@caelo-cms/provisioning 0.11.10 → 0.11.12

package/src/upgrade/converge.ts

@@ -5,7 +5,8 @@
  * service accounts, secrets or other cloud resources so the install matches
  * what the release's stacks declare — the gateway's run SA and the
  * CLI-generated runtime secrets, the stack's IAM/CDN/firewall invariants,
- * MCP access through IAP, public_role's Cloud SQL role memberships (#633),
+ * MCP access through IAP, the staging database and its gateway login
+ * (#1329), the gateway logins' Cloud SQL role memberships (#633),
  * the gateway's and public_role's database logins, the operator-access sync
  * job, the quality-audit job (#875), the remote-MCP load-balancer rules and
  * identity env (#806), and dropping bindings nothing reads any more.
@@ -39,7 +40,7 @@ import {
 import { ensureConvergeJob } from "../converge-job-setup.js";
 import { findSqlInstance, planPublicRoleSwitch } from "../gateway-credentials.js";
 import type { GcloudRunner, Sleep } from "../gcloud-retry.js";
-import { upgraderServiceAccountEmail } from "../gcp-names.js";
+import { schedulerServiceAccountEmail, upgraderServiceAccountEmail } from "../gcp-names.js";
 import type { InstallMetadata } from "../install-state.js";
 import { ensureMcpIapAccess, type IapResource } from "../mcp-iap.js";
 import { ensureOperatorAccessSync, resolveOperatorAccessTarget } from "../operator-access.js";
@@ -52,6 +53,7 @@ import {
   plainGeneratedSecretSeed,
   readSecretReplication,
 } from "../runtime-secrets.js";
+import { ensureSchedulerTick } from "../scheduler-setup.js";
 import { selfCommand } from "../self-command.js";
 import {
   AUDIT_JOB_ENV_VAR,
@@ -64,7 +66,9 @@ import {
   INTERIM_FORWARD_ORIGIN_ENV,
   MCP_ENV_VAR,
   OPERATOR_ACCESS_JOB_ENV_VAR,
+  parseSchedulerIntervalMinutes,
   remoteMcpIdentityEnv,
+  SCHEDULER_SERVICE_ACCOUNT_ENV_VAR,
   UPGRADER_JOB_ENV_VAR,
 } from "../stack-contract.js";
 import {
@@ -73,6 +77,7 @@ import {
   liveEnvHasInlinePassword,
   removeRetiredIamBindings,
 } from "../stack-converge.js";
+import { ensureStagingDatabase } from "../staging-database.js";
 import { ensureUpgraderJob, resolveUpgraderTarget } from "../upgrader-setup.js";
 import { ensureUrlMapRedirectsAccess } from "../url-map-redirects-access.js";
 import type { AppRollHooks, AppRollPlan, RollPlan, RollSlug } from "./app-roll.js";
@@ -110,6 +115,11 @@ export interface ConvergeDeps {
    * then fails and the converge stays incomplete.
    */
   readonly opsImageRef?: string | null;
+  /**
+   * #1140 — the install's `schedulerIntervalMinutes` knob (install.json);
+   * absent: the default. The scheduler step refuses an out-of-range value.
+   */
+  readonly schedulerIntervalMinutes?: number;
 }
 
 export interface ConvergeSession {
@@ -234,22 +244,48 @@ export function startConverge(
     return true;
   }
 
