Merge pull request 'fix(vault): rename applications.policies → ops_policies (cms CI was silently missing its R2 policy)' (#4) from claude/fix-cms-ops-policies-key into main

The `applications` object field was declared `policies` in variables.tf, but
the cms tfvars entry, the runbook (doc/runbooks/new-web-app/03-vault-platform.md),
the guidebook (vibe/guidebooks/tools/secrets-and-vso.md) and the module input
(modules/app_policy variable `ops_policies`) all use the name `ops_policies`.

Because Terraform silently drops unknown attributes when converting a value to
an object() type, cms's `ops_policies = ["factory__cf_r2_arcodange_tf"]` was
discarded and `each.value.policies` fell back to [] — so gitea_cicd_cms never
received the `factory__cf_r2_arcodange_tf` token policy (read on
kvv1/cloudflare/r2/arcodange-tf + kvv1/zoho/self_client, defined in
factory iac/cloudflare.tf). cms CI was missing its Cloudflare R2 Terraform-state
permissions.

Fix at the root: rename the schema field `policies` -> `ops_policies` (and its
single reference main.tf:82 `each.value.policies` -> `each.value.ops_policies`),
aligning the whole chain. This is lower-churn than renaming the tfvars key (the
chosen alternative would also have required fixing the runbook + guidebook, which
both already document `ops_policies`) and prevents the next app created from the
runbook from re-introducing the same silently-dropped key.

Behavioural change: gitea_cicd_cms gains `factory__cf_r2_arcodange_tf` in its
token_policies. No other app sets this field (all default []), so no other role
changes. Reviewer: confirm the R2 policy is the intended grant for cms CI.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

hashicorp-vault/iac/main.tf

@@ -79,7 +79,7 @@ module "app_policies" {
   for_each                   = { for app in var.applications : app.name => app }
   name                       = each.value.name
   envs                       = each.value.envs
-  ops_policies               = each.value.policies
+  ops_policies               = each.value.ops_policies
   service_account_names      = each.value.service_account_names
   service_account_namespaces = each.value.service_account_namespaces
   gitea_app_id               = var.gitea_app_id

hashicorp-vault/iac/modules/app_policy/main.tf

@@ -8,18 +8,14 @@
 locals {
   name = lower(var.name)
   envs = [for e in var.envs : lower(e)]
+
   # Elision rule: env=prod → bare name; else <name>-<env>
-  instances = [for e in local.envs : e == "prod" ? local.name : "${local.name}-${e}"]
+  instances          = [for e in local.envs : e == "prod" ? local.name : "${local.name}-${e}"]
-  # Non-prod instances only (for the per-env runtime policy iteration that doesn't touch the prod state address)
   non_prod_instances = [for e in local.envs : "${local.name}-${e}" if e != "prod"]
 
   # Per-instance SA name/namespace sets used by the CI policy's allowed_parameter blocks.
   per_instance_sa_names      = { for inst in local.instances : inst => concat([inst], var.service_account_names) }
   per_instance_sa_namespaces = { for inst in local.instances : inst => concat([inst], var.service_account_namespaces) }
-
-  # Backwards-compat aliases kept for any caller that referenced these (unused outside the module).
-  bound_service_account_names      = concat([var.name], var.service_account_names)
-  bound_service_account_namespaces = concat([var.name], var.service_account_namespaces)
 }
 
 data "vault_policy_document" "ops" {

hashicorp-vault/iac/modules/app_roles/main.tf

@@ -3,17 +3,17 @@ data "vault_auth_backend" "kubernetes" {
 }
 
 locals {
-  name = lower(var.name)
+  name     = lower(var.name)
-  env  = lower(var.env)
+  env      = lower(var.env)
+  database = var.database == null ? local.instance : var.database
+
   # Elision rule (factory runbook conventions.md):
   #   env == prod → identical to the single-env baseline (no suffix)
-  #   else        → kebab-case "<name>-<env>" for K8s/Vault paths
+  #   else        → kebab-case "<name>-<env>" for K8s/Vault paths.
-  instance = local.env == "prod" ? local.name : "${local.name}-${local.env}"
   # Postgres owner role stays snake-case for consistency with the existing "_role" suffix.
+  instance   = local.env == "prod" ? local.name : "${local.name}-${local.env}"
   owner_role = local.env == "prod" ? "${local.name}_role" : "${local.name}_${local.env}_role"
 
-  database = var.database == null ? local.instance : var.database
-
   bound_service_account_names      = concat([local.instance], var.service_account_names)
   bound_service_account_namespaces = concat([local.instance], var.service_account_namespaces)
 

hashicorp-vault/iac/terraform.tfvars

@@ -1,6 +1,6 @@
 applications = [
   { name = "webapp" },
-  { name = "erp" },
+  { name = "erp", envs = ["prod", "sandbox"] },
   { name = "dance-lessons-coach" },
   {
     name                   = "cms"

hashicorp-vault/iac/variables.tf

@@ -12,7 +12,7 @@ variable "POSTGRES_CREDENTIALS_EDITOR_PASSWORD" {
 variable "applications" {
   type = set(object({
     name                       = string
-    policies                   = optional(list(string), [])
+    ops_policies               = optional(list(string), [])
     service_account_names      = optional(list(string), [])
     service_account_namespaces = optional(list(string), [])
     # Multi-env extension: list of envs this app deploys to. Defaults to ["prod"] for