@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/generators/preset/workspace-files-thin-deploy.js

@@ -0,0 +1,2507 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EBK_RECORD_MAIN_TOKEN_SECRET = exports.THIN_DEPLOY_WORKFLOW_PATH = void 0;
+exports.renderThinDeployVerifyCaller = renderThinDeployVerifyCaller;
+exports.protectedBrowserInstallScript = protectedBrowserInstallScript;
+exports.machineCredentialRequestScript = machineCredentialRequestScript;
+exports.exactStageDeployerGuardScript = exactStageDeployerGuardScript;
+exports.canonicalStageAuthorityDerivationScript = canonicalStageAuthorityDerivationScript;
+exports.exactStagingPromotionPullGuardScript = exactStagingPromotionPullGuardScript;
+exports.stagingPromotionReceiptValidationScript = stagingPromotionReceiptValidationScript;
+exports.restoredCandidateValidationScript = restoredCandidateValidationScript;
+exports.stagingPromotionSealScript = stagingPromotionSealScript;
+exports.postdeploySupplyChainBindingScript = postdeploySupplyChainBindingScript;
+exports.renderThinDeployWorkflowFilePlan = renderThinDeployWorkflowFilePlan;
+exports.THIN_DEPLOY_WORKFLOW_PATH = '.github/workflows/deploy.yml';
+/** The production environment secret that lets record-main fast-forward main. */
+exports.EBK_RECORD_MAIN_TOKEN_SECRET = 'EBK_RECORD_MAIN_TOKEN';
+const EXACT_SEMVER = /^\d+\.\d+\.\d+$/;
+const WORKSPACE_NAME = /^[a-z0-9][a-z0-9-]{0,62}$/;
+const ACTION_PIN = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+@[a-f0-9]{40}(?: # [^\r\n]+)?$/;
+function assertOptions(options) {
+    if (options.productionApprovalMode === 'trunk-promotion' &&
+        (options.deploymentProfile === 'starter' ||
+            options.deliveryLane === 'trunk')) {
+        throw new Error('trunk-promotion requires an isolated deployment profile on the protected pair.');
+    }
+    if (!WORKSPACE_NAME.test(options.name)) {
+        throw new Error('Workspace name must be a bounded lowercase slug.');
+    }
+    for (const [name, value] of Object.entries(options.actionPins)) {
+        if (!ACTION_PIN.test(value)) {
+            throw new Error(`${name} must be an exact 40-character action pin.`);
+        }
+    }
+    for (const [name, value] of Object.entries(options.toolVersions)) {
+        if (!EXACT_SEMVER.test(value)) {
+            throw new Error(`${name} must be an exact semantic version.`);
+        }
+    }
+}
+function workflowCallTrigger(profile, deliveryLane = 'protected-pair') {
+    return profile === 'starter' && deliveryLane !== 'trunk'
+        ? ''
+        : `  workflow_call:
+    inputs:
+      source_branch:
+        required: true
+        type: string
+      source_commit:
+        required: true
+        type: string
+      source_ref:
+        required: true
+        type: string
+      verify_run_attempt:
+        required: true
+        type: string
+      verify_run_id:
+        required: true
+        type: string
+`;
+}
+function renderThinDeployVerifyCaller(profile, deliveryLane = 'protected-pair', productionApprovalMode = 'promotion-pr') {
+    const trunk = deliveryLane === 'trunk';
+    if (profile === 'starter' && !trunk)
+        return '';
+    // GitHub validates every nested deploy.yml job against this caller's
+    // permissions on every event, so the ceiling must admit the managed
+    // rehearsal, which pushes its sealed receipt branch and opens the pull
+    // request with the workflow token (isolated profiles only).
+    const nestedWrite = profile !== 'starter';
+    // Trunk lane: every merged main push is a production delivery.
+    // Trunk promotion: production deploys from the develop run itself and
+    // record-main fast-forwards main afterwards, so a main push only verifies.
+    const protectedBranchCondition = trunk
+        ? "github.ref == 'refs/heads/main'"
+        : productionApprovalMode === 'trunk-promotion'
+            ? "github.ref == 'refs/heads/develop'"
+            : "(github.ref == 'refs/heads/develop' || github.ref == 'refs/heads/main')";
+    return `
+
+  deploy:
+    name: deploy exact verified source
+    needs: [acceptance, release-candidate]
+    if: >-
+      always() &&
+      github.event_name == 'push' &&
+      ${protectedBranchCondition} &&
+      needs.acceptance.result == 'success' &&
+      needs.acceptance.outputs.history_only != 'true' &&
+      (needs.release-candidate.result == 'success' ||
+      (github.ref == 'refs/heads/main' && needs.release-candidate.result == 'skipped'))
+    # Ceiling for the nested deploy.yml jobs; each nested job declares its
+    # own least-privilege set. Isolated profiles admit the rehearse job's
+    # receipt push and pull request (EBK-INT-2026-080).
+    permissions:
+      actions: read
+      contents: ${nestedWrite ? 'write' : 'read'}
+      id-token: write${nestedWrite ? '\n      pull-requests: write' : ''}
+    uses: ./.github/workflows/deploy.yml
+    with:
+      source_branch: \${{ github.ref_name }}
+      source_commit: \${{ github.sha }}
+      source_ref: \${{ github.ref }}
+      verify_run_attempt: \${{ github.run_attempt }}
+      verify_run_id: \${{ github.run_id }}
+    # The reusable workflow reads the production environment secret
+    # AWS_STAGING_PROMOTION_PULL_ROLE_ARN, which only reaches a called
+    # workflow when the caller inherits secrets (EBK-INT-2026-075).
+    secrets: inherit`;
+}
+function indentedScript(source, spaces) {
+    const prefix = ' '.repeat(spaces);
+    return source
+        .trim()
+        .split('\n')
+        .map((line) => `${prefix}${line}`)
+        .join('\n');
+}
+/** @internal Run exactly this generated script in the protected-runner fixture. */
+function protectedBrowserInstallScript() {
+    return `set -euo pipefail
+if [ -z "$EBK_SLICE_PROJECTS" ]; then exit 0; fi
+case "$EBK_SLICE_PROJECTS" in ,*|*,|*,,*) echo 'Invalid smoke project inventory'; exit 1 ;; esac
+IFS=',' read -r -a projects <<< "$EBK_SLICE_PROJECTS"
+seen=,
+for project in "\${projects[@]}"; do
+  case "$project" in ''|*[!A-Za-z0-9_-]*) echo 'Invalid smoke project'; exit 1 ;; esac
+  case "$seen" in *,"$project",*) echo 'Duplicate smoke project'; exit 1 ;; esac
+  seen="$seen$project,"
+done
+for project in "\${projects[@]}"; do
+  pnpm --dir "packages/$project" exec playwright install --with-deps chromium
+done`;
+}
+/**
+ * @internal Run exactly this generated script in the protected-runner fixture.
+ *
+ * Reads the deploying stage's GitHub environment variables through request
+ * names and exports the canonical machine-credential variables only when they
+ * are set. An unset GitHub variable expands to '', which the generated Slice
+ * SST config would read as a generation rather than its blue-1 default, so the
+ * canonical names never reach the lifecycle when the request is empty.
+ */
+function machineCredentialRequestScript() {
+    return `set -euo pipefail
+generation="$EBK_REQUESTED_MACHINE_CREDENTIAL_GENERATION"
+retire="$EBK_REQUESTED_MACHINE_RETIRE_PREVIOUS_GENERATION"
+generation_pattern='^(blue|green)-[1-9][0-9]{0,11}$'
+if [ -n "$generation" ] && ! [[ "$generation" =~ $generation_pattern ]]; then
+  echo 'EBK_MACHINE_CREDENTIAL_GENERATION must be blue-N or green-N, where N is 1 to 12 digits without a leading zero, or unset'
+  exit 1
+fi
+case "$retire" in
+  ''|false|true) ;;
+  *) echo 'EBK_MACHINE_RETIRE_PREVIOUS_GENERATION must be exactly true or false, or unset'; exit 1 ;;
+esac
+if [ "$retire" = true ]; then
+  [ -n "$generation" ] || {
+    echo 'Retiring the previous machine credential generation requires EBK_MACHINE_CREDENTIAL_GENERATION to name the current generation'
+    exit 1
+  }
+  if [ "$EBK_ACTION" = deploy ] && [ "$EBK_LIFECYCLE_SCOPE" != full ]; then
+    echo 'Retiring the previous machine credential generation requires a Deploy dispatch with lifecycle full; affected scope can skip the Slice'
+    exit 1
+  fi
+fi
+if [ -n "$generation" ]; then
+  echo "EBK_MACHINE_CREDENTIAL_GENERATION=$generation" >> "$GITHUB_ENV"
+  echo "Requested machine credential generation: $generation"
+fi
+if [ "$retire" = true ]; then
+  echo 'EBK_MACHINE_RETIRE_PREVIOUS_GENERATION=true' >> "$GITHUB_ENV"
+  echo 'Requested retirement of the previous machine credential generation'
+fi`;
+}
+function machineCredentialRequestStep() {
+    return `      - name: Validate requested machine credential generation
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_REQUESTED_MACHINE_CREDENTIAL_GENERATION: \${{ vars.EBK_MACHINE_CREDENTIAL_GENERATION }}
+          EBK_REQUESTED_MACHINE_RETIRE_PREVIOUS_GENERATION: \${{ vars.EBK_MACHINE_RETIRE_PREVIOUS_GENERATION }}
+        run: |
+${indentedScript(machineCredentialRequestScript(), 10)}`;
+}
+/** @internal Exported for executable source-contract tests. */
+function exactStageDeployerGuardScript(operation, accountVariable) {
+    return `read -r caller_account caller_arn <<< "$(aws sts get-caller-identity --query '[Account,Arn]' --output text)"
+[ "$caller_account" = "${accountVariable}" ] || {
+  echo '${operation} caller account differs from committed policy'; exit 1;
+}
+caller_partition="\${caller_arn#arn:}"
+caller_partition="\${caller_partition%%:*}"
+[ "$caller_partition" = "$AWS_PARTITION" ] || {
+  echo '${operation} caller partition differs from committed policy'; exit 1;
+}
+expected_role_arn="arn:$AWS_PARTITION:iam::${accountVariable}:role/ebk/$EBK_STAGE/deployment/ebk-$EBK_STAGE-deploy"
+[ "$AWS_DEPLOY_ROLE_ARN" = "$expected_role_arn" ] || {
+  echo '${operation} configured role is not the canonical stage deployer'; exit 1;
+}
+expected_caller_prefix="arn:$AWS_PARTITION:sts::${accountVariable}:assumed-role/ebk-$EBK_STAGE-deploy/"
+case "$caller_arn" in
+  "$expected_caller_prefix"?*) ;;
+  *) echo '${operation} caller is not the exact stage deployer'; exit 1 ;;
+esac`;
+}
+/** @internal Shared verbatim by every generated protected workflow. */
+function canonicalStageAuthorityDerivationScript() {
+    return `case "$EBK_STAGE" in
+  development) account_id="$EBK_DEVELOPMENT_ACCOUNT" ;;
+  staging) account_id="$EBK_STAGING_ACCOUNT" ;;
+  production) account_id="$EBK_PRODUCTION_ACCOUNT" ;;
+  *) exit 1 ;;
+esac
+case "$account_id" in *[!0-9]*|'') exit 1 ;; esac
+[ "\${#account_id}" -eq 12 ]
+case "$EBK_REGION" in
+  cn-*) partition=aws-cn; audience=sts.amazonaws.com.cn ;;
+  us-gov-*) partition=aws-us-gov; audience=sts.amazonaws.com ;;
+  us-iso-*|us-isob-*|eu-isoe-*|us-isof-*)
+    echo 'The committed Region belongs to an unsupported AWS partition.' >&2
+    exit 1
+    ;;
+  *) partition=aws; audience=sts.amazonaws.com ;;
+esac
+role_arn="arn:$partition:iam::$account_id:role/ebk/$EBK_STAGE/deployment/ebk-$EBK_STAGE-deploy"
+echo "account_id=$account_id" >> "$GITHUB_OUTPUT"
+echo "audience=$audience" >> "$GITHUB_OUTPUT"
+echo "partition=$partition" >> "$GITHUB_OUTPUT"
+echo "role_arn=$role_arn" >> "$GITHUB_OUTPUT"`;
+}
+/** @internal Exported for executable source-contract tests. */
+function exactStagingPromotionPullGuardScript() {
+    return `read -r caller_account caller_arn <<< "$(aws sts get-caller-identity --query '[Account,Arn]' --output text)"
+[ "$caller_account" = "$EBK_STAGING_ACCOUNT_ID" ] || {
+  echo 'Staging registry caller account differs from committed policy'; exit 1;
+}
+caller_partition="\${caller_arn#arn:}"
+caller_partition="\${caller_partition%%:*}"
+[ "$caller_partition" = "$AWS_PARTITION" ] || {
+  echo 'Staging registry caller partition differs from committed policy'; exit 1;
+}
+expected_role_arn="arn:$AWS_PARTITION:iam::$EBK_STAGING_ACCOUNT_ID:role/ebk/promotion/ebk-staging-promotion-pull"
+[ "$AWS_STAGING_PROMOTION_PULL_ROLE_ARN" = "$expected_role_arn" ] || {
+  echo 'Staging registry configured role is not the canonical promotion pull role'; exit 1;
+}
+expected_caller_prefix="arn:$AWS_PARTITION:sts::$EBK_STAGING_ACCOUNT_ID:assumed-role/ebk-staging-promotion-pull/"
+case "$caller_arn" in
+  "$expected_caller_prefix"?*) ;;
+  *) echo 'Staging registry caller is not the exact promotion pull role'; exit 1 ;;
+esac`;
+}
+/** @internal Shared verbatim with the generated workflow and executable tests. */
+function stagingPromotionReceiptValidationScript() {
+    return `import { createHash } from 'node:crypto';
+import { appendFileSync, readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const commit = /^[a-f0-9]{40,64}$/;
+const integer = /^[1-9][0-9]*$/;
+const digest = /^sha256:[a-f0-9]{64}$/;
+const required = (name, pattern) => {
+  const value = process.env[name]?.trim() ?? '';
+  if (!pattern.test(value)) throw new Error(name + ' is absent or malformed.');
+  return value;
+};
+const root = process.env.EBK_STAGING_RECEIPT_ROOT?.trim() ?? '';
+if (!root) throw new Error('Staging deployment receipt root is absent.');
+const expectedHasSlices = required('EBK_EXPECTED_HAS_SLICES', /^(?:true|false)$/) === 'true';
+const expectedHasContainers = required('EBK_EXPECTED_HAS_CONTAINERS', /^(?:true|false)$/) === 'true';
+if (expectedHasContainers && !expectedHasSlices) throw new Error('Container work requires a selected Slice.');
+const sourceCommit = required('EBK_STAGING_SOURCE_COMMIT', commit);
+const expectedAccount = required('EBK_EXPECTED_STAGING_ACCOUNT_ID', /^[0-9]{12}$/);
+const expectedProfile = required('EBK_EXPECTED_DEPLOYMENT_PROFILE', /^(?:production-isolated|fully-isolated)$/);
+const expectedRegion = required('EBK_EXPECTED_DEPLOYMENT_REGION', /^[a-z]{2}(?:-gov)?-[a-z]+(?:-[a-z]+)*-[0-9]$/);
+const deploymentRunId = required('EBK_STAGING_DEPLOYMENT_RUN_ID', integer);
+const deploymentRunAttempt = required('EBK_STAGING_DEPLOYMENT_RUN_ATTEMPT', integer);
+const receiptArtifactId = required('EBK_STAGING_RECEIPT_ARTIFACT_ID', integer);
+const receiptArtifactDigest = required('EBK_STAGING_RECEIPT_ARTIFACT_DIGEST', digest);
+const receiptBytes = readFileSync(join(root, 'latest.json'));
+const promotionBytes = readFileSync(join(root, 'promotion.json'));
+const receipt = JSON.parse(receiptBytes.toString('utf8'));
+const promotion = JSON.parse(promotionBytes.toString('utf8'));
+const receiptDigest = createHash('sha256').update(receiptBytes).digest('hex');
+if (
+  receipt?.kind !== 'ebk-deployment-receipt' ||
+  receipt.schemaVersion !== 1 ||
+  receipt.outcome !== 'succeeded' ||
+  receipt.authority !== 'github' ||
+  receipt.stage !== 'staging' ||
+  receipt.account !== expectedAccount ||
+  receipt.profile !== expectedProfile ||
+  receipt.region !== expectedRegion ||
+  receipt.source?.clean !== true ||
+  receipt.source?.commit !== sourceCommit ||
+  promotion?.kind !== 'ebk-staging-deployment-promotion' ||
+  promotion.schemaVersion !== 1 ||
+  promotion.hasSlices !== expectedHasSlices ||
+  typeof promotion.hasContainers !== 'boolean' ||
+  (promotion.hasContainers && !promotion.hasSlices) ||
+  (expectedHasContainers && !promotion.hasContainers) ||
