@caelo-cms/provisioning 0.10.69 → 0.10.71

package/src/wizards/gcp-pulumi.ts

@@ -14,8 +14,14 @@
 import { mkdirSync, readFileSync, realpathSync, renameSync, writeFileSync } from "node:fs";
 import { join, relative, resolve as resolvePath } from "node:path";
 import * as pulumi from "@pulumi/pulumi/automation";
+import {
+  type AdoptionCandidate,
+  AdoptionError,
+  adoptExistingResources,
+} from "../adopt-existing.js";
 import { AUDIT_PARALLELISM_DEFAULT } from "../audit-job-setup.js";
 import { checkpointableOutputs } from "../checkpoint-secrets.js";
+import { gcloud } from "../gcloud.js";
 import { GCP_STACK_ENV } from "../gcp-names.js";
 import { type ImageDigests, stackWorkDir } from "../install-state.js";
 import { collectPreviewSteps, type PlannedStep } from "../preview-plan.js";
@@ -24,7 +30,12 @@ import {
   withoutAmbientGoogleCredentials,
 } from "../provisioner-identity.js";
 import { ensureGeneratedSecrets, stackSecretReplication } from "../runtime-secrets.js";
-import { ADMIN_MEMORY_DEFAULT } from "../stack-contract.js";
+import {
+  ADMIN_MEMORY_DEFAULT,
+  REMOTE_MCP_IDENTITY_CONFIG,
+  type RemoteMcpIdentity,
+  serializeRemoteMcpIdentity,
+} from "../stack-contract.js";
 import type { ResolvedBackend } from "../state-backend.js";
 
 /**
@@ -90,6 +101,13 @@ export interface PulumiUpInputs {
    * Defaults to 'gcp' for backwards compatibility.
    */
   provider?: "gcp" | "gcp-firebase";
+  /**
+   * #1082 — the remote-MCP identity the stack declares as env
+   * (stack-contract.ts REMOTE_MCP_IDENTITY_CONFIG), resolved from the live
+   * install. Null when it could not be resolved (a fresh install before its
+   * first `up`): the config keeps what an earlier run wrote.
+   */
+  remoteMcpIdentity?: RemoteMcpIdentity | null;
 }
 
 export interface PulumiUpResult {
@@ -395,6 +413,7 @@ export function resolveSecretReplication(
 
 /** A resource as `pulumi stack export` lists it. */
 export interface StateResource {
+  urn?: string;
   type?: string;
   inputs?: Record<string, unknown>;
   outputs?: Record<string, unknown>;
@@ -449,6 +468,7 @@ export type StackConfigInputs = Pick<
   | "wafAdaptiveProtection"
   | "iapAllowlist"
   | "imageDigests"
+  | "remoteMcpIdentity"
 > & { provider: "gcp" | "gcp-firebase" };
 
 /**
@@ -487,6 +507,13 @@ export async function applyStackConfig(
     // v0.3.2 — anthropicApiKey config dropped. Runtime path is
     // /settings/ai → ai_providers (KEK-encrypted).
     ...imageDigestConfig(provider, inputs.imageDigests),
+    ...(inputs.remoteMcpIdentity
+      ? {
+          [`${ns}:${REMOTE_MCP_IDENTITY_CONFIG}`]: {
+            value: serializeRemoteMcpIdentity(inputs.remoteMcpIdentity),
+          },
+        }
+      : {}),
   });
 
   // Read back only after the required keys are set: `pulumi config` refuses to
@@ -534,6 +561,54 @@ export function pulumiGcpEnv(
   };
 }
 
