diff --git a/.changeset/delegated-release-client.md b/.changeset/delegated-release-client.md
index 93788ea9c7..f5f52c4a54 100644
--- a/.changeset/delegated-release-client.md
+++ b/.changeset/delegated-release-client.md
@@ -3,8 +3,14 @@
 "@emdash-cms/plugin-cli": minor
 ---
 
-Adds typed clients for the experimental delegated release service. `ReleaseServiceClient` submits, polls, and cancels GitHub OpenID Connect release intents, and manages publisher workload policies and retained delegation through a publisher session. `ReleaseServiceOperatorClient` exposes the Cloudflare Access status, sharded publisher and approver inventory, pause, suspension, revocation, cancellation, reconciliation, resumable encryption-key rotation, Workflow-backed encrypted R2 archive, and fail-safe publisher restore and abort operations.
+Adds typed clients for the experimental delegated release service. `ReleaseServiceClient` submits, polls, and cancels GitHub OpenID Connect release intents; manages publisher workload policies and retained delegation; and lets publishers check whether profile-listed approvers have an active passkey and inspect publisher-scoped audit events through a publisher session. `ReleaseServiceOperatorClient` exposes the Cloudflare Access status and sanitized audit, sharded publisher and approver inventory, pause, suspension, revocation, cancellation, reconciliation, resumable encryption-key rotation, Workflow-backed fleet verification, audited key retirement, encrypted R2 archive, and fail-safe publisher restore and abort operations.
+
+`ReleaseServiceClient` can also create, inspect, claim, and confirm short-lived GitHub workflow pairings. A pairing records GitHub's signed repository, workflow, ref, and environment as a proposal. The publisher must confirm those details in the browser before the service creates a workload policy.
 
 Both clients validate response envelopes and return stable `ReleaseServiceError` codes with retry metadata. Mutation helpers require idempotency keys, and workload polling requests a fresh token from the configured provider for each call.
 
-The plugin CLI adds `emdash-plugin release submit`, `release status`, and `release cancel` for GitHub Actions jobs. The commands request audience-bound OIDC tokens from the runner, support JSON output, and use the GitHub run identity as the default idempotency key.
+The plugin CLI adds `emdash-plugin release connect`, `release dry-run`, `release submit`, `release status`, and `release cancel` for GitHub Actions jobs. `release connect` supplies the workflow's signed GitHub identity to a short-lived pairing created in the account dashboard. Dry-run verifies workload admission without creating an intent, consuming rate budget, or reserving a version. The commands request audience-bound OIDC tokens from the runner, support JSON output, and use the GitHub run identity as the default idempotency key where a mutation occurs.
+
+Delegated submissions use a URL-source release record: each package or listing-image artifact supplies a checksum-bound HTTPS URL and no blob. The service stages and uploads those bytes through the publisher's delegation, then creates a blob-only release record. Submit and dry-run reject mixed or blob-backed source inputs before requesting GitHub OIDC.
+
+Interactive `release delegate`, `revoke`, `workload`, `enrol`, `approve`, and `reject` commands print validated browser handoffs. Publisher application sessions, OAuth credentials, and passkey assertions remain at the release-service origin instead of entering the terminal process.
diff --git a/.changeset/swift-verifiers-match.md b/.changeset/swift-verifiers-match.md
index 4c9fb0a459..5c33420e08 100644
--- a/.changeset/swift-verifiers-match.md
+++ b/.changeset/swift-verifiers-match.md
@@ -7,3 +7,7 @@ Adds optional artifact digest candidates to `GitHubProvenanceVerifier`, allowing
 Existing callers can continue passing only `artifactDigest`. Successful results return the candidate that matched the signed subject.
 
 Fixes `@emdash-cms/registry-verification` when it is rebundled into an Astro Cloudflare application, preventing requests from failing during Worker startup.
+
+Adds `@emdash-cms/registry-verification/records` for Worker callers that supply an explicit `ProvenanceVerifier`. The runtime-neutral entry does not load the Node-oriented default Sigstore verifier, while the package root keeps the existing default-verifier behavior.
+
+Fixes `@emdash-cms/registry-verification` when it is rebundled into an Astro Cloudflare application, preventing requests from failing during Worker startup.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index d822b9335e..b0aa7e537b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -32,6 +32,13 @@ jobs:
       - run: pnpm run --filter emdash-demo --filter @emdash-cms/demo-cloudflare typecheck
       - run: pnpm typecheck:templates
       - run: node scripts/typecheck-public-source.mjs
+      - run: pnpm run --filter @emdash-cms/release-service --filter @emdash-cms/release-verifier --filter @emdash-cms/release-action typecheck
+      - run: pnpm run --filter @emdash-cms/release-service --filter @emdash-cms/release-verifier --filter @emdash-cms/release-action build
+      - run: git diff --exit-code -- apps/release-action/dist/index.js
+      - run: pnpm --dir apps/release-service exec wrangler types --check
+      - run: pnpm --dir apps/release-verifier exec wrangler types --check
+      - run: pnpm --dir apps/release-service exec wrangler deploy --dry-run
+      - run: pnpm --dir apps/release-verifier exec wrangler deploy --dry-run
 
   lint:
     name: Lint
@@ -129,6 +136,7 @@ jobs:
       # Render tests use the Astro Vite plugin (vitest.repro.config.ts);
       # they can't run under the plain-node config in test:unit.
       - run: pnpm --filter emdash exec vitest run --config vitest.repro.config.ts
+      - run: pnpm run --filter @emdash-cms/release-service --filter @emdash-cms/release-verifier --filter @emdash-cms/release-action test
 
   test-smoke:
     name: Smoke Tests
@@ -191,7 +199,7 @@ jobs:
           node-version: 22
           cache: pnpm
       - run: pnpm install --frozen-lockfile
-      - run: pnpm run --filter @emdash-cms/admin... build
+      - run: pnpm run --filter @emdash-cms/admin... --filter @emdash-cms/release-service... build
       - uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
         id: playwright-cache
         with:
@@ -199,6 +207,7 @@ jobs:
           key: playwright-${{ hashFiles('pnpm-lock.yaml') }}
       - run: pnpm exec playwright install --with-deps chromium
         if: steps.playwright-cache.outputs.cache-hit != 'true'
+      - run: pnpm --filter @emdash-cms/release-service test:browser
       - run: pnpm run --filter @emdash-cms/admin test
 
   test-e2e-rollup:
diff --git a/apps/release-action/README.md b/apps/release-action/README.md
index 8fe9ddedca..fc6aa8747b 100644
--- a/apps/release-action/README.md
+++ b/apps/release-action/README.md
@@ -1,6 +1,6 @@
 # EmDash delegated release Action
 
-This experimental Action submits a package release record to an EmDash delegated release service. It requests a GitHub OpenID Connect (OIDC) token for each service call, so the workflow does not store a release-service secret.
+This experimental Action submits a URL-source package release record to an EmDash delegated release service. It requests a GitHub OpenID Connect (OIDC) token for each service call, so the workflow does not store a release-service secret.
 
 ## Workflow setup
 
@@ -36,19 +36,19 @@ jobs:
 
 Replace the example service URL, publisher DID, build command, and exact commit with values for your publisher. Pin the Action to an exact commit while the delegated release protocol remains experimental.
 
-The release record must conform to `com.emdashcms.experimental.package.release`. The service validates its package, version, artifact, declared access, and provenance before publication.
+The source release record must conform to `com.emdashcms.experimental.package.release`. Every package or listing-image artifact must have a checksum-bound HTTPS `url` and must not contain `blob`. The service validates and uploads those bytes to the publisher's PDS, then creates a release record whose artifact descriptors contain blobs and no source URLs. Provenance remains checksum-bound to its HTTPS source.
 
 ## Inputs
 
-| Input                   | Required | Default        | Purpose                                                                                        |
-| ----------------------- | -------- | -------------- | ---------------------------------------------------------------------------------------------- |
-| `service-url`           | Yes      | —              | HTTPS origin of the delegated release service.                                                 |
-| `publisher-did`         | Yes      | —              | DID that owns the package profile and release records.                                         |
-| `release-file`          | Yes      | —              | JSON file containing the package release record. The path must stay inside `GITHUB_WORKSPACE`. |
-| `idempotency-key`       | No       | Current run ID | Stable key used to replay the same submission.                                                 |
-| `poll-interval-seconds` | No       | `5`            | Delay between intent status requests.                                                          |
-| `timeout-minutes`       | No       | `30`           | Maximum polling time.                                                                          |
-| `wait-for-approval`     | No       | `false`        | Continue polling when the intent reaches `awaiting_approval`.                                  |
+| Input                   | Required | Default        | Purpose                                                                                                   |
+| ----------------------- | -------- | -------------- | --------------------------------------------------------------------------------------------------------- |
+| `service-url`           | Yes      | —              | HTTPS origin of the delegated release service.                                                            |
+| `publisher-did`         | Yes      | —              | DID that owns the package profile and release records.                                                    |
+| `release-file`          | Yes      | —              | JSON file containing the URL-source package release record. The path must stay inside `GITHUB_WORKSPACE`. |
+| `idempotency-key`       | No       | Current run ID | Stable key used to replay the same submission.                                                            |
+| `poll-interval-seconds` | No       | `5`            | Delay between intent status requests.                                                                     |
+| `timeout-minutes`       | No       | `30`           | Maximum polling time.                                                                                     |
+| `wait-for-approval`     | No       | `false`        | Continue polling when the intent reaches `awaiting_approval`.                                             |
 
 The default idempotency key is stable across attempts of one GitHub run. Set `idempotency-key` when separate runs or jobs must replay the same submission identity.
 
diff --git a/apps/release-action/action.yml b/apps/release-action/action.yml
index 1b01697138..9bd1de0c35 100644
--- a/apps/release-action/action.yml
+++ b/apps/release-action/action.yml
@@ -9,7 +9,7 @@ inputs:
     description: Publisher DID that owns the package.
     required: true
   release-file:
-    description: Path to the package release record JSON file.
+    description: Path to a URL-source package release JSON file. The service publishes PDS blobs.
     required: true
   idempotency-key:
     description: Stable key for replaying this submission. Defaults to the GitHub run.
diff --git a/apps/release-action/dist/index.js b/apps/release-action/dist/index.js
index e1b27ca4aa..17fa0b00ae 100644
--- a/apps/release-action/dist/index.js
+++ b/apps/release-action/dist/index.js
@@ -149,6 +149,34 @@ const isResourceUri = /* @__NO_SIDE_EFFECTS__ */ (input) => {
 	return /* @__PURE__ */ isActorIdentifier(input.substring(5, repoEnd)) && (collection === void 0 || /* @__PURE__ */ isNsid(collection)) && (rkey === void 0 || /* @__PURE__ */ isRecordKey(rkey));
 };
 
+//#endregion
+//#region ../../node_modules/.pnpm/@atcute+lexicons@2.0.0/node_modules/@atcute/lexicons/dist/syntax/cid.js
+const DASL_CID_RE = /^baf[ky]rei[a-z2-7]{52}$/;
+const isCid = /* @__NO_SIDE_EFFECTS__ */ (input) => {
+	return typeof input === "string" && input.length === 59 && DASL_CID_RE.test(input);
+};
+
+//#endregion
+//#region ../../node_modules/.pnpm/@atcute+lexicons@2.0.0/node_modules/@atcute/lexicons/dist/syntax/datetime.js
+const DATE_TIME_RE = /^((?!0{3})\d{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01]))T((?:[01]\d|2[0-3]):(?:[0-5]\d):(?:[0-5]\d))(\.\d+)?(Z|(?!-00:00)[+-](?:[01]\d|2[0-3]):(?:[0-5]\d))$/;
+const isDatetime = /* @__NO_SIDE_EFFECTS__ */ (input) => {
+	return typeof input === "string" && input.length >= 20 && input.length <= 64 && DATE_TIME_RE.test(input);
+};
+
+//#endregion
+//#region ../../node_modules/.pnpm/@atcute+lexicons@2.0.0/node_modules/@atcute/lexicons/dist/syntax/language.js
+const LANGUAGE_CODE_RE = /^((?<grandfathered>(en-GB-oed|i-ami|i-bnn|i-default|i-enochian|i-hak|i-klingon|i-lux|i-mingo|i-navajo|i-pwn|i-tao|i-tay|i-tsu|sgn-BE-FR|sgn-BE-NL|sgn-CH-DE)|(art-lojban|cel-gaulish|no-bok|no-nyn|zh-guoyu|zh-hakka|zh-min|zh-min-nan|zh-xiang))|((?<language>([A-Za-z]{2,3}(-(?<extlang>[A-Za-z]{3}(-[A-Za-z]{3}){0,2}))?)|[A-Za-z]{4}|[A-Za-z]{5,8})(-(?<script>[A-Za-z]{4}))?(-(?<region>[A-Za-z]{2}|[0-9]{3}))?(-(?<variant>[A-Za-z0-9]{5,8}|[0-9][A-Za-z0-9]{3}))*(-(?<extension>[0-9A-WY-Za-wy-z](-[A-Za-z0-9]{2,8})+))*(-(?<privateUseA>x(-[A-Za-z0-9]{1,8})+))?)|(?<privateUseB>x(-[A-Za-z0-9]{1,8})+))$/;
+const isLanguageCode = /* @__NO_SIDE_EFFECTS__ */ (input) => {
+	return typeof input === "string" && input.length >= 2 && LANGUAGE_CODE_RE.test(input);
+};
+
+//#endregion
+//#region ../../node_modules/.pnpm/@atcute+lexicons@2.0.0/node_modules/@atcute/lexicons/dist/syntax/tid.js
+const TID_RE = /^[234567abcdefghij][234567abcdefghijklmnopqrstuvwxyz]{12}$/;
+const isTid = /* @__NO_SIDE_EFFECTS__ */ (input) => {
+	return typeof input === "string" && input.length === 13 && TID_RE.test(input);
+};
+
 //#endregion
 //#region ../../node_modules/.pnpm/@atcute+uint8array@1.1.1/node_modules/@atcute/uint8array/dist/index.node.js
 const _alloc = Buffer.alloc;
@@ -160,7 +188,13 @@ const _compare = Buffer.prototype.compare;
 const _equals = Buffer.prototype.equals;
 const _utf8Slice = Buffer.prototype.utf8Slice;
 const _utf8Write = Buffer.prototype.utf8Write;
-const _fromCharCode = String.fromCharCode;
+const toUint8Array = (buffer) => {
+	return new Uint8Array(buffer.buffer, buffer.byteOffset, buffer.byteLength);
+};
+const allocUnsafe = (size) => {
+	return toUint8Array(_allocUnsafe(size));
+};
+const _fromCharCode$1 = String.fromCharCode;
 /**
 * checks if a string's UTF-8 byte length is within a given range
 * @param str string to measure
@@ -177,40 +211,44 @@ const isUtf8LengthInRange = (str, min, max) => {
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@atcute+lexicons@2.0.0/node_modules/@atcute/lexicons/dist/syntax/cid.js
-const DASL_CID_RE = /^baf[ky]rei[a-z2-7]{52}$/;
-const isCid = /* @__NO_SIDE_EFFECTS__ */ (input) => {
-	return typeof input === "string" && input.length === 59 && DASL_CID_RE.test(input);
+//#region ../../node_modules/.pnpm/@atcute+lexicons@2.0.0/node_modules/@atcute/lexicons/dist/syntax/uri.js
+const URI_RE = /^\w+:(?:\/\/)?[^\s/][^\s]*$/;
+const isGenericUri = /* @__NO_SIDE_EFFECTS__ */ (input) => {
+	if (typeof input !== "string") return false;
+	if (!isUtf8LengthInRange(input, 3, 8192)) return false;
+	return URI_RE.test(input);
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@atcute+lexicons@2.0.0/node_modules/@atcute/lexicons/dist/syntax/datetime.js
-const DATE_TIME_RE = /^((?!0{3})\d{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01]))T((?:[01]\d|2[0-3]):(?:[0-5]\d):(?:[0-5]\d))(\.\d+)?(Z|(?!-00:00)[+-](?:[01]\d|2[0-3]):(?:[0-5]\d))$/;
-const isDatetime = /* @__NO_SIDE_EFFECTS__ */ (input) => {
-	return typeof input === "string" && input.length >= 20 && input.length <= 64 && DATE_TIME_RE.test(input);
+//#region ../../packages/registry-lexicons/dist/chunk-BYypO7fO.js
+var __defProp = Object.defineProperty;
+var __exportAll = (all, no_symbols) => {
+	let target = {};
+	for (var name in all) __defProp(target, name, {
+		get: all[name],
+		enumerable: true
+	});
+	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
+	return target;
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@atcute+lexicons@2.0.0/node_modules/@atcute/lexicons/dist/syntax/language.js
-const LANGUAGE_CODE_RE = /^((?<grandfathered>(en-GB-oed|i-ami|i-bnn|i-default|i-enochian|i-hak|i-klingon|i-lux|i-mingo|i-navajo|i-pwn|i-tao|i-tay|i-tsu|sgn-BE-FR|sgn-BE-NL|sgn-CH-DE)|(art-lojban|cel-gaulish|no-bok|no-nyn|zh-guoyu|zh-hakka|zh-min|zh-min-nan|zh-xiang))|((?<language>([A-Za-z]{2,3}(-(?<extlang>[A-Za-z]{3}(-[A-Za-z]{3}){0,2}))?)|[A-Za-z]{4}|[A-Za-z]{5,8})(-(?<script>[A-Za-z]{4}))?(-(?<region>[A-Za-z]{2}|[0-9]{3}))?(-(?<variant>[A-Za-z0-9]{5,8}|[0-9][A-Za-z0-9]{3}))*(-(?<extension>[0-9A-WY-Za-wy-z](-[A-Za-z0-9]{2,8})+))*(-(?<privateUseA>x(-[A-Za-z0-9]{1,8})+))?)|(?<privateUseB>x(-[A-Za-z0-9]{1,8})+))$/;
-const isLanguageCode = /* @__NO_SIDE_EFFECTS__ */ (input) => {
-	return typeof input === "string" && input.length >= 2 && LANGUAGE_CODE_RE.test(input);
+//#region ../../node_modules/.pnpm/@atcute+lexicons@2.0.0/node_modules/@atcute/lexicons/dist/interfaces/cid-link.js
+const CID_LINK_SYMBOL = Symbol.for("@atcute/cid-link-wrapper");
+const isCidLink = (input) => {
+	const v = input;
+	return typeof v === "object" && v !== null && (CID_LINK_SYMBOL in v || /* @__PURE__ */ isCid(v.$link));
 };
 
