Build and rehearse the courses.datatalks.club redirect; activate only at cutover

Parent epics: #5, #9, #10

Normative authority

• _docs/PROCESS.md
• _docs/specs/open-decisions.md §5, including the 2026-08-26 owner override recorded by #16
• _docs/specs/02-url-link-seo-compatibility.md, especially the legacy course-host contract
• _docs/specs/04-courses-and-cohorts.md, especially URL consolidation and redirect Lambda
• _docs/specs/07-security-privacy-operations.md, for least privilege, redaction, monitoring, rollback, and retention
• _docs/specs/08-aws-development-terraform.md, especially Legacy course-host redirect Lambda
• _docs/specs/09-migration-rollout-roadmap.md, Milestones 5, 7, and 8 plus rollback
• _docs/specs/10-verification-strategy.md

PM disposition

GROOMED / P0 / HUMAN / DEPENDENCY-BLOCKED. Do not dispatch #71 yet.

#71 owns the separate DataTalksClub/aws-infra redirect workload, its inactive source acceptance,
and its non-production rehearsal. It does not itself authorize or execute a production DNS/edge
switch. Production activation is a later #74 operation under explicit named-owner authority, after
#73 and every other #74 gate pass.

The #16 owner override is authoritative: the redirect does not wait for authenticated production
probes or per-route owner/volume evidence, and an authenticated route that does not survive the host
change cleanly is an accepted one-time inconvenience. That product decision removes those two
evidence gates; it does not create a redirect map, authorize production access, waive deterministic
route coverage, or grant AWS/DNS/ACM/credential authority.

Outcome

Consume the exact accepted #60 legacy-host map and build an immutable, least-privilege Terraform
workload for courses.datatalks.club: a small Lambda behind an HTTPS catch-all, explicit
digest-bound path/method behavior, query preservation, true unknown-path 404, bounded cache
behavior, PII-free telemetry and alarms, and instant artifact/config/DNS rollback. Rehearse it on a
separately authorized non-production legacy hostname. Keep the workload inactive for production
until #74's explicit cutover gate.

The checked current-main route contract is characterization input, not #71 completion evidence. At
website face8e4808d65afbf0374d1ced7a88079950d663, it has 115 rows (83 HTML, 30 API, 2 calendar),
all classified preserve, all with expected_status: null, and no authenticated production probe.
#16 permits proceeding without the missing probes/owner-volume fields, but #60 must still emit and
accept the exact destination/method map that #71 consumes.

Staged dependency and authority DAG

“Accepted” means independently tested, PM-accepted, committed, locally merged/pushed, terminal
green, and identified by immutable source/artifact evidence. Open issue prose, a local candidate, a
synthetic test, or a prior audit is not an accepted dependency.

accepted #16 owner decision
+ accepted #60 explicit digest-bound legacy-host map
  -> #71 inactive Terraform/Lambda source candidate

accepted #71 source candidate
+ accepted #78/#94 development delivery/control identities
+ explicit non-production hostname/DNS rehearsal authorization
  -> #71 non-production rehearsal and source acceptance (`Refs #71`)

accepted non-activating #71 contract/rehearsal
+ the other exact #73 entry gates
  -> #73 full development aggregate rehearsal

accepted #29 quantitative route/rollback thresholds
+ accepted #60/#50/#71/#73 evidence
+ one immutable green production release candidate
+ explicit #74 owner/window/DNS/edge/runbook authorization
  -> #74 production destination smoke
  -> #74 activates the approved #71 redirect configuration
  -> quantitative observation/rollback and retained legacy recovery

#73 is downstream of #71's non-activating source/rehearsal gate, so #73 is not a prerequisite for
that gate. It becomes a prerequisite only for the later production activation owned by #74. This
removes the former #71 ↔ #73 cycle.

#49 and #50 are not #71 source dependencies. They remain independent delivery/sender inputs to
#73/#74. #71 performs no Relay, provider, Datamailer, sender, queue, or recipient action.

#67 is an accepted development network/DNS/TLS foundation, not course-host redirect evidence.
#78/#94 gate the authorized development delivery/rehearsal control plane; they do not grant
production authority. #29's approved product boundary is an input, while its unchecked
quantitative monitoring/rollback criterion remains a #74 activation gate rather than a blocker to
inactive #71 source work.

Source and rehearsal scope

• In DataTalksClub/aws-infra, create one separately bounded workload whose input pins the exact
  accepted #60 map schema, digest, and source identity; reject missing, duplicate, ambiguous,
  malformed, drifted, or unclassified rows.
• Package one immutable Lambda artifact and one response implementation behind API Gateway HTTP API
  or an equivalent minimal HTTPS catch-all.
• Reference/import reviewed existing hosted-zone, certificate, and legacy-host resources by exact
  identifiers supplied through the authorized environment. Never select a zone by name, recreate a
  shared zone, or silently take ownership of an existing record.
• Preserve the raw query and the accepted suffix/case/Unicode behavior. Emit one-hop 301 for
  mapped GET/HEAD HTML. Emit 308 only for methods explicitly present in the accepted map under
  #16's override. Unknown or unclassified path/method combinations return a real bounded 404,
  never a homepage or guessed destination.
• Keep the permanent @courses.datatalks.club calendar UID namespace unchanged; it is data, not a
  request destination to rewrite.
• Add least-privilege IAM, bounded cache behavior, no-PII structured access/unknown-path metrics,
  alarms, artifact/config rollback, and a reversible DNS change plan.
• Rehearse TLS, routing, method/query behavior, load/cost, alarms, cache, deployment rollback, and
  DNS/config switch-and-restore only on the explicitly authorized non-production hostname.

