Allow OIDC deployment of Telegram rollout alarms and notifications

[alexeygrigorev]

Allow OIDC deployment of Telegram rollout alarms and health schedules

Status: corrected Gate B source integrated/applied/effective; production dark 17-alarm graph verification blocked by #136 (through #140 and #141)
Tags: enhancement, human, assistant, infra, testing, P1
Depends on: corrected #128 source/transform graph satisfied; successful normal CI deployment after #136 (which depends on #140, which depends on #141)
Blocks: #128 production/HUMAN closure only — source integration and IAM apply are complete
Related: #124, #129, #130

Current review state

The blocked bbb0841653603ee0830747fbb0df43979df0a0eb candidate was superseded by corrected Gate B source ddbaf2893bf2985d32e5a33310fe57e2f4ac9452. Independent Architecture, IAM/security, Tester, and PM reviews passed; the corrected source was integrated, applied through its reviewed CloudFormation change set, verified effective, and found IN_SYNC. No source correction or IAM apply remains.

Normal-CI attempt 2 produced no CloudWatch, SNS, or log IAM denial, but downstream rollback removed the rollout topic before the 17-alarm and health-schedule graph could remain live. The only remaining criterion is the normal-CI dark-deployment observation after #136 → #140 → #141 clears.

Historical source boundary

The accepted corrected change was limited to:

sandbox/dataops/template.github-actions.yaml
sandbox/dataops/tests/test_template_github_actions.py
sandbox/dataops/tests/fixtures/issue_128_observability.synthetic.yaml

That source stage is complete. It preserved #124/#129/#130 and introduced no DataOps application-source or CloudFormation service-role change.

Replacement #128 graph contract

Final review uses fresh replacement #128 source/build/transforms, not the old
fixture.

The observability family remains:

• one ConversationalRolloutAlarmTopic, exact name
  ${FullDocsStackName}-conversational-rollout-alarms, alias/aws/sns, ARN
  output only, no subscription/topic policy/contact;
• exactly three retained 30-day custom log groups:
  backend, execution, and result-dispatcher;
• exactly 17 simple AWS::CloudWatch::Alarm resources with exact
  ${FullDocsStackName}-conversational-<suffix> names and the one topic action;
• heartbeat suffixes execution-worker-heartbeat-stale,
  recovery-heartbeat-stale, and result-dispatcher-heartbeat-stale use
  TreatMissingData: breaching;
• the other 14 alarms retain TreatMissingData: notBreaching;
• no subscription, topic policy, dashboard, composite, anomaly, canary,
  metric/filter/subscription, or additional observability family.

Keep the same 17 suffixes already enumerated by bbb0841:

execution-outcome-unknown
execution-failure-queue-visible
recovery-oldest-due-age
execution-worker-heartbeat-stale
recovery-heartbeat-stale
result-delivery-outcome-unknown
result-delivery-oldest-pending
result-dispatcher-heartbeat-stale
result-delivery-failed
telegram-webhook-failures
model-failures
voice-failures
photo-failures
typefully-draft-failed
media-cleanup-failed
retention-cleanup-failed
execution-failed-safe

#128 adds one execution-conditioned two-minute health-pulse Schedule event to
the existing execution worker. The SAM transform therefore adds one
stack-prefixed AWS::Events::Rule and one AWS::Lambda::Permission targeting
ConversationalExecutionWorkerFunction, in addition to the existing recovery
and result-dispatcher schedule resources. Update the fixture/final graph test
with the exact generated logical IDs, state/condition, input, target, and
permission ownership.

Do not add EventBridge or Lambda actions to the observability managed policy.
The accepted Gate A deploy policy already covers stack-prefixed EventBridge
rule lifecycle/tagging and Add/RemovePermission on the exact worker function
family. Structural tests must prove the new transformed resources fit those
existing statements without changing them.

Managed-policy placement and quotas

Retain one generated-name
ConversationalRolloutObservabilityDeployPolicy, attached only to
GitHubActionsDeployRole. Do not set ManagedPolicyName, grow the nearly full
inline policy, mix domains into Sponsor/dispatcher policies, or grant policy
self-administration.

The corrected compact observability policy must be <= 5,632 characters,
leaving at least 512 below IAM's 6,144-character managed-policy limit. Preserve
all prior policy ceilings and the four-policy steady-state/eight-policy
replacement attachment model. Recompute from resolved documents.

