@empire-builder-kit/nx 1.0.0-rc.37 → 1.0.0-rc.39

package/src/generators/preset/workspace-files-thin-deploy.js

@@ -217,6 +217,8 @@ const required = (name, pattern) => {
 const root = process.env.EBK_STAGING_RECEIPT_ROOT?.trim() ?? '';
 if (!root) throw new Error('Staging deployment receipt root is absent.');
 const expectedHasSlices = required('EBK_EXPECTED_HAS_SLICES', /^(?:true|false)$/) === 'true';
+const expectedHasContainers = required('EBK_EXPECTED_HAS_CONTAINERS', /^(?:true|false)$/) === 'true';
+if (expectedHasContainers && !expectedHasSlices) throw new Error('Container work requires a selected Slice.');
 const sourceCommit = required('EBK_STAGING_SOURCE_COMMIT', commit);
 const expectedAccount = required('EBK_EXPECTED_STAGING_ACCOUNT_ID', /^[0-9]{12}$/);
 const expectedProfile = required('EBK_EXPECTED_DEPLOYMENT_PROFILE', /^(?:production-isolated|fully-isolated)$/);
@@ -244,6 +246,9 @@ if (
   promotion?.kind !== 'ebk-staging-deployment-promotion' ||
   promotion.schemaVersion !== 1 ||
   promotion.hasSlices !== expectedHasSlices ||
+  typeof promotion.hasContainers !== 'boolean' ||
+  (promotion.hasContainers && !promotion.hasSlices) ||
+  (expectedHasContainers && !promotion.hasContainers) ||
   promotion.stage !== 'staging' ||
   promotion.account !== expectedAccount ||
   promotion.deploymentProfile !== expectedProfile ||
@@ -258,10 +263,12 @@ if (
       !integer.test(promotion.candidate?.producerRunId ?? '') ||
       !integer.test(promotion.candidate?.producerRunAttempt ?? '') ||
       promotion.candidate?.sourceCommit !== sourceCommit ||
-      !/^[a-f0-9]{64}$/.test(promotion.candidate?.materialDigest ?? '') ||
-      !integer.test(promotion.container?.artifactId ?? '') ||
+      !/^[a-f0-9]{64}$/.test(promotion.candidate?.materialDigest ?? '')
+    : promotion.candidate !== null) ||
+  (promotion.hasContainers
+    ? !integer.test(promotion.container?.artifactId ?? '') ||
       !digest.test(promotion.container?.artifactDigest ?? '')
-    : promotion.candidate !== null || promotion.container !== null)
+    : promotion.container !== null)
 ) {
   throw new Error('Staging deployment receipt and candidate promotion binding disagree.');
 }
@@ -276,11 +283,13 @@ if (expectedHasSlices) Object.assign(outputs, {
   artifact_digest: promotion.candidate.artifactDigest,
   artifact_id: promotion.candidate.artifactId,
   candidate_material_digest: promotion.candidate.materialDigest,
-  container_artifact_digest: promotion.container.artifactDigest,
-  container_artifact_id: promotion.container.artifactId,
   producer_run_attempt: promotion.candidate.producerRunAttempt,
   producer_run_id: promotion.candidate.producerRunId,
 });
+if (expectedHasContainers) Object.assign(outputs, {
+  container_artifact_digest: promotion.container.artifactDigest,
+  container_artifact_id: promotion.container.artifactId,
+});
 for (const [name, value] of Object.entries(outputs)) appendFileSync(process.env.GITHUB_OUTPUT, name + '=' + value + '\\n');`;
 }
 /** @internal Shared verbatim with the generated workflow and executable tests. */
@@ -333,6 +342,8 @@ const required = (name, pattern) => {
 };
 const sourceCommit = required('EBK_RELEASE_SOURCE_COMMIT', /^[a-f0-9]{40,64}$/);
 const hasSlices = required('EBK_HAS_SLICES', /^(?:true|false)$/) === 'true';
+const hasContainers = required('EBK_HAS_CONTAINERS', /^(?:true|false)$/) === 'true';
+if (hasContainers && !hasSlices) throw new Error('Container work requires a selected Slice.');
 const account = required('EBK_POLICY_ACCOUNT_ID', /^[0-9]{12}$/);
 const deploymentProfile = required('EBK_DEPLOYMENT_PROFILE', /^(?:production-isolated|fully-isolated)$/);
 const region = required('EBK_POLICY_REGION', /^[a-z]{2}(?:-gov)?-[a-z]+(?:-[a-z]+)*-[0-9]$/);
@@ -361,15 +372,6 @@ if (hasSlices) {
   const producerRunAttempt = required('EBK_CANDIDATE_PRODUCER_RUN_ATTEMPT', /^[1-9][0-9]*$/);
   const artifactId = required('EBK_CANDIDATE_ARTIFACT_ID', /^[1-9][0-9]*$/);
   const artifactDigest = required('EBK_CANDIDATE_ARTIFACT_DIGEST', /^sha256:[a-f0-9]{64}$/);
-  const containerArtifactId = required('EBK_CONTAINER_ARTIFACT_ID', /^[1-9][0-9]*$/);
-  // actions/upload-artifact emits the bare SHA-256 hex in artifact-digest while
-  // the artifacts API and the promotion compare the sha256:<hex> registry form
-  // (EBK-INT-2026-073). Normalize before the exact validation.
-  const containerArtifactDigestRaw = process.env.EBK_CONTAINER_ARTIFACT_DIGEST?.trim() ?? '';
-  process.env.EBK_CONTAINER_ARTIFACT_DIGEST = /^[a-f0-9]{64}$/.test(containerArtifactDigestRaw)
-    ? 'sha256:' + containerArtifactDigestRaw
-    : containerArtifactDigestRaw;
