Allow OIDC deployment of Telegram rollout alarms and notifications

Allow OIDC deployment of Telegram rollout alarms and health schedules

Status: complete — corrected Gate B source is integrated/applied/effective, and normal main CI successfully deployed the accepted default-off observability realization
Tags: enhancement, assistant, infra, testing, P1
Depends on: satisfied — corrected #128 source/transform graph, #140/#143 remediation, credentialed Gate B apply, and normal-CI dark deployment evidence are complete
Blocks: none — #128 retains its separate HUMAN subscription confirmation, staged rollout, and alarm canaries
Next owner: none
Resume condition: reopen only if normal CloudFormation deployment again fails on the constrained Telegram observability permissions or the accepted conditional graph cannot be realized
Related: #124, #129, #130
Evidence: normal push run 31545689094 created the all-off topic, three retained log groups, and three disabled generated health schedules, reached UPDATE_COMPLETE, seeded, and passed deployed smoke with every conversational rollout flag and alarm-subscription confirmation false; run 31711997388 later reconfirmed the default-off OIDC deploy path. The accepted transforms contain exactly 17 condition-gated alarm definitions; the correct dark realization has zero instantiated alarms. The unshipped #166 rollout is later work and does not invalidate this completed permission issue.

Current review state

The blocked bbb0841653603ee0830747fbb0df43979df0a0eb candidate was superseded by corrected Gate B source ddbaf2893bf2985d32e5a33310fe57e2f4ac9452. Independent Architecture, IAM/security, Tester, and PM reviews passed; the corrected source was integrated, applied through its reviewed CloudFormation change set, verified effective, and found IN_SYNC. No source correction or IAM apply remains.

The prior rollback evidence is superseded by normal push run 31545689094. That run used the accepted all-false controls, added the rollout topic, three retained custom log groups, and three generated disabled health schedules, reached terminal UPDATE_COMPLETE, completed runtime seeding, and passed deployed smoke without an authorization denial. The accepted transform verification already proves all 17 exact condition-gated alarm definitions; dark mode correctly instantiates zero alarm resources. With ConversationalAlarmSubscriptionConfirmed=false, zero active alarms, and no template subscription, there was no paging or message-content path. Later normal run 31711997388 reconfirmed the stable default-off deployment.

Historical source boundary

The accepted corrected change was limited to:

sandbox/dataops/template.github-actions.yaml
sandbox/dataops/tests/test_template_github_actions.py
sandbox/dataops/tests/fixtures/issue_128_observability.synthetic.yaml

That source stage is complete. It preserved #124/#129/#130 and introduced no DataOps application-source or CloudFormation service-role change.

Replacement #128 graph contract

Final review uses fresh replacement #128 source/build/transforms, not the old
fixture.

The observability family remains:

one ConversationalRolloutAlarmTopic, exact name
${FullDocsStackName}-conversational-rollout-alarms, alias/aws/sns, ARN
output only, no subscription/topic policy/contact;
exactly three retained 30-day custom log groups:
backend, execution, and result-dispatcher;
exactly 17 simple AWS::CloudWatch::Alarm resources with exact
${FullDocsStackName}-conversational-<suffix> names and the one topic action;
heartbeat suffixes execution-worker-heartbeat-stale,
recovery-heartbeat-stale, and result-dispatcher-heartbeat-stale use
TreatMissingData: breaching;
the other 14 alarms retain TreatMissingData: notBreaching;
no subscription, topic policy, dashboard, composite, anomaly, canary,
metric/filter/subscription, or additional observability family.

Keep the same 17 suffixes already enumerated by bbb0841:

execution-outcome-unknown
execution-failure-queue-visible
recovery-oldest-due-age
execution-worker-heartbeat-stale
recovery-heartbeat-stale
result-delivery-outcome-unknown
result-delivery-oldest-pending
result-dispatcher-heartbeat-stale
result-delivery-failed
telegram-webhook-failures
model-failures
voice-failures
photo-failures
typefully-draft-failed
media-cleanup-failed
retention-cleanup-failed
execution-failed-safe

#128 adds one execution-conditioned two-minute health-pulse Schedule event to
the existing execution worker. The SAM transform therefore adds one
stack-prefixed AWS::Events::Rule and one AWS::Lambda::Permission targeting
ConversationalExecutionWorkerFunction, in addition to the existing recovery
and result-dispatcher schedule resources. Update the fixture/final graph test
with the exact generated logical IDs, state/condition, input, target, and
permission ownership.

Do not add EventBridge or Lambda actions to the observability managed policy.
The accepted Gate A deploy policy already covers stack-prefixed EventBridge
rule lifecycle/tagging and Add/RemovePermission on the exact worker function
family. Structural tests must prove the new transformed resources fit those
existing statements without changing them.

Managed-policy placement and quotas

Retain one generated-name
ConversationalRolloutObservabilityDeployPolicy, attached only to
GitHubActionsDeployRole. Do not set ManagedPolicyName, grow the nearly full
inline policy, mix domains into Sponsor/dispatcher policies, or grant policy
self-administration.

The corrected compact observability policy must be <= 5,632 characters,
leaving at least 512 below IAM's 6,144-character managed-policy limit. Preserve
all prior policy ceilings and the four-policy steady-state/eight-policy
replacement attachment model. Recompute from resolved documents.

Exact corrected OIDC permissions

CloudWatch alarm lifecycle and tag-on-create

Retain cloudwatch:PutMetricAlarm on only the exact 17 alarm ARNs, with:

a non-null cloudwatch:AlarmActions; and
every action equal to the one exact rollout topic ARN.

Retain cloudwatch:DescribeAlarms and cloudwatch:DeleteAlarms on those exact
17 ARNs.

Add cloudwatch:TagResource on only those same 17 exact alarm ARNs. It is
required because CloudFormation automatically supplies system tags, the alarm
resource supports tags, and AWS maps tagged alarm creation to
cloudwatch:TagResource in addition to PutMetricAlarm.

Do not place TagResource in the alarm-action-conditioned Put statement:
that condition is not present on the separate tag call. Keep it in a separate
statement or with the unconditioned exact-ARN lifecycle statement.

Do not condition CloudWatch tag permission on the three aws: system tag keys.
Although CloudWatch exposes generic request-tag condition keys, its alarm
tagging guidance explicitly says tag names beginning aws: cannot be used for
tag-based authorization control. The exact 17 ARNs are the reliable boundary.

Add no UntagResource, ListTagsForResource, metric data plane, state forcing,
composite/dashboard/anomaly/canary, or wildcard alarm capability.

Authoritative references:

SNS topic lifecycle and tag-on-create

Retain exactly:

sns:CreateTopic
sns:DeleteTopic
sns:GetTopicAttributes
sns:SetTopicAttributes

on the one exact topic ARN.

Add a separate sns:TagResource statement on that same exact topic ARN.
Require a non-null aws:TagKeys request and use
ForAllValues:StringEquals (or an independently proven equivalent) limiting
the request to:

aws:cloudformation:logical-id
aws:cloudformation:stack-id
aws:cloudformation:stack-name

The condition must reject a missing key set and any customer/extra tag key.
SNS documents aws:TagKeys for TagResource; the official CloudFormation SNS
provider supplies system tags on create.

Do not add ListTagsForResource, ListSubscriptionsByTopic,
GetDataProtectionPolicy, UntagResource, publish, subscription,
confirmation, topic-policy, endpoint, KMS, wildcard, or other optional action.
The provider deliberately tolerates denial of the optional reads; they are not
proven deployment blockers.

Authoritative references:

Retained log groups

Retain the accepted exact policy:

logs:CreateLogGroup and logs:PutRetentionPolicy on the base and :*
forms for only the three custom /dataops/${FullDocsStackName}/conversational
groups;
logs:DescribeLogGroups alone on Resource: "*";
no delete, stream/event data plane, query/export/filter/subscription/policy,
KMS, delivery, or additional wildcard.

Acceptance criteria

Required tests

Run:

uv run --with pytest python -m pytest sandbox/dataops/tests -q
sam validate --lint --template-file sandbox/dataops/template.github-actions.yaml
git diff --check 2a1b95f...HEAD

Parsed structural/mutation tests must prove:

exact statement/action/resource/condition sets;
SNS tag requests are non-null and limited to the three system keys;
CloudWatch tag access is exact-ARN and not incorrectly tied to
cloudwatch:AlarmActions;
no new list/read/untag/data-plane/wildcard/self-admin action;
exact 3/14 heartbeat missing-data split;
exact transformed worker pulse rule/permission and reuse of existing Gate A
EventBridge/Lambda permission statements;
deterministic resolved policy sizes/attachments and Add transactional approval and durable execution recovery #124/Repair DataOps OIDC SES configuration-set tag-on-create permission #129/Repair dispatcher generated-role IAM prefix for CloudFormation rollback #130
preservation.

Fresh-build #128 into an isolated directory and translate dark, execution,
ingress, voice, photo, Typefully-external, and fully staged states. Compare
actual logical IDs, names, actions, conditions, schedules, permissions,
retention/retain policies, and prohibited families. Do not use stale
.aws-sam output or self-compare an in-test constant.

