@caelo-cms/provisioning 0.11.9 → 0.11.11

package/src/deployed-release.test.ts

@@ -29,6 +29,17 @@ function fakeGcloud(answers: Record<string, GcloudResult[]>) {
   return { run, calls };
 }
 
+/**
+ * A gcp-firebase install since #1328: the admin, the data gateway and the
+ * MCP-Auth-Proxy — the service that was the gateway (E13 a).
+ */
+const FIREBASE = { provider: "gcp-firebase" as const, projectId: "p", region: "europe-west1" };
+const firebaseLists = () => ({
+  "metadata.name~^caelo-production-admin": [ok("caelo-production-admin-abc\n")],
+  "metadata.name~^caelo-production-data-gateway": [ok("caelo-production-data-gateway\n")],
+  "metadata.name~^caelo-production-gateway": [ok("caelo-production-gateway-def\n")],
+});
+
 describe("digestFromImageRef", () => {
   it("extracts the pinned digest", () => {
     expect(digestFromImageRef(`${REG}/admin@${A}\n`)).toBe(A);
@@ -39,16 +50,43 @@ describe("digestFromImageRef", () => {
 });
 
 describe("readDeployedImageDigests", () => {
-  it("reads both services' digests", async () => {
+  it("reads the three services' digests, each from the service playing its role", async () => {
     const { run, calls } = fakeGcloud({
+      ...firebaseLists(),
+      "describe caelo-production-admin-abc": [ok(`${REG}/admin@${A}`)],
+      "describe caelo-production-data-gateway": [ok(`${REG}/gateway@${B}`)],
+      "describe caelo-production-gateway-def": [ok(`${REG}/mcp-auth-proxy@${C}`)],
+    });
+    const r = await readDeployedImageDigests({ ...FIREBASE, run });
+    expect(r).toEqual({ ok: true, digests: { admin: A, gateway: B, "mcp-auth-proxy": C } });
+    expect(calls.every((c) => c.includes("--project=p"))).toBe(true);
+  });
+
+  it("finds the gcp proxy under its own name", async () => {
+    const { run } = fakeGcloud({
       "metadata.name~^caelo-production-admin": [ok("caelo-production-admin-abc\n")],
       "metadata.name~^caelo-production-gateway": [ok("caelo-production-gateway-def\n")],
+      "metadata.name~^caelo-production-mcp-auth-proxy": [ok("caelo-production-mcp-auth-proxy\n")],
       "describe caelo-production-admin-abc": [ok(`${REG}/admin@${A}`)],
       "describe caelo-production-gateway-def": [ok(`${REG}/gateway@${B}`)],
+      "describe caelo-production-mcp-auth-proxy": [ok(`${REG}/mcp-auth-proxy@${C}`)],
     });
-    const r = await readDeployedImageDigests({ projectId: "p", region: "europe-west1", run });
-    expect(r).toEqual({ ok: true, digests: { admin: A, gateway: B } });
-    expect(calls.every((c) => c.includes("--project=p"))).toBe(true);
+    const r = await readDeployedImageDigests({ ...FIREBASE, provider: "gcp", run });
+    expect(r).toEqual({ ok: true, digests: { admin: A, gateway: B, "mcp-auth-proxy": C } });
+  });
+
+  it("sends an install without its #1328 services to upgrade", async () => {
+    const { run } = fakeGcloud({
+      "metadata.name~^caelo-production-admin": [ok("caelo-production-admin-abc\n")],
+      "metadata.name~^caelo-production-data-gateway": [ok("")],
+      "describe caelo-production-admin-abc": [ok(`${REG}/admin@${A}`)],
+    });
+    const r = await readDeployedImageDigests({ ...FIREBASE, run });
+    expect(r.ok).toBe(false);
+    if (!r.ok) {
+      expect(r.error).toContain("no caelo-production-data-gateway* Cloud Run service");
+      expect(r.error).toContain("Run `upgrade` first");
+    }
   });
 
