@caelo-cms/provisioning 0.10.70 → 0.10.71

package/src/remote-mcp-stack-config.test.ts

@@ -0,0 +1,195 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #1082 — the remote-MCP identity env has one owner: the stack, which
+ * declares it from the config the CLI writes before `up`. These tests pin
+ * the config round trip and what a refreshed `pulumi up` / `state migrate`
+ * preview would plan for the services' env against an install whose live
+ * services carry the vars (the viu.one shape: contract env plus the four /
+ * two identity vars gcloud added, in gcloud's order).
+ */
+
+import { describe, expect, it } from "bun:test";
+import type * as automation from "@pulumi/pulumi/automation";
+import {
+  adminEnvContract,
+  type CloudRunEnvVar,
+  databaseUrls,
+  gatewayEnvContract,
+  parseRemoteMcpIdentityConfig,
+  REMOTE_MCP_ENV,
+  REMOTE_MCP_IDENTITY_CONFIG,
+  type RemoteMcpIdentity,
+  remoteMcpIdentityEnv,
+  remoteMcpIdentityStackEnv,
+  sameRemoteMcpIdentity,
+  serializeRemoteMcpIdentity,
+} from "./stack-contract.js";
+import { applyStackConfig, type StackConfigInputs } from "./wizards/gcp-pulumi.js";
+
+const identity: RemoteMcpIdentity = {
+  adminUrl: "https://caelo-production-admin-f89c711-7whkh344ca-ew.a.run.app",
+  mcpPublicUrl: "https://caelo-production-gateway-6da3bb0-7whkh344ca-ew.a.run.app",
+  iapAudience: "/projects/42/locations/europe-west1/services/caelo-production-admin-f89c711",
+  googleOrgDomain: "acme.com",
+};
+
+const contractInputs = {
+  provider: "gcp-firebase",
+  projectId: "viu-one-web",
+  env: "production",
+  domain: "viu.one",
+  region: "europe-west1",
+  stagingHost: "staging.viu.one",
+  databaseUrls: databaseUrls("10.153.0.3"),
+} as const;
+const contract = {
+  admin: adminEnvContract({
+    ...contractInputs,
+    firebaseSiteId: "caelo-production-site-eb4697",
+    gatewayService: "caelo-production-gateway-6da3bb0",
+  }),
+  gateway: gatewayEnvContract(contractInputs),
+};
+
+/** The env a stack declares for one service, given the config value. */
+function declared(slug: "admin" | "gateway", config: string | undefined): CloudRunEnvVar[] {
+  return [...contract[slug], ...remoteMcpIdentityStackEnv(config)[slug]];
+}
+
+/** The live services after an installer run plus its old gcloud post-step: gcloud reorders. */
+function live(slug: "admin" | "gateway"): CloudRunEnvVar[] {
+  return [...contract[slug], ...remoteMcpIdentityEnv(identity)[slug]].reverse();
+}
+
+/**
+ * What a refreshed preview plans for `containers.env`: the provider holds it
+ * as a set (terraform-provider-google `google_cloud_run_v2_service`), so
+ * order is no diff — a var only the live service has is removed, one only
+ * the program has is added, a different value is changed.
+ */
+function envPlan(desired: readonly CloudRunEnvVar[], actual: readonly CloudRunEnvVar[]) {
+  const key = (v: CloudRunEnvVar) => JSON.stringify(v);
+  const want = new Map(desired.map((v) => [v.name, key(v)]));
+  const have = new Map(actual.map((v) => [v.name, key(v)]));
+  return {
+    removed: [...have.keys()].filter((n) => !want.has(n)).sort(),
+    added: [...want.keys()].filter((n) => !have.has(n)).sort(),
+    changed: [...want.keys()].filter((n) => have.has(n) && have.get(n) !== want.get(n)).sort(),
+  };
+}
+
+describe("remote-MCP identity as stack config (#1082)", () => {
+  it("round-trips through the config value", () => {
+    const raw = serializeRemoteMcpIdentity(identity);
+    expect(parseRemoteMcpIdentityConfig(raw)).toEqual(identity);
+    const { googleOrgDomain: _d, ...noOrg } = identity;
+    expect(parseRemoteMcpIdentityConfig(serializeRemoteMcpIdentity(noOrg))).toEqual(noOrg);
+  });
+
+  it("declares nothing while the config is unset (a fresh install's first up)", () => {
+    expect(parseRemoteMcpIdentityConfig(undefined)).toBeNull();
+    expect(remoteMcpIdentityStackEnv(undefined)).toEqual({ admin: [], gateway: [] });
+  });
+
