docs(infra): plan pvc-* to cel-* migration into celladore-sub (#58)

* docs(infra): plan pvc-* to cel-* migration into celladore-sub

Full recreate-and-cutover plan for pvc-prod-codeflow-rg (website SWA,
engine Container App, ACR) plus the separate pvc-prod-codeflow-identity-rg
into celladore-sub under cel- naming. Cross-tenant move is not possible
(az resource move is single-tenant only) and neither the runtime/ nor
website/ Terraform stack has ever actually managed the live resources, so
this documents an ordered recreate sequence rather than a Terraform-apply
migration. Flags the runtime/website RG-ownership conflict (data source vs
managed resource), the previously-unaccounted identity-rg, and a separate,
more urgent open question: whether deploy-autopr-engine.yml's OIDC
federated credential subject still matches now that the repo is
celladore/codeflow-engine rather than phoenixvc/codeflow-engine.

Planning only — no Azure resources created or modified.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* docs(infra): correct workflow_dispatch claim in cel migration plan

The plan previously stated deploy-autopr-engine.yml has no workflow_dispatch
trigger. It does (line 21), and the deploy job's if-condition includes
workflow_dispatch, so a manual run triggers the real deploy. Corrects the
record and notes the classifier-blocked attempt to use it directly.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* docs(infra): record Phase 1+3 execution log for cel- migration

- Phase 1 (identity) and Phase 3 (provisioning) executed against
  celladore-sub, lowest-cost tiers throughout (ACR Basic, SWA Free,
  Container Apps Consumption/scale-to-zero, Log Analytics
  PerGB2018/30-day floor).
- Add step 0 to Phase 4: bind Container App to celprodcodeflowacr via
  az containerapp registry set before the first real image deploy,
  otherwise image pull fails.
- Record known gaps: unverified role-assignment propagation (az role
  assignment list blocked by classifier), confirmed-by-curl ingress
  port mismatch on the placeholder image (harmless, target_port 8080
  is correct for the real image), LAW shared key displayed during
  retrieval, Phase 2 RG-ownership fix not yet written back into
  website/main.tf.

* docs(cel-migration): record Phase 4 execution log

Phase 4 (cutover) is complete: registry bind, 6 production GitHub env
vars repointed, AZURE_STATIC_WEB_APPS_API_TOKEN rotated, both website
and engine redeployed and verified live via direct HTTP checks.

Records a real defect hit along the way: celladore has GitHub's
immutable-OIDC-subject-ID behavior active, so the federated credential
subject format from Phase 1 (repo:org/repo:environment:name) no longer
matched the presented assertion (repo:org@id/repo@id:environment:name).
Fixed via az identity federated-credential update, after explicit user
approval since it's a trust-boundary change.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* docs(cel-migration): log Phase 5 progress and resume steps

PR celladore/celladore-org#8 is open, clean, and mergeable (repoints the
codeflow CNAME at the recreated celladore-sub SWA) but this session can't
merge PRs. Document the exact resume sequence once a human merges it:
dispatch terraform-dns-apply.yml with confirm=apply (reconcile stays
blank, it's baton-specific), verify via an authoritative resolver, then
bind the Azure custom domain via direct az CLI rather than the website
Terraform stack, which has never been applied against real resources and
still defaults to the old pvc-* names.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* docs(cel-migration): log Phase 5 DNS completion, blocked on Azure domain bind

PR #8 merged, terraform-dns-apply run 32241459991 succeeded end-to-end
(including the state-commit step), and codeflow.celladoresystems.com now
resolves to the new SWA via Cloudflare's own resolver.

