The Trinity Beast — Kiro Command Center (KCC)

health

Checks all services — LPO health, LRS health, and cluster stats (3/3 nodes reporting). This is the first command run after every ECS deployment.

bash scripts/kcc.sh health

# Output:
# LPO:  ✅ [LPO] [us-east-2] [BeastMirror] [/health] [200]
# LRS:  ✅ [LRS] [us-east-2] [BeastLRS] [/health] [200]
# Cluster: Nodes: 3/3
#   BeastMain: published 2026-04-26T19:04:29Z
#   BeastMirror: published 2026-04-26T19:04:29Z
#   BeastLRS: published 2026-04-26T19:04:28Z

sync-check

Verifies the last nightly sync job ran successfully. Pulls the most recent log stream from CloudWatch (/aws/ecs/trinity-beast-sync) and displays run time (EST), completion status, duration, cache totals, and per-category sync counts (price logs, usage logs, API keys, app params, cleanup). Run this every morning right after health.

bash scripts/kcc.sh sync-check

# Output:
# Run Time:   April 28, 2026 at 01:00 AM EST
#
# Status:     ✅ Sync complete
# Duration:   186.909018ms
# Cache:      3285260 logs in Cache
#
# Sync Results:
#   Price logs:    72 new logs loaded
#   Usage logs:    19 entries written to Cache
#   API keys:      2 keys written to Cache
#   App params:    60 params written to Cache
#   Cleanup:       🟢 Pruned 0 old logs (>93 days)

verify

Hits 16 key endpoints (6 public + 10 admin) and reports the HTTP status code for each. Used after major changes to confirm nothing is broken.

bash scripts/kcc.sh verify

# Output:
# Public Endpoints:
#   ✅ GET /health (LPO) — 200
#   ✅ GET /health (LRS) — 200
#   ✅ GET /exchanges — 200
#   ✅ GET /asset-categories — 200
#   ...
# Admin Endpoints:
#   ✅ GET /admin/config — 200
#   ✅ GET /admin/cluster-stats — 200
#   ...

cluster-stats

Returns the full cluster-wide metrics snapshot — all 24 counters aggregated across all 4 containers via ElastiCache pipeline read.

bash scripts/kcc.sh cluster-stats

payment-links

Shows all 16 payment links with their enabled status, click counts, and Stripe URLs. Used to verify link configuration before and after Stripe setup.

bash scripts/kcc.sh payment-links

# Output:
# Total: 16 links
# Type            Tier                 Enabled    Clicks   URL
# subscription    pro                  ✅          42       https://buy.stripe.com/xxx...

feed-status

Shows the connection status of all 6 exchange WebSocket feeds with subscription counts and stale asset counts.

bash scripts/kcc.sh feed-status

# Output:
# coinbase_ws     ✅ Connected          Subs: 12  Stale: 0
# bitstamp_ws      ✅ Connected          Subs: 12  Stale: 0
# kraken_ws       ✅ Connected          Subs: 12  Stale: 0
# gateio_ws       ✅ Connected          Subs: 12  Stale: 0
# cryptocom_ws        ✅ Connected          Subs: 12  Stale: 0
# okx_ws          ✅ Connected          Subs: 12  Stale: 0

deploy-ecs

Full ECS deployment pipeline — Docker build (no-cache), ECR tag, ECR push, force deploy all 4 services. The most common deployment command.

bash scripts/kcc.sh deploy-ecs

# Builds → Tags → Pushes → Force deploys main, mirror, LRS
# Then: bash scripts/kcc.sh health (after ~40s)

deploy-site <file(s)>

Uploads HTML files to S3 and invalidates CloudFront. Automatically strips the cpmp-redesign/ prefix to determine the S3 path.

bash scripts/kcc.sh deploy-site cpmp-redesign/docs/Trinity-Beast-API-Reference.html
bash scripts/kcc.sh deploy-site cpmp-redesign/subscribe-listener.html cpmp-redesign/docs/index.html

profiles

Lists all 16 system profiles with their key parameters (QPS, burst, TTL, DB pool size).

bash scripts/kcc.sh profiles

config

Shows the current application parameters — cache TTL, prewarm intervals, pool sizes, demo key, etc.