+/**
+ * The URN of the stack's explicit GCP provider (`new gcp.Provider` in both
+ * stacks), which every stack resource uses. An adopted resource is imported
+ * under it (#1079): under Pulumi's default provider instead, the next `up`
+ * would see a provider change on it.
+ *
+ * @throws AdoptionError unless the state holds exactly one
+ */
+export function stackGcpProviderUrn(resources: ReadonlyArray<StateResource>): string {
+  const urns = resources
+    .filter((r) => r.type === "pulumi:providers:gcp" && typeof r.urn === "string")
+    .map((r) => r.urn as string);
+  if (urns.length !== 1) {
+    throw new AdoptionError(
+      `the stack's state holds ${urns.length} GCP providers, so it is unclear which one resources that already exist would be adopted under. Nothing was imported or applied. Report this; the stack needs a look before the installer can run.`,
+    );
+  }
+  return urns[0] as string;
+}
+
+/** The name {@link importIntoStack} gives the stack's provider in the import's name table. */
+const IMPORT_PROVIDER_NAME = "gcpProvider";
+
+/**
+ * `pulumi import` the candidates into the stack under its explicit provider.
+ * State only: nothing in the project changes. Not protected (the program
+ * does not protect them either) and no code generated.
+ */
+async function importIntoStack(
+  stack: pulumi.Stack,
+  providerUrn: string,
+  candidates: readonly AdoptionCandidate[],
+  onOutput: (msg: string) => void,
+): Promise<void> {
+  await stack.import({
+    resources: candidates.map((c) => ({
+      type: c.step.type,
+      name: c.step.name,
+      id: c.importId,
+      provider: IMPORT_PROVIDER_NAME,
+    })),
+    nameTable: { [IMPORT_PROVIDER_NAME]: providerUrn },
+    protect: false,
+    generateCode: false,
+    onOutput,
+  });
+}
+
 /** Thrown when the review (preview-plan.ts planGate) stops `pulumi up` after the preview. */
 export class PulumiUpDeclinedError extends Error {
   override readonly name = "PulumiUpDeclinedError";
@@ -544,16 +619,23 @@ export class PulumiUpDeclinedError extends Error {
  * Streams resource-create events to the supplied onEvent callback so
  * the wizard can render a live progress bar.
  *
- * On a stack that already holds resources, a preview runs first (#737) and
- * `review` sees its planned steps: it lists them and decides (planGate)
- * whether `up` may apply them. Nothing is applied when it says no.
+ * On a stack that already holds resources, a preview runs first (#737).
+ * Planned creates of resources that exist in the project already (made by
+ * `upgrade` through gcloud) are adopted into the stack and the stack is
+ * previewed again (adopt-existing.ts, #1079). `review` sees that plan and
+ * what was adopted: it lists them and decides (planGate) whether `up` may
+ * apply the plan. Nothing is applied when it says no.
  *
  * @throws PulumiUpDeclinedError when `review` declines the plan
+ * @throws AdoptionError when adopting fails; nothing was applied
  */
 export async function pulumiUpGcp(
   inputs: PulumiUpInputs,
   onEvent: (kind: "resource" | "error" | "log", message: string) => void,
-  review: (steps: readonly PlannedStep[]) => Promise<boolean>,
+  review: (
+    steps: readonly PlannedStep[],
+    adopted: readonly AdoptionCandidate[],
+  ) => Promise<boolean>,
 ): Promise<PulumiUpResult> {
   const env = pulumiGcpEnv(process.env, inputs);
 
@@ -608,11 +690,25 @@ export async function pulumiUpGcp(
 
   // #737 — never `up` a deployed stack blind: list what it would change
   // (replaces and deletes first) and let the review stop it. A first run
-  // on an empty stack only creates, so it skips the extra preview.
+  // on an empty stack only creates, so it skips the extra preview (and has
+  // no provider in its state to adopt anything under).
   if (stateResources.length > 0) {
-    const collector = collectPreviewSteps();
-    await stack.preview({ onEvent: collector.onEvent });
-    if (!(await review(collector.steps()))) {
+    const preview = async () => {
+      const collector = collectPreviewSteps();
+      await stack.preview({ onEvent: collector.onEvent });
+      return collector.steps();
+    };
+    // #1079 — what `upgrade` created through gcloud joins the state first.
+    const { steps, adopted } = await adoptExistingResources(await preview(), {
+      projectId: inputs.projectId,
+      gcloud,
+      preview,
+      importResources: (candidates) =>
+        importIntoStack(stack, stackGcpProviderUrn(stateResources), candidates, (msg) =>
+          onEvent("log", msg),
+        ),
+    });
+    if (!(await review(steps, adopted))) {
       throw new PulumiUpDeclinedError("pulumi up was not run: the planned changes were declined.");
     }
   }

