refactor: codebase quality remediation

cmd/lambda/alert-dispatcher/main.go

@@ -22,6 +22,11 @@ import (
 func main() {
 	logger := slog.New(slog.NewJSONHandler(os.Stdout, nil))
 
+	if err := ilambda.ValidateEnv("alert-dispatcher"); err != nil {
+		logger.Error("environment validation failed", "error", err)
+		os.Exit(1)
+	}
+
 	cfg, err := config.LoadDefaultConfig(context.Background())
 	if err != nil {
 		logger.Error("load AWS config", "error", err)

cmd/lambda/event-sink/main.go

@@ -19,6 +19,11 @@ import (
 func main() {
 	logger := slog.New(slog.NewJSONHandler(os.Stdout, nil))
 
+	if err := ilambda.ValidateEnv("event-sink"); err != nil {
+		logger.Error("environment validation failed", "error", err)
+		os.Exit(1)
+	}
+
 	cfg, err := awsconfig.LoadDefaultConfig(context.Background())
 	if err != nil {
 		logger.Error("failed to load AWS config", "error", err)

cmd/lambda/orchestrator/main.go

@@ -41,6 +41,11 @@ func (a *statusCheckerAdapter) CheckStatus(ctx context.Context, triggerType type
 func main() {
 	logger := slog.New(slog.NewJSONHandler(os.Stdout, nil))
 
+	if err := ilambda.ValidateEnv("orchestrator"); err != nil {
+		logger.Error("environment validation failed", "error", err)
+		os.Exit(1)
+	}
+
 	cfg, err := awsconfig.LoadDefaultConfig(context.Background())
 	if err != nil {
 		logger.Error("failed to load AWS config", "error", err)

cmd/lambda/sla-monitor/main.go

@@ -21,6 +21,11 @@ import (
 func main() {
 	logger := slog.New(slog.NewJSONHandler(os.Stdout, nil))
 
+	if err := ilambda.ValidateEnv("sla-monitor"); err != nil {
+		logger.Error("environment validation failed", "error", err)
+		os.Exit(1)
+	}
+
 	cfg, err := awsconfig.LoadDefaultConfig(context.Background())
 	if err != nil {
 		logger.Error("failed to load AWS config", "error", err)

cmd/lambda/stream-router/main.go

@@ -23,6 +23,11 @@ import (
 func main() {
 	logger := slog.New(slog.NewJSONHandler(os.Stdout, nil))
 
+	if err := ilambda.ValidateEnv("stream-router"); err != nil {
+		logger.Error("environment validation failed", "error", err)
+		os.Exit(1)
+	}
+
 	cfg, err := awsconfig.LoadDefaultConfig(context.Background())
 	if err != nil {
 		logger.Error("failed to load AWS config", "error", err)

cmd/lambda/watchdog/main.go

@@ -24,6 +24,11 @@ import (
 func main() {
 	logger := slog.New(slog.NewJSONHandler(os.Stdout, nil))
 
+	if err := ilambda.ValidateEnv("watchdog"); err != nil {
+		logger.Error("environment validation failed", "error", err)
+		os.Exit(1)
+	}
+
 	cfg, err := awsconfig.LoadDefaultConfig(context.Background())
 	if err != nil {
 		logger.Error("failed to load AWS config", "error", err)

internal/calendar/registry_test.go

@@ -5,6 +5,7 @@ import (
 	"path/filepath"
 	"testing"
 