+  it("refuses a corrupt or foreign value loudly instead of dropping the vars", () => {
+    expect(() => parseRemoteMcpIdentityConfig("{")).toThrow(REMOTE_MCP_IDENTITY_CONFIG);
+    expect(() =>
+      parseRemoteMcpIdentityConfig(JSON.stringify({ ...identity, adminUrl: "http://x" })),
+    ).toThrow("adminUrl");
+    expect(() => parseRemoteMcpIdentityConfig(JSON.stringify({ ...identity, extra: "x" }))).toThrow(
+      REMOTE_MCP_IDENTITY_CONFIG,
+    );
+  });
+
+  it("declares exactly the vars and values upgrade's gcloud roll sets", () => {
+    expect(remoteMcpIdentityStackEnv(serializeRemoteMcpIdentity(identity))).toEqual(
+      remoteMcpIdentityEnv(identity),
+    );
+    expect(
+      remoteMcpIdentityStackEnv(serializeRemoteMcpIdentity(identity))
+        .admin.map((v) => v.name)
+        .sort(),
+    ).toEqual(Object.values(REMOTE_MCP_ENV).sort());
+  });
+
+  it.each(["admin", "gateway"] as const)(
+    "%s: with the config the CLI writes, a refreshed plan removes and changes nothing",
+    (slug) => {
+      const plan = envPlan(declared(slug, serializeRemoteMcpIdentity(identity)), live(slug));
+      expect(plan).toEqual({ removed: [], added: [], changed: [] });
+    },
+  );
+
+  it("without it (the bug), every up strips the vars gcloud set", () => {
+    expect(envPlan(declared("admin", undefined), live("admin")).removed).toEqual([
+      "CAELO_ADMIN_URL",
+      "CAELO_GOOGLE_ORG_DOMAIN",
+      "CAELO_IAP_AUDIENCE",
+      "CAELO_MCP_PUBLIC_URL",
+    ]);
+    expect(envPlan(declared("gateway", undefined), live("gateway")).removed).toEqual([
+      "CAELO_ADMIN_URL",
+      "CAELO_MCP_PUBLIC_URL",
+    ]);
+  });
+
+  it("compares identities by every var they set", () => {
+    expect(sameRemoteMcpIdentity(identity, { ...identity })).toBe(true);
+    expect(sameRemoteMcpIdentity(identity, { ...identity, googleOrgDomain: undefined })).toBe(
+      false,
+    );
+    expect(sameRemoteMcpIdentity(identity, null)).toBe(false);
+    expect(sameRemoteMcpIdentity(null, null)).toBe(true);
+  });
+});
+
+describe("applyStackConfig writes the identity (#1082)", () => {
+  /** A Stack fake recording the config the CLI sets. */
+  function fakeStack() {
+    const config: Record<string, string> = {};
+    const stack = {
+      setAllConfig: async (c: automation.ConfigMap) => {
+        for (const [k, v] of Object.entries(c)) config[k] = v.value;
+      },
+      setConfig: async (k: string, v: automation.ConfigValue) => {
+        config[k] = v.value;
+      },
+      getConfig: async (k: string) => {
+        if (!(k in config)) throw new Error(`configuration key '${k}' not found`);
+        return { value: config[k] as string };
+      },
+    } as unknown as automation.Stack;
+    return { stack, config };
+  }
+  const inputs: StackConfigInputs = {
+    provider: "gcp-firebase",
+    projectId: "viu-one-web",
+    domain: "viu.one",
+    stagingDomain: "staging.viu.one",
+    ownerEmail: "owner@viu.one",
+    region: "europe-west1",
+    cloudSqlTier: "db-f1-micro",
+    cloudSqlHa: false,
+    adminMinInstances: 0,
+    adminMemory: "2Gi",
+    gatewayMinInstances: 0,
+    wafAdaptiveProtection: false,
+    iapAllowlist: ["owner@viu.one"],
+    imageDigests: { admin: "sha256:a", gateway: "sha256:g" },
+  };
+  const key = `caelo-gcp-firebase:${REMOTE_MCP_IDENTITY_CONFIG}`;
+
+  it("sets the key the stack reads, from the resolved identity", async () => {
+    const { stack, config } = fakeStack();
+    await applyStackConfig(stack, { ...inputs, remoteMcpIdentity: identity }, []);
+    expect(parseRemoteMcpIdentityConfig(config[key])).toEqual(identity);
+  });
+
+  it("keeps what an earlier run recorded when the identity could not be read", async () => {
+    const { stack, config } = fakeStack();
+    config[key] = serializeRemoteMcpIdentity(identity);
+    await applyStackConfig(stack, { ...inputs, remoteMcpIdentity: null }, []);
+    expect(parseRemoteMcpIdentityConfig(config[key])).toEqual(identity);
+  });
+});

