Fix server account login to use protected HTTP

.dockerignore

@@ -0,0 +1,9 @@
+.git
+.github
+.DS_Store
+**/*.log
+**/*.tmp
+deploy/docker/secrets
+deploy/docker/state
+dist
+tmp

.github/workflows/ci.yml

@@ -52,3 +52,13 @@ jobs:
             echo "building ${target}"
             GOOS="${target%/*}" GOARCH="${target#*/}" go build -o /dev/null ./...
           done
+
+  docker-smoke:
+    name: Docker local and team profiles
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v6
+
+      - name: Exercise both profiles under the production memory limit
+        run: deploy/docker/smoke-test.sh

.github/workflows/gcp-deploy.yml

@@ -0,0 +1,189 @@
+name: GCP Deploy Preflight
+
+on:
+  workflow_dispatch:
+    inputs:
+      deploy_environment:
+        description: "GCP environment to deploy"
+        required: true
+        default: "staging"
+        type: choice
+        options:
+          - staging
+          - production
+      operation:
+        description: "Topology the local Mac golden will mutate after this preflight"
+        required: true
+        default: "slot"
+        type: choice
+        options:
+          - slot
+          - migrate-front
+      release_tag:
+        description: "Existing immutable GitHub release tag (for example v0.1.52)"
+        required: true
+        type: string
+
+permissions:
+  contents: read
+  id-token: write
+  attestations: read
+
+concurrency:
+  # Production and staging share one URL map, so serialize their one-time
+  # migrations. Routine slot deploys remain isolated by environment.
+  group: gcp-deploy-${{ inputs.operation == 'migrate-front' && 'shared-url-map' || inputs.deploy_environment }}
+  cancel-in-progress: false
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+  SUBROUTER_GCP_PROJECT: ${{ vars.SUBROUTER_GCP_PROJECT }}
+  SUBROUTER_GCP_ZONE: ${{ vars.SUBROUTER_GCP_ZONE }}
+  SUBROUTER_GCP_INSTANCE: ${{ inputs.deploy_environment == 'production' && 'subrouter-team' || 'subrouter-staging' }}
+  SUBROUTER_PUBLIC_BASE_URL: ${{ inputs.deploy_environment == 'production' && 'https://sr.cmux.com' || 'https://staging.sr.cmux.com' }}
+  SUBROUTER_RELEASE_TAG: ${{ inputs.release_tag }}
+  SUBROUTER_RELEASE_ARCH: amd64
+  SUBROUTER_RELEASE_OUTPUT: ${{ github.workspace }}/dist/subrouter-linux-amd64
+  SUBROUTER_DEPLOY_BINARY: ${{ github.workspace }}/dist/subrouter-linux-amd64
+  SUBROUTER_RELEASE_SHA256_FILE: ${{ github.workspace }}/dist/subrouter-linux-amd64.sha256
+
+jobs:
+  deploy:
+    name: Preflight ${{ inputs.release_tag }} for ${{ inputs.deploy_environment }} ${{ inputs.operation }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 360
+    environment: subrouter-${{ inputs.deploy_environment }}
+    steps:
+      - name: Check out trusted deployment tooling
+        uses: actions/checkout@v6
+        with:
+          ref: main
+          path: deploy-tooling
+
+      - name: Check out matching release source for observer tooling
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ inputs.release_tag }}
+          path: release-source
+          persist-credentials: false
+          fetch-depth: 0
+
+      - uses: actions/setup-go@v6
+        with:
+          go-version-file: release-source/go.mod
+
+      - name: Verify trusted release before Google authentication
+        working-directory: deploy-tooling
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          umask 077
+          mkdir -p "${GITHUB_WORKSPACE}/dist" "${GITHUB_WORKSPACE}/artifacts/build-provenance"
