Fix conditional simulation entrypoint deployment configuration

.github/request-simulation-model-versions.sh

@@ -2,13 +2,17 @@
 
 set -euo pipefail
 
-# Modal gateway version check script.
+# Simulation gateway version check script.
 # Verifies that the PolicyEngine .py bundle used by API v1 is deployed in the
-# simulation gateway before allowing API v1 deployment to proceed. US/UK
-# versions are optional compatibility checks that should resolve to the same
-# gateway app as the .py bundle route.
+# selected simulation gateway before allowing API v1 deployment to proceed.
+# US/UK versions are optional compatibility checks that should resolve to the
+# same gateway app as the .py bundle route.
 
-GATEWAY_URL="${SIMULATION_ENTRYPOINT_URL:-https://policyengine--policyengine-simulation-gateway-web-app.modal.run}"
+source .github/scripts/simulation_entrypoint_env.sh
+
+GATEWAY_URL="$(
+    simulation_entrypoint_selected_url "${SIM_ENTRYPOINT:-}"
+)"
 
 usage() {
     echo "Usage: $0 -py <policyengine_version> [-us <us_version>] [-uk <uk_version>]"
@@ -55,7 +59,7 @@ if [ -z "$POLICYENGINE_VERSION" ]; then
     usage
 fi
 
-echo "Checking Modal simulation API versions..."
+echo "Checking selected simulation API versions..."
 echo "  Gateway: $GATEWAY_URL"
 echo "  Expected PolicyEngine .py bundle: $POLICYENGINE_VERSION"
 if [ -n "$US_VERSION" ]; then

.github/scripts/deploy_cloud_run_candidate.sh

@@ -11,20 +11,25 @@ env_vars=(
   "POLICYENGINE_DB_INSTANCE_CONNECTION_NAME=${CLOUD_RUN_CLOUD_SQL_INSTANCE}"
   "POLICYENGINE_DB_USER=${POLICYENGINE_DB_USER:-policyengine}"
   "POLICYENGINE_DB_NAME=${POLICYENGINE_DB_NAME:-policyengine}"
-  "SIMULATION_ENTRYPOINT_URL=${SIMULATION_ENTRYPOINT_URL}"
-  "OLD_SIMULATION_GATEWAY_URL=${OLD_SIMULATION_GATEWAY_URL}"
   "GATEWAY_AUTH_REQUIRED=1"
   "GATEWAY_AUTH_ISSUER=${GATEWAY_AUTH_ISSUER}"
   "GATEWAY_AUTH_AUDIENCE=${GATEWAY_AUTH_AUDIENCE}"
   "GATEWAY_AUTH_CLIENT_ID=${GATEWAY_AUTH_CLIENT_ID}"
   "GATEWAY_AUTH_CLIENT_SECRET_RESOURCE=${GATEWAY_AUTH_CLIENT_SECRET_RESOURCE}"
   "API_HOST_BACKEND=cloud_run"
-  "SIM_ENTRYPOINT=${SIM_ENTRYPOINT:-old_gateway_direct}"
+  "SIM_ENTRYPOINT=${SIM_ENTRYPOINT}"
   "SIM_COMPUTE_ECONOMY=old_gateway"
   "CLOUD_RUN_REVISION_TAG=${CLOUD_RUN_TAG}"
   "WEB_CONCURRENCY=${CLOUD_RUN_WEB_CONCURRENCY}"
 )
 
+if [[ -n "${OLD_SIMULATION_GATEWAY_URL:-}" ]]; then
+  env_vars+=("OLD_SIMULATION_GATEWAY_URL=${OLD_SIMULATION_GATEWAY_URL}")
+fi
+if [[ -n "${SIMULATION_ENTRYPOINT_URL:-}" ]]; then
+  env_vars+=("SIMULATION_ENTRYPOINT_URL=${SIMULATION_ENTRYPOINT_URL}")
+fi
+
 secret_vars=(
   "POLICYENGINE_DB_PASSWORD=${CLOUD_RUN_POLICYENGINE_DB_PASSWORD_SECRET}"
   "POLICYENGINE_GITHUB_MICRODATA_AUTH_TOKEN=${CLOUD_RUN_GITHUB_MICRODATA_TOKEN_SECRET}"

