@caelo-cms/provisioning 0.10.57 → 0.10.59

package/src/stack-contract.test.ts

@@ -72,7 +72,8 @@ describe("adminEnvContract", () => {
       MEDIA_ROOT_DIR: "/app/apps/admin/data/media",
       CAELO_MCP_IAP_SERVICE_ACCOUNT: "caelo-mcp@acme.iam.gserviceaccount.com",
       // #806 — where Settings → MCP → Remote writes the OAuth client.
-      CAELO_MCP_OAUTH_CLIENT_STORE: "projects/acme/secrets/caelo-production-mcp-oauth-client",
+      CAELO_OPERATOR_OAUTH_CLIENT_STORE:
+        "projects/acme/secrets/caelo-production-operator-oauth-client",
       CAELO_OPERATOR_ACCESS_JOB:
         "projects/acme/locations/europe-west1/jobs/caelo-production-operator-access-sync",
       CAELO_UPGRADER_JOB: "projects/acme/locations/europe-west1/jobs/caelo-production-upgrader",
@@ -107,7 +108,8 @@ describe("adminEnvContract", () => {
       MEDIA_ROOT_DIR: "/app/apps/admin/data/media",
       CAELO_MCP_IAP_SERVICE_ACCOUNT: "caelo-mcp@acme.iam.gserviceaccount.com",
       // #806 — where Settings → MCP → Remote writes the OAuth client.
-      CAELO_MCP_OAUTH_CLIENT_STORE: "projects/acme/secrets/caelo-production-mcp-oauth-client",
+      CAELO_OPERATOR_OAUTH_CLIENT_STORE:
+        "projects/acme/secrets/caelo-production-operator-oauth-client",
       CAELO_OPERATOR_ACCESS_JOB:
         "projects/acme/locations/europe-west1/jobs/caelo-production-operator-access-sync",
       CAELO_UPGRADER_JOB: "projects/acme/locations/europe-west1/jobs/caelo-production-upgrader",
@@ -174,7 +176,7 @@ describe("gatewayEnvContract", () => {
       PUBLIC_DATABASE_PASSWORD: "secret:caelo-production-public-role-password:latest",
       CAELO_STAGING_GATE_SECRET: "secret:caelo-production-staging-gate-secret:latest",
       // #806 — the remote-MCP broker: its client file and its seal key.
-      CAELO_MCP_OAUTH_CLIENT_FILE: "/secrets/mcp-oauth-client/client.json",
+      CAELO_OPERATOR_OAUTH_CLIENT_FILE: "/secrets/operator-oauth-client/client.json",
       CAELO_MCP_OAUTH_SEAL_KEY: "secret:caelo-production-mcp-oauth-seal-key:latest",
     });
   });
@@ -212,7 +214,7 @@ describe("gatewayEnvContract", () => {
       "staging-gate-secret",
       // #806 — the broker's seal key (env) and OAuth client (file).
       "mcp-oauth-seal-key",
-      "mcp-oauth-client",
+      "operator-oauth-client",
     ]);
     for (const v of gateway) {
       expect(v.name).not.toMatch(/KEK|INTERNAL|TOOL_APPROVAL|PUBLIC_ADMIN/);
@@ -318,8 +320,8 @@ describe("runtime secrets", () => {
       // The secret file counts like an env secret: the SA reads it.
       {
         service: "gateway",
-        secret: "mcp-oauth-client",
-        stackResource: "gateway-mcp-oauth-client-binding",
+        secret: "operator-oauth-client",
+        stackResource: "gateway-operator-oauth-client-binding",
       },
     ]);
   });
@@ -377,14 +379,14 @@ describe("stackIamInvariants", () => {
     }
   });
 
-  it("grants the gateway SA only its own role password, the staging gate key, remote MCP's two secrets + telemetry roles", () => {
+  it("grants the gateway SA only its own role password, the staging gate key, the sign-in client, the seal key + telemetry roles", () => {
     for (const provider of ["gcp", "gcp-firebase"] as const) {
       const gateway = stackIamInvariants(provider).filter((i) => i.member === "gateway-sa");
       expect(gateway.map((i) => `${i.role} ${JSON.stringify(i.target)}`).sort()).toEqual([
         'roles/logging.logWriter {"kind":"project"}',
         'roles/monitoring.metricWriter {"kind":"project"}',
-        'roles/secretmanager.secretAccessor {"kind":"secret","name":"mcp-oauth-client"}',
         'roles/secretmanager.secretAccessor {"kind":"secret","name":"mcp-oauth-seal-key"}',
+        'roles/secretmanager.secretAccessor {"kind":"secret","name":"operator-oauth-client"}',
         'roles/secretmanager.secretAccessor {"kind":"secret","name":"public-role-password"}',
         'roles/secretmanager.secretAccessor {"kind":"secret","name":"staging-gate-secret"}',
       ]);

