@caelo-cms/provisioning 0.11.10 → 0.11.12

package/src/wizards/gcp-cost.ts

@@ -11,7 +11,12 @@
  * + AI calls + storage growth on top.
  */
 
-import { ADMIN_MEMORY_DEFAULT, memoryQuantityMiB } from "../stack-contract.js";
+import {
+  ADMIN_MEMORY_DEFAULT,
+  memoryQuantityMiB,
+  parseSchedulerIntervalMinutes,
+  SERVICE_CPU_IDLE,
+} from "../stack-contract.js";
 
 export interface CostLine {
   name: string;
@@ -41,6 +46,82 @@ export interface CostEstimateInputs {
   provider?: "gcp" | "gcp-firebase";
   /** #607 — the install region; shown in the table (prices are {@link PRICED_REGION} rates). */
   region: string;
+  /** #1140 — the `schedulerIntervalMinutes` knob (1–15); undefined: the default. */
+  schedulerIntervalMinutes?: number;
+}
+
+/**
+ * #1140 — Workflows steps one scheduler tick costs (scheduler-setup.ts
+ * schedulerWorkflowSource): the claims `assign`, the signJwt call (a Google
+ * API, billed as an internal step), the `return` — and the POST to the
+ * admin, the one external HTTP step.
+ */
+export const SCHEDULER_TICK_STEPS = { internal: 3, external: 1 } as const;
+
+/**
+ * Workflows list prices (USD, cloud.google.com/workflows/pricing, as of
+ * 2026-11) and the monthly free tier per billing account.
+ */
+const WORKFLOWS_PRICE = {
+  internalPer1000: 0.01,
+  externalPer1000: 0.025,
+  freeInternal: 5_000,
+  freeExternal: 2_000,
+} as const;
+
+/** Cloud Scheduler: $0.10 per job a month; the first 3 per billing account are free. */
+const SCHEDULER_JOB_USD = 0.1;
+
+/**
+ * #1140 — what the scheduler tick costs a month at `minutes` between ticks:
+ * the Cloud Scheduler job (priced as paid — the 3 free jobs are shared
+ * with every other project on the billing account) plus the Workflows
+ * steps past the free tier. What the tick costs on the admin's side is
+ * priced on the admin's own line ({@link adminKeptWarmByTicks}).
+ */
+export function schedulerTickMonthlyUsd(minutes: number): number {
+  const ticks = Math.ceil((30 * 24 * 60) / parseSchedulerIntervalMinutes(minutes));
+  const internal = Math.max(
+    0,
+    ticks * SCHEDULER_TICK_STEPS.internal - WORKFLOWS_PRICE.freeInternal,
+  );
+  const external = Math.max(
+    0,
+    ticks * SCHEDULER_TICK_STEPS.external - WORKFLOWS_PRICE.freeExternal,
+  );
+  const usd =
+    SCHEDULER_JOB_USD +
+    (internal / 1000) * WORKFLOWS_PRICE.internalPer1000 +
+    (external / 1000) * WORKFLOWS_PRICE.externalPer1000;
+  return Math.round(usd * 100) / 100;
+}
+
+/**
+ * Cloud Run instance-based billing (CPU always allocated) list rates, USD,
+ * tier-1 region, cloud.google.com/run/pricing as of 2026-11. The free tier
+ * is left out: it is shared by every service on the billing account.
+ */
+const CLOUD_RUN_INSTANCE_PRICE = { vcpuSecond: 0.000018, gibSecond: 0.000002 } as const;
+
+/** Seconds in the 30-day month the table prices. */
+const MONTH_SECONDS = 30 * 24 * 60 * 60;
+
+/**
+ * #1140 — whether the scheduler tick keeps a scale-to-zero admin instance
+ * up around the clock. Cloud Run keeps an idle instance for up to 15
+ * minutes after its last request, and the tick comes at most every 15
+ * minutes, so with CPU always allocated (`SERVICE_CPU_IDLE.admin` false
+ * until #1361) the instance never stops and is billed every second. With
+ * request-billed CPU an idle instance costs nothing between ticks.
+ */
+export function adminKeptWarmByTicks(adminMinInstances: number): boolean {
+  return adminMinInstances === 0 && !SERVICE_CPU_IDLE.admin;
+}
+
+/** One always-on admin instance (1 vCPU, `gib` memory) a month at instance-based list rates. */
+export function alwaysOnAdminInstanceUsd(gib: number): number {
+  const perSecond = CLOUD_RUN_INSTANCE_PRICE.vcpuSecond + gib * CLOUD_RUN_INSTANCE_PRICE.gibSecond;
+  return Math.round(perSecond * MONTH_SECONDS);
 }
 
