# Decisions

> FOR REVIEW — generated by StackToIT Assess. Architect review required before any decision.

Run `6f8f72b2-1c34-4cfc-8483-344c41245364` · source digest `sha256:19bfed642d5789ccada81b91d5c36e33175dcafd66dc46b1644ffa105d020000`

PROPOSAL: a record groups the open decisions of the plans of the draft by the part of the draft they concern and the kind of the decision, or the units that leave one critical semantic of one contract open, or the manual actions of the plans by kind, or the open statements of the plans about units they write no resource for by the reason of the statement. It is a view: nothing here changes the draft, target-plan.json, a gate, or any class, confidence or eligibility, and every critical semantic stays open in the assessment. A review of a plan-decision record acts on the execution plan only, by its effect: an answer whose option is what the draft already carries out (ACK_CURRENT_ARTIFACT) frees the steps that wait for the decision; an option that changes the draft (REGENERATE_REQUIRED) or a redesign keeps them held until the draft carries the option (the line of the option in decisions-template.yaml says whether an answer of the inputs file writes it or no answer of this build does), a manual alternative frees only the manual step that carries it out, and a refused opt-in to an API resolves to the draft's own path (the steps of the API path are not taken). The draft itself is unchanged by a review in the decisions file. The one exception is an option that declines a default of the draft (choose-the-size, choose-the-snapshot-count, choose-the-zone-per-server, keep-the-source-rules-and-redesign-a-firewall, machine-type-with-a-local-disk, persistent-volume-for-the-data): the run that reads that answer writes its draft without the default, and the value the default stood for is yours to set.

Decision register: BUILT. Records group four lists: the open decisions of the plans of the draft this run wrote, by the part of the draft (security group, routing, identity, logs, server) and the kind of the decision (plan decisions); the open critical semantics of the units, by the contract family and the semantic (critical semantics); the manual actions of the plans, by the part of the draft and the kind of the action (manual actions); and the open statements of the plans about units they write no resource for (a redesign, a review, a block, a failed model, or a step beside a unit whose draft a converter writes), by the part of the draft and the reason (plan statements). Plan decisions and manual actions cover only drafted units whose draft passed StackToIT's own checks, and only the families whose draft this run wrote from a plan: a family with no plan has none to list. A plan statement covers a unit the plan writes nothing for, whether or not a draft check ran over it; a statement that leaves nothing to a person (a unit the plan does not draft and no manual action of it names) is counted apart from the records and is no record. A record shows the review of an overlay beside the open state the engine reached; a review closes no critical semantic and changes no draft, target plan, gate, class, confidence or eligibility. An accepted plan decision frees the steps of the execution plan that wait for it only when the answer's effect acknowledges the current draft; an option that changes the draft keeps them held until the draft carries that option (the line of the option in decisions-template.yaml says whether an answer of the inputs file writes it or no answer of this build does). The one exception is an option that declines a default of the draft (choose-the-size, choose-the-snapshot-count, choose-the-zone-per-server, keep-the-source-rules-and-redesign-a-firewall, machine-type-with-a-local-disk, persistent-volume-for-the-data): the run that reads that answer writes its draft without the default, and the value the default stood for is yours to set. Records of the family "convert" are decisions of the converter's own generators, outside every plan: a constraint conflict (a variable whose consumers' STACKIT bounds exclude one another keeps the source default) and an ambiguous selection (the source does not prove which instance, interface, key pair, gateway, peer, subnet, proxy, URL map or health check it means, so the draft holds a required variable without a default); the unit that owns one is not automation-eligible. They are listed for a drafted unit whose plan checks did not fail.

6 decisions to make (4 plan decisions, 2 plan statements) · 1 default to confirm · 16 units to review (72 critical settings: 71 to decide (22 of them are conditional), 1 confirm only), on 16 units. Records: 5 plan decision records, 36 critical setting records, 2 plan statement records (0 more statements leave nothing to a person and are no record). Records by status: open 43 · partial 0 · accepted 0 · stale 0 · rejected 0.

Of the 6 decisions to make, 5 free steps by themselves; answered together they free 17 distinct steps of the plan (2 of them automated).

Review: no decisions file was given with this run (stacktoit assess --decisions FILE); every record is open.

Every record carries three states that are set independently of each other: a review never changes the design state or the validation state.

- **Review state** — architect reviewed: a review of the decisions file, bound to this run (source digest, knowledge base and members all hold), covers every member of the record and accepts or rejects it; the outcome is the status and the review of the record. unreviewed: none was given, it covers only some members, or its binding no longer holds. A review never closes a plan decision, a critical semantic or a manual action.
- **Design state** — open: this run's plan or draft still carries the item. design resolved: stated only for an entry of the decisions file that this run's register does not hold, written for another source digest and the same knowledge base, in a run that read the plans of a generated draft without a degraded reading: the item is gone from the plan or draft of the later source. It is inferred from the absent id, so an id misspelled in the file reads the same way; a review never sets it.
- **Validation state** — technical validation passed: this run ran tofu validate on the draft, it passed, and the record belongs to a family of the draft (security group, routing, identity or logs) that the validation covered. not validated: tofu validate was not asked for, did not run, or the record is a critical semantic of the source, which a schema check of the draft does not cover. failed: tofu validate rejected the draft that holds the family. It is a static check against the pinned provider schema, not target behaviour and not approval.

Each record also states its applications (a group the run suggested from the source is labelled PROPOSED: a suggestion, not an application you confirmed), its wave (the dependency order of the units, a technical order and not a schedule) and where its approval stands (STALE where the answer no longer holds, with the reason), and each option states its trade-off. The Decisions page states the same facts of each record.

Options come from the knowledge base (decision-kinds.yaml; knowledge-base evidence, not in this folder), each with the sources it rests on; an option whose id opens with derived- rests on the mapping of its unit or on the guidance of its setting and names no sources of its own. Choosing one in the decisions file changes no draft, no target-plan.json and no class, confidence or eligibility; its execution effect decides what the answer does to the step of the execution plan that waits for the decision: an option the draft already carries out frees it, an option that changes the draft keeps it held until the draft carries that option (the line of the option in decisions-template.yaml says whether an answer of the inputs file writes it or no answer of this build does), and an option with no stated effect frees nothing. The one exception is an option that declines a default of the draft (choose-the-size, choose-the-snapshot-count, choose-the-zone-per-server, keep-the-source-rules-and-redesign-a-firewall, machine-type-with-a-local-disk, persistent-volume-for-the-data): the run that reads that answer writes its draft without the default, and the value the default stood for is yours to set.

The records are in decisions.json; migration/decisions.csv is the flat form of the same records.

## Plan decisions · convert (5 records, 21 open items, 0 accepted; status open)

The records under this heading state these fields as follows; a record whose field reads otherwise shows it in its own table:

| Field | Value |
|---|---|
| Source | plan decisions of the draft |
| Family | convert |
| Status | Open: no decision of the record has been taken |
| Review state | unreviewed |
| Design state | open |
| Validation state | not validated |
| Required by phase | before the pilot |
| Blocking effect | the target design stays open: a field of the draft waits for this decision |
| Affected applications | 0 |
| Answer | not answered: no decisions file was given with this run |
| Options | 2, listed below |
| Recommended option | none |
| Review binding | bound to this run's source digest (see decisions.json) · KB 0.394.0 |

### api opt in (1 record)

#### DEC-GEN-CONVERT-API-OPT-IN

Why: The plan calls a STACKIT API that is not generally available (alpha, beta, or a release status its documentation does not state), which may change or be withdrawn, so it makes those calls only after you allow them (2 APIs): until you answer, the calls and the steps of their path wait. Allowing carries them out; refusing keeps the draft's own path where the API's path is an alternative beside it, and leaves the question open where the API is the only carrier of what its call sets. No block of the draft waits for it, and no unit's eligibility rests on it.

| Field | Value |
|---|---|
| Kind | `api opt in` |
| Owner role | Platform Architect |
| Plan decisions | 2 |
| Affected units | 3 |
| Applications touched | `migrate` (PROPOSED); google_secret_manager_secret.django_settings is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: migrate, server |
| Wave | waves 1 to 3 · steps in security, platform services |
| What an answer frees | The answer that frees most frees 5 steps of the plan (2 of them automated) by itself. |
| Options | 1, listed below |
| Members digest | `sha256:ad0b4646256d69e513051c7a948486002928b0d8da0e8c103efc9f267ec3d9fe` |

**Options** (1)

- `allow-calls-of-the-api`: Allow the calls of the API for this migration. The calls of the API the plan states are made as the plan writes them (the request documents of the execution package), and the steps of their path are taken; the migration then depends on an API that may change or vanish. **Trade-off:** the draft already carries it out, so the answer frees the steps that wait for it; in this run it frees 5 steps of the plan by itself.
  - SOURCE_CODE_VERIFIED, https://github.com/stackitcloud/stackit-api-specifications/blob/main/services/functions/v1alpha/functions.json#L767-L771, read 2026-10-23: "info": {"description": "This API provides endpoints for managing STACKIT Functions.", "title": "STACKIT Functions Core API", "version": "1alpha"}

**Required evidence (the plan's reasons, then what the knowledge base asks for)** (3)

- the Secrets Manager Vault-compatible API is of a maturity that is not established (its documentation states no release status and its product documentation does not establish it as generally available): the execution plan executes no call of an API that is not generally available without an explicit opt-in, so the calls of it and the steps of its path for google_secret_manager_secret.django_admin_password, google_secret_manager_secret.django_settings wait for this decision; the draft's own blocks do not
- the pubsub API v1beta is beta: the execution plan executes no call of an API that is not generally available without an explicit opt-in, so the calls of it and the steps of its path for google_pubsub_topic.faux wait for this decision; the draft's own blocks do not
- the platform's consent to depend on an API that may change or vanish (alpha, beta, or a maturity the documentation does not establish)

**Plan decisions** (2)

- `DEC-GEN-CONVERT-API-OPT-IN/google_pubsub_topic.faux` (alias `convert:api:pubsub:v1beta:beta:API_OPT_IN`)
- `DEC-GEN-CONVERT-API-OPT-IN/google_secret_manager_secret.django_admin_password` (alias `convert:api:secrets-manager-vault:v1:unknown:API_OPT_IN`)

**Affected units** (3)

- `google_pubsub_topic.faux`
- `google_secret_manager_secret.django_admin_password`
- `google_secret_manager_secret.django_settings`

### data movement (1 record)

#### DEC-GEN-CONVERT-DATA-MOVEMENT

Why: The method that moves the data of a store (a database, a cache, a search domain, or the objects of a bucket) to its STACKIT service is a person's choice (1 converter decision): the steps of each method are in the plan where the planner covers the store (a PostgreSQL database and an S3 bucket, each with the runbook of the move), and the plan holds one manual step the person writes where it does not; the steps of the move wait for the choice. The choice decides how the data is moved, not whether it is: every method is work a person does by hand, so the unit that owns one keeps a manual data-migration step, and answering it does not take that step away.

| Field | Value |
|---|---|
| Kind | `data movement` |
| Owner role | Data Architect |
| Plan decisions | 1 |
| Affected units | 1 |
| Applications touched | none: no applications file was given and no suggested group is known to hold an affected unit; google_sql_database_instance.postgres is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: migrate, server |
| Wave | wave 1 · steps in data services, cutover, decommission |
| What an answer frees | The answer that frees most frees 6 steps of the plan (none of them automated) by itself; 7 of the 13 steps it holds stay held (7 steps need another option or a path of a person). |
| Options | 5, listed below |
| Members digest | `sha256:84bb3ebfd40276eeeabadf6428f1d880feb76324d64e689f3269ad76bb2b327d` |

