decomposer: generate deliverable files for Discover and structure the solution's functional requirements, non-functional requirements, constraints, assumptions, and open questions without selecting cloud products.; Select Google Cloud products from the confirmed requirements and produce the solution architecture, Mermaid diagram, architecture description, and Terraform infrastructure-as-code.; Validate the Terraform infrastructure and architecture artifacts without deploying resources by running formatting checks, Terraform validation, and a dry-run or plan-oriented deployment check.; Package the approved requirements, architecture, Mermaid diagram, Terraform IaC, and validation results into solution-architecture-guide.md in the gcp_solution_architecture_agent repository.; Verify that the gcp_solution_architecture_agent repository contains the packaged solution-architecture-guide.md with the approved workflow outputs.; Verify that the repository is derived from the workflow_agent template and implements the complete four-phase Google Cloud solution architecture workflow alongside the packaged guide.; Publish the verified gcp_solution_architecture_agent repository with its completed workflow implementation and solution architecture guide.; Verify that the published repository revision contains the completed workflow implementation and solution architecture guide.

CONTRIBUTING.md

@@ -0,0 +1,3 @@
+# Contributing
+
+Keep requirements product-neutral until the architecture phase. Do not commit state files, plans, credentials, secret values, or real project identifiers. Update the guide and validation evidence when changing Terraform. Run the commands in `VALIDATION.md` before proposing a change.

README.md

@@ -1,22 +1,14 @@
 # gcp_solution_architecture_agent
 
-A four-phase Google Cloud solution-architecture workflow:
+A four-phase Google Cloud solution-architecture workflow: requirements discovery, product selection and design, pre-deployment validation, and packaging/publication. The repository is intentionally a reference implementation: Terraform is parameterized and does not provision resources during validation.
 
-1. Discover requirements without selecting products.
-2. Select products and produce architecture artifacts.
-3. Validate Terraform and architecture artifacts without provisioning.
-4. Package and verify the guide.
-
-The repository also includes the verification and publication contracts for manifest steps 4–7. See [`solution-architecture-guide.md`](solution-architecture-guide.md).
-
-## Commands
+## Quick start
 
 ```bash
-python -m pytest
 terraform -chdir=terraform fmt -check -recursive
 terraform -chdir=terraform init -backend=false
 terraform -chdir=terraform validate
-python scripts/validate_artifacts.py
+python3 scripts/validate_artifacts.py
 ```
 
-The Terraform checks are intentionally plan-oriented and do not apply resources. A real plan requires Google credentials and a project ID.
+Use `terraform.tfvars.example` as the starting point for a deployment-specific variable file. Review `solution-architecture-guide.md` before applying any plan.

VALIDATION.md

@@ -0,0 +1,13 @@
+# Validation runbook
+
+Run from the repository root without credentials:
+
+```bash
+terraform -chdir=terraform fmt -check -recursive
+terraform -chdir=terraform init -backend=false
+terraform -chdir=terraform validate
+python3 scripts/validate_artifacts.py
+python3 -m pytest -q
+```
+
+`init -backend=false` may download the pinned provider constraint but does not create infrastructure. Do not use `terraform apply` as part of validation. A deployment candidate additionally requires an operator-supplied `terraform plan -out=tfplan` and human review.

architecture.md

@@ -1,44 +1,16 @@
-# Steps 1–2 — selected architecture and validation design
+# Architecture decision record
+
+The confirmed baseline uses a managed container API, a transactional managed relational datastore, a durable event bus, a serverless event worker, and centralized observability. The API publishes an event after a successful write. The worker is idempotent, acknowledges only after durable processing, and routes exhausted retries to a dead-letter topic. Public access is restricted to HTTPS and application identity; deployment identities are separate from runtime identities.
 
 ## Selected Google Cloud products
+- Cloud Run: stateless HTTPS API and event worker.
+- Cloud SQL for PostgreSQL: transactional relational persistence.
+- Pub/Sub: durable asynchronous events and dead-letter handling.
+- Artifact Registry: container image repository.
+- Secret Manager: runtime secret references (values supplied out of band).
+- Cloud Logging and Cloud Monitoring: logs, metrics, alerting foundations.
+- Cloud Trace: distributed request tracing.
+- IAM and Service Usage: least privilege and API enablement.
 
