@empire-builder-kit/nx 1.0.0-rc.13 → 1.0.0-rc.17

package/src/generators/preset/workspace-files.js

@@ -709,6 +709,19 @@ function planRoleAuditStep(branch, mode = 'produce') {
                 ],
                 Resource: '*',
               },
+              {
+                Sid: 'ObserveStageSecretVersionIdentity',
+                Effect: 'Allow',
+                Action: 'secretsmanager:ListSecretVersionIds',
+                Resource:
+                  'arn:aws:secretsmanager:' + process.env.AWS_REGION + ':' +
+                  account + ':secret:*',
+                Condition: {
+                  StringEquals: {
+                    'aws:ResourceTag/ebk:stage': stateStage,
+                  },
+                },
+              },
               {
                 Sid: 'ValidatePlannedIamPolicies',
                 Effect: 'Allow',
@@ -969,6 +982,7 @@ exports.WORKSPACE_PROJECT_MANAGED_JSON_POINTERS = [
     '/targets/blueprint-trust-check-protected',
     '/targets/developer-context',
     '/targets/deployment-plan',
+    '/targets/deploy-local',
     '/targets/dev',
     '/targets/dev-doctor',
     '/targets/dev-setup',
@@ -989,6 +1003,10 @@ const FOUNDATION_SEEDED_PATHS = new Set([
     'docs/costs.md',
     'docs/runbooks.md',
     'docs/security.md',
+    'performance/account-cost-policy.json',
+    'security/router-waf-blocking-rehearsal.json',
+    'security/router-waf-live-evidence.json',
+    'security/router-waf.json',
 ]);
 function createFoundationOwnership(files, frameworkVersion) {
     const paths = Object.keys(files)
@@ -1051,7 +1069,16 @@ function createWorkspaceOwnership(files, frameworkVersion) {
 }
 function renderWorkspaceFiles(options) {
     const { frameworkVersion, name } = options;
+    const deploymentProfile = options.deploymentProfile ?? 'starter';
+    const initialRepositoryPolicy = (0, index_js_4.createIncubationRepositoryPolicy)(deploymentProfile);
+    initialRepositoryPolicy.deploymentAccounts = options.deploymentAccounts ?? {
+        development: null,
+        production: null,
+        staging: null,
+    };
+    initialRepositoryPolicy.deploymentRegion = options.deploymentRegion ?? null;
     const developerAgentFilePlan = (0, workspace_files_developer_agent_js_1.renderDeveloperAgentWorkspaceFilePlan)({
+        deploymentProfile,
         frameworkVersion,
         name,
     });
@@ -1064,6 +1091,9 @@ function renderWorkspaceFiles(options) {
     const uploadArtifactAction = (0, index_js_3.pinnedAction)(index_js_3.GITHUB_ACTION_PINS.uploadArtifact);
     const protectedDevelopPromotion = "github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.head.ref == 'develop' && github.event.pull_request.base.ref == 'main'";
     const protectedMainSync = "github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.head.ref == 'main' && github.event.pull_request.base.ref == 'develop'";
+    const protectedPush = "github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop')";
+    const protectedDeploymentRouteJobName = 'protected deployment route';
+    const stagingApplyJobPrefix = 'apply staging plan ';
     const files = {
         ...(0, workspace_files_ci_acceptance_js_1.renderWorkspaceCiAcceptanceFiles)(),
         '.node-version': `${tool_versions_js_1.WORKSPACE_NODE_VERSION}\n`,
@@ -1095,24 +1125,26 @@ env:
 jobs:
   acceptance:
     name: accepted merge evidence
-    if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+    if: ${protectedPush}
     runs-on: ubuntu-latest
     outputs:
+      history_only: \${{ steps.resolve.outputs.history_only == 'true' && steps.restore.outcome == 'success' && steps.verify.outcome == 'success' }}
       reused: \${{ steps.resolve.outputs.reused == 'true' && steps.restore.outcome == 'success' && steps.verify.outcome == 'success' }}
+      route: \${{ steps.resolve.outputs.reused == 'true' && steps.restore.outcome == 'success' && steps.verify.outcome == 'success' && steps.resolve.outputs.route || '' }}
     steps:
       - name: Check out immutable merged candidate
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+        if: ${protectedPush}
         uses: ${checkoutAction}
         with:
           fetch-depth: 0
           ref: \${{ github.sha }}
-      - name: Resolve exact protected-promotion acceptance
-        if: github.event_name == 'push' && github.ref == 'refs/heads/main'
+      - name: Resolve exact protected-route acceptance
+        if: ${protectedPush}
         id: resolve
         env:
           GH_TOKEN: \${{ github.token }}
         run: node tools/ci/workspace-acceptance.mjs resolve
-      - name: Restore exact protected-promotion acceptance
+      - name: Restore exact protected-route acceptance
         if: steps.resolve.outputs.reused == 'true'
         id: restore
         continue-on-error: true
@@ -1132,13 +1164,17 @@ jobs:
         id: verify
         continue-on-error: true
         env:
+          EBK_ACCEPTANCE_BASE: \${{ steps.resolve.outputs.base_commit }}
           EBK_ACCEPTANCE_HEAD: \${{ steps.resolve.outputs.head_commit }}
+          EBK_ACCEPTANCE_ROUTE: \${{ steps.resolve.outputs.route }}
           EBK_ACCEPTANCE_RUN_ATTEMPT: \${{ steps.resolve.outputs.run_attempt }}
           EBK_ACCEPTANCE_RUN_ID: \${{ steps.resolve.outputs.run_id }}
         run: >-
           node tools/ci/workspace-acceptance.mjs verify
           .ebk/evidence/reused-acceptance/manifest.json
           "$EBK_ACCEPTANCE_HEAD"
+          "$EBK_ACCEPTANCE_BASE"
+          "$EBK_ACCEPTANCE_ROUTE"
           "$EBK_ACCEPTANCE_RUN_ID"
           "$EBK_ACCEPTANCE_RUN_ATTEMPT"
 
@@ -1198,12 +1234,14 @@ jobs:
         run: pnpm nx run-many -t verify --parallel=3
 
   seal-acceptance:
-    name: seal protected promotion acceptance
+    name: seal protected route acceptance
     needs: [policy, verify]
     if: >-
       always() &&
+      needs.policy.result == 'success' &&
+      needs.verify.result == 'success' &&
       github.event_name == 'pull_request' &&
-      ${protectedDevelopPromotion}
+      (${protectedDevelopPromotion} || ${protectedMainSync})
     runs-on: ubuntu-latest
     steps:
       - name: Check out immutable accepted candidate
@@ -1211,13 +1249,16 @@ jobs:
         with:
           fetch-depth: 0
           ref: \${{ env.EBK_CI_CANDIDATE_SHA }}
-      - name: Seal exact protected-promotion acceptance
+      - name: Seal exact protected-route acceptance
+        id: seal
         env:
+          EBK_BASE_COMMIT: \${{ github.event.pull_request.base.sha }}
           EBK_HEAD_REPOSITORY: \${{ github.event.pull_request.head.repo.full_name }}
         run: >-
           node tools/ci/workspace-acceptance.mjs seal
           .ebk/evidence/ci/workspace-acceptance/manifest.json
-      - name: Retain exact protected-promotion acceptance
+      - name: Retain exact protected-route acceptance
+        if: steps.seal.outputs.sealed == 'true'
         uses: ${uploadArtifactAction}
         with:
           name: workspace-acceptance-\${{ env.EBK_CI_CANDIDATE_SHA }}-\${{ github.run_id }}-\${{ github.run_attempt }}
@@ -1232,6 +1273,7 @@ jobs:
     if: >-
       always() &&
       github.event_name == 'push' &&
+      needs.acceptance.outputs.history_only != 'true' &&
       (needs.acceptance.outputs.reused == 'true' ||
       (needs.policy.result == 'success' && needs.verify.result == 'success'))
     runs-on: ubuntu-latest
@@ -1298,7 +1340,97 @@ permissions:
   contents: read
 
