OPAX Live Deployment Runbook

Purpose

Use these scripts to deploy the two production components required for the Emma/OPAX experience:

OPAX MCP: the conversational MCP backend and run_emma tool service.
OPAX Web: the live web application served at https://opax.vauco.no.

Fixed Production Targets

Item	Value
Google Cloud project	`propane-will-491900-m5`
Region	`us-central1`
Artifact Registry repository	`us-central1-docker.pkg.dev/propane-will-491900-m5/osvauco-repo`
MCP Cloud Run service	`opax-mcp`
OPAX Web Cloud Run service	`opax-web`
Live operator URL	`https://opax.vauco.no`

Normal Release Sequence

Run commands from the repository root:

./scripts/deploy-mcp.sh
./scripts/deploy-opax-web.sh
./scripts/check-live-services.sh

The scripts build an image, resolve its immutable digest, and deploy that digest to the existing Cloud Run service.

MCP Deployment Behavior

The existing cloudbuild.deploy.yaml workflow builds and pushes an MCP image. Its internal Cloud Build deploy step can fail because the Cloud Build service account is blocked by VPC Service Controls.

deploy-mcp.sh handles that condition by resolving the image that was pushed during the build and then deploying its immutable digest directly through the authenticated local gcloud session.

A Cloud Build failure does not automatically mean the image build failed. The script stops if it cannot resolve an immutable pushed image digest.

Live Validation

After deployment:

Open https://opax.vauco.no.
Hard-refresh the browser with Ctrl+Shift+R.
Log in normally.
Confirm that the new Emma workspace UI is visible.
In a new conversation, send:
```
Jeg heter Chris.
```
In the same conversation, send:
```
Hva heter jeg?
```
Confirm that Emma uses the previous message as conversation history.
Start a second conversation and ask:
```
Hva heter jeg?
```
Confirm that the second conversation does not inherit context from the first conversation.

Guardrails

Use us-central1 only.
Never deploy to europe-west1.
Never deploy a service named opax.
Deploy only the existing opax-mcp and opax-web services.
Final Cloud Run deployment must use an immutable image digest.
Never use a mutable tag for the final deploy.
Never print or place secret values in scripts, logs, documentation, or Git.
Do not deploy from Gemini without explicit human approval.
Do not change IAM, service accounts, secrets, VPC settings, DNS, OAuth, or Cloud Run networking as part of a normal application release.

Rollback

Use one of these existing rollback methods:

In Cloud Run, route traffic back to the prior ready revision.
Re-run the relevant deployment script after replacing the image digest with a previously known good immutable digest.

Use ./scripts/check-live-services.sh to record the currently active revisions and images before a release.

3.0 KiB Raw Blame History