.github/scripts/simulation_entrypoint_env.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+
+# Shared selected-mode helpers for deployment and compatibility checks.
+# The legacy SIMULATION_API_URL secret is intentionally unsupported: its value
+# is opaque and must not influence which upstream API v1 calls.
+
+simulation_entrypoint_url_env_name() {
+  local entrypoint="${1:-}"
+
+  case "${entrypoint}" in
+    old_gateway_direct)
+      printf '%s\n' "OLD_SIMULATION_GATEWAY_URL"
+      ;;
+    cloud_run_simulation_entrypoint)
+      printf '%s\n' "SIMULATION_ENTRYPOINT_URL"
+      ;;
+    "")
+      echo "SIM_ENTRYPOINT is required" >&2
+      return 1
+      ;;
+    *)
+      printf 'SIM_ENTRYPOINT=%q is invalid; expected old_gateway_direct or cloud_run_simulation_entrypoint\n' \
+        "${entrypoint}" >&2
+      return 1
+      ;;
+  esac
+}
+
+simulation_entrypoint_selected_url() {
+  local url_env_name
+  local url
+
+  url_env_name="$(simulation_entrypoint_url_env_name "${1:-}")" || return
+  url="${!url_env_name:-}"
+
+  if [[ -z "${url}" ]]; then
+    printf '%s is required when SIM_ENTRYPOINT=%s\n' \
+      "${url_env_name}" "${1:-}" >&2
+    return 1
+  fi
+
+  printf '%s\n' "${url}"
+}

.github/scripts/validate_app_engine_deploy_env.sh

@@ -2,10 +2,15 @@
 
 set -euo pipefail
 
+source .github/scripts/simulation_entrypoint_env.sh
+
+selected_url_env="$(
+  simulation_entrypoint_url_env_name "${SIM_ENTRYPOINT:-}"
+)"
+
 required=(
-  SIMULATION_ENTRYPOINT_URL
-  OLD_SIMULATION_GATEWAY_URL
   SIM_ENTRYPOINT
+  "${selected_url_env}"
   GATEWAY_AUTH_ISSUER
   GATEWAY_AUTH_AUDIENCE
   GATEWAY_AUTH_CLIENT_ID

.github/scripts/validate_cloud_run_deploy_env.sh

@@ -3,6 +3,7 @@
 set -euo pipefail
 
 source .github/scripts/cloud_run_env.sh
+source .github/scripts/simulation_entrypoint_env.sh
 cloud_run_set_defaults
 
 # Cloud Run rejects deploys where the traffic tag and service name together
@@ -28,9 +29,13 @@ cloud_run_require_env \
   CLOUD_RUN_ANTHROPIC_API_KEY_SECRET \
   CLOUD_RUN_OPENAI_API_KEY_SECRET \
   CLOUD_RUN_HUGGING_FACE_TOKEN_SECRET \
-  SIMULATION_ENTRYPOINT_URL \
-  OLD_SIMULATION_GATEWAY_URL \
+  SIM_ENTRYPOINT \
   GATEWAY_AUTH_ISSUER \
   GATEWAY_AUTH_AUDIENCE \
   GATEWAY_AUTH_CLIENT_ID \
   GATEWAY_AUTH_CLIENT_SECRET_RESOURCE
+
+selected_url_env="$(
+  simulation_entrypoint_url_env_name "${SIM_ENTRYPOINT}"
+)"
+cloud_run_require_env "${selected_url_env}"

.github/workflows/pr.yml

@@ -4,11 +4,16 @@ on: pull_request
 
 env:
   ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
+  OLD_SIMULATION_GATEWAY_URL: ${{ vars.OLD_SIMULATION_GATEWAY_URL }}
 
 jobs:
   ensure-policyengine-bundle-supported-by-simulation-api:
     name: Ensure PolicyEngine bundle is supported by simulation API
     runs-on: ubuntu-latest
+    environment: staging
+    env:
+      SIM_ENTRYPOINT: ${{ vars.SIM_ENTRYPOINT }}
+      SIMULATION_ENTRYPOINT_URL: ${{ secrets.SIMULATION_ENTRYPOINT_URL }}
     permissions:
       contents: read
     steps:
@@ -19,8 +24,6 @@ jobs:
       - name: Install jq
         run: sudo apt-get install -y jq
       - name: Check simulation API supports updated PolicyEngine bundle
-        env:
-          SIMULATION_ENTRYPOINT_URL: ${{ secrets.SIMULATION_ENTRYPOINT_URL }}
         run: bash .github/check-policyengine-bundle-supported.sh --if-changed-from-base "${{ github.base_ref }}"
 
   lint:

