[EstebanGZam]

What changes

• Decision D2 is amended. In docs/Governance and IaC standards program.md, the D2 row strikes the VPC quota increase and points to a new dated subsection. The subsection says:
  • the maintainer withdrew the increase on 2026-09-13;
  • deleting the default VPC (limit L1) becomes a precondition of the full profile, taken in its own approved operation;
  • us-east-1 has no VPC headroom, so a VPC replacement must destroy before it creates, and a sixth VPC reopens the decision;
  • Elastic IPs keep one of five spare.
• full-platform/capacity-and-regions.md records the same. Its header gains an Amended line, and §3 states that five VPCs of five is the ceiling. §6 decision 3 strikes "VPC quota raised to ten" and records the amendment.

Why

The maintainer did not want the rollout to wait on an AWS quota request. The limits already fit us-east-1 at five VPCs once the default VPC is deleted. Without the increase, that deletion can no longer wait for the retention period of the old persistent resources, which the registers had bundled it with.

Tasks

• microservice-app-ai-agents specs/001-governance-and-iac-program T039: withdrawn. The default VPC deletion becomes T043, and T032 drops it.
• microservice-app-ops specs/004-naming-convention-rebuild T026: drops the default VPC, which becomes T028.

No register lives in this repository. Both registers are updated in their paired pull requests, which cite this one.

• The task register is updated in this pull request
• Every task ticked here was verified by locating its artifact

No task is ticked.

How it is verified

The quota and the region, read-only, on 2026-09-13, through the Terraform deploy role in the declared account:

• aws service-quotas get-service-quota --service-code vpc --quota-code L-F678F1CE --region us-east-1 → VPCs per Region 5.0 True (adjustable).
• aws ec2 describe-vpcs --region us-east-1 → one VPC, the default 172.31.0.0/16.
• aws service-quotas get-service-quota --service-code ec2 --quota-code L-0263D0A3 → Elastic IPs 5.0; aws ec2 describe-addresses → 0 allocated.
• aws service-quotas list-requested-service-quota-change-history-by-quota --service-code vpc --quota-code L-F678F1CE → no request. The increase was never filed, so nothing is cancelled at AWS.

Documentation MCP (aws-knowledge), Amazon VPC quotas. "VPCs per Region | 5 | Yes": the default is five, and it is adjustable.

Consistency with spec 009. microservice-app-gitops spec 009 already requires the full profile to fit "the account's current approved quotas without requiring a quota increase" (spec.md), and its research lists a quota increase as avoided by the approved adaptation. The amendment brings D2 back in line with it.

Risk and rollback

No VPC headroom. A root that must replace its VPC, or any additional VPC, now needs either a destroy first or a new quota request with days of lead time. The amendment says so explicitly, so the next reviewer does not rediscover it at apply time.

Rollback. Revert this commit to restore the increase in D2.

What this PR does not do

• It does not delete the default VPC. That is an approval-gated operation, ai-agents T043 and ops spec 004 T028.
• It does not change the other limits L2–L6 or any other decision.
• It does not edit the historical execution plan, whose §1.3 options remain as written in its time.

Correction (2026-09-13): the default VPC deletion was numbered T043 here, but T043 already named the CloudTrail data-events task in the ai-agents register. It is renumbered T045 by microservice-app-ai-agents#35, microservice-app-ops#97, and microservice-app-docs#45.

🤖 Generated with Claude Code