@empire-builder-kit/nx 1.0.0-rc.2 → 1.0.0-rc.20

package/src/generators/preset/workspace-files.js

@@ -16,6 +16,7 @@ const index_js_6 = require("../../supply-chain/index.js");
 const deterministic_order_js_1 = require("../../deterministic-order.js");
 const tool_versions_js_1 = require("./tool-versions.js");
 const workspace_files_developer_agent_js_1 = require("./workspace-files-developer-agent.js");
+const workspace_files_ci_acceptance_js_1 = require("./workspace-files-ci-acceptance.js");
 const workspace_files_foundation_workload_roles_js_1 = require("./workspace-files-foundation-workload-roles.js");
 const workspace_files_performance_cost_js_1 = require("./workspace-files-performance-cost.js");
 const workspace_files_performance_load_js_1 = require("./workspace-files-performance-load.js");
@@ -60,11 +61,12 @@ exports.PLAN_PROVIDER_REFRESH_GLOBAL_READ_ACTIONS = [
     'rds:DescribeDBProxies',
     'rds:DescribeDBSubnetGroups',
 ];
-function validatePlanProviderRefreshPolicy(value, region, account) {
+function validatePlanProviderRefreshPolicy(value, region, account, stage) {
     if (!Array.isArray(value) ||
         value.length === 0 ||
         !/^[a-z]{2}(?:-gov)?-[a-z]+-\d$/.test(region) ||
-        !/^\d{12}$/.test(account)) {
+        !/^\d{12}$/.test(account) ||
+        !['production', 'staging'].includes(stage)) {
         throw new Error('Provider refresh policy must be a non-empty exact statement array for one account and region.');
     }
     const allowed = new Set(exports.PLAN_PROVIDER_REFRESH_READ_ACTIONS);
@@ -117,6 +119,14 @@ function validatePlanProviderRefreshPolicy(value, region, account) {
             if (resources.some((resource) => {
                 const arn = resource.split(':');
                 const target = arn.slice(5).join(':');
+                const boundedPathWildcard = target.endsWith('/*') && !/[*?]/.test(target.slice(0, -2));
+                const boundedLambdaStagePrefix = arn[2] === 'lambda' &&
+                    actions.every((action) => action.startsWith('lambda:') && !global.has(action)) &&
+                    new RegExp('^function:(?:' +
+                        stage +
+                        '-|[A-Za-z0-9][A-Za-z0-9_-]*-' +
+                        stage +
+                        '-)[A-Za-z0-9_-]*\\*$').test(target);
                 return (arn[0] !== 'arn' ||
                     arn[1] !== 'aws' ||
                     !/^[a-z0-9-]+$/.test(arn[2] ?? '') ||
@@ -124,7 +134,8 @@ function validatePlanProviderRefreshPolicy(value, region, account) {
                     !['', account].includes(arn[4] ?? '') ||
                     !target ||
                     (/[*?]/.test(target) &&
-                        (!target.endsWith('/*') || /[*?]/.test(target.slice(0, -2)))));
+                        !boundedPathWildcard &&
+                        !boundedLambdaStagePrefix));
             })) {
                 throw new Error(`Provider refresh statement ${index} is not bounded to exact targets in the selected account and region.`);
             }
@@ -474,6 +485,8 @@ function planRoleAuditStep(branch, mode = 'produce') {
           EBK_PLAN_ENVIRONMENT: infrastructure-plan-${stage}
           EBK_PLAN_ROLE_ARN: \${{ env.AWS_PLAN_ROLE_ARN }}
           EBK_PLAN_REPOSITORY: \${{ github.repository }}
+          EBK_PLAN_REPOSITORY_ID: \${{ github.repository_id }}
+          EBK_PLAN_REPOSITORY_OWNER_ID: \${{ github.repository_owner_id }}
         run: |
           role_name="\${EBK_PLAN_ROLE_ARN##*/}"
           test "$(aws sts get-caller-identity --query Account --output text)" = "$AWS_EXPECTED_ACCOUNT_ID" ||
@@ -506,8 +519,23 @@ function planRoleAuditStep(branch, mode = 'produce') {
           const role = JSON.parse(readFileSync(process.argv[2], 'utf8')).Role;
           const policy = JSON.parse(readFileSync(process.argv[3], 'utf8')).PolicyDocument;
           const account = process.env.AWS_EXPECTED_ACCOUNT_ID;
+          const repository = process.env.EBK_PLAN_REPOSITORY ?? '';
+          const repositoryId = process.env.EBK_PLAN_REPOSITORY_ID ?? '';
+          const repositoryOwnerId = process.env.EBK_PLAN_REPOSITORY_OWNER_ID ?? '';
           const stateBucketArn = process.env.AWS_PLAN_STATE_BUCKET_ARN;
           const stateKmsKeyArn = process.env.AWS_PLAN_STATE_KMS_KEY_ARN;
+          if (
+            !/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})\\/[A-Za-z0-9_.-]{1,100}$/.test(
+              repository,
+            ) ||
+            !/^[1-9][0-9]*$/.test(repositoryOwnerId) ||
+            !/^[1-9][0-9]*$/.test(repositoryId)
+          ) throw new Error('Exact immutable GitHub repository identity is required.');
+          const [repositoryOwner, repositoryName] = repository.split('/');
+          const oidcSubject =
+            'repo:' + repositoryOwner + '@' + repositoryOwnerId + '/' +
+            repositoryName + '@' + repositoryId + ':environment:' +
+            process.env.EBK_PLAN_ENVIRONMENT;
           const parseExactArnArray = (name, pattern) => {
             let value;
             try {
@@ -551,6 +579,7 @@ function planRoleAuditStep(branch, mode = 'produce') {
             'AWS_PLAN_GENERATED_SECRET_ARNS_JSON',
             new RegExp('^arn:aws:secretsmanager:' + process.env.AWS_REGION + ':' + account + ':secret:ebk/'),
           );
+          const stateStage = process.env.EBK_PLAN_BRANCH === 'main' ? 'production' : 'staging';
           let providerRefreshPolicy;
           try {
             providerRefreshPolicy = JSON.parse(
@@ -614,6 +643,23 @@ function planRoleAuditStep(branch, mode = 'produce') {
                 for (const resource of resources) {
                   const arn = resource.split(':');
                   const target = arn.slice(5).join(':');
+                  const boundedPathWildcard =
+                    target.endsWith('/*') &&
+                    !/[*?]/.test(target.slice(0, -2));
+                  const boundedLambdaStagePrefix =
+                    arn[2] === 'lambda' &&
+                    actions.every(
+                      (action) =>
+                        action.startsWith('lambda:') &&
+                        !globalProviderReadActions.has(action),
+                    ) &&
+                    new RegExp(
+                      '^function:(?:' +
+                        stateStage +
+                        '-|[A-Za-z0-9][A-Za-z0-9_-]*-' +
+                        stateStage +
+                        '-)[A-Za-z0-9_-]*\\\\*$',
+                    ).test(target);
                   if (
                     arn[0] !== 'arn' ||
                     arn[1] !== 'aws' ||
@@ -622,7 +668,8 @@ function planRoleAuditStep(branch, mode = 'produce') {
                     !['', account].includes(arn[4] ?? '') ||
                     !target ||
                     (/[*?]/.test(target) &&
-                      (!target.endsWith('/*') || /[*?]/.test(target.slice(0, -2))))
+                      !boundedPathWildcard &&
+                      !boundedLambdaStagePrefix)
                   ) throw new Error('Provider refresh statement ' + index + ' has a target outside the selected account and region.');
                 }
               }
@@ -637,7 +684,6 @@ function planRoleAuditStep(branch, mode = 'produce') {
           ).sort((left, right) =>
             left.Sid < right.Sid ? -1 : left.Sid > right.Sid ? 1 : 0,
           );
-          const stateStage = process.env.EBK_PLAN_BRANCH === 'main' ? 'production' : 'staging';
           if (
             stateKmsKeyArn &&
             stateKmsKeyArn !==
@@ -681,7 +727,7 @@ function planRoleAuditStep(branch, mode = 'produce') {
               Action: 'sts:AssumeRoleWithWebIdentity',
               Condition: { StringEquals: {
                 'token.actions.githubusercontent.com:aud': 'sts.amazonaws.com',
-                'token.actions.githubusercontent.com:sub': 'repo:' + process.env.EBK_PLAN_REPOSITORY + ':environment:' + process.env.EBK_PLAN_ENVIRONMENT,
+                'token.actions.githubusercontent.com:sub': oidcSubject,
               }},
             }],
           };
@@ -708,6 +754,19 @@ function planRoleAuditStep(branch, mode = 'produce') {
                 ],
                 Resource: '*',
               },
+              {
+                Sid: 'ObserveStageSecretVersionIdentity',
+                Effect: 'Allow',
+                Action: 'secretsmanager:ListSecretVersionIds',
+                Resource:
+                  'arn:aws:secretsmanager:' + process.env.AWS_REGION + ':' +
+                  account + ':secret:*',
+                Condition: {
+                  StringEquals: {
+                    'aws:ResourceTag/ebk:stage': stateStage,
+                  },
+                },
+              },
               {
                 Sid: 'ValidatePlannedIamPolicies',
                 Effect: 'Allow',
@@ -782,7 +841,10 @@ function planRoleAuditStep(branch, mode = 'produce') {
             generatedSecretArns,
             providerRefreshStatements,
             region: process.env.AWS_REGION,
-            repository: process.env.EBK_PLAN_REPOSITORY,
+            repository,
+            repositoryId,
+            repositoryOwnerId,
+            oidcSubject,
             role: {
               arn: role.Arn,
               policy: canonical(policy),
@@ -953,6 +1015,9 @@ const WORKSPACE_SEEDED_PATHS = new Set([
 exports.WORKSPACE_PACKAGE_MANAGED_JSON_POINTERS = [
     '/devDependencies/eslint-plugin-jsx-a11y',
     '/devDependencies/vitest',
+    '/engines/node',
+    '/engines/pnpm',
+    '/packageManager',
 ];
 exports.WORKSPACE_PROJECT_MANAGED_JSON_POINTERS = [
     '/name',
@@ -961,9 +1026,11 @@ exports.WORKSPACE_PROJECT_MANAGED_JSON_POINTERS = [
     '/root',
     '/tags',
     '/targets/blueprint-trust-check',
+    '/targets/blueprint-trust-check-main',
     '/targets/blueprint-trust-check-protected',
     '/targets/developer-context',
     '/targets/deployment-plan',
+    '/targets/deploy-local',
     '/targets/dev',
     '/targets/dev-doctor',
     '/targets/dev-setup',
@@ -973,6 +1040,7 @@ exports.WORKSPACE_PROJECT_MANAGED_JSON_POINTERS = [
     '/targets/supply-chain-check-protected',
     '/targets/supply-chain-scan',
     '/targets/verify',
+    '/targets/verify-proposed',
     '/targets/work-markers',
     '/targets/workload-role-candidate-report',
     '/targets/workload-role-provisioner-build',
@@ -983,6 +1051,10 @@ const FOUNDATION_SEEDED_PATHS = new Set([
     'docs/costs.md',
     'docs/runbooks.md',
     'docs/security.md',
+    'performance/account-cost-policy.json',
+    'security/router-waf-blocking-rehearsal.json',
+    'security/router-waf-live-evidence.json',
+    'security/router-waf.json',
 ]);
 function createFoundationOwnership(files, frameworkVersion) {
     const paths = Object.keys(files)
@@ -1045,7 +1117,16 @@ function createWorkspaceOwnership(files, frameworkVersion) {
 }
 function renderWorkspaceFiles(options) {
     const { frameworkVersion, name } = options;
+    const deploymentProfile = options.deploymentProfile ?? 'starter';
+    const initialRepositoryPolicy = (0, index_js_4.createIncubationRepositoryPolicy)(deploymentProfile);
+    initialRepositoryPolicy.deploymentAccounts = options.deploymentAccounts ?? {
+        development: null,
+        production: null,
+        staging: null,
+    };
+    initialRepositoryPolicy.deploymentRegion = options.deploymentRegion ?? null;
     const developerAgentFilePlan = (0, workspace_files_developer_agent_js_1.renderDeveloperAgentWorkspaceFilePlan)({
+        deploymentProfile,
         frameworkVersion,
         name,
     });
@@ -1056,7 +1137,13 @@ function renderWorkspaceFiles(options) {
     const pnpmAction = (0, index_js_3.pinnedAction)(index_js_3.GITHUB_ACTION_PINS.pnpmSetup);
     const setupNodeAction = (0, index_js_3.pinnedAction)(index_js_3.GITHUB_ACTION_PINS.setupNode);
     const uploadArtifactAction = (0, index_js_3.pinnedAction)(index_js_3.GITHUB_ACTION_PINS.uploadArtifact);
+    const protectedDevelopPromotion = "github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.head.ref == 'develop' && github.event.pull_request.base.ref == 'main'";
+    const protectedMainSync = "github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.head.ref == 'main' && github.event.pull_request.base.ref == 'develop'";
+    const protectedPush = "github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop')";
+    const protectedDeploymentRouteJobName = 'protected deployment route';
+    const stagingApplyJobPrefix = 'apply staging plan ';
     const files = {
+        ...(0, workspace_files_ci_acceptance_js_1.renderWorkspaceCiAcceptanceFiles)(),
         '.node-version': `${tool_versions_js_1.WORKSPACE_NODE_VERSION}\n`,
         '.github/CODEOWNERS': `# Replace this placeholder with the GitHub user or team that owns protected source.
 # GitHub bootstrap remains blocked until a non-placeholder catch-all owner is committed.
@@ -1072,15 +1159,77 @@ on:
   workflow_dispatch:
 
