fix(deploy): preserve OPAX MCP private Emma runtime contract

docs/runbooks/opax-live-deploy.md

@@ -34,6 +34,16 @@ to the existing Cloud Run service.
 
 ## MCP Deployment Behavior
 
+## Required OPAX-MCP Runtime Contract
+
+- `opax-mcp` uses Direct VPC egress to reach the internal Emma/Ollama runtime.
+- Network: `default`
+- Subnetwork: `default`
+- Egress: `private-ranges-only`
+- Ollama endpoint: `http://10.128.0.15:11434`
+- Use `./scripts/deploy-mcp.sh` for MCP releases so this contract is explicitly reapplied.
+- Do not use a manual deployment that omits this runtime contract.
+
 The existing `cloudbuild.deploy.yaml` workflow builds and pushes an MCP image.
 Its internal Cloud Build deploy step can fail because the Cloud Build service
 account is blocked by VPC Service Controls.

scripts/deploy-mcp.sh

@@ -10,6 +10,14 @@ REPOSITORY="us-central1-docker.pkg.dev/${PROJECT_ID}/osvauco-repo"
 MCP_SERVICE="opax-mcp"
 MCP_IMAGE="${REPOSITORY}/opax-mcp"
 
+# Emma runtime requires Direct VPC egress to the internal Ollama host.
+# Keep this explicit: a prior manual deployment lost these settings.
+MCP_NETWORK="default"
+MCP_SUBNET="default"
+MCP_VPC_EGRESS="private-ranges-only"
+MCP_OLLAMA_BASE_URL="http://10.128.0.15:11434"
+
+
 echo "==> Submitting MCP Cloud Build"
 
 BUILD_ID="$(
@@ -83,6 +91,10 @@ gcloud run deploy "${MCP_SERVICE}" \
   --project="${PROJECT_ID}" \
   --region="${REGION}" \
   --image="${DEPLOY_IMAGE}" \
+  --network="${MCP_NETWORK}" \
+  --subnet="${MCP_SUBNET}" \
+  --vpc-egress="${MCP_VPC_EGRESS}" \
+  --update-env-vars="OLLAMA_BASE_URL=${MCP_OLLAMA_BASE_URL}" \
   --quiet
 
 echo