   it("refuses an ambiguous service match", async () => {
@@ -57,7 +95,7 @@ describe("readDeployedImageDigests", () => {
         ok("caelo-production-admin-a\ncaelo-production-admin-b\n"),
       ],
     });
-    const r = await readDeployedImageDigests({ projectId: "p", region: "r", run });
+    const r = await readDeployedImageDigests({ ...FIREBASE, run });
     expect(r.ok).toBe(false);
     if (!r.ok)
       expect(r.error).toContain("found caelo-production-admin-a, caelo-production-admin-b");
@@ -68,14 +106,14 @@ describe("readDeployedImageDigests", () => {
       "metadata.name~^caelo-production-admin": [ok("caelo-production-admin-abc\n")],
       "describe caelo-production-admin-abc": [ok(`${REG}/admin:latest`)],
     });
-    const r = await readDeployedImageDigests({ projectId: "p", region: "r", run });
+    const r = await readDeployedImageDigests({ ...FIREBASE, run });
     expect(r.ok).toBe(false);
     if (!r.ok) expect(r.error).toContain("not pinned to a digest");
   });
 
   it("surfaces a gcloud failure", async () => {
     const { run } = fakeGcloud({ "services list": [fail("PERMISSION_DENIED")] });
-    const r = await readDeployedImageDigests({ projectId: "p", region: "r", run });
+    const r = await readDeployedImageDigests({ ...FIREBASE, run });
     expect(r).toEqual({ ok: false, error: "list Cloud Run services: PERMISSION_DENIED" });
   });
 });
@@ -87,40 +125,53 @@ describe("checkDeployedRuntimeEnv", () => {
     name,
     valueFrom: { secretKeyRef: { name: `caelo-production-${id}`, key: "latest" } },
   });
-  const lists = () => ({
-    "metadata.name~^caelo-production-admin": [ok("caelo-production-admin-abc\n")],
-    "metadata.name~^caelo-production-gateway": [ok("caelo-production-gateway-def\n")],
-  });
+  const adminOk = svc([
+    secret("ADMIN_DATABASE_PASSWORD"),
+    secret("PUBLIC_ADMIN_DATABASE_PASSWORD"),
+    // #1329 — the staging database's pool: a release from before it is
+    // refused here too and goes through `upgrade` first.
+    secret("PUBLIC_STAGING_ADMIN_DATABASE_PASSWORD"),
+  ]);
+  const gatewayOk = svc([secret("PUBLIC_DATABASE_PASSWORD", "public-role-password")]);
+  const proxyOk = svc([secret("CAELO_MCP_OAUTH_SEAL_KEY", "mcp-oauth-seal-key")]);
 
-  it("passes once both services read the password from Secret Manager", async () => {
+  it("passes once every service runs the current env", async () => {
     const { run } = fakeGcloud({
-      ...lists(),
-      "describe caelo-production-admin-abc": [
-        svc([secret("ADMIN_DATABASE_PASSWORD"), secret("PUBLIC_ADMIN_DATABASE_PASSWORD")]),
-      ],
-      "describe caelo-production-gateway-def": [
-        svc([secret("PUBLIC_DATABASE_PASSWORD", "public-role-password")]),
-      ],
+      ...firebaseLists(),
+      "describe caelo-production-admin-abc": [adminOk],
+      "describe caelo-production-data-gateway": [gatewayOk],
+      "describe caelo-production-gateway-def": [proxyOk],
     });
-    expect(await checkDeployedRuntimeEnv({ projectId: "p", region: "r", run })).toEqual({
-      ok: true,
+    expect(await checkDeployedRuntimeEnv({ ...FIREBASE, run })).toEqual({ ok: true });
+  });
+
+  it("#1328 — stops a wizard re-run while the proxy is still the old gateway (database env)", async () => {
+    const { run } = fakeGcloud({
+      ...firebaseLists(),
+      "describe caelo-production-admin-abc": [adminOk],
+      "describe caelo-production-data-gateway": [gatewayOk],
+      "describe caelo-production-gateway-def": [gatewayOk],
     });
+    const r = await checkDeployedRuntimeEnv({ ...FIREBASE, run });
+    expect(r.ok).toBe(false);
+    if (!r.ok) {
+      expect(r.error).toContain("PUBLIC_DATABASE_PASSWORD");
+      expect(r.error).toContain("Run `upgrade` first");
+    }
   });
 
