@atmem/architect 0.0.0-stage → 0.2.0

package/src/identifiers.mjs

@@ -0,0 +1,15 @@
+import {sha256} from '@noble/hashes/sha2.js';
+const hex=bytes=>Array.from(bytes,b=>b.toString(16).padStart(2,'0')).join('');
+// Preserve established short addresses. Long Unicode identities use a bounded
+// digest token; original identities remain in project/manifest/requirement links.
+// Odd-length digest tokens cannot overlap any legacy even-length UTF-8 hex token.
+export function identityToken(value){
+ if(typeof value!=='string'||!value)throw Error('Use a nonempty component identity.');
+ try{encodeURIComponent(value);}catch{throw Error('Use a well-formed Unicode identity; no characters were replaced.');}
+ const bytes=new TextEncoder().encode(value);
+ return bytes.length<=124?hex(bytes):'d'+hex(sha256(bytes));
+}
+export const resourceAddress=id=>'block_'+identityToken(id);
+export function assertDistinctIdentifiers(ids,token=identityToken){
+ const seen=new Map();for(const id of ids){const name=token(id);if(seen.has(name))throw Error(seen.get(name)===id?'Duplicate component identity; no output was overwritten.':'Component namespace collision; retain both original identities and stop generation.');seen.set(name,id);}
+}

package/src/implementation-map.mjs

@@ -0,0 +1,14 @@
+import {inspectTerraformModules} from './terraform-admission.mjs';
+// Concrete links are derived from emitted files, not fabricated repository paths.
+export function implementationMap(project,plan,files){
+ const config=JSON.parse(files['main.tf.json']),admission=inspectTerraformModules(project,plan,files,config,()=>{});
+ const components=plan.rows.map(row=>{
+  const scope=admission.scopes.get(row.id),current=scope?.config||(admission.composed?{}:config);
+  const addresses=Object.entries(current.resource||{}).flatMap(([type,items])=>Object.keys(items).filter(name=>name===row.address||name.startsWith(row.address+'_')).map(name=>(scope?.prefix||'')+type+'.'+name));
+  const generatedFiles=Object.entries(files).filter(([name,body])=>scope?name.startsWith(scope.path+'/'):name!=='resource-schedule.json'&&(!admission.composed&&row.invoice||name.includes(row.address)||typeof body==='string'&&body.includes(row.address))).map(([name])=>'terraform/'+name);
+  const variables=scope?Object.keys(current.variable||{}).map(name=>name==='review_approved'?name:scope.module+'__'+name).filter(name=>Object.hasOwn(config.variable||{},name)):Object.keys(config.variable||{}).filter(name=>!admission.composed&&row.invoice||name.startsWith(row.address+'_'));
+  return {id:row.id,...(scope?{module:scope.module,modulePath:'terraform/'+scope.path}:{}),ownership:row.existing?'existing':row.sourceExisting?'existing_source_new_deployment':'proposed',terraformAddresses:addresses,generatedFiles,requiredInputs:variables,requirements:(project.needs||[]).filter(r=>r.links?.includes(row.id)).map(r=>r.id),applicationImplementation:project.nodes.find(n=>n.id===row.id)?.data.implementation==='approval-workflow'?'shared_api_assembly_only':row.containerContract?'supplied_image_required':row.existing?'external_behavior_unverified':generatedFiles.some(p=>p.includes('/handlers/'))?'generated_runtime_unverified':generatedFiles.some(p=>p.includes('/web/')||p.includes('/applications/'))?'generated_application_unverified':row.implemented&&addresses.length?'managed_service_configuration_unverified':'not_established'};
+ });
+ const interfaces=project.edges.map(edge=>({id:edge.id,source:edge.source,target:edge.target,purpose:edge.label||'',integration:edge.integration||null,access:edge.access||null,generated:!!plan.connections.find(e=>e.id===edge.id)?.generated,requiredContractFields:['request/event schema','response/result schema','identity and authorization','timeout','retry and idempotency','error and recovery','observability','acceptance fixtures'],status:'runtime_contract_evidence_required'}));
+ return {version:1,designRevision:project.revision,components,interfaces,commands:admission.composed?['terraform init -backend=false','terraform validate',...admission.configs.filter(s=>s.path).flatMap(s=>['terraform -chdir='+s.path+' init -backend=false','terraform -chdir='+s.path+' validate','terraform -chdir='+s.path+' test'])]:['terraform init -backend=false','terraform validate','terraform test'],evidenceBoundary:'File and resource links are generated artifact facts; runtime behavior and destination account validation require separate evidence.'};
+}

package/src/implementation-outcome.mjs

@@ -0,0 +1,8 @@
+// Raw conversation is retained as provenance, never presented as a finished brief.
+export function implementationOutcome(project){
+ if(project.brief?.application?.trim())return project.brief.application.trim();
+ const recorded=String(project.requirements||'').trim();
+ if(recorded&&!recorded.includes('\n'))return `Recorded project goal (scope requires confirmation): ${recorded}`;
+ const needs=(project.needs||[]).map(r=>r.statement).filter(Boolean);
+ return `System: ${project.name||'Unnamed system'}. Structured outcome requires confirmation.${needs.length?'\n\nRecorded requirements:\n'+needs.map(s=>'- '+s).join('\n'):''}`;
+}

package/src/incomplete-terraform.mjs

@@ -0,0 +1,9 @@
+import {existingReferenceFiles} from './existing-references.mjs';
+import {generationProviders} from './generation-provider.mjs';
+// Preserve intent for unsupported workloads without fabricating a different cloud.
+export function incompleteTerraform(project,plan,environment){
+ const providers=generationProviders(project);
+ const gaps=[...plan.gapDetails.map(g=>g.id),'provider-workload-implementation-required'];
+ const config={terraform:{required_version:'>= 1.7.0, < 2.0.0'},variable:{review_approved:{type:'bool',default:false}},locals:{unfinished_work:gaps},resource:{terraform_data:{review_gate:{input:{design_revision:project.revision,environment,requested_providers:providers},lifecycle:{precondition:[{condition:'${var.review_approved && length(local.unfinished_work) == 0}',error_message:'This workload has no complete compiler for the requested providers. Implement its required resources and connections before deployment.'}]}}}},output:{design_revision:{value:project.revision}}};
+ return {...existingReferenceFiles(project),'main.tf.json':JSON.stringify(config,null,2),'resource-schedule.json':JSON.stringify(plan,null,2),'generation-status.json':JSON.stringify({version:1,status:'implementation_required',providers,deployable:false,runtimeValidated:false,gaps},null,2),'README.md':`# Infrastructure implementation required\n\nRequested providers: ${providers.join(', ')||'not selected'}. No substitute provider or application resources have been generated. This file contains a blocking review gate only. It is not deployment infrastructure.\n\n${plan.gapDetails.map(g=>'- '+g.message).join('\n')}\n\nPreserve the design and implement the missing compiler capabilities; do not clear the gate to obtain a pass.\n`};
+}