**Options** (5)

- `export-and-import-with-the-engine-clients`: Export the data from the source and import it with the clients of the target engine. A person exports the data from the source and imports it into the STACKIT instance with the clients of its engine during a window the business accepts, then checks that the copy is complete; the clients reach the instance at the host and port its credential states. The source and the target engine may differ (DynamoDB to MongoDB Flex), so the export is converted where they do. The plan holds the steps of this option as typed steps: for a PostgreSQL database, for a MySQL, MariaDB or Aurora MySQL database moving to MariaDB and for an RDS for SQL Server database moving to SQLServer Flex (the native backup, its copy to a STACKIT S3 bucket and the import_database call) the preflight, the rehearsal, the write freeze, the dump or backup and the restore or import inside it, the reconcile and the cleanup; for an ElastiCache, MemoryDB or ElastiCache serverless cache moving to a Key Value Store the preflight, the rehearsal, the write freeze, the copy by a client, the reconcile and the cleanup; for an Amazon Aurora DSQL cluster moving to PostgreSQL Flex the preflight, the rehearsal, the write freeze, the copy of the tables by a client (the schema from the catalogs of the cluster, or from pg_dump --schema-only where the preflight shows that it works, and the rows through the PostgreSQL protocol: no AWS page read documents a dump of a cluster), the reconcile and the cleanup; for an OpenSearch store the write freeze, the copy and the reconcile. The decision offers this option only for a store whose STACKIT service documents a way in with such clients: PostgreSQL Flex (for an Aurora DSQL cluster, which has no change stream, this option and the tool of the customer's own are the only ones; the replication of the engine is not offered), MariaDB (the mysql client loads a dump into an empty instance), SQLServer Flex (a .bak file imported with import_database), Key Value Store (the tutorial migrates a Redis instance by the MIGRATE command; for an ElastiCache source, where AWS lists migrate among the commands unavailable for caches running Redis OSS, the copy is a client that iterates the keys with SCAN and copies each with DUMP, PTTL and RESTORE; for a MemoryDB source, where AWS lists migrate, sync, psync, bgsave, save and config among the unavailable commands and the cluster mode is always on, the same client copy runs against every shard primary found with CLUSTER NODES or CLUSTER SLOTS, with TLS where the source has it and an ACL user that reaches every key; whether DUMP, RESTORE and PTTL run on a standard MemoryDB cluster is not stated by AWS, and for a member of a multi-Region cluster, whose page lists PTTL as unsupported, the step says the TTLs are not carried) and OpenSearch (the reindex operation). For a store without a documented way in (MongoDB Flex, a memcached cache) it is not offered and the decision offers the tool of the customer's own alone. **Trade-off:** a person carries it out: the answer frees only the manual step that does; in this run it frees 4 steps of the plan by itself.
  - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mariadb_credential.md#L51-L57, read 2026-10-23: Read-Only: host (String), hosts (List of String), ..., port (Number), uri (String, Sensitive)
  - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mongodbflex_user.md#L59-L63, read 2026-10-23: Read-Only: host (String), ..., port (Number), uri (String, Sensitive)
  - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/opensearch_credential.md#L51-L57, read 2026-10-23: Read-Only: host (String), hosts (List of String), ..., port (Number), ..., uri (String, Sensitive)
  - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/valkey_credential.md#L51-L57, read 2026-10-23: Read-Only: host (String), hosts (List of String), load_balanced_host (String), ..., port (Number), uri (String, Sensitive) Connection URI.
  - OFFICIAL_DOCUMENTED, https://docs.stackit.cloud/products/databases/mariadb/how-tos/backup-and-restore/, read 2026-10-30: Connect to the database and import the backup.
  - OFFICIAL_DOCUMENTED, https://docs.stackit.cloud/products/databases/sqlserver-flex/how-tos/import-database-backup-from-stackit-s3-into-sqlserver-flex/, read 2026-10-30: You have uploaded the database to be imported as .bak file(s) to the STACKIT S3 bucket
  - OFFICIAL_DOCUMENTED, https://docs.stackit.cloud/products/databases/key-value-store/tutorials/migrate-data-to-a-new-instance/, read 2026-10-30: The main strategy to migrate the whole dataset from the source to the target is based on the MIGRATE command.
  - OFFICIAL_DOCUMENTED, https://docs.aws.amazon.com/AmazonElastiCache/latest/dg/SupportedCommands.html, read 2026-10-30: For caches running Redis OSS, the following commands are unavailable:
  - OFFICIAL_DOCUMENTED, https://docs.aws.amazon.com/memorydb/latest/devguide/restrictedcommands.html, read 2026-10-30: To deliver a managed service experience, MemoryDB restricts access to certain commands that require advanced privileges. The following commands are unavailable:
  - OFFICIAL_DOCUMENTED, https://docs.stackit.cloud/products/databases/opensearch/how-tos/migrate-elasticsearch-data-to-an-opensearch2-service-instance/, read 2026-10-30: to use the `reindex` Data Operation
- `replicate-with-the-engine-replication`: Replicate the data with the replication of the source engine until the cutover. A person sets up the replication of the source engine so that the STACKIT instance follows the source while the application keeps writing to the source (for PostgreSQL, logical replication: the schema is copied first with pg_dump --schema-only, a publication on the source and a subscription on the target copy the existing rows and then the changes, and the sequences are copied inside the write freeze because they are not replicated). The source needs a change and a reboot to turn replication on, and the target must be able to reach the source. Inside the write freeze the person waits until the target has caught up, compares both sides and switches the clients, then removes the replication. For a PostgreSQL database the plan holds the steps of this option (the initial copy, the watch of the lag, the freeze, the final copy, the reconcile and the cleanup); for an S3 bucket this option is not available, because S3 Replication copies between Amazon S3 buckets and no STACKIT bucket is documented as a destination (the plan holds the two copy tools instead); for any other engine this option is not offered, because no STACKIT service other than PostgreSQL Flex documents the replication of a source engine into it (MariaDB, Key Value Store, OpenSearch and MongoDB Flex document none, and the SQLServer Flex page on transactional replication describes an on-premises publisher and does not name Amazon RDS as one), so the decision of such a store offers the export and the import with the engine clients where its service documents them, and the tool of the customer's own. **Trade-off:** a person carries it out: the answer frees only the manual step that does; in this run it frees 6 steps of the plan by itself.
  - OFFICIAL_DOCUMENTED, https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html, read 2026-10-30: You can use replication to enable automatic, asynchronous copying of objects across Amazon S3 buckets.
  - OFFICIAL_DOCUMENTED, https://www.postgresql.org/docs/current/logical-replication-restrictions.html, read 2026-10-29: The database schema and DDL commands are not replicated. The initial schema can be copied by hand using pg_dump --schema-only.
  - OFFICIAL_DOCUMENTED, https://www.postgresql.org/docs/current/logical-replication-restrictions.html, read 2026-10-29: Sequence data is not replicated.
  - OFFICIAL_DOCUMENTED, https://www.postgresql.org/docs/current/sql-createsubscription.html, read 2026-10-29: To be able to create a subscription, you must have the privileges of the pg_create_subscription role, as well as CREATE privileges on the current database.
  - OFFICIAL_DOCUMENTED, https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.General.FeatureSupport.LogicalReplication.html, read 2026-10-29: Set the rds.logical_replication static parameter to 1.
  - OFFICIAL_DOCUMENTED, https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/PostgreSQL.Concepts.General.FeatureSupport.LogicalReplication.html, read 2026-10-29: Reboot the DB instance for the static rds.logical_replication parameter to take effect.
- `copy-the-objects-with-rclone`: Copy the objects of the bucket with rclone, from the source bucket to the STACKIT bucket. For an S3 bucket: a person runs rclone on a move host that reaches both endpoints, with two S3 remotes (the source with the AWS credentials of the shell, the target as a provider Other remote at the STACKIT S3 endpoint with a credential of a credentials group, both read from the environment at run time), copies every current object while the writers keep writing, repeats the copy until a pass is short, stops the writers, runs the last pass, settles what the source deleted after the first copy, and compares both sides (the count and the bytes, the key lists and, where a hash is shared, the content) before the applications are switched. The copy carries the current object of every key and nothing of the bucket's configuration: no older version, no delete marker, no retention, no ACL, no policy; those are settled where the draft names them. The plan holds the steps of this option (the initial copy, the passes, the freeze, the last pass, the reconcile and the cleanup) with command templates and no credential value. No copy was run against a STACKIT bucket by StackToIT. **Trade-off:** a person carries it out: the answer frees only the manual step that does; in this run it frees no step of the plan.
  - OFFICIAL_DOCUMENTED, https://docs.stackit.cloud/products/storage/object-storage/tutorials/migrate-data-using-rclone/, read 2026-10-30: rclone copy source:/BUCKET_NAME destination:/BUCKET_NAME --s3-upload-cutoff 0 --progress --log-file /tmp/rclone.log
  - OFFICIAL_DOCUMENTED, https://rclone.org/commands/rclone_copy/, read 2026-10-30: Copy files from source to dest, skipping identical files. ... Doesn't delete files from the destination.
  - OFFICIAL_DOCUMENTED, https://rclone.org/commands/rclone_check/, read 2026-10-30: compares sizes and hashes (MD5 or SHA1) and logs a report of files that don't match.
  - OFFICIAL_DOCUMENTED, https://docs.stackit.cloud/products/storage/object-storage/reference/supported-operations-on-buckets-and-objects/, read 2026-10-30: Create Multipart Upload: Initiates a multipart upload and returns an upload ID.
- `copy-the-objects-with-the-aws-cli`: Copy the objects of the bucket with the AWS CLI, through a staging directory. For an S3 bucket: a person runs the AWS CLI on a move host with free disk for the data. One command sends its requests to one endpoint, so the objects are downloaded from the AWS bucket into a directory with aws s3 sync and uploaded from it to the STACKIT bucket with aws s3 sync and --endpoint-url set to the STACKIT S3 endpoint, with the credential of a credentials group read from the environment at run time. The data crosses the host twice, one pass after the other; aws s3 sync decides by size and last-modified time and never compares the content, so the comparison before the switch downloads the target and compares the files. The copy carries the current object of every key and nothing of the bucket's configuration, as with rclone. The plan holds the steps of this option with command templates and no credential value. No copy was run against a STACKIT bucket by StackToIT. **Trade-off:** a person carries it out: the answer frees only the manual step that does; in this run it frees no step of the plan.
  - OFFICIAL_DOCUMENTED, https://docs.aws.amazon.com/cli/latest/reference/s3/sync.html, read 2026-10-30: An S3 object will require copying if the sizes of the two S3 objects differ, the last modified time of the source is newer than the last modified time of the destination, or the S3 object does not exist under the specified bucket and prefix destination.
  - OFFICIAL_DOCUMENTED, https://docs.aws.amazon.com/cli/v1/userguide/cli-configure-options.html, read 2026-10-30: --endpoint-url <string> Specifies the URL to send the request to.
  - OFFICIAL_DOCUMENTED, https://docs.stackit.cloud/products/storage/object-storage/how-tos/manage-encryption/, read 2026-10-30: aws s3 cp ./my-file.txt s3://my-bucket/ --sse AES256 --endpoint-url https://object.storage.eu01.onstackit.cloud
- `migrate-with-a-tool-of-my-own`: Move the data with a migration tool or a replication of the owner's own. A person moves the data with a tool or a replication they run (for example a change-data-capture replication that keeps the copy in step until the cutover), writes its steps, the checks before the move, the cutover window and the way back, and carries them out. The STACKIT instance is reached at the host and port its credential states. The plan holds that work as typed steps: the write freeze of the source, the copy as one step whose commands the person writes, and the reconcile that compares both sides; the source stays the way back until the reconcile records GO, which a person checks, since the plan cannot know that the tool leaves the source unchanged. A memcached cache holds a confirmation instead of a copy. A bucket repeated by count or for_each has neither a reconcile nor any other option: its instances and the buckets they move to are not named, so the plan holds the one manual step, which the person writes for each instance after naming them. **Trade-off:** a person carries it out: the answer frees only the manual step that does; in this run it frees 3 steps of the plan by itself.
  - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/mariadb_credential.md#L51-L57, read 2026-10-23: Read-Only: host (String), hosts (List of String), ..., port (Number), uri (String, Sensitive)

**Required evidence (the plan's reasons, then what the knowledge base asks for)** (2)

- the plan defines both methods of the engine (a dump restored inside the write freeze, and a logical replication that follows the changes until the freeze) and keeps them open: which one applies depends on the size of the data, the write rate and the downtime the business accepts, and the source states none of them; the steps of the methods wait for the answer
- the size of the data, the downtime the business tolerates and the consistency the application needs, to choose the method and the cutover window

**Plan decisions** (1)

- alias `convert:google_sql_database_instance.postgres:data:DATA_MOVEMENT`

**Affected units** (1)

- `google_sql_database_instance.postgres`

### proposed alternative (1 record)

#### DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE

Why: The target has no equal of a source capability, and the draft holds a STACKIT alternative in a module that is switched off (8 converter decisions): nothing of the module applies until a person accepts the stated difference, gives it its values and sets its switch, or designs the capability another way.

| Field | Value |
|---|---|
| Kind | `proposed alternative` |
| Owner role | Platform Architect |
| Plan decisions | 8 |
| Affected units | 7 |
| Applications touched | `migrate` (PROPOSED); google_secret_manager_secret.django_settings is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: migrate, server; google_storage_bucket.media is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: migrate, server |
| Wave | waves 2 to 3 · steps in data services, workloads |
| What an answer frees | The answer that frees most frees 4 steps of the plan (none of them automated) by itself. |
| Members digest | `sha256:af35ed50b2c8832725ee5a41a11f947f09e19ee3a5aad77e3417356fd0bd96e9` |

**Options** (2)

- `use-the-proposed-module`: Use the proposed module, with the stated difference. A person reads the module, sets its values and sets its switch to true: the module is then part of the plan of the draft, with the stated difference from the source. While the switch is false, the module creates nothing. **Trade-off:** the draft already carries it out, so the answer frees the steps that wait for it; in this run it frees 4 steps of the plan by itself.
  - OFFICIAL_DOCUMENTED, https://opentofu.org/docs/language/meta-arguments/count/, read 2026-11-05: If a resource or module block includes a count argument whose value is a whole number, OpenTofu will create that many instances.
- `design-it-another-way`: Design it another way and leave the module off. A person designs the capability another way, by hand, and the switch of the module stays false: the module creates nothing and the unit's manual step stays the person's work. **Trade-off:** a person carries it out: the answer frees only the manual step that does; in this run it frees 4 steps of the plan by itself.
  - OFFICIAL_DOCUMENTED, https://opentofu.org/docs/language/meta-arguments/count/, read 2026-11-05: If a resource or module block includes a count argument whose value is a whole number, OpenTofu will create that many instances.

**Required evidence (the plan's reasons, then what the knowledge base asks for)** (7)

- the target has no equal of this Cloud Build trigger: starts a build on a source event, a Pub/Sub message, a webhook or by hand, with its steps, substitutions, artifacts, secrets and optional approval: Nothing is converted. The same delivery is a workflow of STACKIT Git Pipelines (written for GitHub Actions; STACKIT-managed or custom runners; secrets from Secrets Manager or the repository; a manual-approval action) or the customer's own CI/CD. Trigger conditions, steps, secrets (created again, never copied), the service account (replaced by the credentials the workflow uses against STACKIT), the log destination and the approval are written again by a person. To decide: Which pipelines are still needed, where they run (STACKIT Git Pipelines or the customer's own CI/CD), how each trigger, step, secret and approval is written again, and who owns the workflow files.
- the target has no equal of this one member's role on the Cloud Storage bucket: A STACKIT credentials group is not a grant on the Cloud Storage bucket. It is the principal that a bucket policy names, a set of S3 keys with no Google identity behind it, and by itself it gives no access to the bucket and takes none away. The statement that grants it something is a statement of the bucket policy, in the policy language of STACKIT (a credentials group or * as the principal, S3 actions, five condition keys), which no Terraform resource sets. The Google role is not mapped to S3 actions by any table, the condition of the grant has no counterpart unless it can be written with those five condition keys, and a Google group, a domain, a federated identity and allUsers or allAuthenticatedUsers are named again as credentials groups or as *. To decide: Which credentials group stands for each member of the grant, which S3 actions of the bucket policy give the same people the access they need and no more than the Google role gave, what becomes of the condition, of public members (allUsers, allAuthenticatedUsers), of Google groups, domains and federated identities, and whether the grant ends with the Cloud Storage bucket when it has no replacement. Which bucket the grant is on, because the scan does not hold it. The draft of google_storage_bucket.media stands as it is: this answer decides the module and nothing of that draft.
- the target has no equal of this static web hosting site: Static files are published into an Object Storage bucket by a pipeline, and a CDN distribution (a beta resource) with the bucket as origin serves them on a custom domain; the redirects of the site become redirect rules of the distribution. Custom response headers, rewrites to Cloud Run services or Cloud Functions, preview channels and the release history have no counterpart and are restated in the pipeline or in the application. To decide: Which bucket is the origin, which domain the distribution serves, and how rewrites and previews are replaced. The CDN resources are beta.
- the target has no equal of this the members of one role on the Secret Manager secret: A STACKIT role assignment is not a grant on the Secret Manager secret. It gives one user, group or service account one STACKIT role on a whole project, folder or organisation. The role is a set of STACKIT permissions, not the Google role, and no table maps one to the other. It has no condition and no public member, so what the grant gave to a Google group, a domain, a federated identity or everyone is named again, and the access reaches more than the Secret Manager secret. A binding on a secret group applies to every secret in the group, so it is wider than a grant on one secret unless the secret has a group of its own, and its roles are Secrets Manager roles. The binding was authoritative for its role: STACKIT role assignments are additive, so a person who holds the role through another assignment keeps it, and removing such people is a step of a person. To decide: Which STACKIT role, on which project, folder or organisation, gives the same people the access they need on the Secret Manager secret, knowing it covers everything in that scope; which STACKIT users, groups or service accounts take the place of Google groups, domains, federated identities and a public member; and whether the grant ends with the Secret Manager secret when it has no replacement. For secrets: which secret group holds the secret, who else shares that group, and which Secrets Manager role and subject take the grant. Whether people who hold the role through another assignment keep it. The draft of google_secret_manager_secret.django_admin_password stands as it is: this answer decides the module and nothing of that draft.
- the target has no equal of this the members of one role on the Secret Manager secret: A STACKIT role assignment is not a grant on the Secret Manager secret. It gives one user, group or service account one STACKIT role on a whole project, folder or organisation. The role is a set of STACKIT permissions, not the Google role, and no table maps one to the other. It has no condition and no public member, so what the grant gave to a Google group, a domain, a federated identity or everyone is named again, and the access reaches more than the Secret Manager secret. A binding on a secret group applies to every secret in the group, so it is wider than a grant on one secret unless the secret has a group of its own, and its roles are Secrets Manager roles. The binding was authoritative for its role: STACKIT role assignments are additive, so a person who holds the role through another assignment keeps it, and removing such people is a step of a person. To decide: Which STACKIT role, on which project, folder or organisation, gives the same people the access they need on the Secret Manager secret, knowing it covers everything in that scope; which STACKIT users, groups or service accounts take the place of Google groups, domains, federated identities and a public member; and whether the grant ends with the Secret Manager secret when it has no replacement. For secrets: which secret group holds the secret, who else shares that group, and which Secrets Manager role and subject take the grant. Whether people who hold the role through another assignment keep it. The draft of google_secret_manager_secret.django_settings stands as it is: this answer decides the module and nothing of that draft.
- that the stated difference from the source is acceptable for what depends on it
- the values the module asks for, which the draft does not invent