-  const containerArtifactDigest = required('EBK_CONTAINER_ARTIFACT_DIGEST', /^sha256:[a-f0-9]{64}$/);
   const root = '.ebk/evidence/release-candidate/packages';
   const projects = readdirSync(root, { withFileTypes: true })
     .filter((entry) => entry.isDirectory())
@@ -385,10 +387,19 @@ if (hasSlices) {
     return { manifestDigest: createHash('sha256').update(bytes).digest('hex'), project };
   });
   candidate = { artifactDigest, artifactId, materialDigest: createHash('sha256').update(JSON.stringify(entries)).digest('hex'), producerRunAttempt, producerRunId, sourceCommit };
-  container = { artifactDigest: containerArtifactDigest, artifactId: containerArtifactId };
-} else if (Object.values(candidateEnvironment).some(Boolean) || Object.values(containerEnvironment).some(Boolean)) {
+} else if (Object.values(candidateEnvironment).some(Boolean)) {
   throw new Error('A staging promotion without Slices must not carry Slice release material.');
 }
+if (hasContainers) {
+  const artifactId = required('EBK_CONTAINER_ARTIFACT_ID', /^[1-9][0-9]*$/);
+  // The upload action returns bare hex; the artifacts API uses sha256:<hex>.
+  const raw = containerEnvironment.artifactDigest;
+  process.env.EBK_CONTAINER_ARTIFACT_DIGEST = /^[a-f0-9]{64}$/.test(raw) ? 'sha256:' + raw : raw;
+  const artifactDigest = required('EBK_CONTAINER_ARTIFACT_DIGEST', /^sha256:[a-f0-9]{64}$/);
+  container = { artifactDigest, artifactId };
+} else if (Object.values(containerEnvironment).some(Boolean)) {
+  throw new Error('A staging promotion without OCI artifacts must not carry container material.');
+}
 const promotion = {
   account,
   candidate,
@@ -396,6 +407,7 @@ const promotion = {
   deploymentProfile,
   deployment: { receiptDigest: createHash('sha256').update(receiptBytes).digest('hex'), runAttempt: deploymentRunAttempt, runId: deploymentRunId },
   hasSlices,
+  hasContainers,
   kind: 'ebk-staging-deployment-promotion',
   region,
   schemaVersion: 1,
@@ -529,6 +541,9 @@ jobs:
       probe_url: \${{ steps.route.outputs.probe_url }}
       account_id: \${{ steps.account.outputs.account_id }}
       has_slices: \${{ steps.policy.outputs.has_slices }}
+      has_containers: \${{ steps.policy.outputs.has_containers }}
+      container_projects: \${{ steps.policy.outputs.container_projects }}
+      container_matrix: \${{ steps.policy.outputs.container_matrix }}
       ordered_projects: \${{ steps.policy.outputs.ordered_projects }}
       oidc_audience: \${{ steps.account.outputs.audience }}
       partition: \${{ steps.account.outputs.partition }}
@@ -879,6 +894,7 @@ ${indentedScript(`set -euo pipefail\n${canonicalStageAuthorityDerivationScript()
           EBK_STAGING_DEPLOYMENT_RUN_ATTEMPT: \${{ steps.staging-receipt.outputs.run_attempt }}
           EBK_STAGING_DEPLOYMENT_RUN_ID: \${{ steps.staging-receipt.outputs.run_id }}
           EBK_EXPECTED_HAS_SLICES: \${{ needs.prepare.outputs.has_slices }}
+          EBK_EXPECTED_HAS_CONTAINERS: \${{ needs.prepare.outputs.has_containers }}
           EBK_EXPECTED_DEPLOYMENT_PROFILE: \${{ needs.prepare.outputs.profile }}
           EBK_EXPECTED_DEPLOYMENT_REGION: \${{ needs.prepare.outputs.region }}
           EBK_EXPECTED_STAGING_ACCOUNT_ID: \${{ needs.prepare.outputs.staging_account_id }}
@@ -900,8 +916,6 @@ ${indentedScript(stagingPromotionReceiptValidationScript(), 10)}
             candidate_run_attempt="$(jq -r '.candidate.producerRunAttempt' "$promotion")"
             candidate_artifact_id="$(jq -r '.candidate.artifactId' "$promotion")"
             candidate_artifact_digest="$(jq -r '.candidate.artifactDigest' "$promotion")"
-            container_artifact_id="$(jq -r '.container.artifactId' "$promotion")"
-            container_artifact_digest="$(jq -r '.container.artifactDigest' "$promotion")"
             candidate_run="$(gh api "/repos/$GH_REPO/actions/runs/$candidate_run_id")"
             printf '%s' "$candidate_run" | jq -e \
               --arg source "$EBK_STAGING_SOURCE_COMMIT" \
@@ -913,6 +927,10 @@ ${indentedScript(stagingPromotionReceiptValidationScript(), 10)}
               --arg digest "$candidate_artifact_digest" \
               --arg name "release-candidate-$EBK_STAGING_SOURCE_COMMIT" \
               '[.artifacts[] | select((.id | tostring) == $id and .name == $name and .digest == $digest and .expired == false)] | length == 1' >/dev/null
+          fi
+          if [ "$EBK_EXPECTED_HAS_CONTAINERS" = true ]; then
+            container_artifact_id="$(jq -r '.container.artifactId' "$promotion")"
+            container_artifact_digest="$(jq -r '.container.artifactDigest' "$promotion")"
