@empire-builder-kit/nx 1.0.0-rc.4 → 1.0.0-rc.41

package/src/generators/preset/workspace-files.js

@@ -7,19 +7,27 @@ exports.renderWorkspaceFiles = renderWorkspaceFiles;
 exports.renderWorkspaceRootFilePlan = renderWorkspaceRootFilePlan;
 exports.renderFoundationFilePlan = renderFoundationFilePlan;
 const sensitive_patterns_1 = require("@empire-builder-kit/runtime/sensitive-patterns");
+const dependency_overrides_js_1 = require("./dependency-overrides.js");
 const index_js_1 = require("../../ownership/index.js");
 const index_js_2 = require("../../frontend-security/index.js");
+const capability_plan_js_1 = require("../../foundation/capability-plan.js");
+const cost_estimate_js_1 = require("../../foundation/cost-estimate.js");
 const index_js_3 = require("../../git-policy/index.js");
 const index_js_4 = require("../../repository-policy/index.js");
 const index_js_5 = require("../../release/index.js");
 const index_js_6 = require("../../supply-chain/index.js");
 const deterministic_order_js_1 = require("../../deterministic-order.js");
 const tool_versions_js_1 = require("./tool-versions.js");
+const workspace_files_shared_operation_claims_js_1 = require("./workspace-files-shared-operation-claims.js");
 const workspace_files_developer_agent_js_1 = require("./workspace-files-developer-agent.js");
-const workspace_files_foundation_workload_roles_js_1 = require("./workspace-files-foundation-workload-roles.js");
-const workspace_files_performance_cost_js_1 = require("./workspace-files-performance-cost.js");
-const workspace_files_performance_load_js_1 = require("./workspace-files-performance-load.js");
-const workspace_files_workload_role_baseline_js_1 = require("./workspace-files-workload-role-baseline.js");
+const workspace_files_ci_acceptance_js_1 = require("./workspace-files-ci-acceptance.js");
+const workspace_files_ci_install_js_1 = require("./workspace-files-ci-install.js");
+const workspace_files_adopter_skills_js_1 = require("./workspace-files-adopter-skills.js");
+const workspace_files_ecr_inspector_js_1 = require("./workspace-files-ecr-inspector.js");
+const workspace_files_thin_deploy_js_1 = require("./workspace-files-thin-deploy.js");
+const workspace_files_thin_docs_js_1 = require("./workspace-files-thin-docs.js");
+const workspace_files_thin_release_js_1 = require("./workspace-files-thin-release.js");
+const workspace_files_stage_authority_js_1 = require("./workspace-files-stage-authority.js");
 const GENERATED_CREDENTIAL_SHAPE_PATTERNS = `[${sensitive_patterns_1.CREDENTIAL_SHAPE_DEFINITIONS.map(({ pattern }) => `new RegExp(${JSON.stringify(pattern.source)}, ${JSON.stringify(pattern.flags)})`).join(',')}]`;
 const GENERATED_RELEASE_ROLLOUT_PLAN_ID_PATTERN = JSON.stringify(index_js_5.RELEASE_ROLLOUT_PLAN_ID_PATTERN_SOURCE);
 exports.BLUEPRINT_TRUST_AUTHORITY_PATH = 'tools/blueprint-trust-check.mjs';
@@ -60,11 +68,12 @@ exports.PLAN_PROVIDER_REFRESH_GLOBAL_READ_ACTIONS = [
     'rds:DescribeDBProxies',
     'rds:DescribeDBSubnetGroups',
 ];
-function validatePlanProviderRefreshPolicy(value, region, account) {
+function validatePlanProviderRefreshPolicy(value, region, account, stage) {
     if (!Array.isArray(value) ||
         value.length === 0 ||
         !/^[a-z]{2}(?:-gov)?-[a-z]+-\d$/.test(region) ||
-        !/^\d{12}$/.test(account)) {
+        !/^\d{12}$/.test(account) ||
+        !['production', 'staging'].includes(stage)) {
         throw new Error('Provider refresh policy must be a non-empty exact statement array for one account and region.');
     }
     const allowed = new Set(exports.PLAN_PROVIDER_REFRESH_READ_ACTIONS);
@@ -117,6 +126,14 @@ function validatePlanProviderRefreshPolicy(value, region, account) {
             if (resources.some((resource) => {
                 const arn = resource.split(':');
                 const target = arn.slice(5).join(':');
+                const boundedPathWildcard = target.endsWith('/*') && !/[*?]/.test(target.slice(0, -2));
+                const boundedLambdaStagePrefix = arn[2] === 'lambda' &&
+                    actions.every((action) => action.startsWith('lambda:') && !global.has(action)) &&
+                    new RegExp('^function:(?:' +
+                        stage +
+                        '-|[A-Za-z0-9][A-Za-z0-9_-]*-' +
+                        stage +
+                        '-)[A-Za-z0-9_-]*\\*$').test(target);
                 return (arn[0] !== 'arn' ||
                     arn[1] !== 'aws' ||
                     !/^[a-z0-9-]+$/.test(arn[2] ?? '') ||
@@ -124,7 +141,8 @@ function validatePlanProviderRefreshPolicy(value, region, account) {
                     !['', account].includes(arn[4] ?? '') ||
                     !target ||
                     (/[*?]/.test(target) &&
-                        (!target.endsWith('/*') || /[*?]/.test(target.slice(0, -2)))));
+                        !boundedPathWildcard &&
+                        !boundedLambdaStagePrefix));
             })) {
                 throw new Error(`Provider refresh statement ${index} is not bounded to exact targets in the selected account and region.`);
             }
@@ -161,6 +179,51 @@ const TOOL_VERSIONS = {
 function json(value) {
     return `${JSON.stringify(value, null, 2)}\n`;
 }
+function indentWorkflowScript(source, spaces) {
+    const prefix = ' '.repeat(spaces);
+    return source
+        .trim()
+        .split('\n')
+        .map((line) => `${prefix}${line}`)
+        .join('\n');
+}
+function protectedSecretPolicyDerivationScript() {
+    return `node --input-type=module <<'NODE'
+import { appendFileSync } from 'node:fs';
+import {
+  configuredDeploymentAccountForStage,
+  configuredDeploymentRegion,
+  isActiveDeploymentStage,
+  readRepositoryOperatingPolicy,
+} from '@empire-builder-kit/nx/repository-policy';
+
+const output = process.env.GITHUB_OUTPUT?.trim() ?? '';
+const renderedProfile = process.env.EBK_RENDERED_PROFILE?.trim() ?? '';
+const stage = process.env.EBK_STAGE?.trim() ?? '';
+if (!output) throw new Error('Secret workflow authority output is unavailable.');
+const policy = readRepositoryOperatingPolicy(process.cwd());
+if (policy.deploymentProfile !== renderedProfile) {
+  throw new Error('Generated and committed deployment profiles differ.');
+}
+if (!isActiveDeploymentStage(policy.deploymentProfile, stage)) {
+  throw new Error('Secret workflow stage is inactive for the committed deployment profile.');
+}
+configuredDeploymentAccountForStage(
+  policy.deploymentProfile,
+  policy.deploymentAccounts,
+  stage,
+);
+const accounts = policy.deploymentAccounts;
+const region = configuredDeploymentRegion(policy.deploymentRegion);
+appendFileSync(output, [
+  'deployment_region=' + region,
+  'development_account_id=' + (accounts.development ?? ''),
+  'staging_account_id=' + (accounts.staging ?? ''),
+  'production_account_id=' + (accounts.production ?? ''),
+  '',
+].join('\\n'));
+NODE`;
+}
 function planApplicationBindingCheck() {
     return `          node - <<'NODE'
           const declared = JSON.parse(process.env.AWS_PLAN_SST_APPS_JSON ?? '');
@@ -474,6 +537,8 @@ function planRoleAuditStep(branch, mode = 'produce') {
           EBK_PLAN_ENVIRONMENT: infrastructure-plan-${stage}
           EBK_PLAN_ROLE_ARN: \${{ env.AWS_PLAN_ROLE_ARN }}
           EBK_PLAN_REPOSITORY: \${{ github.repository }}
+          EBK_PLAN_REPOSITORY_ID: \${{ github.repository_id }}
+          EBK_PLAN_REPOSITORY_OWNER_ID: \${{ github.repository_owner_id }}
         run: |
           role_name="\${EBK_PLAN_ROLE_ARN##*/}"
           test "$(aws sts get-caller-identity --query Account --output text)" = "$AWS_EXPECTED_ACCOUNT_ID" ||
@@ -506,8 +571,23 @@ function planRoleAuditStep(branch, mode = 'produce') {
           const role = JSON.parse(readFileSync(process.argv[2], 'utf8')).Role;
           const policy = JSON.parse(readFileSync(process.argv[3], 'utf8')).PolicyDocument;
           const account = process.env.AWS_EXPECTED_ACCOUNT_ID;
+          const repository = process.env.EBK_PLAN_REPOSITORY ?? '';
+          const repositoryId = process.env.EBK_PLAN_REPOSITORY_ID ?? '';
+          const repositoryOwnerId = process.env.EBK_PLAN_REPOSITORY_OWNER_ID ?? '';
           const stateBucketArn = process.env.AWS_PLAN_STATE_BUCKET_ARN;
           const stateKmsKeyArn = process.env.AWS_PLAN_STATE_KMS_KEY_ARN;
+          if (
+            !/^[A-Za-z0-9](?:[A-Za-z0-9-]{0,38})\\/[A-Za-z0-9_.-]{1,100}$/.test(
+              repository,
+            ) ||
+            !/^[1-9][0-9]*$/.test(repositoryOwnerId) ||
+            !/^[1-9][0-9]*$/.test(repositoryId)
+          ) throw new Error('Exact immutable GitHub repository identity is required.');
+          const [repositoryOwner, repositoryName] = repository.split('/');
+          const oidcSubject =
+            'repo:' + repositoryOwner + '@' + repositoryOwnerId + '/' +
+            repositoryName + '@' + repositoryId + ':environment:' +
+            process.env.EBK_PLAN_ENVIRONMENT;
           const parseExactArnArray = (name, pattern) => {
             let value;
             try {
@@ -551,6 +631,7 @@ function planRoleAuditStep(branch, mode = 'produce') {
             'AWS_PLAN_GENERATED_SECRET_ARNS_JSON',
             new RegExp('^arn:aws:secretsmanager:' + process.env.AWS_REGION + ':' + account + ':secret:ebk/'),
           );
+          const stateStage = process.env.EBK_PLAN_BRANCH === 'main' ? 'production' : 'staging';
           let providerRefreshPolicy;
           try {
             providerRefreshPolicy = JSON.parse(
@@ -614,6 +695,23 @@ function planRoleAuditStep(branch, mode = 'produce') {
                 for (const resource of resources) {
                   const arn = resource.split(':');
                   const target = arn.slice(5).join(':');
+                  const boundedPathWildcard =
+                    target.endsWith('/*') &&
+                    !/[*?]/.test(target.slice(0, -2));
+                  const boundedLambdaStagePrefix =
+                    arn[2] === 'lambda' &&
+                    actions.every(
+                      (action) =>
+                        action.startsWith('lambda:') &&
+                        !globalProviderReadActions.has(action),
+                    ) &&
+                    new RegExp(
+                      '^function:(?:' +
+                        stateStage +
+                        '-|[A-Za-z0-9][A-Za-z0-9_-]*-' +
+                        stateStage +
+                        '-)[A-Za-z0-9_-]*\\\\*$',
+                    ).test(target);
                   if (
                     arn[0] !== 'arn' ||
                     arn[1] !== 'aws' ||
@@ -622,7 +720,8 @@ function planRoleAuditStep(branch, mode = 'produce') {
                     !['', account].includes(arn[4] ?? '') ||
                     !target ||
                     (/[*?]/.test(target) &&
-                      (!target.endsWith('/*') || /[*?]/.test(target.slice(0, -2))))
+                      !boundedPathWildcard &&
+                      !boundedLambdaStagePrefix)
                   ) throw new Error('Provider refresh statement ' + index + ' has a target outside the selected account and region.');
                 }
               }
@@ -637,7 +736,6 @@ function planRoleAuditStep(branch, mode = 'produce') {
           ).sort((left, right) =>
             left.Sid < right.Sid ? -1 : left.Sid > right.Sid ? 1 : 0,
           );
-          const stateStage = process.env.EBK_PLAN_BRANCH === 'main' ? 'production' : 'staging';
           if (
             stateKmsKeyArn &&
             stateKmsKeyArn !==
@@ -681,7 +779,7 @@ function planRoleAuditStep(branch, mode = 'produce') {
               Action: 'sts:AssumeRoleWithWebIdentity',
               Condition: { StringEquals: {
                 'token.actions.githubusercontent.com:aud': 'sts.amazonaws.com',
-                'token.actions.githubusercontent.com:sub': 'repo:' + process.env.EBK_PLAN_REPOSITORY + ':environment:' + process.env.EBK_PLAN_ENVIRONMENT,
+                'token.actions.githubusercontent.com:sub': oidcSubject,
               }},
             }],
           };
@@ -703,11 +801,24 @@ function planRoleAuditStep(branch, mode = 'produce') {
                 Sid: 'ObserveInfrastructureIdentity',
                 Effect: 'Allow',
                 Action: [
-                  'resourcegroupstaggingapi:GetResources',
+                  'tag:GetResources',
                   'sts:GetCallerIdentity',
                 ],
                 Resource: '*',
               },
+              {
+                Sid: 'ObserveStageSecretVersionIdentity',
+                Effect: 'Allow',
+                Action: 'secretsmanager:ListSecretVersionIds',
+                Resource:
+                  'arn:aws:secretsmanager:' + process.env.AWS_REGION + ':' +
+                  account + ':secret:*',
+                Condition: {
+                  StringEquals: {
+                    'aws:ResourceTag/ebk:stage': stateStage,
+                  },
+                },
+              },
               {
                 Sid: 'ValidatePlannedIamPolicies',
                 Effect: 'Allow',
@@ -782,7 +893,10 @@ function planRoleAuditStep(branch, mode = 'produce') {
             generatedSecretArns,
             providerRefreshStatements,
             region: process.env.AWS_REGION,
-            repository: process.env.EBK_PLAN_REPOSITORY,
+            repository,
+            repositoryId,
+            repositoryOwnerId,
+            oidcSubject,
             role: {
               arn: role.Arn,
               policy: canonical(policy),
@@ -826,11 +940,17 @@ function planRoleAuditJob(stage, configureAwsAction) {
     const production = stage === 'production';
     const branch = production ? 'main' : 'develop';
     const prefix = production ? 'AWS_PRODUCTION_PLAN' : 'AWS_STAGING_PLAN';
+    const profileAdmission = production
+        ? ''
+        : `      (github.event_name == 'workflow_dispatch' ||\n      needs.deployment-mode.outputs.profile != 'starter') &&\n`;
     return `  infrastructure-plan-role-audit-${stage}:
     name: audit ${stage} infrastructure plan role
-    needs: route
+    needs: [route, deployment-mode]
     if: |
-      github.ref == 'refs/heads/${branch}' &&
+      always() &&
+      needs.route.result == 'success' &&
+      needs.deployment-mode.result == 'success' &&
+${profileAdmission}      github.ref == 'refs/heads/${branch}' &&
       (github.event_name == 'push' && 'deploy' || inputs.action) != 'unlock'
     runs-on: ubuntu-latest
     environment: infrastructure-plan-${stage}
@@ -938,6 +1058,7 @@ const SUPPLY_CHAIN_WORKSPACE_FILE_PLAN = (0, index_js_6.renderSupplyChainWorkspa
     generatedAt: '1970-01-01T00:00:00.000Z',
 });
 const WORKSPACE_SEEDED_PATHS = new Set([
+    dependency_overrides_js_1.DEPENDENCY_OVERRIDES_PATH,
     ...SUPPLY_CHAIN_WORKSPACE_FILE_PLAN.seeded,
     ...workspace_files_developer_agent_js_1.DEVELOPER_AGENT_WORKSPACE_SEEDED_PATHS,
     '.github/CODEOWNERS',
@@ -947,7 +1068,10 @@ const WORKSPACE_SEEDED_PATHS = new Set([
     'docs/architecture.md',
     'docs/git-workflow.md',
     'docs/repository-operating-policy.md',
+    'docs/stage-deployment-authority.md',
+    'docs/workspace-deployment-ownership.md',
     'docs/work-markers.md',
+    workspace_files_shared_operation_claims_js_1.SHARED_OPERATION_CLAIMS_PATH,
     'ebk.repository-policy.json',
 ]);
 exports.WORKSPACE_PACKAGE_MANAGED_JSON_POINTERS = [
@@ -964,21 +1088,23 @@ exports.WORKSPACE_PROJECT_MANAGED_JSON_POINTERS = [
     '/root',
     '/tags',
     '/targets/blueprint-trust-check',
+    '/targets/blueprint-trust-check-main',
     '/targets/blueprint-trust-check-protected',
     '/targets/developer-context',
     '/targets/deployment-plan',
+    '/targets/deploy-local',
     '/targets/dev',
     '/targets/dev-doctor',
     '/targets/dev-setup',
     '/targets/github-bootstrap',
     '/targets/install-git-hooks',
+    '/targets/stage-authority-render',
     '/targets/supply-chain-check',
     '/targets/supply-chain-check-protected',
     '/targets/supply-chain-scan',
     '/targets/verify',
+    '/targets/verify-proposed',
     '/targets/work-markers',
-    '/targets/workload-role-candidate-report',
-    '/targets/workload-role-provisioner-build',
     '/targets/workspace-health',
 ];
 const FOUNDATION_SEEDED_PATHS = new Set([
@@ -986,6 +1112,10 @@ const FOUNDATION_SEEDED_PATHS = new Set([
     'docs/costs.md',
     'docs/runbooks.md',
     'docs/security.md',
+    'performance/account-cost-policy.json',
+    'security/router-waf-blocking-rehearsal.json',
+    'security/router-waf-live-evidence.json',
+    'security/router-waf.json',
 ]);
 function createFoundationOwnership(files, frameworkVersion) {
     const paths = Object.keys(files)
@@ -1048,7 +1178,48 @@ function createWorkspaceOwnership(files, frameworkVersion) {
 }
 function renderWorkspaceFiles(options) {
     const { frameworkVersion, name } = options;
+    const foundationPlan = (0, capability_plan_js_1.planFoundationCapabilities)({
+        current: options.foundationDescriptor,
+        requirements: options.foundationRequirements ?? [],
+    });
+    const dependencyOverrides = (0, dependency_overrides_js_1.parseDependencyOverrides)(options.dependencyOverrides === undefined
+        ? { schemaVersion: 1, overrides: {} }
+        : options.dependencyOverrides);
+    const deploymentProfile = options.deploymentProfile ?? 'starter';
+    const deliveryLane = options.deliveryLane ?? 'protected-pair';
+    if (deliveryLane === 'trunk' && deploymentProfile !== 'starter') {
+        throw new Error('The trunk delivery lane requires the starter deployment profile.');
+    }
+    const trunkLane = deliveryLane === 'trunk';
+    const productionApprovalMode = options.productionApprovalMode ?? 'promotion-pr';
+    if (productionApprovalMode === 'trunk-promotion' &&
+        (deploymentProfile === 'starter' || trunkLane)) {
+        throw new Error('trunk-promotion requires an isolated deployment profile on the protected pair.');
+    }
+    const trunkPromotion = productionApprovalMode === 'trunk-promotion';
+    const protectedBranches = trunkLane ? '[main]' : '[develop, main]';
+    const activeStages = (0, index_js_4.activeDeploymentStages)(deploymentProfile);
+    const protectedWorkflowStageChoices = deploymentProfile === 'starter'
+        ? 'development, production'
+        : deploymentProfile === 'production-isolated'
+            ? 'production'
+            : 'staging, production';
+    const ecrInspectorWorkflowStageChoices = deploymentProfile === 'starter'
+        ? 'production'
+        : protectedWorkflowStageChoices;
+    const rehearsalStage = (0, index_js_4.productionRehearsalStage)(deploymentProfile);
+    const protectedWorkflowStageBranchCases = `${rehearsalStage}:refs/heads/develop|production:refs/heads/main`;
+    const workspaceDeploymentId = options.workspaceDeploymentId ??
+        `ebkws-${(0, index_js_1.hashGeneratedContent)(`workspace-deployment-id:${name}`).slice(0, 32)}`;
+    const initialRepositoryPolicy = (0, index_js_4.createIncubationRepositoryPolicy)(deploymentProfile, workspaceDeploymentId);
+    initialRepositoryPolicy.deploymentAccounts = options.deploymentAccounts ?? {
+        development: null,
+        production: null,
+        staging: null,
+    };
+    initialRepositoryPolicy.deploymentRegion = options.deploymentRegion ?? null;
     const developerAgentFilePlan = (0, workspace_files_developer_agent_js_1.renderDeveloperAgentWorkspaceFilePlan)({
+        deploymentProfile,
         frameworkVersion,
         name,
     });
@@ -1059,7 +1230,38 @@ function renderWorkspaceFiles(options) {
     const pnpmAction = (0, index_js_3.pinnedAction)(index_js_3.GITHUB_ACTION_PINS.pnpmSetup);
     const setupNodeAction = (0, index_js_3.pinnedAction)(index_js_3.GITHUB_ACTION_PINS.setupNode);
     const uploadArtifactAction = (0, index_js_3.pinnedAction)(index_js_3.GITHUB_ACTION_PINS.uploadArtifact);
+    const cacheAction = (0, index_js_3.pinnedAction)(index_js_3.GITHUB_ACTION_PINS.cache);
+    const nxSetShasAction = (0, index_js_3.pinnedAction)(index_js_3.GITHUB_ACTION_PINS.nxSetShas);
+    // GitHub scopes cache reads to the current branch and its base, so protected
+    // pushes never restore entries written by pull-request runs.
+    const nxCacheSteps = `      - name: Restore the Nx task cache
+        uses: ${cacheAction}
+        with:
+          path: .nx/cache
+          key: nx-\${{ runner.os }}-\${{ hashFiles('pnpm-lock.yaml') }}-\${{ github.sha }}
+          restore-keys: |
+            nx-\${{ runner.os }}-\${{ hashFiles('pnpm-lock.yaml') }}-`;
+    // Isolated profiles bind the staging release candidate when promoting to
+    // production, so a main push never needs a rebuilt candidate.
+    const releaseCandidateBranchCondition = deploymentProfile === 'starter'
+        ? ''
+        : " &&\n      github.ref != 'refs/heads/main'";
+    // In the trunk lane no pull request is a protected route: main is the only
+    // protected branch and every feature pull request targets it.
+    const protectedDevelopPromotion = trunkLane
+        ? 'false'
+        : "github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.head.ref == 'develop' && github.event.pull_request.base.ref == 'main'";
+    const protectedMainSync = trunkLane
+        ? 'false'
+        : "github.event.pull_request.head.repo.full_name == github.repository && github.event.pull_request.head.ref == 'main' && github.event.pull_request.base.ref == 'develop'";
+    const protectedPush = trunkLane
+        ? "github.event_name == 'push' && github.ref == 'refs/heads/main'"
+        : "github.event_name == 'push' && (github.ref == 'refs/heads/main' || github.ref == 'refs/heads/develop')";
+    const protectedDeploymentRouteJobName = 'protected deployment route';
+    const stagingApplyJobPrefix = 'apply staging plan ';
     const files = {
+        ...(0, workspace_files_ci_acceptance_js_1.renderWorkspaceCiAcceptanceFiles)(),
+        ...(0, workspace_files_ci_install_js_1.renderWorkspaceCiInstallFiles)(),
         '.node-version': `${tool_versions_js_1.WORKSPACE_NODE_VERSION}\n`,
         '.github/CODEOWNERS': `# Replace this placeholder with the GitHub user or team that owns protected source.
 # GitHub bootstrap remains blocked until a non-placeholder catch-all owner is committed.
@@ -1069,21 +1271,83 @@ function renderWorkspaceFiles(options) {
 
