Fix ASC key parsing: decode base64 before passing to Fastlane

The app_store_connect_api_key action fails with "invalid curve name"
when is_key_content_base64 is true on macOS runners with OpenSSL 3.x.
Decoding the key manually and passing the raw PEM content avoids the
OpenSSL incompatibility. Also reverts the Fastlane version pin since
2.235.0 doesn't exist.

.github/dependabot.yml

@@ -56,6 +56,20 @@ updates:
     open-pull-requests-limit: 3
 
 
+  - package-ecosystem: pip
+    directory: /lambdas/suggestions
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 3
+
+
+  - package-ecosystem: pip
+    directory: /lambdas/oss-index-creator
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 3
+
+
   - package-ecosystem: github-actions
     directory: /
     schedule:

.github/workflows/ci.yaml

@@ -21,6 +21,7 @@ jobs:
     with:
       working-directory: web
       cache-dependency-path: web/package-lock.json
+      node-version: "24"
       run-cdk-synth: false
       run-conventions-check: false
 
@@ -38,6 +39,7 @@ jobs:
     with:
       working-directory: mobile
       cache-dependency-path: mobile/package-lock.json
+      node-version: "24"
       run-cdk-synth: false
       run-conventions-check: false
 
@@ -47,6 +49,7 @@ jobs:
     with:
       working-directory: infra
       cache-dependency-path: infra/package-lock.json
+      node-version: "24"
       dotnet-version: "8.0.x"
       dotnet-publish-project: api/src/ProposalSystem.Api/ProposalSystem.Api.csproj
       run-typecheck: false

.github/workflows/deploy-mobile.yaml

@@ -12,6 +12,10 @@ concurrency:
   group: deploy-mobile
   cancel-in-progress: false
 
+permissions:
+  id-token: write
+  contents: read
+
 jobs:
   deploy-ios:
     name: Build & Upload to TestFlight

.github/workflows/deploy.yaml

@@ -3,6 +3,8 @@ name: Deploy
 on:
   push:
     branches: [main]
+    paths-ignore:
+      - "mobile/**"
 
 concurrency:
   group: deploy-backend

README.md

@@ -9,7 +9,7 @@ Monorepo with five primary services:
 - **.NET 8 API** -- Clean Architecture REST API hosted on Lambda behind API Gateway
 - **React 19 Web** -- MUI v7 admin/dispatcher workspace served via CloudFront + S3
 - **React Native Mobile** -- iOS-first field app for dispatchers (offline-capable)
-- **Python Lambdas** -- PDF extraction, PDF generation, library ingestion, AI suggestions
+- **Python Lambdas** -- PDF extraction, PDF generation, library ingestion, AI suggestions, AOSS index provisioning
 - **CDK Infrastructure** -- Three TypeScript stacks managing all AWS resources
 
 ## Repository Structure
@@ -41,12 +41,12 @@ proposal-system/
 
 ## AWS Resources
 
-All resources are in **us-east-1** (account 328440206208). CDK stacks are defined but not yet deployed to AWS.
+All resources are in **us-east-1** (account 328440206208).
 
 | CDK Stack | Key Resources |
 |---|---|
 | `proposal-system-foundation` | RDS PostgreSQL 15 (t4g.small), S3 buckets, SQS queue + DLQ, Cognito user pool, Secrets Manager |
-| `proposal-system-compute` | API Gateway HTTP API, .NET 8 API Lambda, Python Lambdas (pdf-extract, pdf-generate, library-ingest, suggestions), Bedrock KB |
+| `proposal-system-compute` | API Gateway HTTP API, .NET 8 API Lambda, Python Lambdas (pdf-extract, pdf-generate, library-ingest, suggestions, oss-index-creator), OpenSearch Serverless collection, Bedrock KB |
 | `proposal-system-frontend` | CloudFront distribution (S3 OAC) |
 
