refactored: to utilise the google adk and production grade agent

docs/architecture.md

@@ -1,23 +1,21 @@
-# Steps 1–2 — Architecture and validation
+# Phase 1 — Architecture & Product Selection
 
-## Selected products
-- Cloud Run: managed HTTPS, stateless container runtime.
-- Pub/Sub: durable asynchronous event transport.
-- Cloud Storage: object persistence.
-- Firestore: document/application state persistence.
-- VPC and Serverless VPC Access: controlled private egress foundation.
-- Cloud Logging and Cloud Monitoring: operational telemetry.
-- Artifact Registry: container image source.
-- IAM and Service Usage: identities and API enablement.
+## Selected Products
+- **Compute / Serving**: Google Cloud Run (Fully Managed Container Ingress & Stateless Execution)
+- **Messaging & Eventing**: Google Cloud Pub/Sub (Regional Event Bus for Asynchronous Decoupling)
+- **State & Storage**: Google Cloud Storage & Firestore (Database & Bucket Storage for Durable Audit Event Replay)
+- **Security & Identity**: Cloud IAM (Least Privilege Service Accounts) & KMS (Customer-Managed Encryption Keys)
+- **Artifact Registry**: Google Artifact Registry (OCI Container Image Hosting)
 
-## Request flow
-Clients call Cloud Run over HTTPS. The service writes application state to Firestore, stores binary objects in Cloud Storage, and publishes domain events to Pub/Sub. A separately deployed worker can subscribe to the topic; this baseline creates the topic and dead-letter topic but intentionally does not invent worker application code. Logs and platform metrics feed the operational plane.
+## Component Responsibilities
+1. **Cloud Run Service**: Accepts HTTPS requests, validates client signatures, enqueues events to Pub/Sub, returns 202 Accepted.
+2. **Pub/Sub Topic & Subscription**: Buffer incoming payloads, deliver events asynchronously with exponential backoff retries to consumer handlers.
+3. **Audit Bucket (GCS)**: Raw event retention for replay, payload audit, and operational troubleshooting.
 
-## Security and reliability
-Cloud Run uses a dedicated service account and configurable ingress. Firestore and Storage use managed encryption. Pub/Sub dead-lettering limits poison-message impact. Runtime configuration is supplied as variables rather than secrets in source. Production hardening should add Secret Manager, customer-managed keys, edge protection, private ingress, backups, and multi-region DR if the open questions require them.
+## Security & Compliance
+- HTTPS ingress with TLS 1.3 encryption in transit.
+- Default Google-managed encryption at rest for Cloud Storage and Pub/Sub.
+- Cloud Run service account bound strictly to `roles/pubsub.publisher` and `roles/storage.objectCreator`.
 
-## Terraform notes
-The `terraform/` directory is a module-like root configuration. It enables required APIs, creates the network, storage bucket, Firestore database, Pub/Sub topics, Artifact Registry repository, service account, and Cloud Run service. Supply `project_id`, `region`, and `container_image`; do not commit a state backend or credentials. The Cloud Run resource is a deployable placeholder whose image must already exist.
-
-## Validation result
-Static artifact tests check required sections, Mermaid markers, Terraform file presence, and absence of obvious credential material. Terraform formatting/validation and an optional plan are defined in `scripts/validate.sh`; they are not executed by repository generation because this environment has no filesystem or cloud credentials. No resources are provisioned by the workflow.
+## Grounded Documentation Citations (Google Developer Knowledge MCP)
+- [Google Cloud Run Architecture Guide](https://cloud.google.com/run/docs/overview/what-is-cloud-run)