@empire-builder-kit/nx 1.0.0-rc.30 → 1.0.0-rc.32

package/src/generators/preset/workspace-files.js

@@ -17,10 +17,11 @@ const deterministic_order_js_1 = require("../../deterministic-order.js");
 const tool_versions_js_1 = require("./tool-versions.js");
 const workspace_files_developer_agent_js_1 = require("./workspace-files-developer-agent.js");
 const workspace_files_ci_acceptance_js_1 = require("./workspace-files-ci-acceptance.js");
-const workspace_files_foundation_workload_roles_js_1 = require("./workspace-files-foundation-workload-roles.js");
-const workspace_files_performance_cost_js_1 = require("./workspace-files-performance-cost.js");
-const workspace_files_performance_load_js_1 = require("./workspace-files-performance-load.js");
-const workspace_files_workload_role_baseline_js_1 = require("./workspace-files-workload-role-baseline.js");
+const workspace_files_ecr_inspector_js_1 = require("./workspace-files-ecr-inspector.js");
+const workspace_files_thin_deploy_js_1 = require("./workspace-files-thin-deploy.js");
+const workspace_files_thin_docs_js_1 = require("./workspace-files-thin-docs.js");
+const workspace_files_thin_release_js_1 = require("./workspace-files-thin-release.js");
+const workspace_files_stage_authority_js_1 = require("./workspace-files-stage-authority.js");
 const GENERATED_CREDENTIAL_SHAPE_PATTERNS = `[${sensitive_patterns_1.CREDENTIAL_SHAPE_DEFINITIONS.map(({ pattern }) => `new RegExp(${JSON.stringify(pattern.source)}, ${JSON.stringify(pattern.flags)})`).join(',')}]`;
 const GENERATED_RELEASE_ROLLOUT_PLAN_ID_PATTERN = JSON.stringify(index_js_5.RELEASE_ROLLOUT_PLAN_ID_PATTERN_SOURCE);
 exports.BLUEPRINT_TRUST_AUTHORITY_PATH = 'tools/blueprint-trust-check.mjs';
@@ -172,6 +173,49 @@ const TOOL_VERSIONS = {
 function json(value) {
     return `${JSON.stringify(value, null, 2)}\n`;
 }
+function indentWorkflowScript(source, spaces) {
+    const prefix = ' '.repeat(spaces);
+    return source
+        .trim()
+        .split('\n')
+        .map((line) => `${prefix}${line}`)
+        .join('\n');
+}
+function protectedSecretPolicyDerivationScript() {
+    return `node --input-type=module <<'NODE'
+import { appendFileSync } from 'node:fs';
+import {
+  configuredDeploymentAccountTopology,
+  configuredDeploymentRegion,
+  isActiveDeploymentStage,
+  readRepositoryOperatingPolicy,
+} from '@empire-builder-kit/nx/repository-policy';
+
+const output = process.env.GITHUB_OUTPUT?.trim() ?? '';
+const renderedProfile = process.env.EBK_RENDERED_PROFILE?.trim() ?? '';
+const stage = process.env.EBK_STAGE?.trim() ?? '';
+if (!output) throw new Error('Secret workflow authority output is unavailable.');
+const policy = readRepositoryOperatingPolicy(process.cwd());
+if (policy.deploymentProfile !== renderedProfile) {
+  throw new Error('Generated and committed deployment profiles differ.');
+}
+if (!isActiveDeploymentStage(policy.deploymentProfile, stage)) {
+  throw new Error('Secret workflow stage is inactive for the committed deployment profile.');
+}
+const accounts = configuredDeploymentAccountTopology(
+  policy.deploymentProfile,
+  policy.deploymentAccounts,
+);
+const region = configuredDeploymentRegion(policy.deploymentRegion);
+appendFileSync(output, [
+  'deployment_region=' + region,
+  'development_account_id=' + accounts.development,
+  'staging_account_id=' + (accounts.staging ?? ''),
+  'production_account_id=' + accounts.production,
+  '',
+].join('\\n'));
+NODE`;
+}
 function planApplicationBindingCheck() {
     return `          node - <<'NODE'
           const declared = JSON.parse(process.env.AWS_PLAN_SST_APPS_JSON ?? '');
@@ -1015,6 +1059,8 @@ const WORKSPACE_SEEDED_PATHS = new Set([
     'docs/architecture.md',
     'docs/git-workflow.md',
     'docs/repository-operating-policy.md',
+    'docs/stage-deployment-authority.md',
+    'docs/workspace-deployment-ownership.md',
     'docs/work-markers.md',
     'ebk.repository-policy.json',
 ]);
@@ -1042,14 +1088,13 @@ exports.WORKSPACE_PROJECT_MANAGED_JSON_POINTERS = [
     '/targets/dev-setup',
     '/targets/github-bootstrap',
     '/targets/install-git-hooks',
+    '/targets/stage-authority-render',
     '/targets/supply-chain-check',
     '/targets/supply-chain-check-protected',
     '/targets/supply-chain-scan',
     '/targets/verify',
     '/targets/verify-proposed',
     '/targets/work-markers',
-    '/targets/workload-role-candidate-report',
-    '/targets/workload-role-provisioner-build',
     '/targets/workspace-health',
 ];
 const FOUNDATION_SEEDED_PATHS = new Set([
@@ -1124,7 +1169,20 @@ function createWorkspaceOwnership(files, frameworkVersion) {
 function renderWorkspaceFiles(options) {
     const { frameworkVersion, name } = options;
     const deploymentProfile = options.deploymentProfile ?? 'starter';
-    const initialRepositoryPolicy = (0, index_js_4.createIncubationRepositoryPolicy)(deploymentProfile);
+    const activeStages = (0, index_js_4.activeDeploymentStages)(deploymentProfile);
+    const protectedWorkflowStageChoices = deploymentProfile === 'starter'
+        ? 'development, production'
+        : deploymentProfile === 'production-isolated'
+            ? 'production'
+            : 'staging, production';
+    const ecrInspectorWorkflowStageChoices = deploymentProfile === 'starter'
+        ? 'production'
+        : protectedWorkflowStageChoices;
+    const rehearsalStage = (0, index_js_4.productionRehearsalStage)(deploymentProfile);
+    const protectedWorkflowStageBranchCases = `${rehearsalStage}:refs/heads/develop|production:refs/heads/main`;
+    const workspaceDeploymentId = options.workspaceDeploymentId ??
+        `ebkws-${(0, index_js_1.hashGeneratedContent)(`workspace-deployment-id:${name}`).slice(0, 32)}`;
+    const initialRepositoryPolicy = (0, index_js_4.createIncubationRepositoryPolicy)(deploymentProfile, workspaceDeploymentId);
     initialRepositoryPolicy.deploymentAccounts = options.deploymentAccounts ?? {
         development: null,
         production: null,
@@ -1367,6 +1425,7 @@ jobs:
           include-hidden-files: true
           retention-days: 30
           path: .ebk/evidence/release-candidate
+${(0, workspace_files_thin_deploy_js_1.renderThinDeployVerifyCaller)(deploymentProfile)}
 `,
         '.github/workflows/deploy.yml': `name: Deploy
 
