@caelo-cms/provisioning 0.10.70 → 0.10.71

package/src/stack-contract.ts

@@ -34,6 +34,7 @@
  * Pure module — the stacks import it from `dist/`.
  */
 
+import { z } from "zod";
 import type { SupportedProvider } from "./adapter.js";
 import {
   auditJobResource,
@@ -642,12 +643,21 @@ export function operatorOAuthClientSecretResource(projectId: string, env: string
  * its own name; the gateway's public URL is its own URL; the admin's URL is
  * a service created after the gateway), and on `gcp` the audience is the
  * numeric id of a backend service created after the admin. A resource
- * cannot take its own (or a later resource's) output as input. So the CLI
- * reads the live identities after deploy and applies these vars with gcloud
- * — the wizard after every `pulumi up`, `upgrade` after every roll
- * (remote-mcp.ts `ensureRemoteMcpIdentityEnv`). A roll that does not set
- * them leaves them as they are (planEnvUpdate never removes a var the
- * contract does not own).
+ * cannot take its own (or a later resource's) output as input.
+ *
+ * So the CLI reads the live identities and hands them to the stack as
+ * config ({@link REMOTE_MCP_IDENTITY_CONFIG}, the way the image digests are
+ * pinned), and the stacks declare the vars from it
+ * ({@link remoteMcpIdentityStackEnv}): the stack is their one owner, and a
+ * `pulumi up` keeps them (#1082 — before, the CLI set them with gcloud
+ * after every `up`, every `up` removed them again, and `state migrate`'s
+ * preview could never come back clean). The installer resolves them before
+ * every `up` of a deployed install, and on a fresh one after the first `up`
+ * followed by a second (wizards/gcp.ts); `state migrate`'s preview resolves
+ * them the same way (state-pulumi.ts). `upgrade`, which does not run
+ * Pulumi, applies the same derived values with its gcloud roll (like the
+ * rest of the env contract); a roll that does not set them leaves them as
+ * they are (planEnvUpdate never removes a var the contract does not own).
  *
  * #914 adds two the admin's Google sign-in needs: its own URL (the
  * self-check opens it signed out) and the project's Google organisation
@@ -752,6 +762,97 @@ export function remoteMcpIdentityEnv(
   };
 }
 
