@caelo-cms/provisioning 0.11.12 → 0.11.14

package/src/lifecycle.ts

@@ -69,12 +69,7 @@ import {
   resolveBackend,
 } from "./state-backend.js";
 import { acquireStateLock, realSyncGcloud, releaseOnSignal } from "./state-store.js";
-import {
-  type AppRollPlan,
-  type ReleaseImage,
-  ROLL_ORDER,
-  type RollSlug,
-} from "./upgrade/app-roll.js";
+import type { AppRollPlan, RollSlug } from "./upgrade/app-roll.js";
 import { restoreCommand, takeSqlBackup } from "./upgrade/backup.js";
 import { findServiceUrl, lookupFailure, resolveGcpResourceName } from "./upgrade/gcp-lookup.js";
 import { createIapHealthProbe, type HealthProbe } from "./upgrade/health.js";
@@ -84,12 +79,10 @@ import {
   canonicalReleaseTag,
   ensureCosignAvailable,
   fetchLatestReleaseTag,
-  RELEASE_REGISTRY,
-  releaseImageRef,
   releaseTag,
   releaseVersionForDigest,
   resolveOpsImageRef,
-  resolveTagDigest,
+  resolveReleaseImages,
   verifyCosignAll,
 } from "./upgrade/release-images.js";
 import { clackReporter } from "./upgrade/reporter.js";
@@ -463,32 +456,6 @@ export async function upgradeCommand(opts: UpgradeOpts = {}): Promise<void> {
   );
 }
 
-/**
- * Resolve both release images' digests from the public registry. Via the
- * registry's anonymous V2 API, not `gcloud artifacts docker tags list`: that
- * needs IAM read on Caelo's registry project, which operators don't have.
- */
-async function resolveReleaseImages(
-  tag: string,
-): Promise<{ ok: true; images: Record<RollSlug, ReleaseImage> } | { ok: false; error: string }> {
-  const images: Partial<Record<RollSlug, ReleaseImage>> = {};
-  for (const slug of ROLL_ORDER) {
-    const res = await resolveTagDigest(slug, tag);
-    if (!res.ok) {
-      const r = RELEASE_REGISTRY;
-      return {
-        ok: false,
-        error:
-          `Couldn't resolve image digest for ${slug}:${tag}: the public registry returned ${res.reason}.\n` +
-          `Verify the tag exists at https://${r.region}-docker.pkg.dev/${r.project}/${r.repo}/${slug}:${tag}\n` +
-          "(latest releases live at https://github.com/caelo-cms/caelo-cms/releases — pass --version vX.Y.Z to pin.)",
-      };
-    }
-    images[slug] = { digest: res.digest, imageRef: releaseImageRef(slug, res.digest) };
-  }
-  return { ok: true, images: images as Record<RollSlug, ReleaseImage> };
-}
-
 /**
  * `upgrade`'s step of the keyless provisioner migration (#696,
  * provisioner-identity.ts) — a converge step (upgrade/converge.ts runs it
@@ -685,12 +652,11 @@ async function upgradeLockedInstall(
   // #696 — upgrade never moves Pulumi state; it says how to.
   const stateNotice = localStateNotice(meta);
   if (stateNotice) note(stateNotice, "Pulumi state is on this machine");
-  if (ok && provider === "gcp-firebase") {
-    // #650 — staging builds now render the staging host; the gateway
-    // serves it once it is mapped. The command is idempotent, so this
-    // reminder is safe to repeat on every upgrade.
+  if (ok) {
+    // #1330 — the converge routed the staging host to the staging gateway
+    // and printed its DNS records (Settings → Updates shows them as well).
     log.info(
-      `Protected staging site: run ${bold("cms-provision staging-domain enable")} once to serve the staging host (it maps the host the admin uses — ${bold(stagingHost)} unless changed there —, turns on password protection, prints the login and the DNS record). Host and access: admin → Settings → Domains / Staging access.`,
+      `Protected staging site: https://${stagingHost}/ — served by the staging gateway behind the staging gate. Password protection and other access: admin → Settings → Staging access (or ${bold("cms-provision staging-domain enable")}).`,
     );
   }
   return ok;

