@empire-builder-kit/nx 1.0.0-rc.30 → 1.0.0-rc.31

package/src/generators/preset/workspace-files.js

@@ -17,10 +17,11 @@ const deterministic_order_js_1 = require("../../deterministic-order.js");
 const tool_versions_js_1 = require("./tool-versions.js");
 const workspace_files_developer_agent_js_1 = require("./workspace-files-developer-agent.js");
 const workspace_files_ci_acceptance_js_1 = require("./workspace-files-ci-acceptance.js");
-const workspace_files_foundation_workload_roles_js_1 = require("./workspace-files-foundation-workload-roles.js");
-const workspace_files_performance_cost_js_1 = require("./workspace-files-performance-cost.js");
-const workspace_files_performance_load_js_1 = require("./workspace-files-performance-load.js");
-const workspace_files_workload_role_baseline_js_1 = require("./workspace-files-workload-role-baseline.js");
+const workspace_files_ecr_inspector_js_1 = require("./workspace-files-ecr-inspector.js");
+const workspace_files_thin_deploy_js_1 = require("./workspace-files-thin-deploy.js");
+const workspace_files_thin_docs_js_1 = require("./workspace-files-thin-docs.js");
+const workspace_files_thin_release_js_1 = require("./workspace-files-thin-release.js");
+const workspace_files_stage_authority_js_1 = require("./workspace-files-stage-authority.js");
 const GENERATED_CREDENTIAL_SHAPE_PATTERNS = `[${sensitive_patterns_1.CREDENTIAL_SHAPE_DEFINITIONS.map(({ pattern }) => `new RegExp(${JSON.stringify(pattern.source)}, ${JSON.stringify(pattern.flags)})`).join(',')}]`;
 const GENERATED_RELEASE_ROLLOUT_PLAN_ID_PATTERN = JSON.stringify(index_js_5.RELEASE_ROLLOUT_PLAN_ID_PATTERN_SOURCE);
 exports.BLUEPRINT_TRUST_AUTHORITY_PATH = 'tools/blueprint-trust-check.mjs';
@@ -1015,6 +1016,7 @@ const WORKSPACE_SEEDED_PATHS = new Set([
     'docs/architecture.md',
     'docs/git-workflow.md',
     'docs/repository-operating-policy.md',
+    'docs/stage-deployment-authority.md',
     'docs/work-markers.md',
     'ebk.repository-policy.json',
 ]);
@@ -1042,14 +1044,13 @@ exports.WORKSPACE_PROJECT_MANAGED_JSON_POINTERS = [
     '/targets/dev-setup',
     '/targets/github-bootstrap',
     '/targets/install-git-hooks',
+    '/targets/stage-authority-render',
     '/targets/supply-chain-check',
     '/targets/supply-chain-check-protected',
     '/targets/supply-chain-scan',
     '/targets/verify',
     '/targets/verify-proposed',
     '/targets/work-markers',
-    '/targets/workload-role-candidate-report',
-    '/targets/workload-role-provisioner-build',
     '/targets/workspace-health',
 ];
 const FOUNDATION_SEEDED_PATHS = new Set([
@@ -1124,6 +1125,17 @@ function createWorkspaceOwnership(files, frameworkVersion) {
 function renderWorkspaceFiles(options) {
     const { frameworkVersion, name } = options;
     const deploymentProfile = options.deploymentProfile ?? 'starter';
+    const activeStages = (0, index_js_4.activeDeploymentStages)(deploymentProfile);
+    const protectedWorkflowStageChoices = deploymentProfile === 'starter'
+        ? 'development, production'
+        : deploymentProfile === 'production-isolated'
+            ? 'production'
+            : 'staging, production';
+    const ecrInspectorWorkflowStageChoices = deploymentProfile === 'starter'
+        ? 'production'
+        : protectedWorkflowStageChoices;
+    const rehearsalStage = (0, index_js_4.productionRehearsalStage)(deploymentProfile);
+    const protectedWorkflowStageBranchCases = `${rehearsalStage}:refs/heads/develop|production:refs/heads/main`;
     const initialRepositoryPolicy = (0, index_js_4.createIncubationRepositoryPolicy)(deploymentProfile);
     initialRepositoryPolicy.deploymentAccounts = options.deploymentAccounts ?? {
         development: null,
@@ -1367,6 +1379,7 @@ jobs:
           include-hidden-files: true
           retention-days: 30
           path: .ebk/evidence/release-candidate
+${(0, workspace_files_thin_deploy_js_1.renderThinDeployVerifyCaller)(deploymentProfile)}
 `,
         '.github/workflows/deploy.yml': `name: Deploy
 