Attempted the Azure-side custom-domain bind (az staticwebapp hostname
set) directly per the documented decision to avoid the un-applied
website Terraform stack; blocked by the permission classifier as a live
production-resource mutation. Needs a human to run it directly.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* docs(cel-migration): close out Phase 5 — codeflow.celladoresystems.com fully live

User ran the classifier-blocked az staticwebapp hostname set command
directly; result was status: Ready with no error. Verified end-to-end:
curl -I https://codeflow.celladoresystems.com/ returns 200 with a valid
cert and the real site's security headers — no propagation-lag
cert-mismatch window was even observed. Phase 5 (DNS/domain repoint) is
now complete; Phase 6 (old-tenant decommission) still needs
source-tenant credentials this session doesn't have, Phase 7 (Terraform
default updates) is the natural next step.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

* chore(cel-migration): Phase 7 — update Terraform defaults and docs to cel-* reality

Now that Phase 4/5 are live and verified, update config to describe
reality instead of the stale pvc-* defaults:

- terraform/runtime and terraform/website variables.tf defaults
  (resource group, Container App, ACR, SWA, identity names, Owner tag)
- website's sku_tier/sku_size corrected to Free (matches the live SWA)
  and enable_custom_domain flipped to true (matches the live binding)
- both stacks' READMEs, noting neither has ever actually been applied
  against real resources — a first real apply needs terraform import
- orchestration/infrastructure/README.md's stale codeflow.phoenixvc.tech
  / org-meta DNS flow and naming table
- .azure/pipeline-setup.md defaults, plus a note on the immutable-OIDC-
  subject-ID gotcha from the Phase 4 log
- scripts/setup-azure-auth-for-pipeline.ps1 defaults, plus a warning
  comment on the subject-format gotcha and a fix for a hardcoded old
  Container App name in its output block

terraform fmt -check -diff clean on both stacks after editing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

Author: JustAGhosT

.azure/pipeline-setup.md

@@ -2,6 +2,17 @@
 
 The Codeflow engine deployment workflow uses GitHub Actions OIDC with a user-assigned managed identity. Do not use the legacy `AZURE_CREDENTIALS` JSON secret for the production deploy path.
 
+> **2026-08-19:** production resources were recreated under `celladore-sub` (`cel-*`
+> naming, resource group `cel-prod-codeflow-identity-rg` for the pipeline identity)
+> following the org transfer to celladore — see `../orchestration/infrastructure/CEL_MIGRATION_PLAN.md`.
+> Also worth knowing if you re-run the setup script below: the `celladore` org has
+> GitHub's immutable-OIDC-subject-ID behavior active, so the federated credential's
+> `subject` needs the `repo:<org>@<org_id>/<repo>@<repo_id>:environment:<name>` form, not
+> the classic `repo:<org>/<repo>:environment:<name>` string — the two are not
+> interchangeable and Azure does exact string matching. The current production credential
+> was fixed to the correct subject after hitting `AADSTS700213` on this exact mismatch;
+> see the migration plan's Phase 4 log for the full story.
+
 ## Production Environment Values
 
 Create a GitHub environment named `production` and configure these environment variables:
@@ -11,9 +22,9 @@ Create a GitHub environment named `production` and configure these environment v
 | `AZURE_CLIENT_ID` | Client ID of the pipeline user-assigned managed identity. |
 | `AZURE_TENANT_ID` | Tenant ID for the Azure subscription. |
 | `AZURE_SUBSCRIPTION_ID` | Subscription containing Codeflow production resources. |
-| `AZURE_RESOURCE_GROUP` | Production resource group, expected default: `pvc-prod-codeflow-rg`. |
-| `AZURE_CONTAINER_APP` | Production Container App, expected default: `pvc-prod-codeflow-api`. |
-| `AZURE_CONTAINER_REGISTRY` | ACR name for production images, expected default: `pvcprodcodeflowacr`. |
+| `AZURE_RESOURCE_GROUP` | Production resource group, expected default: `cel-prod-codeflow-rg`. |
+| `AZURE_CONTAINER_APP` | Production Container App, expected default: `cel-prod-codeflow-api`. |
+| `AZURE_CONTAINER_REGISTRY` | ACR name for production images, expected default: `celprodcodeflowacr`. |
 