package/src/integrations.ts

@@ -0,0 +1,137 @@
+/** AtMem AI Architect adapters for pinned upstream modules. See docs/merge-manifest.json. */
+import { AWS_SERVICES } from "./upstream/openarchflow/providers/aws.ts";
+import { AZURE_SERVICES } from "./upstream/openarchflow/providers/azure.ts";
+import { GENERIC_SERVICES } from "./upstream/openarchflow/providers/generic.ts";
+import { CLOUDNATIVE_SERVICES } from "./upstream/openarchflow/providers/cloudnative.ts";
+import { INTEGRATION_SERVICES } from "./upstream/openarchflow/providers/integration.ts";
+import { TEMPLATES } from "./upstream/openarchflow/templates.ts";
+import { parseMermaid } from "./upstream/openarchflow/import/mermaid.ts";
+import { parseSqlDdl } from "./upstream/openarchflow/import/sql-ddl.ts";
+import { getLayoutedElements } from "./upstream/openarchflow/layout.ts";
+export { prettyPayload } from "./upstream/openarchflow/format-payload.ts";
+
+const catalogues = [
+  ["aws", AWS_SERVICES],
+  ["azure", AZURE_SERVICES],
+  ["tools", GENERIC_SERVICES],
+  ["tools", CLOUDNATIVE_SERVICES],
+  ["tools", INTEGRATION_SERVICES],
+] as const;
+export const UPSTREAM_CATALOG = catalogues.flatMap(
+  ([provider, categories], group) =>
+    categories.flatMap((category, c) =>
+      category.items.map((item, i) => ({
+        id: `upstream-${group}-${c}-${i}`,
+        provider,
+        kind: "resource",
+        label: item.name,
+        description: item.description,
+        service: item.service,
+        category: category.category,
+        origin: "OpenArchFlow",
+        support: "design-only",
+      })),
+    ),
+);
+export const UPSTREAM_TEMPLATES = TEMPLATES;
+function convertGraph(parsed: any, name: string, provider = "tools") {
+  if (!parsed.nodes.length)
+    throw Error(
+      "No supported blocks found. Try a simple flowchart or CREATE TABLE statements.",
+    );
+  if (parsed.nodes.length > 100)
+    throw Error("Import is limited to 100 blocks.");
+  const ids = new Set(parsed.nodes.map((n: any) => n.id));
+  const edges = parsed.edges
+    .filter((e: any) => ids.has(e.source) && ids.has(e.target))
+    .map((e: any, i: number) => ({
+      id: `import-wire-${i}`,
+      source: e.source,
+      target: e.target,
+      label: String(e.label || "relationship"),
+      type: "smoothstep",
+    }));
+  const nodes = parsed.nodes.map((n: any) => ({
+    id: n.id,
+    type: "resource",
+    position: n.position,
+    data: {
+      kind: "resource",
+      provider:
+        n.data.provider === "azure"
+          ? "azure"
+          : n.data.provider === "aws"
+            ? "aws"
+            : provider,
+      label: String(n.data.label || "Imported block"),
+      description: "Imported architecture reference — no fixture executor",
+      service: n.data.service,
+      origin: "OpenArchFlow import",
+      config: {
+        region: "To be selected",
+        classification: "Internal",
+        timeout: 5000,
+      },
+      metadata: n.data.metadata,
+    },
+  }));
+  const layout = getLayoutedElements(nodes, edges, "LR");
+  return {
+    version: 1,
+    revision: 1,
+    name,
+    provider,
+    nodes: layout.nodes,
+    edges: layout.edges,
+    requirements:
+      "Imported architecture reference. Assign fixture behaviours explicitly before running. Relationships do not grant access or imply runtime compatibility.",
+    importReport: {
+      droppedEdges: parsed.edges.length - edges.length,
+      notice:
+        "Architecture-only import. Sequence lifelines, table port handles and non-runtime presentation are normalised; source-specific metadata is kept where available.",
+    },
+  };
+}
+export function importDiagram(code: string, format: string) {
+  if (code.length > 100000) throw Error("Paste fewer than 100,000 characters.");
+  if (format === "mermaid" && !/^\s*(flowchart|graph)\b/i.test(code))
+    throw Error("This integration currently supports Mermaid flowcharts only.");
+  if (format === "sql")
+    return convertGraph(parseSqlDdl(code), "Imported database schema");
+  if (format === "mermaid")
+    return convertGraph(parseMermaid(code), "Imported architecture diagram");
+  throw Error("Unsupported import format.");
+}
+export function importUpstreamProject(raw: any) {
+  if (!raw || !Array.isArray(raw.nodes) || !Array.isArray(raw.edges))
+    throw Error("OpenArchFlow import needs nodes and edges.");
+  const allowed = new Set(["aws", "azure", "gcp", "ibm", "tools"]);
+  const p = convertGraph(
+    raw,
+    String(raw.name || raw.diagramName || "OpenArchFlow architecture"),
+  );
+  p.nodes = p.nodes.map((n: any) => ({
+    ...n,
+    data: {
+      ...n.data,
+      provider: allowed.has(n.data.provider) ? n.data.provider : "tools",
+    },
+  }));
+  return p;
+}
+export function loadUpstreamTemplate(id: string) {
+  const t = TEMPLATES.find((t) => t.id === id);
+  if (!t) throw Error("Unknown template.");
+  return convertGraph(
+    t,
+    t.name,
+    t.category === "AWS" ? "aws" : t.category === "Azure" ? "azure" : "tools",
+  );
+}
+export function autoLayout(project: any) {
+  const nodes = project.nodes.map((n: any) => ({
+    ...n,
+    data: { ...n.data, inputPosition: "left", outputPosition: "right" },
+  }));
+  return { ...project, ...getLayoutedElements(nodes, project.edges, "LR") };
+}

