@empire-builder-kit/nx 1.0.0-rc.30 → 1.0.0-rc.32

package/src/supply-chain/generated-container-release-command.js

@@ -5,6 +5,64 @@ exports.renderContainerReleaseCommand = renderContainerReleaseCommand;
 const generated_ecr_collector_command_js_1 = require("./generated-ecr-collector-command.js");
 const safe_reference_1 = require("@empire-builder-kit/runtime/safe-reference");
 exports.CRANE_VERSION = '0.21.7';
+const WINDOWS_HARDEN_PRIVATE_ACL = String.raw `
+$ErrorActionPreference = 'Stop'
+$path = $env:EBK_PRIVATE_PATH
+$kind = $env:EBK_PRIVATE_KIND
+$identity = [System.Security.Principal.WindowsIdentity]::GetCurrent()
+if ($kind -eq 'directory') {
+  $info = [System.IO.DirectoryInfo]::new($path)
+} else {
+  $info = [System.IO.FileInfo]::new($path)
+}
+$acl = $info.GetAccessControl()
+$acl.SetAccessRuleProtection($true, $false)
+foreach ($rule in @($acl.Access)) {
+  [void]$acl.RemoveAccessRuleSpecific($rule)
+}
+$rights = [System.Security.AccessControl.FileSystemRights]::FullControl
+$type = [System.Security.AccessControl.AccessControlType]::Allow
+if ($kind -eq 'directory') {
+  $inheritance = [System.Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit'
+  $propagation = [System.Security.AccessControl.PropagationFlags]::None
+  $rule = [System.Security.AccessControl.FileSystemAccessRule]::new(
+    $identity.User, $rights, $inheritance, $propagation, $type
+  )
+} else {
+  $rule = [System.Security.AccessControl.FileSystemAccessRule]::new(
+    $identity.User, $rights, $type
+  )
+}
+$acl.AddAccessRule($rule)
+$info.SetAccessControl($acl)
+`;
+const WINDOWS_ASSERT_PRIVATE_ACL = String.raw `
+$ErrorActionPreference = 'Stop'
+$path = $env:EBK_PRIVATE_PATH
+$kind = $env:EBK_PRIVATE_KIND
+$identity = [System.Security.Principal.WindowsIdentity]::GetCurrent()
+if ($kind -eq 'directory') {
+  $info = [System.IO.DirectoryInfo]::new($path)
+} else {
+  $info = [System.IO.FileInfo]::new($path)
+}
+$acl = $info.GetAccessControl()
+if (-not $acl.AreAccessRulesProtected) {
+  throw 'ACL inheritance is enabled.'
+}
+$allowRules = @($acl.Access | Where-Object {
+  $_.AccessControlType -eq [System.Security.AccessControl.AccessControlType]::Allow
+})
+$unsafeRules = @($allowRules | Where-Object {
+  $_.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]).Value -ne $identity.User.Value
+})
+$selfRules = @($allowRules | Where-Object {
+  $_.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]).Value -eq $identity.User.Value
+})
+if ($unsafeRules.Count -ne 0 -or $selfRules.Count -eq 0) {
+  throw 'ACL grants access beyond the current user or omits the current user.'
+}
+`;
 exports.CRANE_RELEASES = Object.freeze({
     'darwin-arm64': {
         archiveFormat: 'tar-gzip',
@@ -59,8 +117,8 @@ function renderContainerReleaseCommand(options = {}) {
         !/^\d+\.\d+\.\d+$/.test(craneVersion)) {
         throw new Error('The generated container release configuration is invalid.');
     }
-    return `import { createHash } from 'node:crypto';
-import { execFileSync, spawnSync } from 'node:child_process';
+    return `import { createHash, randomBytes } from 'node:crypto';
+import { execFileSync, spawn, spawnSync } from 'node:child_process';
 import {
   chmodSync,
   existsSync,
@@ -71,10 +129,11 @@ import {
   realpathSync,
   readdirSync,
   rmSync,
+  unlinkSync,
   writeFileSync,
 } from 'node:fs';
 import { basename, isAbsolute, join, relative, resolve, sep } from 'node:path';
-import { tmpdir } from 'node:os';
+import { platform as hostOperatingSystem, tmpdir } from 'node:os';
 import {
   CONTAINER_NATIVE_LIFECYCLE_PROOFS,
   CONTAINER_RELEASE_PLATFORMS,
@@ -82,6 +141,7 @@ import {
   createContainerNativeRunProof,
   createContainerPlatformEvidence,
   createContainerReleaseBinding,
+  hasSensitiveSupplyChainShape,
   resolveContainerReleaseArtifact,
   supplyChainDigest,
   validateContainerArtifactIdentity,
@@ -95,6 +155,8 @@ const SYFT_VERSION = ${JSON.stringify(syftVersion)};
 const SYFT_RELEASES = Object.freeze(${JSON.stringify(releases)});
 const CRANE_VERSION = ${JSON.stringify(craneVersion)};
 const CRANE_RELEASES = Object.freeze(${JSON.stringify(craneReleases)});
+const WINDOWS_HARDEN_PRIVATE_ACL = ${JSON.stringify(WINDOWS_HARDEN_PRIVATE_ACL)};
+const WINDOWS_ASSERT_PRIVATE_ACL = ${JSON.stringify(WINDOWS_ASSERT_PRIVATE_ACL)};
 const SHA256 = /^[a-f0-9]{64}$/;
 const IMAGE_DIGEST = /^sha256:[a-f0-9]{64}$/;
 const COMMIT = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
@@ -144,23 +206,43 @@ const packageRegistryInput =
 const localFederated =
   process.env.GITHUB_ACTIONS !== 'true' &&
   process.env.EBK_LOCAL_DEPLOYMENT_MODE === 'federated';
-if (localFederated) {
