@caelo-cms/provisioning 0.11.8 → 0.11.10

package/src/upgrader-records.test.ts

@@ -29,13 +29,21 @@ import {
 } from "./upgrader-records.js";
 
 const D = (c: string) => `sha256:${c.repeat(64)}`;
+// #1328 — the MCP-Auth-Proxy's index; serving revisions name it as is here,
+// so it matches without a registry lookup.
+const PROXY_INDEX = `sha256:${"e".repeat(64)}`;
 const ok = (stdout = ""): GcloudResult => ({ ok: true, stdout, stderr: "", exitCode: 0 });
 
 const V064: ReleaseManifest = {
   manifestVersion: 1,
   version: "0.10.64",
   channel: "stable",
-  digests: { admin: ADMIN_INDEX, gateway: GATEWAY_INDEX, ops: D("c") },
+  digests: {
+    admin: ADMIN_INDEX,
+    gateway: GATEWAY_INDEX,
+    ops: D("c"),
+    "mcp-auth-proxy": PROXY_INDEX,
+  },
   minFromVersion: "0.10.0",
   infraContractVersion: 13,
   migrations: { contract: false, lastContractVersion: null, head: "0338_x" },
@@ -51,13 +59,17 @@ const META: InstallMetadata = {
   ownerEmail: "owner@acme.com",
   region: "europe-west1",
   createdAt: "2026-01-01T00:00:00Z",
-  imageDigests: { admin: ADMIN_INDEX, gateway: GATEWAY_INDEX },
+  imageDigests: { admin: ADMIN_INDEX, gateway: GATEWAY_INDEX, "mcp-auth-proxy": PROXY_INDEX },
   releaseVersion: "0.10.64",
   infraContractVersion: 13,
 };
 
 /** What the serving revisions read back as on searchviu-website (spec = status). */
-const LIVE_SERVING: ServingDigests = { admin: [ADMIN_AMD64], gateway: [GATEWAY_AMD64] };
+const LIVE_SERVING: ServingDigests = {
+  admin: [ADMIN_AMD64],
+  gateway: [GATEWAY_AMD64],
+  "mcp-auth-proxy": [PROXY_INDEX],
+};
 
 function deps(
   opts: {
@@ -112,16 +124,38 @@ describe("recordMatchesServing", () => {
     const both = { ...META, platformDigests: { admin: ADMIN_AMD64, gateway: GATEWAY_AMD64 } };
     expect(recordMatchesServing(both, LIVE_SERVING)).toBe(true);
     // Still by the index when a revision names it.
-    expect(recordMatchesServing(META, { admin: [ADMIN_INDEX], gateway: [GATEWAY_INDEX] })).toBe(
-      true,
-    );
+    expect(
+      recordMatchesServing(META, {
+        admin: [ADMIN_INDEX],
+        gateway: [GATEWAY_INDEX],
+        "mcp-auth-proxy": [PROXY_INDEX],
+      }),
+    ).toBe(true);
   });
 
   it("both services must match, and no record never matches", () => {
     const both = { ...META, platformDigests: { admin: ADMIN_AMD64, gateway: GATEWAY_AMD64 } };
-    expect(recordMatchesServing(both, { admin: [ADMIN_AMD64], gateway: [D("6")] })).toBe(false);
+    expect(
+      recordMatchesServing(both, {
+        admin: [ADMIN_AMD64],
+        gateway: [D("6")],
+        "mcp-auth-proxy": [PROXY_INDEX],
+      }),
+    ).toBe(false);
     expect(recordMatchesServing({}, LIVE_SERVING)).toBe(false);
   });
+
+  it("#1328: an install.json from before the MCP-Auth-Proxy (no proxy digest) never matches", () => {
+    const { "mcp-auth-proxy": _none, ...old } = META.imageDigests as NonNullable<
+      InstallMetadata["imageDigests"]
+    >;
+    const both = {
+      ...META,
+      imageDigests: old,
+      platformDigests: { admin: ADMIN_AMD64, gateway: GATEWAY_AMD64 },
+    };
+    expect(recordMatchesServing(both, LIVE_SERVING)).toBe(false);
+  });
 });
 
