@caelo-cms/provisioning 0.10.69 → 0.10.71

package/src/adopt-existing.ts

@@ -0,0 +1,228 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * Adopt cloud resources the stack declares but its Pulumi state lacks
+ * (#1079), before the installer's `pulumi up`.
+ *
+ * `cms-provision upgrade` converges an install through gcloud and never runs
+ * Pulumi (stack-converge.ts), so it creates some resources the stack also
+ * declares — the gateway's service account (runtime-secrets.ts), the MCP
+ * service account (mcp-iap.ts) — without them entering the state. The next
+ * installer run then plans to CREATE them, and `state migrate` refuses an
+ * install whose preview plans anything. So, after the preview and before
+ * the review:
+ *
+ *   1. {@link adoptionCandidates}: the planned creates of a kind in
+ *      {@link ADOPTABLE_KINDS} whose inputs name the cloud resource. Only
+ *      planned steps are looked at, so nothing the stack does not declare is
+ *      ever adopted; every other kind is left to Pulumi.
+ *   2. {@link existingCandidates}: a gcloud describe per candidate. Exists →
+ *      adopt; NOT_FOUND → a plain create; anything else stops the run (we
+ *      can't tell, and guessing either way is wrong).
+ *   3. `pulumi import` of the existing ones into the stack, under the
+ *      stack's explicit GCP provider (wizards/gcp-pulumi.ts). State only: the
+ *      cloud resources are not touched.
+ *   4. A second preview: what the review shows and `up` applies. An adopted
+ *      resource that is still planned as a create stops the run.
+ *
+ * Why only service accounts ({@link ADOPTABLE_KINDS}). A kind is adopted
+ * when the stack declares it AND the CLI also creates it through gcloud, and
+ * its name is unique in the project. Checked per kind against both stacks:
+ *
+ *   - Secret Manager secrets: the stack declares only `postgres-password` and
+ *     `secret-kek`, which the CLI never creates; the secrets the CLI makes
+ *     (stack-contract.ts CLI_GENERATED_SECRETS) the stack only references by
+ *     id. Adopting a secret without its value resource would also make `up`
+ *     add a version with a freshly generated value — a new KEK.
+ *   - Buckets, Cloud Run jobs, custom roles: the stack's buckets are made by
+ *     Pulumi alone; the CLI's own (ops, audit results, the upgrader, converge,
+ *     audit and operator-access jobs, their custom roles) are not declared.
+ *   - The admin's Cloud Run domain mapping: owned by `admin-domain enable`
+ *     (admin-domain.ts), the stack's copy stays off; Pulumi, running as the
+ *     provisioner, could not manage it.
+ *   - IAM member resources (`*IamMember`, `IAMMember`): non-authoritative.
+ *     Their create is a read-modify-write that merges the member into the
+ *     policy and succeeds when it is there already, so a planned create of
+ *     one is an adoption already.
+ *   - Cloud SQL users: the CLI's are IAM users named after service accounts,
+ *     the stack's are the built-in `admin_role` / `public_role`.
+ */
+
+import type { GcloudRunner } from "./gcloud-retry.js";
+import type { PlannedStep } from "./preview-plan.js";
+
+/** The cloud identity of a resource a planned create would make. */
+export interface AdoptionTarget {
+  /** How the operator knows it, e.g. the service account's email. */
+  readonly display: string;
+  /** gcloud args that succeed exactly when it exists. */
+  readonly describeArgs: readonly string[];
+  /** The id `pulumi import` takes for the kind. */
+  readonly importId: string;
+}
+
+/** A resource kind the installer adopts when it exists already. */
+export interface AdoptableKind {
+  /** What it is, for messages (`service account`). */
+  readonly label: string;
+  /**
+   * The resource a create with these inputs would make, or null when the
+   * inputs don't pin it down (then the create is left to Pulumi).
