@empire-builder-kit/nx 1.0.0-rc.44 → 1.0.0-rc.46

package/src/generators/preset/tool-versions.js

@@ -8,9 +8,9 @@ exports.WORKSPACE_SST_NPM_INTEGRITY = exports.WORKSPACE_PNPM_DESCRIPTOR = export
  * existing workspace explicitly adopts the exact reviewed descriptor.
  */
 exports.WORKSPACE_SST_VERSION = '4.17.1';
-exports.WORKSPACE_NODE_VERSION = '22.23.1';
+exports.WORKSPACE_NODE_VERSION = '22.23.4';
 exports.WORKSPACE_PNPM_VERSION = '11.20.0';
-exports.WORKSPACE_VITEST_VERSION = '4.1.11';
+exports.WORKSPACE_VITEST_VERSION = '4.1.12';
 exports.WORKSPACE_PNPM_SHA512 = '9a6f330a95b66446ea088faf1521405a8a01f07fde7124cc9958dfed52d4bb436737e65b08f85f37b46fcba375092558ac51262b816844b22f63406ed166bfee';
 exports.WORKSPACE_PNPM_DESCRIPTOR = `pnpm@${exports.WORKSPACE_PNPM_VERSION}+sha512.${exports.WORKSPACE_PNPM_SHA512}`;
 /**

package/src/generators/preset/workspace-files-adopter-skills.js

@@ -3,6 +3,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.ADOPTER_SKILL_NAMES = void 0;
 exports.renderAdopterSkillIndex = renderAdopterSkillIndex;
 exports.renderAdopterSkills = renderAdopterSkills;
+const workspace_files_agent_development_js_1 = require("./workspace-files-agent-development.js");
 exports.ADOPTER_SKILL_NAMES = [
     'ebk-orient-plan',
     'ebk-build-feature',
@@ -107,6 +108,21 @@ intents commit atomically. TTL is eventual cleanup, not an authorization or
 expiry decision. Events use the same stage/task; never bridge task async work
 to deployed development.
 
+For a cross-Slice event, the producer declares it in its seeded
+\`contracts/events.ts\` \`EventContractSchema\`; its own queue rule then also
+receives it, so its seeded consumer acknowledges it. The consumer adds the
+producer's \`@<scope>/<producer>/contracts\` package to its seeded
+\`contracts/dependencies.json\` \`consumes\` with a \`workspace:*\` dependency,
+runs \`pnpm nx run <consumer>:contract-dependencies-sync\`, declares
+\`{ "source": "<producer>", "events": [{ "detailType": "<Type>", "schemaVersions": [1] }] }\`
+in its seeded \`contracts/event-subscriptions.json\`, and extends its seeded
+\`api/event-consumer.ts\` to accept that source, type and every declared
+version. Managed infrastructure adds one rule per source; never edit
+\`infra/product.ts\`. \`contract-dependencies-check\` binds the declaration to
+the producer's schema. Source and detail type are delivery filters, not
+authentication: authorize every effect from the consumer's own data and
+policy. Never carry product data in \`DataLifecycleChanged\`.
+
 Add SQL only when relational constraints, transactions or joins justify it:
 \`pnpm nx g @empire-builder-kit/nx:sql billing --reason="Ledger requires relational constraints and reporting joins"\`
 reports the paired changes; review and repeat with \`--apply\`. The generator
@@ -125,18 +141,12 @@ not done merely because its generated file exists or the page loads.
             body: `# Develop and verify
 
 Inspect \`ebk dev doctor\` and \`ebk dev status\` using the account and Region
-fixed by committed repository policy and the profile saved by
-\`ebk dev configure\`. If doctor reports an expired or missing SSO session, run
-\`aws sso login --profile <profile>\`; the human approves the request in the
-browser, so the session stays the human's own identity. In a hosted or
-headless shell, add \`--use-device-code\` and the human approves the printed
-code from their own browser. Confirm \`aws sts get-caller-identity\` reports
-that identity, then continue. Never embed access keys, export, copy, or read
-credentials from the SSO cache, or assume a separate or stronger principal.
-Only an attended agent (local or hosted), one a human is actively directing,
-uses that session; an unattended or background agent never receives a human
-profile or SSO session. Resolve other readiness failures using the reported
-prerequisite; a doctor pass is not feature proof.
+fixed by committed repository policy and the development profile saved by
+\`ebk dev configure\`.
+
+${workspace_files_agent_development_js_1.AGENT_DEVELOPMENT_AUTHORITY}
+Resolve other readiness failures using the reported prerequisite; a doctor pass
+is not feature proof.
 Development accepts dirty source and does not require a production
 confirmation, release artifact or full workspace barrier.
 
