@caelo-cms/provisioning 0.10.49 → 0.10.51

package/src/self-hosted-start.test.ts

@@ -0,0 +1,68 @@
+// SPDX-License-Identifier: MPL-2.0
+
+import { describe, expect, it } from "bun:test";
+import type { CommandResult, HostRunner } from "./self-hosted-release.js";
+import { startSelfHosted } from "./self-hosted-start.js";
+
+const DIR = "/srv/install/.caelo";
+
+/** A runner that records every command (minus the `docker compose -f <file>` prefix). */
+function fakeRunner(fail?: (cmd: string) => boolean): HostRunner & { calls: string[] } {
+  const calls: string[] = [];
+  return {
+    calls,
+    async run(argv): Promise<CommandResult> {
+      const cmd = argv.join(" ").replace(`docker compose -f ${DIR}/docker-compose.yml `, "");
+      calls.push(cmd);
+      return { exitCode: fail?.(cmd) ? 1 : 0, stdout: "", stderr: fail?.(cmd) ? "boom" : "" };
+    },
+  };
+}
+
+const MIGRATE =
+  "run --rm --no-deps -T caelo-admin bun --bun /app/packages/migrations/src/migrate.ts";
+
+describe("startSelfHosted (#707 — one command ends with a serving install)", () => {
+  it("pulls, starts Postgres, migrates, starts everything, then health-checks both services", async () => {
+    const runner = fakeRunner();
+    const r = await startSelfHosted({ caeloDir: DIR, runner, log: () => {} });
+    expect(r).toEqual({ ok: true });
+    expect(runner.calls.map((c) => c.replace(/ -e .*/, " -e <probe>"))).toEqual([
+      "pull",
+      "up -d --wait postgres",
+      `${MIGRATE} admin`,
+      `${MIGRATE} public`,
+      "up -d --remove-orphans",
+      "exec -T caelo-admin bun -e <probe>",
+      "exec -T caelo-gateway bun -e <probe>",
+      "exec -T caddy caddy reload --config /etc/caddy/Caddyfile --adapter caddyfile",
+    ]);
+  });
+
+  it("stops at a failed migration — nothing else is started", async () => {
+    const runner = fakeRunner((c) => c.endsWith("migrate.ts admin"));
+    const r = await startSelfHosted({ caeloDir: DIR, runner, log: () => {} });
+    expect(r.ok).toBe(false);
+    if (!r.ok) {
+      expect(r.stage).toBe("migrate");
+      expect(r.error).toContain("admin migrations failed");
+    }
+    expect(runner.calls).not.toContain("up -d --remove-orphans");
+  });
+
+  it("reports an unhealthy admin with where to look", async () => {
+    const runner = fakeRunner((c) => c.startsWith("exec -T caelo-admin"));
+    const r = await startSelfHosted({
+      caeloDir: DIR,
+      runner,
+      log: () => {},
+      healthAttempts: 2,
+      sleep: async () => {},
+    });
+    expect(r.ok).toBe(false);
+    if (!r.ok) {
+      expect(r.stage).toBe("health");
+      expect(r.error).toContain("logs caelo-admin");
+    }
+  });
+});