             staging_artifacts="$(gh api "/repos/$GH_REPO/actions/runs/$EBK_STAGING_DEPLOYMENT_RUN_ID/artifacts?per_page=100")"
             printf '%s' "$staging_artifacts" | jq -e \
               --arg id "$container_artifact_id" \
@@ -929,7 +947,7 @@ ${indentedScript(stagingPromotionReceiptValidationScript(), 10)}
       needs.prepare.result == 'success' &&
       needs.immutable-artifacts.result == 'success' &&
       needs.prepare.outputs.action == 'deploy' &&
-      needs.prepare.outputs.has_slices == 'true' &&
+      needs.prepare.outputs.has_containers == 'true' &&
       (
         needs.prepare.outputs.stage == 'staging' ||
         (needs.prepare.outputs.stage == 'production' && needs.prepare.outputs.profile == 'starter')
@@ -939,7 +957,7 @@ ${indentedScript(stagingPromotionReceiptValidationScript(), 10)}
       # One job per Slice and architecture: Slices build in parallel instead of
       # looping on one runner per architecture.
       matrix:
-        project: \${{ fromJson(needs.prepare.outputs.slice_matrix) }}
+        project: \${{ fromJson(needs.prepare.outputs.container_matrix) }}
         # architecture is an original axis: include entries only decorate the
         # matching combination. Include-only keys would be merged into every
         # project and the later entry would overwrite the earlier one, so every
@@ -972,8 +990,9 @@ ${indentedScript(stagingPromotionReceiptValidationScript(), 10)}
       EBK_RELEASE_SOURCE_COMMIT: \${{ needs.immutable-artifacts.outputs.source_commit }}
       EBK_SOURCE_COMMIT: \${{ inputs.source_commit || github.sha }}
       EBK_STAGE: \${{ needs.prepare.outputs.stage }}
-      EBK_SLICE_PROJECTS: \${{ needs.prepare.outputs.slice_projects }}
+      EBK_SLICE_PROJECTS: \${{ needs.prepare.outputs.container_projects }}
       EBK_SLICE_PROJECT: \${{ matrix.project.project }}
+      EBK_CONTAINER_PROJECTS: \${{ needs.prepare.outputs.container_projects }}
     steps:
       - name: Check out immutable container source
         uses: ${actionPins.checkout}
@@ -1080,7 +1099,7 @@ ${indentedScript(exactStageDeployerGuardScript('Container build', '$EBK_POLICY_A
           case "$EBK_SLICE_PROJECT" in
             ''|-*|*-|*[!a-z0-9-]*) echo 'Container build Slice project must be an exact normalized Slice name'; exit 1 ;;
           esac
-          case ",$EBK_SLICE_PROJECTS," in
+          case ",$EBK_CONTAINER_PROJECTS," in
             *",$EBK_SLICE_PROJECT,"*) ;;
             *) echo 'Container build Slice project is not in the committed deployment plan'; exit 1 ;;
           esac
@@ -1108,7 +1127,7 @@ ${indentedScript(exactStageDeployerGuardScript('Container build', '$EBK_POLICY_A
       needs.immutable-artifacts.result == 'success' &&
       needs.container-platform.result == 'success' &&
       needs.prepare.outputs.action == 'deploy' &&
-      needs.prepare.outputs.has_slices == 'true'
+      needs.prepare.outputs.has_containers == 'true'
     runs-on: ubuntu-latest
     environment: \${{ needs.prepare.outputs.stage }}
     permissions:
@@ -1130,7 +1149,7 @@ ${indentedScript(exactStageDeployerGuardScript('Container build', '$EBK_POLICY_A
       EBK_RELEASE_SOURCE_COMMIT: \${{ needs.immutable-artifacts.outputs.source_commit }}
       EBK_SOURCE_COMMIT: \${{ inputs.source_commit || github.sha }}
       EBK_STAGE: \${{ needs.prepare.outputs.stage }}
-      EBK_SLICE_PROJECTS: \${{ needs.prepare.outputs.slice_projects }}
+      EBK_SLICE_PROJECTS: \${{ needs.prepare.outputs.container_projects }}
     steps:
       - name: Check out immutable container source
         uses: ${actionPins.checkout}
@@ -1244,7 +1263,7 @@ ${indentedScript(exactStageDeployerGuardScript('Container assembly', '$EBK_POLIC
       needs.prepare.outputs.action == 'deploy' &&
       needs.prepare.outputs.stage == 'production' &&
       needs.prepare.outputs.profile != 'starter' &&
-      needs.prepare.outputs.has_slices == 'true'
+      needs.prepare.outputs.has_containers == 'true'
     runs-on: ubuntu-latest
     environment: production
     permissions:
@@ -1267,7 +1286,7 @@ ${indentedScript(exactStageDeployerGuardScript('Container assembly', '$EBK_POLIC
       EBK_RELEASE_SOURCE_COMMIT: \${{ needs.immutable-artifacts.outputs.source_commit }}
       EBK_SOURCE_COMMIT: \${{ inputs.source_commit || github.sha }}
       EBK_STAGE: production
-      EBK_SLICE_PROJECTS: \${{ needs.prepare.outputs.slice_projects }}
+      EBK_SLICE_PROJECTS: \${{ needs.prepare.outputs.container_projects }}
     steps:
       - name: Check out immutable production source
         uses: ${actionPins.checkout}
@@ -1425,7 +1444,7 @@ ${indentedScript(exactStageDeployerGuardScript('Container promotion', '$AWS_EXPE
