@empire-builder-kit/nx 1.0.0-rc.44 → 1.0.0-rc.46

package/src/generators/upgrade/upgrade.js

@@ -11,7 +11,9 @@ exports.upgradeGenerator = upgradeGenerator;
 const deterministic_order_js_1 = require("../../deterministic-order.js");
 const capacity_migration_js_1 = require("../../repository-policy/capacity-migration.js");
 const dependency_overrides_js_1 = require("../preset/dependency-overrides.js");
+const observability_js_1 = require("../../foundation/observability.js");
 const workspace_files_adopter_skills_js_1 = require("../preset/workspace-files-adopter-skills.js");
+const observability_policy_js_1 = require("../observability-policy.js");
 const sql_seeded_reconciliation_js_1 = require("./sql-seeded-reconciliation.js");
 const devkit_1 = require("@nx/devkit");
 const node_buffer_1 = require("node:buffer");
@@ -25,7 +27,8 @@ const index_js_2 = require("../../api-contract/index.js");
 const index_js_3 = require("../../foundation/index.js");
 const capability_plan_js_1 = require("../../foundation/capability-plan.js");
 const persistence_contract_js_1 = require("../slice/persistence-contract.js");
-const index_js_4 = require("../../ownership/index.js");
+const index_js_4 = require("../../repository-policy/index.js");
+const index_js_5 = require("../../ownership/index.js");
 const function_js_1 = require("../function/function.js");
 const logging_registry_js_1 = require("../logging-registry.js");
 const feature_registry_js_1 = require("../feature-registry.js");
@@ -380,6 +383,15 @@ const SEEDED_RECONCILIATION = {
             'journey-authority',
         ],
     },
+    'reliability/metric-declarations.ts': {
+        category: 'reliability-metrics',
+        guidance: 'Review existing custom recordReliabilityOperation calls and declare each finite deployment-owned component/feature/operation tuple in reliability/metric-declarations.ts. Undeclared custom series are dropped by the managed recorder. Never derive declarations from request, user, resource, or correlation IDs. Preserve existing declarations, verify custom metric emission, retain evidence, and resolve the seeded reconciliation marker before protected promotion.',
+        implications: [
+            'custom-metric-series-allowlist',
+            'finite-deployment-owned-dimensions',
+            'undeclared-custom-series-are-dropped',
+        ],
+    },
     'secrets/declarations.ts': {
         category: 'secret-contract',
         implications: [
@@ -458,6 +470,89 @@ function appendSeededReconciliationMarker(tree, root, report) {
         return;
     tree.write(anchor, `${current.replace(/\s*$/, '')}\n\n${SEEDED_RECONCILIATION_MARKER}\n`);
 }
+function isJsonObject(value) {
+    return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+function appendServiceTaskPresenceReconciliation(currentFiles, currentOwnership, targetOwnership, report) {
+    const services = currentOwnership.compositions
+        .filter(({ kind }) => kind === 'service')
+        .map(({ name }) => name)
+        .sort(deterministic_order_js_1.compareUtf16);
+    if (services.length === 0)
+        return;
+    const registryPath = 'operations/reliability.json';
+    const source = currentFiles.get(registryPath);
+    if (source === null || source === undefined)
+        return;
+    let operations;
+    try {
+        operations = JSON.parse(source);
+    }
+    catch {
+        throw new Error('Retained Service reliability registry must be valid JSON before upgrade.');
+    }
+    if (!isJsonObject(operations) ||
+        !Array.isArray(operations.deployedAlarmResources)) {
+        throw new Error('Retained Service reliability registry must expose deployedAlarmResources before upgrade.');
+    }
+    const resources = operations.deployedAlarmResources;
+    const append = (path, guidance) => {
+        const current = currentFiles.get(path);
+        const targetEntry = targetOwnership.paths.find((entry) => entry.path === path);
+        const currentEntry = currentOwnership.paths.find((entry) => entry.path === path);
+        if (current === null ||
+            current === undefined ||
+            targetEntry?.mode !== 'seeded')
+            return;
+        const existing = report.seededReconciliation.find((entry) => entry.path === path);
+        if (existing) {
+            existing.guidance = `${existing.guidance ? `${existing.guidance}\n\n` : ''}${guidance}`;
+            existing.implications = [
+                ...new Set([...existing.implications, 'service-live-task-presence']),
+            ].sort(deterministic_order_js_1.compareUtf16);
+            return;
+        }
+        report.seededReconciliation.push({
+            adopterContentSha256: (0, index_js_5.hashOwnedContent)(current, currentEntry ?? targetEntry),
+            category: 'reliability-operations',
+            currentFrameworkSha256: currentEntry?.sha256 ?? null,
+            guidance,
+            implications: ['alarm-registration', 'service-live-task-presence'],
+            markerReference: SEEDED_RECONCILIATION_MARKER_REFERENCE,
+            path,
+            requiredAction: 'review-and-reconcile-preserving-adopter-content',
+            targetFrameworkSha256: targetEntry.sha256,
+        });
+    };
+    for (const name of services) {
+        const id = `service-${name}-health`;
+        const legacy = resources.some((entry) => {
+            if (!isJsonObject(entry))
+                return false;
+            const expected = {
+                comparisonOperator: 'LessThanThreshold',
+                evaluationPeriods: 1,
+                id,
+                metricName: 'RunningTaskCount',
+                name: `${currentOwnership.slice}-{stage}-service-${name}-running`,
+                namespace: 'ECS/ContainerInsights',
+                period: 60,
+                signal: 'metric',
+                statistic: 'Sum',
+                threshold: 1,
+                treatMissingData: 'breaching',
+            };
+            return (Object.entries(expected).every(([key, value]) => entry[key] === value) &&
+                JSON.stringify(entry.dimensionNames) ===
+                    JSON.stringify(['ClusterName', 'ServiceName']));
+        });
+        if (!legacy)
+            continue;