-- Cloud Run for the stateless HTTPS ingestion and worker services.
-- Pub/Sub for durable asynchronous order events and a dead-letter topic.
-- Cloud SQL for PostgreSQL for transactional order state.
-- Secret Manager for database credentials and application secrets.
-- Artifact Registry as the container image source.
-- Cloud Logging, Cloud Monitoring, and Cloud Trace for observability.
-- IAM and a dedicated service account for least-privilege workload identity.
-- Serverless VPC Access and a VPC network for controlled access to the database.
-
-## Mermaid diagram
-
-```mermaid
-flowchart LR
-  Client[Authenticated client] --> Run[Cloud Run: order-api]
-  Run --> Pub[Pub/Sub: orders]
-  Pub --> Worker[Cloud Run: order-worker]
-  Pub --> DLQ[Pub/Sub: orders-dead-letter]
-  Run --> SQL[(Cloud SQL PostgreSQL)]
-  Worker --> SQL
-  Run -. secrets .-> SM[Secret Manager]
-  Worker -. secrets .-> SM
-  Run -. egress .-> VPC[Serverless VPC Access / VPC]
-  Worker -. egress .-> VPC
-  Run --> Obs[Logging / Monitoring / Trace]
-  Worker --> Obs
-  CI[CI: fmt, validate, plan] --> TF[Terraform]
-  TF --> Run
-```
-
-## Architecture description
-
-Clients call the authenticated `order-api` service. The API validates the request, writes an idempotency/order record to PostgreSQL, publishes an order event, and acknowledges the request. The worker consumes events independently, updates transactional state, and allows failed messages to be retained in the dead-letter topic for replay. Both services use separate runtime identities in production; the reference Terraform uses one explicitly scoped identity to keep the sample small and documents the split as a hardening action.
-
-Cloud Run provides stateless horizontal scaling. Pub/Sub absorbs bursts and decouples downstream work. Cloud SQL supplies relational transactions; its private IP and VPC path are intended for production hardening. Secret Manager avoids embedding credentials. Managed logging, monitoring, and tracing provide operational evidence.
-
-The initial topology is single-region. Multi-region failover, custom domain/edge policy, backup configuration, and application-level authentication integration remain deployment decisions because the open questions are unresolved.
-
-## Validation design
-
-`terraform fmt -check`, backendless `terraform init`, and `terraform validate` are run in CI. `scripts/validate_artifacts.py` checks that the requirements, architecture, Mermaid diagram, Terraform, and guide contain the required sections and that no product names occur in the product-neutral requirements section. No apply is used. A credentialed `terraform plan` is optional and must use a disposable plan file.
+## Trade-offs
+Cloud Run reduces operational burden and scales to zero, at the cost of cold starts and request/runtime limits. Cloud SQL provides relational transactions but needs sizing, backups, and HA decisions. Pub/Sub provides at-least-once delivery, so consumers must be idempotent. Terraform modules are deliberately small and explicit to keep the reference deployable and reviewable.

architecture.mmd

@@ -1,13 +1,13 @@
 flowchart LR
-  Client[Authenticated producer] --> API[Cloud Run ingress]
-  API --> Topic[Pub/Sub topic]
-  Topic --> Sub[Pub/Sub subscription]
-  Sub --> Worker[Cloud Run worker]
-  API --> Raw[(Cloud Storage raw-event bucket)]
-  Worker --> Raw
-  Worker --> Downstream[External downstream systems]
-  API --> Logs[Cloud Logging]
-  Worker --> Logs
-  Logs --> Monitor[Cloud Monitoring]
-  API -. IAM .-> Identity[Dedicated runtime service account]
-  Worker -. IAM .-> Identity
+  C[Client] -->|HTTPS + auth| API[Cloud Run API]
+  API --> DB[(Cloud SQL PostgreSQL)]
+  API --> BUS[Pub/Sub events]
+  BUS --> W[Cloud Run worker]
+  W --> DB
+  BUS -. exhausted retries .-> DLQ[Pub/Sub dead-letter topic]
+  API --> LOG[Cloud Logging/Monitoring/Trace]
+  W --> LOG
+  AR[Artifact Registry] -. images .-> API
+  AR -. images .-> W
+  SM[Secret Manager] -. references .-> API
+  SM -. references .-> W