+/**
+ * #1082 — stack config key (`caelo-<provider>:remoteMcpIdentity`) carrying
+ * the {@link RemoteMcpIdentity} as JSON. Written by the CLI before `up`,
+ * read by the stacks ({@link remoteMcpIdentityStackEnv}).
+ */
+export const REMOTE_MCP_IDENTITY_CONFIG = "remoteMcpIdentity";
+
+const remoteMcpIdentitySchema = z
+  .object({
+    adminUrl: z.string().regex(/^https:\/\/[^\s/]+$/),
+    mcpPublicUrl: z.string().regex(/^https:\/\/[^\s/]+$/),
+    iapAudience: z.string().regex(/^\/projects\/\d+\/[^\s]+$/),
+    googleOrgDomain: z
+      .string()
+      .regex(/^([a-z0-9.-]+\.[a-z]{2,}|none)$/)
+      .optional(),
+  })
+  .strict();
+
+/** {@link RemoteMcpIdentity} as the value of {@link REMOTE_MCP_IDENTITY_CONFIG}. */
+export function serializeRemoteMcpIdentity(id: RemoteMcpIdentity): string {
+  return JSON.stringify(remoteMcpIdentitySchema.parse(id));
+}
+
+/**
+ * Parse the {@link REMOTE_MCP_IDENTITY_CONFIG} value; null when unset (a
+ * fresh install before its first `up`).
+ *
+ * @throws Error naming the key when the value is not a valid identity — a
+ *   hand-edited or corrupt config must stop the `up`, not silently drop
+ *   the vars.
+ */
+export function parseRemoteMcpIdentityConfig(raw: string | undefined): RemoteMcpIdentity | null {
+  if (raw === undefined || raw === "") return null;
+  let json: unknown;
+  try {
+    json = JSON.parse(raw);
+  } catch {
+    throw new Error(
+      `stack config ${REMOTE_MCP_IDENTITY_CONFIG} is not JSON; delete the key and re-run the installer, which writes it again from the live install`,
+    );
+  }
+  const parsed = remoteMcpIdentitySchema.safeParse(json);
+  if (!parsed.success) {
+    throw new Error(
+      `stack config ${REMOTE_MCP_IDENTITY_CONFIG} is not a remote-MCP identity (${parsed.error.issues.map((i) => i.path.join(".") || i.message).join(", ")}); delete the key and re-run the installer, which writes it again from the live install`,
+    );
+  }
+  return parsed.data;
+}
+
+/**
+ * The remote-MCP identity env each Cloud Run service declares in the stacks:
+ * {@link remoteMcpIdentityEnv} of the configured identity, nothing while the
+ * config is unset.
+ */
+export function remoteMcpIdentityStackEnv(
+  raw: string | undefined,
+): Record<CloudRunSlug, CloudRunEnvVar[]> {
+  const id = parseRemoteMcpIdentityConfig(raw);
+  return id ? remoteMcpIdentityEnv(id) : { admin: [], gateway: [] };
+}
+
+/** Whether two identities would give the services the same env. */
+export function sameRemoteMcpIdentity(
+  a: RemoteMcpIdentity | null,
+  b: RemoteMcpIdentity | null,
+): boolean {
+  if (a === null || b === null) return a === b;
+  return (
+    a.adminUrl === b.adminUrl &&
+    a.mcpPublicUrl === b.mcpPublicUrl &&
+    a.iapAudience === b.iapAudience &&
+    a.googleOrgDomain === b.googleOrgDomain
+  );
+}
+
+/**
+ * #1082 — Pulumi options both stacks give the Cloud Run v2 services.
+ * `client` / `clientVersion` only record which tool deployed the service
+ * last: `gcloud` sets them on every `upgrade` roll, and the provider
+ * (terraform-provider-google `google_cloud_run_v2_service`: `Optional`, not
