@kungfu-tech/buildchain 3.0.5 → 3.0.6-alpha.0

package/scripts/auditable-demo-transport-smoke.mjs

@@ -0,0 +1,176 @@
+#!/usr/bin/env node
+// SPDX-License-Identifier: Apache-2.0
+
+import { spawnSync } from "node:child_process";
+import crypto from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+import {
+  prepareArtifact,
+  validateScenario,
+} from "./auditable-demo-platform.mjs";
+
+const NON_AUTHORITIES = [
+  "first-party-identity",
+  "system-identity",
+  "kfd-compliance",
+  "product-system-metadata",
+  "package-metadata",
+  "registry-history",
+  "scan-output",
+  "standalone-generation",
+];
+
+function fail(message) {
+  throw new Error(`auditable demo transport smoke: ${message}`);
+}
+
+function inside(root, relative, label) {
+  if (typeof relative !== "string" || !relative || path.isAbsolute(relative))
+    fail(`${label} must be relative`);
+  const resolvedRoot = path.resolve(root);
+  const resolved = path.resolve(resolvedRoot, relative);
+  if (
+    resolved === resolvedRoot ||
+    !resolved.startsWith(`${resolvedRoot}${path.sep}`)
+  )
+    fail(`${label} escapes its root`);
+  return resolved;
+}
+
+function removeExecuteBits(root) {
+  for (const entry of fs.readdirSync(root, { withFileTypes: true })) {
+    const file = path.join(root, entry.name);
+    if (entry.isDirectory()) removeExecuteBits(file);
+    else if (entry.isFile())
+      fs.chmodSync(file, fs.statSync(file).mode & ~0o111);
+  }
+}
+
+function isolatedEnvironment(home, declared) {
+  const env = {
+    PATH: "/usr/local/bin:/usr/bin:/bin",
+    HOME: home,
+    XDG_CACHE_HOME: path.join(home, ".cache"),
+    XDG_CONFIG_HOME: path.join(home, ".config"),
+    XDG_DATA_HOME: path.join(home, ".local/share"),
+    XDG_STATE_HOME: path.join(home, ".local/state"),
+    LANG: "C.UTF-8",
+    LC_ALL: "C.UTF-8",
+    TZ: "UTC",
+    CI: "true",
+    TERM: "xterm-256color",
+    COLORTERM: "truecolor",
+    FORCE_COLOR: "3",
+  };
+  for (const [key, value] of Object.entries(declared)) {
+    if (Object.hasOwn(env, key))
+      fail(
+        `scenario environment may not override the isolated baseline: ${key}`,
+      );
+    env[key] = value;
+  }
+  return env;
+}
+
+export function runTransportSmoke({ artifactRoot, scenarioPath }) {
+  if (process.platform === "win32")
+    fail("transport smoke currently requires a POSIX host");
+  const root = path.resolve(artifactRoot);
+  const scenario = validateScenario(
+    JSON.parse(fs.readFileSync(path.resolve(scenarioPath), "utf8")),
+  );
+  if (!scenario.transportSmoke) fail("scenario.transportSmoke is required");
+  const distributionRelative = path.posix.dirname(
+    scenario.artifact.metadataPath,
+  );
+  const sourceDistribution =
+    distributionRelative === "."
+      ? root
+      : inside(root, distributionRelative, "distribution root");
+  const temporaryRoot = fs.mkdtempSync(
+    path.join(os.tmpdir(), "buildchain-demo-transport-"),
+  );
+  try {
+    const transportedRoot = path.join(temporaryRoot, "artifact");
+    const transportedDistribution =
+      distributionRelative === "."