package/src/stack-contract.ts

@@ -261,12 +261,15 @@ export type RuntimeSecret =
   | "tool-approval-secret"
   | "staging-gate-secret"
   /**
-   * #806 — the Google OAuth client the remote-MCP broker signs users in
-   * with: JSON `{"client_id","client_secret"}`, `{}` while remote MCP is not
-   * set up. The Owner writes it from Settings → MCP → Remote (the admin may
-   * add versions, never read them); the gateway reads it from a file.
+   * #914 — the install's Google sign-in client: JSON
+   * `{"client_id","client_secret"}`, `{}` while it is not set up. One client
+   * for IAP browser login, IAP programmatic access and the remote-MCP broker
+   * (#806 introduced it as `mcp-oauth-client`). The Owner writes it from
+   * Settings → Google sign-in (the admin may add versions, never read them);
+   * the gateway reads it from a file, the operator-access sync job reads it
+   * to hand it to IAP.
    */
-  | "mcp-oauth-client"
+  | "operator-oauth-client"
   /**
    * #806 — the broker's AES-256-GCM key (base64, 32 bytes) that seals its
    * stateless OAuth state, codes and refresh tokens. Gateway only.
@@ -305,10 +308,11 @@ export const CLI_GENERATED_SECRETS = [
   // session cookies, derives the crawler credentials. Read by the admin
   // (issues) and the gateway (verifies).
   "staging-gate-secret",
-  // #806 — remote MCP. The client starts as the `{}` placeholder (not
-  // configured; the Owner fills it under Settings → MCP), the seal key as
-  // 32 random bytes in base64 ({@link GENERATED_SECRET_FORMAT}).
-  "mcp-oauth-client",
+  // #914 / #806 — the Google sign-in client starts as the `{}` placeholder
+  // (not configured; the Owner fills it under Settings → Google sign-in),
+  // the broker's seal key as 32 random bytes in base64
+  // ({@link GENERATED_SECRET_FORMAT}).
+  "operator-oauth-client",
   "mcp-oauth-seal-key",
 ] as const satisfies readonly RuntimeSecret[];
 
@@ -331,12 +335,28 @@ export const GENERATED_SECRET_FORMAT: Readonly<
   "staging-gate-secret": { kind: "hex32" },
   // The gateway's seal key contract (#806): base64 of exactly 32 bytes.
   "mcp-oauth-seal-key": { kind: "base64-32" },
-  // "Not configured" until the Owner pastes a client (#806). A version must
+  // "Not configured" until the Owner pastes a client (#914). A version must
   // exist from the start: Cloud Run refuses a revision whose secret volume
   // points at a secret without an enabled version.
-  "mcp-oauth-client": { kind: "placeholder", value: "{}" },
+  "operator-oauth-client": { kind: "placeholder", value: "{}" },
 };
 
+/**
+ * Secrets an older contract created that nothing reads any more. Upgrade
+ * deletes each once both services rolled onto revisions that no longer
+ * reference it (stack-converge.ts `deleteRetiredSecrets`); deleting a
+ * secret drops its IAM bindings with it. Pre-1.0 delete-don't-migrate: a
+ * renamed secret is created fresh, never copied.
+ */
+export const RETIRED_RUNTIME_SECRETS: readonly { readonly name: string; readonly why: string }[] = [
+  {
+    // #914 — renamed to `operator-oauth-client`; nobody had configured
+    // remote MCP when the rename shipped, so there is nothing to carry over.
+    name: "mcp-oauth-client",
+    why: "the Google sign-in client moved to operator-oauth-client (#914)",
+  },
+];
+
 /**
  * Each service's Secret Manager-backed env vars and the secret each reads.
  * The services' run SAs get `secretAccessor` on exactly these secrets
@@ -375,8 +395,8 @@ export const SERVICE_SECRET_ENV: Readonly<
 // Secret files (#806)
 // ===========================================================================
 
-/** Env var naming the file that holds the remote-MCP Google OAuth client. */
-export const MCP_OAUTH_CLIENT_FILE_ENV = "CAELO_MCP_OAUTH_CLIENT_FILE";
+/** Env var naming the file that holds the install's Google sign-in client (#914). */
+export const OPERATOR_OAUTH_CLIENT_FILE_ENV = "CAELO_OPERATOR_OAUTH_CLIENT_FILE";
 
 /**
  * A Secret Manager secret mounted into a service as one file, at `latest`.
@@ -386,7 +406,7 @@ export const MCP_OAUTH_CLIENT_FILE_ENV = "CAELO_MCP_OAUTH_CLIENT_FILE";
  * time the file is read ("When reading a volume, Cloud Run always fetches
  * the secret value from the Secret Manager to use the value with the latest
  * version" — cloud.google.com/run/docs/configuring/services/secrets). So the
- * client the Owner saves under Settings → MCP reaches the running gateway
+ * client the Owner saves under Settings → Google sign-in reaches the running gateway
  * (which re-reads it within 60 s) without a new revision, and the admin
  * needs no right to deploy the gateway.
  */
@@ -401,11 +421,11 @@ export interface SecretFileContract {
   readonly version: "latest";
 }
 
