Add reset version listing and isolate drift reads from the inline deploy policy

Status: pending — regroomed for current aws-infra main; source implementation/review and HUMAN activation remain; every #147 AWS dispatch remains blocked
Tags: bug, infra, testing, data, P1
Depends on: #147 exact Security-reviewed reset source contract and drift-aware recovery requirement (not #147 completion)
Blocks: #147 real dispatch and final Security PASS
Next owner: Software Engineer

Scope and current baseline

Change only these two paths in the shared DataTalksClub/aws-infra source of truth:

sandbox/dataops/template.github-actions.yaml
sandbox/dataops/tests/test_template_github_actions.py

Start in a freshly fetched, clean, isolated worktree at current origin/main, exact commit 6c21d2d86898e1b545bf8892114e9ee0f2dc3992. Preserve dirty sibling checkouts. Do not reuse or commit the rejected 680c7c2 candidate.

Deterministically derived current-base evidence:

template SHA-256: d9678248a7e6b41391b4931edb428907e015d810b0700f7df4b77471f3386052
test SHA-256: eade8a778d1bc5c50c78d78dd6e5f096b32acda056e64a88a68e1d619f54fca4
inline policy: 9,676 / 8204c3f419a14dfaa14d9d46189d925360725783ab8454a1fd837f081c255541 — 76 above the 9,600 project ceiling and only 564 below the 10,240 AWS quota
Sponsor compute: 3,893 / 97dd1ea24436bd32f9a81e394c37281c994dbfd78bfd3f8f66f1c5a55d4d5a4f
OIDC trust: 386 / a4fb561e9b54a2418b750fdc84e0c7ddd7856305fd791d615d40aa85174e68bf
one inline policy and four managed policies, all attached only to GitHubActionsDeployRole

The inline overflow is caused only by the separately required cloudformation:DetectStackDrift, cloudformation:DetectStackResourceDrift, and cloudformation:BatchDescribeTypeConfigurations actions added by 6c21d2d for drift-aware #147 recovery. They must remain available; raising the ceiling or deleting them is not a fix.

Exact source shape

1. Relocate the three existing drift-read actions

Remove only:

cloudformation:DetectStackDrift and cloudformation:DetectStackResourceDrift from inline Sid CloudFormationDataOpsStack
cloudformation:BatchDescribeTypeConfigurations from inline Sid CloudFormationRead

Preserve every other inline action, resource, condition, Sid, and order exactly.

Add this dedicated managed policy immediately after GitHubActionsDeployRole and before SponsorCommunicationsComputeDeployPolicy:

  DataOpsCloudFormationDriftReadPolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Description: Read only the DataOps stack drift state required by reviewed recovery.
      PolicyDocument:
        Version: "2012-10-17"
        Statement:
          - Sid: CloudFormationDataOpsStackDriftRead
            Effect: Allow
            Action:
              - cloudformation:DetectStackDrift
              - cloudformation:DetectStackResourceDrift
            Resource: !Sub arn:${AWS::Partition}:cloudformation:${FullDocsRegion}:${AWS::AccountId}:stack/${FullDocsStackName}/*
          - Sid: CloudFormationDataOpsTypeConfigurationRead
            Effect: Allow
            Action:
              - cloudformation:BatchDescribeTypeConfigurations
            Resource: "*"
            Condition:
              StringEquals:
                aws:RequestedRegion: eu-west-1
      Roles:
        - !Ref GitHubActionsDeployRole

This is the smallest clean policy boundary: stack drift actions support the exact stack resource type, while BatchDescribeTypeConfigurations has no resource type and is therefore restricted by the exact requested region. The new policy is attached only to the existing deploy role. Add no managed-policy name, other role, other attachment, parameter, tag, trust change, GitHub Environment, secret, variable, or assumption path.

Authoritative semantics:

AWS-required drift permissions: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-stack-drift.html
CloudFormation action/resource mapping: https://docs.aws.amazon.com/service-authorization/latest/reference/list_awscloudformation.html
aws:RequestedRegion: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-requestedregion

2. Add the reset evidence prerequisite

Add exactly this statement to SponsorCommunicationsComputeDeployPolicy, immediately after SponsorWorkerEventSourceMapping and before SponsorSesEventInvokeConfig:

          - Sid: SponsorResetEvidenceListVersions
            Effect: Allow
            Action:
              - s3:ListBucketVersions
            Resource: !Sub arn:${AWS::Partition}:s3:::aws-sam-cli-managed-default-samclisourcebucket-dgwncwijmnpd
            Condition:
              StringEquals:
                aws:RequestedRegion: eu-west-1
              StringLike:
                s3:prefix: dataops-v1/private/sponsor-crm-reset/v1/*

This is the only newly granted action relative to 6c21d2. It uses the bucket-level IAM action required by ListObjectVersions, the exact SAM bucket, the exact eu-west-1 endpoint, and only the trailing descendant wildcard under the fixed reset evidence root. It grants no object read/write/delete or bucket mutation.

S3 semantics:

prefix conditions: https://docs.aws.amazon.com/AmazonS3/latest/userguide/amazon-s3-policy-keys.html
S3 API/IAM action mapping: https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-with-s3-policy-actions.html

Acceptance criteria

Exact delta, boundaries, and fingerprints

Work starts from exact current base 6c21d2d86898e1b545bf8892114e9ee0f2dc3992; only the two authorized paths change. DataOps, Add a reviewed one-time reset path for the disposable sandbox Sponsor table #147's reset candidate, source-system repositories, and dirty sibling aws-infra checkouts remain untouched.
The three drift-read actions each occur exactly once across all inline and managed policies: only in DataOpsCloudFormationDriftReadPolicy. The two stack actions have only the exact DataOps stack ARN; the type-configuration action has only Resource: "*" plus exact StringEquals aws:RequestedRegion: eu-west-1.
DataOpsCloudFormationDriftReadPolicy has exactly Type and the pinned Description, PolicyDocument, and one-role Roles properties above. It is the only new IAM resource and the fifth managed policy attached only to GitHubActionsDeployRole.
SponsorResetEvidenceListVersions and s3:ListBucketVersions each occur exactly once, only in Sponsor compute, with exactly Sid, Effect: Allow, the one-action list, scalar exact bucket resource, and the two pinned conditions.
No delete, object read/write, bucket configuration/versioning/lifecycle/policy, ACL/tagging, copy, multipart, presign, CloudFormation create/update/execute/delete, trust, role, parameter, secret, environment, or unrelated permission is added, moved, removed, or broadened. Pre-existing SamArtifacts, including s3:DeleteObject, remains byte-for-byte unchanged and is not attributed to Add reset version listing and isolate drift reads from the inline deploy policy #160.
Preserve exact usual OIDC trust: DataTalksClub/dataops, refs/heads/main, audience sts.amazonaws.com; no StringLike trust, wildcard subject, alternate repo/ref/audience, environment subject, or role-assumption workaround.
With the exact shape and resolved current defaults, final policy fingerprints are:
- inline: 9,551 / 8f686d8da8ea0d4db660f9c6828630f21d1ac2dcff6c3de26fb8556874f1ce59 — 49 below the 9,600 project ceiling and 689 below the AWS quota
- drift read: 476 / 43299fce7e37ade4ec7de613e6b4dc90ad55e48273c43c61850e1a835a354cde
- Sponsor compute: 4,210 / 406aee316f5428eb56b7a689ac9aa94ccc23cd68fa5b6cb1661c6c017af91cac — 910 below the 5,120 project ceiling and 1,934 below the AWS quota
- Sponsor service: 1,093 / 30aaa91aa6e00e19e7a04b35c4194075d4e881123e1727093a9001fa4f5dd952
- dispatcher: 1,510 / d705db32ea1786480f149d63916723b22232dad078f0e7710c0984fb31daf313
- observability: 5,369 / 435213eed7933be4ae303aae1b14ef72f09a42a4a6cf2c1f6fa99706455b827f
- OIDC trust: 386 / a4fb561e9b54a2418b750fdc84e0c7ddd7856305fd791d615d40aa85174e68bf
- inventory: one inline policy, five deploy-role-only managed policies, five attachment slots free
Reverse reconstruction is exact: remove SponsorResetEvidenceListVersions, delete only DataOpsCloudFormationDriftReadPolicy, and restore the three drift actions to their exact original 6c21d2 inline positions; the complete parsed template must then equal authoritative base. No final raw template/test SHA, candidate tree, or diff SHA is predeclared; SWE must derive and freeze them from the implemented uncommitted candidate.