@@ -3876,7 +3889,7 @@ on:
         description: Exact protected deployment stage
         required: true
         type: choice
-        options: [staging, production]
+        options: [${ecrInspectorWorkflowStageChoices}]
       deployment_commit:
         description: Exact successful protected deployment commit
         required: true
@@ -3885,8 +3898,8 @@ on:
         description: Exact successful Deploy workflow run ID
         required: true
         type: string
-      release_artifact_name:
-        description: Exact release-evidence artifact from that run
+      deployment_receipt_artifact_name:
+        description: Exact deployment-receipt artifact from that run
         required: true
         type: string
       slice:
@@ -3940,7 +3953,7 @@ jobs:
       EBK_DEPLOYMENT_ARN: \${{ inputs.deployment_arn }}
       EBK_DEPLOYMENT_KIND: \${{ inputs.deployment_kind }}
       EBK_DEPLOY_RUN_ID: \${{ inputs.deploy_run_id }}
-      EBK_RELEASE_ARTIFACT_NAME: \${{ inputs.release_artifact_name }}
+      EBK_DEPLOYMENT_RECEIPT_ARTIFACT_NAME: \${{ inputs.deployment_receipt_artifact_name }}
       EBK_SLICE: \${{ inputs.slice }}
       EBK_DEPLOYMENT_COMMIT: \${{ inputs.deployment_commit }}
       EBK_STAGE: \${{ inputs.stage }}
@@ -3963,10 +3976,10 @@ jobs:
           esac
           expected_branch=develop
           if [ "$EBK_STAGE" = production ]; then expected_branch=main; fi
-          expected_artifact="release-evidence-$EBK_STAGE-$EBK_DEPLOY_RUN_ID-"
-          case "$EBK_RELEASE_ARTIFACT_NAME" in
-            "$expected_artifact"*) attempt="\${EBK_RELEASE_ARTIFACT_NAME#"$expected_artifact"}" ;;
-            *) echo 'Release evidence artifact does not bind the exact deploy run'; exit 1 ;;
+          expected_artifact="deployment-receipt-$EBK_STAGE-$EBK_DEPLOY_RUN_ID-"
+          case "$EBK_DEPLOYMENT_RECEIPT_ARTIFACT_NAME" in
+            "$expected_artifact"*) attempt="\${EBK_DEPLOYMENT_RECEIPT_ARTIFACT_NAME#"$expected_artifact"}" ;;
+            *) echo 'Deployment receipt artifact does not bind the exact deploy run'; exit 1 ;;
           esac
           case "$attempt" in
             ''|0*|*[!0-9]*) echo 'Release evidence artifact has an invalid run attempt'; exit 1 ;;
@@ -3979,7 +3992,7 @@ jobs:
             test "$(printf '%s' "$run" | jq -r .path)" = ".github/workflows/deploy.yml" ||
             { echo 'Deploy run is not the exact successful protected source authority'; exit 1; }
           artifacts="$(gh api "/repos/$GH_REPO/actions/runs/$EBK_DEPLOY_RUN_ID/artifacts?per_page=100")"
-          count="$(printf '%s' "$artifacts" | jq --arg name "$EBK_RELEASE_ARTIFACT_NAME" \
+          count="$(printf '%s' "$artifacts" | jq --arg name "$EBK_DEPLOYMENT_RECEIPT_ARTIFACT_NAME" \
             '[.artifacts[] | select(.name == $name and .expired == false)] | length')"
           test "$count" = 1 ||
             { echo 'Exact unexpired release evidence artifact is absent or ambiguous'; exit 1; }
@@ -3996,7 +4009,7 @@ jobs:
       - uses: ${downloadArtifactAction}
         with:
           github-token: \${{ github.token }}
-          name: \${{ inputs.release_artifact_name }}
+          name: \${{ inputs.deployment_receipt_artifact_name }}
           path: .
           run-id: \${{ inputs.deploy_run_id }}
       - uses: ${pnpmAction}
@@ -4103,7 +4116,7 @@ jobs:
                       { encoding: "utf8" },
                     ).trim()
                   ) fail("Production deployment tree differs from its reviewed release source.");
-                } else if (stage !== "staging") {
+                } else if (stage !== "${rehearsalStage}") {
                   fail("Protected release stage is invalid.");
                 }
                 const productionKeys = [
@@ -4159,7 +4172,7 @@ jobs:
                   !digest.test(binding.candidateDigest ?? "") ||
                   (stage === "production" &&
                     !digest.test(binding.lifecycleDigest ?? "")) ||
-                  (stage === "staging" && binding.stage !== stage) ||
+                  (stage === "${rehearsalStage}" && binding.stage !== stage) ||
                   binding.runId !== process.env.EBK_DEPLOY_RUN_ID ||
                   binding.runAttempt !== process.env.EBK_DEPLOY_RUN_ATTEMPT ||
                   binding.workflow !== expectedWorkflow
@@ -4238,7 +4251,7 @@ on:
         description: Protected deployed stage
         required: true
         type: choice
-        options: [staging, production]
+        options: [${protectedWorkflowStageChoices}]
       project:
         description: Exact Product Slice project
         required: true
@@ -4338,7 +4351,7 @@ jobs:
           EBK_REPORT_RUN_ID: \${{ inputs.report_run_id }}
         run: |
           case "$EBK_STAGE:$EBK_PROTECTED_REF" in
-            staging:refs/heads/develop|production:refs/heads/main) ;;
+            ${protectedWorkflowStageBranchCases}) ;;
             *) echo 'Async recovery stage does not match its protected branch'; exit 1 ;;
           esac
           case "$EBK_PROJECT" in
@@ -5190,27 +5203,26 @@ jobs:
           );
           NODE
       - id: classify
-        name: Require one successful staging deployment job
+        name: Require one successful thin staging deployment job
         env:
           EBK_DEPLOYMENT_PROFILE: \${{ steps.profile.outputs.profile }}
           EBK_DEPLOYMENT_RUN_ID: \${{ github.event.workflow_run.id }}
           GH_TOKEN: \${{ github.token }}
           GH_REPO: \${{ github.repository }}
         run: |
+          if [ "$EBK_DEPLOYMENT_PROFILE" = starter ]; then
+            echo 'deployed=false' >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
           jobs="$(gh api \
             "/repos/$GH_REPO/actions/runs/$EBK_DEPLOYMENT_RUN_ID/jobs?filter=latest&per_page=100")"
-          apply_count="$(printf '%s' "$jobs" | jq \
-            '[.jobs[] | select(.name | startswith("${stagingApplyJobPrefix}")) | select(.conclusion == "success")] | length')"
-          route_success_count="$(printf '%s' "$jobs" | jq \
-            '[.jobs[] | select(.name == "${protectedDeploymentRouteJobName}" and .conclusion == "success")] | length')"
-          route_skipped_count="$(printf '%s' "$jobs" | jq \
-            '[.jobs[] | select(.name == "${protectedDeploymentRouteJobName}" and .conclusion == "skipped")] | length')"
-          case "$apply_count:$route_success_count:$route_skipped_count:$EBK_DEPLOYMENT_PROFILE" in
-            1:1:0:*) echo 'deployed=true' >> "$GITHUB_OUTPUT" ;;
-            0:0:1:*) echo 'deployed=false' >> "$GITHUB_OUTPUT" ;;
-            0:1:0:starter) echo 'deployed=false' >> "$GITHUB_OUTPUT" ;;
-            *) echo 'Deploy route and staging application evidence disagree'; exit 1 ;;
-          esac
+          execute_count="$(printf '%s' "$jobs" | jq \
+            '[.jobs[] | select(.name == "native deploy staging" and .conclusion == "success")] | length')"
+          [ "$execute_count" = 1 ] || {
+            echo 'Deploy must contain exactly one successful thin staging execution'
+            exit 1
+          }
+          echo 'deployed=true' >> "$GITHUB_OUTPUT"
 