-/** The gateway's remote-MCP OAuth client file (#806). */
-export const MCP_OAUTH_CLIENT_FILE: SecretFileContract = {
-  secret: "mcp-oauth-client",
-  volumeName: "mcp-oauth-client",
-  mountDir: "/secrets/mcp-oauth-client",
+/** The gateway's Google sign-in client file, read by the remote-MCP broker (#806, #914). */
+export const OPERATOR_OAUTH_CLIENT_FILE: SecretFileContract = {
+  secret: "operator-oauth-client",
+  volumeName: "operator-oauth-client",
+  mountDir: "/secrets/operator-oauth-client",
   fileName: "client.json",
   version: "latest",
 };
@@ -418,7 +438,30 @@ export function secretFilePath(file: SecretFileContract): string {
 /** Each service's secret files. The admin has none. */
 export const SERVICE_SECRET_FILES: Readonly<Record<CloudRunSlug, readonly SecretFileContract[]>> = {
   admin: [],
-  gateway: [MCP_OAUTH_CLIENT_FILE],
+  gateway: [OPERATOR_OAUTH_CLIENT_FILE],
+};
+
+/** A secret file an older contract mounted; upgrade unmounts it in the roll. */
+export interface RetiredSecretFile {
+  readonly mountDir: string;
+  readonly fileName: string;
+  readonly why: string;
+}
+
+/**
+ * Secret files older contracts mounted that nothing reads any more, per
+ * service. The roll removes each mount (`--remove-secrets=<path>`) in the
+ * same revision that mounts its replacement.
+ */
+export const RETIRED_SECRET_FILES: Readonly<Record<CloudRunSlug, readonly RetiredSecretFile[]>> = {
+  admin: [],
+  gateway: [
+    {
+      mountDir: "/secrets/mcp-oauth-client",
+      fileName: "client.json",
+      why: "the Google sign-in client is mounted from operator-oauth-client now (#914)",
+    },
+  ],
 };
 
 /**
@@ -466,8 +509,11 @@ export function serviceSecrets(service: CloudRunSlug): RuntimeSecret[] {
  * credential is in its env (apps/api-gateway `adminDatabaseAccessInEnv`).
  */
 export const RETIRED_SERVICE_ENV: Readonly<Record<CloudRunSlug, readonly string[]>> = {
-  admin: [],
+  // #914 — the sign-in client's store was renamed with its secret.
+  admin: ["CAELO_MCP_OAUTH_CLIENT_STORE"],
   gateway: [
+    // #914 — renamed to CAELO_OPERATOR_OAUTH_CLIENT_FILE with its secret.
+    "CAELO_MCP_OAUTH_CLIENT_FILE",
     "CAELO_SECRET_KEK",
     "ADMIN_DATABASE_URL",
     "ADMIN_DATABASE_PASSWORD",
@@ -547,7 +593,7 @@ export function gatewayEnvContract<V>(inputs: RuntimeEnvInputs<V>): CloudRunEnvV
     { name: "PUBLIC_DATABASE_URL", value: inputs.databaseUrls.public },
     // #806 — where the remote-MCP broker reads its Google OAuth client
     // (the secret volume of SERVICE_SECRET_FILES).
-    { name: MCP_OAUTH_CLIENT_FILE_ENV, value: secretFilePath(MCP_OAUTH_CLIENT_FILE) },
+    { name: OPERATOR_OAUTH_CLIENT_FILE_ENV, value: secretFilePath(OPERATOR_OAUTH_CLIENT_FILE) },
     ...secretEnv("gateway", inputs.env),
   ];
 }
@@ -565,12 +611,12 @@ export function gatewayEnvContract<V>(inputs: RuntimeEnvInputs<V>): CloudRunEnvV
  */
 export const GATEWAY_TIMEOUT_SECONDS = 3600;
 
-/** Admin env var naming the Secret Manager secret the Owner writes the OAuth client to. */
-export const MCP_OAUTH_CLIENT_STORE_ENV = "CAELO_MCP_OAUTH_CLIENT_STORE";
+/** Admin env var naming the Secret Manager secret the Owner writes the Google sign-in client to. */
+export const OPERATOR_OAUTH_CLIENT_STORE_ENV = "CAELO_OPERATOR_OAUTH_CLIENT_STORE";
 
-/** `projects/<project>/secrets/<id>` of the remote-MCP OAuth client secret. */
-export function mcpOAuthClientSecretResource(projectId: string, env: string): string {
-  return `projects/${projectId}/secrets/${gcpSecretId(env, "mcp-oauth-client")}`;
+/** `projects/<project>/secrets/<id>` of the Google sign-in client secret (#914). */
+export function operatorOAuthClientSecretResource(projectId: string, env: string): string {
+  return `projects/${projectId}/secrets/${gcpSecretId(env, "operator-oauth-client")}`;
 }
 