package/src/self-hosted-start.ts

@@ -0,0 +1,123 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * Start (or converge) a self-hosted Compose install — what `init` and `up`
+ * run after writing `.caelo/`, so one command ends with a serving install
+ * (CLAUDE.md §11.C, issue #707) instead of printing steps to copy.
+ *
+ * Order, and why:
+ *   1. pull every image, with the progress on the terminal (the admin image
+ *      is large; a silent multi-minute step reads as a hang);
+ *   2. start Postgres and wait for its health check — on a fresh volume its
+ *      first start runs bootstrap.sh (roles + databases);
+ *   3. apply the migrations with the install's admin image;
+ *   4. start everything (`--remove-orphans` drops services an older Compose
+ *      file had, e.g. the pgBackRest sidecar);
+ *   5. health-check the admin (`/_caelo/health` proves the DB pool and its
+ *      role) and the gateway;
+ *   6. reload Caddy — Compose does not restart a running Caddy when only
+ *      its bind-mounted Caddyfile changed, so a re-run `up` would otherwise
+ *      keep serving the old vhosts.
+ * Every step converges, so a re-run after a failure picks up where it
+ * stopped.
+ */
+
+import type { HostRunner } from "./self-hosted-release.js";
+import { compose, runMigrations, waitHealthy } from "./self-hosted-upgrade.js";
+
+export interface StartDeps {
+  readonly caeloDir: string;
+  readonly runner: HostRunner;
+  readonly log: (message: string) => void;
+  /** Health probe attempts per service and the pause between them. */
+  readonly healthAttempts?: number;
+  readonly healthIntervalMs?: number;
+  readonly sleep?: (ms: number) => Promise<void>;
+}
+
+export type StartResult =
+  | { readonly ok: true }
+  | { readonly ok: false; readonly stage: StartStage; readonly error: string };
+
+type StartStage = "pull" | "postgres" | "migrate" | "start" | "health" | "caddy";
+
+/** Bring the install's Compose stack up and prove it serves. Never throws for an expected failure. */
+export async function startSelfHosted(deps: StartDeps): Promise<StartResult> {
+  const { caeloDir, runner, log } = deps;
+  log("Pulling the images …");
+  const pull = await runner.run(compose(caeloDir, "pull"), { inherit: true });
+  if (pull.exitCode !== 0) {
+    return fail("pull", "docker compose pull failed (see above). Check the network and re-run.");
+  }
+
+  log("Starting Postgres …");
+  const pg = await runner.run(compose(caeloDir, "up", "-d", "--wait", "postgres"), {
+    inherit: true,
+  });
+  if (pg.exitCode !== 0) {
+    return fail(
+      "postgres",
+      `Postgres did not become healthy (see above; \`docker compose -f ${caeloDir}/docker-compose.yml logs postgres\`).`,
+    );
+  }
+
+  log("Applying the database migrations …");
+  const migrated = await runMigrations(caeloDir, runner);
+  if (!migrated.ok) return fail("migrate", migrated.error);
+
+  log("Starting Caddy, the admin and the gateway …");
+  const up = await runner.run(compose(caeloDir, "up", "-d", "--remove-orphans"), {
+    inherit: true,
+  });
+  if (up.exitCode !== 0) return fail("start", "docker compose up failed (see above).");
+
+  for (const service of ["admin", "gateway"] as const) {
+    log(`Waiting for the ${service} to answer its health check …`);
+    const healthy = await waitHealthy(service, caeloDir, {
+      runner,
+      ...(deps.sleep ? { sleep: deps.sleep } : {}),
+      ...(deps.healthAttempts !== undefined ? { healthAttempts: deps.healthAttempts } : {}),
+      ...(deps.healthIntervalMs !== undefined ? { healthIntervalMs: deps.healthIntervalMs } : {}),
+    });
+    if (!healthy.ok) {
+      return fail(
+        "health",
+        `The ${service} is not healthy: ${healthy.error}. See \`docker compose -f ${caeloDir}/docker-compose.yml logs caelo-${service}\`.`,
+      );
+    }
+  }
+  log("Reloading Caddy …");
+  const reloaded = await reloadCaddy(caeloDir, runner);
+  if (!reloaded.ok) return fail("caddy", reloaded.error);
+  return { ok: true };
+}
+
+/** `caddy reload` in the running Caddy container with the current Caddyfile. */
+export async function reloadCaddy(
+  caeloDir: string,
+  runner: HostRunner,
+): Promise<{ ok: true } | { ok: false; error: string }> {
+  const r = await runner.run(
+    compose(
+      caeloDir,
+      "exec",
+      "-T",
+      "caddy",
+      "caddy",
+      "reload",
+      "--config",
+      "/etc/caddy/Caddyfile",
+      "--adapter",
+      "caddyfile",
+    ),
+  );
+  if (r.exitCode === 0) return { ok: true };
+  return {
+    ok: false,
+    error: `caddy reload failed: ${r.stderr.trim().split("\n").slice(-3).join("\n")}`,
+  };
+}
+
+function fail(stage: StartStage, error: string): StartResult {
+  return { ok: false, stage, error };
+}

