ci: path-filtered infra CI/CD + dual OIDC roles + prod approval gate (T18) (#15 )

* ci: path-filtered infra CI/CD with dual OIDC roles + prod approval gate (T18) Add the /infra half of the combined-repo pipeline (the Python agent keeps ci.yml): - ci-infra.yml — PR check on infra/** : tsc + jest + cdk synth via the org reusable ci-typescript-cdk.yaml (working-directory: infra). - cd-infra.yml — push to dev/main on infra/** (or dispatch): * job 'ci' (reusable) is the CI-green precondition (deploy needs: ci). * deploy-dev (ref=dev, NO environment) → cdk deploy OpenSweDevStack, assuming githubdeploy-open-swe-infra-dev (OIDC sub ref:refs/heads/dev). AUTO. * deploy-prod (ref=main, environment: prod) → cdk deploy OpenSweProdStack, assuming githubdeploy-open-swe-infra-prod (OIDC sub environment:prod). The 'prod' Environment's required reviewer is the manual-approval gate. Deliberately self-contained (NOT the reusable cd-cdk.yaml) because that runs 'cdk deploy --all' — from a single-env push it would deploy the other env + the shared IAM stack, breaking the per-env boundary. CD targets one stack per env; the shared open-swe-iam stack is human-gated (T6), never deployed by CD. Infra CI is enforced at the DEPLOY boundary (deploy jobs need ci), not as a branch-protection required check — path-filtering a required check would deadlock app-only PRs. Documented in infra/README.md along with the post-T6 prerequisites (repo vars AWS_DEPLOY_ROLE_INFRA_{DEV,PROD}; a 'prod' Environment w/ reviewer). Not active until the IAM roles are applied (T6) — assuming a nonexistent role just fails closed. App-side CD (S3 artifact + SSM) is T19. * fix(infra): commit jest.config.js (was ignored by *.js → infra CI used Babel) The infra/.gitignore *.js rule (for compiled CDK output) silently swept up the hand-authored jest.config.js, so it was never committed. Local jest passed (file present in the working tree) but CI's fresh checkout lacked it → jest fell back to the default Babel transform → 'Cannot use import statement outside a module' on the TypeScript test. Surfaced now because T18 is the first workflow to run infra jest in CI. Negate the ignore for this one file and commit it.
feat: open-swe dev/prod compute + ALB ingress (T12) (#14 )
2026-10-07 16:19:09 +00:00 · 2026-06-26 16:11:22 -04:00 · 2026-06-26 16:10:23 -04:00 · 2026-06-26 16:07:23 -04:00
12 changed files with 1105 additions and 18 deletions
--- a/.github/workflows/cd-infra.yml
+++ b/.github/workflows/cd-infra.yml
@ -0,0 +1,122 @@
+name: Infra CD
+
+# Path-filtered CDK deploy for /infra, per env, OIDC-only (no static keys).
+#
+#   push to dev  → CI (tsc+jest+synth) → deploy OpenSweDevStack   (AUTO, CI-green-gated)
+#   push to main → CI                  → deploy OpenSweProdStack  (manual approval: env "prod")
+#
+# Why this is NOT the reusable cd-cdk.yaml: that workflow runs `cdk deploy --all`,
+# which would deploy ALL THREE stacks (incl. the OTHER env + the shared IAM stack)
+# from a single-env push — breaking the per-env dev/prod boundary. So we target one
+# stack explicitly per env. (Infra CI still uses the reusable ci-typescript-cdk.)
+#
+# The shared IAM stack (open-swe-iam — owns BOTH envs' OIDC deploy roles) is
+# intentionally NOT deployed here: it is a privileged, human-gated apply (T6), so a
+# routine dev push can never alter prod's deploy role.
+#
+# OIDC subject alignment (must match the per-env trust in infra/lib/config.ts):
+#   - deploy-dev declares NO `environment:` → token sub = repo:…:ref:refs/heads/dev,
+#     which is exactly what githubdeploy-open-swe-infra-dev trusts.
+#   - deploy-prod declares `environment: prod` → token sub = repo:…:environment:prod,
+#     which githubdeploy-open-swe-infra-prod trusts AND which triggers the GitHub
+#     Environment's required-reviewer (manual approval) gate.
+#
+# Prerequisites (post-T6, when the roles exist):
+#   - repo variables AWS_DEPLOY_ROLE_INFRA_DEV / AWS_DEPLOY_ROLE_INFRA_PROD = the
+#     githubdeploy-open-swe-infra-<env> role ARNs (open-swe-iam CfnOutputs).
+#   - a GitHub Environment named "prod" with Adam as a required reviewer.
+
+permissions:
+  contents: read
+
+on:
+  push:
+    branches: [dev, main]
+    paths:
+      - "infra/**"
+      - ".github/workflows/cd-infra.yml"
+  workflow_dispatch:
+
+concurrency:
+  # one infra deploy per branch at a time; never cancel an in-flight deploy.
+  group: cd-infra-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  # CI-green precondition — re-run tsc + jest + synth on the pushed commit before
+  # any deploy. A failure here blocks the deploy jobs (needs: ci).
+  ci:
+    name: Infra CI (pre-deploy)
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@main
+    with:
+      node-version: "24"
+      working-directory: infra
+      cache-dependency-path: infra/package-lock.json
+      run-typecheck: true
+      run-tests: true
+      run-cdk-synth: true
+
+  deploy-dev:
+    name: Deploy open-swe-dev
+    needs: ci
+    if: ${{ github.ref == 'refs/heads/dev' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+          cache: npm
+          cache-dependency-path: infra/package-lock.json
+      - name: Install deps
+        working-directory: infra
+        run: npm ci
+      - uses: aws-actions/configure-aws-credentials@v6
+        with:
+          role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_INFRA_DEV }}
+          aws-region: us-east-1
+      - name: CDK deploy (dev only)
+        working-directory: infra
+        run: npx cdk deploy OpenSweDevStack --require-approval never
+      - name: Stack outputs
+        run: |
+          aws cloudformation describe-stacks --stack-name open-swe-dev \
+            --query 'Stacks[0].Outputs[*].[OutputKey,OutputValue]' --output table
+
+  deploy-prod:
+    name: Deploy open-swe-prod
+    needs: ci
+    if: ${{ github.ref == 'refs/heads/main' }}
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    # Manual-approval gate: the "prod" Environment requires a reviewer (Adam).
+    # Also makes the OIDC sub …:environment:prod (matches the prod role trust).
+    environment: prod
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "24"
+          cache: npm
+          cache-dependency-path: infra/package-lock.json
+      - name: Install deps
+        working-directory: infra
+        run: npm ci
+      - uses: aws-actions/configure-aws-credentials@v6
+        with:
+          role-to-assume: ${{ vars.AWS_DEPLOY_ROLE_INFRA_PROD }}
+          aws-region: us-east-1
+      - name: CDK deploy (prod only)
+        working-directory: infra
+        run: npx cdk deploy OpenSweProdStack --require-approval never
+      - name: Stack outputs
+        run: |
+          aws cloudformation describe-stacks --stack-name open-swe-prod \
+            --query 'Stacks[0].Outputs[*].[OutputKey,OutputValue]' --output table
--- a/.github/workflows/ci-infra.yml
+++ b/.github/workflows/ci-infra.yml
@ -0,0 +1,26 @@
+name: Infra CI
+
+# Path-filtered CI for the /infra CDK app (TypeScript). The existing "Agent CI"
+# (ci.yml) covers the Python agent; this adds tsc + jest + cdk synth for /infra so
+# infra changes are gated on a PR the same way. Runs only when /infra changes.
+
+permissions:
+  contents: read
+
+on:
+  pull_request:
+    paths:
+      - "infra/**"
+      - ".github/workflows/ci-infra.yml"
+
+jobs:
+  infra-ci:
+    name: Infra CI (tsc + jest + synth)
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-typescript-cdk.yaml@main
+    with:
+      node-version: "24"
+      working-directory: infra
+      cache-dependency-path: infra/package-lock.json
+      run-typecheck: true
+      run-tests: true
+      run-cdk-synth: true
--- a/deploy/ami/templates/open-swe.nginx.conf
+++ b/deploy/ami/templates/open-swe.nginx.conf
@ -26,6 +26,7 @@ server {
    location /dashboard/api/ {
        proxy_pass http://@@BACKEND_ADDR@@;
        proxy_http_version 1.1;
+        client_max_body_size 10m;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
@ -41,6 +42,11 @@ server {
    location /webhooks/ {
        proxy_pass http://@@BACKEND_ADDR@@;
        proxy_http_version 1.1;
+        # GitHub permits webhook payloads up to 25 MB; nginx's 1 MB default would
+        # 413 large push/PR events at the edge BEFORE in-app signature verification
+        # runs, silently dropping them (OSWE-T12-01). proxy_request_buffering off
+        # does not relax the size cap — set it explicitly.
+        client_max_body_size 25m;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
--- a/deploy/seahaven/put-config.sh
+++ b/deploy/seahaven/put-config.sh
@ -0,0 +1,155 @@
+#!/usr/bin/env bash
+# put-config.sh — out-of-band populator for the open-swe config store.