+  promotion.stage !== 'staging' ||
+  promotion.account !== expectedAccount ||
+  promotion.deploymentProfile !== expectedProfile ||
+  promotion.region !== expectedRegion ||
+  promotion.sourceCommit !== sourceCommit ||
+  promotion.deployment?.runId !== deploymentRunId ||
+  promotion.deployment?.runAttempt !== deploymentRunAttempt ||
+  promotion.deployment?.receiptDigest !== receiptDigest ||
+  (expectedHasSlices
+    ? !integer.test(promotion.candidate?.artifactId ?? '') ||
+      !digest.test(promotion.candidate?.artifactDigest ?? '') ||
+      !integer.test(promotion.candidate?.producerRunId ?? '') ||
+      !integer.test(promotion.candidate?.producerRunAttempt ?? '') ||
+      promotion.candidate?.sourceCommit !== sourceCommit ||
+      !/^[a-f0-9]{64}$/.test(promotion.candidate?.materialDigest ?? '')
+    : promotion.candidate !== null) ||
+  (promotion.hasContainers
+    ? !integer.test(promotion.container?.artifactId ?? '') ||
+      !digest.test(promotion.container?.artifactDigest ?? '')
+    : promotion.container !== null)
+) {
+  throw new Error('Staging deployment receipt and candidate promotion binding disagree.');
+}
+const outputs = {
+  deployment_run_attempt: deploymentRunAttempt,
+  deployment_run_id: deploymentRunId,
+  receipt_artifact_digest: receiptArtifactDigest,
+  receipt_artifact_id: receiptArtifactId,
+  source_commit: sourceCommit,
+};
+if (expectedHasSlices) Object.assign(outputs, {
+  artifact_digest: promotion.candidate.artifactDigest,
+  artifact_id: promotion.candidate.artifactId,
+  candidate_material_digest: promotion.candidate.materialDigest,
+  producer_run_attempt: promotion.candidate.producerRunAttempt,
+  producer_run_id: promotion.candidate.producerRunId,
+});
+if (expectedHasContainers) Object.assign(outputs, {
+  container_artifact_digest: promotion.container.artifactDigest,
+  container_artifact_id: promotion.container.artifactId,
+});
+for (const [name, value] of Object.entries(outputs)) appendFileSync(process.env.GITHUB_OUTPUT, name + '=' + value + '\\n');`;
+}
+/** @internal Shared verbatim with the generated workflow and executable tests. */
+function restoredCandidateValidationScript() {
+    return `import { createHash } from 'node:crypto';
+import { readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+
+const root = '.ebk/evidence/release-candidate/packages';
+const sourceCommit = process.env.EBK_RELEASE_SOURCE_COMMIT?.trim() ?? '';
+const producerRunId = process.env.EBK_CANDIDATE_PRODUCER_RUN_ID?.trim() ?? '';
+const producerRunAttempt = process.env.EBK_CANDIDATE_PRODUCER_RUN_ATTEMPT?.trim() ?? '';
+const expected = process.env.EBK_CANDIDATE_MATERIAL_DIGEST?.trim() ?? '';
+if (!/^[a-f0-9]{40,64}$/.test(sourceCommit) || !/^[1-9][0-9]*$/.test(producerRunId) || !/^[1-9][0-9]*$/.test(producerRunAttempt) || !/^[a-f0-9]{64}$/.test(expected)) {
+  throw new Error('Restored candidate authority is absent or malformed.');
+}
+const projects = readdirSync(root, { withFileTypes: true })
+  .filter((entry) => entry.isDirectory())
+  .map((entry) => entry.name)
+  .sort();
+if (projects.length === 0 || projects.some((project) => !/^[a-z0-9][a-z0-9-]{0,62}$/.test(project))) {
+  throw new Error('Restored candidate project inventory is absent or malformed.');
+}
+const entries = projects.map((project) => {
+  const bytes = readFileSync(join(root, project, 'candidate.json'));
+  const value = JSON.parse(bytes.toString('utf8'));
+  if (
+    value?.kind !== 'ebk-release-candidate' ||
+    value.schemaVersion !== 1 ||
+    value.slice !== project ||
+    value.sourceCommit !== sourceCommit ||
+    value.provenance?.runId !== producerRunId ||
+    value.provenance?.runAttempt !== producerRunAttempt
+  ) throw new Error('Restored candidate provenance is stale or cross-paired.');
+  return { manifestDigest: createHash('sha256').update(bytes).digest('hex'), project };
+});
+const observed = createHash('sha256').update(JSON.stringify(entries)).digest('hex');
+if (observed !== expected) throw new Error('Restored candidate material digest differs from staging.');`;
+}
+/** @internal Shared verbatim with the generated workflow and executable tests. */
+function stagingPromotionSealScript() {
+    return `import { createHash } from 'node:crypto';
+import { mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const required = (name, pattern) => {
+  const value = process.env[name]?.trim() ?? '';
+  if (!pattern.test(value)) throw new Error(name + ' is absent or malformed.');
+  return value;
+};
+const sourceCommit = required('EBK_RELEASE_SOURCE_COMMIT', /^[a-f0-9]{40,64}$/);
+const hasSlices = required('EBK_HAS_SLICES', /^(?:true|false)$/) === 'true';
+const hasContainers = required('EBK_HAS_CONTAINERS', /^(?:true|false)$/) === 'true';
+if (hasContainers && !hasSlices) throw new Error('Container work requires a selected Slice.');
+const account = required('EBK_POLICY_ACCOUNT_ID', /^[0-9]{12}$/);
+const deploymentProfile = required('EBK_DEPLOYMENT_PROFILE', /^(?:production-isolated|fully-isolated)$/);
+const region = required('EBK_POLICY_REGION', /^[a-z]{2}(?:-gov)?-[a-z]+(?:-[a-z]+)*-[0-9]$/);
+const deploymentRunId = required('GITHUB_RUN_ID', /^[1-9][0-9]*$/);
+const deploymentRunAttempt = required('GITHUB_RUN_ATTEMPT', /^[1-9][0-9]*$/);
+const receiptPath = '.ebk/evidence/deployment/latest.json';
+const receiptBytes = readFileSync(receiptPath);
+const receipt = JSON.parse(receiptBytes.toString('utf8'));
+if (receipt?.kind !== 'ebk-deployment-receipt' || receipt.schemaVersion !== 1 || receipt.outcome !== 'succeeded' || receipt.authority !== 'github' || receipt.stage !== 'staging' || receipt.account !== account || receipt.profile !== deploymentProfile || receipt.region !== region || receipt.source?.clean !== true || receipt.source?.commit !== sourceCommit) {
+  throw new Error('Successful staging deployment receipt is absent or stale.');
+}
+const candidateEnvironment = {
+  artifactDigest: process.env.EBK_CANDIDATE_ARTIFACT_DIGEST?.trim() ?? '',
+  artifactId: process.env.EBK_CANDIDATE_ARTIFACT_ID?.trim() ?? '',
+  producerRunAttempt: process.env.EBK_CANDIDATE_PRODUCER_RUN_ATTEMPT?.trim() ?? '',
+  producerRunId: process.env.EBK_CANDIDATE_PRODUCER_RUN_ID?.trim() ?? '',
+};
+const containerEnvironment = {
+  artifactDigest: process.env.EBK_CONTAINER_ARTIFACT_DIGEST?.trim() ?? '',
+  artifactId: process.env.EBK_CONTAINER_ARTIFACT_ID?.trim() ?? '',
+};
+let candidate = null;
+let container = null;
+if (hasSlices) {
+  const producerRunId = required('EBK_CANDIDATE_PRODUCER_RUN_ID', /^[1-9][0-9]*$/);
+  const producerRunAttempt = required('EBK_CANDIDATE_PRODUCER_RUN_ATTEMPT', /^[1-9][0-9]*$/);
+  const artifactId = required('EBK_CANDIDATE_ARTIFACT_ID', /^[1-9][0-9]*$/);
+  const artifactDigest = required('EBK_CANDIDATE_ARTIFACT_DIGEST', /^sha256:[a-f0-9]{64}$/);
+  const root = '.ebk/evidence/release-candidate/packages';
+  const projects = readdirSync(root, { withFileTypes: true })
+    .filter((entry) => entry.isDirectory())
+    .map((entry) => entry.name)
+    .sort();
+  if (projects.length === 0 || projects.some((project) => !/^[a-z0-9][a-z0-9-]{0,62}$/.test(project))) throw new Error('Staging candidate inventory is absent or malformed.');
+  const entries = projects.map((project) => {
+    const bytes = readFileSync(join(root, project, 'candidate.json'));
+    const value = JSON.parse(bytes.toString('utf8'));
+    if (value?.kind !== 'ebk-release-candidate' || value.schemaVersion !== 1 || value.slice !== project || value.sourceCommit !== sourceCommit || value.provenance?.runId !== producerRunId || value.provenance?.runAttempt !== producerRunAttempt) {
+      throw new Error('Staging candidate provenance is stale or cross-paired.');
+    }
+    return { manifestDigest: createHash('sha256').update(bytes).digest('hex'), project };
+  });
+  candidate = { artifactDigest, artifactId, materialDigest: createHash('sha256').update(JSON.stringify(entries)).digest('hex'), producerRunAttempt, producerRunId, sourceCommit };
+} else if (Object.values(candidateEnvironment).some(Boolean)) {
+  throw new Error('A staging promotion without Slices must not carry Slice release material.');
+}
+if (hasContainers) {
+  const artifactId = required('EBK_CONTAINER_ARTIFACT_ID', /^[1-9][0-9]*$/);
+  // The upload action returns bare hex; the artifacts API uses sha256:<hex>.
+  const raw = containerEnvironment.artifactDigest;
+  process.env.EBK_CONTAINER_ARTIFACT_DIGEST = /^[a-f0-9]{64}$/.test(raw) ? 'sha256:' + raw : raw;
+  const artifactDigest = required('EBK_CONTAINER_ARTIFACT_DIGEST', /^sha256:[a-f0-9]{64}$/);
+  container = { artifactDigest, artifactId };
+} else if (Object.values(containerEnvironment).some(Boolean)) {
+  throw new Error('A staging promotion without OCI artifacts must not carry container material.');
+}
+const promotion = {
+  account,
+  candidate,
+  container,
+  deploymentProfile,
+  deployment: { receiptDigest: createHash('sha256').update(receiptBytes).digest('hex'), runAttempt: deploymentRunAttempt, runId: deploymentRunId },
+  hasSlices,
+  hasContainers,
+  kind: 'ebk-staging-deployment-promotion',
+  region,
+  schemaVersion: 1,
+  sourceCommit,
+  stage: 'staging',
+};
+mkdirSync('.ebk/evidence/deployment', { recursive: true });
+writeFileSync('.ebk/evidence/deployment/promotion.json', JSON.stringify(promotion, null, 2) + '\\n', { mode: 0o600 });`;
+}
+/** @internal Shared verbatim with the generated workflow and executable tests. */
+function postdeploySupplyChainBindingScript() {
+    return `import { createHash } from 'node:crypto';
+import { mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+
+const required = (name, pattern) => {
+  const value = process.env[name]?.trim() ?? '';
+  if (!pattern.test(value)) throw new Error(name + ' is absent or malformed.');
+  return value;
+};
+const canonical = (value) => {
+  if (value === null || typeof value !== 'object') return JSON.stringify(value);
+  if (Array.isArray(value)) return '[' + value.map(canonical).join(',') + ']';
+  return '{' + Object.entries(value)
+    .sort(([left], [right]) => left < right ? -1 : left > right ? 1 : 0)
+    .map(([key, child]) => JSON.stringify(key) + ':' + canonical(child))
+    .join(',') + '}';
+};
+const accountId = required('EBK_POLICY_ACCOUNT_ID', /^[0-9]{12}$/);
+const deploymentCommit = required('EBK_SOURCE_COMMIT', /^[a-f0-9]{40,64}$/);
+const profile = required('EBK_DEPLOYMENT_PROFILE', /^(?:starter|production-isolated|fully-isolated)$/);
+const region = required('EBK_POLICY_REGION', /^[a-z]{2}(?:-gov)?-[a-z]+(?:-[a-z]+)*-[0-9]$/);
+const releaseCandidateArtifactDigest = required('EBK_CANDIDATE_ARTIFACT_DIGEST', /^sha256:[a-f0-9]{64}$/);
+const releaseCandidateArtifactId = required('EBK_CANDIDATE_ARTIFACT_ID', /^[1-9][0-9]*$/);
+const releaseCandidateProducerRunAttempt = required('EBK_CANDIDATE_PRODUCER_RUN_ATTEMPT', /^[1-9][0-9]*$/);
+const releaseCandidateProducerRunId = required('EBK_CANDIDATE_PRODUCER_RUN_ID', /^[1-9][0-9]*$/);
+const releaseSourceCommit = required('EBK_RELEASE_SOURCE_COMMIT', /^[a-f0-9]{40,64}$/);
+const runAttempt = required('GITHUB_RUN_ATTEMPT', /^[1-9][0-9]*$/);
+const runId = required('GITHUB_RUN_ID', /^[1-9][0-9]*$/);
+const stage = required('EBK_STAGE', /^(?:development|staging|production)$/);
+const receipt = JSON.parse(readFileSync('.ebk/evidence/deployment/latest.json', 'utf8'));
+if (
+  receipt?.kind !== 'ebk-deployment-receipt' ||
+  receipt.schemaVersion !== 1 ||
+  receipt.outcome !== 'succeeded' ||
+  receipt.authority !== 'github' ||
+  receipt.account !== accountId ||
+  receipt.profile !== profile ||
+  receipt.region !== region ||
+  receipt.stage !== stage ||
+  receipt.source?.clean !== true ||
+  receipt.source?.commit !== deploymentCommit
+) throw new Error('Successful deployment receipt is absent or cross-paired.');
+const unsigned = {
+  accountId,
+  deploymentCommit,
+  kind: 'ebk-postdeploy-supply-chain-binding',
+  profile,
+  region,
+  releaseCandidateArtifactDigest,
+  releaseCandidateArtifactId,
+  releaseCandidateProducerRunAttempt,
+  releaseCandidateProducerRunId,
+  releaseSourceCommit,
+  runAttempt,
+  runId,
+  schemaVersion: 1,
+  stage,
+};
+const binding = {
+  ...unsigned,
+  materialDigest: createHash('sha256').update(canonical(unsigned)).digest('hex'),
+};
+mkdirSync('.ebk/evidence/deployment', { recursive: true, mode: 0o700 });
+writeFileSync(
+  '.ebk/evidence/deployment/postdeploy-supply-chain.json',
+  JSON.stringify(binding, null, 2) + '\\n',
+  { flag: 'wx', mode: 0o600 },
+);`;
+}
+function renderThinDeployWorkflow(options) {
+    const { actionPins, deploymentProfile, name, toolVersions } = options;
+    const trunkPromotion = options.productionApprovalMode === 'trunk-promotion';
+    return `name: Deploy
+run-name: Deploy \${{ inputs.source_commit || github.sha }}
+
+on:
+${workflowCallTrigger(deploymentProfile, options.deliveryLane)}  workflow_dispatch:
+    inputs:
+      action:
+        description: Native lifecycle action
+        required: true
+        default: deploy
+        type: choice
+        options: [deploy, refresh, unlock, remove${deploymentProfile === 'starter' ? '' : ', rehearse'}]
+      project:
+        description: Required registered project for unlock or remove recovery
+        required: false
+        type: string${deploymentProfile === 'starter'
+        ? ''
+        : `
+      probe_url:
+        description: rehearse only; exact HTTPS Router health URL in /<kebab-slice>/api/health form for the staging blocking rehearsal
+        required: false
+        type: string`}
+      lifecycle:
+        description: affected skips Slices unchanged since the newest successful deployment; full deploys everything
+        required: false
+        default: affected
+        type: choice
+        options: [affected, full]
+
+concurrency:
+  group: protected-lifecycle-\${{ inputs.source_branch || github.ref_name }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+env:
+  EBK_DEPLOYMENT_SOURCE_BRANCH: \${{ inputs.source_branch || github.ref_name }}
+  EBK_DEPLOYMENT_SOURCE_COMMIT: \${{ inputs.source_commit || github.sha }}
+  EBK_DEPLOYMENT_SOURCE_REF: \${{ inputs.source_ref || github.ref }}
+  EBK_EXPECTED_SST_VERSION: ${toolVersions.sst}
+
+jobs:
+  prepare:
+    name: route protected native lifecycle
+    runs-on: ubuntu-latest
+    outputs:
+      action: \${{ steps.route.outputs.action }}
+      probe_url: \${{ steps.route.outputs.probe_url }}
+      account_id: \${{ steps.account.outputs.account_id }}
+      has_slices: \${{ steps.policy.outputs.has_slices }}
+      has_containers: \${{ steps.policy.outputs.has_containers }}
+      container_projects: \${{ steps.policy.outputs.container_projects }}
+      container_matrix: \${{ steps.policy.outputs.container_matrix }}
