@caelo-cms/provisioning 0.11.13 → 0.11.14

package/src/upgrade/app-roll.ts

@@ -29,6 +29,7 @@ import {
   gatewayServiceAccountEmail,
   mcpAuthProxyServiceAccountEmail,
   runServiceAccountEmail,
+  stagingGatewayServiceAccountEmail,
 } from "../gcp-names.js";
 import type { ImageDigests } from "../install-state.js";
 import {
@@ -82,10 +83,10 @@ import type { UpgradeReporter } from "./reporter.js";
 export type RollSlug = CloudRunSlug;
 
 /**
- * The roll order: the gateway follows the admin, never the other way round,
- * and the MCP-Auth-Proxy comes last (#1328) — on gcp-firebase it forwards
- * the visitor traffic still addressed to it to the gateway, which must
- * already serve the new release by then.
+ * The roll order: the gateways follow the admin, never the other way round
+ * (the admin's migrations and projection come first), the staging gateway
+ * (#1330) right after the live one with the same image, and the
+ * MCP-Auth-Proxy last (#1328).
  */
 export const ROLL_ORDER: readonly RollSlug[] = CLOUD_RUN_SLUGS;
 
@@ -96,6 +97,8 @@ export function rollServiceAccount(slug: RollSlug, projectId: string, env: strin
       return runServiceAccountEmail(projectId, env);
     case "gateway":
       return gatewayServiceAccountEmail(projectId, env);
+    case "staging-gateway":
+      return stagingGatewayServiceAccountEmail(projectId, env);
     case "mcp-auth-proxy":
       return mcpAuthProxyServiceAccountEmail(projectId, env);
   }

package/src/upgrade/converge.ts

@@ -63,7 +63,6 @@ import {
   type CloudRunEnvVar,
   CONVERGE_JOB_ENV_VAR,
   DATABASE_URL_VARS,
-  INTERIM_FORWARD_ORIGIN_ENV,
   MCP_ENV_VAR,
   OPERATOR_ACCESS_JOB_ENV_VAR,
   parseSchedulerIntervalMinutes,
@@ -78,10 +77,11 @@ import {
   removeRetiredIamBindings,
 } from "../stack-converge.js";
 import { ensureStagingDatabase } from "../staging-database.js";
+import { ensureStagingGatewayEdge } from "../staging-gateway-setup.js";
 import { ensureUpgraderJob, resolveUpgraderTarget } from "../upgrader-setup.js";
 import { ensureUrlMapRedirectsAccess } from "../url-map-redirects-access.js";
 import type { AppRollHooks, AppRollPlan, RollPlan, RollSlug } from "./app-roll.js";
-import { findServiceUrl, lookupFailure } from "./gcp-lookup.js";
+import { lookupFailure } from "./gcp-lookup.js";
 import type { UpgradeReporter } from "./reporter.js";
 
 /**
@@ -160,6 +160,7 @@ export function startConverge(
   const services = {
     admin: service("admin").serviceName,
     gateway: service("gateway").serviceName,
+    "staging-gateway": service("staging-gateway").serviceName,
     "mcp-auth-proxy": service("mcp-auth-proxy").serviceName,
   };
   const target = {
@@ -450,17 +451,41 @@ export function startConverge(
     incomplete = true;
   }
 
