fix(gcp-to-aws): stop recommending classic Bedrock Agents (closed to new customers 2026-07-30) - #161
Merged
icarthick merged 4 commits intoJul 22, 2026
Conversation
…e mode, closed to new customers 2026-07-30)
herosjourney
force-pushed
the
feat/bedrock-agents-classic-eol
branch
from
July 20, 2026 19:26
6d41d21 to
e05127b
Compare
This was referenced Jul 20, 2026
5 tasks
Clean merge to current main. The classic Bedrock Agents EOL sweep is intact: zero remaining 'Bedrock Agents' migration recommendations in gcp-to-aws (all mentions are AgentCore or explicit classic/maintenance-mode warnings). Full build green.
leon1418
pushed a commit
to leon1418/startups
that referenced
this pull request
Aug 11, 2026
…and IaC Keeps the migration-to-aws skills' externally-sourced facts current: two monitors on a weekly schedule, a judge that decides what a change means and how far it reaches, and a draft PR for a human to review. Nothing merges without a person. Why: of 176 non-vendored skill markdown files, 37 contain any URL and 8 carry a date marker, so most facts cannot be re-verified by anything. Every stale-fact fix in this repo's history (awslabs#161, awslabs#97, awslabs#131, awslabs#72) was found by a human noticing. Two monitors, deliberately separate: - recheck — re-fetch each fact's own source URL and re-extract the field. Answers only "does what we said still hold?" - announcement scan — the AWS What's New feed, filtered by the 27 existing decision-refs/ design-refs files. No separate topic list to maintain: the skill's own knowledge files ARE the filter, so it cannot fall out of date. The AgentCore runtime-instances launch (2026-08-06) drove every rule. Its value did not change — its SHAPE did. microVMs still cap sessions at 8h; the new EC2-backed option runs 14 days. A value-diff would have rewritten 8h to 14d, which is wrong. Meanwhile the real damage was in ~13 derived judgments across two skills, three of which reversed. Hence: URL re-extraction rather than semantic search for recheck, a schema_change verdict distinct from value_change, and blast radius computed by searching real file content. Measured end to end (see the POC README): recheck agreed on all 6 piloted facts across 3 identical runs; the scan kept 12 of 100 items with the acceptance item among them; the judge returned schema_change with 13 locations and 3 flipped conclusions; apply.py wrote 13/13 to a clean tree and 0/13 on a second run (idempotent); a ticked dashboard checkbox came back as a queued request the next scan consumed. Three defects the POC found, all now guarded or recorded: - a per-second Fargate rate compared against a per-hour stored value, on a fact eligible for automatic editing — a 3600x error away from an auto-PR. Fixed with a mechanical magnitude guard, since the single-location rule did not protect against it. - a rewrite that updated a reason string while leaving the hard_constraints rule it justifies untouched — fluent prose over unchanged behaviour, invisible in the diff. Recorded as the one place review cannot substitute for a mechanical check. - blast radius is unstable between runs: 9 locations one run, 13 the next, neither a superset. infra/kb-autoupdate.yaml deploys the whole thing as one weekly CodeBuild job in the maintainer's own account, pushing to a fork and opening PRs upstream — nothing is added to this repository. Checkov clean (44 passed, 0 failed, 1 documented skip: a log bucket cannot log to itself). Not deployed, and automatic PRs are not authorised by this: the build order still calls for running silently for several weeks first.
leon1418
pushed a commit
to leon1418/startups
that referenced
this pull request
Aug 11, 2026
…and IaC Keeps the migration-to-aws skills' externally-sourced facts current: two monitors on a weekly schedule, a judge that decides what a change means and how far it reaches, and a draft PR for a human to review. Nothing merges without a person. Why: of 176 non-vendored skill markdown files, 37 contain any URL and 8 carry a date marker, so most facts cannot be re-verified by anything. Every stale-fact fix in this repo's history (awslabs#161, awslabs#97, awslabs#131, awslabs#72) was found by a human noticing. Two monitors, deliberately separate: - recheck — re-fetch each fact's own source URL and re-extract the field. Answers only "does what we said still hold?" - announcement scan — the AWS What's New feed, filtered by the 27 existing decision-refs/ design-refs files. No separate topic list to maintain: the skill's own knowledge files ARE the filter, so it cannot fall out of date. The AgentCore runtime-instances launch (2026-08-06) drove every rule. Its value did not change — its SHAPE did. microVMs still cap sessions at 8h; the new EC2-backed option runs 14 days. A value-diff would have rewritten 8h to 14d, which is wrong. Meanwhile the real damage was in ~13 derived judgments across two skills, three of which reversed. Hence: URL re-extraction rather than semantic search for recheck, a schema_change verdict distinct from value_change, and blast radius computed by searching real file content. Measured end to end (see the POC README): recheck agreed on all 6 piloted facts across 3 identical runs; the scan kept 12 of 100 items with the acceptance item among them; the judge returned schema_change with 13 locations and 3 flipped conclusions; apply.py wrote 13/13 to a clean tree and 0/13 on a second run (idempotent); a ticked dashboard checkbox came back as a queued request the next scan consumed. Three defects the POC found, all now guarded or recorded: - a per-second Fargate rate compared against a per-hour stored value, on a fact eligible for automatic editing — a 3600x error away from an auto-PR. Fixed with a mechanical magnitude guard, since the single-location rule did not protect against it. - a rewrite that updated a reason string while leaving the hard_constraints rule it justifies untouched — fluent prose over unchanged behaviour, invisible in the diff. Recorded as the one place review cannot substitute for a mechanical check. - blast radius is unstable between runs: 9 locations one run, 13 the next, neither a superset. infra/kb-autoupdate.yaml deploys the whole thing as one weekly CodeBuild job in the maintainer's own account, pushing to a fork and opening PRs upstream — nothing is added to this repository. Checkov clean (44 passed, 0 failed, 1 documented skip: a log bucket cannot log to itself). Not deployed, and automatic PRs are not authorised by this: the build order still calls for running silently for several weeks first.