+        append(registryPath, `For recorded Service ${name}, reconcile only deployedAlarmResources[id=${id}]: namespace ECS/ContainerInsights -> AWS/ECS, metricName RunningTaskCount -> LiveTaskCount, statistic Sum -> Minimum. Keep its ID, physical name, actions, dimensions, threshold 1, LessThanThreshold, 60-second period, one evaluation period and breaching missing-data policy. In alarmRegistrations[id=${id}], set missingData to breaching and review businessSymptom, condition and both expected risk fields for task presence or missing telemetry, startup/emission-gap false positives, and activating/draining/replacement crash-loop false negatives. Preserve unrelated registrations and every adopter-owned field. Review services/${name}/RUNBOOK.md, run the declared reliability verification after authorized deployment, retain evidence, then resolve the existing seeded reconciliation marker.`);
+        append(`services/${name}/RUNBOOK.md`, `Review the retained Service ${name} runbook for AWS/ECS LiveTaskCount Minimum: ACTIVATING, RUNNING and DEACTIVATING task presence, not readiness. Missing telemetry breaches but does not prove zero tasks. Document startup/emission-gap false positives and activating/draining/replacement crash-loop false negatives, preserve custom recovery instructions, verify the critical journey and alarm recovery after an authorized roll-forward, retain evidence, then resolve the existing seeded reconciliation marker.`);
+    }
+    report.seededReconciliation.sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.path, right.path));
+}
 function currentContractConsumers(tree, root) {
     const source = tree.read(node_path_1.posix.join(root, 'contracts/dependencies.json'), 'utf8');
     if (source === null)
@@ -667,7 +762,7 @@ function preserveBuiltInDerivedApiArtifacts(tree, root, currentOwnership, target
         entry?.mode === 'managed' &&
         entry.origin === 'blueprint' &&
         entry.managedJsonPointers === undefined &&
-        (0, index_js_4.hashOwnedContent)(current, entry) === entry.sha256);
+        (0, index_js_5.hashOwnedContent)(current, entry) === entry.sha256);
     if (!completeCleanPair)
         return targetFiles;
     const retained = { ...targetFiles };
@@ -821,16 +916,17 @@ function ownershipValidationMessage(label, issues) {
 }
 function requireUpgradePrerequisites(tree, target) {
     const installedVersion = (0, generator_js_1.frameworkPackageVersion)();
-    const workspaceResult = (0, index_js_4.validateWorkspaceOwnershipRecord)(readJson(tree, '.ebk/ownership.json', 'Workspace ownership metadata'));
+    const workspaceResult = (0, index_js_5.validateWorkspaceOwnershipRecord)(readJson(tree, '.ebk/ownership.json', 'Workspace ownership metadata'));
     if (!workspaceResult.valid) {
         throw new Error(ownershipValidationMessage('Workspace ownership metadata', workspaceResult.issues));
     }
     if (workspaceResult.value.frameworkVersion !== installedVersion) {
         throw new Error(`Workspace tooling is recorded at ${workspaceResult.value.frameworkVersion}, but the installed @empire-builder-kit/nx version is ${installedVersion}. Report and apply the workspace upgrade before upgrading the ${target === 'foundation' ? 'Standard Foundation' : 'Product Slice'}.`);
     }
+    (0, observability_policy_js_1.requireObservabilityPolicyFromTree)(tree);
     if (target === 'foundation')
         return;
-    const foundationResult = (0, index_js_4.validateFoundationOwnershipRecord)(readJson(tree, 'packages/foundation/.ebk/ownership.json', 'Standard Foundation ownership metadata'));
+    const foundationResult = (0, index_js_5.validateFoundationOwnershipRecord)(readJson(tree, 'packages/foundation/.ebk/ownership.json', 'Standard Foundation ownership metadata'));
     if (!foundationResult.valid) {
         throw new Error(ownershipValidationMessage('Standard Foundation ownership metadata', foundationResult.issues));
     }
@@ -959,21 +1055,29 @@ function createUpgradeReport(currentFiles, currentOwnership, targetFiles, target
                 path.startsWith('database/migrations/')) {
                 report.incompatibleSeededMigrations.push(path);
             }
-            else if (current !== null &&
-                currentEntry?.sha256 !== targetSha256 &&
+            else if (((current !== null && currentEntry?.sha256 !== targetSha256) ||
+                (current === null &&
+                    path === 'reliability/metric-declarations.ts')) &&
                 seededReconciliationDefinition(path) !== null) {
                 const reconciliation = seededReconciliationDefinition(path);
                 if (reconciliation === null) {
                     throw new Error(`Missing seeded reconciliation definition for ${path}.`);
                 }
                 report.seededReconciliation.push({
-                    adopterContentSha256: (0, index_js_4.hashOwnedContent)(current, currentEntry ?? targetEntry),
+                    adopterContentSha256: current === null
+                        ? null
+                        : (0, index_js_5.hashOwnedContent)(current, currentEntry ?? targetEntry),
                     category: reconciliation.category,
                     currentFrameworkSha256: currentEntry?.sha256 ?? null,
+                    ...('guidance' in reconciliation
+                        ? { guidance: reconciliation.guidance }
+                        : {}),
                     implications: [...reconciliation.implications],
                     markerReference: SEEDED_RECONCILIATION_MARKER_REFERENCE,
                     path,
-                    requiredAction: 'review-and-reconcile-preserving-adopter-content',
+                    requiredAction: current === null
+                        ? 'declare-existing-custom-metric-series-before-promotion'
+                        : 'review-and-reconcile-preserving-adopter-content',
                     targetFrameworkSha256: targetSha256,
                 });
             }
@@ -982,7 +1086,7 @@ function createUpgradeReport(currentFiles, currentOwnership, targetFiles, target
             report.missing.push(path);
         }
         else if (currentEntry !== undefined &&
-            (0, index_js_4.hashOwnedContent)(current, currentEntry) !== currentEntry.sha256) {
+            (0, index_js_5.hashOwnedContent)(current, currentEntry) !== currentEntry.sha256) {
             report.conflicting.push(path);
         }
         else if (current === target) {
@@ -1005,7 +1109,7 @@ function createUpgradeReport(currentFiles, currentOwnership, targetFiles, target
         const current = currentFiles.get(path) ?? null;
         if (current === null)
             continue;
-        if ((0, index_js_4.hashOwnedContent)(current, entry) === sha256) {
+        if ((0, index_js_5.hashOwnedContent)(current, entry) === sha256) {
             report.obsolete.push(path);
