@empire-builder-kit/nx 1.0.0-beta.9 → 1.0.0-rc.2

package/src/generators/slice/built-in-plan-reliability-files.js

@@ -0,0 +1,4499 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.renderProductReliabilityFiles = renderProductReliabilityFiles;
+const reliability_1 = require("@empire-builder-kit/runtime/reliability");
+const built_in_plan_shared_js_1 = require("./built-in-plan-shared.js");
+function reliabilityContract(name, reviewedAt) {
+    return {
+        escalationRouteKey: `${name}-on-call`,
+        objectives: [
+            {
+                allowedExclusionPolicyRef: 'docs:reliability/exclusions.md',
+                burn: { fast: 14.4, slow: 6, warning: 0.5 },
+                effectiveAt: reviewedAt,
+                feature: 'operations',
+                id: 'api-availability',
+                indicator: {
+                    goodEventDefinition: 'Valid API requests complete without a server failure.',
+                    metricRef: 'operations:metrics/api-availability',
+                    type: 'availability',
+                    validEventDefinition: 'Requests reaching a declared API operation, including authorization denials.',
+                },
+                journey: 'api-critical-operation',
+                lowTraffic: { mode: 'data-insufficient' },
+                minimumValidEvents: {
+                    diagnosticSample: 100,
+                    fastBurnWindow: 1,
+                    objectiveWindow: 100,
+                    slowBurnWindow: 5,
+                },
+                owner: `${name}-product`,
+                references: {
+                    alarmIds: ['api-fast-burn', 'api-slow-burn'],
+                    dashboardRef: 'dashboard:operations',
+                    runbookRef: 'runbook:api-recovery',
+                },
+                target: 0.99,
+                tier: 'critical',
+                window: { days: 28, kind: 'rolling' },
+            },
+            {
+                allowedExclusionPolicyRef: 'docs:reliability/exclusions.md',
+                burn: { fast: 14.4, slow: 6, warning: 0.5 },
+                effectiveAt: reviewedAt,
+                feature: 'web',
+                id: 'web-latency',
+                indicator: {
+                    goodEventDefinition: 'Valid server-rendered requests complete within 1000 milliseconds.',
+                    metricRef: 'operations:metrics/web-latency',
+                    threshold: 1000,
+                    type: 'latency',
+                    unit: 'Milliseconds',
+                    validEventDefinition: 'Requests reaching the generated web application.',
+                },
+                journey: 'web-critical-route',
+                lowTraffic: { mode: 'data-insufficient' },
+                minimumValidEvents: {
+                    diagnosticSample: 100,
+                    fastBurnWindow: 1,
+                    objectiveWindow: 100,
+                    slowBurnWindow: 5,
+                },
+                owner: `${name}-product`,
+                references: {
+                    alarmIds: ['web-latency-fast-burn', 'web-latency-slow-burn'],
+                    dashboardRef: 'dashboard:operations',
+                    runbookRef: 'runbook:web-recovery',
+                },
+                target: 0.95,
+                tier: 'important',
+                window: { days: 28, kind: 'rolling' },
+            },
+            {
+                allowedExclusionPolicyRef: 'docs:reliability/exclusions.md',
+                burn: { fast: 14.4, slow: 6, warning: 0.5 },
+                effectiveAt: reviewedAt,
+                feature: 'async-work',
+                id: 'async-delivery-deadline',
+                indicator: {
+                    goodEventDefinition: 'Accepted provider deliveries leave the queue within 900 seconds.',
+                    metricRef: 'operations:metrics/async-delivery-deadline',
+                    threshold: 900,
+                    type: 'deadline',
+                    unit: 'Seconds',
+                    validEventDefinition: 'Provider deliveries durably accepted into the generated queue.',
+                },
+                journey: 'provider-delivery',
+                lowTraffic: { mode: 'data-insufficient' },
+                minimumValidEvents: {
+                    diagnosticSample: 10,
+                    fastBurnWindow: 1,
+                    objectiveWindow: 10,
+                    slowBurnWindow: 5,
+                },
+                owner: `${name}-product`,
+                references: {
+                    alarmIds: ['provider-queue-age'],
+                    dashboardRef: 'dashboard:operations',
+                    runbookRef: 'runbook:async-recovery',
+                },
+                target: 0.99,
+                tier: 'important',
+                window: { days: 28, kind: 'rolling' },
+            },
+        ],
+        owner: `${name}-product`,
+        providerDecision: {
+            applicationSignalsCoverage: ['lambda', 'next'],
+            basis: 'Direct CloudWatch metric math covers the generated Lambda, Next.js, queue, Service, Job, and database surfaces without making Application Signals mandatory. Re-evaluate with retained exact-candidate coverage and cost evidence.',
+            cost: {
+                currency: 'USD',
+                monthly: 0,
+                provenance: 'estimate',
+            },
+            directMetricMathCoverage: [
+                'lambda',
+                'next',
+                'queue',
+                'service',
+                'job',
+                'database',
+                'alert-delivery',
+            ],
+            reviewedAt,
+            selected: 'direct-cloudwatch-metric-math',
+        },
+        schemaVersion: 1,
+        slice: name,
+    };
+}
+function alarmRegistrations(name) {
+    const owner = `${name}-product`;
+    const route = `${name}-on-call`;
+    const common = {
+        escalationRouteKey: route,
+        expectedFalseNegativeRisk: 'Low traffic or delayed CloudWatch data can delay detection.',
+        expectedFalsePositiveRisk: 'A dependency or synthetic client can fail while the application remains healthy.',
+        missingData: 'missing',
+        owner,
+        testRef: 'evidence:reliability/failure-recovery',
+    };
+    const registrations = [
+        {
+            ...common,
+            businessSymptom: 'Critical API operations are failing.',
+            condition: 'The API availability objective is consuming budget rapidly.',
+            dependencyAlarmIds: ['database-capacity'],
+            id: 'api-fast-burn',
+            runbookRef: 'runbook:api-recovery',
+            severity: 'critical',
+        },
+        {
+            ...common,
+            businessSymptom: 'Critical API operations have sustained failures.',
+            condition: 'The API availability objective is consuming budget slowly.',
+            dependencyAlarmIds: ['database-capacity'],
+            id: 'api-slow-burn',
+            runbookRef: 'runbook:api-recovery',
+            severity: 'high',
+        },
+        {
+            ...common,
+            businessSymptom: 'Server-rendered routes exceed the latency objective.',
+            condition: 'Web p95 latency exceeds the reviewed threshold.',
+            dependencyAlarmIds: ['database-capacity'],
+            id: 'web-latency-fast-burn',
+            runbookRef: 'runbook:web-recovery',
+            severity: 'high',
+        },
+        {
+            ...common,
+            businessSymptom: 'Server-rendered routes have sustained latency degradation.',
+            condition: 'Web p95 latency remains above the reviewed threshold for the slow window.',
+            dependencyAlarmIds: ['database-capacity'],
+            id: 'web-latency-slow-burn',
+            runbookRef: 'runbook:web-recovery',
+            severity: 'high',
+        },
+        {
+            ...common,
+            businessSymptom: 'Accepted provider work is missing its deadline.',
+            condition: 'Oldest provider-queue work exceeds 900 seconds.',
+            dependencyAlarmIds: [],
+            id: 'provider-queue-age',
+            runbookRef: 'runbook:async-recovery',
+            severity: 'high',
+        },
+        {
+            ...common,
+            businessSymptom: 'The shared database is approaching its capacity bound.',
+            condition: 'Aurora capacity exceeds the reviewed warning threshold.',
+            dependencyAlarmIds: [],
+            id: 'database-capacity',
+            runbookRef: 'runbook:database-recovery',
+            severity: 'high',
+        },
+        {
+            ...common,
+            businessSymptom: 'Expired protected performance-load control records are accumulating.',
+            condition: 'The bounded performance-load expiry cleanup reports a nonzero backlog.',
+            dependencyAlarmIds: [],
+            id: 'performance-load-cleanup-backlog',
+            runbookRef: 'runbook:performance-capacity-cost',
+            severity: 'high',
+        },
+        {
+            ...common,
+            businessSymptom: 'Protected performance-load residue exceeded its cleanup deadline.',
+            condition: 'The bounded expiry worker reports residue at least 24 hours past eligible expiry.',
+            dependencyAlarmIds: ['performance-load-cleanup-backlog'],
+            id: 'performance-load-cleanup-deadline',
+            runbookRef: 'runbook:performance-capacity-cost',
+            severity: 'critical',
+        },
+        {
+            ...common,
+            businessSymptom: 'The confidential-export cleanup invocation is failing.',
+            condition: 'AWS/Lambda reports an error for the exact generated confidential-export cleanup Function.',
+            dependencyAlarmIds: [],
+            id: 'data-export-cleanup-failure',
+            runbookRef: 'runbook:database-recovery',
+            severity: 'high',
+        },
+        {
+            ...common,
+            businessSymptom: 'The scheduled confidential-export cleanup is not running.',
+            condition: 'AWS/Lambda reports fewer than one invocation across two consecutive hourly periods.',
+            dependencyAlarmIds: [],
+            id: 'data-export-cleanup-invocation-missing',
+            runbookRef: 'runbook:database-recovery',
+            severity: 'critical',
+        },
+        {
+            ...common,
+            businessSymptom: 'Confidential-export residue exceeded its deletion deadline.',
+            condition: 'The cleanup worker reports an open export at or after its immutable 24-hour cleanup deadline.',
+            dependencyAlarmIds: [
+                'data-export-cleanup-failure',
+                'data-export-cleanup-invocation-missing',
+            ],
+            id: 'data-export-cleanup-deadline',
+            runbookRef: 'runbook:database-recovery',
+            severity: 'critical',
+        },
+        {
+            ...common,
+            businessSymptom: 'A generated Function has a terminal invocation error.',
+            condition: 'AWS/Lambda reports one or more errors for the exact generated cleanup Function.',
+            dependencyAlarmIds: [],
+            id: 'function-failure',
+            runbookRef: 'runbook:api-recovery',
+            severity: 'high',
+        },
+        {
+            ...common,
+            businessSymptom: 'The built-in retention Job terminated unsuccessfully.',
+            condition: 'AWS Step Functions reports a failed, timed-out, or aborted execution for the exact retention state machine.',
+            dependencyAlarmIds: [],
+            id: 'retention-job-failure',
+            runbookRef: 'runbook:database-recovery',
+            severity: 'high',
+        },
+        {
+            ...common,
+            businessSymptom: 'The primary alert route is failing delivery.',
+            condition: 'SNS reports one or more failed notifications.',
+            dependencyAlarmIds: [],
+            id: 'alert-delivery-degraded',
+            runbookRef: 'runbook:alert-delivery',
+            severity: 'critical',
+        },
+        {
+            ...common,
+            businessSymptom: 'A managed log group contains a protected-data finding.',
+            condition: 'CloudWatch Logs reports one or more protected-data findings.',
+            dependencyAlarmIds: [],
+            id: 'data-protection-findings',
+            runbookRef: 'runbook:log-investigation',
+            severity: 'critical',
+        },
+        {
+            ...common,
+            businessSymptom: 'Domain-event processing has terminal failures.',
+            condition: 'The event dead-letter queue contains one or more messages.',
+            dependencyAlarmIds: [],
+            id: 'event-dlq-depth',
+            runbookRef: 'runbook:async-recovery',
+            severity: 'high',
+        },
+        {
+            ...common,
+            businessSymptom: 'Provider deliveries have terminal failures.',
+            condition: 'The provider-delivery dead-letter queue contains one or more messages.',
+            dependencyAlarmIds: [],
+            id: 'provider-dlq-depth',
+            runbookRef: 'runbook:async-recovery',
+            severity: 'high',
+        },
+        {
+            ...common,
+            businessSymptom: 'An asynchronous target has terminal failures.',
+            condition: 'The asynchronous-target dead-letter queue contains one or more messages.',
+            dependencyAlarmIds: [],
+            id: 'async-target-dlq-depth',
+            runbookRef: 'runbook:async-recovery',
+            severity: 'high',
+        },
+        {
+            ...common,
+            businessSymptom: 'The transactional outbox relay is failing.',
+            condition: 'The generated outbox relay reports one or more errors.',
+            dependencyAlarmIds: [],
+            id: 'outbox-relay-errors',
+            runbookRef: 'runbook:async-recovery',
+            severity: 'high',
+        },
+        {
+            ...common,
+            businessSymptom: 'The asynchronous inbox cleanup job is failing.',
+            condition: 'The generated inbox cleanup job reports one or more errors.',
+            dependencyAlarmIds: [],
+            id: 'inbox-cleanup-errors',
+            runbookRef: 'runbook:async-recovery',
+            severity: 'high',
+        },
+        {
+            ...common,
+            businessSymptom: 'Transactional outbox work is accumulating.',
+            condition: 'The transactional outbox backlog remains nonempty.',
+            dependencyAlarmIds: ['outbox-relay-errors'],
+            id: 'outbox-backlog',
+            runbookRef: 'runbook:async-recovery',
+            severity: 'high',
+        },
+        {
+            ...common,
+            businessSymptom: 'Terminal asynchronous inbox records are accumulating.',
+            condition: 'The terminal inbox cleanup backlog remains nonempty.',
+            dependencyAlarmIds: ['inbox-cleanup-errors'],
+            id: 'inbox-cleanup-backlog',
+            runbookRef: 'runbook:async-recovery',
+            severity: 'high',
+        },
+    ];
+    return registrations.map((registration) => (0, reliability_1.validateAlarmRegistrationMetadata)(registration));
+}
+function reliabilityExercises(name) {
+    const shared = {
+        cleanupRequired: true,
+        owner: `${name}-product`,
+        protectedMutationRequiresApproval: true,
+    };
+    return [
+        {
+            ...shared,
+            failure: 'Inject one bounded generated API handler failure.',
+            id: 'lambda-api-failure',
+            observation: {
+                adapter: 'aws-cloudwatch-alarm-history-v1',
+                alarmIds: ['api-fast-burn'],
+                dynamicAlarmKind: 'none',
+                workflowMetadata: 'none',
+            },
+            postconditions: [
+                'critical API journey succeeds',
+                'alarm returns to normal without being disabled',
+                'release and configuration identity remain attributable',
+            ],
+            recovery: ['retry', 'roll-forward', 'protected-revert'],
+            workload: 'lambda-api',
+        },
+        {
+            ...shared,
+            failure: 'Inject a bounded health or dependency failure in an EBK Service.',
+            id: 'service-failure',
+            observation: {
+                adapter: 'aws-cloudwatch-alarm-history-v1',
+                alarmIds: [],
+                dynamicAlarmKind: 'service',
+                workflowMetadata: 'none',
+            },
+            postconditions: [
+                'service readiness recovers',
+                'critical dependency remains protected',
+            ],
+            recovery: ['retry', 'roll-forward', 'degraded-mode'],
+            workload: 'service',
+        },
+        {
+            ...shared,
+            failure: 'Inject one bounded generated Job failure before completion.',
+            id: 'job-failure',
+            observation: {
+                adapter: 'aws-cloudwatch-alarm-history-v1',
+                alarmIds: [],
+                dynamicAlarmKind: 'job',
+                workflowMetadata: 'none',
+            },
+            postconditions: [
+                'checkpoint or idempotency state is retained',
+                'deadline outcome is verified',
+            ],
+            recovery: ['retry', 'roll-forward'],
+            workload: 'job',
+        },
+        {
+            ...shared,
+            failure: 'Run the built-in retention state machine with a bounded failing fixture.',
+            id: 'retention-job-failure',
+            observation: {
+                adapter: 'aws-cloudwatch-alarm-history-v1',
+                alarmIds: ['retention-job-failure'],
+                dynamicAlarmKind: 'none',
+                workflowMetadata: 'required',
+            },
+            postconditions: [
+                'the exact state machine execution reaches a terminal failure',
+                'the AWS-native execution alarm fires',
+                'the later recovery execution succeeds without weakening retention policy',
+            ],
+            recovery: ['retry', 'roll-forward'],
+            workload: 'built-in-retention-job',
+        },
+        {
+            ...shared,
+            failure: 'Route a deterministic poison fixture to the generated DLQ.',