-  const policy = JSON.parse(
-    readFileSync(join(repositoryRoot, 'ebk.repository-policy.json'), 'utf8'),
+const localRunId = process.env.EBK_LOCAL_CONTAINER_RUN_ID?.trim() ?? '';
+const policy = JSON.parse(
+  readFileSync(join(repositoryRoot, 'ebk.repository-policy.json'), 'utf8'),
+);
+const selectedDeploymentProfile =
+  process.env.EBK_DEPLOYMENT_PROFILE?.trim() ?? '';
+const activeStages = {
+  starter: ['development', 'production'],
+  'production-isolated': ['development', 'staging', 'production'],
+  'fully-isolated': ['development', 'staging', 'production'],
+}[policy.deploymentProfile];
+const locallyAdmittedStages = {
+    starter: ['development', 'production'],
+    'production-isolated': ['development', 'staging'],
+    'fully-isolated': ['development'],
+  }[policy.deploymentProfile];
+if (
+  selectedDeploymentProfile !== policy.deploymentProfile ||
+  !activeStages ||
+  !activeStages.includes(stage) ||
+  policy.deploymentAccounts?.[stage] !== accountId ||
+  policy.deploymentRegion !== region
+) {
+  throw new Error(
+    'Container release requires the exact committed profile, active stage, account, and Region.',
+  );
+}
+if (
+  localFederated &&
+  (!locallyAdmittedStages || !locallyAdmittedStages.includes(stage))
+) {
+  throw new Error(
+    'Local container release requires one of the committed profile locally admitted stages.',
   );
-  if (
-    policy.deploymentProfile !== 'starter' ||
-    stage === 'production' ||
-    policy.deploymentAccounts?.[stage] !== accountId ||
-    policy.deploymentRegion !== region
-  ) {
-    throw new Error(
-      'Local container release requires a locally admitted exact starter deployment target; production requires protected GitHub authority.',
-    );
-  }
 }
 const runId = localFederated
-  ? (BigInt('0x' + sourceCommit.slice(0, 15)) + 1n).toString()
+  ? localRunId
   : process.env.GITHUB_RUN_ID?.trim() ?? '';
 const runAttempt = localFederated
   ? '1'
@@ -359,12 +441,657 @@ const execute = (command, args, label, options = {}) => {
       stdio: ['pipe', 'pipe', 'pipe'],
     });
   } catch (error) {
+    if (options.failureDiagnostics === 'bounded-closure') {
+      const diagnosticStream = (value) => {
+        const raw = value === undefined || value === null ? '' : String(value);
+        if (raw.length === 0) return '[empty]';
+        if (hasSensitiveSupplyChainShape(raw)) {
+          return '[redacted-sensitive-output]';
+        }
+        const bytes = Buffer.from(raw, 'utf8');
+        const truncated = bytes.byteLength > 1_024;
+        const tail = truncated
+          ? bytes.subarray(bytes.byteLength - 1_024).toString('utf8')
+          : raw;
+        return JSON.stringify((truncated ? '[truncated]\\n' : '') + tail);
+      };
+      const status = Number.isSafeInteger(error?.status)
+        ? String(error.status)
+        : 'unavailable';
+      const signal =
+        typeof error?.signal === 'string' && /^[A-Z0-9]+$/.test(error.signal)
+          ? error.signal
+          : 'none';
+      throw new Error(
+        label +
+          ' failed without complete evidence: ' +
+          'status=' +
+          status +
+          '; signal=' +
+          signal +
+          '; stdout=' +
+          diagnosticStream(error?.stdout) +
+          '; stderr=' +
+          diagnosticStream(error?.stderr),
+      );
+    }
     throw new Error(
       label + ' failed without complete evidence: ' +
         String(error?.stderr ?? error?.message ?? error).slice(0, 2_000),
     );
   }
 };
+let releaseBuilder;
+let releaseBuildChild;
+let releaseBuildStopPromise;
+let releaseBuilderSignal;
+const releaseBuilderSignalHandlers = new Map();
+const releaseToolTemporaryDirectories = new Set();
+const yieldToReleaseSignals = () =>
+  new Promise((resolve) => setImmediate(resolve));
+const stopExactReleaseBuildChild = async (signal = 'SIGTERM') => {
+  if (releaseBuildStopPromise) return releaseBuildStopPromise;
+  const observed = releaseBuildChild;
+  if (!observed) return;
+  releaseBuildStopPromise = (async () => {
+    const child = observed.child;
+    if (hostOperatingSystem() === 'win32') {
+      const taskkill = join(process.env.SystemRoot ?? '', 'System32', 'taskkill.exe');
+      if (!isAbsolute(taskkill) || !existsSync(taskkill) || realpathSync(taskkill) !== taskkill) {
+        throw new Error('Exact Windows Buildx cleanup requires canonical SystemRoot.');
+      }
+      const stopped = spawnSync(
+        taskkill,
+        ['/PID', String(child.pid), '/T', '/F'],
+        {
+          cwd: repositoryRoot,
+          encoding: 'utf8',
+          env: process.env,
+          maxBuffer: 1024 * 1024,
+          stdio: ['ignore', 'pipe', 'pipe'],
+          windowsHide: true,
+        },
+      );
+      if (
+        child.exitCode === null &&
+        (stopped.error || stopped.signal || stopped.status !== 0)
+      ) {
+        throw new Error('Exact Windows Buildx process-tree cleanup failed.');
+      }
+    } else if (child.pid) {
+      try {
+        process.kill(-child.pid, signal);
+      } catch (error) {
+        if (error?.code !== 'ESRCH') throw error;
+      }
+    }
+    if (child.exitCode === null) {
+      const closed = await Promise.race([
+        observed.close.then(() => true),
+        new Promise((resolve) => setTimeout(() => resolve(false), 5_000)),
+      ]);
+      if (!closed && hostOperatingSystem() !== 'win32' && child.pid) {
+        try {
+          process.kill(-child.pid, 'SIGKILL');
+        } catch (error) {
+          if (error?.code !== 'ESRCH') throw error;
+        }
+        const killed = await Promise.race([
+          observed.close.then(() => true),
+          new Promise((resolve) => setTimeout(() => resolve(false), 5_000)),
+        ]);
+        if (!killed) {
+          throw new Error('Exact Buildx process group did not terminate.');
+        }
+      }
+    }
+  })().finally(() => {
+    if (releaseBuildChild === observed) releaseBuildChild = undefined;
+    releaseBuildStopPromise = undefined;
+  });
+  return releaseBuildStopPromise;
+};
+const executeObservedBuildx = async (args, label) => {
+  if (releaseBuildChild) {
+    throw new Error('Only one invocation-owned Buildx child may run at a time.');
+  }
+  const child = spawn('docker', args, {
+    cwd: repositoryRoot,
+    detached: hostOperatingSystem() !== 'win32',
+    env: process.env,
+    stdio: ['ignore', 'pipe', 'pipe'],
+    windowsHide: true,
+  });
+  const stdout = [];
+  const stderr = [];
+  let outputBytes = 0;
+  const retain = (chunks, stream, chunk) => {
+    outputBytes += chunk.byteLength;
+    if (outputBytes > MAX_OUTPUT_BYTES) {
+      void stopExactReleaseBuildChild('SIGTERM');
+      return;
+    }
+    chunks.push(chunk);
+    stream.write(chunk);
+  };
+  child.stdout.on('data', (chunk) => retain(stdout, process.stdout, chunk));
+  child.stderr.on('data', (chunk) => retain(stderr, process.stderr, chunk));
+  const close = new Promise((resolve) => {
+    child.once('error', (error) => resolve({ error }));
+    child.once('close', (status, signal) => resolve({ signal, status }));
+  });
+  releaseBuildChild = { child, close };
+  const result = await close;
+  await stopExactReleaseBuildChild();
+  if (
+    outputBytes > MAX_OUTPUT_BYTES ||
+    result.error ||
+    result.signal ||
+    result.status !== 0
+  ) {
+    throw new Error(
+      label + ' failed without complete evidence: ' +
+        Buffer.concat(stderr).toString('utf8').slice(-2_000),
+    );
+  }
+  return Buffer.concat(stdout).toString('utf8');
+};
+const runWindowsPrivateAcl = (script, path, kind) => {
+  const systemRoot = process.env.SystemRoot;
+  if (!systemRoot || !isAbsolute(systemRoot)) {
+    throw new Error('Windows private-path hardening requires an absolute SystemRoot.');
+  }
+  const powershell = join(
+    systemRoot,
+    'System32',
+    'WindowsPowerShell',
+    'v1.0',
+    'powershell.exe',
+  );
+  const result = spawnSync(
+    powershell,
+    [
+      '-NoLogo',
+      '-NoProfile',
+      '-NonInteractive',
+      '-EncodedCommand',
+      Buffer.from(script, 'utf16le').toString('base64'),
+    ],
+    {
+      cwd: repositoryRoot,
+      encoding: 'utf8',
+      env: {
+        ...process.env,
+        EBK_PRIVATE_KIND: kind,
+        EBK_PRIVATE_PATH: path,
+      },
+      maxBuffer: 1024 * 1024,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      timeout: 15_000,
+      windowsHide: true,
+    },
+  );
+  if (result.error || result.signal || result.status !== 0) {
+    throw new Error(
+      'Windows private-path ACL operation failed closed: ' +
+        String(result.stderr || result.error?.message || result.signal || result.status)
+          .slice(-2_000),
+    );
+  }
+};
+const assertPrivateReleaseBuilderPathIdentity = (path, kind) => {
+  const metadata = lstatSync(path);
+  if (
+    metadata.isSymbolicLink() ||
+    (kind === 'directory' ? !metadata.isDirectory() : !metadata.isFile()) ||
+    realpathSync(path) !== path
+  ) {
+    throw new Error(
+      'Container-release builder ownership path failed canonical type validation.',
+    );
+  }
+  return metadata;
+};
+const assertPrivateReleaseBuilderPath = (path, kind) => {
+  const metadata = assertPrivateReleaseBuilderPathIdentity(path, kind);
+  if (hostOperatingSystem() === 'win32') {
