@empire-builder-kit/nx 1.0.0-rc.33 → 1.0.0-rc.35

package/src/generators/preset/workspace-files-thin-deploy.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.THIN_DEPLOY_WORKFLOW_PATH = void 0;
+exports.EBK_RECORD_MAIN_TOKEN_SECRET = exports.THIN_DEPLOY_WORKFLOW_PATH = void 0;
 exports.renderThinDeployVerifyCaller = renderThinDeployVerifyCaller;
 exports.protectedBrowserInstallScript = protectedBrowserInstallScript;
 exports.exactStageDeployerGuardScript = exactStageDeployerGuardScript;
@@ -13,10 +13,17 @@ exports.postdeploySupplyChainBindingScript = postdeploySupplyChainBindingScript;
 exports.renderThinDeployWorkflowFilePlan = renderThinDeployWorkflowFilePlan;
 const tool_versions_js_1 = require("./tool-versions.js");
 exports.THIN_DEPLOY_WORKFLOW_PATH = '.github/workflows/deploy.yml';
+/** The production environment secret that lets record-main fast-forward main. */
+exports.EBK_RECORD_MAIN_TOKEN_SECRET = 'EBK_RECORD_MAIN_TOKEN';
 const EXACT_SEMVER = /^\d+\.\d+\.\d+$/;
 const WORKSPACE_NAME = /^[a-z0-9][a-z0-9-]{0,62}$/;
 const ACTION_PIN = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+@[a-f0-9]{40}(?: # [^\r\n]+)?$/;
 function assertOptions(options) {
+    if (options.productionApprovalMode === 'trunk-promotion' &&
+        (options.deploymentProfile === 'starter' ||
+            options.deliveryLane === 'trunk')) {
+        throw new Error('trunk-promotion requires an isolated deployment profile on the protected pair.');
+    }
     if (!WORKSPACE_NAME.test(options.name)) {
         throw new Error('Workspace name must be a bounded lowercase slug.');
     }
@@ -31,8 +38,8 @@ function assertOptions(options) {
         }
     }
 }
-function workflowCallTrigger(profile) {
-    return profile === 'starter'
+function workflowCallTrigger(profile, deliveryLane = 'protected-pair') {
+    return profile === 'starter' && deliveryLane !== 'trunk'
         ? ''
         : `  workflow_call:
     inputs:
@@ -53,10 +60,23 @@ function workflowCallTrigger(profile) {
         type: string
 `;
 }
-function renderThinDeployVerifyCaller(profile) {
-    if (profile === 'starter')
+function renderThinDeployVerifyCaller(profile, deliveryLane = 'protected-pair', productionApprovalMode = 'promotion-pr') {
+    const trunk = deliveryLane === 'trunk';
+    if (profile === 'starter' && !trunk)
         return '';
-    const protectedBranchCondition = "(github.ref == 'refs/heads/develop' || github.ref == 'refs/heads/main')";
+    // GitHub validates every nested deploy.yml job against this caller's
+    // permissions on every event, so the ceiling must admit the managed
+    // rehearsal, which pushes its sealed receipt branch and opens the pull
+    // request with the workflow token (isolated profiles only).
+    const nestedWrite = profile !== 'starter';
+    // Trunk lane: every merged main push is a production delivery.
+    // Trunk promotion: production deploys from the develop run itself and
+    // record-main fast-forwards main afterwards, so a main push only verifies.
+    const protectedBranchCondition = trunk
+        ? "github.ref == 'refs/heads/main'"
+        : productionApprovalMode === 'trunk-promotion'
+            ? "github.ref == 'refs/heads/develop'"
+            : "(github.ref == 'refs/heads/develop' || github.ref == 'refs/heads/main')";
     return `
 
   deploy:
@@ -68,18 +88,26 @@ function renderThinDeployVerifyCaller(profile) {
       ${protectedBranchCondition} &&
       needs.acceptance.result == 'success' &&
       needs.acceptance.outputs.history_only != 'true' &&
-      needs.release-candidate.result == 'success'
+      (needs.release-candidate.result == 'success' ||
+      (github.ref == 'refs/heads/main' && needs.release-candidate.result == 'skipped'))
+    # Ceiling for the nested deploy.yml jobs; each nested job declares its
+    # own least-privilege set. Isolated profiles admit the rehearse job's
+    # receipt push and pull request (EBK-INT-2026-080).
     permissions:
       actions: read
-      contents: read
-      id-token: write
+      contents: ${nestedWrite ? 'write' : 'read'}
+      id-token: write${nestedWrite ? '\n      pull-requests: write' : ''}
     uses: ./.github/workflows/deploy.yml
     with:
       source_branch: \${{ github.ref_name }}
       source_commit: \${{ github.sha }}
       source_ref: \${{ github.ref }}
       verify_run_attempt: \${{ github.run_attempt }}
-      verify_run_id: \${{ github.run_id }}`;
+      verify_run_id: \${{ github.run_id }}
+    # The reusable workflow reads the production environment secret
+    # AWS_STAGING_PROMOTION_PULL_ROLE_ARN, which only reaches a called
+    # workflow when the caller inherits secrets (EBK-INT-2026-075).
+    secrets: inherit`;
 }
 function indentedScript(source, spaces) {
     const prefix = ' '.repeat(spaces);
@@ -334,6 +362,13 @@ if (hasSlices) {
   const artifactId = required('EBK_CANDIDATE_ARTIFACT_ID', /^[1-9][0-9]*$/);
   const artifactDigest = required('EBK_CANDIDATE_ARTIFACT_DIGEST', /^sha256:[a-f0-9]{64}$/);
   const containerArtifactId = required('EBK_CONTAINER_ARTIFACT_ID', /^[1-9][0-9]*$/);
+  // actions/upload-artifact emits the bare SHA-256 hex in artifact-digest while
+  // the artifacts API and the promotion compare the sha256:<hex> registry form
+  // (EBK-INT-2026-073). Normalize before the exact validation.
