@caelo-cms/provisioning 0.10.52 → 0.10.55

package/src/upgrade/app-roll.ts

@@ -42,6 +42,7 @@ import {
   rollService,
   serviceRollArgs,
 } from "../stack-converge.js";
+import { describeAuditJobImage, setAuditJobImage } from "./audit-job-roll.js";
 import { restoreCommand, type SqlBackup } from "./backup.js";
 import {
   describeServiceJson,
@@ -366,7 +367,17 @@ export async function executeAppRoll(
   }
 
   const rolled: RollPlan[] = [];
+  /** The audit job's image before this roll moved it (#875); null = not moved. */
+  let auditJobPriorImage: string | null = null;
   const rollBack = async (alsoCurrent?: RollPlan): Promise<void> => {
+    if (auditJobPriorImage) {
+      const back = await setAuditJobImage(run, install, auditJobPriorImage);
+      if (back.ok) r.info(`  audit job image restored to ${auditJobPriorImage.slice(-19)}`);
+      else
+        r.error(
+          `  audit job rollback FAILED (${back.error}) — set its image to ${auditJobPriorImage} by hand`,
+        );
+    }
     const services = alsoCurrent ? [...rolled, alsoCurrent] : rolled;
     if (services.length === 0) return;
     r.warn(`Rolling back ${services.length} service(s) to the revisions that served before...`);
@@ -447,6 +458,34 @@ export async function executeAppRoll(
     rolled.push(p);
   }
 
+  // #875 — the audit job runs the admin's image; it follows the admin. A
+  // failure here does not undo the release: audits then fail loudly with
+  // the version mismatch and the fix, until the next upgrade moves it.
+  const sAudit = r.step("Moving the quality-audit job onto the admin's image...");
+  const described = await describeAuditJobImage(run, install);
+  const auditPrior = described.ok ? described.image : null;
+  if (!described.ok) {
+    sAudit.warned(
+      `Could not read the quality-audit job (${described.error}); Stage audits fail until the next upgrade moves it.`,
+    );
+  } else if (!auditPrior) {
+    sAudit.warned(
+      "The install has no quality-audit job yet; Stage audits fail until `cms-provision upgrade` sets it up.",
+    );
+  } else if (auditPrior === admin.imageRef) {
+    sAudit.done("Quality-audit job already on the admin's image");
+  } else {
+    const moved = await setAuditJobImage(run, install, admin.imageRef);
+    if (moved.ok) {
+      auditJobPriorImage = auditPrior;
+      sAudit.done(`Quality-audit job on ${admin.digest.slice(0, 19)}...`);
+    } else {
+      sAudit.warned(
+        `Quality-audit job not moved (${moved.error}); Stage audits fail until the next upgrade moves it.`,
+      );
+    }
+  }
+
   if (deps.health) {
     const s = r.step("Deep health check (database, migrations, version)...");
     // A probe that throws is a failed check: roll back, never leave the

