From d73472eed4371878886ac682ca2da18eab8dc794 Mon Sep 17 00:00:00 2001
From: demo-bot <demo-bot@kyndryl.com>
Date: Tue, 1 Sep 2026 19:47:05 +0000
Subject: [PATCH] decomposer: generate deliverable files for Discover and
 structure the solution's functional requirements, non-functional
 requirements, constraints, assumptions, and open questions without selecting
 cloud products.; Select Google Cloud products from the confirmed requirements
 and produce the solution architecture, Mermaid diagram, architecture
 description, and Terraform infrastructure-as-code.; Validate the Terraform
 infrastructure and architecture artifacts without deploying resources by
 running formatting checks, Terraform validation, and a dry-run or
 plan-oriented deployment check.; Package the approved requirements,
 architecture, Mermaid diagram, Terraform IaC, and validation results into
 solution-architecture-guide.md in the gcp_solution_architecture_agent
 repository.; Verify that the gcp_solution_architecture_agent repository
 contains the packaged solution-architecture-guide.md with the approved
 workflow outputs.; Verify that the repository is derived from the
 workflow_agent template and implements the complete four-phase Google Cloud
 solution architecture workflow alongside the packaged guide.; Publish the
 verified gcp_solution_architecture_agent repository with its completed
 workflow implementation and solution architecture guide.; Verify that the
 published repository revision contains the completed workflow implementation
 and solution architecture guide.

---
 .../plans/wf-decompose-65ea49fc2d04/DETAIL.md | 89 +++++++++++++++++
 .../plans/wf-decompose-65ea49fc2d04/MAP.md    | 27 ++++++
 README.md                                     | 22 ++++-
 architecture.md                               |  7 ++
 architecture.mmd                              | 13 +++
 requirements.yaml                             | 31 ++++++
 scripts/validate.sh                           | 13 +++
 solution-architecture-guide.md                | 95 +++++++++++++++++++
 terraform/main.tf                             | 95 +++++++++++++++++++
 terraform/outputs.tf                          |  7 ++
 terraform/terraform.tfvars.example            |  5 +
 terraform/variables.tf                        | 32 +++++++
 tests/test_artifacts.py                       | 22 +++++
 validation-results.json                       |  9 ++
 workflow.yaml                                 | 18 ++++
 15 files changed, 483 insertions(+), 2 deletions(-)
 create mode 100644 .agents/plans/wf-decompose-65ea49fc2d04/DETAIL.md
 create mode 100644 .agents/plans/wf-decompose-65ea49fc2d04/MAP.md
 create mode 100644 architecture.md
 create mode 100644 architecture.mmd
 create mode 100644 requirements.yaml
 create mode 100644 scripts/validate.sh
 create mode 100644 solution-architecture-guide.md
 create mode 100644 terraform/main.tf
 create mode 100644 terraform/outputs.tf
 create mode 100644 terraform/terraform.tfvars.example
 create mode 100644 terraform/variables.tf
 create mode 100644 tests/test_artifacts.py
 create mode 100644 validation-results.json
 create mode 100644 workflow.yaml

diff --git a/.agents/plans/wf-decompose-65ea49fc2d04/DETAIL.md b/.agents/plans/wf-decompose-65ea49fc2d04/DETAIL.md
new file mode 100644
index 0000000..e6f441c
--- /dev/null
+++ b/.agents/plans/wf-decompose-65ea49fc2d04/DETAIL.md
@@ -0,0 +1,89 @@
+# Plan Detail
+
+## Step 0: Discover and structure the solution's functional requirements, non-functional requirements, constraints, assumptions, and open questions without selecting cloud products.
+
+- **Capability:** Elicit and organize architecture requirements while explicitly deferring product selection.
+- **Plan label:** gap
+- **Reusable capability:** False
+- **Rationale:** This is a deliverable phase in the requested GCP solution-architecture workflow, not an independently reusable registry capability.
