[jmgasper]

Move the ECS deployment migration onto current develop and pin tc-deploy-scripts v2.0.5, fetched by tag and verified against bff574ab5c0b46773e25d2af1eff76675fba2ba5. Build jobs remain separate from the deployment context; production remains approval-gated on its existing production branch. Current dev application/dependency fixes are preserved. Source checkout uses the public HTTPS repository and verifies the exact CircleCI commit, avoiding dependency on failing SSH checkout keys. No GitHub token is added to build or deployment contexts.

Per-service OIDC replaces the Auth0/SSM broker path. The deployment role, matching boundary and STS session explicitly deny Parameter Store, Secrets Manager, KMS decryption and role chaining. Runtime roles and secret references remain owned by ECS infrastructure. Matching private IAM policies include the region-restricted Inspector list permissions required for enhanced scanning; those scan-metadata APIs require Resource *.

Draft: dev resource identities are verified; infrastructure prerequisites remain before merge. deploy/dev.json and matching private IAM templates were prepared from live AWS inventory. No resources or service capacity were changed. Remaining prerequisites:

• Install the service deployment role and matching permissions boundary.
• Create the restricted empty CircleCI deployment context.
• Review and install the dev container health-check proposal; preserve all other task configuration.
• Verify one-shot migration secret/execution-role grants and migration-before-runtime promotion in dev.

IAM templates, baselines and provisioning status remain in the private service directory. No infrastructure files have been reintroduced into the application PR history.

Validation: CircleCI CLI configuration validation; manifest/policy/trust consistency where project identity is available; shell syntax and git diff checks; service-specific Python deployment regressions in the pinned executor. Shared suite v2.0.5 has 82 passing tests. PR checks will report application builds separately. Live OIDC, functional smoke, rollback and wrong-project/ref tests remain rollout acceptance gates.

The custom Forms adapter preserves migration-before-promotion and reviewed first activation. It now supports optional circuit-breaker fields and untagged task registration, and invokes the Prisma CLI directly in the hardened migration image.