 describe("findServingRelease", () => {
@@ -141,12 +175,12 @@ describe("findServingRelease", () => {
   it("an attestation manifest of the index is not a serving image of the release", async () => {
     const r = await findServingRelease(
       META,
-      { admin: [ADMIN_ATTESTATION], gateway: [GATEWAY_AMD64] },
+      { admin: [ADMIN_ATTESTATION], gateway: [GATEWAY_AMD64], "mcp-auth-proxy": [PROXY_INDEX] },
       deps(),
     );
     expect(r.ok).toBe(false);
     expect(r.ok ? "" : r.reason).toContain(
-      "The gateway serves v0.10.64's image, the admin does not.",
+      "The gateway and the MCP-Auth-Proxy serve v0.10.64's image, the admin does not.",
     );
   });
 
@@ -166,7 +200,11 @@ describe("findServingRelease", () => {
   });
 
   it("a digest in no signed index is still refused with the current message", async () => {
-    const r = await findServingRelease(META, { admin: [D("7")], gateway: [D("6")] }, deps());
+    const r = await findServingRelease(
+      META,
+      { admin: [D("7")], gateway: [D("6")], "mcp-auth-proxy": [PROXY_INDEX] },
+      deps(),
+    );
     expect(r).toMatchObject({ ok: false, retryable: false });
     expect(r.ok ? "" : r.reason).toContain(
       "are not the ones install.json names, and they do not belong to one signed Caelo release",
@@ -190,13 +228,60 @@ describe("findServingRelease", () => {
 
   it("finds the release by the template's index when install.json names none", async () => {
     const { releaseVersion: _none, ...unversioned } = META;
-    const meta = { ...unversioned, imageDigests: { admin: D("9"), gateway: D("8") } };
+    const meta = {
+      ...unversioned,
+      imageDigests: { admin: D("9"), gateway: D("8"), "mcp-auth-proxy": D("5") },
+    };
     const d = deps({
       tags: { admin: { "0.10.64": ADMIN_INDEX } },
-      hints: { admin: [ADMIN_INDEX], gateway: [GATEWAY_INDEX] },
+      hints: { admin: [ADMIN_INDEX], gateway: [GATEWAY_INDEX], "mcp-auth-proxy": [PROXY_INDEX] },
     });
     const r = await findServingRelease(meta, LIVE_SERVING, d);
     expect(r.ok && r.manifest.version).toBe("0.10.64");
     expect(d.fetched).toEqual(["0.10.64"]);
   });
 });
+
+describe("findServingRelease — the MCP-Auth-Proxy (#1328)", () => {
+  it("records the proxy's signed platform form with the others", async () => {
+    const PROXY_AMD64 = `sha256:${"f".repeat(64)}`;
+    const signed: ReleaseManifest = {
+      ...V064,
+      platformDigests: {
+        admin: ADMIN_AMD64,
+        gateway: GATEWAY_AMD64,
+        ops: D("3"),
+        "mcp-auth-proxy": PROXY_AMD64,
+      },
+    };
+    const r = await findServingRelease(
+      META,
+      { ...LIVE_SERVING, "mcp-auth-proxy": [PROXY_AMD64] },
+      deps({ manifests: { "0.10.64": signed } }),
+    );
+    expect(r).toMatchObject({
+      ok: true,
+      platformDigests: {
+        admin: ADMIN_AMD64,
+        gateway: GATEWAY_AMD64,
+        "mcp-auth-proxy": PROXY_AMD64,
+      },
+    });
+  });
+
+  it("a release from before the proxy cannot be what serves (its manifest names no proxy)", async () => {
+    const { "mcp-auth-proxy": _none, ...digests } = V064.digests;
+    const old: ReleaseManifest = { ...V064, digests };
+    const r = await findServingRelease(META, LIVE_SERVING, deps({ manifests: { "0.10.64": old } }));
+    expect(r.ok).toBe(false);
+  });
+
+  it("a proxy of another release is refused", async () => {
+    const r = await findServingRelease(
+      META,
+      { ...LIVE_SERVING, "mcp-auth-proxy": [D("4")] },
+      deps(),
+    );
+    expect(r.ok).toBe(false);
+  });
+});

package/src/upgrader-records.ts

@@ -30,14 +30,16 @@
 import type { GcloudRunner } from "./gcloud-retry.js";
 import type { ImageDigests, InstallMetadata } from "./install-state.js";
 import type { ReleaseManifest, ReleaseManifestResult } from "./release-manifest.js";
-import type { RollSlug } from "./upgrade/app-roll.js";
+import { ROLL_ORDER, type RollSlug } from "./upgrade/app-roll.js";
 import type { ReleaseImageForms } from "./upgrade/image-forms.js";
 import { releaseVersionForDigest } from "./upgrade/release-images.js";
 
