@kungfu-tech/buildchain 3.0.4 → 3.0.5-alpha.1

package/packages/core/release-propagation-capture.js

@@ -0,0 +1,150 @@
+import {
+  assertCommitSha,
+} from "./release-propagation-work-control.js";
+import {
+  assertExactFields,
+  assertPlainObject,
+  assertString,
+} from "./release-propagation-common.js";
+import {
+  createReleasePropagationWork,
+  normalizeReleasePropagationGraph,
+  planReleasePropagation,
+  verifyReleasePropagationWork,
+} from "./release-propagation.js";
+import { normalizeUpstreamRelease } from "./release-propagation-release.js";
+
+export const PACKAGE_RELEASE_PROPAGATION_CONFIG_CONTRACT =
+  "kungfu-buildchain-package-release-propagation";
+
+function assertAllowedFields(value, allowed, required, label) {
+  const object = assertPlainObject(value, label);
+  const unknown = Object.keys(object).filter((field) => !allowed.has(field));
+  if (unknown.length > 0) {
+    throw new Error(`${label} has unknown fields: ${unknown.sort().join(", ")}`);
+  }
+  for (const field of required) {
+    if (!(field in object)) throw new Error(`${label}.${field} is required`);
+  }
+  return object;
+}
+
+function assertStrictGraph(graph) {
+  const value = assertAllowedFields(
+    graph,
+    new Set(["schemaVersion", "contract", "channelPolicy", "nodes", "edges"]),
+    ["schemaVersion", "contract", "nodes", "edges"],
+    "package release propagation config graph",
+  );
+  if (!Array.isArray(value.nodes) || !Array.isArray(value.edges)) {
+    throw new Error("package release propagation config graph nodes and edges must be arrays");
+  }
+  value.nodes.forEach((node, index) => assertAllowedFields(
+    node,
+    new Set([
+      "id", "repository", "package", "lockPath", "baseRef", "workflow",
+      "executionProfile",
+    ]),
+    ["id", "repository"],
+    `package release propagation config graph nodes[${index}]`,
+  ));
+  value.edges.forEach((edge, index) => assertAllowedFields(
+    edge,
+    new Set([
+      "id", "from", "to", "channels", "channelPolicy", "channelMap",
+      "lockPath", "prBaseRef",
+    ]),
+    ["from", "to"],
+    `package release propagation config graph edges[${index}]`,
+  ));
+  return normalizeReleasePropagationGraph(value);
+}
+
+export function normalizePackageReleasePropagationConfig(input) {
+  const config = assertExactFields(input, [
+    "schemaVersion", "contract", "sourceNode", "graph", "targets",
+  ], "package release propagation config");
+  if (config.schemaVersion !== 1 || config.contract !== PACKAGE_RELEASE_PROPAGATION_CONFIG_CONTRACT) {
+    throw new Error(`package release propagation config must use ${PACKAGE_RELEASE_PROPAGATION_CONFIG_CONTRACT} v1`);
+  }
+  const sourceNode = assertString(config.sourceNode, "package release propagation config sourceNode");
+  if (!/^[A-Za-z0-9._-]+$/.test(sourceNode)) {
+    throw new Error("package release propagation config sourceNode must be a canonical node id");
+  }
+  if (!Array.isArray(config.targets) || config.targets.length === 0) {
+    throw new Error("package release propagation config targets must be a non-empty array");
+  }
+  const targets = config.targets.map((target, index) => {
+    const value = assertString(target, `package release propagation config targets[${index}]`);
+    if (!/^[A-Za-z0-9._-]+$/.test(value)) {
+      throw new Error("package release propagation config targets must be canonical node ids");
+    }
+    return value;
+  });
+  const canonicalTargets = [...new Set(targets)].sort();
+  if (JSON.stringify(targets) !== JSON.stringify(canonicalTargets)) {
+    throw new Error("package release propagation config targets must be sorted and unique");
+  }
+  const graph = assertStrictGraph(config.graph);
+  const source = graph.nodes.find((node) => node.id === sourceNode);
+  if (!source) throw new Error("package release propagation config sourceNode is absent from graph");
+  if (!source.package) throw new Error("package release propagation source node must declare a package");
+  return {
+    schemaVersion: 1,
+    contract: PACKAGE_RELEASE_PROPAGATION_CONFIG_CONTRACT,
+    sourceNode,
+    graph,
+    targets: canonicalTargets,
+  };
+}
+
+export function createPackageReleasePropagationCapture({
+  config: configInput,
+  upstreamRelease: upstreamReleaseInput,
+  expectedBaseShas = {},
+} = {}) {
+  const config = normalizePackageReleasePropagationConfig(configInput);
+  const upstreamRelease = normalizeUpstreamRelease(upstreamReleaseInput);
+  const source = config.graph.nodes.find((node) => node.id === config.sourceNode);
+  if (source.repository !== upstreamRelease.repository) {
+    throw new Error("package release propagation source repository disagrees with release envelope");
+  }
+  if (source.package !== upstreamRelease.package?.name) {
+    throw new Error("package release propagation source package disagrees with release envelope");
+  }
+  const plan = planReleasePropagation({
+    graph: config.graph,
+    upstreamRelease,
+    sourceNode: config.sourceNode,
+  });
+  const plannedTargets = plan.targets.map((target) => target.target).sort();
+  if (JSON.stringify(plannedTargets) !== JSON.stringify(config.targets)) {
+    throw new Error("package release propagation targets must exactly match the release-channel plan");
+  }
+  const works = plan.targets.map((target) => {
+    const expectedBaseSha = expectedBaseShas[target.target]
+      || expectedBaseShas[target.repository]
+      || "";
+    assertCommitSha(
+      expectedBaseSha,
+      `expected downstream base SHA for ${target.target}`,
+    );
+    const work = createReleasePropagationWork({
+      plan,
+      target: target.target,
+      expectedDownstreamBaseSha: expectedBaseSha,
+    });
+    const status = verifyReleasePropagationWork(work);
+    if (status.lifecycle !== "paused" || status.nextAction?.action !== "claim") {
+      throw new Error("captured package propagation work must remain paused at claim");
+    }
+    return {
+      target: target.target,
+      repository: target.repository,
+      propagationKey: target.propagationKey,
+      work,
+      status,
+    };
+  });
+  return { config, upstreamRelease, plan, works };
+}

