@empire-builder-kit/nx 1.0.0-rc.31 → 1.0.0-rc.32

package/src/generators/preset/workspace-files.js

@@ -173,6 +173,49 @@ const TOOL_VERSIONS = {
 function json(value) {
     return `${JSON.stringify(value, null, 2)}\n`;
 }
+function indentWorkflowScript(source, spaces) {
+    const prefix = ' '.repeat(spaces);
+    return source
+        .trim()
+        .split('\n')
+        .map((line) => `${prefix}${line}`)
+        .join('\n');
+}
+function protectedSecretPolicyDerivationScript() {
+    return `node --input-type=module <<'NODE'
+import { appendFileSync } from 'node:fs';
+import {
+  configuredDeploymentAccountTopology,
+  configuredDeploymentRegion,
+  isActiveDeploymentStage,
+  readRepositoryOperatingPolicy,
+} from '@empire-builder-kit/nx/repository-policy';
+
+const output = process.env.GITHUB_OUTPUT?.trim() ?? '';
+const renderedProfile = process.env.EBK_RENDERED_PROFILE?.trim() ?? '';
+const stage = process.env.EBK_STAGE?.trim() ?? '';
+if (!output) throw new Error('Secret workflow authority output is unavailable.');
+const policy = readRepositoryOperatingPolicy(process.cwd());
+if (policy.deploymentProfile !== renderedProfile) {
+  throw new Error('Generated and committed deployment profiles differ.');
+}
+if (!isActiveDeploymentStage(policy.deploymentProfile, stage)) {
+  throw new Error('Secret workflow stage is inactive for the committed deployment profile.');
+}
+const accounts = configuredDeploymentAccountTopology(
+  policy.deploymentProfile,
+  policy.deploymentAccounts,
+);
+const region = configuredDeploymentRegion(policy.deploymentRegion);
+appendFileSync(output, [
+  'deployment_region=' + region,
+  'development_account_id=' + accounts.development,
+  'staging_account_id=' + (accounts.staging ?? ''),
+  'production_account_id=' + accounts.production,
+  '',
+].join('\\n'));
+NODE`;
+}
 function planApplicationBindingCheck() {
     return `          node - <<'NODE'
           const declared = JSON.parse(process.env.AWS_PLAN_SST_APPS_JSON ?? '');
@@ -1017,6 +1060,7 @@ const WORKSPACE_SEEDED_PATHS = new Set([
     'docs/git-workflow.md',
     'docs/repository-operating-policy.md',
     'docs/stage-deployment-authority.md',
+    'docs/workspace-deployment-ownership.md',
     'docs/work-markers.md',
     'ebk.repository-policy.json',
 ]);
@@ -1136,7 +1180,9 @@ function renderWorkspaceFiles(options) {
         : protectedWorkflowStageChoices;
     const rehearsalStage = (0, index_js_4.productionRehearsalStage)(deploymentProfile);
     const protectedWorkflowStageBranchCases = `${rehearsalStage}:refs/heads/develop|production:refs/heads/main`;
-    const initialRepositoryPolicy = (0, index_js_4.createIncubationRepositoryPolicy)(deploymentProfile);
+    const workspaceDeploymentId = options.workspaceDeploymentId ??
+        `ebkws-${(0, index_js_1.hashGeneratedContent)(`workspace-deployment-id:${name}`).slice(0, 32)}`;
+    const initialRepositoryPolicy = (0, index_js_4.createIncubationRepositoryPolicy)(deploymentProfile, workspaceDeploymentId);
     initialRepositoryPolicy.deploymentAccounts = options.deploymentAccounts ?? {
         development: null,
         production: null,
@@ -7131,11 +7177,9 @@ jobs:
       contents: read
       id-token: write
     env:
-      AWS_DEPLOY_ROLE_ARN: \${{ secrets.AWS_DEPLOY_ROLE_ARN }}
-      AWS_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_EXPECTED_ACCOUNT_ID }}
-      AWS_REGION: \${{ vars.AWS_REGION }}
       EBK_ACTION: \${{ inputs.action }}
       EBK_PROJECT: \${{ inputs.project }}
+      EBK_RENDERED_PROFILE: ${deploymentProfile}
       EBK_STAGE: \${{ inputs.stage }}
     runs-on: ubuntu-latest
     steps:
@@ -7150,13 +7194,6 @@ jobs:
           case "$EBK_PROJECT" in
             ''|-*|*-|*[!a-z0-9-]*) echo 'Secret metadata project must be an exact normalized Slice name'; exit 1 ;;
           esac
-          test -n "$AWS_DEPLOY_ROLE_ARN" || { echo "$EBK_STAGE AWS_DEPLOY_ROLE_ARN is required"; exit 1; }
-          test -n "$AWS_EXPECTED_ACCOUNT_ID" || { echo "$EBK_STAGE AWS_EXPECTED_ACCOUNT_ID is required"; exit 1; }
-          test -n "$AWS_REGION" || { echo "$EBK_STAGE AWS_REGION is required"; exit 1; }
-          case "$AWS_DEPLOY_ROLE_ARN" in
-            arn:aws:iam::$AWS_EXPECTED_ACCOUNT_ID:role/*) ;;
-            *) echo 'Secret metadata role does not belong to the expected account'; exit 1 ;;
-          esac
       - uses: ${checkoutAction}
         with:
           persist-credentials: false
@@ -7168,14 +7205,37 @@ jobs:
       - run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
       - name: Verify managed workspace integrity before AWS authority
         run: pnpm nx run ${name}:workspace-health
+      - id: policy
+        name: Derive committed secret metadata stage policy
+        run: |
+${indentWorkflowScript(protectedSecretPolicyDerivationScript(), 10)}
+      - id: authority
+        name: Derive canonical committed stage authority
+        env:
+          EBK_DEVELOPMENT_ACCOUNT: \${{ steps.policy.outputs.development_account_id }}
+          EBK_PRODUCTION_ACCOUNT: \${{ steps.policy.outputs.production_account_id }}
+          EBK_REGION: \${{ steps.policy.outputs.deployment_region }}
+          EBK_STAGING_ACCOUNT: \${{ steps.policy.outputs.staging_account_id }}
+        run: |
+${indentWorkflowScript(`set -euo pipefail\n${(0, workspace_files_thin_deploy_js_1.canonicalStageAuthorityDerivationScript)()}`, 10)}
       - uses: ${configureAwsAction}
         with:
