@deployfoundation/foundation-deploy 0.2.48 → 0.2.50

package/agent-image/Dockerfile

@@ -161,7 +161,12 @@ ENV AWS_EC2_METADATA_SERVICE_ENDPOINT=http://169.254.169.254 \
 # loopback broker with it. poppler-utils supplies `pdftotext`, the ONLY way a
 # PDF dropped in a thread becomes readable text (files.ts shells out to it
 # rather than adding a PDF parser dependency); missing here, every PDF
-# silently degrades to a path the model cannot open.
+# silently degrades to a path the model cannot open. xz-utils (`xz`, the CLI
+# over the liblzma5 already in the base) unpacks `.tar.xz` downloads, and
+# `file` names what an attachment or download really is before the model
+# picks a tool for it. Together about 12 MB installed (most of it libmagic's
+# database); both are plain Debian CLIs that run no daemon and hold no
+# credentials. Olivia's turns reached for both and found neither.
 #
 # `upgrade` (not just `install`) is what picks up Debian security patches for
 # packages the base image baked in — without it, glibc/systemd/libcap2/liblzma5
@@ -175,7 +180,7 @@ RUN export DEBIAN_FRONTEND=noninteractive \
         libc6 libc-bin libsystemd0 libudev1 libcap2 liblzma5 sed \
     && apt-get install -y --no-install-recommends \
         python3 python3-venv python3-pip ca-certificates git curl \
-        poppler-utils \
+        poppler-utils xz-utils file \
         libasound2t64 libatk-bridge2.0-0t64 libatk1.0-0t64 libatspi2.0-0t64 \
         libcairo2 libcups2t64 libdbus-1-3 libdrm2 libgbm1 libglib2.0-0t64 \
         libnspr4 libnss3 libpango-1.0-0 libx11-6 libxcb1 libxcomposite1 \

package/dist/bin/app.js

@@ -8,13 +8,13 @@ import {
   FoundationPages,
   FoundationPipeline,
   NewsletterStack
-} from "../chunk-z4gsy5kh.js";
+} from "../chunk-efqdhd2e.js";
 import {
   adminsFor,
   instanceNames,
   loadInstanceFile,
   provisionsIntegration
-} from "../chunk-2tachxjf.js";
+} from "../chunk-gnz747z2.js";
 import"../chunk-dz91avrb.js";
 
 // bin/app.ts

package/dist/bin/foundation-deploy.js

@@ -22,12 +22,15 @@ import {
   slackCommandPrefix,
   verifyManifest,
   versionedConfigKey
-} from "../chunk-2tachxjf.js";
+} from "../chunk-gnz747z2.js";
 import {
   DEFAULT_RELEASE_BUCKET,
   expectedKeyArn
 } from "../chunk-dz91avrb.js";
 
+// src/deploy/cli.ts
+import { readFileSync as readFileSync10 } from "node:fs";
+
 // src/deploy/aws.ts
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -859,6 +862,33 @@ var UPWORK_GRAPHQL_DOCUMENTS = Object.freeze({
   $filter: VendorProposalFilter!
   $sortAttribute: VendorProposalSortAttribute!
   $pagination: Pagination!
+) {
+  vendorProposals(
+    filter: $filter
+    sortAttribute: $sortAttribute
+    pagination: $pagination
+  ) {
+    totalCount
+    edges {
+      node {
+        id
+        status { status }
+        marketplaceJobPosting { id content { title } }
+        terms { chargeRate { displayValue } }
+        viewedByClient
+        auditDetails { createdDateTime { rawValue } }
+      }
+    }
+    pageInfo { endCursor hasNextPage }
+  }
+}`
+  }),
+  list_proposals_basic: Object.freeze({
+    operationName: "FreelancerVendorProposalsBasic",
+    query: `query FreelancerVendorProposalsBasic(
+  $filter: VendorProposalFilter!
+  $sortAttribute: VendorProposalSortAttribute!
+  $pagination: Pagination!
 ) {
   vendorProposals(
     filter: $filter
@@ -2560,6 +2590,7 @@ Done. Now say \`@${ctx.instance.displayName} hello\` in Slack.`);
 