   plan:
     needs: deployment-classification
@@ -7093,7 +7105,7 @@ on:
         description: Protected stage
         required: true
         type: choice
-        options: [staging, production]
+        options: [${protectedWorkflowStageChoices}]
       project:
         description: Exact Product Slice project
         required: true
@@ -7132,7 +7144,7 @@ jobs:
           EBK_PROTECTED_REF: \${{ github.ref }}
         run: |
           case "$EBK_STAGE:$EBK_PROTECTED_REF" in
-            staging:refs/heads/develop|production:refs/heads/main) ;;
+            ${protectedWorkflowStageBranchCases}) ;;
             *) echo 'Secret metadata stage does not match the protected branch'; exit 1 ;;
           esac
           case "$EBK_PROJECT" in
@@ -7168,6 +7180,98 @@ jobs:
           args=("--stage=$EBK_STAGE" "--region=$AWS_REGION")
           if [ "$EBK_ACTION" = apply ]; then args+=("--apply"); fi
           pnpm nx run "$EBK_PROJECT:secret-metadata" -- "\${args[@]}"
+`,
+        '.github/workflows/secret-initialize.yml': `name: Secret initialize
+
+on:
+  workflow_dispatch:
+    inputs:
+      stage:
+        description: Protected stage
+        required: true
+        type: choice
+        options: [${protectedWorkflowStageChoices}]
+      project:
+        description: Exact Product Slice project
+        required: true
+        type: string
+      logical_name:
+        description: Exact machine-generated secret logical name
+        required: true
+        type: string
+      action:
+        description: Value-blind initialization action
+        required: true
+        default: report
+        type: choice
+        options: [report, apply]
+
+concurrency:
+  group: secret-initialize-\${{ inputs.stage }}-\${{ inputs.project }}-\${{ inputs.logical_name }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  initialize:
+    environment: \${{ inputs.stage }}
+    permissions:
+      contents: read
+      id-token: write
+    env:
+      AWS_DEPLOY_ROLE_ARN: \${{ secrets.AWS_DEPLOY_ROLE_ARN }}
+      AWS_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_EXPECTED_ACCOUNT_ID }}
+      AWS_REGION: \${{ vars.AWS_REGION }}
+      EBK_ACTION: \${{ inputs.action }}
+      EBK_LOGICAL_NAME: \${{ inputs.logical_name }}
+      EBK_PROJECT: \${{ inputs.project }}
+      EBK_STAGE: \${{ inputs.stage }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Validate protected request
+        env:
+          EBK_PROTECTED_REF: \${{ github.ref }}
+        run: |
+          case "$EBK_STAGE:$EBK_PROTECTED_REF" in
+            ${protectedWorkflowStageBranchCases}) ;;
+            *) echo 'Secret initialize stage does not match the protected branch'; exit 1 ;;
+          esac
+          case "$EBK_PROJECT" in
+            ''|-*|*-|*[!a-z0-9-]*) echo 'Secret initialize project must be an exact normalized Slice name'; exit 1 ;;
+          esac
+          [[ "$EBK_LOGICAL_NAME" =~ ^[A-Za-z][A-Za-z0-9]{0,63}$ ]] ||
+            { echo 'Secret initialize logical name is invalid'; exit 1; }
+          test -n "$AWS_DEPLOY_ROLE_ARN" || { echo "$EBK_STAGE AWS_DEPLOY_ROLE_ARN is required"; exit 1; }
+          test -n "$AWS_EXPECTED_ACCOUNT_ID" || { echo "$EBK_STAGE AWS_EXPECTED_ACCOUNT_ID is required"; exit 1; }
+          test -n "$AWS_REGION" || { echo "$EBK_STAGE AWS_REGION is required"; exit 1; }
+          case "$AWS_DEPLOY_ROLE_ARN" in
+            arn:aws:iam::$AWS_EXPECTED_ACCOUNT_ID:role/*) ;;
+            *) echo 'Secret initialize role does not belong to the expected account'; exit 1 ;;
+          esac
+      - uses: ${checkoutAction}
+        with:
+          persist-credentials: false
+      - uses: ${pnpmAction}
+      - uses: ${setupNodeAction}
+        with:
+          node-version: ${tool_versions_js_1.WORKSPACE_NODE_VERSION}
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
+      - name: Verify managed workspace integrity before AWS authority
+        run: pnpm nx run ${name}:workspace-health
+      - uses: ${configureAwsAction}
+        with:
+          role-to-assume: \${{ secrets.AWS_DEPLOY_ROLE_ARN }}
+          role-session-name: ebk-secret-initialize-\${{ github.run_id }}-\${{ github.run_attempt }}
+          aws-region: \${{ vars.AWS_REGION }}
+      - name: Verify assumed account
+        run: test "$(aws sts get-caller-identity --query Account --output text)" = "$AWS_EXPECTED_ACCOUNT_ID"
+      - name: Initialize machine-generated secret value-blind
+        run: |
+          args=("--logicalName=$EBK_LOGICAL_NAME" "--stage=$EBK_STAGE" "--region=$AWS_REGION")
+          if [ "$EBK_ACTION" = apply ]; then args+=("--apply"); fi
+          pnpm nx run "$EBK_PROJECT:secret-initialize" -- "\${args[@]}"
 `,
         '.github/workflows/sync-back.yml': `name: Sync protected main history
 
@@ -7457,9 +7561,10 @@ infrastructure or protected deployment policy. Preserve the ownership boundary r
 \`.ebk/ownership.json\`: managed files belong to EBK, seeded files are generated starting
 points that adopters may change, and unrecorded files are adopter-owned.
 
-Secret values are a human-only TTY ceremony. Agents and CI must never invoke
-\`ebk secret set\` or \`ebk secret remove\`; they may use only value-blind
-metadata, status, and verification commands.
+Human-supplied secret values are a human-only TTY ceremony. Agents and CI must
+never invoke \`ebk secret set\` or \`ebk secret remove\`. They may use
+value-blind metadata, status, verification, and the exact generated-secret
+initializer, which accepts and returns no plaintext value.
 
 ## Work markers
 
@@ -7576,14 +7681,15 @@ The Standard Foundation lives at \`packages/foundation\`. Product slices live be
 \`packages/<slice-name>\` and consume versioned Foundation contracts instead of importing
 Foundation implementation files.
 
-Canonical consumer stages use the matching \`development\`, \`staging\`, or \`production\`
-Foundation. Framework-derived personal stages may use only the \`development\`
-Foundation; generic preview stages are unsupported.
+This workspace's \`${deploymentProfile}\` profile activates only:
+${activeStages.join(', ')}. Each active canonical consumer stage uses the matching Foundation.
+Inactive canonical stages are rejected. Framework-derived personal stages may use only the
+\`development\` Foundation; generic preview stages are unsupported.
 
-The committed deployment profile changes account and local/GitHub authority only. Every
-canonical stage always owns a separate Router/domain, Aurora cluster and migration history,
+Every active canonical stage owns a separate Router/domain, Aurora cluster and migration history,
 Cognito user pool, event bus, secret namespace, IAM boundary, logs, queues, ECR namespace, and
-stage-qualified SSM discovery contract. Discovery rejects a record for another canonical stage.
+stage-qualified SSM discovery contract. Discovery rejects a record for an inactive or different
+canonical stage.
 `,
         'docs/git-workflow.md': `# Protected Git workflow
 
@@ -7603,10 +7709,11 @@ Direct updates, force pushes, deletion, squash merging, and rebase merging are p
 GitHub rulesets, environments, and AWS IAM are the authorization boundaries; local hooks are
 only defense in depth.
 