package/src/self-hosted-upgrade.ts

@@ -196,7 +196,7 @@ export function composePath(caeloDir: string): string {
 }
 
 /** `docker compose -f <file>` — every Compose call targets the install's file explicitly. */
-function compose(caeloDir: string, ...args: string[]): string[] {
+export function compose(caeloDir: string, ...args: string[]): string[] {
   return ["docker", "compose", "-f", composePath(caeloDir), ...args];
 }
 
@@ -415,12 +415,35 @@ export async function backupDatabases(
     };
   }
   const dir = join(caeloDir, "backups", `pre-upgrade-${at.toISOString().replace(/[:.]/g, "-")}`);
+  const dumped = await dumpDatabases(caeloDir, runner, dir);
+  if (!dumped.ok) return { ok: false, error: `${dumped.error} The upgrade did not start.` };
+  return { ok: true, dir };
+}
+
+/** The files {@link dumpDatabases} writes, and what each holds. */
+export const DATABASE_DUMPS = {
+  /** The cluster's roles (reference only — restores re-create them from config.json). */
+  globals: "globals.sql",
+  cms_admin: "cms_admin.dump",
+  cms_public: "cms_public.dump",
+} as const;
+
+/**
+ * pg_dump both databases (custom format) plus the cluster's roles into
+ * `dir` (created mode 700) from the running Postgres container. Every dump
+ * must exit 0 and be non-empty.
+ */
+export async function dumpDatabases(
+  caeloDir: string,
+  runner: HostRunner,
+  dir: string,
+): Promise<{ ok: true } | { ok: false; error: string }> {
   mkdirSync(dir, { recursive: true, mode: 0o700 });
   chmodSync(dir, 0o700);
   const dumps: [string, string[]][] = [
-    ["globals.sql", ["pg_dumpall", "-U", "caelo", "--globals-only"]],
-    ["cms_admin.dump", ["pg_dump", "-U", "caelo", "-Fc", "cms_admin"]],
-    ["cms_public.dump", ["pg_dump", "-U", "caelo", "-Fc", "cms_public"]],
+    [DATABASE_DUMPS.globals, ["pg_dumpall", "-U", "caelo", "--globals-only"]],
+    [DATABASE_DUMPS.cms_admin, ["pg_dump", "-U", "caelo", "-Fc", "cms_admin"]],
+    [DATABASE_DUMPS.cms_public, ["pg_dump", "-U", "caelo", "-Fc", "cms_public"]],
   ];
   for (const [name, cmd] of dumps) {
     const out = join(dir, name);
@@ -430,12 +453,12 @@ export async function backupDatabases(
     if (r.exitCode !== 0 || fileSize(out) === 0) {
       return {
         ok: false,
-        error: `Backup failed (${cmd.join(" ")} → ${out}): ${tail(r.stderr) || "empty dump"}. The upgrade did not start.`,
+        error: `Backup failed (${cmd.join(" ")} → ${out}): ${tail(r.stderr) || "empty dump"}.`,
       };
     }
     chmodSync(out, 0o600);
   }
-  return { ok: true, dir };
+  return { ok: true };
 }
 
 /**
@@ -483,10 +506,14 @@ const HEALTH_PROBE: Record<"admin" | "gateway", string> = {
     'const r=await fetch("http://127.0.0.1:"+(process.env.PORT||process.env.GATEWAY_PORT||"8090")+"/healthz").catch(()=>null);process.exit(r&&r.ok?0:1)',
 };
 
