Repository navigation
Reconcile Sponsor CRM table ownership with CloudFormation #143
Description
Reconcile Sponsor CRM sandbox table ownership with CloudFormation
Status: blocked — Phase 0 disposable/test-data classification and total-loss acceptance are complete, and Architecture/Security accepted the same-name REVERT_DRIFT route; #147 guard-deleted the old table and it is absent, but recreation is blocked until #160's shipped source is HUMAN-applied, read back, simulated, PM-accepted, and #160 is closed
Tags: bug, infra, data, migration, testing, P1
Depends on: #147 accepted recreation/verification outcome; #147's next AWS dispatch is currently gated by #160 HUMAN activation and PM closure
Blocks: #136
Next owner: #147 implementation/execution pipeline. Its immediate external prerequisite is the authorized HUMAN operator and PM closure sequence in #160; after #160 closes, #147 resumes its separately approved guarded create → execute → verify phases
Resume condition: PM closes #160 only after the non-replacing dataops-github-actions apply, exact live readback, official custom-policy simulations, and official deploy-role principal-policy simulations are accepted; then #147 may resume under its own unchanged HUMAN and fail-closed gates. #143 closes and stops blocking #136 only after #147 proves and records accepted verification that the same-name prefix-0 table has been recreated with canonical CloudFormation ownership. #160 closure alone is not sufficient.
Current PM decision and boundary
Phase 0 is complete. On 2026-08-11, the authorized user/data owner classified the existing Sponsor CRM sandbox contents as test-only/disposable and explicitly accepted complete loss for that sandbox table. Today the user reaffirmed the same sandbox/test-only disposition.
That statement is a reaffirmation of the already-recorded Phase 0 decision, not new or broader authorization. It applies only to the named Sponsor CRM sandbox table and does not authorize production/private-data reuse, another resource, a new environment, an AWS call, IAM activation, workflow dispatch, change-set creation/execution, deployment, migration, cleanup, or bypass of any #147/#160 HUMAN gate.
The active route is the fresh Architecture/Security-approved same-name reset:
- keep all writers, normal deploys, Migrate Sponsor CRM GSIs in a protected stage-only workflow #136, schedules, event consumption, queue processing, and manual mutations frozen as required by Add a reviewed one-time reset path for the disposable sandbox Sponsor table #147;
- use Add a reviewed one-time reset path for the disposable sandbox Sponsor table #147's guarded one-phase-per-dispatch workflow and immutable private receipt chain;
- create a non-executing drift-aware
UPDATEchange set with the previous template andREVERT_DRIFT; - accept only the reviewed recreation of
DataOpsSponsorCrmTableunder the same physical name and exact effects allowed by Add a reviewed one-time reset path for the disposable sandbox Sponsor table #147's current canonical prefix-0 contract; - separately approve and execute the exact immutable candidate; and
- verify the recreated prefix-0 table's canonical CloudFormation ownership and accepted configuration before Migrate Sponsor CRM GSIs in a protected stage-only workflow #136 may freshly pin the new runtime identity and continue its unchanged 0→1→2→3→4 migration.
Route acceptance evidence:
- HUMAN Phase 0 classification
- Architecture PASS — same-name disposable sandbox reset
- Security PASS — same-name drift-aware design
These decisions selected and designed the route; they did not authorize an AWS mutation by themselves.
Reconciled public-safe state
- Phase 0 classifies the named sandbox data as test-only/disposable and accepts complete loss within that sandbox scope.
- Architecture and Security accepted the proportional same-name
REVERT_DRIFTroute for separate implementation/execution in Add a reviewed one-time reset path for the disposable sandbox Sponsor table #147. - Add a reviewed one-time reset path for the disposable sandbox Sponsor table #147's guarded preflight completed and revalidated the then-existing disposable prefix-0 baseline.
- Add a reviewed one-time reset path for the disposable sandbox Sponsor table #147's guarded delete was issued. The public checkpoint records that the old physical table is absent and that immutable private intent/completion evidence exists. The delete workflow itself concluded failure because the completion receipt was not printed; later source repaired serialization and missing-table recovery. Absence is not reset success.
