Module preflight 

preflight: whether a harness can launch here, checked before it queues work (#223).

Three checks, in order, each a Check the CLI’s doctor renders too (it shares region_check and credentials_check and prints the same lines):

1. region: the region resolves, from the caller or from $AWS_REGION / $AWS_DEFAULT_REGION (Region::from_env). Fatal when it does not resolve. Advisory when it is outside crate::region::MEASURED_REGIONS: AWS adds regions faster than a constant is re-read.
2. credentials: the default credential chain resolves credentials (ControlPlane::resolve_credentials). No AWS API call; the chain may read an SSO cache, run a credential process, or ask the instance metadata service.
3. service: one ListManagedMicrovmImages page in that region (ControlPlane::answers_listing): the endpoint resolves, the signature and the IAM permission are accepted, and the region answers the listing. A region without MicroVMs can answer AccessDeniedException with a null message (TRAP-6). A pass does not prove the region runs MicroVMs: measured 2026-10-24, ca-central-1, which AWS lists as planned, answered the listing.

A check whose precondition failed is reported as not run (Check::ran false), fatal, and makes no call. PreflightReport::ok is true exactly when no fatal check failed or was skipped. The Stateright model in crates/model/src/preflight.rs specifies this (BIND-15, BIND-16).

Nothing billable, and what is not checked

The one AWS operation is a free read (send_with_retry may repeat it on a throttle); no call creates, changes, or bills anything. The Python harvester’s check that boto3 knows the lambda-microvms service has no counterpart: this client is Rust and speaks the service model it was built against (crate::constants::MODEL_API_VERSION), so the listing is the equivalent evidence that the endpoint accepts that API version. A harness that also calls the service through boto3 checks its own boto3. Preflight does not check the execution or build role, the S3 artifact bucket, image quotas, or VPC connectors: each needs a call this module does not make, and doctor reports the infrastructure it can see.

Structs

Check

One line of a preflight or doctor report.

PreflightReport

What microvms_core::preflight::preflight found.

Functions

credentials_check

The credentials line, from a control plane that may not have been built.

healthy

Whether every fatal check passed.

preflight_with

preflight (microvms_core::preflight::preflight) over a resolved region and a control-plane constructor, for a caller (and a test) that supplies the transport. connect is not called when no region resolved.

region_check

The region line: pass for a region AWS was measured running MicroVMs in, advisory for any other, fatal when none resolved. doctor marks the last advisory too, because it must run in a broken environment and report everything else.

service_check

The service line: one free, read-only listing page.