@integrity-labs/agt-cli 0.28.670 → 0.28.671

package/dist/{chunk-HGVJVYKW.js → chunk-DWFN5PMF.js}

@@ -5669,6 +5669,27 @@ var FLAG_REGISTRY = [
     // never auto-attach an integration nobody asked for, and both ENG-8332
     // prerequisites above are still open.
     defaultValue: false
+  },
+  {
+    key: "host-right-sizing",
+    description: 'ADR-0072. Gates the HostRightSizer cron, which evaluates every managed EC2 host against 7 days of memory and CPU and (at enforce) resizes it one rung inside the host\'s own maintenance window. off = the cron returns immediately: nothing is read, nothing is written. shadow = evaluate, persist a verdict row per host, and post the weekly summary \u2014 NO resize, and no actor code runs. enforce = as shadow, plus enqueue resizes. AS OF PHASE 1 (ENG-9324) THERE IS NO ACTOR, SO `enforce` BEHAVES EXACTLY LIKE `shadow`: selecting it records the mode on each verdict row and changes nothing else, and no host is resized. This note comes out when the Phase 3 actor lands; until then treat enforce as shadow-with-a-label, not as an armed fleet. Ships dark: this mechanism ends in a stop/start of a customer production host, so an unreachable flag store must resolve to NOT acting. TWO BOUNDS WORTH KNOWING BEFORE FLIPPING. (1) off is not a stop button for in-flight work \u2014 HostResizeDispatcher reads only ec2_pending_instance_type and knows nothing about this flag, so flipping to off stops new enqueues and lets every already-enqueued host complete its stop/modify/start; combined with the ~5-minute eval cache the true blast unit is one tick of open windows. A real kill switch has to live inside the dispatcher. (2) BYO hosts (ADR-0028) are EXCLUDED in Phase 1, not merely clamped to shadow: their instances live in the customer AWS account while the cron authenticates only with the platform provisioner role, so their metrics read as empty and every evaluation would land as unknown. ADR-0072 \xA79 intends them to be shadow-only ("we recommend; they resize") and making that real needs the per-host cross_account_role_arn resolved - its own slice. Pool hosts (ADR-0042) are excluded too, while host_kind is unset in prod. Both are eligibility predicates applied by the cron, documented here so the admin page showing enforce for such an org is not read as behaviour.',
+    flagType: "enum",
+    allowedValues: ["off", "shadow", "enforce"],
+    // Ships dark at `off`, NOT `shadow`. Diverging deliberately from
+    // slack-scheduled-channel-guard, whose shadow is a free local log line:
+    // THIS shadow spends a fleet-wide CloudWatch GetMetricData sweep per tick
+    // and writes a row per host, so defaulting to shadow would newly bill and
+    // newly write for every org that never opted in. shadow is the per-canary
+    // opt-in; enforce is the audited flip after the Phase 2 review.
+    defaultValue: "off",
+    // Evaluated centrally, in the API cron — there is no host-side reader, so
+    // no `since` and no dependence on fleet agt-cli convergence.
+    // NOTE: deliberately NO envVar. ADR-0072 §9 wants this gate scoped per
+    // org/host, and an envVar would be highest-precedence (ADR-0022) — a
+    // literal in sst.config.ts would pin every stage and make the admin page a
+    // control that does nothing, which is the ENG-8303 class exactly.
+    // enforce arms automated downtime on a customer's production host.
+    sensitive: true
   }
 ];
 var REGISTRY_BY_KEY = new Map(FLAG_REGISTRY.map((definition) => [definition.key, definition]));
@@ -12432,4 +12453,4 @@ export {
   minutesSinceLocalMidnight,
   peekCurrentSession
 };
-//# sourceMappingURL=chunk-HGVJVYKW.js.map
+//# sourceMappingURL=chunk-DWFN5PMF.js.map