-          role-to-assume: \${{ secrets.AWS_DEPLOY_ROLE_ARN }}
+          audience: \${{ steps.authority.outputs.audience }}
+          role-to-assume: \${{ steps.authority.outputs.role_arn }}
           role-session-name: ebk-secret-metadata-\${{ github.run_id }}-\${{ github.run_attempt }}
-          aws-region: \${{ vars.AWS_REGION }}
-      - name: Verify assumed account
-        run: test "$(aws sts get-caller-identity --query Account --output text)" = "$AWS_EXPECTED_ACCOUNT_ID"
+          aws-region: \${{ steps.policy.outputs.deployment_region }}
+      - name: Verify exact stage authority
+        env:
+          AWS_DEPLOY_ROLE_ARN: \${{ steps.authority.outputs.role_arn }}
+          AWS_PARTITION: \${{ steps.authority.outputs.partition }}
+          EBK_POLICY_ACCOUNT_ID: \${{ steps.authority.outputs.account_id }}
+        run: |
+${indentWorkflowScript((0, workspace_files_thin_deploy_js_1.exactStageDeployerGuardScript)('Secret metadata', '$EBK_POLICY_ACCOUNT_ID'), 10)}
       - name: Reconcile value-blind metadata
+        env:
+          AWS_DEPLOY_ROLE_ARN: \${{ steps.authority.outputs.role_arn }}
+          AWS_EXPECTED_ACCOUNT_ID: \${{ steps.authority.outputs.account_id }}
+          AWS_REGION: \${{ steps.policy.outputs.deployment_region }}
         run: |
           args=("--stage=$EBK_STAGE" "--region=$AWS_REGION")
           if [ "$EBK_ACTION" = apply ]; then args+=("--apply"); fi
@@ -7220,12 +7280,10 @@ jobs:
       contents: read
       id-token: write
     env:
-      AWS_DEPLOY_ROLE_ARN: \${{ secrets.AWS_DEPLOY_ROLE_ARN }}
-      AWS_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_EXPECTED_ACCOUNT_ID }}
-      AWS_REGION: \${{ vars.AWS_REGION }}
       EBK_ACTION: \${{ inputs.action }}
       EBK_LOGICAL_NAME: \${{ inputs.logical_name }}
       EBK_PROJECT: \${{ inputs.project }}
+      EBK_RENDERED_PROFILE: ${deploymentProfile}
       EBK_STAGE: \${{ inputs.stage }}
     runs-on: ubuntu-latest
     steps:
@@ -7242,13 +7300,6 @@ jobs:
           esac
           [[ "$EBK_LOGICAL_NAME" =~ ^[A-Za-z][A-Za-z0-9]{0,63}$ ]] ||
             { echo 'Secret initialize logical name is invalid'; exit 1; }
-          test -n "$AWS_DEPLOY_ROLE_ARN" || { echo "$EBK_STAGE AWS_DEPLOY_ROLE_ARN is required"; exit 1; }
-          test -n "$AWS_EXPECTED_ACCOUNT_ID" || { echo "$EBK_STAGE AWS_EXPECTED_ACCOUNT_ID is required"; exit 1; }
-          test -n "$AWS_REGION" || { echo "$EBK_STAGE AWS_REGION is required"; exit 1; }
-          case "$AWS_DEPLOY_ROLE_ARN" in
-            arn:aws:iam::$AWS_EXPECTED_ACCOUNT_ID:role/*) ;;
-            *) echo 'Secret initialize role does not belong to the expected account'; exit 1 ;;
-          esac
       - uses: ${checkoutAction}
         with:
           persist-credentials: false
@@ -7260,14 +7311,37 @@ jobs:
       - run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
       - name: Verify managed workspace integrity before AWS authority
         run: pnpm nx run ${name}:workspace-health
+      - id: policy
+        name: Derive committed secret initialize stage policy
+        run: |
+${indentWorkflowScript(protectedSecretPolicyDerivationScript(), 10)}
+      - id: authority
+        name: Derive canonical committed stage authority
+        env:
+          EBK_DEVELOPMENT_ACCOUNT: \${{ steps.policy.outputs.development_account_id }}
+          EBK_PRODUCTION_ACCOUNT: \${{ steps.policy.outputs.production_account_id }}
+          EBK_REGION: \${{ steps.policy.outputs.deployment_region }}
+          EBK_STAGING_ACCOUNT: \${{ steps.policy.outputs.staging_account_id }}
+        run: |
+${indentWorkflowScript(`set -euo pipefail\n${(0, workspace_files_thin_deploy_js_1.canonicalStageAuthorityDerivationScript)()}`, 10)}
       - uses: ${configureAwsAction}
         with:
-          role-to-assume: \${{ secrets.AWS_DEPLOY_ROLE_ARN }}
+          audience: \${{ steps.authority.outputs.audience }}
+          role-to-assume: \${{ steps.authority.outputs.role_arn }}
           role-session-name: ebk-secret-initialize-\${{ github.run_id }}-\${{ github.run_attempt }}
-          aws-region: \${{ vars.AWS_REGION }}
-      - name: Verify assumed account
-        run: test "$(aws sts get-caller-identity --query Account --output text)" = "$AWS_EXPECTED_ACCOUNT_ID"
+          aws-region: \${{ steps.policy.outputs.deployment_region }}
+      - name: Verify exact stage authority
+        env:
+          AWS_DEPLOY_ROLE_ARN: \${{ steps.authority.outputs.role_arn }}
+          AWS_PARTITION: \${{ steps.authority.outputs.partition }}
+          EBK_POLICY_ACCOUNT_ID: \${{ steps.authority.outputs.account_id }}
+        run: |
+${indentWorkflowScript((0, workspace_files_thin_deploy_js_1.exactStageDeployerGuardScript)('Secret initialize', '$EBK_POLICY_ACCOUNT_ID'), 10)}
       - name: Initialize machine-generated secret value-blind
+        env:
+          AWS_DEPLOY_ROLE_ARN: \${{ steps.authority.outputs.role_arn }}
+          AWS_EXPECTED_ACCOUNT_ID: \${{ steps.authority.outputs.account_id }}
+          AWS_REGION: \${{ steps.policy.outputs.deployment_region }}
         run: |
           args=("--logicalName=$EBK_LOGICAL_NAME" "--stage=$EBK_STAGE" "--region=$AWS_REGION")
           if [ "$EBK_ACTION" = apply ]; then args+=("--apply"); fi
@@ -7624,50 +7698,6 @@ export default tseslint.config(
     rules: { 'no-console': 'error' },
   },
 );
-`,
-        'README.md': `# ${name}
-
-This workspace was created with Empire Builder Kit v1.