   it("stops a wizard re-run on a gateway from before #635 (it needs its gateway_role pool)", async () => {
     const { run } = fakeGcloud({
-      ...lists(),
-      "describe caelo-production-admin-abc": [
-        svc([secret("ADMIN_DATABASE_PASSWORD"), secret("PUBLIC_ADMIN_DATABASE_PASSWORD")]),
-      ],
-      "describe caelo-production-gateway-def": [
+      ...firebaseLists(),
+      "describe caelo-production-admin-abc": [adminOk],
+      "describe caelo-production-data-gateway": [
         svc([
           secret("GATEWAY_DATABASE_PASSWORD", "gateway-role-password"),
           secret("PUBLIC_DATABASE_PASSWORD", "public-role-password"),
         ]),
       ],
     });
-    const r = await checkDeployedRuntimeEnv({ projectId: "p", region: "r", run });
+    const r = await checkDeployedRuntimeEnv({ ...FIREBASE, run });
     expect(r.ok).toBe(false);
     if (!r.ok) {
       expect(r.error).toContain("GATEWAY_DATABASE_PASSWORD");
@@ -130,15 +181,13 @@ describe("checkDeployedRuntimeEnv", () => {
 
   it("stops a wizard re-run on a gateway from before #613 (it needs the admin_role pool)", async () => {
     const { run } = fakeGcloud({
-      ...lists(),
-      "describe caelo-production-admin-abc": [
-        svc([secret("ADMIN_DATABASE_PASSWORD"), secret("PUBLIC_ADMIN_DATABASE_PASSWORD")]),
-      ],
-      "describe caelo-production-gateway-def": [
+      ...firebaseLists(),
+      "describe caelo-production-admin-abc": [adminOk],
+      "describe caelo-production-data-gateway": [
         svc([secret("ADMIN_DATABASE_PASSWORD"), secret("PUBLIC_DATABASE_PASSWORD")]),
       ],
     });
-    const r = await checkDeployedRuntimeEnv({ projectId: "p", region: "r", run });
+    const r = await checkDeployedRuntimeEnv({ ...FIREBASE, run });
     expect(r.ok).toBe(false);
     if (!r.ok) {
       expect(r.error).toContain("ADMIN_DATABASE_PASSWORD");
@@ -148,14 +197,17 @@ describe("checkDeployedRuntimeEnv", () => {
 
   it("stops a wizard re-run on an install upgrade hasn't moved over (password in the URL)", async () => {
     const { run } = fakeGcloud({
-      ...lists(),
+      ...firebaseLists(),
       "describe caelo-production-admin-abc": [
         svc([
-          { name: "ADMIN_DATABASE_URL", value: "postgres://admin_role:pw@10.0.0.3:5432/cms_admin" },
+          {
+            name: "ADMIN_DATABASE_URL",
+            value: "postgres://admin_role:pw@db1.p-label.europe-west1.sql-psa.goog:5432/cms_admin",
+          },
         ]),
       ],
     });
-    const r = await checkDeployedRuntimeEnv({ projectId: "p", region: "r", run });
+    const r = await checkDeployedRuntimeEnv({ ...FIREBASE, run });
     expect(r.ok).toBe(false);
     if (!r.ok) {
       expect(r.error).toContain("Run `upgrade` first");
@@ -165,29 +217,44 @@ describe("checkDeployedRuntimeEnv", () => {
 });
 
 describe("chooseImageDigests", () => {
-  const latest = { admin: C, gateway: C };
+  const latest = { admin: C, gateway: C, "mcp-auth-proxy": C };
+  const recorded = { admin: A, gateway: B, "mcp-auth-proxy": C };
   const never = () => {
     throw new Error("must not be called");
   };
 
