[jmgasper]

The v1 deployment path exchanges a reusable Auth0 client secret for AWS credentials, disables TLS verification, sources decrypted SSM values and can continue after configuration failures. This replaces that release path with CircleCI OIDC v3 → AWS STS, reviewed non-secret manifests and explicit denial of deployment-time parameter/secret access.

The production audit confirmed the legacy oidc-circleci-deploy role has broad SSM read/list grants and inline parameter/KMS grants. The Auth0 client ID identifies an allowed client; these AWS IAM policies supply its permissions. The exact broker HTTP endpoint remains the unavailable runtime value of CI_AUTH0_URL; the verified Auth0 issuer is not proof of that URL. See docs/AUTHENTICATION.md.

Breaking v2 migration: do not replace a v1 tag in an old pipeline. Legacy credential-export, SSM/build-file and unrelated infrastructure/secret-provisioning entry points fail closed. Keep v1 tags immutable and release a new major version only after dev acceptance.

• Bind OIDC trust to exact organization/project, checkout repository/ref and configuration repository/ref; verify the returned STS account and role. IAM policy, matching boundary and requested session deny SSM, Secrets Manager, KMS decryption and role chaining.
• Build committed source separately without deployment credentials; reject credential-file inputs, secret-like image/task environment and DB-reset controls. Preserve exact runtime roles, secret references, sidecars and task resources.
• Publish immutable image tags, verify source/configuration digests and scan results, and require healthy actual task revisions/digests with concurrency and rollback checks.
• Support exact legacy dev/prod branch names and absent application task roles without broadening trust. Reviewed service adapters can request a fixed set of migration/health/Inspector/existing-stack capabilities; their role/boundary must independently scope them. No secret-read capability is added.

The consumer PR index lists 46 open draft PRs covering 48 of 58 inventoried production ECS services, including inactive-service deployment containment. All 41 OIDC consumers pin reviewed code commit bbc9b3d0c702947d26b6d9686d7b29104ebe461a; later commits in this PR document the rollout. Ten services had no mapped shared-script release path in accessible configuration. Inventory in sixteen other enabled regions was denied, so those regions are not claimed empty.

Validation: 61 offline regression tests pass locally and inside the digest-pinned executor; shell/diff checks pass. All consumer CircleCI configs validate. IAM Access Analyzer and CloudFormation read-only validation pass for the reviewed permission policies/templates. The index records service-specific tests and image builds, including Forms migrations, AV CloudFormation/ClamAV, Status/Payload adapters, Kafka readiness, nginx and freeCodeCamp. Mocked tests and metadata validation do not prove a real deployment.

No live AWS/IAM/CircleCI configuration, ECR image or service was changed, and no PR was merged. Exact dev manifests await a refreshed dev inventory; six private CircleCI project UUIDs remain required. Install scoped IAM/provider/contexts, runtime bindings, ECR/health prerequisites and complete a real dev rollout/rollback before merging consumer drafts. ECS's execution role retains narrowly scoped runtime secret retrieval; CI must not fetch those values. Custom release and frontend/Lambda separation prerequisites are called out in each PR and the index.