-
-## Start here
-
-1. Review \`docs/architecture.md\`.
-2. Review the generated Foundation before deploying it.
-3. Add product slices through the Empire Builder Kit Nx plugin.
-4. Review \`docs/repository-operating-policy.md\` and \`docs/git-workflow.md\` before enabling production.
-5. Read \`AGENTS.md\` and \`docs/work-markers.md\` before assigning generated customization work to agents.
-
-For one-origin fleet development, initialize the workspace-pinned CLI once with
-\`ebk dev configure --profile=<bounded-development-profile>\`, inspect the certificate reported
-by \`ebk dev setup\`, and then explicitly approve \`ebk dev setup --trust\`. The supported v1
-origin uses the complete explicit-port HTTPS URL reported at startup; optional
-\`--portless\` setup is experimental. \`ebk dev doctor\` requires a real exact-host TLS
-handshake for trust and connectivity readiness, and reports portless access ready
-only after a live port-443 probe. Complete
-\`aws sso login --profile <bounded-development-profile>\`, then start selected Slices with
-\`ebk dev up billing accounts\`. The CLI derives the personal stage from the operating-system
-account, reads the saved profile and Region, propagates that AWS context to child Slices, and
-uses SST \`mono\` mode so agents and non-cursor-addressable terminals receive ordinary logs.
-Use \`ebk dev status\`, \`ebk dev logs\`, \`ebk dev tail\`, \`ebk dev restart\`,
-\`ebk dev down\`, and \`ebk dev doctor\` without supplying a stage. Setup, doctor, and the
-managed root Fleet target remain internal Nx-backed implementation surfaces; \`ebk dev\` is the
-framework-local development interface. For the development namespace, if the shell does not
-expose workspace binaries, \`pnpm exec ebk dev ...\` only locates the workspace-pinned binary;
-it is not another framework command surface. Protected Blueprint receipt review must instead
-use the direct installed \`.bin/ebk blueprint verification-review\` entry documented in
-\`docs/blueprints.md\`.
-
-Workspace creation only writes source files. It does not create or change cloud resources.
-
-New workspaces default to the one-account \`starter\` deployment profile. Configure the exact
-shared account and Region in \`ebk.repository-policy.json\`, authenticate through IAM Identity
-Center, add exact development and staging CIDRs to
-\`packages/foundation/security/router-waf.json\`, and use
-\`pnpm nx run ${name}:deploy-local -- --stage=development
---profile=<profile> --expectedRoleArn=<role-arn>\`. Never invoke SST directly.
-For a brand-new stage with generated Product Slices, complete the documented workload-role
-Foundation publication and pass \`--phase=foundation-bootstrap\` once before publishing and
-deploying the complete stage.
 `,
         'docs/architecture.md': `# Workspace architecture
 
@@ -7690,286 +7720,6 @@ Every active canonical stage owns a separate Router/domain, Aurora cluster and m
 Cognito user pool, event bus, secret namespace, IAM boundary, logs, queues, ECR namespace, and
 stage-qualified SSM discovery contract. Discovery rejects a record for an inactive or different
 canonical stage.
-`,
-        'docs/git-workflow.md': `# Protected Git workflow
-
-Ordinary work starts from \`develop\` and returns through a reviewed pull request to
-\`develop\`. A production promotion is exactly \`develop\` to \`main\`. After production,
-review and merge the managed \`main\` to \`develop\` sync-back pull request before ordinary
-work resumes.
-
-Both protected branches require the stable \`policy\` and \`verify\` checks, one approving
-review including an approval from the committed catch-all CODEOWNER and someone other than the
-most recent pusher, dismissed stale reviews, resolved conversations, and merge commits. Replace
-the placeholder in \`.github/CODEOWNERS\` with a GitHub user or team that has repository access
-before bootstrap. An approval from \`github-actions[bot]\` cannot satisfy the independent
-code-owner gate; the Actions repository setting is needed to create the managed sync-back pull
-request, not to approve it.
-Direct updates, force pushes, deletion, squash merging, and rebase merging are prohibited.
-GitHub rulesets, environments, and AWS IAM are the authorization boundaries; local hooks are
-only defense in depth.
