@caelo-cms/provisioning 0.11.10 → 0.11.11

package/src/infra-contract.test.ts

@@ -20,8 +20,8 @@ describe("infrastructure contract steps", () => {
     );
   });
 
-  it("is at 16: public_role revoke (3), URL-map redirects role (4), no gateway cms_admin login (5), ops-bucket list (6), gateway proxy hops (7), quality-audit job (8), converge job (9), remote MCP (10), Google sign-in (11), project-level sign-in client (12), edge security headers (13), capture job (14), database verify-full TLS (15), MCP-Auth-Proxy (16)", () => {
-    expect(INFRA_CONTRACT_VERSION).toBe(16);
+  it("is at 18: public_role revoke (3), URL-map redirects role (4), no gateway cms_admin login (5), ops-bucket list (6), gateway proxy hops (7), quality-audit job (8), converge job (9), remote MCP (10), Google sign-in (11), project-level sign-in client (12), edge security headers (13), capture job (14), database verify-full TLS (15), MCP-Auth-Proxy (16), staging database (17), scheduler tick (18)", () => {
+    expect(INFRA_CONTRACT_VERSION).toBe(18);
     expect(INFRA_CONTRACT_STEPS[3]).toContain("#633");
     expect(INFRA_CONTRACT_STEPS[4]).toContain("#587");
     expect(INFRA_CONTRACT_STEPS[5]).toContain("#635");
@@ -36,6 +36,8 @@ describe("infrastructure contract steps", () => {
     expect(INFRA_CONTRACT_STEPS[14]).toContain("#1217");
     expect(INFRA_CONTRACT_STEPS[15]).toContain("#1338");
     expect(INFRA_CONTRACT_STEPS[16]).toContain("#1328");
+    expect(INFRA_CONTRACT_STEPS[17]).toContain("#1329");
+    expect(INFRA_CONTRACT_STEPS[18]).toContain("#1140");
   });
 
   it("lists the pending steps oldest first", () => {
@@ -46,6 +48,6 @@ describe("infrastructure contract steps", () => {
   });
 
   it("names a version a newer release added by number", () => {
-    expect(infraStepsText(16, 17)).toBe("infrastructure step 17 (see that release's notes)");
+    expect(infraStepsText(18, 19)).toBe("infrastructure step 19 (see that release's notes)");
   });
 });

package/src/infra-contract.ts

@@ -22,7 +22,7 @@
  * whose app-roll references infrastructure an install does not have yet fails
  * at roll time, after migrations ran.
  */
-export const INFRA_CONTRACT_VERSION = 16;
+export const INFRA_CONTRACT_VERSION = 18;
 
 // History (why each bump happened — an install below a number needs the
 // converge that introduced it):
@@ -131,6 +131,25 @@ export const INFRA_CONTRACT_VERSION = 16;
 //       services, accounts, IAM and load-balancer resources — none of which
 //       the in-cloud upgrader may create, and the app-roll rolls three
 //       services from now on.
+//  17 — #1329: staging's own database. The Cloud SQL database
+//       `cms_public_staging`, the Admin API user `public_staging_role` (its
+//       password the new CLI-generated secret `public-staging-role-password`)
+//       and its membership revoke; the admin's PUBLIC_STAGING_ADMIN_DATABASE_URL
+//       and the gateway's CAELO_GATEWAY_ENVIRONMENT. The in-cloud upgrader
+//       may create no database, user or secret, and the new admin and
+//       gateway refuse to start without them. Additive only (converge
+//       release 1 of the gateway hardening): nothing is served from the
+//       staging database yet, so rolling back stays harmless.
+//  18 — #1140: the scheduler tick (scheduler-setup.ts). Its service account
+//       (token creator on itself, workflows.invoker, logWriter, IAP access to
+//       the admin), the Cloud Workflows workflow that signs its IAP JWT and
+//       calls the admin's /api/internal/scheduler/tick, the one Cloud
+//       Scheduler job that starts it every schedulerIntervalMinutes, the
+//       operator-access job's CAELO_OPERATOR_ACCESS_IAP_SERVICE_ACCOUNTS (so
+//       its sync keeps the account on IAP) and CAELO_SCHEDULER_SERVICE_ACCOUNT
+//       on the admin. The new admin runs its periodic work and plugin workers
+//       only on that tick, so an in-cloud upgrader must not roll an install
+//       onto it before the tick exists.
 