 //#endregion
-//#region ../../node_modules/.pnpm/@atcute+lexicons@2.0.0/node_modules/@atcute/lexicons/dist/syntax/tid.js
-const TID_RE = /^[234567abcdefghij][234567abcdefghijklmnopqrstuvwxyz]{12}$/;
-const isTid = /* @__NO_SIDE_EFFECTS__ */ (input) => {
-	return typeof input === "string" && input.length === 13 && TID_RE.test(input);
+//#region ../../node_modules/.pnpm/@atcute+lexicons@2.0.0/node_modules/@atcute/lexicons/dist/interfaces/blob.js
+const isBlob = (input) => {
+	const v = input;
+	return typeof v === "object" && v !== null && v.$type === "blob" && typeof v.mimeType === "string" && Number.isSafeInteger(v.size) && isCidLink(v.ref) && Object.keys(v).length === 4;
 };
-
-//#endregion
-//#region ../../node_modules/.pnpm/@atcute+lexicons@2.0.0/node_modules/@atcute/lexicons/dist/syntax/uri.js
-const URI_RE = /^\w+:(?:\/\/)?[^\s/][^\s]*$/;
-const isGenericUri = /* @__NO_SIDE_EFFECTS__ */ (input) => {
-	if (typeof input !== "string") return false;
-	if (!isUtf8LengthInRange(input, 3, 8192)) return false;
-	return URI_RE.test(input);
+const isLegacyBlob = (input) => {
+	const v = input;
+	return typeof v === "object" && v !== null && typeof v.cid === "string" && typeof v.mimeType === "string" && Object.keys(v).length === 2;
 };
 
 //#endregion
@@ -315,6 +353,13 @@ const countIssues = (tree) => {
 		default: return count + 1;
 	}
 };
+const separatedList = (list, sep) => {
+	switch (list.length) {
+		case 0: return `nothing`;
+		case 1: return list[0];
+		default: return `${list.slice(0, -1).join(", ")} ${sep} ${list[list.length - 1]}`;
+	}
+};
 const formatLiteral = (value) => {
 	return JSON.stringify(value);
 };
@@ -606,6 +651,82 @@ const stringLength = /* @__NO_SIDE_EFFECTS__ */ (minLength, maxLength = Infinity
 		}
 	};
 };
+const ISSUE_EXPECTED_BLOB = {
+	ok: false,
+	code: "invalid_type",
+	expected: "blob",
+	msg() {
+		return `expected blob`;
+	}
+};
+const BLOB_SCHEMA = {
+	kind: "schema",
+	type: "blob",
+	"~run"(input, flags) {
+		if (typeof input !== "object" || input === null) return ISSUE_EXPECTED_BLOB;
+		if (isBlob(input)) return;
+		if (!(flags & FLAG_STRICT) && isLegacyBlob(input)) return /* @__PURE__ */ ok({
+			$type: "blob",
+			mimeType: input.mimeType,
+			ref: { $link: input.cid },
+			size: -1
+		});
+		return ISSUE_EXPECTED_BLOB;
+	},
+	get "~standard"() {
+		return /* @__PURE__ */ lazyProperty(this, "~standard", toStandardSchema(this));
+	}
+};
+const blob = /* @__NO_SIDE_EFFECTS__ */ () => {
+	return BLOB_SCHEMA;
+};
+const blobSize = /* @__NO_SIDE_EFFECTS__ */ (maxSize) => {
+	const issue = {
+		ok: false,
+		code: "invalid_blob_size",
+		maxSize,
+		msg() {
+			return `blob size must not exceed ${maxSize} bytes`;
+		}
+	};
+	return {
+		kind: "constraint",
+		type: "blob_size",
+		maxSize,
+		"~run"(input, flags) {
+			if (!(flags & FLAG_STRICT)) return;
+			if (input.size > maxSize) return issue;
+		}
+	};
+};
+const blobAccept = /* @__NO_SIDE_EFFECTS__ */ (accept) => {
+	const normalized = accept.map((p) => p.toLowerCase());
+	const issue = {
+		ok: false,
+		code: "invalid_blob_mime_type",
+		accept,
+		msg() {
+			return `blob MIME type must match: ${accept.join(", ")}`;
+		}
+	};
+	return {
+		kind: "constraint",
+		type: "blob_accept",
+		accept,
+		"~run"(input, flags) {
+			if (!(flags & FLAG_STRICT)) return;
+			const mimeType = input.mimeType.toLowerCase();
+			for (let idx = 0, len = normalized.length; idx < len; idx++) {
+				const pattern = normalized[idx];
+				if (pattern === "*/*") return;
+				if (pattern.endsWith("/*")) {
+					if (mimeType.startsWith(pattern.slice(0, -1))) return;
+				} else if (mimeType === pattern) return;
+			}
+			return issue;
+		}
+	};
+};
 const optional = /* @__NO_SIDE_EFFECTS__ */ (wrapped, defaultValue) => {
 	return {
 		kind: "schema",
@@ -838,6 +959,50 @@ const record = /* @__NO_SIDE_EFFECTS__ */ (key, object) => {
 		}
 	};
 };
+const ISSUE_VARIANT_MISSING = /* @__PURE__ */ prependPath("$type", ISSUE_MISSING);
+const ISSUE_VARIANT_TYPE = /* @__PURE__ */ prependPath("$type", ISSUE_TYPE_STRING);
+const variant = /* @__NO_SIDE_EFFECTS__ */ (members, closed = false) => {
+	return {
+		kind: "schema",
+		type: "variant",
+		members,
+		closed,
+		get "~run"() {
+			const types = [];
+			const schemas = [];
+			for (let idx = 0, len = members.length; idx < len; idx++) {
+				const raw = members[idx];
+				const member = raw.type === "record" ? raw.object : raw;
+				let t = member.shape.$type;
+				assert(t !== void 0, `expected $type in variant member #${idx} to be defined`);
+				if (t.type === "optional") t = t.wrapped;
+				assert(t.type === "literal" && typeof t.expected === "string", `expected $type in variant member #${idx} to be a string literal`);
+				types.push(t.expected);
+				schemas.push(member);
+			}
+			const issue = {
+				ok: false,
+				code: "invalid_variant",
+				expected: types,
+				msg() {
+					return `expected ${separatedList(types, "or")}`;
+				}
+			};
+			const matcher = (input, flags) => {
+				if (!/* @__PURE__ */ isObject(input)) return ISSUE_TYPE_OBJECT;
+				const type = input.$type;
+				if (type === void 0 && !("$type" in input)) return ISSUE_VARIANT_MISSING;
+				if (typeof type !== "string") return closed ? issue : ISSUE_VARIANT_TYPE;
+				for (let idx = 0, len = types.length; idx < len; idx++) if (types[idx] === type) return schemas[idx]["~run"](input, flags);
+				if (closed) return issue;
+			};
+			return /* @__PURE__ */ lazyProperty(this, "~run", matcher);
+		},
+		get "~standard"() {
+			return /* @__PURE__ */ lazyProperty(this, "~standard", toStandardSchema(this));
+		}
+	};
+};
 const ISSUE_TYPE_UNKNOWN = {
 	ok: false,
 	code: "invalid_type",
@@ -861,77 +1026,547 @@ const unknown = /* @__NO_SIDE_EFFECTS__ */ () => {
 };
 
 //#endregion
-//#region ../../packages/registry-client/dist/types-Cuqx9ScV.js
-const TERMINAL_RELEASE_INTENT_STATES = new Set([
-	"published",
-	"invalid",
-	"rejected",
-	"cancelled",
-	"expired",
-	"failed",
-	"conflict"
-]);
+//#region ../../packages/registry-lexicons/dist/generated/types/com/emdashcms/experimental/package/release.js
+var release_exports = /* @__PURE__ */ __exportAll({
+	artifactSchema: () => artifactSchema,
+	artifactsSchema: () => artifactsSchema,
+	imageArtifactSchema: () => imageArtifactSchema,
+	mainSchema: () => mainSchema$1,
+	sbomSchema: () => sbomSchema
+});
+const _artifactSchema = /* @__PURE__ */ object({
+	$type: /* @__PURE__ */ optional(/* @__PURE__ */ literal("com.emdashcms.experimental.package.release#artifact")),
+	blob: /* @__PURE__ */ optional(/* @__PURE__ */ constrain(/* @__PURE__ */ blob(), [/* @__PURE__ */ blobSize(262144), /* @__PURE__ */ blobAccept(["application/gzip"])])),
+	checksum: /* @__PURE__ */ constrain(/* @__PURE__ */ string(), [/* @__PURE__ */ stringLength(0, 256)]),
+	contentType: /* @__PURE__ */ optional(/* @__PURE__ */ constrain(/* @__PURE__ */ string(), [/* @__PURE__ */ stringLength(0, 256)])),
+	height: /* @__PURE__ */ optional(/* @__PURE__ */ constrain(/* @__PURE__ */ integer(), [/* @__PURE__ */ integerRange(1, 8192)])),
+	id: /* @__PURE__ */ optional(/* @__PURE__ */ constrain(/* @__PURE__ */ string(), [/* @__PURE__ */ stringLength(0, 128)])),
+	lang: /* @__PURE__ */ optional(/* @__PURE__ */ languageCodeString()),
+	releaseAsset: /* @__PURE__ */ optional(/* @__PURE__ */ boolean()),
+	requiresAuth: /* @__PURE__ */ optional(/* @__PURE__ */ boolean()),
+	signature: /* @__PURE__ */ optional(/* @__PURE__ */ constrain(/* @__PURE__ */ string(), [/* @__PURE__ */ stringLength(0, 1024)])),
+	url: /* @__PURE__ */ optional(/* @__PURE__ */ constrain(/* @__PURE__ */ genericUriString(), [/* @__PURE__ */ stringLength(0, 2048)])),
+	width: /* @__PURE__ */ optional(/* @__PURE__ */ constrain(/* @__PURE__ */ integer(), [/* @__PURE__ */ integerRange(1, 8192)]))
+});
+const _artifactsSchema = /* @__PURE__ */ object({
+	$type: /* @__PURE__ */ optional(/* @__PURE__ */ literal("com.emdashcms.experimental.package.release#artifacts")),
+	get banner() {
+		return /* @__PURE__ */ optional(imageArtifactSchema);
+	},
+	get icon() {
+		return /* @__PURE__ */ optional(imageArtifactSchema);
+	},
+	get package() {
+		return artifactSchema;
+	},
+	get screenshots() {
+		return /* @__PURE__ */ optional(/* @__PURE__ */ constrain(/* @__PURE__ */ array(imageArtifactSchema), [/* @__PURE__ */ arrayLength(0, 8)]));
+	}
+});
+const _imageArtifactSchema = /* @__PURE__ */ object({
+	$type: /* @__PURE__ */ optional(/* @__PURE__ */ literal("com.emdashcms.experimental.package.release#imageArtifact")),
+	blob: /* @__PURE__ */ optional(/* @__PURE__ */ constrain(/* @__PURE__ */ blob(), [/* @__PURE__ */ blobSize(1048576), /* @__PURE__ */ blobAccept([
+		"image/png",
+		"image/jpeg",
+		"image/webp"
+	])])),
+	checksum: /* @__PURE__ */ constrain(/* @__PURE__ */ string(), [/* @__PURE__ */ stringLength(0, 256)]),
+	contentType: /* @__PURE__ */ optional(/* @__PURE__ */ constrain(/* @__PURE__ */ string(), [/* @__PURE__ */ stringLength(0, 256)])),
+	height: /* @__PURE__ */ optional(/* @__PURE__ */ constrain(/* @__PURE__ */ integer(), [/* @__PURE__ */ integerRange(1, 8192)])),
+	id: /* @__PURE__ */ optional(/* @__PURE__ */ constrain(/* @__PURE__ */ string(), [/* @__PURE__ */ stringLength(0, 128)])),
+	lang: /* @__PURE__ */ optional(/* @__PURE__ */ languageCodeString()),
+	releaseAsset: /* @__PURE__ */ optional(/* @__PURE__ */ boolean()),
+	requiresAuth: /* @__PURE__ */ optional(/* @__PURE__ */ boolean()),
+	signature: /* @__PURE__ */ optional(/* @__PURE__ */ constrain(/* @__PURE__ */ string(), [/* @__PURE__ */ stringLength(0, 1024)])),
+	url: /* @__PURE__ */ optional(/* @__PURE__ */ constrain(/* @__PURE__ */ genericUriString(), [/* @__PURE__ */ stringLength(0, 2048)])),
+	width: /* @__PURE__ */ optional(/* @__PURE__ */ constrain(/* @__PURE__ */ integer(), [/* @__PURE__ */ integerRange(1, 8192)]))
+});
+const _mainSchema$1 = /* @__PURE__ */ record(/* @__PURE__ */ string(), /* @__PURE__ */ object({
+	$type: /* @__PURE__ */ literal("com.emdashcms.experimental.package.release"),
+	get artifacts() {
+		return artifactsSchema;
+	},
+	get auth() {
+		return /* @__PURE__ */ optional(/* @__PURE__ */ variant([]));
+	},
+	extensions: /* @__PURE__ */ optional(/* @__PURE__ */ unknown()),
+	package: /* @__PURE__ */ constrain(/* @__PURE__ */ string(), [/* @__PURE__ */ stringLength(1, 64)]),
+	provides: /* @__PURE__ */ optional(/* @__PURE__ */ unknown()),
+	repo: /* @__PURE__ */ optional(/* @__PURE__ */ constrain(/* @__PURE__ */ genericUriString(), [/* @__PURE__ */ stringLength(0, 1024)])),
+	requires: /* @__PURE__ */ optional(/* @__PURE__ */ unknown()),
+	get sbom() {
+		return /* @__PURE__ */ optional(sbomSchema);
+	},
+	suggests: /* @__PURE__ */ optional(/* @__PURE__ */ unknown()),
+	version: /* @__PURE__ */ constrain(/* @__PURE__ */ string(), [/* @__PURE__ */ stringLength(1, 64)])
+}));
+const _sbomSchema = /* @__PURE__ */ object({
+	$type: /* @__PURE__ */ optional(/* @__PURE__ */ literal("com.emdashcms.experimental.package.release#sbom")),
+	checksum: /* @__PURE__ */ optional(/* @__PURE__ */ constrain(/* @__PURE__ */ string(), [/* @__PURE__ */ stringLength(0, 256)])),
+	format: /* @__PURE__ */ optional(/* @__PURE__ */ constrain(/* @__PURE__ */ string(), [/* @__PURE__ */ stringLength(0, 32)])),
+	url: /* @__PURE__ */ optional(/* @__PURE__ */ constrain(/* @__PURE__ */ genericUriString(), [/* @__PURE__ */ stringLength(0, 2048)]))
+});
+const artifactSchema = _artifactSchema;
+const artifactsSchema = _artifactsSchema;
+const imageArtifactSchema = _imageArtifactSchema;
+const mainSchema$1 = _mainSchema$1;
+const sbomSchema = _sbomSchema;
 
