# OSVauco — GCP Agent Master Repo

**Prosjekt:** `propane-will-491900-m5` | **Region:** `us-central1`

## Status
| Komponent | Status |
|---|---|
| Cloud Run Agent | ✅ Live |
| Service URL | https://osvauco-agent-357036551735.us-central1.run.app |
| CI/CD Trigger | ✅ Auto-deploy ved push til `main` |
| ADK Versjon | 1.x (google-adk>=1.0.0,<2.0.0) |
| Siste revisjon | osvauco-agent-00006-mvb |

## Hurtigtest
```bash
TOKEN=$(gcloud auth print-identity-token)
curl -s -X POST -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"user_id":"chris","session_id":"test-1","message":"Hei, hvem er du?"}' \
  https://osvauco-agent-357036551735.us-central1.run.app/run | jq
```

## Repo-struktur
```
├── agents/
│   └── core-logic/        # Live agent: app.py (FastAPI + ADK Runner)
├── infrastructure/
│   ├── 01-setupenv.sh     # ✅ Ferdig
│   ├── 05-cloudrun-deploy.sh  # ✅ Ferdig
│   ├── 06-cicd-setup.sh   # ✅ Ferdig
│   ├── 07-rag-setup.sh    # ⏳ Neste
│   └── 08-memorybank-setup.sh # ⏳ Planlagt
├── docs/
├── scripts/
├── cloudbuild.yaml        # CI/CD pipeline
└── .env.example
```

## Service Account roller (`osvauco-agent-sa`)
| Rolle | Formål |
|---|---|
| roles/aiplatform.user | Vertex AI / Gemini |
| roles/secretmanager.secretAccessor | Secrets |
| roles/logging.logWriter | Logging |
| roles/cloudtrace.agent | Tracing |
| roles/monitoring.metricWriter | Monitoring |
| roles/run.invoker | Cloud Run kall |
| roles/iam.serviceAccountUser | Deploy |
| roles/artifactregistry.writer | Docker push |
| roles/run.developer | Cloud Run deploy |

## Cloud Scheduler for Daglig Fakturering
For å automatisk generere daglige kostnads-snapshots, må en Cloud Scheduler-jobb konfigureres til å kalle `/billing/snapshot`-endepunktet.

**Oppsett med `gcloud`:**
1.  **Service URL:** `https://osvauco-agent-357036551735.us-central1.run.app`
2.  **Service Account:** `osvauco-agent-sa@propane-will-491900-m5.iam.gserviceaccount.com`

```bash
gcloud scheduler jobs create http daily-billing-snapshot \
  --schedule="0 5 * * *" \
  --uri="https://osvauco-agent-357036551735.us-central1.run.app/billing/snapshot" \
  --http-method=POST \
  --oidc-service-account-email="osvauco-agent-sa@propane-will-491900-m5.iam.gserviceaccount.com" \
  --oidc-token-audience="https://osvauco-agent-357036551735.us-central1.run.app" \
  --location="us-central1" \
  --time-zone="Etc/UTC" \
  --description="Kaller /billing/snapshot for å lagre daglig kostnadsdata."
```
Denne kommandoen oppretter en jobb som kjører hver dag kl. 05:00 UTC.

## OPAX MCP connector authentication

The public Cloud Run service permits network invocation so that third-party MCP clients can reach the application. Authentication is enforced by the application.

The server accepts a credential supplied in one of these request headers:

- `api-key`
- `X-MCP-Secret`
- `Authorization: Bearer <token>`

For every supported header form, the extracted credential must exactly match the `MCPSECRET` value injected from Google Secret Manager (`mcp-server-key`). The service rejects missing or non-matching credentials with HTTP 401.

Do not commit, log, or document the secret value itself.