Deterministic tests

Extend the parsed evaluator for simultaneous StringEquals and StringLike conditions without weakening existing region/resource tests.
Drift custom-policy tests allow DetectStackDrift and DetectStackResourceDrift only for the exact DataOps stack ARN, and deny another stack, region, account, transform/change-set/object-like ARN, and Resource: "*". They allow BatchDescribeTypeConfigurations only with Resource: "*" and aws:RequestedRegion=eu-west-1, denying missing or alternate region and any substituted resource shape.
The isolated drift policy grants none of CloudFormation create/update/delete/execute/change-set actions, S3 actions, IAM actions, or non-CloudFormation actions. Whole-role tests prove all three required drift actions remain effective exactly once after relocation.
Reset allow tests cover the exact bucket, eu-west-1, and fixed root/run/intent/completion descendants. Deny tests cover missing/alternate region or prefix, empty/parent/root-without-slash/v10/sibling/traversal-like prefixes, another/wildcard bucket, object ARN, and Resource: "*".
The isolated reset statement grants none of s3:ListBucket, s3:GetObject, s3:PutObject, s3:DeleteObject, s3:DeleteObjectVersion, s3:DeleteBucket, s3:PutBucketVersioning, s3:PutBucketPolicy, s3:PutLifecycleConfiguration, s3:*, or any non-S3 action. Whole-role tests separately preserve and report the unrelated pre-existing s3:DeleteObject result.
Mutation tests reject missing/duplicate/renamed/moved drift or reset actions/Sids; leaving drift actions inline; placing reset in drift/inline/service/dispatcher/observability; scalar/list drift; broader/wildcard/alternate resources; condition/operator/key/value/list drift; extra actions/resources/conditions; another role or attachment; new parameter/environment/secret; OIDC trust drift; IAM inventory drift beyond the one pinned policy; and regressions in Repair DataOps OIDC SES configuration-set tag-on-create permission #129/Repair dispatcher generated-role IAM prefix for CloudFormation rollback #130/Allow CI to read the exact processed DataOps stack template #135/Allow CI to list active change sets for the exact DataOps stack #138/Allow the usual deploy role to list Sponsor event-source mappings in eu-west-1 #149 boundaries.
Canonical source, policy, quota, count, attachment, reverse-reconstruction, and candidate fingerprint tests fail on every unauthorized mutation. Update stale current-main expectations to the exact final values above rather than blessing the 9,676-byte inline document.

Verification and same-fingerprint review

Run the focused drift/reset/policy/mutation tests, all sandbox/dataops tests, SAM lint, Ruff, Python compilation, exact canonical/quota/count checks, and git diff --check. No UI changes; screenshots are not required.
Freeze exact base, NUL-safe two-path inventory, candidate tree, full-index binary diff SHA-256, raw template/test SHA-256, all resolved policy/trust fingerprints and headroom, IAM inventory/attachments, reverse reconstruction, and allow/deny/mutation counts.
Architecture and Security/IAM review the same new uncommitted fingerprint, then Tester independently runs the full required workflow on that identity, then PM performs source acceptance. All old 680c7c2 reviews are historical only.
After all source gates pass, SWE commits only the accepted two paths with Refs DataTalksClub/dataops#160. The integrator merges to freshly updated aws-infra local main and pushes through the normal local-main flow; no PR or AWS apply is part of source integration. Add human only after source ships and activation is the sole remaining gate.

HUMAN activation, readback, and simulation

[HUMAN] A credentialed operator records the terminal live dataops-github-actions baseline and creates a fresh CAPABILITY_NAMED_IAM change set from the exact merged source. The only allowed convergence is: add DataOpsCloudFormationDriftReadPolicy, modify Sponsor compute only by adding the reset statement, and—only if interim 6c21d2 was already applied—modify the deploy role inline document only by removing the three relocated actions. If live inline is still the accepted 9,551-byte Allow the usual deploy role to list Sponsor event-source mappings in eu-west-1 #149 document, no role policy semantic change is expected. Any replacement, other resource, trust, attachment target, parameter, tag, policy identity, or unrelated delta aborts without execution.
[HUMAN] Execute only that reviewed change set; require UPDATE_COMPLETE, no pending executable change set, and exact live final fingerprints for inline, drift, compute, service, dispatcher, observability, and trust as pinned above. Verify five policies attached only to the existing role, no other IAM inventory, exact statement shapes, stack inventory/drift, and unchanged role identity.
[HUMAN] Official custom-policy simulations reproduce both isolated matrices. Drift policy: exact-stack allows for both detect actions; exact-region wildcard-resource allow for type-configuration read; all named alternate resources/regions and unlisted CloudFormation writes are implicitDeny. Reset policy: only exact bucket/region/root-or-descendant prefixes allow; all negative S3 cases are implicitDeny.
[HUMAN] Official deploy-role principal-policy simulation reproduces the required drift and reset allows and the negative cases. It additionally shows s3:DeleteObjectVersion, s3:DeleteBucket, s3:PutBucketVersioning, s3:PutBucketPolicy, and s3:PutLifecycleConfiguration denied on exact SAM resources, while recording unchanged pre-existing s3:DeleteObject without attributing it to Add reset version listing and isolate drift reads from the inline deploy policy #160. Do not add sts:AssumeRole or weaken trust for testing.
PM accepts the HUMAN change-set/apply/readback/simulation evidence and closes Add reset version listing and isolate drift reads from the inline deploy policy #160. Add a reviewed one-time reset path for the disposable sandbox Sponsor table #147 remains dispatch-blocked until that acceptance is recorded; closing Add reset version listing and isolate drift reads from the inline deploy policy #160 authorizes no reset dispatch and bypasses none of Add a reviewed one-time reset path for the disposable sandbox Sponsor table #147's gates.

Required verification

From the fresh aws-infra worktree:

uv run --with pytest python -m pytest sandbox/dataops/tests -q
uv run --with pytest python -m pytest sandbox/dataops/tests/test_template_github_actions.py -q -k "Sponsor or ResetEvidence or ListBucketVersions or DriftRead or DetectStackDrift or BatchDescribeTypeConfigurations"
sam validate --lint --template-file sandbox/dataops/template.github-actions.yaml
uvx ruff check --select E4,E7,E9,F sandbox/dataops/tests/test_template_github_actions.py
python -m py_compile sandbox/dataops/tests/test_template_github_actions.py
git diff --check 6c21d2d86898e1b545bf8892114e9ee0f2dc3992

Tester reports exact commands, exit codes/counts, both allow/deny matrices, mutation results, reverse reconstruction, fingerprints, quota headroom, and trust/inventory preservation.

Test scenarios

Drift reads survive relocation

Given the existing deploy role and exact DataOps stack in eu-west-1
When drift-aware recovery calls the three required CloudFormation read actions
Then the dedicated policy allows them with the pinned stack/region boundaries and no CloudFormation write action.

Reset evidence exact prefix

Given the exact SAM bucket and aws:RequestedRegion=eu-west-1
When version history is listed for the fixed reset root or a valid descendant
Then exactly SponsorResetEvidenceListVersions allows it; near matches and missing/alternate context are denied.

Source ships but is not live

Given accepted source reaches aws-infra main
When #147 readiness is assessed before HUMAN change-set/readback/simulation acceptance
Then every #147 dispatch remains blocked because source integration alone changes no live permission.

Effective prerequisite accepted

Given the stack is terminal, live fingerprints and inventory match, and official simulations reproduce both matrices
When PM accepts the HUMAN evidence and closes #160
Then #147 may resume its own gated pipeline; #160 itself dispatches nothing.

Rollback and out of scope

Rollback is CloudFormation-only through a fresh reviewed CAPABILITY_NAMED_IAM change set using the exact pre-change template recorded by the HUMAN operator. Require terminal success and verify restoration of that recorded inline/compute/policy inventory and unchanged trust. Never patch IAM directly.

Out of scope: editing DataOps, #147's reset candidate, or source-system repositories; committing/pushing during grooming; any AWS call, CloudFormation operation, manual IAM edit, role assumption, or workflow dispatch; modifying #149 behavior; S3 object/version deletion or bucket mutation; CloudFormation write expansion; another role, trust, GitHub Environment, secret, variable, parameter, or normal app deploy.

Grooming authorizes no repository edit, commit, push, AWS call, apply, workflow dispatch, or reset.

PM GROOMED — exact version-history prerequisite is agent-ready

#160 now pins the sole source delta to one SponsorResetEvidenceListVersions statement in the existing SponsorCommunicationsComputeDeployPolicy: only s3:ListBucketVersions, exact SAM bucket ARN, exact dataops-v1/private/sponsor-crm-reset/v1/* prefix boundary, and aws:RequestedRegion=eu-west-1.

The contract includes exact allow/deny/prefix/mutation tests, candidate fingerprint and policy quota values, unchanged #149 fingerprints/trust/attachments, same-fingerprint Architecture/Security/Tester/PM source gates, Refs source integration, and a separate HUMAN reviewed CAPABILITY_NAMED_IAM change set/apply/readback/custom-plus-principal simulation gate. It explicitly adds no version/object deletion, bucket mutation, policy inventory, attachment, trust, GitHub Environment, broader resource, or runtime change.

#147 remains SECURITY BLOCKED for every AWS dispatch until the HUMAN evidence is PM-accepted and #160 closes. #149 is complete and unchanged.

No repository file, Git state, AWS resource, workflow, stack, commit, or deployment was changed or invoked during grooming.

Exact next owner: Software Engineer, in a fresh clean isolated aws-infra worktree from fetched current origin/main.

Software Engineer handoff — #160 source candidate ready for Architecture/Security/IAM

Implemented the exact two-path aws-infra source candidate without commit, push, PR, AWS call, apply, or #147 dispatch.