-async function waitHealthy(
+/**
+ * Probe `service` inside its container until it answers healthy, or give up
+ * after `healthAttempts` tries (default 45, 2 s apart).
+ */
+export async function waitHealthy(
   service: "admin" | "gateway",
   caeloDir: string,
-  deps: SelfHostedUpgradeDeps,
+  deps: Pick<SelfHostedUpgradeDeps, "runner" | "sleep" | "healthAttempts" | "healthIntervalMs">,
 ): Promise<{ ok: true } | { ok: false; error: string }> {
   const attempts = deps.healthAttempts ?? 45;
   const interval = deps.healthIntervalMs ?? 2000;

package/src/stack-contract.test.ts

@@ -49,12 +49,11 @@ const ADMIN_SECRETS = {
 };
 
 describe("databaseUrls", () => {
-  it("builds password-less URLs for the four role/database pairs", () => {
+  it("builds password-less URLs for the three role/database pairs", () => {
     expect(databaseUrls("10.20.0.3")).toEqual({
       admin: "postgresql://admin_role@10.20.0.3:5432/cms_admin?sslmode=require",
       publicAdmin: "postgresql://admin_role@10.20.0.3:5432/cms_public?sslmode=require",
       public: "postgresql://public_role@10.20.0.3:5432/cms_public?sslmode=require",
-      gateway: "postgresql://gateway_role@10.20.0.3:5432/cms_admin?sslmode=require",
     });
   });
 });
@@ -154,15 +153,13 @@ describe.each([
 describe("gatewayEnvContract", () => {
   const gateway = gatewayEnvContract({ ...base, provider: "gcp" });
 
-  it("carries its two own logins and none of the admin's database or app secrets", () => {
+  it("carries its one own login and none of the admin's database or app secrets (#635)", () => {
     expect(asRecord(gateway)).toEqual({
       CAELO_PROVIDER: "gcp",
       CAELO_ENV: "production",
       MEDIA_STORAGE_URL: "gs://acme-caelo-production-media",
       PUBLIC_DATABASE_URL: "postgresql://public_role@10.20.0.3:5432/cms_public?sslmode=require",
-      GATEWAY_DATABASE_URL: "postgresql://gateway_role@10.20.0.3:5432/cms_admin?sslmode=require",
       PUBLIC_DATABASE_PASSWORD: "secret:caelo-production-public-role-password:latest",
-      GATEWAY_DATABASE_PASSWORD: "secret:caelo-production-gateway-role-password:latest",
       CAELO_STAGING_GATE_SECRET: "secret:caelo-production-staging-gate-secret:latest",
     });
   });
@@ -188,11 +185,7 @@ describe("gatewayEnvContract", () => {
   });
 
   it("the gateway's run SA reads no admin-only secret (admin password, KEK, internal, tool approval)", () => {
-    expect(serviceSecrets("gateway")).toEqual([
-      "gateway-role-password",
-      "public-role-password",
-      "staging-gate-secret",
-    ]);
+    expect(serviceSecrets("gateway")).toEqual(["public-role-password", "staging-gate-secret"]);
     for (const v of gateway) {
       expect(v.name).not.toMatch(/KEK|INTERNAL|TOOL_APPROVAL|PUBLIC_ADMIN/);
     }
@@ -280,11 +273,6 @@ describe("runtime secrets", () => {
         secret: "staging-gate-secret",
         stackResource: "staging-gate-secret-binding",
       },
-      {
-        service: "gateway",
-        secret: "gateway-role-password",
-        stackResource: "gateway-gateway-role-password-binding",
-      },
       {
         service: "gateway",
         secret: "public-role-password",
@@ -299,7 +287,11 @@ describe("runtime secrets", () => {
   });
 
