@caelo-cms/provisioning 0.11.9 → 0.11.11

package/src/stack-contract-parity.test.ts

@@ -16,6 +16,7 @@ import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import {
   CLOUD_RUN_IGNORE_CHANGES,
+  type CloudRunSlug,
   type GcpProvider,
   type IamInvariant,
   runtimeSecretBindings,
@@ -61,11 +62,19 @@ const MEMBER_EXPR: Record<IamInvariant["member"], string> = {
   "run-sa": "runSa.email",
   // The secret loop resolves the SA per service through `serviceSa`.
   "gateway-sa": "gatewaySa.email",
+  "mcp-auth-proxy-sa": "mcpAuthProxySa.email",
   "static-publisher-sa": "staticPublisherSa.email",
   "iap-service-agent": "iapServiceIdentity.email",
   allUsers: 'member: "allUsers"',
 };
 
+/** The variable each stack holds a Cloud Run service in. */
+const SERVICE_VAR: Record<CloudRunSlug, string> = {
+  admin: "adminSvc",
+  gateway: "gatewaySvc",
+  "mcp-auth-proxy": "mcpAuthProxySvc",
+};
+
 function targetExpr(inv: IamInvariant): { type: RegExp; ref?: string } {
   switch (inv.target.kind) {
     case "project":
@@ -77,7 +86,7 @@ function targetExpr(inv: IamInvariant): { type: RegExp; ref?: string } {
     case "run-service":
       return {
         type: /^cloudrunv2\.ServiceIamMember$/,
-        ref: `name: ${inv.target.service}Svc.name`,
+        ref: `name: ${SERVICE_VAR[inv.target.service]}.name`,
       };
   }
 }
@@ -125,6 +134,19 @@ describe.each(["gcp", "gcp-firebase"] as const)("%s stack ↔ upgrade parity", (
     expect(unhandled).toEqual([]);
   });
 
+  it("#1328 — the MCP-Auth-Proxy's SA reads its two secrets and holds no other role", () => {
+    expect(src).toContain("accountId: mcpAuthProxyServiceAccountId(env)");
+    expect(src).toMatch(/"mcp-auth-proxy": mcpAuthProxySa,/);
+    // No binding but the secret loop names it: no project role, no bucket,
+    // no service — the loop gives it exactly serviceSecrets("mcp-auth-proxy").
+    expect(declared.filter((d) => d.body.includes("mcpAuthProxySa"))).toEqual([]);
+    expect(
+      runtimeSecretBindings()
+        .filter((b) => b.service === "mcp-auth-proxy")
+        .map((b) => b.secret),
+    ).toEqual(["mcp-oauth-seal-key", "operator-oauth-client"]);
+  });
+
   it("every invariant and exemption names a binding the stack still declares", () => {
     const names = new Set(declared.flatMap(expand));
     for (const inv of invariants) expect(names).toContain(inv.stackResource);
@@ -139,9 +161,20 @@ describe.each(["gcp", "gcp-firebase"] as const)("%s stack ↔ upgrade parity", (
     expect(src).toMatch(
       /serviceName: "admin",[\s\S]*?contractEnv: \[\s*\.\.\.adminEnvContract\([\s\S]*?\.\.\.remoteMcpEnv\.admin,\s*(\/\/[^\n]*\n\s*)?\.\.\.poolBudget\.env\.admin,?\s*\]/,
     );
+    // #1328 — the gateway carries no remote-MCP env any more.
     expect(src).toMatch(
-      /serviceName: "gateway",[\s\S]*?contractEnv: \[\s*\.\.\.gatewayEnvContract\([\s\S]*?\.\.\.remoteMcpEnv\.gateway,\s*\.\.\.poolBudget\.env\.gateway,?\s*\]/,
+      /serviceName: "gateway",[\s\S]*?contractEnv: \[\s*\.\.\.gatewayEnvContract\(envContractInputs\),\s*\.\.\.poolBudget\.env\.gateway,?\s*\]/,
     );
+    if (provider === "gcp-firebase") {
+      // The proxy: its contract, its identity env, and (until #1331) the
+      // data gateway it forwards to — a stack output no contract can name.
+      expect(src).toMatch(
+        /serviceName: "mcp-auth-proxy",[\s\S]*?contractEnv: \[\s*\.\.\.mcpAuthProxyEnvContract\(\{ provider: "gcp-firebase", env \}\),\s*\.\.\.remoteMcpEnv\["mcp-auth-proxy"\],[\s\S]*?\{ name: INTERIM_FORWARD_ORIGIN_ENV, value: gatewaySvc\.uri \},\s*\]/,
+      );
+    } else {
+      // gcp: the proxy is CLI-owned (mcp-auth-proxy-setup.ts), not a stack service.
+      expect(src).not.toContain('serviceName: "mcp-auth-proxy"');
+    }
     expect(src).toContain("envs: [...args.contractEnv],");
   });
 