         }
         else if (!report.conflicting.includes(path)) {
@@ -1060,7 +1164,7 @@ function mergeStructuredTargetFiles(currentFiles, currentOwnership, targetFiles,
         if (!targetEntry.managedJsonPointers)
             continue;
         if (currentEntry?.managedJsonPointers) {
-            const transition = (0, index_js_4.analyzeManagedJsonPointerTransition)(current, target, currentEntry.managedJsonPointers, targetEntry.managedJsonPointers);
+            const transition = (0, index_js_5.analyzeManagedJsonPointerTransition)(current, target, currentEntry.managedJsonPointers, targetEntry.managedJsonPointers);
             changes.claimedJsonMembers.push(...transition.claimed.map((pointer) => `${targetEntry.path}#${pointer}`));
             changes.conflictingJsonMembers.push(...transition.conflictingClaims.map((pointer) => `${targetEntry.path}#${pointer}`));
             changes.releasedJsonMembers.push(...transition.released.map((pointer) => `${targetEntry.path}#${pointer}`));
@@ -1069,7 +1173,7 @@ function mergeStructuredTargetFiles(currentFiles, currentOwnership, targetFiles,
                 continue;
             }
         }
-        files.set(targetEntry.path, (0, index_js_4.mergeManagedJsonContents)(current, target, targetEntry.managedJsonPointers));
+        files.set(targetEntry.path, (0, index_js_5.mergeManagedJsonContents)(current, target, targetEntry.managedJsonPointers));
     }
     return { files, ...changes };
 }
@@ -1089,7 +1193,7 @@ async function formatMergedManagedJsonFiles(tree, root, merge, ownership) {
     }));
     return { ...merge, files };
 }
-function renderCompositionUpgradePlan(ownership, workspace, runtimeVersion, serviceAdapterOwner) {
+function renderCompositionUpgradePlan(ownership, workspace, runtimeVersion, serviceAdapterOwner, deploymentProfile) {
     const compositionPaths = ownership.paths.filter(({ origin }) => origin === 'composition');
     const files = {};
     const paths = new Map();
@@ -1107,7 +1211,7 @@ function renderCompositionUpgradePlan(ownership, workspace, runtimeVersion, serv
                 mode: entry.mode ?? 'managed',
                 origin: 'composition',
                 path: entry.path,
-                sha256: (0, index_js_4.hashOwnedContent)(contents, entry),
+                sha256: (0, index_js_5.hashOwnedContent)(contents, entry),
             });
         }
     };
@@ -1118,7 +1222,7 @@ function renderCompositionUpgradePlan(ownership, workspace, runtimeVersion, serv
         }
         else {
             const plan = (0, workload_js_1.createWorkloadFilePlan)(workspace, ownership.slice, composition.name, composition.kind, runtimeVersion, composition.feature, composition.kind === 'service' &&
-                composition.name === serviceAdapterOwner);
+                composition.name === serviceAdapterOwner, [(0, index_js_4.productionRehearsalStage)(deploymentProfile), 'production']);
             addPlan(plan.files, plan.paths);
         }
     }
@@ -1251,7 +1355,7 @@ async function upgradeFoundation(tree, options, packageJson, output, foundationR
         throw new Error('Standard Foundation upgrades do not accept Blueprint or input options.');
     }
     const root = 'packages/foundation';
-    const ownershipResult = (0, index_js_4.validateFoundationOwnershipRecord)(readJson(tree, node_path_1.posix.join(root, '.ebk/ownership.json'), 'Standard Foundation ownership metadata'));
+    const ownershipResult = (0, index_js_5.validateFoundationOwnershipRecord)(readJson(tree, node_path_1.posix.join(root, '.ebk/ownership.json'), 'Standard Foundation ownership metadata'));
     if (!ownershipResult.valid) {
         throw new Error(ownershipValidationMessage('Standard Foundation ownership metadata', ownershipResult.issues));
     }
@@ -1271,7 +1375,7 @@ async function upgradeFoundation(tree, options, packageJson, output, foundationR
         ...renderedTarget,
         files: await formatRenderedFiles(tree, renderedTarget.files, root),
     };
-    const targetValidation = (0, index_js_4.validateFoundationOwnershipRecord)(target.ownership);
+    const targetValidation = (0, index_js_5.validateFoundationOwnershipRecord)(target.ownership);
     if (!targetValidation.valid) {
         throw new Error(`Target Standard Foundation ownership metadata is invalid:\n${targetValidation.issues
             .map((issue) => `- ${issue.path}: ${issue.message}`)
@@ -1312,7 +1416,7 @@ async function upgradeFoundation(tree, options, packageJson, output, foundationR
         }
         tree.write(node_path_1.posix.join(root, path), contents);
     }
-    (0, index_js_4.restampFoundationOwnership)(tree);
+    (0, index_js_5.restampFoundationOwnership)(tree);
     // Ownership bytes are part of the upgrade result, including agent previews
     // that skip workspace formatting. Canonicalize before binding those bytes.
     await formatOwnershipRecord(tree, node_path_1.posix.join(root, '.ebk/ownership.json'), 'Standard Foundation');
@@ -1339,7 +1443,7 @@ async function upgradeWorkspace(tree, options, packageJson, output) {
     if (options.blueprint !== undefined || options.inputs !== undefined) {
         throw new Error('Workspace upgrades do not accept Blueprint or input options.');
     }
-    const ownershipResult = (0, index_js_4.validateWorkspaceOwnershipRecord)(readJson(tree, '.ebk/ownership.json', 'Workspace ownership metadata'));
+    const ownershipResult = (0, index_js_5.validateWorkspaceOwnershipRecord)(readJson(tree, '.ebk/ownership.json', 'Workspace ownership metadata'));
     if (!ownershipResult.valid) {
         throw new Error(ownershipValidationMessage('Workspace ownership metadata', ownershipResult.issues));
     }
@@ -1354,6 +1458,9 @@ async function upgradeWorkspace(tree, options, packageJson, output) {
         dependencyOverrides: tree.exists(dependency_overrides_js_1.DEPENDENCY_OVERRIDES_PATH)
             ? readJson(tree, dependency_overrides_js_1.DEPENDENCY_OVERRIDES_PATH, 'Dependency overrides')
             : undefined,
+        observabilityPolicy: tree.exists(observability_js_1.OBSERVABILITY_POLICY_PATH)
+            ? readJson(tree, observability_js_1.OBSERVABILITY_POLICY_PATH, 'Observability policy')
+            : (0, observability_js_1.defaultObservabilityPolicy)((0, index_js_4.activeDeploymentStages)(deployment.deploymentProfile ?? 'starter'), { preserveLegacy: true }),
         frameworkVersion: (0, generator_js_1.frameworkPackageVersion)(),
         name: packageJson.name,
     });
@@ -1361,7 +1468,7 @@ async function upgradeWorkspace(tree, options, packageJson, output) {
