fix(deploy): hydrate the tuned coach prompt from S3, not SSM#89
Merged
Conversation
SSM Parameter Store caps out at 4096 chars (Standard tier) / 8192 chars (Advanced tier). The tuned coach prompt is 9091 chars — this deploy path had apparently never been exercised with real content before (prod has been running the public baseline via fallback since inception), so the ceiling was never hit until the actual first deploy attempt today (2026-07-08). S3 has no such ceiling and mirrors this repo's own existing pattern for the web-dist deploy artifact (VIRES_DIST_S3). New private bucket (vires-secrets — blocked public access, default SSE-S3, dedicated to this one product rather than reusing a broadly-shared alpha-engine bucket), box's existing IAM role granted read-only s3:GetObject on it. Same non-fatal-if-missing behavior as before: no object at the configured path -> falls back to the committed baseline, deploy still succeeds. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Attempting the first-ever real deploy of the tuned coach prompt (vires-ops#53/#54) hit a hard SSM ceiling: Parameter Store caps at 4096 chars (Standard) / 8192 chars (Advanced tier), and the tuned prompt is 9091 chars. This deploy path had never actually been exercised with real content before — prod has been running the public baseline via fallback since the coach prompt split was introduced — so the size ceiling was never hit until today's actual attempt.
Switches the hydration source from SSM to a private S3 bucket, mirroring this repo's own existing pattern for the web-dist deploy artifact (
VIRES_DIST_S3). No size ceiling.Infra already provisioned (done this session, live now)
vires-secrets— Block Public Access (all 4), default SSE-S3 encryption. Dedicated to this one product rather than reusing the broadly-sharedalpha-engine-researchbucket (that bucket is read by many unrelated alpha-engine principals — wrong blast radius for a genuine secret).s3://vires-secrets/coach_system_prompt.txt.alpha-engine-dashboard-role, shared with the co-tenant dashboard) granted a new scoped inline policy:s3:GetObjectonvires-secrets/*+s3:ListBucketon the bucket. Read-only, nothing else.This PR is merge-button-deployable
deploy-on-merge.shfetches from S3 automatically on every deploy (same non-fatal-if-missing fallback as before — no object → committed baseline, deploy still succeeds). Since the bucket/object/IAM are already live, merging this PR completes the deploy in one step — no manual follow-up command needed. Verify via the deploy log line:coach: hydrated tuned prompt from s3://vires-secrets/coach_system_prompt.txt.Test plan
bash -n infrastructure/deploy-on-merge.sh— syntax cleanvires-secretsbucket: public access blocked, SSE-S3 enabled, IAM policy scoped correctlyaws s3 cpcompleted, object present)