Frozen candidate

authoritative remote/base/HEAD: 680c7c2ddc6e069f72cd5e8d5e638874178dbab7
candidate tree: ea2c111535246ed1b4ff7ce6fcde93dc50c6de44
full-index binary diff SHA-256: 16f92a1089cc496b458d4225d8385e82a8ea67d5384d6dd26b3381a603ea1bdf
exact NUL-safe inventory:
- sandbox/dataops/template.github-actions.yaml
- sandbox/dataops/tests/test_template_github_actions.py
candidate file SHA-256:
- template: 2f5b6f37ac3d032c163e9ba0b637366d07ed831d39e23b7a7da250d80a7f6848
- tests: fe6bb8fb4e36307785f564fdd913c28f11f8533d2163bbe498c957eed5261275

The only permission added is the pinned SponsorResetEvidenceListVersions statement in SponsorCommunicationsComputeDeployPolicy, immediately after SponsorWorkerEventSourceMapping: one s3:ListBucketVersions action, the exact scalar SAM bucket ARN, StringEquals aws:RequestedRegion=eu-west-1, and StringLike s3:prefix=dataops-v1/private/sponsor-crm-reset/v1/*. Its Sid and action each occur exactly once. No version/object delete, bucket mutation, trust, attachment, policy inventory, parameter, or unrelated permission changed. Removing only this statement reconstructs the authoritative base fingerprint exactly.

Deterministic policy evidence

compute: 4210 / 406aee316f5428eb56b7a689ac9aa94ccc23cd68fa5b6cb1661c6c017af91cac (910 below project ceiling; 1,934 below AWS quota)
inline: 9551 / 8f686d8da8ea0d4db660f9c6828630f21d1ac2dcff6c3de26fb8556874f1ce59
Sponsor service: 1093 / 30aaa91aa6e00e19e7a04b35c4194075d4e881123e1727093a9001fa4f5dd952
dispatcher: 1510 / d705db32ea1786480f149d63916723b22232dad078f0e7710c0984fb31daf313
observability: 5369 / 435213eed7933be4ae303aae1b14ef72f09a42a4a6cf2c1f6fa99706455b827f
trust: 386 / a4fb561e9b54a2418b750fdc84e0c7ddd7856305fd791d615d40aa85174e68bf
inventory: one inline policy, four deploy-role-only managed policies, six attachment slots free

The parsed evaluator now requires simultaneous exact StringEquals plus StringLike matching. The allow matrix passes for only the exact bucket, eu-west-1, and the fixed root/run/intent/completion descendants. Denies pass for missing/alternate region or prefix, empty/parent/v10/sibling/traversal-like prefixes, alternate/wildcard/object/* resources. The isolated statement denies every unlisted S3 read/write/delete/bucket action and non-S3 action; the whole-role test separately records unchanged pre-existing s3:DeleteObject without attributing it to #160. Mutation tests reject missing/duplicate/renamed/moved/scalar/list drift, all named wrong policy homes/new IAM inventory, broadened actions/resources/conditions/prefixes/regions, and trust/parameter/attachment drift.

Verification

focused Sponsor/reset/version-list policy and mutation tests: PASS — 35 passed, 49 deselected, 143 subtests passed
all sandbox/dataops tests: PASS — 84 passed, 271 subtests passed
SAM lint: PASS — valid template
Ruff E4,E7,E9,F: PASS
Python compilation: PASS
git diff --check 680c7c2...: PASS
screenshots: N/A; no UI changed

Exact next gates on this same uncommitted fingerprint: Architecture and Security/IAM, then Tester, then PM source acceptance. #147 remains SECURITY BLOCKED and all HUMAN CloudFormation/apply/readback/simulation criteria remain pending.

ARCHITECTURE PASS — frozen #160 candidate

PASS on base 680c7c2ddc6e069f72cd5e8d5e638874178dbab7, tree ea2c111535246ed1b4ff7ce6fcde93dc50c6de44, binary diff SHA-256 16f92a1089cc496b458d4225d8385e82a8ea67d5384d6dd26b3381a603ea1bdf, exactly two paths.

The new statement is in the correct Sponsor compute policy attached only to the usual deploy role. It grants only s3:ListBucketVersions on the exact SAM bucket ARN with conjunctive aws:RequestedRegion=eu-west-1 and exact reset-prefix conditions. Removing it reconstructs base; no object/version deletion, bucket mutation, trust, parameter, inventory, attachment, or existing artifact permission changed. Compute policy is 4,210 characters with quota/headroom preserved. Focused/full policy tests, SAM lint, Ruff, Python compilation, and diff checks pass.

This is source approval only; HUMAN apply/effective proof remains required. No edit, AWS call, apply, commit, push, or dispatch occurred.

SECURITY PASS — frozen #160 source candidate

PASS on base 680c7c2ddc6e069f72cd5e8d5e638874178dbab7, tree ea2c111535246ed1b4ff7ce6fcde93dc50c6de44, binary diff SHA-256 16f92a1089cc496b458d4225d8385e82a8ea67d5384d6dd26b3381a603ea1bdf, exactly two paths.

The sole permission delta is exact bucket-level s3:ListBucketVersions, restricted by both sandbox region and the dedicated reset prefix. Pagination retains the same prefix. No object read/write/delete, version deletion, bucket mutation, broader S3 resource/action, OIDC trust, attachment, parameter, or policy-inventory change is introduced. Existing unrelated SamArtifacts permissions remain unchanged. Policy fingerprints, quotas, region/prefix/action negative matrices, and full regression tests pass.

Real dispatch remains BLOCKED until source ships and a HUMAN executes the reviewed non-replacing IAM change set, verifies live readback/trust/attachments/inventory, and reproduces custom/principal policy simulations. No edit, AWS call, apply, commit, push, or dispatch occurred.

TEST PASS — frozen #160 source candidate

I independently verified the exact uncommitted Architecture/Security-approved candidate. This is a source-only Tester verdict: no AWS call, apply, commit, push, merge, or #147 dispatch occurred or is authorized.

Frozen candidate / diff integrity

base/HEAD: 680c7c2ddc6e069f72cd5e8d5e638874178dbab7
isolated reconstructed candidate tree: ea2c111535246ed1b4ff7ce6fcde93dc50c6de44
binary diff SHA-256: 16f92a1089cc496b458d4225d8385e82a8ea67d5384d6dd26b3381a603ea1bdf
exact NUL-safe inventory (2): sandbox/dataops/template.github-actions.yaml; sandbox/dataops/tests/test_template_github_actions.py
template SHA-256: 2f5b6f37ac3d032c163e9ba0b637366d07ed831d39e23b7a7da250d80a7f6848
tests SHA-256: fe6bb8fb4e36307785f564fdd913c28f11f8533d2163bbe498c957eed5261275
final status contains only the two expected modified paths; no untracked path
same-fingerprint Architecture PASS: Add reset version listing and isolate drift reads from the inline deploy policy #160 (comment)
same-fingerprint Security PASS: Add reset version listing and isolate drift reads from the inline deploy policy #160 (comment)

Tree reconstruction used an isolated /tmp clone, checkout of the accepted base, piping git diff --binary 680c7c2... -- into git apply --index -, then git write-tree; it produced the exact pinned tree without changing the review worktree. Removing only the parsed reset-evidence statement makes the complete candidate template deep-equal to git show 680c7c2...:sandbox/dataops/template.github-actions.yaml.

Exact policy verification

PASS. SponsorResetEvidenceListVersions is immediately after SponsorWorkerEventSourceMapping and before SponsorSesEventInvokeConfig, only in SponsorCommunicationsComputeDeployPolicy. The Sid and s3:ListBucketVersions each occur exactly once across all IAM documents. The statement contains only Sid, Effect: Allow, the one-item action list, the exact scalar resolved bucket arn:aws:s3:::aws-sam-cli-managed-default-samclisourcebucket-dgwncwijmnpd, and the simultaneous conditions StringEquals aws:RequestedRegion=eu-west-1 plus StringLike s3:prefix=dataops-v1/private/sponsor-crm-reset/v1/*.

Parsed base reconstruction and the one-hunk template diff prove no pre-existing action/resource/condition, SamArtifacts permission (including its existing s3:DeleteObject), trust, parameter, role, managed policy, or attachment changed. The isolated statement grants none of s3:ListBucket, s3:GetObject, s3:PutObject, s3:DeleteObject, s3:DeleteObjectVersion, s3:DeleteBucket, s3:PutBucketVersioning, s3:PutBucketPolicy, s3:PutLifecycleConfiguration, s3:*, or a non-S3 action. Whole-role coverage separately preserves the pre-existing deploy-role s3:DeleteObject result and confirms it is not attributed to #160.

Independent allow matrix: 4/4 passed for the exact bucket and eu-west-1, covering the fixed root, run descendant, intent exact-key descendant, and completion exact-key descendant. Independent deny matrix: 15/15 passed for missing region, missing prefix, eu-central-1, us-east-1, empty prefix, private parent, reset parent, root without slash, v10, sibling v2, traversal-like prefix, another bucket, wildcard bucket, object ARN, and Resource: "*".

Independent supplemental mutation probe: 37/37 rejected, covering missing/duplicate/renamed/moved statement; duplicate/scalar action and list resource drift; inline/service/dispatcher/observability/new-policy/new-role homes; parameterized/wildcard/object/alternate/* resource; missing/IfExists/alternate/multiple region and prefix conditions; parent/sibling/multiple prefix; extra action/resource/condition; NotAction/NotResource; environment subject/parameter; StringLike trust; and attachment drift. The full suite also preserves the existing #129/#130/#135/#138/#149 regressions.

