@deployfoundation/foundation-deploy 0.2.49 → 0.2.51

package/agent-image/Dockerfile

@@ -20,6 +20,8 @@
 #     playwright-core 1.63.0 (exact pins + frozen lockfile in
 #     packages/infra/agent-image/open-slide/), whose Chrome Headless Shell
 #     build is pinned by the playwright-core version
+#   - Node.js 24.22.1 (LTS) with npm, and pnpm through corepack, for the
+#     repositories the agent clones and tests (see the node-provider stage)
 #
 # Secrets bootstrap: the container receives ONE pointer env var,
 # RUNTIME_SECRET_ID. At start, server.ts fetches that JSON secret from Secrets
@@ -40,6 +42,9 @@ ARG GH_VERSION=2.97.0
 # no ECR access; a deploy pipeline can override it with a mirrored tag to stay
 # clear of Docker Hub's anonymous rate limit.
 ARG BUN_IMAGE=oven/bun:1.4.0-slim
+# NODE_IMAGE: where the real Node.js comes from (node-provider stage). AWS's
+# mirror of the Docker official image, like golang below.
+ARG NODE_IMAGE=public.ecr.aws/docker/library/node:24.22.1-trixie-slim
 # GH_IMAGE: where the gh BINARY comes from. The default names the `gh-source`
 # stage below, so a local build compiles it; an override points at a prebuilt
 # image, and under BuildKit an unreferenced stage never runs — which takes the
@@ -129,6 +134,15 @@ COPY skills/slides/export_deck.mjs skills/slides/starter.tsx ./
 # below is what makes the choice load-bearing.
 FROM ${GH_IMAGE} AS gh-provider
 
+# --- Node.js (repositories the agent works in) -------------------------------
+# The bun base ships only Bun's `node` shim (/usr/local/bun-node-fallback-bin),
+# which refuses real Node invocations ("Missing script to execute"). Turns in a
+# Node repository then began by downloading and unpacking a Node tarball before
+# they could typecheck or test anything (Olivia, every PR turn, 2026-10). The
+# runtime stage copies the official build's binary and its bundled npm and
+# corepack from here; nothing else from this image is used.
+FROM ${NODE_IMAGE} AS node-provider
+
 # --- runtime ----------------------------------------------------------------
 FROM ${BUN_IMAGE}
 
@@ -142,8 +156,12 @@ ARG FOUNDATION_GITHUB_APP_ID=0
 # credential probe checks — without this pointer the omp Bedrock provider
 # refuses with "No API key found". The real IMDS control is the tool policy
 # denying 169.254.169.254, not an env var a raw curl could ignore.
+#
+# No NODE_ENV=production: nothing in Foundation reads it (the install below
+# passes --production itself), and the agent's shell inherits the container
+# env, so `pnpm install` and `npm install` in a cloned repository skipped its
+# devDependencies and every typecheck or test then failed on missing modules.
 ENV AWS_EC2_METADATA_SERVICE_ENDPOINT=http://169.254.169.254 \
-    NODE_ENV=production \
     PYTHONDONTWRITEBYTECODE=1 \
     PYTHONUNBUFFERED=1 \
     # omp env sheet: relocate the agent base to the baked container dir
@@ -161,7 +179,12 @@ ENV AWS_EC2_METADATA_SERVICE_ENDPOINT=http://169.254.169.254 \
 # loopback broker with it. poppler-utils supplies `pdftotext`, the ONLY way a
 # PDF dropped in a thread becomes readable text (files.ts shells out to it
 # rather than adding a PDF parser dependency); missing here, every PDF
-# silently degrades to a path the model cannot open.
+# silently degrades to a path the model cannot open. xz-utils (`xz`, the CLI
+# over the liblzma5 already in the base) unpacks `.tar.xz` downloads, and
+# `file` names what an attachment or download really is before the model
+# picks a tool for it. Together about 12 MB installed (most of it libmagic's
+# database); both are plain Debian CLIs that run no daemon and hold no
+# credentials. Olivia's turns reached for both and found neither.
 #
 # `upgrade` (not just `install`) is what picks up Debian security patches for
 # packages the base image baked in — without it, glibc/systemd/libcap2/liblzma5
@@ -175,7 +198,7 @@ RUN export DEBIAN_FRONTEND=noninteractive \
         libc6 libc-bin libsystemd0 libudev1 libcap2 liblzma5 sed \
     && apt-get install -y --no-install-recommends \
         python3 python3-venv python3-pip ca-certificates git curl \
-        poppler-utils \
+        poppler-utils xz-utils file \
         libasound2t64 libatk-bridge2.0-0t64 libatk1.0-0t64 libatspi2.0-0t64 \
         libcairo2 libcups2t64 libdbus-1-3 libdrm2 libgbm1 libglib2.0-0t64 \
         libnspr4 libnss3 libpango-1.0-0 libx11-6 libxcb1 libxcomposite1 \
@@ -234,6 +257,23 @@ RUN chmod 0755 /opt/sky/bin/export_deck
 ENV OPEN_SLIDE_HOME=/opt/open-slide \
     PLAYWRIGHT_BROWSERS_PATH=/opt/open-slide/browsers
 