+#
+# T11 (CDK) creates the RESOURCE SHELLS:
+#   - 28 Secrets Manager secrets  open-swe-<env>/<VAR>  (value-LESS shells)
+#   - the IaC-managed SSM params  /open-swe-<env>/<VAR>  (real values, owned in CDK)
+# This script sets the values that CANNOT live in IaC — every secret value, plus
+# the out-of-band SSM params (operationally-variable / env-specific-unknown). Run
+# it AFTER `cdk deploy open-swe-<env>` and BEFORE the EC2/T12 box first boots, so
+# fetch-config.sh finds every REQUIRED var populated and never writes a partial .env.
+#
+#   The secret list below mirrors config-store.ts SECRET_VARS (28 names — the
+#   inventory's "29" double-counted JUDGE_ANTHROPIC_BASE_URL, which is config
+#   (SSM), not a secret). Keep the two lists in lockstep.
+#
+# SAFETY:
+#   - NO real secret values live in this file — every secret is a <FILL> placeholder.
+#     Replace <FILL...> inline at run time, pipe from a vault, or export the
+#     matching OPENSWE_PUT_<VAR> env var; NEVER commit real values.
+#   - It does NOT touch the IaC-managed SSM params (SANDBOX_TYPE, DEFAULT_REPO_OWNER,
+#     ALLOWED_GITHUB_ORGS, DEFAULT_REPO_NAME, DASHBOARD_*_URL/ORIGINS, LLM_MODEL_ID)
+#     — CDK owns those; setting them here would cause drift.
+#   - Secrets go to Secrets Manager; the box's instance role grants read on
+#     open-swe-<env>/* and /open-swe-<env>/* (no kms:Decrypt — AWS-managed keys).
+#
+# Idempotent: put-secret-value adds a new AWSCURRENT version; put-parameter
+# --overwrite updates in place.
+
+set -euo pipefail
+
+ENV="${1:-}"
+case "$ENV" in
+  dev | prod) ;;
+  *)
+    echo "usage: put-config.sh <dev|prod>" >&2
+    exit 2
+    ;;
+esac
+
+REGION="${AWS_REGION:-${AWS_DEFAULT_REGION:-us-east-1}}"
+SECRET_PREFIX="open-swe-${ENV}/"
+SSM_PREFIX="/open-swe-${ENV}/"
+
+command -v aws >/dev/null 2>&1 || { echo "put-config: 'aws' not found on PATH" >&2; exit 3; }
+
+# --- helpers -----------------------------------------------------------------
+# put_secret VAR  : set the value of an EXISTING secret shell open-swe-<env>/VAR.
+# Resolution order for the value: $OPENSWE_PUT_<VAR> env var, else the literal
+# <FILL> placeholder (which aborts so an unset secret is never silently shipped).
+put_secret() {
+  local var="$1"
+  local override_name="OPENSWE_PUT_${var}"
+  local value="${!override_name:-<FILL>}"
+  if [ "$value" = "<FILL>" ]; then
+    echo "put-config[$ENV]: SKIP secret ${var} (no value; set ${override_name} or edit inline)" >&2
+    return 0
+  fi
+  aws secretsmanager put-secret-value \
+    --secret-id "${SECRET_PREFIX}${var}" \
+    --secret-string "$value" \
+    --region "$REGION" \
+    --no-cli-pager >/dev/null
+  echo "put-config[$ENV]: set secret ${var}"
+}
+
+# put_param VAR [TYPE] : create/update an out-of-band SSM param /open-swe-<env>/VAR.
+# TYPE defaults to String; pass SecureString for anything sensitive-but-not-a-secret.
+put_param() {
+  local var="$1" type="${2:-String}"
+  local override_name="OPENSWE_PUT_${var}"
+  local value="${!override_name:-<FILL>}"
+  if [ "$value" = "<FILL>" ]; then
+    echo "put-config[$ENV]: SKIP param ${var} (no value; set ${override_name} or edit inline)" >&2
+    return 0
+  fi
+  aws ssm put-parameter \
+    --name "${SSM_PREFIX}${var}" \
+    --value "$value" \
+    --type "$type" \
+    --overwrite \
+    --region "$REGION" \
+    --no-cli-pager >/dev/null
+  echo "put-config[$ENV]: set param ${var} (${type})"
+}
+
+# --- 1) Secrets (open-swe-<env>/<VAR>) — 28 shells from config-store.ts -------
+# REQUIRED at boot (fetch-config fail-fast): DASHBOARD_JWT_SECRET,
+# TOKEN_ENCRYPTION_KEY, GITHUB_APP_PRIVATE_KEY/CLIENT_SECRET, the active provider
+# key(s) (ANTHROPIC_API_KEY + OPENAI_API_KEY by default), LANGSMITH_API_KEY_PROD,
+# and (prod) GITHUB_WEBHOOK_SECRET + SLACK_SIGNING_SECRET.
+put_secret ANTHROPIC_API_KEY          # REQUIRED — primary builder provider key
+put_secret OPENAI_API_KEY             # REQUIRED — default reviewer provider key
+put_secret DASHBOARD_JWT_SECRET       # REQUIRED — dashboard session JWT signing
+put_secret TOKEN_ENCRYPTION_KEY       # REQUIRED — Fernet key(s) for GH-token crypto
+put_secret GITHUB_APP_PRIVATE_KEY     # REQUIRED — GitHub App PEM (multiline; quote it)
+put_secret GITHUB_APP_CLIENT_SECRET   # REQUIRED — dashboard OAuth login
+put_secret LANGSMITH_API_KEY_PROD     # REQUIRED (langsmith sandbox) — prod key
+put_secret GITHUB_WEBHOOK_SECRET      # prod-REQUIRED — GitHub webhook signature
+put_secret SLACK_SIGNING_SECRET       # prod-REQUIRED — Slack webhook signature
+put_secret LINEAR_WEBHOOK_SECRET      # required only when Linear is wired
+# Optional / conditional secrets — set the ones this deployment actually uses.
+put_secret CORRIDOR_API_TOKEN         # optional — Corridor MCP
+put_secret CORRIDOR_MCP_TOKEN         # optional — Corridor MCP (alt name)
+put_secret CORRIDOR_TOKEN             # optional — Corridor MCP (alt name)
+put_secret DAYTONA_API_KEY            # only if SANDBOX_TYPE=daytona
+put_secret EXA_API_KEY                # optional — Exa web search
+put_secret FIREWORKS_API_KEY          # only if a fireworks: model is used
+put_secret GITHUB_PAT                 # optional — PAT fallback
+put_secret GOOGLE_API_KEY             # only if a google_genai: model is used
+put_secret GROQ_API_KEY               # only if a groq: model is used
+put_secret JUDGE_ANTHROPIC_API_KEY    # optional — eval judge (falls back to ANTHROPIC)
+put_secret LANGSMITH_API_KEY          # optional — LangSmith (dev)
+put_secret LANGCHAIN_API_KEY          # optional — LangSmith alt name
+put_secret LINEAR_API_KEY             # optional — Linear API
+put_secret RUNLOOP_API_KEY            # only if SANDBOX_TYPE=runloop
+put_secret SLACK_BOT_TOKEN            # optional — Slack bot token
+put_secret SLACK_CLIENT_SECRET        # optional — Slack OAuth
+put_secret USER_ID_API_KEY_MAP        # optional — JSON map user id -> API key (per-user auth)
+put_secret X_SERVICE_AUTH_JWT_SECRET  # optional — service-auth JWT
+
+# --- 2) Out-of-band SSM params (/open-swe-<env>/<VAR>) ------------------------
+# These are NOT created by CDK (operationally-variable / env-specific-unknown).
+# put_param creates them on first run.
+put_param DEFAULT_SANDBOX_SNAPSHOT_ID # REQUIRED (langsmith) — changes every rebuild
+put_param GITHUB_APP_ID               # REQUIRED — GitHub App numeric id
+put_param GITHUB_APP_INSTALLATION_ID  # REQUIRED — GitHub App installation id
+put_param GITHUB_APP_CLIENT_ID        # REQUIRED — dashboard OAuth client id
+put_param GITHUB_OAUTH_PROVIDER_ID    # GitHub OAuth provider id
+put_param LANGSMITH_TENANT_ID_PROD    # LangSmith prod tenant id
+put_param LANGSMITH_URL_PROD          # LangSmith prod URL
+put_param LANGSMITH_ENDPOINT          # LangSmith API endpoint
+put_param LANGSMITH_ENDPOINT_PROD     # LangSmith prod API endpoint
+put_param LANGSMITH_HOST_API_URL      # LangSmith host API URL
+put_param LANGGRAPH_URL               # LangGraph server URL
+put_param LANGGRAPH_URL_PROD          # LangGraph server URL (prod)
+put_param LANGCHAIN_REVISION_ID       # LangChain revision id
+put_param SLACK_CLIENT_ID             # Slack OAuth client id
+put_param SLACK_TEAM_ID               # Slack workspace/team id
+put_param SLACK_BOT_USER_ID           # Slack bot user id
+put_param SLACK_BOT_USERNAME          # Slack bot username
+put_param SLACK_REPO_OWNER            # Slack default repo owner
+put_param SLACK_REPO_NAME             # Slack default repo name
+put_param CONFIGURED_ADMINS           # dashboard admin GitHub logins (comma list)
+put_param OBSERVABILITY_AUTHORIZED_EMAILS  # observability allowlist (comma list)
+put_param PUBLIC_REPO_ORG_GATE        # public-repo trigger gate (org name; empty=off)
+put_param ALLOWED_GITHUB_REPOS        # extra repo allowlist (comma list)
+put_param LLM_FALLBACK_MODEL_ID       # optional — model fallback id
+put_param DATADOG_MCP_TOOLSETS        # optional — Datadog MCP toolsets
+put_param NOTION_MCP_CLIENT_NAME      # optional — Notion MCP client name
+put_param API_STANDARDS_SKILL_HANDLE  # optional — API standards skill handle
+put_param REPO_SNAPSHOT_BASE_IMAGE    # optional — repo snapshot base image
+put_param REPO_SNAPSHOT_BUILD_TIMEOUT_SECONDS   # optional — snapshot build timeout
+put_param REPO_SNAPSHOT_STALE_BUILD_SECONDS     # optional — snapshot stale threshold
+
+echo "put-config[$ENV]: done. Verify with fetch-config.sh ${ENV} before first boot."