+      ordered_projects: \${{ steps.policy.outputs.ordered_projects }}
+      oidc_audience: \${{ steps.account.outputs.audience }}
+      partition: \${{ steps.account.outputs.partition }}
+      profile: \${{ steps.policy.outputs.deployment_profile }}
+      project: \${{ steps.route.outputs.project }}
+      region: \${{ steps.policy.outputs.deployment_region }}
+      slice_projects: \${{ steps.policy.outputs.slice_projects }}
+      slice_matrix: \${{ steps.policy.outputs.slice_matrix }}
+      staging_account_id: \${{ steps.policy.outputs.staging_account_id }}
+      stage: \${{ steps.route.outputs.stage }}
+      stage_deploy_role_arn: \${{ steps.account.outputs.role_arn }}${trunkPromotion
+        ? `
+      production_account_id: \${{ steps.production-account.outputs.account_id }}
+      production_deploy_role_arn: \${{ steps.production-account.outputs.role_arn }}`
+        : ''}
+    steps:
+      - name: Verify exact protected branch tip before setup
+        env:
+          EBK_CONTEXT_REF: \${{ github.ref }}
+          EBK_CONTEXT_REF_NAME: \${{ github.ref_name }}
+          EBK_CONTEXT_RUN_ATTEMPT: \${{ github.run_attempt }}
+          EBK_CONTEXT_RUN_ID: \${{ github.run_id }}
+          EBK_CONTEXT_SHA: \${{ github.sha }}
+          EBK_INPUT_RUN_ATTEMPT: \${{ inputs.verify_run_attempt || '' }}
+          EBK_INPUT_RUN_ID: \${{ inputs.verify_run_id || '' }}
+          EBK_INPUT_SOURCE_BRANCH: \${{ inputs.source_branch || '' }}
+          EBK_INPUT_SOURCE_COMMIT: \${{ inputs.source_commit || '' }}
+          EBK_INPUT_SOURCE_REF: \${{ inputs.source_ref || '' }}
+          EBK_SOURCE_BRANCH: \${{ env.EBK_DEPLOYMENT_SOURCE_BRANCH }}
+          EBK_SOURCE_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+          EBK_SOURCE_REF: \${{ env.EBK_DEPLOYMENT_SOURCE_REF }}
+          EBK_TRIGGER: \${{ github.event_name }}
+          GH_REPO: \${{ github.repository }}
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+          case "$EBK_SOURCE_COMMIT" in ''|*[!0-9a-f]*) exit 1 ;; esac
+          { [ "\${#EBK_SOURCE_COMMIT}" -eq 40 ] || [ "\${#EBK_SOURCE_COMMIT}" -eq 64 ]; } || exit 1
+          case "$EBK_SOURCE_BRANCH:$EBK_SOURCE_REF" in
+            develop:refs/heads/develop|main:refs/heads/main) ;;
+            *) echo 'Protected lifecycle must bind one exact protected branch ref'; exit 1 ;;
+          esac
+          if [ -n "$EBK_INPUT_RUN_ID$EBK_INPUT_RUN_ATTEMPT$EBK_INPUT_SOURCE_BRANCH$EBK_INPUT_SOURCE_COMMIT$EBK_INPUT_SOURCE_REF" ]; then
+            [ "$EBK_TRIGGER" = push ] || { echo 'Automatic deployment requires one protected push Verify caller'; exit 1; }
+            [ -n "$EBK_INPUT_RUN_ID" ] && [ -n "$EBK_INPUT_RUN_ATTEMPT" ] &&
+              [ -n "$EBK_INPUT_SOURCE_BRANCH" ] && [ -n "$EBK_INPUT_SOURCE_COMMIT" ] && [ -n "$EBK_INPUT_SOURCE_REF" ] ||
+              { echo 'Automatic deployment caller binding is incomplete'; exit 1; }
+            [ "$EBK_INPUT_RUN_ID" = "$EBK_CONTEXT_RUN_ID" ] &&
+              [ "$EBK_INPUT_RUN_ATTEMPT" = "$EBK_CONTEXT_RUN_ATTEMPT" ] &&
+              [ "$EBK_INPUT_SOURCE_COMMIT" = "$EBK_CONTEXT_SHA" ] &&
+              [ "$EBK_INPUT_SOURCE_BRANCH" = "$EBK_CONTEXT_REF_NAME" ] &&
+              [ "$EBK_INPUT_SOURCE_REF" = "$EBK_CONTEXT_REF" ] ||
+              { echo 'Automatic deployment differs from its exact Verify caller'; exit 1; }
+          else
+            [ "$EBK_TRIGGER" = workflow_dispatch ] || { echo 'Manual deployment requires workflow dispatch'; exit 1; }
+          fi
+          branch_tip="$(gh api "/repos/$GH_REPO/git/ref/heads/$EBK_SOURCE_BRANCH" --jq '.object.sha')"
+          [ "$branch_tip" = "$EBK_SOURCE_COMMIT" ] || {
+            echo 'Deployment source is no longer the exact protected branch tip'; exit 1;
+          }
+      - name: Check out immutable source
+        uses: ${actionPins.checkout}
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+      - uses: ${actionPins.pnpmSetup}
+      - uses: ${actionPins.setupNode}
+        with:
+          node-version: ${toolVersions.node}
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
+      - id: route
+        name: Resolve protected stage and action
+        env:
+          EBK_DISPATCH_ACTION: \${{ inputs.action || '' }}
+          EBK_DISPATCH_PROBE_URL: \${{ inputs.probe_url || '' }}
+          EBK_DISPATCH_PROJECT: \${{ inputs.project || '' }}
+          EBK_PROFILE: ${deploymentProfile}
+          EBK_SOURCE_BRANCH: \${{ env.EBK_DEPLOYMENT_SOURCE_BRANCH }}
+          EBK_SOURCE_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+          EBK_TRIGGER: \${{ github.event_name }}
+        run: |
+          set -euo pipefail
+          action=deploy
+          project=
+          if [ "$EBK_TRIGGER" = workflow_dispatch ]; then
+            action="$EBK_DISPATCH_ACTION"
+            project="$EBK_DISPATCH_PROJECT"
+          fi
+          case "$EBK_SOURCE_COMMIT" in ''|*[!0-9a-f]*) exit 1 ;; esac
+          { [ "\${#EBK_SOURCE_COMMIT}" -eq 40 ] || [ "\${#EBK_SOURCE_COMMIT}" -eq 64 ]; } || exit 1
+          case "$action" in deploy|refresh|unlock|remove|rehearse) ;; *) exit 1 ;; esac
+          case "$project" in ''|*[!A-Za-z0-9_-]*) [ -z "$project" ] || exit 1 ;; esac
+          case "$action" in
+            unlock|remove) [ -n "$project" ] || { echo 'unlock and remove require an explicit project'; exit 1; } ;;
+            deploy|refresh) [ -z "$project" ] || { echo 'deploy and refresh operate on the policy-derived project order'; exit 1; } ;;
+            rehearse)
+              [ -z "$project" ] || { echo 'rehearse targets the foundation Router WAF and takes no project'; exit 1; }
+              [ "$EBK_PROFILE" != starter ] || { echo 'starter rehearses development locally; rehearse is for isolated staging'; exit 1; }
+              [ "$EBK_SOURCE_BRANCH" = develop ] || { echo 'rehearse runs from develop against staging'; exit 1; }
+              case "$EBK_DISPATCH_PROBE_URL" in
+                https://*/*/api/health) ;;
+                *) echo 'rehearse requires probe_url in https://<router>/<kebab-slice>/api/health form'; exit 1 ;;
+              esac
+              ;;
+          esac
+          # The committed deployment plan knows deploy, refresh, unlock, and
+          # remove; a rehearsal derives the same project inventory as deploy.
+          plan_action="$action"
+          [ "$action" != rehearse ] || plan_action=deploy
+          case "$EBK_SOURCE_BRANCH" in
+            main) stage=production ;;
+            develop)
+              if [ "$EBK_PROFILE" = starter ]; then
+                stage=development
+              else
+                stage=staging
+              fi
+              ;;
+            *) echo 'Protected lifecycle must run from develop or main'; exit 1 ;;
+          esac
+          echo "action=$action" >> "$GITHUB_OUTPUT"
+          echo "plan_action=$plan_action" >> "$GITHUB_OUTPUT"
+          echo "probe_url=$EBK_DISPATCH_PROBE_URL" >> "$GITHUB_OUTPUT"
+          echo "project=$project" >> "$GITHUB_OUTPUT"
+          echo "stage=$stage" >> "$GITHUB_OUTPUT"
+      - id: policy
+        name: Derive ordered projects from committed policy
+        env:
+          EBK_ACTION: \${{ steps.route.outputs.plan_action }}
+          EBK_PROJECT: \${{ steps.route.outputs.project }}
+          EBK_STAGE: \${{ steps.route.outputs.stage }}
+        run: |
+          set -euo pipefail
+          args=("--action=$EBK_ACTION" "--stage=$EBK_STAGE")
+          if [ -n "$EBK_PROJECT" ]; then args+=("--project=$EBK_PROJECT"); fi
+          pnpm nx run ${name}:deployment-plan -- "\${args[@]}"
+      - name: Bind generated profile
+        env:
+          EBK_RENDERED_PROFILE: ${deploymentProfile}
+          EBK_REPOSITORY_PROFILE: \${{ steps.policy.outputs.deployment_profile }}
+        run: test "$EBK_RENDERED_PROFILE" = "$EBK_REPOSITORY_PROFILE"
+      - id: account
+        name: Derive canonical committed stage authority
+        env:
+          EBK_DEVELOPMENT_ACCOUNT: \${{ steps.policy.outputs.development_account_id }}
+          EBK_PRODUCTION_ACCOUNT: \${{ steps.policy.outputs.production_account_id }}
+          EBK_REGION: \${{ steps.policy.outputs.deployment_region }}
+          EBK_STAGE: \${{ steps.route.outputs.stage }}
+          EBK_STAGING_ACCOUNT: \${{ steps.policy.outputs.staging_account_id }}
+        run: |
+${indentedScript(`set -euo pipefail\n${canonicalStageAuthorityDerivationScript()}`, 10)}${trunkPromotion
+        ? `
+      # Trunk promotion deploys production from the develop run, so the
+      # production authority is derived here beside the staging authority.
+      - id: production-account
+        name: Derive canonical committed production authority for trunk promotion
+        if: steps.route.outputs.stage == 'staging'
+        env:
+          EBK_DEVELOPMENT_ACCOUNT: \${{ steps.policy.outputs.development_account_id }}
+          EBK_PRODUCTION_ACCOUNT: \${{ steps.policy.outputs.production_account_id }}
+          EBK_REGION: \${{ steps.policy.outputs.deployment_region }}
+          EBK_STAGE: production
+          EBK_STAGING_ACCOUNT: \${{ steps.policy.outputs.staging_account_id }}
+        run: |
+${indentedScript(`set -euo pipefail\n${canonicalStageAuthorityDerivationScript()}`, 10)}`
+        : ''}
+
+  immutable-artifacts:
+    name: prepare exact immutable release artifacts
+    needs: prepare
+    if: >-
+      needs.prepare.outputs.action == 'deploy' &&
+      (
+        needs.prepare.outputs.has_slices == 'true' ||
+        (needs.prepare.outputs.stage == 'production' && needs.prepare.outputs.profile != 'starter')
+      )
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+    outputs:
+      artifact_digest: \${{ steps.current.outputs.artifact_digest || steps.staging.outputs.artifact_digest }}
+      artifact_id: \${{ steps.current.outputs.artifact_id || steps.staging.outputs.artifact_id }}
+      candidate_material_digest: \${{ steps.staging.outputs.candidate_material_digest }}
+      container_artifact_digest: \${{ steps.staging.outputs.container_artifact_digest }}
+      container_artifact_id: \${{ steps.staging.outputs.container_artifact_id }}
+      staging_deployment_run_attempt: \${{ steps.staging.outputs.deployment_run_attempt }}
+      staging_deployment_run_id: \${{ steps.staging.outputs.deployment_run_id }}
+      baseline_artifact_digest: \${{ steps.baseline.outputs.artifact_digest }}
+      baseline_artifact_id: \${{ steps.baseline.outputs.artifact_id }}
+      baseline_commit: \${{ steps.baseline.outputs.commit }}
+      baseline_found: \${{ steps.baseline.outputs.found }}
+      baseline_run_id: \${{ steps.baseline.outputs.run_id }}
+      producer_run_attempt: \${{ steps.current.outputs.producer_run_attempt || steps.staging.outputs.producer_run_attempt }}
+      producer_run_id: \${{ steps.current.outputs.producer_run_id || steps.staging.outputs.producer_run_id }}
+      source_commit: \${{ steps.current.outputs.source_commit || steps.staging.outputs.source_commit }}
+    steps:
+      - name: Check out immutable production ancestry
+        if: needs.prepare.outputs.stage == 'production' && needs.prepare.outputs.profile != 'starter'
+        uses: ${actionPins.checkout}
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+      - id: current
+        name: Select exact successful current-source CI candidate
+        if: >-
+          needs.prepare.outputs.has_slices == 'true' &&
+          (needs.prepare.outputs.stage != 'production' || needs.prepare.outputs.profile == 'starter')
+        env:
+          EBK_CALLER_RUN_ATTEMPT: \${{ inputs.verify_run_attempt || '' }}
+          EBK_CALLER_RUN_ID: \${{ inputs.verify_run_id || '' }}
+          EBK_SOURCE_BRANCH: \${{ env.EBK_DEPLOYMENT_SOURCE_BRANCH }}
+          EBK_SOURCE_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+          GH_REPO: \${{ github.repository }}
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+          if [ -n "$EBK_CALLER_RUN_ID" ]; then
+            [ -n "$EBK_CALLER_RUN_ATTEMPT" ] || exit 1
+            run_id="$EBK_CALLER_RUN_ID"
+            run_attempt="$EBK_CALLER_RUN_ATTEMPT"
+          else
+            runs="$(gh api "/repos/$GH_REPO/actions/workflows/ci.yml/runs?event=push&branch=$EBK_SOURCE_BRANCH&head_sha=$EBK_SOURCE_COMMIT&status=success&per_page=100")"
+            producer="$(printf '%s' "$runs" | jq -c --arg branch "$EBK_SOURCE_BRANCH" --arg source "$EBK_SOURCE_COMMIT" \
+              '[.workflow_runs[] | select(.head_sha == $source and .head_branch == $branch and .event == "push" and .conclusion == "success" and .path == ".github/workflows/ci.yml")] | if length == 1 then .[0] else empty end')"
+            [ -n "$producer" ] || { echo 'Exact successful CI candidate producer is absent or ambiguous'; exit 1; }
+            run_id="$(printf '%s' "$producer" | jq -r '.id // empty')"
+            run_attempt="$(printf '%s' "$producer" | jq -r '.run_attempt // empty')"
+          fi
+          artifacts="$(gh api "/repos/$GH_REPO/actions/runs/$run_id/artifacts?per_page=100")"
+          artifact="$(printf '%s' "$artifacts" | jq -c --arg source "$EBK_SOURCE_COMMIT" \
+            '[.artifacts[] | select(.name == "release-candidate-" + $source and .expired == false)] | if length == 1 then .[0] else empty end')"
+          [ -n "$artifact" ] || { echo 'Exact release candidate artifact is absent or ambiguous'; exit 1; }
+          artifact_id="$(printf '%s' "$artifact" | jq -r '.id // empty')"
+          artifact_digest="$(printf '%s' "$artifact" | jq -r '.digest // empty')"
+          case "$run_id:$run_attempt:$artifact_id" in *[!0-9:]*) exit 1 ;; esac
+          case "$artifact_digest" in sha256:????????????????????????????????????????????????????????????????) ;; *) exit 1 ;; esac
+          echo "artifact_digest=$artifact_digest" >> "$GITHUB_OUTPUT"
+          echo "artifact_id=$artifact_id" >> "$GITHUB_OUTPUT"
+          echo "producer_run_attempt=$run_attempt" >> "$GITHUB_OUTPUT"
+          echo "producer_run_id=$run_id" >> "$GITHUB_OUTPUT"
+          echo "source_commit=$EBK_SOURCE_COMMIT" >> "$GITHUB_OUTPUT"
+      - id: baseline
+        name: Select the newest successful deployment receipt on this branch
+        if: >-
+          needs.prepare.outputs.has_slices == 'true' &&
+          (needs.prepare.outputs.stage != 'production' || needs.prepare.outputs.profile == 'starter')
+        env:
+          EBK_SOURCE_BRANCH: \${{ env.EBK_DEPLOYMENT_SOURCE_BRANCH }}
+          EBK_SOURCE_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+          EBK_STAGE: \${{ needs.prepare.outputs.stage }}
+          GH_REPO: \${{ github.repository }}
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+          # A baseline lets unchanged OCI artifacts reuse their retained evidence.
+          # Declining is always safe: without one, every artifact is rebuilt.