+ * `Computed`) reads them back on refresh, so the stack, which leaves them
+ * unset, would plan an update on every service `upgrade` ever rolled. They
+ * affect nothing that runs. `ignoreChanges` is Pulumi's way to leave a
+ * property to another writer. (The env itself needs no such option: the
+ * provider holds `containers.env` as a set, so gcloud's reordering is no
+ * diff — only a missing or different var is.)
+ */
+export const CLOUD_RUN_IGNORE_CHANGES: readonly string[] = ["client", "clientVersion"];
+
 /**
  * The env of the admin service.
  *

package/src/state-command.ts

@@ -16,6 +16,7 @@ import { confirm, isCancel, log, note } from "@clack/prompts";
 import { bold, red } from "kleur/colors";
 import { adoptionCandidates, existingCandidates } from "./adopt-existing.js";
 import { checkGcloudAuth, gcloud } from "./gcloud.js";
+import { GCP_STACK_ENV } from "./gcp-names.js";
 import {
   adoptStateBackend,
   currentMetadata,
@@ -33,7 +34,13 @@ import { installIapAllowlist } from "./operator-access.js";
 import { ensureOpsBackend } from "./ops-backend.js";
 import { writePlanFile } from "./preview-plan.js";
 import { provisionerServiceAccountEmail } from "./provisioner-identity.js";
+import {
+  findRemoteMcpTarget,
+  type RemoteMcpTarget,
+  resolveStackRemoteMcpIdentity,
+} from "./remote-mcp.js";
 import { selfCommand } from "./self-command.js";
+import type { RemoteMcpIdentity } from "./stack-contract.js";
 import { attachInstall } from "./state-attach.js";
 import {
   gcsBackendRecord,
@@ -192,6 +199,14 @@ export async function stateCommand(argv: readonly string[]): Promise<void> {
           iapAllowlist: installIapAllowlist(meta.ownerEmail),
           imageDigests,
         },
+        resolveRemoteMcpIdentity: () =>
+          resolveRemoteMcpIdentityForPreview({
+            provider,
+            projectId,
+            region,
+            env: GCP_STACK_ENV,
+            domain: meta.domain,
+          }),
       }),
       report: clackReporter(),
       resolve: (record) =>
@@ -323,3 +338,20 @@ export function adcNote(run: SyncGcloud): string | null {
   if (r.ok) return null;
   return "No Application Default Credentials on this machine. upgrade, status and backup don't need them; re-running the installer or `state migrate` does: gcloud auth application-default login";
 }
+
+/**
+ * #1082 — the remote-MCP identity a preview gives the stack, read from the
+ * live install exactly as the installer reads it before `up`
+ * (remote-mcp.ts resolveStackRemoteMcpIdentity). Unreadable: null, with a
+ * warning — the stack's recorded config then stands, and the preview shows
+ * any difference from what the services carry.
+ */
+async function resolveRemoteMcpIdentityForPreview(
+  base: Omit<RemoteMcpTarget, "services">,
+): Promise<RemoteMcpIdentity | null> {
+  const found = await findRemoteMcpTarget(base);
+  const resolved = found.ok ? await resolveStackRemoteMcpIdentity(found.target) : found;
+  if (resolved.ok) return resolved.identity;
+  log.warn(`Could not read the remote-MCP URLs and IAP audience: ${resolved.error}`);
+  return null;
+}

