@kungfu-tech/buildchain 3.0.5-alpha.0 → 3.0.5-alpha.1

package/dist/site/publication-registry.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-publication-release-registry",
-  "generatedAt": "2026-08-02T01:14:59.679Z",
-  "publishedAt": "2026-08-02T01:14:59.679Z",
+  "generatedAt": "2026-08-02T02:26:15.287Z",
+  "publishedAt": "2026-08-02T02:26:15.287Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "99ce7a8de4cd35f81d743b63d723bee2d4c26f80",
+  "sourceRevision": "8b96fb02e587124bad0f9055f9de6eb7c6b8081c",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -32,7 +32,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.5-alpha.0",
+    "version": "3.0.5-alpha.1",
     "versionSource": "package.json#version"
   },
   "sourceKind": "package-site-bundle",

package/dist/site/site-manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 1,
   "contract": "kungfu-buildchain-site-manifest",
-  "generatedAt": "2026-08-02T01:14:59.679Z",
-  "publishedAt": "2026-08-02T01:14:59.679Z",
+  "generatedAt": "2026-08-02T02:26:15.287Z",
+  "publishedAt": "2026-08-02T02:26:15.287Z",
   "reproducible": true,
   "timestampPolicy": "ci-injected",
   "deterministicInputs": [
@@ -19,7 +19,7 @@
     "declared Buildchain surface manifest contract"
   ],
   "sourceDateEpoch": "0",
-  "sourceRevision": "99ce7a8de4cd35f81d743b63d723bee2d4c26f80",
+  "sourceRevision": "8b96fb02e587124bad0f9055f9de6eb7c6b8081c",
   "timestampPolicyDetails": {
     "contract": "kungfu-buildchain-surface-timestamp-policy",
     "timestampFields": [
@@ -37,7 +37,7 @@
   },
   "package": {
     "name": "@kungfu-tech/buildchain",
-    "version": "3.0.5-alpha.0",
+    "version": "3.0.5-alpha.1",
     "versionSource": "package.json#version"
   },
   "entrypoint": "buildchain-site.json",
@@ -285,7 +285,7 @@
       "path": "docs/publish-transaction.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:9b830727e5b0d2192c937f19106c11ea5064dde77e30d290825f343df47f291b"
+      "digest": "sha256:3a9ef099d5d93d9b558c7b6a0aa4403dfcce1479ce5d6fc36ecb3e34cdd5bb6d"
     },
     {
       "id": "release-governance",
@@ -293,7 +293,7 @@
       "path": "docs/release-governance.md",
       "plane": "why",
       "exists": true,
-      "digest": "sha256:60ec90d3294818d3c53e403312801a8ab47be7c0f34810002676fbfcdbceaa60"
+      "digest": "sha256:96d78f800cd7d43d3a47a11863d4813711e360418ba33a4284688389c7e4b70c"
     },
     {
       "id": "release-flow",
@@ -301,7 +301,7 @@
       "path": "docs/release-flow.md",
       "plane": "verify",
       "exists": true,
-      "digest": "sha256:bac959565c36cf39c3cd30dfce00dbbb59b73ed21b852a8f24a6cae281cb5f05"
+      "digest": "sha256:dc54b8a264489341984ca6157b07d1956e934366f937b7412a21df7f025d2d8d"
     },
     {
       "id": "runtime-train-validation",

package/docs/aws-us-elastic-runner-burst-plane.md

@@ -8,7 +8,12 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: unreviewed
-last_reviewed: 2026-07-30
+last_reviewed: 2026-08-01
+ai_provenance:
+  model_family: GPT-5
+  product: Codex
+  generated_at: 2026-08-01
+  invisible_information: No hidden model checkpoint, parameters, or private training data were available.
 ---
 
 # AWS US elastic runner burst plane
@@ -226,6 +231,32 @@ host, including at least one full run, plus proof that:
 - AWS has no active campaign instance or allocated campaign host;
 - actual incremental spend remained below USD 25.
 
