refactored: to utilise the google adk and production grade agent

docs/requirements-spec.md

@@ -0,0 +1,57 @@
+# Step 0 — approved requirements specification
+
+## Workflow request
+
+Produce a reviewable, deployable Google Cloud reference architecture for an event-driven order-ingestion service, while separating product-neutral discovery from product selection and validating IaC without provisioning.
+
+## Functional requirements
+
+- Accept authenticated order submissions over HTTPS.
+- Validate order payloads and return a synchronous acknowledgement.
+- Process accepted orders asynchronously so ingestion is not coupled to downstream latency.
+- Persist durable order state and support transactional updates.
+- Store credentials and other sensitive configuration outside source code.
+- Provide application logs, metrics, traces, and auditable administrative activity.
+- Support repeatable infrastructure deployment from version-controlled IaC.
+- Provide a documented rollback and dead-letter/replay approach.
+
+## Non-functional requirements
+
+- Target 99.9% monthly availability for the public ingestion endpoint.
+- Target p95 acknowledgement latency below 500 ms under the expected baseline load.
+- Provide encryption in transit and at rest.
+- Scale horizontally for bursty traffic and isolate asynchronous work from ingestion.
+- Apply least-privilege identities and private access to data services where practical.
+- Retain operational and audit evidence for at least 90 days, subject to organizational policy.
+- Ensure deployments are reproducible, reviewable, and non-destructive by default.
+
+## Constraints
+
+- The target platform is Google Cloud.
+- Terraform is the infrastructure-as-code language.
+- No resources may be provisioned during architecture validation.
+- Product selection is explicitly deferred until this requirements section is approved.
+- The first release is a reference implementation, not a completed compliance certification.
+- Region, budget, traffic volume, data residency, and regulatory classification are not yet supplied.
+
+## Assumptions
+
+- Orders are JSON and contain an immutable order identifier.
+- A single primary region is acceptable for the initial release.
+- The service can tolerate eventual consistency for asynchronous fulfillment.
+- A managed relational database is appropriate for transactional order state.
+- CI has permission to run Terraform formatting, initialization without a backend, validation, and an optional credentialed plan.
+- Application container images are published by a separate build pipeline.
+
+## Open questions
+
+- What are peak requests per second, payload size, and daily order volume?
+- Which identity provider and client authentication protocol are required?
+- What RTO/RPO and disaster-recovery region are required?
+- What data residency, PCI, GDPR, or other controls apply?
+- Should the database be regional or cross-region, and what is the retention/deletion policy?
+- Which downstream systems consume orders, and what delivery semantics do they require?
+- What is the approved Google Cloud project, region, DNS zone, and naming convention?
+- What are the maximum monthly budget and alerting escalation targets?
+
+Product selection deferred during this step: **true**.