+# --- Node.js, npm and pnpm (node-provider stage) -----------------------------
+# /usr/local/bin precedes the bun base's fallback directory on PATH, so `node`
+# is the real binary from here on; the build fails if it is not. pnpm is a
+# corepack shim: it runs the version a repository's `packageManager` names,
+# fetched on first use into the runtime user's cache, so no repository's pin is
+# baked into the product. The prompt corepack shows before that fetch would
+# stall a non-interactive shell.
+COPY --from=node-provider /usr/local/bin/node /usr/local/bin/node
+COPY --from=node-provider /usr/local/lib/node_modules /usr/local/lib/node_modules
+RUN ln -s ../lib/node_modules/npm/bin/npm-cli.js /usr/local/bin/npm \
+    && ln -s ../lib/node_modules/npm/bin/npx-cli.js /usr/local/bin/npx \
+    && ln -s ../lib/node_modules/corepack/dist/corepack.js /usr/local/bin/corepack \
+    && corepack enable --install-directory /usr/local/bin pnpm \
+    && test "$(command -v node)" = /usr/local/bin/node \
+    && node --version && npm --version && corepack --version
+ENV COREPACK_ENABLE_DOWNLOAD_PROMPT=0
+
 # /opt/sky/bin FIRST so `gh` and `aws` resolve to the wrappers, never the real
 # binaries.
 ENV PATH="/opt/sky/bin:${PATH}"

package/dist/bin/app.js

@@ -8,7 +8,7 @@ import {
   FoundationPages,
   FoundationPipeline,
   NewsletterStack
-} from "../chunk-6f2hkamj.js";
+} from "../chunk-efqdhd2e.js";
 import {
   adminsFor,
   instanceNames,

package/dist/bin/foundation-deploy.js

@@ -862,6 +862,33 @@ var UPWORK_GRAPHQL_DOCUMENTS = Object.freeze({
   $filter: VendorProposalFilter!
   $sortAttribute: VendorProposalSortAttribute!
   $pagination: Pagination!
+) {
+  vendorProposals(
+    filter: $filter
+    sortAttribute: $sortAttribute
+    pagination: $pagination
+  ) {
+    totalCount
+    edges {
+      node {
+        id
+        status { status }
+        marketplaceJobPosting { id content { title } }
+        terms { chargeRate { displayValue } }
+        viewedByClient
+        auditDetails { createdDateTime { rawValue } }
+      }
+    }
+    pageInfo { endCursor hasNextPage }
+  }
+}`
+  }),
+  list_proposals_basic: Object.freeze({
+    operationName: "FreelancerVendorProposalsBasic",
+    query: `query FreelancerVendorProposalsBasic(
+  $filter: VendorProposalFilter!
+  $sortAttribute: VendorProposalSortAttribute!
+  $pagination: Pagination!
 ) {
   vendorProposals(
     filter: $filter

