Q19 is closed — SES production access granted in ca-central-1, confirmed in
writing. Nothing now blocks /contact/.
The structural change is the important one. Specs in docs/ carried their own
copies of resource IDs, regions, DNS records and service state. AGENTS.md §7
is now the single source of truth for operational facts and docs/ cite it
rather than restating it, with the rule recorded in CLAUDE.md under
Conventions.
The reason is the previous commit's DKIM inversion, generalised: the same
fact lived in §7 and docs/05, a correction reached one of them, and the stale
copy told an operator to delete the records that authenticate outbound mail.
A duplicated fact is one that will eventually be wrong in one place, and the
copy that goes stale is the one nobody re-reads. Verified by grep over
docs/*.md — no operational identifier remains.
Also in this change:
- §7 records the SES monitoring: SNS topic ses-alerts, alarms
SES-BounceRate-High (>= 0.03) and SES-ComplaintRate-High (>= 0.001), and
the deliberate choice of email feedback forwarding over an SNS feedback
topic at this volume. The ses-alerts email subscription is stamped PENDING
CONFIRMATION — the alarms currently notify nobody, now tracked as R9 and on
the cutover checklist.
- docs/05 records why those alarms are a real control: SES suspends above
roughly a 5% bounce rate, and under 100 messages a month five bounces
crosses it.
- Q29: the deploy guard now covers AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY
(emptiness only, never echoed) and INTAKE_ENDPOINT, promoted to job-level
env. An empty intake endpoint ships a live form posting to nothing, which
is worse than a failed build. Executed under sh -e across four input
states; fails closed, leaks nothing.
- docs/06: account ID removed from the backup-bucket callout, pointing at §10
instead, as README already does.
- astro.config.mjs: prefetch removed entirely. Any setting ships Astro's
prefetch script to every page against the zero-JS convention. Recorded as a
decision; revisit against real Lighthouse numbers.
AGENTS.md entry (r) records the full reasoning.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012XquaEq4BgWMCwUqLEyNkF
