Allow OIDC deployment of the conversational result dispatcher

[alexeygrigorev]

Allow OIDC deployment of the conversational result dispatcher

Status: pending
Tags: enhancement, assistant, infra, testing, P1
Depends on: #129 source acceptance/merge — implementation may start from independently reviewed commit 9b5b888, but review/merge must use the finally accepted #129 source
Blocks: #126 production deployment and its HUMAN sandbox gate
Related: #124, DataTalksClub/aws-infra#18

Outcome and ownership

Update only the shared DataTalksClub/aws-infra source of truth at sandbox/dataops/template.github-actions.yaml and its focused tests so dataops-github-actions-deploy can deploy and roll back #126's exact result dispatcher. Do not change DataOps runtime code or apply AWS during agent work.

Fetch first and work in a fresh isolated worktree, suggested as /home/alexey/git/.worktrees/aws-infra-130 on issue-130-conversational-result-dispatcher-deploy-role. Preserve the dirty ../aws-infra checkout, merged #124 PR #18, and finally accepted #129 changes. Never stash/reset/overwrite the sibling checkout.

Authoritative #126 graph

Final #126 infra/template.full.yaml always declares:

• AWS::Serverless::Function ConversationalResultDispatcherFunction;
• generated role ConversationalResultDispatcherFunctionRole;
• its generated Lambda log group;
• one Schedule event named ResultDelivery, rate(1 minute), conditional on ConversationalResultDeliveryEnabled;
• the schedule's generated EventBridge rule and Lambda permission.

There is no dispatcher event-source mapping, queue, EventInvokeConfig, Function URL, API, layer, or separately managed log resource. Default-false disables the schedule but does not remove the function/role.

Acceptance must compare the policy with final agent-approved #126 source, a fresh isolated sam build, and the deploy change-set inventory. Exact logical-ID/resource changes require exact policy/test changes; add nothing speculative.

Policy placement and quotas

The inline role policy is already about 9,341 compact characters, only 899 below IAM's aggregate 10,240 role-inline quota. Do not extend it.

Do not mix this unrelated domain into #129's Sponsor-only compute policy or weaken its negative boundary. Add one generated-name AWS::IAM::ManagedPolicy logical resource, ConversationalResultDispatcherDeployPolicy, attached only through Roles: [!Ref GitHubActionsDeployRole]. Do not set ManagedPolicyName. The OIDC role must not manage/version/attach its own policies; the credentialed shared-stack operator owns those operations.

Deterministic default/pseudo-value resolution plus compact JSON tests must prove:

• aggregate inline policies <= 9,472 characters;
• each Extend the DataOps OIDC deploy role for reviewed sponsor communications #129 policy <= 5,120 characters;
• dispatcher policy <= 3,072 characters, at least 3,072 below IAM's 6,144 limit;
• exactly three source-managed customer policies after Extend the DataOps OIDC deploy role for reviewed sponsor communications #129+Allow OIDC deployment of the conversational result dispatcher #130, leaving seven of the standard ten attachment slots;
• dispatcher resources exist only in its new policy.

If upstream breaks a ceiling, redesign/split rather than weaken assertions. Operator must inspect live external attachments before apply. Quota reference: https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_iam-quotas.html

Exact dispatcher policy

Lambda statement

Grant exactly:

lambda:AddPermission
lambda:CreateFunction
lambda:DeleteFunction
lambda:GetFunction
lambda:GetFunctionConfiguration
lambda:ListTags
lambda:RemovePermission
lambda:TagResource
lambda:UntagResource
lambda:UpdateFunctionCode
lambda:UpdateFunctionConfiguration

on exactly:

arn:${AWS::Partition}:lambda:${FullDocsRegion}:${AWS::AccountId}:function:${FullDocsStackName}-ConversationalResultDispatcherFunction-*
arn:${AWS::Partition}:lambda:${FullDocsRegion}:${AWS::AccountId}:function:${FullDocsStackName}-ConversationalResultDispatcherFunction-*:* 

Tests compare exact strings without trailing whitespace. Do not grant invoke, Function URL operations, lambda:*, ${FullDocsStackName}-Conversational*, or stack/account-wide functions. Add/RemovePermission cover only the generated schedule permission on this function.