+  async function stagingDatabase(): Promise<boolean> {
+    // #1329 — staging's own database and its gateway login, on an install
+    // from before them. Before migrations: the cms_public_staging run and
+    // migration 0530 need both, and the membership revoke below needs the
+    // user. A failure aborts — the new admin refuses to start without the
+    // staging database.
+    const s = r.step("Ensuring the staging database (cms_public_staging) and its gateway login...");
+    const outcomes = await ensureStagingDatabase(
+      { projectId: install.projectId, env: install.env, credentials: install.credentials },
+      { ...runDeps, ...(deps.http ? { http: deps.http } : {}) },
+    );
+    const failed = outcomes.filter((o) => o.status === "failed");
+    if (failed.length > 0) {
+      s.failed("The staging database could not be set up. Aborting upgrade.");
+      for (const o of failed) r.error(`  FAILED: ${o.id}\n    ${o.error ?? ""}`);
+      r.warn("No traffic was shifted and no migrations ran. Fix the above and re-run.");
+      return false;
+    }
+    s.done("Staging database and its gateway login ready");
+    for (const o of outcomes.filter((o) => o.status === "applied")) {
+      r.info(`  ${o.id}: ${o.detail ?? "created"}`);
+    }
+    return true;
+  }
+
   async function publicRoleIsolation(): Promise<boolean> {
-    // #633 — the Admin API made public_role a member of cloudsqlsuperuser.
-    // Revoked here, before migrations, because the migration job's role
-    // audit is what verifies it and fails the upgrade while it remains.
-    const s = r.step("Removing public_role from the Cloud SQL superuser group...");
+    // #633 — the Admin API made public_role (and, #1329, public_staging_role)
+    // a member of cloudsqlsuperuser. Revoked here, before migrations,
+    // because the migration job's role audit is what verifies it and fails
+    // the upgrade while it remains.
+    const s = r.step("Removing the gateway logins from the Cloud SQL superuser group...");
     const outcome = await revokePublicRoleMemberships(
       { projectId: install.projectId, env: install.env, credentials: install.credentials },
       runDeps,
     );
     if (outcome.status === "failed") {
-      s.failed("public_role's role memberships could not be revoked. Aborting upgrade.");
+      s.failed("The gateway logins' role memberships could not be revoked. Aborting upgrade.");
       r.error(`  ${outcome.error ?? ""}`);
       r.warn("No traffic was shifted and no migrations ran. Fix the above and re-run.");
       return false;
     }
-    s.done(`public_role holds no database roles (${outcome.detail ?? "revoked"})`);
+    s.done(`The gateway logins hold no database roles (${outcome.detail ?? "revoked"})`);
     return true;
   }
 
@@ -427,6 +463,9 @@ export function startConverge(
     return [{ name: INTERIM_FORWARD_ORIGIN_ENV, value: new URL(url).origin }];
   }
 
+  /** The admin's origin behind IAP, once {@link remoteMcpIdentity} read it. */
+  let resolvedAdminUrl: string | null = null;
+
   async function remoteMcpIdentity(): Promise<Record<RollSlug, CloudRunEnvVar[]> | null> {
     // #806 — CAELO_ADMIN_URL / CAELO_MCP_PUBLIC_URL / CAELO_IAP_AUDIENCE
     // name identities the env contract cannot (stack-contract.ts
@@ -449,6 +488,7 @@ export function startConverge(
       runDeps,
     );
     if (resolved.ok) {
+      resolvedAdminUrl = resolved.identity.adminUrl;
       s.done(
         `Google sign-in and remote MCP can be set up under Settings → Google sign-in (${resolved.identity.mcpPublicUrl})`,
       );
@@ -672,6 +712,77 @@ export function startConverge(
     leaveUntouched.push(CONVERGE_JOB_ENV_VAR);
   }
 