 //#endregion
-//#region ../../packages/registry-client/dist/release-service/index.js
-const DID_PATTERN = /^did:[a-z0-9]+:[A-Za-z0-9._:%-]+$/;
-const ULID_PATTERN = /^[0-9A-HJKMNP-TV-Z]{26}$/;
-const PACKAGE_SLUG_PATTERN = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
-const VERSION_PATTERN = /^[0-9A-Za-z][0-9A-Za-z.-]{0,127}$/;
-const CID_PATTERN = /^[A-Za-z0-9]+$/;
-const IDEMPOTENCY_KEY_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{15,127}$/;
-const DIGITS_PATTERN = /^[0-9]+$/;
-const CSRF_TOKEN_PATTERN = /^[A-Za-z0-9_-]{43}$/;
-const API_ERROR_CODES = {
-	ACCESS_DENIED: true,
-	ACCESS_AUTH_INVALID: true,
-	ACCESS_AUTH_REQUIRED: true,
-	APPROVAL_INVALID: true,
-	APPROVER_SESSION_INVALID: true,
-	APPROVER_SUSPENDED: true,
-	AUTH_INVALID: true,
-	CONFIGURATION_ERROR: true,
-	CREDENTIAL_LIMIT_REACHED: true,
-	CREDENTIAL_NOT_FOUND: true,
-	CREDENTIAL_REVOKED: true,
-	CSRF_INVALID: true,
-	DELEGATION_REQUIRED: true,
-	IDEMPOTENCY_KEY_INVALID: true,
-	IDEMPOTENCY_CONFLICT: true,
-	INTERNAL_ERROR: true,
-	INVALID_REQUEST: true,
-	INTENT_NOT_APPROVABLE: true,
-	INTENT_NOT_CANCELLABLE: true,
-	METHOD_NOT_ALLOWED: true,
-	NOT_FOUND: true,
-	OAUTH_AUTHORIZATION_FAILED: true,
-	OAUTH_CALLBACK_INVALID: true,
-	PROFILE_CHANGED: true,
-	PROFILE_FETCH_FAILED: true,
-	PUBLISHER_SESSION_INVALID: true,
-	PUBLISHER_SUSPENDED: true,
-	RELEASE_EXISTS: true,
-	SERVICE_PAUSED: true,
-	SERVICE_UNAVAILABLE: true,
-	VERSION_RESERVED: true,
-	WORKFLOW_UNAVAILABLE: true,
-	WORKLOAD_NOT_ALLOWED: true
-};
-const RETRYABLE_ERROR_CODES = new Set([
-	"CONFIGURATION_ERROR",
-	"INTERNAL_ERROR",
-	"NETWORK_ERROR",
-	"PROFILE_FETCH_FAILED",
-	"PUBLISHER_SUSPENDED",
-	"SERVICE_PAUSED",
-	"SERVICE_UNAVAILABLE",
-	"WORKFLOW_UNAVAILABLE"
-]);
-const INTENT_STATES = {
-	received: true,
-	verifying: true,
-	verified: true,
-	awaiting_approval: true,
+//#region ../../packages/registry-lexicons/dist/generated/types/com/emdashcms/experimental/package/releaseExtension.js
+var releaseExtension_exports = /* @__PURE__ */ __exportAll({
+	contentAccessSchema: () => contentAccessSchema,
+	contentReadConstraintsSchema: () => contentReadConstraintsSchema,
+	contentWriteConstraintsSchema: () => contentWriteConstraintsSchema,
+	declaredAccessSchema: () => declaredAccessSchema,
+	emailAccessSchema: () => emailAccessSchema,
+	emailEventsConstraintsSchema: () => emailEventsConstraintsSchema,
+	emailSendConstraintsSchema: () => emailSendConstraintsSchema,
+	emailTransportConstraintsSchema: () => emailTransportConstraintsSchema,
+	mainSchema: () => mainSchema,
+	mediaAccessSchema: () => mediaAccessSchema,
+	mediaReadConstraintsSchema: () => mediaReadConstraintsSchema,
+	mediaWriteConstraintsSchema: () => mediaWriteConstraintsSchema,
+	networkAccessSchema: () => networkAccessSchema,
+	networkRequestConstraintsSchema: () => networkRequestConstraintsSchema,
+	pageAccessSchema: () => pageAccessSchema,
+	pageFragmentsConstraintsSchema: () => pageFragmentsConstraintsSchema,
+	provenanceSchema: () => provenanceSchema,
+	taxonomiesAccessSchema: () => taxonomiesAccessSchema,
+	taxonomiesReadConstraintsSchema: () => taxonomiesReadConstraintsSchema,
+	usersAccessSchema: () => usersAccessSchema,
+	usersReadConstraintsSchema: () => usersReadConstraintsSchema
+});
+const _contentAccessSchema = /* @__PURE__ */ object({
+	$type: /* @__PURE__ */ optional(/* @__PURE__ */ literal("com.emdashcms.experimental.package.releaseExtension#contentAccess")),
+	get read() {
+		return /* @__PURE__ */ optional(contentReadConstraintsSchema);
+	},
+	get write() {
+		return /* @__PURE__ */ optional(contentWriteConstraintsSchema);
+	}
+});
+const _contentReadConstraintsSchema = /* @__PURE__ */ object({ $type: /* @__PURE__ */ optional(/* @__PURE__ */ literal("com.emdashcms.experimental.package.releaseExtension#contentReadConstraints")) });
+const _contentWriteConstraintsSchema = /* @__PURE__ */ object({ $type: /* @__PURE__ */ optional(/* @__PURE__ */ literal("com.emdashcms.experimental.package.releaseExtension#contentWriteConstraints")) });
+const _declaredAccessSchema = /* @__PURE__ */ object({
+	$type: /* @__PURE__ */ optional(/* @__PURE__ */ literal("com.emdashcms.experimental.package.releaseExtension#declaredAccess")),
+	get content() {
+		return /* @__PURE__ */ optional(contentAccessSchema);
+	},
+	get email() {
+		return /* @__PURE__ */ optional(emailAccessSchema);
+	},
+	get media() {
+		return /* @__PURE__ */ optional(mediaAccessSchema);
+	},
+	get network() {
+		return /* @__PURE__ */ optional(networkAccessSchema);
+	},
+	get page() {
+		return /* @__PURE__ */ optional(pageAccessSchema);
+	},
+	get taxonomies() {
+		return /* @__PURE__ */ optional(taxonomiesAccessSchema);
+	},
+	get users() {
+		return /* @__PURE__ */ optional(usersAccessSchema);
+	}
+});
+const _emailAccessSchema = /* @__PURE__ */ object({
+	$type: /* @__PURE__ */ optional(/* @__PURE__ */ literal("com.emdashcms.experimental.package.releaseExtension#emailAccess")),
+	get events() {
+		return /* @__PURE__ */ optional(emailEventsConstraintsSchema);
+	},
+	get send() {
+		return /* @__PURE__ */ optional(emailSendConstraintsSchema);
+	},
+	get transport() {
+		return /* @__PURE__ */ optional(emailTransportConstraintsSchema);
+	}
+});
+const _emailEventsConstraintsSchema = /* @__PURE__ */ object({ $type: /* @__PURE__ */ optional(/* @__PURE__ */ literal("com.emdashcms.experimental.package.releaseExtension#emailEventsConstraints")) });
+const _emailSendConstraintsSchema = /* @__PURE__ */ object({ $type: /* @__PURE__ */ optional(/* @__PURE__ */ literal("com.emdashcms.experimental.package.releaseExtension#emailSendConstraints")) });
+const _emailTransportConstraintsSchema = /* @__PURE__ */ object({ $type: /* @__PURE__ */ optional(/* @__PURE__ */ literal("com.emdashcms.experimental.package.releaseExtension#emailTransportConstraints")) });
+const _mainSchema = /* @__PURE__ */ object({
+	$type: /* @__PURE__ */ optional(/* @__PURE__ */ literal("com.emdashcms.experimental.package.releaseExtension")),
+	get declaredAccess() {
+		return declaredAccessSchema;
+	},
+	get provenance() {
+		return /* @__PURE__ */ optional(provenanceSchema);
+	}
+});
+const _mediaAccessSchema = /* @__PURE__ */ object({
+	$type: /* @__PURE__ */ optional(/* @__PURE__ */ literal("com.emdashcms.experimental.package.releaseExtension#mediaAccess")),
+	get read() {
+		return /* @__PURE__ */ optional(mediaReadConstraintsSchema);
+	},
+	get write() {
+		return /* @__PURE__ */ optional(mediaWriteConstraintsSchema);
+	}
+});
+const _mediaReadConstraintsSchema = /* @__PURE__ */ object({ $type: /* @__PURE__ */ optional(/* @__PURE__ */ literal("com.emdashcms.experimental.package.releaseExtension#mediaReadConstraints")) });
+const _mediaWriteConstraintsSchema = /* @__PURE__ */ object({ $type: /* @__PURE__ */ optional(/* @__PURE__ */ literal("com.emdashcms.experimental.package.releaseExtension#mediaWriteConstraints")) });
+const _networkAccessSchema = /* @__PURE__ */ object({
+	$type: /* @__PURE__ */ optional(/* @__PURE__ */ literal("com.emdashcms.experimental.package.releaseExtension#networkAccess")),
+	get request() {
+		return /* @__PURE__ */ optional(networkRequestConstraintsSchema);
+	}
+});
+const _networkRequestConstraintsSchema = /* @__PURE__ */ object({
+	$type: /* @__PURE__ */ optional(/* @__PURE__ */ literal("com.emdashcms.experimental.package.releaseExtension#networkRequestConstraints")),
+	allowedHosts: /* @__PURE__ */ optional(/* @__PURE__ */ constrain(/* @__PURE__ */ array(/* @__PURE__ */ constrain(/* @__PURE__ */ string(), [/* @__PURE__ */ stringLength(0, 256)])), [/* @__PURE__ */ arrayLength(1, 64)]))
+});
+const _pageAccessSchema = /* @__PURE__ */ object({
+	$type: /* @__PURE__ */ optional(/* @__PURE__ */ literal("com.emdashcms.experimental.package.releaseExtension#pageAccess")),
+	get fragments() {
+		return /* @__PURE__ */ optional(pageFragmentsConstraintsSchema);
+	}
+});
+const _pageFragmentsConstraintsSchema = /* @__PURE__ */ object({ $type: /* @__PURE__ */ optional(/* @__PURE__ */ literal("com.emdashcms.experimental.package.releaseExtension#pageFragmentsConstraints")) });
+const _provenanceSchema = /* @__PURE__ */ object({
+	$type: /* @__PURE__ */ optional(/* @__PURE__ */ literal("com.emdashcms.experimental.package.releaseExtension#provenance")),
+	builderId: /* @__PURE__ */ constrain(/* @__PURE__ */ genericUriString(), [/* @__PURE__ */ stringLength(0, 1024)]),
+	checksum: /* @__PURE__ */ constrain(/* @__PURE__ */ string(), [/* @__PURE__ */ stringLength(0, 256)]),
+	predicateType: /* @__PURE__ */ constrain(/* @__PURE__ */ string(), [/* @__PURE__ */ stringLength(0, 1024)]),
+	sourceRepository: /* @__PURE__ */ constrain(/* @__PURE__ */ genericUriString(), [/* @__PURE__ */ stringLength(0, 1024)]),
+	url: /* @__PURE__ */ constrain(/* @__PURE__ */ genericUriString(), [/* @__PURE__ */ stringLength(0, 2048)])
+});
+const _taxonomiesAccessSchema = /* @__PURE__ */ object({
+	$type: /* @__PURE__ */ optional(/* @__PURE__ */ literal("com.emdashcms.experimental.package.releaseExtension#taxonomiesAccess")),
+	get read() {
+		return /* @__PURE__ */ optional(taxonomiesReadConstraintsSchema);
+	}
+});
+const _taxonomiesReadConstraintsSchema = /* @__PURE__ */ object({ $type: /* @__PURE__ */ optional(/* @__PURE__ */ literal("com.emdashcms.experimental.package.releaseExtension#taxonomiesReadConstraints")) });
+const _usersAccessSchema = /* @__PURE__ */ object({
+	$type: /* @__PURE__ */ optional(/* @__PURE__ */ literal("com.emdashcms.experimental.package.releaseExtension#usersAccess")),
+	get read() {
+		return /* @__PURE__ */ optional(usersReadConstraintsSchema);
+	}
+});
+const _usersReadConstraintsSchema = /* @__PURE__ */ object({ $type: /* @__PURE__ */ optional(/* @__PURE__ */ literal("com.emdashcms.experimental.package.releaseExtension#usersReadConstraints")) });
+const contentAccessSchema = _contentAccessSchema;
+const contentReadConstraintsSchema = _contentReadConstraintsSchema;
+const contentWriteConstraintsSchema = _contentWriteConstraintsSchema;
+const declaredAccessSchema = _declaredAccessSchema;
+const emailAccessSchema = _emailAccessSchema;
+const emailEventsConstraintsSchema = _emailEventsConstraintsSchema;
+const emailSendConstraintsSchema = _emailSendConstraintsSchema;
+const emailTransportConstraintsSchema = _emailTransportConstraintsSchema;
+const mainSchema = _mainSchema;
+const mediaAccessSchema = _mediaAccessSchema;
+const mediaReadConstraintsSchema = _mediaReadConstraintsSchema;
+const mediaWriteConstraintsSchema = _mediaWriteConstraintsSchema;
+const networkAccessSchema = _networkAccessSchema;
+const networkRequestConstraintsSchema = _networkRequestConstraintsSchema;
+const pageAccessSchema = _pageAccessSchema;
+const pageFragmentsConstraintsSchema = _pageFragmentsConstraintsSchema;
+const provenanceSchema = _provenanceSchema;
+const taxonomiesAccessSchema = _taxonomiesAccessSchema;
+const taxonomiesReadConstraintsSchema = _taxonomiesReadConstraintsSchema;
+const usersAccessSchema = _usersAccessSchema;
+const usersReadConstraintsSchema = _usersReadConstraintsSchema;
+
+//#endregion
+//#region ../../packages/registry-lexicons/dist/index.js
+/**
+* NSID constants for the lexicons defined by this package. Useful for consumers
+* that need to reference a record collection by string (e.g. when issuing
+* `listRecords` or `putRecord` calls against a PDS).
+*/
+const NSID = {
+	packageProfile: "com.emdashcms.experimental.package.profile",
+	packageProfileExtension: "com.emdashcms.experimental.package.profileExtension",
+	packageRelease: "com.emdashcms.experimental.package.release",
+	packageReleaseExtension: "com.emdashcms.experimental.package.releaseExtension",
+	publisherProfile: "com.emdashcms.experimental.publisher.profile",
+	publisherVerification: "com.emdashcms.experimental.publisher.verification",
+	aggregatorDefs: "com.emdashcms.experimental.aggregator.defs",
+	aggregatorGetLatestRelease: "com.emdashcms.experimental.aggregator.getLatestRelease",
+	aggregatorGetPackage: "com.emdashcms.experimental.aggregator.getPackage",
+	aggregatorListReleases: "com.emdashcms.experimental.aggregator.listReleases",
+	aggregatorResolvePackage: "com.emdashcms.experimental.aggregator.resolvePackage",
+	aggregatorSearchPackages: "com.emdashcms.experimental.aggregator.searchPackages",
+	labelerDefs: "com.emdashcms.experimental.labeler.defs",
+	labelerGetAssessment: "com.emdashcms.experimental.labeler.getAssessment",
+	labelerGetCurrentAssessment: "com.emdashcms.experimental.labeler.getCurrentAssessment",
+	labelerGetPolicy: "com.emdashcms.experimental.labeler.getPolicy",
+	labelerListAssessments: "com.emdashcms.experimental.labeler.listAssessments"
+};
+const RECORD_SCOPED_BLOB_CACHE_TYPE = `${NSID.aggregatorDefs}#recordScopedBlobCache`;
+const DELEGATED_RELEASE_PERMISSION = Object.freeze({
+	collection: NSID.packageRelease,
+	scope: `atproto repo:${NSID.packageRelease}?action=create blob:application/gzip blob:image/*`
+});
+/**
+* NSIDs of record-shaped lexicons in this package (one row per NSID in the
+* publisher's repo). Embedded objects (`profileExtension`, `releaseExtension`) and shared defs
+* (`aggregator.defs`) are excluded — they don't address their own collection.
+*
+* Useful for consumers building OAuth `repo:` scopes or enumerating writable
+* collections without hand-rolling a list that drifts from the lexicons.
+*/
+const RECORD_NSIDS = [
+	NSID.packageProfile,
+	NSID.packageRelease,
+	NSID.publisherProfile,
+	NSID.publisherVerification
+];
+/**
+* NSIDs of query-shaped lexicons in this package (read-only XRPC methods on
+* the aggregator). Procedures and shared defs are excluded.
+*
+* Useful for consumers building OAuth `rpc:` scopes or enumerating callable
+* AppView endpoints.
+*/
+const QUERY_NSIDS = [
+	NSID.aggregatorGetLatestRelease,
+	NSID.aggregatorGetPackage,
+	NSID.aggregatorListReleases,
+	NSID.aggregatorResolvePackage,
+	NSID.aggregatorSearchPackages,
+	NSID.labelerGetAssessment,
+	NSID.labelerGetCurrentAssessment,
+	NSID.labelerGetPolicy,
+	NSID.labelerListAssessments
+];
+
+//#endregion
+//#region ../../node_modules/.pnpm/@atcute+multibase@1.2.0/node_modules/@atcute/multibase/dist/bases/base32-encode.js
+const ALPHABET$1 = "abcdefghijklmnopqrstuvwxyz234567";
+const _cc = (() => {
+	const t = new Uint8Array(32);
+	for (let i = 0; i < 32; i++) t[i] = ALPHABET$1.charCodeAt(i);
+	return t;
+})();
+const _fromCharCode = String.fromCharCode;
+/**
+* encodes a Uint8Array to an unpadded RFC 4648 base32 (lowercase) string
+* @param bytes source buffer
+* @returns base32 encoded string
+*/
+const toBase32 = (bytes) => {
+	const len = bytes.length;
+	const full = len / 5 | 0;
+	const rem = len - full * 5;
+	const cc = _cc;
+	let str = "";
+	let ip = 0;
+	const pairs = full / 2 | 0;
+	for (let g = 0; g < pairs; g++) {
+		const a0 = bytes[ip], a1 = bytes[ip + 1], a2 = bytes[ip + 2], a3 = bytes[ip + 3], a4 = bytes[ip + 4];
+		const b0 = bytes[ip + 5], b1 = bytes[ip + 6], b2 = bytes[ip + 7], b3 = bytes[ip + 8], b4 = bytes[ip + 9];
+		str += _fromCharCode(cc[a0 >>> 3], cc[(a0 << 2 | a1 >>> 6) & 31], cc[a1 >>> 1 & 31], cc[(a1 << 4 | a2 >>> 4) & 31], cc[(a2 << 1 | a3 >>> 7) & 31], cc[a3 >>> 2 & 31], cc[(a3 << 3 | a4 >>> 5) & 31], cc[a4 & 31], cc[b0 >>> 3], cc[(b0 << 2 | b1 >>> 6) & 31], cc[b1 >>> 1 & 31], cc[(b1 << 4 | b2 >>> 4) & 31], cc[(b2 << 1 | b3 >>> 7) & 31], cc[b3 >>> 2 & 31], cc[(b3 << 3 | b4 >>> 5) & 31], cc[b4 & 31]);
+		ip += 10;
+	}
+	if (full & 1) {
+		const b0 = bytes[ip], b1 = bytes[ip + 1], b2 = bytes[ip + 2], b3 = bytes[ip + 3], b4 = bytes[ip + 4];
+		str += _fromCharCode(cc[b0 >>> 3], cc[(b0 << 2 | b1 >>> 6) & 31], cc[b1 >>> 1 & 31], cc[(b1 << 4 | b2 >>> 4) & 31], cc[(b2 << 1 | b3 >>> 7) & 31], cc[b3 >>> 2 & 31], cc[(b3 << 3 | b4 >>> 5) & 31], cc[b4 & 31]);
+		ip += 5;
+	}
+	if (rem > 0) {
+		let buffer = 0;
+		let bits = 0;
+		for (let i = ip; i < len; i++) {
+			buffer = buffer << 8 | bytes[i];
+			bits += 8;
+		}
+		while (bits >= 5) {
+			bits -= 5;
+			str += _fromCharCode(cc[buffer >>> bits & 31]);