package/src/remote-mcp.test.ts

@@ -11,13 +11,15 @@ import { GCP_PUBLIC_BASE_PATHS } from "@caelo-cms/shared";
 import type { GcloudResult } from "./gcloud.js";
 import type { GcloudRunner } from "./gcloud-retry.js";
 import {
-  applyRemoteMcpIdentityEnv,
+  checkRemoteMcpIdentityEnv,
   ensureMcpArmorRule,
+  findRemoteMcpTarget,
   type LiveUrlMap,
   planUrlMapPaths,
   type RemoteMcpTarget,
   resolveGoogleOrgDomain,
   resolveRemoteMcpIdentity,
+  resolveStackRemoteMcpIdentity,
 } from "./remote-mcp.js";
 import {
   GENERAL_RATE_LIMIT_PRIORITY,
@@ -497,30 +499,111 @@ describe("resolveGoogleOrgDomain (#914)", () => {
   });
 });
 
-describe("applyRemoteMcpIdentityEnv", () => {
+const serviceJson = (env: { name: string; value: string }[]) =>
+  ok(JSON.stringify({ spec: { template: { spec: { containers: [{ env }] } } } }));
+const DESCRIBE_JSON = "--region=europe-west1 --project=acme --format=json";
+
+describe("findRemoteMcpTarget (#1082)", () => {
+  it("finds the Pulumi-suffixed services by prefix", async () => {
+    const { run } = fakeGcloud({
+      "run services list --region europe-west1 --project acme --filter metadata.name~^caelo-production-admin":
+        ok("caelo-production-admin-aaa\n"),
+      "run services list --region europe-west1 --project acme --filter metadata.name~^caelo-production-gateway":
+        ok("caelo-production-gateway-bbb\n"),
+    });
+    const { services: _s, ...base } = firebase;
+    expect(await findRemoteMcpTarget(base, { run })).toEqual({ ok: true, target: firebase });
+  });
+
+  it("fails naming the service it cannot find (a fresh install before its first up)", async () => {
+    const { run } = fakeGcloud({ "run services list": ok("") });
+    const { services: _s, ...base } = firebase;
+    const r = await findRemoteMcpTarget(base, { run });
+    expect(r.ok).toBe(false);
+    if (!r.ok) expect(r.error).toContain("caelo-production-admin* Cloud Run service");
+  });
+});
+
+describe("resolveStackRemoteMcpIdentity (#1082)", () => {
+  const base = {
+    "projects describe acme": ok("42\n"),
+    "projects get-ancestors acme": ANCESTORS_IN_ORG,
+    "run services describe caelo-production-admin-aaa": ok("https://a-xyz.a.run.app\n"),
+    "run services describe caelo-production-gateway-bbb": ok("https://g-xyz.a.run.app\n"),
+  };
+
+  it("is the live identity when the organisation is readable", async () => {
+    const { run } = fakeGcloud({ ...base, "organizations describe 123456": ok("acme.com\n") });
+    const r = await resolveStackRemoteMcpIdentity(firebase, { run });
+    expect(r.ok && r.identity.googleOrgDomain).toBe("acme.com");
+    expect(r.ok && r.orgDomainError).toBeUndefined();
+  });
+
+  it("carries the admin's live organisation domain over when it cannot be read now", async () => {
+    // The stack owns the var: leaving it out of the config would remove it
+    // on the next `up`, where a gcloud roll leaves it as it is.
+    const { run } = fakeGcloud({
+      ...base,
+      "organizations describe 123456": fail("PERMISSION_DENIED"),
+      [`run services describe caelo-production-admin-aaa ${DESCRIBE_JSON}`]: serviceJson([
+        { name: "CAELO_GOOGLE_ORG_DOMAIN", value: "acme.com" },
+      ]),
+    });
+    const r = await resolveStackRemoteMcpIdentity(firebase, { run });
+    expect(r.ok).toBe(true);
+    if (!r.ok) return;
+    expect(r.identity.googleOrgDomain).toBe("acme.com");
+    expect(r.orgDomainError).toContain("Organization Viewer");
+  });
+
+  it("sets no domain when neither the organisation nor the admin has one", async () => {
+    const { run } = fakeGcloud({
+      ...base,
+      "organizations describe 123456": fail("PERMISSION_DENIED"),
+      [`run services describe caelo-production-admin-aaa ${DESCRIBE_JSON}`]: serviceJson([]),
+    });
+    const r = await resolveStackRemoteMcpIdentity(firebase, { run });
+    expect(r.ok && r.identity.googleOrgDomain).toBeUndefined();
+  });
+});
+
+describe("checkRemoteMcpIdentityEnv (#1082)", () => {
   const identity = {
     adminUrl: "https://a.run.app",
     mcpPublicUrl: "https://g.run.app",
     iapAudience: "/projects/42/locations/europe-west1/services/caelo-production-admin-aaa",
   };
-  const serviceJson = (env: { name: string; value: string }[]) =>
-    ok(JSON.stringify({ spec: { template: { spec: { containers: [{ env }] } } } }));
+  const full = remoteMcpIdentityEnv(identity);
+  const plain = (env: ReturnType<typeof remoteMcpIdentityEnv>["admin"]) =>
+    env.map((e) => ({ name: e.name, value: "value" in e ? e.value : "" }));
 
