@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.40

package/src/supply-chain/generated-container-release-command.js

@@ -5,7 +5,75 @@ exports.renderContainerReleaseCommand = renderContainerReleaseCommand;
 const generated_ecr_collector_command_js_1 = require("./generated-ecr-collector-command.js");
 const safe_reference_1 = require("@empire-builder-kit/runtime/safe-reference");
 exports.CRANE_VERSION = '0.21.7';
+const WINDOWS_HARDEN_PRIVATE_ACL = String.raw `
+$ErrorActionPreference = 'Stop'
+$path = $env:EBK_PRIVATE_PATH
+$kind = $env:EBK_PRIVATE_KIND
+$identity = [System.Security.Principal.WindowsIdentity]::GetCurrent()
+if ($kind -eq 'directory') {
+  $info = [System.IO.DirectoryInfo]::new($path)
+} else {
+  $info = [System.IO.FileInfo]::new($path)
+}
+$acl = $info.GetAccessControl()
+$acl.SetAccessRuleProtection($true, $false)
+foreach ($rule in @($acl.Access)) {
+  [void]$acl.RemoveAccessRuleSpecific($rule)
+}
+$rights = [System.Security.AccessControl.FileSystemRights]::FullControl
+$type = [System.Security.AccessControl.AccessControlType]::Allow
+if ($kind -eq 'directory') {
+  $inheritance = [System.Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit'
+  $propagation = [System.Security.AccessControl.PropagationFlags]::None
+  $rule = [System.Security.AccessControl.FileSystemAccessRule]::new(
+    $identity.User, $rights, $inheritance, $propagation, $type
+  )
+} else {
+  $rule = [System.Security.AccessControl.FileSystemAccessRule]::new(
+    $identity.User, $rights, $type
+  )
+}
+$acl.AddAccessRule($rule)
+$info.SetAccessControl($acl)
+`;
+const WINDOWS_ASSERT_PRIVATE_ACL = String.raw `
+$ErrorActionPreference = 'Stop'
+$path = $env:EBK_PRIVATE_PATH
+$kind = $env:EBK_PRIVATE_KIND
+$identity = [System.Security.Principal.WindowsIdentity]::GetCurrent()
+if ($kind -eq 'directory') {
+  $info = [System.IO.DirectoryInfo]::new($path)
+} else {
+  $info = [System.IO.FileInfo]::new($path)
+}
+$acl = $info.GetAccessControl()
+if (-not $acl.AreAccessRulesProtected) {
+  throw 'ACL inheritance is enabled.'
+}
+$allowRules = @($acl.Access | Where-Object {
+  $_.AccessControlType -eq [System.Security.AccessControl.AccessControlType]::Allow
+})
+$unsafeRules = @($allowRules | Where-Object {
+  $_.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]).Value -ne $identity.User.Value
+})
+$selfRules = @($allowRules | Where-Object {
+  $_.IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]).Value -eq $identity.User.Value
+})
+if ($unsafeRules.Count -ne 0 -or $selfRules.Count -eq 0) {
+  throw 'ACL grants access beyond the current user or omits the current user.'
+}
+`;
 exports.CRANE_RELEASES = Object.freeze({
+    'darwin-arm64': {
+        archiveFormat: 'tar-gzip',
+        sha256: '1858c55dcd6053fe869bcb0c4ec20666383ddce445ad0f7e15e1e506b1f7fe52',
+        source: 'https://github.com/google/go-containerregistry/releases/download/v0.21.7/go-containerregistry_Darwin_arm64.tar.gz',
+    },
+    'darwin-x64': {
+        archiveFormat: 'tar-gzip',
+        sha256: '63a7dd15168d4dcac37933c7f6745438f2943d5898a1cf7896ad3341d8519bf2',
+        source: 'https://github.com/google/go-containerregistry/releases/download/v0.21.7/go-containerregistry_Darwin_x86_64.tar.gz',
+    },
     'linux-arm64': {
         archiveFormat: 'tar-gzip',
         sha256: 'b6ee979d9411dfb05ce35ab9e156fe5de7def11a230764a7856ffa2eb971fa88',
@@ -19,7 +87,7 @@ exports.CRANE_RELEASES = Object.freeze({
 });
 function validatedReleases(releases) {
     if (Object.keys(releases).length === 0 ||
-        Object.entries(releases).some(([platform, release]) => !/^linux-(?:arm64|x64)$/.test(platform) ||
+        Object.entries(releases).some(([platform, release]) => !/^(?:darwin|linux)-(?:arm64|x64)$/.test(platform) ||
             !['binary', 'tar-gzip'].includes(release.archiveFormat) ||
             !/^[a-f0-9]{64}$/.test(release.sha256) ||
             !/^https:\/\/github\.com\/anchore\/syft\/releases\/download\/v\d+\.\d+\.\d+\/[A-Za-z0-9._-]+$/.test(release.source))) {
@@ -29,10 +97,10 @@ function validatedReleases(releases) {
 }
 function validatedCraneReleases(releases) {
     if (Object.keys(releases).length === 0 ||
-        Object.entries(releases).some(([platform, release]) => !/^linux-(?:arm64|x64)$/.test(platform) ||
+        Object.entries(releases).some(([platform, release]) => !/^(?:darwin|linux)-(?:arm64|x64)$/.test(platform) ||
             release.archiveFormat !== 'tar-gzip' ||
             !/^[a-f0-9]{64}$/.test(release.sha256) ||
-            !/^https:\/\/github\.com\/google\/go-containerregistry\/releases\/download\/v\d+\.\d+\.\d+\/go-containerregistry_Linux_(?:arm64|x86_64)\.tar\.gz$/.test(release.source))) {
+            !/^https:\/\/github\.com\/google\/go-containerregistry\/releases\/download\/v\d+\.\d+\.\d+\/go-containerregistry_(?:Darwin|Linux)_(?:arm64|x86_64)\.tar\.gz$/.test(release.source))) {
         throw new Error('Container-release Crane assets must be exact official integrity-bound releases.');
     }
     return releases;
@@ -49,10 +117,11 @@ function renderContainerReleaseCommand(options = {}) {
         !/^\d+\.\d+\.\d+$/.test(craneVersion)) {
         throw new Error('The generated container release configuration is invalid.');
     }
-    return `import { createHash } from 'node:crypto';
-import { execFileSync, spawnSync } from 'node:child_process';
+    return `import { createHash, randomBytes } from 'node:crypto';
+import { execFileSync, spawn, spawnSync } from 'node:child_process';
 import {
   chmodSync,
+  copyFileSync,
   existsSync,
   lstatSync,
   mkdirSync,
@@ -60,11 +129,13 @@ import {
   readFileSync,
   realpathSync,
   readdirSync,
+  renameSync,
   rmSync,
+  unlinkSync,
   writeFileSync,
 } from 'node:fs';
 import { basename, isAbsolute, join, relative, resolve, sep } from 'node:path';
-import { tmpdir } from 'node:os';
+import { platform as hostOperatingSystem, tmpdir } from 'node:os';
 import {
   CONTAINER_NATIVE_LIFECYCLE_PROOFS,
   CONTAINER_RELEASE_PLATFORMS,
@@ -72,6 +143,7 @@ import {
   createContainerNativeRunProof,
   createContainerPlatformEvidence,
   createContainerReleaseBinding,
+  hasSensitiveSupplyChainShape,
   resolveContainerReleaseArtifact,
   supplyChainDigest,
   validateContainerArtifactIdentity,
@@ -85,6 +157,8 @@ const SYFT_VERSION = ${JSON.stringify(syftVersion)};
 const SYFT_RELEASES = Object.freeze(${JSON.stringify(releases)});
 const CRANE_VERSION = ${JSON.stringify(craneVersion)};
 const CRANE_RELEASES = Object.freeze(${JSON.stringify(craneReleases)});
+const WINDOWS_HARDEN_PRIVATE_ACL = ${JSON.stringify(WINDOWS_HARDEN_PRIVATE_ACL)};
+const WINDOWS_ASSERT_PRIVATE_ACL = ${JSON.stringify(WINDOWS_ASSERT_PRIVATE_ACL)};
 const SHA256 = /^[a-f0-9]{64}$/;
 const IMAGE_DIGEST = /^sha256:[a-f0-9]{64}$/;
 const COMMIT = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
@@ -95,6 +169,39 @@ const AWS_REGION_NAME =
   /^(?=.{9,32}$)[a-z]{2}(?:-gov)?-[a-z]+(?:-[a-z]+)*-\\d$/;
 const MAX_TOOL_BYTES = 100 * 1024 * 1024;
 const MAX_OUTPUT_BYTES = 64 * 1024 * 1024;
+// Optional absolute cache roots supplied by the workflow (runner-local, restored
+// by the managed cache step). Absent or relative values disable the caches.
