@caelo-cms/provisioning 0.11.8 → 0.11.10

package/src/upgrade/converge.ts

@@ -30,6 +30,12 @@
 
 import { ensureAuditJob, resolveAdminImage } from "../audit-job-setup.js";
 import { ensureCaptureJob } from "../capture-job-setup.js";
+import {
+  dialsIpAddress,
+  ensureCloudSqlVerifyFull,
+  liveDatabaseUrls,
+  moveServicesToDnsHost,
+} from "../cloudsql-tls.js";
 import { ensureConvergeJob } from "../converge-job-setup.js";
 import { findSqlInstance, planPublicRoleSwitch } from "../gateway-credentials.js";
 import type { GcloudRunner, Sleep } from "../gcloud-retry.js";
@@ -54,6 +60,8 @@ import {
   CAPTURE_JOB_ENV_VAR,
   type CloudRunEnvVar,
   CONVERGE_JOB_ENV_VAR,
+  DATABASE_URL_VARS,
+  INTERIM_FORWARD_ORIGIN_ENV,
   MCP_ENV_VAR,
   OPERATOR_ACCESS_JOB_ENV_VAR,
   remoteMcpIdentityEnv,
@@ -68,7 +76,7 @@ import {
 import { ensureUpgraderJob, resolveUpgraderTarget } from "../upgrader-setup.js";
 import { ensureUrlMapRedirectsAccess } from "../url-map-redirects-access.js";
 import type { AppRollHooks, AppRollPlan, RollPlan, RollSlug } from "./app-roll.js";
-import { lookupFailure } from "./gcp-lookup.js";
+import { findServiceUrl, lookupFailure } from "./gcp-lookup.js";
 import type { UpgradeReporter } from "./reporter.js";
 
 /**
@@ -139,7 +147,11 @@ export function startConverge(
   const { reporter: r, run } = deps;
   const runDeps = { run, ...(deps.sleep ? { sleep: deps.sleep } : {}) };
   const service = (slug: RollSlug) => plan.services.find((s) => s.slug === slug) as RollPlan;
-  const services = { admin: service("admin").serviceName, gateway: service("gateway").serviceName };
+  const services = {
+    admin: service("admin").serviceName,
+    gateway: service("gateway").serviceName,
+    "mcp-auth-proxy": service("mcp-auth-proxy").serviceName,
+  };
   const target = {
     provider: install.provider,
     projectId: install.projectId,
@@ -371,33 +383,50 @@ export function startConverge(
   }
 
   async function remoteMcpEdge(): Promise<void> {
-    // #806 — on `gcp` the load balancer routes the remote-MCP discovery
-    // paths to the gateway and Cloud Armor lets agent traffic through on
-    // /api/mcp/* (remote-mcp-edge.ts). Only remote MCP depends on it, so a
-    // failure warns.
+    // #806 / #1328 — on `gcp` the load balancer routes the remote-MCP paths
+    // to the MCP-Auth-Proxy's own backend, whose Cloud Armor policy lets
+    // agent traffic through on /api/mcp/* (remote-mcp-edge.ts). Only remote
+    // MCP depends on it, so a failure warns. The gateway being rolled in
+    // this run no longer answers those paths, so until this succeeds remote
+    // MCP is down on the site's domain — said below.
     if (install.provider !== "gcp") return;
-    const s = r.step("Ensuring the load balancer's remote-MCP routes and Cloud Armor rule...");
+    const s = r.step("Ensuring the MCP-Auth-Proxy's load-balancer route and Cloud Armor rule...");
     const edge = await ensureRemoteMcpEdge(
       {
         provider: install.provider,
         projectId: install.projectId,
+        region: install.region,
         env: install.env,
         domain: install.domain,
+        mcpAuthProxyImageRef: service("mcp-auth-proxy").imageRef,
       },
       { ...runDeps, ...(deps.http ? { http: deps.http } : {}) },
     );
     if (edge.ok) {
       for (const line of edge.done) r.info(`  ${line}`);
-      s.done("Remote-MCP load-balancer rules ready");
+      s.done("Remote-MCP load-balancer route ready");
       return;
     }
-    s.warned(`Remote-MCP load-balancer rules not set up: ${edge.error}`);
+    s.warned(`Remote-MCP load-balancer route not set up: ${edge.error}`);
     r.warn(
       "The upgrade continues; remote MCP (Settings → MCP → Remote) cannot be reached through the site's domain until this succeeds. Re-run upgrade once the cause is fixed.",
     );
     incomplete = true;
   }
 