Generated role and PassRole statement

Grant exactly:

iam:AttachRolePolicy
iam:CreateRole
iam:DeleteRole
iam:DeleteRolePolicy
iam:DetachRolePolicy
iam:GetRole
iam:GetRolePolicy
iam:ListAttachedRolePolicies
iam:ListRoleTags
iam:PassRole
iam:PutRolePolicy
iam:TagRole
iam:UntagRole
iam:UpdateAssumeRolePolicy

on only:

arn:${AWS::Partition}:iam::${AWS::AccountId}:role/${FullDocsStackName}-ConversationalResultDispatcherFunctionRole-*

No wildcard-role PassRole, iam:*, user/group, standalone policy administration, or unrelated role.

Log-group statement

Grant exactly:

logs:CreateLogGroup
logs:DeleteLogGroup
logs:DescribeLogGroups
logs:PutRetentionPolicy
logs:TagResource
logs:UntagResource

on exactly the base and stream-suffix forms:

arn:${AWS::Partition}:logs:${FullDocsRegion}:${AWS::AccountId}:log-group:/aws/lambda/${FullDocsStackName}-ConversationalResultDispatcherFunction-*
arn:${AWS::Partition}:logs:${FullDocsRegion}:${AWS::AccountId}:log-group:/aws/lambda/${FullDocsStackName}-ConversationalResultDispatcherFunction-*:* 

Tests compare exact strings without trailing whitespace. No log-event read/write, arbitrary log group, or broader retention access.

Schedule: preserve existing boundary

The one proven trigger is a SAM Schedule, not an event-source mapping. Existing inline EventBridgeDataOpsRules already grants rule lifecycle on only:

arn:${AWS::Partition}:events:${FullDocsRegion}:${AWS::AccountId}:rule/${FullDocsStackName}-*

Keep it unchanged. Exact Lambda Add/RemovePermission covers the generated permission. Add no EventBridge/Scheduler action, event-bus write, event-source mapping, async-invoke configuration, SQS, DynamoDB, Secrets Manager, Telegram, or runtime permission.

Acceptance criteria

• Isolated change contains only current aws-infra template/focused tests and is based on finally accepted Extend the DataOps OIDC deploy role for reviewed sponsor communications #129; sibling checkout and DataOps code untouched.
• One generated-name dispatcher managed policy attaches only to GitHubActionsDeployRole; inline and Sponsor policies have no dispatcher resource.
• Lambda, role/PassRole, and log action/resource sets exactly match this spec.
• Existing EventBridge statement remains unchanged and final comparison proves it covers ResultDelivery.
• No dispatcher mapping permission exists; no invoke/URL/EventInvokeConfig/queue/table/secret/Telegram/runtime/broad/self-administration permission is added.
• Merged Add transactional approval and durable execution recovery #124 PR Import DTC Operations content directory #18 and every finally accepted Extend the DataOps OIDC deploy role for reviewed sponsor communications #129 boundary/test remain effective.
• Parsed structure, mutation/negative cases, deterministic sizes/count, all sandbox/dataops tests, SAM lint, and git diff --check pass.
• Fresh final Ship approved conversational todo creation #126 build/change-set inventory contains no resource outside this policy.
• Independent IAM/security reviewer accepts actions, resources, wildcards, schedule boundary, quotas, preservation, apply, and rollback.
• Focused DataTalksClub/aws-infra PR merges with Refs DataTalksClub/dataops#130.
• [HUMAN] Credentialed operator reviews change set/live attachment count and applies dataops-github-actions with CAPABILITY_NAMED_IAM.
• [HUMAN] On-Call verifies effective role, default-off DataOps deployment, disabled schedule, dispatcher logs, and Add transactional approval and durable execution recovery #124/Extend the DataOps OIDC deploy role for reviewed sponsor communications #129 preservation. Ship approved conversational todo creation #126's Telegram journey remains separate.

Required tests

Parse YAML as an object graph and assert exact attachment/statements/resources plus absence from inline/Sponsor policies. Mutation tests must reject:

• missing qualified form or broader function/role/log pattern;
• invoke, Function URL, EventInvokeConfig, event-source mapping, wildcard service/action/resource;
• new EventBridge/Scheduler, queue, table, secret, or Telegram access;
• wildcard PassRole, IAM policy self-administration, fixed ManagedPolicyName, another role attachment;
• any Add transactional approval and durable execution recovery #124/Extend the DataOps OIDC deploy role for reviewed sponsor communications #129 regression.

Resolve actual documents and enforce all size/count ceilings. Fresh-build #126 in an isolated output directory and assert exactly one dispatcher function, generated role/log family, one ResultDelivery schedule plus generated rule/permission, and no dispatcher mapping/queue/async config/URL. Compare the eventual CloudFormation change set.