+   */
+  target(inputs: Readonly<Record<string, unknown>>, projectId: string): AdoptionTarget | null;
+}
+
+/** Kinds adopted before `up`, by Pulumi type token. See the file comment for the rest. */
+export const ADOPTABLE_KINDS: Readonly<Record<string, AdoptableKind>> = {
+  "gcp:serviceaccount/account:Account": {
+    label: "service account",
+    target(inputs, projectId) {
+      // GCP's account-id format; also keeps out the engine's placeholder
+      // for a value only known after apply.
+      const accountId = inputs.accountId;
+      if (typeof accountId !== "string" || !/^[a-z][a-z0-9-]{4,28}[a-z0-9]$/.test(accountId)) {
+        return null;
+      }
+      // Unset means the provider's project, which is the install's
+      // (assertStackProject). Another project is never adopted.
+      const project = inputs.project ?? projectId;
+      if (project !== projectId) return null;
+      const email = `${accountId}@${projectId}.iam.gserviceaccount.com`;
+      return {
+        display: email,
+        describeArgs: [
+          "iam",
+          "service-accounts",
+          "describe",
+          email,
+          `--project=${projectId}`,
+          "--format=value(email)",
+        ],
+        importId: `projects/${projectId}/serviceAccounts/${email}`,
+      };
+    },
+  },
+};
+
+/** A planned create the installer may adopt instead. */
+export interface AdoptionCandidate extends AdoptionTarget {
+  readonly step: PlannedStep;
+  readonly label: string;
+}
+
+/** Thrown when adoption cannot finish; nothing was applied. */
+export class AdoptionError extends Error {
+  override readonly name = "AdoptionError";
+}
+
+/** The planned creates of an adoptable kind, with what each would create. */
+export function adoptionCandidates(
+  steps: readonly PlannedStep[],
+  projectId: string,
+): AdoptionCandidate[] {
+  const out: AdoptionCandidate[] = [];
+  for (const step of steps) {
+    if (step.op !== "create") continue;
+    const kind = ADOPTABLE_KINDS[step.type];
+    if (!kind || !step.inputs) continue;
+    const target = kind.target(step.inputs, projectId);
+    if (target) out.push({ ...target, step, label: kind.label });
+  }
+  return out;
+}
+
+const NOT_FOUND = /NOT_FOUND|not found|does not exist/i;
+
+/**
+ * The candidates that exist in the project.
+ *
+ * @throws AdoptionError when a describe fails for another reason than NOT_FOUND
+ */
+export async function existingCandidates(
+  candidates: readonly AdoptionCandidate[],
+  run: GcloudRunner,
+): Promise<AdoptionCandidate[]> {
+  const existing: AdoptionCandidate[] = [];
+  for (const c of candidates) {
+    const r = await run([...c.describeArgs]);
+    if (r.ok) existing.push(c);
+    else if (!NOT_FOUND.test(r.stderr)) {
+      throw new AdoptionError(
+        `could not tell whether the ${c.label} ${c.display} exists (gcloud: ${r.stderr.trim()}). Nothing was imported or applied. Check that gcloud is signed in as the Owner (gcloud auth login) and re-run the installer.`,
+      );
+    }
+  }
+  return existing;
+}
+
+/** What adoption needs from Pulumi and gcloud; fakes in tests. */
+export interface AdoptionDeps {
+  readonly projectId: string;
+  readonly gcloud: GcloudRunner;
+  /** A fresh preview of the stack. */
+  preview(): Promise<readonly PlannedStep[]>;
+  /** `pulumi import` the candidates into the stack (state only). */
+  importResources(candidates: readonly AdoptionCandidate[]): Promise<void>;
+}
+
+/** The plan to review after adoption, and what was adopted into it. */
+export interface AdoptionResult {
+  readonly adopted: readonly AdoptionCandidate[];
+  readonly steps: readonly PlannedStep[];
+}
+
+/**
+ * The line of a failed Pulumi call that says what went wrong. The
+ * Automation API's error starts with `code: 255` and carries the CLI's
+ * stderr below; its first `error:` line is the reason.