Exact corrected OIDC permissions

CloudWatch alarm lifecycle and tag-on-create

Retain cloudwatch:PutMetricAlarm on only the exact 17 alarm ARNs, with:

• a non-null cloudwatch:AlarmActions; and
• every action equal to the one exact rollout topic ARN.

Retain cloudwatch:DescribeAlarms and cloudwatch:DeleteAlarms on those exact
17 ARNs.

Add cloudwatch:TagResource on only those same 17 exact alarm ARNs. It is
required because CloudFormation automatically supplies system tags, the alarm
resource supports tags, and AWS maps tagged alarm creation to
cloudwatch:TagResource in addition to PutMetricAlarm.

Do not place TagResource in the alarm-action-conditioned Put statement:
that condition is not present on the separate tag call. Keep it in a separate
statement or with the unconditioned exact-ARN lifecycle statement.

Do not condition CloudWatch tag permission on the three aws: system tag keys.
Although CloudWatch exposes generic request-tag condition keys, its alarm
tagging guidance explicitly says tag names beginning aws: cannot be used for
tag-based authorization control. The exact 17 ARNs are the reliable boundary.

Add no UntagResource, ListTagsForResource, metric data plane, state forcing,
composite/dashboard/anomaly/canary, or wildcard alarm capability.

Authoritative references:

• https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-resource-tags.html
• https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-cloudwatch-alarm.html
• https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_alarms_and_tagging.html
• https://docs.aws.amazon.com/service-authorization/latest/reference/list_cloudwatch.html

SNS topic lifecycle and tag-on-create

Retain exactly:

sns:CreateTopic
sns:DeleteTopic
sns:GetTopicAttributes
sns:SetTopicAttributes

on the one exact topic ARN.

Add a separate sns:TagResource statement on that same exact topic ARN.
Require a non-null aws:TagKeys request and use
ForAllValues:StringEquals (or an independently proven equivalent) limiting
the request to:

aws:cloudformation:logical-id
aws:cloudformation:stack-id
aws:cloudformation:stack-name

The condition must reject a missing key set and any customer/extra tag key.
SNS documents aws:TagKeys for TagResource; the official CloudFormation SNS
provider supplies system tags on create.

Do not add ListTagsForResource, ListSubscriptionsByTopic,
GetDataProtectionPolicy, UntagResource, publish, subscription,
confirmation, topic-policy, endpoint, KMS, wildcard, or other optional action.
The provider deliberately tolerates denial of the optional reads; they are not
proven deployment blockers.

Authoritative references:

• https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-resource-sns-topic.html
• https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonsns.html

Retained log groups

Retain the accepted exact policy:

• logs:CreateLogGroup and logs:PutRetentionPolicy on the base and :*
  forms for only the three custom /dataops/${FullDocsStackName}/conversational
  groups;
• logs:DescribeLogGroups alone on Resource: "*";
• no delete, stream/event data plane, query/export/filter/subscription/policy,
  KMS, delivery, or additional wildcard.

Acceptance criteria

• Changes remain limited to the deploy-role template, focused tests, and
  corrected public-safe fixture.
• One generated observability policy attaches only to the deploy role and
  preserves Add transactional approval and durable execution recovery #124/Repair DataOps OIDC SES configuration-set tag-on-create permission #129/Repair dispatcher generated-role IAM prefix for CloudFormation rollback #130 policies unchanged.
• Put/read/delete permissions cover only the 17 exact alarm ARNs and retain
  the exact alarm-action condition.
• cloudwatch:TagResource covers only the same 17 exact alarm ARNs, has no
  misleading system-tag condition, and no CloudWatch list/untag action is
  added.
• SNS lifecycle covers only the exact topic; separate
  sns:TagResource is exact-topic and accepts only the three non-null
  CloudFormation system tag keys.
• No optional tolerated SNS read, publish/subscription, topic-policy, KMS,
  wildcard, or other action is added.
• Log-group policy remains exact and unchanged except for size bookkeeping
  if statement ordering changes.
• Corrected compact policy is <=5,632 characters and all prior quota/
  attachment headroom remains safe.
• Final fixture matches Roll out and cut over the Telegram conversational MVP #128's 17 alarms with exactly three
  missing-as-breaching heartbeat alarms and 14 not-breaching alarms.
• Fixture/transform assertions include the new worker health EventBridge
  rule/Lambda permission and prove existing Gate A IAM covers them.
• Mutation tests reject missing/broad tag actions, extra tag keys, absent
  aws:TagKeys, broad resources, optional reads, data plane, self-admin,
  existing-policy drift, and every prior adversarial mutation.
• Fresh final Roll out and cut over the Telegram conversational MVP #128 source/build/transforms and all sandbox/dataops tests,
  SAM lint, resolved-size checks, and diff checks pass.
• Independent IAM/security and PM review accept the corrected commit range
  and exact final Roll out and cut over the Telegram conversational MVP #128 graph before source integration.
• [HUMAN/AWS] Corrected Gate B source is integrated; credentialed apply reached terminal success; the effective policy matches the accepted permissions and is in sync.
• [HUMAN] A normal-CI Roll out and cut over the Telegram conversational MVP #128 dark deployment leaves the exact 17-alarm, topic, and health-schedule graph live without authorization denial, unexpected paging, or leakage.