   it("every CLI-generated secret is read by some service", () => {
-    for (const s of CLI_GENERATED_SECRETS) {
+    // gateway-role-password is read by no service since #635: it only keeps
+    // the legacy gateway_role's password set until the contract release
+    // drops the role (the previous release's gateway logs in with it while
+    // an upgrade rolls).
+    for (const s of CLI_GENERATED_SECRETS.filter((x) => x !== "gateway-role-password")) {
       expect([...serviceSecrets("admin"), ...serviceSecrets("gateway")]).toContain(s);
     }
   });
@@ -311,10 +303,10 @@ describe("self-hosted compose", () => {
       domain: "acme.com",
       postgresPassword: "p",
       rolePasswords: { admin: "a", public: "b", gateway: "g" },
-      minioRootUser: "u",
-      minioRootPassword: "m",
       caeloSecretKek: "k",
       diskSize: "10G",
+      ports: { http: 80, https: 443 },
+      project: "caelo-example-com",
       images: {
         mode: "release" as const,
         admin: `ghcr.io/caelo-cms/admin@sha256:${"a".repeat(64)}`,
@@ -351,13 +343,12 @@ describe("stackIamInvariants", () => {
     }
   });
 
-  it("grants the gateway SA only its two role passwords, the staging gate key + telemetry roles", () => {
+  it("grants the gateway SA only its own role password, the staging gate key + telemetry roles", () => {
     for (const provider of ["gcp", "gcp-firebase"] as const) {
       const gateway = stackIamInvariants(provider).filter((i) => i.member === "gateway-sa");
       expect(gateway.map((i) => `${i.role} ${JSON.stringify(i.target)}`).sort()).toEqual([
         'roles/logging.logWriter {"kind":"project"}',
         'roles/monitoring.metricWriter {"kind":"project"}',
-        'roles/secretmanager.secretAccessor {"kind":"secret","name":"gateway-role-password"}',
         'roles/secretmanager.secretAccessor {"kind":"secret","name":"public-role-password"}',
         'roles/secretmanager.secretAccessor {"kind":"secret","name":"staging-gate-secret"}',
       ]);

package/src/stack-contract.ts

@@ -86,14 +86,12 @@ export interface DatabaseUrls<V = string> {
   readonly admin: V;
   /** admin_role on cms_public — the admin's second pool (DDL, migrations). */
   readonly publicAdmin: V;
-  /** public_role on cms_public — the gateway's visitor-write pool. */
-  readonly public: V;
   /**
-   * gateway_role on cms_admin — the gateway's narrow pool (#613): its
-   * settings, rate limits, captcha, request log, plugin op audit and the
-   * plugin registry, read-mostly (migration 0248).
+   * public_role on cms_public — the gateway's only pool. The gateway has no
+   * cms_admin login (#635, CLAUDE.md §2): what it needs from authoring
+   * state the admin publishes into cms_public.
    */
-  readonly gateway: V;
+  readonly public: V;
 }
 
 /** Port Cloud SQL Postgres listens on (private IP). */
@@ -111,7 +109,6 @@ export function databaseUrls(host: string): DatabaseUrls {
     admin: url("admin_role", "cms_admin"),
     publicAdmin: url("admin_role", "cms_public"),
     public: url("public_role", "cms_public"),
-    gateway: url("gateway_role", "cms_admin"),
   };
 }
 
@@ -251,8 +248,8 @@ export type DatabaseRole = "admin_role" | "public_role" | "gateway_role";
 