+### Phase 3 lifecycle controller
+
+`scripts/aws-macos-jit-controller.mjs` is the operator boundary for the paid
+campaign. It has three explicit mutation modes:
+
+- `launch-campaign` binds the exact repository source, AMI, availability zone,
+  tagged Dedicated Host, and reusable instance. It rejects pre-existing Mac
+  capacity and requires successful `AllocateHosts` and `RunInstances` DryRuns
+  before either real call.
+- `run-job` binds one queued exact-source GitHub job to the existing campaign
+  host and instance. It writes the repository JIT configuration through a
+  mode-0600 temporary file into a distinct SSM SecureString, sends only the
+  credential-free bootstrap through SSM, and removes the parameter plus runner
+  registration if command delivery fails.
+- `close-campaign` refuses execution before the provider's 24-hour minimum,
+  verifies the encrypted delete-on-termination root volume, removes scoped JIT
+  residue, terminates the exact instance, and requires a `ReleaseHosts` DryRun
+  before release. If Apple host scrubbing is still in progress, it reports
+  `release-pending`; the ten-minute card-scoped reaper remains the bounded
+  retry path.
+
+Every execute mode requires the exact source SHA and campaign id to be repeated
+through `--confirm-source-sha` and `--confirm-campaign-id`. `run-job` also
+requires `--confirm-run-id`. Omitting `--execute` emits a deterministic plan
+without changing AWS or GitHub state.
+
 ## Provider lifecycle
 
 The three infrastructure templates live under

package/docs/publish-transaction.md

@@ -415,9 +415,10 @@ first run can stop at `finalizing` after registry publication. If the reviewed
 merge commit later contains that exact transaction release material but the
 exact tag is still absent, a retry performs finalization only: it reloads the
 same durable source, release material, tooling, evidence, version, and target
-bindings; creates the exact and floating tags at the transaction release SHA;
-and completes the passport from the transaction source tree. It does not rerun
-the provider mutation and does not authorize the newer composite channel tree
+bindings; creates the exact tag at the transaction source SHA; moves floating
+refs to the transaction release SHA; and completes the passport from the
+transaction source tree. It does not rerun the provider mutation and does not
+authorize the newer composite channel tree
 as published material. A different source tree still requires a new version and
 a fresh release candidate.
 
@@ -536,8 +537,9 @@ inside the mutation boundary.
 
 If finalization fails after an exact Git tag is created, the next run reads the
 durable `finalizing` state, verifies the exact tag points at the recorded
-release SHA, and retries the remaining floating refs. An exact tag at a
-different SHA is a material conflict and blocks recovery.
+source SHA (while accepting legacy release/material targets for recovery), and
+retries the remaining floating refs. An exact tag at an unrelated SHA is a
+material conflict and blocks recovery.
 
 ## CLI Recovery
 

package/docs/release-flow.md

@@ -96,6 +96,10 @@ published artifacts are already durable.
 The intended governance split is:
 
 - exact tags such as `v3.0.2` and `v3.0.3-alpha.0` are immutable audit refs;
+- for publish transactions, the exact tag points to the transaction
+  `source_sha`, matching package-registry source metadata such as npm
+  `gitHead`; generated version-state commits remain on protected branches and
+  floating channel refs;
 - floating tags such as `v3`, `v3.0`, `v3.0-alpha`, and `v3-alpha` are mutable channel refs
   owned by the Buildchain promotion token;
 - protected branches still require reviewed channel PRs before Buildchain can

package/docs/release-governance.md

@@ -831,6 +831,13 @@ must be absent or already point at accepted release material. This preserves an
 immutable tag that represents a completed transaction while allowing a tag
 collision discovered after registry publication to recover without republishing.
 
+For package publish transactions, the immutable public version tag points to
+the transaction `source_sha`, so registry source metadata such as npm `gitHead`
+and the Git tag identify the same source commit. Protected branches and mutable
+channel tags continue to point to the generated `release_sha`. Recovery accepts
+older completed transactions whose exact tags already point to recorded release
+or release-material SHAs, but new tags are source-bound.
+
 Every Buildchain publish model that can run registry side effects must bind the
 publish entrypoint to an immutable `publish-gate/*` source lock. The reusable
 `release-candidate-promote.yml@v3` wrapper creates or updates that gate ref and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kungfu-tech/buildchain",
-  "version": "3.0.5-alpha.0",
+  "version": "3.0.5-alpha.1",
   "private": false,
   "description": "Buildchain Release Passport, release governance, CLI toolkit, and site facts.",
   "repository": "https://github.com/kungfu-systems/buildchain",