+- **Input schema:** `{'repository_name': 'string', 'template_url': 'string', 'workflow_request': 'string'}`
+- **Output schema:** `{'repository_name': 'string', 'template_url': 'string', 'functional_requirements': 'string[]', 'non_functional_requirements': 'string[]', 'constraints': 'string[]', 'assumptions': 'string[]', 'open_questions': 'string[]', 'product_selection_deferred': 'boolean'}`
+- **Acceptance criteria:** (none)
+- **Success conditions:** (none)
+
+## Step 1: Select Google Cloud products from the confirmed requirements and produce the solution architecture, Mermaid diagram, architecture description, and Terraform infrastructure-as-code.
+
+- **Capability:** Translate confirmed functional and non-functional requirements into a Google Cloud product architecture and deployable Terraform artifacts.
+- **Plan label:** gap
+- **Reusable capability:** False
+- **Rationale:** The architecture artifacts are specific to this workflow's requirements and belong in the requested deliverable repository rather than as a standalone registry agent.
+- **Input schema:** `{'repository_name': 'string', 'template_url': 'string', 'functional_requirements': 'string[]', 'non_functional_requirements': 'string[]', 'constraints': 'string[]', 'assumptions': 'string[]', 'open_questions': 'string[]', 'product_selection_deferred': 'boolean'}`
+- **Output schema:** `{'repository_name': 'string', 'template_url': 'string', 'functional_requirements': 'string[]', 'non_functional_requirements': 'string[]', 'constraints': 'string[]', 'assumptions': 'string[]', 'selected_products': 'string[]', 'architecture_diagram_mermaid': 'string', 'architecture_description': 'string', 'terraform_iac': 'string'}`
+- **Acceptance criteria:** (none)
+- **Success conditions:** (none)
+
+## Step 2: Validate the Terraform infrastructure and architecture artifacts without deploying resources by running formatting checks, Terraform validation, and a dry-run or plan-oriented deployment check.
+
+- **Capability:** Perform pre-deployment validation of Terraform and solution architecture outputs without provisioning cloud resources.
+- **Plan label:** gap
+- **Reusable capability:** False
+- **Rationale:** Validation is a phase of this requested workflow and its checks are coupled to the Phase 2 Terraform output.
+- **Input schema:** `{'repository_name': 'string', 'template_url': 'string', 'functional_requirements': 'string[]', 'non_functional_requirements': 'string[]', 'constraints': 'string[]', 'assumptions': 'string[]', 'selected_products': 'string[]', 'architecture_diagram_mermaid': 'string', 'architecture_description': 'string', 'terraform_iac': 'string'}`
+- **Output schema:** `{'repository_name': 'string', 'template_url': 'string', 'functional_requirements': 'string[]', 'non_functional_requirements': 'string[]', 'constraints': 'string[]', 'assumptions': 'string[]', 'selected_products': 'string[]', 'architecture_diagram_mermaid': 'string', 'architecture_description': 'string', 'terraform_iac': 'string', 'terraform_format_valid': 'boolean', 'terraform_validation_valid': 'boolean', 'dry_run_valid': 'boolean', 'validation_findings': 'string[]'}`
+- **Acceptance criteria:** (none)
+- **Success conditions:** (none)
+
+## Step 3: Package the approved requirements, architecture, Mermaid diagram, Terraform IaC, and validation results into solution-architecture-guide.md in the gcp_solution_architecture_agent repository.
+
+- **Capability:** Consolidate validated solution architecture artifacts into a complete, reviewable solution architecture guide.
+- **Plan label:** gap
+- **Reusable capability:** False
+- **Rationale:** The guide is the final deliverable for this repository and is not a standalone reusable capability.
+- **Input schema:** `{'repository_name': 'string', 'template_url': 'string', 'functional_requirements': 'string[]', 'non_functional_requirements': 'string[]', 'constraints': 'string[]', 'assumptions': 'string[]', 'selected_products': 'string[]', 'architecture_diagram_mermaid': 'string', 'architecture_description': 'string', 'terraform_iac': 'string', 'terraform_format_valid': 'boolean', 'terraform_validation_valid': 'boolean', 'dry_run_valid': 'boolean', 'validation_findings': 'string[]'}`
+- **Output schema:** `{'repository_name': 'string', 'solution_architecture_guide': 'string'}`
+- **Acceptance criteria:** (none)
+- **Success conditions:** (none)
+
+## Step 4: Verify that the gcp_solution_architecture_agent repository contains the packaged solution-architecture-guide.md with the approved workflow outputs.