package/src/upgrade/audit-job-roll.ts

@@ -0,0 +1,68 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #875 — the quality-audit job runs the admin image (admin-core
+ * quality/audit-task.ts) and refuses a batch from an admin on another
+ * version. So every app-roll moves the job onto the admin's new image right
+ * after the services rolled, and a rollback moves it back.
+ *
+ * `run jobs update --image` changes nothing else of the job (identity, env,
+ * parallelism), so this stays inside the app-roll's rights: the upgrader's
+ * `roles/run.developer` plus actAs on the job's service account
+ * (upgrader-setup.ts).
+ */
+
+import type { GcloudRunner } from "../gcloud-retry.js";
+import { auditJobName } from "../gcp-names.js";
+
+/**
+ * The job's image now; `image: null` only when the install has no audit job
+ * yet. Any other gcloud failure (permissions, API, network) is an error, not
+ * "no job", so the app-roll reports it instead of a misleading hint.
+ */
+export async function describeAuditJobImage(
+  run: GcloudRunner,
+  install: { readonly projectId: string; readonly region: string; readonly env: string },
+): Promise<
+  | { readonly ok: true; readonly image: string | null }
+  | { readonly ok: false; readonly error: string }
+> {
+  const r = await run([
+    "run",
+    "jobs",
+    "describe",
+    auditJobName(install.env),
+    `--region=${install.region}`,
+    `--project=${install.projectId}`,
+    "--format=value(spec.template.spec.template.spec.containers[0].image)",
+  ]);
+  if (!r.ok) {
+    return /NOT_FOUND|not found|could not be found/i.test(r.stderr)
+      ? { ok: true, image: null }
+      : { ok: false, error: r.stderr.trim() };
+  }
+  const image = r.stdout.trim();
+  if (image.length === 0) {
+    return { ok: false, error: "the job's description names no container image" };
+  }
+  return { ok: true, image };
+}
+
+/** Point the audit job at `imageRef`. */
+export async function setAuditJobImage(
+  run: GcloudRunner,
+  install: { readonly projectId: string; readonly region: string; readonly env: string },
+  imageRef: string,
+): Promise<{ readonly ok: boolean; readonly error?: string }> {
+  const r = await run([
+    "run",
+    "jobs",
+    "update",
+    auditJobName(install.env),
+    `--image=${imageRef}`,
+    `--region=${install.region}`,
+    `--project=${install.projectId}`,
+    "--quiet",
+  ]);
+  return r.ok ? { ok: true } : { ok: false, error: r.stderr.trim() };
+}

package/src/upgrade/converge.ts

@@ -7,7 +7,8 @@
  * CLI-generated runtime secrets, the stack's IAM/CDN/firewall invariants,
  * MCP access through IAP, public_role's Cloud SQL role memberships (#633),
  * the gateway's and public_role's database logins, the operator-access sync
- * job, and dropping bindings nothing reads any more.
+ * job, the quality-audit job (#875), and dropping bindings nothing reads any
+ * more.
  *
  * It needs the rights of whoever provisioned the install, so only
  * `cms-provision upgrade` (the operator's own identity) runs it — never the
@@ -24,11 +25,8 @@
  * {@link AppRollHooks} the app-roll calls in between, and a part after it.
  */
 
-import {
-  ensureGatewayRolePassword,
-  findSqlInstance,
-  planPublicRoleSwitch,
-} from "../gateway-credentials.js";
+import { ensureAuditJob, resolveAdminImage } from "../audit-job-setup.js";
+import { findSqlInstance, planPublicRoleSwitch } from "../gateway-credentials.js";
 import type { GcloudRunner, Sleep } from "../gcloud-retry.js";
 import { upgraderServiceAccountEmail } from "../gcp-names.js";
 import type { InstallMetadata } from "../install-state.js";
@@ -44,6 +42,8 @@ import {
 } from "../runtime-secrets.js";
 import { selfCommand } from "../self-command.js";
 import {
+  AUDIT_JOB_ENV_VAR,
+  AUDIT_RESULTS_BUCKET_ENV_VAR,
   MCP_ENV_VAR,
   OPERATOR_ACCESS_JOB_ENV_VAR,
   UPGRADER_JOB_ENV_VAR,
@@ -272,6 +272,42 @@ export function startConverge(
     incomplete = true;
   }
 
+  async function auditJob(): Promise<void> {
+    // #875 — the job the quality audit fans its Lighthouse runs out to.
+    // Deployed with the admin's CURRENT image (the admin still runs it until
+    // the app-roll moves both together, and the job refuses a batch from
+    // another version). A failure only costs Stage audits, so it warns and
+    // the admin keeps its current env.
+    const s = r.step("Ensuring the quality-audit job (parallel Lighthouse runs)...");
+    const image = await resolveAdminImage(
+      { projectId: install.projectId, region: install.region, env: install.env },
+      { run },
+    );
+    const aj = image.ok
+      ? await ensureAuditJob(
+          {
+            provider: install.provider,
+            projectId: install.projectId,
+            region: install.region,
+            env: install.env,
+            adminImageRef: image.imageRef,
+          },
+          runDeps,
+        )
+      : { ok: false as const, done: [], error: image.error };
+    for (const step of aj.done) r.info(`  ${step}`);
+    if (aj.ok) {
+      s.done("Quality-audit job ready (Stage audits run in parallel)");
+      return;
+    }
+    s.warned(`Quality-audit job not set up: ${aj.error}`);
+    r.warn(
+      "The upgrade continues; Stage audits fail with the missing job until this succeeds. Re-run upgrade once the cause is fixed.",
+    );
+    incomplete = true;
+    leaveUntouched.push(AUDIT_JOB_ENV_VAR, AUDIT_RESULTS_BUCKET_ENV_VAR);
+  }
+
   /** The admin's IAP resource: the service on gcp-firebase, the LB backend on gcp. */
   async function adminIapResource(): Promise<IapResource | null> {
     if (install.provider === "gcp-firebase") {
@@ -291,10 +327,9 @@ export function startConverge(
   }
 