 jobs:
+  history-classification:
+    name: classify protected history-only sync
+    if: github.event_name == 'push' && github.ref == 'refs/heads/develop'
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      pull-requests: read
+    outputs:
+      history_only: \${{ steps.resolve.outputs.history_only == 'true' && steps.restore.outcome == 'success' && steps.verify.outcome == 'success' }}
+    steps:
+      - name: Check out immutable protected candidate
+        uses: ${checkoutAction}
+        with:
+          fetch-depth: 0
+          ref: \${{ github.sha }}
+      - uses: ${setupNodeAction}
+        with:
+          node-version: ${tool_versions_js_1.WORKSPACE_NODE_VERSION}
+      - name: Resolve exact protected-route acceptance
+        id: resolve
+        env:
+          GH_TOKEN: \${{ github.token }}
+        run: node tools/ci/workspace-acceptance.mjs resolve
+      - name: Restore exact protected-route acceptance
+        if: steps.resolve.outputs.reused == 'true'
+        id: restore
+        continue-on-error: true
+        env:
+          EBK_ACCEPTANCE_ARTIFACT_DIGEST: \${{ steps.resolve.outputs.artifact_digest }}
+          EBK_ACCEPTANCE_ARTIFACT_ID: \${{ steps.resolve.outputs.artifact_id }}
+          EBK_ACCEPTANCE_ARTIFACT_SIZE: \${{ steps.resolve.outputs.artifact_size }}
+          GH_TOKEN: \${{ github.token }}
+        run: >-
+          node tools/ci/workspace-acceptance.mjs download
+          .ebk/evidence/reused-history-acceptance
+          "$EBK_ACCEPTANCE_ARTIFACT_ID"
+          "$EBK_ACCEPTANCE_ARTIFACT_DIGEST"
+          "$EBK_ACCEPTANCE_ARTIFACT_SIZE"
+      - name: Verify exact history-only acceptance
+        if: steps.resolve.outputs.reused == 'true' && steps.restore.outcome == 'success'
+        id: verify
+        continue-on-error: true
+        env:
+          EBK_ACCEPTANCE_BASE: \${{ steps.resolve.outputs.base_commit }}
+          EBK_ACCEPTANCE_HEAD: \${{ steps.resolve.outputs.head_commit }}
+          EBK_ACCEPTANCE_ROUTE: \${{ steps.resolve.outputs.route }}
+          EBK_ACCEPTANCE_RUN_ATTEMPT: \${{ steps.resolve.outputs.run_attempt }}
+          EBK_ACCEPTANCE_RUN_ID: \${{ steps.resolve.outputs.run_id }}
+        run: >-
+          node tools/ci/workspace-acceptance.mjs verify
+          .ebk/evidence/reused-history-acceptance/manifest.json
+          "$EBK_ACCEPTANCE_HEAD"
+          "$EBK_ACCEPTANCE_BASE"
+          "$EBK_ACCEPTANCE_ROUTE"
+          "$EBK_ACCEPTANCE_RUN_ID"
+          "$EBK_ACCEPTANCE_RUN_ATTEMPT"
+
+  deployment-mode:
+    name: classify deployment profile
+    runs-on: ubuntu-latest
+    outputs:
+      profile: \${{ steps.profile.outputs.profile }}
+    steps:
+      - name: Check out immutable deployment policy
+        uses: ${checkoutAction}
+        with:
+          ref: \${{ github.sha }}
+      - id: profile
+        name: Read exact committed deployment profile
+        run: |
+          node - <<'NODE'
+          const { readFileSync } = require('node:fs');
+          const policy = JSON.parse(readFileSync('ebk.repository-policy.json', 'utf8'));
+          const profiles = new Set(['starter', 'production-isolated', 'fully-isolated']);
+          if (!profiles.has(policy.deploymentProfile)) {
+            throw new Error('Committed deployment profile is absent or invalid.');
+          }
+          require('node:fs').appendFileSync(
+            process.env.GITHUB_OUTPUT,
+            'profile=' + policy.deploymentProfile + '\\n',
+          );
+          NODE
+
   route:
+    name: ${protectedDeploymentRouteJobName}
+    needs: [history-classification, deployment-mode]
+    if: >-
+      always() &&
+      needs.history-classification.outputs.history_only != 'true' &&
+      needs.deployment-mode.result == 'success'
     runs-on: ubuntu-latest
     steps:
       - name: Validate protected ref
@@ -1311,14 +1443,22 @@ jobs:
           esac
 
   plan-staging:
-    needs: route
-    if: github.ref == 'refs/heads/develop'
+    needs: [route, deployment-mode]
+    if: >-
+      github.ref == 'refs/heads/develop' &&
+      (github.event_name == 'workflow_dispatch' ||
+      needs.deployment-mode.outputs.profile != 'starter')
     runs-on: ubuntu-latest
     outputs:
+      deployment_profile: \${{ steps.plan.outputs.deployment_profile }}
+      deployment_region: \${{ steps.plan.outputs.deployment_region }}
+      development_account_id: \${{ steps.plan.outputs.development_account_id }}
       foundation_project: \${{ steps.plan.outputs.foundation_project }}
       has_slices: \${{ steps.plan.outputs.has_slices }}
       ordered_projects: \${{ steps.plan.outputs.ordered_projects }}
+      production_account_id: \${{ steps.plan.outputs.production_account_id }}
       slice_projects: \${{ steps.plan.outputs.slice_projects }}
+      staging_account_id: \${{ steps.plan.outputs.staging_account_id }}
     steps:
       - uses: ${checkoutAction}
         with:
@@ -1529,16 +1669,21 @@ jobs:
           path: .ebk/evidence/staging-release-source/**
 
   plan-production:
-    needs: route
+    needs: [route, deployment-mode]
     if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     outputs:
+      deployment_profile: \${{ steps.plan.outputs.deployment_profile }}
+      deployment_region: \${{ steps.plan.outputs.deployment_region }}
+      development_account_id: \${{ steps.plan.outputs.development_account_id }}
       foundation_project: \${{ steps.plan.outputs.foundation_project }}
       foundation_profile: \${{ steps.plan.outputs.foundation_profile }}
       has_slices: \${{ steps.plan.outputs.has_slices }}
       ordered_projects: \${{ steps.plan.outputs.ordered_projects }}
       production_approval_mode: \${{ steps.plan.outputs.production_approval_mode }}
+      production_account_id: \${{ steps.plan.outputs.production_account_id }}
       slice_projects: \${{ steps.plan.outputs.slice_projects }}
+      staging_account_id: \${{ steps.plan.outputs.staging_account_id }}
     steps:
       - uses: ${checkoutAction}
         with:
@@ -1859,6 +2004,8 @@ jobs:
       EBK_RELEASE_SOURCE_COMMIT: \${{ needs.release-source-staging.outputs.source_commit }}
       EBK_SOURCE_COMMIT: \${{ needs.release-source-staging.outputs.source_commit }}
       EBK_STAGE: staging
+      EBK_POLICY_ACCOUNT_ID: \${{ needs.plan-staging.outputs.staging_account_id }}
+      EBK_POLICY_REGION: \${{ needs.plan-staging.outputs.deployment_region }}
       SLICE_PROJECTS: \${{ needs.plan-staging.outputs.slice_projects }}
     steps:
       - uses: ${checkoutAction}
@@ -1874,6 +2021,10 @@ jobs:
       - run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
       - name: Verify managed workspace integrity before AWS authority
         run: pnpm nx run ${name}:workspace-health
+      - name: Bind staging account to committed deployment topology
+        run: |
+          test "$AWS_EXPECTED_ACCOUNT_ID" = "$EBK_POLICY_ACCOUNT_ID"
+          test "$AWS_REGION" = "$EBK_POLICY_REGION"
 ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - uses: ${configureAwsAction}
         with:
           role-to-assume: \${{ secrets.AWS_DEPLOY_ROLE_ARN }}
@@ -1913,6 +2064,8 @@ ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - uses: ${c
       EBK_RELEASE_SOURCE_COMMIT: \${{ needs.release-source-staging.outputs.source_commit }}
       EBK_SOURCE_COMMIT: \${{ needs.release-source-staging.outputs.source_commit }}
       EBK_STAGE: staging
+      EBK_POLICY_ACCOUNT_ID: \${{ needs.plan-staging.outputs.staging_account_id }}
+      EBK_POLICY_REGION: \${{ needs.plan-staging.outputs.deployment_region }}
       SLICE_PROJECTS: \${{ needs.plan-staging.outputs.slice_projects }}
     steps:
       - uses: ${checkoutAction}
@@ -1928,6 +2081,10 @@ ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - uses: ${c
       - run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
       - name: Verify managed workspace integrity before AWS authority
         run: pnpm nx run ${name}:workspace-health
+      - name: Bind staging account to committed deployment topology
+        run: |
+          test "$AWS_EXPECTED_ACCOUNT_ID" = "$EBK_POLICY_ACCOUNT_ID"
+          test "$AWS_REGION" = "$EBK_POLICY_REGION"
 ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - name: Restore both native platform records
         uses: ${downloadArtifactAction}
         with:
@@ -1969,6 +2126,10 @@ ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - name: Res
       AWS_DEPLOY_ROLE_ARN: \${{ secrets.AWS_DEPLOY_ROLE_ARN }}
       AWS_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_EXPECTED_ACCOUNT_ID }}
       AWS_REGION: \${{ vars.AWS_REGION }}
+      EBK_DEPLOYMENT_PROFILE: \${{ needs.plan-production.outputs.deployment_profile }}
+      EBK_POLICY_PRODUCTION_ACCOUNT_ID: \${{ needs.plan-production.outputs.production_account_id }}
+      EBK_POLICY_REGION: \${{ needs.plan-production.outputs.deployment_region }}
+      EBK_POLICY_STAGING_ACCOUNT_ID: \${{ needs.plan-production.outputs.staging_account_id }}
       EBK_CANDIDATE_RUN_ATTEMPT: \${{ needs.release-source-production.outputs.candidate_run_attempt }}
       EBK_CANDIDATE_RUN_ID: \${{ needs.release-source-production.outputs.candidate_run_id }}
       EBK_RELEASE_SOURCE_COMMIT: \${{ needs.release-source-production.outputs.source_commit }}
@@ -2069,11 +2230,13 @@ ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - name: Res
             cp "$source_sidecar" "$target"
           done
       - uses: ${configureAwsAction}
+        if: env.EBK_DEPLOYMENT_PROFILE != 'starter'
         with:
           role-to-assume: \${{ secrets.AWS_STAGING_PROMOTION_PULL_ROLE_ARN }}
           role-session-name: ebk-staging-container-pull-\${{ github.run_id }}-\${{ github.run_attempt }}
           aws-region: \${{ vars.AWS_STAGING_PROMOTION_REGION }}
       - name: Authenticate exact staging source registry
+        if: env.EBK_DEPLOYMENT_PROFILE != 'starter'
         env:
           EBK_STAGING_ACCOUNT_ID: \${{ vars.AWS_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID }}
           EBK_STAGING_REGION: \${{ vars.AWS_STAGING_PROMOTION_REGION }}
@@ -2092,10 +2255,27 @@ ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - name: Res
           role-to-assume: \${{ secrets.AWS_DEPLOY_ROLE_ARN }}
           role-session-name: ebk-production-container-push-\${{ github.run_id }}-\${{ github.run_attempt }}
           aws-region: \${{ vars.AWS_REGION }}
+      - name: Bind production authority to committed deployment topology
+        run: |
+          test "$AWS_EXPECTED_ACCOUNT_ID" = "$EBK_POLICY_PRODUCTION_ACCOUNT_ID" ||
+            { echo 'Production environment account differs from committed deployment topology'; exit 1; }
+          test "$AWS_REGION" = "$EBK_POLICY_REGION" ||
+            { echo 'Production environment Region differs from committed deployment topology'; exit 1; }
+      - name: Authenticate shared-account staging source registry
+        if: env.EBK_DEPLOYMENT_PROFILE == 'starter'
+        run: |
+          test "$EBK_POLICY_STAGING_ACCOUNT_ID" = "$EBK_POLICY_PRODUCTION_ACCOUNT_ID" ||
+            { echo 'Starter promotion requires one shared AWS account'; exit 1; }
+          registry_suffix=.com
+          case "$EBK_POLICY_REGION" in cn-*) registry_suffix=.com.cn ;; esac
+          aws ecr get-login-password --region "$EBK_POLICY_REGION" |
+            docker login --username AWS --password-stdin \
+              "$EBK_POLICY_STAGING_ACCOUNT_ID.dkr.ecr.$EBK_POLICY_REGION.amazonaws$registry_suffix"
       - name: Promote exact staging indexes without rebuilding
         env:
-          EBK_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID }}
-          EBK_STAGING_PROMOTION_REGION: \${{ vars.AWS_STAGING_PROMOTION_REGION }}
+          EBK_DEPLOYMENT_PROFILE: \${{ needs.plan-production.outputs.deployment_profile }}
+          EBK_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID: \${{ needs.plan-production.outputs.deployment_profile == 'starter' && needs.plan-production.outputs.staging_account_id || vars.AWS_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID }}
+          EBK_STAGING_PROMOTION_REGION: \${{ needs.plan-production.outputs.deployment_profile == 'starter' && needs.plan-production.outputs.deployment_region || vars.AWS_STAGING_PROMOTION_REGION }}
         run: |
           test "$(aws sts get-caller-identity --query Account --output text)" = "$AWS_EXPECTED_ACCOUNT_ID" ||
             { echo 'Production promotion role account differs from policy'; exit 1; }
@@ -2314,6 +2494,8 @@ ${planRoleAuditStep('main', 'verify')}
       EBK_RELEASE_SOURCE_COMMIT: \${{ needs.release-source-staging.outputs.source_commit }}
       EBK_SOURCE_COMMIT: \${{ github.sha }}
       EBK_STAGE: staging
+      EBK_POLICY_ACCOUNT_ID: \${{ needs.plan-staging.outputs.staging_account_id }}
+      EBK_POLICY_REGION: \${{ needs.plan-staging.outputs.deployment_region }}
       FOUNDATION_PROJECT: \${{ needs.plan-staging.outputs.foundation_project }}
       ORDERED_PROJECTS: \${{ needs.plan-staging.outputs.ordered_projects }}
       SLICE_PROJECTS: \${{ needs.plan-staging.outputs.slice_projects }}
@@ -2421,7 +2603,7 @@ ${planRoleAuditStep('develop', 'verify')}
             packages/*/.ebk/evidence/infrastructure-plan-command.json
 