+          deploy/gcp/fetch-release.sh | tee "${GITHUB_WORKSPACE}/artifacts/build-provenance/release-fetch.txt"
+          version="${SUBROUTER_RELEASE_TAG#v}"
+          binary_asset="subrouter_${version}_linux_amd64"
+          release_asset_dir="${GITHUB_WORKSPACE}/dist/release-assets"
+          mkdir -p "${release_asset_dir}"
+          required_assets=(SHA256SUMS SOURCE_PROVENANCE.json deployment-contract.py install.sh install-front-slots.sh "${binary_asset}")
+          download_args=()
+          for asset in "${required_assets[@]}"; do
+            download_args+=(--pattern "${asset}")
+          done
+          gh release download "${SUBROUTER_RELEASE_TAG}" --repo manaflow-ai/subrouter \
+            --dir "${release_asset_dir}" "${download_args[@]}"
+          release_state="$(gh release view "${SUBROUTER_RELEASE_TAG}" --repo manaflow-ai/subrouter \
+            --json isDraft,isImmutable,tagName,targetCommitish,assets)"
+          jq -e --arg tag "${SUBROUTER_RELEASE_TAG}" \
+            '.tagName == $tag and (.isDraft | not) and .isImmutable' <<<"${release_state}" >/dev/null
+          printf '%s\n' "${release_state}" >"${GITHUB_WORKSPACE}/artifacts/build-provenance/release-state.json"
+          metadata="$(go version -m "${SUBROUTER_DEPLOY_BINARY}")"
+          printf '%s\n' "${metadata}" | tee "${GITHUB_WORKSPACE}/artifacts/build-provenance/candidate.txt"
+          release_commit="$(git -C "${GITHUB_WORKSPACE}/release-source" rev-parse HEAD)"
+          printf '%s\n' "${release_commit}" | tee "${GITHUB_WORKSPACE}/artifacts/build-provenance/release-source-commit.txt"
+          git -C "${GITHUB_WORKSPACE}/release-source" fetch --no-tags origin main
+          git -C "${GITHUB_WORKSPACE}/release-source" merge-base --is-ancestor \
+            "${release_commit}" origin/main || {
+              echo "release tag commit is not on protected main" >&2
+              exit 1
+            }
+          grep -Fq "vcs.revision=${release_commit}" <<<"${metadata}"
+          grep -Fq "vcs.modified=false" <<<"${metadata}"
+          declare -A digests=()
+          for asset in "${required_assets[@]}"; do
+            path="${release_asset_dir}/${asset}"
+            [[ -f "${path}" && ! -L "${path}" ]]
+            digests["${asset}"]="$(sha256sum "${path}" | awk '{print $1}')"
+            jq -e --arg asset "${asset}" --arg digest "sha256:${digests[${asset}]}" \
+              '[.assets[]? | select(.name == $asset and .digest == $digest)] | length == 1' \
+              <<<"${release_state}" >/dev/null
+            gh release verify-asset "${SUBROUTER_RELEASE_TAG}" "${path}" \
+              --repo manaflow-ai/subrouter --format json >/dev/null
+            verification="$(gh attestation verify "${path}" \
+              --repo manaflow-ai/subrouter \
+              --signer-workflow manaflow-ai/subrouter/.github/workflows/release.yml \
+              --source-ref "refs/tags/${SUBROUTER_RELEASE_TAG}" \
+              --source-digest "${release_commit}" \
+              --deny-self-hosted-runners --format json)"
+            jq -e 'length > 0' <<<"${verification}" >/dev/null
+          done
+          [[ "$(sha256sum "${SUBROUTER_DEPLOY_BINARY}" | awk '{print $1}')" == "${digests[${binary_asset}]}" ]]
+          for asset in SOURCE_PROVENANCE.json deployment-contract.py install.sh install-front-slots.sh "${binary_asset}"; do
+            [[ "$(python3 deploy/gcp/deployment-contract.py manifest-sha \