-
-The rehearsal environment accepts only \`develop\`; \`production\` accepts only \`main\`.
-For \`starter\`, development is the rehearsal stage and GitHub deployment is optional for both
-development and production. For isolated profiles, staging is the rehearsal stage;
-\`production-isolated\` requires GitHub for production and \`fully-isolated\` requires GitHub
-for staging and production.
-The committed \`productionApproval.mode\` selects one of two production authorization
-contracts:
-
-- \`promotion-pr\` is compatible with private repositories on GitHub Team. The required
-  non-author CODEOWNER approval on the exact \`develop\` to \`main\` promotion pull request
-  is the production authorization. Merging that pull request starts production deployment;
-  there is no second EBK-managed environment approval or wait timer. The approver may also be
-  the human whose merge triggers deployment. Roll back through a reviewed revert on the
-  protected branches and let the resulting \`main\` push redeploy. A repository write actor who
-  can run Actions may also manually dispatch \`deploy\`, \`refresh\`, or \`unlock\` against the
-  already approved \`main\` tip without another human gate. That residual cannot introduce
-  unreviewed source; production \`remove\` remains separately variable-gated. Restrict write and
-  Actions access, audit dispatches, or select \`environment-reviewer\` when every production
-  action needs separate approval.
-- \`environment-reviewer\` adds a separate production environment reviewer with self-review
-  prevention. A private repository needs GitHub Enterprise capability for this mode. Bootstrap
-  inspects that capability and fails closed on an unsupported plan; it never silently changes
-  the committed mode.
-
-Both modes retain required checks, a non-author CODEOWNER approval, no ruleset bypass, the
-literal production environment, and its branch-scoped credentials. The base \`staging\` and
-\`production\` environments own deployment and smoke authority plus their variables; isolated
-profiles also keep the staging-registry promotion pull role in production. Read-only container
-evidence uses only \`ecr-inspector-<stage>\`, which owns the exact evidence role and must trust
-that dedicated immutable repository/environment subject rather than the base stage subject.
-Starter promotion authenticates once to the shared account and copies the exact staging digest
-into a distinct production ECR repository. Dedicated
-\`infrastructure-plan-<stage>\` environments gate read-only role use. Separate
-\`async-recovery-<stage>\` and \`reliability-read-<stage>\` environments own only the role and
-variables required by that capability. Infrastructure-plan jobs use a repository-variable read-only role/input inventory;
-an independent clean audit job assumes that exact environment-subject role and verifies its
-trust and complete inline policy before any repository-backed plan job may assume it. Plan-role
-trust uses GitHub's immutable repository identity subject,
-\`repo:<owner>@<owner-id>/<repository>@<repository-id>:environment:<environment>\`.
-The audit derives it from the workflow's repository name, owner ID, repository ID, and literal
-environment and refuses missing IDs or the older mutable name-only subject. Update every
-adopter-owned AWS OIDC role trust to the immutable identity before protected use; never retain
-both forms. Every
-\`*-staging\` environment accepts only \`develop\`; every
-\`*-production\` environment accepts only \`main\`; reviewer, self-review, and wait protection
-matches the corresponding base stage. The credential-free \`npm-prerelease\` environment
-accepts only \`main\` and contains no secrets or variables. In Team-compatible
-\`promotion-pr\` mode, protected-main review plus the exact current-main tag binding is
-publication authorization, so it has no reviewer or wait rule. In
-\`environment-reviewer\` mode it mirrors production protection. Never add repository- or
-organization-visible fallbacks for protected values. Keep repository default workflow
-permissions read-only; generated jobs request only the additional permissions they need.
-
-\`EBK_FLEET_ORIGIN\` is the sole protected deployment and smoke origin. Read-only plan jobs
-enter only their dedicated \`infrastructure-plan-<stage>\` environment; their stage-named
-repository variables \`EBK_STAGING_FLEET_ORIGIN\` and
-\`EBK_PRODUCTION_FLEET_ORIGIN\` remain plan inputs only. Before mutation, each
-base-environment-protected deployment requires
-its \`EBK_FLEET_ORIGIN\` to equal the origin retained by the plan.
-
-\`AWS_ASYNC_RECOVERY_ROLE_ARN\` is a separate mutation role. Trust only this
-repository's exact \`async-recovery-<stage>\` GitHub OIDC subject and grant only
-the recovery operations/resources declared by generated capability adapters.
-
-The preview-era performance aggregate, cost, and load workflow renderers remain available to
-framework maintainers, but RC.31 no longer emits their stale release-manifest-bound workflows
-or GitHub environments by default. Reintroducing them requires an explicit capability contract
-bound to the thin deployment receipt rather than the removed preview/replay lifecycle.
-
-\`AWS_RELIABILITY_READ_ROLE_ARN\` is a separate read-only OIDC role. Trust only
-this repository's exact \`reliability-read-<stage>\` GitHub OIDC subject.
-Grant \`sts:GetCallerIdentity\`, \`cloudwatch:DescribeAlarms\`,
-\`cloudwatch:DescribeAlarmHistory\`, \`cloudwatch:GetMetricData\`,
-\`ecs:DescribeServices\`, and \`states:DescribeExecution\`. Scope ECS and Step
-Functions resources to the reviewed Slice services, state machines, and
-executions wherever IAM supports resource-level constraints. Do not grant log
-reads, deployment, CloudFormation, SST, or any AWS mutation.
-
-The generated \`reliability-read.yml\` workflow selects the newest nonexpired
-binding artifact from a successful deployed-smoke run, reconciles it to the
-current successful protected deployment, and checks out that exact commit
-before assuming the role. Callers choose only a bounded operation and workload;
-they cannot supply the AWS account, Region, role, or binding path. The binding
-allowlists exact alarm names, API ID, ECS services, and Step Functions
-resources before the adapter makes a service call. Bootstrap verifies
-environment-only secret placement, not the role's hidden AWS trust or
-permission policy.