+            id: 'queue-dlq-failure',
+            observation: {
+                adapter: 'aws-cloudwatch-alarm-history-v1',
+                alarmIds: [
+                    'async-target-dlq-depth',
+                    'event-dlq-depth',
+                    'provider-dlq-depth',
+                ],
+                dynamicAlarmKind: 'none',
+                workflowMetadata: 'optional',
+            },
+            postconditions: [
+                'DLQ alarm fires',
+                'bounded redrive converges',
+                'no duplicate provider effect occurs',
+            ],
+            recovery: ['redrive', 'replay'],
+            workload: 'queue-dlq',
+        },
+        {
+            ...shared,
+            failure: 'Inject bounded dependency latency and an availability failure.',
+            id: 'dependency-failure',
+            observation: {
+                adapter: 'aws-cloudwatch-alarm-history-v1',
+                alarmIds: ['api-fast-burn'],
+                dynamicAlarmKind: 'none',
+                workflowMetadata: 'none',
+            },
+            postconditions: [
+                'retry amplification stays bounded',
+                'critical work degrades or queues as declared',
+            ],
+            recovery: ['retry', 'degraded-mode', 'roll-forward'],
+            workload: 'dependency',
+        },
+        {
+            ...shared,
+            failure: 'Exercise database unavailability or cold-resume latency.',
+            id: 'database-failure',
+            observation: {
+                adapter: 'aws-cloudwatch-alarm-history-v1',
+                alarmIds: ['database-capacity'],
+                dynamicAlarmKind: 'none',
+                workflowMetadata: 'none',
+            },
+            postconditions: [
+                'data invariants pass',
+                'connection concurrency remains bounded',
+                'critical journey recovery is verified',
+            ],
+            recovery: ['retry', 'restore', 'roll-forward'],
+            workload: 'database',
+        },
+        {
+            ...shared,
+            failure: 'Fail the primary alert destination during a bounded proof.',
+            id: 'alert-delivery-failure',
+            observation: {
+                adapter: 'aws-cloudwatch-alarm-history-v1',
+                alarmIds: ['alert-delivery-degraded'],
+                dynamicAlarmKind: 'none',
+                workflowMetadata: 'none',
+            },
+            postconditions: [
+                'diagnostic degradation is recorded without using the failed route',
+                'delivery is unsupported unless an independent provider receipt exists',
+            ],
+            recovery: ['roll-forward'],
+            workload: 'alert-delivery',
+        },
+        {
+            ...shared,
+            failure: 'Retain one exact deployed-smoke failure artifact before the successful rerun.',
+            id: 'runtime-smoke-failure',
+            observation: {
+                adapter: 'testing-evidence-aggregate-v1',
+                alarmIds: [],
+                dynamicAlarmKind: 'none',
+                workflowMetadata: 'none',
+            },
+            postconditions: [
+                'the testing-evidence aggregate binds the exact deployment and candidate',
+                'the failure remains retained beside the successful rerun',
+                'cleanup evidence is complete',
+            ],
+            recovery: ['retry', 'roll-forward'],
+            workload: 'deployed-smoke',
+        },
+    ];
+}
+function deployedAlarmResources(name) {
+    const primary = {
+        actions: 'primary-route',
+        comparisonOperator: 'GreaterThanOrEqualToThreshold',
+        owner: `${name}-product`,
+        route: `${name}-on-call`,
+    };
+    return [
+        {
+            ...primary,
+            dimensionNames: ['ApiId'],
+            evaluationPeriods: 1,
+            id: 'api-fast-burn',
+            metricNames: ['5xx', 'Count'],
+            name: `${name}-{stage}-api-fast-burn`,
+            namespace: 'AWS/ApiGateway',
+            objectiveId: 'api-availability',
+            runbook: 'docs/runbooks/api-recovery.md',
+            signal: 'metric-math',
+            threshold: 14.4,
+            treatMissingData: 'missing',
+        },
+        {
+            ...primary,
+            dimensionNames: ['ApiId'],
+            evaluationPeriods: 1,
+            id: 'api-slow-burn',
+            metricNames: ['5xx', 'Count'],
+            name: `${name}-{stage}-api-slow-burn`,
+            namespace: 'AWS/ApiGateway',
+            objectiveId: 'api-availability',
+            runbook: 'docs/runbooks/api-recovery.md',
+            signal: 'metric-math',
+            threshold: 6,
+            treatMissingData: 'missing',
+        },
+        {
+            ...primary,
+            dimensionNames: ['Component', 'Feature', 'Operation', 'Slice', 'Stage'],
+            dimensionValues: {
+                Component: 'next-server',
+                Feature: 'web',
+                Operation: 'request',
+                Slice: name,
+                Stage: '{stage}',
+            },
+            evaluationPeriods: 1,
+            id: 'web-latency-fast-burn',
+            metricNames: ['OperationGood', 'OperationValid'],
+            name: `${name}-{stage}-web-latency-fast-burn`,
+            namespace: `EBK/${name}`,
+            objectiveId: 'web-latency',
+            runbook: 'docs/runbooks/web-recovery.md',
+            signal: 'metric-math',
+            threshold: 14.4,
+            treatMissingData: 'missing',
+        },
+        {
+            ...primary,
+            dimensionNames: ['Component', 'Feature', 'Operation', 'Slice', 'Stage'],
+            dimensionValues: {
+                Component: 'next-server',
+                Feature: 'web',
+                Operation: 'request',
+                Slice: name,
+                Stage: '{stage}',
+            },
+            evaluationPeriods: 1,
+            id: 'web-latency-slow-burn',
+            metricNames: ['OperationGood', 'OperationValid'],
+            name: `${name}-{stage}-web-latency-slow-burn`,
+            namespace: `EBK/${name}`,
+            objectiveId: 'web-latency',
+            runbook: 'docs/runbooks/web-recovery.md',
+            signal: 'metric-math',
+            threshold: 6,
+            treatMissingData: 'missing',
+        },
+        {
+            ...primary,
+            dimensionNames: ['QueueName'],
+            dimensionValues: {
+                QueueName: `ebk-{stage}-${name}-provider-queue`,
+            },
+            evaluationPeriods: 2,
+            id: 'provider-queue-age',
+            metricName: 'ApproximateAgeOfOldestMessage',
+            name: `${name}-{stage}-provider-deadline`,
+            namespace: 'AWS/SQS',
+            period: 300,
+            runbook: 'docs/runbooks/async-recovery.md',
+            signal: 'metric',
+            statistic: 'Maximum',
+            threshold: 900,
+            treatMissingData: 'missing',
+        },
+        {
+            ...primary,
+            dimensionNames: ['DBClusterIdentifier'],
+            evaluationPeriods: 3,
+            id: 'database-capacity',
+            metricName: 'ServerlessDatabaseCapacity',
+            name: `${name}-{stage}-database-capacity`,
+            namespace: 'AWS/RDS',
+            period: 300,
+            runbook: 'docs/runbooks/database-recovery.md',
+            signal: 'metric',
+            statistic: 'Maximum',
+            threshold: 3.5,
+            treatMissingData: 'missing',
+        },
+        {
+            ...primary,
+            dimensionNames: ['Component', 'Feature', 'Operation', 'Slice', 'Stage'],
+            dimensionValues: {
+                Component: 'performance-load-cleanup',
+                Feature: 'performance',
+                Operation: 'expiry-cleanup',
+                Slice: name,
+                Stage: '{stage}',
+            },
+            evaluationPeriods: 1,
+            id: 'performance-load-cleanup-backlog',
+            metricName: 'PerformanceLoadCleanupBacklog',
+            name: `${name}-{stage}-performance-load-cleanup-backlog`,
+            namespace: 'EBK/Performance',
+            period: 3600,
+            runbook: 'docs/runbooks/performance-capacity-cost.md',
+            signal: 'metric',
+            statistic: 'Maximum',
+            threshold: 1,
+            treatMissingData: 'notBreaching',
+        },
+        {
+            ...primary,
+            dimensionNames: ['Component', 'Feature', 'Operation', 'Slice', 'Stage'],
+            dimensionValues: {
+                Component: 'performance-load-cleanup',
+                Feature: 'performance',
+                Operation: 'expiry-cleanup',
+                Slice: name,
+                Stage: '{stage}',
+            },
+            evaluationPeriods: 1,
+            id: 'performance-load-cleanup-deadline',
+            metricName: 'PerformanceLoadCleanupDeadlineBreaches',
+            name: `${name}-{stage}-performance-load-cleanup-deadline`,
+            namespace: 'EBK/Performance',
+            period: 3600,
+            runbook: 'docs/runbooks/performance-capacity-cost.md',
+            signal: 'metric',
+            statistic: 'Maximum',
+            threshold: 1,
+            treatMissingData: 'notBreaching',
+        },
+        {
+            ...primary,
+            comparisonOperator: 'LessThanThreshold',
+            dimensionNames: ['FunctionName'],
+            evaluationPeriods: 2,
+            id: 'data-export-cleanup-invocation-missing',
+            metricName: 'Invocations',
+            name: `${name}-{stage}-data-export-cleanup-invocation-missing`,
+            namespace: 'AWS/Lambda',
+            period: 3600,
+            runbook: 'docs/runbooks/database-recovery.md',
+            signal: 'metric',
+            statistic: 'Sum',
+            threshold: 1,
+            treatMissingData: 'breaching',
+        },
+        {
+            ...primary,
+            dimensionNames: ['FunctionName'],
+            evaluationPeriods: 1,
+            id: 'data-export-cleanup-failure',
+            metricName: 'Errors',
+            name: `${name}-{stage}-data-export-cleanup-failure`,
+            namespace: 'AWS/Lambda',
+            period: 300,
+            runbook: 'docs/runbooks/database-recovery.md',
+            signal: 'metric',
+            statistic: 'Sum',
+            threshold: 1,
+            treatMissingData: 'notBreaching',
+        },
+        {
+            ...primary,
+            dimensionNames: ['Component', 'Feature', 'Operation', 'Slice', 'Stage'],
+            dimensionValues: {
+                Component: 'data-export-cleanup',
+                Feature: 'data-lifecycle',
+                Operation: 'expiry-cleanup',
+                Slice: name,
+                Stage: '{stage}',
+            },
+            evaluationPeriods: 1,
+            id: 'data-export-cleanup-deadline',
+            metricName: 'DataExportCleanupDeadlineBreaches',
+            name: `${name}-{stage}-data-export-cleanup-deadline`,
+            namespace: 'EBK/DataLifecycle',
+            period: 3600,
+            runbook: 'docs/runbooks/database-recovery.md',
+            signal: 'metric',
+            statistic: 'Maximum',
+            threshold: 1,
+            treatMissingData: 'notBreaching',
+        },
+        {
+            ...primary,
+            dimensionNames: ['FunctionName'],
+            evaluationPeriods: 1,
+            id: 'function-failure',
+            metricName: 'Errors',
+            name: `${name}-{stage}-function-failure`,
+            namespace: 'AWS/Lambda',
+            period: 60,
+            runbook: 'docs/runbooks/api-recovery.md',
+            signal: 'metric',
+            statistic: 'Sum',
+            threshold: 1,
+            treatMissingData: 'notBreaching',
+        },
+        {
+            ...primary,
+            dimensionNames: ['StateMachineArn'],
+            evaluationPeriods: 1,
+            id: 'retention-job-failure',
+            metricNames: [
+                'ExecutionsAborted',
+                'ExecutionsFailed',
+                'ExecutionsTimedOut',
+            ],
+            name: `${name}-{stage}-retention-job-failure`,
+            namespace: 'AWS/States',
+            runbook: 'docs/runbooks/database-recovery.md',
+            signal: 'metric-math',
+            threshold: 1,
+            treatMissingData: 'notBreaching',
+        },
+        {
+            ...primary,
+            dimensionNames: ['QueueName'],
+            dimensionValues: {
+                QueueName: `ebk-{stage}-${name}-event-dlq`,
+            },
+            evaluationPeriods: 1,
+            id: 'event-dlq-depth',
+            metricName: 'ApproximateNumberOfMessagesVisible',
+            name: `${name}-{stage}-event-dlq-depth`,
+            namespace: 'AWS/SQS',
+            period: 300,
+            runbook: 'docs/runbooks/async-recovery.md',
+            signal: 'metric',
+            statistic: 'Maximum',
+            threshold: 1,
+            treatMissingData: 'notBreaching',
+        },
+        {
+            ...primary,
+            dimensionNames: ['QueueName'],
+            dimensionValues: {
+                QueueName: `ebk-{stage}-${name}-provider-dlq`,
+            },
+            evaluationPeriods: 1,
+            id: 'provider-dlq-depth',
+            metricName: 'ApproximateNumberOfMessagesVisible',
+            name: `${name}-{stage}-provider-dlq-depth`,
+            namespace: 'AWS/SQS',
+            period: 300,
+            runbook: 'docs/runbooks/async-recovery.md',
+            signal: 'metric',
+            statistic: 'Maximum',
+            threshold: 1,
+            treatMissingData: 'notBreaching',
+        },
+        {
+            ...primary,
+            dimensionNames: ['QueueName'],
+            dimensionValues: {
+                QueueName: `ebk-{stage}-${name}-async-target-dlq`,
+            },
+            evaluationPeriods: 1,
+            id: 'async-target-dlq-depth',
+            metricName: 'ApproximateNumberOfMessagesVisible',
+            name: `${name}-{stage}-async-target-dlq-depth`,
+            namespace: 'AWS/SQS',
+            period: 300,
+            runbook: 'docs/runbooks/async-recovery.md',
+            signal: 'metric',
+            statistic: 'Maximum',
+            threshold: 1,
+            treatMissingData: 'notBreaching',
+        },
+        {
+            ...primary,
+            dimensionNames: ['FunctionName'],
+            evaluationPeriods: 1,
+            id: 'outbox-relay-errors',
+            metricName: 'Errors',
+            name: `${name}-{stage}-outbox-relay-errors`,
+            namespace: 'AWS/Lambda',
+            period: 300,
+            runbook: 'docs/runbooks/async-recovery.md',
+            signal: 'metric',
+            statistic: 'Sum',
+            threshold: 1,
+            treatMissingData: 'notBreaching',
+        },
+        {
+            ...primary,
+            dimensionNames: ['FunctionName'],
+            evaluationPeriods: 1,
+            id: 'inbox-cleanup-errors',
+            metricName: 'Errors',
+            name: `${name}-{stage}-inbox-cleanup-errors`,
+            namespace: 'AWS/Lambda',
+            period: 300,
+            runbook: 'docs/runbooks/async-recovery.md',
+            signal: 'metric',
+            statistic: 'Sum',
+            threshold: 1,
+            treatMissingData: 'notBreaching',
+        },
+        {
+            ...primary,
+            dimensionNames: ['Slice', 'Stage'],
+            dimensionValues: { Slice: name, Stage: '{stage}' },
+            evaluationPeriods: 2,
+            id: 'outbox-backlog',
+            metricName: 'OutboxBacklog',
+            name: `${name}-{stage}-outbox-backlog`,
+            namespace: 'EBK/Async',
+            period: 300,
+            runbook: 'docs/runbooks/async-recovery.md',
+            signal: 'metric',
+            statistic: 'Maximum',
+            threshold: 1,
+            treatMissingData: 'notBreaching',
+        },
+        {
+            ...primary,
+            dimensionNames: ['Component', 'Feature', 'Operation', 'Slice', 'Stage'],
+            dimensionValues: {
+                Component: 'inbox-cleanup',
+                Feature: 'async-work',
+                Operation: 'inbox-cleanup',
+                Slice: name,
+                Stage: '{stage}',
+            },
+            evaluationPeriods: 2,
+            id: 'inbox-cleanup-backlog',
+            metricName: 'InboxCleanupBacklog',
+            name: `${name}-{stage}-inbox-cleanup-backlog`,
+            namespace: 'EBK/Async',
+            period: 3600,
+            runbook: 'docs/runbooks/async-recovery.md',
+            signal: 'metric',
+            statistic: 'Maximum',
+            threshold: 1,
+            treatMissingData: 'notBreaching',
+        },
+        {
+            actions: 'none',
+            comparisonOperator: 'GreaterThanOrEqualToThreshold',
+            dimensionNames: ['TopicName'],
+            evaluationPeriods: 1,
+            id: 'alert-delivery-degraded',
+            metricName: 'NumberOfNotificationsFailed',
+            name: `${name}-{stage}-alert-delivery-degraded`,
+            namespace: 'AWS/SNS',
+            owner: `${name}-product`,
+            period: 300,
+            route: `${name}-on-call`,
+            runbook: 'docs/runbooks/alert-delivery.md',
+            signal: 'metric',
+            statistic: 'Sum',
+            threshold: 1,
+            treatMissingData: 'notBreaching',
+        },
+    ];
+}
+/** @internal */
+function renderProductReliabilityFiles(name, pascalName, reviewedAt) {
+    const contract = reliabilityContract(name, reviewedAt);
+    const alarms = alarmRegistrations(name);
+    const exercises = reliabilityExercises(name);
+    return {
+        'docs/reliability/slo.json': (0, built_in_plan_shared_js_1.json)(contract),
+        'docs/reliability/exclusions.md': `# SLO exclusions
+
+This adopter-owned record starts empty. An exclusion must name one generated
+SLO ID, owner, reason, bounded UTC start and end, and review reference. Define
+planned maintenance exclusions before the window where possible. Never add a
+retroactive exclusion merely to make attainment green.
+
+The generated verifier treats this document as the policy authority; managed
+CloudWatch resources do not rewrite it.