Sequencing and apply

Roll out and cut over the Telegram conversational MVP #128 SWE produces the replacement runtime/SAM candidate.
Assistant and Architect accept its heartbeat/maintenance behavior and fresh
graph.
Allow OIDC deployment of Telegram rollout alarms and notifications #131 SWE corrects the existing isolated IAM candidate and fixture.
Independent IAM/security Tester and PM accept the exact corrected range.
Integrate accepted source into aws-infra/main with
Refs DataTalksClub/dataops#131; add human.
A credentialed operator reviews change sets/live attachments and applies
dataops-github-actions with CAPABILITY_NAMED_IAM.
Verify terminal stack state and effective policy before Roll out and cut over the Telegram conversational MVP #128 commit/push.
On-Call verifies the default-off app deployment creates the exact graph and
no alarm pages. Roll out and cut over the Telegram conversational MVP #128 owns subscription confirmation and alarm canaries.

Rollback uses CloudFormation and the prior accepted template, never manual IAM
editing or destructive resource cleanup.

Out of scope

#128 runtime implementation, extra alarms/metrics, subscription/contact
management, notifications, provider/Telegram calls, secrets, application
deployment outside CI, manual IAM edits, dashboards/composites/anomalies/
canaries, log data plane, optional provider reads, and any other repository or
stack.

PM GROOMED — READY FOR ISOLATED AWS-INFRA IMPLEMENTATION

Validated the intake author (alexeygrigorev) and reviewed #128's full re-groomed rollout contract, Architect/On-Call findings, accepted #124/#129/#130 policy chain, current aws-infra/origin/main at 2a1b95f, resolved policy sizes/attachments, and official CloudWatch/SNS/Logs authorization/resource behavior.

Binding decisions now encoded in #131:

Freeze one exact public-safe Roll out and cut over the Telegram conversational MVP #128 observability graph: 17 named AWS::CloudWatch::Alarm resources, one ConversationalRolloutAlarmTopic, exactly three new custom retained log groups, and no other observability family.
The topic is encrypted with alias/aws/sns, outputs only its ARN, and contains no stack subscription, endpoint, contact, or topic policy. Therefore the deploy role gets no Subscribe/Unsubscribe/Confirm/Publish permission and no KMS permission. Subscription confirmation remains out-of-band/HUMAN.
Existing automatically created /aws/lambda/... groups are never declared/adopted/deleted. New groups use exact /dataops/${FullDocsStackName}/conversational/{backend,execution,result-dispatcher} names, 30-day retention, and retain policies.
Add one fourth generated-name customer-managed policy attached only to the GitHub Actions deploy role. Do not grow the 9,341-character inline policy or mix observability into Sponsor/dispatcher policies.
CloudWatch permission is exact PutMetricAlarm plus exact read/delete on the 17 alarm ARNs. Put is condition-bound to the one exact SNS alarm action. There is no metric data plane, state forcing, dashboard/composite/anomaly/canary, wildcard alarm, or tag capability.
SNS permission is only Create/Delete/Get/Set attributes on the exact topic. Logs permission is only Create/PutRetention on six exact ARN forms plus the single documented unscoped DescribeLogGroups read action. Retained log groups cannot be deleted by this role.
Deterministic policy ceilings preserve current Add transactional approval and durable execution recovery #124/Repair DataOps OIDC SES configuration-set tag-on-create permission #129/Repair dispatcher generated-role IAM prefix for CloudFormation rollback #130 sizes. The new policy must remain <=5,120 characters; source attachments become 4/10. The operator must inspect live attachments because simultaneous replacement of all four could temporarily use 8/10.
Parsed structural and adversarial mutation tests must reject every broader action/resource/condition, preserve all accepted policy/trust boundaries, and measure resolved documents—not source lines.
Final acceptance requires fresh Roll out and cut over the Telegram conversational MVP #128 builds and real SAM transforms for default-off and controlling switch states. Tests must compare actual logical IDs/names/conditions/topic/log ownership, not an in-test constant with itself.
Implementation, independent IAM/security review, PM acceptance, local source integration, credentialed named-IAM apply, rollback, and On-Call default-off verification are separate gates. Source merge alone changes no AWS permission.

Readiness/dependency:

Isolated aws-infra implementation can start now from current origin/main using the frozen contract.
Final review/merge is conditional on the final Roll out and cut over the Telegram conversational MVP #128 SAM/transformed graph matching the exact contract. Graph drift requires PM/Architect review and regrooming rather than speculative policy broadening.
Allow OIDC deployment of Telegram rollout alarms and notifications #131 blocks Roll out and cut over the Telegram conversational MVP #128 dark deployment, not Roll out and cut over the Telegram conversational MVP #128's earlier code dependency work.
Keep Allow OIDC deployment of Telegram rollout alarms and notifications #131 open with human after source integration. Credentialed apply/effective-policy/default-off evidence is required before closure; Roll out and cut over the Telegram conversational MVP #128 separately owns subscription confirmation and alarm canaries.

No repository file, commit, branch, push, merge, AWS stack, alarm, topic, subscription, log group, provider, or runtime state was changed during grooming.

Software Engineer handoff — isolated observability deploy policy ready for security review

Implemented the frozen #131 IAM contract as a separate commit directly above accepted/pushed #130. No remote push/merge, AWS call/apply, dirty-checkout edit, or DataOps source edit was performed.

Isolated branch

Repository: DataTalksClub/aws-infra
Worktree: /home/alexey/git/.worktrees/aws-infra-131
Branch: issue-131-conversational-rollout-observability-deploy-role
Exact base: 2a1b95f4fd0f4d8d0d24e6edf4a337281c2aea79
Allow OIDC deployment of Telegram rollout alarms and notifications #131 commit: bbb0841653603ee0830747fbb0df43979df0a0eb
Commit trailer: Refs DataTalksClub/dataops#131
Worktree: clean

Changed only the shared deploy-role source and its focused test assets:

sandbox/dataops/template.github-actions.yaml
sandbox/dataops/tests/test_template_github_actions.py
sandbox/dataops/tests/fixtures/issue_128_observability.synthetic.yaml

Exact managed-policy boundary

Added one generated-name AWS::IAM::ManagedPolicy, ConversationalRolloutObservabilityDeployPolicy, attached only via Roles: [!Ref GitHubActionsDeployRole]; it has no fixed ManagedPolicyName and grants no policy self-administration.

Its five exact statements are:

cloudwatch:PutMetricAlarm on the 17 frozen exact alarm ARNs. The statement requires both:
- Null: { cloudwatch:AlarmActions: "false" }, preventing an absent alarm action;
- ForAllValues:ArnEquals binding every action to the one exact ${FullDocsStackName}-conversational-rollout-alarms topic ARN.
cloudwatch:DescribeAlarms and cloudwatch:DeleteAlarms on the same 17 exact alarm ARNs.
sns:CreateTopic, DeleteTopic, GetTopicAttributes, and SetTopicAttributes on the one exact rollout topic ARN.
logs:CreateLogGroup and PutRetentionPolicy on the base and :* forms of exactly the backend, execution, and result-dispatcher /dataops/.../conversational/... groups.
logs:DescribeLogGroups alone on Resource: "*", the policy's sole wildcard resource.

No CloudWatch metric data plane/state forcing/composite/dashboard/anomaly/canary/tag action; SNS publish/subscription/policy/endpoint/tag action; KMS action; log deletion/data-plane/query/export/filter/subscription/policy/index/KMS/delivery action; or IAM self-management was added.

The inline, Sponsor compute/service, and dispatcher policies remain domain-pure. All #124/#129/#130 structural and adversarial preservation tests remain active.

Combined automated evidence

PASS:

uv run --with pytest python -m pytest sandbox/dataops/tests -q
47 passed, 94 subtests passed

sam validate --lint --template-file sandbox/dataops/template.github-actions.yaml
valid SAM template

git diff 2a1b95f4fd0f4d8d0d24e6edf4a337281c2aea79 --check
clean

Mutation tests reject missing/extra/broad alarm ARNs; absent/different/additional alarm actions; CloudWatch data plane and other resource families; SNS publish/subscription/policy/tag/KMS; log deletion/data-plane/broad resources/additional wildcard actions; fixed policy name/extra role/self-administration; and all earlier-policy regressions.

Resolved sizes and replacement headroom

Actual policy documents were default/pseudo-value resolved and compact JSON serialized:

aggregate inline: 9,341, leaving 899 below 10,240;
Sponsor compute: 3,706, leaving 2,438 below 6,144;
Sponsor service: 717, leaving 5,427 below 6,144;
dispatcher: 1,512, leaving 4,632 below 6,144;
observability: 4,977, below the 5,120 ceiling and leaving 1,167 below 6,144;
steady-state attachments: 4/10, leaving 6;
simultaneous replacement model: 8/10, leaving 2 before any external attachment.

Live external attachments remain a mandatory operator inspection before apply.

#128 graph status — explicit pre-merge blocker

#128 is not implemented yet; no DataOps worktree or template currently contains ConversationalRolloutAlarmTopic. Therefore no honest final #128 build or SAM transform comparison can be reported now.

A parsed, public-safe synthetic fixture captures the frozen PM contract independently from the policy constants:

exact topic name/type/alias/aws/sns/output and no subscription/topic policy;
exact three custom group names, owners, 30-day retention, and Retain policies;
exact 17 alarm logical IDs and suffixes;
prohibited subscription/topic-policy/composite/dashboard/log-filter families.

The fixture intentionally asserts:

Synthetic: true
RequiresFinalBuildTransformRevalidation: true

FINAL #128 BUILD/TRANSFORM REVALIDATION IS REQUIRED BEFORE MERGE/ACCEPTANCE. Once #128 exists, an independent reviewer must fresh-build and translate default-off plus every controlling switch state, compare actual topic/groups/alarm subsets/names/actions/conditions/retention/ownership and prohibited resource types to the fixture/policy, and reject or regroom #131 on any drift. This commit must not be pushed/merged or applied based only on the synthetic fixture.