-  async function interimForwardEnv(): Promise<CloudRunEnvVar[]> {
-    // #1328 — on gcp-firebase the proxy is the service the current live
-    // release's Firebase rewrite and the staging domain mapping still
-    // point at; it forwards that traffic to the data gateway, whose URL is
-    // its origin (stack-contract.ts INTERIM_FORWARD_ORIGIN_ENV). Without it
-    // the proxy answers the live site's /api/** with 404 until the next
-    // Publish live, and the staging host with 404 — so this aborts.
-    if (install.provider !== "gcp-firebase") return [];
-    const url = await findServiceUrl(run, install.projectId, install.region, services.gateway);
-    if (!url) throw new Error(`could not read the URL of ${services.gateway}`);
-    return [{ name: INTERIM_FORWARD_ORIGIN_ENV, value: new URL(url).origin }];
+  async function stagingEdge(): Promise<void> {
+    // #1330 — route the staging host to the staging gateway and nowhere
+    // else: gcp-firebase's second Hosting site (and the old Cloud Run domain
+    // mapping deleted), gcp's host rule, backend and certificate
+    // (staging-gateway-setup.ts). Only staging depends on it, so a failure
+    // warns; the records the staging host needs are printed (Settings →
+    // Updates shows them too).
+    const s = r.step(`Routing the staging host ${install.stagingHost} to the staging gateway...`);
+    const edge = await ensureStagingGatewayEdge(
+      {
+        provider: install.provider,
+        projectId: install.projectId,
+        region: install.region,
+        env: install.env,
+        domain: install.domain,
+        stagingHost: install.stagingHost,
+      },
+      { run, ...(deps.http ? { http: deps.http } : {}) },
+    );
+    for (const line of edge.done) r.info(`  ${line}`);
+    if (edge.ok) {
+      s.done(`The staging host is served by the staging gateway, behind the staging gate`);
+      if (edge.dnsRecords.length > 0) {
+        r.info(
+          `  DNS for ${install.stagingHost} (add or change at your registrar if it differs; Settings → Updates shows the same):`,
+        );
+        for (const d of edge.dnsRecords) r.info(`    ${d.name}  ${d.type}  ${d.value}`);
+      }
+      return;
+    }
+    s.warned(`The staging host is not routed yet: ${edge.error}`);
+    r.warn(
+      `The upgrade continues; ${install.stagingHost} answers nothing until this succeeds (the live site is not affected). Re-run upgrade once the cause is fixed.`,
+    );
+    incomplete = true;
   }
 
   /** The admin's origin behind IAP, once {@link remoteMcpIdentity} read it. */
@@ -847,6 +872,7 @@ export function startConverge(
       await auditJob();
       await captureJob();
       await remoteMcpEdge();
+      await stagingEdge();
       return true;
     },
 
@@ -859,19 +885,7 @@ export function startConverge(
         await convergeJob();
         await schedulerTick();
         await operatorAccess();
-        let forward: CloudRunEnvVar[];
-        try {
-          forward = await interimForwardEnv();
-        } catch (e) {
-          r.error(
-            `The MCP-Auth-Proxy cannot be pointed at the data gateway: ${e instanceof Error ? e.message : String(e)}. Nothing was rolled; re-run upgrade once it is fixed.`,
-          );
-          return { ok: false };
-        }
-        const extraEnv: Partial<Record<RollSlug, CloudRunEnvVar[]>> = {
-          ...(identity ?? {}),
-          "mcp-auth-proxy": [...(identity?.["mcp-auth-proxy"] ?? []), ...forward],
-        };
+        const extraEnv: Partial<Record<RollSlug, CloudRunEnvVar[]>> = { ...(identity ?? {}) };
         return {
           ok: true,
           leaveUntouched: [...leaveUntouched],

package/src/upgrade/image-forms.ts

@@ -30,7 +30,7 @@
 import { z } from "zod";
 import type { ImageDigests } from "../install-state.js";
 import type { ReleaseManifest } from "../release-manifest.js";
-import { ROLL_ORDER, type RollSlug } from "./app-roll.js";
+import { SERVICE_IMAGE_NAMES, type ServiceImageName } from "../stack-contract.js";
 import { fetchRegistryManifest, IMAGE_DIGEST, RELEASE_REGISTRY } from "./release-images.js";
 
 /** The digests one release image is known by. */
@@ -58,10 +58,10 @@ export interface ReleaseImageForms {
   /** The forms of release `m`'s image `slug` (signed platform digests win). */
   of(
     m: Pick<ReleaseManifest, "version" | "digests" | "platformDigests">,
-    slug: RollSlug,
+    slug: ServiceImageName,
   ): Promise<ImageFormsResult>;
   /** The forms of the index `indexDigest` of image `slug`, read from the mirror. */
-  ofIndex(slug: RollSlug, indexDigest: string): Promise<ImageFormsResult>;
+  ofIndex(slug: ServiceImageName, indexDigest: string): Promise<ImageFormsResult>;
 }
 
 const INDEX_MEDIA_TYPES = new Set([
@@ -133,7 +133,7 @@ export function createReleaseImageForms(fetchImpl: typeof fetch = fetch): Releas
   const cache = new Map<string, Promise<ImageFormsResult>>();
   const { region, project, repo } = RELEASE_REGISTRY;
 