@@ -151,10 +184,11 @@ describe.each(["gcp", "gcp-firebase"] as const)("%s stack ↔ upgrade parity", (
     expect(src).toContain(
       "const remoteMcpEnv = remoteMcpIdentityStackEnv(cfg.get(REMOTE_MCP_IDENTITY_CONFIG));",
     );
-    expect(src.match(/remoteMcpEnv\.(admin|gateway)/g)?.sort()).toEqual([
-      "remoteMcpEnv.admin",
-      "remoteMcpEnv.gateway",
-    ]);
+    expect(src.match(/remoteMcpEnv(\.\w+|\["[\w-]+"\])/g)?.sort()).toEqual(
+      provider === "gcp-firebase"
+        ? ["remoteMcpEnv.admin", 'remoteMcpEnv["mcp-auth-proxy"]']
+        : ["remoteMcpEnv.admin"],
+    );
   });
 
   it("#1082 — leaves client / clientVersion (who deployed last) to gcloud on both services", () => {
@@ -165,6 +199,17 @@ describe.each(["gcp", "gcp-firebase"] as const)("%s stack ↔ upgrade parity", (
     expect(CLOUD_RUN_IGNORE_CHANGES).toEqual(["client", "clientVersion"]);
   });
 
+  it("#1328 E13 a — the proxy keeps the gateway's logical resource names, so its service and URL stay", () => {
+    if (!src.includes('serviceName: "mcp-auth-proxy"')) return; // the gcp stack: CLI-owned proxy
+    // Same URN as before → Pulumi updates the existing service (keeping its
+    // auto-generated name and run.app URL) instead of creating a new one.
+    expect(src).toMatch(
+      /serviceName: "mcp-auth-proxy",\s*resourceName: `\$\{namePrefix\}-gateway`,/,
+    );
+    expect(src).toMatch(/`\$\{namePrefix\}-gateway-public-invoker`/);
+    expect(src).not.toContain("aliases");
+  });
+
   it("mounts the media bucket on the admin, and only there, from the contract upgrade applies", () => {
     // The stack's admin gets adminMediaVolume() — the same volume
     // stack-converge.ts planMediaVolume adds to installs that lack it.
@@ -193,10 +238,17 @@ describe.each(["gcp", "gcp-firebase"] as const)("%s stack ↔ upgrade parity", (
     expect(src.match(/secretFileVolumesTemplate\(args\.serviceName, env\)/g)).toHaveLength(2);
   });
 
-  it("#806 — gives the gateway the contract's request timeout upgrade applies", () => {
-    expect(src).toMatch(
-      /serviceName: "gateway",[\s\S]*?timeout: `\$\{GATEWAY_TIMEOUT_SECONDS\}s`,[\s\S]*?contractEnv: \[\s*\.\.\.gatewayEnvContract\(/,
-    );
+  it("#806 — gives the MCP-Auth-Proxy the contract's request timeout upgrade applies", () => {
+    // #1328 — the long remote-MCP streams are the proxy's; the gateway keeps
+    // Cloud Run's default. On gcp the proxy is deployed by the CLI with the
+    // same constant (mcp-auth-proxy-setup.ts gcpProxyDeployArgs).
+    expect(src).toMatch(/serviceName: "gateway",[\s\S]*?timeout: "300s",/);
+    expect(src).not.toContain("GATEWAY_TIMEOUT_SECONDS");
+    if (provider === "gcp-firebase") {
+      expect(src).toMatch(
+        /serviceName: "mcp-auth-proxy",[\s\S]*?timeout: `\$\{MCP_AUTH_PROXY_TIMEOUT_SECONDS\}s`,/,
+      );
+    }
   });
 
