Verify paging and archive on prod

Epic 5329 ask (verbatim): "Analyze current code, processes and documentation and close the gap to being SOC 2 compliant. Humans can participate but only where it cannot be avoided legally. Ask questions, but do not offload any work that you are technically able to do." Sources: PRD (Task 5330) and architecture (Task 5331) of epic 5329 — read them with `task_read` / `task_read_artifact`. Binding decisions (verbatim): "D8 Paging destination: Slack + email. No phone and no paging vendor." AS1: "agents may run prod terraform, scripts and tests, but only code that has reached `master` through Roman's promotion, plus read-only and test actions that need no code change (a restore into an isolated target, a page test, an export)." AS4: "If an email subscription needs a confirmation click that agents cannot reach, that click goes on the human-steps list." Prod access: `jaah/system/bootstrap-admin` → `OrganizationAccountAccessRole` in 366008913850, explicit `--region`, env vars per command only; `gmind/skynet/main` for the CP cron run-now; confirm with `task_credential_list` first (missing = BLOCKER ask). Evidence filing: `tools/evidence_store.py` CLI with `EVIDENCE_BUCKET=jaah-main-evidence-366008913850`; Object Lock — permanent; dry-run first; no smoke objects. Any new risk: name its row text in your settle summary for the close-out child. ## Requirement (verbatim from PRD) "### R3 — Paging and alerting reach a human (CC7.2, A1.1; OA-9, G-15) - **AC3.1** Both `jaah-main-paging` and `jaah-main-cp-alarms` have a confirmed Slack subscription and a confirmed email subscription (D8). *Verify:* `aws sns list-subscriptions-by-topic` on each shows two non-pending subscriptions. - **AC3.2** A page test has been run: `aws cloudwatch set-alarm-state` on one prod alarm, then a reset. The Slack message and the email were both observed, and the record was filed to `alarms/`. *Verify:* the `alarms/<date>/` object exists, and the Slack message is visible in the channel." "### R4 ... **AC4.1** The `security-event-export` cron succeeds on prod. The archive holds a `security-events/YYYY/MM/DD/…jsonl.gz` object for each day after the fix. *Verify:* `aws s3 ls s3://jaah-main-security-archive-366008913850/security-events/ --recursive` shows the last two consecutive days, and the `CronLastSuccessAgeSeconds` metric is below 90,000." Architecture deviations (§6): AC3.1's Slack-bound subscription is `sqs` (DA3); "visible in the channel" = visible at the alerts destination (DA2: the env channel if prod sets `ALERT_WEBHOOK_URL`, otherwise Roman's DM). ## Scope and approach (from the settled architecture) Architecture B1 — master code only (AS1). **Paging:** `aws sns list-subscriptions-by-topic` on `jaah-main-paging` and `jaah-main-cp-alarms` shows `sqs` and `email` confirmed. A pending email confirmation is not an agent blocker: name it as an R16 row ("click the SNS confirmation link") in the settle summary and continue. Page test: `aws cloudwatch set-alarm-state` ALARM on one prod alarm, then reset to OK. Observe (a) Slack delivery at the alerts destination via the CP relay log line and the Slack message read through the bot, (b) the email: read the `admin@jaah.ai` mailbox if `task_credential_list` carries a credential for it; otherwise the SNS email delivery metric (`NumberOfNotificationsDelivered`) plus the delivery-status log, and name the deviation from "observed" in the settle summary for the close-out child. File the record to `alarms/`. **Archive:** trigger `security-event-export` once (CP cron run-now); its 30-day backfill writes consecutive days. Confirm the objects and the metric. If it still fails, diagnose, deliver a develop fix PR, and name "needs another promotion" in the settle summary. Out of scope: Epic-wide fences (PRD §6, verbatim): "No agent merges or pushes to `master`. No agent approves its own promotion. No agent applies to prod any change not yet promoted. Delivery is a PR to `develop` (D1)." "No contact with any outside party: no emails, Slack messages to externals, vendor portals, NDA click-throughs or RFPs sent; no contracts; no new vendor or subprocessor, which also excludes PagerDuty/Opsgenie and Drata (D3, D7, D8)." "Legacy account 210352747749 is untouched." "Out of scope: Security Hub MEDIUM and LOW findings (D10) — registered only; evidence automation: no new crons, workflows or collectors whose purpose is recurring evidence (D7); Type II, the observation window, the audit, auditor engagement; `compliance_locks` and the vault-lock *compliance* mode." "No change to the console Compliance page, `portfolio/registry.toml` or `portfolio/engine/`" (epic 5303 owns them). "No secret value in any doc, register, evidence object or report." "No weakening of an existing control to make a check pass." This child: Only the two listed prod mutations (one page test with reset; one cron run-now). No hand edits of subscriptions on prod (terraform owns them). No alarm left in ALARM state. Done means: - AC3.1 — oracle: both `list-subscriptions-by-topic` outputs cited, each with an `sqs` and an `email` subscription whose ARN is not `PendingConfirmation` (or the pending one named as an R16 row). - AC3.2 — oracle: the `alarms/<date>/page-test…` `s3://` URI printed; the record includes alarm name, ALARM/OK timestamps, the Slack message text/permalink and the email evidence (mailbox read, or the delivery metric datapoint with the deviation named); alarm state OK afterwards (`describe-alarms` cited). - AC4.1 — oracle: `aws s3 ls s3://jaah-main-security-archive-366008913850/security-events/ --recursive` shows ≥2 consecutive day prefixes; `aws cloudwatch get-metric-statistics` for `CronLastSuccessAgeSeconds` (security-event-export) < 90,000 — both cited.

Prod verified. Archive: 30 consecutive days, metric 28.9k s. Page test filed to alarms/2026-10-09/; Slack DM delivery shown by the relay queue (permalink not read). R16: confirm the SNS email subscriptions for admin@jaah.ai and the Slack DMs. Risk: the DM is the only paging channel until email is confirmed.