One public hub, one private layer

The short version

The public site is a static build published from this repository. The private layer is a second build of the same repository, uploaded to a content bucket and served through a Cloud Run gate that checks a Firebase session and a Firestore access policy. Research projects publish into that bucket as versioned manifests, so a project can be updated without rebuilding the hub.

Three guardrails keep private work private: a styled not-found response that is identical whether a private page is missing or forbidden; an allowlist for what may be published to the public origin; and a leak check that scans every public byte for the titles, summaries, slugs and paths of private items.

Who sees what

A signed-out visitor sees the public research, papers, CV and writing. Signing in does not open a second site: it adds Projects, Calendar and Notes to the same menu. The owner also sees an Admin area for members, access rules, share links and publish status.