@kungfu-tech/buildchain 3.0.5-alpha.8 → 3.0.5

package/docs/aws-us-elastic-runner-burst-plane.md

@@ -8,12 +8,7 @@ confidence: high
 sensitivity: public
 evidence_grade: A
 review_state: unreviewed
-last_reviewed: 2026-08-02
-ai_provenance:
-  model_family: GPT-5
-  product: Codex
-  generated_at: 2026-08-01
-  invisible_information: No hidden model checkpoint, parameters, or private training data were available.
+last_reviewed: 2026-07-30
 ---
 
 # AWS US elastic runner burst plane
@@ -143,16 +138,14 @@ The source-bound evidence and deterministic phase receipt are:
 
 The Windows phase uses the explicit `aws-us-ec2-windows-jit` runner preset.
 Its caller supplies one bounded label under
-`aws-us-ec2-windows-jit-<campaign-id>-<qualification-id>`, and Buildchain
-resolves exactly one Windows x64 native lane. The reusable trust gate still
-runs on a GitHub-hosted runner before the JIT label can select EC2.
+`aws-us-ec2-windows-jit-<qualification-id>`, and Buildchain resolves exactly
+one Windows x64 native lane. The reusable trust gate still runs on a
+GitHub-hosted runner before the JIT label can select EC2.
 
 The provider creates repository-level GitHub JIT configuration for
 `kungfu-systems/kungfu`. Its `labels` request must contain all four scheduling
 labels: `self-hosted`, `Windows`, `X64`, and the card-scoped
-`aws-us-ec2-windows-jit-<campaign-id>-<qualification-id>` label. The workflow
-display title also carries both identities, allowing the launch controller to
-verify the queued run against its campaign plan. GitHub's JIT endpoint does
+`aws-us-ec2-windows-jit-<qualification-id>` label. GitHub's JIT endpoint does
 not infer the default OS and architecture labels when they are omitted. The
 encoded configuration is never placed in EC2 user data, a tag, a command log,
 or an artifact. The operator writes it to a card-scoped SSM SecureString under
@@ -175,123 +168,21 @@ Each runner uses:
   security-group rule, no key pair, and no warm Auto Scaling capacity.
 
 Runner diagnostics and a redacted lifecycle record are uploaded to the
-provider's encrypted, private evidence bucket under the exact campaign, run,
-attempt, and instance identity. The runner process exits after one job, Windows
-shuts down, and EC2's instance-initiated shutdown behavior is set to
-`terminate`. A five-minute reaper terminates card-owned stopped or
+provider's encrypted, private evidence bucket. The runner process exits after
+one job, Windows shuts down, and EC2's instance-initiated shutdown behavior is
+set to `terminate`. A five-minute reaper terminates card-owned stopped or
 three-hour-old instances and deletes only their dedicated JIT parameter.
 