+		}
+		if (bits > 0) str += _fromCharCode(cc[buffer << 5 - bits & 31]);
+	}
+	return str;
+};
+
+//#endregion
+//#region ../../node_modules/.pnpm/@atcute+multibase@1.2.0/node_modules/@atcute/multibase/dist/bases/base32.js
+const ALPHABET = "abcdefghijklmnopqrstuvwxyz234567";
+const _decodeLut = (() => {
+	const t = new Uint8Array(128).fill(255);
+	for (let i = 0; i < 32; i++) t[ALPHABET.charCodeAt(i)] = i;
+	return t;
+})();
+/**
+* decodes an unpadded RFC 4648 base32 (lowercase) string to a Uint8Array
+* @param str base32 encoded string
+* @returns decoded buffer
+* @throws {SyntaxError} on invalid characters or malformed trailing bits
+*/
+const fromBase32 = (str) => {
+	const end = str.length;
+	const bytes = allocUnsafe(end * 5 / 8 | 0);
+	let written = 0;
+	let i = 0;
+	const fullGroups = end - end % 8;
+	for (; i < fullGroups; i += 8) {
+		const c0 = _decodeLut[str.charCodeAt(i)];
+		const c1 = _decodeLut[str.charCodeAt(i + 1)];
+		const c2 = _decodeLut[str.charCodeAt(i + 2)];
+		const c3 = _decodeLut[str.charCodeAt(i + 3)];
+		const c4 = _decodeLut[str.charCodeAt(i + 4)];
+		const c5 = _decodeLut[str.charCodeAt(i + 5)];
+		const c6 = _decodeLut[str.charCodeAt(i + 6)];
+		const c7 = _decodeLut[str.charCodeAt(i + 7)];
+		if ((c0 | c1 | c2 | c3 | c4 | c5 | c6 | c7) & 224) throw new SyntaxError(`invalid base string`);
+		bytes[written] = c0 << 3 | c1 >>> 2;
+		bytes[written + 1] = (c1 << 6 | c2 << 1 | c3 >>> 4) & 255;
+		bytes[written + 2] = (c3 << 4 | c4 >>> 1) & 255;
+		bytes[written + 3] = (c4 << 7 | c5 << 2 | c6 >>> 3) & 255;
+		bytes[written + 4] = (c6 << 5 | c7) & 255;
+		written += 5;
+	}
+	if (i < end) {
+		let bits = 0;
+		let buffer = 0;
+		for (; i < end; ++i) {
+			const value = _decodeLut[str.charCodeAt(i)];
+			if (value & 224) throw new SyntaxError(`invalid base string`);
+			buffer = buffer << 5 | value;
+			bits += 5;
+			if (bits >= 8) {
+				bits -= 8;
+				bytes[written++] = 255 & buffer >> bits;
+			}
+		}
+		if (bits >= 5 || (255 & buffer << 8 - bits) !== 0) throw new SyntaxError(`unexpected end of data`);
+	}
+	return bytes;
+};
+
+//#endregion
+//#region ../../packages/registry-client/dist/types-BKvoAsmc.js
+const SOURCE_ARTIFACT_KEYS = new Set([
+	"$type",
+	"package",
+	"icon",
+	"banner",
+	"screenshots"
+]);
+const IMAGE_CONTENT_TYPES = new Set([
+	"image/jpeg",
+	"image/png",
+	"image/webp"
+]);
+function isRecord$1(value) {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isHttpsUrl(value) {
+	if (typeof value !== "string") return false;
+	try {
+		const url = new URL(value);
+		return url.protocol === "https:" && url.username === "" && url.password === "" && url.hash === "";
+	} catch {
+		return false;
+	}
+}
+function isCanonicalSha256Multihash(value) {
+	if (typeof value !== "string" || !value.startsWith("b")) return false;
+	try {
+		const bytes = fromBase32(value.slice(1));
+		return bytes.length === 34 && bytes[0] === 18 && bytes[1] === 32 && `b${toBase32(bytes)}` === value;
+	} catch {
+		return false;
+	}
+}
+function validSourceArtifact(value, image) {
+	if (!isRecord$1(value) || Object.hasOwn(value, "blob") || Object.hasOwn(value, "requiresAuth") || !isHttpsUrl(value["url"]) || !isCanonicalSha256Multihash(value["checksum"])) return false;
+	const contentType = value["contentType"];
+	return contentType === void 0 ? true : image ? typeof contentType === "string" && IMAGE_CONTENT_TYPES.has(contentType) : contentType === "application/gzip";
+}
+function validSourceArtifacts(value) {
+	if (!isRecord$1(value) || Object.keys(value).some((key) => !SOURCE_ARTIFACT_KEYS.has(key)) || !validSourceArtifact(value["package"], false) || value["icon"] !== void 0 && !validSourceArtifact(value["icon"], true) || value["banner"] !== void 0 && !validSourceArtifact(value["banner"], true)) return false;
+	const screenshots = value["screenshots"];
+	return screenshots === void 0 || Array.isArray(screenshots) && screenshots.every((artifact) => validSourceArtifact(artifact, true));
+}
+function isDelegatedReleaseSourceRecord(release, envelope) {
+	if (Object.hasOwn(release, "auth") || !validSourceArtifacts(release.artifacts) || envelope !== void 0 && (release.package !== envelope.packageSlug || release.version !== envelope.version) || !isRecord$1(release.extensions)) return false;
+	const extension = /* @__PURE__ */ safeParse(releaseExtension_exports.mainSchema, release.extensions[NSID.packageReleaseExtension]);
+	return extension.ok && extension.value.provenance !== void 0 && isHttpsUrl(extension.value.provenance.url) && isCanonicalSha256Multihash(extension.value.provenance.checksum);
+}
+function parseDelegatedReleaseSourceRecord(value, envelope) {
+	const release = /* @__PURE__ */ safeParse(release_exports.mainSchema, value);
+	return release.ok && isDelegatedReleaseSourceRecord(release.value, envelope) ? release.value : null;
+}
+const TERMINAL_RELEASE_INTENT_STATES = new Set([
+	"published",
+	"invalid",
+	"rejected",
+	"cancelled",
+	"expired",
+	"failed",
+	"conflict"
+]);
+
+//#endregion
+//#region ../../packages/registry-client/dist/release-service/index.js
+const DID_PATTERN = /^did:[a-z0-9]+:[A-Za-z0-9._:%-]+$/;
+const ULID_PATTERN = /^[0-9A-HJKMNP-TV-Z]{26}$/;
+const PACKAGE_SLUG_PATTERN = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
+const VERSION_PATTERN = /^[0-9A-Za-z][0-9A-Za-z.-]{0,127}$/;
+const CID_PATTERN = /^[A-Za-z0-9]+$/;
+const IDEMPOTENCY_KEY_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{15,127}$/;
+const DIGITS_PATTERN = /^[0-9]+$/;
+const POSITIVE_INTEGER_PATTERN$1 = /^[1-9][0-9]*$/;
+const CSRF_TOKEN_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+const DIGEST_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+const API_ERROR_CODES = {
+	ACCESS_DENIED: true,
+	ACCESS_AUTH_INVALID: true,
+	ACCESS_AUTH_REQUIRED: true,
+	APPROVAL_INVALID: true,
+	APPROVER_SESSION_INVALID: true,
+	APPROVER_SUSPENDED: true,
+	ARCHIVE_OPERATION_FAILED: true,
+	AUTH_INVALID: true,
+	CONFIGURATION_ERROR: true,
+	CREDENTIAL_LIMIT_REACHED: true,
+	CREDENTIAL_NOT_FOUND: true,
+	CREDENTIAL_REVOKED: true,
+	CSRF_INVALID: true,
+	DELEGATION_REQUIRED: true,
+	ENCRYPTION_OPERATION_FAILED: true,
+	IDEMPOTENCY_KEY_INVALID: true,
+	IDEMPOTENCY_CONFLICT: true,
+	INTERNAL_ERROR: true,
+	INVALID_REQUEST: true,
+	INTENT_NOT_APPROVABLE: true,
+	INTENT_NOT_CANCELLABLE: true,
+	METHOD_NOT_ALLOWED: true,
+	NOT_FOUND: true,
+	OAUTH_AUTHORIZATION_FAILED: true,
+	OAUTH_CALLBACK_INVALID: true,
+	PROFILE_CHANGED: true,
+	PROFILE_FETCH_FAILED: true,
+	PUBLISHER_SESSION_INVALID: true,
+	PUBLISHER_SUSPENDED: true,
+	RELEASE_EXISTS: true,
+	RESTORE_OPERATION_FAILED: true,
+	SERVICE_PAUSED: true,
+	SERVICE_UNAVAILABLE: true,
+	VERSION_RESERVED: true,
+	WORKFLOW_UNAVAILABLE: true,
+	WORKLOAD_NOT_ALLOWED: true,
+	WORKLOAD_RATE_LIMITED: true
+};
+const RETRYABLE_ERROR_CODES = new Set([
+	"CONFIGURATION_ERROR",
+	"INTERNAL_ERROR",
+	"NETWORK_ERROR",
+	"PROFILE_FETCH_FAILED",
+	"PUBLISHER_SUSPENDED",
+	"SERVICE_PAUSED",
+	"SERVICE_UNAVAILABLE",
+	"WORKFLOW_UNAVAILABLE",
+	"WORKLOAD_RATE_LIMITED"
+]);
+const INTENT_STATES = {
+	received: true,
+	verifying: true,
+	verified: true,
+	awaiting_approval: true,
 	ready: true,
 	publishing: true,
 	reconciling: true,
@@ -1025,7 +1660,7 @@ function parseIntent(value, serviceUrl) {
 	const updatedAt = safeInteger(value, "updatedAt");
 	const result = parseIntentResult(value["result"]);
 	const approvalUrl = nullableString(value, "approvalUrl");
-	if (!id || !ULID_PATTERN.test(id) || !publisherDid || !DID_PATTERN.test(publisherDid) || !packageSlug || !PACKAGE_SLUG_PATTERN.test(packageSlug) || !version || !VERSION_PATTERN.test(version) || !isIntentState(state) || stateGeneration === null || stateGeneration < 1 || reasonCode === void 0 || workflowId === void 0 || expiresAt === null || createdAt === null || updatedAt === null || result === void 0 || approvalUrl === void 0 || workflowId !== null && !ULID_PATTERN.test(workflowId) || createdAt > updatedAt || updatedAt > expiresAt || result !== null && (result.uri !== `at://${publisherDid}/com.emdashcms.experimental.package.release/${packageSlug}:${version}` || !CID_PATTERN.test(result.cid))) throw invalidResponse();
+	if (!id || !ULID_PATTERN.test(id) || !publisherDid || !DID_PATTERN.test(publisherDid) || !packageSlug || !PACKAGE_SLUG_PATTERN.test(packageSlug) || !version || !VERSION_PATTERN.test(version) || !isIntentState(state) || stateGeneration === null || stateGeneration < 1 || reasonCode === void 0 || workflowId === void 0 || expiresAt === null || createdAt === null || updatedAt === null || result === void 0 || approvalUrl === void 0 || workflowId !== null && !ULID_PATTERN.test(workflowId) || createdAt > updatedAt || result !== null && (result.uri !== `at://${publisherDid}/com.emdashcms.experimental.package.release/${packageSlug}:${version}` || !CID_PATTERN.test(result.cid))) throw invalidResponse();
 	if (approvalUrl !== null && serviceUrl) {
 		let parsedApproval;
 		try {
@@ -1033,7 +1668,7 @@ function parseIntent(value, serviceUrl) {
 		} catch {
 			throw invalidResponse();
 		}
-		if (parsedApproval.origin !== serviceUrl || parsedApproval.protocol !== "https:") throw invalidResponse();
+		if (parsedApproval.origin !== serviceUrl) throw invalidResponse();
 	}
 	return {
 		id,
@@ -1051,6 +1686,25 @@ function parseIntent(value, serviceUrl) {
 		approvalUrl
 	};
 }
+function parseDryRunIntent(value) {
+	if (!isRecord(value)) throw invalidResponse();
+	const publisherDid = stringValue(value, "publisherDid");
+	const packageSlug = stringValue(value, "packageSlug");
+	const version = stringValue(value, "version");
+	const workloadPolicyVersion = safeInteger(value, "workloadPolicyVersion");
+	const workloadIdentityDigest = stringValue(value, "workloadIdentityDigest");
+	const requestDigest = stringValue(value, "requestDigest");
+	if (value["allowed"] !== true || !publisherDid || !DID_PATTERN.test(publisherDid) || !packageSlug || !PACKAGE_SLUG_PATTERN.test(packageSlug) || !version || !VERSION_PATTERN.test(version) || workloadPolicyVersion === null || workloadPolicyVersion < 1 || !workloadIdentityDigest || !DIGEST_PATTERN.test(workloadIdentityDigest) || !requestDigest || !DIGEST_PATTERN.test(requestDigest)) throw invalidResponse();
+	return {
+		allowed: true,
+		publisherDid,
+		packageSlug,
+		version,
+		workloadPolicyVersion,
+		workloadIdentityDigest,
+		requestDigest
+	};
+}
 function parseStringArray(value) {
 	return Array.isArray(value) && value.every((item) => typeof item === "string") ? [...value] : null;
 }
@@ -1118,6 +1772,36 @@ function parsePublisher(value) {
 		...sessionExpiresAt === void 0 ? {} : { sessionExpiresAt: Number(sessionExpiresAt) }
 	};
 }
+function parsePublisherAuditEvent(value) {
+	if (!isRecord(value)) throw invalidResponse();
+	const sequence = safeInteger(value, "sequence");
+	const eventType = stringValue(value, "eventType");
+	const actorRealm = value["actorRealm"];
+	const actorIdentity = stringValue(value, "actorIdentity");
+	const subject = stringValue(value, "subject");
+	const reasonCode = nullableString(value, "reasonCode");
+	const createdAt = safeInteger(value, "createdAt");
+	if (sequence === null || sequence < 1 || !eventType || actorRealm !== "access" && actorRealm !== "approver" && actorRealm !== "oidc" && actorRealm !== "publisher" && actorRealm !== "system" || !actorIdentity || !subject || reasonCode === void 0 || createdAt === null) throw invalidResponse();
+	return {
+		sequence,
+		eventType,
+		actorRealm,
+		actorIdentity,
+		subject,
+		reasonCode,
+		createdAt
+	};
+}
+function parsePublisherApproverStatus(value) {
+	if (!isRecord(value)) throw invalidResponse();
+	const did = stringValue(value, "did");
+	const status = value["status"];
+	if (!did || !DID_PATTERN.test(did) || status !== "enrolled" && status !== "not_enrolled" && status !== "revoked") throw invalidResponse();
+	return {
+		did,
+		status
+	};
+}
 function invalidResponse(requestId = null) {
 	return new ReleaseServiceError({
 		code: "CLIENT_RESPONSE_INVALID",
@@ -1234,12 +1918,23 @@ var ReleaseServiceClient = class extends BaseReleaseServiceClient {
 		});
 	}
 	async submitIntent(input, options) {
+		const release = parseDelegatedReleaseSourceRecord(input.release, {
+			packageSlug: input.packageSlug,
+			version: input.version
+		});
+		if (!release) throw new ReleaseServiceError({
+			code: "INVALID_REQUEST",
+			message: "Delegated release source record is invalid"
+		});
 		const headers = await this.#workloadHeaders(options.idempotencyKey);
 		headers.set("content-type", "application/json");
 		return await this.call("/v1/release-intents", {
 			method: "POST",
 			headers,
-			body: JSON.stringify(input),
+			body: JSON.stringify({
+				...input,
+				release
+			}),
 			signal: options.signal
 		}, (value) => {
 			if (!isRecord(value) || typeof value["replayed"] !== "boolean") throw invalidResponse();
@@ -1249,6 +1944,27 @@ var ReleaseServiceClient = class extends BaseReleaseServiceClient {
 			};
 		});
 	}
+	async dryRunIntent(input, options = {}) {
+		const release = parseDelegatedReleaseSourceRecord(input.release, {
+			packageSlug: input.packageSlug,
+			version: input.version
+		});
+		if (!release) throw new ReleaseServiceError({
+			code: "INVALID_REQUEST",
+			message: "Delegated release source record is invalid"
+		});
+		const headers = await this.#workloadHeaders();
+		headers.set("content-type", "application/json");
+		return await this.call("/v1/release-intents/dry-run", {
+			method: "POST",
+			headers,
+			body: JSON.stringify({
+				...input,
+				release
+			}),
+			signal: options.signal
+		}, parseDryRunIntent);
+	}
 	async getIntent(publisherDid, intentId, options = {}) {
 		const headers = await this.#workloadHeaders();
 		return await this.call(`/v1/release-intents/${encodeURIComponent(intentId)}?publisher=${encodeURIComponent(publisherDid)}`, {
@@ -1364,6 +2080,48 @@ var ReleaseServiceClient = class extends BaseReleaseServiceClient {
 			signal: options.signal
 		}, (value) => parsePage(value, (item) => parseIntent(item, this.serviceUrl)));
 	}
+	async listPublisherAudit(options = {}) {
+		const url = new URL("/v1/publisher/audit", this.serviceUrl);
+		if (options.cursor) {
+			if (!POSITIVE_INTEGER_PATTERN$1.test(options.cursor)) throw new ReleaseServiceError({
+				code: "CLIENT_RESPONSE_INVALID",
+				message: "Audit cursor is invalid"
+			});
+			url.searchParams.set("cursor", options.cursor);
+		}
+		if (options.limit !== void 0) {
+			if (!Number.isSafeInteger(options.limit) || options.limit < 1 || options.limit > 100) throw new ReleaseServiceError({
+				code: "CLIENT_RESPONSE_INVALID",
+				message: "Audit limit is invalid"
+			});
+			url.searchParams.set("limit", String(options.limit));
+		}
+		return await this.call(`${url.pathname}${url.search}`, {
+			method: "GET",
+			credentials: "include",
+			signal: options.signal
+		}, (value) => parsePage(value, parsePublisherAuditEvent));
+	}
+	async getPublisherApproverStatus(packageSlug) {
+		if (!PACKAGE_SLUG_PATTERN.test(packageSlug)) throw new ReleaseServiceError({
+			code: "CLIENT_RESPONSE_INVALID",
+			message: "Package slug is invalid"
+		});
+		return await this.call(`/v1/publisher/workloads/${encodeURIComponent(packageSlug)}/approvers`, {
+			method: "GET",
+			credentials: "include"
+		}, (value) => {
+			if (!isRecord(value) || !Array.isArray(value["items"])) throw invalidResponse();
+			const returnedPackageSlug = stringValue(value, "packageSlug");
+			const profileCid = stringValue(value, "profileCid");
+			if (returnedPackageSlug !== packageSlug || !profileCid || !CID_PATTERN.test(profileCid)) throw invalidResponse();
+			return {
+				packageSlug: returnedPackageSlug,
+				profileCid,
+				items: value["items"].map(parsePublisherApproverStatus)
+			};
+		});
+	}
 };
 function parsePage(value, parseItem) {
 	if (!isRecord(value) || !Array.isArray(value["items"])) throw invalidResponse();
@@ -1375,146 +2133,6 @@ function parsePage(value, parseItem) {
 	};
 }
 