 // ===========================================================================
@@ -594,6 +640,12 @@ export function mcpOAuthClientSecretResource(projectId: string, env: string): st
  * (remote-mcp.ts `ensureRemoteMcpIdentityEnv`). A roll that does not set
  * them leaves them as they are (planEnvUpdate never removes a var the
  * contract does not own).
+ *
+ * #914 adds two the admin's Google sign-in needs: its own URL (the
+ * self-check opens it signed out) and the project's Google organisation
+ * domain, which the admin's service account cannot read (organisation
+ * metadata needs a grant on the organisation) but the operator's identity
+ * usually can.
  */
 export interface RemoteMcpIdentity {
   /** Where the gateway proxies `/api/mcp/<surface>` to (IAP in front). */
@@ -602,6 +654,12 @@ export interface RemoteMcpIdentity {
   readonly mcpPublicUrl: string;
   /** The `aud` of the admin's IAP JWTs. */
   readonly iapAudience: string;
+  /**
+   * #914 — the project's Google organisation domain, `none` when the project
+   * is in no organisation, undefined when it could not be read (the var is
+   * then left as it is and the admin reports the organisation as unknown).
+   */
+  readonly googleOrgDomain?: string;
 }
 
 /** Env var names of {@link RemoteMcpIdentity}. */
@@ -609,6 +667,7 @@ export const REMOTE_MCP_ENV = {
   adminUrl: "CAELO_ADMIN_URL",
   mcpPublicUrl: "CAELO_MCP_PUBLIC_URL",
   iapAudience: "CAELO_IAP_AUDIENCE",
+  googleOrgDomain: "CAELO_GOOGLE_ORG_DOMAIN",
 } as const;
 
 /** What {@link remoteMcpIdentity} derives the identity from — all read from the live install. */
@@ -668,8 +727,15 @@ export function remoteMcpIdentityEnv(
   return {
     admin: [
       { name: REMOTE_MCP_ENV.iapAudience, value: id.iapAudience },
-      // The setup page shows the redirect URI and the MCP URLs from it.
+      // The setup pages show the redirect URI and the MCP URLs from it.
       { name: REMOTE_MCP_ENV.mcpPublicUrl, value: id.mcpPublicUrl },
+      // #914 — Google sign-in's self-check opens the admin signed out.
+      { name: REMOTE_MCP_ENV.adminUrl, value: id.adminUrl },
+      // #914 — who IAP admits without the Google sign-in client
+      // (admin-core security/identity-gate.ts).
+      ...(id.googleOrgDomain
+        ? [{ name: REMOTE_MCP_ENV.googleOrgDomain, value: id.googleOrgDomain }]
+        : []),
     ],
     gateway: [
       { name: REMOTE_MCP_ENV.adminUrl, value: id.adminUrl },
@@ -722,9 +788,13 @@ export function adminEnvContract<V>(inputs: AdminEnvInputs<V>): CloudRunEnvVar<V
     // where the tasks write their results (audit-job-setup.ts).
     { name: AUDIT_JOB_ENV_VAR, value: auditJobResource(projectId, inputs.region, env) },
     { name: AUDIT_RESULTS_BUCKET_ENV_VAR, value: gcpBucketName(projectId, env, "audit-results") },
-    // #806 — where Settings → MCP → Remote writes the Google OAuth client
-    // (add-version only, see the run SA's secretVersionAdder invariant).
-    { name: MCP_OAUTH_CLIENT_STORE_ENV, value: mcpOAuthClientSecretResource(projectId, env) },
+    // #914 — where Settings → Google sign-in writes the install's Google
+    // sign-in client (add-version only, see the run SA's secretVersionAdder
+    // invariant).
+    {
+      name: OPERATOR_OAUTH_CLIENT_STORE_ENV,
+      value: operatorOAuthClientSecretResource(projectId, env),
+    },
   ];
   if (inputs.provider === "gcp") {
     // v0.2.78 — the GCS StaticPublisher: Stage uploads to staging,
@@ -850,17 +920,18 @@ function secretAccessors(): IamInvariant[] {
 /** Bindings both GCP stacks declare beyond the secret accessors and telemetry. */
 const GCP_COMMON: readonly IamInvariant[] = [
   {
-    stackResource: "admin-mcp-oauth-client-version-adder",
-    // Why the admin may write a secret at all: the Owner pastes the remote-
-    // MCP OAuth client under Settings → MCP → Remote, and the admin stores
-    // it where the gateway reads it. secretVersionAdder is add-version only
-    // (no access, no destroy, no IAM), bound on this one secret only — the
-    // admin can replace the client, never read it or any other secret.
+    stackResource: "admin-operator-oauth-client-version-adder",
+    // Why the admin may write a secret at all: the Owner pastes the
+    // install's Google sign-in client under Settings → Google sign-in, and
+    // the admin stores it where the gateway and the operator-access sync job
+    // read it. secretVersionAdder is add-version only (no access, no
+    // destroy, no IAM), bound on this one secret only — the admin can
+    // replace the client, never read it or any other secret.
     role: SECRET_VERSION_ADDER,
     member: "run-sa",
-    target: { kind: "secret", name: "mcp-oauth-client" },
+    target: { kind: "secret", name: "operator-oauth-client" },
     onFailure: "warn",
-    why: "the Owner's remote-MCP setup (Settings → MCP → Remote) stores the OAuth client; without it only that setup fails",
+    why: "the Owner's Google sign-in setup (Settings → Google sign-in) stores the OAuth client; without it only that setup fails",
   },
 ];
 