 on:
   pull_request:
-    branches: [develop, main]
+    branches: ${protectedBranches}
   push:
-    branches: [develop, main]
+    branches: ${protectedBranches}
   workflow_dispatch:
 
 concurrency:
-  group: verify-\${{ github.ref }}
-  cancel-in-progress: true
+  group: verify-\${{ github.event_name == 'push' && github.sha || github.ref }}
+  cancel-in-progress: \${{ github.event_name != 'push' }}
 
 permissions:
+  actions: read
   contents: read
+  pull-requests: read
+
+env:
+  EBK_CI_CANDIDATE_SHA: \${{ github.event.pull_request.head.sha || github.sha }}
 
 jobs:
+  acceptance:
+    name: accepted merge evidence
+    if: ${protectedPush}
+    runs-on: ubuntu-latest
+    outputs:
+      history_only: \${{ steps.resolve.outputs.history_only == 'true' && steps.restore.outcome == 'success' && steps.verify.outcome == 'success' }}
+      reused: \${{ steps.resolve.outputs.reused == 'true' && steps.restore.outcome == 'success' && steps.verify.outcome == 'success' }}
+      route: \${{ steps.resolve.outputs.reused == 'true' && steps.restore.outcome == 'success' && steps.verify.outcome == 'success' && steps.resolve.outputs.route || '' }}
+    steps:
+      - name: Check out immutable merged candidate
+        if: ${protectedPush}
+        uses: ${checkoutAction}
+        with:
+          fetch-depth: 0
+          ref: \${{ github.sha }}
+      - name: Resolve exact protected-route acceptance
+        if: ${protectedPush}
+        id: resolve
+        env:
+          GH_TOKEN: \${{ github.token }}
+        run: node tools/ci/workspace-acceptance.mjs resolve
+      - name: Restore exact protected-route acceptance
+        if: steps.resolve.outputs.reused == 'true'
+        id: restore
+        continue-on-error: true
+        env:
+          EBK_ACCEPTANCE_ARTIFACT_DIGEST: \${{ steps.resolve.outputs.artifact_digest }}
+          EBK_ACCEPTANCE_ARTIFACT_ID: \${{ steps.resolve.outputs.artifact_id }}
+          EBK_ACCEPTANCE_ARTIFACT_SIZE: \${{ steps.resolve.outputs.artifact_size }}
+          GH_TOKEN: \${{ github.token }}
+        run: >-
+          node tools/ci/workspace-acceptance.mjs download
+          .ebk/evidence/reused-acceptance
+          "$EBK_ACCEPTANCE_ARTIFACT_ID"
+          "$EBK_ACCEPTANCE_ARTIFACT_DIGEST"
+          "$EBK_ACCEPTANCE_ARTIFACT_SIZE"
+      - name: Verify exact merged-tree acceptance
+        if: steps.resolve.outputs.reused == 'true' && steps.restore.outcome == 'success'
+        id: verify
+        continue-on-error: true
+        env:
+          EBK_ACCEPTANCE_BASE: \${{ steps.resolve.outputs.base_commit }}
+          EBK_ACCEPTANCE_HEAD: \${{ steps.resolve.outputs.head_commit }}
+          EBK_ACCEPTANCE_ROUTE: \${{ steps.resolve.outputs.route }}
+          EBK_ACCEPTANCE_RUN_ATTEMPT: \${{ steps.resolve.outputs.run_attempt }}
+          EBK_ACCEPTANCE_RUN_ID: \${{ steps.resolve.outputs.run_id }}
+        run: >-
+          node tools/ci/workspace-acceptance.mjs verify
+          .ebk/evidence/reused-acceptance/manifest.json
+          "$EBK_ACCEPTANCE_HEAD"
+          "$EBK_ACCEPTANCE_BASE"
+          "$EBK_ACCEPTANCE_ROUTE"
+          "$EBK_ACCEPTANCE_RUN_ID"
+          "$EBK_ACCEPTANCE_RUN_ATTEMPT"
+
   policy:
     name: policy
+    needs: acceptance
+    if: always() && needs.acceptance.outputs.reused != 'true'
     runs-on: ubuntu-latest
     steps:
       - uses: ${checkoutAction}
@@ -1095,31 +1359,118 @@ jobs:
         with:
           node-version: ${tool_versions_js_1.WORKSPACE_NODE_VERSION}
           cache: pnpm
-      - run: pnpm install --frozen-lockfile
+      - run: node tools/ci/install.mjs
       - run: node tools/ebk-git-policy.mjs
+        env:
+          EBK_HEAD_REPOSITORY: \${{ github.event.pull_request.head.repo.full_name }}
 
   verify:
     name: verify
+    needs: acceptance
+    if: always() && needs.acceptance.outputs.reused != 'true'
     runs-on: ubuntu-latest
     steps:
       - uses: ${checkoutAction}
+        with:
+          fetch-depth: 0
+          ref: \${{ github.event.pull_request.head.sha || github.sha }}
       - uses: ${pnpmAction}
       - uses: ${setupNodeAction}
         with:
           node-version: ${tool_versions_js_1.WORKSPACE_NODE_VERSION}
           cache: pnpm
-      - run: pnpm install --frozen-lockfile
-      - run: pnpm nx format:check
-      - run: pnpm nx run-many -t verify --parallel=3
+      - run: node tools/ci/install.mjs
+${nxCacheSteps}
+      - run: pnpm format:check
+      - name: Resolve the affected base and head for proposed work
+        if: github.event_name == 'pull_request' && !(${protectedDevelopPromotion} || ${protectedMainSync})
+        uses: ${nxSetShasAction}
+      - name: Verify proposed workspace
+        if: github.event_name == 'pull_request' && !(${protectedDevelopPromotion} || ${protectedMainSync})
+        run: |
+          pnpm nx run ${name}:verify-proposed
+          pnpm nx affected -t verify --exclude=${name} --parallel=3
+      - name: Verify protected develop promotion
+        if: github.event_name == 'pull_request' && ${protectedDevelopPromotion}
+        run: pnpm nx run-many -t verify --parallel=3
+      - name: Verify protected main sync
+        if: github.event_name == 'pull_request' && ${protectedMainSync}
+        run: |
+          pnpm nx run ${name}:blueprint-trust-check-main
+          pnpm nx run ${name}:verify-proposed
+          pnpm nx run-many -t verify --exclude=${name} --parallel=3
+      - name: Verify adopted workspace
+        if: github.event_name != 'pull_request'
+        run: pnpm nx run-many -t verify --parallel=3
+
+  seal-acceptance:
+    name: seal protected route acceptance
+    needs: [policy, verify]
+    if: >-
+      always() &&
+      needs.policy.result == 'success' &&
+      needs.verify.result == 'success' &&
+      github.event_name == 'pull_request' &&
+      (${protectedDevelopPromotion} || ${protectedMainSync})
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out immutable accepted candidate
+        uses: ${checkoutAction}
+        with:
+          fetch-depth: 0
+          ref: \${{ env.EBK_CI_CANDIDATE_SHA }}
+      - name: Seal exact protected-route acceptance
+        id: seal
+        env:
+          EBK_BASE_COMMIT: \${{ github.event.pull_request.base.sha }}
+          EBK_HEAD_REPOSITORY: \${{ github.event.pull_request.head.repo.full_name }}
+        run: >-
+          node tools/ci/workspace-acceptance.mjs seal
+          .ebk/evidence/ci/workspace-acceptance/manifest.json
+      - name: Retain exact protected-route acceptance
+        if: steps.seal.outputs.sealed == 'true'
+        uses: ${uploadArtifactAction}
+        with:
+          name: workspace-acceptance-\${{ env.EBK_CI_CANDIDATE_SHA }}-\${{ github.run_id }}-\${{ github.run_attempt }}
+          path: .ebk/evidence/ci/workspace-acceptance
+          if-no-files-found: error
+          include-hidden-files: true
+          retention-days: 30
+
+  release-candidate:
+    name: build immutable release candidates
+    needs: [acceptance, policy, verify]
+    if: >-
+      always() &&
+      github.event_name == 'push' &&
+      needs.acceptance.outputs.history_only != 'true' &&
+      (needs.acceptance.outputs.reused == 'true' ||
+      (needs.policy.result == 'success' && needs.verify.result == 'success'))${releaseCandidateBranchCondition}
+    runs-on: ubuntu-latest
+    steps:
+      - uses: ${checkoutAction}
+        with:
+          fetch-depth: 0
+          ref: \${{ github.sha }}
+      - uses: ${pnpmAction}
+      - uses: ${setupNodeAction}
+        with:
+          node-version: ${tool_versions_js_1.WORKSPACE_NODE_VERSION}
+          cache: pnpm
+      - run: node tools/ci/install.mjs
+${nxCacheSteps}
       - name: Build immutable release candidates
-        if: github.event_name == 'push'
+        id: candidates
         env:
           EBK_SOURCE_COMMIT: \${{ github.sha }}
         run: |
-          slice_projects="$(pnpm nx show projects --with-target=release-candidate --json | jq -r 'join(",")')"
-          test -n "$slice_projects" ||
-            { echo 'At least one release-candidate target is required'; exit 1; }
-          pnpm nx run-many -t release-candidate --projects="$slice_projects" --parallel=1
+          slice_projects="$(node tools/ci/release-candidates.mjs)"
+          if [ -z "$slice_projects" ]; then
+            echo 'No application release producers; application artifacts are not applicable.'
+            echo 'available=false' >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          pnpm nx run-many -t release-candidate --projects="$slice_projects" --parallel=3
           mkdir -p .ebk/evidence/release-candidate/packages
           IFS=',' read -r -a projects <<< "$slice_projects"
           for project in "\${projects[@]}"; do
@@ -1129,8 +1480,9 @@ jobs:
             cp packages/"$project"/.ebk/evidence/release-candidate/*.json \
               ".ebk/evidence/release-candidate/packages/$project/"
           done
+          echo 'available=true' >> "$GITHUB_OUTPUT"
       - name: Retain exact immutable release candidate
-        if: github.event_name == 'push'
+        if: steps.candidates.outputs.available == 'true'
         uses: ${uploadArtifactAction}
         with:
           name: release-candidate-\${{ github.sha }}
@@ -1138,6 +1490,7 @@ jobs:
           include-hidden-files: true
           retention-days: 30
           path: .ebk/evidence/release-candidate
+${(0, workspace_files_thin_deploy_js_1.renderThinDeployVerifyCaller)(deploymentProfile, deliveryLane, productionApprovalMode)}
 `,
         '.github/workflows/deploy.yml': `name: Deploy
 
@@ -1165,7 +1518,97 @@ permissions:
   contents: read
 
 jobs:
+  history-classification:
+    name: classify protected history-only sync
+    if: github.event_name == 'push' && github.ref == 'refs/heads/develop'
+    runs-on: ubuntu-latest
+    permissions:
+      actions: read
+      contents: read
+      pull-requests: read
+    outputs:
+      history_only: \${{ steps.resolve.outputs.history_only == 'true' && steps.restore.outcome == 'success' && steps.verify.outcome == 'success' }}
+    steps:
+      - name: Check out immutable protected candidate
+        uses: ${checkoutAction}
+        with:
+          fetch-depth: 0
+          ref: \${{ github.sha }}
+      - uses: ${setupNodeAction}
+        with:
+          node-version: ${tool_versions_js_1.WORKSPACE_NODE_VERSION}
+      - name: Resolve exact protected-route acceptance
+        id: resolve
+        env:
+          GH_TOKEN: \${{ github.token }}
+        run: node tools/ci/workspace-acceptance.mjs resolve
+      - name: Restore exact protected-route acceptance
+        if: steps.resolve.outputs.reused == 'true'
+        id: restore
+        continue-on-error: true
+        env:
+          EBK_ACCEPTANCE_ARTIFACT_DIGEST: \${{ steps.resolve.outputs.artifact_digest }}
+          EBK_ACCEPTANCE_ARTIFACT_ID: \${{ steps.resolve.outputs.artifact_id }}
+          EBK_ACCEPTANCE_ARTIFACT_SIZE: \${{ steps.resolve.outputs.artifact_size }}
+          GH_TOKEN: \${{ github.token }}
+        run: >-
+          node tools/ci/workspace-acceptance.mjs download
+          .ebk/evidence/reused-history-acceptance
+          "$EBK_ACCEPTANCE_ARTIFACT_ID"
+          "$EBK_ACCEPTANCE_ARTIFACT_DIGEST"
+          "$EBK_ACCEPTANCE_ARTIFACT_SIZE"
+      - name: Verify exact history-only acceptance
+        if: steps.resolve.outputs.reused == 'true' && steps.restore.outcome == 'success'
+        id: verify
+        continue-on-error: true
+        env:
+          EBK_ACCEPTANCE_BASE: \${{ steps.resolve.outputs.base_commit }}
+          EBK_ACCEPTANCE_HEAD: \${{ steps.resolve.outputs.head_commit }}
+          EBK_ACCEPTANCE_ROUTE: \${{ steps.resolve.outputs.route }}
+          EBK_ACCEPTANCE_RUN_ATTEMPT: \${{ steps.resolve.outputs.run_attempt }}
+          EBK_ACCEPTANCE_RUN_ID: \${{ steps.resolve.outputs.run_id }}
+        run: >-
+          node tools/ci/workspace-acceptance.mjs verify
+          .ebk/evidence/reused-history-acceptance/manifest.json
+          "$EBK_ACCEPTANCE_HEAD"
+          "$EBK_ACCEPTANCE_BASE"
+          "$EBK_ACCEPTANCE_ROUTE"
+          "$EBK_ACCEPTANCE_RUN_ID"
+          "$EBK_ACCEPTANCE_RUN_ATTEMPT"
+
+  deployment-mode:
+    name: classify deployment profile
+    runs-on: ubuntu-latest
+    outputs:
+      profile: \${{ steps.profile.outputs.profile }}
+    steps:
+      - name: Check out immutable deployment policy
+        uses: ${checkoutAction}
+        with:
+          ref: \${{ github.sha }}
+      - id: profile
+        name: Read exact committed deployment profile
+        run: |
+          node - <<'NODE'
+          const { readFileSync } = require('node:fs');
+          const policy = JSON.parse(readFileSync('ebk.repository-policy.json', 'utf8'));
+          const profiles = new Set(['starter', 'production-isolated', 'fully-isolated']);
+          if (!profiles.has(policy.deploymentProfile)) {
+            throw new Error('Committed deployment profile is absent or invalid.');
+          }
+          require('node:fs').appendFileSync(
+            process.env.GITHUB_OUTPUT,
+            'profile=' + policy.deploymentProfile + '\\n',
+          );
+          NODE
+
   route:
+    name: ${protectedDeploymentRouteJobName}
+    needs: [history-classification, deployment-mode]
+    if: >-
+      always() &&
+      needs.history-classification.outputs.history_only != 'true' &&
+      needs.deployment-mode.result == 'success'
     runs-on: ubuntu-latest
     steps:
       - name: Validate protected ref
@@ -1178,14 +1621,25 @@ jobs:
           esac
 
   plan-staging:
-    needs: route
-    if: github.ref == 'refs/heads/develop'
+    needs: [route, deployment-mode]
+    if: >-
+      always() &&
+      needs.route.result == 'success' &&
+      needs.deployment-mode.result == 'success' &&
+      github.ref == 'refs/heads/develop' &&
+      (github.event_name == 'workflow_dispatch' ||
+      needs.deployment-mode.outputs.profile != 'starter')
     runs-on: ubuntu-latest
     outputs:
+      deployment_profile: \${{ steps.plan.outputs.deployment_profile }}
+      deployment_region: \${{ steps.plan.outputs.deployment_region }}
+      development_account_id: \${{ steps.plan.outputs.development_account_id }}
       foundation_project: \${{ steps.plan.outputs.foundation_project }}
       has_slices: \${{ steps.plan.outputs.has_slices }}
       ordered_projects: \${{ steps.plan.outputs.ordered_projects }}
+      production_account_id: \${{ steps.plan.outputs.production_account_id }}
       slice_projects: \${{ steps.plan.outputs.slice_projects }}
+      staging_account_id: \${{ steps.plan.outputs.staging_account_id }}
     steps:
       - uses: ${checkoutAction}
         with:
@@ -1208,7 +1662,7 @@ jobs:
   release-source-staging:
     name: select and seal staging release source
     needs: plan-staging
-    if: \${{ needs.plan-staging.result == 'success' && (github.event_name == 'push' && 'deploy' || inputs.action) != 'unlock' }}
+    if: \${{ always() && needs.plan-staging.result == 'success' && (github.event_name == 'push' && 'deploy' || inputs.action) != 'unlock' }}
     runs-on: ubuntu-latest
     permissions:
       actions: read
@@ -1396,16 +1850,25 @@ jobs:
           path: .ebk/evidence/staging-release-source/**
 