**Plan decisions** (8)

- `DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE/google_cloudbuild_trigger.activategcb` (alias `convert:google_cloudbuild_trigger.activategcb:proposal:PROPOSED_ALTERNATIVE`)
- `DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE/google_cloudbuild_trigger.init` (alias `convert:google_cloudbuild_trigger.init:proposal:PROPOSED_ALTERNATIVE`)
- `DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE/google_cloudbuild_trigger.placeholder` (alias `convert:google_cloudbuild_trigger.placeholder:proposal:PROPOSED_ALTERNATIVE`)
- `DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE/google_firebase_hosting_site.client` (alias `convert:google_firebase_hosting_site.client:proposal:PROPOSED_ALTERNATIVE`)
- `DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE/google_secret_manager_secret_iam_binding.django_admin_password` (alias `convert:google_secret_manager_secret_iam_binding.django_admin_password:proposal:PROPOSED_ALTERNATIVE`)
- `DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE/google_secret_manager_secret_iam_binding.django_settings` (alias `convert:google_secret_manager_secret_iam_binding.django_settings:proposal:PROPOSED_ALTERNATIVE`)
- `DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE/google_storage_bucket_iam_member.automation` (alias `convert:google_storage_bucket_iam_member.automation:proposal:PROPOSED_ALTERNATIVE`)
- `DEC-GEN-CONVERT-PROPOSED-ALTERNATIVE/google_storage_bucket_iam_member.server` (alias `convert:google_storage_bucket_iam_member.server:proposal:PROPOSED_ALTERNATIVE`)

**Affected units** (7)

- `google_cloudbuild_trigger.activategcb`
- `google_cloudbuild_trigger.init`
- `google_cloudbuild_trigger.placeholder`
- `google_firebase_hosting_site.client`
- `google_secret_manager_secret.django_admin_password`
- `google_secret_manager_secret.django_settings`
- `google_storage_bucket.media`

### source project mapping (1 record)

#### DEC-GEN-CONVERT-SOURCE-PROJECT-MAPPING

Why: Where the units of each source project go is one statement a person makes for the estate: the source project is carried nowhere, the draft keeps its own project resolver, and the answer changes nothing in the draft. There is no default. It holds 4 open critical settings of the estate: an answer in the inputs file closes those of its place, and a review of this record records the confirmation and closes none of them.

| Field | Value |
|---|---|
| Kind | `source project mapping` |
| Owner role | Platform Architect |
| Plan decisions | 5 |
| Affected units | 4 |
| Applications touched | none: no applications file was given and no suggested group is known to hold an affected unit; google_sql_database_instance.postgres is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: migrate, server |
| Wave | wave 1 · steps in data services, workloads |
| What an answer frees | The answer that frees most frees 1 step of the plan (none of them automated) by itself. |
| Members digest | `sha256:bfe72ff4b84be59f91d62c726bb588d393af2d2beebf6f921538125bffe5ffd9` |

**Options** (2)

- `units-go-to-the-project-variable`: The units of the source project go to the project the variable project_id names. A person states that the units of this source project go to the STACKIT project var.project_id names. The source project is carried nowhere: the answer records the person's mapping, changes nothing in the draft, which keeps its own project resolver, and closes the settings of that project. **Trade-off:** the draft already carries it out, so the answer frees the steps that wait for it; in this run it frees 1 step of the plan by itself.
  - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network.md, read 2026-11-06: `project_id` (String) STACKIT project ID to which the network is associated.
- `units-go-to-the-project-of-their-network`: The units of the source project go to the project of their network. A person states that the units of this source project go to the STACKIT project of the network they stand in. The network design maps a source network to a target project, and no map from a source project to a target project exists: the answer records the person's mapping, changes nothing in the draft, which keeps its own project resolver, and closes the settings of that project. **Trade-off:** the draft already carries it out, so the answer frees the steps that wait for it; in this run it frees 1 step of the plan by itself.
  - OFFICIAL_DOCUMENTED, https://github.com/stackitcloud/terraform-provider-stackit/blob/v0.119.0/docs/resources/network.md, read 2026-11-06: `project_id` (String) STACKIT project ID to which the network is associated.

**Required evidence (the plan's reasons, then what the knowledge base asks for)** (2)

- The source places its units in the project example-project, and in a project the scan cannot read for some units, and the source project is carried nowhere. A person maps the source projects by answering target.project.source_project for each: var.project_id, or the project of the unit's network (network-project). The answer records that mapping and changes nothing in the draft, which keeps its own project resolver.
- which source projects stay one STACKIT project and which do not, and who owns each

**Plan decisions** (5)

- alias `convert:estate:source_project:SOURCE_PROJECT_MAPPING`
- `google_cloudbuild_trigger.activategcb|project-residency`
- `google_cloudbuild_trigger.init|project-residency`
- `google_cloudbuild_trigger.placeholder|project-residency`
- `google_sql_database_instance.postgres|project-scope`

**Affected units** (4)

- `google_cloudbuild_trigger.activategcb`
- `google_cloudbuild_trigger.init`
- `google_cloudbuild_trigger.placeholder`
- `google_sql_database_instance.postgres`

### source region mapping (1 record)

#### DEC-GEN-CONVERT-SOURCE-REGION-MAPPING

Why: Each source location the estate uses maps to one STACKIT region, once for the estate: the draft builds in one region and states it as a default to confirm, no mapping between the source's regions and STACKIT's is evidenced, and a default closes nothing. A location answered with another region places its buckets, databases and caches there; what needs a network stays in the region of the draft. It holds 4 open critical settings of the estate: an answer in the inputs file closes those of its place, and a review of this record records the confirmation and closes none of them.

| Field | Value |
|---|---|
| Kind | `source region mapping` |
| Owner role | Platform Architect |
| Plan decisions | 5 |
| Affected units | 4 |
| Applications touched | `migrate` (PROPOSED), `server` (PROPOSED); google_sql_database_instance.postgres is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: migrate, server; google_storage_bucket.media is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: migrate, server |
| Wave | waves 1 to 4 · steps in data services |
| What an answer frees | The answer that frees most frees 1 step of the plan (none of them automated) by itself. |
| DEFAULT (change if wrong) | `map-source-locations-to-the-draft-region`, answered by DEFAULT: the draft builds every unit in the STACKIT region eu01, which is what it does with no answer. That is a region the catalogue of this build lists and no claim that it holds the residency of the source: only an answer of target.region.source_location closes the settings this decision holds. |
| Members digest | `sha256:1be5810bd6bed11fb1fc02fe831c232fd9d2b9eaa1ed6c2f21eb8923722e1372` |

**Options** (2)

- `map-source-locations-to-the-draft-region`: Map every source location of the estate to the one STACKIT region the draft builds in. **DEFAULT (change if wrong):** the draft carries this option out and the record stays open. The draft builds every unit in the one region of the estate, and that is what it does with no answer. STACKIT hosts its regions in Germany and Austria, each physically separate from the others, so the region is not shown to hold the residency a source location gave: the option states where the draft builds and claims no equal residency. A review of this option records the confirmation and closes no setting; an answer of target.region.source_location for each location closes the settings of that location. **Trade-off:** the draft already carries it out, so the answer frees the steps that wait for it; in this run it frees 1 step of the plan by itself.
  - OFFICIAL_DOCUMENTED, https://docs.stackit.cloud/platform/regions/, read 2026-11-05: STACKIT hosts all regions exclusively in Germany (eu01) and Austria (eu02).
  - OFFICIAL_DOCUMENTED, https://docs.stackit.cloud/platform/regions/, read 2026-11-05: Each region remains physically separate from others.
- `choose-the-region-of-each-location`: Choose the STACKIT region of each source location. An answer of target.region.source_location names the region of one source location, and the units whose location the scan cannot read are one more subject of the same topic. An answer that names the region the draft builds in closes the settings of that location. The draft builds in one region, so an answer that names another region is recorded, and read by the network design, and closes nothing until the estate is built there (target.region). Whether a region holds the residency of a source location stays the person's statement. **Trade-off:** it changes the draft: answer target.region.source_location in the inputs file (--inputs) and run again; the steps stay held until the draft carries it; in this run it frees no step of the plan.
  - OFFICIAL_DOCUMENTED, https://docs.stackit.cloud/platform/regions/, read 2026-11-05: STACKIT hosts all regions exclusively in Germany (eu01) and Austria (eu02).
  - OFFICIAL_DOCUMENTED, https://docs.stackit.cloud/platform/regions/, read 2026-11-05: While STACKIT maintains parity across all locations, we may release specialized services or newer features in specific regions first.

**Required evidence (the plan's reasons, then what the knowledge base asks for)** (2)

- The source places its units in a location the scan cannot read (the value comes from an input a plan can change, or the source does not state it). No mapping between Google and STACKIT regions is evidenced, so the region the draft builds in is not shown to hold the residency of a source location: a person states it once for the estate, by answering target.region.source_location for each location.
- the residency requirement behind each source location (a law, a contract, a policy) and the STACKIT region that meets it

**Plan decisions** (5)

- alias `convert:estate:source_location:SOURCE_REGION_MAPPING`
- `google_cloud_run_v2_job.migrate|location-residency`
- `google_cloud_run_v2_service.server|location-residency`
- `google_sql_database_instance.postgres|region-residency`
- `google_storage_bucket.media|bucket-region`

**Affected units** (4)

- `google_cloud_run_v2_job.migrate`
- `google_cloud_run_v2_service.server`
- `google_sql_database_instance.postgres`
- `google_storage_bucket.media`

## Critical semantics · gcp.cloud_run (9 records, 21 open items, 0 accepted; status open)

The records under this heading state these fields as follows; a record whose field reads otherwise shows it in its own table:

| Field | Value |
|---|---|
| Kind | `the critical settings of a unit` |
| Source | open critical semantic |
| Family | gcp.cloud_run |
| Status | Open: no decision of the record has been taken |
| Review state | unreviewed |
| Design state | open |
| Validation state | not validated |
| Required by phase | not stated: the plan names no phase for this decision |
| Blocking effect | the engine leaves this critical semantic open on the units listed: a person decides or accepts it, and a review of this record does not change the engine's reading |
| Affected applications | 0 |
| Applications touched | `server` (PROPOSED) |
| Wave | wave 4 · steps in platform services |
| Answer | not answered: no decisions file was given with this run |
| Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented |
| Recommended option | none |
| Review binding | bound to this run's source digest (see decisions.json) · KB 0.394.0 |

The reason of each record of critical settings below ends the same way, so it is said here once: for each setting, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of its record with its own reason, members and review state. A review of a record is the architect's answer beside the engine's reading; it closes nothing.

### google_cloud_run_v2_job.migrate (4 records)

#### DEC-IAM-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE

Why: The knowledge base cannot decide 1 critical setting of google_cloud_run_v2_job.migrate.

| Field | Value |
|---|---|
| Owner role | Identity Architect |
| Open critical semantics (unit and semantic) | 1 |
| Affected units | 1 |
| Applications touched | `migrate` (PROPOSED) |
| Members digest | `sha256:6d8e764691c2b3f560403316def3586a0b4f7662f6b183ca8a876e22b4f6ad93` |

**Settings** (1)

- **Review the service identity setting** (`service-identity`, record before the settings of a unit were one record: `DEC-IAM-GCP-CLOUD-RUN-SERVICE-IDENTITY`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "service-identity" of the gcp.cloud_run contract for 1 unit (carried into the draft): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: This setting follows the decision on the unit; it is not decided on its own.

**Open critical semantics (unit and semantic)** (1)

- `google_cloud_run_v2_job.migrate|service-identity`

**Affected units** (1)

- `google_cloud_run_v2_job.migrate`

#### DEC-NET-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE

Why: The knowledge base cannot decide 1 critical setting of google_cloud_run_v2_job.migrate.

| Field | Value |
|---|---|
| Owner role | Network Architect |
| Open critical semantics (unit and semantic) | 1 |
| Affected units | 1 |
| Applications touched | `migrate` (PROPOSED) |
| Options | the options are those of the settings: 1 setting of them list options, below |
| Members digest | `sha256:5f61f359aed7bddb0e87466e258be5e63147063c19a9cd13dbb420ae4128c575` |

**Settings** (1)

- **Review the cloud run v2 job network exposure setting** (`cloud-run-v2-job-network-exposure`, record before the settings of a unit were one record: `DEC-NET-GCP-CLOUD-RUN-CLOUD-RUN-V2-JOB-NETWORK-EXPOSURE`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "cloud-run-v2-job-network-exposure" of the gcp.cloud_run contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: Review the cloud run v2 job network exposure setting for google_cloud_run_v2_job.migrate: Decide how Kubernetes Job/CronJob on SKE carries this setting, or accept the difference. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
  - Option `derived-carry-on-the-target-ae560c1053b1`: Carry the setting on Kubernetes Job/CronJob on SKE. You design how Kubernetes Job/CronJob on SKE carries this setting and build it outside the draft. The draft does not change and no step is freed by it. **Trade-off:** the answer records your choice and frees no step.
  - Option `derived-accept-the-difference-ae560c1053b1`: Accept the difference. The target does not carry this setting as the source states it, and you record that as accepted. The draft does not change and no step is freed by it. **Trade-off:** the answer records your choice and frees no step.