package/scripts/aws-macos-jit-controller-core.mjs

@@ -0,0 +1,389 @@
+// SPDX-License-Identifier: Apache-2.0
+
+import { digest } from "./aws-runner-burst-core.mjs";
+import {
+  MACOS_EC2_JIT,
+  macosJitRunnerLabel,
+  macosJitRunnerLabels,
+} from "./aws-macos-jit-core.mjs";
+
+export const AWS_MACOS_JIT_CONTROLLER_CONTRACT =
+  "kungfu-buildchain-aws-macos-jit-controller/v1";
+
+function exact(value, pattern, label) {
+  const normalized = String(value || "").trim();
+  if (!pattern.test(normalized)) throw new Error(`${label} is invalid`);
+  return normalized;
+}
+
+function exactSha(value) {
+  return exact(value, /^[0-9a-f]{40}$/i, "sourceSha").toLowerCase();
+}
+
+function iso(value, label) {
+  const parsed = new Date(value || "");
+  if (!Number.isFinite(parsed.getTime())) {
+    throw new Error(`${label} must be an ISO timestamp`);
+  }
+  return parsed.toISOString();
+}
+
+function tag(key, value) {
+  return { Key: key, Value: String(value) };
+}
+
+function repository(value) {
+  const resolved = exact(
+    value || MACOS_EC2_JIT.repository,
+    /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/,
+    "repository",
+  );
+  if (resolved !== MACOS_EC2_JIT.repository) {
+    throw new Error(`repository must be ${MACOS_EC2_JIT.repository}`);
+  }
+  return resolved;
+}
+
+function source(values) {
+  return {
+    sha: exactSha(values.sourceSha),
+    ref: exact(
+      values.sourceRef,
+      /^refs\/heads\/[A-Za-z0-9._/-]+$/,
+      "sourceRef",
+    ),
+  };
+}
+
+function campaignId(value) {
+  return exact(value, /^[a-z0-9][a-z0-9-]{2,47}$/, "campaignId");
+}
+
+function qualificationId(value) {
+  return exact(value, /^mac-(?:smoke-0[12]|full-01)$/, "qualificationId");
+}
+
+function commonAws(values) {
+  const region = exact(
+    values.region || MACOS_EC2_JIT.region,
+    /^us-[a-z]+-\d$/,
+    "region",
+  );
+  if (region !== MACOS_EC2_JIT.region) {
+    throw new Error(`region must be ${MACOS_EC2_JIT.region}`);
+  }
+  const instanceType = exact(
+    values.instanceType || MACOS_EC2_JIT.instanceType,
+    /^mac2\.metal$/,
+    "instanceType",
+  );
+  if (instanceType !== MACOS_EC2_JIT.instanceType) {
+    throw new Error(`instanceType must be ${MACOS_EC2_JIT.instanceType}`);
+  }
+  return {
+    region,
+    availabilityZone: exact(
+      values.availabilityZone,
+      /^us-[a-z]+-\d[a-z]$/,
+      "availabilityZone",
+    ),
+    instanceType,
+    amiId: exact(values.amiId, /^ami-[0-9a-f]+$/, "amiId"),
+    amiName: exact(values.amiName, /^[A-Za-z0-9._-]+$/, "amiName"),
+    subnetId: exact(values.subnetId, /^subnet-[0-9a-f]+$/, "subnetId"),
+    securityGroupId: exact(
+      values.securityGroupId,
+      /^sg-[0-9a-f]+$/,
+      "securityGroupId",
+    ),
+    instanceProfileName: exact(
+      values.instanceProfileName,
+      /^[A-Za-z0-9+=,.@_-]{1,128}$/,
+      "instanceProfileName",
+    ),
+    evidenceBucket: exact(
+      values.evidenceBucket,
+      /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/,
+      "evidenceBucket",
+    ),
+  };
+}
+
+function ownershipTags({ id, sourceSha }) {
+  return [
+    tag("kungfu:owner", "buildchain"),
+    tag("kungfu:plane", "aws-us-elastic-runner-burst"),
+    tag("kungfu:provider", "macos-ec2-jit"),
+    tag("kungfu:campaign-id", id),
+    tag("kungfu:source-sha", sourceSha),
+  ];
+}
+
+export function createMacosJitCampaignPlan(values = {}) {
+  const id = campaignId(values.campaignId);
+  const boundSource = source(values);
+  const aws = commonAws(values);
+  const tags = ownershipTags({ id, sourceSha: boundSource.sha });
+  const createdAt = iso(values.createdAt, "createdAt");
+  const plan = {
+    schemaVersion: 1,
+    contract: AWS_MACOS_JIT_CONTROLLER_CONTRACT,
+    kind: "campaign-launch-plan",
+    repository: repository(values.repository),
+    campaign: { id, createdAt },
+    source: boundSource,
+    aws: {
+      ...aws,
+      hostTags: tags,
+      instanceTags: tags,
+      volumeTags: tags,
+      hostClientToken: `kungfu-mac-host-${id}`,
+      instanceClientToken: `kungfu-mac-instance-${id}`,