.github/workflows/push.yml

@@ -7,6 +7,7 @@ on:
 
 env:
   ACTIONS_ALLOW_USE_UNSECURE_NODE_VERSION: true
+  OLD_SIMULATION_GATEWAY_URL: ${{ vars.OLD_SIMULATION_GATEWAY_URL }}
 
 concurrency:
   group: deploy
@@ -35,14 +36,15 @@ jobs:
       (github.repository == 'PolicyEngine/policyengine-api')
       && (github.event.head_commit.message == 'Update PolicyEngine API')
     environment: staging
+    env:
+      SIM_ENTRYPOINT: ${{ vars.SIM_ENTRYPOINT }}
+      SIMULATION_ENTRYPOINT_URL: ${{ secrets.SIMULATION_ENTRYPOINT_URL }}
     steps:
       - name: Checkout repo
         uses: actions/checkout@v4
       - name: Install jq
         run: sudo apt-get install -y jq
       - name: Check simulation API supports PolicyEngine bundle
-        env:
-          SIMULATION_ENTRYPOINT_URL: ${{ secrets.SIMULATION_ENTRYPOINT_URL }}
         run: bash .github/check-policyengine-bundle-supported.sh
 
   versioning:
@@ -108,6 +110,9 @@ jobs:
       (github.repository == 'PolicyEngine/policyengine-api')
       && (github.event.head_commit.message == 'Update PolicyEngine API')
     environment: staging
+    env:
+      SIM_ENTRYPOINT: ${{ vars.SIM_ENTRYPOINT }}
+      SIMULATION_ENTRYPOINT_URL: ${{ secrets.SIMULATION_ENTRYPOINT_URL }}
     permissions:
       contents: read
       id-token: write
@@ -152,9 +157,6 @@ jobs:
           # Transitional: these values are still passed into the deploy bundle
           # by gcp/export.py. Long-term target is a generic image plus runtime
           # config / Secret Manager lookups instead of image bake-in.
-          SIMULATION_ENTRYPOINT_URL: ${{ secrets.SIMULATION_ENTRYPOINT_URL }}
-          OLD_SIMULATION_GATEWAY_URL: ${{ secrets.OLD_SIMULATION_GATEWAY_URL }}
-          SIM_ENTRYPOINT: old_gateway_direct
           GATEWAY_AUTH_ISSUER: ${{ secrets.GATEWAY_AUTH_ISSUER }}
           GATEWAY_AUTH_AUDIENCE: ${{ secrets.GATEWAY_AUTH_AUDIENCE }}
           GATEWAY_AUTH_CLIENT_ID: ${{ secrets.GATEWAY_AUTH_CLIENT_ID }}
@@ -171,9 +173,6 @@ jobs:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
           HUGGING_FACE_TOKEN: ${{ secrets.HUGGING_FACE_TOKEN }}
-          SIMULATION_ENTRYPOINT_URL: ${{ secrets.SIMULATION_ENTRYPOINT_URL }}
-          OLD_SIMULATION_GATEWAY_URL: ${{ secrets.OLD_SIMULATION_GATEWAY_URL }}
-          SIM_ENTRYPOINT: old_gateway_direct
           GATEWAY_AUTH_ISSUER: ${{ secrets.GATEWAY_AUTH_ISSUER }}
           GATEWAY_AUTH_AUDIENCE: ${{ secrets.GATEWAY_AUTH_AUDIENCE }}