+`,
+        'operations/reliability.json': (0, built_in_plan_shared_js_1.json)({
+            alarmRegistrations: alarms,
+            consoleIndependent: true,
+            deployedAlarmResources: deployedAlarmResources(name),
+            diagnostic: {
+                metadataSources: [
+                    'alarm-state',
+                    'resource-metadata',
+                    'sanitized-signal',
+                ],
+                protectedSource: 'bounded-log-query',
+                runbookRef: 'runbook:reliability-diagnostic',
+            },
+            alertDelivery: {
+                confirmation: 'unsupported-until-independent-route-is-configured',
+                mode: 'diagnostic-only',
+                states: ['requested', 'confirmed', 'unsupported'],
+            },
+            dataLifecycleReferences: {
+                alarms: [
+                    'alarm:data-export-cleanup-deadline',
+                    'alarm:data-export-cleanup-failure',
+                    'alarm:data-export-cleanup-invocation-missing',
+                ],
+                status: 'requires-live-evidence',
+            },
+            incidentTemplateRef: 'operations:incident-template.json',
+            performanceReferences: {
+                alarms: [
+                    'alarm:cost-anomaly',
+                    'alarm:performance-load-cleanup-backlog',
+                    'alarm:performance-load-cleanup-deadline',
+                ],
+                capacityControls: [
+                    'control:api-lambda-concurrency',
+                    'control:async-worker-concurrency',
+                    'control:database-connections',
+                    'control:service-extension-concurrency',
+                ],
+                capacitySignals: [
+                    'adopter:service-saturation-percent',
+                    'database:connection-utilization-percent',
+                    'database:protected-async-backlog-utilization-percent',
+                    'runtime:nodejs-heap-utilization-percent',
+                ],
+                status: 'requires-adopter-values-and-live-evidence',
+            },
+            remediation: {
+                adapter: 'protected-async-recovery',
+                approvalRequired: true,
+                runbookRef: 'runbook:incident-remediation',
+                supportedApplyActions: ['redrive', 'replay'],
+            },
+            schemaVersion: 1,
+            slice: name,
+            sloRef: 'docs:reliability/slo.json',
+            runtimeSmoke: {
+                aggregateOwner: 'testing-evidence',
+                deployedResourceClass: 'testing-evidence-not-cloudwatch-alarm',
+                evidenceKind: 'testing-evidence-result',
+                metricOwner: 'not-provisioned-by-reliability',
+                reporter: 'testing-evidence-native-not-reliability-exercise-report',
+                target: 'smoke-deployed',
+            },
+            workloadCoverage: [
+                { kind: 'lambda-api', registration: 'api-fast-burn' },
+                { kind: 'function', registration: 'function-failure' },
+                { kind: 'next', registration: 'web-latency-fast-burn' },
+                {
+                    kind: 'service',
+                    registration: 'required-when-generated-by-ebk-workload-service-health',
+                },
+                {
+                    kind: 'job',
+                    registration: 'required-when-generated-by-ebk-workload-job-failure',
+                },
+                { kind: 'queue-dlq', registration: 'provider-queue-age' },
+                { kind: 'database', registration: 'database-capacity' },
+                {
+                    kind: 'built-in-retention-job',
+                    registration: 'retention-job-failure',
+                },
+                {
+                    kind: 'built-in-data-export-cleanup',
+                    registration: 'data-export-cleanup-failure',
+                },
+                {
+                    kind: 'deployed-smoke',
+                    registration: 'testing-evidence-aggregate',
+                },
+                {
+                    kind: 'alert-delivery',
+                    registration: 'alert-delivery-degraded',
+                },
+            ],
+        }),
+        'testing/reliability-exercises.json': (0, built_in_plan_shared_js_1.json)({
+            exercises,
+            schemaVersion: 1,
+            slice: name,
+        }),
+        'operations/incident-template.json': (0, built_in_plan_shared_js_1.json)({
+            affectedJourneyIds: ['api-critical-operation'],
+            declaredAt: reviewedAt,
+            followUpRefs: ['replace-with-owned-work-reference'],
+            id: `${name}-incident-template`,
+            impact: 'Replace with confirmed user or operator impact.',
+            roles: {
+                communicationsOwner: 'unassigned-human',
+                incidentCommander: 'unassigned-human',
+                scribe: 'unassigned',
+                technicalLead: 'unassigned-human',
+            },
+            severity: 'SEV-4',
+            slice: name,
+            state: 'declared',
+            timeline: [
+                {
+                    actor: 'unassigned-human',
+                    at: reviewedAt,
+                    evidenceRefs: ['replace-with-sanitized-evidence-reference'],
+                    message: 'Template only: confirm impact and explicitly declare the incident.',
+                    type: 'decision',
+                },
+            ],
+        }),
+        'reliability/contract.ts': `import {
+  validateReliabilityContract,
+} from '@empire-builder-kit/runtime/reliability';
+import declaration from '../docs/reliability/slo.json';
+
+export const Reliability = validateReliabilityContract(declaration);
+`,
+        'reliability/metrics.ts': `import {
+  createMetricEmitter,
+  type MetricEmitter,
+  type MetricOutcome,
+} from '@empire-builder-kit/runtime/observability';
+
+export interface ReliabilityOperation {
+  component: string;
+  durationMilliseconds: number;
+  feature: string;
+  good?: boolean;
+  operation: string;
+  outcome: MetricOutcome;
+}
+
+export function recordReliabilityOperation(
+  input: ReliabilityOperation,
+  metrics: MetricEmitter = createMetricEmitter(),
+) {
+  const dimensions = {
+    component: input.component,
+    feature: input.feature,
+    operation: input.operation,
+    slice: '${name}',
+    stage: process.env.EBK_STAGE ?? 'development',
+  };
+  const valid = metrics.emit({
+    dimensions,
+    metricName: 'OperationValid',
+    unit: 'Count',
+    value: 1,
+  });
+  const good = metrics.emit({
+    dimensions,
+    metricName: 'OperationGood',
+    unit: 'Count',
+    value: (input.good ?? input.outcome === 'success') ? 1 : 0,
+  });
+  const latency = metrics.emit({
+    dimensions,
+    metricName: 'OperationDuration',
+    unit: 'Milliseconds',
+    value: input.durationMilliseconds,
+  });
+  return { good, latency, valid };
+}
+`,
+        'infra/reliability.ts': `import {
+  createSloBurnAlarmPlan,
+} from '@empire-builder-kit/runtime/reliability';
+import { Reliability } from '../reliability/contract.js';
+
+export interface ReliabilityInfrastructureInput {
+  alertTopicArn: any;
+  alertTopicName: any;
+  apiId: any;
+  databaseClusterIdentifier: any;
+  functionName: any;
+  providerQueueName: any;
+}
+
+function alarmDescription(input: {
+  businessSymptom: string;
+  id: string;
+  owner: string;
+  route: string;
+  runbook: string;
+}) {
+  return JSON.stringify({
+    businessSymptom: input.businessSymptom,
+    id: input.id,
+    owner: input.owner,
+    route: input.route,
+    runbook: input.runbook,
+    schemaVersion: 1,
+    slice: '${name}',
+  });
+}
+
+export function create${pascalName}Reliability(
+  input: ReliabilityInfrastructureInput,
+) {
+  const apiObjective = Reliability.objectives.find(
+    ({ id }) => id === 'api-availability',
+  );
+  const webObjective = Reliability.objectives.find(
+    ({ id }) => id === 'web-latency',
+  );
+  if (!apiObjective || !webObjective) {
+    throw new Error('Generated reliability objectives are incomplete.');
+  }
+  const apiBurn = createSloBurnAlarmPlan(apiObjective, {
+    bad: {
+      dimensions: { ApiId: input.apiId },
+      metricName: '5xx',
+      namespace: 'AWS/ApiGateway',
+      stat: 'Sum',
+    },
+    valid: {
+      dimensions: { ApiId: input.apiId },
+      metricName: 'Count',
+      namespace: 'AWS/ApiGateway',
+      stat: 'Sum',
+    },
+  });
+  const webDimensions = {
+    Component: 'next-server',
+    Feature: 'web',
+    Operation: 'request',
+    Slice: '${name}',
+    Stage: $app.stage,
+  };
+  const webBurn = createSloBurnAlarmPlan(webObjective, {
+    good: {
+      dimensions: webDimensions,
+      metricName: 'OperationGood',
+      namespace: 'EBK/${name}',
+      stat: 'Sum',
+    },
+    valid: {
+      dimensions: webDimensions,
+      metricName: 'OperationValid',
+      namespace: 'EBK/${name}',
+      stat: 'Sum',
+    },
+  });
+  const apiFastBurn = new aws.cloudwatch.MetricAlarm(
+    '${pascalName}ApiFastBurn',
+    {
+      alarmActions: [input.alertTopicArn],
+      alarmDescription: alarmDescription({
+        businessSymptom: 'Critical API operations are failing.',
+        id: 'api-fast-burn',
+        owner: '${name}-product',
+        route: '${name}-on-call',
+        runbook: 'docs/runbooks/api-recovery.md',
+      }),
+      comparisonOperator: 'GreaterThanOrEqualToThreshold',
+      datapointsToAlarm: 1,
+      evaluationPeriods: 1,
+      metricQueries: [...apiBurn.fast.metricQueries],
+      name: '${name}-' + $app.stage + '-api-fast-burn',
+      threshold: apiBurn.fast.burnThreshold,
+      treatMissingData: 'missing',
+    },
+  );
+  const apiSlowBurn = new aws.cloudwatch.MetricAlarm(
+    '${pascalName}ApiSlowBurn',
+    {
+      alarmActions: [input.alertTopicArn],
+      alarmDescription: alarmDescription({
+        businessSymptom: 'Critical API operations have sustained failures.',
+        id: 'api-slow-burn',
+        owner: '${name}-product',
+        route: '${name}-on-call',
+        runbook: 'docs/runbooks/api-recovery.md',
+      }),
+      comparisonOperator: 'GreaterThanOrEqualToThreshold',
+      datapointsToAlarm: 1,
+      evaluationPeriods: 1,
+      metricQueries: [...apiBurn.slow.metricQueries],
+      name: '${name}-' + $app.stage + '-api-slow-burn',
+      threshold: apiBurn.slow.burnThreshold,
+      treatMissingData: 'missing',
+    },
+  );
+  const webLatency = new aws.cloudwatch.MetricAlarm(
+    '${pascalName}WebLatencyBurn',
+    {
+      alarmActions: [input.alertTopicArn],
+      alarmDescription: alarmDescription({
+        businessSymptom: 'Server-rendered routes exceed the latency objective.',
+        id: 'web-latency-fast-burn',
+        owner: '${name}-product',
+        route: '${name}-on-call',
+        runbook: 'docs/runbooks/web-recovery.md',
+      }),
+      comparisonOperator: 'GreaterThanOrEqualToThreshold',
+      datapointsToAlarm: 1,
+      evaluationPeriods: 1,
+      metricQueries: [...webBurn.fast.metricQueries],
+      name: '${name}-' + $app.stage + '-web-latency-fast-burn',
+      threshold: webBurn.fast.burnThreshold,
+      treatMissingData: 'missing',
+    },
+  );
+  const webLatencySlow = new aws.cloudwatch.MetricAlarm(
+    '${pascalName}WebLatencySlowBurn',
+    {
+      alarmActions: [input.alertTopicArn],
+      alarmDescription: alarmDescription({
+        businessSymptom: 'Server-rendered routes have sustained latency degradation.',
+        id: 'web-latency-slow-burn',
+        owner: '${name}-product',
+        route: '${name}-on-call',
+        runbook: 'docs/runbooks/web-recovery.md',
+      }),
+      comparisonOperator: 'GreaterThanOrEqualToThreshold',
+      datapointsToAlarm: 1,
+      evaluationPeriods: 1,
+      metricQueries: [...webBurn.slow.metricQueries],
+      name: '${name}-' + $app.stage + '-web-latency-slow-burn',
+      threshold: webBurn.slow.burnThreshold,
+      treatMissingData: 'missing',
+    },
+  );
+  const providerDeadline = new aws.cloudwatch.MetricAlarm(
+    '${pascalName}ProviderDeadline',
+    {
+      alarmActions: [input.alertTopicArn],
+      alarmDescription: alarmDescription({
+        businessSymptom: 'Accepted provider work is missing its deadline.',
+        id: 'provider-queue-age',
+        owner: '${name}-product',
+        route: '${name}-on-call',
+        runbook: 'docs/runbooks/async-recovery.md',
+      }),
+      comparisonOperator: 'GreaterThanOrEqualToThreshold',
+      dimensions: { QueueName: input.providerQueueName },
+      evaluationPeriods: 2,
+      metricName: 'ApproximateAgeOfOldestMessage',
+      name: '${name}-' + $app.stage + '-provider-deadline',
+      namespace: 'AWS/SQS',
+      period: 300,
+      statistic: 'Maximum',
+      threshold: 900,
+      treatMissingData: 'missing',
+    },
+  );
+  const databaseCapacity = new aws.cloudwatch.MetricAlarm(
+    '${pascalName}DatabaseCapacity',
+    {
+      alarmActions: [input.alertTopicArn],
+      alarmDescription: alarmDescription({
+        businessSymptom: 'The shared database is approaching its reviewed capacity bound.',
+        id: 'database-capacity',
+        owner: '${name}-product',
+        route: '${name}-on-call',
+        runbook: 'docs/runbooks/database-recovery.md',
+      }),
+      comparisonOperator: 'GreaterThanOrEqualToThreshold',
+      dimensions: { DBClusterIdentifier: input.databaseClusterIdentifier },
+      evaluationPeriods: 3,
+      metricName: 'ServerlessDatabaseCapacity',
+      name: '${name}-' + $app.stage + '-database-capacity',
+      namespace: 'AWS/RDS',
+      period: 300,
+      statistic: 'Maximum',
+      threshold: 3.5,
+      treatMissingData: 'missing',
+    },
+  );
+  const functionFailure = new aws.cloudwatch.MetricAlarm(
+    '${pascalName}FunctionFailure',
+    {
+      alarmActions: [input.alertTopicArn],
+      alarmDescription: alarmDescription({
+        businessSymptom: 'A generated Function has a terminal invocation error.',
+        id: 'function-failure',
+        owner: '${name}-product',
+        route: '${name}-on-call',
+        runbook: 'docs/runbooks/api-recovery.md',
+      }),
+      comparisonOperator: 'GreaterThanOrEqualToThreshold',
+      dimensions: { FunctionName: input.functionName },
+      evaluationPeriods: 1,
+      metricName: 'Errors',
+      name: '${name}-' + $app.stage + '-function-failure',
+      namespace: 'AWS/Lambda',
+      period: 60,
+      statistic: 'Sum',
+      threshold: 1,
+      treatMissingData: 'notBreaching',
+    },
+  );
+  const alertDelivery = new aws.cloudwatch.MetricAlarm(
+    '${pascalName}AlertDelivery',
+    {
+      alarmDescription: alarmDescription({
+        businessSymptom: 'The primary alert route is failing delivery.',
+        id: 'alert-delivery-degraded',
+        owner: '${name}-product',
+        route: '${name}-on-call',
+        runbook: 'docs/runbooks/alert-delivery.md',
+      }),
+      comparisonOperator: 'GreaterThanOrEqualToThreshold',
+      dimensions: { TopicName: input.alertTopicName },
+      evaluationPeriods: 1,
+      metricName: 'NumberOfNotificationsFailed',
+      name: '${name}-' + $app.stage + '-alert-delivery-degraded',
+      namespace: 'AWS/SNS',
+      okActions: [],
+      period: 300,
+      statistic: 'Sum',
+      threshold: 1,
+      treatMissingData: 'notBreaching',
+    },
+  );
+  return {
+    alertDelivery,
+    apiFastBurn,
+    apiSlowBurn,
+    databaseCapacity,
+    functionFailure,
+    providerDeadline,
+    webLatency,
+    webLatencySlow,
+  };
+}
+`,
+        'docs/runbooks/reliability-diagnostic.md': `# Reliability diagnostic
+
+The stable-v1 generated adapter supports exactly three approval-free sources:
+alarm state, sanitized SLO metric signals, and bounded ECS or Step Functions
+resource metadata. It executes read-only \`DescribeAlarms\`,
+\`GetMetricData\`, \`DescribeServices\`, and \`DescribeExecution\` calls
+against one exact target and immutable deployment binding. Dashboard, generic
+health, cost, and runbook lookups are not claimed as executable diagnostic
+sources. The adapter does not accept arbitrary metric expressions or resource
+scans, read application log contents, or unmask data.
+
+Before an AWS read, the adapter requires a protected GitHub Actions context and
+selects the requested workload only through
+\`.ebk/evidence/reliability/active-bindings.json\`. That protected
+deployed-smoke index must name the current checked-out source commit and exact
+repository. The adapter then recomputes the binding from the exact
+deployed-smoke, active protected-release, and release-manifest artifact bytes.
+The binding also carries the environment-reviewed alarm, API, ECS, and Step
+Functions resource allowlist. A stale binding or substituted resource fails
+before its service query.
+
+Sanitized metric capture is limited to six hours and produces
+\`reliability-slo-diagnostic-sample\`. It reports the declared objective window
+beside the sampled window but never claims that the sample proves the rolling
+28-day SLO. The report derives staging or production provenance from the active
+binding; callers cannot label it.
+
+A bounded log query requires a human approval naming the approver, invoking
+human, incident, reason, account, region, stage, Slice, exact log groups, query
+class, time window, and expiry. The approved query window is at most one hour.
+The script returns an authorization plan; the existing protected query runner
+retains attributable evidence. Empty results never prove recovery.
+`,
+        'docs/runbooks/incident-remediation.md': `# Approval-gated incident remediation
+
+Use \`scripts/incident-remediation.mjs\` in report mode first. The report binds
+one action, account, region, stage, Slice, preconditions, stop conditions,
+verification, cleanup, adapter choice, and any adapter evidence through an
+internally computed SHA-256 remediation-plan digest. That digest is distinct
+from the async-recovery report digest consumed by redrive or replay.
+
+Apply requires an unexpired human approval bound to that exact report, action,
+and target plus protected GitHub OIDC on the approved commit. The stable-v1
+adapter supports bounded async redrive or replay through the generated
+protected async-recovery path; its own resource, rate, idempotency, alarm,
+cleanup, and evidence controls still apply. Other remediation paths remain
+report-only until separately implemented. Stop when the active target or
+approved report changes.
+`,
+        'docs/runbooks/api-recovery.md': `# API recovery
+
+Confirm customer impact, API validity classification, recent release and
+configuration identity, database/dependency health, and correlated sanitized
+signals. Prefer a verified roll-forward. A source revert must traverse the
+normal develop-to-staging evidence path before protected production promotion.
+Verify the critical API journey and data invariants before resolution.
+`,
+        'docs/runbooks/web-recovery.md': `# Web recovery
+
+Confirm the server-rendered route, deployed release, configuration digest,
+origin, cache class, and dependency state. Compare cold and warm paths without
+combining their populations. Verify headers, authentication, keyboard/focus,
+responsive layout, reduced motion, and the user journey after recovery.
+`,
+        'docs/runbooks/alert-delivery.md': `# Alert delivery recovery
+
+The generated SNS delivery-failure alarm is diagnostic-only: it deliberately
+has no action on the route whose failure it observes. Record delivery as
+\`requested\` or \`unsupported\`; never promote it to \`confirmed\` without a
+receipt captured from an independently configured provider or route. Do not
+disable customer-impact alarms. Repair or select an approved independent route,
+send one bounded proof, and retain its provider receipt before resolving.
+`,
+        'scripts/reliability-evidence-lib.mjs': `import { createHash } from 'node:crypto';
+import { isBoundedSafeReference } from '@empire-builder-kit/runtime/safe-reference';
+import {
+  lstatSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync,
+} from 'node:fs';
+import { relative, resolve, sep } from 'node:path';
+
+export const MAX_RELIABILITY_ARTIFACT_BYTES = 64 * 1024;
+const DIGEST = /^[a-f0-9]{64}$/;
+
+export function sha256(bytes) {
+  return createHash('sha256').update(bytes).digest('hex');
+}
+
+export function exactKeys(value, allowed, label) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    throw new Error(label + ' must be an object.');
+  }
+  const unexpected = Object.keys(value).filter((key) => !allowed.includes(key));
+  if (unexpected.length > 0) {
+    throw new Error(label + ' contains unsupported fields: ' + unexpected.sort().join(', ') + '.');
+  }
+  return value;
+}
+
+export function safeToken(value, label, maximum = 512) {
+  if (
+    typeof value !== 'string' ||
+    value.length < 1 ||
+    value.length > maximum ||
+    !isBoundedSafeReference(value, 'repository-evidence') ||
+    value.includes('..') ||
+    value.includes('\\\\')
+  ) {
+    throw new Error(label + ' is not a bounded sanitized token.');
+  }
+  return value;
+}
+
+export function digest(value, label) {
+  if (typeof value !== 'string' || !DIGEST.test(value)) {
+    throw new Error(label + ' must be an exact SHA-256 digest.');
+  }
+  return value;
+}
+
+export function utc(value, label) {
+  if (
+    typeof value !== 'string' ||
+    value.length > 32 ||
+    !value.endsWith('Z') ||
+    !Number.isFinite(Date.parse(value))
+  ) {
+    throw new Error(label + ' must be a bounded UTC timestamp.');
+  }
+  return value;
+}
+
+export function readBoundedJson(path, label) {
+  const bytes = readFileSync(path);
+  if (bytes.length === 0 || bytes.length > MAX_RELIABILITY_ARTIFACT_BYTES) {
+    throw new Error(label + ' exceeds the reliability artifact size bound.');
+  }
+  let value;
+  try {
+    value = JSON.parse(bytes.toString('utf8'));
+  } catch {
+    throw new Error(label + ' is not valid JSON.');
+  }
+  return { bytes, value };
+}
+
+export function binding(value, label) {
+  const record = exactKeys(
+    value,
+    [
+      'candidateDigest',
+      'configurationDigest',
+      'deploymentDigest',
+      'releaseDigest',
+      'sourceCommit',
+      'workload',
+    ],
+    label,
+  );
+  const sourceCommit = safeToken(
+    record.sourceCommit,
+    label + '.sourceCommit',
+    40,
+  );
+  if (!/^[a-f0-9]{40}$/.test(sourceCommit)) {
+    throw new Error(label + '.sourceCommit must be an exact git commit.');
+  }
+  return {
+    candidateDigest: digest(record.candidateDigest, label + '.candidateDigest'),
+    configurationDigest: digest(
+      record.configurationDigest,
+      label + '.configurationDigest',
+    ),
+    deploymentDigest: digest(
+      record.deploymentDigest,
+      label + '.deploymentDigest',
+    ),
+    releaseDigest: digest(record.releaseDigest, label + '.releaseDigest'),
+    sourceCommit,
+    workload: safeToken(record.workload, label + '.workload', 128),
+  };
+}
+
+export function sameBinding(left, right) {
+  return (
+    left.candidateDigest === right.candidateDigest &&
+    left.configurationDigest === right.configurationDigest &&
+    left.deploymentDigest === right.deploymentDigest &&
+    left.releaseDigest === right.releaseDigest &&
+    left.sourceCommit === right.sourceCommit &&
+    left.workload === right.workload
+  );
+}
+
+function artifactReferencePath(value, label) {
+  const path = value;
+  if (
+    typeof path !== 'string' ||
+    path.length < 1 ||
+    path.length > 1024 ||
+    !/^(?:[A-Za-z0-9._-]+\\/)*[A-Za-z0-9._-]+$/.test(path) ||
+    path.startsWith('/') ||
+    path.split('/').includes('..')