READY FOR INDEPENDENT IAM/SECURITY REVIEW of the committed policy and tests, with final #128 graph verification explicitly pending.

TEST PASS — IAM source under frozen specification only

Independently reviewed aws-infra commit bbb0841653603ee0830747fbb0df43979df0a0eb atop accepted 2a1b95f. This is a conditional source/security pass, not final #131 merge/PM acceptance and not authorization to apply AWS changes.

Source/security verdict

PASS for the committed IAM source against the frozen #128 graph:

exactly one generated-name ConversationalRolloutObservabilityDeployPolicy, attached only to GitHubActionsDeployRole; no fixed name, inline-policy growth, other-role attachment, or policy self-administration;
PutMetricAlarm is limited to the exact 17 frozen alarm ARNs and requires a present cloudwatch:AlarmActions value whose every member equals the one exact rollout SNS topic ARN;
DescribeAlarms/DeleteAlarms use the same exact 17 ARNs;
SNS lifecycle is exactly CreateTopic, DeleteTopic, GetTopicAttributes, and SetTopicAttributes on the single exact topic ARN—no publish, subscription, topic-policy, endpoint, tag, or KMS administration;
Logs lifecycle is exactly CreateLogGroup/PutRetentionPolicy on the base and :* ARN forms of the three frozen backend, execution, and result-dispatcher custom groups; DescribeLogGroups alone has Resource: "*", the sole wildcard;
forbidden CloudWatch data-plane/state/composite/dashboard/anomaly/canary/tag actions, log delete/data-plane/query/export/filter/policy/KMS/delivery actions, and IAM/KMS management are absent;
accepted Add transactional approval and durable execution recovery #124/Repair DataOps OIDC SES configuration-set tag-on-create permission #129/Repair dispatcher generated-role IAM prefix for CloudFormation rollback #130 policies and tests remain preserved.

AWS's current service-authorization reference confirms alarm ARNs are supported for PutMetricAlarm, DescribeAlarms, and DeleteAlarms, and cloudwatch:AlarmActions is supported by PutMetricAlarm. AWS's alarm-action guidance confirms that condition key is the intended control for restricting alarm actions.

Independent evidence

uv run --with pytest python -m pytest sandbox/dataops/tests -q
47 passed, 94 subtests passed in 0.64s

sam validate --lint --template-file sandbox/dataops/template.github-actions.yaml
valid SAM template

git diff 2a1b95f..bbb0841653603ee0830747fbb0df43979df0a0eb --check
clean

Independent resolved-size/quota check:

aggregate inline                 9,341 / 10,240
Sponsor compute managed policy  3,706 / 6,144
Sponsor service managed policy    717 / 6,144
dispatcher managed policy       1,512 / 6,144
observability managed policy    4,977 / 6,144 (also below frozen 5,120 ceiling)
steady-state attachments            4 / 10
replacement model                  8 / 10

Commit history is linear above 2a1b95f and includes accepted 9b5b888 and PR #18/#124 ancestry. The isolated aws-infra worktree remained clean and only the three handed-off files differ from the base.

Mandatory unresolved pre-merge gate

The fixture is correctly and conspicuously marked:

Synthetic: true
RequiresFinalBuildTransformRevalidation: true

It is not an actual #128 build. #128 remains open/unimplemented, and the current DataOps template does not contain ConversationalRolloutAlarmTopic or the frozen alarm/log-group logical IDs. Therefore this test pass cannot establish that the eventual application graph matches these permissions.

Before #131 merge or final PM acceptance, an independent reviewer must fresh-build and SAM-transform the implemented #128 default-off template and every controlling switch state, then compare the actual topic, three log groups, 17 alarm subsets/names/actions/conditions/retention/ownership, and prohibited resource types against the frozen fixture and this policy. Any drift requires #131 correction or explicit regrooming. Live external managed-policy attachments must also be inspected before the later credentialed apply.

Verdict: TEST PASS for source-under-frozen-spec; final build/transform verification remains a hard pre-merge/PM gate. No commit, push, merge, AWS call, or apply was performed.

ARCHITECTURE BLOCKED — `bbb0841` must not proceed or be applied

The final build/transform architecture gate is blocked. Full evidence and the exact frozen fingerprint are in the #128 Architect review.

Two hard blockers prevent #131 commit bbb0841653603ee0830747fbb0df43979df0a0eb from proceeding to final review, merge acceptance, or credentialed Gate B apply:

The frozen Roll out and cut over the Telegram conversational MVP #128 graph's three stale-heartbeat alarms cannot breach. Their only runtime emitters publish literal age 0; a stopped/stalled component publishes nothing; and each alarm uses TreatMissingData: notBreaching. The worker, recovery, and result-dispatcher stale alarms therefore cannot detect the failure they name. Fix or regroom the metric/alarm semantics, prove fresh/stale/stopped states, then refreeze the graph and IAM contract.
The Allow OIDC deployment of Telegram rollout alarms and notifications #131 deploy policy grants sns:CreateTopic but omits sns:TagResource. CloudFormation automatically supplies system tags, and the archived official AWS SNS provider explicitly declares system-tag-on-create support, merges those system tags into CreateTopic, and includes sns:TagResource in its resource-role permissions. AWS documents that tagged CreateTopic requires both permissions. With no separate CloudFormation service role, the OIDC deploy credentials must carry the needed resource permission. The exact-topic lifecycle policy is therefore not deployable as written.

The second finding is not an argument to add every action declared by the provider. Its read path deliberately tolerates authorization denial for ListTagsForResource, ListSubscriptionsByTopic, and GetDataProtectionPolicy; those are not asserted as hard blockers. The definite missing create permission is sns:TagResource, which should remain exact-topic and condition-restricted to CloudFormation system tag keys where supported, with structural tests.

One additional permission question requires explicit PM/IAM resolution before acceptance: bbb0841 also omits cloudwatch:TagResource for all 17 alarms. AWS documents that creating tagged alarms requires it, while CloudFormation documents automatic system tags. Establish authoritatively whether this alarm provider/deployment path passes system tags. If yes, grant it only over the exact 17 alarm ARNs with supported conditions and tests; if no, record the authoritative basis in the groomed contract. Do not use a live apply to discover the answer.

The regenerated #128 source and fresh built graphs otherwise match #131's synthetic fixture exactly: one topic, three retained 30-day log groups, 17 alarms, no subscriptions/topic policies/forbidden observability resources, and active-alarm counts of dark 0, execution 6, ingress 7, voice 9, photo 9, Typefully external 7, and fully staged 17. The rest of bbb0841 remains least-privilege and structurally exact against that frozen graph.

Verdict: ARCHITECTURE BLOCKED. Do not merge/apply bbb0841; correct or explicitly regroom, then repeat independent transform/IAM review.

I did not change the issue body or labels, edit repository files, commit, push, merge, deploy, call AWS, or apply CloudFormation. The only external effect here is this requested cross-linked review comment.

PM REGROOMED — IAM/FIXTURE CORRECTION REQUIRED

Commit bbb0841 remains isolated and must not be merged or applied.

Binding IAM decisions:

Add sns:TagResource on the exact topic in a separate statement, require
non-null aws:TagKeys, and allow only the three CloudFormation system tag
keys. Add no tolerated optional SNS reads.
Add cloudwatch:TagResource on only the exact 17 alarm ARNs. CloudFormation
supplies system tags and AWS maps tagged alarm creation to this permission.
Do not condition it on AWS-prefixed tag keys because CloudWatch explicitly
says those keys cannot be used for tag-based authorization; exact ARNs are
the reliable bound.
Add no list/untag/data-plane permissions.
Update the fixture for the three heartbeat alarms' missing-as-breaching
semantics and the SAM-generated worker health EventBridge rule/Lambda
permission. Prove existing Gate A IAM covers those schedule edges; do not add
EventBridge/Lambda actions to the observability policy.
Raise only the deterministic observability-policy ceiling needed for the two
exact tag statements: <=5,632 characters, retaining >=512 bytes of headroom.

Sequence remains #128 replacement and specialist graph acceptance first, then
#131 correction/security/PM review, source integration, credentialed Gate B
apply, and only then #128 commit/push.

READY FOR #128 REPLACEMENT; #131 CORRECTION MAY PREPARE BUT FINAL GRAPH REVIEW IS BLOCKED

Software Engineer interim handoff — tagging correction complete; final graph revalidation pending

Corrected the known #131 tag-on-create IAM slice in the isolated aws-infra worktree atop parked commit bbb0841653603ee0830747fbb0df43979df0a0eb. This remains uncommitted and must not be merged, pushed, or applied yet.

Implemented IAM boundary

Added cloudwatch:TagResource to the existing unconditioned alarm lifecycle statement over only the same exact 17 alarm ARNs. It is not tied to cloudwatch:AlarmActions or any unreliable AWS-prefixed tag-key condition.
Added a separate sns:TagResource statement over only the exact rollout topic ARN.
The SNS tag statement requires non-null aws:TagKeys and uses ForAllValues:StringEquals with exactly:
- aws:cloudformation:logical-id
- aws:cloudformation:stack-id
- aws:cloudformation:stack-name
Added no CloudWatch/SNS list, optional read, untag, data-plane, EventBridge, Lambda, KMS, or policy self-administration action.
Preserved the exact 17 alarms, topic lifecycle, log-group boundary, four-policy attachment model, and accepted Add transactional approval and durable execution recovery #124/Repair DataOps OIDC SES configuration-set tag-on-create permission #129/Repair dispatcher generated-role IAM prefix for CloudFormation rollback #130 policies.