 | Resource Type | Names |

infra/lib/compute-stack.ts

@@ -93,7 +93,9 @@ export class ComputeStack extends cdk.Stack {
 
     // Lambda to pre-create the vector index (retries until AOSS access policy propagates)
     const indexCreatorFn = new lambda.Function(this, 'OssIndexCreator', {
+      functionName: 'proposal-system-oss-index-creator',
       runtime: lambda.Runtime.PYTHON_3_12,
+      architecture: lambda.Architecture.ARM_64,
       handler: 'app.handler',
       code: lambda.Code.fromAsset('../lambdas/oss-index-creator', {
         bundling: {
@@ -105,6 +107,7 @@ export class ComputeStack extends cdk.Stack {
         },
       }),
       timeout: cdk.Duration.minutes(6),
+      logRetention: logs.RetentionDays.TWO_MONTHS,
     });
 
     indexCreatorFn.addToRolePolicy(new iam.PolicyStatement({

lambdas/library-ingest/app.py

@@ -8,7 +8,6 @@ then triggers a KB sync.
 import json
 import logging
 import os
-import time
 from datetime import datetime
 
 import boto3
@@ -199,27 +198,3 @@ def _api_headers() -> dict:
     if api_key:
         headers["X-Internal-Api-Key"] = api_key
     return headers
-
-
-def _api_request(method: str, url: str, retries: int = 3, **kwargs) -> httpx.Response:
-    kwargs.setdefault("headers", _api_headers())
-    kwargs.setdefault("timeout", 10)
-    for attempt in range(retries):
-        try:
-            resp = httpx.request(method, url, **kwargs)
-            if resp.status_code < 500:
-                return resp
-            logger.warning(
-                "API returned %s on attempt %d for %s",
-                resp.status_code,
-                attempt + 1,
-                url,
-            )
-        except httpx.TransportError as e:
-            logger.warning(
-                "Transport error on attempt %d for %s: %s", attempt + 1, url, e
-            )
-            if attempt == retries - 1:
-                raise
-        time.sleep(min(2**attempt, 4))
-    return resp  # type: ignore[possibly-undefined]

lambdas/library-ingest/requirements.txt

@@ -1,2 +1,2 @@
-boto3>=1.43.9,<2.0
+boto3>=1.43.10,<2.0
 httpx>=0.28.1,<1.0

lambdas/oss-index-creator/app.py

@@ -1,4 +1,3 @@
-import json
 import time
 import boto3
 from opensearchpy import OpenSearch, RequestsHttpConnection
@@ -6,10 +5,7 @@ from requests_aws4auth import AWS4Auth
 
 
 def handler(event, context):
-    print(f"Event: {json.dumps(event, default=str)}")
-
     if event["RequestType"] == "Delete":
-        print("Delete request, returning")
         return {"PhysicalResourceId": event.get("PhysicalResourceId", "none")}
 
     props = event["ResourceProperties"]
@@ -19,13 +15,9 @@ def handler(event, context):
     text_field = props["TextField"]
     metadata_field = props["MetadataField"]
 
-    print(f"Endpoint: {endpoint}")
-    print(f"Index: {index_name}")
-
     session = boto3.Session()
     credentials = session.get_credentials().get_frozen_credentials()
     region = session.region_name
-    print(f"Region: {region}")
 
     awsauth = AWS4Auth(
         credentials.access_key,
@@ -45,9 +37,7 @@ def handler(event, context):
     )
 
     index_body = {
-        "settings": {
-            "index": {"knn": True, "knn.algo_param.ef_search": 512}
-        },
+        "settings": {"index": {"knn": True, "knn.algo_param.ef_search": 512}},
         "mappings": {
             "properties": {
                 vector_field: {
@@ -67,24 +57,15 @@ def handler(event, context):
 
