[anth-volk]

Fixes #265

Summary

Documentation only: frontend/HOSTED_RUNTIME.md now describes how the dashboard is hosted and deployed on main today. No code, workflow or setting changes.

• Model identity: .py 6.7.5 (policyengine[us]==6.7.5), which certifies the same populace-us-2024-spm-20260915 release and pins the same policyengine-us 2.2.1, policyengine-core 3.33.0 and spm-calculator 1.0.0 as 6.4.1. The 2026-10-16 memory measurement is labelled as taken under 6.4.1, with the same package versions.
• Stored-input renames: a new section on .py's legacy_inputs.apply_legacy_input_renames_to_microsimulation, which the hosted runtime and the evaluation harness call after building each simulation. It also covers where the response and the image-build receipt record the renames, and an upgrade step for checking them.
• Production deployment: the steps now include the Google Cloud authentication and metadata-only read-secret check, the workspace install, and the calibration release checks before and after promotion. They also say that deploys start only for CI runs on main (Start production deploy runs only for main CI runs #261), and how CI's cancellation of an unfinished main run skips that commit's deploy. Added the retry behaviour of the metadata and post-promotion checks.
• Settings: a table of every setting the workflow reads, with its provider and where it is read, plus the settings the Vercel project supplies itself.
• Collector reads: how the server reads its credential from Google Secret Manager with the deployment's Vercel OIDC token, and that the collector deploys from PolicyEngine/microcosm-collector. The text doesn't name this repository's old collector directory or workflow, so it stays valid after Remove telemetry-service/ now that the collector deploys from its own repo #234.
• Hugging Face reads: which token each reader uses, and that the Modal backend reads the public release without a token.
• POPULACE_HF_REPO/POPULACE_HF_REVISION: corrected. Only the Modal backend's own environment feeds them to the calculation, and that environment sets neither. On Vercel, POPULACE_HF_REPO only redirects US release discovery.
• Other changes: removed the reference to an agent-secret tool that this repository doesn't define. Made every path relative to the repository root (for example frontend/scripts/hosted_release.json, not scripts/hosted_release.json). Kept the #automated-production-deployment and #promotion-and-rollback anchors that README.md, docs/calibration-tree-artifacts.md and deploy.yml's error message link to.

Deployment configuration (documented, not changed)

Setting	Provider	Wiring	Checked
MODAL_TOKEN_ID, MODAL_TOKEN_SECRET	PolicyEngine organization Actions secrets	step env: → Modal client	Names listed 2026-10-26
MICROCOSM_MODAL_KEY, MICROCOSM_MODAL_SECRET	Production environment secrets	step env: → deployment_smoke.py; deploy-dashboard.sh → vercel deploy --env → frontend/app/api/microcosm/variable/route.ts	Names listed
VERCEL_TOKEN, VERCEL_AUTOMATION_BYPASS_SECRET	Production environment secrets	step env: → Vercel CLI; staged checks	Names listed
HF_RELEASE_READ_TOKEN	repository Actions secret	step env: → vercel deploy --env HF_TOKEN=…	Name listed; token scope unverified
MICROCOSM_TELEMETRY_COLLECTOR_URL	Production environment variable	step env: → vercel deploy --env → telemetry-collector-client.ts	Name listed
TELEMETRY_GCP_WIF_PROVIDER, TELEMETRY_GCP_DEPLOY_SERVICE_ACCOUNT	Production environment secrets	google-github-actions/auth	Names listed; the 2026-10-26 deploy run passed the read-secret check
TELEMETRY_GCP_PROJECT_ID, TELEMETRY_READ_SECRET_NAME	Production environment variables	step env: → read-secret check	Names listed
MICROCOSM_TELEMETRY_READ_SECRET_VERSION, MICROCOSM_TELEMETRY_GOOGLE_IDENTITY_PROVIDER	Vercel project settings (Production and Preview)	server runtime → telemetry-collector-client.ts, secret-manager.ts	Names listed with vercel env ls; values and the Google identity bindings unverified
POPULACE_UK_STAGING_HF_TOKEN, BLOB_READ_WRITE_TOKEN, HF_WEBHOOK_SECRET, GITHUB_ACTIONS_DISPATCH_TOKEN, SLACK_WEBHOOK_POPULACE_*, CROSS_DATASET_ARTIFACT_BASE_URL*	Vercel project settings	server runtime	Names listed

Also read on 2026-10-26, read-only: the Vercel project's root directory is frontend, autoAssignCustomDomains is false, OIDC is turned on with the team issuer, and neither Vercel environment sets POPULACE_HF_REPO or POPULACE_HF_REVISION. policyengine/populace-us answers unauthenticated requests. The Production GitHub environment has no protection rules, and the main Modal environment holds 31 calibration-diagnostics-* applications.

Not verified

• Which of the Vercel project's own Production HF_TOKEN and the --env HF_TOKEN value a production deployment uses.
• The Google Workload Identity provider's trust in Vercel's issuer, and each identity's access to its read secret. gcloud needed a new login, which I didn't run. As indirect evidence, a public request to the production build-runs route (US) returned no collector read problem.
• Whether Vercel sets VERCEL_GIT_COMMIT_SHA for the workflow's CLI deployments. The route falls back to MICROCOSM_BACKEND_SOURCE_COMMIT, which is the same commit.

Overlap with #234

#234 doesn't edit this file, and no file it edits links to it. It changes the "Check collector read secret exists" step in deploy.yml, which this document describes only by behaviour (a metadata-only gcloud secrets describe). Both versions of that step behave that way. Its new test_no_tracked_file_refers_to_the_removed_collector_directory fails on any tracked file that mentions the removed directory or its workflow by path, and this document mentions neither. #234 also adds "Reading the collector" to docs/build-monitor.md. That section covers the same three settings in more detail. This document links to docs/build-monitor.md without an anchor, so it works before and after #234.

Tests

Documentation only, so no tests. The repository has no Markdown or docs checks. I checked that every repository path the document names exists and that its section links resolve.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
calibration-diagnostics	Ready	Preview	Oct 26, 2026 3:11pm UTC