   async function databaseLogins(): Promise<boolean> {
-    // #613 — migration 0248 creates gateway_role without a password; it gets
-    // its secret's value before the gateway rolls onto it. public_role
-    // moves onto its own password right before the gateway's roll.
-    const s = r.step("Ensuring the gateway's database login (gateway_role)...");
+    // #613 — public_role moves onto its own password right before the
+    // gateway's roll. The gateway has no other database login (#635).
+    const s = r.step("Preparing the gateway's database login (public_role)...");
     const sqlInstance = await findSqlInstance(install, { run });
     if (!sqlInstance) {
       s.failed("Could not find the Cloud SQL instance. Aborting upgrade.");
@@ -303,16 +338,7 @@ export function startConverge(
     }
     const roleTarget = { projectId: install.projectId, env: install.env, sqlInstance };
     const roleDeps = { ...runDeps, ...(deps.http ? { http: deps.http } : {}) };
-    const gatewayRole = await ensureGatewayRolePassword(roleTarget, roleDeps);
-    if (gatewayRole.status === "failed") {
-      s.failed("gateway_role could not be given its password. Aborting upgrade.");
-      r.error(`  ${gatewayRole.error ?? ""}`);
-      r.warn(
-        "Migrations ran (0248 creates gateway_role); no traffic was shifted. Fix the above and re-run upgrade.",
-      );
-      return false;
-    }
-    s.done("gateway_role ready");
+    s.done("public_role ready to switch");
     publicRole = planPublicRoleSwitch(roleTarget, service("gateway").liveEnv, roleDeps);
     return true;
   }
@@ -420,6 +446,7 @@ export function startConverge(
       if (!(await publicRoleIsolation())) return false;
       await mcpAccess();
       await urlMapRedirectsAccess();
+      await auditJob();
       return true;
     },
 

package/src/upgrade/upgrade.test.ts

@@ -60,7 +60,9 @@ const serviceJson = (image: string, env: unknown[]) =>
     },
   });
 
-const ADMIN_JSON = serviceJson("registry/admin@sha256:old", [
+/** The admin image the install runs before the upgrade (digest-pinned, as deployed). */
+const OLD_ADMIN_IMAGE = `registry/admin@sha256:${"0".repeat(64)}`;
+const ADMIN_JSON = serviceJson(OLD_ADMIN_IMAGE, [
   { name: "CAELO_FIREBASE_SITE", value: "caelo-production-site-abc123" },
   {
     name: "ADMIN_DATABASE_URL",
@@ -98,6 +100,10 @@ function fakeInstall(events: string[], overrides: [RegExp, Answer][] = []) {
     [new RegExp(`describe ${ADMIN} .*--format=json`), ok(ADMIN_JSON)],
     [new RegExp(`describe ${GATEWAY} .*--format=json`), ok(GATEWAY_JSON)],
     [/describe (\S+) .*status\.url/, (l) => ok(`https://${l.split(" ")[3]}-xyz.a.run.app\n`)],
+    [
+      /^run jobs describe caelo-production-audit .*containers\[0\]\.image/,
+      ok(`${OLD_ADMIN_IMAGE}\n`),
+    ],
     [/^sql instances list/, ok(`${SQL}\n`)],
     [/^sql backups list/, ok(`${BACKUP_ID}\n`)],
     [
@@ -223,7 +229,7 @@ const CONVERGE_WRITE =
   /add-iam-policy-binding|remove-iam-policy-binding|set-iam-policy|service-accounts create|secrets create|secrets versions add|services enable|roles create|roles update|roles undelete|firewall-rules delete|users assign-roles/;
 /** Calls that move a service or run migrations — app-roll-only. */
 const APP_ROLL_WRITE =
-  /^run services update |^run services update-traffic|jobs execute caelo-migrate/;
+  /^run services update |^run services update-traffic|jobs execute caelo-migrate|^run jobs update caelo-production-audit /;
 /** Any gcloud call that changes something. */
 const ANY_WRITE =
   /\b(create|update|update-traffic|delete|add-iam-policy-binding|remove-iam-policy-binding|set-iam-policy|execute|enable|add|restore)\b/;
@@ -285,6 +291,69 @@ describe("upgradeGcpInstall — converge, then app-roll", () => {
     );
   });
 