- Subsequent guarded candidate creation failed closed with the redacted permission category. No candidate was executable and no CloudFormation stack mutation occurred.
- Add reset version listing and isolate drift reads from the inline deploy policy #160's accepted source is shipped on
DataTalksClub/aws-inframainat merge9e1ff4f. It preserves the required drift reads in a dedicated policy and adds only the exact bucket/prefix/region-bounded version-history listing required by Add a reviewed one-time reset path for the disposable sandbox Sponsor table #147. - [HUMAN] A credentialed operator completes Add reset version listing and isolate drift reads from the inline deploy policy #160's fresh non-replacing
CAPABILITY_NAMED_IAMchange-set review and exact apply toUPDATE_COMPLETE. - [HUMAN] Add reset version listing and isolate drift reads from the inline deploy policy #160's exact live policy/trust/attachment/inventory/drift readback passes with no pending executable candidate and no unrelated or replacing delta.
- [HUMAN] Add reset version listing and isolate drift reads from the inline deploy policy #160's official custom-policy and deploy-role principal-policy positive/negative simulations pass.
- PM accepts the sanitized HUMAN activation/readback/simulation evidence and closes Add reset version listing and isolate drift reads from the inline deploy policy #160.
- Only after Add reset version listing and isolate drift reads from the inline deploy policy #160 closes, Add a reviewed one-time reset path for the disposable sandbox Sponsor table #147 resumes guarded create → execute → verify under its own receipt-bound HUMAN approvals, identity checks, frozen-writer boundary, candidate allowlist, abort rules, and On-Call/PM acceptance.
- Add a reviewed one-time reset path for the disposable sandbox Sponsor table #147 proves the recreated table uses the same approved physical name, a new runtime identity, the accepted canonical prefix-0 configuration, exact logical↔physical stack association, canonical CloudFormation ownership evidence, and no unapproved resource/IAM/dependency effect.
- Tester/Architecture/Security/PM/HUMAN/On-Call verification required by Add a reviewed one-time reset path for the disposable sandbox Sponsor table #147 is accepted and durably recorded without private item data or credentials-adjacent details.
- Only then may PM close Reconcile Sponsor CRM table ownership with CloudFormation #143 and remove its block on Migrate Sponsor CRM GSIs in a protected stage-only workflow #136. Migrate Sponsor CRM GSIs in a protected stage-only workflow #136 must freshly pin the recreated identity; no historical TableId may be reused.
Current public evidence:
- #147 guarded ownership-repair checkpoint
- preflight run
- guarded delete run
- latest fail-closed candidate-creation proof
- #160 source shipped; HUMAN activation remains
- #160 On-Call source-integration PASS
No current evidence establishes live #160 IAM convergence, successful REVERT_DRIFT candidate creation/execution, recreated-table ownership, reset completion, or readiness to dispatch #136.
Exact remaining sequence
1. Complete #160 without dispatching #147
The authorized HUMAN operator records the terminal live dataops-github-actions baseline, creates and reviews a fresh non-replacing CAPABILITY_NAMED_IAM change set from exact merged source, executes only the accepted convergence, requires UPDATE_COMPLETE, performs exact readback, and runs both official custom-policy and deploy-role principal-policy simulations. Any replacement, unrelated resource/policy/trust/attachment/parameter/tag delta, wrong fingerprint, broader permission, or failed simulation aborts.
PM reviews the sanitized evidence and closes #160. Source integration alone does not establish live permission and does not authorize a #147 dispatch.
2. Resume #147 as implementation/execution owner
After #160 closes, #147—not #143—owns the remaining reset execution. It must resume from the existing immutable private lineage and absent-table state, rerun its complete preflight, and use separately typed/digest-bound HUMAN authorization for each permitted phase. It must not retry blindly, create a second lineage, widen candidate/runtime allowlists, bypass the usual main-branch OIDC role, weaken the ownership guard, or treat table absence as success.