+      rootVolume: {
+        deviceName: "/dev/sda1",
+        deleteOnTermination: true,
+        encrypted: true,
+        volumeSizeGiB: 200,
+        volumeType: "gp3",
+      },
+      metadata: {
+        httpEndpoint: "enabled",
+        httpTokens: "required",
+        httpPutResponseHopLimit: 1,
+        instanceMetadataTags: "disabled",
+      },
+    },
+    safety: {
+      applyMode: values.execute === true ? "execute" : "dry-run",
+      exactSourceRequired: true,
+      activeHostCeiling: MACOS_EC2_JIT.maxAcceptedHosts,
+      activeInstanceCeiling: 1,
+      awsDryRunRequiredBeforeAllocation: true,
+      awsDryRunRequiredBeforeLaunch: true,
+      retainHostOnInstanceLaunchFailure: true,
+      minimumHostAllocationHours: MACOS_EC2_JIT.minimumHostAllocationHours,
+      maximumHostAllocationHours: MACOS_EC2_JIT.maximumHostAllocationHours,
+      cleanupOwner: "scheduled-card-scoped-reaper",
+    },
+  };
+  return { ...plan, digest: digest(plan) };
+}
+
+export function macosAllocateHostsArgs(plan, { dryRun = false } = {}) {
+  if (
+    plan?.contract !== AWS_MACOS_JIT_CONTROLLER_CONTRACT ||
+    plan.kind !== "campaign-launch-plan"
+  ) {
+    throw new Error("macOS JIT campaign launch plan contract is invalid");
+  }
+  const args = [
+    "ec2",
+    "allocate-hosts",
+    "--availability-zone",
+    plan.aws.availabilityZone,
+    "--instance-type",
+    plan.aws.instanceType,
+    "--quantity",
+    "1",
+    "--auto-placement",
+    "off",
+    "--client-token",
+    plan.aws.hostClientToken,
+    "--tag-specifications",
+    JSON.stringify([
+      { ResourceType: "dedicated-host", Tags: plan.aws.hostTags },
+    ]),
+    "--output",
+    "json",
+  ];
+  if (dryRun) args.splice(2, 0, "--dry-run");
+  return args;
+}
+
+export function macosRunInstancesArgs(plan, { hostId, dryRun = false } = {}) {
+  if (
+    plan?.contract !== AWS_MACOS_JIT_CONTROLLER_CONTRACT ||
+    plan.kind !== "campaign-launch-plan"
+  ) {
+    throw new Error("macOS JIT campaign launch plan contract is invalid");
+  }
+  const resolvedHostId = exact(hostId, /^h-[0-9a-f]+$/, "hostId");
+  const args = [
+    "ec2",
+    "run-instances",
+    "--image-id",
+    plan.aws.amiId,
+    "--instance-type",
+    plan.aws.instanceType,
+    "--count",
+    "1",
+    "--client-token",
+    plan.aws.instanceClientToken,
+    "--iam-instance-profile",
+    JSON.stringify({ Name: plan.aws.instanceProfileName }),
+    "--subnet-id",
+    plan.aws.subnetId,
+    "--security-group-ids",
+    plan.aws.securityGroupId,
+    "--associate-public-ip-address",
+    "--placement",
+    JSON.stringify({ HostId: resolvedHostId, Tenancy: "host" }),
+    "--block-device-mappings",
+    JSON.stringify([
+      {
+        DeviceName: plan.aws.rootVolume.deviceName,
+        Ebs: {
+          DeleteOnTermination: plan.aws.rootVolume.deleteOnTermination,
+          Encrypted: plan.aws.rootVolume.encrypted,
+          VolumeSize: plan.aws.rootVolume.volumeSizeGiB,
+          VolumeType: plan.aws.rootVolume.volumeType,
+        },
+      },
+    ]),
+    "--metadata-options",
+    JSON.stringify({
+      HttpEndpoint: plan.aws.metadata.httpEndpoint,
+      HttpTokens: plan.aws.metadata.httpTokens,
+      HttpPutResponseHopLimit: plan.aws.metadata.httpPutResponseHopLimit,
+      InstanceMetadataTags: plan.aws.metadata.instanceMetadataTags,
+    }),
+    "--instance-initiated-shutdown-behavior",
+    "stop",
+    "--tag-specifications",
+    JSON.stringify([
+      { ResourceType: "instance", Tags: plan.aws.instanceTags },
+      { ResourceType: "volume", Tags: plan.aws.volumeTags },
+    ]),
+    "--output",
+    "json",
+  ];
+  if (dryRun) args.splice(2, 0, "--dry-run");
+  return args;
+}
+
+export function createMacosJitJobPlan(values = {}) {
+  const id = campaignId(values.campaignId);
+  const boundSource = source(values);
+  const qualification = qualificationId(values.qualificationId);
+  const runnerLabel = macosJitRunnerLabel(values.runnerLabel);
+  const expectedLabel = `${MACOS_EC2_JIT.labelPrefix}${qualification}`;