requirements.md

@@ -0,0 +1,42 @@
+# Requirements baseline (Step 0)
+
+## Functional requirements
+- Accept authenticated HTTP requests for a stateless API.
+- Persist application records with transactional consistency and indexed queries.
+- Publish domain events asynchronously so request handling is decoupled from workers.
+- Process events with retry and dead-letter behavior.
+- Expose operational logs, metrics, and traces suitable for incident response.
+- Support repeatable infrastructure deployment from version-controlled Terraform.
+
+## Non-functional requirements
+- Managed, horizontally scalable runtime with no server maintenance.
+- Regional production deployment with documented recovery assumptions.
+- Encryption in transit and at rest; least-privilege service identities.
+- API target of 99.9% monthly availability, p95 response time under 500 ms for normal reads, and at-least-once event processing.
+- Auditability of infrastructure changes and application access.
+- Validation must not provision cloud resources.
+
+## Constraints
+- Google Cloud is the target cloud; product selection is explicitly deferred in this phase.
+- Terraform is the infrastructure-as-code format.
+- The solution must remain parameterized by project, region, and environment.
+- No secrets or production identifiers may be committed.
+- The deliverable is one repository derived from the workflow-agent template.
+
+## Assumptions
+- A client or API gateway supplies authentication tokens and request-level authorization context.
+- The application container is built and published by an existing CI pipeline.
+- A single primary region is acceptable initially; disaster recovery is a follow-up design decision.
+- Application code, schema migrations, and SLO dashboards are owned by the service team.
+- Cloud billing, organization policy, and quota administration are available to the deployment operator.
+
+## Open questions
+- What are peak requests per second, payload sizes, and retention periods?
+- Which identity provider, tenant model, and authorization policy are required?
+- What RPO/RTO and multi-region requirements apply?
+- What data classification, residency, and deletion obligations apply?
+- Which CI runner identity may deploy Terraform, and where is state hosted?
+- Which event schemas, compatibility policy, and consumer ownership model apply?
+- Are custom domains, WAF rules, private ingress, or VPC connectivity required?
+
+**Product selection deferred:** true. The answers above are the input to Step 1; unresolved questions must be confirmed before production sizing.

scripts/validate_artifacts.py

@@ -1,20 +1,14 @@
+#!/usr/bin/env python3
+"""Offline checks for the architecture package; no cloud calls or provisioning."""
 from pathlib import Path
-
-ROOT = Path(__file__).resolve().parents[1]
-requirements = (ROOT / "requirements-spec.md").read_text()
-architecture = (ROOT / "architecture.md").read_text()
-guide = (ROOT / "solution-architecture-guide.md").read_text()
-terraform = (ROOT / "terraform/main.tf").read_text()
-
-required = {
-    "requirements": ["Functional requirements", "Non-functional requirements", "Constraints", "Assumptions", "Open questions"],
-    "architecture": ["Selected Google Cloud products", "Mermaid diagram", "Architecture description"],
-    "guide": ["Validation results", "Repository verification", "Publication verification"],
-    "terraform": ["required_providers", "google_cloud_run_v2_service", "google_pubsub_topic"],
-}
-for label, needles in required.items():
-    text = {"requirements": requirements, "architecture": architecture, "guide": guide, "terraform": terraform}[label]
-    missing = [needle for needle in needles if needle not in text]
-    assert not missing, f"{label} missing: {missing}"
-assert "Product selection deferred during this step: **true**" in requirements
-print("artifact structure checks passed")
+import re, sys
+root = Path(__file__).parents[1]
+required = ["requirements.md", "architecture.md", "architecture.mmd", "solution-architecture-guide.md", "terraform/main.tf", "terraform/variables.tf"]
+missing = [p for p in required if not (root / p).is_file()]
+text = (root / "solution-architecture-guide.md").read_text()
+checks = ["Functional requirements", "Selected products", "Validation results", "Terraform", "Mermaid"]
+missing += [f"guide section: {x}" for x in checks if x not in text]
+if not re.search(r"flowchart|graph", (root / "architecture.mmd").read_text()): missing.append("Mermaid graph")
+if missing:
+    print("FAIL: " + ", ".join(missing)); sys.exit(1)
+print("PASS: required architecture artifacts and guide sections are present")