@@ -178,7 +188,7 @@ browser check. Prefer \`ebk dev restart\` while iterating and reserve
 \`ebk dev down\` for the completion boundary.
 
 At the completion boundary, settle \`ebk dev down billing\`, then use
-\`ebk deploy development billing --profile=<approved-profile> --expectedRoleArn=<exact-role>\`.
+\`ebk deploy development billing --profile=<development-profile> --expectedRoleArn=<exact-role>\`.
 This selects Foundation then Billing. Omit Slice selectors for complete-stage
 proof. Verify the deployed Router without hot processes or fallback serving it.
 Check migration, smoke and cleanup outcomes; failure is not acceptance.
@@ -199,11 +209,12 @@ mutation; source policy is authoritative if deliberately changed later.
 
 Use \`ebk deploy development\` for the complete active development stage, or
 \`ebk deploy development billing\` for Foundation plus one selected Slice.
-Pass the human's Identity Center \`--profile\` (typically the one saved by
-\`ebk dev configure\`) and the exact stage deployment role from
+Pass the development profile saved by \`ebk dev configure\` as \`--profile\`;
+it chains the human's Identity Center source profile into the exact development
+deployment role. Pass that role from
 \`docs/stage-deployment-authority.md\` as \`--expectedRoleArn\`; verify
-account, Region, stage and current caller. Refresh an expired development
-session as in the develop/verify skill. No direct SST or AWS application
+account, Region, stage and current caller. Refresh an expired source session
+as in the develop/verify skill. No direct SST or AWS application
 mutation. A development deploy runs to completion with no prompt; add
 \`--json\` for one bounded result on stdout after the run (the receipt this run
 wrote and each project's outcome). Staging and production refuse \`--json\`.

package/src/generators/preset/workspace-files-agent-development.d.ts

@@ -0,0 +1,9 @@
+/**
+ * One canonical statement of what a coding agent may do in the development
+ * stage. The seeded README and Foundation runbook and the managed
+ * develop/verify skill interpolate it verbatim so the three copies cannot
+ * drift. Any agent, attended or unattended, may use the human's approved
+ * development profile for development-stage work; the protected stages,
+ * credential handling and denial handling stay fixed.
+ */
+export declare const AGENT_DEVELOPMENT_AUTHORITY = "Any coding agent, attended or unattended, may run `ebk dev up`, `restart`,\n`down`, and `ebk deploy development` through EBK/Nx with the human's approved\ndevelopment profile, within the approved task, account, Region, ownership,\ncost, and cleanup limits, without repeated confirmation. The source profile is\nthe human's IAM Identity Center login profile. The development profile is the\none `ebk dev configure` saves and `--profile` receives; it chains the source\nprofile into the exact bounded development deployment role named in\n`docs/stage-deployment-authority.md`. That role assumption is expected; it\ndoes not authorize another role or broader access. An agent on another host\nreceives no copy of either profile or of the SSO cache.\nIf the source session is expired or missing, run\n`aws sso login --profile <source-profile>`, adding `--use-device-code` in a\nheadless shell. The login needs the human's browser approval, so an agent whose\nsource session has expired with no human available stops and reports.\nBefore mutation, run `aws sts get-caller-identity --profile <development-profile>`.\n`Account` must equal the committed development account, `Arn` must be\n`arn:<partition>:sts::<account>:assumed-role/ebk-development-deploy/<session>`,\nan assumed-role session of that exact role, and the Region saved by\n`ebk dev configure` must equal the committed Region. `ebk dev up` checks only\nthe account and Region; `ebk deploy development` also enforces the role.\nNever embed keys, export or copy credentials, read the SSO cache, or broaden\ntrust or policies. A protected observer profile, meaning a read-only staging or\nproduction profile the human may hold for inspection, is never a role source,\nand neither is any other staging or production profile.\nStaging and production stay GitHub-only or human-only, and agents and CI never\nrun `ebk secret set`. A new binding or authority expansion stops for a human\ndecision. A denial from the agent host, EBK, or AWS stops that mutation and\nevery equivalent route: report the exact denial and command, and do not\nre-route through Nx, SST, raw AWS, another profile, or another role. A\nhuman-started Fleet is the fallback.";