 /** The region the price table's list rates are for. */
@@ -71,6 +152,7 @@ export function estimateGcpCost(inputs: CostEstimateInputs): {
   const sqlMonthly = Math.round(sqlBase * sqlMultiplier);
 
   const provider = inputs.provider ?? "gcp";
+  const schedulerMinutes = parseSchedulerIntervalMinutes(inputs.schedulerIntervalMinutes);
   const adminMemory = inputs.adminMemory ?? ADMIN_MEMORY_DEFAULT;
   const adminMiB = memoryQuantityMiB(adminMemory);
   if (adminMiB === null) {
@@ -91,23 +173,26 @@ export function estimateGcpCost(inputs: CostEstimateInputs): {
     },
     {
       name: `Cloud Run admin (${adminMemory})`,
-      // FIXME(issue #1140): ~$1 once the admin runs request-billed CPU
-      // (SERVICE_CPU_IDLE). Until then each editing session is billed for
-      // as long as the instance stays up, ~15 minutes past its last request.
-      monthlyUsd:
-        inputs.adminMinInstances === 0
+      // FIXME(issue #1361): with request-billed CPU (SERVICE_CPU_IDLE) the
+      // ticks stop keeping the instance up and this line drops to ~$7 of
+      // editing sessions. Until then the scheduler tick (#1140) keeps one
+      // instance up around the clock, billed at the always-on rate.
+      monthlyUsd: adminKeptWarmByTicks(inputs.adminMinInstances)
+        ? alwaysOnAdminInstanceUsd(adminGiB)
+        : inputs.adminMinInstances === 0
           ? 7
           : Math.round(1 + inputs.adminMinInstances * perMinInstanceUsd),
-      notes:
-        inputs.adminMinInstances === 0
-          ? "scale-to-zero, CPU always allocated while running; ~$7/mo light editorial use"
-          : `${inputs.adminMinInstances} min-instance${inputs.adminMinInstances > 1 ? "s" : ""} (no cold start)`,
+      notes: adminKeptWarmByTicks(inputs.adminMinInstances)
+        ? `scale-to-zero, but CPU is always allocated and the scheduler tick (every ${schedulerMinutes} min) comes before Cloud Run's 15-minute idle shutdown, so one instance (1 vCPU, ${adminMemory}) runs around the clock until request-billed CPU lands (#1361)`
+        : inputs.adminMinInstances === 0
+          ? "scale-to-zero, request-billed CPU; ~$7/mo light editorial use, ticks inside the free tier"
+          : `${inputs.adminMinInstances} min-instance${inputs.adminMinInstances > 1 ? "s" : ""} (no cold start); the scheduler tick adds nothing, the instance is up anyway`,
     },
     {
       name: "Quality checks (Cloud Run audit job)",
       monthlyUsd: 2,
       notes:
-        "one container per Lighthouse run, all in parallel (up to 5 pages x 3 runs, ~90 s at 2 vCPU each): ~$0.05 per audited Stage, partly in the free tier; results bucket ~$0",
+        "one container per Lighthouse run, all in parallel (up to 5 pages x 3 runs, ~90 s at 2 vCPU each; a page whose runs disagree gets 2 more): ~$0.05 per audited Stage, at most ~$0.08, partly in the free tier; results bucket ~$0",
     },
     {
       name: "Screenshots (Cloud Run capture job)",
@@ -192,7 +277,7 @@ export function estimateGcpCost(inputs: CostEstimateInputs): {
       name: "Secret Manager (runtime secrets)",
       monthlyUsd: 0.2,
       notes:
-        "6 active versions free, then ~$0.06 each; the Google sign-in client (#914) and the remote-MCP seal key (#806)",
+        "6 active versions free, then ~$0.06 each; the Google sign-in client (#914), the remote-MCP seal key (#806) and the staging database login's password (#1329; the staging database itself shares the Cloud SQL instance at no extra cost)",
     },
     {
       name: "BigQuery edge log sink",
@@ -211,6 +296,11 @@ export function estimateGcpCost(inputs: CostEstimateInputs): {
       notes:
         "Hourly ~20 s job keeps Google IAP in step with the user list; within the Cloud Run free tier, 1 of 3 free scheduler jobs",
     },
+    {
+      name: `Scheduler tick (Cloud Scheduler + Workflows, every ${schedulerMinutes} min)`,
+      monthlyUsd: schedulerTickMonthlyUsd(schedulerMinutes),
+      notes: `one job starts a ${SCHEDULER_TICK_STEPS.internal + SCHEDULER_TICK_STEPS.external}-step workflow that calls the admin's periodic work and plugin workers; ~${Math.ceil((30 * 24 * 60) / schedulerMinutes)} ticks/mo; what the ticks cost on the admin is on the admin line`,
+    },
   ];
 
