---
title: "Secrets and Data Stores"
slug: gcp-secrets-and-data-stores
section: GCP Infrastructure
status: stable
description: "This page covers the stateful and sensitive layer that sits under every workload in the GCP projects: Secret Manager, Cloud SQL, Memorystore Redis, Firestore, Cloud Storage and Artifact Registry."
last-updated: 2026-10-07
---

# Secrets and Data Stores

This page covers the stateful and sensitive layer that sits under every workload in the GCP projects: Secret Manager, Cloud SQL, Memorystore Redis, Firestore, Cloud Storage and Artifact Registry. It describes the standard, how Terraform and the running systems divide responsibility, and where live state differs. For the projects themselves see `/docs/gcp-overview`; for the identities that read these stores see `/docs/gcp-iam-and-workload-identity`; for name patterns see `/docs/gcp-naming-conventions`.

## How responsibility is split

Terraform in `alliance-gcp-infra` owns the containers: secret containers and their accessor bindings, Cloud SQL instances, Redis instances, Firestore databases, buckets and Artifact Registry repositories. It does not own contents. Secret values and versions, database schemas, database users and runtime bootstrap are created out-of-band (see `/docs/gcp-terraform-workflows` for how applies are run). The Cloud SQL, Redis, bucket, Firestore and Artifact Registry modules set `prevent_destroy = true`, because a Cloud SQL name is immutable and these resources hold real data; renaming to fit the standard is a data migration, not a Terraform edit.

Apply rules are the same as for all resources: dev and QA apply on merge, while prod and MCP use dispatch-only workflows with a typed confirmation phrase. Every apply workflow has a destroy-count circuit breaker. A plan that shows a replacement of a database, bucket or secret container should be treated as a blocker.

## Secrets and data

### Secret Manager containers by project

Secret **values** are never stored in Terraform or documented here: only the containers (names) are managed. Naming follows `<system>-<env>-<key>` (see [GCP Naming Conventions](/docs/gcp-naming-conventions)).

| Environment | Project | Secrets live | Secret items in Terraform | Matched | Live only |
| --- | --- | --- | --- | --- | --- |
| `development` | `skilled-script-469819-f2` | 234 | 14 | 169 | 65 |
| `mcp` | `alliance-mcp-services` | 119 | 18 | 103 | 16 |
| `platform-services` | `alliance-platform-services` | 0 | 4 | 0 | 0 |
| `production` | `production-499116` | 97 | 96 | 96 | 1 |
| `qa` | `quality-assurance-496022` | 97 | 93 | 93 | 4 |
| `vertex` | `alliance-platform-agents` | 35 | 3 | 2 | 33 |

> **Branch Drift Agent decommissioned**
> `branch-drift-agent` was decommissioned, superseded by the sandbox branching model rulesets. The `branch-drift-agent-sa` and `branch-drift-scheduler` service accounts were removed on 2026-10-05. The Cloud Scheduler job `branch-drift-agent-scan` and all `branch-drift-agent-*` secrets were deleted.

### Secret names: skilled-script-469819-f2

234 secrets.

| Secret name | Managed by Terraform |
| --- | --- |
| `applicant-kc-admin` | yes |
| `applicant-kc-admin-password` | yes |
| `applicant-kc-db` | yes |
| `applicant-kc-db-client-cert` | yes |
| `applicant-kc-db-client-key` | yes |
| `applicant-kc-db-password` | yes |
| `applicant-kc-db-server-ca` | yes |
| `applicant-kc-db-url` | yes |
| `applicant-kc-db-username` | yes |
| `applicant-kc-hostname` | yes |
| `auth0-mcp-api-key` | yes |
| `azure-mcp-api-key` | yes |
| `branch-drift-agent-api-key` | yes |
| `branch-drift-agent-asana-gateway-pat` | no |
| `branch-drift-agent-gateway-pat` | yes |
| `branch-drift-agent-known-issues` | yes |
| `bug-diagnosis-agent-api-key` | no |
| `bug-diagnosis-agent-asana-pat` | no |
| `bug-diagnosis-agent-gateway-pat` | no |
| `bug-diagnosis-agent-webhook-secret` | no |
| `bug-diagnosis-reasoner-gateway-pat` | no |
| `bug-diagnosis-reasoner-github-pat` | no |
| `cloudbuild-teams-notifier-github-token` | yes |
| `cloudbuild-teams-webhook-url` | yes |
| `db-aab_portal_rw-pass` | yes |
| `dev-to-qa-sync-agent-api-key` | yes |
| `dev-to-qa-sync-agent-gateway-pat` | yes |
| `docs-update-agent-api-key` | no |
| `docs-update-agent-gateway-pat` | no |
| `email-health-agent-asana-gateway-pat` | no |
| `env-audit-agent-api-key` | yes |
| `env-audit-agent-asana-gateway-pat` | no |
| `env-audit-agent-gateway-pat` | yes |
| `env-audit-agent-known-issues` | yes |
| `form-engine-bump-monitor-gateway-pat` | no |
| `gcp-mcp-server-api-key` | yes |
| `gcp-mcp-server-sa-key` | yes |
| `github-agent-workflow-app-id` | yes |
| `github-agent-workflow-app-private-key` | yes |
| `github-app-packages-reader-id` | yes |
| `github-app-packages-reader-installation-id` | yes |
| `github-app-packages-reader-key` | yes |
| `github-packages-read-pat` | yes |
| `github-packages-token` | yes |
| `gke-workload-health-agent-api-key` | no |
| `gke-workload-health-agent-asana-gateway-pat` | no |
| `gke-workload-health-agent-asana-token` | no |
| `globus-agent-api-key` | yes |
| `globus-asana-access-token` | yes |
| `globus-asana-alliance-api-key` | no |
| `globus-asana-client-id` | yes |
| `globus-asana-client-secret` | yes |
| `globus-backoffice-api-key` | yes |
| `globus-brave-api-key` | yes |
| `globus-database-url` | yes |
| `globus-dev-hubspot-api-key` | no |
| `globus-dev-hubspot-auth-header` | no |
| `globus-dev-netsuite-access-token` | no |
| `globus-dev-netsuite-account-id` | no |
| `globus-dev-netsuite-consumer-key` | no |
| `globus-dev-netsuite-consumer-secret` | no |
| `globus-dev-netsuite-realm` | no |
| `globus-dev-netsuite-token-secret` | no |
| `globus-development-asana-alliance-api-key` | yes |
| `globus-development-docai-processor-id` | yes |
| `globus-development-environment` | no |
| `globus-development-n8n-webhook-url-job-order` | yes |
| `globus-development-posthog-host` | no |
| `globus-development-sandbox-mode` | no |
| `globus-development-sendgrid-api-key` | yes |
| `globus-development-translation-glossary-id` | no |
| `globus-docai-processor-id` | no |
| `globus-document-bucket` | yes |
| `globus-entra-client-id` | yes |
| `globus-entra-client-secret` | yes |
| `globus-entra-tenant-id` | yes |
| `globus-ga4-measurement-id` | yes |
| `globus-ga4-mp-api-secret` | yes |
| `globus-google-maps-api-key` | yes |
| `globus-google-workspace-domain` | yes |
| `globus-host-portal-webhook-url` | yes |
| `globus-internal-ocr-api-key` | yes |
| `globus-internal-translation-api-key` | yes |
| `globus-mcp-api-key` | yes |
| `globus-n8n-api-key` | yes |
| `globus-n8n-api-url` | yes |
| `globus-n8n-sandbox-api-key` | no |
| `globus-n8n-webhook-url-application` | yes |
| `globus-n8n-webhook-url-document` | yes |
| `globus-n8n-webhook-url-job-order` | no |
| `globus-oidc-client-id` | yes |
| `globus-oidc-client-secret` | yes |
| `globus-oidc-discovery-url` | yes |
| `globus-openai-api-key` | yes |
| `globus-participant-profile-pdf-secret` | yes |
| `globus-partner-pipeline-api-key` | yes |
| `globus-partner-pipeline-api-url` | yes |
| `globus-partner-pipeline-user-id` | yes |
| `globus-photo-bucket` | yes |
| `globus-pii-encryption-key` | yes |
| `globus-portal-session-secret` | yes |
| `globus-posthog-key` | yes |
| `globus-seed-admin-email` | yes |
| `globus-seed-admin-password` | yes |
| `globus-sendgrid-api-key` | no |
| `globus-sendgrid-from-email` | yes |
| `globus-session-secret` | yes |
| `globus-sevis-cert-encryption-key` | yes |
| `globus-sevis-cert-file` | yes |
| `globus-sevis-cert-password` | yes |
| `globus-vite-google-maps-api-key` | yes |
| `globus-webhook-secret` | yes |
| `godaddy-api-key` | yes |
| `godaddy-api-secret` | yes |
| `google-workspace-admin` | yes |
| `google-workspace-domain` | yes |
| `google-workspace-mcp-sa-key` | yes |
| `host-portal-allowed-email-domains` | yes |
| `host-portal-auth0-audience` | yes |
| `host-portal-auth0-client-id` | yes |
| `host-portal-auth0-domain` | yes |
| `host-portal-auth0-mgmt-audience` | yes |
| `host-portal-auth0-mgmt-client-id` | yes |
| `host-portal-auth0-mgmt-client-secret` | yes |
| `host-portal-azure-client-id` | yes |
| `host-portal-azure-client-secret` | yes |
| `host-portal-azure-tenant-id` | yes |
| `host-portal-client-base-url` | yes |
| `host-portal-development-anthropic-api-key` | yes |
| `host-portal-development-globus-apikey` | yes |
| `host-portal-development-globus-webhook-secret` | yes |
| `host-portal-development-openai-api-key` | yes |
| `host-portal-development-posthog-key` | yes |
| `host-portal-development-sendgrid-api-key` | yes |
| `host-portal-development-session-secret` | yes |
| `host-portal-globus-api-key` | yes |
| `host-portal-globus-apikey` | yes |
| `host-portal-keycloak-client-id` | yes |
| `host-portal-keycloak-issuer` | yes |
| `host-portal-oaut-client-id` | yes |
| `host-portal-server-public-url` | yes |
| `host-portal-session-jwt-secret` | yes |
| `host-portal-session-secret` | yes |
| `n8n-api-key` | yes |
| `n8n-db-password` | yes |
| `n8n-dev-db-password` | yes |
| `n8n-dev-deploy-api-key` | no |
| `n8n-dev-email-health-kc-admin-pass-qa` | yes |
| `n8n-dev-email-health-n8n-api-key-qa` | yes |
| `n8n-dev-email-health-sendgrid-key-qa` | yes |
| `n8n-dev-encryption-key` | yes |
| `n8n-dev-hubspot-webhook-secret` | no |
| `n8n-dev-owner-password` | no |
| `n8n-encryption-key` | yes |
| `n8n-globus-api-callback-key` | no |
| `n8n-globus-webhook-secret` | yes |
| `n8n-monitors-gateway-pat` | yes |
| `n8n-qa-pipeline-webhook-token` | no |
| `n8n-sandbox-db-password` | yes |
| `n8n-sandbox-deploy-api-key` | no |
| `n8n-sandbox-encryption-key` | yes |
| `n8n-sandbox-globus-callback-key` | no |
| `n8n-sandbox-owner-password` | no |
| `n8n-sandbox-template-admin-harness-key` | no |
| `nexus-ai-keys-admin-password` | yes |
| `nexus-asana-token` | yes |
| `nexus-database-url` | yes |
| `nexus-entra-client-id` | yes |
| `nexus-entra-client-secret` | yes |
| `nexus-entra-tenant-id` | yes |
| `nexus-gcp-sa-key` | yes |
| `nexus-github-token` | yes |
| `nexus-mcp-api-key` | yes |
| `nexus-node-env` | yes |
| `nexus-session-secret` | yes |
| `observer-agent-v2-api-key` | yes |
| `observer-agent-v2-gateway-pat` | yes |
| `observer-agent-v2-last-heartbeat` | yes |
| `onepassword-mcp-vault-admin-token` | no |
| `openstatus-alert-agent-api-key` | no |
| `openstatus-alert-agent-gateway-pat` | no |
| `openstatus-alert-agent-known-issues` | no |
| `openstatus-alert-agent-openstatus-key` | no |
| `openstatus-auth-secret` | yes |
| `openstatus-google-client-id` | yes |
| `openstatus-google-client-secret` | yes |
| `openstatus-mcp-api-key` | yes |
| `openstatus-resend-api-key` | yes |
| `openstatus-super-admin-token` | yes |
| `overseer-agent-api-key` | yes |
| `overseer-agent-gateway-pat` | yes |
| `overseer-agent-known-issues` | yes |
| `overseer-agent-n8n-sync-state` | yes |
| `platform-bot-asana-pat` | no |
| `platform-bot-github-password` | yes |
| `platform-bot-github-pat` | yes |
| `platform-bot-github-recovery-codes` | yes |
| `platform-bot-github-totp-secret` | yes |
| `platform-bot-m365-object-id` | yes |
| `platform-bot-m365-password` | yes |
| `platform-bot-m365-upn` | yes |
| `posthog-agent-api-key` | yes |
| `posthog-agent-gateway-pat` | yes |
| `posthog-agent-known-issues` | yes |
| `posthog-agent-openai-api-key` | yes |
| `ppp2-e2e-bot-password` | yes |
| `ppp2-globus-api-key` | no |
| `ppp2-keycloak-admin-client-secret` | no |
| `ppp2-passport-name-sync-secret` | no |
| `pr-hygiene-agent-api-key` | no |
| `pr-hygiene-agent-gateway-pat` | no |
| `pr-hygiene-agent-known-issues` | no |
| `pr-latency-agent-api-key` | no |
| `pr-latency-agent-gateway-pat` | no |
| `pr-review-agent-gateway-pat` | no |
| `pr-review-eligibility-agent-api-key` | no |
| `pr-review-eligibility-agent-asana-gateway-pat` | no |
| `pr-review-eligibility-agent-cycle-state` | no |
| `pr-review-eligibility-agent-gateway-pat` | no |
| `pr-review-eligibility-agent-webhook-secret` | no |
| `qa-agent-gateway-pat` | yes |
| `secrets-drift-agent-api-key` | no |
| `secrets-drift-agent-state` | no |
| `security-agent-asana-gateway-pat` | no |
| `teams-mcp-api-key` | yes |
| `teams-platform-pulse-webhook-url` | yes |
| `user-addition-agent-api-key` | yes |
| `user-addition-agent-gateway-pat` | yes |
| `vertex-reviewer-private-key` | no |
| `vertex-sync-agent-api-key` | yes |
| `vertex-sync-agent-gateway-pat` | yes |
| `volume-testing-agent-api-key` | yes |
| `volume-testing-agent-engine-id` | yes |
| `volume-testing-agent-gateway-pat` | yes |
| `wildpacks-dev-hubspot-token` | yes |