@@ -3876,7 +3935,7 @@ on:
         description: Exact protected deployment stage
         required: true
         type: choice
-        options: [staging, production]
+        options: [${ecrInspectorWorkflowStageChoices}]
       deployment_commit:
         description: Exact successful protected deployment commit
         required: true
@@ -3885,8 +3944,8 @@ on:
         description: Exact successful Deploy workflow run ID
         required: true
         type: string
-      release_artifact_name:
-        description: Exact release-evidence artifact from that run
+      deployment_receipt_artifact_name:
+        description: Exact deployment-receipt artifact from that run
         required: true
         type: string
       slice:
@@ -3940,7 +3999,7 @@ jobs:
       EBK_DEPLOYMENT_ARN: \${{ inputs.deployment_arn }}
       EBK_DEPLOYMENT_KIND: \${{ inputs.deployment_kind }}
       EBK_DEPLOY_RUN_ID: \${{ inputs.deploy_run_id }}
-      EBK_RELEASE_ARTIFACT_NAME: \${{ inputs.release_artifact_name }}
+      EBK_DEPLOYMENT_RECEIPT_ARTIFACT_NAME: \${{ inputs.deployment_receipt_artifact_name }}
       EBK_SLICE: \${{ inputs.slice }}
       EBK_DEPLOYMENT_COMMIT: \${{ inputs.deployment_commit }}
       EBK_STAGE: \${{ inputs.stage }}
@@ -3963,10 +4022,10 @@ jobs:
           esac
           expected_branch=develop
           if [ "$EBK_STAGE" = production ]; then expected_branch=main; fi
-          expected_artifact="release-evidence-$EBK_STAGE-$EBK_DEPLOY_RUN_ID-"
-          case "$EBK_RELEASE_ARTIFACT_NAME" in
-            "$expected_artifact"*) attempt="\${EBK_RELEASE_ARTIFACT_NAME#"$expected_artifact"}" ;;
-            *) echo 'Release evidence artifact does not bind the exact deploy run'; exit 1 ;;
+          expected_artifact="deployment-receipt-$EBK_STAGE-$EBK_DEPLOY_RUN_ID-"
+          case "$EBK_DEPLOYMENT_RECEIPT_ARTIFACT_NAME" in
+            "$expected_artifact"*) attempt="\${EBK_DEPLOYMENT_RECEIPT_ARTIFACT_NAME#"$expected_artifact"}" ;;
+            *) echo 'Deployment receipt artifact does not bind the exact deploy run'; exit 1 ;;
           esac
           case "$attempt" in
             ''|0*|*[!0-9]*) echo 'Release evidence artifact has an invalid run attempt'; exit 1 ;;
@@ -3979,7 +4038,7 @@ jobs:
             test "$(printf '%s' "$run" | jq -r .path)" = ".github/workflows/deploy.yml" ||
             { echo 'Deploy run is not the exact successful protected source authority'; exit 1; }
           artifacts="$(gh api "/repos/$GH_REPO/actions/runs/$EBK_DEPLOY_RUN_ID/artifacts?per_page=100")"
-          count="$(printf '%s' "$artifacts" | jq --arg name "$EBK_RELEASE_ARTIFACT_NAME" \
+          count="$(printf '%s' "$artifacts" | jq --arg name "$EBK_DEPLOYMENT_RECEIPT_ARTIFACT_NAME" \
             '[.artifacts[] | select(.name == $name and .expired == false)] | length')"
           test "$count" = 1 ||
             { echo 'Exact unexpired release evidence artifact is absent or ambiguous'; exit 1; }
@@ -3996,7 +4055,7 @@ jobs:
       - uses: ${downloadArtifactAction}
         with:
           github-token: \${{ github.token }}
-          name: \${{ inputs.release_artifact_name }}
+          name: \${{ inputs.deployment_receipt_artifact_name }}
           path: .
           run-id: \${{ inputs.deploy_run_id }}
       - uses: ${pnpmAction}
@@ -4103,7 +4162,7 @@ jobs:
                       { encoding: "utf8" },
                     ).trim()
                   ) fail("Production deployment tree differs from its reviewed release source.");
-                } else if (stage !== "staging") {
+                } else if (stage !== "${rehearsalStage}") {
                   fail("Protected release stage is invalid.");
                 }
                 const productionKeys = [
@@ -4159,7 +4218,7 @@ jobs:
                   !digest.test(binding.candidateDigest ?? "") ||
                   (stage === "production" &&
                     !digest.test(binding.lifecycleDigest ?? "")) ||
-                  (stage === "staging" && binding.stage !== stage) ||
+                  (stage === "${rehearsalStage}" && binding.stage !== stage) ||
                   binding.runId !== process.env.EBK_DEPLOY_RUN_ID ||
                   binding.runAttempt !== process.env.EBK_DEPLOY_RUN_ATTEMPT ||
                   binding.workflow !== expectedWorkflow
@@ -4238,7 +4297,7 @@ on:
         description: Protected deployed stage
         required: true
         type: choice
-        options: [staging, production]
+        options: [${protectedWorkflowStageChoices}]
       project:
         description: Exact Product Slice project
         required: true
@@ -4338,7 +4397,7 @@ jobs:
           EBK_REPORT_RUN_ID: \${{ inputs.report_run_id }}
         run: |
           case "$EBK_STAGE:$EBK_PROTECTED_REF" in
-            staging:refs/heads/develop|production:refs/heads/main) ;;
+            ${protectedWorkflowStageBranchCases}) ;;
             *) echo 'Async recovery stage does not match its protected branch'; exit 1 ;;
           esac
           case "$EBK_PROJECT" in
@@ -5190,27 +5249,26 @@ jobs:
           );
           NODE
       - id: classify
-        name: Require one successful staging deployment job
+        name: Require one successful thin staging deployment job
         env:
           EBK_DEPLOYMENT_PROFILE: \${{ steps.profile.outputs.profile }}
           EBK_DEPLOYMENT_RUN_ID: \${{ github.event.workflow_run.id }}
           GH_TOKEN: \${{ github.token }}
           GH_REPO: \${{ github.repository }}
         run: |
+          if [ "$EBK_DEPLOYMENT_PROFILE" = starter ]; then
+            echo 'deployed=false' >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
           jobs="$(gh api \
             "/repos/$GH_REPO/actions/runs/$EBK_DEPLOYMENT_RUN_ID/jobs?filter=latest&per_page=100")"
-          apply_count="$(printf '%s' "$jobs" | jq \
-            '[.jobs[] | select(.name | startswith("${stagingApplyJobPrefix}")) | select(.conclusion == "success")] | length')"
-          route_success_count="$(printf '%s' "$jobs" | jq \
-            '[.jobs[] | select(.name == "${protectedDeploymentRouteJobName}" and .conclusion == "success")] | length')"
-          route_skipped_count="$(printf '%s' "$jobs" | jq \
-            '[.jobs[] | select(.name == "${protectedDeploymentRouteJobName}" and .conclusion == "skipped")] | length')"
-          case "$apply_count:$route_success_count:$route_skipped_count:$EBK_DEPLOYMENT_PROFILE" in
-            1:1:0:*) echo 'deployed=true' >> "$GITHUB_OUTPUT" ;;
-            0:0:1:*) echo 'deployed=false' >> "$GITHUB_OUTPUT" ;;
-            0:1:0:starter) echo 'deployed=false' >> "$GITHUB_OUTPUT" ;;
-            *) echo 'Deploy route and staging application evidence disagree'; exit 1 ;;
-          esac
+          execute_count="$(printf '%s' "$jobs" | jq \
+            '[.jobs[] | select(.name == "native deploy staging" and .conclusion == "success")] | length')"
+          [ "$execute_count" = 1 ] || {
+            echo 'Deploy must contain exactly one successful thin staging execution'
+            exit 1
+          }
+          echo 'deployed=true' >> "$GITHUB_OUTPUT"
 
   plan:
     needs: deployment-classification
@@ -7093,7 +7151,7 @@ on:
         description: Protected stage
         required: true
         type: choice
-        options: [staging, production]
+        options: [${protectedWorkflowStageChoices}]
       project:
         description: Exact Product Slice project
         required: true
@@ -7119,11 +7177,9 @@ jobs:
       contents: read
       id-token: write
     env:
-      AWS_DEPLOY_ROLE_ARN: \${{ secrets.AWS_DEPLOY_ROLE_ARN }}
-      AWS_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_EXPECTED_ACCOUNT_ID }}
-      AWS_REGION: \${{ vars.AWS_REGION }}
       EBK_ACTION: \${{ inputs.action }}
       EBK_PROJECT: \${{ inputs.project }}
+      EBK_RENDERED_PROFILE: ${deploymentProfile}
       EBK_STAGE: \${{ inputs.stage }}
     runs-on: ubuntu-latest
     steps:
@@ -7132,19 +7188,12 @@ jobs:
           EBK_PROTECTED_REF: \${{ github.ref }}
         run: |
           case "$EBK_STAGE:$EBK_PROTECTED_REF" in
-            staging:refs/heads/develop|production:refs/heads/main) ;;
+            ${protectedWorkflowStageBranchCases}) ;;
             *) echo 'Secret metadata stage does not match the protected branch'; exit 1 ;;
           esac
           case "$EBK_PROJECT" in
             ''|-*|*-|*[!a-z0-9-]*) echo 'Secret metadata project must be an exact normalized Slice name'; exit 1 ;;
           esac
-          test -n "$AWS_DEPLOY_ROLE_ARN" || { echo "$EBK_STAGE AWS_DEPLOY_ROLE_ARN is required"; exit 1; }
-          test -n "$AWS_EXPECTED_ACCOUNT_ID" || { echo "$EBK_STAGE AWS_EXPECTED_ACCOUNT_ID is required"; exit 1; }
-          test -n "$AWS_REGION" || { echo "$EBK_STAGE AWS_REGION is required"; exit 1; }
-          case "$AWS_DEPLOY_ROLE_ARN" in
-            arn:aws:iam::$AWS_EXPECTED_ACCOUNT_ID:role/*) ;;
-            *) echo 'Secret metadata role does not belong to the expected account'; exit 1 ;;
-          esac
       - uses: ${checkoutAction}
         with:
           persist-credentials: false
@@ -7156,18 +7205,147 @@ jobs:
       - run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
       - name: Verify managed workspace integrity before AWS authority
         run: pnpm nx run ${name}:workspace-health
+      - id: policy
+        name: Derive committed secret metadata stage policy
+        run: |
+${indentWorkflowScript(protectedSecretPolicyDerivationScript(), 10)}
+      - id: authority
+        name: Derive canonical committed stage authority
+        env:
+          EBK_DEVELOPMENT_ACCOUNT: \${{ steps.policy.outputs.development_account_id }}
+          EBK_PRODUCTION_ACCOUNT: \${{ steps.policy.outputs.production_account_id }}
+          EBK_REGION: \${{ steps.policy.outputs.deployment_region }}
+          EBK_STAGING_ACCOUNT: \${{ steps.policy.outputs.staging_account_id }}
+        run: |
+${indentWorkflowScript(`set -euo pipefail\n${(0, workspace_files_thin_deploy_js_1.canonicalStageAuthorityDerivationScript)()}`, 10)}
       - uses: ${configureAwsAction}
         with:
-          role-to-assume: \${{ secrets.AWS_DEPLOY_ROLE_ARN }}
+          audience: \${{ steps.authority.outputs.audience }}
+          role-to-assume: \${{ steps.authority.outputs.role_arn }}
           role-session-name: ebk-secret-metadata-\${{ github.run_id }}-\${{ github.run_attempt }}
-          aws-region: \${{ vars.AWS_REGION }}
-      - name: Verify assumed account
-        run: test "$(aws sts get-caller-identity --query Account --output text)" = "$AWS_EXPECTED_ACCOUNT_ID"
+          aws-region: \${{ steps.policy.outputs.deployment_region }}
+      - name: Verify exact stage authority
+        env:
+          AWS_DEPLOY_ROLE_ARN: \${{ steps.authority.outputs.role_arn }}
+          AWS_PARTITION: \${{ steps.authority.outputs.partition }}
+          EBK_POLICY_ACCOUNT_ID: \${{ steps.authority.outputs.account_id }}
+        run: |
+${indentWorkflowScript((0, workspace_files_thin_deploy_js_1.exactStageDeployerGuardScript)('Secret metadata', '$EBK_POLICY_ACCOUNT_ID'), 10)}
       - name: Reconcile value-blind metadata
+        env:
+          AWS_DEPLOY_ROLE_ARN: \${{ steps.authority.outputs.role_arn }}
+          AWS_EXPECTED_ACCOUNT_ID: \${{ steps.authority.outputs.account_id }}
+          AWS_REGION: \${{ steps.policy.outputs.deployment_region }}
         run: |
           args=("--stage=$EBK_STAGE" "--region=$AWS_REGION")
           if [ "$EBK_ACTION" = apply ]; then args+=("--apply"); fi
           pnpm nx run "$EBK_PROJECT:secret-metadata" -- "\${args[@]}"
+`,
+        '.github/workflows/secret-initialize.yml': `name: Secret initialize
+
+on:
+  workflow_dispatch:
+    inputs:
+      stage:
+        description: Protected stage
+        required: true
+        type: choice
+        options: [${protectedWorkflowStageChoices}]
+      project:
+        description: Exact Product Slice project
+        required: true
+        type: string
+      logical_name:
+        description: Exact machine-generated secret logical name
+        required: true
+        type: string
+      action:
+        description: Value-blind initialization action
+        required: true
+        default: report
+        type: choice
+        options: [report, apply]
+
+concurrency:
+  group: secret-initialize-\${{ inputs.stage }}-\${{ inputs.project }}-\${{ inputs.logical_name }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  initialize:
+    environment: \${{ inputs.stage }}
+    permissions:
+      contents: read
+      id-token: write
+    env:
+      EBK_ACTION: \${{ inputs.action }}
+      EBK_LOGICAL_NAME: \${{ inputs.logical_name }}
+      EBK_PROJECT: \${{ inputs.project }}
+      EBK_RENDERED_PROFILE: ${deploymentProfile}
+      EBK_STAGE: \${{ inputs.stage }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Validate protected request
+        env:
+          EBK_PROTECTED_REF: \${{ github.ref }}
+        run: |
+          case "$EBK_STAGE:$EBK_PROTECTED_REF" in
+            ${protectedWorkflowStageBranchCases}) ;;
+            *) echo 'Secret initialize stage does not match the protected branch'; exit 1 ;;
+          esac
+          case "$EBK_PROJECT" in
+            ''|-*|*-|*[!a-z0-9-]*) echo 'Secret initialize project must be an exact normalized Slice name'; exit 1 ;;
+          esac
+          [[ "$EBK_LOGICAL_NAME" =~ ^[A-Za-z][A-Za-z0-9]{0,63}$ ]] ||
+            { echo 'Secret initialize logical name is invalid'; exit 1; }
+      - uses: ${checkoutAction}
+        with:
+          persist-credentials: false
+      - uses: ${pnpmAction}
+      - uses: ${setupNodeAction}
+        with:
+          node-version: ${tool_versions_js_1.WORKSPACE_NODE_VERSION}
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
+      - name: Verify managed workspace integrity before AWS authority
+        run: pnpm nx run ${name}:workspace-health
+      - id: policy
+        name: Derive committed secret initialize stage policy
+        run: |
+${indentWorkflowScript(protectedSecretPolicyDerivationScript(), 10)}
+      - id: authority
+        name: Derive canonical committed stage authority
+        env:
+          EBK_DEVELOPMENT_ACCOUNT: \${{ steps.policy.outputs.development_account_id }}
+          EBK_PRODUCTION_ACCOUNT: \${{ steps.policy.outputs.production_account_id }}
+          EBK_REGION: \${{ steps.policy.outputs.deployment_region }}
+          EBK_STAGING_ACCOUNT: \${{ steps.policy.outputs.staging_account_id }}
+        run: |
+${indentWorkflowScript(`set -euo pipefail\n${(0, workspace_files_thin_deploy_js_1.canonicalStageAuthorityDerivationScript)()}`, 10)}
+      - uses: ${configureAwsAction}
+        with:
+          audience: \${{ steps.authority.outputs.audience }}
+          role-to-assume: \${{ steps.authority.outputs.role_arn }}
+          role-session-name: ebk-secret-initialize-\${{ github.run_id }}-\${{ github.run_attempt }}
+          aws-region: \${{ steps.policy.outputs.deployment_region }}
+      - name: Verify exact stage authority
+        env:
+          AWS_DEPLOY_ROLE_ARN: \${{ steps.authority.outputs.role_arn }}
+          AWS_PARTITION: \${{ steps.authority.outputs.partition }}
+          EBK_POLICY_ACCOUNT_ID: \${{ steps.authority.outputs.account_id }}
+        run: |
+${indentWorkflowScript((0, workspace_files_thin_deploy_js_1.exactStageDeployerGuardScript)('Secret initialize', '$EBK_POLICY_ACCOUNT_ID'), 10)}
+      - name: Initialize machine-generated secret value-blind
+        env:
+          AWS_DEPLOY_ROLE_ARN: \${{ steps.authority.outputs.role_arn }}
+          AWS_EXPECTED_ACCOUNT_ID: \${{ steps.authority.outputs.account_id }}
+          AWS_REGION: \${{ steps.policy.outputs.deployment_region }}
+        run: |
+          args=("--logicalName=$EBK_LOGICAL_NAME" "--stage=$EBK_STAGE" "--region=$AWS_REGION")
+          if [ "$EBK_ACTION" = apply ]; then args+=("--apply"); fi
+          pnpm nx run "$EBK_PROJECT:secret-initialize" -- "\${args[@]}"
 `,
         '.github/workflows/sync-back.yml': `name: Sync protected main history
 
@@ -7457,9 +7635,10 @@ infrastructure or protected deployment policy. Preserve the ownership boundary r
 \`.ebk/ownership.json\`: managed files belong to EBK, seeded files are generated starting
 points that adopters may change, and unrecorded files are adopter-owned.
 
-Secret values are a human-only TTY ceremony. Agents and CI must never invoke
-\`ebk secret set\` or \`ebk secret remove\`; they may use only value-blind
-metadata, status, and verification commands.
+Human-supplied secret values are a human-only TTY ceremony. Agents and CI must
+never invoke \`ebk secret set\` or \`ebk secret remove\`. They may use
+value-blind metadata, status, verification, and the exact generated-secret
+initializer, which accepts and returns no plaintext value.
 
 ## Work markers
 
@@ -7519,50 +7698,6 @@ export default tseslint.config(
     rules: { 'no-console': 'error' },
   },
 );
-`,
-        'README.md': `# ${name}
-
-This workspace was created with Empire Builder Kit v1.
-
-## Start here
-
-1. Review \`docs/architecture.md\`.
-2. Review the generated Foundation before deploying it.
-3. Add product slices through the Empire Builder Kit Nx plugin.
-4. Review \`docs/repository-operating-policy.md\` and \`docs/git-workflow.md\` before enabling production.
-5. Read \`AGENTS.md\` and \`docs/work-markers.md\` before assigning generated customization work to agents.
-
-For one-origin fleet development, initialize the workspace-pinned CLI once with
-\`ebk dev configure --profile=<bounded-development-profile>\`, inspect the certificate reported
-by \`ebk dev setup\`, and then explicitly approve \`ebk dev setup --trust\`. The supported v1
-origin uses the complete explicit-port HTTPS URL reported at startup; optional
-\`--portless\` setup is experimental. \`ebk dev doctor\` requires a real exact-host TLS
-handshake for trust and connectivity readiness, and reports portless access ready
-only after a live port-443 probe. Complete
-\`aws sso login --profile <bounded-development-profile>\`, then start selected Slices with
-\`ebk dev up billing accounts\`. The CLI derives the personal stage from the operating-system
-account, reads the saved profile and Region, propagates that AWS context to child Slices, and
-uses SST \`mono\` mode so agents and non-cursor-addressable terminals receive ordinary logs.
-Use \`ebk dev status\`, \`ebk dev logs\`, \`ebk dev tail\`, \`ebk dev restart\`,
-\`ebk dev down\`, and \`ebk dev doctor\` without supplying a stage. Setup, doctor, and the
-managed root Fleet target remain internal Nx-backed implementation surfaces; \`ebk dev\` is the
-framework-local development interface. For the development namespace, if the shell does not
-expose workspace binaries, \`pnpm exec ebk dev ...\` only locates the workspace-pinned binary;
-it is not another framework command surface. Protected Blueprint receipt review must instead
-use the direct installed \`.bin/ebk blueprint verification-review\` entry documented in
-\`docs/blueprints.md\`.
-
-Workspace creation only writes source files. It does not create or change cloud resources.
-
-New workspaces default to the one-account \`starter\` deployment profile. Configure the exact
-shared account and Region in \`ebk.repository-policy.json\`, authenticate through IAM Identity
-Center, add exact development and staging CIDRs to
-\`packages/foundation/security/router-waf.json\`, and use
-\`pnpm nx run ${name}:deploy-local -- --stage=development
---profile=<profile> --expectedRoleArn=<role-arn>\`. Never invoke SST directly.
-For a brand-new stage with generated Product Slices, complete the documented workload-role
-Foundation publication and pass \`--phase=foundation-bootstrap\` once before publishing and
-deploying the complete stage.
 `,
         'docs/architecture.md': `# Workspace architecture
 
@@ -7576,347 +7711,15 @@ The Standard Foundation lives at \`packages/foundation\`. Product slices live be
 \`packages/<slice-name>\` and consume versioned Foundation contracts instead of importing
 Foundation implementation files.
 
-Canonical consumer stages use the matching \`development\`, \`staging\`, or \`production\`
-Foundation. Framework-derived personal stages may use only the \`development\`
-Foundation; generic preview stages are unsupported.
+This workspace's \`${deploymentProfile}\` profile activates only:
+${activeStages.join(', ')}. Each active canonical consumer stage uses the matching Foundation.
+Inactive canonical stages are rejected. Framework-derived personal stages may use only the
+\`development\` Foundation; generic preview stages are unsupported.
 
