Merge 5fc749bc0e into 1e5c73938e

README.md

@@ -107,23 +107,6 @@ The consumer imports the table via `Table.fromTableName(...)` and is granted rea
 
 **Known exception (INFRA-51):** `amazon-po-parser` currently writes directly to `purchase-orders` outside this stack (backfill/enrichment scripts). This second writer is being folded into the `po-ingest` pipeline so this stack is the sole writer; until INFRA-51 closes, coordinate any schema change with `amazon-po-parser` as well.
 
-### `WorkOrders` and `WorkOrderComments` tables (owned here)
-
-Both tables are **owned by this repo's `WorkorderIngestStack`** (`cdk/wo_stack.py`, `RemovalPolicy.RETAIN`, shared customer-managed CMK per INFRA-95 / M-3):
-
-- `WorkOrders` — PK `work_order_id` (S).
-- `WorkOrderComments` — PK `work_order_id` (S), SK `comment_id` (S).
-
-**Consumer (read-only) — data contract:** `seahaven-slack-bot` imports both tables via `Table.fromTableName(...)` (`grantReadData` plus an explicit `kms:Decrypt` grant on the shared CMK) and reads them from two Lambdas: `workorder-sync` (daily full-table scan into the Bedrock knowledge base) and `wo-po-lookup` (the Bedrock agent's direct WO lookup action group). The bot depends on the PK/SK schema above, the CMK encryption, and these attributes: on `WorkOrders` — `description`, `wo_status`, `customer`, `site_code`, `building`, `address`, `severity`, `priority`, `assigned_to`, `date_reported`, `scheduled_start`, `due_date`, `updated_at`; on `WorkOrderComments` — `created_at` (used to sort comments), `commenter`, `text`. Any change to table name, key schema, these attribute names, or the encryption key must be coordinated with `seahaven-slack-bot` before it ships, or the Bedrock agent breaks at runtime (not at deploy — the tables are imported by name, so there is no compile-time link).
-
-### `verified-sites` table (owned here)
-
-Owned by this repo's `po-ingest` stack (`cdk/po_stack.py`). PK `siteCode` (S); AWS-managed encryption (NOT the shared CMK).
-
-**Consumer (read-only) — data contract:** `seahaven-slack-bot`'s `wo-po-lookup` Lambda imports this table via `Table.fromTableName(...)` for the Bedrock agent's `lookup_site` action. It does point lookups by `siteCode` and reads `address`, `fullAddress`, `city`, `state`, `zip`, `latitude`, `longitude`, `notes`. Coordinate any change to the table name, key schema, or these attribute names with `seahaven-slack-bot`.
-
-> **GSI drift (INFRA-138):** the `by-state` GSI was removed here on 2026-06-03 (audit M-20, "0 reads in 30d"), but `seahaven-slack-bot` still queries `IndexName: 'by-state'` for its state-listing path, so that path fails at runtime today. Restoring the GSI or removing the consumer's state path needs to be reconciled cross-repo. This is the kind of silent owner-side lifecycle change this data-contract note exists to prevent.
-
 ## Documentation
 
 The canonical map of Sea Haven's AWS infrastructure lives in Confluence. This project's `po-ingest` and `workorder-ingest` stacks are represented there as Mermaid subgraphs.

cdk/requirements.txt

@@ -1,2 +1,2 @@
-aws-cdk-lib==2.261.0
+aws-cdk-lib==2.260.0
 constructs>=10.6.0

lambdas/po/email_processor/requirements.txt

@@ -1,2 +1,2 @@
 anthropic>=0.116.0
-boto3>=1.43.41
+boto3>=1.43.39

lambdas/wo/email_processor/requirements.txt

@@ -1,2 +1,2 @@
-anthropic>=0.116.0
-boto3>=1.43.41
+anthropic>=0.113.0
+boto3>=1.43.38

lambdas/wo/web_ui/requirements.txt

@@ -1 +1 @@
-boto3>=1.43.41
+boto3>=1.43.39