 concurrency:
-  group: verify-\${{ github.ref }}
-  cancel-in-progress: true
+  group: verify-\${{ github.event_name == 'push' && github.sha || github.ref }}
+  cancel-in-progress: \${{ github.event_name != 'push' }}
 
 permissions:
+  actions: read
   contents: read
+  pull-requests: read
+
+env:
+  EBK_CI_CANDIDATE_SHA: \${{ github.event.pull_request.head.sha || github.sha }}
 
 jobs:
+  acceptance:
+    name: accepted merge evidence
+    if: ${protectedPush}
+    runs-on: ubuntu-latest
+    outputs:
+      history_only: \${{ steps.resolve.outputs.history_only == 'true' && steps.restore.outcome == 'success' && steps.verify.outcome == 'success' }}
+      reused: \${{ steps.resolve.outputs.reused == 'true' && steps.restore.outcome == 'success' && steps.verify.outcome == 'success' }}
+      route: \${{ steps.resolve.outputs.reused == 'true' && steps.restore.outcome == 'success' && steps.verify.outcome == 'success' && steps.resolve.outputs.route || '' }}
+    steps:
+      - name: Check out immutable merged candidate
+        if: ${protectedPush}
+        uses: ${checkoutAction}
+        with:
+          fetch-depth: 0
+          ref: \${{ github.sha }}
+      - name: Resolve exact protected-route acceptance
+        if: ${protectedPush}
+        id: resolve
+        env:
+          GH_TOKEN: \${{ github.token }}
+        run: node tools/ci/workspace-acceptance.mjs resolve
+      - name: Restore exact protected-route acceptance
+        if: steps.resolve.outputs.reused == 'true'
+        id: restore
+        continue-on-error: true
+        env:
+          EBK_ACCEPTANCE_ARTIFACT_DIGEST: \${{ steps.resolve.outputs.artifact_digest }}
+          EBK_ACCEPTANCE_ARTIFACT_ID: \${{ steps.resolve.outputs.artifact_id }}
+          EBK_ACCEPTANCE_ARTIFACT_SIZE: \${{ steps.resolve.outputs.artifact_size }}
+          GH_TOKEN: \${{ github.token }}
+        run: >-
+          node tools/ci/workspace-acceptance.mjs download
+          .ebk/evidence/reused-acceptance
+          "$EBK_ACCEPTANCE_ARTIFACT_ID"
+          "$EBK_ACCEPTANCE_ARTIFACT_DIGEST"
+          "$EBK_ACCEPTANCE_ARTIFACT_SIZE"
+      - name: Verify exact merged-tree acceptance
+        if: steps.resolve.outputs.reused == 'true' && steps.restore.outcome == 'success'
+        id: verify
+        continue-on-error: true
+        env:
+          EBK_ACCEPTANCE_BASE: \${{ steps.resolve.outputs.base_commit }}
+          EBK_ACCEPTANCE_HEAD: \${{ steps.resolve.outputs.head_commit }}
+          EBK_ACCEPTANCE_ROUTE: \${{ steps.resolve.outputs.route }}
+          EBK_ACCEPTANCE_RUN_ATTEMPT: \${{ steps.resolve.outputs.run_attempt }}
+          EBK_ACCEPTANCE_RUN_ID: \${{ steps.resolve.outputs.run_id }}
+        run: >-
+          node tools/ci/workspace-acceptance.mjs verify
+          .ebk/evidence/reused-acceptance/manifest.json
+          "$EBK_ACCEPTANCE_HEAD"
+          "$EBK_ACCEPTANCE_BASE"
+          "$EBK_ACCEPTANCE_ROUTE"
+          "$EBK_ACCEPTANCE_RUN_ID"
+          "$EBK_ACCEPTANCE_RUN_ATTEMPT"
+
   policy:
     name: policy
+    needs: acceptance
+    if: always() && needs.acceptance.outputs.reused != 'true'
     runs-on: ubuntu-latest
     steps:
       - uses: ${checkoutAction}
@@ -1094,12 +1243,19 @@ jobs:
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - run: node tools/ebk-git-policy.mjs
+        env:
+          EBK_HEAD_REPOSITORY: \${{ github.event.pull_request.head.repo.full_name }}
 
   verify:
     name: verify
+    needs: acceptance
+    if: always() && needs.acceptance.outputs.reused != 'true'
     runs-on: ubuntu-latest
     steps:
       - uses: ${checkoutAction}
+        with:
+          fetch-depth: 0
+          ref: \${{ github.event.pull_request.head.sha || github.sha }}
       - uses: ${pnpmAction}
       - uses: ${setupNodeAction}
         with:
@@ -1107,9 +1263,80 @@ jobs:
           cache: pnpm
       - run: pnpm install --frozen-lockfile
       - run: pnpm nx format:check
-      - run: pnpm nx run-many -t verify --parallel=3
+      - name: Verify proposed workspace
+        if: github.event_name == 'pull_request' && !(${protectedDevelopPromotion} || ${protectedMainSync})
+        run: |
+          pnpm nx run ${name}:verify-proposed
+          pnpm nx run-many -t verify --exclude=${name} --parallel=3
+      - name: Verify protected develop promotion
+        if: github.event_name == 'pull_request' && ${protectedDevelopPromotion}
+        run: pnpm nx run-many -t verify --parallel=3
+      - name: Verify protected main sync
+        if: github.event_name == 'pull_request' && ${protectedMainSync}
+        run: |
+          pnpm nx run ${name}:blueprint-trust-check-main
+          pnpm nx run ${name}:verify-proposed
+          pnpm nx run-many -t verify --exclude=${name} --parallel=3
+      - name: Verify adopted workspace
+        if: github.event_name != 'pull_request'
+        run: pnpm nx run-many -t verify --parallel=3
+
+  seal-acceptance:
+    name: seal protected route acceptance
+    needs: [policy, verify]
+    if: >-
+      always() &&
+      needs.policy.result == 'success' &&
+      needs.verify.result == 'success' &&
+      github.event_name == 'pull_request' &&
+      (${protectedDevelopPromotion} || ${protectedMainSync})
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out immutable accepted candidate
+        uses: ${checkoutAction}
+        with:
+          fetch-depth: 0
+          ref: \${{ env.EBK_CI_CANDIDATE_SHA }}
+      - name: Seal exact protected-route acceptance
+        id: seal
+        env:
+          EBK_BASE_COMMIT: \${{ github.event.pull_request.base.sha }}
+          EBK_HEAD_REPOSITORY: \${{ github.event.pull_request.head.repo.full_name }}
+        run: >-
+          node tools/ci/workspace-acceptance.mjs seal
+          .ebk/evidence/ci/workspace-acceptance/manifest.json
+      - name: Retain exact protected-route acceptance
+        if: steps.seal.outputs.sealed == 'true'
+        uses: ${uploadArtifactAction}
+        with:
+          name: workspace-acceptance-\${{ env.EBK_CI_CANDIDATE_SHA }}-\${{ github.run_id }}-\${{ github.run_attempt }}
+          path: .ebk/evidence/ci/workspace-acceptance
+          if-no-files-found: error
+          include-hidden-files: true
+          retention-days: 30
+
+  release-candidate:
+    name: build immutable release candidates
+    needs: [acceptance, policy, verify]
+    if: >-
+      always() &&
+      github.event_name == 'push' &&
+      needs.acceptance.outputs.history_only != 'true' &&
+      (needs.acceptance.outputs.reused == 'true' ||
+      (needs.policy.result == 'success' && needs.verify.result == 'success'))
+    runs-on: ubuntu-latest
+    steps:
+      - uses: ${checkoutAction}
+        with:
+          fetch-depth: 0
+          ref: \${{ github.sha }}
+      - uses: ${pnpmAction}
+      - uses: ${setupNodeAction}
+        with:
+          node-version: ${tool_versions_js_1.WORKSPACE_NODE_VERSION}
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile
       - name: Build immutable release candidates
-        if: github.event_name == 'push'
         env:
           EBK_SOURCE_COMMIT: \${{ github.sha }}
         run: |
@@ -1127,7 +1354,6 @@ jobs:
               ".ebk/evidence/release-candidate/packages/$project/"
           done
       - name: Retain exact immutable release candidate
-        if: github.event_name == 'push'
         uses: ${uploadArtifactAction}
         with:
           name: release-candidate-\${{ github.sha }}
@@ -1162,7 +1388,97 @@ permissions:
   contents: read
 
