{
  "schema_version": 1,
  "issue": 2515,
  "inventory_source_revision": "aabc5604c",
  "configuration_coordination": {
    "status": "applied_in_this_change",
    "base_revision": "aabc5604c",
    "uploads_policy_source": "cddb110ce"
  },
  "aws_account_id": "239023060546",
  "aws_region": "ap-southeast-1",
  "import_manifest_sha256": "da394c29fc0f6e6683e25145aecefef8977e2a27061c09e4bd50f735dc98fe18",
  "execution_gate": "01_import_batches",
  "stage00_bundle": {
    "path": "stage00-bundle.json",
    "sha256": "b527f363664613e28c7ece92e4728a576ebbf95b1f991bbb3e64652f9726d1b9",
    "guard_requirement": "plan and apply must rehash every listed committed artifact before any Terraform operation"
  },
  "safety": {
    "allowed_now": [
      "read-only inventory and configuration coordination",
      "use only the reviewed non-secret production input artifact",
      "render one exact dependency-ordered Stage 01 operation with a saved targeted plan; imports are no-op and the isolated ACM waiter batch is exact-create-only",
      "apply only the exact reviewed saved plan after all SHA256, caller identity, region and state-marker checks pass"
    ],
    "forbidden_now": [
      "direct terraform import",
      "terraform state mutation",
      "non-targeted or unsaved Stage 01 plan",
      "terraform apply that does not consume the exact reviewed saved plan",
      "Stage 02 target-attachment state record before all 63 imports complete"
    ],
    "securestring_values_read": false
  },
  "remote_state_evidence": {
    "bucket": "helix-terraform-state-239023060546",
    "configured_key_from_issue": "infra/aws/environments/prod/terraform.tfstate",
    "object_exists": false,
    "versioning": "Enabled",
    "default_encryption": "aws:kms",
    "public_access_block": true,
    "lock_table": "helix-terraform-lock",
    "lock_table_status": "ACTIVE"
  },
  "known_replacement_blockers": [],
  "replacement_assurance": "not_yet_plan_verified",
  "controlled_inputs": {
    "runtime_tfvars_path": "production-inputs.tfvars.json",
    "runtime_tfvars_sha256": "203a2aad3811c79d7d1735e681885a8f63fd033abf3a9d008c8e6dc16134dd20",
    "backend_config_path": "production-backend.hcl",
    "backend_config_sha256": "08d5f0febbbb364337da106101c7a8766b5d8224f00f55f9c4788eab71865cad",
    "values": {
      "region": "ap-southeast-1",
      "project": "helix",
      "environment": "prod",
      "domain_name": "helix.pingcap.net",
      "github_org": "pingcap-inc",
      "github_repo": "Helix",
      "ec2_key_name": "",
      "ec2_instance_type": "t3.large",
      "redis_node_type": "cache.t3.micro"
    },
    "guard": "the Stage 01 guard recomputes both reviewed repository artifact hashes before plan review and immediately before apply; neither artifact contains secrets"
  },
  "execution_stages": [
    {
      "stage": "00_pre_import_controls",
      "status": "completed",
      "exit_requirements": [
        "review and pin production inputs without exposing sensitive values",
        "complete pre_import_iam_cutover and verify refreshed live policy evidence equals desired",
        "complete pre_import_alb_readiness_cutover and verify the target remains healthy on /api/v1/ready",
        "approve the dependency-ordered state-record strategy: ACM waiter before edge, target attachment only after all imports"
      ],
      "terraform_allowed": false,
      "evidence": "stage00-evidence.json"
    },
    {
      "stage": "01_import_batches",
      "entry_requires": "all stage 00 evidence committed and reviewed",
      "allowed": "one dependency-ordered import batch at a time using import blocks and a saved plan targeted to every address in that exact batch; all dependencies must already be in prior-batch state",
      "plan_json_gate": "targets and planned imports equal the exact batch; no unimported later-batch address is planned; import batches have zero create/update/delete/replace actions; 06-acm-validation has exactly one create for the waiter and no other action",
      "apply_gate": "immediately before apply, recompute the reviewed saved plan SHA256, verify caller account 239023060546 and region ap-southeast-1, and prove the remote-state VersionId/lineage/serial marker still equals the marker captured at planning; apply only that saved plan and record the new state object VersionId/lineage/serial"
    },
    {
      "stage": "02_state_records",
      "entry_requires": "all 63 importable addresses are recorded and refreshed without drift",
      "allowed": "the target-group attachment alone in a separately saved targeted plan",
      "plan_json_gate": "the exact address has one create action and every other address has zero actions",
      "apply_gate": "immediately before apply, recompute the reviewed saved plan SHA256, verify caller account 239023060546 and region ap-southeast-1, prove the remote-state VersionId/lineage/serial marker still equals the marker captured at planning, recheck live preconditions, and apply only that saved plan"
    },
    {
      "stage": "03_final_zero_action",
      "entry_requires": "both state-record operations completed and production health remained green",
      "plan_json_gate": "a full non-targeted plan has create/update/delete/replace counts all equal to zero",
      "completion": "only the reviewed zero-action result permits ordinary Terraform ownership"
    }
  ],
  "stage01_machine_guard": {
    "path": "stage01_guard.py",
    "only_authorized_apply_entrypoint": true,
    "minimum_python_version": "3.12",
    "terraform_version": "1.7.5",
    "terraform_binary_sha256": "c4afcbc47310f2d44c07275743bfd48c13578f22c2a1564c4f446998df0d8429",
    "aws_cli_version": "2.33.30",
    "aws_cli_binary_sha256": "6ee8be6fea5fbc3034035db4145ab617df82d455775b5823f8424256458d8e00",
    "targeted_plan_allowed_unknown_checks": {
      "module.ec2.var.uploads_bucket_arn": "module.ec2."