           GATEWAY_AUTH_CLIENT_ID: ${{ secrets.GATEWAY_AUTH_CLIENT_ID }}
@@ -191,9 +190,6 @@ jobs:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
           HUGGING_FACE_TOKEN: ${{ secrets.HUGGING_FACE_TOKEN }}
-          SIMULATION_ENTRYPOINT_URL: ${{ secrets.SIMULATION_ENTRYPOINT_URL }}
-          OLD_SIMULATION_GATEWAY_URL: ${{ secrets.OLD_SIMULATION_GATEWAY_URL }}
-          SIM_ENTRYPOINT: old_gateway_direct
           GATEWAY_AUTH_ISSUER: ${{ secrets.GATEWAY_AUTH_ISSUER }}
           GATEWAY_AUTH_AUDIENCE: ${{ secrets.GATEWAY_AUTH_AUDIENCE }}
           GATEWAY_AUTH_CLIENT_ID: ${{ secrets.GATEWAY_AUTH_CLIENT_ID }}
@@ -219,6 +215,8 @@ jobs:
       && (github.event.head_commit.message == 'Update PolicyEngine API')
     environment: staging
     env:
+      SIM_ENTRYPOINT: ${{ vars.SIM_ENTRYPOINT }}
+      SIMULATION_ENTRYPOINT_URL: ${{ secrets.SIMULATION_ENTRYPOINT_URL }}
       CLOUD_RUN_SERVICE: policyengine-api-staging
       # Staging stays scale-to-zero, single instance: it exists for per-push
       # validation, not capacity. Both the revision-level (--min-instances) and
@@ -270,9 +268,6 @@ jobs:
           CLOUD_RUN_RUNTIME_SERVICE_ACCOUNT: ${{ secrets.GCP_CLOUD_RUN_RUNTIME_SERVICE_ACCOUNT }}
           POLICYENGINE_DB_USER: ${{ vars.POLICYENGINE_DB_USER }}
           POLICYENGINE_DB_NAME: ${{ vars.POLICYENGINE_DB_NAME }}
-          SIMULATION_ENTRYPOINT_URL: ${{ secrets.SIMULATION_ENTRYPOINT_URL }}
-          OLD_SIMULATION_GATEWAY_URL: ${{ secrets.OLD_SIMULATION_GATEWAY_URL }}
-          SIM_ENTRYPOINT: old_gateway_direct
           GATEWAY_AUTH_ISSUER: ${{ secrets.GATEWAY_AUTH_ISSUER }}
           GATEWAY_AUTH_AUDIENCE: ${{ secrets.GATEWAY_AUTH_AUDIENCE }}
           GATEWAY_AUTH_CLIENT_ID: ${{ secrets.GATEWAY_AUTH_CLIENT_ID }}
@@ -428,14 +423,15 @@ jobs:
       (github.repository == 'PolicyEngine/policyengine-api')
       && (github.event.head_commit.message == 'Update PolicyEngine API')
     environment: production
+    env:
+      SIM_ENTRYPOINT: ${{ vars.SIM_ENTRYPOINT }}
+      SIMULATION_ENTRYPOINT_URL: ${{ secrets.SIMULATION_ENTRYPOINT_URL }}
     steps:
       - name: Checkout repo
         uses: actions/checkout@v4
       - name: Install jq
         run: sudo apt-get install -y jq
       - name: Check simulation API supports PolicyEngine bundle
-        env:
-          SIMULATION_ENTRYPOINT_URL: ${{ secrets.SIMULATION_ENTRYPOINT_URL }}
         run: bash .github/check-policyengine-bundle-supported.sh
 