+  let schedulerReady = false;
+  /** The scheduler's SA exists from an earlier run though this one failed. */
+  let schedulerAccountExists = false;
+
+  async function setUpSchedulerTick(): Promise<
+    | { ok: true; done: string[]; intervalMinutes: number }
+    | { ok: false; done: string[]; error: string }
+  > {
+    let intervalMinutes: number;
+    try {
+      intervalMinutes = parseSchedulerIntervalMinutes(
+        deps.schedulerIntervalMinutes,
+        "install.json schedulerIntervalMinutes",
+      );
+    } catch (e) {
+      return { ok: false, done: [], error: (e as Error).message };
+    }
+    const resource = await adminIapResource();
+    if (!resource) return { ok: false, done: [], error: "the admin's IAP resource was not found" };
+    if (!resolvedAdminUrl)
+      return { ok: false, done: [], error: "the admin's URL could not be read" };
+    const st = await ensureSchedulerTick(
+      {
+        projectId: install.projectId,
+        region: install.region,
+        env: install.env,
+        adminUrl: resolvedAdminUrl,
+        resource,
+        intervalMinutes,
+      },
+      runDeps,
+    );
+    return st.ok ? { ok: true, done: st.done, intervalMinutes } : st;
+  }
+
+  async function schedulerTick(): Promise<void> {
+    // #1140 — the one Cloud Scheduler job that calls the admin's tick
+    // (scheduler-setup.ts). After migrations and before the operator-access
+    // step, which must keep the scheduler's account on IAP. The schedule
+    // starts right away: until the roll below finishes, a tick reaches the
+    // previous admin, which has no such endpoint (404) — that execution
+    // fails and nothing runs; the first tick after the roll does the work.
+    // A failure costs the periodic work (plugin workers, GC, release check),
+    // not the site, so it warns and the admin keeps its current env.
+    const s = r.step("Ensuring the scheduler tick (periodic work and plugin workers)...");
+    const st = await setUpSchedulerTick();
+    for (const step of st.done) r.info(`  ${step}`);
+    if (st.ok) {
+      schedulerReady = true;
+      s.done(`Scheduler tick ready (every ${st.intervalMinutes} min)`);
+      return;
+    }
+    s.warned(`Scheduler tick not set up: ${st.error}`);
+    // An account set up by an earlier run keeps its IAP access, or the next
+    // sync would cut off a tick that still works.
+    const exists = await run([
+      "iam",
+      "service-accounts",
+      "describe",
+      schedulerServiceAccountEmail(install.projectId, install.env),
+      `--project=${install.projectId}`,
+      "--format=value(email)",
+    ]);
+    schedulerAccountExists = exists.ok;
+    r.warn(
+      "The upgrade continues; plugin workers, update checks and clean-up run late or not at all until this succeeds. Re-run upgrade once the cause is fixed.",
+    );
+    incomplete = true;
+    leaveUntouched.push(SCHEDULER_SERVICE_ACCOUNT_ENV_VAR);
+  }
+
   async function operatorAccess(): Promise<void> {
     // The job that keeps IAP in step with the user list (operator-access.ts).
     // After migrations: its database user gets the role migration 0239
@@ -699,6 +810,13 @@ export function startConverge(
                   ],
                 }
               : {}),
+            ...(schedulerReady || schedulerAccountExists
+              ? {
+                  iapServiceAccounts: [
+                    schedulerServiceAccountEmail(install.projectId, install.env),
+                  ],
+                }
+              : {}),
           },
           runDeps,
         )
@@ -721,6 +839,7 @@ export function startConverge(
       if (deps.provisionerIdentity && !(await deps.provisionerIdentity())) return false;
       if (!(await runtimeIdentities())) return false;
       if (!(await stackInvariants())) return false;
+      if (!(await stagingDatabase())) return false;
       if (!(await publicRoleIsolation())) return false;
       if (!(await databaseTls())) return false;
       await mcpAccess();
@@ -734,10 +853,12 @@ export function startConverge(
     hooks: {
       async afterMigrations() {
         if (!(await databaseLogins())) return { ok: false };
+        // Read-only, first: the scheduler tick needs the admin's URL.
+        const identity = await remoteMcpIdentity();
         await upgraderJob();
         await convergeJob();
+        await schedulerTick();
         await operatorAccess();
-        const identity = await remoteMcpIdentity();
         let forward: CloudRunEnvVar[];
         try {
           forward = await interimForwardEnv();

package/src/upgrade/upgrade.test.ts

@@ -423,6 +423,66 @@ describe("upgradeGcpInstall — converge, then app-roll", () => {
     ).toBe(false);
   });
 
