@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/generators/preset/workspace-files-ecr-inspector.js

@@ -0,0 +1,298 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.THIN_ECR_INSPECTOR_WORKFLOW_PATH = void 0;
+exports.renderThinEcrInspectorWorkflow = renderThinEcrInspectorWorkflow;
+exports.THIN_ECR_INSPECTOR_WORKFLOW_PATH = '.github/workflows/ecr-inspector-evidence.yml';
+/** Render the postdeploy scanner against the thin lifecycle receipt artifact. */
+function renderThinEcrInspectorWorkflow(options) {
+    const { actionPins, deploymentProfile, name, nodeVersion } = options;
+    const stageChoices = deploymentProfile === 'starter' ? 'production' : 'staging, production';
+    const stageBranchCases = deploymentProfile === 'starter'
+        ? 'production:main'
+        : 'staging:develop|production:main';
+    return {
+        [exports.THIN_ECR_INSPECTOR_WORKFLOW_PATH]: `name: ECR Inspector evidence
+
+on:
+  workflow_dispatch:
+    inputs:
+      stage:
+        description: Exact deployed container stage
+        required: true
+        type: choice
+        options: [${stageChoices}]
+      deployment_commit:
+        description: Exact successful Deploy workflow commit
+        required: true
+        type: string
+      deploy_run_id:
+        description: Exact successful Deploy workflow run ID
+        required: true
+        type: string
+      deployment_receipt_artifact_name:
+        description: Exact deployment-receipt artifact from that run
+        required: true
+        type: string
+      slice:
+        description: Exact registered Product Slice
+        required: true
+        type: string
+      artifact_id:
+        description: Exact OCI artifact ID from operations/release.json
+        required: true
+        type: string
+      task_definition_family:
+        description: Exact deployed ECS task-definition family
+        required: true
+        type: string
+      deployment_kind:
+        description: Exact deployed ECS authority kind
+        required: true
+        type: choice
+        options: [service, task]
+      cluster_arn:
+        description: Exact ECS cluster ARN
+        required: true
+        type: string
+      deployment_arn:
+        description: Exact ECS service ARN or task ARN
+        required: true
+        type: string
+
+concurrency:
+  group: ecr-inspector-\${{ inputs.stage }}-\${{ inputs.slice }}-\${{ inputs.artifact_id }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  collect:
+    name: exact deployed OCI and Inspector evidence
+    runs-on: ubuntu-latest
+    environment: ecr-inspector-\${{ inputs.stage }}
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+    env:
+      AWS_EVIDENCE_ROLE_ARN: \${{ secrets.AWS_ECR_INSPECTOR_EVIDENCE_ROLE_ARN }}
+      AWS_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_EXPECTED_ACCOUNT_ID }}
+      AWS_REGION: \${{ vars.AWS_REGION }}
+      EBK_ARTIFACT_ID: \${{ inputs.artifact_id }}
+      EBK_CLUSTER_ARN: \${{ inputs.cluster_arn }}
+      EBK_DEPLOYMENT_ARN: \${{ inputs.deployment_arn }}
+      EBK_DEPLOYMENT_COMMIT: \${{ inputs.deployment_commit }}
+      EBK_DEPLOYMENT_KIND: \${{ inputs.deployment_kind }}
+      EBK_DEPLOYMENT_RECEIPT_ARTIFACT_NAME: \${{ inputs.deployment_receipt_artifact_name }}
+      EBK_DEPLOY_RUN_ID: \${{ inputs.deploy_run_id }}
+      EBK_SLICE: \${{ inputs.slice }}
+      EBK_STAGE: \${{ inputs.stage }}
+      EBK_TASK_DEFINITION_FAMILY: \${{ inputs.task_definition_family }}
+      GH_REPO: \${{ github.repository }}
+      GH_TOKEN: \${{ github.token }}
+    steps:
+      - name: Validate exact postdeploy evidence authority
+        run: |
+          set -euo pipefail
+          case "$EBK_DEPLOYMENT_COMMIT" in ''|*[!0-9a-f]*) exit 1 ;; esac
+          { [ "\${#EBK_DEPLOYMENT_COMMIT}" -eq 40 ] || [ "\${#EBK_DEPLOYMENT_COMMIT}" -eq 64 ]; } || exit 1
