Add check-ssm-path validator for the /<org>/<repo>/<tier>/<tail> SSM convention #95

New issue

Closed

opened 2026-05-29 00:54:42 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-05-29 00:54:42 +00:00

Owner

Context

SSM parameter paths across the fleet are moving to a structured schema:

/<org>/<repo>/<tier>/<tail>

org - controlled vocabulary, currently the literal coilysiren
repo - lowercase repo slug [a-z0-9-]+
tier - access tier admin | write | read (the IAM/KMS gate)
tail - freeform leaf [a-z0-9-]+, single segment

The tier segment is load-bearing: IAM gates on parameter/*/*/<tier>/* and the per-tier KMS keys wrap by the same position, so a malformed path silently falls outside every policy instead of failing loudly. A validator catches that at authoring time.

This issue

Add agentic_os.check_ssm_path (console script check-ssm-path) that validates a path against the schema and collects all violations, register it in pyproject.toml, and cover it with pytest. Also add pytest as a dev dependency group so uv run pytest is hermetic on every host.

Follow-up (tracked separately)

Wire check-ssm-path as a blocking pre-commit hook against an auto-scan source (terraform aws_ssm_parameter names or a migrated-paths manifest).
Migrate existing params onto the schema (assign each an owning repo plus tier), then a three-tier IAM/KMS policy keyed on the tier segment.

## Context SSM parameter paths across the fleet are moving to a structured schema: /<org>/<repo>/<tier>/<tail> - `org` - controlled vocabulary, currently the literal `coilysiren` - `repo` - lowercase repo slug `[a-z0-9-]+` - `tier` - access tier `admin | write | read` (the IAM/KMS gate) - `tail` - freeform leaf `[a-z0-9-]+`, single segment The tier segment is load-bearing: IAM gates on `parameter/*/*/<tier>/*` and the per-tier KMS keys wrap by the same position, so a malformed path silently falls outside every policy instead of failing loudly. A validator catches that at authoring time. ## This issue Add `agentic_os.check_ssm_path` (console script `check-ssm-path`) that validates a path against the schema and collects all violations, register it in `pyproject.toml`, and cover it with pytest. Also add pytest as a `dev` dependency group so `uv run pytest` is hermetic on every host. ## Follow-up (tracked separately) - Wire `check-ssm-path` as a blocking pre-commit hook against an auto-scan source (terraform `aws_ssm_parameter` names or a migrated-paths manifest). - Migrate existing params onto the schema (assign each an owning repo plus tier), then a three-tier IAM/KMS policy keyed on the tier segment.

coilysiren referenced this issue from a commit

2026-05-29 18:44:22 +00:00

feat: add check-ssm-path validator for the SSM path-tier convention

coilysiren closed this issue

2026-05-29 18:44:22 +00:00

coilysiren referenced this issue

2026-06-06 01:06:21 +00:00

check-ssm-zone validator: path conformance + key-zone drift (supersedes #95) #179