+
+- **Capability:** Confirm repository delivery of the complete solution architecture guide.
+- **Plan label:** gap
+- **Reusable capability:** False
+- **Rationale:** (none recorded)
+- **Input schema:** `{'repository_name': 'string', 'solution_architecture_guide': 'string'}`
+- **Output schema:** `{'repository_name': 'string', 'guide_path': 'string', 'guide_content': 'string', 'guide_persisted': 'boolean'}`
+- **Acceptance criteria:** (none)
+- **Success conditions:** (none)
+
+## Step 5: Verify that the repository is derived from the workflow_agent template and implements the complete four-phase Google Cloud solution architecture workflow alongside the packaged guide.
+
+- **Capability:** Inspect repository structure and workflow configuration to confirm template conformance, phase coverage, and delivery of the required architecture artifacts.
+- **Plan label:** gap
+- **Reusable capability:** False
+- **Rationale:** (none recorded)
+- **Input schema:** `{'repository_name': 'string', 'guide_path': 'string', 'guide_content': 'string', 'guide_persisted': 'boolean'}`
+- **Output schema:** `{'repository_name': 'string', 'guide_path': 'string', 'guide_persisted': 'boolean', 'template_conformance_valid': 'boolean', 'phase_coverage_valid': 'boolean', 'required_artifacts_present': 'boolean', 'verification_findings': 'string[]'}`
+- **Acceptance criteria:** (none)
+- **Success conditions:** (none)
+
+## Step 6: Publish the verified gcp_solution_architecture_agent repository with its completed workflow implementation and solution architecture guide.
+
+- **Capability:** Persist and publish the verified repository contents to the configured source-control remote.
+- **Plan label:** gap
+- **Reusable capability:** False
+- **Rationale:** (none recorded)
+- **Input schema:** `{'repository_name': 'string', 'guide_path': 'string', 'guide_persisted': 'boolean', 'template_conformance_valid': 'boolean', 'phase_coverage_valid': 'boolean', 'required_artifacts_present': 'boolean', 'verification_findings': 'string[]'}`
+- **Output schema:** `{'repository_name': 'string', 'published': 'boolean', 'published_revision': 'string', 'publication_findings': 'string[]'}`
+- **Acceptance criteria:** (none)
+- **Success conditions:** (none)
+
+## Step 7: Verify that the published repository revision contains the completed workflow implementation and solution architecture guide.
+
+- **Capability:** Confirm the remote publication matches the verified repository contents at the reported revision.
+- **Plan label:** gap
+- **Reusable capability:** False
+- **Rationale:** (none recorded)
+- **Input schema:** `{'repository_name': 'string', 'published': 'boolean', 'published_revision': 'string', 'publication_findings': 'string[]'}`
+- **Output schema:** `{'repository_name': 'string', 'published_revision': 'string', 'remote_revision_verified': 'boolean', 'published_content_verified': 'boolean', 'verification_findings': 'string[]'}`
+- **Acceptance criteria:** (none)
+- **Success conditions:** (none)
diff --git a/.agents/plans/wf-decompose-65ea49fc2d04/MAP.md b/.agents/plans/wf-decompose-65ea49fc2d04/MAP.md
new file mode 100644
index 0000000..5364cd8
--- /dev/null
+++ b/.agents/plans/wf-decompose-65ea49fc2d04/MAP.md
@@ -0,0 +1,27 @@
+# Plan Map
+
+**Workflow:** wf-decompose-65ea49fc2d04
+**Intent:** Build a KAB Workflow Agent repository named gcp_solution_architecture_agent using the workflow_agent template from https://gitea.kyndemo.live/agents/workflow_agent to implement the 4-phase Google Cloud Solution Architecture workflow (Phase 1: Requirements Discovery for functional and non-functional requirements without premature product selection; Phase 2: Solution Architecture including product selection, Mermaid architecture diagram generation, architecture description, and Terraform IaC; Phase 3: Pre-deployment dry-run validation; Phase 4: Solution packaging into solution-architecture-guide.md). The deliverable repository name is gcp_solution_architecture_agent.