package/src/generators/preset/workspace-files-agent-development.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AGENT_DEVELOPMENT_AUTHORITY = void 0;
+/**
+ * One canonical statement of what a coding agent may do in the development
+ * stage. The seeded README and Foundation runbook and the managed
+ * develop/verify skill interpolate it verbatim so the three copies cannot
+ * drift. Any agent, attended or unattended, may use the human's approved
+ * development profile for development-stage work; the protected stages,
+ * credential handling and denial handling stay fixed.
+ */
+exports.AGENT_DEVELOPMENT_AUTHORITY = `Any coding agent, attended or unattended, may run \`ebk dev up\`, \`restart\`,
+\`down\`, and \`ebk deploy development\` through EBK/Nx with the human's approved
+development profile, within the approved task, account, Region, ownership,
+cost, and cleanup limits, without repeated confirmation. The source profile is
+the human's IAM Identity Center login profile. The development profile is the
+one \`ebk dev configure\` saves and \`--profile\` receives; it chains the source
+profile into the exact bounded development deployment role named in
+\`docs/stage-deployment-authority.md\`. That role assumption is expected; it
+does not authorize another role or broader access. An agent on another host
+receives no copy of either profile or of the SSO cache.
+If the source session is expired or missing, run
+\`aws sso login --profile <source-profile>\`, adding \`--use-device-code\` in a
+headless shell. The login needs the human's browser approval, so an agent whose
+source session has expired with no human available stops and reports.
+Before mutation, run \`aws sts get-caller-identity --profile <development-profile>\`.
+\`Account\` must equal the committed development account, \`Arn\` must be
+\`arn:<partition>:sts::<account>:assumed-role/ebk-development-deploy/<session>\`,
+an assumed-role session of that exact role, and the Region saved by
+\`ebk dev configure\` must equal the committed Region. \`ebk dev up\` checks only
+the account and Region; \`ebk deploy development\` also enforces the role.
+Never embed keys, export or copy credentials, read the SSO cache, or broaden
+trust or policies. A protected observer profile, meaning a read-only staging or
+production profile the human may hold for inspection, is never a role source,
+and neither is any other staging or production profile.
+Staging and production stay GitHub-only or human-only, and agents and CI never
+run \`ebk secret set\`. A new binding or authority expansion stops for a human
+decision. A denial from the agent host, EBK, or AWS stops that mutation and
+every equivalent route: report the exact denial and command, and do not
+re-route through Nx, SST, raw AWS, another profile, or another role. A
+human-started Fleet is the fallback.`;
+//# sourceMappingURL=workspace-files-agent-development.js.map

package/src/generators/preset/workspace-files-thin-deploy.js

@@ -541,6 +541,9 @@ writeFileSync(
 function renderThinDeployWorkflow(options) {
     const { actionPins, deploymentProfile, name, toolVersions } = options;
     const trunkPromotion = options.productionApprovalMode === 'trunk-promotion';
+    // The starter protected pair deploys development from protected develop;
+    // in the trunk lane develop is unprotected and owns no stage.
+    const developmentFromProtectedDevelop = deploymentProfile === 'starter' && options.deliveryLane !== 'trunk';
     return `name: Deploy
 run-name: Deploy \${{ inputs.source_commit || github.sha }}
 