   it("keeps the recorded release", async () => {
+    const r = await chooseImageDigests({
+      recorded,
+      deployed: true,
+      readLive: never,
+      resolveLatest: never,
+    });
+    expect(r).toEqual({ ok: true, source: "recorded", digests: recorded });
+  });
+
+  it("#1328 — sends a record from before the MCP-Auth-Proxy to upgrade instead of mixing releases", async () => {
     const r = await chooseImageDigests({
       recorded: { admin: A, gateway: B },
       deployed: true,
       readLive: never,
       resolveLatest: never,
     });
-    expect(r).toEqual({ ok: true, source: "recorded", digests: { admin: A, gateway: B } });
+    expect(r.ok).toBe(false);
+    if (!r.ok) {
+      expect(r.error).toContain("records no mcp-auth-proxy image");
+      expect(r.error).toContain("Run `upgrade` first");
+    }
   });
 
   it("keeps what a provisioned install without a record runs (no :latest roll)", async () => {
     const r = await chooseImageDigests({
       recorded: null,
       deployed: true,
-      readLive: async () => ({ ok: true, digests: { admin: A, gateway: B } }),
+      readLive: async () => ({ ok: true, digests: recorded }),
       resolveLatest: never,
     });
-    expect(r).toEqual({ ok: true, source: "live", digests: { admin: A, gateway: B } });
+    expect(r).toEqual({ ok: true, source: "live", digests: recorded });
   });
 
   it("stops and points at upgrade when the running release can't be read", async () => {

package/src/deployed-release.ts

@@ -15,7 +15,14 @@ import { gcloud as defaultGcloud } from "./gcloud.js";
 import type { GcloudRunner } from "./gcloud-retry.js";
 import { GCP_STACK_ENV, gcpNamePrefix } from "./gcp-names.js";
 import type { ImageDigests } from "./install-state.js";
-import { type CloudRunSlug, RETIRED_SERVICE_ENV, SERVICE_SECRET_ENV } from "./stack-contract.js";
+import {
+  CLOUD_RUN_SLUGS,
+  type CloudRunSlug,
+  cloudRunServicePrefix,
+  type GcpProvider,
+  RETIRED_SERVICE_ENV,
+  SERVICE_SECRET_ENV,
+} from "./stack-contract.js";
 import { liveContainerEnv } from "./stack-converge.js";
 
 /** The `sha256:…` digest an image reference pins, or null for a tag reference. */
@@ -23,13 +30,13 @@ export function digestFromImageRef(ref: string): string | null {
   return ref.trim().match(/@(sha256:[0-9a-f]{64})$/)?.[1] ?? null;
 }
 
-/** The single deployed (Pulumi-suffixed) Cloud Run service for `slug`. */
+/** The single deployed Cloud Run service playing `slug` (stack-contract.ts cloudRunServicePrefix). */
 async function findDeployedService(
   run: GcloudRunner,
-  opts: { projectId: string; region: string },
+  opts: { provider: GcpProvider; projectId: string; region: string },
   slug: CloudRunSlug,
 ): Promise<{ ok: true; name: string } | { ok: false; error: string }> {
-  const prefix = `${gcpNamePrefix(GCP_STACK_ENV)}-${slug}`;
+  const prefix = cloudRunServicePrefix(opts.provider, GCP_STACK_ENV, slug);
   const list = await run([
     "run",
     "services",
@@ -47,7 +54,10 @@ async function findDeployedService(
   if (names.length !== 1) {
     return {
       ok: false,
-      error: `expected one ${prefix}* Cloud Run service, found ${names.length === 0 ? "none" : names.join(", ")}`,
+      error:
+        names.length === 0
+          ? `no ${prefix}* Cloud Run service: the install runs a release from before it (the ${slug} became its own service in #1328). Run \`upgrade\` first: it creates the service and moves the release over.`
+          : `expected one ${prefix}* Cloud Run service, found ${names.join(", ")}`,
     };
   }
   return { ok: true, name: names[0] as string };
@@ -68,12 +78,13 @@ async function findDeployedService(
  * and the env in one revision.
  */
 export async function checkDeployedRuntimeEnv(opts: {
+  provider: GcpProvider;
   projectId: string;
   region: string;
   run?: GcloudRunner;
 }): Promise<{ ok: true } | { ok: false; error: string }> {
   const run = opts.run ?? defaultGcloud;
-  for (const slug of ["admin", "gateway"] as const) {
+  for (const slug of CLOUD_RUN_SLUGS) {
     const found = await findDeployedService(run, opts, slug);
     if (!found.ok) return found;
     const describe = await run([
@@ -109,18 +120,19 @@ export async function checkDeployedRuntimeEnv(opts: {
 }
 
