@caelo-cms/provisioning 0.11.10 → 0.11.11

package/src/wizards/gcp.ts

@@ -68,7 +68,11 @@ import {
   REQUIRED_API_LIST,
   serviceAccountExists,
 } from "../gcloud.js";
-import { GCP_STACK_ENV, upgraderServiceAccountEmail } from "../gcp-names.js";
+import {
+  GCP_STACK_ENV,
+  schedulerServiceAccountEmail,
+  upgraderServiceAccountEmail,
+} from "../gcp-names.js";
 import { INFRA_CONTRACT_VERSION } from "../infra-contract.js";
 import {
   INSTALL_JOB_NAME,
@@ -116,10 +120,12 @@ import {
   resolveStackRemoteMcpIdentity,
 } from "../remote-mcp.js";
 import type { RunMode } from "../run-mode.js";
+import { ensureSchedulerTick } from "../scheduler-setup.js";
 import { selfCommand } from "../self-command.js";
 import {
   ABSENT_DEFAULT_FIREWALL_RULES,
   cloudSqlPrivateDnsName,
+  parseSchedulerIntervalMinutes,
   type RemoteMcpIdentity,
   sameRemoteMcpIdentity,
 } from "../stack-contract.js";
@@ -234,7 +240,15 @@ export async function runGcpWizard(opts: GcpWizardOpts): Promise<void> {
   // drops the LB / Cloud CDN / Cloud Armor lines (saves ~$19/mo
   // vs gcp). Default 'gcp' for backwards compatibility with
   // installs that don't set the field.
-  const estimate = estimateGcpCost({ ...GCP_STACK_KNOB_DEFAULTS, provider, region });
+  const estimate = estimateGcpCost({
+    ...GCP_STACK_KNOB_DEFAULTS,
+    provider,
+    region,
+    // #1140 — the tick's line follows the knob the wizard recorded.
+    ...(meta?.schedulerIntervalMinutes !== undefined
+      ? { schedulerIntervalMinutes: meta.schedulerIntervalMinutes }
+      : {}),
+  });
   note(
     [
       bold(
@@ -523,6 +537,18 @@ export async function runGcpConverge(opts: GcpConvergeOpts): Promise<void> {
   // === 11.45. The converge job: releases that change the cloud setup (#819) ===
   const convergeReady = await stepConvergeJob(projectId, region, releaseVersion);
 
+  // === 11.47. The scheduler tick: periodic work + plugin workers (#1140) ===
+  // Before operator access, which keeps the scheduler's account on IAP.
+  const schedulerReady = await stepSchedulerTick(
+    projectId,
+    region,
+    provider,
+    ownerEmail,
+    identity?.identity.adminUrl ?? null,
+    meta.schedulerIntervalMinutes,
+  );
+  const keepScheduler = schedulerReady || (await schedulerExists(projectId));
+
   // === 11.5. Operator access: IAP follows the Caelo user list ===
   await stepOperatorAccessSync(
     projectId,
@@ -530,6 +556,7 @@ export async function runGcpConverge(opts: GcpConvergeOpts): Promise<void> {
     provider,
     ownerEmail,
     keepSigner ? [`serviceAccount:${upgraderServiceAccountEmail(projectId, GCP_STACK_ENV)}`] : [],
+    keepScheduler ? [schedulerServiceAccountEmail(projectId, GCP_STACK_ENV)] : [],
   );
 
   // === 11.6. Remote MCP (#806): LB rules (gcp) + a check of the identity env ===
@@ -546,9 +573,10 @@ export async function runGcpConverge(opts: GcpConvergeOpts): Promise<void> {
   // A fresh install ran every converge step above, so it is at this CLI's
   // infrastructure contract — recorded only when the upgrader and the
   // converge job are in place (the steps contract bumps 2 and 9 added) and
-  // remote MCP's steps (#806, bump 10) succeeded. With the release version,
-  // the admin can install the next update itself.
-  if (upgraderReady && convergeReady && remoteMcpReady) {
+  // remote MCP's steps (#806, bump 10) and the scheduler tick (#1140, bump
+  // 18) succeeded. With the release version, the admin can install the next
+  // update itself.
+  if (upgraderReady && convergeReady && remoteMcpReady && schedulerReady) {
     const version = releaseVersion;
     // #1025 — the linux/amd64 forms Cloud Run reports, next to the indexes,
     // so the upgrader recognises what serves without a registry lookup.
@@ -998,7 +1026,7 @@ async function stepGrantBaseRoles(
  */
 async function stepPublicRoleIsolation(projectId: string): Promise<void> {
   const s = spinner();
-  s.start("Removing public_role from the Cloud SQL superuser group...");
+  s.start("Removing the gateway logins from the Cloud SQL superuser group...");
   const r = await revokePublicRoleMemberships({
     projectId,
     env: GCP_STACK_ENV,
@@ -1010,7 +1038,7 @@ async function stepPublicRoleIsolation(projectId: string): Promise<void> {
     cancel("Aborted.");
     process.exit(1);
   }
-  s.stop(green("public_role holds no database roles"));
+  s.stop(green("The gateway logins (public_role, public_staging_role) hold no database roles"));
 }
 
