fix: autogenerate mission name

.claude/launch.json

@@ -0,0 +1,20 @@
+{
+  "version": "0.0.1",
+  "configurations": [
+    {
+      "name": "mission-control",
+      "runtimeExecutable": "npm",
+      "runtimeArgs": ["run", "dev", "--prefix", "mission-control"],
+      "port": 3000
+    },
+    {
+      "name": "yard-satellite",
+      "runtimeExecutable": "bash",
+      "runtimeArgs": [
+        "-c",
+        "set -a && source mission-control/.env && cd yard/satellite && python3 web_server.py"
+      ],
+      "port": 3001
+    }
+  ]
+}

.github/workflows/ci.yml

@@ -0,0 +1,127 @@
+name: CI
+
+# Build + test gate. Set these jobs as REQUIRED status checks on main
+# (Settings → Branches → main → Require status checks to pass) so a red
+# build can never be merged again.
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+# Public Firebase web config is required at build time. These are placeholders
+# so `next build` is deterministic in CI; they are NOT secrets (real values live
+# in each app's .env, which is git-ignored).
+env:
+  NEXT_PUBLIC_FIREBASE_API_KEY: ci-placeholder
+  NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN: ci-placeholder.firebaseapp.com
+  NEXT_PUBLIC_FIREBASE_PROJECT_ID: ci-placeholder
+  NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET: ci-placeholder.appspot.com
+  NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID: "0000000000"
+  NEXT_PUBLIC_FIREBASE_APP_ID: "1:0000000000:web:0000000000000000000000"
+
+jobs:
+  mission-control:
+    name: mission-control (build + test)
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: mission-control
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: mission-control/package-lock.json
+      - run: npm ci
+      - run: npm run lint
+      # The yard satellite serves a compiled copy of the rover simulator so its
+      # monitor page can animate a fake rover with the same physics and
+      # renderer the learner's mission page uses. That copy is committed (the
+      # Pi has no Node toolchain), so this fails the build if it no longer
+      # matches the TypeScript it was built from.
+      - run: npm run check:roversim
+      - run: npx next build
+      - run: npx jest --ci
+
+  yard-rover:
+    name: yard rover (python tests)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - name: Install rover deps
+        run: pip install -r yard/rover/requirements.txt
+      - name: Run rover tests
+        working-directory: yard/rover
+        run: python -m pytest -q
+
+  # The satellite is where mission locking, the offline sync worker, the
+  # operator console and the rover stop-control all live, and none of it was
+  # gated: this job did not exist, so ~200 tests covering the most
+  # safety-relevant code in the repo could go red without failing a build.
+  yard-satellite:
+    name: yard satellite (python tests)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - name: Install satellite test deps
+        run: pip install -r yard/satellite/requirements-test.txt
+      - name: Run satellite tests
+        working-directory: yard/satellite
+        run: python -m pytest tests -q
+
+  # The two browser-driven files (test_blockly_codegen, test_status_page) are
+  # skipped by tests/conftest.py whenever playwright is absent, and
+  # requirements-test.txt deliberately leaves it out so a plain `pytest tests`
+  # works anywhere. The consequence was that they ran on nobody's machine
+  # unless someone installed playwright by hand: the yard editor's Blockly
+  # generator, the one thing a learner's program passes through before it
+  # reaches a rover, had no gate at all.
+  #
+  # Caught for real. Moving the block definitions into a shared module turned
+  # code.html's script into an ES module, module scope is not global, and all
+  # seven codegen tests broke. Nothing in CI would have said so.
+  #
+  # A separate job because it is the slow one: it downloads a browser (cached
+  # below) and needs network access for Blockly from unpkg. Keeping it out of
+  # yard-satellite leaves that job's ~2s feedback intact.
+  yard-browser:
+    name: yard browser tests (blockly codegen)
+    runs-on: ubuntu-latest
+    env:
+      # Pinned rather than floating, for the same reason terraform_version is:
+      # a new release should not change what CI does under the team, and the
+      # browser cache below is keyed on this exact value.
+      PLAYWRIGHT_VERSION: "1.62.0"
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - name: Install satellite test deps
+        run: |
+          pip install -r yard/satellite/requirements-test.txt
+          pip install "playwright==${PLAYWRIGHT_VERSION}" pytest-playwright
+
+      # Chromium is ~95MB. Keyed on the pinned version so bumping it fetches a
+      # matching browser instead of silently reusing an incompatible one.
+      - uses: actions/cache@v4
+        id: pw-cache
+        with:
+          path: ~/.cache/ms-playwright
+          key: playwright-${{ runner.os }}-${{ env.PLAYWRIGHT_VERSION }}
+      - name: Install chromium
+        if: steps.pw-cache.outputs.cache-hit != 'true'
+        run: python -m playwright install --with-deps chromium
+
+      - name: Run browser tests
+        working-directory: yard/satellite
+        run: python -m pytest tests/test_blockly_codegen.py tests/test_status_page.py -q