package/src/stack-converge-secrets.test.ts

@@ -342,9 +342,10 @@ describe("upgrading a v0.10.35 install: the gateway leaves admin_role (#613)", (
     expect(plan.ok && plan.services.gateway.changes.map((c) => c.name).sort()).toEqual([
       "ADMIN_DATABASE_PASSWORD",
       "ADMIN_DATABASE_URL",
-      // #806 — the remote-MCP broker's client file path and seal key.
-      "CAELO_MCP_OAUTH_CLIENT_FILE",
+      // #806 — the remote-MCP broker's seal key and (#914) the Google
+      // sign-in client file path.
       "CAELO_MCP_OAUTH_SEAL_KEY",
+      "CAELO_OPERATOR_OAUTH_CLIENT_FILE",
       // #650 — the staging gate key arrives in the same roll.
       "CAELO_STAGING_GATE_SECRET",
       // #845 — and which forwarded address is the visitor.

package/src/stack-converge.test.ts

@@ -312,13 +312,13 @@ describe("planContractEnv", () => {
     // #650 — the same roll converges the protected staging domain's host
     // and gate key onto an install that predates it.
     expect(plan.services.admin.flags).toEqual([
-      "--update-env-vars=CAELO_SITE_URL=https://acme.com,MEDIA_ROOT_DIR=/app/apps/admin/data/media,CAELO_MCP_IAP_SERVICE_ACCOUNT=caelo-mcp@acme.iam.gserviceaccount.com,CAELO_OPERATOR_ACCESS_JOB=projects/acme/locations/europe-west1/jobs/caelo-production-operator-access-sync,CAELO_UPGRADER_JOB=projects/acme/locations/europe-west1/jobs/caelo-production-upgrader,CAELO_CONVERGE_JOB=projects/acme/locations/europe-west1/jobs/caelo-production-converge,CAELO_AUDIT_JOB=projects/acme/locations/europe-west1/jobs/caelo-production-audit,CAELO_AUDIT_RESULTS_BUCKET=acme-caelo-production-audit-results,CAELO_MCP_OAUTH_CLIENT_STORE=projects/acme/secrets/caelo-production-mcp-oauth-client,CAELO_STAGING_HOST=staging.acme.com",
+      "--update-env-vars=CAELO_SITE_URL=https://acme.com,MEDIA_ROOT_DIR=/app/apps/admin/data/media,CAELO_MCP_IAP_SERVICE_ACCOUNT=caelo-mcp@acme.iam.gserviceaccount.com,CAELO_OPERATOR_ACCESS_JOB=projects/acme/locations/europe-west1/jobs/caelo-production-operator-access-sync,CAELO_UPGRADER_JOB=projects/acme/locations/europe-west1/jobs/caelo-production-upgrader,CAELO_CONVERGE_JOB=projects/acme/locations/europe-west1/jobs/caelo-production-converge,CAELO_AUDIT_JOB=projects/acme/locations/europe-west1/jobs/caelo-production-audit,CAELO_AUDIT_RESULTS_BUCKET=acme-caelo-production-audit-results,CAELO_OPERATOR_OAUTH_CLIENT_STORE=projects/acme/secrets/caelo-production-operator-oauth-client,CAELO_STAGING_HOST=staging.acme.com",
       "--update-secrets=CAELO_STAGING_GATE_SECRET=caelo-production-staging-gate-secret:latest",
     ]);
     expect(plan.services.gateway.flags).toEqual([
       // The gateway learns which forwarded address is the visitor (#845).
       // #806 — and where the remote-MCP broker's client file and seal key are.
-      "--update-env-vars=CAELO_TRUSTED_PROXY_HOPS=1,CAELO_MCP_OAUTH_CLIENT_FILE=/secrets/mcp-oauth-client/client.json",
+      "--update-env-vars=CAELO_TRUSTED_PROXY_HOPS=1,CAELO_OPERATOR_OAUTH_CLIENT_FILE=/secrets/operator-oauth-client/client.json",
       "--update-secrets=CAELO_STAGING_GATE_SECRET=caelo-production-staging-gate-secret:latest,CAELO_MCP_OAUTH_SEAL_KEY=caelo-production-mcp-oauth-seal-key:latest",
     ]);
   });
@@ -789,12 +789,12 @@ describe("ensureStackInvariants", () => {
         `secrets add-iam-policy-binding caelo-production-staging-gate-secret --project=acme --member=${GW_SA} --role=roles/secretmanager.secretAccessor --quiet --format=none`,
         // #806 — the remote-MCP broker's seal key and OAuth client file.
         `secrets add-iam-policy-binding caelo-production-mcp-oauth-seal-key --project=acme --member=${GW_SA} --role=roles/secretmanager.secretAccessor --quiet --format=none`,
-        `secrets add-iam-policy-binding caelo-production-mcp-oauth-client --project=acme --member=${GW_SA} --role=roles/secretmanager.secretAccessor --quiet --format=none`,
+        `secrets add-iam-policy-binding caelo-production-operator-oauth-client --project=acme --member=${GW_SA} --role=roles/secretmanager.secretAccessor --quiet --format=none`,
       ]);
       // #806 — the admin may add versions to the OAuth client secret, and to no other.
       const adders = calls.filter((c) => c.includes("roles/secretmanager.secretVersionAdder"));
       expect(adders).toEqual([
-        `secrets add-iam-policy-binding caelo-production-mcp-oauth-client --project=acme --member=${RUN_SA} --role=roles/secretmanager.secretVersionAdder --quiet --format=none`,
+        `secrets add-iam-policy-binding caelo-production-operator-oauth-client --project=acme --member=${RUN_SA} --role=roles/secretmanager.secretVersionAdder --quiet --format=none`,
       ]);
       for (const secret of ["internal-secret", "tool-approval-secret", "secret-kek"]) {
         expect(calls).toContain(