+  it("sets up the quality-audit job on the CURRENT admin image before the roll, then moves it with the admin (#875)", async () => {
+    const events: string[] = [];
+    const { deps, lines } = upgradeDeps(events);
+    expect(await upgradeGcpInstall(TARGET, deps)).toBe(true);
+    const deploy = indexOf(events, /^gcloud run jobs deploy caelo-production-audit /);
+    const adminRoll = indexOf(events, new RegExp(`^gcloud run services update ${ADMIN} `));
+    const move = indexOf(events, /^gcloud run jobs update caelo-production-audit /);
+    const deep = indexOf(events, /^health deep/);
+    expect(events[deploy]).toContain(`--image=${OLD_ADMIN_IMAGE}`);
+    expect(deploy < adminRoll && adminRoll < move && move < deep).toBe(true);
+    expect(events[move]).toContain(`--image=${IMAGES.admin.imageRef}`);
+    expect(lines).toContain("done: Quality-audit job ready (Stage audits run in parallel)");
+  });
+
+  it("a failed audit-job setup leaves the converge incomplete and the admin's audit env untouched", async () => {
+    const events: string[] = [];
+    const { deps, recorded, lines } = upgradeDeps(events, {
+      overrides: [[/^run jobs deploy caelo-production-audit/, fail("PERMISSION_DENIED")]],
+    });
+    expect(await upgradeGcpInstall(TARGET, deps)).toBe(true);
+    expect(recorded.contract).toEqual([]);
+    expect(lines.some((l) => l.includes("Quality-audit job not set up"))).toBe(true);
+    expect(
+      events.some((e) => /services update caelo-production-admin.*CAELO_AUDIT_JOB=/.test(e)),
+    ).toBe(false);
+  });
+
+  it("an unreadable audit job is reported as an error, not as a missing job, and is not moved", async () => {
+    const events: string[] = [];
+    const { deps, lines } = upgradeDeps(events, {
+      overrides: [
+        [
+          /^run jobs describe caelo-production-audit .*containers\[0\]\.image/,
+          fail("PERMISSION_DENIED"),
+        ],
+      ],
+    });
+    expect(await upgradeGcpInstall(TARGET, deps)).toBe(true);
+    expect(
+      lines.some((l) => l.includes("Could not read the quality-audit job (PERMISSION_DENIED)")),
+    ).toBe(true);
+    expect(lines.some((l) => l.includes("has no quality-audit job yet"))).toBe(false);
+    expect(events.some((e) => /^gcloud run jobs update caelo-production-audit /.test(e))).toBe(
+      false,
+    );
+  });
+
+  it("a missing audit job is reported as missing", async () => {
+    const events: string[] = [];
+    const { deps, lines } = upgradeDeps(events, {
+      overrides: [
+        [
+          /^run jobs describe caelo-production-audit .*containers\[0\]\.image/,
+          fail(
+            "ERROR: (gcloud.run.jobs.describe) Cannot find job [caelo-production-audit]. NOT_FOUND",
+          ),
+        ],
+      ],
+    });
+    expect(await upgradeGcpInstall(TARGET, deps)).toBe(true);
+    expect(lines.some((l) => l.includes("has no quality-audit job yet"))).toBe(true);
+  });
+
   it("without an ops image the upgrader step fails, the roll goes on, the converge is incomplete", async () => {
     const events: string[] = [];
     const { deps, recorded, lines } = upgradeDeps(events);
@@ -378,6 +447,11 @@ describe("upgradeGcpInstall — converge, then app-roll", () => {
         `${ADMIN} --region europe-west1 --project acme --to-revisions ${ADMIN}-00001-old=100`,
       ),
     ]);
+    // The audit job follows the admin back to its prior image (#875).
+    const jobBack = events
+      .slice(deep)
+      .filter((e) => e.startsWith("gcloud run jobs update caelo-production-audit "));
+    expect(jobBack).toEqual([expect.stringContaining(`--image=${OLD_ADMIN_IMAGE}`)]);
     expect(recorded.digests).toEqual([]);
     expect(recorded.contract).toEqual([]);
     const restore = `gcloud sql backups restore ${BACKUP_ID} --restore-instance=${SQL} --project=acme`;