Required tests

Run:

uv run --with pytest python -m pytest sandbox/dataops/tests -q
sam validate --lint --template-file sandbox/dataops/template.github-actions.yaml
git diff --check 2a1b95f...HEAD

Parsed structural/mutation tests must prove:

• exact statement/action/resource/condition sets;
• SNS tag requests are non-null and limited to the three system keys;
• CloudWatch tag access is exact-ARN and not incorrectly tied to
  cloudwatch:AlarmActions;
• no new list/read/untag/data-plane/wildcard/self-admin action;
• exact 3/14 heartbeat missing-data split;
• exact transformed worker pulse rule/permission and reuse of existing Gate A
  EventBridge/Lambda permission statements;
• deterministic resolved policy sizes/attachments and Add transactional approval and durable execution recovery #124/Repair DataOps OIDC SES configuration-set tag-on-create permission #129/Repair dispatcher generated-role IAM prefix for CloudFormation rollback #130
  preservation.

Fresh-build #128 into an isolated directory and translate dark, execution,
ingress, voice, photo, Typefully-external, and fully staged states. Compare
actual logical IDs, names, actions, conditions, schedules, permissions,
retention/retain policies, and prohibited families. Do not use stale
.aws-sam output or self-compare an in-test constant.

Sequencing and apply

1. Roll out and cut over the Telegram conversational MVP #128 SWE produces the replacement runtime/SAM candidate.
2. Assistant and Architect accept its heartbeat/maintenance behavior and fresh
   graph.
3. Allow OIDC deployment of Telegram rollout alarms and notifications #131 SWE corrects the existing isolated IAM candidate and fixture.
4. Independent IAM/security Tester and PM accept the exact corrected range.
5. Integrate accepted source into aws-infra/main with
   Refs DataTalksClub/dataops#131; add human.
6. A credentialed operator reviews change sets/live attachments and applies
   dataops-github-actions with CAPABILITY_NAMED_IAM.
7. Verify terminal stack state and effective policy before Roll out and cut over the Telegram conversational MVP #128 commit/push.
8. On-Call verifies the default-off app deployment creates the exact graph and
   no alarm pages. Roll out and cut over the Telegram conversational MVP #128 owns subscription confirmation and alarm canaries.

Rollback uses CloudFormation and the prior accepted template, never manual IAM
editing or destructive resource cleanup.

Out of scope

#128 runtime implementation, extra alarms/metrics, subscription/contact
management, notifications, provider/Telegram calls, secrets, application
deployment outside CI, manual IAM edits, dashboards/composites/anomalies/
canaries, log data plane, optional provider reads, and any other repository or
stack.

[alexeygrigorev]

PM GROOMED — READY FOR ISOLATED AWS-INFRA IMPLEMENTATION

Validated the intake author (alexeygrigorev) and reviewed #128's full re-groomed rollout contract, Architect/On-Call findings, accepted #124/#129/#130 policy chain, current aws-infra/origin/main at 2a1b95f, resolved policy sizes/attachments, and official CloudWatch/SNS/Logs authorization/resource behavior.