+  it("#1140 — sets up the scheduler tick before operator access keeps its account on IAP, and tells the admin whom to trust", async () => {
+    const events: string[] = [];
+    const { deps, lines } = upgradeDeps(events);
+    expect(await upgradeGcpInstall({ ...TARGET, schedulerIntervalMinutes: 2 }, deps)).toBe(true);
+    const workflow = indexOf(events, /^gcloud workflows deploy caelo-production-scheduler-tick /);
+    const schedule = indexOf(
+      events,
+      /^gcloud scheduler jobs (create|update) http caelo-production-scheduler-tick /,
+    );
+    const opAccess = indexOf(
+      events,
+      /^gcloud run jobs deploy caelo-production-operator-access-sync /,
+    );
+    const adminRoll = indexOf(events, new RegExp(`^gcloud run services update ${ADMIN} `));
+    expect(workflow < schedule && schedule < opAccess && opAccess < adminRoll).toBe(true);
+    expect(events[schedule]).toContain("--schedule=*/2 * * * *");
+    expect(events[schedule]).toContain(
+      "--oauth-service-account-email=caelo-production-scheduler@acme.iam.gserviceaccount.com",
+    );
+    expect(events[opAccess]).toContain(
+      "CAELO_OPERATOR_ACCESS_IAP_SERVICE_ACCOUNTS=caelo-production-scheduler@acme.iam.gserviceaccount.com",
+    );
+    expect(events[adminRoll]).toContain(
+      "CAELO_SCHEDULER_SERVICE_ACCOUNT=caelo-production-scheduler@acme.iam.gserviceaccount.com",
+    );
+    expect(lines).toContain("done: Scheduler tick ready (every 2 min)");
+  });
+
+  it("#1140 — a failed scheduler setup leaves the converge incomplete and the admin's trust env untouched", async () => {
+    const events: string[] = [];
+    const { deps, recorded, lines } = upgradeDeps(events, {
+      overrides: [
+        [/^workflows deploy caelo-production-scheduler-tick/, fail("PERMISSION_DENIED")],
+        [/^iam service-accounts describe caelo-production-scheduler@/, fail("NOT_FOUND")],
+      ],
+    });
+    expect(await upgradeGcpInstall(TARGET, deps)).toBe(true);
+    expect(recorded.contract).toEqual([]);
+    expect(lines.some((l) => l.includes("Scheduler tick not set up"))).toBe(true);
+    expect(
+      events.some((e) =>
+        /services update caelo-production-admin.*CAELO_SCHEDULER_SERVICE_ACCOUNT=/.test(e),
+      ),
+    ).toBe(false);
+    expect(
+      events.some((e) =>
+        /^gcloud scheduler jobs (create|update) http caelo-production-scheduler-tick/.test(e),
+      ),
+    ).toBe(false);
+  });
+
+  it("#1140 — refuses an out-of-range interval in install.json without touching the scheduler", async () => {
+    const events: string[] = [];
+    const { deps, recorded, lines } = upgradeDeps(events);
+    expect(await upgradeGcpInstall({ ...TARGET, schedulerIntervalMinutes: 60 }, deps)).toBe(true);
+    expect(recorded.contract).toEqual([]);
+    expect(lines.some((l) => l.includes("between 1 and 15"))).toBe(true);
+    expect(events.some((e) => /^gcloud workflows deploy/.test(e))).toBe(false);
+  });
+
   it("an unreadable audit job is reported as an error, not as a missing job, and is not moved", async () => {
     const events: string[] = [];
     const { deps, lines } = upgradeDeps(events, {
@@ -748,10 +808,33 @@ describe("upgradeGcpInstall — converge, then app-roll", () => {
     expect(indexOf(events, /^gcloud sql backups create/)).toBeLessThan(revoke);
     expect(revoke).toBeLessThan(indexOf(events, /^migrate /));
     expect(lines).toContain(
-      "done: public_role holds no database roles (no database roles left on caelo-production-pg-abc)",
+      "done: The gateway logins hold no database roles (public_role and public_staging_role hold no database roles on caelo-production-pg-abc)",
     );
   });
 