   it("sets no env var outside the contract (C1: no secret value in a plain var)", () => {
@@ -207,7 +259,17 @@ describe.each(["gcp", "gcp-firebase"] as const)("%s stack ↔ upgrade parity", (
 
   it("builds no database URL with a password in it", () => {
     expect(src).not.toMatch(/:\$\{postgresPassword\}@|\$\{pw\}@/);
-    expect(src).toContain("sqlInstance.privateIpAddress.apply(databaseUrls)");
+    // #1338 — from the instance's DNS name, once its private zone record exists.
+    expect(src).toContain(".apply(([host]) => databaseUrls(host))");
+  });
+
+  it("serves verify-full TLS: shared server CA, encrypted only, DNS name in the VPC (#1338)", () => {
+    expect(src).toContain("serverCaMode: CLOUD_SQL_SERVER_CA_MODE");
+    expect(src).toContain("sslMode: CLOUD_SQL_SSL_MODE");
+    // The names cloudsql-tls.ts converges and adopt-existing.ts adopts.
+    expect(src).toContain("name: cloudSqlDnsZoneName(env)");
+    expect(src).toContain("managedZone: cloudSqlDnsZoneName(env)");
+    expect(src).toContain('visibility: "private"');
   });
 
   it("references the CLI-generated secrets by id instead of creating them", () => {
@@ -225,11 +287,16 @@ describe.each(["gcp", "gcp-firebase"] as const)("%s stack ↔ upgrade parity", (
 
   it("pins images by the config keys upgrade writes back", () => {
     const keys = Object.keys(
-      imageDigestConfig(provider, { admin: "sha256:a", gateway: "sha256:b" }),
+      imageDigestConfig(provider, {
+        admin: "sha256:a",
+        gateway: "sha256:b",
+        "mcp-auth-proxy": "sha256:c",
+      }),
     );
     expect(keys).toEqual([
       `caelo-${provider}:image-digest-admin`,
       `caelo-${provider}:image-digest-gateway`,
+      `caelo-${provider}:image-digest-mcp-auth-proxy`,
     ]);
     // The stack reads `<ns>:image-digest-<service>` through pulumi.Config.
     expect(src).toMatch(/cfg\.get\(`image-digest-\$\{service\}`\)/);