package/src/state-pulumi.ts

@@ -20,6 +20,11 @@ import * as automation from "@pulumi/pulumi/automation";
 import { redactCredentials } from "./checkpoint-secrets.js";
 import { GCP_STACK_ENV } from "./gcp-names.js";
 import { collectPreviewSteps } from "./preview-plan.js";
+import {
+  REMOTE_MCP_IDENTITY_CONFIG,
+  type RemoteMcpIdentity,
+  serializeRemoteMcpIdentity,
+} from "./stack-contract.js";
 import type { ResolvedBackend } from "./state-backend.js";
 import type { StatePulumiOps } from "./state-migrate.js";
 import {
@@ -68,6 +73,12 @@ export interface RealPulumiOpsInputs {
   readonly impersonateServiceAccount: string;
   /** The config a wizard run sets, so a preview shows real drift only. */
   readonly stackConfig: StackConfigInputs;
+  /**
+   * #1082 — the remote-MCP identity read from the live install, as the
+   * installer reads it before its `up` (null when it cannot be read: the
+   * stack's config then stays as it is). Asked once per preview.
+   */
+  readonly resolveRemoteMcpIdentity: () => Promise<RemoteMcpIdentity | null>;
 }
 
 /** {@link StatePulumiOps} backed by the `pulumi` CLI + Automation API. */
@@ -195,6 +206,16 @@ export function realStatePulumiOps(inputs: RealPulumiOpsInputs): StatePulumiOps
           []) as StateResource[];
         await applyStackConfig(stack, inputs.stackConfig, resources);
       }
+      // #1082 — the identity env the stack declares, set the way the
+      // installer sets it before every `up`: from the live install. A stack
+      // last applied before the stack owned it has no such config yet, and
+      // its preview would show the vars removed.
+      const identity = await inputs.resolveRemoteMcpIdentity();
+      if (identity) {
+        await stack.setConfig(`caelo-${inputs.provider}:${REMOTE_MCP_IDENTITY_CONFIG}`, {
+          value: serializeRemoteMcpIdentity(identity),
+        });
+      }
       await assertStackProject(stack, inputs.provider, inputs.stackConfig.projectId);
       // #737 — the steps themselves, not just the summary's count: a
       // refusal lists what would change, replaces and deletes first.

package/src/upgrade/converge.ts

@@ -364,8 +364,10 @@ export function startConverge(
     // name identities the env contract cannot (stack-contract.ts
     // RemoteMcpIdentity). Resolved here, read-only, and set by the rolls
     // (AppRollHooks.afterMigrations `extraEnv`), so they ride the new
-    // revisions. A failure leaves the vars as the services have them and
-    // warns: only remote MCP depends on them.
+    // revisions. The stack declares the same derived values from the config
+    // the installer writes before `up` (#1082), so neither writer undoes the
+    // other. A failure leaves the vars as the services have them and warns:
+    // only remote MCP depends on them.
     const s = r.step("Resolving the remote-MCP URLs and IAP audience...");
     const resolved = await resolveRemoteMcpIdentity(
       {

package/src/wizards/gcp-pulumi.ts

@@ -30,7 +30,12 @@ import {
   withoutAmbientGoogleCredentials,
 } from "../provisioner-identity.js";
 import { ensureGeneratedSecrets, stackSecretReplication } from "../runtime-secrets.js";
-import { ADMIN_MEMORY_DEFAULT } from "../stack-contract.js";
+import {
+  ADMIN_MEMORY_DEFAULT,
+  REMOTE_MCP_IDENTITY_CONFIG,
+  type RemoteMcpIdentity,
+  serializeRemoteMcpIdentity,
+} from "../stack-contract.js";
 import type { ResolvedBackend } from "../state-backend.js";
 