### Secret names: alliance-mcp-services

119 secrets.

| Secret name | Managed by Terraform |
| --- | --- |
| `1password-mcp-api-key` | yes |
| `1password-mcp-service-account-token` | yes |
| `BACKEND_GITHUB_APP_ID` | yes |
| `BACKEND_GITHUB_APP_PRIVATE_KEY` | yes |
| `alliance-mcp-gateway-db-url` | yes |
| `auth0-mcp-api-key` | yes |
| `auth0-mcp-domain` | yes |
| `auth0-mcp-hostportal-dev-audience` | no |
| `auth0-mcp-hostportal-dev-client-id` | no |
| `auth0-mcp-hostportal-dev-client-secret` | no |
| `auth0-mcp-hostportal-dev-domain` | no |
| `auth0-mcp-hostportal-qa-audience` | no |
| `auth0-mcp-hostportal-qa-client-id` | no |
| `auth0-mcp-hostportal-qa-client-secret` | no |
| `auth0-mcp-hostportal-qa-domain` | no |
| `auth0-mcp-mgmt-audience` | yes |
| `auth0-mcp-mgmt-client-id` | yes |
| `auth0-mcp-mgmt-client-secret` | yes |
| `azure-mcp-admin-client-id` | yes |
| `azure-mcp-admin-client-secret` | yes |
| `azure-mcp-admin-tenant-id` | yes |
| `azure-mcp-api-key` | yes |
| `domain-admin-sa-key` | no |
| `github-mcp-app-key` | yes |
| `globus-backoffice-mcp-app-key` | yes |
| `globus-development-asana-access-token` | yes |
| `globus-development-asana-alliance-api-key` | yes |
| `globus-mcp-service-api-key` | yes |
| `godaddy-api-key` | yes |
| `godaddy-api-secret` | yes |
| `godaddy-mcp-server-api-key` | yes |
| `google-workspace-mcp-admin` | no |
| `google-workspace-mcp-domain` | no |
| `google-workspace-mcp-sa-key` | no |
| `itrequest-gateway-api-key` | yes |
| `manus-mcp-api-key` | yes |
| `manus-mcp-server-api-key` | yes |
| `mcp-anthropic-api-key` | yes |
| `mcp-api-key` | yes |
| `mcp-database-url` | yes |
| `mcp-datalake-tunnel-key` | yes |
| `mcp-development-admin-password` | yes |
| `mcp-development-admin-username` | yes |
| `mcp-development-agent-key` | yes |
| `mcp-development-ai-connector-service-key` | yes |
| `mcp-development-api-key` | yes |
| `mcp-development-database-url` | yes |
| `mcp-development-datalake-sql-database` | yes |
| `mcp-development-datalake-sql-host` | yes |
| `mcp-development-datalake-sql-password` | yes |
| `mcp-development-datalake-sql-user` | yes |
| `mcp-development-entra-client-id` | yes |
| `mcp-development-entra-client-secret` | yes |
| `mcp-development-entra-tenant-id` | yes |
| `mcp-development-globus-api-base-url` | yes |
| `mcp-development-globus-api-key` | yes |
| `mcp-development-warp-api-key` | yes |
| `mcp-development-warp-environment-id` | yes |
| `mcp-gateway-auth0-audience` | yes |
| `mcp-gateway-auth0-domain` | yes |
| `mcp-gateway-auth0-spa-client-id` | yes |
| `mcp-gateway-bootstrap-token` | yes |
| `mcp-gateway-cred-enc-key` | yes |
| `mcp-gateway-github-token` | yes |
| `mcp-gateway-oauth-asana-client-id` | no |
| `mcp-gateway-oauth-asana-client-secret` | no |
| `mcp-gateway-oauth-entra-client-secret` | yes |
| `mcp-gateway-oauth-gcp-client-id` | yes |
| `mcp-gateway-oauth-gcp-client-secret` | yes |
| `mcp-gateway-oauth-outlook-client-id` | yes |
| `mcp-gateway-oauth-outlook-client-secret` | yes |
| `mcp-gateway-oauth-outlook-tenant-id` | yes |
| `mcp-gateway-oauth-signing-key` | yes |
| `mcp-gateway-oauth-teams-client-id` | yes |
| `mcp-gateway-oauth-teams-client-secret` | yes |
| `mcp-gateway-oauth-teams-tenant-id` | yes |
| `mcp-gateway-op-connect-token` | yes |
| `mcp-gateway-op-connect-url` | yes |
| `mcp-gateway-signing-secret` | yes |
| `mcp-gateway-skill-directive-signing-key` | no |
| `mcp-gateway-skills-sync-token` | yes |
| `mcp-production-admin-password` | yes |
| `mcp-production-admin-username` | yes |
| `mcp-production-agent-key` | yes |
| `mcp-production-anthropic-api-key` | yes |
| `mcp-production-globus-api-base-url` | yes |
| `mcp-production-globus-api-key` | yes |
| `mcp-production-warp-api-key` | yes |
| `mcp-production-warp-environment-id` | yes |
| `nexus-ai-consumer-keys` | yes |
| `nexus-ai-keys-admin-password` | yes |
| `nexus-asana-pat` | yes |
| `nexus-database-url` | yes |
| `nexus-entra-client-id` | yes |
| `nexus-entra-client-secret` | yes |
| `nexus-entra-tenant-id` | yes |
| `nexus-gcp-sa-key-json` | yes |
| `nexus-gh-token` | yes |
| `nexus-hub-ai-key-globus-mcp` | yes |
| `nexus-mcp-api-key` | yes |
| `nexus-node-env` | yes |
| `nexus-session-secret` | yes |
| `nexusdocs-mcp-api-key` | yes |
| `openstatus-mcp-api-key` | yes |
| `platform-hub-gateway-pat` | yes |
| `platform-hub-mcp-github-token` | yes |
| `platformhub-mcp-api-key` | yes |
| `posthog-mcp-personal-api-key` | no |
| `replit-oauth-registration-token` | yes |
| `teams-bot-client-id` | yes |
| `teams-bot-client-secret` | yes |
| `teams-bot-tenant-id` | yes |
| `teams-client-id` | yes |
| `teams-client-secret` | yes |
| `teams-mcp-api-key` | yes |
| `teams-mcp-app-only-key` | yes |
| `teams-service-refresh-token` | yes |
| `teams-tenant-id` | yes |
| `wordpress-mcp-api-key` | yes |
| `wordpress-mcp-app-password` | yes |