 /**
  * What each contract version adds, in operator terms — the upgrader's
@@ -154,6 +173,8 @@ export const INFRA_CONTRACT_STEPS: Readonly<Record<number, string>> = {
   14: "the capture job that takes server-side screenshots outside the admin, its service account, bucket and grants (#1217)",
   15: "verified TLS to the database: Cloud SQL's shared server CA, encrypted connections only, and a private DNS name the services dial (#1338)",
   16: "the MCP sign-in service as its own Cloud Run service with its own account (no database access), the visitor gateway as its own service on Firebase installs, and on Google Cloud load-balancer installs the sign-in service's backend and Cloud Armor rule (#1328)",
+  17: "the staging site's own database and its gateway login, kept apart from the live data (#1329)",
+  18: "the scheduler tick that runs the admin's periodic work and plugin workers every few minutes: its service account, workflow and Cloud Scheduler job, and its IAP access (#1140)",
 };
 
 /**

package/src/install-job.ts

@@ -65,13 +65,16 @@ export const OPS_IMAGE_REPOSITORY =
  * Roles the provisioner needs on top of {@link PROVISIONER_ROLE_LIST} when it
  * runs the install job instead of the operator: the operator-access sync job
  * creates a project custom role and a Cloud Scheduler job (operator-access.ts),
- * and the job's own output has to reach Cloud Logging so the terminal can
+ * the scheduler tick deploys a Cloud Workflows workflow (scheduler-setup.ts,
+ * #1140; the converge job gets the same roles, converge-job-setup.ts), and
+ * the job's own output has to reach Cloud Logging so the terminal can
  * tail it. Granted only to installs that use the job. Not an escalation: the
  * provisioner already holds `resourcemanager.projectIamAdmin`.
  */
 export const INSTALL_JOB_ROLES = [
   "roles/iam.roleAdmin",
   "roles/cloudscheduler.admin",
+  "roles/workflows.editor",
   "roles/logging.logWriter",
 ] as const;
 

package/src/install-state.ts

@@ -115,6 +115,13 @@ export interface InstallMetadata {
    * run while it is lower than the release's (upgrade/converge.ts).
    */
   infraContractVersion?: number;
+  /**
+   * #1140 — the `schedulerIntervalMinutes` knob: how often the one Cloud
+   * Scheduler job calls the admin's tick (1–15 minutes; `--scheduler-
+   * interval-minutes` on the wizard). Absent: the default (5,
+   * stack-contract.ts SCHEDULER_INTERVAL_MINUTES).
+   */
+  schedulerIntervalMinutes?: number;
 }
 
 /** The install's staging host: its recorded setting, else the default. */

package/src/lifecycle.ts

@@ -641,6 +641,9 @@ async function upgradeLockedInstall(
       domain: meta.domain,
       stagingHost,
       ownerEmail: meta.ownerEmail,
+      ...(meta.schedulerIntervalMinutes !== undefined
+        ? { schedulerIntervalMinutes: meta.schedulerIntervalMinutes }
+        : {}),
       targetTag,
       infraContractVersion: INFRA_CONTRACT_VERSION,
       skipVerify: opts.skipVerify === true,

package/src/migration-runner.ts

@@ -24,6 +24,7 @@ import { green, red } from "kleur/colors";
 import { gcloud as defaultGcloud } from "./gcloud.js";
 import type { GcloudRunner } from "./gcloud-retry.js";
 import { GCP_STACK_ENV, gcpSecretId, runServiceAccountEmail } from "./gcp-names.js";
+import { MIGRATION_TARGETS } from "./migration-targets.js";
 import { databaseUrls, SERVICE_SECRET_ENV } from "./stack-contract.js";
 import { liveContainerEnv, liveDatabaseHost } from "./stack-converge.js";
 