package/src/interface-contracts.mjs

@@ -0,0 +1,30 @@
+import {STRUCTURED_OPERATION_POLICY as policy} from './structured-operation-policy.mjs';
+// Executable compiler contracts, not claims that the destination services were exercised.
+export function interfaceContracts(project,plan){
+ const nodes=new Map(project.nodes.map(n=>[n.id,n]));
+ return project.edges.map(edge=>{
+  const source=nodes.get(edge.source),target=nodes.get(edge.target),worker=plan.structuredApiPlan?.entries.find(e=>[e.api.id,e.worker.id].includes(edge.target)||[e.api.id,e.worker.id].includes(edge.source))?.worker;
+  const common={id:edge.id,source:edge.source,target:edge.target,integration:edge.integration||null,access:edge.access||null,generated:!!plan.connections.find(e=>e.id===edge.id)?.generated,runtimeEvidence:'not_attached',contractStatus:plan.connections.find(e=>e.id===edge.id)?.generated?'generated_unverified':'required_not_generated'};
+  const invoice=plan.invoicePlan?.entries.find(entry=>entry.row.id===edge.target||entry.row.id===edge.source);
+  if(invoice&&common.generated&&edge.integration==='browser-https')return {...common,transport:'Same-origin HTTPS assets, /api/session and /api/invoices; native staff sign-in, never a provisioned browser',request:{upload:'POST /api/invoices with application/pdf bytes, maximum 10000000 bytes; no caller account, storage path/version, destination or action supplied',review:'POST /api/invoices/{id}/review: exact revision, fields and bounded notes',approve:'POST /api/invoices/{id}/approve: exact revision only',read:'GET list/detail/original/history; paginated list/history; recover extraction through supervisor-authorized POST /api/invoices/{id}/recover'},response:'202 accepted invoice snapshot on upload; subsequent reads show durable review/delivery state. Acceptance is not extraction or external-action completion.',identity:'Provider-native verified staff identity plus current SQL membership on every operation. Reviewer/supervisor roles come from live membership, never JWT role names or request/document content. JWT revocation is bounded by native token lifetime.',authorization:'Same-origin checks on mutations, strict scope/account ownership and SQL role-specific function grants. Ordinary uploaders cannot approve. Edits invalidate prior approval; approved payload digest/revision is bound to dispatch.',idempotency:'Content digest and account/workflow operation identity deduplicate upload/queue work; immutable original version/digest are server-owned. Delivery effects require the separate accounting contract.',timeouts:'Upload streaming is bounded to 15 seconds and 10 MB; review bodies to 5 seconds and 10000 bytes. Worker/parser execution limits are separate and do not imply an end-to-end SLA.',retention:'90-day application access/cleanup eligibility; original versions, native backups and scheduled cleanup have separate lifecycle/restore windows. No exact global erasure promise.',tests:['invoice_http_acceptance.py','invoice_identity_acceptance.py','invoice_web_acceptance.py','invoice_operations_acceptance.py'],runtimeEvidence:'not_attached'};
+  if(invoice&&common.generated&&edge.integration==='approved-accounting-api')return {...common,transport:'Fixed operator-reviewed HTTPS POST, no redirect or proxy-derived destination; existing accounting system remains external',contract:'normalized-action-v1',request:{headers:['Content-Type: application/json','Authorization: Bearer <separately stored worker credential>','Idempotency-Key: <stable operation UUID>'],body:['operation_id','payload_sha256','kind=document','result']},response:{http:[200,201],contentType:'application/json',maximumBytes:8192,exactFields:['operation_id','payload_sha256','external_id','status=completed']},identity:'Worker-only destination credential; API/parser/operator jobs receive none. Endpoint digest, scope and mapping version are part of the approved snapshot.',approval:'Only a current allowed approved dispatch with matching operation ID, payload digest, destination contract and result revision can call the adapter.',timeouts:'8-second HTTPS connection/read operations with a separate bounded worker/process deadline; no redirect, 202-as-completed or arbitrary error-body logging.',idempotency:'Canonical approved payload and stable key survive retries. An ambiguous/expired dispatch becomes unknown; automatic replay requires separately reviewed scoped/expiring native accounting idempotency acceptance. A no-request retry cannot erase prior uncertainty.',recovery:'Supervisor/operator inspect the existing accounting service independently by operation ID/digest before recording a verified completion receipt. Never resend an uncertain action simply to clear a failure.',tests:['durable_postgres_acceptance.py','workflow_tls_destination_fixture.py','invoice_worker_acceptance.py'],boundary:'Generated normalized adapter and local TLS fixtures do not prove compatibility with this actual accounting API. Actual provider credentials, endpoint behavior, idempotency and reconciliation must be accepted separately.'};
+  const faq=plan.publicFaqPlan?.entries.find(e=>e.row.id===edge.target);
+  if(faq&&edge.integration==='public-catalog-edit'&&common.generated)return {...common,transport:'Local operator CLI to fixed native HTTPS object-store API; no app editing endpoint',identity:'Existing authorized company editor role/group supplied as reviewed destination input; generated role grants stay separate from workload read access',request:'Inspect current catalog version; explicitly confirm public-only init or conditional upsert/delete. Full UTF-8 articles, source-owned IDs/revisions and optional HTTPS links. No secrets in bundle or chat.',response:'Native ETag/generation after successful conditional write; concurrent edit yields conflict and requires reload/review. No automatic overwrite retry.',permissions:'AWS separate assumed role Get/Put on catalog.json; Azure container-scoped Blob Data Contributor; Google bucket-scoped object get/create/delete custom role; IBM bucket-scoped Object Reader/Object Writer existing access group. Inherited permissions require separate destination review.',acceptance:'Local native-transport fixtures test conditions, source updates/deletions and unauthorized/failed writes. Effective IAM and real storage APIs remain unverified.'};
+  if(faq&&edge.integration==='browser-https'&&common.generated)return {...common,transport:'HTTPS browser and POST /api/ask on the generated public application origin',request:{text:{type:'string',maxUtf8Bytes:2000}},response:{answer:'Bounded text',citations:'At most two source-owned IDs/titles/revisions/HTTPS URLs and exact supporting quotes',abstained:'Boolean; unknown or unsupported evidence yields a canonical abstention'},identity:'Explicit anonymous public-only reader; same-origin browser requests are not authentication. No private source or article-edit HTTP endpoint.',permissions:'Dedicated workload identity reads the private public-content catalog. Separate existing company editor identity receives native conditional catalog write authority. Destination role scopes are emitted in Terraform.',sourceLifecycle:'Read current version before retrieval and recheck before returning. Exact version/digest mismatch withholds the answer; missing/inaccessible source never serves cached or empty fallback. Operator CLI edits require observed version plus confirmation and native compare-and-swap.',limits:'100 genuinely public UTF-8 articles up to 30000 bytes each; at most two complete relevant articles, no silent truncation. Questions up to 2000 UTF-8 bytes, five admitted calls per instance and excess calls receive 429.',errors:{400:'Invalid text/body',403:'Missing/wrong Origin',413:'Oversize request',429:'Concurrency exhausted',503:'Unverified policy, source changed/unavailable, or invalid/unavailable model answer'},retries:'No automatic browser/model retry; conditional editor conflict requires reload/review. Clear cancels local presentation and rejects late responses.',quality:'Exact JSON, source membership and supporting quotes are checked; these do not prove factual entailment. Real answer/citation/abstention, freshness, IAM, model latency and budget/abuse testing remain required.'};
+  const azure=plan.azureStructuredPlan?.entries.find(e=>e.row.id===edge.target);
+  const google=plan.gcpStructuredPlan?.entries.find(e=>e.row.id===edge.target);
+  const ibm=plan.ibmStructuredPlan?.entries.find(e=>e.row.id===edge.target);