 /** Every digest each serving image is known by (gcp-lookup.ts servingImageDigests). */
 export type ServingDigests = Readonly<Record<RollSlug, readonly string[]>>;
 
-const SLUGS: readonly RollSlug[] = ["admin", "gateway"];
+// #1328 — the MCP-Auth-Proxy serves on every install this code runs on (the
+// upgrader runs only on installs converged to its contract).
+const SLUGS: readonly RollSlug[] = ROLL_ORDER;
 
 /**
  * Whether install.json names the images that serve: per service, the
@@ -50,11 +52,14 @@ export function recordMatchesServing(
 ): boolean {
   const { imageDigests, platformDigests } = recorded;
   if (!imageDigests) return false;
-  return SLUGS.every(
-    (slug) =>
-      serving[slug].includes(imageDigests[slug]) ||
-      (platformDigests !== undefined && serving[slug].includes(platformDigests[slug])),
-  );
+  return SLUGS.every((slug) => {
+    const index = imageDigests[slug];
+    const platform = platformDigests?.[slug];
+    return (
+      (index !== undefined && serving[slug].includes(index)) ||
+      (platform !== undefined && serving[slug].includes(platform))
+    );
+  });
 }
 
 /** What {@link findServingRelease} learned. */
@@ -139,7 +144,7 @@ export async function findServingRelease(
     if (judged.matching.length > 0) {
       const other = SLUGS.filter((s) => !judged.matching.includes(s));
       partial.push(
-        `the ${judged.matching.join(", ")} serves v${m.version}'s image, the ${other.join(", ")} does not`,
+        `${serviceList(judged.matching)} ${judged.matching.length > 1 ? "serve" : "serves"} v${m.version}'s image, ${serviceList(other)} ${other.length > 1 ? "do" : "does"} not`,
       );
     }
   }
@@ -162,7 +167,7 @@ export async function findServingRelease(
       ...(unverified.length > 0
         ? [`These release records could not be verified: ${unverified.join("; ")}.`]
         : []),
-      "Nothing was changed. Check who deployed these images (the Cloud Run revision history of both services); an upgrade with Cloud Shell puts a signed release back.",
+      "Nothing was changed. Check who deployed these images (the Cloud Run revision history of the services); an upgrade with Cloud Shell puts a signed release back.",
     ].join(" "),
   };
 }
@@ -189,7 +194,10 @@ async function judgeRelease(
   const matching: RollSlug[] = [];
   const platform: Partial<Record<RollSlug, string>> = {};
   for (const slug of SLUGS) {
-    if (serving[slug].includes(m.digests[slug])) {
+    const index = m.digests[slug];
+    // #1328 — a release from before the proxy cannot be what serves here.
+    if (!index) continue;
+    if (serving[slug].includes(index)) {
       matching.push(slug);
       const signed = m.platformDigests?.[slug];
       if (signed) platform[slug] = signed;
@@ -205,10 +213,12 @@ async function judgeRelease(
     }
   }
   const { admin, gateway } = platform;
+  const proxy = platform["mcp-auth-proxy"];
   return {
     kind: "judged",
     matching,
-    platformDigests: admin && gateway ? { admin, gateway } : null,
+    platformDigests:
+      admin && gateway ? { admin, gateway, ...(proxy ? { "mcp-auth-proxy": proxy } : {}) } : null,
   };
 }
 