 /**
- * Read the image digests the admin and gateway services run. Fails, naming
+ * Read the image digests the Cloud Run services run. Fails, naming
  * what is missing, when a service can't be found unambiguously or doesn't
  * run a digest-pinned image.
  */
 export async function readDeployedImageDigests(opts: {
+  provider: GcpProvider;
   projectId: string;
   region: string;
   run?: GcloudRunner;
 }): Promise<{ ok: true; digests: ImageDigests } | { ok: false; error: string }> {
   const run = opts.run ?? defaultGcloud;
-  const digests = { admin: "", gateway: "" };
-  for (const slug of ["admin", "gateway"] as const) {
+  const digests: Record<CloudRunSlug, string> = { admin: "", gateway: "", "mcp-auth-proxy": "" };
+  for (const slug of CLOUD_RUN_SLUGS) {
     const found = await findDeployedService(run, opts, slug);
     if (!found.ok) return found;
     const image = await run([
@@ -170,6 +182,15 @@ export async function chooseImageDigests(opts: {
   readonly readLive: () => ReturnType<typeof readDeployedImageDigests>;
   readonly resolveLatest: () => Promise<ImageDigests>;
 }): Promise<DigestChoice> {
+  if (opts.recorded && !opts.recorded["mcp-auth-proxy"]) {
+    // #1328 — the release it records predates the MCP-Auth-Proxy: this
+    // installer's stack would deploy a proxy image of another release.
+    return {
+      ok: false,
+      error:
+        "This install runs a release from before the MCP-Auth-Proxy (its install.json records no mcp-auth-proxy image). Run `upgrade` first — it sets the proxy up and records the release — then re-run the installer.",
+    };
+  }
   if (opts.recorded) return { ok: true, source: "recorded", digests: opts.recorded };
   if (!opts.deployed) return { ok: true, source: "latest", digests: await opts.resolveLatest() };
   const live = await opts.readLive();

package/src/gateway-env-isolation.test.ts

@@ -16,6 +16,12 @@
  *   self-hosted        the generated compose gateway service: env, secrets,
  *                      mounts
  *
+ * Issue #1329 — the same crosswise between the two public databases: the
+ * live gateway's env names nothing of the staging database
+ * (cms_public_staging, public_staging_role, its password secret), and its
+ * identity cannot read the staging login's password, on every adapter. The
+ * staging gateway (#1330) gets the mirror-image checks with its service.
+ *
  * The gateway itself refuses to boot on such an env
  * (apps/api-gateway `adminDatabaseAccessInEnv`); this catches it at review
  * time, before a release can ship it.
@@ -42,6 +48,12 @@ const ADMIN_ACCESS = /cms_admin|admin_role|gateway_role|ADMIN_DATABASE|GATEWAY_D
 /** Secrets that unlock a cms_admin login. */
 const ADMIN_SECRETS = ["postgres-password", "gateway-role-password"];
 
+/** #1329 — anything in the live gateway's env that reaches the staging database. */
+const STAGING_ACCESS = /cms_public_staging|public_staging_role|PUBLIC_STAGING/;
+
+/** #1329 — the secret that unlocks the staging gateway's login. */
+const STAGING_SECRETS = ["public-staging-role-password"];
+
 /** The secrets the gateway reads on GCP: its own login and the staging gate key. */
 const GCP_GATEWAY_SECRETS = [
   "public-role-password",
@@ -65,26 +77,39 @@ describe("gcp + gcp-firebase: the gateway env contract (#635)", () => {
     domain: "example.com",
     region: "europe-west1",
     stagingHost: "staging.example.com",
-    databaseUrls: databaseUrls("10.20.0.3"),
+    databaseUrls: databaseUrls("db1.p-label.europe-west1.sql-psa.goog"),
   });
 
