[scttfrdmn]

Release v0.163.1: moves Unreleased to ## [0.163.1] - 2026-11-10. Patch.

• v0.162.0: every default-role launch fails on accounts with other inline policies — spored-policy-v1 pushes spored-instance-role past IAM's 10,240-byte inline limit #1573 (via fix(iam): attach the spored grants as a managed policy (#1573) #1577): since v0.162.0, launches failed with LimitExceeded on accounts whose spored role already carries other inline policies. spored's versioned grants are now a customer-managed policy at /spore-host/, attached rather than written inline. If the managed-policy actions are denied, spawn falls back to the inline write with a warning. On LimitExceeded it now lists every inline policy and its size.
  • Live-verified in spore-host-dev: v0.163.0 fails and the fix launches on the same padded role; CloudTrail shows CreatePolicy → AttachRolePolicy. Full teardown, leak check clean.
• New CLI IAM actions: GetPolicy, GetPolicyVersion, CreatePolicy, DeletePolicy, ListAttachedRolePolicies, DetachRolePolicy, GetRolePolicy, plus ListPolicies for cleanup --instance-roles. The documented least-privilege policy is updated in MPI/job-array RunInstances ClientToken is derived from --job-array-name, not the per-launch array ID: relaunching a name fails IdempotentParameterMismatch (or could return the old reservation) #691, to merge once this ships.
• Follow-up: reaper: delete unattached spored managed policies (/spore-host/spored-*-vN) it detaches #1576, the reaper deletes the spored policies it detaches.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[github-actions]

Deploy checklist: v0.163.0..v0.163.1

Operated components whose deploy inputs differ between v0.163.0 (74a4132) and v0.163.1 (b4c55f9), from scripts/deploychecklist (#1444). code-only: only compiled inputs changed, so a code update ships it. manual: a script, template, policy or mapping changed; review and apply it by hand. Deploy from a clean checkout of v0.163.1. How to read this: docs/infra-account.md, "Deploy checklist".

Lambdas (3 of 9 need a deploy)

• lambda/pipeline-orchestrator (spawn-pipeline-orchestrator): changed, code-only
  • compiles pkg/aws: cleanup.go, iam.go, iam_policy_schema.go, iam_spored_managed.go (added), nested_spawn.go, reapercoverage.go
  • compiles pkg/instancerole: sporedpolicies.go (added)
  • deploy (sam): make -C lambda/pipeline-orchestrator deploy
• lambda/sweep-orchestrator (spawn-sweep-orchestrator): changed, code-only
  • compiles pkg/aws: cleanup.go, iam.go, iam_policy_schema.go, iam_spored_managed.go (added), nested_spawn.go, reapercoverage.go
  • compiles pkg/instancerole: sporedpolicies.go (added)
  • deploy (shell): scripts/deploy-sweep-orchestrator.sh
• lambda/ttl-reaper (spawn-ttl-reaper-production): changed, code-only
  • compiles pkg/instancerole: sporedpolicies.go (added)
  • deploy (sam): make -C lambda/ttl-reaper deploy

Unchanged, no deploy: lambda/cost-history-collector, lambda/dashboard-api, lambda/dashboard-websocket, lambda/dashboard-websocket-processor, lambda/dns-updater, lambda/scheduler-handler.

Other deploy inputs (0 of 26 changed, all manual)

None.

Shipped with the CLI, no deploy

• pkg/reaperdeploy: creates a Lambda from Go inside the spawn CLI (the self-hosted reaper, in the user's own account), so it ships with the CLI release, not as a spore.host deploy

[github-actions]

Lambda deploy record: v0.163.0..v0.163.1, LIVE

From scripts/deploylambdas (#1445): code-only Lambda changes, deployed by the approval-gated production job. How to read it: docs/infra-account.md, "Deploying code-only changes from CI".

Function	Result	CodeSha256 before	built	after	Config diff	Version stamp
spawn-pipeline-orchestrator	deployed	0D+9jPQSq9i7qcfUOuNJ7hi693JwPTI61h5wH7i/JTQ=	Ztk3NN+5d2ta3khhh47pBLR3DeaEMpsinMmKwOfuqSY=	Ztk3NN+5d2ta3khhh47pBLR3DeaEMpsinMmKwOfuqSY=	empty	spawn:version=0.163.1 (verified)
spawn-sweep-orchestrator	deployed	ah9JpZ7JSEf6oOgGr9GuyzZQ2VsmvpmN4yJ9F8MykZc=	ALZXlGREySxeOtgmHtDndX4MCyzPc7TebkP3ohCv7Pk=	ALZXlGREySxeOtgmHtDndX4MCyzPc7TebkP3ohCv7Pk=	empty	spawn:version=0.163.1 (verified)
spawn-ttl-reaper-production	deployed	sENMQHESLCRrZx44N5j5//KepbIEH4v7y9eL4Ng8QEY=	HF1sELCTFrkL4dNzqNSkhOjj3LrzkryVe1gLrQlbCNA=	HF1sELCTFrkL4dNzqNSkhOjj3LrzkryVe1gLrQlbCNA=	empty	spawn:version=0.163.1 (verified)

