Story-3372 · callsign LAMBDA · deployment provenance
The code that passed CI must be the code AWS receives
A green test run and a successful deploy used to be two separate facts. A deploy workflow could check out a newer commit, or skip after its upstream failed, while the dashboard still looked harmless. The same-SHA gate turns them into one chain.
verified_sha.Green path
Migration receipt is green where required → exact-SHA push CI is green → the reusable
workflow emits verified_sha → checkout, package, publish, alias promotion and
the workflow summary all carry that SHA.
Fail-closed path
A missing, malformed, cancelled, failed or 20-minute-pending receipt emits no SHA. Because
every downstream job lists verify as a direct dependency, zero AWS credential
or mutation step can start.
Why the API loop changed
| Design | 20-minute calls | 27-workflow wave |
|---|---|---|
| Old: poll every 30 seconds | 41 per receipt | 40 receipts × 41 = 1,640 REST calls |
| New: poll every 120 seconds | 11 per receipt | 40 receipts × 11 = 440 REST calls |
| Final fleet | 27 CI + 13 polled migration receipts | 14 automatic callers carry a trusted migration receipt instead of polling it |
Founder-authorized proof sequence
| Phase | Workflows | Exit evidence |
|---|---|---|
| Proof | App, Admin, Agent Rail, Context Backfill, Agent Results Consumer | Fresh-main automatic/matrix, path-push and manual runs; planted red receipt reaches zero AWS steps. |
| Fleet | Remaining 22 deploy workflows | 27/27 inventory test, final live class proofs, and this walkthrough updated with run links. |
This ordering is an explicit founder exception for proof, not a compatibility window: each workflow has exactly one deploy path, no Lambda code or runtime configuration is duplicated, and callsign LAMBDA owns Phase 2 immediately after the proof exits green.
Live proof log
| Proof | Run | Result |
|---|---|---|
| Planted missing receipt | 30792187200 | The gate exhausted its bounded receipt lookup, named both missing receipts, emitted no SHA, and every test, credential and deploy step stayed skipped. |
| Automatic · App API | 30792209150 | Fresh-main migration receipt, same-SHA CI, package and staging deploy completed on 61ad6e09. |
| Automatic · Admin API | 30792209159 | Fresh-main automatic path completed on the same verified SHA. |
| Manual · Agent Results Consumer | 30792171907 | Manual dispatch resolved and deployed one exact SHA through the reusable gate. |
| Path push · Context Backfill | 30797532572 | The preserved path filter fired, the corrected live canary returned body.requeued, and tested/deployed SHA both equal 2ec12aba…. |
| Matrix · ancestry failure | 30792209173 | The gate selected the exact SHA, then the whole-suite migration-head proofs refused a shallow checkout with no readable origin/main. All deploy jobs stayed skipped. |
| Matrix · Agent Rail | 30797680218 | The full-history test gate passed, then all three matrix Lambdas recorded tested/deployed SHA 3006da1c…. The advisory rail canary did not control the deploy verdict. |
Fleet inventory · 27 of 27
| Class | Workflow | Gate |
|---|---|---|
| Automatic | deploy-admin-api.yml | Reusable same-SHA gate |
| Automatic | deploy-agent-rail.yml | Reusable same-SHA gate |
| Automatic | deploy-app-api.yml | Reusable same-SHA gate |
| Automatic | deploy-billing-renewal.yml | Reusable same-SHA gate |
| Automatic | deploy-deep-read-worker.yml | Reusable same-SHA gate |
| Automatic | deploy-document-extraction-worker.yml | Reusable same-SHA gate |
| Automatic | deploy-document-ingest-relay.yml | Reusable same-SHA gate |
| Automatic | deploy-document-malware-consumer.yml | Reusable same-SHA gate |
| Automatic | deploy-document-registration-consumer.yml | Reusable same-SHA gate |
| Automatic | deploy-document-registration-relay.yml | Reusable same-SHA gate |
| Automatic | deploy-download-open.yml | Reusable same-SHA gate |
| Automatic | deploy-ingest-api.yml | Reusable same-SHA gate |
| Automatic | deploy-whatsapp-consumer.yml | Reusable same-SHA gate |
| Automatic | deploy-whatsapp-webhook.yml | Reusable same-SHA gate |
| Path push | deploy-context-backfill-worker.yml | Reusable same-SHA gate |
| Path push | deploy-context-embed-worker.yml | Reusable same-SHA gate |
| Path push | deploy-layer.yml | Reusable same-SHA gate |
| Path push | deploy-storage-allocation-worker.yml | Reusable same-SHA gate |
| Manual | deploy-agent-results-consumer.yml | Reusable same-SHA gate |
| Manual | deploy-agent-run-sweeper.yml | Reusable same-SHA gate |
| Manual | deploy-channel-alert-digest.yml | Reusable same-SHA gate |
| Manual | deploy-domain-event-relay.yml | Reusable same-SHA gate |
| Manual | deploy-framer-trigger.yml | Reusable same-SHA gate |
| Manual | deploy-indian-kanoon-egress.yml | Reusable same-SHA gate |
| Manual | deploy-razorpay-egress.yml | Reusable same-SHA gate |
| Manual | deploy-seat-health-canary.yml | Reusable same-SHA gate |
| Manual | deploy-whatsapp-sender.yml | Reusable same-SHA gate |