 At the 2026-07-29 AWS Price List rate of USD 1.45 per Windows
-`c7i.4xlarge` hour, each accepted instance reserves its complete three-hour
-USD 4.35 fail-closed lifetime before `RunInstances`. A DynamoDB transaction
-binds the exact campaign and source, creates an idempotent run ledger entry,
-and atomically refuses a sixth accepted instance. Five accepted instances
-therefore reserve at most USD 21.75. The campaign also persists the
-operator-observed spend from earlier Windows work, and refuses to arm unless
-that baseline, all five reservations, and one USD 4.35 fail-closed race
-allowance remain below the USD 80 phase cap.
-
-The campaign starts unarmed and expires within 24 hours. Its `CONTROL` record
-can be created only once: a killed or expired campaign cannot be re-armed by
-the campaign tool. A budget notification or any instance lifetime violation
-persists `KILLED` before cleanup, so later workflow dispatches fail before a
-paid launch. Reservations are never refunded: a controller crash, ambiguous
-launch, or successful launch all remain charged to the campaign, favoring a
-false stop over an accidental budget overrun.
-
-Each stack owns a stack-scoped reaper log group, so an independent retained
-one-shot campaign stack can be created without colliding with another
-campaign's audit log resource.
-
-The tag-filtered AWS Budget is defense in depth, not the authoritative launch
-gate. It is disabled by default because a linked account cannot activate a
-cost-allocation tag. Set `EnableTagFilteredBudget=true` only after the AWS
-Organizations management account has activated `kungfu:provider` and a Cost
-Explorer readback proves that `windows-ec2-jit` spend is visible. The DynamoDB
-reservation cap remains mandatory in either mode.
-
-Qualification requires one runner-profile smoke and three trusted exact-source
-full Windows jobs all bound to the same campaign, independent cancellation and
-timeout cleanup exercises, and zero repository runner, EC2 instance,
-disposable volume, min capacity, and desired capacity within 15 minutes of the
-final job.
-
-### Phase 2 campaign controller
-
-`scripts/aws-windows-jit-campaign.mjs` is the one-shot operator boundary.
-Without a mutation mode it emits the arm plan. `arm-campaign` requires the
-campaign id, exact source SHA, state table, observed prior phase spend, and a
-bounded one-to-five accepted-instance ceiling to be repeated as confirmations,
-then creates `CONTROL` and `CAMPAIGN#<id>` with
-`attribute_not_exists`
-conditions. DynamoDB therefore refuses a second campaign in the same retained
-state table. The operator can always use `kill-campaign`; there is deliberately
-no clear or re-arm operation.
-
-Every `scripts/aws-windows-jit-controller.mjs --execute` call must provide the
-same `--campaign-id`, `--confirm-campaign-id`, `--state-table`, and
-`--confirm-state-table`. After the GitHub, AMI, active-instance, SSM, and EC2
-DryRun checks pass, the controller
-atomically reserves one run. Duplicate run-attempt-qualification identities,
-source mismatch, expiry, `KILLED`, the sixth accepted instance, or a
-reservation that would exceed the baseline-adjusted USD 80 phase ceiling all
-fail closed before `RunInstances`.
-
-Example dry-run and arm boundary (do not execute without a new campaign budget
-decision):
+`c7i.4xlarge` hour, six accepted three-hour instances reserve USD 26.10. The
+two-instance race envelope reserves another USD 8.70, producing a USD 34.80
+worst case below the dedicated USD 40 budget. Budget notifications at 80% and
+95% invoke the same card-scoped global kill switch.
 
-```bash
-windows_campaign=win-REPLACE_WITH_CAMPAIGN_ID
-windows_source=REPLACE_WITH_EXACT_40_CHARACTER_SHA
-windows_state_table=REPLACE_WITH_CAMPAIGN_STATE_TABLE
-windows_expires_at=REPLACE_WITH_ISO_TIMESTAMP_WITHIN_24_HOURS
-windows_phase_spend_baseline_usd=REPLACE_WITH_OBSERVED_PRIOR_WINDOWS_SPEND
-windows_max_accepted_instances=REPLACE_WITH_INTEGER_FROM_1_THROUGH_5
-
-node scripts/aws-windows-jit-campaign.mjs plan-arm \
-  --campaign-id "$windows_campaign" \
-  --source-sha "$windows_source" \
-  --state-table "$windows_state_table" \
-  --expires-at "$windows_expires_at" \
-  --phase-spend-baseline-usd "$windows_phase_spend_baseline_usd" \
-  --max-accepted-instances "$windows_max_accepted_instances"
-
-node scripts/aws-windows-jit-campaign.mjs arm-campaign \
-  --campaign-id "$windows_campaign" \
-  --confirm-campaign-id "$windows_campaign" \
-  --source-sha "$windows_source" \
-  --confirm-source-sha "$windows_source" \
-  --state-table "$windows_state_table" \
-  --confirm-state-table "$windows_state_table" \
-  --expires-at "$windows_expires_at" \
-  --phase-spend-baseline-usd "$windows_phase_spend_baseline_usd" \
-  --confirm-phase-spend-baseline-usd "$windows_phase_spend_baseline_usd" \
-  --max-accepted-instances "$windows_max_accepted_instances" \
-  --confirm-max-accepted-instances "$windows_max_accepted_instances"
-```
-
-Arming creates a permanent one-shot control record and admits only the
-explicitly confirmed number of paid instances, never more than five. Its
-rollback is fail-closed, not deletion: `kill-campaign` first
-persists `KILLED`, then publishes to the dedicated SNS topic so the reaper
-terminates active card-owned instances and removes their JIT parameters. The
-command is idempotent, but the operator must read back DynamoDB, EC2, SSM, and
-GitHub runners before treating cleanup as complete:
-
-```bash
-windows_kill_topic=REPLACE_WITH_DEDICATED_KILL_SWITCH_TOPIC_ARN
-
-node scripts/aws-windows-jit-campaign.mjs kill-campaign \
-  --campaign-id "$windows_campaign" \
-  --confirm-campaign-id "$windows_campaign" \
-  --source-sha "$windows_source" \
-  --confirm-source-sha "$windows_source" \
-  --state-table "$windows_state_table" \
-  --confirm-state-table "$windows_state_table" \
-  --kill-switch-topic "$windows_kill_topic" \
-  --confirm-kill-switch-topic "$windows_kill_topic" \
-  --reason operator-kill
-```
+Qualification requires one runner-profile smoke, three trusted exact-source
+full Windows jobs, independent cancellation and timeout cleanup exercises, and
+zero repository runner, EC2 instance, disposable volume, min capacity, and
+desired capacity within 15 minutes of the final job.
 