@@ -707,14 +710,17 @@ jobs:
           plan_action="$action"
           [ "$action" != rehearse ] || plan_action=deploy
           case "$EBK_SOURCE_BRANCH" in
-            main) stage=production ;;
+            main) stage=production ;;${options.deliveryLane === 'trunk'
+        ? `
+            develop) echo 'Trunk lane protected lifecycle runs from main'; exit 1 ;;`
+        : `
             develop)
               if [ "$EBK_PROFILE" = starter ]; then
                 stage=development
               else
                 stage=staging
               fi
-              ;;
+              ;;`}
             *) echo 'Protected lifecycle must run from develop or main'; exit 1 ;;
           esac
           echo "action=$action" >> "$GITHUB_OUTPUT"
@@ -753,7 +759,11 @@ ${indentedScript(`set -euo pipefail\n${canonicalStageAuthorityDerivationScript()
       # production authority is derived here beside the staging authority.
       - id: production-account
         name: Derive canonical committed production authority for trunk promotion
-        if: steps.route.outputs.stage == 'staging'
+        if: >-
+          steps.route.outputs.action == 'deploy' &&
+          steps.route.outputs.stage == 'staging' &&
+          steps.policy.outputs.deployment_profile != 'starter' &&
+          steps.policy.outputs.has_slices == 'true'
         env:
           EBK_DEVELOPMENT_ACCOUNT: \${{ steps.policy.outputs.development_account_id }}
           EBK_PRODUCTION_ACCOUNT: \${{ steps.policy.outputs.production_account_id }}
@@ -1665,7 +1675,10 @@ ${indentedScript(restoredCandidateValidationScript(), 10)}
             { echo 'Protected Blueprint authority must be one full Git object ID'; exit 1; }
           test "$(git rev-parse HEAD)" = "$EBK_PROTECTED_BLUEPRINT_COMMIT" ||
             { echo 'Protected Blueprint authority differs from the exact workflow checkout'; exit 1; }
-          case "$EBK_STAGE" in
+          case "$EBK_STAGE" in${developmentFromProtectedDevelop
+        ? `
+            development) protected_branch=develop ;;`
+        : ''}
             staging) protected_branch=develop ;;
             production) protected_branch=main ;;
             *) exit 1 ;;

package/src/generators/preset/workspace-files-thin-docs.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.renderThinLifecycleDocumentation = renderThinLifecycleDocumentation;
+const workspace_files_agent_development_js_1 = require("./workspace-files-agent-development.js");
 const index_js_1 = require("../../repository-policy/index.js");
 function renderThinLifecycleDocumentation(options) {
     const stages = (0, index_js_1.activeDeploymentStages)(options.deploymentProfile);
@@ -18,19 +19,13 @@ The committed \`${options.deploymentProfile}\` profile activates: ${stageList}.
 
 For ordinary feature work, run affected tests, typecheck, lint, and ownership
 checks. Run \`pnpm verify\` at a milestone, not before each development edit.
-Configure the exact temporary AWS profile and stage deployment role described
+Configure the development profile and the stage deployment role described
 in \`docs/stage-deployment-authority.md\` before deploying development through
-\`ebk deploy development --profile=<profile> --expectedRoleArn=<role-arn>\`
-(the root \`deploy-local\` target). The profile is the human's IAM Identity
-Center profile, typically the one saved by \`ebk dev configure\`. When
-\`ebk dev doctor\` reports the session expired or missing, an attended coding
-agent (local or hosted) may run \`aws sso login --profile <profile>\`; the
-human approves the request in the browser, so the session stays the human's
-own identity. In a hosted or headless shell, add \`--use-device-code\` and the
-human approves the printed code from their own browser. Confirm
-\`aws sts get-caller-identity\` reports that identity before continuing.
-Never embed access keys, export, copy, or read credentials from the SSO cache,
-or assume a separate or stronger principal. Do not invoke SST directly.
+\`ebk deploy development --profile=<development-profile> --expectedRoleArn=<role-arn>\`
+(the root \`deploy-local\` target).
+
+${workspace_files_agent_development_js_1.AGENT_DEVELOPMENT_AUTHORITY}
+Do not invoke SST directly.
 
 Slice \`verify\` runs \`test-integration\`, which needs a running Docker engine
 for DynamoDB Local (and PostgreSQL when SQL is declared).
@@ -143,7 +138,7 @@ removal, unlock, discovery, and secret resolution.
 