package/src/mcp-auth-proxy-setup.test.ts

@@ -44,8 +44,17 @@ const firebase: ReleaseServicesTarget = {
   region: "europe-west1",
   env: "production",
   domain: "acme.com",
+  stagingHost: "staging.acme.com",
   mcpAuthProxyImageRef: `${IMAGE}/mcp-auth-proxy@sha256:${"c".repeat(64)}`,
+  gatewayImageRef: `${IMAGE}/gateway@sha256:${"b".repeat(64)}`,
 };
+
+/**
+ * The outcomes of the #1328 part; the staging gateway's (#1330) come after
+ * them and are covered by staging-gateway-setup.test.ts.
+ */
+const proxyPart = (outcomes: readonly { id: string; status: string }[]) =>
+  outcomes.filter((o) => !/staging gateway/.test(o.id)).map((o) => o.status);
 const gcp: ReleaseServicesTarget = { ...firebase, provider: "gcp" };
 
 /** The old gateway service as `gcloud run services describe --format=json` shows it. */
@@ -210,7 +219,7 @@ describe("ensureReleaseServices", () => {
         };
       },
     });
-    expect(outcomes.map((o) => o.status)).toEqual(["applied", "present", "present", "applied"]);
+    expect(proxyPart(outcomes)).toEqual(["applied", "present", "present", "applied"]);
     expect(calls.filter((c) => c.startsWith("secrets add-iam-policy-binding"))).toEqual([
       `secrets add-iam-policy-binding caelo-production-mcp-oauth-seal-key --project=acme --member=serviceAccount:${PROXY_SA} --role=roles/secretmanager.secretAccessor --condition=None --quiet`,
       `secrets add-iam-policy-binding caelo-production-operator-oauth-client --project=acme --member=serviceAccount:${PROXY_SA} --role=roles/secretmanager.secretAccessor --condition=None --quiet`,
@@ -237,7 +246,7 @@ describe("ensureReleaseServices", () => {
       "run services describe caelo-production-data-gateway": ok("caelo-production-data-gateway\n"),
     });
     const outcomes = await ensureReleaseServices(firebase, { run });
-    expect(outcomes.map((o) => o.status)).toEqual(["present", "present", "present", "present"]);
+    expect(proxyPart(outcomes)).toEqual(["present", "present", "present", "present"]);
     expect(calls.some((c) => c.includes("replace") || c.includes("create"))).toBe(false);
   });
 
@@ -267,7 +276,7 @@ describe("ensureReleaseServices", () => {
       "run deploy caelo-production-mcp-auth-proxy": ok(),
     });
     const outcomes = await ensureReleaseServices(gcp, { run });
-    expect(outcomes.map((o) => o.status)).toEqual(["applied", "present", "present", "applied"]);
+    expect(proxyPart(outcomes)).toEqual(["applied", "present", "present", "applied"]);
     expect(calls).toContain(gcpProxyDeployArgs(gcp).join(" "));
   });
 
@@ -280,7 +289,7 @@ describe("ensureReleaseServices", () => {
       ),
     });
     const outcomes = await ensureReleaseServices(gcp, { run });
-    expect(outcomes.at(-1)?.status).toBe("present");
+    expect(proxyPart(outcomes).at(-1)).toBe("present");
     expect(calls.some((c) => c.startsWith("run deploy"))).toBe(false);
   });
 
@@ -292,7 +301,7 @@ describe("ensureReleaseServices", () => {
       ),
     });
     const outcomes = await ensureReleaseServices(gcp, { run });
-    expect(outcomes.map((o) => o.status)).toEqual(["applied", "present", "failed"]);
+    expect(proxyPart(outcomes)).toEqual(["applied", "present", "failed"]);
     expect(calls.some((c) => c.startsWith("run "))).toBe(false);
   });
 
@@ -320,7 +329,7 @@ describe("ensureReleaseServices", () => {
         pauses.push(ms);
       },
     });
-    expect(outcomes.map((o) => o.status)).toEqual(["applied", "present", "present", "present"]);
+    expect(proxyPart(outcomes)).toEqual(["applied", "present", "present", "present"]);
     expect(pauses.length).toBe(2);
     expect(calls.filter((c) => c.startsWith("secrets add-iam-policy-binding"))).toHaveLength(2);
   });

package/src/mcp-auth-proxy-setup.ts

@@ -49,6 +49,7 @@ import {
   serviceSecrets,
 } from "./stack-contract.js";
 import { listFlag } from "./stack-converge.js";
+import { ensureStagingGatewayFromLiveGateway } from "./staging-gateway-setup.js";
 import { lookupFailure, resolveGcpResourceName } from "./upgrade/gcp-lookup.js";
 