+  async function interimForwardEnv(): Promise<CloudRunEnvVar[]> {
+    // #1328 — on gcp-firebase the proxy is the service the current live
+    // release's Firebase rewrite and the staging domain mapping still
+    // point at; it forwards that traffic to the data gateway, whose URL is
+    // its origin (stack-contract.ts INTERIM_FORWARD_ORIGIN_ENV). Without it
+    // the proxy answers the live site's /api/** with 404 until the next
+    // Publish live, and the staging host with 404 — so this aborts.
+    if (install.provider !== "gcp-firebase") return [];
+    const url = await findServiceUrl(run, install.projectId, install.region, services.gateway);
+    if (!url) throw new Error(`could not read the URL of ${services.gateway}`);
+    return [{ name: INTERIM_FORWARD_ORIGIN_ENV, value: new URL(url).origin }];
+  }
+
   async function remoteMcpIdentity(): Promise<Record<RollSlug, CloudRunEnvVar[]> | null> {
     // #806 — CAELO_ADMIN_URL / CAELO_MCP_PUBLIC_URL / CAELO_IAP_AUDIENCE
     // name identities the env contract cannot (stack-contract.ts
@@ -459,6 +488,71 @@ export function startConverge(
     return name ? { kind: "backend-services", service: name } : null;
   }
 