-  it("updates only a service whose vars differ", async () => {
+  it("reports no drift when the services carry the vars, and never updates a service", async () => {
     const { run, calls } = fakeGcloud({
-      "run services describe caelo-production-admin-aaa": serviceJson([
-        { name: "CAELO_IAP_AUDIENCE", value: identity.iapAudience },
-        { name: "CAELO_MCP_PUBLIC_URL", value: identity.mcpPublicUrl },
-        { name: "CAELO_ADMIN_URL", value: identity.adminUrl },
-      ]),
-      "run services describe caelo-production-gateway-bbb": serviceJson([]),
-      "run services update caelo-production-gateway-bbb": ok(),
+      [`run services describe caelo-production-admin-aaa ${DESCRIBE_JSON}`]: serviceJson(
+        plain(full.admin),
+      ),
+      [`run services describe caelo-production-gateway-bbb ${DESCRIBE_JSON}`]: serviceJson(
+        plain(full.gateway),
+      ),
     });
-    const r = await applyRemoteMcpIdentityEnv(firebase, identity, { run });
-    expect(r.ok).toBe(true);
-    expect(calls.filter((c) => c.startsWith("run services update"))).toEqual([
-      "run services update caelo-production-gateway-bbb --region=europe-west1 --project=acme --update-env-vars=CAELO_ADMIN_URL=https://a.run.app,CAELO_MCP_PUBLIC_URL=https://g.run.app --quiet",
+    const r = await checkRemoteMcpIdentityEnv(firebase, identity, { run });
+    expect(r).toEqual({ ok: true, drift: { admin: [], gateway: [] } });
+    expect(calls.some((c) => c.startsWith("run services update"))).toBe(false);
+  });
+
+  it("names what a service lacks", async () => {
+    const { run, calls } = fakeGcloud({
+      [`run services describe caelo-production-admin-aaa ${DESCRIBE_JSON}`]: serviceJson(
+        plain(full.admin),
+      ),
+      [`run services describe caelo-production-gateway-bbb ${DESCRIBE_JSON}`]: serviceJson([]),
+    });
+    const r = await checkRemoteMcpIdentityEnv(firebase, identity, { run });
+    expect(r.ok && r.drift.gateway.map((c) => c.name)).toEqual([
+      "CAELO_ADMIN_URL",
+      "CAELO_MCP_PUBLIC_URL",
     ]);
+    expect(calls.some((c) => c.startsWith("run services update"))).toBe(false);
   });
 });
 