-The \`staging\` environment accepts only \`develop\`; \`production\` accepts only \`main\`.
-These workflows exist for every deployment profile. The staging workflow is optional for
-\`starter\`, whose governed local Nx target may deploy development and staging. Production is
-GitHub-only for every profile; \`fully-isolated\` also requires GitHub for staging.
+The rehearsal environment accepts only \`develop\`; \`production\` accepts only \`main\`.
+For \`starter\`, development is the rehearsal stage and GitHub deployment is optional for both
+development and production. For isolated profiles, staging is the rehearsal stage;
+\`production-isolated\` requires GitHub for production and \`fully-isolated\` requires GitHub
+for staging and production.
 The committed \`productionApproval.mode\` selects one of two production authorization
 contracts:
 
@@ -7628,15 +7735,15 @@ contracts:
 
 Both modes retain required checks, a non-author CODEOWNER approval, no ruleset bypass, the
 literal production environment, and its branch-scoped credentials. The base \`staging\` and
-\`production\` environments own deployment, smoke, and ECR evidence roles plus their
-variables; isolated profiles also keep the staging-registry promotion pull role in production.
+\`production\` environments own deployment and smoke authority plus their variables; isolated
+profiles also keep the staging-registry promotion pull role in production. Read-only container
+evidence uses only \`ecr-inspector-<stage>\`, which owns the exact evidence role and must trust
+that dedicated immutable repository/environment subject rather than the base stage subject.
 Starter promotion authenticates once to the shared account and copies the exact staging digest
 into a distinct production ECR repository. Dedicated
 \`infrastructure-plan-<stage>\` environments gate read-only role use. Separate
-\`async-recovery-<stage>\`, \`performance-aggregate-<stage>\`,
-\`performance-cost-<stage>\`, \`performance-load-<stage>\`, and
-\`reliability-read-<stage>\` environments own only the role and variables required by that
-capability. Infrastructure-plan jobs use a repository-variable read-only role/input inventory;
+\`async-recovery-<stage>\` and \`reliability-read-<stage>\` environments own only the role and
+variables required by that capability. Infrastructure-plan jobs use a repository-variable read-only role/input inventory;
 an independent clean audit job assumes that exact environment-subject role and verifies its
 trust and complete inline policy before any repository-backed plan job may assume it. Plan-role
 trust uses GitHub's immutable repository identity subject,
@@ -7666,64 +7773,10 @@ its \`EBK_FLEET_ORIGIN\` to equal the origin retained by the plan.
 repository's exact \`async-recovery-<stage>\` GitHub OIDC subject and grant only
 the recovery operations/resources declared by generated capability adapters.
 
-\`AWS_PERFORMANCE_LOAD_ROLE_ARN\` is a separate read-only OIDC role. Trust only
-this repository's exact \`performance-load-<stage>\` GitHub OIDC subject.
-Set that environment's \`EBK_PERFORMANCE_ORIGINS_JSON\` to a JSON object that
-maps every reviewed Slice to the exact \`performanceEndpoint\` emitted by its
-current deployment; never copy the map to repository scope or substitute the
-fleet web origin. The workflow selects only its requested Slice, and the
-committed load plan must name that same origin and exact reserved Slice path.
-Grant \`sts:GetCallerIdentity\` and \`secretsmanager:GetSecretValue\` only on
-\`arn:<partition>:secretsmanager:<region>:<account>:secret:ebk/<stage>/<slice>/*\` for
-reviewed Slices. Do not grant secret writes, deployment, CloudFormation, SST,
-or CloudWatch Logs access. The protected workflow never logs or uploads HMAC
-material and removes its new job-scoped 0600 file after cleanup.
-Bootstrap verifies environment-only secret placement, not the role's hidden
-AWS trust or permission policy.
-
-\`AWS_PERFORMANCE_AGGREGATE_ROLE_ARN\` is a separate adopter-owned read-only
-OIDC role. Trust only this repository's exact
-\`performance-aggregate-<stage>\` GitHub OIDC subject. Grant
-\`sts:GetCallerIdentity\` plus only the exact data-read actions and resource
-ARNs required by the adopted \`performance/aggregate-count-provider.ts\`.
-Do not grant writes, deployment, CloudFormation, SST, IAM, Cost Explorer, or
-unrelated data access. The generated workflow validates the protected Deploy
-artifact before role assumption, verifies the STS account and environment
-Region, withholds the OIDC bearer, and clears the AWS session before artifact
-retention. Bootstrap verifies environment-only secret placement, not the
-role's hidden AWS trust or least-privilege permission policy.
-
-\`AWS_PERFORMANCE_COST_ROLE_ARN\` is a separate read-only OIDC role. Trust only
-this repository's exact \`performance-cost-<stage>\` GitHub OIDC subject.
-Grant only \`sts:GetCallerIdentity\`, \`ce:ListCostAllocationTags\`, and
-\`ce:GetCostAndUsage\`; Cost Explorer
-queries are account-global, while the retained evidence still binds the
-selected resource Region. Do not grant budget, anomaly-monitor, tag, billing,
-deployment, CloudFormation, SST, or other mutation authority. Bootstrap verifies
-environment-only secret placement, not the role's hidden AWS trust or
-permission policy.
-
-The framework manages
-\`.github/workflows/performance-aggregate-counts.yml\`, its exact Deploy
-binding, evidence wrapper, artifact name, and canonical schema. The seeded
-\`performance/aggregate-count-provider.ts\` remains adopter-owned and fails
-closed until it returns only the reviewed business counts and provider request
-reference. The provider runs only with the dedicated aggregate-read role after
-the framework validates the exact protected release and STS account. The
-workflow binds those untrusted counts to the environment-owned account/Region,
-closed period, exact current protected release, Slice, stage, and workspace
-and records the dedicated OIDC access mode and adopter-owned least-privilege
-read contract before it emits the single
-\`aggregate-count-<stage>-<slice>-<run>-<attempt>\` artifact. The framework
-does not invent counts or copy them from request-level dimensions.
-
-\`performance-cost-actual.yml\` treats supplied run IDs and artifact names only
-as selectors. Before OIDC it queries GitHub for the fixed aggregate workflow
-and generated \`Deploy\` workflow runs, requiring the same repository,
-candidate, protected branch, successful conclusion, allowed event, exact
-workflow name/path, and one exact nonexpired artifact. It derives the compact
-performance release binding from that Deploy artifact and separately verifies
-the independently approved aggregate-count and release-binding byte digests.
+The preview-era performance aggregate, cost, and load workflow renderers remain available to
+framework maintainers, but RC.31 no longer emits their stale release-manifest-bound workflows
+or GitHub environments by default. Reintroducing them requires an explicit capability contract
+bound to the thin deployment receipt rather than the removed preview/replay lifecycle.
 
 \`AWS_RELIABILITY_READ_ROLE_ARN\` is a separate read-only OIDC role. Trust only
 this repository's exact \`reliability-read-<stage>\` GitHub OIDC subject.
@@ -7744,8 +7797,8 @@ resources before the adapter makes a service call. Bootstrap verifies
 environment-only secret placement, not the role's hidden AWS trust or
 permission policy.
 