Binding decisions now encoded in #131:

• Freeze one exact public-safe Roll out and cut over the Telegram conversational MVP #128 observability graph: 17 named AWS::CloudWatch::Alarm resources, one ConversationalRolloutAlarmTopic, exactly three new custom retained log groups, and no other observability family.
• The topic is encrypted with alias/aws/sns, outputs only its ARN, and contains no stack subscription, endpoint, contact, or topic policy. Therefore the deploy role gets no Subscribe/Unsubscribe/Confirm/Publish permission and no KMS permission. Subscription confirmation remains out-of-band/HUMAN.
• Existing automatically created /aws/lambda/... groups are never declared/adopted/deleted. New groups use exact /dataops/${FullDocsStackName}/conversational/{backend,execution,result-dispatcher} names, 30-day retention, and retain policies.
• Add one fourth generated-name customer-managed policy attached only to the GitHub Actions deploy role. Do not grow the 9,341-character inline policy or mix observability into Sponsor/dispatcher policies.
• CloudWatch permission is exact PutMetricAlarm plus exact read/delete on the 17 alarm ARNs. Put is condition-bound to the one exact SNS alarm action. There is no metric data plane, state forcing, dashboard/composite/anomaly/canary, wildcard alarm, or tag capability.
• SNS permission is only Create/Delete/Get/Set attributes on the exact topic. Logs permission is only Create/PutRetention on six exact ARN forms plus the single documented unscoped DescribeLogGroups read action. Retained log groups cannot be deleted by this role.
• Deterministic policy ceilings preserve current Add transactional approval and durable execution recovery #124/Repair DataOps OIDC SES configuration-set tag-on-create permission #129/Repair dispatcher generated-role IAM prefix for CloudFormation rollback #130 sizes. The new policy must remain <=5,120 characters; source attachments become 4/10. The operator must inspect live attachments because simultaneous replacement of all four could temporarily use 8/10.
• Parsed structural and adversarial mutation tests must reject every broader action/resource/condition, preserve all accepted policy/trust boundaries, and measure resolved documents—not source lines.
• Final acceptance requires fresh Roll out and cut over the Telegram conversational MVP #128 builds and real SAM transforms for default-off and controlling switch states. Tests must compare actual logical IDs/names/conditions/topic/log ownership, not an in-test constant with itself.
• Implementation, independent IAM/security review, PM acceptance, local source integration, credentialed named-IAM apply, rollback, and On-Call default-off verification are separate gates. Source merge alone changes no AWS permission.

Readiness/dependency:

• Isolated aws-infra implementation can start now from current origin/main using the frozen contract.
• Final review/merge is conditional on the final Roll out and cut over the Telegram conversational MVP #128 SAM/transformed graph matching the exact contract. Graph drift requires PM/Architect review and regrooming rather than speculative policy broadening.
• Allow OIDC deployment of Telegram rollout alarms and notifications #131 blocks Roll out and cut over the Telegram conversational MVP #128 dark deployment, not Roll out and cut over the Telegram conversational MVP #128's earlier code dependency work.
• Keep Allow OIDC deployment of Telegram rollout alarms and notifications #131 open with human after source integration. Credentialed apply/effective-policy/default-off evidence is required before closure; Roll out and cut over the Telegram conversational MVP #128 separately owns subscription confirmation and alarm canaries.

No repository file, commit, branch, push, merge, AWS stack, alarm, topic, subscription, log group, provider, or runtime state was changed during grooming.

[alexeygrigorev]

Software Engineer handoff — isolated observability deploy policy ready for security review

Implemented the frozen #131 IAM contract as a separate commit directly above accepted/pushed #130. No remote push/merge, AWS call/apply, dirty-checkout edit, or DataOps source edit was performed.

Isolated branch

• Repository: DataTalksClub/aws-infra
• Worktree: /home/alexey/git/.worktrees/aws-infra-131
• Branch: issue-131-conversational-rollout-observability-deploy-role
• Exact base: 2a1b95f4fd0f4d8d0d24e6edf4a337281c2aea79
• Allow OIDC deployment of Telegram rollout alarms and notifications #131 commit: bbb0841653603ee0830747fbb0df43979df0a0eb
• Commit trailer: Refs DataTalksClub/dataops#131
• Worktree: clean

Changed only the shared deploy-role source and its focused test assets:

• sandbox/dataops/template.github-actions.yaml
• sandbox/dataops/tests/test_template_github_actions.py
• sandbox/dataops/tests/fixtures/issue_128_observability.synthetic.yaml

Exact managed-policy boundary

Added one generated-name AWS::IAM::ManagedPolicy, ConversationalRolloutObservabilityDeployPolicy, attached only via Roles: [!Ref GitHubActionsDeployRole]; it has no fixed ManagedPolicyName and grants no policy self-administration.