@@ -245,3 +255,10 @@ async function* candidateVersions(
 function capitalize(s: string): string {
   return s.charAt(0).toUpperCase() + s.slice(1);
 }
+
+/** `the admin`, `the gateway and the MCP-Auth-Proxy`, … for the refusal text. */
+function serviceList(slugs: readonly RollSlug[]): string {
+  const names = slugs.map((s) => (s === "mcp-auth-proxy" ? "the MCP-Auth-Proxy" : `the ${s}`));
+  if (names.length <= 1) return names[0] ?? "";
+  return `${names.slice(0, -1).join(", ")} and ${names[names.length - 1]}`;
+}

package/src/upgrader-setup.test.ts

@@ -81,6 +81,8 @@ describe("ensureUpgraderJob", () => {
         "projects add-iam-policy-binding acme → projects/acme/roles/caeloUpgraderSqlBackup",
         "iam service-accounts add-iam-policy-binding caelo-production-run-sa@acme.iam.gserviceaccount.com → roles/iam.serviceAccountUser",
         "iam service-accounts add-iam-policy-binding caelo-production-gateway-sa@acme.iam.gserviceaccount.com → roles/iam.serviceAccountUser",
+        // #1328 — the MCP-Auth-Proxy's revisions run as its own account.
+        "iam service-accounts add-iam-policy-binding caelo-production-mcp-proxy-sa@acme.iam.gserviceaccount.com → roles/iam.serviceAccountUser",
         "iam service-accounts add-iam-policy-binding caelo-production-upgrader@acme.iam.gserviceaccount.com → roles/iam.serviceAccountUser",
         "iam service-accounts add-iam-policy-binding caelo-mcp@acme.iam.gserviceaccount.com → roles/iam.serviceAccountTokenCreator",
         "iam service-accounts add-iam-policy-binding caelo-production-audit@acme.iam.gserviceaccount.com → roles/iam.serviceAccountUser",

package/src/upgrader-setup.ts

@@ -27,11 +27,11 @@
  *     PULUMI_*) and so act as the provisioner (#883 review). The custom role
  *     has no `runWithOverrides` and no `*.setIamPolicy`. Updating another
  *     job (the converge job's image, say) additionally needs `actAs` on its
- *     service account, which the upgrader holds only on the admin, gateway
- *     and its own. A grant of `roles/run.developer` left by an earlier
+ *     service account, which the upgrader holds only on the admin, gateway,
+ *     MCP-Auth-Proxy and its own. A grant of `roles/run.developer` left by an earlier
  *     setup is removed.
- *   - `roles/iam.serviceAccountUser` on exactly the admin's and the
- *     gateway's runtime service accounts (a revision runs as them), on
+ *   - `roles/iam.serviceAccountUser` on exactly the admin's, the
+ *     gateway's and the MCP-Auth-Proxy's (#1328) runtime service accounts (a revision runs as them), on
  *     itself (its own job) and on the quality-audit and capture jobs'
  *     accounts (the app-roll moves those jobs' images, #875, #1217) — not
  *     on the project.
@@ -79,6 +79,7 @@ import {
   auditServiceAccountEmail,
   captureServiceAccountEmail,
   gatewayServiceAccountEmail,
+  mcpAuthProxyServiceAccountEmail,
   mcpIapServiceAccountEmail,
   runServiceAccountEmail,
   upgraderJobName,
@@ -367,6 +368,11 @@ export async function ensureUpgraderJob(
       role: "roles/iam.serviceAccountUser",
       why: "gateway revisions run as it",
     },
+    {
+      account: mcpAuthProxyServiceAccountEmail(projectId, env),
+      role: "roles/iam.serviceAccountUser",
+      why: "MCP-Auth-Proxy revisions run as it (#1328)",
+    },
     { account: sa, role: "roles/iam.serviceAccountUser", why: "the job updates its own image" },
     {
       account: auditServiceAccountEmail(projectId, env),