package/src/remote-mcp.ts

@@ -3,13 +3,15 @@
 /**
  * #806 — the CLI's part of remote MCP on a Google IAP install (`gcp`,
  * `gcp-firebase`), run as the operator's (or the provisioner's) gcloud
- * identity by the wizard after `pulumi up` and by `cms-provision upgrade`
- * after the roll. Every step is idempotent.
+ * identity by the wizard around `pulumi up`, by `state migrate`'s preview
+ * and by `cms-provision upgrade` around the roll. Every step is idempotent.
  *
- *   - {@link ensureRemoteMcpIdentityEnv}: the env vars that name generated
- *     identities ({@link RemoteMcpIdentity} — why the stacks cannot declare
- *     them is in stack-contract.ts), applied with `gcloud run services
- *     update` only where they differ.
+ *   - {@link resolveStackRemoteMcpIdentity}: the env vars that name
+ *     generated identities ({@link RemoteMcpIdentity}), resolved from the
+ *     live install for the stack config the installer writes before `up`
+ *     (#1082: the stack is their one owner — stack-contract.ts says why
+ *     they cannot be plain resource inputs), and
+ *     {@link checkRemoteMcpIdentityEnv}, the read-only check after it.
  *   - {@link ensureRemoteMcpEdge} (`gcp` only): the load balancer's part for
  *     installs whose URL map / Cloud Armor policy predate it — the
  *     `/.well-known/oauth-*` path rules (the stack ignores `pathRules` after
@@ -43,11 +45,13 @@ import type { HttpFetch } from "./runtime-secrets.js";
 import {
   type CloudRunSlug,
   type GcpProvider,
+  REMOTE_MCP_ENV,
   type RemoteMcpIdentity,
   remoteMcpIdentity,
   remoteMcpIdentityEnv,
 } from "./stack-contract.js";
 import { type EnvChange, liveContainerEnv, planEnvUpdate } from "./stack-converge.js";
+import { lookupFailure, resolveGcpResourceName } from "./upgrade/gcp-lookup.js";
 
 /** The install remote MCP is set up on. */
 export interface RemoteMcpTarget {
@@ -226,76 +230,118 @@ async function resolveServiceIdentity(
   };
 }
 
+/** `gcloud run services describe --format=json` of one service, or why it failed. */
+async function describeService(
+  target: RemoteMcpTarget,
+  service: string,
+  run: GcloudRunner,
+): Promise<RemoteMcpResult<{ readonly json: string }>> {
+  const describe = await run([
+    "run",
+    "services",
+    "describe",
+    service,
+    `--region=${target.region}`,
+    `--project=${target.projectId}`,
+    "--format=json",
+  ]);
+  if (!describe.ok) return { ok: false, error: `describe ${service}: ${describe.stderr.trim()}` };
+  if (parseJson(describe.stdout) === null) {
+    return { ok: false, error: `describe ${service}: output is not JSON` };
+  }
+  return { ok: true, json: describe.stdout };
+}
+
 /**
- * Bring both services' {@link RemoteMcpIdentity} env vars to `identity`
- * with one `gcloud run services update` per service that differs (a new
- * revision only then). Vars already right are left alone.
+ * #1082 — the deployed install remote MCP is resolved on: the Pulumi-suffixed
+ * admin and gateway Cloud Run services found by prefix. Read-only.
  */
-export async function applyRemoteMcpIdentityEnv(
-  target: RemoteMcpTarget,
-  identity: RemoteMcpIdentity,
+export async function findRemoteMcpTarget(
+  base: Omit<RemoteMcpTarget, "services">,
   deps: { run?: GcloudRunner } = {},
-): Promise<RemoteMcpResult<{ readonly changes: Record<CloudRunSlug, EnvChange[]> }>> {
+): Promise<RemoteMcpResult<{ readonly target: RemoteMcpTarget }>> {
   const run = deps.run ?? defaultGcloud;
-  const desired = remoteMcpIdentityEnv(identity);
-  const changes: Record<CloudRunSlug, EnvChange[]> = { admin: [], gateway: [] };
+  const services: Partial<Record<CloudRunSlug, string>> = {};
   for (const slug of ["admin", "gateway"] as const) {
-    const service = target.services[slug];
-    const describe = await run([
-      "run",
-      "services",
-      "describe",
-      service,
-      `--region=${target.region}`,
-      `--project=${target.projectId}`,
-      "--format=json",
-    ]);
-    if (!describe.ok) return { ok: false, error: `describe ${service}: ${describe.stderr.trim()}` };
-    if (parseJson(describe.stdout) === null) {
-      return { ok: false, error: `describe ${service}: output is not JSON` };
+    const prefix = `${gcpNamePrefix(base.env)}-${slug}`;
+    const lookup = await resolveGcpResourceName(
+      run,
+      "run-service",
+      prefix,
+      base.projectId,
+      base.region,
+    );
+    if (lookup.status !== "found") {
+      return {
+        ok: false,
+        error: lookupFailure(lookup, `${prefix}* Cloud Run service`, "operator"),
+      };
     }
-    const plan = planEnvUpdate(liveContainerEnv(describe.stdout), desired[slug]);
-    if (!plan.ok) return { ok: false, error: `${slug}: ${plan.error}` };
-    if (plan.flags.length === 0) continue;
-    const update = await run([
-      "run",
-      "services",
-      "update",
-      service,
-      `--region=${target.region}`,
-      `--project=${target.projectId}`,
-      ...plan.flags,
-      "--quiet",
-    ]);
-    if (!update.ok) return { ok: false, error: `update ${service}: ${update.stderr.trim()}` };
-    changes[slug] = plan.changes;
+    services[slug] = lookup.name;
   }
-  return { ok: true, changes };
+  return {
+    ok: true,
+    target: { ...base, services: services as Record<CloudRunSlug, string> },
+  };
 }
 