Minimum commands:

uv run --with pytest python -m pytest sandbox/dataops/tests -q
sam validate --lint --template-file sandbox/dataops/template.github-actions.yaml
git diff --check <accepted-base>...HEAD

Also run project-supported #126 make sam-build and lint with fresh isolated output, never stale .aws-sam.

Pipeline and HUMAN apply

1. Engineer implements/commits in isolated aws-infra with Refs DataTalksClub/dataops#130; no push/apply.
2. Independent Tester/security reviewer verifies exact boundary, final Ship approved conversational todo creation #126 graph, quotas, and Add transactional approval and durable execution recovery #124/Extend the DataOps OIDC deploy role for reviewed sponsor communications #129 preservation.
3. PM accepts reviewed diff/final SAM comparison.
4. Integrator pushes and merges focused aws-infra PR, confirming merged source includes accepted Extend the DataOps OIDC deploy role for reviewed sponsor communications #129+Allow OIDC deployment of the conversational result dispatcher #130.
5. Source merge does not apply AWS; keep Allow OIDC deployment of the conversational result dispatcher #130 open with human.
6. [HUMAN] Credentialed operator creates/reviews change set, checks external attachments/operator managed-policy capability, then from sandbox/dataops runs:

aws cloudformation deploy \
  --stack-name dataops-github-actions \
  --template-file template.github-actions.yaml \
  --region eu-west-1 \
  --capabilities CAPABILITY_NAMED_IAM

7. Require UPDATE_COMPLETE and inspect effective role before retrying DataOps CI.
8. Deploy Ship approved conversational todo creation #126 only through normal GitHub Actions CI with conversational flags default-off. On-Call confirms function/role/log creation, generated result schedule disabled, no dispatch, and Add transactional approval and durable execution recovery #124/Extend the DataOps OIDC deploy role for reviewed sponsor communications #129 still effective.
9. Enable/test delivery only in Ship approved conversational todo creation #126's controlled HUMAN rollout. Close Allow OIDC deployment of the conversational result dispatcher #130 only after apply and On-Call evidence pass.

Rollback

Use CloudFormation, never manual IAM edits. Retain the exact prior merged template/commit. A failed update must reach an explained terminal rollback state. For an unacceptable successful update, redeploy the prior accepted shared-infra template with CAPABILITY_NAMED_IAM; confirm dispatcher policy detaches/deletes and #124/#129 remain effective. Do not remove PR #18 while #124 resources exist, remove #129 coverage while Sponsor resources exist, or edit/delete DataOps app/runtime resources. Keep result delivery disabled during rollback verification.

Out of scope

DataOps code/SAM changes, conversational behavior, Telegram/z.ai calls, secrets, task writes, app deploy outside CI, #126's sandbox journey, broad role redesign, moving existing inline statements, permission boundaries, speculative access, live IAM edits, retained-resource deletion, or other stacks/repos.

[alexeygrigorev]

PM GROOMED — READY FOR ISOLATED AWS-INFRA IMPLEMENTATION AFTER #129 SOURCE ACCEPTANCE

Validated the intake author (alexeygrigorev) and grounded the specification in:

• Ship approved conversational todo creation #126's final application template/current build output and PM rejection evidence;
• merged Add transactional approval and durable execution recovery #124 aws-infra PR Import DTC Operations content directory #18 / commit 691666a;
• current aws-infra/origin/main (cc96704 at review time);
• Extend the DataOps OIDC deploy role for reviewed sponsor communications #129's isolated implementation commit 9b5b888 and independent IAM/security PASS.

Decisions now fixed in #130:

• The dispatcher always creates ConversationalResultDispatcherFunction, its generated role, and log family. Its only proven trigger is one conditional SAM Schedule; there is no dispatcher event-source mapping, queue, EventInvokeConfig, or Function URL.
• Existing stack-scoped EventBridge rule lifecycle already covers the generated schedule, while exact Lambda Add/RemovePermission covers its generated permission. No EventBridge or mapping addition is allowed.
• The nearly-full inline policy remains unchanged. The accepted Sponsor-only Extend the DataOps OIDC deploy role for reviewed sponsor communications #129 policies also remain domain-pure.
• One generated-name dispatcher-only customer-managed policy carries exact non-invoke Lambda lifecycle, exact generated role lifecycle/PassRole, and exact log lifecycle. It attaches only to the GitHub Actions deploy role and cannot self-administer policies.
• Structural and adversarial negatives, deterministic policy sizes/attachment count, final Ship approved conversational todo creation #126 SAM/change-set comparison, preservation tests, SAM lint, isolated diff, and independent IAM review are mandatory.
• Source implementation/review performs no AWS mutation. A focused DataTalksClub/aws-infra PR must merge with Refs DataTalksClub/dataops#130.
• Credentialed CAPABILITY_NAMED_IAM apply, terminal stack state, effective-role inspection, default-off DataOps CI deployment, On-Call verification, and CloudFormation rollback are explicit HUMAN gates. The issue stays open with human through them.