   deploy-staging:
-    name: apply staging plan \${{ needs.infrastructure-plan-staging.outputs.plan_digest || 'recovery-without-resource-plan' }}
+    name: ${stagingApplyJobPrefix}\${{ needs.infrastructure-plan-staging.outputs.plan_digest || 'recovery-without-resource-plan' }}
     needs: [plan-staging, release-source-staging, container-assemble-staging, infrastructure-plan-staging]
     if: |
       always() &&
@@ -2500,6 +2682,10 @@ ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - name: Res
           test -n "$AWS_DEPLOY_ROLE_ARN" || { echo 'staging AWS_DEPLOY_ROLE_ARN is required'; exit 1; }
           test -n "$AWS_EXPECTED_ACCOUNT_ID" || { echo 'staging AWS_EXPECTED_ACCOUNT_ID is required'; exit 1; }
           test -n "$AWS_REGION" || { echo 'staging AWS_REGION is required'; exit 1; }
+          test "$AWS_EXPECTED_ACCOUNT_ID" = "$EBK_POLICY_ACCOUNT_ID" ||
+            { echo 'staging environment account differs from committed deployment topology'; exit 1; }
+          test "$AWS_REGION" = "$EBK_POLICY_REGION" ||
+            { echo 'staging environment Region differs from committed deployment topology'; exit 1; }
           test -n "$EBK_FLEET_ORIGIN" ||
             { echo 'staging environment EBK_FLEET_ORIGIN is required'; exit 1; }
           test "$EBK_FLEET_ORIGIN" = "$EBK_PLANNED_FLEET_ORIGIN" ||
@@ -3136,6 +3322,8 @@ ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - name: Res
       EBK_APPROVED_MAIN_COMMIT: \${{ github.sha }}
       EBK_SOURCE_COMMIT: \${{ github.sha }}
       EBK_STAGE: production
+      EBK_POLICY_ACCOUNT_ID: \${{ needs.plan-production.outputs.production_account_id }}
+      EBK_POLICY_REGION: \${{ needs.plan-production.outputs.deployment_region }}
       EBK_VERIFIED_STAGING_RUN_ID: \${{ needs.release-source-production.outputs.verified_staging_run_id }}
       FOUNDATION_PROJECT: \${{ needs.plan-production.outputs.foundation_project }}
       ORDERED_PROJECTS: \${{ needs.plan-production.outputs.ordered_projects }}
@@ -3232,6 +3420,10 @@ ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - name: Res
           test -n "$AWS_DEPLOY_ROLE_ARN" || { echo 'production AWS_DEPLOY_ROLE_ARN is required'; exit 1; }
           test -n "$AWS_EXPECTED_ACCOUNT_ID" || { echo 'production AWS_EXPECTED_ACCOUNT_ID is required'; exit 1; }
           test -n "$AWS_REGION" || { echo 'production AWS_REGION is required'; exit 1; }
+          test "$AWS_EXPECTED_ACCOUNT_ID" = "$EBK_POLICY_ACCOUNT_ID" ||
+            { echo 'production environment account differs from committed deployment topology'; exit 1; }
+          test "$AWS_REGION" = "$EBK_POLICY_REGION" ||
+            { echo 'production environment Region differs from committed deployment topology'; exit 1; }
           test -n "$EBK_FLEET_ORIGIN" ||
             { echo 'production environment EBK_FLEET_ORIGIN is required'; exit 1; }
           test "$EBK_FLEET_ORIGIN" = "$EBK_PLANNED_FLEET_ORIGIN" ||
@@ -4898,13 +5090,51 @@ permissions:
   contents: read
 
