@raindancers/raindancers-crew 0.0.0

package/.kiro/specs/private-brain-construct-changes/design.md

@@ -0,0 +1,147 @@
+# Design — `@raindancers/raindancers-crew` changes for the 55minutes brain
+
+All changes land on **`RemoteCrewInstance`** and its `bootstrap.sh`. Every one is **additive**;
+the no-prop path is unchanged. Files touched:
+`src/remote-crew-instance-props.ts`, `src/remote-crew-instance.ts`, `src/assets/bootstrap.sh`,
+and tests under `test/`.
+
+## Prop additions (jsii-clean)
+
+Extend `RemoteCrewInstanceProps` with these optional fields:
+
+```ts
+/** Assign an IPv6 address to the instance ENI and permit IPv6 egress.
+ *  Requires the selected subnet(s) to have IPv6 CIDRs — this construct does NOT
+ *  provision subnet CIDRs, an Egress-Only IGW, or routes (consumer VPC concern).
+ *  @default false */
+readonly enableIpv6?: boolean;
+
+/** Expose the gateway's native-webhook port to ONE source security group only.
+ *  There is deliberately no CIDR form: the box is never internet-reachable. */
+readonly webhookIngress?: WebhookIngress;
+
+/** Secrets Manager ARN of the Bearer token that authenticates POST /api/hooks/agent.
+ *  Fetched at boot into the gateway env; instance role gets GetSecretValue on this ARN only.
+ *  Required when webhookIngress is set. @default - webhook disabled (loopback/SSM only) */
+readonly webhookTokenSecretArn?: string;
+
+/** 24/7 brain runtime settings, threaded into the bootstrap kirocrew config. */
+readonly crewRuntime?: CrewRuntime;
+```
+
+New jsii interfaces:
+
+```ts
+export interface WebhookIngress {
+  /** Imported SG allowed to reach the webhook port (e.g. the ingest Lambda's SG). */
+  readonly source: ec2.ISecurityGroup;
+  /** Webhook listener TCP port. @default 5477 (dashboard stays on dashboardPort/5476, loopback) */
+  readonly port?: number;
+}
+
+export interface CrewRuntime {
+  /** Enable Autopilot mode. @default false (gateway default) */
+  readonly autopilot?: boolean;
+  /** Keep the brain session alive between events (disable idle-session-close). @default false */
+  readonly disableIdleClose?: boolean;
+  /** Roster config the bootstrap applies (installed agent configs incl. the conductor).
+   *  Delivered via `source` or an inline manifest — see "Roster provisioning" below. */
+  readonly roster?: CrewRosterConfig;
+}
+```
+
+**Why a separate webhook port (default 5477), not 5476:** the dashboard port stays loopback-only,
+reached via SSM port-forward, exactly as today (RC3.3). Opening ingress on 5476 would expose the
+dashboard to the source SG. The webhook route binds on its own port so only `POST /api/hooks/agent`
+is reachable from the ingest Lambda.
+
+## Security-group changes (`remote-crew-instance.ts`)
+
+The construct already creates one SG (`allowAllOutbound: true`, no inbound). Add, conditionally:
+
+1. **IPv6 egress** (when `enableIpv6`):
+   ```ts
+   this.securityGroup.addEgressRule(ec2.Peer.anyIpv6(), ec2.Port.allTraffic(), 'IPv6 egress');
+   ```
+   (CDK's `allowAllOutbound` renders IPv4 `0.0.0.0/0` only, so the v6 rule is required — RC1.2.)
+
+2. **Webhook ingress from the source SG** (when `webhookIngress`):
+   ```ts
+   const port = props.webhookIngress.port ?? 5477;
+   this.securityGroup.addIngressRule(
+     ec2.Peer.securityGroupId(props.webhookIngress.source.securityGroupId),
+     ec2.Port.tcp(port),
+     'Native webhook from ingest Lambda SG only');
+   ```
+   Never a CIDR peer (RC2.2). The existing `allowSshCidr` path is untouched and independent (RC2.3).
+
+## ENI / IPv6 (when `enableIpv6`)
+
+`RemoteCrewInstance` launches via a launch template / instance. Set IPv6 on the primary ENI:
+- Launch-template network interface `ipv6AddressCount: 1` (or `assignIpv6AddressOnCreation` on the
+  ENI), gated on `enableIpv6`.