Dependency/readiness:

• Engineering may start from reviewed Extend the DataOps OIDC deploy role for reviewed sponsor communications #129 commit 9b5b888 to avoid idle time.
• Allow OIDC deployment of the conversational result dispatcher #130 review/merge depends on Extend the DataOps OIDC deploy role for reviewed sponsor communications #129 source acceptance and must rebase/compare against its final merged form.
• Allow OIDC deployment of the conversational result dispatcher #130 blocks Ship approved conversational todo creation #126 production deployment, not further local runtime review.

No repository file, commit, push, PR, live IAM policy, CloudFormation stack, provider, or application state was changed during grooming.

[alexeygrigorev]

Software Engineer handoff — isolated dispatcher deploy policy ready for independent review

Implemented #130 as a separate commit directly above the reviewed #129 commit. No push, pull request, AWS call/apply, dirty-checkout edit, or DataOps source edit was performed.

Isolated branch

• Repository: DataTalksClub/aws-infra
• Worktree: /home/alexey/git/.worktrees/aws-infra-130
• Branch: issue-130-conversational-result-dispatcher-deploy-role
• Base commit preserved separately: 9b5b8884630cf0eb43113be9149c528b41ec03ab (Extend the DataOps OIDC deploy role for reviewed sponsor communications #129)
• Allow OIDC deployment of the conversational result dispatcher #130 commit: 2a1b95f4fd0f4d8d0d24e6edf4a337281c2aea79
• Commit trailer: Refs DataTalksClub/dataops#130
• Worktree status: clean

Only the two accepted shared-infrastructure surfaces changed relative to #129:

• sandbox/dataops/template.github-actions.yaml: 58 insertions
• sandbox/dataops/tests/test_template_github_actions.py: 370 insertions, 2 test-adjustment deletions

Exact policy delivered

Added one generated-name AWS::IAM::ManagedPolicy named logically ConversationalResultDispatcherDeployPolicy, attached only through Roles: [!Ref GitHubActionsDeployRole], with no ManagedPolicyName.

It has exactly three statements:

1. The proven non-invoke/non-URL Lambda create/read/update/delete/tag/AddPermission/RemovePermission lifecycle on only the unqualified and qualified ConversationalResultDispatcherFunction-* ARN forms.
2. The existing exact generated-role lifecycle plus iam:PassRole on only ConversationalResultDispatcherFunctionRole-*.
3. The existing exact log-group lifecycle on only the dispatcher base and :* log ARN forms.

It adds no EventBridge or Scheduler permission because the unchanged inline EventBridgeDataOpsRules stack boundary already covers the one generated rule. It adds no event-source mapping, queue, EventInvokeConfig, Function URL, Lambda invoke, DynamoDB, secret, Telegram/provider, runtime, or policy-self-administration capability.

Dispatcher resources occur only in this new managed policy; they do not enter the inline or either Sponsor policy. All #124 PR #18 and #129 exact-boundary tests remain active.

Automated verification

PASS:

uv run --with pytest python -m pytest sandbox/dataops/tests -q
34 passed, 50 subtests passed

sam validate --lint --template-file sandbox/dataops/template.github-actions.yaml
valid SAM template

git diff 9b5b8884630cf0eb43113be9149c528b41ec03ab --check
clean

The expanded parsed object-graph suite mutation-tests and rejects:

• missing qualified function form and broad function/role/log resources;
• invoke, URL, EventInvokeConfig, event-source mapping, EventBridge/Scheduler, SQS, DynamoDB, Secrets Manager, provider, and wildcard actions;
• IAM wildcard PassRole and managed-policy self-administration;
• log data-plane access;
• fixed managed-policy names, another role attachment, or dispatcher resources leaking into inline/Sponsor policies;
• EventBridge, PR Import DTC Operations content directory #18, or Extend the DataOps OIDC deploy role for reviewed sponsor communications #129 regressions.