bash scripts/kcc.sh config

daily-collect

Collects all infrastructure metrics (endpoints, feeds, cluster, Valkey, Lambda, sync, SQS queue, website analytics) and stores them as a single JSON blob in Valkey (kcc:daily key, 24h TTL). This is the data source for both the CLI daily command and the KCC Live Dashboard.

bash scripts/kcc.sh daily-collect

daily

Renders the compact daily status dashboard from the Valkey cache. If no cached data exists, it auto-runs daily-collect first. Shows services, ECS nodes, Valkey health, Lambda, nightly sync, SQS queue depth, and 7-day website analytics.

bash scripts/kcc.sh daily

# Output:
# ════════════════════
#  KCC — May 02 02:11PM EDT
# ════════════════════
# ─── Services ───
# ✅ LPO  ✅ LRS  ✅ Web
# Cluster: 3/3
# ─── SQS Usage Queue ───
# ✅ Pending: 0  In-flight: 0
# ─── Website (7d) ───
# Total 14,250 2.2GB  Avg 2,035/day

security

Security dashboard — CloudFront WAF (24h blocks), API WAF (per-rule breakdown), GuardDuty threat detection, CloudWatch security alarms, and application rate limiting stats.

bash scripts/kcc.sh security

force-deploy

Reloads all application parameters from Aurora → local cache + ElastiCache, re-parses prewarm asset lists, flushes prices, and resets all timers across all containers. Use after changing application_parameters in the database.

bash scripts/kcc.sh force-deploy

prewarm-audit

Validates all 360 prewarm assets across 6 exchanges against their live APIs, in 5 layers (live-price check, EAM↔legacy-param drift, master-list sync, an end-to-end smoke test, and category hygiene). Reports any dead/delisted assets that need replacement. Run periodically — exchanges delist and rebrand assets more often than expected.

bash scripts/kcc.sh prewarm-audit

# Output:
# ✅ COINBASE   26/26 OK
# ✅ CRYPTOCOM  24/24 OK
# ✅ GATEIO     24/24 OK
# ✅ BITSTAMP   29/29 OK
# ✅ KRAKEN     26/26 OK
# ✅ OKX        36/36 OK

sync-icons

Fetches the top 750 coins by market cap from CoinGecko's free API, matches by symbol against enabled EAM assets, and populates icon_url for any asset missing one. Icons are served to subscribers via the /asset-categories response and displayed in the demo dropdown.

bash scripts/kcc.sh sync-icons

# Output:
#   Mode: Fill missing icons only
#   Assets needing icons: 37
#   Fetching CoinGecko market data...
#     Page 1/3... 250 coins
#     Page 2/3... 250 coins
#     Page 3/3... 250 coins
#   CoinGecko unique symbols: 712
#   Matched: 28 | Still missing: 9
#   Writing 28 icon URLs to Aurora... ✅ 28 rows updated (42ms)

# Use --force to overwrite all existing icon URLs:
bash scripts/kcc.sh sync-icons --force

build-search

Rebuilds the multi-lingual full-text search index from all 32 documents across 12 languages (384 total) plus daily operations reports (English only, 30-day rolling archive). Fetches each doc from CloudFront, parses HTML into sections, and stores per-language indexes in Valkey. Run after deploying new or updated documents. The nightly sync also triggers this automatically.

Search features: Paginated results (9 per page), multi-lingual scoring, daily report indexing, and an interactive Search Demo showing the English → Japanese flow.

bash scripts/kcc.sh build-search

push-langs

Pushes all 12 language JSON files from cpmp-redesign/lang/ to Valkey (lang:{code} keys). The i18n system's primary source is the API (/public/lang/{code}), which reads from Valkey. If language files are edited locally and deployed to S3 but NOT pushed to Valkey, the API serves stale data and new i18n keys won't appear on the website. Run after any edit to language JSON files.

bash scripts/kcc.sh push-langs

push-impact-messages

Pushes the impact messages JSON (cpmp-redesign/data/impact-messages.json) to S3 and Valkey (impact:messages key). These are the localized donation impact messages used by the receipt Lambda (12 languages × 10 impact types). Run after editing any impact message text. The BeastReconciler also refreshes this nightly from S3.

bash scripts/kcc.sh push-impact-messages

email-queue

Shows the current state of the email queue (trinity-beast-email-queue): messages waiting, messages in-flight, and optionally peeks at the oldest message. Useful for verifying the email-sender Lambda is draining correctly or debugging delivery delays.