 /**
@@ -1216,6 +1244,78 @@ async function upgraderExists(projectId: string): Promise<boolean> {
   return r.ok;
 }
 
+/** Whether the scheduler tick's account exists from an earlier run (it keeps its IAP access). */
+async function schedulerExists(projectId: string): Promise<boolean> {
+  const r = await gcloud([
+    "iam",
+    "service-accounts",
+    "describe",
+    schedulerServiceAccountEmail(projectId, GCP_STACK_ENV),
+    `--project=${projectId}`,
+    "--format=value(email)",
+  ]);
+  return r.ok;
+}
+
+/**
+ * #1140 — set up the scheduler tick (scheduler-setup.ts): the one Cloud
+ * Scheduler job that calls the admin's tick every `schedulerIntervalMinutes`
+ * through IAP. After migrations (the admin answers the tick once its tables
+ * exist) and before operator access. Not fatal: the site works without it,
+ * but plugin workers, update checks and clean-up do not run, so a failure
+ * warns loudly and the install is not recorded at this contract — the next
+ * wizard pass or `upgrade` retries. Idempotent.
+ *
+ * @returns whether the tick is in place
+ */
+async function stepSchedulerTick(
+  projectId: string,
+  region: string,
+  provider: "gcp" | "gcp-firebase",
+  ownerEmail: string,
+  adminUrl: string | null,
+  recordedInterval: number | undefined,
+): Promise<boolean> {
+  const s = spinner();
+  s.start("Setting up the scheduler tick (periodic work and plugin workers)...");
+  const failed = (error: string) => {
+    s.stop(yellow(`Scheduler tick not set up: ${error}`));
+    log.warn(
+      `The install works, but plugin workers (newsletter sends, rating aggregates), update checks and clean-up do not run until this succeeds. Re-run the installer or ${bold(selfCommand("upgrade"))} once the cause is fixed.`,
+    );
+    return false;
+  };
+  let intervalMinutes: number;
+  try {
+    intervalMinutes = parseSchedulerIntervalMinutes(
+      recordedInterval,
+      "install.json schedulerIntervalMinutes",
+    );
+  } catch (e) {
+    return failed((e as Error).message);
+  }
+  if (!adminUrl) return failed("the admin's URL could not be read (see the remote-MCP step above)");
+  const resolved = await resolveOperatorAccessTarget({
+    provider,
+    projectId,
+    region,
+    env: GCP_STACK_ENV,
+    ownerEmail,
+  });
+  if (!resolved.ok) return failed(resolved.error);
+  const r = await ensureSchedulerTick({
+    projectId,
+    region,
+    env: GCP_STACK_ENV,
+    adminUrl,
+    resource: resolved.target.resource,
+    intervalMinutes,
+  });
+  if (!r.ok) return failed(r.error);
+  s.stop(green(`Scheduler tick ready (every ${intervalMinutes} min, ${r.done.length} steps)`));
+  return true;
+}
+
 /**
  * Set up the operator-access sync job (operator-access.ts): the only
  * principal that may change who passes IAP, run as the operator's gcloud
@@ -1228,6 +1328,7 @@ async function stepOperatorAccessSync(
   provider: "gcp" | "gcp-firebase",
   ownerEmail: string,
   mcpSigners: readonly string[],
+  iapServiceAccounts: readonly string[],
 ): Promise<void> {
   const s = spinner();
   s.start("Setting up the operator-access sync job (Google IAP follows the user list)...");
@@ -1239,7 +1340,7 @@ async function stepOperatorAccessSync(
     ownerEmail,
   });
   const r = resolved.ok
-    ? await ensureOperatorAccessSync({ ...resolved.target, mcpSigners })
+    ? await ensureOperatorAccessSync({ ...resolved.target, mcpSigners, iapServiceAccounts })
     : { ok: false as const, done: [], error: resolved.error };
   if (!r.ok) {
     s.stop(red(`Failed: ${r.error}`));