.github/workflows/deploy-prod.yml

@@ -0,0 +1,73 @@
+name: Deploy prod
+
+# Prod promotion (Werner's deploy guide, Phase 3).
+#
+# Manually triggered, gated by the GitHub "production" Environment (configure
+# required reviewers there: Werner and/or Gavin approve). Promotes the image
+# digest CURRENTLY SERVING on staging to the prod service: the exact bytes
+# that were smoke-checked, no rebuild.
+#
+# Rollback is the same mechanism in reverse: rerun this workflow after
+# pointing staging at the previous digest, or
+#   gcloud run services update-traffic / gcloud run deploy --image <old digest>
+#
+# Variables (from Terraform outputs): GCP_WIF_PROVIDER, GCP_DEPLOY_SA,
+# GCP_PROJECT_ID, GCP_REGION, STAGING_SERVICE, PROD_SERVICE, PROD_URL.
+# PROD_URL is the load-balancer URL (service_urls.prod), not *.run.app.
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  id-token: write # OIDC token for WIF
+
+concurrency:
+  group: deploy-prod
+  cancel-in-progress: false
+
+jobs:
+  promote:
+    name: Promote staging digest to prod
+    runs-on: ubuntu-latest
+    environment: production
+    steps:
+      - id: auth
+        uses: google-github-actions/auth@v2
+        with:
+          workload_identity_provider: ${{ vars.GCP_WIF_PROVIDER }}
+          service_account: ${{ vars.GCP_DEPLOY_SA }}
+
+      - uses: google-github-actions/setup-gcloud@v2
+
+      - name: Read the digest serving on staging
+        run: |
+          IMAGE=$(gcloud run services describe "${{ vars.STAGING_SERVICE }}" \
+            --project "${{ vars.GCP_PROJECT_ID }}" --region "${{ vars.GCP_REGION }}" \
+            --format='value(spec.template.spec.containers[0].image)')
+          echo "Promoting: $IMAGE"
+          case "$IMAGE" in
+            *@sha256:*) ;;
+            *) echo "Staging is not pinned to a digest; refusing to promote a mutable tag" >&2; exit 1 ;;
+          esac
+          echo "IMAGE=$IMAGE" >> "$GITHUB_ENV"
+
+      - name: Deploy Cloud Run prod
+        run: |
+          gcloud run deploy "${{ vars.PROD_SERVICE }}" \
+            --project "${{ vars.GCP_PROJECT_ID }}" \
+            --region "${{ vars.GCP_REGION }}" \
+            --image "$IMAGE" \
+            --quiet
+
+      - name: Smoke check
+        run: |
+          URL="${{ vars.PROD_URL }}"
+          if [ -z "$URL" ]; then
+            echo "PROD_URL GitHub variable is unset; copy terraform output service_urls.prod" >&2
+            exit 1
+          fi
+          echo "Prod URL: $URL"
+          curl -sSf -o /dev/null "$URL/"
+          test "$(curl -s -o /dev/null -w '%{http_code}' "$URL/operator")" = "404"
+          echo "Smoke check passed"