### Secret names: production-499116

97 secrets.

| Secret name | Managed by Terraform |
| --- | --- |
| `cloudbuild-teams-notifier-prod-github-token` | yes |
| `cloudbuild-teams-notifier-prod-webhook-url` | yes |
| `db-query-proxy-prod-db-password` | yes |
| `db-query-proxy-prod-token` | yes |
| `github-packages-read-pat` | yes |
| `github-prod-oauth-token` | yes |
| `globus-applicant-portal-webhook-url` | yes |
| `globus-asana-access-token` | yes |
| `globus-asana-client-id` | yes |
| `globus-asana-client-secret` | yes |
| `globus-backoffice-api-key` | yes |
| `globus-brave-api-key` | yes |
| `globus-database-url` | yes |
| `globus-document-bucket` | yes |
| `globus-entra-client-id` | yes |
| `globus-entra-client-secret` | yes |
| `globus-entra-tenant-id` | yes |
| `globus-github-config-repo-token` | yes |
| `globus-github-config-repo-write-token` | yes |
| `globus-google-maps-api-key` | yes |
| `globus-google-workspace-domain` | yes |
| `globus-host-portal-webhook-url` | yes |
| `globus-internal-ocr-api-key` | yes |
| `globus-internal-translation-api-key` | yes |
| `globus-mcp-api-key` | yes |
| `globus-n8n-api-key` | yes |
| `globus-n8n-api-url` | yes |
| `globus-n8n-job-order-webhook-url` | yes |
| `globus-n8n-webhook-url-application` | yes |
| `globus-n8n-webhook-url-document` | yes |
| `globus-oidc-client-id` | yes |
| `globus-oidc-client-secret` | yes |
| `globus-oidc-discovery-url` | yes |
| `globus-openai-api-key` | yes |
| `globus-partner-pipeline-api-key` | yes |
| `globus-partner-pipeline-api-url` | yes |
| `globus-partner-pipeline-user-id` | yes |
| `globus-photo-bucket` | yes |
| `globus-pii-encryption-key` | yes |
| `globus-portal-session-secret` | yes |
| `globus-prod-applicant-portal-posthog-key` | yes |
| `globus-prod-docai-processor-id` | yes |
| `globus-prod-environment` | yes |
| `globus-prod-hubspot-api-key` | yes |
| `globus-prod-internal-ocr-api-key` | yes |
| `globus-prod-mailjet-api-key` | yes |
| `globus-prod-mailjet-from-email` | yes |
| `globus-prod-n8n-globus-api-key` | yes |
| `globus-prod-openai-api-key` | yes |
| `globus-prod-postgres-admin-password` | yes |
| `globus-prod-posthog-host` | yes |
| `globus-prod-posthog-key` | yes |
| `globus-prod-sandbox-mode` | yes |
| `globus-prod-sendgrid-api-key` | yes |
| `globus-prod-translation-glossary-id` | yes |
| `globus-seed-admin-email` | yes |
| `globus-seed-admin-password` | yes |
| `globus-sendgrid-api-key` | yes |
| `globus-sendgrid-from-email` | yes |
| `globus-session-secret` | yes |
| `globus-sevis-batch-user-id` | yes |
| `globus-sevis-cert-encryption-key` | yes |
| `globus-sevis-cert-file` | yes |
| `globus-sevis-cert-password` | yes |
| `globus-sevis-program-sponsor-id` | yes |
| `globus-vite-google-maps-api-key` | yes |
| `globus-webhook-secret` | yes |
| `host-portal-prod-anthropic-api-key` | yes |
| `host-portal-prod-auth0-audience` | yes |
| `host-portal-prod-auth0-client-id` | yes |
| `host-portal-prod-auth0-domain` | yes |
| `host-portal-prod-auth0-mgmt-audience` | yes |
| `host-portal-prod-auth0-mgmt-client-id` | yes |
| `host-portal-prod-auth0-mgmt-client-secret` | yes |
| `host-portal-prod-auth0-namespace` | yes |
| `host-portal-prod-globus-apikey` | yes |
| `host-portal-prod-globus-webhook-secret` | yes |
| `host-portal-prod-openai-api-key` | yes |
| `host-portal-prod-postgres-admin-password` | yes |
| `host-portal-prod-posthog-key` | yes |
| `host-portal-prod-sendgrid-api-key` | yes |
| `host-portal-prod-session-secret` | yes |
| `keycloak-prod-admin-password` | yes |
| `keycloak-prod-db-password` | yes |
| `n8n-prod-api-key` | yes |
| `n8n-prod-db-password` | yes |
| `n8n-prod-encryption-key` | yes |
| `n8n-prod-hubspot-webhook-secret` | no |
| `n8n-prod-kc-admin-user` | yes |
| `n8n-prod-postgres-admin-password` | yes |
| `n8n-prod-self-api-key` | yes |
| `ppp2-globus-api-key` | yes |
| `ppp2-keycloak-admin-client-secret` | yes |
| `ppp2-prod-globus-api-key` | yes |
| `ppp2-prod-keycloak-admin-client-secret` | yes |
| `ppp2-prod-passport-name-sync-secret` | yes |
| `wildpacks-prod-hubspot-token` | yes |

### Secret names: quality-assurance-496022

97 secrets.