   // Cents, so a sub-dollar line (the KMS key) doesn't print float noise.

package/src/wizards/gcp.ts

@@ -68,7 +68,11 @@ import {
   REQUIRED_API_LIST,
   serviceAccountExists,
 } from "../gcloud.js";
-import { GCP_STACK_ENV, upgraderServiceAccountEmail } from "../gcp-names.js";
+import {
+  GCP_STACK_ENV,
+  schedulerServiceAccountEmail,
+  upgraderServiceAccountEmail,
+} from "../gcp-names.js";
 import { INFRA_CONTRACT_VERSION } from "../infra-contract.js";
 import {
   INSTALL_JOB_NAME,
@@ -116,10 +120,12 @@ import {
   resolveStackRemoteMcpIdentity,
 } from "../remote-mcp.js";
 import type { RunMode } from "../run-mode.js";
+import { ensureSchedulerTick } from "../scheduler-setup.js";
 import { selfCommand } from "../self-command.js";
 import {
   ABSENT_DEFAULT_FIREWALL_RULES,
   cloudSqlPrivateDnsName,
+  parseSchedulerIntervalMinutes,
   type RemoteMcpIdentity,
   sameRemoteMcpIdentity,
 } from "../stack-contract.js";
@@ -234,7 +240,15 @@ export async function runGcpWizard(opts: GcpWizardOpts): Promise<void> {
   // drops the LB / Cloud CDN / Cloud Armor lines (saves ~$19/mo
   // vs gcp). Default 'gcp' for backwards compatibility with
   // installs that don't set the field.
-  const estimate = estimateGcpCost({ ...GCP_STACK_KNOB_DEFAULTS, provider, region });
+  const estimate = estimateGcpCost({
+    ...GCP_STACK_KNOB_DEFAULTS,
+    provider,
+    region,
+    // #1140 — the tick's line follows the knob the wizard recorded.
+    ...(meta?.schedulerIntervalMinutes !== undefined
+      ? { schedulerIntervalMinutes: meta.schedulerIntervalMinutes }
+      : {}),
+  });
   note(
     [
       bold(
@@ -523,6 +537,18 @@ export async function runGcpConverge(opts: GcpConvergeOpts): Promise<void> {
   // === 11.45. The converge job: releases that change the cloud setup (#819) ===
   const convergeReady = await stepConvergeJob(projectId, region, releaseVersion);
 
+  // === 11.47. The scheduler tick: periodic work + plugin workers (#1140) ===
+  // Before operator access, which keeps the scheduler's account on IAP.
+  const schedulerReady = await stepSchedulerTick(
+    projectId,
+    region,
+    provider,
+    ownerEmail,
+    identity?.identity.adminUrl ?? null,
+    meta.schedulerIntervalMinutes,
+  );
+  const keepScheduler = schedulerReady || (await schedulerExists(projectId));
+
   // === 11.5. Operator access: IAP follows the Caelo user list ===
   await stepOperatorAccessSync(
     projectId,
@@ -530,6 +556,7 @@ export async function runGcpConverge(opts: GcpConvergeOpts): Promise<void> {
     provider,
     ownerEmail,
     keepSigner ? [`serviceAccount:${upgraderServiceAccountEmail(projectId, GCP_STACK_ENV)}`] : [],
+    keepScheduler ? [schedulerServiceAccountEmail(projectId, GCP_STACK_ENV)] : [],
   );
 
   // === 11.6. Remote MCP (#806): LB rules (gcp) + a check of the identity env ===
@@ -546,9 +573,10 @@ export async function runGcpConverge(opts: GcpConvergeOpts): Promise<void> {
   // A fresh install ran every converge step above, so it is at this CLI's
   // infrastructure contract — recorded only when the upgrader and the
   // converge job are in place (the steps contract bumps 2 and 9 added) and
-  // remote MCP's steps (#806, bump 10) succeeded. With the release version,
-  // the admin can install the next update itself.
-  if (upgraderReady && convergeReady && remoteMcpReady) {
+  // remote MCP's steps (#806, bump 10) and the scheduler tick (#1140, bump
+  // 18) succeeded. With the release version, the admin can install the next
+  // update itself.
+  if (upgraderReady && convergeReady && remoteMcpReady && schedulerReady) {
     const version = releaseVersion;
     // #1025 — the linux/amd64 forms Cloud Run reports, next to the indexes,
     // so the upgrader recognises what serves without a registry lookup.
@@ -998,7 +1026,7 @@ async function stepGrantBaseRoles(
  */
 async function stepPublicRoleIsolation(projectId: string): Promise<void> {
   const s = spinner();
-  s.start("Removing public_role from the Cloud SQL superuser group...");
+  s.start("Removing the gateway logins from the Cloud SQL superuser group...");
   const r = await revokePublicRoleMemberships({
     projectId,
     env: GCP_STACK_ENV,
@@ -1010,7 +1038,7 @@ async function stepPublicRoleIsolation(projectId: string): Promise<void> {
     cancel("Aborted.");
     process.exit(1);
   }
-  s.stop(green("public_role holds no database roles"));
+  s.stop(green("The gateway logins (public_role, public_staging_role) hold no database roles"));
 }
 