+  /** #1338 — the host the database TLS step moved the services onto. */
+  let databaseHost: string | null = null;
+
+  async function databaseTls(): Promise<boolean> {
+    // #1338 — verify-full TLS needs the shared server CA, the instance's
+    // DNS name resolving in the VPC, and the services dialling that name
+    // (cloudsql-tls.ts). Before migrations: the migration job reads its host
+    // from the admin's live URL, and the new images refuse anything less
+    // than verify-full. A failure aborts — the new revisions could not
+    // reach the database.
+    const s = r.step("Setting up verify-full TLS to the database (shared CA, private DNS name)...");
+    const liveUrls = plan.services.map((p) => ({
+      serviceName: p.serviceName,
+      liveUrls: liveDatabaseUrls(p.liveEnv, DATABASE_URL_VARS[p.slug]),
+    }));
+    // Only this step moves the services off the instance's IP, and only
+    // after the instance, its certificate and the DNS name are in shape —
+    // so services that dial a host name already went through it.
+    const onIp = liveUrls.some((u) => Object.values(u.liveUrls).some((v) => dialsIpAddress(v)));
+    if (!onIp) {
+      s.done("Database TLS ready: the services already dial the instance's DNS name");
+      return true;
+    }
+    const lookup = await findSqlInstance(install, { run });
+    if (lookup.status !== "found") {
+      s.failed(
+        `${lookupFailure(lookup, "Cloud SQL instance", install.credentials)}. Aborting upgrade.`,
+      );
+      r.warn(
+        "No traffic was shifted and no migrations ran. Re-run upgrade once the instance is found.",
+      );
+      return false;
+    }
+    const tlsDeps = { ...runDeps, ...(deps.http ? { http: deps.http } : {}) };
+    const tls = await ensureCloudSqlVerifyFull(
+      { projectId: install.projectId, env: install.env, sqlInstance: lookup.name },
+      tlsDeps,
+    );
+    for (const line of tls.done) r.info(`  ${line}`);
+    if (!tls.ok) {
+      s.failed(`Database TLS could not be set up: ${tls.error}. Aborting upgrade.`);
+      r.warn("No traffic was shifted and no migrations ran. Fix the above and re-run.");
+      return false;
+    }
+    const moved = await moveServicesToDnsHost(
+      { projectId: install.projectId, region: install.region },
+      liveUrls,
+      tls.host,
+      tlsDeps,
+    );
+    for (const line of moved.done) r.info(`  ${line}`);
+    if (!moved.ok) {
+      s.failed(
+        `The services could not be moved onto ${tls.host}: ${moved.error}. Aborting upgrade.`,
+      );
+      r.warn("No migrations ran. Fix the above and re-run.");
+      return false;
+    }
+    databaseHost = tls.host;
+    s.done(
+      `Database TLS ready: the services dial ${tls.host} (verify-full from the new revisions)`,
+    );
+    return true;
+  }
+
   async function databaseLogins(): Promise<boolean> {
     // #613 — public_role moves onto its own password right before the
     // gateway's roll. The gateway has no other database login (#635).
@@ -628,6 +722,7 @@ export function startConverge(
       if (!(await runtimeIdentities())) return false;
       if (!(await stackInvariants())) return false;
       if (!(await publicRoleIsolation())) return false;
+      if (!(await databaseTls())) return false;
       await mcpAccess();
       await urlMapRedirectsAccess();
       await auditJob();
@@ -642,11 +737,25 @@ export function startConverge(
         await upgraderJob();
         await convergeJob();
         await operatorAccess();
-        const extraEnv = await remoteMcpIdentity();
+        const identity = await remoteMcpIdentity();
+        let forward: CloudRunEnvVar[];
+        try {
+          forward = await interimForwardEnv();
+        } catch (e) {
+          r.error(
+            `The MCP-Auth-Proxy cannot be pointed at the data gateway: ${e instanceof Error ? e.message : String(e)}. Nothing was rolled; re-run upgrade once it is fixed.`,
+          );
+          return { ok: false };
+        }
+        const extraEnv: Partial<Record<RollSlug, CloudRunEnvVar[]>> = {
+          ...(identity ?? {}),
+          "mcp-auth-proxy": [...(identity?.["mcp-auth-proxy"] ?? []), ...forward],
+        };
         return {
           ok: true,
           leaveUntouched: [...leaveUntouched],
-          ...(extraEnv ? { extraEnv } : {}),
+          extraEnv,
+          ...(databaseHost ? { databaseHost } : {}),
         };
       },
       async beforeRoll(slug) {

package/src/upgrade/health.test.ts

@@ -6,7 +6,7 @@ import type { HttpFetch } from "../runtime-secrets.js";
 import {
   createIapHealthProbe,
   evaluateAdminDeepHealth,
-  evaluateGatewayDeepHealth,
+  evaluatePublicServiceDeepHealth,
   type HealthTarget,
   healthOrigins,
   IAM_PROPAGATION_WINDOW_MS,
@@ -72,27 +72,29 @@ describe("evaluateAdminDeepHealth", () => {
   });
 });
 
-describe("evaluateGatewayDeepHealth", () => {
-  it("accepts a healthy gateway on the admin's version", () => {
-    expect(
-      evaluateGatewayDeepHealth(200, JSON.stringify({ ok: true, version: "0.11.0" }), "0.11.0"),
-    ).toEqual({ ok: true, detail: "gateway 0.11.0" });
+describe("evaluatePublicServiceDeepHealth", () => {
+  it("accepts a healthy gateway; its version is not public any more (#1326)", () => {
+    expect(evaluatePublicServiceDeepHealth("gateway", 200, JSON.stringify({ ok: true }))).toEqual({
+      ok: true,
+      detail: "gateway healthy",
+    });
   });
 