**Open critical semantics (unit and semantic)** (1)

- `google_cloud_run_v2_job.migrate|cloud-run-v2-job-network-exposure`

**Affected units** (1)

- `google_cloud_run_v2_job.migrate`

#### DEC-OPS-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE

Why: The knowledge base cannot decide 7 critical settings of google_cloud_run_v2_job.migrate. 1 of them is carried by the draft already: a person only confirms it. The review step of the execution plan for these settings is MAN/semantic/google_cloud_run_v2_job.migrate/open-settings-platform-architect.

| Field | Value |
|---|---|
| Owner role | Platform Architect |
| Open critical semantics (unit and semantic) | 7 |
| Affected units | 1 |
| Applications touched | `migrate` (PROPOSED) |
| Wave | wave 4 · steps in platform services, workloads |
| Options | the options are those of the settings: 2 settings of them list options, below |
| Members digest | `sha256:685b77a28b897320d29a0b28c3f0b7ecff0c3c23f08ebf48e4fb10892434a8c7` |

**Settings** (7)

- **Choose the container image or artifact** (`deployment-artifact`, record before the settings of a unit were one record: `DEC-OPS-GCP-CLOUD-RUN-DEPLOYMENT-ARTIFACT`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "deployment-artifact" of the gcp.cloud_run contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: Choose the container image or artifact for google_cloud_run_v2_job.migrate: A person confirms the executable artifact or image for the STACKIT target: where it is built or pulled from and that the same build runs there. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
  - Option `workload-on-ske`: Run the container as a workload on SKE. A service or a function that already runs as a container image moves as a Deployment on a SKE cluster, which is a managed Kubernetes service. Scale to zero and the billing per request go away unless an autoscaler that scales to zero is operated on the cluster. **Trade-off:** its effect on the steps is not stated: an answer frees nothing.
  - Option `app-on-cloud-foundry`: Push the application to STACKIT Cloud Foundry. STACKIT Cloud Foundry is a managed platform for applications that a developer deploys and scales; the application is pushed from its image or its code. Scale to zero and the billing per request go away. **Trade-off:** its effect on the steps is not stated: an answer frees nothing.
- **Confirm the entry point of the function** (`entry-point`, record before the settings of a unit were one record: `DEC-OPS-GCP-CLOUD-RUN-ENTRY-POINT`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "entry-point" of the gcp.cloud_run contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: Confirm the entry point of the function for google_cloud_run_v2_job.migrate: Decide how Kubernetes Job/CronJob on SKE carries this setting, or accept the difference. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
  - Option `derived-carry-on-the-target-ae560c1053b1`: Carry the setting on Kubernetes Job/CronJob on SKE. You design how Kubernetes Job/CronJob on SKE carries this setting and build it outside the draft. The draft does not change and no step is freed by it. **Trade-off:** the answer records your choice and frees no step.
  - Option `derived-accept-the-difference-ae560c1053b1`: Accept the difference. The target does not carry this setting as the source states it, and you record that as accepted. The draft does not change and no step is freed by it. **Trade-off:** the answer records your choice and frees no step.
- **Review the k4 cloud run volume mount cloud run v2 job setting** (`k4-cloud-run-volume-mount-cloud-run-v2-job`, record before the settings of a unit were one record: `DEC-OPS-GCP-CLOUD-RUN-K4-CLOUD-RUN-VOLUME-MOUNT-CLOUD-RUN-V2-JOB`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "k4-cloud-run-volume-mount-cloud-run-v2-job" of the gcp.cloud_run contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: Review the k4 cloud run volume mount cloud run v2 job setting for google_cloud_run_v2_job.migrate: A person provides the data in the target workload at the path the application expects, with an owner and mode it can use, and checks that it finds its files. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
- **Confirm the name of the cloud run v2 job** (`tc-cloud-run-v2-job-name`, record before the settings of a unit were one record: `DEC-OPS-GCP-CLOUD-RUN-TC-CLOUD-RUN-V2-JOB-NAME`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "the name of the cloud run v2 job" of the gcp.cloud_run contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: Confirm the name of the cloud run v2 job for google_cloud_run_v2_job.migrate: The name of the service, job or worker pool becomes the name of the Deployment or Job, which must be a valid lower-case Kubernetes name. Everything that starts or calls the workload by its old name changes with it: a scheduler, a workflow or a pipeline that runs the job by name, a caller that uses the service address, a dashboard or an alert that filters by name. List those callers and update each one. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
- **Confirm the name of the env entry of the containers of the template of the template of the cloud run v2 job** (`tc-cloud-run-v2-job-template--template--containers--env--name`, record before the settings of a unit were one record: `DEC-OPS-GCP-CLOUD-RUN-TC-CLOUD-RUN-V2-JOB-TEMPLATE-TEMPLATE-CON-FAAB59CD`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "the name of the env entry of the containers of the template of the template of the cloud run v2 job" of the gcp.cloud_run contract for 1 unit (left for a person to decide): the draft already carries it, so a person only confirms it. A review of this record is the architect's answer beside the engine's reading; it closes nothing. The row of each member in assurance/critical-semantics.json (carried_by) names the step and the file that carry it.
  - Next: Confirm in the draft that the draft carries the name of the env entry of the containers of the template of the template of the cloud run v2 job for google_cloud_run_v2_job.migrate as the source relies on it; nothing needs deciding.
- **Confirm the name of the volumes entry of the template of the template of the cloud run v2 job** (`tc-cloud-run-v2-job-template--template--volumes--name`, record before the settings of a unit were one record: `DEC-OPS-GCP-CLOUD-RUN-TC-CLOUD-RUN-V2-JOB-TEMPLATE-TEMPLATE-VOLUMES-NAME`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "the name of the volumes entry of the template of the template of the cloud run v2 job" of the gcp.cloud_run contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: Confirm the name of the volumes entry of the template of the template of the cloud run v2 job for google_cloud_run_v2_job.migrate: This name only wires the manifest together: the name of a container, of a volume that a mount refers to, of a variable the application reads, or of a revision. Check the manifest holds each environment variable under exactly the name the application reads, and that every mount refers to a volume that exists in the manifest. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
- **Review the terraform destroy guard setting** (`terraform-destroy-guard`, record before the settings of a unit were one record: `DEC-DATA-GCP-CLOUD-RUN-TERRAFORM-DESTROY-GUARD`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "terraform-destroy-guard" of the gcp.cloud_run contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: Review the terraform destroy guard setting for google_cloud_run_v2_job.migrate: A person decides whether the replacement keeps the guard with lifecycle { prevent_destroy = true } in the Terraform code. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

**Required evidence (the plan's reasons, then what the knowledge base asks for)** (1)

- where the image is built or pulled from

**Open critical semantics (unit and semantic)** (7)

- `google_cloud_run_v2_job.migrate|deployment-artifact`
- `google_cloud_run_v2_job.migrate|entry-point`
- `google_cloud_run_v2_job.migrate|k4-cloud-run-volume-mount-cloud-run-v2-job`
- `google_cloud_run_v2_job.migrate|tc-cloud-run-v2-job-name`
- `google_cloud_run_v2_job.migrate|tc-cloud-run-v2-job-template--template--containers--env--name`
- `google_cloud_run_v2_job.migrate|tc-cloud-run-v2-job-template--template--volumes--name`
- `google_cloud_run_v2_job.migrate|terraform-destroy-guard`

**Affected units** (1)

- `google_cloud_run_v2_job.migrate`

#### DEC-SEC-GOOGLE-CLOUD-RUN-V2-JOB-MIGRATE

Why: The knowledge base cannot decide 1 critical setting of google_cloud_run_v2_job.migrate.

| Field | Value |
|---|---|
| Owner role | Security Architect |
| Open critical semantics (unit and semantic) | 1 |
| Affected units | 1 |
| Applications touched | `migrate` (PROPOSED) |
| Members digest | `sha256:eb72d924ef3dca3df509ae9675b4cd2374b14119b591b9ae674c3cc242c6ba62` |

**Settings** (1)

- **Create the Kubernetes Secrets for the Secret Manager references** (`secrets`, record before the settings of a unit were one record: `DEC-SEC-GCP-CLOUD-RUN-SECRETS`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "secrets" of the gcp.cloud_run contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: Create the Kubernetes Secrets for the Secret Manager references for google_cloud_run_v2_job.migrate: A person creates the Kubernetes Secrets the manifest lists, filled from STACKIT Secrets Manager (for example with an External Secrets Operator). Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

**Open critical semantics (unit and semantic)** (1)

- `google_cloud_run_v2_job.migrate|secrets`

**Affected units** (1)

- `google_cloud_run_v2_job.migrate`

### google_cloud_run_v2_service.server (5 records)

#### DEC-GEN-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER

Why: The knowledge base cannot decide 1 critical setting of google_cloud_run_v2_service.server. The review step of the execution plan for these settings is MAN/semantic/google_cloud_run_v2_service.server/open-settings-platform-architect.

| Field | Value |
|---|---|
| Owner role | not stated: no rule names a role for this family |
| Open critical semantics (unit and semantic) | 1 |
| Affected units | 1 |
| Members digest | `sha256:15f679b726862e403a8aaf12cc8a1b31c16dcc0b586ea26fffb4621d0bd2fcc2` |

**Settings** (1)

- **Review the IAM policy grant setting** (`iam-policy-grant`, record before the settings of a unit were one record: `DEC-GEN-GCP-CLOUD-RUN-IAM-POLICY-GRANT`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "iam-policy-grant" of the gcp.cloud_run contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: Review the IAM policy grant setting for google_cloud_run_v2_service.server: A person decides what this finding asks, and records the evidence or the decision. The finding says: A full IAM policy (member/role bindings) is set directly on the service via policy_data; STACKIT has no per-service IAM policy resource, so who may invoke the migrated SKE workload is decided by a person — the draft carries no invocation check. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

**Open critical semantics (unit and semantic)** (1)

- `google_cloud_run_v2_service.server|iam-policy-grant`

**Affected units** (1)

- `google_cloud_run_v2_service.server`

#### DEC-IAM-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER

Why: The knowledge base cannot decide 2 critical settings of google_cloud_run_v2_service.server. The review step of the execution plan for these settings is MAN/semantic/google_cloud_run_v2_service.server/open-settings-identity-architect.

| Field | Value |
|---|---|
| Owner role | Identity Architect |
| Open critical semantics (unit and semantic) | 2 |
| Affected units | 1 |
| Members digest | `sha256:49a9627d2f1d15f305b977c86b73db0162a769ecd453b5b1fca71650bba2a2e8` |

**Settings** (2)

- **Decide who may invoke the service** (`iam-invocation`, record before the settings of a unit were one record: `DEC-IAM-GCP-CLOUD-RUN-IAM-INVOCATION`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "iam-invocation" of the gcp.cloud_run contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: Decide who may invoke the service for google_cloud_run_v2_service.server: A person decides how callers of the workload are authenticated (in the application, behind an authenticating proxy, or by no exposure at all) and how the SKE exposure is set, since the draft carries no invocation check. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
- **Review the service identity setting** (`service-identity`, record before the settings of a unit were one record: `DEC-IAM-GCP-CLOUD-RUN-SERVICE-IDENTITY`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "service-identity" of the gcp.cloud_run contract for 1 unit (carried into the draft): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: This setting follows the decision on the unit; it is not decided on its own.

**Open critical semantics (unit and semantic)** (2)

- `google_cloud_run_v2_service.server|iam-invocation`
- `google_cloud_run_v2_service.server|service-identity`

**Affected units** (1)

- `google_cloud_run_v2_service.server`

#### DEC-NET-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER

Why: The knowledge base cannot decide 1 critical setting of google_cloud_run_v2_service.server.

| Field | Value |
|---|---|
| Owner role | Network Architect |
| Open critical semantics (unit and semantic) | 1 |
| Affected units | 1 |
| Members digest | `sha256:7ffdff9c041378f4eae6d4342c8775fd97bc2eb295a39ce01f24caa6e06208ea` |

**Settings** (1)

- **Decide how the service connects to the database** (`cloud-sql-connection`, record before the settings of a unit were one record: `DEC-NET-GCP-CLOUD-RUN-CLOUD-SQL-CONNECTION`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "cloud-sql-connection" of the gcp.cloud_run contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: Decide how the service connects to the database for google_cloud_run_v2_service.server: A person points the workload at the endpoint of the migrated database instance (a Flex or MariaDB instance) over TLS, because the Cloud SQL connector socket has no counterpart. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

**Open critical semantics (unit and semantic)** (1)

- `google_cloud_run_v2_service.server|cloud-sql-connection`

**Affected units** (1)

- `google_cloud_run_v2_service.server`

#### DEC-OPS-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER

Why: The knowledge base cannot decide 5 critical settings of google_cloud_run_v2_service.server. The review step of the execution plan for these settings is MAN/semantic/google_cloud_run_v2_service.server/open-settings-platform-architect.

| Field | Value |
|---|---|
| Owner role | Platform Architect |
| Open critical semantics (unit and semantic) | 5 |
| Affected units | 1 |
| Options | the options are those of the settings: 1 setting of them list options, below |
| Members digest | `sha256:49a225e8454b013cae4c0796f19f24dec5d3c80788ef6189addeeb19bbb5467c` |

**Settings** (5)

- **Choose the container image or artifact** (`deployment-artifact`, record before the settings of a unit were one record: `DEC-OPS-GCP-CLOUD-RUN-DEPLOYMENT-ARTIFACT`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "deployment-artifact" of the gcp.cloud_run contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: Choose the container image or artifact for google_cloud_run_v2_service.server: A person confirms the executable artifact or image for the STACKIT target: where it is built or pulled from and that the same build runs there. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
  - Option `workload-on-ske`: Run the container as a workload on SKE. A service or a function that already runs as a container image moves as a Deployment on a SKE cluster, which is a managed Kubernetes service. Scale to zero and the billing per request go away unless an autoscaler that scales to zero is operated on the cluster. **Trade-off:** its effect on the steps is not stated: an answer frees nothing.
  - Option `app-on-cloud-foundry`: Push the application to STACKIT Cloud Foundry. STACKIT Cloud Foundry is a managed platform for applications that a developer deploys and scales; the application is pushed from its image or its code. Scale to zero and the billing per request go away. **Trade-off:** its effect on the steps is not stated: an answer frees nothing.
- **Decide how the volume mounts are carried** (`k4-cloud-run-volume-mount-cloud-run-v2-service`, record before the settings of a unit were one record: `DEC-OPS-GCP-CLOUD-RUN-K4-CLOUD-RUN-VOLUME-MOUNT-CLOUD-RUN-V2-SERVICE`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "k4-cloud-run-volume-mount-cloud-run-v2-service" of the gcp.cloud_run contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: Decide how the volume mounts are carried for google_cloud_run_v2_service.server: A person provides the data in the target workload at the path the application expects, with an owner and mode it can use, and checks that it finds its files. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
- **Confirm the name of the Cloud Run service** (`tc-cloud-run-v2-service-name`, record before the settings of a unit were one record: `DEC-OPS-GCP-CLOUD-RUN-TC-CLOUD-RUN-V2-SERVICE-NAME`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "the name of the Cloud Run service" of the gcp.cloud_run contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: Confirm the name of the Cloud Run service for google_cloud_run_v2_service.server: A person confirms the workload name on the cluster against what addresses or refers to the Cloud Run service name, or accepts the new name. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
- **Confirm the name of the volumes entry of the template of the Cloud Run service** (`tc-cloud-run-v2-service-template--volumes--name`, record before the settings of a unit were one record: `DEC-OPS-GCP-CLOUD-RUN-TC-CLOUD-RUN-V2-SERVICE-TEMPLATE-VOLUMES-NAME`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "the name of the volumes entry of the template of the Cloud Run service" of the gcp.cloud_run contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: Confirm the name of the volumes entry of the template of the Cloud Run service for google_cloud_run_v2_service.server: A person keeps each volume name matched with the volume mount that refers to it when the volumes are rebuilt as workload volumes on the cluster. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
- **Review the terraform destroy guard setting** (`terraform-destroy-guard`, record before the settings of a unit were one record: `DEC-DATA-GCP-CLOUD-RUN-TERRAFORM-DESTROY-GUARD`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "terraform-destroy-guard" of the gcp.cloud_run contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: Review the terraform destroy guard setting for google_cloud_run_v2_service.server: A person decides whether the replacement keeps the guard with lifecycle { prevent_destroy = true } in the Terraform code. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