package/packages/core/release-propagation-stage-evidence.js

@@ -58,7 +58,7 @@ function exactClaims(entry, fields, label) {
 function releaseClaims(work) {
   return {
     releaseRoot: work.upstream.releaseRoot,
-    releaseLockRoot: work.downstream.releaseLockRoot,
+    releaseLockRoot: `sha256:${work.downstream.lockSha256}`,
     sourceSha: work.upstream.release.sourceSha,
     tagTargetSha: work.upstream.release.tagTargetSha,
   };

package/packages/core/release-propagation.js

@@ -471,3 +471,8 @@ export {
   recordReleasePropagationStage,
   repairReleasePropagationWork,
 } from "./release-propagation-work-transitions.js";
+export {
+  PACKAGE_RELEASE_PROPAGATION_CONFIG_CONTRACT,
+  createPackageReleasePropagationCapture,
+  normalizePackageReleasePropagationConfig,
+} from "./release-propagation-capture.js";

package/scripts/auditable-demo-renditions.mjs

@@ -16,7 +16,6 @@ const RENDITION_SET_NON_AUTHORITIES = [
   "runtime-authority",
   ...TERMINAL_CAPTURE_NON_AUTHORITIES,
 ];
-
 export function validateTerminalCapture(value, scene, helpers) {
   const { decodeBase64, digestPattern, exactKeys, integer, invariant, maxBytes, maxEvents, text } = helpers;
   exactKeys(
@@ -53,10 +52,10 @@ export function validateTerminalCapture(value, scene, helpers) {
   }
   exactKeys(value.completion, ["schema", "status", "reportRoot", "eventCount"], [], "terminalCapture.completion");
   invariant(
-    value.completion.schema === "kungfu.agent-work-lab.tui-autoplay/v1"
+    /^[a-z0-9][a-z0-9._/-]*\/v[1-9][0-9]*$/u.test(value.completion.schema)
       && value.completion.status === "qualified"
       && digestPattern.test(value.completion.reportRoot),
-    "terminal capture completion sentinel is not a qualified Agent Work Lab autoplay",
+    "terminal capture completion sentinel is not a qualified versioned result",
   );
   integer(value.completion.eventCount, 1, 100_000, "terminalCapture.completion.eventCount");
   invariant(value.exitCode === 0, "terminal capture exitCode must be zero");