-
-The async-recovery and reliability-read jobs have job-scoped \`id-token: write\`.
-They install the frozen dependency
-graph with lifecycle scripts and pnpm hooks disabled before assuming AWS
-authority. Immediately after the one pinned credential action, they blank the
-OIDC request URL and bearer for future steps and explicitly shadow both values
-empty on every later step. After bounded AWS use, they blank current AWS
-credential variables before evidence upload. This withholds credentials from
-later processes; it does not claim that GitHub revokes the job-level
-permission.
-
-\`AWS_SMOKE_ROLE_ARN\` is separate from deployment authority. Trust only this
-repository's GitHub OIDC subject for the matching protected environment. Grant
-only run-scoped Cognito principal setup/cleanup on reviewed user-pool ARNs and
-\`logs:FilterLogEvents\` on exact
-\`/ebk/<stage>/<slice>/event-consumer\` log-group ARNs. Do not grant
-CloudFormation, SST mutation, broad Logs query, \`GetLogEvents\`,
-\`StartQuery\`, or \`logs:Unmask\`. Bootstrap verifies environment-only secret
-inventory but never creates or reads the secret, materializes the role, or
-attests its hidden policy.
-
-Run the GitHub bootstrap in report mode first. Source upgrades never alter remote GitHub
-settings. Apply a reviewed report only after \`develop\` exists and the candidate's exact
-\`policy\` and \`verify\` check contexts have run.
-
-Set \`GH_REPO=<owner>/<repository>\` and a suitable \`GH_TOKEN\`, then run
-\`pnpm nx run ${name}:github-bootstrap\`. Review the deterministic report before rerunning
-with \`--apply\`. The command never creates branches, credentials, secrets, or AWS resources.
-Supply \`--npmPrereleaseReviewerIds=<id,...>\` only in
-\`environment-reviewer\` mode when intentionally setting a distinct npm
-mutation reviewer set.
-Supply \`--productionReviewerIds=<id,...>\` only when committed policy selects
-\`environment-reviewer\`; it is rejected in \`promotion-pr\` mode.
-
-Install the optional defense-in-depth pre-push hook explicitly with
-\`pnpm nx run ${name}:install-git-hooks\`. It refuses to overwrite an unrelated existing hook.
-
-The sync-back workflow uses only \`GITHUB_TOKEN\` and never pushes or auto-merges. GitHub may
-place its pull-request workflows in an approval-required state. Approve them; if no run
-materializes, close and reopen the pull request as a human and then approve it.
-`,
-        'docs/repository-operating-policy.md': `# Repository Operating Policy
-
-\`ebk.repository-policy.json\` is the reviewed source of truth for deployment profile, exact
-stage account IDs, deployment Region, production access, production approval, per-Slice
-readiness, and the one shared production Foundation profile.
-New workspaces start with production disabled and explicit Team-compatible
-\`productionApproval.mode: "promotion-pr"\`. A missing approval mode or Slice entry fails
-closed; no GitHub capability is allowed to choose a mode implicitly.
-
-Deployment profiles are proportional to operator maturity:
-
-- \`starter\` (default) requires one shared account, permits local development and staging
-  through the governed root Nx target, and reserves production for protected GitHub deployment;
-- \`production-isolated\` requires one development/staging account and a distinct production
-  account; only production is GitHub-only; and
-- \`fully-isolated\` requires three distinct accounts; staging and production are GitHub-only.
-
-Equal account IDs never imply shared stage resources. Router, Aurora, Cognito, events, secrets,
-IAM, logs, queues, resource names, and SSM discovery remain stage-specific. Existing prerelease
-repositories migrate explicitly to \`fully-isolated\`; upgrades never infer or weaken topology.
-That profile-only migration retains the former authority model but stays undeployable until exact
-development, staging, and production account IDs plus \`deploymentRegion\` are committed.
-
-The named repository modes are source-writing presets, not runtime state. Report a change
-first and inspect the complete current/next policy:
-
-\`\`\`bash
-pnpm nx g @empire-builder-kit/nx:repository-policy \\
-  --deploymentProfile=starter --deploymentRegion=us-east-1 \\
-  --developmentAccountId=111122223333 --stagingAccountId=111122223333 \\
-  --productionAccountId=111122223333
-\`\`\`
-
-Apply the reviewed source change separately with \`--apply\`. This command never contacts AWS
-or GitHub. Use \`--status=blocked|pilot|ready\` for explicit Slice transitions and
-\`--profile=cost-optimized|standard\` for an explicit shared Foundation decision.
-Use \`--productionApprovalMode=promotion-pr|environment-reviewer\` for an explicit approval
-transition. This changes committed policy only; a separate bootstrap report/apply reconciles
-remote GitHub settings.
-
-After applying exact topology, authenticate with temporary federated credentials for development
-or staging and invoke
-\`pnpm nx run ${name}:deploy-local -- --stage=<stage> --profile=<profile>
---expectedRoleArn=<role-arn>\`. Production runs only through the protected main-branch GitHub
-workflow. Each admitted local invocation plans the complete current stage, displays the stage
-summary and first material project, and requires a real TTY response of
-\`approve:<action>:<stage>:<project>:<current-plan-digest>\`. A human or authorized agent may type
-that acknowledgement; it is active operator control, not a claim of independent human review.
-The target creates one private ten-minute capability for that project, rechecks the exact source,
-artifacts, account, Region, role, stage, policy, state, and lock without a second provider preview,
-consumes the capability once, and removes it on every exit path. Unattended scripts cannot approve.
