Google Cloud hub — first release

Ten families, built in one session on 2026-10-21 to docs/sprints/PROMPTS-hub-generation-v2.md. Per-family notes: changelog/2026-10-21-identity-family.md and the nine beside it.

What was built

References and one error catalogue per family; at least one guide per family; a parity guide per family; a top-level method guide; a drift-report guide; three patterns; one worked example; the overview map; and these notes.

The facts that most change an answer

Fact	Why it matters
Cloud Deployment Manager "reached end of support on March 31, 2026."	a model answering from memory still writes it
"Cloud Functions" is now "Cloud Run functions", and a modern function is a Cloud Run service	the old names are what a model says
A function instance serves up to 1000 concurrent requests; 1st gen and AWS Lambda serve one at a time	a correctness risk in a migration, not a tuning note
A Google Cloud VPC is global; subnets are regional	N regional networks become one, and the transit object disappears
Cloud Storage ARCHIVE commits 365 days, against 180 on both other clouds	every lifecycle rule carried in needs re-tuning
Uniform bucket-level access is reversible for 90 days, then permanent	a one-way door in the middle of a routine setting
Cloud KMS key rings cannot be deleted; deleted key names cannot be reused; protection level, purpose and type are immutable	four irreversible decisions in one service
Adding a second Bigtable cluster changes the instance from strongly to eventually consistent by default	it produces no error at all
Spanner has no like-for-like counterpart on AWS or Azure	a move off it is an architecture change
Oracle and SQL Server have documented paths onto PostgreSQL	"migrate" and "drop the licence" can be one project
The Dataproc overview page is titled "Managed Service for Apache Spark"	both names are live; neither is stale
OpenTelemetry is the recommended tracing instrumentation	re-instrument on the source first; it pays for itself either way
A Dataproc cluster starts, scales and stops in "90 seconds or less, on average"	clusters can be ephemeral; count cluster-hours
Three Pub/Sub subscription types write into BigQuery, Bigtable or Cloud Storage with no code	a consumer service is deleted

The one vendor contradiction found

iam/docs/understanding-roles describes custom roles as organization-scoped; iam/quotas counts them per project and per organization (300 each). Recorded with the hub's reading in reference/identity/predefined-roles-and-permissions.md §3 rather than quietly resolved.

Absences recorded rather than filled in — the complete list

1. Secret Manager's overview gives no resource-name format, does not define latest, and does not

enumerate the version states.

1. The GKE Workload Identity Federation page does not say whether the feature is on by default on

Autopilot.

1. The IAM troubleshooting page prints no verbatim denial string.
2. Config Connector's overview does not name the deletion-policy annotation — and guessing it deletes a

database.

1. Infrastructure Manager's overview states **no supported Terraform versions, no default identity, no API

name, no limits**.

1. The Terraform-on-Google-Cloud overview makes no provider-version and no authentication recommendation.
2. The service enable/disable page prints no verbatim not-enabled error.
3. The Compute Engine disks overview does not address multi-instance attachment.
4. Filestore's service-tiers page says nothing about changing tier after creation.
5. The Cloud Storage classes page does not describe a rehydration step for ARCHIVE.
6. Cloud NAT's overview names no port-allocation modes.
7. Cloud Armor's overview does not name distinct policy classes.
8. Cloud SQL publishes no verbatim connection error strings, and no version end-of-support information.
9. Firestore's modes page does not say whether a mode can be changed.
10. Spanner's instance-configurations page states no minimum for nodes or processing units.
11. Pub/Sub's overview states no default message retention; Pub/Sub Lite's status is not claimed.
12. Cloud Tasks' overview does not compare itself to Pub/Sub — the choose-between rule is labelled as the

hub's reading.

1. No error table was read for Dataflow or Dataproc; the Dataproc overview states no cluster location and

names no image versions.

1. Cloud Logging's retention periods live in a quotas document not read here, so **no retention figure is

quoted anywhere in this hub**.

1. Cloud Monitoring's page references PromQL and does not name Managed Service for Prometheus; nothing

about that product is claimed.

1. Cloud Trace's overview states no sampling behaviour.
2. Migrate to Virtual Machines' architecture page does not detail the replication or test-clone mechanics

in the content read — the things a cut-over window depends on.

1. Database Migration Service mentions "ongoing replication" without CDC specifics, and its

engine/version list is a separate living document.

1. Storage Transfer Service's overview does not detail delete-after-transfer or overwrite behaviour —

both destructive-adjacent.

Known missing — the whole list

Each family's own release note has the detail. In summary: organization policy constraints and VPC Service Controls; IAM Conditions (CEL); Terraform import coverage per resource type; object lifecycle rules, retention policies and CMEK; snapshots and machine images; managed instance groups, Spot VMs and Confidential Computing; Artifact Registry; backend services, health checks, URL maps and certificates; Cloud Interconnect, Cloud VPN, Network Connectivity Center and Cloud DNS; VPC Flow Logs and Network Intelligence Center; Memorystore; backups and point-in-time recovery; Cloud SQL read replicas; Firestore security rules; Spanner schema design; Cloud Scheduler and Workflows; Pub/Sub schemas, snapshots, seek and filtering; BigQuery partitioning, clustering, reservations, ML and Omni; Dataflow pipeline options and the template catalogue; Cloud Data Fusion, Dataplex and Looker; Cloud Profiler and Error Reporting; audit log types; Compute Engine and GKE error catalogues; Migrate for Anthos; Transfer Appliance; Backup and DR; VMware Engine; and — the highest-value next addition — cut-over runbooks and rollback procedures.

Conventions, fixed from day one

status: published on every document, because the bundle is the published state and there is no promote command. freshness: {tier: asserted, verified_at, verified_by} — never recheck:, which the platform stores and never validates. One error catalogue per family, because the Google API status codes are the platform's rather than a service's. No address appears as one string: a service-account identity is written ` <sa-name> at <project-id>.iam.gserviceaccount.com . Every document has a next_read, and everything is reachable from _boot/START.md or HUB.md` by links.