Phase 1 — Architecture & Product Selection

Selected Products

Compute / Serving: Google Cloud Run (Fully Managed Container Ingress & Stateless Execution)
Messaging & Eventing: Google Cloud Pub/Sub (Regional Event Bus for Asynchronous Decoupling)
State & Storage: Google Cloud Storage & Firestore (Database & Bucket Storage for Durable Audit Event Replay)
Security & Identity: Cloud IAM (Least Privilege Service Accounts) & KMS (Customer-Managed Encryption Keys)
Artifact Registry: Google Artifact Registry (OCI Container Image Hosting)

Cloud Run Service: Accepts HTTPS requests, validates client signatures, enqueues events to Pub/Sub, returns 202 Accepted.
Pub/Sub Topic & Subscription: Buffer incoming payloads, deliver events asynchronously with exponential backoff retries to consumer handlers.
Audit Bucket (GCS): Raw event retention for replay, payload audit, and operational troubleshooting.

HTTPS ingress with TLS 1.3 encryption in transit.
Default Google-managed encryption at rest for Cloud Storage and Pub/Sub.
Cloud Run service account bound strictly to roles/pubsub.publisher and roles/storage.objectCreator.