Coming from Loom's SAM deploy
llms.txt lists every page for a coding agent.
Show the prompt
Read https://intentius.io/loomster/guides/coming-from-upstream-loom/ and, from the person's Loom checkout (shared/etc/common.sh and the environment.sh files), write the LOOM_* exports that match their settings using the page's settings table.
List each setting with no loomster equivalent and what the page says to do instead. Don't deploy.
Never run `chant approve` or `just grant`, never deploy to or delete from a real AWS account unless the person asked for that in this session, never register an identity provider in Loom, and never push or edit the `chant/lifecycle` branch.Result
Section titled “Result”The same Loom v1.9.0 you deploy with make and SAM, deployed from typed source
with one command per tier, with your
settings carried over as build parameters.
The first command
Section titled “The first command”Where Loom’s DEPLOYMENT.md has you copy four environment.sh files, fill in
shared/etc/common.sh, and run make per stack across three directories with
make outputs between them, loomster is:
git clone https://github.com/INTENTIUS/loomster && cd loomster && npm installexport LOOM_TIER=production LOOM_VPC_ID=... LOOM_PUBLIC_SUBNET_IDS=... LOOM_PRIVATE_SUBNET_IDS=...export LOOM_DOMAIN_NAME=loom.example.com LOOM_DB_PASSWORD=...npm run vendornpx chant run --components all --env prodThe stacks deploy in dependency order and pass outputs to each other; there is
no outputs.sh. Deploy to production on AWS
is the full runbook.
Targets
Section titled “Targets”| To do this | Loom | loomster |
|---|---|---|
| Configure a deployment | shared/etc/common.sh plus etc/environment.sh in shared/, backend/, frontend/ | LOOM_* build parameters (settings below) |
| Once per account | make agentcore.init, make ecs.init | just bootstrap |
| Pass outputs between stacks | make outputs, then include etc/outputs.sh | automatic: stackOutput(...) between components |
| Hosted zone and NS delegation | make dns, make dns.outputs | npm run dns-setup (creates the zone, prints the NS records, waits for the delegation) |
| S3, ECR, ACM, ALB | make infra | shared-foundation |
| ECS cluster | make ecs (shared) | shared-foundation |
| PrivateLink | make privatelink | shared-foundation on the production tiers (LOOM_PRIVATELINK) |
| Cognito pool, groups, scopes, clients | make cognito | loom-cognito |
| An agent execution role | make role with P_AGENT_NAME | just agent-role <agent> <group>, which also registers it in Loom (guide); the shared role is in shared-foundation |
| Code Interpreter role | make ci-role | LOOM_AGENT_ROLE_CODE_INTERPRETER=true on loom-agent-role |
| RDS and RDS Proxy | make rds in backend/ | loom-db |
| Bastion and tunnel to the database | make ec2, make tunnel | just tunnel-host, then just tunnel (guide) |
| Build, push and deploy the services | make deploy (podman build and push by git sha, sam deploy per service) | chant run --components loom-backend and loom-frontend: build, publish by digest, deploy, wait for steady state and /health, roll back on failure |
| Everything, in order | about ten targets across three directories | npx chant run --components all |
| A token for the API | make cognito.get-tokens | just cognito-token, a throwaway admin with the MFA challenge handled on the production tiers |
| Client ids | make cognito.get-client-id | just cognito-client-id |
| First-sign-in passwords | make cognito.set-passwords | LOOM_COGNITO_PASSWORD=... just set-passwords [users] |
| Copy a SQLite Loom into Postgres | make migrate | just import-sqlite <loom.db>, gated |
| Fix sequences | make fix-sequences | just fix-sequences |
| Wipe the database | make reset-db | just reset-db: snapshot first, gated |
| Run locally | Phase 1: SQLite, make run and make dev, Cognito in AWS | just local-up: Postgres and Cognito on Floci, no AWS account |
| Fill a fresh Loom (role, authorizer) | ONBOARDING.md steps by hand | npm run seed (Seed and validate a deploy) |
| Remove everything | make *.delete in reverse, per directory | chant run loom-teardown, gated (Tear down a deployment) |
| List AgentCore credential providers | make agentcore.credentials.list | just credentials |
| Delete them | make agentcore.credentials.delete-all (every provider in the account) | just credentials-delete: only the ones this Loom recorded, gated |
| Inspect AgentCore memory | make agentcore.memory.list, get, records, records-by-namespace, extraction-jobs | just memory [query] [id] [who] |
Loom make targets has every operator target and how each verb differs from it.
