Merge c64b2999ce into 61ccc68877

Signed-off-by: Adam Moussa <adam@seahavenind.com>

.github/workflows/ci.yaml

@@ -8,7 +8,7 @@ permissions:
 
 jobs:
   ci:
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml@f71002a9ed2938730b683249b28059c92a081af6
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml@0170a57c0d99b542cfafd1f3e1d369c32643f486 # v1.0.2
     with:
       source-dirs: "lambdas cdk tests scripts"
       run-tests: true

.github/workflows/dependency-review.yml

@@ -7,4 +7,4 @@ permissions:
 
 jobs:
   review:
-    uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@fd60e4c9041784f666ac0fdefb9bec3c7fbf5143 # main
+    uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@0170a57c0d99b542cfafd1f3e1d369c32643f486 # v1.0.2

.github/workflows/deploy.yaml

@@ -13,7 +13,7 @@ concurrency:
 
 jobs:
   deploy:
-    uses: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml@fd60e4c9041784f666ac0fdefb9bec3c7fbf5143 # main
+    uses: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml@0170a57c0d99b542cfafd1f3e1d369c32643f486 # v1.0.2
     with:
       python-version: "3.12"
       cdk-dir: cdk

.github/workflows/labeler.yml

@@ -2,10 +2,12 @@ name: Labeler
 on:
   pull_request:
     branches: [main]
+
 permissions:
   contents: read
   pull-requests: write
   issues: write
+
 jobs:
   label:
-    uses: Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml@fd60e4c9041784f666ac0fdefb9bec3c7fbf5143 # main
+    uses: Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml@0170a57c0d99b542cfafd1f3e1d369c32643f486 # v1.0.2

cdk/wo_stack.py

@@ -1,29 +1,56 @@
 """CDK stack for the work order email ingestion pipeline."""
 
 import aws_cdk as cdk
+import common
 from aws_cdk import (
     Duration,
     RemovalPolicy,
     Stack,
+)
+from aws_cdk import (
     aws_cloudwatch as cloudwatch,
+)
+from aws_cdk import (
     aws_cloudwatch_actions as cw_actions,
+)
+from aws_cdk import (
     aws_dynamodb as dynamodb,
+)
+from aws_cdk import (
     aws_iam as iam,
+)
+from aws_cdk import (
     aws_kms as kms,
+)
+from aws_cdk import (
     aws_lambda as lambda_,
+)
+from aws_cdk import (
     aws_lambda_event_sources as lambda_event_sources,
+)
+from aws_cdk import (
     aws_s3 as s3,
+)
+from aws_cdk import (
     aws_s3_notifications as s3n,
-    aws_ses as ses,
-    aws_ses_actions as ses_actions,
+)
+from aws_cdk import (
     aws_secretsmanager as secretsmanager,
+)
+from aws_cdk import (
+    aws_ses as ses,
+)
+from aws_cdk import (
+    aws_ses_actions as ses_actions,
+)
+from aws_cdk import (
     aws_sns as sns,
+)
+from aws_cdk import (
     aws_sqs as sqs,
 )
 from constructs import Construct
 
-import common
-
 
 class WorkorderIngestStack(Stack):
     def __init__(self, scope: Construct, construct_id: str, **kwargs):
@@ -750,14 +777,12 @@ def _add_shoc_webhook_emitter(stack, work_orders_table, comments_table, alarm_to
     shoc_emitter_rejected_queue.grant_send_messages(shoc_emitter)
 
     # ------------------------------------------------------------------
-    # SHIPS DARK: both event source mappings deploy with enabled=False,
-    # deliberately. The full stack (Lambda, queues, alarms, secret,
-    # rotation) deploys and is testable with zero deliveries while SHOC
-    # has no receiver, so our merge cadence never depends on Luby's.
-    # Activation is a one-line enabled=True PR gated on the SHOC receiver
-    # passing the shared HMAC test vectors (plan Phase 3). LATEST start
-    # position => no historical flood at activation; SHOC loads history
-    # via the procurement read API instead.
+    # ACTIVATED (enabled=True) 2026-07-30 after SHOC's receiver passed the
+    # shared HMAC test vectors. Shipped DARK originally (enabled=False) so the
+    # stack could deploy and be tested with zero deliveries while SHOC had no
+    # receiver; this activation PR is the deliberate one-line flip (plan Phase
+    # 3). LATEST start position => the feed begins now, no historical flood;
+    # SHOC backfills history via the procurement read API, not the stream.
     # Ordering knobs: parallelization_factor=1, bisect_batch_on_error=
     # False and retry_attempts=-1 (retry until the 24h record age) are
     # REQUIRED for strict per-work-order in-order delivery -- a retryable
@@ -775,7 +800,7 @@ def _add_shoc_webhook_emitter(stack, work_orders_table, comments_table, alarm_to
             max_record_age=Duration.hours(24),
             parallelization_factor=1,
             report_batch_item_failures=True,
-            enabled=False,
+            enabled=True,
             on_failure=lambda_event_sources.SqsDlq(shoc_emitter_failures_queue),
         )
     )
@@ -789,7 +814,7 @@ def _add_shoc_webhook_emitter(stack, work_orders_table, comments_table, alarm_to
             max_record_age=Duration.hours(24),
             parallelization_factor=1,
             report_batch_item_failures=True,
-            enabled=False,
+            enabled=True,
             on_failure=lambda_event_sources.SqsDlq(shoc_emitter_failures_queue),
         )
     )