# loomster > A deployment of awslabs/loom on chant: six components, three tiers, a local stack on Floci, gated lifecycle Ops and generated CI. ## Start here - [Architecture](https://intentius.io/loomster/concepts/how-it-works/): The six components loomster deploys Loom as, the order they deploy in, how values pass between them, and what runs around them. - [Run Loom locally](https://intentius.io/loomster/getting-started/): Bring up a browsable Loom on your laptop with one command, log in through a real Cognito flow on Floci, and check every screen, with Docker and no AWS account. ## Tutorial - [Browse Loom on your laptop](https://intentius.io/loomster/tutorial/): Tutorial step 1. Bring Loom up on Floci, walk the screens the demo seed fills, and check them with the validation harness, with no AWS account. - [Deploy the light tier to AWS](https://intentius.io/loomster/tutorial/light-on-aws/): Tutorial step 2. Deploy the cheapest real Loom to an AWS account with one command, seed it, validate every screen behind real Cognito, and tear it down. - [Run your first Ops](https://intentius.io/loomster/tutorial/operate/): Tutorial step 4. Back up a deployment, prove the backup restores without touching the live database, check for drift, and see how a gated Op stops for approval. - [Go to production](https://intentius.io/loomster/tutorial/production/): Tutorial step 3. What the production tiers add over light, the network and domain they need from you, and the deploy that brings them up. ## Your setup - [With a coding agent](https://intentius.io/loomster/for/agents/): For a person who works through a coding agent, and for the agent: the skill file, the page prompts, llms.txt, and the limits the repository enforces. - [Evaluate for your org](https://intentius.io/loomster/for/evaluate/): For a platform team deciding whether to run Loom: what loomster deploys and proves, how it fits an organization's accounts and identity, what it costs, and what it leaves to you. - [On call](https://intentius.io/loomster/for/on-call/): For whoever is paged for a Loom deployment: the Ops and runbooks for backup and restore, rotation, upgrade, drift, lockouts and teardown, and what each one changes. - [Platform team](https://intentius.io/loomster/for/platform-team/): For the team that will run Loom for others: adopting your own network, identity and roles, running several deployments, wiring CI, and keeping the code in step with Loom releases. - [Security review](https://intentius.io/loomster/for/security/): For a security reviewer: the IAM roles and what each can reach, the network paths, who sees what inside Loom, what each CI job and Op touches, and the proof behind it. - [Try it](https://intentius.io/loomster/for/try-it/): For someone who wants to see Loom running: what works on a laptop, what differs from AWS, the first command, and what to read next. ## Coming from - [Coming from the AgentCore starter toolkit](https://intentius.io/loomster/guides/coming-from-agentcore-starter-toolkit/): What Loom adds on top of an agent you deploy with the Bedrock AgentCore starter toolkit, how the toolkit's commands map to Loom's screens and API, and where your own agents fit. - [Coming from CDK, SAM or CloudFormation](https://intentius.io/loomster/guides/coming-from-cdk-or-sam/): The CDK, SAM and CloudFormation commands and concepts you know, what does the same job in loomster's chant source, and what works differently. - [Coming from Terraform, Terragrunt or Pulumi](https://intentius.io/loomster/guides/coming-from-terraform-or-pulumi/): The Terraform, Terragrunt and Pulumi commands and concepts you know, what does the same job in loomster, and what changes when CloudFormation holds the state. - [Coming from Loom's SAM deploy](https://intentius.io/loomster/guides/coming-from-upstream-loom/): Each make target and etc/environment.sh setting in Loom's own SAM deploy, what does the same job in loomster, what behaves differently, and how to bring an existing Loom's users and database across. ## Proof - [Claims](https://intentius.io/loomster/reference/claims/): One check per documented capability, each with a BREAK mode that proves it can fail, and the human gate in front of the ones that deploy. - [Validation](https://intentius.io/loomster/reference/validation/): What has been shown to work, on which tier and target, by which recorded claim or end-to-end run, and what nothing has shown yet. The one status page for loomster. ## How-to guides - [Add CI to your forge](https://intentius.io/loomster/guides/add-ci-to-your-forge/): Generate the component pipeline for GitHub, GitLab or Forgejo from loomster's component graph, keep it in step with the graph, give its jobs a runner, and turn on the gated deploy. - [Add the first admin](https://intentius.io/loomster/guides/add-the-first-admin/): Create the first user in a deployed Loom's Cognito pool, put it in the admin groups, and sign in to the web app. - [Back up and