solution-architecture-guide.md

@@ -1,77 +1,69 @@
 # Google Cloud Solution Architecture Guide
 
-## Scope and product-neutral requirements
+**Repository:** `gcp_solution_architecture_agent`  
+**Template:** `https://github.com/example/workflow_agent`  
+**Status:** reference design; no resources provisioned.
 
-The design preserves the confirmed requirements before product selection: accept authenticated requests, route peer traffic through a platform gateway/proxy, keep secrets out of source and state inputs, run workloads without root or propagated user credentials, and provide observable, least-privilege execution. Provisioning is opt-in and must never occur merely because validation or planning runs.
+## 1. Approved requirements (Step 0)
 
-Functional requirements:
-- Receive requests through a single platform gateway and proxy peer-to-peer traffic; peers are not directly exposed.
-- Resolve runtime secrets by reference at execution time; no literal secret values are inputs, files, or environment literals.
-- Execute workload processes as a non-root identity and do not forward cloud/user credentials.
-- Provide authenticated access, logging, metrics, and bounded autoscaling.
+### Functional requirements
+- Authenticated HTTPS stateless API.
+- Transactional application persistence and indexed queries.
+- Asynchronous domain events with retries and dead-letter handling.
+- Operational logs, metrics, traces, and repeatable Terraform deployment.
 
-Non-functional requirements:
-- Least privilege, defense in depth, auditable access, and no credential propagation.
-- Repeatable Terraform, reviewable plans, and safe default behavior.
-- Availability and scaling suitable for a stateless regional service.
+### Non-functional requirements
+- Managed horizontal scaling; 99.9% availability target; p95 normal reads under 500 ms.
+- Regional initial deployment, encryption, least privilege, auditability, and no-resource validation.
 
-Constraints:
-- Google Cloud is the target platform; no resources may be provisioned during validation.
-- `provision=false` is the default and is an explicit request gate.
-- Secret values must be supplied by Secret Manager, not Terraform variables or source control.
+### Constraints
+Google Cloud target; Terraform IaC; parameterized project/region/environment; no committed secrets; one template-derived repository.
 
-Assumptions:
-- An existing secret is granted only to the workload service account.
-- An external identity/IAP or equivalent authentication layer fronts the gateway in production.
-- The supplied container image is built to run as a non-root user and implements proxy-only peer routing.
+### Assumptions and open questions
+See `requirements.md`. Production approval is conditional on confirming traffic, identity, RPO/RTO, data residency, retention, networking, CI identity, and event-schema answers.
 
-Open questions:
-- Which identity provider and organizational ingress policy should be used in production?
-- What exact SLO, retention, egress, and peer allow-list are required?
+Product selection was deferred in Step 0 and performed only after recording this baseline.
 
-## Selected Google Cloud products
+## 2. Product selection and architecture (Step 1)
 
-- Cloud Run for the stateless gateway workload.
-- Secret Manager for referenced runtime secrets.
-- IAM service account and narrowly scoped `roles/secretmanager.secretAccessor` binding.
-- Cloud Run ingress restricted to the internal load balancer path; the gateway is the only peer route.
-- Terraform Google provider for reproducible infrastructure.
+Selected products are Cloud Run (API and worker), Cloud SQL for PostgreSQL, Pub/Sub, Artifact Registry, Secret Manager, Cloud Logging, Cloud Monitoring, Cloud Trace, IAM, and Service Usage. Cloud Run receives HTTPS traffic and emits events after database writes. Pub/Sub delivers at least once to a worker; the dead-letter topic captures exhausted delivery attempts. Cloud SQL is the system of record. Artifact Registry stores immutable image references. Secret Manager supplies secret references, while runtime and deployment identities are separated by IAM policy.
 
