# Steps 1–2 — Architecture and validation

## Selected products
- Cloud Run: managed HTTPS, stateless container runtime.
- Pub/Sub: durable asynchronous event transport.
- Cloud Storage: object persistence.
- Firestore: document/application state persistence.
- VPC and Serverless VPC Access: controlled private egress foundation.
- Cloud Logging and Cloud Monitoring: operational telemetry.
- Artifact Registry: container image source.
- IAM and Service Usage: identities and API enablement.

## Request flow
Clients call Cloud Run over HTTPS. The service writes application state to Firestore, stores binary objects in Cloud Storage, and publishes domain events to Pub/Sub. A separately deployed worker can subscribe to the topic; this baseline creates the topic and dead-letter topic but intentionally does not invent worker application code. Logs and platform metrics feed the operational plane.

## Security and reliability
Cloud Run uses a dedicated service account and configurable ingress. Firestore and Storage use managed encryption. Pub/Sub dead-lettering limits poison-message impact. Runtime configuration is supplied as variables rather than secrets in source. Production hardening should add Secret Manager, customer-managed keys, edge protection, private ingress, backups, and multi-region DR if the open questions require them.

## Terraform notes
The `terraform/` directory is a module-like root configuration. It enables required APIs, creates the network, storage bucket, Firestore database, Pub/Sub topics, Artifact Registry repository, service account, and Cloud Run service. Supply `project_id`, `region`, and `container_image`; do not commit a state backend or credentials. The Cloud Run resource is a deployable placeholder whose image must already exist.

## Validation result
Static artifact tests check required sections, Mermaid markers, Terraform file presence, and absence of obvious credential material. Terraform formatting/validation and an optional plan are defined in `scripts/validate.sh`; they are not executed by repository generation because this environment has no filesystem or cloud credentials. No resources are provisioned by the workflow.