package/stacks/aws/Pulumi.yaml

@@ -34,7 +34,7 @@ config:
     description: RDS max_connections (parameter group); every service's pool size is computed from it (docs/dev/connection-budget.md).
   caelo-aws:adminMaxInstances:
     type: string
-    default: "5"
+    default: "4"
     description: Most admin tasks at once; part of the connection budget.
   caelo-aws:gatewayMaxInstances:
     type: string

package/stacks/aws/index.ts

@@ -44,8 +44,10 @@ import {
 } from "../../dist/aws-task-roles.js";
 import { generateBootstrapToken } from "../../dist/bootstrap-token.js";
 import {
+  DEFAULT_ADMIN_MAX_INSTANCES,
   DEFAULT_GATEWAY_MAX_INSTANCES,
   DEFAULT_MAX_CONNECTIONS,
+  DEFAULT_STAGING_GATEWAY_MAX_INSTANCES,
   stackPoolBudget,
 } from "../../dist/pool-budget-stack.js";
 import { ADMIN_MEMORY_DEFAULT, memoryQuantityMiB } from "../../dist/stack-contract.js";
@@ -86,7 +88,10 @@ const maxConnections = Number.parseInt(
   cfg.get("maxConnections") ?? String(DEFAULT_MAX_CONNECTIONS.aws),
   10,
 );
-const adminMaxInstances = Number.parseInt(cfg.get("adminMaxInstances") ?? "5", 10);
+const adminMaxInstances = Number.parseInt(
+  cfg.get("adminMaxInstances") ?? String(DEFAULT_ADMIN_MAX_INSTANCES),
+  10,
+);
 const gatewayMaxInstances = Number.parseInt(
   cfg.get("gatewayMaxInstances") ?? String(DEFAULT_GATEWAY_MAX_INSTANCES),
   10,
@@ -95,6 +100,8 @@ const poolBudget = stackPoolBudget("aws", {
   maxConnections,
   adminMaxInstances,
   gatewayMaxInstances,
+  // #1329 — the staging gateway joins the budget with the staging database.
+  stagingGatewayMaxInstances: DEFAULT_STAGING_GATEWAY_MAX_INSTANCES,
 });
 if (_adminMemoryMiB === null) {
   throw new Error(`caelo-aws:adminMemory "${adminMemory}" is not a memory quantity (e.g. 2Gi)`);
@@ -131,6 +138,9 @@ const postgresPassword = pulumi.secret(randomHex(32));
 // #635) never holds admin_role's. bootstrap.sh creates the roles with these
 // (ADMIN_ROLE_PASSWORD / PUBLIC_ROLE_PASSWORD).
 const publicRolePassword = pulumi.secret(randomHex(32));
+// #1329 — the staging gateway's own login on cms_public_staging (created
+// with the database by bootstrap.sh, PUBLIC_STAGING_ROLE_PASSWORD).
+const publicStagingRolePassword = pulumi.secret(randomHex(32));
 const csrfSecret = pulumi.secret(randomHex(32));
 const cookieSecret = pulumi.secret(randomHex(32));
 const anthropicApiKey = pulumi.secret(process.env.ANTHROPIC_API_KEY ?? "");
@@ -151,6 +161,8 @@ function secret(name: string, value: pulumi.Output<string>): aws.secretsmanager.
 
 const pgSecret = secret("postgres-password", postgresPassword);
 const publicRoleSecret = secret("public-role-password", publicRolePassword);
+// #1329 — read by nothing yet: the staging gateway's task (#749) will.
+const _publicStagingRoleSecret = secret("public-staging-role-password", publicStagingRolePassword);
 const csrfSecretRes = secret("csrf-secret", csrfSecret);
 const cookieSecretRes = secret("cookie-secret", cookieSecret);
 const anthropicSecretRes = secret("anthropic-api-key", anthropicApiKey);
@@ -213,6 +225,20 @@ const publicDatabaseUrl = pulumi
   .apply(
     ([host, port, pw]) => `postgresql://public_role:${pw}@${host}:${port}/cms_public?${RDS_TLS}`,
   );
+// #1329 — the admin's pool on the staging database, and the staging
+// gateway's only login (no task definition reads them before #749).
+const publicStagingAdminDatabaseUrl = pulumi
+  .all([db.address, db.port, postgresPassword])
+  .apply(
+    ([host, port, pw]) =>
+      `postgresql://caelo_admin:${pw}@${host}:${port}/cms_public_staging?${RDS_TLS}`,
+  );
+const publicStagingDatabaseUrl = pulumi
+  .all([db.address, db.port, publicStagingRolePassword])
+  .apply(
+    ([host, port, pw]) =>
+      `postgresql://public_staging_role:${pw}@${host}:${port}/cms_public_staging?${RDS_TLS}`,
+  );
 