package/dist/{chunk-6f2hkamj.js → chunk-efqdhd2e.js}

@@ -670,9 +670,14 @@ class FoundationAgent extends cdk.Stack {
     }));
     role.addToPolicy(new iam.PolicyStatement({
       sid: "ConfigList",
-      actions: ["s3:ListBucket"],
+      actions: ["s3:ListBucket", "s3:ListBucketVersions"],
       resources: [props.bucket.bucketArn]
     }));
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "ConfigLastGood",
+      actions: ["s3:GetObjectVersion"],
+      resources: [props.bucket.arnForObjects("config/*")]
+    }));
     role.addToPolicy(new iam.PolicyStatement({
       sid: "DocumentsObjects",
       actions: ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"],
@@ -839,6 +844,7 @@ import * as cwActions from "aws-cdk-lib/aws-cloudwatch-actions";
 import * as iam2 from "aws-cdk-lib/aws-iam";
 import * as lambda from "aws-cdk-lib/aws-lambda";
 import * as lambdaEventSources from "aws-cdk-lib/aws-lambda-event-sources";
+import * as logs2 from "aws-cdk-lib/aws-logs";
 import * as scheduler from "aws-cdk-lib/aws-scheduler";
 import * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
 import * as sns from "aws-cdk-lib/aws-sns";
@@ -1629,18 +1635,31 @@ class FoundationApi extends cdk2.Stack {
       ["InvokeDlqDepthAlarm", this.invokeDlq]
     ]) {
       const alarm = new cloudwatch.Alarm(this, name, {
-        alarmDescription: `${name}: messages are sitting in the DLQ`,
-        metric: queue.metricApproximateNumberOfMessagesVisible({
+        alarmDescription: `${name}: new messages arrived in the DLQ. Inspect them before any redrive.`,
+        metric: new cloudwatch.MathExpression({
+          expression: "DIFF(FILL(depth, 0))",
+          usingMetrics: {
+            depth: queue.metricApproximateNumberOfMessagesVisible({
+              period: cdk2.Duration.minutes(5),
+              statistic: "Maximum"
+            })
+          },
           period: cdk2.Duration.minutes(5),
-          statistic: "Maximum"
+          label: "Messages added to the DLQ"
         }),
-        threshold: 1,
-        evaluationPeriods: 1,
-        comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+        threshold: 0,
+        comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD,
+        evaluationPeriods: 3,
+        datapointsToAlarm: 1,
         treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING
       });
       alarm.addAlarmAction(alarmAction);
     }
+    addConfigLoadAlarm(this, {
+      instance: props.instance,
+      agentRuntimeArn: props.agentRuntimeArn,
+      alarmAction
+    });
     let dispatcherFunctionName;
     if (configuredScheduledJobs.length > 0) {
       const dispatchRole = new iam2.Role(this, "ScheduledJobDispatcherRole", {
@@ -1757,6 +1776,65 @@ class FoundationApi extends cdk2.Stack {
     });
   }
 }
+var CONFIG_LOAD_FAILURE_EVENTS = ["config_fallback_active", "config_reload_failed"];
+function addConfigLoadAlarm(stack, args) {