.github/workflows/deploy-staging.yml

@@ -0,0 +1,102 @@
+name: Deploy staging
+
+# CD for mission-control (Werner's deploy guide, Phase 2).
+#
+# Runs only after the CI workflow finishes GREEN on main: build the Docker
+# image, push it to Artifact Registry tagged with the git SHA (immutable
+# artifact), deploy Cloud Run staging to that exact digest, then smoke-check.
+#
+# Auth is Workload Identity Federation (GitHub OIDC -> deploy service
+# account): no downloaded JSON keys anywhere. All environment-specific values
+# come from GitHub *variables* (Settings -> Secrets and variables -> Actions
+# -> Variables), which are filled from Terraform outputs once Phase 1 lands:
+#
+#   GCP_WIF_PROVIDER        projects/N/locations/global/workloadIdentityPools/github/providers/github
+#   GCP_DEPLOY_SA           deploy SA email (push image + update Cloud Run)
+#   GCP_PROJECT_ID          bt-impact-academy
+#   GCP_REGION              e.g. africa-south1
+#   GCP_AR_REPO             Artifact Registry docker repo name
+#   STAGING_SERVICE         e.g. mission-control-staging
+#   STAGING_URL             load-balancer URL from terraform output service_urls.staging
+#                           (NOT the Cloud Run *.run.app URI — that 403s without allUsers)
+#   NEXT_PUBLIC_FIREBASE_*  public web config for the staging Firebase app
+#   NEXT_PUBLIC_APP_URL     same as STAGING_URL (baked into the image at build time)
+#
+# Server secrets (FIREBASE_* admin credentials) are NOT here: Terraform wires
+# them from Secret Manager onto the Cloud Run service itself.
+
+on:
+  workflow_run:
+    workflows: [CI]
+    types: [completed]
+    branches: [main]
+
+permissions:
+  contents: read
+  id-token: write # OIDC token for WIF
+
+concurrency:
+  group: deploy-staging
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    name: Build, push, deploy staging
+    runs-on: ubuntu-latest
+    if: github.event.workflow_run.conclusion == 'success'
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.workflow_run.head_sha }}
+
+      - id: auth
+        uses: google-github-actions/auth@v2
+        with:
+          workload_identity_provider: ${{ vars.GCP_WIF_PROVIDER }}
+          service_account: ${{ vars.GCP_DEPLOY_SA }}
+
+      - uses: google-github-actions/setup-gcloud@v2
+
+      - name: Configure docker for Artifact Registry
+        run: gcloud auth configure-docker ${{ vars.GCP_REGION }}-docker.pkg.dev --quiet
+
+      - name: Build image (tag = git SHA)
+        working-directory: mission-control
+        run: |
+          IMAGE="${{ vars.GCP_REGION }}-docker.pkg.dev/${{ vars.GCP_PROJECT_ID }}/${{ vars.GCP_AR_REPO }}/mission-control:${{ github.event.workflow_run.head_sha }}"
+          echo "IMAGE=$IMAGE" >> "$GITHUB_ENV"
+          docker build \
+            --build-arg NEXT_PUBLIC_APP_URL='${{ vars.NEXT_PUBLIC_APP_URL }}' \
+            --build-arg NEXT_PUBLIC_FIREBASE_API_KEY='${{ vars.NEXT_PUBLIC_FIREBASE_API_KEY }}' \
+            --build-arg NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN='${{ vars.NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN }}' \
+            --build-arg NEXT_PUBLIC_FIREBASE_PROJECT_ID='${{ vars.NEXT_PUBLIC_FIREBASE_PROJECT_ID }}' \
+            --build-arg NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET='${{ vars.NEXT_PUBLIC_FIREBASE_STORAGE_BUCKET }}' \
+            --build-arg NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID='${{ vars.NEXT_PUBLIC_FIREBASE_MESSAGING_SENDER_ID }}' \
+            --build-arg NEXT_PUBLIC_FIREBASE_APP_ID='${{ vars.NEXT_PUBLIC_FIREBASE_APP_ID }}' \
+            --build-arg NEXT_PUBLIC_FIREBASE_MEASUREMENT_ID='${{ vars.NEXT_PUBLIC_FIREBASE_MEASUREMENT_ID }}' \
+            -t "$IMAGE" .
+
+      - name: Push image
+        run: docker push "$IMAGE"
+
+      - name: Deploy Cloud Run staging (by digest)
+        run: |
+          DIGEST=$(gcloud artifacts docker images describe "$IMAGE" --format='value(image_summary.digest)')
+          gcloud run deploy "${{ vars.STAGING_SERVICE }}" \
+            --project "${{ vars.GCP_PROJECT_ID }}" \
+            --region "${{ vars.GCP_REGION }}" \
+            --image "${IMAGE%%:*}@${DIGEST}" \
+            --quiet
+
+      - name: Smoke check
+        run: |
+          URL="${{ vars.STAGING_URL }}"
+          if [ -z "$URL" ]; then
+            echo "STAGING_URL GitHub variable is unset; copy terraform output service_urls.staging" >&2
+            exit 1
+          fi
+          echo "Staging URL: $URL"
+          # Learner home must serve via the load balancer; the operator surface must NOT exist.
+          curl -sSf -o /dev/null "$URL/"
+          test "$(curl -s -o /dev/null -w '%{http_code}' "$URL/operator")" = "404"
+          echo "Smoke check passed"