@atmem/architect 0.0.0-stage → 0.2.0-alpha.4.1

package/src/invoice-dependencies.mjs

@@ -0,0 +1,43 @@
+import aws from './runtime/aws-web-python-lock.json' with {type:'json'};
+import azure from './runtime/azure-python-lock.json' with {type:'json'};
+import gcp from './runtime/web-python-lock.json' with {type:'json'};
+import ibm from './runtime/ibm-python-lock.json' with {type:'json'};
+import durable from './runtime/durable-python-lock.json' with {type:'json'};
+import testing from './runtime/azure-test-lock.json' with {type:'json'};
+
+const normalize=name=>name.toLowerCase().replaceAll(/[_.]+/g,'-');
+function entries(lock){
+ const result=[];let current;
+ for(const line of lock.requirements.trim().split('\n')){
+  if(!line.trim())continue;
+  if(lock===testing&&line==='-r requirements.lock')continue; // Already merged above.
+  const start=/^([A-Za-z0-9_.-]+)==([^\s\\]+)((?:\s+--hash=sha256:[0-9a-f]{64})*)(?:\s*\\)?$/.exec(line);
+  if(start){current={name:normalize(start[1]),version:start[2],hashes:new Set([...start[3].matchAll(/--hash=sha256:([0-9a-f]{64})/g)].map(match=>match[1]))};result.push(current);continue;}
+  const hash=/^\s+--hash=sha256:([0-9a-f]{64})(?:\s*\\)?$/.exec(line);
+  if(!hash||!current)throw Error('Invoice dependencies must be exact reviewed version/hash records');current.hashes.add(hash[1]);
+ }
+ if(!result.length||result.some(entry=>!entry.hashes.size)||new Set(result.map(e=>e.name)).size!==result.length)throw Error('Incomplete or duplicate reviewed dependency records');return result;
+}
+
+// One explicit composition decision, not a general dependency-conflict override.
+// IBM SDK 3.28.2 requires dateutil >=3,<3.1; Procrastinate/croniter accept it.
+// The resulting queue composition still requires independent runtime tests.
+export function invoiceDependencies(provider,{tests=false}={}){
+ const native={aws,azure,gcp,ibm}[provider];if(!native)throw Error('Unsupported invoice dependency provider');
+ const locks=[native,durable,...(tests?[testing]:[])],merged=new Map(),resolutions=[];
+ for(const lock of locks)for(const entry of entries(lock)){
+  if(provider==='aws'&&entry.name==='mangum')continue; // Fargate, not Lambda.
+  const previous=merged.get(entry.name);
+  if(previous&&previous.version!==entry.version){
+   if(provider==='ibm'&&entry.name==='python-dateutil'&&new Set([previous.version,entry.version]).size===2&&[previous.version,entry.version].every(v=>['2.9.0.post0','3.0.0'].includes(v))){
+    merged.set(entry.name,previous.version==='3.0.0'?previous:entry);resolutions.push({name:entry.name,selected:'3.0.0',otherReviewedPin:'2.9.0.post0',reason:'IBM SDK requires >=3,<3.1; queue dependency permits it. Whole composition qualification is mandatory.'});continue;
+   }throw Error('Unreviewed invoice dependency conflict for '+entry.name);
+  }
+  if(previous)for(const hash of entry.hashes)previous.hashes.add(hash);else merged.set(entry.name,entry);
+ }
+ const records=[...merged.values()].sort((a,b)=>a.name.localeCompare(b.name));
+ const requirements=records.map(e=>e.name+'=='+e.version+' \\\n'+[...e.hashes].sort().map((h,i,all)=>'    --hash=sha256:'+h+(i<all.length-1?' \\':'')).join('\n')).join('\n')+'\n';
+ const sourceMap=new Map();for(const lock of locks)for(const source of lock.sources){const key=normalize(source.name),selected=merged.get(key);if(selected?.version===source.version)sourceMap.set(key,source);}
+ if(records.some(record=>!sourceMap.has(record.name)))throw Error('Missing dependency provenance');
+ return{requirements,sources:[...sourceMap.values()],resolutions,scope:'Reviewed dependency union; generation is not a runtime/clean-security claim'};
+}

package/src/invoice-gcp-operations.mjs

@@ -0,0 +1,178 @@
+import{v,r,l}from'./invoice-builder.mjs';
+
+export function gcpInvoiceOperations(b,n,{destination,region,sa,member,proxy}){
+ const{add,input}=b;
+ for(const key of ['operations_enabled','maintenance_enabled']){b.variable[key]={type:'bool',default:false,description:key==='operations_enabled'?'After immutable image publication, create fixed private SQL operator jobs before application release.':'Enable daily cleanup/hourly monitor after owned SQL bootstrap. Verify live telemetry/notification acceptance before application release.'};b.examples[key]=false;b.testExpressions[key]='true';}
+ const channel=input('operator_notification_channel','Existing verified on-call Cloud Monitoring channel in this project, referenced without modification.','projects/'+b.examples.project_id+'/notificationChannels/123456789012','^projects/[a-z][a-z0-9-]{4,28}[a-z0-9]/notificationChannels/[0-9]+$');
+ b.resource.terraform_data.review_gate.lifecycle.precondition.push({condition:'${!var.maintenance_enabled || var.operations_enabled}',error_message:'Scheduled maintenance requires separate operator jobs.'},{condition:'${!var.applications_enabled || (var.operations_enabled && var.maintenance_enabled)}',error_message:'Complete owned SQL, membership and operating telemetry acceptance before application release.'},{condition:'${startswith(var.operator_notification_channel,format("projects/%s/notificationChannels/",var.project_id))}',error_message:'Use the reviewed notification channel in this destination project.'});
+ b.locals.operator_deployment=b.output.operator_deployment.value;
+ for(const[purpose,service]of[['scheduler','cloudscheduler.googleapis.com'],['logging','logging.googleapis.com'],['monitoring','monitoring.googleapis.com']])add('google_project_service',n+'_'+purpose,{project:destination,service,disable_on_destroy:false});
+ add('google_project_service_identity',n+'_scheduler',{provider:'google-beta',project:destination,service:'cloudscheduler.googleapis.com',depends_on:['google_project_service.'+n+'_scheduler']});
+ add('google_project_iam_member',n+'_scheduler_service_agent',{project:destination,role:'roles/cloudscheduler.serviceAgent',member:r('google_project_service_identity',n+'_scheduler','member')});
+ add('google_service_account',n+'_scheduler',{project:destination,account_id:l('name')+'-scheduler',display_name:'Only invoke owned maintenance/monitor jobs; no SQL/data/bootstrap/override authority',depends_on:['google_project_service.'+n+'_identity']});
+ const settings={DATABASE_NAME:'invoice',DATABASE_CONNECTION_NAME:r('google_sql_database_instance',n,'connection_name'),DATABASE_TRANSPORT:'cloudsql-private-proxy',DATABASE_SERVICE_ACCOUNT:sa('ops','email'),OPERATOR_PROXY_SHUTDOWN:'cloudsql-private-proxy',OPERATOR_DEPLOYMENT_BASE64:'${base64encode(jsonencode(local.operator_deployment))}'};
+ for(const action of ['initialize','maintain','monitor']){
+  const operator={name:'operator',image:v('runtime_image'),command:['python','-I','/app/invoice_operator_job.py',action,'--execute'],resources:{limits:{cpu:'1',memory:'1Gi'}},env:Object.entries(settings).map(([name,value])=>({name,value}))};
+  // Stable concurrent startup; the operator waits on /startup itself and always
+  // POSTs /quitquitquit, so a completed/failed task cannot leave this sidecar alive.
