# Architecture decision record

The confirmed baseline uses a managed container API, a transactional managed relational datastore, a durable event bus, a serverless event worker, and centralized observability. The API publishes an event after a successful write. The worker is idempotent, acknowledges only after durable processing, and routes exhausted retries to a dead-letter topic. Public access is restricted to HTTPS and application identity; deployment identities are separate from runtime identities.

## Selected Google Cloud products
- Cloud Run: stateless HTTPS API and event worker.
- Cloud SQL for PostgreSQL: transactional relational persistence.
- Pub/Sub: durable asynchronous events and dead-letter handling.
- Artifact Registry: container image repository.
- Secret Manager: runtime secret references (values supplied out of band).
- Cloud Logging and Cloud Monitoring: logs, metrics, alerting foundations.
- Cloud Trace: distributed request tracing.
- IAM and Service Usage: least privilege and API enablement.

## Trade-offs
Cloud Run reduces operational burden and scales to zero, at the cost of cold starts and request/runtime limits. Cloud SQL provides relational transactions but needs sizing, backups, and HA decisions. Pub/Sub provides at-least-once delivery, so consumers must be idempotent. Terraform modules are deliberately small and explicit to keep the reference deployable and reviewable.