+          case "$EBK_DEPLOY_RUN_ID" in ''|0|*[!0-9]*) exit 1 ;; esac
+          case "$EBK_SLICE" in ''|-*|*-|*[!a-z0-9-]*) exit 1 ;; esac
+          expected_branch=develop
+          if [ "$EBK_STAGE" = production ]; then expected_branch=main; fi
+          case "$EBK_STAGE:$expected_branch" in ${stageBranchCases}) ;;
+            *) echo 'ECR evidence stage is inactive for this deployment profile'; exit 1 ;;
+          esac
+          prefix="deployment-receipt-$EBK_STAGE-$EBK_DEPLOY_RUN_ID-"
+          case "$EBK_DEPLOYMENT_RECEIPT_ARTIFACT_NAME" in
+            "$prefix"*) attempt="\${EBK_DEPLOYMENT_RECEIPT_ARTIFACT_NAME#"$prefix"}" ;;
+            *) echo 'Deployment receipt artifact does not bind the exact Deploy run'; exit 1 ;;
+          esac
+          case "$attempt" in ''|0*|*[!0-9]*) exit 1 ;; esac
+          echo "EBK_DEPLOY_RUN_ATTEMPT=$attempt" >> "$GITHUB_ENV"
+          run="$(gh api "/repos/$GH_REPO/actions/runs/$EBK_DEPLOY_RUN_ID")"
+          [ "$(printf '%s' "$run" | jq -r .conclusion)" = success ] &&
+            [ "$(printf '%s' "$run" | jq -r .run_attempt)" = "$attempt" ] &&
+            [ "$(printf '%s' "$run" | jq -r .head_sha)" = "$EBK_DEPLOYMENT_COMMIT" ] &&
+            [ "$(printf '%s' "$run" | jq -r .head_branch)" = "$expected_branch" ] &&
+            [ "$(printf '%s' "$run" | jq -r .path)" = .github/workflows/deploy.yml ] || {
+              echo 'Deploy run is not the exact successful protected source authority'; exit 1;
+            }
+          artifacts="$(gh api "/repos/$GH_REPO/actions/runs/$EBK_DEPLOY_RUN_ID/artifacts?per_page=100")"
+          count="$(printf '%s' "$artifacts" | jq --arg name "$EBK_DEPLOYMENT_RECEIPT_ARTIFACT_NAME" \
+            '[.artifacts[] | select(.name == $name and .expired == false)] | length')"
+          [ "$count" = 1 ] || { echo 'Exact unexpired deployment receipt is absent or ambiguous'; exit 1; }
+      - uses: ${actionPins.checkout}
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: \${{ inputs.deployment_commit }}
+      - name: Restore exact deployment receipt and release binding
+        uses: ${actionPins.downloadArtifact}
+        with:
+          github-token: \${{ github.token }}
+          name: \${{ inputs.deployment_receipt_artifact_name }}
+          path: .
+          run-id: \${{ inputs.deploy_run_id }}
+      - id: candidate
+        name: Verify exact release-candidate artifact provenance
+        run: |
+          set -euo pipefail
+          binding=.ebk/evidence/deployment/postdeploy-supply-chain.json
+          test -f "$binding" || { echo 'Postdeploy release-candidate binding is absent'; exit 1; }
+          artifact_id="$(jq -r '.releaseCandidateArtifactId // empty' "$binding")"
+          artifact_digest="$(jq -r '.releaseCandidateArtifactDigest // empty' "$binding")"
+          candidate_source="$(jq -r '.releaseSourceCommit // empty' "$binding")"
+          producer_attempt="$(jq -r '.releaseCandidateProducerRunAttempt // empty' "$binding")"
+          producer_run_id="$(jq -r '.releaseCandidateProducerRunId // empty' "$binding")"
+          profile="$(jq -r '.profile // empty' "$binding")"
+          case "$artifact_id:$producer_attempt:$producer_run_id" in
+            *[!0-9:]*|:*|*:|*::*|0*:*|*:0*:*|*:0*) echo 'Candidate artifact provenance is malformed'; exit 1 ;;
+          esac
+          printf '%s' "$artifact_digest" | grep -Eq '^sha256:[0-9a-f]{64}$' || {
+            echo 'Candidate artifact digest is malformed'; exit 1;
+          }
+          case "$candidate_source" in ''|*[!0-9a-f]*) exit 1 ;; esac
+          { [ "\${#candidate_source}" -eq 40 ] || [ "\${#candidate_source}" -eq 64 ]; } || exit 1
+          expected_candidate_branch=develop
+          case "$profile:$EBK_STAGE" in
+            starter:production) expected_candidate_branch=main ;;