+  const sidecar={name:'cloud-sql-proxy',image:proxy.image,args:['--private-ip','--address=127.0.0.1','--port=5432','--structured-logs','--lazy-refresh','--health-check','--http-address=127.0.0.1','--http-port=9090','--quitquitquit','--admin-port=9091','--exit-zero-on-sigterm',r('google_sql_database_instance',n,'connection_name')],resources:{limits:{cpu:'1',memory:'256Mi'}}};
+  add('google_cloud_run_v2_job',n+'_operator_'+action,{count:'${var.operations_enabled ? 1 : 0}',project:destination,name:l('name')+'-'+action,location:region,deletion_protection:true,launch_stage:'GA',template:{parallelism:1,task_count:1,template:{service_account:sa('ops','email'),execution_environment:'EXECUTION_ENVIRONMENT_GEN2',timeout:'960s',max_retries:0,containers:[operator,sidecar],vpc_access:{egress:'PRIVATE_RANGES_ONLY',network_interfaces:{network:r('google_compute_network',n,'name'),subnetwork:r('google_compute_subnetwork',n,'name')}}}},depends_on:['google_project_service.'+n+'_run','google_artifact_registry_repository_iam_member.'+n,'google_sql_database.'+n,'google_sql_user.'+n+'_ops','google_sql_user.'+n+'_api','google_sql_user.'+n+'_worker','google_project_iam_member.'+n+'_ops_connect','google_project_iam_member.'+n+'_ops_login']});
+  if(action==='initialize')continue;
+  add('google_cloud_run_v2_job_iam_member',n+'_operator_'+action,{count:'${var.operations_enabled ? 1 : 0}',project:destination,location:region,name:r('google_cloud_run_v2_job',n+'_operator_'+action+'[0]','name'),role:'roles/run.invoker',member:'serviceAccount:'+r('google_service_account',n+'_scheduler','email')});
+  add('google_cloud_scheduler_job',n+'_'+action,{count:'${var.operations_enabled ? 1 : 0}',project:destination,region,name:l('name')+'-'+action,schedule:action==='maintain'?'17 2 * * *':'7 * * * *',time_zone:'Etc/UTC',paused:'${!var.maintenance_enabled}',attempt_deadline:'180s',retry_config:{retry_count:2,min_backoff_duration:'10s',max_backoff_duration:'60s',max_retry_duration:'300s'},http_target:{http_method:'POST',uri:'https://run.googleapis.com/v2/projects/'+destination+'/locations/'+region+'/jobs/'+l('name')+'-'+action+':run',body:'${base64encode("{}")}',headers:{'Content-Type':'application/json'},oauth_token:{service_account_email:r('google_service_account',n+'_scheduler','email'),scope:'https://www.googleapis.com/auth/cloud-platform'}},depends_on:['google_project_service.'+n+'_scheduler','google_project_iam_member.'+n+'_scheduler_service_agent','google_cloud_run_v2_job_iam_member.'+n+'_operator_'+action]});
+ }
+ const jobNames=['initialize','maintain','monitor'].map(action=>'resource.labels.job_name="'+l('name')+'-'+action+'"').join(' OR ');
+ const failures='resource.type="cloud_run_job" AND resource.labels.location="'+region+'" AND ('+jobNames+') AND ((jsonPayload.format="invoice-operator-v1" AND (jsonPayload.status="failed" OR jsonPayload.status="attention" OR jsonPayload.status="backlog")) OR severity>=ERROR)';
+ const schedulerFailures='resource.type="cloud_scheduler_job" AND resource.labels.location="'+region+'" AND (resource.labels.job_id="'+l('name')+'-maintain" OR resource.labels.job_id="'+l('name')+'-monitor") AND severity>=ERROR';
+ const success='resource.type="cloud_run_job" AND resource.labels.location="'+region+'" AND resource.labels.job_name="'+l('name')+'-monitor" AND jsonPayload.format="invoice-operator-v1" AND jsonPayload.action="monitor" AND jsonPayload.status="ok"';
+ for(const[purpose,filter]of[['failed',failures],['scheduler_failed',schedulerFailures],['monitor_success',success]]){
+  add('google_logging_metric',n+'_'+purpose,{project:destination,name:l('name')+'-'+purpose,filter,metric_descriptor:{metric_kind:'DELTA',value_type:'INT64',unit:'1'},depends_on:['google_project_service.'+n+'_logging']});
+  b.files['monitoring/'+purpose+'.filter']=filter+'\n';
+ }
+ for(const[purpose,resourceType]of[['failed','cloud_run_job'],['scheduler_failed','cloud_scheduler_job']])add('google_monitoring_alert_policy',n+'_'+purpose,{project:destination,display_name:l('name')+'-'+purpose,combiner:'OR',enabled:v('operations_enabled'),notification_channels:[channel],conditions:[{display_name:'Owned operator or scheduler failure',condition_threshold:{filter:'resource.type="'+resourceType+'" AND metric.type="logging.googleapis.com/user/'+l('name')+'-'+purpose+'"',comparison:'COMPARISON_GT',threshold_value:0,duration:'0s',aggregations:[{alignment_period:'600s',per_series_aligner:'ALIGN_SUM'}],trigger:{count:1}}}],alert_strategy:{auto_close:'1800s'},documentation:{mime_type:'text/markdown',content:'Inspect the owned operator execution/logs and private SQL path. A RunJob acceptance response does not prove task success. Never replay uncertain accounting effects.'},depends_on:['google_project_service.'+n+'_monitoring','google_logging_metric.'+n+'_'+purpose]});
+ // Google absence has a <24h trigger ceiling and requires an initial sample.