-The committed deployment profile changes account and local/GitHub authority only. Every
-canonical stage always owns a separate Router/domain, Aurora cluster and migration history,
+Every active canonical stage owns a separate Router/domain, Aurora cluster and migration history,
 Cognito user pool, event bus, secret namespace, IAM boundary, logs, queues, ECR namespace, and
-stage-qualified SSM discovery contract. Discovery rejects a record for another canonical stage.
-`,
-        'docs/git-workflow.md': `# Protected Git workflow
-
-Ordinary work starts from \`develop\` and returns through a reviewed pull request to
-\`develop\`. A production promotion is exactly \`develop\` to \`main\`. After production,
-review and merge the managed \`main\` to \`develop\` sync-back pull request before ordinary
-work resumes.
-
-Both protected branches require the stable \`policy\` and \`verify\` checks, one approving
-review including an approval from the committed catch-all CODEOWNER and someone other than the
-most recent pusher, dismissed stale reviews, resolved conversations, and merge commits. Replace
-the placeholder in \`.github/CODEOWNERS\` with a GitHub user or team that has repository access
-before bootstrap. An approval from \`github-actions[bot]\` cannot satisfy the independent
-code-owner gate; the Actions repository setting is needed to create the managed sync-back pull
-request, not to approve it.
-Direct updates, force pushes, deletion, squash merging, and rebase merging are prohibited.
-GitHub rulesets, environments, and AWS IAM are the authorization boundaries; local hooks are
-only defense in depth.
-
-The \`staging\` environment accepts only \`develop\`; \`production\` accepts only \`main\`.
-These workflows exist for every deployment profile. The staging workflow is optional for
-\`starter\`, whose governed local Nx target may deploy development and staging. Production is
-GitHub-only for every profile; \`fully-isolated\` also requires GitHub for staging.
-The committed \`productionApproval.mode\` selects one of two production authorization
-contracts:
-
-- \`promotion-pr\` is compatible with private repositories on GitHub Team. The required
-  non-author CODEOWNER approval on the exact \`develop\` to \`main\` promotion pull request
-  is the production authorization. Merging that pull request starts production deployment;
-  there is no second EBK-managed environment approval or wait timer. The approver may also be
-  the human whose merge triggers deployment. Roll back through a reviewed revert on the
-  protected branches and let the resulting \`main\` push redeploy. A repository write actor who
-  can run Actions may also manually dispatch \`deploy\`, \`refresh\`, or \`unlock\` against the
-  already approved \`main\` tip without another human gate. That residual cannot introduce
-  unreviewed source; production \`remove\` remains separately variable-gated. Restrict write and
-  Actions access, audit dispatches, or select \`environment-reviewer\` when every production
-  action needs separate approval.
-- \`environment-reviewer\` adds a separate production environment reviewer with self-review
-  prevention. A private repository needs GitHub Enterprise capability for this mode. Bootstrap
-  inspects that capability and fails closed on an unsupported plan; it never silently changes
-  the committed mode.
-
-Both modes retain required checks, a non-author CODEOWNER approval, no ruleset bypass, the
-literal production environment, and its branch-scoped credentials. The base \`staging\` and
-\`production\` environments own deployment, smoke, and ECR evidence roles plus their
-variables; isolated profiles also keep the staging-registry promotion pull role in production.
-Starter promotion authenticates once to the shared account and copies the exact staging digest
-into a distinct production ECR repository. Dedicated
-\`infrastructure-plan-<stage>\` environments gate read-only role use. Separate
-\`async-recovery-<stage>\`, \`performance-aggregate-<stage>\`,
-\`performance-cost-<stage>\`, \`performance-load-<stage>\`, and
-\`reliability-read-<stage>\` environments own only the role and variables required by that
-capability. Infrastructure-plan jobs use a repository-variable read-only role/input inventory;
-an independent clean audit job assumes that exact environment-subject role and verifies its
-trust and complete inline policy before any repository-backed plan job may assume it. Plan-role
-trust uses GitHub's immutable repository identity subject,
-\`repo:<owner>@<owner-id>/<repository>@<repository-id>:environment:<environment>\`.
-The audit derives it from the workflow's repository name, owner ID, repository ID, and literal
-environment and refuses missing IDs or the older mutable name-only subject. Update every
-adopter-owned AWS OIDC role trust to the immutable identity before protected use; never retain
-both forms. Every
-\`*-staging\` environment accepts only \`develop\`; every
-\`*-production\` environment accepts only \`main\`; reviewer, self-review, and wait protection
-matches the corresponding base stage. The credential-free \`npm-prerelease\` environment
-accepts only \`main\` and contains no secrets or variables. In Team-compatible
-\`promotion-pr\` mode, protected-main review plus the exact current-main tag binding is
-publication authorization, so it has no reviewer or wait rule. In
-\`environment-reviewer\` mode it mirrors production protection. Never add repository- or
-organization-visible fallbacks for protected values. Keep repository default workflow
-permissions read-only; generated jobs request only the additional permissions they need.
-
-\`EBK_FLEET_ORIGIN\` is the sole protected deployment and smoke origin. Read-only plan jobs
-enter only their dedicated \`infrastructure-plan-<stage>\` environment; their stage-named
-repository variables \`EBK_STAGING_FLEET_ORIGIN\` and
-\`EBK_PRODUCTION_FLEET_ORIGIN\` remain plan inputs only. Before mutation, each
-base-environment-protected deployment requires
-its \`EBK_FLEET_ORIGIN\` to equal the origin retained by the plan.
-
-\`AWS_ASYNC_RECOVERY_ROLE_ARN\` is a separate mutation role. Trust only this
-repository's exact \`async-recovery-<stage>\` GitHub OIDC subject and grant only
-the recovery operations/resources declared by generated capability adapters.
-
-\`AWS_PERFORMANCE_LOAD_ROLE_ARN\` is a separate read-only OIDC role. Trust only
-this repository's exact \`performance-load-<stage>\` GitHub OIDC subject.
-Set that environment's \`EBK_PERFORMANCE_ORIGINS_JSON\` to a JSON object that
-maps every reviewed Slice to the exact \`performanceEndpoint\` emitted by its
-current deployment; never copy the map to repository scope or substitute the
-fleet web origin. The workflow selects only its requested Slice, and the
-committed load plan must name that same origin and exact reserved Slice path.
-Grant \`sts:GetCallerIdentity\` and \`secretsmanager:GetSecretValue\` only on
-\`arn:<partition>:secretsmanager:<region>:<account>:secret:ebk/<stage>/<slice>/*\` for
-reviewed Slices. Do not grant secret writes, deployment, CloudFormation, SST,
-or CloudWatch Logs access. The protected workflow never logs or uploads HMAC
-material and removes its new job-scoped 0600 file after cleanup.
-Bootstrap verifies environment-only secret placement, not the role's hidden
-AWS trust or permission policy.
-
-\`AWS_PERFORMANCE_AGGREGATE_ROLE_ARN\` is a separate adopter-owned read-only
-OIDC role. Trust only this repository's exact
-\`performance-aggregate-<stage>\` GitHub OIDC subject. Grant
-\`sts:GetCallerIdentity\` plus only the exact data-read actions and resource
-ARNs required by the adopted \`performance/aggregate-count-provider.ts\`.
-Do not grant writes, deployment, CloudFormation, SST, IAM, Cost Explorer, or
-unrelated data access. The generated workflow validates the protected Deploy
-artifact before role assumption, verifies the STS account and environment
-Region, withholds the OIDC bearer, and clears the AWS session before artifact
-retention. Bootstrap verifies environment-only secret placement, not the
-role's hidden AWS trust or least-privilege permission policy.
-
-\`AWS_PERFORMANCE_COST_ROLE_ARN\` is a separate read-only OIDC role. Trust only
-this repository's exact \`performance-cost-<stage>\` GitHub OIDC subject.
-Grant only \`sts:GetCallerIdentity\`, \`ce:ListCostAllocationTags\`, and
-\`ce:GetCostAndUsage\`; Cost Explorer
-queries are account-global, while the retained evidence still binds the
-selected resource Region. Do not grant budget, anomaly-monitor, tag, billing,
-deployment, CloudFormation, SST, or other mutation authority. Bootstrap verifies
-environment-only secret placement, not the role's hidden AWS trust or
-permission policy.
-
-The framework manages
-\`.github/workflows/performance-aggregate-counts.yml\`, its exact Deploy
-binding, evidence wrapper, artifact name, and canonical schema. The seeded
-\`performance/aggregate-count-provider.ts\` remains adopter-owned and fails
-closed until it returns only the reviewed business counts and provider request
-reference. The provider runs only with the dedicated aggregate-read role after
-the framework validates the exact protected release and STS account. The
-workflow binds those untrusted counts to the environment-owned account/Region,
-closed period, exact current protected release, Slice, stage, and workspace
-and records the dedicated OIDC access mode and adopter-owned least-privilege
-read contract before it emits the single
-\`aggregate-count-<stage>-<slice>-<run>-<attempt>\` artifact. The framework
-does not invent counts or copy them from request-level dimensions.
-
-\`performance-cost-actual.yml\` treats supplied run IDs and artifact names only
-as selectors. Before OIDC it queries GitHub for the fixed aggregate workflow
-and generated \`Deploy\` workflow runs, requiring the same repository,
-candidate, protected branch, successful conclusion, allowed event, exact
-workflow name/path, and one exact nonexpired artifact. It derives the compact
-performance release binding from that Deploy artifact and separately verifies
-the independently approved aggregate-count and release-binding byte digests.
-
-\`AWS_RELIABILITY_READ_ROLE_ARN\` is a separate read-only OIDC role. Trust only
-this repository's exact \`reliability-read-<stage>\` GitHub OIDC subject.
-Grant \`sts:GetCallerIdentity\`, \`cloudwatch:DescribeAlarms\`,
-\`cloudwatch:DescribeAlarmHistory\`, \`cloudwatch:GetMetricData\`,
-\`ecs:DescribeServices\`, and \`states:DescribeExecution\`. Scope ECS and Step
-Functions resources to the reviewed Slice services, state machines, and
-executions wherever IAM supports resource-level constraints. Do not grant log
-reads, deployment, CloudFormation, SST, or any AWS mutation.
-
-The generated \`reliability-read.yml\` workflow selects the newest nonexpired
-binding artifact from a successful deployed-smoke run, reconciles it to the
-current successful protected deployment, and checks out that exact commit
-before assuming the role. Callers choose only a bounded operation and workload;
-they cannot supply the AWS account, Region, role, or binding path. The binding
-allowlists exact alarm names, API ID, ECS services, and Step Functions
-resources before the adapter makes a service call. Bootstrap verifies
-environment-only secret placement, not the role's hidden AWS trust or
-permission policy.
-
-The async-recovery, performance-load, performance-cost, and reliability-read
-jobs have job-scoped \`id-token: write\`. They install the frozen dependency
-graph with lifecycle scripts and pnpm hooks disabled before assuming AWS
-authority. Immediately after the one pinned credential action, they blank the
-OIDC request URL and bearer for future steps and explicitly shadow both values
-empty on every later step. After bounded AWS use, they blank current AWS
-credential variables before evidence upload. This withholds credentials from
-later processes; it does not claim that GitHub revokes the job-level
-permission.
-
-\`AWS_SMOKE_ROLE_ARN\` is separate from deployment authority. Trust only this
-repository's GitHub OIDC subject for the matching protected environment. Grant
-only run-scoped Cognito principal setup/cleanup on reviewed user-pool ARNs and
-\`logs:FilterLogEvents\` on exact
-\`/ebk/<stage>/<slice>/event-consumer\` log-group ARNs. Do not grant
-CloudFormation, SST mutation, broad Logs query, \`GetLogEvents\`,
-\`StartQuery\`, or \`logs:Unmask\`. Bootstrap verifies environment-only secret
-inventory but never creates or reads the secret, materializes the role, or
-attests its hidden policy.
-
-Run the GitHub bootstrap in report mode first. Source upgrades never alter remote GitHub
-settings. Apply a reviewed report only after \`develop\` exists and the candidate's exact
-\`policy\` and \`verify\` check contexts have run.
-
-Set \`GH_REPO=<owner>/<repository>\` and a suitable \`GH_TOKEN\`, then run
-\`pnpm nx run ${name}:github-bootstrap\`. Review the deterministic report before rerunning
-with \`--apply\`. The command never creates branches, credentials, secrets, or AWS resources.
-Supply \`--npmPrereleaseReviewerIds=<id,...>\` only in
-\`environment-reviewer\` mode when intentionally setting a distinct npm
-mutation reviewer set.
-Supply \`--productionReviewerIds=<id,...>\` only when committed policy selects
-\`environment-reviewer\`; it is rejected in \`promotion-pr\` mode.
-
-Install the optional defense-in-depth pre-push hook explicitly with
-\`pnpm nx run ${name}:install-git-hooks\`. It refuses to overwrite an unrelated existing hook.
-
-The sync-back workflow uses only \`GITHUB_TOKEN\` and never pushes or auto-merges. GitHub may
-place its pull-request workflows in an approval-required state. Approve them; if no run
-materializes, close and reopen the pull request as a human and then approve it.
-`,
-        'docs/repository-operating-policy.md': `# Repository Operating Policy
-
-\`ebk.repository-policy.json\` is the reviewed source of truth for deployment profile, exact
-stage account IDs, deployment Region, production access, production approval, per-Slice
-readiness, and the one shared production Foundation profile.
-New workspaces start with production disabled and explicit Team-compatible
-\`productionApproval.mode: "promotion-pr"\`. A missing approval mode or Slice entry fails
-closed; no GitHub capability is allowed to choose a mode implicitly.
-
-Deployment profiles are proportional to operator maturity:
-
-- \`starter\` (default) requires one shared account, permits local development and staging
-  through the governed root Nx target, and reserves production for protected GitHub deployment;
-- \`production-isolated\` requires one development/staging account and a distinct production
-  account; only production is GitHub-only; and
-- \`fully-isolated\` requires three distinct accounts; staging and production are GitHub-only.
-
-Equal account IDs never imply shared stage resources. Router, Aurora, Cognito, events, secrets,
-IAM, logs, queues, resource names, and SSM discovery remain stage-specific. Existing prerelease
-repositories migrate explicitly to \`fully-isolated\`; upgrades never infer or weaken topology.
-That profile-only migration retains the former authority model but stays undeployable until exact
-development, staging, and production account IDs plus \`deploymentRegion\` are committed.
-
-The named repository modes are source-writing presets, not runtime state. Report a change
-first and inspect the complete current/next policy:
-
-\`\`\`bash
-pnpm nx g @empire-builder-kit/nx:repository-policy \\
-  --deploymentProfile=starter --deploymentRegion=us-east-1 \\
-  --developmentAccountId=111122223333 --stagingAccountId=111122223333 \\
-  --productionAccountId=111122223333
-\`\`\`
-
-Apply the reviewed source change separately with \`--apply\`. This command never contacts AWS
-or GitHub. Use \`--status=blocked|pilot|ready\` for explicit Slice transitions and
-\`--profile=cost-optimized|standard\` for an explicit shared Foundation decision.
-Use \`--productionApprovalMode=promotion-pr|environment-reviewer\` for an explicit approval
-transition. This changes committed policy only; a separate bootstrap report/apply reconciles
-remote GitHub settings.
-
-After applying exact topology, authenticate with temporary federated credentials for development
-or staging and invoke
-\`pnpm nx run ${name}:deploy-local -- --stage=<stage> --profile=<profile>
---expectedRoleArn=<role-arn>\`. Production runs only through the protected main-branch GitHub
-workflow. Each admitted local invocation plans the complete current stage, displays the stage
-summary and first material project, and requires a real TTY response of
-\`approve:<action>:<stage>:<project>:<current-plan-digest>\`. A human or authorized agent may type
-that acknowledgement; it is active operator control, not a claim of independent human review.
-The target creates one private ten-minute capability for that project, rechecks the exact source,
-artifacts, account, Region, role, stage, policy, state, and lock without a second provider preview,
-consumes the capability once, and removes it on every exit path. Unattended scripts cannot approve.
-Every material deploy or refresh mutates at most the first material project and ends with a
-controlled non-success \`replan-required\` handoff, including the last project in the ordered stage.
-Rerun the complete stage, review the new current summary, and repeat until one invocation proves
-every project is semantically converged. Only that convergence invocation succeeds. A preview is
-recent review and audit evidence; it is not represented as a cryptographically replayable Pulumi
-transaction. A complete, unlocked deploy plan containing only provider reads with no changed
-properties, replacement, failure, or unmatched risk finding is retained as observation evidence
-and counts as semantically converged. The standalone project planner may still return its
-conservative non-success for that drift observation; the root local transaction accepts only a
-freshly emitted exact provider-read-only record from that child. Repeated reads coalesce
-only when their logical ID and resource type match exactly. Any stale or ambiguous
-observation fails closed; a plan with desired changes remains material and requires review. One
-narrower case stays reviewable instead of becoming
-drift: when an upstream Foundation apply changes only both external framework-version tag
-projections (plus SST's already-bounded name hydration), the retained
-external identity must match one exact non-replacing provider read in the same ordinary plan.
-Missing read correlation, owned resources, other tag or property changes, incomplete tag pairs,
-and provider failures remain drift and fail closed. The local target requires the exact SST v5 account bootstrap normally
-created by the pinned \`ebk dev up\` path, then creates and attests only missing exact
-per-project/canonical-stage state passphrases before its formal read-only plans. This passphrase
-bootstrap is the only persistent pre-acknowledgement write; it creates no deployment authority
-and is reported in bounded local evidence. Clean immutable source, immediate per-project plans,
-migration and retention preflights, and secret-free result
-evidence remain mandatory. Direct SST is forbidden.
-
-After an interrupted apply, use the same target with \`--action=refresh\` and the exact
-phase, stage, profile, and role. It retains the same plan-summary review boundary, admits only
-bounded drift-detected refresh evidence, and never turns refresh into an implicit deploy. When
-the interrupted write leaves a recorded provider output unusable by the ordinary desired preview,
-the plan stops without mutation. The non-writing refresh preview separates provider refresh
-records from its later desired preview and cannot replace failed ordinary desired authority;
-repair the recorded dependency or use the documented
-operator recovery path before planning again.
-
-A stage-wide refresh still plans and authorizes every selected project. When one exact retained
-project plan proves an absent SST state that is unlocked, complete, empty, and drift-free, the
-root target records that project as a refresh no-op instead of invoking SST against a nonexistent
-stage. It also retains the pinned provider's exact SSM \`ebk:framework-version\` \`tagsAll\`
-normalization as a semantically inert observation after the same bounded shape
-repeats following refresh. Value changes, other tags, security findings, deletes, replacements,
-sensitive properties, and every other resource type remain material. Locked, incomplete, failed,
-or otherwise drifted plans are never skipped.
-
-For a stage with no workload-role account baseline, publish the fixed Foundation-only candidate
-and invoke this root target with \`--phase=foundation-bootstrap\`. After Foundation outputs exist,
-publish the complete \`full-stage\` candidate and invoke the target without \`--phase\` (or with
-\`--phase=full-stage\`). The bootstrap phase selects exactly Foundation; it is not an arbitrary
-project filter.
-
-Validation requires both an explicit production approval mode and an explicit Foundation
-profile. It does not infer omitted values. Use \`promotion-pr\` for a private GitHub Team
-repository. Use \`environment-reviewer\` only when the repository plan can enforce a separate
-environment reviewer.
-
-- \`blocked\` prohibits production create, update, and migration.
-- \`pilot\` permits protected evidence gathering without claiming normal latency or maturity.
-- \`ready\` records an adopter decision after its evidence and review; it is not inferred.
-- removal and unlock remain explicit protected recovery paths so disabled policy cannot strand
-  resources.
-
-Protected production deploy and refresh validate the complete Foundation/Slice set before AWS
-access. The Foundation is always ordered first. The set is derived from committed policy and
-cannot be narrowed with an ad hoc project argument. The retained stage preview remains review
-evidence. Immediately before each project mutation the workflow computes one fresh plan against
-current state and applies it without a second redundant preview. Source, artifacts, configuration,
-policy, environment, and protected identities remain exact. Provider-only read/discard observations
-may appear or disappear, but any new delete, replacement, import, stateful or security change, IAM
-expansion, protection reduction, or unclassified resource stops for renewed approval. After an
-upstream mutation, every downstream project therefore receives a fresh independent risk decision.
-
-\`standard\` keeps Aurora warm at 2–16 ACU. \`cost-optimized\` keeps a smaller
-0.5–4 ACU warm floor for starter production traffic. Both keep managed NAT,
-30-day backups, deletion protection, retained data, and the protected GitHub/OIDC/AWS path.
-Changing policy affects only later lifecycle requests; it never deploys or removes resources.
-Changing profile requires a separate reviewed Foundation deployment and retained operational
-evidence.
-
-\`EBK_PRODUCTION_FOUNDATION_PROFILE\` is reserved managed executor input. The lifecycle
-executor derives it from validated committed policy immediately before SST and removes any
-ambient shell value. Do not set it as a local, repository, organization, or environment
-variable. Incubation keeps the last configured profile so protected remove and unlock can still
-render existing production resources; production deploy remains disabled.
+stage-qualified SSM discovery contract. Discovery rejects a record for an inactive or different
+canonical stage.
 `,
         'docs/work-markers.md': `# Agent work markers
 
@@ -8135,8 +7938,18 @@ must be committed, reviewable, and auditable.
                     executor: 'nx:run-commands',
                     options: { command: 'node tools/install-ebk-hooks.mjs' },
                 },
+                'stage-authority-render': {
+                    cache: false,
+                    executor: 'nx:run-commands',
+                    outputs: ['{workspaceRoot}/.ebk/authority/{args.stage}/*'],
+                    options: {
+                        command: 'node tools/stage-authority-render.mjs',
+                        forwardAllArgs: true,
+                    },
+                },
                 'deploy-local': {
                     cache: false,
+                    dependsOn: ['workspace-health'],
                     executor: '@empire-builder-kit/nx:local-deploy',
                     options: {
                         stage: 'development',
@@ -8165,19 +7978,6 @@ must be committed, reviewable, and auditable.
                     executor: '@empire-builder-kit/nx:work-markers',
                     options: {},
                 },
-                'workload-role-candidate-report': {
-                    executor: 'nx:run-commands',
-                    options: {
-                        command: 'node tools/workload-role-baseline/report-candidate-bundle.mjs',
-                        forwardAllArgs: true,
-                    },
-                },
-                'workload-role-provisioner-build': {
-                    executor: 'nx:run-commands',
-                    options: {
-                        command: 'node tools/workload-role-baseline/build.mjs',
-                    },
-                },
                 verify: {
                     dependsOn: ['blueprint-trust-check', 'supply-chain-check'],
                     executor: 'nx:run-commands',
@@ -8194,27 +7994,6 @@ must be committed, reviewable, and auditable.
                 },
             },
         }),
-        'packages/foundation/README.md': `# Standard Foundation
-
-This project owns the workspace-wide AWS platform for each canonical \`development\`,
-\`staging\`, or \`production\` stage. It is a separate SST state boundary from product slices.
-Never deploy it at a framework-derived personal stage; that consumer maps to
-\`development\`.
-
-It provides the v1 network, routing, container compute, Postgres, identity, events,
-observability, configuration, and deployment capabilities. Product slices consume its
-versioned contract; they do not import files from \`infra/\`.
-
-Workspace creation does not deploy this project. Review \`docs/costs.md\`,
-\`docs/security.md\`, and \`docs/runbooks.md\` before the first deployment.
-
-Set \`EBK_ROOT_DOMAIN\` before deploying when Route 53 in the target account owns a public
-domain. Without it, the shared Router uses its functional provider URL.
-
-Before deploying development or staging, add at least one exact operator/probe CIDR to
-\`security/router-waf.json\`. Production is public by default behind the same managed and
-rate-limiting baseline; select its allowlist mode explicitly when required.
-`,
         'packages/foundation/contracts/foundation.json': json({
             contractVersion: '1.0.0',
             capabilities: [
@@ -8243,11 +8022,15 @@ rate-limiting baseline; select its allowlist mode explicitly when required.
                     dataRetention: 'retained',
                     nat: 'ec2',
                 },
-                staging: {
-                    aurora: 'scale-to-zero',
-                    dataRetention: 'retained',
-                    nat: 'ec2',
-                },
+                ...(deploymentProfile === 'starter'
+                    ? {}
+                    : {
+                        staging: {
+                            aurora: 'scale-to-zero',
+                            dataRetention: 'retained',
+                            nat: 'ec2',
+                        },
+                    }),
                 production: {
                     aurora: 'repository-policy',
                     dataRetention: 'retained-and-protected',
@@ -8271,8 +8054,7 @@ The machine-readable stage inventory is \`../contracts/costs.json\`; keep this
 seeded decision record aligned with organization-specific budgets and alerts.
 
 - Development uses EC2 NAT, a development bastion, and Aurora scale-to-zero.
-- Staging uses EC2 NAT and Aurora scale-to-zero by default.
-- Production always uses managed NAT and retains protected data. Its explicit Repository
+${deploymentProfile === 'starter' ? '' : '- Staging uses EC2 NAT and Aurora scale-to-zero by default.\n'}- Production always uses managed NAT and retains protected data. Its explicit Repository
   Operating Policy profile selects either the standard 2-ACU Aurora floor or the
   cost-optimized 0.5-ACU warm floor.
 - ECS, EventBridge, Cognito, SNS, SSM, and CloudWatch are primarily usage-priced; logs,
@@ -8280,102 +8062,6 @@ seeded decision record aligned with organization-specific budgets and alerts.
 
 Run \`foundation:remove\` only for disposable stages. Production is retained and protected by
 the SST configuration.
-`,
-        'packages/foundation/docs/runbooks.md': `# Foundation runbooks
-
-## Deployment
-
-Use Nx for every supported lifecycle action:
-
-- \`pnpm nx run foundation:deploy --stage=development\`
-- \`pnpm nx run foundation:refresh --stage=development\`
-- \`pnpm nx run foundation:unlock --stage=development\`
-- \`pnpm nx run foundation:remove --stage=development\`
-
-Do not invoke SST lifecycle commands directly. The root \`deploy-local\` target is the governed
-local path for stages admitted by the committed deployment profile. Its fixed
-\`foundation-bootstrap\` phase is the only local partial-stage path and exists solely for the
-documented first workload-role publication; isolated protected stages remain on the trusted
-GitHub path.
-
-Every local invocation plans the complete selected stage but mutates at most one material
-project. Type the exact current \`approve:<action>:<stage>:<project>:<plan-digest>\` challenge in a
-real TTY after reviewing the displayed summary. A human or authorized agent may operate that TTY;
-unattended input is refused. The acknowledgement creates one ten-minute, one-use, private
-capability bound to source, artifacts, policy, environment, credentials, and current state. A
-completed deploy or refresh returns the controlled non-success \`replan-required\`; rerun the
-complete stage, review the new current summary, and continue one project at a time. Only a
-semantically converged complete stage reports success. No upstream mutation can authorize a
-downstream project. A complete, unlocked deploy plan containing only provider reads with no
-changed properties, replacement, failure, or unmatched risk finding is retained as observation
-evidence and counts as semantically converged. The standalone project planner may still return
-its conservative non-success for that drift observation; the root local transaction accepts only
-a freshly emitted exact provider-read-only record from that child. Repeated reads coalesce
-only when their logical ID and resource type match exactly. Any stale or ambiguous
-observation fails closed; a plan with desired changes remains material and requires review. A
-material downstream plan may also retain an upstream Foundation framework-version tag advance as
-observation only when both external tag
-projections, the retained identity, optional bounded SST name hydration, and one non-replacing
-provider read correlate exactly. Every other external property or uncorroborated read remains
-drift and blocks before the TTY challenge.
-
-For an interrupted local apply, run the same root target with \`--action=refresh\`, review its
-current provider-refresh evidence, and type the displayed TTY challenge. Before mutation the
-executor writes and verifies a private state recovery point plus a secret-free digest/version
-manifest. The refresh preview validates its provider and later desired-event partitions; any
-ordinary preview failure or malformed post-refresh desired event remains blocked. Provider-only
-observation noise is retained without claiming a replayable preview. Because refresh changes
-recorded state rather than cloud resources, provider-output security and protection findings
-remain explicit review requirements under the drift decision. Refresh never continues into deploy
-or claims desired-state convergence: run the governed deploy target afterward and resolve every
-remaining source-versus-state change. Exclude the \`.private.json\` recovery point from archives.
-
-The root refresh target includes every selected project in its exact reviewed plan set. It skips
-the SST child only when that project's retained plan proves an absent, unlocked, complete, empty,
-and drift-free state, or when the only retained difference is the pinned provider's exact repeated
-SSM \`ebk:framework-version\` \`tagsAll\` normalization. It records the project as an explicit refresh no-op
-in either case while retaining the observation. Value changes, other tags, security findings,
-deletes, replacements, sensitive
-properties, and every other resource type remain material; every other plan must execute or fail
-closed.
-
-## Router WAF
-
-Each canonical stage owns one global-scope Web ACL attached to that stage's Foundation Router.
-The committed \`security/router-waf.json\` policy requires AWS Common Rule Set, Known Bad
-Inputs, Amazon IP Reputation, an IP rate limit, CloudWatch metrics, and sampled requests.
-Development and staging fail synthesis until their allowlists contain explicit CIDRs.
-Production is public by default and may be changed to an explicit allowlist.
-
-For tuning, set a nonproduction stage to \`count\`, deploy and inspect sampled requests, then
-return staging to \`block\` and run the live allow/deny, managed-rule, rate-limit, metric, and
-sampled-request probes. Write their bounded, secret-free result to
-\`security/router-waf-live-evidence.json\`, then run
-\`pnpm nx run foundation:router-waf-rehearsal\`. The executor seals the exact policy digest
-into \`router-waf-blocking-rehearsal.json\`. Production synthesis rejects a missing, stale, or
-count-mode rehearsal. Full request logging is opt-in, blocked-only, retention-bounded, and
-redacts query strings plus credential-bearing headers.
-
-Foundation stages are canonical. \`ebk dev\` derives a Product Slice personal
-stage from the operating-system account and maps that consumer to the
-development Foundation. Callers cannot select that stage. Slice preflight
-reports both identities, never deploys a personal Foundation, and full mapped
-personal-stage deploys fail closed.
-
-## Database restore
-
-Production Aurora retains 30 days of automated backups; non-production retains 7 days.
-Restore into a new cluster, validate application migrations and data integrity, then cut over
-consumers deliberately. Never expose the Foundation master credential to a product slice.
-
-## Protected database migrations
-
-Each database-backed Product Slice deploys a one-off Fargate migration task and
-Standard Step Functions workflow into the shared cluster. The existing
-environment-scoped \`AWS_DEPLOY_ROLE_ARN\` starts and observes that exact
-workflow; do not create a second migration OIDC role. GitHub has no direct SQL,
-database-secret-value, or \`rds-db:connect\` authority. The generated task role
-connects as the Slice's no-password IAM-authenticated migrator user.
 `,
         'packages/foundation/docs/security.md': `# Foundation security contract
 
@@ -8392,7 +8078,7 @@ connects as the Slice's no-password IAM-authenticated migrator user.
 - Every stage's CloudFront Router has its own global Web ACL. The baseline always includes AWS
   Common Rule Set, Known Bad Inputs, Amazon IP Reputation, rate blocking, CloudWatch metrics,
   and sampled requests. Nonproduction is allowlisted by default. Production is public by
-  default, but cannot deploy until the exact policy has passed a staging blocking rehearsal.
+  default, but cannot deploy until the exact policy has passed a ${rehearsalStage} blocking rehearsal.
 - Full WAF request logging is disabled by default. Enabling it keeps blocked requests only,
   uses bounded retention, and redacts query strings, cookies, authorization, and API keys.
 
@@ -8433,6 +8119,7 @@ import {
   foundationSsmPath,
   normalizeRouterWafPolicy,
   reconcileRouterWafBlockingRehearsal,
+  routerWafContractDigest,
   type FoundationSsmKey,
 } from '@empire-builder-kit/nx/foundation';
 import {
@@ -8440,12 +8127,19 @@ import {
   FOUNDATION_AURORA_ENGINE_VERSION,
   productionFoundationProfileContract,
 } from '@empire-builder-kit/nx/repository-policy';
+import { installStageIamBoundaryTransforms } from '@empire-builder-kit/nx/aws-authority';
+import { createStageAuthorityIdentity } from '@empire-builder-kit/nx/aws-authority';
+import {
+  configuredDeploymentAccountForStage,
+  configuredDeploymentRegion,
+  productionRehearsalStage,
+} from '@empire-builder-kit/nx/repository-policy';
 import { createFoundationAccountCostControlPlan } from '@empire-builder-kit/nx/performance';
 import accountCostPolicy from '../performance/account-cost-policy.json';
 import routerWafBlockingRehearsal from '../security/router-waf-blocking-rehearsal.json';
 import routerWafLiveEvidence from '../security/router-waf-live-evidence.json';
 import routerWafPolicy from '../security/router-waf.json';
-import type { FoundationWorkloadRolePreflight } from './workload-roles/preflight.js';
+import repositoryPolicy from '../../../ebk.repository-policy.json';
 
 function identityDomainPrefix(stage: string, accountId: string): string {
   if (!/^\\d{12}$/.test(accountId)) {
@@ -8479,14 +8173,7 @@ function publishFoundation(values: Record<FoundationSsmKey, any>) {
   );
 }
 
-export function foundation(
-  workloadRoles?: FoundationWorkloadRolePreflight,
-) {
-  if (!$dev && !workloadRoles) {
-    throw new Error(
-      'Protected Foundation workload-role preflight must complete before infrastructure construction.',
-    );
-  }
+export function foundation() {
   const isProduction = $app.stage === 'production';
   const isStaging = $app.stage === 'staging';
   const rootDomain = process.env.EBK_ROOT_DOMAIN?.trim();
@@ -8497,40 +8184,63 @@ export function foundation(
     : undefined;
   const natMode = productionConfiguration?.contract.nat ?? 'ec2';
   const normalizedRouterWafPolicy = normalizeRouterWafPolicy(routerWafPolicy);
+  if (repositoryPolicy.deploymentProfile !== normalizedRouterWafPolicy.deploymentProfile) {
+    throw new Error('Router WAF policy profile differs from committed repository policy.');
+  }
+  const rehearsalStage = productionRehearsalStage(normalizedRouterWafPolicy.deploymentProfile);
+  const rehearsalAccount = configuredDeploymentAccountForStage(
+    normalizedRouterWafPolicy.deploymentProfile,
+    repositoryPolicy.deploymentAccounts,
+    rehearsalStage,
+  );
+  const rehearsalRegion = configuredDeploymentRegion(repositoryPolicy.deploymentRegion);
+  const rehearsalRoleArn = createStageAuthorityIdentity({
+    accountId: rehearsalAccount,
+    partition: rehearsalRegion.startsWith('us-gov-') ? 'aws-us-gov' : 'aws',
+    region: rehearsalRegion,
+    stage: rehearsalStage,
+  }).deploymentRoleArn;
   const wafPlan = createRouterWafStagePlan({
     policy: normalizedRouterWafPolicy,
     rehearsal: isProduction
       ? reconcileRouterWafBlockingRehearsal({
           evidence: routerWafLiveEvidence,
+          expected: {
+            accountId: rehearsalAccount,
+            deploymentRoleArn: rehearsalRoleArn,
+            region: rehearsalRegion,
+            stage: rehearsalStage,
+            wafContractDigest: routerWafContractDigest(normalizedRouterWafPolicy),
+            workspace: '${name}',
+          },
           policy: normalizedRouterWafPolicy,
           receipt: routerWafBlockingRehearsal,
         })
       : null,
     stage: $app.stage,
   });
-  const natBinding = workloadRoles?.bindings.nat;
-  if (natMode === 'ec2' && natBinding) {
-    $transform(
-      aws.iam.InstanceProfile,
-      (args: any, opts: any, logicalName: string) => {
-        if (logicalName !== 'FoundationVpcNatInstanceProfile') return;
-        args.name = natBinding.instanceProfileName;
-        args.role = natBinding.roleName;
-        opts.import = natBinding.instanceProfileName;
-        opts.ignoreChanges = [
-          ...new Set([...(opts.ignoreChanges ?? []), 'tags', 'tagsAll']),
-        ];
-      },
+  const deploymentAccount = process.env.AWS_EXPECTED_ACCOUNT_ID?.trim() ?? '';
+  if (!/^\\d{12}$/.test(deploymentAccount)) {
+    throw new Error(
+      'Foundation deployment requires the exact committed AWS account before infrastructure construction.',
     );
   }
+  installStageIamBoundaryTransforms({
+    accountId: deploymentAccount,
+    instanceProfileResource: aws.iam.InstanceProfile,
+    registerTransform: $transform,
+    roleResource: aws.iam.Role,
+    stage: ($dev ? 'development' : $app.stage) as
+      | 'development'
+      | 'staging'
+      | 'production',
+  });
 
   const vpc = new sst.aws.Vpc('FoundationVpc', {
     az: 2,
     bastion: $app.stage === 'development',
     nat:
-      natMode === 'ec2'
-        ? (natBinding?.vpc.nat ?? 'ec2')
-        : 'managed',
+      natMode === 'ec2' ? 'ec2' : 'managed',
   });
   const cluster = new sst.aws.Cluster('FoundationCluster', { vpc });
   const router = new sst.aws.Router('FoundationRouter', {
@@ -8559,6 +8269,13 @@ export function foundation(
             'Foundation Router must attach its exact global Web ACL.',
           );
         }
+        args.tags = {
+          ...(args.tags ?? {}),
+          'ebk:managed-by': 'empire-builder-kit',
+          'ebk:owner': 'foundation',
+          'ebk:stage': wafPlan.stage,
+          'ebk:workspace': '${name}',
+        };
       },
       waf(args: any, opts: any) {
         if (args.scope !== 'CLOUDFRONT') {
@@ -8576,8 +8293,11 @@ export function foundation(
               name: 'foundation-' + wafPlan.stage + '-router-ipv4-allowlist',
               scope: 'CLOUDFRONT',
               tags: {
+                'ebk:managed-by': 'empire-builder-kit',
+                'ebk:owner': 'foundation',
                 'ebk:policy-digest': wafPlan.policyDigest,
                 'ebk:stage': wafPlan.stage,
+                'ebk:workspace': '${name}',
               },
             },
             { provider: opts.provider },
@@ -8592,8 +8312,11 @@ export function foundation(
               name: 'foundation-' + wafPlan.stage + '-router-ipv6-allowlist',
               scope: 'CLOUDFRONT',
               tags: {
+                'ebk:managed-by': 'empire-builder-kit',
+                'ebk:owner': 'foundation',
                 'ebk:policy-digest': wafPlan.policyDigest,
                 'ebk:stage': wafPlan.stage,
+                'ebk:workspace': '${name}',
               },
             },
             { provider: opts.provider },
@@ -8604,8 +8327,11 @@ export function foundation(
         args.scope = 'CLOUDFRONT';
         args.tags = {
           ...(args.tags ?? {}),
+          'ebk:managed-by': 'empire-builder-kit',
+          'ebk:owner': 'foundation',
           'ebk:policy-digest': wafPlan.policyDigest,
           'ebk:stage': wafPlan.stage,
+          'ebk:workspace': '${name}',
         };
         args.visibilityConfig = {
           cloudwatchMetricsEnabled: true,
@@ -8709,6 +8435,7 @@ export function foundation(
   const accountCostControl = createFoundationAccountCostControlPlan({
     evaluatedAt: new Date().toISOString(),
     policy: accountCostPolicy,
+    rehearsalStage: '${rehearsalStage}',
     region: process.env.AWS_REGION,
     stage: $app.stage,
     workspace: '${name}',
@@ -9013,15 +8740,9 @@ export function foundation(
 }
 `,
         'packages/foundation/infra/index.ts': `import { foundation } from './foundation.js';
-import type { FoundationWorkloadRolePreflight } from './workload-roles/preflight.js';
 
-export function app(workloadRoles?: FoundationWorkloadRolePreflight) {
-  const resources = foundation(workloadRoles);
-  return {
-    ...resources,
-    workloadRoleManifestDigest:
-      workloadRoles?.registry.manifestDigest ?? 'local-dev-ephemeral',
-  };
+export function app() {
+  return foundation();
 }
 `,
         'packages/foundation/performance/account-cost-policy.json': json({
@@ -9036,6 +8757,7 @@ export function app(workloadRoles?: FoundationWorkloadRolePreflight) {
             workspace: name,
         }),
         'packages/foundation/security/router-waf.json': json({
+            deploymentProfile,
             kind: 'ebk-router-waf-policy',
             logging: {
                 enabled: false,
@@ -9054,21 +8776,25 @@ export function app(workloadRoles?: FoundationWorkloadRolePreflight) {
                     allowedCidrs: [],
                     mode: 'block',
                 },
-                staging: {
-                    access: 'allowlist',
-                    allowedCidrs: [],
-                    mode: 'block',
-                },
+                ...(deploymentProfile === 'starter'
+                    ? {}
+                    : {
+                        staging: {
+                            access: 'allowlist',
+                            allowedCidrs: [],
+                            mode: 'block',
+                        },
+                    }),
             },
         }),
         'packages/foundation/security/router-waf-blocking-rehearsal.json': json({
             kind: 'ebk-router-waf-blocking-rehearsal',
-            schemaVersion: 1,
+            schemaVersion: 4,
             status: 'pending',
         }),
         'packages/foundation/security/router-waf-live-evidence.json': json({
             kind: 'ebk-router-waf-live-evidence',
-            schemaVersion: 1,
+            schemaVersion: 4,
             status: 'pending',
         }),
         'packages/foundation/configuration/declarations.json': json({
@@ -9103,16 +8829,7 @@ export function app(workloadRoles?: FoundationWorkloadRolePreflight) {
                 version: '4.17.1',
             },
             policy: {
-                adoptedImports: [
-                    {
-                        authority: 'workload-role-account-baseline',
-                        logicalId: 'FoundationVpcNatInstanceProfile',
-                        privateIdentifierTemplate: 'ebk-{stage}-foundation-nat-profile',
-                        recoveryRunbookRef: 'docs/workload-role-account-baseline.md',
-                        removalBehavior: 'retain',
-                        resourceType: 'aws:iam/instanceProfile:InstanceProfile',
-                    },
-                ],
+                adoptedImports: [],
                 additiveLowRiskTypes: [
                     'aws:cloudwatch/dashboard:Dashboard',
                     'aws:cloudwatch/logGroup:LogGroup',
@@ -9222,10 +8939,6 @@ export function app(workloadRoles?: FoundationWorkloadRolePreflight) {
                         'verify',
                         { target: 'profile-preflight', params: 'forward' },
                     ],
-                    outputs: [
-                        `{projectRoot}/.ebk/evidence/infrastructure-convergence.json`,
-                        `{projectRoot}/.ebk/evidence/infrastructure-mutation-binding.json`,
-                    ],
                     options: {
                         cwd: 'packages/foundation',
                         stage: 'development',
@@ -9242,15 +8955,7 @@ export function app(workloadRoles?: FoundationWorkloadRolePreflight) {
                 'infrastructure-plan': {
                     cache: false,
                     executor: '@empire-builder-kit/nx:infrastructure-plan',
-                    outputs: [
-                        `{projectRoot}/.ebk/evidence/infrastructure-plan-authorization.json`,
-                        `{projectRoot}/.ebk/evidence/infrastructure-plan-command.json`,
-                        `{projectRoot}/.ebk/evidence/infrastructure-plan.private-stderr.txt`,
-                        `{projectRoot}/.ebk/evidence/infrastructure-plan.raw.json`,
-                        `{projectRoot}/.ebk/evidence/infrastructure-plan.json`,
-                    ],
                     options: {
-                        action: 'deploy',
                         cwd: 'packages/foundation',
                         stage: 'development',
                         stageMode: 'foundation',
@@ -9259,10 +8964,6 @@ export function app(workloadRoles?: FoundationWorkloadRolePreflight) {
                 refresh: {
                     executor: '@empire-builder-kit/nx:refresh',
                     dependsOn: [{ target: 'profile-preflight', params: 'forward' }],
-                    outputs: [
-                        `{projectRoot}/.ebk/evidence/infrastructure-convergence.json`,
-                        `{projectRoot}/.ebk/evidence/infrastructure-mutation-binding.json`,
-                    ],
                     options: {
                         cwd: 'packages/foundation',
                         stage: 'development',
@@ -9272,10 +8973,6 @@ export function app(workloadRoles?: FoundationWorkloadRolePreflight) {
                 remove: {
                     executor: '@empire-builder-kit/nx:remove',
                     dependsOn: [{ target: 'remove-preflight', params: 'forward' }],
-                    outputs: [
-                        `{projectRoot}/.ebk/evidence/infrastructure-convergence.json`,
-                        `{projectRoot}/.ebk/evidence/infrastructure-mutation-binding.json`,
-                    ],
                     options: {
                         cwd: 'packages/foundation',
                         stage: 'development',
@@ -9325,9 +9022,17 @@ export function app(workloadRoles?: FoundationWorkloadRolePreflight) {
         'packages/foundation/scripts/verify-foundation.mjs': `import { readFileSync } from 'node:fs';
 
 import {
+  normalizeRouterWafBlockingRehearsal,
   normalizeRouterWafPolicy,
   reconcileRouterWafBlockingRehearsal,
+  routerWafContractDigest,
 } from '@empire-builder-kit/nx/foundation';
+import { createStageAuthorityIdentity } from '@empire-builder-kit/nx/aws-authority';
+import {
+  configuredDeploymentAccountForStage,
+  configuredDeploymentRegion,
+  productionRehearsalStage,
+} from '@empire-builder-kit/nx/repository-policy';
 
 const descriptor = JSON.parse(
   readFileSync(new URL('../contracts/foundation.json', import.meta.url), 'utf8'),
@@ -9352,25 +9057,54 @@ const routerWafPolicy = normalizeRouterWafPolicy(
     ),
   ),
 );
-reconcileRouterWafBlockingRehearsal({
-  evidence: JSON.parse(
-    readFileSync(
-      new URL('../security/router-waf-live-evidence.json', import.meta.url),
-      'utf8',
+const repositoryPolicy = JSON.parse(
+  readFileSync(new URL('../../../ebk.repository-policy.json', import.meta.url), 'utf8'),
+);
+const workspaceManifest = JSON.parse(
+  readFileSync(new URL('../../../package.json', import.meta.url), 'utf8'),
+);
+const rehearsalReceipt = JSON.parse(
+  readFileSync(
+    new URL(
+      '../security/router-waf-blocking-rehearsal.json',
+      import.meta.url,
     ),
+    'utf8',
   ),
-  policy: routerWafPolicy,
-  receipt:
-  JSON.parse(
-    readFileSync(
-      new URL(
-        '../security/router-waf-blocking-rehearsal.json',
-        import.meta.url,
+);
+const normalizedRehearsal = normalizeRouterWafBlockingRehearsal(rehearsalReceipt);
+if (normalizedRehearsal) {
+  const rehearsalStage = productionRehearsalStage(repositoryPolicy.deploymentProfile);
+  const rehearsalAccount = configuredDeploymentAccountForStage(
+    repositoryPolicy.deploymentProfile,
+    repositoryPolicy.deploymentAccounts,
+    rehearsalStage,
+  );
+  const rehearsalRegion = configuredDeploymentRegion(repositoryPolicy.deploymentRegion);
+  reconcileRouterWafBlockingRehearsal({
+    evidence: JSON.parse(
+      readFileSync(
+        new URL('../security/router-waf-live-evidence.json', import.meta.url),
+        'utf8',
       ),
-      'utf8',
     ),
-  ),
-});
+    expected: {
+      accountId: rehearsalAccount,
+      deploymentRoleArn: createStageAuthorityIdentity({
+        accountId: rehearsalAccount,
+        partition: rehearsalRegion.startsWith('us-gov-') ? 'aws-us-gov' : 'aws',
+        region: rehearsalRegion,
+        stage: rehearsalStage,
+      }).deploymentRoleArn,
+      region: rehearsalRegion,
+      stage: rehearsalStage,
+      wafContractDigest: routerWafContractDigest(routerWafPolicy),
+      workspace: workspaceManifest.name,
+    },
+    policy: routerWafPolicy,
+    receipt: normalizedRehearsal,
+  });
+}
 const expectedCapabilities = [
   'network',
   'routing',
@@ -9387,8 +9121,10 @@ if (descriptor.contractVersion !== '1.0.0') {
   throw new Error('Foundation contractVersion must be 1.0.0.');
 }
 if (
+  JSON.stringify(Object.keys(routerWafPolicy.stages).sort()) !==
+    JSON.stringify(${JSON.stringify([...activeStages].sort())}) ||
   routerWafPolicy.stages.development.access !== 'allowlist' ||
-  routerWafPolicy.stages.staging.access !== 'allowlist' ||
+  ${deploymentProfile !== 'starter' ? "routerWafPolicy.stages.staging?.access !== 'allowlist' ||" : ''}
   routerWafPolicy.stages.production.mode !== 'block'
 ) {
   throw new Error('Foundation Router WAF stage defaults are invalid.');
@@ -9403,7 +9139,8 @@ if (
   costs.productionProfiles?.standard?.aurora?.min !== '2 ACU' ||
   costs.productionProfiles?.['cost-optimized']?.aurora?.min !== '0.5 ACU' ||
   !costs.stages?.development ||
-  !costs.stages?.staging ||
+  JSON.stringify(Object.keys(costs.stages ?? {}).sort()) !==
+    JSON.stringify(${JSON.stringify([...activeStages].sort())}) ||
   costs.stages?.production?.dataRetention !== 'retained-and-protected'
 ) {
   throw new Error('Foundation cost manifest does not match the v1 stage contract.');
@@ -9443,9 +9180,9 @@ export {};
 export default $config({
   app(input: { stage?: string } | undefined) {
     const stage = input?.stage ?? 'development';
-    if (!['development', 'staging', 'production'].includes(stage)) {
+    if (!new Set<string>(${JSON.stringify(activeStages)}).has(stage)) {
       throw new Error(
-        'Foundation stage ' + stage + ' is not canonical. Use development, staging, or production.',
+        'Foundation stage ' + stage + ' is inactive for the ${deploymentProfile} deployment profile.',
       );
     }
     const production = stage === 'production';
@@ -9477,15 +9214,8 @@ export default $config({
     };
   },
   async run() {
-    const workloadRoles = $dev
-      ? undefined
-      : await import(
-          './infra/workload-roles/preflight.js'
-        ).then(({ preflightFoundationWorkloadRoles }) =>
-          preflightFoundationWorkloadRoles($app.stage),
-        );
     const { app } = await import('./infra/index.js');
-    return app(workloadRoles);
+    return app();
   },
 });
 `,
@@ -10419,7 +10149,7 @@ const decision = evaluateGitPolicy(request);
 process.stdout.write(JSON.stringify(decision, null, 2) + '\\n');
 if (!decision.allowed) process.exitCode = 1;
 `,
-        'tools/workspace-health.mjs': `import { validateRepositoryOperatingPolicy } from '@empire-builder-kit/nx/repository-policy';
+        'tools/workspace-health.mjs': `import { readRepositoryOperatingPolicy } from '@empire-builder-kit/nx/repository-policy';
 import { assertWorkMarkerReport, formatWorkMarkerReport, scanWorkMarkers } from '@empire-builder-kit/nx/work-markers';
 import { createHash } from 'node:crypto';
 import { existsSync, readdirSync, readFileSync } from 'node:fs';
@@ -10482,13 +10212,7 @@ if (
 validateOwnership('.', workspace, 'Workspace');
 validateOwnership('packages/foundation', foundation, 'Foundation');
 
-const policy = validateRepositoryOperatingPolicy(readJson('ebk.repository-policy.json'));
-if (!policy.valid) {
-  throw new Error(
-    'Repository Operating Policy is invalid:\\n' +
-      policy.issues.map(({ message, path }) => '- ' + path + ': ' + message).join('\\n'),
-  );
-}
+readRepositoryOperatingPolicy(process.cwd());
 
 for (const name of readdirSync('packages')) {
   if (name === 'foundation') continue;
@@ -10506,7 +10230,51 @@ assertWorkMarkerReport(markerReport);
 process.stdout.write('Empire Builder Kit workspace source health is green.\\n');
 `,
     };
-    Object.assign(files, SUPPLY_CHAIN_WORKSPACE_FILE_PLAN.files, (0, workspace_files_performance_cost_js_1.renderProtectedPerformanceCostWorkflow)(), (0, workspace_files_performance_cost_js_1.renderProtectedAggregateCountWorkflow)(), (0, workspace_files_performance_load_js_1.renderProtectedPerformanceLoadWorkflowPlan)('workspace').files, developerAgentFilePlan.files, (0, workspace_files_foundation_workload_roles_js_1.renderFoundationWorkloadRoleFiles)(), (0, workspace_files_workload_role_baseline_js_1.renderWorkspaceWorkloadRoleBaselineFiles)({ name }));
+    Object.assign(files, SUPPLY_CHAIN_WORKSPACE_FILE_PLAN.files, developerAgentFilePlan.files, (0, workspace_files_stage_authority_js_1.renderStageAuthorityWorkspaceFiles)({
+        deploymentProfile,
+        name,
+        workspaceDeploymentId,
+    }));
+    Object.assign(files, (0, workspace_files_ecr_inspector_js_1.renderThinEcrInspectorWorkflow)({
+        actionPins: {
+            checkout: checkoutAction,
+            configureAwsCredentials: configureAwsAction,
+            downloadArtifact: downloadArtifactAction,
+            pnpmSetup: pnpmAction,
+            setupNode: setupNodeAction,
+            uploadArtifact: uploadArtifactAction,
+        },
+        deploymentProfile,
+        name,
+        nodeVersion: tool_versions_js_1.WORKSPACE_NODE_VERSION,
+    }), (0, workspace_files_thin_deploy_js_1.renderThinDeployWorkflowFilePlan)({
+        actionPins: {
+            checkout: checkoutAction,
+            configureAwsCredentials: configureAwsAction,
+            downloadArtifact: downloadArtifactAction,
+            pnpmSetup: pnpmAction,
+            setupNode: setupNodeAction,
+            uploadArtifact: uploadArtifactAction,
+        },
+        deploymentProfile,
+        name,
+        toolVersions: {
+            node: tool_versions_js_1.WORKSPACE_NODE_VERSION,
+            sst: tool_versions_js_1.WORKSPACE_SST_VERSION,
+        },
+    }).files, (0, workspace_files_thin_docs_js_1.renderThinLifecycleDocumentation)({ deploymentProfile, name }));
+    const thinReleaseWorkflowPlan = (0, workspace_files_thin_release_js_1.renderThinReleaseWorkflowPlan)();
+    Object.assign(files, thinReleaseWorkflowPlan.files);
+    for (const obsoletePath of [
+        ...thinReleaseWorkflowPlan.obsoletePaths,
+        '.github/workflows/performance-aggregate-counts.yml',
+        '.github/workflows/performance-cost-actual.yml',
+        '.github/workflows/performance-load.yml',
+        'packages/foundation/operations/infrastructure-change.json',
+        'tools/ebk-infrastructure-plan-summary.mjs',
+    ]) {
+        delete files[obsoletePath];
+    }
     for (const [path, source] of Object.entries(files)) {
         if (/^\.github\/workflows\/[^/]+\.ya?ml$/u.test(path)) {
             files[path] = isolateOidcTokenBeforeAwsAuthority(source, configureAwsAction);