 // src/deploy/cli.ts
 var COMMANDS = [
+  "check",
   "deploy",
   "post-deploy",
   "config:sync",
@@ -2572,6 +2603,10 @@ var COMMANDS = [
 var USAGE = `usage: foundation-deploy <command> --instance <path> [options]
 
 commands
+  check                parse the instance and config files with THIS release's
+                       schema; no AWS. Run it on config PRs with the pinned
+                       version: a config the deployed release rejects puts the
+                       teammate on the fallback config.
   deploy               build and push the agent image, cdk deploy --all, refresh
                        the runtime secret, sync config
   post-deploy          smoke DEFAULT, probe the mount, promote \`live\`, smoke \`live\`
@@ -2650,6 +2685,18 @@ async function main(argv2 = process.argv.slice(2)) {
 ${USAGE}`);
     return 1;
   }
+  if (command === "check") {
+    const paths = loadInstanceContext(resolveInstanceFilePath(args, process.env));
+    try {
+      parseInstanceConfig(readFileSync10(paths.configPath, "utf8"));
+    } catch (error) {
+      console.error(`${paths.configPath} does not parse with this release (v${toolVersion()}):
+${error instanceof Error ? error.message : String(error)}`);
+      return 1;
+    }
+    console.log(`${paths.configPath} parses with this release (v${toolVersion()})`);
+    return 0;
+  }
   if (command === "slack-manifest") {
     const paths = loadInstanceContext(resolveInstanceFilePath(args, process.env));
     if (process.env.EVENTS_REQUEST_URL === undefined)

package/dist/bin/release-account.js

@@ -111,6 +111,11 @@ class ReleaseAccountStack extends cdk.Stack {
               actions: ["ecr:GetAuthorizationToken"],
               resources: ["*"]
             }),
+            new iam.PolicyStatement({
+              sid: "EcrPublicLogin",
+              actions: ["ecr-public:GetAuthorizationToken", "sts:GetServiceBearerToken"],
+              resources: ["*"]
+            }),
             new iam.PolicyStatement({
               sid: "SignManifest",
               actions: ["kms:Sign", "kms:GetPublicKey", "kms:DescribeKey"],

package/dist/{chunk-z4gsy5kh.js → chunk-efqdhd2e.js}

@@ -24,7 +24,7 @@ import {
   scheduledJobBindings,
   slackCommandPrefixes,
   webhookJobBindings
-} from "./chunk-2tachxjf.js";
+} from "./chunk-gnz747z2.js";
 