+            production-isolated:staging|production-isolated:production|fully-isolated:staging|fully-isolated:production) ;;
+            *) echo 'Candidate profile and protected ECR stage disagree'; exit 1 ;;
+          esac
+          artifact="$(gh api "/repos/$GH_REPO/actions/artifacts/$artifact_id")"
+          printf '%s' "$artifact" | jq -e \
+            --arg digest "$artifact_digest" \
+            --arg id "$artifact_id" \
+            --arg name "release-candidate-$candidate_source" \
+            --arg run "$producer_run_id" \
+            '(.id | tostring) == $id and .name == $name and .expired == false and .digest == $digest and (.workflow_run.id | tostring) == $run' \
+            >/dev/null || { echo 'Candidate artifact differs from the exact producer'; exit 1; }
+          producer="$(gh api "/repos/$GH_REPO/actions/runs/$producer_run_id")"
+          printf '%s' "$producer" | jq -e \
+            --arg attempt "$producer_attempt" \
+            --arg branch "$expected_candidate_branch" \
+            --arg run "$producer_run_id" \
+            --arg source "$candidate_source" \
+            '(.id | tostring) == $run and (.run_attempt | tostring) == $attempt and .head_sha == $source and .head_branch == $branch and .conclusion == "success" and .event == "push" and .path == ".github/workflows/ci.yml"' \
+            >/dev/null || { echo 'Candidate producer is not the exact successful protected CI run'; exit 1; }
+          echo "artifact_id=$artifact_id" >> "$GITHUB_OUTPUT"
+          echo "producer_run_id=$producer_run_id" >> "$GITHUB_OUTPUT"
+          echo "candidate_source=$candidate_source" >> "$GITHUB_OUTPUT"
+      - name: Require fresh original candidate destination
+        run: |
+          set -euo pipefail
+          test ! -e .ebk/evidence/ecr-original-release-candidate || {
+            echo 'Original candidate destination already exists'; exit 1;
+          }
+      - name: Download exact original release candidate
+        uses: ${actionPins.downloadArtifact}
+        with:
+          artifact-ids: \${{ steps.candidate.outputs.artifact_id }}
+          github-token: \${{ github.token }}
+          path: .ebk/evidence/ecr-original-release-candidate
+          run-id: \${{ steps.candidate.outputs.producer_run_id }}
+      - name: Verify downloaded release candidate identity
+        env:
+          EBK_CANDIDATE_SOURCE: \${{ steps.candidate.outputs.candidate_source }}
+          EBK_PRODUCER_RUN_ID: \${{ steps.candidate.outputs.producer_run_id }}
+        run: |
+          set -euo pipefail
+          candidate=.ebk/evidence/ecr-original-release-candidate/packages/$EBK_SLICE/candidate.json
+          test -f "$candidate" || { echo 'Exact Slice candidate is absent'; exit 1; }
+          jq -e \
+            --arg slice "$EBK_SLICE" \
+            --arg source "$EBK_CANDIDATE_SOURCE" \
+            --arg run "$EBK_PRODUCER_RUN_ID" \
+            '.kind == "ebk-release-candidate" and .schemaVersion == 1 and .slice == $slice and .sourceCommit == $source and (.provenance.runId | tostring) == $run' \
+            "$candidate" >/dev/null || { echo 'Downloaded candidate identity disagrees with its immutable artifact'; exit 1; }
+      - uses: ${actionPins.pnpmSetup}
+      - uses: ${actionPins.setupNode}
+        with:
+          node-version: ${nodeVersion}
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
+      - name: Verify managed workspace integrity before AWS authority
+        run: pnpm nx run ${name}:workspace-health
+      - name: Validate read-only evidence role configuration
+        run: |
+          set -euo pipefail
+          test -n "$AWS_EVIDENCE_ROLE_ARN" && test -n "$AWS_EXPECTED_ACCOUNT_ID" && test -n "$AWS_REGION"
+          case "$AWS_EVIDENCE_ROLE_ARN" in
+            arn:aws:iam::$AWS_EXPECTED_ACCOUNT_ID:role/*) ;;