         ...renderedTarget,
         files: await formatRenderedFiles(tree, renderedTarget.files),
     };
-    const targetValidation = (0, index_js_4.validateWorkspaceOwnershipRecord)(target.ownership);
+    const targetValidation = (0, index_js_5.validateWorkspaceOwnershipRecord)(target.ownership);
     if (!targetValidation.valid) {
         throw new Error('Target workspace ownership metadata is invalid.');
     }
@@ -1417,7 +1524,7 @@ async function upgradeWorkspace(tree, options, packageJson, output) {
     if (developerAgentInstructionAppend !== null) {
         tree.write(developerAgentInstructionAppend.path, developerAgentInstructionAppend.contents);
     }
-    (0, index_js_4.restampWorkspaceOwnership)(tree);
+    (0, index_js_5.restampWorkspaceOwnership)(tree);
     await formatOwnershipRecord(tree, '.ebk/ownership.json', 'Workspace');
 }
 async function executeUpgradeGenerator(tree, options, output = devkit_1.logger, executionOptions = {}) {
@@ -1445,7 +1552,7 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
             if (recorded?.blueprint
                 ?.name !== index_js_1.BUILTIN_BLUEPRINT_NAME)
                 continue;
-            const parsed = (0, index_js_4.validateGeneratedOwnershipRecord)(recorded);
+            const parsed = (0, index_js_5.validateGeneratedOwnershipRecord)(recorded);
             if (!parsed.valid)
                 throw new Error(ownershipValidationMessage('Product Slice ownership metadata', parsed.issues));
             (0, persistence_contract_js_1.standardPersistenceContract)({
@@ -1462,7 +1569,7 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
     }
     requireUpgradePrerequisites(tree, 'product-slice');
     const root = node_path_1.posix.join('packages', name);
-    const ownershipResult = (0, index_js_4.validateGeneratedOwnershipRecord)(readJson(tree, node_path_1.posix.join(root, '.ebk/ownership.json'), 'Product Slice ownership metadata'));
+    const ownershipResult = (0, index_js_5.validateGeneratedOwnershipRecord)(readJson(tree, node_path_1.posix.join(root, '.ebk/ownership.json'), 'Product Slice ownership metadata'));
     if (!ownershipResult.valid) {
         throw new Error(ownershipValidationMessage('Product Slice ownership metadata', ownershipResult.issues));
     }
@@ -1609,7 +1716,7 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
             mode,
             origin: 'blueprint',
             path,
-            sha256: (0, index_js_4.hashOwnedContent)(contents, { managedJsonPointers }),
+            sha256: (0, index_js_5.hashOwnedContent)(contents, { managedJsonPointers }),
         }));
         paths.sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.path, right.path));
         targetOwnership = {
@@ -1623,7 +1730,7 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
             inputs: inputResult.value,
             paths,
             projects: generated.projects,
-            schemaVersion: index_js_4.GENERATED_OWNERSHIP_SCHEMA_VERSION,
+            schemaVersion: index_js_5.GENERATED_OWNERSHIP_SCHEMA_VERSION,
             slice: name,
             verification: blueprint.manifest.verification,
         };
@@ -1648,7 +1755,7 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
         targetFiles = preserveBuiltInDerivedApiArtifacts(tree, root, currentOwnership, targetFiles);
     }
     const targetPathSet = new Set(targetOwnership.paths.map(({ path }) => path));
-    const compositionPlan = renderCompositionUpgradePlan(currentOwnership, packageJson.name ?? '', packageJson.dependencies?.['@empire-builder-kit/runtime'] ?? '', serviceAdapterOwner);
+    const compositionPlan = renderCompositionUpgradePlan(currentOwnership, packageJson.name ?? '', packageJson.dependencies?.['@empire-builder-kit/runtime'] ?? '', serviceAdapterOwner, (0, tree_policy_js_1.readRepositoryOperatingPolicyFromTree)(tree).deploymentProfile);
     const compositionPaths = compositionPlan.paths.filter(({ path }) => !targetPathSet.has(path));
     if (externalBlueprintDestinationPaths) {
         (0, index_js_1.assertBlueprintDestinationPaths)(tree.root, root, [
@@ -1677,7 +1784,7 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
             if (contents === undefined) {
                 throw new Error(`Target Blueprint did not render ${entry.path}.`);
             }
-            return { ...entry, sha256: (0, index_js_4.hashOwnedContent)(contents, entry) };
+            return { ...entry, sha256: (0, index_js_5.hashOwnedContent)(contents, entry) };
         }),
         projects: [
             ...new Set([...targetOwnership.projects, ...currentOwnership.projects]),
@@ -1687,7 +1794,7 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
         ...targetFiles,
         '.ebk/ownership.json': json(targetOwnership),
     };
-    const targetValidation = (0, index_js_4.validateGeneratedOwnershipRecord)(targetOwnership);
+    const targetValidation = (0, index_js_5.validateGeneratedOwnershipRecord)(targetOwnership);
     if (!targetValidation.valid) {
         throw new Error(`Target ownership metadata is invalid:\n${targetValidation.issues
             .map((issue) => `- ${issue.path}: ${issue.message}`)
@@ -1721,6 +1828,9 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
         mergedTarget.files.set(logging_registry_js_1.SLICE_LOGGING_REGISTRY_PATH, await (0, formatting_js_1.formatTreeContentsToFixedPoint)(loggingAppend, formatting, workspacePath));
     }
     const report = createUpgradeReport(currentFiles, currentOwnership, mergedTarget.files, targetOwnership, mergedTarget);
+    if (blueprint.source === 'built-in') {
+        appendServiceTaskPresenceReconciliation(currentFiles, currentOwnership, targetOwnership, report);
+    }
     if (loggingAppend !== null) {
         report.preservedSeeded = report.preservedSeeded.filter((path) => path !== logging_registry_js_1.SLICE_LOGGING_REGISTRY_PATH);
         report.appendedSeeded.push(logging_registry_js_1.SLICE_LOGGING_REGISTRY_PATH);
@@ -1774,7 +1884,7 @@ async function executeUpgradeGenerator(tree, options, output = devkit_1.logger,
             await (0, formatting_js_1.formatTreeFileToFixedPoint)(tree, path);
         }
     }
-    (0, index_js_4.restampProductSliceOwnership)(tree, name, { preserveSeeded: true });
+    (0, index_js_5.restampProductSliceOwnership)(tree, name, { preserveSeeded: true });
     await formatOwnershipRecord(tree, node_path_1.posix.join(root, '.ebk/ownership.json'), 'Product Slice');
     return options.skipInstall
         ? undefined

package/src/generators/workload/frozen-container.d.ts

@@ -1,4 +1,4 @@
-export declare const WORKLOAD_CONTAINER_NODE_IMAGE: "node:22-alpine@sha256:0a7108bf6c7bf5de370ffb1a3ed6be93d405b43ff159f681a8d18c0e2bc2e402";
+export declare const WORKLOAD_CONTAINER_NODE_IMAGE: "node:22-alpine@sha256:fe4f6d74e20370acb04ad889077d14d0f64a9c8ea6a42bc60cddf1e844699914";
 export declare const WORKLOAD_CONTAINER_PNPM_VERSION: "11.20.0";
 export declare const WORKLOAD_CONTAINER_PNPM_DESCRIPTOR: "pnpm@11.20.0+sha512.9a6f330a95b66446ea088faf1521405a8a01f07fde7124cc9958dfed52d4bb436737e65b08f85f37b46fcba375092558ac51262b816844b22f63406ed166bfee";
 export declare const WORKLOAD_CONTAINER_PNPM_STORE = "/workspace/.ebk/cache/pnpm-store";

package/src/generators/workload/reliability-registration.d.ts

@@ -3,7 +3,7 @@ export declare const WORKLOAD_RELIABILITY_REGISTRY_PATH: "operations/reliability
 export interface WorkloadReliabilityPlan {
     alarmId: string;
     contents: string;
-    metricName: 'MatchedEvents' | 'RunningTaskCount';
+    metricName: 'LiveTaskCount' | 'MatchedEvents';
     path: string;
     runbookRef: string;
 }

package/src/generators/workload/reliability-registration.js

@@ -61,21 +61,21 @@ function planWorkloadReliabilityRegistration(tree, input) {
         ...operations.alarmRegistrations,
         (0, reliability_1.validateAlarmRegistrationMetadata)({
             businessSymptom: input.kind === 'service'
-                ? `${input.name} Service health checks are failing.`
+                ? `${input.name} Service task presence is below one or telemetry is missing.`
                 : `${input.name} Job executions are failing.`,
             condition: input.kind === 'service'
-                ? 'The AWS-native ECS RunningTaskCount signal is below one or missing for the exact Service.'
+                ? 'The AWS/ECS LiveTaskCount minimum is below one or missing for the exact Service; it counts ACTIVATING, RUNNING, and DEACTIVATING tasks.'
                 : 'An AWS-native ECS task-state event reports an essential container exit for the exact Job task family.',
             dependencyAlarmIds: [],
             escalationRouteKey: `${input.slice}-on-call`,
             expectedFalseNegativeRisk: input.kind === 'service'
-                ? 'Container Insights delivery can be delayed; missing data is therefore treated as breaching.'
+                ? 'Activating, draining, or repeatedly replaced tasks can keep LiveTaskCount positive while readiness or useful work fails.'
                 : 'ECS task-state events are durable but can be delayed before EventBridge reports a match.',
             expectedFalsePositiveRisk: input.kind === 'service'
-                ? 'A synthetic health client can fail while the Service remains available.'
+                ? 'Metric emission gaps, startup, or lifecycle transitions can breach the missing-data policy while tasks remain present.'
                 : 'A retried Job attempt can fail before a later attempt succeeds.',
             id: alarmId,
-            missingData: 'missing',
+            missingData: input.kind === 'service' ? 'breaching' : 'missing',
             owner,
             runbookRef: `runbook:${runbookRef}`,
             severity: 'high',
@@ -90,15 +90,15 @@ function planWorkloadReliabilityRegistration(tree, input) {
         dimensionNames: input.kind === 'service' ? ['ClusterName', 'ServiceName'] : ['RuleName'],
         evaluationPeriods: 1,
         id: alarmId,
-        metricName: input.kind === 'service' ? 'RunningTaskCount' : 'MatchedEvents',
+        metricName: input.kind === 'service' ? 'LiveTaskCount' : 'MatchedEvents',
         name: `${input.slice}-{stage}-${input.kind}-${input.name}-${input.kind === 'service' ? 'running' : 'hard-crash'}`,
-        namespace: input.kind === 'service' ? 'ECS/ContainerInsights' : 'AWS/Events',
+        namespace: input.kind === 'service' ? 'AWS/ECS' : 'AWS/Events',
         owner,
         period: 60,
         route: `${input.slice}-on-call`,
         runbook: runbookRef,
         signal: 'metric',
-        statistic: 'Sum',
+        statistic: input.kind === 'service' ? 'Minimum' : 'Sum',
         threshold: 1,
         treatMissingData: input.kind === 'service' ? 'breaching' : 'notBreaching',
     };
@@ -142,7 +142,7 @@ function planWorkloadReliabilityRegistration(tree, input) {
     return {
         alarmId,
         contents: `${JSON.stringify(operations, null, 2)}\n`,
-        metricName: input.kind === 'service' ? 'RunningTaskCount' : 'MatchedEvents',
+        metricName: input.kind === 'service' ? 'LiveTaskCount' : 'MatchedEvents',
         path,
         runbookRef,
     };