 /**
  * Each database role's password secret — one per role (#613), so the
- * gateway's SA, which reads only the public_role and gateway_role
- * passwords, can never read admin_role's. `postgres-password` keeps its
+ * gateway's SA, which reads only the public_role password, can never read
+ * admin_role's (or, since #635, gateway_role's). `postgres-password` keeps its
  * name: it has always been admin_role's (and, before #613, shared with
  * public_role). `rotate-secret` changes exactly the role(s) listed here.
  */
@@ -306,9 +303,8 @@ export const SERVICE_SECRET_ENV: Readonly<
     CAELO_STAGING_GATE_SECRET: "staging-gate-secret",
   },
   gateway: {
-    // CLAUDE.md §2: never an admin_role credential (#613). gateway_role on
-    // cms_admin + public_role on cms_public, each with its own password.
-    GATEWAY_DATABASE_PASSWORD: "gateway-role-password",
+    // CLAUDE.md §2: no cms_admin credential of any role (#613, #635).
+    // public_role on cms_public is the gateway's only login.
     PUBLIC_DATABASE_PASSWORD: "public-role-password",
     // #650 — verifies staging-host requests (api-gateway staging-proxy.ts).
     CAELO_STAGING_GATE_SECRET: "staging-gate-secret",
@@ -323,12 +319,20 @@ export function serviceSecrets(service: CloudRunSlug): RuntimeSecret[] {
 /**
  * Env vars an older stack set that the contract no longer gives a service;
  * upgrade removes them. The gateway never used the KEK, and its run SA
- * cannot read it. Its admin_role pool went with #613 — the gateway refuses
- * to boot while either var is set (apps/api-gateway `gatewayDatabaseUrls`).
+ * cannot read it. Its admin_role pool went with #613 and its gateway_role
+ * pool with #635 — the gateway refuses to boot while any cms_admin
+ * credential is in its env (apps/api-gateway `adminDatabaseAccessInEnv`).
  */
 export const RETIRED_SERVICE_ENV: Readonly<Record<CloudRunSlug, readonly string[]>> = {
   admin: [],
-  gateway: ["CAELO_SECRET_KEK", "ADMIN_DATABASE_URL", "ADMIN_DATABASE_PASSWORD"],
+  gateway: [
+    "CAELO_SECRET_KEK",
+    "ADMIN_DATABASE_URL",
+    "ADMIN_DATABASE_PASSWORD",
+    // #635 — its gateway_role login on cms_admin is gone too.
+    "GATEWAY_DATABASE_URL",
+    "GATEWAY_DATABASE_PASSWORD",
+  ],
 };
 
 function secretEnv(service: CloudRunSlug, env: string): CloudRunEnvVar[] {
@@ -362,7 +366,6 @@ export function gatewayEnvContract<V>(inputs: RuntimeEnvInputs<V>): CloudRunEnvV
   return [
     ...commonEnv(inputs),
     { name: "PUBLIC_DATABASE_URL", value: inputs.databaseUrls.public },
-    { name: "GATEWAY_DATABASE_URL", value: inputs.databaseUrls.gateway },
     ...secretEnv("gateway", inputs.env),
   ];
 }
@@ -679,6 +682,12 @@ export const RETIRED_IAM_BINDINGS: readonly RetiredIamBinding[] = [
     target: { kind: "secret", name: "postgres-password" },
     why: "the gateway no longer logs in as admin_role and must not be able to read its password (CLAUDE.md §2)",
   },
+  {
+    role: SECRET_ACCESSOR,
+    member: "gateway-sa",
+    target: { kind: "secret", name: "gateway-role-password" },
+    why: "the gateway has no cms_admin login at all and must not be able to read gateway_role's password (CLAUDE.md §2, #635)",
+  },
 ];
 
 /** Every IAM binding upgrade ensures on an install of `provider`. */

package/src/stack-converge-secrets.test.ts

@@ -38,12 +38,14 @@ const SECRET_VALUES: Record<string, string> = {
   "caelo-production-gateway-role-password": "g".repeat(64),
 };
 
-/** Env vars that would hand the gateway an admin_role credential (apps/api-gateway ADMIN_CREDENTIAL_ENV). */
+/** Env vars that would hand the gateway a cms_admin credential (a subset of what apps/api-gateway adminDatabaseAccessInEnv refuses). */
 const ADMIN_CREDENTIAL_ENV = [
   "ADMIN_DATABASE_URL",
   "ADMIN_DATABASE_PASSWORD",
   "PUBLIC_ADMIN_DATABASE_URL",
   "PUBLIC_ADMIN_DATABASE_PASSWORD",
+  "GATEWAY_DATABASE_URL",
+  "GATEWAY_DATABASE_PASSWORD",
 ];
 
 /** Split a gcloud list flag value, honouring the `^<delim>^` escape. */
@@ -122,16 +124,15 @@ function credentials(url: string | undefined): string {
 }
 