package/src/wizards/gcp-cost.test.ts

@@ -0,0 +1,50 @@
+// SPDX-License-Identifier: MPL-2.0
+
+/**
+ * #1328 — the pre-flight cost table shows the MCP-Auth-Proxy on both GCP
+ * variants, its own Cloud Armor policy on `gcp`, and the gcp-firebase data
+ * gateway (CLAUDE.md §11.C: every billable resource has a cost line).
+ */
+
+import { describe, expect, it } from "bun:test";
+import { type CostEstimateInputs, estimateGcpCost } from "./gcp-cost.js";
+
+const inputs: CostEstimateInputs = {
+  cloudSqlTier: "db-f1-micro",
+  cloudSqlHa: false,
+  adminMinInstances: 0,
+  gatewayMinInstances: 0,
+  wafAdaptiveProtection: false,
+  region: "europe-west1",
+};
+
+function names(provider: "gcp" | "gcp-firebase"): string[] {
+  return estimateGcpCost({ ...inputs, provider }).lines.map((l) => l.name);
+}
+
+describe("cost table: MCP-Auth-Proxy (#1328)", () => {
+  it("lists the proxy's Cloud Run service at $0 idle on both variants", () => {
+    for (const provider of ["gcp", "gcp-firebase"] as const) {
+      const line = estimateGcpCost({ ...inputs, provider }).lines.find(
+        (l) => l.name === "Cloud Run MCP-Auth-Proxy",
+      );
+      expect(line?.monthlyUsd).toBe(0);
+      expect(line?.notes).toContain("scale-to-zero");
+    }
+  });
+
+  it("prices the proxy's own Cloud Armor policy on gcp only (policy + 2 rules)", () => {
+    const gcp = estimateGcpCost({ ...inputs, provider: "gcp" }).lines.find((l) =>
+      l.name.startsWith("MCP-Auth-Proxy backend"),
+    );
+    expect(gcp?.monthlyUsd).toBe(7);
+    expect(names("gcp-firebase").some((n) => n.startsWith("MCP-Auth-Proxy backend"))).toBe(false);
+    // The throttle moved off the gateway's policy: no separate rule line.
+    expect(names("gcp")).not.toContain("Cloud Armor rule: remote MCP throttle");
+  });
+
+  it("names the gcp-firebase visitor gateway as the data gateway", () => {
+    expect(names("gcp-firebase")).toContain("Cloud Run data gateway");
+    expect(names("gcp")).toContain("Cloud Run gateway");
+  });
+});

package/src/wizards/gcp-cost.ts

@@ -116,13 +116,24 @@ export function estimateGcpCost(inputs: CostEstimateInputs): {
         "one short container per server-side screenshot or page render (~20-40 s at 1 vCPU / 2 GiB): ~$0.001 each, a 50-page site import ~$0.05; mostly in the free tier; capture bucket ~$0",
     },
     {
-      name: "Cloud Run gateway",
+      // #1328 — on gcp-firebase the visitor gateway is the new
+      // `caelo-<env>-data-gateway` service; same billing either way.
+      name: provider === "gcp" ? "Cloud Run gateway" : "Cloud Run data gateway",
       monthlyUsd: inputs.gatewayMinInstances === 0 ? 1 : 1 + inputs.gatewayMinInstances * 15,
       notes:
         inputs.gatewayMinInstances === 0
           ? "scale-to-zero; ~$1/mo light traffic"
           : `${inputs.gatewayMinInstances} min-instance${inputs.gatewayMinInstances > 1 ? "s" : ""}`,
     },
+    {
+      // #1328 — remote MCP's sign-in service, its own service on every
+      // install (E14 a of #763): always provisioned, zero minimum instances,
+      // CPU only during requests, so it costs nothing while nobody connects.
+      name: "Cloud Run MCP-Auth-Proxy",
+      monthlyUsd: 0,
+      notes:
+        "scale-to-zero, request-based CPU; only external AI apps' sign-in and MCP calls wake it, mostly in the free tier",
+    },
     // v0.3.3 — LB / Cloud CDN / Cloud Armor lines apply only to the
     // gcp variant. gcp-firebase has no LB (Firebase Hosting is the
     // edge); no Cloud CDN line (Firebase Hosting has its own CDN
@@ -148,12 +159,18 @@ export function estimateGcpCost(inputs: CostEstimateInputs): {
               : "Free tier — rate limit + OWASP basic rules",
           },
           {
-            // #806 — the remote-MCP throttle (src/remote-mcp-edge.ts) is one
-            // more rule on the gateway's policy; Cloud Armor Standard bills
-            // each rule at about $1/mo.
-            name: "Cloud Armor rule: remote MCP throttle",
-            monthlyUsd: 1,
-            notes: "Per-IP throttle for /api/mcp/* (remote MCP clients)",
+            // #1328 — the MCP-Auth-Proxy's own backend (serverless NEG +
+            // backend service, no extra LB fee: same URL map) with its own
+            // Cloud Armor policy carrying the remote-MCP throttle
+            // (src/remote-mcp-edge.ts) and the default rule. Cloud Armor
+            // Standard: $0.006849315/policy-hour (~$5/mo) and
+            // $0.001369863/rule-hour (~$1/mo), plus $0.75 per million
+            // requests on a global policy — cloud.google.com/armor/pricing,
+            // checked 2026-11-02.
+            name: "MCP-Auth-Proxy backend + Cloud Armor policy",
+            monthlyUsd: 7,
+            notes:
+              "own policy ($5) with 2 rules ($2): per-IP throttle for remote MCP clients; requests ~$0",
           },
         ] satisfies CostLine[])
       : ([