Acceptance criteria

• The workload pins one accepted #60 map identity/digest and deterministically rejects missing,
  duplicate, ambiguous, malformed, drifted, or unclassified route/method/destination input without
  creating or changing infrastructure.
• Terraform plan and policy tests prove workload-only ownership, immutable Lambda packaging,
  least privilege, exact existing DNS/ACM references, no hosted-zone recreation/name lookup, no
  secret or production value in source/evidence, and no deletion or mutation of the legacy
  ECS/database stack.
• Table-driven tests cover every accepted map row and prove direct one-hop destinations, raw
  query preservation, approved suffix/case/Unicode behavior, 301 for mapped GET/HEAD HTML,
  explicitly mapped 308 behavior under #16, and true bounded 404 for unknown/unclassified or
  malformed inputs.
• Logging, metrics, traces, alarms, and error responses contain no query value, authorization,
  cookie, body, recipient, user, credential, or other PII/secret; safe route-class counters are
  cardinality-bounded and sufficient for quantitative observation and rollback.
• Cache behavior, cold/warm execution, concurrency, load/cost envelope, alarm transitions,
  immutable artifact rollback, configuration rollback, and stale/mismatched-map failure behavior
  pass with deterministic redacted evidence.
• [HUMAN] An explicitly authorized non-production rehearsal proves TLS, exact host/path/method/query
  behavior, browser/API outcomes, alarms, and reversible DNS/config switch-and-restore without
  production access or mutation.
• A separate tester independently validates the frozen plan, every criterion, graph-selected
  source checks, and inspected desktop/mobile screenshots; PM accepts the inactive source
  candidate. Its focused commit uses Refs #71, and #71 remains open with human. The later
  authorized non-production rehearsal is recorded against that exact merged source/artifact
  identity and must pass before #73 consumes the #71 contract.
• [HUMAN] Only under #74, a named authorized owner approves the exact production hosted-zone,
  record, certificate, artifact/config/map identities, destination smoke, change window, roles,
  quantitative thresholds, rollback target, and observation/retention window before activation.
• [HUMAN] #74 activation and observation prove one-hop approved redirects, true unknown-path
  404, bounded PII-free telemetry, successful rollback readiness, and continued recoverability of
  the legacy stack/database. Only then may #71 close.

Required validation

1. Generate cases from the entire accepted map and exercise GET, HEAD, every explicitly mapped
   unsafe method, raw and empty queries, suffix/case/Unicode variants, unknown/malformed paths,
   duplicate/drifted map input, and oversized requests.
2. Prove authorization/cookies/bodies/query values are neither logged nor used as unbounded metric
   dimensions, including denial and Lambda/API Gateway failure paths.
3. Exercise cold/warm Lambda behavior, concurrency, cache headers, throttling, alarm state, artifact
   rollback, configuration rollback, and the authorized non-production DNS switch-and-restore.
4. Bind all evidence to the exact website map digest, aws-infra source SHA, Terraform plan digest,
   Lambda artifact digest, environment identity, and tester-observed candidate.

Browser and screenshots

On the authorized non-production hostname, the independent tester exercises representative mapped
public HTML, account/login, API, calendar/certificate, query-bearing, unknown, malformed, and safe
error paths at desktop and mobile. Verify the expected final destination/status, no redirect loop or
homepage fallback, and no secret/PII in the page, URL, console, network evidence, or screenshots.
Production browser evidence belongs to #74 after explicit authorization.

Explicit non-goals

• No production Terraform plan/apply, AWS/DNS/ACM/edge/provider/credential read or mutation,
  production traffic probe, protected-data access, or activation under a repository-only lane.
• No inferred production hostname/zone/certificate/record identity from development values or a
  name-only lookup.
• No new route/product classification, guessed destination, year stripping, blanket/homepage
  redirect, calendar UID rewrite, or waiver of the exact accepted #60 map.
• No website domain feature, Course/Cohort migration, Relay/email/Datamailer behavior, sender
  enablement, queue action, sitemap submission, indexing change, or legacy write retirement.
• No deletion of the legacy ECS service, database, artifacts, mapping, or rollback evidence in the
  same change or before #74's accepted observation/retention gate.

Lifecycle

Do not dispatch #71 while #60 is open. After #60 supplies the accepted explicit map, create a fresh
isolated aws-infra engineer lane for the inactive source candidate. Engineering remains uncommitted;
a separate tester verifies it and captures required screenshots; PM accepts it; then the focused
source commit uses Refs #71, is merged/pushed under the owning repository process, and is observed
by on-call. The authorized non-production rehearsal must also pass before #73 consumes #71.

Keep #71 open with human. #74 alone owns the later production destination smoke, DNS/edge switch,
redirect activation, quantitative observation, rollback decision, and legacy retention. No issue
text or source acceptance substitutes for that authority.

Start in the separately bounded DataTalksClub/aws-infra workload after #60 supplies its accepted map, reading the listed redirect, security, Terraform, rollout, and verification specifications. Define the immutable Lambda/API Gateway and Terraform source candidate, then run the map, policy, redaction, rollback, and non-production rehearsal checks. Done means independent validation and PM acceptance of inactive source and authorized rehearsal evidence; do not activate production.