         ) || (
           needs.immutable-artifacts.result == 'success' &&
           (
-            needs.prepare.outputs.has_slices != 'true' ||
+            needs.prepare.outputs.has_containers != 'true' ||
             needs.prepare.outputs.stage == 'development' ||
             (
               (
@@ -1526,7 +1545,7 @@ ${indentedScript(exactStageDeployerGuardScript('Container promotion', '$AWS_EXPE
       - name: Restore exact current-stage container binding
         if: >-
           needs.prepare.outputs.action == 'deploy' &&
-          needs.prepare.outputs.has_slices == 'true' &&
+          needs.prepare.outputs.has_containers == 'true' &&
           (
             needs.prepare.outputs.stage == 'staging' ||
             (needs.prepare.outputs.stage == 'production' && needs.prepare.outputs.profile == 'starter')
@@ -1541,7 +1560,7 @@ ${indentedScript(exactStageDeployerGuardScript('Container promotion', '$AWS_EXPE
       - name: Restore exact promoted production container binding
         if: >-
           needs.prepare.outputs.action == 'deploy' &&
-          needs.prepare.outputs.has_slices == 'true' &&
+          needs.prepare.outputs.has_containers == 'true' &&
           needs.prepare.outputs.stage == 'production' &&
           needs.prepare.outputs.profile != 'starter'
         uses: ${actionPins.downloadArtifact}
@@ -1554,14 +1573,15 @@ ${indentedScript(exactStageDeployerGuardScript('Container promotion', '$AWS_EXPE
       - name: Verify exact predeploy container binding inventory
         if: >-
           needs.prepare.outputs.action == 'deploy' &&
-          needs.prepare.outputs.has_slices == 'true' &&
+          needs.prepare.outputs.has_containers == 'true' &&
           needs.prepare.outputs.stage != 'development'
         env:
           ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
           ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_CONTAINER_PROJECTS: \${{ needs.prepare.outputs.container_projects }}
         run: |
           set -euo pipefail
-          IFS=',' read -r -a projects <<< "$EBK_SLICE_PROJECTS"
+          IFS=',' read -r -a projects <<< "$EBK_CONTAINER_PROJECTS"
           for project in "\${projects[@]}"; do
             test -n "$project" || continue
             test -f ".ebk/evidence/container-release/$EBK_STAGE/packages/$project/binding.json" || {
@@ -1731,6 +1751,7 @@ ${indentedScript(exactStageDeployerGuardScript('Smoke access cleanup', '$EBK_POL
           EBK_CONTAINER_ARTIFACT_DIGEST: \${{ needs.container-assemble.outputs.artifact_digest }}
           EBK_CONTAINER_ARTIFACT_ID: \${{ needs.container-assemble.outputs.artifact_id }}
           EBK_HAS_SLICES: \${{ needs.prepare.outputs.has_slices }}
+          EBK_HAS_CONTAINERS: \${{ needs.prepare.outputs.has_containers }}
         run: |
           node --input-type=module <<'NODE'
 ${indentedScript(stagingPromotionSealScript(), 10)}
@@ -2008,7 +2029,7 @@ function renderTrunkPromotionJobs(options) {
       always() &&
       needs.prepare.result == 'success' &&
       needs.immutable-artifacts.result == 'success' &&
-      needs.container-assemble.result == 'success' &&
+      (needs.prepare.outputs.has_containers != 'true' || needs.container-assemble.result == 'success') &&
       needs.execute.result == 'success' &&
 ${trunkPromotionGate}
     runs-on: ubuntu-latest
@@ -2039,6 +2060,7 @@ ${trunkPromotionGate}
       EBK_SOURCE_COMMIT: \${{ inputs.source_commit || github.sha }}
       EBK_STAGE: production
       EBK_SLICE_PROJECTS: \${{ needs.prepare.outputs.slice_projects }}
+      EBK_CONTAINER_PROJECTS: \${{ needs.prepare.outputs.container_projects }}
     steps:
 ${checkoutAndInstall('Verify managed workspace integrity before container authority')}
       - id: staging-receipt
@@ -2081,6 +2103,7 @@ ${checkoutAndInstall('Verify managed workspace integrity before container author
           EBK_STAGING_DEPLOYMENT_RUN_ATTEMPT: \${{ github.run_attempt }}
           EBK_STAGING_DEPLOYMENT_RUN_ID: \${{ github.run_id }}
           EBK_EXPECTED_HAS_SLICES: \${{ needs.prepare.outputs.has_slices }}
+          EBK_EXPECTED_HAS_CONTAINERS: \${{ needs.prepare.outputs.has_containers }}
           EBK_EXPECTED_DEPLOYMENT_PROFILE: \${{ needs.prepare.outputs.profile }}
           EBK_EXPECTED_DEPLOYMENT_REGION: \${{ needs.prepare.outputs.region }}
           EBK_EXPECTED_STAGING_ACCOUNT_ID: \${{ needs.prepare.outputs.staging_account_id }}
@@ -2122,6 +2145,7 @@ ${indentedScript(stagingPromotionReceiptValidationScript(), 10)}
           path: .ebk/evidence/release-candidate
           run-id: \${{ steps.staging.outputs.producer_run_id }}