 // === 4. S3 buckets ===
 const mediaBucket = new aws.s3.BucketV2(`${namePrefix}-media`, {
@@ -449,6 +475,16 @@ new aws.cloudwatch.LogDelivery(
 // refuses every server-side render with that gap
 // (capture/capture-backend.ts) instead of running a browser in its own task.
 //
+// FIXME(issue #749): no scheduler tick yet (#1140). On GCP one Cloud
+// Scheduler job calls the admin's /api/internal/scheduler/tick every
+// `schedulerIntervalMinutes` (src/scheduler-setup.ts), and the admin runs
+// its periodic work and plugin workers only on that tick; self-hosted has a
+// scheduler container. The AWS equivalent is one EventBridge Scheduler
+// schedule that runs a small Fargate task (or Lambda) POSTing the same
+// endpoint through the ALB's Cognito gate, with the same 1–15 minute knob.
+// Nothing calls the tick here because no admin task exists on AWS yet; it
+// lands with the admin task in #749.
+//
 // FIXME(issue #696): no in-cloud upgrader or converge job (#819) yet. On
 // GCP Settings → Updates hands app-roll releases to the upgrader job and
 // cloud-setup releases to the converge job; on AWS the admin refuses a
@@ -551,6 +587,7 @@ const dnsRecordsRequired: DnsRecord[] = [
 const out: CloudAdapterOutputs = {
   adminDatabaseUrl: adminDatabaseUrl as unknown as string,
   publicDatabaseUrl: publicDatabaseUrl as unknown as string,
+  publicStagingDatabaseUrl: publicStagingDatabaseUrl as unknown as string,
   mediaStorageUrl: pulumi.interpolate`s3://${mediaBucket.bucket}` as unknown as string,
   mediaCdnBaseUrl:
     pulumi.interpolate`https://${distribution.domainName}/media` as unknown as string,
@@ -565,6 +602,9 @@ const out: CloudAdapterOutputs = {
 
 export const adminDatabaseUrlOut = out.adminDatabaseUrl;
 export const publicDatabaseUrlOut = out.publicDatabaseUrl;
+export const publicStagingDatabaseUrlOut = out.publicStagingDatabaseUrl;
+// #1329 — what the admin task definition (#749) sets as PUBLIC_STAGING_ADMIN_DATABASE_URL.
+export const publicStagingAdminDatabaseUrlOut = publicStagingAdminDatabaseUrl;
 export const mediaStorageUrlOut = out.mediaStorageUrl;
 export const mediaCdnBaseUrlOut = out.mediaCdnBaseUrl;
 export const bootstrapUrlOut = out.bootstrapUrl;