Resolved policy quotas

Default parameters/pseudo-values were deterministically resolved and actual policy documents compact-serialized:

• aggregate inline: 9,341, leaving 899 below 10,240;
• Extend the DataOps OIDC deploy role for reviewed sponsor communications #129 Sponsor compute: 3,706, leaving 2,438 below 6,144;
• Extend the DataOps OIDC deploy role for reviewed sponsor communications #129 Sponsor service: 717, leaving 5,427 below 6,144;
• Allow OIDC deployment of the conversational result dispatcher #130 dispatcher: 1,512, leaving 4,632 below 6,144 and satisfying the 3,072 ceiling;
• source-managed role attachments: exactly 3, leaving 7 standard slots.

Fresh final #126 graph comparison

Ran a fresh build outside the DataOps checkout output tree:

sam build --config-env full-sandbox --build-dir /tmp/dataops-126-sam-build.aFTNwc
Build Succeeded

Parsed both the fresh SAM output and a local SAM translation. The dispatcher graph is exactly:

• ConversationalResultDispatcherFunction — AWS::Lambda::Function;
• ConversationalResultDispatcherFunctionRole — generated AWS::IAM::Role;
• ConversationalResultDispatcherFunctionResultDelivery — one generated AWS::Events::Rule;
• ConversationalResultDispatcherFunctionResultDeliveryPermission — one generated AWS::Lambda::Permission.

The source schedule is exactly ResultDelivery, rate(1 minute), with Enabled: Fn::If [ConversationalResultDeliveryIsEnabled, true, false]; the parameter default is false. Parsed source and transformed resources contain no dispatcher EventSourceMapping, EventInvokeConfig, SQS queue, or Function URL.

The final #114 Sponsor graph was also reparsed and still matches all #129 constants: three functions, SponsorSendWorker-only DynamoDB mapping, SponsorSesEvent-only async config, exact queue/archive key/archive bucket/SES configuration/destination/rule/permission resources.

The real deployed change-set inventory and default-disabled deployed rule remain HUMAN/On-Call gates; no live AWS simulation or mutation was attempted.

READY FOR INDEPENDENT IAM/SECURITY REVIEW. Review should compare commit 2a1b95f to base 9b5b888, confirm the three exact statements, unchanged EventBridge/PR #18/#129 boundaries, quotas/attachments, and the final #126 graph before PM acceptance or source push.

[alexeygrigorev]

CHANGES REQUESTED — transformed #126 schedule is always enabled

The #130 aws-infra policy itself is exact and least-privilege, and all focused policy checks pass. However, the mandatory fresh transformed-graph verification found that final #126 does not actually produce the default-disabled conditional rule required by #130. This blocks security acceptance before source merge/apply.

Blocking finding

Final #126 declares:

Enabled: !If [ConversationalResultDeliveryIsEnabled, true, false]

under the SAM Schedule event. AWS SAM documents Schedule.Enabled as a Boolean and its translator implements it as:

State = "ENABLED" if Enabled else "DISABLED"

The unresolved Fn::If object is truthy during SAM translation. I independently transformed the freshly built template twice with ConversationalResultDeliveryEnabled set to false and true. Both transformed outputs contained:

ConversationalResultDispatcherFunctionResultDelivery
Type: AWS::Events::Rule
State: ENABLED

Observed result:

• false -> ENABLED
• true -> ENABLED

Therefore the source default false does not disable the generated EventBridge rule. The dispatcher function environment still receives the false flag, but the rule will invoke it every minute, contrary to #126/#130s explicit default-off deployed-rule contract and HUMAN On-Call check.

The existing app-infra assertion and #130 authoritative-graph test do not catch this. The app test checks only that the source contains the Fn::If text. The #130 test compares an in-file expected graph constant with another in-file literal and never inspects the transformed rule state.

Required correction

Fix final #126s SAM Schedule property using the pass-through State form, for example:

State: !If [ConversationalResultDeliveryIsEnabled, ENABLED, DISABLED]

An in-memory proof with the same SAM translator preserves that exact conditional State in the generated AWS::Events::Rule. Add a real transform assertion proving the false branch is DISABLED and the true branch is ENABLED, then rebuild and re-run this #130 graph review. If the logical IDs remain unchanged, the #130 IAM action/resource policy should require no change.