-  it("refuses a gateway on another version than the admin", () => {
-    const r = evaluateGatewayDeepHealth(
-      200,
-      JSON.stringify({ ok: true, version: "0.10.0" }),
-      "0.11.0",
-    );
-    expect(r.ok).toBe(false);
+  it("ignores a version an older gateway still reports", () => {
+    expect(
+      evaluatePublicServiceDeepHealth(
+        "gateway",
+        200,
+        JSON.stringify({ ok: true, version: "0.10.0" }),
+      ).ok,
+    ).toBe(true);
   });
 
   it("refuses a gateway that can't reach its database", () => {
-    const r = evaluateGatewayDeepHealth(
+    const r = evaluatePublicServiceDeepHealth(
+      "gateway",
       503,
-      JSON.stringify({ ok: false, version: "0.11.0", error: { kind: "DbUnreachable" } }),
-      "0.11.0",
+      JSON.stringify({ ok: false, error: { kind: "DbUnreachable" } }),
     );
     expect(r).toEqual({ ok: false, error: "gateway reports unhealthy (HTTP 503, DbUnreachable)" });
   });
@@ -103,7 +105,8 @@ const FIREBASE: HealthTarget = {
   projectId: "acme",
   domain: "acme.com",
   adminServiceUrl: "https://caelo-production-admin-aaa-xyz.a.run.app",
-  gatewayServiceUrl: "https://caelo-production-gateway-bbb-xyz.a.run.app",
+  gatewayServiceUrl: "https://caelo-production-data-gateway-ddd-xyz.a.run.app",
+  mcpAuthProxyServiceUrl: "https://caelo-production-gateway-bbb-xyz.a.run.app",
 };
 
 describe("healthOrigins", () => {
@@ -111,13 +114,15 @@ describe("healthOrigins", () => {
     expect(healthOrigins({ ...FIREBASE, provider: "gcp" })).toEqual({
       admin: "https://admin.acme.com",
       gateway: "https://acme.com",
+      mcpAuthProxy: "https://acme.com",
     });
   });
 
   it("uses the run.app URLs on gcp-firebase", () => {
     expect(healthOrigins(FIREBASE)).toEqual({
       admin: "https://caelo-production-admin-aaa-xyz.a.run.app",
-      gateway: "https://caelo-production-gateway-bbb-xyz.a.run.app",
+      gateway: "https://caelo-production-data-gateway-ddd-xyz.a.run.app",
+      mcpAuthProxy: "https://caelo-production-gateway-bbb-xyz.a.run.app",
     });
   });
 });
@@ -130,8 +135,12 @@ describe("createIapHealthProbe", () => {
     exitCode: 0,
   });
 