 jobs:
+  deployment-classification:
+    name: classify exact staging deployment
+    if: >-
+      github.event_name == 'workflow_run' &&
+      github.event.workflow_run.event == 'push' &&
+      github.event.workflow_run.head_branch == 'develop' &&
+      github.event.workflow_run.conclusion == 'success'
+    permissions:
+      actions: read
+      contents: read
+    outputs:
+      deployed: \${{ steps.classify.outputs.deployed }}
+    runs-on: ubuntu-latest
+    steps:
+      - id: classify
+        name: Require one successful staging deployment job
+        env:
+          EBK_DEPLOYMENT_RUN_ID: \${{ github.event.workflow_run.id }}
+          GH_TOKEN: \${{ github.token }}
+          GH_REPO: \${{ github.repository }}
+        run: |
+          jobs="$(gh api \
+            "/repos/$GH_REPO/actions/runs/$EBK_DEPLOYMENT_RUN_ID/jobs?filter=latest&per_page=100")"
+          apply_count="$(printf '%s' "$jobs" | jq \
+            '[.jobs[] | select(.name | startswith("${stagingApplyJobPrefix}")) | select(.conclusion == "success")] | length')"
+          route_success_count="$(printf '%s' "$jobs" | jq \
+            '[.jobs[] | select(.name == "${protectedDeploymentRouteJobName}" and .conclusion == "success")] | length')"
+          route_skipped_count="$(printf '%s' "$jobs" | jq \
+            '[.jobs[] | select(.name == "${protectedDeploymentRouteJobName}" and .conclusion == "skipped")] | length')"
+          case "$apply_count:$route_success_count:$route_skipped_count" in
+            1:1:0) echo 'deployed=true' >> "$GITHUB_OUTPUT" ;;
+            0:0:1) echo 'deployed=false' >> "$GITHUB_OUTPUT" ;;
+            *) echo 'Deploy route and staging application evidence disagree'; exit 1 ;;
+          esac
+
   plan:
+    needs: deployment-classification
     if: >-
-      (github.event_name == 'workflow_run' &&
+      always() &&
+      ((github.event_name == 'workflow_run' &&
       github.event.workflow_run.conclusion == 'success' &&
       github.event.workflow_run.event == 'push' &&
-      github.event.workflow_run.head_branch == 'develop') ||
-      github.event_name == 'workflow_dispatch'
+      github.event.workflow_run.head_branch == 'develop' &&
+      needs.deployment-classification.outputs.deployed == 'true') ||
+      github.event_name == 'workflow_dispatch')
     outputs:
       deployment_run_attempt: \${{ steps.identity.outputs.deployment_run_attempt }}
       deployment_run_id: \${{ steps.identity.outputs.deployment_run_id }}
@@ -5397,14 +5627,14 @@ jobs:
           test "$(node --version | cut -d. -f1)" = v22
       - name: Run exact deployed smoke
         working-directory: \${{ runner.temp }}/ebk-prepared-workspace
-        run: node node_modules/nx/bin/nx.js run "$EBK_PROJECT:smoke-deployed"
+        run: node node_modules/nx/dist/bin/nx.js run "$EBK_PROJECT:smoke-deployed"
       - name: Verify reviewed frontend visual baseline
         working-directory: \${{ runner.temp }}/ebk-prepared-workspace
-        run: node node_modules/nx/bin/nx.js run "$EBK_PROJECT:frontend-visual"
+        run: node node_modules/nx/dist/bin/nx.js run "$EBK_PROJECT:frontend-visual"
       - name: Verify deployed frontend security headers
         working-directory: \${{ runner.temp }}/ebk-prepared-workspace
         run: |
-          node node_modules/nx/bin/nx.js run \
+          node node_modules/nx/dist/bin/nx.js run \
             "$EBK_PROJECT:frontend-security-headers" -- \
             --url="$EBK_SMOKE_URL"
       - name: Bind exact alarm and data-integrity evidence
@@ -6851,11 +7081,11 @@ jobs:
           if [ "$EBK_ACTION" = apply ]; then args+=("--apply"); fi
           pnpm nx run "$EBK_PROJECT:secret-metadata" -- "\${args[@]}"
 `,
-        '.github/workflows/sync-back.yml': `name: Sync production history
+        '.github/workflows/sync-back.yml': `name: Sync protected main history
 
 on:
   workflow_run:
-    workflows: [Deploy]
+    workflows: [Verify]
     types: [completed]
 
 permissions:
@@ -6866,6 +7096,7 @@ jobs:
   sync-back:
     if: >-
       github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'push' &&
       github.event.workflow_run.head_branch == 'main'
     runs-on: ubuntu-latest
     steps:
@@ -6879,8 +7110,8 @@ jobs:
             gh pr create \
               --head main \
               --base develop \
-              --title 'chore: sync production history to develop' \
-              --body 'Managed EBK sync-back. Review and merge; this workflow never pushes or auto-merges.'
+              --title 'chore(git): sync protected main to develop' \
+              --body 'Managed EBK source-history sync. Review and merge; this does not claim or waive independent staging or production deployment evidence, and this workflow never pushes or auto-merges.'
             number=$(gh pr list --state open --head main --base develop --json number --jq '.[0].number')
           fi
           echo "Sync-back pull request #$number is ready for review."
@@ -7234,6 +7465,16 @@ use the direct installed \`.bin/ebk blueprint verification-review\` entry docume
 \`docs/blueprints.md\`.
 
 Workspace creation only writes source files. It does not create or change cloud resources.
+
+New workspaces default to the one-account \`starter\` deployment profile. Configure the exact
+shared account and Region in \`ebk.repository-policy.json\`, authenticate through IAM Identity
+Center, add exact development and staging CIDRs to
+\`packages/foundation/security/router-waf.json\`, and use
+\`pnpm nx run ${name}:deploy-local -- --stage=development
+--profile=<profile> --expectedRoleArn=<role-arn>\`. Never invoke SST directly.
+For a brand-new stage with generated Product Slices, complete the documented workload-role
+Foundation publication and pass \`--phase=foundation-bootstrap\` once before publishing and
+deploying the complete stage.
 `,
         'docs/architecture.md': `# Workspace architecture
 
@@ -7250,6 +7491,11 @@ Foundation implementation files.
 Canonical consumer stages use the matching \`development\`, \`staging\`, or \`production\`
 Foundation. Framework-derived personal stages may use only the \`development\`
 Foundation; generic preview stages are unsupported.
+
+The committed deployment profile changes account and local/GitHub authority only. Every
+canonical stage always owns a separate Router/domain, Aurora cluster and migration history,
+Cognito user pool, event bus, secret namespace, IAM boundary, logs, queues, ECR namespace, and
+stage-qualified SSM discovery contract. Discovery rejects a record for another canonical stage.
 `,
         'docs/git-workflow.md': `# Protected Git workflow
 
@@ -7270,6 +7516,9 @@ GitHub rulesets, environments, and AWS IAM are the authorization boundaries; loc
 only defense in depth.
 
 The \`staging\` environment accepts only \`develop\`; \`production\` accepts only \`main\`.
+These workflows exist for every deployment profile. The staging workflow is optional for
+\`starter\`, whose governed local Nx target may deploy development and staging. Production is
+GitHub-only for every profile; \`fully-isolated\` also requires GitHub for staging.
 The committed \`productionApproval.mode\` selects one of two production authorization
 contracts:
 
@@ -7292,7 +7541,9 @@ contracts:
 Both modes retain required checks, a non-author CODEOWNER approval, no ruleset bypass, the
 literal production environment, and its branch-scoped credentials. The base \`staging\` and
 \`production\` environments own deployment, smoke, and ECR evidence roles plus their
-variables; production also owns the staging-registry promotion pull role. Dedicated
+variables; isolated profiles also keep the staging-registry promotion pull role in production.
+Starter promotion authenticates once to the shared account and copies the exact staging digest
+into a distinct production ECR repository. Dedicated
 \`infrastructure-plan-<stage>\` environments gate read-only role use. Separate
 \`async-recovery-<stage>\`, \`performance-aggregate-<stage>\`,
 \`performance-cost-<stage>\`, \`performance-load-<stage>\`, and
@@ -7441,18 +7692,35 @@ materializes, close and reopen the pull request as a human and then approve it.
 `,
         'docs/repository-operating-policy.md': `# Repository Operating Policy
 
-\`ebk.repository-policy.json\` is the reviewed source of truth for production access,
-production approval, per-Slice readiness, and the one shared production Foundation profile.
+\`ebk.repository-policy.json\` is the reviewed source of truth for deployment profile, exact
+stage account IDs, deployment Region, production access, production approval, per-Slice
+readiness, and the one shared production Foundation profile.
 New workspaces start with production disabled and explicit Team-compatible
 \`productionApproval.mode: "promotion-pr"\`. A missing approval mode or Slice entry fails
 closed; no GitHub capability is allowed to choose a mode implicitly.
 
+Deployment profiles are proportional to operator maturity:
+
+- \`starter\` (default) requires one shared account, permits local development and staging
+  through the governed root Nx target, and reserves production for protected GitHub deployment;
+- \`production-isolated\` requires one development/staging account and a distinct production
+  account; only production is GitHub-only; and
+- \`fully-isolated\` requires three distinct accounts; staging and production are GitHub-only.
+
+Equal account IDs never imply shared stage resources. Router, Aurora, Cognito, events, secrets,
+IAM, logs, queues, resource names, and SSM discovery remain stage-specific. Existing prerelease
+repositories migrate explicitly to \`fully-isolated\`; upgrades never infer or weaken topology.
+That profile-only migration retains the former authority model but stays undeployable until exact
+development, staging, and production account IDs plus \`deploymentRegion\` are committed.
+
 The named repository modes are source-writing presets, not runtime state. Report a change
 first and inspect the complete current/next policy:
 
 \`\`\`bash
 pnpm nx g @empire-builder-kit/nx:repository-policy \\
-  --preset=controlled-production --slices=billing
+  --deploymentProfile=starter --deploymentRegion=us-east-1 \\
+  --developmentAccountId=111122223333 --stagingAccountId=111122223333 \\
+  --productionAccountId=111122223333
 \`\`\`
 
 Apply the reviewed source change separately with \`--apply\`. This command never contacts AWS
@@ -7462,6 +7730,66 @@ Use \`--productionApprovalMode=promotion-pr|environment-reviewer\` for an explic
 transition. This changes committed policy only; a separate bootstrap report/apply reconciles
 remote GitHub settings.
 