Its five exact statements are:

1. cloudwatch:PutMetricAlarm on the 17 frozen exact alarm ARNs. The statement requires both:
   • Null: { cloudwatch:AlarmActions: "false" }, preventing an absent alarm action;
   • ForAllValues:ArnEquals binding every action to the one exact ${FullDocsStackName}-conversational-rollout-alarms topic ARN.
2. cloudwatch:DescribeAlarms and cloudwatch:DeleteAlarms on the same 17 exact alarm ARNs.
3. sns:CreateTopic, DeleteTopic, GetTopicAttributes, and SetTopicAttributes on the one exact rollout topic ARN.
4. logs:CreateLogGroup and PutRetentionPolicy on the base and :* forms of exactly the backend, execution, and result-dispatcher /dataops/.../conversational/... groups.
5. logs:DescribeLogGroups alone on Resource: "*", the policy's sole wildcard resource.

No CloudWatch metric data plane/state forcing/composite/dashboard/anomaly/canary/tag action; SNS publish/subscription/policy/endpoint/tag action; KMS action; log deletion/data-plane/query/export/filter/subscription/policy/index/KMS/delivery action; or IAM self-management was added.

The inline, Sponsor compute/service, and dispatcher policies remain domain-pure. All #124/#129/#130 structural and adversarial preservation tests remain active.

Combined automated evidence

PASS:

uv run --with pytest python -m pytest sandbox/dataops/tests -q
47 passed, 94 subtests passed

sam validate --lint --template-file sandbox/dataops/template.github-actions.yaml
valid SAM template

git diff 2a1b95f4fd0f4d8d0d24e6edf4a337281c2aea79 --check
clean

Mutation tests reject missing/extra/broad alarm ARNs; absent/different/additional alarm actions; CloudWatch data plane and other resource families; SNS publish/subscription/policy/tag/KMS; log deletion/data-plane/broad resources/additional wildcard actions; fixed policy name/extra role/self-administration; and all earlier-policy regressions.

Resolved sizes and replacement headroom

Actual policy documents were default/pseudo-value resolved and compact JSON serialized:

• aggregate inline: 9,341, leaving 899 below 10,240;
• Sponsor compute: 3,706, leaving 2,438 below 6,144;
• Sponsor service: 717, leaving 5,427 below 6,144;
• dispatcher: 1,512, leaving 4,632 below 6,144;
• observability: 4,977, below the 5,120 ceiling and leaving 1,167 below 6,144;
• steady-state attachments: 4/10, leaving 6;
• simultaneous replacement model: 8/10, leaving 2 before any external attachment.

Live external attachments remain a mandatory operator inspection before apply.

#128 graph status — explicit pre-merge blocker

#128 is not implemented yet; no DataOps worktree or template currently contains ConversationalRolloutAlarmTopic. Therefore no honest final #128 build or SAM transform comparison can be reported now.

A parsed, public-safe synthetic fixture captures the frozen PM contract independently from the policy constants:

• exact topic name/type/alias/aws/sns/output and no subscription/topic policy;
• exact three custom group names, owners, 30-day retention, and Retain policies;
• exact 17 alarm logical IDs and suffixes;
• prohibited subscription/topic-policy/composite/dashboard/log-filter families.

The fixture intentionally asserts:

Synthetic: true
RequiresFinalBuildTransformRevalidation: true

FINAL #128 BUILD/TRANSFORM REVALIDATION IS REQUIRED BEFORE MERGE/ACCEPTANCE. Once #128 exists, an independent reviewer must fresh-build and translate default-off plus every controlling switch state, compare actual topic/groups/alarm subsets/names/actions/conditions/retention/ownership and prohibited resource types to the fixture/policy, and reject or regroom #131 on any drift. This commit must not be pushed/merged or applied based only on the synthetic fixture.