| Secret name | Managed by Terraform |
| --- | --- |
| `cloudbuild-teams-notifier-qa-github-token` | yes |
| `cloudbuild-teams-notifier-qa-webhook-url` | yes |
| `db-query-proxy-qa-db-password` | no |
| `db-query-proxy-qa-token` | no |
| `github-qa-oauth-token` | yes |
| `globus-admin-db-url` | yes |
| `globus-applicant-portal-posthog-key` | yes |
| `globus-applicant-portal-webhook-url` | yes |
| `globus-asana-access-token` | yes |
| `globus-asana-client-id` | yes |
| `globus-asana-client-secret` | yes |
| `globus-backoffice-api-key` | yes |
| `globus-brave-api-key` | yes |
| `globus-database-url` | yes |
| `globus-document-bucket` | yes |
| `globus-entra-client-id` | yes |
| `globus-entra-client-secret` | yes |
| `globus-entra-tenant-id` | yes |
| `globus-github-config-repo-token` | yes |
| `globus-github-config-repo-write-token` | yes |
| `globus-google-maps-api-key` | yes |
| `globus-host-portal-webhook-url` | yes |
| `globus-internal-ocr-api-key` | yes |
| `globus-internal-translation-api-key` | yes |
| `globus-mcp-api-key` | yes |
| `globus-n8n-api-key` | yes |
| `globus-n8n-api-url` | yes |
| `globus-n8n-job-order-webhook-url` | yes |
| `globus-n8n-webhook-url-application` | yes |
| `globus-n8n-webhook-url-document` | yes |
| `globus-oidc-client-id` | yes |
| `globus-oidc-client-secret` | yes |
| `globus-oidc-discovery-url` | yes |
| `globus-openai-api-key` | yes |
| `globus-partner-pipeline-api-key` | yes |
| `globus-partner-pipeline-api-url` | yes |
| `globus-partner-pipeline-user-id` | yes |
| `globus-photo-bucket` | yes |
| `globus-pii-encryption-key` | yes |
| `globus-portal-session-secret` | yes |
| `globus-posthog-host` | yes |
| `globus-posthog-key` | yes |
| `globus-qa-docai-processor-id` | yes |
| `globus-qa-environment` | yes |
| `globus-qa-hubspot-api-key` | yes |
| `globus-qa-mailjet-api-key` | yes |
| `globus-qa-mailjet-from-email` | yes |
| `globus-qa-n8n-api-key` | yes |
| `globus-qa-n8n-globus-api-key` | yes |
| `globus-qa-netsuite-access-token` | yes |
| `globus-qa-netsuite-account-id` | yes |
| `globus-qa-netsuite-consumer-key` | yes |
| `globus-qa-netsuite-consumer-secret` | yes |
| `globus-qa-netsuite-realm` | yes |
| `globus-qa-netsuite-token-secret` | yes |
| `globus-qa-openai-api-key` | yes |
| `globus-qa-posthog-host` | yes |
| `globus-qa-sandbox-mode` | yes |
| `globus-qa-sendgrid-api-key` | yes |
| `globus-qa-template-admin-sendgrid-key` | no |
| `globus-qa-translation-endpoint` | yes |
| `globus-qa-translation-glossary-id` | yes |
| `globus-qa-vertex-qa-agent-id` | yes |
| `globus-seed-admin-email` | yes |
| `globus-seed-admin-password` | yes |
| `globus-sendgrid-api-key` | yes |
| `globus-sendgrid-from-email` | yes |
| `globus-sendgrid-from-name` | yes |
| `globus-session-secret` | yes |
| `globus-sevis-cert-encryption-key` | yes |
| `globus-sevis-cert-file` | yes |
| `globus-sevis-cert-password` | yes |
| `globus-vite-google-maps-api-key` | yes |
| `host-portal-qa-anthropic-api-key` | yes |
| `host-portal-qa-auth0-audience` | yes |
| `host-portal-qa-auth0-client-id` | yes |
| `host-portal-qa-auth0-domain` | yes |
| `host-portal-qa-auth0-mgmt-audience` | yes |
| `host-portal-qa-auth0-mgmt-client-id` | yes |
| `host-portal-qa-auth0-mgmt-client-secret` | yes |
| `host-portal-qa-auth0-namespace` | yes |
| `host-portal-qa-globus-apikey` | yes |
| `host-portal-qa-globus-webhook-secret` | yes |
| `host-portal-qa-openai-api-key` | yes |
| `host-portal-qa-posthog-key` | yes |
| `host-portal-qa-sendgrid-api-key` | yes |
| `host-portal-qa-session-secret` | yes |
| `keycloak-qa-admin-password` | yes |
| `keycloak-qa-db-password` | yes |
| `n8n-qa-db-password` | yes |
| `n8n-qa-encryption-key` | yes |
| `n8n-qa-hubspot-webhook-secret` | no |
| `ppp2-globus-api-key` | yes |
| `ppp2-keycloak-admin-client-secret` | yes |
| `ppp2-qa-globus-api-key` | yes |
| `ppp2-qa-keycloak-admin-client-secret` | yes |
| `wildpacks-qa-hubspot-token` | yes |

### Secret names: alliance-platform-agents

35 secrets.

| Secret name | Managed by Terraform |
| --- | --- |
| `POSTHOG_PERSONAL_API_KEY` | no |
| `asana-hygiene-agent-api-key` | no |
| `asana-hygiene-agent-gateway-pat` | no |
| `branch-drift-agent-api-key` | no |
| `branch-drift-agent-gateway-pat` | no |
| `branch-drift-agent-known-issues` | no |
| `dev-to-qa-sync-agent-api-key` | no |
| `dev-to-qa-sync-agent-gateway-pat` | no |
| `dev-to-qa-sync-agent-state` | no |
| `env-audit-agent-api-key` | no |
| `env-audit-agent-gateway-pat` | no |
| `globus-development-asana-access-token` | no |
| `n8n-api-key` | no |
| `observer-agent-v2-api-key` | no |
| `observer-agent-v2-gateway-pat` | no |
| `overseer-agent-api-key` | no |
| `overseer-agent-gateway-pat` | no |
| `overseer-agent-known-issues` | no |
| `overseer-agent-n8n-sync-state` | no |
| `overseer-agent-openai-api-key` | no |
| `platform-bot-github-pat` | no |
| `posthog-agent-api-key` | no |
| `posthog-agent-gateway-pat` | no |
| `pr-hygiene-agent-api-key` | yes |
| `pr-hygiene-agent-asana-pat` | no |
| `pr-hygiene-agent-gateway-pat` | yes |
| `qa-to-prod-sync-agent-api-key` | no |
| `qa-to-prod-sync-agent-gateway-pat` | no |
| `security-agent-api-key` | no |
| `security-agent-gateway-pat` | no |
| `security-agent-iac-scan-github-token` | no |
| `security-agent-openai-api-key` | no |
| `teams-platform-pulse-webhook-url` | no |
| `vertex-sync-agent-api-key` | no |
| `vertex-sync-agent-gateway-pat` | no |

### Data store resources in Terraform: development

| Terraform address | Module or resource type | Identifier | Defined in |
| --- | --- | --- | --- |
| `module.docs_update_agent_firestore` | `firestore-database` |  | `docs-update-agent-firestore.tf:1` |
| `module.n8n_dev_db` | `cloud-sql-postgres` | `n8n-dev-db` | `main.tf:764` |
| `module.applicant_portal_db_development` | `cloud-sql-postgres` | `applicant-portal-db-development` | `main.tf:779` |
| `module.participant_keycloak_db_development` | `cloud-sql-postgres` | `participant-keycloak-db-development` | `main.tf:819` |
| `module.npe_j1_visa_postgres_db` | `cloud-sql-postgres` | `npe-j1-visa-postgres-db` | `main.tf:831` |
| `module.globus_db_development` | `cloud-sql-postgres` | `globus-db-development` | `main.tf:845` |
| `module.mcp_db_development` | `cloud-sql-postgres` | `mcp-db-development` | `main.tf:895` |
| `module.redis_globus_cache_dev` | `redis-instance` | `globus-cache-dev` | `main.tf:1094` |
| `module.redis_keycloackparticipant_development` | `redis-instance` | `keycloackparticipant` | `main.tf:1109` |
| `module.bucket_applicant_portal_documents_development` | `storage-bucket` | `applicant-portal-documents-development` | `main.tf:2142` |
| `module.bucket_applicant_portal_photos_development` | `storage-bucket` | `applicant-portal-photos-development` | `main.tf:2153` |
| `module.bucket_development_globus_branding_assets` | `storage-bucket` | `development-globus-branding-assets` | `main.tf:2164` |
| `module.bucket_globus_documents_development` | `storage-bucket` | `globus-documents-development` | `main.tf:2172` |
| `module.bucket_globus_documents_prod` | `storage-bucket` | `globus-documents-prod` | `main.tf:2193` |
| `module.bucket_globus_documents_test` | `storage-bucket` | `globus-documents-test` | `main.tf:2205` |
| `module.bucket_globus_profile_photos_development` | `storage-bucket` | `globus-profile-photos-development` | `main.tf:2216` |
| `module.bucket_globus_profile_photos_prod` | `storage-bucket` | `globus-profile-photos-prod` | `main.tf:2223` |
| `module.bucket_globus_vertex_agent_prod` | `storage-bucket` | `globus-vertex-agent-prod` | `main.tf:2230` |
| `module.bucket_globus_vertex_agent_staging` | `storage-bucket` | `globus-vertex-agent-staging` | `main.tf:2238` |
| `module.bucket_host_portal_metrics_storage` | `storage-bucket` | `host-portal-metrics-storage` | `main.tf:2246` |
| `module.bucket_manus_agent_builds_469819` | `storage-bucket` | `manus-agent-builds-469819` | `main.tf:2254` |
| `module.bucket_openstatus_sqld_data` | `storage-bucket` | `openstatus-sqld-data-skilled-script-469819-f2` | `main.tf:2262` |
| `module.bucket_skilled_script_cloudbuild_source` | `storage-bucket` | `skilled-script-469819-f2-cloudbuild-source` | `main.tf:2274` |
| `module.n8n_db_dev` | `cloud-sql-postgres` | `n8n-db-dev` | `n8n-dev-standalone.tf:26` |
| `module.n8n_db_sandbox` | `cloud-sql-postgres` | `n8n-db-sandbox` | `n8n-sandbox-standalone.tf:24` |
| `module.openstatus_alert_agent_firestore` | `firestore-database` |  | `openstatus-alert-agent-firestore.tf:1` |
| `module.pr_review_eligibility_agent_firestore` | `firestore-database` |  | `pr-review-eligibility-agent-firestore.tf:1` |
| `module.user_addition_agent_firestore` | `firestore-database` |  | `user-addition-agent-firestore.tf:1` |