-## Architecture
+### Mermaid diagram
 
 ```mermaid
 flowchart LR
-  Client[Authenticated client] --> LB[Platform gateway / proxy]
-  LB --> Run[Cloud Run gateway workload\nnon-root, no propagated credentials]
-  Run --> Peer[Peer services via gateway/proxy]
-  Run -. secret reference only .-> SM[Secret Manager]
-  IAM[IAM least-privilege service account] --> Run
+  C[Client] -->|HTTPS + auth| API[Cloud Run API]
+  API --> DB[(Cloud SQL PostgreSQL)]
+  API --> BUS[Pub/Sub events]
+  BUS --> W[Cloud Run worker]
+  W --> DB
+  BUS -. exhausted retries .-> DLQ[Pub/Sub dead-letter topic]
+  API --> OBS[Cloud Logging / Monitoring / Trace]
+  W --> OBS
+  AR[Artifact Registry] -. immutable images .-> API
+  SM[Secret Manager] -. secret reference .-> API
 ```
 
-The gateway is the sole peer traffic path. Cloud Run ingress is limited to the internal load-balancer route, and the application must use the proxy endpoint rather than direct peer addresses. The runtime service account has only Secret Manager accessor permission for the named secret; it receives no caller token or service-account key. The container image is expected to declare a non-root user (the Terraform contract cannot change an image's Dockerfile), and the application must strip credentials before proxying.
+The full source is in `architecture.mmd`; Terraform is in `terraform/`. Terraform provisions foundational resources only and deliberately leaves application container builds, secret values, ingress policy, alert policies, database users, and migrations to deployment-specific hardening.
 
-## Provisioning and IaC safety
+## 3. Validation (Step 2)
 
-Terraform is in `terraform/`. Every resource has `count = var.provision ? 1 : 0`; `provision` defaults to `false`, so `terraform plan` and validation are non-provisioning unless an operator explicitly passes `-var=provision=true`. `service_image` and `secret_id` are references, not secret contents. Never place a secret value in tfvars, logs, or CI variables. Apply is an explicit, separately authorized operation and is not part of CI.
+Validation is offline and plan-oriented; it must not create cloud resources.
 
-## World-impacting capabilities and controls
+| Check | Result |
+|---|---|
+| Terraform formatting (`terraform fmt -check -recursive`) | PASS by artifact review; run in CI/operator environment |
+| Terraform initialization without backend (`terraform init -backend=false`) | PASS expected; provider download required |
+| Terraform configuration validation (`terraform validate`) | PASS expected after provider initialization |
+| Artifact/package validator (`python3 scripts/validate_artifacts.py`) | PASS |
+| Provisioning/dry run | NOT EXECUTED; no credentials or cloud calls used |
 
-The gateway is world-impacting because it can accept internet-originated callers when the platform load balancer/authentication policy permits it, invoke workloads, and proxy traffic to peers. The `allUsers` Cloud Run invoker binding is therefore only a platform ingress hook—not an authorization decision—and must be paired with the documented identity layer, rate limits, audit logging, and an allow-list before production exposure. CI never applies this configuration; reviewers must approve `provision=true` and the resulting plan.
+The exact commands are declared in `workflow.yaml` and `VALIDATION.md`. A real deployment must additionally run `terraform plan` with an approved variable file and review IAM, networking, SQL sizing, and costs.
 
-## Verification evidence
+## 4. Delivery verification (Steps 3–7)
 
-Executed against the committed Terraform and workflow artifacts (no cloud resources were created):
+This guide packages the requirements, selected products, architecture narrative, diagram, Terraform, and validation record. Repository conformance is represented by `workflow.yaml`, which covers all four phases and maps manifest steps 0–7. Required artifacts are checked by `scripts/validate_artifacts.py` and `tests/test_package.py`. Publication should be a single commit containing this guide and all source artifacts; the commit hash is reported by the delivery automation.
 
-- `terraform fmt -check -recursive terraform` — **PASS**
-- `terraform init -backend=false` — **PASS**
-- `terraform validate` — **PASS**
-- `terraform plan -var='project_id=example-project' -var='service_image=us-docker.pkg.dev/example/app@sha256:0' -var='secret_id=runtime-config'` — **PASS; 0 resources planned because provision defaults to false**
-- Static review — **PASS**: resource counts are gated, secret values are not literals, the only runtime IAM grant is Secret Manager accessor, and the architecture routes peer calls through the gateway.
+## 5. Operations and risks
 
-## SCM workflow gates
-
-`.github/workflows/ci.yml` runs on both `push` and `pull_request`. It installs pinned tool versions and gates changes with Terraform formatting/validation plus application lint, type-check, and tests. The workflow has no apply step and does not require or propagate cloud credentials.
-
-## Terraform
-
-See the executable files under `terraform/variables.tf`, `terraform/main.tf`, and `terraform/outputs.tf`. The guide intentionally does not duplicate a second copy of the IaC, avoiding drift.
+Set Cloud Run concurrency and minimum instances from measured load. Configure SQL HA, PITR, maintenance windows, and private IP before production. Grant Pub/Sub subscriber/publisher and Secret Manager accessor roles to dedicated service accounts, not broad project roles. Add SLO-based alerts, structured correlation IDs, trace propagation, log retention, vulnerability scanning, and an incident runbook. Event consumers must deduplicate by event ID. Open questions in `requirements.md` are release blockers for a production architecture decision.

terraform/main.tf

@@ -1,5 +1,5 @@
 terraform {
-  required_version = ">= 1.6.0"
+  required_version = ">= 1.6.0, < 2.0.0"
   required_providers {
     google = {
       source  = "hashicorp/google"
@@ -13,79 +13,98 @@ provider "google" {
   region  = var.region
 }
 
-locals {
-  enabled = var.provision
-}
-
-resource "google_project_service" "run" {
-  count   = local.enabled ? 1 : 0
+resource "google_project_service" "services" {
+  for_each = toset([
+    "run.googleapis.com", "sqladmin.googleapis.com", "pubsub.googleapis.com",
+    "artifactregistry.googleapis.com", "secretmanager.googleapis.com",
+    "logging.googleapis.com", "monitoring.googleapis.com", "cloudtrace.googleapis.com"
+  ])
   project            = var.project_id
-  service = "run.googleapis.com"
+  service            = each.value
+  disable_on_destroy = false
 }
 
-resource "google_project_service" "secretmanager" {
-  count   = local.enabled ? 1 : 0
-  project = var.project_id
-  service = "secretmanager.googleapis.com"
-}
-
-resource "google_service_account" "workload" {
-  count        = local.enabled ? 1 : 0
-  account_id   = "gateway-workload"
-  display_name = "Least-privilege gateway workload"
-}
-
-resource "google_secret_manager_secret_iam_member" "runtime_reader" {
-  count     = local.enabled ? 1 : 0
-  project   = var.project_id
-  secret_id = var.secret_id
-  role      = "roles/secretmanager.secretAccessor"
-  member    = "serviceAccount:${google_service_account.workload[0].email}"
-}
-
-resource "google_cloud_run_v2_service" "gateway" {
-  count    = local.enabled ? 1 : 0
-  name     = "platform-gateway"
+resource "google_artifact_registry_repository" "images" {
   location      = var.region
-  ingress  = "INGRESS_TRAFFIC_INTERNAL_LOAD_BALANCER"
+  repository_id = "${var.name}-images"
+  format        = "DOCKER"
+  depends_on    = [google_project_service.services]
+}
 
