v0.0.11

v0.0.11 makes the CaltechAUTHORS restore scriptable and safe to run on a test instance, tags everything clasm creates, adds a report and a command for tagging what was there before, and adds command-line forms to start and stop an instance.

Restore role and instance profile. A test instance that restores from production's backups should not be able to write to the backup buckets, so clasm can now build and tear down that setup from the command line. clasm iam create-role-from-template has a new template, "RDM Restore Source (read-only)": SSM, read of one source prefix in one or two backup buckets, and an explicit Deny of every write and delete there (DR-0184). create-instance-profile (also a new IAM menu item, number 7, so the items after it move down by one) wraps a role in a profile. clasm compute associate-replace-iam-instance-profile <instance> <profile> swaps a running instance's profile in place, no reboot, and is a no-op when the instance already has it; it refuses a profile that is not SSM-capable (DR-0185). remove-role-from-instance-profile, delete-instance-profile and delete-role complete the teardown on the shared destructive gate: a dry run by default and --confirm <name> to run (DR-0186, DR-0188).

Restore location guard. A restored RDM database carries its file locations (CaltechAUTHORS: s3://caltechauthors), so an instance that can write to that bucket would write to production's content after the restore. Restore SQL Backup now reads the backup's files_location rows before replacing anything (a dry run streams the dump through the instance and writes nothing), asks IAM's policy simulator whether the instance's role or the access key in /Sites/.env can write to each S3 bucket, and refuses unless each writable bucket is named in its own --confirm, beside the instance's: --confirm <instance> --confirm <bucket> (DR-0187). An instance that cannot write to any of them is never blocked. What cannot be told is treated as writable, and the simulator does not see bucket policies. It needs iam:SimulatePrincipalPolicy, iam:GetAccessKeyLastUsed and iam:GetUser. The menu flow warns and asks to continue. One behaviour change: --confirm "" is now a usage error instead of a silent dry run.

Tagging. clasm now adds the Origin tag (the key and DLD-owned value in origin_tag in ~/.clasm) to everything it creates: IAM roles, policies and instance profiles; EC2 instances with their volumes and network interfaces, launch templates and what they launch, AMIs with their snapshots, key pairs and the temporary cloud-init instance; and S3 buckets (DR-0189, DR-0190, DR-0191). It only does so when origin_tag.dld_value is set; with the default empty value nothing is added. A tag the request already carries keeps its own value. S3 objects and new launch template versions are not tagged, and nothing that already existed is changed.

Finding and tagging what was there before. Tag Management now covers eleven kinds: EBS volumes, EBS snapshots and network interfaces join the original eight (ebs-volume, ebs-snapshot, network-interface). clasm tag-management show-untagged [-text|-json|-jsonl] [<kind>...] lists the resources that lack the Origin tag, then those that have it with another value; it is read-only, takes kinds to narrow it, and leaves out AWS service-linked IAM roles. clasm tag-management tag-resource [--replace] <kind> <name-or-id> --tag key=value ... adds tags to one resource from a script: it adds what is missing, treats the same value as done so a loop can be re-run, and refuses a different value, changing nothing, unless --replace is given. It rejects aws: keys and an Environment value other than production, development or test (DR-0192, DR-0193). show-untagged is also item 3 of the Tag Management menu. The command line is still experimental: names and JSON keys may change.

Starting and stopping an instance. clasm compute start-ec2-instance [-no-wait] <instance> and clasm compute stop-ec2-instance [-no-wait] [--confirm <instance>] <instance> are the command-line forms of the two Compute menu items (DR-0194, DR-0195). Both read the instance's live state from AWS rather than the listing clasm loaded at startup, and both are safe to repeat: starting a running instance, or stopping a stopped one, sends nothing and succeeds, and an instance already starting or stopping is waited out. A state that cannot take the request (a stopping instance cannot be started; a pending, shutting-down or terminated one cannot be stopped) is exit 1 with nothing sent. They wait for the end state, up to five minutes, unless -no-wait is given, which returns as soon as AWS accepts the request and says the state it is in (pending or stopping). Stopping an instance whose live Environment tag is exactly production needs --confirm <instance-id-or-name>: without it the form prints the plan, changes nothing and exits 0, and a terminal is asked to type the name. --confirm is accepted on any instance and checked against it, before any AWS call. With -json both print one object (instance_id, name, region, previous_state, state, changed, plus the connection details for a start and declined for a stop). An unreachable AWS is exit 69. Terminate stays menu-only.

Note on verification. Verified against real AWS (us-west-2, 2026-10-16 and 2026-10-19): the restore role and its policy with the policy simulator; the profile swap and its repeat; the location guard on a real 1002.9 MiB production dump, as a dry run, as a confirmed restore with the read-only role, and refusing and exiting 2 in the writable cases; Restore OpenSearch of a 6.4 GiB snapshot, and then the full Archive OpenSearch Snapshot workflow on that restored instance into a scratch prefix (exit 0 in 246 s, 3,219 objects and 6,916,570,422 bytes, confirmed by clasm and independently by the AWS CLI, with the repository directory still owned by the service user and no root-owned file: the restore-then-archive direction DR-0175 fixed); tagging on launch templates, on launches from templates (including templates with no tag) and on creation of every EC2 and IAM kind; the whole-account show-untagged and tag-resource on ten kinds of throwaway resource, including the refusal and --replace, and tag-resource on a real S3 bucket, whose three existing tags all survived the merge; start-ec2-instance and stop-ec2-instance (44 checks on a test instance: the waits, the repeats, -no-wait each way, waiting out a pending and a stopping instance, a wrong and a right --confirm); and the teardown forms. The full-screen flows were also driven at a terminal against AWS: Create Instance Profile (the profile came out tagged and SSM-capable; a name already in use was refused by AWS with nothing created), Show untagged resources over all eleven kinds, Manage tags on the three new kinds (a tag added to and removed from an EBS volume, and the menu editor accepting any Environment value, as DR-0193 records), and the Restore SQL Backup menu as far as the file-location guard and the type-the-name prompt, which a blank answer cancelled before anything was downloaded. Not verified: the stop of a production instance (its --confirm gate is unit-tested only; no production instance was touched); the guard's warn-and-ask prompt, which appears only when the instance can write to a bucket the backup names (unit-tested only); exit 69; and two small checks not run by hand, declining the Create Instance Profile confirm and the CLI refusal of an Environment value outside production, development and test (both unit-tested). Rough edges found while testing are listed in TODO.md and are not part of this release.

Full Changelog: v0.0.10...v0.0.11