 /** The install the services are ensured on. */
@@ -61,8 +62,15 @@ export interface ReleaseServicesTarget {
   readonly domain: string;
   /** The release's digest-pinned MCP-Auth-Proxy image (`…/mcp-auth-proxy@sha256:…`). */
   readonly mcpAuthProxyImageRef: string;
+  /** #1330 — the release's digest-pinned gateway image, which the staging gateway runs too. */
+  readonly gatewayImageRef: string;
+  /** #1330 — the staging host (install.json `stagingDomain`). */
+  readonly stagingHost: string;
 }
 
+/** What the `gcp` proxy's own service needs. */
+export type ProxyServiceTarget = Omit<ReleaseServicesTarget, "gatewayImageRef" | "stagingHost">;
+
 export interface ReleaseServicesDeps {
   readonly run?: GcloudRunner;
   /** Writes a service spec for `gcloud run services replace`; returns its path and a cleanup. */
@@ -95,6 +103,10 @@ export async function ensureReleaseServices(
       ? await ensureDataGatewayService(target, run, deps.writeSpecFile ?? writeTempSpec)
       : await ensureMcpAuthProxyServiceGcp(target, run),
   );
+  if (outcomes.some((o) => o.status === "failed")) return outcomes;
+  outcomes.push(
+    ...(await ensureStagingGatewayFromLiveGateway(target, { run, sleep: deps.sleep ?? realSleep })),
+  );
   return outcomes;
 }
 
@@ -317,7 +329,7 @@ function gcpProxyEnv(target: Pick<ReleaseServicesTarget, "env" | "domain">): Clo
  * invokable without a Google identity (MCP clients have none), request-based
  * CPU, no VPC, and its Google sign-in client file as a secret volume.
  */
-export function gcpProxyDeployArgs(target: ReleaseServicesTarget): string[] {
+export function gcpProxyDeployArgs(target: ProxyServiceTarget): string[] {
   const name = fixedCloudRunServiceName("gcp", target.env, "mcp-auth-proxy") as string;
   const env = gcpProxyEnv(target);
   const plain = env.flatMap((e) => ("value" in e ? [`${e.name}=${e.value}`] : []));
@@ -356,7 +368,7 @@ export function gcpProxyDeployArgs(target: ReleaseServicesTarget): string[] {
  * app-roll moves it onto each release's image after that.
  */
 export async function ensureMcpAuthProxyServiceGcp(
-  target: ReleaseServicesTarget,
+  target: ProxyServiceTarget,
   run: GcloudRunner,
 ): Promise<EnsureOutcome> {
   const name = fixedCloudRunServiceName("gcp", target.env, "mcp-auth-proxy") as string;

package/src/release-manifest.ts

@@ -254,7 +254,7 @@ export function manifestServiceImages(m: Pick<ReleaseManifest, "version" | "dige
   | {
       readonly ok: true;
       readonly images: Readonly<
-        Record<"admin" | "gateway" | "mcp-auth-proxy", ManifestServiceImage>
+        Record<"admin" | "gateway" | "staging-gateway" | "mcp-auth-proxy", ManifestServiceImage>
       >;
     }
   | { readonly ok: false; readonly error: string } {
@@ -274,6 +274,8 @@ export function manifestServiceImages(m: Pick<ReleaseManifest, "version" | "dige
     images: {
       admin: image("admin", m.digests.admin),
       gateway: image("gateway", m.digests.gateway),
+      // #1330 — the staging gateway runs the live gateway's image.
+      "staging-gateway": image("gateway", m.digests.gateway),
       "mcp-auth-proxy": image("mcp-auth-proxy", proxy),
     },
   };

package/src/remote-mcp-stack-config.test.ts

@@ -96,6 +96,7 @@ describe("remote-MCP identity as stack config (#1082)", () => {
     expect(remoteMcpIdentityStackEnv(undefined)).toEqual({
       admin: [],
       gateway: [],
+      "staging-gateway": [],
       "mcp-auth-proxy": [],
     });
   });