-  async function lookup(slug: RollSlug, indexDigest: string): Promise<ImageFormsResult> {
+  async function lookup(slug: ServiceImageName, indexDigest: string): Promise<ImageFormsResult> {
     const where = `the ${slug} image index ${indexDigest} in the release mirror`;
     const fetched = await fetchRegistryManifest(
       `${region}-docker.pkg.dev`,
@@ -165,7 +165,7 @@ export function createReleaseImageForms(fetchImpl: typeof fetch = fetch): Releas
     return formsFromIndexJson(indexDigest, json);
   }
 
-  const ofIndex = (slug: RollSlug, indexDigest: string): Promise<ImageFormsResult> => {
+  const ofIndex = (slug: ServiceImageName, indexDigest: string): Promise<ImageFormsResult> => {
     const key = `${slug}@${indexDigest}`;
     let pending = cache.get(key);
     if (!pending) {
@@ -212,8 +212,8 @@ export async function platformDigestsOf(
   | { readonly ok: true; readonly platformDigests: ImageDigests }
   | { readonly ok: false; readonly message: string }
 > {
-  const out: Partial<Record<RollSlug, string>> = {};
-  for (const slug of ROLL_ORDER) {
+  const out: Partial<Record<ServiceImageName, string>> = {};
+  for (const slug of SERVICE_IMAGE_NAMES) {
     const index = digests[slug];
     // #1328 — digests recorded before the MCP-Auth-Proxy existed carry none.
     if (!index) continue;

package/src/upgrade/release-images.test.ts

@@ -10,6 +10,7 @@ import {
   RELEASE_SIGNER_IDENTITY_REGEXP,
   releaseTag,
   resolveRegistryDigest,
+  resolveReleaseImages,
 } from "./release-images.js";
 
 const DIGEST = `sha256:${"d".repeat(64)}`;
@@ -138,3 +139,30 @@ describe("cosignInstallHint (#816)", () => {
     expect(cosignInstallHint("darwin")).toContain("brew install cosign");
   });
 });
+
+describe("resolveReleaseImages (#1330)", () => {
+  it("looks up each release image once and gives the staging gateway the gateway's", async () => {
+    const asked: string[] = [];
+    const r = await resolveReleaseImages("0.12.0", async (image) => {
+      asked.push(image);
+      return { ok: true, digest: `sha256:${image === "gateway" ? "b" : "a"}${"0".repeat(63)}` };
+    });
+    expect(asked).toEqual(["admin", "gateway", "mcp-auth-proxy"]);
+    expect(r.ok).toBe(true);
+    if (!r.ok) return;
+    expect(r.images["staging-gateway"]).toEqual(r.images.gateway);
+    expect(r.images["staging-gateway"].imageRef).toContain("/gateway@sha256:");
+  });
+
+  it("names the image whose tag is missing", async () => {
+    const r = await resolveReleaseImages("0.12.0", async (image) =>
+      image === "gateway"
+        ? { ok: false, reason: "404" }
+        : { ok: true, digest: `sha256:${"a".repeat(64)}` },
+    );
+    expect(r.ok).toBe(false);
+    if (r.ok) return;
+    expect(r.error).toContain("gateway:0.12.0");
+    expect(r.error).not.toContain("staging-gateway");
+  });
+});

package/src/upgrade/release-images.ts

@@ -16,6 +16,13 @@
 import { IMAGE_DIGEST } from "@caelo-cms/shared";
 import { confirm, isCancel, log, spinner } from "@clack/prompts";
 import { green, red } from "kleur/colors";
+import {
+  CLOUD_RUN_SLUGS,
+  type CloudRunSlug,
+  SERVICE_IMAGE,
+  SERVICE_IMAGE_NAMES,
+  type ServiceImageName,
+} from "../stack-contract.js";
 
