Promote dev to main: terraform relative-path depth fix

terraform/foundation/ai.tf

@@ -809,11 +809,11 @@ data "archive_file" "agent" {
   type        = "zip"
   output_path = "${path.module}/.build/agent-${each.key}.zip"
   source {
-    content  = file("${path.module}/../../../agent/lambda/${each.value.file}")
+    content  = file("${path.module}/../../agent/lambda/${each.value.file}")
     filename = each.value.file
   }
   source {
-    content  = file("${path.module}/../../../agent/lambda/cross_account.py")
+    content  = file("${path.module}/../../agent/lambda/cross_account.py")
     filename = "cross_account.py"
   }
   # The datasource-family connectors (clickhouse/prometheus/loki/tempo/mimir) import the shared
@@ -823,7 +823,7 @@ data "archive_file" "agent" {
   dynamic "source" {
     for_each = contains(["clickhouse_mcp.py", "prometheus_mcp.py", "loki_mcp.py", "tempo_mcp.py", "mimir_mcp.py", "jaeger_mcp.py", "dynatrace_mcp.py", "datadog_mcp.py"], each.value.file) ? [1] : []
     content {
-      content  = file("${path.module}/../../../agent/lambda/datasource_http.py")
+      content  = file("${path.module}/../../agent/lambda/datasource_http.py")
       filename = "datasource_http.py"
     }
   }
@@ -834,7 +834,7 @@ data "archive_file" "agent" {
   dynamic "source" {
     for_each = contains(["clickhouse_mcp.py", "aws_rds_mcp.py"], each.value.file) ? [1] : []
     content {
-      content  = file("${path.module}/../../../agent/lambda/sql_readonly_guard.py")
+      content  = file("${path.module}/../../agent/lambda/sql_readonly_guard.py")
       filename = "sql_readonly_guard.py"
     }
   }

terraform/foundation/eks.tf

@@ -76,13 +76,13 @@ data "archive_file" "eks_auto_register" {
   type        = "zip"
   output_path = "${path.module}/.build/eks_auto_register.zip"
   source {
-    content  = file("${path.root}/../../../scripts/v2/eks/auto_register.py")
+    content  = file("${path.root}/../../scripts/v2/eks/auto_register.py")
     filename = "auto_register.py"
   }
   source {
     # Regional RDS CA trust bundle — the Lambda REQUIRES verified TLS to Aurora
     # (PR #36 review: this write-path must not run CERT_NONE).
-    content  = file("${path.root}/../../../scripts/v2/eks/rds-ca-bundle.pem")
+    content  = file("${path.root}/../../scripts/v2/eks/rds-ca-bundle.pem")
     filename = "rds-ca-bundle.pem"
   }
 }

terraform/foundation/incidents.tf

@@ -23,9 +23,9 @@
 locals {
   il             = var.incident_lifecycle_enabled ? 1 : 0
   rwb            = var.rca_writeback_enabled ? 1 : 0 # ADR-034 write-back gate (see writeback.tf)
-  inc_src        = "${path.module}/../../../scripts/v2/incident"
-  workers_src_il = "${path.module}/../../../scripts/v2/workers"     # reuse db.py + status_updater ARN
-  rem_src_il     = "${path.module}/../../../scripts/v2/remediation" # ADR-034: writeback.py imports remediation_executor (+ action_catalog) — the 029/036 single-write surface
+  inc_src        = "${path.module}/../../scripts/v2/incident"
+  workers_src_il = "${path.module}/../../scripts/v2/workers"     # reuse db.py + status_updater ARN
+  rem_src_il     = "${path.module}/../../scripts/v2/remediation" # ADR-034: writeback.py imports remediation_executor (+ action_catalog) — the 029/036 single-write surface
   inc_acct       = data.aws_caller_identity.current.account_id
   # The AgentCore runtime ARN SSM param — created by ai.tf when agentcore_enabled, written by
   # provision.py after apply. Referenced by NAME (string), NOT the gated resource, so the incident

terraform/foundation/remediation.tf

@@ -18,8 +18,8 @@ locals {
   # the IAM split). Both default false ⇒ re_or_iw=0 ⇒ unchanged.
   iw              = var.integrations_write_enabled ? 1 : 0
   re_or_iw        = (var.remediation_enabled || var.integrations_write_enabled) ? 1 : 0
-  rem_src         = "${path.module}/../../../scripts/v2/remediation"
-  workers_src_re  = "${path.module}/../../../scripts/v2/workers" # reuse db.py/status_updater
+  rem_src         = "${path.module}/../../scripts/v2/remediation"
+  workers_src_re  = "${path.module}/../../scripts/v2/workers" # reuse db.py/status_updater
   rem_acct        = data.aws_caller_identity.current.account_id
   worker_cname_re = local.worker_cname # reuse the worker container name (workers.tf)
 }

terraform/foundation/secret-rotation.tf

@@ -32,7 +32,7 @@ data "archive_file" "secret_rotation_redeploy" {
   type        = "zip"
   output_path = "${path.module}/.build/secret_rotation_redeploy.zip"
   source {
-    content  = file("${path.root}/../../../scripts/v2/secret-rotation/redeploy.py")
+    content  = file("${path.root}/../../scripts/v2/secret-rotation/redeploy.py")
     filename = "redeploy.py"
   }
 }

terraform/foundation/steampipe.tf

@@ -258,7 +258,7 @@ resource "aws_cloudwatch_metric_alarm" "steampipe_down" {
 # ---- sync Lambda (VPC, pg8000 layer; queries Steampipe + writes Aurora) ----
 resource "terraform_data" "inv_pg8000_build" {
   count            = local.sp
-  triggers_replace = filemd5("${path.module}/../../../scripts/v2/steampipe/requirements.txt")
+  triggers_replace = filemd5("${path.module}/../../scripts/v2/steampipe/requirements.txt")
   provisioner "local-exec" {
     command = <<-EOT
       set -e
@@ -288,7 +288,7 @@ data "archive_file" "inv_sync_src" {
   type        = "zip"
   output_path = "${path.module}/.build/inv_sync.zip"
   source {
-    content  = file("${path.module}/../../../scripts/v2/steampipe/sync_lambda.py")
+    content  = file("${path.module}/../../scripts/v2/steampipe/sync_lambda.py")
     filename = "sync_lambda.py"
   }
 }

terraform/foundation/workers.tf

@@ -10,7 +10,7 @@
 
 locals {
   we           = var.workers_enabled ? 1 : 0
-  workers_src  = "${path.module}/../../../scripts/v2/workers"
+  workers_src  = "${path.module}/../../scripts/v2/workers"
   worker_cname = "worker" # MUST equal the ContainerOverrides Name in sfn.asl.json
   acct         = data.aws_caller_identity.current.account_id
   # ai-cost aggregator gate — reuses the worker role/pg8000 layer/VPC, so it REQUIRES workers_enabled.