Build reference — full portal admin UX: companies, GCP projects, deploy queue, 5-step create app (backend→frontend), app tabs (config / deploy / observe / secrets), billing, audit. No real API calls.
Maps to: Firebase Auth → GET /api/me → role=admin
Reference mockup — use this screen map when building portal/frontend
com-a backend + frontend never mismatch with com-b.
Backend deploys first; frontend build receives the live backend URL.
GET /api/admin/gcp-projects
GET /api/apps · deploy queue
GET /api/admin/deploy-queue · queue_id, bundle_id, company_id, app_id, phase
| Company | ID | GCP projects | Apps |
|---|
GET /api/admin/companies · POST · PATCH · DELETE (409 if apps exist)
GET /api/admin/deploy-queue · Cloud Tasks / Firestore worker
| Company | GCP project ID | Display name | Source | Apps | Billing |
|---|
Firestore gcp_projects/{project_id} · company_id · billing_account_id
| Name | ID | Default LLM | Apps using |
|---|
GET /api/personas · POST /api/personas · PATCH /api/personas/{id}
| App | Company | GCP project | Status | Sight | Revision | Actions |
|---|
Admin can force Sight OFF on any app → POST /api/apps/{id}/sight
service_name=rag-{app_id}.
| Company | GCP project | Est. 30d | Billing | Apps |
|---|
GET /api/admin/billing
| Name | Role | Status |
|---|
POST /api/admin/developers/invite · PATCH role · DELETE revoke
PATCH /api/admin/settings → Firestore portal_settings/global
| When | App | Event | Actor | Detail |
|---|
GET /api/admin/audit?from=… · deployment_events collection
Register a project the customer already created in GCP Console.