   deploy-production-candidate:
@@ -446,6 +442,9 @@ jobs:
       (github.repository == 'PolicyEngine/policyengine-api')
       && (github.event.head_commit.message == 'Update PolicyEngine API')
     environment: production
+    env:
+      SIM_ENTRYPOINT: ${{ vars.SIM_ENTRYPOINT }}
+      SIMULATION_ENTRYPOINT_URL: ${{ secrets.SIMULATION_ENTRYPOINT_URL }}
     permissions:
       contents: read
       id-token: write
@@ -476,9 +475,6 @@ jobs:
           # Transitional: these values are still passed into the deploy bundle
           # by gcp/export.py. Long-term target is a generic image plus runtime
           # config / Secret Manager lookups instead of image bake-in.
-          SIMULATION_ENTRYPOINT_URL: ${{ secrets.SIMULATION_ENTRYPOINT_URL }}
-          OLD_SIMULATION_GATEWAY_URL: ${{ secrets.OLD_SIMULATION_GATEWAY_URL }}
-          SIM_ENTRYPOINT: old_gateway_direct
           GATEWAY_AUTH_ISSUER: ${{ secrets.GATEWAY_AUTH_ISSUER }}
           GATEWAY_AUTH_AUDIENCE: ${{ secrets.GATEWAY_AUTH_AUDIENCE }}
           GATEWAY_AUTH_CLIENT_ID: ${{ secrets.GATEWAY_AUTH_CLIENT_ID }}
@@ -496,9 +492,6 @@ jobs:
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
           HUGGING_FACE_TOKEN: ${{ secrets.HUGGING_FACE_TOKEN }}
-          SIMULATION_ENTRYPOINT_URL: ${{ secrets.SIMULATION_ENTRYPOINT_URL }}
-          OLD_SIMULATION_GATEWAY_URL: ${{ secrets.OLD_SIMULATION_GATEWAY_URL }}
-          SIM_ENTRYPOINT: old_gateway_direct
           GATEWAY_AUTH_ISSUER: ${{ secrets.GATEWAY_AUTH_ISSUER }}
           GATEWAY_AUTH_AUDIENCE: ${{ secrets.GATEWAY_AUTH_AUDIENCE }}
           GATEWAY_AUTH_CLIENT_ID: ${{ secrets.GATEWAY_AUTH_CLIENT_ID }}
@@ -579,6 +572,8 @@ jobs:
       && (github.event.head_commit.message == 'Update PolicyEngine API')
     environment: production
     env:
+      SIM_ENTRYPOINT: ${{ vars.SIM_ENTRYPOINT }}
+      SIMULATION_ENTRYPOINT_URL: ${{ secrets.SIMULATION_ENTRYPOINT_URL }}
       CLOUD_RUN_SERVICE: policyengine-api
       # Sized by the Stage 2 qualification and the PR 4 host cutover — rationale
       # and numbers in docs/migration/cloud-run-operations.md ("Runtime shape and
@@ -620,9 +615,6 @@ jobs:
           CLOUD_RUN_RUNTIME_SERVICE_ACCOUNT: ${{ secrets.GCP_CLOUD_RUN_RUNTIME_SERVICE_ACCOUNT }}
           POLICYENGINE_DB_USER: ${{ vars.POLICYENGINE_DB_USER }}
           POLICYENGINE_DB_NAME: ${{ vars.POLICYENGINE_DB_NAME }}
-          SIMULATION_ENTRYPOINT_URL: ${{ secrets.SIMULATION_ENTRYPOINT_URL }}
-          OLD_SIMULATION_GATEWAY_URL: ${{ secrets.OLD_SIMULATION_GATEWAY_URL }}
-          SIM_ENTRYPOINT: old_gateway_direct
           GATEWAY_AUTH_ISSUER: ${{ secrets.GATEWAY_AUTH_ISSUER }}
           GATEWAY_AUTH_AUDIENCE: ${{ secrets.GATEWAY_AUTH_AUDIENCE }}
           GATEWAY_AUTH_CLIENT_ID: ${{ secrets.GATEWAY_AUTH_CLIENT_ID }}

README.md

@@ -54,8 +54,9 @@ Keep that commented unless you are pointing at a real local credential file. The
 If you are running against an auth-protected simulation gateway outside the managed deploy path, you may also need:
 
 - `SIM_ENTRYPOINT` (`old_gateway_direct` or `cloud_run_simulation_entrypoint`)
-- `OLD_SIMULATION_GATEWAY_URL`
-- `SIMULATION_ENTRYPOINT_URL`
+- the URL selected by `SIM_ENTRYPOINT`:
+  - `OLD_SIMULATION_GATEWAY_URL` for `old_gateway_direct`; or
+  - `SIMULATION_ENTRYPOINT_URL` for `cloud_run_simulation_entrypoint`
 - `GATEWAY_AUTH_REQUIRED`
 - `GATEWAY_AUTH_ISSUER`
 - `GATEWAY_AUTH_AUDIENCE`

changelog.d/conditional-simulation-entrypoint-config.fixed.md

@@ -0,0 +1 @@
+Require only the simulation upstream URL selected by each deployment environment, without relying on the inaccessible legacy `SIMULATION_API_URL` secret.