bash scripts/kcc.sh email-queue

# Output:
# ═══════════════════════════════
#  Email Queue Status
# ═══════════════════════════════
#   Messages waiting:    0
#   Messages in-flight:  0
#   ✅ Queue is empty (emails delivered)

email-send <to> <subject> <body-file>

Manually enqueues an email message to the email queue for delivery by the email-sender Lambda. Useful for testing the SQS → SES pipeline or sending one-off operational emails through the standard delivery path.

bash scripts/kcc.sh email-send "user@example.com" "Test Subject" /tmp/email-body.html

delta-validate <doc>

Validates that TBI-CHUNK markers are preserved through the translation reassembly pipeline for a given document. Checks that chunk count in the source matches chunk count in the reassembled output. Run before submitting a document to the translation engine to confirm chunk integrity.

bash scripts/kcc.sh delta-validate Trinity-Beast-API-Reference.html

# Output:
# Source chunks:  12
# Output chunks:  12
# ✅ Chunk markers preserved — safe to submit

chunk-size <doc>

Scans a document and reports the size of each chunk between TBI-CHUNK markers. Flags any chunks that exceed the translation engine's size policy (15 KB baseline, 18 KB max, 12 KB for dense/code-heavy sections). Also suggests where to add new markers if any chunk is over-limit. Run before submitting large or recently updated documents to the translation engine.

bash scripts/kcc.sh chunk-size cpmp-redesign/docs/Trinity-Beast-API-Reference.html

# Output:
# Chunk 1:  11.2 KB  ✅
# Chunk 2:  14.8 KB  ✅
# Chunk 3:  17.1 KB  ⚠️  approaching limit
# Chunk 4:   9.3 KB  ✅
# Chunk 5:  19.4 KB  🛑  OVER LIMIT — add TBI-CHUNK near line 412

trace-ip <ip_address>

Forensic trace of an IP address — WAF blocks (last 24h sampled requests) and usage logs from Aurora. Shows what the IP was doing and whether WAF caught it.

bash scripts/kcc.sh trace-ip 45.148.10.247

trace-key <api_key_id>

Forensic trace of an API key — owner details (email, name, tier), recent activity (last 50 calls), and unique IPs used.

bash scripts/kcc.sh trace-key demo-public-2026-03-01-abc123

trace-email <email>

Full account trace — user account, API keys, transactions, and support tickets for an email address.

bash scripts/kcc.sh trace-email user@example.com

threat-log

Shows WAF blocks by rule (last 24h) and GuardDuty findings (severity ≥ MEDIUM). Quick threat visibility without the full security dashboard.

bash scripts/kcc.sh threat-log

threat-status

Current defense posture — manually blocked IPs (WAF IP set) and any firing CloudWatch alarms.

bash scripts/kcc.sh threat-status

block-ip <ip_address>

Adds an IP to the WAF block list (trinity-beast-blocked-ips IP set). Creates the IP set if it doesn't exist. Immediate effect — all requests from this IP get 403.

bash scripts/kcc.sh block-ip 1.2.3.4

unblock-ip <ip_address>

Removes an IP from the WAF block list.

bash scripts/kcc.sh unblock-ip 1.2.3.4

kill-key <api_key_id>

Immediately revokes an API key — sets status to 'revoked' in Aurora and deletes the cached key from ElastiCache. All subsequent requests with this key get 403 Forbidden.

bash scripts/kcc.sh kill-key abc123-compromised-key

warn-subscriber <api_key_id> "reason"

Sends a threat warning email to the subscriber who owns the specified API key. Uses the ThreatWarning SES template. Does not revoke the key — this is a first-strike warning.

bash scripts/kcc.sh warn-subscriber abc123-key "Unusual request patterns detected from your API key"

terminate-subscriber <api_key_id> "reason"

Full subscriber termination — revokes key, cancels Stripe subscription (prorated refund), blocks all source IPs, and sends termination notice via SES. Irreversible. Generates a violation ID for audit trail.

bash scripts/kcc.sh terminate-subscriber abc123-key "Repeated abuse after warning"

rotate-admin-key

Generates a new admin key, updates Aurora application_parameters, flushes the old key from Valkey, force-deploys params to all containers, and self-updates the KCC script. The old key is immediately invalid. Use when the admin key may be compromised.

