From e791005af019515a30a7acd57100353467893ca0 Mon Sep 17 00:00:00 2001 From: Adam Moussa Date: Thu, 30 Jul 2026 19:09:27 -0400 Subject: [PATCH] docs(iam): cite INFRA-187 as the per-workload boundary end state Replaces the placeholder 'tracked as its own ticket' references with the real key, and records the load-bearing constraint inline so the next reader does not rediscover it: both guardrail policies pin ONE literal boundary ARN inside StringEquals iam:PermissionsBoundary, and loosening that to a wildcard weakens the gate rather than merely relaxing it. --- lib/deploy-substrate/deploy-substrate.template.yaml | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/lib/deploy-substrate/deploy-substrate.template.yaml b/lib/deploy-substrate/deploy-substrate.template.yaml index 9a91de2..a7a756b 100644 --- a/lib/deploy-substrate/deploy-substrate.template.yaml +++ b/lib/deploy-substrate/deploy-substrate.template.yaml @@ -132,7 +132,7 @@ Description: >- # the boundary itself) removed that pressure entirely. If the budget tightens # again as workloads land, the end-state fix is per-workload boundaries # (seahaven-lambda-execution-boundary-), which also resolves the -# shared-ceiling residual — tracked as its own ticket, do not improvise it. +# shared-ceiling residual — tracked as INFRA-187, do not improvise it. # CRITICAL: unlike the 2026-07-27 inline-limit incident, # there is NO restructure available when this cap is reached — a role has exactly # ONE permissions boundary, so statements cannot be spilled into a second attached @@ -498,7 +498,10 @@ Resources: # # The end-state fix for the shared-ceiling residual (one boundary = # every SAM workload reaches every other's data plane once they land) - # is per-workload boundaries — tracked separately, see the header. + # is per-workload boundaries — tracked as INFRA-187. Do not improvise + # it: the load-bearing problem there is that both guardrail policies + # pin ONE literal boundary ARN inside StringEquals conditions, and + # loosening that to a wildcard weakens the gate. # --------------------------------------------------------------------------- # Shared CloudFormation execution role (SAM stacks) — INFRA-97 scoped #