@empire-builder-kit/nx 1.0.0-rc.38 → 1.0.0-rc.39

package/src/executors/dev-task-cleanup/task-stack-checkpoint.js

@@ -0,0 +1,92 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NativeTaskCheckpointError = void 0;
+exports.verifyRemovedTaskCheckpoint = verifyRemovedTaskCheckpoint;
+const client_s3_1 = require("@aws-sdk/client-s3");
+const MAX_CHECKPOINT_BYTES = 8 * 1024 * 1024;
+class NativeTaskCheckpointError extends Error {
+}
+exports.NativeTaskCheckpointError = NativeTaskCheckpointError;
+function refuse(reason) {
+    throw new NativeTaskCheckpointError(`Native task cleanup is incomplete: ${reason}.`);
+}
+function object(value) {
+    return !!value && typeof value === 'object' && !Array.isArray(value);
+}
+/**
+ * Read-only postcondition for the pinned SST checkpoint envelope. It does not
+ * decrypt, retain, repair, or infer physical identities from resource contents.
+ * An empty checkpoint is necessary, not independent physical-absence proof.
+ */
+async function verifyRemovedTaskCheckpoint(s3, owner, key, stack, signal) {
+    try {
+        const result = await s3.send(new client_s3_1.GetObjectCommand({ ...owner, Key: key }), {
+            abortSignal: signal,
+        });
+        const body = result.Body;
+        if (!body ||
+            !('destroy' in body) ||
+            typeof body.destroy !== 'function' ||
+            !(Symbol.asyncIterator in body))
+            refuse('the checkpoint stream is unavailable');
+        const stream = body;
+        const abort = () => stream.destroy();
+        signal.addEventListener('abort', abort, { once: true });
+        let bytes;
+        try {
+            if (!Number.isSafeInteger(result.ContentLength) ||
+                !result.ContentLength ||
+                result.ContentLength < 0 ||
+                result.ContentLength > MAX_CHECKPOINT_BYTES ||
+                !result.VersionId ||
+                result.VersionId === 'null' ||
+                !result.ETag)
+                refuse('the checkpoint size or version is unsupported');
+            signal.throwIfAborted();
+            let size = 0;
+            const chunks = [];
+            for await (const chunk of stream) {
+                signal.throwIfAborted();
+                if (!(chunk instanceof Uint8Array))
+                    refuse('the checkpoint stream is malformed');
+                size += chunk.byteLength;
+                if (size > MAX_CHECKPOINT_BYTES || size > result.ContentLength)
+                    refuse('the checkpoint exceeded its bounded size');
+                chunks.push(Buffer.from(chunk));
+            }
+            signal.throwIfAborted();
+            if (size !== result.ContentLength)
+                refuse('the checkpoint read was incomplete');
+            bytes = Buffer.concat(chunks);
+        }
+        finally {
+            signal.removeEventListener('abort', abort);
+            stream.destroy();
+        }
+        // Parse errors and SDK errors must never include checkpoint or secret data.
+        const value = JSON.parse(bytes.toString('utf8'));
+        if (!object(value) ||
+            value.version !== 3 ||
+            !object(value.checkpoint) ||
+            value.checkpoint.stack !== stack ||
+            !object(value.checkpoint.latest))
+            refuse('the checkpoint format or exact stack identity differs');
+        for (const field of ['resources', 'pending_operations']) {
+            const entries = value.checkpoint.latest[field];
+            // The native serializer omits empty collections after complete removal.
+            if (entries !== undefined && !Array.isArray(entries))
+                refuse('the checkpoint collections are malformed');
+            if (Array.isArray(entries) && entries.length > 0)
+                refuse(`${entries.length} ${field === 'resources' ? 'resource records' : 'pending operations'} remain; preserve native diagnostics and resolve the interrupted operation before retrying task cleanup`);
+        }
+        const current = await s3.send(new client_s3_1.HeadObjectCommand({ ...owner, Key: key, IfMatch: result.ETag }), { abortSignal: signal });
+        if (current.VersionId !== result.VersionId || current.ETag !== result.ETag)
+            refuse('the checkpoint changed during verification');
+    }
+    catch (error) {
+        if (error instanceof NativeTaskCheckpointError)
+            throw error;
+        refuse('the required checkpoint read or validation failed');
+    }
+}
+//# sourceMappingURL=task-stack-checkpoint.js.map

package/src/executors/fleet/fleet.js

@@ -87,7 +87,7 @@ const executor = async (options, context) => {
     try {
         const command = fleetExecutorCommand(options);
         const plan = await (0, nx_workspace_js_1.loadWorkspaceFleetPlan)();
-        const identity = (0, personal_stage_js_1.createPersonalStageResolver)().resolve();
+        const identity = (0, personal_stage_js_1.createPersonalStageResolver)().resolve(context.root);
         const gitCommonDirectory = (0, fleet_launcher_js_1.resolveGitCommonDirectory)(context.root);
         const saved = (0, local_context_js_1.readSavedLocalDevContext)(gitCommonDirectory);
         if (saved.kind === 'invalid') {

package/src/executors/foundation-remove-preflight/foundation-remove-preflight.js

@@ -8,6 +8,8 @@ const client_ssm_1 = require("@aws-sdk/client-ssm");
 const credential_providers_1 = require("@aws-sdk/credential-providers");
 const devkit_1 = require("@nx/devkit");
 const discovery_js_1 = require("../../foundation/discovery.js");
+const stages_js_1 = require("../../foundation/stages.js");
+const index_js_1 = require("../../repository-policy/index.js");
 function evaluateFoundationRemoval(foundationStage, registrationNames) {
     if (registrationNames.length === 0) {
         return {
@@ -87,6 +89,31 @@ async function runFoundationRemovePreflight(options, dependencies = {}) {
         devkit_1.logger.error(result.message);
     return { success: result.success };
 }
-const executor = (options) => runFoundationRemovePreflight(options);
+const executor = async (options, context) => {
+    try {
+        const policy = (0, index_js_1.readRepositoryOperatingPolicy)(context.root);
+        const stage = (0, stages_js_1.requireFoundationStage)(options.stage);
+        if (!(0, index_js_1.isActiveDeploymentStage)(policy.deploymentProfile, stage)) {
+            throw new Error(`Foundation stage ${stage} is inactive for ${policy.deploymentProfile}.`);
+        }
+        const region = (0, index_js_1.configuredDeploymentRegion)(policy.deploymentRegion);
+        // The dependency executes before the remove child derives its environment.
+        // Bind this read to the same committed Region, never the operator's default.
+        for (const requested of [
+            options.region,
+            process.env.AWS_REGION,
+            process.env.AWS_DEFAULT_REGION,
+        ]) {
+            if (requested?.trim() && requested.trim() !== region) {
+                throw new Error(`Requested Region ${requested.trim()} differs from committed deployment Region ${region}.`);
+            }
+        }
+        return await runFoundationRemovePreflight({ ...options, region, stage });
+    }
+    catch (error) {
+        devkit_1.logger.error(`[foundation-remove-preflight] ${error instanceof Error ? error.message : String(error)}`);
+        return { success: false };
+    }
+};
 exports.default = executor;
 //# sourceMappingURL=foundation-remove-preflight.js.map

package/src/executors/local-deploy/local-deploy.d.ts

@@ -7,6 +7,7 @@ import { createLocalFederatedCredentialTransport } from './federated-credential-
 import { type LocalMutationApprover } from './local-approval.js';
 import { assertWorkspaceStageOwnershipForWorkspace } from '../../workspace-deployment/index.js';
 import { runGithubPrivateSmoke } from '../../foundation/private-smoke-access.js';
+import { runLocalPrivateSmoke } from '../../foundation/local-private-smoke-access.js';
 interface LocalDeployOptions {
     /** Newest successful deployment receipt on this branch (protected runs). */
     baselineReceipt?: string;
@@ -16,6 +17,8 @@ interface LocalDeployOptions {
     /** affected: skip Slices unchanged since the baseline; full: deploy all. */
     lifecycleScope?: LifecycleMode;
     profile?: string;
+    /** Local explicit selection; never a protected full-stage baseline. */
+    slices?: string[];
     stage: CanonicalDeploymentStage;
 }
 interface LocalDeployDependencies {
@@ -33,6 +36,7 @@ interface LocalDeployDependencies {
     run?: typeof spawnSync;
     spawnChild?: typeof spawn;
     privateSmoke?: typeof runGithubPrivateSmoke;
+    localPrivateSmoke?: typeof runLocalPrivateSmoke;
 }
 interface ProjectDescriptor {
     name: string;
@@ -61,6 +65,7 @@ export interface DeploymentReceipt {
         phase: string;
         mutationStatus: 'not-attempted' | 'may-have-changed';
         nextAction: string;
+        secondaryPhases?: readonly ['source-reconciliation'];
     };
     kind: 'ebk-deployment-receipt';
     lifecycleScope?: LifecycleScope;
@@ -69,6 +74,8 @@ export interface DeploymentReceipt {
     profile: RepositoryOperatingPolicy['deploymentProfile'];
     region: string;
     schemaVersion: 1;
+    /** Present only for explicit local selection, not complete-stage acceptance. */
+    selectedSlices?: readonly string[];
     smoke: Readonly<Record<string, 'not-applicable' | 'passed' | 'unchanged-since-baseline'>>;
     source: {
         clean: boolean;
@@ -97,7 +104,7 @@ declare function attestLocalContainerBinding(input: {
 export declare function deployedSourceCommit(sourceCommit: string, environment?: NodeJS.ProcessEnv): string;
 /** Determine the one native deployment order. Foundation is always first and
  * production Slice admission remains a committed policy decision. */
-export declare function localDeploymentProjectOrder(policy: RepositoryOperatingPolicy, context: ExecutorContext, stage: CanonicalDeploymentStage): string[];
+export declare function localDeploymentProjectOrder(policy: RepositoryOperatingPolicy, context: ExecutorContext, stage: CanonicalDeploymentStage, requestedSlices?: readonly string[]): string[];
 export declare function runLocalDeploy(options: LocalDeployOptions, context: ExecutorContext, dependencies?: LocalDeployDependencies): Promise<{
     success: boolean;
 }>;

package/src/executors/local-deploy/local-deploy.js

@@ -24,6 +24,8 @@ const container_release_js_1 = require("../../supply-chain/container-release.js"
 const run_sst_command_js_1 = require("../sst-lifecycle/run-sst-command.js");
 const index_js_3 = require("../../workspace-deployment/index.js");
 const private_smoke_access_js_1 = require("../../foundation/private-smoke-access.js");
+const local_private_smoke_access_js_1 = require("../../foundation/local-private-smoke-access.js");
+const sst_environment_source_js_1 = require("../sst-lifecycle/sst-environment-source.js");
 const SHA = /^[a-f0-9]{40,64}$/u;
 const ROLE = /^arn:(aws|aws-us-gov|aws-cn):iam::\d{12}:role\/[A-Za-z0-9+=,.@_/-]{1,512}$/u;
 const MAX_LOCAL_RELEASE_CANDIDATE_FILE_BYTES = 64 * 1024;
@@ -471,6 +473,7 @@ function validateBaselineReceipt(value) {
     const record = value;
     if (!record ||
         typeof record !== 'object' ||
+        Object.prototype.hasOwnProperty.call(record, 'selectedSlices') ||
         record.kind !== 'ebk-deployment-receipt' ||
         record.schemaVersion !== 1 ||
         typeof record.outcome !== 'string' ||
@@ -497,7 +500,7 @@ function validateBaselineReceipt(value) {
 }
 /** Determine the one native deployment order. Foundation is always first and
  * production Slice admission remains a committed policy decision. */
-function localDeploymentProjectOrder(policy, context, stage) {
+function localDeploymentProjectOrder(policy, context, stage, requestedSlices) {
     if (!(0, index_js_2.isActiveDeploymentStage)(policy.deploymentProfile, stage)) {
         throw new Error(`Deployment stage ${stage} is inactive for the ${policy.deploymentProfile} deployment profile.`);
     }
@@ -519,12 +522,28 @@ function localDeploymentProjectOrder(policy, context, stage) {
             throw new Error(`Registered Product Slices lack an explicit production policy: ${missing.join(', ')}.`);
         }
     }
-    const selectedSlices = stage === 'production'
+    const eligibleSlices = stage === 'production'
         ? slices.filter(({ name }) => {
             const status = policy.slices[name]?.productionStatus;
             return status === 'pilot' || status === 'ready';
         })
         : slices;
+    if (requestedSlices !== undefined &&
+        (!Array.isArray(requestedSlices) ||
+            requestedSlices.length === 0 ||
+            requestedSlices.length > 64 ||
+            new Set(requestedSlices).size !== requestedSlices.length ||
+            requestedSlices.some((name) => typeof name !== 'string' || !/^[a-z0-9][a-z0-9-]{0,62}$/.test(name)))) {
+        throw new Error('Local deployment Slice selection must contain unique, bounded Slice names.');
+    }
+    for (const name of requestedSlices ?? []) {
+        if (!eligibleSlices.some((slice) => slice.name === name)) {
+            throw new Error(`Selected Slice ${name} is not deployable in ${stage}; inspect its project and committed production policy.`);
+        }
+    }
+    const selectedSlices = requestedSlices === undefined
+        ? eligibleSlices
+        : eligibleSlices.filter(({ name }) => requestedSlices.includes(name));
     const selected = [
         { kind: 'foundation', name: foundations[0]?.name ?? '' },
         ...selectedSlices.map(({ name }) => ({ kind: 'slice', name })),
@@ -582,6 +601,12 @@ function invalidatePriorReceipt(root) {
         throw new Error('Prior deployment receipt invalidation failed.');
     }
 }
+class NativeChildReconciliationError extends Error {
+    constructor(primary, reconciliation) {
+        const describe = (error) => error instanceof Error ? error.message : String(error);
+        super(`${describe(primary)}; source reconciliation also failed: ${describe(reconciliation)}`);
+    }
+}
 async function runNxTarget(input) {
     const forwarded = [
         `--stage=${input.stage}`,
@@ -596,27 +621,52 @@ async function runNxTarget(input) {
         '--',
         ...forwarded,
     ];
-    const result = input.runSync
-        ? input.runSync(process.execPath, args, {
-            cwd: input.context.root,
-            env: input.environment,
-            shell: false,
-            stdio: 'inherit',
-        })
-        : await (0, run_sst_command_js_1.runGovernedChildProcess)({
-            args,
-            cwd: input.context.root,
-            environment: input.environment,
-            executable: process.execPath,
-            ...(input.spawnChild ? { spawnChild: input.spawnChild } : {}),
-        });
-    if (result.error || result.signal || result.status !== 0) {
-        throw new Error(result.error
-            ? `${input.target} failed for ${input.project}: ${result.error.message}`
-            : result.signal
-                ? `${input.target} failed for ${input.project} with signal ${result.signal}.`
-                : `${input.target} failed for ${input.project} with status ${result.status ?? 'unknown'}.`);
+    const projectRoot = input.context.projectsConfigurations?.projects[input.project]?.root;
+    if (!projectRoot)
+        throw new Error(`Deployment project ${input.project} lacks its source root.`);
+    const nextSource = (0, sst_environment_source_js_1.captureNextEnvironmentSource)({
+        projectRoot: confinedWorkspacePath(input.context.root, projectRoot),
+        workspaceRoot: input.context.root,
+    });
+    let primaryFailure;
+    try {
+        const result = input.runSync
+            ? input.runSync(process.execPath, args, {
+                cwd: input.context.root,
+                env: input.environment,
+                shell: false,
+                stdio: 'inherit',
+            })
+            : await (0, run_sst_command_js_1.runGovernedChildProcess)({
+                args,
+                cwd: input.context.root,
+                environment: input.environment,
+                executable: process.execPath,
+                ...(input.spawnChild ? { spawnChild: input.spawnChild } : {}),
+            });
+        if (result.error || result.signal || result.status !== 0) {
+            throw new Error(result.error
+                ? `${input.target} failed for ${input.project}: ${result.error.message}`
+                : result.signal
+                    ? `${input.target} failed for ${input.project} with signal ${result.signal}.`
+                    : `${input.target} failed for ${input.project} with status ${result.status ?? 'unknown'}.`);
+        }
+    }
+    catch (error) {
+        primaryFailure = { error };
+    }
+    // Reconcile after every settled child, retaining its error until cleanup ends.
+    // Native Next may run in an Nx dependency before the SST executor starts.
+    try {
+        (0, sst_environment_source_js_1.reconcileNextEnvironmentSource)(nextSource, input.context.root);
+    }
+    catch (error) {
+        if (primaryFailure)
+            throw new NativeChildReconciliationError(primaryFailure.error, error);
+        throw error;
     }
+    if (primaryFailure)
+        throw primaryFailure.error;
 }
 function productionConfirmation(account, region, commit) {
     return `deploy:production:${account}:${region}:${commit}`;
@@ -669,6 +719,7 @@ async function runLocalDeploy(options, context, dependencies = {}) {
     const migrations = {};
     const smoke = {};
     let lifecycleScope;
+    let selectedSlices;
     let account = '';
     let actor = '';
     let policy;
@@ -700,6 +751,7 @@ async function runLocalDeploy(options, context, dependencies = {}) {
             profile: policy.deploymentProfile,
             region,
             schemaVersion: 1,
+            ...(selectedSlices ? { selectedSlices } : {}),
             smoke,
             source,
             stage: options.stage,
@@ -735,6 +787,13 @@ async function runLocalDeploy(options, context, dependencies = {}) {
         if (options.expectedRoleArn !== expectedRoleArn) {
             throw new Error(`Deployment role must equal the committed ${options.stage} stage authority role ${expectedRoleArn}.`);
         }
+        if (options.slices !== undefined &&
+            (githubAuthority || options.lifecycleScope === 'affected')) {
+            throw new Error('Explicit Slice selection is local-only and cannot be combined with affected lifecycle or protected GitHub deployment.');
+        }
+        const orderedProjects = localDeploymentProjectOrder(policy, context, options.stage, options.slices);
+        if (options.slices)
+            selectedSlices = orderedProjects.slice(1);
         const identity = localWorkingTreeDigest(context.root, run);
         source = {
             clean: identity.clean,
@@ -809,7 +868,6 @@ async function runLocalDeploy(options, context, dependencies = {}) {
                 throw new Error('Local production deployment acknowledgement was declined.');
             }
         }
-        const orderedProjects = localDeploymentProjectOrder(policy, context, options.stage);
         lifecycleScope = resolveLifecycleScope({
             context,
             frameworkVersion: frameworkVersion(context.root),
@@ -1148,7 +1206,19 @@ async function runLocalDeploy(options, context, dependencies = {}) {
                         });
                     }
                     else {
-                        await runSmoke();
+                        if (!transport)
+                            throw new Error('Local smoke requires the verified federated transport.');
+                        await (dependencies.localPrivateSmoke ?? local_private_smoke_access_js_1.runLocalPrivateSmoke)({
+                            account,
+                            deploymentProfile: policy.deploymentProfile,
+                            root: context.root,
+                            source: source.commit,
+                            stage: options.stage,
+                            url: smokeTarget.webUrl,
+                            workspace: JSON.parse((0, node_fs_1.readFileSync)((0, node_path_1.join)(context.root, 'package.json'), 'utf8')).name,
+                            credentialEnvironment: transport.childEnvironment({}),
+                            run: runSmoke,
+                        });
                     }
                     children.push({
                         completedAt: now().toISOString(),
@@ -1261,6 +1331,9 @@ async function runLocalDeploy(options, context, dependencies = {}) {
         failure = {
             project,
             operation: 'deploy',
+            ...(error instanceof NativeChildReconciliationError
+                ? { secondaryPhases: ['source-reconciliation'] }
+                : {}),
             phase: finalPhase === 'credential-cleanup'
                 ? finalPhase
                 : (failedChild?.target ?? finalPhase),

package/src/executors/local-deploy/schema.json

@@ -20,6 +20,14 @@
       "minLength": 1,
       "maxLength": 128
     },
+    "slices": {
+      "type": "array",
+      "items": { "type": "string", "pattern": "^[a-z0-9][a-z0-9-]{0,62}$" },
+      "minItems": 1,
+      "maxItems": 64,
+      "uniqueItems": true,
+      "description": "Local-only explicit Slice selection. Foundation still deploys first; omitted means every eligible Slice. A selected deployment is not full-stage acceptance."
+    },
     "lifecycleScope": {
       "type": "string",
       "enum": ["affected", "full"],

package/src/executors/router-waf-rehearsal/router-waf-rehearsal.js

@@ -329,8 +329,9 @@ function normalizedLiveRules(input) {
                 const orStatement = liveRecord(nested.OrStatement, 'StageIpAllowlist OR statement');
                 exactLiveKeys(orStatement, ['Statements'], 'StageIpAllowlist OR statement');
                 if (!Array.isArray(orStatement.Statements) ||
-                    orStatement.Statements.length !== 2) {
-                    throw new Error('StageIpAllowlist OR statement must contain the exact generated IPv4 and IPv6 references.');
+                    orStatement.Statements.length < 2 ||
+                    orStatement.Statements.length > 3) {
+                    throw new Error('StageIpAllowlist OR statement must contain the exact generated baseline and smoke references.');
                 }
                 const references = orStatement.Statements.map((item, referenceIndex) => {
                     const wrapper = liveRecord(item, `StageIpAllowlist reference ${referenceIndex}`);
@@ -438,11 +439,6 @@ function normalizedLiveRules(input) {
     });
     return { ipSetArns, rules };
 }
-function admittedCidrs(cidrs, admittedCidr) {
-    return admittedCidr && !cidrs.includes(admittedCidr)
-        ? [...cidrs, admittedCidr]
-        : cidrs;
-}
 function requiredIdentityTags(input) {
     return {
         'ebk:managed-by': 'empire-builder-kit',
@@ -475,24 +471,37 @@ async function attestIpSet(input) {
     }
     const name = arn[3] ?? '';
     const id = arn[4] ?? '';
+    const smoke = name ===
+        `foundation-${input.expectedTags['ebk:stage']}-router-smoke-access`;
     const [ipSetResult, tagsResult] = await Promise.all([
         input.waf.send(new client_wafv2_1.GetIPSetCommand({ Id: id, Name: name, Scope: 'CLOUDFRONT' })),
         input.waf.send(new client_wafv2_1.ListTagsForResourceCommand({ ResourceARN: input.arn })),
     ]);
     const ipSet = ipSetResult.IPSet;
-    const expectedCidrs = ipSet?.IPAddressVersion === 'IPV4'
-        ? input.expectedIpv4Cidrs
-        : input.expectedIpv6Cidrs;
+    const expectedCidrs = smoke
+        ? input.admittedCidr
+            ? [input.admittedCidr]
+            : []
+        : ipSet?.IPAddressVersion === 'IPV4'
+            ? input.expectedIpv4Cidrs
+            : input.expectedIpv6Cidrs;
     if (ipSet?.ARN !== input.arn ||
         ipSet.Id !== id ||
         ipSet.Name !== name ||
+        (smoke && ipSet.IPAddressVersion !== 'IPV4') ||
         (ipSet.IPAddressVersion !== 'IPV4' && ipSet.IPAddressVersion !== 'IPV6') ||
         JSON.stringify([...(ipSet.Addresses ?? [])].sort()) !==
             JSON.stringify([...expectedCidrs].sort())) {
         throw new Error('Live Router WAF IP set identity, address family, or exact CIDRs differ from the generated plan.');
     }
-    attestWafTags(tagsResult, input.arn, input.expectedTags, 'Router WAF IP set');
-    return ipSet.IPAddressVersion;
+    const expectedTags = smoke
+        ? {
+            ...Object.fromEntries(Object.entries(input.expectedTags).filter(([key]) => key !== 'ebk:policy-digest')),
+            'ebk:purpose': 'private-smoke-access',
+        }
+        : input.expectedTags;
+    attestWafTags(tagsResult, input.arn, expectedTags, 'Router WAF IP set');
+    return smoke ? 'SMOKE' : ipSet.IPAddressVersion;
 }
 async function attestLoggingConfiguration(input) {
     let configuration;
@@ -610,7 +619,8 @@ async function attestRouterWafBaseline(input) {
         stage: input.stage,
     });
     const expectedIpSetCount = Number(input.plan.ipv4Cidrs.length > 0) +
-        Number(input.plan.ipv6Cidrs.length > 0);
+        Number(input.plan.ipv6Cidrs.length > 0) +
+        1;
     if (normalized.ipSetArns.length !== expectedIpSetCount) {
         throw new Error('Live StageIpAllowlist has an unexpected number of generated IP set references.');
     }
@@ -621,10 +631,9 @@ async function attestRouterWafBaseline(input) {
         const version = await attestIpSet({
             accountId: input.accountId,
             arn: ipSetArn,
-            // While the managed rehearsal runs inside the temporary smoke
-            // admission the live IPv4 set legitimately carries the lease CIDR
-            // beside the committed allowlist (EBK-INT-2026-082).
-            expectedIpv4Cidrs: admittedCidrs(input.plan.ipv4Cidrs, input.admittedCidr),
+            ...(input.admittedCidr ? { admittedCidr: input.admittedCidr } : {}),
+            // Admission owns only the separate smoke set. Baselines stay exact.
+            expectedIpv4Cidrs: input.plan.ipv4Cidrs,
             expectedIpv6Cidrs: input.plan.ipv6Cidrs,
             expectedTags,
             waf: input.waf,
@@ -633,11 +642,14 @@ async function attestRouterWafBaseline(input) {
     }));
     const ipv4Arn = ipSetResults.find(({ version }) => version === 'IPV4')?.arn;
     const ipv6Arn = ipSetResults.find(({ version }) => version === 'IPV6')?.arn;
-    if (Boolean(ipv4Arn) !== Boolean(input.plan.ipv4Cidrs.length) ||
+    const smokeArn = ipSetResults.find(({ version }) => version === 'SMOKE')?.arn;
+    if (!smokeArn ||
+        Boolean(ipv4Arn) !== Boolean(input.plan.ipv4Cidrs.length) ||
         Boolean(ipv6Arn) !== Boolean(input.plan.ipv6Cidrs.length)) {
         throw new Error('Live Router WAF IP set address families differ from the generated plan.');
     }
     const expectedRules = (0, index_js_1.createRouterWafRules)(input.plan, {
+        smokeArn,
         ...(ipv4Arn ? { ipv4Arn } : {}),
         ...(ipv6Arn ? { ipv6Arn } : {}),
     });

package/src/executors/sst-lifecycle/governed-native-operation.d.ts

@@ -1,6 +1,7 @@
 import type { ReadStream, WriteStream } from 'node:tty';
 import { type ExecutorContext } from '@nx/devkit';
 import { createLocalFederatedCredentialTransport } from '../local-deploy/federated-credential-transport.js';
+import { type TaskUnlockDependencies } from './task-unlock.js';
 import { type SstLifecycleCommand, type SstLifecycleOptions } from './run-sst-command.js';
 export type GovernedNativeOperation = 'refresh' | 'remove' | 'unlock';
 export interface GovernedNativeOperationApprovalRequest {
@@ -25,6 +26,7 @@ type NativeRunner = (command: SstLifecycleCommand, options: SstLifecycleOptions,
     success: boolean;
 }>;
 export interface GovernedNativeOperationDependencies {
+    taskUnlock?: Pick<TaskUnlockDependencies, 'authority' | 'writers'>;
     approve?: GovernedNativeOperationApprover;
     createTransport?: typeof createLocalFederatedCredentialTransport;
     environment?: NodeJS.ProcessEnv;

package/src/executors/sst-lifecycle/governed-native-operation.js

@@ -8,6 +8,7 @@ const index_js_1 = require("../../aws-authority/index.js");
 const index_js_2 = require("../../repository-policy/index.js");
 const federated_credential_transport_js_1 = require("../local-deploy/federated-credential-transport.js");
 const local_deploy_js_1 = require("../local-deploy/local-deploy.js");
+const task_unlock_js_1 = require("./task-unlock.js");
 const run_sst_command_js_1 = require("./run-sst-command.js");
 const SHA = /^[a-f0-9]{40,64}$/u;
 function partitionForRegion(region) {
@@ -61,6 +62,14 @@ function createTtyGovernedNativeOperationApprover(terminal = {
  * acknowledgement. GitHub OIDC proceeds through the existing native path.
  */
 async function runGovernedNativeOperation(command, options, context, dependencies = {}) {
+    if (command === 'unlock' && options.stage?.startsWith('personal-')) {
+        return (0, task_unlock_js_1.runCurrentTaskUnlock)(options, context, {
+            ...dependencies.taskUnlock,
+            createTransport: dependencies.createTransport,
+            environment: dependencies.environment,
+            run: dependencies.run,
+        });
+    }
     try {
         (0, run_sst_command_js_1.assertGovernedAwsLifecyclePlatform)(dependencies.platform);
     }

package/src/executors/sst-lifecycle/run-sst-command.d.ts

@@ -5,6 +5,7 @@ import { type PersonalStageResolver } from '../../local-dev/personal-stage.js';
 import { type DeploymentProfile } from '../../repository-policy/index.js';
 import { assertWorkspaceStageOwnershipForWorkspace } from '../../workspace-deployment/index.js';
 import { preflightSliceSecretMetadata } from './secret-preflight.js';
+import { acquireTaskNativeWriterLease, type TaskNativeWriterEffects } from '../../local-dev/task-native-writer.js';
 import { initializeProtectedDeploymentSecrets } from '../secret-initialize/secret-initialize.js';
 import { retireGeneratedSecretsAfterSliceRemove } from './generated-secret-retirement.js';
 export type SstLifecycleCommand = 'deploy' | 'dev' | 'refresh' | 'remove' | 'unlock';
@@ -32,6 +33,8 @@ export interface SstCommandInvocation {
         EBK_LOCAL_SOURCE_TREE?: string;
         EBK_PRODUCTION_FOUNDATION_PROFILE?: string;
         EBK_SOURCE_COMMIT?: string;
+        EBK_NX_TASK_CLEANUP?: string;
+        EBK_NX_TASK_UNLOCK?: string;
     };
     executable: string;
 }
@@ -46,6 +49,8 @@ interface SstLifecycleRuntimeDependencies extends SstLifecyclePreflightDependenc
     generatedSecretRetirement?: typeof retireGeneratedSecretsAfterSliceRemove;
     platform?: NodeJS.Platform;
     spawnChild?: typeof spawn;
+    taskNativeWriterEffects?: TaskNativeWriterEffects;
+    acquireTaskWriter?: typeof acquireTaskNativeWriterLease;
 }
 export declare function assertGovernedAwsLifecyclePlatform(platform?: NodeJS.Platform): void;
 export interface GovernedChildProcessResult {