     for attempt in range(30):
         try:
-            print(f"Attempt {attempt}: creating index...")
-            response = client.indices.create(index=index_name, body=index_body)
-            print(f"Index created successfully: {response}")
-            # Verify the index exists
-            exists = client.indices.exists(index=index_name)
-            print(f"Index exists check: {exists}")
+            client.indices.create(index=index_name, body=index_body)
             return {"PhysicalResourceId": index_name}
         except Exception as e:
             error_str = str(e)
-            print(f"Attempt {attempt} error: {error_str}")
             if "resource_already_exists_exception" in error_str:
-                print("Index already exists, returning success")
                 return {"PhysicalResourceId": index_name}
             if "403" in error_str and attempt < 29:
-                print(f"403 error, retrying in 10s (attempt {attempt}/29)")
                 time.sleep(10)
                 continue
-            print(f"Fatal error on attempt {attempt}: {error_str}")
             raise
 
     raise Exception("Timeout waiting for AOSS access policy propagation")

lambdas/oss-index-creator/requirements.txt

@@ -1,3 +1,3 @@
-opensearch-py>=2.4.0
-requests-aws4auth>=1.2.0
-requests>=2.31.0
+opensearch-py>=3.2.0
+requests-aws4auth>=1.3.2
+requests>=2.34.2

lambdas/pdf-extract/app.py

@@ -9,7 +9,6 @@ import json
 import logging
 import os
 import tempfile
-import time
 
 import boto3
 import httpx
@@ -339,27 +338,3 @@ def _api_headers() -> dict:
     if api_key:
         headers["X-Internal-Api-Key"] = api_key
     return headers
-
-
-def _api_request(method: str, url: str, retries: int = 3, **kwargs) -> httpx.Response:
-    kwargs.setdefault("headers", _api_headers())
-    kwargs.setdefault("timeout", 10)
-    for attempt in range(retries):
-        try:
-            resp = httpx.request(method, url, **kwargs)
-            if resp.status_code < 500:
-                return resp
-            logger.warning(
-                "API returned %s on attempt %d for %s",
-                resp.status_code,
-                attempt + 1,
-                url,
-            )
-        except httpx.TransportError as e:
-            logger.warning(
-                "Transport error on attempt %d for %s: %s", attempt + 1, url, e
-            )
-            if attempt == retries - 1:
-                raise
-        time.sleep(min(2**attempt, 4))
-    return resp  # type: ignore[possibly-undefined]

lambdas/pdf-extract/requirements.txt

@@ -1,3 +1,3 @@
 pdfplumber>=0.11.9,<1.0
-boto3>=1.43.9,<2.0
+boto3>=1.43.10,<2.0
 httpx>=0.28.1,<1.0

lambdas/pdf-generate/app.py

@@ -7,7 +7,6 @@ Triggered via SQS when an admin requests PDF generation.
 import json
 import logging
 import os
-import time
 from datetime import datetime
 from io import BytesIO
 
@@ -543,27 +542,3 @@ def _api_headers() -> dict:
     if api_key:
         headers["X-Internal-Api-Key"] = api_key
     return headers
-
-
-def _api_request(method: str, url: str, retries: int = 3, **kwargs) -> httpx.Response:
-    kwargs.setdefault("headers", _api_headers())
-    kwargs.setdefault("timeout", 10)
-    for attempt in range(retries):
-        try:
-            resp = httpx.request(method, url, **kwargs)
-            if resp.status_code < 500:
-                return resp
-            logger.warning(
-                "API returned %s on attempt %d for %s",
-                resp.status_code,
-                attempt + 1,
-                url,
-            )
-        except httpx.TransportError as e:
-            logger.warning(
-                "Transport error on attempt %d for %s: %s", attempt + 1, url, e
-            )
-            if attempt == retries - 1:
-                raise
-        time.sleep(min(2**attempt, 4))
-    return resp  # type: ignore[possibly-undefined]