+  ) {
+    throw new Error(label + ' must remain inside the Slice package.');
+  }
+  const root = resolve(process.cwd());
+  const absolute = resolve(root, path);
+  const within = relative(root, absolute);
+  if (within.startsWith('..' + sep) || within === '..') {
+    throw new Error(label + ' escapes the Slice package.');
+  }
+  return path;
+}
+
+export function artifactReference(value, label) {
+  const record = exactKeys(value, ['digest', 'path'], label);
+  const expectedDigest = digest(record.digest, label + '.digest');
+  const path = artifactReferencePath(record.path, label + '.path');
+  const absolute = resolve(process.cwd(), path);
+  const artifact = readBoundedJson(absolute, label);
+  const metadata = lstatSync(absolute);
+  if (!metadata.isFile() || metadata.isSymbolicLink()) {
+    throw new Error(label + ' must be a regular non-symlink artifact.');
+  }
+  if (sha256(artifact.bytes) !== expectedDigest) {
+    throw new Error(label + ' digest does not match its exact artifact bytes.');
+  }
+  return { ...artifact, digest: expectedDigest, path };
+}
+
+function reliabilityTarget(value, label) {
+  const target = exactKeys(
+    value,
+    ['account', 'region', 'slice', 'stage'],
+    label,
+  );
+  const account = safeToken(target.account, label + '.account', 12);
+  if (!/^\\d{12}$/.test(account)) {
+    throw new Error(label + '.account must be an exact AWS account ID.');
+  }
+  const stage = safeToken(target.stage, label + '.stage', 16);
+  if (!['staging', 'production'].includes(stage)) {
+    throw new Error(label + '.stage must be a protected stage.');
+  }
+  const slice = safeToken(target.slice, label + '.slice', 128);
+  if (slice !== '${name}') {
+    throw new Error(label + '.slice escaped the generated Slice.');
+  }
+  const region = safeToken(target.region, label + '.region', 64);
+  if (!/^[a-z]{2}(?:-[a-z]+)+-\\d$/.test(region)) {
+    throw new Error(label + '.region must be an exact AWS Region.');
+  }
+  return {
+    account,
+    region,
+    slice,
+    stage,
+  };
+}
+
+export function awsPartition(region) {
+  if (region.startsWith('cn-')) return 'aws-cn';
+  if (region.startsWith('us-gov-')) return 'aws-us-gov';
+  if (region.startsWith('us-isob-')) return 'aws-iso-b';
+  if (region.startsWith('us-isoe-')) return 'aws-iso-e';
+  if (region.startsWith('us-isof-')) return 'aws-iso-f';
+  if (region.startsWith('us-iso-')) return 'aws-iso';
+  if (region.startsWith('eusc-')) return 'aws-eusc';
+  return 'aws';
+}
+
+function reliabilityResources(value, target, label) {
+  const resources = exactKeys(
+    value,
+    ['alarmNames', 'apiId', 'ecsServices', 'stateMachineArns'],
+    label,
+  );
+  if (
+    !Array.isArray(resources.alarmNames) ||
+    resources.alarmNames.length < 1 ||
+    resources.alarmNames.length > 100 ||
+    new Set(resources.alarmNames).size !== resources.alarmNames.length
+  ) {
+    throw new Error(label + '.alarmNames must contain exact unique alarms.');
+  }
+  const alarmNames = resources.alarmNames
+    .map((value, index) =>
+      safeToken(value, label + '.alarmNames[' + index + ']', 255),
+    )
+    .sort();
+  if (
+    alarmNames.some(
+      (value) => !value.startsWith(target.slice + '-' + target.stage + '-'),
+    )
+  ) {
+    throw new Error(label + '.alarmNames escaped the exact Slice and stage.');
+  }
+  const apiId = safeToken(resources.apiId, label + '.apiId', 128);
+  if (!/^[a-z0-9]{1,128}$/.test(apiId)) {
+    throw new Error(label + '.apiId must be one exact API Gateway ID.');
+  }
+  if (
+    !Array.isArray(resources.ecsServices) ||
+    resources.ecsServices.length > 8
+  ) {
+    throw new Error(label + '.ecsServices exceeds its eight-cluster bound.');
+  }
+  const ecsServices = resources.ecsServices
+    .map((value, index) => {
+      const entry = exactKeys(
+        value,
+        ['cluster', 'services'],
+        label + '.ecsServices[' + index + ']',
+      );
+      const cluster = safeToken(
+        entry.cluster,
+        label + '.ecsServices[' + index + '].cluster',
+        512,
+      );
+      if (
+        !Array.isArray(entry.services) ||
+        entry.services.length < 1 ||
+        entry.services.length > 10 ||
+        new Set(entry.services).size !== entry.services.length
+      ) {
+        throw new Error(
+          label + '.ecsServices[' + index + '] has invalid services.',
+        );
+      }
+      const services = entry.services
+        .map((service, serviceIndex) =>
+          safeToken(
+            service,
+            label +
+              '.ecsServices[' +
+              index +
+              '].services[' +
+              serviceIndex +
+              ']',
+            255,
+          ),
+        )
+        .sort();
+      const clusterArnPrefix =
+        'arn:' +
+        awsPartition(target.region) +
+        ':ecs:' +
+        target.region +
+        ':' +
+        target.account +
+        ':cluster/';
+      if (
+        cluster.startsWith('arn:') &&
+        !cluster.startsWith(clusterArnPrefix)
+      ) {
+        throw new Error(
+          label + '.ecsServices[' + index + '] escaped the exact target.',
+        );
+      }
+      return { cluster, services };
+    })
+    .sort((left, right) =>
+      left.cluster < right.cluster
+        ? -1
+        : left.cluster > right.cluster
+          ? 1
+          : 0,
+    );
+  if (
+    new Set(ecsServices.map(({ cluster }) => cluster)).size !==
+    ecsServices.length
+  ) {
+    throw new Error(label + '.ecsServices repeats an exact cluster.');
+  }
+  if (
+    !Array.isArray(resources.stateMachineArns) ||
+    resources.stateMachineArns.length > 8 ||
+    new Set(resources.stateMachineArns).size !==
+      resources.stateMachineArns.length
+  ) {
+    throw new Error(
+      label + '.stateMachineArns exceeds its exact unique bound.',
+    );
+  }
+  const stateMachinePrefix =
+    'arn:' +
+    awsPartition(target.region) +
+    ':states:' +
+    target.region +
+    ':' +
+    target.account +
+    ':stateMachine:';
+  const stateMachineArns = resources.stateMachineArns
+    .map((value, index) =>
+      safeToken(value, label + '.stateMachineArns[' + index + ']', 512),
+    )
+    .sort();
+  if (
+    stateMachineArns.some(
+      (value) =>
+        !value.startsWith(stateMachinePrefix) ||
+        value.length === stateMachinePrefix.length,
+    )
+  ) {
+    throw new Error(label + '.stateMachineArns escaped the exact target.');
+  }
+  return {
+    alarmNames,
+    apiId,
+    ecsServices,
+    stateMachineArns,
+  };
+}
+
+export function authorizedExecutionArn(resources, executionArn) {
+  return resources.stateMachineArns.some((stateMachineArn) => {
+    const separator = ':stateMachine:';
+    const position = stateMachineArn.indexOf(separator);
+    if (position < 0) return false;
+    const executionPrefix =
+      stateMachineArn.slice(0, position) +
+      ':execution:' +
+      stateMachineArn.slice(position + separator.length) +
+      ':';
+    return executionArn.startsWith(executionPrefix);
+  });
+}
+
+function protectedDeploymentSource(reference, target, expectedSmoke) {
+  const deploymentReference = artifactReference(
+    reference,
+    'sources.deployment',
+  );
+  const deployment = exactKeys(
+    deploymentReference.value,
+    [
+      'deployment',
+      'kind',
+      'project',
+      'resources',
+      'schemaVersion',
+      'smoke',
+      'sourceCommit',
+      'stage',
+      'trigger',
+    ],
+    'Protected deployment binding',
+  );
+  const identity = exactKeys(
+    deployment.deployment,
+    [
+      'conclusion',
+      'event',
+      'headBranch',
+      'headSha',
+      'runAttempt',
+      'runId',
+      'workflow',
+    ],
+    'Protected deployment identity',
+  );
+  const smoke = exactKeys(
+    deployment.smoke,
+    ['runAttempt', 'runId', 'workflow'],
+    'Protected smoke identity',
+  );
+  const sourceCommit = safeToken(
+    deployment.sourceCommit,
+    'Protected deployment sourceCommit',
+    40,
+  );
+  const expectedBranch = target.stage === 'production' ? 'main' : 'develop';
+  if (
+    deployment.kind !== 'ebk-deployed-smoke-binding' ||
+    deployment.schemaVersion !== 1 ||
+    deployment.project !== '${name}' ||
+    deployment.stage !== target.stage ||
+    deployment.trigger !== 'deployment' ||
+    identity.conclusion !== 'success' ||
+    !['push', 'workflow_dispatch'].includes(identity.event) ||
+    identity.headBranch !== expectedBranch ||
+    identity.headSha !== sourceCommit ||
+    identity.workflow !== 'Deploy' ||
+    smoke.workflow !== 'Deployed smoke' ||
+    String(smoke.runId) !== expectedSmoke.runId ||
+    String(smoke.runAttempt) !== expectedSmoke.runAttempt ||
+    !/^\\d+$/.test(String(identity.runId ?? '')) ||
+    !/^\\d+$/.test(String(identity.runAttempt ?? '')) ||
+    !/^[a-f0-9]{40}$/.test(sourceCommit)
+  ) {
+    throw new Error(
+      'Protected deployment source does not prove the active Slice deployment.',
+    );
+  }
+  return {
+    reference: deploymentReference,
+    resources: reliabilityResources(
+      deployment.resources,
+      target,
+      'Protected deployment resources',
+    ),
+    runAttempt: String(identity.runAttempt),
+    runId: String(identity.runId),
+    sourceCommit,
+  };
+}
+
+function protectedReleaseSource(reference, target, deployment) {
+  const releaseReference = artifactReference(
+    reference,
+    'sources.release',
+  );
+  const release = exactKeys(
+    releaseReference.value,
+    [
+      'candidateDigest',
+      'deploymentCommit',
+      'kind',
+      'manifestDigest',
+      'releaseId',
+      'releaseMaterialDigest',
+      'releaseSourceCommit',
+      'runAttempt',
+      'runId',
+      'schemaVersion',
+      'stage',
+      'workflow',
+    ],
+    'Active protected release',
+  );
+  const releaseSourceCommit = safeToken(
+    release.releaseSourceCommit,
+    'Active protected release.releaseSourceCommit',
+    40,
+  );
+  if (
+    release.kind !== 'ebk-active-protected-release-binding' ||
+    release.schemaVersion !== 1 ||
+    release.stage !== target.stage ||
+    release.deploymentCommit !== deployment.sourceCommit ||
+    String(release.runId) !== deployment.runId ||
+    String(release.runAttempt) !== deployment.runAttempt ||
+    release.workflow !== 'Deploy' ||
+    !/^[a-f0-9]{40}$/.test(releaseSourceCommit)
+  ) {
+    throw new Error(
+      'Active release does not match the protected deployment identity.',
+    );
+  }
+  return {
+    candidateDigest: digest(
+      release.candidateDigest,
+      'Active protected release.candidateDigest',
+    ),
+    manifestDigest: digest(
+      release.manifestDigest,
+      'Active protected release.manifestDigest',
+    ),
+    reference: releaseReference,
+    releaseMaterialDigest: digest(
+      release.releaseMaterialDigest,
+      'Active protected release.releaseMaterialDigest',
+    ),
+    releaseSourceCommit,
+  };
+}
+
+function releaseManifestSource(reference, target, sourceCommit) {
+  const manifestReference = artifactReference(
+    reference,
+    'sources.manifest',
+  );
+  const manifest = exactKeys(
+    manifestReference.value,
+    [
+      'artifacts',
+      'blueprints',
+      'build',
+      'builtAt',
+      'configuration',
+      'contracts',
+      'controls',
+      'frameworkCandidate',
+      'infrastructure',
+      'initialLifecycle',
+      'kind',
+      'materialDigest',
+      'migrations',
+      'packageLockDigest',
+      'projects',
+      'releaseId',
+      'requiredTests',
+      'schemaVersion',
+      'secrets',
+      'source',
+      'supplyChain',
+      'toolchain',
+    ],
+    'Release manifest',
+  );
+  const source = exactKeys(
+    manifest.source,
+    ['commit', 'repository', 'treeDigest'],
+    'Release manifest source',
+  );
+  const infrastructure = exactKeys(
+    manifest.infrastructure,
+    [
+      'aggregateRisk',
+      'configurationMetadataDigest',
+      'materialDigest',
+      'policyProfileDigest',
+      'riskClasses',
+      'stage',
+      'tool',
+    ],
+    'Release manifest infrastructure',
+  );
+  if (
+    manifest.kind !== 'ebk-release-manifest' ||
+    manifest.schemaVersion !== 1 ||
+    source.commit !== sourceCommit ||
+    infrastructure.stage !== target.stage ||
+    !Array.isArray(manifest.projects) ||
+    !manifest.projects.includes('${name}') ||
+    !Array.isArray(manifest.configuration)
+  ) {
+    throw new Error(
+      'Release manifest does not match the protected deployment source.',
+    );
+  }
+  digest(manifest.materialDigest, 'Release manifest.materialDigest');
+  const configuration = manifest.configuration.filter(
+    (entry) => entry?.stage === target.stage,
+  );
+  if (configuration.length !== 1) {
+    throw new Error(
+      'Release manifest must contain one exact protected-stage configuration.',
+    );
+  }
+  const configured = exactKeys(
+    configuration[0],
+    ['digest', 'stage'],
+    'Release manifest configuration',
+  );
+  return {
+    configurationDigest: digest(
+      configured.digest,
+      'Release manifest configuration.digest',
+    ),
+    reference: manifestReference,
+  };
+}
+
+export function createReliabilityDeploymentBinding(
+  input,
+  expectedTarget,
+  expectedSmoke,
+) {
+  const request = exactKeys(
+    input,
+    ['schemaVersion', 'sources', 'workload'],
+    'Reliability deployment binding input',
+  );
+  if (request.schemaVersion !== 1) {
+    throw new Error('Reliability deployment binding input is incompatible.');
+  }
+  const target = reliabilityTarget(expectedTarget, 'target');
+  const sources = exactKeys(
+    request.sources,
+    ['deployment', 'manifest', 'release'],
+    'Reliability deployment sources',
+  );
+  const smoke = exactKeys(
+    expectedSmoke,
+    ['runAttempt', 'runId'],
+    'expectedSmoke',
+  );
+  for (const [name, value] of Object.entries(smoke)) {
+    if (!/^\\d+$/.test(String(value ?? ''))) {
+      throw new Error('expectedSmoke.' + name + ' must be an exact run number.');
+    }
+  }
+  const deployment = protectedDeploymentSource(sources.deployment, target, {
+    runAttempt: String(smoke.runAttempt),
+    runId: String(smoke.runId),
+  });
+  const release = protectedReleaseSource(
+    sources.release,
+    target,
+    deployment,
+  );
+  const manifest = releaseManifestSource(
+    sources.manifest,
+    target,
+    release.releaseSourceCommit,
+  );
+  if (
+    release.manifestDigest !== manifest.reference.digest ||
+    release.releaseMaterialDigest !==
+      manifest.reference.value.materialDigest
+  ) {
+    throw new Error(
+      'Active release does not bind the exact release manifest bytes.',
+    );
+  }
+  return {
+    binding: {
+      candidateDigest: release.candidateDigest,
+      configurationDigest: manifest.configurationDigest,
+      deploymentDigest: deployment.reference.digest,
+      releaseDigest: manifest.reference.digest,
+      sourceCommit: release.releaseSourceCommit,
+      workload: safeToken(request.workload, 'workload', 128),
+    },
+    kind: 'reliability-active-deployment-binding',
+    resources: deployment.resources,
+    schemaVersion: 1,
+    slice: '${name}',
+    smoke: {
+      runAttempt: String(smoke.runAttempt),
+      runId: String(smoke.runId),
+    },
+    sources: {
+      deployment: {
+        digest: deployment.reference.digest,
+        path: deployment.reference.path,
+      },
+      manifest: {
+        digest: manifest.reference.digest,
+        path: manifest.reference.path,
+      },
+      release: {
+        digest: release.reference.digest,
+        path: release.reference.path,
+      },
+    },
+    target,
+  };
+}
+
+export function activeDeploymentBinding(reference, label) {
+  if (
+    process.env.GITHUB_ACTIONS !== 'true' ||
+    process.env.GITHUB_REF_PROTECTED !== 'true'
+  ) {
+    throw new Error(
+      'AWS reliability access requires one protected GitHub Actions context.',
+    );
+  }
+  const requested = exactKeys(reference, ['digest', 'path'], label);
+  const indexPath = '.ebk/evidence/reliability/active-bindings.json';
+  const indexAbsolute = resolve(process.cwd(), indexPath);
+  const indexArtifact = readBoundedJson(
+    indexAbsolute,
+    'Protected reliability binding index',
+  );
+  const indexMetadata = lstatSync(indexAbsolute);
+  if (!indexMetadata.isFile() || indexMetadata.isSymbolicLink()) {
+    throw new Error(
+      'Protected reliability binding index must be a regular non-symlink artifact.',
+    );
+  }
+  const index = exactKeys(
+    indexArtifact.value,
+    [
+      'authority',
+      'bindings',
+      'kind',
+      'schemaVersion',
+      'slice',
+      'stage',
+      'target',
+    ],
+    'Protected reliability binding index',
+  );
+  const authority = exactKeys(
+    index.authority,
+    [
+      'repository',
+      'runAttempt',
+      'runId',
+      'sourceCommit',
+      'workflow',
+    ],
+    'Protected reliability binding authority',
+  );
+  const sourceCommit = safeToken(
+    authority.sourceCommit,
+    'Protected reliability binding authority.sourceCommit',
+    40,
+  );
+  const repository = safeToken(
+    authority.repository,
+    'Protected reliability binding authority.repository',
+    256,
+  );
+  if (
+    index.kind !== 'reliability-active-binding-index' ||
+    index.schemaVersion !== 1 ||
+    index.slice !== '${name}' ||
+    !['staging', 'production'].includes(index.stage) ||
+    authority.workflow !== 'Deployed smoke' ||
+    !/^\\d+$/.test(String(authority.runId ?? '')) ||
+    !/^\\d+$/.test(String(authority.runAttempt ?? '')) ||
+    !/^[a-f0-9]{40}$/.test(sourceCommit) ||
+    !/^[A-Za-z0-9_.-]+\\/[A-Za-z0-9_.-]+$/.test(repository) ||
+    process.env.EBK_RELIABILITY_AUTHORIZED_SOURCE_COMMIT !== sourceCommit ||
+    process.env.EBK_RELIABILITY_AUTHORIZED_SMOKE_RUN_ID !==
+      String(authority.runId) ||
+    process.env.EBK_RELIABILITY_AUTHORIZED_SMOKE_RUN_ATTEMPT !==
+      String(authority.runAttempt) ||
+    process.env.GITHUB_REPOSITORY !== repository
+  ) {
+    throw new Error(
+      'Protected reliability binding index is stale or lacks current workflow authority.',
+    );
+  }
+  const indexTarget = reliabilityTarget(
+    {