package/src/stack-contract.test.ts

@@ -6,16 +6,27 @@ import { generateDockerCompose } from "./compose.js";
 import {
   adminEnvContract,
   CLI_GENERATED_SECRETS,
+  CLOUD_RUN_SLUGS,
   type CloudRunEnvVar,
+  cloudRunServicePrefix,
   DATABASE_ROLE_SECRET,
   databaseUrls,
   defaultStagingHost,
+  fixedCloudRunServiceName,
   gatewayEnvContract,
+  INTERIM_FORWARD_ORIGIN_ENV,
   iamMember,
+  MCP_AUTH_PROXY_TRUSTED_PROXY_HOPS,
+  mcpAuthProxyEnvContract,
+  REMOTE_MCP_MODE,
   RETIRED_IAM_BINDINGS,
+  RETIRED_SECRET_FILES,
   RETIRED_SERVICE_ENV,
   runtimeSecretBindings,
+  SECRETS_SET_UP_AHEAD_OF_THEIR_READER,
   SERVICE_SECRET_ENV,
+  SERVICE_SECRET_FILES,
+  SERVICE_VPC_EGRESS,
   STACK_IAM_NOT_ENSURED,
   serviceSecrets,
   stackIamInvariants,
@@ -27,7 +38,7 @@ const base = {
   domain: "acme.com",
   stagingHost: "staging.acme.com",
   region: "europe-west1",
-  databaseUrls: databaseUrls("10.20.0.3"),
+  databaseUrls: databaseUrls("db1.p-label.europe-west1.sql-psa.goog"),
 };
 const asRecord = (vars: CloudRunEnvVar[]) =>
   Object.fromEntries(
@@ -42,6 +53,7 @@ const asRecord = (vars: CloudRunEnvVar[]) =>
 const ADMIN_SECRETS = {
   ADMIN_DATABASE_PASSWORD: "secret:caelo-production-postgres-password:latest",
   PUBLIC_ADMIN_DATABASE_PASSWORD: "secret:caelo-production-postgres-password:latest",
+  PUBLIC_STAGING_ADMIN_DATABASE_PASSWORD: "secret:caelo-production-postgres-password:latest",
   CAELO_SECRET_KEK: "secret:caelo-production-secret-kek:latest",
   CAELO_INTERNAL_SECRET: "secret:caelo-production-internal-secret:latest",
   CAELO_TOOL_APPROVAL_SECRET: "secret:caelo-production-tool-approval-secret:latest",
@@ -50,10 +62,17 @@ const ADMIN_SECRETS = {
 