• spawn-pipeline-orchestrator:

  • SAM-managed, stack spawn-pipeline-orchestrator: after this update the stack's Code and Version parameter still name the previous deploy; that drift is expected and the next make -C lambda/pipeline-orchestrator deploy from a release tag reconciles it (docs/infra-account.md)
  • runtime version moved with the update (Lambda runtime management): map[RuntimeVersionArn:arn:aws:lambda:us-east-1::runtime:ff6eee7eb5e5e28588288c3d409d70849b3eaabef4006dcc892cd3e52a1c7afe] -> map[RuntimeVersionArn:arn:aws:lambda:us-east-1::runtime:0b1e416b0d97ff47846ecb1b6118b561a8ee9553dcec4f53b9e97c46c0910fec]

• spawn-sweep-orchestrator:

  • runtime version moved with the update (Lambda runtime management): map[RuntimeVersionArn:arn:aws:lambda:us-east-1::runtime:ad4edae0ce7eed91f4a7e16231f6ace264cc87b0608875c69007f5b9fc8a1ff7] -> map[RuntimeVersionArn:arn:aws:lambda:us-east-1::runtime:506c21b6706a88eca34819d9ab4d17b7861bbbdfd224524eb0cbe85a921582c2]

• spawn-ttl-reaper-production:

  • SAM-managed, stack spawn-ttl-reaper-production: after this update the stack's Code and Version parameter still name the previous deploy; that drift is expected and the next make -C lambda/ttl-reaper deploy from a release tag reconciles it (docs/infra-account.md)
  • runtime version moved with the update (Lambda runtime management): map[RuntimeVersionArn:arn:aws:lambda:us-east-1::runtime:ff6eee7eb5e5e28588288c3d409d70849b3eaabef4006dcc892cd3e52a1c7afe] -> map[RuntimeVersionArn:arn:aws:lambda:us-east-1::runtime:0b1e416b0d97ff47846ecb1b6118b561a8ee9553dcec4f53b9e97c46c0910fec]

• published bootstrap body for v0.163.1 verified (sha256 3563692d194f446e3aca50030b0e6a24a9fb15a87594daf30b46271f0e93f739)

Not deployed by this job

• lambda/cost-history-collector (spawn-cost-history-collector) (unchanged, none): unchanged, no deploy
• lambda/dashboard-api (spawn-dashboard-api) (unchanged, none): unchanged, no deploy
• lambda/dashboard-websocket (spawn-dashboard-websocket) (unchanged, none): unchanged, no deploy
• lambda/dashboard-websocket-processor (spawn-dashboard-websocket-processor) (unchanged, none): unchanged, no deploy
• lambda/dns-updater (spawn-dns-updater) (unchanged, none): unchanged, no deploy
• lambda/scheduler-handler (scheduler-handler) (unchanged, none): unchanged, no deploy

[scttfrdmn]

v0.163.1 deployed and verified (the owner approved run 42885548976).

• Code-only deploys: spawn-pipeline-orchestrator, spawn-sweep-orchestrator and spawn-ttl-reaper-production each have a new CodeSha256 and zero config drift against the pre-deploy snapshot. All are Active, with update status Successful.
• CloudTrail: exactly 3 UpdateFunctionCode calls plus 3 TagResource calls, all by GitHubActions-spawn-lambda-deploy, with no errors and no other Lambda writes.
• Reaper: first run after the deploy at 22:12Z finished with Errors:0 AccountsDenied:0 InstanceRolesAccountsDenied:0.
• Release artifacts: Go proxy, Homebrew and Scoop are at 0.163.1. verify-spored: 231 objects, fail=0.
• MPI/job-array RunInstances ClientToken is derived from --job-array-name, not the per-launch array ID: relaunching a name fails IdempotentParameterMismatch (or could return the old reservation) #691 (IAM docs) is merged. Before merging, the documented policy was proven with a real PutRolePolicy on a throwaway role.