Deployment

Deployment

Each path stands on its own. A judge who only wants to see Wick working needs the first or the second, not the rest. The authoritative guide is docs/SETUP.md; this page is the map.

Path	Needs	What you get
1. The hosted demo	A browser	The deployed stack, a demo home, a television in a browser tab, for quick testing only (judge Wick on the Vega or Fire OS simulator, or a Fire TV). See Try It.
2. Run the tests	Node 22	Every test, the type checks, the lint rules and the no-mocks guard.
3. Run it locally	Node 22	The family app and the real server on your laptop, with stand-ins for the television and the doorbell. See the Developer Guide.
4. The Vega app	The Vega SDK	Wick on the Vega Virtual Device, against the deployed stack.
5. The Fire OS build	Java 17, the Android SDK	Wick on the Android TV emulator, against the deployed stack.
6. Your own stack	An AWS account, Bedrock access, a Ring developer account	All of it, in your account.

Run it on a television simulator

Vega. Build the app with the Vega SDK, install the .vpkg on the Vega Virtual Device and launch it. It shows a pairing code; enter that in the family app. The simulator keeps no secret on disk, so pair it only to a demo home.

Fire OS. Build the same source for Android TV with Java 17 and the Android command-line tools, install the APK on an API 34 Android TV emulator and launch it. Pairing is the same.

Both are described step by step in docs/SETUP.md, sections 4 and 5, with the tricks that make the emulators behave.

Deploy your own stack

Every command runs from the repository root with AWS_PROFILE set. The order matters: each step needs what the one before made.

1. State bucket, once per account: infra/bootstrap/bootstrap.sh.
2. Build the Lambda bundles: npm ci && npm run build:lambda. Every plan and apply needs this first.
3. Initialise Terraform, then apply only the three image repositories and the two parameters that pin their tags. App Runner and AgentCore will not start without an image.
4. Push the images: scripts/push-agent-image.sh (arm64) and scripts/push-mcp-image.sh (amd64). After this, CI does it on every push to main.
5. Apply everything. The Wick server's address is baked into its OAuth metadata, so a new deployment starts with it empty.
6. Apply a second time with the Wick server's real address, and set it as the default.
7. Fill the secrets: Terraform makes the containers, and the bootstrap scripts put the Ring credentials, the pairing key and the push keys in them.
8. Link a Ring account for the operator household. A Playground token lasts about 30 minutes.
9. Upload the films the television plays.

The full commands are in infra/README.md.

Which changes need a laptop apply

CI's deploy role is deliberately narrow: it can change the stack but cannot widen itself or read a household's data. Apply from a laptop first when a change:

• adds an AWS service CI has never touched,
• changes the deploy role itself, or
• changes the spend brake or other IAM.

Before a laptop apply, bring the checkout up to date with main, export TF_VAR_alarm_email (an apply without it removes the alarm subscription), run terraform plan, read it, and apply the saved plan.

Release the Fire OS app

The release APK is signed with a key kept in a protected GitHub environment named release. Pushing a tag that starts with v runs the release job, which waits for a reviewer, checks that the APK is not signed with the debug key and attaches it to the tag's GitHub release. Every other build is signed with a throwaway key made on the runner. The setup is in docs/SETUP.md, section 6.1.1.

Roll back

Images are tagged with the commit and pinned in SSM Parameter Store, so a rollback is one pin: the earlier image tag is written back to its parameter and applied from a laptop. The command is in infra/README.md.