### Data store resources in Terraform: mcp

| Terraform address | Module or resource type | Identifier | Defined in |
| --- | --- | --- | --- |
| `module.alliance_mcp_gateway_db` | `cloud-sql-postgres` | `alliance-mcp-gateway-db` | `main.tf:142` |

### Data store resources in Terraform: platform-services

| Terraform address | Module or resource type | Identifier | Defined in |
| --- | --- | --- | --- |
| `google_sql_database_instance.itrequestportal` | `google_sql_database_instance` | `itrequestportal-db` | `itrequestportal.tf:167` |
| `module.sys_n8n_db` | `cloud-sql-postgres` | `sys-n8n-db` | `sys-n8n.tf:70` |

### Data store resources in Terraform: production

| Terraform address | Module or resource type | Identifier | Defined in |
| --- | --- | --- | --- |
| `module.globus_db_prod` | `cloud-sql-postgres` | `globus-db-prod` | `main.tf:641` |
| `module.n8n_db_prod` | `cloud-sql-postgres` | `n8n-db-prod` | `main.tf:667` |
| `module.keycloak_db_prod` | `cloud-sql-postgres` | `keycloak-db-prod` | `main.tf:680` |
| `module.n8n_redis_prod` | `redis-instance` | `n8n-redis-prod` | `main.tf:1177` |
| `module.bucket_globus_prod_documents` | `storage-bucket` | `globus-prod-documents` | `main.tf:2069` |
| `module.bucket_globus_prod_photos` | `storage-bucket` | `globus-prod-photos` | `main.tf:2076` |
| `module.bucket_prod_globus_branding_assets` | `storage-bucket` | `prod-globus-branding-assets` | `main.tf:2083` |
| `module.bucket_prod_tfstate_own_backend` | `storage-bucket` | `prod-tfstate-production-499116` | `main.tf:2090` |

### Data store resources in Terraform: qa

| Terraform address | Module or resource type | Identifier | Defined in |
| --- | --- | --- | --- |
| `module.globus_db_qa` | `cloud-sql-postgres` | `globus-db-qa` | `main.tf:695` |
| `module.n8n_db_qa` | `cloud-sql-postgres` | `n8n-db-qa` | `main.tf:723` |
| `module.keycloak_db_qa` | `cloud-sql-postgres` | `keycloak-db-qa` | `main.tf:736` |
| `module.n8n_redis_qa` | `redis-instance` | `n8n-redis-qa` | `main.tf:1305` |
| `module.bucket_globus_qa_documents` | `storage-bucket` | `globus-qa-documents` | `main.tf:2165` |
| `module.bucket_globus_qa_photos` | `storage-bucket` | `globus-qa-photos` | `main.tf:2182` |
| `module.bucket_qa_globus_branding_assets` | `storage-bucket` | `qa-globus-branding-assets` | `main.tf:2244` |
| `module.bucket_qa_tfstate_own_backend` | `storage-bucket` | `qa-tfstate-quality-assurance-496022` | `main.tf:2251` |

### Live data stores: skilled-script-469819-f2

#### Cloud Run services (live)

| Service | Region | Ingress | Scaling | Runs as |
| --- | --- | --- | --- | --- |
| `applicant-keycloak` | `northamerica-northeast1` | `all` | `1-1` | `382570452229-compute@developer.gserviceaccount.com` |
| `bug-diagnosis-agent` | `us-central1` | `all` | `0-100` | `bug-diagnosis-agent@skilled-script-469819-f2.iam.gserviceaccount.com` |
| `docs-update-agent` | `us-central1` | `all` | `0-1` | `docs-update-agent-sa@skilled-script-469819-f2.iam.gserviceaccount.com` |
| `gcp-mcp-server` | `us-central1` | `all` | `1-10` | `manus-agent-sa@skilled-script-469819-f2.iam.gserviceaccount.com` |
| `gke-workload-health-agent` | `us-central1` | `all` | `0-1` | `gke-workload-health-agent-sa@skilled-script-469819-f2.iam.gserviceaccount.com` |
| `host-company-portal-client` | `northamerica-northeast1` | `all` | `1-1` | `host-service-potal@skilled-script-469819-f2.iam.gserviceaccount.com` |
| `host-company-portal-server` | `northamerica-northeast1` | `all` | `1-1` | `backend-service-potal@skilled-script-469819-f2.iam.gserviceaccount.com` |
| `openstatus-alert-agent` | `us-central1` | `all` | `0-1` | `openstatus-alert-agent-sa@skilled-script-469819-f2.iam.gserviceaccount.com` |
| `ppp2-participant-client` | `northamerica-northeast1` | `all` | `0-2` | `382570452229-compute@developer.gserviceaccount.com` |
| `ppp2-participant-server` | `northamerica-northeast1` | `all` | `0-3` | `382570452229-compute@developer.gserviceaccount.com` |
| `pr-latency-agent` | `us-central1` | `all` | `0-1` | `pr-latency-agent-sa@skilled-script-469819-f2.iam.gserviceaccount.com` |
| `pr-review-eligibility-agent` | `us-central1` | `all` | `0-100` | `pr-review-eligibility-agent@skilled-script-469819-f2.iam.gserviceaccount.com` |
| `sandbox-web-dev-1` | `us-central1` | `all` | `0-2` | `sandbox-runtime-dev@skilled-script-469819-f2.iam.gserviceaccount.com` |
| `sandbox-web-dev-2` | `us-central1` | `all` | `0-2` | `sandbox-runtime-dev@skilled-script-469819-f2.iam.gserviceaccount.com` |
| `sandbox-web-dev-3` | `us-central1` | `all` | `0-2` | `sandbox-runtime-dev@skilled-script-469819-f2.iam.gserviceaccount.com` |
| `secrets-drift-agent` | `us-central1` | `all` | `0-1` | `secrets-drift-agent-sa@skilled-script-469819-f2.iam.gserviceaccount.com` |
| `user-addition-agent` | `us-central1` | `all` | `0-1` | `user-addition-agent-sa@skilled-script-469819-f2.iam.gserviceaccount.com` |
| `wildpacks-development` | `us-central1` | `all` | `0-3` | `wildpacks-dev-runtime@skilled-script-469819-f2.iam.gserviceaccount.com` |

#### Cloud SQL instances (live)

| Instance | Region | Version | Tier | Edition | Private IP | Backups |
| --- | --- | --- | --- | --- | --- | --- |
| `n8n-dev-db` | `us-central1` | `POSTGRES_15` | `db-g1-small` | `ENTERPRISE` | `true` | `true` |
| `applicant-portal-db-development` | `us-central1` | `POSTGRES_15` | `db-custom-1-3840` | `ENTERPRISE` | `true` | `true` |
| `participant-keycloak-db-development` | `us-central1` | `POSTGRES_15` | `db-g1-small` | `ENTERPRISE` | `true` | `true` |
| `n8n-db-sandbox` | `us-central1` | `POSTGRES_15` | `db-g1-small` | `ENTERPRISE` | `true` | `true` |
| `npe-j1-visa-postgres-db` | `us-central1` | `POSTGRES_15` | `db-f1-micro` | `ENTERPRISE` | `true` | `true` |
| `globus-db-development` | `us-central1` | `POSTGRES_15` | `db-custom-1-3840` | `ENTERPRISE` | `true` | `true` |
| `n8n-db-dev` | `us-central1` | `POSTGRES_15` | `db-g1-small` | `ENTERPRISE` | `true` | `true` |
| `mcp-db-development` | `us-central1` | `POSTGRES_15` | `db-custom-1-3840` | `ENTERPRISE` | `true` | `true` |

#### Redis instances (live)

| Instance | Region | Tier | Memory GB | Version |
| --- | --- | --- | --- | --- |
| `keycloackparticipant` | `northamerica-northeast1` | `BASIC` |  | `REDIS_7_2` |
| `globus-cache-dev` | `us-central1` | `BASIC` |  | `REDIS_7_0` |

#### Cloud Storage buckets (live)

| Bucket | Location | Class | Versioning | Public access prevention |
| --- | --- | --- | --- | --- |
| `481e243513174cba93c5a766e5db6d40_clouddeploy` | `NORTHAMERICA-NORTHEAST1` |  |  |  |
| `applicant-portal-documents-development` | `US-CENTRAL1` |  | `false` |  |
| `applicant-portal-photos-development` | `US-CENTRAL1` |  | `false` |  |
| `dev-tfstate-skilled-script-469819-f2` | `US-CENTRAL1` |  | `true` |  |
| `development-globus-branding-assets` | `US-CENTRAL1` |  | `false` |  |
| `gcf-v2-sources-382570452229-us-central1` | `US-CENTRAL1` |  | `true` |  |
| `gcf-v2-uploads-382570452229.us-central1.cloudfunctions.appspot.com` | `US-CENTRAL1` |  |  |  |
| `globus-documents-development` | `US-CENTRAL1` |  | `false` |  |
| `globus-documents-prod` | `US-CENTRAL1` |  | `false` |  |
| `globus-documents-test` | `US-CENTRAL1` |  | `false` |  |
| `globus-profile-photos-development` | `US-CENTRAL1` |  | `false` |  |
| `globus-profile-photos-prod` | `US-CENTRAL1` |  | `false` |  |
| `globus-vertex-agent-prod` | `US-CENTRAL1` |  | `false` |  |
| `globus-vertex-agent-staging` | `US-CENTRAL1` |  | `false` |  |
| `host-portal-db-backups-development` | `US-CENTRAL1` |  |  |  |
| `host-portal-metrics-storage` | `NORTHAMERICA-NORTHEAST1` |  | `false` |  |
| `host-portal-public-assets` | `US` |  |  |  |
| `manus-agent-builds-469819` | `US-CENTRAL1` |  | `false` |  |
| `northamerica-northeast1.deploy-artifacts.skilled-script-469819-f2.appspot.com` | `NORTHAMERICA-NORTHEAST1` |  |  |  |
| `openstatus-sqld-data-skilled-script-469819-f2` | `US-CENTRAL1` |  | `false` |  |
| `pr-review-eligibility-agent-claims` | `US-CENTRAL1` |  |  |  |
| `run-sources-skilled-script-469819-f2-us-central1` | `US-CENTRAL1` |  |  |  |
| `skilled-script-469819-f2-cloudbuild-source` | `US-CENTRAL1` |  | `false` |  |
| `skilled-script-469819-f2_cloudbuild` | `US` |  |  |  |
| `terraform-state-bucket-npe` | `US-EAST1` |  | `true` |  |
| `terraform-state-skilled-script-prod` | `NORTHAMERICA-NORTHEAST1` |  |  |  |