+            *) echo 'ECR evidence role does not belong to the expected account'; exit 1 ;;
+          esac
+      - uses: ${actionPins.configureAwsCredentials}
+        with:
+          role-to-assume: \${{ secrets.AWS_ECR_INSPECTOR_EVIDENCE_ROLE_ARN }}
+          role-session-name: ebk-ecr-inspector-\${{ github.run_id }}-\${{ github.run_attempt }}
+          aws-region: \${{ vars.AWS_REGION }}
+      - name: Collect exact deployed OCI and Inspector evidence
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+          set -euo pipefail
+          [ "$(aws sts get-caller-identity --query Account --output text)" = "$AWS_EXPECTED_ACCOUNT_ID" ]
+          slice_root="packages/$EBK_SLICE"
+          test -d "$slice_root" || { echo 'Requested Product Slice is absent'; exit 1; }
+          input="$slice_root/.ebk/evidence/ecr-inspector-input.json"
+          EBK_COLLECTOR_INPUT="$input" node -e '
+            const { mkdirSync, writeFileSync } = require("node:fs");
+            const { dirname } = require("node:path");
+            const deployment = process.env.EBK_DEPLOYMENT_KIND === "service"
+              ? { clusterArn: process.env.EBK_CLUSTER_ARN, kind: "service", serviceArn: process.env.EBK_DEPLOYMENT_ARN }
+              : { clusterArn: process.env.EBK_CLUSTER_ARN, kind: "task", taskArn: process.env.EBK_DEPLOYMENT_ARN };
+            const record = {
+              accountId: process.env.AWS_EXPECTED_ACCOUNT_ID,
+              artifactId: process.env.EBK_ARTIFACT_ID,
+              deployment,
+              deployRunAttempt: process.env.EBK_DEPLOY_RUN_ATTEMPT,
+              deployRunId: process.env.EBK_DEPLOY_RUN_ID,
+              deploymentReceiptPath: "../../.ebk/evidence/deployment/latest.json",
+              outputDirectory: ".ebk/evidence/supply-chain/ecr-scans",
+              postdeployBindingPath: "../../.ebk/evidence/deployment/postdeploy-supply-chain.json",
+              region: process.env.AWS_REGION,
+              releaseCandidatePath: "../../.ebk/evidence/ecr-original-release-candidate/packages/" + process.env.EBK_SLICE + "/candidate.json",
+              schemaVersion: 1,
+              stage: process.env.EBK_STAGE,
+              taskDefinitionFamily: process.env.EBK_TASK_DEFINITION_FAMILY,
+            };
+            mkdirSync(dirname(process.env.EBK_COLLECTOR_INPUT), { recursive: true, mode: 0o700 });
+            writeFileSync(process.env.EBK_COLLECTOR_INPUT, JSON.stringify(record, null, 2) + "\\n", { flag: "wx", mode: 0o600 });
+          '
+          export EBK_ECR_SCAN_INPUT_PATH=.ebk/evidence/ecr-inspector-input.json
+          pnpm nx run "$EBK_SLICE:ecr-inspector-collect"
+      - name: Clear current ECR evidence authority
+        if: always()
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+          unset AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY AWS_SESSION_TOKEN AWS_SECURITY_TOKEN
+          echo 'AWS_ACCESS_KEY_ID=' >> "$GITHUB_ENV"
+          echo 'AWS_SECRET_ACCESS_KEY=' >> "$GITHUB_ENV"
+          echo 'AWS_SESSION_TOKEN=' >> "$GITHUB_ENV"
+          echo 'AWS_SECURITY_TOKEN=' >> "$GITHUB_ENV"
+      - name: Retain exact deployed OCI and Inspector evidence
+        if: always()
+        uses: ${actionPins.uploadArtifact}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          AWS_ACCESS_KEY_ID: ''
+          AWS_SECRET_ACCESS_KEY: ''
+          AWS_SESSION_TOKEN: ''
+        with:
+          name: ecr-inspector-\${{ inputs.stage }}-\${{ inputs.slice }}-\${{ github.run_id }}-\${{ github.run_attempt }}
+          if-no-files-found: error
+          include-hidden-files: true
+          retention-days: 90
+          path: |
+            packages/\${{ inputs.slice }}/.ebk/evidence/ecr-inspector-input.json
+            packages/\${{ inputs.slice }}/.ebk/evidence/supply-chain/ecr-scans/**
+`,
+    };
+}
+//# sourceMappingURL=workspace-files-ecr-inspector.js.map