package/src/upgrader-assess.test.ts

@@ -30,6 +30,7 @@ const POLICY: StoredUpdatePolicy = {
   autoSecurity: true,
   autoPatch: true,
   autoMinor: true,
+  autoConverge: false,
   channel: "stable",
   windowStart: null,
   windowEnd: null,

package/src/upgrader-job.test.ts

@@ -49,6 +49,7 @@ const POLICY: StoredUpdatePolicy = {
   autoSecurity: false,
   autoPatch: false,
   autoMinor: false,
+  autoConverge: false,
   channel: "stable",
   windowStart: null,
   windowEnd: null,

package/src/upgrader-setup.test.ts

@@ -83,6 +83,7 @@ describe("ensureUpgraderJob", () => {
         "iam service-accounts add-iam-policy-binding caelo-production-gateway-sa@acme.iam.gserviceaccount.com → roles/iam.serviceAccountUser",
         "iam service-accounts add-iam-policy-binding caelo-production-upgrader@acme.iam.gserviceaccount.com → roles/iam.serviceAccountUser",
         "iam service-accounts add-iam-policy-binding caelo-mcp@acme.iam.gserviceaccount.com → roles/iam.serviceAccountTokenCreator",
+        "iam service-accounts add-iam-policy-binding caelo-production-audit@acme.iam.gserviceaccount.com → roles/iam.serviceAccountUser",
         "storage buckets add-iam-policy-binding gs://acme-caelo-ops → roles/storage.objectUser",
         "storage buckets add-iam-policy-binding gs://acme-caelo-ops → projects/acme/roles/caeloUpgraderOpsList",
       ].sort(),

package/src/upgrader-setup.ts

@@ -21,8 +21,9 @@
  *     move traffic, recreate the migration job, update its own job image.
  *     It includes no `*.setIamPolicy`.
  *   - `roles/iam.serviceAccountUser` on exactly the admin's and the
- *     gateway's runtime service accounts (a revision runs as them) and on
- *     itself (its own job) — not on the project.
+ *     gateway's runtime service accounts (a revision runs as them), on
+ *     itself (its own job) and on the quality-audit job's account (the
+ *     app-roll moves that job's image, #875) — not on the project.
  *   - the custom role `caeloUpgraderSqlBackup`: create/read Cloud SQL
  *     backups and read the instance — no restore, no instance changes.
  *   - `roles/cloudsql.instanceUser` + a Cloud SQL IAM database user that
@@ -51,6 +52,7 @@ import { ensureCloudSqlIamUser } from "./cloudsql-iam-user.js";
 import { gcloud as defaultGcloud, type GcloudResult } from "./gcloud.js";
 import { type GcloudRunner, realSleep, runWithRetry, type Sleep } from "./gcloud-retry.js";
 import {
+  auditServiceAccountEmail,
   gatewayServiceAccountEmail,
   mcpIapServiceAccountEmail,
   runServiceAccountEmail,
@@ -256,6 +258,11 @@ export async function ensureUpgraderJob(
       why: "gateway revisions run as it",
     },
     { account: sa, role: "roles/iam.serviceAccountUser", why: "the job updates its own image" },
+    {
+      account: auditServiceAccountEmail(projectId, env),
+      role: "roles/iam.serviceAccountUser",
+      why: "the app-roll moves the quality-audit job, which runs as it, onto the new image",
+    },
     {
       account: mcpIapServiceAccountEmail(projectId),
       role: "roles/iam.serviceAccountTokenCreator",

