Setup and customer lifecycle
Separate subscribing, connecting, and authorizing
A managed add-on should make setup understandable without hiding identity, retention, or action boundaries.
A subscription is not permission to access a customer AWS account.
Inspect readiness before sending data
The SDK candidate can discover bounded visible workspaces and inspect owner-only account and scope onboarding metadata. kam-history doctor is the read-only diagnostic; quickstart is the separate documented write path.
Account status distinguishes commercial observation, authorization freshness, lifecycle, and reconciliation health. A stale background check is neither cancellation nor permission to extend an expired grant. Effective deployed behavior remains a qualification requirement.
A bounded export is implemented
An authorized owner closes outcome ingress, waits for the captured lifecycle boundary, then requests an export session. Preserve exportId, scope, page order, pageHash, and the opaque returned cursor. Check session completion before using the export to authorize deletion.
The export is a closed-ingress operational view, not one atomic database snapshot across all pages. Source changes and authority changes have explicit behavior. The current limits are 32 registered scopes, ten records per page, and 512 KiB of page JSON.
Export, deletion, and restoration are different controls
Primary-state deletion and a separately retained restore fence are implemented. Simulated exact AgentCore erasure is distinct from a qualified live downstream deletion journey. Export success alone proves neither physical deletion nor backup erasure.
Live purchase, renewal, cancellation, grant-refresh outages, revocation timing, remote erasure, and backup restore drills remain separate qualification boundaries.
The purchasing channel is still planned
There is no live listing or one-click activation yet. SDK publication, native public distribution, support/fulfillment, commercial terms, and live production qualification are not implied by source implementation. An evaluation request does not subscribe you or grant AWS access.