Adam Moussa 2f2fc83a82 fix(webhook): kms:ViaService pins, https-only delivery, cross-account principal CI pin ... GPT-4.1 cross-family review of the policy surface (no BLOCK): FIX applied to the cross-account shoc-backend-dev Decrypt statement and both Lambda role KMS grants (the key is only ever used via Secrets Manager); its invariant-enforcement QUESTION answered durably with tests/test_cross_account_principal_pin.py (any new foreign IAM principal in cdk/ fails CI). Scanner mediums fixed: delivery.py and the replay script now refuse non-https URLs (urllib follows file:// and http://). SQS metadata-action and dynamodb:ListStreams NITs skipped: standard CDK grant shapes; ListStreams has no resource-level scoping. The 4 gitleaks HIGHs on docs/shoc-webhook-test-vectors.json are deliberate non-secrets (shared receiver-verification vectors) suppressed machine-level with justification.		2026-07-24 15:00:15 -04:00
..
email_processor	test: consolidate test roots — one loader, shared support, enforced CI floor (phase 8) (#118)	2026-07-20 16:19:15 -04:00
shoc_emitter	fix(webhook): kms:ViaService pins, https-only delivery, cross-account principal CI pin	2026-07-24 15:00:15 -04:00
shoc_hmac_rotator	feat(webhook): SHOC WO webhook emitter — dark-ship streams, HMAC secret + rotation	2026-07-24 14:54:07 -04:00
web_ui	chore(deps): update boto3 requirement in /lambdas/wo/web_ui (#123)	2026-07-21 16:06:29 -04:00