# Handoff: Cloud Build blocked by organization policy / VPC Service Controls

## Resume point

- Handoff date: 2026-09-10
- Branch at handoff: `feat/opax-web-bff-readonly`
- HEAD at handoff: `5d74fb09f3f1725bb6bec8662d890c22dd038188`
- Earlier source-provenance commit: `5d74fb09f3f1725bb6bec8662d890c22dd038188`
- Working directory: `CLEAN at the original Git-provenance check`

This document records the deployment-investigation state. It does not authorize infrastructure changes, another build, or deployment.

## Intended first image build

- Build mechanism: Cloud Build from a local, approved source snapshot
- Build context: `opax-web/`
- Dockerfile: `opax-web/Dockerfile`
- Project: `propane-will-491900-m5`
- Artifact Registry location: `us-central1`
- Repository: `osvauco-repo`
- Image: `opax-web`
- Intended immutable tag: `5d74fb09f3f1725bb6bec8662d890c22dd038188`
- Intended image reference:
  `us-central1-docker.pkg.dev/propane-will-491900-m5/osvauco-repo/opax-web:5d74fb09f3f1725bb6bec8662d890c22dd038188`

## Verified facts

- `opax-web/Dockerfile` was present as a regular file.
- `opax-web/.gcloudignore` was absent.
- `opax-web/cloudbuild.yaml` was absent.
- `opax-web/cloudbuild.yml` was absent.
- Effective Cloud Build default runtime service account:
  `357036551735-compute@developer.gserviceaccount.com`
- That runtime service account has direct `roles/artifactregistry.writer` on:
  `us-central1/osvauco-repo`
- Active local gcloud caller observed during the investigation:
  `chris.christiansen@vauco.no`
- This project-level IAM binding was successfully added:
  `roles/serviceusage.serviceUsageConsumer`
  for `user:chris.christiansen@vauco.no`
  on project `propane-will-491900-m5`.

## Build blocker

Two attempts to submit local source using `gcloud builds submit` failed before a Cloud Build started.

Affected Cloud Build source bucket:

`gs://propane-will-491900-m5_cloudbuild`

Observed failure category:

`PERMISSION_DENIED`

Observed error included:

`The user is forbidden from accessing the bucket [propane-will-491900-m5_cloudbuild]`

Adding `roles/serviceusage.serviceUsageConsumer` did not resolve the failure.

A bucket-level IAM remediation was attempted but was not applied:

- Intended principal:
  `user:chris.christiansen@vauco.no`
- Intended resource:
  `gs://propane-will-491900-m5_cloudbuild`
- Intended role:
  `roles/storage.objectCreator`

The attempted bucket IAM change was denied with:

`Request is prohibited by organization's policy`

The response contained a VPC Service Controls diagnostic correlation ID:

`hSyd2GQvlMqQGdZ0HXTW5fNlD0n0U48CHziavzv6HhoKYEI_8vWYFM2YtMCsz6QbhjOiyDowZRU7gJ-3`

## Current conclusion

The immediate blocker is organization-level policy enforcement, likely VPC Service Controls, affecting the active caller's access to the Cloud Build-managed source bucket.

No successful Cloud Build has been confirmed.
No image push has been confirmed.
No Cloud Run deployment has been performed.

## Instructions for the next browser-enabled agent

1. Use Google Cloud Console with approved browser-based organizational access. Start read-only.

2. Identify the VPC Service Controls service perimeter, ingress policy, egress policy, access level, IAM Condition, or related organization policy that blocks:
   - Active caller: `chris.christiansen@vauco.no`
   - Source bucket: `gs://propane-will-491900-m5_cloudbuild`
   - Project: `propane-will-491900-m5`

3. Use this only as diagnostic correlation information:
   `hSyd2GQvlMqQGdZ0HXTW5fNlD0n0U48CHziavzv6HhoKYEI_8vWYFM2YtMCsz6QbhjOiyDowZRU7gJ-3`

4. Inspect the applicable perimeter, ingress/egress rules, access levels, and any available perimeter-violation or dry-run evidence. Identify the exact blocking rule before proposing a change.

5. Propose the smallest specific correction. Do not:
   - Disable VPC Service Controls.
   - Create a broad perimeter exception.
   - Broaden organization policy unnecessarily.
   - Grant broad IAM roles as a substitute for identifying the policy block.
   - Change the Cloud Build runtime service account's Artifact Registry writer role.
   - Deploy to Cloud Run.

6. Before any VPC Service Controls, Access Context Manager, IAM, source-upload, build, image, or deployment change:
   - Present the exact action.
   - Explain scope, expected effect, risk, and rollback.
   - Obtain separate explicit approval.

7. After an approved policy correction:
   - Re-check the current branch, full HEAD SHA, and clean working-tree status.
   - Confirm the build context remains `opax-web/`.
   - Reuse image tag `5d74fb09f3f1725bb6bec8662d890c22dd038188` only if current HEAD is exactly `5d74fb09f3f1725bb6bec8662d890c22dd038188`.
   - If HEAD differs, stop and make a new provenance/tag decision.
   - Submit at most one explicitly approved Cloud Build.
   - Do not retry automatically.

8. After a successful Cloud Build:
   - Do not deploy automatically.
   - Retrieve the pushed image digest through a separate read-only gate.
   - Use the image digest, not only the tag, in any later Cloud Run deployment proposal.
   - Require a separate explicit Cloud Run deploy gate.

## Git closeout

This file is intended to be the only local change made during closeout.

Before staging or committing:
- Verify that this exact file is the only intended change.
- Present the exact Git commands and commit message for approval.
- Commit only after separate approval.
- Report the resulting commit SHA.
- Do not push until the exact commit SHA and push target have been separately approved.