{
  "artifact": "teleo_gcp_service_communication_contract",
  "schema_version": 1,
  "project": "teleo-501523",
  "region": "europe-west6",
  "network": "teleo-staging-net",
  "global_invariants": {
    "no_public_database_ip": true,
    "no_broad_ssh_or_rdp": true,
    "no_default_compute_service_accounts": true,
    "secret_values_not_stored_in_contract": true,
    "database_connections_encrypted_only": true
  },
  "allowed_paths": [
    {
      "name": "github_actions_to_artifact_registry",
      "purpose": "Build, smoke-run, and push Teleo staging Docker image.",
      "source": {
        "type": "github_actions_wif",
        "repository": "living-ip/teleo-infrastructure"
      },
      "identity": "sa-artifact-builder@teleo-501523.iam.gserviceaccount.com",
      "target": {
        "type": "artifact_registry",
        "repository": "projects/teleo-501523/locations/europe-west6/repositories/teleo"
      },
      "protocol": "https",
      "ports": [443],
      "network_path": "google_apis",
      "encryption": "tls",
      "allowed_by": [".github/workflows/gcp-artifact.yml", "roles/artifactregistry.writer"],
      "forbidden": ["cloudsql.editor", "secretmanager.secretAccessor", "compute.admin"]
    },
    {
      "name": "github_actions_to_readiness_probe",
      "purpose": "Read-only GCP readiness probe with retained artifacts.",
      "source": {
        "type": "github_actions_wif",
        "repository": "living-ip/teleo-infrastructure"
      },
      "identity": "sa-teleo-readiness@teleo-501523.iam.gserviceaccount.com",
      "target": {
        "type": "gcp_control_plane",
        "resources": ["artifact_registry", "compute_metadata", "cloudsql_metadata", "secret_metadata", "storage_metadata"]
      },
      "protocol": "https",
      "ports": [443],
      "network_path": "google_apis",
      "encryption": "tls",
      "allowed_by": [".github/workflows/gcp-readiness.yml", "ops/plan_gcp_iam_split.py"],
      "forbidden": ["artifactregistry.writer", "cloudsql.editor", "secretmanager.secretAccessor"]
    },
    {
      "name": "operator_ssh_to_teleo_vms",
      "purpose": "Emergency/operator shell access only from one retained operator IPv4 /32.",
      "source": {
        "type": "operator_ip",
        "cidrs": ["<operator-ip>/32"]
      },
      "identity": "oslogin_operator",
      "target": {
        "type": "compute_instance_tags",
        "tags": ["teleo-prod-ssh", "teleo-staging-ssh"]
      },
      "protocol": "tcp",
      "ports": [22],
      "network_path": "vpc_firewall",
      "encryption": "ssh",
      "allowed_by": ["ops/apply_gcp_runtime_baseline.py", "ops/check_gcp_infra_readiness.py"],
      "forbidden": ["broad_ipv4_ingress", "broad_ipv6_ingress", "tcp:3389"]
    },
    {
      "name": "teleo_vms_to_artifact_registry",
      "purpose": "Runtime pulls immutable images from Artifact Registry over Private Google Access.",
      "source": {
        "type": "compute_service_accounts",
        "service_accounts": [
          "sa-teleo-prod-vm@teleo-501523.iam.gserviceaccount.com",
          "sa-teleo-staging-vm@teleo-501523.iam.gserviceaccount.com"
        ]
      },
      "identity": "dedicated_vm_service_accounts",
      "target": {
        "type": "artifact_registry",
        "repository": "projects/teleo-501523/locations/europe-west6/repositories/teleo"
      },
      "protocol": "https",
      "ports": [443],
      "network_path": "private_google_access",
      "encryption": "tls",
      "allowed_by": ["roles/artifactregistry.reader", "ops/apply_gcp_runtime_baseline.py"],
      "forbidden": ["default_compute_service_account", "public_image_registry_required"]
    },
    {