+  const containerArtifactDigestRaw = process.env.EBK_CONTAINER_ARTIFACT_DIGEST?.trim() ?? '';
+  process.env.EBK_CONTAINER_ARTIFACT_DIGEST = /^[a-f0-9]{64}$/.test(containerArtifactDigestRaw)
+    ? 'sha256:' + containerArtifactDigestRaw
+    : containerArtifactDigestRaw;
   const containerArtifactDigest = required('EBK_CONTAINER_ARTIFACT_DIGEST', /^sha256:[a-f0-9]{64}$/);
   const root = '.ebk/evidence/release-candidate/packages';
   const projects = readdirSync(root, { withFileTypes: true })
@@ -442,22 +477,35 @@ writeFileSync(
 }
 function renderThinDeployWorkflow(options) {
     const { actionPins, deploymentProfile, name, toolVersions } = options;
+    const trunkPromotion = options.productionApprovalMode === 'trunk-promotion';
     return `name: Deploy
 run-name: Deploy \${{ inputs.source_commit || github.sha }}
 
 on:
-${workflowCallTrigger(deploymentProfile)}  workflow_dispatch:
+${workflowCallTrigger(deploymentProfile, options.deliveryLane)}  workflow_dispatch:
     inputs:
       action:
         description: Native lifecycle action
         required: true
         default: deploy
         type: choice
-        options: [deploy, refresh, unlock, remove]
+        options: [deploy, refresh, unlock, remove${deploymentProfile === 'starter' ? '' : ', rehearse'}]
       project:
         description: Required registered project for unlock or remove recovery
         required: false
-        type: string
+        type: string${deploymentProfile === 'starter'
+        ? ''
+        : `
+      probe_url:
+        description: rehearse only; exact HTTPS Router health URL in /<kebab-slice>/api/health form for the staging blocking rehearsal
+        required: false
+        type: string`}
+      lifecycle:
+        description: affected skips Slices unchanged since the newest successful deployment; full deploys everything
+        required: false
+        default: affected
+        type: choice
+        options: [affected, full]
 
 concurrency:
   group: protected-lifecycle-\${{ inputs.source_branch || github.ref_name }}
@@ -478,6 +526,7 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       action: \${{ steps.route.outputs.action }}
+      probe_url: \${{ steps.route.outputs.probe_url }}
       account_id: \${{ steps.account.outputs.account_id }}
       has_slices: \${{ steps.policy.outputs.has_slices }}
       ordered_projects: \${{ steps.policy.outputs.ordered_projects }}
@@ -487,9 +536,14 @@ jobs:
       project: \${{ steps.route.outputs.project }}
       region: \${{ steps.policy.outputs.deployment_region }}
       slice_projects: \${{ steps.policy.outputs.slice_projects }}
+      slice_matrix: \${{ steps.policy.outputs.slice_matrix }}
       staging_account_id: \${{ steps.policy.outputs.staging_account_id }}
       stage: \${{ steps.route.outputs.stage }}
-      stage_deploy_role_arn: \${{ steps.account.outputs.role_arn }}
+      stage_deploy_role_arn: \${{ steps.account.outputs.role_arn }}${trunkPromotion
+        ? `
+      production_account_id: \${{ steps.production-account.outputs.account_id }}
+      production_deploy_role_arn: \${{ steps.production-account.outputs.role_arn }}`
+        : ''}
     steps:
       - name: Verify exact protected branch tip before setup
         env:
@@ -551,6 +605,7 @@ jobs:
         name: Resolve protected stage and action
         env:
           EBK_DISPATCH_ACTION: \${{ inputs.action || '' }}
+          EBK_DISPATCH_PROBE_URL: \${{ inputs.probe_url || '' }}
           EBK_DISPATCH_PROJECT: \${{ inputs.project || '' }}
           EBK_PROFILE: ${deploymentProfile}
           EBK_SOURCE_BRANCH: \${{ env.EBK_DEPLOYMENT_SOURCE_BRANCH }}
@@ -566,12 +621,25 @@ jobs:
           fi
           case "$EBK_SOURCE_COMMIT" in ''|*[!0-9a-f]*) exit 1 ;; esac
           { [ "\${#EBK_SOURCE_COMMIT}" -eq 40 ] || [ "\${#EBK_SOURCE_COMMIT}" -eq 64 ]; } || exit 1
-          case "$action" in deploy|refresh|unlock|remove) ;; *) exit 1 ;; esac
+          case "$action" in deploy|refresh|unlock|remove|rehearse) ;; *) exit 1 ;; esac
           case "$project" in ''|*[!A-Za-z0-9_-]*) [ -z "$project" ] || exit 1 ;; esac
           case "$action" in
             unlock|remove) [ -n "$project" ] || { echo 'unlock and remove require an explicit project'; exit 1; } ;;
             deploy|refresh) [ -z "$project" ] || { echo 'deploy and refresh operate on the policy-derived project order'; exit 1; } ;;
+            rehearse)
+              [ -z "$project" ] || { echo 'rehearse targets the foundation Router WAF and takes no project'; exit 1; }
+              [ "$EBK_PROFILE" != starter ] || { echo 'starter rehearses development locally; rehearse is for isolated staging'; exit 1; }
+              [ "$EBK_SOURCE_BRANCH" = develop ] || { echo 'rehearse runs from develop against staging'; exit 1; }
+              case "$EBK_DISPATCH_PROBE_URL" in
+                https://*/*/api/health) ;;
+                *) echo 'rehearse requires probe_url in https://<router>/<kebab-slice>/api/health form'; exit 1 ;;
+              esac
+              ;;
           esac
+          # The committed deployment plan knows deploy, refresh, unlock, and
+          # remove; a rehearsal derives the same project inventory as deploy.
+          plan_action="$action"
+          [ "$action" != rehearse ] || plan_action=deploy
           case "$EBK_SOURCE_BRANCH" in
             main) stage=production ;;
             develop)
@@ -584,12 +652,14 @@ jobs:
             *) echo 'Protected lifecycle must run from develop or main'; exit 1 ;;
           esac
           echo "action=$action" >> "$GITHUB_OUTPUT"
+          echo "plan_action=$plan_action" >> "$GITHUB_OUTPUT"
+          echo "probe_url=$EBK_DISPATCH_PROBE_URL" >> "$GITHUB_OUTPUT"
           echo "project=$project" >> "$GITHUB_OUTPUT"
           echo "stage=$stage" >> "$GITHUB_OUTPUT"
       - id: policy
         name: Derive ordered projects from committed policy
         env:
-          EBK_ACTION: \${{ steps.route.outputs.action }}
+          EBK_ACTION: \${{ steps.route.outputs.plan_action }}
           EBK_PROJECT: \${{ steps.route.outputs.project }}
           EBK_STAGE: \${{ steps.route.outputs.stage }}
         run: |
@@ -611,7 +681,22 @@ jobs:
           EBK_STAGE: \${{ steps.route.outputs.stage }}
           EBK_STAGING_ACCOUNT: \${{ steps.policy.outputs.staging_account_id }}
         run: |
-${indentedScript(`set -euo pipefail\n${canonicalStageAuthorityDerivationScript()}`, 10)}
+${indentedScript(`set -euo pipefail\n${canonicalStageAuthorityDerivationScript()}`, 10)}${trunkPromotion
+        ? `
+      # Trunk promotion deploys production from the develop run, so the
+      # production authority is derived here beside the staging authority.
+      - id: production-account
+        name: Derive canonical committed production authority for trunk promotion
+        if: steps.route.outputs.stage == 'staging'
+        env:
+          EBK_DEVELOPMENT_ACCOUNT: \${{ steps.policy.outputs.development_account_id }}
+          EBK_PRODUCTION_ACCOUNT: \${{ steps.policy.outputs.production_account_id }}
+          EBK_REGION: \${{ steps.policy.outputs.deployment_region }}
+          EBK_STAGE: production
+          EBK_STAGING_ACCOUNT: \${{ steps.policy.outputs.staging_account_id }}
+        run: |
+${indentedScript(`set -euo pipefail\n${canonicalStageAuthorityDerivationScript()}`, 10)}`
+        : ''}
 
   immutable-artifacts:
     name: prepare exact immutable release artifacts
@@ -634,6 +719,11 @@ ${indentedScript(`set -euo pipefail\n${canonicalStageAuthorityDerivationScript()
       container_artifact_id: \${{ steps.staging.outputs.container_artifact_id }}
       staging_deployment_run_attempt: \${{ steps.staging.outputs.deployment_run_attempt }}
       staging_deployment_run_id: \${{ steps.staging.outputs.deployment_run_id }}
+      baseline_artifact_digest: \${{ steps.baseline.outputs.artifact_digest }}
+      baseline_artifact_id: \${{ steps.baseline.outputs.artifact_id }}
+      baseline_commit: \${{ steps.baseline.outputs.commit }}
+      baseline_found: \${{ steps.baseline.outputs.found }}
+      baseline_run_id: \${{ steps.baseline.outputs.run_id }}
       producer_run_attempt: \${{ steps.current.outputs.producer_run_attempt || steps.staging.outputs.producer_run_attempt }}
       producer_run_id: \${{ steps.current.outputs.producer_run_id || steps.staging.outputs.producer_run_id }}
       source_commit: \${{ steps.current.outputs.source_commit || steps.staging.outputs.source_commit }}
@@ -684,6 +774,46 @@ ${indentedScript(`set -euo pipefail\n${canonicalStageAuthorityDerivationScript()
           echo "producer_run_attempt=$run_attempt" >> "$GITHUB_OUTPUT"
           echo "producer_run_id=$run_id" >> "$GITHUB_OUTPUT"
           echo "source_commit=$EBK_SOURCE_COMMIT" >> "$GITHUB_OUTPUT"
+      - id: baseline
+        name: Select the newest successful deployment receipt on this branch
+        if: >-
+          needs.prepare.outputs.has_slices == 'true' &&
+          (needs.prepare.outputs.stage != 'production' || needs.prepare.outputs.profile == 'starter')
+        env:
+          EBK_SOURCE_BRANCH: \${{ env.EBK_DEPLOYMENT_SOURCE_BRANCH }}
+          EBK_SOURCE_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+          EBK_STAGE: \${{ needs.prepare.outputs.stage }}
+          GH_REPO: \${{ github.repository }}
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+          # A baseline lets unchanged OCI artifacts reuse their retained evidence.
+          # Declining is always safe: without one, every artifact is rebuilt.