package/src/remote-mcp.test.ts

@@ -413,6 +413,7 @@ const firebase: RemoteMcpTarget = {
   services: {
     admin: "caelo-production-admin-aaa",
     gateway: "caelo-production-data-gateway",
+    "staging-gateway": "caelo-production-staging-gateway",
     "mcp-auth-proxy": "caelo-production-gateway-bbb",
   },
 };
@@ -606,7 +607,10 @@ describe("checkRemoteMcpIdentityEnv (#1082)", () => {
       ),
     });
     const r = await checkRemoteMcpIdentityEnv(firebase, identity, { run });
-    expect(r).toEqual({ ok: true, drift: { admin: [], gateway: [], "mcp-auth-proxy": [] } });
+    expect(r).toEqual({
+      ok: true,
+      drift: { admin: [], gateway: [], "staging-gateway": [], "mcp-auth-proxy": [] },
+    });
     expect(calls.some((c) => c.startsWith("run services update"))).toBe(false);
   });
 

package/src/remote-mcp.ts

@@ -345,8 +345,17 @@ export async function checkRemoteMcpIdentityEnv(
 ): Promise<RemoteMcpResult<{ readonly drift: Record<CloudRunSlug, EnvChange[]> }>> {
   const run = deps.run ?? defaultGcloud;
   const desired = remoteMcpIdentityEnv(identity);
-  const drift: Record<CloudRunSlug, EnvChange[]> = { admin: [], gateway: [], "mcp-auth-proxy": [] };
+  const drift: Record<CloudRunSlug, EnvChange[]> = {
+    admin: [],
+    gateway: [],
+    "staging-gateway": [],
+    "mcp-auth-proxy": [],
+  };
   for (const slug of CLOUD_RUN_SLUGS) {
+    // Nothing to check where the identity names nothing (the visitor
+    // gateways), and the staging gateway is the CLI's (#1330), not the
+    // stack's: it may not exist yet right after a first `up`.
+    if (desired[slug].length === 0) continue;
     const described = await describeService(target, target.services[slug], run);
     if (!described.ok) return described;
     const plan = planEnvUpdate(liveContainerEnv(described.json), desired[slug]);

package/src/runtime-secrets.test.ts

@@ -323,7 +323,12 @@ describe("rotateRuntimeSecret", () => {
     projectId: "acme",
     region: "europe-west1",
     env: "production",
-    services: { admin: "adm-svc", gateway: "gw-svc", "mcp-auth-proxy": "px-svc" },
+    services: {
+      admin: "adm-svc",
+      gateway: "gw-svc",
+      "staging-gateway": "stg-svc",
+      "mcp-auth-proxy": "px-svc",
+    },
     sqlInstance: "caelo-production-pg-1",
   };
   const ref = (name: string, secret: string, version = "latest") => ({
@@ -347,6 +352,10 @@ describe("rotateRuntimeSecret", () => {
     "run services describe gw-svc": [
       service([ref("PUBLIC_DATABASE_PASSWORD", "public-role-password")]),
     ],
+    // #1330 — the staging gateway reads its own login password.
+    "run services describe stg-svc": [
+      service([ref("PUBLIC_DATABASE_PASSWORD", "public-staging-role-password")]),
+    ],
     // #1328 — the proxy reads none of the rotatable database secrets.
     "run services describe px-svc": [
       service([ref("CAELO_MCP_OAUTH_SEAL_KEY", "mcp-oauth-seal-key")]),

package/src/runtime-secrets.ts

@@ -30,6 +30,8 @@ import {
   gcpSecretId,
   mcpAuthProxyServiceAccountEmail,
   mcpAuthProxyServiceAccountId,
+  stagingGatewayServiceAccountEmail,
+  stagingGatewayServiceAccountId,
 } from "./gcp-names.js";
 import {
   CLI_GENERATED_SECRETS,
@@ -123,6 +125,25 @@ export function ensureMcpAuthProxyServiceAccount(
   );
 }
 
+/**
+ * #1330 — create the staging gateway's run SA unless it exists. Its rights:
+ * `secretAccessor` on `public-staging-role-password` (runtimeSecretBindings),
+ * the log and metric writer, and object viewer on the staging bucket
+ * (staging-gateway-setup.ts) — nothing of the live site's.
+ */
+export function ensureStagingGatewayServiceAccount(
+  install: { readonly projectId: string; readonly env: string },
+  deps: RuntimeDeps = {},
+): Promise<EnsureOutcome> {
+  return ensureServiceAccount(
+    install.projectId,
+    stagingGatewayServiceAccountId(install.env),
+    stagingGatewayServiceAccountEmail(install.projectId, install.env),
+    `Caelo ${install.env} staging gateway`,
+    deps,
+  );
+}
+
 async function ensureServiceAccount(
   projectId: string,
   accountId: string,

package/src/scheduler-setup.test.ts

@@ -177,6 +177,12 @@ describe("schedulerWorkflowSource", () => {
     expect(src).toContain(`exp: \${now + 600}`);
   });
 
