@empire-builder-kit/nx 1.0.0-rc.40 → 1.0.0-rc.41

package/src/generators/preset/tool-versions.d.ts

@@ -8,8 +8,6 @@ export declare const WORKSPACE_SST_VERSION: "4.17.1";
 export declare const WORKSPACE_NODE_VERSION: "22.23.1";
 export declare const WORKSPACE_PNPM_VERSION: "11.20.0";
 export declare const WORKSPACE_VITEST_VERSION: "4.1.4";
-/** Python packaging runtime required by the pinned SST-generated workloads. */
-export declare const WORKSPACE_UV_VERSION: "0.11.28";
 export declare const WORKSPACE_PNPM_SHA512: "9a6f330a95b66446ea088faf1521405a8a01f07fde7124cc9958dfed52d4bb436737e65b08f85f37b46fcba375092558ac51262b816844b22f63406ed166bfee";
 export declare const WORKSPACE_PNPM_DESCRIPTOR: "pnpm@11.20.0+sha512.9a6f330a95b66446ea088faf1521405a8a01f07fde7124cc9958dfed52d4bb436737e65b08f85f37b46fcba375092558ac51262b816844b22f63406ed166bfee";
 /**

package/src/generators/preset/tool-versions.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.WORKSPACE_SST_NPM_INTEGRITY = exports.WORKSPACE_PNPM_DESCRIPTOR = exports.WORKSPACE_PNPM_SHA512 = exports.WORKSPACE_UV_VERSION = exports.WORKSPACE_VITEST_VERSION = exports.WORKSPACE_PNPM_VERSION = exports.WORKSPACE_NODE_VERSION = exports.WORKSPACE_SST_VERSION = void 0;
+exports.WORKSPACE_SST_NPM_INTEGRITY = exports.WORKSPACE_PNPM_DESCRIPTOR = exports.WORKSPACE_PNPM_SHA512 = exports.WORKSPACE_VITEST_VERSION = exports.WORKSPACE_PNPM_VERSION = exports.WORKSPACE_NODE_VERSION = exports.WORKSPACE_SST_VERSION = void 0;
 /**
  * Framework-required tool versions written into newly generated workspaces.
  *
@@ -11,8 +11,6 @@ exports.WORKSPACE_SST_VERSION = '4.17.1';
 exports.WORKSPACE_NODE_VERSION = '22.23.1';
 exports.WORKSPACE_PNPM_VERSION = '11.20.0';
 exports.WORKSPACE_VITEST_VERSION = '4.1.4';
-/** Python packaging runtime required by the pinned SST-generated workloads. */
-exports.WORKSPACE_UV_VERSION = '0.11.28';
 exports.WORKSPACE_PNPM_SHA512 = '9a6f330a95b66446ea088faf1521405a8a01f07fde7124cc9958dfed52d4bb436737e65b08f85f37b46fcba375092558ac51262b816844b22f63406ed166bfee';
 exports.WORKSPACE_PNPM_DESCRIPTOR = `pnpm@${exports.WORKSPACE_PNPM_VERSION}+sha512.${exports.WORKSPACE_PNPM_SHA512}`;
 /**

package/src/generators/preset/workspace-files-adopter-skills.js

@@ -3,7 +3,6 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ADOPTER_SKILL_NAMES = void 0;
 exports.renderAdopterSkillIndex = renderAdopterSkillIndex;
 exports.renderAdopterSkills = renderAdopterSkills;
-const tool_versions_js_1 = require("./tool-versions.js");
 exports.ADOPTER_SKILL_NAMES = [
     'ebk-orient-plan',
     'ebk-build-feature',
@@ -115,11 +114,21 @@ not done merely because its generated file exists or the page loads.
             description: 'Run EBK task-scoped hot development, fleet-origin browser checks and final deployed-development smoke; choose feature versus milestone verification accurately.',
             body: `# Develop and verify
 
-Inspect \`ebk dev doctor\` and \`ebk dev status\` with the approved account,
-Region and temporary credential context. Resolve readiness failures using the
-reported prerequisite; a doctor pass is not feature proof. Development accepts
-dirty source and does not require a production confirmation, release artifact
-or full workspace barrier.
+Inspect \`ebk dev doctor\` and \`ebk dev status\` using the account and Region
+fixed by committed repository policy and the profile saved by
+\`ebk dev configure\`. If doctor reports an expired or missing SSO session, run
+\`aws sso login --profile <profile>\`; the human approves the request in the
+browser, so the session stays the human's own identity. In a hosted or
+headless shell, add \`--use-device-code\` and the human approves the printed
+code from their own browser. Confirm \`aws sts get-caller-identity\` reports
+that identity, then continue. Never embed access keys, export, copy, or read
+credentials from the SSO cache, or assume a separate or stronger principal.
+Only an attended agent (local or hosted), one a human is actively directing,
+uses that session; an unattended or background agent never receives a human
+profile or SSO session. Resolve other readiness failures using the reported
+prerequisite; a doctor pass is not feature proof.
+Development accepts dirty source and does not require a production
+confirmation, release artifact or full workspace barrier.
 