 ## Native lifecycle
 
-Use \`ebk deploy development --profile=<profile> --expectedRoleArn=<role-arn>\`.
+Use \`ebk deploy development --profile=<development-profile> --expectedRoleArn=<role-arn>\`.
 Add Slice names, for example \`ebk deploy development billing\` with the same
 authority options, for focused deployment after Foundation. Other Slices are
 not redeployed; required peers must already exist. Omit Slice names for the
@@ -248,16 +243,9 @@ The resolved ${rehearsalStage} stage is rehearsed with
 Use temporary IAM Identity Center credentials and the stable stage deployment
 role. Development accepts a dirty tree and requires no acknowledgement:
 
-\`ebk deploy development --profile=<profile> --expectedRoleArn=<role-arn>\`
+\`ebk deploy development --profile=<development-profile> --expectedRoleArn=<role-arn>\`
 
-For development, when the session is expired or missing, an attended coding
-agent (local or hosted) may run \`aws sso login --profile <profile>\`; the
-human approves the request in the browser, so the session stays the human's
-own identity. In a hosted or headless shell, add \`--use-device-code\` and the
-human approves the printed code from their own browser. Confirm
-\`aws sts get-caller-identity\` reports that identity before continuing.
-Never embed access keys, export, copy, or read credentials from the SSO cache,
-or assume a separate or stronger principal.
+${workspace_files_agent_development_js_1.AGENT_DEVELOPMENT_AUTHORITY}
 
 Local staging, when active, requires a clean commit and an interactive
 \`approve:deploy:staging:<source-commit>\` response. Starter production requires

package/src/generators/preset/workspace-files.d.ts

@@ -11,6 +11,7 @@ export interface WorkspaceFileOptions {
     /** Seeded supply-chain/dependency-overrides.json data. When absent, the
      * workspace is seeded with DEFAULT_DEPENDENCY_OVERRIDES. */
     dependencyOverrides?: unknown;
+    observabilityPolicy?: unknown;
     deploymentAccounts?: ConfiguredDeploymentAccounts;
     deploymentProfile?: DeploymentProfile;
     deploymentRegion?: string | null;