 /** The Caelo services shipped as release images (#1328 added the MCP-Auth-Proxy). */
 export type ReleaseService = "admin" | "gateway" | "mcp-auth-proxy";
@@ -468,3 +475,40 @@ export async function verifyCosignAll(
   }
   return true;
 }
+
+/**
+ * Resolve each release image's digest from the public registry, and give
+ * every service the image it runs (#1330: the staging gateway runs the
+ * gateway's — there is no `staging-gateway` image to look up). Via the
+ * registry's anonymous V2 API, not `gcloud artifacts docker tags list`: that
+ * needs IAM read on Caelo's registry project, which operators don't have.
+ *
+ * @param resolve - the tag lookup (tests pass a fake)
+ */
+export async function resolveReleaseImages(
+  tag: string,
+  resolve: (image: string, tag: string) => Promise<DigestResult> = resolveTagDigest,
+): Promise<
+  | { ok: true; images: Record<CloudRunSlug, { digest: string; imageRef: string }> }
+  | { ok: false; error: string }
+> {
+  const byImage: Partial<Record<ServiceImageName, { digest: string; imageRef: string }>> = {};
+  for (const image of SERVICE_IMAGE_NAMES) {
+    const res = await resolve(image, tag);
+    if (!res.ok) {
+      const r = RELEASE_REGISTRY;
+      return {
+        ok: false,
+        error:
+          `Couldn't resolve image digest for ${image}:${tag}: the public registry returned ${res.reason}.\n` +
+          `Verify the tag exists at https://${r.region}-docker.pkg.dev/${r.project}/${r.repo}/${image}:${tag}\n` +
+          "(latest releases live at https://github.com/caelo-cms/caelo-cms/releases — pass --version vX.Y.Z to pin.)",
+      };
+    }
+    byImage[image] = { digest: res.digest, imageRef: releaseImageRef(image, res.digest) };
+  }
+  const images = Object.fromEntries(
+    CLOUD_RUN_SLUGS.map((slug) => [slug, byImage[SERVICE_IMAGE[slug]]]),
+  ) as Record<CloudRunSlug, { digest: string; imageRef: string }>;
+  return { ok: true, images };
+}

package/src/upgrade/upgrade.test.ts

@@ -41,6 +41,8 @@ const GATEWAY = "caelo-production-data-gateway";
 const PROXY = "caelo-production-gateway-bbb";
 /** gcp: the proxy's fixed name (the gateway keeps its auto-named service). */
 const GCP_PROXY = "caelo-production-mcp-auth-proxy";
+/** #1330 — the staging gateway, under its fixed name on both providers. */
+const STAGING = "caelo-production-staging-gateway";
 const SQL = "caelo-production-pg-abc";
 const BACKUP_ID = "1760000000000";
 const DIGEST = {
@@ -51,6 +53,8 @@ const DIGEST = {
 const IMAGES: Record<RollSlug, ReleaseImage> = {
   admin: { digest: DIGEST.admin, imageRef: `registry/admin@${DIGEST.admin}` },
   gateway: { digest: DIGEST.gateway, imageRef: `registry/gateway@${DIGEST.gateway}` },
+  // #1330 — the staging gateway runs the gateway's image.
+  "staging-gateway": { digest: DIGEST.gateway, imageRef: `registry/gateway@${DIGEST.gateway}` },
   "mcp-auth-proxy": {
     digest: DIGEST["mcp-auth-proxy"],
     imageRef: `registry/mcp-auth-proxy@${DIGEST["mcp-auth-proxy"]}`,
@@ -115,6 +119,16 @@ const GATEWAY_JSON = serviceJson("registry/gateway@sha256:old", [
   secretRef("PUBLIC_DATABASE_PASSWORD", "public-role-password"),
 ]);
 
