# Vendor the Pinned Official Account-Setup Bundle

Controlplane9 vendors the official AWS BYOC account-setup execution closure
byte for byte: `tidbcloud-byoc-setup.sh` and its deploy, dataplane, and O11Y
CloudFormation templates. The first implementation pins
`tidbcloud/byoc-account-setup@16210282152a0f2eef56821bb6e47c7986034b68`.
A checked-in manifest records the upstream repository and full commit, each
file's SHA-256 digest, and a deterministic whole-bundle digest. Static tests
verify that the embedded closure and manifest agree.

Activation materializes the embedded files into a session-owned staging
directory, preserves the script's executable mode, sets the local customer AWS
profile and region environment, and runs the original script from the directory
containing its relative templates. CP9 does not rewrite the script's three
`aws cloudformation deploy` calls. It executes the unchanged script under a
pass-through AWS CLI wrapper that appends only the mandatory `cp9-owner` and
`cp9-session` stack tags to those three deploys; every other script AWS call is
passed through unchanged. Under the selector reservation and account lease,
the wrapper also repeats an identity read immediately before each individual
deploy and rejects a stack created or replaced after the leased preflight.
Binding and resume validate those tags as well as stack ID, template,
parameters, account, region, and creation time. Revalidation of an already
completed setup repeats the pinned template and recorded creation-time checks
rather than trusting its journaled ID. Template canonicalization preserves
CloudFormation intrinsic YAML tags such as `!Sub`, `!Ref`, and `!GetAtt`, so
semantically changed intrinsics cannot collide with plain scalars. The setup
contract commit and bundle digest are part of the immutable activation
fingerprint and are reported by BYOC status and evidence without exposing
credentials.

Activation never reads a floating upstream branch, an arbitrary operator
checkout, or a runtime network clone. Updating the production setup contract is
an intentional reviewed bundle-bump change that refreshes the vendored files,
manifest, and closure tests together.