 /**
- * The gateway's process env after the upgrade: gateway_role on cms_admin and
- * public_role on cms_public, each with its own secret, and no admin_role
- * credential at all (the gateway refuses to boot with one).
+ * The gateway's process env after the upgrade: public_role on cms_public
+ * with its own secret, and no cms_admin credential of any role at all
+ * (#613, #635 — the gateway refuses to boot with one).
  */
 function expectGatewayOnItsOwnLogins(env: Record<string, string>): void {
   for (const name of ADMIN_CREDENTIAL_ENV) expect(Object.keys(env)).not.toContain(name);
   expect(Object.values(env).join("\n")).not.toContain(PW);
-  expect(credentials(databaseUrlFromEnv(["GATEWAY_DATABASE_URL"], env))).toBe(
-    `gateway_role:${"g".repeat(64)}@${HOST}:5432/cms_admin?sslmode=require`,
-  );
+  expect(Object.values(env).join("\n")).not.toContain("g".repeat(64));
+  expect(Object.values(env).join("\n")).not.toContain("cms_admin");
   expect(credentials(databaseUrlFromEnv(["PUBLIC_DATABASE_URL"], env))).toBe(
     `public_role:${"p".repeat(64)}@${HOST}:5432/cms_public?sslmode=require`,
   );
@@ -331,7 +332,7 @@ function v01035Install() {
 }
 
 describe("upgrading a v0.10.35 install: the gateway leaves admin_role (#613)", () => {
-  it("drops the admin_role credential and adds the gateway's own logins in one revision", () => {
+  it("drops the admin_role credential and adds the gateway's own login in one revision", () => {
     const services = v01035Install();
     const plan = upgrade(services);
     expect(services.gateway.revisions).toHaveLength(2);
@@ -343,8 +344,6 @@ describe("upgrading a v0.10.35 install: the gateway leaves admin_role (#613)", (
       "ADMIN_DATABASE_URL",
       // #650 — the staging gate key arrives in the same roll.
       "CAELO_STAGING_GATE_SECRET",
-      "GATEWAY_DATABASE_PASSWORD",
-      "GATEWAY_DATABASE_URL",
       "PUBLIC_DATABASE_PASSWORD",
     ]);
   });
@@ -374,6 +373,42 @@ describe("upgrading a v0.10.35 install: the gateway leaves admin_role (#613)", (
   });
 });
 
+/**
+ * A v0.10.50 install (#613, before #635): the gateway on gateway_role's
+ * cms_admin pool next to public_role's.
+ */
+function v01050Install() {
+  const services = v01035Install();
+  upgrade(services);
+  const env = new Map(services.gateway.env);
+  env.set("GATEWAY_DATABASE_URL", {
+    kind: "value",
+    value: `postgresql://gateway_role@${HOST}:5432/cms_admin?sslmode=require`,
+  });
+  env.set("GATEWAY_DATABASE_PASSWORD", {
+    kind: "secret",
+    secret: "caelo-production-gateway-role-password",
+    version: "latest",
+  });
+  services.gateway = new FakeService(env, SERVICE_ACCOUNTS.gateway);
+  return services;
+}
+
+describe("upgrading a v0.10.50 install: the gateway leaves cms_admin entirely (#635)", () => {
+  it("removes the gateway_role login in one revision and keeps the public pool", () => {
+    const services = v01050Install();
+    const plan = upgrade(services);
+    expect(plan.ok && plan.services.gateway.changes.map((c) => c.name).sort()).toEqual([
+      "GATEWAY_DATABASE_PASSWORD",
+      "GATEWAY_DATABASE_URL",
+    ]);
+    expectGatewayOnItsOwnLogins(containerEnv(services.gateway.env));
+    for (const revision of services.gateway.revisions) {
+      expect(revision.has("PUBLIC_DATABASE_URL")).toBe(true);
+    }
+  });
+});
+
 describe("plain → Secret Manager migration of an existing var", () => {
   it("never leaves a revision without the var", () => {
     // An operator set CAELO_INTERNAL_SECRET by hand as a plain value.