-  /** A fake network: signJwt + the two health endpoints. */
-  function network(answers: { admin: () => [number, string]; gateway: () => [number, string] }) {
+  /** A fake network: signJwt + the three health endpoints (the proxy answers healthy unless given). */
+  function network(answers: {
+    admin: () => [number, string];
+    gateway: () => [number, string];
+    proxy?: () => [number, string];
+  }) {
     const requests: { url: string; headers: Record<string, string>; body?: string }[] = [];
     const http: HttpFetch = async (url, init) => {
       requests.push({ url, headers: init.headers, ...(init.body ? { body: init.body } : {}) });
@@ -139,7 +148,9 @@ describe("createIapHealthProbe", () => {
         ? [200, JSON.stringify({ signedJwt: "signed.jwt" })]
         : url.includes("admin")
           ? answers.admin()
-          : answers.gateway();
+          : url.endsWith("/api/mcp/health")
+            ? (answers.proxy ?? (() => [200, JSON.stringify({ ok: true, version: "0.11.0" })]))()
+            : answers.gateway();
       return { ok: status < 400, status, text: async () => text };
     };
     return { http, requests };
@@ -148,7 +159,7 @@ describe("createIapHealthProbe", () => {
   it("signs an IAP credential for the admin origin and sends it to the admin only", async () => {
     const net = network({
       admin: () => [200, adminBody()],
-      gateway: () => [200, JSON.stringify({ ok: true, version: "0.11.0" })],
+      gateway: () => [200, JSON.stringify({ ok: true })],
     });
     const probe = createIapHealthProbe(FIREBASE, {
       run: gcloudOk,
@@ -160,7 +171,7 @@ describe("createIapHealthProbe", () => {
     expect(await probe.deep({ version: "0.11.0" })).toEqual({
       ok: true,
       detail:
-        "admin 0.11.0, migrations at 0262_tool_approval_branch.sql / 0040_x.sql; gateway 0.11.0",
+        "admin 0.11.0, migrations at 0262_tool_approval_branch.sql / 0040_x.sql; gateway healthy; MCP-Auth-Proxy healthy",
     });
     const sign = net.requests[0];
     expect(sign?.url).toBe(
@@ -180,9 +191,36 @@ describe("createIapHealthProbe", () => {
     expect(admin?.headers.Authorization).toBe("Bearer signed.jwt");
     const gateway = net.requests.find((r) => r.url.endsWith("/api/_caelo/health?deep=1"));
     expect(gateway?.url).toBe(
-      "https://caelo-production-gateway-bbb-xyz.a.run.app/api/_caelo/health?deep=1",
+      "https://caelo-production-data-gateway-ddd-xyz.a.run.app/api/_caelo/health?deep=1",
     );
     expect(gateway?.headers.Authorization).toBeUndefined();
+    // #1328 — the proxy, on the service that was the gateway, by version.
+    const proxy = net.requests.find((r) => r.url.endsWith("/api/mcp/health"));
+    expect(proxy?.url).toBe("https://caelo-production-gateway-bbb-xyz.a.run.app/api/mcp/health");
+    expect(proxy?.headers.Authorization).toBeUndefined();
+  });
+
+  it("#1328 — fails the deep check while the MCP-Auth-Proxy is unhealthy or does not answer", async () => {
+    const deepWith = (proxy: () => [number, string]) =>
+      createIapHealthProbe(FIREBASE, {
+        run: gcloudOk,
+        http: network({
+          admin: () => [200, adminBody()],
+          gateway: () => [200, JSON.stringify({ ok: true, version: "0.11.0" })],
+          proxy,
+        }).http,
+        sleep: async () => {},
+        accessJustChanged: false,
+        attempts: 1,
+      }).deep({ version: "0.11.0" });
+    expect(await deepWith(() => [503, JSON.stringify({ ok: false })])).toEqual({
+      ok: false,
+      error: "MCP-Auth-Proxy reports unhealthy (HTTP 503, no reason)",
+    });
+    expect(await deepWith(() => [404, "<html>Not Found</html>"])).toEqual({
+      ok: false,
+      error: "MCP-Auth-Proxy answered HTTP 404 without JSON",
+    });
   });
 
   it("retries while the new revisions warm up, then gives the last error", async () => {
@@ -194,7 +232,7 @@ describe("createIapHealthProbe", () => {
           ? [503, adminBody({ ok: false, migrations: migrations(1) })]
           : [200, adminBody()];
       },
-      gateway: () => [200, JSON.stringify({ ok: true, version: "0.11.0" })],
+      gateway: () => [200, JSON.stringify({ ok: true })],
     });
     const probe = createIapHealthProbe(FIREBASE, {
       run: gcloudOk,

package/src/upgrade/health.ts

@@ -11,9 +11,12 @@
  *   - admin   `GET /_caelo/health?deep=1` → `{ ok, version, migrations }`:
  *             both databases reachable as the expected roles, and every
  *             migration the image ships recorded as applied.
- *   - gateway `GET /api/_caelo/health?deep=1` → `{ ok, version }`: its
- *             database logins work. Under `/api/` because that is the only
+ *   - gateway `GET /api/_caelo/health?deep=1` → `{ ok }` (no version since
+ *             #1326): its database login works. Under `/api/` because that is the only
  *             path the gcp load balancer routes to the gateway.
+ *   - MCP-Auth-Proxy `GET /api/mcp/health` → `{ ok }` (#1328, no version
+ *             either): it has no database, so it answers once it runs; under
+ *             `/api/mcp/`, the prefix the gcp load balancer routes to it.
  *
  * Both answer with no secrets and no raw database errors. The admin sits
  * behind IAP, so the probe signs an IAP credential as the install's MCP
@@ -134,29 +137,41 @@ export function evaluateAdminDeepHealth(
   };
 }
 