After rotation, only 2 files need manual update: ume.py (Python canonical source) and the steering file. All 14 helpers and legacy scripts inherit automatically. See Section 3 — Credential Centralization for the full propagation map.

bash scripts/kcc.sh rotate-admin-key

# Output:
# Old key: tbcc-admin-ec...e380
# New key: tbcc-admin-7f3a...b291
# [1/4] Updating Aurora application_parameters...
# [2/4] Flushing old key from Valkey...
# [3/4] Force deploying params to all containers...
# [4/4] Updating KCC script with new key...
# ✅ Admin key rotated successfully
#
# Post-rotation (manual):
#   1. Update ume.py fallback value
#   2. Update kiro-command-center.md steering
#   3. Update 6 Lambda env vars (aws lambda update-function-configuration)
#   4. Update 2 ECS task definitions (sync job + translate worker)

lockdown-admin <your_ip>

Creates a WAF rule (priority 0 — highest) that blocks ALL /admin/* requests unless they originate from the specified IP. Emergency use — locks out everyone except you. To find your IP: curl -s ifconfig.me

bash scripts/kcc.sh lockdown-admin 73.42.156.89

# Only 73.42.156.89 can now reach /admin/* endpoints
# All other IPs get blocked at WAF before reaching the server

unlock-admin

Removes the admin lockdown WAF rule, restoring normal admin access for all authenticated requests.

bash scripts/kcc.sh unlock-admin

block-country "<country_codes>"

Adds a geo-match WAF rule to the ALB that blocks ALL traffic from specified countries (ISO 3166-1 alpha-2 codes). Idempotent — running again replaces the previous list. Use during sustained regional attacks.

bash scripts/kcc.sh block-country "RU CN"
bash scripts/kcc.sh block-country "RU CN IR KP"

unblock-country

Removes the country geo-block rule entirely, allowing all geographic traffic.

bash scripts/kcc.sh unblock-country

admin-tier-reset <email> <target_tier> [options]

Resets a customer's API key tier with full history tracking. Applies rate_limit_template values for the target tier, resets monthly usage to 0, and invalidates the API key cache across all ECS nodes. The stripe_customer_id is preserved so dashboard login continues to work.

# Basic tier reset (no refund)
bash scripts/kcc.sh admin-tier-reset customer@email.com free

# With full refund of most recent charge
bash scripts/kcc.sh admin-tier-reset customer@email.com free --refund

# With partial refund ($50)
bash scripts/kcc.sh admin-tier-reset customer@email.com free --refund-amount 50.00

# Specify which key (if customer has multiple)
bash scripts/kcc.sh admin-tier-reset customer@email.com free --key-id bb1fdafb-a009-...

Valid tiers: free, pro, enterprise, unlimited, lifetime

Options:

• --key-id <uuid> — Specify which key (required if customer has multiple non-translation keys)
• --refund — Issue a full refund of the most recent Stripe charge
• --refund-amount <N.NN> — Issue a partial refund (in dollars)

What it does (in order):

1. Looks up all non-revoked, non-translation keys by email
2. Shows current state vs target state (interactive confirmation)
3. If --refund: issues Stripe refund via POST /admin/refund — customer receives refund email automatically
4. Records tier change in tier_change_history (source: admin-tier-reset)
5. Updates tier + rate limits from rate_limit_template
6. Resets current_usage to 0
7. Invalidates API key cache (immediate effect)

What it preserves: stripe_customer_id (dashboard login), the API key string itself, user_id (account association), and all historical data.

release-notes "<note>"

Appends a release note to the weekly accumulator in Valkey (autoops:release-notes:week). These notes are read by the digest Lambda on Monday morning and included as a "What's New" section in the weekly subscriber newsletter. Run at the end of each session to capture subscriber-facing improvements.

bash scripts/kcc.sh release-notes "Branded HTML email notifications for all AutoOps alerts"

# Output:
# ✅ Release note added (#3 this week)
#    Branded HTML email notifications for all AutoOps alerts

release-notes-show

Shows all accumulated release notes for the current week. Use to review what will appear in Monday's newsletter.