 describe("databaseUrls", () => {
   it("builds password-less URLs for the three role/database pairs", () => {
-    expect(databaseUrls("10.20.0.3")).toEqual({
-      admin: "postgresql://admin_role@10.20.0.3:5432/cms_admin?sslmode=require",
-      publicAdmin: "postgresql://admin_role@10.20.0.3:5432/cms_public?sslmode=require",
-      public: "postgresql://public_role@10.20.0.3:5432/cms_public?sslmode=require",
+    expect(databaseUrls("db1.p-label.europe-west1.sql-psa.goog")).toEqual({
+      admin:
+        "postgresql://admin_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_admin?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem",
+      publicAdmin:
+        "postgresql://admin_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_public?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem",
+      public:
+        "postgresql://public_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_public?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem",
+      publicStagingAdmin:
+        "postgresql://admin_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_public_staging?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem",
+      publicStaging:
+        "postgresql://public_staging_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_public_staging?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem",
     });
   });
 });
@@ -64,14 +83,18 @@ describe("adminEnvContract", () => {
       CAELO_PROVIDER: "gcp",
       CAELO_ENV: "production",
       MEDIA_STORAGE_URL: "gs://acme-caelo-production-media",
-      ADMIN_DATABASE_URL: "postgresql://admin_role@10.20.0.3:5432/cms_admin?sslmode=require",
+      ADMIN_DATABASE_URL:
+        "postgresql://admin_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_admin?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem",
       PUBLIC_ADMIN_DATABASE_URL:
-        "postgresql://admin_role@10.20.0.3:5432/cms_public?sslmode=require",
+        "postgresql://admin_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_public?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem",
+      PUBLIC_STAGING_ADMIN_DATABASE_URL:
+        "postgresql://admin_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_public_staging?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem",
       CAELO_SITE_URL: "https://acme.com",
       CAELO_GENERATOR_CLI: "/app/apps/static-generator/src/cli.ts",
       MEDIA_ROOT_DIR: "/app/apps/admin/data/media",
       CAELO_MCP_IAP_SERVICE_ACCOUNT: "caelo-mcp@acme.iam.gserviceaccount.com",
       CAELO_MEDIA_BUCKET: "acme-caelo-production-media",
+      CAELO_SCHEDULER_SERVICE_ACCOUNT: "caelo-production-scheduler@acme.iam.gserviceaccount.com",
       // #806 — where Settings → MCP → Remote writes the OAuth client.
       CAELO_OPERATOR_OAUTH_CLIENT_STORE:
         "projects/acme/secrets/caelo-production-operator-oauth-client",
@@ -103,14 +126,18 @@ describe("adminEnvContract", () => {
       CAELO_PROVIDER: "gcp-firebase",
       CAELO_ENV: "production",
       MEDIA_STORAGE_URL: "gs://acme-caelo-production-media",
-      ADMIN_DATABASE_URL: "postgresql://admin_role@10.20.0.3:5432/cms_admin?sslmode=require",
+      ADMIN_DATABASE_URL:
+        "postgresql://admin_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_admin?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem",
       PUBLIC_ADMIN_DATABASE_URL:
-        "postgresql://admin_role@10.20.0.3:5432/cms_public?sslmode=require",
+        "postgresql://admin_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_public?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem",
+      PUBLIC_STAGING_ADMIN_DATABASE_URL:
+        "postgresql://admin_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_public_staging?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem",
       CAELO_SITE_URL: "https://acme.com",
       CAELO_GENERATOR_CLI: "/app/apps/static-generator/src/cli.ts",
       MEDIA_ROOT_DIR: "/app/apps/admin/data/media",
       CAELO_MCP_IAP_SERVICE_ACCOUNT: "caelo-mcp@acme.iam.gserviceaccount.com",
       CAELO_MEDIA_BUCKET: "acme-caelo-production-media",
+      CAELO_SCHEDULER_SERVICE_ACCOUNT: "caelo-production-scheduler@acme.iam.gserviceaccount.com",
       // #806 — where Settings → MCP → Remote writes the OAuth client.
       CAELO_OPERATOR_OAUTH_CLIENT_STORE:
         "projects/acme/secrets/caelo-production-operator-oauth-client",
@@ -176,14 +203,15 @@ describe("gatewayEnvContract", () => {
       CAELO_PROVIDER: "gcp",
       CAELO_ENV: "production",
       MEDIA_STORAGE_URL: "gs://acme-caelo-production-media",
+      // #1329 — the live site's gateway.
+      CAELO_GATEWAY_ENVIRONMENT: "live",
       // #845 — gcp: the LB appends <client>,<LB IP>.
       CAELO_TRUSTED_PROXY_HOPS: "2",
-      PUBLIC_DATABASE_URL: "postgresql://public_role@10.20.0.3:5432/cms_public?sslmode=require",
+      PUBLIC_DATABASE_URL:
+        "postgresql://public_role@db1.p-label.europe-west1.sql-psa.goog:5432/cms_public?sslmode=verify-full&sslrootcert=/etc/caelo/db-ca/cloudsql-global.pem",
       PUBLIC_DATABASE_PASSWORD: "secret:caelo-production-public-role-password:latest",
       CAELO_STAGING_GATE_SECRET: "secret:caelo-production-staging-gate-secret:latest",
-      // #806 — the remote-MCP broker: its client file and its seal key.
-      CAELO_OPERATOR_OAUTH_CLIENT_FILE: "/secrets/operator-oauth-client/client.json",
-      CAELO_MCP_OAUTH_SEAL_KEY: "secret:caelo-production-mcp-oauth-seal-key:latest",
+      // No remote-MCP env: the broker is the MCP-Auth-Proxy's (#1328).
     });
   });
 
@@ -215,13 +243,7 @@ describe("gatewayEnvContract", () => {
   });
 
   it("the gateway's run SA reads no admin-only secret (admin password, KEK, internal, tool approval)", () => {
-    expect(serviceSecrets("gateway")).toEqual([
-      "public-role-password",
-      "staging-gate-secret",
-      // #806 — the broker's seal key (env) and OAuth client (file).
-      "mcp-oauth-seal-key",
-      "operator-oauth-client",
-    ]);
+    expect(serviceSecrets("gateway")).toEqual(["public-role-password", "staging-gate-secret"]);
     for (const v of gateway) {
       expect(v.name).not.toMatch(/KEK|INTERNAL|TOOL_APPROVAL|PUBLIC_ADMIN/);
     }
@@ -259,6 +281,7 @@ describe("database role secrets (#613)", () => {
     expect(DATABASE_ROLE_SECRET).toEqual({
       admin_role: "postgres-password",
       public_role: "public-role-password",
+      public_staging_role: "public-staging-role-password",
     });
   });
 
