{
  "schema_version": 1,
  "required_stage": "split: ACM validation in Stage 01 before edge; target attachment in Stage 02",
  "approval_status": "approved_for_dependency_ordered_execution_only",
  "approval_reference": "user delegated full execution authority in the active Codex task; execution remains conditional on every listed Stage 02 precondition",
  "resources": [
    {
      "address": "aws_acm_certificate_validation.main",
      "kind": "provider_waiter_only",
      "required_batch": "06-acm-validation",
      "cloud_mutation_expected": false,
      "preconditions": [
        "ACM certificate status is ISSUED",
        "DNSPod validation CNAME still resolves to the ACM validation target",
        "a saved targeted plan limits this address to one create and no dependency changes",
        "the reviewed saved-plan SHA256 matches the file passed to terraform apply"
      ],
      "reviewed_strategy": "After the ACM certificate import and before edge listener imports, the Stage 01 guard creates one saved plan targeted only to the waiter. It may create only the waiter state record, performs no cloud mutation, and breaks the HTTPS listener dependency cycle."
    },
    {
      "address": "module.alb.aws_lb_target_group_attachment.this",
      "kind": "provider_not_importable_idempotent_registration",
      "required_batch": "09-state-records",
      "cloud_mutation_expected": true,
      "provider_create_api": "elasticloadbalancing:RegisterTargets",
      "provider_delete_api": "elasticloadbalancing:DeregisterTargets",
      "preconditions": [
        "immediately before planning and applying, target health confirms the exact target group, instance ID, port 80, and healthy registration with no draining transition",
        "provider documentation confirms the resource has no importer",
        "a saved targeted plan limits this address to one create with the exact existing tuple and no dependency changes",
        "the reviewed saved-plan SHA256 matches the file passed to terraform apply",
        "operators accept Terraform ownership means a future destroy calls DeregisterTargets and can remove the only production target"
      ],
      "reviewed_strategy": "After target group and instance imports, create one saved plan with -target and -out, inspect its JSON, record its SHA256, recheck live target health, and apply that exact reviewed saved plan file. RegisterTargets is a production write even when the tuple already exists. Require a post-write refresh and health check before continuing."
    }
  ],
  "forbidden": [
    "terraform state manipulation",
    "fabricated import IDs",
    "combined apply with any unrelated address",
    "terraform apply that replans instead of consuming the reviewed saved plan",
    "target attachment execution before all 63 imports complete or while any listed Stage 02 precondition is unmet",
    "ACM validation state-record execution before the certificate import or together with any unrelated operation"
  ]
}