package/src/generators/preset/workspace-files.js

@@ -11,6 +11,7 @@ const dependency_overrides_js_1 = require("./dependency-overrides.js");
 const index_js_1 = require("../../ownership/index.js");
 const index_js_2 = require("../../frontend-security/index.js");
 const capability_plan_js_1 = require("../../foundation/capability-plan.js");
+const observability_js_1 = require("../../foundation/observability.js");
 const cost_estimate_js_1 = require("../../foundation/cost-estimate.js");
 const index_js_3 = require("../../git-policy/index.js");
 const index_js_4 = require("../../repository-policy/index.js");
@@ -1059,6 +1060,7 @@ const SUPPLY_CHAIN_WORKSPACE_FILE_PLAN = (0, index_js_6.renderSupplyChainWorkspa
 });
 const WORKSPACE_SEEDED_PATHS = new Set([
     dependency_overrides_js_1.DEPENDENCY_OVERRIDES_PATH,
+    observability_js_1.OBSERVABILITY_POLICY_PATH,
     ...SUPPLY_CHAIN_WORKSPACE_FILE_PLAN.seeded,
     ...workspace_files_developer_agent_js_1.DEVELOPER_AGENT_WORKSPACE_SEEDED_PATHS,
     '.github/CODEOWNERS',
@@ -1066,6 +1068,7 @@ const WORKSPACE_SEEDED_PATHS = new Set([
     'CLAUDE.md',
     'README.md',
     'docs/architecture.md',
+    'docs/observability.md',
     'docs/git-workflow.md',
     'docs/repository-operating-policy.md',
     'docs/stage-deployment-authority.md',
@@ -7656,6 +7659,7 @@ console.log('Installed the repository-local EBK pre-push hook at ' + hookPath +
 .open-next
 dist
 *.tsbuildinfo
+**/next-env.d.ts
 node_modules
 .sst
 **/playwright/.auth
@@ -7874,6 +7878,72 @@ convention, current only as far as the copy each actor reads.
 `,
         [workspace_files_shared_operation_claims_js_1.SHARED_OPERATION_CLAIMS_PATH]: (0, workspace_files_shared_operation_claims_js_1.renderSharedOperationClaims)(name),
         'ebk.repository-policy.json': json(initialRepositoryPolicy),
+        [observability_js_1.OBSERVABILITY_POLICY_PATH]: json(options.observabilityPolicy === undefined
+            ? (0, observability_js_1.defaultObservabilityPolicy)(activeStages, {
+                productionProfile: initialRepositoryPolicy.productionFoundation.profile,
+            })
+            : (0, observability_js_1.parseObservabilityPolicy)(options.observabilityPolicy, activeStages)),
+        'docs/observability.md': `# Observability spending and diagnostics
+
+The seeded ebk.observability.json is the stage-specific policy. New development
+uses cost-optimized, active staging uses balanced, and production gets an explicit
+profile initialized from its capacity choice. Later capacity changes never alter
+that seeded observability choice. Task diagnostics are lean, but explicit retention
+and dormant-log preservation still apply; local hot diagnostics remain complete.
+This policy never pauses work or
+changes database protection, encryption, backups, topology or deployment authority.
+
+Cost-optimized retains 5% of marked neutral request-start/success diagnostics, WARN Lambda
+system logs and no dashboards. Balanced retains 25%, INFO system logs and one
+Foundation dashboard. Standard retains 100%, INFO system logs and Foundation plus
+Slice dashboards. All retain errors, warnings, security, migration/event receipts,
+required counters and core failure/backlog alarms. Custom metrics are not free;
+batching reduces ingestion bytes, not billable metric series.
+
+Mixed application/security log groups retain at least 30 days (90 for new standard
+production). diagnosticRetentionDays is an extension default; no generated log
+group uses it. Shorter diagnostic retention applies only to separately declared