@@ -318,25 +341,39 @@ describe("runtime secrets", () => {
         secret: "staging-gate-secret",
         stackResource: "gateway-staging-gate-secret-binding",
       },
+      // #1328 — the broker's seal key (env) and Google sign-in client (a
+      // file, which counts like an env secret: the SA reads it).
       {
-        service: "gateway",
+        service: "mcp-auth-proxy",
         secret: "mcp-oauth-seal-key",
-        stackResource: "gateway-mcp-oauth-seal-key-binding",
+        stackResource: "mcp-auth-proxy-mcp-oauth-seal-key-binding",
       },
-      // The secret file counts like an env secret: the SA reads it.
       {
-        service: "gateway",
+        service: "mcp-auth-proxy",
         secret: "operator-oauth-client",
-        stackResource: "gateway-operator-oauth-client-binding",
+        stackResource: "mcp-auth-proxy-operator-oauth-client-binding",
       },
     ]);
   });
 
-  it("every CLI-generated secret is read by some service", () => {
+  it("every CLI-generated secret is read by some service, or says what reads it until one does", () => {
+    const read = CLOUD_RUN_SLUGS.flatMap((slug) => serviceSecrets(slug));
     for (const s of CLI_GENERATED_SECRETS) {
-      expect([...serviceSecrets("admin"), ...serviceSecrets("gateway")]).toContain(s);
+      if (SECRETS_SET_UP_AHEAD_OF_THEIR_READER[s]) {
+        // Set up ahead: no service may read it yet, or the entry is stale.
+        expect(read).not.toContain(s);
+        continue;
+      }
+      expect(read).toContain(s);
     }
   });
+
+  it("the two gateway logins share no password secret, and no service reads the staging one yet (#1329)", () => {
+    expect(DATABASE_ROLE_SECRET.public_staging_role).not.toBe(DATABASE_ROLE_SECRET.public_role);
+    expect(CLI_GENERATED_SECRETS).toContain("public-staging-role-password");
+    expect(serviceSecrets("gateway")).not.toContain("public-staging-role-password");
+    expect(serviceSecrets("admin")).not.toContain("public-staging-role-password");
+  });
 });
 
 describe("self-hosted compose", () => {
@@ -344,8 +381,9 @@ describe("self-hosted compose", () => {
     const yaml = generateDockerCompose({
       domain: "acme.com",
       postgresPassword: "p",
-      rolePasswords: { admin: "a", public: "b" },
+      rolePasswords: { admin: "a", public: "b", publicStaging: "ps" },
       caeloSecretKek: "k",
+      dbTlsServerCertSha256: "abababababababababababababababababababababababababababababababab",
       internalSecret: "i".repeat(48),
       diskSize: "10G",
       ports: { http: 80, https: 443 },
@@ -386,14 +424,12 @@ describe("stackIamInvariants", () => {
     }
   });
 
-  it("grants the gateway SA only its own role password, the staging gate key, the sign-in client, the seal key + telemetry roles", () => {
+  it("grants the gateway SA only its own role password, the staging gate key + telemetry roles", () => {
     for (const provider of ["gcp", "gcp-firebase"] as const) {
       const gateway = stackIamInvariants(provider).filter((i) => i.member === "gateway-sa");
       expect(gateway.map((i) => `${i.role} ${JSON.stringify(i.target)}`).sort()).toEqual([
         'roles/logging.logWriter {"kind":"project"}',
         'roles/monitoring.metricWriter {"kind":"project"}',
-        'roles/secretmanager.secretAccessor {"kind":"secret","name":"mcp-oauth-seal-key"}',
-        'roles/secretmanager.secretAccessor {"kind":"secret","name":"operator-oauth-client"}',
         'roles/secretmanager.secretAccessor {"kind":"secret","name":"public-role-password"}',
         'roles/secretmanager.secretAccessor {"kind":"secret","name":"staging-gate-secret"}',
       ]);
@@ -407,6 +443,135 @@ describe("stackIamInvariants", () => {
   });
 });
 