       - name: Restore this run's staging container bundle
+        if: needs.prepare.outputs.has_containers == 'true'
         uses: ${actionPins.downloadArtifact}
         env:
           ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
@@ -2132,6 +2156,7 @@ ${indentedScript(stagingPromotionReceiptValidationScript(), 10)}
           path: .ebk/evidence/container-release
 ${revalidateTip}
       - name: Assume exact staging registry pull role
+        if: needs.prepare.outputs.has_containers == 'true'
         uses: ${actionPins.configureAwsCredentials}
         with:
           audience: \${{ needs.prepare.outputs.oidc_audience }}
@@ -2139,6 +2164,7 @@ ${revalidateTip}
           role-session-name: ebk-staging-container-pull-\${{ github.run_id }}-\${{ github.run_attempt }}
           role-to-assume: \${{ secrets.AWS_STAGING_PROMOTION_PULL_ROLE_ARN }}
       - name: Authenticate exact staging source registry
+        if: needs.prepare.outputs.has_containers == 'true'
         env:
           AWS_STAGING_PROMOTION_PULL_ROLE_ARN: \${{ secrets.AWS_STAGING_PROMOTION_PULL_ROLE_ARN }}
           EBK_STAGING_ACCOUNT_ID: \${{ vars.AWS_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID }}
@@ -2156,6 +2182,7 @@ ${indentedScript(exactStagingPromotionPullGuardScript(), 10)}
               "$EBK_STAGING_ACCOUNT_ID.dkr.ecr.$EBK_STAGING_REGION.amazonaws$registry_suffix"
 ${revalidateTip}
       - name: Assume the production deployment role for container promotion
+        if: needs.prepare.outputs.has_containers == 'true'
         uses: ${actionPins.configureAwsCredentials}
         with:
           audience: \${{ needs.prepare.outputs.oidc_audience }}
@@ -2163,6 +2190,7 @@ ${revalidateTip}
           role-session-name: ebk-production-container-push-\${{ github.run_id }}-\${{ github.run_attempt }}
           role-to-assume: \${{ env.AWS_DEPLOY_ROLE_ARN }}
       - name: Promote exact staging indexes without rebuilding
+        if: needs.prepare.outputs.has_containers == 'true'
         env:
           EBK_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID }}
           EBK_STAGING_PROMOTION_REGION: \${{ vars.AWS_STAGING_PROMOTION_REGION }}
@@ -2171,7 +2199,7 @@ ${revalidateTip}
           [ "$AWS_EXPECTED_ACCOUNT_ID" = "$EBK_POLICY_PRODUCTION_ACCOUNT_ID" ]
           [ "$AWS_REGION" = "$EBK_POLICY_REGION" ]
 ${indentedScript(exactStageDeployerGuardScript('Container promotion', '$AWS_EXPECTED_ACCOUNT_ID'), 10)}
-          IFS=',' read -r -a projects <<< "$EBK_SLICE_PROJECTS"
+          IFS=',' read -r -a projects <<< "$EBK_CONTAINER_PROJECTS"
           for project in "\${projects[@]}"; do
             test -n "$project" || continue
             # Repository-relative for the container release tool (EBK-INT-2026-077).
@@ -2181,6 +2209,7 @@ ${indentedScript(exactStageDeployerGuardScript('Container promotion', '$AWS_EXPE
           done
       - id: retain
         name: Retain production target container binding
+        if: needs.prepare.outputs.has_containers == 'true'
         uses: ${actionPins.uploadArtifact}
         with:
           name: container-release-production-\${{ github.run_id }}-\${{ github.run_attempt }}
@@ -2242,6 +2271,7 @@ ${checkoutAndInstall('Verify managed workspace integrity before AWS authority')}
           path: .ebk/evidence/release-candidate
           run-id: \${{ needs.promote-production.outputs.candidate_producer_run_id }}
       - name: Restore exact promoted production container binding
+        if: needs.prepare.outputs.has_containers == 'true'
         uses: ${actionPins.downloadArtifact}
         env:
           ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
@@ -2250,12 +2280,14 @@ ${checkoutAndInstall('Verify managed workspace integrity before AWS authority')}
           name: container-release-production-\${{ github.run_id }}-\${{ github.run_attempt }}
           path: .ebk/evidence/container-release
       - name: Verify exact predeploy container binding inventory
+        if: needs.prepare.outputs.has_containers == 'true'
         env:
           ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
           ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_CONTAINER_PROJECTS: \${{ needs.prepare.outputs.container_projects }}
         run: |
           set -euo pipefail
-          IFS=',' read -r -a projects <<< "$EBK_SLICE_PROJECTS"
+          IFS=',' read -r -a projects <<< "$EBK_CONTAINER_PROJECTS"
           for project in "\${projects[@]}"; do
             test -n "$project" || continue
             test -f ".ebk/evidence/container-release/$EBK_STAGE/packages/$project/binding.json" || {