 jobs:
+  history-classification:
+    name: classify protected history-only sync
+    if: github.event_name == 'push' && github.ref == 'refs/heads/develop'
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      pull-requests: read
+    outputs:
+      history_only: \${{ steps.resolve.outputs.history_only == 'true' && steps.restore.outcome == 'success' && steps.verify.outcome == 'success' }}
+    steps:
+      - name: Check out immutable protected candidate
+        uses: ${checkoutAction}
+        with:
+          fetch-depth: 0
+          ref: \${{ github.sha }}
+      - uses: ${setupNodeAction}
+        with:
+          node-version: ${tool_versions_js_1.WORKSPACE_NODE_VERSION}
+      - name: Resolve exact protected-route acceptance
+        id: resolve
+        env:
+          GH_TOKEN: \${{ github.token }}
+        run: node tools/ci/workspace-acceptance.mjs resolve
+      - name: Restore exact protected-route acceptance
+        if: steps.resolve.outputs.reused == 'true'
+        id: restore
+        continue-on-error: true
+        env:
+          EBK_ACCEPTANCE_ARTIFACT_DIGEST: \${{ steps.resolve.outputs.artifact_digest }}
+          EBK_ACCEPTANCE_ARTIFACT_ID: \${{ steps.resolve.outputs.artifact_id }}
+          EBK_ACCEPTANCE_ARTIFACT_SIZE: \${{ steps.resolve.outputs.artifact_size }}
+          GH_TOKEN: \${{ github.token }}
+        run: >-
+          node tools/ci/workspace-acceptance.mjs download
+          .ebk/evidence/reused-history-acceptance
+          "$EBK_ACCEPTANCE_ARTIFACT_ID"
+          "$EBK_ACCEPTANCE_ARTIFACT_DIGEST"
+          "$EBK_ACCEPTANCE_ARTIFACT_SIZE"
+      - name: Verify exact history-only acceptance
+        if: steps.resolve.outputs.reused == 'true' && steps.restore.outcome == 'success'
+        id: verify
+        continue-on-error: true
+        env:
+          EBK_ACCEPTANCE_BASE: \${{ steps.resolve.outputs.base_commit }}
+          EBK_ACCEPTANCE_HEAD: \${{ steps.resolve.outputs.head_commit }}
+          EBK_ACCEPTANCE_ROUTE: \${{ steps.resolve.outputs.route }}
+          EBK_ACCEPTANCE_RUN_ATTEMPT: \${{ steps.resolve.outputs.run_attempt }}
+          EBK_ACCEPTANCE_RUN_ID: \${{ steps.resolve.outputs.run_id }}
+        run: >-
+          node tools/ci/workspace-acceptance.mjs verify
+          .ebk/evidence/reused-history-acceptance/manifest.json
+          "$EBK_ACCEPTANCE_HEAD"
+          "$EBK_ACCEPTANCE_BASE"
+          "$EBK_ACCEPTANCE_ROUTE"
+          "$EBK_ACCEPTANCE_RUN_ID"
+          "$EBK_ACCEPTANCE_RUN_ATTEMPT"
+
+  deployment-mode:
+    name: classify deployment profile
+    runs-on: ubuntu-latest
+    outputs:
+      profile: \${{ steps.profile.outputs.profile }}
+    steps:
+      - name: Check out immutable deployment policy
+        uses: ${checkoutAction}
+        with:
+          ref: \${{ github.sha }}
+      - id: profile
+        name: Read exact committed deployment profile
+        run: |
+          node - <<'NODE'
+          const { readFileSync } = require('node:fs');
+          const policy = JSON.parse(readFileSync('ebk.repository-policy.json', 'utf8'));
+          const profiles = new Set(['starter', 'production-isolated', 'fully-isolated']);
+          if (!profiles.has(policy.deploymentProfile)) {
+            throw new Error('Committed deployment profile is absent or invalid.');
+          }
+          require('node:fs').appendFileSync(
+            process.env.GITHUB_OUTPUT,
+            'profile=' + policy.deploymentProfile + '\\n',
+          );
+          NODE
+
   route:
+    name: ${protectedDeploymentRouteJobName}
+    needs: [history-classification, deployment-mode]
+    if: >-
+      always() &&
+      needs.history-classification.outputs.history_only != 'true' &&
+      needs.deployment-mode.result == 'success'
     runs-on: ubuntu-latest
     steps:
       - name: Validate protected ref
@@ -1175,14 +1491,22 @@ jobs:
           esac
 
   plan-staging:
-    needs: route
-    if: github.ref == 'refs/heads/develop'
+    needs: [route, deployment-mode]
+    if: >-
+      github.ref == 'refs/heads/develop' &&
+      (github.event_name == 'workflow_dispatch' ||
+      needs.deployment-mode.outputs.profile != 'starter')
     runs-on: ubuntu-latest
     outputs:
+      deployment_profile: \${{ steps.plan.outputs.deployment_profile }}
+      deployment_region: \${{ steps.plan.outputs.deployment_region }}
+      development_account_id: \${{ steps.plan.outputs.development_account_id }}
       foundation_project: \${{ steps.plan.outputs.foundation_project }}
       has_slices: \${{ steps.plan.outputs.has_slices }}
       ordered_projects: \${{ steps.plan.outputs.ordered_projects }}
+      production_account_id: \${{ steps.plan.outputs.production_account_id }}
       slice_projects: \${{ steps.plan.outputs.slice_projects }}
+      staging_account_id: \${{ steps.plan.outputs.staging_account_id }}
     steps:
       - uses: ${checkoutAction}
         with:
@@ -1393,16 +1717,21 @@ jobs:
           path: .ebk/evidence/staging-release-source/**
 
   plan-production:
-    needs: route
+    needs: [route, deployment-mode]
     if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     outputs:
+      deployment_profile: \${{ steps.plan.outputs.deployment_profile }}
+      deployment_region: \${{ steps.plan.outputs.deployment_region }}
+      development_account_id: \${{ steps.plan.outputs.development_account_id }}
       foundation_project: \${{ steps.plan.outputs.foundation_project }}
       foundation_profile: \${{ steps.plan.outputs.foundation_profile }}
       has_slices: \${{ steps.plan.outputs.has_slices }}
       ordered_projects: \${{ steps.plan.outputs.ordered_projects }}
       production_approval_mode: \${{ steps.plan.outputs.production_approval_mode }}
+      production_account_id: \${{ steps.plan.outputs.production_account_id }}
       slice_projects: \${{ steps.plan.outputs.slice_projects }}
+      staging_account_id: \${{ steps.plan.outputs.staging_account_id }}
     steps:
       - uses: ${checkoutAction}
         with:
@@ -1723,6 +2052,8 @@ jobs:
       EBK_RELEASE_SOURCE_COMMIT: \${{ needs.release-source-staging.outputs.source_commit }}
       EBK_SOURCE_COMMIT: \${{ needs.release-source-staging.outputs.source_commit }}
       EBK_STAGE: staging
+      EBK_POLICY_ACCOUNT_ID: \${{ needs.plan-staging.outputs.staging_account_id }}
+      EBK_POLICY_REGION: \${{ needs.plan-staging.outputs.deployment_region }}
       SLICE_PROJECTS: \${{ needs.plan-staging.outputs.slice_projects }}
     steps:
       - uses: ${checkoutAction}
@@ -1738,6 +2069,10 @@ jobs:
       - run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
       - name: Verify managed workspace integrity before AWS authority
         run: pnpm nx run ${name}:workspace-health
+      - name: Bind staging account to committed deployment topology
+        run: |
+          test "$AWS_EXPECTED_ACCOUNT_ID" = "$EBK_POLICY_ACCOUNT_ID"
+          test "$AWS_REGION" = "$EBK_POLICY_REGION"
 ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - uses: ${configureAwsAction}
         with:
           role-to-assume: \${{ secrets.AWS_DEPLOY_ROLE_ARN }}
@@ -1777,6 +2112,8 @@ ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - uses: ${c
       EBK_RELEASE_SOURCE_COMMIT: \${{ needs.release-source-staging.outputs.source_commit }}
       EBK_SOURCE_COMMIT: \${{ needs.release-source-staging.outputs.source_commit }}
       EBK_STAGE: staging
+      EBK_POLICY_ACCOUNT_ID: \${{ needs.plan-staging.outputs.staging_account_id }}
+      EBK_POLICY_REGION: \${{ needs.plan-staging.outputs.deployment_region }}
       SLICE_PROJECTS: \${{ needs.plan-staging.outputs.slice_projects }}
     steps:
       - uses: ${checkoutAction}
@@ -1792,6 +2129,10 @@ ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - uses: ${c
       - run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
       - name: Verify managed workspace integrity before AWS authority
         run: pnpm nx run ${name}:workspace-health
+      - name: Bind staging account to committed deployment topology
+        run: |
+          test "$AWS_EXPECTED_ACCOUNT_ID" = "$EBK_POLICY_ACCOUNT_ID"
+          test "$AWS_REGION" = "$EBK_POLICY_REGION"
 ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - name: Restore both native platform records
         uses: ${downloadArtifactAction}
         with:
@@ -1833,6 +2174,10 @@ ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - name: Res
       AWS_DEPLOY_ROLE_ARN: \${{ secrets.AWS_DEPLOY_ROLE_ARN }}
       AWS_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_EXPECTED_ACCOUNT_ID }}
       AWS_REGION: \${{ vars.AWS_REGION }}
+      EBK_DEPLOYMENT_PROFILE: \${{ needs.plan-production.outputs.deployment_profile }}
+      EBK_POLICY_PRODUCTION_ACCOUNT_ID: \${{ needs.plan-production.outputs.production_account_id }}
+      EBK_POLICY_REGION: \${{ needs.plan-production.outputs.deployment_region }}
+      EBK_POLICY_STAGING_ACCOUNT_ID: \${{ needs.plan-production.outputs.staging_account_id }}
       EBK_CANDIDATE_RUN_ATTEMPT: \${{ needs.release-source-production.outputs.candidate_run_attempt }}
       EBK_CANDIDATE_RUN_ID: \${{ needs.release-source-production.outputs.candidate_run_id }}
       EBK_RELEASE_SOURCE_COMMIT: \${{ needs.release-source-production.outputs.source_commit }}
@@ -1933,11 +2278,13 @@ ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - name: Res
             cp "$source_sidecar" "$target"
           done
       - uses: ${configureAwsAction}
+        if: env.EBK_DEPLOYMENT_PROFILE != 'starter'
         with:
           role-to-assume: \${{ secrets.AWS_STAGING_PROMOTION_PULL_ROLE_ARN }}
           role-session-name: ebk-staging-container-pull-\${{ github.run_id }}-\${{ github.run_attempt }}
           aws-region: \${{ vars.AWS_STAGING_PROMOTION_REGION }}
       - name: Authenticate exact staging source registry
+        if: env.EBK_DEPLOYMENT_PROFILE != 'starter'
         env:
           EBK_STAGING_ACCOUNT_ID: \${{ vars.AWS_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID }}
           EBK_STAGING_REGION: \${{ vars.AWS_STAGING_PROMOTION_REGION }}
@@ -1956,10 +2303,27 @@ ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - name: Res
           role-to-assume: \${{ secrets.AWS_DEPLOY_ROLE_ARN }}
           role-session-name: ebk-production-container-push-\${{ github.run_id }}-\${{ github.run_attempt }}
           aws-region: \${{ vars.AWS_REGION }}
+      - name: Bind production authority to committed deployment topology
+        run: |
+          test "$AWS_EXPECTED_ACCOUNT_ID" = "$EBK_POLICY_PRODUCTION_ACCOUNT_ID" ||
+            { echo 'Production environment account differs from committed deployment topology'; exit 1; }
+          test "$AWS_REGION" = "$EBK_POLICY_REGION" ||
+            { echo 'Production environment Region differs from committed deployment topology'; exit 1; }
+      - name: Authenticate shared-account staging source registry
+        if: env.EBK_DEPLOYMENT_PROFILE == 'starter'
+        run: |
+          test "$EBK_POLICY_STAGING_ACCOUNT_ID" = "$EBK_POLICY_PRODUCTION_ACCOUNT_ID" ||
+            { echo 'Starter promotion requires one shared AWS account'; exit 1; }
+          registry_suffix=.com
+          case "$EBK_POLICY_REGION" in cn-*) registry_suffix=.com.cn ;; esac
+          aws ecr get-login-password --region "$EBK_POLICY_REGION" |
+            docker login --username AWS --password-stdin \
+              "$EBK_POLICY_STAGING_ACCOUNT_ID.dkr.ecr.$EBK_POLICY_REGION.amazonaws$registry_suffix"
       - name: Promote exact staging indexes without rebuilding
         env:
-          EBK_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID }}
-          EBK_STAGING_PROMOTION_REGION: \${{ vars.AWS_STAGING_PROMOTION_REGION }}
+          EBK_DEPLOYMENT_PROFILE: \${{ needs.plan-production.outputs.deployment_profile }}
+          EBK_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID: \${{ needs.plan-production.outputs.deployment_profile == 'starter' && needs.plan-production.outputs.staging_account_id || vars.AWS_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID }}
+          EBK_STAGING_PROMOTION_REGION: \${{ needs.plan-production.outputs.deployment_profile == 'starter' && needs.plan-production.outputs.deployment_region || vars.AWS_STAGING_PROMOTION_REGION }}
         run: |
           test "$(aws sts get-caller-identity --query Account --output text)" = "$AWS_EXPECTED_ACCOUNT_ID" ||
             { echo 'Production promotion role account differs from policy'; exit 1; }
@@ -2178,6 +2542,8 @@ ${planRoleAuditStep('main', 'verify')}
       EBK_RELEASE_SOURCE_COMMIT: \${{ needs.release-source-staging.outputs.source_commit }}
       EBK_SOURCE_COMMIT: \${{ github.sha }}
       EBK_STAGE: staging
+      EBK_POLICY_ACCOUNT_ID: \${{ needs.plan-staging.outputs.staging_account_id }}
+      EBK_POLICY_REGION: \${{ needs.plan-staging.outputs.deployment_region }}
       FOUNDATION_PROJECT: \${{ needs.plan-staging.outputs.foundation_project }}
       ORDERED_PROJECTS: \${{ needs.plan-staging.outputs.ordered_projects }}
       SLICE_PROJECTS: \${{ needs.plan-staging.outputs.slice_projects }}
@@ -2285,7 +2651,7 @@ ${planRoleAuditStep('develop', 'verify')}
             packages/*/.ebk/evidence/infrastructure-plan-command.json
 