+/** #1330 — the staging gateway as the converge deployed it. */
+const STAGING_JSON = serviceJson("registry/gateway@sha256:old", [
+  {
+    name: "PUBLIC_DATABASE_URL",
+    value:
+      "postgresql://public_staging_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_public_staging?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem",
+  },
+  secretRef("PUBLIC_DATABASE_PASSWORD", "public-staging-role-password"),
+]);
+
 /**
  * gcp-firebase: the service that was the gateway, before this upgrade turns
  * it into the MCP-Auth-Proxy — the visitor gateway's database login, the
@@ -150,6 +164,28 @@ function fakeInstall(events: string[], overrides: [RegExp, Answer][] = []) {
     // On gcp this prefix is the gateway's, on gcp-firebase the proxy's.
     [/^run services list .*caelo-production-gateway/, ok(`${PROXY}\n`)],
     [/^run services list .*caelo-production-mcp-auth-proxy/, ok(`${GCP_PROXY}\n`)],
+    [/^run services list .*caelo-production-staging-gateway/, ok(`${STAGING}\n`)],
+    [new RegExp(`describe ${STAGING} .*--format=json`), ok(STAGING_JSON)],
+    // #1330 — the gcp staging edge: one WAF policy, one HTTPS proxy, the site's URL map.
+    [/^compute security-policies list/, ok("caelo-production-waf-1\n")],
+    [
+      /^compute target-https-proxies list/,
+      ok(JSON.stringify([{ name: "caelo-production-https-proxy-1", sslCertificates: [] }])),
+    ],
+    [
+      /^compute url-maps list/,
+      ok(
+        JSON.stringify([
+          {
+            name: "caelo-production-url-map-1",
+            hostRules: [{ hosts: ["acme.com"], pathMatcher: "public" }],
+            pathMatchers: [
+              { name: "public", pathRules: [{ paths: ["/api/*"], service: "gw-backend" }] },
+            ],
+          },
+        ]),
+      ),
+    ],
     [/describe (\S+) .*revisionName/, (l) => ok(`${l.split(" ")[3]}-00001-old\n`)],
     [new RegExp(`describe ${ADMIN} .*--format=json`), ok(ADMIN_JSON)],
     [new RegExp(`describe ${GATEWAY} .*--format=json`), ok(GATEWAY_JSON)],
@@ -298,7 +334,7 @@ const ANY_WRITE =
  * install lacks (mcp-auth-proxy-setup.ts). Additive; nothing serves on them.
  */
 const PRE_PLAN_WRITE =
-  /^(iam service-accounts create caelo-production-mcp-proxy-sa |secrets add-iam-policy-binding caelo-production-(mcp-oauth-seal-key|operator-oauth-client) .*--member=serviceAccount:caelo-production-mcp-proxy-sa@|run services replace |run deploy caelo-production-mcp-auth-proxy )/;
+  /^(iam service-accounts create caelo-production-(mcp-proxy-sa|stg-gw-sa) |secrets add-iam-policy-binding caelo-production-(mcp-oauth-seal-key|operator-oauth-client) .*--member=serviceAccount:caelo-production-mcp-proxy-sa@|secrets add-iam-policy-binding caelo-production-public-staging-role-password .*--member=serviceAccount:caelo-production-stg-gw-sa@|storage buckets (create|add-iam-policy-binding) gs:\/\/acme-caelo-production-staging |run services replace |run deploy caelo-production-(mcp-auth-proxy|staging-gateway) |run services add-iam-policy-binding caelo-production-staging-gateway .*--member=allUsers )/;
 