package/src/generators/preset/workspace-files-foundation-workload-roles.js

@@ -229,6 +229,7 @@ export async function reportWorkloadRoleCandidate(options: {
 import { GetParameterCommand, SSMClient } from '@aws-sdk/client-ssm';
 import { GetCallerIdentityCommand, STSClient } from '@aws-sdk/client-sts';
 import {
+  areWorkloadRoleIntentsEquivalent,
   digestWorkloadRoleManifest,
   provisionedWorkloadRoleRegistrationObjectKey,
   registeredWorkloadRoleManifestObjectKey,
@@ -360,8 +361,10 @@ export async function preflightFoundationWorkloadRoles(stage: string) {
     digestWorkloadRoleManifest(recreated.manifest) !==
       registered.manifestDigest ||
     registered.manifestDigest !== storage.manifestDigest ||
-    JSON.stringify(recreated.intentsByRole) !==
-      JSON.stringify(registered.intentsByRole)
+    !areWorkloadRoleIntentsEquivalent(
+      recreated.intentsByRole,
+      registered.intentsByRole,
+    )
   ) {
     throw new Error(
       'Foundation workload-role registration differs from generated intent.',

package/src/generators/preset/workspace-files-performance-cost.d.ts

@@ -55,12 +55,12 @@ export declare function validateProtectedAggregateCountSourceAuthority(input: Pr
     artifactName: string;
     runAttempt: string;
 }>;
-export declare function renderProtectedAggregateCountWorkflow(): Readonly<Record<typeof PROTECTED_AGGREGATE_COUNT_WORKFLOW_PATH, string>>;
+export declare function renderProtectedAggregateCountWorkflow(rehearsalStage?: 'development' | 'staging'): Readonly<Record<typeof PROTECTED_AGGREGATE_COUNT_WORKFLOW_PATH, string>>;
 /**
  * Treats caller-supplied run IDs and artifact names only as selectors. The
  * selected producer runs and artifacts must independently match the fixed
  * protected workflow contracts before AWS authority is introduced.
  */
 export declare function validateProtectedPerformanceCostSourceAuthority(input: ProtectedPerformanceCostSourceAuthority): void;
-export declare function renderProtectedPerformanceCostWorkflow(): Readonly<Record<typeof PROTECTED_PERFORMANCE_COST_WORKFLOW_PATH, string>>;
+export declare function renderProtectedPerformanceCostWorkflow(rehearsalStage?: 'development' | 'staging'): Readonly<Record<typeof PROTECTED_PERFORMANCE_COST_WORKFLOW_PATH, string>>;
 export {};

package/src/generators/preset/workspace-files-performance-cost.js

@@ -20,7 +20,7 @@ function validateProtectedAggregateCountSourceAuthority(input) {
     const refuse = (detail) => {
         throw new Error(`Protected aggregate-count source authority is invalid: ${detail}.`);
     };
-    const branch = input.stage === 'staging'
+    const branch = input.stage === 'development' || input.stage === 'staging'
         ? 'develop'
         : input.stage === 'production'
             ? 'main'
@@ -61,7 +61,7 @@ function validateProtectedAggregateCountSourceAuthority(input) {
     }
     return Object.freeze({ artifactName, runAttempt });
 }
-function renderProtectedAggregateCountWorkflow() {
+function renderProtectedAggregateCountWorkflow(rehearsalStage = 'staging') {
     const checkout = (0, index_js_1.pinnedAction)(index_js_1.GITHUB_ACTION_PINS.checkout);
     const configureAws = (0, index_js_1.pinnedAction)(index_js_1.GITHUB_ACTION_PINS.configureAwsCredentials);
     const downloadArtifact = (0, index_js_1.pinnedAction)(index_js_1.GITHUB_ACTION_PINS.downloadArtifact);
@@ -79,7 +79,7 @@ on:
         description: Exact protected aggregate cohort stage
         required: true
         type: choice
-        options: [staging, production]
+        options: [${rehearsalStage}, production]
       project:
         description: Exact Product Slice project
         required: true
@@ -137,7 +137,7 @@ jobs:
         run: |
           set -euo pipefail
           case "$EBK_STAGE:$EBK_PROTECTED_REF" in
-            staging:refs/heads/develop|production:refs/heads/main) ;;
+            ${rehearsalStage}:refs/heads/develop|production:refs/heads/main) ;;
             *) echo 'Aggregate stage does not match its protected branch'; exit 1 ;;
           esac
           case "$EBK_PROJECT" in
@@ -334,7 +334,7 @@ function validateProtectedPerformanceCostSourceAuthority(input) {
     const refuse = (detail) => {
         throw new Error(`Protected cost source authority is invalid: ${detail}.`);
     };
-    const branch = input.stage === 'staging'
+    const branch = input.stage === 'development' || input.stage === 'staging'
         ? 'develop'
         : input.stage === 'production'
             ? 'main'
@@ -399,7 +399,7 @@ function validateProtectedPerformanceCostSourceAuthority(input) {
     validateArtifact(input.aggregateArtifacts, input.aggregateArtifactTotal, input.aggregateArtifactName, expectedAggregateName, 'aggregate-count');
     validateArtifact(input.releaseArtifacts, input.releaseArtifactTotal, input.releaseArtifactName, expectedReleaseName, 'release');
 }
-function renderProtectedPerformanceCostWorkflow() {
+function renderProtectedPerformanceCostWorkflow(rehearsalStage = 'staging') {
     const checkout = (0, index_js_1.pinnedAction)(index_js_1.GITHUB_ACTION_PINS.checkout);
     const configureAws = (0, index_js_1.pinnedAction)(index_js_1.GITHUB_ACTION_PINS.configureAwsCredentials);
     const downloadArtifact = (0, index_js_1.pinnedAction)(index_js_1.GITHUB_ACTION_PINS.downloadArtifact);
@@ -417,7 +417,7 @@ on:
         description: Exact protected billing cohort stage
         required: true
         type: choice
-        options: [staging, production]
+        options: [${rehearsalStage}, production]
       project:
         description: Exact Product Slice project
         required: true
@@ -511,7 +511,7 @@ jobs:
         run: |
           set -euo pipefail
           case "$EBK_STAGE:$EBK_PROTECTED_REF" in
-            staging:refs/heads/develop|production:refs/heads/main) ;;
+            ${rehearsalStage}:refs/heads/develop|production:refs/heads/main) ;;
             *) echo 'Cost collection stage does not match its protected branch'; exit 1 ;;
           esac
           case "$EBK_PROJECT" in