package/src/generators/workload/workload.d.ts

@@ -13,5 +13,5 @@ export interface WorkloadFilePlan {
     }>;
     project: string;
 }
-export declare function createWorkloadFilePlan(workspace: string, slice: string, workload: string, kind: WorkloadKind, runtimeVersion: string, feature: string, ownsProtectedLoadAdapter: boolean, protectedRuntimeStages?: readonly ('development' | 'production' | 'staging')[]): WorkloadFilePlan;
+export declare function createWorkloadFilePlan(workspace: string, slice: string, workload: string, kind: WorkloadKind, runtimeVersion: string, feature: string, ownsProtectedLoadAdapter: boolean, protectedRuntimeStages: readonly ('development' | 'production' | 'staging')[]): WorkloadFilePlan;
 export declare function workloadGenerator(tree: Tree, options: WorkloadGeneratorSchema, kind: WorkloadKind): Promise<GeneratorCallback | void>;

package/src/generators/workload/workload.js

@@ -4,6 +4,8 @@ exports.SERVICE_WORKLOAD_PACKAGE_MANAGED_JSON_POINTERS = exports.WORKLOAD_PACKAG
 exports.createWorkloadFilePlan = createWorkloadFilePlan;
 exports.workloadGenerator = workloadGenerator;
 const deterministic_order_js_1 = require("../../deterministic-order.js");
+const observability_infrastructure_js_1 = require("../observability-infrastructure.js");
+const observability_policy_js_1 = require("../observability-policy.js");
 const node_path_1 = require("node:path");
 const index_js_1 = require("../../ownership/index.js");
 const capability_plan_js_1 = require("../../foundation/capability-plan.js");
@@ -137,7 +139,7 @@ exports.SERVICE_WORKLOAD_PACKAGE_MANAGED_JSON_POINTERS = [
     '/dependencies/@aws-sdk~1client-dynamodb',
     '/dependencies/sst',
 ];
-function createWorkloadFilePlan(workspace, slice, workload, kind, runtimeVersion, feature, ownsProtectedLoadAdapter, protectedRuntimeStages = ['staging', 'production']) {
+function createWorkloadFilePlan(workspace, slice, workload, kind, runtimeVersion, feature, ownsProtectedLoadAdapter, protectedRuntimeStages) {
     const plural = kind === 'service' ? 'services' : 'jobs';
     const relativeRoot = node_path_1.posix.join(plural, workload);
     const className = `${pascal(slice)}${pascal(workload)}${pascal(kind)}`;
@@ -159,7 +161,7 @@ function createWorkloadFilePlan(workspace, slice, workload, kind, runtimeVersion
             version: '0.0.0',
             scripts: {
                 build: 'tsc -p tsconfig.json',
-                'docker-build': `docker build -f packages/${slice}/${relativeRoot}/Dockerfile ` +
+                'docker-build': 'docker build -f Dockerfile ' +
                     `-t ${slice}-${kind}-${workload}:local ../../../..`,
                 dev: `node --experimental-strip-types ${kind === 'service' ? 'src/main.ts' : 'src/run.ts'}`,
                 lint: 'eslint .',
@@ -210,7 +212,7 @@ function createWorkloadFilePlan(workspace, slice, workload, kind, runtimeVersion
         [`${relativeRoot}/src/workload.spec.ts`]: kind === 'service'
             ? `import { describe, expect, it } from 'vitest';\nimport { healthResponse } from './main.js';\n\ndescribe('${workload} service', () => {\n  it('reports healthy only on the health endpoint', () => {\n    expect(healthResponse('/health')).toEqual({ body: { service: '${workload}', status: 'ok' }, status: 200 });\n    expect(healthResponse('/missing').status).toBe(404);\n  });\n});\n`
             : `import { createLogger, type LogEntry } from '@empire-builder-kit/runtime/logging';\nimport { describe, expect, it } from 'vitest';\nimport { run } from './run.js';\n\ndescribe('${workload} job', () => {\n  it('emits canonical start and completion records', async () => {\n    const entries: LogEntry[] = [];\n    const logger = createLogger({\n      component: 'job-${workload}', feature: '${feature}', operation: 'run',\n      slice: '${slice}', stage: 'test', workspace: '${workspace}',\n      sink: (entry) => entries.push(entry as LogEntry),\n    });\n    await expect(run(logger)).resolves.toEqual({\n      ok: true,\n      providerDeliveryAssigned: false,\n    });\n    expect(entries.map(({ message, outcome }) => ({ message, outcome }))).toEqual([\n      { message: '${workload} job started', outcome: undefined },\n      { message: '${workload} job completed', outcome: 'success' },\n    ]);\n  });\n});\n`,
-        [`${relativeRoot}/infra.ts`]: `import { createManagedLogGroupContract } from '@empire-builder-kit/nx/foundation';\nimport { standardSliceExtensionTaskFamily } from '../../infra/workload-roles/effective-intent.js';\n\nexport function ${factoryName}(\n  cluster: any,\n  alertTopicArn: any,\n  roles?: { executionRole: string; taskRole: string },\n  links: any[] = [],\n  configuration?: {\n    applicationId: any;\n    deployment: any;\n    environmentId: any;\n    profileId: any;\n  },\n) {\n  const contract = createManagedLogGroupContract({\n    component: '${kind}-${workload}',\n    slice: '${slice}',\n    stage: $app.stage,\n    workspace: '${workspace}',\n  });\n  const workload = new sst.aws.${resource}('${className}', {\n    ...(roles ?? {}),\n    cluster,\n    environment: {\n      EBK_STAGE: $app.stage,\n      ...(configuration\n        ? {\n            EBK_APPCONFIG_APPLICATION_ID: configuration.applicationId,\n            EBK_APPCONFIG_ENVIRONMENT_ID: configuration.environmentId,\n            EBK_APPCONFIG_PROFILE_ID: configuration.profileId,\n          }\n        : {}),\n    },\n    link: links,\n    ${kind === 'service' ? "image: { context: './services/" + workload + "', dockerfile: 'Dockerfile' },\n    health: { command: ['CMD-SHELL', 'wget -qO- http://localhost:3000/health || exit 1'] },\n    logging: { name: contract.name, retention: '1 month' },\n    serviceRegistry: { port: 3000 }," : "image: { context: './jobs/" + workload + "', dockerfile: 'Dockerfile' },\n    logging: { name: contract.name, retention: '1 month' },"}\n    transform: {\n      logGroup: {\n        logGroupClass: contract.logGroupClass,\n        tags: contract.tags,\n      },\n      taskDefinition: {\n        family: standardSliceExtensionTaskFamily(\n          $app.stage,\n          '${workload}',\n          '${kind}',\n        ),\n      },\n    },\n  }, configuration?.deployment\n    ? { dependsOn: [configuration.deployment] }\n    : {});\n  const dataProtection = new aws.cloudwatch.LogDataProtectionPolicy(\n    '${className}LogDataProtection',\n    {\n      logGroupName: contract.name,\n      policyDocument: JSON.stringify(contract.dataProtectionPolicy),\n    },\n    { dependsOn: [workload.nodes.taskDefinition] },\n  );\n  const dataProtectionAlarm = new aws.cloudwatch.MetricAlarm(\n    '${className}LogDataProtectionFindings',\n    {\n      alarmActions: [alertTopicArn],\n      comparisonOperator: 'GreaterThanOrEqualToThreshold',\n      dimensions: { LogGroupName: contract.name },\n      evaluationPeriods: 1,\n      metricName: 'LogEventsWithFindings',\n      namespace: 'AWS/Logs',\n      period: 300,\n      statistic: 'Sum',\n      threshold: 1,\n      treatMissingData: 'notBreaching',\n    },\n    { dependsOn: [dataProtection] },\n  );\n  void dataProtectionAlarm;\n  return workload;\n}\n`,
+        [`${relativeRoot}/infra.ts`]: `import { createManagedLogGroupContract } from '@empire-builder-kit/nx/foundation';\nimport { standardSliceExtensionTaskFamily } from '../../infra/workload-roles/effective-intent.js';\n\nexport function ${factoryName}(\n  cluster: any,\n  alertTopicArn: any,\n  roles?: { executionRole: string; taskRole: string },\n  links: any[] = [],\n  configuration?: {\n    applicationId: any;\n    deployment: any;\n    environmentId: any;\n    profileId: any;\n  },\n) {\n  const contract = createManagedLogGroupContract({\n    component: '${kind}-${workload}',\n    slice: '${slice}',\n    stage: $app.stage,\n    workspace: '${workspace}',\n  });\n  const workload = new sst.aws.${resource}('${className}', {\n    ...(roles ?? {}),\n    cluster,\n    environment: {\n      EBK_STAGE: $app.stage,\n      ...(configuration\n        ? {\n            EBK_APPCONFIG_APPLICATION_ID: configuration.applicationId,\n            EBK_APPCONFIG_ENVIRONMENT_ID: configuration.environmentId,\n            EBK_APPCONFIG_PROFILE_ID: configuration.profileId,\n          }\n        : {}),\n    },\n    link: links,\n    ${kind === 'service' ? "image: { context: './services/" + workload + "', dockerfile: 'Dockerfile' },\n    health: { command: ['CMD-SHELL', 'wget -qO- http://localhost:3000/health || exit 1'] },\n    logging: { name: contract.name, retention: '1 month' },\n    serviceRegistry: { port: 3000 }," : "image: { context: './jobs/" + workload + "', dockerfile: 'Dockerfile' },\n    logging: { name: contract.name, retention: '1 month' },"}\n    transform: {\n      logGroup: {\n        logGroupClass: contract.logGroupClass,\n        tags: contract.tags,\n      },\n      taskDefinition: {\n        family: standardSliceExtensionTaskFamily(\n          $app.stage,\n          '${workload}',\n          '${kind}',\n        ),\n      },\n    },\n  }, configuration?.deployment\n    ? { dependsOn: [configuration.deployment] }\n    : {});\n${kind === 'service' ? '  if ($dev) return workload;\n' : ''}  const dataProtection = new aws.cloudwatch.LogDataProtectionPolicy(\n    '${className}LogDataProtection',\n    {\n      logGroupName: contract.name,\n      policyDocument: JSON.stringify(contract.dataProtectionPolicy),\n    },\n    { dependsOn: [workload.nodes.taskDefinition] },\n  );\n  const dataProtectionAlarm = new aws.cloudwatch.MetricAlarm(\n    '${className}LogDataProtectionFindings',\n    {\n      alarmActions: [alertTopicArn],\n      comparisonOperator: 'GreaterThanOrEqualToThreshold',\n      dimensions: { LogGroupName: contract.name },\n      evaluationPeriods: 1,\n      metricName: 'LogEventsWithFindings',\n      namespace: 'AWS/Logs',\n      period: 300,\n      statistic: 'Sum',\n      threshold: 1,\n      treatMissingData: 'notBreaching',\n    },\n    { dependsOn: [dataProtection] },\n  );\n  void dataProtectionAlarm;\n  return workload;\n}\n`,
     };
     if (kind === 'service') {
         const serviceMainPath = `${relativeRoot}/src/main.ts`;
@@ -411,7 +413,7 @@ ${kind !== 'service' || ownsProtectedLoadAdapter
       alarmDescription: JSON.stringify({
         businessSymptom:
           '${kind === 'service'
-        ? `${workload} Service has no running task.`
+        ? `${workload} Service task presence is below one or telemetry is missing.`
         : `${workload} Job essential container exited.`}',
         id: '${kind === 'service'
         ? `service-${workload}-health`
@@ -426,14 +428,14 @@ ${kind !== 'service' || ownsProtectedLoadAdapter
         ? 'LessThanThreshold'
         : 'GreaterThanOrEqualToThreshold'}',
       dimensions: ${kind === 'service'
-        ? `{ ClusterName: cluster.name, ServiceName: workload.name }`
+        ? `{ ClusterName: cluster.nodes.cluster.name, ServiceName: workload.nodes.service.name }`
         : `{ RuleName: reliabilityTaskStopped.name }`},
       evaluationPeriods: 1,
-      metricName: '${kind === 'service' ? 'RunningTaskCount' : 'MatchedEvents'}',
+      metricName: '${kind === 'service' ? 'LiveTaskCount' : 'MatchedEvents'}',
       name: '${slice}-' + $app.stage + '-${kind}-${workload}-${kind === 'service' ? 'running' : 'hard-crash'}',
-      namespace: '${kind === 'service' ? 'ECS/ContainerInsights' : 'AWS/Events'}',
+      namespace: '${kind === 'service' ? 'AWS/ECS' : 'AWS/Events'}',
       period: 60,
-      statistic: 'Sum',
+      statistic: '${kind === 'service' ? 'Minimum' : 'Sum'}',
       tags: standardTags,
       threshold: 1,
       treatMissingData: '${kind === 'service' ? 'breaching' : 'notBreaching'}',
@@ -539,7 +541,8 @@ ${kind !== 'service' || ownsProtectedLoadAdapter
   }
   const dataProtection = new aws.cloudwatch.LogDataProtectionPolicy(`);
     }
-    files[infrastructurePath] = infrastructureSource;
+    files[infrastructurePath] =
+        (0, observability_infrastructure_js_1.renderExtensionObservability)(infrastructureSource);
     files[`${relativeRoot}/RUNBOOK.md`] = `# ${workload} ${kind} recovery
 