@@ -58,15 +59,19 @@ const NEEDS_UPGRADE =
  */
 export function migrationJobEnvArgs(databaseHost: string, env = GCP_STACK_ENV): string[] {
   const urls = databaseUrls(databaseHost);
-  const passwords = (["ADMIN_DATABASE_PASSWORD", "PUBLIC_ADMIN_DATABASE_PASSWORD"] as const).map(
-    (name) => {
-      const secret = SERVICE_SECRET_ENV.admin[name];
-      if (!secret) throw new Error(`the admin env contract has no ${name}`);
-      return `${name}=${gcpSecretId(env, secret)}:latest`;
-    },
-  );
+  const passwords = (
+    [
+      "ADMIN_DATABASE_PASSWORD",
+      "PUBLIC_ADMIN_DATABASE_PASSWORD",
+      "PUBLIC_STAGING_ADMIN_DATABASE_PASSWORD",
+    ] as const
+  ).map((name) => {
+    const secret = SERVICE_SECRET_ENV.admin[name];
+    if (!secret) throw new Error(`the admin env contract has no ${name}`);
+    return `${name}=${gcpSecretId(env, secret)}:latest`;
+  });
   return [
-    `--set-env-vars=ADMIN_DATABASE_URL=${urls.admin},PUBLIC_ADMIN_DATABASE_URL=${urls.publicAdmin}`,
+    `--set-env-vars=ADMIN_DATABASE_URL=${urls.admin},PUBLIC_ADMIN_DATABASE_URL=${urls.publicAdmin},PUBLIC_STAGING_ADMIN_DATABASE_URL=${urls.publicStagingAdmin}`,
     `--set-secrets=${passwords.join(",")}`,
   ];
 }
@@ -300,7 +305,7 @@ export async function runMigrationsViaCloudRunJob(
     sAdmin.stop(green(`Admin config resolved (${migrationImage.slice(-19)})`));
   }
 
-  for (const target of ["admin", "public"] as const) {
+  for (const target of MIGRATION_TARGETS) {
     const s = spinner();
     s.start(`Applying ${target} migrations via one-shot Cloud Run Job...`);
     // Delete-then-create so each invocation runs with the freshest

package/src/migration-targets.ts

@@ -0,0 +1,12 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * The targets of `packages/migrations/src/migrate.ts`, in the order every
+ * runner applies them — the GCP migration job (migration-runner.ts), the
+ * self-hosted install and upgrade (self-hosted-start.ts,
+ * self-hosted-upgrade.ts) and the self-hosted stack: cms_admin first (its
+ * role audit covers the whole cluster), then the two public databases,
+ * which run the same cms_public files (#1329: cms_public_staging is the
+ * staging site's twin, with its own gateway login).
+ */
+export const MIGRATION_TARGETS = ["admin", "public", "public-staging"] as const;

package/src/operator-access.test.ts

@@ -205,6 +205,21 @@ describe("ensureOperatorAccessSync", () => {
     );
   });
 
+  it("#1140 — tells the job which service accounts keep IAP access (the scheduler tick)", async () => {
+    const { run, calls } = freshInstall();
+    await ensureOperatorAccessSync(
+      { ...target, iapServiceAccounts: ["caelo-production-scheduler@p.iam.gserviceaccount.com"] },
+      { run, sleep: async () => {} },
+    );
+    const deploy = calls.find((c) => c.slice(0, 3).join(" ") === "run jobs deploy") ?? [];
+    const env = deploy.find((a) => a.startsWith("--set-env-vars=")) ?? "";
+    expect(env).toContain(
+      "|CAELO_OPERATOR_ACCESS_IAP_SERVICE_ACCOUNTS=caelo-production-scheduler@p.iam.gserviceaccount.com",
+    );
+    // The static members stay the install's allowlist (converge-job-gcp.ts compares them).
+    expect(env).toContain("|CAELO_OPERATOR_ACCESS_STATIC_MEMBERS=user:owner@x.com|");
+  });
+
   it("#914 — lets the job read exactly the Google sign-in client's secret, nothing else", async () => {
     const { run, lines } = freshInstall();
     await ensureOperatorAccessSync(target, { run, sleep: async () => {} });

package/src/operator-access.ts

@@ -218,11 +218,22 @@ export interface OperatorAccessSyncTarget {
    * The job reconciles that binding, so anyone missing here loses it.
    */
   readonly mcpSigners?: readonly string[];
+  /**
+   * #1140 — service accounts (besides caelo-mcp) that keep
+   * `roles/iap.httpsResourceAccessor` on the admin: the scheduler tick's
+   * account (scheduler-setup.ts) calls the admin through IAP. The job
+   * reconciles that binding to exactly its members, so anyone missing here
+   * loses it on the next run. Emails, not `serviceAccount:` members.
+   */
+  readonly iapServiceAccounts?: readonly string[];
 }
 
 /** Env var of the sync job listing {@link OperatorAccessSyncTarget.mcpSigners}. */
 export const MCP_SIGNERS_ENV = "CAELO_OPERATOR_ACCESS_MCP_SIGNERS";
 
+/** #1140 — env var of the sync job listing {@link OperatorAccessSyncTarget.iapServiceAccounts}. */
+export const IAP_SERVICE_ACCOUNTS_ENV = "CAELO_OPERATOR_ACCESS_IAP_SERVICE_ACCOUNTS";
+
 /** #914 — env var of the sync job naming the Google sign-in client's secret. */
 export const OPERATOR_OAUTH_CLIENT_SECRET_ENV = "CAELO_OPERATOR_OAUTH_CLIENT_SECRET";
 
