Phase 4 — Run 6: runtime-platform-drift Workflow (G-E)

Overview

Branch / PR: jmpicnic/email-integration-phase-4 (infra) → PR phase-4-G-E against Arda-cards/infrastructure main. Group: G-E (drift workflow). Tasks: T-I11 (workflow YAML), T-I12 (driver script), T-I13 (shared utility extraction), T-D1 (verification entries), T-D8 (infra CHANGELOG), T-O8 (first scheduled drift run). Working directory: /Users/jmp/code/arda/projects/email-integration-worktrees/phase-4/infrastructure. AWS impact: None at the workflow/driver level (probes are read-only). Personas: devops-engineer for T-I*; user as operator for T-O8.

The workflow runs in parallel with the existing corporate-drift (per DQ-R1-018: corporate-drift is not renamed). Shared probe helpers are extracted to tools/lib/drift/ so both workflows source the same logic.

Entry criteria

Run-1 PR merged (provides the tools/lib/ location and the helper-extraction precedent).
Run-2 PR merged and dev partition live (drift probes need at least one partition’s state to assert against).
Recommended: run-3 / run-4 / run-5 may also be live, but not required — drift gracefully handles partitions that don’t yet exist.

Tasks

Task	Description	Files touched	Persona
T-I11	New `.github/workflows/runtime-platform-drift.yml` (daily cron, labels `drift` + `runtime-platform`)	`infrastructure/.github/workflows/runtime-platform-drift.yml`	`devops-engineer`
T-I12	Driver script enumerating `instances/Alpha001/{prod,demo}.ts` + `instances/Alpha002/{dev,stage}.ts` and probing Postmark + DNS + AWS-SM + IAM	`infrastructure/tools/runtime-platform-drift.ts` + test	`devops-engineer`
T-I13	Extract shared drift utilities into `tools/lib/drift/`	`infrastructure/tools/lib/drift/*.ts` + `corporate-drift.ts` imports updated	`devops-engineer`
T-D1	Verification entries V-CI-001, V-CI-002, V-CI-003	`documentation` worktree → `4-runtime-platform-updates/design/verification.md`	`devops-engineer`
T-D8	Infra `CHANGELOG.md` entry	`CHANGELOG.md`	`devops-engineer`
T-O8	Operator triggers `runtime-platform-drift.yml` via `gh workflow run`; confirms no spurious issue opened	none (operator-driven)	user

Worktree strategy

Single working directory. The extraction in T-I13 must keep corporate-drift.yml working unchanged — regression-test by manually triggering corporate-drift.yml after the extraction lands.

Validation

validate-exit.sh covers the workflow YAML lint, driver script tests, helper unit tests, and (post-merge) confirms the first runtime-platform-drift scheduled / manual run completes without opening a spurious GitHub issue.

Exit criteria

npm run build && npm run lint && npm test exit 0.
runtime-platform-drift.yml lints without errors; gh workflow run runtime-platform-drift.yml --ref jmpicnic/email-integration-phase-4 runs to completion.
Synthetic-drift fixture run produces a labelled GitHub issue (label drift + runtime-platform).
corporate-drift.yml manual run against the live Corporate Signature produces an unchanged report shape (regression-tested).
PR opened; checks green; reviewer approval.
Post-merge: T-O8 — operator triggers the new workflow via workflow_dispatch. Run completes; no spurious issue opened. Logs inspected; per-partition probe shapes match expected. Sign-off row populated.

References

../../../../decision-log.md — DQ-R1-018 (corporate-drift not renamed; parallel workflow with shared logic).
../../../design/specification.md — T-I11, T-I12, T-I13, T-O8.
../../../design/verification.md — V-CI-001, V-CI-002, V-CI-003.