#130 policy review that already passes

• One generated-name ConversationalResultDispatcherDeployPolicy attaches only to GitHubActionsDeployRole; it has no ManagedPolicyName and no self-administration capability.
• Lambda lifecycle is exactly the required 11 non-invoke/non-URL actions on only unqualified and qualified ConversationalResultDispatcherFunction ARNs.
• Generated-role lifecycle and iam:PassRole are exactly the proven 14 actions on only ConversationalResultDispatcherFunctionRole.
• Logs are exactly the proven six lifecycle/read/tag actions on only the base and :* dispatcher log-group forms.
• No event-source mapping, queue, EventInvokeConfig, Function URL, invoke, runtime, provider, table, secret, Telegram, EventBridge, or Scheduler permission is present in the dispatcher policy.
• Existing EventBridgeDataOpsRules is unchanged and is sufficient for the generated stack-scoped schedule; Lambda Add/RemovePermission covers the generated permission.
• Add transactional approval and durable execution recovery #124 PR Import DTC Operations content directory #18 and Extend the DataOps OIDC deploy role for reviewed sponsor communications #129 Sponsor policies/tests remain structurally intact.
• Generated managed-policy names/attachment dependency support CloudFormation detach/delete rollback. The shared-stack operator, not OIDC, must have policy create/version/read/delete/tag and role attach/detach permissions and must inspect live attachments.

Independent resolved sizes:

• aggregate inline: 9,341, leaving 899 below 10,240;
• Sponsor compute: 3,706, leaving 2,438 below 6,144;
• Sponsor service: 717, leaving 5,427 below 6,144;
• dispatcher: 1,512, leaving 4,632 below 6,144;
• source-managed attachments: 3 of standard 10, leaving 7; simultaneous replacement of all three can temporarily use 6 before any external attachments.

Commands and evidence

• PASS — uv run --with pytest python -m pytest sandbox/dataops/tests -q: 34/34 tests, 50/50 negative subtests.
• PASS — sam validate --lint --template-file sandbox/dataops/template.github-actions.yaml.
• PASS — git diff 9b5b888..2a1b95f --check.
• PASS — isolated Allow OIDC deployment of the conversational result dispatcher #130 diff: only template.github-actions.yaml and focused test file; template 58 additions, no deletion.
• PASS — aws-infra worktree clean; Allow OIDC deployment of the conversational result dispatcher #130 is a direct child of reviewed Extend the DataOps OIDC deploy role for reviewed sponsor communications #129 commit 9b5b888 with the required Refs trailer.
• PASS — fresh Ship approved conversational todo creation #126 build from a clean project-local source copy to an isolated build directory; all three functions built and the built SAM template linted.
• PASS — transformed inventory contains exactly dispatcher Lambda, generated role, one ResultDelivery EventBridge rule, and one Lambda permission; no dispatcher ESM, queue, EventInvokeConfig, or URL.
• FAIL — transformed ResultDelivery state: false and true inputs both become ENABLED.

The temporary fresh-build source/artifact directories created for this review were moved to trash after inspection; they were ignored test artifacts and are recoverable. No tracked file, commit, branch, push, PR, AWS stack, provider, or runtime state was changed. Credentialed operator apply remains a separate HUMAN gate after this blocker and review are resolved.

[alexeygrigorev]

TEST PASS — transformed schedule blocker resolved

Re-reviewed unchanged aws-infra commit 2a1b95f4fd0f4d8d0d24e6edf4a337281c2aea79 against the current uncommitted #126 source after the schedule correction. The only prior blocker is closed: the generated ResultDelivery rule now resolves default false to DISABLED and explicit true to ENABLED.

Independent fresh build and transform proof

I copied only tracked plus non-ignored #126 files into a clean project-local source fixture, built to a separate fresh output directory, linted the built template, and translated it with the SAM CLI translator.

The transformed dispatcher inventory is exactly:

• ConversationalResultDispatcherFunction — AWS::Lambda::Function;
• ConversationalResultDispatcherFunctionRole — AWS::IAM::Role;
• ConversationalResultDispatcherFunctionResultDelivery — AWS::Events::Rule;
• ConversationalResultDispatcherFunctionResultDeliveryPermission — AWS::Lambda::Permission.

There is no dispatcher EventSourceMapping, EventInvokeConfig, SQS queue, Function URL, API, layer, or separately managed log resource.