@@ -424,6 +435,9 @@ export async function ensureOperatorAccessSync(
     ...(target.mcpSigners && target.mcpSigners.length > 0
       ? [`${MCP_SIGNERS_ENV}=${target.mcpSigners.join(",")}`]
       : []),
+    ...(target.iapServiceAccounts && target.iapServiceAccounts.length > 0
+      ? [`${IAP_SERVICE_ACCOUNTS_ENV}=${target.iapServiceAccounts.join(",")}`]
+      : []),
   ];
   const deploy = await run([
     "run",

package/src/pool-budget-stack.ts

@@ -14,11 +14,14 @@
 
 import {
   computePoolBudget,
+  DEFAULT_STAGING_GATEWAY_MAX_INSTANCES,
   type PoolBudget,
   type PoolBudgetInput,
   poolBudgetEnv,
 } from "@caelo-cms/shared";
 
+export { DEFAULT_STAGING_GATEWAY_MAX_INSTANCES };
+
 /** The adapters that provision a Postgres server. */
 export type BudgetProvider = "gcp" | "gcp-firebase" | "aws" | "azure" | "self-hosted";
 
@@ -84,12 +87,24 @@ export const DEFAULT_MAX_CONNECTIONS: Readonly<Record<BudgetProvider, number>> =
  */
 export const DEFAULT_GATEWAY_MAX_INSTANCES = 10;
 
+/**
+ * Admin instances a GCP or AWS stack lets start (`adminMaxInstances` knob).
+ * Five before #1329; the staging database added the admin's
+ * cms_public_staging pool and the staging gateway to the budget, and on the
+ * default server (100 connections) five instances no longer get the
+ * minimum cms_admin pool. Raising `max_connections` instead was ruled out
+ * for db-f1-micro (docs/dev/connection-budget.md, "#1329").
+ */
+export const DEFAULT_ADMIN_MAX_INSTANCES = 4;
+
 /** The server and scale-out a stack sizes its pools for. */
 export interface StackScale {
   readonly maxConnections: number;
   /** Every instance that opens the admin's pools (admin-side services included). */
   readonly adminMaxInstances: number;
   readonly gatewayMaxInstances: number;
+  /** #1329 — the staging gateway's scale-out ({@link DEFAULT_STAGING_GATEWAY_MAX_INSTANCES}). */
+  readonly stagingGatewayMaxInstances: number;
 }
 
 /** A stack's budget plus the env each service sets from it. */

package/src/pool-budget-stacks.test.ts

@@ -12,8 +12,10 @@ import { resolve } from "node:path";
 import { COMPOSE_POOL_BUDGET } from "./compose.js";
 import {
   type BudgetProvider,
+  DEFAULT_ADMIN_MAX_INSTANCES,
   DEFAULT_GATEWAY_MAX_INSTANCES,
   DEFAULT_MAX_CONNECTIONS,
+  DEFAULT_STAGING_GATEWAY_MAX_INSTANCES,
   stackPoolBudget,
 } from "./pool-budget-stack.js";
 
@@ -21,22 +23,39 @@ const stackSource = (provider: string): string =>
   readFileSync(resolve(import.meta.dir, "..", "stacks", provider, "index.ts"), "utf8");
 
 /** Each stack's default scale-out, as its index.ts reads it. */
-const DEFAULT_SCALE: Record<BudgetProvider, { admin: number; gateway: number }> = {
-  gcp: { admin: 5, gateway: DEFAULT_GATEWAY_MAX_INSTANCES },
-  "gcp-firebase": { admin: 5, gateway: DEFAULT_GATEWAY_MAX_INSTANCES },
-  aws: { admin: 5, gateway: DEFAULT_GATEWAY_MAX_INSTANCES },
+const DEFAULT_SCALE: Record<BudgetProvider, { admin: number; gateway: number; staging: number }> = {
+  gcp: {
+    admin: DEFAULT_ADMIN_MAX_INSTANCES,
+    gateway: DEFAULT_GATEWAY_MAX_INSTANCES,
+    staging: DEFAULT_STAGING_GATEWAY_MAX_INSTANCES,
+  },
+  "gcp-firebase": {
+    admin: DEFAULT_ADMIN_MAX_INSTANCES,
+    gateway: DEFAULT_GATEWAY_MAX_INSTANCES,
+    staging: DEFAULT_STAGING_GATEWAY_MAX_INSTANCES,
+  },
+  aws: {
+    admin: DEFAULT_ADMIN_MAX_INSTANCES,
+    gateway: DEFAULT_GATEWAY_MAX_INSTANCES,
+    staging: DEFAULT_STAGING_GATEWAY_MAX_INSTANCES,
+  },
   // admin + orchestrator + runner apps, 10 replicas each.
-  azure: { admin: 30, gateway: 10 },
-  "self-hosted": { admin: 1, gateway: 1 },
+  azure: { admin: 30, gateway: 10, staging: DEFAULT_STAGING_GATEWAY_MAX_INSTANCES },
+  "self-hosted": { admin: 1, gateway: 1, staging: 1 },
 };
 
