Promote dev to main: terraform relative-path depth fix

[Atom-oh]

Promotes PR #22.

🤖 Generated with Claude Code

[github-actions]

🤖 AI Code Review (Claude Fable 5 chair · lens×model matrix)

_Cells (model/lens): codex/L2 codex/L3 codex/L4 codex/L5 _

Status: BLOCKED — CRITICAL/MAJOR issues must be resolved before merge

🛑 Forced FAIL due to coverage collapse: at most one vendor survived, so cross-verification across the lens x model matrix cannot happen — fail-closed regardless of the chair's judgment.

⚠️ Coverage degraded: model(s) [kiro-opus, kiro-gpt] had no response across every lens (invalid flag/missing binary/auth failure, etc.) — the review below was synthesized without them.

All verified. Writing the synthesized review.

PR #23 Review — terraform relative-path depth fix (dev → main)

1. Summary

This PR corrects the relative-path depth of 15 source-file references across seven files in terraform/foundation/ from ../../../ (which resolves one directory above the repo root) to ../../ (repo root), affecting archive_file sources, filemd5 triggers, and locals source-dir strings. I independently verified against the checked-out base that (a) terraform/foundation/ is exactly two levels below the repo root, so ../../ is the correct depth, (b) every referenced target exists at the new path (agent/lambda/{cross_account,datasource_http,sql_readonly_guard}.py, scripts/v2/{workers,steampipe,secret-rotation,remediation,incident,eks}/… including rds-ca-bundle.pem and requirements.txt), and (c) the diff covers all 15 occurrences of the triple-../ pattern in base terraform/ — no stragglers remain. No gates, IAM policies, secrets, or behavior are touched.

2. Issues per lens

L2 — Code correctness (panel: codex)

• No issues. 1/1 model found nothing, and my base verification agrees: path arithmetic is correct, all targets resolve, and the fix is exhaustive (grep on base shows exactly the 15 occurrences the diff rewrites). Comment-only trailing text in the changed locals lines is preserved verbatim.

L3 — Security / AWS mutation safety (panel: codex)

• No issues. 1/1 model found nothing. Confirmed: no changes to feature gates (remediation_enabled, integrations_write_enabled, etc. remain untouched — remediation.tf/incidents.tf changes are string-path-only inside locals), no IAM, no secrets, no ADR-005 surface. The rds-ca-bundle.pem packaging (the PR terraform: fresh-VPC bootstrap for the CloudFront VPC-origin SG lookup #36 verified-TLS requirement noted in eks.tf comments) continues to resolve to a real file at the new path.

L4 — Observability / data-integration correctness (panel: codex)

• No issues. 1/1 model found nothing. The Steampipe sync Lambda source and pg8000-layer filemd5 trigger now point at existing files; note the filemd5 trigger change will fire a one-time layer rebuild on next plan/apply where steampipe_enabled is set, which is expected and harmless (flag defaults to false).

L5 — Docs/ADR consistency (panel: codex)

• No issues. 1/1 model found nothing. The fix aligns the Terraform with the documented repo layout (CLAUDE.md: single root at terraform/foundation/, app code at repo-root agent/, scripts/v2/); no CHANGELOG entry is required for an infra path correction with no user-visible behavior change, and no ADR is contradicted.

3. Suggestions

• None blocking. Optionally, a CI step running terraform validate/plan with all flags default-off would catch path-depth regressions like this earlier, since file() on a bad path fails only at plan time for the ungated resources (e.g. ai.tf's archive is gated, so a default-off plan may not exercise every path).

4. Verdict

Mechanical, complete, and correct path fix; panel unanimous across all four lenses with zero findings, and every claim verified against the base tree.

---

Triggered by commit e02b9744828e7bba30a0932118ce8f5c262778c5 · workflow: .github/workflows/pr-review.yml