package/scripts/aws-macos-jit-controller-core.mjs

@@ -0,0 +1,389 @@
+// SPDX-License-Identifier: Apache-2.0
+
+import { digest } from "./aws-runner-burst-core.mjs";
+import {
+  MACOS_EC2_JIT,
+  macosJitRunnerLabel,
+  macosJitRunnerLabels,
+} from "./aws-macos-jit-core.mjs";
+
+export const AWS_MACOS_JIT_CONTROLLER_CONTRACT =
+  "kungfu-buildchain-aws-macos-jit-controller/v1";
+
+function exact(value, pattern, label) {
+  const normalized = String(value || "").trim();
+  if (!pattern.test(normalized)) throw new Error(`${label} is invalid`);
+  return normalized;
+}
+
+function exactSha(value) {
+  return exact(value, /^[0-9a-f]{40}$/i, "sourceSha").toLowerCase();
+}
+
+function iso(value, label) {
+  const parsed = new Date(value || "");
+  if (!Number.isFinite(parsed.getTime())) {
+    throw new Error(`${label} must be an ISO timestamp`);
+  }
+  return parsed.toISOString();
+}
+
+function tag(key, value) {
+  return { Key: key, Value: String(value) };
+}
+
+function repository(value) {
+  const resolved = exact(
+    value || MACOS_EC2_JIT.repository,
+    /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/,
+    "repository",
+  );
+  if (resolved !== MACOS_EC2_JIT.repository) {
+    throw new Error(`repository must be ${MACOS_EC2_JIT.repository}`);
+  }
+  return resolved;
+}
+
+function source(values) {
+  return {
+    sha: exactSha(values.sourceSha),
+    ref: exact(
+      values.sourceRef,
+      /^refs\/heads\/[A-Za-z0-9._/-]+$/,
+      "sourceRef",
+    ),
+  };
+}
+
+function campaignId(value) {
+  return exact(value, /^[a-z0-9][a-z0-9-]{2,47}$/, "campaignId");
+}
+
+function qualificationId(value) {
+  return exact(value, /^mac-(?:smoke-0[12]|full-01)$/, "qualificationId");
+}
+
+function commonAws(values) {
+  const region = exact(
+    values.region || MACOS_EC2_JIT.region,
+    /^us-[a-z]+-\d$/,
+    "region",
+  );
+  if (region !== MACOS_EC2_JIT.region) {
+    throw new Error(`region must be ${MACOS_EC2_JIT.region}`);
+  }
+  const instanceType = exact(
+    values.instanceType || MACOS_EC2_JIT.instanceType,
+    /^mac2\.metal$/,
+    "instanceType",
+  );
+  if (instanceType !== MACOS_EC2_JIT.instanceType) {
+    throw new Error(`instanceType must be ${MACOS_EC2_JIT.instanceType}`);
+  }
+  return {
+    region,
+    availabilityZone: exact(
+      values.availabilityZone,
+      /^us-[a-z]+-\d[a-z]$/,
+      "availabilityZone",
+    ),
+    instanceType,
+    amiId: exact(values.amiId, /^ami-[0-9a-f]+$/, "amiId"),
+    amiName: exact(values.amiName, /^[A-Za-z0-9._-]+$/, "amiName"),
+    subnetId: exact(values.subnetId, /^subnet-[0-9a-f]+$/, "subnetId"),
+    securityGroupId: exact(
+      values.securityGroupId,
+      /^sg-[0-9a-f]+$/,
+      "securityGroupId",
+    ),
+    instanceProfileName: exact(
+      values.instanceProfileName,
+      /^[A-Za-z0-9+=,.@_-]{1,128}$/,
+      "instanceProfileName",
+    ),
+    evidenceBucket: exact(
+      values.evidenceBucket,
+      /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/,
+      "evidenceBucket",
+    ),
+  };
+}
+
+function ownershipTags({ id, sourceSha }) {
+  return [
+    tag("kungfu:owner", "buildchain"),
+    tag("kungfu:plane", "aws-us-elastic-runner-burst"),
+    tag("kungfu:provider", "macos-ec2-jit"),
+    tag("kungfu:campaign-id", id),
+    tag("kungfu:source-sha", sourceSha),
+  ];
+}
+
+export function createMacosJitCampaignPlan(values = {}) {
+  const id = campaignId(values.campaignId);
+  const boundSource = source(values);
+  const aws = commonAws(values);
+  const tags = ownershipTags({ id, sourceSha: boundSource.sha });
+  const createdAt = iso(values.createdAt, "createdAt");
+  const plan = {
+    schemaVersion: 1,
+    contract: AWS_MACOS_JIT_CONTROLLER_CONTRACT,
+    kind: "campaign-launch-plan",
+    repository: repository(values.repository),
+    campaign: { id, createdAt },
+    source: boundSource,
+    aws: {
+      ...aws,
+      hostTags: tags,
+      instanceTags: tags,
+      volumeTags: tags,
+      hostClientToken: `kungfu-mac-host-${id}`,
+      instanceClientToken: `kungfu-mac-instance-${id}`,
+      rootVolume: {
+        deviceName: "/dev/sda1",
+        deleteOnTermination: true,
+        encrypted: true,
+        volumeSizeGiB: 200,
+        volumeType: "gp3",
+      },
+      metadata: {
+        httpEndpoint: "enabled",
+        httpTokens: "required",
+        httpPutResponseHopLimit: 1,
+        instanceMetadataTags: "disabled",
+      },
+    },
+    safety: {
+      applyMode: values.execute === true ? "execute" : "dry-run",
+      exactSourceRequired: true,
+      activeHostCeiling: MACOS_EC2_JIT.maxAcceptedHosts,
+      activeInstanceCeiling: 1,
+      awsDryRunRequiredBeforeAllocation: true,
+      awsDryRunRequiredBeforeLaunch: true,
+      retainHostOnInstanceLaunchFailure: true,
+      minimumHostAllocationHours: MACOS_EC2_JIT.minimumHostAllocationHours,
+      maximumHostAllocationHours: MACOS_EC2_JIT.maximumHostAllocationHours,
+      cleanupOwner: "scheduled-card-scoped-reaper",
+    },
+  };
+  return { ...plan, digest: digest(plan) };
+}
+
+export function macosAllocateHostsArgs(plan, { dryRun = false } = {}) {
+  if (
+    plan?.contract !== AWS_MACOS_JIT_CONTROLLER_CONTRACT ||
+    plan.kind !== "campaign-launch-plan"
+  ) {
+    throw new Error("macOS JIT campaign launch plan contract is invalid");
+  }
+  const args = [
+    "ec2",
+    "allocate-hosts",
+    "--availability-zone",
+    plan.aws.availabilityZone,
+    "--instance-type",
+    plan.aws.instanceType,
+    "--quantity",
+    "1",
+    "--auto-placement",
+    "off",
+    "--client-token",
+    plan.aws.hostClientToken,
+    "--tag-specifications",
+    JSON.stringify([
+      { ResourceType: "dedicated-host", Tags: plan.aws.hostTags },
+    ]),
+    "--output",
+    "json",
+  ];
+  if (dryRun) args.splice(2, 0, "--dry-run");
+  return args;
+}
+
+export function macosRunInstancesArgs(plan, { hostId, dryRun = false } = {}) {
+  if (
+    plan?.contract !== AWS_MACOS_JIT_CONTROLLER_CONTRACT ||
+    plan.kind !== "campaign-launch-plan"
+  ) {
+    throw new Error("macOS JIT campaign launch plan contract is invalid");
+  }
+  const resolvedHostId = exact(hostId, /^h-[0-9a-f]+$/, "hostId");
+  const args = [
+    "ec2",
+    "run-instances",
+    "--image-id",
+    plan.aws.amiId,
+    "--instance-type",
+    plan.aws.instanceType,
+    "--count",
+    "1",
+    "--client-token",
+    plan.aws.instanceClientToken,
+    "--iam-instance-profile",
+    JSON.stringify({ Name: plan.aws.instanceProfileName }),
+    "--subnet-id",
+    plan.aws.subnetId,
+    "--security-group-ids",
+    plan.aws.securityGroupId,
+    "--associate-public-ip-address",
+    "--placement",
+    JSON.stringify({ HostId: resolvedHostId, Tenancy: "host" }),
+    "--block-device-mappings",
+    JSON.stringify([
+      {
+        DeviceName: plan.aws.rootVolume.deviceName,
+        Ebs: {
+          DeleteOnTermination: plan.aws.rootVolume.deleteOnTermination,
+          Encrypted: plan.aws.rootVolume.encrypted,
+          VolumeSize: plan.aws.rootVolume.volumeSizeGiB,
+          VolumeType: plan.aws.rootVolume.volumeType,
+        },
+      },
+    ]),
+    "--metadata-options",
+    JSON.stringify({
+      HttpEndpoint: plan.aws.metadata.httpEndpoint,
+      HttpTokens: plan.aws.metadata.httpTokens,
+      HttpPutResponseHopLimit: plan.aws.metadata.httpPutResponseHopLimit,
+      InstanceMetadataTags: plan.aws.metadata.instanceMetadataTags,
+    }),
+    "--instance-initiated-shutdown-behavior",
+    "stop",
+    "--tag-specifications",
+    JSON.stringify([
+      { ResourceType: "instance", Tags: plan.aws.instanceTags },
+      { ResourceType: "volume", Tags: plan.aws.volumeTags },
+    ]),
+    "--output",
+    "json",
+  ];
+  if (dryRun) args.splice(2, 0, "--dry-run");
+  return args;
+}
+
+export function createMacosJitJobPlan(values = {}) {
+  const id = campaignId(values.campaignId);
+  const boundSource = source(values);
+  const qualification = qualificationId(values.qualificationId);
+  const runnerLabel = macosJitRunnerLabel(values.runnerLabel);
+  const expectedLabel = `${MACOS_EC2_JIT.labelPrefix}${qualification}`;
+  if (runnerLabel !== expectedLabel) {
+    throw new Error(`runnerLabel must be ${expectedLabel}`);
+  }
+  const runId = exact(values.runId, /^\d+$/, "runId");
+  const runAttempt = exact(
+    values.runAttempt || "1",
+    /^[1-9]\d*$/,
+    "runAttempt",
+  );
+  const hostAllocatedAt = iso(values.hostAllocatedAt, "hostAllocatedAt");
+  const jitParameterName = `${MACOS_EC2_JIT.jitParameterPrefix}${id}/${runId}/${runAttempt}/${qualification}`;
+  const plan = {
+    schemaVersion: 1,
+    contract: AWS_MACOS_JIT_CONTROLLER_CONTRACT,
+    kind: "job-run-plan",
+    repository: repository(values.repository),
+    campaign: { id },
+    source: boundSource,
+    github: {
+      runId,
+      runAttempt,
+      jobId: exact(values.jobId, /^\d+$/, "jobId"),
+      qualificationId: qualification,
+      event: "workflow_dispatch",
+    },
+    runner: {
+      name: exact(
+        values.runnerName,
+        /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/,
+        "runnerName",
+      ),
+      label: runnerLabel,
+      labels: macosJitRunnerLabels(runnerLabel),
+      oneJobJit: true,
+    },
+    aws: {
+      ...commonAws(values),
+      hostId: exact(values.hostId, /^h-[0-9a-f]+$/, "hostId"),
+      instanceId: exact(values.instanceId, /^i-[0-9a-f]+$/, "instanceId"),
+      hostAllocatedAt,
+      jitParameterName,
+    },
+    safety: {
+      applyMode: values.execute === true ? "execute" : "dry-run",
+      exactSourceRequired: true,
+      queuedJobRequired: true,
+      sameCampaignHostRequired: true,
+      sameCampaignInstanceRequired: true,
+      jitConfigTransport: "0600-temporary-file-to-ssm-secure-string",
+      bootstrapTransport: "0600-temporary-file-to-ssm-command",
+      jitConfigInBootstrap: false,
+      jitConfigInArgv: false,
+      cleanupOnCommandFailure: ["ssm-parameter", "github-runner-registration"],
+    },
+  };
+  return { ...plan, digest: digest(plan) };
+}
+
+export function createMacosJitClosePlan(values = {}) {
+  const id = campaignId(values.campaignId);
+  const boundSource = source(values);
+  const hostAllocatedAt = iso(values.hostAllocatedAt, "hostAllocatedAt");
+  const observedAt = iso(values.observedAt, "observedAt");
+  const allocationHours =
+    (new Date(observedAt).getTime() - new Date(hostAllocatedAt).getTime()) /
+    3_600_000;
+  if (allocationHours < MACOS_EC2_JIT.minimumHostAllocationHours) {
+    throw new Error(
+      `Dedicated Host cannot be closed before ${MACOS_EC2_JIT.minimumHostAllocationHours} hours`,
+    );
+  }
+  const plan = {
+    schemaVersion: 1,
+    contract: AWS_MACOS_JIT_CONTROLLER_CONTRACT,
+    kind: "campaign-close-plan",
+    repository: repository(values.repository),
+    campaign: { id },
+    source: boundSource,
+    aws: {
+      ...commonAws(values),
+      hostId: exact(values.hostId, /^h-[0-9a-f]+$/, "hostId"),
+      instanceId: exact(values.instanceId, /^i-[0-9a-f]+$/, "instanceId"),
+      hostAllocatedAt,
+    },
+    lifecycle: {
+      observedAt,
+      allocationHours,
+      minimumHostAllocationHours: MACOS_EC2_JIT.minimumHostAllocationHours,
+      maximumHostAllocationHours: MACOS_EC2_JIT.maximumHostAllocationHours,
+    },
+    safety: {
+      applyMode: values.execute === true ? "execute" : "dry-run",
+      exactCampaignOwnershipRequired: true,
+      instanceTerminationRequiredBeforeRelease: true,
+      encryptedDeleteOnTerminationVolumeRequired: true,
+      awsDryRunRequiredBeforeRelease: true,
+      reaperFallback: true,
+    },
+  };
+  return { ...plan, digest: digest(plan) };
+}
+
+export function macosReleaseHostsArgs(plan, { dryRun = false } = {}) {
+  if (
+    plan?.contract !== AWS_MACOS_JIT_CONTROLLER_CONTRACT ||
+    plan.kind !== "campaign-close-plan"
+  ) {
+    throw new Error("macOS JIT campaign close plan contract is invalid");
+  }
+  const args = [
+    "ec2",
+    "release-hosts",
+    "--host-ids",
+    plan.aws.hostId,
+    "--output",
+    "json",
+  ];
+  if (dryRun) args.splice(2, 0, "--dry-run");
+  return args;
+}