+        ? transportedRoot
+        : path.join(transportedRoot, ...distributionRelative.split("/"));
+    fs.mkdirSync(path.dirname(transportedDistribution), { recursive: true });
+    fs.cpSync(sourceDistribution, transportedDistribution, {
+      recursive: true,
+      dereference: false,
+      preserveTimestamps: true,
+      verbatimSymlinks: true,
+    });
+    removeExecuteBits(transportedDistribution);
+    const prepared = prepareArtifact({
+      artifactRoot: transportedRoot,
+      scenarioPath,
+    });
+    const binary = inside(
+      transportedRoot,
+      scenario.artifact.binaryPath,
+      "transport smoke binary",
+    );
+    const workspace = path.join(temporaryRoot, "workspace");
+    const home = path.join(temporaryRoot, "home");
+    fs.mkdirSync(workspace);
+    fs.mkdirSync(home);
+    const smoke = scenario.transportSmoke;
+    const result = spawnSync(binary, smoke.argv, {
+      cwd: workspace,
+      env: isolatedEnvironment(home, scenario.execution.environment),
+      encoding: "utf8",
+      timeout: smoke.timeoutSeconds * 1000,
+      maxBuffer: 4 * 1024 * 1024,
+    });
+    const output = `${result.stdout || ""}${result.stderr || ""}`;
+    if (result.error) fail(`could not execute: ${result.error.message}`);
+    if (!smoke.expectedExitCodes.includes(result.status))
+      fail(`exited with ${result.status}; output: ${output.slice(-4096)}`);
+    for (const expected of smoke.stdoutIncludes)
+      if (!output.includes(expected)) fail(`output is missing: ${expected}`);
+    return {
+      schema: "buildchain.declarative-demo-transport-smoke/v1",
+      status: "passed",
+      executableFiles: prepared.executableFiles,
+      argv: smoke.argv,
+      exitCode: result.status,
+      outputRoot: `sha256:${crypto.createHash("sha256").update(output).digest("hex")}`,
+      authority: {
+        classification: "pre-upload-transport-diagnostic",
+        grants: [],
+        nonAuthorities: NON_AUTHORITIES,
+      },
+    };
+  } finally {
+    fs.rmSync(temporaryRoot, { recursive: true, force: true });
+  }
+}
+
+function parseArgs(argv) {
+  const values = {};
+  for (let index = 0; index < argv.length; index += 2)
+    values[argv[index].replace(/^--/u, "")] = argv[index + 1];
+  return values;
+}
+
+if (
+  process.argv[1] &&
+  import.meta.url === pathToFileURL(process.argv[1]).href
+) {
+  try {
+    const args = parseArgs(process.argv.slice(2));
+    process.stdout.write(
+      `${JSON.stringify({ ok: true, ...runTransportSmoke({ artifactRoot: args["artifact-root"], scenarioPath: args.scenario }) }, null, 2)}\n`,
+    );
+  } catch (error) {
+    console.error(error instanceof Error ? error.message : String(error));
+    process.exitCode = 1;
+  }
+}

package/scripts/auditable-demo.mjs

@@ -36,6 +36,10 @@ const OPTIONAL_ADAPTER_FILES = [
 ];
 const MAX_TERMINAL_CAPTURE_BYTES = 4 * 1024 * 1024;
 const MAX_TERMINAL_CAPTURE_EVENTS = 10_000;
+const STANDARD_MAX_DURATION_MS = 60_000;
+const LONG_FORM_MAX_DURATION_MS = 180_000;
+const LONG_FORM_MAX_FPS = 10;
+const MAX_RENDER_FRAMES = 1_800;
 
 function invariant(condition, message) {
   if (!condition) throw new Error(message);
@@ -186,15 +190,20 @@ function validateScene(value) {
   exactKeys(
     value,
     ["schema", "id", "width", "height", "fps", "durationMs", "title"],
-    ["commandLabel", "background", "accent"],
+    ["durationClass", "commandLabel", "background", "accent"],
     "scene",
   );