+          echo "found=false" >> "$GITHUB_OUTPUT"
+          runs="$(gh api "/repos/$GH_REPO/actions/workflows/ci.yml/runs?event=push&branch=$EBK_SOURCE_BRANCH&status=success&per_page=50")"
+          for candidate in $(printf '%s' "$runs" | jq -r --arg branch "$EBK_SOURCE_BRANCH" \\
+            '.workflow_runs | sort_by(.run_number) | reverse | .[] | select(.head_branch == $branch and .event == "push" and .conclusion == "success" and .path == ".github/workflows/ci.yml") | "\\(.id):\\(.run_attempt):\\(.head_sha)"'); do
+            IFS=':' read -r run_id run_attempt head_sha <<< "$candidate"
+            case "$run_id:$run_attempt" in *[!0-9:]*) continue ;; esac
+            case "$head_sha" in ????????????????????????????????????????) ;; *) continue ;; esac
+            [ "$head_sha" != "$EBK_SOURCE_COMMIT" ] || continue
+            git merge-base --is-ancestor "$head_sha" "$EBK_SOURCE_COMMIT" 2>/dev/null || continue
+            artifacts="$(gh api "/repos/$GH_REPO/actions/runs/$run_id/artifacts?per_page=100")"
+            receipt="$(printf '%s' "$artifacts" | jq -c --arg name "deployment-receipt-$EBK_STAGE-$run_id-$run_attempt" \\
+              '[.artifacts[] | select(.name == $name and .expired == false)] | if length == 1 then .[0] else empty end')"
+            [ -n "$receipt" ] || continue
+            artifact_id="$(printf '%s' "$receipt" | jq -r '.id // empty')"
+            artifact_digest="$(printf '%s' "$receipt" | jq -r '.digest // empty')"
+            case "$artifact_id" in ''|*[!0-9]*) continue ;; esac
+            case "$artifact_digest" in sha256:????????????????????????????????????????????????????????????????) ;; *) continue ;; esac
+            echo "artifact_digest=$artifact_digest" >> "$GITHUB_OUTPUT"
+            echo "artifact_id=$artifact_id" >> "$GITHUB_OUTPUT"
+            echo "commit=$head_sha" >> "$GITHUB_OUTPUT"
+            echo "found=true" >> "$GITHUB_OUTPUT"
+            echo "run_id=$run_id" >> "$GITHUB_OUTPUT"
+            echo "Baseline deployment receipt: run $run_id attempt $run_attempt at $head_sha"
+            break
+          done
       - id: staging-receipt
         name: Select exact successful staging deployment receipt
         if: needs.prepare.outputs.stage == 'production' && needs.prepare.outputs.profile != 'starter'
@@ -751,7 +881,9 @@ ${indentedScript(`set -euo pipefail\n${canonicalStageAuthorityDerivationScript()
           EBK_EXPECTED_STAGING_ACCOUNT_ID: \${{ needs.prepare.outputs.staging_account_id }}
           EBK_STAGING_RECEIPT_ARTIFACT_DIGEST: \${{ steps.staging-receipt.outputs.artifact_digest }}
           EBK_STAGING_RECEIPT_ARTIFACT_ID: \${{ steps.staging-receipt.outputs.artifact_id }}
-          EBK_STAGING_RECEIPT_ROOT: \${{ runner.temp }}/staging-deployment-receipt
+          # The receipt artifact keeps .ebk/evidence as its root, so latest.json
+          # and promotion.json live under deployment/ (EBK-INT-2026-074).
+          EBK_STAGING_RECEIPT_ROOT: \${{ runner.temp }}/staging-deployment-receipt/deployment
           EBK_STAGING_SOURCE_COMMIT: \${{ steps.staging-receipt.outputs.source_commit }}
           GH_REPO: \${{ github.repository }}
           GH_TOKEN: \${{ github.token }}
@@ -787,7 +919,7 @@ ${indentedScript(stagingPromotionReceiptValidationScript(), 10)}
           fi
 
   container-platform:
-    name: native \${{ needs.prepare.outputs.stage }} OCI \${{ matrix.platform }}
+    name: native \${{ needs.prepare.outputs.stage }} OCI \${{ matrix.project.project }} \${{ matrix.platform }}
     needs: [prepare, immutable-artifacts]
     if: >-
       always() &&
@@ -801,7 +933,10 @@ ${indentedScript(stagingPromotionReceiptValidationScript(), 10)}
       )
     strategy:
       fail-fast: false
+      # One job per Slice and architecture: Slices build in parallel instead of
+      # looping on one runner per architecture.
       matrix:
+        project: \${{ fromJson(needs.prepare.outputs.slice_matrix) }}
         include:
           - architecture: amd64
             platform: linux/amd64
@@ -830,6 +965,7 @@ ${indentedScript(stagingPromotionReceiptValidationScript(), 10)}
       EBK_SOURCE_COMMIT: \${{ inputs.source_commit || github.sha }}
       EBK_STAGE: \${{ needs.prepare.outputs.stage }}
       EBK_SLICE_PROJECTS: \${{ needs.prepare.outputs.slice_projects }}
+      EBK_SLICE_PROJECT: \${{ matrix.project.project }}
     steps:
       - name: Check out immutable container source
         uses: ${actionPins.checkout}
@@ -870,6 +1006,17 @@ ${indentedScript(stagingPromotionReceiptValidationScript(), 10)}
           github-token: \${{ github.token }}
           path: .ebk/evidence/release-candidate
           run-id: \${{ needs.immutable-artifacts.outputs.producer_run_id }}
+      - name: Restore the baseline deployment receipt for unchanged artifacts
+        if: needs.immutable-artifacts.outputs.baseline_found == 'true'
+        uses: ${actionPins.downloadArtifact}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          artifact-ids: \${{ needs.immutable-artifacts.outputs.baseline_artifact_id }}
+          github-token: \${{ github.token }}
+          path: \${{ runner.temp }}/ebk-deployment-baseline
+          run-id: \${{ needs.immutable-artifacts.outputs.baseline_run_id }}
       - name: Revalidate exact protected branch tip before OIDC
         env:
           ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
@@ -900,22 +1047,48 @@ ${indentedScript(stagingPromotionReceiptValidationScript(), 10)}
           [ "$AWS_EXPECTED_ACCOUNT_ID" = "$EBK_POLICY_ACCOUNT_ID" ]
           [ "$AWS_REGION" = "$EBK_POLICY_REGION" ]
           [ "$(aws sts get-caller-identity --query Account --output text)" = "$EBK_POLICY_ACCOUNT_ID" ]
+      - name: Restore the container layer and release tool caches
+        uses: ${actionPins.cache}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          path: |
+            \${{ runner.temp }}/ebk-buildx-cache
+            \${{ runner.temp }}/ebk-release-tools
+          key: ebk-container-\${{ needs.prepare.outputs.stage }}-\${{ matrix.project.project }}-\${{ matrix.architecture }}-\${{ hashFiles('pnpm-lock.yaml') }}-\${{ github.run_id }}
+          restore-keys: |
+            ebk-container-\${{ needs.prepare.outputs.stage }}-\${{ matrix.project.project }}-\${{ matrix.architecture }}-\${{ hashFiles('pnpm-lock.yaml') }}-
+            ebk-container-\${{ needs.prepare.outputs.stage }}-\${{ matrix.project.project }}-\${{ matrix.architecture }}-
       - name: Build and run exact native OCI artifacts
+        env:
+          EBK_BUILDX_CACHE_DIR: \${{ runner.temp }}/ebk-buildx-cache
+          EBK_RELEASE_TOOL_CACHE_DIR: \${{ runner.temp }}/ebk-release-tools
+          EBK_CONTAINER_BASELINE_COMMIT: \${{ needs.immutable-artifacts.outputs.baseline_commit }}
+          EBK_CONTAINER_BASELINE_ROOT: \${{ needs.immutable-artifacts.outputs.baseline_found == 'true' && format('{0}/ebk-deployment-baseline', runner.temp) || '' }}
         run: |
           set -euo pipefail
 ${indentedScript(exactStageDeployerGuardScript('Container build', '$EBK_POLICY_ACCOUNT_ID'), 10)}
-          IFS=',' read -r -a projects <<< "$EBK_SLICE_PROJECTS"
-          for project in "\${projects[@]}"; do
-            test -n "$project" || continue
-            pnpm nx run "$project:\${{ matrix.target }}"
-          done
+          case "$EBK_SLICE_PROJECT" in
+            ''|-*|*-|*[!a-z0-9-]*) echo 'Container build Slice project must be an exact normalized Slice name'; exit 1 ;;
+          esac
+          case ",$EBK_SLICE_PROJECTS," in
+            *",$EBK_SLICE_PROJECT,"*) ;;
+            *) echo 'Container build Slice project is not in the committed deployment plan'; exit 1 ;;
+          esac
+          pnpm nx run "$EBK_SLICE_PROJECT:\${{ matrix.target }}"
       - name: Retain native platform evidence
         uses: ${actionPins.uploadArtifact}
         with:
-          name: container-platform-\${{ needs.prepare.outputs.stage }}-\${{ matrix.architecture }}-\${{ github.run_id }}-\${{ github.run_attempt }}
+          name: container-platform-\${{ needs.prepare.outputs.stage }}-\${{ matrix.project.project }}-\${{ matrix.architecture }}-\${{ github.run_id }}-\${{ github.run_attempt }}
           if-no-files-found: error
           include-hidden-files: true
           retention-days: 30
+          # The glob keeps partials/<stage> as the artifact root: the assemble
+          # job merges every platform artifact into that directory and the
+          # container release tool reads <project>/<architecture>/ beneath it.