package/src/wizards/gcp-cost.ts

@@ -101,10 +101,10 @@ export function estimateGcpCost(inputs: CostEstimateInputs): {
           : `${inputs.adminMinInstances} min-instance${inputs.adminMinInstances > 1 ? "s" : ""} (no cold start)`,
     },
     {
-      name: "Quality checks (Lighthouse on the admin)",
-      monthlyUsd: 1,
+      name: "Quality checks (Cloud Run audit job)",
+      monthlyUsd: 2,
       notes:
-        "~2-4 min of admin CPU per audited Stage (up to 5 pages x 5 runs); ~$1/mo at a few Stages a day",
+        "one container per Lighthouse run, all in parallel (up to 5 pages x 3 runs, ~90 s at 2 vCPU each): ~$0.05 per audited Stage, partly in the free tier; results bucket ~$0",
     },
     {
       name: "Cloud Run gateway",

package/src/wizards/gcp-pulumi.ts

@@ -13,6 +13,7 @@
 
 import { resolve as resolvePath } from "node:path";
 import * as pulumi from "@pulumi/pulumi/automation";
+import { AUDIT_PARALLELISM_DEFAULT } from "../audit-job-setup.js";
 import { checkpointableOutputs } from "../checkpoint-secrets.js";
 import { GCP_STACK_ENV } from "../gcp-names.js";
 import type { ImageDigests } from "../install-state.js";
@@ -36,6 +37,12 @@ export const GCP_STACK_KNOB_DEFAULTS = {
   adminMemory: ADMIN_MEMORY_DEFAULT,
   gatewayMinInstances: 0,
   wafAdaptiveProtection: false,
+  /**
+   * #875 — audit tasks at once. Not stack config: the audit job is
+   * CLI-owned (audit-job-setup.ts), so the wizard passes it to the job and
+   * `upgrade` keeps whatever the job has.
+   */
+  auditParallelism: AUDIT_PARALLELISM_DEFAULT,
 } as const;
 
 export interface PulumiUpInputs {

package/src/wizards/gcp.ts

@@ -33,6 +33,7 @@ import { join } from "node:path";
 import { cancel, confirm, isCancel, log, note, select, spinner } from "@clack/prompts";
 import { bold, cyan, dim, green, red, yellow } from "kleur/colors";
 import { checkAdcImpersonation } from "../adc-impersonation.js";
+import { ensureAuditJob, resolveAdminImage } from "../audit-job-setup.js";
 import { CERT_WAIT_TIMEOUT_MS, lbCertProbe, waitForCert } from "../cert-wait.js";
 import { redactCredentials } from "../checkpoint-secrets.js";
 import { removeDefaultFirewallRules } from "../default-firewall.js";
@@ -45,7 +46,6 @@ import {
 import { formatDnsRecordGroups, groupDnsRecords, type InstallDnsRecord } from "../dns/groups.js";
 import { pickDnsAdapter } from "../dns/index.js";
 import type { DnsRecord } from "../dns/types.js";
-import { ensureGatewayRolePassword, findSqlInstance } from "../gateway-credentials.js";
 import {
   activeAccount,
   type BillingAccount,
@@ -453,13 +453,11 @@ export async function runGcpConverge(opts: GcpConvergeOpts): Promise<void> {
     }
   }
 
-  // === 11.2. The gateway's database login (#613) ===
-  // Migration 0248 created gateway_role without a password; it gets the
-  // gateway-role-password secret's value here. The gateway (deployed by
-  // Pulumi before migrations) retries its database on every request, so it
-  // starts serving /api/* as soon as this lands — no restart.
-  phase("Finishing: database logins, operator access, welcome page");
-  await stepGatewayRolePassword(projectId);
+  phase("Finishing: operator access, welcome page");
+
+  // === 11.3. The quality-audit job: parallel Lighthouse runs (#875) ===
+  // Before the upgrader, which gets actAs on the job's service account.
+  await stepAuditJob(projectId, region, provider);
 
   // === 11.4. The upgrader job: Settings → Updates → Install update (#696) ===
   // Before operator access, which keeps the upgrader's caelo-mcp grant.
@@ -934,29 +932,6 @@ async function stepUrlMapRedirectsAccess(projectId: string): Promise<void> {
   s.stop(green(`Redirects role ready (${r.role})`));
 }
 