+  it("declares the tick as JSON, or SvelteKit refuses it as a cross-site form post", () => {
+    const tick = src.slice(src.indexOf("- tick:"), src.indexOf("- done:"));
+    expect(tick).toContain("Content-Type: application/json");
+    expect(tick).toContain("body: {}");
+  });
+
   it("posts the tick with the signed JWT and a bounded timeout", () => {
     expect(src).toContain('url: "https://admin.acme.com/api/internal/scheduler/tick"');
     expect(src).toContain(`Authorization: \${"Bearer " + signed.body.signedJwt}`);

package/src/scheduler-setup.ts

@@ -165,6 +165,11 @@ export function tickOrigin(
  * Credentials API, authenticated with the workflow's own OAuth token), then
  * POST the tick with it. A refused or failed tick (HTTP ≥ 400) fails the
  * execution, so it shows in the workflow's execution history and logs.
+ *
+ * The tick carries `Content-Type: application/json` and a JSON body, like the
+ * self-hosted clock (admin-core scheduler/clock.ts), because the admin's
+ * SvelteKit treats a POST with no content type and no `Origin` as a
+ * cross-site form submission: it answers 403 before the route runs.
  */
 export function schedulerWorkflowSource(opts: {
   readonly serviceAccount: string;
@@ -198,6 +203,8 @@ main:
           url: "${origin}${SCHEDULER_TICK_PATH}"
           headers:
             Authorization: \${"Bearer " + signed.body.signedJwt}
+            Content-Type: application/json
+          body: {}
           timeout: ${SCHEDULER_TICK_TIMEOUT_SECONDS}
         result: answer
     - done:

package/src/self-hosted-backup.test.ts

@@ -109,12 +109,12 @@ describe("backupSelfHosted", () => {
     expect(out).toEqual({ ok: true, path: to });
     expect(probe(r.calls.map((c) => c.cmd))).toEqual([
       "exec -T postgres pg_isready -U caelo",
-      "stop caelo-admin caelo-gateway",
+      "stop caelo-admin caelo-gateway caelo-staging-gateway",
       "exec -T postgres pg_dumpall -U caelo --globals-only",
       "exec -T postgres pg_dump -U caelo -Fc cms_admin",
       "exec -T postgres pg_dump -U caelo -Fc cms_public",
       "run --rm --no-deps -T --entrypoint tar caelo-admin -C / -cf - srv/caelo data/media",
-      "up -d caelo-admin caelo-gateway",
+      "up -d caelo-admin caelo-gateway caelo-staging-gateway",
       "exec -T caelo-admin bun -e <probe>",
       "exec -T caelo-gateway bun -e <probe>",
     ]);
@@ -146,7 +146,9 @@ describe("backupSelfHosted", () => {
       ...quiet,
     });
     expect(out.ok).toBe(false);
-    expect(r.calls.map((c) => c.cmd)).toContain("up -d caelo-admin caelo-gateway");
+    expect(r.calls.map((c) => c.cmd)).toContain(
+      "up -d caelo-admin caelo-gateway caelo-staging-gateway",
+    );
   });
 
   it("refuses when Postgres is not running and changes nothing", async () => {
@@ -194,7 +196,7 @@ describe("restoreSelfHosted", () => {
     const out = await restoreSelfHosted(archive, restoreDeps(r));
     expect(out.ok).toBe(true);
     expect(probe(r.calls.map((c) => c.cmd))).toEqual([
-      "stop caelo-admin caelo-gateway",
+      "stop caelo-admin caelo-gateway caelo-staging-gateway",
       "up -d --wait postgres",
       "exec -T postgres psql -U caelo -d postgres -v ON_ERROR_STOP=1 -c DROP DATABASE IF EXISTS cms_admin WITH (FORCE) -c DROP DATABASE IF EXISTS cms_public WITH (FORCE)",
       "<converge roles>",

package/src/self-hosted-compose.test.ts

@@ -28,6 +28,8 @@ const base: Omit<ComposeSpec, "images"> = {
   caeloSecretKek: "0".repeat(64),
   dbTlsServerCertSha256: "abababababababababababababababababababababababababababababababab",
   internalSecret: "i".repeat(48),
+  stagingHost: "staging.example.com",
+  stagingGateSecret: "g".repeat(64),
   anthropicApiKey: "sk-ant-x",
   diskSize: "20Gi",
   ports: { http: 80, https: 443 },