+ // Hourly monitoring checks SQL's 92-day overdue invariant instead of emitting
+ // an invalid 48-hour metric-absence rule for a once-daily maintenance job.
+ add('google_monitoring_alert_policy',n+'_monitor_missing',{project:destination,display_name:l('name')+'-monitor-missing',combiner:'OR',enabled:v('maintenance_enabled'),notification_channels:[channel],conditions:[{display_name:'No successful hourly SQL monitor',condition_absent:{filter:'resource.type="cloud_run_job" AND metric.type="logging.googleapis.com/user/'+l('name')+'-monitor_success"',duration:'7200s',aggregations:[{alignment_period:'600s',per_series_aligner:'ALIGN_SUM'}],trigger:{count:1}}}],alert_strategy:{auto_close:'1800s'},documentation:{mime_type:'text/markdown',content:'This absence rule needs an actual successful measurement after policy installation/modification. Run monitor and verify its metric before release. Hourly SQL monitoring reports overdue retention; a never-started metric is not an armed heartbeat.'},depends_on:['google_project_service.'+n+'_monitoring','google_logging_metric.'+n+'_monitor_success']});
+ b.output.operator_start_urls={value:Object.fromEntries(['initialize','maintain','monitor'].map(action=>[action,'https://run.googleapis.com/v2/projects/'+destination+'/locations/'+region+'/jobs/'+l('name')+'-'+action+':run']))};
+ b.output.operator_bootstrap_url={value:'https://run.googleapis.com/v2/projects/'+destination+'/locations/'+region+'/jobs/'+l('name')+'-initialize:run',description:'Use only after reviewed operating-job resources have actually been applied.'};
+ b.output.operator_jobs={value:{project:destination,region,serviceAccount:sa('ops','email'),schedulerServiceAccount:r('google_service_account',n+'_scheduler','email'),notificationChannel:channel,names:Object.fromEntries(['initialize','maintain','monitor'].map(action=>[action,l('name')+'-'+action]))}};
+ b.files['OPERATING_JOBS.md']=GCP_OPERATING_JOBS;
+ b.files['scripts/run-operator.py']=GCP_OPERATOR_RUNNER;
+ b.assertions.push(`run "operator_before_applications" {
+ command = plan
+ variables {
+ applications_enabled = false
+ maintenance_enabled = false
+ staff_principals = []
+ }
+ assert {
+ condition = length(google_cloud_run_v2_job.${n}_operator_initialize) == 1 && google_cloud_scheduler_job.${n}_maintain[0].paused && length(google_cloud_run_v2_service.${n}_api) == 0
+ error_message = "Manual bootstrap must precede scheduled maintenance and application release."
+ }
+}
+run "operator_private_proxy_and_caller" {
+ command = plan
+ assert {
+ condition = google_cloud_run_v2_job.${n}_operator_monitor[0].template[0].template[0].service_account == google_service_account.${n}_ops.email && google_cloud_run_v2_job.${n}_operator_monitor[0].template[0].template[0].max_retries == 0 && contains(google_cloud_run_v2_job.${n}_operator_monitor[0].template[0].template[0].containers[1].args,"--quitquitquit") && google_cloud_run_v2_job_iam_member.${n}_operator_maintain[0].member == "serviceAccount:\${google_service_account.${n}_scheduler.email}"
+ error_message = "Separate SQL operator, private terminating proxy and job-scoped invoker are required."
+ }
+}
+run "operating_jobs_required" {
+ command = plan
+ variables {
+ operations_enabled = false
+ maintenance_enabled = false
+ }
+ expect_failures = [terraform_data.review_gate]
+}
+run "operator_mutable_image_rejected" {
+ command = plan
+ variables {
+ applications_enabled = false
+ maintenance_enabled = false
+ runtime_image = "unreviewed:latest"
+ }
+ expect_failures = [var.runtime_image]
+}
+`);
+}
+
+const GCP_OPERATING_JOBS=`# Google invoice operating jobs
+
+Obtain authorization before account writes, apply, publication or RunJob. Fixed
+operator jobs are not API/model tools. The existing project, verified staff and
+notification channel are referenced, never replaced. Verify the existing channel's
+actual on-call recipients and delivery. Review organization log placement/retention
+and effective inherited IAM; this package does not rewrite existing logging sinks.
+Operator receipts contain counts/status, not invoices, subjects or amounts.
+
+Foundation: applications_enabled=false, operations_enabled=false,
+maintenance_enabled=false. Publish reviewed immutable runtime/parser images into
+the owned regional repository only when authorized. With runtime_image supplied,
+set operations_enabled=true and keep maintenance/applications false. The three
+fixed jobs exist; daily/hourly schedules remain paused.