Canonical evidence independently reproduced:

compute: 4210 / 406aee316f5428eb56b7a689ac9aa94ccc23cd68fa5b6cb1661c6c017af91cac; headroom 910 under project ceiling and 1,934 under AWS quota
inline: 9551 / 8f686d8da8ea0d4db660f9c6828630f21d1ac2dcff6c3de26fb8556874f1ce59
service: 1093 / 30aaa91aa6e00e19e7a04b35c4194075d4e881123e1727093a9001fa4f5dd952
dispatcher: 1510 / d705db32ea1786480f149d63916723b22232dad078f0e7710c0984fb31daf313
observability: 5369 / 435213eed7933be4ae303aae1b14ef72f09a42a4a6cf2c1f6fa99706455b827f
OIDC trust: 386 / a4fb561e9b54a2418b750fdc84e0c7ddd7856305fd791d615d40aa85174e68bf, exact DataTalksClub/dataops, main ref, sts.amazonaws.com
inventory/attachments: one inline policy, four managed policies attached only to GitHubActionsDeployRole, six managed-policy attachment slots free

Commands and results

PYTHONDONTWRITEBYTECODE=1 uv run --with pytest python -m pytest sandbox/dataops/tests/test_template_github_actions.py::SponsorResetEvidenceListVersionsPolicyTest -q → exit 0; 10 passed, 82 subtests passed
PYTHONDONTWRITEBYTECODE=1 uv run --with pytest python -m pytest sandbox/dataops/tests/test_template_github_actions.py -q -k "Sponsor or ResetEvidence or ListBucketVersions" → exit 0; 35 passed, 49 deselected, 143 subtests passed
PYTHONDONTWRITEBYTECODE=1 uv run --with pytest python -m pytest sandbox/dataops/tests -q → exit 0; 84 passed, 271 subtests passed
sam validate --lint --template-file sandbox/dataops/template.github-actions.yaml → exit 0; valid SAM template
uvx ruff check --select E4,E7,E9,F sandbox/dataops/tests/test_template_github_actions.py → exit 0; all checks passed
PYTHONPYCACHEPREFIX=/tmp/dataops-160-pycache python -m py_compile sandbox/dataops/tests/test_template_github_actions.py → exit 0
git diff --check 680c7c2ddc6e069f72cd5e8d5e638874178dbab7 → exit 0
git diff --binary 680c7c2ddc6e069f72cd5e8d5e638874178dbab7 -- | sha256sum → exit 0; exact pinned SHA-256

No UI changed; screenshots are not required.

Pending gates

Next source gates are PM source acceptance, accepted two-path commit with Refs DataTalksClub/dataops#160, local-main integration/push, and On-Call monitoring. HUMAN-only gates remain fully pending: credentialed terminal-stack/change-set review showing exactly one non-replacing compute-policy PolicyDocument modification; execution to UPDATE_COMPLETE plus live default-version readback/fingerprint/trust/attachment/inventory/drift verification; official custom-policy and deploy-role principal-policy simulations reproducing all positive/negative cases; and PM acceptance of that HUMAN evidence. #147 remains blocked for every dispatch until those gates complete.

PM REJECTED — current upstream invalidates the frozen source acceptance contract

I cannot accept #160 for source commit on the previously reviewed fingerprint.

The worktree still exactly matches the reviewed candidate: base 680c7c2ddc6e069f72cd5e8d5e638874178dbab7, tree ea2c111535246ed1b4ff7ce6fcde93dc50c6de44, binary diff SHA-256 16f92a1089cc496b458d4225d8385e82a8ea67d5384d6dd26b3381a603ea1bdf, exactly the two authorized paths, and the reviewed file hashes. Architecture, Security, and Tester therefore remain valid evidence for that old-base candidate only.

Authoritative DataTalksClub/aws-infra origin/main is now 6c21d2d86898e1b545bf8892114e9ee0f2dc3992. It descends from 680c7c2 and changes the same template path by adding only:

cloudformation:DetectStackDrift
cloudformation:DetectStackResourceDrift
cloudformation:BatchDescribeTypeConfigurations

A read-only three-way composition of the frozen #160 template with 6c21d2d is textually conflict-free, but it is a new, unreviewed source identity. Its template SHA-256 is 7bdf8118966902a009f785ba8c63275cb37e09caf3bff39f329ed57290d5fb95, not the reviewed 2f5b6f37.... The composed inline policy is exactly 9,676 / 8204c3f419a14dfaa14d9d46189d925360725783ab8454a1fd837f081c255541, not the required 9,551 / 8f686d8d.... That is 76 characters above the issue’s 9,600 project ceiling and leaves only 564 characters below the 10,240 AWS inline-policy quota, below the tested 640-character safety floor. The #160 tests still pin the old template SHA, old inline fingerprint, 9,551 size, and quota headroom, so the relevant canonical/quota/full-suite evidence does not transfer to the composed source.

The #160 statement itself still composes to the required compute fingerprint 4,210 / 406aee31..., and trust remains 386 / a4fb561e.... That is insufficient to waive the failures: the acceptance criteria also require preservation of the exact inline boundary, current-base reconstruction, passing canonical/quota tests, and Architecture/Security/Tester/PM review of one frozen identity. HUMAN apply/readback/simulation remains pending and #147 remains blocked for every dispatch.

Exact bounded next steps

Do not commit or integrate the frozen candidate. Do not call AWS, apply CloudFormation, or dispatch Add a reviewed one-time reset path for the disposable sandbox Sponsor table #147.
PM/Architecture/Security must resolve the new authoritative baseline before implementation resumes. Regroom Add reset version listing and isolate drift reads from the inline deploy policy #160 against exact 6c21d2d or a newer explicitly frozen origin/main, and specify how the upstream inline-policy ceiling/headroom regression is resolved. Merely changing expected hashes to bless 9,676/564 is not acceptable under the current contract.
Software Engineer then reconstructs the Add reset version listing and isolate drift reads from the inline deploy policy #160 work in a fresh clean isolated worktree from that approved current base, preserving only the exact two authorized paths and the sole Add reset version listing and isolate drift reads from the inline deploy policy #160 SponsorResetEvidenceListVersions permission delta. Update deterministic tests only to the newly approved baseline; do not erase the three upstream recovery actions or broaden Add reset version listing and isolate drift reads from the inline deploy policy #160.
Freeze a new base, NUL-safe two-path inventory, candidate tree, full-index binary diff hash, file hashes, policy/trust/inventory fingerprints, and quota evidence. Prove that removing only the Add reset version listing and isolate drift reads from the inline deploy policy #160 statement reconstructs that approved authoritative base.
Run the full required focused and sandbox/dataops suites, SAM lint, Ruff, compilation, fingerprint/quota/mutation checks, and git diff --check.
Re-run Architecture and Security/IAM, then Tester, then PM source acceptance on that exact new uncommitted fingerprint. Only after all PASS may SWE commit the accepted two paths with Refs DataTalksClub/dataops#160.
Keep the issue open after source integration; the three HUMAN change-set/apply/readback/simulation gates and final PM HUMAN acceptance remain required.

No source file, Git state, AWS resource, workflow, stack, commit, push, apply, or dispatch was changed or invoked by this PM review.

PM REGROOMED — current-base source contract is agent-ready

#160 is rewritten against exact aws-infra origin/main 6c21d2d86898e1b545bf8892114e9ee0f2dc3992; the rejected 680c7c2 candidate and its reviews remain historical only.

The smallest safe shape is now pinned to the same two authorized paths:

relocate the three already-required CloudFormation drift-read actions out of the overflowing inline policy into one dedicated DataOpsCloudFormationDriftReadPolicy attached only to the existing deploy role;
restrict the two detect actions to the exact DataOps stack ARN and BatchDescribeTypeConfigurations to Resource: "*" with exact aws:RequestedRegion=eu-west-1;
add only the original exact-prefix SponsorResetEvidenceListVersions statement to Sponsor compute.

Deterministic resolved outcomes are pinned in the issue: inline returns to 9,551 / 8f686d8d..., the new drift policy is 476 / 43299fce..., Sponsor compute becomes 4,210 / 406aee31..., all other policy/trust fingerprints remain unchanged, and inventory becomes one inline plus five deploy-role-only managed policies with five attachment slots free. The final raw file hashes, candidate tree, and binary diff hash are deliberately left for SWE to derive and freeze from the actual uncommitted implementation.

The spec includes exact reverse reconstruction to 6c21d2, drift/reset allow-deny and mutation matrices, same-fingerprint Architecture/Security/Tester/PM gates, Refs source integration, and fail-closed HUMAN change-set/apply/readback/custom-plus-principal simulation gates. It handles either exact known live baseline: if interim 6c21d2 was already applied, the role inline change may remove only the three relocated actions; if live remains #149, the role inline document is already the final fingerprint and must have no semantic change.

Labels remain bug, infra, testing, data, P1; status is pending and the exact next owner is Software Engineer in a fresh clean isolated aws-infra worktree from fetched current origin/main.

Every #147 dispatch remains blocked. No source file, Git state, AWS resource, stack, workflow, commit, push, apply, or dispatch was changed or invoked during regrooming.