   deploy-staging:
-    name: apply staging plan \${{ needs.infrastructure-plan-staging.outputs.plan_digest || 'recovery-without-resource-plan' }}
+    name: ${stagingApplyJobPrefix}\${{ needs.infrastructure-plan-staging.outputs.plan_digest || 'recovery-without-resource-plan' }}
     needs: [plan-staging, release-source-staging, container-assemble-staging, infrastructure-plan-staging]
     if: |
       always() &&
@@ -2364,6 +2730,10 @@ ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - name: Res
           test -n "$AWS_DEPLOY_ROLE_ARN" || { echo 'staging AWS_DEPLOY_ROLE_ARN is required'; exit 1; }
           test -n "$AWS_EXPECTED_ACCOUNT_ID" || { echo 'staging AWS_EXPECTED_ACCOUNT_ID is required'; exit 1; }
           test -n "$AWS_REGION" || { echo 'staging AWS_REGION is required'; exit 1; }
+          test "$AWS_EXPECTED_ACCOUNT_ID" = "$EBK_POLICY_ACCOUNT_ID" ||
+            { echo 'staging environment account differs from committed deployment topology'; exit 1; }
+          test "$AWS_REGION" = "$EBK_POLICY_REGION" ||
+            { echo 'staging environment Region differs from committed deployment topology'; exit 1; }
           test -n "$EBK_FLEET_ORIGIN" ||
             { echo 'staging environment EBK_FLEET_ORIGIN is required'; exit 1; }
           test "$EBK_FLEET_ORIGIN" = "$EBK_PLANNED_FLEET_ORIGIN" ||
@@ -2375,8 +2745,7 @@ ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - name: Res
             test -n "$AWS_PLAN_GENERATED_SECRET_ARNS_JSON" &&
             test -n "$AWS_PLAN_PROVIDER_REFRESH_POLICY_JSON" ||
             { echo 'staging exact plan-discovery inputs are required'; exit 1; }
-          test -n "$AWS_PLAN_ROLE_ARN" &&
-            test -n "$AWS_PLAN_STATE_KMS_KEY_ARN" ||
+          test -n "$AWS_PLAN_ROLE_ARN" ||
             { echo 'staging exact plan-authority inputs are required'; exit 1; }
           case "$AWS_DEPLOY_ROLE_ARN" in
             arn:aws:iam::$AWS_EXPECTED_ACCOUNT_ID:role/*) ;;
@@ -3000,6 +3369,8 @@ ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - name: Res
       EBK_APPROVED_MAIN_COMMIT: \${{ github.sha }}
       EBK_SOURCE_COMMIT: \${{ github.sha }}
       EBK_STAGE: production
+      EBK_POLICY_ACCOUNT_ID: \${{ needs.plan-production.outputs.production_account_id }}
+      EBK_POLICY_REGION: \${{ needs.plan-production.outputs.deployment_region }}
       EBK_VERIFIED_STAGING_RUN_ID: \${{ needs.release-source-production.outputs.verified_staging_run_id }}
       FOUNDATION_PROJECT: \${{ needs.plan-production.outputs.foundation_project }}
       ORDERED_PROJECTS: \${{ needs.plan-production.outputs.ordered_projects }}
@@ -3096,6 +3467,10 @@ ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - name: Res
           test -n "$AWS_DEPLOY_ROLE_ARN" || { echo 'production AWS_DEPLOY_ROLE_ARN is required'; exit 1; }
           test -n "$AWS_EXPECTED_ACCOUNT_ID" || { echo 'production AWS_EXPECTED_ACCOUNT_ID is required'; exit 1; }
           test -n "$AWS_REGION" || { echo 'production AWS_REGION is required'; exit 1; }
+          test "$AWS_EXPECTED_ACCOUNT_ID" = "$EBK_POLICY_ACCOUNT_ID" ||
+            { echo 'production environment account differs from committed deployment topology'; exit 1; }
+          test "$AWS_REGION" = "$EBK_POLICY_REGION" ||
+            { echo 'production environment Region differs from committed deployment topology'; exit 1; }
           test -n "$EBK_FLEET_ORIGIN" ||
             { echo 'production environment EBK_FLEET_ORIGIN is required'; exit 1; }
           test "$EBK_FLEET_ORIGIN" = "$EBK_PLANNED_FLEET_ORIGIN" ||
@@ -3107,8 +3482,7 @@ ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - name: Res
             test -n "$AWS_PLAN_GENERATED_SECRET_ARNS_JSON" &&
             test -n "$AWS_PLAN_PROVIDER_REFRESH_POLICY_JSON" ||
             { echo 'production exact plan-discovery inputs are required'; exit 1; }
-          test -n "$AWS_PLAN_ROLE_ARN" &&
-            test -n "$AWS_PLAN_STATE_KMS_KEY_ARN" ||
+          test -n "$AWS_PLAN_ROLE_ARN" ||
             { echo 'production exact plan-authority inputs are required'; exit 1; }
           case "$AWS_DEPLOY_ROLE_ARN" in
             arn:aws:iam::$AWS_EXPECTED_ACCOUNT_ID:role/*) ;;
@@ -4762,13 +5136,51 @@ permissions:
   contents: read
 
 jobs:
+  deployment-classification:
+    name: classify exact staging deployment
+    if: >-
+      github.event_name == 'workflow_run' &&
+      github.event.workflow_run.event == 'push' &&
+      github.event.workflow_run.head_branch == 'develop' &&
+      github.event.workflow_run.conclusion == 'success'
+    permissions:
+      actions: read
+      contents: read
+    outputs:
+      deployed: \${{ steps.classify.outputs.deployed }}
+    runs-on: ubuntu-latest
+    steps:
+      - id: classify
+        name: Require one successful staging deployment job
+        env:
+          EBK_DEPLOYMENT_RUN_ID: \${{ github.event.workflow_run.id }}
+          GH_TOKEN: \${{ github.token }}
+          GH_REPO: \${{ github.repository }}
+        run: |
+          jobs="$(gh api \
+            "/repos/$GH_REPO/actions/runs/$EBK_DEPLOYMENT_RUN_ID/jobs?filter=latest&per_page=100")"
+          apply_count="$(printf '%s' "$jobs" | jq \
+            '[.jobs[] | select(.name | startswith("${stagingApplyJobPrefix}")) | select(.conclusion == "success")] | length')"
+          route_success_count="$(printf '%s' "$jobs" | jq \
+            '[.jobs[] | select(.name == "${protectedDeploymentRouteJobName}" and .conclusion == "success")] | length')"
+          route_skipped_count="$(printf '%s' "$jobs" | jq \
+            '[.jobs[] | select(.name == "${protectedDeploymentRouteJobName}" and .conclusion == "skipped")] | length')"
+          case "$apply_count:$route_success_count:$route_skipped_count" in
+            1:1:0) echo 'deployed=true' >> "$GITHUB_OUTPUT" ;;
+            0:0:1) echo 'deployed=false' >> "$GITHUB_OUTPUT" ;;
+            *) echo 'Deploy route and staging application evidence disagree'; exit 1 ;;
+          esac
+
   plan:
+    needs: deployment-classification
     if: >-
-      (github.event_name == 'workflow_run' &&
+      always() &&
+      ((github.event_name == 'workflow_run' &&
       github.event.workflow_run.conclusion == 'success' &&
       github.event.workflow_run.event == 'push' &&
-      github.event.workflow_run.head_branch == 'develop') ||
-      github.event_name == 'workflow_dispatch'
+      github.event.workflow_run.head_branch == 'develop' &&
+      needs.deployment-classification.outputs.deployed == 'true') ||
+      github.event_name == 'workflow_dispatch')
     outputs:
       deployment_run_attempt: \${{ steps.identity.outputs.deployment_run_attempt }}
       deployment_run_id: \${{ steps.identity.outputs.deployment_run_id }}
@@ -4875,9 +5287,10 @@ jobs:
       EBK_SMOKE_AUTHORITY_VERSION: \${{ vars.EBK_SMOKE_AUTHORITY_VERSION }}
       EBK_SMOKE_TARGETS: \${{ vars.EBK_SMOKE_TARGETS }}
       EBK_SOURCE_COMMIT: \${{ needs.plan.outputs.source_commit }}
-      PLAYWRIGHT_BROWSERS_PATH: \${{ runner.temp }}/ebk-playwright-browsers
     runs-on: ubuntu-latest
     steps:
+      - name: Initialize private browser cache path
+        run: echo "PLAYWRIGHT_BROWSERS_PATH=$RUNNER_TEMP/ebk-playwright-browsers" >> "$GITHUB_ENV"
       - name: Validate credential-free preparation
         run: |
           test -n "$AWS_EXPECTED_ACCOUNT_ID" || { echo 'AWS_EXPECTED_ACCOUNT_ID is required'; exit 1; }
@@ -5261,14 +5674,14 @@ jobs:
           test "$(node --version | cut -d. -f1)" = v22
       - name: Run exact deployed smoke
         working-directory: \${{ runner.temp }}/ebk-prepared-workspace
-        run: node node_modules/nx/bin/nx.js run "$EBK_PROJECT:smoke-deployed"
+        run: node node_modules/nx/dist/bin/nx.js run "$EBK_PROJECT:smoke-deployed"
       - name: Verify reviewed frontend visual baseline
         working-directory: \${{ runner.temp }}/ebk-prepared-workspace
-        run: node node_modules/nx/bin/nx.js run "$EBK_PROJECT:frontend-visual"
+        run: node node_modules/nx/dist/bin/nx.js run "$EBK_PROJECT:frontend-visual"
       - name: Verify deployed frontend security headers
         working-directory: \${{ runner.temp }}/ebk-prepared-workspace
         run: |
-          node node_modules/nx/bin/nx.js run \
+          node node_modules/nx/dist/bin/nx.js run \
             "$EBK_PROJECT:frontend-security-headers" -- \
             --url="$EBK_SMOKE_URL"
       - name: Bind exact alarm and data-integrity evidence
@@ -6715,11 +7128,11 @@ jobs:
           if [ "$EBK_ACTION" = apply ]; then args+=("--apply"); fi
           pnpm nx run "$EBK_PROJECT:secret-metadata" -- "\${args[@]}"
 `,
-        '.github/workflows/sync-back.yml': `name: Sync production history
+        '.github/workflows/sync-back.yml': `name: Sync protected main history
 
 on:
   workflow_run:
-    workflows: [Deploy]
+    workflows: [Verify]
     types: [completed]
 
 permissions:
@@ -6730,6 +7143,7 @@ jobs:
   sync-back:
     if: >-
       github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.event == 'push' &&
       github.event.workflow_run.head_branch == 'main'
     runs-on: ubuntu-latest
     steps:
@@ -6743,8 +7157,8 @@ jobs:
             gh pr create \
               --head main \
               --base develop \
-              --title 'chore: sync production history to develop' \
-              --body 'Managed EBK sync-back. Review and merge; this workflow never pushes or auto-merges.'
+              --title 'chore(git): sync protected main to develop' \
+              --body 'Managed EBK source-history sync. Review and merge; this does not claim or waive independent staging or production deployment evidence, and this workflow never pushes or auto-merges.'
             number=$(gh pr list --state open --head main --base develop --json number --jq '.[0].number')
           fi
           echo "Sync-back pull request #$number is ready for review."
@@ -6989,6 +7403,8 @@ dist
 .open-next
 .sst
 **/next-env.d.ts
+**/api/generated/*.json
+**/database/migrations/**
 pnpm-lock.yaml
 tools/blueprint-trust-check.mjs
 `,
@@ -7096,6 +7512,16 @@ use the direct installed \`.bin/ebk blueprint verification-review\` entry docume
 \`docs/blueprints.md\`.
 