-//#endregion
-//#region ../../packages/registry-lexicons/dist/chunk-BYypO7fO.js
-var __defProp = Object.defineProperty;
-var __exportAll = (all, no_symbols) => {
-	let target = {};
-	for (var name in all) __defProp(target, name, {
-		get: all[name],
-		enumerable: true
-	});
-	if (!no_symbols) __defProp(target, Symbol.toStringTag, { value: "Module" });
-	return target;
-};
-
-//#endregion
-//#region ../../packages/registry-lexicons/dist/generated/types/com/emdashcms/experimental/package/release.js
-var release_exports = /* @__PURE__ */ __exportAll({
-	artifactSchema: () => artifactSchema,
-	artifactsSchema: () => artifactsSchema,
-	mainSchema: () => mainSchema,
-	sbomSchema: () => sbomSchema
-});
-const _artifactSchema = /* @__PURE__ */ object({
-	$type: /* @__PURE__ */ optional(/* @__PURE__ */ literal("com.emdashcms.experimental.package.release#artifact")),
-	checksum: /* @__PURE__ */ constrain(/* @__PURE__ */ string(), [/* @__PURE__ */ stringLength(0, 256)]),
-	contentType: /* @__PURE__ */ optional(/* @__PURE__ */ constrain(/* @__PURE__ */ string(), [/* @__PURE__ */ stringLength(0, 256)])),
-	height: /* @__PURE__ */ optional(/* @__PURE__ */ constrain(/* @__PURE__ */ integer(), [/* @__PURE__ */ integerRange(1, 8192)])),
-	id: /* @__PURE__ */ optional(/* @__PURE__ */ constrain(/* @__PURE__ */ string(), [/* @__PURE__ */ stringLength(0, 128)])),
-	lang: /* @__PURE__ */ optional(/* @__PURE__ */ languageCodeString()),
-	releaseAsset: /* @__PURE__ */ optional(/* @__PURE__ */ boolean()),
-	requiresAuth: /* @__PURE__ */ optional(/* @__PURE__ */ boolean()),
-	signature: /* @__PURE__ */ optional(/* @__PURE__ */ constrain(/* @__PURE__ */ string(), [/* @__PURE__ */ stringLength(0, 1024)])),
-	url: /* @__PURE__ */ constrain(/* @__PURE__ */ genericUriString(), [/* @__PURE__ */ stringLength(0, 2048)]),
-	width: /* @__PURE__ */ optional(/* @__PURE__ */ constrain(/* @__PURE__ */ integer(), [/* @__PURE__ */ integerRange(1, 8192)]))
-});
-const _artifactsSchema = /* @__PURE__ */ object({
-	$type: /* @__PURE__ */ optional(/* @__PURE__ */ literal("com.emdashcms.experimental.package.release#artifacts")),
-	get banner() {
-		return /* @__PURE__ */ optional(artifactSchema);
-	},
-	get icon() {
-		return /* @__PURE__ */ optional(artifactSchema);
-	},
-	get package() {
-		return artifactSchema;
-	},
-	get screenshots() {
-		return /* @__PURE__ */ optional(/* @__PURE__ */ constrain(/* @__PURE__ */ array(artifactSchema), [/* @__PURE__ */ arrayLength(0, 8)]));
-	}
-});
-const _mainSchema = /* @__PURE__ */ record(/* @__PURE__ */ string(), /* @__PURE__ */ object({
-	$type: /* @__PURE__ */ literal("com.emdashcms.experimental.package.release"),
-	get artifacts() {
-		return artifactsSchema;
-	},
-	auth: /* @__PURE__ */ optional(/* @__PURE__ */ unknown()),
-	extensions: /* @__PURE__ */ optional(/* @__PURE__ */ unknown()),
-	package: /* @__PURE__ */ constrain(/* @__PURE__ */ string(), [/* @__PURE__ */ stringLength(1, 64)]),
-	provides: /* @__PURE__ */ optional(/* @__PURE__ */ unknown()),
-	repo: /* @__PURE__ */ optional(/* @__PURE__ */ constrain(/* @__PURE__ */ genericUriString(), [/* @__PURE__ */ stringLength(0, 1024)])),
-	requires: /* @__PURE__ */ optional(/* @__PURE__ */ unknown()),
-	get sbom() {
-		return /* @__PURE__ */ optional(sbomSchema);
-	},
-	suggests: /* @__PURE__ */ optional(/* @__PURE__ */ unknown()),
-	version: /* @__PURE__ */ constrain(/* @__PURE__ */ string(), [/* @__PURE__ */ stringLength(1, 64)])
-}));
-const _sbomSchema = /* @__PURE__ */ object({
-	$type: /* @__PURE__ */ optional(/* @__PURE__ */ literal("com.emdashcms.experimental.package.release#sbom")),
-	checksum: /* @__PURE__ */ optional(/* @__PURE__ */ constrain(/* @__PURE__ */ string(), [/* @__PURE__ */ stringLength(0, 256)])),
-	format: /* @__PURE__ */ optional(/* @__PURE__ */ constrain(/* @__PURE__ */ string(), [/* @__PURE__ */ stringLength(0, 32)])),
-	url: /* @__PURE__ */ optional(/* @__PURE__ */ constrain(/* @__PURE__ */ genericUriString(), [/* @__PURE__ */ stringLength(0, 2048)]))
-});
-const artifactSchema = _artifactSchema;
-const artifactsSchema = _artifactsSchema;
-const mainSchema = _mainSchema;
-const sbomSchema = _sbomSchema;
-
-//#endregion
-//#region ../../packages/registry-lexicons/dist/index.js
-/**
-* NSID constants for the lexicons defined by this package. Useful for consumers
-* that need to reference a record collection by string (e.g. when issuing
-* `listRecords` or `putRecord` calls against a PDS).
-*/
-const NSID = {
-	packageProfile: "com.emdashcms.experimental.package.profile",
-	packageProfileExtension: "com.emdashcms.experimental.package.profileExtension",
-	packageRelease: "com.emdashcms.experimental.package.release",
-	packageReleaseExtension: "com.emdashcms.experimental.package.releaseExtension",
-	publisherProfile: "com.emdashcms.experimental.publisher.profile",
-	publisherVerification: "com.emdashcms.experimental.publisher.verification",
-	aggregatorDefs: "com.emdashcms.experimental.aggregator.defs",
-	aggregatorGetLatestRelease: "com.emdashcms.experimental.aggregator.getLatestRelease",
-	aggregatorGetPackage: "com.emdashcms.experimental.aggregator.getPackage",
-	aggregatorListReleases: "com.emdashcms.experimental.aggregator.listReleases",
-	aggregatorResolvePackage: "com.emdashcms.experimental.aggregator.resolvePackage",
-	aggregatorSearchPackages: "com.emdashcms.experimental.aggregator.searchPackages",
-	labelerDefs: "com.emdashcms.experimental.labeler.defs",
-	labelerGetAssessment: "com.emdashcms.experimental.labeler.getAssessment",
-	labelerGetCurrentAssessment: "com.emdashcms.experimental.labeler.getCurrentAssessment",
-	labelerGetPolicy: "com.emdashcms.experimental.labeler.getPolicy",
-	labelerListAssessments: "com.emdashcms.experimental.labeler.listAssessments"
-};
-const DELEGATED_RELEASE_PERMISSION = Object.freeze({
-	collection: NSID.packageRelease,
-	scope: `atproto repo:${NSID.packageRelease}?action=create`
-});
-/**
-* NSIDs of record-shaped lexicons in this package (one row per NSID in the
-* publisher's repo). Embedded objects (`profileExtension`, `releaseExtension`) and shared defs
-* (`aggregator.defs`) are excluded — they don't address their own collection.
-*
-* Useful for consumers building OAuth `repo:` scopes or enumerating writable
-* collections without hand-rolling a list that drifts from the lexicons.
-*/
-const RECORD_NSIDS = [
-	NSID.packageProfile,
-	NSID.packageRelease,
-	NSID.publisherProfile,
-	NSID.publisherVerification
-];
-/**
-* NSIDs of query-shaped lexicons in this package (read-only XRPC methods on
-* the aggregator). Procedures and shared defs are excluded.
-*
-* Useful for consumers building OAuth `rpc:` scopes or enumerating callable
-* AppView endpoints.
-*/
-const QUERY_NSIDS = [
-	NSID.aggregatorGetLatestRelease,
-	NSID.aggregatorGetPackage,
-	NSID.aggregatorListReleases,
-	NSID.aggregatorResolvePackage,
-	NSID.aggregatorSearchPackages,
-	NSID.labelerGetAssessment,
-	NSID.labelerGetCurrentAssessment,
-	NSID.labelerGetPolicy,
-	NSID.labelerListAssessments
-];
-
 //#endregion
 //#region src/run.ts
 const POSITIVE_INTEGER_PATTERN = /^[1-9][0-9]*$/;
@@ -1577,9 +2195,8 @@ async function runAction(runtime, dependencies = {}) {
 	const releaseFile = runtime.getInput("release-file", { required: true });
 	const workspace = runtime.getEnvironment("GITHUB_WORKSPACE");
 	if (!workspace) throw new ActionConfigurationError("GitHub workspace is unavailable");
-	const rawRelease = await (dependencies.readReleaseRecord ?? defaultReadReleaseRecord)(releaseFile, workspace);
-	const release = /* @__PURE__ */ safeParse(release_exports.mainSchema, rawRelease);
-	if (!release.ok) throw new ActionConfigurationError("Release record file is invalid");
+	const release = parseDelegatedReleaseSourceRecord(await (dependencies.readReleaseRecord ?? defaultReadReleaseRecord)(releaseFile, workspace));
+	if (!release) throw new ActionConfigurationError("Release record file is invalid");
 	const idempotencyKey = runtime.getInput("idempotency-key") || defaultIdempotencyKey(runtime);
 	const pollIntervalSeconds = parsePositiveInteger(runtime.getInput("poll-interval-seconds") || "5", "poll-interval-seconds", 300);
 	const timeoutMinutes = parsePositiveInteger(runtime.getInput("timeout-minutes") || "30", "timeout-minutes", 360);
@@ -1595,9 +2212,9 @@ async function runAction(runtime, dependencies = {}) {
 	});
 	const submitted = await client.submitIntent({
 		publisherDid,
-		packageSlug: release.value.package,
-		version: release.value.version,
-		release: release.value
+		packageSlug: release.package,
+		version: release.version,
+		release
 	}, { idempotencyKey });
 	runtime.info(submitted.replayed ? `Reusing release intent ${submitted.intent.id}` : `Submitted release intent ${submitted.intent.id}`);
 	let previousState = submitted.intent.state;
diff --git a/apps/release-service/e2e/web-surfaces.spec.ts b/apps/release-service/e2e/web-surfaces.spec.ts
new file mode 100644
index 0000000000..bac0f41521
--- /dev/null
+++ b/apps/release-service/e2e/web-surfaces.spec.ts
@@ -0,0 +1,373 @@
+import { Buffer } from "node:buffer";
+
+import { expect, test } from "@playwright/test";
+
+import { addVirtualWebAuthnAuthenticator } from "../../../e2e/fixtures/virtual-authenticator.js";
+
+const PUBLISHER_DID = "did:web:publisher.example.com";
+const INTENT_ID = "01JABCDEFGHJKMNPQRSTVWXYZ0";
+const BASE_URL = "http://localhost:5185";
+const WEB_IDEMPOTENCY_KEY = /^web-/;
+const OIDC_PERMISSION_PATTERN = /id-token: write/;
+
+function success(data: unknown) {
+	return {
+		status: 200,
+		contentType: "application/json",
+		body: JSON.stringify({ data, requestId: "pw" }),
+	};
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+test("Access denies an unauthenticated operator API request", async ({ request }) => {
+	const response = await request.get("/admin/api/status");
+	expect(response.status()).toBe(401);
+	expect(response.headers()["content-type"]).toContain("application/json");
+	expect(await response.json()).toMatchObject({ error: { code: "ACCESS_AUTH_REQUIRED" } });
+});
+
+test("publisher login sends mutation fencing and remains RTL-safe on mobile", async ({ page }) => {
+	await page.setViewportSize({ width: 390, height: 844 });
+	let authorizationRequest: { body: unknown; headers: Record<string, string> } | null = null;
+	await page.route("**/v1/publisher**", async (route) => {
+		const request = route.request();
+		const path = new URL(request.url()).pathname;
+		if (path === "/v1/publisher/session/authorize" && request.method() === "POST") {
+			authorizationRequest = {
+				body: request.postDataJSON(),
+				headers: await request.allHeaders(),
+			};
+			await route.fulfill(success({ authorizationUrl: `${BASE_URL}/oauth/mock` }));
+			return;
+		}
+		await route.fulfill({
+			status: 401,
+			contentType: "application/json",
+			body: JSON.stringify({
+				error: { code: "PUBLISHER_SESSION_INVALID", message: "Publisher session is not valid" },
+				requestId: "pw",
+			}),
+		});
+	});
+
+	await page.goto("/publisher?locale=ar");
+	await expect(page.getByRole("heading", { name: "Sign in" })).toBeVisible();
+	expect(await page.locator("html").getAttribute("dir")).toBe("rtl");
+	expect(
+		await page.evaluate(
+			() => document.documentElement.scrollWidth <= document.documentElement.clientWidth,
+		),
+	).toBe(true);
+	await page.getByLabel("Account handle").fill("publisher.example.com");
+	await page.getByRole("button", { name: "Sign in with Atmosphere" }).click();
+	await page.waitForURL("**/oauth/mock");
+
+	expect(authorizationRequest).not.toBeNull();
+	expect(authorizationRequest!.headers["x-emdash-request"]).toBe("1");
+	expect(authorizationRequest!.headers["origin"]).toBe(BASE_URL);
+	expect(authorizationRequest!.body).toEqual({
+		identifier: "publisher.example.com",
+		redirectTarget: "/publisher?locale=ar",
+	});
+});
+
+test("account connects a GitHub workflow only after confirming its identity", async ({ page }) => {
+	await page.context().addCookies([
+		{
+			name: "__Host-emdash_publisher_csrf",
+			value: "C".repeat(43),
+			url: "https://localhost:5185",
+			httpOnly: false,
+			secure: true,
+			sameSite: "Strict",
+		},
+	]);
+	let confirmed = false;
+	await page.route("**/v1/**", async (route) => {
+		const request = route.request();
+		const path = new URL(request.url()).pathname;
+		if (path === "/v1/publisher") {
+			await route.fulfill(
+				success({
+					publisher: {
+						did: PUBLISHER_DID,
+						handle: "publisher.example.com",
+						delegation: {
+							releaseNsid: "com.emdashcms.experimental.package.release",
+							scope:
+								"atproto repo:com.emdashcms.experimental.package.release?action=create blob:application/gzip blob:image/*",
+							issuer: "https://authorization.example.com",
+							pdsUrl: "https://pds.example.com",
+							expiresAt: null,
+							refreshBefore: null,
+							status: "active",
+							stateVersion: 1,
+						},
+					},
+				}),
+			);
+			return;
+		}
+		if (
+			path === "/v1/publisher/workloads" ||
+			path === "/v1/publisher/intents" ||
+			path === "/v1/publisher/audit" ||
+			path === "/v1/approver/credentials"
+		) {
+			await route.fulfill(success({ items: [] }));
+			return;
+		}
+		const pairing = {
+			id: "01JABCDEFGHJKMNPQRSTVWXYZ1",
+			packageSlug: "gallery",
+			expiresAt: 1_900_000_000_000,
+			createdAt: 1_800_000_000_000,
+		};
+		const claim = {
+			repository: "example/gallery",
+			repositoryId: "123",
+			repositoryOwner: "example",
+			repositoryOwnerId: "456",
+			repositoryVisibility: "private",
+			workflowRef: "example/gallery/.github/workflows/release.yml@refs/heads/main",
+			ref: "refs/heads/main",
+			environment: null,
+		};
+		if (path === "/v1/publisher/workflow-pairings" && request.method() === "POST") {
+			await route.fulfill(
+				success({
+					pairing: {
+						...pairing,
+						state: "pending",
+						claim: null,
+						claimedAt: null,
+						confirmedAt: null,
+					},
+					pairingToken: "T".repeat(43),
+					replayed: false,
+				}),
+			);
+			return;
+		}
+		if (path.endsWith("/confirm")) {
+			confirmed = true;
+			await route.fulfill(
+				success({
+					pairing: {
+						...pairing,
+						state: "confirmed",
+						claim,
+						claimedAt: 1_800_000_001_000,
+						confirmedAt: 1_800_000_002_000,
+					},
+					policy: {
+						packageSlug: "gallery",
+						repository: "example/gallery",
+						repositoryId: "123",
+						repositoryOwnerId: "456",
+						workflowRef: "example/gallery/.github/workflows/release.yml@refs/heads/main",
+						allowedRefs: ["refs/heads/main"],
+						allowedEnvironments: [],
+						active: true,
+						stateVersion: 1,
+						authorizedBy: PUBLISHER_DID,
+						createdAt: 1_800_000_002_000,
+						updatedAt: 1_800_000_002_000,
+					},
+					replayed: false,
+				}),
+			);
+			return;
+		}
+		if (path.includes("/workflow-pairings/") && request.method() === "GET") {
+			await route.fulfill(
+				success({
+					pairing: {
+						...pairing,
+						state: "claimed",
+						claim,
+						claimedAt: 1_800_000_001_000,
+						confirmedAt: null,
+					},
+				}),
+			);
+			return;
+		}
+		await route.abort();
+	});
+
+	await page.goto("/publisher");
+	await expect(page.getByText("Signed in as @publisher.example.com")).toBeVisible();
+	await expect(page.getByText(PUBLISHER_DID)).toHaveCount(0);
+	const pluginId = page.getByLabel("Plugin ID");
+	const startConnection = page.getByRole("button", { name: "Start connection" });
+	const [pluginIdBox, startConnectionBox] = await Promise.all([
+		pluginId.boundingBox(),
+		startConnection.boundingBox(),
+	]);
+	expect(pluginIdBox).not.toBeNull();
+	expect(startConnectionBox).not.toBeNull();
+	expect(
+		Math.abs(
+			pluginIdBox!.y + pluginIdBox!.height - (startConnectionBox!.y + startConnectionBox!.height),
+		),
+	).toBeLessThan(1);
+	await pluginId.fill("gallery");
+	await startConnection.click();
+	await expect(page.getByText("Run the workflow once to identify it")).toBeVisible();
+	await expect(page.getByText(OIDC_PERMISSION_PATTERN)).toBeVisible();
+	await page.getByRole("button", { name: "I've run the workflow" }).click();
+	await expect(page.getByRole("heading", { name: "Confirm this GitHub workflow" })).toBeVisible();
+	await expect(page.getByText("example/gallery")).toBeVisible();
+	await expect(page.getByText(".github/workflows/release.yml")).toBeVisible();
+	await page.getByRole("button", { name: "Allow this workflow" }).click();
+	await expect(page.getByRole("button", { name: "Start connection" })).toBeVisible();
+	expect(confirmed).toBe(true);
+});
+
+test("approver enrols and uses a user-verified virtual passkey", async ({ page }) => {
+	const removeAuthenticator = await addVirtualWebAuthnAuthenticator(page);
+	let credentialId: string | null = null;
+	let decisionAssertion: unknown = null;
+	let decisionHeaders: Record<string, string> | null = null;
+	try {
+		await page.route("**/v1/**", async (route) => {
+			const request = route.request();
+			const url = new URL(request.url());
+			if (url.pathname === "/v1/approver/credentials" && request.method() === "GET") {
+				await route.fulfill(
+					success({
+						items: credentialId
+							? [
+									{
+										id: credentialId,
+										name: "Virtual key",
+										transports: ["internal"],
+										createdAt: Date.now(),
+										lastUsedAt: null,
+										revokedAt: null,
+									},
+								]
+							: [],
+					}),
+				);
+				return;
+			}
+			if (url.pathname === "/v1/approver/credentials/options") {
+				await route.fulfill(
+					success({
+						challenge: "AQID",
+						rp: { id: "localhost", name: "EmDash" },
+						user: { id: "BAUG", name: "did:plc:approver", displayName: "Approver" },
+						pubKeyCredParams: [{ type: "public-key", alg: -7 }],
+						authenticatorSelection: {
+							residentKey: "preferred",
+							userVerification: "required",
+						},
+						attestation: "none",
+					}),
+				);
+				return;
+			}
+			if (url.pathname === "/v1/approver/credentials" && request.method() === "POST") {
+				const body: unknown = request.postDataJSON();
+				if (
+					body === null ||
+					typeof body !== "object" ||
+					Array.isArray(body) ||
+					!("rawId" in body) ||
+					typeof body.rawId !== "string"
+				) {
+					throw new Error("Passkey registration response is invalid");
+				}
+				credentialId = body.rawId;
+				expect((await request.allHeaders())["x-emdash-request"]).toBe("1");
+				await route.fulfill(success(null));
+				return;
+			}
+			if (url.pathname.endsWith("/options")) {
+				expect((await request.allHeaders())["x-emdash-request"]).toBe("1");
+				await route.fulfill(
+					success({
+						challenge: "BwgJ",
+						rpId: "localhost",
+						userVerification: "required",
+						allowCredentials: [{ type: "public-key", id: credentialId }],
+					}),
+				);
+				return;
+			}
+			if (url.pathname === `/v1/approvals/${INTENT_ID}` && request.method() === "POST") {
+				decisionAssertion = request.postDataJSON();
+				decisionHeaders = await request.allHeaders();
+				await route.fulfill(success(null));
+				return;
+			}
+			if (url.pathname === `/v1/approvals/${INTENT_ID}`) {
+				await route.fulfill(
+					success({
+						intent: {
+							id: INTENT_ID,
+							packageSlug: "gallery",
+							version: "1.2.3",
+							state: "awaiting_approval",
+							expiresAt: Date.now() + 60_000,
+						},
+						evidence: { profileCid: "bafyprofile" },
+						evidenceDigest: "D".repeat(43),
+						review: {
+							source: {
+								repository: "example/gallery",
+								workflowRef: "example/gallery/.github/workflows/release.yml@refs/heads/main",
+								commitSha: "a".repeat(40),
+								runId: "100",
+								actor: "release-bot",
+							},
+							artifact: { url: "https://example.com/gallery.tgz", checksum: "sha256:artifact" },
+							provenance: {
+								url: "https://example.com/provenance.json",
+								checksum: "sha256:provenance",
+								predicateType: "https://slsa.dev/provenance/v1",
+								sourceRepository: "https://github.com/example/gallery",
+								builderId:
+									"https://github.com/example/gallery/.github/workflows/release.yml@refs/heads/main",
+							},
+							accessDiff: { escalation: false, changes: [] },
+						},
+					}),
+				);
+				return;
+			}
+			await route.abort();
+		});
+
+		await page.goto(`/approvals/${INTENT_ID}?publisher=${encodeURIComponent(PUBLISHER_DID)}`);
+		await expect(page.getByRole("heading", { name: "Review plugin release" })).toBeVisible();
+		await page.getByLabel("Passkey name").fill("Virtual key");
+		await page.getByRole("button", { name: "Add passkey" }).click();
+		await expect(page.getByText("Virtual key", { exact: true })).toBeVisible();
+		await page.getByRole("button", { name: "Approve release" }).click();
+		await expect(
+			page.getByText("Approval recorded. The release workflow can continue."),
+		).toBeVisible();
+		expect(decisionAssertion).toMatchObject({
+			decision: "approve",
+			response: { type: "public-key" },
+		});
+		expect(decisionHeaders?.["x-emdash-request"]).toBe("1");
+		expect(decisionHeaders?.["idempotency-key"]).toMatch(WEB_IDEMPOTENCY_KEY);
+		const credential = isRecord(decisionAssertion) ? decisionAssertion["response"] : null;
+		const assertion = isRecord(credential) ? credential["response"] : null;
+		if (!isRecord(assertion) || typeof assertion["authenticatorData"] !== "string") {
+			throw new Error("Passkey assertion response is invalid");
+		}
+		const authenticatorData = Buffer.from(assertion["authenticatorData"], "base64url");
+		expect(authenticatorData.byteLength).toBeGreaterThan(32);
+		expect(authenticatorData[32]! & 0x04).toBe(0x04);
+	} finally {
+		await removeAuthenticator();
+	}
+});
diff --git a/apps/release-service/package.json b/apps/release-service/package.json
index 4014b3eefd..c064e3e7bd 100644
--- a/apps/release-service/package.json
+++ b/apps/release-service/package.json
@@ -11,8 +11,10 @@
 		"deploy": "vite build && wrangler deploy",
 		"typecheck": "tsgo --noEmit && tsgo --noEmit -p tsconfig.ui.json",
 		"pretest": "vite build",
-		"test": "vitest run && pnpm run test:ui",
+		"test": "vitest run && pnpm run test:encryption-v2 && pnpm run test:ui",
+		"test:encryption-v2": "vitest run --config vitest.encryption-v2.config.ts",
 		"test:ui": "vitest run --config vitest.ui.config.ts",
+		"test:browser": "playwright test --config playwright.config.ts",
 		"types": "wrangler types"
 	},
 	"dependencies": {
@@ -38,6 +40,7 @@
 	"devDependencies": {
 		"@cloudflare/vite-plugin": "catalog:",
 		"@cloudflare/vitest-pool-workers": "catalog:",
+		"@playwright/test": "^1.61.1",
 		"@tailwindcss/vite": "^4.3.3",
 		"@testing-library/react": "^16.3.0",
 		"@types/react": "catalog:",
diff --git a/apps/release-service/playwright.config.ts b/apps/release-service/playwright.config.ts
new file mode 100644
index 0000000000..e0e02cba28
--- /dev/null
+++ b/apps/release-service/playwright.config.ts
@@ -0,0 +1,25 @@
+import { defineConfig, devices } from "@playwright/test";
+
+import { TEST_BINDINGS } from "./test/fixtures/oauth.js";
+
+export default defineConfig({
+	testDir: "./e2e",
+	fullyParallel: false,
+	workers: 1,
+	retries: 0,
+	reporter: "list",
+	timeout: 30_000,
+	use: {
+		baseURL: "http://localhost:5185",
+		trace: "on-first-retry",
+		screenshot: "only-on-failure",
+		...devices["Desktop Chrome"],
+	},
+	webServer: {
+		command: "pnpm dev --host 127.0.0.1 --port 5185",
+		url: "http://localhost:5185/health",
+		reuseExistingServer: false,
+		timeout: 60_000,
+		env: { ...process.env, ...TEST_BINDINGS },
+	},
+});
diff --git a/apps/release-service/src/access/auth.ts b/apps/release-service/src/access/auth.ts
index e825c25722..f1714048c2 100644
--- a/apps/release-service/src/access/auth.ts
+++ b/apps/release-service/src/access/auth.ts
@@ -14,7 +14,7 @@ export type AccessRole = "viewer" | "reviewer" | "admin";
 