+    runWindowsPrivateAcl(WINDOWS_ASSERT_PRIVATE_ACL, path, kind);
+    return metadata;
+  }
+  const expectedMode = kind === 'directory' ? 0o700 : 0o600;
+  if (
+    (metadata.mode & 0o777) !== expectedMode ||
+    (typeof process.getuid === 'function' && metadata.uid !== process.getuid())
+  ) {
+    throw new Error(
+      'Container-release builder ownership path is not current-user private.',
+    );
+  }
+  return metadata;
+};
+const hardenPrivateReleaseBuilderPath = (path, kind) => {
+  assertPrivateReleaseBuilderPathIdentity(path, kind);
+  if (hostOperatingSystem() === 'win32') {
+    runWindowsPrivateAcl(WINDOWS_HARDEN_PRIVATE_ACL, path, kind);
+  } else {
+    chmodSync(path, kind === 'directory' ? 0o700 : 0o600);
+  }
+  return assertPrivateReleaseBuilderPath(path, kind);
+};
+const assertCanonicalAncestorsBeforeCreate = (requested) => {
+  const requestedRelative = relative(repositoryRoot, requested);
+  if (
+    requestedRelative === '' ||
+    requestedRelative === '..' ||
+    requestedRelative.startsWith('..' + sep) ||
+    isAbsolute(requestedRelative)
+  ) {
+    throw new Error('Container-release builder ownership path escapes its repository.');
+  }
+  let cursor = repositoryRoot;
+  for (const segment of requestedRelative.split(sep)) {
+    cursor = join(cursor, segment);
+    if (!existsSync(cursor)) break;
+    const metadata = lstatSync(cursor);
+    if (metadata.isSymbolicLink() || realpathSync(cursor) !== cursor) {
+      throw new Error(
+        'Container-release builder ownership path has a symbolic or noncanonical ancestor.',
+      );
+    }
+  }
+};
+const releaseBuilderLeaseRoot = () => {
+  const requested = resolve(
+    repositoryRoot,
+    '.ebk/cache/container-release-builders',
+  );
+  assertCanonicalAncestorsBeforeCreate(requested);
+  mkdirSync(requested, { mode: 0o700, recursive: true });
+  hardenPrivateReleaseBuilderPath(requested, 'directory');
+  const canonical = realpathSync(requested);
+  if (canonical !== requested) {
+    throw new Error(
+      'Container-release builder leases require one repository-private owned directory.',
+    );
+  }
+  return canonical;
+};
+const readReleaseBuilderLease = (leasePath, expectedName) => {
+  const metadata = assertPrivateReleaseBuilderPath(leasePath, 'file');
+  if (
+    metadata.nlink !== 1 ||
+    metadata.size < 2 ||
+    metadata.size > 16 * 1024
+  ) {
+    throw new Error('Container-release builder lease is not one private file.');
+  }
+  let lease;
+  try {
+    lease = JSON.parse(readFileSync(leasePath, 'utf8'));
+  } catch {
+    throw new Error('Container-release builder lease is invalid JSON.');
+  }
+  const keys = Object.keys(lease ?? {}).sort();
+  if (
+    JSON.stringify(keys) !==
+      JSON.stringify([
+        'builder',
+        'cleanup',
+        'createdAt',
+        'driver',
+        'kind',
+        'ownerPid',
+        'schemaVersion',
+      ]) ||
+    lease.kind !== 'ebk-container-release-builder-lease' ||
+    lease.schemaVersion !== 1 ||
+    lease.builder !== expectedName ||
+    !/^ebk-release-[a-f0-9]{32}$/.test(lease.builder) ||
+    lease.driver !== 'docker-container' ||
+    JSON.stringify(lease.cleanup) !==
+      JSON.stringify(['docker', 'buildx', 'rm', lease.builder]) ||
+    !Number.isSafeInteger(lease.ownerPid) ||
+    lease.ownerPid <= 0 ||
+    !Number.isFinite(Date.parse(lease.createdAt)) ||
+    new Date(lease.createdAt).toISOString() !== lease.createdAt
+  ) {
+    throw new Error('Container-release builder lease has an invalid identity.');
+  }
+  return lease;
+};
+const removeReleaseBuilderSignalHandlers = () => {
+  for (const [signal, handler] of releaseBuilderSignalHandlers) {
+    process.removeListener(signal, handler);
+  }
+  releaseBuilderSignalHandlers.clear();
+};
+const ensureReleaseBuilderSignalHandlers = () => {
+  if (releaseBuilderSignalHandlers.size > 0) return;
+  for (const signal of ['SIGINT', 'SIGTERM']) {
+    const handler = () => void handleReleaseBuilderSignal(signal);
+    releaseBuilderSignalHandlers.set(signal, handler);
+    process.on(signal, handler);
+  }
+};
+const removeReleaseBuilderSignalHandlersWhenIdle = () => {
+  if (!releaseBuilder && releaseToolTemporaryDirectories.size === 0) {
+    removeReleaseBuilderSignalHandlers();
+  }
+};
+const createReleaseToolTemporaryDirectory = (prefix) => {
+  const created = mkdtempSync(join(tmpdir(), prefix));
+  const metadata = lstatSync(created);
+  if (
+    !metadata.isDirectory() ||
+    metadata.isSymbolicLink() ||
+    !isAbsolute(created)
+  ) {
+    throw new Error('Container-release tool temporary directory is not exact.');
+  }
+  const temporary = realpathSync(created);
+  const canonicalMetadata = lstatSync(temporary);
+  if (
+    !isAbsolute(temporary) ||
+    !canonicalMetadata.isDirectory() ||
+    canonicalMetadata.isSymbolicLink() ||
+    canonicalMetadata.dev !== metadata.dev ||
+    canonicalMetadata.ino !== metadata.ino
+  ) {
+    throw new Error('Container-release tool temporary directory is not canonical.');
+  }
+  releaseToolTemporaryDirectories.add(temporary);
+  ensureReleaseBuilderSignalHandlers();
+  return temporary;
+};
+const removeExactReleaseToolTemporaryDirectory = (temporary) => {
+  if (!releaseToolTemporaryDirectories.has(temporary)) {
+    throw new Error('Container-release tool temporary directory is not owned.');
+  }
+  const metadata = lstatSync(temporary);
+  if (
+    !metadata.isDirectory() ||
+    metadata.isSymbolicLink() ||
+    !isAbsolute(temporary) ||
+    realpathSync(temporary) !== temporary
+  ) {
+    throw new Error(
+      'Container-release tool temporary directory changed identity before cleanup.',
+    );
+  }
+  rmSync(temporary, { force: true, recursive: true });
+  if (existsSync(temporary)) {
+    throw new Error('Container-release tool temporary directory cleanup failed.');
+  }
+  releaseToolTemporaryDirectories.delete(temporary);
+  removeReleaseBuilderSignalHandlersWhenIdle();
+};
+const removeAllReleaseToolTemporaryDirectories = () => {
+  const cleanupErrors = [];
+  for (const temporary of [...releaseToolTemporaryDirectories]) {
+    try {
+      removeExactReleaseToolTemporaryDirectory(temporary);
+    } catch (error) {
+      cleanupErrors.push(error);
+    }
+  }
+  if (cleanupErrors.length > 0) {
+    throw new AggregateError(
+      cleanupErrors,
+      'Exact container-release tool temporary cleanup failed.',
+    );
+  }
+};
+const releaseBuilderCleanupDiagnostic = (builder) =>
+  'docker buildx rm ' + builder.name +
+  ' (ownership lease: ' + builder.leasePath + ')';
+const listExactReleaseBuilderNames = ({ signal } = {}) => {
+  const inventory = spawnSync(
+    'docker',
+    ['buildx', 'ls', '--format', '{{json .Name}}'],
+    {
+      cwd: repositoryRoot,
+      encoding: 'utf8',
+      env: process.env,
+      maxBuffer: 1024 * 1024,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      timeout: signal ? 5_000 : undefined,
+    },
+  );
+  if (inventory.error || inventory.signal || inventory.status !== 0) {
+    throw new Error(
+      'Invocation-owned Buildx inventory failed while proving exact cleanup: ' +
+        String(
+          inventory.stderr ||
+            inventory.error?.message ||
+            inventory.signal ||
+            inventory.status,
+        ).slice(-2_000),
+    );
+  }
+  const lines = inventory.stdout.trim() === ''
+    ? []
+    : inventory.stdout.trim().split(/\\r?\\n/u);
+  if (lines.length > 256) {
+    throw new Error('Invocation-owned Buildx inventory is unbounded.');
+  }
+  const names = new Set();
+  for (const line of lines) {
+    let name;
+    try {
+      name = JSON.parse(line);
+    } catch {
+      throw new Error('Invocation-owned Buildx inventory is not exact JSON.');
+    }
+    if (
+      typeof name !== 'string' ||
+      name.length === 0 ||
+      name.length > 256 ||
+      names.has(name)
+    ) {
+      throw new Error('Invocation-owned Buildx inventory has an invalid identity.');
+    }
+    names.add(name);
+  }
+  return names;
+};
+const removeExactReleaseBuilder = (builder, { signal } = {}) => {
+  readReleaseBuilderLease(builder.leasePath, builder.name);
+  const cleanup = spawnSync(
+    'docker',
+    ['buildx', 'rm', builder.name],
+    {
+      cwd: repositoryRoot,
+      encoding: 'utf8',
+      env: process.env,
+      maxBuffer: 1024 * 1024,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      timeout: signal ? 5_000 : undefined,
+    },
+  );
+  if (cleanup.error || cleanup.signal || cleanup.status !== 0) {
+    let builderNames;
+    try {
+      builderNames = listExactReleaseBuilderNames({ signal });
+    } catch (inventoryError) {
+      const error = new AggregateError(
+        [
+          cleanup.error ?? new Error(String(cleanup.stderr || cleanup.status)),
+          inventoryError,
+        ],
+        'Invocation-owned Buildx cleanup and exact absence proof both failed; ' +
+          'retain ' + releaseBuilderCleanupDiagnostic(builder) + '.',
+      );
+      if (signal) {
+        process.stderr.write(error.message + '\\n');
+        return false;
+      }
+      throw error;
+    }
+    if (!builderNames.has(builder.name)) {
+      unlinkSync(builder.leasePath);
+      process.stderr.write(
+        'ebk-release-builder-already-absent ' +
+          JSON.stringify({ builder: builder.name, leasePath: builder.leasePath }) +
+          '\\n',
+      );
+      return true;
+    }
+    const diagnostic = [cleanup.stdout, cleanup.stderr]
+      .filter(Boolean)
+      .join('\\n')
+      .slice(-2_000);
+    const error = new Error(
+      'Invocation-owned Buildx cleanup failed; use only the exact retained ' +
+        'hard-kill cleanup command ' + releaseBuilderCleanupDiagnostic(builder) +
+        (diagnostic ? ': ' + diagnostic : ''),
+    );
+    if (signal) {
+      process.stderr.write(error.message + '\\n');
+      return false;
+    }
+    throw error;
+  }
+  unlinkSync(builder.leasePath);
+  return true;
+};
+const recoverReleaseBuilders = () => {
+  const leaseRoot = releaseBuilderLeaseRoot();
+  const entries = readdirSync(leaseRoot, { withFileTypes: true }).sort(
+    (left, right) =>
+      left.name < right.name ? -1 : left.name > right.name ? 1 : 0,
+  );
+  if (entries.length > 64) {
+    throw new Error('Container-release builder lease inventory is unbounded.');
+  }
+  for (const entry of entries) {
+    const matched = /^(ebk-release-[a-f0-9]{32})\\.json$/.exec(entry.name);
+    if (!entry.isFile() || !matched) {
+      throw new Error(
+        'Container-release builder lease directory contains an unexpected entry.',
+      );
+    }
+    const leasePath = join(leaseRoot, entry.name);
+    const lease = readReleaseBuilderLease(leasePath, matched[1]);
+    const builderNames = listExactReleaseBuilderNames();
+    if (builderNames.has(lease.builder)) {
+      throw new Error(
+        'A retained invocation-owned Buildx builder still exists; inspect it and use only the exact cleanup command ' +
+          releaseBuilderCleanupDiagnostic({ leasePath, name: lease.builder }) + '.',
+      );
+    }
+    unlinkSync(leasePath);
+    process.stderr.write(
+      'ebk-release-builder-recovered ' +
+        JSON.stringify({ builder: lease.builder, leasePath }) +
+        '\\n',
+    );
+  }
+};
+const cleanupReleaseBuilder = ({ signal } = {}) => {
+  const builder = releaseBuilder;
+  if (!builder) {
+    removeReleaseBuilderSignalHandlersWhenIdle();
+    return;
+  }
+  releaseBuilder = undefined;
+  const removed = removeExactReleaseBuilder(builder, { signal });
+  removeReleaseBuilderSignalHandlersWhenIdle();
+  return removed;
+};
+const handleReleaseBuilderSignal = async (signal) => {
+  if (releaseBuilderSignal) return;
+  releaseBuilderSignal = signal;
+  removeReleaseBuilderSignalHandlers();
+  const cleanupErrors = [];
+  let childStopped = false;
+  try {
+    await stopExactReleaseBuildChild(signal);
+    childStopped = true;
+  } catch (error) {
+    cleanupErrors.push(error);
+  }
+  if (childStopped) {
+    try {
+      cleanupReleaseBuilder({ signal });
+    } catch (error) {
+      cleanupErrors.push(error);
+    }
+  }
+  try {
+    removeAllReleaseToolTemporaryDirectories();
+  } catch (error) {
+    cleanupErrors.push(error);
+  }
+  if (cleanupErrors.length > 0) {
+    process.stderr.write(
+      'Invocation-owned Buildx signal cleanup failed closed; the exact ' +
+        'ownership lease was retained: ' +
+        cleanupErrors
+          .map((error) => String(error?.message ?? error))
+          .join('; ')
+          .slice(-2_000) + '\\n',
+    );
+  }
+  try {
+    removeReleaseBuilderSignalHandlers();
+  } finally {
+    process.kill(process.pid, signal);
+  }
+};
+const ensureReleaseBuilder = () => {
+  if (releaseBuilder) return releaseBuilder;
+  const name = 'ebk-release-' + randomBytes(16).toString('hex');
+  const leaseRoot = releaseBuilderLeaseRoot();
+  const leasePath = join(leaseRoot, name + '.json');
+  const builder = {
+    leasePath,
+    leaseRoot,
+    name,
+  };
+  writeFileSync(
+    leasePath,
+    JSON.stringify({
+      builder: name,
+      cleanup: ['docker', 'buildx', 'rm', name],
+      createdAt: new Date().toISOString(),
+      driver: 'docker-container',
+      kind: 'ebk-container-release-builder-lease',
+      ownerPid: process.pid,
+      schemaVersion: 1,
+    }) + '\\n',
+    { encoding: 'utf8', flag: 'wx', mode: 0o600 },
+  );
+  hardenPrivateReleaseBuilderPath(leasePath, 'file');
+  releaseBuilder = builder;
+  ensureReleaseBuilderSignalHandlers();
+  process.stderr.write(
+    'ebk-release-builder-ownership ' +
+      JSON.stringify({
+        builder: name,
+        hardKillCleanup: ['docker', 'buildx', 'rm', name],
+        leasePath,
+      }) +
+      '\\n',
+  );
+  try {
+    execute(
+      'docker',
+      ['buildx', 'create', '--name', name, '--driver', 'docker-container'],
+      'Invocation-owned native Buildx builder creation',
+    );
+  } catch (error) {
+    try {
+      cleanupReleaseBuilder();
+    } catch (cleanupError) {
+      throw new AggregateError(
+        [error, cleanupError],
+        'Invocation-owned Buildx creation and cleanup both failed.',
+      );
+    }
+    throw error;
+  }
+  return builder;
+};
 const awsJson = (args, label) => {
   const raw = execute('aws', args, label);
   try {
@@ -419,6 +1146,18 @@ const caller = awsJson(
 if (caller?.Account !== accountId) {
   throw new Error('Container release AWS caller differs from the target account.');
 }
+execute(
+  process.execPath,
+  [
+    safePath(
+      'tools/stage-authority-render.mjs',
+      'Workspace ownership doctor',
+    ),
+    '--stage=' + stage,
+    '--ownership-doctor=true',
+  ],
+  'Workspace stage ownership',
+);
 const controls = readJson(
   safePath('operations/release.json', 'Release controls', { base: sliceRoot }),
   'Release controls',
@@ -760,7 +1499,8 @@ const acquireSyft = async () => {
   if (!release) {
     throw new Error('No reviewed Syft release exists for ' + platformKey + '.');
   }
-  const temporary = mkdtempSync(join(tmpdir(), 'ebk-container-syft-'));
+  const temporary = createReleaseToolTemporaryDirectory('ebk-container-syft-');
+  try {
   const supplied = process.env.EBK_SYFT_ARCHIVE_PATH?.trim();
   const archive = supplied
     ? safePath(relative(repositoryRoot, resolve(repositoryRoot, supplied)), 'Supplied Syft archive')
@@ -798,6 +1538,7 @@ const acquireSyft = async () => {
     chmodSync(path, 0o700);
   }
   const version = String(execute(path, ['version'], 'Syft version'));
+  await yieldToReleaseSignals();
   if (
     !new RegExp('(?:Version|version):?\\\\s*' + SYFT_VERSION.replaceAll('.', '\\\\.')).test(
       version,
@@ -805,7 +1546,18 @@ const acquireSyft = async () => {
   ) {
     throw new Error('Syft runtime version differs from reviewed policy.');
   }
-  return { path, temporary };
+    return { path, temporary };
+  } catch (error) {
+    try {
+      removeExactReleaseToolTemporaryDirectory(temporary);
+    } catch (cleanupError) {
+      throw new AggregateError(
+        [error, cleanupError],
+        'Syft acquisition and exact temporary cleanup both failed.',
+      );
+    }
+    throw error;
+  }
 };
 const acquireCrane = async () => {
   const platformKey = process.platform + '-' + process.arch;
@@ -813,7 +1565,8 @@ const acquireCrane = async () => {
   if (!release) {
     throw new Error('No reviewed Crane release exists for ' + platformKey + '.');
   }
-  const temporary = mkdtempSync(join(tmpdir(), 'ebk-container-crane-'));
+  const temporary = createReleaseToolTemporaryDirectory('ebk-container-crane-');
+  try {
   const supplied = process.env.EBK_CRANE_ARCHIVE_PATH?.trim();
   const archive = supplied
     ? safePath(
@@ -850,6 +1603,7 @@ const acquireCrane = async () => {
   const path = join(temporary, 'crane');
   chmodSync(path, 0o700);
   const version = String(execute(path, ['version'], 'Crane version')).trim();
+  await yieldToReleaseSignals();
   if (
     !new RegExp('(?:^|\\s|v)' + CRANE_VERSION.replaceAll('.', '\\.') + '(?:$|\\s)').test(
       version,
@@ -857,7 +1611,18 @@ const acquireCrane = async () => {
   ) {
     throw new Error('Crane runtime version differs from reviewed policy.');
   }
-  return { path, temporary };
+    return { path, temporary };
+  } catch (error) {
+    try {
+      removeExactReleaseToolTemporaryDirectory(temporary);
+    } catch (cleanupError) {
+      throw new AggregateError(
+        [error, cleanupError],
+        'Crane acquisition and exact temporary cleanup both failed.',
+      );
+    }
+    throw error;
+  }
 };
 const parseCycloneDx = (value, label) => {
   if (
@@ -957,8 +1722,8 @@ const npmClosureFor = (syftDocument, options = {}) => {
   }
   return unique;
 };
-const deriveExpectedProductionClosure = (syft, input) => {
-  const temporary = mkdtempSync(join(tmpdir(), 'ebk-container-closure-'));
+const deriveExpectedProductionClosure = async (syft, input) => {
+  const temporary = createReleaseToolTemporaryDirectory('ebk-container-closure-');
   const deployed = join(temporary, 'deployed');
   try {
     execute(
@@ -977,16 +1742,24 @@ const deriveExpectedProductionClosure = (syft, input) => {
         deployed,
       ],
       'Independent production closure deployment',
-      { env: { COREPACK_ENABLE_DOWNLOAD_PROMPT: '0' } },
+      {
+        env: { COREPACK_ENABLE_DOWNLOAD_PROMPT: '0' },
+        failureDiagnostics: 'bounded-closure',
+      },
     );
+    await yieldToReleaseSignals();
     const raw = String(
       execute(
         syft.path,
         ['scan', 'dir:' + deployed, '--output', 'syft-json'],
