interlock
Deployment

Laptop today, team tomorrow

The same daemon runs on a developer's machine or as a shared service in your account. Both profiles keep the audit trail in your own AWS.

Laptop Profile

verified

Everything runs on the developer's machine; AWS is reached with their own credentials.

  • ▸Daemon + Decider run locally
  • ▸AWS services (DynamoDB, Guardrails, Bedrock) via the developer's credentials
  • ▸Local spool for offline operation
  • ▸Apple Silicon (MLX) or NVIDIA GPU for the judge

Team Profile

designed

A shared service for an engineering org — centrally deployed, IAM everywhere.

  • ▸Daemon on ECS Fargate behind an internal ALB
  • ▸Decider on a SageMaker endpoint (ml.g6.xlarge class)
  • ▸IAM (SigV4) everywhere
  • ▸One CDK command to deploy

Infrastructure

The team profile deploys as a single CloudFormation stack with a tracked resource ledger, so you always know what's running in your account.

CloudFormation stack: DynamoDB table + stream
Explainer Lambda
Firehose → S3 export
SageMaker endpoint
IAM roles
Running AWS resource ledger (infra/AWS-RESOURCES.md)
Tag-based inventory