 /**
@@ -1216,6 +1244,78 @@ async function upgraderExists(projectId: string): Promise<boolean> {
   return r.ok;
 }
 
+/** Whether the scheduler tick's account exists from an earlier run (it keeps its IAP access). */
+async function schedulerExists(projectId: string): Promise<boolean> {
+  const r = await gcloud([
+    "iam",
+    "service-accounts",
+    "describe",
+    schedulerServiceAccountEmail(projectId, GCP_STACK_ENV),
+    `--project=${projectId}`,
+    "--format=value(email)",
+  ]);
+  return r.ok;
+}
+
+/**
+ * #1140 — set up the scheduler tick (scheduler-setup.ts): the one Cloud
+ * Scheduler job that calls the admin's tick every `schedulerIntervalMinutes`
+ * through IAP. After migrations (the admin answers the tick once its tables
+ * exist) and before operator access. Not fatal: the site works without it,
+ * but plugin workers, update checks and clean-up do not run, so a failure
+ * warns loudly and the install is not recorded at this contract — the next
+ * wizard pass or `upgrade` retries. Idempotent.
+ *
+ * @returns whether the tick is in place
+ */
+async function stepSchedulerTick(
+  projectId: string,
+  region: string,
+  provider: "gcp" | "gcp-firebase",
+  ownerEmail: string,
+  adminUrl: string | null,
+  recordedInterval: number | undefined,
+): Promise<boolean> {
+  const s = spinner();
+  s.start("Setting up the scheduler tick (periodic work and plugin workers)...");
+  const failed = (error: string) => {
+    s.stop(yellow(`Scheduler tick not set up: ${error}`));
+    log.warn(
+      `The install works, but plugin workers (newsletter sends, rating aggregates), update checks and clean-up do not run until this succeeds. Re-run the installer or ${bold(selfCommand("upgrade"))} once the cause is fixed.`,
+    );
+    return false;
+  };
+  let intervalMinutes: number;
+  try {
+    intervalMinutes = parseSchedulerIntervalMinutes(
+      recordedInterval,
+      "install.json schedulerIntervalMinutes",
+    );
+  } catch (e) {
+    return failed((e as Error).message);
+  }
+  if (!adminUrl) return failed("the admin's URL could not be read (see the remote-MCP step above)");
+  const resolved = await resolveOperatorAccessTarget({
+    provider,
+    projectId,
+    region,
+    env: GCP_STACK_ENV,
+    ownerEmail,
+  });
+  if (!resolved.ok) return failed(resolved.error);
+  const r = await ensureSchedulerTick({
+    projectId,
+    region,
+    env: GCP_STACK_ENV,
+    adminUrl,
+    resource: resolved.target.resource,
+    intervalMinutes,
+  });
+  if (!r.ok) return failed(r.error);
+  s.stop(green(`Scheduler tick ready (every ${intervalMinutes} min, ${r.done.length} steps)`));
+  return true;
+}
+
 /**
  * Set up the operator-access sync job (operator-access.ts): the only
  * principal that may change who passes IAP, run as the operator's gcloud
@@ -1228,6 +1328,7 @@ async function stepOperatorAccessSync(
   provider: "gcp" | "gcp-firebase",
   ownerEmail: string,
   mcpSigners: readonly string[],
+  iapServiceAccounts: readonly string[],
 ): Promise<void> {
   const s = spinner();
   s.start("Setting up the operator-access sync job (Google IAP follows the user list)...");
@@ -1239,7 +1340,7 @@ async function stepOperatorAccessSync(
     ownerEmail,
   });
   const r = resolved.ok
-    ? await ensureOperatorAccessSync({ ...resolved.target, mcpSigners })
+    ? await ensureOperatorAccessSync({ ...resolved.target, mcpSigners, iapServiceAccounts })
     : { ok: false as const, done: [], error: resolved.error };
   if (!r.ok) {
     s.stop(red(`Failed: ${r.error}`));