   invariant(value.schema === "build-images.demo-scene/v1", "unsupported scene schema");
   invariant(/^[a-z0-9][a-z0-9._-]{0,63}$/.test(value.id), "scene.id is invalid");
   integer(value.width, 640, 1920, "scene.width");
   integer(value.height, 360, 1080, "scene.height");
-  integer(value.fps, 1, 30, "scene.fps");
-  integer(value.durationMs, 500, 60000, "scene.durationMs");
+  const durationClass = value.durationClass ?? "standard";
+  invariant(durationClass === "standard" || durationClass === "long-form", "scene.durationClass is invalid");
+  const maximumDurationMs = durationClass === "long-form" ? LONG_FORM_MAX_DURATION_MS : STANDARD_MAX_DURATION_MS;
+  const maximumFps = durationClass === "long-form" ? LONG_FORM_MAX_FPS : 30;
+  integer(value.fps, 1, maximumFps, "scene.fps");
+  integer(value.durationMs, 500, maximumDurationMs, "scene.durationMs");
+  invariant(Math.ceil((value.durationMs / 1000) * value.fps) <= MAX_RENDER_FRAMES, "scene exceeds the deterministic source-frame bound");
   text(value.title, 1, 120, "scene.title");
   if (value.commandLabel !== undefined) text(value.commandLabel, 0, 160, "scene.commandLabel");
   for (const key of ["background", "accent"]) {
@@ -206,6 +215,7 @@ function validateScene(value) {
     width: value.width,
     height: value.height,
     fps: value.fps,
+    ...(value.durationClass === undefined ? {} : { durationClass }),
     durationMs: value.durationMs,
     title: value.title,
     commandLabel: value.commandLabel ?? "",
@@ -524,7 +534,7 @@ function validateBudgetBasis(entry, label) {
     MAX_BUNDLE_MEMBER_BYTES,
     `${label}.budgetBasis.observedBytes`,
   );
-  const multiplier = integer(entry.budgetBasis.multiplier, 1, 64, `${label}.budgetBasis.multiplier`);
+  const multiplier = integer(entry.budgetBasis.multiplier, 1, 128, `${label}.budgetBasis.multiplier`);
   invariant(entry.budgetBasis.rounding === "next-power-of-two", `${label}.budgetBasis.rounding is unsupported`);
   const expected = 2 ** Math.ceil(Math.log2(observedBytes * multiplier));
   invariant(entry.maximumBytes === expected, `${label}.maximumBytes does not match its measured budget basis`);
@@ -1017,6 +1027,15 @@ function verifyRendererOutput(renderOutput, expectedImage, expectedInputs, optio
   return { manifest, probe, qualification };
 }
 
+function renditionInputRoots(root, renditions) {
+  return renditions.map((rendition) => ({
+    id: rendition.id, role: rendition.role, captureRoot: rendition.captureRoot,
+    sceneRoot: sha256(readRegular(path.join(root, rendition.files.scene), `${rendition.id} scene`)),
+    transcriptRoot: sha256(readRegular(path.join(root, rendition.files.transcript), `${rendition.id} transcript`)),
+    projectionRoot: sha256(readRegular(path.join(root, rendition.files.projection), `${rendition.id} projection`)),
+  }));
+}
+
 function finalizeGate(values) {
   const adapterOutput = path.resolve(required(values, "--adapter-output"));
   const smokeInput = path.resolve(required(values, "--smoke-input"));
@@ -1109,14 +1128,7 @@ function finalizeGate(values) {
           renditionSet: {
             schema: normalized.renditionSet.schema,
             root: sha256(readRegular(path.join(output, "rendition-set.json"), "rendition set")),
-            renditions: normalized.renditionSet.renditions.map((rendition) => ({
-              id: rendition.id,
-              role: rendition.role,
-              captureRoot: rendition.captureRoot,
