PR #157 · Foundation Hardening
feat(infra): import gate, host drift reconcile, operator stack + tests
What
Two-phase foundation fix: import-only CDK for two orphan resources (TurnJournalTable, GoogleIdp), then a normal-mode pass for production hardening (PITR, TTL, deletion protection, IAM, SES, lifecycle).
Why now
Foundation stack drifted from deployed template. Need to adopt orphans without touching live data.
What changed
Think2earnFoundationImportStack with snapshot parity; Think2earnFoundationStack for full hardening; import-foundation-orphans.sh parity gate; deletion protection only on turn-journal table; import + normal mode tests (1175 passing).
Risk / trade-off
Import must precede normal deploy. Wrong mapping could adopt the wrong resource. Script gates cdk import until diff contains only the two expected orphans.
Money & ops
TTL reduces storage costs; PITR protects against operator error; SES + lifecycle cap runaway storage spend; deletion protection keeps the journal table safe.
CEO decision
Approve. Branch is green. Next: run live cdk diff parity, import orphans, then merge and deploy normal-mode hardening.