package/stacks/aws/Pulumi.yaml

@@ -34,7 +34,7 @@ config:
     description: RDS max_connections (parameter group); every service's pool size is computed from it (docs/dev/connection-budget.md).
   caelo-aws:adminMaxInstances:
     type: string
-    default: "5"
+    default: "4"
     description: Most admin tasks at once; part of the connection budget.
   caelo-aws:gatewayMaxInstances:
     type: string

package/stacks/aws/index.ts

@@ -44,8 +44,10 @@ import {
 } from "../../dist/aws-task-roles.js";
 import { generateBootstrapToken } from "../../dist/bootstrap-token.js";
 import {
+  DEFAULT_ADMIN_MAX_INSTANCES,
   DEFAULT_GATEWAY_MAX_INSTANCES,
   DEFAULT_MAX_CONNECTIONS,
+  DEFAULT_STAGING_GATEWAY_MAX_INSTANCES,
   stackPoolBudget,
 } from "../../dist/pool-budget-stack.js";
 import { ADMIN_MEMORY_DEFAULT, memoryQuantityMiB } from "../../dist/stack-contract.js";
@@ -86,7 +88,10 @@ const maxConnections = Number.parseInt(
   cfg.get("maxConnections") ?? String(DEFAULT_MAX_CONNECTIONS.aws),
   10,
 );
-const adminMaxInstances = Number.parseInt(cfg.get("adminMaxInstances") ?? "5", 10);
+const adminMaxInstances = Number.parseInt(
+  cfg.get("adminMaxInstances") ?? String(DEFAULT_ADMIN_MAX_INSTANCES),
+  10,
+);
 const gatewayMaxInstances = Number.parseInt(
   cfg.get("gatewayMaxInstances") ?? String(DEFAULT_GATEWAY_MAX_INSTANCES),
   10,
@@ -95,6 +100,8 @@ const poolBudget = stackPoolBudget("aws", {
   maxConnections,
   adminMaxInstances,
   gatewayMaxInstances,
+  // #1329 — the staging gateway joins the budget with the staging database.
+  stagingGatewayMaxInstances: DEFAULT_STAGING_GATEWAY_MAX_INSTANCES,
 });
 if (_adminMemoryMiB === null) {
   throw new Error(`caelo-aws:adminMemory "${adminMemory}" is not a memory quantity (e.g. 2Gi)`);
@@ -131,6 +138,9 @@ const postgresPassword = pulumi.secret(randomHex(32));
 // #635) never holds admin_role's. bootstrap.sh creates the roles with these
 // (ADMIN_ROLE_PASSWORD / PUBLIC_ROLE_PASSWORD).
 const publicRolePassword = pulumi.secret(randomHex(32));
+// #1329 — the staging gateway's own login on cms_public_staging (created
+// with the database by bootstrap.sh, PUBLIC_STAGING_ROLE_PASSWORD).
+const publicStagingRolePassword = pulumi.secret(randomHex(32));
 const csrfSecret = pulumi.secret(randomHex(32));
 const cookieSecret = pulumi.secret(randomHex(32));
 const anthropicApiKey = pulumi.secret(process.env.ANTHROPIC_API_KEY ?? "");
@@ -151,6 +161,8 @@ function secret(name: string, value: pulumi.Output<string>): aws.secretsmanager.
 
 const pgSecret = secret("postgres-password", postgresPassword);
 const publicRoleSecret = secret("public-role-password", publicRolePassword);
+// #1329 — read by nothing yet: the staging gateway's task (#749) will.
+const _publicStagingRoleSecret = secret("public-staging-role-password", publicStagingRolePassword);
 const csrfSecretRes = secret("csrf-secret", csrfSecret);
 const cookieSecretRes = secret("cookie-secret", cookieSecret);
 const anthropicSecretRes = secret("anthropic-api-key", anthropicApiKey);
@@ -213,6 +225,20 @@ const publicDatabaseUrl = pulumi
   .apply(
     ([host, port, pw]) => `postgresql://public_role:${pw}@${host}:${port}/cms_public?${RDS_TLS}`,
   );
+// #1329 — the admin's pool on the staging database, and the staging
+// gateway's only login (no task definition reads them before #749).
+const publicStagingAdminDatabaseUrl = pulumi
+  .all([db.address, db.port, postgresPassword])
+  .apply(
+    ([host, port, pw]) =>
+      `postgresql://caelo_admin:${pw}@${host}:${port}/cms_public_staging?${RDS_TLS}`,
+  );
+const publicStagingDatabaseUrl = pulumi
+  .all([db.address, db.port, publicStagingRolePassword])
+  .apply(
+    ([host, port, pw]) =>
+      `postgresql://public_staging_role:${pw}@${host}:${port}/cms_public_staging?${RDS_TLS}`,
+  );
 