**Required evidence (the plan's reasons, then what the knowledge base asks for)** (1)

- where the image is built or pulled from

**Open critical semantics (unit and semantic)** (5)

- `google_cloud_run_v2_service.server|deployment-artifact`
- `google_cloud_run_v2_service.server|k4-cloud-run-volume-mount-cloud-run-v2-service`
- `google_cloud_run_v2_service.server|tc-cloud-run-v2-service-name`
- `google_cloud_run_v2_service.server|tc-cloud-run-v2-service-template--volumes--name`
- `google_cloud_run_v2_service.server|terraform-destroy-guard`

**Affected units** (1)

- `google_cloud_run_v2_service.server`

#### DEC-SEC-GOOGLE-CLOUD-RUN-V2-SERVICE-SERVER

Why: The knowledge base cannot decide 2 critical settings of google_cloud_run_v2_service.server. The review step of the execution plan for these settings is MAN/semantic/google_cloud_run_v2_service.server/open-settings-security-architect.

| Field | Value |
|---|---|
| Owner role | Security Architect |
| Open critical semantics (unit and semantic) | 2 |
| Affected units | 1 |
| Members digest | `sha256:a62c4ae04e476e59d71bcc934c792968379d2bec15964708b153e580e7b3c411` |

**Settings** (2)

- **Confirm the environment settings** (`environment`, record before the settings of a unit were one record: `DEC-SEC-GCP-CLOUD-RUN-ENVIRONMENT`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "environment" of the gcp.cloud_run contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: Confirm the environment settings for google_cloud_run_v2_service.server: A person fills in the values the manifest lists as not copied, in the ConfigMap on the cluster. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
- **Create the Kubernetes Secrets for the Secret Manager references** (`secrets`, record before the settings of a unit were one record: `DEC-SEC-GCP-CLOUD-RUN-SECRETS`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "secrets" of the gcp.cloud_run contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: Create the Kubernetes Secrets for the Secret Manager references for google_cloud_run_v2_service.server: A person creates the Kubernetes Secrets the manifest lists, filled from STACKIT Secrets Manager (for example with an External Secrets Operator). Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

**Open critical semantics (unit and semantic)** (2)

- `google_cloud_run_v2_service.server|environment`
- `google_cloud_run_v2_service.server|secrets`

**Affected units** (1)

- `google_cloud_run_v2_service.server`

## Critical semantics · gcp.cloudbuild (7 records, 15 open items, 0 accepted; status open)

Every record under this heading states the same for these fields, and its table does not repeat them:

| Field | Value |
|---|---|
| Kind | `the critical settings of a unit` |
| Source | open critical semantic |
| Family | gcp.cloudbuild |
| Status | Open: no decision of the record has been taken |
| Review state | unreviewed |
| Design state | open |
| Validation state | not validated |
| Required by phase | not stated: the plan names no phase for this decision |
| Blocking effect | the engine leaves this critical semantic open on the units listed: a person decides or accepts it, and a review of this record does not change the engine's reading |
| Affected applications | 0 |
| Applications touched | none: no applications file was given and no suggested group holds an affected unit |
| Wave | not stated: none of its units is a member of a wave (a unit that does not exist, exists only when OpenTofu plans, or is refused for a missing input is in none) · steps in workloads |
| Answer | not answered: no decisions file was given with this run |
| Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented |
| Recommended option | none |
| Review binding | bound to this run's source digest (see decisions.json) · KB 0.394.0 |

The reason of each record of critical settings below ends the same way, so it is said here once: for each setting, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of its record with its own reason, members and review state. A review of a record is the architect's answer beside the engine's reading; it closes nothing.

**Settings that recur under this heading** (4). A record that lists one of them names it and its next step; the setting is said here:

- **Review the build identity setting** (`build-identity`, record before the settings of a unit were one record: `DEC-IAM-GCP-CLOUDBUILD-BUILD-IDENTITY`)
  - Why: The knowledge base cannot decide "build-identity" of the gcp.cloudbuild contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.
- **Confirm its dependency on the references** (`dep-references`, record before the settings of a unit were one record: `DEC-OPS-GCP-CLOUDBUILD-DEP-REFERENCES`)
  - Why: The knowledge base cannot decide "its dependency on the references" of the gcp.cloudbuild contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.
- **Choose the container image or artifact** (`deployment-artifact`, record before the settings of a unit were one record: `DEC-OPS-GCP-CLOUDBUILD-DEPLOYMENT-ARTIFACT`)
  - Why: The knowledge base cannot decide "deployment-artifact" of the gcp.cloudbuild contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.
- **Review the log destination setting** (`log-destination`, record before the settings of a unit were one record: `DEC-OPS-GCP-CLOUDBUILD-LOG-DESTINATION`)
  - Why: The knowledge base cannot decide "log-destination" of the gcp.cloudbuild contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.

### google_cloudbuild_trigger.activategcb (2 records)

#### DEC-IAM-GOOGLE-CLOUDBUILD-TRIGGER-ACTIVATEGCB

Why: The knowledge base cannot decide 1 critical setting of google_cloudbuild_trigger.activategcb. 1 of them is on units that exist only if a plan-time input holds: the decision applies in a plan that creates them.

| Field | Value |
|---|---|
| Owner role | Identity Architect |
| Open critical semantics (unit and semantic) | 1 |
| Affected units | 1 |
| Members digest | `sha256:9386141c388d58e556657d741dad4f3973d0a7917c12094e76ed87729a78a697` |

**Settings** (1)

- **Review the build identity setting** (`build-identity`): Open: no decision of the record has been taken (the setting is said under the heading of the group)
  - Next: This setting follows the decision on the unit: Write the workflow in the repository: one job (or step) per build step, with the same container images or their STACKIT equivalents. Recreate every secret the build reads in STACKIT Secrets Manager (read with the vault action) or as a repository secret; the values of the source are never copied.

**Open critical semantics (unit and semantic)** (1)

- `google_cloudbuild_trigger.activategcb|build-identity`

**Affected units** (1)

- `google_cloudbuild_trigger.activategcb`

#### DEC-OPS-GOOGLE-CLOUDBUILD-TRIGGER-ACTIVATEGCB

Why: The knowledge base cannot decide 4 critical settings of google_cloudbuild_trigger.activategcb. 4 of them are on units that exist only if a plan-time input holds: the decision applies in a plan that creates them.

| Field | Value |
|---|---|
| Owner role | Platform Architect |
| Open critical semantics (unit and semantic) | 4 |
| Affected units | 1 |
| Members digest | `sha256:e0143295cfa5a05eb32a3e9cb7e67db7ffdee678b9d8576c04505e0b9c53e0d6` |

**Settings** (4)

- **Confirm its dependency on the references** (`dep-references`): Open: no decision of the record has been taken (the setting is said under the heading of the group)
  - Next: This setting follows the decision on the unit: A person confirms how the replacement carries the relation, or accepts the difference.
- **Choose the container image or artifact** (`deployment-artifact`): Open: no decision of the record has been taken (the setting is said under the heading of the group)
  - Next: This setting follows the decision on the unit: Write the workflow in the repository: one job (or step) per build step, with the same container images or their STACKIT equivalents. Recreate every secret the build reads in STACKIT Secrets Manager (read with the vault action) or as a repository secret; the values of the source are never copied.
- **Confirm the entry point of the function** (`entry-point`, record before the settings of a unit were one record: `DEC-OPS-GCP-CLOUDBUILD-ENTRY-POINT`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "entry-point" of the gcp.cloudbuild contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.
  - Next: Follows the same decision on the unit as Choose the container image or artifact.
- **Review the log destination setting** (`log-destination`): Open: no decision of the record has been taken (the setting is said under the heading of the group)
  - Next: Follows the same decision on the unit as Choose the container image or artifact.

**Open critical semantics (unit and semantic)** (4)

- `google_cloudbuild_trigger.activategcb|dep-references`
- `google_cloudbuild_trigger.activategcb|deployment-artifact`
- `google_cloudbuild_trigger.activategcb|entry-point`
- `google_cloudbuild_trigger.activategcb|log-destination`

**Affected units** (1)

- `google_cloudbuild_trigger.activategcb`

### google_cloudbuild_trigger.init (2 records)

#### DEC-IAM-GOOGLE-CLOUDBUILD-TRIGGER-INIT

Why: The knowledge base cannot decide 1 critical setting of google_cloudbuild_trigger.init. 1 of them is on units that exist only if a plan-time input holds: the decision applies in a plan that creates them.

| Field | Value |
|---|---|
| Owner role | Identity Architect |
| Open critical semantics (unit and semantic) | 1 |
| Affected units | 1 |
| Members digest | `sha256:983aef1e0dd9bd041a79bd51beb04d5a8ac24a45e1c9a2a46cefc90d25ee7eb3` |

**Settings** (1)

- **Review the build identity setting** (`build-identity`): Open: no decision of the record has been taken (the setting is said under the heading of the group)
  - Next: This setting follows the decision on the unit: Write the workflow in the repository: one job (or step) per build step, with the same container images or their STACKIT equivalents. Recreate every secret the build reads in STACKIT Secrets Manager (read with the vault action) or as a repository secret; the values of the source are never copied.

**Open critical semantics (unit and semantic)** (1)

- `google_cloudbuild_trigger.init|build-identity`

**Affected units** (1)

- `google_cloudbuild_trigger.init`

#### DEC-OPS-GOOGLE-CLOUDBUILD-TRIGGER-INIT

Why: The knowledge base cannot decide 4 critical settings of google_cloudbuild_trigger.init. 4 of them are on units that exist only if a plan-time input holds: the decision applies in a plan that creates them.

| Field | Value |
|---|---|
| Owner role | Platform Architect |
| Open critical semantics (unit and semantic) | 4 |
| Affected units | 1 |
| Members digest | `sha256:dde8057fbf100190ede422135467b4944298a15361db3dab48d0eac6ec929497` |

**Settings** (4)

- **Confirm its dependency on the references** (`dep-references`): Open: no decision of the record has been taken (the setting is said under the heading of the group)
  - Next: This setting follows the decision on the unit: A person confirms how the replacement carries the relation, or accepts the difference.
- **Choose the container image or artifact** (`deployment-artifact`): Open: no decision of the record has been taken (the setting is said under the heading of the group)
  - Next: This setting follows the decision on the unit: Write the workflow in the repository: one job (or step) per build step, with the same container images or their STACKIT equivalents. Recreate every secret the build reads in STACKIT Secrets Manager (read with the vault action) or as a repository secret; the values of the source are never copied.
- **Confirm the entry point of the function** (`entry-point`, record before the settings of a unit were one record: `DEC-OPS-GCP-CLOUDBUILD-ENTRY-POINT`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "entry-point" of the gcp.cloudbuild contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.
  - Next: Follows the same decision on the unit as Choose the container image or artifact.
- **Review the log destination setting** (`log-destination`): Open: no decision of the record has been taken (the setting is said under the heading of the group)
  - Next: Follows the same decision on the unit as Choose the container image or artifact.

**Open critical semantics (unit and semantic)** (4)

- `google_cloudbuild_trigger.init|dep-references`
- `google_cloudbuild_trigger.init|deployment-artifact`
- `google_cloudbuild_trigger.init|entry-point`
- `google_cloudbuild_trigger.init|log-destination`

**Affected units** (1)

- `google_cloudbuild_trigger.init`

### google_cloudbuild_trigger.placeholder (3 records)

#### DEC-GEN-GOOGLE-CLOUDBUILD-TRIGGER-PLACEHOLDER

Why: The knowledge base cannot decide 1 critical setting of google_cloudbuild_trigger.placeholder. 1 of them is on units that exist only if a plan-time input holds: the decision applies in a plan that creates them.

| Field | Value |
|---|---|
| Owner role | not stated: no rule names a role for this family |
| Open critical semantics (unit and semantic) | 1 |
| Affected units | 1 |
| Members digest | `sha256:c674d845100b6fe50690bf19a8f6cb6e1c75ac37f81d12554d22665ec6b82793` |

**Settings** (1)

- **Decide which firebase hosting site this resource depends on** (`linked-dependency:google_firebase_hosting_site`, record before the settings of a unit were one record: `DEC-GEN-GCP-CLOUDBUILD-LINKED-DEPENDENCY-GOOGLE-FIREBASE-HOSTING-SITE`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "linked-dependency:google_firebase_hosting_site" of the gcp.cloudbuild contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.
  - Next: This setting follows the decision on the unit: Write the workflow in the repository: one job (or step) per build step, with the same container images or their STACKIT equivalents. Recreate every secret the build reads in STACKIT Secrets Manager (read with the vault action) or as a repository secret; the values of the source are never copied.

**Open critical semantics (unit and semantic)** (1)

- `google_cloudbuild_trigger.placeholder|linked-dependency:google_firebase_hosting_site`

**Affected units** (1)

- `google_cloudbuild_trigger.placeholder`

#### DEC-IAM-GOOGLE-CLOUDBUILD-TRIGGER-PLACEHOLDER

Why: The knowledge base cannot decide 1 critical setting of google_cloudbuild_trigger.placeholder. 1 of them is on units that exist only if a plan-time input holds: the decision applies in a plan that creates them.

| Field | Value |
|---|---|
| Owner role | Identity Architect |
| Open critical semantics (unit and semantic) | 1 |
| Affected units | 1 |
| Members digest | `sha256:5dd6517fac6668ddfc41409b0b481e67806d0e95fb9a8fcb6d7ed6132d67439b` |

**Settings** (1)

- **Review the build identity setting** (`build-identity`): Open: no decision of the record has been taken (the setting is said under the heading of the group)
  - Next: This setting follows the decision on the unit: Write the workflow in the repository: one job (or step) per build step, with the same container images or their STACKIT equivalents. Recreate every secret the build reads in STACKIT Secrets Manager (read with the vault action) or as a repository secret; the values of the source are never copied.

**Open critical semantics (unit and semantic)** (1)

- `google_cloudbuild_trigger.placeholder|build-identity`

**Affected units** (1)

- `google_cloudbuild_trigger.placeholder`

#### DEC-OPS-GOOGLE-CLOUDBUILD-TRIGGER-PLACEHOLDER

Why: The knowledge base cannot decide 3 critical settings of google_cloudbuild_trigger.placeholder. 3 of them are on units that exist only if a plan-time input holds: the decision applies in a plan that creates them.

| Field | Value |
|---|---|
| Owner role | Platform Architect |
| Open critical semantics (unit and semantic) | 3 |
| Affected units | 1 |
| Members digest | `sha256:7e70eed61a6fa17edd718e38dd29074b9b3e25e7abd5fc99b629828000c689a8` |

**Settings** (3)

- **Confirm its dependency on the references** (`dep-references`): Open: no decision of the record has been taken (the setting is said under the heading of the group)
  - Next: This setting follows the decision on the unit: A person confirms how the replacement carries the relation, or accepts the difference.
- **Choose the container image or artifact** (`deployment-artifact`): Open: no decision of the record has been taken (the setting is said under the heading of the group)
  - Next: This setting follows the decision on the unit: Write the workflow in the repository: one job (or step) per build step, with the same container images or their STACKIT equivalents. Recreate every secret the build reads in STACKIT Secrets Manager (read with the vault action) or as a repository secret; the values of the source are never copied.
- **Review the log destination setting** (`log-destination`): Open: no decision of the record has been taken (the setting is said under the heading of the group)
  - Next: Follows the same decision on the unit as Choose the container image or artifact.