#### Workload Identity pools (live)

| Pool | State | Providers |
| --- | --- | --- |
| `github-actions-apply-dev` | `ACTIVE` | `github-provider` |
| `github-actions-sandbox` | `ACTIVE` | `github-provider` |
| `manus-pool` | `ACTIVE` | `manus-provider` |
| `github-actions-n8n-wf` | `ACTIVE` | `github-provider` |
| `github-actions` | `ACTIVE` | `github` |
| `github-actions-iac` | `ACTIVE` | `github-provider` |
| `skilled-script-469819-f2.svc.id.goog` | `ACTIVE` |  |

#### Cloud Scheduler jobs (live)

| Job | Schedule | State |
| --- | --- | --- |
| `docs-update-agent-sweep` | `0 13 * * *` | `ENABLED` |
| `docs-update-agent-drift-check` | `0 12 * * 1` | `ENABLED` |

### Live data stores: alliance-mcp-services

#### Cloud Run services (live)

| Service | Region | Ingress | Scaling | Runs as |
| --- | --- | --- | --- | --- |
| `alliance-mcp-gateway` | `northamerica-northeast1` | `all` | `1-1` | `alliance-mcp-gateway-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `alliance-mcp-gateway-admin` | `northamerica-northeast1` | `all` | `0-3` | `627350954379-compute@developer.gserviceaccount.com` |
| `asana-mcp` | `us-central1` | `all` | `0-3` | `asana-mcp-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `auth0-mcp-server` | `us-central1` | `all` | `0-20` | `auth0-mcp-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `azure-mcp` | `us-central1` | `all` | `0-3` | `azure-mcp-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `gcp-mcp-server` | `us-central1` | `all` | `1-10` | `gcp-mcp-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `github-mcp` | `us-central1` | `all` | `0-3` | `github-mcp-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `globus-backoffice-mcp` | `us-central1` | `all` | `0-3` | `globus-backoffice-mcp-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `globus-mcp-development` | `us-central1` | `all` | `1-5` | `globus-mcp-dev-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `godaddy-mcp` | `us-central1` | `all` | `0-10` | `godaddy-mcp-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `google-workspace-mcp` | `us-central1` | `all` | `0-3` | `gws-mcp-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `hubspot-mcp` | `us-central1` | `all` | `0-3` | `hubspot-mcp-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `itrequest-mcp` | `northamerica-northeast1` | `all` | `0-?` | `itrequest-mcp-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `nexus-hub` | `us-central1` | `all` | `1-5` | `nexus-hub-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `onepassword-mcp` | `us-central1` | `all` | `0-10` | `onepassword-mcp-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `openstatus-mcp` | `us-central1` | `all` | `0-10` | `openstatus-mcp-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `outlook-mcp` | `us-central1` | `all` | `0-3` | `627350954379-compute@developer.gserviceaccount.com` |
| `platform-hub` | `us-central1` | `internal-and-cloud-load-balancing` | `1-3` | `platform-hub-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `posthog-mcp` | `us-central1` | `all` | `0-3` | `posthog-mcp-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `replitmcp` | `us-central1` | `all` | `0-2` | `globus-mcp-dev-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `teams-mcp` | `us-central1` | `all` | `1-20` | `teams-mcp-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `teams-mcp-bot` | `us-central1` | `all` | `0-2` | `teams-mcp-sa@alliance-mcp-services.iam.gserviceaccount.com` |
| `wordpress-mcp` | `us-central1` | `all` | `0-10` | `wordpress-mcp-sa@alliance-mcp-services.iam.gserviceaccount.com` |

### Live data stores: production-499116

#### Cloud Run services (live)

| Service | Region | Ingress | Scaling | Runs as |
| --- | --- | --- | --- | --- |
| `applicant-keycloak` | `northamerica-northeast1` | `all` | `1-3` | `keycloak-runtime-prod@production-499116.iam.gserviceaccount.com` |
| `cloudbuild-teams-notifier` | `us-central1` | `internal-and-cloud-load-balancing` | `0-3` | `cloudbuild-teams-notifier@production-499116.iam.gserviceaccount.com` |
| `db-query-proxy-prod` | `us-central1` | `all` | `0-2` | `db-query-proxy-prod-runtime@production-499116.iam.gserviceaccount.com` |
| `db-query-proxy-prod-broker` | `us-central1` | `all` | `0-2` | `db-query-proxy-prod-broker@production-499116.iam.gserviceaccount.com` |
| `host-company-portal-client-prod` | `northamerica-northeast1` | `all` | `2-4` | `host-portal-client-run-prod@production-499116.iam.gserviceaccount.com` |
| `host-company-portal-server-prod` | `northamerica-northeast1` | `all` | `1-1` | `host-portal-server-run-prod@production-499116.iam.gserviceaccount.com` |
| `ppp2-participant-client-prod` | `northamerica-northeast1` | `all` | `1-3` | `ppp2-client-prod@production-499116.iam.gserviceaccount.com` |
| `ppp2-participant-server-prod` | `northamerica-northeast1` | `all` | `1-5` | `ppp2-server-prod@production-499116.iam.gserviceaccount.com` |
| `sandbox-web-prod` | `us-central1` | `all` | `0-2` | `sandbox-runtime-prod@production-499116.iam.gserviceaccount.com` |

#### Cloud SQL instances (live)

| Instance | Region | Version | Tier | Edition | Private IP | Backups |
| --- | --- | --- | --- | --- | --- | --- |
| `n8n-db-prod` | `us-central1` | `POSTGRES_15` | `db-g1-small` | `ENTERPRISE` | `true` | `true` |
| `globus-db-prod` | `us-central1` | `POSTGRES_16` | `db-custom-2-7680` | `ENTERPRISE` | `true` | `true` |
| `keycloak-db-prod` | `us-central1` | `POSTGRES_15` | `db-g1-small` | `ENTERPRISE` | `true` | `true` |

#### Redis instances (live)

| Instance | Region | Tier | Memory GB | Version |
| --- | --- | --- | --- | --- |
| `n8n-redis-prod` | `us-central1` | `BASIC` | `1` | `REDIS_7_2` |

#### Cloud Storage buckets (live)

| Bucket | Location | Class | Versioning | Public access prevention |
| --- | --- | --- | --- | --- |
| `globus-prod-documents` | `US-CENTRAL1` | `STANDARD` | `false` | `inherited` |
| `globus-prod-photos` | `US-CENTRAL1` | `STANDARD` | `false` | `inherited` |
| `host-portal-db-backups-prod` | `US-CENTRAL1` | `STANDARD` |  | `enforced` |
| `prod-globus-branding-assets` | `US-CENTRAL1` | `STANDARD` | `false` | `inherited` |
| `prod-tfstate-production-499116` | `US-CENTRAL1` | `STANDARD` | `true` | `inherited` |
| `production-499116-db-migration` | `US-CENTRAL1` | `STANDARD` |  | `enforced` |
| `production-499116_cloudbuild` | `US-CENTRAL1` | `STANDARD` |  | `enforced` |
| `terraform-state-bucket-produ` | `NORTHAMERICA-NORTHEAST1` | `STANDARD` | `true` | `enforced` |

#### Workload Identity pools (live)

| Pool | State | Providers |
| --- | --- | --- |
| `github-actions-apply-prod` | `ACTIVE` | `github-provider` |
| `github-actions-sandbox` | `ACTIVE` | `github-provider` |
| `github-actions-iac` | `ACTIVE` | `github-provider` |
| `github-actions-pool` | `ACTIVE` | `github-provider` |
| `production-499116.svc.id.goog` | `ACTIVE` |  |