--- a/infra/.gitignore
+++ b/infra/.gitignore
@ -3,6 +3,8 @@ cdk.out/
 *.js
 *.d.ts
 *.js.map
+# ...but jest.config.js is hand-authored config, not build output — keep it.
+!jest.config.js

 # deps
 node_modules/
--- a/infra/README.md
+++ b/infra/README.md
@ -13,12 +13,14 @@ infra/
 ├── lib/
 │   ├── config.ts                    # account/region/org constants, env type, OIDC trust subjects
 │   ├── open-swe-iam-stack.ts        # account-level: shared OIDC deploy roles
-│   ├── open-swe-stack.ts            # per-env stack (instance role + AMI cache wiring)
+│   ├── open-swe-stack.ts            # per-env stack (instance role + config store + AppService)
 │   ├── aspects/
 │   │   └── kebab-naming-aspect.ts   # fails synth on any non-kebab-case explicit name
 │   └── constructs/
 │       ├── github-deploy-roles.ts   # githubdeploy-open-swe-infra + githubdeploy-open-swe-app
 │       ├── instance-role.ts         # open-swe-<env>-instance-role (least-privilege)
+│       ├── config-store.ts          # Secrets Manager + SSM Parameter Store shells (T11)
+│       ├── app-service.ts           # EC2 box + imported-ALB ingress + Route53 + logs (T12)
 │       └── ami-cache.ts             # cached ARM64 AL2023 helper + EBS/AMI discipline docs
 ├── test/
 │   └── kebab-naming-aspect.test.ts  # jest: Aspect passes conforming names, flags bad ones
@ -35,8 +37,8 @@ infra/
 | Stack name (kebab) | Construct | Contents |
 |---|---|---|
 | `open-swe-iam` | `OpenSweIamStack` | Account-level shared GitHub OIDC deploy roles (singletons). |
-| `open-swe-dev` | `OpenSweStack` (`envName: dev`) | `open-swe-dev-instance-role` + AMI-cache wiring. EC2/ALB/etc. land at T12. |
-| `open-swe-prod` | `OpenSweStack` (`envName: prod`) | `open-swe-prod-instance-role` + AMI-cache wiring. |
+| `open-swe-dev` | `OpenSweStack` (`envName: dev`) | `open-swe-dev-instance-role`, config store (T11), and the EC2 box + ALB ingress (T12, `AppService`). |
+| `open-swe-prod` | `OpenSweStack` (`envName: prod`) | `open-swe-prod-instance-role`, config store, and the EC2 box + ALB ingress. |

 Account `328440206208`, region `us-east-1`. Stack names are set explicitly so CDK
 never defaults to PascalCase; resource names follow `open-swe-<env>-*`.
@ -73,7 +75,129 @@ Manager `a/b`, SSM `/a/b`, log groups `/aws/.../x`) are validated per `/`-segmen
 CDK logical construct ids are intentionally NOT validated (they are conventionally
 PascalCase). Covered by `test/kebab-naming-aspect.test.ts`.

-## AMI cache discipline (EBS-fix plumbing — stub for T12)
+## Config store (Secrets Manager + SSM shells — T11)
+
+`ConfigStore` (`lib/constructs/config-store.ts`, one per env from `OpenSweStack`)
+renders the resource shells the boot hook `deploy/seahaven/fetch-config.sh` reads.
+The naming contract (T9 inventory + the fetch-config header) is LITERAL env-var
+names as the last path segment — `open-swe-<env>/<VAR>` for secrets,
+`/open-swe-<env>/<VAR>` (FLAT) for config — because fetch-config strips the prefix
+and exports that segment verbatim.
+
+Three buckets:
+
+1. **Secret shells (Secrets Manager) — 27 secrets.** Created value-LESS (an L1
+   `CfnSecret` with NEITHER `secretString` NOR `generateSecretString`, which
+   CloudFormation creates as an empty secret). The real value is set **out-of-band**
+   (`put-config.sh`) — CDK never owns it, so a later `cdk deploy` can never clobber
+   it. `UpdateReplacePolicy/DeletionPolicy: Retain` so a teardown can't destroy
+   operator-set secret material. AWS-managed key (no CMK — matches the instance
+   role, which omits `kms:Decrypt`).
+   > The T9 header says "29 secrets" but its table enumerates **27** distinct VAR
+   > names (the CORRIDOR row holds 3). We create 27 — we don't invent two to hit 29.
+   > **Confirm** the 27-vs-29 count (code-only candidates not in the table:
+   > `USER_ID_API_KEY_MAP`, `JUDGE_ANTHROPIC_BASE_URL`).
+
+2. **IaC-managed SSM config — 8 params, real values owned in code:**
+
+   | Param | dev | prod |
+   |---|---|---|
+   | `SANDBOX_TYPE` | `langsmith` | `langsmith` |
+   | `DEFAULT_REPO_OWNER` | `Sea-Haven-Industries` | `Sea-Haven-Industries` |
+   | `ALLOWED_GITHUB_ORGS` | `Sea-Haven-Industries` | `Sea-Haven-Industries` |
+   | `DEFAULT_REPO_NAME` | `open-swe-pilot` *(confirm)* | `open-swe-pilot` *(confirm)* |
+   | `DASHBOARD_BASE_URL` | `https://openswe-dev.seahaven.com` *(confirm host)* | `https://openswe.seahaven.com` *(confirm host)* |
+   | `DASHBOARD_API_BASE_URL` | same as base | same as base |
+   | `DASHBOARD_ALLOWED_ORIGINS` | same as base | same as base |
+   | `LLM_MODEL_ID` | `anthropic:claude-opus-4-8` *(confirm)* | `anthropic:claude-opus-4-8` *(confirm)* |
+
+3. **Out-of-band SSM config — NOT created by CDK.** Operationally-variable or
+   env-specific-unknown values listed in `OUT_OF_BAND_SSM` and populated by
+   `put-config.sh`. The keystone is `DEFAULT_SANDBOX_SNAPSHOT_ID` (changes on every
+   snapshot rebuild → must NOT be CDK-managed or a deploy clobbers it); also the
+   GitHub App ids, Slack ids, and LangSmith tenant/urls.
+
+### Kebab-Aspect deviation
+
+`KebabNamingAspect` exempts `AWS::SecretsManager::Secret` and `AWS::SSM::Parameter`
+from the kebab check (see the `KEBAB_EXEMPT_RESOURCE_TYPES` set) — the UPPER_SNAKE
+env-var segment is a required, documented deviation for a lossless store→env
+round-trip. Every other explicitly-named resource is still validated. Covered by a
+dedicated case in `test/kebab-naming-aspect.test.ts`.
+
+### Deploy ordering (values BEFORE the box boots)
+
+The shells are synth-able now (T11). Population is out-of-band and happens **after**
+`cdk deploy open-swe-<env>` but **before** the EC2/T12 box first boots:
+
+```bash
+cdk deploy open-swe-<env>                  # creates the 27 secret shells + 8 IaC params
+deploy/seahaven/put-config.sh <dev|prod>   # sets the 27 secret values + out-of-band SSM
+deploy/seahaven/fetch-config.sh <dev|prod> # (on the box) fail-fast verify before first start
+```
+
+`put-config.sh` ships `<FILL>` placeholders only (no real secret values committed);
+provide each value inline, via `OPENSWE_PUT_<VAR>` env vars, or from a vault. It does
+NOT touch the IaC-managed params (CDK owns those — editing them here would drift).
+
+## Compute + ingress (`AppService` — T12)
+
+`AppService` (`lib/constructs/app-service.ts`, one per env from `OpenSweStack`)
+builds the box and its path to the internet. A **single** internet-facing ALB
+(`app/seahaven-com`) and a **single** VPC are shared with the on-prem
+`seahaven-site` stack, so open-swe **imports** the VPC, the ALB security group
+(`sg-0b0301deed193258a`), the `:443` listener, and the public `seahaven.com`
+zone — and never owns/mutates them. It **adds**:
+
+- **One ARM64 EC2 box** (`open-swe-<env>-box`, `t4g.medium` dev / `t4g.large`
+  prod) in **private1 (us-east-1a)** — same AZ as the single NAT for in-AZ egress.