 The workflow deploys only to existing infrastructure. Provision or import the production Container App and ACR before running the deploy job.
 

orchestration/infrastructure/CEL_MIGRATION_PLAN.md

@@ -16,16 +16,24 @@ This directory is the canonical home for Codeflow product-specific infrastructur
 
 Path: `terraform/website`
 
-This stack creates the Azure Static Web App for the temporary launch hostname
-`codeflow.phoenixvc.tech`.
+This stack owns the Azure Static Web App for the production launch hostname
+`codeflow.celladoresystems.com` (moved from `codeflow.phoenixvc.tech` 2026-08-19
+following the org transfer to celladore — see `CEL_MIGRATION_PLAN.md`).
 
 Use the sequence documented in [terraform/website/README.md](terraform/website/README.md):
 
 1. Plan/apply the Static Web App with `enable_custom_domain=false`.
-2. Pass the Static Web App default hostname to the org-meta DNS stack.
-3. Apply the `codeflow.phoenixvc.tech` CNAME in org-meta.
+2. Pass the Static Web App default hostname to `celladore-org/infrastructure/dns`
+   (Cloudflare, zone `celladoresystems.com` — DNS for this domain is owned there now,
+   not org-meta).
+3. Apply the `codeflow.celladoresystems.com` CNAME via that repo's manual apply workflow.
 4. Re-plan this stack with `enable_custom_domain=true` for the Azure custom-domain binding.
 
+As of 2026-08-19 this sequence has been executed against live resources directly via `az`
+CLI, not by actually applying this stack — see `terraform/website/README.md`'s banner for
+why (this stack has never been successfully applied; a first real apply needs
+`terraform import` first).
+
 Do not use `codeflow.io` until domain ownership and brand risk are resolved.
 
 ## Legacy Bicep
@@ -44,9 +52,15 @@ exception documented next to the stack.
 Current Codeflow resource names follow the ADR-0027 style: structured identifiers with no trailing
 region suffix. Region remains expressed by the resource group location.
 
-- Resource group: `pvc-prod-codeflow-rg`
-- Website Static Web App: `pvc-prod-codeflow-swa`
-- Runtime Container App: `pvc-prod-codeflow-api`
+As of 2026-08-19, live resources use `cel-` naming in `celladore-sub` — recreated from the
+original `pvc-` resources following the org transfer to celladore (cross-tenant resource
+`move` doesn't exist as an Azure operation, so this was a recreate-and-cutover; see
+`CEL_MIGRATION_PLAN.md` for the full history, including the still-pending handoff to
+decommission the old `pvc-*` resource groups).
+
+- Resource group: `cel-prod-codeflow-rg`
+- Website Static Web App: `cel-prod-codeflow-swa`
+- Runtime Container App: `cel-prod-codeflow-api`
 
-Keep future names aligned with `pvc-{env}-codeflow-{type}` unless a provider constraint requires
+Keep future names aligned with `cel-{env}-codeflow-{type}` unless a provider constraint requires
 otherwise. Storage accounts and ACR names omit dashes.

orchestration/infrastructure/README.md

@@ -2,13 +2,23 @@
 
 This stack owns the Azure Container Apps runtime for Codeflow Engine.
 
+> **2026-08-19:** resources recreated under `celladore-sub` (`cel-*` naming) following the
+> org transfer to celladore — cross-tenant resource `move` doesn't exist as an Azure
+> operation, so this was a recreate-and-cutover, not a rename. See
+> `orchestration/infrastructure/CEL_MIGRATION_PLAN.md` for the full history. The defaults
+> below now match the live `cel-*` resources, but **this stack has never actually been
+> applied against them** — they were provisioned directly via `az` CLI (see that plan's
+> "Nothing here is currently Terraform-managed" note). A first real apply needs
+> `terraform import` for each resource first, or it will try to create duplicates of
+> things that already exist.
+
 Names follow the ADR-0027-style convention used for live Codeflow resources:
 