+After applying exact topology, authenticate with temporary federated credentials for development
+or staging and invoke
+\`pnpm nx run ${name}:deploy-local -- --stage=<stage> --profile=<profile>
+--expectedRoleArn=<role-arn>\`. Production runs only through the protected main-branch GitHub
+workflow. Each admitted local invocation plans the complete current stage, displays the stage
+summary and first material project, and requires a real TTY response of
+\`approve:<action>:<stage>:<project>:<current-plan-digest>\`. A human or authorized agent may type
+that acknowledgement; it is active operator control, not a claim of independent human review.
+The target creates one private ten-minute capability for that project, rechecks the exact source,
+artifacts, account, Region, role, stage, policy, state, and lock without a second provider preview,
+consumes the capability once, and removes it on every exit path. Unattended scripts cannot approve.
+Every material deploy or refresh mutates at most the first material project and ends with a
+controlled non-success \`replan-required\` handoff, including the last project in the ordered stage.
+Rerun the complete stage, review the new current summary, and repeat until one invocation proves
+every project is semantically converged. Only that convergence invocation succeeds. A preview is
+recent review and audit evidence; it is not represented as a cryptographically replayable Pulumi
+transaction. A complete, unlocked deploy plan containing only provider reads with no changed
+properties, replacement, failure, or unmatched risk finding is retained as observation evidence
+and counts as semantically converged. The standalone project planner may still return its
+conservative non-success for that drift observation; the root local transaction accepts only a
+freshly emitted exact provider-read-only record from that child. Repeated reads coalesce
+only when their logical ID and resource type match exactly. Any stale or ambiguous
+observation fails closed; a plan with desired changes remains material and requires review. One
+narrower case stays reviewable instead of becoming
+drift: when an upstream Foundation apply changes only both external framework-version tag
+projections (plus SST's already-bounded name hydration), the retained
+external identity must match one exact non-replacing provider read in the same ordinary plan.
+Missing read correlation, owned resources, other tag or property changes, incomplete tag pairs,
+and provider failures remain drift and fail closed. The local target requires the exact SST v5 account bootstrap normally
+created by the pinned \`ebk dev up\` path, then creates and attests only missing exact
+per-project/canonical-stage state passphrases before its formal read-only plans. This passphrase
+bootstrap is the only persistent pre-acknowledgement write; it creates no deployment authority
+and is reported in bounded local evidence. Clean immutable source, immediate per-project plans,
+migration and retention preflights, and secret-free result
+evidence remain mandatory. Direct SST is forbidden.
+
+After an interrupted apply, use the same target with \`--action=refresh\` and the exact
+phase, stage, profile, and role. It retains the same plan-summary review boundary, admits only
+bounded drift-detected refresh evidence, and never turns refresh into an implicit deploy. When
+the interrupted write leaves a recorded provider output unusable by the ordinary desired preview,
+the plan stops without mutation. The non-writing refresh preview separates provider refresh
+records from its later desired preview and cannot replace failed ordinary desired authority;
+repair the recorded dependency or use the documented
+operator recovery path before planning again.
+
+A stage-wide refresh still plans and authorizes every selected project. When one exact retained
+project plan proves an absent SST state that is unlocked, complete, empty, and drift-free, the
+root target records that project as a refresh no-op instead of invoking SST against a nonexistent
+stage. It also retains the pinned provider's exact SSM \`ebk:framework-version\` \`tagsAll\`
+normalization as a semantically inert observation after the same bounded shape
+repeats following refresh. Value changes, other tags, security findings, deletes, replacements,
+sensitive properties, and every other resource type remain material. Locked, incomplete, failed,
+or otherwise drifted plans are never skipped.
+
+For a stage with no workload-role account baseline, publish the fixed Foundation-only candidate
+and invoke this root target with \`--phase=foundation-bootstrap\`. After Foundation outputs exist,
+publish the complete \`full-stage\` candidate and invoke the target without \`--phase\` (or with
+\`--phase=full-stage\`). The bootstrap phase selects exactly Foundation; it is not an arbitrary
+project filter.
+
 Validation requires both an explicit production approval mode and an explicit Foundation
 profile. It does not infer omitted values. Use \`promotion-pr\` for a private GitHub Team
 repository. Use \`environment-reviewer\` only when the repository plan can enforce a separate
@@ -7475,10 +7803,16 @@ environment reviewer.
 
 Protected production deploy and refresh validate the complete Foundation/Slice set before AWS
 access. The Foundation is always ordered first. The set is derived from committed policy and
-cannot be narrowed with an ad hoc project argument.
-
-\`standard\` keeps Aurora warm at 2–16 ACU. \`cost-optimized\` is a prerelease candidate at
-0–4 ACU with a five-minute auto-pause and potential cold-resume latency. Both keep managed NAT,
+cannot be narrowed with an ad hoc project argument. The retained stage preview remains review
+evidence. Immediately before each project mutation the workflow computes one fresh plan against
+current state and applies it without a second redundant preview. Source, artifacts, configuration,
+policy, environment, and protected identities remain exact. Provider-only read/discard observations
+may appear or disappear, but any new delete, replacement, import, stateful or security change, IAM
+expansion, protection reduction, or unclassified resource stops for renewed approval. After an
+upstream mutation, every downstream project therefore receives a fresh independent risk decision.
+
+\`standard\` keeps Aurora warm at 2–16 ACU. \`cost-optimized\` keeps a smaller
+0.5–4 ACU warm floor for starter production traffic. Both keep managed NAT,
 30-day backups, deletion protection, retained data, and the protected GitHub/OIDC/AWS path.
 Changing policy affects only later lifecycle requests; it never deploys or removes resources.
 Changing profile requires a separate reviewed Foundation deployment and retained operational
@@ -7549,7 +7883,7 @@ deploy or refresh before AWS access. Protected remove and unlock remain usable f
 There is no local or silent bypass in this prerelease contract; any future waiver mechanism
 must be committed, reviewable, and auditable.
 `,
-        'ebk.repository-policy.json': json((0, index_js_4.createIncubationRepositoryPolicy)()),
+        'ebk.repository-policy.json': json(initialRepositoryPolicy),
         'nx.json': json({
             $schema: './node_modules/nx/schemas/nx-schema.json',
             defaultBase: 'develop',
@@ -7589,6 +7923,7 @@ must be committed, reviewable, and auditable.
                     inputs: ['default', '^production'],
                 },
             },
+            analytics: false,
             neverConnectToCloud: true,
             useDaemonProcess: false,
         }),
@@ -7617,10 +7952,12 @@ must be committed, reviewable, and auditable.
             },
             devDependencies: {
                 '@aws-sdk/client-iam': TOOL_VERSIONS.awsSdk,
+                '@aws-sdk/client-rds': TOOL_VERSIONS.awsSdk,
                 '@aws-sdk/client-s3': TOOL_VERSIONS.awsSdk,
                 '@aws-sdk/client-secrets-manager': TOOL_VERSIONS.awsSdk,
                 '@aws-sdk/client-ssm': TOOL_VERSIONS.awsSdk,
                 '@aws-sdk/client-sts': TOOL_VERSIONS.awsSdk,
+                '@aws-sdk/credential-providers': TOOL_VERSIONS.awsSdk,
                 '@eslint/js': TOOL_VERSIONS.eslintJs,
                 '@empire-builder-kit/nx': frameworkVersion,
                 '@types/node': TOOL_VERSIONS.nodeTypes,
@@ -7704,6 +8041,13 @@ must be committed, reviewable, and auditable.
                     executor: 'nx:run-commands',
                     options: { command: 'node tools/install-ebk-hooks.mjs' },
                 },
+                'deploy-local': {
+                    cache: false,
+                    executor: '@empire-builder-kit/nx:local-deploy',
+                    options: {
+                        stage: 'development',
+                    },
+                },
                 'supply-chain-check': {
                     executor: 'nx:run-commands',
                     options: {
@@ -7772,6 +8116,10 @@ Workspace creation does not deploy this project. Review \`docs/costs.md\`,
 
 Set \`EBK_ROOT_DOMAIN\` before deploying when Route 53 in the target account owns a public
 domain. Without it, the shared Router uses its functional provider URL.
+
+Before deploying development or staging, add at least one exact operator/probe CIDR to
+\`security/router-waf.json\`. Production is public by default behind the same managed and
+rate-limiting baseline; select its allowlist mode explicitly when required.
 `,
         'packages/foundation/contracts/foundation.json': json({
             contractVersion: '1.0.0',
@@ -7831,8 +8179,8 @@ seeded decision record aligned with organization-specific budgets and alerts.
 - Development uses EC2 NAT, a development bastion, and Aurora scale-to-zero.
 - Staging uses EC2 NAT and Aurora scale-to-zero by default.
 - Production always uses managed NAT and retains protected data. Its explicit Repository
-  Operating Policy profile selects either the standard always-warm Aurora floor or the
-  prerelease cost-optimized auto-pause candidate.
+  Operating Policy profile selects either the standard 2-ACU Aurora floor or the
+  cost-optimized 0.5-ACU warm floor.
 - ECS, EventBridge, Cognito, SNS, SSM, and CloudWatch are primarily usage-priced; logs,
   metrics, alarms, and retained data still require active cost review.
 
