decomposer: generate deliverable files for Discover and structure the solution's functional requirements, non-functional requirements, constraints, assumptions, and open questions without selecting cloud products.; Select Google Cloud products from the confirmed requirements and produce the solution architecture, Mermaid diagram, architecture description, and Terraform infrastructure-as-code.; Validate the Terraform infrastructure and architecture artifacts without deploying resources by running formatting checks, Terraform validation, and a dry-run or plan-oriented deployment check.; Package the approved requirements, architecture, Mermaid diagram, Terraform IaC, and validation results into solution-architecture-guide.md in the gcp_solution_architecture_agent repository.; Verify that the gcp_solution_architecture_agent repository contains the packaged solution-architecture-guide.md with the approved workflow outputs.; Verify that the repository is derived from the workflow_agent template and implements the complete four-phase Google Cloud solution architecture workflow alongside the packaged guide.; Publish the verified gcp_solution_architecture_agent repository with its completed workflow implementation and solution architecture guide.; Verify that the published repository revision contains the completed workflow implementation and solution architecture guide.

requirements-spec.md

@@ -0,0 +1,57 @@
+# Step 0 — approved requirements specification
+
+## Workflow request
+
+Produce a reviewable, deployable Google Cloud reference architecture for an event-driven order-ingestion service, while separating product-neutral discovery from product selection and validating IaC without provisioning.
+
+## Functional requirements
+
+- Accept authenticated order submissions over HTTPS.
+- Validate order payloads and return a synchronous acknowledgement.
+- Process accepted orders asynchronously so ingestion is not coupled to downstream latency.
+- Persist durable order state and support transactional updates.
+- Store credentials and other sensitive configuration outside source code.
+- Provide application logs, metrics, traces, and auditable administrative activity.
+- Support repeatable infrastructure deployment from version-controlled IaC.
+- Provide a documented rollback and dead-letter/replay approach.
+
+## Non-functional requirements
+
+- Target 99.9% monthly availability for the public ingestion endpoint.
+- Target p95 acknowledgement latency below 500 ms under the expected baseline load.
+- Provide encryption in transit and at rest.
+- Scale horizontally for bursty traffic and isolate asynchronous work from ingestion.
+- Apply least-privilege identities and private access to data services where practical.
+- Retain operational and audit evidence for at least 90 days, subject to organizational policy.
+- Ensure deployments are reproducible, reviewable, and non-destructive by default.
+
+## Constraints
+
+- The target platform is Google Cloud.
+- Terraform is the infrastructure-as-code language.
+- No resources may be provisioned during architecture validation.
+- Product selection is explicitly deferred until this requirements section is approved.
+- The first release is a reference implementation, not a completed compliance certification.
+- Region, budget, traffic volume, data residency, and regulatory classification are not yet supplied.
+
+## Assumptions
+
+- Orders are JSON and contain an immutable order identifier.
+- A single primary region is acceptable for the initial release.
+- The service can tolerate eventual consistency for asynchronous fulfillment.
+- A managed relational database is appropriate for transactional order state.
+- CI has permission to run Terraform formatting, initialization without a backend, validation, and an optional credentialed plan.
+- Application container images are published by a separate build pipeline.
+
+## Open questions
+
+- What are peak requests per second, payload size, and daily order volume?
+- Which identity provider and client authentication protocol are required?
+- What RTO/RPO and disaster-recovery region are required?
+- What data residency, PCI, GDPR, or other controls apply?
+- Should the database be regional or cross-region, and what is the retention/deletion policy?
+- Which downstream systems consume orders, and what delivery semantics do they require?
+- What is the approved Google Cloud project, region, DNS zone, and naming convention?
+- What are the maximum monthly budget and alerting escalation targets?
+
+Product selection deferred during this step: **true**.