+- Leave `associatePublicIp` to the existing prop; the 55minutes posture passes
+  `associatePublicIp: false` + `enableIpv6: true` → private, dual-stack, IPv6-egress, no public IPv4
+  (RC1.4). Add a synth-time note when `enableIpv6` is set but the resolved subnets expose no IPv6
+  CIDR (best-effort; the VPC owns the CIDR — RC1.3).
+
+## Secrets grant (when `webhookTokenSecretArn`)
+
+```ts
+const secret = secretsmanager.Secret.fromSecretCompleteArn(this, 'WebhookToken', arn);
+secret.grantRead(this.role);   // GetSecretValue on this one secret ARN only (RC3.2)
+```
+Fail synth if `webhookIngress` is set without `webhookTokenSecretArn` (a reachable webhook with no
+auth is a defect, not a default).
+
+## `bootstrap.sh` changes — all guarded, default path unchanged (RC3.4 / RC4.4)
+
+Today: `kirocrew setup --agent-only` → `kirocrew gateway`; systemd unit sets `KIROCREW_PORT`,
+`HOME`, `PATH`; health check `curl http://127.0.0.1:$DASHBOARD_PORT/`.
+
+Add, only when the corresponding CFN parameter/env is non-empty (passed from the construct as
+userData substitutions):
+
+- **Webhook token:** if `WEBHOOK_TOKEN_SECRET_ARN` set → `aws secretsmanager get-secret-value` at
+  boot, export the token into the gateway env (e.g. `KIROCREW_HOOK_TOKEN`), and configure the
+  gateway to serve `POST /api/hooks/agent` on `WEBHOOK_PORT` (default 5477) bound to the instance's
+  routable address (not loopback). Dashboard stays on `KIROCREW_PORT` loopback.
+- **Autopilot:** if enabled → the `kirocrew` config/env flag that turns Autopilot on.
+- **No idle-close:** if enabled → the session-idle-close-disable setting.
+- **Roster:** see below.
+
+The token is fetched, never baked. Keep the WaitCondition/health-check gate; extend it to also
+confirm the webhook route answers when the webhook is configured.
+
+### Roster provisioning (RC4.3)
+
+Two candidate mechanisms — design picks one in tasks:
+- **(a) `source`-delivered manifest:** the roster ships as part of the KiroCrew source tarball /
+  repo the box already installs; bootstrap runs `kirocrew agent`-equivalent apply. Zero new transport.
+- **(b) Inline `CrewRosterConfig`:** the construct writes a small manifest to userData/SSM param and
+  bootstrap applies it. More prop surface, but self-contained.
+  Lean **(a)** unless the consumer needs per-deploy roster variation; keep the prop as the seam.
+
+## Backward-compatibility proof
+
+- No-prop synth ⇒ identical template (assertion test snapshots the SG rules = none-inbound +
+  IPv4-only egress, no IPv6 ENI, no secret grant, and the rendered `bootstrap.sh` = current bytes).
+- Each new capability is behind a truthy prop; the `if`-guards in `bootstrap.sh` mean an unset
+  parameter renders the current script.
+
+## What stays in the consumer (55minutes), restated
+
+EIGW (IPv6 egress route), fck-nat (IPv4 egress), the ingest Lambda + its SG, and the SCP carve-out
+are **not** in this library. `RemoteCrewInstance` accepts the ingest Lambda's SG as
+`webhookIngress.source` and nothing more.
+
+## Decisions
+
+| Decision | Choice | Why |
+|---|---|---|
+| Webhook port | separate `5477`, not the dashboard `5476` | dashboard stays loopback/SSM-only; only the hook route is exposed |
+| Webhook peer | source-SG only, no CIDR form | the box is never internet-reachable by contract |
+| Bearer token | Secrets Manager ARN prop, single-secret grant, fetched at boot | no secret in userData/code |
+| IPv6 routing | out of scope (consumer VPC) | construct takes `IVpc`, provisions no routes/EIGW |
+| Roster transport | prefer `source`-delivered manifest, keep prop as seam | least new surface; self-contained fallback exists |
+| Compatibility | every prop optional, default = today | no migration for existing consumers |

package/.kiro/specs/private-brain-construct-changes/requirements.md

@@ -0,0 +1,123 @@
+# Requirements — `@raindancers/raindancers-crew` library changes for the 55minutes brain
+
+## Purpose
+
+The 55minutes cloud orchestrator (a **consumer** of this library) needs the brain box —
+`RemoteCrewInstance` — to run in a **private, dual-stack, IPv6-preferred subnet with no public
+IP**, be woken by the **native KiroCrew webhook** (`POST /api/hooks/agent`, Bearer token) reachable
+**only from the ingest Lambda's security group**, and run as an **always-on conductor-driven crew**
+(Autopilot, no idle-session-close).