-The async-recovery, performance-load, performance-cost, and reliability-read
-jobs have job-scoped \`id-token: write\`. They install the frozen dependency
+The async-recovery and reliability-read jobs have job-scoped \`id-token: write\`.
+They install the frozen dependency
 graph with lifecycle scripts and pnpm hooks disabled before assuming AWS
 authority. Immediately after the one pinned credential action, they blank the
 OIDC request URL and bearer for future steps and explicitly shadow both values
@@ -8135,8 +8188,18 @@ must be committed, reviewable, and auditable.
                     executor: 'nx:run-commands',
                     options: { command: 'node tools/install-ebk-hooks.mjs' },
                 },
+                'stage-authority-render': {
+                    cache: false,
+                    executor: 'nx:run-commands',
+                    outputs: ['{workspaceRoot}/.ebk/authority/{args.stage}/*'],
+                    options: {
+                        command: 'node tools/stage-authority-render.mjs',
+                        forwardAllArgs: true,
+                    },
+                },
                 'deploy-local': {
                     cache: false,
+                    dependsOn: ['workspace-health'],
                     executor: '@empire-builder-kit/nx:local-deploy',
                     options: {
                         stage: 'development',
@@ -8165,19 +8228,6 @@ must be committed, reviewable, and auditable.
                     executor: '@empire-builder-kit/nx:work-markers',
                     options: {},
                 },
-                'workload-role-candidate-report': {
-                    executor: 'nx:run-commands',
-                    options: {
-                        command: 'node tools/workload-role-baseline/report-candidate-bundle.mjs',
-                        forwardAllArgs: true,
-                    },
-                },
-                'workload-role-provisioner-build': {
-                    executor: 'nx:run-commands',
-                    options: {
-                        command: 'node tools/workload-role-baseline/build.mjs',
-                    },
-                },
                 verify: {
                     dependsOn: ['blueprint-trust-check', 'supply-chain-check'],
                     executor: 'nx:run-commands',
@@ -8213,7 +8263,9 @@ domain. Without it, the shared Router uses its functional provider URL.
 
 Before deploying development or staging, add at least one exact operator/probe CIDR to
 \`security/router-waf.json\`. Production is public by default behind the same managed and
-rate-limiting baseline; select its allowlist mode explicitly when required.
+rate-limiting baseline; select its allowlist mode explicitly when required. Rehearse the
+resolved ${(0, index_js_4.productionRehearsalStage)(deploymentProfile)} stage with
+\`pnpm nx run foundation:router-waf-rehearsal -- --probeUrl=https://<router>/<slice>/api/health --profile=<temporary-profile>\`.
 `,
         'packages/foundation/contracts/foundation.json': json({
             contractVersion: '1.0.0',
@@ -8243,11 +8295,15 @@ rate-limiting baseline; select its allowlist mode explicitly when required.
                     dataRetention: 'retained',
                     nat: 'ec2',
                 },
-                staging: {
-                    aurora: 'scale-to-zero',
-                    dataRetention: 'retained',
-                    nat: 'ec2',
-                },
+                ...(deploymentProfile === 'starter'
+                    ? {}
+                    : {
+                        staging: {
+                            aurora: 'scale-to-zero',
+                            dataRetention: 'retained',
+                            nat: 'ec2',
+                        },
+                    }),
                 production: {
                     aurora: 'repository-policy',
                     dataRetention: 'retained-and-protected',
@@ -8271,7 +8327,7 @@ The machine-readable stage inventory is \`../contracts/costs.json\`; keep this
 seeded decision record aligned with organization-specific budgets and alerts.
 
 - Development uses EC2 NAT, a development bastion, and Aurora scale-to-zero.
-- Staging uses EC2 NAT and Aurora scale-to-zero by default.
+${deploymentProfile === 'starter' ? '' : '- Staging uses EC2 NAT and Aurora scale-to-zero by default.\n'}- Production always uses managed NAT and retains protected data. Its explicit Repository
 - Production always uses managed NAT and retains protected data. Its explicit Repository
   Operating Policy profile selects either the standard 2-ACU Aurora floor or the
   cost-optimized 0.5-ACU warm floor.
@@ -8392,7 +8448,7 @@ connects as the Slice's no-password IAM-authenticated migrator user.
 - Every stage's CloudFront Router has its own global Web ACL. The baseline always includes AWS
   Common Rule Set, Known Bad Inputs, Amazon IP Reputation, rate blocking, CloudWatch metrics,
   and sampled requests. Nonproduction is allowlisted by default. Production is public by
-  default, but cannot deploy until the exact policy has passed a staging blocking rehearsal.
+  default, but cannot deploy until the exact policy has passed a ${rehearsalStage} blocking rehearsal.
 - Full WAF request logging is disabled by default. Enabling it keeps blocked requests only,
   uses bounded retention, and redacts query strings, cookies, authorization, and API keys.
 
@@ -8433,6 +8489,7 @@ import {
   foundationSsmPath,
   normalizeRouterWafPolicy,
   reconcileRouterWafBlockingRehearsal,
+  routerWafContractDigest,
   type FoundationSsmKey,
 } from '@empire-builder-kit/nx/foundation';
 import {
@@ -8440,12 +8497,19 @@ import {
   FOUNDATION_AURORA_ENGINE_VERSION,
   productionFoundationProfileContract,
 } from '@empire-builder-kit/nx/repository-policy';
+import { installStageIamBoundaryTransforms } from '@empire-builder-kit/nx/aws-authority';
+import { createStageAuthorityIdentity } from '@empire-builder-kit/nx/aws-authority';
+import {
+  configuredDeploymentAccountForStage,
+  configuredDeploymentRegion,
+  productionRehearsalStage,
+} from '@empire-builder-kit/nx/repository-policy';
 import { createFoundationAccountCostControlPlan } from '@empire-builder-kit/nx/performance';
 import accountCostPolicy from '../performance/account-cost-policy.json';
 import routerWafBlockingRehearsal from '../security/router-waf-blocking-rehearsal.json';
 import routerWafLiveEvidence from '../security/router-waf-live-evidence.json';
 import routerWafPolicy from '../security/router-waf.json';
-import type { FoundationWorkloadRolePreflight } from './workload-roles/preflight.js';
+import repositoryPolicy from '../../../ebk.repository-policy.json';
 
 function identityDomainPrefix(stage: string, accountId: string): string {
   if (!/^\\d{12}$/.test(accountId)) {
@@ -8479,14 +8543,7 @@ function publishFoundation(values: Record<FoundationSsmKey, any>) {
   );
 }
 