+          # A literal <project>/<architecture> path would make the architecture
+          # directory the root and flatten the merged restore.
           path: .ebk/evidence/container-release/partials/\${{ needs.prepare.outputs.stage }}/*/\${{ matrix.architecture }}
 
   container-assemble:
@@ -1213,8 +1386,10 @@ ${indentedScript(exactStageDeployerGuardScript('Container promotion', '$AWS_EXPE
           IFS=',' read -r -a projects <<< "$EBK_SLICE_PROJECTS"
           for project in "\${projects[@]}"; do
             test -n "$project" || continue
-            export EBK_CONTAINER_PROMOTION_SOURCE_BINDING_PATH="../../.ebk/evidence/container-release/staging/packages/$project/binding.json"
-            export EBK_CONTAINER_PROMOTION_SOURCE_SIDECAR_PATH="../../.ebk/evidence/container-release/staging/packages/$project/release-bound-binding.json"
+            # The container release tool resolves these against the repository
+            # root, so they stay repository-relative (EBK-INT-2026-077).
+            export EBK_CONTAINER_PROMOTION_SOURCE_BINDING_PATH=".ebk/evidence/container-release/staging/packages/$project/binding.json"
+            export EBK_CONTAINER_PROMOTION_SOURCE_SIDECAR_PATH=".ebk/evidence/container-release/staging/packages/$project/release-bound-binding.json"
             pnpm nx run "$project:container-release-promote"
           done
       - id: retain
@@ -1233,6 +1408,7 @@ ${indentedScript(exactStageDeployerGuardScript('Container promotion', '$AWS_EXPE
     if: >-
       always() &&
       needs.prepare.result == 'success' &&
+      needs.prepare.outputs.action != 'rehearse' &&
       (
         needs.prepare.outputs.action != 'deploy' ||
         (
@@ -1284,6 +1460,9 @@ ${indentedScript(exactStageDeployerGuardScript('Container promotion', '$AWS_EXPE
       EBK_SLICE_PROJECTS: \${{ needs.prepare.outputs.slice_projects }}
       EBK_SOURCE_COMMIT: \${{ inputs.source_commit || github.sha }}
       EBK_STAGE: \${{ needs.prepare.outputs.stage }}
+      EBK_LIFECYCLE_SCOPE: \${{ inputs.lifecycle || 'affected' }}
+      EBK_BASELINE_FOUND: \${{ needs.immutable-artifacts.outputs.baseline_found }}
+      EBK_BASELINE_RUN_ID: \${{ needs.immutable-artifacts.outputs.baseline_run_id }}
     steps:
       - name: Check out immutable deployment source
         uses: ${actionPins.checkout}
@@ -1325,6 +1504,17 @@ ${indentedScript(exactStageDeployerGuardScript('Container promotion', '$AWS_EXPE
           github-token: \${{ github.token }}
           path: .ebk/evidence/release-candidate
           run-id: \${{ needs.immutable-artifacts.outputs.producer_run_id }}
+      - name: Restore the baseline deployment receipt for unchanged Slices
+        if: needs.prepare.outputs.action == 'deploy' && needs.immutable-artifacts.outputs.baseline_found == 'true'
+        uses: ${actionPins.downloadArtifact}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          artifact-ids: \${{ needs.immutable-artifacts.outputs.baseline_artifact_id }}
+          github-token: \${{ github.token }}
+          path: \${{ runner.temp }}/ebk-deployment-baseline
+          run-id: \${{ needs.immutable-artifacts.outputs.baseline_run_id }}
       - name: Restore exact current-stage container binding
         if: >-
           needs.prepare.outputs.action == 'deploy' &&
@@ -1476,9 +1666,21 @@ ${indentedScript(exactStageDeployerGuardScript('Native lifecycle', '$EBK_POLICY_
           set -euo pipefail
           test -n "$AWS_DEPLOY_ROLE_ARN" || { echo 'Stage deployment role is absent'; exit 1; }
           if [ "$EBK_ACTION" = deploy ]; then
+            case "$EBK_LIFECYCLE_SCOPE" in affected|full) ;; *) echo 'Lifecycle scope must be affected or full'; exit 1 ;; esac
+            baseline_arguments=()
+            if [ "$EBK_LIFECYCLE_SCOPE" = affected ] && [ "$EBK_BASELINE_FOUND" = true ]; then
+              case "$EBK_BASELINE_RUN_ID" in ''|*[!0-9]*) echo 'Baseline run id is malformed'; exit 1 ;; esac
+              baseline_arguments=(
+                --baselineReceipt="$RUNNER_TEMP/ebk-deployment-baseline/deployment/latest.json"
+                --baselineRunId="$EBK_BASELINE_RUN_ID"
+                --baselineRunAttempt=1
+              )
+            fi
             pnpm nx run ${name}:deploy-local -- \
               --stage="$EBK_STAGE" \
-              --expectedRoleArn="$AWS_DEPLOY_ROLE_ARN"
+              --expectedRoleArn="$AWS_DEPLOY_ROLE_ARN" \
+              --lifecycleScope="$EBK_LIFECYCLE_SCOPE" \
+              "\${baseline_arguments[@]}"
           else
             [ -n "$EBK_ORDERED_PROJECTS" ] || { echo 'Committed deployment order is empty'; exit 1; }
             IFS=',' read -r -a projects <<< "$EBK_ORDERED_PROJECTS"
@@ -1546,6 +1748,673 @@ ${indentedScript(postdeploySupplyChainBindingScript(), 10)}
             .ebk/evidence/deployment/promotion.json
             .ebk/evidence/container-release/**
           retention-days: 30
+${deploymentProfile === 'starter' ? '' : renderRehearseJob(options)}${trunkPromotion ? renderTrunkPromotionJobs(options) : ''}`;
+}
+/**
+ * Managed Router WAF blocking rehearsal (EBK-INT-2026-079). The protected
+ * dispatch runs the foundation rehearsal target under the staging deployment
+ * role with seedProbes, so the runner performs the operator probes itself
+ * inside the private-smoke allowlist admission, proves the admission removed,
+ * and opens the pull request that carries the sealed evidence and receipt
+ * back to develop through the ordinary review path.