 If a container build stalls while Docker itself responds, run
 \`ebk dev doctor --refresh --json\` and inspect \`docker-credential-helpers\`.
@@ -148,12 +157,15 @@ Use affected unit/type/lint/ownership checks during edits. Require Docker for
 Slice integration tests (\`test-integration\`, part of \`verify\`), local container
 dependencies, or external Blueprint execution; require AWS
 credentials for actual task resources. Install browser binaries for browser
-proof. A Standard Slice includes a Python infrastructure provisioner even when
-its feature handlers use TypeScript: install uv ${tool_versions_js_1.WORKSPACE_UV_VERSION} (Python 3.12 or
-newer) on PATH before native development or deployment. Projects without Python and
-ordinary source-only feature checks do not require it. Tooling preflight is
-readiness, not browser or application proof; never infer that doctor alone has
-validated every build dependency.
+proof. Tooling preflight is readiness, not browser or application proof; never
+infer that doctor alone has validated every build dependency.
+
+Measured 2026-09-28/29 on Linux during the rc.39 acceptance, a fresh two-Slice
+\`ebk dev up\` took 334–442 s and \`ebk dev down\` 242–345 s. Those figures
+include the Python provisioner build that rc.41 removes, so they may change.
+\`ebk dev restart\` of retained resources took about 70–85 s including the
+browser check. Prefer \`ebk dev restart\` while iterating and reserve
+\`ebk dev down\` for the completion boundary.
 
 At the completion boundary, settle \`ebk dev down billing\`, then use
 \`ebk deploy development billing --profile=<approved-profile> --expectedRoleArn=<exact-role>\`.
@@ -177,12 +189,21 @@ mutation; source policy is authoritative if deliberately changed later.
 
 Use \`ebk deploy development\` for the complete active development stage, or
 \`ebk deploy development billing\` for Foundation plus one selected Slice.
-Pass the approved \`--profile\` and exact \`--expectedRoleArn\`; verify account,
-Region, stage and current caller. No direct SST or AWS application mutation.
-
-For an authorized local production deployment, retain clean source and the
-exact \`deploy:production:<account>:<region>:<source-commit>\` confirmation.
-An agent skill cannot authorize production or bypass a protected environment.
+Pass the human's Identity Center \`--profile\` (typically the one saved by
+\`ebk dev configure\`) and the exact stage deployment role from
+\`docs/stage-deployment-authority.md\` as \`--expectedRoleArn\`; verify
+account, Region, stage and current caller. Refresh an expired development
+session as in the develop/verify skill. No direct SST or AWS application
+mutation. A development deploy runs to completion with no prompt; add
+\`--json\` for one bounded result on stdout after the run (the receipt this run
+wrote and each project's outcome). Staging and production refuse \`--json\`.
+
+A local staging or production deployment, where the profile admits one, is
+human-operated: from clean source, a human at the terminal types the exact
+acknowledgement (for production,
+\`deploy:production:<account>:<region>:<source-commit>\`). Prepare the command,
+the receipt review and the evidence for the human. An agent skill cannot
+authorize production or bypass a protected environment.
 Refresh, unlock and remove are separate owning Nx targets: inspect their
 actual options and operation \`target:<project>:<target>\`; do not substitute
 deploy or raw provider commands. Remove dependent Slices before Foundation.

package/src/generators/preset/workspace-files-developer-agent.js

@@ -20,15 +20,33 @@ const HANDOFF_STATE_DESCRIPTIONS = {
     'failed-recovery-or-cleanup-required': 'Execution failed and named recovery or cleanup work is still required.',
     'proposal-or-research-only': 'The record contains no implementation or mutation claim.',
 };
+/**
+ * One canonical secret hand-off for seeded agent guidance. `set` stays
+ * human-only (the CLI refuses agent and CI markers); `remove` carries no value
+ * and an agent may start it, with the human typing the hidden confirmation.
+ */
+const HUMAN_SECRET_HANDOFF = `Human-supplied secret values are entered only by a human, in a terminal no agent spawned,
+through \`ebk secret set <slice> <logical-name>\`; the command refuses agent and CI
+environments, so the plaintext never crosses an agent-owned process. An agent prepares that
+step: it names the exact Slice and logical name, tells the human the exact command to run,
+and verifies afterwards with the value-blind status and verification targets.
+\`ebk secret remove <slice> <logical-name>\` carries no value: an agent may start it, and the
+human types the hidden confirmation in that interactive terminal. Agents and CI may use
+value-blind metadata, status, verification, and the exact generated-secret initializer, which
+accepts and returns no plaintext value.`;
 function deploymentAuthorityGuidance(deploymentProfile) {
     switch (deploymentProfile) {
         case 'starter':
             return `Development and production mutation may run locally only through the matching
 authenticated Nx lifecycle and committed Repository Operating Policy. GitHub deployment
-remains optional. Never invoke SST directly.`;
+remains optional. A human operates the terminal for local production and types its exact
+acknowledgement; an agent prepares the command, receipt review, and evidence.
+Never invoke SST directly.`;
         case 'production-isolated':
             return `Development and staging mutation may run locally only through the matching
-authenticated Nx lifecycle and committed Repository Operating Policy. Production mutation
+authenticated Nx lifecycle and committed Repository Operating Policy. A human operates the
+terminal for local staging and types its exact acknowledgement; an agent prepares the
+command, receipt review, and evidence. Production mutation
 belongs to the protected GitHub environment and OIDC workflow. Never invoke SST directly.`;
         case 'fully-isolated':
             return `Development mutation may run locally only through the matching authenticated Nx
@@ -45,11 +63,15 @@ not grant authority over another repository, account, environment, or worktree.
 