3. Accept ownership before unblocking #136
#143 may close and stop blocking #136 only when #147's accepted verification proves all of the following:
- the same approved physical table name is present again under
DataOpsSponsorCrmTable; - the recreated resource matches the accepted canonical prefix-0 fixture and has a new runtime identity;
- exact CloudFormation logical↔physical association and canonical system ownership evidence match the current
dataops-v1stack incarnation; - the stack/resource and required dependent state are terminal and healthy under Add a reviewed one-time reset path for the disposable sandbox Sponsor table #147's verified contract;
- no unrelated resource, IAM, tag, parameter, queue, Lambda, schedule, rule, table, or deployment effect occurred; and
- Add a reviewed one-time reset path for the disposable sandbox Sponsor table #147's required verification and acceptance verdicts are recorded.
Only then does #136 resume its own fresh identity pinning and separately gated prefix migration. Neither Phase 0 completion, deletion, #160 source shipping, #160 closure, nor candidate creation by itself unblocks #136.
Historical protected-data route — inactive, retained for fail-closed fallback
Before the accountable sandbox/test-data classification, the issue correctly treated the contents as real/private/unknown and required the protected route. That historical route remains part of the audit record and must not be presented as the current path:
- authenticated minimum-disclosure AWS Support guidance and private diagnostics;
- immutable point-in-time baseline and complete writer reconciliation;
- verified retained recovery source, source-equivalent confidentiality, and private integrity evidence;
- isolated rehearsal;
- one supported retain/detach/import, unique-name restore/rebuild, or authenticated association-repair path;
- short-lived phase-scoped access, private audit/redaction, exact allowed-versus-observed operation inventory, technical freeze, rollback, retention, and separate digest-bound approvals for every mutation and cleanup; and
- fresh Architecture, Security, Tester, PM, HUMAN, and On-Call gates.
Historical evidence is preserved in the original Architecture design PASS, Security's original block, the PM amendment, and the amended Security PASS.
If the sandbox/test-only classification becomes ambiguous, a retained dependency or production/private-data crossing appears, the immutable lineage cannot be proved, or the same-name route exposes an unsafe/unsupported effect, stop #147 and return to fresh PM/Architecture/Security grooming. The historical protected route does not become automatically authorized.
Out of scope and non-authorization
- Claiming that Add reset version listing and isolate drift reads from the inline deploy policy #160 source is live IAM, that the reset succeeded, or that Migrate Sponsor CRM GSIs in a protected stage-only workflow #136 is ready.
- Any new AWS call, CloudFormation apply, workflow dispatch, table recreation, migration, normal app deploy, cleanup, or private evidence inspection under this tracker reconciliation.
- Weakening a HUMAN gate, ownership proof, OIDC trust, candidate allowlist, receipt lineage, writer freeze, or Migrate Sponsor CRM GSIs in a protected stage-only workflow #136 guard.
- Manual reserved
aws:tags, a tagless exception, historical TableId reuse, unique-name/-v2replacement without fresh grooming, or manual app deploy. - Publishing Sponsor items, private object keys/evidence, raw StackId/table/stream/mapping identities, private links/paths, AWS output, or credentials-adjacent material.
This tracker reconciliation changes issue state only. It authorizes no repository edit, commit, push, AWS call, CloudFormation action, role assumption, workflow dispatch, deployment, migration, cleanup, or private-data inspection.
Activity
alexeygrigorev commentedon Jul 31, 2026
PM grooming complete. Route B is now a design-and-approval-first HUMAN/AWS remediation: Support guidance, private baseline evidence, verified recovery, isolated restore/ownership rehearsal, deterministic integrity checks, one explicitly selected CloudFormation path, rollback/abort/downtime/load/cost controls, and fresh Architecture/Security/Tester/PM/HUMAN/On-Call gates. Grooming authorizes no AWS or repository mutation. Next owner: authorized HUMAN AWS operator; resume with sanitized confirmation that Support guidance and authentic private diagnostics are ready for review.
alexeygrigorev commentedon Jul 31, 2026
ARCHITECTURE PASS — design gate only; no AWS action authorized
The route-B plan is implementable and safely ordered: authenticated Support guidance → immutable baseline → approved recovery artifact → isolated restore/ownership rehearsal → one selected supported path → frozen production runbook → per-phase approvals → production verification. This PASS approves the groomed design framework only. It does not select a candidate path, accept evidence not yet supplied, or authorize a Support disclosure or AWS mutation.