Software Engineer handoff — regroomed #160 candidate ready for Architecture/Security/IAM

Implemented the exact current-base two-path aws-infra candidate without commit, push, PR, AWS call, CloudFormation apply, workflow dispatch, or #147 dispatch.

Frozen uncommitted candidate

freshly fetched authoritative base / worktree HEAD / local origin/main: 6c21d2d86898e1b545bf8892114e9ee0f2dc3992
branch/worktree: worktree-agent-160-v2 at /home/alexey/git/aws-infra/.tmp/worktrees/issue-160-v2
candidate tree from an isolated temporary index: 4eb33216dbb2b2a49e3489685be80e55d59a8ead
full-index binary diff SHA-256: dbd24347b229176ca284cba19ecacd5f38df3f779de0b481d72ea655f8f538f7
exact NUL-safe inventory (2):
- sandbox/dataops/template.github-actions.yaml
- sandbox/dataops/tests/test_template_github_actions.py
raw file SHA-256:
- template: 6bd69bdd20da97f2b2342100bfbaa6c01abe4628849826b6cc592e7ccc0cce1e
- tests: cea4200abf632482d5b3e25b4662850dd5034f1a9a92eb7f00a3265b91835635

The template removes only the three already-shipped drift-read actions from their original inline statements, adds the pinned DataOpsCloudFormationDriftReadPolicy immediately after the deploy role and attached only to that role, and adds the pinned SponsorResetEvidenceListVersions statement immediately between the worker event-source-mapping and SES invoke-config statements. No other source path or permission surface changed.

Exact policy, trust, inventory, and reconstruction evidence

inline: 9,551 / 8f686d8da8ea0d4db660f9c6828630f21d1ac2dcff6c3de26fb8556874f1ce59; 49 below project ceiling, 689 below AWS quota
drift read: 476 / 43299fce7e37ade4ec7de613e6b4dc90ad55e48273c43c61850e1a835a354cde
Sponsor compute: 4,210 / 406aee316f5428eb56b7a689ac9aa94ccc23cd68fa5b6cb1661c6c017af91cac; 910 below project ceiling, 1,934 below AWS quota
Sponsor service: 1,093 / 30aaa91aa6e00e19e7a04b35c4194075d4e881123e1727093a9001fa4f5dd952
dispatcher: 1,510 / d705db32ea1786480f149d63916723b22232dad078f0e7710c0984fb31daf313
observability: 5,369 / 435213eed7933be4ae303aae1b14ef72f09a42a4a6cf2c1f6fa99706455b827f
OIDC trust: 386 / a4fb561e9b54a2418b750fdc84e0c7ddd7856305fd791d615d40aa85174e68bf; exact DataTalksClub/dataops, main ref, and sts.amazonaws.com
inventory: one inline policy and five managed policies; every managed policy attaches only to GitHubActionsDeployRole; five attachment slots free
each of DetectStackDrift, DetectStackResourceDrift, BatchDescribeTypeConfigurations, and s3:ListBucketVersions occurs exactly once in its pinned policy/Sid
parsed reverse reconstruction is exact: removing reset listing, deleting only the drift policy, and restoring the three actions to their exact original inline positions deep-equals the authoritative 6c21d2d template
authoritative parsed base fingerprint: 24,022 / 9e1cf60fa1aa2664f2e50adc23571c4cde39dcbbe1ac536886b32ee3327d0831

Deterministic matrices and mutation evidence

drift stack matrix: 2 allows / 14 denies across both detect actions and exact/other-stack/other-region/other-account/transform/change-set/object-like/* resources
type-configuration matrix: 1 allow / 3 denies for exact, missing, and alternate requested regions; policy-shape mutations reject every non-* or list resource
reset matrix: 4 allows / 15 denies covering root/run/intent/completion descendants and every pinned near-match/context/resource negative
isolated-action negatives: drift policy 10/10 denied for CloudFormation writes plus S3/IAM/non-CloudFormation actions; reset statement 11/11 denied for unlisted S3 and non-S3 actions
whole-role coverage keeps all three drift reads effective exactly once and separately preserves the unrelated pre-existing s3:DeleteObject result while denying s3:DeleteObjectVersion
focused drift/reset mutation selection: 10 passed, 85 deselected, 107 subtests passed; covers identity, placement/home, action/resource scalar/list, condition operator/key/value/list, trust, attachment, IAM/resource inventory, parameter/environment/secret, and prior boundary drift

Verification

PYTHONDONTWRITEBYTECODE=1 uv run --with pytest python -m pytest sandbox/dataops/tests/test_template_github_actions.py -q -k "Sponsor or ResetEvidence or ListBucketVersions or DriftRead or DetectStackDrift or BatchDescribeTypeConfigurations" → PASS; 46 passed, 49 deselected, 228 subtests passed
PYTHONDONTWRITEBYTECODE=1 uv run --with pytest python -m pytest sandbox/dataops/tests -q → PASS; 95 passed, 356 subtests passed
sam validate --lint --template-file sandbox/dataops/template.github-actions.yaml → PASS; valid SAM template
uvx ruff check --select E4,E7,E9,F sandbox/dataops/tests/test_template_github_actions.py → PASS
PYTHONPYCACHEPREFIX=.tmp/issue-160-v2-pycache python -m py_compile sandbox/dataops/tests/test_template_github_actions.py → PASS
git diff --check 6c21d2d86898e1b545bf8892114e9ee0f2dc3992 → PASS
screenshots: N/A; no UI changed

Exact next gates on this same uncommitted identity are Architecture and Security/IAM, then independent Tester verification, then PM source acceptance. All HUMAN change-set/apply/readback/simulation gates remain pending, and every #147 AWS dispatch remains blocked.

ARCHITECTURE PASS — regroomed current-base candidate

PASS on the exact uncommitted aws-infra candidate:

base / HEAD / local origin/main: 6c21d2d86898e1b545bf8892114e9ee0f2dc3992
candidate tree: 4eb33216dbb2b2a49e3489685be80e55d59a8ead
full-index binary diff SHA-256: dbd24347b229176ca284cba19ecacd5f38df3f779de0b481d72ea655f8f538f7
exact changed inventory: sandbox/dataops/template.github-actions.yaml and sandbox/dataops/tests/test_template_github_actions.py
template SHA-256: 6bd69bdd20da97f2b2342100bfbaa6c01abe4628849826b6cc592e7ccc0cce1e
tests SHA-256: cea4200abf632482d5b3e25b4662850dd5034f1a9a92eb7f00a3265b91835635

The architecture matches the regroomed current-base contract. The three pre-existing CloudFormation drift-read actions move out of the over-ceiling inline policy without loss or broadening and occur exactly once in the single new DataOpsCloudFormationDriftReadPolicy, attached only to the existing GitHubActionsDeployRole. The two detect actions are limited to the exact resolved DataOps stack ARN; BatchDescribeTypeConfigurations remains the required wildcard-resource action but is conjunctively restricted to StringEquals aws:RequestedRegion=eu-west-1. The inline policy returns to the pinned 9,551 / 8f686d8d... boundary.

The only newly granted action relative to the base is s3:ListBucketVersions, exactly once in SponsorCommunicationsComputeDeployPolicy, on the exact SAM bucket with simultaneous aws:RequestedRegion=eu-west-1 and s3:prefix=dataops-v1/private/sponsor-crm-reset/v1/* constraints. It adds no object/version deletion, object read/write, bucket mutation, or broader S3 capability. Sponsor compute resolves to 4,210 / 406aee31... with the pinned quota headroom.

The final inventory is one inline policy plus five managed policies, all attached only to the existing deploy role, leaving five attachment slots. Existing service, dispatcher, observability, and OIDC trust fingerprints remain pinned; trust stays limited to DataTalksClub/dataops, refs/heads/main, and sts.amazonaws.com. No role, environment, secret, parameter, bucket, runtime, or source-repository coupling is introduced. Parsed reverse reconstruction removes the reset statement, deletes the one drift policy, restores the three actions to their original inline positions, and deep-equals authoritative 6c21d2d.

Independent read-only verification:

focused drift/reset/policy/mutation selection: 46 passed, 49 deselected, 228 subtests passed
sam validate --lint: PASS
git diff --check: PASS
candidate identity and both raw file hashes rechecked after validation

This is source-only Architecture approval. HUMAN credentialed change-set review, apply to UPDATE_COMPLETE, live readback/fingerprint/trust/attachment/inventory/drift checks, official custom-policy and deploy-role principal-policy simulations, and final PM HUMAN acceptance all remain pending. Every #147 dispatch remains blocked. No source edit, commit, push, AWS call, CloudFormation operation, workflow dispatch, or #147 dispatch was performed by this review.

