The SSM parameter, the boot script's fetch and the `--operator-secret-file` flag on the systemd unit are gone. auth-types, agent-accounts, config, aws-deploy and onboarding now describe the handshake as the only bootstrap, and conformance's relay table says local socket access is the authorization `ANNOUNCE` and `NOTIFY` rest on. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>