   plan-production:
-    needs: route
-    if: github.ref == 'refs/heads/main'
+    needs: [route, deployment-mode]
+    if: >-
+      always() &&
+      needs.route.result == 'success' &&
+      needs.deployment-mode.result == 'success' &&
+      github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     outputs:
+      deployment_profile: \${{ steps.plan.outputs.deployment_profile }}
+      deployment_region: \${{ steps.plan.outputs.deployment_region }}
+      development_account_id: \${{ steps.plan.outputs.development_account_id }}
       foundation_project: \${{ steps.plan.outputs.foundation_project }}
       foundation_profile: \${{ steps.plan.outputs.foundation_profile }}
       has_slices: \${{ steps.plan.outputs.has_slices }}
       ordered_projects: \${{ steps.plan.outputs.ordered_projects }}
       production_approval_mode: \${{ steps.plan.outputs.production_approval_mode }}
+      production_account_id: \${{ steps.plan.outputs.production_account_id }}
       slice_projects: \${{ steps.plan.outputs.slice_projects }}
+      staging_account_id: \${{ steps.plan.outputs.staging_account_id }}
     steps:
       - uses: ${checkoutAction}
         with:
@@ -1699,7 +2162,7 @@ jobs:
   container-platform-staging:
     name: native staging OCI \${{ matrix.platform }}
     needs: [plan-staging, release-source-staging]
-    if: \${{ (github.event_name == 'push' && 'deploy' || inputs.action) == 'deploy' && needs.plan-staging.outputs.has_slices == 'true' && needs.release-source-staging.result == 'success' }}
+    if: \${{ always() && (github.event_name == 'push' && 'deploy' || inputs.action) == 'deploy' && needs.plan-staging.result == 'success' && needs.plan-staging.outputs.slice_projects != '' && needs.release-source-staging.result == 'success' }}
     strategy:
       fail-fast: false
       matrix:
@@ -1726,6 +2189,8 @@ jobs:
       EBK_RELEASE_SOURCE_COMMIT: \${{ needs.release-source-staging.outputs.source_commit }}
       EBK_SOURCE_COMMIT: \${{ needs.release-source-staging.outputs.source_commit }}
       EBK_STAGE: staging
+      EBK_POLICY_ACCOUNT_ID: \${{ needs.plan-staging.outputs.staging_account_id }}
+      EBK_POLICY_REGION: \${{ needs.plan-staging.outputs.deployment_region }}
       SLICE_PROJECTS: \${{ needs.plan-staging.outputs.slice_projects }}
     steps:
       - uses: ${checkoutAction}
@@ -1741,6 +2206,10 @@ jobs:
       - run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
       - name: Verify managed workspace integrity before AWS authority
         run: pnpm nx run ${name}:workspace-health
+      - name: Bind staging account to committed deployment topology
+        run: |
+          test "$AWS_EXPECTED_ACCOUNT_ID" = "$EBK_POLICY_ACCOUNT_ID"
+          test "$AWS_REGION" = "$EBK_POLICY_REGION"
 ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - uses: ${configureAwsAction}
         with:
           role-to-assume: \${{ secrets.AWS_DEPLOY_ROLE_ARN }}
@@ -1780,6 +2249,8 @@ ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - uses: ${c
       EBK_RELEASE_SOURCE_COMMIT: \${{ needs.release-source-staging.outputs.source_commit }}
       EBK_SOURCE_COMMIT: \${{ needs.release-source-staging.outputs.source_commit }}
       EBK_STAGE: staging
+      EBK_POLICY_ACCOUNT_ID: \${{ needs.plan-staging.outputs.staging_account_id }}
+      EBK_POLICY_REGION: \${{ needs.plan-staging.outputs.deployment_region }}
       SLICE_PROJECTS: \${{ needs.plan-staging.outputs.slice_projects }}
     steps:
       - uses: ${checkoutAction}
@@ -1795,6 +2266,10 @@ ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - uses: ${c
       - run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
       - name: Verify managed workspace integrity before AWS authority
         run: pnpm nx run ${name}:workspace-health
+      - name: Bind staging account to committed deployment topology
+        run: |
+          test "$AWS_EXPECTED_ACCOUNT_ID" = "$EBK_POLICY_ACCOUNT_ID"
+          test "$AWS_REGION" = "$EBK_POLICY_REGION"
 ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - name: Restore both native platform records
         uses: ${downloadArtifactAction}
         with:
@@ -1825,7 +2300,7 @@ ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - name: Res
   container-promote-production:
     name: promote reviewed OCI indexes to production
     needs: [plan-production, release-source-production]
-    if: \${{ always() && needs.plan-production.result == 'success' && needs.release-source-production.result == 'success' && needs.plan-production.outputs.has_slices == 'true' }}
+    if: \${{ always() && needs.plan-production.result == 'success' && needs.release-source-production.result == 'success' && needs.plan-production.outputs.slice_projects != '' }}
     runs-on: ubuntu-latest
     environment: production
     permissions:
@@ -1836,6 +2311,10 @@ ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - name: Res
       AWS_DEPLOY_ROLE_ARN: \${{ secrets.AWS_DEPLOY_ROLE_ARN }}
       AWS_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_EXPECTED_ACCOUNT_ID }}
       AWS_REGION: \${{ vars.AWS_REGION }}
+      EBK_DEPLOYMENT_PROFILE: \${{ needs.plan-production.outputs.deployment_profile }}
+      EBK_POLICY_PRODUCTION_ACCOUNT_ID: \${{ needs.plan-production.outputs.production_account_id }}
+      EBK_POLICY_REGION: \${{ needs.plan-production.outputs.deployment_region }}
+      EBK_POLICY_STAGING_ACCOUNT_ID: \${{ needs.plan-production.outputs.staging_account_id }}
       EBK_CANDIDATE_RUN_ATTEMPT: \${{ needs.release-source-production.outputs.candidate_run_attempt }}
       EBK_CANDIDATE_RUN_ID: \${{ needs.release-source-production.outputs.candidate_run_id }}
       EBK_RELEASE_SOURCE_COMMIT: \${{ needs.release-source-production.outputs.source_commit }}
@@ -1936,11 +2415,13 @@ ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - name: Res
             cp "$source_sidecar" "$target"
           done
       - uses: ${configureAwsAction}
+        if: env.EBK_DEPLOYMENT_PROFILE != 'starter'
         with:
           role-to-assume: \${{ secrets.AWS_STAGING_PROMOTION_PULL_ROLE_ARN }}
           role-session-name: ebk-staging-container-pull-\${{ github.run_id }}-\${{ github.run_attempt }}
           aws-region: \${{ vars.AWS_STAGING_PROMOTION_REGION }}
       - name: Authenticate exact staging source registry
+        if: env.EBK_DEPLOYMENT_PROFILE != 'starter'
         env:
           EBK_STAGING_ACCOUNT_ID: \${{ vars.AWS_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID }}
           EBK_STAGING_REGION: \${{ vars.AWS_STAGING_PROMOTION_REGION }}
@@ -1959,10 +2440,27 @@ ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - name: Res
           role-to-assume: \${{ secrets.AWS_DEPLOY_ROLE_ARN }}
           role-session-name: ebk-production-container-push-\${{ github.run_id }}-\${{ github.run_attempt }}
           aws-region: \${{ vars.AWS_REGION }}
+      - name: Bind production authority to committed deployment topology
+        run: |
+          test "$AWS_EXPECTED_ACCOUNT_ID" = "$EBK_POLICY_PRODUCTION_ACCOUNT_ID" ||
+            { echo 'Production environment account differs from committed deployment topology'; exit 1; }
+          test "$AWS_REGION" = "$EBK_POLICY_REGION" ||
+            { echo 'Production environment Region differs from committed deployment topology'; exit 1; }
+      - name: Authenticate shared-account staging source registry
+        if: env.EBK_DEPLOYMENT_PROFILE == 'starter'
+        run: |
+          test "$EBK_POLICY_STAGING_ACCOUNT_ID" = "$EBK_POLICY_PRODUCTION_ACCOUNT_ID" ||
+            { echo 'Starter promotion requires one shared AWS account'; exit 1; }
+          registry_suffix=.com
+          case "$EBK_POLICY_REGION" in cn-*) registry_suffix=.com.cn ;; esac
+          aws ecr get-login-password --region "$EBK_POLICY_REGION" |
+            docker login --username AWS --password-stdin \
+              "$EBK_POLICY_STAGING_ACCOUNT_ID.dkr.ecr.$EBK_POLICY_REGION.amazonaws$registry_suffix"
       - name: Promote exact staging indexes without rebuilding
         env:
-          EBK_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID }}
-          EBK_STAGING_PROMOTION_REGION: \${{ vars.AWS_STAGING_PROMOTION_REGION }}
+          EBK_DEPLOYMENT_PROFILE: \${{ needs.plan-production.outputs.deployment_profile }}
+          EBK_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID: \${{ needs.plan-production.outputs.deployment_profile == 'starter' && needs.plan-production.outputs.staging_account_id || vars.AWS_STAGING_PROMOTION_EXPECTED_ACCOUNT_ID }}
+          EBK_STAGING_PROMOTION_REGION: \${{ needs.plan-production.outputs.deployment_profile == 'starter' && needs.plan-production.outputs.deployment_region || vars.AWS_STAGING_PROMOTION_REGION }}
         run: |
           test "$(aws sts get-caller-identity --query Account --output text)" = "$AWS_EXPECTED_ACCOUNT_ID" ||
             { echo 'Production promotion role account differs from policy'; exit 1; }
@@ -1995,7 +2493,7 @@ ${planRoleAuditJob('production', configureAwsAction)}${planRoleAuditJob('staging
         (
           needs.release-source-production.result == 'success' &&
           (
-            needs.plan-production.outputs.has_slices != 'true' ||
+            needs.plan-production.outputs.slice_projects == '' ||
             needs.container-promote-production.result == 'success'
           )
         )
@@ -2089,7 +2587,7 @@ ${infrastructureCandidateDownloadSteps(downloadArtifactAction, {
             runId: '${{ needs.release-source-production.outputs.candidate_run_id }}',
             verifiedStagingRunId: '${{ needs.release-source-production.outputs.verified_staging_run_id }}',
         })}      - name: Restore exact production container bindings
-        if: env.EBK_ACTION == 'deploy' && needs.plan-production.outputs.has_slices == 'true'
+        if: env.EBK_ACTION == 'deploy' && needs.plan-production.outputs.slice_projects != ''
         env:
           ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
           ACTIONS_ID_TOKEN_REQUEST_URL: ''
@@ -2150,7 +2648,7 @@ ${planRoleAuditStep('main', 'verify')}
       (github.event_name == 'push' && 'deploy' || inputs.action) != 'unlock' &&
       (
         (github.event_name == 'push' && 'deploy' || inputs.action) != 'deploy' ||
-        needs.plan-staging.outputs.has_slices != 'true' ||
+        needs.plan-staging.outputs.slice_projects == '' ||
         needs.container-assemble-staging.result == 'success'
       )
     runs-on: ubuntu-latest
@@ -2181,6 +2679,8 @@ ${planRoleAuditStep('main', 'verify')}
       EBK_RELEASE_SOURCE_COMMIT: \${{ needs.release-source-staging.outputs.source_commit }}
       EBK_SOURCE_COMMIT: \${{ github.sha }}
       EBK_STAGE: staging
+      EBK_POLICY_ACCOUNT_ID: \${{ needs.plan-staging.outputs.staging_account_id }}
+      EBK_POLICY_REGION: \${{ needs.plan-staging.outputs.deployment_region }}
       FOUNDATION_PROJECT: \${{ needs.plan-staging.outputs.foundation_project }}
       ORDERED_PROJECTS: \${{ needs.plan-staging.outputs.ordered_projects }}
       SLICE_PROJECTS: \${{ needs.plan-staging.outputs.slice_projects }}
@@ -2238,7 +2738,7 @@ ${planApplicationBindingCheck()}          case "$AWS_PLAN_ROLE_ARN" in
           ACTIONS_ID_TOKEN_REQUEST_URL: ''
         run: pnpm nx run ${name}:workspace-health
 ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - name: Restore exact staging container bindings
-        if: env.EBK_ACTION == 'deploy' && needs.plan-staging.outputs.has_slices == 'true'
+        if: env.EBK_ACTION == 'deploy' && needs.plan-staging.outputs.slice_projects != ''
         env:
           ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
           ACTIONS_ID_TOKEN_REQUEST_URL: ''
@@ -2288,14 +2788,14 @@ ${planRoleAuditStep('develop', 'verify')}
             packages/*/.ebk/evidence/infrastructure-plan-command.json
 
   deploy-staging:
-    name: apply staging plan \${{ needs.infrastructure-plan-staging.outputs.plan_digest || 'recovery-without-resource-plan' }}
+    name: ${stagingApplyJobPrefix}\${{ needs.infrastructure-plan-staging.outputs.plan_digest || 'recovery-without-resource-plan' }}
     needs: [plan-staging, release-source-staging, container-assemble-staging, infrastructure-plan-staging]
     if: |
       always() &&
       needs.plan-staging.result == 'success' &&
       (
         (github.event_name == 'push' && 'deploy' || inputs.action) != 'deploy' ||
-        needs.plan-staging.outputs.has_slices != 'true' ||
+        needs.plan-staging.outputs.slice_projects == '' ||
         needs.container-assemble-staging.result == 'success'
       ) &&
       (
@@ -2357,7 +2857,7 @@ ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - name: Res
           name: infrastructure-plan-staging-\${{ github.run_id }}-\${{ github.run_attempt }}
           path: .
       - name: Restore exact staging container bindings
-        if: env.EBK_ACTION == 'deploy' && needs.plan-staging.outputs.has_slices == 'true'
+        if: env.EBK_ACTION == 'deploy' && needs.plan-staging.outputs.slice_projects != ''
         uses: ${downloadArtifactAction}
         with:
           name: container-release-staging-\${{ github.run_id }}-\${{ github.run_attempt }}
@@ -2367,6 +2867,10 @@ ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - name: Res
           test -n "$AWS_DEPLOY_ROLE_ARN" || { echo 'staging AWS_DEPLOY_ROLE_ARN is required'; exit 1; }
           test -n "$AWS_EXPECTED_ACCOUNT_ID" || { echo 'staging AWS_EXPECTED_ACCOUNT_ID is required'; exit 1; }
           test -n "$AWS_REGION" || { echo 'staging AWS_REGION is required'; exit 1; }
+          test "$AWS_EXPECTED_ACCOUNT_ID" = "$EBK_POLICY_ACCOUNT_ID" ||
+            { echo 'staging environment account differs from committed deployment topology'; exit 1; }
+          test "$AWS_REGION" = "$EBK_POLICY_REGION" ||
+            { echo 'staging environment Region differs from committed deployment topology'; exit 1; }
           test -n "$EBK_FLEET_ORIGIN" ||
             { echo 'staging environment EBK_FLEET_ORIGIN is required'; exit 1; }
           test "$EBK_FLEET_ORIGIN" = "$EBK_PLANNED_FLEET_ORIGIN" ||
@@ -2378,8 +2882,7 @@ ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - name: Res
             test -n "$AWS_PLAN_GENERATED_SECRET_ARNS_JSON" &&
             test -n "$AWS_PLAN_PROVIDER_REFRESH_POLICY_JSON" ||
             { echo 'staging exact plan-discovery inputs are required'; exit 1; }
-          test -n "$AWS_PLAN_ROLE_ARN" &&
-            test -n "$AWS_PLAN_STATE_KMS_KEY_ARN" ||
+          test -n "$AWS_PLAN_ROLE_ARN" ||
             { echo 'staging exact plan-authority inputs are required'; exit 1; }
           case "$AWS_DEPLOY_ROLE_ARN" in
             arn:aws:iam::$AWS_EXPECTED_ACCOUNT_ID:role/*) ;;
@@ -2946,7 +3449,7 @@ ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - name: Res
       needs.plan-production.result == 'success' &&
       (
         (github.event_name == 'push' && 'deploy' || inputs.action) != 'deploy' ||
-        needs.plan-production.outputs.has_slices != 'true' ||
+        needs.plan-production.outputs.slice_projects == '' ||
         needs.container-promote-production.result == 'success'
       ) &&
       (
@@ -3003,6 +3506,8 @@ ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - name: Res
       EBK_APPROVED_MAIN_COMMIT: \${{ github.sha }}
       EBK_SOURCE_COMMIT: \${{ github.sha }}
       EBK_STAGE: production
+      EBK_POLICY_ACCOUNT_ID: \${{ needs.plan-production.outputs.production_account_id }}
+      EBK_POLICY_REGION: \${{ needs.plan-production.outputs.deployment_region }}
       EBK_VERIFIED_STAGING_RUN_ID: \${{ needs.release-source-production.outputs.verified_staging_run_id }}
       FOUNDATION_PROJECT: \${{ needs.plan-production.outputs.foundation_project }}
       ORDERED_PROJECTS: \${{ needs.plan-production.outputs.ordered_projects }}
@@ -3089,7 +3594,7 @@ ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - name: Res
           name: infrastructure-plan-production-\${{ github.run_id }}-\${{ github.run_attempt }}
           path: .
       - name: Restore exact production container bindings
-        if: env.EBK_ACTION == 'deploy' && needs.plan-production.outputs.has_slices == 'true'
+        if: env.EBK_ACTION == 'deploy' && needs.plan-production.outputs.slice_projects != ''
         uses: ${downloadArtifactAction}
         with:
           name: container-release-production-\${{ github.run_id }}-\${{ github.run_attempt }}
@@ -3099,6 +3604,10 @@ ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - name: Res
           test -n "$AWS_DEPLOY_ROLE_ARN" || { echo 'production AWS_DEPLOY_ROLE_ARN is required'; exit 1; }
           test -n "$AWS_EXPECTED_ACCOUNT_ID" || { echo 'production AWS_EXPECTED_ACCOUNT_ID is required'; exit 1; }
           test -n "$AWS_REGION" || { echo 'production AWS_REGION is required'; exit 1; }
+          test "$AWS_EXPECTED_ACCOUNT_ID" = "$EBK_POLICY_ACCOUNT_ID" ||
+            { echo 'production environment account differs from committed deployment topology'; exit 1; }
+          test "$AWS_REGION" = "$EBK_POLICY_REGION" ||
+            { echo 'production environment Region differs from committed deployment topology'; exit 1; }
           test -n "$EBK_FLEET_ORIGIN" ||
             { echo 'production environment EBK_FLEET_ORIGIN is required'; exit 1; }
           test "$EBK_FLEET_ORIGIN" = "$EBK_PLANNED_FLEET_ORIGIN" ||
@@ -3110,8 +3619,7 @@ ${stagingReleaseCandidateDownloadSteps(downloadArtifactAction)}      - name: Res
             test -n "$AWS_PLAN_GENERATED_SECRET_ARNS_JSON" &&
             test -n "$AWS_PLAN_PROVIDER_REFRESH_POLICY_JSON" ||
             { echo 'production exact plan-discovery inputs are required'; exit 1; }
-          test -n "$AWS_PLAN_ROLE_ARN" &&
-            test -n "$AWS_PLAN_STATE_KMS_KEY_ARN" ||
+          test -n "$AWS_PLAN_ROLE_ARN" ||
             { echo 'production exact plan-authority inputs are required'; exit 1; }
           case "$AWS_DEPLOY_ROLE_ARN" in
             arn:aws:iam::$AWS_EXPECTED_ACCOUNT_ID:role/*) ;;
@@ -3492,7 +4000,7 @@ on:
         description: Exact protected deployment stage
         required: true
         type: choice
-        options: [staging, production]
+        options: [${ecrInspectorWorkflowStageChoices}]
       deployment_commit:
         description: Exact successful protected deployment commit
         required: true
@@ -3501,8 +4009,8 @@ on:
         description: Exact successful Deploy workflow run ID
         required: true
         type: string
-      release_artifact_name:
-        description: Exact release-evidence artifact from that run
+      deployment_receipt_artifact_name:
+        description: Exact deployment-receipt artifact from that run
         required: true
         type: string
       slice:
@@ -3556,7 +4064,7 @@ jobs:
       EBK_DEPLOYMENT_ARN: \${{ inputs.deployment_arn }}
       EBK_DEPLOYMENT_KIND: \${{ inputs.deployment_kind }}
       EBK_DEPLOY_RUN_ID: \${{ inputs.deploy_run_id }}
-      EBK_RELEASE_ARTIFACT_NAME: \${{ inputs.release_artifact_name }}
+      EBK_DEPLOYMENT_RECEIPT_ARTIFACT_NAME: \${{ inputs.deployment_receipt_artifact_name }}
       EBK_SLICE: \${{ inputs.slice }}
       EBK_DEPLOYMENT_COMMIT: \${{ inputs.deployment_commit }}
       EBK_STAGE: \${{ inputs.stage }}
@@ -3579,10 +4087,10 @@ jobs:
           esac
           expected_branch=develop
           if [ "$EBK_STAGE" = production ]; then expected_branch=main; fi
-          expected_artifact="release-evidence-$EBK_STAGE-$EBK_DEPLOY_RUN_ID-"
-          case "$EBK_RELEASE_ARTIFACT_NAME" in
-            "$expected_artifact"*) attempt="\${EBK_RELEASE_ARTIFACT_NAME#"$expected_artifact"}" ;;
-            *) echo 'Release evidence artifact does not bind the exact deploy run'; exit 1 ;;
+          expected_artifact="deployment-receipt-$EBK_STAGE-$EBK_DEPLOY_RUN_ID-"
+          case "$EBK_DEPLOYMENT_RECEIPT_ARTIFACT_NAME" in
+            "$expected_artifact"*) attempt="\${EBK_DEPLOYMENT_RECEIPT_ARTIFACT_NAME#"$expected_artifact"}" ;;
+            *) echo 'Deployment receipt artifact does not bind the exact deploy run'; exit 1 ;;
           esac
           case "$attempt" in
             ''|0*|*[!0-9]*) echo 'Release evidence artifact has an invalid run attempt'; exit 1 ;;
@@ -3595,7 +4103,7 @@ jobs:
             test "$(printf '%s' "$run" | jq -r .path)" = ".github/workflows/deploy.yml" ||
             { echo 'Deploy run is not the exact successful protected source authority'; exit 1; }
           artifacts="$(gh api "/repos/$GH_REPO/actions/runs/$EBK_DEPLOY_RUN_ID/artifacts?per_page=100")"
-          count="$(printf '%s' "$artifacts" | jq --arg name "$EBK_RELEASE_ARTIFACT_NAME" \
+          count="$(printf '%s' "$artifacts" | jq --arg name "$EBK_DEPLOYMENT_RECEIPT_ARTIFACT_NAME" \
             '[.artifacts[] | select(.name == $name and .expired == false)] | length')"
           test "$count" = 1 ||
             { echo 'Exact unexpired release evidence artifact is absent or ambiguous'; exit 1; }
@@ -3612,7 +4120,7 @@ jobs:
       - uses: ${downloadArtifactAction}
         with:
           github-token: \${{ github.token }}
-          name: \${{ inputs.release_artifact_name }}
+          name: \${{ inputs.deployment_receipt_artifact_name }}
           path: .
           run-id: \${{ inputs.deploy_run_id }}
       - uses: ${pnpmAction}
@@ -3719,7 +4227,7 @@ jobs:
                       { encoding: "utf8" },
                     ).trim()
                   ) fail("Production deployment tree differs from its reviewed release source.");
-                } else if (stage !== "staging") {
+                } else if (stage !== "${rehearsalStage}") {
                   fail("Protected release stage is invalid.");
                 }
                 const productionKeys = [
@@ -3775,7 +4283,7 @@ jobs:
                   !digest.test(binding.candidateDigest ?? "") ||
                   (stage === "production" &&
                     !digest.test(binding.lifecycleDigest ?? "")) ||
-                  (stage === "staging" && binding.stage !== stage) ||
+                  (stage === "${rehearsalStage}" && binding.stage !== stage) ||
                   binding.runId !== process.env.EBK_DEPLOY_RUN_ID ||
                   binding.runAttempt !== process.env.EBK_DEPLOY_RUN_ATTEMPT ||
                   binding.workflow !== expectedWorkflow
@@ -3854,7 +4362,7 @@ on:
         description: Protected deployed stage
         required: true
         type: choice
-        options: [staging, production]
+        options: [${protectedWorkflowStageChoices}]
       project:
         description: Exact Product Slice project
         required: true
@@ -3954,7 +4462,7 @@ jobs:
           EBK_REPORT_RUN_ID: \${{ inputs.report_run_id }}
         run: |
           case "$EBK_STAGE:$EBK_PROTECTED_REF" in
-            staging:refs/heads/develop|production:refs/heads/main) ;;
+            ${protectedWorkflowStageBranchCases}) ;;
             *) echo 'Async recovery stage does not match its protected branch'; exit 1 ;;
           esac
           case "$EBK_PROJECT" in
@@ -4765,13 +5273,78 @@ permissions:
   contents: read
 