-- Resource group: `pvc-prod-codeflow-rg`
-- Container App: `pvc-prod-codeflow-api`
-- Container Apps Environment: `pvc-prod-codeflow-cae`
-- Log Analytics Workspace: `pvc-prod-codeflow-law`
-- Container Registry: `pvcprodcodeflowacr`
+- Resource group: `cel-prod-codeflow-rg`
+- Container App: `cel-prod-codeflow-api`
+- Container Apps Environment: `cel-prod-codeflow-cae`
+- Log Analytics Workspace: `cel-prod-codeflow-law`
+- Container Registry: `celprodcodeflowacr`
 
 The stack expects the Codeflow image to exist in ACR. For a first-time bootstrap before the image is
 available, override `initial_image` with a temporary public image, then switch it back to the ACR

orchestration/infrastructure/terraform/runtime/README.md

@@ -11,7 +11,7 @@ variable "tenant_id" {
 variable "resource_group_name" {
   description = "Existing Codeflow production resource group."
   type        = string
-  default     = "pvc-prod-codeflow-rg"
+  default     = "cel-prod-codeflow-rg"
 }
 
 variable "location" {
@@ -23,37 +23,37 @@ variable "location" {
 variable "container_app_name" {
   description = "Codeflow runtime Container App name."
   type        = string
-  default     = "pvc-prod-codeflow-api"
+  default     = "cel-prod-codeflow-api"
 }
 
 variable "container_app_environment_name" {
   description = "Codeflow Container Apps Environment name."
   type        = string
-  default     = "pvc-prod-codeflow-cae"
+  default     = "cel-prod-codeflow-cae"
 }
 
 variable "log_analytics_workspace_name" {
   description = "Log Analytics Workspace for Codeflow Container Apps logs."
   type        = string
-  default     = "pvc-prod-codeflow-law"
+  default     = "cel-prod-codeflow-law"
 }
 
 variable "container_registry_name" {
   description = "Globally unique Azure Container Registry name. ACR names cannot contain dashes."
   type        = string
-  default     = "pvcprodcodeflowacr"
+  default     = "celprodcodeflowacr"
 }
 
 variable "container_app_identity_name" {
   description = "User-assigned managed identity attached to the Codeflow Container App."
   type        = string
-  default     = "pvc-prod-codeflow-api-mi"
+  default     = "cel-prod-codeflow-api-mi"
 }
 
 variable "initial_image" {
   description = "Codeflow Engine image deployed by default. Override only for bootstrap scenarios."
   type        = string
-  default     = "pvcprodcodeflowacr.azurecr.io/codeflow-engine:master"
+  default     = "celprodcodeflowacr.azurecr.io/codeflow-engine:master"
 }
 
 variable "tags" {
@@ -62,7 +62,7 @@ variable "tags" {
   default = {
     Environment = "prod"
     Product     = "codeflow"
-    Owner       = "phoenixvc"
+    Owner       = "celladore"
     ManagedBy   = "terraform"
   }
 }

orchestration/infrastructure/terraform/runtime/variables.tf

@@ -5,12 +5,24 @@ This stack owns the Azure resource side of the Codeflow website launch at
 
