docs(deploy): record unresolved EB ACL gate

infra/cdk/README.md

@@ -117,20 +117,6 @@ The role grants only:
   Elastic Beanstalk emitted this read during the same attempt while validating
   the uploaded application bundle. It grants no bucket-wide or cross-prefix
   object access.
-- `s3:GetObjectAcl` on only the live environment's AWS-owned launch-control
-  object:
-  `elasticbeanstalk-us-east-1/environments/28bfd388-952c-4121-8897-42d39fb48b69/launch_control`.
-  The sanitized live environment template references that exact object. An
-  audited account-bucket data-event trail captured source-bundle ACL reads but
-  did not capture the remaining denied ACL read, and a controlled deployment
-  still failed after granting the separate platform-assets prefix. Together,
-  those observations identify this cross-account launch-control object as the
-  remaining ACL target. The grant exposes ACL metadata for one object only: it
-  grants no object content read or write, no adjacent environment object, no
-  platform asset, and no account-owned runtime object access. If the EB
-  environment is replaced, this identifier must be re-derived from the new
-  sanitized environment stack before updating the policy.
-
 It grants **no** IAM mutation or `PassRole`, **no** RDS / Secrets Manager
 access, no EC2 mutation, and **no** administrator policy. The only non-EB/S3
 mutations are the three deployment-process Auto Scaling calls, restricted to
@@ -174,6 +160,20 @@ All commands run from `infra/cdk/`.
 The workflow's `AWS_DEPLOY_ROLE_ARN` repository secret (environment `dev`) must
 hold the ARN output by this stack (`GithubDeployRoleArn`).
 
+The OIDC deployment is currently fail-closed, not repaired. Elastic Beanstalk
+still reports a generic `s3:GetObjectAcl` denial after the account-owned source
+prefix and every exact cross-account object referenced by the sanitized live
+stack were tested independently. The runtime-prefix, platform-assets, and
+launch-control hypotheses were disproved and are intentionally absent from the
+policy. Do not broaden `GetObjectAcl` without an exact principal/action/resource
+record from AWS Support or the AWS-owned bucket's diagnostic owner.
+
+The pinned deployment action can return success after Elastic Beanstalk emits a
+fatal deployment event. The following workflow step therefore verifies that
+the exact immutable version label is active and healthy before smoke testing.
+Any mismatch fails and invokes rollback. This guard prevents false success; it
+does not make the unresolved OIDC deployment path release-ready.
+
 The GitHub `dev` environment is an external release control and must restrict
 deployments to the `dev` branch. Required reviewers should be configured when
 the repository plan supports environment reviewers. The workflow also checks

infra/cdk/deploy-dev-stack.ts

@@ -10,8 +10,6 @@ const ENVIRONMENT_ID = 'e-hehnrqjjrt';
 const ENVIRONMENT_STACK_NAME = `awseb-${ENVIRONMENT_ID}-stack`;
 const REPO = 'Sea-Haven-Industries/shoc-backend';
 const BUCKET_NAME = `elasticbeanstalk-${REGION}-${ACCOUNT_ID}`;
-const ENVIRONMENT_LAUNCH_CONTROL_KEY =
-  'environments/28bfd388-952c-4121-8897-42d39fb48b69/launch_control';
 
 export class DeployDevStack extends cdk.Stack {
   constructor(scope: Construct, id: string, props: cdk.StackProps = {}) {
@@ -149,16 +147,6 @@ export class DeployDevStack extends cdk.Stack {
       }),
     );
 
-    deployRole.addToPolicy(
-      new iam.PolicyStatement({
-        effect: iam.Effect.ALLOW,
-        actions: ['s3:GetObjectAcl'],
-        resources: [
-          `arn:aws:s3:::elasticbeanstalk-${REGION}/${ENVIRONMENT_LAUNCH_CONTROL_KEY}`,
-        ],
-      }),
-    );
-
     new cdk.CfnOutput(this, 'GithubDeployRoleArn', {
       value: deployRole.roleArn,
       description: 'ARN of the GitHub OIDC deploy role for shoc-backend dev.',