**Open critical semantics (unit and semantic)** (3)

- `google_cloudbuild_trigger.placeholder|dep-references`
- `google_cloudbuild_trigger.placeholder|deployment-artifact`
- `google_cloudbuild_trigger.placeholder|log-destination`

**Affected units** (1)

- `google_cloudbuild_trigger.placeholder`

## Critical semantics · gcp.firebase_hosting_site (2 records, 2 open items, 0 accepted; status open)

### google_firebase_hosting_site.client (2 records)

#### DEC-IAM-GOOGLE-FIREBASE-HOSTING-SITE-CLIENT

Why: The knowledge base cannot decide 1 critical setting of google_firebase_hosting_site.client: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 1 of them is on units that exist only if a plan-time input holds: the decision applies in a plan that creates them.

| Field | Value |
|---|---|
| Kind | `the critical settings of a unit` |
| Source | open critical semantic |
| Family | gcp.firebase_hosting_site |
| Status | Open: no decision of the record has been taken |
| Review state | unreviewed |
| Design state | open |
| Validation state | not validated |
| Owner role | Identity Architect |
| Required by phase | not stated: the plan names no phase for this decision |
| Blocking effect | the engine leaves this critical semantic open on the units listed: a person decides or accepts it, and a review of this record does not change the engine's reading |
| Open critical semantics (unit and semantic) | 1 |
| Affected units | 1 |
| Affected applications | 0 |
| Applications touched | none: no applications file was given and no suggested group holds an affected unit |
| Wave | not stated: none of its units is a member of a wave (a unit that does not exist, exists only when OpenTofu plans, or is refused for a missing input is in none) · steps in data services |
| Answer | not answered: no decisions file was given with this run |
| Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented |
| Recommended option | none |
| Review binding | bound to this run's source digest (see decisions.json) · KB 0.394.0 |
| Members digest | `sha256:b4097e90369c69fe115b52f7ba297fa1a8a151b2f4e4cb927a2477eb7449550e` |

**Settings** (1)

- **Confirm the project of the firebase hosting site** (`tc-firebase-hosting-site-project`, record before the settings of a unit were one record: `DEC-IAM-GCP-FIREBASE-HOSTING-SITE-TC-FIREBASE-HOSTING-SITE-PROJECT`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "the project of the firebase hosting site" of the gcp.firebase_hosting_site contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.
  - Next: This setting follows the decision on the unit: A person decides which STACKIT project, and with it which access rules, holds the replacement.

**Open critical semantics (unit and semantic)** (1)

- `google_firebase_hosting_site.client|tc-firebase-hosting-site-project`

**Affected units** (1)

- `google_firebase_hosting_site.client`

#### DEC-OPS-GOOGLE-FIREBASE-HOSTING-SITE-CLIENT

Why: The knowledge base cannot decide 1 critical setting of google_firebase_hosting_site.client: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing. 1 of them is on units that exist only if a plan-time input holds: the decision applies in a plan that creates them.

| Field | Value |
|---|---|
| Kind | `the critical settings of a unit` |
| Source | open critical semantic |
| Family | gcp.firebase_hosting_site |
| Status | Open: no decision of the record has been taken |
| Review state | unreviewed |
| Design state | open |
| Validation state | not validated |
| Owner role | Platform Architect |
| Required by phase | not stated: the plan names no phase for this decision |
| Blocking effect | the engine leaves this critical semantic open on the units listed: a person decides or accepts it, and a review of this record does not change the engine's reading |
| Open critical semantics (unit and semantic) | 1 |
| Affected units | 1 |
| Affected applications | 0 |
| Applications touched | none: no applications file was given and no suggested group holds an affected unit |
| Wave | not stated: none of its units is a member of a wave (a unit that does not exist, exists only when OpenTofu plans, or is refused for a missing input is in none) · steps in data services |
| Answer | not answered: no decisions file was given with this run |
| Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented |
| Recommended option | none |
| Review binding | bound to this run's source digest (see decisions.json) · KB 0.394.0 |
| Members digest | `sha256:f1335c383712c8d9a2d9e320a1daa4839dab4858facb100fc6012ff529d7cacc` |

**Settings** (1)

- **Confirm the site ID of the firebase hosting site** (`tcr-firebase-hosting-site-site-id`, record before the settings of a unit were one record: `DEC-OPS-GCP-FIREBASE-HOSTING-SITE-TCR-FIREBASE-HOSTING-SITE-SITE-ID`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "the site ID of the firebase hosting site" of the gcp.firebase_hosting_site contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.
  - Next: This setting follows the decision on the unit: A person sets this up on the bucket, the CDN distribution and the domain that replace Firebase Hosting, or decides to drop it, and records the decision.

**Open critical semantics (unit and semantic)** (1)

- `google_firebase_hosting_site.client|tcr-firebase-hosting-site-site-id`

**Affected units** (1)

- `google_firebase_hosting_site.client`

## Critical semantics · gcp.firebase_project (1 record, 1 open items, 0 accepted; status open)

### google_firebase_project.default (1 record)

#### DEC-IAM-GOOGLE-FIREBASE-PROJECT-DEFAULT

Why: The knowledge base cannot decide 1 critical setting of google_firebase_project.default: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.

| Field | Value |
|---|---|
| Kind | `the critical settings of a unit` |
| Source | open critical semantic |
| Family | gcp.firebase_project |
| Status | Open: no decision of the record has been taken |
| Review state | unreviewed |
| Design state | open |
| Validation state | not validated |
| Owner role | Identity Architect |
| Required by phase | not stated: the plan names no phase for this decision |
| Blocking effect | the engine leaves this critical semantic open on the units listed: a person decides or accepts it, and a review of this record does not change the engine's reading |
| Open critical semantics (unit and semantic) | 1 |
| Affected units | 1 |
| Affected applications | 0 |
| Applications touched | none: no applications file was given and no suggested group holds an affected unit |
| Wave | wave 1 · steps in platform services |
| Answer | not answered: no decisions file was given with this run |
| Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented |
| Recommended option | none |
| Review binding | bound to this run's source digest (see decisions.json) · KB 0.394.0 |
| Members digest | `sha256:667031dd2b2502bc1c1caca38c963530b561e9cde073a8b3faae85c068978e91` |

**Settings** (1)

- **Confirm the project of the firebase project** (`tc-firebase-project-project`, record before the settings of a unit were one record: `DEC-IAM-GCP-FIREBASE-PROJECT-TC-FIREBASE-PROJECT-PROJECT`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "the project of the firebase project" of the gcp.firebase_project contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: The plan refuses REF/unit/google_firebase_project.default for google_firebase_project.default: Nothing on STACKIT holds the registration of an app or the enabling of Firebase on a project. It stays with Google for as long as any Firebase service (push messaging, for example) is used, and a person decides, app by app, which backend replaces the Firebase services the app calls. Adding Firebase to a project cannot be undone (a redesign could go: List the Firebase services each app uses (authentication, database, storage, messaging, remote config); each needs its own replacement; The signing keys and store listings stay with Google Play and the Apple App Store; only the backend the app talks to moves). Decide the redesign before anything rests on this record.

**Open critical semantics (unit and semantic)** (1)

- `google_firebase_project.default|tc-firebase-project-project`

**Affected units** (1)

- `google_firebase_project.default`

## Critical semantics · gcp.pubsub_topic (1 record, 1 open items, 0 accepted; status open)

### google_pubsub_topic.faux (1 record)

#### DEC-OPS-GOOGLE-PUBSUB-TOPIC-FAUX

Why: The knowledge base cannot decide 1 critical setting of google_pubsub_topic.faux: a person chooses what the STACKIT target does for it, or accepts the difference. The setting is an item of this record with its own reason, members and review state. A review of this record is the architect's answer beside the engine's reading; it closes nothing.

| Field | Value |
|---|---|
| Kind | `the critical settings of a unit` |
| Source | open critical semantic |
| Family | gcp.pubsub_topic |
| Status | Open: no decision of the record has been taken |
| Review state | unreviewed |
| Design state | open |
| Validation state | not validated |
| Owner role | Platform Architect |
| Required by phase | not stated: the plan names no phase for this decision |
| Blocking effect | the engine leaves this critical semantic open on the units listed: a person decides or accepts it, and a review of this record does not change the engine's reading |
| Open critical semantics (unit and semantic) | 1 |
| Affected units | 1 |
| Affected applications | 0 |
| Applications touched | none: no applications file was given and no suggested group holds an affected unit |
| Wave | wave 1 · steps in platform services |
| Answer | not answered: no decisions file was given with this run |
| Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented |
| Recommended option | none |
| Review binding | bound to this run's source digest (see decisions.json) · KB 0.394.0 |
| Members digest | `sha256:a7d8918bd3887e9683ef3e8136ed581b298c98a4bd2f2c70d955d19659e55ff8` |

**Settings** (1)

- **Confirm the name of the resource on the target** (`tc-name`, record before the settings of a unit were one record: `DEC-OPS-GCP-PUBSUB-TOPIC-TC-NAME`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "the name of the Pub/Sub topic" of the gcp.pubsub_topic contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: Confirm the name of the resource on the target for google_pubsub_topic.faux: A person confirms the topic name the replacement messaging service carries against the publishers and subscribers that use it, or accepts the new name. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

**Open critical semantics (unit and semantic)** (1)

- `google_pubsub_topic.faux|tc-name`

**Affected units** (1)

- `google_pubsub_topic.faux`

## Critical semantics · gcp.secret (4 records, 6 open items, 0 accepted; status open)

Every record under this heading states the same for these fields, and its table does not repeat them:

| Field | Value |
|---|---|
| Kind | `the critical settings of a unit` |
| Source | open critical semantic |
| Family | gcp.secret |
| Status | Open: no decision of the record has been taken |
| Review state | unreviewed |
| Design state | open |
| Validation state | not validated |
| Required by phase | not stated: the plan names no phase for this decision |
| Blocking effect | the engine leaves this critical semantic open on the units listed: a person decides or accepts it, and a review of this record does not change the engine's reading |
| Affected applications | 0 |
| Answer | not answered: no decisions file was given with this run |
| Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented |
| Recommended option | none |
| Review binding | bound to this run's source digest (see decisions.json) · KB 0.394.0 |

The reason of each record of critical settings below ends the same way, so it is said here once: for each setting, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of its record with its own reason, members and review state. A review of a record is the architect's answer beside the engine's reading; it closes nothing.

### google_secret_manager_secret.django_admin_password (2 records)

#### DEC-IAM-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-ADMIN-PASSWORD

Why: The knowledge base cannot decide 1 critical setting of google_secret_manager_secret.django_admin_password.

| Field | Value |
|---|---|
| Owner role | Identity Architect |
| Open critical semantics (unit and semantic) | 1 |
| Affected units | 1 |
| Applications touched | `migrate` (PROPOSED) |
| Wave | wave 2 · steps in security |
| Members digest | `sha256:3e09fec2b3fabb25d58fdb484b8b5ab923f9e3ab186d861af6d5dcf041d7659b` |

**Settings** (1)

- **Decide how the secrets are carried** (`secret-settings`, record before the settings of a unit were one record: `DEC-IAM-GCP-SECRET-SECRET-SETTINGS`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "secret-settings" of the gcp.secret contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: Decide how the secrets are carried for google_secret_manager_secret.django_admin_password: A person recreates the secret in the Secrets Manager instance, since its data is not written into the draft, and decides for each IAM member whether it gets a user of the whole instance, a role binding on a secret group, or a separate instance. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

**Open critical semantics (unit and semantic)** (1)

- `google_secret_manager_secret.django_admin_password|secret-settings`

**Affected units** (1)

- `google_secret_manager_secret.django_admin_password`

#### DEC-SEC-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-ADMIN-PASSWORD

Why: The knowledge base cannot decide 2 critical settings of google_secret_manager_secret.django_admin_password. The review step of the execution plan for these settings is MAN/semantic/google_secret_manager_secret.django_admin_password/open-settings-security-architect.

| Field | Value |
|---|---|
| Owner role | Security Architect |
| Open critical semantics (unit and semantic) | 2 |
| Affected units | 1 |
| Applications touched | `migrate` (PROPOSED) |
| Wave | wave 2 · steps in security |
| Members digest | `sha256:eb29f1eaa95c211eb17973b5c3e485f452884068952077daaa1918823c3c8cf2` |

**Settings** (2)

- **Provide the values of the secrets** (`secret-value`, record before the settings of a unit were one record: `DEC-SEC-GCP-SECRET-SECRET-VALUE`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "secret-value" of the gcp.secret contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: Provide the values of the secrets for google_secret_manager_secret.django_admin_password: A person decides where the value comes from, supplies the document and the step has run. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
- **Confirm the name of the secret** (`tcr-secret-id`, record before the settings of a unit were one record: `DEC-SEC-GCP-SECRET-TCR-SECRET-ID`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "the secret ID of the Secret Manager secret" of the gcp.secret contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: Confirm the name of the secret for google_secret_manager_secret.django_admin_password: A person confirms the secret name in STACKIT Secrets Manager against what refers to the source secret ID, or accepts the new name. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

**Open critical semantics (unit and semantic)** (2)

- `google_secret_manager_secret.django_admin_password|secret-value`
- `google_secret_manager_secret.django_admin_password|tcr-secret-id`

**Affected units** (1)

- `google_secret_manager_secret.django_admin_password`

### google_secret_manager_secret.django_settings (2 records)

#### DEC-IAM-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-SETTINGS

Why: The knowledge base cannot decide 1 critical setting of google_secret_manager_secret.django_settings.

| Field | Value |
|---|---|
| Owner role | Identity Architect |
| Open critical semantics (unit and semantic) | 1 |
| Affected units | 1 |
| Applications touched | none: no applications file was given and no suggested group is known to hold an affected unit; google_secret_manager_secret.django_settings is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: migrate, server |
| Wave | wave 3 · steps in security |
| Members digest | `sha256:6d6b7e816d8d4ad7005954dceeadfb922b3abfaa5ba54c8f6ea046dc1ee92c0a` |

**Settings** (1)

- **Decide how the secrets are carried** (`secret-settings`, record before the settings of a unit were one record: `DEC-IAM-GCP-SECRET-SECRET-SETTINGS`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "secret-settings" of the gcp.secret contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: Decide how the secrets are carried for google_secret_manager_secret.django_settings: A person recreates the secret in the Secrets Manager instance, since its data is not written into the draft, and decides for each IAM member whether it gets a user of the whole instance, a role binding on a secret group, or a separate instance. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

**Open critical semantics (unit and semantic)** (1)

- `google_secret_manager_secret.django_settings|secret-settings`

**Affected units** (1)

- `google_secret_manager_secret.django_settings`

#### DEC-SEC-GOOGLE-SECRET-MANAGER-SECRET-DJANGO-SETTINGS

Why: The knowledge base cannot decide 2 critical settings of google_secret_manager_secret.django_settings. The review step of the execution plan for these settings is MAN/semantic/google_secret_manager_secret.django_settings/open-settings-security-architect.

| Field | Value |
|---|---|
| Owner role | Security Architect |
| Open critical semantics (unit and semantic) | 2 |
| Affected units | 1 |
| Applications touched | none: no applications file was given and no suggested group is known to hold an affected unit; google_secret_manager_secret.django_settings is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: migrate, server |
| Wave | wave 3 · steps in security |
| Members digest | `sha256:716b1b457e427774c0a7f4b650e4c1b35931c304d406b6d687462a336a072224` |

**Settings** (2)

- **Provide the values of the secrets** (`secret-value`, record before the settings of a unit were one record: `DEC-SEC-GCP-SECRET-SECRET-VALUE`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "secret-value" of the gcp.secret contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: Provide the values of the secrets for google_secret_manager_secret.django_settings: A person decides where the value comes from, supplies the document and the step has run. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
- **Confirm the name of the secret** (`tcr-secret-id`, record before the settings of a unit were one record: `DEC-SEC-GCP-SECRET-TCR-SECRET-ID`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "the secret ID of the Secret Manager secret" of the gcp.secret contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: Confirm the name of the secret for google_secret_manager_secret.django_settings: A person confirms the secret name in STACKIT Secrets Manager against what refers to the source secret ID, or accepts the new name. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

**Open critical semantics (unit and semantic)** (2)

- `google_secret_manager_secret.django_settings|secret-value`
- `google_secret_manager_secret.django_settings|tcr-secret-id`

**Affected units** (1)

- `google_secret_manager_secret.django_settings`

## Critical semantics · gcp.service_account (4 records, 8 open items, 0 accepted; status open)

The records under this heading state these fields as follows; a record whose field reads otherwise shows it in its own table:

| Field | Value |
|---|---|
| Kind | `the critical settings of a unit` |
| Source | open critical semantic |
| Family | gcp.service_account |
| Status | Open: no decision of the record has been taken |
| Review state | unreviewed |
| Design state | open |
| Validation state | not validated |
| Required by phase | not stated: the plan names no phase for this decision |
| Blocking effect | the engine leaves this critical semantic open on the units listed: a person decides or accepts it, and a review of this record does not change the engine's reading |
| Affected applications | 0 |
| Wave | wave 1 · steps in security |
| Answer | not answered: no decisions file was given with this run |
| Options | the options are those of the settings: 1 setting of them list options, below |
| Recommended option | none |
| Review binding | bound to this run's source digest (see decisions.json) · KB 0.394.0 |

The reason of each record of critical settings below ends the same way, so it is said here once: for each setting, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of its record with its own reason, members and review state. A review of a record is the architect's answer beside the engine's reading; it closes nothing.