READY FOR INDEPENDENT IAM/SECURITY REVIEW of the committed policy and tests, with final #128 graph verification explicitly pending.

[alexeygrigorev]

TEST PASS — IAM source under frozen specification only

Independently reviewed aws-infra commit bbb0841653603ee0830747fbb0df43979df0a0eb atop accepted 2a1b95f. This is a conditional source/security pass, not final #131 merge/PM acceptance and not authorization to apply AWS changes.

Source/security verdict

PASS for the committed IAM source against the frozen #128 graph:

• exactly one generated-name ConversationalRolloutObservabilityDeployPolicy, attached only to GitHubActionsDeployRole; no fixed name, inline-policy growth, other-role attachment, or policy self-administration;
• PutMetricAlarm is limited to the exact 17 frozen alarm ARNs and requires a present cloudwatch:AlarmActions value whose every member equals the one exact rollout SNS topic ARN;
• DescribeAlarms/DeleteAlarms use the same exact 17 ARNs;
• SNS lifecycle is exactly CreateTopic, DeleteTopic, GetTopicAttributes, and SetTopicAttributes on the single exact topic ARN—no publish, subscription, topic-policy, endpoint, tag, or KMS administration;
• Logs lifecycle is exactly CreateLogGroup/PutRetentionPolicy on the base and :* ARN forms of the three frozen backend, execution, and result-dispatcher custom groups; DescribeLogGroups alone has Resource: "*", the sole wildcard;
• forbidden CloudWatch data-plane/state/composite/dashboard/anomaly/canary/tag actions, log delete/data-plane/query/export/filter/policy/KMS/delivery actions, and IAM/KMS management are absent;
• accepted Add transactional approval and durable execution recovery #124/Repair DataOps OIDC SES configuration-set tag-on-create permission #129/Repair dispatcher generated-role IAM prefix for CloudFormation rollback #130 policies and tests remain preserved.

AWS's current service-authorization reference confirms alarm ARNs are supported for PutMetricAlarm, DescribeAlarms, and DeleteAlarms, and cloudwatch:AlarmActions is supported by PutMetricAlarm. AWS's alarm-action guidance confirms that condition key is the intended control for restricting alarm actions.

Independent evidence

uv run --with pytest python -m pytest sandbox/dataops/tests -q
47 passed, 94 subtests passed in 0.64s

sam validate --lint --template-file sandbox/dataops/template.github-actions.yaml
valid SAM template

git diff 2a1b95f..bbb0841653603ee0830747fbb0df43979df0a0eb --check
clean

Independent resolved-size/quota check:

aggregate inline                 9,341 / 10,240
Sponsor compute managed policy  3,706 / 6,144
Sponsor service managed policy    717 / 6,144
dispatcher managed policy       1,512 / 6,144
observability managed policy    4,977 / 6,144 (also below frozen 5,120 ceiling)
steady-state attachments            4 / 10
replacement model                  8 / 10

Commit history is linear above 2a1b95f and includes accepted 9b5b888 and PR #18/#124 ancestry. The isolated aws-infra worktree remained clean and only the three handed-off files differ from the base.

Mandatory unresolved pre-merge gate

The fixture is correctly and conspicuously marked:

Synthetic: true
RequiresFinalBuildTransformRevalidation: true

It is not an actual #128 build. #128 remains open/unimplemented, and the current DataOps template does not contain ConversationalRolloutAlarmTopic or the frozen alarm/log-group logical IDs. Therefore this test pass cannot establish that the eventual application graph matches these permissions.

Before #131 merge or final PM acceptance, an independent reviewer must fresh-build and SAM-transform the implemented #128 default-off template and every controlling switch state, then compare the actual topic, three log groups, 17 alarm subsets/names/actions/conditions/retention/ownership, and prohibited resource types against the frozen fixture and this policy. Any drift requires #131 correction or explicit regrooming. Live external managed-policy attachments must also be inspected before the later credentialed apply.

Verdict: TEST PASS for source-under-frozen-spec; final build/transform verification remains a hard pre-merge/PM gate. No commit, push, merge, AWS call, or apply was performed.

[alexeygrigorev]

ARCHITECTURE BLOCKED — bbb0841 must not proceed or be applied

The final build/transform architecture gate is blocked. Full evidence and the exact frozen fingerprint are in the #128 Architect review.