-/** [cms_admin pool per admin instance, connections left unassigned]. */
+/**
+ * [cms_admin pool per admin instance, connections left unassigned]. #1329
+ * added the staging gateway and the admin's cms_public_staging pool; the
+ * GCP and AWS stacks start four admin instances instead of five so the
+ * cms_admin pool stays at five (docs/dev/connection-budget.md).
+ */
 const EXPECTED: Record<BudgetProvider, [number, number]> = {
-  gcp: [5, 1],
-  "gcp-firebase": [5, 1],
-  aws: [5, 3],
-  azure: [7, 12],
-  "self-hosted": [77, 0],
+  gcp: [5, 0],
+  "gcp-firebase": [5, 0],
+  aws: [5, 2],
+  azure: [5, 9],
+  "self-hosted": [72, 0],
 };
 
 describe("stack pool budgets at the default config", () => {
@@ -46,7 +65,10 @@ describe("stack pool budgets at the default config", () => {
         maxConnections: DEFAULT_MAX_CONNECTIONS[provider],
         adminMaxInstances: DEFAULT_SCALE[provider].admin,
         gatewayMaxInstances: DEFAULT_SCALE[provider].gateway,
+        stagingGatewayMaxInstances: DEFAULT_SCALE[provider].staging,
       });
+      expect(budget.reserves.map((r) => r.name)).toContain("staging-gateway");
+      expect(budget.reserves.map((r) => r.name)).toContain("admin-public-staging");
       expect([budget.adminPoolMax, budget.unassigned]).toEqual(EXPECTED[provider]);
       expect(env.admin).toEqual([
         { name: "CAELO_DB_POOL_MAX", value: String(EXPECTED[provider][0]) },
@@ -60,8 +82,9 @@ describe("stack pool budgets at the default config", () => {
     expect(() =>
       stackPoolBudget("gcp", {
         maxConnections: 100,
-        adminMaxInstances: 5,
+        adminMaxInstances: 4,
         gatewayMaxInstances: 100,
+        stagingGatewayMaxInstances: 1,
       }),
     ).toThrow(/CONNECTION LIMIT, #1338/);
   });
@@ -75,6 +98,8 @@ describe("stacks set the budget on their services", () => {
       expect(src).toContain("...poolBudget.env.admin");
       expect(src).toContain("...poolBudget.env.gateway");
       expect(src).toContain("maxInstances: gatewayMaxInstances");
+      expect(src).toContain("stagingGatewayMaxInstances: DEFAULT_STAGING_GATEWAY_MAX_INSTANCES");
+      expect(src).toContain('cfg.get("adminMaxInstances") ?? String(DEFAULT_ADMIN_MAX_INSTANCES)');
       expect(src).not.toContain("maxInstances: 100");
     });
   }

package/src/public-role-isolation.test.ts

@@ -25,7 +25,11 @@ function fake(answers: (line: string) => GcloudResult) {
 describe("revokePublicRoleMembershipsArgs (#633)", () => {
   it("revokes every database role of the built-in public_role user", () => {
     expect(
-      revokePublicRoleMembershipsArgs({ projectId: "acme", sqlInstance: "caelo-production-pg-1" }),
+      revokePublicRoleMembershipsArgs({
+        projectId: "acme",
+        sqlInstance: "caelo-production-pg-1",
+        role: "public_role",
+      }),
     ).toEqual([
       "sql",
       "users",
@@ -40,7 +44,12 @@ describe("revokePublicRoleMembershipsArgs (#633)", () => {
   });
 
   it("grants nothing in exchange (no --database-roles)", () => {
-    const args = revokePublicRoleMembershipsArgs({ projectId: "p", sqlInstance: "i" });
+    const args = revokePublicRoleMembershipsArgs({
+      projectId: "p",
+      sqlInstance: "i",
+      role: "public_staging_role",
+    });
+    expect(args[3]).toBe("public_staging_role");
     expect(args.some((a) => a.startsWith("--database-roles"))).toBe(false);
   });
 });
@@ -48,17 +57,18 @@ describe("revokePublicRoleMembershipsArgs (#633)", () => {
 describe("revokePublicRoleMemberships", () => {
   const install = { projectId: "acme", env: "production", credentials: "operator" } as const;
 