+ */
+function renderRehearseJob(options) {
+    const { actionPins, name, toolVersions } = options;
+    return `
+  rehearse:
+    name: rehearse staging Router WAF blocking
+    needs: prepare
+    if: >-
+      needs.prepare.result == 'success' &&
+      needs.prepare.outputs.action == 'rehearse' &&
+      needs.prepare.outputs.stage == 'staging' &&
+      needs.prepare.outputs.profile != 'starter'
+    runs-on: ubuntu-latest
+    environment: \${{ needs.prepare.outputs.stage }}
+    permissions:
+      actions: read
+      contents: write
+      id-token: write
+      pull-requests: write
+    env:
+      AWS_DEPLOY_ROLE_ARN: \${{ needs.prepare.outputs.stage_deploy_role_arn }}
+      AWS_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_EXPECTED_ACCOUNT_ID }}
+      AWS_PARTITION: \${{ needs.prepare.outputs.partition }}
+      AWS_REGION: \${{ vars.AWS_REGION }}
+      EBK_ACTION: rehearse
+      EBK_DEPLOYMENT_PROFILE: \${{ needs.prepare.outputs.profile }}
+      EBK_POLICY_ACCOUNT_ID: \${{ needs.prepare.outputs.account_id }}
+      EBK_POLICY_REGION: \${{ needs.prepare.outputs.region }}
+      EBK_PROBE_URL: \${{ needs.prepare.outputs.probe_url }}
+      EBK_SOURCE_COMMIT: \${{ inputs.source_commit || github.sha }}
+      EBK_STAGE: \${{ needs.prepare.outputs.stage }}
+    steps:
+      - name: Check out immutable deployment source
+        uses: ${actionPins.checkout}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+      - uses: ${actionPins.pnpmSetup}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+      - uses: ${actionPins.setupNode}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          node-version: ${toolVersions.node}
+          cache: pnpm
+      - env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
+      - name: Verify managed workspace integrity before AWS authority
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: pnpm nx run ${name}:workspace-health
+      - name: Require the exact pending rehearsal seeds
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+          set -euo pipefail
+          for seed in router-waf-live-evidence router-waf-blocking-rehearsal; do
+            [ "$(jq -r '.status // empty' "packages/foundation/security/$seed.json")" = pending ] || {
+              echo "packages/foundation/security/$seed.json must be reset to its pending seed before another rehearsal"; exit 1;
+            }
+          done
+      - name: Revalidate exact protected branch tip before OIDC
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_SOURCE_BRANCH: \${{ env.EBK_DEPLOYMENT_SOURCE_BRANCH }}
+          EBK_SOURCE_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+          GH_REPO: \${{ github.repository }}
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+          [ "$(git rev-parse HEAD)" = "$EBK_SOURCE_COMMIT" ] || {
+            echo 'Deployment checkout differs from the exact protected source'; exit 1;
+          }
+          branch_tip="$(gh api "/repos/$GH_REPO/git/ref/heads/$EBK_SOURCE_BRANCH" --jq '.object.sha')"
+          [ "$branch_tip" = "$EBK_SOURCE_COMMIT" ] || {
+            echo 'Deployment source is no longer the exact protected branch tip'; exit 1;
+          }
+      - name: Assume the one stage deployment role
+        uses: ${actionPins.configureAwsCredentials}
+        with:
+          audience: \${{ needs.prepare.outputs.oidc_audience }}
+          aws-region: \${{ vars.AWS_REGION }}
+          role-session-name: ebk-rehearse-\${{ github.run_id }}-\${{ github.run_attempt }}
+          role-to-assume: \${{ env.AWS_DEPLOY_ROLE_ARN }}
+      - name: Verify exact stage authority
+        run: |
+          set -euo pipefail
+          [ "$AWS_EXPECTED_ACCOUNT_ID" = "$EBK_POLICY_ACCOUNT_ID" ]
+          [ "$AWS_REGION" = "$EBK_POLICY_REGION" ]
+${indentedScript(exactStageDeployerGuardScript('Router WAF rehearsal', '$EBK_POLICY_ACCOUNT_ID'), 10)}
+      - name: Rehearse Router WAF blocking with runner-seeded probes
+        id: rehearsal
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_GITHUB_JOB_WORKFLOW_REF: \${{ job.workflow_ref }}
+          GITHUB_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+          test -n "$AWS_DEPLOY_ROLE_ARN" || { echo 'Stage deployment role is absent'; exit 1; }
+          pnpm nx run foundation:router-waf-rehearsal -- \\
+            --probeUrl="$EBK_PROBE_URL" \\
+            --seedProbes=true
+      - name: Prove temporary smoke admission removed
+        if: always() && steps.rehearsal.outcome != 'skipped'
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_GITHUB_JOB_WORKFLOW_REF: \${{ job.workflow_ref }}
+          GITHUB_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+${indentedScript(exactStageDeployerGuardScript('Smoke access cleanup', '$EBK_POLICY_ACCOUNT_ID'), 10)}
+          [ "$(git rev-parse HEAD)" = "$EBK_SOURCE_COMMIT" ]
+          node --input-type=module <<'NODE'
+          import { cleanupGithubPrivateSmoke } from '@empire-builder-kit/nx/foundation';
+          await cleanupGithubPrivateSmoke({
+            account: process.env.EBK_POLICY_ACCOUNT_ID,
+            deploymentProfile: process.env.EBK_DEPLOYMENT_PROFILE,
+            root: process.cwd(),
+            source: process.env.EBK_SOURCE_COMMIT,
+            stage: process.env.EBK_STAGE,
+            workspace: '${name}',
+          });
+          NODE
+      - name: Retain the sealed rehearsal evidence
+        uses: ${actionPins.uploadArtifact}
+        with:
+          if-no-files-found: error
+          name: router-waf-rehearsal-\${{ github.run_id }}-\${{ github.run_attempt }}
+          path: |
+            packages/foundation/security/router-waf-live-evidence.json
+            packages/foundation/security/router-waf-blocking-rehearsal.json
+          retention-days: 90
+      - name: Open the rehearsal receipt pull request
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_RUN_ATTEMPT: \${{ github.run_attempt }}
+          EBK_RUN_ID: \${{ github.run_id }}
+          GH_REPO: \${{ github.repository }}
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+          case "$EBK_RUN_ID:$EBK_RUN_ATTEMPT" in *[!0-9:]*|:*|*:) exit 1 ;; esac
+          branch="ebk/router-waf-rehearsal-$EBK_RUN_ID-$EBK_RUN_ATTEMPT"
+          git diff --quiet -- packages/foundation/security && { echo 'The rehearsal sealed nothing new'; exit 1; }
+          git config user.name 'ebk-router-waf-rehearsal[bot]'
+          git config user.email 'ebk-router-waf-rehearsal[bot]@users.noreply.github.com'
+          git checkout -q -b "$branch"
+          git add packages/foundation/security/router-waf-live-evidence.json packages/foundation/security/router-waf-blocking-rehearsal.json
+          git commit -q -m "chore(security): seal the staging Router WAF blocking rehearsal (run $EBK_RUN_ID)"
+          git -c http.https://github.com/.extraheader="AUTHORIZATION: bearer $GH_TOKEN" push -q origin "HEAD:refs/heads/$branch"
+          gh pr create \\
+            --head "$branch" \\
+            --base develop \\
+            --title 'chore(security): seal the staging Router WAF blocking rehearsal' \\
+            --body "Managed rehearsal run $EBK_RUN_ID attempt $EBK_RUN_ATTEMPT sealed the staging Router WAF blocking rehearsal for the committed policy digest. Merge to unblock the production Router WAF gate; the receipt binds the exact account, Region, and policy digest."
+`;
+}
+/**
+ * Trunk promotion: after a successful staging lifecycle on develop, the same
+ * run binds its own staging receipt, promotes the reviewed OCI indexes into
+ * production, deploys production, and fast-forwards main to the deployed
+ * commit. Every job carries the production environment so environment
+ * reviewers can still gate it, and every step reuses the promotion-pr scripts.