-/**
- * Give `gateway_role` (created by migration 0248) its password from the
- * `gateway-role-password` secret (#613). public_role already has its own:
- * the stack set it from `public-role-password`. Idempotent, so it runs on
- * every wizard pass.
- */
-async function stepGatewayRolePassword(projectId: string): Promise<void> {
-  const s = spinner();
-  s.start("Setting the gateway's database login (gateway_role)...");
-  const install = { projectId, env: GCP_STACK_ENV };
-  const sqlInstance = await findSqlInstance(install);
-  const r = sqlInstance
-    ? await ensureGatewayRolePassword({ ...install, sqlInstance })
-    : { status: "failed" as const, error: "the Cloud SQL instance was not found" };
-  if (r.status === "failed") {
-    s.stop(red(`Failed: ${r.error ?? ""}`));
-    log.error("Re-run the wizard once the cause is fixed (this step is idempotent).");
-    cancel("Aborted.");
-    process.exit(1);
-  }
-  s.stop(green("gateway_role ready"));
-}
-
 /**
  * Set up the upgrader job (upgrader-setup.ts, #696): what the admin's
  * "Install update" starts. After migrations, because the job's database
@@ -1006,6 +981,38 @@ async function stepUpgraderJob(
   return true;
 }
 
+/**
+ * Set up the quality-audit job (audit-job-setup.ts) on the deployed admin's
+ * image. A failure stops the wizard: without the job every Stage audit
+ * fails. Idempotent, so it runs on every wizard pass.
+ */
+async function stepAuditJob(
+  projectId: string,
+  region: string,
+  provider: "gcp" | "gcp-firebase",
+): Promise<void> {
+  const s = spinner();
+  s.start("Setting up the quality-audit job (parallel Lighthouse runs)...");
+  const image = await resolveAdminImage({ projectId, region, env: GCP_STACK_ENV });
+  const r = image.ok
+    ? await ensureAuditJob({
+        provider,
+        projectId,
+        region,
+        env: GCP_STACK_ENV,
+        adminImageRef: image.imageRef,
+        parallelism: GCP_STACK_KNOB_DEFAULTS.auditParallelism,
+      })
+    : { ok: false as const, done: [], error: image.error };
+  if (!r.ok) {
+    s.stop(red(`Failed: ${r.error}`));
+    log.error("Re-run the wizard once the cause is fixed (this step is idempotent).");
+    cancel("Aborted.");
+    process.exit(1);
+  }
+  s.stop(green(`Quality-audit job ready (${r.done.length} steps)`));
+}
+
 /**
  * Whether an upgrader set up by an earlier run exists, so a failed setup
  * this time still keeps its caelo-mcp signing grant (the operator-access

package/stacks/aws/README.md

@@ -10,7 +10,7 @@ Pulumi stack provisioning Caelo on AWS managed services. Implements the shared `
 | Blob storage | Two S3 buckets (`caelo-<env>-media` + `caelo-<env>-static`) |
 | CDN | CloudFront distribution with two origins (S3 static + S3 media); static files are served as files, no edge compute on the request path |
 | Container runtime | ECS Fargate cluster + four services (admin / gateway / orchestrator / runner) |
-| Secret store | AWS Secrets Manager (postgres-password, public-role-password, gateway-role-password, csrf-secret, cookie-secret, anthropic-api-key, resend-api-key). The gateway gets `publicDatabaseUrlOut` only, never a cms_admin URL of any role (#613, #635). |
+| Secret store | AWS Secrets Manager (postgres-password, public-role-password, csrf-secret, cookie-secret, anthropic-api-key, resend-api-key). The gateway gets `publicDatabaseUrlOut` only, never a cms_admin URL of any role (#613, #635). |
 | DNS + cert | ACM cert (us-east-1, DNS-validated, supports `*.<domain>`) |
 | Edge-log sink | CloudFront access logs delivered to the CloudWatch log group `/caelo/<env>/cloudfront` in us-east-1 (queryable by P12A analytics plugin) |
 