 /**
@@ -96,6 +101,13 @@ export interface PulumiUpInputs {
    * Defaults to 'gcp' for backwards compatibility.
    */
   provider?: "gcp" | "gcp-firebase";
+  /**
+   * #1082 — the remote-MCP identity the stack declares as env
+   * (stack-contract.ts REMOTE_MCP_IDENTITY_CONFIG), resolved from the live
+   * install. Null when it could not be resolved (a fresh install before its
+   * first `up`): the config keeps what an earlier run wrote.
+   */
+  remoteMcpIdentity?: RemoteMcpIdentity | null;
 }
 
 export interface PulumiUpResult {
@@ -456,6 +468,7 @@ export type StackConfigInputs = Pick<
   | "wafAdaptiveProtection"
   | "iapAllowlist"
   | "imageDigests"
+  | "remoteMcpIdentity"
 > & { provider: "gcp" | "gcp-firebase" };
 
 /**
@@ -494,6 +507,13 @@ export async function applyStackConfig(
     // v0.3.2 — anthropicApiKey config dropped. Runtime path is
     // /settings/ai → ai_providers (KEK-encrypted).
     ...imageDigestConfig(provider, inputs.imageDigests),
+    ...(inputs.remoteMcpIdentity
+      ? {
+          [`${ns}:${REMOTE_MCP_IDENTITY_CONFIG}`]: {
+            value: serializeRemoteMcpIdentity(inputs.remoteMcpIdentity),
+          },
+        }
+      : {}),
   });
 
   // Read back only after the required keys are set: `pulumi config` refuses to

package/src/wizards/gcp.ts

@@ -105,10 +105,20 @@ import {
 } from "../provisioner-identity.js";
 import { revokePublicRoleMemberships } from "../public-role-isolation.js";
 import { decideRegion, detectCliRegion, installableRegions, suggestRegion } from "../regions.js";
-import { ensureRemoteMcpEdge, ensureRemoteMcpIdentityEnv } from "../remote-mcp.js";
+import {
+  checkRemoteMcpIdentityEnv,
+  ensureRemoteMcpEdge,
+  findRemoteMcpTarget,
+  type RemoteMcpTarget,
+  resolveStackRemoteMcpIdentity,
+} from "../remote-mcp.js";
 import type { RunMode } from "../run-mode.js";
 import { selfCommand } from "../self-command.js";
-import { ABSENT_DEFAULT_FIREWALL_RULES } from "../stack-contract.js";
+import {
+  ABSENT_DEFAULT_FIREWALL_RULES,
+  type RemoteMcpIdentity,
+  sameRemoteMcpIdentity,
+} from "../stack-contract.js";
 import {
   chooseInstallBackend,
   describeBackend,
@@ -120,7 +130,6 @@ import {
   resolveBackend,
 } from "../state-backend.js";
 import { acquireStateLock, GcsStateStore } from "../state-store.js";
-import { lookupFailure, resolveGcpResourceName } from "../upgrade/gcp-lookup.js";
 import { createReleaseImageForms, platformDigestsOf } from "../upgrade/image-forms.js";
 import {
   releaseVersionForDigest,
@@ -379,12 +388,22 @@ export async function runGcpConverge(opts: GcpConvergeOpts): Promise<void> {
   // post-cleanup re-runs both pass through cleanly).
   await stepDrainLegacyCaeloAdminUser(projectId, region);
 