-Every material deploy or refresh mutates at most the first material project and ends with a
-controlled non-success \`replan-required\` handoff, including the last project in the ordered stage.
-Rerun the complete stage, review the new current summary, and repeat until one invocation proves
-every project is semantically converged. Only that convergence invocation succeeds. A preview is
-recent review and audit evidence; it is not represented as a cryptographically replayable Pulumi
-transaction. A complete, unlocked deploy plan containing only provider reads with no changed
-properties, replacement, failure, or unmatched risk finding is retained as observation evidence
-and counts as semantically converged. The standalone project planner may still return its
-conservative non-success for that drift observation; the root local transaction accepts only a
-freshly emitted exact provider-read-only record from that child. Repeated reads coalesce
-only when their logical ID and resource type match exactly. Any stale or ambiguous
-observation fails closed; a plan with desired changes remains material and requires review. One
-narrower case stays reviewable instead of becoming
-drift: when an upstream Foundation apply changes only both external framework-version tag
-projections (plus SST's already-bounded name hydration), the retained
-external identity must match one exact non-replacing provider read in the same ordinary plan.
-Missing read correlation, owned resources, other tag or property changes, incomplete tag pairs,
-and provider failures remain drift and fail closed. The local target requires the exact SST v5 account bootstrap normally
-created by the pinned \`ebk dev up\` path, then creates and attests only missing exact
-per-project/canonical-stage state passphrases before its formal read-only plans. This passphrase
-bootstrap is the only persistent pre-acknowledgement write; it creates no deployment authority
-and is reported in bounded local evidence. Clean immutable source, immediate per-project plans,
-migration and retention preflights, and secret-free result
-evidence remain mandatory. Direct SST is forbidden.
-
-After an interrupted apply, use the same target with \`--action=refresh\` and the exact
-phase, stage, profile, and role. It retains the same plan-summary review boundary, admits only
-bounded drift-detected refresh evidence, and never turns refresh into an implicit deploy. When
-the interrupted write leaves a recorded provider output unusable by the ordinary desired preview,
-the plan stops without mutation. The non-writing refresh preview separates provider refresh
-records from its later desired preview and cannot replace failed ordinary desired authority;
-repair the recorded dependency or use the documented
-operator recovery path before planning again.
-
-A stage-wide refresh still plans and authorizes every selected project. When one exact retained
-project plan proves an absent SST state that is unlocked, complete, empty, and drift-free, the
-root target records that project as a refresh no-op instead of invoking SST against a nonexistent
-stage. It also retains the pinned provider's exact SSM \`ebk:framework-version\` \`tagsAll\`
-normalization as a semantically inert observation after the same bounded shape
-repeats following refresh. Value changes, other tags, security findings, deletes, replacements,
-sensitive properties, and every other resource type remain material. Locked, incomplete, failed,
-or otherwise drifted plans are never skipped.
-
-For a stage with no workload-role account baseline, publish the fixed Foundation-only candidate
-and invoke this root target with \`--phase=foundation-bootstrap\`. After Foundation outputs exist,
-publish the complete \`full-stage\` candidate and invoke the target without \`--phase\` (or with
-\`--phase=full-stage\`). The bootstrap phase selects exactly Foundation; it is not an arbitrary
-project filter.
-
-Validation requires both an explicit production approval mode and an explicit Foundation
-profile. It does not infer omitted values. Use \`promotion-pr\` for a private GitHub Team
-repository. Use \`environment-reviewer\` only when the repository plan can enforce a separate
-environment reviewer.
-
-- \`blocked\` prohibits production create, update, and migration.
-- \`pilot\` permits protected evidence gathering without claiming normal latency or maturity.
-- \`ready\` records an adopter decision after its evidence and review; it is not inferred.
-- removal and unlock remain explicit protected recovery paths so disabled policy cannot strand
-  resources.
-
-Protected production deploy and refresh validate the complete Foundation/Slice set before AWS
-access. The Foundation is always ordered first. The set is derived from committed policy and
-cannot be narrowed with an ad hoc project argument. The retained stage preview remains review
-evidence. Immediately before each project mutation the workflow computes one fresh plan against
-current state and applies it without a second redundant preview. Source, artifacts, configuration,
-policy, environment, and protected identities remain exact. Provider-only read/discard observations
-may appear or disappear, but any new delete, replacement, import, stateful or security change, IAM
-expansion, protection reduction, or unclassified resource stops for renewed approval. After an
-upstream mutation, every downstream project therefore receives a fresh independent risk decision.
-
-\`standard\` keeps Aurora warm at 2–16 ACU. \`cost-optimized\` keeps a smaller
-0.5–4 ACU warm floor for starter production traffic. Both keep managed NAT,
-30-day backups, deletion protection, retained data, and the protected GitHub/OIDC/AWS path.
-Changing policy affects only later lifecycle requests; it never deploys or removes resources.
-Changing profile requires a separate reviewed Foundation deployment and retained operational
-evidence.
-
-\`EBK_PRODUCTION_FOUNDATION_PROFILE\` is reserved managed executor input. The lifecycle
-executor derives it from validated committed policy immediately before SST and removes any
-ambient shell value. Do not set it as a local, repository, organization, or environment
-variable. Incubation keeps the last configured profile so protected remove and unlock can still
-render existing production resources; production deploy remains disabled.
 `,
         'docs/work-markers.md': `# Agent work markers
 
@@ -8244,29 +7994,6 @@ must be committed, reviewable, and auditable.
                 },
             },
         }),
-        'packages/foundation/README.md': `# Standard Foundation
-
-This project owns the workspace-wide AWS platform for each canonical \`development\`,
-\`staging\`, or \`production\` stage. It is a separate SST state boundary from product slices.