The frozen runbook must make these proofs explicit before later Architecture approval:
DeletionPolicy: RetainandUpdateReplacePolicy: Retain, (2) removing/detaching while retaining the table, and (3) a distinctIMPORTchange set describing the actual configuration. Import cannot create/delete/update other resources, and the resource must not belong to another stack. Preview, execute, wait, verify, and abort gates must be enumerated for each operation. See manual import constraints and AWS's retain/remove/re-import sequence.Dependency direction is correct: #143 remains independent to avoid a #140↔#143 cycle; #140 remains blocked on #143. #141's remaining access-session/provenance cleanup does not block route B and must not be recollected. If Support supplies an authoritative exact historical binding, stop and return to fresh #140 Architecture/Security review as specified.
Verdict: ARCHITECTURE PASS for the groomed remediation plan. The issue correctly remains blocked on authorized HUMAN Support guidance and private diagnostics; no production or rehearsal mutation may begin from this verdict.
alexeygrigorev commentedon Jul 31, 2026
SECURITY BLOCK — add an explicit access and production-data contract
The route-B sequence, CloudFormation choices, recovery ordering, deterministic integrity standard, per-mutation HUMAN gates, abort/rollback structure, and downtime/load/cost requirements are sound. I agree with the Architecture constraints, including point-in-time write reconciliation, separate retain/detach/import operations, new-name restore configuration reconstruction, and digest-bound approval for every mutation and rollback.
I cannot yet approve the groomed security design because three controls are implicit or deferred rather than required for every phase, including Support disclosure, baseline reads, backup/export, rehearsal, and cleanup.
1. Phase-scoped least privilege and session provenance
“Approved identity” is too broad. Add a global access contract requiring the frozen private runbook to define, before each phase:
A broad administrator session must not become acceptable merely because the runbook enumerates calls.
2. Production-data controls for exports and rehearsal
A restore into a “non-production” target still contains production Sponsor CRM data and is not declassified. Require production-equivalent confidentiality controls throughout its lifetime:
Support receives only the minimum ownership diagnostics; production item data is excluded unless Security and an authorized HUMAN explicitly approve that disclosure.
3. Enforced audit, redaction, and change/write freeze
Require a reviewed execution mechanism for every phase that captures UTC actor/session/action/result evidence directly into the private evidence store while suppressing shell tracing, credential material, item data, and raw identifiers from public logs. An evidence leak or mismatch is an immediate ABORT and security-containment event.
Before snapshot/integrity comparison, detach/import, restore, or cutover, require an enforceable deployment/change freeze and an explicit inventory of all writers and mutators: application writes, retries, TTL, streams, scheduled/async consumers, operators, deployment workflows, and #136 migration. The runbook must define quiescence or complete ordered change capture/reconciliation through cutover and rollback; a procedural promise not to deploy is insufficient.
The existing numeric downtime/load/cost ceilings, owner coverage, recovery-asset retention, named-table collision rule,
Retainpolicies, change-set abort checks, and separate HUMAN approval for backup/restore/import/cutover/rollback/cleanup should remain unchanged.After the issue makes these requirements explicit, Security can re-review the groomed design. This BLOCK authorizes no Support disclosure, AWS call, IAM change, backup/export, rehearsal, cleanup, or production mutation.
alexeygrigorev commentedon Jul 31, 2026
PM AMENDMENT — Security re-review requested
I amended the groomed issue body to close exactly the three global-control gaps in the Security block:
The Architecture-approved route-B sequence, CloudFormation candidates and constraints, numeric downtime/load/cost ceilings, recovery retention, named-table and
Retainsafeguards, change-set abort checks, and separate frozen-runbook-digest-bound HUMAN approval for every mutation and rollback remain unchanged.Security: please re-review the amended groomed design against the blocking findings. This PM specification amendment authorizes no Support disclosure, AWS call, IAM change, backup/export, restore/rehearsal, deploy/change/write action, cleanup, rollback, or production mutation. The issue remains blocked pending the documented HUMAN evidence and review gates.
alexeygrigorev commentedon Jul 31, 2026
SECURITY PASS — amended groomed design only; no action authorized
I re-reviewed the amended issue body against all three findings in the prior Security block.