-  it("finds the instance, then revokes", async () => {
+  it("finds the instance, then revokes for both gateway logins (#1329)", async () => {
     const { run, calls } = fake((l) => (l.startsWith("sql instances list") ? ok("pg-1\n") : ok()));
     const r = await revokePublicRoleMemberships(install, { run, sleep: noSleep });
     expect(r).toEqual({
-      id: "public_role database role memberships",
+      id: "gateway logins' database role memberships",
       status: "applied",
-      detail: "no database roles left on pg-1",
+      detail: "public_role and public_staging_role hold no database roles on pg-1",
     });
-    expect(calls[1]).toBe(
+    expect(calls.slice(1)).toEqual([
       "sql users assign-roles public_role --instance=pg-1 --type=BUILT_IN --revoke-existing-roles --project=acme --quiet",
-    );
+      "sql users assign-roles public_staging_role --instance=pg-1 --type=BUILT_IN --revoke-existing-roles --project=acme --quiet",
+    ]);
   });
 
   it("is idempotent: a second run issues the same revoke and succeeds", async () => {
@@ -66,7 +76,7 @@ describe("revokePublicRoleMemberships", () => {
     await revokePublicRoleMemberships(install, { run, sleep: noSleep });
     const again = await revokePublicRoleMemberships(install, { run, sleep: noSleep });
     expect(again.status).toBe("applied");
-    expect(calls[1]).toBe(calls[3] as string);
+    expect(calls.slice(4)).toEqual(calls.slice(1, 3));
   });
 
   it("fails without an instance and never calls the revoke", async () => {

package/src/public-role-isolation.ts

@@ -28,6 +28,9 @@
  * `public_role` is still a member of any role. This step therefore runs
  * BEFORE migrations, on every install pass and every `upgrade`. Idempotent:
  * revoking from a role that has none changes nothing.
+ *
+ * Since #1329 the staging gateway's login `public_staging_role` is an
+ * Admin API user too and gets the same revoke.
  */
 
 import { findSqlInstance } from "./gateway-credentials.js";
@@ -36,16 +39,20 @@ import { type GcloudRunner, realSleep, runWithRetry, type Sleep } from "./gcloud
 import type { EnsureOutcome } from "./runtime-secrets.js";
 import { type GcloudCredentials, lookupFailure } from "./upgrade/gcp-lookup.js";
 
-/** The gcloud call that leaves `public_role` with no database roles. */
+/** The gateway logins the Admin API created, which must hold no database role (#633, #1329). */
+export const GATEWAY_DATABASE_LOGINS = ["public_role", "public_staging_role"] as const;
+
+/** The gcloud call that leaves a gateway login with no database roles. */
 export function revokePublicRoleMembershipsArgs(target: {
   readonly projectId: string;
   readonly sqlInstance: string;
+  readonly role: (typeof GATEWAY_DATABASE_LOGINS)[number];
 }): string[] {
   return [
     "sql",
     "users",
     "assign-roles",
-    "public_role",
+    target.role,
     `--instance=${target.sqlInstance}`,
     "--type=BUILT_IN",
     "--revoke-existing-roles",
@@ -55,8 +62,9 @@ export function revokePublicRoleMembershipsArgs(target: {
 }
 