package/stacks/aws/index.ts

@@ -97,11 +97,8 @@ function randomHex(bytes: number): string {
 const postgresPassword = pulumi.secret(randomHex(32));
 // #613 — one password per database role, so the gateway (public_role only,
 // #635) never holds admin_role's. bootstrap.sh creates the roles with these
-// (PUBLIC_ROLE_PASSWORD / GATEWAY_ROLE_PASSWORD). gateway_role is no longer
-// any service's login; its password stays until the contract release that
-// drops the role (#635).
+// (ADMIN_ROLE_PASSWORD / PUBLIC_ROLE_PASSWORD).
 const publicRolePassword = pulumi.secret(randomHex(32));
-const gatewayRolePassword = pulumi.secret(randomHex(32));
 const csrfSecret = pulumi.secret(randomHex(32));
 const cookieSecret = pulumi.secret(randomHex(32));
 const anthropicApiKey = pulumi.secret(process.env.ANTHROPIC_API_KEY ?? "");
@@ -122,7 +119,6 @@ function secret(name: string, value: pulumi.Output<string>): aws.secretsmanager.
 
 const pgSecret = secret("postgres-password", postgresPassword);
 const publicRoleSecret = secret("public-role-password", publicRolePassword);
-const gatewayRoleSecret = secret("gateway-role-password", gatewayRolePassword);
 const csrfSecretRes = secret("csrf-secret", csrfSecret);
 const cookieSecretRes = secret("cookie-secret", cookieSecret);
 const anthropicSecretRes = secret("anthropic-api-key", anthropicApiKey);
@@ -353,6 +349,14 @@ new aws.cloudwatch.LogDelivery(
 //
 // Each Caelo service runs as its own Fargate service; sharing a cluster
 // keeps the per-month Fargate-cluster fee at zero (clusters are free).
+//
+// FIXME(issue #749): no quality-audit task definition yet. On GCP every
+// Lighthouse run of a Stage audit runs in its own container (#875,
+// src/audit-job-setup.ts); the AWS equivalent is a Fargate task per run
+// (admin-core quality/parallel-runner.ts `AuditTaskLauncher`). Until it
+// exists the admin records every Lighthouse audit as failed with that gap
+// (quality/lighthouse-runner-select.ts) instead of measuring on its own
+// shared CPU. Nothing is staged on AWS before #749 either.
 const cluster = new aws.ecs.Cluster(`${namePrefix}-ecs`, {
   settings: [{ name: "containerInsights", value: "enabled" }],
 });
@@ -365,7 +369,6 @@ const cluster = new aws.ecs.Cluster(`${namePrefix}-ecs`, {
 const secretArns: Record<AwsSecret, pulumi.Output<string>> = {
   "postgres-password": pgSecret.arn,
   "public-role-password": publicRoleSecret.arn,
-  "gateway-role-password": gatewayRoleSecret.arn,
   "csrf-secret": csrfSecretRes.arn,
   "cookie-secret": cookieSecretRes.arn,
   "anthropic-api-key": anthropicSecretRes.arn,

package/stacks/azure/README.md

@@ -10,7 +10,7 @@ Pulumi stack provisioning Caelo on Azure managed services. Implements the shared
 | Blob storage | Storage Account with a private `media` container and static-website hosting (`$web`) |
 | CDN / Edge | Azure Front Door Standard: the primary domain serves the static website as files, with a Front Door managed certificate; no edge compute on the request path |
 | Container runtime | Four Container Apps (admin / gateway / orchestrator / runner) in one managed environment |
-| Secret store | Key Vault (postgres-password, public-role-password, gateway-role-password, csrf-secret, cookie-secret, anthropic-api-key, resend-api-key). The gateway container gets `PUBLIC_DATABASE_URL` only, never a cms_admin credential of any role (#613, #635). |
+| Secret store | Key Vault (postgres-password, public-role-password, csrf-secret, cookie-secret, anthropic-api-key, resend-api-key). The gateway container gets `PUBLIC_DATABASE_URL` only, never a cms_admin credential of any role (#613, #635). |
 | Edge-log sink | Log Analytics workspace receives Container Apps logs (queryable by P12A analytics plugin via Azure Monitor) |
 
 The Caelo runtime never knows it's on Azure — every Container App consumes plain `DATABASE_URL` / `MEDIA_STORAGE_URL` / `SECRETS_PROVIDER` env vars.