chore(platform): provision managed OCR fallback prerequisites

[Sam123ben]

Purpose

Provision the optional managed OCR fallback needed by the reusable document-intelligence service. This is a platform prerequisite for confidence-based escalation, not a product-specific integration.

Current evidence

Read-only discovery on 2026-09-04 in tesseracthub-480811 showed documentai.googleapis.com is disabled (HTTP 403); no processor can currently be selected or tested.

Required reviewed changes

• Enable Document AI through reviewed Terraform/GitOps, selecting the required regional residency explicitly.
• Create a generic OCR processor only; no Kora-specific processor, bucket, credential, or label belongs here.
• Define the service-account workload-identity principal and grant the smallest processor invocation permission possible.
• Store only non-secret processor resource configuration in GitOps; no bearer tokens, service-account keys, signed URLs, or raw documents.
• Add egress NetworkPolicy for only the managed API endpoint, with application timeouts/circuit breaker and tenant/provider policy enforcement.
• Record retention, residency, pricing ceiling, audit and provider-data-use settings.
• Validate from sandbox using synthetic data, then make the configuration eligible for Kargo canary promotion.

Acceptance evidence

A sandbox workload using workload identity invokes the configured processor on a synthetic document, returns provider-neutral evidence, emits redacted metrics/traces, and proves that callers cannot override provider endpoint, processor, credentials, or tenant residency.

Dependencies

• Blocks fallback slice in feat: implement durable hybrid OCR execution path #46.
• Does not replace legally approved, signed local-model artifact governance; local inference remains a separately gated path.
• Does not authorize production rollout, IAM mutation, secret changes, or use of production documents.

[Sam123ben]

Read-only revalidation on 2026-09-04: documentai.googleapis.com is still not enabled in tesseracthub-480811. No processor, IAM, secret or network change was made. The local model-staging bucket exists but is empty, so #49 remains the only potential managed-fallback route pending reviewed platform work.

[Sam123ben]

Live platform discovery (2026-09-05):

The only document-intelligence GCS buckets currently present are evaluation/model/sandbox artifacts. The Kora/tenant runtime route set required by the service is absent: there is no approved source bucket, page-artifact bucket or result bucket for runtime document processing. The documented KSA/Google SA identities exist, but no service workload has been deployed.

The managed provider implementation in PR #53 requires this issue to provision, in Terraform/GitOps:

1. enable documentai.googleapis.com;
2. create the approved processor in the required residency region;
3. grant only the OCR execution worker GSA the processor invocation permission;
4. provision per-product quarantine/source/page/result buckets with lifecycle policies (sandbox test artifacts delete after 24h);
5. grant the scanner, execution worker and result API least-privilege bucket roles;
6. create isolated document-intelligence-sandbox and document-intelligence-prod Temporal namespaces; and
7. create the sandbox/prod Argo applications from reviewed workload manifests so Kargo can produce Freight.

No imperative cloud/IAM/secret changes were made.

[Sam123ben]

Terraform implementation is in tesserix/tesserix-k8s#967: enables Document AI, declares a generic OCR_PROCESSOR and grants only the execution-worker workload identity roles/documentai.apiUser. It carries no raw documents, service-account key or static provider credential. Processor creation and synthetic evidence remain pending the green PR, merge and reviewed Terraform apply.

[Sam123ben]

Terraform PR #967 has been merged and its reviewed plan applied: Document AI is enabled in asia-south1, the generic OCR processor exists, and only kora-doc-worker has documentai.apiUser. Runtime wiring and sandbox qualification are in tesserix/tesserix-k8s#969.