package/src/generators/preset/workspace-files-thin-docs.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderThinLifecycleDocumentation = renderThinLifecycleDocumentation;
 const index_js_1 = require("../../repository-policy/index.js");
+const tool_versions_js_1 = require("./tool-versions.js");
 function renderThinLifecycleDocumentation(options) {
     const stages = (0, index_js_1.activeDeploymentStages)(options.deploymentProfile);
     const stageList = stages.join(', ');
@@ -16,9 +17,19 @@ refresh, removal, and provider diagnostics.
 
 The committed \`${options.deploymentProfile}\` profile activates: ${stageList}.
 
-Start with \`pnpm verify\`, configure the exact temporary AWS profile and stage
-deployment role described in \`docs/stage-deployment-authority.md\`, then deploy
-development through the root \`deploy-local\` target. Do not invoke SST directly.
+For ordinary feature work, run affected tests, typecheck, lint, and ownership
+checks. Run \`pnpm verify\` at a milestone, not before each development edit.
+Configure the exact temporary AWS profile and stage deployment role described
+in \`docs/stage-deployment-authority.md\` before deploying development through
+\`ebk deploy development --profile=<profile> --expectedRoleArn=<role-arn>\`
+(the root \`deploy-local\` target). Do not invoke SST directly.
+
+Standard Slices include a Python infrastructure provisioner: install \`uv\`
+${tool_versions_js_1.WORKSPACE_UV_VERSION} (Python 3.12 or newer) on PATH before \`ebk dev up\` or
+\`ebk deploy\`. Each Standard Slice stops before its SST child starts when
+\`uv --version\` fails; a full \`ebk deploy\` may already have deployed
+Foundation.
+Source-only feature checks do not require it.
 `,
         'docs/git-workflow.md': `# Protected Git workflow
 