+  it("creates the staging database and its login before the revoke and the migrations (#1329)", async () => {
+    const events: string[] = [];
+    const { deps, lines } = upgradeDeps(events);
+    expect(await upgradeGcpInstall(TARGET, deps)).toBe(true);
+    const created = indexOf(events, /^gcloud sql databases (list|create)/);
+    const revoke = indexOf(events, /^gcloud sql users assign-roles public_staging_role/);
+    expect(created).toBeGreaterThan(-1);
+    expect(created).toBeLessThan(revoke);
+    expect(revoke).toBeLessThan(indexOf(events, /^migrate /));
+    expect(lines).toContain("done: Staging database and its gateway login ready");
+  });
+
+  it("a staging database that cannot be created stops the upgrade before migrations and any roll (#1329)", async () => {
+    const events: string[] = [];
+    const { deps, calls, lines } = upgradeDeps(events, {
+      overrides: [[/^sql databases list/, fail("PERMISSION_DENIED: no")]],
+    });
+    expect(await upgradeGcpInstall(TARGET, deps)).toBe(false);
+    expect(events.some((e) => e.startsWith("migrate"))).toBe(false);
+    expect(calls.filter((c) => APP_ROLL_WRITE.test(c))).toEqual([]);
+    expect(lines).toContain("failed: The staging database could not be set up. Aborting upgrade.");
+  });
+
   it("a refused public_role revoke stops the upgrade before migrations and any roll (#633)", async () => {
     const events: string[] = [];
     const { deps, calls, lines } = upgradeDeps(events, {
@@ -761,7 +844,7 @@ describe("upgradeGcpInstall — converge, then app-roll", () => {
     expect(events.some((e) => e.startsWith("migrate"))).toBe(false);
     expect(calls.filter((c) => APP_ROLL_WRITE.test(c))).toEqual([]);
     expect(lines).toContain(
-      "failed: public_role's role memberships could not be revoked. Aborting upgrade.",
+      "failed: The gateway logins' role memberships could not be revoked. Aborting upgrade.",
     );
   });
 

package/src/upgrade/upgrade.ts

@@ -57,6 +57,12 @@ export interface GcpUpgradeTarget {
   readonly domain: string;
   readonly stagingHost: string;
   readonly ownerEmail: string;
+  /**
+   * #1140 — install.json's `schedulerIntervalMinutes` (absent: the default).
+   * Bounded to 1–15 by the converge, so a tampered record can change only
+   * how soon due work runs.
+   */
+  readonly schedulerIntervalMinutes?: number;
   /** The tag rolled to: a version (`0.11.0`) or a channel tag (`latest`, `rc`). */
   readonly targetTag: string;
   /** The infrastructure contract version this CLI converges to (infra-contract.ts). */
@@ -276,6 +282,9 @@ export async function upgradeGcpInstallOutcome(
   const opsImageRef = await verifiedOpsImage(target, deps);
   const converge = startConverge(plan, target.ownerEmail, {
     opsImageRef,
+    ...(target.schedulerIntervalMinutes !== undefined
+      ? { schedulerIntervalMinutes: target.schedulerIntervalMinutes }
+      : {}),
     run,
     reporter: r,
     ...(deps.sleep ? { sleep: deps.sleep } : {}),

package/src/upgrader-gcp.ts

@@ -73,11 +73,12 @@ export async function upgraderDatabaseHost(
 
 /**
  * #1338 — the database host for the converge job (#819), after making sure
- * a verify-full connection to it can work. The job opens its database
- * queue before it converges anything, with this release's code, which
- * connects with verify-full only; on an install whose services still dial
- * the instance's IP it first runs the converge's database TLS step
+ * a verify-full connection to it can work. On an install whose services
+ * still dial the instance's IP it runs the converge's database TLS step
  * (cloudsql-tls.ts: shared CA, private DNS name, services moved onto it).
+ * Stage 2 of the job runs it as a timeline step, over a queue opened on
+ * the IP (converge-db-trust.ts, #1373), then reconnects on the host this
+ * returns.
  * The job runs as the install's `caelo-provisioner`, which holds
  * `roles/cloudsql.admin` and `roles/dns.admin` (gcloud.ts PROVISIONER_ROLES).
  * Idempotent: the converge's own step finds everything in shape.