-/** Judge the gateway's deep health answer against the version the admin runs. */
-export function evaluateGatewayDeepHealth(
+/**
+ * Judge a public service's deep health answer: the gateway's, or the
+ * MCP-Auth-Proxy's (#1328). Since #1326 the public services report no
+ * release version (a public version string names the flaws to try), so
+ * this proves only that the service answers healthy — for the gateway,
+ * that its database login works. Which release it runs the roll itself
+ * establishes: `update --image` with the pinned digest succeeded and
+ * traffic moved to that revision (app-roll.ts), or the roll already failed.
+ *
+ * @param service how the errors name it (`gateway`, `MCP-Auth-Proxy`)
+ */
+export function evaluatePublicServiceDeepHealth(
+  service: string,
   status: number,
   text: string,
-  expectedVersion: string,
 ): HealthOutcome {
-  const body = parseJson<{ ok?: boolean; version?: string; error?: { kind?: string } }>(text);
-  if (!body) return { ok: false, error: `gateway answered HTTP ${status} without JSON` };
+  const body = parseJson<{ ok?: boolean; error?: { kind?: string } }>(text);
+  if (!body) return { ok: false, error: `${service} answered HTTP ${status} without JSON` };
   if (status !== 200 || body.ok !== true) {
     return {
       ok: false,
-      error: `gateway reports unhealthy (HTTP ${status}, ${body.error?.kind ?? "no reason"})`,
+      error: `${service} reports unhealthy (HTTP ${status}, ${body.error?.kind ?? "no reason"})`,
     };
   }
-  if (body.version !== expectedVersion) {
-    return {
-      ok: false,
-      error: `gateway runs ${body.version ?? "an unknown version"}, the admin runs ${expectedVersion}`,
-    };
-  }
-  return { ok: true, detail: `gateway ${body.version}` };
+  return { ok: true, detail: `${service} healthy` };
 }
 
+/**
+ * The MCP-Auth-Proxy's health path (apps/mcp-auth-proxy server.ts). Under
+ * `/api/mcp/` because on gcp that is the prefix the load balancer routes to
+ * the proxy; it answers before any other routing, also while remote MCP is
+ * off.
+ */
+export const MCP_AUTH_PROXY_HEALTH_PATH = "/api/mcp/health";
+
 /** Where the probe reaches the install. */
 export interface HealthTarget {
   readonly provider: "gcp" | "gcp-firebase";
@@ -166,20 +181,32 @@ export interface HealthTarget {
   readonly adminServiceUrl: string;
   /** The gateway service's `run.app` URL (public on gcp-firebase). */
   readonly gatewayServiceUrl: string;
+  /** The MCP-Auth-Proxy service's `run.app` URL (public on gcp-firebase). */
+  readonly mcpAuthProxyServiceUrl: string;
 }
 
 /**
  * The origins the probe calls. On gcp the admin's IAP lives on the load
- * balancer (`admin.<domain>`) and the gateway's ingress is load-balancer-only
- * (`<domain>/api/*`); on gcp-firebase both `run.app` URLs are reachable — the
- * admin's through Cloud Run's own IAP, the gateway's publicly.
+ * balancer (`admin.<domain>`), and the gateway's and the proxy's ingress is
+ * load-balancer-only (`<domain>/api/*`, `<domain>/api/mcp/*`); on
+ * gcp-firebase every `run.app` URL is reachable — the admin's through Cloud
+ * Run's own IAP, the others publicly.
  */
-export function healthOrigins(target: HealthTarget): { admin: string; gateway: string } {
+export function healthOrigins(target: HealthTarget): {
+  admin: string;
+  gateway: string;
+  mcpAuthProxy: string;
+} {
   return target.provider === "gcp"
-    ? { admin: `https://admin.${target.domain}`, gateway: `https://${target.domain}` }
+    ? {
+        admin: `https://admin.${target.domain}`,
+        gateway: `https://${target.domain}`,
+        mcpAuthProxy: `https://${target.domain}`,
+      }
     : {
         admin: new URL(target.adminServiceUrl).origin,
         gateway: new URL(target.gatewayServiceUrl).origin,
+        mcpAuthProxy: new URL(target.mcpAuthProxyServiceUrl).origin,
       };
 }
 