The generated rule now contains exactly:

State: { Fn::If: [ConversationalResultDeliveryIsEnabled, ENABLED, DISABLED] }

and its condition is exactly:

Fn::Equals: [{ Ref: ConversationalResultDeliveryEnabled }, "true"]

Independent resolution proved:

• parameter default false -> DISABLED;
• explicit true -> ENABLED.

The source parameter still defaults to false, the schedule remains ResultDelivery at rate(1 minute), and the dispatcher runtime receives the independent result-delivery flag. The correction changes no dispatcher logical ID or physical-name family, so the #130 IAM policy requires no modification.

Final IAM/security result

Commit 2a1b95f remains exact and least-privilege:

• one generated-name ConversationalResultDispatcherDeployPolicy, no ManagedPolicyName, attached only to GitHubActionsDeployRole;
• exact 11-action non-invoke/non-URL Lambda lifecycle on only dispatcher unqualified and qualified ARNs;
• exact 14-action generated-role lifecycle/iam:PassRole on only the dispatcher role family;
• exact six-action log lifecycle/read/tag set on only dispatcher base and :* log-group forms;
• no dispatcher ESM, queue, EventInvokeConfig, Function URL, Lambda invoke, EventBridge/Scheduler addition, table, secret, Telegram, runtime/provider, wildcard, or policy-self-administration grant;
• unchanged stack-scoped EventBridgeDataOpsRules already covers the one generated rule, and exact dispatcher Add/RemovePermission covers its generated Lambda permission;
• Add transactional approval and durable execution recovery #124 PR Import DTC Operations content directory #18 mapping/queue/function/role/log boundaries and all Extend the DataOps OIDC deploy role for reviewed sponsor communications #129 Sponsor policy boundaries remain structurally intact.

Generated managed-policy attachment and rollback behavior remains correct: CloudFormation owns the generated policy name, Roles references only the deploy role, and no retention policy leaves a named orphan. Credentialed shared-stack apply must still verify operator managed-policy lifecycle permissions and live external attachments; the OIDC role correctly cannot administer its own policies.

Policy sizes and attachment headroom

• aggregate inline: 9,341 / 10,240, leaving 899;
• Sponsor compute: 3,706 / 6,144, leaving 2,438;
• Sponsor service: 717 / 6,144, leaving 5,427;
• dispatcher: 1,512 / 6,144, leaving 4,632;
• source-managed attachments: 3 / standard 10, leaving 7 before the required live external-attachment check.

Commands and results

• PASS — uv run --with pytest python -m pytest sandbox/dataops/tests -q: 34/34 tests, 50/50 negative subtests.
• PASS — sam validate --lint --template-file sandbox/dataops/template.github-actions.yaml.
• PASS — git diff 9b5b888..2a1b95f --check.
• PASS — Allow OIDC deployment of the conversational result dispatcher #130 worktree clean; HEAD 2a1b95f is a direct child of reviewed Extend the DataOps OIDC deploy role for reviewed sponsor communications #129 commit 9b5b888 and retains Refs Allow OIDC deployment of the conversational result dispatcher #130.
• PASS — Allow OIDC deployment of the conversational result dispatcher #130 diff remains only template.github-actions.yaml and its focused tests: 58 template insertions, no template deletion.
• PASS — uv run --with pytest python -m pytest tests/infra -q in Ship approved conversational todo creation #126: 28/28, including the real transform contract.
• PASS — fresh isolated Ship approved conversational todo creation #126 sam build --config-env full-sandbox: all three functions built.
• PASS — SAM lint on the fresh built Ship approved conversational todo creation #126 template.
• PASS — independent transform graph/state assertions: four exact resources; false DISABLED; true ENABLED; prohibited generated resource types absent.
• PASS — git diff --check in the Ship approved conversational todo creation #126 worktree.

The fresh-build fixtures used for this re-review were moved to trash after inspection; they were ignored test artifacts and are recoverable. No tracked file, commit, branch, push, PR, AWS stack, rule, function, provider, or runtime state was changed.

#130 now passes the independent automated IAM/security gate. Credentialed CloudFormation change-set review/apply, terminal UPDATE_COMPLETE or explained rollback, live attachment inspection, default-off DataOps CI deployment, and On-Call verification remain separate HUMAN gates. The issue must remain open until those pass.

[alexeygrigorev]

PM ACCEPTED — SOURCE CHANGE APPROVED; #129 ACCEPTANCE MUST PRECEDE COMBINED INTEGRATION

Accepted DataTalksClub/aws-infra commit 2a1b95f4fd0f4d8d0d24e6edf4a337281c2aea79 from the PM/user and operator perspective. The prior transformed-schedule blocker is resolved in current #126 without changing the dispatcher logical IDs or ARN family, so the reviewed IAM patch remains exact.

