Review checklist
Use each item to request and record evidence for the exact review target. No item below is pre-passed. Mark a result only after the relevant observation; explain a not-applicable decision. Keep AWS-owned review results separate.
Delivery and review handoff
AWS-01Exact image and release
Match the submitted version, regional AMI and installed manifest. Record missing delivery values as unresolved.
Basis: VibePackr manuals and the supplied release instructions
AWS-02Entitlement and review quantity
Verify the actual contract or supplied test entitlement and the number of concurrent VM units available for this review.
AWS-03Region, OS and sizing
Use the version's supported Region, architecture and sizing. Do not promote an untested candidate size to a minimum requirement.
AWS-23Usage, support and terms
Confirm the delivered instructions, support contact, applicable contract and refund terms. Do not infer a response-time SLA from this guide.
AWS-24AWS ingestion, scanning and decision
Record AWS-owned ingestion, scan and review results for the submitted version separately from the supplier's checks and reviewer conclusion.
Access and image security
AWS-04Network and administrative access
Confirm actual ports, restricted ingress and required outbound endpoints. Keep application access distinct from AWS scanner access.
AWS-05Instance role and IMDSv2
Check the supplied least-privilege role instructions and IMDSv2 requirement. Do not request static AWS access keys.
AWS-06Customer control and image hygiene
Review evidence that the image contains no baked credentials or seller access. Any support access is explicitly enabled by the customer.
AWS-07Supported software and scan findings
Review OS/package support and actual scan findings for the exact submitted image. A documentation checklist is not a security scan result.
First boot and customer setup
AWS-08Fresh first-boot identity
Verify that separately launched review VMs create their own installation state. Do not reuse initialized image state.
Basis: VibePackr manuals and the supplied release instructions
AWS-09Services and health result
Record first-boot/control-plane service results and the actual health output, including a failure exit code when present.
Basis: VibePackr manuals and the supplied release instructions
AWS-10Customer binding
Confirm customer_binding_state=BOUND independently of service liveness and licensing.
Basis: VibePackr manuals and the supplied release instructions
Licensing
AWS-11Active license admission
Observe aws_marketplace_license.state=ACTIVE on the intended VM. A health-script exit code alone is insufficient.
Basis: VibePackr manuals and the supplied release instructions
AWS-12Concurrent unit limit
Under an authorized test, verify that use beyond the actual entitlement quantity cannot admit new Work. Record both VM identities privately.
AWS-13Renewal and license loss
Use an approved redacted observation to check renewal and the refusal of new Work without valid authority. Do not collect consumption tokens.
Basis: VibePackr manuals and the supplied release instructions
AWS-14Replacement and lease expiry
Confirm the old VM has stopped and record actual replacement availability. Allow the current candidate's up-to-one-hour expiry window after its last successful renewal.
Work and evidence
AWS-15Customer identity and authority
Follow the supplied owner/bootstrap procedure and confirm permission for the selected operation separately from the software license.
Basis: VibePackr manuals and the supplied release instructions
AWS-16Supported runtime binding
Verify the release-supported runtime and its actual binding. Do not infer Bedrock or another adapter from general provider availability.
Basis: VibePackr manuals and the supplied release instructions
AWS-17One traceable authorized Work
Use approved input and one operation. Link its Work ID, output and evidence without publishing customer content.
Basis: VibePackr manuals and the supplied release instructions
AWS-18Validation, review and closure
Record product validation, human review, acceptance and closure distinctly. Do not infer acceptance from a file or a passed validation alone.
Basis: VibePackr manuals and the supplied release instructions
AWS-19Denied and interrupted operations
Record the actual refusal or interruption and its first error. Preserve the original Work identity; do not hide uncertainty with a duplicate run.
Basis: VibePackr manuals and the supplied release instructions
Operations and cleanup
AWS-20Consistent backup and restore
Test the supplied recovery procedure on approved disposable data. Check identity, binding and licensing again after a host change; a copied lease is not restoration authority.
Basis: VibePackr manuals and the supplied release instructions
AWS-21Upgrade and rollback scope
Verify only the documented version-specific upgrade/recovery path. Record untested rollback behavior as unresolved.
Basis: VibePackr manuals and the supplied release instructions
AWS-22Costs and residual resources
Account for instances, retained EBS volumes, snapshots and model calls. Verify the actual deletion/retention outcome against the agreed cleanup scope.
Basis: VibePackr manuals and the supplied release instructions
Review basis and sources
Vendor-authored review aid, checked against the linked AWS documentation on 2026-11-08. It is not an exhaustive AWS checklist or an AWS approval. Confirm current requirements for the actual submission.