+  if(ibm&&edge.integration==='browser-https'&&common.generated)return {...common,transport:'HTTPS browser and POST /api/ask on the Code Engine origin',request:{text:{type:'string',maxUtf8Bytes:ibm.maxInput}},response:{result:ibm.contract.fields,requiresHumanReview:true},identity:'App ID RS256 signed access token, exact issuer/tenant/single-client audience, authenticated Cloud Directory user and process scope. S256 PKCE and state verification; access tokens remain in browser memory. Admin-enrolled subject allowlist in the NEW owned tenant.',revocation:'JWT scope authorization lasts until expiry. Immediate revocation, existing SSO and MFA are not established. Local workspace clearing does not claim provider logout.',permissions:'Exact Code Engine compute-resource link to dedicated trusted profile. Writer on the reviewed pm-20 runtime instance includes broader instance operations. Existing watsonx project collaborator membership is separate; no static application API key.',retention:'No app input/result persistence. Scoped expiring destination-owner policy review is operator-attested evidence, not an IBM approval API. Unknown review stops before workload authentication or inference.',errors:{400:'Invalid input',401:'Missing/invalid user access',403:'Wrong origin or authorization changed while running',413:'Oversize body',429:'Concurrency exhausted',503:'Unverified policy, model unavailable or invalid result'},retries:'One bounded regional Text Chat request; no automated actions or automatic retry.',operations:'Build/scan/test emitted Python source and immutable Linux image, obtain publish authorization, supply exact existing project/registry/pull-secret/model inputs. Enroll users and review exact subjects; starts with no authorized users. Verify separate watsonx collaborator access and actual identity/model behavior before deployment.'};
+  if(google&&edge.integration==='browser-https'&&common.generated)return {...common,transport:'HTTPS browser and POST /api/ask on the generated deterministic Cloud Run URL',request:{text:{type:'string',maxUtf8Bytes:google.maxInput}},response:{result:google.contract.fields,requiresHumanReview:true},identity:'IAP organization session and existing company group grant; Cloud Run IAM admits the IAP service agent. App validates every non-health request using ES256 IAP JWT, exact audience/issuer/user/lifetime and fixed Google keys; POST requires same-origin Origin.',revocation:'IAP group/session policy; signed headers remain valid until expiry/skew. No independent continuous directory check or proven MFA behavior.',permissions:'Dedicated keyless runtime account: project-level prediction plus read-only cache/publisher-config queries. Exact repository reader grant belongs to the Cloud Run platform agent; no model-policy writes or user-managed keys.',retention:'No app persistence. Destination-owner abuse-logging review is attested with exact project/model/region/evidence digest/expiry; separate runtime cache/logging/sharing reads fail closed. This is not universal zero-retention or independent provider approval proof.',errors:{400:'Invalid input',401:'Missing/invalid IAP identity',403:'Wrong/missing Origin or identity changed while running',413:'Oversize body',429:'Concurrency exhausted',503:'Unverified policy or invalid/unavailable model result'},retries:'No automatic browser/model retry. Verify actual platform latency, region availability and quotas separately.',operations:'Build/scan/test emitted Python 3.13 source and pinned Linux image, obtain authorization to publish to existing Artifact Registry, supply exact digest and reviewed destination/group/model/policy inputs. No Terraform build/deployment provisioner.'};
+  if(azure&&edge.integration==='browser-https'&&common.generated)return {...common,transport:'HTTPS assets and POST /api/ask on the generated App Service origin',request:{text:{type:'string',maxUtf8Bytes:azure.maxInput}},response:{result:azure.contract.fields,requiresHumanReview:true},identity:'Entra single-tenant v2 RS256 delegated access token; exact API audience, browser client, access_as_user scope and assigned WorkspaceUser role. The browser uses S256 PKCE with state verification; tokens stay in memory.',revocation:'JWT claims authorize until expiry. No continuous user/group revocation or tenant MFA policy is established by this module.',permissions:'User-assigned managed identity; model inference and Reader scoped to the generated model account; AcrPull on the exact existing reviewed registry. No client/model key or directory-admin permission for runtime.',errors:{400:'Invalid input',401:'Missing/invalid/expired access token',403:'Wrong origin or access expired while running',413:'Oversize body',429:'Application concurrency exhausted',503:'Policy unverified, model unavailable or invalid output'},retention:'No app persistence; account ContentLogging=false verified before sending input. Approval and provider terms require destination review.',retries:'No automatic application retry; one model HTTP request. User-visible browser deadline 28 seconds; per-transport timeouts are not a latency SLA.',operations:'Build emitted applications/* source and pinned image, validate it, publish to the existing ACR with authorization, then supply its digest and reviewed account/model/group inputs. No Terraform provisioner or automatic deployment.'};
+  if(worker&&edge.integration==='web-rag-api')return {...common,transport:'HTTPS POST /api/ask',request:{text:{type:'string',maxUtf8Bytes:worker.settings.maxInputBytes??16000}},response:{result:worker.settings.outputContract.fields,requiresHumanReview:true},identity:'Cognito access token in Authorization: Bearer; API Gateway verifies issuer, client audience and atmem/ask scope',errors:{400:'Invalid input',403:'Unavailable/disabled user or forbidden boundary',503:'Identity/model unavailable or invalid model output'},retention:'No input or result persistence; browser tokens in memory only',retries:'No automatic browser retry; SDK makes one model attempt for this HTTP composition',revocation:'Authoritative enabled/confirmed user and subject checked before model invocation and before returning; in-flight model cost is not undone'};
+  if(worker&&edge.integration==='http-api-lambda')return {...common,request:'API Gateway v2 event with verified JWT authorizer context; body is the exact text request above',response:'Lambda proxy statusCode, no-store JSON headers and serialized result/error body',identity:'Exact account-bound Gateway route is the only generated Lambda invocation permission; handler checks API ID, route, issuer, token use, scope, client, subject and Cognito user state',timeouts:`Gateway ${policy.gatewayDeadlineMs/1000} seconds; model connect ${policy.modelConnectSeconds}/read ${policy.modelReadSeconds} seconds; identity connect ${policy.identityConnectSeconds}/read ${policy.identityReadSeconds}, policy connect ${policy.policyConnectSeconds}/read ${policy.policyReadSeconds}; ${policy.sdkAttempts} SDK attempt per call. Verify destination latency independently.`,failure:'Fail closed; do not log input, tokens, model response or provider error text'};
+  if(source?.data.implementation==='bedrock-structured'&&source.data.config?.outputContract&&edge.integration==='bedrock-converse')return {...common,operation:'Bedrock Runtime Converse',request:'Configured bounded text plus compiler-owned instruction/output schema; direct reviewed regional foundation-model ARN',response:{fields:source.data.config.outputContract.fields,validation:'Strict JSON object: exact unique fields, bounded strings/enumerations, finite numbers, strict booleans; only end_turn admitted'},permissions:'bedrock:InvokeModel scoped to the selected regional foundation-model ARN; read-only regional GetAccountDataRetention with fail-closed mode none check',quality:'Schema checks do not prove factual or classification accuracy. Representative labeled acceptance fixtures and an authorized model test remain required.'};
+  const known={
+   'browser-https':{transport:'HTTPS',purpose:'Load web assets from the selected hosting endpoint; not a request to provision the browser'},
+   'oauth-pkce':{transport:'OAuth authorization code with S256 PKCE',identity:'Random state/verifier, callback-state validation, transient verifier removed after callback, tokens in memory',authorization:'Administrator-created users and MFA; inspect the emitted pool/client configuration'},
+   'jwt-authorizer':{purpose:'Bind the generated API route to the generated user-pool issuer, client audience and required access-token scope',boundary:'Gateway token verification and application access checks are distinct'},
+  }[edge.integration];
+  return {...common,...(known||{contractStatus:'Engineering contract required; inspect emitted resources and behavior before declaring this integration complete'})};
+ });
+}