Accepted least-privilege result

• The diff is a direct child of reviewed Extend the DataOps OIDC deploy role for reviewed sponsor communications #129 commit 9b5b888 and changes only sandbox/dataops/template.github-actions.yaml plus its focused tests.
• One generated-name ConversationalResultDispatcherDeployPolicy attaches only to GitHubActionsDeployRole; there is no fixed ManagedPolicyName, self-administration capability, inline-policy growth, or leakage into either Sponsor policy.
• Lambda lifecycle is exactly the groomed 11 non-invoke/non-URL actions on the unqualified and qualified dispatcher function families.
• Generated-role lifecycle and iam:PassRole are exactly the groomed 14 actions on only ConversationalResultDispatcherFunctionRole-*.
• Logs are exactly the groomed six lifecycle/read/tag actions on only the dispatcher base and :* log-group forms.
• There is no dispatcher event-source mapping, EventInvokeConfig, queue, Function URL, invoke, EventBridge/Scheduler addition, runtime table/secret/Telegram/provider grant, broad resource, or IAM policy self-management.
• Existing stack-scoped EventBridgeDataOpsRules is unchanged and covers the one generated result rule; exact Lambda Add/RemovePermission covers the generated permission.
• Add transactional approval and durable execution recovery #124 PR Import DTC Operations content directory #18's worker/function/role/log/queue/mapping/tag boundaries and Extend the DataOps OIDC deploy role for reviewed sponsor communications #129's Sponsor compute/service boundaries remain enforced by parsed and mutation tests.

Default-off generated graph

Current corrected #126 transforms to exactly:

• ConversationalResultDispatcherFunction — AWS::Lambda::Function;
• ConversationalResultDispatcherFunctionRole — AWS::IAM::Role;
• ConversationalResultDispatcherFunctionResultDelivery — AWS::Events::Rule;
• ConversationalResultDispatcherFunctionResultDeliveryPermission — AWS::Lambda::Permission.

No dispatcher mapping, async config, queue, URL, API, layer, or separate log resource is generated. The rule now retains conditional State, with default false resolving to DISABLED and explicit true to ENABLED. I independently reran the transform contract: PASS.

Quotas and rollback/operator usability

Independent resolved compact sizes:

• aggregate inline: 9,341 / 10,240;
• Sponsor compute: 3,706 / 6,144;
• Sponsor service: 717 / 6,144;
• dispatcher: 1,512 / 6,144;
• source-managed attachments: 3 / standard 10.

The generated policy name, direct role reference, and absence of retention allow CloudFormation to detach/delete the dispatcher policy on rollback without a fixed-name orphan. Before apply, the operator must still inspect live external attachments and confirm its own managed-policy create/version/read/delete/tag and role attach/detach capabilities. The OIDC role correctly lacks those capabilities.

PM verification

• PASS — uv run --with pytest python -m pytest sandbox/dataops/tests -q: 34/34 tests and 50/50 negative subtests.
• PASS — sam validate --lint --template-file sandbox/dataops/template.github-actions.yaml.
• PASS — git diff --check 9b5b888..2a1b95f.
• PASS — clean isolated worktree and exact two-file diff.
• PASS — current Ship approved conversational todo creation #126 real SAM transform test, SAM lint, and git diff --check.
• PASS — commit contains Refs DataTalksClub/dataops#130.

Integration and remaining gates

#130 is accepted for source integration, but its declared dependency is real: #129 has independent TEST PASS but no PM acceptance comment yet. Do not merge 2a1b95f alone or bypass that gate. First obtain PM acceptance for #129 commit 9b5b888; then integrate the accepted commit chain into DataTalksClub/aws-infra using the repository's local-merge/push process. Do not open a PR under the current DataOps process.

Source integration does not apply AWS. Keep #130 open with human. A credentialed operator must review the CloudFormation change set/live attachments, apply dataops-github-actions with CAPABILITY_NAMED_IAM, require a terminal successful or explained rollback state, inspect the effective role, and then allow the normal default-off DataOps CI deployment. On-Call must verify the dispatcher function/role/logs, disabled generated schedule/no dispatch, and preserved #124/#129 capability before #130 can close.

No file, commit, branch, push, merge, AWS resource, provider, or runtime state was changed during PM acceptance.