leon1418
pushed a commit
to leon1418/startups
that referenced
this pull request
Aug 11, 2026
…and IaC Keeps the migration-to-aws skills' externally-sourced facts current: two monitors on a weekly schedule, a judge that decides what a change means and how far it reaches, and a draft PR for a human to review. Nothing merges without a person. Why: of 176 non-vendored skill markdown files, 37 contain any URL and 8 carry a date marker, so most facts cannot be re-verified by anything. Every stale-fact fix in this repo's history (awslabs#161, awslabs#97, awslabs#131, awslabs#72) was found by a human noticing. Two monitors, deliberately separate: - recheck — re-fetch each fact's own source URL and re-extract the field. Answers only "does what we said still hold?" - announcement scan — the AWS What's New feed, filtered by the 27 existing decision-refs/ design-refs files. No separate topic list to maintain: the skill's own knowledge files ARE the filter, so it cannot fall out of date. The AgentCore runtime-instances launch (2026-08-06) drove every rule. Its value did not change — its SHAPE did. microVMs still cap sessions at 8h; the new EC2-backed option runs 14 days. A value-diff would have rewritten 8h to 14d, which is wrong. Meanwhile the real damage was in ~13 derived judgments across two skills, three of which reversed. Hence: URL re-extraction rather than semantic search for recheck, a schema_change verdict distinct from value_change, and blast radius computed by searching real file content. Measured end to end (see the POC README): recheck agreed on all 6 piloted facts across 3 identical runs; the scan kept 12 of 100 items with the acceptance item among them; the judge returned schema_change with 13 locations and 3 flipped conclusions; apply.py wrote 13/13 to a clean tree and 0/13 on a second run (idempotent); a ticked dashboard checkbox came back as a queued request the next scan consumed. Three defects the POC found, all now guarded or recorded: - a per-second Fargate rate compared against a per-hour stored value, on a fact eligible for automatic editing — a 3600x error away from an auto-PR. Fixed with a mechanical magnitude guard, since the single-location rule did not protect against it. - a rewrite that updated a reason string while leaving the hard_constraints rule it justifies untouched — fluent prose over unchanged behaviour, invisible in the diff. Recorded as the one place review cannot substitute for a mechanical check. - blast radius is unstable between runs: 9 locations one run, 13 the next, neither a superset. infra/kb-autoupdate.yaml deploys the whole thing as one weekly CodeBuild job in the maintainer's own account, pushing to a fork and opening PRs upstream — nothing is added to this repository. Checkov clean (44 passed, 0 failed, 1 documented skip: a log bucket cannot log to itself). Not deployed, and automatic PRs are not authorised by this: the build order still calls for running silently for several weeks first.
leon1418
pushed a commit
to leon1418/startups
that referenced
this pull request
Aug 11, 2026
…and IaC Keeps the migration-to-aws skills' externally-sourced facts current: two monitors on a weekly schedule, a judge that decides what a change means and how far it reaches, and a draft PR for a human to review. Nothing merges without a person. Why: of 176 non-vendored skill markdown files, 37 contain any URL and 8 carry a date marker, so most facts cannot be re-verified by anything. Every stale-fact fix in this repo's history (awslabs#161, awslabs#97, awslabs#131, awslabs#72) was found by a human noticing. Two monitors, deliberately separate: - recheck — re-fetch each fact's own source URL and re-extract the field. Answers only "does what we said still hold?" - announcement scan — the AWS What's New feed, filtered by the 27 existing decision-refs/ design-refs files. No separate topic list to maintain: the skill's own knowledge files ARE the filter, so it cannot fall out of date. The AgentCore runtime-instances launch (2026-08-06) drove every rule. Its value did not change — its SHAPE did. microVMs still cap sessions at 8h; the new EC2-backed option runs 14 days. A value-diff would have rewritten 8h to 14d, which is wrong. Meanwhile the real damage was in ~13 derived judgments across two skills, three of which reversed. Hence: URL re-extraction rather than semantic search for recheck, a schema_change verdict distinct from value_change, and blast radius computed by searching real file content. Measured end to end (see the POC README): recheck agreed on all 6 piloted facts across 3 identical runs; the scan kept 12 of 100 items with the acceptance item among them; the judge returned schema_change with 13 locations and 3 flipped conclusions; apply.py wrote 13/13 to a clean tree and 0/13 on a second run (idempotent); a ticked dashboard checkbox came back as a queued request the next scan consumed. Three defects the POC found, all now guarded or recorded: - a per-second Fargate rate compared against a per-hour stored value, on a fact eligible for automatic editing — a 3600x error away from an auto-PR. Fixed with a mechanical magnitude guard, since the single-location rule did not protect against it. - a rewrite that updated a reason string while leaving the hard_constraints rule it justifies untouched — fluent prose over unchanged behaviour, invisible in the diff. Recorded as the one place review cannot substitute for a mechanical check. - blast radius is unstable between runs: 9 locations one run, 13 the next, neither a superset. infra/kb-autoupdate.yaml deploys the whole thing as one weekly CodeBuild job in the maintainer's own account, pushing to a fork and opening PRs upstream — nothing is added to this repository. Checkov clean (44 passed, 0 failed, 1 documented skip: a log bucket cannot log to itself). Not deployed, and automatic PRs are not authorised by this: the build order still calls for running silently for several weeks first.