+	"github.com/dwsmith1983/interlock/pkg/types"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -69,3 +70,57 @@ func TestRegistry_LoadDir_MissingDir(t *testing.T) {
 	err := reg.LoadDir("/nonexistent/path")
 	assert.Error(t, err)
 }
+
+func TestRegistry_Register_Success(t *testing.T) {
+	reg := NewRegistry()
+	cal := &types.Calendar{Name: "test-cal", Dates: []string{"2025-12-25"}}
+	require.NoError(t, reg.Register(cal))
+
+	retrieved := reg.Get("test-cal")
+	require.NotNil(t, retrieved)
+	assert.Equal(t, "test-cal", retrieved.Name)
+	assert.Contains(t, retrieved.Dates, "2025-12-25")
+}
+
+func TestRegistry_Register_NoName(t *testing.T) {
+	reg := NewRegistry()
+	err := reg.Register(&types.Calendar{})
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "no name")
+}
+
+func TestRegistry_LoadFile_InvalidYAML(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "bad.yaml")
+	require.NoError(t, os.WriteFile(path, []byte("{{invalid yaml"), 0o644))
+
+	reg := NewRegistry()
+	err := reg.LoadFile(path)
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "parsing YAML")
+}
+
+func TestRegistry_LoadFile_FileNotFound(t *testing.T) {
+	reg := NewRegistry()
+	err := reg.LoadFile("/nonexistent/calendar.yaml")
+	assert.Error(t, err)
+	assert.Contains(t, err.Error(), "reading file")
+}
+
+func TestRegistry_LoadDir_IgnoresSubdirs(t *testing.T) {
+	dir := t.TempDir()
+	require.NoError(t, os.MkdirAll(filepath.Join(dir, "subdir"), 0o755))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "subdir", "hidden.yaml"), []byte(`
+name: hidden
+dates: ["2025-01-01"]
+`), 0o644))
+	require.NoError(t, os.WriteFile(filepath.Join(dir, "main.yaml"), []byte(`
+name: main-cal
+dates: ["2025-12-25"]
+`), 0o644))
+
+	reg := NewRegistry()
+	require.NoError(t, reg.LoadDir(dir))
+	assert.NotNil(t, reg.Get("main-cal"), "top-level calendar should be loaded")
+	assert.Nil(t, reg.Get("hidden"), "subdirectory calendar should NOT be loaded")
+}

internal/lambda/defaults.go

@@ -0,0 +1,29 @@
+package lambda
+
+import "time"
+
+// Default timing constants for Step Function evaluation and job polling.
+const (
+	// DefaultEvalIntervalSec is the default evaluation loop interval (5 minutes).
+	DefaultEvalIntervalSec = 300
+
+	// DefaultEvalWindowSec is the default evaluation window (1 hour).
+	DefaultEvalWindowSec = 3600
+
+	// DefaultJobCheckIntervalSec is the default job status check interval (1 minute).
+	DefaultJobCheckIntervalSec = 60
+
+	// DefaultJobPollWindowSec is the default job poll window (1 hour).
+	DefaultJobPollWindowSec = 3600
+
+	// DefaultTriggerLockTTL is the default trigger lock duration when
+	// SFN_TIMEOUT_SECONDS is not set.
+	DefaultTriggerLockTTL = 4*time.Hour + 30*time.Minute
+
+	// TriggerLockBuffer is the padding added to the SFN timeout to
+	// derive the trigger lock TTL.
+	TriggerLockBuffer = 30 * time.Minute
+
+	// SFNExecNameMaxLen is the AWS limit for Step Function execution names.
+	SFNExecNameMaxLen = 80
+)

internal/lambda/doc.go

@@ -0,0 +1,18 @@
+// Package lambda implements the core business logic for the six AWS Lambda
+// handlers that power the Interlock pipeline safety framework:
+//
+//   - stream-router: processes DynamoDB stream events, evaluates trigger
+//     conditions, manages reruns, and detects post-run data drift
+//   - orchestrator: evaluates validation rules, executes triggers, polls
+//     job status, and manages trigger lifecycle
+//   - sla-monitor: calculates SLA deadlines, schedules/cancels EventBridge
+//     Scheduler entries, and fires warning/breach alerts
+//   - watchdog: detects silently missed pipeline schedules by scanning for
+//     pipelines that should have run but have no trigger record
+//   - event-sink: persists EventBridge events to DynamoDB for audit trail
+//   - alert-dispatcher: routes SQS alert messages to Slack
+//
+// All handlers share a common [Deps] struct for dependency injection,
+// making the package fully testable with mock implementations of AWS SDK
+// interfaces ([SFNAPI], [EventBridgeAPI], [SchedulerAPI], etc.).
+package lambda