+          echo "found=false" >> "$GITHUB_OUTPUT"
+          runs="$(gh api "/repos/$GH_REPO/actions/workflows/ci.yml/runs?event=push&branch=$EBK_SOURCE_BRANCH&status=success&per_page=50")"
+          for candidate in $(printf '%s' "$runs" | jq -r --arg branch "$EBK_SOURCE_BRANCH" \\
+            '.workflow_runs | sort_by(.run_number) | reverse | .[] | select(.head_branch == $branch and .event == "push" and .conclusion == "success" and .path == ".github/workflows/ci.yml") | "\\(.id):\\(.run_attempt):\\(.head_sha)"'); do
+            IFS=':' read -r run_id run_attempt head_sha <<< "$candidate"
+            case "$run_id:$run_attempt" in *[!0-9:]*) continue ;; esac
+            case "$head_sha" in ????????????????????????????????????????) ;; *) continue ;; esac
+            [ "$head_sha" != "$EBK_SOURCE_COMMIT" ] || continue
+            # This job has no checkout on the staging path, so ancestry comes
+            # from the API rather than a local repository (EBK-INT-2026-083).
+            ancestry="$(gh api "/repos/$GH_REPO/compare/$head_sha...$EBK_SOURCE_COMMIT" --jq '.status' 2>/dev/null || echo unknown)"
+            [ "$ancestry" = ahead ] || continue
+            artifacts="$(gh api "/repos/$GH_REPO/actions/runs/$run_id/artifacts?per_page=100")"
+            receipt="$(printf '%s' "$artifacts" | jq -c --arg name "deployment-receipt-$EBK_STAGE-$run_id-$run_attempt" \\
+              '[.artifacts[] | select(.name == $name and .expired == false)] | if length == 1 then .[0] else empty end')"
+            [ -n "$receipt" ] || continue
+            artifact_id="$(printf '%s' "$receipt" | jq -r '.id // empty')"
+            artifact_digest="$(printf '%s' "$receipt" | jq -r '.digest // empty')"
+            case "$artifact_id" in ''|*[!0-9]*) continue ;; esac
+            case "$artifact_digest" in sha256:????????????????????????????????????????????????????????????????) ;; *) continue ;; esac
+            echo "artifact_digest=$artifact_digest" >> "$GITHUB_OUTPUT"
+            echo "artifact_id=$artifact_id" >> "$GITHUB_OUTPUT"
+            echo "commit=$head_sha" >> "$GITHUB_OUTPUT"
+            echo "found=true" >> "$GITHUB_OUTPUT"
+            echo "run_id=$run_id" >> "$GITHUB_OUTPUT"
+            echo "Baseline deployment receipt: run $run_id attempt $run_attempt at $head_sha"
+            break
+          done
+      - id: staging-receipt
+        name: Select exact successful staging deployment receipt
+        if: needs.prepare.outputs.stage == 'production' && needs.prepare.outputs.profile != 'starter'
+        env:
+          EBK_DEPLOYMENT_SOURCE_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+          GH_REPO: \${{ github.repository }}
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+          parents="$(git rev-list --parents -n 1 "$EBK_DEPLOYMENT_SOURCE_COMMIT")"
+          set -- $parents
+          [ "$#" -eq 3 ] || { echo 'Isolated production requires one exact two-parent promotion merge'; exit 1; }
+          [ "$1" = "$EBK_DEPLOYMENT_SOURCE_COMMIT" ] || exit 1
+          staging_source="$3"
+          git merge-base --is-ancestor "$staging_source" "$EBK_DEPLOYMENT_SOURCE_COMMIT" || {
+            echo 'Staging promotion source is not an ancestor of production'; exit 1;
+          }
+          [ "$(git rev-parse "$EBK_DEPLOYMENT_SOURCE_COMMIT^{tree}")" = "$(git rev-parse "$staging_source^{tree}")" ] || {
+            echo 'Production merge tree differs from the promoted staging source'; exit 1;
+          }
+          git show-ref --verify --quiet refs/remotes/origin/develop || {
+            echo 'Protected develop lineage is absent from the immutable checkout'; exit 1;
+          }
+          git rev-list --first-parent refs/remotes/origin/develop > "$RUNNER_TEMP/develop-first-parent"
+          grep -Fxq "$staging_source" "$RUNNER_TEMP/develop-first-parent" || {
+            echo 'Staging promotion source is absent from protected develop first-parent history'; exit 1;
+          }
+          runs="$(gh api "/repos/$GH_REPO/actions/workflows/ci.yml/runs?event=push&branch=develop&head_sha=$staging_source&status=success&per_page=100")"
+          producer="$(printf '%s' "$runs" | jq -c --arg source "$staging_source" \
+            '[.workflow_runs[] | select(.head_sha == $source and .head_branch == "develop" and .event == "push" and .conclusion == "success" and .path == ".github/workflows/ci.yml")] | if length == 1 then .[0] else empty end')"
+          [ -n "$producer" ] || { echo 'Exact successful staging Verify deployment is absent or ambiguous'; exit 1; }
+          run_id="$(printf '%s' "$producer" | jq -r '.id // empty')"
+          run_attempt="$(printf '%s' "$producer" | jq -r '.run_attempt // empty')"
+          artifacts="$(gh api "/repos/$GH_REPO/actions/runs/$run_id/artifacts?per_page=100")"
+          receipt_name="deployment-receipt-staging-$run_id-$run_attempt"
+          receipt="$(printf '%s' "$artifacts" | jq -c --arg name "$receipt_name" \
+            '[.artifacts[] | select(.name == $name and .expired == false)] | if length == 1 then .[0] else empty end')"
+          [ -n "$receipt" ] || { echo 'Exact successful staging deployment receipt is absent or ambiguous'; exit 1; }
+          artifact_id="$(printf '%s' "$receipt" | jq -r '.id // empty')"
+          artifact_digest="$(printf '%s' "$receipt" | jq -r '.digest // empty')"
+          case "$run_id:$run_attempt:$artifact_id" in *[!0-9:]*) exit 1 ;; esac
+          case "$artifact_digest" in sha256:????????????????????????????????????????????????????????????????) ;; *) exit 1 ;; esac
+          echo "artifact_digest=$artifact_digest" >> "$GITHUB_OUTPUT"
+          echo "artifact_id=$artifact_id" >> "$GITHUB_OUTPUT"
+          echo "run_attempt=$run_attempt" >> "$GITHUB_OUTPUT"
+          echo "run_id=$run_id" >> "$GITHUB_OUTPUT"
+          echo "source_commit=$staging_source" >> "$GITHUB_OUTPUT"
+      - name: Restore exact staging deployment receipt
+        if: needs.prepare.outputs.stage == 'production' && needs.prepare.outputs.profile != 'starter'
+        uses: ${actionPins.downloadArtifact}
+        with:
+          artifact-ids: \${{ steps.staging-receipt.outputs.artifact_id }}
+          github-token: \${{ github.token }}
+          path: \${{ runner.temp }}/staging-deployment-receipt
+          run-id: \${{ steps.staging-receipt.outputs.run_id }}
+      - id: staging
+        name: Bind exact staging deployment and release evidence
+        if: needs.prepare.outputs.stage == 'production' && needs.prepare.outputs.profile != 'starter'
+        env:
+          EBK_STAGING_DEPLOYMENT_RUN_ATTEMPT: \${{ steps.staging-receipt.outputs.run_attempt }}
+          EBK_STAGING_DEPLOYMENT_RUN_ID: \${{ steps.staging-receipt.outputs.run_id }}
+          EBK_EXPECTED_HAS_SLICES: \${{ needs.prepare.outputs.has_slices }}
+          EBK_EXPECTED_HAS_CONTAINERS: \${{ needs.prepare.outputs.has_containers }}
+          EBK_EXPECTED_DEPLOYMENT_PROFILE: \${{ needs.prepare.outputs.profile }}
+          EBK_EXPECTED_DEPLOYMENT_REGION: \${{ needs.prepare.outputs.region }}
+          EBK_EXPECTED_STAGING_ACCOUNT_ID: \${{ needs.prepare.outputs.staging_account_id }}
+          EBK_STAGING_RECEIPT_ARTIFACT_DIGEST: \${{ steps.staging-receipt.outputs.artifact_digest }}
+          EBK_STAGING_RECEIPT_ARTIFACT_ID: \${{ steps.staging-receipt.outputs.artifact_id }}
+          # The receipt artifact keeps .ebk/evidence as its root, so latest.json
+          # and promotion.json live under deployment/ (EBK-INT-2026-074).
+          EBK_STAGING_RECEIPT_ROOT: \${{ runner.temp }}/staging-deployment-receipt/deployment
+          EBK_STAGING_SOURCE_COMMIT: \${{ steps.staging-receipt.outputs.source_commit }}
+          GH_REPO: \${{ github.repository }}
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          node --input-type=module <<'NODE'
+${indentedScript(stagingPromotionReceiptValidationScript(), 10)}
+          NODE
+          if [ "$EBK_EXPECTED_HAS_SLICES" = true ]; then
+            promotion="$EBK_STAGING_RECEIPT_ROOT/promotion.json"
+            candidate_run_id="$(jq -r '.candidate.producerRunId' "$promotion")"
+            candidate_run_attempt="$(jq -r '.candidate.producerRunAttempt' "$promotion")"
+            candidate_artifact_id="$(jq -r '.candidate.artifactId' "$promotion")"
+            candidate_artifact_digest="$(jq -r '.candidate.artifactDigest' "$promotion")"
+            candidate_run="$(gh api "/repos/$GH_REPO/actions/runs/$candidate_run_id")"
+            printf '%s' "$candidate_run" | jq -e \
+              --arg source "$EBK_STAGING_SOURCE_COMMIT" \
+              --arg attempt "$candidate_run_attempt" \
+              '.head_sha == $source and .head_branch == "develop" and .event == "push" and .path == ".github/workflows/ci.yml" and .conclusion == "success" and (.run_attempt | tostring) == $attempt' >/dev/null
+            candidate_artifacts="$(gh api "/repos/$GH_REPO/actions/runs/$candidate_run_id/artifacts?per_page=100")"
+            printf '%s' "$candidate_artifacts" | jq -e \
+              --arg id "$candidate_artifact_id" \
+              --arg digest "$candidate_artifact_digest" \
+              --arg name "release-candidate-$EBK_STAGING_SOURCE_COMMIT" \
+              '[.artifacts[] | select((.id | tostring) == $id and .name == $name and .digest == $digest and .expired == false)] | length == 1' >/dev/null
+          fi
+          if [ "$EBK_EXPECTED_HAS_CONTAINERS" = true ]; then
+            container_artifact_id="$(jq -r '.container.artifactId' "$promotion")"
+            container_artifact_digest="$(jq -r '.container.artifactDigest' "$promotion")"
+            staging_artifacts="$(gh api "/repos/$GH_REPO/actions/runs/$EBK_STAGING_DEPLOYMENT_RUN_ID/artifacts?per_page=100")"
+            printf '%s' "$staging_artifacts" | jq -e \
+              --arg id "$container_artifact_id" \
+              --arg digest "$container_artifact_digest" \
+              --arg name "container-release-staging-$EBK_STAGING_DEPLOYMENT_RUN_ID-$EBK_STAGING_DEPLOYMENT_RUN_ATTEMPT" \
+              '[.artifacts[] | select((.id | tostring) == $id and .name == $name and .digest == $digest and .expired == false)] | length == 1' >/dev/null
+          fi
+
+  container-platform:
+    name: native \${{ needs.prepare.outputs.stage }} OCI \${{ matrix.project.project }} \${{ matrix.platform }}
+    needs: [prepare, immutable-artifacts]
+    if: >-
+      always() &&
+      needs.prepare.result == 'success' &&
+      needs.immutable-artifacts.result == 'success' &&
+      needs.prepare.outputs.action == 'deploy' &&
+      needs.prepare.outputs.has_containers == 'true' &&
+      (
+        needs.prepare.outputs.stage == 'staging' ||
+        (needs.prepare.outputs.stage == 'production' && needs.prepare.outputs.profile == 'starter')
+      )
+    strategy:
+      fail-fast: false
+      # One job per Slice and architecture: Slices build in parallel instead of
+      # looping on one runner per architecture.
+      matrix:
+        project: \${{ fromJson(needs.prepare.outputs.container_matrix) }}
+        # architecture is an original axis: include entries only decorate the
+        # matching combination. Include-only keys would be merged into every
+        # project and the later entry would overwrite the earlier one, so every
+        # Slice would build one architecture (EBK-INT-2026-081).
+        architecture: [amd64, arm64]
+        include:
+          - architecture: amd64
+            platform: linux/amd64
+            runner: ubuntu-latest
+            target: container-release-amd64
+          - architecture: arm64
+            platform: linux/arm64
+            runner: ubuntu-24.04-arm
+            target: container-release-arm64
+    runs-on: \${{ matrix.runner }}
+    environment: \${{ needs.prepare.outputs.stage }}
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+    env:
+      AWS_DEPLOY_ROLE_ARN: \${{ needs.prepare.outputs.stage_deploy_role_arn }}
+      AWS_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_EXPECTED_ACCOUNT_ID }}
+      AWS_PARTITION: \${{ needs.prepare.outputs.partition }}
+      AWS_REGION: \${{ vars.AWS_REGION }}
+      EBK_ACTION: deploy
+      EBK_DEPLOYMENT_PROFILE: \${{ needs.prepare.outputs.profile }}
+      EBK_POLICY_ACCOUNT_ID: \${{ needs.prepare.outputs.account_id }}
+      EBK_POLICY_REGION: \${{ needs.prepare.outputs.region }}
+      EBK_RELEASE_SOURCE_COMMIT: \${{ needs.immutable-artifacts.outputs.source_commit }}
+      EBK_SOURCE_COMMIT: \${{ inputs.source_commit || github.sha }}
+      EBK_STAGE: \${{ needs.prepare.outputs.stage }}
+      EBK_SLICE_PROJECTS: \${{ needs.prepare.outputs.container_projects }}
+      EBK_SLICE_PROJECT: \${{ matrix.project.project }}
+      EBK_CONTAINER_PROJECTS: \${{ needs.prepare.outputs.container_projects }}
+    steps:
+      - name: Check out immutable container source
+        uses: ${actionPins.checkout}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+      - uses: ${actionPins.pnpmSetup}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+      - uses: ${actionPins.setupNode}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          node-version: ${toolVersions.node}
+          cache: pnpm
+      - env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
+      - name: Verify managed workspace integrity before container authority
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: pnpm nx run ${name}:workspace-health
+      - name: Restore exact immutable release candidate for container build
+        uses: ${actionPins.downloadArtifact}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          artifact-ids: \${{ needs.immutable-artifacts.outputs.artifact_id }}
+          github-token: \${{ github.token }}
+          path: .ebk/evidence/release-candidate
+          run-id: \${{ needs.immutable-artifacts.outputs.producer_run_id }}
+      - name: Restore the baseline deployment receipt for unchanged artifacts
+        if: needs.immutable-artifacts.outputs.baseline_found == 'true'
+        uses: ${actionPins.downloadArtifact}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          artifact-ids: \${{ needs.immutable-artifacts.outputs.baseline_artifact_id }}
+          github-token: \${{ github.token }}
+          path: \${{ runner.temp }}/ebk-deployment-baseline
+          run-id: \${{ needs.immutable-artifacts.outputs.baseline_run_id }}
+      - name: Revalidate exact protected branch tip before OIDC
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_SOURCE_BRANCH: \${{ env.EBK_DEPLOYMENT_SOURCE_BRANCH }}
+          EBK_SOURCE_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+          GH_REPO: \${{ github.repository }}
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+          [ "$(git rev-parse HEAD)" = "$EBK_SOURCE_COMMIT" ] || {
+            echo 'Deployment checkout differs from the exact protected source'; exit 1;
+          }
+          branch_tip="$(gh api "/repos/$GH_REPO/git/ref/heads/$EBK_SOURCE_BRANCH" --jq '.object.sha')"
+          [ "$branch_tip" = "$EBK_SOURCE_COMMIT" ] || {
+            echo 'Deployment source is no longer the exact protected branch tip'; exit 1;
+          }
+      - name: Assume the current stage deployment role for container build
+        uses: ${actionPins.configureAwsCredentials}
+        with:
+          audience: \${{ needs.prepare.outputs.oidc_audience }}
+          aws-region: \${{ vars.AWS_REGION }}
+          role-session-name: ebk-container-\${{ matrix.architecture }}-\${{ github.run_id }}-\${{ github.run_attempt }}
+          role-to-assume: \${{ env.AWS_DEPLOY_ROLE_ARN }}
+      - name: Verify exact container build authority
+        run: |
+          set -euo pipefail
+          [ "$AWS_EXPECTED_ACCOUNT_ID" = "$EBK_POLICY_ACCOUNT_ID" ]
+          [ "$AWS_REGION" = "$EBK_POLICY_REGION" ]
+          [ "$(aws sts get-caller-identity --query Account --output text)" = "$EBK_POLICY_ACCOUNT_ID" ]
+      - name: Restore the container layer and release tool caches
+        uses: ${actionPins.cache}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          path: |
+            \${{ runner.temp }}/ebk-buildx-cache
+            \${{ runner.temp }}/ebk-release-tools
+          key: ebk-container-\${{ needs.prepare.outputs.stage }}-\${{ matrix.project.project }}-\${{ matrix.architecture }}-\${{ hashFiles('pnpm-lock.yaml') }}-\${{ github.run_id }}
+          restore-keys: |
+            ebk-container-\${{ needs.prepare.outputs.stage }}-\${{ matrix.project.project }}-\${{ matrix.architecture }}-\${{ hashFiles('pnpm-lock.yaml') }}-
+            ebk-container-\${{ needs.prepare.outputs.stage }}-\${{ matrix.project.project }}-\${{ matrix.architecture }}-
+      - name: Build and run exact native OCI artifacts
+        env:
+          EBK_BUILDX_CACHE_DIR: \${{ runner.temp }}/ebk-buildx-cache
+          EBK_RELEASE_TOOL_CACHE_DIR: \${{ runner.temp }}/ebk-release-tools
+          EBK_CONTAINER_BASELINE_COMMIT: \${{ needs.immutable-artifacts.outputs.baseline_commit }}
+          EBK_CONTAINER_BASELINE_ROOT: \${{ needs.immutable-artifacts.outputs.baseline_found == 'true' && format('{0}/ebk-deployment-baseline', runner.temp) || '' }}
+        run: |
+          set -euo pipefail
+${indentedScript(exactStageDeployerGuardScript('Container build', '$EBK_POLICY_ACCOUNT_ID'), 10)}
+          case "$EBK_SLICE_PROJECT" in
+            ''|-*|*-|*[!a-z0-9-]*) echo 'Container build Slice project must be an exact normalized Slice name'; exit 1 ;;
+          esac
+          case ",$EBK_CONTAINER_PROJECTS," in
+            *",$EBK_SLICE_PROJECT,"*) ;;
+            *) echo 'Container build Slice project is not in the committed deployment plan'; exit 1 ;;
+          esac
+          pnpm nx run "$EBK_SLICE_PROJECT:\${{ matrix.target }}"
+      - name: Retain native platform evidence
+        uses: ${actionPins.uploadArtifact}
+        with:
+          name: container-platform-\${{ needs.prepare.outputs.stage }}-\${{ matrix.project.project }}-\${{ matrix.architecture }}-\${{ github.run_id }}-\${{ github.run_attempt }}
+          if-no-files-found: error
+          include-hidden-files: true
+          retention-days: 30
+          # The glob keeps partials/<stage> as the artifact root: the assemble
+          # job merges every platform artifact into that directory and the
+          # container release tool reads <project>/<architecture>/ beneath it.
