chore: clarify public access and scope MCP

.gitignore

@@ -1,18 +1,14 @@
-# vim swap files
 **/*.sw[po]
 
 # don't commit terraform state or lock. the repo code is the only state we care about.
 # the provider state cache is auto-upgraded by default to ensure compatibility with upstream cloud provider APIs
 **/.terraform.lock.hcl
 **/.terraform
 
-# IDE Folders
 **/.vscode
 
-# Mac Finder cache
 **/.DS_Store
 
-# Plan output
 plan-output.txt
 
 # Generated pre-commit configuration

aws-s3.tf

@@ -66,7 +66,8 @@ resource "aws_s3_bucket" "web" {
   }
 }
 
-# Make "web" buckets publicly accessible
+# S3 website endpoints cannot authenticate object requests. This access block
+# permits public controls; the following policy grants anonymous GetObject.
 resource "aws_s3_bucket_public_access_block" "web" {
   for_each                = aws_s3_bucket.web
   bucket                  = each.value.bucket

opencode.json

@@ -16,6 +16,7 @@
     "aws-prod": {"enabled": false},
     "grafana": {"enabled": false},
     "terraform-docs": {"enabled": false},
+    "argocd-makeitwork": {"enabled": true},
     "argocd-staging-eks": {"enabled": false},
     "argocd-prod-eks": {"enabled": false}
   },
@@ -29,6 +30,7 @@
     "aws-prod_*": false,
     "grafana_*": false,
     "terraform-docs_*": false,
+    "argocd-makeitwork_*": true,
     "argocd-staging-eks_*": false,
     "argocd-prod-eks_*": false
   }