leon1418
pushed a commit
to leon1418/startups
that referenced
this pull request
Aug 11, 2026
…and IaC Keeps the migration-to-aws skills' externally-sourced facts current: two monitors on a weekly schedule, a judge that decides what a change means and how far it reaches, and a draft PR for a human to review. Nothing merges without a person. Why: of 176 non-vendored skill markdown files, 37 contain any URL and 8 carry a date marker, so most facts cannot be re-verified by anything. Every stale-fact fix in this repo's history (awslabs#161, awslabs#97, awslabs#131, awslabs#72) was found by a human noticing. Two monitors, deliberately separate: - recheck — re-fetch each fact's own source URL and re-extract the field. Answers only "does what we said still hold?" - announcement scan — the AWS What's New feed, filtered by the 27 existing decision-refs/ design-refs files. No separate topic list to maintain: the skill's own knowledge files ARE the filter, so it cannot fall out of date. The AgentCore runtime-instances launch (2026-08-06) drove every rule. Its value did not change — its SHAPE did. microVMs still cap sessions at 8h; the new EC2-backed option runs 14 days. A value-diff would have rewritten 8h to 14d, which is wrong. Meanwhile the real damage was in ~13 derived judgments across two skills, three of which reversed. Hence: URL re-extraction rather than semantic search for recheck, a schema_change verdict distinct from value_change, and blast radius computed by searching real file content. Measured end to end (see the POC README): recheck agreed on all 6 piloted facts across 3 identical runs; the scan kept 12 of 100 items with the acceptance item among them; the judge returned schema_change with 13 locations and 3 flipped conclusions; apply.py wrote 13/13 to a clean tree and 0/13 on a second run (idempotent); a ticked dashboard checkbox came back as a queued request the next scan consumed. Three defects the POC found, all now guarded or recorded: - a per-second Fargate rate compared against a per-hour stored value, on a fact eligible for automatic editing — a 3600x error away from an auto-PR. Fixed with a mechanical magnitude guard, since the single-location rule did not protect against it. - a rewrite that updated a reason string while leaving the hard_constraints rule it justifies untouched — fluent prose over unchanged behaviour, invisible in the diff. Recorded as the one place review cannot substitute for a mechanical check. - blast radius is unstable between runs: 9 locations one run, 13 the next, neither a superset. infra/kb-autoupdate.yaml deploys the whole thing as one weekly CodeBuild job in the maintainer's own account, pushing to a fork and opening PRs upstream — nothing is added to this repository. Checkov clean (44 passed, 0 failed, 1 documented skip: a log bucket cannot log to itself). Not deployed, and automatic PRs are not authorised by this: the build order still calls for running silently for several weeks first.
leon1418
pushed a commit
to leon1418/startups
that referenced
this pull request
Aug 11, 2026
…and IaC Keeps the migration-to-aws skills' externally-sourced facts current: two monitors on a weekly schedule, a judge that decides what a change means and how far it reaches, and a draft PR for a human to review. Nothing merges without a person. Why: of 176 non-vendored skill markdown files, 37 contain any URL and 8 carry a date marker, so most facts cannot be re-verified by anything. Every stale-fact fix in this repo's history (awslabs#161, awslabs#97, awslabs#131, awslabs#72) was found by a human noticing. Two monitors, deliberately separate: - recheck — re-fetch each fact's own source URL and re-extract the field. Answers only "does what we said still hold?" - announcement scan — the AWS What's New feed, filtered by the 27 existing decision-refs/ design-refs files. No separate topic list to maintain: the skill's own knowledge files ARE the filter, so it cannot fall out of date. The AgentCore runtime-instances launch (2026-08-06) drove every rule. Its value did not change — its SHAPE did. microVMs still cap sessions at 8h; the new EC2-backed option runs 14 days. A value-diff would have rewritten 8h to 14d, which is wrong. Meanwhile the real damage was in ~13 derived judgments across two skills, three of which reversed. Hence: URL re-extraction rather than semantic search for recheck, a schema_change verdict distinct from value_change, and blast radius computed by searching real file content. Measured end to end (see the POC README): recheck agreed on all 6 piloted facts across 3 identical runs; the scan kept 12 of 100 items with the acceptance item among them; the judge returned schema_change with 13 locations and 3 flipped conclusions; apply.py wrote 13/13 to a clean tree and 0/13 on a second run (idempotent); a ticked dashboard checkbox came back as a queued request the next scan consumed. Three defects the POC found, all now guarded or recorded: - a per-second Fargate rate compared against a per-hour stored value, on a fact eligible for automatic editing — a 3600x error away from an auto-PR. Fixed with a mechanical magnitude guard, since the single-location rule did not protect against it. - a rewrite that updated a reason string while leaving the hard_constraints rule it justifies untouched — fluent prose over unchanged behaviour, invisible in the diff. Recorded as the one place review cannot substitute for a mechanical check. - blast radius is unstable between runs: 9 locations one run, 13 the next, neither a superset. infra/kb-autoupdate.yaml deploys the whole thing as one weekly CodeBuild job in the maintainer's own account, pushing to a fork and opening PRs upstream — nothing is added to this repository. Checkov clean (44 passed, 0 failed, 1 documented skip: a log bucket cannot log to itself). Not deployed, and automatic PRs are not authorised by this: the build order still calls for running silently for several weeks first.