 // === 4. S3 buckets ===
 const mediaBucket = new aws.s3.BucketV2(`${namePrefix}-media`, {
@@ -449,6 +475,16 @@ new aws.cloudwatch.LogDelivery(
 // refuses every server-side render with that gap
 // (capture/capture-backend.ts) instead of running a browser in its own task.
 //
+// FIXME(issue #749): no scheduler tick yet (#1140). On GCP one Cloud
+// Scheduler job calls the admin's /api/internal/scheduler/tick every
+// `schedulerIntervalMinutes` (src/scheduler-setup.ts), and the admin runs
+// its periodic work and plugin workers only on that tick; self-hosted has a
+// scheduler container. The AWS equivalent is one EventBridge Scheduler
+// schedule that runs a small Fargate task (or Lambda) POSTing the same
+// endpoint through the ALB's Cognito gate, with the same 1–15 minute knob.
+// Nothing calls the tick here because no admin task exists on AWS yet; it
+// lands with the admin task in #749.
+//
 // FIXME(issue #696): no in-cloud upgrader or converge job (#819) yet. On
 // GCP Settings → Updates hands app-roll releases to the upgrader job and
 // cloud-setup releases to the converge job; on AWS the admin refuses a
@@ -551,6 +587,7 @@ const dnsRecordsRequired: DnsRecord[] = [
 const out: CloudAdapterOutputs = {
   adminDatabaseUrl: adminDatabaseUrl as unknown as string,
   publicDatabaseUrl: publicDatabaseUrl as unknown as string,
+  publicStagingDatabaseUrl: publicStagingDatabaseUrl as unknown as string,
   mediaStorageUrl: pulumi.interpolate`s3://${mediaBucket.bucket}` as unknown as string,
   mediaCdnBaseUrl:
     pulumi.interpolate`https://${distribution.domainName}/media` as unknown as string,
@@ -565,6 +602,9 @@ const out: CloudAdapterOutputs = {
 
 export const adminDatabaseUrlOut = out.adminDatabaseUrl;
 export const publicDatabaseUrlOut = out.publicDatabaseUrl;
+export const publicStagingDatabaseUrlOut = out.publicStagingDatabaseUrl;
+// #1329 — what the admin task definition (#749) sets as PUBLIC_STAGING_ADMIN_DATABASE_URL.
+export const publicStagingAdminDatabaseUrlOut = publicStagingAdminDatabaseUrl;
 export const mediaStorageUrlOut = out.mediaStorageUrl;
 export const mediaCdnBaseUrlOut = out.mediaCdnBaseUrl;
 export const bootstrapUrlOut = out.bootstrapUrl;

package/stacks/azure/index.ts

@@ -41,10 +41,15 @@ import * as pulumi from "@pulumi/pulumi";
 import type { CloudAdapterOutputs, DnsRecord } from "../../dist/adapter.js";
 import { azureFrontDoorDnsRecords } from "../../dist/azure-front-door.js";
 import { generateBootstrapToken } from "../../dist/bootstrap-token.js";
-import { DEFAULT_MAX_CONNECTIONS, stackPoolBudget } from "../../dist/pool-budget-stack.js";
+import {
+  DEFAULT_MAX_CONNECTIONS,
+  DEFAULT_STAGING_GATEWAY_MAX_INSTANCES,
+  stackPoolBudget,
+} from "../../dist/pool-budget-stack.js";
 import {
   ADMIN_MEMORY_DEFAULT,
   azureContainerAppResources,
+  GATEWAY_ENVIRONMENT_ENV,
   GATEWAY_TRUSTED_PROXY_HOPS,
   MCP_AUTH_PROXY_TRUSTED_PROXY_HOPS,
   REMOTE_MCP_MODE,
@@ -88,6 +93,8 @@ const poolBudget = stackPoolBudget("azure", {
   maxConnections,
   adminMaxInstances: ADMIN_SIDE_APPS * MAX_REPLICAS,
   gatewayMaxInstances: MAX_REPLICAS,
+  // #1329 — the staging gateway joins the budget with the staging database.
+  stagingGatewayMaxInstances: DEFAULT_STAGING_GATEWAY_MAX_INSTANCES,
 });
 // #553 — the admin runs the Lighthouse quality audit; same knob + default
 // as every adapter (stack-contract.ts). Container Apps only accepts fixed
@@ -116,6 +123,9 @@ const postgresPassword = pulumi.secret(randomHex(32));
 // #635) never holds admin_role's. bootstrap.sh creates the roles with these
 // (ADMIN_ROLE_PASSWORD / PUBLIC_ROLE_PASSWORD).
 const publicRolePassword = pulumi.secret(randomHex(32));
+// #1329 — the staging gateway's own login on cms_public_staging (created
+// with the database by bootstrap.sh, PUBLIC_STAGING_ROLE_PASSWORD).
+const publicStagingRolePassword = pulumi.secret(randomHex(32));
 const csrfSecret = pulumi.secret(randomHex(32));
 const cookieSecret = pulumi.secret(randomHex(32));
 const anthropicApiKey = pulumi.secret(process.env.ANTHROPIC_API_KEY ?? "");
@@ -145,6 +155,8 @@ function keyVaultSecret(shortName: string, value: pulumi.Output<string>): azure.
 