+
+As the separately authorized destination operator, preview the emitted command:
+
+    python3 scripts/run-operator.py initialize
+
+Then add --execute for the authorized destination. The helper reads nonsecret
+Terraform outputs and invokes gcloud with exact project/region/name and --wait,
+without shell interpolation, overrides or exposing OAuth tokens. Use maintain or
+monitor for the other fixed jobs. Install/authenticate the reviewed Google Cloud
+CLI beforehand. The exact operator_start_urls REST outputs are also available.
+Do not use public invokers or application roles to launch privileged SQL work. RunJob acceptance is asynchronous: retain the actual
+completed execution/exit status and initialized:true receipt before continuing.
+
+The ops service account intentionally has separate cloudsqlsuperuser SQL authority.
+API/worker IAM SQL users must already exist. Bootstrap verifies native IAM markers,
+owned identities, exact schema/grants and scope, never creates a substitute native
+IAM user or adopts unrelated roles. Managed Cloud SQL role mutation, native IAM and
+effective privileges require destination checks; local PostgreSQL is not Cloud SQL.
+Admit verified staff SQL memberships separately; IAP access alone is insufficient.
+Populate the accounting secret outside Terraform/source and outside operator jobs.
+
+Each job has one task, parallelism one, no native retry and a 960-second task limit.
+Its operator waits up to 30 seconds on the pinned proxy's own loopback startup
+endpoint, uses a 900-second work deadline and always calls the loopback shutdown
+endpoint. Initial SQL connection transport failures retry at most three times with
+fresh credentials; authentication/permission/schema errors do not. No insecure
+remote connection, public SQL IP or configurable proxy URL is introduced. The
+maintained proxy uses private IP/upstream TLS and a fixed instance. A failed shutdown
+cannot emit an ok heartbeat; native task timeout remains the final failure bound.
+
+Next enable maintenance_enabled=true while applications_enabled=false. Cleanup
+runs 02:17 UTC daily, monitor at minute 7 hourly. The scheduler uses its own invoker
+identity scoped to maintain/monitor only, OAuth, bounded retries and no bootstrap
+or override/SQL authority. Its service agent has the required native role.
+Manually run monitor and verify a real success metric AFTER policy installation/
+modification: Google's absence policy does not arm from a never-written metric.
+The two-hour monitor absence rule plus failures and hourly SQL retention-overdue
+checks cover operating progress. No invalid 48-hour absence condition is emitted.
+Native platform ERROR logs and count-only failed/attention/backlog receipts alert;
+inspect execution history as well. Test failed scheduling/execution, first-sample,
+missing runs and channel delivery before final applications_enabled=true release.
+
+Daily cleanup is bounded to twenty 500-record transactions and refuses live jobs/
+leases; younger/concurrent work is preserved. Original-object expiry is separate
+and asynchronous. Restore/quarantine/reconciliation remain isolated and paused.
+Local schemas/mocks and fixture SQL do not prove Cloud SQL IAM/TLS, scheduling,
+metric/log ingestion, notification delivery or managed restore. Retain those actual
+destination acceptance receipts; no production readiness is inferred from a URL.
+`;
+
+const GCP_OPERATOR_RUNNER=String.raw`"""Preview or explicitly execute one owned Google operator job from Terraform outputs."""
+import argparse
+import json
+import re
+import subprocess
+import sys
+
+def unique(pairs):
+    result={}
+    for key,value in pairs:
+        if key in result:raise ValueError('Duplicate output field')
+        result[key]=value
+    return result
+
+def command(action,configuration):
+    if action not in {'initialize','maintain','monitor'}or not isinstance(configuration,dict):raise ValueError('Use an owned fixed operator action')
+    project=configuration.get('project');region=configuration.get('region');names=configuration.get('names')
+    if not isinstance(project,str)or not re.fullmatch(r'[a-z][a-z0-9-]{4,28}[a-z0-9]',project)or not isinstance(region,str)or not re.fullmatch(r'[a-z]+-[a-z]+[1-9][0-9]?',region):raise ValueError('Use the emitted destination')
+    if not isinstance(names,dict)or set(names)!={'initialize','maintain','monitor'}or any(not isinstance(name,str)or not re.fullmatch(r'[a-z][a-z0-9-]{1,61}[a-z0-9]',name)for name in names.values())or len(set(names.values()))!=3:raise ValueError('Use distinct owned job names')
+    return ['gcloud','run','jobs','execute',names[action],'--project',project,'--region',region,'--wait','--format=json']
+
+def main():
+    parser=argparse.ArgumentParser(description=__doc__);parser.add_argument('action',choices=['initialize','maintain','monitor']);parser.add_argument('--execute',action='store_true');args=parser.parse_args()
+    result=subprocess.run(['terraform','output','-json','operator_jobs'],capture_output=True,check=True,timeout=30)
+    selected=command(args.action,json.loads(result.stdout,object_pairs_hook=unique))
+    if not args.execute:
+        print(json.dumps({'willWrite':False,'command':selected}));return 0
+    return subprocess.run(selected,timeout=1200).returncode
+
+if __name__=='__main__':
+    try:sys.exit(main())
+    except Exception:
+        print('Operator invocation failed. Check the owned Terraform state, authenticated destination and job execution receipt.',file=sys.stderr);sys.exit(1)
+`;

package/src/invoice-gcp.mjs

@@ -0,0 +1,104 @@
+import {invoiceBuilder,v,r,l}from'./invoice-builder.mjs';
+import {CLOUD_PROVIDER_LOCKS}from'./cloud-provider-locks.mjs';
+import {gcpInvoiceOperations}from'./invoice-gcp-operations.mjs';
+import proxy from'./runtime/cloud-sql-proxy-lock.json'with{type:'json'};
+import proxyReview from'./runtime/cloud-sql-proxy-security-review.json'with{type:'json'};
+
+// Native composition under qualification. Account/model approvals are not invented.