+  if (args.agentRuntimeArn.endsWith("-pending"))
+    return;
+  const runtimeId = cdk2.Fn.select(1, cdk2.Fn.split("/", args.agentRuntimeArn));
+  const logGroupName = `/aws/bedrock-agentcore/runtimes/${runtimeId}-${LIVE_ENDPOINT_NAME}`;
+  const role = new iam2.Role(stack, "AgentLiveLogGroupRole", {
+    assumedBy: new iam2.ServicePrincipal("lambda.amazonaws.com"),
+    description: `${args.instance.displayName} creates the runtime's live log group when missing`,
+    managedPolicies: [
+      iam2.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole")
+    ]
+  });
+  role.addToPolicy(new iam2.PolicyStatement({
+    sid: "CreateRuntimeLiveLogGroup",
+    actions: ["logs:CreateLogGroup"],
+    resources: [
+      `arn:${stack.partition}:logs:${stack.region}:${stack.account}:log-group:${logGroupName}`
+    ]
+  }));
+  const ensureFunction = new lambda.Function(stack, "AgentLiveLogGroupFunction", {
+    runtime: lambda.Runtime.NODEJS_22_X,
+    handler: "index.runtimeLogGroupHandler",
+    code: lambdaCode(stack, "gateway"),
+    role,
+    timeout: cdk2.Duration.seconds(30),
+    memorySize: 128
+  });
+  const ensureLogGroup = new cdk2.CustomResource(stack, "AgentLiveLogGroup", {
+    serviceToken: ensureFunction.functionArn,
+    resourceType: "Custom::FoundationRuntimeLogGroup",
+    properties: { LogGroupName: logGroupName }
+  });
+  ensureLogGroup.node.addDependency(role);
+  const filter = new logs2.MetricFilter(stack, "ConfigLoadFailureMetricFilter", {
+    logGroup: logs2.LogGroup.fromLogGroupName(stack, "AgentLiveLogs", logGroupName),
+    filterPattern: logs2.FilterPattern.any(...CONFIG_LOAD_FAILURE_EVENTS.map((event) => logs2.FilterPattern.stringValue("$.event", "=", event))),
+    metricNamespace: `Foundation/${args.instance.naming.prefix}`,
+    metricName: "ConfigLoadFailures",
+    metricValue: "1"
+  });
+  filter.node.addDependency(ensureLogGroup);
+  const alarm = new cloudwatch.Alarm(stack, "ConfigLoadFailureAlarm", {
+    alarmDescription: [
+      `${args.instance.displayName}'s runtime is not serving the config deployed for it: the`,
+      "config failed to load, so it runs on its last good config with company-data",
+      "capabilities off, or on the built-in fallback. The config_fallback_active or",
+      "config_reload_failed line in the runtime's live log group names the refused field.",
+      "Fix config.yaml, run foundation-deploy check, then deploy or config:sync."
+    ].join(" "),
+    metric: filter.metric({ statistic: "Sum", period: cdk2.Duration.hours(1) }),
+    threshold: 1,
+    evaluationPeriods: 1,
+    comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+    treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING
+  });
+  alarm.addAlarmAction(args.alarmAction);
+  return alarm;
+}
 function crmConfigForProvisioning(configPath) {
   const config = parseInstanceConfig(readFileSync(configPath, "utf8"));
   const crm = config.capabilities.crm;