package/src/wizards/gcp.ts

@@ -30,6 +30,7 @@ import { randomBytes } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
+import { CLOUD_SQL_CA_BUNDLE, verifyFullQuery } from "@caelo-cms/shared";
 import { cancel, confirm, isCancel, log, note, select, spinner } from "@clack/prompts";
 import { bold, cyan, dim, green, red, yellow } from "kleur/colors";
 import { checkAdcImpersonation } from "../adc-impersonation.js";
@@ -118,6 +119,7 @@ import type { RunMode } from "../run-mode.js";
 import { selfCommand } from "../self-command.js";
 import {
   ABSENT_DEFAULT_FIREWALL_RULES,
+  cloudSqlPrivateDnsName,
   type RemoteMcpIdentity,
   sameRemoteMcpIdentity,
 } from "../stack-contract.js";
@@ -134,6 +136,7 @@ import {
 import { acquireStateLock, GcsStateStore } from "../state-store.js";
 import { createReleaseImageForms, platformDigestsOf } from "../upgrade/image-forms.js";
 import {
+  releaseImageRef,
   releaseVersionForDigest,
   resolveOpsImageRef,
   verifyCosignAll,
@@ -357,7 +360,7 @@ export async function runGcpConverge(opts: GcpConvergeOpts): Promise<void> {
   const deployed = isStepDone(installId, `pulumi-up-${projectId}`);
   if (deployed) {
     // The kept release must be able to use the env the stack deploys.
-    const runtimeEnv = await checkDeployedRuntimeEnv({ projectId, region });
+    const runtimeEnv = await checkDeployedRuntimeEnv({ provider, projectId, region });
     if (!runtimeEnv.ok) {
       cancel(runtimeEnv.error);
       process.exit(1);
@@ -366,7 +369,7 @@ export async function runGcpConverge(opts: GcpConvergeOpts): Promise<void> {
   const choice = await chooseImageDigests({
     recorded: recordedImageDigests(meta),
     deployed,
-    readLive: () => readDeployedImageDigests({ projectId, region }),
+    readLive: () => readDeployedImageDigests({ provider, projectId, region }),
     resolveLatest: resolveImageDigests,
   });
   if (!choice.ok) {
@@ -531,7 +534,14 @@ export async function runGcpConverge(opts: GcpConvergeOpts): Promise<void> {
 
   // === 11.6. Remote MCP (#806): LB rules (gcp) + a check of the identity env ===
   // The env itself came with `pulumi up` (step 10.05, #1082).
-  const remoteMcpReady = await stepRemoteMcp(projectId, provider, domain, identity);
+  const remoteMcpReady = await stepRemoteMcp(
+    projectId,
+    region,
+    provider,
+    domain,
+    identity,
+    imageDigests,
+  );
 