    },
    "review_requires": [
      "exact batch address-to-import-ID mapping from the manifest",
      "all managed resource actions are no-op except exact-create-only aws_acm_certificate_validation.main in 06-acm-validation",
      "no later, unknown or unrelated managed address",
      "plan JSON byte hash equals fresh terraform show -json output from the exact saved plan",
      "reviewed manifest, tfvars, backend, saved plan and plan JSON SHA256",
      "canonical initialized S3 backend semantic hash binds the entire backend config including the reviewed bucket, key, region, DynamoDB lock table and encryption while excluding transient top-level Terraform metadata bytes",
      "plan is generated only inside a mode-0700 sealed copy of the exact source, Terraform binary, inputs and provider lock",
      "Terraform JSON format_version 1.2, terraform_version 1.7.5, errored false, exact variable set, all evaluated checks pass, and only the exact reviewed module.ec2.var.uploads_bucket_arn check may be unknown while the current targeted batch contains no module.ec2 address",
      "expected AWS account/region and exact pre-plan state VersionId/lineage/serial marker",
      "review evidence is committed through a reviewed PR and merged to origin/main before apply"
    ],
    "pre_apply_rechecks": [
      "all reviewed artifact SHA256 values",
      "exact import/state-record mapping and only its reviewed action shape",
      "AWS account 239023060546 and AWS_REGION ap-southeast-1",
      "unchanged remote-state object absence or exact VersionId/lineage/serial"
    ],
    "apply_command_contract": "terraform -chdir=<reviewed-root> apply -input=false <exact-reviewed-saved-plan>; no replan and no apply-time -target",
    "post_apply": "persist terraform_apply_returned_success before leaving the sealed execution context, then record the new VersionId/lineage/serial atomically and require all three fixed no-redirect production probes to return 200; finalize may resume only these post-apply checks and cannot execute Terraform"
  },
  "saved_plan_integrity": {
    "review_source": "terraform show -json must consume the exact saved plan file that will be applied",
    "planning_state_marker": "capture S3 VersionId plus Terraform lineage and serial; for the first batch record explicit object absence",
    "pre_apply_checks": [
      "recompute saved plan SHA256 and compare with the reviewed value",
      "verify AWS caller account is 239023060546 and configured region is ap-southeast-1",
      "verify remote-state object absence or exact VersionId/lineage/serial still matches planning evidence",
      "treat Terraform stale-plan rejection as an additional guard rather than a replacement for these checks"
    ]
  },
  "replacement_sensitive_contract": [
    {
      "addresses": [
        "module.network.aws_subnet.public[0]",
        "module.network.aws_subnet.public[1]"
      ],
      "field": "cidr_block",
      "desired": ["10.0.1.0/24", "10.0.2.0/24"],
      "live": ["10.0.1.0/24", "10.0.2.0/24"],
      "guard": "CIDR is ForceNew; desired is intentionally pinned to the adopted live subnets"
    },
    {
      "addresses": [
        "module.security.aws_security_group.alb",
        "module.security.aws_security_group.app",
        "module.security.aws_security_group.cache",
        "module.security.aws_security_group.db"
      ],
      "field": "description",
      "desired": ["ALB SG", "App SG", "Cache SG", "DB SG"],
      "live": ["ALB SG", "App SG", "Cache SG", "DB SG"],
      "guard": "AWS security-group descriptions are ForceNew and must remain equal to live"
    },
    {
      "addresses": [
        "module.ecr.aws_ecr_repository.this[\"helix-server\"]",
        "module.ecr.aws_ecr_repository.this[\"helix-web\"]",
        "module.ecr.aws_ecr_repository.this[\"helix-worker\"]"
      ],
      "field": "name",
      "desired": ["helix-server", "helix-web", "helix-worker"],
      "live": ["helix-server", "helix-web", "helix-worker"],
      "guard": "repository names are replacement-sensitive and pinned to the established identities"
    },
    {
      "addresses": ["module.ec2.aws_iam_role_policy.ecr_secrets"],
      "field": "name",
      "desired": "helix-prod-ecr-ssm-s3",
      "live": "helix-prod-ecr-ssm-s3",
      "guard": "inline-policy identity is pinned to the established live name"
    },
    {