SECURITY PASS — regroomed frozen #160 source candidate

PASS is bound only to this exact uncommitted identity:

base/worktree HEAD: 6c21d2d86898e1b545bf8892114e9ee0f2dc3992
candidate tree: 4eb33216dbb2b2a49e3489685be80e55d59a8ead
full-index binary diff SHA-256: dbd24347b229176ca284cba19ecacd5f38df3f779de0b481d72ea655f8f538f7
exact NUL-safe inventory: sandbox/dataops/template.github-actions.yaml; sandbox/dataops/tests/test_template_github_actions.py
template SHA-256: 6bd69bdd20da97f2b2342100bfbaa6c01abe4628849826b6cc592e7ccc0cce1e
tests SHA-256: cea4200abf632482d5b3e25b4662850dd5034f1a9a92eb7f00a3265b91835635

Least privilege and negative space

The only newly granted action relative to 6c21d2d is s3:ListBucketVersions. It occurs once, only in SponsorResetEvidenceListVersions, on the exact scalar SAM bucket ARN. StringEquals aws:RequestedRegion=eu-west-1 and StringLike s3:prefix=dataops-v1/private/sponsor-crm-reset/v1/* are conjunctive. The fixed trailing-slash root and its descendants allow; missing/alternate region or prefix, empty/parent/root-without-slash/v10/sibling/traversal-like prefixes, another/wildcard bucket, object ARN, and Resource: "*" deny under the isolated statement. Pagination remains within the same authorization boundary only while the caller reuses that exact prefix, which the deterministic matrix covers.

This matches AWS's bucket-level API mapping: ListObjectVersions requires s3:ListBucketVersions, and AWS documents that this action supports s3:prefix. The statement grants metadata listing only; it adds no object/version get, put, copy, multipart, delete, ACL/tagging, presign, bucket-policy/versioning/lifecycle/configuration, or other bucket mutation permission. The unrelated pre-existing inline SamArtifacts s3:DeleteObject permission is unchanged and is not attributed to #160; s3:DeleteObjectVersion remains absent and denied by the tested whole-role boundary.

The three already-required CloudFormation drift actions remain effective exactly once after relocation. DetectStackDrift and DetectStackResourceDrift are isolated to the exact resolved stack ARN arn:aws:cloudformation:eu-west-1:817685572750:stack/dataops-v1/*; AWS's service-authorization table marks stack as the required resource type for both. Other stack, region, account, transform, change-set, object-like, and wildcard resources deny. BatchDescribeTypeConfigurations has no supported resource type, so the required Resource: "*" is narrowed by exact StringEquals aws:RequestedRegion=eu-west-1; missing/alternate region denies. The isolated managed policy grants no CloudFormation create/update/delete/execute/change-set action and no S3, IAM, Lambda, or other-service action. No existing CloudFormation mutation action or resource was added, moved, removed, or broadened.

OIDC trust is parsed-equal to base and remains exact DataTalksClub/dataops, refs/heads/main, audience sts.amazonaws.com, using StringEquals; there is no alternate repo/ref/audience, wildcard/environment subject, new assumption path, or sts:AssumeRole workaround.

Inventory, quotas, reconstruction, and tests

Independent canonical reproduction matches all pinned values:

inline: 9,551 / 8f686d8da8ea0d4db660f9c6828630f21d1ac2dcff6c3de26fb8556874f1ce59 — 49 below project ceiling, 689 below AWS quota
drift read: 476 / 43299fce7e37ade4ec7de613e6b4dc90ad55e48273c43c61850e1a835a354cde
Sponsor compute: 4,210 / 406aee316f5428eb56b7a689ac9aa94ccc23cd68fa5b6cb1661c6c017af91cac — 910 below project ceiling, 1,934 below AWS quota
service: 1,093 / 30aaa91aa6e00e19e7a04b35c4194075d4e881123e1727093a9001fa4f5dd952
dispatcher: 1,510 / d705db32ea1786480f149d63916723b22232dad078f0e7710c0984fb31daf313
observability: 5,369 / 435213eed7933be4ae303aae1b14ef72f09a42a4a6cf2c1f6fa99706455b827f
trust: 386 / a4fb561e9b54a2418b750fdc84e0c7ddd7856305fd791d615d40aa85174e68bf

Inventory is exactly one retained inline policy plus five customer-managed policies. Every managed policy has only GitHubActionsDeployRole in Roles; there is no ManagedPolicyArns role attachment, fixed managed-policy name, other principal, role, IAM resource, parameter, environment, secret, or tag. Five of the default ten managed-policy attachment slots remain, and every managed policy is below the 6,144-character IAM limit. The parsed reverse operation—remove reset listing, delete only the drift policy, and restore the three actions to their original inline positions—deep-equals the authoritative 6c21d2d template.

Independent local verification, with no AWS call:

focused drift/reset selection: 46 passed, 49 deselected, 228 subtests passed
full sandbox/dataops suite: 95 passed, 356 subtests passed
focused rejection/mutation selection: 10 passed, 85 deselected, 107 subtests passed
SAM lint: PASS
Ruff E4,E7,E9,F: PASS
git diff --check 6c21d2d...: PASS

No pre-existing test function was removed. The evaluator now requires simultaneous StringEquals and StringLike; exact policy fingerprints, whole-template/base reconstruction, action occurrence, resource/condition scalar-vs-list shape, policy home/order, IAM inventory/attachments, OIDC trust, parameter/environment/secret, quota, and prior #129/#130/#135/#138/#149 boundaries reject the named unauthorized mutations.

Gate remains closed

This is source-only Security approval. It proves no live permission and authorizes no AWS call, CloudFormation operation, role assumption, workflow run, reset, or #147 dispatch. #147 remains blocked until the exact accepted source ships and a credentialed HUMAN records the live baseline, reviews a fresh non-replacing CAPABILITY_NAMED_IAM change set, applies only the allowed convergence to terminal UPDATE_COMPLETE, reads back exact live policy/trust/inventory/attachment/drift state, reproduces both custom-policy and deploy-role principal-policy positive/negative simulations, and PM accepts that evidence and closes #160. Any replacement, unrelated delta, trust/attachment/parameter/tag change, wrong fingerprint, or failed simulation must abort without dispatch.

No source edit, commit, push, AWS call, apply, role assumption, or workflow/#147 dispatch occurred during this review.

TEST PASS — regroomed frozen #160 source candidate

I independently verified every agent-verifiable source criterion on the exact same uncommitted candidate approved by Architecture and Security/IAM. This is source-only Tester approval: no source edit, commit, push, AWS call, CloudFormation operation, role assumption, workflow run, or #147 dispatch was performed or authorized.

Frozen identity and diff integrity

base / worktree HEAD / local origin/main: 6c21d2d86898e1b545bf8892114e9ee0f2dc3992
isolated-index candidate tree: 4eb33216dbb2b2a49e3489685be80e55d59a8ead
full-index binary diff SHA-256: dbd24347b229176ca284cba19ecacd5f38df3f779de0b481d72ea655f8f538f7
exact NUL-safe inventory (2):
- sandbox/dataops/template.github-actions.yaml
- sandbox/dataops/tests/test_template_github_actions.py
template SHA-256: 6bd69bdd20da97f2b2342100bfbaa6c01abe4628849826b6cc592e7ccc0cce1e
tests SHA-256: cea4200abf632482d5b3e25b4662850dd5034f1a9a92eb7f00a3265b91835635
base source hashes independently match the groomed contract: template d9678248...; tests eade8a77...
final status contains only the two expected tracked modifications and no untracked path
same-fingerprint Architecture PASS: Add reset version listing and isolate drift reads from the inline deploy policy #160 (comment)
same-fingerprint Security PASS: Add reset version listing and isolate drift reads from the inline deploy policy #160 (comment)

The template diff is exactly the specified relocation/addition: remove the two detect actions from inline CloudFormationDataOpsStack, remove the type-configuration action from inline CloudFormationRead, insert the pinned drift managed policy between the role and Sponsor compute, and insert the reset statement between SponsorWorkerEventSourceMapping and SponsorSesEventInvokeConfig. A parsed reverse operation removing reset listing, deleting only the drift policy, and restoring the three actions at their exact original positions deep-equals authoritative 6c21d2d. The independently reproduced authoritative parsed base fingerprint is 24,022 / 9e1cf60fa1aa2664f2e50adc23571c4cde39dcbbe1ac536886b32ee3327d0831.

Acceptance-criterion evidence

PASS — policy identity, shape, placement, actions, resources, and conditions are exact. Each of DetectStackDrift, DetectStackResourceDrift, BatchDescribeTypeConfigurations, SponsorResetEvidenceListVersions, and s3:ListBucketVersions occurs exactly once in the pinned policy/Sid. DataOpsCloudFormationDriftReadPolicy is the only new IAM resource and has only the pinned Type, description, two-statement document, and Roles: [GitHubActionsDeployRole]. The reset statement has only the pinned one-action list, scalar SAM bucket, exact StringEquals region and conjunctive StringLike prefix.

PASS — independent global action-multiset comparison against base reports only + s3:ListBucketVersions: 1, with no removed action. SamArtifacts, including pre-existing s3:DeleteObject, is parsed-equal to base. Parameters and OIDC trust are parsed-equal to base. No role property, ManagedPolicyArns, environment, secret, parameter, tag, fixed managed-policy name, other attachment/principal, or unrelated IAM resource appears.

