mirror of
https://github.com/stablyai/orca.git
synced 2026-10-31 00:57:45 +00:00
* feat(relay): Cloud Storage bucket for the per-cell runtime switch files <project_id>-relay-control, versioned, uniform access, public access prevented. Cells and directors read; only the flag workflow's deploy identity writes. Apply with a targeted apply, never a root plan. * fix(relay): scope the switch-file writer to cells/ with a minimal custom role; soft-delete keeps history The deploy identity is shared, so its grant now reaches only cells/<cellId>.json and carries only get, create and delete. A 90-day soft-delete window keeps every deleted generation recoverable, since overwrite needs delete and delete also reaches old versions. * refactor(relay): drop the speculative directors.json read grant from the control bucket