+  if (runnerLabel !== expectedLabel) {
+    throw new Error(`runnerLabel must be ${expectedLabel}`);
+  }
+  const runId = exact(values.runId, /^\d+$/, "runId");
+  const runAttempt = exact(
+    values.runAttempt || "1",
+    /^[1-9]\d*$/,
+    "runAttempt",
+  );
+  const hostAllocatedAt = iso(values.hostAllocatedAt, "hostAllocatedAt");
+  const jitParameterName = `${MACOS_EC2_JIT.jitParameterPrefix}${id}/${runId}/${runAttempt}/${qualification}`;
+  const plan = {
+    schemaVersion: 1,
+    contract: AWS_MACOS_JIT_CONTROLLER_CONTRACT,
+    kind: "job-run-plan",
+    repository: repository(values.repository),
+    campaign: { id },
+    source: boundSource,
+    github: {
+      runId,
+      runAttempt,
+      jobId: exact(values.jobId, /^\d+$/, "jobId"),
+      qualificationId: qualification,
+      event: "workflow_dispatch",
+    },
+    runner: {
+      name: exact(
+        values.runnerName,
+        /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/,
+        "runnerName",
+      ),
+      label: runnerLabel,
+      labels: macosJitRunnerLabels(runnerLabel),
+      oneJobJit: true,
+    },
+    aws: {
+      ...commonAws(values),
+      hostId: exact(values.hostId, /^h-[0-9a-f]+$/, "hostId"),
+      instanceId: exact(values.instanceId, /^i-[0-9a-f]+$/, "instanceId"),
+      hostAllocatedAt,
+      jitParameterName,
+    },
+    safety: {
+      applyMode: values.execute === true ? "execute" : "dry-run",
+      exactSourceRequired: true,
+      queuedJobRequired: true,
+      sameCampaignHostRequired: true,
+      sameCampaignInstanceRequired: true,
+      jitConfigTransport: "0600-temporary-file-to-ssm-secure-string",
+      bootstrapTransport: "0600-temporary-file-to-ssm-command",
+      jitConfigInBootstrap: false,
+      jitConfigInArgv: false,
+      cleanupOnCommandFailure: ["ssm-parameter", "github-runner-registration"],
+    },
+  };
+  return { ...plan, digest: digest(plan) };
+}
+
+export function createMacosJitClosePlan(values = {}) {
+  const id = campaignId(values.campaignId);
+  const boundSource = source(values);
+  const hostAllocatedAt = iso(values.hostAllocatedAt, "hostAllocatedAt");
+  const observedAt = iso(values.observedAt, "observedAt");
+  const allocationHours =
+    (new Date(observedAt).getTime() - new Date(hostAllocatedAt).getTime()) /
+    3_600_000;
+  if (allocationHours < MACOS_EC2_JIT.minimumHostAllocationHours) {
+    throw new Error(
+      `Dedicated Host cannot be closed before ${MACOS_EC2_JIT.minimumHostAllocationHours} hours`,
+    );
+  }
+  const plan = {
+    schemaVersion: 1,
+    contract: AWS_MACOS_JIT_CONTROLLER_CONTRACT,
+    kind: "campaign-close-plan",
+    repository: repository(values.repository),
+    campaign: { id },
+    source: boundSource,
+    aws: {
+      ...commonAws(values),
+      hostId: exact(values.hostId, /^h-[0-9a-f]+$/, "hostId"),
+      instanceId: exact(values.instanceId, /^i-[0-9a-f]+$/, "instanceId"),
+      hostAllocatedAt,
+    },
+    lifecycle: {
+      observedAt,
+      allocationHours,
+      minimumHostAllocationHours: MACOS_EC2_JIT.minimumHostAllocationHours,
+      maximumHostAllocationHours: MACOS_EC2_JIT.maximumHostAllocationHours,
+    },
+    safety: {
+      applyMode: values.execute === true ? "execute" : "dry-run",
+      exactCampaignOwnershipRequired: true,
+      instanceTerminationRequiredBeforeRelease: true,
+      encryptedDeleteOnTerminationVolumeRequired: true,
+      awsDryRunRequiredBeforeRelease: true,
+      reaperFallback: true,
+    },
+  };
+  return { ...plan, digest: digest(plan) };
+}
+
+export function macosReleaseHostsArgs(plan, { dryRun = false } = {}) {
+  if (
+    plan?.contract !== AWS_MACOS_JIT_CONTROLLER_CONTRACT ||
+    plan.kind !== "campaign-close-plan"
+  ) {
+    throw new Error("macOS JIT campaign close plan contract is invalid");
+  }
+  const args = [
+    "ec2",
+    "release-hosts",
+    "--host-ids",
+    plan.aws.hostId,
+    "--output",
+    "json",
+  ];
+  if (dryRun) args.splice(2, 0, "--dry-run");
+  return args;
+}