      "addresses": ["module.elasticache.aws_elasticache_subnet_group.this"],
      "field": "name",
      "desired": "helix-prod-cache-subnet",
      "live": "helix-prod-cache-subnet",
      "guard": "subnet-group name is replacement-sensitive and pinned to live"
    },
    {
      "addresses": ["module.elasticache.aws_elasticache_replication_group.this"],
      "field": "replication_group_id",
      "desired": "helix-prod-redis",
      "live": "helix-prod-redis",
      "guard": "replication-group ID is replacement-sensitive and pinned to live"
    }
  ],
  "dangerous_in_place_contract": [
    {
      "address": "module.ssm_secrets.aws_ssm_parameter.app_env",
      "field": "value",
      "desired": "production",
      "live": "production",
      "guard": "a different value changes the application's production storage isolation behavior"
    },
    {
      "address": "module.alb.aws_lb_target_group.this",
      "field": "health_check.path",
      "desired": "/api/v1/ready",
      "live": "/api/v1/ready",
      "guard": "Stage 00 changed only the health path and verified five consecutive healthy windows before exposing the import ID"
    },
    {
      "address": "module.alb.aws_lb_target_group.this",
      "field": "health_check.thresholds",
      "desired": {
        "healthy": 5,
        "unhealthy": 2
      },
      "live": {
        "healthy": 5,
        "unhealthy": 2
      },
      "guard": "threshold tuning is intentionally outside state adoption"
    },
    {
      "address": "module.alb.aws_lb_listener.https",
      "field": "ssl_policy",
      "desired": "ELBSecurityPolicy-2016-08",
      "live": "ELBSecurityPolicy-2016-08",
      "guard": "TLS hardening is intentionally outside state adoption"
    },
    {
      "address": "module.ssm_secrets.aws_ssm_parameter.cors_origins",
      "field": "value",
      "desired": "[\"https://helix.pingcap.net\"]",
      "live": "[\"https://helix.pingcap.net\"]",
      "guard": "the application parser consumes a JSON array string; a plain URL changes the stored configuration shape"
    },
    {
      "address": "module.ec2.aws_iam_role_policy.ecr_secrets",
      "field": "policy_document",
      "desired": {
        "ecr_repository_resources": "three repository ARNs",
        "ecr_batch_check_layer_availability": true,
        "secretsmanager_scoped_read": false,
        "ssm_resource": "exact account/region /helix/prod/*",
        "ssm_notresource_explicit_deny": true,
        "s3_list_prefix_condition": "deploy-assets/*",
        "cloudwatch_logs_write": false
      },
      "live": {
        "ecr_repository_resources": "three repository ARNs",
        "ecr_batch_check_layer_availability": true,
        "secretsmanager_scoped_read": false,
        "ssm_resource": "exact account/region /helix/prod/*",
        "ssm_notresource_explicit_deny": true,
        "s3_list_prefix_condition": "deploy-assets/*",
        "cloudwatch_logs_write": false
      },
      "guard": "Stage 00 principal simulation and digest-pinned runtime canary proved the least-privilege live policy equals desired before exposing the import ID"
    },
    {
      "address": "module.ec2.aws_instance.this",
      "field": "user_data",
      "desired": "lifecycle ignored during adoption",
      "live_sha256": "eefe18755c85a5dd4a02bc979e4047639050428530cc544d0e52360501058130",
      "guard": "the live bootstrap predates Terraform; changing user_data may stop/start the instance and is a separate rollout"
    },
    {
      "address": "module.ec2.aws_instance.this",
      "field": "metadata_options",
      "desired": {"http_endpoint": "enabled", "http_tokens": "required", "http_put_response_hop_limit": 2, "instance_metadata_tags": "disabled"},
      "live": {"http_endpoint": "enabled", "http_tokens": "required", "http_put_response_hop_limit": 2, "instance_metadata_tags": "disabled"},
      "guard": "explicitly preserve IMDSv2 enforcement and the live container hop limit"
    },
    {
      "address": "module.elasticache.aws_elasticache_subnet_group.this",
      "field": "description",
      "desired": "Helix prod cache subnets",
      "live": "Helix prod cache subnets",
      "guard": "description is pinned to live adoption metadata"
    },
    {
      "address": "module.elasticache.aws_elasticache_replication_group.this",
      "field": "engine_version",
      "desired": "7.1",
      "live": "7.1.0",
      "guard": "provider version normalization is not assumed; plan JSON must prove zero update"
