Description
A fresh loop4 read of an adopted deployment bucket returned NoSuchBucketPolicy. Enabled versioning, default encryption, public access blocks and the separately granted additive raw-view lifecycle rule do not establish a TLS-deny policy. The loop parked deployment before new raw-label publication because its grant covered one lifecycle write, not a bucket-policy write. No deployment identifiers belong in this task; the exact environment and readback are retained only in the private operations/evidence record. Resume after explicit owner authorization for the policy change, or after an owner-installed policy is independently read back. Do not infer broader adopted-resource write authority.
Acceptance Criteria
- #1 Explicit owner authority for the policy write is recorded separately from lifecycle or rollout grants
- #2 Fresh effective bucket policy denies non-TLS access on the bucket and object resources, with unrelated policy statements preserved
- #3 Versioning, encryption, public-access controls and views-only reader access remain correct and are independently witnessed before raw-label publication
- #4 The blocked rollout resumes only from its recorded image/module/manifest and task state, with no duplicate live task or credential mint
Definition of Done
- #1 just test
- #2 just tf-validate
- #3 just check-identifiers and just no-em-dashes both return clean
Implementation Notes
loop5 preparation (2026-10-01): Rob authorised the TLS-only policy from the main thread, separately from any lifecycle or rollout grant, and asked that it be managed by Terraform (AC1). The private deployment root now manages a bucket-policy-only resource carrying the single DenyInsecureTransport statement; the bucket itself is still adopted, not imported. Applied from a reviewed saved plan (1 to add), followed by a no-change plan. Fresh readback: the effective policy denies s3:* on the bucket and object resources when aws:SecureTransport is false; a plain-HTTP list that succeeded before the change is now AccessDenied by explicit deny, and HTTPS still succeeds. No other statement existed to preserve (AC2). Versioning, default encryption, public-access block and lifecycle were byte-identical before and after. AC3’s views-only reader and task IAM witness and AC4’s rollout resume remain for the loop5 root, immediately before raw-label publication.
Final Summary
loop5 completed stable0.4.1 customer rollout from recordedv0.3.0manifest/module/image baseline. Fresh pre/pre-refresh/post privacy witnesses verified unchanged TLS policy/lifecycle/versioning/encryption/public blocks and resource-specific task/views-only IAM decisions. Saved rollout plan explicitly left TLS policy no-op; final targeted plan No changes. Exactly one manual provisioner, T2 and T1 ARN; all STOPPED exit0, descriptors captured promptly, T2/T1 scan objects advanced with healthy100%coverage. All310live reader service-account/token IDs, role UIDs, SSM versions, basic roleNone, complete permission pairs and datasource query pins unchanged pre/post. Eleven dashboards published/read back; eight existing alerts preserved pause/routing, no activation/new rules. StableGHCRsignedverified sourceef2033b; deployedECRconsumer is distinct/unsigned. Existing gate/doD proofexactstableCI36833177921 andcleanreleasecandidatejustcheck. Implementation0 for this witness/rollout task, review-repair0; scratch witness representation errors corrected against actual schemas, not live repairs.