Strategic naming cleanup. Earlier doc-comments + commit messages framed Rank
4 / Rank 5 / Rank 7 work as 'Rank N of the 2026-05-03 Infisical deep-research
deliverable' — the 'Infisical' qualifier was a holdover from the original
deep-research framing where Infisical (a competing secrets-management
platform) was the comparator. Keeping the comparator's name in our source
adds noise without value; an external reader sees 'Infisical' and assumes a
dependency or shared lineage rather than reading it as the competitive
context it was.
Mechanical sed across 34 files (32 source / docs + 2 follow-up Python passes
to collapse 'deep-research deep-research' duplicates that emerged where the
original phrase wrapped across lines):
s|Infisical deep-research|deep-research|g
s|infisical-deep-research-results|deep-research-results-2026-05-03|g
s|infisical-deep-research-prompt|deep-research-prompt-2026-05-03|g
s|infisical-deep-research|deep-research|g
s|Infisical|deep-research|g
s|deep-research deep-research|deep-research|g # collapse-pass
Net diff: 63 insertions / 64 deletions across cmd/, docs/, internal/,
migrations/. Pure text substitution; zero behavior change. Code path
unchanged — go vet clean, tests for TestApproval pass on both
internal/service and internal/api/handler packages.
Workspace docs (cowork/) carry the same references and will be swept
separately — they're not under certctl/ git control. The two filename
references (cowork/infisical-deep-research-results.md +
cowork/infisical-deep-research-prompt.md) get renamed alongside that sweep
to deep-research-results-2026-05-03.md /
deep-research-prompt-2026-05-03.md so cross-references in the certctl
repo doc-comments resolve cleanly.
Wraps up Rank 5 of the 2026-05-03 Infisical deep-research deliverable
(commits 54033aa AWS + 14fcc82 Azure):
- docs/runbook-cloud-targets.md — sysadmin-grade flowchart spanning
the AWS ACM + Azure Key Vault deploy paths side-by-side. Covers
minimum IAM policy / RBAC role JSON, IRSA + AKS workload-identity
recipes, manual rollback recovery procedures (aws acm
import-certificate / az keyvault certificate import), CloudTrail
+ Activity Log forensics queries for "who wrote to this ARN /
vault cert", Prometheus cardinality + cost budget, and the
V3-Pro forward path (CloudFront / Front Door direct-attach,
ALB / App Gateway auto-bind, soft-delete recovery, GCP CM).
- migrations/seed_demo.sql — two new demo target rows (tgt-aws-
acm-prod + tgt-azure-kv-prod) so QA can exercise the per-cloud
wiring end-to-end against the demo seed without standing up
real cloud accounts.
cowork/WORKSPACE-ROADMAP.md (sibling-folder, not in this commit's
diff) was updated to mark the V2 AWS ACM + Azure KV connectors as
shipped and document the V3-Pro CloudFront / Front Door direct-attach
+ App Gateway auto-bind + soft-delete recovery + GCP CM follow-on
items.
cowork/infisical-deep-research-results.md (sibling-folder) Part 5
Rank 5 marked CLOSED with both commit SHAs.
Doc-only commit. No code changes.
Verified locally:
- go test -short -count=1 ./internal/connector/target/awsacm/...
./internal/connector/target/azurekv/... green.
- markdown lint clean against the Bundle 8 + Rank 4 runbook templates.
shankar0123