* feat(iam): import hcptf roles into app Terraform (PLAT-146)
Move the existing hcptf pair into this repo so app Terraform owns prod IAM after the substrate handoff.
* fix(iam): attach scoped IAM as a managed policy (PLAT-146)
The apply role's services inline already uses 6894 of 10240 bytes, so a second inline policy cannot hold scoped IAM.
* fix(iam): add apply-role IAM list permissions (PLAT-146)
IamReadOnly omitted ListRoleTags and ListInstanceProfilesForRole needed after detaching the substrate guardrail.
* fix(iam): allow ListPolicyTags on scoped IAM policy (PLAT-146)
tagged managed scoped IAM is refreshed with ListPolicyTags; apply IamReadOnly and plan-refresh omitted it.
Writers already use kebab tables. Allow HCP to destroy PascalCase
WorkOrders / WorkOrderComments after the ≥24h kebab soak. Docs scrub
to kebab as the live physical names; GitHub #24 noted superseded.
Cutover apply updated Lambda env/IAM but ESM recreate failed until the
lambda execution boundary included kebab table ARNs. Import the
out-of-band Enabled mappings so HCP state matches live.
* feat(infra): retarget WO writers and ESMs to kebab Dynamo tables
Point Lambda env, IAM, emitter streams, and DDB alarms at work-orders /
work-order-comments for the PLAT-11 freeze cutover. Legacy PascalCase
tables remain in state until the decommission soak.
* style(infra): terraform fmt wo_ddb alarm map alignment
Tables were created in seahaven-prod after hcptf-procurement-ingest lacked
CreateTable on kebab ARNs; import blocks bring work-orders and
work-order-comments under Terraform ownership.
* feat(infra): add kebab WO tables and PLAT-11 cutover tooling
Create empty work-orders/work-order-comments under Terraform while writers
stay on PascalCase; make emitter table classification env-driven and add
same-account migrate/verify plus cutover runbook.
* style(test): ruff-format shoc emitter envelope tests
* chore(infra): remove cdk tree after hcp cutover
Delete retired CDK sources, retarget bundle/principal contract tests to
Terraform packaging, disable CDK synth in CI, and scrub deploy-adjacent docs.
* fix(test): restore exact SHOC principal pin in terraform
Pin shoc_consumer_role_arn's Terraform default and example to the trusted
ARN, and require grant sites to consume local.shoc_consumer_role_arn only.