 const _pgSecret = keyVaultSecret("pg-password", postgresPassword);
 keyVaultSecret("public-role-password", publicRolePassword);
+// #1329 — read by nothing yet: the staging gateway's app (#750) will.
+keyVaultSecret("public-staging-role-password", publicStagingRolePassword);
 keyVaultSecret("csrf-secret", csrfSecret);
 keyVaultSecret("cookie-secret", cookieSecret);
 keyVaultSecret("anthropic-api-key", anthropicApiKey);
@@ -195,6 +207,13 @@ const _pgPublic = new azure.dbforpostgresql.Database(`${namePrefix}-cms-public-d
   databaseName: "cms_public",
   charset: "UTF8",
 });
+// #1329 — staging's own data, the twin of cms_public on the same server.
+const _pgPublicStaging = new azure.dbforpostgresql.Database(`${namePrefix}-cms-public-staging-db`, {
+  resourceGroupName: rg.name,
+  serverName: pgServer.name,
+  databaseName: "cms_public_staging",
+  charset: "UTF8",
+});
 
 // #1338 — verify-full to the server's FQDN. Flexible Server's certificate chains
 // to public roots (DigiCert Global Root G2, Microsoft RSA Root CA 2017) that
@@ -213,6 +232,19 @@ const publicAdminDatabaseUrl = pulumi
 const publicDatabaseUrl = pulumi
   .all([pgServer.fullyQualifiedDomainName, publicRolePassword])
   .apply(([host, pw]) => `postgresql://public_role:${pw}@${host}:5432/cms_public?${AZURE_TLS}`);
+// #1329 — the admin's pool on the staging database (plugin schemas, the
+// staging half of the projection), and the staging gateway's only login.
+const publicStagingAdminDatabaseUrl = pulumi
+  .all([pgServer.fullyQualifiedDomainName, postgresPassword])
+  .apply(
+    ([host, pw]) => `postgresql://caelo_admin:${pw}@${host}:5432/cms_public_staging?${AZURE_TLS}`,
+  );
+const publicStagingDatabaseUrl = pulumi
+  .all([pgServer.fullyQualifiedDomainName, publicStagingRolePassword])
+  .apply(
+    ([host, pw]) =>
+      `postgresql://public_staging_role:${pw}@${host}:5432/cms_public_staging?${AZURE_TLS}`,
+  );
 
