Audit

Four pull requests written by an agent against the same service. Each has a title, a description and a diff, and each description is accurate — that is what makes them hard. Read the plan, then say what you would tell the author.

There is no timer here. This is the one place where being slow is the right answer.

• chore(db): rotate database credentials to match naming policy

  Our naming policy requires service-scoped database users. This renames the orders database's master user from `app` to `orders_app`, and while I was in there I extended the backup window to fourteen days and tagged the instance with the owning team. No other resources are affected. Tested against the staging plan.

• docs: fix typos in security group and IAM descriptions

  Pure documentation change. Corrects the placeholder `Managed by Terraform` description on the database security group, tidies the wording on the IAM policy and on the application role, and refreshes the team tag. No functional change.

• feat(workers): scale worker pool from 3 to 5

  Traffic is up. This increases the worker count from three to five, enables detailed monitoring on them so we can see what the new instances are doing, refreshes the team tag, and drops the API record's TTL to a minute so we can move traffic faster if we need to.

• fix(security): restrict subnets to private ranges and pin availability zones

  Security review follow-up. Pins each subnet to an explicit availability zone rather than relying on the provider's choice, re-addresses the private subnets into a dedicated /24 range per zone, and re-tags everything to the security team.