-/** {@link resolveRemoteMcpIdentity} then {@link applyRemoteMcpIdentityEnv}. */
-export async function ensureRemoteMcpIdentityEnv(
+/**
+ * #1082 — the identity the installer writes into the stack config before
+ * `up` (stack-contract.ts REMOTE_MCP_IDENTITY_CONFIG), so the stack declares
+ * the vars the services carry and `up` keeps them.
+ *
+ * {@link resolveRemoteMcpIdentity}, except for the organisation domain when
+ * it cannot be read: then the admin's live `CAELO_GOOGLE_ORG_DOMAIN` is
+ * carried over (an earlier run as an account with the Organization Viewer
+ * role set it). The stack would otherwise remove it, where a gcloud roll
+ * leaves it as it is. `orgDomainError` still says why it was not read.
+ */
+export async function resolveStackRemoteMcpIdentity(
   target: RemoteMcpTarget,
   deps: { run?: GcloudRunner } = {},
 ): Promise<
-  RemoteMcpResult<{
-    readonly identity: RemoteMcpIdentity;
-    readonly changes: Record<CloudRunSlug, EnvChange[]>;
-    readonly orgDomainError?: string;
-  }>
+  RemoteMcpResult<{ readonly identity: RemoteMcpIdentity; readonly orgDomainError?: string }>
 > {
-  const resolved = await resolveRemoteMcpIdentity(target, deps);
-  if (!resolved.ok) return resolved;
-  const applied = await applyRemoteMcpIdentityEnv(target, resolved.identity, deps);
-  if (!applied.ok) return applied;
+  const run = deps.run ?? defaultGcloud;
+  const resolved = await resolveRemoteMcpIdentity(target, { run });
+  if (!resolved.ok || !resolved.orgDomainError) return resolved;
+  const admin = await describeService(target, target.services.admin, run);
+  if (!admin.ok) return admin;
+  const live = liveContainerEnv(admin.json).get(REMOTE_MCP_ENV.googleOrgDomain);
   return {
     ok: true,
-    identity: resolved.identity,
-    changes: applied.changes,
-    ...(resolved.orgDomainError ? { orgDomainError: resolved.orgDomainError } : {}),
+    identity:
+      live?.kind === "value"
+        ? { ...resolved.identity, googleOrgDomain: live.value }
+        : resolved.identity,
+    orgDomainError: resolved.orgDomainError,
   };
 }
 