Changed in this correction slice:

sandbox/dataops/template.github-actions.yaml
sandbox/dataops/tests/test_template_github_actions.py

The synthetic fixture was deliberately not finalized in this slice. sandbox/dataops/tests/fixtures/issue_128_observability.synthetic.yaml remains marked Synthetic: true and RequiresFinalBuildTransformRevalidation: true pending #128's final generated worker health rule/permission inventory, hashes, and exact transform edges.

Verification

uv run --with pytest python -m pytest sandbox/dataops/tests/test_template_github_actions.py::ConversationalRolloutObservabilityDeployPolicyTest -q
15 passed, 52 subtests passed

uv run --with pytest python -m pytest sandbox/dataops/tests -q
49 passed, 102 subtests passed

sam validate --lint --template-file sandbox/dataops/template.github-actions.yaml
valid SAM template

git diff 2a1b95f4fd0f4d8d0d24e6edf4a337281c2aea79 --check
clean

Resolved compact policy evidence:

aggregate inline:       9,341
Sponsor compute:        3,706
Sponsor service:          717
dispatcher:              1,512
observability:           5,369 / 5,632 issue ceiling / 6,144 IAM limit
observability headroom:    775
steady attachments:       4/10
replacement model:        8/10

Resolved observability policy SHA-256:

435213eed7933be4ae303aae1b14ef72f09a42a4a6cf2c1f6fa99706455b827f

Mutation coverage now rejects missing/broad/misplaced CloudWatch tagging, alarm-action or tag-key conditions on the CloudWatch tag call, missing/broad SNS tagging, absent/non-enforcing aws:TagKeys, missing or extra permitted tag keys, optional SNS reads/untag, CloudWatch list/untag/data plane, and EventBridge/Lambda additions to the observability policy.

INTERIM TAGGING SLICE COMPLETE. FINAL #128 FIXTURE/TRANSFORM/INVENTORY REVALIDATION REMAINS A HARD BLOCKER BEFORE TESTER/PM ACCEPTANCE, COMMIT, MERGE, OR APPLY.

Software Engineer replacement handoff — corrected IAM and final #128 graph frozen

This supersedes the conditional tagging-only handoff:
#131 (comment).

The corrected #131 candidate is complete in the isolated aws-infra worktree atop parked commit bbb0841653603ee0830747fbb0df43979df0a0eb. It remains uncommitted and has not been pushed, merged, or applied.

Corrected exact IAM boundary

cloudwatch:PutMetricAlarm remains limited to the exact 17 alarm ARNs and requires a present cloudwatch:AlarmActions set whose every value is the one exact rollout topic ARN.
cloudwatch:DeleteAlarms, cloudwatch:DescribeAlarms, and cloudwatch:TagResource share the same exact 17 ARNs in the unconditioned lifecycle statement. The tag call has no alarm-action condition and no unreliable AWS-prefixed tag-key condition.
SNS lifecycle remains exactly CreateTopic, DeleteTopic, GetTopicAttributes, and SetTopicAttributes on the one exact topic ARN.
A separate exact-topic sns:TagResource statement requires Null: { aws:TagKeys: "false" } and ForAllValues:StringEquals over exactly the three CloudFormation system keys.
No CloudWatch/SNS optional list/read/untag/data-plane action and no EventBridge/Lambda action was added to the observability policy.
The exact retained log-group policy, generated managed-policy placement, Add transactional approval and durable execution recovery #124/Repair DataOps OIDC SES configuration-set tag-on-create permission #129/Repair dispatcher generated-role IAM prefix for CloudFormation rollback #130 boundaries, and four-policy attachment model remain unchanged.

Final replacement #128 graph evidence

Consumed the authoritative #128 replacement handoff:
#128 (comment)

Verified before fixture finalization:

base/HEAD:  f08cfc750cebc601db8b71024168741f8ef4aadb
source SAM: fb272bbddbde1a41cb2b5ae92cf0923baa03815a517df143119731fee2ef8ee5
built SAM:  f5d053beb24013a5ef8daf01ff6522e3bf1ed673e616ac3dbdcf07609f3be7aa
inventory:  a8a9203638d27297f4c5a1f36b983e3731099f419bb0c8bdefaf19b8c64b1a4c

Ran a fresh six-state source translation into an isolated ignored aws-infra evidence directory. The regenerated inventory was byte-identical to the authoritative inventory. Every state has 88 resources and the exact frozen transform hashes:

dark                92fb5407e18d0a679b36a93bebe872236c5d7d4286801eb41bc62da7fad72bdc
execution           321949b057d3967322ff3df4a42309bced894caba06f6ee2fa7accaf4463aab9
ingress             8d9851f3a6f6adcd549a7d5476f62d6d97633190b398eaaf1054004b4f165181
voice               97d55161b98c25059952336ef06737f82fb95b7f640b867eb1e56534ba102705
photo               50852c0fd6f1b759df4ced6348670fe5c69225490608b7232b21c3082fe62095
typefully-external  2d98ef178fe0b517d2535217cf82aa5b5c923a7ab30b4fc6c26f2688113365f8

The checked-in public-safe fixture now freezes the actual graph and no longer contains the synthetic/final-revalidation markers. It asserts:

one encrypted exact-name topic, no subscription/topic policy;
three exact retained 30-day custom log groups;
the same 17 alarm identities and suffixes;
exactly the three heartbeat alarms use TreatMissingData: breaching, while the other 14 use notBreaching;
exactly these three generated rule/permission pairs:
- ConversationalExecutionWorkerFunctionExecutionHealthPulse / ...Permission;
- ConversationalExecutionWorkerFunctionExecutionRecovery / ...Permission;
- ConversationalResultDispatcherFunctionResultDelivery / ...Permission;
exact conditions, states, rates, targets, fixed worker inputs, permission source ARNs, and absence of result-delivery input;
no subscription/topic policy/dashboard/composite/log filter family.

Structural tests prove the generated rules have no explicit names and fit Gate A's stack-prefixed EventBridge rule boundary. Worker permissions fit Gate A's exact execution-worker Lambda family; result-delivery permission fits the existing exact dispatcher family. Both contain the required AddPermission/RemovePermission deployment APIs. No Gate A or observability action was broadened.

Verification

Every command exited 0:

focused observability/security suite
16 passed, 55 subtests passed

uv run --with pytest python -m pytest sandbox/dataops/tests -q
50 passed, 105 subtests passed

sam validate --lint --template-file sandbox/dataops/template.github-actions.yaml
valid SAM template

uv run python -m compileall -q sandbox/dataops/tests/test_template_github_actions.py
clean

git diff 2a1b95f4fd0f4d8d0d24e6edf4a337281c2aea79 --check
clean

git diff --check
clean

Fresh graph comparison additionally reported:

fixture_inventory_match=true
fresh_transform_edge_match=true
alarm_count=17
schedule_rule_count=3
schedule_permission_count=3

Resolved policy sizes and preservation hashes:

aggregate inline:       9,341
Sponsor compute:        3,706  sha256 3aaec33e0624faaafa3a7e6d5381415c80481dea5b7a6f51f1365663ce4b3a61
Sponsor service:          717  sha256 14276c7b72f3dc1b6d81a695d27c77274b4e861869ee0a519114851044bb64fb
dispatcher:              1,512  sha256 991f8670747081dabd407d4fe8e101c1b9c4d7620722274b65b9325bdfefea04
observability:           5,369  sha256 435213eed7933be4ae303aae1b14ef72f09a42a4a6cf2c1f6fa99706455b827f
observability headroom:    775 below IAM 6,144
steady attachments:       4/10
replacement model:        8/10

Final candidate file hashes:

template.github-actions.yaml                 3d6ed1a042970e53439d49d80e23034d1da8d3b42f21c310c1537fbffd30951f
test_template_github_actions.py              bda8e337b0a4c098d7d49a772dca8fa0f1fea2ea4131a651e68b68a0a6526132
issue_128_observability.synthetic.yaml        29df7ff925c13cbf1558e24a7fb0eefad397d6da8fc41adbca3f4a6af2e226da
correction diff above bbb0841                 aa2e04121100ec575ecabaf4cd90038c4ffaa52dc1ebf9650a6a0c540c29cb25
full candidate diff above accepted 2a1b95f   008169ebf688bdbd66fae6055e820380bff8faa36fac7776090d0c033074b69c

No commit, push, merge, issue-body/label edit, AWS call, CloudFormation apply, policy attachment, application deploy, subscription, alarm, or runtime/provider action was performed.

READY FOR ARCHITECT AND INDEPENDENT IAM/SECURITY TESTER REVIEW.

ARCHITECT PASS — corrected IAM and final #128 graph

I independently re-reviewed the corrected, uncommitted #131 candidate in /home/alexey/git/.worktrees/aws-infra-131, based on parked commit bbb0841653603ee0830747fbb0df43979df0a0eb above accepted base 2a1b95f4fd0f4d8d0d24e6edf4a337281c2aea79, against the authoritative repaired #128 replacement handoff.

Architecture passes. #131 is authorized to proceed to independent IAM/security Tester and PM review. This is not authorization to commit, merge, push, or perform a credentialed Gate B apply.