-  it("carries no cms_admin URL, role or credential name", () => {
+  it("carries no cms_admin URL, role or credential name, and nothing of the staging database (#1329)", () => {
     for (const v of env) {
       expect(v.name).not.toMatch(ADMIN_ACCESS);
-      if ("value" in v && typeof v.value === "string") expect(v.value).not.toMatch(ADMIN_ACCESS);
+      expect(v.name).not.toMatch(STAGING_ACCESS);
+      if ("value" in v && typeof v.value === "string") {
+        expect(v.value).not.toMatch(ADMIN_ACCESS);
+        expect(v.value).not.toMatch(STAGING_ACCESS);
+      }
     }
+    expect(env.find((v) => v.name === "CAELO_GATEWAY_ENVIRONMENT")).toEqual({
+      name: "CAELO_GATEWAY_ENVIRONMENT",
+      value: "live",
+    });
     expect(env.find((v) => v.name === "PUBLIC_DATABASE_URL")).toEqual({
       name: "PUBLIC_DATABASE_URL",
-      value: "postgresql://public_role@10.20.0.3:5432/cms_public?sslmode=require",
+      value:
+        "postgresql://public_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_public?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem",
     });
   });
 
-  it("references no secret that unlocks a cms_admin login", () => {
+  it("references no secret that unlocks a cms_admin or the staging login", () => {
     for (const secret of Object.values(SERVICE_SECRET_ENV.gateway)) {
       expect(ADMIN_SECRETS).not.toContain(secret);
+      expect(STAGING_SECRETS).not.toContain(secret);
     }
     const gatewayBindings = runtimeSecretBindings().filter((b) => b.service === "gateway");
-    for (const b of gatewayBindings) expect(ADMIN_SECRETS).not.toContain(b.secret);
+    for (const b of gatewayBindings) {
+      expect(ADMIN_SECRETS).not.toContain(b.secret);
+      expect(STAGING_SECRETS).not.toContain(b.secret);
+    }
   });
 
   for (const provider of ["gcp", "gcp-firebase"] as const) {
@@ -133,8 +158,9 @@ describe("self-hosted: the generated compose gateway service (#635)", () => {
     const out = generateDockerCompose({
       domain: "example.com",
       postgresPassword: "superpw",
-      rolePasswords: { admin: "adminpw", public: "publicpw" },
+      rolePasswords: { admin: "adminpw", public: "publicpw", publicStaging: "stagingpw" },
       caeloSecretKek: "0".repeat(64),
+      dbTlsServerCertSha256: "abababababababababababababababababababababababababababababababab",
       internalSecret: "i".repeat(48),
       diskSize: "20Gi",
       images: {
@@ -150,15 +176,22 @@ describe("self-hosted: the generated compose gateway service (#635)", () => {
     const gateway = out.slice(start, end === -1 ? undefined : end);
     expect(gateway).toContain("PUBLIC_DATABASE_URL:");
     expect(gateway).not.toMatch(ADMIN_ACCESS);
-    expect(gateway).not.toMatch(/superpw|adminpw|gatewaypw/);
-    // No other way in: no Compose secrets, no env file, no mounts (a
-    // mounted file is read by no env check), and exactly its own env.
-    expect(gateway).not.toMatch(/^ {4}(secrets|env_file|volumes):/m);
+    expect(gateway).not.toMatch(STAGING_ACCESS);
+    expect(gateway).not.toMatch(/superpw|adminpw|gatewaypw|stagingpw/);
+    expect(gateway).toContain('CAELO_GATEWAY_ENVIRONMENT: "live"');
+    // No other way in: no Compose secrets, no env file, and exactly one
+    // mount — the database CA certificate (#1338), public, no credential.
+    expect(gateway).not.toMatch(/^ {4}(secrets|env_file):/m);
+    expect(gateway).toContain(
+      "    volumes:\n      - ./postgres-tls/ca.crt:/etc/caelo/db-ca/self-hosted-ca.pem:ro\n    restart:",
+    );
     const env = gateway.slice(gateway.indexOf("    environment:"));
     const keys = [...env.matchAll(/^ {6}([A-Z_][A-Z0-9_]*):/gm)].map((m) => m[1]);
     expect(keys.sort()).toEqual([
       // #1254 — its cms_public pool size (pool-budget-stack.ts).
       "CAELO_DB_PUBLIC_POOL_MAX",
+      // #1329 — the live site's gateway.
+      "CAELO_GATEWAY_ENVIRONMENT",
       "CAELO_TRUSTED_PROXY_HOPS",
       "GATEWAY_PORT",
       "NODE_ENV",
@@ -176,6 +209,9 @@ describe("azure: the gateway container app (#635)", () => {
     const block = src.slice(start, src.indexOf("});", start));
     expect(block).toContain('{ name: "PUBLIC_DATABASE_URL", value: publicDatabaseUrl }');
     expect(block).not.toMatch(/adminDatabase|gatewayDatabase|ADMIN_DATABASE|GATEWAY_DATABASE/);
+    // #1329 — nothing of the staging database, and it says it is the live one.
+    expect(block).not.toMatch(/publicStaging|PUBLIC_STAGING/);
+    expect(block).toContain('{ name: GATEWAY_ENVIRONMENT_ENV, value: "live" }');
   });
 
   it("builds no cms_admin URL for any role but the admin's", () => {
@@ -201,7 +237,9 @@ describe("aws: the stack (#635)", () => {
 
   it("the gateway's task role reads only the public_role password (review finding)", () => {
     expect(AWS_SERVICE_SECRETS.gateway).toEqual(["public-role-password"]);
-    for (const secret of ADMIN_SECRETS) expect(AWS_SERVICE_SECRETS.gateway).not.toContain(secret);
+    for (const secret of [...ADMIN_SECRETS, ...STAGING_SECRETS]) {
+      expect(AWS_SERVICE_SECRETS.gateway).not.toContain(secret);
+    }
   });
 
   it("each service gets its own task role whose policy is built from that table", () => {

package/src/gcp-names.ts

@@ -56,6 +56,37 @@ export function gatewayServiceAccountEmail(projectId: string, env: string): stri
   return `${gatewayServiceAccountId(env)}@${projectId}.iam.gserviceaccount.com`;
 }
 
+/**
+ * #1328 — account id of the service account the MCP-Auth-Proxy runs as. It
+ * may read the Google sign-in client and the broker's seal key and nothing
+ * else: no database password, no project role (stack-contract.ts
+ * `SERVICE_SECRET_ENV` / `SERVICE_SECRET_FILES`). Shortened from the
+ * service's name: account ids max out at 30 characters.
+ */
+export function mcpAuthProxyServiceAccountId(env: string): string {
+  return `${gcpNamePrefix(env)}-mcp-proxy-sa`;
+}
+
+/**
+ * #1328 — the `gcp` MCP-Auth-Proxy's load-balancer resources, CLI-owned
+ * (remote-mcp.ts ensureRemoteMcpEdge): its serverless NEG, its backend
+ * service and its own Cloud Armor policy. None matches a prefix the other
+ * lookups use (`…-waf`, `…-admin-backend`, `…-gateway-backend`).
+ */
+export function mcpAuthProxyEdgeNames(env: string): {
+  readonly neg: string;
+  readonly backend: string;
+  readonly policy: string;
+} {
+  const prefix = `${gcpNamePrefix(env)}-mcp-auth-proxy`;
+  return { neg: `${prefix}-neg`, backend: `${prefix}-backend`, policy: `${prefix}-armor` };
+}
+
+/** Email of the service account the MCP-Auth-Proxy runs as. */
+export function mcpAuthProxyServiceAccountEmail(projectId: string, env: string): string {
+  return `${mcpAuthProxyServiceAccountId(env)}@${projectId}.iam.gserviceaccount.com`;
+}
+
 /**
  * Account id of the `gcp` stack's static-publisher service account. Account
  * ids max out at 30 chars, so the env is shortened.
@@ -190,6 +221,31 @@ export function captureServiceAccountEmail(projectId: string, env: string): stri
   return `${captureServiceAccountId(env)}@${projectId}.iam.gserviceaccount.com`;
 }
 