+          # A literal <project>/<architecture> path would make the architecture
+          # directory the root and flatten the merged restore.
+          path: .ebk/evidence/container-release/partials/\${{ needs.prepare.outputs.stage }}/*/\${{ matrix.architecture }}
+
+  container-assemble:
+    name: assemble \${{ needs.prepare.outputs.stage }} OCI indexes
+    needs: [prepare, immutable-artifacts, container-platform]
+    if: >-
+      always() &&
+      needs.prepare.result == 'success' &&
+      needs.immutable-artifacts.result == 'success' &&
+      needs.container-platform.result == 'success' &&
+      needs.prepare.outputs.action == 'deploy' &&
+      needs.prepare.outputs.has_containers == 'true'
+    runs-on: ubuntu-latest
+    environment: \${{ needs.prepare.outputs.stage }}
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+    outputs:
+      artifact_digest: \${{ steps.retain.outputs.artifact-digest }}
+      artifact_id: \${{ steps.retain.outputs.artifact-id }}
+    env:
+      AWS_DEPLOY_ROLE_ARN: \${{ needs.prepare.outputs.stage_deploy_role_arn }}
+      AWS_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_EXPECTED_ACCOUNT_ID }}
+      AWS_PARTITION: \${{ needs.prepare.outputs.partition }}
+      AWS_REGION: \${{ vars.AWS_REGION }}
+      EBK_ACTION: deploy
+      EBK_DEPLOYMENT_PROFILE: \${{ needs.prepare.outputs.profile }}
+      EBK_POLICY_ACCOUNT_ID: \${{ needs.prepare.outputs.account_id }}
+      EBK_POLICY_REGION: \${{ needs.prepare.outputs.region }}
+      EBK_RELEASE_SOURCE_COMMIT: \${{ needs.immutable-artifacts.outputs.source_commit }}
+      EBK_SOURCE_COMMIT: \${{ inputs.source_commit || github.sha }}
+      EBK_STAGE: \${{ needs.prepare.outputs.stage }}
+      EBK_SLICE_PROJECTS: \${{ needs.prepare.outputs.container_projects }}
+    steps:
+      - name: Check out immutable container source
+        uses: ${actionPins.checkout}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+      - uses: ${actionPins.pnpmSetup}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+      - uses: ${actionPins.setupNode}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          node-version: ${toolVersions.node}
+          cache: pnpm
+      - env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
+      - name: Verify managed workspace integrity before container authority
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: pnpm nx run ${name}:workspace-health
+      - name: Restore exact immutable release candidate for container assembly
+        uses: ${actionPins.downloadArtifact}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          artifact-ids: \${{ needs.immutable-artifacts.outputs.artifact_id }}
+          github-token: \${{ github.token }}
+          path: .ebk/evidence/release-candidate
+          run-id: \${{ needs.immutable-artifacts.outputs.producer_run_id }}
+      - name: Restore both native platform records
+        uses: ${actionPins.downloadArtifact}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          pattern: container-platform-\${{ needs.prepare.outputs.stage }}-*-\${{ github.run_id }}-\${{ github.run_attempt }}
+          merge-multiple: true
+          path: .ebk/evidence/container-release/partials/\${{ needs.prepare.outputs.stage }}
+      - name: Revalidate exact protected branch tip before OIDC
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_SOURCE_BRANCH: \${{ env.EBK_DEPLOYMENT_SOURCE_BRANCH }}
+          EBK_SOURCE_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+          GH_REPO: \${{ github.repository }}
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+          [ "$(git rev-parse HEAD)" = "$EBK_SOURCE_COMMIT" ] || {
+            echo 'Deployment checkout differs from the exact protected source'; exit 1;
+          }
+          branch_tip="$(gh api "/repos/$GH_REPO/git/ref/heads/$EBK_SOURCE_BRANCH" --jq '.object.sha')"
+          [ "$branch_tip" = "$EBK_SOURCE_COMMIT" ] || {
+            echo 'Deployment source is no longer the exact protected branch tip'; exit 1;
+          }
+      - name: Assume the current stage deployment role for container assembly
+        uses: ${actionPins.configureAwsCredentials}
+        with:
+          audience: \${{ needs.prepare.outputs.oidc_audience }}
+          aws-region: \${{ vars.AWS_REGION }}
+          role-session-name: ebk-container-assemble-\${{ github.run_id }}-\${{ github.run_attempt }}
+          role-to-assume: \${{ env.AWS_DEPLOY_ROLE_ARN }}
+      - name: Verify exact container assembly authority
+        run: |
+          set -euo pipefail
+          [ "$AWS_EXPECTED_ACCOUNT_ID" = "$EBK_POLICY_ACCOUNT_ID" ]
+          [ "$AWS_REGION" = "$EBK_POLICY_REGION" ]
+          [ "$(aws sts get-caller-identity --query Account --output text)" = "$EBK_POLICY_ACCOUNT_ID" ]
+      - name: Assemble exact dual-architecture indexes
+        run: |
+          set -euo pipefail
+${indentedScript(exactStageDeployerGuardScript('Container assembly', '$EBK_POLICY_ACCOUNT_ID'), 10)}
+          IFS=',' read -r -a projects <<< "$EBK_SLICE_PROJECTS"
+          for project in "\${projects[@]}"; do
+            test -n "$project" || continue
+            pnpm nx run "$project:container-release-assemble"
+            binding=".ebk/evidence/container-release/$EBK_STAGE/packages/$project/binding.json"
+            sidecar=".ebk/evidence/container-release/$EBK_STAGE/packages/$project/release-bound-binding.json"
+            test -f "$binding" && test ! -e "$sidecar"
+            cp "$binding" "$sidecar"
+            cmp "$binding" "$sidecar"
+          done
+      - id: retain
+        name: Retain exact predeploy container bundle
+        uses: ${actionPins.uploadArtifact}
+        with:
+          name: container-release-\${{ needs.prepare.outputs.stage }}-\${{ github.run_id }}-\${{ github.run_attempt }}
+          if-no-files-found: error
+          include-hidden-files: true
+          retention-days: 30
+          path: .ebk/evidence/container-release
+
+  container-promote-production:
+    name: promote reviewed OCI indexes to production
+    needs: [prepare, immutable-artifacts]
+    if: >-
+      always() &&
+      needs.prepare.result == 'success' &&
+      needs.immutable-artifacts.result == 'success' &&
+      needs.prepare.outputs.action == 'deploy' &&
+      needs.prepare.outputs.stage == 'production' &&
+      needs.prepare.outputs.profile != 'starter' &&
+      needs.prepare.outputs.has_containers == 'true'
+    runs-on: ubuntu-latest
+    environment: production
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+    outputs:
+      artifact_digest: \${{ steps.retain.outputs.artifact-digest }}
+      artifact_id: \${{ steps.retain.outputs.artifact-id }}
+    env:
+      AWS_DEPLOY_ROLE_ARN: \${{ needs.prepare.outputs.stage_deploy_role_arn }}
+      AWS_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_EXPECTED_ACCOUNT_ID }}
+      AWS_PARTITION: \${{ needs.prepare.outputs.partition }}
+      AWS_REGION: \${{ vars.AWS_REGION }}
+      EBK_ACTION: deploy
+      EBK_DEPLOYMENT_PROFILE: \${{ needs.prepare.outputs.profile }}
+      EBK_POLICY_PRODUCTION_ACCOUNT_ID: \${{ needs.prepare.outputs.account_id }}
+      EBK_POLICY_REGION: \${{ needs.prepare.outputs.region }}
+      EBK_POLICY_STAGING_ACCOUNT_ID: \${{ needs.prepare.outputs.staging_account_id }}
+      EBK_RELEASE_SOURCE_COMMIT: \${{ needs.immutable-artifacts.outputs.source_commit }}
+      EBK_SOURCE_COMMIT: \${{ inputs.source_commit || github.sha }}
+      EBK_STAGE: production
+      EBK_SLICE_PROJECTS: \${{ needs.prepare.outputs.container_projects }}
+    steps:
+      - name: Check out immutable production source
+        uses: ${actionPins.checkout}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+      - uses: ${actionPins.pnpmSetup}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+      - uses: ${actionPins.setupNode}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          node-version: ${toolVersions.node}
+          cache: pnpm
+      - env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
+      - name: Verify managed workspace integrity before container authority
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: pnpm nx run ${name}:workspace-health
+      - name: Restore exact immutable release candidate for promotion
+        uses: ${actionPins.downloadArtifact}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          artifact-ids: \${{ needs.immutable-artifacts.outputs.artifact_id }}
+          github-token: \${{ github.token }}
+          path: .ebk/evidence/release-candidate
+          run-id: \${{ needs.immutable-artifacts.outputs.producer_run_id }}
+      - name: Restore exact staging container bundle
+        uses: ${actionPins.downloadArtifact}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          artifact-ids: \${{ needs.immutable-artifacts.outputs.container_artifact_id }}
+          github-token: \${{ github.token }}
+          path: .ebk/evidence/container-release
+          run-id: \${{ needs.immutable-artifacts.outputs.staging_deployment_run_id }}
+      - name: Revalidate exact protected branch tip before OIDC
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_SOURCE_BRANCH: \${{ env.EBK_DEPLOYMENT_SOURCE_BRANCH }}
+          EBK_SOURCE_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+          GH_REPO: \${{ github.repository }}
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+          [ "$(git rev-parse HEAD)" = "$EBK_SOURCE_COMMIT" ] || {
+            echo 'Deployment checkout differs from the exact protected source'; exit 1;
+          }
+          branch_tip="$(gh api "/repos/$GH_REPO/git/ref/heads/$EBK_SOURCE_BRANCH" --jq '.object.sha')"
+          [ "$branch_tip" = "$EBK_SOURCE_COMMIT" ] || {
+            echo 'Deployment source is no longer the exact protected branch tip'; exit 1;
+          }
+      - name: Assume exact staging registry pull role
+        uses: ${actionPins.configureAwsCredentials}
+        with:
+          audience: \${{ needs.prepare.outputs.oidc_audience }}
+          aws-region: \${{ vars.AWS_STAGING_PROMOTION_REGION }}
+          role-session-name: ebk-staging-container-pull-\${{ github.run_id }}-\${{ github.run_attempt }}
+          role-to-assume: \${{ secrets.AWS_STAGING_PROMOTION_PULL_ROLE_ARN }}
+      - name: Authenticate exact staging source registry
+        env:
+          AWS_STAGING_PROMOTION_PULL_ROLE_ARN: \${{ secrets.AWS_STAGING_PROMOTION_PULL_ROLE_ARN }}
+          EBK_STAGING_ACCOUNT_ID: \${{ vars.AWS_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID }}
+          EBK_STAGING_REGION: \${{ vars.AWS_STAGING_PROMOTION_REGION }}
+        run: |
+          set -euo pipefail
+          [ "$EBK_STAGING_ACCOUNT_ID" = "$EBK_POLICY_STAGING_ACCOUNT_ID" ]
+          [ "$EBK_STAGING_REGION" = "$EBK_POLICY_REGION" ]
+${indentedScript(exactStagingPromotionPullGuardScript(), 10)}
+          [ "$EBK_STAGING_ACCOUNT_ID" != "$AWS_EXPECTED_ACCOUNT_ID" ]
+          registry_suffix=.com
+          case "$EBK_STAGING_REGION" in cn-*) registry_suffix=.com.cn ;; esac
+          aws ecr get-login-password --region "$EBK_STAGING_REGION" |
+            docker login --username AWS --password-stdin \
+              "$EBK_STAGING_ACCOUNT_ID.dkr.ecr.$EBK_STAGING_REGION.amazonaws$registry_suffix"
+      - name: Revalidate exact protected branch tip before OIDC
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_SOURCE_BRANCH: \${{ env.EBK_DEPLOYMENT_SOURCE_BRANCH }}
+          EBK_SOURCE_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+          GH_REPO: \${{ github.repository }}
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+          [ "$(git rev-parse HEAD)" = "$EBK_SOURCE_COMMIT" ] || {
+            echo 'Deployment checkout differs from the exact protected source'; exit 1;
+          }
+          branch_tip="$(gh api "/repos/$GH_REPO/git/ref/heads/$EBK_SOURCE_BRANCH" --jq '.object.sha')"
+          [ "$branch_tip" = "$EBK_SOURCE_COMMIT" ] || {
+            echo 'Deployment source is no longer the exact protected branch tip'; exit 1;
+          }
+      - name: Assume the production deployment role for container promotion
+        uses: ${actionPins.configureAwsCredentials}
+        with:
+          audience: \${{ needs.prepare.outputs.oidc_audience }}
+          aws-region: \${{ vars.AWS_REGION }}
+          role-session-name: ebk-production-container-push-\${{ github.run_id }}-\${{ github.run_attempt }}
+          role-to-assume: \${{ env.AWS_DEPLOY_ROLE_ARN }}
+      - name: Promote exact staging indexes without rebuilding
+        env:
+          EBK_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID }}
+          EBK_STAGING_PROMOTION_REGION: \${{ vars.AWS_STAGING_PROMOTION_REGION }}
+        run: |
+          set -euo pipefail
+          [ "$AWS_EXPECTED_ACCOUNT_ID" = "$EBK_POLICY_PRODUCTION_ACCOUNT_ID" ]
+          [ "$AWS_REGION" = "$EBK_POLICY_REGION" ]
+${indentedScript(exactStageDeployerGuardScript('Container promotion', '$AWS_EXPECTED_ACCOUNT_ID'), 10)}
+          IFS=',' read -r -a projects <<< "$EBK_SLICE_PROJECTS"
+          for project in "\${projects[@]}"; do
+            test -n "$project" || continue
+            # The container release tool resolves these against the repository
+            # root, so they stay repository-relative (EBK-INT-2026-077).