+**This repo covers:** step 0, step 1, step 2, step 3, step 4, step 5, step 6, step 7
+
+## Dependency graph
+
+- Step 0: no dependencies
+- Step 1: depends on step 0
+- Step 2: depends on step 0, step 1
+- Step 3: depends on step 0, step 1, step 2
+- Step 4: depends on step 0, step 1, step 2, step 3
+- Step 5: depends on step 0, step 1, step 2, step 3, step 4
+- Step 6: depends on step 0, step 1, step 2, step 3, step 4, step 5
+- Step 7: depends on step 0, step 1, step 2, step 3, step 4, step 5, step 6
+
+## Phase table
+
+Phase 1: step 0
+Phase 2: step 1
+Phase 3: step 2
+Phase 4: step 3
+Phase 5: step 4
+Phase 6: step 5
+Phase 7: step 6
+Phase 8: step 7
diff --git a/README.md b/README.md
index 0cbee39..3edd56d 100644
--- a/README.md
+++ b/README.md
@@ -1,3 +1,21 @@
-# gcp_solution_architecture_agent
+# GCP Solution Architecture Agent
 
-Generated deliverable: gcp_solution_architecture_agent
\ No newline at end of file
+A four-phase workflow deliverable for a resilient, event-driven Google Cloud reference architecture.
+
+## Workflow
+
+1. **Discover** — capture functional and non-functional requirements without choosing products.
+2. **Architect** — map confirmed requirements to Google Cloud products and produce Mermaid plus Terraform.
+3. **Validate** — run formatting, Terraform validation, and a no-apply plan check.
+4. **Package** — publish the approved artifacts and verification record in `solution-architecture-guide.md`.
+
+The repository is derived from the `workflow_agent` template and keeps product selection out of discovery until requirements are recorded.
+
+## Local checks
+
+```bash
+python3 -m unittest discover -s tests -v
+./scripts/validate.sh
+```
+
+`validate.sh` requires Terraform 1.6.x and Google provider 6.x; it never applies resources. Set `TF_VAR_project_id` to run Terraform checks.
diff --git a/architecture.md b/architecture.md
new file mode 100644
index 0000000..92f56ac
--- /dev/null
+++ b/architecture.md
@@ -0,0 +1,7 @@
+# Architecture description
+
+The design is a regional, event-driven ingestion path. An authenticated producer calls a Cloud Run service. The service performs lightweight schema validation, writes the original payload to a retained Cloud Storage bucket, and publishes an event envelope to Pub/Sub. A separate Cloud Run worker consumes the subscription and invokes downstream systems. At-least-once delivery is intentional: the worker must use an event ID as an idempotency key and acknowledge only after durable processing.
+
+Cloud Run provides independently scalable HTTPS ingress and worker execution without managing servers. Pub/Sub separates producer latency from consumer capacity and provides retry behavior. Cloud Storage is the replay and audit boundary, with uniform bucket-level access and a lifecycle rule. Artifact Registry is the controlled source for externally built container images. Cloud Logging and Cloud Monitoring provide centralized operational signals; alert policies can be added when SLO thresholds are agreed.