 Use \`ebk agent context\`, \`ebk agent plan\`, \`ebk agent upgrade-preview\`,
 \`ebk agent handoff\`, and \`ebk agent resume\`; add \`--json\` when a machine-readable
-result is required. Nx remains the graph and target authority: an agent plan is advisory, and
-work runs only through the authenticated owning target, typed Nx generator, bounded EBK
-development command, frozen package-manager command, or plan-derived adopter-owned
-source-edit scope. Protected and destructive operations expose identity and routing only,
-never local command arguments.
+result is required. Nx remains the graph and target authority. An agent plan is advisory; it
+is the route for typed generators, Upgrade preview and apply, and protected routing. Ordinary
+edits to adopter-owned, seeded, and unrecorded files need no plan: make them directly on a
+topic branch, bounded by \`.ebk/ownership.json\`, \`pnpm health\`, the verify barrier, and
+pull-request review. Managed paths are never hand-edited. Other work runs through the
+authenticated owning target, typed Nx generator, bounded EBK development command, or frozen
+package-manager command.
+Protected and destructive operations expose identity and routing only, never local command
+arguments.
 
 External Blueprint receipt review is the one deliberate target exception. Run only
 \`ebk blueprint verification-review\` after the protected static approval; there is no Nx
@@ -81,18 +103,23 @@ that same generator with the exact scoped prefix
 the workspace's fail-closed dependency-state check: it lets Nx reach EBK's bound recovery
 callback, which owns the install. Never run \`pnpm install\` while the retained marker exists.
 
-Use one topic branch and linked worktree per independent change. Stop on stale base,
-overlapping paths or shared external state, ownership or generated drift, invalid policy,
-blocking markers, missing prerequisites, or unknown authority; never merge, rebase, discard,
-or overwrite another worktree automatically.
+Use one topic branch and linked worktree per independent change. Stop on overlapping paths
+or shared external state, ownership or generated drift, invalid policy, blocking markers,
+missing prerequisites, or unknown authority. A stale base on your own topic branch is not a
+stop: rebase or merge the base branch into your own branch, rerun affected verification, and
+continue; where an operation itself binds an exact base (upgrade, formal handoff), refresh
+the base first and then rerun that operation. Never merge, rebase, discard, or overwrite
+another worktree or another actor's branch automatically. Before a shared operation (gateway
+setup, package release, candidate adoption, database replacement, or development
+deployment), follow the claim procedure in \`docs/shared-operation-claims.yaml\`.
 
-${deploymentAuthorityGuidance(deploymentProfile)} Human-supplied secret values remain a
-human-only TTY ceremony. Agents may use value-blind metadata, status, verification, and the
-exact generated-secret initializer; the initializer accepts and returns no plaintext value.
+${deploymentAuthorityGuidance(deploymentProfile)}
+
+${HUMAN_SECRET_HANDOFF}
 
 Read \`docs/developer-agent.md\`, \`docs/developer-agent-handoff.template.json\`,
-\`docs/developer-agent-adapters.md\`, \`docs/git-workflow.md\`, and
-\`docs/work-markers.md\` before proceeding.
+\`docs/developer-agent-adapters.md\`, \`docs/git-workflow.md\`,
+\`docs/work-markers.md\`, and \`docs/shared-operation-claims.yaml\` before proceeding.
 `;
 }
 function renderHandoffStates() {
@@ -109,7 +136,9 @@ required. A skill, MCP client, IDE, or hosted agent service is optional.
 
