[jmgasper]

The Challenge API dev retry successfully assumed its OIDC deployment role, then stopped before image publication because the circuit-breaker preflight compared the entire ECS object with {enable: true, rollback: true}. The pinned AWS CLI also returns the documented optional resetOnHealthyTask and thresholdConfiguration fields, causing a false rejection even though rollback is enabled.

Require both safety flags to be literal true, while accepting and preserving optional service settings. Missing, false, numeric, string, or malformed flags still fail before publication or task registration. The deployment does not modify circuit-breaker configuration or require new IAM permissions.

Validation:

• All 75 tests pass in the pinned CircleCI executor with networking disabled, including the actual response shape, invalid flag combinations, and preservation of service settings.
• Read-only preflight through the same AWS CLI passes against the existing dev service and task; runtime roles and secret references are preserved, and ECR remains immutable.
• CloudTrail confirms successful OIDC role assumption and service inspection. No candidate image was pushed and ECS remains on its previous revision.
• Shell syntax and diff checks pass.

After merging, release v2.0.3 and update the Challenge API tag/commit pin through a develop PR before retrying deployment.

AWS response schema: https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_DeploymentCircuitBreaker.html