 export interface AccessConfiguration {
 	teamDomain: string;
-	audiences: Readonly<Record<AccessRole, string>>;
+	audiences: Readonly<Record<AccessRole, string | readonly string[]>>;
 }
 
 export interface AccessActor {
@@ -62,9 +62,11 @@ export async function authenticateAccessRequest(
 		throw new ApiError("ACCESS_AUTH_INVALID", 403, "Access authorization failed");
 	}
 	try {
+		const configuredAudience = configuration.audiences[requiredRole];
 		const { payload } = await jwtVerify(token, keyResolver, {
 			algorithms: ["RS256"],
-			audience: configuration.audiences[requiredRole],
+			audience:
+				typeof configuredAudience === "string" ? configuredAudience : [...configuredAudience],
 			clockTolerance: 5,
 			issuer: configuration.teamDomain,
 			typ: "JWT",
diff --git a/apps/release-service/src/api/errors.ts b/apps/release-service/src/api/errors.ts
index 0a851c783b..2c1cdebb14 100644
--- a/apps/release-service/src/api/errors.ts
+++ b/apps/release-service/src/api/errors.ts
@@ -24,6 +24,11 @@ export type ApiErrorCode =
 	| "METHOD_NOT_ALLOWED"
 	| "OAUTH_AUTHORIZATION_FAILED"
 	| "OAUTH_CALLBACK_INVALID"
+	| "PAIRING_CONFLICT"
+	| "PAIRING_EXPIRED"
+	| "PAIRING_INVALID"
+	| "PAIRING_LIMIT_REACHED"
+	| "PAIRING_NOT_CLAIMED"
 	| "PUBLISHER_SESSION_INVALID"
 	| "PUBLISHER_SUSPENDED"
 	| "PROFILE_CHANGED"
diff --git a/apps/release-service/src/approvals/authority.ts b/apps/release-service/src/approvals/authority.ts
index 1fe26349ce..d4a7fb3469 100644
--- a/apps/release-service/src/approvals/authority.ts
+++ b/apps/release-service/src/approvals/authority.ts
@@ -2,7 +2,7 @@ import type { ActorResolver } from "@atcute/identity-resolver";
 import { safeParse } from "@atcute/lexicons";
 import { isDid } from "@atcute/lexicons/syntax";
 import { NSID, PackageProfile, PackageProfileExtension } from "@emdash-cms/registry-lexicons";
-import { fetchVerifiedResource } from "@emdash-cms/registry-verification";
+import { fetchVerifiedResource } from "@emdash-cms/registry-verification/fetch";
 
 import { createWorkerActorResolver } from "../oauth/custody.js";
 import type {
@@ -15,6 +15,7 @@ import { decodeAwaitingApprovalState, type ApprovalEvidence } from "./digest.js"
 const DNS_ENDPOINT = "https://cloudflare-dns.com/dns-query";
 const MAX_DNS_RESPONSE_BYTES = 64 * 1024;
 const MAX_PROFILE_RESPONSE_BYTES = 256 * 1024;
+const PACKAGE_SLUG_PATTERN = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
 
 export type ApprovalAuthorityErrorCode =
 	| "APPROVAL_EVIDENCE_INVALID"
@@ -45,6 +46,11 @@ export interface VerifyCurrentApproverOptions {
 	fetch?: typeof globalThis.fetch;
 }
 