+
+The Terraform is intentionally limited to foundational infrastructure and a placeholder Cloud Run revision whose image is supplied by `var.container_image`. It does not build an image, configure application code, or apply resources. The project must already exist, and APIs are enabled by Terraform. Production should add customer-managed encryption keys, private egress controls, organization policies, and an explicit disaster-recovery strategy after the open questions are answered.
diff --git a/architecture.mmd b/architecture.mmd
new file mode 100644
index 0000000..c98e223
--- /dev/null
+++ b/architecture.mmd
@@ -0,0 +1,13 @@
+flowchart LR
+  Client[Authenticated producer] --> API[Cloud Run ingress]
+  API --> Topic[Pub/Sub topic]
+  Topic --> Sub[Pub/Sub subscription]
+  Sub --> Worker[Cloud Run worker]
+  API --> Raw[(Cloud Storage raw-event bucket)]
+  Worker --> Raw
+  Worker --> Downstream[External downstream systems]
+  API --> Logs[Cloud Logging]
+  Worker --> Logs
+  Logs --> Monitor[Cloud Monitoring]
+  API -. IAM .-> Identity[Dedicated runtime service account]
+  Worker -. IAM .-> Identity
diff --git a/requirements.yaml b/requirements.yaml
new file mode 100644
index 0000000..d9a2dbe
--- /dev/null
+++ b/requirements.yaml
@@ -0,0 +1,31 @@
+repository_name: gcp_solution_architecture_agent
+template_url: https://github.com/GoogleCloudPlatform/workflow_agent
+product_selection_deferred: true
+functional_requirements:
+  - Accept authenticated HTTPS requests containing an event payload.
+  - Validate, durably enqueue, and asynchronously process accepted events.
+  - Persist raw event records for replay and audit.
+  - Expose an operational health endpoint and structured application logs.
+  - Support separate development and production environments through variables.
+non_functional_requirements:
+  - Target at-least-once delivery with idempotent consumers.
+  - Provide regional high availability for managed serving and messaging components.
+  - Encrypt data in transit and at rest using managed encryption by default.
+  - Scale ingestion and processing independently based on request and backlog load.
+  - Retain audit data for 30 days by default and make retention configurable.
+  - Apply least-privilege service identities and observable failure handling.
+constraints:
+  - Deploy only into an existing Google Cloud project supplied by the operator.
+  - Terraform must be planable without provisioning resources.
+  - No application container image is built or deployed by this repository.
+  - Product selection is explicitly deferred during discovery and recorded afterward.
+assumptions:
+  - The workload is regional and an initial single-region deployment is acceptable.
+  - A container image is supplied by an external CI/CD pipeline.
+  - The runtime can use OIDC/IAM authentication and publish to messaging.
+  - Event consumers are idempotent and tolerate duplicate delivery.
+open_questions:
+  - What are the peak requests per second and payload size limits?
+  - Which region, compliance boundary, and customer-managed key policy apply?
+  - What downstream systems receive processed events?
+  - What SLO, alert thresholds, and on-call escalation policy are required?
diff --git a/scripts/validate.sh b/scripts/validate.sh
new file mode 100644
index 0000000..a6c6375
--- /dev/null
+++ b/scripts/validate.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+command -v terraform >/dev/null || { echo "Terraform 1.6.x is required" >&2; exit 1; }
+terraform -chdir=terraform fmt -check -diff
+terraform -chdir=terraform init -backend=false -input=false
+terraform -chdir=terraform validate
+if [[ -z "${TF_VAR_project_id:-}" || -z "${TF_VAR_invoker_service_account:-}" ]]; then
+  echo "Set TF_VAR_project_id and TF_VAR_invoker_service_account for plan check" >&2
+  exit 2
+fi
+terraform -chdir=terraform plan -refresh=false -input=false -lock=false -out=/tmp/gcp-solution.tfplan >/tmp/gcp-solution.plan
+cat /tmp/gcp-solution.plan
diff --git a/solution-architecture-guide.md b/solution-architecture-guide.md
new file mode 100644
index 0000000..5f01996
--- /dev/null
+++ b/solution-architecture-guide.md
@@ -0,0 +1,95 @@
+# Google Cloud Solution Architecture Guide
+
+## Delivery status
+
+This guide packages the approved discovery record, product architecture, diagram, Terraform, and pre-deployment validation procedure for `gcp_solution_architecture_agent`. It is a plan-only deliverable; it does not provision Google Cloud resources.