lambdas/pdf-generate/requirements.txt

@@ -1,3 +1,3 @@
 reportlab>=4.5.1,<5.0
-boto3>=1.43.9,<2.0
+boto3>=1.43.10,<2.0
 httpx>=0.28.1,<1.0

lambdas/suggestions/app.py

@@ -7,7 +7,6 @@ to generate line item suggestions for new proposals.
 import json
 import logging
 import os
-import time
 
 import boto3
 import httpx
@@ -320,27 +319,3 @@ def _api_headers() -> dict:
     if api_key:
         headers["X-Internal-Api-Key"] = api_key
     return headers
-
-
-def _api_request(method: str, url: str, retries: int = 3, **kwargs) -> httpx.Response:
-    kwargs.setdefault("headers", _api_headers())
-    kwargs.setdefault("timeout", 10)
-    for attempt in range(retries):
-        try:
-            resp = httpx.request(method, url, **kwargs)
-            if resp.status_code < 500:
-                return resp
-            logger.warning(
-                "API returned %s on attempt %d for %s",
-                resp.status_code,
-                attempt + 1,
-                url,
-            )
-        except httpx.TransportError as e:
-            logger.warning(
-                "Transport error on attempt %d for %s: %s", attempt + 1, url, e
-            )
-            if attempt == retries - 1:
-                raise
-        time.sleep(min(2**attempt, 4))
-    return resp  # type: ignore[possibly-undefined]

lambdas/suggestions/requirements.txt

@@ -1,2 +1,2 @@
 boto3>=1.35.0,<2.0
-httpx>=0.27.0,<1.0
+httpx>=0.28.1,<1.0

mobile/fastlane/Fastfile

@@ -5,11 +5,12 @@ platform :ios do
   lane :beta do
     setup_ci
 
+    key_content = Base64.decode64(ENV["ASC_KEY_CONTENT"])
     app_store_connect_api_key(
       key_id: ENV["ASC_KEY_ID"],
       issuer_id: ENV["ASC_ISSUER_ID"],
-      key_content: ENV["ASC_KEY_CONTENT"],
-      is_key_content_base64: true
+      key_content: key_content,
+      is_key_content_base64: false
     )
 
     match(type: "appstore", readonly: true)

mobile/package.json

@@ -19,7 +19,7 @@
     "@tanstack/react-query": "^5.100.10",
     "axios": "^1.16.0",
     "react": "^19.0.0",
-    "react-native": "^0.79.0",
+    "react-native": "^0.85.3",
     "react-native-app-auth": "^8.0.0",
     "react-native-document-picker": "^9.3.0",
     "react-native-haptic-feedback": "^2.3.0",
@@ -33,7 +33,9 @@
     "react-redux": "^9.2.0"
   },
   "devDependencies": {
-    "@react-native/babel-preset": "^0.85.3",
+    "@react-native-community/cli": "^20.1.3",
+    "@react-native-community/cli-platform-ios": "^20.1.3",
+    "@react-native/babel-preset": "^0.79.0",
     "@react-native/metro-config": "^0.79.0",
     "@types/react": "^19.0.0",
     "@types/react-native-vector-icons": "^6.4.18",