package/stacks/azure/index.ts

@@ -41,10 +41,15 @@ import * as pulumi from "@pulumi/pulumi";
 import type { CloudAdapterOutputs, DnsRecord } from "../../dist/adapter.js";
 import { azureFrontDoorDnsRecords } from "../../dist/azure-front-door.js";
 import { generateBootstrapToken } from "../../dist/bootstrap-token.js";
-import { DEFAULT_MAX_CONNECTIONS, stackPoolBudget } from "../../dist/pool-budget-stack.js";
+import {
+  DEFAULT_MAX_CONNECTIONS,
+  DEFAULT_STAGING_GATEWAY_MAX_INSTANCES,
+  stackPoolBudget,
+} from "../../dist/pool-budget-stack.js";
 import {
   ADMIN_MEMORY_DEFAULT,
   azureContainerAppResources,
+  GATEWAY_ENVIRONMENT_ENV,
   GATEWAY_TRUSTED_PROXY_HOPS,
   MCP_AUTH_PROXY_TRUSTED_PROXY_HOPS,
   REMOTE_MCP_MODE,
@@ -88,6 +93,8 @@ const poolBudget = stackPoolBudget("azure", {
   maxConnections,
   adminMaxInstances: ADMIN_SIDE_APPS * MAX_REPLICAS,
   gatewayMaxInstances: MAX_REPLICAS,
+  // #1329 — the staging gateway joins the budget with the staging database.
+  stagingGatewayMaxInstances: DEFAULT_STAGING_GATEWAY_MAX_INSTANCES,
 });
 // #553 — the admin runs the Lighthouse quality audit; same knob + default
 // as every adapter (stack-contract.ts). Container Apps only accepts fixed
@@ -116,6 +123,9 @@ const postgresPassword = pulumi.secret(randomHex(32));
 // #635) never holds admin_role's. bootstrap.sh creates the roles with these
 // (ADMIN_ROLE_PASSWORD / PUBLIC_ROLE_PASSWORD).
 const publicRolePassword = pulumi.secret(randomHex(32));
+// #1329 — the staging gateway's own login on cms_public_staging (created
+// with the database by bootstrap.sh, PUBLIC_STAGING_ROLE_PASSWORD).
+const publicStagingRolePassword = pulumi.secret(randomHex(32));
 const csrfSecret = pulumi.secret(randomHex(32));
 const cookieSecret = pulumi.secret(randomHex(32));
 const anthropicApiKey = pulumi.secret(process.env.ANTHROPIC_API_KEY ?? "");
@@ -145,6 +155,8 @@ function keyVaultSecret(shortName: string, value: pulumi.Output<string>): azure.
 
 const _pgSecret = keyVaultSecret("pg-password", postgresPassword);
 keyVaultSecret("public-role-password", publicRolePassword);
+// #1329 — read by nothing yet: the staging gateway's app (#750) will.
+keyVaultSecret("public-staging-role-password", publicStagingRolePassword);
 keyVaultSecret("csrf-secret", csrfSecret);
 keyVaultSecret("cookie-secret", cookieSecret);
 keyVaultSecret("anthropic-api-key", anthropicApiKey);
@@ -195,6 +207,13 @@ const _pgPublic = new azure.dbforpostgresql.Database(`${namePrefix}-cms-public-d
   databaseName: "cms_public",
   charset: "UTF8",
 });
+// #1329 — staging's own data, the twin of cms_public on the same server.
+const _pgPublicStaging = new azure.dbforpostgresql.Database(`${namePrefix}-cms-public-staging-db`, {
+  resourceGroupName: rg.name,
+  serverName: pgServer.name,
+  databaseName: "cms_public_staging",
+  charset: "UTF8",
+});
 
 // #1338 — verify-full to the server's FQDN. Flexible Server's certificate chains
 // to public roots (DigiCert Global Root G2, Microsoft RSA Root CA 2017) that
@@ -213,6 +232,19 @@ const publicAdminDatabaseUrl = pulumi
 const publicDatabaseUrl = pulumi
   .all([pgServer.fullyQualifiedDomainName, publicRolePassword])
   .apply(([host, pw]) => `postgresql://public_role:${pw}@${host}:5432/cms_public?${AZURE_TLS}`);
+// #1329 — the admin's pool on the staging database (plugin schemas, the
+// staging half of the projection), and the staging gateway's only login.
+const publicStagingAdminDatabaseUrl = pulumi
+  .all([pgServer.fullyQualifiedDomainName, postgresPassword])
+  .apply(
+    ([host, pw]) => `postgresql://caelo_admin:${pw}@${host}:5432/cms_public_staging?${AZURE_TLS}`,
+  );
+const publicStagingDatabaseUrl = pulumi
+  .all([pgServer.fullyQualifiedDomainName, publicStagingRolePassword])
+  .apply(
+    ([host, pw]) =>
+      `postgresql://public_staging_role:${pw}@${host}:5432/cms_public_staging?${AZURE_TLS}`,
+  );
 
