Reconcile staging preflight inventory

docs/gcp-leoclean-nosend-preflight.md

@@ -7,8 +7,9 @@ the separately reviewed no-send service package. It creates one revision-bound
 receipt and does not deploy the service.
 
 The checker validates the exact project, VM, machine type, attached service
-account, exact boot-disk attachment and architecture, private-only VM
+account, exact `e2-standard-4` machine type, boot-disk attachment and
-VPC/subnet attachment, Private Google Access, immutable Docker Artifact
+architecture, private-only VM attachment to `teleo-staging-europe-west6`
+(`10.60.0.0/20`), Private Google Access, immutable Docker Artifact
 Registry repository, exact private PostgreSQL 16 Cloud SQL endpoint, host
 architecture, Docker server, Docker storage floor, unused service/container
 names, and private TCP/5432 reachability from the VM.

docs/workstreams/gcp-leoclean/goals.md

@@ -72,6 +72,14 @@ cut over safely and retire the VPS after soak.
   reading secrets, logging into PostgreSQL, deploying, or restarting. Its
   bounded IAP/SSH path uses a fixed remote command and a maximum five-minute
   key lifetime, but no live run is currently authorized.
+- Historical only: the superseded preflight branch records an earlier live
+  observation of `e2-standard-4` on `teleo-staging-europe-west6`
+  (`10.60.0.0/20`) with an external IPv4 attachment. That observation is not
+  current-revision proof and has not been refreshed in this slice. The checker
+  intentionally fails while any public attachment remains.
+- The older provisioning baseline names `e2-standard-2` and
+  `teleo-staging-subnet`; reconciling that declarative baseline is a separate
+  infrastructure change, not part of this preflight implementation.
 - Not yet live-proven: staging VM/container engine, IAM/Secret Manager, Cloud
   SQL effective identity, restart behavior, or model/database parity.
 

ops/check_gcp_leoclean_nosend_preflight.py

@@ -32,14 +32,14 @@ CRITICAL_TRACKED_PATHS = (
     "hermes-agent/leoclean-bin/cloudsql_memory_tool.py",
 )
 REGION = package.ZONE.rsplit("-", 1)[0]
-MACHINE_TYPE = "e2-standard-2"
+MACHINE_TYPE = "e2-standard-4"
 MINIMUM_BOOT_DISK_GB = 80
 MINIMUM_DOCKER_FREE_BYTES = 10 * 1024**3
 MINIMUM_DOCKER_MAJOR = 24
 SSH_KEY_LIFETIME = "5m"
 NETWORK = "teleo-staging-net"
-SUBNET = "teleo-staging-subnet"
+SUBNET = "teleo-staging-europe-west6"
-SUBNET_CIDR = ipaddress.ip_network("10.70.0.0/24")
+SUBNET_CIDR = ipaddress.ip_network("10.60.0.0/20")
 CLOUDSQL_INSTANCE = "teleo-pgvector-standby"
 ARTIFACT_REPOSITORY = "teleo"
 
@@ -190,7 +190,7 @@ def _instance_readback(runner: Runner) -> dict[str, Any]:
             package.PROJECT,
             "--zone",
             package.ZONE,
-            "--format=json(name,status,zone,machineType,cpuPlatform,serviceAccounts.email,disks,networkInterfaces,tags.items)",
+            "--format=json(name,status,zone,machineType,cpuPlatform,serviceAccounts,disks,networkInterfaces,tags.items)",
         ],
         runner,
     )

tests/test_gcp_leoclean_nosend_preflight.py

@@ -27,7 +27,7 @@ def live_fixtures() -> dict[str, object]:
             "zone": "https://www.googleapis.com/compute/v1/projects/teleo-501523/zones/europe-west6-a",
             "machineType": (
                 "https://www.googleapis.com/compute/v1/projects/teleo-501523/zones/europe-west6-a/"
-                "machineTypes/e2-standard-2"
+                "machineTypes/e2-standard-4"
             ),
             "cpuPlatform": "Intel Broadwell",
             "serviceAccounts": [
@@ -49,9 +49,9 @@ def live_fixtures() -> dict[str, object]:
                     ),
                     "subnetwork": (
                         "https://www.googleapis.com/compute/v1/projects/teleo-501523/regions/europe-west6/"
-                        "subnetworks/teleo-staging-subnet"
+                        "subnetworks/teleo-staging-europe-west6"
                     ),
-                    "networkIP": "10.70.0.2",
+                    "networkIP": "10.60.0.2",
                     "accessConfigs": [],
                     "ipv6AccessConfigs": [],
                     "stackType": "IPV4_ONLY",
@@ -71,10 +71,10 @@ def live_fixtures() -> dict[str, object]:
             ],
         },
         "subnet": {
-            "name": "teleo-staging-subnet",
+            "name": "teleo-staging-europe-west6",
             "region": "https://www.googleapis.com/compute/v1/projects/teleo-501523/regions/europe-west6",
             "network": "https://www.googleapis.com/compute/v1/projects/teleo-501523/global/networks/teleo-staging-net",
-            "ipCidrRange": "10.70.0.0/24",
+            "ipCidrRange": "10.60.0.0/20",
             "privateIpGoogleAccess": True,
         },
         "artifact": {
@@ -202,7 +202,7 @@ def test_exact_read_only_preflight_passes_without_exposing_private_ip() -> None:
             "teleo-501523",
             "--zone",
             "europe-west6-a",
-            "--format=json(name,status,zone,machineType,cpuPlatform,serviceAccounts.email,disks,networkInterfaces,tags.items)",
+            "--format=json(name,status,zone,machineType,cpuPlatform,serviceAccounts,disks,networkInterfaces,tags.items)",
         ],
         [
             "gcloud",
@@ -222,7 +222,7 @@ def test_exact_read_only_preflight_passes_without_exposing_private_ip() -> None:
             "networks",
             "subnets",
             "describe",
-            "teleo-staging-subnet",
+            "teleo-staging-europe-west6",
             "--project",
             "teleo-501523",
             "--region",