[Bug] gemini-enterprise deploy.sh: the "Configure Gemini Applications" helper appends a second gemini_apps assignment to terraform.tfvars instead of replacing the first

[JohnHales]

Bug Description

Two code paths write the gemini_apps map into the same file, and both append:

# deploy.sh:2479 — main stage-0 configuration path
echo "gemini_apps = ${APPS_OBJ}" >> gemini-stage-0/terraform.tfvars

# deploy.sh:2731 — configure_gemini_apps(), the Helper Functions menu entry
echo "gemini_apps = ${APPS_OBJ}" >> gemini-stage-0/terraform.tfvars

Neither removes an existing assignment first. An operator who deploys stage-0 and later uses the helper to add or replace an application ends up with a terraform.tfvars holding two top-level gemini_apps = {...} assignments — which HCL rejects as a redefined argument, since each may be set only once.

configure_gemini_apps() runs terraform apply immediately after writing, so the helper's own apply is the first thing to fail, and every plan or apply from that directory fails afterwards until the file is hand-edited. The helper is the documented way to add an application after the initial deployment, so this sits on the normal path rather than an edge case.

Environment and Deployment Context

• Stellar Engine Version/Commit: main at commit f64ce6cd (re-verified 2026-08-10)
• Deployment Type:
  • US Region Restricted (e.g., Access Policy constraint)
  • FedRAMP Medium
  • FedRAMP High
  • FedRAMP Moderate
  • DoD IL4
  • DoD IL5
  • Stand-alone / Custom
• FAST Stage (if applicable): N/A — this is a blueprint, not a FAST stage
  • Stage 0 (Bootstrap)
  • Stage 1 (Resource Management)
  • Stage 2 (Network Creation)
  • Stage 3 (Security and Audit)
• Affected Component:
  • blueprints/fedramp-high/gemini-enterprise/deploy.sh:2479
  • blueprints/fedramp-high/gemini-enterprise/deploy.sh:2689-2731 (configure_gemini_apps())
• Terraform Version: 1.12.2 (pinned by deploy.sh via tfenv; the stage declares required_version >= 1.7.4)
• GCP Provider Version: hashicorp/google >= 6.21.0 (stage-0 declared constraint)

Steps to Reproduce

1. Run deploy.sh and complete stage-0 configuration with at least one Gemini application.
2. Return to the menu and run the Helper Function that configures Gemini Enterprise applications.
3. Complete the prompts, then inspect gemini-stage-0/terraform.tfvars — gemini_apps is assigned twice.
4. The helper's apply fails, as does every later plan from that directory.

Expected Behavior

Re-running the helper replaces the application map; the resulting tfvars is valid.

Actual Behavior

terraform.tfvars ends up with two top-level gemini_apps = {...} assignments. The helper's own apply fails immediately, and every later plan or apply from that directory fails the same way until the file is edited by hand.

Relevant Logs and Errors

Expected error (from source inspection; not captured from a run) — HCL rejects a duplicate argument in a values file:

Error: Attribute redefined

  on terraform.tfvars line NN:
  NN: gemini_apps = {

The argument "gemini_apps" was already set at terraform.tfvars:MM.
Each argument may be set only once.

Suggested Fix

Strip any existing gemini_apps = ... block before writing — the script already rewrites other tfvars values in place — or write the application map to its own .auto.tfvars file that is regenerated rather than appended to.

Additional Context

Read from source; confirmed against main @ f64ce6cd, 2026-08-10.