package/src/stack-converge.ts

@@ -43,8 +43,10 @@ import {
   type MediaVolumeContract,
   memoryQuantityMiB,
   RETIRED_IAM_BINDINGS,
+  RETIRED_RUNTIME_SECRETS,
   RETIRED_SERVICE_ENV,
   type RetiredIamBinding,
+  type RetiredSecretFile,
   type RuntimeEnvInputs,
   type SecretFileContract,
   type ServiceEnvInputs,
@@ -682,6 +684,53 @@ export async function removeRetiredIamBindings(
   return outcomes;
 }
 
+/**
+ * Delete the secrets older contracts created and nothing reads any more
+ * ({@link RETIRED_RUNTIME_SECRETS}) — run by upgrade AFTER both services
+ * rolled onto revisions that no longer reference them (Cloud Run would
+ * refuse a revision whose secret is gone). Deleting a secret drops its IAM
+ * bindings with it. An absent secret is `absent`; never throws for a
+ * gcloud failure.
+ */
+export async function deleteRetiredSecrets(
+  install: Pick<InstallTarget, "projectId" | "env">,
+  deps: {
+    run?: GcloudRunner;
+    retired?: readonly { readonly name: string; readonly why: string }[];
+  } = {},
+): Promise<RetiredBindingOutcome[]> {
+  const run = deps.run ?? defaultGcloud;
+  const outcomes: RetiredBindingOutcome[] = [];
+  for (const s of deps.retired ?? RETIRED_RUNTIME_SECRETS) {
+    const id = `secret ${gcpSecretId(install.env, s.name)}`;
+    const project = `--project=${install.projectId}`;
+    const describe = await run([
+      "secrets",
+      "describe",
+      gcpSecretId(install.env, s.name),
+      project,
+      "--format=value(name)",
+    ]);
+    if (!describe.ok && RESOURCE_MISSING.test(describe.stderr)) {
+      outcomes.push({ id, status: "absent", why: s.why });
+      continue;
+    }
+    const del = await run([
+      "secrets",
+      "delete",
+      gcpSecretId(install.env, s.name),
+      project,
+      "--quiet",
+    ]);
+    outcomes.push(
+      del.ok || RESOURCE_MISSING.test(del.stderr)
+        ? { id, status: del.ok ? "removed" : "absent", why: s.why }
+        : { id, status: "failed", why: s.why, error: del.stderr.trim() },
+    );
+  }
+  return outcomes;
+}
+
 /** The memory limit of the service's container (`512Mi`, `2Gi`), or null
  *  when the service declares none (Cloud Run then runs it with 512Mi). */
 export function liveContainerMemory(serviceJson: string): string | null {
@@ -895,9 +944,21 @@ export function planSecretFiles(
   live: LiveVolumes,
   files: readonly SecretFileContract[],
   env: string,
+  retired: readonly RetiredSecretFile[] = [],
 ): RollAdditionsPlan {
   const flags: string[] = [];
   const changes: string[] = [];
+  // #914 — mounts an older contract made and nothing reads any more
+  // (RETIRED_SECRET_FILES) go in the same revision that mounts their
+  // replacement. `--remove-secrets=<dir>/<file>` drops the file, and the
+  // mount with it when it was the volume's only file (gcloud
+  // `_PruneManagedVolumeMapping`). Repeated `--remove-secrets` /
+  // `--update-secrets` flags merge (gcloud map flags use UpdateAction).
+  for (const old of retired) {
+    if (!live.mounts.some((m) => m.mountPath === old.mountDir)) continue;
+    flags.push(`--remove-secrets=${old.mountDir}/${old.fileName}`);
+    changes.push(`secret file ${old.mountDir}/${old.fileName}: removed (${old.why})`);
+  }
   for (const file of files) {
     const secretId = gcpSecretId(env, file.secret);
     const mount = live.mounts.find((m) => m.mountPath === file.mountDir);