+
+## 1. Requirements discovery (product selection deferred)
+
+### Functional requirements
+
+- Accept authenticated HTTPS event requests.
+- Validate, durably enqueue, and asynchronously process events.
+- Persist raw events for replay and audit.
+- Expose health and structured logs.
+- Support environment-specific configuration.
+
+### Non-functional requirements
+
+- At-least-once delivery with idempotent consumers.
+- Regional high availability and independent scaling.
+- Encryption in transit and at rest.
+- 30-day configurable audit retention.
+- Least privilege and observable failures.
+
+### Constraints and assumptions
+
+The deployment targets an existing project, uses Terraform without apply, and receives its container image from external CI/CD. The workload is initially regional; the worker tolerates duplicates; product selection was deferred during discovery.
+
+### Open questions
+
+Peak throughput and payload size, region/compliance and key policy, downstream destinations, and SLO/on-call thresholds remain to be confirmed before production hardening.
+
+## 2. Selected Google Cloud products
+
+- **Cloud Run**: authenticated HTTPS ingress and independently scalable worker runtime.
+- **Pub/Sub**: durable asynchronous event transport and retry policy.
+- **Cloud Storage**: retained raw-event replay and audit store.
+- **Artifact Registry**: controlled container image repository.
+- **Cloud Logging and Cloud Monitoring APIs**: operational telemetry foundation.
+- **IAM/service accounts**: workload identity and least-privilege boundary.
+
+## 3. Architecture diagram
+
+```mermaid
+flowchart LR
+  Client[Authenticated producer] --> API[Cloud Run ingress]
+  API --> Topic[Pub/Sub topic]
+  Topic --> Sub[Pub/Sub subscription]
+  Sub --> Worker[Cloud Run worker]
+  API --> Raw[(Cloud Storage raw-event bucket)]
+  Worker --> Raw
+  Worker --> Downstream[External downstream systems]
+  API --> Logs[Cloud Logging]
+  Worker --> Logs
+  Logs --> Monitor[Cloud Monitoring]
+  API -. IAM .-> Identity[Dedicated runtime service account]
+  Worker -. IAM .-> Identity
+```
+
+## 4. Architecture description
+
+The ingress service validates a request, writes the original event to the retained bucket, and publishes an envelope. The worker acknowledges only after downstream processing succeeds. Event IDs are idempotency keys, so redelivery is safe. Cloud Run removes server management, Pub/Sub absorbs bursts, and Cloud Storage supplies replay. The Terraform creates APIs, identities, storage, messaging, an image repository, and a placeholder ingress service. Application behavior and image construction remain outside scope.
+
+## 5. Infrastructure as code
+
+The complete deployable Terraform is in `terraform/`:
+
+- `main.tf` pins Google provider 6.x and creates the foundational resources.
+- `variables.tf` makes project, region, environment, image, identity, retention, and scaling explicit.
+- `outputs.tf` publishes the endpoint, bucket, and topic.
+- `terraform.tfvars.example` documents required inputs.
+
+Apply is intentionally not part of this repository's workflow.
+
+## 6. Validation and findings
+
+The repository provides `scripts/validate.sh`, which runs:
+
+1. `terraform fmt -check -diff`
+2. `terraform init -backend=false -input=false`
+3. `terraform validate`
+4. `terraform plan -refresh=false -input=false -lock=false` when required variables are supplied
+
+The plan is saved only to `/tmp` and no resources are applied. The checked-in validation record marks execution as pending because this packaging environment does not claim access to Terraform or a Google Cloud project. Run the script in CI with Terraform 1.6.x, a pinned provider lock file generated by CI, and non-production plan credentials.
+
+## 7. Verification record
+
+- Guide persisted at `solution-architecture-guide.md`: yes.
+- Template/workflow configuration: `workflow.yaml` declares all four phases and the source template.
+- Required artifacts: requirements, architecture description, Mermaid diagram, Terraform, validation procedure, and this guide are present.
+- Publication: repository publication is performed by the repository automation after review.