    }
  ],
  "metadata_contract": [
    {
      "addresses": [
        "module.security.aws_security_group.alb",
        "module.security.aws_security_group.app",
        "module.security.aws_security_group.cache",
        "module.security.aws_security_group.db"
      ],
      "field": "tags",
      "desired": [
        {"Name": "helix-prod-alb-sg", "Project": "helix"},
        {"Name": "helix-prod-app-sg", "Project": "helix"},
        {"Name": "helix-prod-cache-sg", "Project": "helix"},
        {"Name": "helix-prod-db-sg", "Project": "helix"}
      ],
      "live": [
        {"Name": "helix-prod-alb-sg", "Project": "helix"},
        {"Name": "helix-prod-app-sg", "Project": "helix"},
        {"Name": "helix-prod-cache-sg", "Project": "helix"},
        {"Name": "helix-prod-db-sg", "Project": "helix"}
      ],
      "guard": "Environment/ManagedBy/Module tag rollout is separate from state adoption"
    },
    {
      "addresses": [
        "module.alb.aws_lb_target_group.this",
        "module.alb.aws_lb_listener.https",
        "module.alb.aws_lb_listener.http"
      ],
      "field": "tags",
      "desired": {},
      "live": {},
      "guard": "tag governance is separate from state adoption"
    },
    {
      "addresses": [
        "module.network.aws_internet_gateway.this",
        "module.network.aws_subnet.public[0]",
        "module.network.aws_subnet.public[1]",
        "module.network.aws_subnet.private_app[0]",
        "module.network.aws_subnet.private_app[1]",
        "module.network.aws_subnet.private_cache[0]",
        "module.network.aws_subnet.private_cache[1]",
        "module.network.aws_nat_gateway.this",
        "module.network.aws_route_table.public",
        "module.network.aws_route_table.private"
      ],
      "field": "tags",
      "desired": "address-specific Name plus Project=helix",
      "live": "address-specific Name plus Project=helix",
      "guard": "Environment tag rollout is separate from state adoption"
    },
    {
      "addresses": ["module.network.aws_eip.nat"],
      "field": "tags",
      "desired": {},
      "live": {},
      "guard": "EIP tagging is separate from state adoption"
    },
    {
      "addresses": ["module.elasticache.aws_elasticache_replication_group.this"],
      "field": "tags",
      "desired": {"Project": "helix", "Environment": "prod"},
      "live": {"Project": "helix", "Environment": "prod"},
      "guard": "Name tag rollout is separate from state adoption"
    },
    {
      "addresses": [
        "aws_acm_certificate.main",
        "module.oidc_github.aws_iam_openid_connect_provider.github",
        "module.ssm_secrets.aws_ssm_parameter.app_env",
        "module.ssm_secrets.aws_ssm_parameter.auth_password_login_enabled",
        "module.ssm_secrets.aws_ssm_parameter.cors_origins",
        "module.ssm_secrets.aws_ssm_parameter.successfactors_base_url"
      ],
      "field": "tags",
      "desired": {},
      "live": {},
      "guard": "tag governance is separate from state adoption"
    },
    {
      "addresses": ["module.alb.aws_lb.this"],
      "field": "tags",
      "desired": {"Project": "helix", "Environment": "prod"},
      "live": {"Project": "helix", "Environment": "prod"},
      "guard": "Name tag rollout is separate from state adoption"
    }
  ],
  "external_ownership": {
    "evidence_file": "external-ownership.json",
    "dns_provider": "DNSPod",
    "securestring_values_in_terraform_state": false
  },
  "state_record_only": {
    "strategy_file": "state-record-strategy.json",
    "addresses": [
      "aws_acm_certificate_validation.main",
      "module.alb.aws_lb_target_group_attachment.this"
    ],
    "status": "approved_for_dependency_ordered_execution_only",
    "approval_reference": "user delegated full execution authority in the active Codex task; the ACM waiter is allowed only in 06-acm-validation after certificate import, and the target attachment remains forbidden until all 63 imports and every Stage 02 precondition"
  },
  "disabled_resource_declarations": [
    "module.ecr.aws_ecr_lifecycle_policy.this"
  ],
  "pre_import_alb_readiness_cutover": {
    "address": "module.alb.aws_lb_target_group.this",
    "status": "completed",
    "evidence_file": "stage00-evidence.json",
    "target_group_arn": "arn:aws:elasticloadbalancing:ap-southeast-1:239023060546:targetgroup/helix-prod-tg/66579d9570a4c306",