 Workspace creation only writes source files. It does not create or change cloud resources.
+
+New workspaces default to the one-account \`starter\` deployment profile. Configure the exact
+shared account and Region in \`ebk.repository-policy.json\`, authenticate through IAM Identity
+Center, add exact development and staging CIDRs to
+\`packages/foundation/security/router-waf.json\`, and use
+\`pnpm nx run ${name}:deploy-local -- --stage=development
+--profile=<profile> --expectedRoleArn=<role-arn>\`. Never invoke SST directly.
+For a brand-new stage with generated Product Slices, complete the documented workload-role
+Foundation publication and pass \`--phase=foundation-bootstrap\` once before publishing and
+deploying the complete stage.
 `,
         'docs/architecture.md': `# Workspace architecture
 
@@ -7112,6 +7538,11 @@ Foundation implementation files.
 Canonical consumer stages use the matching \`development\`, \`staging\`, or \`production\`
 Foundation. Framework-derived personal stages may use only the \`development\`
 Foundation; generic preview stages are unsupported.
+
+The committed deployment profile changes account and local/GitHub authority only. Every
+canonical stage always owns a separate Router/domain, Aurora cluster and migration history,
+Cognito user pool, event bus, secret namespace, IAM boundary, logs, queues, ECR namespace, and
+stage-qualified SSM discovery contract. Discovery rejects a record for another canonical stage.
 `,
         'docs/git-workflow.md': `# Protected Git workflow
 
@@ -7132,6 +7563,9 @@ GitHub rulesets, environments, and AWS IAM are the authorization boundaries; loc
 only defense in depth.
 
 The \`staging\` environment accepts only \`develop\`; \`production\` accepts only \`main\`.
+These workflows exist for every deployment profile. The staging workflow is optional for
+\`starter\`, whose governed local Nx target may deploy development and staging. Production is
+GitHub-only for every profile; \`fully-isolated\` also requires GitHub for staging.
 The committed \`productionApproval.mode\` selects one of two production authorization
 contracts:
 
@@ -7154,14 +7588,22 @@ contracts:
 Both modes retain required checks, a non-author CODEOWNER approval, no ruleset bypass, the
 literal production environment, and its branch-scoped credentials. The base \`staging\` and
 \`production\` environments own deployment, smoke, and ECR evidence roles plus their
-variables; production also owns the staging-registry promotion pull role. Dedicated
+variables; isolated profiles also keep the staging-registry promotion pull role in production.
+Starter promotion authenticates once to the shared account and copies the exact staging digest
+into a distinct production ECR repository. Dedicated
 \`infrastructure-plan-<stage>\` environments gate read-only role use. Separate
 \`async-recovery-<stage>\`, \`performance-aggregate-<stage>\`,
 \`performance-cost-<stage>\`, \`performance-load-<stage>\`, and
 \`reliability-read-<stage>\` environments own only the role and variables required by that
 capability. Infrastructure-plan jobs use a repository-variable read-only role/input inventory;
 an independent clean audit job assumes that exact environment-subject role and verifies its
-trust and complete inline policy before any repository-backed plan job may assume it. Every
+trust and complete inline policy before any repository-backed plan job may assume it. Plan-role
+trust uses GitHub's immutable repository identity subject,
+\`repo:<owner>@<owner-id>/<repository>@<repository-id>:environment:<environment>\`.
+The audit derives it from the workflow's repository name, owner ID, repository ID, and literal
+environment and refuses missing IDs or the older mutable name-only subject. Update every
+adopter-owned AWS OIDC role trust to the immutable identity before protected use; never retain
+both forms. Every
 \`*-staging\` environment accepts only \`develop\`; every
 \`*-production\` environment accepts only \`main\`; reviewer, self-review, and wait protection
 matches the corresponding base stage. The credential-free \`npm-prerelease\` environment
@@ -7303,18 +7745,35 @@ materializes, close and reopen the pull request as a human and then approve it.
 `,
         'docs/repository-operating-policy.md': `# Repository Operating Policy
 
-\`ebk.repository-policy.json\` is the reviewed source of truth for production access,
-production approval, per-Slice readiness, and the one shared production Foundation profile.
+\`ebk.repository-policy.json\` is the reviewed source of truth for deployment profile, exact
+stage account IDs, deployment Region, production access, production approval, per-Slice
+readiness, and the one shared production Foundation profile.
 New workspaces start with production disabled and explicit Team-compatible
 \`productionApproval.mode: "promotion-pr"\`. A missing approval mode or Slice entry fails
 closed; no GitHub capability is allowed to choose a mode implicitly.
 
+Deployment profiles are proportional to operator maturity:
+
+- \`starter\` (default) requires one shared account, permits local development and staging
+  through the governed root Nx target, and reserves production for protected GitHub deployment;
+- \`production-isolated\` requires one development/staging account and a distinct production
+  account; only production is GitHub-only; and
+- \`fully-isolated\` requires three distinct accounts; staging and production are GitHub-only.
+
+Equal account IDs never imply shared stage resources. Router, Aurora, Cognito, events, secrets,
+IAM, logs, queues, resource names, and SSM discovery remain stage-specific. Existing prerelease
+repositories migrate explicitly to \`fully-isolated\`; upgrades never infer or weaken topology.
+That profile-only migration retains the former authority model but stays undeployable until exact
+development, staging, and production account IDs plus \`deploymentRegion\` are committed.
+
 The named repository modes are source-writing presets, not runtime state. Report a change
 first and inspect the complete current/next policy:
 
 \`\`\`bash
 pnpm nx g @empire-builder-kit/nx:repository-policy \\
-  --preset=controlled-production --slices=billing
+  --deploymentProfile=starter --deploymentRegion=us-east-1 \\
+  --developmentAccountId=111122223333 --stagingAccountId=111122223333 \\
+  --productionAccountId=111122223333
 \`\`\`
 
 Apply the reviewed source change separately with \`--apply\`. This command never contacts AWS
@@ -7324,6 +7783,66 @@ Use \`--productionApprovalMode=promotion-pr|environment-reviewer\` for an explic
 transition. This changes committed policy only; a separate bootstrap report/apply reconciles
 remote GitHub settings.
 
+After applying exact topology, authenticate with temporary federated credentials for development
+or staging and invoke
+\`pnpm nx run ${name}:deploy-local -- --stage=<stage> --profile=<profile>
+--expectedRoleArn=<role-arn>\`. Production runs only through the protected main-branch GitHub
+workflow. Each admitted local invocation plans the complete current stage, displays the stage
+summary and first material project, and requires a real TTY response of
+\`approve:<action>:<stage>:<project>:<current-plan-digest>\`. A human or authorized agent may type
+that acknowledgement; it is active operator control, not a claim of independent human review.
+The target creates one private ten-minute capability for that project, rechecks the exact source,
+artifacts, account, Region, role, stage, policy, state, and lock without a second provider preview,
+consumes the capability once, and removes it on every exit path. Unattended scripts cannot approve.
+Every material deploy or refresh mutates at most the first material project and ends with a
+controlled non-success \`replan-required\` handoff, including the last project in the ordered stage.
+Rerun the complete stage, review the new current summary, and repeat until one invocation proves
+every project is semantically converged. Only that convergence invocation succeeds. A preview is
+recent review and audit evidence; it is not represented as a cryptographically replayable Pulumi
+transaction. A complete, unlocked deploy plan containing only provider reads with no changed
+properties, replacement, failure, or unmatched risk finding is retained as observation evidence
+and counts as semantically converged. The standalone project planner may still return its
+conservative non-success for that drift observation; the root local transaction accepts only a
+freshly emitted exact provider-read-only record from that child. Repeated reads coalesce
+only when their logical ID and resource type match exactly. Any stale or ambiguous
+observation fails closed; a plan with desired changes remains material and requires review. One
+narrower case stays reviewable instead of becoming
+drift: when an upstream Foundation apply changes only both external framework-version tag
+projections (plus SST's already-bounded name hydration), the retained
+external identity must match one exact non-replacing provider read in the same ordinary plan.
+Missing read correlation, owned resources, other tag or property changes, incomplete tag pairs,
+and provider failures remain drift and fail closed. The local target requires the exact SST v5 account bootstrap normally
+created by the pinned \`ebk dev up\` path, then creates and attests only missing exact
+per-project/canonical-stage state passphrases before its formal read-only plans. This passphrase
+bootstrap is the only persistent pre-acknowledgement write; it creates no deployment authority
+and is reported in bounded local evidence. Clean immutable source, immediate per-project plans,
+migration and retention preflights, and secret-free result
+evidence remain mandatory. Direct SST is forbidden.
+
+After an interrupted apply, use the same target with \`--action=refresh\` and the exact
+phase, stage, profile, and role. It retains the same plan-summary review boundary, admits only
+bounded drift-detected refresh evidence, and never turns refresh into an implicit deploy. When
+the interrupted write leaves a recorded provider output unusable by the ordinary desired preview,
+the plan stops without mutation. The non-writing refresh preview separates provider refresh
+records from its later desired preview and cannot replace failed ordinary desired authority;
+repair the recorded dependency or use the documented
+operator recovery path before planning again.
+
+A stage-wide refresh still plans and authorizes every selected project. When one exact retained
+project plan proves an absent SST state that is unlocked, complete, empty, and drift-free, the
+root target records that project as a refresh no-op instead of invoking SST against a nonexistent
+stage. It also retains the pinned provider's exact SSM \`ebk:framework-version\` \`tagsAll\`
+normalization as a semantically inert observation after the same bounded shape
+repeats following refresh. Value changes, other tags, security findings, deletes, replacements,
+sensitive properties, and every other resource type remain material. Locked, incomplete, failed,
+or otherwise drifted plans are never skipped.
+
+For a stage with no workload-role account baseline, publish the fixed Foundation-only candidate
+and invoke this root target with \`--phase=foundation-bootstrap\`. After Foundation outputs exist,
+publish the complete \`full-stage\` candidate and invoke the target without \`--phase\` (or with
+\`--phase=full-stage\`). The bootstrap phase selects exactly Foundation; it is not an arbitrary
+project filter.
+
 Validation requires both an explicit production approval mode and an explicit Foundation
 profile. It does not infer omitted values. Use \`promotion-pr\` for a private GitHub Team
 repository. Use \`environment-reviewer\` only when the repository plan can enforce a separate
@@ -7337,10 +7856,16 @@ environment reviewer.
 