+/**
+ * #1082 — what each service's identity env lacks against `identity`
+ * (read-only). The stack owns these vars now; this is the installer's check
+ * that the `up` it just ran put them in place. An empty list per service is
+ * the expected answer.
+ */
+export async function checkRemoteMcpIdentityEnv(
+  target: RemoteMcpTarget,
+  identity: RemoteMcpIdentity,
+  deps: { run?: GcloudRunner } = {},
+): Promise<RemoteMcpResult<{ readonly drift: Record<CloudRunSlug, EnvChange[]> }>> {
+  const run = deps.run ?? defaultGcloud;
+  const desired = remoteMcpIdentityEnv(identity);
+  const drift: Record<CloudRunSlug, EnvChange[]> = { admin: [], gateway: [] };
+  for (const slug of ["admin", "gateway"] as const) {
+    const described = await describeService(target, target.services[slug], run);
+    if (!described.ok) return described;
+    const plan = planEnvUpdate(liveContainerEnv(described.json), desired[slug]);
+    if (!plan.ok) return { ok: false, error: `${slug}: ${plan.error}` };
+    drift[slug] = plan.changes;
+  }
+  return { ok: true, drift };
+}
+
 // ===========================================================================
 // Load balancer (gcp)
 // ===========================================================================

package/src/stack-contract-parity.test.ts

@@ -15,6 +15,7 @@ import { describe, expect, it } from "bun:test";
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import {
+  CLOUD_RUN_IGNORE_CHANGES,
   type GcpProvider,
   type IamInvariant,
   runtimeSecretBindings,
@@ -131,11 +132,35 @@ describe.each(["gcp", "gcp-firebase"] as const)("%s stack ↔ upgrade parity", (
   });
 
   it("builds the admin + gateway env from the shared contracts", () => {
-    expect(src).toMatch(/serviceName: "admin",[\s\S]*?contractEnv: adminEnvContract\(/);
-    expect(src).toMatch(/serviceName: "gateway",[\s\S]*?contractEnv: gatewayEnvContract\(/);
+    expect(src).toMatch(
+      /serviceName: "admin",[\s\S]*?contractEnv: \[\s*\.\.\.adminEnvContract\([\s\S]*?\.\.\.remoteMcpEnv\.admin,?\s*\]/,
+    );
+    expect(src).toMatch(
+      /serviceName: "gateway",[\s\S]*?contractEnv: \[\s*\.\.\.gatewayEnvContract\([\s\S]*?\.\.\.remoteMcpEnv\.gateway,?\s*\]/,
+    );
     expect(src).toContain("envs: [...args.contractEnv],");
   });
 
+  it("#1082 — declares the remote-MCP identity env from the config the CLI writes", () => {
+    // The stack is the vars' one owner: `pulumi up` keeps what the CLI used
+    // to add with gcloud after every `up` (and every `up` removed again).
+    expect(src).toContain(
+      "const remoteMcpEnv = remoteMcpIdentityStackEnv(cfg.get(REMOTE_MCP_IDENTITY_CONFIG));",
+    );
+    expect(src.match(/remoteMcpEnv\.(admin|gateway)/g)?.sort()).toEqual([
+      "remoteMcpEnv.admin",
+      "remoteMcpEnv.gateway",
+    ]);
+  });
+
+  it("#1082 — leaves client / clientVersion (who deployed last) to gcloud on both services", () => {
+    expect(src.match(/new gcp\.cloudrunv2\.Service\(/g)).toHaveLength(1);
+    expect(src).toMatch(
+      /new gcp\.cloudrunv2\.Service\([\s\S]*?\.\.\.opts,\s*\/\/[^\n]*\n\s*ignoreChanges: \[\.\.\.CLOUD_RUN_IGNORE_CHANGES\],/,
+    );
+    expect(CLOUD_RUN_IGNORE_CHANGES).toEqual(["client", "clientVersion"]);
+  });
+
   it("mounts the media bucket on the admin, and only there, from the contract upgrade applies", () => {
     // The stack's admin gets adminMediaVolume() — the same volume
     // stack-converge.ts planMediaVolume adds to installs that lack it.
@@ -166,7 +191,7 @@ describe.each(["gcp", "gcp-firebase"] as const)("%s stack ↔ upgrade parity", (
 
   it("#806 — gives the gateway the contract's request timeout upgrade applies", () => {
     expect(src).toMatch(
-      /serviceName: "gateway",[\s\S]*?timeout: `\$\{GATEWAY_TIMEOUT_SECONDS\}s`,[\s\S]*?contractEnv: gatewayEnvContract\(/,
+      /serviceName: "gateway",[\s\S]*?timeout: `\$\{GATEWAY_TIMEOUT_SECONDS\}s`,[\s\S]*?contractEnv: \[\s*\.\.\.gatewayEnvContract\(/,
     );
   });