 jobs:
+  deployment-classification:
+    name: classify exact staging deployment
+    if: >-
+      github.event_name == 'workflow_run' &&
+      github.event.workflow_run.event == 'push' &&
+      github.event.workflow_run.head_branch == 'develop' &&
+      github.event.workflow_run.conclusion == 'success'
+    permissions:
+      actions: read
+      contents: read
+    outputs:
+      deployed: \${{ steps.classify.outputs.deployed }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out immutable deployment policy
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
+        with:
+          persist-credentials: false
+          ref: \${{ github.event.workflow_run.head_sha }}
+      - id: profile
+        name: Read exact committed deployment profile
+        run: |
+          node - <<'NODE'
+          const { appendFileSync, readFileSync } = require('node:fs');
+          const policy = JSON.parse(
+            readFileSync('ebk.repository-policy.json', 'utf8'),
+          );
+          const profiles = new Set([
+            'starter',
+            'production-isolated',
+            'fully-isolated',
+          ]);
+          if (!profiles.has(policy.deploymentProfile)) {
+            throw new Error('Committed deployment profile is absent or invalid.');
+          }
+          appendFileSync(
+            process.env.GITHUB_OUTPUT,
+            'profile=' + policy.deploymentProfile + '\\n',
+          );
+          NODE
+      - id: classify
+        name: Require one successful thin staging deployment job
+        env:
+          EBK_DEPLOYMENT_PROFILE: \${{ steps.profile.outputs.profile }}
+          EBK_DEPLOYMENT_RUN_ID: \${{ github.event.workflow_run.id }}
+          GH_TOKEN: \${{ github.token }}
+          GH_REPO: \${{ github.repository }}
+        run: |
+          if [ "$EBK_DEPLOYMENT_PROFILE" = starter ]; then
+            echo 'deployed=false' >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+          jobs="$(gh api \
+            "/repos/$GH_REPO/actions/runs/$EBK_DEPLOYMENT_RUN_ID/jobs?filter=latest&per_page=100")"
+          execute_count="$(printf '%s' "$jobs" | jq \
+            '[.jobs[] | select(.name == "native deploy staging" and .conclusion == "success")] | length')"
+          [ "$execute_count" = 1 ] || {
+            echo 'Deploy must contain exactly one successful thin staging execution'
+            exit 1
+          }
+          echo 'deployed=true' >> "$GITHUB_OUTPUT"
+
   plan:
+    needs: deployment-classification
     if: >-
-      (github.event_name == 'workflow_run' &&
+      always() &&
+      ((github.event_name == 'workflow_run' &&
       github.event.workflow_run.conclusion == 'success' &&
       github.event.workflow_run.event == 'push' &&
-      github.event.workflow_run.head_branch == 'develop') ||
-      github.event_name == 'workflow_dispatch'
+      github.event.workflow_run.head_branch == 'develop' &&
+      needs.deployment-classification.outputs.deployed == 'true') ||
+      github.event_name == 'workflow_dispatch')
     outputs:
       deployment_run_attempt: \${{ steps.identity.outputs.deployment_run_attempt }}
       deployment_run_id: \${{ steps.identity.outputs.deployment_run_id }}
@@ -4878,9 +5451,10 @@ jobs:
       EBK_SMOKE_AUTHORITY_VERSION: \${{ vars.EBK_SMOKE_AUTHORITY_VERSION }}
       EBK_SMOKE_TARGETS: \${{ vars.EBK_SMOKE_TARGETS }}
       EBK_SOURCE_COMMIT: \${{ needs.plan.outputs.source_commit }}
-      PLAYWRIGHT_BROWSERS_PATH: \${{ runner.temp }}/ebk-playwright-browsers
     runs-on: ubuntu-latest
     steps:
+      - name: Initialize private browser cache path
+        run: echo "PLAYWRIGHT_BROWSERS_PATH=$RUNNER_TEMP/ebk-playwright-browsers" >> "$GITHUB_ENV"
       - name: Validate credential-free preparation
         run: |
           test -n "$AWS_EXPECTED_ACCOUNT_ID" || { echo 'AWS_EXPECTED_ACCOUNT_ID is required'; exit 1; }
@@ -5264,14 +5838,14 @@ jobs:
           test "$(node --version | cut -d. -f1)" = v22
       - name: Run exact deployed smoke
         working-directory: \${{ runner.temp }}/ebk-prepared-workspace
-        run: node node_modules/nx/bin/nx.js run "$EBK_PROJECT:smoke-deployed"
+        run: node node_modules/nx/dist/bin/nx.js run "$EBK_PROJECT:smoke-deployed"
       - name: Verify reviewed frontend visual baseline
         working-directory: \${{ runner.temp }}/ebk-prepared-workspace
-        run: node node_modules/nx/bin/nx.js run "$EBK_PROJECT:frontend-visual"
+        run: node node_modules/nx/dist/bin/nx.js run "$EBK_PROJECT:frontend-visual"
       - name: Verify deployed frontend security headers
         working-directory: \${{ runner.temp }}/ebk-prepared-workspace
         run: |
-          node node_modules/nx/bin/nx.js run \
+          node node_modules/nx/dist/bin/nx.js run \
             "$EBK_PROJECT:frontend-security-headers" -- \
             --url="$EBK_SMOKE_URL"
       - name: Bind exact alarm and data-integrity evidence
@@ -6642,7 +7216,7 @@ on:
         description: Protected stage
         required: true
         type: choice
-        options: [staging, production]
+        options: [${protectedWorkflowStageChoices}]
       project:
         description: Exact Product Slice project
         required: true
@@ -6668,11 +7242,9 @@ jobs:
       contents: read
       id-token: write
     env:
-      AWS_DEPLOY_ROLE_ARN: \${{ secrets.AWS_DEPLOY_ROLE_ARN }}
-      AWS_EXPECTED_ACCOUNT_ID: \${{ vars.AWS_EXPECTED_ACCOUNT_ID }}
-      AWS_REGION: \${{ vars.AWS_REGION }}
       EBK_ACTION: \${{ inputs.action }}
       EBK_PROJECT: \${{ inputs.project }}
+      EBK_RENDERED_PROFILE: ${deploymentProfile}
       EBK_STAGE: \${{ inputs.stage }}
     runs-on: ubuntu-latest
     steps:
@@ -6681,19 +7253,12 @@ jobs:
           EBK_PROTECTED_REF: \${{ github.ref }}
         run: |
           case "$EBK_STAGE:$EBK_PROTECTED_REF" in
-            staging:refs/heads/develop|production:refs/heads/main) ;;
+            ${protectedWorkflowStageBranchCases}) ;;
             *) echo 'Secret metadata stage does not match the protected branch'; exit 1 ;;
           esac
           case "$EBK_PROJECT" in
             ''|-*|*-|*[!a-z0-9-]*) echo 'Secret metadata project must be an exact normalized Slice name'; exit 1 ;;
           esac
-          test -n "$AWS_DEPLOY_ROLE_ARN" || { echo "$EBK_STAGE AWS_DEPLOY_ROLE_ARN is required"; exit 1; }
-          test -n "$AWS_EXPECTED_ACCOUNT_ID" || { echo "$EBK_STAGE AWS_EXPECTED_ACCOUNT_ID is required"; exit 1; }
-          test -n "$AWS_REGION" || { echo "$EBK_STAGE AWS_REGION is required"; exit 1; }
-          case "$AWS_DEPLOY_ROLE_ARN" in
-            arn:aws:iam::$AWS_EXPECTED_ACCOUNT_ID:role/*) ;;
-            *) echo 'Secret metadata role does not belong to the expected account'; exit 1 ;;
-          esac
       - uses: ${checkoutAction}
         with:
           persist-credentials: false
@@ -6705,24 +7270,153 @@ jobs:
       - run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
       - name: Verify managed workspace integrity before AWS authority
         run: pnpm nx run ${name}:workspace-health
+      - id: policy
+        name: Derive committed secret metadata stage policy
+        run: |
+${indentWorkflowScript(protectedSecretPolicyDerivationScript(), 10)}
+      - id: authority
+        name: Derive canonical committed stage authority
+        env:
+          EBK_DEVELOPMENT_ACCOUNT: \${{ steps.policy.outputs.development_account_id }}
+          EBK_PRODUCTION_ACCOUNT: \${{ steps.policy.outputs.production_account_id }}
+          EBK_REGION: \${{ steps.policy.outputs.deployment_region }}
+          EBK_STAGING_ACCOUNT: \${{ steps.policy.outputs.staging_account_id }}
+        run: |
+${indentWorkflowScript(`set -euo pipefail\n${(0, workspace_files_thin_deploy_js_1.canonicalStageAuthorityDerivationScript)()}`, 10)}
       - uses: ${configureAwsAction}
         with:
-          role-to-assume: \${{ secrets.AWS_DEPLOY_ROLE_ARN }}
+          audience: \${{ steps.authority.outputs.audience }}
+          role-to-assume: \${{ steps.authority.outputs.role_arn }}
           role-session-name: ebk-secret-metadata-\${{ github.run_id }}-\${{ github.run_attempt }}
-          aws-region: \${{ vars.AWS_REGION }}
-      - name: Verify assumed account
-        run: test "$(aws sts get-caller-identity --query Account --output text)" = "$AWS_EXPECTED_ACCOUNT_ID"
+          aws-region: \${{ steps.policy.outputs.deployment_region }}
+      - name: Verify exact stage authority
+        env:
+          AWS_DEPLOY_ROLE_ARN: \${{ steps.authority.outputs.role_arn }}
+          AWS_PARTITION: \${{ steps.authority.outputs.partition }}
+          EBK_POLICY_ACCOUNT_ID: \${{ steps.authority.outputs.account_id }}
+        run: |
+${indentWorkflowScript((0, workspace_files_thin_deploy_js_1.exactStageDeployerGuardScript)('Secret metadata', '$EBK_POLICY_ACCOUNT_ID'), 10)}
       - name: Reconcile value-blind metadata
+        env:
+          AWS_DEPLOY_ROLE_ARN: \${{ steps.authority.outputs.role_arn }}
+          AWS_EXPECTED_ACCOUNT_ID: \${{ steps.authority.outputs.account_id }}
+          AWS_REGION: \${{ steps.policy.outputs.deployment_region }}
         run: |
           args=("--stage=$EBK_STAGE" "--region=$AWS_REGION")
           if [ "$EBK_ACTION" = apply ]; then args+=("--apply"); fi
           pnpm nx run "$EBK_PROJECT:secret-metadata" -- "\${args[@]}"
 `,
-        '.github/workflows/sync-back.yml': `name: Sync production history
+        '.github/workflows/secret-initialize.yml': `name: Secret initialize
+
+on:
+  workflow_dispatch:
+    inputs:
+      stage:
+        description: Protected stage
+        required: true
+        type: choice
+        options: [${protectedWorkflowStageChoices}]
+      project:
+        description: Exact Product Slice project
+        required: true
+        type: string
+      logical_name:
+        description: Exact machine-generated secret logical name
+        required: true
+        type: string
+      action:
+        description: Value-blind initialization action
+        required: true
+        default: report
+        type: choice
+        options: [report, apply]
+
+concurrency:
+  group: secret-initialize-\${{ inputs.stage }}-\${{ inputs.project }}-\${{ inputs.logical_name }}
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+
+jobs:
+  initialize:
+    environment: \${{ inputs.stage }}
+    permissions:
+      contents: read
+      id-token: write
+    env:
+      EBK_ACTION: \${{ inputs.action }}
+      EBK_LOGICAL_NAME: \${{ inputs.logical_name }}
+      EBK_PROJECT: \${{ inputs.project }}
+      EBK_RENDERED_PROFILE: ${deploymentProfile}
+      EBK_STAGE: \${{ inputs.stage }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Validate protected request
+        env:
+          EBK_PROTECTED_REF: \${{ github.ref }}
+        run: |
+          case "$EBK_STAGE:$EBK_PROTECTED_REF" in
+            ${protectedWorkflowStageBranchCases}) ;;
+            *) echo 'Secret initialize stage does not match the protected branch'; exit 1 ;;
+          esac
+          case "$EBK_PROJECT" in
+            ''|-*|*-|*[!a-z0-9-]*) echo 'Secret initialize project must be an exact normalized Slice name'; exit 1 ;;
+          esac
+          [[ "$EBK_LOGICAL_NAME" =~ ^[A-Za-z][A-Za-z0-9]{0,63}$ ]] ||
+            { echo 'Secret initialize logical name is invalid'; exit 1; }
+      - uses: ${checkoutAction}
+        with:
+          persist-credentials: false
+      - uses: ${pnpmAction}
+      - uses: ${setupNodeAction}
+        with:
+          node-version: ${tool_versions_js_1.WORKSPACE_NODE_VERSION}
+          cache: pnpm
+      - run: pnpm install --frozen-lockfile --ignore-scripts --ignore-pnpmfile
+      - name: Verify managed workspace integrity before AWS authority
+        run: pnpm nx run ${name}:workspace-health
+      - id: policy
+        name: Derive committed secret initialize stage policy
+        run: |
+${indentWorkflowScript(protectedSecretPolicyDerivationScript(), 10)}
+      - id: authority
+        name: Derive canonical committed stage authority
+        env:
+          EBK_DEVELOPMENT_ACCOUNT: \${{ steps.policy.outputs.development_account_id }}
+          EBK_PRODUCTION_ACCOUNT: \${{ steps.policy.outputs.production_account_id }}
+          EBK_REGION: \${{ steps.policy.outputs.deployment_region }}
+          EBK_STAGING_ACCOUNT: \${{ steps.policy.outputs.staging_account_id }}
+        run: |
+${indentWorkflowScript(`set -euo pipefail\n${(0, workspace_files_thin_deploy_js_1.canonicalStageAuthorityDerivationScript)()}`, 10)}
+      - uses: ${configureAwsAction}
+        with:
+          audience: \${{ steps.authority.outputs.audience }}
+          role-to-assume: \${{ steps.authority.outputs.role_arn }}
+          role-session-name: ebk-secret-initialize-\${{ github.run_id }}-\${{ github.run_attempt }}
+          aws-region: \${{ steps.policy.outputs.deployment_region }}
+      - name: Verify exact stage authority
+        env:
+          AWS_DEPLOY_ROLE_ARN: \${{ steps.authority.outputs.role_arn }}
+          AWS_PARTITION: \${{ steps.authority.outputs.partition }}
+          EBK_POLICY_ACCOUNT_ID: \${{ steps.authority.outputs.account_id }}
+        run: |
+${indentWorkflowScript((0, workspace_files_thin_deploy_js_1.exactStageDeployerGuardScript)('Secret initialize', '$EBK_POLICY_ACCOUNT_ID'), 10)}
+      - name: Initialize machine-generated secret value-blind
+        env:
+          AWS_DEPLOY_ROLE_ARN: \${{ steps.authority.outputs.role_arn }}
+          AWS_EXPECTED_ACCOUNT_ID: \${{ steps.authority.outputs.account_id }}
+          AWS_REGION: \${{ steps.policy.outputs.deployment_region }}
+        run: |
+          args=("--logicalName=$EBK_LOGICAL_NAME" "--stage=$EBK_STAGE" "--region=$AWS_REGION")
+          if [ "$EBK_ACTION" = apply ]; then args+=("--apply"); fi
+          pnpm nx run "$EBK_PROJECT:secret-initialize" -- "\${args[@]}"
+`,
+        '.github/workflows/sync-back.yml': `name: Sync protected main history
 
 on:
   workflow_run:
-    workflows: [Deploy]
+    workflows: [Verify]
     types: [completed]
 
 permissions:
@@ -6731,8 +7425,12 @@ permissions:
 
 jobs:
   sync-back:
+    # The sync carries history, not deployment evidence: open it after any
+    # completed main run so a failed production deploy cannot lock develop
+    # behind a sync that never opens.
     if: >-
-      github.event.workflow_run.conclusion == 'success' &&
+      github.event.workflow_run.conclusion != 'cancelled' &&
+      github.event.workflow_run.event == 'push' &&
       github.event.workflow_run.head_branch == 'main'
     runs-on: ubuntu-latest
     steps:
@@ -6746,8 +7444,8 @@ jobs:
             gh pr create \
               --head main \
               --base develop \
-              --title 'chore: sync production history to develop' \
-              --body 'Managed EBK sync-back. Review and merge; this workflow never pushes or auto-merges.'
+              --title 'chore(git): sync protected main to develop' \
+              --body 'Managed EBK source-history sync. Review and merge; this does not claim or waive independent staging or production deployment evidence, and this workflow never pushes or auto-merges.'
             number=$(gh pr list --state open --head main --base develop --json number --jq '.[0].number')
           fi
           echo "Sync-back pull request #$number is ready for review."
@@ -6764,7 +7462,7 @@ jobs:
             fi
             sleep 5
           done
-          echo 'No pull-request verification run materialized. Close and reopen the sync pull request as a human, then approve its workflows.'
+          echo "No pull-request verification run materialized; events created with GITHUB_TOKEN may not start workflows. Close and reopen sync pull request #$number with a user credential (a write-access user, or an agent in that user's own gh session: gh pr close $number && gh pr reopen $number), then approve its workflows if GitHub marks them approval-required."
           exit 1
 `,
         'tools/ebk-infrastructure-plan-summary.mjs': `import {
@@ -7005,9 +7703,15 @@ infrastructure or protected deployment policy. Preserve the ownership boundary r
 \`.ebk/ownership.json\`: managed files belong to EBK, seeded files are generated starting
 points that adopters may change, and unrecorded files are adopter-owned.
 