PASS — exact deterministic matrices:

drift stack: 2 allows / 14 denies. Both detect actions allow only arn:aws:cloudformation:eu-west-1:817685572750:stack/dataops-v1/<id>; for each action, other stack, other region, other account, Serverless transform, change-set ARN, object-like stack descendant, and * deny.
type configuration: 1 allow / 3 denies. BatchDescribeTypeConfigurations allows only wildcard resource with aws:RequestedRegion=eu-west-1; missing region, eu-central-1, and us-east-1 deny. Mutation coverage rejects every non-* and list resource shape.
reset: 4 allows / 15 denies. Allows exact trailing-slash root, run descendant, intent descendant, and completion descendant on the exact bucket/region. Denies missing region, missing prefix, two alternate regions, empty prefix, private parent, reset parent, root without slash, v10, sibling v2, traversal-like prefix, another bucket, wildcard bucket, object ARN, and Resource: "*".
isolated drift policy: 10/10 denied for create/update/delete stack, create/execute/delete change set, S3 list/get, IAM pass-role, and Lambda get.
isolated reset statement: 11/11 denied for ListBucket, object get/put/delete/delete-version, bucket delete/versioning/policy/lifecycle, s3:*, and a non-S3 action.
whole-role checks retain each required drift read exactly once, preserve the unrelated pre-existing s3:DeleteObject result, and deny s3:DeleteObjectVersion.

PASS — the evaluator requires every simultaneous StringEquals and StringLike operator/key to match and retains existing region/resource regression coverage. Focused rejection selection killed all named identity/home/order, scalar/list, action/resource, condition operator/key/value/list, attachment, IAM inventory, parameter/environment/secret, trust, and prior-boundary mutations: 10 tests passed, 107 mutation subtests passed. AST comparison confirms all 74/74 pre-existing test methods remain and 21 focused methods were added.

PASS — canonical values independently reproduced:

inline: 9,551 / 8f686d8da8ea0d4db660f9c6828630f21d1ac2dcff6c3de26fb8556874f1ce59 — 49 below project ceiling; 689 below AWS quota
drift read: 476 / 43299fce7e37ade4ec7de613e6b4dc90ad55e48273c43c61850e1a835a354cde
Sponsor compute: 4,210 / 406aee316f5428eb56b7a689ac9aa94ccc23cd68fa5b6cb1661c6c017af91cac — 910 below project ceiling; 1,934 below AWS quota
Sponsor service: 1,093 / 30aaa91aa6e00e19e7a04b35c4194075d4e881123e1727093a9001fa4f5dd952
dispatcher: 1,510 / d705db32ea1786480f149d63916723b22232dad078f0e7710c0984fb31daf313
observability: 5,369 / 435213eed7933be4ae303aae1b14ef72f09a42a4a6cf2c1f6fa99706455b827f
OIDC trust: 386 / a4fb561e9b54a2418b750fdc84e0c7ddd7856305fd791d615d40aa85174e68bf — exact DataTalksClub/dataops, refs/heads/main, sts.amazonaws.com, StringEquals
inventory: exactly one inline policy plus five managed policies, each attached only to GitHubActionsDeployRole; five default attachment slots remain; all managed policies are below the 6,144-character AWS limit

Commands and results

PYTHONDONTWRITEBYTECODE=1 uv run --with pytest python -m pytest sandbox/dataops/tests/test_template_github_actions.py -q -k "Sponsor or ResetEvidence or ListBucketVersions or DriftRead or DetectStackDrift or BatchDescribeTypeConfigurations" → exit 0; 46 passed, 49 deselected, 228 subtests passed
PYTHONDONTWRITEBYTECODE=1 uv run --with pytest python -m pytest sandbox/dataops/tests -q → exit 0; 95 passed, 356 subtests passed
PYTHONDONTWRITEBYTECODE=1 uv run --with pytest python -m pytest sandbox/dataops/tests/test_template_github_actions.py -q -k "(DriftRead or ResetEvidence) and rejects" → exit 0; 10 passed, 85 deselected, 107 subtests passed
sam validate --lint --template-file sandbox/dataops/template.github-actions.yaml → exit 0; valid SAM template
uvx ruff check --select E4,E7,E9,F sandbox/dataops/tests/test_template_github_actions.py → exit 0; all checks passed
PYTHONPYCACHEPREFIX=.tmp/tester-160-v2-pycache python -m py_compile sandbox/dataops/tests/test_template_github_actions.py → exit 0; generated cache was removed after the check
git diff --check 6c21d2d86898e1b545bf8892114e9ee0f2dc3992 → exit 0
git diff --full-index --binary 6c21d2d86898e1b545bf8892114e9ee0f2dc3992 -- | sha256sum → exit 0; exact frozen diff hash
independent read-only Ruby-YAML/Python canonical probe → exit 0; reverse reconstruction, global action delta, exact shapes, matrices, fingerprints, quotas, trust, inventory, and attachments all matched the results above

Screenshots: N/A — only CloudFormation source and tests changed; there is no UI page or flow.

Gate remains closed

The next source gate is PM source acceptance on this exact fingerprint. Only after that acceptance may SWE commit only the two accepted paths with Refs DataTalksClub/dataops#160, followed by normal local-main integration/push and On-Call monitoring. Source integration is not live activation.

All HUMAN gates remain pending and mandatory: credentialed terminal-baseline capture and fresh non-replacing CAPABILITY_NAMED_IAM change-set review; exact allowed convergence only; execution to UPDATE_COMPLETE; exact live policy/trust/attachment/inventory/drift readback; official custom-policy simulations for both isolated matrices; official deploy-role principal-policy simulations for positive and negative cases; and final PM HUMAN acceptance. Any replacement, unrelated delta, wrong fingerprint, wrong attachment/trust/parameter/tag, or failed simulation must abort. s3:DeleteObject must be recorded as unchanged pre-existing behavior; no sts:AssumeRole or trust weakening is allowed for testing.

Every #147 AWS dispatch remains blocked. #160 itself dispatches nothing, and source Tester PASS authorizes no AWS call, apply, role assumption, or reset.

PM ACCEPTED — regroomed #160 source candidate

All agent-verifiable source criteria PASS on the exact same uncommitted identity approved by Architecture, Security/IAM, and Tester:

base / HEAD / current authoritative origin/main: 6c21d2d86898e1b545bf8892114e9ee0f2dc3992
candidate tree: 4eb33216dbb2b2a49e3489685be80e55d59a8ead
full-index binary diff SHA-256: dbd24347b229176ca284cba19ecacd5f38df3f779de0b481d72ea655f8f538f7
exact two-path inventory:
- sandbox/dataops/template.github-actions.yaml
- sandbox/dataops/tests/test_template_github_actions.py
template SHA-256: 6bd69bdd20da97f2b2342100bfbaa6c01abe4628849826b6cc592e7ccc0cce1e
tests SHA-256: cea4200abf632482d5b3e25b4662850dd5034f1a9a92eb7f00a3265b91835635

I rechecked the worktree status, remote base, stored candidate tree, full binary diff, raw file hashes, template diff, parsed policy inventory, reverse reconstruction, action multiset, and canonical fingerprints after the Tester verdict. The identity is unchanged and contains no untracked path.

Product/source acceptance

PASS — the over-ceiling inline policy returns exactly to 9,551 / 8f686d8da8ea0d4db660f9c6828630f21d1ac2dcff6c3de26fb8556874f1ce59. The three separately required drift-read actions are not lost or broadened: each occurs exactly once in the pinned 476 / 43299fce7e37ade4ec7de613e6b4dc90ad55e48273c43c61850e1a835a354cde DataOpsCloudFormationDriftReadPolicy, attached only to the existing deploy role. Both detect actions are exact-stack-only; the wildcard-resource type-configuration read is limited to aws:RequestedRegion=eu-west-1.

PASS — the only net IAM action addition relative to authoritative base is exactly one s3:ListBucketVersions. It is isolated in SponsorResetEvidenceListVersions under Sponsor compute, on the exact SAM bucket with conjunctive exact region and dataops-v1/private/sponsor-crm-reset/v1/* prefix conditions. Sponsor compute is exactly 4,210 / 406aee316f5428eb56b7a689ac9aa94ccc23cd68fa5b6cb1661c6c017af91cac. No object/version deletion, object read/write, bucket mutation, CloudFormation write expansion, or unrelated permission is introduced.

PASS — service, dispatcher, observability, and OIDC trust fingerprints are unchanged. Trust remains exact DataTalksClub/dataops, refs/heads/main, sts.amazonaws.com, and StringEquals. Inventory is exactly one inline policy plus five managed policies, every managed policy attaches only to GitHubActionsDeployRole, and five attachment slots remain. There is no new role, fixed managed-policy name, ManagedPolicyArns, environment, secret, parameter, tag, other principal, or assumption path.

PASS — the parsed reverse operation removes the reset statement, deletes only the dedicated drift policy, restores the three drift actions at their exact original inline positions, and deep-equals 6c21d2d. Independent action comparison reports only + s3:ListBucketVersions: 1, with no removed action. SamArtifacts, including its unrelated pre-existing s3:DeleteObject, remains unchanged; s3:DeleteObjectVersion remains denied by the tested whole-role boundary.

PASS — same-fingerprint review and verification are complete:

Architecture PASS: Add reset version listing and isolate drift reads from the inline deploy policy #160 (comment)
Security/IAM PASS: Add reset version listing and isolate drift reads from the inline deploy policy #160 (comment)
Tester PASS: Add reset version listing and isolate drift reads from the inline deploy policy #160 (comment)
focused drift/reset workflow: 46 passed, 49 deselected, 228 subtests passed
full sandbox/dataops workflow: 95 passed, 356 subtests passed
focused rejection coverage: 10 passed, 85 deselected, 107 mutation subtests passed
SAM lint, Ruff, Python compilation, and git diff --check: PASS
screenshots: N/A; no UI changed

The exact drift, type-configuration, reset, isolated negative-action, whole-role, trust, quota, attachment, inventory, canonical fingerprint, and named mutation matrices satisfy the regroomed contract. From the operator perspective, this source shape restores deploy-policy headroom, preserves drift-aware recovery reads, and adds only the missing exact-prefix version-history metadata read needed by #147.