+const optionalCacheRoot = (name) => {
+  const value = process.env[name]?.trim() ?? '';
+  return value !== '' && isAbsolute(value) && !value.includes('..') ? value : '';
+};
+const buildxLayerCache = (repositoryName, architecture) => {
+  const root = optionalCacheRoot('EBK_BUILDX_CACHE_DIR');
+  if (root === '') return { arguments: [], commit: () => {} };
+  const scope = repositoryName.replaceAll('/', '-') + '-' + architecture;
+  const current = join(root, scope);
+  const next = join(root, scope + '.next');
+  mkdirSync(root, { mode: 0o700, recursive: true });
+  rmSync(next, { force: true, recursive: true });
+  return {
+    arguments: [
+      ...(existsSync(current)
+        ? ['--cache-from', 'type=local,src=' + current]
+        : []),
+      '--cache-to',
+      'type=local,dest=' + next + ',mode=max',
+    ],
+    commit: () => {
+      if (!existsSync(next)) return;
+      rmSync(current, { force: true, recursive: true });
+      renameSync(next, current);
+    },
+  };
+};
+const cachedReleaseToolArchive = (name, sha256) => {
+  const root = optionalCacheRoot('EBK_RELEASE_TOOL_CACHE_DIR');
+  return root === '' ? '' : join(root, name + '-' + sha256);
+};
 const mode = process.argv[2];
 const requestedPlatform = process.argv[3];
 if (
@@ -129,23 +236,102 @@ const sourceCommit =
 const stage = process.env.EBK_STAGE?.trim() ?? '';
 const accountId = process.env.AWS_EXPECTED_ACCOUNT_ID?.trim() ?? '';
 const region = process.env.AWS_REGION?.trim() ?? '';
-const runId = process.env.GITHUB_RUN_ID?.trim() ?? '';
-const runAttempt = process.env.GITHUB_RUN_ATTEMPT?.trim() ?? '';
-const workflow = process.env.GITHUB_WORKFLOW_REF?.trim() ?? '';
+const packageRegistryInput =
+  process.env.EBK_CONTAINER_PACKAGE_REGISTRY?.trim() ?? '';
+const localFederated =
+  process.env.GITHUB_ACTIONS !== 'true' &&
+  process.env.EBK_LOCAL_DEPLOYMENT_MODE === 'federated';
+const localRunId = process.env.EBK_LOCAL_CONTAINER_RUN_ID?.trim() ?? '';
+const policy = JSON.parse(
+  readFileSync(join(repositoryRoot, 'ebk.repository-policy.json'), 'utf8'),
+);
+const selectedDeploymentProfile =
+  process.env.EBK_DEPLOYMENT_PROFILE?.trim() ?? '';
+const activeStages = {
+  starter: ['development', 'production'],
+  'production-isolated': ['development', 'staging', 'production'],
+  'fully-isolated': ['development', 'staging', 'production'],
+}[policy.deploymentProfile];
+const locallyAdmittedStages = {
+    starter: ['development', 'production'],
+    'production-isolated': ['development', 'staging'],
+    'fully-isolated': ['development'],
+  }[policy.deploymentProfile];
+if (
+  selectedDeploymentProfile !== policy.deploymentProfile ||
+  !activeStages ||
+  !activeStages.includes(stage) ||
+  policy.deploymentAccounts?.[stage] !== accountId ||
+  policy.deploymentRegion !== region
+) {
+  throw new Error(
+    'Container release requires the exact committed profile, active stage, account, and Region.',
+  );
+}
+if (
+  localFederated &&
+  (!locallyAdmittedStages || !locallyAdmittedStages.includes(stage))
+) {
+  throw new Error(
+    'Local container release requires one of the committed profile locally admitted stages.',
+  );
+}
+const runId = localFederated
+  ? localRunId
+  : process.env.GITHUB_RUN_ID?.trim() ?? '';
+const runAttempt = localFederated
+  ? '1'
+  : process.env.GITHUB_RUN_ATTEMPT?.trim() ?? '';
+const workflow = localFederated
+  ? 'local-federated/' + stage + '/' + accountId + '/' + region
+  : process.env.GITHUB_WORKFLOW_REF?.trim() ?? '';
 if (
   !COMMIT.test(deploymentSourceCommit) ||
   !COMMIT.test(sourceCommit) ||
   !['development', 'staging', 'production'].includes(stage) ||
   !/^\\d{12}$/.test(accountId) ||
   !AWS_REGION_NAME.test(region) ||
+  (!localFederated && process.env.GITHUB_ACTIONS !== 'true') ||
   !/^[1-9]\\d*$/.test(runId) ||
   !/^[1-9]\\d*$/.test(runAttempt) ||
   !REFERENCE.test(workflow)
 ) {
   throw new Error(
-    'Container release requires one exact protected source, run, account, Region, and stage.',
+    'Container release requires one exact GitHub or local-federated source, run, account, Region, and stage.',
   );
 }
+const packageRegistry = (() => {
+  if (packageRegistryInput === '') return undefined;
+  if (packageRegistryInput.length > 2_048) {
+    throw new Error('Container package registry authority is invalid.');
+  }
+  let parsed;
+  try {
+    parsed = new URL(packageRegistryInput);
+  } catch {
+    throw new Error('Container package registry authority is invalid.');
+  }
+  const normalized = parsed.href;
+  const canonicalInput =
+    packageRegistryInput === normalized ||
+    packageRegistryInput + '/' === normalized;
+  const localPlaintext =
+    parsed.protocol === 'http:' &&
+    ['127.0.0.1', 'localhost', 'host.docker.internal', '[::1]'].includes(
+      parsed.hostname,
+    );
+  if (
+    !canonicalInput ||
+    (parsed.protocol !== 'https:' && !localPlaintext) ||
+    parsed.username !== '' ||
+    parsed.password !== '' ||
+    parsed.search !== '' ||
+    parsed.hash !== ''
+  ) {
+    throw new Error('Container package registry authority is invalid.');
+  }
+  return normalized.endsWith('/') ? normalized.slice(0, -1) : normalized;
+})();
 const requireReviewedCheckout = () => {
   validateReviewedReleaseCheckout({
     deploymentSourceCommit,
@@ -290,12 +476,657 @@ const execute = (command, args, label, options = {}) => {
       stdio: ['pipe', 'pipe', 'pipe'],
     });
   } catch (error) {
+    if (options.failureDiagnostics === 'bounded-closure') {
+      const diagnosticStream = (value) => {
+        const raw = value === undefined || value === null ? '' : String(value);
+        if (raw.length === 0) return '[empty]';
+        if (hasSensitiveSupplyChainShape(raw)) {
+          return '[redacted-sensitive-output]';
+        }
+        const bytes = Buffer.from(raw, 'utf8');
+        const truncated = bytes.byteLength > 1_024;
+        const tail = truncated
+          ? bytes.subarray(bytes.byteLength - 1_024).toString('utf8')
+          : raw;
+        return JSON.stringify((truncated ? '[truncated]\\n' : '') + tail);
+      };
+      const status = Number.isSafeInteger(error?.status)
+        ? String(error.status)
+        : 'unavailable';
+      const signal =
+        typeof error?.signal === 'string' && /^[A-Z0-9]+$/.test(error.signal)
+          ? error.signal
+          : 'none';
+      throw new Error(
+        label +
+          ' failed without complete evidence: ' +
+          'status=' +
+          status +
+          '; signal=' +
+          signal +
+          '; stdout=' +
+          diagnosticStream(error?.stdout) +
+          '; stderr=' +
+          diagnosticStream(error?.stderr),
+      );
+    }
     throw new Error(
       label + ' failed without complete evidence: ' +
         String(error?.stderr ?? error?.message ?? error).slice(0, 2_000),
     );
   }
 };
+let releaseBuilder;
+let releaseBuildChild;
+let releaseBuildStopPromise;
+let releaseBuilderSignal;
+const releaseBuilderSignalHandlers = new Map();
+const releaseToolTemporaryDirectories = new Set();
+const yieldToReleaseSignals = () =>
+  new Promise((resolve) => setImmediate(resolve));
+const stopExactReleaseBuildChild = async (signal = 'SIGTERM') => {
+  if (releaseBuildStopPromise) return releaseBuildStopPromise;
+  const observed = releaseBuildChild;
+  if (!observed) return;
+  releaseBuildStopPromise = (async () => {
+    const child = observed.child;
+    if (hostOperatingSystem() === 'win32') {
+      const taskkill = join(process.env.SystemRoot ?? '', 'System32', 'taskkill.exe');