bash scripts/kcc.sh release-notes-show

# Output:
# 1. [2026-05-10] Branded HTML email notifications via SES
# 2. [2026-05-10] SNS-to-Lambda notification pipeline
# 3. [2026-05-10] Weekly newsletter Gmail-compatible dark theme
#
# Total: 3 notes

release-notes-clear

Clears all accumulated release notes. Done automatically after the weekly newsletter sends successfully. Manual use only needed if you want to start fresh mid-week.

bash scripts/kcc.sh release-notes-clear

stripe-events [--type T] [--limit N] [--failed]

Lists recent Stripe events with type, ID, and timestamp. Filterable by event type (supports wildcards like customer.subscription.*), result count, and delivery status. Defaults to last 15 events.

bash scripts/kcc.sh stripe-events --type charge.refunded --limit 5

# Output:
#   ID                             Type                       Created
#   ----------------------------- ----------------------- -------------------
#   evt_3TuExsAM8MECeobB0olAbqXO   charge.refunded          07/17 12:50 PM
#   evt_3TuEw7AM8MECeobB2Ex9TNai   charge.refunded          07/17 12:48 PM
#   Total: 2 events shown

stripe-event <event_id>

Shows full details of a Stripe event — type, timestamp, mode (test/live), API version, pending webhooks, object summary (ID, status, customer, amount, subscription), and metadata.

bash scripts/kcc.sh stripe-event evt_1TuF8QAM8MECeobBhajm1tnT

# Output:
#   Type:             customer.subscription.updated
#   Created:          2026-07-17 01:01:14 PM EST
#   Mode:             🧪 TEST
#   ─── Object Summary ───
#   ID                   sub_1TuF8LAM8MECeobBnvuXZvh8
#   Status               active
#   Customer             cus_Uu3ETfHHwcRs3G

stripe-replay <event_id>

Resends a Stripe event to the webhook endpoint (receipt.cpmp-site.org/webhook) and tails the receipt Lambda logs for 15 seconds. Shows event details first so you confirm what you're replaying before it fires.

bash scripts/kcc.sh stripe-replay evt_3TuExsAM8MECeobB0olAbqXO

# Output:
# ─── Event Details ───
#   Type:    charge.refunded
#   Created: 2026-07-17 12:50 PM
#   Mode:    🧪 TEST
#   amount: $1.00
# ─── Resending to Webhook ───
#   ✅ Event resent successfully
# ─── Lambda Logs (tailing 15s) ───
#   2026/07/17 18:28:54 [us-east-2|ReceiptLambda|Lifecycle] 🟡 Refund event has no customer ID — skipping

Use cases: testing receipt Lambda after a deploy, debugging failed deliveries, re-triggering emails, verifying plan-switch or refund handling end-to-end.

doc-publish <file> --reason "what changed"

Deploys an English document to S3, invalidates CloudFront, updates the doc registry in Valkey, queues for translation, and triggers a search index rebuild. One command handles the entire publish pipeline.

bash scripts/kcc.sh doc-publish Trinity-Beast-API-Reference.html --reason "Added EAM endpoints"

session-close <N> "<summary>"

Finalizes a session report — uploads to S3, appends to the session log in Valkey (docs:session:log), and writes the plain-text version for the weekly newsletter (report:text:YYYY-MM-DD).

bash scripts/kcc.sh session-close 2 "UME helper migration, doc updates, steering cleanup"

translate-pending [--list]

Without flags: validates all queued docs' Mermaid diagrams, then submits to the translation engine in batches of 6. With --list: shows the pending queue without submitting. Reads from docs:pending:translation sorted set.

bash scripts/kcc.sh translate-pending --list

# Output:
# 39 docs pending translation:
#   Trinity-Beast-API-Reference.html — "Added EAM endpoints" (2026-06-11)
#   Trinity-Beast-Go-Application-Features.html — "Multi-provider Bedrock" (2026-06-07)
#   ...

doc-registry [--pending | --status <file>]

Shows the full document registry (44 docs: ✓ current / ⏳ pending / ★ new). Use --pending to see only docs queued for translation, or --status <file> for a single doc's entry.

bash scripts/kcc.sh doc-registry --pending

alarm-audit [--hours N] [--no-coverage] [--advisory] [--all-regions] [--regions <list>]