+  `requireImdsv2`, gp3 **encrypted** root, `deleteOnTermination` (no RETAIN
+  volume — see below). `userDataCausesReplacement: true`; user-data is rendered
+  from `deploy/ami/user-data.sh`.
+- **A standalone instance SG** reachable **only** from the shared ALB SG on `:80`
+  (nginx). Egress open (NAT). The ALB SG is opened to the box via a **standalone
+  `CfnSecurityGroupEgress`** so the imported (on-prem-owned) SG is never mutated.
+- **A target group → instance `:80`** (nginx is the sole ingress; the LangGraph
+  control plane stays on loopback `:2024`). Health check `GET /healthz`.
+- **Two listener rules** on the imported `:443` listener, both → the same TG:
+  - **Webhooks** (priority **2** dev / **3** prod): `host ∈ {openswe-<env>, hooks-<env>}.seahaven.com` **AND** path `/webhooks/*`.
+  - **Site** (priority **10** dev / **11** prod): `host = openswe-<env>.seahaven.com` (dashboard SPA + `/dashboard/api/`).
+- **Route53 alias records** `openswe[-dev]` + `hooks[-dev]` → the shared ALB.
+- **Four CloudWatch log groups** (`/open-swe/<env>/{app,user-data,nginx-access,nginx-error}`) at **30-day** retention (IaC-owned; mirrors the CW-agent config).
+
+### Listener-rule ordering (load-bearing)
+
+The shared listener already has a **host-agnostic** `/webhooks/*` PATH rule at
+**priority 5** (on-prem). ALB rules are first-match by ascending priority, so the
+open-swe webhook rule **must** sit below 5 or every `…/webhooks/*` request (any
+host) is forwarded to the on-prem target first. Hence priority 2/3. The rule ANDs
+a host condition, so it does **not** steal the on-prem hosts' webhooks. The
+dashboard "site" rule carries no path that collides with rule 5, so it sits at
+10/11.
+
+**Cross-stack coordination (T13 review).** The `seahaven-site` (on-prem) and
+`open-swe` stacks both add resources to the *same imported* listener and ALB SG.
+This is safe: each stack owns only the resources it declares (its own logical
+ids), so an on-prem deploy can't delete open-swe's rules/egress and vice-versa,
+and the standalone `CfnSecurityGroupEgress` never mutates the shared SG's own
+definition (the pattern on-prem itself uses). The one shared namespace that needs
+care is **listener-rule priority** (globally unique per listener; a collision is
+a fail-*safe* deploy error, not silent drift). Ownership — keep disjoint:
+`seahaven-site` = **4-7 + default**; `open-swe` = **2, 3, 10, 11**. open-swe's
+webhook rules are host-scoped to its own `*.seahaven.com` hosts, so they never
+match an on-prem `seahavenind.com` host.
+
+### Security review (T5/T12 `/sh-security-review`)
+
+The T12 surface was run through the detector-fan-out + proof-or-kill verifier.
+One **confirmed medium** (OSWE-T12-01: nginx's 1 MB default `client_max_body_size`
+would 413 large GitHub webhooks before in-app signature verification) is fixed in
+`open-swe.nginx.conf` (`25m` on `/webhooks/`, `10m` on `/dashboard/api/`). The
+hooks hostname is scoped to `/webhooks/*` only (OSWE-T12-02 hygiene). An
+X-Forwarded-For spoof candidate was **killed** — no code trusts the leftmost XFF.
+No confirmed critical/high; no block.
+
+## AMI cache discipline (EBS-fix plumbing — consumed by T12 `AppService`)

 `cachedArm64AmazonLinux2023()` (in `lib/constructs/ami-cache.ts`) returns an
 ARM64 Amazon Linux 2023 image with `cachedInContext: true`, so the resolved AMI
@ -81,7 +205,7 @@ id is pinned in the committed `cdk.context.json`. Without the pin, every deploy
 could pick up a newer AL2023 release → AMI change → **EC2 instance replacement**
 (the file-share data-loss root cause — memory `feedback_inline_ebs_volumes`).

-Design intent documented in code for T12 to plug into:
+Design intent (now consumed by `AppService`):

 - `userDataCausesReplacement: true` is the **deliberate** choice — user-data is
  provisioning-only and carries no durable state.
@ -89,9 +213,9 @@ Design intent documented in code for T12 to plug into:
  store is rebuilt on every boot from S3 + Secrets Manager / SSM, so there is
  intentionally no standalone `ec2.Volume` + `removalPolicy.RETAIN`. The goal is
  replacement-*tolerance*, not avoidance.
- **Snapshot-before-replace** still applies operationally at T12: snapshot the
-  root volume and wait `state=completed` before any replacing deploy, and re-verify
-  "no local-only durable state" first.
+- **Snapshot-before-replace** still applies operationally: before any replacing
+  deploy snapshot the root volume and wait `state=completed`, and re-verify "no
+  local-only durable state" first.

 Refresh the AMI pin deliberately:

@ -102,7 +226,9 @@ cdk synth   # review the diff — it WILL show "requires replacement"

 > The committed `cdk.context.json` ships a dummy-but-valid-shaped AMI id
 > (`ami-00000000000000000`) so `cdk synth` resolves the cache locally without any
-> live AWS call. Replace it with the real resolved id when T8/T12 build the AMI.
+> live AWS call. **Before the first real deploy**, repoint `AppService` to the
+> baked `open-swe-base-arm64` AMI and pin its real id — the placeholder is
+> intentionally un-bootable on stock AL2023.

 ## Commands

@ -114,15 +240,56 @@ npx cdk synth open-swe-prod
 npm test            # jest — naming Aspect
 ```

+## CI/CD (T18 — `.github/workflows/ci-infra.yml` + `cd-infra.yml`)
+
+Path-filtered, OIDC-only (no static keys). The Python agent keeps its own
+`ci.yml` ("Agent CI"); these two add the `/infra` half.
+
+| Workflow | Trigger | Does |
+|---|---|---|
+| `ci-infra.yml` | PR touching `infra/**` | `tsc` + `jest` + `cdk synth` (reusable `ci-typescript-cdk.yaml`). |
+| `cd-infra.yml` | push to `dev`/`main` touching `infra/**`, or dispatch | CI (pre-deploy) → per-env `cdk deploy`. |
+
+`cd-infra.yml` flow:
+
+- **push to `dev`** → CI green → **auto** `cdk deploy OpenSweDevStack` (assumes
+  `githubdeploy-open-swe-infra-dev`; the job declares **no** `environment:`, so the
+  OIDC subject is `…:ref:refs/heads/dev` — matching that role's trust).
+- **push to `main`** → CI green → `cdk deploy OpenSweProdStack` behind the
+  **`prod` GitHub Environment** (required reviewer = Adam). The `environment: prod`
+  declaration both fires the manual-approval gate and makes the OIDC subject
+  `…:environment:prod` — matching `githubdeploy-open-swe-infra-prod`'s trust.
+
+**Why not the reusable `cd-cdk.yaml`:** it runs `cdk deploy --all`, which from a
+single-env push would deploy the *other* env + the shared IAM stack — breaking the
+per-env boundary. So CD targets one stack explicitly per env. The shared
+`open-swe-iam` stack is **not** deployed by CD (privileged, human-gated — T6).
+
+**Gating note:** infra CI is enforced at the *deploy* boundary (`cd-infra`'s
+`deploy-*` jobs `needs: ci`), not as a branch-protection required check —
+path-filtering a *required* check would deadlock app-only PRs (a skipped required
+check never satisfies). Making `Infra CI` a required check later needs a
+skip-aware shim or dropping its path filter.
+
+**Prerequisites (set post-T6, when the roles exist):**
+
+- repo **variables** `AWS_DEPLOY_ROLE_INFRA_DEV` / `AWS_DEPLOY_ROLE_INFRA_PROD`
+  = the `githubdeploy-open-swe-infra-<env>` role ARNs (`open-swe-iam` outputs).
+- a GitHub **Environment** named `prod` with Adam as a required reviewer.
+
+> App-side CD (CI → S3 artifact → SSM deploy via `githubdeploy-open-swe-app-<env>`)
+> is **T19**, not here.
+
 ## Deploy ordering (when the gate clears — NOT yet)

-1. **`open-swe-iam` first** — create `githubdeploy-open-swe-infra` + set the repo
-   `AWS_DEPLOY_ROLE_ARN` secret before any infra/secrets CI step (BLOCK#3).
+1. **`open-swe-iam` first** — apply the IAM stack (T6, human-gated), then set the
+   repo `AWS_DEPLOY_ROLE_INFRA_{DEV,PROD}` variables from its role-ARN outputs and
+   configure the `prod` Environment reviewer (BLOCK#3).
 2. **Security gate** — T4 GPT-4.1 IAM cross-review + T5 `/sh-security-review` on
   the synth; resolve every confirmed critical/high.
 3. **IAM applied** (T6) — only after the gate.
-4. Env stacks (`open-swe-dev`, then `open-swe-prod`) build out at T12+, prod gated
-   by a GitHub Environment manual approval.
+4. Env stacks: first `open-swe-dev` (T14, manual validate), then CD auto-deploys
+   dev on push; `open-swe-prod` (T21) behind the `prod` Environment approval.

 ## Version policy

--- a/infra/jest.config.js
+++ b/infra/jest.config.js
@ -0,0 +1,9 @@
+module.exports = {
+  testEnvironment: "node",
+  roots: ["<rootDir>/test"],
+  testMatch: ["**/*.test.ts"],
+  preset: "ts-jest",
+  transform: {
+    "^.+\\.tsx?$": ["ts-jest", { tsconfig: "tsconfig.json" }],
+  },
+};
--- a/infra/lib/aspects/kebab-naming-aspect.ts
+++ b/infra/lib/aspects/kebab-naming-aspect.ts
@ -40,6 +40,22 @@ const NAME_PROPERTY_KEYS = [

 const NAME_KEYS_LC = new Set(NAME_PROPERTY_KEYS.map((k) => k.toLowerCase()));

+/**
+ * Resource types whose physical NAME is a REQUIRED deviation from kebab-case:
+ * the open-swe config store names secrets `open-swe-<env>/<ENV_VAR_NAME>` and SSM
+ * params `/open-swe-<env>/<ENV_VAR_NAME>`, where the last segment is the LITERAL
+ * UPPER_SNAKE environment-variable name. The boot hook
+ * (deploy/seahaven/fetch-config.sh) strips the prefix and exports that segment
+ * verbatim, so a lossless store→env round-trip needs the exact env-var name —
+ * it cannot be kebab-cased. These two resource types are therefore exempt; every
+ * OTHER explicitly-named resource is still validated. (The `open-swe-<env>`
+ * prefix is code-generated from `prefix(env)` and is always kebab-case.)
+ */
+const KEBAB_EXEMPT_RESOURCE_TYPES = new Set([
+  "AWS::SecretsManager::Secret",
+  "AWS::SSM::Parameter",
+]);
+
 /**
 * `true` when every non-empty "/"-delimited segment is kebab-case.
 *
@ -75,6 +91,11 @@ export class KebabNamingAspect implements IAspect {
    }

    if (node instanceof CfnResource) {
+      // The config store's Secret/Parameter names carry the literal UPPER_SNAKE
+      // env-var name per the fetch-config naming contract — a required deviation.
+      if (KEBAB_EXEMPT_RESOURCE_TYPES.has(node.cfnResourceType)) {
+        return;
+      }
      // `_cfnProperties` is the props as set on the L1; resolve to collapse any
      // intrinsic tokens (refs/getatt) so only literal strings are checked.
      // eslint-disable-next-line @typescript-eslint/no-explicit-any
--- a/infra/lib/constructs/app-service.ts
+++ b/infra/lib/constructs/app-service.ts
@ -0,0 +1,293 @@
+import * as fs from "fs";
+import * as path from "path";
+import * as cdk from "aws-cdk-lib";
+import * as ec2 from "aws-cdk-lib/aws-ec2";
+import * as elbv2 from "aws-cdk-lib/aws-elasticloadbalancingv2";
+import * as elbTargets from "aws-cdk-lib/aws-elasticloadbalancingv2-targets";
+import * as logs from "aws-cdk-lib/aws-logs";
+import * as route53 from "aws-cdk-lib/aws-route53";
+import * as iam from "aws-cdk-lib/aws-iam";
+import { Construct } from "constructs";
+import { EnvName, prefix } from "../config";
+import { cachedArm64AmazonLinux2023 } from "./ami-cache";
+
+/**
+ * Shared seahaven-vpc + internet-facing ALB facts (read-only recon 2026-06-26;
+ * scratchpad/T12-infra-facts.md). A SINGLE VPC and a SINGLE shared ALB front
+ * both the on-prem `seahaven-site` stack and open-swe. We IMPORT every one of
+ * these and NEVER own them — open-swe only ADDS its own instance SG, a standalone
+ * ALB-egress rule, listener rules, a target group, and DNS records.
+ *
+ * ── Cross-stack coordination on the SHARED listener + ALB SG (T13 review) ──
+ * Two CDK stacks (seahaven-site, open-swe) add resources to the same imported
+ * `:443` listener and ALB SG. This is safe because each stack owns ONLY the
+ * resources it declares (its own logical ids): an on-prem `cdk deploy` computes a
+ * changeset over its own template and cannot delete rules/egress it never
+ * declared. The standalone-egress pattern is what on-prem itself uses
+ * (sgr-0c57812752a3bca13), so it does not mutate the shared SG's own definition.
+ *
+ * The ONE shared namespace that REQUIRES coordination is listener-rule PRIORITY
+ * (globally unique per listener; a collision is a fail-SAFE deploy error, not
+ * silent drift). Ownership map — keep these disjoint when editing either stack:
+ *   - seahaven-site (on-prem): priorities 4-7 + default.
+ *   - open-swe:                priorities 2, 3 (webhooks) and 10, 11 (site).
+ * open-swe's webhook rules are HOST-scoped to its own *.seahaven.com hosts, so
+ * they never match (let alone "steal") any seahavenind.com / on-prem host.
+ */
+const SHARED = {
+  vpcId: "vpc-0d3d4b67bd0cf8a68",
+  availabilityZones: ["us-east-1a", "us-east-1b"],
+  // Private subnets host the EC2 box. The single NAT gateway lives in 1a, so the
+  // box is pinned to private1 (1a) for in-AZ NAT egress (no cross-AZ data $).
+  privateSubnetIds: ["subnet-04e38c507e96f1926", "subnet-0a0b4fc6f296dfba5"],
+  instanceSubnetId: "subnet-04e38c507e96f1926",
+  instanceAz: "us-east-1a",
+  albDnsName: "seahaven-com-1856441924.us-east-1.elb.amazonaws.com",
+  albCanonicalHostedZoneId: "Z35SXDOTRQ7X7K",
+  albSecurityGroupId: "sg-0b0301deed193258a",
+  httpsListenerArn:
+    "arn:aws:elasticloadbalancing:us-east-1:328440206208:listener/app/seahaven-com/222c3257354ab559/bab8bcf0da0e2927",
+  publicZoneId: "Z06652411XKH89KTZD3XA",
+  publicZoneName: "seahaven.com",
+} as const;
+
+/**
+ * Per-env public hostnames, listener-rule priorities, and instance size.
+ *
+ * ── Listener-rule ordering hazard (load-bearing) ──
+ * The shared listener already has a HOST-AGNOSTIC `/webhooks/*` PATH rule at
+ * priority 5 (the on-prem seahaven-site stack owns it). ALB rules are first-match
+ * by ASCENDING priority, so a `…/webhooks/*` request to our host would match
+ * rule 5 (priority 5) and be forwarded to the on-prem target BEFORE any host rule
+ * at 10+. Therefore our webhook rule MUST sit below priority 5. The catch-all
+ * "site" rule (dashboard SPA + /dashboard/api/) carries no path that collides
+ * with rule 5, so it can sit at any free higher number (10/11). Free priorities
+ * confirmed by recon: 1-3 and 8+ (4=forgejo, 5=/webhooks/*, 6/7=seahavenind).
+ */
+const ENV_NET: Record<
+  EnvName,
+  {
+    dashboardHost: string;
+    hooksHost: string;
+    webhookPriority: number;
+    sitePriority: number;
+    instanceType: string;
+  }
+> = {
+  dev: {
+    dashboardHost: "openswe-dev.seahaven.com",
+    hooksHost: "hooks-dev.seahaven.com",
+    webhookPriority: 2,
+    sitePriority: 10,
+    instanceType: "t4g.medium",
+  },
+  prod: {
+    dashboardHost: "openswe.seahaven.com",
+    hooksHost: "hooks.seahaven.com",
+    webhookPriority: 3,
+    sitePriority: 11,
+    instanceType: "t4g.large",
+  },
+};
+
+export interface AppServiceProps {
+  readonly envName: EnvName;
+  /** Least-privilege EC2 instance role (per-env; from InstanceRole). */
+  readonly instanceRole: iam.IRole;
+  /** S3 artifact key prefix the box pulls app.tar.gz / spa.tar.gz from. */
+  readonly artifactPrefix?: string;
+}
+
+/**
+ * The open-swe compute + ingress wiring for one env (T12):
+ *  - one ARM64 EC2 box in private1 (1a), replacement-tolerant (no RETAIN volume),
+ *  - a standalone instance SG reachable ONLY from the shared ALB SG on :80,
+ *  - a target group → instance:80 (nginx is the sole ingress; :2024 stays loopback),
+ *  - two listener rules on the imported :443 listener (webhooks below the on-prem
+ *    path rule; site catch-all above it), both → the same TG,
+ *  - Route53 alias records for both hostnames → the shared ALB,
+ *  - IaC-owned CloudWatch log groups at 30-day retention.
+ *
+ * Everything ALB/VPC/zone-side is IMPORTED. Synth is offline: the AMI is the
+ * cdk.context.json-pinned AL2023 ARM64 placeholder until the baked
+ * open-swe-base-arm64 id is pinned before the first real deploy.
+ */
+export class AppService extends Construct {
+  public readonly instance: ec2.Instance;
+  public readonly targetGroup: elbv2.ApplicationTargetGroup;
+
+  constructor(scope: Construct, id: string, props: AppServiceProps) {
+    super(scope, id);
+    const env = props.envName;
+    const p = prefix(env);
+    const net = ENV_NET[env];
+    const artifactPrefix = props.artifactPrefix ?? "releases/latest";
+
+    // Import the shared VPC with explicit attributes (no fromLookup → offline synth).
