Agent Workspace v2.0.0

Breaking changes

• extra_env_vars and extra_env_var_parameter_names are removed. Use the new env_vars map instead: a null value creates an SSM placeholder, a path references an existing parameter.

Added

• Tag-driven scheduler. It manages any instance carrying a scheduler tag and reads the tag on every run: free-time follows the windows, on-demand keeps the instance on, disabled is ignored. Values are matched leniently.
• Cohorts: give windows a mode name to run different schedules from one deployment.
• scheduler_mode sets the starting mode; changes you make to the tag at runtime are kept.

Fixed

• The scheduler leaves an on-demand instance running, and leaves any instance running when its schedule cannot be evaluated.
• Multi-Region (mrk-) KMS key ARNs are accepted.
• AMI exports are written under the configured S3 prefix.
• The IMDSv2 hop limit is 2, so containerized agents can reach instance credentials.
• Subnet selection is deterministic, with a clear error when none is found.
• Daily snapshots cover the root volume only, matching the IAM grant.

Security

• The scheduler Lambda's IAM is scoped to instances tagged scheduler.
• Lambdas use active X-Ray tracing and KMS for environment variables; the instance is EBS-optimized. IaC security scans (Trivy, Checkov) pass.