package/src/stack-converge.test.ts

@@ -268,12 +268,7 @@ const CONVERGED_GATEWAY_DB = [
     name: "PUBLIC_DATABASE_URL",
     value: "postgresql://public_role@10.20.0.3:5432/cms_public?sslmode=require",
   },
-  {
-    name: "GATEWAY_DATABASE_URL",
-    value: "postgresql://gateway_role@10.20.0.3:5432/cms_admin?sslmode=require",
-  },
   secretRef("PUBLIC_DATABASE_PASSWORD", "public-role-password"),
-  secretRef("GATEWAY_DATABASE_PASSWORD", "gateway-role-password"),
 ];
 
 describe("planContractEnv", () => {
@@ -776,10 +771,10 @@ describe("ensureStackInvariants", () => {
       const gatewayGrants = calls.filter(
         (c) => c.startsWith("secrets add-iam-policy-binding") && c.includes(GW_SA),
       );
-      // #613 — never admin_role's postgres-password. #650 — the staging
-      // gate key is the one secret the gateway shares with the admin.
+      // #613 — never admin_role's postgres-password; #635 — nor
+      // gateway_role's. #650 — the staging gate key is the one secret the
+      // gateway shares with the admin.
       expect(gatewayGrants).toEqual([
-        `secrets add-iam-policy-binding caelo-production-gateway-role-password --project=acme --member=${GW_SA} --role=roles/secretmanager.secretAccessor --quiet --format=none`,
         `secrets add-iam-policy-binding caelo-production-public-role-password --project=acme --member=${GW_SA} --role=roles/secretmanager.secretAccessor --quiet --format=none`,
         `secrets add-iam-policy-binding caelo-production-staging-gate-secret --project=acme --member=${GW_SA} --role=roles/secretmanager.secretAccessor --quiet --format=none`,
       ]);
@@ -802,7 +797,8 @@ describe("removeRetiredIamBindings (#613)", () => {
       ],
     });
     const outcomes = await removeRetiredIamBindings(gcp, { run, sleep: async () => {} });
-    expect(outcomes.map((o) => o.status)).toEqual(["removed"]);
+    // postgres-password removed; gateway-role-password (#635) already clean.
+    expect(outcomes.map((o) => o.status)).toEqual(["removed", "absent"]);
     expect(calls).toContain(REMOVE);
     // The admin's own binding on the same secret is never touched.
     expect(calls.some((c) => c.includes("remove") && c.includes(RUN_SA))).toBe(false);
@@ -815,10 +811,23 @@ describe("removeRetiredIamBindings (#613)", () => {
       ],
     });
     const outcomes = await removeRetiredIamBindings(firebase, { run, sleep: async () => {} });
-    expect(outcomes.map((o) => o.status)).toEqual(["absent"]);
+    expect(outcomes.map((o) => o.status)).toEqual(["absent", "absent"]);
     expect(calls.filter((c) => c.includes("remove-iam-policy-binding"))).toEqual([]);
   });
 
+  it("takes the gateway SA off gateway_role's password (#635)", async () => {
+    const { run, calls } = fakeGcloud({
+      "secrets get-iam-policy caelo-production-gateway-role-password": [
+        policy([{ role: "roles/secretmanager.secretAccessor", members: [GW_SA] }]),
+      ],
+    });
+    const outcomes = await removeRetiredIamBindings(gcp, { run, sleep: async () => {} });
+    expect(outcomes.map((o) => o.status)).toEqual(["absent", "removed"]);
+    expect(calls).toContain(
+      `secrets remove-iam-policy-binding caelo-production-gateway-role-password --project=acme --member=${GW_SA} --role=roles/secretmanager.secretAccessor --quiet --format=none`,
+    );
+  });
+
   it("reports a failed removal instead of throwing", async () => {
     const { run } = fakeGcloud({
       "secrets get-iam-policy caelo-production-postgres-password": [