leon1418
pushed a commit
to leon1418/startups
that referenced
this pull request
Aug 11, 2026
…and IaC Keeps the migration-to-aws skills' externally-sourced facts current: two monitors on a weekly schedule, a judge that decides what a change means and how far it reaches, and a draft PR for a human to review. Nothing merges without a person. Why: of 176 non-vendored skill markdown files, 37 contain any URL and 8 carry a date marker, so most facts cannot be re-verified by anything. Every stale-fact fix in this repo's history (awslabs#161, awslabs#97, awslabs#131, awslabs#72) was found by a human noticing. Two monitors, deliberately separate: - recheck — re-fetch each fact's own source URL and re-extract the field. Answers only "does what we said still hold?" - announcement scan — the AWS What's New feed, filtered by the 27 existing decision-refs/ design-refs files. No separate topic list to maintain: the skill's own knowledge files ARE the filter, so it cannot fall out of date. The AgentCore runtime-instances launch (2026-08-06) drove every rule. Its value did not change — its SHAPE did. microVMs still cap sessions at 8h; the new EC2-backed option runs 14 days. A value-diff would have rewritten 8h to 14d, which is wrong. Meanwhile the real damage was in ~13 derived judgments across two skills, three of which reversed. Hence: URL re-extraction rather than semantic search for recheck, a schema_change verdict distinct from value_change, and blast radius computed by searching real file content. Measured end to end (see the POC README): recheck agreed on all 6 piloted facts across 3 identical runs; the scan kept 12 of 100 items with the acceptance item among them; the judge returned schema_change with 13 locations and 3 flipped conclusions; apply.py wrote 13/13 to a clean tree and 0/13 on a second run (idempotent); a ticked dashboard checkbox came back as a queued request the next scan consumed. Three defects the POC found, all now guarded or recorded: - a per-second Fargate rate compared against a per-hour stored value, on a fact eligible for automatic editing — a 3600x error away from an auto-PR. Fixed with a mechanical magnitude guard, since the single-location rule did not protect against it. - a rewrite that updated a reason string while leaving the hard_constraints rule it justifies untouched — fluent prose over unchanged behaviour, invisible in the diff. Recorded as the one place review cannot substitute for a mechanical check. - blast radius is unstable between runs: 9 locations one run, 13 the next, neither a superset. infra/kb-autoupdate.yaml deploys the whole thing as one weekly CodeBuild job in the maintainer's own account, pushing to a fork and opening PRs upstream — nothing is added to this repository. Checkov clean (44 passed, 0 failed, 1 documented skip: a log bucket cannot log to itself). Not deployed, and automatic PRs are not authorised by this: the build order still calls for running silently for several weeks first.
leon1418
pushed a commit
to leon1418/startups
that referenced
this pull request
Aug 11, 2026
…and IaC Keeps the migration-to-aws skills' externally-sourced facts current: two monitors on a weekly schedule, a judge that decides what a change means and how far it reaches, and a draft PR for a human to review. Nothing merges without a person. Why: of 176 non-vendored skill markdown files, 37 contain any URL and 8 carry a date marker, so most facts cannot be re-verified by anything. Every stale-fact fix in this repo's history (awslabs#161, awslabs#97, awslabs#131, awslabs#72) was found by a human noticing. Two monitors, deliberately separate: - recheck — re-fetch each fact's own source URL and re-extract the field. Answers only "does what we said still hold?" - announcement scan — the AWS What's New feed, filtered by the 27 existing decision-refs/ design-refs files. No separate topic list to maintain: the skill's own knowledge files ARE the filter, so it cannot fall out of date. The AgentCore runtime-instances launch (2026-08-06) drove every rule. Its value did not change — its SHAPE did. microVMs still cap sessions at 8h; the new EC2-backed option runs 14 days. A value-diff would have rewritten 8h to 14d, which is wrong. Meanwhile the real damage was in ~13 derived judgments across two skills, three of which reversed. Hence: URL re-extraction rather than semantic search for recheck, a schema_change verdict distinct from value_change, and blast radius computed by searching real file content. Measured end to end (see the POC README): recheck agreed on all 6 piloted facts across 3 identical runs; the scan kept 12 of 100 items with the acceptance item among them; the judge returned schema_change with 13 locations and 3 flipped conclusions; apply.py wrote 13/13 to a clean tree and 0/13 on a second run (idempotent); a ticked dashboard checkbox came back as a queued request the next scan consumed. Three defects the POC found, all now guarded or recorded: - a per-second Fargate rate compared against a per-hour stored value, on a fact eligible for automatic editing — a 3600x error away from an auto-PR. Fixed with a mechanical magnitude guard, since the single-location rule did not protect against it. - a rewrite that updated a reason string while leaving the hard_constraints rule it justifies untouched — fluent prose over unchanged behaviour, invisible in the diff. Recorded as the one place review cannot substitute for a mechanical check. - blast radius is unstable between runs: 9 locations one run, 13 the next, neither a superset. infra/kb-autoupdate.yaml deploys the whole thing as one weekly CodeBuild job in the maintainer's own account, pushing to a fork and opening PRs upstream — nothing is added to this repository. Checkov clean (44 passed, 0 failed, 1 documented skip: a log bucket cannot log to itself). Not deployed, and automatic PRs are not authorised by this: the build order still calls for running silently for several weeks first.
leon1418
pushed a commit
to leon1418/startups
that referenced
this pull request
Aug 11, 2026
…and IaC Keeps the migration-to-aws skills' externally-sourced facts current: two monitors on a weekly schedule, a judge that decides what a change means and how far it reaches, and a draft PR for a human to review. Nothing merges without a person. Why: of 176 non-vendored skill markdown files, 37 contain any URL and 8 carry a date marker, so most facts cannot be re-verified by anything. Every stale-fact fix in this repo's history (awslabs#161, awslabs#97, awslabs#131, awslabs#72) was found by a human noticing. Two monitors, deliberately separate: - recheck — re-fetch each fact's own source URL and re-extract the field. Answers only "does what we said still hold?" - announcement scan — the AWS What's New feed, filtered by the 27 existing decision-refs/ design-refs files. No separate topic list to maintain: the skill's own knowledge files ARE the filter, so it cannot fall out of date. The AgentCore runtime-instances launch (2026-08-06) drove every rule. Its value did not change — its SHAPE did. microVMs still cap sessions at 8h; the new EC2-backed option runs 14 days. A value-diff would have rewritten 8h to 14d, which is wrong. Meanwhile the real damage was in ~13 derived judgments across two skills, three of which reversed. Hence: URL re-extraction rather than semantic search for recheck, a schema_change verdict distinct from value_change, and blast radius computed by searching real file content. Measured end to end (see the POC README): recheck agreed on all 6 piloted facts across 3 identical runs; the scan kept 12 of 100 items with the acceptance item among them; the judge returned schema_change with 13 locations and 3 flipped conclusions; apply.py wrote 13/13 to a clean tree and 0/13 on a second run (idempotent); a ticked dashboard checkbox came back as a queued request the next scan consumed. Three defects the POC found, all now guarded or recorded: - a per-second Fargate rate compared against a per-hour stored value, on a fact eligible for automatic editing — a 3600x error away from an auto-PR. Fixed with a mechanical magnitude guard, since the single-location rule did not protect against it. - a rewrite that updated a reason string while leaving the hard_constraints rule it justifies untouched — fluent prose over unchanged behaviour, invisible in the diff. Recorded as the one place review cannot substitute for a mechanical check. - blast radius is unstable between runs: 9 locations one run, 13 the next, neither a superset. infra/kb-autoupdate.yaml deploys the whole thing as one weekly CodeBuild job in the maintainer's own account, pushing to a fork and opening PRs upstream — nothing is added to this repository. Checkov clean (44 passed, 0 failed, 1 documented skip: a log bucket cannot log to itself). Not deployed, and automatic PRs are not authorised by this: the build order still calls for running silently for several weeks first.