         'Independent production closure inventory',
-        { env: { SYFT_CHECK_FOR_APP_UPDATE: 'false' } },
+        {
+          env: { SYFT_CHECK_FOR_APP_UPDATE: 'false' },
+          failureDiagnostics: 'bounded-closure',
+        },
       ),
     );
+    await yieldToReleaseSignals();
     let inventory;
     try {
       inventory = JSON.parse(raw);
@@ -1041,7 +1814,7 @@ const deriveExpectedProductionClosure = (syft, input) => {
     }
     return { digest: supplyChainDigest(packages), packages };
   } finally {
-    rmSync(temporary, { force: true, recursive: true });
+    removeExactReleaseToolTemporaryDirectory(temporary);
   }
 };
 const validateRetainedSbom = (entry, label) => {
@@ -1719,6 +2492,7 @@ if (mode === 'promote') {
     slice,
     'binding.json',
   );
+  await yieldToReleaseSignals();
   immutableWrite(output, binding);
   process.stdout.write(
     JSON.stringify({
@@ -1731,21 +2505,26 @@ if (mode === 'promote') {
     }) + '\\n',
   );
   } finally {
-    rmSync(crane.temporary, { force: true, recursive: true });
+    removeExactReleaseToolTemporaryDirectory(crane.temporary);
   }
   process.exit(0);
 }
 
 if (mode === 'platform') {
-  const syft = await acquireSyft();
-  const crane = stage === 'development' ? await acquireCrane() : undefined;
+  let syft;
+  let crane;
+  let platformError;
   try {
-    const expectedClosures = new Map(
-      containerInputs.map((input) => [
+    syft = await acquireSyft();
+    crane = stage === 'development' ? await acquireCrane() : undefined;
+    recoverReleaseBuilders();
+    const expectedClosures = new Map();
+    for (const input of containerInputs) {
+      expectedClosures.set(
         input.declared.id,
-        deriveExpectedProductionClosure(syft, input),
-      ]),
-    );
+        await deriveExpectedProductionClosure(syft, input),
+      );
+    }
     requireReviewedCheckout();
     for (const input of containerInputs) requireCandidateAuthority(input);
     login();
@@ -1788,11 +2567,13 @@ if (mode === 'platform') {
           'Exact staging retirement child promotion',
         );
       } else {
-        execute(
-          'docker',
-          [
+        const platformBuilder = ensureReleaseBuilder();
+        try {
+          await executeObservedBuildx([
             'buildx',
             'build',
+            '--builder',
+            platformBuilder.name,
             ...(packageRegistry
               ? [
                   '--build-arg',
@@ -1814,9 +2595,10 @@ if (mode === 'platform') {
             '--tag',
             taggedReference,
             relative(repositoryRoot, input.context) || '.',
-          ],
-          'Native container build and push',
-        );
+          ], 'Native container build and push');
+        } finally {
+          cleanupReleaseBuilder();
+        }
       }
       const imageDigest = exactImageByTag(repositoryName, tag);
       const imageReference = registry + '/' + repositoryName + '@' + imageDigest;
@@ -1991,6 +2773,7 @@ if (mode === 'platform') {
         evidence,
       );
     }
+    await yieldToReleaseSignals();
     process.stdout.write(
       JSON.stringify({
         artifactCount: containerInputs.length,
@@ -1999,12 +2782,33 @@ if (mode === 'platform') {
         stage,
       }) + '\\n',
     );
+  } catch (error) {
+    platformError = error;
   } finally {
-    rmSync(syft.temporary, { force: true, recursive: true });
-    if (crane) {
-      rmSync(crane.temporary, { force: true, recursive: true });
+    const cleanupErrors = [];
+    for (const cleanup of [
+      () => cleanupReleaseBuilder(),
+      ...(syft
+        ? [() => removeExactReleaseToolTemporaryDirectory(syft.temporary)]
+        : []),
+      ...(crane
+        ? [() => removeExactReleaseToolTemporaryDirectory(crane.temporary)]
+        : []),
+    ]) {
+      try {
+        cleanup();
+      } catch (error) {
+        cleanupErrors.push(error);
+      }
+    }
+    if (cleanupErrors.length > 0) {
+      throw new AggregateError(
+        [...(platformError ? [platformError] : []), ...cleanupErrors],
+        'Container platform release and independent owned-resource cleanup failed.',
+      );
     }
   }
+  if (platformError) throw platformError;
   process.exit(0);
 }
 
@@ -2216,6 +3020,7 @@ const output = resolve(
   slice,
   'binding.json',
 );
+await yieldToReleaseSignals();
 immutableWrite(output, binding);
 process.stdout.write(
   JSON.stringify({
@@ -2228,7 +3033,7 @@ process.stdout.write(
 );
 } finally {
   if (assemblyCrane) {
-    rmSync(assemblyCrane.temporary, { force: true, recursive: true });
+    removeExactReleaseToolTemporaryDirectory(assemblyCrane.temporary);
   }
 }
 `;