@@ -7850,8 +8198,69 @@ Use Nx for every supported lifecycle action:
 - \`pnpm nx run foundation:unlock --stage=development\`
 - \`pnpm nx run foundation:remove --stage=development\`
 
-Do not invoke SST lifecycle commands directly. Production deployment belongs in the trusted
-CI path.
+Do not invoke SST lifecycle commands directly. The root \`deploy-local\` target is the governed
+local path for stages admitted by the committed deployment profile. Its fixed
+\`foundation-bootstrap\` phase is the only local partial-stage path and exists solely for the
+documented first workload-role publication; isolated protected stages remain on the trusted
+GitHub path.
+
+Every local invocation plans the complete selected stage but mutates at most one material
+project. Type the exact current \`approve:<action>:<stage>:<project>:<plan-digest>\` challenge in a
+real TTY after reviewing the displayed summary. A human or authorized agent may operate that TTY;
+unattended input is refused. The acknowledgement creates one ten-minute, one-use, private
+capability bound to source, artifacts, policy, environment, credentials, and current state. A
+completed deploy or refresh returns the controlled non-success \`replan-required\`; rerun the
+complete stage, review the new current summary, and continue one project at a time. Only a
+semantically converged complete stage reports success. No upstream mutation can authorize a
+downstream project. A complete, unlocked deploy plan containing only provider reads with no
+changed properties, replacement, failure, or unmatched risk finding is retained as observation
+evidence and counts as semantically converged. The standalone project planner may still return
+its conservative non-success for that drift observation; the root local transaction accepts only
+a freshly emitted exact provider-read-only record from that child. Repeated reads coalesce
+only when their logical ID and resource type match exactly. Any stale or ambiguous
+observation fails closed; a plan with desired changes remains material and requires review. A
+material downstream plan may also retain an upstream Foundation framework-version tag advance as
+observation only when both external tag
+projections, the retained identity, optional bounded SST name hydration, and one non-replacing
+provider read correlate exactly. Every other external property or uncorroborated read remains
+drift and blocks before the TTY challenge.
+
+For an interrupted local apply, run the same root target with \`--action=refresh\`, review its
+current provider-refresh evidence, and type the displayed TTY challenge. Before mutation the
+executor writes and verifies a private state recovery point plus a secret-free digest/version
+manifest. The refresh preview validates its provider and later desired-event partitions; any
+ordinary preview failure or malformed post-refresh desired event remains blocked. Provider-only
+observation noise is retained without claiming a replayable preview. Because refresh changes
+recorded state rather than cloud resources, provider-output security and protection findings
+remain explicit review requirements under the drift decision. Refresh never continues into deploy
+or claims desired-state convergence: run the governed deploy target afterward and resolve every
+remaining source-versus-state change. Exclude the \`.private.json\` recovery point from archives.
+
+The root refresh target includes every selected project in its exact reviewed plan set. It skips
+the SST child only when that project's retained plan proves an absent, unlocked, complete, empty,
+and drift-free state, or when the only retained difference is the pinned provider's exact repeated
+SSM \`ebk:framework-version\` \`tagsAll\` normalization. It records the project as an explicit refresh no-op
+in either case while retaining the observation. Value changes, other tags, security findings,
+deletes, replacements, sensitive
+properties, and every other resource type remain material; every other plan must execute or fail
+closed.
+
+## Router WAF
+
+Each canonical stage owns one global-scope Web ACL attached to that stage's Foundation Router.
+The committed \`security/router-waf.json\` policy requires AWS Common Rule Set, Known Bad
+Inputs, Amazon IP Reputation, an IP rate limit, CloudWatch metrics, and sampled requests.
+Development and staging fail synthesis until their allowlists contain explicit CIDRs.
+Production is public by default and may be changed to an explicit allowlist.
+
+For tuning, set a nonproduction stage to \`count\`, deploy and inspect sampled requests, then
+return staging to \`block\` and run the live allow/deny, managed-rule, rate-limit, metric, and
+sampled-request probes. Write their bounded, secret-free result to
+\`security/router-waf-live-evidence.json\`, then run
+\`pnpm nx run foundation:router-waf-rehearsal\`. The executor seals the exact policy digest
+into \`router-waf-blocking-rehearsal.json\`. Production synthesis rejects a missing, stale, or
+count-mode rehearsal. Full request logging is opt-in, blocked-only, retention-bounded, and
+redacts query strings plus credential-bearing headers.
 
 Foundation stages are canonical. \`ebk dev\` derives a Product Slice personal
 stage from the operating-system account and maps that consumer to the
@@ -7886,6 +8295,12 @@ connects as the Slice's no-password IAM-authenticated migrator user.
   stage-scoped SSM/secret path and least-privilege IAM.
 - Public domains are configured explicitly through \`EBK_ROOT_DOMAIN\`; generated source never
   contains credentials or customer domain assumptions.
+- Every stage's CloudFront Router has its own global Web ACL. The baseline always includes AWS
+  Common Rule Set, Known Bad Inputs, Amazon IP Reputation, rate blocking, CloudWatch metrics,
+  and sampled requests. Nonproduction is allowlisted by default. Production is public by
+  default, but cannot deploy until the exact policy has passed a staging blocking rehearsal.
+- Full WAF request logging is disabled by default. Enabling it keeps blocked requests only,
+  uses bounded retention, and redacts query strings, cookies, authorization, and API keys.
 
 The managed \`contracts/frontend-security-headers.json\` file owns the transport
 minimum: HTTPS in deployed environments, one-year HSTS there, and the common
@@ -7918,7 +8333,12 @@ declare const $app: {
 import {
   FOUNDATION_SSM_SCHEMA_VERSION,
   STANDARD_FOUNDATION_CAPABILITIES,
+  createRouterWafRules,
+  createRouterWafStagePlan,
+  foundationDatabaseEndpointHost,
   foundationSsmPath,
+  normalizeRouterWafPolicy,
+  reconcileRouterWafBlockingRehearsal,
   type FoundationSsmKey,
 } from '@empire-builder-kit/nx/foundation';
 import {
@@ -7928,6 +8348,9 @@ import {
 } from '@empire-builder-kit/nx/repository-policy';
 import { createFoundationAccountCostControlPlan } from '@empire-builder-kit/nx/performance';
 import accountCostPolicy from '../performance/account-cost-policy.json';
+import routerWafBlockingRehearsal from '../security/router-waf-blocking-rehearsal.json';
+import routerWafLiveEvidence from '../security/router-waf-live-evidence.json';
+import routerWafPolicy from '../security/router-waf.json';
 import type { FoundationWorkloadRolePreflight } from './workload-roles/preflight.js';
 
