docs(module-06): add Cloud Run planning foundation

docs/modules/module-06-cloud-run/APPROVAL_MATRIX.md

@@ -0,0 +1,23 @@
+# Module 06 Approval Matrix
+
+| Operation | Allowed in Planning | Requires Live Approval |
+|---|---:|---:|
+| Source code review | Yes | No |
+| Local test execution | Yes | No |
+| Container build | No | Yes |
+| API enablement | No | Yes |
+| IAM changes | No | Yes |
+| Cloud Run deploy | No | Yes |
+| Public endpoint exposure | No | Separate approval |
+| Billing or budget changes | No | Separate approval |
+| Screenshot or evidence capture | Planned only | After deploy |
+
+## Decision Rule
+
+If an action changes live cloud state, it is outside planning and requires explicit human approval.
+
+## Notes
+
+- Planning docs may describe commands.
+- Planning docs must not execute commands.
+- The matrix is intentionally conservative to avoid accidental live changes.

docs/modules/module-06-cloud-run/CHECKLIST.md

@@ -0,0 +1,29 @@
+# Module 06 Planning Checklist
+
+## Planning Gate
+
+- [ ] Source module is identified
+- [ ] Runtime baseline is documented
+- [ ] Deployment prerequisites are listed
+- [ ] Cost boundaries are explicit
+- [ ] IAM review points are listed
+- [ ] API review points are listed
+- [ ] Rollback path is documented
+- [ ] Evidence plan is separated from deployment path
+- [ ] Approval matrix exists and separates planning from live operations
+- [ ] No deploy, billing, or IAM changes are included
+- [ ] No secrets or private URLs are exposed
+
+## Decision Split
+
+- Deployment path: build, container, deploy, rollback
+- Evidence plan: Network, Console, Performance, Cloud logs
+
+## Stop Conditions
+
+- Missing cost boundary
+- Missing approval gate
+- Missing rollback path
+- Any attempt to move from planning into live deployment without manual review
+- Any attempt to use this planning branch as a deployment branch
+

docs/modules/module-06-cloud-run/COST_BOUNDARY.md

@@ -0,0 +1,29 @@
+# Module 06 Cost Boundary
+
+## Purpose
+
+Define planning-time cost boundaries before any live Cloud Run action.
+
+## Planning Decisions
+
+- Minimum instances: `0`
+- Maximum instances: must be explicitly defined before deploy
+- CPU allocation: request-based preference should be evaluated before deploy
+- Concurrency: default must not be assumed; review separately
+- Region: must be selected with cost and latency review before deploy
+- Budget alert: must not be created or changed without explicit human approval
+- Public ingress: must not be assumed by default
+
+## Cost Rules
+
+- Do not publish live pricing values in public documentation.
+- Verify cloud prices separately before any deployment decision.
+- Treat any always-on setting as a cost risk until reviewed.
+
+## Stop Conditions
+
+- No explicit instance cap
+- No region review
+- No budget approval
+- No public ingress approval
+

docs/modules/module-06-cloud-run/EVIDENCE_PLAN.md

@@ -0,0 +1,46 @@
+# Module 06 Evidence Plan
+
+## Objective
+
+Capture the minimum evidence needed to prove Cloud Run readiness and post-deploy behavior without mixing it with deployment instructions.
+
+## Evidence Split
+
+- Deployment path: build, container, deploy, rollback
+- Evidence plan: Network, Console, Performance, Cloud logs
+- Approval gate: manual decision before any live mutation command
+
+## Evidence Categories
+
+### Local Readiness
+
+- app starts locally
+- container or buildpack path is reproducible
+- local config does not rely on secrets
+
+### Deployment Readiness
+
+- billing cap is defined
+- API enablement is reviewed
+- IAM service account is reviewed
+- rollback path is documented
+
+### DevTools Evidence
+
+- Network: request and response status
+- Console: no critical runtime errors
+- Performance: cold start or load timing when applicable
+- Application: storage and cookie review
+
+### Cloud Evidence
+
+- service status
+- logs
+- revision or rollout state
+
+## Evidence Rules
+
+- keep screenshots free of secrets and private URLs
+- avoid exporting sensitive data
+- store only public-safe notes in this repository
+

