American Reference Record - Annual Tester

Purchase the Annual Tester contract in AWS Marketplace. Price: USD 700,000 upfront for 12 months. Orders, payments and renewals stay in AWS Marketplace. Support: licensing@america.cool  (product support only).

1. Use Amazon ECS with an ARM64 Linux EC2 container instance in your cluster. This image is ARM64, not x86_64. Begin with 1 vCPU and 2 GiB memory. AWS infrastructure charges depend on your configuration and are separate from the software price.

2. In IAM, create or select a task role trusted by ecs-tasks.amazonaws.com. Its license policy is: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["license-manager:CheckoutLicense","license-manager:CheckInLicense"],"Resource":"*"}]} Set this role as taskRoleArn below. The separate executionRoleArn must permit ECR authorization and image pulls from the Marketplace repository, and CloudWatch logging if configured. IAM roles are configured in the buyer's AWS account; ECS supplies the runtime role automatically. The executable uses only the ECS container metadata provider. It has no static-key, shared-profile or seller-login authentication path.

3. Image: 709825985650.dkr.ecr.us-east-1.amazonaws.com/dot-cool-l-l-c/arr-annual-tester:ecs-role-only-20261028-arm64 Verified digest: sha256:260dc5dd0e32cb58187e2d8ed771b396a9bafff1d69ab90a67d062bc237cf1e2 Use this exact Marketplace image in all deployments. No third-party image or seller-operated service is needed. Allow HTTPS to AWS License Manager in us-east-1 and the ECR/logging endpoints used by the task; no inbound application port is needed.

4. Prepare /opt/arr/input/responses.jsonl on the ECS container instance, readable by UID 10001. Each line is {"id":"original-question-id","answerId":"exact-option-entityId"}. Use encrypted storage and mount only this input directory. An empty file is a valid deployment test: it reports all 233 current-facts questions as missing, not correct answers.

5. In ECS > Task definitions > Create new task definition > Create with JSON, paste this template and replace TASK_ROLE_ARN and EXECUTION_ROLE_ARN with the roles from step 2. Retain your account's normal logging configuration if desired: {"family":"arr-annual-tester","networkMode":"bridge","requiresCompatibilities":["EC2"],"cpu":"1024","memory":"2048","runtimePlatform":{"cpuArchitecture":"ARM64","operatingSystemFamily":"LINUX"},"taskRoleArn":"TASK_ROLE_ARN","executionRoleArn":"EXECUTION_ROLE_ARN","volumes":[{"name":"input","host":{"sourcePath":"/opt/arr/input"}}],"containerDefinitions":[{"name":"tester","image":"709825985650.dkr.ecr.us-east-1.amazonaws.com/dot-cool-l-l-c/arr-annual-tester:ecs-role-only-20261028-arm64","essential":true,"user":"10001:10001","readonlyRootFilesystem":true,"command":["score","current-facts-v1","/input/responses.jsonl"],"mountPoints":[{"sourceVolume":"input","containerPath":"/input","readOnly":true}]}]}

6. Choose your cluster > Tasks > Run new task, select EC2 and this task definition. Successful jobs exit 0 and emit a JSON report to stdout (and configured logs). Licensed scoring checks out annual_tester, scores, and checks it back in. A licensing failure exits nonzero before scoring. Jobs are bounded to two minutes. If EcsTaskRoleRequired appears, check taskRoleArn; do not replace it with another authentication method.

7. Command ["info"] reports the packet version and counts. The packet is /app/_packet: manifest.json, schemas, questions, retained records, evaluator-only answer keys and score.mjs. Keep evaluator keys and scorer separate from model-facing questions/grounding records. Other scoring layers: scale-v1, language-v1, making-growing-v1, county-facts-v1.

8. Stop completed tasks; retain manifests, inputs and reports in buyer-controlled encrypted storage with appropriate log retention. Upgrade by selecting a new immutable image explicitly. Check EC2/ECS capacity quotas before launch. No response-file contents are sent to Dot Cool. The complete corpus is excluded.