+      ...index.target,
+      slice: index.slice,
+      stage: index.stage,
+    },
+    'Protected reliability binding index target',
+  );
+  if (
+    !Array.isArray(index.bindings) ||
+    index.bindings.length < 1 ||
+    index.bindings.length > 128
+  ) {
+    throw new Error(
+      'Protected reliability binding index has invalid workload coverage.',
+    );
+  }
+  const indexedBindings = index.bindings.map((value, entryIndex) => {
+    const entry = exactKeys(
+      value,
+      ['digest', 'path', 'workload'],
+      'Protected reliability binding index.bindings[' +
+        entryIndex +
+        ']',
+    );
+    return {
+      digest: digest(
+        entry.digest,
+        'Protected reliability binding index.bindings.digest',
+      ),
+      path: artifactReferencePath(
+        entry.path,
+        'Protected reliability binding index.bindings.path',
+      ),
+      workload: safeToken(
+        entry.workload,
+        'Protected reliability binding index.bindings.workload',
+        128,
+      ),
+    };
+  });
+  if (
+    new Set(
+      indexedBindings.map(
+        ({ digest: artifactDigest, path }) => artifactDigest + ':' + path,
+      ),
+    ).size !== indexedBindings.length ||
+    new Set(indexedBindings.map(({ workload }) => workload)).size !==
+      indexedBindings.length
+  ) {
+    throw new Error(
+      'Protected reliability binding index contains ambiguous bindings.',
+    );
+  }
+  const indexed = indexedBindings.filter(
+    ({ digest: artifactDigest, path }) =>
+      artifactDigest === requested.digest && path === requested.path,
+  );
+  if (indexed.length !== 1) {
+    throw new Error(
+      'Requested reliability binding is not selected by the protected current index.',
+    );
+  }
+  const active = artifactReference(requested, label);
+  const document = exactKeys(
+    active.value,
+    [
+      'binding',
+      'kind',
+      'resources',
+      'schemaVersion',
+      'slice',
+      'smoke',
+      'sources',
+      'target',
+    ],
+    'Active reliability deployment binding',
+  );
+  const target = reliabilityTarget(
+    document.target,
+    'Active reliability deployment binding target',
+  );
+  const capturedBinding = binding(
+    document.binding,
+    'Active reliability deployment binding.binding',
+  );
+  const expected = createReliabilityDeploymentBinding(
+    {
+      schemaVersion: 1,
+      sources: document.sources,
+      workload: capturedBinding.workload,
+    },
+    target,
+    document.smoke,
+  );
+  if (
+    document.kind !== expected.kind ||
+    document.schemaVersion !== 1 ||
+    document.slice !== '${name}' ||
+    capturedBinding.sourceCommit !== sourceCommit ||
+    capturedBinding.workload !== indexed[0].workload ||
+    target.account !== indexTarget.account ||
+    target.region !== indexTarget.region ||
+    target.stage !== indexTarget.stage ||
+    JSON.stringify(document) !== JSON.stringify(expected)
+  ) {
+    throw new Error(
+      'Active reliability deployment binding is stale or was substituted.',
+    );
+  }
+  return {
+    binding: capturedBinding,
+    authorityDigest: sha256(indexArtifact.bytes),
+    digest: active.digest,
+    document,
+    path: active.path,
+    resources: reliabilityResources(
+      document.resources,
+      target,
+      'Active reliability deployment binding.resources',
+    ),
+    target,
+  };
+}
+
+export function writeImmutableArtifact(directory, value) {
+  const bytes = Buffer.from(JSON.stringify(value, null, 2) + '\\n');
+  if (bytes.length > MAX_RELIABILITY_ARTIFACT_BYTES) {
+    throw new Error('Reliability artifact exceeds its output size bound.');
+  }
+  const artifactDigest = sha256(bytes);
+  const relativePath = directory + '/' + artifactDigest + '.json';
+  const absolute = resolve(process.cwd(), relativePath);
+  mkdirSync(resolve(process.cwd(), directory), {
+    mode: 0o700,
+    recursive: true,
+  });
+  try {
+    writeFileSync(absolute, bytes, { flag: 'wx', mode: 0o600 });
+  } catch (error) {
+    if (!readFileSync(absolute).equals(bytes)) throw error;
+  }
+  return { digest: artifactDigest, path: relativePath };
+}
+`,
+        'scripts/create-reliability-deployment-binding.mjs': `import {
+  createReliabilityDeploymentBinding,
+  exactKeys,
+  readBoundedJson,
+  writeImmutableArtifact,
+} from './reliability-evidence-lib.mjs';
+
+const inputPath =
+  process.env.EBK_RELIABILITY_BINDING_INPUT_PATH?.trim();
+if (!inputPath) {
+  throw new Error('EBK_RELIABILITY_BINDING_INPUT_PATH is required.');
+}
+const required = (name, pattern) => {
+  const value = process.env[name]?.trim();
+  if (!value || !pattern.test(value)) {
+    throw new Error(name + ' is required and outside its exact bound.');
+  }
+  return value;
+};
+const input = exactKeys(
+  readBoundedJson(inputPath, 'Reliability deployment binding input').value,
+  ['schemaVersion', 'sources', 'workload'],
+  'Reliability deployment binding input',
+);
+const document = createReliabilityDeploymentBinding(input, {
+  account: required('AWS_EXPECTED_ACCOUNT_ID', /^\\d{12}$/),
+  region: required('AWS_REGION', /^[a-z]{2}(?:-[a-z]+)+-\\d$/),
+  slice: '${name}',
+  stage: required('EBK_STAGE', /^(?:staging|production)$/),
+}, {
+  runAttempt: required('EBK_SMOKE_RUN_ATTEMPT', /^\\d+$/),
+  runId: required('EBK_SMOKE_RUN_ID', /^\\d+$/),
+});
+const reference = writeImmutableArtifact(
+  '.ebk/evidence/reliability/bindings',
+  document,
+);
+process.stdout.write(
+  JSON.stringify({ ...reference, ...document }) + '\\n',
+);
+`,
+        'scripts/verify-reliability.mjs': `import {
+  CloudWatchClient,
+  DescribeAlarmsCommand,
+} from '@aws-sdk/client-cloudwatch';
+import {
+  GetCallerIdentityCommand,
+  STSClient,
+} from '@aws-sdk/client-sts';
+import { readFileSync } from 'node:fs';
+import { awsPartition } from './reliability-evidence-lib.mjs';
+import {
+  validateAlarmRegistrationMetadata,
+  validateIncidentRecord,
+  validateReliabilityContract,
+} from '@empire-builder-kit/runtime/reliability';
+
+const slo = JSON.parse(
+  readFileSync(new URL('../docs/reliability/slo.json', import.meta.url), 'utf8'),
+);
+const operations = JSON.parse(
+  readFileSync(new URL('../operations/reliability.json', import.meta.url), 'utf8'),
+);
+const incident = JSON.parse(
+  readFileSync(new URL('../operations/incident-template.json', import.meta.url), 'utf8'),
+);
+const contract = validateReliabilityContract(slo);
+validateIncidentRecord(incident);
+if (
+  operations?.schemaVersion !== 1 ||
+  operations?.slice !== '${name}' ||
+  operations?.sloRef !== 'docs:reliability/slo.json' ||
+  operations?.consoleIndependent !== true
+) {
+  throw new Error('Reliability operations registration is incompatible.');
+}
+if (!Array.isArray(operations.alarmRegistrations)) {
+  throw new Error('Reliability alarm registrations are absent.');
+}
+const alarmRegistrations = operations.alarmRegistrations.map(
+  validateAlarmRegistrationMetadata,
+);
+const registered = new Set(alarmRegistrations.map((alarm) => alarm.id));
+if (registered.size !== alarmRegistrations.length) {
+  throw new Error('Reliability alarm registrations contain duplicate IDs.');
+}
+for (const objective of contract.objectives) {
+  for (const alarmId of objective.references.alarmIds) {
+    if (!registered.has(alarmId)) {
+      throw new Error(
+        'SLO objective ' + objective.id + ' references an unregistered alarm.',
+      );
+    }
+  }
+}
+const requiredCoverage = [
+  'alert-delivery',
+  'built-in-retention-job',
+  'deployed-smoke',
+  'function',
+  'job',
+  'service',
+];
+if (requiredCoverage.some(
+  (kind) => !operations.workloadCoverage?.some((entry) => entry.kind === kind),
+)) {
+  throw new Error('Reliability workload coverage is incomplete.');
+}
+if (
+  operations.alertDelivery?.mode !== 'diagnostic-only' ||
+  operations.alertDelivery?.confirmation !==
+    'unsupported-until-independent-route-is-configured' ||
+  operations.runtimeSmoke?.aggregateOwner !== 'testing-evidence' ||
+  operations.runtimeSmoke?.deployedResourceClass !==
+    'testing-evidence-not-cloudwatch-alarm' ||
+  operations.runtimeSmoke?.reporter !==
+    'testing-evidence-native-not-reliability-exercise-report' ||
+  operations.runtimeSmoke?.target !== 'smoke-deployed'
+) {
+  throw new Error(
+    'Alert-delivery or deployed-smoke ownership is overstated.',
+  );
+}
+
+let deployed = false;
+if (process.argv.includes('--deployed')) {
+  const required = (key) => {
+    const value = process.env[key]?.trim();
+    if (!value || !/^[A-Za-z0-9._:/-]{1,128}$/.test(value)) {
+      throw new Error(key + ' is required for deployed verification.');
+    }
+    return value;
+  };
+  const account = required('AWS_EXPECTED_ACCOUNT_ID');
+  const region = required('AWS_REGION');
+  const stage = required('EBK_STAGE');
+  const partition = awsPartition(region);
+  const identity = await new STSClient({ region }).send(
+    new GetCallerIdentityCommand({}),
+  );
+  if (
+    identity.Account !== account ||
+    !identity.Arn?.startsWith('arn:' + partition + ':sts::' + account + ':')
+  ) {
+    throw new Error(
+      'AWS caller identity does not match deployed reliability verification.',
+    );
+  }
+  const expected = operations.deployedAlarmResources?.map((resource) => ({
+    ...resource,
+    name: resource.name.replace('{stage}', stage),
+  }));
+  if (
+    !Array.isArray(expected) ||
+    expected.length < 1 ||
+    expected.length > 100 ||
+    new Set(expected.map(({ name }) => name)).size !== expected.length ||
+    new Set(expected.map(({ id }) => id)).size !== expected.length ||
+    expected.some(({ id }) => !registered.has(id))
+  ) {
+    throw new Error('Deployed alarm resource inventory is invalid.');
+  }
+  const response = await new CloudWatchClient({ region }).send(
+    new DescribeAlarmsCommand({
+      AlarmNames: expected.map(({ name }) => name),
+      MaxRecords: expected.length,
+    }),
+  );
+  if (response.NextToken) {
+    throw new Error('Deployed alarm verification exceeded its one-page bound.');
+  }
+  const alarms = response.MetricAlarms ?? [];
+  if (
+    alarms.length !== expected.length ||
+    new Set(alarms.map(({ AlarmName }) => AlarmName)).size !== alarms.length
+  ) {
+    throw new Error('Deployed alarm resource identity is absent or ambiguous.');
+  }
+  const primaryRouteArns = new Set();
+  for (const resource of expected) {
+    const alarm = alarms.find(({ AlarmName }) => AlarmName === resource.name);
+    const description = JSON.parse(alarm?.AlarmDescription ?? 'null');
+    if (
+      !alarm ||
+      alarm.AlarmArn !==
+        'arn:' +
+          partition +
+          ':cloudwatch:' +
+          region +
+          ':' +
+          account +
+          ':alarm:' +
+          resource.name ||
+      description?.id !== resource.id ||
+      description?.slice !== '${name}' ||
+      description?.schemaVersion !== 1 ||
+      description?.owner !== resource.owner ||
+      description?.route !== resource.route ||
+      description?.runbook !== resource.runbook
+    ) {
+      throw new Error(
+        'Deployed alarm does not match its exact AWS resource identity.',
+      );
+    }
+    if (
+      (resource.actions === 'none' && (alarm.AlarmActions?.length ?? 0) !== 0) ||
+      (resource.actions === 'primary-route' &&
+        (alarm.AlarmActions?.length ?? 0) !== 1)
+    ) {
+      throw new Error('Deployed alarm action route does not match policy.');
+    }
+    if (resource.actions === 'primary-route') {
+      const action = alarm.AlarmActions[0];
+      if (
+        typeof action !== 'string' ||
+        !action.startsWith(
+          'arn:' + partition + ':sns:' + region + ':' + account + ':',
+        )
+      ) {
+        throw new Error('Deployed alarm action escaped the exact AWS target.');
+      }
+      primaryRouteArns.add(action);
+    }
+    const metricDefinitions = [
+      ...(alarm.MetricName
+        ? [{
+            dimensions: alarm.Dimensions ?? [],
+            metricName: alarm.MetricName,
+            namespace: alarm.Namespace,
+            period: alarm.Period,
+            statistic: alarm.Statistic,
+          }]
+        : []),
+      ...(alarm.Metrics ?? [])
+        .filter(({ MetricStat }) => MetricStat?.Metric)
+        .map(({ MetricStat }) => ({
+          dimensions: MetricStat.Metric.Dimensions ?? [],
+          metricName: MetricStat.Metric.MetricName,
+          namespace: MetricStat.Metric.Namespace,
+          period: MetricStat.Period,
+          statistic: MetricStat.Stat,
+        })),
+    ];
+    const actualDimensionNames = [
+      ...new Set(
+        metricDefinitions.flatMap(({ dimensions }) =>
+          dimensions.map(({ Name }) => Name),
+        ),
+      ),
+    ].sort();
+    const dimensionValues = new Map();
+    let incompatibleDimensionValue = false;
+    for (const { dimensions } of metricDefinitions) {
+      for (const { Name, Value } of dimensions) {
+        if (
+          typeof Name !== 'string' ||
+          typeof Value !== 'string' ||
+          Value.length < 1 ||
+          Value.length > 1024 ||
+          (dimensionValues.has(Name) &&
+            dimensionValues.get(Name) !== Value)
+        ) {
+          incompatibleDimensionValue = true;
+        }
+        dimensionValues.set(Name, Value);
+      }
+    }
+    const expectedDimensionValues = Object.fromEntries(
+      Object.entries(resource.dimensionValues ?? {}).map(([key, value]) => [
+        key,
+        value.replace('{stage}', stage),
+      ]),
+    );
+    const actualMetricNames = [
+      ...new Set(metricDefinitions.map(({ metricName }) => metricName)),
+    ].sort();
+    const actualNamespaces = [
+      ...new Set(metricDefinitions.map(({ namespace }) => namespace)),
+    ];
+    const expectedMetricNames = (
+      resource.metricNames ?? [resource.metricName]
+    ).slice().sort();
+    if (
+      JSON.stringify(actualDimensionNames) !==
+        JSON.stringify(resource.dimensionNames.slice().sort()) ||
+      incompatibleDimensionValue ||
+      Object.entries(expectedDimensionValues).some(
+        ([key, value]) => dimensionValues.get(key) !== value,
+      ) ||
+      JSON.stringify(actualMetricNames) !==
+        JSON.stringify(expectedMetricNames) ||
+      actualNamespaces.length !== 1 ||
+      actualNamespaces[0] !== resource.namespace ||
+      alarm.ComparisonOperator !== resource.comparisonOperator ||
+      alarm.EvaluationPeriods !== resource.evaluationPeriods ||
+      alarm.Threshold !== resource.threshold ||
+      alarm.TreatMissingData !== resource.treatMissingData ||
+      (resource.period !== undefined &&
+        metricDefinitions.some(({ period }) => period !== resource.period)) ||
+      (resource.statistic !== undefined &&
+        metricDefinitions.some(
+          ({ statistic }) => statistic !== resource.statistic,
+        ))
+    ) {
+      throw new Error(
+        'Deployed alarm dimensions or AWS signal do not match inventory.',
+      );
+    }
+    if (
+      resource.signal === 'metric-math' &&
+      (
+        !Array.isArray(alarm.Metrics) ||
+        alarm.Metrics.filter(({ ReturnData }) => ReturnData).length !== 1 ||
+        (resource.objectiveId !== undefined &&
+          !alarm.Metrics.some(({ Expression }) => {
+            const objective = contract.objectives.find(
+              ({ id }) => id === resource.objectiveId,
+            );
+            const allowedBadFraction = objective
+              ? Number((1 - objective.target).toFixed(6)).toString()
+              : '';
+            return (
+              objective &&
+              Expression?.includes('IF(v>=') &&
+              Expression.includes('/' + allowedBadFraction)
+            );
+          }))
+      )
+    ) {
+      throw new Error('Deployed metric-math alarm is not executable.');
+    }
+  }
+  if (primaryRouteArns.size !== 1) {
+    throw new Error('Deployed alarms do not share one exact primary route.');
+  }
+  deployed = true;
+}
+process.stdout.write(JSON.stringify({
+  deployedAlarmResourcesVerified: deployed,
+  kind: 'reliability-contract-verification',
+  schemaVersion: 1,
+  slice: '${name}',
+}) + '\\n');
+`,
+        'scripts/reliability-report.mjs': `import { readFileSync } from 'node:fs';
+import {
+  evaluateSlo,
+  validateReliabilityContract,
+} from '@empire-builder-kit/runtime/reliability';
+import {
+  activeDeploymentBinding,
+  artifactReference,
+  binding,
+  digest,
+  exactKeys,
+  readBoundedJson,
+  safeToken,
+  sameBinding,
+  utc,
+  writeImmutableArtifact,
+} from './reliability-evidence-lib.mjs';
+
+const inputPath = process.env.EBK_RELIABILITY_EVIDENCE_INPUT_PATH?.trim();
+if (!inputPath) {
+  throw new Error('EBK_RELIABILITY_EVIDENCE_INPUT_PATH is required.');
+}
+const inputArtifact = readBoundedJson(inputPath, 'Reliability report input');
+const input = exactKeys(
+  inputArtifact.value,
+  ['capture', 'objectiveId', 'schemaVersion'],
+  'Reliability report input',
+);
+if (input.schemaVersion !== 1) {
+  throw new Error('Reliability report input is incompatible.');
+}
+const objectiveId = safeToken(input.objectiveId, 'objectiveId', 128);
+const captured = artifactReference(input.capture, 'capture');
+const capture = exactKeys(
+  captured.value,
+  [
+    'binding',
+    'bindingArtifact',
+    'capturedAt',
+    'kind',
+    'metricResults',
+    'objectiveId',
+    'queryDigest',
+    'sampleWindow',
+    'schemaVersion',
+    'slice',
+    'target',
+  ],
+  'Captured metric artifact',
+);
+if (
+  capture.kind !== 'reliability-metric-capture' ||
+  capture.schemaVersion !== 1 ||
+  capture.slice !== '${name}' ||
+  capture.objectiveId !== objectiveId ||
+  !Array.isArray(capture.metricResults)
+) {
+  throw new Error(
+    'Reliability report requires the exact captured AWS metric artifact.',
+  );
+}
+const capturedBinding = binding(capture.binding, 'capture.binding');
+const activeBinding = activeDeploymentBinding(
+  capture.bindingArtifact,
+  'capture.bindingArtifact',
+);
+const captureTarget = exactKeys(
+  capture.target,
+  ['account', 'region', 'slice', 'stage'],
+  'capture.target',
+);
+const sampleWindow = exactKeys(
+  capture.sampleWindow,
+  ['durationSeconds', 'end', 'start'],
+  'capture.sampleWindow',