Two hard blockers prevent #131 commit bbb0841653603ee0830747fbb0df43979df0a0eb from proceeding to final review, merge acceptance, or credentialed Gate B apply:

1. The frozen Roll out and cut over the Telegram conversational MVP #128 graph's three stale-heartbeat alarms cannot breach. Their only runtime emitters publish literal age 0; a stopped/stalled component publishes nothing; and each alarm uses TreatMissingData: notBreaching. The worker, recovery, and result-dispatcher stale alarms therefore cannot detect the failure they name. Fix or regroom the metric/alarm semantics, prove fresh/stale/stopped states, then refreeze the graph and IAM contract.
2. The Allow OIDC deployment of Telegram rollout alarms and notifications #131 deploy policy grants sns:CreateTopic but omits sns:TagResource. CloudFormation automatically supplies system tags, and the archived official AWS SNS provider explicitly declares system-tag-on-create support, merges those system tags into CreateTopic, and includes sns:TagResource in its resource-role permissions. AWS documents that tagged CreateTopic requires both permissions. With no separate CloudFormation service role, the OIDC deploy credentials must carry the needed resource permission. The exact-topic lifecycle policy is therefore not deployable as written.

The second finding is not an argument to add every action declared by the provider. Its read path deliberately tolerates authorization denial for ListTagsForResource, ListSubscriptionsByTopic, and GetDataProtectionPolicy; those are not asserted as hard blockers. The definite missing create permission is sns:TagResource, which should remain exact-topic and condition-restricted to CloudFormation system tag keys where supported, with structural tests.

One additional permission question requires explicit PM/IAM resolution before acceptance: bbb0841 also omits cloudwatch:TagResource for all 17 alarms. AWS documents that creating tagged alarms requires it, while CloudFormation documents automatic system tags. Establish authoritatively whether this alarm provider/deployment path passes system tags. If yes, grant it only over the exact 17 alarm ARNs with supported conditions and tests; if no, record the authoritative basis in the groomed contract. Do not use a live apply to discover the answer.

The regenerated #128 source and fresh built graphs otherwise match #131's synthetic fixture exactly: one topic, three retained 30-day log groups, 17 alarms, no subscriptions/topic policies/forbidden observability resources, and active-alarm counts of dark 0, execution 6, ingress 7, voice 9, photo 9, Typefully external 7, and fully staged 17. The rest of bbb0841 remains least-privilege and structurally exact against that frozen graph.

Verdict: ARCHITECTURE BLOCKED. Do not merge/apply bbb0841; correct or explicitly regroom, then repeat independent transform/IAM review.

I did not change the issue body or labels, edit repository files, commit, push, merge, deploy, call AWS, or apply CloudFormation. The only external effect here is this requested cross-linked review comment.

[alexeygrigorev]

PM REGROOMED — IAM/FIXTURE CORRECTION REQUIRED

Commit bbb0841 remains isolated and must not be merged or applied.

Binding IAM decisions:

• Add sns:TagResource on the exact topic in a separate statement, require
  non-null aws:TagKeys, and allow only the three CloudFormation system tag
  keys. Add no tolerated optional SNS reads.
• Add cloudwatch:TagResource on only the exact 17 alarm ARNs. CloudFormation
  supplies system tags and AWS maps tagged alarm creation to this permission.
  Do not condition it on AWS-prefixed tag keys because CloudWatch explicitly
  says those keys cannot be used for tag-based authorization; exact ARNs are
  the reliable bound.
• Add no list/untag/data-plane permissions.
• Update the fixture for the three heartbeat alarms' missing-as-breaching
  semantics and the SAM-generated worker health EventBridge rule/Lambda
  permission. Prove existing Gate A IAM covers those schedule edges; do not add
  EventBridge/Lambda actions to the observability policy.
• Raise only the deterministic observability-policy ceiling needed for the two
  exact tag statements: <=5,632 characters, retaining >=512 bytes of headroom.

Sequence remains #128 replacement and specialist graph acceptance first, then
#131 correction/security/PM review, source integration, credentialed Gate B
apply, and only then #128 commit/push.

READY FOR #128 REPLACEMENT; #131 CORRECTION MAY PREPARE BUT FINAL GRAPH REVIEW IS BLOCKED