+
+The current construct is **IPv4- and public-subnet-shaped, SSM-reached, with no inbound app port**.
+This spec is a **change order against the existing construct**, written against its real interface
+(PRs #1–#4 on `raindancers/raindancers-crew`), not a greenfield design. Everything here is
+**additive and backward-compatible**: current consumers (public-subnet default, SSM-only, no
+webhook) keep working with unchanged behaviour.
+
+## Baseline — what the construct is today (do not re-derive)
+
+`RemoteCrewInstanceProps` (current, verbatim): `vpc` (req), `permissionsBoundaryArn` (req),
+`vpcSubnets` (default one **public** subnet), `instanceType`, `architecture` (default `ARM64`),
+`volumeSizeGb` (60), `associatePublicIp` (**default `true`**), `stackTag` (`kirocrew`),
+`dashboardPort` (5476, **loopback-only via SSM port-forward**), `allowSshCidr` (opt, opens tcp/22
+from an IPv4 CIDR ≤/16), `source` (`CrewSource`), `bootstrapTimeoutMinutes` (25), `backupBucket`,
+`backupSchedule`, `backupPrefix`.
+
+Current facts that constrain the design:
+- **One security group**, `allowAllOutbound: true` (⇒ IPv4 `0.0.0.0/0` egress only), **no inbound
+  by default**. The only ingress prop is `allowSshCidr` → `Peer.ipv4(cidr)` + `Port.tcp(22)`.
+  **No source-SG peer, no app port.**
+- **No IPv6 anywhere** — no `assignIpv6AddressOnCreation`, no IPv6 egress rule, no EIGW awareness.
+- **`bootstrap.sh`** runs `kirocrew setup --agent-only` then `kirocrew gateway`, systemd unit sets
+  only `KIROCREW_PORT`/`HOME`/`PATH`, health check hits `http://127.0.0.1:$DASHBOARD_PORT/`.
+  **No `POST /api/hooks/agent`, no Bearer token, no Autopilot, no idle-close, no roster.**
+
+## Requirements
+
+### RC1 — Dual-stack, IPv6-preferred ENI (additive)
+
+- **RC1.1** A new optional prop enables IPv6 on the instance ENI: `enableIpv6?: boolean` (default
+  `false` — current consumers unaffected). When `true`, the ENI is assigned an IPv6 address
+  (`assignIpv6AddressOnCreation` / launch-template ENI IPv6 count = 1).
+- **RC1.2** When `enableIpv6` is `true`, the construct's security group MUST add an **IPv6 egress
+  rule** (`ec2.Peer.anyIpv6()`, all traffic) alongside the existing IPv4 all-outbound, so IPv6
+  egress is actually permitted (CDK's `allowAllOutbound` emits IPv4 only).
+- **RC1.3** `enableIpv6` requires the selected subnet(s) to have IPv6 CIDRs; the construct does
+  **not** provision subnet IPv6 CIDRs, an Egress-Only IGW, or any route — those are the consumer's
+  VPC (`IVpc`) responsibility. A synth-time note/validation should make this contract explicit.
+- **RC1.4** `enableIpv6: true` with `associatePublicIp: false` (the 55minutes posture) MUST be a
+  valid, tested combination: a private dual-stack instance with IPv6 egress and no public IPv4.
+
+### RC2 — Webhook ingress from a source security group (additive)
+
+- **RC2.1** A new optional prop exposes the gateway's webhook port to a **specific source security
+  group** only: `webhookIngress?: { source: ec2.ISecurityGroup; port?: number }`. When set, the
+  construct's SG adds `addIngressRule(Peer.securityGroupId(source SG id), Port.tcp(port))`.
+- **RC2.2** `port` defaults to the gateway's webhook listener port (see RC3.1). No wider peer is
+  ever allowed for the webhook — **no CIDR form** of this prop; it is source-SG-only by construction
+  (the whole point is that the box is never internet-reachable).