Closed findings
Least privilege and session provenance — closed. The global contract now applies to every phase and requires a private phase-specific matrix of exact account/region/resources, actor and expected principal, role/session source, issuance/expiry, MFA/approval provenance, minimum API/action/resource scope, short-lived unique attribution, read/write separation where practical, and explicit exclusion of shared/static credentials, broad administrator sessions, rehearsal production credentials, and deploy-OIDC broadening. Entry/pre-mutation identity checks, exact allowed-versus-observed operation reconciliation, verified expiry/revocation, separate review for any IAM change, and fail-closed drift are explicit.
Production-data confidentiality — closed. Backup, export, restored data, keys, items, and derived integrity evidence retain production classification in non-production. Approved KMS, transport/storage encryption, private access, account/principal isolation, public/cross-account exclusion, no external integrations or uncontrolled egress, private integrity evidence, disclosure-resistant public digests, minimum Support disclosure, retention/hold, separately approved cleanup, verified deletion, and KMS/access revocation are all required.
Audit/redaction and enforced freeze — closed. Every phase requires a reviewed private execution/evidence mechanism with UTC actor/session/action/result capture, allowed-versus-observed reconciliation, redaction/destination checks, and leak/mismatch containment. Snapshot, integrity, ownership, restore, cutover, and rollback are protected by a technically enforced deploy/change/write freeze, complete mutator inventory, explicit quiescence or ordered capture, reconciliation through rollback, and an explicit freeze-release gate.
Preserved controls
The amendment does not weaken the Architecture-approved sequence or existing gates. Support ambiguity still fails closed; route A is not revived by inference; CloudFormation import/replacement/
Retain/named-table constraints remain; deterministic point-in-time integrity, recovery retention, numeric downtime/load/cost ceilings, abort/rollback boundaries, and separate frozen-runbook-digest-bound HUMAN approval for every mutation and rollback remain mandatory. #136 remains blocked.Verdict: SECURITY PASS for the amended groomed design. This approves only the security control framework. It does not approve an identity/session, Support disclosure, diagnostic collection, IAM change, backup/export, restore/rehearsal, selected CloudFormation path, runbook, cleanup, rollback, or production mutation. Each later phase still requires its specified evidence and fresh Security/HUMAN gates; any material drift returns to review.
alexeygrigorev commentedon Jul 31, 2026
PM lifecycle reconciliation — future repository path made explicit
Retained the exact current owner and resume signal: authorized HUMAN AWS operator obtains Support guidance/private diagnostics, then posts only sanitized availability confirmation for Architecture/Security review; no action is implied. Added explicit PM→SWE→Architecture/Security→Tester→PM→commit/merge/push→On-Call routing for any repository/template change, plus an explicit no-change disposition when applicable. #143 now blocks #136 directly, #141 is not a blocker, and the premature
humanlabel is removed while substantial later agent/deploy gates remain. No Support contact, AWS/repository/deploy action, or criterion completion occurred.alexeygrigorev commentedon Aug 1, 2026
PM bounded tracker update — credential-provider availability is not the resume signal
The authorized user reports that the AWS gate is open. At the currently verified scope, this indicates only local AWS credential-provider availability. Actual suitability remains unverified: no trusted current AWS identity, phase-scoped principal/session provenance, expiry/revocation, least-privilege action/resource scope, account/region/resource binding, or allowed-versus-observed operation inventory has been established. No AWS call, private-evidence inspection, Support contact, repository change, workflow action, environment change, or mutation was performed.
PM disposition: BLOCK. Credential-provider availability does not satisfy this issue resume condition. AWS Support guidance and authentic private diagnostics are not yet reported as available for Architecture/Security review. It also does not authorize an agent to call AWS or Support, infer ownership, select a CloudFormation path, create recovery assets, rehearse, mutate production, or advance #136.
