Merge 77a0f66bc9 into a6759167ae

The deliberate one-line activation flip (plan Phase 3). Turns on both
DynamoDB stream event-source mappings for workorder-shoc-emitter, which
shipped dark (enabled=False) in PR-2. LATEST start position => the live
feed begins at deploy, no historical flood; SHOC loads history via the
procurement read API first.

DO NOT MERGE until: (1) PR-2 (feat/shoc-wo-webhook) is merged to main;
(2) SHOC's receiver passes the shared HMAC test vectors
(docs/shoc-webhook-test-vectors.json) at the target endpoint; (3) the
cross-account secret read from shoc-backend-dev is confirmed working.
Draft, gated on Luby.

.github/workflows/ci.yaml

@@ -8,7 +8,7 @@ permissions:
 
 jobs:
   ci:
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml@0170a57c0d99b542cfafd1f3e1d369c32643f486 # v1.0.2
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml@f71002a9ed2938730b683249b28059c92a081af6
     with:
       source-dirs: "lambdas cdk tests scripts"
       run-tests: true

.github/workflows/dependency-review.yml

@@ -7,4 +7,4 @@ permissions:
 
 jobs:
   review:
-    uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@0170a57c0d99b542cfafd1f3e1d369c32643f486 # v1.0.2
+    uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@fd60e4c9041784f666ac0fdefb9bec3c7fbf5143 # main

.github/workflows/deploy.yaml

@@ -13,7 +13,7 @@ concurrency:
 
 jobs:
   deploy:
-    uses: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml@0170a57c0d99b542cfafd1f3e1d369c32643f486 # v1.0.2
+    uses: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml@fd60e4c9041784f666ac0fdefb9bec3c7fbf5143 # main
     with:
       python-version: "3.12"
       cdk-dir: cdk

.github/workflows/labeler.yml

@@ -2,12 +2,10 @@ name: Labeler
 on:
   pull_request:
     branches: [main]
-
 permissions:
   contents: read
   pull-requests: write
   issues: write
-
 jobs:
   label:
-    uses: Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml@0170a57c0d99b542cfafd1f3e1d369c32643f486 # v1.0.2
+    uses: Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml@fd60e4c9041784f666ac0fdefb9bec3c7fbf5143 # main

cdk/wo_stack.py

@@ -1,56 +1,29 @@
 """CDK stack for the work order email ingestion pipeline."""
 
 import aws_cdk as cdk
-import common
 from aws_cdk import (
     Duration,
     RemovalPolicy,
     Stack,
-)
-from aws_cdk import (
     aws_cloudwatch as cloudwatch,
-)
-from aws_cdk import (
     aws_cloudwatch_actions as cw_actions,
-)
-from aws_cdk import (
     aws_dynamodb as dynamodb,
-)
-from aws_cdk import (
     aws_iam as iam,
-)
-from aws_cdk import (
     aws_kms as kms,
-)
-from aws_cdk import (
     aws_lambda as lambda_,
-)
-from aws_cdk import (
     aws_lambda_event_sources as lambda_event_sources,
-)
-from aws_cdk import (
     aws_s3 as s3,
-)
-from aws_cdk import (
     aws_s3_notifications as s3n,
-)
-from aws_cdk import (
-    aws_secretsmanager as secretsmanager,
-)
-from aws_cdk import (
     aws_ses as ses,
-)
-from aws_cdk import (
     aws_ses_actions as ses_actions,
-)
-from aws_cdk import (
+    aws_secretsmanager as secretsmanager,
     aws_sns as sns,
-)
-from aws_cdk import (
     aws_sqs as sqs,
 )
 from constructs import Construct
 
+import common
+
 
 class WorkorderIngestStack(Stack):
     def __init__(self, scope: Construct, construct_id: str, **kwargs):
@@ -777,7 +750,7 @@ def _add_shoc_webhook_emitter(stack, work_orders_table, comments_table, alarm_to
     shoc_emitter_rejected_queue.grant_send_messages(shoc_emitter)
 
     # ------------------------------------------------------------------
-    # ACTIVATED (enabled=True) 2026-07-30 after SHOC's receiver passed the
+    # ACTIVATED (enabled=True) 2026-07-27 after SHOC's receiver passed the
     # shared HMAC test vectors. Shipped DARK originally (enabled=False) so the
     # stack could deploy and be tested with zero deliveries while SHOC had no
     # receiver; this activation PR is the deliberate one-line flip (plan Phase