package/src/stack-contract-parity.test.ts

@@ -63,6 +63,7 @@ const MEMBER_EXPR: Record<IamInvariant["member"], string> = {
   // The secret loop resolves the SA per service through `serviceSa`.
   "gateway-sa": "gatewaySa.email",
   "mcp-auth-proxy-sa": "mcpAuthProxySa.email",
+  "staging-gateway-sa": "stagingGatewaySa.email",
   "static-publisher-sa": "staticPublisherSa.email",
   "iap-service-agent": "iapServiceIdentity.email",
   allUsers: 'member: "allUsers"',
@@ -166,15 +167,18 @@ describe.each(["gcp", "gcp-firebase"] as const)("%s stack ↔ upgrade parity", (
       /serviceName: "gateway",[\s\S]*?contractEnv: \[\s*\.\.\.gatewayEnvContract\(envContractInputs\),\s*\.\.\.poolBudget\.env\.gateway,?\s*\]/,
     );
     if (provider === "gcp-firebase") {
-      // The proxy: its contract, its identity env, and (until #1331) the
-      // data gateway it forwards to — a stack output no contract can name.
+      // The proxy: its contract and its identity env, nothing else (#1331:
+      // no forward origin any more).
       expect(src).toMatch(
-        /serviceName: "mcp-auth-proxy",[\s\S]*?contractEnv: \[\s*\.\.\.mcpAuthProxyEnvContract\(\{ provider: "gcp-firebase", env \}\),\s*\.\.\.remoteMcpEnv\["mcp-auth-proxy"\],[\s\S]*?\{ name: INTERIM_FORWARD_ORIGIN_ENV, value: gatewaySvc\.uri \},\s*\]/,
+        /serviceName: "mcp-auth-proxy",[\s\S]*?contractEnv: \[\s*\.\.\.mcpAuthProxyEnvContract\(\{ provider: "gcp-firebase", env \}\),\s*\.\.\.remoteMcpEnv\["mcp-auth-proxy"\],?\s*\]/,
       );
+      expect(src).not.toContain("INTERIM_FORWARD_ORIGIN");
     } else {
       // gcp: the proxy is CLI-owned (mcp-auth-proxy-setup.ts), not a stack service.
       expect(src).not.toContain('serviceName: "mcp-auth-proxy"');
     }
+    // #1330 — the staging gateway is CLI-owned on both (staging-gateway-setup.ts).
+    expect(src).not.toContain('serviceName: "staging-gateway"');
     expect(src).toContain("envs: [...args.contractEnv],");
   });
 

package/src/stack-contract.test.ts

@@ -14,7 +14,6 @@ import {
   defaultStagingHost,
   fixedCloudRunServiceName,
   gatewayEnvContract,
-  INTERIM_FORWARD_ORIGIN_ENV,
   iamMember,
   MCP_AUTH_PROXY_TRUSTED_PROXY_HOPS,
   mcpAuthProxyEnvContract,
@@ -24,12 +23,15 @@ import {
   RETIRED_SERVICE_ENV,
   runtimeSecretBindings,
   SECRETS_SET_UP_AHEAD_OF_THEIR_READER,
+  SERVICE_IMAGE,
   SERVICE_SECRET_ENV,
   SERVICE_SECRET_FILES,
   SERVICE_VPC_EGRESS,
   STACK_IAM_NOT_ENSURED,
+  STAGING_GATEWAY_TRUSTED_PROXY_HOPS,
   serviceSecrets,
   stackIamInvariants,
+  stagingGatewayEnvContract,
 } from "./stack-contract.js";
 
