From 35254145ca3d55065b8fc7812a0e809392f1ad72 Mon Sep 17 00:00:00 2001
From: Chris Christiansen <chris.christiansen@vauco.no>
Date: Sat, 19 Sep 2026 12:30:01 +0000
Subject: [PATCH] fix(deploy): preserve OPAX MCP private Emma runtime contract

---
 docs/runbooks/opax-live-deploy.md | 10 ++++++++++
 scripts/deploy-mcp.sh             | 12 ++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/docs/runbooks/opax-live-deploy.md b/docs/runbooks/opax-live-deploy.md
index f656989..b20ae52 100644
--- a/docs/runbooks/opax-live-deploy.md
+++ b/docs/runbooks/opax-live-deploy.md
@@ -34,6 +34,16 @@ to the existing Cloud Run service.
 
 ## MCP Deployment Behavior
 
+## Required OPAX-MCP Runtime Contract
+
+- `opax-mcp` uses Direct VPC egress to reach the internal Emma/Ollama runtime.
+- Network: `default`
+- Subnetwork: `default`
+- Egress: `private-ranges-only`
+- Ollama endpoint: `http://10.128.0.15:11434`
+- Use `./scripts/deploy-mcp.sh` for MCP releases so this contract is explicitly reapplied.
+- Do not use a manual deployment that omits this runtime contract.
+
 The existing `cloudbuild.deploy.yaml` workflow builds and pushes an MCP image.
 Its internal Cloud Build deploy step can fail because the Cloud Build service
 account is blocked by VPC Service Controls.
diff --git a/scripts/deploy-mcp.sh b/scripts/deploy-mcp.sh
index f060b3f..3d5fc94 100755
--- a/scripts/deploy-mcp.sh
+++ b/scripts/deploy-mcp.sh
@@ -10,6 +10,14 @@ REPOSITORY="us-central1-docker.pkg.dev/${PROJECT_ID}/osvauco-repo"
 MCP_SERVICE="opax-mcp"
 MCP_IMAGE="${REPOSITORY}/opax-mcp"
 
+# Emma runtime requires Direct VPC egress to the internal Ollama host.
+# Keep this explicit: a prior manual deployment lost these settings.
+MCP_NETWORK="default"
+MCP_SUBNET="default"
+MCP_VPC_EGRESS="private-ranges-only"
+MCP_OLLAMA_BASE_URL="http://10.128.0.15:11434"
+
+
 echo "==> Submitting MCP Cloud Build"
 
 BUILD_ID="$(
@@ -83,6 +91,10 @@ gcloud run deploy "${MCP_SERVICE}" \
   --project="${PROJECT_ID}" \
   --region="${REGION}" \
   --image="${DEPLOY_IMAGE}" \
+  --network="${MCP_NETWORK}" \
+  --subnet="${MCP_SUBNET}" \
+  --vpc-egress="${MCP_VPC_EGRESS}" \
+  --update-env-vars="OLLAMA_BASE_URL=${MCP_OLLAMA_BASE_URL}" \
   --quiet
 
 echo