+export function gcpInvoiceTerraform(project,row,environment='staging'){
+ if(row.provider!=='gcp')throw Error('Google invoice compilation cannot substitute another cloud');
+ if(proxyReview.imageIndex!==proxy.image||proxyReview.status!=='reviewed-not-affected-by-listed-findings'||proxyReview.platform!=='linux/amd64')throw Error('Repeat the exact Cloud SQL proxy dependency review before changing its artifact');
+ const b=invoiceBuilder(project,row,environment),{input,add,region}=b,n=row.address;
+ const destination=input('project_id','Existing organization-owned Google Cloud destination project.','reviewed-project','^[a-z][a-z0-9-]{4,28}[a-z0-9]$');
+ const model=input('model_id','Explicit compatible regional Gemini model; verify current regional availability, lifecycle and quotas.','gemini-reviewed-version','^gemini-[a-z0-9.-]{1,80}$');
+ const endpoint=input('accounting_endpoint','Existing reviewed accounting HTTPS adapter, never recreated.','https://accounting.example.test/actions','^https://[A-Za-z0-9.-]+(:[0-9]{1,5})?(/[^?#@ ]*)?$');
+ const scope=input('accounting_scope','Reviewed accounting scope bound to every approval.','owned-team','^[A-Za-z0-9_.:/-]{1,200}$');
+ for(const purpose of ['runtime','parser']){
+  input(purpose+'_image','Exact immutable image in this package-owned Artifact Registry. Empty during foundation.','australia-southeast1-docker.pkg.dev/reviewed-project/reviewed-repository/'+purpose+'@sha256:'+'a'.repeat(64));
+  b.variable[purpose+'_image'].default='';b.variable[purpose+'_image'].validation={condition:'${!('+(purpose==='runtime'?'var.applications_enabled || var.operations_enabled':'var.applications_enabled')+') || can(regex("@sha256:[0-9a-f]{64}$",var.'+purpose+'_image))}',error_message:'Release requires the reviewed immutable image digest.'};
+  b.resource.terraform_data.review_gate.lifecycle.precondition.push({condition:'${!('+(purpose==='runtime'?'var.applications_enabled || var.operations_enabled':'var.applications_enabled')+') || startswith(var.'+purpose+'_image,format("%s-docker.pkg.dev/%s/%s/'+purpose+'@sha256:",var.region,var.project_id,local.name))}',error_message:'Use the package-owned regional Artifact Registry and immutable image.'});
+ }
+ b.variable.staff_principals={type:'set(string)',default:[],description:'Explicit existing staff IAP user/group IAM principals. SQL membership independently governs review/approval.',validation:{condition:'${alltrue([for principal in var.staff_principals : can(regex("^(user|group):[^@ ]+@[^@ ]+[.][^@ ]+$",principal))])}',error_message:'Supply explicit user/group principals; public principals are prohibited.'}};b.examples.staff_principals=['group:invoice-staff@example.test'];
+ b.variable.policy_review_base64={type:'string',default:'',description:'Scoped expiring owner review of actual model privacy/abuse-monitoring terms. Empty blocks inference, never self-approved.'};b.examples.policy_review_base64='';
+ b.variable.replay_review_base64={type:'string',default:'',description:'Scoped expiring accounting replay acceptance. Empty disables automatic uncertain replay.'};b.examples.replay_review_base64='';
+ b.data.google_project={destination:{project_id:destination}};const number=r('data.google_project','destination','number');
+ b.resource.terraform_data.review_gate.lifecycle.precondition.push({condition:'${!var.applications_enabled || length(var.staff_principals)>0}',error_message:'Review exact existing staff IAP admission before release.'});
+ Object.assign(b.locals,{public_origin:'${format("https://%s-api-%s.%s.run.app",local.name,data.google_project.destination.number,var.region)}',parser_origin:'${format("https://%s-parser-%s.%s.run.app",local.name,data.google_project.destination.number,var.region)}',parser_endpoint:'${format("%s/extract",local.parser_origin)}',destination_contract:{id:'normalized-action-v1',endpointSha256:'${sha256(var.accounting_endpoint)}',scope,mappingVersion:1},destination_contract_base64:'${base64encode(jsonencode(local.destination_contract))}'});
+ const services={run:'run.googleapis.com',iap:'iap.googleapis.com',model:'aiplatform.googleapis.com',registry:'artifactregistry.googleapis.com',database:'sqladmin.googleapis.com',network:'compute.googleapis.com',peering:'servicenetworking.googleapis.com',secrets:'secretmanager.googleapis.com',identity:'iam.googleapis.com'};
+ for(const[purpose,service]of Object.entries(services))add('google_project_service',n+'_'+purpose,{project:destination,service,disable_on_destroy:false});
+ for(const purpose of ['run','iap'])add('google_project_service_identity',n+'_'+purpose,{provider:'google-beta',project:destination,service:services[purpose],depends_on:['google_project_service.'+n+'_'+purpose]});
+ add('google_compute_network',n,{project:destination,name:l('name'),auto_create_subnetworks:false,depends_on:['google_project_service.'+n+'_network']});
+ add('google_compute_subnetwork',n,{project:destination,name:l('name'),region,network:r('google_compute_network',n,'id'),ip_cidr_range:'10.86.0.0/24',private_ip_google_access:true});
+ add('google_compute_global_address',n+'_database',{project:destination,name:l('name')+'-database',purpose:'VPC_PEERING',address_type:'INTERNAL',prefix_length:16,address:'10.89.0.0',network:r('google_compute_network',n,'id')});
+ add('google_service_networking_connection',n,{network:r('google_compute_network',n,'id'),service:'servicenetworking.googleapis.com',reserved_peering_ranges:[r('google_compute_global_address',n+'_database','name')],deletion_policy:'ABANDON',depends_on:['google_project_service.'+n+'_peering']});