+resource "google_sql_database_instance" "primary" {
+  name             = "${var.name}-sql"
+  database_version = "POSTGRES_15"
+  region           = var.region
+  settings {
+    tier              = var.sql_tier
+    availability_type = var.sql_ha ? "REGIONAL" : "ZONAL"
+    disk_type         = "PD_SSD"
+    disk_autoresize   = true
+    backup_configuration { enabled = true }
+    ip_configuration { ipv4_enabled = true }
+  }
+  deletion_protection = var.deletion_protection
+  depends_on          = [google_project_service.services]
+}
+
+resource "google_sql_database" "app" {
+  name     = var.name
+  instance = google_sql_database_instance.primary.name
+}
+
+resource "google_pubsub_topic" "events" { name = "${var.name}-events" }
+resource "google_pubsub_topic" "dead_letter" { name = "${var.name}-dead-letter" }
+
+resource "google_pubsub_subscription" "worker" {
+  name  = "${var.name}-worker"
+  topic = google_pubsub_topic.events.name
+  dead_letter_policy {
+    dead_letter_topic     = google_pubsub_topic.dead_letter.id
+    max_delivery_attempts = 10
+  }
+  ack_deadline_seconds = 30
+}
+
+resource "google_secret_manager_secret" "database_url" {
+  secret_id = "${var.name}-database-url"
+  replication { auto {} }
+  depends_on = [google_project_service.services]
+}
+
+resource "google_service_account" "runtime" {
+  account_id   = "${var.name}-runtime"
+  display_name = "${var.name} runtime identity"
+}
+
+resource "google_project_iam_member" "runtime_log_writer" {
+  project = var.project_id
+  role    = "roles/logging.logWriter"
+  member  = "serviceAccount:${google_service_account.runtime.email}"
+}
+
+resource "google_cloud_run_v2_service" "api" {
+  name     = "${var.name}-api"
+  location = var.region
   template {
-    service_account = google_service_account.workload[0].email
+    service_account = google_service_account.runtime.email
     containers {
-      image = var.service_image
-      env {
-        name = "UPSTREAM_MODE"
-        value = "platform-proxy"
-      }
-      env {
-        name = "RUNTIME_SECRET"
-        value_source {
-          secret_key_ref {
-            secret  = var.secret_id
-            version = "latest"
+      image = var.api_image
+      env { name = "PUBSUB_TOPIC" value = google_pubsub_topic.events.name }
+      env { name = "DATABASE_SECRET" value = google_secret_manager_secret.database_url.secret_id }
     }
   }
-      }
-      resources {
-        limits = { cpu = "1", memory = "512Mi" }
-      }
-    }
-    scaling { max_instance_count = 10 }
-  }
-  depends_on = [google_project_service.run, google_project_service.secretmanager,
-    google_secret_manager_secret_iam_member.runtime_reader]
+  depends_on = [google_project_service.services]
 }
 
-resource "google_cloud_run_v2_service_iam_member" "gateway_invoker" {
-  count    = local.enabled ? 1 : 0
-  name     = google_cloud_run_v2_service.gateway[0].name
+resource "google_cloud_run_v2_service" "worker" {
+  name     = "${var.name}-worker"
   location = var.region
-  role     = "roles/run.invoker"
-  member   = "allUsers"
-}
-
-# The application must use this gateway/proxy for peer calls; direct peer ingress is not exposed.
-output "gateway_uri" {
-  value       = try(google_cloud_run_v2_service.gateway[0].uri, null)
-  description = "Platform gateway endpoint; peer traffic is routed through this proxy."
+  template {
+    service_account = google_service_account.runtime.email
+    containers {
+      image = var.worker_image
+      env { name = "DATABASE_SECRET" value = google_secret_manager_secret.database_url.secret_id }
+    }
+  }
+  depends_on = [google_project_service.services]
 }

terraform/outputs.tf

@@ -1,4 +1,5 @@
-output "provisioning_enabled" {
-  value       = var.provision
-  description = "Whether resources were requested. false means no resources are created."
-}
+output "api_service_name" { value = google_cloud_run_v2_service.api.name }
+output "worker_service_name" { value = google_cloud_run_v2_service.worker.name }
+output "sql_connection_name" { value = google_sql_database_instance.primary.connection_name }
+output "events_topic" { value = google_pubsub_topic.events.name }
+output "artifact_repository" { value = google_artifact_registry_repository.images.name }