+export interface CurrentApprovalPolicy {
+	profileCid: string;
+	approverDids: readonly string[];
+}
+
 function isRecord(value: unknown): value is Record<string, unknown> {
 	return value !== null && typeof value === "object" && !Array.isArray(value);
 }
@@ -244,20 +250,41 @@ export async function verifyCurrentApprover(
 	if (!isDid(evidence.publisherDid) || !isDid(approverDid)) {
 		throw new ApprovalAuthorityError("APPROVAL_EVIDENCE_INVALID");
 	}
+	const policy = await loadCurrentApprovalPolicy(
+		evidence.publisherDid,
+		evidence.packageSlug,
+		options,
+	);
+	if (!policy.approverDids.includes(approverDid)) {
+		throw new ApprovalAuthorityError("APPROVER_NOT_AUTHORIZED");
+	}
+	if (policy.profileCid !== evidence.profileCid) {
+		throw new ApprovalAuthorityError("PROFILE_CHANGED");
+	}
+}
+
+export async function loadCurrentApprovalPolicy(
+	publisherDid: string,
+	packageSlug: string,
+	options: VerifyCurrentApproverOptions = {},
+): Promise<CurrentApprovalPolicy> {
+	if (!isDid(publisherDid) || !PACKAGE_SLUG_PATTERN.test(packageSlug)) {
+		throw new ApprovalAuthorityError("PROFILE_FETCH_FAILED");
+	}
 	const fetchImplementation = options.fetch ?? globalThis.fetch;
 	let actor;
 	try {
 		actor = await (
 			options.actorResolver ??
 			createWorkerActorResolver(createGuardedIdentityFetch(fetchImplementation))
-		).resolve(evidence.publisherDid, { signal: AbortSignal.timeout(30_000), noCache: true });
+		).resolve(publisherDid, { signal: AbortSignal.timeout(30_000), noCache: true });
 	} catch {
 		throw new ApprovalAuthorityError("PROFILE_FETCH_FAILED");
 	}
-	if (actor.did !== evidence.publisherDid) {
+	if (actor.did !== publisherDid) {
 		throw new ApprovalAuthorityError("PROFILE_FETCH_FAILED");
 	}
-	const requestedUrl = profileRecordUrl(actor.pds, evidence.publisherDid, evidence.packageSlug);
+	const requestedUrl = profileRecordUrl(actor.pds, publisherDid, packageSlug);
 	const resource = await fetchVerifiedResource(requestedUrl, {
 		fetch: (url, init) => fetchImplementation(url, init),
 		resolveHostname: (hostname) => resolvePublicHostname(hostname, fetchImplementation),
@@ -277,7 +304,7 @@ export async function verifyCurrentApprover(
 	} catch {
 		throw new ApprovalAuthorityError("PROFILE_FETCH_FAILED");
 	}
-	const expectedUri = `at://${evidence.publisherDid}/${NSID.packageProfile}/${evidence.packageSlug}`;
+	const expectedUri = `at://${publisherDid}/${NSID.packageProfile}/${packageSlug}`;
 	if (
 		!isRecord(envelope) ||
 		envelope["uri"] !== expectedUri ||
@@ -293,10 +320,15 @@ export async function verifyCurrentApprover(
 	const rawExtension = profile.value.extensions?.[NSID.packageProfileExtension];
 	const extension = safeParse(PackageProfileExtension.mainSchema, rawExtension);
 	if (!extension.ok) throw new ApprovalAuthorityError("PROFILE_FETCH_FAILED");
-	if (!extension.value.releasePolicy?.approvers?.includes(approverDid)) {
-		throw new ApprovalAuthorityError("APPROVER_NOT_AUTHORIZED");
-	}
-	if (envelope["cid"] !== evidence.profileCid) {
-		throw new ApprovalAuthorityError("PROFILE_CHANGED");
+	const approverDids = extension.value.releasePolicy?.approvers ?? [];
+	if (
+		new Set(approverDids).size !== approverDids.length ||
+		approverDids.some((approverDid) => !isDid(approverDid))
+	) {
+		throw new ApprovalAuthorityError("PROFILE_FETCH_FAILED");
 	}
+	return {
+		profileCid: envelope["cid"],
+		approverDids: [...approverDids].toSorted(),
+	};
 }
diff --git a/apps/release-service/src/approvals/digest.ts b/apps/release-service/src/approvals/digest.ts
index ec09014f7e..afdd0f102e 100644
--- a/apps/release-service/src/approvals/digest.ts
+++ b/apps/release-service/src/approvals/digest.ts
@@ -150,7 +150,9 @@ function normalizeApproverDids(values: readonly string[]): readonly string[] {
 	if (!Array.isArray(values) || values.length === 0 || values.length > 32) {
 		throw new ApprovalDigestError();
 	}
-	const normalized = [...values].toSorted((left, right) => left.localeCompare(right));
+	const normalized = [...values].toSorted((left, right) =>
+		left < right ? -1 : left > right ? 1 : 0,
+	);
 	if (
 		normalized.some((value) => typeof value !== "string" || !DID_PATTERN.test(value)) ||
 		new Set(normalized).size !== normalized.length
diff --git a/apps/release-service/src/approver-do/approver-do.ts b/apps/release-service/src/approver-do/approver-do.ts
index 21dea1e74c..26522c4fc9 100644
--- a/apps/release-service/src/approver-do/approver-do.ts
+++ b/apps/release-service/src/approver-do/approver-do.ts
@@ -10,6 +10,7 @@ import {
 	ApproverStoreError,
 	type ApproverAuditEvent,
 	type ApproverCredential,
+	type ApproverEnrollmentStatus,
 	type ApprovalReceipt,
 	type CleanupResult,
 	type CommitVerifiedDecisionInput,
@@ -35,6 +36,7 @@ import {
 export type {
 	ApproverAuditEvent,
 	ApproverCredential,
+	ApproverEnrollmentStatus,
 	ApprovalDecision,
 	ApprovalReceipt,
 	CleanupResult,
@@ -154,6 +156,11 @@ export class ApproverDurableObject extends DurableObject<Env> {
 		return this.#store.listCredentials(approverDid, afterCredentialId, limit);
 	}
 
+	getEnrollmentStatus(approverDid: string): ApproverEnrollmentStatus {
+		this.#assertObjectName(approverDid);
+		return this.#store.getEnrollmentStatus(approverDid);
+	}
+
 	getCredentialForVerification(
 		approverDid: string,
 		credentialId: string,
diff --git a/apps/release-service/src/approver-do/store.ts b/apps/release-service/src/approver-do/store.ts
index 310db3ae22..d3233016a2 100644
--- a/apps/release-service/src/approver-do/store.ts
+++ b/apps/release-service/src/approver-do/store.ts
@@ -109,6 +109,14 @@ export interface ApproverCredential {
 	revokedAt: number | null;
 }
 
+export interface ApproverEnrollmentStatus {
+	credentialCount: number;
+	activeCredentialCount: number;
+	firstEnrolledAt: number | null;
+	lastEnrolledAt: number | null;
+	lastRevokedAt: number | null;
+}
+
 export interface CredentialVerificationMaterial {
 	id: string;
 	publicKey: Uint8Array;
@@ -285,6 +293,15 @@ interface CredentialListRow {
 	revoked_at: number | null;
 }
 
+interface EnrollmentStatusRow {
+	[key: string]: string | number | ArrayBuffer | null;
+	credential_count: number;
+	active_credential_count: number;
+	first_enrolled_at: number | null;
+	last_enrolled_at: number | null;
+	last_revoked_at: number | null;
+}
+
 interface ChallengeRow {
 	[key: string]: string | number | ArrayBuffer | null;
 	kind: "registration" | "approval";
@@ -461,6 +478,7 @@ export class ApproverStore {
 				.toArray()[0];
 			if (existing) return { ok: false, code: "IDENTITY_TRANSACTION_EXISTS" } as const;
 			this.#deleteExpiredIdentityTransactions(now, MAX_ACTIVE_IDENTITY_TRANSACTIONS);
+			this.storage.sql.exec("DELETE FROM identity_transactions WHERE completed_at IS NOT NULL");
 			const count = this.storage.sql
 				.exec<{ count: number }>(
 					"SELECT COUNT(*) AS count FROM identity_transactions WHERE completed_at IS NULL",
@@ -768,6 +786,43 @@ export class ApproverStore {
 		return rows.map(credentialView);
 	}
 
+	getEnrollmentStatus(approverDid: string): ApproverEnrollmentStatus {
+		if (!validDid(approverDid)) {
+			throw new ApproverStoreError("APPROVER_DID_INVALID");
+		}
+		const owner = this.#readOwner();
+		if (!owner) {
+			return {
+				credentialCount: 0,
+				activeCredentialCount: 0,
+				firstEnrolledAt: null,
+				lastEnrolledAt: null,
+				lastRevokedAt: null,
+			};
+		}
+		if (owner.did !== approverDid) {
+			throw new ApproverStoreError("APPROVER_DID_MISMATCH");
+		}
+		const row = this.storage.sql
+			.exec<EnrollmentStatusRow>(
+				`SELECT COUNT(*) AS credential_count,
+				        COALESCE(SUM(CASE WHEN revoked_at IS NULL THEN 1 ELSE 0 END), 0)
+				          AS active_credential_count,
+				        MIN(created_at) AS first_enrolled_at,
+				        MAX(created_at) AS last_enrolled_at,
+				        MAX(revoked_at) AS last_revoked_at
+				 FROM credentials`,
+			)
+			.one();
+		return {
+			credentialCount: row.credential_count,
+			activeCredentialCount: row.active_credential_count,
+			firstEnrolledAt: row.first_enrolled_at,
+			lastEnrolledAt: row.last_enrolled_at,
+			lastRevokedAt: row.last_revoked_at,
+		};
+	}
+
 	getCredentialForVerification(
 		approverDid: string,
 		credentialId: string,
@@ -877,6 +932,7 @@ export class ApproverStore {
 				.toArray()[0];
 			if (existing) return { ok: false, code: "CHALLENGE_EXISTS" } as const;
 			this.#expireChallenges(now, MAX_ACTIVE_CHALLENGES);
+			this.storage.sql.exec("DELETE FROM approval_challenges WHERE consumed_at IS NOT NULL");
 			const count = this.storage.sql
 				.exec<{ count: number }>(
 					"SELECT COUNT(*) AS count FROM approval_challenges WHERE consumed_at IS NULL",
diff --git a/apps/release-service/src/backup/routes.ts b/apps/release-service/src/backup/routes.ts
index d1e38127f0..4c119f3c70 100644
--- a/apps/release-service/src/backup/routes.ts
+++ b/apps/release-service/src/backup/routes.ts
@@ -137,6 +137,9 @@ async function writeEncryptedObject(
 	if (created) return false;
 	const existing = await env.OPERATIONS_ARCHIVE.get(key);
 	if (!existing) throw new ApiError("ARCHIVE_OPERATION_FAILED", 503, "Archive write failed");
+	if (existing.size > MAX_ARCHIVE_OBJECT_BYTES) {
+		throw new ApiError("ARCHIVE_OPERATION_FAILED", 409, "Archive page conflicts with prior write");
+	}
 	let existingPlaintext: string;
 	try {
 		existingPlaintext = decoder.decode(
@@ -202,6 +205,9 @@ async function writeAuditObject(ownerHash: string, events: readonly unknown[]):
 	const firstSequence = String(first.sequence).padStart(20, "0");
 	const lastSequence = String(last.sequence).padStart(20, "0");
 	const content = JSON.stringify({ version: SNAPSHOT_VERSION, events: publicEvents });
+	if (encoder.encode(content).byteLength > MAX_ARCHIVE_OBJECT_BYTES) {
+		throw new ApiError("ARCHIVE_OPERATION_FAILED", 500, "Audit export exceeded its size limit");
+	}
 	const contentDigest = base64url.encode(
 		new Uint8Array(await crypto.subtle.digest("SHA-256", encoder.encode(content))),
 	);
@@ -212,7 +218,11 @@ async function writeAuditObject(ownerHash: string, events: readonly unknown[]):
 	});
 	if (created) return;
 	const existing = await env.OPERATIONS_ARCHIVE.get(key);
-	if (!existing || (await existing.text()) !== content) {
+	if (
+		!existing ||
+		existing.size > MAX_ARCHIVE_OBJECT_BYTES ||
+		(await existing.text()) !== content
+	) {
 		throw new ApiError("ARCHIVE_OPERATION_FAILED", 409, "Audit export conflicts with prior write");
 	}
 }
diff --git a/apps/release-service/src/config.ts b/apps/release-service/src/config.ts
index 9fb09fd717..821c1f1a36 100644
--- a/apps/release-service/src/config.ts
+++ b/apps/release-service/src/config.ts
@@ -27,6 +27,7 @@ type ResolvedConfigurationBindings = Record<
 >;
 
 const ACCESS_AUDIENCE_PATTERN = /^[a-f0-9]{64}$/;
+const MAX_ACCESS_AUDIENCES_PER_ROLE = 8;
 const BASE64URL_PATTERN = /^[A-Za-z0-9_-]+$/;
 const DEPLOYMENT_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,255}$/;
 const MAX_ASSERTION_KEYSET_CHARS = 64 * 1024;
@@ -110,16 +111,36 @@ function parseAccessTeamDomain(value: unknown): string | null {
 function parseAccessAudiences(
 	bindings: ResolvedConfigurationBindings,
 ): AccessConfiguration["audiences"] | null {
-	const audiences = {
-		viewer: bindings.ACCESS_VIEWER_AUD,
-		reviewer: bindings.ACCESS_REVIEWER_AUD,
-		admin: bindings.ACCESS_ADMIN_AUD,
-	};
-	const values = Object.values(audiences);
-	return values.every((audience) => ACCESS_AUDIENCE_PATTERN.test(audience)) &&
-		new Set(values).size === values.length
-		? audiences
-		: null;
+	function parseAudience(value: string): string | readonly string[] | null {
+		if (ACCESS_AUDIENCE_PATTERN.test(value)) return value;
+		try {
+			const parsed: unknown = JSON.parse(value);
+			if (
+				!Array.isArray(parsed) ||
+				parsed.length === 0 ||
+				parsed.length > MAX_ACCESS_AUDIENCES_PER_ROLE ||
+				!parsed.every(
+					(audience): audience is string =>
+						typeof audience === "string" && ACCESS_AUDIENCE_PATTERN.test(audience),
+				)
+			) {
+				return null;
+			}
+			return Object.freeze([...parsed]);
+		} catch {
+			return null;
+		}
+	}
+
+	const viewer = parseAudience(bindings.ACCESS_VIEWER_AUD);
+	const reviewer = parseAudience(bindings.ACCESS_REVIEWER_AUD);
+	const admin = parseAudience(bindings.ACCESS_ADMIN_AUD);
+	if (!viewer || !reviewer || !admin) return null;
+	const audiences = { viewer, reviewer, admin };
+	const values = Object.values(audiences).flatMap((audience) =>
+		typeof audience === "string" ? [audience] : audience,
+	);
+	return new Set(values).size === values.length ? audiences : null;
 }
 
 function isRecord(value: unknown): value is Record<string, unknown> {
diff --git a/apps/release-service/src/control-do/routes.ts b/apps/release-service/src/control-do/routes.ts
index 2c38344f3d..1da3bd1a49 100644
--- a/apps/release-service/src/control-do/routes.ts
+++ b/apps/release-service/src/control-do/routes.ts
@@ -7,10 +7,12 @@ import { ApiError } from "../api/errors.js";
 import { apiSuccess } from "../api/response.js";
 import type { ServiceConfiguration } from "../config.js";
 import { writeOperationsMetric } from "../observability/metrics.js";
+import { startEncryptionVerificationWorkflow } from "../workflows/encryption-verification.js";
 import { SERVICE_CONTROL_OBJECT_NAME, type ServiceMode } from "./service-control-do.js";
 
 const REASON_CODE_PATTERN = /^[A-Z][A-Z0-9_]{0,63}$/;
 const DECIMAL_INTEGER_PATTERN = /^(0|[1-9][0-9]*)$/;
+const ENCRYPTION_RETIRE_PATH_PATTERN = /^\/admin\/api\/encryption\/keys\/([1-9][0-9]*)\/retire$/;
 
 function requireActor(actor: AccessActor | null): AccessActor {
 	if (!actor) throw new Error("Access actor missing from protected operator route");
@@ -81,11 +83,18 @@ export async function handleServiceStatus(
 	return apiSuccess({ state }, requestId);
 }
 