web/package-lock.json

@@ -13,7 +13,7 @@
         "@mui/icons-material": "^7.3.1",
         "@mui/material": "^7.3.1",
         "@reduxjs/toolkit": "^2.11.2",
-        "@tanstack/react-query": "^5.100.10",
+        "@tanstack/react-query": "^5.100.11",
         "axios": "^1.16.0",
         "react": "^19.1.1",
         "react-dom": "^19.1.1",
@@ -1319,9 +1319,6 @@
         "arm"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1336,9 +1333,6 @@
         "arm"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1353,9 +1347,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1370,9 +1361,6 @@
         "arm64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1387,9 +1375,6 @@
         "loong64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1404,9 +1389,6 @@
         "loong64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1421,9 +1403,6 @@
         "ppc64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1438,9 +1417,6 @@
         "ppc64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1455,9 +1431,6 @@
         "riscv64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1472,9 +1445,6 @@
         "riscv64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1489,9 +1459,6 @@
         "s390x"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1506,9 +1473,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "glibc"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1523,9 +1487,6 @@
         "x64"
       ],
       "dev": true,
-      "libc": [
-        "musl"
-      ],
       "license": "MIT",
       "optional": true,
       "os": [
@@ -1629,9 +1590,9 @@
       "license": "MIT"
     },
     "node_modules/@tanstack/query-core": {
-      "version": "5.100.10",
-      "resolved": "https://registry.npmjs.org/@tanstack/query-core/-/query-core-5.100.10.tgz",
-      "integrity": "sha512-8UR0yJR+GiQ40m3lPhUr0xbfAupe6GSQiksSBSa9SM2NjezFyxXCIA69/lz8cSoNKZLrw1/PktIyQBJcVeMi3w==",
+      "version": "5.100.11",
+      "resolved": "https://registry.npmjs.org/@tanstack/query-core/-/query-core-5.100.11.tgz",
+      "integrity": "sha512-lmE0994apShXPj8CUxgx4ch5yUJhE9k/+tVwihBvPOyerACWdBocfFg24t8+0RhtlTd7tEgchDkhlCxNssvDxw==",
       "license": "MIT",
       "funding": {
         "type": "github",
@@ -1639,12 +1600,12 @@
       }
     },
     "node_modules/@tanstack/react-query": {
-      "version": "5.100.10",
-      "resolved": "https://registry.npmjs.org/@tanstack/react-query/-/react-query-5.100.10.tgz",
-      "integrity": "sha512-FLaZf2RCrA/Zgp4aiu5tG3TyasTRO7aZ99skxQpr3Hg/zXOhu6yq5FZCYQ/tRaJtM9ylnoK8tFK7PolXQadv6Q==",
+      "version": "5.100.11",
+      "resolved": "https://registry.npmjs.org/@tanstack/react-query/-/react-query-5.100.11.tgz",
+      "integrity": "sha512-J0f9s5x3LE1450nNNfYx+e/n0DMa0uOBdFJUy5r0RvmsXd4nB/n0rbHtHI1vYXhikNFan+wf51p6Tmp4c8ucrg==",
       "license": "MIT",
       "dependencies": {
-        "@tanstack/query-core": "5.100.10"
+        "@tanstack/query-core": "5.100.11"
       },
       "funding": {
         "type": "github",
@@ -3100,22 +3061,6 @@
       "integrity": "sha512-a4UGQaWPH59mOXUYnAG2ewncQS4i4F43Tv3JoAM+s2VDAmS9NsK8GpDMLrCHPksFT7h3K6TOoUNn2pb7RoXx4g==",
       "dev": true,
       "license": "ISC"
-    },
-    "node_modules/yaml": {
-      "version": "2.9.0",
-      "resolved": "https://registry.npmjs.org/yaml/-/yaml-2.9.0.tgz",
-      "integrity": "sha512-2AvhNX3mb8zd6Zy7INTtSpl1F15HW6Wnqj0srWlkKLcpYl/gMIMJiyuGq2KeI2YFxUPjdlB+3Lc10seMLtL4cA==",
-      "extraneous": true,
-      "license": "ISC",
-      "bin": {
-        "yaml": "bin.mjs"
-      },
-      "engines": {
-        "node": ">= 14.6"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/eemeli"
-      }
     }
   }
 }

web/package.json

@@ -14,7 +14,7 @@
     "@mui/icons-material": "^7.3.1",
     "@mui/material": "^7.3.1",
     "@reduxjs/toolkit": "^2.11.2",
-    "@tanstack/react-query": "^5.100.10",
+    "@tanstack/react-query": "^5.100.11",
     "axios": "^1.16.0",
     "react": "^19.1.1",
     "react-dom": "^19.1.1",