 The numeric JSON schema in this runbook is framework-internal and may change before stable v1.
 Do not publish an adapter or treat it as an independent public API until the repository-native
-CLI and Nx contract complete their live pilots.
+CLI and Nx contract complete their live pilots. A local, unpublished wrapper (skill, MCP tool,
+or IDE command) that only invokes these same commands with \`--json\` is permitted under
+\`docs/developer-agent-adapters.md\` and must stay removable without changing the workflow.
 
 ## Canonical loop
 
@@ -132,6 +161,10 @@ CLI and Nx contract complete their live pilots.
      the structured arguments reported by the plan;
    - execute authenticated read-only, local-source, or development Nx targets;
    - execute bounded \`ebk dev\` inspection or Slice lifecycle commands;
+   - run \`ebk deploy development [slice...]\` directly for a development deployment,
+     adding \`--json\` for one bounded result on stdout after the run (planning reports the
+     root \`deploy-local\` target as non-plannable and names this owner; staging and
+     production refuse \`--json\`);
    - execute the frozen package installation command;
    - make an ordinary source edit within inspected seeded/user-owned extension points
      (formal source-edit plans admit only adopter-owned paths); or
@@ -156,7 +189,11 @@ unsupported until their owning target, command, workflow, or runbook has an exac
 signature and proof contract. The stable Slice, Function, Service, Job, and Upgrade generators
 have closed typed inputs; arbitrary Blueprint references or inputs, dependency changes other
 than frozen installation, mutable development configuration, and secret set/remove remain
-outside \`ebk agent plan\`. Use their direct typed owner and never infer arguments.
+outside \`ebk agent plan\` but are not forbidden: use their direct owner and never infer
+arguments. Add or upgrade a dependency with \`pnpm add\` or \`pnpm up\` on the
+adopter-owned entries of a projection-managed \`package.json\` (never a framework-managed
+entry), then run the frozen installation and \`pnpm verify\`, which includes the
+supply-chain checks, and let pull-request review cover the change.
 
 External Blueprint receipt creation is not an Nx target. After protected Git retains the exact
 static generated-content approval, invoke only \`ebk blueprint verification-review\`. The
@@ -188,9 +225,13 @@ project roots; the request cannot assert it. Cross-project selections, unknown o
 managed or seeded source-edit plan paths, raw commands, prompts, secret values, absolute paths,
 traversal, and symlink inputs are refused.
 
-That source-edit plan restriction does not make seeded feature code immutable.
-Edit seeded handlers, tests and feature registries through the ordinary documented
-feature workflow; managed mechanics always require their owning generator.
+That source-edit plan restriction does not make seeded feature code immutable. A plan
+refusal for a seeded path is not a prohibition: seeded files and files absent from the
+ownership record may be edited directly on a topic branch, without a plan, bounded by
+\`pnpm health\`, the verify barrier, and pull-request review. Edit seeded handlers, tests
+and feature registries through the ordinary documented feature workflow; managed mechanics
+always require their owning generator and are never hand-edited. Source-edit plans do not yet
+admit seeded paths.
 
 Typed generator requests add one closed \`generatorInput\` object and cannot supply
 \`selectedFiles\`. New Slice planning accepts only \`{"generator":"slice","name":"billing"}\`
@@ -271,14 +312,29 @@ broaden an operation beyond the owning tool.
 Dirty source alone does not block ordinary feature generation, seeded/user-owned edits,
 affected verification or local development. Commit-bound plans, upgrades and formal
 handoffs still enforce their exact source requirements; protected authority is unchanged.
+A stale base on your own topic branch is not a stop: rebase or merge the base branch into
+your own branch, rerun affected verification, and continue. Never merge, rebase, discard,
+or overwrite another worktree or another actor's branch.
 
 For every mutation, name the cleanup and recovery owner before execution.
-${deploymentAuthorityGuidance(deploymentProfile)} Destructive work additionally requires an
-exact target, explicit approval, retained recovery proof, and completed cleanup.
-
-Human-supplied secret values are entered only through the human TTY ceremony. Agents and CI
-may use value-blind metadata, status, verification, and the exact generated-secret initializer;
-the initializer accepts and returns no plaintext value.
+${deploymentAuthorityGuidance(deploymentProfile)} Destructive work in a staging or production
+stage additionally requires an exact target, the human-typed TTY acknowledgement or protected
+GitHub environment approval that owns that stage, retained recovery proof, and completed
+cleanup. Destructive work in the development stage (remove, unlock, migration, personal task
+teardown) needs only the exact target and completed cleanup.
+
+${HUMAN_SECRET_HANDOFF}
+
+## Shared-operation claims
+
+Gateway setup, package release, candidate adoption, database replacement, and development
+deployment are shared operations that only one actor at a time may run. Before starting one,
+follow the procedure in \`docs/shared-operation-claims.yaml\` and \`docs/work-markers.md\`:
+read the current ledger, stop and report an open conflicting claim instead of running the
+operation, otherwise record your claim, and delete it when the operation and its verification
+are complete. Nothing enforces a claim; it is a convention built on work markers. Adding or
+removing a claim changes the work-marker set, so \`ebk agent resume\` reports a retained
+handoff as \`marker-blocked\`; record a fresh handoff after the claim changes.
 