@@ -437,7 +464,12 @@ export function createIapHealthProbe(target: HealthTarget, deps: HealthProbeDeps
     if (!a.ok) return a;
     const gateway = await get(`${origins.gateway}/api/_caelo/health?deep=1`, {});
     if (!gateway.reached) return { ok: false, error: `gateway unreachable: ${gateway.error}` };
-    const g = evaluateGatewayDeepHealth(gateway.status, gateway.text, a.version);
-    return g.ok ? { ok: true, detail: `${a.detail}; ${g.detail}` } : g;
+    const g = evaluatePublicServiceDeepHealth("gateway", gateway.status, gateway.text);
+    if (!g.ok) return g;
+    // #1328 — the proxy holds no database login: healthy once it answers.
+    const proxy = await get(`${origins.mcpAuthProxy}${MCP_AUTH_PROXY_HEALTH_PATH}`, {});
+    if (!proxy.reached) return { ok: false, error: `MCP-Auth-Proxy unreachable: ${proxy.error}` };
+    const p = evaluatePublicServiceDeepHealth("MCP-Auth-Proxy", proxy.status, proxy.text);
+    return p.ok ? { ok: true, detail: `${a.detail}; ${g.detail}; ${p.detail}` } : p;
   }
 }

package/src/upgrade/image-forms.test.ts

@@ -184,6 +184,40 @@ describe("platformDigestsOf", () => {
     expect(calls).toEqual([]);
   });
 
+  it("#1328: carries the MCP-Auth-Proxy's signed form, and skips a proxy digest install.json lacks", async () => {
+    const calls: string[] = [];
+    const forms = createReleaseImageForms(fakeRegistryFetch(calls));
+    const m = {
+      version: "0.12.0",
+      digests: { admin: D("a"), gateway: D("b"), ops: D("c"), "mcp-auth-proxy": D("d") },
+      platformDigests: { admin: D("1"), gateway: D("2"), ops: D("3"), "mcp-auth-proxy": D("4") },
+    };
+    expect(
+      await platformDigestsOf(
+        { admin: D("a"), gateway: D("b"), "mcp-auth-proxy": D("d") },
+        forms,
+        m,
+      ),
+    ).toEqual({
+      ok: true,
+      platformDigests: { admin: D("1"), gateway: D("2"), "mcp-auth-proxy": D("4") },
+    });
+    // Recorded before the proxy existed: no proxy form, and nothing looked up for it.
+    expect(await platformDigestsOf({ admin: D("a"), gateway: D("b") }, forms, m)).toEqual({
+      ok: true,
+      platformDigests: { admin: D("1"), gateway: D("2") },
+    });
+    expect(calls).toEqual([]);
+  });
+
+  it("#1328: a release from before the proxy ships no proxy image form", async () => {
+    const forms = createReleaseImageForms(fakeRegistryFetch([]));
+    const m = { version: "0.11.0", digests: { admin: D("a"), gateway: D("b"), ops: D("c") } };
+    const r = await forms.of(m, "mcp-auth-proxy");
+    expect(r).toMatchObject({ ok: false, transient: false });
+    expect(r.ok ? "" : r.message).toContain("ships no mcp-auth-proxy image");
+  });
+
   it("says why when an index cannot be read", async () => {
     const forms = createReleaseImageForms(fakeRegistryFetch([], { status: 503 }));
     const r = await platformDigestsOf({ admin: ADMIN_INDEX, gateway: GATEWAY_INDEX }, forms);