+  // === 9.8. The remote-MCP identity the stack declares (#1082) ===
+  // The stack owns the identity env vars (stack-contract.ts
+  // RemoteMcpIdentity) and declares them from config the CLI resolves from
+  // the live services, so this `up` keeps what they carry. A fresh install
+  // has no services yet: the identity is resolved after the first `up` and
+  // applied by a second one below.
+  const identityBefore = deployed
+    ? await stepResolveRemoteMcpIdentity(projectId, region, provider, domain, "before")
+    : null;
+
   // === 10. Pulumi up via Automation SDK ===
   // Pre-built signed images live at the Caelo-team public AR repo
   // (caelo-website/caelo-cms-images by default). Cloud Run reads them
   // directly with no operator-side IAM binding — anonymous public pull.
   phase("Provisioning the infrastructure (pulumi up, 8-15 min)");
-  await stepPulumiUp(installId, {
+  const upOpts: PulumiUpOpts = {
     projectId,
     domain,
     // #650 — the wizard recorded it (or the install predates the setting).
@@ -406,9 +425,24 @@ export async function runGcpConverge(opts: GcpConvergeOpts): Promise<void> {
     // matching config namespace.
     provider,
     nonInteractive: opts.nonInteractive,
-  });
+  };
+  await stepPulumiUp(installId, { ...upOpts, remoteMcpIdentity: identityBefore?.identity ?? null });
   recordImageDigests(installId, imageDigests);
 
+  // === 10.05. The identity once the services exist (#1082) ===
+  // Read again after every `up`: on a fresh install (or one whose identity
+  // could not be read before) this is the first time it can be, and an `up`
+  // that replaced a service changed it. A second `up` then applies it
+  // through the stack — never through gcloud, which the next `up` would
+  // undo.
+  const identity = await stepResolveRemoteMcpIdentity(projectId, region, provider, domain, "after");
+  if (identity && !sameRemoteMcpIdentity(identity.identity, identityBefore?.identity ?? null)) {
+    log.info(
+      "Applying the remote-MCP URLs and IAP audience through the stack (second pulumi up)...",
+    );
+    await stepPulumiUp(installId, { ...upOpts, remoteMcpIdentity: identity.identity });
+  }
+
   // === 10.1. Remove the default network's pre-populated firewall rules ===
   // GCP creates them when Compute Engine is enabled (step 5). Run after
   // Pulumi rather than right after enabling the API: the default network
@@ -489,11 +523,9 @@ export async function runGcpConverge(opts: GcpConvergeOpts): Promise<void> {
     keepSigner ? [`serviceAccount:${upgraderServiceAccountEmail(projectId, GCP_STACK_ENV)}`] : [],
   );
 
-  // === 11.6. Remote MCP (#806): LB rules (gcp) + the identity env ===
-  // After `pulumi up` on every pass: the identity env names services Pulumi
-  // generated, so the stack cannot declare it, and an `up` that changed a
-  // service's template dropped it (remote-mcp.ts).
-  const remoteMcpReady = await stepRemoteMcp(projectId, region, provider, domain);
+  // === 11.6. Remote MCP (#806): LB rules (gcp) + a check of the identity env ===
+  // The env itself came with `pulumi up` (step 10.05, #1082).
+  const remoteMcpReady = await stepRemoteMcp(projectId, provider, domain, identity);
 
   // A fresh install ran every converge step above, so it is at this CLI's
   // infrastructure contract — recorded only when the upgrader and the
@@ -1166,74 +1198,104 @@ async function stepOperatorAccessSync(
   s.stop(green(`Operator-access sync job ready (${r.done.length} steps)`));
 }
 