      "name": "teleo_vms_to_cloudsql_private",
      "purpose": "Application and restore readback connections to the private Cloud SQL standby.",
      "source": {
        "type": "compute_service_accounts",
        "service_accounts": [
          "sa-teleo-prod-vm@teleo-501523.iam.gserviceaccount.com",
          "sa-teleo-staging-vm@teleo-501523.iam.gserviceaccount.com"
        ]
      },
      "identity": "dedicated_vm_service_accounts",
      "target": {
        "type": "cloudsql_postgres",
        "instance": "teleo-pgvector-standby",
        "database": "teleo_kb",
        "private_network": "projects/teleo-501523/global/networks/teleo-staging-net",
        "public_ip": false
      },
      "protocol": "postgres",
      "ports": [5432],
      "network_path": "private_vpc",
      "encryption": "encrypted_only",
      "allowed_by": ["ops/apply_gcp_runtime_baseline.py", "ops/check_gcp_infra_readiness.py"],
      "forbidden": ["public_ip", "ssl_disabled", "authorized_networks_public"]
    },
    {
      "name": "cloudsql_import_from_backup_bucket",
      "purpose": "Cloud SQL import operation reads generated restore SQL from the versioned backup bucket.",
      "source": {
        "type": "cloudsql_instance_service_account",
        "discovered_by": "gcloud sql instances describe teleo-pgvector-standby --format=value(serviceAccountEmailAddress)"
      },
      "identity": "cloudsql_instance_service_account",
      "target": {
        "type": "gcs_bucket",
        "bucket": "gs://teleo-501523-prod-backups",
        "prefix": "kb-dumps/cloudsql-restore-drills/"
      },
      "protocol": "https",
      "ports": [443],
      "network_path": "google_apis",
      "encryption": "tls",
      "allowed_by": ["roles/storage.objectAdmin", "ops/apply_gcp_iam_split.py"],
      "forbidden": ["allUsers", "allAuthenticatedUsers", "publicAccessPreventionDisabled"]
    },
    {
      "name": "restore_drill_operator_to_cloudsql_admin",
      "purpose": "Operator-triggered Cloud SQL import drill and post-import readback.",
      "source": {
        "type": "operator_or_ci_with_explicit_auth",
        "requires_retained_execute_proof": true
      },
      "identity": "sa-teleo-restore-drill@teleo-501523.iam.gserviceaccount.com",
      "target": {
        "type": "cloudsql_admin_api",
        "instance": "teleo-pgvector-standby"
      },
      "protocol": "https",
      "ports": [443],
      "network_path": "google_apis",
      "encryption": "tls",
      "allowed_by": ["roles/cloudsql.editor", "ops/run_gcp_cloudsql_restore_drill.sh"],
      "forbidden": ["unretained_execute", "raw_password_in_logs"]
    },
    {
      "name": "vps_backup_to_gcs_bucket",
      "purpose": "Source backup artifacts are uploaded to versioned GCS only through an approved backup identity.",
      "source": {
        "type": "hetzner_vps_or_operator_export",
        "host": "teleo@77.42.65.182"
      },
      "identity": "approved_backup_writer_or_operator_session",
      "target": {
        "type": "gcs_bucket",
        "bucket": "gs://teleo-501523-prod-backups",
        "prefix": "kb-dumps/"
      },
      "protocol": "https",
      "ports": [443],
      "network_path": "google_apis",
      "encryption": "tls",
      "allowed_by": ["ops/backup_vps_sqlite_kb.sh", "ops/run_gcp_cloudsql_restore_drill.sh"],
      "forbidden": ["raw_private_key_in_contract", "database_public_ingress", "unversioned_bucket"]
    }
  ],
  "not_proven_by_this_contract": [
    "that GCP resources currently exist",
    "that firewall rules are currently applied",
    "that Cloud SQL import/readback has succeeded",
    "that production Telegram/Leo traffic has cut over to GCP"
  ]
}