package/src/generators/preset/workspace-files-performance-load.d.ts

@@ -70,4 +70,4 @@ export declare function createProtectedPerformanceLoadSliceTargets(slice: string
  * The caller merges the returned fixed Slice targets into generated project
  * metadata; neither target forwards user-supplied commands or arguments.
  */
-export declare function renderProtectedPerformanceLoadWorkflowPlan(sliceForTargetMetadata: string): ProtectedPerformanceLoadWorkflowPlan;
+export declare function renderProtectedPerformanceLoadWorkflowPlan(sliceForTargetMetadata: string, rehearsalStage?: 'development' | 'staging'): ProtectedPerformanceLoadWorkflowPlan;

package/src/generators/preset/workspace-files-performance-load.js

@@ -81,7 +81,7 @@ function deriveProtectedPerformanceEndpoint(input) {
     const refuse = (detail) => {
         throw new Error(`Protected performance target authority is invalid: ${detail}.`);
     };
-    const expectedRef = input.stage === 'staging'
+    const expectedRef = input.stage === 'development' || input.stage === 'staging'
         ? 'refs/heads/develop'
         : input.stage === 'production'
             ? 'refs/heads/main'
@@ -170,6 +170,14 @@ function deriveProtectedPerformanceEndpoint(input) {
             suffix: '/__ebk/performance/async-worker',
             workload: 'async-worker',
         },
+        'async-key-value-burst': {
+            suffix: '/__ebk/performance/async-worker',
+            workload: 'async-worker',
+        },
+        'database-read-write': {
+            suffix: '/__ebk/performance/database',
+            workload: 'database',
+        },
         'database-cold-resume': {
             suffix: '/__ebk/performance/database',
             workload: 'database',
@@ -344,7 +352,7 @@ function createProtectedPerformanceLoadSliceTargets(slice) {
  * The caller merges the returned fixed Slice targets into generated project
  * metadata; neither target forwards user-supplied commands or arguments.
  */
-function renderProtectedPerformanceLoadWorkflowPlan(sliceForTargetMetadata) {
+function renderProtectedPerformanceLoadWorkflowPlan(sliceForTargetMetadata, rehearsalStage = 'staging') {
     const checkout = (0, index_js_1.pinnedAction)(index_js_1.GITHUB_ACTION_PINS.checkout);
     const configureAws = (0, index_js_1.pinnedAction)(index_js_1.GITHUB_ACTION_PINS.configureAwsCredentials);
     const pnpmSetup = (0, index_js_1.pinnedAction)(index_js_1.GITHUB_ACTION_PINS.pnpmSetup);
@@ -362,11 +370,11 @@ on:
   workflow_dispatch:
     inputs:
       stage:
-        description: Protected target stage; staging is the normal path
+        description: Protected target stage; ${rehearsalStage} is the rehearsal path
         required: true
-        default: staging
+        default: ${rehearsalStage}
         type: choice
-        options: [staging, production]
+        options: [${rehearsalStage}, production]
       project:
         description: Exact Product Slice project
         required: true
@@ -414,7 +422,6 @@ jobs:
       EBK_ACCOUNT_FINGERPRINT: \${{ inputs.target_account_fingerprint }}
       EBK_APPROVED_REGION: \${{ vars.AWS_REGION }}
       EBK_PERFORMANCE_ORIGINS_JSON: \${{ vars.EBK_PERFORMANCE_ORIGINS_JSON }}
-      EBK_PERFORMANCE_LOAD_HMAC_KEY_PATH: \${{ runner.temp }}/ebk-performance-load-hmac-\${{ github.run_id }}-\${{ github.run_attempt }}.json
       EBK_PROJECT: \${{ inputs.project }}
       EBK_PROTECTED_LOAD_APPROVAL_PATH: \${{ inputs.approval }}
       EBK_PROTECTED_LOAD_PLAN_PATH: \${{ inputs.plan }}
@@ -422,6 +429,8 @@ jobs:
       EBK_STAGE: \${{ inputs.stage }}
       NX_DAEMON: 'false'
     steps:
+      - name: Initialize private performance material path