leon1418
pushed a commit
to leon1418/startups
that referenced
this pull request
Aug 11, 2026
…and IaC Keeps the migration-to-aws skills' externally-sourced facts current: two monitors on a weekly schedule, a judge that decides what a change means and how far it reaches, and a draft PR for a human to review. Nothing merges without a person. Why: of 176 non-vendored skill markdown files, 37 contain any URL and 8 carry a date marker, so most facts cannot be re-verified by anything. Every stale-fact fix in this repo's history (awslabs#161, awslabs#97, awslabs#131, awslabs#72) was found by a human noticing. Two monitors, deliberately separate: - recheck — re-fetch each fact's own source URL and re-extract the field. Answers only "does what we said still hold?" - announcement scan — the AWS What's New feed, filtered by the 27 existing decision-refs/ design-refs files. No separate topic list to maintain: the skill's own knowledge files ARE the filter, so it cannot fall out of date. The AgentCore runtime-instances launch (2026-08-06) drove every rule. Its value did not change — its SHAPE did. microVMs still cap sessions at 8h; the new EC2-backed option runs 14 days. A value-diff would have rewritten 8h to 14d, which is wrong. Meanwhile the real damage was in ~13 derived judgments across two skills, three of which reversed. Hence: URL re-extraction rather than semantic search for recheck, a schema_change verdict distinct from value_change, and blast radius computed by searching real file content. Measured end to end (see the POC README): recheck agreed on all 6 piloted facts across 3 identical runs; the scan kept 12 of 100 items with the acceptance item among them; the judge returned schema_change with 13 locations and 3 flipped conclusions; apply.py wrote 13/13 to a clean tree and 0/13 on a second run (idempotent); a ticked dashboard checkbox came back as a queued request the next scan consumed. Three defects the POC found, all now guarded or recorded: - a per-second Fargate rate compared against a per-hour stored value, on a fact eligible for automatic editing — a 3600x error away from an auto-PR. Fixed with a mechanical magnitude guard, since the single-location rule did not protect against it. - a rewrite that updated a reason string while leaving the hard_constraints rule it justifies untouched — fluent prose over unchanged behaviour, invisible in the diff. Recorded as the one place review cannot substitute for a mechanical check. - blast radius is unstable between runs: 9 locations one run, 13 the next, neither a superset. infra/kb-autoupdate.yaml deploys the whole thing as one weekly CodeBuild job in the maintainer's own account, pushing to a fork and opening PRs upstream — nothing is added to this repository. Checkov clean (44 passed, 0 failed, 1 documented skip: a log bucket cannot log to itself). Not deployed, and automatic PRs are not authorised by this: the build order still calls for running silently for several weeks first.
leon1418
pushed a commit
to leon1418/startups
that referenced
this pull request
Aug 11, 2026
…and IaC Keeps the migration-to-aws skills' externally-sourced facts current: two monitors on a weekly schedule, a judge that decides what a change means and how far it reaches, and a draft PR for a human to review. Nothing merges without a person. Why: of 176 non-vendored skill markdown files, 37 contain any URL and 8 carry a date marker, so most facts cannot be re-verified by anything. Every stale-fact fix in this repo's history (awslabs#161, awslabs#97, awslabs#131, awslabs#72) was found by a human noticing. Two monitors, deliberately separate: - recheck — re-fetch each fact's own source URL and re-extract the field. Answers only "does what we said still hold?" - announcement scan — the AWS What's New feed, filtered by the 27 existing decision-refs/ design-refs files. No separate topic list to maintain: the skill's own knowledge files ARE the filter, so it cannot fall out of date. The AgentCore runtime-instances launch (2026-08-06) drove every rule. Its value did not change — its SHAPE did. microVMs still cap sessions at 8h; the new EC2-backed option runs 14 days. A value-diff would have rewritten 8h to 14d, which is wrong. Meanwhile the real damage was in ~13 derived judgments across two skills, three of which reversed. Hence: URL re-extraction rather than semantic search for recheck, a schema_change verdict distinct from value_change, and blast radius computed by searching real file content. Measured end to end (see the POC README): recheck agreed on all 6 piloted facts across 3 identical runs; the scan kept 12 of 100 items with the acceptance item among them; the judge returned schema_change with 13 locations and 3 flipped conclusions; apply.py wrote 13/13 to a clean tree and 0/13 on a second run (idempotent); a ticked dashboard checkbox came back as a queued request the next scan consumed. Three defects the POC found, all now guarded or recorded: - a per-second Fargate rate compared against a per-hour stored value, on a fact eligible for automatic editing — a 3600x error away from an auto-PR. Fixed with a mechanical magnitude guard, since the single-location rule did not protect against it. - a rewrite that updated a reason string while leaving the hard_constraints rule it justifies untouched — fluent prose over unchanged behaviour, invisible in the diff. Recorded as the one place review cannot substitute for a mechanical check. - blast radius is unstable between runs: 9 locations one run, 13 the next, neither a superset. infra/kb-autoupdate.yaml deploys the whole thing as one weekly CodeBuild job in the maintainer's own account, pushing to a fork and opening PRs upstream — nothing is added to this repository. Checkov clean (44 passed, 0 failed, 1 documented skip: a log bucket cannot log to itself). Not deployed, and automatic PRs are not authorised by this: the build order still calls for running silently for several weeks first.
