How this page reached you

One codebase, shipped by agent.cloud to four spike targets. This copy runs on AWS, provisioned with Cluster API. Its siblings run on the other three.

1. AgentA coding agent works on the code in a folder and runs agc ship. The source goes to agent.cloud (staging), which checks it and holds the release for a person to approve.
2. Build, in this target’s cloudagent.cloud hands the build to this target’s own runner, which starts AWS CodeBuild in the experiment account. The app’s code only ever runs inside that build service, with agent.cloud’s default Node image.
3. Image, in this target’s registryThe image lands in Amazon ECR, one repository per app (agentcloud-spike/tenants/<app>), created on first push, in the same cloud and region as this cluster. Nothing is copied between clouds.
4. RehearsalThe new image runs once beside production on a copy of its data, with the agent’s checks. Only a passing rehearsal is released.
5. Release on k3sThe runner deploys it as web-v<N> in its own namespace (app-tour-aws-capi): Pod Security “restricted”, no service account token, traffic only from the ingress, never to the cloud’s metadata or private ranges. It pulls with ECR’s token for the node’s role.
6. Serving youYou reach it through the network load balancer Cluster API makes for the API, with the web ports added, then Traefik on the cluster, with a certificate for this exact address from cert-manager and Let’s Encrypt. The previous version stays a moment for an instant switch back.