 // src/stacks/agent-stack.ts
 import * as cdk from "aws-cdk-lib";
@@ -670,9 +670,14 @@ class FoundationAgent extends cdk.Stack {
     }));
     role.addToPolicy(new iam.PolicyStatement({
       sid: "ConfigList",
-      actions: ["s3:ListBucket"],
+      actions: ["s3:ListBucket", "s3:ListBucketVersions"],
       resources: [props.bucket.bucketArn]
     }));
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "ConfigLastGood",
+      actions: ["s3:GetObjectVersion"],
+      resources: [props.bucket.arnForObjects("config/*")]
+    }));
     role.addToPolicy(new iam.PolicyStatement({
       sid: "DocumentsObjects",
       actions: ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
@@ -839,6 +844,7 @@ import * as cwActions from "aws-cdk-lib/aws-cloudwatch-actions";
 import * as iam2 from "aws-cdk-lib/aws-iam";
 import * as lambda from "aws-cdk-lib/aws-lambda";
 import * as lambdaEventSources from "aws-cdk-lib/aws-lambda-event-sources";
+import * as logs2 from "aws-cdk-lib/aws-logs";
 import * as scheduler from "aws-cdk-lib/aws-scheduler";
 import * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
 import * as sns from "aws-cdk-lib/aws-sns";
@@ -1629,18 +1635,31 @@ class FoundationApi extends cdk2.Stack {
       ["InvokeDlqDepthAlarm", this.invokeDlq]
     ]) {
       const alarm = new cloudwatch.Alarm(this, name, {
-        alarmDescription: `${name}: messages are sitting in the DLQ`,
-        metric: queue.metricApproximateNumberOfMessagesVisible({
+        alarmDescription: `${name}: new messages arrived in the DLQ. Inspect them before any redrive.`,
+        metric: new cloudwatch.MathExpression({
+          expression: "DIFF(FILL(depth, 0))",
+          usingMetrics: {
+            depth: queue.metricApproximateNumberOfMessagesVisible({
+              period: cdk2.Duration.minutes(5),
+              statistic: "Maximum"
+            })
+          },
           period: cdk2.Duration.minutes(5),
-          statistic: "Maximum"
+          label: "Messages added to the DLQ"
         }),
-        threshold: 1,
-        evaluationPeriods: 1,
-        comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+        threshold: 0,
+        comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD,
+        evaluationPeriods: 3,
+        datapointsToAlarm: 1,
         treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING
       });
       alarm.addAlarmAction(alarmAction);
     }
+    addConfigLoadAlarm(this, {
+      instance: props.instance,
+      agentRuntimeArn: props.agentRuntimeArn,
+      alarmAction
+    });
     let dispatcherFunctionName;
     if (configuredScheduledJobs.length > 0) {
       const dispatchRole = new iam2.Role(this, "ScheduledJobDispatcherRole", {
@@ -1757,6 +1776,65 @@ class FoundationApi extends cdk2.Stack {
     });
   }
 }
+var CONFIG_LOAD_FAILURE_EVENTS = ["config_fallback_active", "config_reload_failed"];
+function addConfigLoadAlarm(stack, args) {