Source integration authorization and remaining gates

Software Engineer is authorized to commit exactly the two accepted paths above, unchanged, with Refs DataTalksClub/dataops#160. No other path, content change, commit reference, push, PR, AWS call, apply, role assumption, workflow dispatch, or #147 dispatch is authorized by this acceptance. Any candidate identity change invalidates this verdict and requires relevant re-review.

After the accepted source is integrated and pushed through the normal aws-infra local-main flow, add human and keep #160 open. Source integration is not live activation.

All HUMAN gates remain pending and mandatory before final PM closure:

A credentialed operator records the terminal live dataops-github-actions baseline and reviews a fresh non-replacing CAPABILITY_NAMED_IAM change set from the exact merged source. Only the issue-pinned convergence is allowed; any replacement or unrelated trust, attachment, parameter, tag, policy identity, or resource delta aborts.
Execute only that reviewed change set to UPDATE_COMPLETE, require no pending executable change set, and read back the exact live inline/drift/compute/service/dispatcher/observability/trust fingerprints, statement shapes, role identity, five exact attachments, IAM inventory, and stack drift state.
Run official custom-policy simulations for both isolated policies and official deploy-role principal-policy simulations for all pinned positive and negative cases. Record the unchanged pre-existing s3:DeleteObject result without attributing it to Add reset version listing and isolate drift reads from the inline deploy policy #160; do not add sts:AssumeRole or weaken trust for testing.
PM reviews and accepts that HUMAN evidence before closing Add reset version listing and isolate drift reads from the inline deploy policy #160.

Every #147 dispatch remains blocked until those HUMAN gates pass and PM closes #160. This source acceptance itself dispatches nothing and authorizes no AWS mutation.

No source edit, commit, push, AWS call, CloudFormation operation, apply, role assumption, workflow run, or #147 dispatch occurred during this PM review.

SOURCE SHIPPED — HUMAN activation remains

The accepted #160 source is now on DataTalksClub/aws-infra main:

accepted SWE commit: 261fa4466551710a87f13f0526761b4aa09df664
local integration merge: 9e1ff4f3f5d8456ed3426dfdc3f86d48d47b3c30
source base: 6c21d2d86898e1b545bf8892114e9ee0f2dc3992
accepted candidate tree: 4eb33216dbb2b2a49e3489685be80e55d59a8ead
exact inventory: the shared DataOps GitHub-actions template and its focused tests only

Source integration changes no live AWS policy. The issue remains open with human.

Exact remaining HUMAN gate:

A credentialed operator verifies the dataops-github-actions stack is terminal and creates a fresh CAPABILITY_NAMED_IAM change set from exact merged source.
Review proves the only changes are the accepted non-replacing managed-policy document/attachment effects: retain the three drift-read actions under their exact dedicated policy and add the exact bucket/prefix/region-bounded s3:ListBucketVersions statement. Any role, trust, unrelated policy/resource, replacement, tag, parameter, or broader permission aborts.
Execute only that reviewed change set; require UPDATE_COMPLETE, exact live default-version policy fingerprints, unchanged trust/inventory/attachments, and no pending executable candidate.
Run the groomed official custom-policy and deploy-role principal-policy simulations for all exact allow and negative cases.
PM reviews that sanitized activation/readback/simulation evidence and closes Add reset version listing and isolate drift reads from the inline deploy policy #160.

Every #147 workflow dispatch remains blocked until all five items pass. This source push authorizes no AWS apply or Sponsor reset phase.

ON-CALL PASS — source integration healthy; HUMAN activation still blocked

Inspected the exact pushed DataTalksClub/aws-infra main merge 9e1ff4f3f5d8456ed3426dfdc3f86d48d47b3c30.

Source identity PASS:

parents: authoritative base 6c21d2d86898e1b545bf8892114e9ee0f2dc3992 and accepted SWE commit 261fa4466551710a87f13f0526761b4aa09df664
merged tree: accepted candidate tree 4eb33216dbb2b2a49e3489685be80e55d59a8ead
changed paths: only sandbox/dataops/template.github-actions.yaml and sandbox/dataops/tests/test_template_github_actions.py

Push-workflow reconciliation PASS / expected no-run:

Active push workflow	Trigger result for exact SHA	Exact job outcome	Run URL
Deploy shared authentication	skipped by path filter; the merge changed neither `.github/workflows/deploy-shared-auth.yml` nor `sandbox/auth/**`	no run created; no jobs	none
Website Terraform CI	skipped by path filter; neither changed DataOps path matches its website/modules/policy/workflow filters	no run created; no jobs	none
Website Development Terraform	skipped by path filter; neither changed DataOps path matches its website/modules/policy/workflow filters	no run created; no jobs	none

Final GitHub reconciliation for this exact SHA at 2026-08-11T19:55:21Z: Actions push runs 0, check suites 0, check runs 0, legacy statuses 0. Therefore there are no run URLs or failing/pending/cancelled jobs to route. Classification: source integration PASS; CI non-execution is expected because aws-infra has no DataOps workflow matching these paths and does not deploy this stack through CI. This is not evidence of live permission or deployment.

#160 remains OPEN with human. The reviewed HUMAN gate is retained and is not replaced by this on-call pass: a credentialed operator must record the terminal live baseline; create and review the fresh non-replacing CAPABILITY_NAMED_IAM change set; execute only the accepted convergence; require UPDATE_COMPLETE and exact live readback with unchanged role/trust/inventory/attachments and no pending executable candidate; run the pinned official custom-policy plus deploy-role principal-policy positive/negative simulations; and obtain final PM acceptance before #160 closes.

Every #147 workflow/AWS dispatch remains blocked until that HUMAN evidence is accepted and #160 closes. No AWS call, CloudFormation apply, workflow dispatch, source edit, or workaround was performed.

ON-CALL PASS: accepted source is integrated; no matching push workflow ran; HUMAN activation remains pending.

Closing as obsolete after the completed Sponsor table reset and #174 cleanup. This issue existed only to grant drift-read/version-history support to the one-time reset evidence workflow. That workflow, its guards, and permanent reset machinery are now deleted; the Sponsor table is CloudFormation-owned, empty, ACTIVE, and has the four final ACTIVE indexes. No live application path needs these reset-only permissions, so no further IAM apply is warranted.

Add reset version listing and isolate drift reads from the inline deploy policy #160

Description

Add reset version listing and isolate drift reads from the inline deploy policy

Scope and current baseline

Exact source shape

1. Relocate the three existing drift-read actions

2. Add the reset evidence prerequisite

Acceptance criteria

Exact delta, boundaries, and fingerprints

Deterministic tests

Verification and same-fingerprint review

HUMAN activation, readback, and simulation

Required verification

Test scenarios

Drift reads survive relocation

Reset evidence exact prefix

Source ships but is not live

Effective prerequisite accepted

Rollback and out of scope

Activity

alexeygrigorev commented on Aug 11, 2026

PM GROOMED — exact version-history prerequisite is agent-ready

alexeygrigorev commented on Aug 11, 2026

Software Engineer handoff — #160 source candidate ready for Architecture/Security/IAM

Frozen candidate

Deterministic policy evidence

Verification

alexeygrigorev commented on Aug 11, 2026

ARCHITECTURE PASS — frozen #160 candidate

alexeygrigorev commented on Aug 11, 2026

SECURITY PASS — frozen #160 source candidate

alexeygrigorev commented on Aug 11, 2026

Frozen candidate / diff integrity

Exact policy verification

Commands and results

Pending gates

alexeygrigorev commented on Aug 11, 2026

PM REJECTED — current upstream invalidates the frozen source acceptance contract

Exact bounded next steps

alexeygrigorev commented on Aug 11, 2026

PM REGROOMED — current-base source contract is agent-ready

alexeygrigorev commented on Aug 11, 2026

Software Engineer handoff — regroomed #160 candidate ready for Architecture/Security/IAM

Frozen uncommitted candidate

Exact policy, trust, inventory, and reconstruction evidence

Deterministic matrices and mutation evidence

Verification

alexeygrigorev commented on Aug 11, 2026

ARCHITECTURE PASS — regroomed current-base candidate

alexeygrigorev commented on Aug 11, 2026

SECURITY PASS — regroomed frozen #160 source candidate

Least privilege and negative space

Inventory, quotas, reconstruction, and tests

Gate remains closed

alexeygrigorev commented on Aug 11, 2026

Frozen identity and diff integrity

Acceptance-criterion evidence

Commands and results

Gate remains closed

alexeygrigorev commented on Aug 11, 2026

PM ACCEPTED — regroomed #160 source candidate

Product/source acceptance

Source integration authorization and remaining gates

alexeygrigorev commented on Aug 11, 2026

SOURCE SHIPPED — HUMAN activation remains

alexeygrigorev commented on Aug 11, 2026

ON-CALL PASS — source integration healthy; HUMAN activation still blocked

alexeygrigorev commented on Aug 13, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions