Promote dev: runner tooling, stateless build job, dispatch build, -lock=false plan, fresh-VPC SG bootstrap

[Atom-oh]

Promotes #30–#36: sub-ownership docs, setup-terraform, build job derives the ECR URI without state, deploy-web dispatch build input, read-only plan with -lock=false + terraform.yml self-trigger, and the fresh-VPC CloudFront-SG bootstrap fix.

🤖 Generated with Claude Code

[github-actions]

🤖 AI Code Review (Claude Fable 5 chair · lens×model matrix)

_Cells (model/lens): codex/L2 codex/L3 codex/L4 codex/L5 _

Status: BLOCKED — CRITICAL/MAJOR issues must be resolved before merge

🛑 Forced FAIL due to coverage collapse: at most one vendor survived, so cross-verification across the lens x model matrix cannot happen — fail-closed regardless of the chair's judgment.

⚠️ Coverage degraded: model(s) [kiro-opus, kiro-gpt] had no response across every lens (invalid flag/missing binary/auth failure, etc.) — the review below was synthesized without them.

All verification is complete — no dangling references to the removed singular data source, the deploy job's fail-safe if already handles a skipped build, and the ECR repo derivation matches ecr.tf. Here is the synthesized review.

---

PR #37 — Chair Review: runner tooling, stateless build job, dispatch build, -lock=false plan, fresh-VPC SG bootstrap

Summary

This PR makes the web build job stateless (deriving the ECR repo from the tfvars project instead of reading Terraform state — a genuine least-privilege improvement for the ci-build role), adds a build dispatch input, pins setup-terraform across workflows, drops the S3 lock on the read-only plan job, and converts the CloudFront-managed-SG lookup to a plural data source so a brand-new VPC can bootstrap without a hard plan failure. All four panel reviews came back clean except one MINOR docs finding; my independent verification against base confirms the design is sound — the deploy job's if: needs.build.result == 'success' || 'skipped' (base deploy-web.yml:144-147) already tolerates the now-conditional build job, the repo name ${var.project}-web matches terraform/foundation/ecr.tf:2, and the bootstrap state fails closed (no ALB ingress rather than a CIDR fallback).

Issues per lens

L2 — code correctness

Panel: codex reported no findings. Chair verification agrees there are no CRITICAL/MAJOR issues; two chair-added MINORs:

• MINOR (chair): The PROJECT="${PROJECT:-awsops-v2}" fallback in the build job silently masks a sed parse failure, not just a legitimately-omitted project variable. A stack whose tfvars sets a non-default project in a format the regex misses (single quotes, unusual spacing) would push its image to awsops-v2-web — the wrong stack's repo — instead of failing loudly. Risk is bounded (only the immutable web-<sha> tag is written; :web-latest is untouched; a repo-scoped push role would reject it), but a fail-closed error would match this workflow's own "no cross-branch fallback, by design" philosophy better than a silent default.
• MINOR (chair): The build/image_sha mutual-exclusion check runs in the deploy job's pin step — after the full arm64 build has already completed, and on main after a production-environment reviewer has approved the rollout. Validating the inputs in a cheap first step (or in the build job's if) would fail the bad dispatch in seconds instead of after a build plus an approval. Not a correctness bug (the pin never happens, and the stray immutable tag is harmless).

L3 — security/AWS mutation safety

Panel: codex reported no findings. Chair concurs — no issues, and two properties worth recording as positives:

• Removing TF_BACKEND_HCL* secrets from the build job shrinks the ci-build role's effective surface to ECR-push-only (no tfstate read), consistent with the stated design.
• The fresh-VPC bootstrap fails closed: while CloudFront-VPCOrigins-Service-SG is absent, the ALB SG has no 443 ingress rather than a VPC-CIDR fallback — explicitly avoiding the unauthenticated in-VPC path the base comments warn about. -lock=false is confined to the ReadOnlyAccess plan role; apply still locks, and terraform apply tfplan rejects a stale plan via state-serial checks, so no lost-update window is opened. No ADR-005 surface is touched (no new mutating capability; ecs update-service in the deploy job is pre-existing CI deployment, not agent autonomy).

L4 — observability/data-integration correctness

Panel: codex reported no findings. Chair concurs — the diff touches no Steampipe queries, CIS checks, collectors, or AgentCore diagnosis logic. Nothing in scope for this lens.

L5 — docs/ADR consistency

Panel: codex flagged one MINOR. Chair verified it against base — confirmed:

• MINOR (1/1 panel model; chair-confirmed): docs/runbooks/dev-repo-setup.md (new text in this diff) states "Only the legacy verified-email read path bridges some tables." In base, canMutateReport (web/lib/diagnosis.ts:265-271) delegates to matchesIdentity → matchesLegacyEmailOwner (web/lib/auth.ts:355-357), so while LEGACY_EMAIL_OWNER_MATCH is enabled the legacy email match also authorizes report PATCH/DELETE, not just reads. The runbook's identity caveat should say the legacy bridge covers both read and mutation of email-keyed rows, so operators reasoning about recreated users understand their effective access.
• Positive: docs/reference/01-edge-network.md was updated in lockstep with the workload.tf singular→plural change (both the SG-lookup description and the 504-root-cause section), and the removed singular data source has no remaining references in the tree.

Suggestions

1. Replace the silent awsops-v2 fallback with a hard error when the tfvars blob contains a project line the regex can't parse (keep the default only when the variable is genuinely absent), or at least emit a ::warning:: when the fallback is used.
2. Move the build/image_sha mutual-exclusion check to a first-step input validation so it fails before the build and before production approval.
3. Fix the runbook's "read path" phrasing to reflect that LEGACY_EMAIL_OWNER_MATCH also gates report mutations (canMutateReport).
4. Consider pinning terraform_version in the setup-terraform steps (repo requires ≥1.15; unpinned latest could jump majors under CI silently).

Verdict

No CRITICAL or MAJOR findings. All four panel lenses returned clean apart from one confirmed docs MINOR; chair verification against base reproduced no gate-worthy defects — the conditional build job, stateless ECR derivation, lock-free read-only plan, and fail-closed SG bootstrap are all consistent with the repo's conventions (fail-closed stack selection, SG description immutability respected, no ADR-005 impact).

---

Triggered by commit 8a9a6e0e70b807da2c12c4d84e1ef0345f5d6ae3 · workflow: .github/workflows/pr-review.yml