package/src/wizards/gcp.ts

@@ -33,6 +33,7 @@ import { join } from "node:path";
 import { cancel, confirm, isCancel, log, note, select, spinner } from "@clack/prompts";
 import { bold, cyan, dim, green, red, yellow } from "kleur/colors";
 import { checkAdcImpersonation } from "../adc-impersonation.js";
+import { type AdoptionCandidate, AdoptionError, formatAdopted } from "../adopt-existing.js";
 import { ensureAuditJob, resolveAdminImage } from "../audit-job-setup.js";
 import { CERT_WAIT_TIMEOUT_MS, lbCertProbe, waitForCert } from "../cert-wait.js";
 import { redactCredentials } from "../checkpoint-secrets.js";
@@ -104,10 +105,20 @@ import {
 } from "../provisioner-identity.js";
 import { revokePublicRoleMemberships } from "../public-role-isolation.js";
 import { decideRegion, detectCliRegion, installableRegions, suggestRegion } from "../regions.js";
-import { ensureRemoteMcpEdge, ensureRemoteMcpIdentityEnv } from "../remote-mcp.js";
+import {
+  checkRemoteMcpIdentityEnv,
+  ensureRemoteMcpEdge,
+  findRemoteMcpTarget,
+  type RemoteMcpTarget,
+  resolveStackRemoteMcpIdentity,
+} from "../remote-mcp.js";
 import type { RunMode } from "../run-mode.js";
 import { selfCommand } from "../self-command.js";
-import { ABSENT_DEFAULT_FIREWALL_RULES } from "../stack-contract.js";
+import {
+  ABSENT_DEFAULT_FIREWALL_RULES,
+  type RemoteMcpIdentity,
+  sameRemoteMcpIdentity,
+} from "../stack-contract.js";
 import {
   chooseInstallBackend,
   describeBackend,
@@ -119,7 +130,6 @@ import {
   resolveBackend,
 } from "../state-backend.js";
 import { acquireStateLock, GcsStateStore } from "../state-store.js";
-import { lookupFailure, resolveGcpResourceName } from "../upgrade/gcp-lookup.js";
 import { createReleaseImageForms, platformDigestsOf } from "../upgrade/image-forms.js";
 import {
   releaseVersionForDigest,
@@ -378,12 +388,22 @@ export async function runGcpConverge(opts: GcpConvergeOpts): Promise<void> {
   // post-cleanup re-runs both pass through cleanly).
   await stepDrainLegacyCaeloAdminUser(projectId, region);
 
+  // === 9.8. The remote-MCP identity the stack declares (#1082) ===
+  // The stack owns the identity env vars (stack-contract.ts
+  // RemoteMcpIdentity) and declares them from config the CLI resolves from
+  // the live services, so this `up` keeps what they carry. A fresh install
+  // has no services yet: the identity is resolved after the first `up` and
+  // applied by a second one below.
+  const identityBefore = deployed
+    ? await stepResolveRemoteMcpIdentity(projectId, region, provider, domain, "before")
+    : null;
+
   // === 10. Pulumi up via Automation SDK ===
   // Pre-built signed images live at the Caelo-team public AR repo
   // (caelo-website/caelo-cms-images by default). Cloud Run reads them
   // directly with no operator-side IAM binding — anonymous public pull.
   phase("Provisioning the infrastructure (pulumi up, 8-15 min)");
-  await stepPulumiUp(installId, {
+  const upOpts: PulumiUpOpts = {
     projectId,
     domain,
     // #650 — the wizard recorded it (or the install predates the setting).
@@ -405,9 +425,24 @@ export async function runGcpConverge(opts: GcpConvergeOpts): Promise<void> {
     // matching config namespace.
     provider,
     nonInteractive: opts.nonInteractive,
-  });
+  };
+  await stepPulumiUp(installId, { ...upOpts, remoteMcpIdentity: identityBefore?.identity ?? null });
   recordImageDigests(installId, imageDigests);
 
+  // === 10.05. The identity once the services exist (#1082) ===
+  // Read again after every `up`: on a fresh install (or one whose identity
+  // could not be read before) this is the first time it can be, and an `up`
+  // that replaced a service changed it. A second `up` then applies it
+  // through the stack — never through gcloud, which the next `up` would
+  // undo.
+  const identity = await stepResolveRemoteMcpIdentity(projectId, region, provider, domain, "after");
+  if (identity && !sameRemoteMcpIdentity(identity.identity, identityBefore?.identity ?? null)) {
+    log.info(
+      "Applying the remote-MCP URLs and IAP audience through the stack (second pulumi up)...",
+    );
+    await stepPulumiUp(installId, { ...upOpts, remoteMcpIdentity: identity.identity });
+  }
+
   // === 10.1. Remove the default network's pre-populated firewall rules ===
   // GCP creates them when Compute Engine is enabled (step 5). Run after
   // Pulumi rather than right after enabling the API: the default network
@@ -488,11 +523,9 @@ export async function runGcpConverge(opts: GcpConvergeOpts): Promise<void> {
     keepSigner ? [`serviceAccount:${upgraderServiceAccountEmail(projectId, GCP_STACK_ENV)}`] : [],
   );
 
-  // === 11.6. Remote MCP (#806): LB rules (gcp) + the identity env ===
-  // After `pulumi up` on every pass: the identity env names services Pulumi
-  // generated, so the stack cannot declare it, and an `up` that changed a
-  // service's template dropped it (remote-mcp.ts).
-  const remoteMcpReady = await stepRemoteMcp(projectId, region, provider, domain);
+  // === 11.6. Remote MCP (#806): LB rules (gcp) + a check of the identity env ===
+  // The env itself came with `pulumi up` (step 10.05, #1082).
+  const remoteMcpReady = await stepRemoteMcp(projectId, provider, domain, identity);
 
   // A fresh install ran every converge step above, so it is at this CLI's
   // infrastructure contract — recorded only when the upgrader and the
@@ -1165,74 +1198,104 @@ async function stepOperatorAccessSync(
   s.stop(green(`Operator-access sync job ready (${r.done.length} steps)`));
 }
 
+/** The install's identity for the stack, with the deployed services it was read from. */
+interface ResolvedRemoteMcpIdentity {
+  readonly target: RemoteMcpTarget;
+  readonly identity: RemoteMcpIdentity;
+}
+
 /**
- * #806 — the CLI's part of remote MCP (remote-mcp.ts): on `gcp` the load
- * balancer's discovery routes and Cloud Armor rule, on both providers the
- * env vars naming the admin URL, the broker's public URL and the IAP
- * audience. Remote MCP stays off until the Owner sets it up under Settings →
- * MCP, so a failure does not stop the install: it warns, and the next pass
- * or `upgrade` retries. Idempotent.
+ * #1082 — resolve the remote-MCP identity (remote-mcp.ts
+ * resolveStackRemoteMcpIdentity) for the stack config: the deployed
+ * services' names, then their URLs / the IAP backend and the organisation.
+ * Read-only. Not fatal: remote MCP stays off until the Owner sets it up, so
+ * a failure warns and the `up` keeps the identity the config last recorded.
  *
- * @returns whether every part is in place
+ * @param when `before` the `up` (the services exist), or `after` it
+ * @returns the identity, or null when it could not be read
  */
-async function stepRemoteMcp(
+async function stepResolveRemoteMcpIdentity(
   projectId: string,
   region: string,
   provider: "gcp" | "gcp-firebase",
   domain: string,
-): Promise<boolean> {
+  when: "before" | "after",
+): Promise<ResolvedRemoteMcpIdentity | null> {
   const s = spinner();
   s.start(
-    "Preparing remote MCP (ChatGPT / claude.ai connectors; off until the Owner enables it)...",
+    "Reading the remote-MCP URLs and IAP audience (Google sign-in, ChatGPT / claude.ai connectors)...",
   );
-  const name = (slug: "admin" | "gateway") =>
-    resolveGcpResourceName(
-      gcloud,
-      "run-service",
-      `caelo-${GCP_STACK_ENV}-${slug}`,
-      projectId,
-      region,
-    );
-  const [adminLookup, gatewayLookup] = [await name("admin"), await name("gateway")];
   const failed = (error: string) => {
-    s.stop(yellow(`Remote MCP not prepared: ${error}`));
+    s.stop(yellow(`Remote-MCP URLs not read: ${error}`));
     log.warn(
-      `The install works; Settings → Google sign-in and Settings → MCP report this install as not prepared until ${bold(selfCommand("upgrade"))} prepares it.`,
+      when === "before"
+        ? "pulumi up keeps the remote-MCP env the stack recorded last; the installer reads it again after the update."
+        : "The install works; Settings → Google sign-in and Settings → MCP report this install as not prepared until a re-run of the installer reads them.",
     );
-    return false;
+    return null;
   };
-  if (adminLookup.status !== "found") {
-    return failed(
-      lookupFailure(adminLookup, `caelo-${GCP_STACK_ENV}-admin* Cloud Run service`, "operator"),
-    );
-  }
-  if (gatewayLookup.status !== "found") {
-    return failed(
-      lookupFailure(gatewayLookup, `caelo-${GCP_STACK_ENV}-gateway* Cloud Run service`, "operator"),
-    );
-  }
-  const [admin, gateway] = [adminLookup.name, gatewayLookup.name];
-  const edge = await ensureRemoteMcpEdge({ provider, projectId, env: GCP_STACK_ENV, domain });
-  if (!edge.ok) return failed(edge.error);
-  const env = await ensureRemoteMcpIdentityEnv({
+  const found = await findRemoteMcpTarget({
     provider,
     projectId,
     region,
     env: GCP_STACK_ENV,
     domain,
-    services: { admin, gateway },
   });
-  if (!env.ok) return failed(env.error);
-  s.stop(green(`Remote MCP and Google sign-in prepared (${env.identity.mcpPublicUrl})`));
-  if (env.orgDomainError) {
+  if (!found.ok) return failed(found.error);
+  const { target } = found;
+  const resolved = await resolveStackRemoteMcpIdentity(target);
+  if (!resolved.ok) return failed(resolved.error);
+  s.stop(green(`Remote-MCP URLs read (${resolved.identity.mcpPublicUrl})`));
+  if (resolved.orgDomainError && when === "after") {
     // #914 — without the organisation's domain the admin cannot tell who
     // IAP's built-in sign-in admits, so it refuses new users until the
     // Owner sets up Google sign-in. Say so now rather than at the first
     // invite.
     log.warn(
-      `Could not read this project's Google organisation (${env.orgDomainError}). Set up Google sign-in under Settings → Google sign-in before adding users, or re-run ${bold(selfCommand("upgrade"))} as an account with the Organization Viewer role.`,
+      `Could not read this project's Google organisation (${resolved.orgDomainError}). Set up Google sign-in under Settings → Google sign-in before adding users, or re-run ${bold(selfCommand("upgrade"))} as an account with the Organization Viewer role.`,
     );
   }
+  return { target, identity: resolved.identity };
+}
+
+/**
+ * #806 — the CLI's part of remote MCP (remote-mcp.ts): on `gcp` the load
+ * balancer's discovery routes and Cloud Armor rule. The identity env vars
+ * (admin URL, the broker's public URL, the IAP audience) come with `pulumi
+ * up` from the stack config (#1082); this only checks that the services
+ * carry them. Remote MCP stays off until the Owner sets it up under
+ * Settings → MCP, so a failure does not stop the install: it warns, and the
+ * next pass or `upgrade` retries. Idempotent.
+ *
+ * @returns whether every part is in place
+ */
+async function stepRemoteMcp(
+  projectId: string,
+  provider: "gcp" | "gcp-firebase",
+  domain: string,
+  identity: ResolvedRemoteMcpIdentity | null,
+): Promise<boolean> {
+  const s = spinner();
+  s.start(
+    "Preparing remote MCP (ChatGPT / claude.ai connectors; off until the Owner enables it)...",
+  );
+  const failed = (error: string) => {
+    s.stop(yellow(`Remote MCP not prepared: ${error}`));
+    log.warn(
+      `The install works; Settings → Google sign-in and Settings → MCP report this install as not prepared until ${bold(selfCommand("upgrade"))} prepares it.`,
+    );
+    return false;
+  };
+  if (!identity) return failed("its URLs and IAP audience could not be read (see above)");
+  const edge = await ensureRemoteMcpEdge({ provider, projectId, env: GCP_STACK_ENV, domain });
+  if (!edge.ok) return failed(edge.error);
+  const check = await checkRemoteMcpIdentityEnv(identity.target, identity.identity);
+  if (!check.ok) return failed(check.error);
+  const missing = [...check.drift.admin, ...check.drift.gateway].map((c) => c.name);
+  if (missing.length > 0) {
+    return failed(`pulumi up left ${[...new Set(missing)].join(", ")} out of the services' env`);
+  }
+  s.stop(green(`Remote MCP and Google sign-in prepared (${identity.identity.mcpPublicUrl})`));
   return true;
 }
 
@@ -1480,22 +1543,29 @@ interface PulumiUpOpts {
   provider?: "gcp" | "gcp-firebase";
   /** No terminal to ask (the install job, `--non-interactive`): see planGate. */
   nonInteractive: boolean;
+  /** #1082 — the remote-MCP identity the stack declares (gcp-pulumi.ts PulumiUpInputs). */
+  remoteMcpIdentity?: RemoteMcpIdentity | null;
 }
 
 /**
  * The installer's review of a deployed stack's plan before `pulumi up`
  * (#737): the grouped list, the full diff in the install dir, and a y/N
  * for any replace or delete. A data-bearing one is asked about by name and
- * defaults to No; without a terminal it is refused (planGate).
+ * defaults to No; without a terminal it is refused (planGate). Resources
+ * adopted into the stack before this preview (adopt-existing.ts, #1079) are
+ * listed first; they are no longer in the plan.
  *
  * @returns whether `pulumi up` may apply the plan
  */
 async function reviewPulumiPlan(
   installId: string,
   steps: readonly PlannedStep[],
+  adopted: readonly AdoptionCandidate[],
   nonInteractive: boolean,
 ): Promise<boolean> {
   const gate = planGate(steps, { interactive: !nonInteractive && process.stdin.isTTY === true });
+  const adoptedLines = formatAdopted(adopted);
+  if (adoptedLines.length > 0) log.info(adoptedLines.join("\n"));
   if (steps.length === 0) {
     log.info(dim("Preview: no changes planned."));
     return true;
@@ -1601,11 +1671,12 @@ async function stepPulumiUp(installId: string, opts: PulumiUpOpts): Promise<void
         // logs: silent — too noisy for a live progress UI; pulumi
         // diagnostics will print on failure via the SDK's onOutput.
       },
-      (steps) => reviewPulumiPlan(installId, steps, opts.nonInteractive),
+      (steps, adopted) => reviewPulumiPlan(installId, steps, adopted, opts.nonInteractive),
     );
   } catch (e) {
-    if (!(e instanceof PulumiUpDeclinedError)) throw e;
-    declined = e.message;
+    if (e instanceof AdoptionError) declined = `pulumi up was not run: ${e.message}`;
+    else if (e instanceof PulumiUpDeclinedError) declined = e.message;
+    else throw e;
   } finally {
     releaseLock();
   }

package/stacks/gcp/index.ts

@@ -37,13 +37,16 @@ import {
   adminEnvContract,
   adminMediaVolume,
   adminMediaVolumeTemplate,
+  CLOUD_RUN_IGNORE_CHANGES,
   type CloudRunEnvVar,
   type CloudRunSlug,
   databaseUrls,
   defaultStagingHost,
   GATEWAY_TIMEOUT_SECONDS,
   gatewayEnvContract,
+  REMOTE_MCP_IDENTITY_CONFIG,
   type RuntimeSecret,
+  remoteMcpIdentityStackEnv,
   runtimeSecretBindings,
   STATIC_CDN_POLICY,
   secretFileVolumesTemplate,
@@ -685,6 +688,12 @@ const envContractInputs = {
   },
 } as const;
 
+// #1082 — the remote-MCP identity env (stack-contract.ts RemoteMcpIdentity):
+// names generated identities no resource here can take as input, so the CLI
+// resolves them from the live install and writes them as config before `up`.
+// Declared here so the stack is their one owner and `up` keeps them.
+const remoteMcpEnv = remoteMcpIdentityStackEnv(cfg.get(REMOTE_MCP_IDENTITY_CONFIG));
+
 function cloudRunService(args: CloudRunArgs): gcp.cloudrunv2.Service {
   return new gcp.cloudrunv2.Service(
     `${namePrefix}-${args.serviceName}`,
@@ -740,6 +749,8 @@ function cloudRunService(args: CloudRunArgs): gcp.cloudrunv2.Service {
     },
     {
       ...opts,
+      // #1082 — which tool deployed last; see CLOUD_RUN_IGNORE_CHANGES.
+      ignoreChanges: [...CLOUD_RUN_IGNORE_CHANGES],
       dependsOn: [
         pgAdminUser,
         cmsAdminDb,
@@ -771,7 +782,7 @@ const adminSvc = cloudRunService({
   // in Cloud Run logs. 3600s is the platform max; no cost penalty for
   // unused timeout (Cloud Run bills running time, not allocated time).
   timeout: "3600s",
-  contractEnv: adminEnvContract(envContractInputs),
+  contractEnv: [...adminEnvContract(envContractInputs), ...remoteMcpEnv.admin],
   mediaVolume: adminMediaVolumeTemplate(adminMediaVolume(project, env)),
 });
 const gatewaySvc = cloudRunService({
@@ -786,7 +797,7 @@ const gatewaySvc = cloudRunService({
   timeout: `${GATEWAY_TIMEOUT_SECONDS}s`,
   // public_role on cms_public only: no cms_admin login of any role
   // (#613, #635, CLAUDE.md §2).
-  contractEnv: gatewayEnvContract(envContractInputs),
+  contractEnv: [...gatewayEnvContract(envContractInputs), ...remoteMcpEnv.gateway],
 });
 
 // =========================================================================

package/stacks/gcp-firebase/index.ts

@@ -42,13 +42,16 @@ import {
   adminEnvContract,
   adminMediaVolume,
   adminMediaVolumeTemplate,
+  CLOUD_RUN_IGNORE_CHANGES,
   type CloudRunEnvVar,
   type CloudRunSlug,
   databaseUrls,
   defaultStagingHost,
   GATEWAY_TIMEOUT_SECONDS,
   gatewayEnvContract,
+  REMOTE_MCP_IDENTITY_CONFIG,
   type RuntimeSecret,
+  remoteMcpIdentityStackEnv,
   runtimeSecretBindings,
   secretFileVolumesTemplate,
 } from "../../dist/stack-contract.js";
@@ -552,6 +555,12 @@ function imageRef(service: string): string {
   return digest ? `${base}@${digest}` : `${base}:${cfg.get("image-tag") ?? "latest"}`;
 }
 
+// #1082 — the remote-MCP identity env (stack-contract.ts RemoteMcpIdentity):
+// names generated identities no resource here can take as input, so the CLI
+// resolves them from the live install and writes them as config before `up`.
+// Declared here so the stack is their one owner and `up` keeps them.
+const remoteMcpEnv = remoteMcpIdentityStackEnv(cfg.get(REMOTE_MCP_IDENTITY_CONFIG));
+
 function cloudRunService(args: CloudRunArgs): gcp.cloudrunv2.Service {
   return new gcp.cloudrunv2.Service(
     `${namePrefix}-${args.serviceName}`,
@@ -600,6 +609,8 @@ function cloudRunService(args: CloudRunArgs): gcp.cloudrunv2.Service {
     },
     {
       ...opts,
+      // #1082 — which tool deployed last; see CLOUD_RUN_IGNORE_CHANGES.
+      ignoreChanges: [...CLOUD_RUN_IGNORE_CHANGES],
       dependsOn: [
         pgAdminUser,
         cmsAdminDb,
@@ -654,7 +665,7 @@ const gatewaySvc = cloudRunService({
   // request passes its rate limits, captcha and honeypot; staging requests
   // pass the staging access gate.
   ingress: "INGRESS_TRAFFIC_ALL",
-  contractEnv: gatewayEnvContract(envContractInputs),
+  contractEnv: [...gatewayEnvContract(envContractInputs), ...remoteMcpEnv.gateway],
 });
 
 const adminSvc = cloudRunService({
@@ -670,11 +681,14 @@ const adminSvc = cloudRunService({
   // Use the input string (known at config time) for the site — the
   // resource output is Output<string | undefined>, which Input<string>
   // rejects.
-  contractEnv: adminEnvContract({
-    ...envContractInputs,
-    firebaseSiteId,
-    gatewayService: gatewaySvc.name,
-  }),
+  contractEnv: [
+    ...adminEnvContract({
+      ...envContractInputs,
+      firebaseSiteId,
+      gatewayService: gatewaySvc.name,
+    }),
+    ...remoteMcpEnv.admin,
+  ],
   mediaVolume: adminMediaVolumeTemplate(adminMediaVolume(project, env)),
 });