+            export EBK_CONTAINER_PROMOTION_SOURCE_BINDING_PATH=".ebk/evidence/container-release/staging/packages/$project/binding.json"
+            export EBK_CONTAINER_PROMOTION_SOURCE_SIDECAR_PATH=".ebk/evidence/container-release/staging/packages/$project/release-bound-binding.json"
+            pnpm nx run "$project:container-release-promote"
+          done
+      - id: retain
+        name: Retain production target container binding
+        uses: ${actionPins.uploadArtifact}
+        with:
+          name: container-release-production-\${{ github.run_id }}-\${{ github.run_attempt }}
+          if-no-files-found: error
+          include-hidden-files: true
+          retention-days: 90
+          path: .ebk/evidence/container-release
+
+  execute:
+    name: native \${{ needs.prepare.outputs.action }} \${{ needs.prepare.outputs.stage }}
+    needs: [prepare, immutable-artifacts, container-assemble, container-promote-production]
+    if: >-
+      always() &&
+      needs.prepare.result == 'success' &&
+      needs.prepare.outputs.action != 'rehearse' &&
+      (
+        needs.prepare.outputs.action != 'deploy' ||
+        (
+          needs.prepare.outputs.has_slices != 'true' &&
+          (needs.prepare.outputs.stage != 'production' || needs.prepare.outputs.profile == 'starter')
+        ) || (
+          needs.immutable-artifacts.result == 'success' &&
+          (
+            needs.prepare.outputs.has_containers != 'true' ||
+            needs.prepare.outputs.stage == 'development' ||
+            (
+              (
+                needs.prepare.outputs.stage == 'staging' ||
+                (needs.prepare.outputs.stage == 'production' && needs.prepare.outputs.profile == 'starter')
+              ) &&
+              needs.container-assemble.result == 'success'
+            ) ||
+            (
+              needs.prepare.outputs.stage == 'production' &&
+              needs.prepare.outputs.profile != 'starter' &&
+              needs.container-promote-production.result == 'success'
+            )
+          )
+        )
+      )
+    runs-on: ubuntu-latest
+    environment: \${{ needs.prepare.outputs.stage }}
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+    env:
+      AWS_DEPLOY_ROLE_ARN: \${{ needs.prepare.outputs.stage_deploy_role_arn }}
+      AWS_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_EXPECTED_ACCOUNT_ID }}
+      AWS_PARTITION: \${{ needs.prepare.outputs.partition }}
+      AWS_REGION: \${{ vars.AWS_REGION }}
+      EBK_ACTION: \${{ needs.prepare.outputs.action }}
+      EBK_ALLOW_PRODUCTION_REMOVE: \${{ vars.EBK_ALLOW_PRODUCTION_REMOVE }}
+      EBK_CANDIDATE_ARTIFACT_DIGEST: \${{ needs.immutable-artifacts.outputs.artifact_digest }}
+      EBK_CANDIDATE_ARTIFACT_ID: \${{ needs.immutable-artifacts.outputs.artifact_id }}
+      EBK_CANDIDATE_MATERIAL_DIGEST: \${{ needs.immutable-artifacts.outputs.candidate_material_digest }}
+      EBK_CANDIDATE_PRODUCER_RUN_ATTEMPT: \${{ needs.immutable-artifacts.outputs.producer_run_attempt }}
+      EBK_CANDIDATE_PRODUCER_RUN_ID: \${{ needs.immutable-artifacts.outputs.producer_run_id }}
+      EBK_DEPLOYMENT_PROFILE: \${{ needs.prepare.outputs.profile }}
+      EBK_ORDERED_PROJECTS: \${{ needs.prepare.outputs.ordered_projects }}
+      EBK_POLICY_ACCOUNT_ID: \${{ needs.prepare.outputs.account_id }}
+      EBK_POLICY_REGION: \${{ needs.prepare.outputs.region }}
+      EBK_RELEASE_SOURCE_COMMIT: \${{ needs.immutable-artifacts.outputs.source_commit || inputs.source_commit || github.sha }}
+      EBK_SLICE_PROJECTS: \${{ needs.prepare.outputs.slice_projects }}
+      EBK_SOURCE_COMMIT: \${{ inputs.source_commit || github.sha }}
+      EBK_STAGE: \${{ needs.prepare.outputs.stage }}
+      EBK_LIFECYCLE_SCOPE: \${{ inputs.lifecycle || 'affected' }}
+      EBK_BASELINE_FOUND: \${{ needs.immutable-artifacts.outputs.baseline_found }}
+      EBK_BASELINE_RUN_ID: \${{ needs.immutable-artifacts.outputs.baseline_run_id }}
+    steps:
+      - name: Check out immutable deployment source
+        uses: ${actionPins.checkout}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+      - uses: ${actionPins.pnpmSetup}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+      - uses: ${actionPins.setupNode}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          node-version: ${toolVersions.node}
+          cache: pnpm
+      - env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
+      - name: Verify managed workspace integrity before AWS authority
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: pnpm nx run ${name}:workspace-health
+      - name: Restore exact immutable release candidate
+        if: needs.prepare.outputs.action == 'deploy' && needs.prepare.outputs.has_slices == 'true'
+        uses: ${actionPins.downloadArtifact}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          artifact-ids: \${{ needs.immutable-artifacts.outputs.artifact_id }}
+          github-token: \${{ github.token }}
+          path: .ebk/evidence/release-candidate
+          run-id: \${{ needs.immutable-artifacts.outputs.producer_run_id }}
+      - name: Restore the baseline deployment receipt for unchanged Slices
+        if: needs.prepare.outputs.action == 'deploy' && needs.immutable-artifacts.outputs.baseline_found == 'true'
+        uses: ${actionPins.downloadArtifact}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          artifact-ids: \${{ needs.immutable-artifacts.outputs.baseline_artifact_id }}
+          github-token: \${{ github.token }}
+          path: \${{ runner.temp }}/ebk-deployment-baseline
+          run-id: \${{ needs.immutable-artifacts.outputs.baseline_run_id }}
+      - name: Restore exact current-stage container binding
+        if: >-
+          needs.prepare.outputs.action == 'deploy' &&
+          needs.prepare.outputs.has_containers == 'true' &&
+          (
+            needs.prepare.outputs.stage == 'staging' ||
+            (needs.prepare.outputs.stage == 'production' && needs.prepare.outputs.profile == 'starter')
+          )
+        uses: ${actionPins.downloadArtifact}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          name: container-release-\${{ needs.prepare.outputs.stage }}-\${{ github.run_id }}-\${{ github.run_attempt }}
+          path: .ebk/evidence/container-release
+      - name: Restore exact promoted production container binding
+        if: >-
+          needs.prepare.outputs.action == 'deploy' &&
+          needs.prepare.outputs.has_containers == 'true' &&
+          needs.prepare.outputs.stage == 'production' &&
+          needs.prepare.outputs.profile != 'starter'
+        uses: ${actionPins.downloadArtifact}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          name: container-release-production-\${{ github.run_id }}-\${{ github.run_attempt }}
+          path: .ebk/evidence/container-release
+      - name: Verify exact predeploy container binding inventory
+        if: >-
+          needs.prepare.outputs.action == 'deploy' &&
+          needs.prepare.outputs.has_containers == 'true' &&
+          needs.prepare.outputs.stage != 'development'
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_CONTAINER_PROJECTS: \${{ needs.prepare.outputs.container_projects }}
+        run: |
+          set -euo pipefail
+          IFS=',' read -r -a projects <<< "$EBK_CONTAINER_PROJECTS"
+          for project in "\${projects[@]}"; do
+            test -n "$project" || continue
+            test -f ".ebk/evidence/container-release/$EBK_STAGE/packages/$project/binding.json" || {
+              echo "Exact predeploy container binding is absent for $project"
+              exit 1
+            }
+          done
+      - name: Verify exact restored staging-tested release candidate
+        if: env.EBK_ACTION == 'deploy' && env.EBK_STAGE == 'production' && needs.prepare.outputs.profile != 'starter' && needs.prepare.outputs.has_slices == 'true'
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+          node --input-type=module <<'NODE'
+${indentedScript(restoredCandidateValidationScript(), 10)}
+          NODE
+      - name: Authorize deployed Blueprint trust before protected mutation
+        if: env.EBK_ACTION == 'deploy'
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_PROTECTED_BLUEPRINT_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+        run: |
+          set -euo pipefail
+          case "$EBK_PROTECTED_BLUEPRINT_COMMIT" in
+            ''|*[!0-9a-f]*) echo 'Protected Blueprint authority must be one full lowercase Git object ID'; exit 1 ;;
+          esac
+          test "\${#EBK_PROTECTED_BLUEPRINT_COMMIT}" -eq 40 ||
+            test "\${#EBK_PROTECTED_BLUEPRINT_COMMIT}" -eq 64 ||
+            { echo 'Protected Blueprint authority must be one full Git object ID'; exit 1; }
+          test "$(git rev-parse HEAD)" = "$EBK_PROTECTED_BLUEPRINT_COMMIT" ||
+            { echo 'Protected Blueprint authority differs from the exact workflow checkout'; exit 1; }
+          case "$EBK_STAGE" in
+            staging) protected_branch=develop ;;
+            production) protected_branch=main ;;
+            *) exit 1 ;;
+          esac
+          node tools/blueprint-trust-check.mjs \
+            --operation=deploy \
+            --protected-branch="$protected_branch" \
+            --protected-ref="$EBK_PROTECTED_BLUEPRINT_COMMIT" \
+            --output=.ebk/evidence/supply-chain/blueprint-trust.json
+      - name: Produce subject-bound protected scanner evidence
+        if: env.EBK_ACTION == 'deploy'
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: pnpm nx run ${name}:supply-chain-scan
+      - name: Enforce protected supply-chain policy before mutation
+        if: env.EBK_ACTION == 'deploy'
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: pnpm nx run ${name}:supply-chain-check-protected
+      - name: Install pinned Playwright Chromium for deployed smoke proofs
+        if: env.EBK_ACTION == 'deploy' && needs.prepare.outputs.has_slices == 'true'
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+${indentedScript(protectedBrowserInstallScript(), 10)}
+${machineCredentialRequestStep()}
+      - name: Revalidate exact protected branch tip before OIDC
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_SOURCE_BRANCH: \${{ env.EBK_DEPLOYMENT_SOURCE_BRANCH }}
+          EBK_SOURCE_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+          GH_REPO: \${{ github.repository }}
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+          [ "$(git rev-parse HEAD)" = "$EBK_SOURCE_COMMIT" ] || {
+            echo 'Deployment checkout differs from the exact protected source'; exit 1;
+          }
+          branch_tip="$(gh api "/repos/$GH_REPO/git/ref/heads/$EBK_SOURCE_BRANCH" --jq '.object.sha')"
+          [ "$branch_tip" = "$EBK_SOURCE_COMMIT" ] || {
+            echo 'Deployment source is no longer the exact protected branch tip'; exit 1;
+          }
+      - name: Assume the one stage deployment role
+        uses: ${actionPins.configureAwsCredentials}
+        with:
+          audience: \${{ needs.prepare.outputs.oidc_audience }}
+          aws-region: \${{ vars.AWS_REGION }}
+          role-session-name: ebk-native-\${{ github.run_id }}-\${{ github.run_attempt }}
+          role-to-assume: \${{ env.AWS_DEPLOY_ROLE_ARN }}
+      - name: Verify exact stage authority
+        run: |
+          set -euo pipefail
+          [ "$AWS_EXPECTED_ACCOUNT_ID" = "$EBK_POLICY_ACCOUNT_ID" ]
+          [ "$AWS_REGION" = "$EBK_POLICY_REGION" ]
+${indentedScript(exactStageDeployerGuardScript('Native lifecycle', '$EBK_POLICY_ACCOUNT_ID'), 10)}
+      - name: Run ordered native lifecycle targets
+        id: native-lifecycle
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_GITHUB_JOB_WORKFLOW_REF: \${{ job.workflow_ref }}
+          GITHUB_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+          test -n "$AWS_DEPLOY_ROLE_ARN" || { echo 'Stage deployment role is absent'; exit 1; }
+          if [ "$EBK_ACTION" = deploy ]; then
+            case "$EBK_LIFECYCLE_SCOPE" in affected|full) ;; *) echo 'Lifecycle scope must be affected or full'; exit 1 ;; esac
+            baseline_arguments=()
+            if [ "$EBK_LIFECYCLE_SCOPE" = affected ] && [ "$EBK_BASELINE_FOUND" = true ]; then
+              case "$EBK_BASELINE_RUN_ID" in ''|*[!0-9]*) echo 'Baseline run id is malformed'; exit 1 ;; esac
+              baseline_arguments=(
+                --baselineReceipt="$RUNNER_TEMP/ebk-deployment-baseline/deployment/latest.json"
+                --baselineRunId="$EBK_BASELINE_RUN_ID"
+                --baselineRunAttempt=1
+              )
+            fi
+            pnpm nx run ${name}:deploy-local -- \
+              --stage="$EBK_STAGE" \
+              --expectedRoleArn="$AWS_DEPLOY_ROLE_ARN" \
+              --lifecycleScope="$EBK_LIFECYCLE_SCOPE" \
+              "\${baseline_arguments[@]}"
+          else
+            [ -n "$EBK_ORDERED_PROJECTS" ] || { echo 'Committed deployment order is empty'; exit 1; }
+            IFS=',' read -r -a projects <<< "$EBK_ORDERED_PROJECTS"
+            seen=,
+            for project in "\${projects[@]}"; do
+              case "$project" in ''|*[!A-Za-z0-9_-]*) exit 1 ;; esac
+              case "$seen" in *,"$project",*) echo "Duplicate lifecycle project: $project"; exit 1 ;; esac
+              seen="$seen$project,"
+              pnpm nx run "$project:$EBK_ACTION" -- --stage="$EBK_STAGE" --region="$AWS_REGION" --expectedRoleArn="$AWS_DEPLOY_ROLE_ARN"
+            done
+          fi
+      - name: Prove temporary smoke admission removed
+        if: always() && env.EBK_ACTION == 'deploy' && steps.native-lifecycle.outcome != 'skipped'
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_GITHUB_JOB_WORKFLOW_REF: \${{ job.workflow_ref }}
+          GITHUB_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+${indentedScript(exactStageDeployerGuardScript('Smoke access cleanup', '$EBK_POLICY_ACCOUNT_ID'), 10)}
+          [ "$(git rev-parse HEAD)" = "$EBK_SOURCE_COMMIT" ]
+          git diff --quiet HEAD
+          node --input-type=module <<'NODE'
+          import { cleanupGithubPrivateSmoke } from '@empire-builder-kit/nx/foundation';
+          await cleanupGithubPrivateSmoke({
+            account: process.env.EBK_POLICY_ACCOUNT_ID,
+            deploymentProfile: process.env.EBK_DEPLOYMENT_PROFILE,
+            root: process.cwd(),
+            source: process.env.EBK_SOURCE_COMMIT,
+            stage: process.env.EBK_STAGE,
+            workspace: '${name}',
+          });
+          NODE
+      - name: Seal exact staging promotion receipt
+        if: env.EBK_ACTION == 'deploy' && env.EBK_STAGE == 'staging' && needs.prepare.outputs.profile != 'starter'
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_CONTAINER_ARTIFACT_DIGEST: \${{ needs.container-assemble.outputs.artifact_digest }}
+          EBK_CONTAINER_ARTIFACT_ID: \${{ needs.container-assemble.outputs.artifact_id }}
+          EBK_HAS_SLICES: \${{ needs.prepare.outputs.has_slices }}
+          EBK_HAS_CONTAINERS: \${{ needs.prepare.outputs.has_containers }}
+        run: |
+          node --input-type=module <<'NODE'
+${indentedScript(stagingPromotionSealScript(), 10)}
+          NODE
+      - name: Seal exact postdeploy supply-chain binding
+        if: env.EBK_ACTION == 'deploy' && env.EBK_STAGE != 'development' && needs.prepare.outputs.has_slices == 'true'
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+          node --input-type=module <<'NODE'
+${indentedScript(postdeploySupplyChainBindingScript(), 10)}
+          NODE
+      - name: Retain bounded deployment receipt
+        if: always() && needs.prepare.outputs.action == 'deploy'
+        uses: ${actionPins.uploadArtifact}
+        with:
+          if-no-files-found: warn
+          name: deployment-receipt-\${{ needs.prepare.outputs.stage }}-\${{ github.run_id }}-\${{ github.run_attempt }}
+          path: |
+            .ebk/evidence/deployment/latest.json
+            .ebk/evidence/deployment/postdeploy-supply-chain.json
+            .ebk/evidence/deployment/promotion.json
+            .ebk/evidence/container-release/**
+          retention-days: 30
+${deploymentProfile === 'starter' ? '' : renderRehearseJob(options)}${trunkPromotion ? renderTrunkPromotionJobs(options) : ''}`;
+}
+/**
+ * Managed Router WAF blocking rehearsal (EBK-INT-2026-079). The protected
+ * dispatch runs the foundation rehearsal target under the staging deployment
+ * role with seedProbes, so the runner performs the operator probes itself
+ * inside the private-smoke allowlist admission, proves the admission removed,
+ * and opens the pull request that carries the sealed evidence and receipt
+ * back to develop through the ordinary review path.