 ## Handoff and resumption
 

package/src/generators/preset/workspace-files-shared-operation-claims.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Seeded shared-operation claim ledger. A claim is an ordinary EBK work marker
+ * (`EBK-TODO` with a `PLAN:shared-operation/<operation>` reference), so the
+ * existing work-markers scanner validates and reports open claims; no new
+ * enforcement exists, and the generated text must not imply one.
+ */
+export declare const SHARED_OPERATION_CLAIMS_PATH: "docs/shared-operation-claims.yaml";
+export declare const SHARED_OPERATIONS: readonly ["gateway-setup", "package-release", "candidate-adoption", "database-replacement", "development-deployment"];
+export declare const SHARED_OPERATION_CLAIM_PHASE: "shared-operation";
+export declare function renderSharedOperationClaims(workspaceName: string): string;

package/src/generators/preset/workspace-files-shared-operation-claims.js

@@ -0,0 +1,59 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SHARED_OPERATION_CLAIM_PHASE = exports.SHARED_OPERATIONS = exports.SHARED_OPERATION_CLAIMS_PATH = void 0;
+exports.renderSharedOperationClaims = renderSharedOperationClaims;
+/**
+ * Seeded shared-operation claim ledger. A claim is an ordinary EBK work marker
+ * (`EBK-TODO` with a `PLAN:shared-operation/<operation>` reference), so the
+ * existing work-markers scanner validates and reports open claims; no new
+ * enforcement exists, and the generated text must not imply one.
+ */
+exports.SHARED_OPERATION_CLAIMS_PATH = 'docs/shared-operation-claims.yaml';
+exports.SHARED_OPERATIONS = [
+    'gateway-setup',
+    'package-release',
+    'candidate-adoption',
+    'database-replacement',
+    'development-deployment',
+];
+exports.SHARED_OPERATION_CLAIM_PHASE = 'shared-operation';
+function renderSharedOperationClaims(workspaceName) {
+    return `# Shared-operation claim ledger
+#
+# Seeded by Empire Builder Kit; this repository owns the file after
+# generation. It serializes shared operations that only one actor at a time
+# may run: ${exports.SHARED_OPERATIONS.slice(0, -1).join(', ')}, and
+# ${exports.SHARED_OPERATIONS.at(-1)}.
+#
+# Before starting one of them, an agent or a human:
+#
+# 1. reads the current copy of this file where the other actors record
+#    claims (for example the integration branch after a fetch) and looks for
+#    an open claim on the same operation;
+# 2. if one exists, stops and reports the conflict instead of running the
+#    operation; the claim's owner or a human coordinator resolves it;
+# 3. otherwise adds one claim line below and commits it where the other
+#    actors read this ledger before starting; and
+# 4. deletes its own claim line once the operation and its verification are
+#    complete.
+#
+# A claim is one full-line EBK work marker: kind EBK-TODO, reference
+# PLAN:${exports.SHARED_OPERATION_CLAIM_PHASE}/<operation>, where <operation> is one of
+# the five names above, and a self-contained description naming the actor,
+# the branch or worktree, the start time in UTC, and the exact target. Two
+# open claims with the same reference conflict. For example (prose, not a
+# claim):
+#
+#   Example: EBK-TODO(PLAN:${exports.SHARED_OPERATION_CLAIM_PHASE}/development-deployment): <actor> on <branch> since <UTC time>; deploying billing to development.
+#
+# Run \`pnpm nx run ${workspaceName}:work-markers\` to list open claims with
+# every other work marker and validate their syntax. Adding or removing a
+# claim changes the marker set, so a retained Developer-Agent handoff
+# reports the change on resume. Nothing enforces a claim: it is a
+# convention the actors follow, and it is only as current as the copy they
+# read.
+#
+# Open claims:
+`;
+}
+//# sourceMappingURL=workspace-files-shared-operation-claims.js.map

package/src/generators/preset/workspace-files-stage-authority.js

@@ -26,7 +26,17 @@ pnpm nx run <workspace>:stage-authority-render -- \\
 \`\`\`
 
 Locally admitted stages require at least one reviewed
-\`--aws-principal-arn\`. Stages that require only protected GitHub deployment
+\`--aws-principal-arn\`.
+
+Rendering, reviewing, and read-only simulation of the emitted templates are
+ordinary work an agent may do with the development profile. Applying the
+owner-claim and authority stacks creates IAM roles and trust and therefore
+requires an account-administrator credential that agents never hold: the agent
+hands the exact rendered \`ownership-template.json\`, \`template.json\`, stack
+names, and parameters to the account administrator, who applies them, and the
+agent verifies afterwards with the read-only ownership doctor.
+
+Stages that require only protected GitHub deployment
 require one exact \`--github-repository\` environment trust and reject local AWS
 principals. Production-isolated staging requires both the local principal and
 the protected GitHub environment trust: local staging remains supported, while
@@ -204,7 +214,8 @@ exclusive and retained. Two workspaces do not cohabit one tuple, and removing
 an application stack does not release the claim.
 