+ for(const purpose of ['api','worker','parser','ops'])add('google_service_account',n+'_'+purpose,{project:destination,account_id:l('name')+'-'+purpose,display_name:'Invoice '+purpose+'; separate least-privilege purpose',depends_on:['google_project_service.'+n+'_identity']});
+ const sa=(purpose,attribute)=>r('google_service_account',n+'_'+purpose,attribute),member=purpose=>'serviceAccount:'+sa(purpose,'email');
+ add('google_sql_database_instance',n,{project:destination,name:l('name'),region,database_version:'POSTGRES_17',deletion_protection:true,settings:{tier:'db-custom-2-7680',edition:'ENTERPRISE',availability_type:'REGIONAL',deletion_protection_enabled:true,disk_type:'PD_SSD',disk_size:20,disk_autoresize:true,disk_autoresize_limit:100,ip_configuration:{ipv4_enabled:false,private_network:r('google_compute_network',n,'id'),ssl_mode:'TRUSTED_CLIENT_CERTIFICATE_REQUIRED'},backup_configuration:{enabled:true,point_in_time_recovery_enabled:true,transaction_log_retention_days:7,location:region,backup_retention_settings:{retained_backups:7,retention_unit:'COUNT'}},database_flags:[{name:'cloudsql.iam_authentication',value:'on'},{name:'log_statement',value:'none'},{name:'log_min_error_statement',value:'panic'},{name:'log_parameter_max_length_on_error',value:'0'}],insights_config:{query_insights_enabled:false,record_application_tags:false,record_client_address:false}},lifecycle:{prevent_destroy:true},depends_on:['google_project_service.'+n+'_database','google_service_networking_connection.'+n]});
+ add('google_sql_database',n,{project:destination,name:'invoice',instance:r('google_sql_database_instance',n,'name'),charset:'UTF8',collation:'en_US.UTF8',deletion_policy:'ABANDON'});
+ for(const purpose of ['api','worker','ops']){
+  add('google_sql_user',n+'_'+purpose,{project:destination,name:'${trimsuffix(google_service_account.'+n+'_'+purpose+'.email,".gserviceaccount.com")}',instance:r('google_sql_database_instance',n,'name'),type:'CLOUD_IAM_SERVICE_ACCOUNT',database_roles:purpose==='ops'?['cloudsqlsuperuser']:[],deletion_policy:'ABANDON'});
+  for(const[role,suffix]of [['roles/cloudsql.client','connect'],['roles/cloudsql.instanceUser','login']])add('google_project_iam_member',n+'_'+purpose+'_'+suffix,{project:destination,role,member:member(purpose)});
+ }
+ add('google_storage_bucket',n,{project:destination,name:destination+'-'+l('name')+'-invoices',location:region,storage_class:'STANDARD',uniform_bucket_level_access:true,public_access_prevention:'enforced',force_destroy:false,versioning:{enabled:true},soft_delete_policy:{retention_duration_seconds:0},lifecycle_rule:[{action:{type:'Delete'},condition:{age:90}}],lifecycle:{prevent_destroy:true}});
+ add('google_project_iam_custom_role',n+'_upload',{project:destination,role_id:'${replace(local.name,"-","_")}_documents',title:'Invoice immutable document upload/read',permissions:['storage.objects.create','storage.objects.get'],stage:'GA'});
+ add('google_storage_bucket_iam_member',n+'_upload',{bucket:r('google_storage_bucket',n,'name'),role:r('google_project_iam_custom_role',n+'_upload','name'),member:member('api')});
+ add('google_storage_bucket_iam_member',n+'_read',{bucket:r('google_storage_bucket',n,'name'),role:'roles/storage.objectViewer',member:member('worker')});
+ add('google_project_iam_custom_role',n+'_model',{project:destination,role_id:'${replace(local.name,"-","_")}_model',title:'Invoice model and read-only policy inspection',permissions:['aiplatform.endpoints.predict','aiplatform.cacheConfigs.get','aiplatform.endpoints.fetchPublisherModelConfig'],stage:'GA'});
+ add('google_project_iam_member',n+'_model',{project:destination,role:r('google_project_iam_custom_role',n+'_model','name'),member:member('worker'),depends_on:['google_project_service.'+n+'_model']});
+ add('google_artifact_registry_repository',n,{project:destination,location:region,repository_id:l('name'),format:'DOCKER',docker_config:{immutable_tags:true},cleanup_policy_dry_run:true,lifecycle:{prevent_destroy:true},depends_on:['google_project_service.'+n+'_registry']});
+ add('google_artifact_registry_repository_iam_member',n,{project:destination,location:region,repository:r('google_artifact_registry_repository',n,'name'),role:'roles/artifactregistry.reader',member:r('google_project_service_identity',n+'_run','member')});
+ add('google_secret_manager_secret',n+'_destination',{project:destination,secret_id:l('name')+'-accounting-token',replication:{user_managed:{replicas:{location:region}}},lifecycle:{prevent_destroy:true},depends_on:['google_project_service.'+n+'_secrets']});
+ add('google_secret_manager_secret_iam_member',n,{project:destination,secret_id:r('google_secret_manager_secret',n+'_destination','secret_id'),role:'roles/secretmanager.secretAccessor',member:member('worker')});
+ const common={PROJECT_ID:destination,PROJECT_NUMBER:number,REGION:region,ACCOUNT_ID:l('account_uuid'),WORKFLOW_NAMESPACE:'invoice',DATABASE_NAME:'invoice',DATABASE_CONNECTION_NAME:r('google_sql_database_instance',n,'connection_name'),DATABASE_TRANSPORT:'cloudsql-private-proxy',DOCUMENT_BUCKET:r('google_storage_bucket',n,'name'),DESTINATION_CONTRACT_BASE64:l('destination_contract_base64')};
+ for(const purpose of ['api','worker','parser']){
+  const name=l('name')+'-'+purpose;
+  const settings=purpose==='parser'?{}:purpose==='api'?{...common,SERVICE_NAME:name,PUBLIC_ORIGIN:l('public_origin'),DATABASE_SERVICE_ACCOUNT:sa('api','email')}:{...common,DATABASE_SERVICE_ACCOUNT:sa('worker','email'),PARSER_ENDPOINT:l('parser_endpoint'),PARSER_AUDIENCE:l('parser_origin'),MODEL_ID:model,MAX_OUTPUT_TOKENS:'2048',POLICY_REVIEW_BASE64:v('policy_review_base64'),DESTINATION_ENDPOINT:endpoint,DESTINATION_SCOPE:scope,DESTINATION_REPLAY_REVIEW_BASE64:v('replay_review_base64')};