package/src/upgrader-iam-preflight.ts

@@ -92,9 +92,9 @@ export interface AccessCheck {
   readonly permissions: readonly string[];
 }
 
-/** A check with the permissions it lacks. */
-export interface MissingAccess {
-  readonly check: AccessCheck;
+/** A check with the permissions it lacks (`C`: the caller's own check type, handed back as given). */
+export interface MissingAccess<C extends AccessCheck = AccessCheck> {
+  readonly check: C;
   readonly missing: readonly string[];
   /**
    * Permissions that could not be judged because another one is missing
@@ -114,9 +114,9 @@ export interface IamTester {
 }
 
 /** How the self-check came out. */
-export type PreflightOutcome =
+export type PreflightOutcome<C extends AccessCheck = AccessCheck> =
   | { readonly kind: "ok" }
-  | { readonly kind: "missing"; readonly missing: readonly MissingAccess[] }
+  | { readonly kind: "missing"; readonly missing: readonly MissingAccess<C>[] }
   /** IAM could not be asked about at least one resource; nothing was judged missing. */
   | { readonly kind: "error"; readonly errors: readonly string[] };
 
@@ -250,10 +250,10 @@ export function upgraderAccessChecks(target: {
 }
 
 /** Ask IAM about every check (one call per resource); never throws. */
-export async function runIamPreflight(
-  checks: readonly AccessCheck[],
+export async function runIamPreflight<C extends AccessCheck>(
+  checks: readonly C[],
   tester: IamTester,
-): Promise<PreflightOutcome> {
+): Promise<PreflightOutcome<C>> {
   // One question per resource: the project alone carries four checks.
   const byResource = new Map<string, { resource: IamResource; permissions: Set<string> }>();
   for (const c of checks) {
@@ -300,7 +300,7 @@ export async function runIamPreflight(
       }),
   );
   if (errors.length > 0) return { kind: "error", errors: errors.sort() };
-  const missing: MissingAccess[] = [];
+  const missing: MissingAccess<C>[] = [];
   for (const check of checks) {
     const key = resourceName(check.resource);
     const held = granted.get(key) ?? new Set<string>();
@@ -343,6 +343,11 @@ export function preflightMissingReason(
   missing: readonly MissingAccess[],
   voice: PreflightVoice,
 ): string {
+  return `Nothing was changed: ${voice.subject} checked its access before starting and is missing permissions this update needs — ${missingAccessText(missing)}. ${voice.repair}`;
+}
+
+/** Every missing permission with what it is for, as one clause list ("it cannot …; it cannot …"). */
+export function missingAccessText(missing: readonly MissingAccess[]): string {
   const lines = missing.map((m) => {
     const where = resourceName(m.check.resource);
     const parts = [
@@ -355,7 +360,7 @@ export function preflightMissingReason(
     ];
     return `it ${m.missing.length > 0 ? "cannot" : "may not be able to"} ${m.check.need} (${parts.join("; ")})`;
   });
-  return `Nothing was changed: ${voice.subject} checked its access before starting and is missing permissions this update needs — ${lines.join("; ")}. ${voice.repair}`;
+  return lines.join("; ");
 }
 
 /** The request's end reason when IAM could not be asked. */

package/src/wizard.ts

@@ -72,6 +72,13 @@ export interface WizardOptions {
    * install a different value is refused.
    */
   region?: string;
+  /**
+   * #1140 — `--scheduler-interval-minutes` (1–15, already validated): how
+   * often the scheduler tick calls the admin. Recorded in install.json, so
+   * every later `upgrade` keeps it; omitted keeps what is recorded (or the
+   * default, 5).
+   */
+  schedulerIntervalMinutes?: number;
   /**
    * #696 — where `pulumi up` and the rest of a GCP install run
    * (run-mode.ts): `job` (default in Cloud Shell) or `local`.
@@ -192,6 +199,18 @@ export async function runWizard(opts: WizardOptions = {}): Promise<void> {
     }
   }
 