package/src/invoice-application.mjs

@@ -0,0 +1,66 @@
+import sources from './runtime/invoice-sources.json' with{type:'json'};
+import {invoiceDependencies}from'./invoice-dependencies.mjs';
+import {pythonContainer}from'./python-container.mjs';
+import base from'./runtime/python-container-lock.json'with{type:'json'};
+import{invoiceTestFiles}from'./invoice-tests.mjs';
+
+// Application emission alone is not a supported/cloud-qualified project. Native
+// provider compilers and independent whole-export checks must admit composition.
+export function invoiceApplicationFiles(provider,address){
+ if(!['aws','azure','gcp','ibm'].includes(provider)||!/^block_[0-9a-f]+$/.test(address))throw Error('Use the exact owned invoice provider and address');
+ const root='applications/'+address+'/',files={},modules=Object.keys(sources).filter(name=>name.endsWith('.py')&&name!=='invoice_parser_service.py'&&name!=='invoice_parser_cli.py');
+ const assets=['workflow_schema.sql','invoice-web.html','invoice-web.css','invoice-web.js',...(provider==='aws'?['rds-global-ca.pem']:[])];
+ for(const name of [...modules,...assets])files[root+name]=sources[name];
+ const runtime=invoiceDependencies(provider),testing=invoiceDependencies(provider,{tests:true});
+ files[root+'requirements.lock']=runtime.requirements;files[root+'dependency-sources.json']=JSON.stringify({sources:runtime.sources,resolutions:runtime.resolutions},null,2)+'\n';
+ files[root+'test-requirements.lock']=testing.requirements;files[root+'test-dependency-sources.json']=JSON.stringify({sources:testing.sources,resolutions:testing.resolutions},null,2)+'\n';
+ files[root+'invoice-deployment.json']=JSON.stringify({format:'invoice-workflow-v1',provider},null,2)+'\n';
+ files[root+'container-base.json']=JSON.stringify(base,null,2)+'\n';
+ if(provider==='aws')files[root+'rds-ca-source.json']=sources['rds-ca-source.json'];
+ files[root+'Dockerfile']=pythonContainer('invoice_native',modules,['invoice-deployment.json'],{web:false,contract:false,assets,concurrency:32});
+ files[root+'.dockerignore']='*\n!requirements.lock\n!invoice-deployment.json\n'+[...modules,...assets].map(name=>'!'+name+'\n').join('');
+ const parserRoot=root+'parser/';for(const name of ['invoice_document.py','invoice_extraction.py','structured_output.py','invoice_parser_cli.py','invoice_parser_service.py','invoice_parser_identity.py','parser-requirements.lock','invoice-parser-python-lock.json','invoice-parser-lock.json'])files[parserRoot+name]=sources[name];
+ files[parserRoot+'Dockerfile']=sources['invoice-parser.Dockerfile'];
+ files[parserRoot+'.dockerignore']='*\n!invoice_document.py\n!invoice_extraction.py\n!structured_output.py\n!invoice_parser_cli.py\n!invoice_parser_service.py\n!invoice_parser_identity.py\n!parser-requirements.lock\n';
+ files[root+'BUILD.md']=INVOICE_BUILD;
+ return {...files,...invoiceTestFiles(provider,address)};
+}
+
+export const INVOICE_BUILD=`# Invoice application images
+
+This directory contains API/worker source and a separate bounded PDF/OCR image.
+Build both as Linux/amd64 and retain source/image digests and security reports.
+Use only the emitted exact wheel/native-package hashes and pinned container bases.
+The IBM lock deliberately uses dateutil 3.0.0 required by its SDK; the composed queue
+must be qualified with this dependency set, rather than borrowing another provider's
+test result. Installer tools are removed from the application delivery image.
+
+The API command is the image default. The dedicated worker command is
+python -I /app/invoice_worker.py. Parser hosting overrides its default CLI with
+python -I /app/invoice_parser_service.py. Do not run a Docker daemon in the worker.
+Keep the parser in a separate workload with no database, model, object-store or
+outbound action authority. Its private TLS ingress/caller restrictions are required
+native infrastructure, not an anonymous public HTTP service. Runtime identities,
+network and destination acceptance require separate destination checks.
+
+The API never receives a model credential or outbound action secret. The worker
+splits extraction and delivery into bounded child processes without database
+configuration in their environments. The 180-second extraction deadline includes
+object retrieval, up to 110 seconds of parsing/OCR and model/commit overhead inside
+a 600-second domain lease. Delivery is bounded to 45 seconds; unknown external
+outcomes require a verified same-key/same-payload idempotency contract or operator
+reconciliation. A failed new attempt cannot erase an older uncertain side effect.
+Child deadlines are not an OS sandbox; untrusted PDF parsing stays separate.
+
+Default worker concurrency is one, matched to one parser slot. Twenty uploads
+are admitted into the durable queue; they do not become twenty simultaneous OCR
+processes. Scale worker/parser capacity together only after throughput, model quotas
+and backpressure are tested. Capacity settings are not a price cap or SLA.
+
+Keep credentials outside this directory and source control. Mount native CA and
+secret files and supply the generated deployment environment. SQL role/bootstrap,
+membership, retention/restore and reviewed external accounting contract are required
+operational steps. Building this application does not prove those resources exist
+or declare the complete project ready. Obtain authorization before publication,
+account plans or deployment. Local checks do not establish cloud IAM or availability.
+`;

