docs(webhook): stamp activation date and correct backfill wording

The deliberate one-line activation flip (plan Phase 3). Turns on both
DynamoDB stream event-source mappings for workorder-shoc-emitter, which
shipped dark (enabled=False) in PR-2. LATEST start position => the live
feed begins at deploy, no historical flood; SHOC loads history via the
procurement read API first.

DO NOT MERGE until: (1) PR-2 (feat/shoc-wo-webhook) is merged to main;
(2) SHOC's receiver passes the shared HMAC test vectors
(docs/shoc-webhook-test-vectors.json) at the target endpoint; (3) the
cross-account secret read from shoc-backend-dev is confirmed working.
Draft, gated on Luby.

.github/workflows/ci.yaml

@@ -8,7 +8,7 @@ permissions:
 
 jobs:
   ci:
-    uses: Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml@0170a57c0d99b542cfafd1f3e1d369c32643f486 # v1.0.2
+    uses: Sea-Haven-Industries/.github/.github/workflows/ci-python-sam.yaml@f71002a9ed2938730b683249b28059c92a081af6
     with:
       source-dirs: "lambdas cdk tests scripts"
       run-tests: true

.github/workflows/dependency-review.yml

@@ -7,4 +7,4 @@ permissions:
 
 jobs:
   review:
-    uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@0170a57c0d99b542cfafd1f3e1d369c32643f486 # v1.0.2
+    uses: Sea-Haven-Industries/.github/.github/workflows/callable-dependency-review.yaml@fd60e4c9041784f666ac0fdefb9bec3c7fbf5143 # main

.github/workflows/deploy.yaml

@@ -13,7 +13,7 @@ concurrency:
 
 jobs:
   deploy:
-    uses: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml@0170a57c0d99b542cfafd1f3e1d369c32643f486 # v1.0.2
+    uses: Sea-Haven-Industries/.github/.github/workflows/cd-cdk.yaml@fd60e4c9041784f666ac0fdefb9bec3c7fbf5143 # main
     with:
       python-version: "3.12"
       cdk-dir: cdk

.github/workflows/labeler.yml

@@ -2,12 +2,10 @@ name: Labeler
 on:
   pull_request:
     branches: [main]
-
 permissions:
   contents: read
   pull-requests: write
   issues: write
-
 jobs:
   label:
-    uses: Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml@0170a57c0d99b542cfafd1f3e1d369c32643f486 # v1.0.2
+    uses: Sea-Haven-Industries/.github/.github/workflows/callable-labeler.yaml@fd60e4c9041784f666ac0fdefb9bec3c7fbf5143 # main

cdk/wo_stack.py

@@ -1,56 +1,29 @@
 """CDK stack for the work order email ingestion pipeline."""
 
 import aws_cdk as cdk
-import common
 from aws_cdk import (
     Duration,
     RemovalPolicy,
     Stack,
-)
-from aws_cdk import (
     aws_cloudwatch as cloudwatch,
-)
-from aws_cdk import (
     aws_cloudwatch_actions as cw_actions,
-)
-from aws_cdk import (
     aws_dynamodb as dynamodb,
-)
-from aws_cdk import (
     aws_iam as iam,
-)
-from aws_cdk import (
     aws_kms as kms,
-)
-from aws_cdk import (
     aws_lambda as lambda_,
-)
-from aws_cdk import (
     aws_lambda_event_sources as lambda_event_sources,
-)
-from aws_cdk import (
     aws_s3 as s3,
-)
-from aws_cdk import (
     aws_s3_notifications as s3n,
-)
-from aws_cdk import (
-    aws_secretsmanager as secretsmanager,
-)
-from aws_cdk import (
     aws_ses as ses,
-)
-from aws_cdk import (
     aws_ses_actions as ses_actions,
-)
-from aws_cdk import (
+    aws_secretsmanager as secretsmanager,
     aws_sns as sns,
-)
-from aws_cdk import (
     aws_sqs as sqs,
 )
 from constructs import Construct
 
+import common
+
 
 class WorkorderIngestStack(Stack):
     def __init__(self, scope: Construct, construct_id: str, **kwargs):
@@ -777,7 +750,7 @@ def _add_shoc_webhook_emitter(stack, work_orders_table, comments_table, alarm_to
     shoc_emitter_rejected_queue.grant_send_messages(shoc_emitter)
 
     # ------------------------------------------------------------------
-    # ACTIVATED (enabled=True) 2026-07-30 after SHOC's receiver passed the
+    # ACTIVATED (enabled=True) 2026-07-27 after SHOC's receiver passed the
     # shared HMAC test vectors. Shipped DARK originally (enabled=False) so the
     # stack could deploy and be tested with zero deliveries while SHOC had no
     # receiver; this activation PR is the deliberate one-line flip (plan Phase

lambdas/po/site_extractor/requirements.txt

@@ -1 +1 @@
-boto3==1.43.57
+boto3==1.43.56

lambdas/po/web_ui/requirements.txt

@@ -1 +1 @@
-boto3==1.43.57
+boto3==1.43.56

lambdas/wo/web_ui/requirements.txt

@@ -1 +1 @@
-boto3>=1.43.57
+boto3>=1.43.56

package-lock.json

@@ -5,13 +5,13 @@
   "packages": {
     "": {
       "devDependencies": {
-        "@redocly/cli": "^2.41.1"
+        "@redocly/cli": "^2.40.0"
       }
     },
     "node_modules/@redocly/cli": {
-      "version": "2.41.1",
-      "resolved": "https://registry.npmjs.org/@redocly/cli/-/cli-2.41.1.tgz",
-      "integrity": "sha512-Rde/CpjSMxTBWUCbkECtR4S1YTF8NE+tQgnI1Y7M4wxMLGy8yhmUmTHRUDlKSha97bfBfvjryYuEuZfocD2UNw==",
+      "version": "2.40.0",
+      "resolved": "https://registry.npmjs.org/@redocly/cli/-/cli-2.40.0.tgz",
+      "integrity": "sha512-1uQ4GeNjhApy9EtypZgp70ZN5GC2JFfst3UkNEXSqkXgVIPGdEAnlz5Xwgax/4cEUGOvaZoM3X25iSQcqbplFg==",
       "dev": true,
       "license": "MIT",
       "bin": {

package.json

@@ -4,6 +4,6 @@
     "docs:preview": ".venv/bin/python scripts/preview_docs.py"
   },
   "devDependencies": {
-    "@redocly/cli": "^2.41.1"
+    "@redocly/cli": "^2.40.0"
   }
 }