-Secret values are a human-only TTY ceremony. Agents and CI must never invoke
-\`ebk secret set\` or \`ebk secret remove\`; they may use only value-blind
-metadata, status, and verification commands.
+Ordinary feature work uses affected tests, typecheck, lint, and ownership checks.
+At a local milestone, \`pnpm verify\` checks current source through
+\`${name}:verify-proposed\`, including before the first Git commit. This is not
+protected Blueprint acceptance. The separate \`${name}:verify\` target and
+protected GitHub workflows retain their committed-history and trust gates.
+
+Human-supplied secret values are entered only by a human. The Developer-Agent workflow
+below describes the hand-off for \`ebk secret set\` and \`ebk secret remove\` and the
+value-blind paths agents and CI use.
 
 ## Work markers
 
@@ -7067,40 +7771,6 @@ export default tseslint.config(
     rules: { 'no-console': 'error' },
   },
 );
-`,
-        'README.md': `# ${name}
-
-This workspace was created with Empire Builder Kit v1.
-
-## Start here
-
-1. Review \`docs/architecture.md\`.
-2. Review the generated Foundation before deploying it.
-3. Add product slices through the Empire Builder Kit Nx plugin.
-4. Review \`docs/repository-operating-policy.md\` and \`docs/git-workflow.md\` before enabling production.
-5. Read \`AGENTS.md\` and \`docs/work-markers.md\` before assigning generated customization work to agents.
-
-For one-origin fleet development, initialize the workspace-pinned CLI once with
-\`ebk dev configure --profile=<bounded-development-profile>\`, inspect the certificate reported
-by \`ebk dev setup\`, and then explicitly approve \`ebk dev setup --trust\`. The supported v1
-origin uses the complete explicit-port HTTPS URL reported at startup; optional
-\`--portless\` setup is experimental. \`ebk dev doctor\` requires a real exact-host TLS
-handshake for trust and connectivity readiness, and reports portless access ready
-only after a live port-443 probe. Complete
-\`aws sso login --profile <bounded-development-profile>\`, then start selected Slices with
-\`ebk dev up billing accounts\`. The CLI derives the personal stage from the operating-system
-account, reads the saved profile and Region, propagates that AWS context to child Slices, and
-uses SST \`mono\` mode so agents and non-cursor-addressable terminals receive ordinary logs.
-Use \`ebk dev status\`, \`ebk dev logs\`, \`ebk dev tail\`, \`ebk dev restart\`,
-\`ebk dev down\`, and \`ebk dev doctor\` without supplying a stage. Setup, doctor, and the
-managed root Fleet target remain internal Nx-backed implementation surfaces; \`ebk dev\` is the
-framework-local development interface. For the development namespace, if the shell does not
-expose workspace binaries, \`pnpm exec ebk dev ...\` only locates the workspace-pinned binary;
-it is not another framework command surface. Protected Blueprint receipt review must instead
-use the direct installed \`.bin/ebk blueprint verification-review\` entry documented in
-\`docs/blueprints.md\`.
-
-Workspace creation only writes source files. It does not create or change cloud resources.
 `,
         'docs/architecture.md': `# Workspace architecture
 
@@ -7114,248 +7784,18 @@ The Standard Foundation lives at \`packages/foundation\`. Product slices live be
 \`packages/<slice-name>\` and consume versioned Foundation contracts instead of importing
 Foundation implementation files.
 
-Canonical consumer stages use the matching \`development\`, \`staging\`, or \`production\`
-Foundation. Framework-derived personal stages may use only the \`development\`
-Foundation; generic preview stages are unsupported.
-`,
-        'docs/git-workflow.md': `# Protected Git workflow
-
-Ordinary work starts from \`develop\` and returns through a reviewed pull request to
-\`develop\`. A production promotion is exactly \`develop\` to \`main\`. After production,
-review and merge the managed \`main\` to \`develop\` sync-back pull request before ordinary
-work resumes.
-
-Both protected branches require the stable \`policy\` and \`verify\` checks, one approving
-review including an approval from the committed catch-all CODEOWNER and someone other than the
-most recent pusher, dismissed stale reviews, resolved conversations, and merge commits. Replace
-the placeholder in \`.github/CODEOWNERS\` with a GitHub user or team that has repository access
-before bootstrap. An approval from \`github-actions[bot]\` cannot satisfy the independent
-code-owner gate; the Actions repository setting is needed to create the managed sync-back pull
-request, not to approve it.
-Direct updates, force pushes, deletion, squash merging, and rebase merging are prohibited.
-GitHub rulesets, environments, and AWS IAM are the authorization boundaries; local hooks are
-only defense in depth.
-
-The \`staging\` environment accepts only \`develop\`; \`production\` accepts only \`main\`.
-The committed \`productionApproval.mode\` selects one of two production authorization
-contracts:
-
-- \`promotion-pr\` is compatible with private repositories on GitHub Team. The required
-  non-author CODEOWNER approval on the exact \`develop\` to \`main\` promotion pull request
-  is the production authorization. Merging that pull request starts production deployment;
-  there is no second EBK-managed environment approval or wait timer. The approver may also be
-  the human whose merge triggers deployment. Roll back through a reviewed revert on the
-  protected branches and let the resulting \`main\` push redeploy. A repository write actor who
-  can run Actions may also manually dispatch \`deploy\`, \`refresh\`, or \`unlock\` against the
-  already approved \`main\` tip without another human gate. That residual cannot introduce
-  unreviewed source; production \`remove\` remains separately variable-gated. Restrict write and
-  Actions access, audit dispatches, or select \`environment-reviewer\` when every production
-  action needs separate approval.
-- \`environment-reviewer\` adds a separate production environment reviewer with self-review
-  prevention. A private repository needs GitHub Enterprise capability for this mode. Bootstrap
-  inspects that capability and fails closed on an unsupported plan; it never silently changes
-  the committed mode.
-
-Both modes retain required checks, a non-author CODEOWNER approval, no ruleset bypass, the
-literal production environment, and its branch-scoped credentials. The base \`staging\` and
-\`production\` environments own deployment, smoke, and ECR evidence roles plus their
-variables; production also owns the staging-registry promotion pull role. Dedicated
-\`infrastructure-plan-<stage>\` environments gate read-only role use. Separate
-\`async-recovery-<stage>\`, \`performance-aggregate-<stage>\`,
-\`performance-cost-<stage>\`, \`performance-load-<stage>\`, and
-\`reliability-read-<stage>\` environments own only the role and variables required by that
-capability. Infrastructure-plan jobs use a repository-variable read-only role/input inventory;
-an independent clean audit job assumes that exact environment-subject role and verifies its
-trust and complete inline policy before any repository-backed plan job may assume it. Every
-\`*-staging\` environment accepts only \`develop\`; every
-\`*-production\` environment accepts only \`main\`; reviewer, self-review, and wait protection
-matches the corresponding base stage. The credential-free \`npm-prerelease\` environment
-accepts only \`main\` and contains no secrets or variables. In Team-compatible
-\`promotion-pr\` mode, protected-main review plus the exact current-main tag binding is
-publication authorization, so it has no reviewer or wait rule. In
-\`environment-reviewer\` mode it mirrors production protection. Never add repository- or
-organization-visible fallbacks for protected values. Keep repository default workflow
-permissions read-only; generated jobs request only the additional permissions they need.
-
-\`EBK_FLEET_ORIGIN\` is the sole protected deployment and smoke origin. Read-only plan jobs
-enter only their dedicated \`infrastructure-plan-<stage>\` environment; their stage-named
-repository variables \`EBK_STAGING_FLEET_ORIGIN\` and
-\`EBK_PRODUCTION_FLEET_ORIGIN\` remain plan inputs only. Before mutation, each
-base-environment-protected deployment requires
-its \`EBK_FLEET_ORIGIN\` to equal the origin retained by the plan.
-
-\`AWS_ASYNC_RECOVERY_ROLE_ARN\` is a separate mutation role. Trust only this
-repository's exact \`async-recovery-<stage>\` GitHub OIDC subject and grant only
-the recovery operations/resources declared by generated capability adapters.
-
-\`AWS_PERFORMANCE_LOAD_ROLE_ARN\` is a separate read-only OIDC role. Trust only
-this repository's exact \`performance-load-<stage>\` GitHub OIDC subject.
-Set that environment's \`EBK_PERFORMANCE_ORIGINS_JSON\` to a JSON object that
-maps every reviewed Slice to the exact \`performanceEndpoint\` emitted by its
-current deployment; never copy the map to repository scope or substitute the
-fleet web origin. The workflow selects only its requested Slice, and the
-committed load plan must name that same origin and exact reserved Slice path.
-Grant \`sts:GetCallerIdentity\` and \`secretsmanager:GetSecretValue\` only on
-\`arn:<partition>:secretsmanager:<region>:<account>:secret:ebk/<stage>/<slice>/*\` for
-reviewed Slices. Do not grant secret writes, deployment, CloudFormation, SST,
-or CloudWatch Logs access. The protected workflow never logs or uploads HMAC
-material and removes its new job-scoped 0600 file after cleanup.
-Bootstrap verifies environment-only secret placement, not the role's hidden
-AWS trust or permission policy.
-
-\`AWS_PERFORMANCE_AGGREGATE_ROLE_ARN\` is a separate adopter-owned read-only
-OIDC role. Trust only this repository's exact
-\`performance-aggregate-<stage>\` GitHub OIDC subject. Grant
-\`sts:GetCallerIdentity\` plus only the exact data-read actions and resource
-ARNs required by the adopted \`performance/aggregate-count-provider.ts\`.
-Do not grant writes, deployment, CloudFormation, SST, IAM, Cost Explorer, or
-unrelated data access. The generated workflow validates the protected Deploy
-artifact before role assumption, verifies the STS account and environment
-Region, withholds the OIDC bearer, and clears the AWS session before artifact
-retention. Bootstrap verifies environment-only secret placement, not the
-role's hidden AWS trust or least-privilege permission policy.
-
-\`AWS_PERFORMANCE_COST_ROLE_ARN\` is a separate read-only OIDC role. Trust only
-this repository's exact \`performance-cost-<stage>\` GitHub OIDC subject.
-Grant only \`sts:GetCallerIdentity\`, \`ce:ListCostAllocationTags\`, and
-\`ce:GetCostAndUsage\`; Cost Explorer
-queries are account-global, while the retained evidence still binds the
-selected resource Region. Do not grant budget, anomaly-monitor, tag, billing,
-deployment, CloudFormation, SST, or other mutation authority. Bootstrap verifies
-environment-only secret placement, not the role's hidden AWS trust or
-permission policy.
-
-The framework manages
-\`.github/workflows/performance-aggregate-counts.yml\`, its exact Deploy
-binding, evidence wrapper, artifact name, and canonical schema. The seeded
-\`performance/aggregate-count-provider.ts\` remains adopter-owned and fails
-closed until it returns only the reviewed business counts and provider request
-reference. The provider runs only with the dedicated aggregate-read role after
-the framework validates the exact protected release and STS account. The
-workflow binds those untrusted counts to the environment-owned account/Region,
-closed period, exact current protected release, Slice, stage, and workspace
-and records the dedicated OIDC access mode and adopter-owned least-privilege
-read contract before it emits the single
-\`aggregate-count-<stage>-<slice>-<run>-<attempt>\` artifact. The framework
-does not invent counts or copy them from request-level dimensions.
-
-\`performance-cost-actual.yml\` treats supplied run IDs and artifact names only
-as selectors. Before OIDC it queries GitHub for the fixed aggregate workflow
-and generated \`Deploy\` workflow runs, requiring the same repository,
-candidate, protected branch, successful conclusion, allowed event, exact
-workflow name/path, and one exact nonexpired artifact. It derives the compact
-performance release binding from that Deploy artifact and separately verifies
-the independently approved aggregate-count and release-binding byte digests.
-
-\`AWS_RELIABILITY_READ_ROLE_ARN\` is a separate read-only OIDC role. Trust only
-this repository's exact \`reliability-read-<stage>\` GitHub OIDC subject.
-Grant \`sts:GetCallerIdentity\`, \`cloudwatch:DescribeAlarms\`,
-\`cloudwatch:DescribeAlarmHistory\`, \`cloudwatch:GetMetricData\`,
-\`ecs:DescribeServices\`, and \`states:DescribeExecution\`. Scope ECS and Step
-Functions resources to the reviewed Slice services, state machines, and
-executions wherever IAM supports resource-level constraints. Do not grant log
-reads, deployment, CloudFormation, SST, or any AWS mutation.
-
-The generated \`reliability-read.yml\` workflow selects the newest nonexpired
-binding artifact from a successful deployed-smoke run, reconciles it to the
-current successful protected deployment, and checks out that exact commit
-before assuming the role. Callers choose only a bounded operation and workload;
-they cannot supply the AWS account, Region, role, or binding path. The binding
-allowlists exact alarm names, API ID, ECS services, and Step Functions
-resources before the adapter makes a service call. Bootstrap verifies
-environment-only secret placement, not the role's hidden AWS trust or
-permission policy.
-
-The async-recovery, performance-load, performance-cost, and reliability-read
-jobs have job-scoped \`id-token: write\`. They install the frozen dependency
-graph with lifecycle scripts and pnpm hooks disabled before assuming AWS
-authority. Immediately after the one pinned credential action, they blank the
-OIDC request URL and bearer for future steps and explicitly shadow both values
-empty on every later step. After bounded AWS use, they blank current AWS
-credential variables before evidence upload. This withholds credentials from
-later processes; it does not claim that GitHub revokes the job-level
-permission.
-
-\`AWS_SMOKE_ROLE_ARN\` is separate from deployment authority. Trust only this
-repository's GitHub OIDC subject for the matching protected environment. Grant
-only run-scoped Cognito principal setup/cleanup on reviewed user-pool ARNs and
-\`logs:FilterLogEvents\` on exact
-\`/ebk/<stage>/<slice>/event-consumer\` log-group ARNs. Do not grant
-CloudFormation, SST mutation, broad Logs query, \`GetLogEvents\`,
-\`StartQuery\`, or \`logs:Unmask\`. Bootstrap verifies environment-only secret
-inventory but never creates or reads the secret, materializes the role, or
-attests its hidden policy.
-
-Run the GitHub bootstrap in report mode first. Source upgrades never alter remote GitHub
-settings. Apply a reviewed report only after \`develop\` exists and the candidate's exact
-\`policy\` and \`verify\` check contexts have run.
-
-Set \`GH_REPO=<owner>/<repository>\` and a suitable \`GH_TOKEN\`, then run
-\`pnpm nx run ${name}:github-bootstrap\`. Review the deterministic report before rerunning
-with \`--apply\`. The command never creates branches, credentials, secrets, or AWS resources.
-Supply \`--npmPrereleaseReviewerIds=<id,...>\` only in
-\`environment-reviewer\` mode when intentionally setting a distinct npm
-mutation reviewer set.
-Supply \`--productionReviewerIds=<id,...>\` only when committed policy selects
-\`environment-reviewer\`; it is rejected in \`promotion-pr\` mode.
-
-Install the optional defense-in-depth pre-push hook explicitly with
-\`pnpm nx run ${name}:install-git-hooks\`. It refuses to overwrite an unrelated existing hook.
-
-The sync-back workflow uses only \`GITHUB_TOKEN\` and never pushes or auto-merges. GitHub may
-place its pull-request workflows in an approval-required state. Approve them; if no run
-materializes, close and reopen the pull request as a human and then approve it.
-`,
-        'docs/repository-operating-policy.md': `# Repository Operating Policy
-
-\`ebk.repository-policy.json\` is the reviewed source of truth for production access,
-production approval, per-Slice readiness, and the one shared production Foundation profile.
-New workspaces start with production disabled and explicit Team-compatible
-\`productionApproval.mode: "promotion-pr"\`. A missing approval mode or Slice entry fails
-closed; no GitHub capability is allowed to choose a mode implicitly.
-
-The named repository modes are source-writing presets, not runtime state. Report a change
-first and inspect the complete current/next policy:
-
-\`\`\`bash
-pnpm nx g @empire-builder-kit/nx:repository-policy \\
-  --preset=controlled-production --slices=billing
-\`\`\`
-
-Apply the reviewed source change separately with \`--apply\`. This command never contacts AWS
-or GitHub. Use \`--status=blocked|pilot|ready\` for explicit Slice transitions and
-\`--profile=cost-optimized|standard\` for an explicit shared Foundation decision.
-Use \`--productionApprovalMode=promotion-pr|environment-reviewer\` for an explicit approval
-transition. This changes committed policy only; a separate bootstrap report/apply reconciles
-remote GitHub settings.
-
-Validation requires both an explicit production approval mode and an explicit Foundation
-profile. It does not infer omitted values. Use \`promotion-pr\` for a private GitHub Team
-repository. Use \`environment-reviewer\` only when the repository plan can enforce a separate
-environment reviewer.
-
-- \`blocked\` prohibits production create, update, and migration.
-- \`pilot\` permits protected evidence gathering without claiming normal latency or maturity.
-- \`ready\` records an adopter decision after its evidence and review; it is not inferred.
-- removal and unlock remain explicit protected recovery paths so disabled policy cannot strand
-  resources.
-
-Protected production deploy and refresh validate the complete Foundation/Slice set before AWS
-access. The Foundation is always ordered first. The set is derived from committed policy and
-cannot be narrowed with an ad hoc project argument.
-
-\`standard\` keeps Aurora warm at 2–16 ACU. \`cost-optimized\` is a prerelease candidate at
-0–4 ACU with a five-minute auto-pause and potential cold-resume latency. Both keep managed NAT,
-30-day backups, deletion protection, retained data, and the protected GitHub/OIDC/AWS path.
-Changing policy affects only later lifecycle requests; it never deploys or removes resources.
-Changing profile requires a separate reviewed Foundation deployment and retained operational
-evidence.
-
-\`EBK_PRODUCTION_FOUNDATION_PROFILE\` is reserved managed executor input. The lifecycle
-executor derives it from validated committed policy immediately before SST and removes any
-ambient shell value. Do not set it as a local, repository, organization, or environment
-variable. Incubation keeps the last configured profile so protected remove and unlock can still
-render existing production resources; production deploy remains disabled.
+This workspace's \`${deploymentProfile}\` profile activates only:
+${activeStages.join(', ')}. Each active canonical consumer stage uses the matching Foundation.
+Inactive canonical stages are rejected. Framework-derived personal stages may use only the
+\`development\` Foundation; generic preview stages are unsupported.
+
+Every active canonical stage owns a separate Router/domain, Cognito user pool,
+event bus, secret namespace, IAM boundary, logs, queues, ECR namespace, and
+stage-qualified SSM discovery contract. Discovery rejects a record for an inactive or different
+canonical stage. DynamoDB tables belong to individual Slices/tasks, not one global application
+table. Declared relational features add an independent Aurora cluster per canonical stage,
+with separate logical databases and migration histories per Slice. Existing relational resources
+remain declared on upgrade and after removing their last consumer; that is not database retirement.
 `,
         'docs/work-markers.md': `# Agent work markers
 