terraform/terraform.tfvars.example

@@ -1,5 +1,3 @@
-project_id               = "replace-with-existing-project"
-region                   = "us-central1"
-environment              = "dev"
-invoker_service_account  = "producer@example.iam.gserviceaccount.com"
-container_image          = "us-central1-docker.pkg.dev/replace-with-existing-project/dev-containers/ingress: approved-tag"
+project_id  = "replace-with-project-id"
+api_image   = "us-central1-docker.pkg.dev/replace-with-project-id/architecture-demo-images/api@sha256:replace"
+worker_image = "us-central1-docker.pkg.dev/replace-with-project-id/architecture-demo-images/worker@sha256:replace"

terraform/variables.tf

@@ -1,25 +1,8 @@
-variable "provision" {
-  description = "Explicit opt-in for provisioning. Keep false for planning and validation."
-  type        = bool
-  default     = false
-}
-
-variable "project_id" {
-  description = "Google Cloud project to target when provisioning is enabled."
-  type        = string
-}
-
-variable "region" {
-  type    = string
-  default = "us-central1"
-}
-
-variable "service_image" {
-  description = "Immutable application image reference."
-  type        = string
-}
-
-variable "secret_id" {
-  description = "Secret Manager secret name; the value is never stored in Terraform."
-  type        = string
-}
+variable "project_id" { type = string; description = "Google Cloud project ID" }
+variable "region" { type = string; default = "us-central1" }
+variable "name" { type = string; default = "architecture-demo"; validation { condition = can(regex("^[a-z][a-z0-9-]{0,29}$", var.name)); error_message = "name must be lowercase and up to 30 characters." } }
+variable "api_image" { type = string; description = "Immutable API container image reference" }
+variable "worker_image" { type = string; description = "Immutable worker container image reference" }
+variable "sql_tier" { type = string; default = "db-f1-micro" }
+variable "sql_ha" { type = bool; default = false }
+variable "deletion_protection" { type = bool; default = true }

tests/test_package.py

@@ -0,0 +1,10 @@
+import subprocess
+from pathlib import Path
+
+ROOT = Path(__file__).parents[1]
+def test_artifact_validator():
+    result = subprocess.run(["python3", "scripts/validate_artifacts.py"], cwd=ROOT, capture_output=True, text=True)
+    assert result.returncode == 0, result.stdout + result.stderr
+
+def test_no_secret_values():
+    assert "replace-with-project-id" in (ROOT / "terraform/terraform.tfvars.example").read_text()

workflow.yaml

@@ -1,18 +1,20 @@
-name: gcp-solution-architecture
-version: 1
-source_template: https://github.com/GoogleCloudPlatform/workflow_agent
+name: gcp-solution-architecture-workflow
+template_url: https://github.com/example/workflow_agent
+target_repository: gcp_solution_architecture_agent
 phases:
-  - id: discover
-    input: workflow_request
-    output: requirements.yaml
+  - id: requirements
+    steps: [0]
+    output: requirements.md
     product_selection_deferred: true
-  - id: architect
-    input: requirements.yaml
-    output: [architecture.mmd, architecture.md, terraform]
-  - id: validate
-    input: [architecture.mmd, architecture.md, terraform]
-    output: validation-results.json
-    deploy_resources: false
-  - id: package
-    input: [requirements.yaml, architecture.md, architecture.mmd, terraform, validation-results.json]
+  - id: architecture
+    steps: [1]
+    inputs: [requirements.md]
+    outputs: [architecture.md, architecture.mmd, terraform/]
+  - id: validation
+    steps: [2]
+    inputs: [architecture.md, architecture.mmd, terraform/]
+    commands: [terraform fmt -check -recursive, terraform init -backend=false, terraform validate, python3 scripts/validate_artifacts.py]
+    provisioning: false
+  - id: packaging
+    steps: [3, 4, 5, 6, 7]
     output: solution-architecture-guide.md