-              sceneRoot: sha256(readRegular(path.join(output, rendition.scene), `${rendition.id} scene`)),
-              transcriptRoot: sha256(readRegular(path.join(output, rendition.transcript), `${rendition.id} transcript`)),
-              projectionRoot: sha256(readRegular(path.join(output, rendition.projection), `${rendition.id} projection`)),
-            })),
+            renditions: renditionInputRoots(output, normalized.renditionSet.renditions),
           },
         }
         : {}),
@@ -1179,15 +1191,8 @@ function verifyGate(values) {
     invariant(
       qualifiedRenditionSet.schema === normalized.renditionSet.schema
         && qualifiedRenditionSet.root === sha256(readRegular(path.join(bundle, "rendition-set.json"), "rendition set"))
-        && JSON.stringify(qualifiedRenditionSet.renditions)
-          === JSON.stringify(normalized.renditionSet.renditions.map((rendition) => ({
-            id: rendition.id,
-            role: rendition.role,
-            captureRoot: rendition.captureRoot,
-            sceneRoot: sha256(readRegular(path.join(bundle, rendition.scene), `${rendition.id} scene`)),
-            transcriptRoot: sha256(readRegular(path.join(bundle, rendition.transcript), `${rendition.id} transcript`)),
-            projectionRoot: sha256(readRegular(path.join(bundle, rendition.projection), `${rendition.id} projection`)),
-          }))),
+        && stableJson(qualifiedRenditionSet.renditions)
+          === stableJson(renditionInputRoots(bundle, normalized.renditionSet.renditions)),
       "gate native rendition roots mismatch",
     );
   }
@@ -1311,6 +1316,7 @@ export {
   inspectRendererMedia,
   parseAdapterArguments,
   qualifyMediaFixture,
+  renditionInputRoots,
   prepareSmoke,
   runAdapter,
   sha256,

package/scripts/aws-macos-jit-controller-core.mjs

@@ -0,0 +1,389 @@
+// SPDX-License-Identifier: Apache-2.0
+
+import { digest } from "./aws-runner-burst-core.mjs";
+import {
+  MACOS_EC2_JIT,
+  macosJitRunnerLabel,
+  macosJitRunnerLabels,
+} from "./aws-macos-jit-core.mjs";
+
+export const AWS_MACOS_JIT_CONTROLLER_CONTRACT =
+  "kungfu-buildchain-aws-macos-jit-controller/v1";
+
+function exact(value, pattern, label) {
+  const normalized = String(value || "").trim();
+  if (!pattern.test(normalized)) throw new Error(`${label} is invalid`);
+  return normalized;
+}
+
+function exactSha(value) {
+  return exact(value, /^[0-9a-f]{40}$/i, "sourceSha").toLowerCase();
+}
+
+function iso(value, label) {
+  const parsed = new Date(value || "");
+  if (!Number.isFinite(parsed.getTime())) {
+    throw new Error(`${label} must be an ISO timestamp`);
+  }
+  return parsed.toISOString();
+}
+
+function tag(key, value) {
+  return { Key: key, Value: String(value) };
+}
+
+function repository(value) {
+  const resolved = exact(
+    value || MACOS_EC2_JIT.repository,
+    /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/,
+    "repository",
+  );
+  if (resolved !== MACOS_EC2_JIT.repository) {
+    throw new Error(`repository must be ${MACOS_EC2_JIT.repository}`);
+  }
+  return resolved;
+}
+
+function source(values) {
+  return {
+    sha: exactSha(values.sourceSha),
+    ref: exact(
+      values.sourceRef,
+      /^refs\/heads\/[A-Za-z0-9._/-]+$/,
+      "sourceRef",
+    ),
+  };
+}
+
+function campaignId(value) {
+  return exact(value, /^[a-z0-9][a-z0-9-]{2,47}$/, "campaignId");
+}
+
+function qualificationId(value) {
+  return exact(value, /^mac-(?:smoke-0[12]|full-01)$/, "qualificationId");
+}
+
+function commonAws(values) {
