Install reviewed w3-lab-auto workflows on main

[zacharybalicki]

Founder decisions 2026-09-30, options B and C, on this same pull request. Audience is internal. This does not change IAM, Paid, or the teardown reviewer.

Head

df552a561808c40aa4323f8cc84d825565f06ed4

The earlier byte-identical install remains the parent commit 6bf765d2ff076a27e0cbab8c0f5e99e9ae29d112.

What changed

Launch and sweep are no longer held. They call AWS only when every one of these is true:

• The cost-gate document says expected_oop_usd is 0, abort is false, and Cost Explorer was not called.
• The caller account is 960577828987. Account 934814114565 is refused.
• Region is us-east-2.
• Instance type is t3.micro or t3.small, the image owner is 099720109477, shutdown is terminate, and self-stop is 1 through 420 minutes.
• The sweeper deletes only resources that carry vantio:destroyable=true and the rest of the owned-lab tags, and only when the existing sweeper plan says delete. Untagged resources, other regions, and the denylist ids are skipped.

NONINTERACTIVE_TEARDOWN_READY stays false in the script. Live F-SELF and F-SWEEP have not been dispatched. They wait until this is on main.

Pin contract

The provision workflow calls the cost gate at refs/heads/main, with the comment oidc-trust. That is the string the billing role already trusts in job_workflow_ref. A commit SHA there would fail AssumeRole, and this pull request does not change IAM.

The pin report records that one call as same_repo_refs_heads_main and digest_pinned: false. Every other action use still has to be a 40-character digest with a tag comment. A third-party @main or a second workflow file at @refs/heads/main stays floating and fails the test. The optics dossier still lists this call as not accepted as a publish pin.

Tests

scripts/aws/test_w3_lab_auto.py covers unknown billing, a Paid plan, out-of-pocket above zero, credits at exactly $2.00, the forbidden account, another account, another region, untagged resources, destroyable=false, and one terminating run-instances call. The tests use a fake runner. They do not call AWS.

Review

main still requires one approving review. This pull request is waiting for kvantio. It was not self-approved, and branch protection was not changed.