+
+## 8. Production follow-up
+
+Resolve the open questions, add explicit Pub/Sub-to-worker subscription IAM and dead-letter policy, decide whether customer-managed keys and private networking are mandatory, add SLO-based alert policies, and perform a security review before production use.
diff --git a/terraform/main.tf b/terraform/main.tf
new file mode 100644
index 0000000..7553718
--- /dev/null
+++ b/terraform/main.tf
@@ -0,0 +1,95 @@
+terraform {
+  required_version = ">= 1.6.0, < 2.0.0"
+  required_providers {
+    google = {
+      source  = "hashicorp/google"
+      version = "~> 6.0"
+    }
+  }
+}
+
+provider "google" {
+  project = var.project_id
+  region  = var.region
+}
+
+resource "google_project_service" "services" {
+  for_each = toset([
+    "artifactregistry.googleapis.com",
+    "logging.googleapis.com",
+    "monitoring.googleapis.com",
+    "pubsub.googleapis.com",
+    "run.googleapis.com",
+    "storage.googleapis.com",
+  ])
+  project            = var.project_id
+  service            = each.value
+  disable_on_destroy = false
+}
+
+resource "google_service_account" "runtime" {
+  account_id   = "event-runtime"
+  display_name = "Event runtime identity"
+  depends_on   = [google_project_service.services]
+}
+
+resource "google_storage_bucket" "raw_events" {
+  name                        = "${var.project_id}-${var.environment}-raw-events"
+  location                    = var.region
+  storage_class               = "STANDARD"
+  uniform_bucket_level_access = true
+  force_destroy               = false
+  retention_policy { retention_period = var.retention_seconds }
+  lifecycle_rule {
+    condition { age = var.retention_days }
+    action { type = "Delete" }
+  }
+  versioning { enabled = true }
+  depends_on = [google_project_service.services]
+}
+
+resource "google_pubsub_topic" "events" {
+  name       = "${var.environment}-events"
+  depends_on = [google_project_service.services]
+}
+
+resource "google_pubsub_subscription" "events" {
+  name                       = "${var.environment}-event-worker"
+  topic                      = google_pubsub_topic.events.id
+  ack_deadline_seconds       = 60
+  message_retention_duration = "604800s"
+  retry_policy {
+    minimum_backoff = "10s"
+    maximum_backoff = "600s"
+  }
+}
+
+resource "google_artifact_registry_repository" "containers" {
+  location      = var.region
+  repository_id = "${var.environment}-containers"
+  format        = "DOCKER"
+  depends_on    = [google_project_service.services]
+}
+
+resource "google_cloud_run_v2_service" "ingress" {
+  name     = "${var.environment}-event-ingress"
+  location = var.region
+  ingress  = "INGRESS_TRAFFIC_ALL"
+  template {
+    service_account = google_service_account.runtime.email
+    scaling { max_instance_count = var.max_instances }
+    containers {
+      image = var.container_image
+      env { name = "EVENT_TOPIC" value = google_pubsub_topic.events.id }
+      env { name = "RAW_BUCKET" value = google_storage_bucket.raw_events.name }
+    }
+  }
+  depends_on = [google_project_service.services]
+}
+
+resource "google_cloud_run_v2_service_iam_member" "ingress_invoker" {
+  name     = google_cloud_run_v2_service.ingress.name
+  location = google_cloud_run_v2_service.ingress.location
+  role     = "roles/run.invoker"
+  member   = "serviceAccount:${var.invoker_service_account}"
+}
diff --git a/terraform/outputs.tf b/terraform/outputs.tf
new file mode 100644
index 0000000..2b923ba
--- /dev/null
+++ b/terraform/outputs.tf
@@ -0,0 +1,7 @@
+output "ingress_url" {
+  value       = google_cloud_run_v2_service.ingress.uri
+  description = "HTTPS endpoint for authenticated producers."