leon1418
pushed a commit
to leon1418/startups
that referenced
this pull request
Aug 11, 2026
…and IaC Keeps the migration-to-aws skills' externally-sourced facts current: two monitors on a weekly schedule, a judge that decides what a change means and how far it reaches, and a draft PR for a human to review. Nothing merges without a person. Why: of 176 non-vendored skill markdown files, 37 contain any URL and 8 carry a date marker, so most facts cannot be re-verified by anything. Every stale-fact fix in this repo's history (awslabs#161, awslabs#97, awslabs#131, awslabs#72) was found by a human noticing. Two monitors, deliberately separate: - recheck — re-fetch each fact's own source URL and re-extract the field. Answers only "does what we said still hold?" - announcement scan — the AWS What's New feed, filtered by the 27 existing decision-refs/ design-refs files. No separate topic list to maintain: the skill's own knowledge files ARE the filter, so it cannot fall out of date. The AgentCore runtime-instances launch (2026-08-06) drove every rule. Its value did not change — its SHAPE did. microVMs still cap sessions at 8h; the new EC2-backed option runs 14 days. A value-diff would have rewritten 8h to 14d, which is wrong. Meanwhile the real damage was in ~13 derived judgments across two skills, three of which reversed. Hence: URL re-extraction rather than semantic search for recheck, a schema_change verdict distinct from value_change, and blast radius computed by searching real file content. Measured end to end (see the POC README): recheck agreed on all 6 piloted facts across 3 identical runs; the scan kept 12 of 100 items with the acceptance item among them; the judge returned schema_change with 13 locations and 3 flipped conclusions; apply.py wrote 13/13 to a clean tree and 0/13 on a second run (idempotent); a ticked dashboard checkbox came back as a queued request the next scan consumed. Three defects the POC found, all now guarded or recorded: - a per-second Fargate rate compared against a per-hour stored value, on a fact eligible for automatic editing — a 3600x error away from an auto-PR. Fixed with a mechanical magnitude guard, since the single-location rule did not protect against it. - a rewrite that updated a reason string while leaving the hard_constraints rule it justifies untouched — fluent prose over unchanged behaviour, invisible in the diff. Recorded as the one place review cannot substitute for a mechanical check. - blast radius is unstable between runs: 9 locations one run, 13 the next, neither a superset. infra/kb-autoupdate.yaml deploys the whole thing as one weekly CodeBuild job in the maintainer's own account, pushing to a fork and opening PRs upstream — nothing is added to this repository. Checkov clean (44 passed, 0 failed, 1 documented skip: a log bucket cannot log to itself). Not deployed, and automatic PRs are not authorised by this: the build order still calls for running silently for several weeks first.
leon1418
pushed a commit
to leon1418/startups
that referenced
this pull request
Aug 11, 2026
…and IaC Keeps the migration-to-aws skills' externally-sourced facts current: two monitors on a weekly schedule, a judge that decides what a change means and how far it reaches, and a draft PR for a human to review. Nothing merges without a person. Why: of 176 non-vendored skill markdown files, 37 contain any URL and 8 carry a date marker, so most facts cannot be re-verified by anything. Every stale-fact fix in this repo's history (awslabs#161, awslabs#97, awslabs#131, awslabs#72) was found by a human noticing. Two monitors, deliberately separate: - recheck — re-fetch each fact's own source URL and re-extract the field. Answers only "does what we said still hold?" - announcement scan — the AWS What's New feed, filtered by the 27 existing decision-refs/ design-refs files. No separate topic list to maintain: the skill's own knowledge files ARE the filter, so it cannot fall out of date. The AgentCore runtime-instances launch (2026-08-06) drove every rule. Its value did not change — its SHAPE did. microVMs still cap sessions at 8h; the new EC2-backed option runs 14 days. A value-diff would have rewritten 8h to 14d, which is wrong. Meanwhile the real damage was in ~13 derived judgments across two skills, three of which reversed. Hence: URL re-extraction rather than semantic search for recheck, a schema_change verdict distinct from value_change, and blast radius computed by searching real file content. Measured end to end (see the POC README): recheck agreed on all 6 piloted facts across 3 identical runs; the scan kept 12 of 100 items with the acceptance item among them; the judge returned schema_change with 13 locations and 3 flipped conclusions; apply.py wrote 13/13 to a clean tree and 0/13 on a second run (idempotent); a ticked dashboard checkbox came back as a queued request the next scan consumed. Three defects the POC found, all now guarded or recorded: - a per-second Fargate rate compared against a per-hour stored value, on a fact eligible for automatic editing — a 3600x error away from an auto-PR. Fixed with a mechanical magnitude guard, since the single-location rule did not protect against it. - a rewrite that updated a reason string while leaving the hard_constraints rule it justifies untouched — fluent prose over unchanged behaviour, invisible in the diff. Recorded as the one place review cannot substitute for a mechanical check. - blast radius is unstable between runs: 9 locations one run, 13 the next, neither a superset. infra/kb-autoupdate.yaml deploys the whole thing as one weekly CodeBuild job in the maintainer's own account, pushing to a fork and opening PRs upstream — nothing is added to this repository. Checkov clean (44 passed, 0 failed, 1 documented skip: a log bucket cannot log to itself). Not deployed, and automatic PRs are not authorised by this: the build order still calls for running silently for several weeks first.