docs/modules/module-06-cloud-run/README.md

@@ -0,0 +1,68 @@
+# Module 06 — Cloud Run Planning Foundation
+
+## Purpose
+
+This directory contains the planning foundation for Module 06.
+
+The goal is to separate Cloud Run planning from execution and evidence gathering so the repository stays deterministic, cost-aware, and reviewable.
+
+## Scope
+
+This planning set covers:
+
+- deployment prerequisites
+- billing and cost boundaries
+- API and IAM review points
+- approval gates
+- rollback planning
+- DevTools and Cloud Run evidence planning
+
+## Source And Target
+
+Source module:
+
+`gae-flask-module-1/mod5-cloud-run-buildpacks/`
+
+Target module:
+
+`docs/modules/module-06-cloud-run/`
+
+Future runtime target, when planning is later converted into an implementation module:
+
+`gae-flask-module-1/mod6-cloud-run/`
+
+## Out of Scope
+
+This planning increment does not include:
+
+- deploy commands
+- API enablement
+- IAM changes
+- billing operations
+- container builds
+- ROADMAP updates
+- cherry-picks from other branches
+
+## Related Module 06 Docs
+
+Existing Module 06 evidence and gate documents remain available in this folder:
+
+- `MODULE_06A_CLOUD_RUN_READINESS_PLAN.md`
+- `MODULE_06B_CLOUD_RUN_RUNBOOK_APPROVAL.md`
+- `MODULE_06C_PRE_DEPLOY_APPROVAL_GATE.md`
+- `MODULE_06D_FINAL_LOCAL_PREFLIGHT_REPORT.md`
+
+## Planning Extensions
+
+This PR increment adds:
+
+- `RUNTIME_BASELINE.md`
+- `COST_BOUNDARY.md`
+- `APPROVAL_MATRIX.md`
+
+## Safety Boundary
+
+This module is docs-only.
+
+It must remain public-safe and avoid secrets, private URLs, service account material, or any direct runtime coupling to sensitive repositories.
+

docs/modules/module-06-cloud-run/RISK_REGISTER.md

@@ -0,0 +1,17 @@
+# Module 06 Risk Register
+
+| Risk | Impact | Likelihood | Mitigation | Trigger | Stop condition | Evidence required | Status |
+|---|---|---|---|---|---|---|---|
+| Billing exposure from always-on Cloud Run settings | High | Medium | Use explicit caps in the planning docs before any deploy step | Deployment planning starts without caps | Cost cap is undefined | Planning docs with cap fields | Open |
+| IAM over-permission | High | Medium | Require least-privilege service account review | IAM roles are proposed without review | Service account roles are not documented | IAM review note | Open |
+| Secret leakage into build or runtime | High | Low | Keep secrets out of repo and out of public docs | Secret references appear in docs or commands | Secret or private URL is present | Secret scan note | Open |
+| Public endpoint exposure | High | Medium | Require deployment approval gate and restricted access review | Public ingress is implied without approval | Public access is not separately approved | Approval matrix entry | Open |
+| Evidence and deployment confusion | Medium | Medium | Separate deployment path from evidence plan | Evidence steps include live mutation commands | Deployment and evidence are mixed | Evidence plan doc | Open |
+| Roadmap drift | Low | Medium | Keep Module 06 planning scoped and isolated from other modules | ROADMAP is modified in this branch | ROADMAP change is introduced here | Branch diff review | Open |
+
+## Notes
+
+- This is a planning artifact only.
+- No live cloud action is authorized by this document.
+- The register intentionally avoids exact cloud pricing because cost values change.
+

docs/modules/module-06-cloud-run/RUNTIME_BASELINE.md

@@ -0,0 +1,26 @@
+# Module 06 Runtime Baseline
+
+## Purpose
+
+This document records the runtime baseline that Module 06 planning depends on.
+
+## Baseline Fields
+
+| Field | Value |
+|---|---|
+| Python/runtime version | Python 3.12 / Flask runtime used by the guestbook sample |
+| Entry point | `main.py` |
+| Dependency file | `requirements.txt` |
+| Local start command | `PORT=8080 gunicorn -b :8080 main:app` |
+| Expected port | `8080` |
+| Health endpoint | `GET /` |
+| Environment variables | `PORT` for local or container execution |
+| Secret-free local configuration | No `.env`; local demo uses checked-in sample configuration only |
+| Known tests | Flask route smoke tests and local request verification from Module 05 evidence |
+| Source module commit | `6dea081` |
+
+## Baseline Notes
+
+- The runtime baseline is derived from the already completed Cloud Run buildpacks path.
+- This document does not authorise deployment or build execution.
+- Any later implementation must re-validate the runtime before live Cloud Run work.