### Live data stores: quality-assurance-496022

#### Cloud Run services (live)

| Service | Region | Ingress | Scaling | Runs as |
| --- | --- | --- | --- | --- |
| `applicant-keycloak` | `northamerica-northeast1` | `all` | `1-3` | `keycloak-runtime-qa@quality-assurance-496022.iam.gserviceaccount.com` |
| `cloudbuild-teams-notifier` | `us-central1` | `internal-and-cloud-load-balancing` | `0-3` | `cloudbuild-teams-notifier@quality-assurance-496022.iam.gserviceaccount.com` |
| `db-query-proxy-qa` | `us-central1` | `all` | `0-2` | `db-query-proxy-qa-runtime@quality-assurance-496022.iam.gserviceaccount.com` |
| `host-portal-qa-client` | `us-central1` | `all` | `0-3` | `host-portal-qa-runtime@quality-assurance-496022.iam.gserviceaccount.com` |
| `host-portal-qa-server` | `us-central1` | `all` | `0-3` | `host-portal-qa-runtime@quality-assurance-496022.iam.gserviceaccount.com` |
| `ppp2-participant-client-qa` | `northamerica-northeast1` | `all` | `0-2` | `ppp2-client-qa@quality-assurance-496022.iam.gserviceaccount.com` |
| `ppp2-participant-server-qa` | `northamerica-northeast1` | `all` | `0-3` | `ppp2-server-qa@quality-assurance-496022.iam.gserviceaccount.com` |
| `sandbox-web-qa-1` | `us-central1` | `all` | `0-2` | `sandbox-runtime-qa@quality-assurance-496022.iam.gserviceaccount.com` |
| `sandbox-web-qa-2` | `us-central1` | `all` | `0-2` | `sandbox-runtime-qa@quality-assurance-496022.iam.gserviceaccount.com` |
| `sandbox-web-qa-3` | `us-central1` | `all` | `0-2` | `sandbox-runtime-qa@quality-assurance-496022.iam.gserviceaccount.com` |
| `wildpacks-qa` | `us-central1` | `all` | `0-3` | `wildpacks-qa-runtime@quality-assurance-496022.iam.gserviceaccount.com` |

#### Cloud SQL instances (live)

| Instance | Region | Version | Tier | Edition | Private IP | Backups |
| --- | --- | --- | --- | --- | --- | --- |
| `keycloak-db-qa` | `us-central1` | `POSTGRES_15` | `db-g1-small` | `ENTERPRISE` | `true` | `true` |
| `globus-db-qa` | `us-central1` | `POSTGRES_16` | `db-custom-2-7680` | `ENTERPRISE` | `true` | `true` |
| `n8n-db-qa` | `us-central1` | `POSTGRES_15` | `db-g1-small` | `ENTERPRISE` | `true` | `true` |

#### Redis instances (live)

| Instance | Region | Tier | Memory GB | Version |
| --- | --- | --- | --- | --- |
| `n8n-redis-qa` | `us-central1` | `BASIC` | `1` |  |

#### Cloud Storage buckets (live)

| Bucket | Location | Class | Versioning | Public access prevention |
| --- | --- | --- | --- | --- |
| `globus-qa-documents` | `US-CENTRAL1` | `STANDARD` | `false` | `inherited` |
| `globus-qa-photos` | `US-CENTRAL1` | `STANDARD` | `false` | `inherited` |
| `host-portal-db-backups-qa` | `US-CENTRAL1` | `STANDARD` |  | `enforced` |
| `host-portal-public-assets-qa` | `US` | `STANDARD` |  | `inherited` |
| `qa-cloudbuild-staging-496022` | `NORTHAMERICA-NORTHEAST1` | `STANDARD` |  | `enforced` |
| `qa-globus-branding-assets` | `US-CENTRAL1` | `STANDARD` | `false` | `inherited` |
| `qa-tfstate-quality-assurance-496022` | `US-CENTRAL1` | `STANDARD` | `true` | `inherited` |
| `quality-assurance-496022_cloudbuild` | `US-CENTRAL1` | `STANDARD` |  | `enforced` |

#### Workload Identity pools (live)

| Pool | State | Providers |
| --- | --- | --- |
| `github-actions-iac` | `ACTIVE` | `github-provider` |
| `github-actions-pool` | `ACTIVE` | `github-provider` |
| `github-actions-apply-qa` | `ACTIVE` | `github-provider` |
| `github-actions-sandbox` | `ACTIVE` | `github-provider` |
| `quality-assurance-496022.svc.id.goog` | `ACTIVE` |  |

### Live data stores: alliance-platform-agents

#### Cloud Run services (live)

| Service | Region | Ingress | Scaling | Runs as |
| --- | --- | --- | --- | --- |
| `asana-hygiene-agent` | `us-central1` | `all` | `0-1` | `asana-hygiene-agent-sa@alliance-platform-agents.iam.gserviceaccount.com` |
| `branch-drift-agent` | `us-central1` | `all` | `0-1` | `branch-drift-agent-sa@alliance-platform-agents.iam.gserviceaccount.com` |
| `cloudbuild-teams-notifier` | `us-central1` | `all` | `0-3` | `cloudbuild-teams-notifier-sa@alliance-platform-agents.iam.gserviceaccount.com` |
| `dev-to-qa-sync-agent` | `us-central1` | `all` | `0-1` | `dev-to-qa-sync-agent-sa@alliance-platform-agents.iam.gserviceaccount.com` |
| `env-audit-agent` | `us-central1` | `all` | `0-1` | `env-audit-agent-sa@alliance-platform-agents.iam.gserviceaccount.com` |
| `github-token-minter` | `us-central1` | `all` | `0-3` | `github-token-minter-sa@alliance-platform-agents.iam.gserviceaccount.com` |
| `posthog-agent` | `us-central1` | `all` | `0-1` | `posthog-agent-sa@alliance-platform-agents.iam.gserviceaccount.com` |
| `pr-hygiene-agent` | `us-central1` | `all` | `0-100` | `pr-hygiene-agent-sa@alliance-platform-agents.iam.gserviceaccount.com` |
| `qa-to-prod-sync-agent` | `us-central1` | `all` | `0-1` | `qa-to-prod-sync-agent-sa@alliance-platform-agents.iam.gserviceaccount.com` |
| `security-agent` | `us-central1` | `all` | `0-1` | `security-agent-sa@alliance-platform-agents.iam.gserviceaccount.com` |
| `vertex-sync-agent` | `us-central1` | `all` | `0-1` | `vertex-sync-agent-sa@alliance-platform-agents.iam.gserviceaccount.com` |

#### Cloud Storage buckets (live)

| Bucket | Location | Class | Versioning | Public access prevention |
| --- | --- | --- | --- | --- |
| `alliance-platform-agents_cloudbuild` | `US` | `STANDARD` | `false` | `inherited` |
| `platform-agents-tfstate-alliance-platform-agents` | `US-CENTRAL1` | `STANDARD` | `true` | `inherited` |
| `run-sources-alliance-platform-agents-us-central1` | `US-CENTRAL1` | `STANDARD` | `false` | `inherited` |

#### Cloud Scheduler jobs (live)

| Job | Schedule | State |
| --- | --- | --- |
| `branch-drift-agent-scan` | `0 */6 * * *` | `ENABLED` |
| `vertex-sync-agent-hourly` | `0 * * * *` | `ENABLED` |

## Secrets

Secrets are managed as containers only. Two modules exist:

- `modules/secret-manager-secret` derives the id as `<system>-<component>-<env>-<key>`, or `<system>-<env>-<key>` when the system has one component, with `secret_id_override` as an escape hatch. It also creates `roles/secretmanager.secretAccessor` bindings for a list of service account emails. It ignores label changes and never manages versions.
- `modules/secret-manager-secret-bulk` imports many containers at once under their exact historical names, with optional per-secret accessor bindings. Its README records the QA import: roughly 200 containers, accessor bindings reproduced from live policy, and bindings to deleted principals deliberately dropped because they grant no access. Names from this path do not follow the standard (for example `secret-alias-N`, `applicant-*`, `ppp2-*`), because renaming a container breaks every consumer that reads it by name.

In 2026-08 QA and prod added short names (`globus-database-url`, `globus-session-secret` and similar) next to the older `globus-qa-*` / `globus-prod-*` names, since the project already identifies the environment. Those were imported, not applied (`environments/qa/globus-short-secret-names-pilot.tf`, `environments/production/globus-short-secret-names-migration.tf`). Names therefore mix three conventions per project; always look up the exact name before wiring a consumer.

The dev, QA, prod, MCP and agents snapshots record automatic replication for their secrets. The bulk module also supports a user-managed replication outlier (a GitHub OAuth token secret historically pinned to `us-central1`), but that secret is now declared as `github-qa-oauth-token` / `github-prod-oauth-token` and the live snapshots do not show a user-managed secret.

Accessor bindings can cross projects: `environment-index-sa` in `alliance-platform-services` holds `roles/secretmanager.secretAccessor` on the dev secrets `github-agent-workflow-app-id` and `github-agent-workflow-app-private-key` (declared in `environments/development/main.tf`), and the `environment-index` Cloud Run service reads them as `GH_APP_ID` and `GH_APP_PRIVATE_KEY` at version `latest`. Terraform sets only that initial env and ignores later env changes, because the repo's `deploy.yml` owns the service's env. The `alliance-mcp-services` predecessor was removed 2026-10-05. The board's own secret containers (for example `environment-index-session-secret`) are declared in `environments/platform-services/environment-index.tf`; like `itrequestportal.tf` in that directory, they are live but were not created through Terraform.

The dev secret `atlas-agent-gateway-pat` is another cross-project case. It is declared in `environments/development/main.tf`, was created with `gcloud` on 2026-10-06, and its value is set out-of-band. `atlas-agent-sa` in `alliance-platform-agents` holds `roles/secretmanager.secretAccessor` on it. Per the Terraform comments, the `atlas-agent` Cloud Run service in `alliance-platform-agents` reads its gateway robot PAT from this project.