The next owner remains the authorized HUMAN AWS operator under the existing Phase 1 boundary. That HUMAN must separately use an approved identity and minimum disclosure to obtain the guidance and retain the authentic response/diagnostics privately. Only after the following sanitized statement is true should Architecture and Security resume:
Do not include a Support case identifier, correspondence, screenshots, private links or locations, account/resource/principal identifiers, raw diagnostics, item data, or credentials-adjacent material in the public issue.
The separate protected-environment verification remains tracked in the bounded #136 PM update. Even when that environment proof passes, it cannot substitute for this Support-guidance/ownership-remediation gate.
alexeygrigorev commentedon Aug 2, 2026
PM REGROOM — sandbox-only boundary and source-data classification gate
I regroomed this issue to reflect the authoritative deployment boundary: the existing
dataops-v1stack and Sponsor CRM source table are in the DataOps sandbox AWS account. There is no production AWS target or production rollout in #143.This naming correction completes no acceptance criterion and authorizes no AWS call, private-evidence inspection, Support contact, repository/workflow change, backup, reset, deletion, import, replacement, deployment, migration, or other mutation. #140/#141 historical evidence and every existing comment remain preserved; #141 is still not a blocker and must not be recollected without a newly identified exact-pair source.
The new first gate is an accountable HUMAN classification of the existing sandbox source table:
Until that classification is independently accepted, all source data and derived evidence retain source-equivalent private/operational confidentiality. Sandbox naming, apparent emptiness, low count, or assumed reconstructability is not proof and cannot check a criterion.
PM disposition: BLOCK pending Phase 0 HUMAN classification.
Next owner: authorized HUMAN data owner/operator.
Resume with exactly one sanitized statement using the form in the issue body, retaining accountable ownership, authentic evidence, UTC decision time, scope, and digest privately. Do not publish item data, raw counts, account/resource/principal identifiers, screenshots, commands, Support details, private locations/links, or credentials-adjacent material.
After that statement, Architecture and Security must perform a fresh proportionality review. Their next verdict decides only which route may be groomed further; it does not authorize action.
alexeygrigorev commentedon Aug 11, 2026
HUMAN Phase 0 classification — disposable sandbox test data
The authorized user/data owner has classified the existing sandbox Sponsor CRM table contents as test data and explicitly accepts complete data loss for this sandbox table: "test data is disposable."
This statement authorizes fresh Architecture and Security proportionality review of a synthetic/disposable reset path. It does not by itself authorize an AWS call, backup deletion, table deletion/replacement, CloudFormation mutation, migration dispatch, application deploy, or reuse of production/private data. Reviewers must still define and verify the exact sandbox identity, no-production-data boundary, dependency impact, rollback/abort conditions, and explicit mutation gate before any reset.
alexeygrigorev commentedon Aug 11, 2026
REVISED ARCHITECTURE PASS — same-name disposable sandbox reset
Fresh Architecture review accepts the same-name reset and blocks a permanent
-v2replacement as unnecessary complexity.AWS documents that a drift-aware UPDATE change set created with
--use-previous-template --deployment-mode REVERT_DRIFTcan preview and recreate a resource deleted outside CloudFormation. The proportional route is therefore: freeze all writers and deploy/migration activity; revalidate the exact sandbox identity, stack, logical/physical table binding, disposable-data classification, dependencies, and retained queues; separately HUMAN-approve deletion of only the exact table; create and fully inspect the drift-aware change set; allow only recreation ofDataOpsSponsorCrmTableand the exact stream event-source-mapping effect caused by the new stream ARN; separately HUMAN-approve execution of that exact immutable candidate; and verify the same physical name, new TableId, canonical CloudFormation tags, previous-template configuration, stream, and event mapping.Any unrelated drift, unsupported/ignored comparison, IAM/queue/resource change, or unexpected dependency aborts. A failed execution may roll back to the already-missing actual state, so keep writers frozen and require a fresh reviewed candidate rather than retrying blindly.
#136 can run unchanged after successful reset verification: its name/ownership guard remains intact and its migrator pins the new TableId at runtime.
Sources: AWS drift-aware change-set documentation and AWS deleted-resource recreation example.