+  const region = exact(
+    values.region || MACOS_EC2_JIT.region,
+    /^us-[a-z]+-\d$/,
+    "region",
+  );
+  if (region !== MACOS_EC2_JIT.region) {
+    throw new Error(`region must be ${MACOS_EC2_JIT.region}`);
+  }
+  const instanceType = exact(
+    values.instanceType || MACOS_EC2_JIT.instanceType,
+    /^mac2\.metal$/,
+    "instanceType",
+  );
+  if (instanceType !== MACOS_EC2_JIT.instanceType) {
+    throw new Error(`instanceType must be ${MACOS_EC2_JIT.instanceType}`);
+  }
+  return {
+    region,
+    availabilityZone: exact(
+      values.availabilityZone,
+      /^us-[a-z]+-\d[a-z]$/,
+      "availabilityZone",
+    ),
+    instanceType,
+    amiId: exact(values.amiId, /^ami-[0-9a-f]+$/, "amiId"),
+    amiName: exact(values.amiName, /^[A-Za-z0-9._-]+$/, "amiName"),
+    subnetId: exact(values.subnetId, /^subnet-[0-9a-f]+$/, "subnetId"),
+    securityGroupId: exact(
+      values.securityGroupId,
+      /^sg-[0-9a-f]+$/,
+      "securityGroupId",
+    ),
+    instanceProfileName: exact(
+      values.instanceProfileName,
+      /^[A-Za-z0-9+=,.@_-]{1,128}$/,
+      "instanceProfileName",
+    ),
+    evidenceBucket: exact(
+      values.evidenceBucket,
+      /^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/,
+      "evidenceBucket",
+    ),
+  };
+}
+
+function ownershipTags({ id, sourceSha }) {
+  return [
+    tag("kungfu:owner", "buildchain"),
+    tag("kungfu:plane", "aws-us-elastic-runner-burst"),
+    tag("kungfu:provider", "macos-ec2-jit"),
+    tag("kungfu:campaign-id", id),
+    tag("kungfu:source-sha", sourceSha),
+  ];
+}
+
+export function createMacosJitCampaignPlan(values = {}) {
+  const id = campaignId(values.campaignId);
+  const boundSource = source(values);
+  const aws = commonAws(values);
+  const tags = ownershipTags({ id, sourceSha: boundSource.sha });
+  const createdAt = iso(values.createdAt, "createdAt");
+  const plan = {
+    schemaVersion: 1,
+    contract: AWS_MACOS_JIT_CONTROLLER_CONTRACT,
+    kind: "campaign-launch-plan",
+    repository: repository(values.repository),
+    campaign: { id, createdAt },
+    source: boundSource,
+    aws: {
+      ...aws,
+      hostTags: tags,
+      instanceTags: tags,
+      volumeTags: tags,
+      hostClientToken: `kungfu-mac-host-${id}`,
+      instanceClientToken: `kungfu-mac-instance-${id}`,
+      rootVolume: {
+        deviceName: "/dev/sda1",
+        deleteOnTermination: true,
+        encrypted: true,
+        volumeSizeGiB: 200,
+        volumeType: "gp3",
+      },
+      metadata: {
+        httpEndpoint: "enabled",
+        httpTokens: "required",
+        httpPutResponseHopLimit: 1,
+        instanceMetadataTags: "disabled",
+      },
+    },
+    safety: {
+      applyMode: values.execute === true ? "execute" : "dry-run",
+      exactSourceRequired: true,
+      activeHostCeiling: MACOS_EC2_JIT.maxAcceptedHosts,
+      activeInstanceCeiling: 1,
+      awsDryRunRequiredBeforeAllocation: true,
+      awsDryRunRequiredBeforeLaunch: true,
+      retainHostOnInstanceLaunchFailure: true,
+      minimumHostAllocationHours: MACOS_EC2_JIT.minimumHostAllocationHours,
+      maximumHostAllocationHours: MACOS_EC2_JIT.maximumHostAllocationHours,
+      cleanupOwner: "scheduled-card-scoped-reaper",
+    },
+  };
+  return { ...plan, digest: digest(plan) };
+}
+
+export function macosAllocateHostsArgs(plan, { dryRun = false } = {}) {
+  if (
+    plan?.contract !== AWS_MACOS_JIT_CONTROLLER_CONTRACT ||