package/dist/src/index.js

@@ -10,7 +10,7 @@ import {
   FoundationPipeline,
   NewsletterStack,
   deployStatements
-} from "../chunk-6f2hkamj.js";
+} from "../chunk-efqdhd2e.js";
 import {
   BUN_VERSION,
   LAMBDA_ENTRY_POINTS,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deployfoundation/foundation-deploy",
-  "version": "0.2.49",
+  "version": "0.2.51",
   "description": "Deploys one Foundation instance from a published, signed release: the CDK app and the deploy tool.",
   "license": "UNLICENSED",
   "private": false,

package/src/deploy/endpoint.ts

@@ -193,7 +193,9 @@ export async function currentRuntimeVersion(runner: EndpointRunner, id: string):
  * What a healthy `_smoke_test` response says. `config_source` is here because
  * a container that booted before its runtime secret named a bucket answers
  * happily from the fallback config — a green smoke test hiding a teammate that
- * knows none of its own configuration.
+ * knows none of its own configuration. A runtime whose config did not parse
+ * answers `last_good` (an earlier version of its config, fail-closed) or
+ * `fallback`, and fails here too.
  */
 export const SMOKE_EXPECT = ['"authenticated":true', '"config_source":"s3"'];
 

package/src/stacks/agent-stack.ts

@@ -1045,13 +1045,25 @@ export class FoundationAgent extends cdk.Stack {
         resources: [props.bucket.arnForObjects("memory/*")],
       }),
     );
+    // A boot whose own config object does not parse falls back to the newest
+    // earlier VERSION of that object that does (`loadLastGoodConfig` in the
+    // agent's server.ts): deployment-written, read-only, and readable only
+    // under `config/`. Listing versions reveals no more than `ListBucket`
+    // already does (key names), so it is not scoped further.
     role.addToPolicy(
       new iam.PolicyStatement({
         sid: "ConfigList",
-        actions: ["s3:ListBucket"],
+        actions: ["s3:ListBucket", "s3:ListBucketVersions"],
         resources: [props.bucket.bucketArn],
       }),
     );
+    role.addToPolicy(
+      new iam.PolicyStatement({
+        sid: "ConfigLastGood",
+        actions: ["s3:GetObjectVersion"],
+        resources: [props.bucket.arnForObjects("config/*")],
+      }),
+    );
     role.addToPolicy(
       new iam.PolicyStatement({
         sid: "DocumentsObjects",

package/src/stacks/api-stack.ts

@@ -27,6 +27,7 @@ import * as iam from "aws-cdk-lib/aws-iam";
 import type * as kms from "aws-cdk-lib/aws-kms";
 import * as lambda from "aws-cdk-lib/aws-lambda";
 import * as lambdaEventSources from "aws-cdk-lib/aws-lambda-event-sources";
+import * as logs from "aws-cdk-lib/aws-logs";
 import * as scheduler from "aws-cdk-lib/aws-scheduler";
 import * as secretsmanager from "aws-cdk-lib/aws-secretsmanager";
 import * as sns from "aws-cdk-lib/aws-sns";
@@ -100,9 +101,11 @@ export interface FoundationApiProps extends cdk.StackProps {
 /**
  * FoundationApi — the edge: API Gateway → gateway Lambda → SQS → invoker
  * Lambda → `InvokeAgentRuntime`. The gateway must answer Slack inside 3
- * seconds, so it only verifies, dedupes and enqueues; the invoker holds the
- * blocking agent turn for up to Lambda's 15 minutes (which is also
- * AgentCore's per-invoke ceiling).
+ * seconds, so it only verifies, dedupes and enqueues; the invoker follows the
+ * blocking agent turn for up to Lambda's 15 minutes. A longer turn keeps
+ * running in its session and posts its own answer: the invoker stops waiting
+ * just before its deadline and returns, so the message is deleted rather than
+ * failed into the DLQ (`DETACH_MARGIN_MS` in gateway/src/invoker.ts).
  *
  * Neither Lambda is VPC-attached. Everything they call — Secrets Manager,
  * SQS, DynamoDB, AgentCore — is a public AWS endpoint, so the VPC would buy
@@ -193,9 +196,9 @@ export class FoundationApi extends cdk.Stack {
       encryption: sqs.QueueEncryption.KMS,
       encryptionMasterKey: props.dataKey,
       enforceSSL: true,
-      // Matches the invoker's 15-minute timeout: Lambda extends visibility
-      // while the turn runs, and a dead invoker's message surfaces once and
-      // then rolls to the DLQ.
+      // Matches the invoker's 15-minute timeout. The invoker always returns
+      // before it, even on a longer turn, so only a crashed invoker's message
+      // surfaces again, and then it rolls to the DLQ instead of re-running.
       visibilityTimeout: cdk.Duration.seconds(900),
       retentionPeriod: cdk.Duration.hours(6),
       deadLetterQueue: { queue: this.invokeDlq, maxReceiveCount: 1 },
@@ -1229,25 +1232,51 @@ export class FoundationApi extends cdk.Stack {
       });
     }
     const alarmAction = new cwActions.SnsAction(alarmTopic);
-    // Depth ≥ 1 on either DLQ means a user's message was silently dropped —
-    // the only way anyone learns it needs a redrive.
+    // A message ARRIVING in either DLQ means a user's message was dropped, so
+    // the alarm fires on growth, not depth. A depth alarm (≥ 1) stays in ALARM
+    // while anything sits in the queue and never notifies again: Olivia's
+    // InvokeDlq alarm sat in ALARM from 2026-09-26 through every later
+    // arrival. This one clears once the depth stops growing and fires again
+    // on the next arrival.
+    //
+    // Not `NumberOfMessagesSent`: SQS does not count a message its redrive
+    // policy moves into a DLQ, which is how every InvokeDlq message arrives.
+    // FILL turns the first arrival into an empty, idle queue (which reports
+    // no data at all) into a step up from 0. One breaching period in three,
+    // because FILL also fills the newest period while its datapoint is still
+    // on the way; the step is caught once it lands. The 5-minute Maximum
+    // hides the brief dip of someone inspecting the queue.
     for (const [name, queue] of [
       ["GatewayDlqDepthAlarm", this.gatewayDlq],
       ["InvokeDlqDepthAlarm", this.invokeDlq],
     ] as const) {
       const alarm = new cloudwatch.Alarm(this, name, {
-        alarmDescription: `${name}: messages are sitting in the DLQ`,
-        metric: queue.metricApproximateNumberOfMessagesVisible({
+        alarmDescription: `${name}: new messages arrived in the DLQ. Inspect them before any redrive.`,
+        metric: new cloudwatch.MathExpression({
+          expression: "DIFF(FILL(depth, 0))",
+          usingMetrics: {
+            depth: queue.metricApproximateNumberOfMessagesVisible({
+              period: cdk.Duration.minutes(5),
+              statistic: "Maximum",
+            }),
+          },
           period: cdk.Duration.minutes(5),
-          statistic: "Maximum",
+          label: "Messages added to the DLQ",
         }),
-        threshold: 1,
-        evaluationPeriods: 1,
-        comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+        threshold: 0,
+        comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_THRESHOLD,
+        evaluationPeriods: 3,
+        datapointsToAlarm: 1,
         treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
       });
       alarm.addAlarmAction(alarmAction);
     }
+    // The runtime serving anything but its deployed config.
+    addConfigLoadAlarm(this, {
+      instance: props.instance,
+      agentRuntimeArn: props.agentRuntimeArn,
+      alarmAction,
+    });
 
     // --- deployment-owned scheduled jobs --------------------------------
     // Config jobs never share the agent-managed routine group or pass role.
@@ -1387,6 +1416,102 @@ export class FoundationApi extends cdk.Stack {
   }
 }
 
+/** What the runtime logs when it is not serving its deployed config. */
+export const CONFIG_LOAD_FAILURE_EVENTS = ["config_fallback_active", "config_reload_failed"];
+
+/**
+ * Alarm when the runtime is not serving the config deployed for it.
+ *
+ * A config the runtime cannot parse used to leave it on the built-in fallback
+ * for hours with nobody told (Sky 2026-10-19, Olivia 2026-10-23). The runtime
+ * now logs `config_fallback_active` once per boot and `config_reload_failed`
+ * once per distinct failure in a warm container; this counts both in the
+ * `live` endpoint's log group, where every human's turn runs, and raises the
+ * instance's alarm topic.
+ *
+ * AgentCore creates that log group on the endpoint's first invocation, and
+ * `live` itself is created by the deploy tool after CloudFormation, so a new
+ * instance has no group for the metric filter to attach to. A custom resource
+ * (`runtimeLogGroupHandler`, in the release-signed gateway bundle) therefore
+ * creates it when it is missing, and leaves it alone when it exists or when
+ * this stack is deleted. A phase-one deploy has no runtime: nothing to watch.
+ *
+ * The period is an hour, not five minutes: the condition lasts until someone
+ * fixes the config, and a short period would re-notify after every quiet gap
+ * between turns.
+ */
+export function addConfigLoadAlarm(
+  stack: cdk.Stack,
+  args: {
+    instance: Instance;
+    agentRuntimeArn: string;
+    alarmAction: cloudwatch.IAlarmAction;
+  },
+): cloudwatch.Alarm | undefined {
+  if (args.agentRuntimeArn.endsWith("-pending")) return undefined;
+  const runtimeId = cdk.Fn.select(1, cdk.Fn.split("/", args.agentRuntimeArn));
+  const logGroupName = `/aws/bedrock-agentcore/runtimes/${runtimeId}-${LIVE_ENDPOINT_NAME}`;
+  const role = new iam.Role(stack, "AgentLiveLogGroupRole", {
+    assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
+    description: `${args.instance.displayName} creates the runtime's live log group when missing`,
+    managedPolicies: [
+      iam.ManagedPolicy.fromAwsManagedPolicyName("service-role/AWSLambdaBasicExecutionRole"),
+    ],
+  });
+  role.addToPolicy(
+    new iam.PolicyStatement({
+      sid: "CreateRuntimeLiveLogGroup",
+      actions: ["logs:CreateLogGroup"],
+      resources: [
+        `arn:${stack.partition}:logs:${stack.region}:${stack.account}:log-group:${logGroupName}`,
+      ],
+    }),
+  );
+  const ensureFunction = new lambda.Function(stack, "AgentLiveLogGroupFunction", {
+    runtime: lambda.Runtime.NODEJS_22_X,
+    handler: "index.runtimeLogGroupHandler",
+    code: lambdaCode(stack, "gateway"),
+    role,
+    timeout: cdk.Duration.seconds(30),
+    memorySize: 128,
+  });
+  const ensureLogGroup = new cdk.CustomResource(stack, "AgentLiveLogGroup", {
+    serviceToken: ensureFunction.functionArn,
+    resourceType: "Custom::FoundationRuntimeLogGroup",
+    properties: { LogGroupName: logGroupName },
+  });
+  // The function needs its permission before CloudFormation invokes it.
+  ensureLogGroup.node.addDependency(role);
+  const filter = new logs.MetricFilter(stack, "ConfigLoadFailureMetricFilter", {
+    logGroup: logs.LogGroup.fromLogGroupName(stack, "AgentLiveLogs", logGroupName),
+    filterPattern: logs.FilterPattern.any(
+      ...CONFIG_LOAD_FAILURE_EVENTS.map((event) =>
+        logs.FilterPattern.stringValue("$.event", "=", event),
+      ),
+    ),
+    metricNamespace: `Foundation/${args.instance.naming.prefix}`,
+    metricName: "ConfigLoadFailures",
+    metricValue: "1",
+  });
+  filter.node.addDependency(ensureLogGroup);
+  const alarm = new cloudwatch.Alarm(stack, "ConfigLoadFailureAlarm", {
+    alarmDescription: [
+      `${args.instance.displayName}'s runtime is not serving the config deployed for it: the`,
+      "config failed to load, so it runs on its last good config with company-data",
+      "capabilities off, or on the built-in fallback. The config_fallback_active or",
+      "config_reload_failed line in the runtime's live log group names the refused field.",
+      "Fix config.yaml, run foundation-deploy check, then deploy or config:sync.",
+    ].join(" "),
+    metric: filter.metric({ statistic: "Sum", period: cdk.Duration.hours(1) }),
+    threshold: 1,
+    evaluationPeriods: 1,
+    comparisonOperator: cloudwatch.ComparisonOperator.GREATER_THAN_OR_EQUAL_TO_THRESHOLD,
+    treatMissingData: cloudwatch.TreatMissingData.NOT_BREACHING,
+  });
+  alarm.addAlarmAction(args.alarmAction);
+  return alarm;
+}
+
 interface ProvisionedCrmConfig {
   channels: string[];
   statuses: string[];