+  if (args.agentRuntimeArn.endsWith("-pending"))
+    return;
+  const runtimeId = cdk2.Fn.select(1, cdk2.Fn.split("/", args.agentRuntimeArn));
+  const logGroupName = `/aws/bedrock-agentcore/runtimes/${runtimeId}-${LIVE_ENDPOINT_NAME}`;
+  const role = new iam2.Role(stack, "AgentLiveLogGroupRole", {
+    assumedBy: new iam2.ServicePrincipal("lambda.amazonaws.com"),
+    description: `${args.instance.displayName} creates the runtime's live log group when missing`,
+    managedPolicies: [
+      iam2.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")
+    ]
+  });
+  role.addToPolicy(new iam2.PolicyStatement({
+    sid: "CreateRuntimeLiveLogGroup",
+    actions: ["logs:CreateLogGroup"],
+    resources: [
+      `arn:${stack.partition}:logs:${stack.region}:${stack.account}:log-group:${logGroupName}`
+    ]
+  }));
+  const ensureFunction = new lambda.Function(stack, "AgentLiveLogGroupFunction", {
+    runtime: lambda.Runtime.NODEJS_22_X,
+    handler: "index.runtimeLogGroupHandler",
+    code: lambdaCode(stack, "gateway"),
+    role,
+    timeout: cdk2.Duration.seconds(30),
+    memorySize: 128
+  });
+  const ensureLogGroup = new cdk2.CustomResource(stack, "AgentLiveLogGroup", {
+    serviceToken: ensureFunction.functionArn,
+    resourceType: "Custom::FoundationRuntimeLogGroup",
+    properties: { LogGroupName: logGroupName }
+  });
+  ensureLogGroup.node.addDependency(role);
+  const filter = new logs2.MetricFilter(stack, "ConfigLoadFailureMetricFilter", {
+    logGroup: logs2.LogGroup.fromLogGroupName(stack, "AgentLiveLogs", logGroupName),
+    filterPattern: logs2.FilterPattern.any(...CONFIG_LOAD_FAILURE_EVENTS.map((event) => logs2.FilterPattern.stringValue("$.event", "=", event))),
+    metricNamespace: `Foundation/${args.instance.naming.prefix}`,
+    metricName: "ConfigLoadFailures",
+    metricValue: "1"
+  });
+  filter.node.addDependency(ensureLogGroup);
+  const alarm = new cloudwatch.Alarm(stack, "ConfigLoadFailureAlarm", {
+    alarmDescription: [
+      `${args.instance.displayName}'s runtime is not serving the config deployed for it: the`,
+      "config failed to load, so it runs on its last good config with company-data",
+      "capabilities off, or on the built-in fallback. The config_fallback_active or",
+      "config_reload_failed line in the runtime's live log group names the refused field.",
+      "Fix config.yaml, run foundation-deploy check, then deploy or config:sync."
+    ].join(" "),
+    metric: filter.metric({ statistic: "Sum", period: cdk2.Duration.hours(1) }),
+    threshold: 1,
+    evaluationPeriods: 1,
+    comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+    treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING
+  });
+  alarm.addAlarmAction(args.alarmAction);
+  return alarm;
+}
 function crmConfigForProvisioning(configPath) {
   const config = parseInstanceConfig(readFileSync(configPath, "utf8"));
   const crm = config.capabilities.crm;