+ */
+function renderRehearseJob(options) {
+    const { actionPins, name, toolVersions } = options;
+    return `
+  rehearse:
+    name: rehearse staging Router WAF blocking
+    needs: prepare
+    if: >-
+      needs.prepare.result == 'success' &&
+      needs.prepare.outputs.action == 'rehearse' &&
+      needs.prepare.outputs.stage == 'staging' &&
+      needs.prepare.outputs.profile != 'starter'
+    runs-on: ubuntu-latest
+    environment: \${{ needs.prepare.outputs.stage }}
+    permissions:
+      actions: read
+      contents: write
+      id-token: write
+      pull-requests: write
+    env:
+      AWS_DEPLOY_ROLE_ARN: \${{ needs.prepare.outputs.stage_deploy_role_arn }}
+      AWS_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_EXPECTED_ACCOUNT_ID }}
+      AWS_PARTITION: \${{ needs.prepare.outputs.partition }}
+      AWS_REGION: \${{ vars.AWS_REGION }}
+      EBK_ACTION: rehearse
+      EBK_DEPLOYMENT_PROFILE: \${{ needs.prepare.outputs.profile }}
+      EBK_POLICY_ACCOUNT_ID: \${{ needs.prepare.outputs.account_id }}
+      EBK_POLICY_REGION: \${{ needs.prepare.outputs.region }}
+      EBK_PROBE_URL: \${{ needs.prepare.outputs.probe_url }}
+      EBK_SOURCE_COMMIT: \${{ inputs.source_commit || github.sha }}
+      EBK_STAGE: \${{ needs.prepare.outputs.stage }}
+    steps:
+      - name: Check out immutable deployment source
+        uses: ${actionPins.checkout}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+      - uses: ${actionPins.pnpmSetup}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+      - uses: ${actionPins.setupNode}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          node-version: ${toolVersions.node}
+          cache: pnpm
+      - env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
+      - name: Verify managed workspace integrity before AWS authority
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: pnpm nx run ${name}:workspace-health
+      - name: Require the exact pending rehearsal seeds
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+          set -euo pipefail
+          for seed in router-waf-live-evidence router-waf-blocking-rehearsal; do
+            [ "$(jq -r '.status // empty' "packages/foundation/security/$seed.json")" = pending ] || {
+              echo "packages/foundation/security/$seed.json must be reset to its pending seed before another rehearsal"; exit 1;
+            }
+          done
+      - name: Revalidate exact protected branch tip before OIDC
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_SOURCE_BRANCH: \${{ env.EBK_DEPLOYMENT_SOURCE_BRANCH }}
+          EBK_SOURCE_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+          GH_REPO: \${{ github.repository }}
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+          [ "$(git rev-parse HEAD)" = "$EBK_SOURCE_COMMIT" ] || {
+            echo 'Deployment checkout differs from the exact protected source'; exit 1;
+          }
+          branch_tip="$(gh api "/repos/$GH_REPO/git/ref/heads/$EBK_SOURCE_BRANCH" --jq '.object.sha')"
+          [ "$branch_tip" = "$EBK_SOURCE_COMMIT" ] || {
+            echo 'Deployment source is no longer the exact protected branch tip'; exit 1;
+          }
+      - name: Assume the one stage deployment role
+        uses: ${actionPins.configureAwsCredentials}
+        with:
+          audience: \${{ needs.prepare.outputs.oidc_audience }}
+          aws-region: \${{ vars.AWS_REGION }}
+          role-session-name: ebk-rehearse-\${{ github.run_id }}-\${{ github.run_attempt }}
+          role-to-assume: \${{ env.AWS_DEPLOY_ROLE_ARN }}
+      - name: Verify exact stage authority
+        run: |
+          set -euo pipefail
+          [ "$AWS_EXPECTED_ACCOUNT_ID" = "$EBK_POLICY_ACCOUNT_ID" ]
+          [ "$AWS_REGION" = "$EBK_POLICY_REGION" ]
+${indentedScript(exactStageDeployerGuardScript('Router WAF rehearsal', '$EBK_POLICY_ACCOUNT_ID'), 10)}
+      - name: Rehearse Router WAF blocking with runner-seeded probes
+        id: rehearsal
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_GITHUB_JOB_WORKFLOW_REF: \${{ job.workflow_ref }}
+          GITHUB_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+          test -n "$AWS_DEPLOY_ROLE_ARN" || { echo 'Stage deployment role is absent'; exit 1; }
+          pnpm nx run foundation:router-waf-rehearsal -- \\
+            --probeUrl="$EBK_PROBE_URL" \\
+            --seedProbes=true
+      - name: Prove temporary smoke admission removed
+        if: always() && steps.rehearsal.outcome != 'skipped'
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_GITHUB_JOB_WORKFLOW_REF: \${{ job.workflow_ref }}
+          GITHUB_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+${indentedScript(exactStageDeployerGuardScript('Smoke access cleanup', '$EBK_POLICY_ACCOUNT_ID'), 10)}
+          [ "$(git rev-parse HEAD)" = "$EBK_SOURCE_COMMIT" ]
+          node --input-type=module <<'NODE'
+          import { cleanupGithubPrivateSmoke } from '@empire-builder-kit/nx/foundation';
+          await cleanupGithubPrivateSmoke({
+            account: process.env.EBK_POLICY_ACCOUNT_ID,
+            deploymentProfile: process.env.EBK_DEPLOYMENT_PROFILE,
+            root: process.cwd(),
+            source: process.env.EBK_SOURCE_COMMIT,
+            stage: process.env.EBK_STAGE,
+            workspace: '${name}',
+          });
+          NODE
+      - name: Retain the sealed rehearsal evidence
+        uses: ${actionPins.uploadArtifact}
+        with:
+          if-no-files-found: error
+          name: router-waf-rehearsal-\${{ github.run_id }}-\${{ github.run_attempt }}
+          path: |
+            packages/foundation/security/router-waf-live-evidence.json
+            packages/foundation/security/router-waf-blocking-rehearsal.json
+          retention-days: 90
+      - name: Open the rehearsal receipt pull request
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_RUN_ATTEMPT: \${{ github.run_attempt }}
+          EBK_RUN_ID: \${{ github.run_id }}
+          GH_REPO: \${{ github.repository }}
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+          case "$EBK_RUN_ID:$EBK_RUN_ATTEMPT" in *[!0-9:]*|:*|*:) exit 1 ;; esac
+          branch="ebk/router-waf-rehearsal-$EBK_RUN_ID-$EBK_RUN_ATTEMPT"
+          git diff --quiet -- packages/foundation/security && { echo 'The rehearsal sealed nothing new'; exit 1; }
+          git config user.name 'ebk-router-waf-rehearsal[bot]'
+          git config user.email 'ebk-router-waf-rehearsal[bot]@users.noreply.github.com'
+          git checkout -q -b "$branch"
+          git add packages/foundation/security/router-waf-live-evidence.json packages/foundation/security/router-waf-blocking-rehearsal.json
+          git commit -q -m "chore(security): seal the staging Router WAF blocking rehearsal (run $EBK_RUN_ID)"
+          # git over HTTPS authenticates with basic x-access-token, the same
+          # header actions/checkout persists; a bearer header makes git fall
+          # back to a username prompt (EBK-INT-2026-085).
+          authorization="$(printf 'x-access-token:%s' "$GH_TOKEN" | base64 | tr -d '\\n')"
+          git -c "http.https://github.com/.extraheader=AUTHORIZATION: basic $authorization" push -q origin "HEAD:refs/heads/$branch"
+          gh pr create \\
+            --head "$branch" \\
+            --base develop \\
+            --title 'chore(security): seal the staging Router WAF blocking rehearsal' \\
+            --body "Managed rehearsal run $EBK_RUN_ID attempt $EBK_RUN_ATTEMPT sealed the staging Router WAF blocking rehearsal for the committed policy digest. Merge to unblock the production Router WAF gate; the receipt binds the exact account, Region, and policy digest."
+`;
+}
+/**
+ * Trunk promotion: after a successful staging lifecycle on develop, the same
+ * run binds its own staging receipt, promotes the reviewed OCI indexes into
+ * production, deploys production, and fast-forwards main to the deployed
+ * commit. Every job carries the production environment so environment
+ * reviewers can still gate it, and every step reuses the promotion-pr scripts.
+ */
+function renderTrunkPromotionJobs(options) {
+    const { actionPins, name, toolVersions } = options;
+    const checkoutAndInstall = (integrityStep) => `      - name: Check out immutable deployment source
+        uses: ${actionPins.checkout}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+          ref: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+      - uses: ${actionPins.pnpmSetup}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+      - uses: ${actionPins.setupNode}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          node-version: ${toolVersions.node}
+          cache: pnpm
+      - env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
+      - name: ${integrityStep}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: pnpm nx run ${name}:workspace-health`;
+    const revalidateTip = `      - name: Revalidate exact protected branch tip before OIDC
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_SOURCE_BRANCH: \${{ env.EBK_DEPLOYMENT_SOURCE_BRANCH }}
+          EBK_SOURCE_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+          GH_REPO: \${{ github.repository }}
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+          [ "$(git rev-parse HEAD)" = "$EBK_SOURCE_COMMIT" ] || {
+            echo 'Deployment checkout differs from the exact protected source'; exit 1;
+          }
+          branch_tip="$(gh api "/repos/$GH_REPO/git/ref/heads/$EBK_SOURCE_BRANCH" --jq '.object.sha')"
+          [ "$branch_tip" = "$EBK_SOURCE_COMMIT" ] || {
+            echo 'Deployment source is no longer the exact protected branch tip'; exit 1;
+          }`;
+    const trunkPromotionGate = `      needs.prepare.outputs.action == 'deploy' &&
+      needs.prepare.outputs.stage == 'staging' &&
+      needs.prepare.outputs.profile != 'starter' &&
+      needs.prepare.outputs.has_slices == 'true'`;
+    return `
+  promote-production:
+    name: promote the staging-tested candidate to production
+    needs: [prepare, immutable-artifacts, container-assemble, execute]
+    if: >-
+      always() &&
+      needs.prepare.result == 'success' &&
+      needs.immutable-artifacts.result == 'success' &&
+      (needs.prepare.outputs.has_containers != 'true' || needs.container-assemble.result == 'success') &&
+      needs.execute.result == 'success' &&
+${trunkPromotionGate}
+    runs-on: ubuntu-latest
+    environment: production
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+    outputs:
+      artifact_digest: \${{ steps.retain.outputs.artifact-digest }}
+      artifact_id: \${{ steps.retain.outputs.artifact-id }}
+      candidate_artifact_digest: \${{ steps.staging.outputs.artifact_digest }}
+      candidate_artifact_id: \${{ steps.staging.outputs.artifact_id }}
+      candidate_material_digest: \${{ steps.staging.outputs.candidate_material_digest }}
+      candidate_producer_run_attempt: \${{ steps.staging.outputs.producer_run_attempt }}
+      candidate_producer_run_id: \${{ steps.staging.outputs.producer_run_id }}
+    env:
+      AWS_DEPLOY_ROLE_ARN: \${{ needs.prepare.outputs.production_deploy_role_arn }}
+      AWS_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_EXPECTED_ACCOUNT_ID }}
+      AWS_PARTITION: \${{ needs.prepare.outputs.partition }}
+      AWS_REGION: \${{ vars.AWS_REGION }}
+      EBK_ACTION: deploy
+      EBK_DEPLOYMENT_PROFILE: \${{ needs.prepare.outputs.profile }}
+      EBK_POLICY_PRODUCTION_ACCOUNT_ID: \${{ needs.prepare.outputs.production_account_id }}
+      EBK_POLICY_REGION: \${{ needs.prepare.outputs.region }}
+      EBK_POLICY_STAGING_ACCOUNT_ID: \${{ needs.prepare.outputs.staging_account_id }}
+      EBK_RELEASE_SOURCE_COMMIT: \${{ needs.immutable-artifacts.outputs.source_commit }}
+      EBK_SOURCE_COMMIT: \${{ inputs.source_commit || github.sha }}
+      EBK_STAGE: production
+      EBK_SLICE_PROJECTS: \${{ needs.prepare.outputs.slice_projects }}
+      EBK_CONTAINER_PROJECTS: \${{ needs.prepare.outputs.container_projects }}
+    steps:
+${checkoutAndInstall('Verify managed workspace integrity before container authority')}
+      - id: staging-receipt
+        name: Select this run's staging deployment receipt
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_DEPLOYMENT_RUN_ATTEMPT: \${{ github.run_attempt }}
+          EBK_DEPLOYMENT_RUN_ID: \${{ github.run_id }}
+          GH_REPO: \${{ github.repository }}
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+          case "$EBK_DEPLOYMENT_RUN_ID:$EBK_DEPLOYMENT_RUN_ATTEMPT" in *[!0-9:]*|:*|*:) exit 1 ;; esac
+          artifacts="$(gh api "/repos/$GH_REPO/actions/runs/$EBK_DEPLOYMENT_RUN_ID/artifacts?per_page=100")"
+          receipt_name="deployment-receipt-staging-$EBK_DEPLOYMENT_RUN_ID-$EBK_DEPLOYMENT_RUN_ATTEMPT"
+          receipt="$(printf '%s' "$artifacts" | jq -c --arg name "$receipt_name" \\
+            '[.artifacts[] | select(.name == $name and .expired == false)] | if length == 1 then .[0] else empty end')"
+          [ -n "$receipt" ] || { echo 'This run retained no exact staging deployment receipt'; exit 1; }
+          artifact_id="$(printf '%s' "$receipt" | jq -r '.id // empty')"
+          artifact_digest="$(printf '%s' "$receipt" | jq -r '.digest // empty')"
+          case "$artifact_id" in ''|*[!0-9]*) exit 1 ;; esac
+          case "$artifact_digest" in sha256:????????????????????????????????????????????????????????????????) ;; *) exit 1 ;; esac
+          echo "artifact_digest=$artifact_digest" >> "$GITHUB_OUTPUT"
+          echo "artifact_id=$artifact_id" >> "$GITHUB_OUTPUT"
+      - name: Restore this run's staging deployment receipt
+        uses: ${actionPins.downloadArtifact}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          artifact-ids: \${{ steps.staging-receipt.outputs.artifact_id }}
+          github-token: \${{ github.token }}
+          path: \${{ runner.temp }}/staging-deployment-receipt
+      - id: staging
+        name: Bind exact staging deployment and release evidence
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_STAGING_DEPLOYMENT_RUN_ATTEMPT: \${{ github.run_attempt }}
+          EBK_STAGING_DEPLOYMENT_RUN_ID: \${{ github.run_id }}
+          EBK_EXPECTED_HAS_SLICES: \${{ needs.prepare.outputs.has_slices }}
+          EBK_EXPECTED_HAS_CONTAINERS: \${{ needs.prepare.outputs.has_containers }}
+          EBK_EXPECTED_DEPLOYMENT_PROFILE: \${{ needs.prepare.outputs.profile }}
+          EBK_EXPECTED_DEPLOYMENT_REGION: \${{ needs.prepare.outputs.region }}
+          EBK_EXPECTED_STAGING_ACCOUNT_ID: \${{ needs.prepare.outputs.staging_account_id }}
+          EBK_STAGING_RECEIPT_ARTIFACT_DIGEST: \${{ steps.staging-receipt.outputs.artifact_digest }}
+          EBK_STAGING_RECEIPT_ARTIFACT_ID: \${{ steps.staging-receipt.outputs.artifact_id }}
+          # The receipt artifact keeps .ebk/evidence as its root (EBK-INT-2026-074).