 function identityDomainPrefix(stage: string, accountId: string): string {
@@ -7979,6 +8402,18 @@ export function foundation(
       )
     : undefined;
   const natMode = productionConfiguration?.contract.nat ?? 'ec2';
+  const normalizedRouterWafPolicy = normalizeRouterWafPolicy(routerWafPolicy);
+  const wafPlan = createRouterWafStagePlan({
+    policy: normalizedRouterWafPolicy,
+    rehearsal: isProduction
+      ? reconcileRouterWafBlockingRehearsal({
+          evidence: routerWafLiveEvidence,
+          policy: normalizedRouterWafPolicy,
+          receipt: routerWafBlockingRehearsal,
+        })
+      : null,
+    stage: $app.stage,
+  });
   const natBinding = workloadRoles?.bindings.nat;
   if (natMode === 'ec2' && natBinding) {
     $transform(
@@ -7988,6 +8423,9 @@ export function foundation(
         args.name = natBinding.instanceProfileName;
         args.role = natBinding.roleName;
         opts.import = natBinding.instanceProfileName;
+        opts.ignoreChanges = [
+          ...new Set([...(opts.ignoreChanges ?? []), 'tags', 'tagsAll']),
+        ];
       },
     );
   }
@@ -8009,8 +8447,83 @@ export function foundation(
             aliases: ['*.' + rootDomain],
             dns: sst.aws.dns(),
           },
-        }
+      }
       : {}),
+    waf: {
+      logging: wafPlan.logging,
+      managedRules: {
+        coreRuleSet: true,
+        knownBadInputs: true,
+        sqlInjection: false,
+      },
+      rateLimitPerIp: wafPlan.rateLimitPerIp,
+    },
+    transform: {
+      cdn(args: any) {
+        if (!args.webAclArn) {
+          throw new Error(
+            'Foundation Router must attach its exact global Web ACL.',
+          );
+        }
+      },
+      waf(args: any, opts: any) {
+        if (args.scope !== 'CLOUDFRONT') {
+          throw new Error(
+            'Foundation Router Web ACL must use global CloudFront scope.',
+          );
+        }
+        const ipSets: { ipv4Arn?: any; ipv6Arn?: any } = {};
+        if (wafPlan.ipv4Cidrs.length > 0) {
+          ipSets.ipv4Arn = new aws.wafv2.IpSet(
+            'FoundationRouterIpv4Allowlist',
+            {
+              addresses: wafPlan.ipv4Cidrs,
+              ipAddressVersion: 'IPV4',
+              name: 'foundation-' + wafPlan.stage + '-router-ipv4-allowlist',
+              scope: 'CLOUDFRONT',
+              tags: {
+                'ebk:policy-digest': wafPlan.policyDigest,
+                'ebk:stage': wafPlan.stage,
+              },
+            },
+            { provider: opts.provider },
+          ).arn;
+        }
+        if (wafPlan.ipv6Cidrs.length > 0) {
+          ipSets.ipv6Arn = new aws.wafv2.IpSet(
+            'FoundationRouterIpv6Allowlist',
+            {
+              addresses: wafPlan.ipv6Cidrs,
+              ipAddressVersion: 'IPV6',
+              name: 'foundation-' + wafPlan.stage + '-router-ipv6-allowlist',
+              scope: 'CLOUDFRONT',
+              tags: {
+                'ebk:policy-digest': wafPlan.policyDigest,
+                'ebk:stage': wafPlan.stage,
+              },
+            },
+            { provider: opts.provider },
+          ).arn;
+        }
+        args.defaultAction = { allow: {} };
+        args.rules = createRouterWafRules(wafPlan, ipSets);
+        args.scope = 'CLOUDFRONT';
+        args.tags = {
+          ...(args.tags ?? {}),
+          'ebk:policy-digest': wafPlan.policyDigest,
+          'ebk:stage': wafPlan.stage,
+        };
+        args.visibilityConfig = {
+          cloudwatchMetricsEnabled: true,
+          metricName:
+            'Ebk' +
+            wafPlan.stage[0].toUpperCase() +
+            wafPlan.stage.slice(1) +
+            'FoundationRouterWaf',
+          sampledRequestsEnabled: true,
+        };
+      },
+    },
   });
   const database = new sst.aws.Aurora('FoundationDatabase', {
     // SQL bootstrap and migrations run inside the VPC. Keep the public HTTPS
@@ -8034,6 +8547,46 @@ export function foundation(
     },
     vpc,
   });
+  const databaseClusterEndpoint = database.nodes.cluster.endpoint.apply(
+    foundationDatabaseEndpointHost,
+  );
+  const databaseReaderEndpoint = database.nodes.cluster.readerEndpoint.apply(
+    foundationDatabaseEndpointHost,
+  );
+  // SST v4.17.1 creates a top-level LinkRef on the next tick and its Aurora
+  // implementation unconditionally splits cluster endpoints. During a
+  // governed refresh after an interrupted first deploy, those provider
+  // outputs are legitimately absent. Preserve the normal link contract while
+  // keeping that read-only recovery program total; a real deploy resolves the
+  // exact endpoints before any discovery resource is created.
+  database.getSSTLink = () => ({
+    include: [
+      sst.aws.permission({
+        actions: ['secretsmanager:GetSecretValue'],
+        resources: [database.secretArn],
+      }),
+      sst.aws.permission({
+        actions: [
+          'rds-data:BatchExecuteStatement',
+          'rds-data:BeginTransaction',
+          'rds-data:CommitTransaction',
+          'rds-data:ExecuteStatement',
+          'rds-data:RollbackTransaction',
+        ],
+        resources: [database.clusterArn],
+      }),
+    ],
+    properties: {
+      clusterArn: database.clusterArn,
+      database: database.database,
+      host: databaseClusterEndpoint,
+      password: database.password,
+      port: database.port,
+      reader: databaseReaderEndpoint,
+      secretArn: database.secretArn,
+      username: database.username,
+    },
+  });
   const foundationAccountId = aws.getCallerIdentityOutput({}).accountId;
   const foundationPartition = aws.getPartitionOutput({});
   const foundationRegion = aws.getRegionOutput({});
@@ -8096,6 +8649,7 @@ export function foundation(
               },
             ],
             resources: [alertTopic.arn],
+            sid: 'AllowBudgetAlerts',
           },
           {
             actions: ['sns:Publish'],
@@ -8109,6 +8663,7 @@ export function foundation(
               type: 'Service',
             }],
             resources: [alertTopic.arn],
+            sid: 'AllowCostAnomalyAlerts',
           },
           {
             actions: ['sns:Publish'],
@@ -8131,6 +8686,7 @@ export function foundation(
               type: 'Service',
             }],
             resources: [alertTopic.arn],
+            sid: 'AllowRdsEventAlerts',
           },
           {
             actions: ['sns:Publish'],
@@ -8155,6 +8711,7 @@ export function foundation(
               },
             ],
             resources: [alertTopic.arn],
+            sid: 'AllowCloudWatchAlarmAlerts',
           },
         ],
       }).json,
@@ -8183,6 +8740,41 @@ export function foundation(
         { dependsOn: [alertTopicPolicy] },
       )
     : undefined;
+  const accountCostAnomalyMonitor = isProduction
+    ? new aws.costexplorer.AnomalyMonitor(
+        'FoundationAccountCostAnomalyMonitor',
+        {
+          monitorDimension: 'SERVICE',
+          monitorType: 'DIMENSIONAL',
+          name: '${name}-account-service-cost-anomalies',
+          tags: {
+            'ebk:cost-policy-digest': accountCostControl.policyDigest,
+            'ebk:cost-scope': '${name}/account/production',
+            'ebk:owner': accountCostControl.owner,
+          },
+        },
+      )
+    : undefined;
+  const accountCostAnomalySubscription =
+    accountCostControl.anomaly && accountCostAnomalyMonitor
+      ? new aws.costexplorer.AnomalySubscription(
+          'FoundationAccountCostAnomalySubscription',
+          {
+            frequency: accountCostControl.anomaly.subscription.frequency,
+            monitorArnLists: [accountCostAnomalyMonitor.arn],
+            name: accountCostControl.anomaly.subscription.name,
+            subscribers: [{ address: alertTopic.arn, type: 'SNS' }],
+            tags: {
+              'ebk:cost-policy-digest': accountCostControl.policyDigest,
+              'ebk:cost-scope': '${name}/account/production',
+              'ebk:owner': accountCostControl.owner,
+            },
+            thresholdExpression:
+              accountCostControl.anomaly.subscription.thresholdExpression,
+          },
+          { dependsOn: [accountCostAnomalyMonitor, alertTopicPolicy] },
+        )
+      : undefined;
   const databaseEvents = isProduction
     ? new aws.rds.EventSubscription(
         'FoundationDatabaseEvents',
@@ -8285,12 +8877,10 @@ export function foundation(
     clusterId: cluster.id,
     contractVersion: '1.0.0',
     databaseClusterArn: database.clusterArn,
-    databaseClusterEndpoint: database.nodes.cluster.endpoint.apply(
-      (endpoint: string) => endpoint.split(':')[0],
-    ),
+    databaseClusterEndpoint,
     databaseClusterId: database.id,
     databaseClusterResourceId: database.nodes.cluster.clusterResourceId,
-    databaseHost: database.host,
+    databaseHost: databaseClusterEndpoint,
     databaseMasterSecretArn: database.secretArn,
     databasePort: database.port.apply(String),
     eventBusArn: eventBus.arn,
@@ -8312,6 +8902,7 @@ export function foundation(
     capabilities: STANDARD_FOUNDATION_CAPABILITIES,
     clusterId: cluster.id,
     contractVersion: '1.0.0',
+    costAnomalySubscriptionArn: accountCostAnomalySubscription?.arn,
     databaseCapacityAlarmName: databaseCapacityAlarm.name,
     dashboardName: dashboard.dashboardName,
     databaseClusterId: database.id,
@@ -8343,13 +8934,49 @@ export function app(workloadRoles?: FoundationWorkloadRolePreflight) {
             actualNotificationThresholdPercent: 80,
             forecastNotificationThresholdPercent: 100,
             kind: 'ebk-foundation-account-cost-policy',
-            monthlyMaximumUsd: 1_000,
+            monthlyMaximumUsd: deploymentProfile === 'starter' ? 250 : 1_000,
             owner: 'replace-with-owner',
             reviewAt: null,
             schemaVersion: 1,
             status: 'example',
             workspace: name,
         }),
+        'packages/foundation/security/router-waf.json': json({
+            kind: 'ebk-router-waf-policy',
+            logging: {
+                enabled: false,
+                retention: '1 week',
+            },
+            rateLimitPerIp: 2_000,
+            schemaVersion: 1,
+            stages: {
+                development: {
+                    access: 'allowlist',
+                    allowedCidrs: [],
+                    mode: 'block',
+                },
+                production: {
+                    access: 'public',
+                    allowedCidrs: [],
+                    mode: 'block',
+                },
+                staging: {
+                    access: 'allowlist',
+                    allowedCidrs: [],
+                    mode: 'block',
+                },
+            },
+        }),
+        'packages/foundation/security/router-waf-blocking-rehearsal.json': json({
+            kind: 'ebk-router-waf-blocking-rehearsal',
+            schemaVersion: 1,
+            status: 'pending',
+        }),
+        'packages/foundation/security/router-waf-live-evidence.json': json({
+            kind: 'ebk-router-waf-live-evidence',
+            schemaVersion: 1,
+            status: 'pending',
+        }),
         'packages/foundation/configuration/declarations.json': json({
             project: 'foundation',
             schemaVersion: 1,
@@ -8382,29 +9009,96 @@ export function app(workloadRoles?: FoundationWorkloadRolePreflight) {
                 version: '4.17.1',
             },
             policy: {
+                adoptedImports: [
+                    {
+                        authority: 'workload-role-account-baseline',
+                        logicalId: 'FoundationVpcNatInstanceProfile',
+                        privateIdentifierTemplate: 'ebk-{stage}-foundation-nat-profile',
+                        recoveryRunbookRef: 'docs/workload-role-account-baseline.md',
+                        removalBehavior: 'retain',
+                        resourceType: 'aws:iam/instanceProfile:InstanceProfile',
+                    },
+                ],
                 additiveLowRiskTypes: [
                     'aws:cloudwatch/dashboard:Dashboard',
                     'aws:cloudwatch/logGroup:LogGroup',
                     'aws:cloudwatch/metricAlarm:MetricAlarm',
                 ],
+                additiveReviewedTypes: [
+                    'aws:cloudwatch/eventArchive:EventArchive',
+                    'aws:cloudwatch/eventBus:EventBus',
+                    'aws:cognito/userPoolDomain:UserPoolDomain',
+                    'aws:ec2/defaultSecurityGroup:DefaultSecurityGroup',
+                    'aws:ec2/internetGateway:InternetGateway',
+                    'aws:ec2/routeTable:RouteTable',
+                    'aws:ec2/routeTableAssociation:RouteTableAssociation',
+                    'aws:ec2/securityGroup:SecurityGroup',
+                    'aws:ec2/subnet:Subnet',
+                    'aws:ec2/vpc:Vpc',
+                    'aws:ecs/cluster:Cluster',
+                    'aws:ecs/clusterCapacityProviders:ClusterCapacityProviders',
+                    'aws:rds/clusterParameterGroup:ClusterParameterGroup',
+                    'aws:rds/eventSubscription:EventSubscription',
+                    'aws:rds/parameterGroup:ParameterGroup',
+                    'aws:rds/subnetGroup:SubnetGroup',
+                    'aws:servicediscovery/privateDnsNamespace:PrivateDnsNamespace',
+                    'aws:sns/topic:Topic',
+                    'aws:sns/topicPolicy:TopicPolicy',
+                    'aws:wafv2/webAclLoggingConfiguration:WebAclLoggingConfiguration',
+                    'pulumi-nodejs:dynamic:Resource',
+                    'pulumi:providers:aws',
+                    'pulumi:providers:pulumi-nodejs',
+                    'pulumi:providers:random',
+                    'pulumi:pulumi:Stack',
+                    'sst:aws:Aurora',
+                    'sst:aws:Bus',
+                    'sst:aws:CDN',
+                    'sst:aws:Cluster',
+                    'sst:aws:CognitoUserPool',
+                    'sst:aws:Router',
+                    'sst:aws:SnsTopic',
+                    'sst:aws:Vpc',
+                    'sst:sst:LinkRef',
+                    'sst:sst:Version',
+                ],
                 costOrQuotaTypes: [
                     'aws:apigatewayv2/api:Api',
                     'aws:budgets/budget:Budget',
+                    'aws:cloudfront/cachePolicy:CachePolicy',
                     'aws:cloudfront/distribution:Distribution',
+                    'aws:cloudfront/function:Function',
+                    'aws:cloudfront/keyValueStore:KeyValueStore',
+                    'aws:costexplorer/anomalyMonitor:AnomalyMonitor',
+                    'aws:costexplorer/anomalySubscription:AnomalySubscription',
                     'aws:cognito/userPool:UserPool',
+                    'aws:ec2/eip:Eip',
+                    'aws:ec2/eipAssociation:EipAssociation',
+                    'aws:ec2/instance:Instance',
                     'aws:ec2/natGateway:NatGateway',
                     'aws:rds/cluster:Cluster',
+                    'aws:rds/clusterInstance:ClusterInstance',
+                    'aws:wafv2/ipSet:IpSet',
+                    'aws:wafv2/webAcl:WebAcl',
                 ],
                 failClosedOnUnknown: true,
                 protectedPlanAuthority: 'deploy-role-residual',
                 standingPolicyRiskClasses: ['no-change', 'additive-low-risk'],
                 statefulTypes: [
+                    'aws:cloudwatch/eventArchive:EventArchive',
+                    'aws:cloudwatch/eventBus:EventBus',
                     'aws:cognito/userPool:UserPool',
                     'aws:dynamodb/table:Table',
                     'aws:events/eventBus:EventBus',
                     'aws:kms/key:Key',
                     'aws:rds/cluster:Cluster',
                     'aws:s3/bucket:Bucket',
+                    'aws:secretsmanager/secret:Secret',
+                    'aws:secretsmanager/secretVersion:SecretVersion',
+                    'aws:sns/topic:Topic',
+                    'aws:ssm/parameter:Parameter',
+                    'aws:wafv2/ipSet:IpSet',
+                    'aws:wafv2/webAcl:WebAcl',
+                    'random:index/randomPassword:RandomPassword',
                 ],
             },
             project: 'foundation',
@@ -8502,6 +9196,13 @@ export function app(workloadRoles?: FoundationWorkloadRolePreflight) {
                     executor: '@empire-builder-kit/nx:foundation-profile-preflight',
                     options: { stage: 'development' },
                 },
+                'router-waf-rehearsal': {
+                    cache: false,
+                    executor: '@empire-builder-kit/nx:router-waf-rehearsal',
+                    outputs: [
+                        `{projectRoot}/security/router-waf-blocking-rehearsal.json`,
+                    ],
+                },
                 typecheck: {
                     executor: 'nx:run-commands',
                     options: {
@@ -8529,6 +9230,11 @@ export function app(workloadRoles?: FoundationWorkloadRolePreflight) {
         }),
         'packages/foundation/scripts/verify-foundation.mjs': `import { readFileSync } from 'node:fs';
 