+        run: echo "EBK_PERFORMANCE_LOAD_HMAC_KEY_PATH=$RUNNER_TEMP/ebk-performance-load-hmac-$GITHUB_RUN_ID-$GITHUB_RUN_ATTEMPT.json" >> "$GITHUB_ENV"
       - name: Validate exact protected request
         env:
           EBK_PROTECTED_REF: \${{ github.ref }}
@@ -429,7 +438,7 @@ jobs:
         run: |
           set -euo pipefail
           case "$EBK_STAGE:$EBK_PROTECTED_REF" in
-            staging:refs/heads/develop|production:refs/heads/main) ;;
+            ${rehearsalStage}:refs/heads/develop|production:refs/heads/main) ;;
             *) echo 'Performance load stage does not match its protected branch'; exit 1 ;;
           esac
           case "$EBK_PROJECT" in
@@ -556,6 +565,27 @@ jobs:
             { echo 'Assumed account fingerprint does not equal the reviewed target'; exit 1; }
           test "$AWS_REGION" = "$EBK_APPROVED_REGION" ||
             { echo 'Target Region does not equal the environment-approved Region'; exit 1; }
+          owner_parameter="/ebk/$EBK_STAGE/workspace-owner"
+          actual_owner="$(aws ssm get-parameter \
+            --name "$owner_parameter" \
+            --no-with-decryption \
+            --query 'Parameter.Value' \
+            --output text)" ||
+            { echo 'Performance load role requires ssm:GetParameter on the exact retained workspace owner'; exit 1; }
+          expected_owner="$(node -e '
+            const policy = require("./ebk.repository-policy.json");
+            process.stdout.write(JSON.stringify({
+              accountId: process.env.AWS_EXPECTED_ACCOUNT_ID,
+              kind: "ebk-workspace-stage-owner",
+              region: process.env.AWS_REGION,
+              schemaVersion: 1,
+              stage: process.env.EBK_STAGE,
+              workspaceDeploymentId: policy.workspaceDeploymentId,
+            }));
+          ')" ||
+            { echo 'Committed workspace owner identity is invalid'; exit 1; }
+          test "$actual_owner" = "$expected_owner" ||
+            { echo 'Performance load target is owned by another workspace'; exit 1; }
           test -f "$EBK_PROTECTED_LOAD_PLAN_PATH" ||
             { echo 'Exact protected load plan is absent from the candidate'; exit 1; }
           test -f "$EBK_PROTECTED_LOAD_APPROVAL_PATH" ||
@@ -662,16 +692,12 @@ jobs:
         run: |
           set -euo pipefail
           logical_name="$(node -e '
-            const project = process.argv[1];
-            const logicalName =
-              project.split("-")
-                .map((part) => part[0].toUpperCase() + part.slice(1))
-                .join("") + "PerformanceLoadHmacKeys";
+            const logicalName = "GeneratedPerformanceLoadHmacKeys";
             if (!/^[A-Za-z][A-Za-z0-9]{0,63}$/.test(logicalName)) {
               process.exit(1);
             }
             process.stdout.write(logicalName);
-          ' "$EBK_PROJECT")" ||
+          ')" ||
             { echo 'Slice HMAC logical name is invalid'; exit 1; }
           secret_name="ebk/$EBK_STAGE/$EBK_PROJECT/$logical_name"
           aws secretsmanager get-secret-value \
@@ -722,18 +748,6 @@ jobs:
                 }
               });
             ' "$EBK_PERFORMANCE_LOAD_HMAC_KEY_PATH"
-      - name: Clear current performance-load AWS session credentials
-        if: always()
-        env:
-          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
-          ACTIONS_ID_TOKEN_REQUEST_URL: ''
-        run: |
-          {
-            echo 'AWS_ACCESS_KEY_ID='
-            echo 'AWS_SECRET_ACCESS_KEY='
-            echo 'AWS_SESSION_TOKEN='
-            echo 'AWS_SECURITY_TOKEN='
-          } >> "$GITHUB_ENV"
       - name: Guard and run the exact allowlisted load target
         env:
           ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''