+/**
+ * #1140 — account id of the scheduler tick's service account: signs its own
+ * IAP credential and calls the admin's tick endpoint, nothing else
+ * (scheduler-setup.ts). `caelo-production-scheduler` is 26 of the 30
+ * characters an account id may have.
+ */
+export function schedulerServiceAccountId(env: string): string {
+  return `${gcpNamePrefix(env)}-scheduler`;
+}
+
+/** Email of the scheduler tick's service account. */
+export function schedulerServiceAccountEmail(projectId: string, env: string): string {
+  return `${schedulerServiceAccountId(env)}@${projectId}.iam.gserviceaccount.com`;
+}
+
+/** #1140 — the Cloud Workflows workflow one scheduler tick runs (scheduler-setup.ts). */
+export function schedulerWorkflowName(env: string): string {
+  return `${gcpNamePrefix(env)}-scheduler-tick`;
+}
+
+/** #1140 — the Cloud Scheduler job that starts the tick workflow every N minutes. */
+export function schedulerJobName(env: string): string {
+  return `${gcpNamePrefix(env)}-scheduler-tick`;
+}
+
 /**
  * Account id of the upgrader job's own service account: may roll the two
  * Cloud Run services, run the migration job and back up Cloud SQL, never

package/src/gcp-url-map.test.ts

@@ -9,7 +9,7 @@
 import { beforeAll, describe, expect, it } from "bun:test";
 import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
-import { GCP_PUBLIC_BASE_PATHS, isGcpRedirectRule, withGcpRedirects } from "@caelo-cms/shared";
+import { GCP_GATEWAY_PATHS, isGcpRedirectRule, withGcpRedirects } from "@caelo-cms/shared";
 import * as pulumi from "@pulumi/pulumi";
 import { URL_MAP_REDIRECTS_PERMISSIONS, urlMapRedirectsRoleId } from "./gcp-names.js";
 
@@ -66,7 +66,8 @@ describe("gcp stack URL map (Pulumi mocks)", () => {
       {
         name: PUBLIC_PATH_MATCHER,
         defaultService: "bucket-id",
-        pathRules: [{ paths: [...GCP_PUBLIC_BASE_PATHS], service: "gateway-id" }],
+        // #1328 — only /api/* here: the MCP-Auth-Proxy's rule is the CLI's.
+        pathRules: [{ paths: [...GCP_GATEWAY_PATHS], service: "gateway-id" }],
       },
       { name: "admin", defaultService: "admin-id" },
     ]);
@@ -102,12 +103,9 @@ describe("gcp stack URL map (Pulumi mocks)", () => {
     );
     expect(withRedirects.pathRules?.filter((r) => !isGcpRedirectRule(r))).toEqual([
       {
-        paths: [
-          "/api/*",
-          // #806 — the remote-MCP broker's discovery documents.
-          "/.well-known/oauth-protected-resource/*",
-          "/.well-known/oauth-authorization-server/*",
-        ],
+        // #1328 — the remote-MCP discovery paths go to the MCP-Auth-Proxy's
+        // own rule, which the CLI adds (remote-mcp.ts planUrlMapPaths).
+        paths: ["/api/*"],
         service: "gateway-id",
       },
     ]);

package/src/gcp-url-map.ts

@@ -19,7 +19,7 @@
  * Imported by the stack from `dist/`; keep it free of CLI dependencies.
  */
 
-import { GCP_PUBLIC_BASE_PATHS } from "@caelo-cms/shared";
+import { GCP_GATEWAY_PATHS } from "@caelo-cms/shared";
 import * as gcp from "@pulumi/gcp";
 import type * as pulumi from "@pulumi/pulumi";
 
@@ -58,7 +58,11 @@ export function siteUrlMapArgs(i: SiteUrlMapInputs): gcp.compute.URLMapArgs {
       {
         name: PUBLIC_PATH_MATCHER,
         defaultService: i.staticBackend,
-        pathRules: [{ paths: [...GCP_PUBLIC_BASE_PATHS], service: i.gatewayBackend }],
+        // #1328 — the MCP-Auth-Proxy's rule (GCP_MCP_AUTH_PROXY_PATHS) is the
+        // CLI's: it creates the proxy's backend after the first `up`
+        // (remote-mcp.ts ensureRemoteMcpEdge), and the stack ignores
+        // `pathRules` after creation anyway.
+        pathRules: [{ paths: [...GCP_GATEWAY_PATHS], service: i.gatewayBackend }],
       },
       {
         name: "admin",