 Render stage authority with \`pnpm nx run ${options.name}:stage-authority-render --
---stage=<stage> ...\`. Apply the emitted \`ownership-template.json\` as the exact
+--stage=<stage> ...\`. An agent may render and review it; an account administrator
+applies the stacks, because they create IAM roles and trust. Apply the emitted \`ownership-template.json\` as the exact
 claim stack in \`ownership-manifest.json\` before applying the authority template.
 CloudFormation's fixed-name SSM create is the atomic claim. The authority
 template accepts only that exact parameter path and fails its Rule before any

package/src/generators/preset/workspace-files-thin-deploy.d.ts

@@ -38,6 +38,16 @@ export interface ThinDeployWorkflowFilePlan {
 export declare function renderThinDeployVerifyCaller(profile: DeploymentProfile, deliveryLane?: 'protected-pair' | 'trunk', productionApprovalMode?: ThinDeployProductionApprovalMode): string;
 /** @internal Run exactly this generated script in the protected-runner fixture. */
 export declare function protectedBrowserInstallScript(): string;
+/**
+ * @internal Run exactly this generated script in the protected-runner fixture.
+ *
+ * Reads the deploying stage's GitHub environment variables through request
+ * names and exports the canonical machine-credential variables only when they
+ * are set. An unset GitHub variable expands to '', which the generated Slice
+ * SST config would read as a generation rather than its blue-1 default, so the
+ * canonical names never reach the lifecycle when the request is empty.
+ */
+export declare function machineCredentialRequestScript(): string;
 /** @internal Exported for executable source-contract tests. */
 export declare function exactStageDeployerGuardScript(operation: string, accountVariable: string): string;
 /** @internal Shared verbatim by every generated protected workflow. */