package/scripts/aws-macos-jit-controller-runtime.mjs

@@ -0,0 +1,82 @@
+// SPDX-License-Identifier: Apache-2.0
+
+import { spawnSync } from "node:child_process";
+
+export function commandResult(command, args, options = {}) {
+  const result = spawnSync(command, args, {
+    encoding: "utf8",
+    maxBuffer: 16 * 1024 * 1024,
+    stdio: [options.input === undefined ? "ignore" : "pipe", "pipe", "pipe"],
+    input: options.input,
+    env: process.env,
+  });
+  return {
+    status: result.status,
+    stdout: String(result.stdout || ""),
+    stderr: String(result.stderr || result.error?.message || ""),
+  };
+}
+
+export function requireSuccess(result, label) {
+  if (result.status !== 0) {
+    const detail = (result.stderr || result.stdout).trim().slice(0, 2000);
+    throw new Error(`${label} failed${detail ? `: ${detail}` : ""}`);
+  }
+  return result.stdout;
+}
+
+export function jsonResult(result, label) {
+  const output = requireSuccess(result, label);
+  try {
+    return JSON.parse(output);
+  } catch {
+    throw new Error(`${label} returned invalid JSON`);
+  }
+}
+
+export function awsArgs(plan, profile, serviceArgs) {
+  return [
+    ...(profile ? ["--profile", profile] : []),
+    "--region",
+    plan.aws.region,
+    ...serviceArgs,
+  ];
+}
+
+export function awsJson(plan, profile, serviceArgs, label) {
+  return jsonResult(
+    commandResult("aws", awsArgs(plan, profile, serviceArgs)),
+    label,
+  );
+}
+
+export function ghJson(args, input, label) {
+  return jsonResult(commandResult("gh", args, { input }), label);
+}
+
+export function assertOwnership(resourceTags, plan) {
+  const observed = Object.fromEntries(
+    (resourceTags || []).map((entry) => [entry.Key, String(entry.Value)]),
+  );
+  const expected = {
+    "kungfu:owner": "buildchain",
+    "kungfu:plane": "aws-us-elastic-runner-burst",
+    "kungfu:provider": "macos-ec2-jit",
+    "kungfu:campaign-id": plan.campaign.id,
+    "kungfu:source-sha": plan.source.sha,
+  };
+  for (const [key, value] of Object.entries(expected)) {
+    if (observed[key] !== value) {
+      throw new Error(`AWS resource ownership tag ${key} mismatch`);
+    }
+  }
+}
+
+export function assertDryRun(result, label) {
+  if (
+    result.status === 0 ||
+    !/DryRunOperation/.test(`${result.stdout}\n${result.stderr}`)
+  ) {
+    throw new Error(`${label} did not return DryRunOperation`);
+  }
+}