[jaydreyer]

Closes #44

Summary

• implement ADR-0022 as two focused Terraform roots: secure state bootstrap and one demo environment with no premature modules
• provision the approved VPC, isolated RDS PostgreSQL 17, immutable ECR, two-container ECS Fargate service, separate migration task, Cognito/ACM/Route 53 ingress, Secrets Manager containers, observability, budget, and GitHub OIDC roles
• default to the cost-safe off state and require explicit confirmation that ADR-0022 application prerequisites are complete before any environment plan
• document exact initial provisioning, DNS delegation, GitHub Environment, secret handoff, safe off-state, destructive teardown, and Codex delegation steps
• add Terraform CI plus native tests for off/demo state, destructive guards, signer identity, and credential separation

Acceptance evidence

• networking spans two AZs; database subnets have no internet route
• FastAPI has no ingress; RDS accepts 5432 only from the task security group and is not public
• application and migration execution roles can read only their named images, logs, and secrets; task roles have no AWS API policy
• deploy OIDC can run only the migration task family and update only the named service; lifecycle DNS permission is restricted to the named A alias
• RDS is encrypted, Single-AZ db.t4g.micro, 20 GiB gp3 with 50 GiB cap, seven-day backups, TLS required, log-exported, deletion-protected, and final-snapshot guarded
• normal off state has ECS desired count zero and no ALB or application alias; declared demo state has exactly one task
• monthly budget remains USD 20 and no NAT Gateway, Kubernetes, queue, or extra runtime boundary is introduced

Verification

• terraform fmt -check -recursive infra/terraform
• terraform validate for bootstrap and demo roots
• terraform test: 5 passed
• frontend typecheck, lint, 53 tests, and production build
• backend Ruff lint and format checks
• backend pytest: 285 passed
• isolated Alembic empty-upgrade, seed, downgrade-one, re-upgrade, and current-head check
• fresh independent review completed; all five findings fixed; re-review approved with no remaining findings

Safety

No AWS resources were created or changed. ADR-0022 prohibits apply until its application authentication, trusted-header, database-configuration, logging, health, and sizing prerequisites are implemented and tested. The required Terraform confirmation defaults to false.

Four pre-existing files were mechanically reformatted with the repository-pinned Ruff version because the current default-branch formatting gate otherwise fails; behavior and tests are unchanged.

[jaydreyer]

CI verification completed successfully for head f5fa351 via the Quality workflow manual trigger because GitHub did not create a pull_request check suite after open, reopen, or synchronize events. All three jobs passed: terraform, migration, and quality.

Run: https://github.com/jaydreyer/ChangeOps/actions/runs/31129361250