restore](https://intentius.io/loomster/guides/back-up-and-restore/): Take and copy RDS backups, export Cognito users, prove a backup restores with the drill, and restore the database from a snapshot or a point in time with a gated cutover. - [Bring your own everything](https://intentius.io/loomster/guides/bring-your-own-everything/): Build the src/examples/byo example, which sets every seam to reference-existing against one set of platform-owned resources with no change to any composite, and use it as the template for your own. - [Bring your own KMS, ECR and database](https://intentius.io/loomster/guides/bring-your-own-kms-ecr-and-database/): Point loomster at a KMS key, ECR repositories and a Postgres endpoint you already run, or leave the key and repositories out, through build parameters. - [Bring your own network and IAM](https://intentius.io/loomster/guides/bring-your-own-network-and-iam/): Deploy Loom into a VPC and subnets your platform team owns, hand over existing IAM roles for the backend, frontend and agents, and run behind a TLS-inspecting proxy. - [Create an execution role per agent](https://intentius.io/loomster/guides/create-an-execution-role-per-agent/): Deploy one agent's AgentCore execution role the way Loom's role.yaml does, scoped to that agent's credential providers, and register it in Loom tagged into the group that deploys the agent. - [Deploy to production on AWS](https://intentius.io/loomster/guides/deploy-to-production/): The runbook for putting the production or production-ha tier on a real AWS account, from DNS delegation and the network through the deploy to an authenticated validation, plus the scripted end-to-end run. - [Deploy without chant](https://intentius.io/loomster/guides/deploy-without-chant/): Export loomster's synthesized CloudFormation templates and generated CI per tier as a plain directory, and deploy them with the AWS CLI or your own pipeline. - [Drive loomster with an agent](https://intentius.io/loomster/guides/drive-with-an-agent/): Hand loomster to a coding agent with the skill file, chant's MCP server, the page prompts and llms.txt, and what the agent can and can't do without a person. - [Estimate cost](https://intentius.io/loomster/guides/estimate-cost/): Run Infracost against each synthesized component template for a per-component monthly estimate, locally or on a weekly schedule, with a skip notice when Infracost isn't set up. - [Migrate Loom's database](https://intentius.io/loomster/guides/migrate-the-database/): Hand Loom's Postgres schema to SQL Yodeler, record the v1.9.0 baseline on a deployment, and apply each Loom version's reviewed migration behind a plan-bound approval before the backend rolls. - [Open a tunnel to the database](https://intentius.io/loomster/guides/open-a-tunnel-to-the-database/): Deploy the optional SSM tunnel host (Loom's ec2.yaml) and port-forward localhost to the RDS Proxy with Session Manager, Loom's make tunnel. - [Recover from an IdP lockout](https://intentius.io/loomster/guides/recover-from-an-idp-lockout/): Get back into a Loom whose login page an identity provider took over, by calling Loom's API with a Cognito token and deleting or deactivating the provider. - [Rotate credentials](https://intentius.io/loomster/guides/rotate-credentials/): Rotate the Cognito machine-to-machine client, the RDS credential and the ALB's certificate on a production tier with the gated rotation Op, switching consumers over before the old credentials are removed. - [Run a second deployment](https://intentius.io/loomster/guides/run-a-second-deployment/): Stand up another Loom in the same AWS account, or another one, without collisions by giving it a different instance or env, and tear one down without touching the other. - [Work with the local stack](https://intentius.io/loomster/guides/run-locally-in-depth/): What runs in the local Floci stack and what is a stand-in, how to call Loom's API from a shell, how the local login reaches Floci's Cognito through a small Loom patch, and how the stack is wired. - [Seed and validate a deploy](https://intentius.io/loomster/guides/seed-and-validate/): Register what loomster provisioned into a fresh Loom through its API with the loom-seed Op, choose a seed profile, and check every screen with the validation harness. - [Set up a custom domain](https://intentius.io/loomster/guides/set-up-a-custom-domain/): Serve a production-tier Loom on your own domain over HTTPS by referencing an existing Route53 zone and certificate, letting loomster create them, or dropping the domain. - [Share a Cognito pool](https://intentius.io/loomster/guides/share-a-cognito-pool/): Point one or many Loom instances at a Cognito pool your organization already runs, so users, groups and scopes are defined once and every instance honors them. - [Tear down a deployment](https://intentius.io/loomster/guides/tear-down/): Delete one deployment's stacks with the gated teardown Op, then remove what it keeps on purpose, and get past the snags a production teardown hits. - [Turn on scheduled Ops](https://intentius.io/loomster/guides/turn-on-scheduled-ops/): Turn on the inert GitHub Actions workflows that run drift watch, reconcile, backup, the restore drill, the cost report and the CI audit on a schedule. - [Upgrade Loom](https://intentius.io/loomster/guides/upgrade-loom/): Move the pinned Loom release, run the tier's upgrade Op, which snapshots the database and rolls the backend and frontend, and run the one-time scripts and manual steps a release needs, including v1.6 to v1.9. - [Watch and reconcile drift](https://intentius.io/loomster/guides/watch-and-reconcile-drift/): Compare every stack with the live account on demand or on a schedule, and turn drift into a pull request that brings the source in line, for chant-owned resources only. ## Reference - [Adoption seams](https://intentius.io/loomster/reference/adoption-seams/): Every seam in loomster's composites, its modes, its default, and what replacing it needs, in one table. - [CI providers](https://intentius.io/loomster/reference/ci/): The generated component pipeline and the deploy and scheduled workflows on GitHub, GitLab and Forgejo, what each file is, how it is checked, and the variables that turn each workflow on. - [Components](https://intentius.io/loomster/reference/components/): Each component stack loomster deploys, its dependencies, the phases chant runs for it, the stack name it gets and the outputs it hands to the stacks after it. - [Cost](https://intentius.io/loomster/reference/cost/): What costs money in each tier of a loomster deployment, what keeps costing after a teardown, which seed and claim steps are billable, and how to estimate it. - [Local caveats](https://intentius.io/loomster/reference/local-caveats/): How the local (Floci) run diverges from real AWS. Read this before you trust anything the local tier shows you. - [Loom make targets](https://intentius.io/loomster/reference/make-targets/): Each operator target in Loom's backend and shared makefiles, and the loomster verb or chant Op that does the same job. - [Naming & Tagging](https://intentius.io/loomster/reference/naming/): How every Loom composite derives its physical resource names and cost-allocation tags from one shared parameter source. Segment order, per-service length/char limits, uniqueness strategy, and lint enforcement. - [Ops](https://intentius.io/loomster/reference/ops/): Every lifecycle Op in ops/, what it does, whether it stops at an approval gate, the inputs it reads, and how to run it. - [Build parameters](https://intentius.io/loomster/reference/parameters/): Every build parameter chant.config.ts declares, the LOOM_ environment variable that sets it, its type and default, and what it changes. - [Screens](https://intentius.io/loomster/reference/screens/): Every Loom v1.9.0 screen after a loomster deploy, what backs it, what each seed profile puts there, what stays empty on purpose, and the validation check that holds it. - [Security](https://intentius.io/loomster/reference/security/): The IAM roles loomster creates and what each can reach, the network paths into and inside a deployment, who can see what in Loom, and what each CI workflow and Op touches. - [Tiers and targets](https://intentius.io/loomster/reference/tiers/): What differs between the light, production and production-ha tiers, how a target (Floci or real AWS) is chosen, and the recovery targets of each tier. - [Changes on Loom v1.9.0](https://intentius.io/loomster/reference/whats-new/): What changed in loomster since it moved to Loom v1.9.0 and chant 0.124, for someone who deployed an earlier loomster. ## Concepts - [Provision, reference or omit](https://intentius.io/loomster/concepts/adoption-seams/): Why every replaceable piece of loomster's infrastructure takes provision, reference-existing or omit through parameters, so a team adopts Loom without forking a composite. - [Gated Ops](https://intentius.io/loomster/concepts/gated-ops/): How loomster's lifecycle Ops run, why the destructive ones stop at an approval gate recorded on the chant/lifecycle branch, and how they are triggered. - [Glossary](https://intentius.io/loomster/concepts/glossary/): The loomster, chant and Loom words these pages use, each in a sentence or two with a link to where it is explained in full. - [Tiers and instances](https://intentius.io/loomster/concepts/tiers-and-instances/): The two independent settings behind every loomster deployment, tier for the size of one Loom and instance for which Loom it is, and the single-boundary and multi-boundary topologies they give. - [Stateful resources](https://intentius.io/loomster/concepts/what-holds-state/): Which parts of a Loom deployment hold data a redeploy can't bring back, and what protects each of them. - [Choosing chant](https://intentius.io/loomster/concepts/why-chant/): What loomster gets from writing Loom's infrastructure in chant instead of Loom's own SAM templates and makefiles, and what stays plain CloudFormation either way.