TODO¶

The container serves no HTML page: files/Dockerfile:59 starts flask_app:app, while upstream’s Procfile starts app:app, and only upstream’s app.py imports the modules that register the page routes (front page, documentation, sign-in chooser, user pages). / therefore answers with Werkzeug’s 404 without <head> or <body>, as files/playwright/playwright.spec.js:17 and the two matomo-track exemptions in meta/services.yml already state, and neither the corporate design nor any other injection has a document to attach to (read from the role and from upstream at commit e7c6f80e35330c249e35205ce9e181ebc24531e2, not measured on a stack). Options: start app:app together with the datastore emulator the README mentions and templates/compose.yml.j2 does not declare; or declare the role as API-only and take it out of the web interface scope.
templates/env.j2:7-10 renders BRIDGY_APPVIEW_HOST, BRIDGY_PLC_HOST, BRIDGY_BGS_HOST and BRIDGY_PDS_HOST, while upstream reads APPVIEW_HOST, PLC_HOST, BGS_HOST and PDS_HOST (config.py:116-118, hub.py:201-203), so the rendered values reach no code path (read from both sources, not measured). Options: render the names upstream reads; or drop the four lines.
Upstream’s config.py:39-47 takes its SECRET_KEY from a debug branch whenever appengine_info.DEBUG is set, and that value is a constant published in the upstream repository (read; how the flag is derived outside Google’s runtimes and what the container resolves it to was not measured). Today no served route uses a session. Once app:app serves pages, sessions and the administration endpoints would be signed with a public key. Options: make the container leave the debug branch and provide a generated key the way the other branch reads it, before the entry point changes.
Upstream’s sign-in chooser opens its provider fields through inline event handlers, and meta/csp.yml grants no flag for them (read from upstream’s templates and the role file, not measured). This only matters once the pages are served. Options: grant script-src-attr what the handlers need, with the reason next to it; or keep the chooser out of scope.