 ## Phase 3 contract
 
@@ -335,32 +226,6 @@ host, including at least one full run, plus proof that:
 - AWS has no active campaign instance or allocated campaign host;
 - actual incremental spend remained below USD 25.
 
-### Phase 3 lifecycle controller
-
-`scripts/aws-macos-jit-controller.mjs` is the operator boundary for the paid
-campaign. It has three explicit mutation modes:
-
-- `launch-campaign` binds the exact repository source, AMI, availability zone,
-  tagged Dedicated Host, and reusable instance. It rejects pre-existing Mac
-  capacity and requires successful `AllocateHosts` and `RunInstances` DryRuns
-  before either real call.
-- `run-job` binds one queued exact-source GitHub job to the existing campaign
-  host and instance. It writes the repository JIT configuration through a
-  mode-0600 temporary file into a distinct SSM SecureString, sends only the
-  credential-free bootstrap through SSM, and removes the parameter plus runner
-  registration if command delivery fails.
-- `close-campaign` refuses execution before the provider's 24-hour minimum,
-  verifies the encrypted delete-on-termination root volume, removes scoped JIT
-  residue, terminates the exact instance, and requires a `ReleaseHosts` DryRun
-  before release. If Apple host scrubbing is still in progress, it reports
-  `release-pending`; the ten-minute card-scoped reaper remains the bounded
-  retry path.
-
-Every execute mode requires the exact source SHA and campaign id to be repeated
-through `--confirm-source-sha` and `--confirm-campaign-id`. `run-job` also
-requires `--confirm-run-id`. Omitting `--execute` emits a deterministic plan
-without changing AWS or GitHub state.
-
 ## Provider lifecycle
 
 The three infrastructure templates live under

package/docs/cli-reference.md

@@ -1668,17 +1668,6 @@ buildchain release-governance reconcile --repository <owner/repo> --branch <dev|
 buildchain release-propagation
 ```
 
-### `buildchain release-propagation pickup`
-
-- Help: `buildchain release-propagation pickup --help`
-- Canonical id: `release-propagation`
-- Options: none declared
-- Syntax:
-
-```text
-buildchain release-propagation <plan|write-lock|work|pickup> ...
-```
-
 ### `buildchain release-propagation plan`
 
 - Help: `buildchain release-propagation plan --help`
@@ -1687,18 +1676,7 @@ buildchain release-propagation <plan|write-lock|work|pickup> ...
 - Syntax:
 
 ```text
-buildchain release-propagation <plan|write-lock|work|pickup> ...
-```
-
-### `buildchain release-propagation work`
-
-- Help: `buildchain release-propagation work --help`
-- Canonical id: `release-propagation`
-- Options: none declared
-- Syntax:
-
-```text
-buildchain release-propagation <plan|write-lock|work|pickup> ...
+buildchain release-propagation <plan|write-lock> ...
 ```
 
 ### `buildchain release-propagation write-lock`
@@ -1709,7 +1687,7 @@ buildchain release-propagation <plan|write-lock|work|pickup> ...
 - Syntax:
 
 ```text
-buildchain release-propagation <plan|write-lock|work|pickup> ...
+buildchain release-propagation <plan|write-lock> ...
 ```
 
 ## `sample`