The one project that is public on purpose

neon-law-marketing is the exception, and it proves the rule. It holds the brand marketing site as static files — a React build, no server, no database, no cluster — and its buckets are anonymously readable, because a GCS backend bucket behind a load balancer is fetched anonymously and there is no service-account path for one.

So it carries a project-scoped override of constraints/iam.allowedPolicyMemberDomains. The organization-wide constraint is untouched, and every runtime project still inherits it.

	Runtime projects	neon-law-marketing
Buckets	private, objectAdmin to named identities	allUsers objectViewer
Contents	client documents, exports, logs	published marketing HTML
Serves	authenticated requests	static files only
Provisioner	ops gcp setup	ops gcp marketing setup

navigator ops gcp marketing setup --dry-run
navigator ops gcp marketing setup