Adam Moussa 434d0ad80c feat(deploy): AWS-sourced fetch-config + seed_store + rotation docs (PR#7) (#8) ... PR#7 of the AWS migration. deploy/seahaven/: fetch-config.sh materializes a service-user-owned 0600 tmpfs .env from Secrets Manager + SSM (fail-fast); seed_store.sh reseeds the in-memory store; ROTATION.md. Incorporates T5 /sh-security-review fixes: - seed_store no longer bash-sources the .env (closes the SH-INJ-001 RCE); uses a non-eval reader, jq --arg JSON bodies, and a loopback-pinned BASE. - fetch-config: .env owned by the openswe service user (app no longer runs as root); DEFAULT_REPO_OWNER hard-pinned; key-identifier validation + flat-namespace collision detection; dropped SSM --recursive. shellcheck + bash -n clean.		2026-06-26 15:06:41 -04:00
..
ami	feat(deploy): EC2 AMI recipe (Packer) + cloud-init/user-data (PR#2) (#7)	2026-06-26 15:06:36 -04:00
seahaven	feat(deploy): AWS-sourced fetch-config + seed_store + rotation docs (PR#7) (#8)	2026-06-26 15:06:41 -04:00