feat/energia-sweep
needs attentionviewing older commit21a26c5 · fullPR #331reviewed 2026-07-21 23:40 UTC0H · 4M · 4L · 5I- Purpose
- Provides the automatic nightly trigger for utility_contract_findings — without this Lambda the detection shell exists but nothing calls it automatically.
- Goal
- A self-contained scheduled Lambda that enumerates energia-entitled orgs nightly, delegates detection to the existing FindingFCIS.detectFindingsForOrgShell, and emits CloudWatch metrics via EMF.
- Sub-goals
- Services/findings package scaffold mirroring billing pattern
- Pure sweep core (selectEntitledOrgs, aggregateSweep, buildSweepEmf)
- FindingsLambdaStack CDK stack with EventBridge cron + disabled on branch previews
- Wire into main.ts
- What
- New services/findings/ package + FindingsLambdaStack + paths.ts entry + main.ts wiring. Zero changes to existing domain code, DB schema, or API.
- Why
- The findings detection shell from #328 needs an automatic trigger to fill utility_contract_findings; the read API returns empty results without it.
- Areas
- services/findings+442−0infra/cdk+148−0pnpm-lock.yaml+67−2
- Blast
- 12 files, +745/-2 lines. Purely additive. No existing code paths modified.
Findings · 8
correctness1
aggregateSweep latent interface gap: ok:false outcomes can carry non-zero counts
services/findings/src/lib/sweep.ts
Guard with outcome.ok ? outcome.inserted : 0 to make intent explicit.
security1
SSM ARN parameter written but never consumed
infra/cdk/src/stacks/services/findings/findings-lambda.stack.ts:111
FindingsSweepFnArnParam has no reader. Remove until a concrete consumer exists.
conventions1
Missing batu:provider tag on FindingsLambdaStack
infra/cdk/src/stacks/services/findings/findings-lambda.stack.ts:63
RequiredTags interface requires batu:provider. Set to 'internal' for this first-party process.
tests3
aggregateSweep counts from ok:false outcomes untested with non-zero values
services/findings/src/__tests__/sweep.test.ts:67
OrgSweepOutcome allows non-zero counts on failure; reducer sums unconditionally. Add test case to pin behavior.
selectEntitledOrgs not tested for JSONB-hostile truthy values (null, 1)
services/findings/src/__tests__/sweep.test.ts:18
resolveEnabledModules uses strict === true. Tests cover false/absent/undefined but not null/1. Pin the strict check.
buildSweepEmf Metrics entries lack Unit assertion in tests
services/findings/src/__tests__/sweep.test.ts:128
Assert Unit presence/absence to prevent silent drift.
improvement2
Sequential org sweep has no graceful degradation before 10-minute Lambda ceiling
services/findings/src/handlers/findings-sweep.handler.ts:70
At ~2-3s/org and 50+ entitled orgs the ceiling is tight. aggregateSweep already handles per-org outcomes; add bounded concurrency now or document the threshold.
fetchAllOrganizations pagination complexity unearned at current org scale
services/findings/src/handlers/findings-sweep.handler.ts
Dual break condition and stale total add reasoning surface for little benefit at current scale.