@@ -99,15 +110,21 @@ secret; do not add repository-scope fallbacks.
 
 ## Production capacity
 
-The shared Foundation has three capacity profiles, independent of deployment topology:
-- \`cost-optimized\`: 0–2 ACUs, five-minute idle auto-pause; new starter default.
+Foundation provisions Aurora only when SQL is declared. DynamoDB remains the framework core.
+Aurora has three capacity profiles, independent of deployment topology:
+- \`cost-optimized\`: 0–2 ACUs, five-minute idle auto-pause; default for all new deployment profiles.
 - \`balanced\`: 0.5–4 ACUs, always warm.
-- \`standard\`: 2–16 ACUs, always warm; isolated repository default.
+- \`standard\`: 2–16 ACUs, always warm.
 
-All retain 30-day backups, deletion protection, encryption, and managed NAT.
+Existing explicit capacity choices survive upgrades. Provisioned production Aurora
+retains 30-day backups, deletion protection and encryption in all three profiles.
+Undeclared SQL does not provision Aurora or SQL-only networking.
 Pause can delay first requests (typically 15 seconds, sometimes 30 seconds or
 longer); open connections or polling can prevent it. Storage/NAT still cost money.
 Validate cold-resume retries, migration timeouts, and the shared capacity ceiling.
+Choose balanced when measured cold-resume latency is unacceptable; choose standard
+when measured capacity and concurrency justify the larger warm range. Capacity
+selection never changes background-work cadence or an explicit maintenance pause.
 
 Existing warm \`cost-optimized\` users must use the new generator to report
 \`pnpm nx g @empire-builder-kit/nx:repository-policy --profile=balanced\`, then
@@ -122,6 +139,15 @@ removal, unlock, discovery, and secret resolution.
 
 ## Native lifecycle
 
+Use \`ebk deploy development --profile=<profile> --expectedRoleArn=<role-arn>\`.
+Add Slice names, for example \`ebk deploy development billing\` with the same
+authority options, for focused deployment after Foundation. Other Slices are
+not redeployed; required peers must already exist. Omit Slice names for the
+complete stage. Explicit selection is local-only and its \`selectedSlices\`
+receipt is not full-stage acceptance or a protected affected-deployment baseline.
+\`ebk deploy --help\` lists options; it preserves native TTY/output and does not
+accept arbitrary Nx/SST flags or a noninteractive confirmation.
+
 The root \`${options.name}:deploy-local\` target orders Foundation before every
 eligible Product Slice. Each project runs its public Nx \`deploy\` target, which
 uses pinned native \`sst deploy\`; successful Slice infrastructure is followed
@@ -169,7 +195,7 @@ mutation remains denied. EBK does not claim a postdeployment trust attestor. In
 commercial AWS, CloudFront, CloudFront-scope WAF, edge WAF log delivery, and
 edge ACM use the us-east-1 control plane. CloudWatch Logs cannot scope the
 generated WAF \`PutResourcePolicy\` payload through IAM; reviewed generated
-source and the edge Region are its controls. RC.31 does not claim Router edge support in noncommercial
+source and the edge Region are its controls. This prerelease does not claim Router edge support in noncommercial
 partitions: CloudFront is unavailable in GovCloud, and the China-partition edge
 control plane is not yet proven.
 