package/src/upgrade/app-roll.ts

@@ -31,6 +31,7 @@ import {
   adminMediaVolume,
   type CloudRunEnvVar,
   GATEWAY_TIMEOUT_SECONDS,
+  RETIRED_SECRET_FILES,
   SERVICE_SECRET_FILES,
 } from "../stack-contract.js";
 import {
@@ -197,12 +198,17 @@ export async function planAppRoll(
   );
   if (!media.ok)
     return { ok: false, error: `the admin's media volume can't be set up: ${media.error}` };
-  // #806 — each service's secret files (the gateway's remote-MCP OAuth
+  // #806/#914 — each service's secret files (the gateway's Google sign-in
   // client). A file the roll cannot mount fails the plan: the new gateway
   // reads its path from the env contract.
   const secretFiles = {} as Record<RollSlug, { flags: string[]; changes: string[] }>;
   for (const s of services) {
-    const files = planSecretFiles(s.liveVolumes, SERVICE_SECRET_FILES[s.slug], install.env);
+    const files = planSecretFiles(
+      s.liveVolumes,
+      SERVICE_SECRET_FILES[s.slug],
+      install.env,
+      RETIRED_SECRET_FILES[s.slug],
+    );
     if (!files.ok) {
       return { ok: false, error: `the ${s.slug}'s secret files can't be mounted: ${files.error}` };
     }

package/src/upgrade/audit-job-roll.ts

@@ -37,7 +37,9 @@ export async function describeAuditJobImage(
     "--format=value(spec.template.spec.template.spec.containers[0].image)",
   ]);
   if (!r.ok) {
-    return /NOT_FOUND|not found|could not be found/i.test(r.stderr)
+    // gcloud's own wording for a missing job is "Cannot find job [<name>]."
+    // (no NOT_FOUND code), so match that too.
+    return /NOT_FOUND|not found|could not be found|cannot find/i.test(r.stderr)
       ? { ok: true, image: null }
       : { ok: false, error: r.stderr.trim() };
   }

package/src/upgrade/converge.ts

@@ -57,6 +57,7 @@ import {
   UPGRADER_JOB_ENV_VAR,
 } from "../stack-contract.js";
 import {
+  deleteRetiredSecrets,
   ensureStackInvariants,
   liveEnvHasInlinePassword,
   removeRetiredIamBindings,
@@ -364,12 +365,22 @@ export function startConverge(
       runDeps,
     );
     if (resolved.ok) {
-      s.done(`Remote MCP can be set up under Settings → MCP (${resolved.identity.mcpPublicUrl})`);
+      s.done(
+        `Google sign-in and remote MCP can be set up under Settings → Google sign-in (${resolved.identity.mcpPublicUrl})`,
+      );
+      if (resolved.orgDomainError) {
+        // #914 — the admin then refuses new users until Google sign-in is
+        // set up (it cannot tell who IAP's built-in sign-in admits). Not a
+        // converge failure: the Owner's sign-in setup resolves it.
+        r.warn(
+          `Could not read this project's Google organisation (${resolved.orgDomainError}). Until Google sign-in is set up under Settings → Google sign-in, the admin refuses to add users; or re-run upgrade as an account with the Organization Viewer role.`,
+        );
+      }
       return remoteMcpIdentityEnv(resolved.identity);
     }
     s.warned(`Remote-MCP env not resolved: ${resolved.error}`);
     r.warn(
-      "The upgrade continues; Settings → MCP reports remote MCP as not prepared on this install until this succeeds. Re-run upgrade once the cause is fixed.",
+      "The upgrade continues; Settings → Google sign-in and Settings → MCP report this install as not prepared until this succeeds. Re-run upgrade once the cause is fixed.",
     );
     incomplete = true;
     return null;
@@ -602,13 +613,18 @@ export function startConverge(
       // #613 — with both services on their new revisions, drop the bindings
       // nothing reads through any more (above all the gateway SA's access to
       // admin_role's password). Loud on failure.
-      const retired = await removeRetiredIamBindings(target, runDeps);
+      const retired = [
+        ...(await removeRetiredIamBindings(target, runDeps)),
+        // #914 — secrets nothing references any more (the renamed Google
+        // sign-in client); their IAM bindings go with them.
+        ...(await deleteRetiredSecrets(target, runDeps)),
+      ];
       for (const o of retired) {
         if (o.status === "removed") r.info(`  removed: ${o.id} (${o.why})`);
         if (o.status === "failed") {
           incomplete = true;
           r.error(
-            `  NOT removed: ${o.id} — ${o.why}\n    ${o.error ?? ""}\n    Re-run upgrade with an account that may change IAM, or remove the binding by hand.`,
+            `  NOT removed: ${o.id} — ${o.why}\n    ${o.error ?? ""}\n    Re-run upgrade with an account that may change IAM and secrets, or remove it by hand.`,
           );
         }
       }