 // === 4. Storage account + containers ===
 const storage = new azure.storage.StorageAccount(`${namePrefix}-st`, {
@@ -409,6 +441,15 @@ const logWorkspace = new azure.operationalinsights.Workspace(`${namePrefix}-logs
 // refuses every server-side render with that gap
 // (capture/capture-backend.ts) instead of running a browser in its own app.
 //
+// FIXME(issue #750): no scheduler tick yet (#1140). On GCP one Cloud
+// Scheduler job calls the admin's /api/internal/scheduler/tick every
+// `schedulerIntervalMinutes` (src/scheduler-setup.ts), and the admin runs
+// its periodic work and plugin workers only on that tick; self-hosted has a
+// scheduler container. The Azure equivalent is a scheduled Container Apps
+// job (or Logic App recurrence) POSTing the same endpoint behind Easy Auth,
+// with the same 1–15 minute knob. Nothing calls the tick here because no
+// admin app exists on Azure yet; it lands with the admin in #750.
+//
 // FIXME(issue #696): no in-cloud upgrader or converge job (#819) yet. On
 // GCP Settings → Updates hands app-roll releases to the upgrader job and
 // cloud-setup releases to the converge job; on Azure the admin refuses a
@@ -503,6 +544,7 @@ function containerApp(args: ContainerAppArgs): azure.app.ContainerApp {
 const adminDatabaseEnv = [
   { name: "ADMIN_DATABASE_URL", value: adminDatabaseUrl },
   { name: "PUBLIC_ADMIN_DATABASE_URL", value: publicAdminDatabaseUrl },
+  { name: "PUBLIC_STAGING_ADMIN_DATABASE_URL", value: publicStagingAdminDatabaseUrl },
   ...poolBudget.env.admin,
 ];
 const adminApp = containerApp({
@@ -519,8 +561,12 @@ const _gatewayApp = containerApp({
     { name: "PUBLIC_DATABASE_URL", value: publicDatabaseUrl },
     ...poolBudget.env.gateway,
   ],
-  // Which X-Forwarded-For entry is the visitor (api-gateway client-ip.ts).
-  extraEnv: [{ name: TRUSTED_PROXY_HOPS_ENV, value: String(GATEWAY_TRUSTED_PROXY_HOPS.azure) }],
+  // Which X-Forwarded-For entry is the visitor (api-gateway client-ip.ts),
+  // and (#1329) that this is the live site's gateway.
+  extraEnv: [
+    { name: TRUSTED_PROXY_HOPS_ENV, value: String(GATEWAY_TRUSTED_PROXY_HOPS.azure) },
+    { name: GATEWAY_ENVIRONMENT_ENV, value: "live" },
+  ],
 });
 // #1328 — the MCP-Auth-Proxy, its own Container App and so its own FQDN:
 // remote MCP's sign-in pages never share an origin with the site's module
@@ -565,6 +611,7 @@ const dnsRecordsRequired = pulumi
 const out: CloudAdapterOutputs = {
   adminDatabaseUrl: adminDatabaseUrl as unknown as string,
   publicDatabaseUrl: publicDatabaseUrl as unknown as string,
+  publicStagingDatabaseUrl: publicStagingDatabaseUrl as unknown as string,
   mediaStorageUrl:
     pulumi.interpolate`https://${storage.name}.blob.core.windows.net/media` as unknown as string,
   mediaCdnBaseUrl: pulumi.interpolate`https://${domain}/media` as unknown as string,
@@ -578,6 +625,7 @@ const out: CloudAdapterOutputs = {
 
 export const adminDatabaseUrlOut = out.adminDatabaseUrl;
 export const publicDatabaseUrlOut = out.publicDatabaseUrl;
+export const publicStagingDatabaseUrlOut = out.publicStagingDatabaseUrl;
 export const mediaStorageUrlOut = out.mediaStorageUrl;
 export const mediaCdnBaseUrlOut = out.mediaCdnBaseUrl;
 export const bootstrapUrlOut = out.bootstrapUrl;

package/stacks/gcp/Pulumi.yaml

@@ -55,7 +55,7 @@ config:
     description: Admin Cloud Run memory. 2Gi leaves room for the Lighthouse quality audit next to editor requests; billed only while an instance runs.
   caelo-gcp:adminMaxInstances:
     type: string
-    default: "5"
+    default: "4"
     description: |
       Admin Cloud Run max instances. Each instance gets an equal share of
       the connection budget (docs/dev/connection-budget.md): at the