+      if (!isAbsolute(taskkill) || !existsSync(taskkill) || realpathSync(taskkill) !== taskkill) {
+        throw new Error('Exact Windows Buildx cleanup requires canonical SystemRoot.');
+      }
+      const stopped = spawnSync(
+        taskkill,
+        ['/PID', String(child.pid), '/T', '/F'],
+        {
+          cwd: repositoryRoot,
+          encoding: 'utf8',
+          env: process.env,
+          maxBuffer: 1024 * 1024,
+          stdio: ['ignore', 'pipe', 'pipe'],
+          windowsHide: true,
+        },
+      );
+      if (
+        child.exitCode === null &&
+        (stopped.error || stopped.signal || stopped.status !== 0)
+      ) {
+        throw new Error('Exact Windows Buildx process-tree cleanup failed.');
+      }
+    } else if (child.pid) {
+      try {
+        process.kill(-child.pid, signal);
+      } catch (error) {
+        if (error?.code !== 'ESRCH') throw error;
+      }
+    }
+    if (child.exitCode === null) {
+      const closed = await Promise.race([
+        observed.close.then(() => true),
+        new Promise((resolve) => setTimeout(() => resolve(false), 5_000)),
+      ]);
+      if (!closed && hostOperatingSystem() !== 'win32' && child.pid) {
+        try {
+          process.kill(-child.pid, 'SIGKILL');
+        } catch (error) {
+          if (error?.code !== 'ESRCH') throw error;
+        }
+        const killed = await Promise.race([
+          observed.close.then(() => true),
+          new Promise((resolve) => setTimeout(() => resolve(false), 5_000)),
+        ]);
+        if (!killed) {
+          throw new Error('Exact Buildx process group did not terminate.');
+        }
+      }
+    }
+  })().finally(() => {
+    if (releaseBuildChild === observed) releaseBuildChild = undefined;
+    releaseBuildStopPromise = undefined;
+  });
+  return releaseBuildStopPromise;
+};
+const executeObservedBuildx = async (args, label) => {
+  if (releaseBuildChild) {
+    throw new Error('Only one invocation-owned Buildx child may run at a time.');
+  }
+  const child = spawn('docker', args, {
+    cwd: repositoryRoot,
+    detached: hostOperatingSystem() !== 'win32',
+    env: process.env,
+    stdio: ['ignore', 'pipe', 'pipe'],
+    windowsHide: true,
+  });
+  const stdout = [];
+  const stderr = [];
+  let outputBytes = 0;
+  const retain = (chunks, stream, chunk) => {
+    outputBytes += chunk.byteLength;
+    if (outputBytes > MAX_OUTPUT_BYTES) {
+      void stopExactReleaseBuildChild('SIGTERM');
+      return;
+    }
+    chunks.push(chunk);
+    stream.write(chunk);
+  };
+  child.stdout.on('data', (chunk) => retain(stdout, process.stdout, chunk));
+  child.stderr.on('data', (chunk) => retain(stderr, process.stderr, chunk));
+  const close = new Promise((resolve) => {
+    child.once('error', (error) => resolve({ error }));
+    child.once('close', (status, signal) => resolve({ signal, status }));
+  });
+  releaseBuildChild = { child, close };
+  const result = await close;
+  await stopExactReleaseBuildChild();
+  if (
+    outputBytes > MAX_OUTPUT_BYTES ||
+    result.error ||
+    result.signal ||
+    result.status !== 0
+  ) {
+    throw new Error(
+      label + ' failed without complete evidence: ' +
+        Buffer.concat(stderr).toString('utf8').slice(-2_000),
+    );
+  }
+  return Buffer.concat(stdout).toString('utf8');
+};
+const runWindowsPrivateAcl = (script, path, kind) => {
+  const systemRoot = process.env.SystemRoot;
+  if (!systemRoot || !isAbsolute(systemRoot)) {
+    throw new Error('Windows private-path hardening requires an absolute SystemRoot.');
+  }
+  const powershell = join(
+    systemRoot,
+    'System32',
+    'WindowsPowerShell',
+    'v1.0',
+    'powershell.exe',
+  );
+  const result = spawnSync(
+    powershell,
+    [
+      '-NoLogo',
+      '-NoProfile',
+      '-NonInteractive',
+      '-EncodedCommand',
+      Buffer.from(script, 'utf16le').toString('base64'),
+    ],
+    {
+      cwd: repositoryRoot,
+      encoding: 'utf8',
+      env: {
+        ...process.env,
+        EBK_PRIVATE_KIND: kind,
+        EBK_PRIVATE_PATH: path,
+      },
+      maxBuffer: 1024 * 1024,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      timeout: 15_000,
+      windowsHide: true,
+    },
+  );
+  if (result.error || result.signal || result.status !== 0) {
+    throw new Error(
+      'Windows private-path ACL operation failed closed: ' +
+        String(result.stderr || result.error?.message || result.signal || result.status)
+          .slice(-2_000),
+    );
+  }
+};
+const assertPrivateReleaseBuilderPathIdentity = (path, kind) => {
+  const metadata = lstatSync(path);
+  if (
+    metadata.isSymbolicLink() ||
+    (kind === 'directory' ? !metadata.isDirectory() : !metadata.isFile()) ||
+    realpathSync(path) !== path
+  ) {
+    throw new Error(
+      'Container-release builder ownership path failed canonical type validation.',
+    );
+  }
+  return metadata;
+};
+const assertPrivateReleaseBuilderPath = (path, kind) => {
+  const metadata = assertPrivateReleaseBuilderPathIdentity(path, kind);
+  if (hostOperatingSystem() === 'win32') {
+    runWindowsPrivateAcl(WINDOWS_ASSERT_PRIVATE_ACL, path, kind);
+    return metadata;
+  }
+  const expectedMode = kind === 'directory' ? 0o700 : 0o600;
+  if (
+    (metadata.mode & 0o777) !== expectedMode ||
+    (typeof process.getuid === 'function' && metadata.uid !== process.getuid())
+  ) {
+    throw new Error(
+      'Container-release builder ownership path is not current-user private.',
+    );
+  }
+  return metadata;
+};
+const hardenPrivateReleaseBuilderPath = (path, kind) => {
+  assertPrivateReleaseBuilderPathIdentity(path, kind);
+  if (hostOperatingSystem() === 'win32') {
+    runWindowsPrivateAcl(WINDOWS_HARDEN_PRIVATE_ACL, path, kind);
+  } else {
+    chmodSync(path, kind === 'directory' ? 0o700 : 0o600);
+  }
+  return assertPrivateReleaseBuilderPath(path, kind);
+};
+const assertCanonicalAncestorsBeforeCreate = (requested) => {
+  const requestedRelative = relative(repositoryRoot, requested);
+  if (
+    requestedRelative === '' ||
+    requestedRelative === '..' ||
+    requestedRelative.startsWith('..' + sep) ||
+    isAbsolute(requestedRelative)
+  ) {
+    throw new Error('Container-release builder ownership path escapes its repository.');
+  }
+  let cursor = repositoryRoot;
+  for (const segment of requestedRelative.split(sep)) {
+    cursor = join(cursor, segment);
+    if (!existsSync(cursor)) break;
+    const metadata = lstatSync(cursor);
+    if (metadata.isSymbolicLink() || realpathSync(cursor) !== cursor) {
+      throw new Error(
+        'Container-release builder ownership path has a symbolic or noncanonical ancestor.',
+      );
+    }
+  }
+};
+const releaseBuilderLeaseRoot = () => {
+  const requested = resolve(
+    repositoryRoot,
+    '.ebk/cache/container-release-builders',
+  );
+  assertCanonicalAncestorsBeforeCreate(requested);
+  mkdirSync(requested, { mode: 0o700, recursive: true });
+  hardenPrivateReleaseBuilderPath(requested, 'directory');
+  const canonical = realpathSync(requested);
+  if (canonical !== requested) {
+    throw new Error(
+      'Container-release builder leases require one repository-private owned directory.',
+    );
+  }
+  return canonical;
+};
+const readReleaseBuilderLease = (leasePath, expectedName) => {
+  const metadata = assertPrivateReleaseBuilderPath(leasePath, 'file');
+  if (
+    metadata.nlink !== 1 ||
+    metadata.size < 2 ||
+    metadata.size > 16 * 1024
+  ) {
+    throw new Error('Container-release builder lease is not one private file.');
+  }
+  let lease;
+  try {