Audits every CloudWatch alarm for three failure modes an alarm can be in without ever telling you: blind dimensions (pointing at a resource that no longer exists), flapping (≥6 ALARM transitions in the window, default 24h), and muted-but-still-automating (ActionsEnabled: false that still fires the self-heal EventBridge rule on every state change). A fourth check inverts the direction — coverage — enumerating what should be monitored and diffing against what actually has an alarm, which is the only way to catch a resource that was never alarmed on at all. Multi-region by default (us-east-2 + us-east-1); every result line states its scope.

bash scripts/kcc.sh alarm-audit                    # us-east-2 + us-east-1
bash scripts/kcc.sh alarm-audit --advisory         # list every advisory-tier coverage gap
bash scripts/kcc.sh alarm-audit --all-regions      # sweep all enabled regions

orphan-audit [--quiet] [--all-regions] [--regions <list>]

Checks ownership, not health. Finds hand-maintained resources that look fine today and will rot silently on the next deploy — target groups no ECS service declares in its loadBalancers config, empty non-default VPCs, Lambda log groups whose function is gone, log groups with no retention, unattached security groups and volumes, and undocumented VPC Lattice resources. Built after the 2026-07-30 PrivateLink incident, where two target groups held stale ip-type targets from long-dead tasks for months because nothing owned them. 13 checks, multi-region by default.

bash scripts/kcc.sh orphan-audit --quiet

log-freshness [--quiet]

Configuration is not delivery. This checks whether each S3-delivered log feed (WAF, ALB, CloudFront, S3-access, CloudTrail) is actually landing objects, by recency — not by whether the delivery config still names the bucket. Built after WAF and ALB logs were silently dead for 50 days (a bucket-policy overwrite) while every config check still reported the destination as configured.

bash scripts/kcc.sh log-freshness

frames-check [--quiet]

Confirms three stores agree on every transactional-email label key: the Go code that calls frame(), the data file (email-frames.json) that defines the key across all 12 languages, and the live Valkey email:frames hash the Lambda actually reads. A key present in one store but not the next renders raw keys or falls back to English silently — both have happened. Checks language completeness, placeholder-token parity, and flags any data-file key no code path references (informational, not a failure).

bash scripts/kcc.sh frames-check

audit-all [--quiet] [--all-regions] [--skip-orphan]

Runs prewarm-audit, alarm-audit, orphan-audit, and log-freshness in sequence and rolls the four verdicts into one pass/fail, exiting non-zero if any fails. --quiet collapses a clean audit to one line and prints full detail only for a failure. --skip-orphan skips the slow orphan-audit leg for routine post-deploy checks — the convention is to run the full five-audit set (this command plus frames-check) once per day during the morning sweep, and use --skip-orphan every other invocation that day.

bash scripts/kcc.sh audit-all --quiet --skip-orphan   # standard post-deploy combo

udp-check [--probes N] [--quick] [--no-aws]

The only command that tests the public UDP API — curl can't speak UDP, so nothing else covers ports 2679 (LPO price feed) and 2680 (LRS reports) from outside AWS. Sends 30 loss-probes per port by default, reports reply-loss %, latency spread, which cluster nodes answered, and UME envelope conformance. Since 2026-08-07 also covers the Webhook Push Test Receiver, both transports — an HTTPS probe expecting a 403 (the allow-list correctly rejecting an unauthenticated request) and a UDP probe verified via a Valkey receipt rather than a socket reply, since that receiver is fire-and-forget by design. WARN at ≥3 lost probes, FAIL at ≥33% loss — calibrated so ordinary UDP loss (the protocol, not a fault) doesn't cry wolf.

bash scripts/kcc.sh udp-check                 # 30 probes/port, routine volume
bash scripts/kcc.sh udp-check --quick         # reachability only
bash scripts/kcc.sh udp-check --probes 33     # custom volume

security-view

(alias secview.) Renders all five defence layers on one screen — perimeter (WAF/Shield), application (rate limits/honeypot), detection (GuardDuty/alarms/Bedrock), autonomous response (WAF auto-block set + AutoOps actions), and visibility (is the WAF log feed actually delivering) — ending in one posture verdict: SECURE, ELEVATED, or CRITICAL. Replaces running security + threat-log + threat-status + a manual Bedrock pull separately. Layer 5 (visibility) is deliberately included because a stale WAF log feed once went unnoticed for 50 days while every other layer looked fine.

bash scripts/kcc.sh security-view

morning [--quiet] [--all-regions]