+describe("MCP-Auth-Proxy contract (#1328)", () => {
+  it("names one service per role; no prefix is a prefix of another", () => {
+    for (const provider of ["gcp", "gcp-firebase"] as const) {
+      const prefixes = CLOUD_RUN_SLUGS.map((s) => cloudRunServicePrefix(provider, "production", s));
+      expect(new Set(prefixes).size).toBe(prefixes.length);
+      for (const a of prefixes) {
+        for (const b of prefixes) if (a !== b) expect(b.startsWith(a)).toBe(false);
+      }
+    }
+    // E13 (a): on gcp-firebase the proxy keeps the old gateway service.
+    expect(cloudRunServicePrefix("gcp-firebase", "production", "mcp-auth-proxy")).toBe(
+      "caelo-production-gateway",
+    );
+    expect(cloudRunServicePrefix("gcp-firebase", "production", "gateway")).toBe(
+      "caelo-production-data-gateway",
+    );
+    expect(cloudRunServicePrefix("gcp", "production", "gateway")).toBe("caelo-production-gateway");
+    expect(cloudRunServicePrefix("gcp", "production", "mcp-auth-proxy")).toBe(
+      "caelo-production-mcp-auth-proxy",
+    );
+  });
+
+  it("fixes the names of exactly the services the converge creates", () => {
+    expect(fixedCloudRunServiceName("gcp-firebase", "production", "gateway")).toBe(
+      "caelo-production-data-gateway",
+    );
+    expect(fixedCloudRunServiceName("gcp", "production", "mcp-auth-proxy")).toBe(
+      "caelo-production-mcp-auth-proxy",
+    );
+    for (const [provider, slug] of [
+      ["gcp-firebase", "admin"],
+      ["gcp-firebase", "mcp-auth-proxy"],
+      ["gcp", "admin"],
+      ["gcp", "gateway"],
+    ] as const) {
+      expect(fixedCloudRunServiceName(provider, "production", slug)).toBeNull();
+    }
+  });
+
+  it("gives the proxy no database, site or pool env — only its mode, hops, file and seal key", () => {
+    for (const provider of ["gcp", "gcp-firebase"] as const) {
+      const env = asRecord(mcpAuthProxyEnvContract({ provider, env: "production" }));
+      expect(env).toEqual({
+        CAELO_PROVIDER: provider,
+        CAELO_REMOTE_MCP: "available",
+        CAELO_TRUSTED_PROXY_HOPS: provider === "gcp" ? "2" : "1",
+        CAELO_OPERATOR_OAUTH_CLIENT_FILE: "/secrets/operator-oauth-client/client.json",
+        CAELO_MCP_OAUTH_SEAL_KEY: "secret:caelo-production-mcp-oauth-seal-key:latest",
+      });
+      for (const name of Object.keys(env)) expect(name).not.toMatch(/DATABASE|POOL|KEK|STAGING/);
+    }
+    // Remote MCP needs Google IAP: everywhere else the proxy answers its 404.
+    expect(REMOTE_MCP_MODE).toEqual({
+      gcp: "available",
+      "gcp-firebase": "available",
+      "self-hosted": "unavailable",
+      aws: "unavailable",
+      azure: "unavailable",
+    });
+    expect(
+      asRecord(mcpAuthProxyEnvContract({ provider: "azure", env: "production" })),
+    ).toMatchObject({
+      CAELO_REMOTE_MCP: "unavailable",
+      CAELO_TRUSTED_PROXY_HOPS: String(MCP_AUTH_PROXY_TRUSTED_PROXY_HOPS.azure),
+    });
+    // The interim forward origin is the stack's / converge's, never the contract's.
+    expect(
+      mcpAuthProxyEnvContract({ provider: "gcp-firebase", env: "production" }).map((v) => v.name),
+    ).not.toContain(INTERIM_FORWARD_ORIGIN_ENV);
+  });
+