+diagnostic groups, never mixed groups. Insights, enhanced database monitoring and
+tracing have no control in this policy. Retain Standard class for EMF and generated
+receipt queries. WAF enforcement and existing request-log privacy are unchanged.
+
+Upgrades from older workspaces seed explicit prior retention and verbosity; they
+do not silently adopt shorter retention or remove dormant log groups. Review this
+seeded file to opt in deliberately. Profile changes require ordinary deployment;
+generators never change AWS. Workspace upgrade comes before Foundation/Slices.
+When enabling a new canonical stage, declare it here as well as in repository policy.
+
+Stage overrides: profile; routineSuccessSampleRate (0–1); diagnosticRetentionDays;
+protectedRetentionDays (AWS-supported, at least 30); dashboards (none, stage, slice);
+systemLogLevel (WARN, INFO); retainDormantComponentLogs (boolean). Declared optional
+components always keep their logs. Only absent provider/webhook components may
+omit their otherwise unused log groups and findings alarms.
+
+Fractional sampling uses a server-owned ID, not client correlation/request headers.
+Request starts are neutral, never successful. Legacy/standard retain an entry
+breadcrumb even for handlers that never return; cheap profiles may omit routine
+starts, but failures and receipts remain unsampled.
+
+Custom reliability labels belong in each Slice's seeded reliability/metric-declarations.ts.
+Declare finite component/feature/operation values, never user, tenant, request or
+resource identifiers. Keep high-cardinality context in redacted logs. Only reviewed
+routine INFO successes may use routineSuccess; never mark receipts or security events.
+Upgrades flag the new declaration requirement with a reconciliation work marker.
+Undeclared tuples and invalid observations produce bounded reason-only warnings;
+invalid latency never suppresses the valid operation counters.
+
+At low traffic, fixed dashboards, alarms and metric series can dominate the bill.
+Profile savings primarily change dashboard inventory; fresh disabled adapters omit
+two dormant groups and findings alarms. Sampling/batching affect ingestion and
+scanning volume, while retention affects storage only where applied. No live
+saving or free-tier discount is implied by the list-price estimate.
+
+Diagnostics are on demand. Budget CloudWatch API metric retrieval as well as
+alarms, storage, ingestion, scanning and custom series. Narrow queries to the
+exact owned stage/resources/window; account-wide repeated sweeps are not a
+default application behavior. Never reduce a safety check's coverage or cadence
+to hide its cost. Measure actual billing after deployment, not just estimates.
+`,
         'nx.json': json({
             $schema: './node_modules/nx/schemas/nx-schema.json',
             defaultBase: 'develop',
@@ -8222,6 +8292,7 @@ ${foundationPlan.resources.postgres ? '  foundationDatabaseEndpointHost,' : ''}
   foundationSsmPath,
   normalizeRouterWafPolicy,
   reconcileRouterWafBlockingRehearsal,
+  resolveObservabilityPolicy,
   routerWafContractDigest,
   type FoundationSsmKey,
 } from '@empire-builder-kit/nx/foundation';
@@ -8242,6 +8313,7 @@ import routerWafBlockingRehearsal from '../security/router-waf-blocking-rehearsa
 import routerWafLiveEvidence from '../security/router-waf-live-evidence.json';
 import routerWafPolicy from '../security/router-waf.json';
 import repositoryPolicy from '../../../ebk.repository-policy.json';
+import observabilityPolicy from '../../../ebk.observability.json';
 