+- **RC2.3** `webhookIngress` is independent of `allowSshCidr` — both, either, or neither may be set.
+  When neither any ingress prop is set, the SG remains no-inbound (unchanged default).
+- **RC2.4** The construct MUST expose its security group (already does, `this.securityGroup`) so the
+  consumer can also reference it from the ingest Lambda side if needed; and MUST accept the source
+  SG as an `ISecurityGroup` (imported), not require creating it.
+
+### RC3 — Native webhook wake + Bearer token in bootstrap (additive)
+
+- **RC3.1** A new optional prop configures the gateway to serve the native webhook on a routable
+  bind (not loopback-only) when webhook ingress is in use: the gateway listens for
+  `POST /api/hooks/agent`. The listener port is what RC2.2 defaults to.
+- **RC3.2** The Bearer token that authenticates the webhook is delivered as a **Secrets Manager
+  secret ARN** prop (e.g. `webhookTokenSecretArn?: string`). `bootstrap.sh` fetches it at boot and
+  sets it in the gateway's environment. **No token in userData, env literals, or code.** The
+  instance role is granted `secretsmanager:GetSecretValue` on **that one secret ARN only**.
+- **RC3.3** The dashboard port (5476) remains **loopback-only via SSM** as today — RC3.1 opens only
+  the webhook route on its own port, not the dashboard.
+- **RC3.4** When no webhook props are set, `bootstrap.sh` behaviour is byte-for-byte unchanged
+  (loopback dashboard, SSM-only, no token) — backward compatibility is a hard requirement.
+
+### RC4 — Always-on crew runtime: Autopilot, no idle-close, conductor roster (additive)
+
+- **RC4.1** A new optional prop enables **Autopilot mode** on the hosted crew, threaded into the
+  bootstrap `kirocrew` configuration/env.
+- **RC4.2** A new optional prop disables **idle-session-close** so the 24/7 brain is not torn down
+  between events.
+- **RC4.3** The construct supports provisioning a **crew-member / conductor roster** at boot (the
+  installed agent configs, including the conductor). Shape TBD in design: a prop carrying roster
+  config, or a documented `source`-delivered config the bootstrap applies. This is the R6.8 seam
+  from the 55minutes spec.
+- **RC4.4** All of RC4 are optional and default to the current gateway defaults; omitting them
+  reproduces today's `kirocrew setup --agent-only` + `kirocrew gateway` behaviour exactly.
+
+### RC5 — Out of scope for this library (stated so the consumer owns them)
+
+- **RC5.1** **Egress-Only Internet Gateway** (IPv6 egress route) — a VPC/route-table resource. The
+  construct consumes an `IVpc` and provisions no routing. The 55minutes app / its VPC construct owns
+  it.
+- **RC5.2** **fck-nat** (single-AZ IPv4 egress) — a consumer VPC instance + route concern. Not a
+  `RemoteCrewInstance` prop.
+- **RC5.3** **The ingest Lambda and its security group** — live in the consumer app (55minutes
+  `CrewIngress`). `RemoteCrewInstance` only *accepts* that SG as `webhookIngress.source` (RC2.1).
+
+## Non-functional requirements
+
+- **Backward compatibility (hard):** every new prop is optional with a default that reproduces
+  current behaviour. `test/` must assert the no-prop synth is unchanged.
+- **Security:** webhook ingress is source-SG-only (never a CIDR); the Bearer token is a Secrets
+  Manager ARN with a single-secret grant; the dashboard stays loopback/SSM-only; the permissions
+  boundary stays required.
+- **jsii-clean:** new prop types must be jsii-compatible (interfaces/enums, no TS-only constructs) —
+  the library publishes via jsii (`~5.9.0`, cdk `2.260.0`).
+- **Testability:** each requirement maps to a CDK assertion test (SG rules, ENI IPv6, secret grant)
+  and/or a bootstrap-rendering test.
+
+## Definition of done
+
+- `RemoteCrewInstance` accepts and correctly wires: `enableIpv6`, `webhookIngress`,
+  `webhookTokenSecretArn` (+ webhook listener config), and the Autopilot / no-idle-close / roster
+  props — all additive, all optional.
+- The **private dual-stack + no-public-IP + source-SG webhook + native-webhook-wake** posture the
+  55minutes brain needs is achievable purely from props, with EIGW/fck-nat/ingest-Lambda left to the
+  consumer.
