Δ4 — Secured stateless poll endpoint (GET /solves/{id}/frames|stats|status)

[jack-champagne]

C1. A stateless, credential-scoped read API serving the newest frame (S3), the AMICODE_ITER stats (CloudWatch — runs already log there via CloudWatchOutputEnabled), and terminal status/result.toml (S3). No WebSocket/live-stream layer (locked: poll-on-demand).

Acceptance (TDD): polling returns the newest frame + parsed stats for an in-flight run and the terminal result.toml once FINISHED; a credential not matching the run's submitter → 403.

Depends on Δ3 (frames in S3).

⛔ Gate: blocked by the wk-3 freeze — run-dir contract + SchemaPackage v0 (amicode #15 + the #28–31 stack). RemoteExecutor/the S3 layout is the run-dir contract, so do not start until that lands.

📄 Refs: Spec armonissima/specs/spec-20260628-amicode-cloud-solve-service.md (Δ4) · phased plan §5a (plan-20260603-124231-amicode-phased-build) · aws-infra/INFRASTRUCTURE.md → The Analysis Pipeline (reuse step_function/ec2_launch_template/dynamodb/runner_image).

Evolve, not build — a working v0 (the aws-infra Analysis Pipeline) already does size→S/M/L EC2→julia→S3→email→terminate. Validate on staging (mirrors prod), then two-step promote.

🏗 Implementation repo: aws-infra (Terraform / lambda / Image Builder). Infra-side reference: harmoniqs/aws-infra#127.

[jack-champagne]

Freeze 1 resolution (d) — terminal is best-effort, resolution reliable: status must carry a liveness signal (instance state / DynamoDB task_status) so a box that dies without FINISHED resolves to an inferred terminal, not an infinite poll. Now in the cloud-solve-service spec (Δ4 + Locked decisions); #56/#32 build to it.

[jack-champagne]

Protocol note (post-#67; see #58): the frames this endpoint serves are pulse DATA records (parsed from run.log's AMICODE_PULSE), not PNGs — the client renders natively. GET …/frames returns the latest pulse record (+ AMICODE_PULSE_META once); …/stats the AMICODE_ITER row. This is on top of the resolution-(d) liveness requirement noted above.