+  it("the proxy's SA reads exactly its two secrets and holds no other invariant", () => {
+    expect(serviceSecrets("mcp-auth-proxy")).toEqual([
+      "mcp-oauth-seal-key",
+      "operator-oauth-client",
+    ]);
+    for (const provider of ["gcp", "gcp-firebase"] as const) {
+      const proxy = stackIamInvariants(provider).filter((i) => i.member === "mcp-auth-proxy-sa");
+      expect(proxy.map((i) => `${i.role} ${JSON.stringify(i.target)}`).sort()).toEqual([
+        'roles/secretmanager.secretAccessor {"kind":"secret","name":"mcp-oauth-seal-key"}',
+        'roles/secretmanager.secretAccessor {"kind":"secret","name":"operator-oauth-client"}',
+      ]);
+    }
+    expect(SERVICE_VPC_EGRESS["mcp-auth-proxy"]).toBe(false);
+    expect(SERVICE_SECRET_FILES["mcp-auth-proxy"]).toHaveLength(1);
+    expect(SERVICE_SECRET_FILES.gateway).toEqual([]);
+  });
+
+  it("retires the broker's env, file and secret access on the gateway", () => {
+    for (const name of [
+      "CAELO_OPERATOR_OAUTH_CLIENT_FILE",
+      "CAELO_MCP_OAUTH_SEAL_KEY",
+      "CAELO_MCP_OAUTH_SEAL_KEY_PREVIOUS",
+      "CAELO_MCP_PUBLIC_URL",
+      "CAELO_ADMIN_URL",
+    ]) {
+      expect(RETIRED_SERVICE_ENV.gateway).toContain(name);
+    }
+    expect(RETIRED_SECRET_FILES.gateway.map((f) => f.secret)).toContain("operator-oauth-client");
+    for (const secret of ["mcp-oauth-seal-key", "operator-oauth-client"]) {
+      expect(RETIRED_IAM_BINDINGS).toContainEqual(
+        expect.objectContaining({ member: "gateway-sa", target: { kind: "secret", name: secret } }),
+      );
+    }
+    // On gcp-firebase the proxy is the old gateway service: its visitor env goes.
+    for (const name of [
+      "PUBLIC_DATABASE_URL",
+      "PUBLIC_DATABASE_PASSWORD",
+      "CAELO_STAGING_GATE_SECRET",
+    ]) {
+      expect(RETIRED_SERVICE_ENV["mcp-auth-proxy"]).toContain(name);
+    }
+  });
+
+  it("gcp-firebase: the data gateway is the rewrite target, the proxy public", () => {
+    const inv = stackIamInvariants("gcp-firebase");
+    const on = (service: string) =>
+      inv
+        .filter((i) => i.target.kind === "run-service" && i.target.service === service)
+        .map((i) => `${i.stackResource} ${i.role} ${i.member}`)
+        .sort();
+    expect(on("gateway")).toEqual([
+      "data-gateway-public-invoker roles/run.invoker allUsers",
+      "data-gateway-viewer-for-admin-sa roles/run.viewer run-sa",
+    ]);
+    expect(on("mcp-auth-proxy")).toEqual(["gateway-public-invoker roles/run.invoker allUsers"]);
+  });
+});
+
 describe("iamMember", () => {
   const install = { projectId: "acme", projectNumber: "123", env: "production" };
   it("resolves every principal to the name the stack gives it", () => {
@@ -416,6 +581,9 @@ describe("iamMember", () => {
     expect(iamMember("gateway-sa", install)).toBe(
       "serviceAccount:caelo-production-gateway-sa@acme.iam.gserviceaccount.com",
     );
+    expect(iamMember("mcp-auth-proxy-sa", install)).toBe(
+      "serviceAccount:caelo-production-mcp-proxy-sa@acme.iam.gserviceaccount.com",
+    );
     expect(iamMember("static-publisher-sa", install)).toBe(
       "serviceAccount:caelo-prod-publisher@acme.iam.gserviceaccount.com",
     );