+ */
+function renderTrunkPromotionJobs(options) {
+    const { actionPins, name, toolVersions } = options;
+    const checkoutAndInstall = (integrityStep) => `      - name: Check out immutable deployment source
+        uses: ${actionPins.checkout}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+      - uses: ${actionPins.pnpmSetup}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+      - uses: ${actionPins.setupNode}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          node-version: ${toolVersions.node}
+          cache: pnpm
+      - env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
+      - name: ${integrityStep}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: pnpm nx run ${name}:workspace-health`;
+    const revalidateTip = `      - name: Revalidate exact protected branch tip before OIDC
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_SOURCE_BRANCH: \${{ env.EBK_DEPLOYMENT_SOURCE_BRANCH }}
+          EBK_SOURCE_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+          GH_REPO: \${{ github.repository }}
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+          [ "$(git rev-parse HEAD)" = "$EBK_SOURCE_COMMIT" ] || {
+            echo 'Deployment checkout differs from the exact protected source'; exit 1;
+          }
+          branch_tip="$(gh api "/repos/$GH_REPO/git/ref/heads/$EBK_SOURCE_BRANCH" --jq '.object.sha')"
+          [ "$branch_tip" = "$EBK_SOURCE_COMMIT" ] || {
+            echo 'Deployment source is no longer the exact protected branch tip'; exit 1;
+          }`;
+    const trunkPromotionGate = `      needs.prepare.outputs.action == 'deploy' &&
+      needs.prepare.outputs.stage == 'staging' &&
+      needs.prepare.outputs.profile != 'starter' &&
+      needs.prepare.outputs.has_slices == 'true'`;
+    return `
+  promote-production:
+    name: promote the staging-tested candidate to production
+    needs: [prepare, immutable-artifacts, container-assemble, execute]
+    if: >-
+      always() &&
+      needs.prepare.result == 'success' &&
+      needs.immutable-artifacts.result == 'success' &&
+      needs.container-assemble.result == 'success' &&
+      needs.execute.result == 'success' &&
+${trunkPromotionGate}
+    runs-on: ubuntu-latest
+    environment: production
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+    outputs:
+      artifact_digest: \${{ steps.retain.outputs.artifact-digest }}
+      artifact_id: \${{ steps.retain.outputs.artifact-id }}
+      candidate_artifact_digest: \${{ steps.staging.outputs.artifact_digest }}
+      candidate_artifact_id: \${{ steps.staging.outputs.artifact_id }}
+      candidate_material_digest: \${{ steps.staging.outputs.candidate_material_digest }}
+      candidate_producer_run_attempt: \${{ steps.staging.outputs.producer_run_attempt }}
+      candidate_producer_run_id: \${{ steps.staging.outputs.producer_run_id }}
+    env:
+      AWS_DEPLOY_ROLE_ARN: \${{ needs.prepare.outputs.production_deploy_role_arn }}
+      AWS_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_EXPECTED_ACCOUNT_ID }}
+      AWS_PARTITION: \${{ needs.prepare.outputs.partition }}
+      AWS_REGION: \${{ vars.AWS_REGION }}
+      EBK_ACTION: deploy
+      EBK_DEPLOYMENT_PROFILE: \${{ needs.prepare.outputs.profile }}
+      EBK_POLICY_PRODUCTION_ACCOUNT_ID: \${{ needs.prepare.outputs.production_account_id }}
+      EBK_POLICY_REGION: \${{ needs.prepare.outputs.region }}
+      EBK_POLICY_STAGING_ACCOUNT_ID: \${{ needs.prepare.outputs.staging_account_id }}
+      EBK_RELEASE_SOURCE_COMMIT: \${{ needs.immutable-artifacts.outputs.source_commit }}
+      EBK_SOURCE_COMMIT: \${{ inputs.source_commit || github.sha }}
+      EBK_STAGE: production
+      EBK_SLICE_PROJECTS: \${{ needs.prepare.outputs.slice_projects }}
+    steps:
+${checkoutAndInstall('Verify managed workspace integrity before container authority')}
+      - id: staging-receipt
+        name: Select this run's staging deployment receipt
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_DEPLOYMENT_RUN_ATTEMPT: \${{ github.run_attempt }}
+          EBK_DEPLOYMENT_RUN_ID: \${{ github.run_id }}
+          GH_REPO: \${{ github.repository }}
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+          case "$EBK_DEPLOYMENT_RUN_ID:$EBK_DEPLOYMENT_RUN_ATTEMPT" in *[!0-9:]*|:*|*:) exit 1 ;; esac
+          artifacts="$(gh api "/repos/$GH_REPO/actions/runs/$EBK_DEPLOYMENT_RUN_ID/artifacts?per_page=100")"
+          receipt_name="deployment-receipt-staging-$EBK_DEPLOYMENT_RUN_ID-$EBK_DEPLOYMENT_RUN_ATTEMPT"
+          receipt="$(printf '%s' "$artifacts" | jq -c --arg name "$receipt_name" \\
+            '[.artifacts[] | select(.name == $name and .expired == false)] | if length == 1 then .[0] else empty end')"
+          [ -n "$receipt" ] || { echo 'This run retained no exact staging deployment receipt'; exit 1; }
+          artifact_id="$(printf '%s' "$receipt" | jq -r '.id // empty')"
+          artifact_digest="$(printf '%s' "$receipt" | jq -r '.digest // empty')"
+          case "$artifact_id" in ''|*[!0-9]*) exit 1 ;; esac
+          case "$artifact_digest" in sha256:????????????????????????????????????????????????????????????????) ;; *) exit 1 ;; esac
+          echo "artifact_digest=$artifact_digest" >> "$GITHUB_OUTPUT"
+          echo "artifact_id=$artifact_id" >> "$GITHUB_OUTPUT"
+      - name: Restore this run's staging deployment receipt
+        uses: ${actionPins.downloadArtifact}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          artifact-ids: \${{ steps.staging-receipt.outputs.artifact_id }}
+          github-token: \${{ github.token }}
+          path: \${{ runner.temp }}/staging-deployment-receipt
+      - id: staging
+        name: Bind exact staging deployment and release evidence
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_STAGING_DEPLOYMENT_RUN_ATTEMPT: \${{ github.run_attempt }}
+          EBK_STAGING_DEPLOYMENT_RUN_ID: \${{ github.run_id }}
+          EBK_EXPECTED_HAS_SLICES: \${{ needs.prepare.outputs.has_slices }}
+          EBK_EXPECTED_DEPLOYMENT_PROFILE: \${{ needs.prepare.outputs.profile }}
+          EBK_EXPECTED_DEPLOYMENT_REGION: \${{ needs.prepare.outputs.region }}
+          EBK_EXPECTED_STAGING_ACCOUNT_ID: \${{ needs.prepare.outputs.staging_account_id }}
+          EBK_STAGING_RECEIPT_ARTIFACT_DIGEST: \${{ steps.staging-receipt.outputs.artifact_digest }}
+          EBK_STAGING_RECEIPT_ARTIFACT_ID: \${{ steps.staging-receipt.outputs.artifact_id }}
+          # The receipt artifact keeps .ebk/evidence as its root (EBK-INT-2026-074).