+/** The install's identity for the stack, with the deployed services it was read from. */
+interface ResolvedRemoteMcpIdentity {
+  readonly target: RemoteMcpTarget;
+  readonly identity: RemoteMcpIdentity;
+}
+
 /**
- * #806 — the CLI's part of remote MCP (remote-mcp.ts): on `gcp` the load
- * balancer's discovery routes and Cloud Armor rule, on both providers the
- * env vars naming the admin URL, the broker's public URL and the IAP
- * audience. Remote MCP stays off until the Owner sets it up under Settings →
- * MCP, so a failure does not stop the install: it warns, and the next pass
- * or `upgrade` retries. Idempotent.
+ * #1082 — resolve the remote-MCP identity (remote-mcp.ts
+ * resolveStackRemoteMcpIdentity) for the stack config: the deployed
+ * services' names, then their URLs / the IAP backend and the organisation.
+ * Read-only. Not fatal: remote MCP stays off until the Owner sets it up, so
+ * a failure warns and the `up` keeps the identity the config last recorded.
  *
- * @returns whether every part is in place
+ * @param when `before` the `up` (the services exist), or `after` it
+ * @returns the identity, or null when it could not be read
  */
-async function stepRemoteMcp(
+async function stepResolveRemoteMcpIdentity(
   projectId: string,
   region: string,
   provider: "gcp" | "gcp-firebase",
   domain: string,
-): Promise<boolean> {
+  when: "before" | "after",
+): Promise<ResolvedRemoteMcpIdentity | null> {
   const s = spinner();
   s.start(
-    "Preparing remote MCP (ChatGPT / claude.ai connectors; off until the Owner enables it)...",
+    "Reading the remote-MCP URLs and IAP audience (Google sign-in, ChatGPT / claude.ai connectors)...",
   );
-  const name = (slug: "admin" | "gateway") =>
-    resolveGcpResourceName(
-      gcloud,
-      "run-service",
-      `caelo-${GCP_STACK_ENV}-${slug}`,
-      projectId,
-      region,
-    );
-  const [adminLookup, gatewayLookup] = [await name("admin"), await name("gateway")];
   const failed = (error: string) => {
-    s.stop(yellow(`Remote MCP not prepared: ${error}`));
+    s.stop(yellow(`Remote-MCP URLs not read: ${error}`));
     log.warn(
-      `The install works; Settings → Google sign-in and Settings → MCP report this install as not prepared until ${bold(selfCommand("upgrade"))} prepares it.`,
+      when === "before"
+        ? "pulumi up keeps the remote-MCP env the stack recorded last; the installer reads it again after the update."
+        : "The install works; Settings → Google sign-in and Settings → MCP report this install as not prepared until a re-run of the installer reads them.",
     );
-    return false;
+    return null;
   };
-  if (adminLookup.status !== "found") {
-    return failed(
-      lookupFailure(adminLookup, `caelo-${GCP_STACK_ENV}-admin* Cloud Run service`, "operator"),
-    );
-  }
-  if (gatewayLookup.status !== "found") {
-    return failed(
-      lookupFailure(gatewayLookup, `caelo-${GCP_STACK_ENV}-gateway* Cloud Run service`, "operator"),
-    );
-  }
-  const [admin, gateway] = [adminLookup.name, gatewayLookup.name];
-  const edge = await ensureRemoteMcpEdge({ provider, projectId, env: GCP_STACK_ENV, domain });
-  if (!edge.ok) return failed(edge.error);
-  const env = await ensureRemoteMcpIdentityEnv({
+  const found = await findRemoteMcpTarget({
     provider,
     projectId,
     region,
     env: GCP_STACK_ENV,
     domain,
-    services: { admin, gateway },
   });
-  if (!env.ok) return failed(env.error);
-  s.stop(green(`Remote MCP and Google sign-in prepared (${env.identity.mcpPublicUrl})`));
-  if (env.orgDomainError) {
+  if (!found.ok) return failed(found.error);
+  const { target } = found;
+  const resolved = await resolveStackRemoteMcpIdentity(target);
+  if (!resolved.ok) return failed(resolved.error);
+  s.stop(green(`Remote-MCP URLs read (${resolved.identity.mcpPublicUrl})`));
+  if (resolved.orgDomainError && when === "after") {
     // #914 — without the organisation's domain the admin cannot tell who
     // IAP's built-in sign-in admits, so it refuses new users until the
     // Owner sets up Google sign-in. Say so now rather than at the first
     // invite.
     log.warn(
-      `Could not read this project's Google organisation (${env.orgDomainError}). Set up Google sign-in under Settings → Google sign-in before adding users, or re-run ${bold(selfCommand("upgrade"))} as an account with the Organization Viewer role.`,
+      `Could not read this project's Google organisation (${resolved.orgDomainError}). Set up Google sign-in under Settings → Google sign-in before adding users, or re-run ${bold(selfCommand("upgrade"))} as an account with the Organization Viewer role.`,
     );
   }
+  return { target, identity: resolved.identity };
+}
+
+/**
+ * #806 — the CLI's part of remote MCP (remote-mcp.ts): on `gcp` the load
+ * balancer's discovery routes and Cloud Armor rule. The identity env vars
+ * (admin URL, the broker's public URL, the IAP audience) come with `pulumi
+ * up` from the stack config (#1082); this only checks that the services
+ * carry them. Remote MCP stays off until the Owner sets it up under
+ * Settings → MCP, so a failure does not stop the install: it warns, and the
+ * next pass or `upgrade` retries. Idempotent.
+ *
+ * @returns whether every part is in place
+ */
+async function stepRemoteMcp(
+  projectId: string,
+  provider: "gcp" | "gcp-firebase",
+  domain: string,
+  identity: ResolvedRemoteMcpIdentity | null,
+): Promise<boolean> {
+  const s = spinner();
+  s.start(
+    "Preparing remote MCP (ChatGPT / claude.ai connectors; off until the Owner enables it)...",
+  );
+  const failed = (error: string) => {
+    s.stop(yellow(`Remote MCP not prepared: ${error}`));
+    log.warn(
+      `The install works; Settings → Google sign-in and Settings → MCP report this install as not prepared until ${bold(selfCommand("upgrade"))} prepares it.`,
+    );
+    return false;
+  };
+  if (!identity) return failed("its URLs and IAP audience could not be read (see above)");
+  const edge = await ensureRemoteMcpEdge({ provider, projectId, env: GCP_STACK_ENV, domain });
+  if (!edge.ok) return failed(edge.error);
+  const check = await checkRemoteMcpIdentityEnv(identity.target, identity.identity);
+  if (!check.ok) return failed(check.error);
+  const missing = [...check.drift.admin, ...check.drift.gateway].map((c) => c.name);
+  if (missing.length > 0) {
+    return failed(`pulumi up left ${[...new Set(missing)].join(", ")} out of the services' env`);
+  }
+  s.stop(green(`Remote MCP and Google sign-in prepared (${identity.identity.mcpPublicUrl})`));
   return true;
 }
 