package/src/upgrade/image-forms.ts

@@ -30,7 +30,7 @@
 import { z } from "zod";
 import type { ImageDigests } from "../install-state.js";
 import type { ReleaseManifest } from "../release-manifest.js";
-import type { RollSlug } from "./app-roll.js";
+import { ROLL_ORDER, type RollSlug } from "./app-roll.js";
 import { fetchRegistryManifest, IMAGE_DIGEST, RELEASE_REGISTRY } from "./release-images.js";
 
 /** The digests one release image is known by. */
@@ -178,12 +178,20 @@ export function createReleaseImageForms(fetchImpl: typeof fetch = fetch): Releas
   return {
     ofIndex,
     of: async (m, slug) => {
+      const index = m.digests[slug];
+      if (!index) {
+        // #1328 — a release from before the MCP-Auth-Proxy signs no image of it.
+        return {
+          ok: false,
+          transient: false,
+          message: `release ${m.version} ships no ${slug} image`,
+        };
+      }
       const signed = m.platformDigests?.[slug];
       if (signed) {
-        const index = m.digests[slug];
         return { ok: true, digests: [index, ...(signed === index ? [] : [signed])], amd64: signed };
       }
-      return ofIndex(slug, m.digests[slug]);
+      return ofIndex(slug, index);
     },
   };
 }
@@ -205,22 +213,29 @@ export async function platformDigestsOf(
   | { readonly ok: false; readonly message: string }
 > {
   const out: Partial<Record<RollSlug, string>> = {};
-  for (const slug of ["admin", "gateway"] as const) {
+  for (const slug of ROLL_ORDER) {
+    const index = digests[slug];
+    // #1328 — digests recorded before the MCP-Auth-Proxy existed carry none.
+    if (!index) continue;
     const found =
-      manifest && manifest.digests[slug] === digests[slug]
+      manifest && manifest.digests[slug] === index
         ? await forms.of(manifest, slug)
-        : await forms.ofIndex(slug, digests[slug]);
+        : await forms.ofIndex(slug, index);
     if (!found.ok) return { ok: false, message: found.message };
     if (!found.amd64) {
       return {
         ok: false,
-        message: `the ${slug} image index ${digests[slug]} lists no single linux/amd64 manifest`,
+        message: `the ${slug} image index ${index} lists no single linux/amd64 manifest`,
       };
     }
     out[slug] = found.amd64;
   }
   const { admin, gateway } = out;
+  const proxy = out["mcp-auth-proxy"];
   return admin && gateway
-    ? { ok: true, platformDigests: { admin, gateway } }
+    ? {
+        ok: true,
+        platformDigests: { admin, gateway, ...(proxy ? { "mcp-auth-proxy": proxy } : {}) },
+      }
     : { ok: false, message: "the platform digests could not be read" };
 }

package/src/upgrade/release-images.test.ts

@@ -70,7 +70,11 @@ describe("resolveRegistryDigest", () => {
     const missing = fakeFetch(() => new Response(null, { status: 404, statusText: "Not Found" }));
     expect(
       await resolveRegistryDigest("ghcr.io", "caelo-cms/admin", "9.9.9", missing.impl),
-    ).toEqual({ ok: false, reason: "HTTP 404 Not Found" });
+    ).toEqual({ ok: false, reason: "HTTP 404 Not Found", notFound: true });
+    // Only a 404 is the verdict "no such tag" (#1328); an outage is not.
+    const down = fakeFetch(() => new Response(null, { status: 503 }));
+    const outage = await resolveRegistryDigest("ghcr.io", "caelo-cms/admin", "9.9.9", down.impl);
+    expect(outage.ok === false && "notFound" in outage).toBe(false);
     const bad = fakeFetch(
       () => new Response(null, { status: 200, headers: { "docker-content-digest": "md5:x" } }),
     );