 Confirm the exact Slice, stage, release, configuration, alarm, and workload
@@ -548,7 +551,25 @@ through the read-only diagnostic path. Do not restart, scale, retry, or replace
 protected resources without the named approval.
 
 ${kind === 'service'
-        ? 'Prefer a verified roll-forward; verify readiness, dependency protection, and the critical Service journey after recovery.'
+        ? `The native AWS/ECS LiveTaskCount alarm uses Minimum over 60 seconds and
+counts tasks in ACTIVATING, RUNNING, and DEACTIVATING states. It breaches below
+one or when telemetry is missing. ECS can emit no metrics when there are no
+RUNNING tasks; missing telemetry is actionable but does not prove zero tasks.
+
+Startup, emission gaps, and lifecycle transitions can cause false positives.
+Activating, draining, or repeatedly replaced tasks can keep the count positive
+while readiness or useful work fails. ALARM is not a diagnosis. OK does not
+prove readiness, freedom from crash loops, or successful business traffic.
+
+Inspect ECS events, task states and exit reasons, the existing container health
+check, and the Slice API health and burn alarms. Do not infer that every Service
+has a load-balancer readiness alarm. Prefer a verified roll-forward; verify
+stable tasks, readiness, dependency protection, and the critical Service journey
+after recovery, then confirm telemetry and alarm recovery.
+
+LiveTaskCount adds no metric collection charge and needs no Container Insights
+opt-in. Existing alarm, compute, log, and request charges still apply; this is
+not a measured account-cost claim.`
         : 'Preserve idempotency and checkpoint state; verify the business deadline and postconditions before retrying or declaring recovery.'}
 `;
     files[`${relativeRoot}/src/reliability.ts`] = `import {
@@ -1038,6 +1059,7 @@ async function executeWorkloadGenerator(tree, options, kind) {
     const slice = name(options.slice, 'Product Slice name');
     const workload = name(options.name, kind === 'service' ? 'Service name' : 'Job name');
     const requestedFeature = name(options.feature, 'Feature');
+    (0, observability_policy_js_1.requireObservabilityPolicyFromTree)(tree);
     const plural = kind === 'service' ? 'services' : 'jobs';
     const sliceRoot = node_path_1.posix.join('packages', slice);
     const root = node_path_1.posix.join(sliceRoot, plural, workload);

package/src/git-policy/github-bootstrap.d.ts

@@ -72,5 +72,23 @@ export interface GitHubRepositoryIdentity {
     repositoryId: string;
     subjectPrefix: string;
 }
+export interface FrameworkNpmStableBootstrapOptions {
+    npmStable: true;
+    apiBaseUrl?: string;
+    apply?: boolean;
+    repository: string;
+    token: string;
+    npmStableReviewerIds: number[];
+    npmStablePreventSelfReview: boolean;
+}
+export interface FrameworkNpmStableBootstrapReport {
+    kind: 'framework-npm-stable';
+    repository: string;
+    ready: boolean;
+    blockers: string[];
+    changes: string[];
+    warnings: string[];
+}
+export declare function runGitHubBootstrap(options: FrameworkNpmStableBootstrapOptions): Promise<FrameworkNpmStableBootstrapReport>;
 export declare function runGitHubBootstrap(options: GitHubBootstrapOptions): Promise<GitHubBootstrapReport>;
 export {};