+import {
+  normalizeRouterWafPolicy,
+  reconcileRouterWafBlockingRehearsal,
+} from '@empire-builder-kit/nx/foundation';
+
 const descriptor = JSON.parse(
   readFileSync(new URL('../contracts/foundation.json', import.meta.url), 'utf8'),
 );
@@ -8544,6 +9250,33 @@ const frontendSecurityHeaders = JSON.parse(
     'utf8',
   ),
 );
+const routerWafPolicy = normalizeRouterWafPolicy(
+  JSON.parse(
+    readFileSync(
+      new URL('../security/router-waf.json', import.meta.url),
+      'utf8',
+    ),
+  ),
+);
+reconcileRouterWafBlockingRehearsal({
+  evidence: JSON.parse(
+    readFileSync(
+      new URL('../security/router-waf-live-evidence.json', import.meta.url),
+      'utf8',
+    ),
+  ),
+  policy: routerWafPolicy,
+  receipt:
+  JSON.parse(
+    readFileSync(
+      new URL(
+        '../security/router-waf-blocking-rehearsal.json',
+        import.meta.url,
+      ),
+      'utf8',
+    ),
+  ),
+});
 const expectedCapabilities = [
   'network',
   'routing',
@@ -8559,6 +9292,13 @@ const expectedCapabilities = [
 if (descriptor.contractVersion !== '1.0.0') {
   throw new Error('Foundation contractVersion must be 1.0.0.');
 }
+if (
+  routerWafPolicy.stages.development.access !== 'allowlist' ||
+  routerWafPolicy.stages.staging.access !== 'allowlist' ||
+  routerWafPolicy.stages.production.mode !== 'block'
+) {
+  throw new Error('Foundation Router WAF stage defaults are invalid.');
+}
 if (JSON.stringify(descriptor.capabilities) !== JSON.stringify(expectedCapabilities)) {
   throw new Error('Foundation capability descriptor does not match the v1 standard.');
 }
@@ -8567,7 +9307,7 @@ if (
   costs.aurora?.engineVersion !== '${index_js_4.FOUNDATION_AURORA_ENGINE_VERSION}' ||
   costs.productionProfileSource !== 'ebk.repository-policy.json' ||
   costs.productionProfiles?.standard?.aurora?.min !== '2 ACU' ||
-  costs.productionProfiles?.['cost-optimized']?.aurora?.min !== '0 ACU' ||
+  costs.productionProfiles?.['cost-optimized']?.aurora?.min !== '0.5 ACU' ||
   !costs.stages?.development ||
   !costs.stages?.staging ||
   costs.stages?.production?.dataRetention !== 'retained-and-protected'
@@ -8623,16 +9363,15 @@ export default $config({
       providers: {
         aws: {
           defaultTags: {
+            // SST contributes sst:app and sst:stage. Keep the provider baseline
+            // at eight tags so generated S3 asset objects remain within AWS's
+            // hard ten-tag object limit. Richer performance tags stay explicit.
             tags: {
               'ebk:cost-allocation': 'foundation',
               'ebk:cost-scope': '${name}/foundation/' + stage,
               'ebk:framework-version': '${frameworkVersion}',
               'ebk:managed-by': 'empire-builder-kit',
               'ebk:owner': 'foundation',
-              'ebk:production-profile':
-                process.env.EBK_PRODUCTION_FOUNDATION_PROFILE ?? 'standard',
-              'ebk:repository':
-                process.env.GITHUB_REPOSITORY ?? '${name}',
               'ebk:slice': 'foundation',
               'ebk:stage': stage,
               'ebk:workspace': '${name}',