docs/migration/cloud-run-operations.md

@@ -241,6 +241,28 @@ control-plane traffic and stable health, and then leaves the deployment red.
 This rollback only covers immediate deployment failures; later operational
 rollback remains an explicit incident-response action.
 
+## Simulation entrypoint deployment configuration
+
+`SIM_ENTRYPOINT` is a GitHub Actions Environment variable configured separately
+in the existing `staging` and `production` environments. Environment-bound
+jobs expose it as the same-named environment variable. Deployment validation,
+App Engine packaging, Cloud Run configuration, and the model-version
+compatibility guard all require only the URL selected by that value:
+
+- `old_gateway_direct` requires `OLD_SIMULATION_GATEWAY_URL`;
+- `cloud_run_simulation_entrypoint` requires
+  `SIMULATION_ENTRYPOINT_URL`.
+
+`OLD_SIMULATION_GATEWAY_URL` is a non-secret repository-level GitHub Actions
+variable. `SIMULATION_ENTRYPOINT_URL` is a GitHub Actions Environment secret
+configured separately in those same environments. Each environment-bound job
+exposes both values under their same-named environment variables and passes
+them to the deployed service as runtime configuration. If both URLs are
+configured, both are retained on a revision, but an unselected future URL does
+not block a direct-Modal deployment. The legacy `SIMULATION_API_URL` secret is
+intentionally unsupported: its value is opaque, cannot be audited, and must
+not silently choose a deployment upstream.
+
 ## IAM and bootstrap constraints
 
 - The GitHub deploy service account holds `roles/run.developer`: it can deploy to

gcp/export.py

@@ -5,9 +5,26 @@
 ANTHROPIC_API_KEY = os.environ["ANTHROPIC_API_KEY"]
 OPENAI_API_KEY = os.environ["OPENAI_API_KEY"]
 HUGGING_FACE_TOKEN = os.environ["HUGGING_FACE_TOKEN"]
-SIMULATION_ENTRYPOINT_URL = os.environ["SIMULATION_ENTRYPOINT_URL"]
-OLD_SIMULATION_GATEWAY_URL = os.environ["OLD_SIMULATION_GATEWAY_URL"]
 SIM_ENTRYPOINT = os.environ["SIM_ENTRYPOINT"]
+SIMULATION_URL_ENV_BY_ENTRYPOINT = {
+    "old_gateway_direct": "OLD_SIMULATION_GATEWAY_URL",
+    "cloud_run_simulation_entrypoint": "SIMULATION_ENTRYPOINT_URL",
+}
+try:
+    selected_url_env = SIMULATION_URL_ENV_BY_ENTRYPOINT[SIM_ENTRYPOINT]
+except KeyError as error:
+    raise ValueError(
+        "SIM_ENTRYPOINT must be old_gateway_direct or cloud_run_simulation_entrypoint"
+    ) from error
+
+selected_url = os.environ.get(selected_url_env, "")
+if not selected_url:
+    raise ValueError(
+        f"{selected_url_env} is required when SIM_ENTRYPOINT={SIM_ENTRYPOINT}"
+    )
+
+SIMULATION_ENTRYPOINT_URL = os.environ.get("SIMULATION_ENTRYPOINT_URL", "")
+OLD_SIMULATION_GATEWAY_URL = os.environ.get("OLD_SIMULATION_GATEWAY_URL", "")
 GATEWAY_AUTH_ISSUER = os.environ["GATEWAY_AUTH_ISSUER"]
 GATEWAY_AUTH_AUDIENCE = os.environ["GATEWAY_AUTH_AUDIENCE"]
 GATEWAY_AUTH_CLIENT_ID = os.environ["GATEWAY_AUTH_CLIENT_ID"]