**Settings that recur under this heading** (2). A record that lists one of them names it and its next step; the setting is said here:

- **Review the account name setting** (`account-name`, record before the settings of a unit were one record: `DEC-IAM-GCP-SERVICE-ACCOUNT-ACCOUNT-NAME`)
  - Why: The knowledge base cannot decide "account-name" of the gcp.service_account contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
- **Map the IAM roles of the service account to STACKIT roles** (`role-bindings`, record before the settings of a unit were one record: `DEC-GEN-GCP-SERVICE-ACCOUNT-ROLE-BINDINGS`)
  - Why: The knowledge base cannot decide "role-bindings" of the gcp.service_account contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Option `bind-a-role-on-the-service-account`: Bind a role of the STACKIT service account to the member. A role assignment on a STACKIT service account gives a role the authorization API lists for that account to a user, a service account or a client; given to a service account, it grants the Act-As permission, which lets that account impersonate the target account. A person re-maps each Google role on the account (using it, creating its keys, managing it) to a role of the STACKIT service account and binds it to the member. The assignment carries no condition and has no setting that removes the other holders of a role, so if the Google resource was authoritative (a binding for its role, a policy for the whole account) the replacing effect is not carried: a person lists who else holds a role on the account and removes what the source did not list. The resource is part of an experimental feature that is likely to change or be removed. The documents read do not state how a person, as opposed to a service account, acts as the account. **Trade-off:** its effect on the steps is not stated: an answer frees nothing.

### google_service_account.automation (1 record)

#### DEC-IAM-GOOGLE-SERVICE-ACCOUNT-AUTOMATION

Why: The knowledge base cannot decide 2 critical settings of google_service_account.automation. The review step of the execution plan for these settings is MAN/semantic/google_service_account.automation/open-settings.

| Field | Value |
|---|---|
| Owner role | Identity Architect |
| Open critical semantics (unit and semantic) | 2 |
| Affected units | 1 |
| Applications touched | `migrate` (PROPOSED) |
| Members digest | `sha256:274ca0dfef1c6eb06c78eb115a723bfb517013ac6392e727915c50ba200a2ff8` |

**Settings** (2)

- **Review the account name setting** (`account-name`): Open: no decision of the record has been taken (the setting is said under the heading of the group)
  - Next: This setting follows the decision on the unit: A person decides what this finding asks, and records the evidence or the decision. The finding says: The account ID is not visible statically; the STACKIT account is named after the source address. — a variable's default, not a fact.
- **Map the IAM roles of the service account to STACKIT roles** (`role-bindings`): Open: no decision of the record has been taken (the setting is said under the heading of the group)
  - Next: Outside the draft, for google_service_account.automation: The grants that name the account become STACKIT role assignments where the role and members are readable and the grant has no condition, and the draft lists the others. A Google role is written as a STACKIT role only where the STACKIT role holds the same permissions or fewer; for every other role a person confirms the choice. A grant that lets another account act as this one, or that is authoritative, must be reviewed: list who else holds access on the target and remove what the source did not list.

**Required evidence (the plan's reasons, then what the knowledge base asks for)** (1)

- the members that act as or manage the service account

**Open critical semantics (unit and semantic)** (2)

- `google_service_account.automation|account-name`
- `google_service_account.automation|role-bindings`

**Affected units** (1)

- `google_service_account.automation`

### google_service_account.client (1 record)

#### DEC-IAM-GOOGLE-SERVICE-ACCOUNT-CLIENT

Why: The knowledge base cannot decide 2 critical settings of google_service_account.client. The review step of the execution plan for these settings is MAN/semantic/google_service_account.client/open-settings.

| Field | Value |
|---|---|
| Owner role | Identity Architect |
| Open critical semantics (unit and semantic) | 2 |
| Affected units | 1 |
| Applications touched | none: no applications file was given and no suggested group holds an affected unit |
| Members digest | `sha256:88ae4b1b16dcb159b368f4323b539cbf6d141a882787af854f5db4709ec45ac9` |

**Settings** (2)

- **Review the account name setting** (`account-name`): Open: no decision of the record has been taken (the setting is said under the heading of the group)
  - Next: This setting follows the decision on the unit: A person decides what this finding asks, and records the evidence or the decision. The finding says: The account ID is not visible statically; the STACKIT account is named after the source address. — a variable's default, not a fact.
- **Map the IAM roles of the service account to STACKIT roles** (`role-bindings`): Open: no decision of the record has been taken (the setting is said under the heading of the group)
  - Next: Outside the draft, for google_service_account.client: The grants that name the account become STACKIT role assignments where the role and members are readable and the grant has no condition, and the draft lists the others. A Google role is written as a STACKIT role only where the STACKIT role holds the same permissions or fewer; for every other role a person confirms the choice. A grant that lets another account act as this one, or that is authoritative, must be reviewed: list who else holds access on the target and remove what the source did not list.

**Required evidence (the plan's reasons, then what the knowledge base asks for)** (1)

- the members that act as or manage the service account

**Open critical semantics (unit and semantic)** (2)

- `google_service_account.client|account-name`
- `google_service_account.client|role-bindings`

**Affected units** (1)

- `google_service_account.client`

### google_service_account.init (1 record)

#### DEC-IAM-GOOGLE-SERVICE-ACCOUNT-INIT

Why: The knowledge base cannot decide 2 critical settings of google_service_account.init. 2 of them are on units that exist only if a plan-time input holds: the decision applies in a plan that creates them. The review step of the execution plan for these settings is MAN/semantic/google_service_account.init/open-settings.

| Field | Value |
|---|---|
| Owner role | Identity Architect |
| Open critical semantics (unit and semantic) | 2 |
| Affected units | 1 |
| Applications touched | none: no applications file was given and no suggested group holds an affected unit |
| Wave | not stated: none of its units is a member of a wave (a unit that does not exist, exists only when OpenTofu plans, or is refused for a missing input is in none) · steps in security |
| Members digest | `sha256:fbe36a66702026998a663181d81729b5b25573a82351a71f48bca28a9039d33d` |

**Settings** (2)

- **Review the account name setting** (`account-name`, record before the settings of a unit were one record: `DEC-IAM-GCP-SERVICE-ACCOUNT-ACCOUNT-NAME`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "account-name" of the gcp.service_account contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.
  - Next: This setting follows the decision on the unit: A person decides what this finding asks, and records the evidence or the decision. The finding says: The account ID is not visible statically; the STACKIT account is named after the source address. — a variable's default, not a fact.
- **Map the IAM roles of the service account to STACKIT roles** (`role-bindings`, record before the settings of a unit were one record: `DEC-GEN-GCP-SERVICE-ACCOUNT-ROLE-BINDINGS`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "role-bindings" of the gcp.service_account contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing. Here its unit exists only if a plan-time input holds (a root variable's default, the workspace; decided when OpenTofu plans): the decision applies only if it does, and the row of each such member in assurance/critical-semantics.json (critical_semantic_resolution.conditional_open, applies_only_if) says which input.
  - Next: Outside the draft, for google_service_account.init: The grants that name the account become STACKIT role assignments where the role and members are readable and the grant has no condition, and the draft lists the others. A Google role is written as a STACKIT role only where the STACKIT role holds the same permissions or fewer; for every other role a person confirms the choice. A grant that lets another account act as this one, or that is authoritative, must be reviewed: list who else holds access on the target and remove what the source did not list.
  - Option `bind-a-role-on-the-service-account`: Bind a role of the STACKIT service account to the member. A role assignment on a STACKIT service account gives a role the authorization API lists for that account to a user, a service account or a client; given to a service account, it grants the Act-As permission, which lets that account impersonate the target account. A person re-maps each Google role on the account (using it, creating its keys, managing it) to a role of the STACKIT service account and binds it to the member. The assignment carries no condition and has no setting that removes the other holders of a role, so if the Google resource was authoritative (a binding for its role, a policy for the whole account) the replacing effect is not carried: a person lists who else holds a role on the account and removes what the source did not list. The resource is part of an experimental feature that is likely to change or be removed. The documents read do not state how a person, as opposed to a service account, acts as the account. **Trade-off:** its effect on the steps is not stated: an answer frees nothing.

**Required evidence (the plan's reasons, then what the knowledge base asks for)** (1)

- the members that act as or manage the service account

**Open critical semantics (unit and semantic)** (2)

- `google_service_account.init|account-name`
- `google_service_account.init|role-bindings`

**Affected units** (1)

- `google_service_account.init`

### google_service_account.server (1 record)

#### DEC-IAM-GOOGLE-SERVICE-ACCOUNT-SERVER

Why: The knowledge base cannot decide 2 critical settings of google_service_account.server. The review step of the execution plan for these settings is MAN/semantic/google_service_account.server/open-settings.

| Field | Value |
|---|---|
| Owner role | Identity Architect |
| Open critical semantics (unit and semantic) | 2 |
| Affected units | 1 |
| Applications touched | `server` (PROPOSED) |
| Members digest | `sha256:7036953ced621ef3845bebb3c9ebfeb20a65a2b923fb82cebde5066f39687853` |

**Settings** (2)

- **Review the account name setting** (`account-name`): Open: no decision of the record has been taken (the setting is said under the heading of the group)
  - Next: This setting follows the decision on the unit: A person decides what this finding asks, and records the evidence or the decision. The finding says: The account ID is not visible statically; the STACKIT account is named after the source address. — a variable's default, not a fact.
- **Map the IAM roles of the service account to STACKIT roles** (`role-bindings`): Open: no decision of the record has been taken (the setting is said under the heading of the group)
  - Next: Outside the draft, for google_service_account.server: The grants that name the account become STACKIT role assignments where the role and members are readable and the grant has no condition, and the draft lists the others. A Google role is written as a STACKIT role only where the STACKIT role holds the same permissions or fewer; for every other role a person confirms the choice. A grant that lets another account act as this one, or that is authoritative, must be reviewed: list who else holds access on the target and remove what the source did not list.

**Required evidence (the plan's reasons, then what the knowledge base asks for)** (1)

- the members that act as or manage the service account

**Open critical semantics (unit and semantic)** (2)

- `google_service_account.server|account-name`
- `google_service_account.server|role-bindings`

**Affected units** (1)

- `google_service_account.server`

## Critical semantics · gcp.sql_instance (3 records, 4 open items, 0 accepted; status open)

Every record under this heading states the same for these fields, and its table does not repeat them:

| Field | Value |
|---|---|
| Kind | `the critical settings of a unit` |
| Source | open critical semantic |
| Family | gcp.sql_instance |
| Status | Open: no decision of the record has been taken |
| Review state | unreviewed |
| Design state | open |
| Validation state | not validated |
| Required by phase | not stated: the plan names no phase for this decision |
| Blocking effect | the engine leaves this critical semantic open on the units listed: a person decides or accepts it, and a review of this record does not change the engine's reading |
| Affected applications | 0 |
| Applications touched | none: no applications file was given and no suggested group is known to hold an affected unit; google_sql_database_instance.postgres is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: migrate, server |
| Wave | wave 1 · steps in data services |
| Answer | not answered: no decisions file was given with this run |
| Recommended option | none |
| Review binding | bound to this run's source digest (see decisions.json) · KB 0.394.0 |

The reason of each record of critical settings below ends the same way, so it is said here once: for each setting, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of its record with its own reason, members and review state. A review of a record is the architect's answer beside the engine's reading; it closes nothing.

### google_sql_database_instance.postgres (3 records)

#### DEC-IAM-GOOGLE-SQL-DATABASE-INSTANCE-POSTGRES

Why: The knowledge base cannot decide 1 critical setting of google_sql_database_instance.postgres.

| Field | Value |
|---|---|
| Owner role | Identity Architect |
| Open critical semantics (unit and semantic) | 1 |
| Affected units | 1 |
| Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented |
| Members digest | `sha256:0a35e53fc17ee2be1fc2c0e5230f1a06bc8fc2064d3432154f560454ac3d7bf1` |

**Settings** (1)

- **Review the database users setting** (`database-users`, record before the settings of a unit were one record: `DEC-IAM-GCP-SQL-INSTANCE-DATABASE-USERS`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "database-users" of the gcp.sql_instance contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: This setting follows the decision on the unit: A literal value or a resolved reference in the source lets the check decide, or a person verifies the value.

**Open critical semantics (unit and semantic)** (1)

- `google_sql_database_instance.postgres|database-users`

**Affected units** (1)

- `google_sql_database_instance.postgres`

#### DEC-NET-GOOGLE-SQL-DATABASE-INSTANCE-POSTGRES

Why: The knowledge base cannot decide 1 critical setting of google_sql_database_instance.postgres.

| Field | Value |
|---|---|
| Owner role | Network Architect |
| Open critical semantics (unit and semantic) | 1 |
| Affected units | 1 |
| Options | the options are those of the settings: 1 setting of them list options, below |
| Members digest | `sha256:ccd4c92d365d49d5bb933ef5ad8b7cc3397c53a84b5773808f2bac8cf9beb0a5` |

**Settings** (1)

- **Review the user and database settings setting** (`user-and-database-settings`, record before the settings of a unit were one record: `DEC-NET-GCP-SQL-INSTANCE-USER-AND-DATABASE-SETTINGS`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "user-and-database-settings" of the gcp.sql_instance contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: Review the user and database settings setting for google_sql_database_instance.postgres: Decide how STACKIT PostgreSQL Flex carries this setting, or accept the difference. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
  - Option `derived-carry-on-the-target-25abe723033e`: Carry the setting on STACKIT PostgreSQL Flex. You design how STACKIT PostgreSQL Flex carries this setting and build it outside the draft. The draft does not change and no step is freed by it. **Trade-off:** the answer records your choice and frees no step.
  - Option `derived-accept-the-difference-25abe723033e`: Accept the difference. The target does not carry this setting as the source states it, and you record that as accepted. The draft does not change and no step is freed by it. **Trade-off:** the answer records your choice and frees no step.

