Review follow-up. `deployedPolicyBase` spread the app file's policy over the
deployed one, and older pulls wrote the whole policy into that file — so a repo
still carrying `on_behalf_of` (a stale value, or the explicit `null` a pull used
to write) or a legacy `triggerables` map fed both back into the deploy. The
first re-permissioned the app from checked-in content, the second restored
grants for runnables the deploy had removed. `pushRawApp` compounded it by
gating `preserve_on_behalf_of` on the merged policy rather than the deployed
one, which also let a create bypass the folder default.
The run-as identity and every derived grant (`triggerables`, `s3_inputs`,
`allowed_s3_keys`) now come off the deployed policy or not at all, and the raw
path claims an identity only on update, matching the low-code path.
Also honour a file-stated `execution_mode: viewer`, which had no other way to
survive a first deploy, and warn a non-deployer that a raw-app push reassigns
ownership — `preCheckPermissionedAs` covered `app` but not `raw_app`.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01MaJ9KHDeaWrWUdVsHeHQ8L
Diego ImbertandClaude Opus 5
3ef858807c