Adam Moussa 2f2fc83a82 fix(webhook): kms:ViaService pins, https-only delivery, cross-account principal CI pin ... GPT-4.1 cross-family review of the policy surface (no BLOCK): FIX applied to the cross-account shoc-backend-dev Decrypt statement and both Lambda role KMS grants (the key is only ever used via Secrets Manager); its invariant-enforcement QUESTION answered durably with tests/test_cross_account_principal_pin.py (any new foreign IAM principal in cdk/ fails CI). Scanner mediums fixed: delivery.py and the replay script now refuse non-https URLs (urllib follows file:// and http://). SQS metadata-action and dynamodb:ListStreams NITs skipped: standard CDK grant shapes; ListStreams has no resource-level scoping. The 4 gitleaks HIGHs on docs/shoc-webhook-test-vectors.json are deliberate non-secrets (shared receiver-verification vectors) suppressed machine-level with justification.		2026-07-24 15:00:15 -04:00
..
backfill_sites.py	feat: template-first WO parser + Bedrock fallback, PO Bedrock switch (#99)	2026-07-16 12:45:11 -04:00
migrate_tables.py	Migrate to seahaven-prod: deploy role, backfill tooling, account-portability fixes (#125)	2026-07-23 17:08:47 -04:00
post-deploy-smoke.sh	feat(api): procurement-api read stack + OpenAPI docs (SHOC reconciliation path) (#127)	2026-07-23 19:32:20 -04:00
preview_docs.py	feat(api): Redocly lint gate + SHOC-themed /docs (Redoc theming, topbar, collapsible samples) (#130)	2026-07-24 18:04:30 +00:00
replay_shoc_webhooks.py	fix(webhook): kms:ViaService pins, https-only delivery, cross-account principal CI pin	2026-07-24 15:00:15 -04:00
reprocess.py	Ops/recovery tooling + dependency hygiene (refactor phase 7) (#110)	2026-07-20 12:53:34 -04:00