Greptile Summary

This PR hardens AWS CloudFormation BYOC (Bring Your Own Cloud) release generation across four distinct areas, each with focused tests and real deployment proof.

• SES inbound email automation: Replaces the previous manual "activate rule set" post-deploy step with a stack-local CloudFormation custom resource (Lambda + IAM role) that activates the provisioned AWS::SES::ReceiptRuleSet on create/update and safely deactivates it on delete only if it is still the currently-active rule set. A new topology validator rejects stacks with more than one inbound email resource at generation time.
• OpenSearch Serverless capacity limits: Extends the AwsOpenSearch resource with optional capacity (indexing/search OCU bounds) validated against AWS's supported increment set, emitted as CapacityLimits on the NEXTGEN collection group.
• Storage CORS & path parsing: Emits a CorsConfiguration rule on S3 buckets when corsAllowedOrigins is set; switches all storage binding calls from Path::from (no validation) to Path::parse (rejects empty segments, preserves RFC characters exactly once before signing).
• Runtime hardening: Defers OTLP bootstrap when ALIEN_RUNTIME_SECRETS indicates vault-backed credentials; replaces oneshot/Notify readiness primitives in ControlGrpcServer with watch channels so multiple concurrent waiters are correctly unblocked; propagates --input flag values to the platform API (previously HashMap::new() was always sent); includes transitive @alienplatform/bindings bytes in TypeScript build cache keys.

Confidence Score: 5/5

Safe to merge — all changes are additive fixes or hardening with real deployment and unit-test proof; no regressions observed.

The PR fixes three distinct correctness bugs (input values silently dropped, unauthenticated OTLP export before vault load, multiple waiters on a oneshot channel), adds tested new capabilities (CORS, OCU capacity limits, SES custom resource), and validates each through both focused unit tests and live AWS deployments. The most significant logic addition — the CloudFormation SES activation Lambda — handles the edge cases (no active rule set, in-place vs. replacement update, stack-managed vs. externally-managed rule sets) correctly. Code is well-commented and changes are well-scoped.

crates/alien-cloudformation/src/emitters/aws/email.rs (new custom resource Lambda — review Python inline code and IAM permissions carefully) and crates/alien-build/src/lib.rs (bindings_realpath overwrite edge case in hoisted-dependency layouts).

Sequence Diagram

sequenceDiagram
    participant main as main.rs
    participant runtime as runtime::run()
    participant otlp as otlp.rs
    participant vault as BindingsProvider (vault)
    participant lambda as LambdaTransport

    main->>otlp: init_otlp_logging()
    alt ALIEN_RUNTIME_SECRETS present (vault-backed)
        otlp-->>main: Ok(None) — deferred
    else env-only credentials
        otlp-->>main: Ok(Some(bridge)) — initialized
    end

    main->>runtime: run(config, deps)
    runtime->>lambda: prestart_lambda_transport() [Init phase]
    lambda-->>runtime: PrestartedTransport handle

    runtime->>vault: load_runtime_secrets()
    vault-->>runtime: "HashMap { OTEL_EXPORTER_OTLP_HEADERS: ... }"

    runtime->>otlp: init_otlp_logging_from_config(otlp_config)
    Note over otlp: Authenticated OTLP provider installed into OTLP_PROVIDER

    runtime->>runtime: start_application(child, log_exporter)

    Note over lambda: Invocation loop begins (wait_for_task_readiness per call)

    runtime->>runtime: run_transport() — joins prestarted handle

_{Reviews (4): Last reviewed commit: "fix: activate SES receipt rule sets duri..." | Re-trigger Greptile}

Final AWS validation update:

• Live OpenSearch Serverless rejected 1 OCU for both indexing and search; the supported nonzero floor is 2. Validation/schema and the CloudFormation fixture now enforce that before deployment (4229ed78, 3a45a908).
• The generated CloudFormation setup path updated a real NEXTGEN collection group to min indexing/search 2.0 OCU; the stack reached UPDATE_COMPLETE. The runtime manager correctly refused to mutate the frozen setup-owned capacity.
• Real Lambda testing exposed that an 8-second pre-poll readiness budget could still cross Lambda’s 10-second init limit. 22c1bcc3 now polls the Runtime API immediately and keeps readiness waiting inside invocation handling. A cold API invocation had one init (1334.03 ms), HTTP 200, and no init timeout/restart.
• A cold events invocation initialized once (1165.78 ms) and a deliberately unmatched valid SQS event returned FunctionError: Unhandled / TASK_DELIVERY_FAILED, proving failures are no longer silently acknowledged.
• Focused results: OpenSearch core 8/8, CloudFormation generator 7/7, TypeScript core 67/67, AWS runtime 80/80. Fresh CI is running on 3a45a908.

@greptileai

@greptileai