 > **2026-08-19:** domain moved from `codeflow.phoenixvc.tech` to
 > `codeflow.celladoresystems.com` following the org transfer to celladore.
-> Only the `custom_domain` variable default changed in that update — the
-> existing `resource_group_name` / `static_web_app_name` defaults
-> (`pvc-prod-codeflow-rg` / `pvc-prod-codeflow-swa`) are the **live resource
-> names** and were deliberately left alone; renaming those defaults would
-> make Terraform plan a destroy/recreate of the resource group and the SWA
-> itself. `enable_custom_domain` is still `false` — see step 5 below.
+> Same day, the underlying SWA itself was also recreated: cross-tenant Azure
+> resource `move` doesn't exist, so the `pvc-prod-codeflow-swa` resource under
+> the old phoenixvc-owned subscription was replaced by `cel-prod-codeflow-swa`
+> in `celladore-sub` (recreate-and-cutover, not a rename — see
+> `../../CEL_MIGRATION_PLAN.md` for the full history). `resource_group_name` /
+> `static_web_app_name` now default to the *new* live names
+> (`cel-prod-codeflow-rg` / `cel-prod-codeflow-swa`). Safe to update now
+> specifically because this stack has **never been successfully applied**
+> against either the old or new resources — no backend was ever configured
+> (only `backend.tf.example` exists) and no state has ever tracked them, so
+> there's no tracked resource for a rename to plan a destroy/recreate of. A
+> first real apply still needs `terraform import` for the resource group and
+> the SWA (both already exist, provisioned out-of-band via `az` CLI — see
+> "Nothing here is currently Terraform-managed" in the migration plan) or it
+> will try to create duplicates and fail. `enable_custom_domain` now defaults
+> to `true`, matching the live binding (done directly via `az staticwebapp
+> hostname set`, not through this stack — see the resolved known-gap note
+> below) — but the same import caveat applies before a first real apply.
 
 Boundary:
 
@@ -31,14 +43,17 @@ Apply sequence:
 
 Do not use `codeflow.io` in this stack until domain ownership and brand-collision risk are confirmed.
 
-## Known gap: Azure subscription access
-
-As of 2026-08-19, the SWA resource (`pvc-prod-codeflow-swa`) was not found via
-`az staticwebapp list` under either `celladore-sub` or `neuralliquid-sub` — the
-two subscriptions available in the session that made this update. It is
-presumably still under a phoenixvc-owned subscription that didn't transfer
-with the repo. Steps 1, 2, 5, and 6 above need credentials for whichever
-subscription actually holds this resource group; confirm that before running
-them. The site itself is independently confirmed live (HTTP 200 from its
-default hostname, `Last-Modified` current) — this gap is about Terraform/CLI
-access to the resource, not about whether the site is up.
+## Known gap: Azure subscription access — resolved 2026-08-19
+
+This gap (originally: the SWA wasn't reachable from any subscription available
+in the session that wrote this note, presumably stranded under a
+phoenixvc-owned subscription) is resolved as of the same day, but not the way
+it originally implied. It wasn't a missing-credential problem — it was that
+`pvc-prod-codeflow-swa` no longer exists at all. The whole resource group was
+recreated under `celladore-sub` as `cel-prod-codeflow-rg` /
+`cel-prod-codeflow-swa` (see the banner above). `celladore-sub` credentials
+are available in this session and steps 1–6 are all now practically done —
+via direct `az` CLI, not by actually applying this stack (see the banner
+above for why a real apply still needs `terraform import` first). The site is
+confirmed live end-to-end: `curl -I https://codeflow.celladoresystems.com/`
+returns `200` with a valid cert and the expected security headers.

orchestration/infrastructure/terraform/website/README.md

@@ -11,7 +11,7 @@ variable "tenant_id" {
 variable "resource_group_name" {
   description = "Resource group for Codeflow website hosting."
   type        = string
-  default     = "pvc-prod-codeflow-rg"
+  default     = "cel-prod-codeflow-rg"
 }
 
 variable "location" {
@@ -23,7 +23,7 @@ variable "location" {
 variable "static_web_app_name" {
   description = "Azure Static Web App resource name."
   type        = string
-  default     = "pvc-prod-codeflow-swa"
+  default     = "cel-prod-codeflow-swa"
 }
 
