Story-3406 · pre-cutover deployment definition

Publish one candidate, connect no product source

This workflow prepares the existing pramaan-workers shell for proof. It is manual-only: a merge, migration or ordinary push cannot run it. The reusable same-SHA gate first proves that the selected revision passed CI and its migration receipt.

1 · ProveResolve the existing Terraform shell and the exact CI-tested SHA.

2 · FreezeMeasure the package and environment, publish one numeric Lambda version.

3 · InspectMove the isolated drill alias, then prove the candidate has no product trigger.

What the workflow may change

Owned here	Not owned here
Code bytes on the existing shell	IAM roles or policies
Three deployment-identity environment markers	Queues, mappings, rules or targets
One immutable numeric version	Lambda shell creation or deletion
The existing `drill` alias pointer	The product `live` alias or any product-source cutover

The proof is against live configuration

Before publication, the job verifies the 900-second, 1,536 MB Python 3.12 shell and its measured immutable layers. It rejects a Zip at 50 MB, assembled code plus layers at 250 MB, or the exact environment payload at 4,096 bytes. After publication, the alias must resolve to a numeric version whose CodeSha256, deployment marker and description all name the reviewed source SHA.

Dormancy is read back from AWS. The job requires zero enabled or product event-source mappings, zero candidate EventBridge targets, zero Scheduler targets, no broad Lambda resource policy and no function URL. It permits only Story-3407's exact disabled drill mapping and its one source-ARN-fenced EventBridge permission; neither is a product trigger. Every other non-empty inventory turns the workflow red.

Eight canaries require a second explicit decision

Candidate publication does not silently spend model calls. The eight conditioned-permission canaries run only when run_operation_canaries is explicitly selected. That job requires the exact closed eight-operation contract in the reviewed shared-worker code, validates one JSON input containing exactly the clerk, context-embed and Vega-framer synthetic fixture fields, invokes only pramaan-workers:drill, and records each operation's returned receipt. A missing route, fixture field, function error or AccessDenied fails the proof.

This PR defines the deployment boundary only. It does not run the workflow, publish a candidate, move either alias or touch AWS. The first product queue cutover remains a separate founder gate after the isolated forward-and-rollback drill reports measured timing.

Repository evidence

Check	Failure it prevents
`test_shared_worker_candidate_deploy_workflow.py`	Automatic deployment, forbidden infrastructure mutation, mutable-version targeting, missing limit/identity/trigger proof and vacuous canaries.
`test_same_sha_deploy_fleet.py`	The new 28th deploy workflow escaping the fleet-wide same-SHA inventory.
`test_shared_worker_package_limits.py`	The reviewed source package or immutable layer set exceeding Lambda limits.