Exact corrected IAM boundary

cloudwatch:PutMetricAlarm remains limited to the exact 17 frozen alarm ARNs and requires a present cloudwatch:AlarmActions set whose every member is the one exact rollout topic ARN.
cloudwatch:DeleteAlarms, cloudwatch:DescribeAlarms, and the required cloudwatch:TagResource use exactly those same 17 alarm ARNs. Alarm tagging has no inapplicable alarm-action or AWS-prefixed tag-key condition.
SNS lifecycle remains exactly CreateTopic, DeleteTopic, GetTopicAttributes, and SetTopicAttributes on the one exact rollout topic ARN.
A separate exact-topic sns:TagResource statement requires non-null aws:TagKeys and uses ForAllValues:StringEquals over only:
- aws:cloudformation:logical-id
- aws:cloudformation:stack-id
- aws:cloudformation:stack-name
No optional SNS list/read, publish, subscription, policy, endpoint, untag, or KMS action was added.
No CloudWatch list, untag, metric data plane, alarm-state forcing, composite, dashboard, anomaly, stream, or canary action was added.
No EventBridge or Lambda action was added to the observability policy. The pre-existing Gate A policies cover the exact transformed schedule edges.
Log-group permissions remain the exact three base/:* pairs with only CreateLogGroup and PutRetentionPolicy; logs:DescribeLogGroups remains the sole wildcard-resource action.
The generated managed policy remains attached only to GitHubActionsDeployRole, with no fixed name or policy self-administration.

The resolved observability policy is 5,369 characters, below the regroomed 5,632 ceiling and IAM's 6,144 limit, leaving 775 characters of IAM headroom. Steady-state attachments remain 4/10; the simultaneous replacement model remains 8/10.

Exact final fixture/graph match

The fixture no longer carries the synthetic/final-revalidation markers. It matches the repaired #128 inventory and freezes:

one encrypted exact-name SNS topic, no subscription or topic policy;
three exact retained 30-day custom log groups;
the same 17 alarm identities and suffixes;
exactly three heartbeat alarms with TreatMissingData: breaching and 14 alarms with notBreaching;
exactly three generated schedule rule/permission pairs:
- ConversationalExecutionWorkerFunctionExecutionHealthPulse / ...Permission;
- ConversationalExecutionWorkerFunctionExecutionRecovery / ...Permission;
- ConversationalResultDispatcherFunctionResultDelivery / ...Permission;
exact rates, conditions, Fn::If states, functions, targets, worker action inputs, permission source ARNs, and absent dispatcher input;
no explicit rule names, allowing the existing stack-prefixed Gate A EventBridge ARN boundary to apply;
no prohibited observability resource family.

I independently regenerated the six #128 transforms twice. They were deterministic, each contained 88 resources, and matched the fixture hashes exactly:

dark                92fb5407e18d0a679b36a93bebe872236c5d7d4286801eb41bc62da7fad72bdc
execution           321949b057d3967322ff3df4a42309bced894caba06f6ee2fa7accaf4463aab9
ingress             8d9851f3a6f6adcd549a7d5476f62d6d97633190b398eaaf1054004b4f165181
voice               97d55161b98c25059952336ef06737f82fb95b7f640b867eb1e56534ba102705
photo               50852c0fd6f1b759df4ced6348670fe5c69225490608b7232b21c3082fe62095
typefully-external  2d98ef178fe0b517d2535217cf82aa5b5c923a7ab30b4fc6c26f2688113365f8

Frozen #128 graph anchors:

base           f08cfc750cebc601db8b71024168741f8ef4aadb
tracked diff   3ff4b16a4a7742f90015c71fdba1257697421314de0cc300b1fab7c2dab098f6
source SAM     fb272bbddbde1a41cb2b5ae92cf0923baa03815a517df143119731fee2ef8ee5
built SAM      f5d053beb24013a5ef8daf01ff6522e3bf1ed673e616ac3dbdcf07609f3be7aa
inventory      a8a9203638d27297f4c5a1f36b983e3731099f419bb0c8bdefaf19b8c64b1a4c

The inventory's framed-content untracked digest is dc50ff5129307087debb9470455cdf6c55d1fd59ab375a77b04f7f57b08178ac; the independently requested canonical aggregate of the seven sorted per-file digests is 792c024c2d0189f0c70cbbb6fa7b59fe101a2a3932b4ad991ac3cb5a0afedcff. Both reproduce from the same seven files; there is no candidate-content mismatch.

Corrected #131 fingerprints:

correction diff above bbb0841  aa2e04121100ec575ecabaf4cd90038c4ffaa52dc1ebf9650a6a0c540c29cb25
full diff above 2a1b95f       008169ebf688bdbd66fae6055e820380bff8faa36fac7776090d0c033074b69c
observability policy           435213eed7933be4ae303aae1b14ef72f09a42a4a6cf2c1f6fa99706455b827f
template                       3d6ed1a042970e53439d49d80e23034d1da8d3b42f21c310c1537fbffd30951f
tests                          bda8e337b0a4c098d7d49a772dca8fa0f1fea2ea4131a651e68b68a0a6526132
fixture                        29df7ff925c13cbf1558e24a7fb0eefad397d6da8fc41adbca3f4a6af2e226da

Independent verification

uv run --with pytest python -m pytest sandbox/dataops/tests -q
50 passed, 105 subtests passed

sam validate --lint --template-file sandbox/dataops/template.github-actions.yaml
valid SAM template

git diff 2a1b95f4fd0f4d8d0d24e6edf4a337281c2aea79 --check
clean

git diff --check
clean

Structural mutation coverage rejects missing, misplaced, conditioned, broadened, or additional tagging; weakened/missing SNS tag-key enforcement; missing/extra/broad alarm or topic resources; optional reads and data-plane actions; EventBridge/Lambda leakage; policy placement/name drift; and regressions to the accepted Gate A, dispatcher, #124, #129, and #130 boundaries.

Verdict: ARCHITECT PASS. READY FOR INDEPENDENT IAM/SECURITY TESTER REVIEW, but not yet for merge or apply. Source integration, PM acceptance, credentialed Gate B apply, effective-permission inspection, and terminal stack verification remain separate mandatory gates.

I did not edit repository files, the issue body, or labels; did not commit, push, merge, deploy, attach a policy, or apply CloudFormation; and made no AWS/runtime/provider mutation. The only external effect in this step is this requested review comment.

TEST PASS — independent IAM/security review

The corrected automated #131 candidate passes independent IAM/security testing. This PASS authorizes Product Manager review only; it does not authorize commit, merge, push, AWS apply, #128 deployment, or issue closure.

Exact candidate and scope

Repository/worktree: DataTalksClub/aws-infra, /home/alexey/git/.worktrees/aws-infra-131
Accepted base/local main/origin/main: 2a1b95f4fd0f4d8d0d24e6edf4a337281c2aea79
Parked HEAD: bbb0841653603ee0830747fbb0df43979df0a0eb
Correction diff above bbb0841: aa2e04121100ec575ecabaf4cd90038c4ffaa52dc1ebf9650a6a0c540c29cb25
Full candidate diff above 2a1b95f: 008169ebf688bdbd66fae6055e820380bff8faa36fac7776090d0c033074b69c

Exactly three authorized tracked paths are dirty and there are no untracked additions:

sandbox/dataops/template.github-actions.yaml — SHA-256 3d6ed1a042970e53439d49d80e23034d1da8d3b42f21c310c1537fbffd30951f
sandbox/dataops/tests/test_template_github_actions.py — SHA-256 bda8e337b0a4c098d7d49a772dca8fa0f1fea2ea4131a651e68b68a0a6526132
sandbox/dataops/tests/fixtures/issue_128_observability.synthetic.yaml — SHA-256 29df7ff925c13cbf1558e24a7fb0eefad397d6da8fc41adbca3f4a6af2e226da

Executed verification

Every command exited 0:

Focused ConversationalRolloutObservabilityDeployPolicyTest: 16 passed, 55 subtests passed.
Full sandbox/dataops/tests: 50 passed, 105 subtests passed.
sam validate --lint --template-file sandbox/dataops/template.github-actions.yaml: valid SAM template, with metadata and credential files disabled.
Read-only Python compile of the focused test module: passed.
git diff --check, base-range diff check, and correction-range diff check: passed.
Exact changed-path, untracked-file, fixture-finalization, credential-shape, public/private boundary, and prohibited-family declaration scans: passed.

Exact IAM boundary

The generated-name ConversationalRolloutObservabilityDeployPolicy retains the same logical resource ID as bbb0841, has no ManagedPolicyName, and attaches only to GitHubActionsDeployRole. The correction is an in-place policy-document update, not a new role, attachment target, service role, or policy-administration surface.

The resolved observability document contains only:

cloudwatch:PutMetricAlarm on exactly the frozen 17 alarm ARNs, conditioned by:
- Null: { cloudwatch:AlarmActions: "false" }; and
- ForAllValues:ArnEquals requiring every alarm action to equal the one exact ${FullDocsStackName}-conversational-rollout-alarms topic ARN.
cloudwatch:DeleteAlarms, cloudwatch:DescribeAlarms, and cloudwatch:TagResource on exactly those same 17 alarm ARNs, with no condition on the separate tag call.
SNS lifecycle exactly CreateTopic, DeleteTopic, GetTopicAttributes, and SetTopicAttributes on the one exact rollout topic ARN.
A separate exact-topic sns:TagResource statement with:
- Null: { aws:TagKeys: "false" }; and
- ForAllValues:StringEquals allowing only aws:cloudformation:logical-id, aws:cloudformation:stack-id, and aws:cloudformation:stack-name.
logs:CreateLogGroup and logs:PutRetentionPolicy on only the base and :* ARNs of the backend, execution, and result-dispatcher custom log groups.
logs:DescribeLogGroups alone on Resource: "*", the only wildcard resource statement.

