From 58f258c496136d51eb61b2b14e1c2efcee0c228d Mon Sep 17 00:00:00 2001 From: Senih Bayankulu Date: Wed, 1 Jul 2026 18:34:08 +0300 Subject: [PATCH 1/3] docs(module-06): add cloud run planning foundation --- docs/modules/module-06-cloud-run/CHECKLIST.md | 27 +++++++++++ .../module-06-cloud-run/EVIDENCE_PLAN.md | 40 ++++++++++++++++ docs/modules/module-06-cloud-run/README.md | 46 +++++++++++++++++++ .../module-06-cloud-run/RISK_REGISTER.md | 16 +++++++ 4 files changed, 129 insertions(+) create mode 100644 docs/modules/module-06-cloud-run/CHECKLIST.md create mode 100644 docs/modules/module-06-cloud-run/EVIDENCE_PLAN.md create mode 100644 docs/modules/module-06-cloud-run/README.md create mode 100644 docs/modules/module-06-cloud-run/RISK_REGISTER.md diff --git a/docs/modules/module-06-cloud-run/CHECKLIST.md b/docs/modules/module-06-cloud-run/CHECKLIST.md new file mode 100644 index 0000000..44a78c0 --- /dev/null +++ b/docs/modules/module-06-cloud-run/CHECKLIST.md @@ -0,0 +1,27 @@ +# Module 06 Planning Checklist + +## Planning Gate + +- [ ] Source module is identified +- [ ] Runtime baseline is documented +- [ ] Deployment prerequisites are listed +- [ ] Cost boundaries are explicit +- [ ] IAM review points are listed +- [ ] API review points are listed +- [ ] Rollback path is documented +- [ ] Evidence plan is separated from deployment path +- [ ] No deploy, billing, or IAM changes are included +- [ ] No secrets or private URLs are exposed + +## Decision Split + +- Deployment path: build, container, deploy, rollback +- Evidence plan: Network, Console, Performance, Cloud logs + +## Stop Conditions + +- Missing cost boundary +- Missing approval gate +- Missing rollback path +- Any attempt to move from planning into live deployment without manual review + diff --git a/docs/modules/module-06-cloud-run/EVIDENCE_PLAN.md b/docs/modules/module-06-cloud-run/EVIDENCE_PLAN.md new file mode 100644 index 0000000..f043743 --- /dev/null +++ b/docs/modules/module-06-cloud-run/EVIDENCE_PLAN.md @@ -0,0 +1,40 @@ +# Module 06 Evidence Plan + +## Objective + +Capture the minimum evidence needed to prove Cloud Run readiness and post-deploy behavior without mixing it with deployment instructions. + +## Evidence Categories + +### Local Readiness + +- app starts locally +- container or buildpack path is reproducible +- local config does not rely on secrets + +### Deployment Readiness + +- billing cap is defined +- API enablement is reviewed +- IAM service account is reviewed +- rollback path is documented + +### DevTools Evidence + +- Network: request and response status +- Console: no critical runtime errors +- Performance: cold start or load timing when applicable +- Application: storage and cookie review + +### Cloud Evidence + +- service status +- logs +- revision or rollout state + +## Evidence Rules + +- keep screenshots free of secrets and private URLs +- avoid exporting sensitive data +- store only public-safe notes in this repository + diff --git a/docs/modules/module-06-cloud-run/README.md b/docs/modules/module-06-cloud-run/README.md new file mode 100644 index 0000000..6a0d35d --- /dev/null +++ b/docs/modules/module-06-cloud-run/README.md @@ -0,0 +1,46 @@ +# Module 06 — Cloud Run Planning Foundation + +## Purpose + +This directory contains the planning foundation for Module 06. + +The goal is to separate Cloud Run planning from execution and evidence gathering so the repository stays deterministic, cost-aware, and reviewable. + +## Scope + +This planning set covers: + +- deployment prerequisites +- billing and cost boundaries +- API and IAM review points +- approval gates +- rollback planning +- DevTools and Cloud Run evidence planning + +## Out of Scope + +This planning increment does not include: + +- deploy commands +- API enablement +- IAM changes +- billing operations +- container builds +- ROADMAP updates +- cherry-picks from other branches + +## Related Module 06 Docs + +Existing Module 06 evidence and gate documents remain available in this folder: + +- `MODULE_06A_CLOUD_RUN_READINESS_PLAN.md` +- `MODULE_06B_CLOUD_RUN_RUNBOOK_APPROVAL.md` +- `MODULE_06C_PRE_DEPLOY_APPROVAL_GATE.md` +- `MODULE_06D_FINAL_LOCAL_PREFLIGHT_REPORT.md` + +## Safety Boundary + +This module is docs-only. + +It must remain public-safe and avoid secrets, private URLs, service account material, or any direct runtime coupling to sensitive repositories. + diff --git a/docs/modules/module-06-cloud-run/RISK_REGISTER.md b/docs/modules/module-06-cloud-run/RISK_REGISTER.md new file mode 100644 index 