The entire First Session (and Last Session) morning routine in one invocation: daily-collect + daily, udp-check, the full audit-all (always the full five-audit set — this is the once-daily orphan-audit anchor, and does not accept --skip-orphan), and security-view. One rolled-up verdict at the end. Runtime ~90-120s for a default two-region run; replaces four separate invocations and the chance of skipping one.

bash scripts/kcc.sh morning

honeypot-prune [--apply] [--days N]

The honeypot auto-block WAF IP set grows without bound by design — every decoy-path hitter gets added, nothing removes them. This ages out honeypot-attributed blocks after 90 days (default), using a durable ledger that is independent of the flaky per-IP Valkey hash. Dry-run by default; never expires a manually-added block-ip entry, since those have no honeypot evidence and should stay permanent.

bash scripts/kcc.sh honeypot-prune             # dry-run, reports only
bash scripts/kcc.sh honeypot-prune --apply     # commit the prune

refresh-volume [exchange]

Pulls real, exchange-reported 24-hour USD trading volume for every prewarm asset — one bulk-ticker call per exchange, not one call per asset — and writes it to exchange_asset_map.volume_24h_usd/volume_updated_at. This is market-wide trading volume, deliberately distinct from our own query-count ranking; it powers the "Most Traded" sort toggle on the webhook and partner asset pickers. Run weekly, or before a asset-rebalance pass.

bash scripts/kcc.sh refresh-volume              # all 6 exchanges
bash scripts/kcc.sh refresh-volume bitstamp     # single exchange

webhook-test-allowlist [list | add | remove | add-by-email]

Manages who the in-process Webhook Push Test Receiver (webhook.cpmp-site.org / udp.cpmp-site.org:2681) will accept deliveries for — table-driven against webhook_test_receiver_allowlist since 2026-08-09, replacing what used to be a hardcoded Go allow-list. A change here takes effect within 10 seconds (the same TTL as the server's own in-memory cache) — zero ECS redeploy, zero restart.

bash scripts/kcc.sh webhook-test-allowlist list
bash scripts/kcc.sh webhook-test-allowlist add <subscription_id> "<label>"
bash scripts/kcc.sh webhook-test-allowlist remove <subscription_id>
bash scripts/kcc.sh webhook-test-allowlist add-by-email <email> "<label>"

stripe-xref [--view | --apply]

Backfills and maintains stripe_customer_xref — the table mapping many Stripe cus_... customer records to one users.id, keyed by case-insensitive email. Standalone Stripe Payment Links (the LRS addon, and others) mint a new Stripe customer on every purchase, orphaned from the account's real customer record — this closes that gap so a repeat purchase can attach to the existing customer instead of creating a disconnected one. Read-only by default; never writes to Stripe, never cancels or refunds anything.

bash scripts/kcc.sh stripe-xref --view      # print the current table
bash scripts/kcc.sh stripe-xref --apply     # commit the backfill

translate-kv --namespace <ns> --keys <k1,k2,...> [--langs <codes|all>] [--dry-run]

Translates JSON string values through the same Qwen 3 235B pipeline the doc-translation engine uses — brand-term tokenization plus mechanical verification (placeholder parity, correct script per language, not identical to English) — for one-off key additions that don't warrant a full document translation job. Built after the same ad hoc "translate these dashboard i18n keys" or "translate this new email-frame family" script had been hand-rebuilt from scratch three separate times.

Two modes: --namespace reads the English value(s) directly from cpmp-redesign/lang/en.json under the given dotted key path and merges the translations straight into all 11 other language files. --pairs takes an arbitrary {"key": "English text"} object and prints the per-language result to stdout, for cases like email-frames.json where the caller decides the destination.

bash scripts/kcc.sh translate-kv --namespace docLibrary --keys cardTitle33,cardDesc33
bash scripts/kcc.sh translate-kv --pairs '{"newKey":"New English string"}' --dry-run

POST /admin/translate — Submit a Translation Job

Enqueues a translation job. The engine handles everything: sentinel preprocessing, Bedrock translation, S3 deployment, CloudFront invalidation, search index rebuild, and email notification. Fire and forget — one API call does it all.

# Single document, all 11 languages
curl -s -X POST -H "X-Admin-Key: $ADMIN_KEY" -H "Content-Type: application/json" \
  -d '{"docs":["Trinity-Beast-API-Reference.html"],"langs":"all"}' \
  "$LPO_BASE/admin/translate" | jq .