package/dist/{chunk-2tachxjf.js → chunk-gnz747z2.js}

@@ -1975,4 +1975,4 @@ function ecrRepositoryArn(repositoryUri) {
   return `arn:aws:ecr:${region}:${account}:repository/${name}`;
 }
 
-export { parseSchedule, BASE_SLACK_EVENTS, CAPABILITY_IDS, requiredGithubPermissions, requiredSlackScopes, requiredSlackCommands, encodeProactiveChannels, CUSTOMIZATION_ARTIFACT_NAME, newsletterManifestFor, FOUNDATION_VERSION_RE, versionedConfigKey, instanceNames, slackCommandPrefix, slackCommandPrefixes, isScheduledJob, isWebhookJob, webhookJobBindings, scheduledJobBindings, jobWebhookKey, capabilityScheduledJobs, crmOutreachConfigured, crmPolicyFingerprint, parseInstanceConfig, loadInstanceFile, configPathFor, capabilityEnabled, requiresAuthenticatedQueue, enabledIntegrations, provisionsIntegration, adminsFor, WEB_SEARCH_TARGET, WEB_SEARCH_CONNECTOR_VERSION, LIVE_ENDPOINT_NAME, RELEASE_VERSION_RE, parseManifest, manifestKey, lambdaKey, skillsKey, buildManifest, manifestSigningPayload, verifyManifest, lambdaBundleContext, BUN_VERSION, LAMBDA_ENTRY_POINTS, skipBundle, RELEASE_BUCKET_ENV, RELEASE_DIR_ENV, releaseCacheDir, releaseSource, releaseAccess, lambdaCode, agentImage, agentImageTagRequired, releaseImageRepositoryArn, ecrRepositoryArn };
+export { parseSchedule, BASE_SLACK_EVENTS, CAPABILITY_IDS, requiredGithubPermissions, requiredSlackScopes, requiredSlackCommands, isScheduledJob, isWebhookJob, webhookJobBindings, scheduledJobBindings, jobWebhookKey, capabilityScheduledJobs, crmOutreachConfigured, crmPolicyFingerprint, parseInstanceConfig, encodeProactiveChannels, CUSTOMIZATION_ARTIFACT_NAME, newsletterManifestFor, FOUNDATION_VERSION_RE, versionedConfigKey, instanceNames, slackCommandPrefix, slackCommandPrefixes, loadInstanceFile, configPathFor, capabilityEnabled, requiresAuthenticatedQueue, enabledIntegrations, provisionsIntegration, adminsFor, WEB_SEARCH_TARGET, WEB_SEARCH_CONNECTOR_VERSION, LIVE_ENDPOINT_NAME, RELEASE_VERSION_RE, parseManifest, manifestKey, lambdaKey, skillsKey, buildManifest, manifestSigningPayload, verifyManifest, lambdaBundleContext, BUN_VERSION, LAMBDA_ENTRY_POINTS, skipBundle, RELEASE_BUCKET_ENV, RELEASE_DIR_ENV, releaseCacheDir, releaseSource, releaseAccess, lambdaCode, agentImage, agentImageTagRequired, releaseImageRepositoryArn, ecrRepositoryArn };

