Web / Artifact Deploy

Ship what the agent built. Artifact Deploy takes a kind: "webapp" artifact from your library and puts it live at a global public HTTPS URL — in your own AWS account, with a default TTL, automatic cleanup, and a promote-to-persistent path.

Crew orchestrates the deploy; your account pays only for what the site actually serves.

Use an artifact's Publish menu to create a public HTTPS URL in your own AWS account. Publishing requires a configured AWS profile, the capabilities.publish governance gate, and a destination allowed by publish.allowed_destinations in config.json. It is never the default destination for an artifact.

An administrator controls the required publishing capability and allowed destinations. If the Publish action is unavailable or refused, ask the administrator to enable artifact publishing for the intended destination rather than changing the artifact.

1. Enable the Artifact Deploy app (App Store → Artifact Deploy), open it from the sidebar, and register an AWS profile (a named profile from ~/.aws/config). Click Verify to confirm access.
2. Ask the agent to build something — apps saved with kind: "webapp" appear in the Artifacts gallery with a live local preview.
3. Click Deploy on the artifact card. A deploy session opens; the agent proposes a plan (resources, region, cost estimate); you confirm in the console.
4. You get a CloudFront URL. The card flips to Live with the link, TTL countdown, architecture summary, and a Tear down button.

Three tiers, chosen by the agent based on the artifact's needs:

The first deploy in an account creates a shared base stack (kirocrew-deploy-base: S3 bucket + CloudFront distribution). This takes ~5–15 min while CloudFront propagates globally.

Every subsequent deploy reuses the base stack and completes in seconds.

The reaper only ever touches resources that carry the kirocrew:site + kirocrew:managed tags and match the managed naming scheme. It cannot delete anything else in your account.

Every artifact's card in the dashboard renders one of these states:

• Not deployed — Deploy button + AWS profile picker
• Deploying — progress log with resource creation events
• Live — URL, TTL countdown, architecture rows, cost pills, Tear down button
• Expired — tombstone card + Redeploy button

The card renders your app inside a browser-framed preview. It prefers the local copy (served through a token-gated gateway channel, sandboxed, works even before deploying). Deployed sites can render the remote CloudFront page directly when the gateway confirms it's framable.

The preview channel is deny-by-default: token-gated, sandboxed to an opaque origin, path-traversal and symlink hardened, and every response is scanned so credential-bearing files are refused rather than served.

The card shows what-if traffic scenarios:

1,000 views · $0.05
100,000 views · $5.00

These are estimates, not a bill. You pay only for actual usage. Estimates are labelled explicitly to avoid confusion.

Sidebar → Artifact Deploy. One place for everything deployed:

Three invariants hold:

1. Crew never writes IAM. The deploy policy and permissions boundary are generated for you, but you apply them in your own account. Any error that needs an operator action fails loudly with the exact command to run.
2. Tag-gated mutations. Deploy actions only apply to resources tagged kirocrew:managed=true. The reaper enforces the same on cleanup.
3. Deny-by-default preview. The local preview channel is token-gated and sandboxed. Path traversal, symlinks, and credential-bearing files are refused.

Before your first deploy:

# 1. Register the AWS profile from ~/.aws/config in the Artifact Deploy console
# 2. Apply the generated IAM policy to that profile (the console shows the command)
# 3. Install the reaper stack in each region you'll deploy to
./install-reaper.sh --profile my-profile --region us-east-1

The IAM policy generator produces a least-privilege policy scoped to kirocrew:managed=true tagged resources. Apply it yourself; Crew won't do it for you.

Every deployed artifact card has a Tear down button. It:

1. Removes the S3 objects under the site's prefix
2. Removes the CloudFront invalidation
3. Removes any Lambda / DynamoDB tier resources
4. Marks the deploy expired

For persistent deploys (ttl_hours: 0), this is the only way to remove them — the reaper doesn't touch persistent sites.

For a deploy you want to keep:

• Card menu → Promote to persistent
• The reaper skips it on future sweeps
• The card no longer shows a TTL countdown; only the manual Tear down button remains

If a deploy expired or you want to update it:

• Expired — the card shows a Redeploy button
• Live — deploy again from the artifact card; existing site is updated in place (S3 objects replaced, CloudFront invalidated)

Artifact Deploy is one thing you can do with artifacts. Every artifact — not just webapps — has a stable identity, versions, and a live preview. See Artifacts & widgets for the model.