package/src/upgrade/upgrade.test.ts

@@ -684,7 +684,7 @@ describe("upgradeGcpInstall — converge, then app-roll", () => {
     expect(gateway).toContain(`CAELO_ADMIN_URL=https://${ADMIN}-xyz.a.run.app`);
     expect(gateway).toContain(`CAELO_MCP_PUBLIC_URL=https://${GATEWAY}-xyz.a.run.app`);
     expect(gateway).toContain(
-      "--update-secrets=/secrets/mcp-oauth-client/client.json=caelo-production-mcp-oauth-client:latest",
+      "--update-secrets=/secrets/operator-oauth-client/client.json=caelo-production-operator-oauth-client:latest",
     );
     expect(gateway).toContain("--timeout=3600");
     expect(admin).not.toContain("--timeout");

package/src/wizards/gcp-cost.ts

@@ -166,7 +166,7 @@ export function estimateGcpCost(inputs: CostEstimateInputs): {
       name: "Secret Manager (runtime secrets)",
       monthlyUsd: 0.2,
       notes:
-        "6 active versions free, then ~$0.06 each; remote MCP (#806) adds the OAuth client and its seal key",
+        "6 active versions free, then ~$0.06 each; the Google sign-in client (#914) and the remote-MCP seal key (#806)",
     },
     {
       name: "BigQuery edge log sink",

package/src/wizards/gcp-pulumi.test.ts

@@ -7,6 +7,7 @@ import {
   alignedStackSettings,
   assertStackRegion,
   deployedStackRegion,
+  presentImageOverrides,
   pulumiGcpEnv,
   resolveSecretReplication,
   stateOnlyEnv,
@@ -244,3 +245,17 @@ describe("stateOnlyEnv (#696)", () => {
     expect(env.PULUMI_BACKEND_URL).toBe("gs://acme-caelo-ops/pulumi");
   });
 });
+
+describe("presentImageOverrides", () => {
+  it("reads the settings file as-is, so a stack missing its required keys still pins (regression: `pulumi config` refused to list it and every upgrade from a new CLI version failed)", () => {
+    const freshBunxSettings = { "caelo-gcp-firebase:image-digest-admin": "sha256:a" };
+    expect(presentImageOverrides("gcp-firebase", freshBunxSettings)).toEqual([]);
+    expect(presentImageOverrides("gcp", { "caelo-gcp:image-admin": "x:1" })).toEqual([
+      "caelo-gcp:image-admin",
+    ]);
+  });
+
+  it("finds nothing in a settings file without config", () => {
+    expect(presentImageOverrides("gcp", undefined)).toEqual([]);
+  });
+});

package/src/wizards/gcp-pulumi.ts

@@ -150,12 +150,28 @@ export async function writeImageDigestsToStack(inputs: {
 }): Promise<{ removedOverrides: string[] }> {
   const stack = await selectInstallStack(inputs.backend, inputs.provider);
   await stack.setAllConfig(imageDigestConfig(inputs.provider, inputs.digests));
-  const config = await stack.getAllConfig();
-  const removedOverrides = imageOverrideKeys(inputs.provider).filter((k) => k in config);
+  // Read the settings file, not `getAllConfig()`: `pulumi config` refuses
+  // to list a stack whose required keys (domain, project, …) are unset, and
+  // the settings file in a freshly unpacked `bunx` package holds only what
+  // this call just wrote — so every upgrade from a new CLI version failed.
+  const settings = await stack.workspace.stackSettings(stack.name);
+  const removedOverrides = presentImageOverrides(inputs.provider, settings.config);
   if (removedOverrides.length > 0) await stack.removeAllConfig(removedOverrides);
   return { removedOverrides };
 }
 
+/**
+ * The image-override keys set in a stack settings file's `config`.
+ *
+ * @param config the settings file's `config` map (absent when the file has none)
+ */
+export function presentImageOverrides(
+  provider: "gcp" | "gcp-firebase",
+  config: Record<string, unknown> | undefined,
+): string[] {
+  return imageOverrideKeys(provider).filter((k) => config !== undefined && k in config);
+}
+
 /**
  * One output of the install's stack, secrets included (the Automation API's
  * `pulumi stack output --show-secrets`). Read at the moment of use, never