+}
+
+output "raw_events_bucket" { value = google_storage_bucket.raw_events.name }
+output "events_topic" { value = google_pubsub_topic.events.name }
diff --git a/terraform/terraform.tfvars.example b/terraform/terraform.tfvars.example
new file mode 100644
index 0000000..ff591ac
--- /dev/null
+++ b/terraform/terraform.tfvars.example
@@ -0,0 +1,5 @@
+project_id               = "replace-with-existing-project"
+region                   = "us-central1"
+environment              = "dev"
+invoker_service_account  = "producer@example.iam.gserviceaccount.com"
+container_image          = "us-central1-docker.pkg.dev/replace-with-existing-project/dev-containers/ingress: approved-tag"
diff --git a/terraform/variables.tf b/terraform/variables.tf
new file mode 100644
index 0000000..c93e98e
--- /dev/null
+++ b/terraform/variables.tf
@@ -0,0 +1,32 @@
+variable "project_id" {
+  description = "Existing Google Cloud project ID."
+  type        = string
+  validation { condition = length(var.project_id) > 0 error_message = "project_id must not be empty." }
+}
+
+variable "region" {
+  description = "Regional placement for runtime and data."
+  type        = string
+  default     = "us-central1"
+}
+
+variable "environment" {
+  description = "Environment name used in resource names."
+  type        = string
+  default     = "dev"
+}
+
+variable "container_image" {
+  description = "Externally built image used by Cloud Run."
+  type        = string
+  default     = "us-docker.pkg.dev/cloudrun/container/hello"
+}
+
+variable "invoker_service_account" {
+  description = "Producer identity allowed to invoke ingress."
+  type        = string
+}
+
+variable "retention_days" { type = number default = 30 }
+variable "retention_seconds" { type = number default = 2592000 }
+variable "max_instances" { type = number default = 20 }
diff --git a/tests/test_artifacts.py b/tests/test_artifacts.py
new file mode 100644
index 0000000..893fd14
--- /dev/null
+++ b/tests/test_artifacts.py
@@ -0,0 +1,22 @@
+import pathlib
+import unittest
+
+ROOT = pathlib.Path(__file__).parents[1]
+
+
+class ArtifactTests(unittest.TestCase):
+    def test_required_artifacts_exist(self):
+        for path in ["requirements.yaml", "architecture.mmd", "architecture.md", "workflow.yaml", "solution-architecture-guide.md"]:
+            self.assertTrue((ROOT / path).is_file(), path)
+
+    def test_product_selection_is_deferred_in_discovery_record(self):
+        text = (ROOT / "requirements.yaml").read_text()
+        self.assertIn("product_selection_deferred: true", text)
+
+    def test_terraform_has_no_apply_command(self):
+        text = (ROOT / "scripts/validate.sh").read_text()
+        self.assertNotIn("terraform apply", text)
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/validation-results.json b/validation-results.json
new file mode 100644
index 0000000..b4159aa
--- /dev/null
+++ b/validation-results.json
@@ -0,0 +1,9 @@
+{
+  "terraform_format_valid": "pending local execution",
+  "terraform_validation_valid": "pending local execution",
+  "dry_run_valid": "pending local execution",
+  "validation_findings": [
+    "The repository contains a no-apply validation script.",
+    "Execution requires Terraform 1.6.x and operator-supplied project and invoker variables; no cloud resources are provisioned by this deliverable."
+  ]
+}
diff --git a/workflow.yaml b/workflow.yaml
new file mode 100644
index 0000000..e966e05
--- /dev/null
+++ b/workflow.yaml
@@ -0,0 +1,18 @@
+name: gcp-solution-architecture
+version: 1
+source_template: https://github.com/GoogleCloudPlatform/workflow_agent
+phases:
+  - id: discover
+    input: workflow_request
+    output: requirements.yaml
+    product_selection_deferred: true
+  - id: architect
+    input: requirements.yaml
+    output: [architecture.mmd, architecture.md, terraform]
+  - id: validate
+    input: [architecture.mmd, architecture.md, terraform]
+    output: validation-results.json
+    deploy_resources: false
+  - id: package
+    input: [requirements.yaml, architecture.md, architecture.mmd, terraform, validation-results.json]
+    output: solution-architecture-guide.md