    "live_path": "/api/v1/ready",
    "desired_path": "/api/v1/ready",
    "required_before_import": [
      "merge the reviewed desired readiness path",
      "probe /api/v1/ready directly and through production and require repeated HTTP 200 ready responses",
      "capture and hash the current target-group health-check configuration and verify the administrator can restore path /",
      "obtain separate approval and update only the live health-check path to /api/v1/ready",
      "wait for the exact instance target on port 80 to remain healthy for the configured five-success threshold and probe production health and readiness",
      "refresh target-group evidence and prove live health-check configuration equals desired"
    ],
    "evidence_required": [
      "rollback_target_group_config_sha256",
      "pre_cutover_ready_probe_result",
      "separate_approval_reference",
      "post_update_target_health_result",
      "post_update_production_health_and_readiness_result",
      "refreshed_live_target_group_config_sha256"
    ],
    "failure_action": "restore health-check path / immediately, wait for the exact target to become healthy, reverify production health, reset execution_gate to 00_pre_import_controls, and suppress the target-group import ID until fresh evidence is reviewed"
  },
  "pre_import_iam_cutover": {
    "address": "module.ec2.aws_iam_role_policy.ecr_secrets",
    "status": "completed",
    "evidence_file": "stage00-evidence.json",
    "required_before_manifest_ready": [
      "merge the reviewed desired policy",
      "capture the current live inline policy as a rollback snapshot, record its SHA256, and verify the administrator can restore it",
      "run candidate custom-policy simulation for required ECR, SSM and deploy-assets S3 operations; prove prod parameter allow plus staging, unrelated account/region and /aws/service public-parameter explicit deny; also prove negative ECR/S3 resources and absent Secrets Manager or CloudWatch Logs access",
      "capture and hash a read-only inventory of active State Manager associations, Maintenance Windows, Patch/Distributor/UpdateSSMAgent usage and SSM document parameter interpolation; canary every active feature or document any reviewed public-parameter exception before approval",
      "obtain separate approval and update the live inline policy to the reviewed candidate",
      "immediately run principal-policy simulation and production-safe SSM, image-pull, render-env and deploy-assets canaries; on any failure restore the rollback snapshot and reverify the old healthy path",
      "refresh read-only live policy evidence, prove it equals desired, and record healthy production probes"
    ],
    "evidence_required": [
      "rollback_policy_sha256",
      "candidate_policy_sha256",
      "custom_policy_simulation_result",
      "ssm_active_feature_inventory_sha256",
      "ssm_parameter_decision_matrix_result",
      "separate_approval_reference",
      "post_update_principal_simulation_result",
      "ssm_canary_command_id_and_status_without_secret_output",
      "refreshed_live_policy_sha256",
      "production_health_result"
    ],
    "failure_action": "restore the exact rollback snapshot immediately, verify the prior principal policy and production health, reset execution_gate to 00_pre_import_controls, and suppress the IAM import ID until fresh evidence is reviewed"
  },
  "non_replacement_blockers": [
    {
      "address": "module.elasticache.aws_elasticache_replication_group.this",
      "impact": "desired engine_version 7.1 versus live 7.1.0 may be provider normalization but remains not_yet_plan_verified"
    },
    {
      "addresses": [
        "aws_acm_certificate_validation.main",
        "module.alb.aws_lb_target_group_attachment.this"
      ],
      "impact": "provider-only records require separate saved plans; ACM validation is a waiter, while target attachment performs a production RegisterTargets write and creates future DeregisterTargets ownership"
    },
    {
      "impact": "no Stage 01 saved plan JSON has been reviewed yet; zero drift is a target baseline until each exact batch passes its saved-plan gate"
    }
  ],
  "batch_order": [
    "01-network",
    "02-security",
    "03-ecr",
    "04-iam",
    "05-compute",
    "05-post-compute-iam",
    "05-acm-certificate",
    "06-acm-validation",
    "06-edge",
    "07-cache",
    "08-parameters"
  ]
}