+);
+const sampleStart = utc(sampleWindow.start, 'capture.sampleWindow.start');
+const sampleEnd = utc(sampleWindow.end, 'capture.sampleWindow.end');
+const sampleDurationSeconds =
+  (Date.parse(sampleEnd) - Date.parse(sampleStart)) / 1_000;
+digest(capture.queryDigest, 'capture.queryDigest');
+if (
+  !sameBinding(capturedBinding, activeBinding.binding) ||
+  ['account', 'region', 'slice', 'stage'].some(
+    (key) => captureTarget[key] !== activeBinding.target[key],
+  ) ||
+  !Number.isSafeInteger(sampleWindow.durationSeconds) ||
+  sampleWindow.durationSeconds !== sampleDurationSeconds ||
+  sampleDurationSeconds <= 0 ||
+  sampleDurationSeconds > 6 * 60 * 60
+) {
+  throw new Error(
+    'Captured metric sample is not bound to the exact active deployment and bounded window.',
+  );
+}
+const result = (id, optional = false) => {
+  const matches = capture.metricResults.filter((entry) => entry?.id === id);
+  if (matches.length === 0 && optional) return 0;
+  if (
+    matches.length !== 1 ||
+    !Array.isArray(matches[0].timestamps) ||
+    !Array.isArray(matches[0].values) ||
+    matches[0].timestamps.length !== matches[0].values.length ||
+    matches[0].values.length > 1008 ||
+    matches[0].timestamps.some(
+      (value) =>
+        typeof value !== 'string' ||
+        !Number.isFinite(Date.parse(value)) ||
+        Date.parse(value) < Date.parse(sampleStart) ||
+        Date.parse(value) > Date.parse(sampleEnd),
+    ) ||
+    matches[0].values.some(
+      (value) => typeof value !== 'number' || !Number.isFinite(value) || value < 0,
+    )
+  ) {
+    throw new Error('Captured metric series ' + id + ' is absent or ambiguous.');
+  }
+  return matches[0].values.reduce((total, value) => total + value, 0);
+};
+const contract = validateReliabilityContract(
+  JSON.parse(
+    readFileSync(
+      new URL('../docs/reliability/slo.json', import.meta.url),
+      'utf8',
+    ),
+  ),
+);
+const objective = contract.objectives.find(
+  ({ id }) => id === objectiveId,
+);
+if (!objective) throw new Error('Reliability objective is not declared.');
+if (capturedBinding.workload !== objective.journey) {
+  throw new Error(
+    'Captured metric workload does not match the declared objective journey.',
+  );
+}
+const validEvents = result('valid');
+const goodEvents = result('good');
+const syntheticValid = result(
+  'synthetic-valid',
+  objective.lowTraffic.mode === 'data-insufficient',
+);
+const syntheticGood = result(
+  'synthetic-good',
+  objective.lowTraffic.mode === 'data-insufficient',
+);
+if (
+  !Number.isSafeInteger(validEvents) ||
+  !Number.isSafeInteger(goodEvents) ||
+  !Number.isSafeInteger(syntheticValid) ||
+  !Number.isSafeInteger(syntheticGood) ||
+  goodEvents > validEvents ||
+  syntheticGood > syntheticValid
+) {
+  throw new Error('Captured metric counts are incompatible.');
+}
+const evaluation = evaluateSlo({
+  goodEvents,
+  minimumValidEvents: objective.minimumValidEvents.diagnosticSample,
+  objective,
+  ...(validEvents >= objective.minimumValidEvents.diagnosticSample
+    ? {}
+    : {
+        syntheticSuccess:
+          syntheticValid > 0 ? syntheticGood === syntheticValid : undefined,
+      }),
+  validEvents,
+});
+const report = {
+  binding: capturedBinding,
+  capturedMetricDigest: captured.digest,
+  declaredObjectiveWindow: objective.window,
+  kind: 'reliability-slo-diagnostic-sample',
+  objectiveId: objective.id,
+  provenance: activeBinding.target.stage,
+  sampleEvaluation: evaluation,
+  sampleWindow: {
+    durationSeconds: sampleDurationSeconds,
+    end: sampleEnd,
+    start: sampleStart,
+  },
+  schemaVersion: 1,
+  scope: 'bounded-diagnostic-sample-not-slo-window-evidence',
+  slice: '${name}',
+};
+const reference = writeImmutableArtifact(
+  '.ebk/evidence/reliability/slo',
+  report,
+);
+process.stdout.write(JSON.stringify({ ...reference, ...report }) + '\\n');
+`,
+        'scripts/collect-reliability-exercise.mjs': `import {
+  CloudWatchClient,
+  DescribeAlarmHistoryCommand,
+  DescribeAlarmsCommand,
+} from '@aws-sdk/client-cloudwatch';
+import {
+  DescribeExecutionCommand,
+  SFNClient,
+} from '@aws-sdk/client-sfn';
+import {
+  GetCallerIdentityCommand,
+  STSClient,
+} from '@aws-sdk/client-sts';
+import { readFileSync } from 'node:fs';
+import {
+  activeDeploymentBinding,
+  awsPartition,
+  authorizedExecutionArn,
+  exactKeys,
+  readBoundedJson,
+  safeToken,
+  utc,
+  writeImmutableArtifact,
+} from './reliability-evidence-lib.mjs';
+
+const inputPath =
+  process.env.EBK_RELIABILITY_EXERCISE_COLLECTION_INPUT_PATH?.trim();
+if (!inputPath) {
+  throw new Error(
+    'EBK_RELIABILITY_EXERCISE_COLLECTION_INPUT_PATH is required.',
+  );
+}
+const input = exactKeys(
+  readBoundedJson(
+    inputPath,
+    'Reliability exercise collection input',
+  ).value,
+  [
+    'alarmResourceId',
+    'bindingArtifact',
+    'exerciseId',
+    'schemaVersion',
+    'target',
+    'windowEnd',
+    'windowStart',
+    'workflowExecutions',
+  ],
+  'Reliability exercise collection input',
+);
+if (input.schemaVersion !== 1) {
+  throw new Error('Reliability exercise collection input is incompatible.');
+}
+const exerciseId = safeToken(input.exerciseId, 'exerciseId', 128);
+const declaration = JSON.parse(
+  readFileSync(
+    new URL('../testing/reliability-exercises.json', import.meta.url),
+    'utf8',
+  ),
+);
+const operations = JSON.parse(
+  readFileSync(
+    new URL('../operations/reliability.json', import.meta.url),
+    'utf8',
+  ),
+);
+const exercise = declaration.exercises?.find(({ id }) => id === exerciseId);
+if (
+  !exercise ||
+  exercise.observation?.adapter !== 'aws-cloudwatch-alarm-history-v1'
+) {
+  throw new Error(
+    'Reliability exercise has no stable-v1 AWS collection adapter.',
+  );
+}
+const alarmResourceId = safeToken(
+  input.alarmResourceId,
+  'alarmResourceId',
+  128,
+);
+const alarmResource = operations.deployedAlarmResources?.find(
+  ({ id }) => id === alarmResourceId,
+);
+const dynamicMatch =
+  (exercise.observation.dynamicAlarmKind === 'service' &&
+    /^service-[a-z][a-z0-9-]*-health$/.test(alarmResourceId)) ||
+  (exercise.observation.dynamicAlarmKind === 'job' &&
+    /^job-[a-z][a-z0-9-]*-failure$/.test(alarmResourceId));
+if (
+  !alarmResource ||
+  (!exercise.observation.alarmIds.includes(alarmResourceId) && !dynamicMatch)
+) {
+  throw new Error(
+    'Reliability exercise alarm is absent or outside its declared workload.',
+  );
+}
+const target = exactKeys(
+  input.target,
+  ['account', 'region', 'slice', 'stage'],
+  'target',
+);
+for (const key of ['account', 'region', 'slice', 'stage']) {
+  safeToken(target[key], 'target.' + key, 128);
+}
+if (target.slice !== '${name}') {
+  throw new Error('Reliability collection target escaped the exact Slice.');
+}
+const activeBinding = activeDeploymentBinding(
+  input.bindingArtifact,
+  'bindingArtifact',
+);
+const collectedBinding = activeBinding.binding;
+const activeResources = activeBinding.resources;
+const bindingTarget = activeBinding.target;
+if (
+  collectedBinding.workload !== exercise.workload ||
+  ['account', 'region', 'slice', 'stage'].some(
+    (key) => bindingTarget[key] !== target[key],
+  )
+) {
+  throw new Error(
+    'Reliability collection deployment binding does not match the exercise target.',
+  );
+}
+const identity = await new STSClient({ region: target.region }).send(
+  new GetCallerIdentityCommand({}),
+);
+const partition = awsPartition(target.region);
+if (
+  identity.Account !== target.account ||
+  !identity.Arn?.startsWith(
+    'arn:' + partition + ':sts::' + target.account + ':',
+  )
+) {
+  throw new Error(
+    'AWS caller identity does not match the active reliability target.',
+  );
+}
+const windowStart = utc(input.windowStart, 'windowStart');
+const windowEnd = utc(input.windowEnd, 'windowEnd');
+const windowMilliseconds = Date.parse(windowEnd) - Date.parse(windowStart);
+if (
+  windowMilliseconds <= 0 ||
+  windowMilliseconds > 6 * 60 * 60 * 1000
+) {
+  throw new Error(
+    'Reliability collection window must be positive and at most six hours.',
+  );
+}
+const alarmName = alarmResource.name.replace('{stage}', target.stage);
+if (
+  !alarmName.startsWith('${name}-' + target.stage + '-') ||
+  alarmName.includes('{stage}') ||
+  !activeResources.alarmNames.includes(alarmName)
+) {
+  throw new Error(
+    'Reliability alarm is not authorized by the protected deployment.',
+  );
+}
+const historyRequest = {
+  AlarmName: alarmName,
+  EndDate: new Date(windowEnd),
+  HistoryItemType: 'StateUpdate',
+  MaxRecords: 32,
+  ScanBy: 'TimestampAscending',
+  StartDate: new Date(windowStart),
+};
+const stateRequest = {
+  AlarmNames: [alarmName],
+  MaxRecords: 1,
+};
+const cloudwatch = new CloudWatchClient({ region: target.region });
+const historyResponse = await cloudwatch.send(
+  new DescribeAlarmHistoryCommand(historyRequest),
+);
+const stateResponse = await cloudwatch.send(
+  new DescribeAlarmsCommand(stateRequest),
+);
+if (historyResponse.NextToken || stateResponse.NextToken) {
+  throw new Error('Reliability alarm collection exceeded its page bound.');
+}
+const boundedText = (value, label, maximum = 2048) => {
+  if (
+    typeof value !== 'string' ||
+    value.length < 1 ||
+    value.length > maximum ||
+    [...value].some((character) => {
+      const code = character.charCodeAt(0);
+      return code < 9 || (code > 13 && code < 32) || code === 127;
+    })
+  ) {
+    throw new Error(label + ' is not bounded provider metadata.');
+  }
+  return value;
+};
+const requestId = safeToken(
+  historyResponse.$metadata?.requestId,
+  'alarmHistory.requestId',
+  128,
+);
+const stateRequestId = safeToken(
+  stateResponse.$metadata?.requestId,
+  'alarmState.requestId',
+  128,
+);
+const historyItems = (historyResponse.AlarmHistoryItems ?? []).map(
+  (item, index) => {
+    const historyData = boundedText(
+      item.HistoryData,
+      'alarmHistory[' + index + '].historyData',
+      4096,
+    );
+    let parsed;
+    try {
+      parsed = JSON.parse(historyData);
+    } catch {
+      throw new Error('Alarm history state data is not valid JSON.');
+    }
+    const state = parsed?.newState?.stateValue;
+    if (!['ALARM', 'INSUFFICIENT_DATA', 'OK'].includes(state)) {
+      throw new Error('Alarm history contains an unsupported state.');
+    }
+    const timestamp = utc(
+      item.Timestamp?.toISOString?.(),
+      'alarmHistory[' + index + '].timestamp',
+    );
+    if (
+      Date.parse(timestamp) < Date.parse(windowStart) ||
+      Date.parse(timestamp) > Date.parse(windowEnd) ||
+      item.AlarmName !== alarmName ||
+      item.HistoryItemType !== 'StateUpdate'
+    ) {
+      throw new Error('Alarm history escaped the exact collection request.');
+    }
+    return {
+      alarmName,
+      historyData,
+      historyItemType: item.HistoryItemType,
+      historySummary: boundedText(
+        item.HistorySummary,
+        'alarmHistory[' + index + '].historySummary',
+      ),
+      state,
+      timestamp,
+    };
+  },
+);
+const failureIndex = historyItems.findIndex(({ state }) => state === 'ALARM');
+const recoveryIndex = historyItems.findIndex(
+  ({ state }, index) => index > failureIndex && state === 'OK',
+);
+if (failureIndex < 0 || recoveryIndex < 0) {
+  throw new Error(
+    'Alarm history does not independently prove failure followed by recovery.',
+  );
+}
+const alarm = stateResponse.MetricAlarms?.[0];
+const alarmArn =
+  'arn:' +
+  partition +
+  ':cloudwatch:' +
+  target.region +
+  ':' +
+  target.account +
+  ':alarm:' +
+  alarmName;
+let description;
+try {
+  description = JSON.parse(alarm?.AlarmDescription ?? 'null');
+} catch {
+  throw new Error('Reliability alarm description is not valid metadata.');
+}
+if (
+  stateResponse.MetricAlarms?.length !== 1 ||
+  alarm?.AlarmArn !== alarmArn ||
+  alarm?.AlarmName !== alarmName ||
+  alarm?.StateValue !== 'OK' ||
+  description?.id !== alarmResource.id ||
+  description?.slice !== '${name}' ||
+  description?.schemaVersion !== 1
+) {
+  throw new Error(
+    'Reliability alarm response does not match the exact declared resource.',
+  );
+}
+const workflowInputs = input.workflowExecutions ?? [];
+if (
+  !Array.isArray(workflowInputs) ||
+  workflowInputs.length > 2 ||
+  (exercise.observation.workflowMetadata === 'required' &&
+    workflowInputs.length !== 2) ||
+  (exercise.observation.workflowMetadata === 'none' &&
+    workflowInputs.length !== 0)
+) {
+  throw new Error(
+    'Reliability workflow provenance is absent or outside its declared bound.',
+  );
+}
+const workflowExecutions = [];
+for (const [index, workflowInput] of workflowInputs.entries()) {
+  const workflow = exactKeys(
+    workflowInput,
+    ['executionArn', 'role'],
+    'workflowExecutions[' + index + ']',
+  );
+  if (
+    !['failure', 'recovery'].includes(workflow.role) ||
+    workflowInputs.filter(({ role }) => role === workflow.role).length !== 1
+  ) {
+    throw new Error('Reliability workflow roles must be exact and unique.');
+  }
+  const executionArn = safeToken(
+    workflow.executionArn,
+    'workflowExecutions[' + index + '].executionArn',
+    512,
+  );
+  if (!authorizedExecutionArn(activeResources, executionArn)) {
+    throw new Error(
+      'Reliability workflow is not authorized by the protected deployment.',
+    );
+  }
+  const workflowRequest = {
+    executionArn,
+    includedData: 'METADATA_ONLY',
+  };
+  const response = await new SFNClient({ region: target.region }).send(
+    new DescribeExecutionCommand(workflowRequest),
+  );
+  const expectedStatuses =
+    workflow.role === 'failure'
+      ? ['ABORTED', 'FAILED', 'TIMED_OUT']
+      : ['SUCCEEDED'];
+  if (
+    response.executionArn !== executionArn ||
+    !activeResources.stateMachineArns.includes(response.stateMachineArn) ||
+    !expectedStatuses.includes(response.status)
+  ) {
+    throw new Error(
+      'Reliability workflow response does not prove the declared outcome.',
+    );
+  }
+  workflowExecutions.push({
+    request: workflowRequest,
+    response: {
+      executionArn: response.executionArn,
+      requestId: safeToken(
+        response.$metadata?.requestId,
+        'workflow.requestId',
+        128,
+      ),
+      startDate: utc(
+        response.startDate?.toISOString?.(),
+        'workflow.startDate',
+      ),
+      stateMachineArn: response.stateMachineArn,
+      status: response.status,
+      stopDate: utc(
+        response.stopDate?.toISOString?.(),
+        'workflow.stopDate',
+      ),
+    },
+    role: workflow.role,
+  });
+}
+const failure = historyItems[failureIndex];
+const recovery = historyItems[recoveryIndex];
+const collection = {
+  alarm: {
+    alarmArn,
+    alarmName,
+    currentState: alarm.StateValue,
+    description,
+  },
+  binding: collectedBinding,
+  bindingArtifact: {
+    digest: activeBinding.digest,
+    path: activeBinding.path,
+  },
+  exerciseId,
+  kind: 'reliability-exercise-aws-collection',
+  requests: {
+    alarmHistory: {
+      ...historyRequest,
+      EndDate: windowEnd,
+      StartDate: windowStart,
+    },
+    alarmState: stateRequest,
+  },
+  responses: {
+    alarmHistory: {
+      items: historyItems,
+      requestId,
+    },
+    alarmState: {
+      requestId: stateRequestId,
+      state: alarm.StateValue,
+    },
+    workflowExecutions,
+  },
+  schemaVersion: 1,
+  slice: '${name}',
+  target,
+  transitions: {
+    failure: { state: failure.state, timestamp: failure.timestamp },
+    recovery: { state: recovery.state, timestamp: recovery.timestamp },
+  },
+  workload: exercise.workload,
+};
+const collectionArtifact = writeImmutableArtifact(
+  '.ebk/evidence/reliability/collections',
+  collection,
+);
+const observation = (role, transition, status) => ({
+  binding: collectedBinding,
+  capturedAt: transition.timestamp,
+  evidenceId:
+    exerciseId + '-' + role + '-' + collectionArtifact.digest.slice(0, 16),
+  exerciseId,
+  kind: 'reliability-exercise-' + role,
+  producer: {
+    adapter: 'aws-cloudwatch-alarm-history-v1',
+    collectionArtifact,
+    requestId,
+    resource: alarmArn,
+  },
+  schemaVersion: 1,
+  slice: '${name}',
+  status,
+  workload: exercise.workload,
+});
+const failureArtifact = writeImmutableArtifact(
+  '.ebk/evidence/reliability/exercise-inputs',
+  observation('failure', failure, 'observed'),
+);
+const recoveryArtifact = writeImmutableArtifact(
+  '.ebk/evidence/reliability/exercise-inputs',
+  observation(
+    'recovery',
+    recovery,
+    exercise.workload === 'alert-delivery' ? 'unsupported' : 'verified',
+  ),
+);
+process.stdout.write(
+  JSON.stringify({
+    collection: collectionArtifact,
+    failure: failureArtifact,
+    kind: 'reliability-exercise-collection-result',
+    recovery: recoveryArtifact,
+    schemaVersion: 1,
+  }) + '\\n',
+);
+`,
+        'scripts/reliability-exercise-report.mjs': `import { readFileSync } from 'node:fs';
+import {
+  activeDeploymentBinding,
+  artifactReference,
+  binding,
+  exactKeys,
+  readBoundedJson,
+  safeToken,
+  sameBinding,
+  utc,
+  writeImmutableArtifact,
+} from './reliability-evidence-lib.mjs';
+
+const inputPath = process.env.EBK_RELIABILITY_EXERCISE_INPUT_PATH?.trim();
+if (!inputPath) {
+  throw new Error('EBK_RELIABILITY_EXERCISE_INPUT_PATH is required.');
+}
+const inputArtifact = readBoundedJson(
+  inputPath,
+  'Reliability exercise report input',
+);
+const input = exactKeys(
+  inputArtifact.value,
+  ['artifacts', 'binding', 'exerciseId', 'schemaVersion'],
+  'Reliability exercise report input',
+);
+const declaration = JSON.parse(
+  readFileSync(
+    new URL('../testing/reliability-exercises.json', import.meta.url),
+    'utf8',
+  ),
+);
+if (input.schemaVersion !== 1) {
+  throw new Error('Reliability exercise report input is incompatible.');
+}
+const exerciseId = safeToken(input.exerciseId, 'exerciseId', 128);
+const exercise = declaration.exercises?.find(
+  ({ id }) => id === exerciseId,
+);
+if (!exercise) {
+  throw new Error('Reliability exercise is undeclared or incomplete.');
+}
+const reportBinding = binding(input.binding, 'binding');
+if (reportBinding.workload !== exercise.workload) {