 const base = {
@@ -108,6 +110,8 @@ describe("adminEnvContract", () => {
       CAELO_CAPTURE_JOB: "projects/acme/locations/europe-west1/jobs/caelo-production-capture",
       CAELO_STATIC_BUCKET: "acme-caelo-production-static",
       CAELO_STAGING_BUCKET: "acme-caelo-production-staging",
+      // #1330 — every provider serves staging at its own host now.
+      CAELO_STAGING_HOST: "staging.acme.com",
       ...ADMIN_SECRETS,
     });
   });
@@ -119,10 +123,13 @@ describe("adminEnvContract", () => {
           ...base,
           provider: "gcp-firebase",
           firebaseSiteId: "caelo-production-site-abc123",
+          firebaseStagingSiteId: "caelo-production-stg-6eace1",
           gatewayService: "caelo-production-gateway-1a2b3c4",
         }),
       ),
     ).toEqual({
+      CAELO_FIREBASE_STAGING_SITE: "caelo-production-stg-6eace1",
+      CAELO_STAGING_BUCKET: "acme-caelo-production-staging",
       CAELO_PROVIDER: "gcp-firebase",
       CAELO_ENV: "production",
       MEDIA_STORAGE_URL: "gs://acme-caelo-production-media",
@@ -210,8 +217,8 @@ describe("gatewayEnvContract", () => {
       PUBLIC_DATABASE_URL:
         "postgresql://public_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_public?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem",
       PUBLIC_DATABASE_PASSWORD: "secret:caelo-production-public-role-password:latest",
-      CAELO_STAGING_GATE_SECRET: "secret:caelo-production-staging-gate-secret:latest",
-      // No remote-MCP env: the broker is the MCP-Auth-Proxy's (#1328).
+      // No remote-MCP env: the broker is the MCP-Auth-Proxy's (#1328); no
+      // staging gate key: the staging gateway's, through its projection (#1330).
     });
   });
 
@@ -222,10 +229,53 @@ describe("gatewayEnvContract", () => {
     expect(asRecord(gateway).CAELO_TRUSTED_PROXY_HOPS).toBe("2");
   });
 
-  it("#650 — reads the staging host from the database, not its env", () => {
+  it("#1330 — the live gateway knows no staging host and holds no staging gate key", () => {
     const fb = asRecord(gatewayEnvContract({ ...base, provider: "gcp-firebase" }));
     expect(fb.CAELO_STAGING_HOST).toBeUndefined();
-    expect(fb.CAELO_STAGING_GATE_SECRET).toBe("secret:caelo-production-staging-gate-secret:latest");
+    expect(fb.CAELO_STAGING_GATE_SECRET).toBeUndefined();
+    expect(RETIRED_SERVICE_ENV.gateway).toContain("CAELO_STAGING_GATE_SECRET");
+  });
+
+  it("#1330 — the staging gateway is the gateway image set to staging: its one login, its storage, nothing live", () => {
+    for (const provider of ["gcp", "gcp-firebase"] as const) {
+      expect(asRecord(stagingGatewayEnvContract({ ...base, provider }))).toEqual({
+        CAELO_PROVIDER: provider,
+        CAELO_ENV: "production",
+        CAELO_GATEWAY_ENVIRONMENT: "staging",
+        CAELO_TRUSTED_PROXY_HOPS: String(STAGING_GATEWAY_TRUSTED_PROXY_HOPS[provider]),
+        PUBLIC_DATABASE_URL:
+          "postgresql://public_staging_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_public_staging?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem",
+        CAELO_STAGING_STORAGE: "gs://acme-caelo-production-staging",
+        PUBLIC_DATABASE_PASSWORD: "secret:caelo-production-public-staging-role-password:latest",
+      });
+    }
+  });
+
+  it("pins the trusted hop count per provider, so a forged X-Forwarded-For entry is never trusted", () => {
+    expect(STAGING_GATEWAY_TRUSTED_PROXY_HOPS).toEqual({
+      gcp: 2,
+      "gcp-firebase": 1,
+      "self-hosted": 1,
+      aws: 2,
+      azure: 1,
+    });
+  });
+
+  it("shares no secret with the live gateway and reads exactly its own login", () => {
+    expect(serviceSecrets("staging-gateway")).toEqual(["public-staging-role-password"]);
+    const live = new Set(serviceSecrets("gateway"));
+    expect(serviceSecrets("staging-gateway").some((x) => live.has(x))).toBe(false);
+    expect(serviceSecrets("gateway")).not.toContain("staging-gate-secret");
+    expect(SECRETS_SET_UP_AHEAD_OF_THEIR_READER["public-staging-role-password"]).toBeUndefined();
+  });
+
+  it("runs the live gateway's image under its own fixed name", () => {
+    expect(SERVICE_IMAGE["staging-gateway"]).toBe("gateway");
+    for (const provider of ["gcp", "gcp-firebase"] as const) {
+      expect(fixedCloudRunServiceName(provider, "production", "staging-gateway")).toBe(
+        "caelo-production-staging-gateway",
+      );
+    }
   });
 