+          EBK_STAGING_RECEIPT_ROOT: \${{ runner.temp }}/staging-deployment-receipt/deployment
+          EBK_STAGING_SOURCE_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+          GH_REPO: \${{ github.repository }}
+          GH_TOKEN: \${{ github.token }}
+        run: |
+          node --input-type=module <<'NODE'
+${indentedScript(stagingPromotionReceiptValidationScript(), 10)}
+          NODE
+          promotion="$EBK_STAGING_RECEIPT_ROOT/promotion.json"
+          candidate_run_id="$(jq -r '.candidate.producerRunId' "$promotion")"
+          candidate_run_attempt="$(jq -r '.candidate.producerRunAttempt' "$promotion")"
+          candidate_artifact_id="$(jq -r '.candidate.artifactId' "$promotion")"
+          candidate_artifact_digest="$(jq -r '.candidate.artifactDigest' "$promotion")"
+          candidate_run="$(gh api "/repos/$GH_REPO/actions/runs/$candidate_run_id")"
+          printf '%s' "$candidate_run" | jq -e \\
+            --arg source "$EBK_STAGING_SOURCE_COMMIT" \\
+            --arg attempt "$candidate_run_attempt" \\
+            '.head_sha == $source and .head_branch == "develop" and .event == "push" and .path == ".github/workflows/ci.yml" and .conclusion == "success" and (.run_attempt | tostring) == $attempt' >/dev/null
+          candidate_artifacts="$(gh api "/repos/$GH_REPO/actions/runs/$candidate_run_id/artifacts?per_page=100")"
+          printf '%s' "$candidate_artifacts" | jq -e \\
+            --arg id "$candidate_artifact_id" \\
+            --arg digest "$candidate_artifact_digest" \\
+            --arg name "release-candidate-$EBK_STAGING_SOURCE_COMMIT" \\
+            '[.artifacts[] | select((.id | tostring) == $id and .name == $name and .digest == $digest and .expired == false)] | length == 1' >/dev/null
+      - name: Restore exact immutable release candidate for promotion
+        uses: ${actionPins.downloadArtifact}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          artifact-ids: \${{ steps.staging.outputs.artifact_id }}
+          github-token: \${{ github.token }}
+          path: .ebk/evidence/release-candidate
+          run-id: \${{ steps.staging.outputs.producer_run_id }}
+      - name: Restore this run's staging container bundle
+        if: needs.prepare.outputs.has_containers == 'true'
+        uses: ${actionPins.downloadArtifact}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          artifact-ids: \${{ steps.staging.outputs.container_artifact_id }}
+          github-token: \${{ github.token }}
+          path: .ebk/evidence/container-release
+${revalidateTip}
+      - name: Assume exact staging registry pull role
+        if: needs.prepare.outputs.has_containers == 'true'
+        uses: ${actionPins.configureAwsCredentials}
+        with:
+          audience: \${{ needs.prepare.outputs.oidc_audience }}
+          aws-region: \${{ vars.AWS_STAGING_PROMOTION_REGION }}
+          role-session-name: ebk-staging-container-pull-\${{ github.run_id }}-\${{ github.run_attempt }}
+          role-to-assume: \${{ secrets.AWS_STAGING_PROMOTION_PULL_ROLE_ARN }}
+      - name: Authenticate exact staging source registry
+        if: needs.prepare.outputs.has_containers == 'true'
+        env:
+          AWS_STAGING_PROMOTION_PULL_ROLE_ARN: \${{ secrets.AWS_STAGING_PROMOTION_PULL_ROLE_ARN }}
+          EBK_STAGING_ACCOUNT_ID: \${{ vars.AWS_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID }}
+          EBK_STAGING_REGION: \${{ vars.AWS_STAGING_PROMOTION_REGION }}
+        run: |
+          set -euo pipefail
+          [ "$EBK_STAGING_ACCOUNT_ID" = "$EBK_POLICY_STAGING_ACCOUNT_ID" ]
+          [ "$EBK_STAGING_REGION" = "$EBK_POLICY_REGION" ]
+${indentedScript(exactStagingPromotionPullGuardScript(), 10)}
+          [ "$EBK_STAGING_ACCOUNT_ID" != "$AWS_EXPECTED_ACCOUNT_ID" ]
+          registry_suffix=.com
+          case "$EBK_STAGING_REGION" in cn-*) registry_suffix=.com.cn ;; esac
+          aws ecr get-login-password --region "$EBK_STAGING_REGION" |
+            docker login --username AWS --password-stdin \\
+              "$EBK_STAGING_ACCOUNT_ID.dkr.ecr.$EBK_STAGING_REGION.amazonaws$registry_suffix"
+${revalidateTip}
+      - name: Assume the production deployment role for container promotion
+        if: needs.prepare.outputs.has_containers == 'true'
+        uses: ${actionPins.configureAwsCredentials}
+        with:
+          audience: \${{ needs.prepare.outputs.oidc_audience }}
+          aws-region: \${{ vars.AWS_REGION }}
+          role-session-name: ebk-production-container-push-\${{ github.run_id }}-\${{ github.run_attempt }}
+          role-to-assume: \${{ env.AWS_DEPLOY_ROLE_ARN }}
+      - name: Promote exact staging indexes without rebuilding
+        if: needs.prepare.outputs.has_containers == 'true'
+        env:
+          EBK_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID }}
+          EBK_STAGING_PROMOTION_REGION: \${{ vars.AWS_STAGING_PROMOTION_REGION }}
+        run: |
+          set -euo pipefail
+          [ "$AWS_EXPECTED_ACCOUNT_ID" = "$EBK_POLICY_PRODUCTION_ACCOUNT_ID" ]
+          [ "$AWS_REGION" = "$EBK_POLICY_REGION" ]
+${indentedScript(exactStageDeployerGuardScript('Container promotion', '$AWS_EXPECTED_ACCOUNT_ID'), 10)}
+          IFS=',' read -r -a projects <<< "$EBK_CONTAINER_PROJECTS"
+          for project in "\${projects[@]}"; do
+            test -n "$project" || continue
+            # Repository-relative for the container release tool (EBK-INT-2026-077).
+            export EBK_CONTAINER_PROMOTION_SOURCE_BINDING_PATH=".ebk/evidence/container-release/staging/packages/$project/binding.json"
+            export EBK_CONTAINER_PROMOTION_SOURCE_SIDECAR_PATH=".ebk/evidence/container-release/staging/packages/$project/release-bound-binding.json"
+            pnpm nx run "$project:container-release-promote"
+          done
+      - id: retain
+        name: Retain production target container binding
+        if: needs.prepare.outputs.has_containers == 'true'
+        uses: ${actionPins.uploadArtifact}
+        with:
+          name: container-release-production-\${{ github.run_id }}-\${{ github.run_attempt }}
+          if-no-files-found: error
+          include-hidden-files: true
+          retention-days: 90
+          path: .ebk/evidence/container-release
+
+  execute-production:
+    name: native deploy production
+    needs: [prepare, immutable-artifacts, promote-production]
+    if: >-
+      always() &&
+      needs.prepare.result == 'success' &&
+      needs.immutable-artifacts.result == 'success' &&
+      needs.promote-production.result == 'success' &&
+${trunkPromotionGate}
+    runs-on: ubuntu-latest
+    environment: production
+    permissions:
+      actions: read
+      contents: read
+      id-token: write
+    env:
+      AWS_DEPLOY_ROLE_ARN: \${{ needs.prepare.outputs.production_deploy_role_arn }}
+      AWS_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_EXPECTED_ACCOUNT_ID }}
+      AWS_PARTITION: \${{ needs.prepare.outputs.partition }}
+      AWS_REGION: \${{ vars.AWS_REGION }}
+      EBK_ACTION: deploy
+      EBK_ALLOW_PRODUCTION_REMOVE: \${{ vars.EBK_ALLOW_PRODUCTION_REMOVE }}
+      EBK_CANDIDATE_ARTIFACT_DIGEST: \${{ needs.promote-production.outputs.candidate_artifact_digest }}
+      EBK_CANDIDATE_ARTIFACT_ID: \${{ needs.promote-production.outputs.candidate_artifact_id }}
+      EBK_CANDIDATE_MATERIAL_DIGEST: \${{ needs.promote-production.outputs.candidate_material_digest }}
+      EBK_CANDIDATE_PRODUCER_RUN_ATTEMPT: \${{ needs.promote-production.outputs.candidate_producer_run_attempt }}
+      EBK_CANDIDATE_PRODUCER_RUN_ID: \${{ needs.promote-production.outputs.candidate_producer_run_id }}
+      EBK_DEPLOYMENT_PROFILE: \${{ needs.prepare.outputs.profile }}
+      EBK_ORDERED_PROJECTS: \${{ needs.prepare.outputs.ordered_projects }}
+      EBK_POLICY_ACCOUNT_ID: \${{ needs.prepare.outputs.production_account_id }}
+      EBK_POLICY_REGION: \${{ needs.prepare.outputs.region }}
+      EBK_RELEASE_SOURCE_COMMIT: \${{ needs.immutable-artifacts.outputs.source_commit || inputs.source_commit || github.sha }}
+      EBK_SLICE_PROJECTS: \${{ needs.prepare.outputs.slice_projects }}
+      EBK_SOURCE_COMMIT: \${{ inputs.source_commit || github.sha }}
+      EBK_STAGE: production
+      # Production has no same-branch baseline receipt in this run; the
+      # full lifecycle keeps its evidence complete.
+      EBK_LIFECYCLE_SCOPE: full
+      EBK_BASELINE_FOUND: 'false'
+      EBK_BASELINE_RUN_ID: ''
+    steps:
+${checkoutAndInstall('Verify managed workspace integrity before AWS authority')}
+      - name: Restore exact immutable release candidate
+        uses: ${actionPins.downloadArtifact}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          artifact-ids: \${{ needs.promote-production.outputs.candidate_artifact_id }}
+          github-token: \${{ github.token }}
+          path: .ebk/evidence/release-candidate
+          run-id: \${{ needs.promote-production.outputs.candidate_producer_run_id }}
+      - name: Restore exact promoted production container binding
+        if: needs.prepare.outputs.has_containers == 'true'
+        uses: ${actionPins.downloadArtifact}
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        with:
+          name: container-release-production-\${{ github.run_id }}-\${{ github.run_attempt }}
+          path: .ebk/evidence/container-release
+      - name: Verify exact predeploy container binding inventory
+        if: needs.prepare.outputs.has_containers == 'true'
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_CONTAINER_PROJECTS: \${{ needs.prepare.outputs.container_projects }}
+        run: |
+          set -euo pipefail
+          IFS=',' read -r -a projects <<< "$EBK_CONTAINER_PROJECTS"
+          for project in "\${projects[@]}"; do
+            test -n "$project" || continue
+            test -f ".ebk/evidence/container-release/$EBK_STAGE/packages/$project/binding.json" || {
+              echo "Exact predeploy container binding is absent for $project"
+              exit 1
+            }
+          done
+      - name: Verify exact restored staging-tested release candidate
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+          node --input-type=module <<'NODE'
+${indentedScript(restoredCandidateValidationScript(), 10)}
+          NODE
+      - name: Authorize deployed Blueprint trust before protected mutation
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_PROTECTED_BLUEPRINT_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+        run: |
+          set -euo pipefail
+          case "$EBK_PROTECTED_BLUEPRINT_COMMIT" in
+            ''|*[!0-9a-f]*) echo 'Protected Blueprint authority must be one full lowercase Git object ID'; exit 1 ;;
+          esac
+          test "\${#EBK_PROTECTED_BLUEPRINT_COMMIT}" -eq 40 ||
+            test "\${#EBK_PROTECTED_BLUEPRINT_COMMIT}" -eq 64 ||
+            { echo 'Protected Blueprint authority must be one full Git object ID'; exit 1; }
+          test "$(git rev-parse HEAD)" = "$EBK_PROTECTED_BLUEPRINT_COMMIT" ||
+            { echo 'Protected Blueprint authority differs from the exact workflow checkout'; exit 1; }
+          node tools/blueprint-trust-check.mjs \\
+            --operation=deploy \\
+            --protected-branch=main \\
+            --protected-ref="$EBK_PROTECTED_BLUEPRINT_COMMIT" \\
+            --output=.ebk/evidence/supply-chain/blueprint-trust.json
+      - name: Produce subject-bound protected scanner evidence
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: pnpm nx run ${name}:supply-chain-scan
+      - name: Enforce protected supply-chain policy before mutation
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: pnpm nx run ${name}:supply-chain-check-protected
+      - name: Install pinned Playwright Chromium for deployed smoke proofs
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+${indentedScript(protectedBrowserInstallScript(), 10)}
+${machineCredentialRequestStep()}
+${revalidateTip}
+      - name: Assume the one stage deployment role
+        uses: ${actionPins.configureAwsCredentials}
+        with:
+          audience: \${{ needs.prepare.outputs.oidc_audience }}
+          aws-region: \${{ vars.AWS_REGION }}
+          role-session-name: ebk-native-\${{ github.run_id }}-\${{ github.run_attempt }}
+          role-to-assume: \${{ env.AWS_DEPLOY_ROLE_ARN }}
+      - name: Verify exact stage authority
+        run: |
+          set -euo pipefail
+          [ "$AWS_EXPECTED_ACCOUNT_ID" = "$EBK_POLICY_ACCOUNT_ID" ]
+          [ "$AWS_REGION" = "$EBK_POLICY_REGION" ]
+${indentedScript(exactStageDeployerGuardScript('Native lifecycle', '$EBK_POLICY_ACCOUNT_ID'), 10)}
+      - name: Run ordered native lifecycle targets
+        id: native-lifecycle
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_GITHUB_JOB_WORKFLOW_REF: \${{ job.workflow_ref }}
+          GITHUB_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+          test -n "$AWS_DEPLOY_ROLE_ARN" || { echo 'Stage deployment role is absent'; exit 1; }
+          pnpm nx run ${name}:deploy-local -- \\
+            --stage="$EBK_STAGE" \\
+            --expectedRoleArn="$AWS_DEPLOY_ROLE_ARN" \\
+            --lifecycleScope="$EBK_LIFECYCLE_SCOPE"
+      - name: Prove temporary smoke admission removed
+        if: always() && steps.native-lifecycle.outcome != 'skipped'
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_GITHUB_JOB_WORKFLOW_REF: \${{ job.workflow_ref }}
+          GITHUB_TOKEN: \${{ github.token }}
+        run: |
+          set -euo pipefail
+${indentedScript(exactStageDeployerGuardScript('Smoke access cleanup', '$EBK_POLICY_ACCOUNT_ID'), 10)}
+          [ "$(git rev-parse HEAD)" = "$EBK_SOURCE_COMMIT" ]
+          git diff --quiet HEAD
+          node --input-type=module <<'NODE'
+          import { cleanupGithubPrivateSmoke } from '@empire-builder-kit/nx/foundation';
+          await cleanupGithubPrivateSmoke({
+            account: process.env.EBK_POLICY_ACCOUNT_ID,
+            deploymentProfile: process.env.EBK_DEPLOYMENT_PROFILE,
+            root: process.cwd(),
+            source: process.env.EBK_SOURCE_COMMIT,
+            stage: process.env.EBK_STAGE,
+            workspace: '${name}',
+          });
+          NODE
+      - name: Seal exact postdeploy supply-chain binding
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+        run: |
+          node --input-type=module <<'NODE'
+${indentedScript(postdeploySupplyChainBindingScript(), 10)}
+          NODE
+      - name: Retain bounded deployment receipt
+        if: always()
+        uses: ${actionPins.uploadArtifact}
+        with:
+          if-no-files-found: warn
+          name: deployment-receipt-production-\${{ github.run_id }}-\${{ github.run_attempt }}
+          path: |
+            .ebk/evidence/deployment/latest.json
+            .ebk/evidence/deployment/postdeploy-supply-chain.json
+            .ebk/evidence/deployment/promotion.json
+            .ebk/evidence/container-release/**
+          retention-days: 30
+
+  record-main:
+    name: record the deployed commit on main
+    needs: [prepare, execute-production]
+    if: >-
+      always() &&
+      needs.prepare.result == 'success' &&
+      needs.execute-production.result == 'success' &&
+${trunkPromotionGate}
+    runs-on: ubuntu-latest
+    environment: production
+    # The fast-forward uses the scoped environment token, not the workflow token.
+    permissions:
+      contents: read
+    steps:
+      - name: Fast-forward protected main to the deployed commit
+        env:
+          EBK_RECORD_MAIN_TOKEN: \${{ secrets.${exports.EBK_RECORD_MAIN_TOKEN_SECRET} }}
+          EBK_SOURCE_BRANCH: \${{ env.EBK_DEPLOYMENT_SOURCE_BRANCH }}
+          EBK_SOURCE_COMMIT: \${{ env.EBK_DEPLOYMENT_SOURCE_COMMIT }}
+          GH_REPO: \${{ github.repository }}
+        run: |
+          set -euo pipefail
+          test -n "$EBK_RECORD_MAIN_TOKEN" || { echo '${exports.EBK_RECORD_MAIN_TOKEN_SECRET} is absent from the production environment'; exit 1; }
+          [ "$EBK_SOURCE_BRANCH" = develop ] || { echo 'Trunk promotion records main only from develop'; exit 1; }
+          case "$EBK_SOURCE_COMMIT" in ''|*[!0-9a-f]*) exit 1 ;; esac
+          export GH_TOKEN="$EBK_RECORD_MAIN_TOKEN"
+          develop_tip="$(gh api "/repos/$GH_REPO/git/ref/heads/develop" --jq '.object.sha')"
+          [ "$develop_tip" = "$EBK_SOURCE_COMMIT" ] || { echo 'Deployed commit is no longer the develop tip; leaving main unchanged'; exit 1; }
+          main_tip="$(gh api "/repos/$GH_REPO/git/ref/heads/main" --jq '.object.sha')"
+          if [ "$main_tip" = "$EBK_SOURCE_COMMIT" ]; then
+            echo 'main already records the deployed commit'
+            exit 0
+          fi
+          # GitHub refuses a non-fast-forward reference update unless force is
+          # requested; it is never requested here.
+          gh api -X PATCH "/repos/$GH_REPO/git/refs/heads/main" -f sha="$EBK_SOURCE_COMMIT" -F force=false >/dev/null
+          recorded="$(gh api "/repos/$GH_REPO/git/ref/heads/main" --jq '.object.sha')"
+          [ "$recorded" = "$EBK_SOURCE_COMMIT" ] || { echo 'main did not record the deployed commit'; exit 1; }
+          echo "main now records $EBK_SOURCE_COMMIT (previously $main_tip)"
+`;
+}
+function renderThinDeployWorkflowFilePlan(options) {
+    assertOptions(options);
+    return {
+        files: {
+            [exports.THIN_DEPLOY_WORKFLOW_PATH]: renderThinDeployWorkflow(options),
+        },
+        managedPaths: [exports.THIN_DEPLOY_WORKFLOW_PATH],
+    };
+}
+//# sourceMappingURL=workspace-files-thin-deploy.js.map