+  throw new Error('Reliability exercise workload binding does not match.');
+}
+const references = exactKeys(
+  input.artifacts,
+  ['cleanup', 'failure', 'postconditions', 'recovery'],
+  'artifacts',
+);
+const roles = ['failure', 'recovery', 'postconditions', 'cleanup'];
+const statuses = {
+  cleanup: 'complete',
+  failure: 'observed',
+  postconditions: 'passed',
+  recovery:
+    exercise.workload === 'alert-delivery' ? 'unsupported' : 'verified',
+};
+const evidence = {};
+const collectionDigests = [];
+let protectedStage;
+let previous = 0;
+for (const role of roles) {
+  const reference = artifactReference(references[role], 'artifacts.' + role);
+  const artifact = exactKeys(
+    reference.value,
+    [
+      'binding',
+      'capturedAt',
+      'checks',
+      'evidenceId',
+      'exerciseId',
+      'kind',
+      'producer',
+      'schemaVersion',
+      'slice',
+      'status',
+      'workload',
+    ],
+    role + ' artifact',
+  );
+  const artifactBinding = binding(artifact.binding, role + '.binding');
+  const producer = exactKeys(
+    artifact.producer,
+    role === 'failure' || role === 'recovery'
+      ? ['adapter', 'collectionArtifact', 'requestId', 'resource']
+      : ['kind', 'requestId', 'resource'],
+    role + '.producer',
+  );
+  const capturedAt = Date.parse(utc(artifact.capturedAt, role + '.capturedAt'));
+  if (
+    artifact.schemaVersion !== 1 ||
+    artifact.kind !== 'reliability-exercise-' + role ||
+    artifact.exerciseId !== exercise.id ||
+    artifact.slice !== '${name}' ||
+    artifact.workload !== exercise.workload ||
+    !sameBinding(reportBinding, artifactBinding) ||
+    capturedAt < previous ||
+    !safeToken(artifact.evidenceId, role + '.evidenceId', 128) ||
+    !safeToken(producer.requestId, role + '.producer.requestId', 128) ||
+    !safeToken(producer.resource, role + '.producer.resource', 512)
+  ) {
+    throw new Error(
+      'Reliability exercise artifact is fabricated, cross-paired, or unsanitized.',
+    );
+  }
+  previous = capturedAt;
+  if (role === 'failure' || role === 'recovery') {
+    if (producer.adapter !== 'aws-cloudwatch-alarm-history-v1') {
+      throw new Error(
+        'Failure and recovery require the generated AWS collection adapter.',
+      );
+    }
+    const collectionReference = artifactReference(
+      producer.collectionArtifact,
+      role + '.producer.collectionArtifact',
+    );
+    const collection = exactKeys(
+      collectionReference.value,
+      [
+        'alarm',
+        'binding',
+        'bindingArtifact',
+        'exerciseId',
+        'kind',
+        'requests',
+        'responses',
+        'schemaVersion',
+        'slice',
+        'target',
+        'transitions',
+        'workload',
+      ],
+      role + ' collection',
+    );
+    const collectionBinding = binding(
+      collection.binding,
+      role + '.collection.binding',
+    );
+    const collectionActiveBinding = activeDeploymentBinding(
+      collection.bindingArtifact,
+      role + '.collection.bindingArtifact',
+    );
+    const alarm = exactKeys(
+      collection.alarm,
+      ['alarmArn', 'alarmName', 'currentState', 'description'],
+      role + '.collection.alarm',
+    );
+    const requests = exactKeys(
+      collection.requests,
+      ['alarmHistory', 'alarmState'],
+      role + '.collection.requests',
+    );
+    const responses = exactKeys(
+      collection.responses,
+      ['alarmHistory', 'alarmState', 'workflowExecutions'],
+      role + '.collection.responses',
+    );
+    const alarmHistoryRequest = exactKeys(
+      requests.alarmHistory,
+      [
+        'AlarmName',
+        'EndDate',
+        'HistoryItemType',
+        'MaxRecords',
+        'ScanBy',
+        'StartDate',
+      ],
+      role + '.collection.requests.alarmHistory',
+    );
+    const alarmStateRequest = exactKeys(
+      requests.alarmState,
+      ['AlarmNames', 'MaxRecords'],
+      role + '.collection.requests.alarmState',
+    );
+    const alarmHistoryResponse = exactKeys(
+      responses.alarmHistory,
+      ['items', 'requestId'],
+      role + '.collection.responses.alarmHistory',
+    );
+    const alarmStateResponse = exactKeys(
+      responses.alarmState,
+      ['requestId', 'state'],
+      role + '.collection.responses.alarmState',
+    );
+    const collectionTarget = exactKeys(
+      collection.target,
+      ['account', 'region', 'slice', 'stage'],
+      role + '.collection.target',
+    );
+    const transitions = exactKeys(
+      collection.transitions,
+      ['failure', 'recovery'],
+      role + '.collection.transitions',
+    );
+    const transition = exactKeys(
+      transitions[role],
+      ['state', 'timestamp'],
+      role + '.collection.transitions.' + role,
+    );
+    if (
+      !Array.isArray(alarmHistoryResponse.items) ||
+      !Array.isArray(responses.workflowExecutions)
+    ) {
+      throw new Error(
+        'Reliability collection responses are outside their bounded shape.',
+      );
+    }
+    const historyStates = alarmHistoryResponse.items.map((item, index) => {
+      const historyItem = exactKeys(
+        item,
+        [
+          'alarmName',
+          'historyData',
+          'historyItemType',
+          'historySummary',
+          'state',
+          'timestamp',
+        ],
+        role + '.collection.responses.alarmHistory.items[' + index + ']',
+      );
+      if (
+        historyItem.alarmName !== alarm.alarmName ||
+        historyItem.historyItemType !== 'StateUpdate' ||
+        !['ALARM', 'INSUFFICIENT_DATA', 'OK'].includes(historyItem.state) ||
+        !utc(
+          historyItem.timestamp,
+          role + '.collection.responses.alarmHistory.items.timestamp',
+        ) ||
+        typeof historyItem.historyData !== 'string' ||
+        historyItem.historyData.length > 4096 ||
+        typeof historyItem.historySummary !== 'string' ||
+        historyItem.historySummary.length > 2048
+      ) {
+        throw new Error(
+          'Reliability collection contains incompatible alarm history.',
+        );
+      }
+      return {
+        state: historyItem.state,
+        timestamp: historyItem.timestamp,
+      };
+    });
+    const failureHistoryIndex = historyStates.findIndex(
+      ({ state }) => state === 'ALARM',
+    );
+    const recoveryHistoryIndex = historyStates.findIndex(
+      ({ state }, index) =>
+        index > failureHistoryIndex && state === 'OK',
+    );
+    for (const [index, workflowEntry] of
+      responses.workflowExecutions.entries()) {
+      const workflow = exactKeys(
+        workflowEntry,
+        ['request', 'response', 'role'],
+        role + '.collection.responses.workflowExecutions[' + index + ']',
+      );
+      const workflowRequest = exactKeys(
+        workflow.request,
+        ['executionArn', 'includedData'],
+        role + '.collection.responses.workflowExecutions.request',
+      );
+      const workflowResponse = exactKeys(
+        workflow.response,
+        [
+          'executionArn',
+          'requestId',
+          'startDate',
+          'stateMachineArn',
+          'status',
+          'stopDate',
+        ],
+        role + '.collection.responses.workflowExecutions.response',
+      );
+      if (
+        !['failure', 'recovery'].includes(workflow.role) ||
+        workflowRequest.includedData !== 'METADATA_ONLY' ||
+        workflowRequest.executionArn !== workflowResponse.executionArn ||
+        !safeToken(
+          workflowResponse.requestId,
+          role + '.collection.responses.workflow.requestId',
+          128,
+        ) ||
+        (workflow.role === 'failure'
+          ? !['ABORTED', 'FAILED', 'TIMED_OUT'].includes(
+              workflowResponse.status,
+            )
+          : workflowResponse.status !== 'SUCCEEDED')
+      ) {
+        throw new Error(
+          'Reliability collection workflow provenance is incompatible.',
+        );
+      }
+    }
+    if (
+      collection.kind !== 'reliability-exercise-aws-collection' ||
+      collection.schemaVersion !== 1 ||
+      collection.exerciseId !== exercise.id ||
+      collection.slice !== '${name}' ||
+      collection.workload !== exercise.workload ||
+      !sameBinding(reportBinding, collectionBinding) ||
+      !sameBinding(collectionBinding, collectionActiveBinding.binding) ||
+      alarm.currentState !== 'OK' ||
+      alarmStateResponse.state !== 'OK' ||
+      !safeToken(
+        alarmStateResponse.requestId,
+        role + '.collection.responses.alarmState.requestId',
+        128,
+      ) ||
+      alarm.alarmArn !== producer.resource ||
+      collectionTarget.slice !== '${name}' ||
+      ['account', 'region', 'slice', 'stage'].some(
+        (key) =>
+          collectionTarget[key] !==
+          collectionActiveBinding.target[key],
+      ) ||
+      !safeToken(
+        collectionTarget.account,
+        role + '.collection.target.account',
+        128,
+      ) ||
+      !safeToken(
+        collectionTarget.region,
+        role + '.collection.target.region',
+        128,
+      ) ||
+      !safeToken(
+        collectionTarget.stage,
+        role + '.collection.target.stage',
+        128,
+      ) ||
+      alarmHistoryRequest.AlarmName !== alarm.alarmName ||
+      alarmHistoryRequest.HistoryItemType !== 'StateUpdate' ||
+      alarmHistoryRequest.MaxRecords !== 32 ||
+      alarmHistoryRequest.ScanBy !== 'TimestampAscending' ||
+      !Array.isArray(alarmStateRequest.AlarmNames) ||
+      alarmStateRequest.AlarmNames.length !== 1 ||
+      alarmStateRequest.AlarmNames[0] !== alarm.alarmName ||
+      alarmStateRequest.MaxRecords !== 1 ||
+      alarmHistoryResponse.requestId !== producer.requestId ||
+      alarmHistoryResponse.items.length < 2 ||
+      failureHistoryIndex < 0 ||
+      recoveryHistoryIndex < 0 ||
+      transitions.failure.timestamp !==
+        historyStates[failureHistoryIndex].timestamp ||
+      transitions.recovery.timestamp !==
+        historyStates[recoveryHistoryIndex].timestamp ||
+      transition.timestamp !== artifact.capturedAt ||
+      transition.state !== (role === 'failure' ? 'ALARM' : 'OK')
+    ) {
+      throw new Error(
+        'Reliability collection request, response, resource, or transition is cross-paired.',
+      );
+    }
+    if (
+      protectedStage !== undefined &&
+      protectedStage !== collectionActiveBinding.target.stage
+    ) {
+      throw new Error(
+        'Reliability exercise collections crossed protected stages.',
+      );
+    }
+    protectedStage = collectionActiveBinding.target.stage;
+    collectionDigests.push(collectionReference.digest);
+  } else if (producer.kind !== 'testing-evidence') {
+    throw new Error(
+      'Postconditions and cleanup require testing-evidence provenance.',
+    );
+  }
+  if (artifact.status !== statuses[role]) {
+    throw new Error('Reliability exercise artifact status is incompatible.');
+  }
+  if (role === 'postconditions') {
+    if (
+      !Array.isArray(artifact.checks) ||
+      artifact.checks.length !== exercise.postconditions.length ||
+      artifact.checks.some(
+        (check, index) =>
+          check !== 'postcondition-' + String(index + 1) + '-passed',
+      )
+    ) {
+      throw new Error(
+        'Reliability exercise postcondition artifact is incomplete.',
+      );
+    }
+  } else if (artifact.checks !== undefined) {
+    throw new Error('Only the postcondition artifact may contain checks.');
+  }
+  evidence[role] = reference.digest;
+}
+if (
+  collectionDigests.length !== 2 ||
+  new Set(collectionDigests).size !== 1 ||
+  !['staging', 'production'].includes(protectedStage)
+) {
+  throw new Error(
+    'Failure and recovery must come from one independently collected AWS transition chain.',
+  );
+}
+if (new Set(Object.values(evidence)).size !== roles.length) {
+  throw new Error('Reliability exercise artifacts must be independently captured.');
+}
+const report = {
+  artifacts: evidence,
+  binding: reportBinding,
+  ...(exercise.workload === 'alert-delivery'
+    ? { alertDelivery: { state: artifactReference(
+        references.recovery,
+        'artifacts.recovery',
+      ).value.status } }
+    : {}),
+  exerciseId: exercise.id,
+  kind: 'reliability-failure-recovery-evidence',
+  provenance: protectedStage,
+  schemaVersion: 1,
+  slice: '${name}',
+  workload: exercise.workload,
+};
+const reference = writeImmutableArtifact(
+  '.ebk/evidence/reliability/exercises',
+  report,
+);
+process.stdout.write(JSON.stringify({ ...reference, ...report }) + '\\n');
+`,
+        'scripts/reliability-diagnostic.mjs': `import {
+  CloudWatchClient,
+  DescribeAlarmsCommand,
+  GetMetricDataCommand,
+} from '@aws-sdk/client-cloudwatch';
+import {
+  DescribeServicesCommand,
+  ECSClient,
+} from '@aws-sdk/client-ecs';
+import {
+  DescribeExecutionCommand,
+  SFNClient,
+} from '@aws-sdk/client-sfn';
+import {
+  GetCallerIdentityCommand,
+  STSClient,
+} from '@aws-sdk/client-sts';
+import { readFileSync } from 'node:fs';
+import {
+  authorizeDiagnostic,
+  validateReliabilityContract,
+} from '@empire-builder-kit/runtime/reliability';
+import {
+  activeDeploymentBinding,
+  awsPartition,
+  authorizedExecutionArn,
+  exactKeys,
+  readBoundedJson,
+  safeToken,
+  sha256,
+  utc,
+  writeImmutableArtifact,
+} from './reliability-evidence-lib.mjs';
+
+const inputPath = process.env.EBK_RELIABILITY_DIAGNOSTIC_INPUT_PATH?.trim();
+if (!inputPath) {
+  throw new Error('EBK_RELIABILITY_DIAGNOSTIC_INPUT_PATH is required.');
+}
+const requestInput = readBoundedJson(inputPath, 'Reliability diagnostic input');
+const request = exactKeys(
+  requestInput.value,
+  ['approval', 'bindingArtifact', 'query', 'source', 'target'],
+  'Reliability diagnostic input',
+);
+const plan = authorizeDiagnostic({
+  ...(request.approval === undefined ? {} : { approval: request.approval }),
+  source: request.source,
+  target: request.target,
+});
+if (plan.approvalRequired) {
+  process.stdout.write(JSON.stringify({
+    approvalRequired: true,
+    expiresAt: plan.expiresAt,
+    queryClass: plan.queryClass,
+    source: plan.source,
+    target: plan.target,
+  }) + '\\n');
+  process.exit(0);
+}
+const activeBinding = activeDeploymentBinding(
+  request.bindingArtifact,
+  'bindingArtifact',
+);
+const capturedBinding = activeBinding.binding;
+const activeResources = activeBinding.resources;
+const bindingTarget = activeBinding.target;
+if (
+  bindingTarget.account !== plan.target.account ||
+  bindingTarget.region !== plan.target.region ||
+  bindingTarget.slice !== plan.target.slice ||
+  bindingTarget.stage !== plan.target.stage
+) {
+  throw new Error(
+    'Reliability diagnostic deployment binding does not match the exact target.',
+  );
+}
+if (plan.source === 'alarm-state') {
+  const query = exactKeys(request.query, ['alarmNames'], 'alarm-state query');
+  if (
+    !Array.isArray(query.alarmNames) ||
+    query.alarmNames.some(
+      (value) =>
+        !activeResources.alarmNames.includes(
+          safeToken(value, 'alarm-state alarm', 255),
+        ),
+    )
+  ) {
+    throw new Error(
+      'Alarm-state query is not authorized by the protected deployment.',
+    );
+  }
+}
+if (
+  plan.source === 'sanitized-signal' &&
+  request.query?.apiId !== undefined &&
+  safeToken(request.query.apiId, 'apiId', 128) !== activeResources.apiId
+) {
+  throw new Error(
+    'Metric query API is not authorized by the protected deployment.',
+  );
+}
+if (plan.source === 'resource-metadata') {
+  const query = exactKeys(
+    request.query,
+    ['ecsServices', 'executions'],
+    'resource-metadata query',
+  );
+  if (!Array.isArray(query.ecsServices) || !Array.isArray(query.executions)) {
+    throw new Error(
+      'Resource query is not authorized by the protected deployment.',
+    );
+  }
+  for (const [index, value] of query.ecsServices.entries()) {
+    const requested = exactKeys(
+      value,
+      ['cluster', 'services'],
+      'ecsServices[' + index + ']',
+    );
+    const cluster = safeToken(
+      requested.cluster,
+      'ecsServices[' + index + '].cluster',
+      512,
+    );
+    const authorized = activeResources.ecsServices.find(
+      (entry) => entry.cluster === cluster,
+    );
+    if (
+      !authorized ||
+      !Array.isArray(requested.services) ||
+      requested.services.some(
+        (service) =>
+          !authorized.services.includes(
+            safeToken(service, 'ecsServices.service', 255),
+          ),
+      )
+    ) {
+      throw new Error(
+        'ECS query is not authorized by the protected deployment.',
+      );
+    }
+  }
+  for (const [index, value] of query.executions.entries()) {
+    const executionArn = safeToken(value, 'executions[' + index + ']', 512);
+    if (!authorizedExecutionArn(activeResources, executionArn)) {
+      throw new Error(
+        'Step Functions query is not authorized by the protected deployment.',
+      );
+    }
+  }
+}
+const region = plan.target.region;
+const partition = awsPartition(region);
+const identity = await new STSClient({ region }).send(
+  new GetCallerIdentityCommand({}),
+);
+if (
+  identity.Account !== plan.target.account ||
+  !identity.Arn?.startsWith(
+    'arn:' + partition + ':sts::' + plan.target.account + ':',
+  )
+) {
+  throw new Error(
+    'AWS caller identity does not match the active reliability target.',
+  );
+}
+const capture = async (value, directory) => {
+  const reference = writeImmutableArtifact(directory, value);
+  process.stdout.write(JSON.stringify({ ...reference, ...value }) + '\\n');
+};
+if (plan.source === 'alarm-state') {
+  const query = exactKeys(request.query, ['alarmNames'], 'alarm-state query');
+  if (
+    !Array.isArray(query.alarmNames) ||
+    query.alarmNames.length < 1 ||
+    query.alarmNames.length > 32 ||
+    new Set(query.alarmNames).size !== query.alarmNames.length
+  ) {
+    throw new Error('Alarm-state query must name one to 32 exact alarms.');
+  }
+  const alarmNames = query.alarmNames.map((value, index) =>
+    safeToken(value, 'alarmNames[' + index + ']', 255),
+  );
+  if (
+    alarmNames.some(
+      (value) => !value.startsWith('${name}-' + plan.target.stage + '-'),
+    )
+  ) {