package/dist/src/index.js

@@ -10,7 +10,7 @@ import {
   FoundationPipeline,
   NewsletterStack,
   deployStatements
-} from "../chunk-z4gsy5kh.js";
+} from "../chunk-efqdhd2e.js";
 import {
   BUN_VERSION,
   LAMBDA_ENTRY_POINTS,
@@ -44,7 +44,7 @@ import {
   skillsKey,
   skipBundle,
   verifyManifest
-} from "../chunk-2tachxjf.js";
+} from "../chunk-gnz747z2.js";
 import"../chunk-dz91avrb.js";
 export {
   BUILD_TIMEOUT,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deployfoundation/foundation-deploy",
-  "version": "0.2.48",
+  "version": "0.2.50",
   "description": "Deploys one Foundation instance from a published, signed release: the CDK app and the deploy tool.",
   "license": "UNLICENSED",
   "private": false,

package/src/deploy/cli.ts

@@ -11,6 +11,8 @@
  * tree into a deploy would make every release of the tool carry a model
  * runtime it never executes.
  */
+import { readFileSync } from "node:fs";
+import { parseInstanceConfig } from "@deployfoundation/foundation-core";
 import { type AwsContext, awsContext } from "./aws.ts";
 import { configSync } from "./config-sync.ts";
 import { deploy } from "./deploy.ts";
@@ -18,12 +20,13 @@ import { githubAppCreate } from "./github-app-create.ts";
 import { instanceBanner, loadInstanceContext, resolveInstanceFilePath } from "./instance.ts";
 import { jobKey } from "./job-key.ts";
 import { postDeploy } from "./post-deploy.ts";
-import { releaseRequest, resolveRelease } from "./release.ts";
+import { releaseRequest, resolveRelease, toolVersion } from "./release.ts";
 import { setup } from "./setup.ts";
 import { slackManifestFor } from "./slack-manifest.ts";
 import { stageCustomization } from "./stage-customization.ts";
 
 export const COMMANDS = [
+  "check",
   "deploy",
   "post-deploy",
   "config:sync",
@@ -39,6 +42,10 @@ export type Command = (typeof COMMANDS)[number];
 export const USAGE = `usage: foundation-deploy <command> --instance <path> [options]
 
 commands
+  check                parse the instance and config files with THIS release's
+                       schema; no AWS. Run it on config PRs with the pinned
+                       version: a config the deployed release rejects puts the
+                       teammate on the fallback config.
   deploy               build and push the agent image, cdk deploy --all, refresh
                        the runtime secret, sync config
   post-deploy          smoke DEFAULT, probe the mount, promote \`live\`, smoke \`live\`
@@ -120,6 +127,23 @@ export async function main(argv: readonly string[] = process.argv.slice(2)): Pro
     return 1;
   }
 
+  // `check` reads files only, so it runs in a pull request with no credentials.
+  if (command === "check") {
+    const paths = loadInstanceContext(resolveInstanceFilePath(args, process.env));
+    try {
+      parseInstanceConfig(readFileSync(paths.configPath, "utf8"));
+    } catch (error) {
+      console.error(
+        `${paths.configPath} does not parse with this release (v${toolVersion()}):\n${
+          error instanceof Error ? error.message : String(error)
+        }`,
+      );
+      return 1;
+    }
+    console.log(`${paths.configPath} parses with this release (v${toolVersion()})`);
+    return 0;
+  }
+
   // `slack-manifest` writes a machine-readable document to stdout and must not
   // print a banner into it; every other command announces its target first.
   if (command === "slack-manifest") {

package/src/deploy/endpoint.ts

@@ -193,7 +193,9 @@ export async function currentRuntimeVersion(runner: EndpointRunner, id: string):
  * What a healthy `_smoke_test` response says. `config_source` is here because
  * a container that booted before its runtime secret named a bucket answers
  * happily from the fallback config — a green smoke test hiding a teammate that
- * knows none of its own configuration.
+ * knows none of its own configuration. A runtime whose config did not parse
+ * answers `last_good` (an earlier version of its config, fail-closed) or
+ * `fallback`, and fails here too.
  */
 export const SMOKE_EXPECT = ['"authenticated":true', '"config_source":"s3"'];
 