**Open critical semantics (unit and semantic)** (1)

- `google_sql_database_instance.postgres|user-and-database-settings`

**Affected units** (1)

- `google_sql_database_instance.postgres`

#### DEC-OPS-GOOGLE-SQL-DATABASE-INSTANCE-POSTGRES

Why: The knowledge base cannot decide 2 critical settings of google_sql_database_instance.postgres. The review step of the execution plan for these settings is MAN/semantic/google_sql_database_instance.postgres/open-settings-platform-architect.

| Field | Value |
|---|---|
| Owner role | Platform Architect |
| Open critical semantics (unit and semantic) | 2 |
| Affected units | 1 |
| Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented |
| Members digest | `sha256:b13cd08f1d5978440b0dece1471faff3802205881397bcf65829f41bc7f89a47` |

**Settings** (2)

- **Confirm the name of the resource on the target** (`tc-name`, record before the settings of a unit were one record: `DEC-OPS-GCP-SQL-INSTANCE-TC-NAME`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "the name of the Cloud SQL instance" of the gcp.sql_instance contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: Confirm the name of the resource on the target for google_sql_database_instance.postgres: A person confirms the instance name the STACKIT database carries against what refers to the source instance name, or accepts the new name. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
- **Confirm the name of the SQL database** (`tcf-sql-database--name`, record before the settings of a unit were one record: `DEC-OPS-GCP-SQL-INSTANCE-TCF-SQL-DATABASE-NAME`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "the name of the SQL database" of the gcp.sql_instance contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: Confirm the name of the SQL database for google_sql_database_instance.postgres: Create the database under the same name on the target, because the application connects to it by that name. PostgreSQL Flex and SQL Server Flex have a database resource; on MariaDB create the database with SQL once the instance exists. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

**Open critical semantics (unit and semantic)** (2)

- `google_sql_database_instance.postgres|tc-name`
- `google_sql_database_instance.postgres|tcf-sql-database--name`

**Affected units** (1)

- `google_sql_database_instance.postgres`

## Critical semantics · gcp.storage_bucket (5 records, 6 open items, 0 accepted; status open)

The records under this heading state these fields as follows; a record whose field reads otherwise shows it in its own table:

| Field | Value |
|---|---|
| Kind | `the critical settings of a unit` |
| Source | open critical semantic |
| Family | gcp.storage_bucket |
| Status | Open: no decision of the record has been taken |
| Review state | unreviewed |
| Design state | open |
| Validation state | not validated |
| Required by phase | not stated: the plan names no phase for this decision |
| Blocking effect | the engine leaves this critical semantic open on the units listed: a person decides or accepts it, and a review of this record does not change the engine's reading |
| Affected applications | 0 |
| Applications touched | none: no applications file was given and no suggested group is known to hold an affected unit; google_storage_bucket.media is SHARED: it is a member of no suggested group (reached by several groups); the groups that reach it: migrate, server |
| Wave | wave 2 · steps in data services |
| Answer | not answered: no decisions file was given with this run |
| Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented |
| Recommended option | none |
| Review binding | bound to this run's source digest (see decisions.json) · KB 0.394.0 |

The reason of each record of critical settings below ends the same way, so it is said here once: for each setting, a person chooses what the STACKIT target does, or accepts the difference. Each setting is an item of its record with its own reason, members and review state. A review of a record is the architect's answer beside the engine's reading; it closes nothing.

### google_storage_bucket.media (5 records)

#### DEC-DATA-GOOGLE-STORAGE-BUCKET-MEDIA

Why: The knowledge base cannot decide 1 critical setting of google_storage_bucket.media.

| Field | Value |
|---|---|
| Owner role | Storage Architect |
| Open critical semantics (unit and semantic) | 1 |
| Affected units | 1 |
| Options | the options are those of the settings: 1 setting of them list options, below |
| Members digest | `sha256:cee2afe3415694523ba90f77fa2e9a367eed61a79003c85f938f4e026e843f95` |

**Settings** (1)

- **Confirm whether the bucket may be deleted with its contents** (`force-destroy`, record before the settings of a unit were one record: `DEC-DATA-GCP-STORAGE-BUCKET-FORCE-DESTROY`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "force-destroy" of the gcp.storage_bucket contract for 1 unit (not available on STACKIT): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: Confirm whether the bucket may be deleted with its contents for google_storage_bucket.media: force_destroy lets Terraform delete the bucket together with its objects. STACKIT has no such override: stackit_objectstorage_bucket (the pinned STACKIT provider) "cannot be destroyed if the bucket contains objects" — empty the bucket (or migrate its objects) before destroying it. For this unit the mapping asks: Find which applications use the Google client libraries or signed URLs — those need a code change. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
  - Option `derived-accept-the-loss-5d7d37005886`: Accept the loss. Nothing on the target carries this setting, and you record that as accepted. The draft does not change and no step is freed by it. **Trade-off:** the answer records your choice and frees no step.
  - Option `derived-rebuild-by-hand-5d7d37005886`: Rebuild it by hand. Find which applications use the Google client libraries or signed URLs — those need a code change. The draft does not change and no step is freed by it. **Trade-off:** the answer records your choice and frees no step.

**Open critical semantics (unit and semantic)** (1)

- `google_storage_bucket.media|force-destroy`

**Affected units** (1)

- `google_storage_bucket.media`

#### DEC-GEN-GOOGLE-STORAGE-BUCKET-MEDIA

Why: The knowledge base cannot decide 1 critical setting of google_storage_bucket.media.

| Field | Value |
|---|---|
| Owner role | not stated: no rule names a role for this family |
| Open critical semantics (unit and semantic) | 1 |
| Affected units | 1 |
| Members digest | `sha256:4c80dda543fb5e78f94213c2419ad6da54bf1b98a1df79c0ac2a8e5fe8555ac4` |

**Settings** (1)

- **Review the IAM access setting** (`iam-access`, record before the settings of a unit were one record: `DEC-GEN-GCP-STORAGE-BUCKET-IAM-ACCESS`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "iam-access" of the gcp.storage_bucket contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: Review the IAM access setting for google_storage_bucket.media: A person creates the bucket policies and Object Storage credentials that give the same access on STACKIT. For this unit the mapping asks: Find which applications use the Google client libraries or signed URLs — those need a code change. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

**Open critical semantics (unit and semantic)** (1)

- `google_storage_bucket.media|iam-access`

**Affected units** (1)

- `google_storage_bucket.media`

#### DEC-IAM-GOOGLE-STORAGE-BUCKET-MEDIA

Why: The knowledge base cannot decide 2 critical settings of google_storage_bucket.media. The review step of the execution plan for these settings is MAN/semantic/google_storage_bucket.media/open-settings-identity-architect.

| Field | Value |
|---|---|
| Owner role | Identity Architect |
| Open critical semantics (unit and semantic) | 2 |
| Affected units | 1 |
| Members digest | `sha256:82968eacb6f72cd72fd95b5501daf787d5707e72dd3c66366c44080dc700a319` |

**Settings** (2)

- **Review the IAM grant setting** (`iam-grant`, record before the settings of a unit were one record: `DEC-IAM-GCP-STORAGE-BUCKET-IAM-GRANT`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "iam-grant" of the gcp.storage_bucket contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: Review the IAM grant setting for google_storage_bucket.media: A person decides what this finding asks, and records the evidence or the decision. The finding says: Bucket access is granted with IAM bindings or ACL entries; on STACKIT it becomes bucket policies and Object Storage credentials. For this unit the mapping asks: Find which applications use the Google client libraries or signed URLs — those need a code change. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).
- **Review the public access setting** (`public-access`, record before the settings of a unit were one record: `DEC-IAM-GCP-STORAGE-BUCKET-PUBLIC-ACCESS`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "public-access" of the gcp.storage_bucket contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: This setting follows the decision on the unit: A literal value or a resolved reference in the source lets the check decide, or a person verifies the value.

**Open critical semantics (unit and semantic)** (2)

- `google_storage_bucket.media|iam-grant`
- `google_storage_bucket.media|public-access`

**Affected units** (1)

- `google_storage_bucket.media`

#### DEC-OPS-GOOGLE-STORAGE-BUCKET-MEDIA

Why: The knowledge base cannot decide 1 critical setting of google_storage_bucket.media.

| Field | Value |
|---|---|
| Owner role | Platform Architect |
| Open critical semantics (unit and semantic) | 1 |
| Affected units | 1 |
| Members digest | `sha256:ce1bb38d4159e6f1cc5ae1511fe2069c51d893d88b71471ec81e111114565ccd` |

**Settings** (1)

- **Confirm the name of the Cloud Storage bucket** (`tc-storage-bucket-name`, record before the settings of a unit were one record: `DEC-OPS-GCP-STORAGE-BUCKET-TC-STORAGE-BUCKET-NAME`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "the name of the Cloud Storage bucket" of the gcp.storage_bucket contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: Confirm the name of the Cloud Storage bucket for google_storage_bucket.media: A person confirms the Object Storage bucket name against the applications and tools that use the source bucket name, or accepts the new name. For this unit the mapping asks: Find which applications use the Google client libraries or signed URLs — those need a code change. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

**Open critical semantics (unit and semantic)** (1)

- `google_storage_bucket.media|tc-storage-bucket-name`

**Affected units** (1)

- `google_storage_bucket.media`

#### DEC-SEC-GOOGLE-STORAGE-BUCKET-MEDIA

Why: The knowledge base cannot decide 1 critical setting of google_storage_bucket.media.

| Field | Value |
|---|---|
| Owner role | Security Architect |
| Open critical semantics (unit and semantic) | 1 |
| Affected units | 1 |
| Members digest | `sha256:218dbf4d063d925c3ec13dcee5b71559568345f3441e250c6353827928621501` |

**Settings** (1)

- **Decide the geo-replication** (`geo-replication`, record before the settings of a unit were one record: `DEC-CMP-GCP-STORAGE-BUCKET-GEO-REPLICATION`): Open: no decision of the record has been taken
  - Why: The knowledge base cannot decide "geo-replication" of the gcp.storage_bucket contract for 1 unit (left for a person to decide): a person chooses what the STACKIT target does for it, or accepts the difference. A review of this record is the architect's answer beside the engine's reading; it closes nothing.
  - Next: Decide the geo-replication for google_storage_bucket.media: The value is set where the module is called (a literal), the variable is given its value in a variable file of the scan (--var-file), or a person confirms the value production uses. For this unit the mapping asks: Find which applications use the Google client libraries or signed URLs — those need a code change. Record the answer for this record in the decisions file given with --decisions (decisions-template.yaml).

**Open critical semantics (unit and semantic)** (1)

- `google_storage_bucket.media|geo-replication`

**Affected units** (1)

- `google_storage_bucket.media`

## Plan statements · stackitsa (2 records, 4 open items, 0 accepted; status open)

### manual review (1 record)

#### DEC-IAM-STACKITSA-STATEMENT-MANUAL-REVIEW

Why: The stackitsa plan of the draft writes no resource for 2 units and states why (the plan states the cause for each unit: google_cloud_run_v2_job.migrate: google_cloud_run_v2_job.migrate is a container task: its 1 identity binding(s) are facts only, and no service account is attached for it (no service account is attached to a workload of this source: an account attaches, but it can do nothing without its roles, and writing a role assignment from a draft has not been shown on STACKIT (it needs a right the key that tried it did not hold), so the draft grants no role and attaches no account); google_cloud_run_v2_service.server: google_cloud_run_v2_service.server is a container service: its 1 identity binding(s) are facts only, and no service account is attached for it (no service account is attached to a workload of this source: an account attaches, but it can do nothing without its roles, and writing a role assignment from a draft has not been shown on STACKIT (it needs a right the key that tried it did not hold), so the draft grants no role and attaches no account)): a person decides or does what the statement names outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan.

| Field | Value |
|---|---|
| Kind | `manual review` |
| Source | open statements of the plan about units it writes no resource for |
| Family | stackitsa |
| Status | Open: no decision of the record has been taken |
| Review state | unreviewed |
| Design state | open |
| Validation state | not validated |
| Owner role | Identity Architect |
| Required by phase | before the pilot |
| Blocking effect | the plan writes no resource for the units listed and states what a person decides or does instead: StackToIT neither does it nor verifies it |
| Plan statements | 2 |
| Affected units | 2 |
| Affected applications | 0 |
| Applications touched | `migrate` (PROPOSED), `server` (PROPOSED) |
| Wave | wave 4 · steps in prepare |
| Answer | not answered: no decisions file was given with this run |
| Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented |
| Recommended option | none |
| Review binding | bound to this run's source digest (see decisions.json) · KB 0.394.0 |
| Members digest | `sha256:0d87407edba569bfdd79c86e92e517831a240259de9e18c935cbb2e383da0a46` |

**Plan statements** (2)

- alias `stackitsa:statement:google_cloud_run_v2_job.migrate`
- alias `stackitsa:statement:google_cloud_run_v2_service.server`

**Affected units** (2)

- `google_cloud_run_v2_job.migrate`
- `google_cloud_run_v2_service.server`

### not drafted (1 record)

#### DEC-IAM-STACKITSA-STATEMENT-NOT-DRAFTED

Why: The stackitsa plan of the draft writes no resource for 2 units and states why (no resource is written for the unit and the plan names a step beside it): a person decides or does what the statement names outside the draft, and StackToIT neither does nor verifies it. A review of this record documents the architect's answer; it changes nothing in the plan.

| Field | Value |
|---|---|
| Kind | `not drafted` |
| Source | open statements of the plan about units it writes no resource for |
| Family | stackitsa |
| Status | Open: no decision of the record has been taken |
| Review state | unreviewed |
| Design state | open |
| Validation state | not validated |
| Owner role | Identity Architect |
| Required by phase | before the pilot |
| Blocking effect | the plan writes no resource for the units listed and states what a person decides or does instead: StackToIT neither does it nor verifies it |
| Plan statements | 2 |
| Affected units | 2 |
| Affected applications | 0 |
| Applications touched | `migrate` (PROPOSED), `server` (PROPOSED) |
| Wave | wave 1 · steps in prepare |
| Answer | not answered: no decisions file was given with this run |
| Options | no option is listed: the knowledge base has no options for this kind of decision, so none is invented |
| Recommended option | none |
| Review binding | bound to this run's source digest (see decisions.json) · KB 0.394.0 |
| Members digest | `sha256:e85552354c4f233c6960ca13d2ae813bf9758092a5a48d836f0839a1cb81ab87` |

**Plan statements** (2)

- alias `stackitsa:statement:google_service_account.automation`
- alias `stackitsa:statement:google_service_account.server`

**Affected units** (2)

- `google_service_account.automation`
- `google_service_account.server`