+    throw new Error('Alarm-state query escaped the exact Slice and stage.');
+  }
+  const response = await new CloudWatchClient({ region }).send(
+    new DescribeAlarmsCommand({
+      AlarmNames: alarmNames,
+      MaxRecords: alarmNames.length,
+    }),
+  );
+  if (response.NextToken) {
+    throw new Error('Alarm-state query exceeded its one-page bound.');
+  }
+  const alarms = (response.MetricAlarms ?? []).map((alarm) => ({
+    actionsEnabled: alarm.ActionsEnabled ?? null,
+    alarmArn: alarm.AlarmArn ?? null,
+    alarmName: alarm.AlarmName ?? null,
+    stateUpdatedTimestamp:
+      alarm.StateUpdatedTimestamp?.toISOString?.() ?? null,
+    stateValue: alarm.StateValue ?? null,
+  }));
+  if (
+    alarms.length !== alarmNames.length ||
+    new Set(alarms.map(({ alarmName }) => alarmName)).size !== alarms.length ||
+    alarms.some(
+      ({ alarmArn, alarmName }) =>
+        !alarmNames.includes(alarmName) ||
+        !alarmArn?.startsWith(
+          'arn:' +
+            partition +
+            ':cloudwatch:' +
+            region +
+            ':' +
+            plan.target.account +
+            ':alarm:',
+        ),
+    )
+  ) {
+    throw new Error('AWS alarm response did not match the exact query target.');
+  }
+  await capture(
+    {
+      alarms,
+      binding: capturedBinding,
+      bindingDigest: activeBinding.digest,
+      capturedAt: new Date().toISOString(),
+      kind: 'reliability-alarm-capture',
+      schemaVersion: 1,
+      slice: '${name}',
+      target: plan.target,
+    },
+    '.ebk/evidence/reliability/diagnostics',
+  );
+  process.exit(0);
+}
+if (plan.source === 'sanitized-signal') {
+  const query = exactKeys(
+    request.query,
+    ['apiId', 'endTime', 'objectiveId', 'startTime'],
+    'sanitized-signal query',
+  );
+  const objectiveId = safeToken(query.objectiveId, 'objectiveId', 128);
+  const contract = validateReliabilityContract(
+    JSON.parse(
+      readFileSync(
+        new URL('../docs/reliability/slo.json', import.meta.url),
+        'utf8',
+      ),
+    ),
+  );
+  const objective = contract.objectives.find(({ id }) => id === objectiveId);
+  if (!objective || capturedBinding.workload !== objective.journey) {
+    throw new Error(
+      'Metric query workload does not match the exact objective journey.',
+    );
+  }
+  const startTime = utc(query.startTime, 'startTime');
+  const endTime = utc(query.endTime, 'endTime');
+  const elapsed = Date.parse(endTime) - Date.parse(startTime);
+  if (elapsed <= 0 || elapsed > 6 * 60 * 60 * 1000) {
+    throw new Error('Metric query window must be positive and at most six hours.');
+  }
+  const dimensions = [
+    { Name: 'Component', Value: 'next-server' },
+    { Name: 'Feature', Value: objective.feature },
+    { Name: 'Operation', Value: 'request' },
+    { Name: 'Slice', Value: '${name}' },
+    { Name: 'Stage', Value: plan.target.stage },
+  ];
+  const metric = (id, metricName, metricDimensions = dimensions) => ({
+    Id: id,
+    MetricStat: {
+      Metric: {
+        Dimensions: metricDimensions,
+        MetricName: metricName,
+        Namespace:
+          objective.id === 'api-availability' &&
+          metricName !== 'SyntheticGood' &&
+          metricName !== 'SyntheticValid'
+            ? 'AWS/ApiGateway'
+            : 'EBK/${name}',
+      },
+      Period: 60,
+      Stat: 'Sum',
+    },
+    ReturnData: true,
+  });
+  const syntheticDimensions = [
+    { Name: 'Component', Value: 'synthetic' },
+    { Name: 'Feature', Value: 'operations' },
+    {
+      Name: 'Operation',
+      Value:
+        objective.id === 'api-availability'
+          ? 'api-health'
+          : 'web-critical-route',
+    },
+    { Name: 'Slice', Value: '${name}' },
+    { Name: 'Stage', Value: plan.target.stage },
+  ];
+  const syntheticQueries =
+    objective.lowTraffic.mode === 'synthetic'
+      ? [
+          metric('synthetic_valid', 'SyntheticValid', syntheticDimensions),
+          metric('synthetic_good', 'SyntheticGood', syntheticDimensions),
+        ]
+      : [];
+  let metricDataQueries;
+  if (objective.id === 'api-availability') {
+    const apiId = safeToken(query.apiId, 'apiId', 128);
+    if (apiId !== activeResources.apiId) {
+      throw new Error(
+        'Metric query API is not authorized by the protected deployment.',
+      );
+    }
+    const apiDimensions = [{ Name: 'ApiId', Value: apiId }];
+    metricDataQueries = [
+      metric('valid', 'Count', apiDimensions),
+      { ...metric('bad', '5xx', apiDimensions), ReturnData: false },
+      {
+        Expression: 'valid-bad',
+        Id: 'good',
+        Label: 'Good API events',
+        ReturnData: true,
+      },
+      ...syntheticQueries,
+    ];
+  } else if (objective.id === 'web-latency') {
+    if (query.apiId !== undefined) {
+      throw new Error('Web metric capture must not accept an API identity.');
+    }
+    metricDataQueries = [
+      metric('valid', 'OperationValid'),
+      metric('good', 'OperationGood'),
+      ...syntheticQueries,
+    ];
+  } else {
+    throw new Error(
+      'This objective has no stable-v1 AWS metric capture adapter.',
+    );
+  }
+  const response = await new CloudWatchClient({ region }).send(
+    new GetMetricDataCommand({
+      EndTime: new Date(endTime),
+      MaxDatapoints: 1008,
+      MetricDataQueries: metricDataQueries,
+      ScanBy: 'TimestampDescending',
+      StartTime: new Date(startTime),
+    }),
+  );
+  if (response.NextToken) {
+    throw new Error('Metric query exceeded its one-page data-point bound.');
+  }
+  const idMap = {
+    good: 'good',
+    synthetic_good: 'synthetic-good',
+    synthetic_valid: 'synthetic-valid',
+    valid: 'valid',
+  };
+  const metricResults = (response.MetricDataResults ?? [])
+    .filter(({ Id }) => idMap[Id])
+    .map((result) => ({
+      id: idMap[result.Id],
+      status: result.StatusCode ?? null,
+      timestamps: (result.Timestamps ?? []).map((value) => value.toISOString()),
+      values: result.Values ?? [],
+    }));
+  if (
+    metricResults.length !==
+      (objective.lowTraffic.mode === 'synthetic' ? 4 : 2) ||
+    new Set(metricResults.map(({ id }) => id)).size !== metricResults.length ||
+    !metricResults.some(({ id }) => id === 'valid') ||
+    !metricResults.some(({ id }) => id === 'good') ||
+    metricResults.some(
+      ({ status, timestamps, values }) =>
+        status !== 'Complete' ||
+        timestamps.length !== values.length ||
+        values.length > 1008 ||
+        timestamps.some(
+          (value) =>
+            !Number.isFinite(Date.parse(value)) ||
+            Date.parse(value) < Date.parse(startTime) ||
+            Date.parse(value) > Date.parse(endTime),
+        ) ||
+        values.some((value) => !Number.isFinite(value) || value < 0),
+    )
+  ) {
+    throw new Error('AWS metric response is incomplete or outside its bound.');
+  }
+  const queryDigest = sha256(
+    Buffer.from(JSON.stringify({
+      endTime,
+      metricDataQueries,
+      startTime,
+      target: plan.target,
+    })),
+  );
+  await capture(
+    {
+      binding: capturedBinding,
+      bindingArtifact: {
+        digest: activeBinding.digest,
+        path: activeBinding.path,
+      },
+      capturedAt: new Date().toISOString(),
+      kind: 'reliability-metric-capture',
+      metricResults,
+      objectiveId,
+      queryDigest,
+      sampleWindow: {
+        durationSeconds: elapsed / 1_000,
+        end: endTime,
+        start: startTime,
+      },
+      schemaVersion: 1,
+      slice: '${name}',
+      target: plan.target,
+    },
+    '.ebk/evidence/reliability/captures',
+  );
+  process.exit(0);
+}
+if (plan.source === 'resource-metadata') {
+  const query = exactKeys(
+    request.query,
+    ['ecsServices', 'executions'],
+    'resource-metadata query',
+  );
+  const ecsServices = query.ecsServices ?? [];
+  const executions = query.executions ?? [];
+  if (
+    !Array.isArray(ecsServices) ||
+    !Array.isArray(executions) ||
+    ecsServices.length > 8 ||
+    executions.length > 8 ||
+    ecsServices.length + executions.length < 1
+  ) {
+    throw new Error('Resource query is empty or exceeds eight targets per kind.');
+  }
+  const resources = [];
+  for (const [index, input] of ecsServices.entries()) {
+    const target = exactKeys(input, ['cluster', 'services'], 'ecsServices[' + index + ']');
+    const cluster = safeToken(target.cluster, 'ecsServices.cluster', 512);
+    if (
+      !Array.isArray(target.services) ||
+      target.services.length < 1 ||
+      target.services.length > 10
+    ) {
+      throw new Error('ECS service query is outside its ten-service bound.');
+    }
+    const services = target.services.map((value) =>
+      safeToken(value, 'ecsServices.service', 255),
+    );
+    const response = await new ECSClient({ region }).send(
+      new DescribeServicesCommand({ cluster, services }),
+    );
+    if ((response.failures?.length ?? 0) > 0) {
+      throw new Error('ECS returned an unresolved reliability target.');
+    }
+    if (
+      response.services?.length !== services.length ||
+      new Set(
+        (response.services ?? []).map(({ serviceArn }) =>
+          serviceArn?.slice(serviceArn.lastIndexOf('/') + 1),
+        ),
+      ).size !== services.length ||
+      response.services.some(
+        ({ serviceArn }) =>
+          !services.includes(serviceArn?.slice(serviceArn.lastIndexOf('/') + 1)),
+      )
+    ) {
+      throw new Error('ECS response escaped the exact diagnostic target.');
+    }
+    resources.push(...response.services.map((service) => ({
+      desiredCount: service.desiredCount ?? null,
+      pendingCount: service.pendingCount ?? null,
+      runningCount: service.runningCount ?? null,
+      serviceArn: service.serviceArn ?? null,
+      status: service.status ?? null,
+    })));
+  }
+  for (const [index, value] of executions.entries()) {
+    const executionArn = safeToken(value, 'executions[' + index + ']', 512);
+    const response = await new SFNClient({ region }).send(
+      new DescribeExecutionCommand({
+        executionArn,
+        includedData: 'METADATA_ONLY',
+      }),
+    );
+    if (
+      response.executionArn !== executionArn ||
+      !activeResources.stateMachineArns.includes(response.stateMachineArn)
+    ) {
+      throw new Error(
+        'Step Functions response escaped the exact diagnostic target.',
+      );
+    }
+    resources.push({
+      executionArn: response.executionArn ?? null,
+      stateMachineArn: response.stateMachineArn ?? null,
+      status: response.status ?? null,
+      stopDate: response.stopDate?.toISOString?.() ?? null,
+    });
+  }
+  await capture(
+    {
+      binding: capturedBinding,
+      bindingDigest: activeBinding.digest,
+      capturedAt: new Date().toISOString(),
+      kind: 'reliability-resource-capture',
+      resources,
+      schemaVersion: 1,
+      slice: '${name}',
+      target: plan.target,
+    },
+    '.ebk/evidence/reliability/diagnostics',
+  );
+  process.exit(0);
+}
+throw new Error(
+  'This diagnostic source has no stable-v1 read-only AWS query adapter.',
+);
+`,
+        'scripts/incident-remediation.mjs': `import { spawnSync } from 'node:child_process';
+import {
+  planRemediation,
+} from '@empire-builder-kit/runtime/reliability';
+import {
+  readBoundedJson,
+} from './reliability-evidence-lib.mjs';
+
+const inputPath = process.env.EBK_INCIDENT_REMEDIATION_INPUT_PATH?.trim();
+if (!inputPath) {
+  throw new Error('EBK_INCIDENT_REMEDIATION_INPUT_PATH is required.');
+}
+const request = readBoundedJson(
+  inputPath,
+  'Incident remediation input',
+).value;
+const plan = planRemediation(request);
+if (plan.mode === 'report') {
+  process.stdout.write(JSON.stringify({
+    action: plan.action,
+    approvalRequired: true,
+    authorized: false,
+    execution: plan.execution,
+    remediationPlanDigest: plan.remediationPlanDigest,
+    target: plan.target,
+  }) + '\\n');
+  process.exit(0);
+}
+const required = (name) => {
+  const value = process.env[name]?.trim();
+  if (!value) throw new Error(name + ' is required.');
+  return value;
+};
+if (
+  process.env.GITHUB_ACTIONS !== 'true' ||
+  process.env.GITHUB_REF_PROTECTED !== 'true' ||
+  process.env.GITHUB_SHA !== process.env.EBK_APPROVED_COMMIT ||
+  !process.env.ACTIONS_ID_TOKEN_REQUEST_URL
+) {
+  throw new Error(
+    'Incident remediation apply requires protected GitHub OIDC on the approved commit.',
+  );
+}
+if (
+  plan.target.account !== required('AWS_EXPECTED_ACCOUNT_ID') ||
+  plan.target.region !== required('AWS_REGION') ||
+  plan.target.stage !== required('EBK_STAGE') ||
+  plan.target.slice !== '${name}'
+) {
+  throw new Error(
+    'Incident remediation approval does not match the effective target.',
+  );
+}
+if (
+  !['redrive', 'replay'].includes(plan.action) ||
+  plan.execution.adapter !== 'protected-async-recovery'
+) {
+  throw new Error(
+    'This remediation action has no stable-v1 executable adapter.',
+  );
+}
+if (
+  plan.execution.asyncRecoveryReportDigest !==
+  required('EBK_ASYNC_REPORT_DIGEST')
+) {
+  throw new Error(
+    'Incident remediation does not match the distinct async-recovery report.',
+  );
+}
+const capability =
+  plan.action === 'redrive'
+    ? 'bounded-selective-redrive'
+    : 'event-replay';
+const result = spawnSync(
+  process.execPath,
+  ['scripts/protected-async-recovery.mjs'],
+  {
+    env: {
+      ...process.env,
+      EBK_ASYNC_CAPABILITY: capability,
+      EBK_RECOVERY_ACTION: 'apply',
+    },
+    stdio: 'inherit',
+  },
+);
+if (result.error) throw result.error;
+if (result.status !== 0) process.exit(result.status ?? 1);
+`,
+        'reliability/contract.spec.ts': `import { describe, expect, it } from 'vitest';
+import { createAuthenticatedSession } from '@empire-builder-kit/runtime/auth';
+import {
+  createApprovalRequest,
+  createDirectAuthorizationPrincipal,
+  decideApprovalRequest,
+} from '@empire-builder-kit/runtime/authorization';
+import {
+  authorizeDiagnostic,
+  candidateIncidentSeverity,
+  diagnosticApprovalDigestInput,
+  evaluateSlo,
+  planRemediation,
+  RELIABILITY_APPROVAL_POLICY_VERSION,
+  remediationApprovalDigestInput,
+} from '@empire-builder-kit/runtime/reliability';
+import { Reliability } from './contract.js';
+
+const human = (id: string) =>
+  createDirectAuthorizationPrincipal({
+    id,
+    kind: 'admin',
+    roles: [],
+    scopes: [],
+    session: createAuthenticatedSession({
+      subject: { id, type: 'user' },
+    }),
+  });
+const approvedAuthorization = <Action extends string>(
+  input: {
+    action: Action;
+    command: unknown;
+    resource: { id?: string; type: string };
+  },
+) => {
+  const now = Date.now();
+  const pending = createApprovalRequest({
+    ...input,
+    author: human('human-operator'),
+    expiresAt: new Date(now + 30 * 60 * 1_000).toISOString(),
+    now: new Date(now - 60 * 1_000).toISOString(),
+    policyVersion: RELIABILITY_APPROVAL_POLICY_VERSION,
+    slice: '${name}',
+  });
+  return decideApprovalRequest(pending, {
+    approver: human('human-reviewer'),
+    expectedRequestDigest: pending.requestDigest,
+    now: new Date(now - 30 * 1_000).toISOString(),
+    outcome: 'approved',
+    reasonReference: 'incident-1-review',
+    requiredPolicyVersion: RELIABILITY_APPROVAL_POLICY_VERSION,
+  }).request;
+};
+
+describe('${name} reliability contract', () => {
+  it('binds owned objectives and never auto-declares SEV-1', () => {
+    expect(Reliability.slice).toBe('${name}');
+    expect(Reliability.objectives.map(({ id }) => id)).toEqual([
+      'api-availability',
+      'web-latency',
+      'async-delivery-deadline',
+    ]);
+    expect(candidateIncidentSeverity('critical')).toBe('SEV-2');
+  });
+
+  it('makes low-traffic data sufficiency explicit', () => {
+    const objective = Reliability.objectives[0]!;
+    expect(
+      evaluateSlo({
+        goodEvents: 1,
+        objective,
+        validEvents: 1,
+      }).state,
+    ).toBe('data-insufficient');
+  });
+
+  it('rejects cross-target diagnostic and remediation approvals', () => {
+    const target = {
+      account: '123456789012',
+      region: 'us-east-1',
+      slice: '${name}',
+      stage: 'production',
+    };
+    const approvalScope = {
+      allowedLogGroups: ['/ebk/production/${name}/api-health'],
+      incidentRef: 'incident-1',
+      queryClass: 'scoped-errors',
+      reason: 'Confirm the bounded failure signature.',
+      target: { ...target, slice: 'other-slice' },
+      windowEnd: '2026-07-29T12:00:00.000Z',
+      windowStart: '2026-07-29T11:30:00.000Z',
+    };
+    const approval = {
+      ...approvalScope,
+      authorization: approvedAuthorization(
+        diagnosticApprovalDigestInput(approvalScope),
+      ),
+    };
+    expect(() =>
+      authorizeDiagnostic({
+        approval,
+        source: 'bounded-log-query',
+        target,
+      }),
+    ).toThrow('does not match');
+    const report = planRemediation({
+      action: 'replay',
+      cleanup: ['Remove test resources.'],
+      execution: {
+        adapter: 'protected-async-recovery',
+        asyncRecoveryReportDigest: 'a'.repeat(64),
+      },
+      mode: 'report',
+      preconditions: ['The target is still active.'],
+      stopConditions: ['Stop on target change.'],
+      target,
+      verification: ['Verify the critical journey.'],
+    });
+    expect(() =>
+      planRemediation({
+        action: 'replay',
+        approval: {
+          authorization: approvedAuthorization(
+            remediationApprovalDigestInput({
+              incidentRef: 'incident-1',
+              plan: report,
+            }),
+          ),
+          incidentRef: 'incident-1',
+        },
+        cleanup: ['Remove test resources.'],
+        execution: {
+          adapter: 'protected-async-recovery',
+          asyncRecoveryReportDigest: 'a'.repeat(64),
+        },
+        mode: 'apply',
+        preconditions: ['The target is still active.'],
+        stopConditions: ['Stop on target change.'],
+        target,
+        verification: ['Verify a substituted journey.'],
+      }),
+    ).toThrow('does not match');
+  });
+});
+`,
+    };
+}
+//# sourceMappingURL=built-in-plan-reliability-files.js.map