From 7f9ad9a309b314c3b2995ac4b835bfd2a43df252 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=EC=98=A4=EC=A4=80=EC=84=9D=28Junseok=20Oh=29DevOps?=
 <52226147+Atom-oh@users.noreply.github.com>
Date: Fri, 4 Sep 2026 05:09:08 +0000
Subject: [PATCH] runbook: plan role trust includes the user-branch refs
 (own-stack plans on push)

---
 docs/runbooks/dev-repo-setup.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/runbooks/dev-repo-setup.md b/docs/runbooks/dev-repo-setup.md
index 5f501990c..c1b29d3d4 100644
--- a/docs/runbooks/dev-repo-setup.md
+++ b/docs/runbooks/dev-repo-setup.md
@@ -50,7 +50,7 @@ mutation roles. Role-to-sub matrix:
 | `sample-awsops-ci-deployer` | main roll / apply / agentcore (jobs carry `environment: production`) | StringEquals `repo:aws-samples/sample-awsops:environment:production` | prod ECS/ECR-pin/apply |
 | `sample-awsops-dev-ci-build` | dev + user-branch builds (no environment) | StringLike, one entry per branch: `...:ref:refs/heads/dev`, `...:ref:refs/heads/atomoh`, `...:ref:refs/heads/ssminji`, `...:ref:refs/heads/whchoi` | dev + user stacks' ECR push |
 | `sample-awsops-dev-ci-deployer` | dev + user-branch rolls, dev apply/agentcore (jobs carry `environment: development`) | StringEquals `repo:aws-samples/sample-awsops:environment:development` | dev + user stacks' ECS/ECR-pin/apply — **never production** |
-| `sample-awsops-ci-terraform-plan` | plan (PR/push, read-only) | StringLike: `...:ref:refs/heads/main`, `...:ref:refs/heads/dev`, `...:pull_request` | ReadOnlyAccess |
+| `sample-awsops-ci-terraform-plan` | plan (PR/push incl. user-branch own-stack plans, read-only) | StringLike: `...:pull_request` + refs `main`, `dev`, `atomoh`, `ssminji`, `whchoi` | ReadOnlyAccess |
 | `sample-awsops-ci-review` | AI pr-review | StringLike: `...:ref:refs/heads/main`, `...:ref:refs/heads/dev` | Bedrock invoke |
 
 CRITICAL sub rule: **a job that declares `environment:` presents the