package/src/invoice-aws-operations.mjs

@@ -0,0 +1,136 @@
+import{v,r,l}from'./invoice-builder.mjs';
+
+// Fixed native jobs, not Terraform provisioners or API/model-accessible tools.
+export function awsInvoiceOperations(b,n,{account,region,privateSubnets,trust}){
+ const{add,input}=b;
+ for(const key of ['operations_enabled','maintenance_enabled']){b.variable[key]={type:'bool',default:false,description:key==='operations_enabled'?'Publish the reviewed runtime image, then create fixed operator task definitions before application release.':'Enable only after successful owned SQL bootstrap and membership admission. Starts daily cleanup/hourly monitoring.'};b.examples[key]=false;b.testExpressions[key]='true';}
+ const alert=input('operator_alert_topic_arn','Existing reviewed same-account regional SNS alert topic. Its owner must authorize CloudWatch publishing and verify an actual subscribed on-call route; this package does not modify that existing policy.','arn:aws:sns:'+b.examples.region+':123456789012:reviewed-operations','^arn:aws:sns:[a-z0-9-]+:[0-9]{12}:[A-Za-z0-9_-]{1,256}$');
+ b.resource.terraform_data.review_gate.lifecycle.precondition.push({condition:'${!var.maintenance_enabled || var.operations_enabled}',error_message:'Maintenance requires the separate operator tasks.'},{condition:'${!var.applications_enabled || (var.operations_enabled && var.maintenance_enabled)}',error_message:'Bootstrap owned SQL and staff access, then enable the operating jobs before application release.'},{condition:'${startswith(var.operator_alert_topic_arn,format("arn:aws:sns:%s:%s:",var.region,var.account_id))}',error_message:'Use the reviewed existing alert route in this account and region.'});
+ b.locals.operator_deployment=b.output.operator_deployment.value;
+ add('aws_security_group',n+'_operator',{name_prefix:l('name')+'-operator-',description:'Separate fixed operator jobs: private SQL and native image/secret/log transport',vpc_id:r('aws_vpc',n,'id')});
+ add('aws_vpc_security_group_ingress_rule',n+'_database_from_operator',{security_group_id:r('aws_security_group',n+'_database','id'),ip_protocol:'tcp',from_port:5432,to_port:5432,referenced_security_group_id:r('aws_security_group',n+'_operator','id')});
+ for(const [suffix,port,target]of[['sql',5432,{referenced_security_group_id:r('aws_security_group',n+'_database','id')}],['native_https',443,{cidr_ipv4:'0.0.0.0/0'}]])add('aws_vpc_security_group_egress_rule',n+'_operator_'+suffix,{security_group_id:r('aws_security_group',n+'_operator','id'),ip_protocol:'tcp',from_port:port,to_port:port,...target});
+ add('aws_cloudwatch_log_group',n+'_operator',{name:'/ecs/'+l('name')+'/operator',retention_in_days:7});
+ add('aws_iam_role',n+'_operator_execution',{name:l('name')+'-operator-execution',assume_role_policy:trust});
+ const secret=r('aws_db_instance',n,'master_user_secret[0].secret_arn');
+ add('aws_iam_role_policy',n+'_operator_execution',{role:r('aws_iam_role',n+'_operator_execution','id'),policy:JSON.stringify({Version:'2012-10-17',Statement:[{Effect:'Allow',Action:['ecr:GetAuthorizationToken'],Resource:'*'},{Effect:'Allow',Action:['ecr:BatchGetImage','ecr:GetDownloadUrlForLayer','ecr:BatchCheckLayerAvailability'],Resource:r('aws_ecr_repository',n+'_runtime','arn')},{Effect:'Allow',Action:['logs:CreateLogStream','logs:PutLogEvents'],Resource:r('aws_cloudwatch_log_group',n+'_operator','arn')+':*'},{Effect:'Allow',Action:['secretsmanager:GetSecretValue'],Resource:secret}]})});
+ const settings={REGION:region,DATABASE_NAME:'invoice',DATABASE_HOST:r('aws_db_instance',n,'address'),DATABASE_USER:'invoice_operator',DATABASE_CA_FILE:'/app/rds-global-ca.pem',OPERATOR_DEPLOYMENT_BASE64:'${base64encode(jsonencode(local.operator_deployment))}'};
+ for(const action of ['initialize','maintain','monitor']){
+  const init={name:'prepare-tmp',image:v('runtime_image'),essential:false,user:'0:0',readonlyRootFilesystem:true,command:['python','-I','-c','import os;os.chmod("/runtime-tmp",0o1777)'],mountPoints:[{sourceVolume:'runtime-tmp',containerPath:'/runtime-tmp',readOnly:false}]};
+  const container={name:'operator',image:v('runtime_image'),essential:true,readonlyRootFilesystem:true,command:['python','-I','/app/invoice_operator_job.py',action,'--execute'],environment:Object.entries(settings).map(([name,value])=>({name,value})),secrets:[{name:'DATABASE_PASSWORD',valueFrom:secret+':password::'}],mountPoints:[{sourceVolume:'runtime-tmp',containerPath:'/tmp',readOnly:false}],dependsOn:[{containerName:'prepare-tmp',condition:'SUCCESS'}],logConfiguration:{logDriver:'awslogs',options:{'awslogs-group':r('aws_cloudwatch_log_group',n+'_operator','name'),'awslogs-region':region,'awslogs-stream-prefix':action}}};
+  add('aws_ecs_task_definition',n+'_operator_'+action,{count:'${var.operations_enabled ? 1 : 0}',family:l('name')+'-'+action,network_mode:'awsvpc',requires_compatibilities:['FARGATE'],cpu:'512',memory:'1024',execution_role_arn:r('aws_iam_role',n+'_operator_execution','arn'),volume:{name:'runtime-tmp'},runtime_platform:{operating_system_family:'LINUX',cpu_architecture:'X86_64'},container_definitions:JSON.stringify([init,container]),depends_on:['aws_iam_role_policy.'+n+'_operator_execution']});
+ }
+ add('aws_sqs_queue',n+'_operator_failures',{name:l('name')+'-operator-failures',sqs_managed_sse_enabled:true,message_retention_seconds:604800,visibility_timeout_seconds:60,lifecycle:{prevent_destroy:true}});
+ add('aws_scheduler_schedule_group',n+'_operator',{name:l('name')+'-operator'});
+ add('aws_iam_role',n+'_operator_scheduler',{count:'${var.operations_enabled ? 1 : 0}',name:l('name')+'-operator-scheduler',assume_role_policy:JSON.stringify({Version:'2012-10-17',Statement:[{Effect:'Allow',Principal:{Service:'scheduler.amazonaws.com'},Action:'sts:AssumeRole',Condition:{StringEquals:{'aws:SourceAccount':account},ArnEquals:{'aws:SourceArn':r('aws_scheduler_schedule_group',n+'_operator','arn')}}}]})});
+ add('aws_iam_role_policy',n+'_operator_scheduler',{count:'${var.operations_enabled ? 1 : 0}',role:r('aws_iam_role',n+'_operator_scheduler[0]','id'),policy:JSON.stringify({Version:'2012-10-17',Statement:[{Effect:'Allow',Action:['ecs:RunTask'],Resource:['maintain','monitor'].map(action=>r('aws_ecs_task_definition',n+'_operator_'+action+'[0]','arn')),Condition:{ArnEquals:{'ecs:cluster':r('aws_ecs_cluster',n,'arn')}}},{Effect:'Allow',Action:['iam:PassRole'],Resource:r('aws_iam_role',n+'_operator_execution','arn'),Condition:{StringEquals:{'iam:PassedToService':'ecs-tasks.amazonaws.com'}}},{Effect:'Allow',Action:['sqs:SendMessage'],Resource:r('aws_sqs_queue',n+'_operator_failures','arn')}]})});
+ for(const[action,expression]of[['maintain','cron(17 2 * * ? *)'],['monitor','rate(1 hour)']]){
+  add('aws_scheduler_schedule',n+'_'+action,{count:'${var.operations_enabled ? 1 : 0}',name:l('name')+'-'+action,group_name:r('aws_scheduler_schedule_group',n+'_operator','name'),state:'${var.maintenance_enabled ? "ENABLED" : "DISABLED"}',schedule_expression:expression,schedule_expression_timezone:'UTC',flexible_time_window:{mode:'OFF'},target:{arn:r('aws_ecs_cluster',n,'arn'),role_arn:r('aws_iam_role',n+'_operator_scheduler[0]','arn'),ecs_parameters:{task_definition_arn:r('aws_ecs_task_definition',n+'_operator_'+action+'[0]','arn'),launch_type:'FARGATE',platform_version:'1.4.0',task_count:1,enable_execute_command:false,network_configuration:{subnets:privateSubnets,security_groups:[r('aws_security_group',n+'_operator','id')],assign_public_ip:false}},dead_letter_config:{arn:r('aws_sqs_queue',n+'_operator_failures','arn')},retry_policy:{maximum_event_age_in_seconds:3600,maximum_retry_attempts:2}},depends_on:['aws_iam_role_policy.'+n+'_operator_scheduler','aws_route_table_association.'+n+'_private_0','aws_route_table_association.'+n+'_private_1']});
+  add('aws_cloudwatch_log_metric_filter',n+'_'+action+'_success',{name:l('name')+'-'+action+'-success',log_group_name:r('aws_cloudwatch_log_group',n+'_operator','name'),pattern:'{ $.format = "invoice-operator-v1" && $.action = "'+action+'" && $.status = "ok" }',metric_transformation:{name:l('name')+'-'+action+'-success',namespace:'AtMem/InvoiceOperations',value:'1',default_value:0,unit:'Count'}});
+  add('aws_cloudwatch_metric_alarm',n+'_'+action+'_missing',{alarm_name:l('name')+'-'+action+'-missing',alarm_description:'No successful '+action+' receipt in two operating periods. Inspect owned operator task logs and failed-job queue; no payload is in the count-only receipt.',namespace:'AtMem/InvoiceOperations',metric_name:l('name')+'-'+action+'-success',statistic:'Sum',period:action==='maintain'?86400:3600,evaluation_periods:2,datapoints_to_alarm:2,threshold:1,comparison_operator:'LessThanThreshold',treat_missing_data:'breaching',actions_enabled:v('maintenance_enabled'),alarm_actions:[alert],ok_actions:[alert]});
+ }
+ const taskArns=['initialize','maintain','monitor'].map(action=>r('aws_ecs_task_definition',n+'_operator_'+action+'[0]','arn'));
+ add('aws_cloudwatch_event_rule',n+'_operator_stopped',{count:'${var.operations_enabled ? 1 : 0}',name:l('name')+'-operator-stopped',event_pattern:JSON.stringify({source:['aws.ecs'],'detail-type':['ECS Task State Change'],detail:{clusterArn:[r('aws_ecs_cluster',n,'arn')],taskDefinitionArn:taskArns,lastStatus:['STOPPED'],$or:[{stopCode:['TaskFailedToStart']},{containers:{name:['operator'],exitCode:[{'anything-but':0}]}}]}})});
+ add('aws_sqs_queue_policy',n+'_operator_failures',{count:'${var.operations_enabled ? 1 : 0}',queue_url:r('aws_sqs_queue',n+'_operator_failures','id'),policy:JSON.stringify({Version:'2012-10-17',Statement:[{Effect:'Allow',Principal:{Service:'events.amazonaws.com'},Action:'sqs:SendMessage',Resource:r('aws_sqs_queue',n+'_operator_failures','arn'),Condition:{ArnEquals:{'aws:SourceArn':r('aws_cloudwatch_event_rule',n+'_operator_stopped[0]','arn')},StringEquals:{'aws:SourceAccount':account}}}]})});
+ add('aws_cloudwatch_event_target',n+'_operator_stopped',{count:'${var.operations_enabled ? 1 : 0}',rule:r('aws_cloudwatch_event_rule',n+'_operator_stopped[0]','name'),arn:r('aws_sqs_queue',n+'_operator_failures','arn'),input:JSON.stringify({format:'invoice-operator-v1',status:'failed',code:'operator_task_stopped'}),depends_on:['aws_sqs_queue_policy.'+n+'_operator_failures']});
+ add('aws_cloudwatch_metric_alarm',n+'_operator_failures',{alarm_name:l('name')+'-operator-failed',alarm_description:'Operator task or schedule invocation failed. Inspect task logs and the private failed-job queue before retrying.',namespace:'AWS/SQS',metric_name:'ApproximateNumberOfMessagesVisible',dimensions:{QueueName:r('aws_sqs_queue',n+'_operator_failures','name')},statistic:'Maximum',period:300,evaluation_periods:1,threshold:0,comparison_operator:'GreaterThanThreshold',treat_missing_data:'notBreaching',actions_enabled:v('operations_enabled'),alarm_actions:[alert]});
+ b.output.operator_jobs={value:{cluster:r('aws_ecs_cluster',n,'arn'),privateSubnets,securityGroups:[r('aws_security_group',n+'_operator','id')],taskDefinitions:Object.fromEntries(['initialize','maintain','monitor'].map(action=>[action,'${try(aws_ecs_task_definition.'+n+'_operator_'+action+'[0].arn,null)}'])),failedJobQueue:r('aws_sqs_queue',n+'_operator_failures','id'),alertTopic:alert}};
+ b.output.operator_bootstrap_request={value:{cluster:r('aws_ecs_cluster',n,'arn'),taskDefinition:'${try(aws_ecs_task_definition.'+n+'_operator_initialize[0].arn,null)}',launchType:'FARGATE',platformVersion:'1.4.0',count:1,enableExecuteCommand:false,networkConfiguration:{awsvpcConfiguration:{subnets:privateSubnets,securityGroups:[r('aws_security_group',n+'_operator','id')],assignPublicIp:'DISABLED'}}}};