   it("#650 — the admin's staging host seed is the install setting, any host", () => {
@@ -235,6 +285,7 @@ describe("gatewayEnvContract", () => {
         stagingHost: "preview.other.de",
         provider: "gcp-firebase",
         firebaseSiteId: "s",
+        firebaseStagingSiteId: "s-stg",
         gatewayService: "g",
       }),
     );
@@ -243,7 +294,7 @@ describe("gatewayEnvContract", () => {
   });
 
   it("the gateway's run SA reads no admin-only secret (admin password, KEK, internal, tool approval)", () => {
-    expect(serviceSecrets("gateway")).toEqual(["public-role-password", "staging-gate-secret"]);
+    expect(serviceSecrets("gateway")).toEqual(["public-role-password"]);
     for (const v of gateway) {
       expect(v.name).not.toMatch(/KEK|INTERNAL|TOOL_APPROVAL|PUBLIC_ADMIN/);
     }
@@ -336,10 +387,11 @@ describe("runtime secrets", () => {
         secret: "public-role-password",
         stackResource: "gateway-public-role-password-binding",
       },
+      // #1330 — the staging gateway: its own login only.
       {
-        service: "gateway",
-        secret: "staging-gate-secret",
-        stackResource: "gateway-staging-gate-secret-binding",
+        service: "staging-gateway",
+        secret: "public-staging-role-password",
+        stackResource: "staging-gateway-public-staging-role-password-binding",
       },
       // #1328 — the broker's seal key (env) and Google sign-in client (a
       // file, which counts like an env secret: the SA reads it).
@@ -385,6 +437,8 @@ describe("self-hosted compose", () => {
       caeloSecretKek: "k",
       dbTlsServerCertSha256: "abababababababababababababababababababababababababababababababab",
       internalSecret: "i".repeat(48),
+      stagingHost: "staging.example.com",
+      stagingGateSecret: "g".repeat(64),
       diskSize: "10G",
       ports: { http: 80, https: 443 },
       project: "caelo-example-com",
@@ -424,14 +478,19 @@ describe("stackIamInvariants", () => {
     }
   });
 
-  it("grants the gateway SA only its own role password, the staging gate key + telemetry roles", () => {
+  it("grants the gateway SA only its own role password + telemetry roles (#1330: no staging gate key)", () => {
     for (const provider of ["gcp", "gcp-firebase"] as const) {
       const gateway = stackIamInvariants(provider).filter((i) => i.member === "gateway-sa");
       expect(gateway.map((i) => `${i.role} ${JSON.stringify(i.target)}`).sort()).toEqual([
         'roles/logging.logWriter {"kind":"project"}',
         'roles/monitoring.metricWriter {"kind":"project"}',
         'roles/secretmanager.secretAccessor {"kind":"secret","name":"public-role-password"}',
-        'roles/secretmanager.secretAccessor {"kind":"secret","name":"staging-gate-secret"}',
+      ]);
+      const staging = stackIamInvariants(provider).filter((i) => i.member === "staging-gateway-sa");
+      expect(staging.map((i) => `${i.role} ${JSON.stringify(i.target)}`).sort()).toEqual([
+        'roles/logging.logWriter {"kind":"project"}',
+        'roles/monitoring.metricWriter {"kind":"project"}',
+        'roles/secretmanager.secretAccessor {"kind":"secret","name":"public-staging-role-password"}',
       ]);
     }
   });
@@ -508,10 +567,11 @@ describe("MCP-Auth-Proxy contract (#1328)", () => {
       CAELO_REMOTE_MCP: "unavailable",
       CAELO_TRUSTED_PROXY_HOPS: String(MCP_AUTH_PROXY_TRUSTED_PROXY_HOPS.azure),
     });
-    // The interim forward origin is the stack's / converge's, never the contract's.
+    // #1331 — the interim forwarder is gone; the roll removes its env.
     expect(
       mcpAuthProxyEnvContract({ provider: "gcp-firebase", env: "production" }).map((v) => v.name),
-    ).not.toContain(INTERIM_FORWARD_ORIGIN_ENV);
+    ).not.toContain("CAELO_INTERIM_FORWARD_ORIGIN");
+    expect(RETIRED_SERVICE_ENV["mcp-auth-proxy"]).toContain("CAELO_INTERIM_FORWARD_ORIGIN");
   });
 
   it("the proxy's SA reads exactly its two secrets and holds no other invariant", () => {