+          EBK_STAGING_RECEIPT_ROOT: \${{ runner.temp }}/staging-deployment-receipt/deployment
+          EBK_STAGING_SOURCE_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+          GH_REPO: \${{ github.repository }}
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          node --input-type=module <<'NODE'
+${indentedScript(stagingPromotionReceiptValidationScript(), 10)}
+          NODE
+          promotion="$EBK_STAGING_RECEIPT_ROOT/promotion.json"
+          candidate_run_id="$(jq -r '.candidate.producerRunId' "$promotion")"
+          candidate_run_attempt="$(jq -r '.candidate.producerRunAttempt' "$promotion")"
+          candidate_artifact_id="$(jq -r '.candidate.artifactId' "$promotion")"
+          candidate_artifact_digest="$(jq -r '.candidate.artifactDigest' "$promotion")"
+          candidate_run="$(gh api "/repos/$GH_REPO/actions/runs/$candidate_run_id")"
+          printf '%s' "$candidate_run" | jq -e \\
+            --arg source "$EBK_STAGING_SOURCE_COMMIT" \\
+            --arg attempt "$candidate_run_attempt" \\
+            '.head_sha == $source and .head_branch == "develop" and .event == "push" and .path == ".github/workflows/ci.yml" and .conclusion == "success" and (.run_attempt | tostring) == $attempt' >/dev/null
+          candidate_artifacts="$(gh api "/repos/$GH_REPO/actions/runs/$candidate_run_id/artifacts?per_page=100")"
+          printf '%s' "$candidate_artifacts" | jq -e \\
+            --arg id "$candidate_artifact_id" \\
+            --arg digest "$candidate_artifact_digest" \\
+            --arg name "release-candidate-$EBK_STAGING_SOURCE_COMMIT" \\
+            '[.artifacts[] | select((.id | tostring) == $id and .name == $name and .digest == $digest and .expired == false)] | length == 1' >/dev/null
+      - name: Restore exact immutable release candidate for promotion
+        uses: ${actionPins.downloadArtifact}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          artifact-ids: \${{ steps.staging.outputs.artifact_id }}
+          github-token: \${{ github.token }}
+          path: .ebk/evidence/release-candidate
+          run-id: \${{ steps.staging.outputs.producer_run_id }}
+      - name: Restore this run's staging container bundle
+        uses: ${actionPins.downloadArtifact}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          artifact-ids: \${{ steps.staging.outputs.container_artifact_id }}
+          github-token: \${{ github.token }}
+          path: .ebk/evidence/container-release
+${revalidateTip}
+      - name: Assume exact staging registry pull role
+        uses: ${actionPins.configureAwsCredentials}
+        with:
+          audience: \${{ needs.prepare.outputs.oidc_audience }}
+          aws-region: \${{ vars.AWS_STAGING_PROMOTION_REGION }}
+          role-session-name: ebk-staging-container-pull-\${{ github.run_id }}-\${{ github.run_attempt }}
+          role-to-assume: \${{ secrets.AWS_STAGING_PROMOTION_PULL_ROLE_ARN }}
+      - name: Authenticate exact staging source registry
+        env:
+          AWS_STAGING_PROMOTION_PULL_ROLE_ARN: \${{ secrets.AWS_STAGING_PROMOTION_PULL_ROLE_ARN }}
+          EBK_STAGING_ACCOUNT_ID: \${{ vars.AWS_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID }}
+          EBK_STAGING_REGION: \${{ vars.AWS_STAGING_PROMOTION_REGION }}
+        run: |
+          set -euo pipefail
+          [ "$EBK_STAGING_ACCOUNT_ID" = "$EBK_POLICY_STAGING_ACCOUNT_ID" ]
+          [ "$EBK_STAGING_REGION" = "$EBK_POLICY_REGION" ]
+${indentedScript(exactStagingPromotionPullGuardScript(), 10)}
+          [ "$EBK_STAGING_ACCOUNT_ID" != "$AWS_EXPECTED_ACCOUNT_ID" ]
+          registry_suffix=.com
+          case "$EBK_STAGING_REGION" in cn-*) registry_suffix=.com.cn ;; esac
+          aws ecr get-login-password --region "$EBK_STAGING_REGION" |
+            docker login --username AWS --password-stdin \\
+              "$EBK_STAGING_ACCOUNT_ID.dkr.ecr.$EBK_STAGING_REGION.amazonaws$registry_suffix"
+${revalidateTip}
+      - name: Assume the production deployment role for container promotion
+        uses: ${actionPins.configureAwsCredentials}
+        with:
+          audience: \${{ needs.prepare.outputs.oidc_audience }}
+          aws-region: \${{ vars.AWS_REGION }}
+          role-session-name: ebk-production-container-push-\${{ github.run_id }}-\${{ github.run_attempt }}
+          role-to-assume: \${{ env.AWS_DEPLOY_ROLE_ARN }}
+      - name: Promote exact staging indexes without rebuilding
+        env:
+          EBK_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID }}
+          EBK_STAGING_PROMOTION_REGION: \${{ vars.AWS_STAGING_PROMOTION_REGION }}
+        run: |
+          set -euo pipefail
+          [ "$AWS_EXPECTED_ACCOUNT_ID" = "$EBK_POLICY_PRODUCTION_ACCOUNT_ID" ]
+          [ "$AWS_REGION" = "$EBK_POLICY_REGION" ]
+${indentedScript(exactStageDeployerGuardScript('Container promotion', '$AWS_EXPECTED_ACCOUNT_ID'), 10)}
+          IFS=',' read -r -a projects <<< "$EBK_SLICE_PROJECTS"
+          for project in "\${projects[@]}"; do
+            test -n "$project" || continue
+            # Repository-relative for the container release tool (EBK-INT-2026-077).
+            export EBK_CONTAINER_PROMOTION_SOURCE_BINDING_PATH=".ebk/evidence/container-release/staging/packages/$project/binding.json"
+            export EBK_CONTAINER_PROMOTION_SOURCE_SIDECAR_PATH=".ebk/evidence/container-release/staging/packages/$project/release-bound-binding.json"
+            pnpm nx run "$project:container-release-promote"
+          done
+      - id: retain
+        name: Retain production target container binding
+        uses: ${actionPins.uploadArtifact}
+        with:
+          name: container-release-production-\${{ github.run_id }}-\${{ github.run_attempt }}
+          if-no-files-found: error
+          include-hidden-files: true
+          retention-days: 90
+          path: .ebk/evidence/container-release
+
+  execute-production:
+    name: native deploy production
+    needs: [prepare, immutable-artifacts, promote-production]
+    if: >-
+      always() &&
+      needs.prepare.result == 'success' &&
+      needs.immutable-artifacts.result == 'success' &&
+      needs.promote-production.result == 'success' &&
+${trunkPromotionGate}
+    runs-on: ubuntu-latest
+    environment: production
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+    env:
+      AWS_DEPLOY_ROLE_ARN: \${{ needs.prepare.outputs.production_deploy_role_arn }}
+      AWS_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_EXPECTED_ACCOUNT_ID }}
+      AWS_PARTITION: \${{ needs.prepare.outputs.partition }}
+      AWS_REGION: \${{ vars.AWS_REGION }}
+      EBK_ACTION: deploy
+      EBK_ALLOW_PRODUCTION_REMOVE: \${{ vars.EBK_ALLOW_PRODUCTION_REMOVE }}
+      EBK_CANDIDATE_ARTIFACT_DIGEST: \${{ needs.promote-production.outputs.candidate_artifact_digest }}
+      EBK_CANDIDATE_ARTIFACT_ID: \${{ needs.promote-production.outputs.candidate_artifact_id }}
+      EBK_CANDIDATE_MATERIAL_DIGEST: \${{ needs.promote-production.outputs.candidate_material_digest }}
+      EBK_CANDIDATE_PRODUCER_RUN_ATTEMPT: \${{ needs.promote-production.outputs.candidate_producer_run_attempt }}
+      EBK_CANDIDATE_PRODUCER_RUN_ID: \${{ needs.promote-production.outputs.candidate_producer_run_id }}
+      EBK_DEPLOYMENT_PROFILE: \${{ needs.prepare.outputs.profile }}
+      EBK_ORDERED_PROJECTS: \${{ needs.prepare.outputs.ordered_projects }}
+      EBK_POLICY_ACCOUNT_ID: \${{ needs.prepare.outputs.production_account_id }}
+      EBK_POLICY_REGION: \${{ needs.prepare.outputs.region }}
+      EBK_RELEASE_SOURCE_COMMIT: \${{ needs.immutable-artifacts.outputs.source_commit || inputs.source_commit || github.sha }}
+      EBK_SLICE_PROJECTS: \${{ needs.prepare.outputs.slice_projects }}
+      EBK_SOURCE_COMMIT: \${{ inputs.source_commit || github.sha }}
+      EBK_STAGE: production
+      # Production has no same-branch baseline receipt in this run; the
+      # full lifecycle keeps its evidence complete.
