fix(agent): provision agent VMs without public NAT

[Git-on-my-level]

Merge order & dependencies

PR	Dependencies
9250	None — merge first (unblocks CI)
9252	None — parallel with #9253, #9254
9253	None — parallel with #9252, #9254
9254	None — parallel with #9252, #9253; #9255 should merge after this
9255	Merge after #9254 (registers teardown tests). Merge after #9250 recommended.
9256	Independent code PR; PR6b prod deploy after merge. Related #9255 not blocking.
9257	Draft. Merge after #9255 (workflow contract CI).
9258	Draft. Independent; merge after wave 1.
9260	Draft. Independent; merge after wave 1.
9261	Draft. Merge after wave 1; PR10c proxy routing follow-up optional.

Summary

• Remove accessConfigs / ONE_TO_ONE_NAT from GCE agent VM provisioning in agent.rs.
• Add firewall IaC for tag omi-agent-vm and Rust contract test ensuring provision JSON has no public NAT.

Related: #6611

Optional follow-up (PR10c): route desktop upload/sync through agent-proxy in a separate PR if scope grows; not required for this change.

Test plan

cd desktop/macos/Backend-Rust && cargo test provision
# 1 passed (contract_create_gce_vm_provision_json_has_no_public_nat)

Merge with a regular merge (no squash).

Closes #7326

Made with Cursor

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f5ad7e46dc

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cubic-dev-ai]

4 issues found across 6 files

Confidence score: 2/5

• In desktop/macos/Backend-Rust/src/routes/agent.rs, removing accessConfigs means create_gce_vm can no longer produce an external IP while its Result<String> contract and downstream consumers still treat it as reachable over public network; merging as-is is likely to break agent provisioning/reachability flows — either restore external IP assignment or change the return contract and all callers before merging.
• AGENTS.md describes agent-vm-firewall as denying only public tcp:8080, but backend/charts/agent-vm-firewall/firewall-rule.yaml uses sourceRanges: [0.0.0.0/0] on a DENY ingress rule, which effectively blocks that port from everywhere and can cut off intended internal access paths — align the rule or documentation to the intended policy and verify expected traffic still works.
• backend/scripts/agent-vm-reachability-check.sh relies on Python assert for firewall contract checks, and backend/scripts/apply-agent-vm-firewall.sh validates only DENY while not enforcing full contract fields (like ingress/public source ranges), so CI/deploy validation can silently pass unsafe or incorrect rules in some environments — replace assert with explicit runtime checks and enforce all security-critical fields before merging.

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[Git-on-my-level]

Monitor follow-up for PR #9261:

• Updated agent VM readiness/restart recovery to store the VM's private networkIP instead of falling back to missing public natIP / unknown after removing NAT.
• Split the firewall contract into a higher-priority private tcp:8080 ALLOW plus public 0.0.0.0/0 DENY so agent-proxy/VPC traffic remains reachable.
• Replaced optimized-away live-check assert statements with explicit SystemExit failures and expanded apply-time firewall contract validation.
• Resolved the five addressed review threads.

Verification passed:

• backend/scripts/agent-vm-reachability-check.sh under PYTHONOPTIMIZE=1: 6 passed
• cargo test agent: 2 passed
• cargo fmt --check
• git diff --check
• post-push GitHub checks all completed successfully or skipped as expected
• post-push trusted-thread re-scan found no unresolved trusted bot threads