0000000..3b94d76 --- /dev/null +++ b/docs/modules/module-06-cloud-run/RISK_REGISTER.md @@ -0,0 +1,16 @@ +# Module 06 Risk Register + +| Risk | Impact | Mitigation | +|---|---|---| +| Billing exposure from always-on Cloud Run settings | Medium to high | Use explicit caps in the planning docs before any deploy step | +| IAM over-permission | High | Require least-privilege service account review | +| Secret leakage into build or runtime | High | Keep secrets out of repo and out of public docs | +| Public endpoint exposure | Medium | Require deployment approval gate and restricted access review | +| Evidence and deployment confusion | Medium | Separate deployment path from evidence plan | +| Roadmap drift | Low to medium | Keep Module 06 planning scoped and isolated from other modules | + +## Notes + +- This is a planning artifact only. +- No live cloud action is authorized by this document. + From 02e6f17d1d02a7f7a2c5fd90ada9fe27b0408edc Mon Sep 17 00:00:00 2001 From: Senih Bayankulu Date: Wed, 1 Jul 2026 18:46:06 +0300 Subject: [PATCH 2/3] docs(module-06): define runtime cost and approval gates --- .../module-06-cloud-run/APPROVAL_MATRIX.md | 23 +++++++++++++++ docs/modules/module-06-cloud-run/CHECKLIST.md | 2 ++ .../module-06-cloud-run/COST_BOUNDARY.md | 29 +++++++++++++++++++ .../module-06-cloud-run/EVIDENCE_PLAN.md | 6 ++++ docs/modules/module-06-cloud-run/README.md | 22 ++++++++++++++ .../module-06-cloud-run/RISK_REGISTER.md | 17 ++++++----- .../module-06-cloud-run/RUNTIME_BASELINE.md | 26 +++++++++++++++++ 7 files changed, 117 insertions(+), 8 deletions(-) create mode 100644 docs/modules/module-06-cloud-run/APPROVAL_MATRIX.md create mode 100644 docs/modules/module-06-cloud-run/COST_BOUNDARY.md create mode 100644 docs/modules/module-06-cloud-run/RUNTIME_BASELINE.md diff --git a/docs/modules/module-06-cloud-run/APPROVAL_MATRIX.md b/docs/modules/module-06-cloud-run/APPROVAL_MATRIX.md new file mode 100644 index 0000000..f2a1d1d --- /dev/null +++ b/docs/modules/module-06-cloud-run/APPROVAL_MATRIX.md @@ -0,0 +1,23 @@ +# Module 06 Approval Matrix + +| Operation | Allowed in Planning | Requires Live Approval | +|---|---:|---:| +| Source code review | Yes | No | +| Local test execution | Yes | No | +| Container build | No | Yes | +| API enablement | No | Yes | +| IAM changes | No | Yes | +| Cloud Run deploy | No | Yes | +| Public endpoint exposure | No | Separate approval | +| Billing or budget changes | No | Separate approval | +| Screenshot or evidence capture | Planned only | After deploy | + +## Decision Rule + +If an action changes live cloud state, it is outside planning and requires explicit human approval. + +## Notes + +- Planning docs may describe commands. +- Planning docs must not execute commands. +- The matrix is intentionally conservative to avoid accidental live changes. diff --git a/docs/modules/module-06-cloud-run/CHECKLIST.md b/docs/modules/module-06-cloud-run/CHECKLIST.md index 44a78c0..c33f4b2 100644 --- a/docs/modules/module-06-cloud-run/CHECKLIST.md +++ b/docs/modules/module-06-cloud-run/CHECKLIST.md @@ -10,6 +10,7 @@ - [ ] API review points are listed - [ ] Rollback path is documented - [ ] Evidence plan is separated from deployment path +- [ ] Approval matrix exists and separates planning from live operations - [ ] No deploy, billing, or IAM changes are included - [ ] No secrets or private URLs are exposed @@ -24,4 +25,5 @@ - Missing approval gate - Missing rollback path - Any attempt to move from planning into live deployment without manual review +- Any attempt to use this planning branch as a deployment branch diff --git a/docs/modules/module-06-cloud-run/COST_BOUNDARY.md b/docs/modules/module-06-cloud-run/COST_BOUNDARY.md new file mode 100644 index 0000000..7384fbf --- /dev/null +++ b/docs/modules/module-06-cloud-run/COST_BOUNDARY.md @@ -0,0 +1,29 @@ +# Module 06 Cost Boundary + +## Purpose + +Define planning-time cost boundaries before any live Cloud Run action. + +## Planning Decisions + +- Minimum instances: `0` +- Maximum instances: must be explicitly defined before deploy +- CPU allocation: request-based preference should be evaluated before deploy +- Concurrency: default must not be assumed; review separately +- Region: must be selected with cost and latency review before deploy +- Budget alert: must not be created or changed without explicit human approval +- Public ingress: must not be assumed by default + +## Cost Rules + +- Do not publish live pricing values in public documentation. +- Verify cloud prices separately before any deployment decision. +- Treat any always-on setting as a cost risk until reviewed. + +## Stop Conditions + +- No explicit instance cap +- No region review +- No budget approval +- No public ingress approval + diff --git a/docs/modules/module-06-cloud-run/EVIDENCE_PLAN.md b/docs/modules/module-06-cloud-run/EVIDENCE_PLAN.md index f043743..e08a948 100644 --- a/docs/modules/module-06-cloud-run/EVIDENCE_PLAN.md +++ b/docs/modules/module-06-cloud-run/EVIDENCE_PLAN.md @@ -4,6 +4,12 @@ Capture the minimum evidence needed to prove Cloud Run readiness and post-deploy behavior without mixing it with deployment instructions. +## Evidence Split + +- Deployment path: build, container, deploy, rollback +- Evidence plan: Network, Console, Performance, Cloud logs +- Approval gate: manual decision before any live mutation command + ## Evidence Categories ### Local Readiness diff --git a/docs/modules/module-06-cloud-run/README.md b/docs/modules/module-06-cloud-run/README.md index 6a0d35d..bbf7e9a 100644 --- a/docs/modules/module-06-cloud-run/README.md +++ b/docs/modules/module-06-cloud-run/README.md @@ -17,6 +17,20 @@ This planning set covers: - rollback planning - DevTools and Cloud Run evidence planning +## Source And Target + +Source module: + +`gae-flask-module-1/mod5-cloud-run-buildpacks/` + +Target module: + +`docs/modules/module-06-cloud-run/` + +Future runtime target, when planning is later converted into an implementation module: + +`gae-flask-module-1/mod6-cloud-run/` + ## Out of Scope This planning increment does not include: @@ -38,6 +52,14 @@ Existing Module 06 evidence and gate documents remain available in this folder: - `MODULE_06C_PRE_DEPLOY_APPROVAL_GATE.md` - `MODULE_06D_FINAL_LOCAL_PREFLIGHT_REPORT.md` +## Planning Extensions + +This PR increment adds: + +- `RUNTIME_BASELINE.md` +- `COST_BOUNDARY.md` +- `APPROVAL_MATRIX.md` + ## Safety Boundary This module is docs-only. diff --git a/docs/modules/module-06-cloud-run/RISK_REGISTER.md b/docs/modules/module-06-cloud-run/RISK_REGISTER.md index 3b94d76..e8637e0 100644 --- a/docs/modules/module-06-cloud-run/RISK_REGISTER.md +++ b/docs/modules/module-06-cloud-run/RISK_REGISTER.md @@ -1,16 +1,17 @@ # Module 06 Risk Register -| Risk | Impact | Mitigation | -|---|---|---| -| Billing exposure from always-on Cloud Run settings | Medium to high | Use explicit caps in the planning docs before any deploy step | -| IAM over-permission | High | Require least-privilege service account review | -| Secret leakage into build or runtime | High | Keep secrets out of repo and out of public docs | -| Public endpoint exposure | Medium | Require deployment approval gate and restricted access review | -| Evidence and deployment confusion | Medium | Separate deployment path from evidence plan | -| Roadmap drift | Low to medium | Keep Module 06 planning scoped and isolated from other modules | +| Risk | Impact | Likelihood | Mitigation | Trigger | Stop condition | Evidence required | Status | +|---|---|---|---|---|---|---|---| +| Billing exposure from always-on Cloud Run settings | High | Medium | Use explicit caps in the planning docs before any deploy step | Deployment planning starts without caps | Cost cap is undefined | Planning docs with cap fields | Open | +| IAM over-permission | High | Medium | Require least-privilege service account review | IAM roles are proposed without review | Service account roles are not documented | IAM review note | Open | +| Secret leakage into build or runtime | High | Low | Keep secrets out of repo and out of public docs | Secret references appear in docs or commands | Secret or private URL is present | Secret scan note | Open | +| Public endpoint exposure | High | Medium | Require deployment approval gate and restricted access review | Public ingress is implied without approval | Public access is not separately approved | Approval matrix entry | Open | +| Evidence and deployment confusion | Medium | Medium | Separate deployment path from evidence plan | Evidence steps include live mutation commands | Deployment and evidence are mixed | Evidence plan doc | Open | +| Roadmap drift | Low | Medium | Keep Module 06 planning scoped and isolated from other modules | ROADMAP is modified in this branch | ROADMAP change is introduced here | Branch diff review | Open | ## Notes - This is a planning artifact only. - No live cloud action is authorized by this document. +- The register intentionally avoids exact cloud pricing because cost values change. diff --git a/docs/modules/module-06-cloud-run/RUNTIME_BASELINE.md b/docs/modules/module-06-cloud-run/RUNTIME_BASELINE.md new file mode 100644 index 0000000..951d0bd --- /dev/null +++ b/docs/modules/module-06-cloud-run/RUNTIME_BASELINE.md @@ -0,0 +1,26 @@ +# Module 06 Runtime Baseline + +## Purpose + +This document records the runtime baseline that Module 06 planning depends on. + +## Baseline Fields + +| Field | Value | +|---|---| +| Python/runtime version | Python 3.12 / Flask runtime used by the guestbook sample | +| Entry point | `main.py` | +| Dependency file | `requirements.txt` | +| Local start command | `PORT=8080 gunicorn -b :8080 main:app` | +| Expected port | `8080` | +| Health endpoint | `GET /` | +| Environment variables | `PORT` for local or container execution | +| Secret-free local configuration | No `.env`; local demo uses checked-in sample configuration only | +| Known tests | Flask route smoke tests and local request verification from Module 05 evidence | +| Source module commit | `6dea081` | + +## Baseline Notes + +- The runtime baseline is derived from the already completed Cloud Run buildpacks path. +- This document does not authorise deployment or build execution. +- Any later implementation must re-validate the runtime before live Cloud Run work. From 95176f59f00d36791d838f25be37472f114576ce Mon Sep 17 00:00:00 2001 From: Senih Bayankulu Date: Wed, 1 Jul 2026 20:02:41 +0300 Subject: [PATCH 3/3] docs(research): note chrome source priority order --- ...OME_SOURCE_PRIORITY_FOR_SENSITIVE_REPOS.md | 100 ++++++++++++++++++ 1 file changed, 100 insertions(+) create mode 100644 docs/research/CHROME_SOURCE_PRIORITY_FOR_SENSITIVE_REPOS.md diff --git a/docs/research/CHROME_SOURCE_PRIORITY_FOR_SENSITIVE_REPOS.md b/docs/research/CHROME_SOURCE_PRIORITY_FOR_SENSITIVE_REPOS.md new file mode 100644 index 0000000..eea62b3 --- /dev/null +++ b/docs/research/CHROME_SOURCE_PRIORITY_FOR_SENSITIVE_REPOS.md @@ -0,0 +1,100 @@ +# Chrome Source Priority For Sensitive Repos + +## Purpose + +This note records the next safe application order for the Chrome source library in `chrome_articles_2026-07-01.csv`. + +The CSV is treated as a public-safe source library, not as an execution plan. + +## Priority Order + +1. UYAP Local Case Capture +2. e-Nabız Capture Tool / e-Nabız Local Health Assistant +3. Social Profile Assistant + +## Why This Order + +The first two targets have stricter data, permission, and execution boundaries: + +- they are more sensitive from a privacy and security perspective +- they rely directly on permission minimization and content-script boundaries +- they benefit most from explicit user action and local-first capture discipline +- they produce the highest-value Chrome DevTools security and debugging evidence + +Social Profile Assistant remains important, but it should follow the higher-risk sensitive repos so the Chrome patterns are validated first in the strictest environments. + +## CSV Source Clusters Most Relevant To This Order + +- Extensions +- Web Store +- DevTools +- Permissions +- `chrome.storage` +- service worker lifecycle +- content scripts +- `activeTab` +- optional host permissions +- runtime messaging +- Puppeteer +- Privacy/Security + +## Cross-Repository Classification + +Every cross-repository idea in this note is classified as: + +- UYAP Local Case Capture: Needs manual review +- e-Nabız Capture Tool / e-Nabız Local Health Assistant: Needs manual review +- Social Profile Assistant: Allowed public-safe documentation/checklist pattern + +## Recommended Milestone Flow + +### UYAP + +```text +permission audit +→ explicit user action +→ content-script trust boundary +→ storage schema +→ message protocol +→ Puppeteer E2E +→ DevTools evidence +``` + +### e-Nabız + +```text +privacy boundary +→ permission audit +→ category contracts +→ session/local storage model +→ synthetic fixtures +→ export/import boundary +→ DevTools evidence +``` + +### Social Profile Assistant + +```text +storage contract +→ service worker resilience +→ messaging protocol +→ side panel runtime verification +→ permission minimization +→ Puppeteer E2E +→ Web Store readiness +``` + +## Safety Boundary + +- No real UYAP data +- No e-Nabız exports +- No PHI +- No credentials or tokens +- No direct runtime integration with sensitive repositories + +## Notes + +- This document is planning-only. +- It does not authorize live data access, deployment, or repository coupling. +- The CSV remains a source index; actual implementation work must stay inside the target repository and its own safety boundary. +