leon1418
pushed a commit
to leon1418/startups
that referenced
this pull request
Aug 11, 2026
…and IaC Keeps the migration-to-aws skills' externally-sourced facts current: two monitors on a weekly schedule, a judge that decides what a change means and how far it reaches, and a draft PR for a human to review. Nothing merges without a person. Why: of 176 non-vendored skill markdown files, 37 contain any URL and 8 carry a date marker, so most facts cannot be re-verified by anything. Every stale-fact fix in this repo's history (awslabs#161, awslabs#97, awslabs#131, awslabs#72) was found by a human noticing. Two monitors, deliberately separate: - recheck — re-fetch each fact's own source URL and re-extract the field. Answers only "does what we said still hold?" - announcement scan — the AWS What's New feed, filtered by the 27 existing decision-refs/ design-refs files. No separate topic list to maintain: the skill's own knowledge files ARE the filter, so it cannot fall out of date. The AgentCore runtime-instances launch (2026-08-06) drove every rule. Its value did not change — its SHAPE did. microVMs still cap sessions at 8h; the new EC2-backed option runs 14 days. A value-diff would have rewritten 8h to 14d, which is wrong. Meanwhile the real damage was in ~13 derived judgments across two skills, three of which reversed. Hence: URL re-extraction rather than semantic search for recheck, a schema_change verdict distinct from value_change, and blast radius computed by searching real file content. Measured end to end (see the POC README): recheck agreed on all 6 piloted facts across 3 identical runs; the scan kept 12 of 100 items with the acceptance item among them; the judge returned schema_change with 13 locations and 3 flipped conclusions; apply.py wrote 13/13 to a clean tree and 0/13 on a second run (idempotent); a ticked dashboard checkbox came back as a queued request the next scan consumed. Three defects the POC found, all now guarded or recorded: - a per-second Fargate rate compared against a per-hour stored value, on a fact eligible for automatic editing — a 3600x error away from an auto-PR. Fixed with a mechanical magnitude guard, since the single-location rule did not protect against it. - a rewrite that updated a reason string while leaving the hard_constraints rule it justifies untouched — fluent prose over unchanged behaviour, invisible in the diff. Recorded as the one place review cannot substitute for a mechanical check. - blast radius is unstable between runs: 9 locations one run, 13 the next, neither a superset. infra/kb-autoupdate.yaml deploys the whole thing as one weekly CodeBuild job in the maintainer's own account, pushing to a fork and opening PRs upstream — nothing is added to this repository. Checkov clean (44 passed, 0 failed, 1 documented skip: a log bucket cannot log to itself). Not deployed, and automatic PRs are not authorised by this: the build order still calls for running silently for several weeks first.
leon1418
pushed a commit
to leon1418/startups
that referenced
this pull request
Aug 13, 2026
…and IaC Keeps the migration-to-aws skills' externally-sourced facts current: two monitors on a weekly schedule, a judge that decides what a change means and how far it reaches, and a draft PR for a human to review. Nothing merges without a person. Why: of 176 non-vendored skill markdown files, 37 contain any URL and 8 carry a date marker, so most facts cannot be re-verified by anything. Every stale-fact fix in this repo's history (awslabs#161, awslabs#97, awslabs#131, awslabs#72) was found by a human noticing. Two monitors, deliberately separate: - recheck — re-fetch each fact's own source URL and re-extract the field. Answers only "does what we said still hold?" - announcement scan — the AWS What's New feed, filtered by the 27 existing decision-refs/ design-refs files. No separate topic list to maintain: the skill's own knowledge files ARE the filter, so it cannot fall out of date. The AgentCore runtime-instances launch (2026-08-06) drove every rule. Its value did not change — its SHAPE did. microVMs still cap sessions at 8h; the new EC2-backed option runs 14 days. A value-diff would have rewritten 8h to 14d, which is wrong. Meanwhile the real damage was in ~13 derived judgments across two skills, three of which reversed. Hence: URL re-extraction rather than semantic search for recheck, a schema_change verdict distinct from value_change, and blast radius computed by searching real file content. Measured end to end (see the POC README): recheck agreed on all 6 piloted facts across 3 identical runs; the scan kept 12 of 100 items with the acceptance item among them; the judge returned schema_change with 13 locations and 3 flipped conclusions; apply.py wrote 13/13 to a clean tree and 0/13 on a second run (idempotent); a ticked dashboard checkbox came back as a queued request the next scan consumed. Three defects the POC found, all now guarded or recorded: - a per-second Fargate rate compared against a per-hour stored value, on a fact eligible for automatic editing — a 3600x error away from an auto-PR. Fixed with a mechanical magnitude guard, since the single-location rule did not protect against it. - a rewrite that updated a reason string while leaving the hard_constraints rule it justifies untouched — fluent prose over unchanged behaviour, invisible in the diff. Recorded as the one place review cannot substitute for a mechanical check. - blast radius is unstable between runs: 9 locations one run, 13 the next, neither a superset. infra/kb-autoupdate.yaml deploys the whole thing as one weekly CodeBuild job in the maintainer's own account, pushing to a fork and opening PRs upstream — nothing is added to this repository. Checkov clean (44 passed, 0 failed, 1 documented skip: a log bucket cannot log to itself). Not deployed, and automatic PRs are not authorised by this: the build order still calls for running silently for several weeks first.