+      EBK_LIFECYCLE_SCOPE: full
+      EBK_BASELINE_FOUND: 'false'
+      EBK_BASELINE_RUN_ID: ''
+    steps:
+${checkoutAndInstall('Verify managed workspace integrity before AWS authority')}
+      - name: Restore exact immutable release candidate
+        uses: ${actionPins.downloadArtifact}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          artifact-ids: \${{ needs.promote-production.outputs.candidate_artifact_id }}
+          github-token: \${{ github.token }}
+          path: .ebk/evidence/release-candidate
+          run-id: \${{ needs.promote-production.outputs.candidate_producer_run_id }}
+      - name: Restore exact promoted production container binding
+        uses: ${actionPins.downloadArtifact}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          name: container-release-production-\${{ github.run_id }}-\${{ github.run_attempt }}
+          path: .ebk/evidence/container-release
+      - name: Verify exact predeploy container binding inventory
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+          set -euo pipefail
+          IFS=',' read -r -a projects <<< "$EBK_SLICE_PROJECTS"
+          for project in "\${projects[@]}"; do
+            test -n "$project" || continue
+            test -f ".ebk/evidence/container-release/$EBK_STAGE/packages/$project/binding.json" || {
+              echo "Exact predeploy container binding is absent for $project"
+              exit 1
+            }
+          done
+      - name: Verify exact restored staging-tested release candidate
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+          node --input-type=module <<'NODE'
+${indentedScript(restoredCandidateValidationScript(), 10)}
+          NODE
+      - name: Authorize deployed Blueprint trust before protected mutation
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_PROTECTED_BLUEPRINT_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+        run: |
+          set -euo pipefail
+          case "$EBK_PROTECTED_BLUEPRINT_COMMIT" in
+            ''|*[!0-9a-f]*) echo 'Protected Blueprint authority must be one full lowercase Git object ID'; exit 1 ;;
+          esac
+          test "\${#EBK_PROTECTED_BLUEPRINT_COMMIT}" -eq 40 ||
+            test "\${#EBK_PROTECTED_BLUEPRINT_COMMIT}" -eq 64 ||
+            { echo 'Protected Blueprint authority must be one full Git object ID'; exit 1; }
+          test "$(git rev-parse HEAD)" = "$EBK_PROTECTED_BLUEPRINT_COMMIT" ||
+            { echo 'Protected Blueprint authority differs from the exact workflow checkout'; exit 1; }
+          node tools/blueprint-trust-check.mjs \\
+            --operation=deploy \\
+            --protected-branch=main \\
+            --protected-ref="$EBK_PROTECTED_BLUEPRINT_COMMIT" \\
+            --output=.ebk/evidence/supply-chain/blueprint-trust.json
+      - name: Produce subject-bound protected scanner evidence
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: pnpm nx run ${name}:supply-chain-scan
+      - name: Enforce protected supply-chain policy before mutation
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: pnpm nx run ${name}:supply-chain-check-protected
+      - name: Install pinned uv for generated Python workloads
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+          set -euo pipefail
+          python3 -m pip install --user --disable-pip-version-check 'uv==${tool_versions_js_1.WORKSPACE_UV_VERSION}'
+          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+          "$HOME/.local/bin/uv" --version
+      - name: Install pinned Playwright Chromium for deployed smoke proofs
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+${indentedScript(protectedBrowserInstallScript(), 10)}
+${revalidateTip}
+      - name: Assume the one stage deployment role
+        uses: ${actionPins.configureAwsCredentials}
+        with:
+          audience: \${{ needs.prepare.outputs.oidc_audience }}
+          aws-region: \${{ vars.AWS_REGION }}
+          role-session-name: ebk-native-\${{ github.run_id }}-\${{ github.run_attempt }}
+          role-to-assume: \${{ env.AWS_DEPLOY_ROLE_ARN }}
+      - name: Verify exact stage authority
+        run: |
+          set -euo pipefail
+          [ "$AWS_EXPECTED_ACCOUNT_ID" = "$EBK_POLICY_ACCOUNT_ID" ]
+          [ "$AWS_REGION" = "$EBK_POLICY_REGION" ]
+${indentedScript(exactStageDeployerGuardScript('Native lifecycle', '$EBK_POLICY_ACCOUNT_ID'), 10)}
+      - name: Run ordered native lifecycle targets
+        id: native-lifecycle
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_GITHUB_JOB_WORKFLOW_REF: \${{ job.workflow_ref }}
+          GITHUB_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+          test -n "$AWS_DEPLOY_ROLE_ARN" || { echo 'Stage deployment role is absent'; exit 1; }
+          pnpm nx run ${name}:deploy-local -- \\
+            --stage="$EBK_STAGE" \\
+            --expectedRoleArn="$AWS_DEPLOY_ROLE_ARN" \\
+            --lifecycleScope="$EBK_LIFECYCLE_SCOPE"
+      - name: Prove temporary smoke admission removed
+        if: always() && steps.native-lifecycle.outcome != 'skipped'
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_GITHUB_JOB_WORKFLOW_REF: \${{ job.workflow_ref }}
+          GITHUB_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+${indentedScript(exactStageDeployerGuardScript('Smoke access cleanup', '$EBK_POLICY_ACCOUNT_ID'), 10)}
+          [ "$(git rev-parse HEAD)" = "$EBK_SOURCE_COMMIT" ]
+          git diff --quiet HEAD
+          node --input-type=module <<'NODE'
+          import { cleanupGithubPrivateSmoke } from '@empire-builder-kit/nx/foundation';
+          await cleanupGithubPrivateSmoke({
+            account: process.env.EBK_POLICY_ACCOUNT_ID,
+            deploymentProfile: process.env.EBK_DEPLOYMENT_PROFILE,
+            root: process.cwd(),
+            source: process.env.EBK_SOURCE_COMMIT,
+            stage: process.env.EBK_STAGE,
+            workspace: '${name}',
+          });
+          NODE
+      - name: Seal exact postdeploy supply-chain binding
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+          node --input-type=module <<'NODE'
+${indentedScript(postdeploySupplyChainBindingScript(), 10)}
+          NODE
+      - name: Retain bounded deployment receipt
+        if: always()
+        uses: ${actionPins.uploadArtifact}
+        with:
+          if-no-files-found: warn
+          name: deployment-receipt-production-\${{ github.run_id }}-\${{ github.run_attempt }}
+          path: |
+            .ebk/evidence/deployment/latest.json
+            .ebk/evidence/deployment/postdeploy-supply-chain.json
+            .ebk/evidence/deployment/promotion.json
+            .ebk/evidence/container-release/**
+          retention-days: 30
+
+  record-main:
+    name: record the deployed commit on main
+    needs: [prepare, execute-production]
+    if: >-
+      always() &&
+      needs.prepare.result == 'success' &&
+      needs.execute-production.result == 'success' &&
+${trunkPromotionGate}
+    runs-on: ubuntu-latest
+    environment: production
+    # The fast-forward uses the scoped environment token, not the workflow token.
+    permissions:
+      contents: read
+    steps:
+      - name: Fast-forward protected main to the deployed commit
+        env:
+          EBK_RECORD_MAIN_TOKEN: \${{ secrets.${exports.EBK_RECORD_MAIN_TOKEN_SECRET} }}
+          EBK_SOURCE_BRANCH: \${{ env.EBK_DEPLOYMENT_SOURCE_BRANCH }}
+          EBK_SOURCE_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+          GH_REPO: \${{ github.repository }}
+        run: |
+          set -euo pipefail
+          test -n "$EBK_RECORD_MAIN_TOKEN" || { echo '${exports.EBK_RECORD_MAIN_TOKEN_SECRET} is absent from the production environment'; exit 1; }
+          [ "$EBK_SOURCE_BRANCH" = develop ] || { echo 'Trunk promotion records main only from develop'; exit 1; }
+          case "$EBK_SOURCE_COMMIT" in ''|*[!0-9a-f]*) exit 1 ;; esac
+          export GH_TOKEN="$EBK_RECORD_MAIN_TOKEN"
+          develop_tip="$(gh api "/repos/$GH_REPO/git/ref/heads/develop" --jq '.object.sha')"
+          [ "$develop_tip" = "$EBK_SOURCE_COMMIT" ] || { echo 'Deployed commit is no longer the develop tip; leaving main unchanged'; exit 1; }
+          main_tip="$(gh api "/repos/$GH_REPO/git/ref/heads/main" --jq '.object.sha')"
+          if [ "$main_tip" = "$EBK_SOURCE_COMMIT" ]; then
+            echo 'main already records the deployed commit'
+            exit 0
+          fi
+          # GitHub refuses a non-fast-forward reference update unless force is
+          # requested; it is never requested here.
+          gh api -X PATCH "/repos/$GH_REPO/git/refs/heads/main" -f sha="$EBK_SOURCE_COMMIT" -F force=false >/dev/null
+          recorded="$(gh api "/repos/$GH_REPO/git/ref/heads/main" --jq '.object.sha')"
+          [ "$recorded" = "$EBK_SOURCE_COMMIT" ] || { echo 'main did not record the deployed commit'; exit 1; }
+          echo "main now records $EBK_SOURCE_COMMIT (previously $main_tip)"
 `;
 }
 function renderThinDeployWorkflowFilePlan(options) {