 variable "custom_domain" {
@@ -33,21 +33,21 @@ variable "custom_domain" {
 }
 
 variable "enable_custom_domain" {
-  description = "Enable only after celladore-org/infrastructure/dns has created the CNAME to the Static Web App default hostname and it resolves."
+  description = "Enable only after celladore-org/infrastructure/dns has created the CNAME to the Static Web App default hostname and it resolves. Live reality as of 2026-08-19: the CNAME resolves and the custom domain is bound (done directly via `az staticwebapp hostname set`, not through this stack — see README's known-gap note). Default reflects that; a real first apply still needs the SWA imported first or this will try to create a duplicate."
   type        = bool
-  default     = false
+  default     = true
 }
 
 variable "sku_tier" {
-  description = "Static Web App SKU tier."
+  description = "Static Web App SKU tier. Live resource is Free (confirmed supports up to 2 custom domains, which covers this use case) — departs from this stack's original Standard default."
   type        = string
-  default     = "Standard"
+  default     = "Free"
 }
 
 variable "sku_size" {
   description = "Static Web App SKU size."
   type        = string
-  default     = "Standard"
+  default     = "Free"
 }
 
 variable "tags" {
@@ -56,7 +56,7 @@ variable "tags" {
   default = {
     Environment = "Production"
     Product     = "Codeflow"
-    Owner       = "phoenixvc"
+    Owner       = "celladore"
     ManagedBy   = "Terraform"
   }
 }

orchestration/infrastructure/terraform/website/variables.tf

@@ -5,17 +5,17 @@ param(
     [Parameter(Mandatory = $true)]
     [string]$TenantId,
 
-    [string]$IdentityResourceGroup = "pvc-prod-codeflow-identity-rg",
+    [string]$IdentityResourceGroup = "cel-prod-codeflow-identity-rg",
 
-    [string]$DeploymentResourceGroup = "pvc-prod-codeflow-rg",
+    [string]$DeploymentResourceGroup = "cel-prod-codeflow-rg",
 
-    [string]$ContainerRegistryName = "pvcprodcodeflowacr",
+    [string]$ContainerRegistryName = "celprodcodeflowacr",
 
     [string]$Location = "southafricanorth",
 
-    [string]$IdentityName = "pvc-prod-codeflow-github-mi",
+    [string]$IdentityName = "cel-prod-codeflow-github-mi",
 
-    [string]$GitHubOwner = "phoenixvc",
+    [string]$GitHubOwner = "celladore",
 
     [string]$GitHubRepository = "codeflow-engine",
 
@@ -80,6 +80,14 @@ Invoke-Az role assignment create `
     --role AcrPush `
     --scope $containerRegistryId | Out-Null
 
+# NOTE (2026-08-19): this classic-format subject matched what GitHub issued when this
+# script was first used against phoenixvc/codeflow-engine, but the celladore org has
+# GitHub's immutable-OIDC-subject-ID behavior active — its actual `sub` claim is
+# `repo:<org>@<org_id>/<repo>@<repo_id>:environment:<name>`, not this string. Azure does
+# exact string matching, so a fresh credential created with this subject will fail
+# deploys with AADSTS700213 until corrected via `az identity federated-credential
+# update --subject <the exact string from the error>`. Confirm which format applies
+# before relying on this value; see CEL_MIGRATION_PLAN.md's Phase 4 log for the story.
 $subject = "repo:${GitHubOwner}/${GitHubRepository}:environment:${GitHubEnvironment}"
 
 Invoke-Az identity federated-credential create `
@@ -95,6 +103,8 @@ Invoke-Az identity federated-credential create `
     AZURE_TENANT_ID       = $selectedTenantId
     AZURE_SUBSCRIPTION_ID = $SubscriptionId
     AZURE_RESOURCE_GROUP  = $DeploymentResourceGroup
-    AZURE_CONTAINER_APP   = "pvc-prod-codeflow-api"
+    # Hardcoded rather than parameterized (pre-existing; not a $DeploymentResourceGroup
+    # derivation) — update this literal directly if the Container App name ever changes.
+    AZURE_CONTAINER_APP   = "cel-prod-codeflow-api"
     AZURE_CONTAINER_REGISTRY = $ContainerRegistryName
 } | Format-List