+    const vpc = ec2.Vpc.fromVpcAttributes(this, "Vpc", {
+      vpcId: SHARED.vpcId,
+      availabilityZones: [...SHARED.availabilityZones],
+      privateSubnetIds: [...SHARED.privateSubnetIds],
+    });
+
+    // Standalone instance SG. Egress open (NAT path); ingress only from the ALB SG.
+    const instanceSg = new ec2.SecurityGroup(this, "InstanceSg", {
+      vpc,
+      securityGroupName: `${p}-instance-sg`,
+      description: `${p} instance SG — ingress only from the shared ALB SG on :80; egress via NAT.`,
+      allowAllOutbound: true,
+    });
+    instanceSg.addIngressRule(
+      ec2.Peer.securityGroupId(SHARED.albSecurityGroupId),
+      ec2.Port.tcp(80),
+      `${p}: shared ALB SG → nginx :80`,
+    );
+    // Open the IMPORTED ALB SG to our instance via a STANDALONE egress rule, so we
+    // never mutate the ALB SG's own (on-prem-owned) definition.
+    new ec2.CfnSecurityGroupEgress(this, "AlbToInstanceEgress", {
+      groupId: SHARED.albSecurityGroupId,
+      ipProtocol: "tcp",
+      fromPort: 80,
+      toPort: 80,
+      destinationSecurityGroupId: instanceSg.securityGroupId,
+      description: `${p}: ALB → instance nginx :80`,
+    });
+
+    // Render the provisioning script's @@tokens@@ into the instance user-data.
+    // userDataCausesReplacement makes a bootstrap change roll a fresh box (the box
+    // holds no durable state — see ami-cache.ts / user-data.sh).
+    const userDataPath = path.join(__dirname, "..", "..", "..", "deploy", "ami", "user-data.sh");
+    const userData = ec2.UserData.custom(
+      fs
+        .readFileSync(userDataPath, "utf8")
+        .replace(/@@OPENSWE_ENV@@/g, env)
+        .replace(/@@ASSETS_BUCKET@@/g, `${p}-assets`)
+        .replace(/@@SERVER_NAME@@/g, net.dashboardHost)
+        .replace(/@@ARTIFACT_PREFIX@@/g, artifactPrefix),
+    );
+
+    this.instance = new ec2.Instance(this, "Instance", {
+      vpc,
+      vpcSubnets: {
+        subnets: [
+          ec2.Subnet.fromSubnetAttributes(this, "InstanceSubnet", {
+            subnetId: SHARED.instanceSubnetId,
+            availabilityZone: SHARED.instanceAz,
+          }),
+        ],
+      },
+      instanceType: new ec2.InstanceType(net.instanceType),
+      // TODO(T12-deploy): repoint to the custom open-swe-base-arm64 AMI baked by
+      // packer (deploy/ami). The AL2023 ARM64 cache is a synth-time placeholder
+      // (pinned in cdk.context.json) so the box DEFINITION synths offline; the
+      // baked AMI id is pinned (cdk context) before the first real deploy.
+      // user-data.sh assumes the baked layout (/opt/open-swe, openswe user, nginx,
+      // CloudWatch agent) — it is NOT runnable on the stock AL2023 placeholder.
+      machineImage: cachedArm64AmazonLinux2023(),
+      role: props.instanceRole,
+      securityGroup: instanceSg,
+      userData,
+      userDataCausesReplacement: true,
+      requireImdsv2: true,
+      instanceName: `${p}-box`,
+      blockDevices: [
+        {
+          deviceName: "/dev/xvda",
+          // gp3 encrypted root; deleteOnTermination (no durable on-box state →
+          // intentionally NO standalone RETAIN volume; see ami-cache.ts).
+          volume: ec2.BlockDeviceVolume.ebs(30, {
+            volumeType: ec2.EbsDeviceVolumeType.GP3,
+            encrypted: true,
+            deleteOnTermination: true,
+          }),
+        },
+      ],
+    });
+
+    // Target group → instance:80 (nginx). Health check hits nginx's /healthz
+    // (returns 200; the dashboard TG health path defined in open-swe.nginx.conf).
+    this.targetGroup = new elbv2.ApplicationTargetGroup(this, "Tg", {
+      vpc,
+      targetGroupName: `${p}-tg`,
+      port: 80,
+      protocol: elbv2.ApplicationProtocol.HTTP,
+      targetType: elbv2.TargetType.INSTANCE,
+      targets: [new elbTargets.InstanceTarget(this.instance)],
+      deregistrationDelay: cdk.Duration.seconds(15),
+      healthCheck: {
+        path: "/healthz",
+        healthyHttpCodes: "200",
+        interval: cdk.Duration.seconds(30),
+        timeout: cdk.Duration.seconds(5),
+        healthyThresholdCount: 2,
+        unhealthyThresholdCount: 3,
+      },
+    });
+
+    // Import the shared :443 listener (with its ALB SG) and ADD our two rules.
+    const albSg = ec2.SecurityGroup.fromSecurityGroupId(this, "AlbSg", SHARED.albSecurityGroupId, {
+      mutable: false,
+    });
+    const listener = elbv2.ApplicationListener.fromApplicationListenerAttributes(this, "HttpsListener", {
+      listenerArn: SHARED.httpsListenerArn,
+      securityGroup: albSg,
+    });
+
+    // (1) Webhooks — accepted on EITHER host (integrations may target either), and
+    // MUST be below the on-prem path-only rule 5 (see ENV_NET note).
+    new elbv2.ApplicationListenerRule(this, "WebhooksRule", {
+      listener,
+      priority: net.webhookPriority,
+      conditions: [
+        elbv2.ListenerCondition.hostHeaders([net.dashboardHost, net.hooksHost]),
+        elbv2.ListenerCondition.pathPatterns(["/webhooks/*"]),
+      ],
+      action: elbv2.ListenerAction.forward([this.targetGroup]),
+    });
+    // (2) Dashboard SPA + /dashboard/api/ (OAuth) — DASHBOARD host ONLY. The hooks
+    // host intentionally serves nothing but /webhooks/* (rule 1), so the OAuth /
+    // dashboard surface stays single-origin (OSWE-T12-02). Non-webhook paths on the
+    // hooks host fall through to the on-prem default.
+    new elbv2.ApplicationListenerRule(this, "SiteRule", {
+      listener,
+      priority: net.sitePriority,
+      conditions: [elbv2.ListenerCondition.hostHeaders([net.dashboardHost])],
+      action: elbv2.ListenerAction.forward([this.targetGroup]),
+    });
+
+    // Route53 ALIAS records → the shared ALB, for both hostnames.
+    const zone = route53.HostedZone.fromHostedZoneAttributes(this, "PublicZone", {
+      hostedZoneId: SHARED.publicZoneId,
+      zoneName: SHARED.publicZoneName,
+    });
+    const albAlias: route53.IAliasRecordTarget = {
+      bind: () => ({
+        dnsName: SHARED.albDnsName,
+        hostedZoneId: SHARED.albCanonicalHostedZoneId,
+      }),
+    };
+    for (const [label, host] of [
+      ["Dashboard", net.dashboardHost],
+      ["Hooks", net.hooksHost],
+    ] as const) {
+      new route53.ARecord(this, `${label}Alias`, {
+        zone,
+        recordName: host,
+        target: route53.RecordTarget.fromAlias(albAlias),
+        comment: `${p} ${label.toLowerCase()} → shared seahaven-com ALB`,
+      });
+    }
+
+    // IaC-owned CloudWatch log groups at 30-day retention. Names mirror the
+    // CloudWatch-agent config (deploy/ami/templates/amazon-cloudwatch-agent.json);
+    // owning them here makes retention declarative rather than agent-set. Logs are
+    // not durable state → DESTROY on stack delete.
+    for (const suffix of ["app", "user-data", "nginx-access", "nginx-error"]) {
+      new logs.LogGroup(this, `Log-${suffix}`, {
+        logGroupName: `/open-swe/${env}/${suffix}`,
+        retention: logs.RetentionDays.ONE_MONTH,
+        removalPolicy: cdk.RemovalPolicy.DESTROY,
+      });
+    }
+  }
+}
--- a/infra/lib/constructs/config-store.ts
+++ b/infra/lib/constructs/config-store.ts
@ -0,0 +1,235 @@
+import * as cdk from "aws-cdk-lib";
+import * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
+import * as ssm from "aws-cdk-lib/aws-ssm";
+import { Construct } from "constructs";
+import { EnvName } from "../config";
+
+/**
+ * Config / secret "shells" for the boot hook (`deploy/seahaven/fetch-config.sh`).
+ *
+ * The naming contract (source of truth: the T9 env/secret/config inventory + the
+ * fetch-config header) is LITERAL env-var names as the last path segment:
+ *
+ *   Secrets  open-swe-<env>/<ENV_VAR_NAME>     (AWS Secrets Manager)
+ *   Config   /open-swe-<env>/<ENV_VAR_NAME>    (AWS SSM Parameter Store, FLAT)
+ *
+ * fetch-config reads secrets with `batch-get-secret-value --filters
+ * Key=name,Values=open-swe-<env>/` and config with `get-parameters-by-path
+ * --path /open-swe-<env>/` (NON-recursive), then strips the prefix so the last
+ * segment IS the exported variable name. So these resources MUST carry the
+ * UPPER_SNAKE env-var name verbatim — which is why both resource types are
+ * exempted from the kebab-naming Aspect (see aspects/kebab-naming-aspect.ts).