package/stacks/gcp/README.md

@@ -12,6 +12,7 @@ Pulumi stack provisioning Caelo on GCP managed services. Implements the shared `
 | Container runtime | Four Cloud Run services (admin / gateway / orchestrator / runner) |
 | Secret store | Secret Manager: postgres-password (admin_role) + secret-kek (Pulumi); internal-secret, tool-approval-secret and public-role-password (created by the CLI before `pulumi up`, see `src/runtime-secrets.ts`). Cloud Run reads each as a `secretKeyRef`; database URLs carry no password. The gateway's service account reads only `public-role-password` (#613, #635: the gateway has no cms_admin login). |
 | Edge-log sink | Cloud Logging project sink → BigQuery dataset `<env>_edge_logs` (queryable by P12A analytics plugin) |
+| Scheduler tick (CLI-owned, #1140) | One Cloud Scheduler job `caelo-<env>-scheduler-tick` starts the Workflows workflow of the same name every `schedulerIntervalMinutes` (1–15, default 5; `--scheduler-interval-minutes` on the installer, recorded in install.json). The workflow signs an IAP credential as `caelo-<env>-scheduler` and POSTs the admin's `/api/internal/scheduler/tick`, which runs the due periodic work and plugin workers. Set up by the installer and `upgrade` (`src/scheduler-setup.ts`), not by this stack. |
 
 The Caelo runtime never knows it's on GCP — every Cloud Run service consumes plain `DATABASE_URL` / `MEDIA_STORAGE_URL` / `SECRETS_PROVIDER` env vars.
 

package/stacks/gcp/index.ts

@@ -33,8 +33,10 @@ import {
 } from "../../dist/gcp-names.js";
 import { createSiteUrlMap } from "../../dist/gcp-url-map.js";
 import {
+  DEFAULT_ADMIN_MAX_INSTANCES,
   DEFAULT_GATEWAY_MAX_INSTANCES,
   DEFAULT_MAX_CONNECTIONS,
+  DEFAULT_STAGING_GATEWAY_MAX_INSTANCES,
   stackPoolBudget,
 } from "../../dist/pool-budget-stack.js";
 import {
@@ -119,7 +121,10 @@ const adminMemory = cfg.get("adminMemory") ?? ADMIN_MEMORY_DEFAULT;
 // against the original 25-slot Postgres default — connection exhaustion
 // took the admin offline. v0.2.49 bakes the post-incident shape so fresh
 // installs don't trip the same wall.
-const adminMaxInstances = Number.parseInt(cfg.get("adminMaxInstances") ?? "5", 10);
+const adminMaxInstances = Number.parseInt(
+  cfg.get("adminMaxInstances") ?? String(DEFAULT_ADMIN_MAX_INSTANCES),
+  10,
+);
 const gatewayMinInstances = Number.parseInt(cfg.get("gatewayMinInstances") ?? "0", 10);
 // #1254 — the gateway's scale-out is part of the connection budget: each
 // instance holds a cms_public pool.
@@ -137,6 +142,8 @@ const poolBudget = stackPoolBudget("gcp", {
   maxConnections,
   adminMaxInstances,
   gatewayMaxInstances,
+  // #1329 — the staging gateway (P3b-2) is budgeted from this release on.
+  stagingGatewayMaxInstances: DEFAULT_STAGING_GATEWAY_MAX_INSTANCES,
 });
 const wafAdaptiveProtection = cfg.getBoolean("wafAdaptiveProtection") ?? false;
 const backupRetentionDays = Number.parseInt(cfg.get("backupRetentionDays") ?? "7", 10);
@@ -281,6 +288,8 @@ const runtimeSecretIds: Record<RuntimeSecret, pulumi.Input<string>> = {
   "tool-approval-secret": gcpSecretId(env, "tool-approval-secret"),
   "staging-gate-secret": gcpSecretId(env, "staging-gate-secret"),
   "public-role-password": gcpSecretId(env, "public-role-password"),
+  // #1329 — the staging gateway's login, never the live one's.
+  "public-staging-role-password": gcpSecretId(env, "public-staging-role-password"),
   // #914 / #806 — the Owner-set Google sign-in client (a placeholder until
   // then; IAP login, IAP programmatic access and the remote-MCP broker) and
   // the broker's seal key, both CLI-generated.
@@ -297,6 +306,14 @@ const publicRolePassword = pulumi.secret(
     { provider: gcpProvider },
   ).secretData,
 );
+// #1329 — public_staging_role's own password (CLI-generated like the one
+// above): the staging gateway's only login, on cms_public_staging only.
+const publicStagingRolePassword = pulumi.secret(
+  gcp.secretmanager.getSecretVersionOutput(
+    { project, secret: gcpSecretId(env, "public-staging-role-password") },
+    { provider: gcpProvider },
+  ).secretData,
+);
 