+- No-prop synth is proven byte-unchanged; every new capability has a test.
+- README usage gains a "private dual-stack brain" example.

package/.kiro/specs/private-brain-construct-changes/tasks.md

@@ -0,0 +1,119 @@
+# Tasks — `@raindancers/raindancers-crew` changes for the 55minutes brain
+
+Ordered, checkable. Each group is one reviewable PR against `raindancers/raindancers-crew`,
+additive and backward-compatible. All work lands on `RemoteCrewInstance` + `bootstrap.sh` + tests.
+`[ ]` not started. Do groups in order; RC2/RC3 depend on RC-props being in place.
+
+**Repo facts:** jsii `AwsCdkConstructLibrary`, cdk `2.260.0`, jsii `~5.9.0`, default branch `main`,
+`src/assets/**` force-bundled. Build/test: `npx projen build` (synth + compile + eslint + jest).
+
+---
+
+## RC0. Baseline lock (no code) — PR: n/a (do first, in the spec)
+
+- [ ] RC0.1 Snapshot the current no-prop synth of `RemoteCrewInstance` into a golden test fixture
+      **before** any change, so every later group can assert "no-prop template unchanged". (NFR)
+- [ ] RC0.2 Snapshot the current rendered `bootstrap.sh` bytes as a fixture for the same reason.
+
+---
+
+## RC1. Dual-stack IPv6 ENI — PR: `feat/rci-ipv6`
+
+- [ ] RC1.1 Add `enableIpv6?: boolean` (default `false`) to `RemoteCrewInstanceProps`. (RC1.1)
+- [ ] RC1.2 In `remote-crew-instance.ts`, when `enableIpv6`: set the primary ENI's
+      `ipv6AddressCount: 1` (launch template network interface / `assignIpv6AddressOnCreation`). (RC1.1)
+- [ ] RC1.3 Add the IPv6 egress SG rule (`Peer.anyIpv6()`, `Port.allTraffic()`) when `enableIpv6`,
+      since `allowAllOutbound` emits IPv4-only. (RC1.2)
+- [ ] RC1.4 Synth-time best-effort note when `enableIpv6` is set but the resolved subnets expose no
+      IPv6 CIDR (the VPC owns the CIDR/EIGW — not this construct). (RC1.3)
+- [ ] RC1.5 Tests: assertion test that `enableIpv6: true` adds an IPv6 address to the ENI and an
+      IPv6 egress rule; that `enableIpv6: true` + `associatePublicIp: false` synths a private
+      dual-stack instance with no public IPv4; and that the **no-prop golden (RC0.1) is unchanged**. (RC1.4, NFR)
+
+**Done when:** a consumer can request a private, dual-stack, IPv6-egress, no-public-IP instance
+purely via `enableIpv6: true` + `associatePublicIp: false` + private `vpcSubnets`, proven by synth.
+
+---
+
+## RC2. Source-SG webhook ingress — PR: `feat/rci-webhook-ingress`
+
+- [ ] RC2.1 Add the `WebhookIngress` jsii interface (`source: ec2.ISecurityGroup`, `port?: number`
+      default 5477) and the `webhookIngress?: WebhookIngress` prop. (RC2.1, RC2.2)
+- [ ] RC2.2 When set, add `securityGroup.addIngressRule(Peer.securityGroupId(source.securityGroupId),
+      Port.tcp(port), ...)`. **No CIDR form.** Leave `allowSshCidr` path untouched. (RC2.1, RC2.3)
+- [ ] RC2.3 Confirm/keep `this.securityGroup` exported so the consumer can reference it. (RC2.4)
+- [ ] RC2.4 Tests: assertion test that `webhookIngress` adds exactly one ingress rule, peer =
+      source SG id, port = 5477 (or override), and **no** `0.0.0.0/0`/`::/0` ingress ever appears;
+      that omitting it leaves the SG no-inbound; golden unchanged. (RC2.2, NFR)
+
+**Done when:** the webhook port is reachable only from the named source SG, and the default stays
+no-inbound.