+              "${release_asset_dir}/SHA256SUMS" "${asset}")" == "${digests[${asset}]}" ]]
+          done
+          jq -e --arg tag "${SUBROUTER_RELEASE_TAG}" --arg revision "${release_commit}" \
+            '(. | keys | sort) == (["source_revision","tag","tag_on_main"] | sort) and
+             .tag == $tag and .source_revision == $revision and .tag_on_main == true' \
+            "${release_asset_dir}/SOURCE_PROVENANCE.json" >/dev/null
+          release_verification="${GITHUB_WORKSPACE}/artifacts/build-provenance/release-verification.json"
+          jq -n --arg schema 'subrouter.release-verification/v1' \
+            --arg release_tag "${SUBROUTER_RELEASE_TAG}" --arg source_revision "${release_commit}" \
+            --arg sums "${digests[SHA256SUMS]}" \
+            --arg provenance "${digests[SOURCE_PROVENANCE.json]}" \
+            --arg deployment_contract "${digests[deployment-contract.py]}" \
+            --arg installer "${digests[install.sh]}" \
+            --arg front_installer "${digests[install-front-slots.sh]}" \
+            --arg binary_name "${binary_asset}" --arg binary "${digests[${binary_asset}]}" \
+            '{schema:$schema,release_tag:$release_tag,source_revision:$source_revision,
+              tag_on_main:true,release_published:true,release_immutable:true,
+              asset_digest_verified:true,strict_build_attestation_verified:true,
+              provenance_verified:true,embedded_revision_verified:true,
+              assets:{"SHA256SUMS":$sums,"SOURCE_PROVENANCE.json":$provenance,
+                "deployment-contract.py":$deployment_contract,"install.sh":$installer,
+                "install-front-slots.sh":$front_installer,($binary_name):$binary}}' \
+            >"${release_verification}"
+          chmod 0600 "${release_verification}"
+          {
+            echo "SUBROUTER_DEPLOY_REVISION=${release_commit}"
+            echo "SUBROUTER_RELEASE_TAG_ON_MAIN=true"
+            echo "SUBROUTER_RELEASE_ATTESTATION_VERIFIED=true"
+            echo "SUBROUTER_RELEASE_IMMUTABLE=true"
+            echo "SUBROUTER_RELEASE_ASSET_DIR=${release_asset_dir}"
+            echo "SUBROUTER_RELEASE_VERIFICATION_JSON=${release_verification}"
+            echo "SUBROUTER_INSTALL_FRONT_SLOTS=${release_asset_dir}/install-front-slots.sh"
+            echo "SUBROUTER_DEPLOYMENT_CONTRACT=${release_asset_dir}/deployment-contract.py"
+          } >>"${GITHUB_ENV}"
+
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@v3
+        with:
+          workload_identity_provider: ${{ vars.SUBROUTER_GCP_WORKLOAD_IDENTITY_PROVIDER }}
+          service_account: ${{ vars.SUBROUTER_GCP_DEPLOY_SERVICE_ACCOUNT }}
+
+      - uses: google-github-actions/setup-gcloud@v3
+
+      - name: Validate live topology without mutation
+        working-directory: deploy-tooling
+        env:
+          SUBROUTER_PREFLIGHT_TOPOLOGY: ${{ inputs.operation }}
+          SUBROUTER_DEPLOY_ARTIFACT_DIR: ${{ github.workspace }}/artifacts/gcp-preflight
+        run: deploy/gcp/preflight-deployment.sh --evidence-json "${GITHUB_WORKSPACE}/artifacts/gcp-preflight/result.json"
+
+      - name: Upload deployment evidence
+        if: always()
+        uses: actions/upload-artifact@v5
+        with:
+          name: gcp-${{ inputs.deploy_environment }}-${{ inputs.operation }}-${{ inputs.release_tag }}-${{ github.run_attempt }}
+          path: artifacts
+          if-no-files-found: warn