+ b.files['OPERATING_JOBS.md']=AWS_OPERATING_JOBS;
+ b.assertions.push(`run "operator_before_applications" {
+ command = plan
+ variables {
+ applications_enabled = false
+ maintenance_enabled = false
+ }
+ assert {
+ condition = length(aws_ecs_task_definition.${n}_operator_initialize) == 1 && length(aws_ecs_service.${n}_api) == 0 && aws_scheduler_schedule.${n}_maintain[0].state == "DISABLED" && aws_ecs_task_definition.${n}_operator_monitor[0].task_role_arn == null
+ error_message = "Fixed bootstrap tasks precede application release; schedules remain stopped and no task role is conferred."
+ }
+}
+
+run "operating_jobs_required" {
+ command = plan
+ variables {
+ operations_enabled = false
+ maintenance_enabled = false
+ }
+ expect_failures = [terraform_data.review_gate]
+}
+run "operator_mutable_image_rejected" {
+ command = plan
+ variables {
+ applications_enabled = false
+ maintenance_enabled = false
+ runtime_image = "unreviewed:latest"
+ }
+ expect_failures = [var.runtime_image]
+}
+`);
+}
+
+const AWS_OPERATING_JOBS=`# Fixed AWS invoice operating jobs
+
+These are generated definitions and commands, not evidence of a deployed service.
+Obtain destination authorization before apply, publication or RunTask. Keep an
+existing reviewed same-account regional SNS topic in operator_alert_topic_arn.
+Its owner must authorize CloudWatch publishing and verify an actual subscribed
+on-call route. If encrypted, the topic must use a compatible customer-managed KMS
+key whose policy admits CloudWatch; the default alias/aws/sns key is not sufficient. This package does not adopt or modify the existing topic/policy.
+
+1. Foundation: applications_enabled=false, operations_enabled=false,
+   maintenance_enabled=false. Review/apply only when authorized; publish the
+   scanned immutable runtime and parser images to the emitted ECR repositories.
+2. Bootstrap definitions: operations_enabled=true, applications_enabled=false,
+   maintenance_enabled=false, runtime_image set to the owned immutable digest.
+   This creates fixed tasks and disabled schedules; it does not execute SQL.
+3. From the authorized foundation state, write the nonsecret bootstrap request:
+
+       terraform output -json operator_bootstrap_request > .local/bootstrap.json
+       aws ecs run-task --cli-input-json file://.local/bootstrap.json
+
+   Use the same reviewed AWS account/region. Retain the returned task ARN, wait
+   for STOPPED and check operator exitCode=0 plus an initialized:true receipt in
+   the initialize log stream. A successful RunTask response alone only admits
+   scheduling; it does not prove SQL initialization. Failed start/nonzero exit
+   events reach the private operator-failures queue. No task role, accounting
+   credential, model or object authority is conferred on the operator container.
+   The execution role resolves only the managed RDS admin password field, image
+   and logs. The connection verifies the regional RDS CA/hostname. SQL transactions
+   and an advisory lock protect owned retries; existing passwords are preserved.
+4. Invite verified Cognito users and admit explicit application roles through
+   invoice_operator.py membership as described in OPERATIONS.md. No invitation
+   or sign-in silently grants reviewer/owner authority. Populate the accounting
+   secret outside Terraform/source. Retain native membership/denial checks.
+5. Release: applications_enabled=true, operations_enabled=true,
+   maintenance_enabled=true. The review gate refuses application release without
+   the operating definitions/schedules enabled. This flag does not prove step 3
+   or 4 ran: retain their actual destination receipts before approving release.
+
+Daily maintenance runs at 02:17 UTC. It removes at most twenty batches of 500
+expired SQL operations, with separate transactions and exact account/namespace
+ownership. Live execution jobs/leases refuse deletion. Table locks serialize
+concurrent submissions, preserving new/young operations. Remaining backlog returns
+nonzero; retry after inspecting count-only logs. Object lifecycle expiry remains
+independent and asynchronous. No scheduler IAM role can launch the bootstrap task.
+
+Hourly monitoring uses a read-only SQL transaction and emits scoped state counts.
+Pending/approved work unchanged for two hours, expired execution leases, dead or
+unknown outcomes and records overdue for cleanup by two days need attention.
+These are operational starting thresholds, not a promised throughput/latency SLA.
+Both jobs have a 15-minute process deadline; SQL waits/statements are bounded.
+
+Scheduler invocation failures go to the encrypted seven-day failure queue with
+bounded retries. Task failed-to-start/nonzero operator exits also reach that queue;
+this matters because RunTask acceptance is not application success. Queue alarms
+and missing-success-receipt alarms publish to the reviewed existing SNS topic.
+Daily/hourly heartbeat alarms breach after two missing periods. Bootstrap failures
+alarm as well; no bootstrap is scheduled. Operator logs retain seven days and do
+not include document data, subjects, amounts or SQL/password exception text.
+
+Test alert delivery, stopped-task routing, missed schedules, private SQL/TLS,
+native secret rotation and effective IAM in an authorized destination. Cloud
+availability, notification delivery and managed restore remain unverified by local
+schema/mocks. Keep restore/quarantine/reconciliation isolated and explicitly paused;
+daily cleanup does not authorize replaying uncertain external accounting effects.
+`;