+ */
+export function pulumiErrorReason(e: unknown): string {
+  const lines = (e instanceof Error ? e.message : String(e))
+    .split("\n")
+    .map((l) => l.trim().replace(/^stderr:\s*/, ""))
+    .filter((l) => l !== "");
+  return lines.find((l) => /^error:/i.test(l)) ?? lines[0] ?? "no output";
+}
+
+/**
+ * Adopt the planned creates of `steps` that exist in the project already,
+ * and return the plan after it. With nothing to adopt, `steps` comes back
+ * unchanged and nothing else runs.
+ *
+ * @throws AdoptionError when a probe or the import fails, or a re-plan still
+ *   creates an adopted resource; `up` must not run then
+ */
+export async function adoptExistingResources(
+  steps: readonly PlannedStep[],
+  deps: AdoptionDeps,
+): Promise<AdoptionResult> {
+  const existing = await existingCandidates(adoptionCandidates(steps, deps.projectId), deps.gcloud);
+  if (existing.length === 0) return { adopted: [], steps };
+  const names = existing.map((c) => `${c.label} ${c.display}`).join(", ");
+  try {
+    await deps.importResources(existing);
+  } catch (e) {
+    throw new AdoptionError(
+      `could not adopt ${names} (already in the project) into the stack: pulumi import says "${pulumiErrorReason(e)}". Nothing was applied. Re-run the installer: what was adopted stays adopted. If it fails the same way, report it with this message.`,
+    );
+  }
+  const after = await deps.preview();
+  const stillCreated = after.filter(
+    (s) => s.op === "create" && existing.some((c) => c.step.urn === s.urn),
+  );
+  if (stillCreated.length > 0) {
+    throw new AdoptionError(
+      `imported ${names}, but the next preview still creates ${stillCreated.map((s) => s.name).join(", ")}. Nothing was applied. Report this with the message; re-running the installer does not fix it.`,
+    );
+  }
+  return { adopted: existing, steps: after };
+}
+
+/** The adopted resources as lines for the review, or none. */
+export function formatAdopted(adopted: readonly AdoptionCandidate[]): string[] {
+  if (adopted.length === 0) return [];
+  return [
+    `Adopted (${adopted.length}) — already in the project, now in the stack instead of created again:`,
+    ...adopted.map((c) => `  ${c.label} ${c.display} (${c.step.name})`),
+  ];
+}

package/src/preview-plan.ts

@@ -31,6 +31,13 @@ export interface PlannedStep {
   readonly diffs: readonly string[];
   /** Properties that force the replace (replace steps only). */
   readonly replaceReasons: readonly string[];
+  /**
+   * The inputs the program declares, for create steps only (#1079: they name
+   * the cloud resource a create would make, e.g. a service account's
+   * `accountId`, so adopt-existing.ts can tell whether it exists already).
+   * Secret values arrive masked by the engine. Never written to a plan file.
+   */
+  readonly inputs?: Readonly<Record<string, unknown>>;
 }
 
 /**
@@ -116,6 +123,7 @@ export function collectPreviewSteps(): PreviewCollector {
         urn: m.urn,
         diffs: [...(m.diffs ?? [])],
         replaceReasons: op === "replace" ? [...(m.keys ?? [])] : [],
+        ...(op === "create" && m.new?.inputs ? { inputs: { ...m.new.inputs } } : {}),
       });
     },
     steps: () => [...byUrn.values()],

package/src/remote-mcp-stack-config.test.ts

@@ -0,0 +1,195 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #1082 — the remote-MCP identity env has one owner: the stack, which
+ * declares it from the config the CLI writes before `up`. These tests pin
+ * the config round trip and what a refreshed `pulumi up` / `state migrate`
+ * preview would plan for the services' env against an install whose live
+ * services carry the vars (the viu.one shape: contract env plus the four /
+ * two identity vars gcloud added, in gcloud's order).
+ */
+
+import { describe, expect, it } from "bun:test";
+import type * as automation from "@pulumi/pulumi/automation";
+import {
+  adminEnvContract,
+  type CloudRunEnvVar,
+  databaseUrls,
+  gatewayEnvContract,
+  parseRemoteMcpIdentityConfig,
+  REMOTE_MCP_ENV,
+  REMOTE_MCP_IDENTITY_CONFIG,
+  type RemoteMcpIdentity,
+  remoteMcpIdentityEnv,
+  remoteMcpIdentityStackEnv,
+  sameRemoteMcpIdentity,
+  serializeRemoteMcpIdentity,
+} from "./stack-contract.js";
+import { applyStackConfig, type StackConfigInputs } from "./wizards/gcp-pulumi.js";
+
+const identity: RemoteMcpIdentity = {
+  adminUrl: "https://caelo-production-admin-f89c711-7whkh344ca-ew.a.run.app",
+  mcpPublicUrl: "https://caelo-production-gateway-6da3bb0-7whkh344ca-ew.a.run.app",
+  iapAudience: "/projects/42/locations/europe-west1/services/caelo-production-admin-f89c711",
+  googleOrgDomain: "acme.com",
+};
+
+const contractInputs = {
+  provider: "gcp-firebase",
+  projectId: "viu-one-web",
+  env: "production",
+  domain: "viu.one",
+  region: "europe-west1",
+  stagingHost: "staging.viu.one",
+  databaseUrls: databaseUrls("10.153.0.3"),
+} as const;
+const contract = {
+  admin: adminEnvContract({
+    ...contractInputs,
+    firebaseSiteId: "caelo-production-site-eb4697",
+    gatewayService: "caelo-production-gateway-6da3bb0",
+  }),
+  gateway: gatewayEnvContract(contractInputs),
+};
+
+/** The env a stack declares for one service, given the config value. */
+function declared(slug: "admin" | "gateway", config: string | undefined): CloudRunEnvVar[] {
+  return [...contract[slug], ...remoteMcpIdentityStackEnv(config)[slug]];
+}
+
+/** The live services after an installer run plus its old gcloud post-step: gcloud reorders. */
+function live(slug: "admin" | "gateway"): CloudRunEnvVar[] {
+  return [...contract[slug], ...remoteMcpIdentityEnv(identity)[slug]].reverse();
+}
+
+/**
+ * What a refreshed preview plans for `containers.env`: the provider holds it
+ * as a set (terraform-provider-google `google_cloud_run_v2_service`), so
+ * order is no diff — a var only the live service has is removed, one only
+ * the program has is added, a different value is changed.
+ */
+function envPlan(desired: readonly CloudRunEnvVar[], actual: readonly CloudRunEnvVar[]) {
+  const key = (v: CloudRunEnvVar) => JSON.stringify(v);
+  const want = new Map(desired.map((v) => [v.name, key(v)]));
+  const have = new Map(actual.map((v) => [v.name, key(v)]));
+  return {
+    removed: [...have.keys()].filter((n) => !want.has(n)).sort(),
+    added: [...want.keys()].filter((n) => !have.has(n)).sort(),
+    changed: [...want.keys()].filter((n) => have.has(n) && have.get(n) !== want.get(n)).sort(),
+  };
+}
+
+describe("remote-MCP identity as stack config (#1082)", () => {
+  it("round-trips through the config value", () => {
+    const raw = serializeRemoteMcpIdentity(identity);
+    expect(parseRemoteMcpIdentityConfig(raw)).toEqual(identity);
+    const { googleOrgDomain: _d, ...noOrg } = identity;
+    expect(parseRemoteMcpIdentityConfig(serializeRemoteMcpIdentity(noOrg))).toEqual(noOrg);
+  });
+
+  it("declares nothing while the config is unset (a fresh install's first up)", () => {
+    expect(parseRemoteMcpIdentityConfig(undefined)).toBeNull();
+    expect(remoteMcpIdentityStackEnv(undefined)).toEqual({ admin: [], gateway: [] });
+  });
+
+  it("refuses a corrupt or foreign value loudly instead of dropping the vars", () => {
+    expect(() => parseRemoteMcpIdentityConfig("{")).toThrow(REMOTE_MCP_IDENTITY_CONFIG);
+    expect(() =>
+      parseRemoteMcpIdentityConfig(JSON.stringify({ ...identity, adminUrl: "http://x" })),
+    ).toThrow("adminUrl");
+    expect(() => parseRemoteMcpIdentityConfig(JSON.stringify({ ...identity, extra: "x" }))).toThrow(
+      REMOTE_MCP_IDENTITY_CONFIG,
+    );
+  });
+
+  it("declares exactly the vars and values upgrade's gcloud roll sets", () => {
+    expect(remoteMcpIdentityStackEnv(serializeRemoteMcpIdentity(identity))).toEqual(
+      remoteMcpIdentityEnv(identity),
+    );
+    expect(
+      remoteMcpIdentityStackEnv(serializeRemoteMcpIdentity(identity))
+        .admin.map((v) => v.name)
+        .sort(),
+    ).toEqual(Object.values(REMOTE_MCP_ENV).sort());
+  });
+
+  it.each(["admin", "gateway"] as const)(
+    "%s: with the config the CLI writes, a refreshed plan removes and changes nothing",
+    (slug) => {
+      const plan = envPlan(declared(slug, serializeRemoteMcpIdentity(identity)), live(slug));
+      expect(plan).toEqual({ removed: [], added: [], changed: [] });
+    },
+  );
+
+  it("without it (the bug), every up strips the vars gcloud set", () => {
+    expect(envPlan(declared("admin", undefined), live("admin")).removed).toEqual([
+      "CAELO_ADMIN_URL",
+      "CAELO_GOOGLE_ORG_DOMAIN",
+      "CAELO_IAP_AUDIENCE",
+      "CAELO_MCP_PUBLIC_URL",
+    ]);
+    expect(envPlan(declared("gateway", undefined), live("gateway")).removed).toEqual([
+      "CAELO_ADMIN_URL",
+      "CAELO_MCP_PUBLIC_URL",
+    ]);
+  });
+
+  it("compares identities by every var they set", () => {
+    expect(sameRemoteMcpIdentity(identity, { ...identity })).toBe(true);
+    expect(sameRemoteMcpIdentity(identity, { ...identity, googleOrgDomain: undefined })).toBe(
+      false,
+    );
+    expect(sameRemoteMcpIdentity(identity, null)).toBe(false);
+    expect(sameRemoteMcpIdentity(null, null)).toBe(true);
+  });
+});
+
+describe("applyStackConfig writes the identity (#1082)", () => {
+  /** A Stack fake recording the config the CLI sets. */
+  function fakeStack() {
+    const config: Record<string, string> = {};
+    const stack = {
+      setAllConfig: async (c: automation.ConfigMap) => {
+        for (const [k, v] of Object.entries(c)) config[k] = v.value;
+      },
+      setConfig: async (k: string, v: automation.ConfigValue) => {
+        config[k] = v.value;
+      },
+      getConfig: async (k: string) => {
+        if (!(k in config)) throw new Error(`configuration key '${k}' not found`);
+        return { value: config[k] as string };
+      },
+    } as unknown as automation.Stack;
+    return { stack, config };
+  }
+  const inputs: StackConfigInputs = {
+    provider: "gcp-firebase",
+    projectId: "viu-one-web",
+    domain: "viu.one",
+    stagingDomain: "staging.viu.one",
+    ownerEmail: "owner@viu.one",
+    region: "europe-west1",
+    cloudSqlTier: "db-f1-micro",
+    cloudSqlHa: false,
+    adminMinInstances: 0,
+    adminMemory: "2Gi",
+    gatewayMinInstances: 0,
+    wafAdaptiveProtection: false,
+    iapAllowlist: ["owner@viu.one"],
+    imageDigests: { admin: "sha256:a", gateway: "sha256:g" },
+  };
+  const key = `caelo-gcp-firebase:${REMOTE_MCP_IDENTITY_CONFIG}`;
+
+  it("sets the key the stack reads, from the resolved identity", async () => {
+    const { stack, config } = fakeStack();
+    await applyStackConfig(stack, { ...inputs, remoteMcpIdentity: identity }, []);
+    expect(parseRemoteMcpIdentityConfig(config[key])).toEqual(identity);
+  });
+
+  it("keeps what an earlier run recorded when the identity could not be read", async () => {
+    const { stack, config } = fakeStack();
+    config[key] = serializeRemoteMcpIdentity(identity);
+    await applyStackConfig(stack, { ...inputs, remoteMcpIdentity: null }, []);
+    expect(parseRemoteMcpIdentityConfig(config[key])).toEqual(identity);
+  });
+});

package/src/remote-mcp.test.ts

@@ -11,13 +11,15 @@ import { GCP_PUBLIC_BASE_PATHS } from "@caelo-cms/shared";
 import type { GcloudResult } from "./gcloud.js";
 import type { GcloudRunner } from "./gcloud-retry.js";
 import {
-  applyRemoteMcpIdentityEnv,
+  checkRemoteMcpIdentityEnv,
   ensureMcpArmorRule,
+  findRemoteMcpTarget,
   type LiveUrlMap,
   planUrlMapPaths,
   type RemoteMcpTarget,
   resolveGoogleOrgDomain,
   resolveRemoteMcpIdentity,
+  resolveStackRemoteMcpIdentity,
 } from "./remote-mcp.js";
 import {
   GENERAL_RATE_LIMIT_PRIORITY,
@@ -497,30 +499,111 @@ describe("resolveGoogleOrgDomain (#914)", () => {
   });
 });
 
-describe("applyRemoteMcpIdentityEnv", () => {
+const serviceJson = (env: { name: string; value: string }[]) =>
+  ok(JSON.stringify({ spec: { template: { spec: { containers: [{ env }] } } } }));
+const DESCRIBE_JSON = "--region=europe-west1 --project=acme --format=json";
+
+describe("findRemoteMcpTarget (#1082)", () => {
+  it("finds the Pulumi-suffixed services by prefix", async () => {
+    const { run } = fakeGcloud({
+      "run services list --region europe-west1 --project acme --filter metadata.name~^caelo-production-admin":
+        ok("caelo-production-admin-aaa\n"),
+      "run services list --region europe-west1 --project acme --filter metadata.name~^caelo-production-gateway":
+        ok("caelo-production-gateway-bbb\n"),
+    });
+    const { services: _s, ...base } = firebase;
+    expect(await findRemoteMcpTarget(base, { run })).toEqual({ ok: true, target: firebase });
+  });
+
+  it("fails naming the service it cannot find (a fresh install before its first up)", async () => {
+    const { run } = fakeGcloud({ "run services list": ok("") });
+    const { services: _s, ...base } = firebase;
+    const r = await findRemoteMcpTarget(base, { run });
+    expect(r.ok).toBe(false);
+    if (!r.ok) expect(r.error).toContain("caelo-production-admin* Cloud Run service");
+  });
+});
+
+describe("resolveStackRemoteMcpIdentity (#1082)", () => {
+  const base = {
+    "projects describe acme": ok("42\n"),
+    "projects get-ancestors acme": ANCESTORS_IN_ORG,
+    "run services describe caelo-production-admin-aaa": ok("https://a-xyz.a.run.app\n"),
+    "run services describe caelo-production-gateway-bbb": ok("https://g-xyz.a.run.app\n"),
+  };
+
+  it("is the live identity when the organisation is readable", async () => {
+    const { run } = fakeGcloud({ ...base, "organizations describe 123456": ok("acme.com\n") });
+    const r = await resolveStackRemoteMcpIdentity(firebase, { run });
+    expect(r.ok && r.identity.googleOrgDomain).toBe("acme.com");
+    expect(r.ok && r.orgDomainError).toBeUndefined();
+  });
+
+  it("carries the admin's live organisation domain over when it cannot be read now", async () => {
+    // The stack owns the var: leaving it out of the config would remove it
+    // on the next `up`, where a gcloud roll leaves it as it is.
+    const { run } = fakeGcloud({
+      ...base,
+      "organizations describe 123456": fail("PERMISSION_DENIED"),
+      [`run services describe caelo-production-admin-aaa ${DESCRIBE_JSON}`]: serviceJson([
+        { name: "CAELO_GOOGLE_ORG_DOMAIN", value: "acme.com" },
+      ]),
+    });
+    const r = await resolveStackRemoteMcpIdentity(firebase, { run });
+    expect(r.ok).toBe(true);
+    if (!r.ok) return;
+    expect(r.identity.googleOrgDomain).toBe("acme.com");
+    expect(r.orgDomainError).toContain("Organization Viewer");
+  });
+
+  it("sets no domain when neither the organisation nor the admin has one", async () => {
+    const { run } = fakeGcloud({
+      ...base,
+      "organizations describe 123456": fail("PERMISSION_DENIED"),
+      [`run services describe caelo-production-admin-aaa ${DESCRIBE_JSON}`]: serviceJson([]),
+    });
+    const r = await resolveStackRemoteMcpIdentity(firebase, { run });
+    expect(r.ok && r.identity.googleOrgDomain).toBeUndefined();
+  });
+});
+
+describe("checkRemoteMcpIdentityEnv (#1082)", () => {
   const identity = {
     adminUrl: "https://a.run.app",
     mcpPublicUrl: "https://g.run.app",
     iapAudience: "/projects/42/locations/europe-west1/services/caelo-production-admin-aaa",
   };
-  const serviceJson = (env: { name: string; value: string }[]) =>
-    ok(JSON.stringify({ spec: { template: { spec: { containers: [{ env }] } } } }));
+  const full = remoteMcpIdentityEnv(identity);
+  const plain = (env: ReturnType<typeof remoteMcpIdentityEnv>["admin"]) =>
+    env.map((e) => ({ name: e.name, value: "value" in e ? e.value : "" }));
 
-  it("updates only a service whose vars differ", async () => {
+  it("reports no drift when the services carry the vars, and never updates a service", async () => {
     const { run, calls } = fakeGcloud({
-      "run services describe caelo-production-admin-aaa": serviceJson([
-        { name: "CAELO_IAP_AUDIENCE", value: identity.iapAudience },
-        { name: "CAELO_MCP_PUBLIC_URL", value: identity.mcpPublicUrl },
-        { name: "CAELO_ADMIN_URL", value: identity.adminUrl },
-      ]),
-      "run services describe caelo-production-gateway-bbb": serviceJson([]),
-      "run services update caelo-production-gateway-bbb": ok(),
+      [`run services describe caelo-production-admin-aaa ${DESCRIBE_JSON}`]: serviceJson(
+        plain(full.admin),
+      ),
+      [`run services describe caelo-production-gateway-bbb ${DESCRIBE_JSON}`]: serviceJson(
+        plain(full.gateway),
+      ),
     });
-    const r = await applyRemoteMcpIdentityEnv(firebase, identity, { run });
-    expect(r.ok).toBe(true);
-    expect(calls.filter((c) => c.startsWith("run services update"))).toEqual([
-      "run services update caelo-production-gateway-bbb --region=europe-west1 --project=acme --update-env-vars=CAELO_ADMIN_URL=https://a.run.app,CAELO_MCP_PUBLIC_URL=https://g.run.app --quiet",
+    const r = await checkRemoteMcpIdentityEnv(firebase, identity, { run });
+    expect(r).toEqual({ ok: true, drift: { admin: [], gateway: [] } });
+    expect(calls.some((c) => c.startsWith("run services update"))).toBe(false);
+  });
+
+  it("names what a service lacks", async () => {
+    const { run, calls } = fakeGcloud({
+      [`run services describe caelo-production-admin-aaa ${DESCRIBE_JSON}`]: serviceJson(
+        plain(full.admin),
+      ),
+      [`run services describe caelo-production-gateway-bbb ${DESCRIBE_JSON}`]: serviceJson([]),
+    });
+    const r = await checkRemoteMcpIdentityEnv(firebase, identity, { run });
+    expect(r.ok && r.drift.gateway.map((c) => c.name)).toEqual([
+      "CAELO_ADMIN_URL",
+      "CAELO_MCP_PUBLIC_URL",
     ]);
+    expect(calls.some((c) => c.startsWith("run services update"))).toBe(false);
   });
 });