+  const application={name:'application',image:v(purpose==='parser'?'parser_image':'runtime_image'),ports:{container_port:8080},resources:{limits:{cpu:'1',memory:purpose==='parser'?'2Gi':'1Gi'},cpu_idle:false,startup_cpu_boost:true},env:[...Object.entries(settings).map(([name,value])=>({name,value})),...(purpose==='worker'?[{name:'DESTINATION_TOKEN',value_source:{secret_key_ref:{secret:r('google_secret_manager_secret',n+'_destination','secret_id'),version:'latest'}}}]:[])],startup_probe:{http_get:{path:'/healthz',port:8080},initial_delay_seconds:0,period_seconds:5,timeout_seconds:2,failure_threshold:24},...(purpose==='api'?{}:{command:['python','-I','/app/'+(purpose==='worker'?'invoice_worker.py':'invoice_parser_service.py')]}),...(purpose==='parser'?{}:{depends_on:['cloud-sql-proxy']})};
+  const sidecar={name:'cloud-sql-proxy',image:proxy.image,args:['--private-ip','--address=127.0.0.1','--port=5432','--structured-logs',r('google_sql_database_instance',n,'connection_name')],resources:{limits:{cpu:'1',memory:'256Mi'},cpu_idle:false},startup_probe:{tcp_socket:{port:5432},period_seconds:5,timeout_seconds:2,failure_threshold:24}};
+  add('google_cloud_run_v2_service',n+'_'+purpose,{count:'${var.applications_enabled ? 1 : 0}',project:destination,name,location:region,deletion_protection:true,ingress:purpose==='worker'?'INGRESS_TRAFFIC_INTERNAL_ONLY':'INGRESS_TRAFFIC_ALL',iap_enabled:purpose==='api',invoker_iam_disabled:false,labels:{managed_by:'atmem-ai-architect',environment},template:{service_account:sa(purpose,'email'),execution_environment:'EXECUTION_ENVIRONMENT_GEN2',timeout:purpose==='parser'?'150s':'300s',max_instance_request_concurrency:purpose==='api'?32:purpose==='parser'?1:1,scaling:{min_instance_count:1,max_instance_count:1},containers:[application,...(purpose==='parser'?[]:[sidecar])],...(purpose==='parser'?{}:{vpc_access:{egress:'PRIVATE_RANGES_ONLY',network_interfaces:{network:r('google_compute_network',n,'name'),subnetwork:r('google_compute_subnetwork',n,'name')}}})},depends_on:['google_project_service.'+n+'_run','google_artifact_registry_repository_iam_member.'+n,'google_secret_manager_secret_iam_member.'+n,'google_project_iam_member.'+n+'_model','google_project_service_identity.'+n+'_iap',...(purpose==='parser'?[]:['google_sql_user.'+n+'_'+purpose,'google_project_iam_member.'+n+'_'+purpose+'_connect','google_project_iam_member.'+n+'_'+purpose+'_login'])]});
+ }
+ add('google_cloud_run_v2_service_iam_member',n+'_api',{count:'${var.applications_enabled ? 1 : 0}',project:destination,location:region,name:r('google_cloud_run_v2_service',n+'_api[0]','name'),role:'roles/run.invoker',member:r('google_project_service_identity',n+'_iap','member')});
+ add('google_cloud_run_v2_service_iam_member',n+'_parser',{count:'${var.applications_enabled ? 1 : 0}',project:destination,location:region,name:r('google_cloud_run_v2_service',n+'_parser[0]','name'),role:'roles/run.invoker',member:member('worker')});
+ add('google_iap_web_cloud_run_service_iam_member',n,{for_each:'${var.applications_enabled ? var.staff_principals : toset([])}',project:destination,location:region,cloud_run_service_name:l('name')+'-api',role:'roles/iap.httpsResourceAccessor',member:'${each.value}',depends_on:['google_cloud_run_v2_service.'+n+'_api']});
+ b.output.application_url={value:l('public_origin')};b.output.registry={value:region+'-docker.pkg.dev/'+destination+'/'+l('name')};
+ b.output.operator_deployment={value:{provider:'gcp',deploymentId:l('account_uuid'),accountId:l('account_uuid'),namespace:'invoice',tenantId:null,bindings:Object.fromEntries(['api','worker'].map(purpose=>[purpose,{name:'${trimsuffix(google_service_account.'+n+'_'+purpose+'.email,".gserviceaccount.com")}',principal:sa(purpose,'email'),created_by_package:true}]))}};
+ gcpInvoiceOperations(b,n,{destination,region,sa,member,proxy});
+ b.output.database_bootstrap={value:{connectionName:r('google_sql_database_instance',n,'connection_name'),database:'invoice',operatorServiceAccount:sa('ops','email'),operatorRole:'Intentional separate operator cloudsqlsuperuser; never an application identity.',proxyImage:proxy.image}};
+ b.files['CLOUD_SQL_PROXY_SECURITY_REVIEW.json']=JSON.stringify(proxyReview,null,2)+'\n';
+ b.files['CLOUD_SQL_PROXY.md']='Use the exact upstream proxy image '+proxy.image+' (version '+proxy.version+'). The maintained proxy enforces upstream TLS and private-IP connection; only same-instance 127.0.0.1:5432 is exposed to API/worker. No insecure native-host fallback or shared writable Unix volume is used. Cloud SQL client/login IAM is project-scoped; SQL identities/grants and the fixed proxy instance constrain the data connection. Native IAM/CA/connection and inherited permissions require authorized destination checks.\n';
+ b.files['CLOUD_SQL_PROXY.md']+='\nCLOUD_SQL_PROXY_SECURITY_REVIEW.json records the exact AMD64 image/binary review. Three module-version findings remain in inventory, but independent binary analysis plus an affected compiled control establishes that their vulnerable packages are absent from this artifact. This is scoped applicability evidence, not a blanket security approval. Repeat the review if the image or findings change.\n';