+  // #1140 — the scheduler knob, on a new install and on a resumed one alike
+  // (every later `upgrade` reads it from install.json).
+  if (opts.schedulerIntervalMinutes !== undefined) {
+    const recorded = readMetadata(installId);
+    if (recorded) {
+      writeMetadata(installId, {
+        ...recorded,
+        schedulerIntervalMinutes: opts.schedulerIntervalMinutes,
+      });
+    }
+  }
+
   // 3.5. #656 — a re-run of an install an earlier CLI set up: drop the
   // secrets that CLI checkpointed (database passwords, the setup link)
   // before any step writes progress.json again, and say what to rotate.

package/src/wizards/gcp-cost.test.ts

@@ -7,7 +7,14 @@
  */
 
 import { describe, expect, it } from "bun:test";
-import { type CostEstimateInputs, estimateGcpCost } from "./gcp-cost.js";
+import { SERVICE_CPU_IDLE } from "../stack-contract.js";
+import {
+  adminKeptWarmByTicks,
+  alwaysOnAdminInstanceUsd,
+  type CostEstimateInputs,
+  estimateGcpCost,
+  schedulerTickMonthlyUsd,
+} from "./gcp-cost.js";
 
 const inputs: CostEstimateInputs = {
   cloudSqlTier: "db-f1-micro",
@@ -48,3 +55,49 @@ describe("cost table: MCP-Auth-Proxy (#1328)", () => {
     expect(names("gcp")).toContain("Cloud Run gateway");
   });
 });
+
+describe("cost table: scheduler tick (#1140)", () => {
+  it("lists the tick at the default 5 minutes: well under a dollar", () => {
+    const line = estimateGcpCost(inputs).lines.find((l) => l.name.startsWith("Scheduler tick"));
+    expect(line?.name).toBe("Scheduler tick (Cloud Scheduler + Workflows, every 5 min)");
+    // 8,640 ticks: 25,920 internal steps (20,920 billed) + 8,640 external
+    // (6,640 billed) + the scheduler job.
+    expect(line?.monthlyUsd).toBe(0.48);
+  });
+
+  it("follows the knob: one minute stays a few dollars, fifteen little more than the job", () => {
+    expect(schedulerTickMonthlyUsd(1)).toBe(2.38);
+    expect(schedulerTickMonthlyUsd(15)).toBe(0.16);
+    const fast = estimateGcpCost({ ...inputs, schedulerIntervalMinutes: 1 }).lines.find((l) =>
+      l.name.startsWith("Scheduler tick"),
+    );
+    expect(fast?.name).toContain("every 1 min");
+  });
+
+  it("prices the admin kept up around the clock while its CPU is always allocated (#1361)", () => {
+    // The tick (at most every 15 minutes) beats Cloud Run's 15-minute idle
+    // shutdown, so a scale-to-zero admin never stops.
+    expect(SERVICE_CPU_IDLE.admin).toBe(false);
+    expect(adminKeptWarmByTicks(0)).toBe(true);
+    // 2,592,000 s x (1 vCPU x $0.000018 + 2 GiB x $0.000002).
+    expect(alwaysOnAdminInstanceUsd(2)).toBe(57);
+    const admin = estimateGcpCost(inputs).lines.find((l) => l.name.startsWith("Cloud Run admin"));
+    expect(admin?.monthlyUsd).toBe(57);
+    expect(admin?.notes).toContain("around the clock");
+    expect(admin?.notes).toContain("#1361");
+  });
+
+  it("adds nothing on the admin with a min instance, which is up anyway", () => {
+    expect(adminKeptWarmByTicks(1)).toBe(false);
+    const admin = estimateGcpCost({ ...inputs, adminMinInstances: 1 }).lines.find((l) =>
+      l.name.startsWith("Cloud Run admin"),
+    );
+    expect(admin?.notes).toContain("the scheduler tick adds nothing");
+  });
+
+  it("refuses an interval outside 1-15 minutes", () => {
+    expect(() => estimateGcpCost({ ...inputs, schedulerIntervalMinutes: 20 })).toThrow(
+      "between 1 and 15",
+    );
+  });
+});