 Protected production deploy and refresh validate the complete Foundation/Slice set before AWS
 access. The Foundation is always ordered first. The set is derived from committed policy and
-cannot be narrowed with an ad hoc project argument.
-
-\`standard\` keeps Aurora warm at 2–16 ACU. \`cost-optimized\` is a prerelease candidate at
-0–4 ACU with a five-minute auto-pause and potential cold-resume latency. Both keep managed NAT,
+cannot be narrowed with an ad hoc project argument. The retained stage preview remains review
+evidence. Immediately before each project mutation the workflow computes one fresh plan against
+current state and applies it without a second redundant preview. Source, artifacts, configuration,
+policy, environment, and protected identities remain exact. Provider-only read/discard observations
+may appear or disappear, but any new delete, replacement, import, stateful or security change, IAM
+expansion, protection reduction, or unclassified resource stops for renewed approval. After an
+upstream mutation, every downstream project therefore receives a fresh independent risk decision.
+
+\`standard\` keeps Aurora warm at 2–16 ACU. \`cost-optimized\` keeps a smaller
+0.5–4 ACU warm floor for starter production traffic. Both keep managed NAT,
 30-day backups, deletion protection, retained data, and the protected GitHub/OIDC/AWS path.
 Changing policy affects only later lifecycle requests; it never deploys or removes resources.
 Changing profile requires a separate reviewed Foundation deployment and retained operational
@@ -7411,7 +7936,7 @@ deploy or refresh before AWS access. Protected remove and unlock remain usable f
 There is no local or silent bypass in this prerelease contract; any future waiver mechanism
 must be committed, reviewable, and auditable.
 `,
-        'ebk.repository-policy.json': json((0, index_js_4.createIncubationRepositoryPolicy)()),
+        'ebk.repository-policy.json': json(initialRepositoryPolicy),
         'nx.json': json({
             $schema: './node_modules/nx/schemas/nx-schema.json',
             defaultBase: 'develop',
@@ -7451,6 +7976,7 @@ must be committed, reviewable, and auditable.
                     inputs: ['default', '^production'],
                 },
             },
+            analytics: false,
             neverConnectToCloud: true,
             useDaemonProcess: false,
         }),
@@ -7460,8 +7986,8 @@ must be committed, reviewable, and auditable.
             private: true,
             packageManager: tool_versions_js_1.WORKSPACE_PNPM_DESCRIPTOR,
             engines: {
-                node: '>=22.12.0',
-                pnpm: '>=10.0.0',
+                node: '>=22.13.0',
+                pnpm: '>=11.20.0',
             },
             scripts: {
                 build: `nx run-many -t build --exclude=${name}`,
@@ -7479,10 +8005,12 @@ must be committed, reviewable, and auditable.
             },
             devDependencies: {
                 '@aws-sdk/client-iam': TOOL_VERSIONS.awsSdk,
+                '@aws-sdk/client-rds': TOOL_VERSIONS.awsSdk,
                 '@aws-sdk/client-s3': TOOL_VERSIONS.awsSdk,
                 '@aws-sdk/client-secrets-manager': TOOL_VERSIONS.awsSdk,
                 '@aws-sdk/client-ssm': TOOL_VERSIONS.awsSdk,
                 '@aws-sdk/client-sts': TOOL_VERSIONS.awsSdk,
+                '@aws-sdk/credential-providers': TOOL_VERSIONS.awsSdk,
                 '@eslint/js': TOOL_VERSIONS.eslintJs,
                 '@empire-builder-kit/nx': frameworkVersion,
                 '@types/node': TOOL_VERSIONS.nodeTypes,
@@ -7515,6 +8043,15 @@ must be committed, reviewable, and auditable.
                         protectedRef: 'refs/remotes/origin/develop',
                     },
                 },
+                'blueprint-trust-check-main': {
+                    executor: '@empire-builder-kit/nx:blueprint-trust',
+                    options: {
+                        operation: 'adopt',
+                        output: '.ebk/evidence/supply-chain/blueprint-trust.json',
+                        protectedBranch: 'main',
+                        protectedRef: 'refs/remotes/origin/main',
+                    },
+                },
                 'blueprint-trust-check-protected': {
                     executor: '@empire-builder-kit/nx:blueprint-trust',
                     options: {
@@ -7557,6 +8094,13 @@ must be committed, reviewable, and auditable.
                     executor: 'nx:run-commands',
                     options: { command: 'node tools/install-ebk-hooks.mjs' },
                 },
+                'deploy-local': {
+                    cache: false,
+                    executor: '@empire-builder-kit/nx:local-deploy',
+                    options: {
+                        stage: 'development',
+                    },
+                },
                 'supply-chain-check': {
                     executor: 'nx:run-commands',
                     options: {
@@ -7598,6 +8142,11 @@ must be committed, reviewable, and auditable.
                     executor: 'nx:run-commands',
                     options: { command: 'node tools/workspace-health.mjs' },
                 },
+                'verify-proposed': {
+                    dependsOn: ['supply-chain-check'],
+                    executor: 'nx:run-commands',
+                    options: { command: 'node tools/workspace-health.mjs' },
+                },
                 'workspace-health': {
                     executor: 'nx:run-commands',
                     options: { command: 'node tools/workspace-health.mjs' },
@@ -7620,6 +8169,10 @@ Workspace creation does not deploy this project. Review \`docs/costs.md\`,
 
 Set \`EBK_ROOT_DOMAIN\` before deploying when Route 53 in the target account owns a public
 domain. Without it, the shared Router uses its functional provider URL.
+
+Before deploying development or staging, add at least one exact operator/probe CIDR to
+\`security/router-waf.json\`. Production is public by default behind the same managed and
+rate-limiting baseline; select its allowlist mode explicitly when required.
 `,
         'packages/foundation/contracts/foundation.json': json({
             contractVersion: '1.0.0',
@@ -7679,8 +8232,8 @@ seeded decision record aligned with organization-specific budgets and alerts.
 - Development uses EC2 NAT, a development bastion, and Aurora scale-to-zero.
 - Staging uses EC2 NAT and Aurora scale-to-zero by default.
 - Production always uses managed NAT and retains protected data. Its explicit Repository
-  Operating Policy profile selects either the standard always-warm Aurora floor or the
-  prerelease cost-optimized auto-pause candidate.
+  Operating Policy profile selects either the standard 2-ACU Aurora floor or the
+  cost-optimized 0.5-ACU warm floor.
 - ECS, EventBridge, Cognito, SNS, SSM, and CloudWatch are primarily usage-priced; logs,
   metrics, alarms, and retained data still require active cost review.
 
@@ -7698,8 +8251,69 @@ Use Nx for every supported lifecycle action:
 - \`pnpm nx run foundation:unlock --stage=development\`
 - \`pnpm nx run foundation:remove --stage=development\`
 
-Do not invoke SST lifecycle commands directly. Production deployment belongs in the trusted
-CI path.
+Do not invoke SST lifecycle commands directly. The root \`deploy-local\` target is the governed
+local path for stages admitted by the committed deployment profile. Its fixed
+\`foundation-bootstrap\` phase is the only local partial-stage path and exists solely for the
+documented first workload-role publication; isolated protected stages remain on the trusted
+GitHub path.
+
+Every local invocation plans the complete selected stage but mutates at most one material
+project. Type the exact current \`approve:<action>:<stage>:<project>:<plan-digest>\` challenge in a
+real TTY after reviewing the displayed summary. A human or authorized agent may operate that TTY;
+unattended input is refused. The acknowledgement creates one ten-minute, one-use, private
+capability bound to source, artifacts, policy, environment, credentials, and current state. A
+completed deploy or refresh returns the controlled non-success \`replan-required\`; rerun the
+complete stage, review the new current summary, and continue one project at a time. Only a
+semantically converged complete stage reports success. No upstream mutation can authorize a
+downstream project. A complete, unlocked deploy plan containing only provider reads with no
+changed properties, replacement, failure, or unmatched risk finding is retained as observation
+evidence and counts as semantically converged. The standalone project planner may still return
+its conservative non-success for that drift observation; the root local transaction accepts only
+a freshly emitted exact provider-read-only record from that child. Repeated reads coalesce
+only when their logical ID and resource type match exactly. Any stale or ambiguous
+observation fails closed; a plan with desired changes remains material and requires review. A
+material downstream plan may also retain an upstream Foundation framework-version tag advance as
+observation only when both external tag
+projections, the retained identity, optional bounded SST name hydration, and one non-replacing
+provider read correlate exactly. Every other external property or uncorroborated read remains
+drift and blocks before the TTY challenge.
+
+For an interrupted local apply, run the same root target with \`--action=refresh\`, review its
+current provider-refresh evidence, and type the displayed TTY challenge. Before mutation the
+executor writes and verifies a private state recovery point plus a secret-free digest/version
+manifest. The refresh preview validates its provider and later desired-event partitions; any
+ordinary preview failure or malformed post-refresh desired event remains blocked. Provider-only
+observation noise is retained without claiming a replayable preview. Because refresh changes
+recorded state rather than cloud resources, provider-output security and protection findings
+remain explicit review requirements under the drift decision. Refresh never continues into deploy
+or claims desired-state convergence: run the governed deploy target afterward and resolve every
+remaining source-versus-state change. Exclude the \`.private.json\` recovery point from archives.
+
+The root refresh target includes every selected project in its exact reviewed plan set. It skips
+the SST child only when that project's retained plan proves an absent, unlocked, complete, empty,
+and drift-free state, or when the only retained difference is the pinned provider's exact repeated
+SSM \`ebk:framework-version\` \`tagsAll\` normalization. It records the project as an explicit refresh no-op
+in either case while retaining the observation. Value changes, other tags, security findings,
+deletes, replacements, sensitive
+properties, and every other resource type remain material; every other plan must execute or fail
+closed.
+
+## Router WAF
+
+Each canonical stage owns one global-scope Web ACL attached to that stage's Foundation Router.
+The committed \`security/router-waf.json\` policy requires AWS Common Rule Set, Known Bad
+Inputs, Amazon IP Reputation, an IP rate limit, CloudWatch metrics, and sampled requests.
+Development and staging fail synthesis until their allowlists contain explicit CIDRs.
+Production is public by default and may be changed to an explicit allowlist.
+
+For tuning, set a nonproduction stage to \`count\`, deploy and inspect sampled requests, then
+return staging to \`block\` and run the live allow/deny, managed-rule, rate-limit, metric, and
+sampled-request probes. Write their bounded, secret-free result to
+\`security/router-waf-live-evidence.json\`, then run
+\`pnpm nx run foundation:router-waf-rehearsal\`. The executor seals the exact policy digest
+into \`router-waf-blocking-rehearsal.json\`. Production synthesis rejects a missing, stale, or
+count-mode rehearsal. Full request logging is opt-in, blocked-only, retention-bounded, and
+redacts query strings plus credential-bearing headers.
 
 Foundation stages are canonical. \`ebk dev\` derives a Product Slice personal
 stage from the operating-system account and maps that consumer to the
@@ -7734,6 +8348,12 @@ connects as the Slice's no-password IAM-authenticated migrator user.
   stage-scoped SSM/secret path and least-privilege IAM.
 - Public domains are configured explicitly through \`EBK_ROOT_DOMAIN\`; generated source never
   contains credentials or customer domain assumptions.
+- Every stage's CloudFront Router has its own global Web ACL. The baseline always includes AWS
+  Common Rule Set, Known Bad Inputs, Amazon IP Reputation, rate blocking, CloudWatch metrics,
+  and sampled requests. Nonproduction is allowlisted by default. Production is public by
+  default, but cannot deploy until the exact policy has passed a staging blocking rehearsal.
+- Full WAF request logging is disabled by default. Enabling it keeps blocked requests only,
+  uses bounded retention, and redacts query strings, cookies, authorization, and API keys.
 