Settings
Section titled “Settings”| Loom setting | Where | loomster |
|---|---|---|
AWS_PROFILE, AWS_REGION | common.sh | your AWS CLI configuration, AWS_REGION |
ACCOUNTID | common.sh | AWS_ACCOUNT_ID |
BUCKET (SAM artifacts) | common.sh | none: chant applies templates without a SAM bucket |
VPC_ID, PUBLIC_SUBNET_IDS, PRIVATE_SUBNET_IDS | common.sh | LOOM_VPC_ID, LOOM_PUBLIC_SUBNET_IDS, LOOM_PRIVATE_SUBNET_IDS |
PUBLIC_FQDN | common.sh | LOOM_DOMAIN_NAME |
RDS_ALLOWED_CIDR | common.sh | LOOM_DB_ALLOWED_CIDR |
COGNITO_POOL_NAME, COGNITO_DOMAIN | common.sh | derived from {project}-{env}-{instance} (Naming and tagging) |
LOOM_ARTIFACT_BUCKET | common.sh | created and named by shared-foundation |
LOOM_LOGGING_BUCKET | common.sh (required) | LOOM_LOGGING_BUCKET_NAME (optional) |
RDS_PASSWORD | common.sh | LOOM_DB_PASSWORD |
SUPER_ADMIN_PASSWORD, DEMO_USER_*_PASSWORD | common.sh | none: loomster creates no users |
P_TAG_OWNER | each environment.sh | LOOM_OWNER |
P_RDS_INSTANCE_CLASS, P_RDS_ALLOCATED_STORAGE | backend/ | LOOM_DB_INSTANCE_CLASS, LOOM_DB_ALLOCATED_STORAGE |
P_RDS_MULTI_AZ, P_RDS_ENABLE_PROXY | backend/ | the tier: Proxy on production, Proxy and Multi-AZ on production-ha |
P_ECS_BACKEND_CPU, _MEMORY, _DESIRED_COUNT, _MAX_COUNT | backend/ | LOOM_BACKEND_CPU, _MEMORY, _DESIRED_COUNT, _MAX_COUNT |
P_ECS_FRONTEND_CPU, _MEMORY, _DESIRED_COUNT | frontend/ | LOOM_FRONTEND_CPU, _MEMORY, _DESIRED_COUNT |
LOOM_ALLOWED_ORIGINS, LOOM_REGISTRY_ID | backend/ | the same names |
P_LITELLM_* | backend/ | LOOM_LITELLM_* |
P_INFRA_ALB_INGRESS_CIDR | shared/ | LOOM_ALB_INGRESS_CIDR |
P_AGENT_NAME, P_MEMORY_ARN, P_BEDROCK_MODEL_ARNS, P_ENABLE_CODE_INTERPRETER | shared/ (role) | LOOM_AGENT_ROLE_AGENT, _MEMORY_ARN, _BEDROCK_MODEL_ARNS, _CODE_INTERPRETER |
Every parameter is in Build parameters.
Behavior differences
Section titled “Behavior differences”- Defaults are smaller. Loom’s example runs three backend tasks, Multi-AZ RDS and an RDS Proxy. loomster sizes by tier: one backend task on light and production, two on production-ha; Multi-AZ only on production-ha.
- On the production tiers both services run in private subnets with no public IP; Loom’s example puts the frontend in public subnets.
- Images deploy by digest, not by git sha tag, and a failed service deploy rolls back to the previous task definition.
- Like Loom’s
podman.build.frontend, the frontend build passes the Cognito end-user client id, so the served app signs in on every tier. Loom’s pool creates demo users; loomster’s creates none, so you add the first admin yourself. The production tiers’ pool defaults to optional MFA, since the web app can’t answer an MFA challenge (Loom’s own pool leaves MFA off). - The tunnel host is optional and off until you run
just tunnel-host. The database Ops (import-sqlite,fix-sequences,reset-db) don’t need it: they run as one-off tasks of the backend inside the VPC. - Upgrades are an Op that snapshots first, and on the production tiers waits for approval (Upgrade Loom).
Bringing an existing Loom across
Section titled “Bringing an existing Loom across”- Users: point loomster at your existing pool with
LOOM_COGNITO_MODE=reference-existingand its ids, and every user and group stays (Share a Cognito pool). - Data: point
loom-dbat your existing database withLOOM_DB_MODE=reference-existing,LOOM_DB_ENDPOINTand the secret Loom’srds.yamlcreated (Bring your own KMS, ECR and database). Record its schema as the v1.9.0 baseline withjust db baseline, so later Loom versions arrive as reviewed migrations (Migrate Loom’s database). A Phase 1 Loom’sloom.dbcomes across withjust import-sqlite loom.db. - Agent roles: they keep working; register any Loom created on demand before v1.9.0 under Security > IAM roles.
Left out on purpose
Section titled “Left out on purpose”| Not here | In Loom | loomster’s rule | Do this instead |
|---|---|---|---|
| The 12 demo groups and 22 demo users | cognito.yaml, make cognito.set-passwords | it doesn’t invent an org structure or users | LOOM_COGNITO_RESOURCE_GROUPS_JSON and LOOM_COGNITO_DEMO_SEED_USERS_JSON, or reference your pool |
| SQLite | Phase 1 local development | every run, local included, uses Postgres | just local-up; bring a SQLite Loom’s data across with just import-sqlite |
| A laptop backend on cloud RDS | Phase 2 hybrid | the backend runs where its database is | just local-up, or a deployed tier |
make refresh-models on a running deploy | backend/makefile | the model list arrives with a Loom release | bump the pinned Loom (Upgrade Loom) |
make ci-role | shared/makefile, with a template Loom doesn’t ship | the generated pipelines’ own credentials (CI providers) | |
| Deleting every credential provider in the account | make agentcore.credentials.delete-all | another instance’s providers aren’t this one’s to delete | just credentials-delete |
- Deploy the light tier to AWS to try it on a scratch account first.
- Build parameters.