@@ -7415,8 +7855,22 @@ deployment by themselves. Open \`SECURITY\` and \`BLOCKER\` markers fail staging
 deploy or refresh before AWS access. Protected remove and unlock remain usable for recovery.
 There is no local or silent bypass in this prerelease contract; any future waiver mechanism
 must be committed, reviewable, and auditable.
+
+## Shared-operation claims
+
+\`${workspace_files_shared_operation_claims_js_1.SHARED_OPERATION_CLAIMS_PATH}\` is a seeded claim ledger for operations that only one
+actor at a time may run: gateway setup, package release, candidate adoption, database
+replacement, and development deployment. Before starting one, an agent or human reads the
+current ledger where the other actors record claims; if another open claim names the same
+operation, it stops and reports the conflict instead of running the operation. Otherwise it
+records one \`EBK-TODO\` claim with the reference
+\`PLAN:${workspace_files_shared_operation_claims_js_1.SHARED_OPERATION_CLAIM_PHASE}/<operation>\`, commits it where the others read the
+ledger, and deletes the claim when the operation and its verification are complete. The
+work-markers target above lists open claims. Nothing enforces a claim; the ledger is a
+convention, current only as far as the copy each actor reads.
 `,
-        'ebk.repository-policy.json': json((0, index_js_4.createIncubationRepositoryPolicy)()),
+        [workspace_files_shared_operation_claims_js_1.SHARED_OPERATION_CLAIMS_PATH]: (0, workspace_files_shared_operation_claims_js_1.renderSharedOperationClaims)(name),
+        'ebk.repository-policy.json': json(initialRepositoryPolicy),
         'nx.json': json({
             $schema: './node_modules/nx/schemas/nx-schema.json',
             defaultBase: 'develop',
@@ -7456,6 +7910,7 @@ must be committed, reviewable, and auditable.
                     inputs: ['default', '^production'],
                 },
             },
+            analytics: false,
             neverConnectToCloud: true,
             useDaemonProcess: false,
         }),
@@ -7471,23 +7926,25 @@ must be committed, reviewable, and auditable.
             scripts: {
                 build: `nx run-many -t build --exclude=${name}`,
                 format: 'nx format:write',
-                'format:check': 'nx format:check',
+                'format:check': 'nx format:check --all',
                 graph: 'nx graph',
                 health: `nx run ${name}:workspace-health`,
                 lint: `nx run-many -t lint --exclude=${name}`,
                 test: `nx run-many -t test --exclude=${name}`,
                 typecheck: `nx run-many -t typecheck --exclude=${name}`,
-                verify: `nx run ${name}:verify && nx run-many -t verify --exclude=${name}`,
+                verify: `nx format:check --all && nx run ${name}:verify-proposed && nx run-many -t verify --exclude=${name}`,
             },
             dependencies: {
                 '@empire-builder-kit/runtime': frameworkVersion,
             },
             devDependencies: {
                 '@aws-sdk/client-iam': TOOL_VERSIONS.awsSdk,
+                '@aws-sdk/client-rds': TOOL_VERSIONS.awsSdk,
                 '@aws-sdk/client-s3': TOOL_VERSIONS.awsSdk,
                 '@aws-sdk/client-secrets-manager': TOOL_VERSIONS.awsSdk,
                 '@aws-sdk/client-ssm': TOOL_VERSIONS.awsSdk,
                 '@aws-sdk/client-sts': TOOL_VERSIONS.awsSdk,
+                '@aws-sdk/credential-providers': TOOL_VERSIONS.awsSdk,
                 '@eslint/js': TOOL_VERSIONS.eslintJs,
                 '@empire-builder-kit/nx': frameworkVersion,
                 '@types/node': TOOL_VERSIONS.nodeTypes,
@@ -7520,6 +7977,15 @@ must be committed, reviewable, and auditable.
                         protectedRef: 'refs/remotes/origin/develop',
                     },
                 },
+                'blueprint-trust-check-main': {
+                    executor: '@empire-builder-kit/nx:blueprint-trust',
+                    options: {
+                        operation: 'adopt',
+                        output: '.ebk/evidence/supply-chain/blueprint-trust.json',
+                        protectedBranch: 'main',
+                        protectedRef: 'refs/remotes/origin/main',
+                    },
+                },
                 'blueprint-trust-check-protected': {
                     executor: '@empire-builder-kit/nx:blueprint-trust',
                     options: {
@@ -7562,6 +8028,23 @@ must be committed, reviewable, and auditable.
                     executor: 'nx:run-commands',
                     options: { command: 'node tools/install-ebk-hooks.mjs' },
                 },
+                'stage-authority-render': {
+                    cache: false,
+                    executor: 'nx:run-commands',
+                    outputs: ['{workspaceRoot}/.ebk/authority/{args.stage}/*'],
+                    options: {
+                        command: 'node tools/stage-authority-render.mjs',
+                        forwardAllArgs: true,
+                    },
+                },
+                'deploy-local': {
+                    cache: false,
+                    dependsOn: ['workspace-health'],
+                    executor: '@empire-builder-kit/nx:local-deploy',
+                    options: {
+                        stage: 'development',
+                    },
+                },
                 'supply-chain-check': {
                     executor: 'nx:run-commands',
                     options: {
@@ -7585,64 +8068,27 @@ must be committed, reviewable, and auditable.
                     executor: '@empire-builder-kit/nx:work-markers',
                     options: {},
                 },
-                'workload-role-candidate-report': {
-                    executor: 'nx:run-commands',
-                    options: {
-                        command: 'node tools/workload-role-baseline/report-candidate-bundle.mjs',
-                        forwardAllArgs: true,
-                    },
-                },
-                'workload-role-provisioner-build': {
-                    executor: 'nx:run-commands',
-                    options: {
-                        command: 'node tools/workload-role-baseline/build.mjs',
-                    },
-                },
                 verify: {
                     dependsOn: ['blueprint-trust-check', 'supply-chain-check'],
                     executor: 'nx:run-commands',
                     options: { command: 'node tools/workspace-health.mjs' },
                 },
+                'verify-proposed': {
+                    dependsOn: ['supply-chain-check'],
+                    executor: 'nx:run-commands',
+                    options: { command: 'node tools/workspace-health.mjs' },
+                },
                 'workspace-health': {
                     executor: 'nx:run-commands',
                     options: { command: 'node tools/workspace-health.mjs' },
                 },
             },
         }),
-        'packages/foundation/README.md': `# Standard Foundation
-
-This project owns the workspace-wide AWS platform for each canonical \`development\`,
-\`staging\`, or \`production\` stage. It is a separate SST state boundary from product slices.
-Never deploy it at a framework-derived personal stage; that consumer maps to
-\`development\`.
-
-It provides the v1 network, routing, container compute, Postgres, identity, events,
-observability, configuration, and deployment capabilities. Product slices consume its
-versioned contract; they do not import files from \`infra/\`.
-
-Workspace creation does not deploy this project. Review \`docs/costs.md\`,
-\`docs/security.md\`, and \`docs/runbooks.md\` before the first deployment.
-
-Set \`EBK_ROOT_DOMAIN\` before deploying when Route 53 in the target account owns a public
-domain. Without it, the shared Router uses its functional provider URL.
-`,
-        'packages/foundation/contracts/foundation.json': json({
-            contractVersion: '1.0.0',
-            capabilities: [
-                'network',
-                'routing',
-                'container-compute',
-                'postgres',
-                'identity',
-                'events',
-                'observability',
-                'configuration',
-                'deployment',
-            ],
-        }),
+        'packages/foundation/contracts/foundation.json': json(foundationPlan.descriptor),
         'packages/foundation/contracts/costs.json': json({
-            schemaVersion: 2,
+            schemaVersion: 3,
             aurora: {
+                declared: foundationPlan.resources.postgres,
                 engine: index_js_4.FOUNDATION_AURORA_ENGINE_FAMILY,
                 engineVersion: index_js_4.FOUNDATION_AURORA_ENGINE_VERSION,
             },
@@ -7650,19 +8096,29 @@ domain. Without it, the shared Router uses its functional provider URL.
             productionProfileSource: 'ebk.repository-policy.json',
             stages: {
                 development: {
-                    aurora: 'scale-to-zero',
+                    aurora: foundationPlan.resources.postgres
+                        ? 'scale-to-zero'
+                        : 'not-declared',
                     dataRetention: 'retained',
-                    nat: 'ec2',
-                },
-                staging: {
-                    aurora: 'scale-to-zero',
-                    dataRetention: 'retained',
-                    nat: 'ec2',
+                    nat: foundationPlan.resources.network ? 'ec2' : 'none',
                 },
+                ...(deploymentProfile === 'starter'
+                    ? {}
+                    : {
+                        staging: {
+                            aurora: foundationPlan.resources.postgres
+                                ? 'scale-to-zero'
+                                : 'not-declared',
+                            dataRetention: 'retained',
+                            nat: foundationPlan.resources.network ? 'ec2' : 'none',
+                        },
+                    }),
                 production: {
-                    aurora: 'repository-policy',
+                    aurora: foundationPlan.resources.postgres
+                        ? 'repository-policy'
+                        : 'not-declared',
                     dataRetention: 'retained-and-protected',
-                    nat: 'managed',
+                    nat: foundationPlan.resources.network ? 'managed' : 'none',
                 },
             },
             usagePriced: [
@@ -7677,68 +8133,55 @@ domain. Without it, the shared Router uses its functional provider URL.
         'packages/foundation/contracts/frontend-security-headers.json': json((0, index_js_2.foundationFrontendSecurityHeaderPolicy)()),
         'packages/foundation/docs/costs.md': `# Foundation cost contract
 
-The VPC NAT path and Aurora capacity are the main fixed-cost decisions.
+The default Foundation has no Aurora, VPC/NAT, or ECS cluster. Slice-scoped DynamoDB
+is the first persistence choice. A relational requirement adds Aurora and its
+network/container migration dependencies; an explicit network workload can also
+require those dependencies without SQL. Previously provisioned capabilities stay
+declared until an explicit retirement operation, even with no remaining consumers.
 The machine-readable stage inventory is \`../contracts/costs.json\`; keep this
 seeded decision record aligned with organization-specific budgets and alerts.
 
-- Development uses EC2 NAT, a development bastion, and Aurora scale-to-zero.
-- Staging uses EC2 NAT and Aurora scale-to-zero by default.
-- Production always uses managed NAT and retains protected data. Its explicit Repository
-  Operating Policy profile selects either the standard always-warm Aurora floor or the
-  prerelease cost-optimized auto-pause candidate.
+- When network/SQL is declared, development uses EC2 NAT, a development bastion,
+  and Aurora scale-to-zero (${(0, cost_estimate_js_1.nonproductionAuroraScalingLabel)('development')}).
+${deploymentProfile === 'starter' ? '' : `- Declared staging network/SQL uses EC2 NAT and Aurora scale-to-zero (${(0, cost_estimate_js_1.nonproductionAuroraScalingLabel)('staging')}) by default.\n`}- Declared production networking uses managed NAT; production retains protected data. Its explicit Repository
+  Operating Policy profile selects cost-optimized (0–2 ACUs, pause after five idle
+  minutes), balanced (0.5–4 ACUs, always warm), or standard (2–16 ACUs, always warm).
+  Newly generated repositories default to cost-optimized in every deployment profile.
+  Cold resume adds latency; measure it for the workload and validate
+  connection retries, request timeouts, migrations, and background polling.
+  Capacity is shared by all Slices. Open connections can prevent pausing; storage
+  and managed NAT remain billable while Aurora compute is paused.
+  Existing 0.5–4 cost-optimized adopters must explicitly select balanced before
+  upgrade, then opt into cost-optimized separately if cold starts are acceptable.
 - ECS, EventBridge, Cognito, SNS, SSM, and CloudWatch are primarily usage-priced; logs,
   metrics, alarms, and retained data still require active cost review.
+- Every deployed stage of every Standard Slice, including each personal development
+  stage, adds its own fixed floor: a KMS key, secrets, a machine-to-machine app client,
+  CloudWatch alarms and a dashboard. The estimate below lists it.
 
 Run \`foundation:remove\` only for disposable stages. Production is retained and protected by
 the SST configuration.
-`,
-        'packages/foundation/docs/runbooks.md': `# Foundation runbooks
-
-## Deployment
 
-Use Nx for every supported lifecycle action:
-
-- \`pnpm nx run foundation:deploy --stage=development\`
-- \`pnpm nx run foundation:refresh --stage=development\`
-- \`pnpm nx run foundation:unlock --stage=development\`
-- \`pnpm nx run foundation:remove --stage=development\`
-
-Do not invoke SST lifecycle commands directly. Production deployment belongs in the trusted
-CI path.
-
-Foundation stages are canonical. \`ebk dev\` derives a Product Slice personal
-stage from the operating-system account and maps that consumer to the
-development Foundation. Callers cannot select that stage. Slice preflight
-reports both identities, never deploys a personal Foundation, and full mapped
-personal-stage deploys fail closed.
-
-## Database restore
-
-Production Aurora retains 30 days of automated backups; non-production retains 7 days.
-Restore into a new cluster, validate application migrations and data integrity, then cut over
-consumers deliberately. Never expose the Foundation master credential to a product slice.
-
-## Protected database migrations
-
-Each database-backed Product Slice deploys a one-off Fargate migration task and
-Standard Step Functions workflow into the shared cluster. The existing
-environment-scoped \`AWS_DEPLOY_ROLE_ARN\` starts and observes that exact
-workflow; do not create a second migration OIDC role. GitHub has no direct SQL,
-database-secret-value, or \`rds-db:connect\` authority. The generated task role
-connects as the Slice's no-password IAM-authenticated migrator user.
-`,
+${(0, cost_estimate_js_1.renderFoundationCostEstimate)({ deploymentProfile, headingLevel: 2 })}`,
         'packages/foundation/docs/security.md': `# Foundation security contract
 
 - Production resources are retained and protected.
-- The shared Aurora master credential is Foundation-internal.
-- Aurora IAM authentication is enabled for generated short-lived migration
+- When relational persistence is declared, the shared Aurora master credential is Foundation-internal.
+- Declared Aurora IAM authentication is enabled for generated short-lived migration
   tasks. The exact cluster resource ID is non-secret Foundation discovery.
-- Product slices receive scoped logical-database credentials through the provisioning contract.
+- Relational Product Slices receive scoped logical-database credentials through the provisioning contract.
+- DynamoDB tables and their access are Slice/task scoped; no shared Foundation application table exists.
 - Cognito owns authentication; product slices own authorization policy and app clients.
 - Lambda and server-side web workloads use resource linking. Containers use the documented
   stage-scoped SSM/secret path and least-privilege IAM.
 - Public domains are configured explicitly through \`EBK_ROOT_DOMAIN\`; generated source never
   contains credentials or customer domain assumptions.
+- Every stage's CloudFront Router has its own global Web ACL. The baseline always includes AWS
+  Common Rule Set, Known Bad Inputs, Amazon IP Reputation, rate blocking, CloudWatch metrics,
+  and sampled requests. Nonproduction is allowlisted by default. Production is public by
+  default, but cannot deploy until the exact policy has passed a ${rehearsalStage} blocking rehearsal.
+- Full WAF request logging is disabled by default. Enabling it keeps blocked requests only,
+  uses bounded retention, and redacts query strings, cookies, authorization, and API keys.
 
 The managed \`contracts/frontend-security-headers.json\` file owns the transport
 minimum: HTTPS in deployed environments, one-year HSTS there, and the common
@@ -7770,18 +8213,32 @@ declare const $app: {
 
 import {
   FOUNDATION_SSM_SCHEMA_VERSION,
-  STANDARD_FOUNDATION_CAPABILITIES,
+  createRouterWafRules,
+  createRouterWafStagePlan,
+${foundationPlan.resources.postgres ? '  foundationDatabaseEndpointHost,' : ''}
   foundationSsmPath,
+  normalizeRouterWafPolicy,
+  reconcileRouterWafBlockingRehearsal,
+  routerWafContractDigest,
   type FoundationSsmKey,
 } from '@empire-builder-kit/nx/foundation';
 import {
-  FOUNDATION_AURORA_ENGINE,
-  FOUNDATION_AURORA_ENGINE_VERSION,
+${foundationPlan.resources.postgres ? '  FOUNDATION_AURORA_ENGINE,\n  FOUNDATION_AURORA_ENGINE_VERSION,' : ''}
   productionFoundationProfileContract,
 } from '@empire-builder-kit/nx/repository-policy';
+import { installStageIamBoundaryTransforms } from '@empire-builder-kit/nx/aws-authority';
+import { createStageAuthorityIdentity } from '@empire-builder-kit/nx/aws-authority';
+import {
+  configuredDeploymentAccountForStage,
+  configuredDeploymentRegion,
+  productionRehearsalStage,
+} from '@empire-builder-kit/nx/repository-policy';
 import { createFoundationAccountCostControlPlan } from '@empire-builder-kit/nx/performance';
 import accountCostPolicy from '../performance/account-cost-policy.json';
-import type { FoundationWorkloadRolePreflight } from './workload-roles/preflight.js';
+import routerWafBlockingRehearsal from '../security/router-waf-blocking-rehearsal.json';
+import routerWafLiveEvidence from '../security/router-waf-live-evidence.json';
+import routerWafPolicy from '../security/router-waf.json';
+import repositoryPolicy from '../../../ebk.repository-policy.json';
 
 function identityDomainPrefix(stage: string, accountId: string): string {
   if (!/^\\d{12}$/.test(accountId)) {
@@ -7802,7 +8259,7 @@ function identityDomainPrefix(stage: string, accountId: string): string {
   return value.slice(0, 50) + '-' + digest;
 }
 
-function publishFoundation(values: Record<FoundationSsmKey, any>) {
+function publishFoundation(values: Partial<Record<FoundationSsmKey, any>>) {
   return Object.fromEntries(
     Object.entries(values).map(([key, value]) => [
       key,
@@ -7815,45 +8272,78 @@ function publishFoundation(values: Record<FoundationSsmKey, any>) {
   );
 }
 
-export function foundation(
-  workloadRoles?: FoundationWorkloadRolePreflight,
-) {
-  if (!$dev && !workloadRoles) {
-    throw new Error(
-      'Protected Foundation workload-role preflight must complete before infrastructure construction.',
-    );
-  }
+export function foundation() {
   const isProduction = $app.stage === 'production';
-  const isStaging = $app.stage === 'staging';
+${foundationPlan.resources.postgres ? "  const isStaging = $app.stage === 'staging';" : ''}
   const rootDomain = process.env.EBK_ROOT_DOMAIN?.trim();
   const productionConfiguration = isProduction
     ? productionFoundationProfileContract(
         process.env.EBK_PRODUCTION_FOUNDATION_PROFILE,
       )
     : undefined;
-  const natMode = productionConfiguration?.contract.nat ?? 'ec2';
-  const natBinding = workloadRoles?.bindings.nat;
-  if (natMode === 'ec2' && natBinding) {
-    $transform(
-      aws.iam.InstanceProfile,
-      (args: any, opts: any, logicalName: string) => {
-        if (logicalName !== 'FoundationVpcNatInstanceProfile') return;
-        args.name = natBinding.instanceProfileName;
-        args.role = natBinding.roleName;
-        opts.import = natBinding.instanceProfileName;
-      },
+${foundationPlan.resources.network ? "  const natMode = productionConfiguration?.contract.nat ?? 'ec2';" : ''}
+  const normalizedRouterWafPolicy = normalizeRouterWafPolicy(routerWafPolicy);
+  if (repositoryPolicy.deploymentProfile !== normalizedRouterWafPolicy.deploymentProfile) {
+    throw new Error('Router WAF policy profile differs from committed repository policy.');
+  }
+  const rehearsalStage = productionRehearsalStage(normalizedRouterWafPolicy.deploymentProfile);
+  const rehearsalAccount = configuredDeploymentAccountForStage(
+    normalizedRouterWafPolicy.deploymentProfile,
+    repositoryPolicy.deploymentAccounts,
+    rehearsalStage,
+  );
+  const rehearsalRegion = configuredDeploymentRegion(repositoryPolicy.deploymentRegion);
+  const rehearsalRoleArn = createStageAuthorityIdentity({
+    accountId: rehearsalAccount,
+    partition: rehearsalRegion.startsWith('us-gov-') ? 'aws-us-gov' : 'aws',
+    region: rehearsalRegion,
+    stage: rehearsalStage,
+  }).deploymentRoleArn;
+  const wafPlan = createRouterWafStagePlan({
+    policy: normalizedRouterWafPolicy,
+    rehearsal: isProduction
+      ? reconcileRouterWafBlockingRehearsal({
+          evidence: routerWafLiveEvidence,
+          expected: {
+            accountId: rehearsalAccount,
+            deploymentRoleArn: rehearsalRoleArn,
+            region: rehearsalRegion,
+            stage: rehearsalStage,
+            wafContractDigest: routerWafContractDigest(normalizedRouterWafPolicy),
+            workspace: '${name}',
+          },
+          policy: normalizedRouterWafPolicy,
+          receipt: routerWafBlockingRehearsal,
+        })
+      : null,
+    stage: $app.stage,
+  });
+  const deploymentAccount = process.env.AWS_EXPECTED_ACCOUNT_ID?.trim() ?? '';
+  if (!/^\\d{12}$/.test(deploymentAccount)) {
+    throw new Error(
+      'Foundation deployment requires the exact committed AWS account before infrastructure construction.',
     );
   }
+  installStageIamBoundaryTransforms({
+    accountId: deploymentAccount,
+    instanceProfileResource: aws.iam.InstanceProfile,
+    registerTransform: $transform,
+    roleResource: aws.iam.Role,
+    stage: ($dev ? 'development' : $app.stage) as
+      | 'development'
+      | 'staging'
+      | 'production',
+  });
 