package/src/generators/preset/workspace-files-shared-operation-claims.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Seeded shared-operation claim ledger. A claim is an ordinary EBK work marker
+ * (`EBK-TODO` with a `PLAN:shared-operation/<operation>` reference), so the
+ * existing work-markers scanner validates and reports open claims; no new
+ * enforcement exists, and the generated text must not imply one.
+ */
+export declare const SHARED_OPERATION_CLAIMS_PATH: "docs/shared-operation-claims.yaml";
+export declare const SHARED_OPERATIONS: readonly ["gateway-setup", "package-release", "candidate-adoption", "database-replacement", "development-deployment"];
+export declare const SHARED_OPERATION_CLAIM_PHASE: "shared-operation";
+export declare function renderSharedOperationClaims(workspaceName: string): string;

package/src/generators/preset/workspace-files-shared-operation-claims.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SHARED_OPERATION_CLAIM_PHASE = exports.SHARED_OPERATIONS = exports.SHARED_OPERATION_CLAIMS_PATH = void 0;
+exports.renderSharedOperationClaims = renderSharedOperationClaims;
+/**
+ * Seeded shared-operation claim ledger. A claim is an ordinary EBK work marker
+ * (`EBK-TODO` with a `PLAN:shared-operation/<operation>` reference), so the
+ * existing work-markers scanner validates and reports open claims; no new
+ * enforcement exists, and the generated text must not imply one.
+ */
+exports.SHARED_OPERATION_CLAIMS_PATH = 'docs/shared-operation-claims.yaml';
+exports.SHARED_OPERATIONS = [
+    'gateway-setup',
+    'package-release',
+    'candidate-adoption',
+    'database-replacement',
+    'development-deployment',
+];
+exports.SHARED_OPERATION_CLAIM_PHASE = 'shared-operation';
+function renderSharedOperationClaims(workspaceName) {
+    return `# Shared-operation claim ledger
+#
+# Seeded by Empire Builder Kit; this repository owns the file after
+# generation. It serializes shared operations that only one actor at a time
+# may run: ${exports.SHARED_OPERATIONS.slice(0, -1).join(', ')}, and
+# ${exports.SHARED_OPERATIONS.at(-1)}.
+#
+# Before starting one of them, an agent or a human:
+#
+# 1. reads the current copy of this file where the other actors record
+#    claims (for example the integration branch after a fetch) and looks for
+#    an open claim on the same operation;
+# 2. if one exists, stops and reports the conflict instead of running the
+#    operation; the claim's owner or a human coordinator resolves it;
+# 3. otherwise adds one claim line below and commits it where the other
+#    actors read this ledger before starting; and
+# 4. deletes its own claim line once the operation and its verification are
+#    complete.
+#
+# A claim is one full-line EBK work marker: kind EBK-TODO, reference
+# PLAN:${exports.SHARED_OPERATION_CLAIM_PHASE}/<operation>, where <operation> is one of
+# the five names above, and a self-contained description naming the actor,
+# the branch or worktree, the start time in UTC, and the exact target. Two
+# open claims with the same reference conflict. For example (prose, not a
+# claim):
+#
+#   Example: EBK-TODO(PLAN:${exports.SHARED_OPERATION_CLAIM_PHASE}/development-deployment): <actor> on <branch> since <UTC time>; deploying billing to development.
+#
+# Run \`pnpm nx run ${workspaceName}:work-markers\` to list open claims with
+# every other work marker and validate their syntax. Adding or removing a
+# claim changes the marker set, so a retained Developer-Agent handoff
+# reports the change on resume. Nothing enforces a claim: it is a
+# convention the actors follow, and it is only as current as the copy they
+# read.
+#
+# Open claims:
+`;
+}
+//# sourceMappingURL=workspace-files-shared-operation-claims.js.map

package/src/generators/preset/workspace-files-stage-authority.d.ts

@@ -0,0 +1,6 @@
+import type { DeploymentProfile } from '../../repository-policy/index.js';
+export declare function renderStageAuthorityWorkspaceFiles(options: {
+    deploymentProfile: DeploymentProfile;
+    name: string;
+    workspaceDeploymentId: string;
+}): Readonly<Record<string, string>>;