fix(aws/ec2): harden SecurityGroup reconcile + add lifecycle convergence tests

[sam-goodwin]

Harden the EC2 SecurityGroup reconciler against eventual-consistency races and rule drift, then add lifecycle convergence tests on top of ScratchStack.

Reconciler changes

-      const describeSecurityGroup = (groupId: string) =>
-        ec2.describeSecurityGroups({ GroupIds: [groupId] }).pipe(
-          Effect.map((r) => r.SecurityGroups?.[0]),
-          Effect.flatMap((sg) =>
-            sg
-              ? Effect.succeed(sg)
-              : Effect.fail(new Error(`Security Group ${groupId} not found`)),
-          ),
-        );
+      const retryEventuallyConsistent = <A, E, R>(
+        eff: Effect.Effect<A, E, R>,
+      ) =>
+        eff.pipe(
+          Effect.retry({
+            while: (e) =>
+              e?._tag === "InvalidGroup.NotFound" ||
+              e?._tag === "SecurityGroupNotVisible",
+            schedule: Schedule.exponential(100).pipe(
+              Schedule.both(Schedule.recurs(10)),
+            ),
+          }),
+        );
+      const describeSecurityGroup = (groupId: string) =>
+        retryEventuallyConsistent(
+          ec2.describeSecurityGroups({ GroupIds: [groupId] }).pipe(
+            Effect.flatMap((r) =>
+              r.SecurityGroups?.[0]
+                ? Effect.succeed(r.SecurityGroups[0])
+                : Effect.fail({
+                    _tag: "SecurityGroupNotVisible" as const,
+                    groupId,
+                  }),
+            ),
+          ),
+        );

Rule sync used to revoke every observed rule and re-authorize the desired set every reconcile. Replaced with a canonical-key diff (protocol + ports + source + description) so we only apply the delta:

-          if (currentIngress.length > 0) {
-            yield* ec2.revokeSecurityGroupIngress({ ... all observed ... });
-          }
-          if (news.ingress) {
-            yield* ec2.authorizeSecurityGroupIngress({ ... all desired ... });
-          }
+          const observedKeys = new Map(observed.map((r) => [canonicalRuleKey(...), r]));
+          const desiredKeys = new Map(desired.map((r) => [canonicalRuleKey(...), r]));
+          const toRevoke = [...observedKeys].filter(([k]) => !desiredKeys.has(k));
+          const toAuthorize = [...desiredKeys].filter(([k]) => !observedKeys.has(k));

read now searches by alchemy tag filters when state is missing, returns Unowned(attrs) for foreign-tagged SGs (gating adoption behind adopt(true)), and treats a vanished SG as undefined so the engine recreates it.

-        read: Effect.fn(function* ({ output }) {
-          if (!output) return undefined;
-          const sg = yield* describeSecurityGroup(output.groupId);
-          ...
+        read: Effect.fn(function* ({ id, output }) {
+          const sg = output?.groupId
+            ? yield* findSecurityGroup(output.groupId)
+            : (yield* ec2.describeSecurityGroups({
+                Filters: yield* createAlchemyTagFilters(id),
+              })).SecurityGroups?.[0];
+          if (!sg) return undefined;
+          ...
+          return (yield* hasAlchemyTags(id, tagRecord)) ? attrs : Unowned(attrs);

delete previously also matched e._tag === "ValidationError" && e.message?.includes("DependencyViolation"). That branch was dead — distilled tags DependencyViolation directly via withDependencyViolationError, so the substring match never fired and any real ValidationError was being swallowed silently. Drop it.

New lifecycle tests

• redeploy with same props is a no-op (reconcile is idempotent)
• reconcile resets ingress + egress rules mutated out-of-band
• reconcile re-creates an SG deleted out-of-band
• changing groupName triggers replace; old SG is deleted
• adding/removing/changing rules diffs against cloud state
• destroying an already-deleted SG is a no-op
• foreign-tagged SG requires adopt(true) to take over

Distilled patch

No patch needed — error categorization for SG flows (InvalidGroup.NotFound, InvalidPermission.NotFound, DependencyViolation) is already correct in distilled.

.worktrees/ joins .gitignore (matching the VPC hardening PR) so per-resource hardening worktrees stay untracked.

[alchemy-version-bot]

Install the packages built from this commit:

alchemy

bun add alchemy@https://pkg.ing/alchemy/df3833b

@alchemy.run/better-auth

bun add @alchemy.run/better-auth@https://pkg.ing/@alchemy.run/better-auth/df3833b

@alchemy.run/pr-package

bun add @alchemy.run/pr-package@https://pkg.ing/@alchemy.run/pr-package/df3833b

[alchemy-version-bot]

Website Preview Deployed

URL: https://alchemyeffectwebsite-worker-pr-222-eeeczzzx4ipb72uw.testing-2b2.workers.dev

Built from commit df3833b.

---

This comment updates automatically with each push.