+ b.assertions.push(`run "private_database_and_identity" {\n command = plan\n assert {\n condition = !google_sql_database_instance.${n}.settings[0].ip_configuration[0].ipv4_enabled && google_sql_database_instance.${n}.settings[0].availability_type == "REGIONAL" && google_storage_bucket.${n}.public_access_prevention == "enforced"\n error_message = "Retain private database, regional recovery and nonpublic documents."\n }\n assert {\n condition = google_cloud_run_v2_service.${n}_api[0].iap_enabled && !google_cloud_run_v2_service.${n}_api[0].invoker_iam_disabled && google_cloud_run_v2_service_iam_member.${n}_parser[0].member == "serviceAccount:\${google_service_account.${n}_worker.email}"\n error_message = "Staff authentication and worker-only parser invocation are required."\n }\n}\nrun "private_proxy_and_worker_cpu" {\n command = plan\n assert {\n condition = google_cloud_run_v2_service.${n}_worker[0].template[0].containers[0].resources[0].cpu_idle == false && google_cloud_run_v2_service.${n}_worker[0].template[0].scaling[0].min_instance_count == 1 && contains(google_cloud_run_v2_service.${n}_worker[0].template[0].containers[1].args,"--private-ip") && contains(google_cloud_run_v2_service.${n}_worker[0].template[0].containers[1].args,"--address=127.0.0.1")\n error_message = "Keep worker CPU allocated and the maintained private-IP proxy scoped to loopback."\n }\n}\nrun "foundation_only" {\n command = plan\n variables {\n applications_enabled = false\n operations_enabled = false\n maintenance_enabled = false\n }\n assert {\n condition = length(google_cloud_run_v2_service.${n}_api) == 0 && length(google_cloud_run_v2_service.${n}_worker) == 0 && length(google_cloud_run_v2_service.${n}_parser) == 0\n error_message = "Bootstrap and publication precede application release."\n }\n}\nrun "mutable_image_rejected" {\n command = plan\n variables { runtime_image = "unreviewed:latest" }\n expect_failures = [var.runtime_image]\n}\nrun "foreign_registry_rejected" {\n command = plan\n variables { runtime_image = "foreign.example.test/runtime@sha256:${'a'.repeat(64)}" }\n expect_failures = [terraform_data.review_gate]\n}`);
+ const seed=b.seed;
+ for(const purpose of ['runtime','parser'])b.testExpressions[purpose+'_image']='format("'+(row.region||'australia-southeast1')+'-docker.pkg.dev/reviewed-project/invoice-%s/'+purpose+'@sha256:'+'a'.repeat(64)+'",substr(sha256('+JSON.stringify(seed)+'),0,12))';
+ let mock='mock_provider "google" {\n override_during = plan\n mock_data "google_project" { defaults={ number="123456789012" } }\n}\nmock_provider "google-beta" {\n override_during = plan\n mock_resource "google_project_service_identity" { defaults={ email="service-123456789012@gcp-sa-iap.iam.gserviceaccount.com",member="serviceAccount:service-123456789012@gcp-sa-iap.iam.gserviceaccount.com" } }\n}\n';
+ for(const purpose of ['api','worker','parser','ops','scheduler'])mock+='override_resource {\n override_during = plan\n target = google_service_account.'+n+'_'+purpose+'\n values = '+JSON.stringify({email:'invoice-'+purpose+'@reviewed-project.iam.gserviceaccount.com',member:'serviceAccount:invoice-'+purpose+'@reviewed-project.iam.gserviceaccount.com'})+'\n}\n';
+ for(const[purpose,email]of [['run','service-123456789012@serverless-robot-prod.iam.gserviceaccount.com'],['iap','service-123456789012@gcp-sa-iap.iam.gserviceaccount.com'],['scheduler','service-123456789012@gcp-sa-cloudscheduler.iam.gserviceaccount.com']])mock+='override_resource {\n override_during = plan\n target = google_project_service_identity.'+n+'_'+purpose+'\n values = '+JSON.stringify({email,member:'serviceAccount:'+email})+'\n}\n';
+ mock+='override_resource {\n override_during = plan\n target = google_sql_database_instance.'+n+'\n values = '+JSON.stringify({connection_name:'reviewed-project:australia-southeast1:invoice-fixture'})+'\n}\n';
+ return b.finish({google:{project:destination},'google-beta':{project:destination}},{google:{source:'hashicorp/google',version:'7.46.2'},'google-beta':{source:'hashicorp/google-beta',version:'7.46.2'}},CLOUD_PROVIDER_LOCKS.gcp+'\n'+CLOUD_PROVIDER_LOCKS.gcpBeta,mock,GCP_INVOICE_GUIDE);
+}
+
+const GCP_INVOICE_GUIDE=`# Google invoice workflow (under qualification)
+
+Cloud Run/IAP API, continuously allocated private worker, separate IAM-protected
+parser, maintained private-IP Cloud SQL Auth Proxy, regional HA IAM-authenticated
+PostgreSQL, versioned private regional documents and separately populated regional
+secret. Existing project, staff identities and accounting system are preserved.
+
+The API receives no model/action authority. Only the worker invokes the parser;
+the parser has no emitted data/model grants or database/proxy sidecar. The proxy's
+local TCP connection stays inside the workload, with upstream TLS and IAM checked
+by the pinned maintained proxy. No Cloud SQL public IP or plaintext remote fallback.
+Application and worker SQL users receive explicit restricted bootstrap grants; the
+separate operator IAM user intentionally has administrative SQL authority.
+
+Review organization-owned IAP setup, actual model geography/lifecycle, privacy
+policy evidence, inherited IAM and regional quotas/costs. Missing scoped model-policy
+review blocks inference. The application never self-approves or modifies project
+logging/cache/abuse policies. Native private connectivity, token roles and managed
+restore still require destination checks. OPERATING_JOBS.md supplies fixed private
+bootstrap, daily/hourly jobs, scoped OAuth scheduling and count-only log alerts.
+The operator waits for and explicitly terminates its job-only proxy sidecar.
+See OPERATIONS.md and CLOUD_SQL_PROXY.md; whole-project acceptance remains pending.
+Native operator scheduling/bootstrap and whole-export qualification are unfinished;
+this compiler fixture is not a complete benchmark project or deployment evidence.
+`;