 const indexOf = (events: string[], pattern: RegExp): number => {
   const i = events.findIndex((e) => pattern.test(e));
@@ -606,11 +642,14 @@ describe("upgradeGcpInstall — converge, then app-roll", () => {
       .slice(deep)
       .filter((e) => e.includes("update-traffic") && e.includes("--to-revisions"));
     // Newest first: the proxy (back to the gateway release it was), the
-    // gateway, the admin.
+    // staging gateway (#1330), the gateway, the admin.
     expect(rollbacks).toEqual([
       expect.stringContaining(
         `${PROXY} --region europe-west1 --project acme --to-revisions ${PROXY}-00001-old=100`,
       ),
+      expect.stringContaining(
+        `${STAGING} --region europe-west1 --project acme --to-revisions ${STAGING}-00001-old=100`,
+      ),
       expect.stringContaining(
         `${GATEWAY} --region europe-west1 --project acme --to-revisions ${GATEWAY}-00001-old=100`,
       ),
@@ -752,6 +791,7 @@ describe("upgradeGcpInstall — converge, then app-roll", () => {
     const before = {
       admin: `${ADMIN}-00000-before`,
       gateway: `${GATEWAY}-00000-before`,
+      "staging-gateway": `${STAGING}-00000-before`,
       "mcp-auth-proxy": `${PROXY}-00000-before`,
     };
     expect(
@@ -772,12 +812,13 @@ describe("upgradeGcpInstall — converge, then app-roll", () => {
     const rollbacks = events.filter((e) => e.includes("--to-revisions"));
     expect(rollbacks).toEqual([
       expect.stringContaining(`--to-revisions ${before["mcp-auth-proxy"]}=100`),
+      expect.stringContaining(`--to-revisions ${before["staging-gateway"]}=100`),
       expect.stringContaining(`--to-revisions ${before.gateway}=100`),
       expect.stringContaining(`--to-revisions ${before.admin}=100`),
     ]);
   });
 
-  it("#1328 — a checkpoint without the proxy's revision (an older release wrote it) keeps the planned one", async () => {
+  it("#1328/#1330 — a checkpoint without the proxy's or staging gateway's revision (an older release wrote it) keeps the planned one", async () => {
     const events: string[] = [];
     const { deps } = upgradeDeps(events, { deep: { ok: false, error: "unhealthy" } });
     const before = { admin: `${ADMIN}-00000-before`, gateway: `${GATEWAY}-00000-before` };
@@ -792,6 +833,7 @@ describe("upgradeGcpInstall — converge, then app-roll", () => {
     ).toBe(false);
     expect(events.filter((e) => e.includes("--to-revisions"))).toEqual([
       expect.stringContaining(`--to-revisions ${PROXY}-00001-old=100`),
+      expect.stringContaining(`--to-revisions ${STAGING}-00001-old=100`),
       expect.stringContaining(`--to-revisions ${before.gateway}=100`),
       expect.stringContaining(`--to-revisions ${before.admin}=100`),
     ]);
@@ -916,11 +958,12 @@ describe("upgradeGcpInstall — converge, then app-roll", () => {
     expect(gateway).not.toContain("operator-oauth-client");
     expect(gateway).not.toContain("--timeout");
     expect(admin).not.toContain("--timeout");
-    // No extra revision: everything rides the image rolls.
-    expect(calls.filter((c) => /^run services update /.test(c))).toHaveLength(3);
+    // No extra revision: everything rides the image rolls (four services
+    // since the staging gateway, #1330).
+    expect(calls.filter((c) => /^run services update /.test(c))).toHaveLength(4);
   });
 
-  it("#1328 — the gcp-firebase proxy roll leaves the VPC, drops every database login and forwards to the data gateway", async () => {
+  it("#1328/#1331 — the gcp-firebase proxy roll leaves the VPC, drops every database login and forwards nothing", async () => {
     const events: string[] = [];
     const { deps, calls } = upgradeDeps(events);
     expect(await upgradeGcpInstall(TARGET, deps)).toBe(true);
@@ -931,7 +974,8 @@ describe("upgradeGcpInstall — converge, then app-roll", () => {
     );
     expect(proxy).toContain("--clear-network");
     expect(proxy).toContain("CAELO_REMOTE_MCP=available");
-    expect(proxy).toContain(`CAELO_INTERIM_FORWARD_ORIGIN=https://${GATEWAY}-xyz.a.run.app`);
+    // #1331 — the interim forwarder to the data gateway is gone.
+    expect(proxy).not.toContain("CAELO_INTERIM_FORWARD_ORIGIN");
     const removedEnv = proxy.match(/--remove-env-vars=(\S+)/)?.[1]?.split(",") ?? [];
     const removedSecrets = proxy.match(/--remove-secrets=(\S+)/)?.[1]?.split(",") ?? [];
     expect(removedEnv).toContain("PUBLIC_DATABASE_URL");
@@ -1031,10 +1075,12 @@ describe("upgradeGcpInstall — converge, then app-roll", () => {
     const admin = rolls.find((c) => c.startsWith(`run services update ${ADMIN} `)) ?? "";
     const gateway = rolls.find((c) => c.startsWith(`run services update ${GATEWAY} `)) ?? "";
     const proxy = rolls.find((c) => c.startsWith(`run services update ${PROXY} `)) ?? "";
+    const staging = rolls.find((c) => c.startsWith(`run services update ${STAGING} `)) ?? "";
     expect(gateway).toContain("--cpu-throttling");
+    expect(staging).toContain("--cpu-throttling");
     expect(proxy).toContain("--cpu-throttling");
     expect(admin).not.toContain("cpu-throttling");
-    expect(calls.filter((c) => /^run services update /.test(c))).toHaveLength(3);
+    expect(calls.filter((c) => /^run services update /.test(c))).toHaveLength(4);
   });
 