 // =========================================================================
 // Tier 4 — Cloud SQL Postgres (private IP only; HA + retention configurable)
@@ -371,6 +388,14 @@ const pgPublicUser = new gcp.sql.User(
   { instance: sqlInstance.name, name: "public_role", password: publicRolePassword },
   opts,
 );
+// #1329 — the staging gateway's login: an Admin API user like public_role,
+// so the same membership revoke (public-role-isolation.ts) and the same
+// audit apply; migration 0530 gives it CONNECT on cms_public_staging only.
+new gcp.sql.User(
+  `${namePrefix}-pg-public-staging`,
+  { instance: sqlInstance.name, name: "public_staging_role", password: publicStagingRolePassword },
+  opts,
+);
 
 const cmsAdminDb = new gcp.sql.Database(
   `${namePrefix}-cms-admin-db`,
@@ -382,6 +407,13 @@ const cmsPublicDb = new gcp.sql.Database(
   { instance: sqlInstance.name, name: "cms_public" },
   opts,
 );
+// #1329 — staging's own data: the twin of cms_public on the same instance
+// (no extra cost), reached by the staging gateway only.
+const cmsPublicStagingDb = new gcp.sql.Database(
+  `${namePrefix}-cms-public-staging-db`,
+  { instance: sqlInstance.name, name: "cms_public_staging" },
+  opts,
+);
 
 // #1338 — the instance's DNS name, resolved to its private IP by a private
 // zone in the VPC (Cloud SQL assigns the name, it does not resolve it).
@@ -767,6 +799,8 @@ const envContractInputs = {
     admin: dbUrls.admin,
     publicAdmin: dbUrls.publicAdmin,
     public: dbUrls.public,
+    publicStagingAdmin: dbUrls.publicStagingAdmin,
+    publicStaging: dbUrls.publicStaging,
   },
 } as const;
 
@@ -841,6 +875,7 @@ function cloudRunService(args: CloudRunArgs): gcp.cloudrunv2.Service {
         pgAdminUser,
         cmsAdminDb,
         cmsPublicDb,
+        cmsPublicStagingDb,
         // The env contract names the buckets as strings; keep them ordered
         // before the services that use them.
         mediaBucket,
@@ -1155,6 +1190,18 @@ new gcp.iap.WebBackendServiceIamMember(
 // (packages/provisioning/src/capture-job-setup.ts), for the same reason as
 // the audit job above.
 
+// =========================================================================
+// Scheduler tick — deliberately NOT here
+// =========================================================================
+//
+// #1140 — one Cloud Scheduler job starts a Cloud Workflows execution every
+// `schedulerIntervalMinutes` (1–15, default 5); the workflow signs an IAP
+// credential as the scheduler's own service account and POSTs the admin's
+// /api/internal/scheduler/tick, where the admin runs its periodic work and
+// plugin workers from its due-table. The CLI owns the account, its grants,
+// the workflow and the job (packages/provisioning/src/scheduler-setup.ts),
+// for the same reason as the audit job above.
+
 // =========================================================================
 // Operator access — deliberately NOT here
 // =========================================================================
@@ -1325,6 +1372,7 @@ const out: CloudAdapterOutputs = {
   // Password-less — the password lives only in Secret Manager.
   adminDatabaseUrl: dbUrls.admin as unknown as string,
   publicDatabaseUrl: dbUrls.public as unknown as string,
+  publicStagingDatabaseUrl: dbUrls.publicStaging as unknown as string,
   mediaStorageUrl: pulumi.interpolate`gs://${mediaBucket.name}` as unknown as string,
   mediaCdnBaseUrl: pulumi.interpolate`https://${domain}/media` as unknown as string,
   bootstrapUrl:
@@ -1338,6 +1386,7 @@ const out: CloudAdapterOutputs = {
 
 export const adminDatabaseUrlOut = out.adminDatabaseUrl;
 export const publicDatabaseUrlOut = out.publicDatabaseUrl;
+export const publicStagingDatabaseUrlOut = out.publicStagingDatabaseUrl;
 export const mediaStorageUrlOut = out.mediaStorageUrl;
 export const mediaCdnBaseUrlOut = out.mediaCdnBaseUrl;
 export const bootstrapUrlOut = out.bootstrapUrl;

package/stacks/gcp-firebase/Pulumi.yaml

@@ -58,7 +58,7 @@ config:
     description: Admin Cloud Run memory. 2Gi leaves room for the Lighthouse quality audit next to editor requests; billed only while an instance runs.
   caelo-gcp-firebase:adminMaxInstances:
     type: string
-    default: "5"
+    default: "4"
     description: Admin Cloud Run max instances.
   caelo-gcp-firebase:maxConnections:
     type: string