The complete observability action set is therefore exactly:

cloudwatch:DeleteAlarms
cloudwatch:DescribeAlarms
cloudwatch:PutMetricAlarm
cloudwatch:TagResource
logs:CreateLogGroup
logs:DescribeLogGroups
logs:PutRetentionPolicy
sns:CreateTopic
sns:DeleteTopic
sns:GetTopicAttributes
sns:SetTopicAttributes
sns:TagResource

No optional SNS list/read, publish, subscription, confirmation, topic-policy, endpoint, untag, or KMS capability exists. No CloudWatch list, untag, metric data plane, alarm-state forcing, dashboard/composite/anomaly/canary capability exists. No log deletion, stream/event data plane, query/export/filter/subscription/policy/KMS/delivery capability exists. No EventBridge, Lambda, IAM self-administration, broad resource, or extra wildcard was added to this policy.

Direct parsed comparison proves the accepted GitHubActionsDeployRole, Sponsor compute policy, Sponsor service policy, and conversational dispatcher policy are byte-equivalent to base 2a1b95f; #124/#129/#130 remain preserved.

Resolved sizes, hashes, and attachment quota

Aggregate inline: 9,341 characters.
Sponsor compute: 3,706, SHA-256 3aaec33e0624faaafa3a7e6d5381415c80481dea5b7a6f51f1365663ce4b3a61.
Sponsor service: 717, SHA-256 14276c7b72f3dc1b6d81a695d27c77274b4e861869ee0a519114851044bb64fb.
Dispatcher: 1,512, SHA-256 991f8670747081dabd407d4fe8e101c1b9c4d7620722274b65b9325bdfefea04.
Observability: 5,369, SHA-256 435213eed7933be4ae303aae1b14ef72f09a42a4a6cf2c1f6fa99706455b827f.
Observability headroom: 263 below the issue ceiling of 5,632 and 775 below IAM limit 6,144.
Attachments: 4/10 steady state and 8/10 simultaneous replacement model.

Structural mutation evidence

The shipped focused/full suites retain the complete prior mutation corpus. In addition, I ran 19 independent in-memory security mutations; 19/19 were rejected:

broad or extra alarm resource;
missing non-null alarm-action guard;
additional alarm action;
missing or conditioned CloudWatch tagging;
optional SNS read;
missing SNS non-null guard;
extra customer tag key;
broad SNS tag resource;
CloudWatch untag;
SNS publish;
log deletion;
extra wildcard action;
EventBridge or Lambda leakage;
fixed managed-policy name;
other-role attachment; and
existing-policy drift.

Fresh #128 graph proof

I regenerated all six transforms from the current frozen #128 source into an automatically removed external scratch directory rather than self-comparing the checked-in fixture. The fresh inventory was byte-identical to the authoritative inventory:

source SAM: fb272bbddbde1a41cb2b5ae92cf0923baa03815a517df143119731fee2ef8ee5
built SAM: f5d053beb24013a5ef8daf01ff6522e3bf1ed673e616ac3dbdcf07609f3be7aa
inventory: a8a9203638d27297f4c5a1f36b983e3731099f419bb0c8bdefaf19b8c64b1a4c

Fresh transform hashes, each with exactly 88 resources:

dark                92fb5407e18d0a679b36a93bebe872236c5d7d4286801eb41bc62da7fad72bdc
execution           321949b057d3967322ff3df4a42309bced894caba06f6ee2fa7accaf4463aab9
ingress             8d9851f3a6f6adcd549a7d5476f62d6d97633190b398eaaf1054004b4f165181
voice               97d55161b98c25059952336ef06737f82fb95b7f640b867eb1e56534ba102705
photo               50852c0fd6f1b759df4ced6348670fe5c69225490608b7232b21c3082fe62095
typefully-external  2d98ef178fe0b517d2535217cf82aa5b5c923a7ab30b4fc6c26f2688113365f8

Direct normalized source/built comparison matches the topic, three retained 30-day log groups, 17 alarms, schedule inputs, and topic output. The alarm suffix set is exact; exactly three heartbeat alarms are breaching and the other 14 are notBreaching.

The transformed graph contains exactly these rule/permission pairs:

ConversationalExecutionWorkerFunctionExecutionHealthPulse / ...Permission;
ConversationalExecutionWorkerFunctionExecutionRecovery / ...Permission;
ConversationalResultDispatcherFunctionResultDelivery / ...Permission.

A separate fresh dark transform directly proves all three rules have no explicit Name. Their exact conditions, Fn::If enabled/disabled states, rates, targets, fixed worker inputs, dispatcher no-input behavior, permission principals, functions, and source ARNs match the fixture. Existing Gate A stack-prefixed EventBridge lifecycle/tagging and exact worker/dispatcher lambda:AddPermission/RemovePermission families cover these generated edges. The observability policy contains no EventBridge or Lambda action.

The fixture contains no conditional-finalization marker, private sentinel, credential-shaped value, or prohibited resource declaration. No private #78 material or private repository was read.

Remaining mandatory HUMAN gates

This issue must remain open and must not be marked done after automated Tester/PM acceptance. After accepted source integration, preserve the required human tracking state until a credentialed operator completes all of the following:

Review live managed-policy attachments and the CloudFormation change set.
Apply dataops-github-actions with CAPABILITY_NAMED_IAM.
Observe terminal stack success or record an explained CloudFormation rollback.
Inspect the effective deployed policy and confirm it contains only the accepted permissions.
Only then allow Roll out and cut over the Telegram conversational MVP #128 dark deployment to create the exact graph and verify there is no authorization denial, unexpected paging, or leakage.
Use CloudFormation and the prior accepted template for rollback; do not perform manual IAM editing or destructive resource cleanup.

#128 separately owns subscription confirmation and alarm canaries.

I did not edit repository files, the issue body, or labels; did not commit, push, merge, deploy, dispatch, attach a policy, call AWS or a provider, or apply CloudFormation. The only external effect is this requested review comment.

TEST PASS — Tester authorizes Product Manager review. Keep #131 open for the HUMAN gates above.

PM final acceptance — ACCEPTED locally; HUMAN apply remains open

I accept the corrected #131 candidate after the independent SWE, Architect, and Tester chain and direct PM verification against the exact parked bytes. This is the infrastructure prerequisite for #128: #128

Reviewed handoffs:

SWE: Allow OIDC deployment of Telegram rollout alarms and notifications #131 (comment)
Architect PASS: Allow OIDC deployment of Telegram rollout alarms and notifications #131 (comment)
Tester PASS: Allow OIDC deployment of Telegram rollout alarms and notifications #131 (comment)

Exact accepted fingerprint

worktree: /home/alexey/git/.worktrees/aws-infra-131
parked HEAD: bbb0841653603ee0830747fbb0df43979df0a0eb
accepted base: 2a1b95f4fd0f4d8d0d24e6edf4a337281c2aea79
state: exactly three modified tracked paths and no untracked paths
correction diff above parked HEAD: aa2e04121100ec575ecabaf4cd90038c4ffaa52dc1ebf9650a6a0c540c29cb25
full diff above accepted base: 008169ebf688bdbd66fae6055e820380bff8faa36fac7776090d0c033074b69c
template: 3d6ed1a042970e53439d49d80e23034d1da8d3b42f21c310c1537fbffd30951f
focused tests: bda8e337b0a4c098d7d49a772dca8fa0f1fea2ea4131a651e68b68a0a6526132
corrected public-safe fixture: 29df7ff925c13cbf1558e24a7fb0eefad397d6da8fc41adbca3f4a6af2e226da

The only candidate paths are the deploy-role template, its focused tests, and the corrected fixture required by the issue.

Product/operator acceptance evidence

One generated-name ConversationalRolloutObservabilityDeployPolicy attaches only to GitHubActionsDeployRole; no service role or policy self-administration is introduced.
cloudwatch:PutMetricAlarm is restricted to the exact 17 alarm ARNs and requires the exact rollout-topic alarm action. Describe/delete/tag access is restricted to the same 17 ARNs. CloudWatch tagging has no unreliable aws: system-tag authorization condition.
SNS lifecycle is restricted to the exact topic. The separate exact-topic sns:TagResource permission rejects a missing key set and accepts only aws:cloudformation:logical-id, aws:cloudformation:stack-id, and aws:cloudformation:stack-name.
The action set remains exactly the accepted CloudWatch, SNS, and Logs lifecycle set. There is no optional SNS read, publish/subscription, untag, data plane, IAM, KMS, EventBridge, or Lambda expansion.
Logs remain limited to the base and :* forms of the three custom groups; only logs:DescribeLogGroups uses Resource: "*".
Corrected compact policy size is 5,369 characters: 263 below the issue ceiling of 5,632 and 775 below IAM's 6,144-character limit. Attachments remain 4/10 steady-state and 8/10 during replacement.
The fixture matches the final Roll out and cut over the Telegram conversational MVP #128 graph: 17 exact alarms, exactly three heartbeat alarms with missing-as-breaching, 14 with not-breaching, and the three exact schedule rule/Lambda-permission pairs. Existing Gate A permissions cover the new worker schedule graph; Allow OIDC deployment of Telegram rollout alarms and notifications #131 adds no EventBridge/Lambda actions.
Direct PM rerun: 50 passed, 105 subtests passed; strict SAM lint passed; diff checks passed. The source/build/inventory and all six transformed-state hashes match the accepted Roll out and cut over the Telegram conversational MVP #128 review chain.

Shipping and HUMAN apply instruction

This acceptance authorizes source integration, not an AWS apply:

Commit the exact accepted candidate with the cross-repository footer Refs DataTalksClub/dataops#131 (Refs #131 in this issue's shorthand).
Retain/add human, leave Allow OIDC deployment of Telegram rollout alarms and notifications #131 open, integrate into aws-infra/main, and push.
Do not treat that push as an AWS apply. aws-infra does not deploy itself through CI/CD.
A credentialed HUMAN must inspect the CloudFormation change set/live attachment state and confirm the expected generated managed-policy creation/attachment and exact accepted document, with no unexpected role, policy, action, resource, or condition change.
Apply dataops-github-actions with CAPABILITY_NAMED_IAM and observe terminal success or an explained CloudFormation rollback.
Inspect the effective deployed role/policy after the stack operation. Only effective Gate A plus corrected Gate B release Roll out and cut over the Telegram conversational MVP #128 for commit/push and dark deployment.

Rollback is through CloudFormation and the prior accepted template, never manual IAM edits or destructive resource cleanup.

Checklist normalization

I normalized the issue body to the verified state: the first 13 criteria are checked. The final [HUMAN] apply/dark-deployment criterion remains unchecked. No non-checkbox issue-body content, candidate files, labels, commits, branches, AWS state, application deployment, or provider state was changed by PM review.

ON-CALL — expected no-run; credentialed HUMAN apply required

Verified the DataTalksClub/aws-infra main push for #131.

Exact pushed and accepted source

origin/main: ddbaf2893bf2985d32e5a33310fe57e2f4ac9452
parent: bbb0841653603ee0830747fbb0df43979df0a0eb
accepted base: 2a1b95f4fd0f4d8d0d24e6edf4a337281c2aea79
correction diff above bbb0841: aa2e04121100ec575ecabaf4cd90038c4ffaa52dc1ebf9650a6a0c540c29cb25
full diff above 2a1b95f: 008169ebf688bdbd66fae6055e820380bff8faa36fac7776090d0c033074b69c
deploy-role template: 3d6ed1a042970e53439d49d80e23034d1da8d3b42f21c310c1537fbffd30951f
focused tests: bda8e337b0a4c098d7d49a772dca8fa0f1fea2ea4131a651e68b68a0a6526132
corrected public-safe fixture: 29df7ff925c13cbf1558e24a7fb0eefad397d6da8fc41adbca3f4a6af2e226da
resolved observability-policy document: 435213eed7933be4ae303aae1b14ef72f09a42a4a6cf2c1f6fa99706455b827f, 5,369 compact characters

These fingerprints exactly match the accepted SWE, Architect, Tester, and PM review chain.

GitHub Actions / deployment status

Terminal classification: EXPECTED NO-RUN.

exact-commit workflow runs: 0
check runs: 0
commit statuses: 0
the repository has one active workflow, Deploy shared authentication;
its push filter covers only .github/workflows/deploy-shared-auth.yml and sandbox/auth/**;
this commit changes only the three accepted sandbox/dataops/** paths.

Therefore this source push scheduled no CI/CD job and performed no automatic CloudFormation apply, IAM mutation, or DataOps application deployment. aws-infra does not automatically deploy this stack.

The accepted source was integrated through a clean isolated worktree. The primary aws-infra checkout still contains unrelated dirty user changes and was not touched, cleaned, reset, staged, committed, or pushed.

Credentialed operator gate

Keep #131 open with human. A credentialed operator must:

Inspect the current dataops-github-actions stack and live managed-policy attachments in eu-west-1.
From a clean checkout at exact commit ddbaf2893bf2985d32e5a33310fe57e2f4ac9452, create an UPDATE change set from sandbox/dataops/template.github-actions.yaml with CAPABILITY_NAMED_IAM.
Confirm the change set contains only addition of logical resource ConversationalRolloutObservabilityDeployPolicy (AWS::IAM::ManagedPolicy) and its attachment exclusively to GitHubActionsDeployRole. There must be no unexpected role/policy/resource change, replacement, attachment, action, resource, or condition drift. Stop rather than execute if the live baseline or change set differs.
Execute the reviewed change set and observe terminal UPDATE_COMPLETE, or record an explained CloudFormation rollback with the failing events. Rollback must use CloudFormation and the prior accepted template, never manual IAM edits or destructive resource cleanup.
Resolve the deployed managed-policy ARN from the stack, confirm it is attached only to the configured deploy role, fetch its default version, and compare the effective document to the accepted policy.

The effective policy must contain exactly:

cloudwatch:DeleteAlarms
cloudwatch:DescribeAlarms
cloudwatch:PutMetricAlarm
cloudwatch:TagResource
logs:CreateLogGroup
logs:DescribeLogGroups
logs:PutRetentionPolicy
sns:CreateTopic
sns:DeleteTopic
sns:GetTopicAttributes
sns:SetTopicAttributes
sns:TagResource

It must retain:

PutMetricAlarm on exactly the 17 accepted alarm ARNs with a non-null cloudwatch:AlarmActions set whose every value is the one exact rollout-topic ARN;
describe/delete/tag on only those same 17 alarm ARNs, with no tag condition;
SNS lifecycle on only the exact rollout topic;
a separate exact-topic sns:TagResource statement requiring a non-null aws:TagKeys set limited to the three CloudFormation system keys;
create/retention access on only the six exact base/:* custom-log-group ARN forms;
logs:DescribeLogGroups as the sole Resource: "*" action;
no EventBridge, Lambda, IAM self-administration, optional SNS reads, publish/subscription, untag, data-plane, KMS, broader resource, or additional wildcard capability.

Only terminal stack success plus effective Gate A and corrected Gate B verification releases the #128 commit/push hold. DataOps origin/main remains the accepted #128 base f08cfc750cebc601db8b71024168741f8ef4aadb at this check; recheck it immediately before shipping #128. Use the normal DataOps CI/CD path for the all-off dark deployment and leave #131 open until the remaining HUMAN dark-deployment evidence is complete.

I did not trigger or rerun a workflow, call AWS, inspect credentials, apply CloudFormation, deploy the application, edit the issue body or labels, edit files, commit, push, or touch the unrelated dirty primary checkout. The only external effect of this on-call step is this requested status comment.

ON-CALL DONE: EXPECTED NO-RUN; WAITING FOR CREDENTIALED HUMAN APPLY

CREDENTIALED OPERATOR — Gate A + Gate B effective; #128 hold released

Completed the accepted sequential CloudFormation operator plan for stack dataops-github-actions in eu-west-1.

Exact accepted source

Gate A (Add transactional approval and durable execution recovery #124 + Repair DataOps OIDC SES configuration-set tag-on-create permission #129 + Repair dispatcher generated-role IAM prefix for CloudFormation rollback #130): 2a1b95f4fd0f4d8d0d24e6edf4a337281c2aea79
Gate B (Allow OIDC deployment of Telegram rollout alarms and notifications #131 correction): ddbaf2893bf2985d32e5a33310fe57e2f4ac9452
Gate B template: 3d6ed1a042970e53439d49d80e23034d1da8d3b42f21c310c1537fbffd30951f
Gate B focused tests: bda8e337b0a4c098d7d49a772dca8fa0f1fea2ea4131a651e68b68a0a6526132
corrected public-safe fixture: 29df7ff925c13cbf1558e24a7fb0eefad397d6da8fc41adbca3f4a6af2e226da

Before each operation, the exact clean source, accepted hashes, focused suites, strict SAM lint, and CloudFormation change-set inventory were revalidated. Gate A passed 34 tests plus 50 mutation subtests. Gate B passed 50 tests plus 105 mutation subtests.

Sequential CloudFormation result

Gate A was applied first from its independently reviewed change set. It reached terminal UPDATE_COMPLETE and created exactly:

SponsorCommunicationsComputeDeployPolicy
SponsorCommunicationsServiceDeployPolicy
ConversationalResultDispatcherDeployPolicy

It also updated GitHubActionsDeployRole in place only at Properties.Policies; there was no role replacement or trust/name/session change.

A fresh Gate B change set was then created against that effective baseline. Its authoritative inventory contained exactly one addition:

ConversationalRolloutObservabilityDeployPolicy (AWS::IAM::ManagedPolicy), generated name, attached only to GitHubActionsDeployRole

There was no role modification, other addition, deletion, replacement, or attachment change. Gate B execution reached terminal UPDATE_COMPLETE; the observability policy was the only resource created in that update. No rollback or failure event occurred.

Effective IAM evidence

The stack now owns exactly the deploy role plus the four accepted managed-policy resources. The role has:

exactly one inline policy, dataops-v1-deploy;
exactly four managed-policy attachments out of the standard ten slots;
no unexpected external attachment or permissions boundary;
unchanged name, 3,600-second session duration, and OIDC trust restricted to DataTalksClub/dataops main with audience sts.amazonaws.com.

Every managed policy has one default version and is attached only to the deploy role, with no user or group attachment. Independent live-document comparison matched the accepted resolved source exactly:

trust              386  a4fb561e9b54a2418b750fdc84e0c7ddd7856305fd791d615d40aa85174e68bf
inline            9341  285dc9a4fa4cdc2503e46b9cdc5048c041df316cb757b6264f4863dd11433f0f
Sponsor compute   3706  3aaec33e0624faaafa3a7e6d5381415c80481dea5b7a6f51f1365663ce4b3a61
Sponsor service    717  14276c7b72f3dc1b6d81a695d27c77274b4e861869ee0a519114851044bb64fb
dispatcher        1512  991f8670747081dabd407d4fe8e101c1b9c4d7620722274b65b9325bdfefea04
observability     5369  435213eed7933be4ae303aae1b14ef72f09a42a4a6cf2c1f6fa99706455b827f

The effective observability boundary is exactly the accepted one:

cloudwatch:PutMetricAlarm on the 17 exact alarm resources, requiring a non-null alarm-action set whose every value is the exact rollout topic;
describe/delete/tag on the same 17 exact alarms, with no tag condition;
SNS create/delete/get/set lifecycle on the one exact topic;
separate topic tagging requiring non-null aws:TagKeys limited to the three CloudFormation system keys;
create/retention access on the six exact base/:* custom log-group resources;
logs:DescribeLogGroups as the sole wildcard-resource action;
no EventBridge, Lambda, IAM self-administration, optional SNS read, publish/subscription, untag, data-plane, KMS, broader resource, or extra wildcard capability.

Drift and release decision

Post-Gate-B drift detection completed successfully:

stack status: UPDATE_COMPLETE
stack drift: IN_SYNC
drifted resource count: 0
deploy role and all four managed policies: individually IN_SYNC

Gate A and Gate B are now effective and exact. This releases #128 from the IAM prerequisite hold for its normal commit/push and all-off dark deployment through DataOps CI/CD.

No manual IAM edit, manual DataOps application deployment, provider call, subscription action, alarm canary, or runtime mutation was performed. Keep #131 open until #128's remaining default-off dark-deployment On-Call evidence confirms the exact graph, no authorization denial, no unexpected paging, and no leakage.

CREDENTIALED OPERATOR PASS — GATE A+B EFFECTIVE; #128 HOLD RELEASED

ON-CALL CROSS-CHECK — #131 NOT YET LIVE-VERIFIED

Exact-SHA workflow 79ed0adb3c9f020a435f9604879be2331b6968fd passed checks but rolled back during normal CI deployment because of the unrelated #129 ses:TagResource denial on the Sponsor SES configuration set:

https://github.com/DataTalksClub/dataops/actions/runs/30591398299

The rollout SNS topic began creation and was cancelled/deleted during rollback. No SNS, CloudWatch, or custom-log-group IAM denial was observed, but the stack never reached a state where #131's full dark observability graph/no-paging assertions could be verified. The restored stack has no six-control #128 parameter set.

Keep #131 open with human. Gate B's live app-deployment criterion remains unchecked until #129 is corrected/applied and a later normal CI deployment reaches terminal success. No manual deployment, alarm/subscription change, or AWS mutation was performed by On-Call.

ON-CALL ATTEMPT 2 — GATE B NOT YET LIVE-ACCEPTED

Workflow attempt 2
passed all checks and reached AWS, but failed before the #128 observability
graph could remain deployed. The rollout topic was created and then deleted
during rollback; no rollout alarms or schedules are live, and the restored
stack is the prior 38-resource graph.

The initiating failures were the #130 dispatcher generated-role name
truncation and an all-at-once Sponsor CRM multi-GSI update. There was no
CloudWatch/SNS/log IAM denial, but this run does not satisfy #131's default-off
deployment/On-Call criterion. Keep #131 open with human.

Canonical evidence and retained-queue reconciliation:
#128 (comment)

PM STATUS RECONCILIATION — corrected Gate B effective; live alarm graph pending

The originally blocked bbb0841 candidate was superseded. The corrected source/final graph passed Architecture, independent IAM/security testing, and PM acceptance.
Corrected Gate B source ddbaf2893bf2985d32e5a33310fe57e2f4ac9452 was integrated, applied, and verified effective and IN_SYNC by the credentialed operator. The source-correction/apply portion of the HUMAN criterion is complete.
Normal-CI attempt 2 had no CloudWatch/SNS/log IAM denial, but rollback removed the rollout topic before the observability graph could remain live. No rollout alarms or schedules were production-accepted.
The remaining dark-deployment verification is currently blocked by Migrate Sponsor CRM GSIs in a protected stage-only workflow #136 → Reconcile missing CloudFormation ownership provenance for Sponsor CRM table #140 → Close out the retained CloudTrail audit session record #141.

PM decision: keep #131 open with human. Closure requires one normal-CI
all-off deployment that leaves the exact 17-alarm/topic/health-schedule graph
live and On-Call confirmation of no authorization denial, unexpected page, or
information leakage. It must not be replaced by a manual app deployment or a
claim based only on effective IAM.

No code, AWS, IAM, workflow, environment, flag, paging, or provider action was
performed during this reconciliation.

PM tracker reconciliation — effective Gate B separated from live graph acceptance

Preserved the corrected/effective Gate B and prior review evidence. Replaced the stale #141 dependency with #140 lifecycle acceptance plus #143 ownership remediation, recorded On-Call and the terminal-success 17-alarm graph resume signal, and removed the premature human label while live agent verification remains. No AWS or criterion change occurred.

PM final acceptance — default-off normal-CI gate satisfied

The final #131 criterion is complete. The previously blocked rollout was superseded by normal push run 31545689094 at 5ac8b39c39e358cdec41b192bad984b8a46a2daa:

the check job passed;
normal OIDC deployment used all conversational rollout controls as false, including ConversationalAlarmSubscriptionConfirmed=false;
the CloudFormation change set added the rollout SNS topic, the three retained custom log groups, and the three generated health/recovery schedule rules; their create operations completed and the stack reached UPDATE_COMPLETE;
the deploy job then seeded runtime data and passed deployed single-origin smoke;
no CloudWatch, SNS, Logs, EventBridge, or Lambda authorization denial occurred.

The old criterion text conflated the frozen 17-alarm transform graph with its all-off runtime realization. The already accepted transforms contain exactly 17 condition-gated alarm definitions, while dark mode correctly instantiates zero alarm resources. With zero active alarms, a newly created topic, ConversationalAlarmSubscriptionConfirmed=false, and no subscription resource in the accepted template, there was no paging or message-content delivery path. Normal run 31711997388 later reconfirmed the stable default-off OIDC deployment.

The corrected Gate B source, reviewed credentialed apply, effective-policy fingerprint, attachments, and IN_SYNC verification were already accepted. #128 continues to own subscription confirmation, staged rollout, and alarm canaries; those are not #131 closure gates. The unshipped #166 sequence is later application-stack work and does not reopen this completed IAM issue.

PM decision: all #131 acceptance criteria are satisfied; close as completed. Reopen only on recurrence of the bounded observability-deploy authorization failure or inability to realize the accepted conditional graph.

This reconciliation made no repository edit, test run, AWS/IAM call, workflow dispatch, credential/provider change, or data operation.

Allow OIDC deployment of Telegram rollout alarms and notifications #131

Description

Allow OIDC deployment of Telegram rollout alarms and health schedules

Current review state

Historical source boundary

Replacement #128 graph contract

Managed-policy placement and quotas

Exact corrected OIDC permissions

CloudWatch alarm lifecycle and tag-on-create

SNS topic lifecycle and tag-on-create

Retained log groups

Acceptance criteria

Required tests

Sequencing and apply

Out of scope

Activity

alexeygrigorev commented on Jul 30, 2026

alexeygrigorev commented on Jul 30, 2026

Software Engineer handoff — isolated observability deploy policy ready for security review

Isolated branch

Exact managed-policy boundary

Combined automated evidence

Resolved sizes and replacement headroom

#128 graph status — explicit pre-merge blocker

alexeygrigorev commented on Jul 30, 2026

TEST PASS — IAM source under frozen specification only

Source/security verdict

Independent evidence

Mandatory unresolved pre-merge gate

alexeygrigorev commented on Jul 30, 2026

ARCHITECTURE BLOCKED — bbb0841 must not proceed or be applied

alexeygrigorev commented on Jul 30, 2026

PM REGROOMED — IAM/FIXTURE CORRECTION REQUIRED

alexeygrigorev commented on Jul 30, 2026

Software Engineer interim handoff — tagging correction complete; final graph revalidation pending

Implemented IAM boundary

Verification

alexeygrigorev commented on Jul 30, 2026

Software Engineer replacement handoff — corrected IAM and final #128 graph frozen

Corrected exact IAM boundary

Final replacement #128 graph evidence

Verification

alexeygrigorev commented on Jul 30, 2026

ARCHITECT PASS — corrected IAM and final #128 graph

Exact corrected IAM boundary

Exact final fixture/graph match

Independent verification

alexeygrigorev commented on Jul 30, 2026

TEST PASS — independent IAM/security review

Exact candidate and scope

Executed verification

Exact IAM boundary

Resolved sizes, hashes, and attachment quota

Structural mutation evidence

Fresh #128 graph proof

Remaining mandatory HUMAN gates

alexeygrigorev commented on Jul 30, 2026

PM final acceptance — ACCEPTED locally; HUMAN apply remains open

Exact accepted fingerprint

Product/operator acceptance evidence

Shipping and HUMAN apply instruction

Checklist normalization

alexeygrigorev commented on Jul 30, 2026

ON-CALL — expected no-run; credentialed HUMAN apply required

Exact pushed and accepted source

GitHub Actions / deployment status

Credentialed operator gate

alexeygrigorev commented on Jul 30, 2026

CREDENTIALED OPERATOR — Gate A + Gate B effective; #128 hold released

Exact accepted source

Sequential CloudFormation result

Effective IAM evidence

Drift and release decision

alexeygrigorev commented on Jul 30, 2026

ON-CALL CROSS-CHECK — #131 NOT YET LIVE-VERIFIED

alexeygrigorev commented on Jul 31, 2026

ON-CALL ATTEMPT 2 — GATE B NOT YET LIVE-ACCEPTED

alexeygrigorev commented on Jul 31, 2026

PM STATUS RECONCILIATION — corrected Gate B effective; live alarm graph pending

alexeygrigorev commented on Jul 31, 2026

ARCHITECTURE BLOCKED — `bbb0841` must not proceed or be applied