@@ -1481,6 +1543,8 @@ interface PulumiUpOpts {
   provider?: "gcp" | "gcp-firebase";
   /** No terminal to ask (the install job, `--non-interactive`): see planGate. */
   nonInteractive: boolean;
+  /** #1082 — the remote-MCP identity the stack declares (gcp-pulumi.ts PulumiUpInputs). */
+  remoteMcpIdentity?: RemoteMcpIdentity | null;
 }
 
 /**

package/stacks/gcp/index.ts

@@ -37,13 +37,16 @@ import {
   adminEnvContract,
   adminMediaVolume,
   adminMediaVolumeTemplate,
+  CLOUD_RUN_IGNORE_CHANGES,
   type CloudRunEnvVar,
   type CloudRunSlug,
   databaseUrls,
   defaultStagingHost,
   GATEWAY_TIMEOUT_SECONDS,
   gatewayEnvContract,
+  REMOTE_MCP_IDENTITY_CONFIG,
   type RuntimeSecret,
+  remoteMcpIdentityStackEnv,
   runtimeSecretBindings,
   STATIC_CDN_POLICY,
   secretFileVolumesTemplate,
@@ -685,6 +688,12 @@ const envContractInputs = {
   },
 } as const;
 
+// #1082 — the remote-MCP identity env (stack-contract.ts RemoteMcpIdentity):
+// names generated identities no resource here can take as input, so the CLI
+// resolves them from the live install and writes them as config before `up`.
+// Declared here so the stack is their one owner and `up` keeps them.
+const remoteMcpEnv = remoteMcpIdentityStackEnv(cfg.get(REMOTE_MCP_IDENTITY_CONFIG));
+
 function cloudRunService(args: CloudRunArgs): gcp.cloudrunv2.Service {
   return new gcp.cloudrunv2.Service(
     `${namePrefix}-${args.serviceName}`,
@@ -740,6 +749,8 @@ function cloudRunService(args: CloudRunArgs): gcp.cloudrunv2.Service {
     },
     {
       ...opts,
+      // #1082 — which tool deployed last; see CLOUD_RUN_IGNORE_CHANGES.
+      ignoreChanges: [...CLOUD_RUN_IGNORE_CHANGES],
       dependsOn: [
         pgAdminUser,
         cmsAdminDb,
@@ -771,7 +782,7 @@ const adminSvc = cloudRunService({
   // in Cloud Run logs. 3600s is the platform max; no cost penalty for
   // unused timeout (Cloud Run bills running time, not allocated time).
   timeout: "3600s",
-  contractEnv: adminEnvContract(envContractInputs),
+  contractEnv: [...adminEnvContract(envContractInputs), ...remoteMcpEnv.admin],
   mediaVolume: adminMediaVolumeTemplate(adminMediaVolume(project, env)),
 });
 const gatewaySvc = cloudRunService({
@@ -786,7 +797,7 @@ const gatewaySvc = cloudRunService({
   timeout: `${GATEWAY_TIMEOUT_SECONDS}s`,
   // public_role on cms_public only: no cms_admin login of any role
   // (#613, #635, CLAUDE.md §2).
-  contractEnv: gatewayEnvContract(envContractInputs),
+  contractEnv: [...gatewayEnvContract(envContractInputs), ...remoteMcpEnv.gateway],
 });
 
 // =========================================================================

package/stacks/gcp-firebase/index.ts

@@ -42,13 +42,16 @@ import {
   adminEnvContract,
   adminMediaVolume,
   adminMediaVolumeTemplate,
+  CLOUD_RUN_IGNORE_CHANGES,
   type CloudRunEnvVar,
   type CloudRunSlug,
   databaseUrls,
   defaultStagingHost,
   GATEWAY_TIMEOUT_SECONDS,
   gatewayEnvContract,
+  REMOTE_MCP_IDENTITY_CONFIG,
   type RuntimeSecret,
+  remoteMcpIdentityStackEnv,
   runtimeSecretBindings,
   secretFileVolumesTemplate,
 } from "../../dist/stack-contract.js";
@@ -552,6 +555,12 @@ function imageRef(service: string): string {
   return digest ? `${base}@${digest}` : `${base}:${cfg.get("image-tag") ?? "latest"}`;
 }
 
+// #1082 — the remote-MCP identity env (stack-contract.ts RemoteMcpIdentity):
+// names generated identities no resource here can take as input, so the CLI
+// resolves them from the live install and writes them as config before `up`.
+// Declared here so the stack is their one owner and `up` keeps them.
+const remoteMcpEnv = remoteMcpIdentityStackEnv(cfg.get(REMOTE_MCP_IDENTITY_CONFIG));
+
 function cloudRunService(args: CloudRunArgs): gcp.cloudrunv2.Service {
   return new gcp.cloudrunv2.Service(
     `${namePrefix}-${args.serviceName}`,
@@ -600,6 +609,8 @@ function cloudRunService(args: CloudRunArgs): gcp.cloudrunv2.Service {
     },
     {
       ...opts,
+      // #1082 — which tool deployed last; see CLOUD_RUN_IGNORE_CHANGES.
+      ignoreChanges: [...CLOUD_RUN_IGNORE_CHANGES],
       dependsOn: [
         pgAdminUser,
         cmsAdminDb,
@@ -654,7 +665,7 @@ const gatewaySvc = cloudRunService({
   // request passes its rate limits, captcha and honeypot; staging requests
   // pass the staging access gate.
   ingress: "INGRESS_TRAFFIC_ALL",
-  contractEnv: gatewayEnvContract(envContractInputs),
+  contractEnv: [...gatewayEnvContract(envContractInputs), ...remoteMcpEnv.gateway],
 });
 
 const adminSvc = cloudRunService({
@@ -670,11 +681,14 @@ const adminSvc = cloudRunService({
   // Use the input string (known at config time) for the site — the
   // resource output is Output<string | undefined>, which Input<string>
   // rejects.
-  contractEnv: adminEnvContract({
-    ...envContractInputs,
-    firebaseSiteId,
-    gatewayService: gatewaySvc.name,
-  }),
+  contractEnv: [
+    ...adminEnvContract({
+      ...envContractInputs,
+      firebaseSiteId,
+      gatewayService: gatewaySvc.name,
+    }),
+    ...remoteMcpEnv.admin,
+  ],
   mediaVolume: adminMediaVolumeTemplate(adminMediaVolume(project, env)),
 });