 // === 4. Storage account + containers ===
 const storage = new azure.storage.StorageAccount(`${namePrefix}-st`, {
@@ -409,6 +441,15 @@ const logWorkspace = new azure.operationalinsights.Workspace(`${namePrefix}-logs
 // refuses every server-side render with that gap
 // (capture/capture-backend.ts) instead of running a browser in its own app.
 //
+// FIXME(issue #750): no scheduler tick yet (#1140). On GCP one Cloud
+// Scheduler job calls the admin's /api/internal/scheduler/tick every
+// `schedulerIntervalMinutes` (src/scheduler-setup.ts), and the admin runs
+// its periodic work and plugin workers only on that tick; self-hosted has a
+// scheduler container. The Azure equivalent is a scheduled Container Apps
+// job (or Logic App recurrence) POSTing the same endpoint behind Easy Auth,
+// with the same 1–15 minute knob. Nothing calls the tick here because no
+// admin app exists on Azure yet; it lands with the admin in #750.
+//
 // FIXME(issue #696): no in-cloud upgrader or converge job (#819) yet. On
 // GCP Settings → Updates hands app-roll releases to the upgrader job and
 // cloud-setup releases to the converge job; on Azure the admin refuses a
@@ -503,6 +544,7 @@ function containerApp(args: ContainerAppArgs): azure.app.ContainerApp {
 const adminDatabaseEnv = [
   { name: "ADMIN_DATABASE_URL", value: adminDatabaseUrl },
   { name: "PUBLIC_ADMIN_DATABASE_URL", value: publicAdminDatabaseUrl },
+  { name: "PUBLIC_STAGING_ADMIN_DATABASE_URL", value: publicStagingAdminDatabaseUrl },
   ...poolBudget.env.admin,
 ];
 const adminApp = containerApp({
@@ -519,8 +561,12 @@ const _gatewayApp = containerApp({
     { name: "PUBLIC_DATABASE_URL", value: publicDatabaseUrl },
     ...poolBudget.env.gateway,
   ],
-  // Which X-Forwarded-For entry is the visitor (api-gateway client-ip.ts).
-  extraEnv: [{ name: TRUSTED_PROXY_HOPS_ENV, value: String(GATEWAY_TRUSTED_PROXY_HOPS.azure) }],
+  // Which X-Forwarded-For entry is the visitor (api-gateway client-ip.ts),
+  // and (#1329) that this is the live site's gateway.
+  extraEnv: [
+    { name: TRUSTED_PROXY_HOPS_ENV, value: String(GATEWAY_TRUSTED_PROXY_HOPS.azure) },
+    { name: GATEWAY_ENVIRONMENT_ENV, value: "live" },
+  ],
 });
 // #1328 — the MCP-Auth-Proxy, its own Container App and so its own FQDN:
 // remote MCP's sign-in pages never share an origin with the site's module
@@ -565,6 +611,7 @@ const dnsRecordsRequired = pulumi
 const out: CloudAdapterOutputs = {
   adminDatabaseUrl: adminDatabaseUrl as unknown as string,
   publicDatabaseUrl: publicDatabaseUrl as unknown as string,
+  publicStagingDatabaseUrl: publicStagingDatabaseUrl as unknown as string,
   mediaStorageUrl:
     pulumi.interpolate`https://${storage.name}.blob.core.windows.net/media` as unknown as string,
   mediaCdnBaseUrl: pulumi.interpolate`https://${domain}/media` as unknown as string,
@@ -578,6 +625,7 @@ const out: CloudAdapterOutputs = {
 
 export const adminDatabaseUrlOut = out.adminDatabaseUrl;
 export const publicDatabaseUrlOut = out.publicDatabaseUrl;
+export const publicStagingDatabaseUrlOut = out.publicStagingDatabaseUrl;
 export const mediaStorageUrlOut = out.mediaStorageUrl;
 export const mediaCdnBaseUrlOut = out.mediaCdnBaseUrl;
 export const bootstrapUrlOut = out.bootstrapUrl;

package/stacks/gcp/Pulumi.yaml

@@ -55,7 +55,7 @@ config:
     description: Admin Cloud Run memory. 2Gi leaves room for the Lighthouse quality audit next to editor requests; billed only while an instance runs.
   caelo-gcp:adminMaxInstances:
     type: string
-    default: "5"
+    default: "4"
     description: |
       Admin Cloud Run max instances. Each instance gets an equal share of
       the connection budget (docs/dev/connection-budget.md): at the

package/stacks/gcp/README.md

@@ -12,6 +12,7 @@ Pulumi stack provisioning Caelo on GCP managed services. Implements the shared `
 | Container runtime | Four Cloud Run services (admin / gateway / orchestrator / runner) |
 | Secret store | Secret Manager: postgres-password (admin_role) + secret-kek (Pulumi); internal-secret, tool-approval-secret and public-role-password (created by the CLI before `pulumi up`, see `src/runtime-secrets.ts`). Cloud Run reads each as a `secretKeyRef`; database URLs carry no password. The gateway's service account reads only `public-role-password` (#613, #635: the gateway has no cms_admin login). |
 | Edge-log sink | Cloud Logging project sink → BigQuery dataset `<env>_edge_logs` (queryable by P12A analytics plugin) |
+| Scheduler tick (CLI-owned, #1140) | One Cloud Scheduler job `caelo-<env>-scheduler-tick` starts the Workflows workflow of the same name every `schedulerIntervalMinutes` (1–15, default 5; `--scheduler-interval-minutes` on the installer, recorded in install.json). The workflow signs an IAP credential as `caelo-<env>-scheduler` and POSTs the admin's `/api/internal/scheduler/tick`, which runs the due periodic work and plugin workers. Set up by the installer and `upgrade` (`src/scheduler-setup.ts`), not by this stack. |
 
 The Caelo runtime never knows it's on GCP — every Cloud Run service consumes plain `DATABASE_URL` / `MEDIA_STORAGE_URL` / `SECRETS_PROVIDER` env vars.