-export function foundation(
-  workloadRoles?: FoundationWorkloadRolePreflight,
-) {
-  if (!$dev && !workloadRoles) {
-    throw new Error(
-      'Protected Foundation workload-role preflight must complete before infrastructure construction.',
-    );
-  }
+export function foundation() {
   const isProduction = $app.stage === 'production';
   const isStaging = $app.stage === 'staging';
   const rootDomain = process.env.EBK_ROOT_DOMAIN?.trim();
@@ -8497,40 +8554,63 @@ export function foundation(
     : undefined;
   const natMode = productionConfiguration?.contract.nat ?? 'ec2';
   const normalizedRouterWafPolicy = normalizeRouterWafPolicy(routerWafPolicy);
+  if (repositoryPolicy.deploymentProfile !== normalizedRouterWafPolicy.deploymentProfile) {
+    throw new Error('Router WAF policy profile differs from committed repository policy.');
+  }
+  const rehearsalStage = productionRehearsalStage(normalizedRouterWafPolicy.deploymentProfile);
+  const rehearsalAccount = configuredDeploymentAccountForStage(
+    normalizedRouterWafPolicy.deploymentProfile,
+    repositoryPolicy.deploymentAccounts,
+    rehearsalStage,
+  );
+  const rehearsalRegion = configuredDeploymentRegion(repositoryPolicy.deploymentRegion);
+  const rehearsalRoleArn = createStageAuthorityIdentity({
+    accountId: rehearsalAccount,
+    partition: rehearsalRegion.startsWith('us-gov-') ? 'aws-us-gov' : 'aws',
+    region: rehearsalRegion,
+    stage: rehearsalStage,
+  }).deploymentRoleArn;
   const wafPlan = createRouterWafStagePlan({
     policy: normalizedRouterWafPolicy,
     rehearsal: isProduction
       ? reconcileRouterWafBlockingRehearsal({
           evidence: routerWafLiveEvidence,
+          expected: {
+            accountId: rehearsalAccount,
+            deploymentRoleArn: rehearsalRoleArn,
+            region: rehearsalRegion,
+            stage: rehearsalStage,
+            wafContractDigest: routerWafContractDigest(normalizedRouterWafPolicy),
+            workspace: '${name}',
+          },
           policy: normalizedRouterWafPolicy,
           receipt: routerWafBlockingRehearsal,
         })
       : null,
     stage: $app.stage,
   });
-  const natBinding = workloadRoles?.bindings.nat;
-  if (natMode === 'ec2' && natBinding) {
-    $transform(
-      aws.iam.InstanceProfile,
-      (args: any, opts: any, logicalName: string) => {
-        if (logicalName !== 'FoundationVpcNatInstanceProfile') return;
-        args.name = natBinding.instanceProfileName;
-        args.role = natBinding.roleName;
-        opts.import = natBinding.instanceProfileName;
-        opts.ignoreChanges = [
-          ...new Set([...(opts.ignoreChanges ?? []), 'tags', 'tagsAll']),
-        ];
-      },
+  const deploymentAccount = process.env.AWS_EXPECTED_ACCOUNT_ID?.trim() ?? '';
+  if (!/^\\d{12}$/.test(deploymentAccount)) {
+    throw new Error(
+      'Foundation deployment requires the exact committed AWS account before infrastructure construction.',
     );
   }
+  installStageIamBoundaryTransforms({
+    accountId: deploymentAccount,
+    instanceProfileResource: aws.iam.InstanceProfile,
+    registerTransform: $transform,
+    roleResource: aws.iam.Role,
+    stage: ($dev ? 'development' : $app.stage) as
+      | 'development'
+      | 'staging'
+      | 'production',
+  });
 
   const vpc = new sst.aws.Vpc('FoundationVpc', {
     az: 2,
     bastion: $app.stage === 'development',
     nat:
-      natMode === 'ec2'
-        ? (natBinding?.vpc.nat ?? 'ec2')
-        : 'managed',
+      natMode === 'ec2' ? 'ec2' : 'managed',
   });
   const cluster = new sst.aws.Cluster('FoundationCluster', { vpc });
   const router = new sst.aws.Router('FoundationRouter', {
@@ -8559,6 +8639,13 @@ export function foundation(
             'Foundation Router must attach its exact global Web ACL.',
           );
         }
+        args.tags = {
+          ...(args.tags ?? {}),
+          'ebk:managed-by': 'empire-builder-kit',
+          'ebk:owner': 'foundation',
+          'ebk:stage': wafPlan.stage,
+          'ebk:workspace': '${name}',
+        };
       },
       waf(args: any, opts: any) {
         if (args.scope !== 'CLOUDFRONT') {
@@ -8576,8 +8663,11 @@ export function foundation(
               name: 'foundation-' + wafPlan.stage + '-router-ipv4-allowlist',
               scope: 'CLOUDFRONT',
               tags: {
+                'ebk:managed-by': 'empire-builder-kit',
+                'ebk:owner': 'foundation',
                 'ebk:policy-digest': wafPlan.policyDigest,
                 'ebk:stage': wafPlan.stage,
+                'ebk:workspace': '${name}',
               },
             },
             { provider: opts.provider },
@@ -8592,8 +8682,11 @@ export function foundation(
               name: 'foundation-' + wafPlan.stage + '-router-ipv6-allowlist',
               scope: 'CLOUDFRONT',
               tags: {
+                'ebk:managed-by': 'empire-builder-kit',
+                'ebk:owner': 'foundation',
                 'ebk:policy-digest': wafPlan.policyDigest,
                 'ebk:stage': wafPlan.stage,
+                'ebk:workspace': '${name}',
               },
             },
             { provider: opts.provider },
@@ -8604,8 +8697,11 @@ export function foundation(
         args.scope = 'CLOUDFRONT';
         args.tags = {
           ...(args.tags ?? {}),
+          'ebk:managed-by': 'empire-builder-kit',
+          'ebk:owner': 'foundation',
           'ebk:policy-digest': wafPlan.policyDigest,
           'ebk:stage': wafPlan.stage,
+          'ebk:workspace': '${name}',
         };
         args.visibilityConfig = {
           cloudwatchMetricsEnabled: true,
@@ -8709,6 +8805,7 @@ export function foundation(
   const accountCostControl = createFoundationAccountCostControlPlan({
     evaluatedAt: new Date().toISOString(),
     policy: accountCostPolicy,
+    rehearsalStage: '${rehearsalStage}',
     region: process.env.AWS_REGION,
     stage: $app.stage,
     workspace: '${name}',
@@ -9013,15 +9110,9 @@ export function foundation(
 }
 `,
         'packages/foundation/infra/index.ts': `import { foundation } from './foundation.js';
-import type { FoundationWorkloadRolePreflight } from './workload-roles/preflight.js';
 