Rotation is operational, not declarative: write a new version out-of-band, then make consumers pick it up. Cloud Run services that pin a version number or read `latest` need a new revision; GKE workloads read through ExternalSecrets, so a forced sync or a pod restart is needed. Trailing newlines in values have caused real failures, so write values without them. The runbook set is in `/docs/gcp-runbooks` and the `gcp-secrets-ops` skill; `/docs/onboarding-security-secrets` has the general developer rules.

### ExternalSecrets on GKE

GKE workloads consume Secret Manager through the External Secrets Operator (ESO) in the `external-secrets` namespace; the Terraform comments say it is installed with Helm in QA and prod and is outside Terraform's scope. In dev the `external-secrets` Kubernetes service account is bound through Workload Identity to the `globus-dev-runtime` Google service account, which also serves the Globus app; its project-wide secret accessor role was replaced with an explicit per-secret list (`environments/development/main.tf`). The dev secret `globus-webhook-secret` was created live with `gcloud` and imported in `environments/development/drift-reconciliation-2026-10-05-globus-webhook-secret.tf`. Per the Terraform comments, the BOP dev ExternalSecrets in `k8s/development` and `k8s/pool/dev` sync it as `GLOBUS_WEBHOOK_SECRET`. Its accessor is recorded as a project-level `roles/secretmanager.secretAccessor` on `globus-dev-runtime`, with no per-secret binding. QA uses `external-secrets-qa-runtime` and prod `external-secrets-prod-runtime`, each declared with a project-level `roles/secretmanager.secretAccessor`, which is why QA secrets need no per-secret bindings for ESO. This is broad by design in QA and prod: ESO can read every secret in the project. Cloud Run services instead mount secrets with their own dedicated runtime service accounts and per-secret bindings.

The ExternalSecret manifests themselves live in application repos, not here, and no kubectl data was collected, so which secrets each namespace actually syncs is not verified on this page.

## Cloud SQL

The module `modules/cloud-sql-postgres` takes its defaults from the dominant live shape: private IP, backups on, `ssl_mode = TRUSTED_CLIENT_CERTIFICATE_REQUIRED`, zonal availability, point-in-time recovery off. `ssl_mode`, `ipv4_enabled`, `backup_enabled` and the private-path flag are variables so that outliers are declared honestly instead of hidden with `ignore_changes`.

Standard instance names are `<system>-db-<env>`; live names are older and mixed. By environment (live snapshots, 2026-10-01):

- Development (`skilled-script-469819-f2`, `us-central1`, all Postgres 15): the Globus instance `globus-db-development` (databases include `globus_development`, `globus_development_test`, `nexus_hub`), `applicant-portal-db-development` and `participant-keycloak-db-development` (Applicant Portal and its Keycloak), `n8n-db-dev` plus the older `n8n-dev-db` and `n8n-db-sandbox`, `mcp-db-development` (databases `globus_mcp` and `mcp_gateway_qa`) and `npe-j1-visa-postgres-db` on the separate `skilled-script-vpc-npe` network.
- QA (`quality-assurance-496022`): `globus-db-qa` (Postgres 16, database named `globus_staging` despite there being no staging environment), `keycloak-db-qa`, `n8n-db-qa`.
- Production (`production-499116`): `globus-db-prod` (Postgres 16), `keycloak-db-prod`, `n8n-db-prod`.
- MCP (`alliance-mcp-services`): Terraform declares `alliance-mcp-gateway-db` in `environments/mcp/main.tf`; it could not be read live.
- Platform services: Terraform declares an IT-request portal database and `sys-n8n-db`; the project could not be read.

Connection patterns: Per the module notes, consumers connect through the Cloud SQL Auth Proxy: Cloud Run via the Cloud SQL socket annotation, GKE pods via a sidecar. The proxy handles mTLS, which is why the strict client-certificate mode is the default. The exception is anything connecting over plain JDBC: Keycloak uses `ENCRYPTED_ONLY` in both QA and prod (`keycloak-db-qa`, `keycloak-db-prod`), because the app has no client certificate. Prod and QA instances are zonal with backups enabled; the prod snapshot shows PITR off, and `/docs/disaster-recovery-plan` audits the absence of PITR as an RPO gap.

Both that page and the module agree on the SSL change for Keycloak; the live snapshots match it (`ENCRYPTED_ONLY`), so the "confirm live matches" caveat in the DR plan can be considered closed for QA and prod.

## Redis, Firestore and Storage

- Redis (Memorystore, BASIC tier, 1 GB, so no HA): `globus-cache-dev` and `keycloackparticipant` in dev, `n8n-redis-qa` in QA, `n8n-redis-prod` in prod. The `keycloackparticipant` spelling is the live name and cannot be changed in place. Transit encryption is recorded as disabled on the dev Keycloak instance and on `n8n-redis-prod`; it is not recorded for the other instances.
- Firestore: the databases found are all agent-related. Dev holds Native databases named after agents (`user-addition-agent`, `pr-review-eligibility-agent`, `openstatus-alert-agent`, `docs-update-agent`, `bug-diagnosis-agent`), and the agents project has a `(default)` database in `us-central1`. QA and prod have the Firestore API disabled.
- Buckets by purpose: application data (`globus-documents-*`, `globus-profile-photos-*` in dev; `globus-qa-documents`, `globus-qa-photos`; `globus-prod-documents`, `globus-prod-photos`; `applicant-portal-documents-*`, `applicant-portal-photos-*`), branding assets (`<env>-globus-branding-assets`), Host Portal database backups (`host-portal-db-backups-<env>`, public access prevention enforced) and Terraform state (`dev-tfstate-skilled-script-469819-f2`, `qa-tfstate-quality-assurance-496022`, `prod-tfstate-production-499116`; `mcp-tfstate-alliance-mcp-services` and `platform-services-tfstate-alliance-platform-services` are the declared backends of those stacks; the vertex stack's backend points at the dev bucket, while the agents project also has a live `platform-agents-tfstate-alliance-platform-agents` bucket). The dev, QA and prod state buckets are versioned in the snapshots; the MCP and platform-services backends are declared in Terraform but their buckets could not be read. Cloud Build and Cloud Deploy plumbing buckets are created by GCP and are not declared.
- Artifact Registry: Docker repositories per system across the projects (for example `globus`, `portal`, `wildpacks`, `ppp2`, `applicants-portal`, `host-company-portal`, `applicant-portal`), plus remote repositories used as pull-through mirrors (`keycloak-upstream`, and the npm mirrors `globus-npm` and `sevis-npm` in dev).

## Security observations

These are facts from the read-only snapshots and should be reviewed; they are not new findings from this page.

- Public IPv4 on Cloud SQL: `globus-db-development` and `mcp-db-development` have a public address (dev snapshot); Terraform records the first as a live setting and the MCP one as an allowlisted admin address. The Terraform-declared MCP gateway database has a public address, no private network, backups off and `ALLOW_UNENCRYPTED_AND_ENCRYPTED`; this was not confirmed live.
- All other instances read have private IP only. Instances in all three read projects use client-certificate-required SSL, except `keycloak-db-qa` and `keycloak-db-prod`, which use `ENCRYPTED_ONLY`.
- Redis transit encryption is recorded as off on two instances (see above).
- The dev project holds buckets named for other environments (`globus-documents-prod`, `globus-profile-photos-prod`, `terraform-state-skilled-script-prod`) and one named `globus-vertex-agent-staging`, plus cross-project access Terraform for the prod photo bucket. Several QA and prod app-data buckets have public access prevention `inherited` rather than `enforced`.
- Dev project IAM includes principals from external company domains with `roles/storage.admin` (two users from one domain) and BigQuery admin (one user from another); QA has a temporary external user with Cloud SQL instance access. Project-level `owner` is also held by a service account in dev and by one in QA. Review whether these still need data-store access.
- One dev API key (the Maps rotation key) has no API target restriction.

## Known gaps

- `alliance-platform-services` was unreadable and `alliance-mcp-services` was read through a development token with Cloud SQL, Redis, Firestore, buckets and Artifact Registry sections denied. Their data stores are described from Terraform only.
- Drift: dev has live-only secrets and buckets and one declared secret missing live; QA, prod and especially the agents project have undeclared secrets (see the generated tables above for counts). Firestore in dev shows no matches because the declared database names could not be reconciled to the live ones; treat as unresolved. The generated drift report is at `/docs/gcp-drift-report`.
- No secret values, version histories or rotation dates were read, so rotation currency is unknown. One MCP service references a secret name not present in the project's list.
- PITR is off on the prod instances in the snapshot; the exception is `participant-keycloak-db-development`, where Terraform enables it. QA PITR and dev live PITR were not recorded. No restore has been drilled (`/docs/disaster-recovery-plan`).
- ESO and ExternalSecret state, Cloud SQL users, Redis auth settings and Redis persistence were not collected.
- README-vs-live on deletion protection: the `modules/cloud-sql-postgres` README says QA instances have `deletionProtectionEnabled: false`, but the live snapshots show API-side deletion protection on for every readable instance in dev, QA and prod, and Terraform sets it for the QA and prod instances and most dev instances (the variable description says QA was set true in a 2026-07-15 audit remediation). The README and the variable default of false are stale. The MCP instance could not be read live.