 function identityDomainPrefix(stage: string, accountId: string): string {
   if (!/^\\d{12}$/.test(accountId)) {
@@ -8277,6 +8349,11 @@ function publishFoundation(values: Partial<Record<FoundationSsmKey, any>>) {
 
 export function foundation() {
   const isProduction = $app.stage === 'production';
+  const observability = resolveObservabilityPolicy({
+    policy: observabilityPolicy,
+    stage: $app.stage,
+    productionProfile: process.env.EBK_PRODUCTION_FOUNDATION_PROFILE,
+  });
 ${foundationPlan.resources.postgres ? "  const isStaging = $app.stage === 'staging';" : ''}
   const rootDomain = process.env.EBK_ROOT_DOMAIN?.trim();
   const productionConfiguration = isProduction
@@ -8289,36 +8366,38 @@ ${foundationPlan.resources.network ? "  const natMode = productionConfiguration?
   if (repositoryPolicy.deploymentProfile !== normalizedRouterWafPolicy.deploymentProfile) {
     throw new Error('Router WAF policy profile differs from committed repository policy.');
   }
-  const rehearsalStage = productionRehearsalStage(normalizedRouterWafPolicy.deploymentProfile);
-  const rehearsalAccount = configuredDeploymentAccountForStage(
-    normalizedRouterWafPolicy.deploymentProfile,
-    repositoryPolicy.deploymentAccounts,
-    rehearsalStage,
-  );
-  const rehearsalRegion = configuredDeploymentRegion(repositoryPolicy.deploymentRegion);
-  const rehearsalRoleArn = createStageAuthorityIdentity({
-    accountId: rehearsalAccount,
-    partition: rehearsalRegion.startsWith('us-gov-') ? 'aws-us-gov' : 'aws',
-    region: rehearsalRegion,
-    stage: rehearsalStage,
-  }).deploymentRoleArn;
+  let rehearsal: ReturnType<typeof reconcileRouterWafBlockingRehearsal> = null;
+  if (isProduction) {
+    const rehearsalStage = productionRehearsalStage(normalizedRouterWafPolicy.deploymentProfile);
+    const rehearsalAccount = configuredDeploymentAccountForStage(
+      normalizedRouterWafPolicy.deploymentProfile,
+      repositoryPolicy.deploymentAccounts,
+      rehearsalStage,
+    );
+    const rehearsalRegion = configuredDeploymentRegion(repositoryPolicy.deploymentRegion);
+    const rehearsalRoleArn = createStageAuthorityIdentity({
+      accountId: rehearsalAccount,
+      partition: rehearsalRegion.startsWith('us-gov-') ? 'aws-us-gov' : 'aws',
+      region: rehearsalRegion,
+      stage: rehearsalStage,
+    }).deploymentRoleArn;
+    rehearsal = reconcileRouterWafBlockingRehearsal({
+      evidence: routerWafLiveEvidence,
+      expected: {
+        accountId: rehearsalAccount,
+        deploymentRoleArn: rehearsalRoleArn,
+        region: rehearsalRegion,
+        stage: rehearsalStage,
+        wafContractDigest: routerWafContractDigest(normalizedRouterWafPolicy),
+        workspace: '${name}',
+      },
+      policy: normalizedRouterWafPolicy,
+      receipt: routerWafBlockingRehearsal,
+    });
+  }
   const wafPlan = createRouterWafStagePlan({
     policy: normalizedRouterWafPolicy,
-    rehearsal: isProduction
-      ? reconcileRouterWafBlockingRehearsal({
-          evidence: routerWafLiveEvidence,
-          expected: {
-            accountId: rehearsalAccount,
-            deploymentRoleArn: rehearsalRoleArn,
-            region: rehearsalRegion,
-            stage: rehearsalStage,
-            wafContractDigest: routerWafContractDigest(normalizedRouterWafPolicy),
-            workspace: '${name}',
-          },
-          policy: normalizedRouterWafPolicy,
-          receipt: routerWafBlockingRehearsal,
-        })
-      : null,
+    rehearsal,
     stage: $app.stage,
   });
   const deploymentAccount = process.env.AWS_EXPECTED_ACCOUNT_ID?.trim() ?? '';
@@ -8753,7 +8832,7 @@ ${foundationPlan.resources.postgres
         { dependsOn: [alertTopicPolicy] },
       )
     : undefined;
-  const dashboard = new aws.cloudwatch.Dashboard('FoundationDashboard', {
+  const dashboard = observability.dashboards === 'none' ? undefined : new aws.cloudwatch.Dashboard('FoundationDashboard', {
     dashboardName: 'ebk-' + $app.stage + '-foundation',
     dashboardBody: databaseInstanceId.apply((identifier: string) => JSON.stringify({
       widgets: [
@@ -8824,12 +8903,18 @@ ${foundationPlan.resources.postgres
       treatMissingData: 'notBreaching',
     },
   );`
-            : `  const dashboard = new aws.cloudwatch.Dashboard('FoundationDashboard', {
+            : `  const dashboard = observability.dashboards === 'none' ? undefined : new aws.cloudwatch.Dashboard('FoundationDashboard', {
     dashboardName: 'ebk-' + $app.stage + '-foundation',
-    dashboardBody: JSON.stringify({ widgets: [{
-      type: 'text', x: 0, y: 0, width: 24, height: 3,
-      properties: { markdown: '# Empire Builder Kit Foundation\\nStage: ' + $app.stage + '\\nPersistence: Slice-scoped DynamoDB; SQL not declared.' },
-    }] }),
+    dashboardBody: router.distributionID.apply((distributionId: string) => JSON.stringify({ widgets: [{
+      type: 'metric', x: 0, y: 0, width: 24, height: 6,
+      properties: {
+        title: 'Router requests and errors', region: 'us-east-1', period: 300,
+        metrics: [
+          ['AWS/CloudFront', 'Requests', 'DistributionId', distributionId, 'Region', 'Global', { stat: 'Sum' }],
+          ['AWS/CloudFront', '5xxErrorRate', 'DistributionId', distributionId, 'Region', 'Global', { stat: 'Average', yAxis: 'right' }],
+        ],
+      },
+    }] })),
   });`}
 
   if (new Set(['development', 'staging', 'production']).has($app.stage)) {
@@ -8879,7 +8964,7 @@ ${foundationPlan.resources.containerCompute ? '    clusterId: cluster.id,' : ''}
     contractVersion: '${foundationPlan.descriptor.contractVersion}',
     costAnomalySubscriptionArn: accountCostAnomalySubscription?.arn,
 ${foundationPlan.resources.postgres ? '    databaseCapacityAlarmName: databaseCapacityAlarm.name,' : ''}
-    dashboardName: dashboard.dashboardName,
+    dashboardName: dashboard?.dashboardName,
 ${foundationPlan.resources.postgres
             ? `    databaseClusterId: database.id,
     databaseEventSubscriptionId: databaseEvents?.id,`