Google platform

Workspace for humans; GCP APIs for how decli is built, managed, observed, and improved — recursively.

Two layers

Product layer — Workspace sign-in, Drive packs, Docs/Sheets/Slides, Maps location, Air Quality. Used every day by Mac developers.

Platform layer — Agent, App Hub, Observability, IAM, Storage, Security, Telemetry, and related GCP APIs. How the ecosystem is operated and improved over time.

Primary auth

Google Workspace is the primary path into the web console:

Dev: https://decli.lvh.me/auth/signin
Prod: https://decli.dev/auth/signin

One OAuth web client lists both redirect URIs. Offline tokens land in ~/.decli/google/tokens.json for CLI Drive/Docs after browser login. Optional restriction: GOOGLE_WORKSPACE_DOMAIN.

# After Workspace sign-in in the browser:
decli google auth
decli google drive-list
decli google doc-create "Recover notes"

Product APIs (user-facing)

API	Role in decli
`OAuth / People / userinfo`	Google Workspace primary login (decli.lvh.me + decli.dev)
`Google Drive API`	Encrypted desk pack upload/list (drive.file)
`Google Docs / Sheets / Slides APIs`	Workspace documents from CLI after Workspace sign-in
`Geocoding + Geolocation APIs`	Device fleet places (laptop / mini / iPad)
`Air Quality API`	Session environment AQI metadata for coding + web
`Maps / Places (optional)`	Richer place context and future map UI

Platform APIs (enabled on project decli)

These APIs are key elements of how decli is built, managed, used, maintained, and improved upon — including agent fleets, app topology, security, and observability. Product UI may not call every API on day one; they define the platform contract.

API	Role in the ecosystem
`Agent Registry API`	Catalog and discover agents that participate in the decli fleet
`Agent Platform API`	Runtime surface for agent lifecycle and orchestration
`App Hub API`	Application inventory — map monorepos and services as first-class apps
`App Topology API`	Service dependency graph for desk/recover and ops awareness
`App Lifecycle Manager API`	Deploy / stage / retire app versions consistently
`Cloud API Registry API`	Govern which external and internal APIs decli may call
`Cloud Trace API`	Distributed traces across bridge, API, and web
`Cloud Logging API`	Central logs for recover, pack, and long-running agents
`Cloud Monitoring API`	SLOs and alerts on desk health and bridge uptime
`Observability API`	Unified telemetry control plane
`Telemetry API`	Metrics and event pipelines (pairs with Magenta product analytics)
`Compute Engine API`	Optional remote workers / bastions (e.g. fleet EC2, not local desk)
`Cloud Storage`	Object storage for packs, artifacts, and agent outputs you own
`Dataform API`	Structured data pipelines when desk Postgres feeds analytics
`Notebooks API`	Managed notebook runtimes for research / agent eval loops
`Identity and Access Management (IAM) API`	Least-privilege service accounts for automation
`IAM Connectors API`	Connect external IdPs and workload identity
`Cloud Identity-Aware Proxy API`	Protect admin and agent endpoints without a flat VPN
`Security Command Center API`	Security findings over projects that host decli automation
`Model Armor API`	Guardrails on model I/O as AI providers expand
`Network Security API`	Policy for private connectivity of platform services
`Network Services API`	Load balancing and edge routing for decli.dev surfaces
`Cloud Text-to-Speech API`	Voice UX for notify / accessibility / agent speak-back

Recursive improvement loop

Use — Mac desk pack/recover; CLI + web sessions with environment meta
Observe — Logging, Monitoring, Trace, Telemetry, Magenta product events
Secure — IAM, IAP, SCC, Network Security, Model Armor
Orchestrate — Agent Registry / Platform, App Hub / Topology / Lifecycle
Store — Cloud Storage for artifacts and optional pack mirrors
Improve — Notebooks / Dataform / agents consume signals → better desk defaults

CLI

decli google apis              # product scopes + API list
decli google environment      # session meta incl. AQI
decli google location seed
bash scripts/google-cloud-setup.sh   # enable core product APIs

Full OAuth redirect and env checklist: repo docs/GOOGLE_CLOUD.md. Destinations that use GCS/Drive: Destinations. Architecture: Architecture.