+
+---
+
+## RC3. Native webhook wake + Bearer token — PR: `feat/rci-webhook-runtime`
+
+- [ ] RC3.1 Add `webhookTokenSecretArn?: string`. Synth-fail if `webhookIngress` is set without it
+      (reachable webhook must have auth). (RC3.2, design guard)
+- [ ] RC3.2 Grant `secret.grantRead(this.role)` via `Secret.fromSecretCompleteArn` — GetSecretValue
+      on that one ARN only. (RC3.2)
+- [ ] RC3.3 `bootstrap.sh` (guarded on a non-empty `WEBHOOK_TOKEN_SECRET_ARN` substitution): fetch
+      the token with `aws secretsmanager get-secret-value`, export into the gateway env
+      (`KIROCREW_HOOK_TOKEN`), configure the gateway to serve `POST /api/hooks/agent` on
+      `WEBHOOK_PORT` (default 5477) on the routable address. Dashboard stays loopback on
+      `KIROCREW_PORT`. (RC3.1, RC3.3)
+- [ ] RC3.4 Extend the WaitCondition/health check to also confirm the webhook route answers when
+      configured. (RC3.1)
+- [ ] RC3.5 Tests: assertion test for the single-secret read grant; a bootstrap-render test that
+      with no webhook props the script equals the **RC0.2 golden bytes**, and with them present it
+      gains exactly the guarded token-fetch + webhook-serve lines (no token literal anywhere). (RC3.4, NFR)
+
+**Done when:** the box serves the native webhook on its own port, authenticated by a Secrets-Manager
+Bearer token fetched at boot, with the dashboard still loopback/SSM-only and the no-prop script
+byte-identical.
+
+---
+
+## RC4. Always-on crew runtime (Autopilot / no-idle-close / roster) — PR: `feat/rci-crew-runtime`
+
+- [ ] RC4.1 Add the `CrewRuntime` interface (`autopilot?`, `disableIdleClose?`, `roster?`) and the
+      `crewRuntime?: CrewRuntime` prop. (RC4.1, RC4.2, RC4.3)
+- [ ] RC4.2 `bootstrap.sh` (guarded): when `autopilot` → set the Autopilot config/env flag; when
+      `disableIdleClose` → set the idle-close-disable setting. Default path unchanged. (RC4.1, RC4.2)
+- [ ] RC4.3 Roster: implement the chosen mechanism (design leans **`source`-delivered manifest** —
+      bootstrap applies the roster the installed source carries via a `kirocrew agent`-equivalent
+      step). Keep `CrewRosterConfig` as the seam even if the first cut is source-delivered. (RC4.3)
+- [ ] RC4.4 Tests: bootstrap-render tests that each flag appears only when its prop is set, and the
+      no-prop render matches the RC0.2 golden; a doc/assertion that the roster mechanism applies the
+      conductor + members. (RC4.4, NFR)
+
+**Done when:** the hosted crew comes up in Autopilot, never idle-closes, and has its conductor +
+member roster — all opt-in, with the default gateway behaviour intact when omitted.
+
+---
+
+## RC5. Docs — PR: `docs/rci-private-brain-usage`
+
+- [ ] RC5.1 README: add a "Private dual-stack brain (55minutes posture)" usage example composing
+      `enableIpv6`, `associatePublicIp: false`, private `vpcSubnets`, `webhookIngress` (with an
+      imported ingest-Lambda SG), `webhookTokenSecretArn`, and `crewRuntime`.
+- [ ] RC5.2 README: explicitly state what stays in the consumer VPC/app (EIGW, fck-nat, ingest
+      Lambda + SG, SCP), so a reader does not expect the construct to provision routing. (RC5.1–5.3)
+
+---
+
+## Out of scope (consumer owns — do NOT add to this library)
+
+- **Egress-Only IGW** for IPv6 egress route (VPC/route-table). (RC5.1)
+- **fck-nat** single-AZ IPv4 egress (consumer VPC instance + route). (RC5.2)
+- **The ingest Lambda + its SG** — 55minutes `CrewIngress`; the construct only *accepts* the SG as
+  `webhookIngress.source`. (RC5.3)
+
+## Definition of done (whole change set)
+
+- `enableIpv6`, `webhookIngress`, `webhookTokenSecretArn`, `crewRuntime` all land as optional props,
+  each behind a test, each backward-compatible.
+- No-prop synth (RC0.1) and no-prop `bootstrap.sh` (RC0.2) proven byte-unchanged.
+- The 55minutes brain posture is achievable purely from props; EIGW/fck-nat/ingest-Lambda stay in
+  the consumer.
+- `npx projen build` green; README carries the private-brain example.