-Never deploy it at a framework-derived personal stage; that consumer maps to
-\`development\`.
-
-It provides the v1 network, routing, container compute, Postgres, identity, events,
-observability, configuration, and deployment capabilities. Product slices consume its
-versioned contract; they do not import files from \`infra/\`.
-
-Workspace creation does not deploy this project. Review \`docs/costs.md\`,
-\`docs/security.md\`, and \`docs/runbooks.md\` before the first deployment.
-
-Set \`EBK_ROOT_DOMAIN\` before deploying when Route 53 in the target account owns a public
-domain. Without it, the shared Router uses its functional provider URL.
-
-Before deploying development or staging, add at least one exact operator/probe CIDR to
-\`security/router-waf.json\`. Production is public by default behind the same managed and
-rate-limiting baseline; select its allowlist mode explicitly when required. Rehearse the
-resolved ${(0, index_js_4.productionRehearsalStage)(deploymentProfile)} stage with
-\`pnpm nx run foundation:router-waf-rehearsal -- --probeUrl=https://<router>/<slice>/api/health --profile=<temporary-profile>\`.
-`,
         'packages/foundation/contracts/foundation.json': json({
             contractVersion: '1.0.0',
             capabilities: [
@@ -8328,7 +8055,6 @@ seeded decision record aligned with organization-specific budgets and alerts.
 
 - Development uses EC2 NAT, a development bastion, and Aurora scale-to-zero.
 ${deploymentProfile === 'starter' ? '' : '- Staging uses EC2 NAT and Aurora scale-to-zero by default.\n'}- Production always uses managed NAT and retains protected data. Its explicit Repository
-- Production always uses managed NAT and retains protected data. Its explicit Repository
   Operating Policy profile selects either the standard 2-ACU Aurora floor or the
   cost-optimized 0.5-ACU warm floor.
 - ECS, EventBridge, Cognito, SNS, SSM, and CloudWatch are primarily usage-priced; logs,
@@ -8336,102 +8062,6 @@ ${deploymentProfile === 'starter' ? '' : '- Staging uses EC2 NAT and Aurora scal
 
 Run \`foundation:remove\` only for disposable stages. Production is retained and protected by
 the SST configuration.
-`,
-        'packages/foundation/docs/runbooks.md': `# Foundation runbooks
-
-## Deployment
-
-Use Nx for every supported lifecycle action:
-
-- \`pnpm nx run foundation:deploy --stage=development\`
-- \`pnpm nx run foundation:refresh --stage=development\`
-- \`pnpm nx run foundation:unlock --stage=development\`
-- \`pnpm nx run foundation:remove --stage=development\`
-
-Do not invoke SST lifecycle commands directly. The root \`deploy-local\` target is the governed
-local path for stages admitted by the committed deployment profile. Its fixed
-\`foundation-bootstrap\` phase is the only local partial-stage path and exists solely for the
-documented first workload-role publication; isolated protected stages remain on the trusted
-GitHub path.
-
-Every local invocation plans the complete selected stage but mutates at most one material
-project. Type the exact current \`approve:<action>:<stage>:<project>:<plan-digest>\` challenge in a
-real TTY after reviewing the displayed summary. A human or authorized agent may operate that TTY;
-unattended input is refused. The acknowledgement creates one ten-minute, one-use, private
-capability bound to source, artifacts, policy, environment, credentials, and current state. A
-completed deploy or refresh returns the controlled non-success \`replan-required\`; rerun the
-complete stage, review the new current summary, and continue one project at a time. Only a
-semantically converged complete stage reports success. No upstream mutation can authorize a
-downstream project. A complete, unlocked deploy plan containing only provider reads with no
-changed properties, replacement, failure, or unmatched risk finding is retained as observation
-evidence and counts as semantically converged. The standalone project planner may still return
-its conservative non-success for that drift observation; the root local transaction accepts only
-a freshly emitted exact provider-read-only record from that child. Repeated reads coalesce
-only when their logical ID and resource type match exactly. Any stale or ambiguous
-observation fails closed; a plan with desired changes remains material and requires review. A
-material downstream plan may also retain an upstream Foundation framework-version tag advance as
-observation only when both external tag
-projections, the retained identity, optional bounded SST name hydration, and one non-replacing
-provider read correlate exactly. Every other external property or uncorroborated read remains
-drift and blocks before the TTY challenge.
-
-For an interrupted local apply, run the same root target with \`--action=refresh\`, review its
-current provider-refresh evidence, and type the displayed TTY challenge. Before mutation the
-executor writes and verifies a private state recovery point plus a secret-free digest/version
-manifest. The refresh preview validates its provider and later desired-event partitions; any
-ordinary preview failure or malformed post-refresh desired event remains blocked. Provider-only
-observation noise is retained without claiming a replayable preview. Because refresh changes
-recorded state rather than cloud resources, provider-output security and protection findings
-remain explicit review requirements under the drift decision. Refresh never continues into deploy
-or claims desired-state convergence: run the governed deploy target afterward and resolve every
-remaining source-versus-state change. Exclude the \`.private.json\` recovery point from archives.
-
-The root refresh target includes every selected project in its exact reviewed plan set. It skips
-the SST child only when that project's retained plan proves an absent, unlocked, complete, empty,
-and drift-free state, or when the only retained difference is the pinned provider's exact repeated
-SSM \`ebk:framework-version\` \`tagsAll\` normalization. It records the project as an explicit refresh no-op
-in either case while retaining the observation. Value changes, other tags, security findings,
-deletes, replacements, sensitive
-properties, and every other resource type remain material; every other plan must execute or fail
-closed.
-
-## Router WAF
-
-Each canonical stage owns one global-scope Web ACL attached to that stage's Foundation Router.
