release: promote AWSops 0.10.1 from dev to main

[Atom-oh]

Promote AWSops 0.10.1 from dev to main through the standing-branch release path. The unpublished 0.10.0 preparation and subsequent review hardening are consolidated into one 0.10.1 release by merged PR #141; no SQL migration checksum or dependency resolution was changed by that preparation.

Release-prepared source: 4134838c7c45a6e004f0d12a8be31e5c08018838. Main base: ab091a2d1c87c5be8d9e43d75553cec0342f4bf7. The simulated main merge tree equals the prepared dev tree.

This promotion includes accumulated account onboarding, cross-account EKS/inventory, topology/evidence and runtime-release work, dependency updates, documentation/blog source and evidence, regression fixes, and release metadata. An interactive Codex review examined authentication/ownership, account and region scope, IAM/frozen boundaries, graph data/partial evidence, migration immutability and release/deployment controls. It found no new blocking implementation defect in those reviewed areas. Independently rerun checks passed 493 targeted web tests, 417 Python policy/readiness/collector tests and six release-note tests; the 55 migrations already on main are byte-identical. This is a risk-focused direct review, not a claim that every line was manually inspected or that the automated AI workflow completed coverage.

The normal required AI check remains blocked by input size. The accumulated diff exceeds the automated review's 128 KiB admission bound, so that job does not invoke reviewers. Code review findings and this workflow capacity failure are separate. Existing ruleset protect-main-dev requires that AI check and grants no administrator bypass. No protection rule has been changed and no automated-review success has been fabricated. Any one-promotion replacement with an explicitly named direct-review status requires a separate policy-exception decision while retaining all other checks and restoring the normal protection afterward.

Before merging, verify this exact HEAD's current CodeQL, Merge Verify, Plan, dev-only main guard and deployment/runtime readiness. Production deployment and Terraform apply remain separately approved operations. Merge with a merge commit to preserve branch ancestry; only after an approved merge and confirmed protection state create annotated v0.10.1 on the actual main merge SHA and push that tag explicitly to samples. No release tag has been created by this preparation.

[github-actions]

🤖 AI Code Review (two independent reviewers)

Reviewer responses: none
⚠️ oversized lines (>50k chars) omitted from the reviewed diff in: blog/2026-09-awsops/images/appendix-a-private-edge.svg blog/2026-09-awsops/images/appendix-b-edge-auth.svg blog/2026-09-awsops/images/fig2a-interactive.svg blog/2026-09-awsops/images/fig2b-diagnosis.svg blog/2026-09-awsops/images/fig3-agentcore.svg blog/2026-09-awsops/images/fig4-workers.svg — no lens saw those lines; verify them manually.

Status: BLOCKED — input coverage incomplete; models were not called

Review input incomplete: diff exceeds 128 KiB; split the change or implement complete bounded review batches. No models were called; no code verdict is available.

---

Triggered by commit 4134838c7c45a6e004f0d12a8be31e5c08018838 · workflow: .github/workflows/pr-review.yml

[Atom-oh]

Direct release review — PR #137

Reviewed by Codex on 2026-09-20. This is an interactive, risk-focused code review,
not a successful execution of the automated AI Code Review workflow and not a claim
that every line of the accumulated diff was individually inspected.

Scope and candidate

• Promotion: samples/dev -> samples/main, PR release: promote AWSops 0.10.1 from dev to main #137.
• Application source reviewed: 87c2fbe.
• Main base: ab091a2.
• Release metadata follow-up: PR release: prepare AWSops 0.10.1 promotion metadata #141, reviewed candidate e5fcbb4, now merged into dev at 4134838.
• Candidate tree: 58054fb8b3797232e1687ea38df9ce61e66778b2.
• The simulated main merge tree equals the candidate tree. Main-only commits are
  earlier promotion merges and introduce no exclusive content relative to the merge base.
• Change inventory: 994 paths, including 51 changed API route files; large portions
  are tests, documentation, blog/diagram artifacts and generated documentation assets.

Assessment

No new merge-blocking implementation defect was found in the reviewed areas.
The previous inventory-scope and metric-key defects were corrected in #139. Review
pipeline corrections in #140 are also included; their successful latest-HEAD review
and CI results are preserved in the prior audit.

Authentication and authorization: examined changed route guards and the common auth
implementation. RS256/issuer/audience/token_use validation and session revocation
remain. Account onboarding and cluster registration writes require admin authority;
chat/report ownership remains sub-based with the explicitly allowed verified-email
migration path. The /api/db route is the documented edge-authenticated exception,
not a newly public data endpoint. Edge public-path/auth implementation is unchanged
by this promotion; Cognito self-signup remains closed.

Account/region boundaries: examined EKS context resolution, registration, role identity,
VPC lookup and inventory-summary scope. Disabled/unregistered member accounts and
ambiguous/contradictory selectors are rejected before member data access. Account and
region are part of cache/identity keys. Readiness probes require admin or the designated
verifier group and retain input, concurrency and cooldown bounds.

Data and topology: examined graph transaction/read paths, parameterized traversal and
inventory queries, redaction and partial/unknown evidence propagation. Graph reads
retain account/class scope, traversal/node bounds and explicit incomplete evidence;
a missing/partial source is not converted into a healthy result.

AWS/IaC boundaries: reviewed runtime-read scope, AgentCore IAM narrowing, private
migration capability and deployment conditions. Frozen mutation/remediation flags
remain disabled by default; no new application mutation path is enabled. Runtime
IAM moves away from broad AgentCore control actions toward explicit invocation/read
scopes. CI deployment/migration operations are operator workflows, not autonomous
application remediation. Main pushes can build images, but production rollout still
requires workflow_dispatch and the production environment. No infrastructure change
was applied by this review.

Migrations: all 55 SQL migrations already on main are byte-identical. The promotion
adds 12 SQL migrations rather than retagging or editing existing checksums. Automatic
migration safety and private migration/image-provenance controls remain; a main merge
is not approval to skip production migration or deployment prerequisites.

Release metadata: #140 landed after the 0.10.0 preparation, leaving its entry in
Unreleased. #141 prepares 0.10.1, aligns package/root lock versions and README, and
consolidates the unpublished 0.10.0 preparation and later review hardening into one dated 0.10.1 release in both languages. Dependency resolutions
and SQL migration contents are unchanged. Tag v0.10.1 belongs on the actual main merge
commit only after all approved prerequisites pass.

Verification

• 493 targeted web tests passed (17 files): auth, account registration/connection,
  onboarding, EKS scope and isolation, graph privacy/state/publication, VPC connectivity,
  readiness and changelog behavior.
• 417 Python policy/readiness/collector tests passed.
• Six changelog tests passed again after the version preparation.
• Version/lock consistency and unchanged dependency resolutions verified.
• Existing migration byte equality and prospective merge-tree equality verified.
• Earlier restricted local test runs stalled in subprocess fixtures; task-owned wrappers
  were stopped and the same suites passed with the required local subprocess access.
• On source 87c2fbe, CodeQL, Merge Verify, Terraform Plan, main-only-from-dev guard,
  exact ECS/image verification and authenticated inventory/runtime readiness all passed.
  New release-head CI/readiness must be checked again before any merge transaction.

Approved one-promotion exception

The owner explicitly approved this exception on 2026-09-20. Final reviewed HEAD: 4134838c7c45a6e004f0d12a8be31e5c08018838; main base: ab091a2d1c87c5be8d9e43d75553cec0342f4bf7. Fresh CodeQL, Merge Verify, Plan, dev-only main guard, ECS deployment and authenticated runtime readiness all passed. Automatic AI review failed input admission and is NOT represented as passed. For this promotion only, an honestly named direct-review status replaces that requirement while other required checks remain enforced. Original protection will be restored immediately after the merge attempt; v0.10.1 will be tagged only after successful merge and restoration.