+    lease = JSON.parse(readFileSync(leasePath, 'utf8'));
+  } catch {
+    throw new Error('Container-release builder lease is invalid JSON.');
+  }
+  const keys = Object.keys(lease ?? {}).sort();
+  if (
+    JSON.stringify(keys) !==
+      JSON.stringify([
+        'builder',
+        'cleanup',
+        'createdAt',
+        'driver',
+        'kind',
+        'ownerPid',
+        'schemaVersion',
+      ]) ||
+    lease.kind !== 'ebk-container-release-builder-lease' ||
+    lease.schemaVersion !== 1 ||
+    lease.builder !== expectedName ||
+    !/^ebk-release-[a-f0-9]{32}$/.test(lease.builder) ||
+    lease.driver !== 'docker-container' ||
+    JSON.stringify(lease.cleanup) !==
+      JSON.stringify(['docker', 'buildx', 'rm', lease.builder]) ||
+    !Number.isSafeInteger(lease.ownerPid) ||
+    lease.ownerPid <= 0 ||
+    !Number.isFinite(Date.parse(lease.createdAt)) ||
+    new Date(lease.createdAt).toISOString() !== lease.createdAt
+  ) {
+    throw new Error('Container-release builder lease has an invalid identity.');
+  }
+  return lease;
+};
+const removeReleaseBuilderSignalHandlers = () => {
+  for (const [signal, handler] of releaseBuilderSignalHandlers) {
+    process.removeListener(signal, handler);
+  }
+  releaseBuilderSignalHandlers.clear();
+};
+const ensureReleaseBuilderSignalHandlers = () => {
+  if (releaseBuilderSignalHandlers.size > 0) return;
+  for (const signal of ['SIGINT', 'SIGTERM']) {
+    const handler = () => void handleReleaseBuilderSignal(signal);
+    releaseBuilderSignalHandlers.set(signal, handler);
+    process.on(signal, handler);
+  }
+};
+const removeReleaseBuilderSignalHandlersWhenIdle = () => {
+  if (!releaseBuilder && releaseToolTemporaryDirectories.size === 0) {
+    removeReleaseBuilderSignalHandlers();
+  }
+};
+const createReleaseToolTemporaryDirectory = (prefix) => {
+  const created = mkdtempSync(join(tmpdir(), prefix));
+  const metadata = lstatSync(created);
+  if (
+    !metadata.isDirectory() ||
+    metadata.isSymbolicLink() ||
+    !isAbsolute(created)
+  ) {
+    throw new Error('Container-release tool temporary directory is not exact.');
+  }
+  const temporary = realpathSync(created);
+  const canonicalMetadata = lstatSync(temporary);
+  if (
+    !isAbsolute(temporary) ||
+    !canonicalMetadata.isDirectory() ||
+    canonicalMetadata.isSymbolicLink() ||
+    canonicalMetadata.dev !== metadata.dev ||
+    canonicalMetadata.ino !== metadata.ino
+  ) {
+    throw new Error('Container-release tool temporary directory is not canonical.');
+  }
+  releaseToolTemporaryDirectories.add(temporary);
+  ensureReleaseBuilderSignalHandlers();
+  return temporary;
+};
+const removeExactReleaseToolTemporaryDirectory = (temporary) => {
+  if (!releaseToolTemporaryDirectories.has(temporary)) {
+    throw new Error('Container-release tool temporary directory is not owned.');
+  }
+  const metadata = lstatSync(temporary);
+  if (
+    !metadata.isDirectory() ||
+    metadata.isSymbolicLink() ||
+    !isAbsolute(temporary) ||
+    realpathSync(temporary) !== temporary
+  ) {
+    throw new Error(
+      'Container-release tool temporary directory changed identity before cleanup.',
+    );
+  }
+  rmSync(temporary, { force: true, recursive: true });
+  if (existsSync(temporary)) {
+    throw new Error('Container-release tool temporary directory cleanup failed.');
+  }
+  releaseToolTemporaryDirectories.delete(temporary);
+  removeReleaseBuilderSignalHandlersWhenIdle();
+};
+const removeAllReleaseToolTemporaryDirectories = () => {
+  const cleanupErrors = [];
+  for (const temporary of [...releaseToolTemporaryDirectories]) {
+    try {
+      removeExactReleaseToolTemporaryDirectory(temporary);
+    } catch (error) {
+      cleanupErrors.push(error);
+    }
+  }
+  if (cleanupErrors.length > 0) {
+    throw new AggregateError(
+      cleanupErrors,
+      'Exact container-release tool temporary cleanup failed.',
+    );
+  }
+};
+const releaseBuilderCleanupDiagnostic = (builder) =>
+  'docker buildx rm ' + builder.name +
+  ' (ownership lease: ' + builder.leasePath + ')';
+const listExactReleaseBuilderNames = ({ signal } = {}) => {
+  const inventory = spawnSync(
+    'docker',
+    ['buildx', 'ls', '--format', '{{json .Name}}'],
+    {
+      cwd: repositoryRoot,
+      encoding: 'utf8',
+      env: process.env,
+      maxBuffer: 1024 * 1024,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      timeout: signal ? 5_000 : undefined,
+    },
+  );
+  if (inventory.error || inventory.signal || inventory.status !== 0) {
+    throw new Error(
+      'Invocation-owned Buildx inventory failed while proving exact cleanup: ' +
+        String(
+          inventory.stderr ||
+            inventory.error?.message ||
+            inventory.signal ||
+            inventory.status,
+        ).slice(-2_000),
+    );
+  }
+  const lines = inventory.stdout.trim() === ''
+    ? []
+    : inventory.stdout.trim().split(/\\r?\\n/u);
+  if (lines.length > 256) {
+    throw new Error('Invocation-owned Buildx inventory is unbounded.');
+  }
+  const names = new Set();
+  for (const line of lines) {
+    let name;
+    try {
+      name = JSON.parse(line);
+    } catch {
+      throw new Error('Invocation-owned Buildx inventory is not exact JSON.');
+    }
+    if (
+      typeof name !== 'string' ||
+      name.length === 0 ||
+      name.length > 256 ||
+      names.has(name)
+    ) {
+      throw new Error('Invocation-owned Buildx inventory has an invalid identity.');
+    }
+    names.add(name);
+  }
+  return names;
+};
+const removeExactReleaseBuilder = (builder, { signal } = {}) => {
+  readReleaseBuilderLease(builder.leasePath, builder.name);
+  const cleanup = spawnSync(
+    'docker',
+    ['buildx', 'rm', builder.name],
+    {
+      cwd: repositoryRoot,
+      encoding: 'utf8',
+      env: process.env,
+      maxBuffer: 1024 * 1024,
+      stdio: ['ignore', 'pipe', 'pipe'],
+      timeout: signal ? 5_000 : undefined,
+    },
+  );
+  if (cleanup.error || cleanup.signal || cleanup.status !== 0) {
+    let builderNames;
+    try {
+      builderNames = listExactReleaseBuilderNames({ signal });
+    } catch (inventoryError) {
+      const error = new AggregateError(
+        [
+          cleanup.error ?? new Error(String(cleanup.stderr || cleanup.status)),
+          inventoryError,
+        ],
+        'Invocation-owned Buildx cleanup and exact absence proof both failed; ' +
+          'retain ' + releaseBuilderCleanupDiagnostic(builder) + '.',
+      );
+      if (signal) {
+        process.stderr.write(error.message + '\\n');
+        return false;
+      }
+      throw error;
+    }
+    if (!builderNames.has(builder.name)) {
+      unlinkSync(builder.leasePath);
+      process.stderr.write(
+        'ebk-release-builder-already-absent ' +
+          JSON.stringify({ builder: builder.name, leasePath: builder.leasePath }) +
+          '\\n',
+      );
+      return true;
+    }
+    const diagnostic = [cleanup.stdout, cleanup.stderr]
+      .filter(Boolean)
+      .join('\\n')
+      .slice(-2_000);
+    const error = new Error(
+      'Invocation-owned Buildx cleanup failed; use only the exact retained ' +
+        'hard-kill cleanup command ' + releaseBuilderCleanupDiagnostic(builder) +
+        (diagnostic ? ': ' + diagnostic : ''),
+    );
+    if (signal) {
+      process.stderr.write(error.message + '\\n');
+      return false;
+    }
+    throw error;
+  }
+  unlinkSync(builder.leasePath);
+  return true;
+};
+const recoverReleaseBuilders = () => {
+  const leaseRoot = releaseBuilderLeaseRoot();
+  const entries = readdirSync(leaseRoot, { withFileTypes: true }).sort(
+    (left, right) =>
+      left.name < right.name ? -1 : left.name > right.name ? 1 : 0,
+  );
+  if (entries.length > 64) {
+    throw new Error('Container-release builder lease inventory is unbounded.');
+  }
+  for (const entry of entries) {
+    const matched = /^(ebk-release-[a-f0-9]{32})\\.json$/.exec(entry.name);
+    if (!entry.isFile() || !matched) {
+      throw new Error(
+        'Container-release builder lease directory contains an unexpected entry.',
+      );
+    }
+    const leasePath = join(leaseRoot, entry.name);
+    const lease = readReleaseBuilderLease(leasePath, matched[1]);
+    const builderNames = listExactReleaseBuilderNames();
+    if (builderNames.has(lease.builder)) {
+      throw new Error(
+        'A retained invocation-owned Buildx builder still exists; inspect it and use only the exact cleanup command ' +
+          releaseBuilderCleanupDiagnostic({ leasePath, name: lease.builder }) + '.',
+      );
+    }
+    unlinkSync(leasePath);
+    process.stderr.write(
+      'ebk-release-builder-recovered ' +
+        JSON.stringify({ builder: lease.builder, leasePath }) +
+        '\\n',
+    );
+  }
+};
+const cleanupReleaseBuilder = ({ signal } = {}) => {
+  const builder = releaseBuilder;
+  if (!builder) {
+    removeReleaseBuilderSignalHandlersWhenIdle();
+    return;
+  }
+  releaseBuilder = undefined;
+  const removed = removeExactReleaseBuilder(builder, { signal });
+  removeReleaseBuilderSignalHandlersWhenIdle();
+  return removed;
+};
+const handleReleaseBuilderSignal = async (signal) => {
+  if (releaseBuilderSignal) return;
+  releaseBuilderSignal = signal;
+  removeReleaseBuilderSignalHandlers();
+  const cleanupErrors = [];
+  let childStopped = false;
+  try {
+    await stopExactReleaseBuildChild(signal);
+    childStopped = true;
+  } catch (error) {
+    cleanupErrors.push(error);
+  }
+  if (childStopped) {
+    try {
+      cleanupReleaseBuilder({ signal });
+    } catch (error) {
+      cleanupErrors.push(error);
+    }
+  }
+  try {
+    removeAllReleaseToolTemporaryDirectories();
+  } catch (error) {
+    cleanupErrors.push(error);
+  }
+  if (cleanupErrors.length > 0) {
+    process.stderr.write(
+      'Invocation-owned Buildx signal cleanup failed closed; the exact ' +
+        'ownership lease was retained: ' +
+        cleanupErrors
+          .map((error) => String(error?.message ?? error))
+          .join('; ')
+          .slice(-2_000) + '\\n',
+    );
+  }
+  try {
+    removeReleaseBuilderSignalHandlers();
+  } finally {
+    process.kill(process.pid, signal);
+  }
+};
+const ensureReleaseBuilder = () => {
+  if (releaseBuilder) return releaseBuilder;
+  const name = 'ebk-release-' + randomBytes(16).toString('hex');
+  const leaseRoot = releaseBuilderLeaseRoot();
+  const leasePath = join(leaseRoot, name + '.json');
+  const builder = {
+    leasePath,
+    leaseRoot,
+    name,
+  };
+  writeFileSync(
+    leasePath,
+    JSON.stringify({
+      builder: name,
+      cleanup: ['docker', 'buildx', 'rm', name],
+      createdAt: new Date().toISOString(),
+      driver: 'docker-container',
+      kind: 'ebk-container-release-builder-lease',
+      ownerPid: process.pid,
+      schemaVersion: 1,
+    }) + '\\n',
+    { encoding: 'utf8', flag: 'wx', mode: 0o600 },
+  );
+  hardenPrivateReleaseBuilderPath(leasePath, 'file');
+  releaseBuilder = builder;
+  ensureReleaseBuilderSignalHandlers();
+  process.stderr.write(
+    'ebk-release-builder-ownership ' +
+      JSON.stringify({
+        builder: name,
+        hardKillCleanup: ['docker', 'buildx', 'rm', name],
+        leasePath,
+      }) +
+      '\\n',
+  );
+  try {
+    execute(
+      'docker',
+      ['buildx', 'create', '--name', name, '--driver', 'docker-container'],
+      'Invocation-owned native Buildx builder creation',
+    );
+  } catch (error) {
+    try {
+      cleanupReleaseBuilder();
+    } catch (cleanupError) {
+      throw new AggregateError(
+        [error, cleanupError],
+        'Invocation-owned Buildx creation and cleanup both failed.',
+      );
+    }
+    throw error;
+  }
+  return builder;
+};
 const awsJson = (args, label) => {
   const raw = execute('aws', args, label);
   try {
@@ -332,11 +1163,12 @@ const describeRepository = (repositoryName) => {
       throw new Error('ECR repository lookup returned invalid JSON.');
     }
   }
-  const error = String(result.stderr ?? '');
+  const error = String(result.stderr ?? '').trimStart();
+  const notFound =
+    'An error occurred (RepositoryNotFoundException) when calling the DescribeRepositories operation:';
   if (
-    !error.startsWith(
-      'An error occurred (RepositoryNotFoundException) when calling the DescribeRepositories operation:',
-    )
+    !error.startsWith(notFound) &&
+    !error.startsWith('aws: [ERROR]: ' + notFound)
   ) {
     throw new Error('ECR repository lookup failed outside the create-if-absent path.');
   }
@@ -349,6 +1181,18 @@ const caller = awsJson(
 if (caller?.Account !== accountId) {
   throw new Error('Container release AWS caller differs from the target account.');
 }
+execute(
+  process.execPath,
+  [
+    safePath(
+      'tools/stage-authority-render.mjs',
+      'Workspace ownership doctor',
+    ),
+    '--stage=' + stage,
+    '--ownership-doctor=true',
+  ],
+  'Workspace stage ownership',
+);
 const controls = readJson(
   safePath('operations/release.json', 'Release controls', { base: sliceRoot }),
   'Release controls',
@@ -404,10 +1248,17 @@ const releaseContainerInputs = declaredContainers.map((declared, index) => {
       ? captured.digest
       : captured?.candidateDigest;
   const candidate = declared.candidate;
-  const materialDigest = digestCandidatePaths(
-    candidate.materialPaths,
-    'OCI artifact candidate material',
-  );
+  // Promotion copies reviewed staging images without rebuilding, so the build
+  // material is never present in that job; the candidate evidence restored
+  // from the exact release artifact already binds the material digest
+  // (EBK-INT-2026-076).
+  const materialDigest =
+    mode === 'promote'
+      ? candidateArtifactDigest
+      : digestCandidatePaths(
+          candidate.materialPaths,
+          'OCI artifact candidate material',
+        );
   const buildRecipeDigest = digestCandidatePaths(
     candidate.recipePaths,
     'OCI artifact candidate recipe',
@@ -684,18 +1535,132 @@ const exactImageByTag = (repositoryName, tag) => {
   }
   return response.imageDetails[0].imageDigest;
 };
+const exactImageByDigest = (repositoryName, imageDigest) => {
+  const response = awsJson(
+    [
+      'ecr',
+      'describe-images',
+      '--registry-id',
+      accountId,
+      '--repository-name',
+      repositoryName,
+      '--image-ids',
+      'imageDigest=' + imageDigest,
+      '--region',
+      region,
+      '--output',
+      'json',
+    ],
+    'Exact ECR image digest lookup',
+  );
+  return (
+    Array.isArray(response?.imageDetails) &&
+    response.imageDetails.length === 1 &&
+    response.imageDetails[0]?.registryId === accountId &&
+    response.imageDetails[0]?.repositoryName === repositoryName &&
+    response.imageDetails[0]?.imageDigest === imageDigest
+  );
+};
+// An unchanged artifact (same candidate material, recipe, Dockerfile, platform,
+// and production closure) may reuse the image and SBOM retained by the newest
+// successful deployment on this branch instead of rebuilding. Declining reuse
+// is always safe: the full native build runs. The native run proof is always
+// re-executed against the reused image.
+const reusableBaselinePlatformRecord = (input, requestedPlatform, architecture, repositoryName, expectedClosure) => {
+  const root = optionalCacheRoot('EBK_CONTAINER_BASELINE_ROOT');
+  if (root === '' || process.env.EBK_OCI_REBUILD?.trim() === 'all') return undefined;
+  const safeArtifact = input.declared.name.replace(/[^A-Za-z0-9._-]/g, '_');
+  const recordPath = join(
+    root,
+    'container-release',
+    'partials',
+    stage,
+    slice,
+    architecture,
+    safeArtifact + '.platform.json',
+  );
+  const decline = (reason) => {
+    process.stderr.write(
+      'ebk-container-release-reuse ' +
+        JSON.stringify({ artifact: input.declared.id, platform: requestedPlatform, reason, reused: false }) +
+        '\\n',
+    );
+    return undefined;
+  };
+  if (!existsSync(recordPath) || lstatSync(recordPath).isSymbolicLink()) {
+    return decline('no baseline platform record');
+  }
+  let record;
+  try {
+    record = validateContainerPlatformEvidence(JSON.parse(readFileSync(recordPath, 'utf8')));
+  } catch (error) {
+    return decline('baseline platform record is invalid: ' + String(error?.message ?? error));
+  }
+  if (
+    record.accountId !== accountId ||
+    record.region !== region ||
+    record.stage !== stage ||
+    record.slice !== slice ||
+    record.artifactId !== input.declared.id ||
+    record.artifactName !== input.declared.name ||
+    record.platform !== requestedPlatform ||
+    record.repositoryName !== repositoryName ||
+    record.candidateArtifactDigest !== input.candidateArtifactDigest ||
+    record.dockerfileDigest !== digestBytes(readFileSync(input.dockerfile)) ||
+    record.productionClosureDigest !== expectedClosure.digest ||
+    !IMAGE_DIGEST.test(record.imageDigest) ||
+    record.imageReference !== registry + '/' + repositoryName + '@' + record.imageDigest
+  ) {
+    return decline('artifact inputs changed since the baseline');
+  }
+  const evidencePrefix = '.ebk/evidence/';
+  const sbomPath = join(
+    root,
+    record.sbom.path.startsWith(evidencePrefix)
+      ? record.sbom.path.slice(evidencePrefix.length)
+      : record.sbom.path,
+  );
+  if (!existsSync(sbomPath) || lstatSync(sbomPath).isSymbolicLink()) {
+    return decline('baseline SBOM is absent');
+  }
+  const sbomBytes = readFileSync(sbomPath);
+  if (digestBytes(sbomBytes) !== record.sbom.sha256) {
+    return decline('baseline SBOM bytes differ from the retained record');
+  }
+  if (!exactImageByDigest(repositoryName, record.imageDigest)) {
+    return decline('baseline image is no longer in the registry');
+  }
+  process.stderr.write(
+    'ebk-container-release-reuse ' +
+      JSON.stringify({
+        artifact: input.declared.id,
+        baselineCommit: record.sourceCommit,
+        imageDigest: record.imageDigest,
+        platform: requestedPlatform,
+        reused: true,
+      }) +
+      '\\n',
+  );
+  return { imageDigest: record.imageDigest, sbomBytes };
+};
 const acquireSyft = async () => {
   const platformKey = process.platform + '-' + process.arch;
   const release = SYFT_RELEASES[platformKey];
   if (!release) {
     throw new Error('No reviewed Syft release exists for ' + platformKey + '.');
   }
-  const temporary = mkdtempSync(join(tmpdir(), 'ebk-container-syft-'));
+  const temporary = createReleaseToolTemporaryDirectory('ebk-container-syft-');
+  try {
   const supplied = process.env.EBK_SYFT_ARCHIVE_PATH?.trim();
   const archive = supplied
     ? safePath(relative(repositoryRoot, resolve(repositoryRoot, supplied)), 'Supplied Syft archive')
     : join(temporary, 'syft-archive');
-  if (!supplied) {
+  const cachedArchive = supplied ? '' : cachedReleaseToolArchive('syft', release.sha256);
+  if (!supplied && cachedArchive && existsSync(cachedArchive)) {
+    // Reuse the archive verified by an earlier invocation on this runner; the
+    // digest check below still runs against the copied bytes.
+    copyFileSync(cachedArchive, archive);
+  } else if (!supplied) {
     const response = await fetch(release.source, {
       redirect: 'follow',
       signal: AbortSignal.timeout(120_000),
@@ -720,6 +1685,10 @@ const acquireSyft = async () => {
   ) {
     throw new Error('Pinned Syft archive integrity does not match policy.');
   }
+  if (cachedArchive && !existsSync(cachedArchive)) {
+    mkdirSync(optionalCacheRoot('EBK_RELEASE_TOOL_CACHE_DIR'), { mode: 0o700, recursive: true });
+    writeFileSync(cachedArchive, bytes, { mode: 0o600 });
+  }
   const path = join(temporary, 'syft');
   if (release.archiveFormat === 'binary') {
     writeFileSync(path, bytes, { mode: 0o700 });
@@ -728,6 +1697,7 @@ const acquireSyft = async () => {
     chmodSync(path, 0o700);
   }
   const version = String(execute(path, ['version'], 'Syft version'));
+  await yieldToReleaseSignals();
   if (
     !new RegExp('(?:Version|version):?\\\\s*' + SYFT_VERSION.replaceAll('.', '\\\\.')).test(
       version,
@@ -735,7 +1705,18 @@ const acquireSyft = async () => {
   ) {
     throw new Error('Syft runtime version differs from reviewed policy.');
   }
-  return { path, temporary };
+    return { path, temporary };
+  } catch (error) {
+    try {
+      removeExactReleaseToolTemporaryDirectory(temporary);
+    } catch (cleanupError) {
+      throw new AggregateError(
+        [error, cleanupError],
+        'Syft acquisition and exact temporary cleanup both failed.',
+      );
+    }
+    throw error;
+  }
 };
 const acquireCrane = async () => {
   const platformKey = process.platform + '-' + process.arch;
@@ -743,7 +1724,8 @@ const acquireCrane = async () => {
   if (!release) {
     throw new Error('No reviewed Crane release exists for ' + platformKey + '.');
   }
-  const temporary = mkdtempSync(join(tmpdir(), 'ebk-container-crane-'));
+  const temporary = createReleaseToolTemporaryDirectory('ebk-container-crane-');
+  try {
   const supplied = process.env.EBK_CRANE_ARCHIVE_PATH?.trim();
   const archive = supplied
     ? safePath(
@@ -751,7 +1733,10 @@ const acquireCrane = async () => {
         'Supplied Crane archive',
       )
     : join(temporary, 'crane-archive.tar.gz');
-  if (!supplied) {
+  const cachedArchive = supplied ? '' : cachedReleaseToolArchive('crane', release.sha256);
+  if (!supplied && cachedArchive && existsSync(cachedArchive)) {
+    copyFileSync(cachedArchive, archive);
+  } else if (!supplied) {
     const response = await fetch(release.source, {
       redirect: 'follow',
       signal: AbortSignal.timeout(120_000),
@@ -776,10 +1761,15 @@ const acquireCrane = async () => {
   ) {
     throw new Error('Pinned Crane archive integrity does not match policy.');
   }
+  if (cachedArchive && !existsSync(cachedArchive)) {
+    mkdirSync(optionalCacheRoot('EBK_RELEASE_TOOL_CACHE_DIR'), { mode: 0o700, recursive: true });
+    writeFileSync(cachedArchive, bytes, { mode: 0o600 });
+  }
   execute('tar', ['-xzf', archive, '-C', temporary, 'crane'], 'Crane extraction');
   const path = join(temporary, 'crane');
   chmodSync(path, 0o700);
   const version = String(execute(path, ['version'], 'Crane version')).trim();
+  await yieldToReleaseSignals();
   if (
     !new RegExp('(?:^|\\s|v)' + CRANE_VERSION.replaceAll('.', '\\.') + '(?:$|\\s)').test(
       version,
@@ -787,12 +1777,23 @@ const acquireCrane = async () => {
   ) {
     throw new Error('Crane runtime version differs from reviewed policy.');
   }
-  return { path, temporary };
+    return { path, temporary };
+  } catch (error) {
+    try {
+      removeExactReleaseToolTemporaryDirectory(temporary);
+    } catch (cleanupError) {
+      throw new AggregateError(
+        [error, cleanupError],
+        'Crane acquisition and exact temporary cleanup both failed.',
+      );
+    }
+    throw error;
+  }
 };
 const parseCycloneDx = (value, label) => {
   if (
     value?.bomFormat !== 'CycloneDX' ||
-    value.specVersion !== '1.6' ||
+    value.specVersion !== '1.7' ||
     value.version !== 1 ||
     !/^urn:uuid:[a-fA-F0-9-]{36}$/.test(value.serialNumber ?? '') ||
     !Array.isArray(value.components) ||
@@ -801,17 +1802,30 @@ const parseCycloneDx = (value, label) => {
     !value.metadata ||
     typeof value.metadata !== 'object'
   ) {
-    throw new Error(label + ' is not complete CycloneDX 1.6.');
+    throw new Error(label + ' is not complete CycloneDX 1.7.');
   }
   return value;
 };
+const isVersionlessSyftFileComponent = (component) =>
+  component?.type === 'file' &&
+  component.version === undefined &&
+  component.purl === undefined &&
+  typeof component.name === 'string' &&
+  component.name.startsWith('/') &&
+  component.name.length <= 4_096 &&
+  Array.isArray(component.hashes) &&
+  component.hashes.length === 2 &&
+  component.hashes[0]?.alg === 'SHA-1' &&
+  /^[a-f0-9]{40}$/.test(component.hashes[0]?.content ?? '') &&
+  component.hashes[1]?.alg === 'SHA-256' &&
+  /^[a-f0-9]{64}$/.test(component.hashes[1]?.content ?? '');
 const componentSetFor = (sbom) =>
   sbom.components
     .map((component) => ({
       name: component?.name,
       purl: component?.purl ?? '',
       type: component?.type,
-      version: component?.version,
+      version: component?.version ?? '',
     }))
     .sort((left, right) =>
       JSON.stringify(left) < JSON.stringify(right)
@@ -874,15 +1888,19 @@ const npmClosureFor = (syftDocument, options = {}) => {
   }
   return unique;
 };
-const deriveExpectedProductionClosure = (syft, input) => {
-  const temporary = mkdtempSync(join(tmpdir(), 'ebk-container-closure-'));
+const deriveExpectedProductionClosure = async (syft, input) => {
+  const temporary = createReleaseToolTemporaryDirectory('ebk-container-closure-');
   const deployed = join(temporary, 'deployed');
   try {
     execute(
       'pnpm',
       [
+        '--config.store-dir=' +
+          safePath('.ebk/cache/pnpm-store', 'Workspace pnpm store'),
+        '--config.inject-workspace-packages=true',
         '--filter',
         input.packageName,
+        '--trust-lockfile',
         'deploy',
         '--prod',
         '--offline',
@@ -890,38 +1908,79 @@ const deriveExpectedProductionClosure = (syft, input) => {
         deployed,
       ],
       'Independent production closure deployment',
-      { env: { COREPACK_ENABLE_DOWNLOAD_PROMPT: '0' } },
+      {
+        env: { COREPACK_ENABLE_DOWNLOAD_PROMPT: '0' },
+        failureDiagnostics: 'bounded-closure',
+      },
     );
+    await yieldToReleaseSignals();
     const raw = String(
       execute(
         syft.path,
         ['scan', 'dir:' + deployed, '--output', 'syft-json'],
         'Independent production closure inventory',
-        { env: { SYFT_CHECK_FOR_APP_UPDATE: 'false' } },
+        {
+          env: { SYFT_CHECK_FOR_APP_UPDATE: 'false' },
+          failureDiagnostics: 'bounded-closure',
+        },
       ),
     );
+    await yieldToReleaseSignals();
     let inventory;
     try {
       inventory = JSON.parse(raw);
     } catch {
       throw new Error('Independent production closure inventory is invalid JSON.');
     }
+    const sourceManifest = readJson(
+      input.packageManifestPath,
+      'Container package manifest',
+    );
+    const deployedManifest = readJson(
+      join(deployed, 'package.json'),
+      'Deployed container package manifest',
+    );
+    if (
+      sourceManifest.name !== input.packageName ||
+      typeof sourceManifest.version !== 'string' ||
+      sourceManifest.version.length === 0 ||
+      sourceManifest.version.length > 128 ||
+      deployedManifest.name !== sourceManifest.name ||
+      deployedManifest.version !== sourceManifest.version
+    ) {
+      throw new Error(
+        'Independent production closure changed the workload package identity.',
+      );
+    }
     const packages = npmClosureFor(inventory);
     if (
-      !packages.some(
+      packages.some(
         ({ name, version }) =>
-          name === input.packageName &&
-          version === readJson(
-            input.packageManifestPath,
-            'Container package manifest',
-          ).version,
+          name === sourceManifest.name && version !== sourceManifest.version,
       )
     ) {
-      throw new Error('Independent production closure omits the workload package.');
+      throw new Error(
+        'Independent production closure contains a conflicting workload package identity.',
+      );
+    }
+    if (!packages.some(({ name }) => name === sourceManifest.name)) {
+      packages.push({
+        name: sourceManifest.name,
+        version: sourceManifest.version,
+      });
+      packages.sort(
+        (left, right) =>
+          (left.name < right.name ? -1 : left.name > right.name ? 1 : 0) ||
+          (left.version < right.version
+            ? -1
+            : left.version > right.version
+              ? 1
+              : 0),
+      );
     }
     return { digest: supplyChainDigest(packages), packages };
   } finally {
-    rmSync(temporary, { force: true, recursive: true });
+    removeExactReleaseToolTemporaryDirectory(temporary);
   }
 };
 const validateRetainedSbom = (entry, label) => {
@@ -1210,13 +2269,26 @@ if (stage === 'development') {
     process.env.EBK_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID?.trim() ?? '';
   const expectedSourceRegion =
     process.env.EBK_STAGING_PROMOTION_REGION?.trim() ?? '';
+  const deploymentProfile = process.env.EBK_DEPLOYMENT_PROFILE?.trim() ?? '';
+  if (
+    deploymentProfile !== 'starter' &&
+    deploymentProfile !== 'production-isolated' &&
+    deploymentProfile !== 'fully-isolated'
+  ) {
+    throw new Error('Container promotion requires one exact deployment profile.');
+  }
+  const sameAccountPromotion = deploymentProfile === 'starter';
   if (
     !/^\\d{12}$/.test(expectedSourceAccountId) ||
     !AWS_REGION_NAME.test(expectedSourceRegion) ||
-    expectedSourceAccountId === accountId
+    (sameAccountPromotion
+      ? expectedSourceAccountId !== accountId || expectedSourceRegion !== region
+      : expectedSourceAccountId === accountId)
   ) {
     throw new Error(
-      'Development retirement promotion requires one independent staging account and Region.',
+      sameAccountPromotion
+        ? 'Starter promotion requires the exact shared account and Region.'
+        : 'Isolated promotion requires one independent staging account and exact Region.',
     );
   }
   const sourceBindingPath = safePath(
@@ -1310,13 +2382,26 @@ if (mode === 'promote') {
     process.env.EBK_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID?.trim() ?? '';
   const expectedSourceRegion =
     process.env.EBK_STAGING_PROMOTION_REGION?.trim() ?? '';
+  const deploymentProfile = process.env.EBK_DEPLOYMENT_PROFILE?.trim() ?? '';
+  if (
+    deploymentProfile !== 'starter' &&
+    deploymentProfile !== 'production-isolated' &&
+    deploymentProfile !== 'fully-isolated'
+  ) {
+    throw new Error('OCI promotion requires one exact deployment profile.');
+  }
+  const sameAccountPromotion = deploymentProfile === 'starter';
   if (
     !/^\\d{12}$/.test(expectedSourceAccountId) ||
     !AWS_REGION_NAME.test(expectedSourceRegion) ||
-    expectedSourceAccountId === accountId
+    (sameAccountPromotion
+      ? expectedSourceAccountId !== accountId || expectedSourceRegion !== region
+      : expectedSourceAccountId === accountId)
   ) {
     throw new Error(
-      'OCI promotion requires one bounded independent staging account and Region.',
+      sameAccountPromotion
+        ? 'Starter OCI promotion requires the exact shared account and Region.'
+        : 'Isolated OCI promotion requires one bounded independent staging account and exact Region.',
     );
   }
   const sourceBindingInput =
@@ -1573,6 +2658,7 @@ if (mode === 'promote') {
     slice,
     'binding.json',
   );
+  await yieldToReleaseSignals();
   immutableWrite(output, binding);
   process.stdout.write(
     JSON.stringify({
@@ -1585,30 +2671,41 @@ if (mode === 'promote') {
     }) + '\\n',
   );
   } finally {
-    rmSync(crane.temporary, { force: true, recursive: true });
+    removeExactReleaseToolTemporaryDirectory(crane.temporary);
   }
   process.exit(0);
 }
 
 if (mode === 'platform') {
-  const nativeArchitecture = process.arch === 'x64' ? 'amd64' : process.arch;
-  if (
-    process.platform !== 'linux' ||
-    requestedPlatform !== 'linux/' + nativeArchitecture
-  ) {
-    throw new Error(
-      'Platform evidence must run on the matching native Linux architecture.',
-    );
-  }
-  const syft = await acquireSyft();
-  const crane = stage === 'development' ? await acquireCrane() : undefined;
+  let syft;
+  let crane;
+  let platformError;
   try {
-    const expectedClosures = new Map(
-      containerInputs.map((input) => [
-        input.declared.id,
-        deriveExpectedProductionClosure(syft, input),
-      ]),
-    );
+    syft = await acquireSyft();
+    crane =
+      stage === 'development' || optionalCacheRoot('EBK_CONTAINER_BASELINE_ROOT') !== ''
+        ? await acquireCrane()
+        : undefined;
+    recoverReleaseBuilders();
+    // Artifacts that share a package, recipe, and Dockerfile (the migration and
+    // retirement jobs) resolve one identical production closure.
+    const expectedClosures = new Map();
+    const closuresByRecipe = new Map();
+    for (const input of containerInputs) {
+      const recipeKey =
+        input.packageName +
+        ':' +
+        input.buildRecipeDigest +
+        ':' +
+        digestBytes(readFileSync(input.dockerfile));
+      if (!closuresByRecipe.has(recipeKey)) {
+        closuresByRecipe.set(
+          recipeKey,
+          await deriveExpectedProductionClosure(syft, input),
+        );
+      }
+      expectedClosures.set(input.declared.id, closuresByRecipe.get(recipeKey));
+    }
     requireReviewedCheckout();
     for (const input of containerInputs) requireCandidateAuthority(input);
     login();
@@ -1639,7 +2736,24 @@ if (mode === 'platform') {
               ({ platform }) => platform === requestedPlatform,
             )
           : undefined;
-      if (stage === 'development') {
+      const reusable =
+        stage === 'development'
+          ? undefined
+          : reusableBaselinePlatformRecord(
+              input,
+              requestedPlatform,
+              architecture,
+              repositoryName,
+              expectedClosure,
+            );
+      if (reusable) {
+        if (!crane) throw new Error('Unchanged artifact reuse requires the reviewed crane.');
+        execute(
+          crane.path,
+          ['copy', registry + '/' + repositoryName + '@' + reusable.imageDigest, taggedReference],
+          'Unchanged artifact re-tag without rebuilding',
+        );
+      } else if (stage === 'development') {
         if (!crane || !developmentSourcePlatform) {
           throw new Error(
             'Development retirement source platform is absent.',
@@ -1651,32 +2765,46 @@ if (mode === 'platform') {
           'Exact staging retirement child promotion',
         );
       } else {
-        execute(
-          'docker',
-          [
-            'buildx',
-            'build',
-            '--file',
-            relative(repositoryRoot, input.dockerfile),
-            '--label',
-            'org.opencontainers.image.revision=' + sourceCommit,
-            '--label',
-            'dev.empire-builder-kit.candidate-digest=' +
-              input.candidateArtifactDigest,
-            '--platform',
-            requestedPlatform,
-            '--provenance=false',
-            '--push',
-            '--sbom=false',
-            '--tag',
-            taggedReference,
-            relative(repositoryRoot, input.context) || '.',
-          ],
-          'Native container build and push',
-        );
+        // One BuildKit builder serves every artifact of this invocation so
+        // shared layers (pnpm fetch, filtered install) are reused across the
+        // Slice's images; the platform-mode finally block removes it.
+        const platformBuilder = ensureReleaseBuilder();
+        const layerCache = buildxLayerCache(repositoryName, architecture);
+        await executeObservedBuildx([
+          'buildx',
+          'build',
+          '--builder',
+          platformBuilder.name,
+          ...(packageRegistry
+            ? [
+                '--build-arg',
+                'NPM_CONFIG_REGISTRY=' + packageRegistry,
+              ]
+            : []),
+          ...layerCache.arguments,
+          '--file',
+          relative(repositoryRoot, input.dockerfile),
+          '--label',
+          'org.opencontainers.image.revision=' + sourceCommit,
+          '--label',
+          'dev.empire-builder-kit.candidate-digest=' +
+            input.candidateArtifactDigest,
+          '--platform',
+          requestedPlatform,
+          '--provenance=false',
+          '--push',
+          '--sbom=false',
+          '--tag',
+          taggedReference,
+          relative(repositoryRoot, input.context) || '.',
+        ], 'Native container build and push');
+        layerCache.commit();
       }
       const imageDigest = exactImageByTag(repositoryName, tag);
       const imageReference = registry + '/' + repositoryName + '@' + imageDigest;
+      if (reusable && reusable.imageDigest !== imageDigest) {
+        throw new Error('Unchanged artifact re-tag differs from the baseline image.');
+      }
       if (
         stage === 'development' &&
         developmentSourcePlatform?.imageDigest !== imageDigest
@@ -1752,39 +2880,43 @@ if (mode === 'platform') {
         resolve(repositoryRoot, relativeRunProofPath),
         serializedRunProof,
       );
-      const closureRaw = String(
-        execute(
-          syft.path,
-          ['scan', 'registry:' + imageReference, '--output', 'syft-json'],
-          'Exact application npm closure inventory',
-          { env: { SYFT_CHECK_FOR_APP_UPDATE: 'false' } },
-        ),
-      );
-      let closureInventory;
-      try {
-        closureInventory = JSON.parse(closureRaw);
-      } catch {
-        throw new Error('Exact application npm closure inventory is invalid JSON.');
-      }
-      const observedClosure = npmClosureFor(closureInventory, {
-        applicationOnly: true,
-      });
-      if (
-        JSON.stringify(observedClosure) !==
-        JSON.stringify(expectedClosure.packages)
-      ) {
-        throw new Error(
-          'Container application npm closure differs from the independently deployed production closure.',
+      if (!reusable) {
+        const closureRaw = String(
+          execute(
+            syft.path,
+            ['scan', 'registry:' + imageReference, '--output', 'syft-json'],
+            'Exact application npm closure inventory',
+            { env: { SYFT_CHECK_FOR_APP_UPDATE: 'false' } },
+          ),
         );
+        let closureInventory;
+        try {
+          closureInventory = JSON.parse(closureRaw);
+        } catch {
+          throw new Error('Exact application npm closure inventory is invalid JSON.');
+        }
+        const observedClosure = npmClosureFor(closureInventory, {
+          applicationOnly: true,
+        });
+        if (
+          JSON.stringify(observedClosure) !==
+          JSON.stringify(expectedClosure.packages)
+        ) {
+          throw new Error(
+            'Container application npm closure differs from the independently deployed production closure.',
+          );
+        }
       }
-      const rawSbom = String(
-        execute(
-          syft.path,
-          ['scan', 'registry:' + imageReference, '--output', 'cyclonedx-json'],
-          'Exact platform OCI SBOM',
-          { env: { SYFT_CHECK_FOR_APP_UPDATE: 'false' } },
-        ),
-      );
+      const rawSbom = reusable
+        ? reusable.sbomBytes.toString('utf8')
+        : String(
+            execute(
+              syft.path,
+              ['scan', 'registry:' + imageReference, '--output', 'cyclonedx-json'],
+              'Exact platform OCI SBOM',
+              { env: { SYFT_CHECK_FOR_APP_UPDATE: 'false' } },
+            ),
+          );
       let sbom;
       try {
         sbom = parseCycloneDx(
@@ -1796,14 +2928,20 @@ if (mode === 'platform') {
       }
       const componentSet = componentSetFor(sbom);
       if (
-        componentSet.some(
+        sbom.components.some(
           (component) =>
-            typeof component.name !== 'string' ||
+            typeof component?.name !== 'string' ||
+            component.name.length === 0 ||
             typeof component.type !== 'string' ||
-            typeof component.version !== 'string',
+            component.type.length === 0 ||
+            !(
+              (typeof component.version === 'string' &&
+                component.version.length > 0) ||
+              isVersionlessSyftFileComponent(component)
+            ),
         )
       ) {
-        throw new Error('Platform SBOM contains invalid or development components.');
+        throw new Error('Platform SBOM contains an invalid component identity.');
       }
       const serializedSbom = JSON.stringify(sbom, null, 2) + '\\n';
       const relativeSbomPath =
@@ -1842,6 +2980,7 @@ if (mode === 'platform') {
         evidence,
       );
     }
+    await yieldToReleaseSignals();
     process.stdout.write(
       JSON.stringify({
         artifactCount: containerInputs.length,
@@ -1850,12 +2989,33 @@ if (mode === 'platform') {
         stage,
       }) + '\\n',
     );
+  } catch (error) {
+    platformError = error;
   } finally {
-    rmSync(syft.temporary, { force: true, recursive: true });
-    if (crane) {
-      rmSync(crane.temporary, { force: true, recursive: true });
+    const cleanupErrors = [];
+    for (const cleanup of [
+      () => cleanupReleaseBuilder(),
+      ...(syft
+        ? [() => removeExactReleaseToolTemporaryDirectory(syft.temporary)]
+        : []),
+      ...(crane
+        ? [() => removeExactReleaseToolTemporaryDirectory(crane.temporary)]
+        : []),
+    ]) {
+      try {
+        cleanup();
+      } catch (error) {
+        cleanupErrors.push(error);
+      }
+    }
+    if (cleanupErrors.length > 0) {
+      throw new AggregateError(
+        [...(platformError ? [platformError] : []), ...cleanupErrors],
+        'Container platform release and independent owned-resource cleanup failed.',
+      );
     }
   }
+  if (platformError) throw platformError;
   process.exit(0);
 }
 
@@ -2067,6 +3227,7 @@ const output = resolve(
   slice,
   'binding.json',
 );
+await yieldToReleaseSignals();
 immutableWrite(output, binding);
 process.stdout.write(
   JSON.stringify({
@@ -2079,7 +3240,7 @@ process.stdout.write(
 );
 } finally {
   if (assemblyCrane) {
-    rmSync(assemblyCrane.temporary, { force: true, recursive: true });
+    removeExactReleaseToolTemporaryDirectory(assemblyCrane.temporary);
   }
 }
 `;