package/src/generators/preset/workspace-files-thin-deploy.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.EBK_RECORD_MAIN_TOKEN_SECRET = exports.THIN_DEPLOY_WORKFLOW_PATH = void 0;
 exports.renderThinDeployVerifyCaller = renderThinDeployVerifyCaller;
 exports.protectedBrowserInstallScript = protectedBrowserInstallScript;
+exports.machineCredentialRequestScript = machineCredentialRequestScript;
 exports.exactStageDeployerGuardScript = exactStageDeployerGuardScript;
 exports.canonicalStageAuthorityDerivationScript = canonicalStageAuthorityDerivationScript;
 exports.exactStagingPromotionPullGuardScript = exactStagingPromotionPullGuardScript;
@@ -11,7 +12,6 @@ exports.restoredCandidateValidationScript = restoredCandidateValidationScript;
 exports.stagingPromotionSealScript = stagingPromotionSealScript;
 exports.postdeploySupplyChainBindingScript = postdeploySupplyChainBindingScript;
 exports.renderThinDeployWorkflowFilePlan = renderThinDeployWorkflowFilePlan;
-const tool_versions_js_1 = require("./tool-versions.js");
 exports.THIN_DEPLOY_WORKFLOW_PATH = '.github/workflows/deploy.yml';
 /** The production environment secret that lets record-main fast-forward main. */
 exports.EBK_RECORD_MAIN_TOKEN_SECRET = 'EBK_RECORD_MAIN_TOKEN';
@@ -133,6 +133,57 @@ for project in "\${projects[@]}"; do
   pnpm --dir "packages/$project" exec playwright install --with-deps chromium
 done`;
 }
+/**
+ * @internal Run exactly this generated script in the protected-runner fixture.
+ *
+ * Reads the deploying stage's GitHub environment variables through request
+ * names and exports the canonical machine-credential variables only when they
+ * are set. An unset GitHub variable expands to '', which the generated Slice
+ * SST config would read as a generation rather than its blue-1 default, so the
+ * canonical names never reach the lifecycle when the request is empty.
+ */
+function machineCredentialRequestScript() {
+    return `set -euo pipefail
+generation="$EBK_REQUESTED_MACHINE_CREDENTIAL_GENERATION"
+retire="$EBK_REQUESTED_MACHINE_RETIRE_PREVIOUS_GENERATION"
+generation_pattern='^(blue|green)-[1-9][0-9]{0,11}$'
+if [ -n "$generation" ] && ! [[ "$generation" =~ $generation_pattern ]]; then
+  echo 'EBK_MACHINE_CREDENTIAL_GENERATION must be blue-N or green-N, where N is 1 to 12 digits without a leading zero, or unset'
+  exit 1
+fi
+case "$retire" in
+  ''|false|true) ;;
+  *) echo 'EBK_MACHINE_RETIRE_PREVIOUS_GENERATION must be exactly true or false, or unset'; exit 1 ;;
+esac
+if [ "$retire" = true ]; then
+  [ -n "$generation" ] || {
+    echo 'Retiring the previous machine credential generation requires EBK_MACHINE_CREDENTIAL_GENERATION to name the current generation'
+    exit 1
+  }
+  if [ "$EBK_ACTION" = deploy ] && [ "$EBK_LIFECYCLE_SCOPE" != full ]; then
+    echo 'Retiring the previous machine credential generation requires a Deploy dispatch with lifecycle full; affected scope can skip the Slice'
+    exit 1
+  fi
+fi
+if [ -n "$generation" ]; then
+  echo "EBK_MACHINE_CREDENTIAL_GENERATION=$generation" >> "$GITHUB_ENV"
+  echo "Requested machine credential generation: $generation"
+fi
+if [ "$retire" = true ]; then
+  echo 'EBK_MACHINE_RETIRE_PREVIOUS_GENERATION=true' >> "$GITHUB_ENV"
+  echo 'Requested retirement of the previous machine credential generation'
+fi`;
+}
+function machineCredentialRequestStep() {
+    return `      - name: Validate requested machine credential generation
+        env:
+          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
+          ACTIONS_ID_TOKEN_REQUEST_URL: ''
+          EBK_REQUESTED_MACHINE_CREDENTIAL_GENERATION: \${{ vars.EBK_MACHINE_CREDENTIAL_GENERATION }}
+          EBK_REQUESTED_MACHINE_RETIRE_PREVIOUS_GENERATION: \${{ vars.EBK_MACHINE_RETIRE_PREVIOUS_GENERATION }}
+        run: |
+${indentedScript(machineCredentialRequestScript(), 10)}`;
+}
 /** @internal Exported for executable source-contract tests. */
 function exactStageDeployerGuardScript(operation, accountVariable) {
     return `read -r caller_account caller_arn <<< "$(aws sts get-caller-identity --query '[Account,Arn]' --output text)"
@@ -1636,16 +1687,6 @@ ${indentedScript(restoredCandidateValidationScript(), 10)}
           ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
           ACTIONS_ID_TOKEN_REQUEST_URL: ''
         run: pnpm nx run ${name}:supply-chain-check-protected
-      - name: Install pinned uv for generated Python workloads
-        if: env.EBK_ACTION == 'deploy'
-        env:
-          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
-          ACTIONS_ID_TOKEN_REQUEST_URL: ''
-        run: |
-          set -euo pipefail
-          python3 -m pip install --user --disable-pip-version-check 'uv==${tool_versions_js_1.WORKSPACE_UV_VERSION}'
-          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
-          "$HOME/.local/bin/uv" --version
       - name: Install pinned Playwright Chromium for deployed smoke proofs
         if: env.EBK_ACTION == 'deploy' && needs.prepare.outputs.has_slices == 'true'
         env:
@@ -1653,6 +1694,7 @@ ${indentedScript(restoredCandidateValidationScript(), 10)}
           ACTIONS_ID_TOKEN_REQUEST_URL: ''
         run: |
 ${indentedScript(protectedBrowserInstallScript(), 10)}
+${machineCredentialRequestStep()}
       - name: Revalidate exact protected branch tip before OIDC
         env:
           ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
@@ -2333,21 +2375,13 @@ ${indentedScript(restoredCandidateValidationScript(), 10)}
           ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
           ACTIONS_ID_TOKEN_REQUEST_URL: ''
         run: pnpm nx run ${name}:supply-chain-check-protected
-      - name: Install pinned uv for generated Python workloads
-        env:
-          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
-          ACTIONS_ID_TOKEN_REQUEST_URL: ''
-        run: |
-          set -euo pipefail
-          python3 -m pip install --user --disable-pip-version-check 'uv==${tool_versions_js_1.WORKSPACE_UV_VERSION}'
-          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
-          "$HOME/.local/bin/uv" --version
       - name: Install pinned Playwright Chromium for deployed smoke proofs
         env:
           ACTIONS_ID_TOKEN_REQUEST_TOKEN: ''
           ACTIONS_ID_TOKEN_REQUEST_URL: ''
         run: |
 ${indentedScript(protectedBrowserInstallScript(), 10)}
+${machineCredentialRequestStep()}
 ${revalidateTip}
       - name: Assume the one stage deployment role
         uses: ${actionPins.configureAwsCredentials}

