From ef57dcec682d794d65311ec3c3e8f858c963ac7a Mon Sep 17 00:00:00 2001
From: Jaana Dogan <jbd@google.com>
Date: Fri, 10 Jul 2026 10:20:33 -0700
Subject: [PATCH 1/2] Update install script to use GOOGLE_CLOUD_PROJECT instead
 of PROJECT_ID

Fixes #290.
---
 hack/install-ax.sh | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/hack/install-ax.sh b/hack/install-ax.sh
index c383f20..78d58d5 100755
--- a/hack/install-ax.sh
+++ b/hack/install-ax.sh
@@ -20,8 +20,8 @@ set -o pipefail
 ROOT=$(git rev-parse --show-toplevel)
 cd "${ROOT}"
 
-if [[ -n "${PROJECT_ID:-}" ]]; then
-  export AX_IMAGE_REPO="gcr.io/${PROJECT_ID}"
+if [[ -n "${GOOGLE_CLOUD_PROJECT:-}" ]]; then
+  export AX_IMAGE_REPO="gcr.io/${GOOGLE_CLOUD_PROJECT}"
   echo "Using AX_IMAGE_REPO: ${AX_IMAGE_REPO}" >&2
 fi
 
@@ -236,7 +236,8 @@ deploy_ax_server() {
     -e "s|\${AX_SNAPSHOTS_BUCKET}|${AX_SNAPSHOTS_BUCKET}|g"
     -e "s|\${AX_IMAGE}|${ax_image}|g"
     -e "s|\${ATEOM_IMAGE}|${ateom_image}|g"
-    -e "s|\${PROJECT_ID}|${PROJECT_ID:-}|g"
+    -e "s|\${PROJECT_ID}|${GOOGLE_CLOUD_PROJECT:-}|g"
+    -e "s|\${GOOGLE_CLOUD_PROJECT}|${GOOGLE_CLOUD_PROJECT:-}|g"
   )
 
   # Render and apply the core manifest (namespace, harnesses, ax-server, ConfigMap).

From 5830585c25b551ec3ecce571eec35d7e9dd97939 Mon Sep 17 00:00:00 2001
From: Jaana Dogan <jbd@google.com>
Date: Fri, 10 Jul 2026 10:25:32 -0700
Subject: [PATCH 2/2] Use GOOGLE_CLOUD_PROJECT variable and remove PROJECT_ID
 usage

Fixes #290.
---
 hack/install-ax.sh  |  1 -
 manifests/README.md | 14 +++++++-------
 2 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/hack/install-ax.sh b/hack/install-ax.sh
index 78d58d5..f4a2025 100755
--- a/hack/install-ax.sh
+++ b/hack/install-ax.sh
@@ -236,7 +236,6 @@ deploy_ax_server() {
     -e "s|\${AX_SNAPSHOTS_BUCKET}|${AX_SNAPSHOTS_BUCKET}|g"
     -e "s|\${AX_IMAGE}|${ax_image}|g"
     -e "s|\${ATEOM_IMAGE}|${ateom_image}|g"
-    -e "s|\${PROJECT_ID}|${GOOGLE_CLOUD_PROJECT:-}|g"
     -e "s|\${GOOGLE_CLOUD_PROJECT}|${GOOGLE_CLOUD_PROJECT:-}|g"
   )
 
diff --git a/manifests/README.md b/manifests/README.md
index 6fc4962..6e68e67 100644
--- a/manifests/README.md
+++ b/manifests/README.md
@@ -45,7 +45,7 @@ with `CONTAINER_ENGINE=docker` or `CONTAINER_ENGINE=podman`:
 
 #### Registry authentication
 
-`PROJECT_ID` sets `AX_IMAGE_REPO=gcr.io/$PROJECT_ID`. The deploy pushes two
+`GOOGLE_CLOUD_PROJECT` sets `AX_IMAGE_REPO=gcr.io/$GOOGLE_CLOUD_PROJECT`. The deploy pushes two
 images — the **ax** image (via your container engine) and the **ateom** image
 (via `ko`) — and both authenticate through the gcloud credential helper:
 
@@ -61,9 +61,9 @@ The event log is stored in Postgres. By default ax-server connects to an
 create a **bundled** Postgres in-cluster instead (for testing).
 
 ```bash
-export PROJECT_ID="ax-substrate" # Your GCP project ID
+export GOOGLE_CLOUD_PROJECT="ax-substrate" # Your GCP project ID
 export GEMINI_API_KEY="your-api-key"
-export AX_SNAPSHOTS_BUCKET="snapshot-substrate-test-$PROJECT_ID"
+export AX_SNAPSHOTS_BUCKET="snapshot-substrate-test-$GOOGLE_CLOUD_PROJECT"
 
 # Connect to your existing Postgres:
 export AX_EVENTLOG_DSN="postgres://user:pass@host:5432/db?sslmode=require"
@@ -92,15 +92,15 @@ Antigravity harness, which uses `GEMINI_API_KEY`.
 The worker pods (WorkerPool `ax-harness-workerpool`, namespace `ax`) have no GSA
 annotation, so with Workload Identity the actor authenticates **directly as the
 Kubernetes ServiceAccount principal** `ax/default`. Grant that principal
-`roles/aiplatform.user` on the project the harness reads from `PROJECT_ID`, or
+`roles/aiplatform.user` on the project the harness reads from `GOOGLE_CLOUD_PROJECT`, or
 Vertex calls fail with `PermissionDenied (403)`. IAM changes can take a minute or two to propagate.
 
 ```bash
-PROJECT_NUMBER="$(gcloud projects describe "${PROJECT_ID}" --format='value(projectNumber)')"
+PROJECT_NUMBER="$(gcloud projects describe "${GOOGLE_CLOUD_PROJECT}" --format='value(projectNumber)')"
 
-gcloud projects add-iam-policy-binding "${PROJECT_ID}" \
+gcloud projects add-iam-policy-binding "${GOOGLE_CLOUD_PROJECT}" \
   --role=roles/aiplatform.user \
-  --member="principal://iam.googleapis.com/projects/${PROJECT_NUMBER}/locations/global/workloadIdentityPools/${PROJECT_ID}.svc.id.goog/subject/ns/ax/sa/default" \
+  --member="principal://iam.googleapis.com/projects/${PROJECT_NUMBER}/locations/global/workloadIdentityPools/${GOOGLE_CLOUD_PROJECT}.svc.id.goog/subject/ns/ax/sa/default" \
   --condition=None
 ```