package/src/stacks/agent-stack.ts

@@ -1045,13 +1045,25 @@ export class FoundationAgent extends cdk.Stack {
         resources: [props.bucket.arnForObjects("memory/*")],
       }),
     );
+    // A boot whose own config object does not parse falls back to the newest
+    // earlier VERSION of that object that does (`loadLastGoodConfig` in the
+    // agent's server.ts): deployment-written, read-only, and readable only
+    // under `config/`. Listing versions reveals no more than `ListBucket`
+    // already does (key names), so it is not scoped further.
     role.addToPolicy(
       new iam.PolicyStatement({
         sid: "ConfigList",
-        actions: ["s3:ListBucket"],
+        actions: ["s3:ListBucket", "s3:ListBucketVersions"],
         resources: [props.bucket.bucketArn],
       }),
     );
+    role.addToPolicy(
+      new iam.PolicyStatement({
+        sid: "ConfigLastGood",
+        actions: ["s3:GetObjectVersion"],
+        resources: [props.bucket.arnForObjects("config/*")],
+      }),
+    );
     role.addToPolicy(
       new iam.PolicyStatement({
         sid: "DocumentsObjects",

package/src/stacks/api-stack.ts

@@ -27,6 +27,7 @@ import * as iam from "aws-cdk-lib/aws-iam";
 import type * as kms from "aws-cdk-lib/aws-kms";
 import * as lambda from "aws-cdk-lib/aws-lambda";
 import * as lambdaEventSources from "aws-cdk-lib/aws-lambda-event-sources";
+import * as logs from "aws-cdk-lib/aws-logs";
 import * as scheduler from "aws-cdk-lib/aws-scheduler";
 import * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
 import * as sns from "aws-cdk-lib/aws-sns";
@@ -100,9 +101,11 @@ export interface FoundationApiProps extends cdk.StackProps {
 /**
  * FoundationApi — the edge: API Gateway → gateway Lambda → SQS → invoker
  * Lambda → `InvokeAgentRuntime`. The gateway must answer Slack inside 3
- * seconds, so it only verifies, dedupes and enqueues; the invoker holds the
- * blocking agent turn for up to Lambda's 15 minutes (which is also
- * AgentCore's per-invoke ceiling).
+ * seconds, so it only verifies, dedupes and enqueues; the invoker follows the
+ * blocking agent turn for up to Lambda's 15 minutes. A longer turn keeps
+ * running in its session and posts its own answer: the invoker stops waiting
+ * just before its deadline and returns, so the message is deleted rather than
+ * failed into the DLQ (`DETACH_MARGIN_MS` in gateway/src/invoker.ts).
  *
  * Neither Lambda is VPC-attached. Everything they call — Secrets Manager,
  * SQS, DynamoDB, AgentCore — is a public AWS endpoint, so the VPC would buy
@@ -193,9 +196,9 @@ export class FoundationApi extends cdk.Stack {
       encryption: sqs.QueueEncryption.KMS,
       encryptionMasterKey: props.dataKey,
       enforceSSL: true,
-      // Matches the invoker's 15-minute timeout: Lambda extends visibility
-      // while the turn runs, and a dead invoker's message surfaces once and
-      // then rolls to the DLQ.
+      // Matches the invoker's 15-minute timeout. The invoker always returns
+      // before it, even on a longer turn, so only a crashed invoker's message
+      // surfaces again, and then it rolls to the DLQ instead of re-running.
       visibilityTimeout: cdk.Duration.seconds(900),
       retentionPeriod: cdk.Duration.hours(6),
       deadLetterQueue: { queue: this.invokeDlq, maxReceiveCount: 1 },
@@ -1229,25 +1232,51 @@ export class FoundationApi extends cdk.Stack {
       });
     }
     const alarmAction = new cwActions.SnsAction(alarmTopic);
-    // Depth ≥ 1 on either DLQ means a user's message was silently dropped —
-    // the only way anyone learns it needs a redrive.
+    // A message ARRIVING in either DLQ means a user's message was dropped, so
+    // the alarm fires on growth, not depth. A depth alarm (≥ 1) stays in ALARM
+    // while anything sits in the queue and never notifies again: Olivia's
+    // InvokeDlq alarm sat in ALARM from 2026-09-26 through every later
+    // arrival. This one clears once the depth stops growing and fires again
+    // on the next arrival.
+    //
+    // Not `NumberOfMessagesSent`: SQS does not count a message its redrive
+    // policy moves into a DLQ, which is how every InvokeDlq message arrives.
+    // FILL turns the first arrival into an empty, idle queue (which reports
+    // no data at all) into a step up from 0. One breaching period in three,
+    // because FILL also fills the newest period while its datapoint is still
+    // on the way; the step is caught once it lands. The 5-minute Maximum
+    // hides the brief dip of someone inspecting the queue.
     for (const [name, queue] of [
       ["GatewayDlqDepthAlarm", this.gatewayDlq],
       ["InvokeDlqDepthAlarm", this.invokeDlq],
     ] as const) {
       const alarm = new cloudwatch.Alarm(this, name, {
-        alarmDescription: `${name}: messages are sitting in the DLQ`,
-        metric: queue.metricApproximateNumberOfMessagesVisible({
+        alarmDescription: `${name}: new messages arrived in the DLQ. Inspect them before any redrive.`,
+        metric: new cloudwatch.MathExpression({
+          expression: "DIFF(FILL(depth, 0))",
+          usingMetrics: {
+            depth: queue.metricApproximateNumberOfMessagesVisible({
+              period: cdk.Duration.minutes(5),
+              statistic: "Maximum",
+            }),
+          },
           period: cdk.Duration.minutes(5),
-          statistic: "Maximum",
+          label: "Messages added to the DLQ",
         }),
-        threshold: 1,
-        evaluationPeriods: 1,
-        comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+        threshold: 0,
+        comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD,
+        evaluationPeriods: 3,
+        datapointsToAlarm: 1,
         treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
       });
       alarm.addAlarmAction(alarmAction);
     }
+    // The runtime serving anything but its deployed config.
+    addConfigLoadAlarm(this, {
+      instance: props.instance,
+      agentRuntimeArn: props.agentRuntimeArn,
+      alarmAction,
+    });
 
     // --- deployment-owned scheduled jobs --------------------------------
     // Config jobs never share the agent-managed routine group or pass role.
@@ -1387,6 +1416,102 @@ export class FoundationApi extends cdk.Stack {
   }
 }
 
+/** What the runtime logs when it is not serving its deployed config. */
+export const CONFIG_LOAD_FAILURE_EVENTS = ["config_fallback_active", "config_reload_failed"];
+
+/**
+ * Alarm when the runtime is not serving the config deployed for it.
+ *
+ * A config the runtime cannot parse used to leave it on the built-in fallback
+ * for hours with nobody told (Sky 2026-10-19, Olivia 2026-10-23). The runtime
+ * now logs `config_fallback_active` once per boot and `config_reload_failed`
+ * once per distinct failure in a warm container; this counts both in the
+ * `live` endpoint's log group, where every human's turn runs, and raises the
+ * instance's alarm topic.
+ *
+ * AgentCore creates that log group on the endpoint's first invocation, and
+ * `live` itself is created by the deploy tool after CloudFormation, so a new
+ * instance has no group for the metric filter to attach to. A custom resource
+ * (`runtimeLogGroupHandler`, in the release-signed gateway bundle) therefore
+ * creates it when it is missing, and leaves it alone when it exists or when
+ * this stack is deleted. A phase-one deploy has no runtime: nothing to watch.
+ *
+ * The period is an hour, not five minutes: the condition lasts until someone
+ * fixes the config, and a short period would re-notify after every quiet gap
+ * between turns.
+ */
+export function addConfigLoadAlarm(
+  stack: cdk.Stack,
+  args: {
+    instance: Instance;
+    agentRuntimeArn: string;
+    alarmAction: cloudwatch.IAlarmAction;
+  },
+): cloudwatch.Alarm | undefined {
+  if (args.agentRuntimeArn.endsWith("-pending")) return undefined;
+  const runtimeId = cdk.Fn.select(1, cdk.Fn.split("/", args.agentRuntimeArn));
+  const logGroupName = `/aws/bedrock-agentcore/runtimes/${runtimeId}-${LIVE_ENDPOINT_NAME}`;
+  const role = new iam.Role(stack, "AgentLiveLogGroupRole", {
+    assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
+    description: `${args.instance.displayName} creates the runtime's live log group when missing`,
+    managedPolicies: [
+      iam.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole"),
+    ],
+  });
+  role.addToPolicy(
+    new iam.PolicyStatement({
+      sid: "CreateRuntimeLiveLogGroup",
+      actions: ["logs:CreateLogGroup"],
+      resources: [
+        `arn:${stack.partition}:logs:${stack.region}:${stack.account}:log-group:${logGroupName}`,
+      ],
+    }),
+  );
+  const ensureFunction = new lambda.Function(stack, "AgentLiveLogGroupFunction", {
+    runtime: lambda.Runtime.NODEJS_22_X,
+    handler: "index.runtimeLogGroupHandler",
+    code: lambdaCode(stack, "gateway"),
+    role,
+    timeout: cdk.Duration.seconds(30),
+    memorySize: 128,
+  });
+  const ensureLogGroup = new cdk.CustomResource(stack, "AgentLiveLogGroup", {
+    serviceToken: ensureFunction.functionArn,
+    resourceType: "Custom::FoundationRuntimeLogGroup",
+    properties: { LogGroupName: logGroupName },
+  });
+  // The function needs its permission before CloudFormation invokes it.
+  ensureLogGroup.node.addDependency(role);
+  const filter = new logs.MetricFilter(stack, "ConfigLoadFailureMetricFilter", {
+    logGroup: logs.LogGroup.fromLogGroupName(stack, "AgentLiveLogs", logGroupName),
+    filterPattern: logs.FilterPattern.any(
+      ...CONFIG_LOAD_FAILURE_EVENTS.map((event) =>
+        logs.FilterPattern.stringValue("$.event", "=", event),
+      ),
+    ),
+    metricNamespace: `Foundation/${args.instance.naming.prefix}`,
+    metricName: "ConfigLoadFailures",
+    metricValue: "1",
+  });
+  filter.node.addDependency(ensureLogGroup);
+  const alarm = new cloudwatch.Alarm(stack, "ConfigLoadFailureAlarm", {
+    alarmDescription: [
+      `${args.instance.displayName}'s runtime is not serving the config deployed for it: the`,
+      "config failed to load, so it runs on its last good config with company-data",
+      "capabilities off, or on the built-in fallback. The config_fallback_active or",
+      "config_reload_failed line in the runtime's live log group names the refused field.",
+      "Fix config.yaml, run foundation-deploy check, then deploy or config:sync.",
+    ].join(" "),
+    metric: filter.metric({ statistic: "Sum", period: cdk.Duration.hours(1) }),
+    threshold: 1,
+    evaluationPeriods: 1,
+    comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+    treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
+  });
+  alarm.addAlarmAction(args.alarmAction);
+  return alarm;
+}
+
 interface ProvisionedCrmConfig {
   channels: string[];
   statuses: string[];

package/src/stacks/release-account-stack.ts

@@ -208,6 +208,13 @@ export class ReleaseAccountStack extends cdk.Stack {
               actions: ["ecr:GetAuthorizationToken"],
               resources: ["*"],
             }),
+            // Pull-only login to public ECR. Anonymous base-image pulls share
+            // the hosted runners' quota and failed v0.2.48's build with 429.
+            new iam.PolicyStatement({
+              sid: "EcrPublicLogin",
+              actions: ["ecr-public:GetAuthorizationToken", "sts:GetServiceBearerToken"],
+              resources: ["*"],
+            }),
             new iam.PolicyStatement({
               sid: "SignManifest",
               actions: ["kms:Sign", "kms:GetPublicKey", "kms:DescribeKey"],