# Multiple documents, specific languages
curl -s -X POST -H "X-Admin-Key: $ADMIN_KEY" -H "Content-Type: application/json" \
  -d '{"docs":["Trinity-Beast-API-Reference.html","Trinity-Beast-Architecture-Guide.html"],"langs":["es","pt","fr"]}' \
  "$LPO_BASE/admin/translate" | jq .

# Delta mode — skip pairs where translated S3 file is newer than source (saves up to 90%)
curl -s -X POST -H "X-Admin-Key: $ADMIN_KEY" -H "Content-Type: application/json" \
  -d '{"docs":["Trinity-Beast-API-Reference.html"],"langs":"all","options":{"delta":true}}' \
  "$LPO_BASE/admin/translate" | jq .

# With idempotency key (safe to retry)
curl -s -X POST -H "X-Admin-Key: $ADMIN_KEY" -H "X-Idempotency-Key: api-ref-2026-05-27" \
  -H "Content-Type: application/json" \
  -d '{"docs":["Trinity-Beast-API-Reference.html"],"langs":"all"}' \
  "$LPO_BASE/admin/translate" | jq .

Limits: Max 6 docs per request (multiples-of-3 convention). Max 3 active jobs (additional queue in SQS, depth 12). Max 12 languages per request. Typical cost: ~$1.65 per doc-language pair, ~$18 for 1 doc × 11 langs.

GET /admin/translate/status/{job_id} — Monitor Progress

Real-time per-pair progress from Valkey. Shows each language pair's status (pending, in_progress, completed, failed), token counts, and cost.

curl -s -H "X-Admin-Key: $ADMIN_KEY" "$LPO_BASE/admin/translate/status/{job_id}" | jq .

GET /admin/translate/queue — Active Queue

Shows all active and queued jobs with their current state.

curl -s -H "X-Admin-Key: $ADMIN_KEY" "$LPO_BASE/admin/translate/queue" | jq .

GET /admin/translate/health — System Health

Translation engine health snapshot — daily spend, token usage (input + output vs 50M limit), active job count, queue depth. The KCC Live Dashboard also shows this data in the Translation Engine card.

curl -s -H "X-Admin-Key: $ADMIN_KEY" "$LPO_BASE/admin/translate/health" | jq .

# Key fields in response:
# daily_spend_usd        — dollars spent today
# daily_input_tokens     — input tokens consumed today
# daily_output_tokens    — output tokens consumed today
# daily_token_limit      — 50,000,000 (50M combined cap)
# active_jobs            — currently running Step Functions
# queue_depth            — jobs waiting in SQS

GET /admin/translate/history — Job History

Last 50 completed jobs from Aurora — the permanent ledger. Includes job ID, docs, languages, total cost, duration, and completion time.

curl -s -H "X-Admin-Key: $ADMIN_KEY" "$LPO_BASE/admin/translate/history" | jq .

POST /admin/translate/cancel/{job_id} — Cancel a Job

Stops the Step Function immediately. Already-completed pairs are not rolled back — S3 files written before cancellation remain.

curl -s -X POST -H "X-Admin-Key: $ADMIN_KEY" "$LPO_BASE/admin/translate/cancel/{job_id}"

POST /admin/translate/retry-failed/{job_id} — Retry Failed Pairs

Retries only the failed language pairs from a partial job. Successful pairs are not re-translated. Cost-efficient recovery from partial failures.

curl -s -X POST -H "X-Admin-Key: $ADMIN_KEY" "$LPO_BASE/admin/translate/retry-failed/{job_id}"

chunk-size <doc> — Verify Chunk Sizes

Reports the size of each chunk between TBI-CHUNK markers. Policy: 15 KB baseline, 18 KB max, 12 KB for dense/code-heavy sections. Flags over-limit chunks and suggests where to add markers. Do not submit and hope — verify first.

bash scripts/kcc.sh chunk-size cpmp-redesign/docs/Trinity-Beast-API-Reference.html

delta-validate <doc> — Verify Chunk Marker Integrity

Confirms that TBI-CHUNK markers survive the translation reassembly pipeline. Chunk count in source must match chunk count in output. Run before submitting documents that have been recently edited.

bash scripts/kcc.sh delta-validate Trinity-Beast-API-Reference.html