 The managed \`contracts/frontend-security-headers.json\` file owns the transport
 minimum: HTTPS in deployed environments, one-year HSTS there, and the common
@@ -7766,7 +8386,12 @@ declare const $app: {
 import {
   FOUNDATION_SSM_SCHEMA_VERSION,
   STANDARD_FOUNDATION_CAPABILITIES,
+  createRouterWafRules,
+  createRouterWafStagePlan,
+  foundationDatabaseEndpointHost,
   foundationSsmPath,
+  normalizeRouterWafPolicy,
+  reconcileRouterWafBlockingRehearsal,
   type FoundationSsmKey,
 } from '@empire-builder-kit/nx/foundation';
 import {
@@ -7776,6 +8401,9 @@ import {
 } from '@empire-builder-kit/nx/repository-policy';
 import { createFoundationAccountCostControlPlan } from '@empire-builder-kit/nx/performance';
 import accountCostPolicy from '../performance/account-cost-policy.json';
+import routerWafBlockingRehearsal from '../security/router-waf-blocking-rehearsal.json';
+import routerWafLiveEvidence from '../security/router-waf-live-evidence.json';
+import routerWafPolicy from '../security/router-waf.json';
 import type { FoundationWorkloadRolePreflight } from './workload-roles/preflight.js';
 
 function identityDomainPrefix(stage: string, accountId: string): string {
@@ -7827,6 +8455,18 @@ export function foundation(
       )
     : undefined;
   const natMode = productionConfiguration?.contract.nat ?? 'ec2';
+  const normalizedRouterWafPolicy = normalizeRouterWafPolicy(routerWafPolicy);
+  const wafPlan = createRouterWafStagePlan({
+    policy: normalizedRouterWafPolicy,
+    rehearsal: isProduction
+      ? reconcileRouterWafBlockingRehearsal({
+          evidence: routerWafLiveEvidence,
+          policy: normalizedRouterWafPolicy,
+          receipt: routerWafBlockingRehearsal,
+        })
+      : null,
+    stage: $app.stage,
+  });
   const natBinding = workloadRoles?.bindings.nat;
   if (natMode === 'ec2' && natBinding) {
     $transform(
@@ -7836,6 +8476,9 @@ export function foundation(
         args.name = natBinding.instanceProfileName;
         args.role = natBinding.roleName;
         opts.import = natBinding.instanceProfileName;
+        opts.ignoreChanges = [
+          ...new Set([...(opts.ignoreChanges ?? []), 'tags', 'tagsAll']),
+        ];
       },
     );
   }
@@ -7857,8 +8500,83 @@ export function foundation(
             aliases: ['*.' + rootDomain],
             dns: sst.aws.dns(),
           },
-        }
+      }
       : {}),
+    waf: {
+      logging: wafPlan.logging,
+      managedRules: {
+        coreRuleSet: true,
+        knownBadInputs: true,
+        sqlInjection: false,
+      },
+      rateLimitPerIp: wafPlan.rateLimitPerIp,
+    },
+    transform: {
+      cdn(args: any) {
+        if (!args.webAclArn) {
+          throw new Error(
+            'Foundation Router must attach its exact global Web ACL.',
+          );
+        }
+      },
+      waf(args: any, opts: any) {
+        if (args.scope !== 'CLOUDFRONT') {
+          throw new Error(
+            'Foundation Router Web ACL must use global CloudFront scope.',
+          );
+        }
+        const ipSets: { ipv4Arn?: any; ipv6Arn?: any } = {};
+        if (wafPlan.ipv4Cidrs.length > 0) {
+          ipSets.ipv4Arn = new aws.wafv2.IpSet(
+            'FoundationRouterIpv4Allowlist',
+            {
+              addresses: wafPlan.ipv4Cidrs,
+              ipAddressVersion: 'IPV4',
+              name: 'foundation-' + wafPlan.stage + '-router-ipv4-allowlist',
+              scope: 'CLOUDFRONT',
+              tags: {
+                'ebk:policy-digest': wafPlan.policyDigest,
+                'ebk:stage': wafPlan.stage,
+              },
+            },
+            { provider: opts.provider },
+          ).arn;
+        }
+        if (wafPlan.ipv6Cidrs.length > 0) {
+          ipSets.ipv6Arn = new aws.wafv2.IpSet(
+            'FoundationRouterIpv6Allowlist',
+            {
+              addresses: wafPlan.ipv6Cidrs,
+              ipAddressVersion: 'IPV6',
+              name: 'foundation-' + wafPlan.stage + '-router-ipv6-allowlist',
+              scope: 'CLOUDFRONT',
+              tags: {
+                'ebk:policy-digest': wafPlan.policyDigest,
+                'ebk:stage': wafPlan.stage,
+              },
+            },
+            { provider: opts.provider },
+          ).arn;
+        }
+        args.defaultAction = { allow: {} };
+        args.rules = createRouterWafRules(wafPlan, ipSets);
+        args.scope = 'CLOUDFRONT';
+        args.tags = {
+          ...(args.tags ?? {}),
+          'ebk:policy-digest': wafPlan.policyDigest,
+          'ebk:stage': wafPlan.stage,
+        };
+        args.visibilityConfig = {
+          cloudwatchMetricsEnabled: true,
+          metricName:
+            'Ebk' +
+            wafPlan.stage[0].toUpperCase() +
+            wafPlan.stage.slice(1) +
+            'FoundationRouterWaf',
+          sampledRequestsEnabled: true,
+        };
+      },
+    },
   });
   const database = new sst.aws.Aurora('FoundationDatabase', {
     // SQL bootstrap and migrations run inside the VPC. Keep the public HTTPS
@@ -7882,6 +8600,46 @@ export function foundation(
     },
     vpc,
   });
+  const databaseClusterEndpoint = database.nodes.cluster.endpoint.apply(
+    foundationDatabaseEndpointHost,
+  );
+  const databaseReaderEndpoint = database.nodes.cluster.readerEndpoint.apply(
+    foundationDatabaseEndpointHost,
+  );
+  // SST v4.17.1 creates a top-level LinkRef on the next tick and its Aurora
+  // implementation unconditionally splits cluster endpoints. During a
+  // governed refresh after an interrupted first deploy, those provider
+  // outputs are legitimately absent. Preserve the normal link contract while
+  // keeping that read-only recovery program total; a real deploy resolves the
+  // exact endpoints before any discovery resource is created.
+  database.getSSTLink = () => ({
+    include: [
+      sst.aws.permission({
+        actions: ['secretsmanager:GetSecretValue'],
+        resources: [database.secretArn],
+      }),
+      sst.aws.permission({
+        actions: [
+          'rds-data:BatchExecuteStatement',
+          'rds-data:BeginTransaction',
+          'rds-data:CommitTransaction',
+          'rds-data:ExecuteStatement',
+          'rds-data:RollbackTransaction',
+        ],
+        resources: [database.clusterArn],
+      }),
+    ],
+    properties: {
+      clusterArn: database.clusterArn,
+      database: database.database,
+      host: databaseClusterEndpoint,
+      password: database.password,
+      port: database.port,
+      reader: databaseReaderEndpoint,
+      secretArn: database.secretArn,
+      username: database.username,
+    },
+  });
   const foundationAccountId = aws.getCallerIdentityOutput({}).accountId;
   const foundationPartition = aws.getPartitionOutput({});
   const foundationRegion = aws.getRegionOutput({});
@@ -7944,6 +8702,7 @@ export function foundation(
               },
             ],
             resources: [alertTopic.arn],
+            sid: 'AllowBudgetAlerts',
           },
           {
             actions: ['sns:Publish'],
@@ -7957,6 +8716,7 @@ export function foundation(
               type: 'Service',
             }],
             resources: [alertTopic.arn],
+            sid: 'AllowCostAnomalyAlerts',
           },
           {
             actions: ['sns:Publish'],
@@ -7979,6 +8739,7 @@ export function foundation(
               type: 'Service',
             }],
             resources: [alertTopic.arn],
+            sid: 'AllowRdsEventAlerts',
           },
           {
             actions: ['sns:Publish'],
@@ -8003,6 +8764,7 @@ export function foundation(
               },
             ],
             resources: [alertTopic.arn],
+            sid: 'AllowCloudWatchAlarmAlerts',
           },
         ],
       }).json,
@@ -8031,6 +8793,41 @@ export function foundation(
         { dependsOn: [alertTopicPolicy] },
       )
     : undefined;
+  const accountCostAnomalyMonitor = isProduction
+    ? new aws.costexplorer.AnomalyMonitor(
+        'FoundationAccountCostAnomalyMonitor',
+        {
+          monitorDimension: 'SERVICE',
+          monitorType: 'DIMENSIONAL',
+          name: '${name}-account-service-cost-anomalies',
+          tags: {
+            'ebk:cost-policy-digest': accountCostControl.policyDigest,
+            'ebk:cost-scope': '${name}/account/production',
+            'ebk:owner': accountCostControl.owner,
+          },
+        },
+      )
+    : undefined;
+  const accountCostAnomalySubscription =
+    accountCostControl.anomaly && accountCostAnomalyMonitor
+      ? new aws.costexplorer.AnomalySubscription(
+          'FoundationAccountCostAnomalySubscription',
+          {
+            frequency: accountCostControl.anomaly.subscription.frequency,
+            monitorArnLists: [accountCostAnomalyMonitor.arn],
+            name: accountCostControl.anomaly.subscription.name,
+            subscribers: [{ address: alertTopic.arn, type: 'SNS' }],
+            tags: {
+              'ebk:cost-policy-digest': accountCostControl.policyDigest,
+              'ebk:cost-scope': '${name}/account/production',
+              'ebk:owner': accountCostControl.owner,
+            },
+            thresholdExpression:
+              accountCostControl.anomaly.subscription.thresholdExpression,
+          },
+          { dependsOn: [accountCostAnomalyMonitor, alertTopicPolicy] },
+        )
+      : undefined;
   const databaseEvents = isProduction
     ? new aws.rds.EventSubscription(
         'FoundationDatabaseEvents',
@@ -8133,12 +8930,10 @@ export function foundation(
     clusterId: cluster.id,
     contractVersion: '1.0.0',
     databaseClusterArn: database.clusterArn,
-    databaseClusterEndpoint: database.nodes.cluster.endpoint.apply(
-      (endpoint: string) => endpoint.split(':')[0],
-    ),
+    databaseClusterEndpoint,
     databaseClusterId: database.id,
     databaseClusterResourceId: database.nodes.cluster.clusterResourceId,
-    databaseHost: database.host,
+    databaseHost: databaseClusterEndpoint,
     databaseMasterSecretArn: database.secretArn,
     databasePort: database.port.apply(String),
     eventBusArn: eventBus.arn,
@@ -8160,6 +8955,7 @@ export function foundation(
     capabilities: STANDARD_FOUNDATION_CAPABILITIES,
     clusterId: cluster.id,
     contractVersion: '1.0.0',
+    costAnomalySubscriptionArn: accountCostAnomalySubscription?.arn,
     databaseCapacityAlarmName: databaseCapacityAlarm.name,
     dashboardName: dashboard.dashboardName,
     databaseClusterId: database.id,
@@ -8191,13 +8987,49 @@ export function app(workloadRoles?: FoundationWorkloadRolePreflight) {
             actualNotificationThresholdPercent: 80,
             forecastNotificationThresholdPercent: 100,
             kind: 'ebk-foundation-account-cost-policy',
-            monthlyMaximumUsd: 1_000,
+            monthlyMaximumUsd: deploymentProfile === 'starter' ? 250 : 1_000,
             owner: 'replace-with-owner',
             reviewAt: null,
             schemaVersion: 1,
             status: 'example',
             workspace: name,
         }),
+        'packages/foundation/security/router-waf.json': json({
+            kind: 'ebk-router-waf-policy',
+            logging: {
+                enabled: false,
+                retention: '1 week',
+            },
+            rateLimitPerIp: 2_000,
+            schemaVersion: 1,
+            stages: {
+                development: {
+                    access: 'allowlist',
+                    allowedCidrs: [],
+                    mode: 'block',
+                },
+                production: {
+                    access: 'public',
+                    allowedCidrs: [],
+                    mode: 'block',
+                },
+                staging: {
+                    access: 'allowlist',
+                    allowedCidrs: [],
+                    mode: 'block',
+                },
+            },
+        }),
+        'packages/foundation/security/router-waf-blocking-rehearsal.json': json({
+            kind: 'ebk-router-waf-blocking-rehearsal',
+            schemaVersion: 1,
+            status: 'pending',
+        }),
+        'packages/foundation/security/router-waf-live-evidence.json': json({
+            kind: 'ebk-router-waf-live-evidence',
+            schemaVersion: 1,
+            status: 'pending',
+        }),
         'packages/foundation/configuration/declarations.json': json({
             project: 'foundation',
             schemaVersion: 1,
@@ -8230,29 +9062,96 @@ export function app(workloadRoles?: FoundationWorkloadRolePreflight) {
                 version: '4.17.1',
             },
             policy: {
+                adoptedImports: [
+                    {
+                        authority: 'workload-role-account-baseline',
+                        logicalId: 'FoundationVpcNatInstanceProfile',
+                        privateIdentifierTemplate: 'ebk-{stage}-foundation-nat-profile',
+                        recoveryRunbookRef: 'docs/workload-role-account-baseline.md',
+                        removalBehavior: 'retain',
+                        resourceType: 'aws:iam/instanceProfile:InstanceProfile',
+                    },
+                ],
                 additiveLowRiskTypes: [
                     'aws:cloudwatch/dashboard:Dashboard',
                     'aws:cloudwatch/logGroup:LogGroup',
                     'aws:cloudwatch/metricAlarm:MetricAlarm',
                 ],
+                additiveReviewedTypes: [
+                    'aws:cloudwatch/eventArchive:EventArchive',
+                    'aws:cloudwatch/eventBus:EventBus',
+                    'aws:cognito/userPoolDomain:UserPoolDomain',
+                    'aws:ec2/defaultSecurityGroup:DefaultSecurityGroup',
+                    'aws:ec2/internetGateway:InternetGateway',
+                    'aws:ec2/routeTable:RouteTable',
+                    'aws:ec2/routeTableAssociation:RouteTableAssociation',
+                    'aws:ec2/securityGroup:SecurityGroup',
+                    'aws:ec2/subnet:Subnet',
+                    'aws:ec2/vpc:Vpc',
+                    'aws:ecs/cluster:Cluster',
+                    'aws:ecs/clusterCapacityProviders:ClusterCapacityProviders',
+                    'aws:rds/clusterParameterGroup:ClusterParameterGroup',
+                    'aws:rds/eventSubscription:EventSubscription',
+                    'aws:rds/parameterGroup:ParameterGroup',
+                    'aws:rds/subnetGroup:SubnetGroup',
+                    'aws:servicediscovery/privateDnsNamespace:PrivateDnsNamespace',
+                    'aws:sns/topic:Topic',
+                    'aws:sns/topicPolicy:TopicPolicy',
+                    'aws:wafv2/webAclLoggingConfiguration:WebAclLoggingConfiguration',
+                    'pulumi-nodejs:dynamic:Resource',
+                    'pulumi:providers:aws',
+                    'pulumi:providers:pulumi-nodejs',
+                    'pulumi:providers:random',
+                    'pulumi:pulumi:Stack',
+                    'sst:aws:Aurora',
+                    'sst:aws:Bus',
+                    'sst:aws:CDN',
+                    'sst:aws:Cluster',
+                    'sst:aws:CognitoUserPool',
+                    'sst:aws:Router',
+                    'sst:aws:SnsTopic',
+                    'sst:aws:Vpc',
+                    'sst:sst:LinkRef',
+                    'sst:sst:Version',
+                ],
                 costOrQuotaTypes: [
                     'aws:apigatewayv2/api:Api',
                     'aws:budgets/budget:Budget',
+                    'aws:cloudfront/cachePolicy:CachePolicy',
                     'aws:cloudfront/distribution:Distribution',
+                    'aws:cloudfront/function:Function',
+                    'aws:cloudfront/keyValueStore:KeyValueStore',
+                    'aws:costexplorer/anomalyMonitor:AnomalyMonitor',
+                    'aws:costexplorer/anomalySubscription:AnomalySubscription',
                     'aws:cognito/userPool:UserPool',
+                    'aws:ec2/eip:Eip',
+                    'aws:ec2/eipAssociation:EipAssociation',
+                    'aws:ec2/instance:Instance',
                     'aws:ec2/natGateway:NatGateway',
                     'aws:rds/cluster:Cluster',
+                    'aws:rds/clusterInstance:ClusterInstance',
+                    'aws:wafv2/ipSet:IpSet',
+                    'aws:wafv2/webAcl:WebAcl',
                 ],
                 failClosedOnUnknown: true,
                 protectedPlanAuthority: 'deploy-role-residual',
                 standingPolicyRiskClasses: ['no-change', 'additive-low-risk'],
                 statefulTypes: [
+                    'aws:cloudwatch/eventArchive:EventArchive',
+                    'aws:cloudwatch/eventBus:EventBus',
                     'aws:cognito/userPool:UserPool',
                     'aws:dynamodb/table:Table',
                     'aws:events/eventBus:EventBus',
                     'aws:kms/key:Key',
                     'aws:rds/cluster:Cluster',
                     'aws:s3/bucket:Bucket',
+                    'aws:secretsmanager/secret:Secret',
+                    'aws:secretsmanager/secretVersion:SecretVersion',
+                    'aws:sns/topic:Topic',
+                    'aws:ssm/parameter:Parameter',
+                    'aws:wafv2/ipSet:IpSet',
+                    'aws:wafv2/webAcl:WebAcl',
+                    'random:index/randomPassword:RandomPassword',
                 ],
             },
             project: 'foundation',
@@ -8350,6 +9249,13 @@ export function app(workloadRoles?: FoundationWorkloadRolePreflight) {
                     executor: '@empire-builder-kit/nx:foundation-profile-preflight',
                     options: { stage: 'development' },
                 },
+                'router-waf-rehearsal': {
+                    cache: false,
+                    executor: '@empire-builder-kit/nx:router-waf-rehearsal',
+                    outputs: [
+                        `{projectRoot}/security/router-waf-blocking-rehearsal.json`,
+                    ],
+                },
                 typecheck: {
                     executor: 'nx:run-commands',
                     options: {
@@ -8377,6 +9283,11 @@ export function app(workloadRoles?: FoundationWorkloadRolePreflight) {
         }),
         'packages/foundation/scripts/verify-foundation.mjs': `import { readFileSync } from 'node:fs';
 