 /**
- * Revoke every database role the Admin API gave `public_role`. Reports
- * instead of throwing; `failed` names the next step.
+ * Revoke every database role the Admin API gave the gateway logins
+ * ({@link GATEWAY_DATABASE_LOGINS}). Reports instead of throwing; `failed`
+ * names the next step.
  */
 export async function revokePublicRoleMemberships(
   install: {
@@ -67,7 +75,7 @@ export async function revokePublicRoleMemberships(
   deps: { readonly run?: GcloudRunner; readonly sleep?: Sleep } = {},
 ): Promise<EnsureOutcome> {
   const run = deps.run ?? defaultGcloud;
-  const id = "public_role database role memberships";
+  const id = "gateway logins' database role memberships";
   const lookup = await findSqlInstance(install, { run });
   if (lookup.status !== "found") {
     return {
@@ -77,17 +85,23 @@ export async function revokePublicRoleMemberships(
     };
   }
   const sqlInstance = lookup.name;
-  const r = await runWithRetry(
-    run,
-    deps.sleep ?? realSleep,
-    revokePublicRoleMembershipsArgs({ projectId: install.projectId, sqlInstance }),
-  );
-  if (!r.ok) {
-    return {
-      id,
-      status: "failed",
-      error: `gcloud sql users assign-roles public_role --revoke-existing-roles on ${sqlInstance}: ${r.stderr.trim()}. The account running this needs cloudsql.users.update on the project; re-run once it has.`,
-    };
+  for (const role of GATEWAY_DATABASE_LOGINS) {
+    const r = await runWithRetry(
+      run,
+      deps.sleep ?? realSleep,
+      revokePublicRoleMembershipsArgs({ projectId: install.projectId, sqlInstance, role }),
+    );
+    if (!r.ok) {
+      return {
+        id,
+        status: "failed",
+        error: `gcloud sql users assign-roles ${role} --revoke-existing-roles on ${sqlInstance}: ${r.stderr.trim()}. The account running this needs cloudsql.users.update on the project; re-run once it has.`,
+      };
+    }
   }
-  return { id, status: "applied", detail: `no database roles left on ${sqlInstance}` };
+  return {
+    id,
+    status: "applied",
+    detail: `${GATEWAY_DATABASE_LOGINS.join(" and ")} hold no database roles on ${sqlInstance}`,
+  };
 }

package/src/release-contract.ts

@@ -55,6 +55,9 @@ export const INFRA_CONTRACT_PATHS: readonly string[] = [
   "packages/provisioning/src/audit-job-setup.ts",
   // #1217 — the capture job, its service account, bucket and grants.
   "packages/provisioning/src/capture-job-setup.ts",
+  // #1140 — the scheduler tick: its service account, workflow, Cloud
+  // Scheduler job and grants.
+  "packages/provisioning/src/scheduler-setup.ts",
   // #819 — the converge job, its database login and the admin's grant on it.
   "packages/provisioning/src/converge-job-setup.ts",
   // #891 — the edge security headers the stacks attach, and the converge's

package/src/runtime-secrets.test.ts

@@ -115,7 +115,7 @@ describe("ensureGeneratedSecrets", () => {
       { ...secretsInstall, replication: regional },
       { run },
     );
-    expect(outcomes.map((o) => o.status)).toEqual(Array(6).fill("present"));
+    expect(outcomes.map((o) => o.status)).toEqual(Array(7).fill("present"));
     expect(lines().some((l) => l.includes(" create ") || l.includes(" add "))).toBe(false);
   });
 