leon1418
pushed a commit
to leon1418/startups
that referenced
this pull request
Aug 14, 2026
…and IaC Keeps the migration-to-aws skills' externally-sourced facts current: two monitors on a weekly schedule, a judge that decides what a change means and how far it reaches, and a draft PR for a human to review. Nothing merges without a person. Why: of 176 non-vendored skill markdown files, 37 contain any URL and 8 carry a date marker, so most facts cannot be re-verified by anything. Every stale-fact fix in this repo's history (awslabs#161, awslabs#97, awslabs#131, awslabs#72) was found by a human noticing. Two monitors, deliberately separate: - recheck — re-fetch each fact's own source URL and re-extract the field. Answers only "does what we said still hold?" - announcement scan — the AWS What's New feed, filtered by the 27 existing decision-refs/ design-refs files. No separate topic list to maintain: the skill's own knowledge files ARE the filter, so it cannot fall out of date. The AgentCore runtime-instances launch (2026-08-06) drove every rule. Its value did not change — its SHAPE did. microVMs still cap sessions at 8h; the new EC2-backed option runs 14 days. A value-diff would have rewritten 8h to 14d, which is wrong. Meanwhile the real damage was in ~13 derived judgments across two skills, three of which reversed. Hence: URL re-extraction rather than semantic search for recheck, a schema_change verdict distinct from value_change, and blast radius computed by searching real file content. Measured end to end (see the POC README): recheck agreed on all 6 piloted facts across 3 identical runs; the scan kept 12 of 100 items with the acceptance item among them; the judge returned schema_change with 13 locations and 3 flipped conclusions; apply.py wrote 13/13 to a clean tree and 0/13 on a second run (idempotent); a ticked dashboard checkbox came back as a queued request the next scan consumed. Three defects the POC found, all now guarded or recorded: - a per-second Fargate rate compared against a per-hour stored value, on a fact eligible for automatic editing — a 3600x error away from an auto-PR. Fixed with a mechanical magnitude guard, since the single-location rule did not protect against it. - a rewrite that updated a reason string while leaving the hard_constraints rule it justifies untouched — fluent prose over unchanged behaviour, invisible in the diff. Recorded as the one place review cannot substitute for a mechanical check. - blast radius is unstable between runs: 9 locations one run, 13 the next, neither a superset. infra/kb-autoupdate.yaml deploys the whole thing as one weekly CodeBuild job in the maintainer's own account, pushing to a fork and opening PRs upstream — nothing is added to this repository. Checkov clean (44 passed, 0 failed, 1 documented skip: a log bucket cannot log to itself). Not deployed, and automatic PRs are not authorised by this: the build order still calls for running silently for several weeks first.
leon1418
pushed a commit
to leon1418/startups
that referenced
this pull request
Aug 14, 2026
…and IaC Keeps the migration-to-aws skills' externally-sourced facts current: two monitors on a weekly schedule, a judge that decides what a change means and how far it reaches, and a draft PR for a human to review. Nothing merges without a person. Why: of 176 non-vendored skill markdown files, 37 contain any URL and 8 carry a date marker, so most facts cannot be re-verified by anything. Every stale-fact fix in this repo's history (awslabs#161, awslabs#97, awslabs#131, awslabs#72) was found by a human noticing. Two monitors, deliberately separate: - recheck — re-fetch each fact's own source URL and re-extract the field. Answers only "does what we said still hold?" - announcement scan — the AWS What's New feed, filtered by the 27 existing decision-refs/ design-refs files. No separate topic list to maintain: the skill's own knowledge files ARE the filter, so it cannot fall out of date. The AgentCore runtime-instances launch (2026-08-06) drove every rule. Its value did not change — its SHAPE did. microVMs still cap sessions at 8h; the new EC2-backed option runs 14 days. A value-diff would have rewritten 8h to 14d, which is wrong. Meanwhile the real damage was in ~13 derived judgments across two skills, three of which reversed. Hence: URL re-extraction rather than semantic search for recheck, a schema_change verdict distinct from value_change, and blast radius computed by searching real file content. Measured end to end (see the POC README): recheck agreed on all 6 piloted facts across 3 identical runs; the scan kept 12 of 100 items with the acceptance item among them; the judge returned schema_change with 13 locations and 3 flipped conclusions; apply.py wrote 13/13 to a clean tree and 0/13 on a second run (idempotent); a ticked dashboard checkbox came back as a queued request the next scan consumed. Three defects the POC found, all now guarded or recorded: - a per-second Fargate rate compared against a per-hour stored value, on a fact eligible for automatic editing — a 3600x error away from an auto-PR. Fixed with a mechanical magnitude guard, since the single-location rule did not protect against it. - a rewrite that updated a reason string while leaving the hard_constraints rule it justifies untouched — fluent prose over unchanged behaviour, invisible in the diff. Recorded as the one place review cannot substitute for a mechanical check. - blast radius is unstable between runs: 9 locations one run, 13 the next, neither a superset. infra/kb-autoupdate.yaml deploys the whole thing as one weekly CodeBuild job in the maintainer's own account, pushing to a fork and opening PRs upstream — nothing is added to this repository. Checkov clean (44 passed, 0 failed, 1 documented skip: a log bucket cannot log to itself). Not deployed, and automatic PRs are not authorised by this: the build order still calls for running silently for several weeks first.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
AWS moved classic Bedrock Agents (
bedrock-agent) to maintenance mode: it is closed to new customers as of July 30, 2026 (AWS announcement, maintenance mode guide). The gcp-to-aws AI path still recommended classic Bedrock Agents as a migration target in 11 places — and those recommendations carry 2–4 week timelines, so a customer starting today would reach Bedrock Agents onboarding after the cutoff. This PR removes every such recommendation and replaces it with AgentCore (Harness by default, Runtime for code-defined loops), which is AWS's official migration target and already what the plugin's own agentic questions (Q23–Q26) recommend. This also closes an internal inconsistency: Q14/Q17 said "Bedrock Agents" while Q23–Q26 said AgentCore.Changes
clarify-ai.md: Q14 answer rows A/E/F and D+F combination row, Q17 agentic-workflows row → AgentCore (Harness/Runtime, Gateway for MCP); added a guardrail note under the Q14 table with the EOL date and announcement link so the recommendation cannot silently regressclarify.md: two combination-trigger rows (OpenAI Agents SDK, Multi-agent + MCP) → AgentCoredesign-ai.md: capability map row Vertex AI Agent Builder → Bedrock AgentCore (Harness)ai-openai-to-bedrock.md: Assistants-API case 4 target → AgentCore (Harness sessions/memory, action groups as MCP tools via Gateway, gateway-fronted knowledge bases) with an explicit never-target-classic note; Converse-vs-Mantle feature list → AgentCore integrationai-gemini-to-bedrock.md: ecosystem-advantage list → AgentCoreRelationship to other PRs
Independent — based directly on current
main(includes #154 and #157). No overlap with open PRs; the workshop/estimate/pricing branches do not touch these lines.Test plan
mise run fmtcleanmise run buildgreen (160/160 checks, no vulnerabilities)