package/scripts/aws-macos-jit-controller-runtime.mjs

@@ -0,0 +1,82 @@
+// SPDX-License-Identifier: Apache-2.0
+
+import { spawnSync } from "node:child_process";
+
+export function commandResult(command, args, options = {}) {
+  const result = spawnSync(command, args, {
+    encoding: "utf8",
+    maxBuffer: 16 * 1024 * 1024,
+    stdio: [options.input === undefined ? "ignore" : "pipe", "pipe", "pipe"],
+    input: options.input,
+    env: process.env,
+  });
+  return {
+    status: result.status,
+    stdout: String(result.stdout || ""),
+    stderr: String(result.stderr || result.error?.message || ""),
+  };
+}
+
+export function requireSuccess(result, label) {
+  if (result.status !== 0) {
+    const detail = (result.stderr || result.stdout).trim().slice(0, 2000);
+    throw new Error(`${label} failed${detail ? `: ${detail}` : ""}`);
+  }
+  return result.stdout;
+}
+
+export function jsonResult(result, label) {
+  const output = requireSuccess(result, label);
+  try {
+    return JSON.parse(output);
+  } catch {
+    throw new Error(`${label} returned invalid JSON`);
+  }
+}
+
+export function awsArgs(plan, profile, serviceArgs) {
+  return [
+    ...(profile ? ["--profile", profile] : []),
+    "--region",
+    plan.aws.region,
+    ...serviceArgs,
+  ];
+}
+
+export function awsJson(plan, profile, serviceArgs, label) {
+  return jsonResult(
+    commandResult("aws", awsArgs(plan, profile, serviceArgs)),
+    label,
+  );
+}
+
+export function ghJson(args, input, label) {
+  return jsonResult(commandResult("gh", args, { input }), label);
+}
+
+export function assertOwnership(resourceTags, plan) {
+  const observed = Object.fromEntries(
+    (resourceTags || []).map((entry) => [entry.Key, String(entry.Value)]),
+  );
+  const expected = {
+    "kungfu:owner": "buildchain",
+    "kungfu:plane": "aws-us-elastic-runner-burst",
+    "kungfu:provider": "macos-ec2-jit",
+    "kungfu:campaign-id": plan.campaign.id,
+    "kungfu:source-sha": plan.source.sha,
+  };
+  for (const [key, value] of Object.entries(expected)) {
+    if (observed[key] !== value) {
+      throw new Error(`AWS resource ownership tag ${key} mismatch`);
+    }
+  }
+}
+
+export function assertDryRun(result, label) {
+  if (
+    result.status === 0 ||
+    !/DryRunOperation/.test(`${result.stdout}\n${result.stderr}`)
+  ) {
+    throw new Error(`${label} did not return DryRunOperation`);
+  }
+}