AWS

• net.ts is the mrlynet-site Lambda: a deploy from the desk wakes it, it builds main and pushes what changed.
• The event is { source, repo, sha }; source is one of push, schedule, automator, manual, and any other word reads as none.
• repo says what moved: mrlyprod/mrlyprod is this repo, the slug in SHELF_REPO is a research-shelf change and rebuilds against the current main, any other slug is ignored.
• SHELF_REPO is an owner/repo in the Lambda env; empty means no shelf, and then nothing is fetched or mounted at MRLY_SHELF.
• A sha without a repo is never trusted; with no trusted sha it falls back to the ETag poll, which is what the hourly safety-net schedule sends.
• A wake for a sha already built is a no-op, unless a line of build/net/head is still empty and the build never finished.
• build/net/head in mrlydev is four lines: source sha, source etag, shelf sha, shelf etag. Every GitHub and codeload fetch retries three times, 1s, 3s, 9s.
• The build installs site with --frozen-lockfile, runs scripts/pkg.ts and then bun run push there.
• net.test.ts covers the payload parser: bun test aws/net.test.ts.
• s3.ts is the S3 client it shares with site/scripts/pkg.ts and push.ts: credentials from the environment, no SDK.
• The Lambda never runs cargo: scripts/wasm.sh only builds pkg/.
• Bundled with bun build aws/net.ts --target=bun into one handler.js; the infrastructure console lives outside this repo.