-  const vpc = new sst.aws.Vpc('FoundationVpc', {
+${foundationPlan.resources.network
+            ? `  const vpc = new sst.aws.Vpc('FoundationVpc', {
     az: 2,
     bastion: $app.stage === 'development',
     nat:
-      natMode === 'ec2'
-        ? (natBinding?.vpc.nat ?? 'ec2')
-        : 'managed',
-  });
-  const cluster = new sst.aws.Cluster('FoundationCluster', { vpc });
+      natMode === 'ec2' ? 'ec2' : 'managed',
+  });`
+            : ''}
+${foundationPlan.resources.containerCompute ? "  const cluster = new sst.aws.Cluster('FoundationCluster', { vpc });" : ''}
   const router = new sst.aws.Router('FoundationRouter', {
     ...(rootDomain
       ? {
@@ -7862,10 +8352,138 @@ export function foundation(
             aliases: ['*.' + rootDomain],
             dns: sst.aws.dns(),
           },
-        }
+      }
       : {}),
+    waf: {
+      logging: wafPlan.logging,
+      managedRules: {
+        coreRuleSet: true,
+        knownBadInputs: true,
+        sqlInjection: false,
+      },
+      rateLimitPerIp: wafPlan.rateLimitPerIp,
+    },
+    transform: {
+      cdn(args: any) {
+        if (!args.webAclArn) {
+          throw new Error(
+            'Foundation Router must attach its exact global Web ACL.',
+          );
+        }
+        args.tags = {
+          ...(args.tags ?? {}),
+          'ebk:managed-by': 'empire-builder-kit',
+          'ebk:owner': 'foundation',
+          'ebk:stage': wafPlan.stage,
+          'ebk:workspace': '${name}',
+        };
+      },
+      waf(args: any, opts: any) {
+        if (args.scope !== 'CLOUDFRONT') {
+          throw new Error(
+            'Foundation Router Web ACL must use global CloudFront scope.',
+          );
+        }
+        const ipSets: { ipv4Arn?: any; ipv6Arn?: any; smokeArn?: any } = {};
+        if (wafPlan.ipv4Cidrs.length > 0) {
+          ipSets.ipv4Arn = new aws.wafv2.IpSet(
+            'FoundationRouterIpv4Allowlist',
+            {
+              addresses: wafPlan.ipv4Cidrs,
+              ipAddressVersion: 'IPV4',
+              name: 'foundation-' + wafPlan.stage + '-router-ipv4-allowlist',
+              scope: 'CLOUDFRONT',
+              tags: {
+                'ebk:managed-by': 'empire-builder-kit',
+                'ebk:owner': 'foundation',
+                'ebk:policy-digest': wafPlan.policyDigest,
+                'ebk:stage': wafPlan.stage,
+                'ebk:workspace': '${name}',
+              },
+            },
+            { provider: opts.provider },
+          ).arn;
+        }
+        if (wafPlan.ipv6Cidrs.length > 0) {
+          ipSets.ipv6Arn = new aws.wafv2.IpSet(
+            'FoundationRouterIpv6Allowlist',
+            {
+              addresses: wafPlan.ipv6Cidrs,
+              ipAddressVersion: 'IPV6',
+              name: 'foundation-' + wafPlan.stage + '-router-ipv6-allowlist',
+              scope: 'CLOUDFRONT',
+              tags: {
+                'ebk:managed-by': 'empire-builder-kit',
+                'ebk:owner': 'foundation',
+                'ebk:policy-digest': wafPlan.policyDigest,
+                'ebk:stage': wafPlan.stage,
+                'ebk:workspace': '${name}',
+              },
+            },
+            { provider: opts.provider },
+          ).arn;
+        }
+        if (wafPlan.access === 'allowlist') {
+          // Smoke rotates WAF's LockToken outside Pulumi. Keep the existing
+          // baseline IP sets untouched; AWS's Cloud Control handler owns the
+          // separate ephemeral set's lifecycle without a cached lock token.
+          const smokeAccess = new aws.cloudcontrol.Resource(
+            'FoundationRouterSmokeAccess',
+            {
+              typeName: 'AWS::WAFv2::IPSet',
+              desiredState: JSON.stringify({
+                Addresses: [],
+                IPAddressVersion: 'IPV4',
+                Name: 'foundation-' + wafPlan.stage + '-router-smoke-access',
+                Scope: 'CLOUDFRONT',
+                Tags: Object.entries({
+                  'ebk:managed-by': 'empire-builder-kit',
+                  'ebk:owner': 'foundation',
+                  'ebk:purpose': 'private-smoke-access',
+                  'ebk:stage': wafPlan.stage,
+                  'ebk:workspace': '${name}',
+                }).map(([Key, Value]) => ({ Key, Value })),
+              }),
+            },
+            {
+              provider: opts.provider,
+              // This dedicated set has creation-only identity/ownership inputs.
+              // Admission owns its addresses; the Web ACL owns policy binding.
+              // Retain old inputs on upgrade too: Cloud Control patches arrays
+              // by index, which is unsafe for service-reordered Tags (including
+              // removing an older policy-digest tag). Never patch this document.
+              ignoreChanges: ['desiredState'],
+            },
+          );
+          ipSets.smokeArn = smokeAccess.properties.apply(
+            (properties: string) => JSON.parse(properties).Arn,
+          );
+        }
+        args.defaultAction = { allow: {} };
+        args.rules = createRouterWafRules(wafPlan, ipSets);
+        args.scope = 'CLOUDFRONT';
+        args.tags = {
+          ...(args.tags ?? {}),
+          'ebk:managed-by': 'empire-builder-kit',
+          'ebk:owner': 'foundation',
+          'ebk:policy-digest': wafPlan.policyDigest,
+          'ebk:stage': wafPlan.stage,
+          'ebk:workspace': '${name}',
+        };
+        args.visibilityConfig = {
+          cloudwatchMetricsEnabled: true,
+          metricName:
+            'Ebk' +
+            wafPlan.stage[0].toUpperCase() +
+            wafPlan.stage.slice(1) +
+            'FoundationRouterWaf',
+          sampledRequestsEnabled: true,
+        };
+      },
+    },
   });
-  const database = new sst.aws.Aurora('FoundationDatabase', {
+${foundationPlan.resources.postgres
+            ? `  const database = new sst.aws.Aurora('FoundationDatabase', {
     // SQL bootstrap and migrations run inside the VPC. Keep the public HTTPS
     // Data API surface disabled; protected GitHub roles also deny its actions.
     dataApi: false,
@@ -7887,6 +8505,47 @@ export function foundation(
     },
     vpc,
   });
+  const databaseClusterEndpoint = database.nodes.cluster.endpoint.apply(
+    foundationDatabaseEndpointHost,
+  );
+  const databaseReaderEndpoint = database.nodes.cluster.readerEndpoint.apply(
+    foundationDatabaseEndpointHost,
+  );
+  // SST v4.17.1 creates a top-level LinkRef on the next tick and its Aurora
+  // implementation unconditionally splits cluster endpoints. During a
+  // governed refresh after an interrupted first deploy, those provider
+  // outputs are legitimately absent. Preserve the normal link contract while
+  // keeping that read-only recovery program total; a real deploy resolves the
+  // exact endpoints before any discovery resource is created.
+  database.getSSTLink = () => ({
+    include: [
+      sst.aws.permission({
+        actions: ['secretsmanager:GetSecretValue'],
+        resources: [database.secretArn],
+      }),
+      sst.aws.permission({
+        actions: [
+          'rds-data:BatchExecuteStatement',
+          'rds-data:BeginTransaction',
+          'rds-data:CommitTransaction',
+          'rds-data:ExecuteStatement',
+          'rds-data:RollbackTransaction',
+        ],
+        resources: [database.clusterArn],
+      }),
+    ],
+    properties: {
+      clusterArn: database.clusterArn,
+      database: database.database,
+      host: databaseClusterEndpoint,
+      password: database.password,
+      port: database.port,
+      reader: databaseReaderEndpoint,
+      secretArn: database.secretArn,
+      username: database.username,
+    },
+  });`
+            : ''}
   const foundationAccountId = aws.getCallerIdentityOutput({}).accountId;
   const foundationPartition = aws.getPartitionOutput({});
   const foundationRegion = aws.getRegionOutput({});
@@ -7915,11 +8574,12 @@ export function foundation(
   const accountCostControl = createFoundationAccountCostControlPlan({
     evaluatedAt: new Date().toISOString(),
     policy: accountCostPolicy,
+    rehearsalStage: '${rehearsalStage}',
     region: process.env.AWS_REGION,
     stage: $app.stage,
     workspace: '${name}',
   });
-  const databaseInstanceId = database.nodes.instance.identifier;
+${foundationPlan.resources.postgres ? '  const databaseInstanceId = database.nodes.instance.identifier;' : ''}
   const alertTopicPolicy = new aws.sns.TopicPolicy(
     'FoundationAlertTopicPolicy',
     {
@@ -7949,6 +8609,7 @@ export function foundation(
               },
             ],
             resources: [alertTopic.arn],
+            sid: 'AllowBudgetAlerts',
           },
           {
             actions: ['sns:Publish'],
@@ -7962,8 +8623,10 @@ export function foundation(
               type: 'Service',
             }],
             resources: [alertTopic.arn],
+            sid: 'AllowCostAnomalyAlerts',
           },
-          {
+${foundationPlan.resources.postgres
+            ? `          {
             actions: ['sns:Publish'],
             conditions: [
               {
@@ -7984,7 +8647,9 @@ export function foundation(
               type: 'Service',
             }],
             resources: [alertTopic.arn],
-          },
+            sid: 'AllowRdsEventAlerts',
+          },`
+            : ''}
           {
             actions: ['sns:Publish'],
             conditions: [
@@ -8008,6 +8673,7 @@ export function foundation(
               },
             ],
             resources: [alertTopic.arn],
+            sid: 'AllowCloudWatchAlarmAlerts',
           },
         ],
       }).json,
@@ -8036,7 +8702,43 @@ export function foundation(
         { dependsOn: [alertTopicPolicy] },
       )
     : undefined;
-  const databaseEvents = isProduction
+  const accountCostAnomalyMonitor = isProduction
+    ? new aws.costexplorer.AnomalyMonitor(
+        'FoundationAccountCostAnomalyMonitor',
+        {
+          monitorDimension: 'SERVICE',
+          monitorType: 'DIMENSIONAL',
+          name: '${name}-account-service-cost-anomalies',
+          tags: {
+            'ebk:cost-policy-digest': accountCostControl.policyDigest,
+            'ebk:cost-scope': '${name}/account/production',
+            'ebk:owner': accountCostControl.owner,
+          },
+        },
+      )
+    : undefined;
+  const accountCostAnomalySubscription =
+    accountCostControl.anomaly && accountCostAnomalyMonitor
+      ? new aws.costexplorer.AnomalySubscription(
+          'FoundationAccountCostAnomalySubscription',
+          {
+            frequency: accountCostControl.anomaly.subscription.frequency,
+            monitorArnLists: [accountCostAnomalyMonitor.arn],
+            name: accountCostControl.anomaly.subscription.name,
+            subscribers: [{ address: alertTopic.arn, type: 'SNS' }],
+            tags: {
+              'ebk:cost-policy-digest': accountCostControl.policyDigest,
+              'ebk:cost-scope': '${name}/account/production',
+              'ebk:owner': accountCostControl.owner,
+            },
+            thresholdExpression:
+              accountCostControl.anomaly.subscription.thresholdExpression,
+          },
+          { dependsOn: [accountCostAnomalyMonitor, alertTopicPolicy] },
+        )
+      : undefined;
+${foundationPlan.resources.postgres
+            ? `  const databaseEvents = isProduction
     ? new aws.rds.EventSubscription(
         'FoundationDatabaseEvents',
         {
@@ -8118,7 +8820,14 @@ export function foundation(
       threshold: 90,
       treatMissingData: 'notBreaching',
     },
-  );
+  );`
+            : `  const dashboard = new aws.cloudwatch.Dashboard('FoundationDashboard', {
+    dashboardName: 'ebk-' + $app.stage + '-foundation',
+    dashboardBody: JSON.stringify({ widgets: [{
+      type: 'text', x: 0, y: 0, width: 24, height: 3,
+      properties: { markdown: '# Empire Builder Kit Foundation\\nStage: ' + $app.stage + '\\nPersistence: Slice-scoped DynamoDB; SQL not declared.' },
+    }] }),
+  });`}
 
   if (new Set(['development', 'staging', 'production']).has($app.stage)) {
     new aws.cloudwatch.EventArchive('FoundationEventArchive', {
@@ -8134,18 +8843,18 @@ export function foundation(
       accountCostControl.authority.monthlyMaximumUsd,
     ),
     alertTopicArn: alertTopic.arn,
-    capabilities: STANDARD_FOUNDATION_CAPABILITIES.join(','),
-    clusterId: cluster.id,
-    contractVersion: '1.0.0',
-    databaseClusterArn: database.clusterArn,
-    databaseClusterEndpoint: database.nodes.cluster.endpoint.apply(
-      (endpoint: string) => endpoint.split(':')[0],
-    ),
+    capabilities: ${JSON.stringify(foundationPlan.descriptor.capabilities.join(','))},
+${foundationPlan.resources.containerCompute ? '    clusterId: cluster.id,' : ''}
+    contractVersion: '${foundationPlan.descriptor.contractVersion}',
+${foundationPlan.resources.postgres
+            ? `    databaseClusterArn: database.clusterArn,
+    databaseClusterEndpoint,
     databaseClusterId: database.id,
     databaseClusterResourceId: database.nodes.cluster.clusterResourceId,
-    databaseHost: database.host,
+    databaseHost: databaseClusterEndpoint,
     databaseMasterSecretArn: database.secretArn,
-    databasePort: database.port.apply(String),
+    databasePort: database.port.apply(String),`
+            : ''}
     eventBusArn: eventBus.arn,
     eventBusName: eventBus.name,
     hasPublicDomain: rootDomain ? 'true' : 'false',
@@ -8156,19 +8865,22 @@ export function foundation(
     routerDistributionId: router.distributionID,
     routerUrl: router.url,
     schemaVersion: String(FOUNDATION_SSM_SCHEMA_VERSION),
-    vpcId: vpc.id,
+${foundationPlan.resources.network ? '    vpcId: vpc.id,' : ''}
   });
 
   return {
     accountBudgetName: accountBudget?.name,
     alertTopicArn: alertTopic.arn,
-    capabilities: STANDARD_FOUNDATION_CAPABILITIES,
-    clusterId: cluster.id,
-    contractVersion: '1.0.0',
-    databaseCapacityAlarmName: databaseCapacityAlarm.name,
+    capabilities: ${JSON.stringify(foundationPlan.descriptor.capabilities)},
+${foundationPlan.resources.containerCompute ? '    clusterId: cluster.id,' : ''}
+    contractVersion: '${foundationPlan.descriptor.contractVersion}',
+    costAnomalySubscriptionArn: accountCostAnomalySubscription?.arn,
+${foundationPlan.resources.postgres ? '    databaseCapacityAlarmName: databaseCapacityAlarm.name,' : ''}
     dashboardName: dashboard.dashboardName,
-    databaseClusterId: database.id,
-    databaseEventSubscriptionId: databaseEvents?.id,
+${foundationPlan.resources.postgres
+            ? `    databaseClusterId: database.id,
+    databaseEventSubscriptionId: databaseEvents?.id,`
+            : ''}
     eventBusName: eventBus.name,
     identityUserPoolId: userPool.id,
     identityTokenEndpoint,
@@ -8176,33 +8888,68 @@ export function foundation(
     productionFoundationProfile: productionConfiguration?.profile,
     rootDomain,
     routerUrl: router.url,
-    vpcId: vpc.id,
+${foundationPlan.resources.network ? '    vpcId: vpc.id,' : ''}
   };
 }
 `,
         'packages/foundation/infra/index.ts': `import { foundation } from './foundation.js';
-import type { FoundationWorkloadRolePreflight } from './workload-roles/preflight.js';
 
-export function app(workloadRoles?: FoundationWorkloadRolePreflight) {
-  const resources = foundation(workloadRoles);
-  return {
-    ...resources,
-    workloadRoleManifestDigest:
-      workloadRoles?.registry.manifestDigest ?? 'local-dev-ephemeral',
-  };
+export function app() {
+  return foundation();
 }
 `,
         'packages/foundation/performance/account-cost-policy.json': json({
             actualNotificationThresholdPercent: 80,
             forecastNotificationThresholdPercent: 100,
             kind: 'ebk-foundation-account-cost-policy',
-            monthlyMaximumUsd: 1_000,
+            monthlyMaximumUsd: deploymentProfile === 'starter' ? 250 : 1_000,
             owner: 'replace-with-owner',
             reviewAt: null,
             schemaVersion: 1,
             status: 'example',
             workspace: name,
         }),
+        'packages/foundation/security/router-waf.json': json({
+            deploymentProfile,
+            kind: 'ebk-router-waf-policy',
+            logging: {
+                enabled: false,
+                retention: '1 week',
+            },
+            rateLimitPerIp: 2_000,
+            schemaVersion: 1,
+            stages: {
+                development: {
+                    access: 'allowlist',
+                    allowedCidrs: [],
+                    mode: 'block',
+                },
+                production: {
+                    access: 'public',
+                    allowedCidrs: [],
+                    mode: 'block',
+                },
+                ...(deploymentProfile === 'starter'
+                    ? {}
+                    : {
+                        staging: {
+                            access: 'allowlist',
+                            allowedCidrs: [],
+                            mode: 'block',
+                        },
+                    }),
+            },
+        }),
+        'packages/foundation/security/router-waf-blocking-rehearsal.json': json({
+            kind: 'ebk-router-waf-blocking-rehearsal',
+            schemaVersion: 4,
+            status: 'pending',
+        }),
+        'packages/foundation/security/router-waf-live-evidence.json': json({
+            kind: 'ebk-router-waf-live-evidence',
+            schemaVersion: 4,
+            status: 'pending',
+        }),
         'packages/foundation/configuration/declarations.json': json({
             project: 'foundation',
             schemaVersion: 1,
@@ -8235,29 +8982,87 @@ export function app(workloadRoles?: FoundationWorkloadRolePreflight) {
                 version: '4.17.1',
             },
             policy: {
+                adoptedImports: [],
                 additiveLowRiskTypes: [
                     'aws:cloudwatch/dashboard:Dashboard',
                     'aws:cloudwatch/logGroup:LogGroup',
                     'aws:cloudwatch/metricAlarm:MetricAlarm',
                 ],
+                additiveReviewedTypes: [
+                    'aws:cloudwatch/eventArchive:EventArchive',
+                    'aws:cloudwatch/eventBus:EventBus',
+                    'aws:cognito/userPoolDomain:UserPoolDomain',
+                    'aws:ec2/defaultSecurityGroup:DefaultSecurityGroup',
+                    'aws:ec2/internetGateway:InternetGateway',
+                    'aws:ec2/routeTable:RouteTable',
+                    'aws:ec2/routeTableAssociation:RouteTableAssociation',
+                    'aws:ec2/securityGroup:SecurityGroup',
+                    'aws:ec2/subnet:Subnet',
+                    'aws:ec2/vpc:Vpc',
+                    'aws:ecs/cluster:Cluster',
+                    'aws:ecs/clusterCapacityProviders:ClusterCapacityProviders',
+                    'aws:rds/clusterParameterGroup:ClusterParameterGroup',
+                    'aws:rds/eventSubscription:EventSubscription',
+                    'aws:rds/parameterGroup:ParameterGroup',
+                    'aws:rds/subnetGroup:SubnetGroup',
+                    'aws:servicediscovery/privateDnsNamespace:PrivateDnsNamespace',
+                    'aws:sns/topic:Topic',
+                    'aws:sns/topicPolicy:TopicPolicy',
+                    'aws:wafv2/webAclLoggingConfiguration:WebAclLoggingConfiguration',
+                    'pulumi-nodejs:dynamic:Resource',
+                    'pulumi:providers:aws',
+                    'pulumi:providers:pulumi-nodejs',
+                    'pulumi:providers:random',
+                    'pulumi:pulumi:Stack',
+                    'sst:aws:Aurora',
+                    'sst:aws:Bus',
+                    'sst:aws:CDN',
+                    'sst:aws:Cluster',
+                    'sst:aws:CognitoUserPool',
+                    'sst:aws:Router',
+                    'sst:aws:SnsTopic',
+                    'sst:aws:Vpc',
+                    'sst:sst:LinkRef',
+                    'sst:sst:Version',
+                ],
                 costOrQuotaTypes: [
                     'aws:apigatewayv2/api:Api',
                     'aws:budgets/budget:Budget',
+                    'aws:cloudfront/cachePolicy:CachePolicy',
                     'aws:cloudfront/distribution:Distribution',
+                    'aws:cloudfront/function:Function',
+                    'aws:cloudfront/keyValueStore:KeyValueStore',
+                    'aws:costexplorer/anomalyMonitor:AnomalyMonitor',
+                    'aws:costexplorer/anomalySubscription:AnomalySubscription',
                     'aws:cognito/userPool:UserPool',
+                    'aws:ec2/eip:Eip',
+                    'aws:ec2/eipAssociation:EipAssociation',
+                    'aws:ec2/instance:Instance',
                     'aws:ec2/natGateway:NatGateway',
                     'aws:rds/cluster:Cluster',
+                    'aws:rds/clusterInstance:ClusterInstance',
+                    'aws:wafv2/ipSet:IpSet',
+                    'aws:wafv2/webAcl:WebAcl',
                 ],
                 failClosedOnUnknown: true,
                 protectedPlanAuthority: 'deploy-role-residual',
                 standingPolicyRiskClasses: ['no-change', 'additive-low-risk'],
                 statefulTypes: [
+                    'aws:cloudwatch/eventArchive:EventArchive',
+                    'aws:cloudwatch/eventBus:EventBus',
                     'aws:cognito/userPool:UserPool',
                     'aws:dynamodb/table:Table',
                     'aws:events/eventBus:EventBus',
                     'aws:kms/key:Key',
                     'aws:rds/cluster:Cluster',
                     'aws:s3/bucket:Bucket',
+                    'aws:secretsmanager/secret:Secret',
+                    'aws:secretsmanager/secretVersion:SecretVersion',
+                    'aws:sns/topic:Topic',
+                    'aws:ssm/parameter:Parameter',
+                    'aws:wafv2/ipSet:IpSet',
+                    'aws:wafv2/webAcl:WebAcl',
+                    'random:index/randomPassword:RandomPassword',
                 ],
             },
             project: 'foundation',
@@ -8287,10 +9092,6 @@ export function app(workloadRoles?: FoundationWorkloadRolePreflight) {
                         'verify',
                         { target: 'profile-preflight', params: 'forward' },
                     ],
-                    outputs: [
-                        `{projectRoot}/.ebk/evidence/infrastructure-convergence.json`,
-                        `{projectRoot}/.ebk/evidence/infrastructure-mutation-binding.json`,
-                    ],
                     options: {
                         cwd: 'packages/foundation',
                         stage: 'development',
@@ -8307,15 +9108,7 @@ export function app(workloadRoles?: FoundationWorkloadRolePreflight) {
                 'infrastructure-plan': {
                     cache: false,
                     executor: '@empire-builder-kit/nx:infrastructure-plan',
-                    outputs: [
-                        `{projectRoot}/.ebk/evidence/infrastructure-plan-authorization.json`,
-                        `{projectRoot}/.ebk/evidence/infrastructure-plan-command.json`,
-                        `{projectRoot}/.ebk/evidence/infrastructure-plan.private-stderr.txt`,
-                        `{projectRoot}/.ebk/evidence/infrastructure-plan.raw.json`,
-                        `{projectRoot}/.ebk/evidence/infrastructure-plan.json`,
-                    ],
                     options: {
-                        action: 'deploy',
                         cwd: 'packages/foundation',
                         stage: 'development',
                         stageMode: 'foundation',
@@ -8324,10 +9117,6 @@ export function app(workloadRoles?: FoundationWorkloadRolePreflight) {
                 refresh: {
                     executor: '@empire-builder-kit/nx:refresh',
                     dependsOn: [{ target: 'profile-preflight', params: 'forward' }],
-                    outputs: [
-                        `{projectRoot}/.ebk/evidence/infrastructure-convergence.json`,
-                        `{projectRoot}/.ebk/evidence/infrastructure-mutation-binding.json`,
-                    ],
                     options: {
                         cwd: 'packages/foundation',
                         stage: 'development',
@@ -8337,10 +9126,6 @@ export function app(workloadRoles?: FoundationWorkloadRolePreflight) {
                 remove: {
                     executor: '@empire-builder-kit/nx:remove',
                     dependsOn: [{ target: 'remove-preflight', params: 'forward' }],
-                    outputs: [
-                        `{projectRoot}/.ebk/evidence/infrastructure-convergence.json`,
-                        `{projectRoot}/.ebk/evidence/infrastructure-mutation-binding.json`,
-                    ],
                     options: {
                         cwd: 'packages/foundation',
                         stage: 'development',
@@ -8355,6 +9140,13 @@ export function app(workloadRoles?: FoundationWorkloadRolePreflight) {
                     executor: '@empire-builder-kit/nx:foundation-profile-preflight',
                     options: { stage: 'development' },
                 },
+                'router-waf-rehearsal': {
+                    cache: false,
+                    executor: '@empire-builder-kit/nx:router-waf-rehearsal',
+                    outputs: [
+                        `{projectRoot}/security/router-waf-blocking-rehearsal.json`,
+                    ],
+                },
                 typecheck: {
                     executor: 'nx:run-commands',
                     options: {
@@ -8382,6 +9174,19 @@ export function app(workloadRoles?: FoundationWorkloadRolePreflight) {
         }),
         'packages/foundation/scripts/verify-foundation.mjs': `import { readFileSync } from 'node:fs';
 