   // A fresh install ran every converge step above, so it is at this CLI's
   // infrastructure contract — recorded only when the upgrader and the
@@ -603,8 +613,12 @@ async function resolveImageDigests(): Promise<ImageDigests> {
   const project = "caelo-website";
   const registryRegion = "europe-west1";
   const repo = "caelo-cms-images";
-  const out = { admin: "", gateway: "" };
-  for (const service of ["admin", "gateway"] as const) {
+  const out: Record<"admin" | "gateway" | "mcp-auth-proxy", string> = {
+    admin: "",
+    gateway: "",
+    "mcp-auth-proxy": "",
+  };
+  for (const service of ["admin", "gateway", "mcp-auth-proxy"] as const) {
     const s = spinner();
     s.start(`Resolving ${service}:latest → digest...`);
     // gcloud's --filter='tag=latest' is in a transitional state (warns +
@@ -1309,9 +1323,11 @@ async function stepResolveRemoteMcpIdentity(
  */
 async function stepRemoteMcp(
   projectId: string,
+  region: string,
   provider: "gcp" | "gcp-firebase",
   domain: string,
   identity: ResolvedRemoteMcpIdentity | null,
+  imageDigests: ImageDigests,
 ): Promise<boolean> {
   const s = spinner();
   s.start(
@@ -1325,11 +1341,22 @@ async function stepRemoteMcp(
     return false;
   };
   if (!identity) return failed("its URLs and IAP audience could not be read (see above)");
-  const edge = await ensureRemoteMcpEdge({ provider, projectId, env: GCP_STACK_ENV, domain });
+  const proxyDigest = imageDigests["mcp-auth-proxy"];
+  if (!proxyDigest) return failed("the release records no MCP-Auth-Proxy image");
+  const edge = await ensureRemoteMcpEdge({
+    provider,
+    projectId,
+    region,
+    env: GCP_STACK_ENV,
+    domain,
+    mcpAuthProxyImageRef: releaseImageRef("mcp-auth-proxy", proxyDigest),
+  });
   if (!edge.ok) return failed(edge.error);
   const check = await checkRemoteMcpIdentityEnv(identity.target, identity.identity);
   if (!check.ok) return failed(check.error);
-  const missing = [...check.drift.admin, ...check.drift.gateway].map((c) => c.name);
+  const missing = Object.values(check.drift)
+    .flat()
+    .map((c) => c.name);
   if (missing.length > 0) {
     return failed(`pulumi up left ${[...new Set(missing)].join(", ")} out of the services' env`);
   }
@@ -1905,8 +1932,10 @@ async function stepDrainLegacyCaeloAdminUser(projectId: string, region: string):
     pgPass,
   ]);
 
-  // Resolve the SQL instance's private IP from gcloud (avoids reading
-  // Pulumi outputs from inside the wizard).
+  // Resolve the SQL instance's DNS name from gcloud (avoids reading
+  // Pulumi outputs from inside the wizard). #1338: the job connects with
+  // verify-full, and the shared-CA certificate names the DNS name, not the
+  // private IP.
   const sqlDescr = await gcloud([
     "sql",
     "instances",
@@ -1914,16 +1943,28 @@ async function stepDrainLegacyCaeloAdminUser(projectId: string, region: string):
     "caelo-production-pg-1d65811",
     "--project",
     projectId,
-    "--format=value(ipAddresses[0].ipAddress)",
+    "--format=json(dnsNames)",
   ]);
-  const pgHost = (sqlDescr.stdout || "").trim();
+  let pgHost: string | null = null;
+  try {
+    pgHost = cloudSqlPrivateDnsName(
+      (
+        JSON.parse(sqlDescr.stdout || "{}") as {
+          dnsNames?: { name?: string; connectionType?: string }[];
+        }
+      ).dnsNames,
+    );
+  } catch {
+    pgHost = null;
+  }
   if (!pgHost) {
-    s.stop(yellow("Could not resolve Cloud SQL private IP — skipping drain"));
+    s.stop(yellow("Could not resolve the Cloud SQL instance's DNS name — skipping drain"));
     return;
   }
 
-  const adminPg = `postgres://postgres:${pgPass}@${pgHost}:5432/cms_admin`;
-  const publicPg = `postgres://postgres:${pgPass}@${pgHost}:5432/cms_public`;
+  const tls = verifyFullQuery(CLOUD_SQL_CA_BUNDLE);
+  const adminPg = `postgres://postgres:${pgPass}@${pgHost}:5432/cms_admin?${tls}`;
+  const publicPg = `postgres://postgres:${pgPass}@${pgHost}:5432/cms_public?${tls}`;
 
   // The cleanup script — uses bun's globalThis.Bun.SQL (already proven
   // pattern in hooks.server.ts + the migration runner). DO block makes