+ *
+ * Three buckets:
+ *
+ *  1. SECRETS_SHELLS — the 29 secrets. Created as value-LESS shells (an L1
+ *     `CfnSecret` with NEITHER `secretString` NOR `generateSecretString`, which
+ *     CloudFormation creates as an empty secret with no version). The real value
+ *     is set out-of-band via `deploy/seahaven/put-config.sh` (put-secret-value)
+ *     BEFORE the box boots. Because CDK never owns the value, a later
+ *     `cdk deploy` can never clobber the operator-set value. AWS-managed key
+ *     (alias/aws/secretsmanager) — no CMK, matching the instance role which
+ *     deliberately omits kms:Decrypt.
+ *
+ *  2. IAC_MANAGED_SSM — stable / derivable config. Real values are owned here in
+ *     IaC (one StringParameter each) so they are reproducible and reviewed.
+ *
+ *  3. Out-of-band SSM (NOT created here) — operationally-variable or
+ *     env-specific-unknown config (e.g. DEFAULT_SANDBOX_SNAPSHOT_ID, which
+ *     changes on every snapshot rebuild and would be clobbered by a deploy if it
+ *     were CDK-managed; GitHub App ids; Slack ids; LangSmith tenant/urls). These
+ *     are listed in OUT_OF_BAND_SSM purely for documentation and are set by
+ *     `put-config.sh`, never by CDK.
+ */
+
+/** The 29 Secrets Manager secret VAR names (T9 inventory SECRETS table). */
+export const SECRET_VARS: readonly string[] = [
+  "ANTHROPIC_API_KEY",
+  "CORRIDOR_API_TOKEN",
+  "CORRIDOR_MCP_TOKEN",
+  "CORRIDOR_TOKEN",
+  "DASHBOARD_JWT_SECRET",
+  "DAYTONA_API_KEY",
+  "EXA_API_KEY",
+  "FIREWORKS_API_KEY",
+  "GITHUB_APP_CLIENT_SECRET",
+  "GITHUB_APP_PRIVATE_KEY",
+  "GITHUB_PAT",
+  "GITHUB_WEBHOOK_SECRET",
+  "GOOGLE_API_KEY",
+  "GROQ_API_KEY",
+  "JUDGE_ANTHROPIC_API_KEY",
+  "LANGSMITH_API_KEY",
+  "LANGSMITH_API_KEY_PROD",
+  "LANGCHAIN_API_KEY",
+  "LINEAR_API_KEY",
+  "LINEAR_WEBHOOK_SECRET",
+  "OPENAI_API_KEY",
+  "RUNLOOP_API_KEY",
+  "SLACK_BOT_TOKEN",
+  "SLACK_CLIENT_SECRET",
+  "SLACK_SIGNING_SECRET",
+  "TOKEN_ENCRYPTION_KEY",
+  "USER_ID_API_KEY_MAP",
+  "X_SERVICE_AUTH_JWT_SECRET",
+] as const;
+// 28 secret shells. The T9 inventory header said "29" vs 27 enumerated; reconciled
+// (Adam confirm 2026-06-26): USER_ID_API_KEY_MAP (maps user ids -> API keys; flagged
+// sensitive by the T5 security review) is a SECRET and is included here.
+// JUDGE_ANTHROPIC_BASE_URL is a URL (non-sensitive config, eval-only) -> SSM/default,
+// NOT a secret. So the inventory's "29" was effectively a miscount.
+
+/** Short, value-free descriptions for the secret shells (no secret material). */
+const SECRET_DESCRIPTIONS: Record<string, string> = {
+  ANTHROPIC_API_KEY: "Claude LLM API key (primary builder provider).",
+  CORRIDOR_API_TOKEN: "Corridor MCP token (optional).",
+  CORRIDOR_MCP_TOKEN: "Corridor MCP token alt name (optional).",
+  CORRIDOR_TOKEN: "Corridor MCP token alt name (optional).",
+  DASHBOARD_JWT_SECRET: "JWT signing secret for dashboard session cookies (REQUIRED).",
+  DAYTONA_API_KEY: "Daytona sandbox key (only if SANDBOX_TYPE=daytona).",
+  EXA_API_KEY: "Exa web-search key (optional).",
+  FIREWORKS_API_KEY: "Fireworks LLM key (only if a fireworks: model is used).",
+  GITHUB_APP_CLIENT_SECRET: "GitHub App OAuth client secret (dashboard login).",
+  GITHUB_APP_PRIVATE_KEY: "GitHub App private key PEM (installation-token minting).",
+  GITHUB_PAT: "GitHub PAT fallback (optional).",
+  GITHUB_WEBHOOK_SECRET: "GitHub webhook signature secret (prod-required).",
+  GOOGLE_API_KEY: "Google GenAI key (only if a google_genai: model is used).",
+  GROQ_API_KEY: "Groq LLM key (only if a groq: model is used).",
+  JUDGE_ANTHROPIC_API_KEY: "Eval judge key (optional; falls back to ANTHROPIC_API_KEY).",
+  LANGSMITH_API_KEY: "LangSmith key (dev).",
+  LANGSMITH_API_KEY_PROD: "LangSmith key (prod / deployed sandbox).",
+  LANGCHAIN_API_KEY: "LangSmith key alt name (fallback).",
+  LINEAR_API_KEY: "Linear API key (optional).",
+  LINEAR_WEBHOOK_SECRET: "Linear webhook signature secret (required when Linear is wired).",
+  OPENAI_API_KEY: "OpenAI key (primary reviewer provider).",
+  RUNLOOP_API_KEY: "Runloop sandbox key (only if SANDBOX_TYPE=runloop).",
+  SLACK_BOT_TOKEN: "Slack bot token (optional).",
+  SLACK_CLIENT_SECRET: "Slack OAuth client secret.",
+  SLACK_SIGNING_SECRET: "Slack webhook signing secret (prod-required).",
+  TOKEN_ENCRYPTION_KEY: "Fernet key(s) for per-user GitHub-token encryption (REQUIRED).",
+  USER_ID_API_KEY_MAP: "JSON map of user id -> API key for per-user auth (optional, sensitive).",
+  X_SERVICE_AUTH_JWT_SECRET: "Service-auth JWT secret (optional).",
+};
+
+/**
+ * IaC-managed SSM config: stable / derivable values owned in code, per env.
+ * Values are functions of envName so dev/prod render correct hosts.
+ *
+ * Anything operationally-variable or env-specific-unknown is deliberately NOT
+ * here — see OUT_OF_BAND_SSM.
+ */
+export function iacManagedSsm(env: EnvName): Record<string, string> {
+  // Public host = seahaven.com (the migration's new AWS public face; confirmed by
+  // recon: seahaven.com Route53 zone + *.seahaven.com ACM cert are live on the ALB
+  // — distinct from the on-prem seahavenind.com). dev = openswe-dev, prod = openswe.
+  const host = `https://openswe${env === "dev" ? "-dev" : ""}.seahaven.com`;
+  return {
+    // Sandbox provider — plan keeps stock langsmith (T9). Stable.
+    SANDBOX_TYPE: "langsmith",
+    // Sea Haven org pin. fetch-config ALSO hard-pins this at boot, but owning the
+    // real value here keeps SSM self-consistent rather than blank.
+    DEFAULT_REPO_OWNER: "Sea-Haven-Industries",
+    // Repo allowlist (comma list) — the Sea Haven org. Stable/derivable.
+    ALLOWED_GITHUB_ORGS: "Sea-Haven-Industries",
+    // Pilot repo (project memory: Sea-Haven-Industries/open-swe-pilot).
+    DEFAULT_REPO_NAME: "open-swe-pilot",
+    // Dashboard URLs — derived from the public host.
+    DASHBOARD_BASE_URL: host,
+    DASHBOARD_API_BASE_URL: host,
+    DASHBOARD_ALLOWED_ORIGINS: host,
+    // Primary builder model (project memory team_settings: anthropic:claude-opus-4-8).
+    LLM_MODEL_ID: "anthropic:claude-opus-4-8",
+  };
+}
+
+/**
+ * Out-of-band SSM config: NOT created by CDK. Listed for documentation and for
+ * `put-config.sh` to populate before the box boots. Each MUST stay out of IaC
+ * because its value is operationally-variable or env-specific and unknown at
+ * synth time — making it CDK-managed would either clobber the operator value on
+ * the next deploy (e.g. DEFAULT_SANDBOX_SNAPSHOT_ID) or hardcode a secret-ish id.
+ */
+export const OUT_OF_BAND_SSM: readonly string[] = [
+  // Sandbox snapshot id — changes on EVERY snapshot rebuild. MUST NOT be
+  // CDK-managed or a deploy clobbers it. Required for SANDBOX_TYPE=langsmith.
+  "DEFAULT_SANDBOX_SNAPSHOT_ID",
+  // GitHub App identifiers — set when the per-env GitHub App is created.
+  "GITHUB_APP_ID",
+  "GITHUB_APP_CLIENT_ID",
+  "GITHUB_APP_INSTALLATION_ID",
+  "GITHUB_OAUTH_PROVIDER_ID",
+  // LangSmith deployment coordinates (prod tenant/urls/endpoints).