.github/workflows/release.yml

@@ -1,9 +1,9 @@
 name: Release
 
-# A pushed tag builds + tests, then publishes a GitHub release with the binary.
-# The VM auto-updater pulls that release; that is the only deploy path we care
-# about. npm/PyPI are NOT published on a tag; they are manual opt-in only via
-# the workflow_dispatch toggles below.
+# A pushed tag builds and tests, then publishes the immutable binaries consumed
+# by protected GCP deploys. The legacy pre-front updater reads the same release.
+# npm/PyPI are not published on a tag; they are manual opt-in only through the
+# workflow_dispatch toggles below.
 
 on:
   push:
@@ -28,15 +28,27 @@ permissions:
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
+concurrency:
+  group: release-${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   build:
     name: Build and verify artifacts
+    if: ${{ github.event_name == 'push' && github.ref_type == 'tag' }}
     runs-on: ubuntu-latest
     outputs:
       version: ${{ steps.version.outputs.version }}
+      source_commit: ${{ steps.version.outputs.source_commit }}
+    permissions:
+      contents: read
+      id-token: write
+      attestations: write
     steps:
       - name: Check out repository
         uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
 
       - name: Set up Go
         uses: actions/setup-go@v6
@@ -49,20 +61,58 @@ jobs:
         run: |
           set -euo pipefail
           if [[ "${GITHUB_REF_TYPE}" == "tag" ]]; then
+            [[ "${GITHUB_REF_NAME}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+([.-][0-9A-Za-z.-]+)?$ ]] || {
+              echo "release tag must be versioned, for example v0.1.52" >&2
+              exit 1
+            }
             version="${GITHUB_REF_NAME#v}"
           else
             version="$(python3 -c 'import tomllib; print(tomllib.load(open("pyproject.toml", "rb"))["project"]["version"])')"
           fi
           echo "version=${version}" >> "${GITHUB_OUTPUT}"
+          source_commit="$(git rev-parse "${GITHUB_REF}^{commit}")"
+          echo "source_commit=${source_commit}" >> "${GITHUB_OUTPUT}"
+
+      - name: Require release commit on protected main
+        env:
+          SOURCE_COMMIT: ${{ steps.version.outputs.source_commit }}
+        run: |
+          set -euo pipefail
+          git fetch --no-tags origin main
+          git merge-base --is-ancestor "${SOURCE_COMMIT}" origin/main || {
+            echo "refusing to release a tag whose commit is not on origin/main" >&2
+            exit 1
+          }
 
       - name: Test Go packages
         run: CGO_ENABLED=0 go test ./...
 
       - name: Build Go release binaries
         run: scripts/build-release.sh "${{ steps.version.outputs.version }}"
 
-      - name: Copy shell installer into release assets
-        run: cp install.sh dist/release/install.sh
+      - name: Copy deployment helpers into release assets
+        env:
+          SOURCE_COMMIT: ${{ steps.version.outputs.source_commit }}
+        run: |
+          set -euo pipefail
+          cp install.sh dist/release/install.sh
+          cp deploy/gcp/install-front-slots.sh dist/release/install-front-slots.sh
+          cp deploy/gcp/deployment-contract.py dist/release/deployment-contract.py
+          jq -n --arg tag "${GITHUB_REF_NAME}" --arg source_revision "${SOURCE_COMMIT}" \
+            '{tag:$tag,source_revision:$source_revision,tag_on_main:true}' \
+            >dist/release/SOURCE_PROVENANCE.json
+          (
+            cd dist/release
+            find . -maxdepth 1 -type f ! -name SHA256SUMS -printf '%f\n' \
+              | LC_ALL=C sort \
+              | xargs sha256sum >SHA256SUMS
+            sha256sum --check SHA256SUMS
+          )
+
+      - name: Attest complete release asset set
+        uses: actions/attest-build-provenance@v3
+        with:
+          subject-path: dist/release/*
 
       - name: Upload Go release artifacts
         uses: actions/upload-artifact@v5
@@ -75,36 +125,32 @@ jobs:
     name: Publish GitHub release
     needs: build
     runs-on: ubuntu-latest
-    if: ${{ github.event_name == 'push' || github.event_name == 'workflow_dispatch' }}
+    if: ${{ github.event_name == 'push' && github.ref_type == 'tag' }}
     permissions:
       contents: write
+      attestations: read
     steps:
+      - name: Check out repository
+        uses: actions/checkout@v6
+
       - name: Download Go release artifacts
         uses: actions/download-artifact@v5
         with:
           name: release-assets
           path: dist/release
 
-      - name: Create or update GitHub release
+      - name: Stage, verify, and publish immutable GitHub release
         env:
           GH_TOKEN: ${{ github.token }}
           GH_REPO: ${{ github.repository }}
           TAG_NAME: v${{ needs.build.outputs.version }}
-        run: |
-          set -euo pipefail
-          if gh release view "${TAG_NAME}" >/dev/null 2>&1; then
-            gh release upload "${TAG_NAME}" dist/release/* --clobber
-          else
-            gh release create "${TAG_NAME}" dist/release/* \
-              --title "Subrouter ${TAG_NAME}" \
-              --notes "Subrouter ${TAG_NAME}"
-          fi
+          SOURCE_COMMIT: ${{ needs.build.outputs.source_commit }}
+        run: bash scripts/publish-github-release.sh dist/release
 
   # Manual opt-in only. These never run on a tag push; trigger this workflow via
   # the Actions "Run workflow" button with the toggle enabled to publish.
   npm-publish:
     name: Publish npm package (manual)
-    needs: build
     runs-on: ubuntu-latest
     if: ${{ github.event_name == 'workflow_dispatch' && inputs.publish_npm }}
     environment: npm
@@ -126,7 +172,6 @@ jobs:
 
   pypi-publish:
     name: Publish PyPI package (manual)
-    needs: build
     runs-on: ubuntu-latest
     if: ${{ github.event_name == 'workflow_dispatch' && inputs.publish_pypi }}
     environment: pypi

.gitignore

@@ -1,4 +1,6 @@
 .DS_Store
+deploy/docker/secrets/
+deploy/docker/state/
 /subrouter
 bin/
 !npm/bin/