   it("#806/#1328 — on gcp, moves the remote-MCP paths and the Cloud Armor rule to the proxy's backend before the roll", async () => {
@@ -1122,7 +1168,13 @@ describe("upgradeGcpInstall — converge, then app-roll", () => {
       events,
       /^gcloud compute security-policies rules delete 900 --security-policy=caelo-production-waf-1 /,
     );
-    expect(puts).toHaveLength(1);
+    // The remote-MCP routes first, then (#1330) the staging host's own rule.
+    expect(puts).toHaveLength(2);
+    const staging = JSON.parse(puts[1] as string) as typeof urlMap;
+    expect(staging.hostRules).toContainEqual({
+      hosts: ["staging.acme.com"],
+      pathMatcher: "staging",
+    });
     const put = JSON.parse(puts[0] as string) as typeof urlMap;
     const rules = put.pathMatchers[0]?.pathRules ?? [];
     expect(rules).toEqual([
@@ -1190,7 +1242,7 @@ describe("upgradeGcpInstall — converge, then app-roll", () => {
         healthProbe: async () => ({ ok: true, probe: throwing }),
       }),
     ).toBe(false);
-    expect(events.filter((e) => e.includes("--to-revisions"))).toHaveLength(3);
+    expect(events.filter((e) => e.includes("--to-revisions"))).toHaveLength(4);
     expect(recorded.digests).toEqual([]);
   });
 
@@ -1351,7 +1403,7 @@ describe("app-roll and converge stay on their side", () => {
     );
     expect(result).toEqual({ ok: true, digests: DIGEST });
     expect(calls.filter((c) => CONVERGE_WRITE.test(c))).toEqual([]);
-    expect(calls.filter((c) => /^run services update /.test(c))).toHaveLength(3);
+    expect(calls.filter((c) => /^run services update /.test(c))).toHaveLength(4);
   });
 
   it("#1338: without a converge, a plan whose services dial the database's IP stops before migrations", async () => {

package/src/upgrade/upgrade.ts

@@ -34,6 +34,7 @@ import type { GcloudRunner, Sleep } from "../gcloud-retry.js";
 import type { ImageDigests } from "../install-state.js";
 import { ensureReleaseServices } from "../mcp-auth-proxy-setup.js";
 import type { HttpFetch } from "../runtime-secrets.js";
+import { SERVICE_IMAGE } from "../stack-contract.js";
 import {
   type AppRollPlan,
   executeAppRoll,
@@ -90,9 +91,11 @@ export interface UpgradeCheckpoint {
 
 /**
  * The rollback target per service. The MCP-Auth-Proxy's is absent in a
- * checkpoint a release before #1328 wrote; its planned revision is kept then.
+ * checkpoint a release before #1328 wrote, the staging gateway's in one from
+ * before #1330; their planned revisions are kept then.
  */
 export type PriorRevisions = Readonly<Record<"admin" | "gateway", string>> & {
+  readonly "staging-gateway"?: string;
   readonly "mcp-auth-proxy"?: string;
 };
 