-The committed \`security/router-waf.json\` policy requires AWS Common Rule Set, Known Bad
-Inputs, Amazon IP Reputation, an IP rate limit, CloudWatch metrics, and sampled requests.
-Development and staging fail synthesis until their allowlists contain explicit CIDRs.
-Production is public by default and may be changed to an explicit allowlist.
-
-For tuning, set a nonproduction stage to \`count\`, deploy and inspect sampled requests, then
-return staging to \`block\` and run the live allow/deny, managed-rule, rate-limit, metric, and
-sampled-request probes. Write their bounded, secret-free result to
-\`security/router-waf-live-evidence.json\`, then run
-\`pnpm nx run foundation:router-waf-rehearsal\`. The executor seals the exact policy digest
-into \`router-waf-blocking-rehearsal.json\`. Production synthesis rejects a missing, stale, or
-count-mode rehearsal. Full request logging is opt-in, blocked-only, retention-bounded, and
-redacts query strings plus credential-bearing headers.
-
-Foundation stages are canonical. \`ebk dev\` derives a Product Slice personal
-stage from the operating-system account and maps that consumer to the
-development Foundation. Callers cannot select that stage. Slice preflight
-reports both identities, never deploys a personal Foundation, and full mapped
-personal-stage deploys fail closed.
-
-## Database restore
-
-Production Aurora retains 30 days of automated backups; non-production retains 7 days.
-Restore into a new cluster, validate application migrations and data integrity, then cut over
-consumers deliberately. Never expose the Foundation master credential to a product slice.
-
-## Protected database migrations
-
-Each database-backed Product Slice deploys a one-off Fargate migration task and
-Standard Step Functions workflow into the shared cluster. The existing
-environment-scoped \`AWS_DEPLOY_ROLE_ARN\` starts and observes that exact
-workflow; do not create a second migration OIDC role. GitHub has no direct SQL,
-database-secret-value, or \`rds-db:connect\` authority. The generated task role
-connects as the Slice's no-password IAM-authenticated migrator user.
 `,
         'packages/foundation/docs/security.md': `# Foundation security contract
 
@@ -9199,16 +8829,7 @@ export function app() {
                 version: '4.17.1',
             },
             policy: {
-                adoptedImports: [
-                    {
-                        authority: 'workload-role-account-baseline',
-                        logicalId: 'FoundationVpcNatInstanceProfile',
-                        privateIdentifierTemplate: 'ebk-{stage}-foundation-nat-profile',
-                        recoveryRunbookRef: 'docs/workload-role-account-baseline.md',
-                        removalBehavior: 'retain',
-                        resourceType: 'aws:iam/instanceProfile:InstanceProfile',
-                    },
-                ],
+                adoptedImports: [],
                 additiveLowRiskTypes: [
                     'aws:cloudwatch/dashboard:Dashboard',
                     'aws:cloudwatch/logGroup:LogGroup',
@@ -10528,7 +10149,7 @@ const decision = evaluateGitPolicy(request);
 process.stdout.write(JSON.stringify(decision, null, 2) + '\\n');
 if (!decision.allowed) process.exitCode = 1;
 `,
-        'tools/workspace-health.mjs': `import { validateRepositoryOperatingPolicy } from '@empire-builder-kit/nx/repository-policy';
+        'tools/workspace-health.mjs': `import { readRepositoryOperatingPolicy } from '@empire-builder-kit/nx/repository-policy';
 import { assertWorkMarkerReport, formatWorkMarkerReport, scanWorkMarkers } from '@empire-builder-kit/nx/work-markers';
 import { createHash } from 'node:crypto';
 import { existsSync, readdirSync, readFileSync } from 'node:fs';
@@ -10591,13 +10212,7 @@ if (
 validateOwnership('.', workspace, 'Workspace');
 validateOwnership('packages/foundation', foundation, 'Foundation');
 
-const policy = validateRepositoryOperatingPolicy(readJson('ebk.repository-policy.json'));
-if (!policy.valid) {
-  throw new Error(
-    'Repository Operating Policy is invalid:\\n' +
-      policy.issues.map(({ message, path }) => '- ' + path + ': ' + message).join('\\n'),
-  );
-}
+readRepositoryOperatingPolicy(process.cwd());
 
 for (const name of readdirSync('packages')) {
   if (name === 'foundation') continue;
@@ -10615,7 +10230,11 @@ assertWorkMarkerReport(markerReport);
 process.stdout.write('Empire Builder Kit workspace source health is green.\\n');
 `,
     };
-    Object.assign(files, SUPPLY_CHAIN_WORKSPACE_FILE_PLAN.files, developerAgentFilePlan.files, (0, workspace_files_stage_authority_js_1.renderStageAuthorityWorkspaceFiles)({ deploymentProfile }));
+    Object.assign(files, SUPPLY_CHAIN_WORKSPACE_FILE_PLAN.files, developerAgentFilePlan.files, (0, workspace_files_stage_authority_js_1.renderStageAuthorityWorkspaceFiles)({
+        deploymentProfile,
+        name,
+        workspaceDeploymentId,
+    }));
     Object.assign(files, (0, workspace_files_ecr_inspector_js_1.renderThinEcrInspectorWorkflow)({
         actionPins: {
             checkout: checkoutAction,
@@ -10641,7 +10260,6 @@ process.stdout.write('Empire Builder Kit workspace source health is green.\\n');
         name,
         toolVersions: {
             node: tool_versions_js_1.WORKSPACE_NODE_VERSION,
-            pnpm: tool_versions_js_1.WORKSPACE_PNPM_VERSION,
             sst: tool_versions_js_1.WORKSPACE_SST_VERSION,
         },
     }).files, (0, workspace_files_thin_docs_js_1.renderThinLifecycleDocumentation)({ deploymentProfile, name }));