+    plan.kind !== "campaign-launch-plan"
+  ) {
+    throw new Error("macOS JIT campaign launch plan contract is invalid");
+  }
+  const args = [
+    "ec2",
+    "allocate-hosts",
+    "--availability-zone",
+    plan.aws.availabilityZone,
+    "--instance-type",
+    plan.aws.instanceType,
+    "--quantity",
+    "1",
+    "--auto-placement",
+    "off",
+    "--client-token",
+    plan.aws.hostClientToken,
+    "--tag-specifications",
+    JSON.stringify([
+      { ResourceType: "dedicated-host", Tags: plan.aws.hostTags },
+    ]),
+    "--output",
+    "json",
+  ];
+  if (dryRun) args.splice(2, 0, "--dry-run");
+  return args;
+}
+
+export function macosRunInstancesArgs(plan, { hostId, dryRun = false } = {}) {
+  if (
+    plan?.contract !== AWS_MACOS_JIT_CONTROLLER_CONTRACT ||
+    plan.kind !== "campaign-launch-plan"
+  ) {
+    throw new Error("macOS JIT campaign launch plan contract is invalid");
+  }
+  const resolvedHostId = exact(hostId, /^h-[0-9a-f]+$/, "hostId");
+  const args = [
+    "ec2",
+    "run-instances",
+    "--image-id",
+    plan.aws.amiId,
+    "--instance-type",
+    plan.aws.instanceType,
+    "--count",
+    "1",
+    "--client-token",
+    plan.aws.instanceClientToken,
+    "--iam-instance-profile",
+    JSON.stringify({ Name: plan.aws.instanceProfileName }),
+    "--subnet-id",
+    plan.aws.subnetId,
+    "--security-group-ids",
+    plan.aws.securityGroupId,
+    "--associate-public-ip-address",
+    "--placement",
+    JSON.stringify({ HostId: resolvedHostId, Tenancy: "host" }),
+    "--block-device-mappings",
+    JSON.stringify([
+      {
+        DeviceName: plan.aws.rootVolume.deviceName,
+        Ebs: {
+          DeleteOnTermination: plan.aws.rootVolume.deleteOnTermination,
+          Encrypted: plan.aws.rootVolume.encrypted,
+          VolumeSize: plan.aws.rootVolume.volumeSizeGiB,
+          VolumeType: plan.aws.rootVolume.volumeType,
+        },
+      },
+    ]),
+    "--metadata-options",
+    JSON.stringify({
+      HttpEndpoint: plan.aws.metadata.httpEndpoint,
+      HttpTokens: plan.aws.metadata.httpTokens,
+      HttpPutResponseHopLimit: plan.aws.metadata.httpPutResponseHopLimit,
+      InstanceMetadataTags: plan.aws.metadata.instanceMetadataTags,
+    }),
+    "--instance-initiated-shutdown-behavior",
+    "stop",
+    "--tag-specifications",
+    JSON.stringify([
+      { ResourceType: "instance", Tags: plan.aws.instanceTags },
+      { ResourceType: "volume", Tags: plan.aws.volumeTags },
+    ]),
+    "--output",
+    "json",
+  ];
+  if (dryRun) args.splice(2, 0, "--dry-run");
+  return args;
+}
+
+export function createMacosJitJobPlan(values = {}) {
+  const id = campaignId(values.campaignId);
+  const boundSource = source(values);
+  const qualification = qualificationId(values.qualificationId);
+  const runnerLabel = macosJitRunnerLabel(values.runnerLabel);
+  const expectedLabel = `${MACOS_EC2_JIT.labelPrefix}${qualification}`;
+  if (runnerLabel !== expectedLabel) {
+    throw new Error(`runnerLabel must be ${expectedLabel}`);
+  }
+  const runId = exact(values.runId, /^\d+$/, "runId");
+  const runAttempt = exact(
+    values.runAttempt || "1",
+    /^[1-9]\d*$/,
+    "runAttempt",
+  );
+  const hostAllocatedAt = iso(values.hostAllocatedAt, "hostAllocatedAt");
+  const jitParameterName = `${MACOS_EC2_JIT.jitParameterPrefix}${id}/${runId}/${runAttempt}/${qualification}`;
+  const plan = {
+    schemaVersion: 1,
+    contract: AWS_MACOS_JIT_CONTROLLER_CONTRACT,