package/src/generators/preset/workspace-files-thin-docs.js

@@ -2,7 +2,6 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderThinLifecycleDocumentation = renderThinLifecycleDocumentation;
 const index_js_1 = require("../../repository-policy/index.js");
-const tool_versions_js_1 = require("./tool-versions.js");
 function renderThinLifecycleDocumentation(options) {
     const stages = (0, index_js_1.activeDeploymentStages)(options.deploymentProfile);
     const stageList = stages.join(', ');
@@ -22,16 +21,19 @@ checks. Run \`pnpm verify\` at a milestone, not before each development edit.
 Configure the exact temporary AWS profile and stage deployment role described
 in \`docs/stage-deployment-authority.md\` before deploying development through
 \`ebk deploy development --profile=<profile> --expectedRoleArn=<role-arn>\`
-(the root \`deploy-local\` target). Do not invoke SST directly.
-
-Standard Slices include a Python infrastructure provisioner: install \`uv\`
-${tool_versions_js_1.WORKSPACE_UV_VERSION} (Python 3.12 or newer) on PATH before \`ebk dev up\` or
-\`ebk deploy\`. Each Standard Slice stops before its SST child starts when
-\`uv --version\` fails; a full \`ebk deploy\` may already have deployed
-Foundation.
-Source-only feature checks do not require it. Slice \`verify\` runs
-\`test-integration\`, which needs a running Docker engine for DynamoDB Local (and
-PostgreSQL when SQL is declared).
+(the root \`deploy-local\` target). The profile is the human's IAM Identity
+Center profile, typically the one saved by \`ebk dev configure\`. When
+\`ebk dev doctor\` reports the session expired or missing, an attended coding
+agent (local or hosted) may run \`aws sso login --profile <profile>\`; the
+human approves the request in the browser, so the session stays the human's
+own identity. In a hosted or headless shell, add \`--use-device-code\` and the
+human approves the printed code from their own browser. Confirm
+\`aws sts get-caller-identity\` reports that identity before continuing.
+Never embed access keys, export, copy, or read credentials from the SSO cache,
+or assume a separate or stronger principal. Do not invoke SST directly.
+
+Slice \`verify\` runs \`test-integration\`, which needs a running Docker engine
+for DynamoDB Local (and PostgreSQL when SQL is declared).
 `,
         'docs/git-workflow.md': `# Protected Git workflow
 
@@ -147,8 +149,13 @@ authority options, for focused deployment after Foundation. Other Slices are
 not redeployed; required peers must already exist. Omit Slice names for the
 complete stage. Explicit selection is local-only and its \`selectedSlices\`
 receipt is not full-stage acceptance or a protected affected-deployment baseline.
-\`ebk deploy --help\` lists options; it preserves native TTY/output and does not
-accept arbitrary Nx/SST flags or a noninteractive confirmation.
+\`ebk deploy --help\` lists options. The command streams native output unchanged
+and accepts no arbitrary Nx/SST flags; the written deployment receipt is the
+structured result. Add \`--json\` to a development deploy to receive that receipt
+and per-project status on stdout after the run (native output moves to stderr);
+staging and production refuse \`--json\`. Development runs to completion with no
+prompt; only local staging and starter production stop for the human-typed
+acknowledgement described below.
 
 The root \`${options.name}:deploy-local\` target orders Foundation before every
 eligible Product Slice. Each project runs its public Nx \`deploy\` target, which
@@ -227,7 +234,9 @@ pinned SST owns native planning, state, locking, and deployment. Do not invoke
 SST directly.
 
 Before a nonproduction deployment, add the operator/probe CIDRs required by the
-stage's \`security/router-waf.json\` entry. Production remains public by default
+stage's \`security/router-waf.json\` entry. This is an ordinary edit to a seeded
+file; an agent may make it after confirming the current public IPv4 address of
+the workstation or probe host with the human. Production remains public by default
 behind managed rules and rate limiting and requires its blocking rehearsal.
 The resolved ${rehearsalStage} stage is rehearsed with
 \`pnpm nx run foundation:router-waf-rehearsal -- --probeUrl=https://<router>/<slice>/api/health --profile=<temporary-profile>\`.
@@ -241,6 +250,15 @@ role. Development accepts a dirty tree and requires no acknowledgement:
 
 \`ebk deploy development --profile=<profile> --expectedRoleArn=<role-arn>\`
 
+For development, when the session is expired or missing, an attended coding
+agent (local or hosted) may run \`aws sso login --profile <profile>\`; the
+human approves the request in the browser, so the session stays the human's
+own identity. In a hosted or headless shell, add \`--use-device-code\` and the
+human approves the printed code from their own browser. Confirm
+\`aws sts get-caller-identity\` reports that identity before continuing.
+Never embed access keys, export, copy, or read credentials from the SSO cache,
+or assume a separate or stronger principal.
+
 Local staging, when active, requires a clean commit and an interactive
 \`approve:deploy:staging:<source-commit>\` response. Starter production requires
 a clean commit and one exact response entered at the real terminal prompt: