How Harmonia uses it
The worker receives authenticated Pub/Sub pushes and Scheduler ticks. Each service uses its own least-privilege service account. Deployment injects resource names and non-secret configuration; provider tokens belong in Secret Manager-backed environment variables.
Cloud Run instances are treated as disposable. Durable state, queues, assets, and operation claims live outside the container.
Security and authority
The web service is the operator boundary. The worker is private and accepts fixed OIDC audiences for machine calls. Cloud Run identity grants are split by responsibility rather than shared through one broad account.Failure behavior
Container restart or scale-to-zero does not erase job state. Pub/Sub redelivery, outbox recovery, Firestore claims, and idempotent effects resume work safely.Evidence status
Production builds verify standalone packaging locally. The full deployment path builds commit-tagged images once, deploys their resolved digests, and emits the Cloud Run revision/image identities. A web-preview revision does not prove the worker or managed agent stack is deployed; retain the full release identity lines with correlated service revisions and traces.Relevant files
Dockerfileagent/Dockerfileinfra/deploy.shinfra/deploy-web-preview.shdocs/deployment.mdx