+    kind: "job-run-plan",
+    repository: repository(values.repository),
+    campaign: { id },
+    source: boundSource,
+    github: {
+      runId,
+      runAttempt,
+      jobId: exact(values.jobId, /^\d+$/, "jobId"),
+      qualificationId: qualification,
+      event: "workflow_dispatch",
+    },
+    runner: {
+      name: exact(
+        values.runnerName,
+        /^[A-Za-z0-9][A-Za-z0-9._-]{0,79}$/,
+        "runnerName",
+      ),
+      label: runnerLabel,
+      labels: macosJitRunnerLabels(runnerLabel),
+      oneJobJit: true,
+    },
+    aws: {
+      ...commonAws(values),
+      hostId: exact(values.hostId, /^h-[0-9a-f]+$/, "hostId"),
+      instanceId: exact(values.instanceId, /^i-[0-9a-f]+$/, "instanceId"),
+      hostAllocatedAt,
+      jitParameterName,
+    },
+    safety: {
+      applyMode: values.execute === true ? "execute" : "dry-run",
+      exactSourceRequired: true,
+      queuedJobRequired: true,
+      sameCampaignHostRequired: true,
+      sameCampaignInstanceRequired: true,
+      jitConfigTransport: "0600-temporary-file-to-ssm-secure-string",
+      bootstrapTransport: "0600-temporary-file-to-ssm-command",
+      jitConfigInBootstrap: false,
+      jitConfigInArgv: false,
+      cleanupOnCommandFailure: ["ssm-parameter", "github-runner-registration"],
+    },
+  };
+  return { ...plan, digest: digest(plan) };
+}
+
+export function createMacosJitClosePlan(values = {}) {
+  const id = campaignId(values.campaignId);
+  const boundSource = source(values);
+  const hostAllocatedAt = iso(values.hostAllocatedAt, "hostAllocatedAt");
+  const observedAt = iso(values.observedAt, "observedAt");
+  const allocationHours =
+    (new Date(observedAt).getTime() - new Date(hostAllocatedAt).getTime()) /
+    3_600_000;
+  if (allocationHours < MACOS_EC2_JIT.minimumHostAllocationHours) {
+    throw new Error(
+      `Dedicated Host cannot be closed before ${MACOS_EC2_JIT.minimumHostAllocationHours} hours`,
+    );
+  }
+  const plan = {
+    schemaVersion: 1,
+    contract: AWS_MACOS_JIT_CONTROLLER_CONTRACT,
+    kind: "campaign-close-plan",
+    repository: repository(values.repository),
+    campaign: { id },
+    source: boundSource,
+    aws: {
+      ...commonAws(values),
+      hostId: exact(values.hostId, /^h-[0-9a-f]+$/, "hostId"),
+      instanceId: exact(values.instanceId, /^i-[0-9a-f]+$/, "instanceId"),
+      hostAllocatedAt,
+    },
+    lifecycle: {
+      observedAt,
+      allocationHours,
+      minimumHostAllocationHours: MACOS_EC2_JIT.minimumHostAllocationHours,
+      maximumHostAllocationHours: MACOS_EC2_JIT.maximumHostAllocationHours,
+    },
+    safety: {
+      applyMode: values.execute === true ? "execute" : "dry-run",
+      exactCampaignOwnershipRequired: true,
+      instanceTerminationRequiredBeforeRelease: true,
+      encryptedDeleteOnTerminationVolumeRequired: true,
+      awsDryRunRequiredBeforeRelease: true,
+      reaperFallback: true,
+    },
+  };
+  return { ...plan, digest: digest(plan) };
+}
+
+export function macosReleaseHostsArgs(plan, { dryRun = false } = {}) {
+  if (
+    plan?.contract !== AWS_MACOS_JIT_CONTROLLER_CONTRACT ||
+    plan.kind !== "campaign-close-plan"
+  ) {
+    throw new Error("macOS JIT campaign close plan contract is invalid");
+  }
+  const args = [
+    "ec2",
+    "release-hosts",
+    "--host-ids",
+    plan.aws.hostId,
+    "--output",
+    "json",
+  ];
+  if (dryRun) args.splice(2, 0, "--dry-run");
+  return args;
+}