@@ -126,7 +126,7 @@ describe("ensureGeneratedSecrets", () => {
       { ...secretsInstall, replication: regional },
       { run, generate: () => `generated-value-${++n}` },
     );
-    expect(outcomes.map((o) => o.status)).toEqual(Array(6).fill("applied"));
+    expect(outcomes.map((o) => o.status)).toEqual(Array(7).fill("applied"));
     const creates = calls.filter((c) => c.line.startsWith("secrets create"));
     // #806 — the seal key is 32 random bytes in base64 (not the injected hex generator).
     const sealKey = creates.find((c) => c.line.includes("mcp-oauth-seal-key"))?.stdin ?? "";
@@ -145,10 +145,15 @@ describe("ensureGeneratedSecrets", () => {
         line: "secrets create caelo-production-public-role-password --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
         stdin: "generated-value-3",
       },
+      // #1329 — the staging gateway's role password: its own, never the live one's.
+      {
+        line: "secrets create caelo-production-public-staging-role-password --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
+        stdin: "generated-value-4",
+      },
       // #650 — the staging access gate's key.
       {
         line: "secrets create caelo-production-staging-gate-secret --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
-        stdin: "generated-value-4",
+        stdin: "generated-value-5",
       },
       // #806 — remote MCP's OAuth client starts as the "not configured"
       // placeholder; the Owner writes the real one from Settings → MCP.
@@ -178,11 +183,12 @@ describe("ensureGeneratedSecrets", () => {
       { run, generate: () => "generated" },
     );
     const creates = calls.filter((c) => c.line.startsWith("secrets create"));
-    expect(creates.map((c) => c.stdin).slice(0, 5)).toEqual([
+    expect(creates.map((c) => c.stdin).slice(0, 6)).toEqual([
       "operator-set",
       "generated",
       "generated",
       "generated",
+      "generated",
       "{}",
     ]);
     for (const c of calls) expect(c.line).not.toContain("operator-set");
@@ -194,6 +200,7 @@ describe("ensureGeneratedSecrets", () => {
       "secrets versions list caelo-production-internal-secret": [ok("")],
       "secrets versions list caelo-production-tool-approval-secret": [ok("v/1")],
       "secrets versions list caelo-production-public-role-password": [ok("v/1")],
+      "secrets versions list caelo-production-public-staging-role-password": [ok("v/1")],
       "secrets versions list caelo-production-staging-gate-secret": [ok("v/1")],
       "secrets versions list caelo-production-operator-oauth-client": [ok("v/1")],
       "secrets versions list caelo-production-mcp-oauth-seal-key": [ok("v/1")],
@@ -209,6 +216,7 @@ describe("ensureGeneratedSecrets", () => {
       "present",
       "present",
       "present",
+      "present",
     ]);
     expect(calls.filter((c) => c.line.startsWith("secrets versions add"))).toEqual([
       {
@@ -243,7 +251,7 @@ describe("ensureGeneratedSecrets", () => {
       { ...secretsInstall, replication: { kind: "automatic" } },
       { run, generate: () => "v" },
     );
-    expect(outcomes.map((o) => o.status)).toEqual(Array(6).fill("applied"));
+    expect(outcomes.map((o) => o.status)).toEqual(Array(7).fill("applied"));
     expect(outcomes.every((o) => o.detail?.includes("gcp.resourceLocations"))).toBe(true);
     const creates = lines().filter((l) => l.startsWith("secrets create"));
     // One refused automatic attempt; then every secret — the refused one
@@ -253,6 +261,7 @@ describe("ensureGeneratedSecrets", () => {
       "secrets create caelo-production-internal-secret --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
       "secrets create caelo-production-tool-approval-secret --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
       "secrets create caelo-production-public-role-password --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
+      "secrets create caelo-production-public-staging-role-password --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
       // #652 — the staging gate's key follows the same path.
       "secrets create caelo-production-staging-gate-secret --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
       "secrets create caelo-production-operator-oauth-client --project=acme --replication-policy=user-managed --locations=europe-west1 --data-file=- --quiet",
@@ -284,7 +293,7 @@ describe("ensureGeneratedSecrets", () => {
       { run, generate: () => "v" },
     );
     expect(outcomes.every((o) => o.status === "failed")).toBe(true);
-    expect(lines().filter((l) => l.startsWith("secrets create"))).toHaveLength(6);
+    expect(lines().filter((l) => l.startsWith("secrets create"))).toHaveLength(7);
   });
 });
 
@@ -329,6 +338,7 @@ describe("rotateRuntimeSecret", () => {
       service([
         ref("ADMIN_DATABASE_PASSWORD", "postgres-password"),
         ref("PUBLIC_ADMIN_DATABASE_PASSWORD", "postgres-password"),
+        ref("PUBLIC_STAGING_ADMIN_DATABASE_PASSWORD", "postgres-password"),
         ref("CAELO_SECRET_KEK", "secret-kek"),
         ref("CAELO_INTERNAL_SECRET", "internal-secret"),
         ref("CAELO_TOOL_APPROVAL_SECRET", "tool-approval-secret"),
@@ -574,8 +584,8 @@ describe("migrationJobEnvArgs", () => {
   it("gives the job password-less URLs and the password as a secret reference", () => {
     const args = migrationJobEnvArgs("db1.p-label.europe-west1.sql-psa.goog");
     expect(args).toEqual([
-      "--set-env-vars=ADMIN_DATABASE_URL=postgresql://admin_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_admin?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem,PUBLIC_ADMIN_DATABASE_URL=postgresql://admin_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_public?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem",
-      "--set-secrets=ADMIN_DATABASE_PASSWORD=caelo-production-postgres-password:latest,PUBLIC_ADMIN_DATABASE_PASSWORD=caelo-production-postgres-password:latest",
+      "--set-env-vars=ADMIN_DATABASE_URL=postgresql://admin_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_admin?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem,PUBLIC_ADMIN_DATABASE_URL=postgresql://admin_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_public?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem,PUBLIC_STAGING_ADMIN_DATABASE_URL=postgresql://admin_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_public_staging?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem",
+      "--set-secrets=ADMIN_DATABASE_PASSWORD=caelo-production-postgres-password:latest,PUBLIC_ADMIN_DATABASE_PASSWORD=caelo-production-postgres-password:latest,PUBLIC_STAGING_ADMIN_DATABASE_PASSWORD=caelo-production-postgres-password:latest",
     ]);
   });
 });