@@ -186,9 +212,10 @@ it. Post-deployment evidence may attest the native bootstrap resources.
 `,
         'packages/foundation/README.md': `# Standard Foundation
 
-Foundation owns the shared network, Router/WAF, Aurora, Cognito, events,
-observability, configuration, and container-compute resources for each active
-canonical stage. The \`${options.deploymentProfile}\` profile activates:
+Foundation owns shared Router/WAF, Cognito, events, observability, and
+configuration resources for each active canonical stage. It provisions Aurora
+only when SQL is declared; network and container-compute resources depend on
+declared workloads. The \`${options.deploymentProfile}\` profile activates:
 ${stageList}.
 
 Deploy it through the workspace root \`deploy-local\` target or the protected
@@ -209,7 +236,7 @@ The resolved ${rehearsalStage} stage is rehearsed with
 Use temporary IAM Identity Center credentials and the stable stage deployment
 role. Development accepts a dirty tree and requires no acknowledgement:
 
-\`pnpm nx run ${options.name}:deploy-local -- --stage=development --profile=<profile> --expectedRoleArn=<role-arn>\`
+\`ebk deploy development --profile=<profile> --expectedRoleArn=<role-arn>\`
 
 Local staging, when active, requires a clean commit and an interactive
 \`approve:deploy:staging:<source-commit>\` response. Starter production requires
@@ -233,6 +260,24 @@ committed stage role, refreshes its invocation-private temporary credentials
 immediately before SST, and removes them on every exit. A failed child stops
 immediately.
 
+After all Slice registrations are absent, \`foundation:remove\` runs native
+SST removal directly, without a separate refresh or local retry checkpoint.
+Temporary smoke admission uses a separate, normally empty Cloud Control IP set;
+the baseline allowlist identities and addresses remain untouched. Its AWS service
+handler resolves the current WAF lock token during deletion. A failed or
+interrupted removal remains failed. Resolve its native diagnostic and any lock
+through the governed unlock target, then retry the same remove target, including
+from a fresh checkout. Ownership, caller and production removal safeguards run
+on every invocation. Refresh stays separate and never continues into removal or
+deployment; do not bypass its diagnostics, edit state, or use deprecated SST
+components.
+
+For an older deployment whose smoke helper edited the baseline IP set, reconcile
+that existing provider state with an explicit governed refresh while Foundation
+is intact. The new smoke set does not retroactively repair old lock tokens.
+Partially removed old stacks require an evidence-backed recovery assessment;
+do not redeploy a maintenance-held stage merely to apply this upgrade.
+
 ## Router WAF rehearsal
 
 ${options.deploymentProfile === 'starter'
@@ -285,12 +330,13 @@ receipt binds the derived account and Region.
 
 ## Production safeguards
 
-Production keeps the committed Aurora capacity profile, 30-day backup
-retention, deletion protection, WAF blocking rehearsal, migration preflight,
-and application smoke checks. Any change to these controls must be a committed
-policy change and must remain permitted by the stage authority's explicit
-guardrails. AWS exposes SNS topic and SQS queue policy updates through the same
-Set*Attributes actions required during native creation and provides no
+Production keeps WAF blocking rehearsal and application smoke checks. When SQL
+is declared, production also keeps the committed Aurora capacity profile,
+30-day backup retention, deletion protection, and migration preflight. Any
+change to these controls must be a committed policy change and must remain
+permitted by the stage authority's explicit guardrails. AWS exposes SNS topic
+and SQS queue policy updates through the same Set*Attributes actions required
+during native creation and provides no
 attribute-name IAM condition. The stable stage role therefore contains those
 calls by exact account, Region, and generated stage-name pattern; hard stage
 separation requires an isolated profile. CloudFront KeyValueStore data-plane

package/src/generators/preset/workspace-files.d.ts

@@ -1,6 +1,10 @@
 import { type FoundationOwnershipRecord, type WorkspaceOwnershipRecord } from '../../ownership/index.js';
 import { type DeliveryLane, type ProductionApprovalMode, type ConfiguredDeploymentAccounts, type DeploymentProfile } from '../../repository-policy/index.js';
 export interface WorkspaceFileOptions {
+    /** Prior managed declaration: upgrades retain every already-declared resource. */
+    foundationDescriptor?: unknown;
+    /** Validated requirements are unioned before any generated file is written. */
+    foundationRequirements?: readonly unknown[];
     /** trunk (starter only) protects main alone and delivers production from
      * every merged main push; protected-pair keeps develop and main. */
     deliveryLane?: DeliveryLane;