+  "LANGSMITH_TENANT_ID_PROD",
+  "LANGSMITH_URL_PROD",
+  "LANGSMITH_ENDPOINT",
+  "LANGSMITH_ENDPOINT_PROD",
+  "LANGSMITH_HOST_API_URL",
+  "LANGGRAPH_URL",
+  "LANGGRAPH_URL_PROD",
+  "LANGCHAIN_REVISION_ID",
+  // Slack workspace ids — set after the Slack app is installed.
+  "SLACK_CLIENT_ID",
+  "SLACK_TEAM_ID",
+  "SLACK_BOT_USER_ID",
+  "SLACK_BOT_USERNAME",
+  "SLACK_REPO_OWNER",
+  "SLACK_REPO_NAME",
+  // Access / observability allowlists — operator-curated.
+  "CONFIGURED_ADMINS",
+  "OBSERVABILITY_AUTHORIZED_EMAILS",
+  "PUBLIC_REPO_ORG_GATE",
+  "ALLOWED_GITHUB_REPOS",
+  // Optional integrations + tuning knobs (left to code defaults unless set).
+  "LLM_FALLBACK_MODEL_ID",
+  "DATADOG_MCP_TOOLSETS",
+  "NOTION_MCP_CLIENT_NAME",
+  "API_STANDARDS_SKILL_HANDLE",
+  "REPO_SNAPSHOT_BASE_IMAGE",
+  "REPO_SNAPSHOT_BUILD_TIMEOUT_SECONDS",
+  "REPO_SNAPSHOT_STALE_BUILD_SECONDS",
+] as const;
+
+export interface ConfigStoreProps {
+  readonly envName: EnvName;
+}
+
+/**
+ * Per-env Secrets Manager + SSM Parameter Store shells the boot hook reads.
+ * Instantiated from OpenSweStack. Synth-able now (T11); values populated
+ * out-of-band BEFORE the EC2/T12 deploy. See infra/README.md "Config store".
+ */
+export class ConfigStore extends Construct {
+  public readonly secrets: secretsmanager.CfnSecret[] = [];
+  public readonly params: ssm.StringParameter[] = [];
+
+  constructor(scope: Construct, id: string, props: ConfigStoreProps) {
+    super(scope, id);
+    const env = props.envName;
+
+    // --- 1) Secret shells (value-LESS; populated out-of-band) ----------------
+    for (const varName of SECRET_VARS) {
+      const secret = new secretsmanager.CfnSecret(this, `Secret-${varName}`, {
+        name: `open-swe-${env}/${varName}`,
+        description: SECRET_DESCRIPTIONS[varName] ?? `open-swe ${varName}`,
+        // Deliberately NO secretString / generateSecretString: CloudFormation
+        // creates an empty secret, so the out-of-band value is never clobbered.
+      });
+      // RETAIN: a stack teardown must not destroy operator-set secret material.
+      secret.applyRemovalPolicy(cdk.RemovalPolicy.RETAIN);
+      this.secrets.push(secret);
+    }
+
+    // --- 2) IaC-managed SSM config (real, derivable values) ------------------
+    const managed = iacManagedSsm(env);
+    for (const [varName, value] of Object.entries(managed)) {
+      this.params.push(
+        new ssm.StringParameter(this, `Param-${varName}`, {
+          parameterName: `/open-swe-${env}/${varName}`,
+          stringValue: value,
+          description: `IaC-managed open-swe ${varName} (${env}).`,
+          tier: ssm.ParameterTier.STANDARD,
+        }),
+      );
+    }
+  }
+}
--- a/infra/lib/open-swe-stack.ts
+++ b/infra/lib/open-swe-stack.ts
@ -1,6 +1,8 @@
 import * as cdk from "aws-cdk-lib";
 import { Construct } from "constructs";
 import { EnvName, prefix } from "./config";
+import { AppService } from "./constructs/app-service";
+import { ConfigStore } from "./constructs/config-store";
 import { InstanceRole } from "./constructs/instance-role";
 import {
  AL2023_ARM64_SSM_CONTEXT_KEY,
@ -16,13 +18,16 @@ export interface OpenSweStackProps extends cdk.StackProps {
 * Per-env open-swe stack (`open-swe-dev` / `open-swe-prod`). Resource names are
 * prefixed `open-swe-<env>-*`.
 *
- * T3 scope: the per-env EC2 instance role + the wired-but-not-yet-instantiated
- * AMI cache helper. The EC2 instance, ALB target groups, listener rules, SG,
- * Route53 and NAT come at T12 — this stack is the synth-able shell they plug
- * into.
+ * Composes: the per-env least-privilege instance role (T6), the Secrets/SSM
+ * config store (T11), and the compute + ingress wiring (T12, AppService — EC2
+ * box, instance SG, target group, imported-listener rules, Route53 aliases,
+ * 30-day log groups). The shared VPC and ALB are imported, never owned. Synth is
+ * offline (AMI is the cdk.context.json-pinned placeholder until T12-deploy).
 */
 export class OpenSweStack extends cdk.Stack {
  public readonly instanceRole: InstanceRole;
+  public readonly configStore: ConfigStore;
+  public readonly appService: AppService;

  constructor(scope: Construct, id: string, props: OpenSweStackProps) {
    super(scope, id, props);
@ -37,6 +42,12 @@ export class OpenSweStack extends cdk.Stack {
    // Per-env least-privilege EC2 instance role (open-swe-<env>-instance-role).
    this.instanceRole = new InstanceRole(this, "Instance", envName);

+    // Secrets Manager + SSM Parameter Store shells the boot hook reads
+    // (deploy/seahaven/fetch-config.sh). Secret shells are value-less and
+    // populated out-of-band; IaC-managed SSM params carry real derivable values.
+    // The instance role already grants read on open-swe-<env>/* + /open-swe-<env>/*.
+    this.configStore = new ConfigStore(this, "Config", { envName });
+
    // AMI cache discipline (see lib/constructs/ami-cache.ts). T3 is synth-only:
    // resolve + surface the pinned AMI id ONLY when it is already cached in
    // cdk.context.json, so synth never makes a live SSM call. T12 consumes
@ -50,9 +61,24 @@ export class OpenSweStack extends cdk.Stack {
      });
    }

+    // T12: compute + ingress. Imports the shared seahaven-vpc + ALB and adds the
+    // env's EC2 box, instance SG, target group, listener rules, DNS, log groups.
+    this.appService = new AppService(this, "App", {
+      envName,
+      instanceRole: this.instanceRole.role,
+    });
+
    new cdk.CfnOutput(this, "InstanceRoleArn", {
      value: this.instanceRole.role.roleArn,
      description: `${p} EC2 instance role ARN.`,
    });
+    new cdk.CfnOutput(this, "InstanceId", {
+      value: this.appService.instance.instanceId,
+      description: `${p} EC2 instance id.`,
+    });
+    new cdk.CfnOutput(this, "TargetGroupArn", {
+      value: this.appService.targetGroup.targetGroupArn,
+      description: `${p} ALB target group ARN (→ instance:80 nginx).`,
+    });
  }
 }
--- a/infra/test/kebab-naming-aspect.test.ts
+++ b/infra/test/kebab-naming-aspect.test.ts
@ -1,5 +1,5 @@
 import * as cdk from "aws-cdk-lib";
-import { Annotations, Match } from "aws-cdk-lib/assertions";
+import { Annotations, Match, Template } from "aws-cdk-lib/assertions";
 import * as iam from "aws-cdk-lib/aws-iam";
 import { KebabNamingAspect, isKebabCase } from "../lib/aspects/kebab-naming-aspect";
 import { OpenSweIamStack } from "../lib/open-swe-iam-stack";
@ -53,6 +53,31 @@ describe("KebabNamingAspect", () => {
    }
  });

+  it("exempts Secrets Manager + SSM names that carry the literal env-var segment", () => {
+    // The config store names a secret open-swe-dev/ANTHROPIC_API_KEY and a param
+    // /open-swe-dev/SANDBOX_TYPE — the UPPER_SNAKE last segment is a REQUIRED
+    // deviation from kebab (fetch-config naming contract). Must NOT be flagged.
+    const app = new cdk.App();
+    cdk.Aspects.of(app).add(new KebabNamingAspect());
+
+    const dev = new OpenSweStack(app, "OpenSweDevStack", {
+      stackName: "open-swe-dev",
+      env: ENV,
+      envName: "dev",
+    });
+
+    const tpl = Template.fromStack(dev);
+    // Sanity: the shells actually render with the literal env-var names.
+    tpl.hasResourceProperties("AWS::SecretsManager::Secret", {
+      Name: "open-swe-dev/ANTHROPIC_API_KEY",
+    });
+    tpl.hasResourceProperties("AWS::SSM::Parameter", {
+      Name: "/open-swe-dev/SANDBOX_TYPE",
+      Value: "langsmith",
+    });
+    Annotations.fromStack(dev).hasNoError("*", Match.anyValue());
+  });
+
  it("flags a deliberately non-kebab-case resource name", () => {
    const app = new cdk.App();
    const stack = new cdk.Stack(app, "ConformingStackId", { stackName: "open-swe-test", env: ENV });