This verdict approves only the route for separate grooming. No AWS call, repository change, workflow dispatch, or mutation is authorized.
alexeygrigorev commentedon Aug 11, 2026
REVISED SECURITY PASS — same-name drift-aware design only
Fresh Security review accepts same-name
REVERT_DRIFTrecreation as the simplest proportional route for this sandbox-only table after explicit total-loss acceptance. Unique-name replacement remains only a separately groomed fallback if the candidate cannot reproduce the table exactly or exposes ambiguous/unrelated effects.The separate reset issue must require a short-lived least-privilege read preflight that proves the exact sandbox principal/account/region, terminal stack, logical/physical binding, current TableId and stream, previous-template digest/configuration, parameters/capabilities, deletion protection, complete writer/dependency inventory and quiescence, no production crossing, private redacted audit, and time/cost ceilings. No item scan, item-level integrity proof, backup/export, restore rehearsal, or Support contact is required for disposable test data.
Mutation gates remain separate and digest-bound: deletion-protection change if needed; exact-table deletion; non-executing drift-aware change-set creation; exact-candidate execution; and any later reset/retry/cleanup. Fully paginate the candidate and accept only the Sponsor table recreation plus exact enumerated stream event-source-mapping effects. Any other resource/property/tag/IAM/Lambda/schedule/rule/table change, unknown dynamic effect, extra candidate, or identity/template/parameter drift fails closed.
After deletion, data recovery is intentionally unavailable. If the candidate is unsafe or execution fails, keep writers frozen, preserve evidence, and return to review. After success, require a new TableId, exact canonical CloudFormation binding/configuration, healthy stream, and exact event mapping before #136 freshly pins the new identity.
SECURITY BLOCK remains on AWS preflight or execution until the separate issue is groomed, reviewed, and its phase-specific HUMAN authorization exists. This comment authorizes no AWS call or mutation.
alexeygrigorev commentedon Aug 11, 2026
Fresh evidence from canonical-frontend rollout SHA 36d446c: normal workflow https://github.com/DataTalksClub/dataops/actions/runs/31514587968 passed all source/E2E/SAM gates, assumed the deploy role, then failed closed at the credentialed pre-build guard with
guard-cloudformation-table-stack-id-absent. Build/deploy/seed/smoke were skipped, so no AWS mutation occurred. This remains the direct blocker for #155 and #148.alexeygrigorev commentedon Aug 11, 2026
PM TRACKER RECONCILED — Phase 0 complete; #147 owns execution
Rewrote #143 in place to remove the stale Phase 0/HUMAN-classification blocker and reconcile it with the current public-safe evidence.
REVERT_DRIFTroute. The historical protected-data route remains documented only as an inactive fail-closed fallback if classification or route evidence drifts.dataops-github-actionsapply toUPDATE_COMPLETE, exact live readback, official custom-policy simulations, official deploy-role principal-policy simulations, and PM closes Add reset version listing and isolate drift reads from the inline deploy policy #160.Exact next owner: #147 implementation/execution pipeline, with the immediate external prerequisite owned by the authorized HUMAN operator and PM in #160.
Exact resume/closure condition: #160 is PM-closed after accepted HUMAN activation/readback/simulation evidence; #147 then recreates and verifies the same-name canonical prefix-0 table under its unchanged gates; only accepted proof of canonical CloudFormation ownership and healthy exact logical↔physical association allows #143 to close and stop blocking #136.
Labels remain correct;
humanis not added to #143 because substantial #147 execution and verification remain after the transitive #160 HUMAN gate.No source edit, commit, push, AWS call, CloudFormation operation, role assumption, workflow dispatch, deployment, migration, cleanup, or private-item inspection occurred during this PM reconciliation.
alexeygrigorev commentedon Aug 13, 2026
Tracker reconciliation: CloudFormation stack
dataops-v1now owns logical resourceDataOpsSponsorCrmTable, physical tabledataops-v1-sponsor-crm, with resource statusUPDATE_COMPLETE. The table is ACTIVE and currently empty. The ownership-reset machinery has completed its job and was removed under #174. Closing as completed.