-export function app(workloadRoles?: FoundationWorkloadRolePreflight) {
-  const resources = foundation(workloadRoles);
-  return {
-    ...resources,
-    workloadRoleManifestDigest:
-      workloadRoles?.registry.manifestDigest ?? 'local-dev-ephemeral',
-  };
+export function app() {
+  return foundation();
 }
 `,
         'packages/foundation/performance/account-cost-policy.json': json({
@@ -9036,6 +9127,7 @@ export function app(workloadRoles?: FoundationWorkloadRolePreflight) {
             workspace: name,
         }),
         'packages/foundation/security/router-waf.json': json({
+            deploymentProfile,
             kind: 'ebk-router-waf-policy',
             logging: {
                 enabled: false,
@@ -9054,21 +9146,25 @@ export function app(workloadRoles?: FoundationWorkloadRolePreflight) {
                     allowedCidrs: [],
                     mode: 'block',
                 },
-                staging: {
-                    access: 'allowlist',
-                    allowedCidrs: [],
-                    mode: 'block',
-                },
+                ...(deploymentProfile === 'starter'
+                    ? {}
+                    : {
+                        staging: {
+                            access: 'allowlist',
+                            allowedCidrs: [],
+                            mode: 'block',
+                        },
+                    }),
             },
         }),
         'packages/foundation/security/router-waf-blocking-rehearsal.json': json({
             kind: 'ebk-router-waf-blocking-rehearsal',
-            schemaVersion: 1,
+            schemaVersion: 4,
             status: 'pending',
         }),
         'packages/foundation/security/router-waf-live-evidence.json': json({
             kind: 'ebk-router-waf-live-evidence',
-            schemaVersion: 1,
+            schemaVersion: 4,
             status: 'pending',
         }),
         'packages/foundation/configuration/declarations.json': json({
@@ -9222,10 +9318,6 @@ export function app(workloadRoles?: FoundationWorkloadRolePreflight) {
                         'verify',
                         { target: 'profile-preflight', params: 'forward' },
                     ],
-                    outputs: [
-                        `{projectRoot}/.ebk/evidence/infrastructure-convergence.json`,
-                        `{projectRoot}/.ebk/evidence/infrastructure-mutation-binding.json`,
-                    ],
                     options: {
                         cwd: 'packages/foundation',
                         stage: 'development',
@@ -9242,15 +9334,7 @@ export function app(workloadRoles?: FoundationWorkloadRolePreflight) {
                 'infrastructure-plan': {
                     cache: false,
                     executor: '@empire-builder-kit/nx:infrastructure-plan',
-                    outputs: [
-                        `{projectRoot}/.ebk/evidence/infrastructure-plan-authorization.json`,
-                        `{projectRoot}/.ebk/evidence/infrastructure-plan-command.json`,
-                        `{projectRoot}/.ebk/evidence/infrastructure-plan.private-stderr.txt`,
-                        `{projectRoot}/.ebk/evidence/infrastructure-plan.raw.json`,
-                        `{projectRoot}/.ebk/evidence/infrastructure-plan.json`,
-                    ],
                     options: {
-                        action: 'deploy',
                         cwd: 'packages/foundation',
                         stage: 'development',
                         stageMode: 'foundation',
@@ -9259,10 +9343,6 @@ export function app(workloadRoles?: FoundationWorkloadRolePreflight) {
                 refresh: {
                     executor: '@empire-builder-kit/nx:refresh',
                     dependsOn: [{ target: 'profile-preflight', params: 'forward' }],
-                    outputs: [
-                        `{projectRoot}/.ebk/evidence/infrastructure-convergence.json`,
-                        `{projectRoot}/.ebk/evidence/infrastructure-mutation-binding.json`,
-                    ],
                     options: {
                         cwd: 'packages/foundation',
                         stage: 'development',
@@ -9272,10 +9352,6 @@ export function app(workloadRoles?: FoundationWorkloadRolePreflight) {
                 remove: {
                     executor: '@empire-builder-kit/nx:remove',
                     dependsOn: [{ target: 'remove-preflight', params: 'forward' }],
-                    outputs: [
-                        `{projectRoot}/.ebk/evidence/infrastructure-convergence.json`,
-                        `{projectRoot}/.ebk/evidence/infrastructure-mutation-binding.json`,
-                    ],
                     options: {
                         cwd: 'packages/foundation',
                         stage: 'development',
@@ -9325,9 +9401,17 @@ export function app(workloadRoles?: FoundationWorkloadRolePreflight) {
         'packages/foundation/scripts/verify-foundation.mjs': `import { readFileSync } from 'node:fs';
 
 import {
+  normalizeRouterWafBlockingRehearsal,
   normalizeRouterWafPolicy,
   reconcileRouterWafBlockingRehearsal,
+  routerWafContractDigest,
 } from '@empire-builder-kit/nx/foundation';
+import { createStageAuthorityIdentity } from '@empire-builder-kit/nx/aws-authority';
+import {
+  configuredDeploymentAccountForStage,
+  configuredDeploymentRegion,
+  productionRehearsalStage,
+} from '@empire-builder-kit/nx/repository-policy';
 
 const descriptor = JSON.parse(
   readFileSync(new URL('../contracts/foundation.json', import.meta.url), 'utf8'),
@@ -9352,25 +9436,54 @@ const routerWafPolicy = normalizeRouterWafPolicy(
     ),
   ),
 );
-reconcileRouterWafBlockingRehearsal({
-  evidence: JSON.parse(
-    readFileSync(
-      new URL('../security/router-waf-live-evidence.json', import.meta.url),
-      'utf8',
+const repositoryPolicy = JSON.parse(
+  readFileSync(new URL('../../../ebk.repository-policy.json', import.meta.url), 'utf8'),
+);
+const workspaceManifest = JSON.parse(
+  readFileSync(new URL('../../../package.json', import.meta.url), 'utf8'),
+);
+const rehearsalReceipt = JSON.parse(
+  readFileSync(
+    new URL(
+      '../security/router-waf-blocking-rehearsal.json',
+      import.meta.url,
     ),
+    'utf8',
   ),
-  policy: routerWafPolicy,
-  receipt:
-  JSON.parse(
-    readFileSync(
-      new URL(
-        '../security/router-waf-blocking-rehearsal.json',
-        import.meta.url,
+);
+const normalizedRehearsal = normalizeRouterWafBlockingRehearsal(rehearsalReceipt);
+if (normalizedRehearsal) {
+  const rehearsalStage = productionRehearsalStage(repositoryPolicy.deploymentProfile);
+  const rehearsalAccount = configuredDeploymentAccountForStage(
+    repositoryPolicy.deploymentProfile,
+    repositoryPolicy.deploymentAccounts,
+    rehearsalStage,
+  );
+  const rehearsalRegion = configuredDeploymentRegion(repositoryPolicy.deploymentRegion);
+  reconcileRouterWafBlockingRehearsal({
+    evidence: JSON.parse(
+      readFileSync(
+        new URL('../security/router-waf-live-evidence.json', import.meta.url),
+        'utf8',
       ),
-      'utf8',
     ),
-  ),
-});
+    expected: {
+      accountId: rehearsalAccount,
+      deploymentRoleArn: createStageAuthorityIdentity({
+        accountId: rehearsalAccount,
+        partition: rehearsalRegion.startsWith('us-gov-') ? 'aws-us-gov' : 'aws',
+        region: rehearsalRegion,
+        stage: rehearsalStage,
+      }).deploymentRoleArn,
+      region: rehearsalRegion,
+      stage: rehearsalStage,
+      wafContractDigest: routerWafContractDigest(routerWafPolicy),
+      workspace: workspaceManifest.name,
+    },
+    policy: routerWafPolicy,
+    receipt: normalizedRehearsal,
+  });
+}
 const expectedCapabilities = [
   'network',
   'routing',
@@ -9387,8 +9500,10 @@ if (descriptor.contractVersion !== '1.0.0') {
   throw new Error('Foundation contractVersion must be 1.0.0.');
 }
 if (
+  JSON.stringify(Object.keys(routerWafPolicy.stages).sort()) !==
+    JSON.stringify(${JSON.stringify([...activeStages].sort())}) ||
   routerWafPolicy.stages.development.access !== 'allowlist' ||
-  routerWafPolicy.stages.staging.access !== 'allowlist' ||
+  ${deploymentProfile !== 'starter' ? "routerWafPolicy.stages.staging?.access !== 'allowlist' ||" : ''}
   routerWafPolicy.stages.production.mode !== 'block'
 ) {
   throw new Error('Foundation Router WAF stage defaults are invalid.');
@@ -9403,7 +9518,8 @@ if (
   costs.productionProfiles?.standard?.aurora?.min !== '2 ACU' ||
   costs.productionProfiles?.['cost-optimized']?.aurora?.min !== '0.5 ACU' ||
   !costs.stages?.development ||
-  !costs.stages?.staging ||
+  JSON.stringify(Object.keys(costs.stages ?? {}).sort()) !==
+    JSON.stringify(${JSON.stringify([...activeStages].sort())}) ||
   costs.stages?.production?.dataRetention !== 'retained-and-protected'
 ) {
   throw new Error('Foundation cost manifest does not match the v1 stage contract.');
@@ -9443,9 +9559,9 @@ export {};
 export default $config({
   app(input: { stage?: string } | undefined) {
     const stage = input?.stage ?? 'development';
-    if (!['development', 'staging', 'production'].includes(stage)) {
+    if (!new Set<string>(${JSON.stringify(activeStages)}).has(stage)) {
       throw new Error(
-        'Foundation stage ' + stage + ' is not canonical. Use development, staging, or production.',
+        'Foundation stage ' + stage + ' is inactive for the ${deploymentProfile} deployment profile.',
       );
     }
     const production = stage === 'production';
@@ -9477,15 +9593,8 @@ export default $config({
     };
   },
   async run() {
-    const workloadRoles = $dev
-      ? undefined
-      : await import(
-          './infra/workload-roles/preflight.js'
-        ).then(({ preflightFoundationWorkloadRoles }) =>
-          preflightFoundationWorkloadRoles($app.stage),
-        );
     const { app } = await import('./infra/index.js');
-    return app(workloadRoles);
+    return app();
   },
 });
 `,
@@ -10506,7 +10615,48 @@ assertWorkMarkerReport(markerReport);
 process.stdout.write('Empire Builder Kit workspace source health is green.\\n');
 `,
     };
-    Object.assign(files, SUPPLY_CHAIN_WORKSPACE_FILE_PLAN.files, (0, workspace_files_performance_cost_js_1.renderProtectedPerformanceCostWorkflow)(), (0, workspace_files_performance_cost_js_1.renderProtectedAggregateCountWorkflow)(), (0, workspace_files_performance_load_js_1.renderProtectedPerformanceLoadWorkflowPlan)('workspace').files, developerAgentFilePlan.files, (0, workspace_files_foundation_workload_roles_js_1.renderFoundationWorkloadRoleFiles)(), (0, workspace_files_workload_role_baseline_js_1.renderWorkspaceWorkloadRoleBaselineFiles)({ name }));
+    Object.assign(files, SUPPLY_CHAIN_WORKSPACE_FILE_PLAN.files, developerAgentFilePlan.files, (0, workspace_files_stage_authority_js_1.renderStageAuthorityWorkspaceFiles)({ deploymentProfile }));
+    Object.assign(files, (0, workspace_files_ecr_inspector_js_1.renderThinEcrInspectorWorkflow)({
+        actionPins: {
+            checkout: checkoutAction,
+            configureAwsCredentials: configureAwsAction,
+            downloadArtifact: downloadArtifactAction,
+            pnpmSetup: pnpmAction,
+            setupNode: setupNodeAction,
+            uploadArtifact: uploadArtifactAction,
+        },
+        deploymentProfile,
+        name,
+        nodeVersion: tool_versions_js_1.WORKSPACE_NODE_VERSION,
+    }), (0, workspace_files_thin_deploy_js_1.renderThinDeployWorkflowFilePlan)({
+        actionPins: {
+            checkout: checkoutAction,
+            configureAwsCredentials: configureAwsAction,
+            downloadArtifact: downloadArtifactAction,
+            pnpmSetup: pnpmAction,
+            setupNode: setupNodeAction,
+            uploadArtifact: uploadArtifactAction,
+        },
+        deploymentProfile,
+        name,
+        toolVersions: {
+            node: tool_versions_js_1.WORKSPACE_NODE_VERSION,
+            pnpm: tool_versions_js_1.WORKSPACE_PNPM_VERSION,
+            sst: tool_versions_js_1.WORKSPACE_SST_VERSION,
+        },
+    }).files, (0, workspace_files_thin_docs_js_1.renderThinLifecycleDocumentation)({ deploymentProfile, name }));
+    const thinReleaseWorkflowPlan = (0, workspace_files_thin_release_js_1.renderThinReleaseWorkflowPlan)();
+    Object.assign(files, thinReleaseWorkflowPlan.files);
+    for (const obsoletePath of [
+        ...thinReleaseWorkflowPlan.obsoletePaths,
+        '.github/workflows/performance-aggregate-counts.yml',
+        '.github/workflows/performance-cost-actual.yml',
+        '.github/workflows/performance-load.yml',
+        'packages/foundation/operations/infrastructure-change.json',
+        'tools/ebk-infrastructure-plan-summary.mjs',
+    ]) {
+        delete files[obsoletePath];
+    }
     for (const [path, source] of Object.entries(files)) {
         if (/^\.github\/workflows\/[^/]+\.ya?ml$/u.test(path)) {
             files[path] = isolateOidcTokenBeforeAwsAuthority(source, configureAwsAction);