+import {
+  normalizeRouterWafBlockingRehearsal,
+  normalizeRouterWafPolicy,
+  reconcileRouterWafBlockingRehearsal,
+  routerWafContractDigest,
+} from '@empire-builder-kit/nx/foundation';
+import { createStageAuthorityIdentity } from '@empire-builder-kit/nx/aws-authority';
+import {
+  configuredDeploymentAccountForStage,
+  configuredDeploymentRegion,
+  productionRehearsalStage,
+} from '@empire-builder-kit/nx/repository-policy';
+
 const descriptor = JSON.parse(
   readFileSync(new URL('../contracts/foundation.json', import.meta.url), 'utf8'),
 );
@@ -8397,35 +9202,92 @@ const frontendSecurityHeaders = JSON.parse(
     'utf8',
   ),
 );
-const expectedCapabilities = [
-  'network',
-  'routing',
-  'container-compute',
-  'postgres',
-  'identity',
-  'events',
-  'observability',
-  'configuration',
-  'deployment',
-];
+const routerWafPolicy = normalizeRouterWafPolicy(
+  JSON.parse(
+    readFileSync(
+      new URL('../security/router-waf.json', import.meta.url),
+      'utf8',
+    ),
+  ),
+);
+const repositoryPolicy = JSON.parse(
+  readFileSync(new URL('../../../ebk.repository-policy.json', import.meta.url), 'utf8'),
+);
+const workspaceManifest = JSON.parse(
+  readFileSync(new URL('../../../package.json', import.meta.url), 'utf8'),
+);
+const rehearsalReceipt = JSON.parse(
+  readFileSync(
+    new URL(
+      '../security/router-waf-blocking-rehearsal.json',
+      import.meta.url,
+    ),
+    'utf8',
+  ),
+);
+const normalizedRehearsal = normalizeRouterWafBlockingRehearsal(rehearsalReceipt);
+if (normalizedRehearsal) {
+  const rehearsalStage = productionRehearsalStage(repositoryPolicy.deploymentProfile);
+  const rehearsalAccount = configuredDeploymentAccountForStage(
+    repositoryPolicy.deploymentProfile,
+    repositoryPolicy.deploymentAccounts,
+    rehearsalStage,
+  );
+  const rehearsalRegion = configuredDeploymentRegion(repositoryPolicy.deploymentRegion);
+  reconcileRouterWafBlockingRehearsal({
+    evidence: JSON.parse(
+      readFileSync(
+        new URL('../security/router-waf-live-evidence.json', import.meta.url),
+        'utf8',
+      ),
+    ),
+    expected: {
+      accountId: rehearsalAccount,
+      deploymentRoleArn: createStageAuthorityIdentity({
+        accountId: rehearsalAccount,
+        partition: rehearsalRegion.startsWith('us-gov-') ? 'aws-us-gov' : 'aws',
+        region: rehearsalRegion,
+        stage: rehearsalStage,
+      }).deploymentRoleArn,
+      region: rehearsalRegion,
+      stage: rehearsalStage,
+      wafContractDigest: routerWafContractDigest(routerWafPolicy),
+      workspace: workspaceManifest.name,
+    },
+    policy: routerWafPolicy,
+    receipt: normalizedRehearsal,
+  });
+}
+const expectedCapabilities = ${JSON.stringify(foundationPlan.descriptor.capabilities)};
 
-if (descriptor.contractVersion !== '1.0.0') {
-  throw new Error('Foundation contractVersion must be 1.0.0.');
+if (descriptor.contractVersion !== '2.0.0') {
+  throw new Error('Foundation contractVersion must be 2.0.0.');
+}
+if (
+  JSON.stringify(Object.keys(routerWafPolicy.stages).sort()) !==
+    JSON.stringify(${JSON.stringify([...activeStages].sort())}) ||
+  routerWafPolicy.stages.development.access !== 'allowlist' ||
+  ${deploymentProfile !== 'starter' ? "routerWafPolicy.stages.staging?.access !== 'allowlist' ||" : ''}
+  routerWafPolicy.stages.production.mode !== 'block'
+) {
+  throw new Error('Foundation Router WAF stage defaults are invalid.');
 }
 if (JSON.stringify(descriptor.capabilities) !== JSON.stringify(expectedCapabilities)) {
-  throw new Error('Foundation capability descriptor does not match the v1 standard.');
+  throw new Error('Foundation capability descriptor does not match its generated resource declaration.');
 }
 if (
-  costs.schemaVersion !== 2 ||
+  costs.schemaVersion !== 3 ||
+  costs.aurora?.declared !== ${foundationPlan.resources.postgres} ||
   costs.aurora?.engineVersion !== '${index_js_4.FOUNDATION_AURORA_ENGINE_VERSION}' ||
   costs.productionProfileSource !== 'ebk.repository-policy.json' ||
   costs.productionProfiles?.standard?.aurora?.min !== '2 ACU' ||
-  costs.productionProfiles?.['cost-optimized']?.aurora?.min !== '0 ACU' ||
+  JSON.stringify(costs.productionProfiles) !== JSON.stringify(${JSON.stringify(index_js_4.PRODUCTION_FOUNDATION_PROFILE_CONTRACTS)}) ||
   !costs.stages?.development ||
-  !costs.stages?.staging ||
+  JSON.stringify(Object.keys(costs.stages ?? {}).sort()) !==
+    JSON.stringify(${JSON.stringify([...activeStages].sort())}) ||
   costs.stages?.production?.dataRetention !== 'retained-and-protected'
 ) {
-  throw new Error('Foundation cost manifest does not match the v1 stage contract.');
+  throw new Error('Foundation cost manifest does not match the declared capability and stage contract.');
 }
 const localHeaders =
   frontendSecurityHeaders.profiles?.['local-development']?.headers ?? [];
@@ -8462,9 +9324,9 @@ export {};
 export default $config({
   app(input: { stage?: string } | undefined) {
     const stage = input?.stage ?? 'development';
-    if (!['development', 'staging', 'production'].includes(stage)) {
+    if (!new Set<string>(${JSON.stringify(activeStages)}).has(stage)) {
       throw new Error(
-        'Foundation stage ' + stage + ' is not canonical. Use development, staging, or production.',
+        'Foundation stage ' + stage + ' is inactive for the ${deploymentProfile} deployment profile.',
       );
     }
     const production = stage === 'production';
@@ -8476,16 +9338,15 @@ export default $config({
       providers: {
         aws: {
           defaultTags: {
+            // SST contributes sst:app and sst:stage. Keep the provider baseline
+            // at eight tags so generated S3 asset objects remain within AWS's
+            // hard ten-tag object limit. Richer performance tags stay explicit.
             tags: {
               'ebk:cost-allocation': 'foundation',
               'ebk:cost-scope': '${name}/foundation/' + stage,
               'ebk:framework-version': '${frameworkVersion}',
               'ebk:managed-by': 'empire-builder-kit',
               'ebk:owner': 'foundation',
-              'ebk:production-profile':
-                process.env.EBK_PRODUCTION_FOUNDATION_PROFILE ?? 'standard',
-              'ebk:repository':
-                process.env.GITHUB_REPOSITORY ?? '${name}',
               'ebk:slice': 'foundation',
               'ebk:stage': stage,
               'ebk:workspace': '${name}',
@@ -8497,15 +9358,8 @@ export default $config({
     };
   },
   async run() {
-    const workloadRoles = $dev
-      ? undefined
-      : await import(
-          './infra/workload-roles/preflight.js'
-        ).then(({ preflightFoundationWorkloadRoles }) =>
-          preflightFoundationWorkloadRoles($app.stage),
-        );
     const { app } = await import('./infra/index.js');
-    return app(workloadRoles);
+    return app();
   },
 });
 `,
@@ -8520,6 +9374,7 @@ export default $config({
             ],
             exclude: ['.sst', 'dist', 'node_modules'],
         }),
+        [dependency_overrides_js_1.DEPENDENCY_OVERRIDES_PATH]: json(dependencyOverrides),
         'pnpm-workspace.yaml': `packages:
   - 'packages/*'
   - 'packages/*/apps/*'
@@ -8554,6 +9409,7 @@ supportedArchitectures:
 strictDepBuilds: true
 allowBuilds:
 ${index_js_6.FRAMEWORK_REVIEWED_BUILD_PACKAGES.map((packageName) => `  '${packageName}': true`).join('\n')}
+${(0, dependency_overrides_js_1.renderDependencyOverridesYaml)(dependencyOverrides)}
 `,
         'tsconfig.base.json': json({
             compilerOptions: {
@@ -9376,7 +10232,9 @@ process.stdout.write(
 );
 `,
         'tools/ebk-git-policy.mjs': `import { evaluateGitPolicy } from '@empire-builder-kit/nx/git-policy';
+import { deliveryLaneOf, readRepositoryOperatingPolicy } from '@empire-builder-kit/nx/repository-policy';
 import { spawnSync } from 'node:child_process';
+const deliveryLane = deliveryLaneOf(readRepositoryOperatingPolicy(process.cwd()));
 
 const git = (...args) => {
   const result = spawnSync('git', args, { encoding: 'utf8', shell: false });
@@ -9396,32 +10254,40 @@ if (!['pull_request', 'push', 'workflow_dispatch'].includes(eventName)) {
   throw new Error('Unsupported or missing GITHUB_EVENT_NAME; Git policy fails closed.');
 }
 
-const request = { eventName, ref: process.env.GITHUB_REF };
+const request = { deliveryLane, eventName, ref: process.env.GITHUB_REF };
 if (eventName === 'pull_request' || eventName === 'push') {
   git(
     'fetch',
     '--no-tags',
     'origin',
     'main:refs/remotes/origin/main',
-    'develop:refs/remotes/origin/develop',
+    ...(deliveryLane === 'trunk' ? [] : ['develop:refs/remotes/origin/develop']),
   );
 }
 if (eventName === 'pull_request') {
   const baseRef = process.env.GITHUB_BASE_REF;
+  const headRepository = process.env.EBK_HEAD_REPOSITORY;
   const headRef = process.env.GITHUB_HEAD_REF;
-  if (!baseRef || !headRef) {
-    throw new Error('Pull-request branch metadata is missing.');
+  const repository = process.env.GITHUB_REPOSITORY;
+  if (!baseRef || !headRepository || !headRef || !repository) {
+    throw new Error('Pull-request branch and repository metadata is missing.');
   }
   Object.assign(request, {
     baseIsAncestorOfHead: isAncestor('refs/remotes/origin/' + baseRef, 'HEAD'),
     baseRef,
+    headRepository,
     headRef,
-    mainIsAncestorOfDevelop: isAncestor(
-      'refs/remotes/origin/main',
-      'refs/remotes/origin/develop',
-    ),
+    ...(deliveryLane === 'trunk'
+      ? {}
+      : {
+          mainIsAncestorOfDevelop: isAncestor(
+            'refs/remotes/origin/main',
+            'refs/remotes/origin/develop',
+          ),
+        }),
+    repository,
   });
-} else if (eventName === 'push') {
+} else if (eventName === 'push' && deliveryLane !== 'trunk') {
   Object.assign(request, {
     baseIsAncestorOfHead: isAncestor('refs/remotes/origin/develop', 'HEAD'),
     mainIsAncestorOfDevelop: isAncestor(
@@ -9435,7 +10301,7 @@ const decision = evaluateGitPolicy(request);
 process.stdout.write(JSON.stringify(decision, null, 2) + '\\n');
 if (!decision.allowed) process.exitCode = 1;
 `,
-        'tools/workspace-health.mjs': `import { validateRepositoryOperatingPolicy } from '@empire-builder-kit/nx/repository-policy';
+        'tools/workspace-health.mjs': `import { readRepositoryOperatingPolicy } from '@empire-builder-kit/nx/repository-policy';
 import { assertWorkMarkerReport, formatWorkMarkerReport, scanWorkMarkers } from '@empire-builder-kit/nx/work-markers';
 import { createHash } from 'node:crypto';
 import { existsSync, readdirSync, readFileSync } from 'node:fs';
@@ -9498,13 +10364,7 @@ if (
 validateOwnership('.', workspace, 'Workspace');
 validateOwnership('packages/foundation', foundation, 'Foundation');
 
-const policy = validateRepositoryOperatingPolicy(readJson('ebk.repository-policy.json'));
-if (!policy.valid) {
-  throw new Error(
-    'Repository Operating Policy is invalid:\\n' +
-      policy.issues.map(({ message, path }) => '- ' + path + ': ' + message).join('\\n'),
-  );
-}
+readRepositoryOperatingPolicy(process.cwd());
 
 for (const name of readdirSync('packages')) {
   if (name === 'foundation') continue;
@@ -9522,7 +10382,63 @@ assertWorkMarkerReport(markerReport);
 process.stdout.write('Empire Builder Kit workspace source health is green.\\n');
 `,
     };
-    Object.assign(files, SUPPLY_CHAIN_WORKSPACE_FILE_PLAN.files, (0, workspace_files_performance_cost_js_1.renderProtectedPerformanceCostWorkflow)(), (0, workspace_files_performance_cost_js_1.renderProtectedAggregateCountWorkflow)(), (0, workspace_files_performance_load_js_1.renderProtectedPerformanceLoadWorkflowPlan)('workspace').files, developerAgentFilePlan.files, (0, workspace_files_foundation_workload_roles_js_1.renderFoundationWorkloadRoleFiles)(), (0, workspace_files_workload_role_baseline_js_1.renderWorkspaceWorkloadRoleBaselineFiles)({ name }));
+    Object.assign(files, SUPPLY_CHAIN_WORKSPACE_FILE_PLAN.files, developerAgentFilePlan.files, (0, workspace_files_adopter_skills_js_1.renderAdopterSkills)({ name, deploymentProfile }), (0, workspace_files_stage_authority_js_1.renderStageAuthorityWorkspaceFiles)({
+        deploymentProfile,
+        name,
+        workspaceDeploymentId,
+    }));
+    Object.assign(files, (0, workspace_files_ecr_inspector_js_1.renderThinEcrInspectorWorkflow)({
+        actionPins: {
+            checkout: checkoutAction,
+            configureAwsCredentials: configureAwsAction,
+            downloadArtifact: downloadArtifactAction,
+            pnpmSetup: pnpmAction,
+            setupNode: setupNodeAction,
+            uploadArtifact: uploadArtifactAction,
+        },
+        deploymentProfile,
+        name,
+        nodeVersion: tool_versions_js_1.WORKSPACE_NODE_VERSION,
+    }), (0, workspace_files_thin_deploy_js_1.renderThinDeployWorkflowFilePlan)({
+        deliveryLane,
+        productionApprovalMode,
+        actionPins: {
+            cache: cacheAction,
+            checkout: checkoutAction,
+            configureAwsCredentials: configureAwsAction,
+            downloadArtifact: downloadArtifactAction,
+            pnpmSetup: pnpmAction,
+            setupNode: setupNodeAction,
+            uploadArtifact: uploadArtifactAction,
+        },
+        deploymentProfile,
+        name,
+        toolVersions: {
+            node: tool_versions_js_1.WORKSPACE_NODE_VERSION,
+            sst: tool_versions_js_1.WORKSPACE_SST_VERSION,
+        },
+    }).files, (0, workspace_files_thin_docs_js_1.renderThinLifecycleDocumentation)({
+        deliveryLane,
+        deploymentProfile,
+        name,
+        productionApprovalMode,
+    }));
+    const thinReleaseWorkflowPlan = (0, workspace_files_thin_release_js_1.renderThinReleaseWorkflowPlan)();
+    Object.assign(files, thinReleaseWorkflowPlan.files);
+    for (const obsoletePath of [
+        ...thinReleaseWorkflowPlan.obsoletePaths,
+        // The trunk lane has no develop branch to sync main back into; trunk
+        // promotion only ever fast-forwards main from develop, so there is
+        // nothing to sync back either.
+        ...(trunkLane || trunkPromotion ? ['.github/workflows/sync-back.yml'] : []),
+        '.github/workflows/performance-aggregate-counts.yml',
+        '.github/workflows/performance-cost-actual.yml',
+        '.github/workflows/performance-load.yml',
+        'packages/foundation/operations/infrastructure-change.json',
+        'tools/ebk-infrastructure-plan-summary.mjs',
+    ]) {
+        delete files[obsoletePath];
+    }
     for (const [path, source] of Object.entries(files)) {
         if (/^\.github\/workflows\/[^/]+\.ya?ml$/u.test(path)) {
             files[path] = isolateOidcTokenBeforeAwsAuthority(source, configureAwsAction);