+import {
+  normalizeRouterWafPolicy,
+  reconcileRouterWafBlockingRehearsal,
+} from '@empire-builder-kit/nx/foundation';
+
 const descriptor = JSON.parse(
   readFileSync(new URL('../contracts/foundation.json', import.meta.url), 'utf8'),
 );
@@ -8392,6 +9303,33 @@ const frontendSecurityHeaders = JSON.parse(
     'utf8',
   ),
 );
+const routerWafPolicy = normalizeRouterWafPolicy(
+  JSON.parse(
+    readFileSync(
+      new URL('../security/router-waf.json', import.meta.url),
+      'utf8',
+    ),
+  ),
+);
+reconcileRouterWafBlockingRehearsal({
+  evidence: JSON.parse(
+    readFileSync(
+      new URL('../security/router-waf-live-evidence.json', import.meta.url),
+      'utf8',
+    ),
+  ),
+  policy: routerWafPolicy,
+  receipt:
+  JSON.parse(
+    readFileSync(
+      new URL(
+        '../security/router-waf-blocking-rehearsal.json',
+        import.meta.url,
+      ),
+      'utf8',
+    ),
+  ),
+});
 const expectedCapabilities = [
   'network',
   'routing',
@@ -8407,6 +9345,13 @@ const expectedCapabilities = [
 if (descriptor.contractVersion !== '1.0.0') {
   throw new Error('Foundation contractVersion must be 1.0.0.');
 }
+if (
+  routerWafPolicy.stages.development.access !== 'allowlist' ||
+  routerWafPolicy.stages.staging.access !== 'allowlist' ||
+  routerWafPolicy.stages.production.mode !== 'block'
+) {
+  throw new Error('Foundation Router WAF stage defaults are invalid.');
+}
 if (JSON.stringify(descriptor.capabilities) !== JSON.stringify(expectedCapabilities)) {
   throw new Error('Foundation capability descriptor does not match the v1 standard.');
 }
@@ -8415,7 +9360,7 @@ if (
   costs.aurora?.engineVersion !== '${index_js_4.FOUNDATION_AURORA_ENGINE_VERSION}' ||
   costs.productionProfileSource !== 'ebk.repository-policy.json' ||
   costs.productionProfiles?.standard?.aurora?.min !== '2 ACU' ||
-  costs.productionProfiles?.['cost-optimized']?.aurora?.min !== '0 ACU' ||
+  costs.productionProfiles?.['cost-optimized']?.aurora?.min !== '0.5 ACU' ||
   !costs.stages?.development ||
   !costs.stages?.staging ||
   costs.stages?.production?.dataRetention !== 'retained-and-protected'
@@ -8471,16 +9416,15 @@ export default $config({
       providers: {
         aws: {
           defaultTags: {
+            // SST contributes sst:app and sst:stage. Keep the provider baseline
+            // at eight tags so generated S3 asset objects remain within AWS's
+            // hard ten-tag object limit. Richer performance tags stay explicit.
             tags: {
               'ebk:cost-allocation': 'foundation',
               'ebk:cost-scope': '${name}/foundation/' + stage,
               'ebk:framework-version': '${frameworkVersion}',
               'ebk:managed-by': 'empire-builder-kit',
               'ebk:owner': 'foundation',
-              'ebk:production-profile':
-                process.env.EBK_PRODUCTION_FOUNDATION_PROFILE ?? 'standard',
-              'ebk:repository':
-                process.env.GITHUB_REPOSITORY ?? '${name}',
               'ebk:slice': 'foundation',
               'ebk:stage': stage,
               'ebk:workspace': '${name}',
@@ -8524,6 +9468,16 @@ export default $config({
   - 'packages/*/services/*'
 
 autoInstallPeers: true
+blockExoticSubdeps: true
+enableGlobalVirtualStore: false
+ignorePnpmfile: true
+pnpmfile: []
+minimumReleaseAge: 1440
+minimumReleaseAgeExclude:
+  - '@empire-builder-kit/*'
+minimumReleaseAgeIgnoreMissingTime: false
+minimumReleaseAgeStrict: true
+verifyDepsBeforeRun: error
 storeDir: .ebk/cache/pnpm-store
 supportedArchitectures:
   os:
@@ -9393,18 +10347,22 @@ if (eventName === 'pull_request' || eventName === 'push') {
 }
 if (eventName === 'pull_request') {
   const baseRef = process.env.GITHUB_BASE_REF;
+  const headRepository = process.env.EBK_HEAD_REPOSITORY;
   const headRef = process.env.GITHUB_HEAD_REF;
-  if (!baseRef || !headRef) {
-    throw new Error('Pull-request branch metadata is missing.');
+  const repository = process.env.GITHUB_REPOSITORY;
+  if (!baseRef || !headRepository || !headRef || !repository) {
+    throw new Error('Pull-request branch and repository metadata is missing.');
   }
   Object.assign(request, {
     baseIsAncestorOfHead: isAncestor('refs/remotes/origin/' + baseRef, 'HEAD'),
     baseRef,
+    headRepository,
     headRef,
     mainIsAncestorOfDevelop: isAncestor(
       'refs/remotes/origin/main',
       'refs/remotes/origin/develop',
     ),
+    repository,
   });
 } else if (eventName === 'push') {
   Object.assign(request, {