refactored: to utilise the google adk and production grade agent

deliverables/executions/a1c12752-bd61-4f06-a21b-fc862e9017df/target/architecture.md

@@ -0,0 +1,21 @@
+# Phase 1 — Architecture & Product Selection
+
+## Selected Products
+- **Compute / Serving**: Google Cloud Run (Fully Managed Container Ingress & Stateless Execution)
+- **Messaging & Eventing**: Google Cloud Pub/Sub (Regional Event Bus for Asynchronous Decoupling)
+- **State & Storage**: Google Cloud Storage & Firestore (Database & Bucket Storage for Durable Audit Event Replay)
+- **Security & Identity**: Cloud IAM (Least Privilege Service Accounts) & KMS (Customer-Managed Encryption Keys)
+- **Artifact Registry**: Google Artifact Registry (OCI Container Image Hosting)
+
+## Component Responsibilities
+1. **Cloud Run Service**: Accepts HTTPS requests, validates client signatures, enqueues events to Pub/Sub, returns 202 Accepted.
+2. **Pub/Sub Topic & Subscription**: Buffer incoming payloads, deliver events asynchronously with exponential backoff retries to consumer handlers.
+3. **Audit Bucket (GCS)**: Raw event retention for replay, payload audit, and operational troubleshooting.
+
+## Security & Compliance
+- HTTPS ingress with TLS 1.3 encryption in transit.
+- Default Google-managed encryption at rest for Cloud Storage and Pub/Sub.
+- Cloud Run service account bound strictly to `roles/pubsub.publisher` and `roles/storage.objectCreator`.
+
+## Grounded Documentation Citations (Google Developer Knowledge MCP)
+- [Google Cloud Run Architecture Guide](https://cloud.google.com/run/docs/overview/what-is-cloud-run)