@@ -189,7 +192,12 @@ export async function upgradeGcpInstallOutcome(
   // nothing yet, so the install keeps running as it is when this or
   // anything after it fails. The gcp proxy runs the new release's image,
   // so that image's signature is checked before it is deployed.
+  //
+  // #1330 — and the staging gateway (both providers), deployed with the new
+  // release's gateway image when the install has none yet, so that image's
+  // signature is checked first too.
   const proxyImage = images.images["mcp-auth-proxy"];
+  const gatewayImage = images.images.gateway;
   if (
     target.provider === "gcp" &&
     !target.skipVerify &&
@@ -198,6 +206,13 @@ export async function upgradeGcpInstallOutcome(
     sPre.failed("The MCP-Auth-Proxy image's signature did not verify");
     return failed;
   }
+  if (
+    !target.skipVerify &&
+    !(await deps.verifyImages([{ slug: "gateway", digest: gatewayImage.digest }]))
+  ) {
+    sPre.failed("The gateway image's signature did not verify");
+    return failed;
+  }
   const ensured = await ensureReleaseServices(
     {
       provider: target.provider,
@@ -205,7 +220,9 @@ export async function upgradeGcpInstallOutcome(
       region: target.region,
       env: target.env,
       domain: target.domain,
+      stagingHost: target.stagingHost,
       mcpAuthProxyImageRef: proxyImage.imageRef,
+      gatewayImageRef: gatewayImage.imageRef,
     },
     { run },
   );
@@ -244,7 +261,17 @@ export async function upgradeGcpInstallOutcome(
   // 2. P21 ship 4 — signatures against the Caelo release workflow's
   // identity: refuses a compromised registry, a typosquat or a fork's image.
   if (!target.skipVerify) {
-    if (!(await deps.verifyImages(plan.services))) return failed;
+    // One check per release image: the staging gateway (#1330) runs the
+    // gateway's, which has no repository of its own to verify against.
+    const images = [
+      ...new Map(
+        plan.services.map((s) => [
+          `${SERVICE_IMAGE[s.slug]}@${s.digest}`,
+          { slug: SERVICE_IMAGE[s.slug], digest: s.digest },
+        ]),
+      ).values(),
+    ];
+    if (!(await deps.verifyImages(images))) return failed;
   } else {
     r.warn("--skip-verify set — image signatures NOT verified.");
   }

package/src/upgrader-job.test.ts

@@ -171,6 +171,11 @@ function fakeGcloud(events: string[], overrides: [RegExp, Answer][] = []) {
     [/^run services list .*caelo-production-admin/, ok(`${ADMIN}\n`)],
     [/^run services list .*caelo-production-data-gateway/, ok(`${GATEWAY}\n`)],
     [/^run services list .*caelo-production-gateway/, ok(`${PROXY}\n`)],
+    // #1330 — the staging gateway, serving the gateway's image (below).
+    [
+      /^run services list .*caelo-production-staging-gateway/,
+      ok("caelo-production-staging-gateway\n"),
+    ],
     [/describe (\S+) .*revisionName/, (l) => ok(`${l.split(" ")[3]}-00001-old\n`)],
     [new RegExp(`describe ${ADMIN} .*--format=json`), ok(ADMIN_JSON)],
     [new RegExp(`describe ${GATEWAY} .*--format=json`), ok(GATEWAY_JSON)],
@@ -478,6 +483,24 @@ describe("runUpgraderJob", () => {
     );
   });
 
+  it("#1330: a staging gateway that serves another image than the gateway stops the run; nothing changed", async () => {
+    const { deps, order, q, written } = setup({
+      gcloud: [
+        [
+          /^run revisions describe caelo-production-staging-gateway/,
+          ok(revisionJson(D("9"), P("9"))),
+        ],
+      ],
+    });
+    const r = await runUpgraderJob(deps);
+    expect(r).toMatchObject({ exitCode: 1, status: "failed" });
+    expect(q.end()?.reason).toContain(
+      "the staging gateway (caelo-production-staging-gateway) serves",
+    );
+    expect(order.some((l) => /^gcloud run services update /.test(l))).toBe(false);
+    expect(written).toEqual([]);
+  });
+
   it("#818: missing grants end needs-Cloud-Shell with EVERY missing permission named; nothing changed", async () => {
     const { deps, order, q, written } = setup({
       iamWithheld: {