-export async function handleReadiness(_request: Request, requestId: string): Promise<Response> {
+export async function handleReadiness(
+	_request: Request,
+	requestId: string,
+	configuration: ServiceConfiguration,
+): Promise<Response> {
 	try {
-		await control().checkReadiness();
+		if (!(await control().checkReadiness(configuration.encryption.currentKeyVersion))) {
+			throw new ApiError("SERVICE_UNAVAILABLE", 503, "Service dependency is unavailable");
+		}
 		return apiSuccess({ status: "ready" }, requestId);
-	} catch {
+	} catch (error) {
+		if (error instanceof ApiError) throw error;
 		throw new ApiError("SERVICE_UNAVAILABLE", 503, "Service dependency is unavailable");
 	}
 }
@@ -93,7 +102,7 @@ export async function handleReadiness(_request: Request, requestId: string): Pro
 export async function handleSetServiceMode(
 	request: Request,
 	requestId: string,
-	_configuration: ServiceConfiguration,
+	configuration: ServiceConfiguration,
 	_params: Readonly<Record<string, string>>,
 	accessActor: AccessActor | null,
 ): Promise<Response> {
@@ -112,6 +121,19 @@ export async function handleSetServiceMode(
 	const mode: ServiceMode = body["mode"];
 	const reasonCode = body["reasonCode"];
 	try {
+		if (mode === "active") {
+			const keys = await control().readEncryptionKeys(actor);
+			if (
+				keys.find((key) => key.status === "active")?.version !==
+				configuration.encryption.currentKeyVersion
+			) {
+				throw new ApiError(
+					"ENCRYPTION_OPERATION_FAILED",
+					409,
+					"Configured encryption key has not been activated",
+				);
+			}
+		}
 		const result = await control().setServiceMode({
 			actor,
 			idempotencyKey: requireIdempotencyKey(request),
@@ -136,6 +158,201 @@ export async function handleSetServiceMode(
 	}
 }
 
+export function matchRetireEncryptionKeyPath(
+	pathname: string,
+): Readonly<Record<string, string>> | null {
+	const match = ENCRYPTION_RETIRE_PATH_PATTERN.exec(pathname);
+	if (!match?.[1]) return null;
+	const version = Number(match[1]);
+	return Number.isSafeInteger(version) && version >= 1 && version <= 2_147_483_647
+		? { version: match[1] }
+		: null;
+}
+
+export async function handleEncryptionKeyStatus(
+	_request: Request,
+	requestId: string,
+	configuration: ServiceConfiguration,
+	_params: Readonly<Record<string, string>>,
+	accessActor: AccessActor | null,
+): Promise<Response> {
+	const actor = requireActor(accessActor);
+	const keys = await control().readEncryptionKeys(actor);
+	const activeVersion = keys.find((key) => key.status === "active")?.version;
+	if (activeVersion === undefined) {
+		throw new ApiError("SERVICE_UNAVAILABLE", 503, "Encryption key state is unavailable");
+	}
+	const verification = await control().readEncryptionVerification(actor, activeVersion);
+	return apiSuccess(
+		{
+			configured: {
+				activeVersion: configuration.encryption.currentKeyVersion,
+				versions: configuration.encryption.availableKeyVersions,
+			},
+			keys,
+			verification,
+		},
+		requestId,
+	);
+}
+
+export async function handleActivateEncryptionKey(
+	request: Request,
+	requestId: string,
+	configuration: ServiceConfiguration,
+	_params: Readonly<Record<string, string>>,
+	accessActor: AccessActor | null,
+): Promise<Response> {
+	const actor = requireActor(accessActor);
+	const body = await readJsonObject(request);
+	if (
+		!hasExactKeys(body, ["version"]) ||
+		!Number.isSafeInteger(body["version"]) ||
+		Number(body["version"]) < 1 ||
+		Number(body["version"]) > 2_147_483_647
+	) {
+		throw new ApiError("INVALID_REQUEST", 400, "Invalid encryption key activation request");
+	}
+	const version = Number(body["version"]);
+	if (
+		configuration.encryption.currentKeyVersion !== version ||
+		!configuration.encryption.availableKeyVersions.includes(version)
+	) {
+		throw new ApiError(
+			"ENCRYPTION_OPERATION_FAILED",
+			409,
+			"Encryption key is not the configured active version",
+		);
+	}
+	if ((await control().readServiceState(actor)).mode !== "publication-paused") {
+		throw new ApiError(
+			"ENCRYPTION_OPERATION_FAILED",
+			409,
+			"Publication must be paused before activating an encryption key",
+		);
+	}
+	try {
+		const result = await control().activateEncryptionKey({
+			actor,
+			idempotencyKey: requireIdempotencyKey(request),
+			requestDigest: await requestDigest(["encryption-key-activate", version]),
+			version,
+		});
+		if (!result.ok) {
+			throw new ApiError("IDEMPOTENCY_CONFLICT", 409, "Idempotency key conflicts with prior use");
+		}
+		return apiSuccess({ key: result.value, replayed: result.replayed }, requestId);
+	} catch (error) {
+		mapControlError(error);
+	}
+}
+
+export async function handleStartEncryptionVerification(
+	request: Request,
+	requestId: string,
+	configuration: ServiceConfiguration,
+	_params: Readonly<Record<string, string>>,
+	accessActor: AccessActor | null,
+): Promise<Response> {
+	const actor = requireActor(accessActor);
+	const body = await readJsonObject(request);
+	if (
+		!hasExactKeys(body, ["retiringVersion"]) ||
+		!Number.isSafeInteger(body["retiringVersion"]) ||
+		Number(body["retiringVersion"]) < 1 ||
+		Number(body["retiringVersion"]) >= configuration.encryption.currentKeyVersion ||
+		!configuration.encryption.availableKeyVersions.includes(Number(body["retiringVersion"]))
+	) {
+		throw new ApiError("INVALID_REQUEST", 400, "Invalid encryption verification request");
+	}
+	if ((await control().readServiceState(actor)).mode !== "publication-paused") {
+		throw new ApiError(
+			"ENCRYPTION_OPERATION_FAILED",
+			409,
+			"Publication must be paused before verifying encryption",
+		);
+	}
+	const retiringVersion = Number(body["retiringVersion"]);
+	const keys = await control().readEncryptionKeys(actor);
+	if (
+		keys.find((key) => key.status === "active")?.version !==
+			configuration.encryption.currentKeyVersion ||
+		keys.find((key) => key.version === retiringVersion)?.status !== "readable"
+	) {
+		throw new ApiError(
+			"ENCRYPTION_OPERATION_FAILED",
+			409,
+			"Encryption key control state is not ready for verification",
+		);
+	}
+	const campaignId = requireIdempotencyKey(request);
+	const result = await startEncryptionVerificationWorkflow(env.ENCRYPTION_VERIFICATION_WORKFLOW, {
+		campaignId,
+		targetKeyVersion: configuration.encryption.currentKeyVersion,
+		retiringKeyVersion: retiringVersion,
+		actorIdentity: actor.identity,
+	});
+	if (!result.ok) {
+		throw new ApiError("WORKFLOW_UNAVAILABLE", 503, "Encryption verification could not start");
+	}
+	return apiSuccess(result, requestId, result.created ? 202 : 200);
+}
+
+export async function handleRetireEncryptionKey(
+	request: Request,
+	requestId: string,
+	configuration: ServiceConfiguration,
+	params: Readonly<Record<string, string>>,
+	accessActor: AccessActor | null,
+): Promise<Response> {
+	const actor = requireActor(accessActor);
+	const body = await readJsonObject(request);
+	const version = Number(params["version"]);
+	if (!hasExactKeys(body, []) || !Number.isSafeInteger(version) || version < 1) {
+		throw new ApiError("INVALID_REQUEST", 400, "Invalid encryption key retirement request");
+	}
+	if (configuration.encryption.availableKeyVersions.includes(version)) {
+		throw new ApiError(
+			"ENCRYPTION_OPERATION_FAILED",
+			409,
+			"Encryption key remains configured and cannot be retired",
+		);
+	}
+	if ((await control().readServiceState(actor)).mode !== "publication-paused") {
+		throw new ApiError(
+			"ENCRYPTION_OPERATION_FAILED",
+			409,
+			"Publication must be paused before retiring an encryption key",
+		);
+	}
+	const keys = await control().readEncryptionKeys(actor);
+	const activeVersion = keys.find((key) => key.status === "active")?.version;
+	if (
+		activeVersion === undefined ||
+		!(await control().readEncryptionVerification(actor, activeVersion))
+	) {
+		throw new ApiError(
+			"ENCRYPTION_OPERATION_FAILED",
+			409,
+			"Encryption key rotation has not been verified",
+		);
+	}
+	try {
+		const result = await control().retireEncryptionKey({
+			actor,
+			idempotencyKey: requireIdempotencyKey(request),
+			requestDigest: await requestDigest(["encryption-key-retire", version]),
+			version,
+		});
+		if (!result.ok) {
+			throw new ApiError("IDEMPOTENCY_CONFLICT", 409, "Idempotency key conflicts with prior use");
+		}
+		return apiSuccess({ key: result.value, replayed: result.replayed }, requestId);
+	} catch (error) {
+		mapControlError(error);
+	}
+}
+
 export async function handleControlAudit(
 	request: Request,
 	requestId: string,
diff --git a/apps/release-service/src/control-do/service-control-do.ts b/apps/release-service/src/control-do/service-control-do.ts
index db64e106c4..42caeaad9d 100644
--- a/apps/release-service/src/control-do/service-control-do.ts
+++ b/apps/release-service/src/control-do/service-control-do.ts
@@ -13,6 +13,7 @@ const REASON_CODE_PATTERN = /^[A-Z][A-Z0-9_]{0,63}$/;
 const INTENT_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/;
 const PERMIT_ID_PATTERN = /^[A-Za-z0-9_-]{22}$/;
 const PERMIT_TOKEN_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+const MAX_KEY_VERSION = 2_147_483_647;
 const MAX_PERMIT_TTL_MS = 30_000;
 const OPERATOR_IDEMPOTENCY_TTL_MS = 24 * 60 * 60_000;
 const ROLE_RANK: Readonly<Record<AccessRole, number>> = {
@@ -23,6 +24,7 @@ const ROLE_RANK: Readonly<Record<AccessRole, number>> = {
 
 export type ServiceMode = "active" | "admission-paused" | "publication-paused";
 export type PublisherControlStatus = "allowed" | "suspended";
+export type EncryptionKeyStatus = "active" | "readable" | "retired";
 
 export type ServiceControlErrorCode =
 	| "CONTROL_ACTOR_INVALID"
@@ -56,6 +58,29 @@ export interface PublisherControl {
 	changedAt: number;
 }
 
+export interface EncryptionKeyState {
+	version: number;
+	status: EncryptionKeyStatus;
+	activatedAt: number;
+	retiredAt: number | null;
+	changedBy: string;
+	updatedAt: number;
+}
+
+export interface EncryptionVerificationState {
+	targetKeyVersion: number;
+	workflowId: string;
+	publishers: number;
+	approvers: number;
+	records: number;
+	rotated: number;
+	verifiedAt: number;
+}
+
+export interface RecordEncryptionVerificationInput extends EncryptionVerificationState {
+	actorIdentity: string;
+}
+
 interface OperatorMutationInput {
 	actor: AccessActor;
 	idempotencyKey: string;
@@ -74,6 +99,14 @@ export interface SetPublisherControlInput extends OperatorMutationInput {
 	reasonCode: string | null;
 }
 
+export interface ActivateEncryptionKeyInput extends OperatorMutationInput {
+	version: number;
+}
+
+export interface RetireEncryptionKeyInput extends OperatorMutationInput {
+	version: number;
+}
+
 export type OperatorMutationResult<T> =
 	| { ok: true; value: T; replayed: boolean }
 	| { ok: false; code: "IDEMPOTENCY_CONFLICT" };
@@ -91,12 +124,16 @@ export interface PublicationPermit {
 	publisherDid: string;
 	intentId: string;
 	modeEpoch: number;
+	encryptionKeyVersion: number;
 	expiresAt: number;
 }
 
 export type IssuePublicationPermitResult =
 	| { ok: true; permit: PublicationPermit }
-	| { ok: false; code: "PUBLICATION_PAUSED" | "PUBLISHER_SUSPENDED" };
+	| {
+			ok: false;
+			code: "ENCRYPTION_KEY_INACTIVE" | "PUBLICATION_PAUSED" | "PUBLISHER_SUSPENDED";
+	  };
 
 export interface ConsumePublicationPermitInput {
 	id: string;
@@ -149,6 +186,27 @@ interface PublisherControlRow {
 	changed_at: number;
 }
 
+interface EncryptionKeyRow {
+	[key: string]: string | number | ArrayBuffer | null;
+	version: number;
+	status: EncryptionKeyStatus;
+	activated_at: number | null;
+	retired_at: number | null;
+	operator_identity: string;
+	updated_at: number;
+}
+
+interface EncryptionVerificationRow {
+	[key: string]: string | number | ArrayBuffer | null;
+	target_key_version: number;
+	workflow_id: string;
+	publishers: number;
+	approvers: number;
+	records: number;
+	rotated: number;
+	verified_at: number;
+}
+
 interface IdempotencyRow {
 	[key: string]: string | number | ArrayBuffer | null;
 	action: string;
@@ -163,6 +221,7 @@ interface PublicationPermitRow {
 	publisher_did: string;
 	intent_id: string;
 	mode_epoch: number;
+	encryption_key_version: number;
 	expires_at: number;
 	consumed_at: number | null;
 }
@@ -191,6 +250,10 @@ function validTimestamp(value: unknown): value is number {
 	return Number.isSafeInteger(value) && Number(value) >= 0;
 }
 
+function validKeyVersion(value: unknown): value is number {
+	return Number.isSafeInteger(value) && Number(value) >= 1 && Number(value) <= MAX_KEY_VERSION;
+}
+
 function parseServiceState(value: string): ServiceState {
 	let parsed: unknown;
 	try {
@@ -249,6 +312,38 @@ function parsePublisherControl(value: string): PublisherControl {
 	};
 }
 
+function parseEncryptionKeyState(value: string): EncryptionKeyState {
+	let parsed: unknown;
+	try {
+		parsed = JSON.parse(value);
+	} catch {
+		throw new ServiceControlError("CONTROL_STATE_CORRUPT");
+	}
+	if (
+		!isRecord(parsed) ||
+		!validKeyVersion(parsed["version"]) ||
+		(parsed["status"] !== "active" &&
+			parsed["status"] !== "readable" &&
+			parsed["status"] !== "retired") ||
+		!validTimestamp(parsed["activatedAt"]) ||
+		(parsed["retiredAt"] !== null && !validTimestamp(parsed["retiredAt"])) ||
+		typeof parsed["changedBy"] !== "string" ||
+		!ACTOR_IDENTITY_PATTERN.test(parsed["changedBy"]) ||
+		!validTimestamp(parsed["updatedAt"]) ||
+		(parsed["status"] === "retired") !== (parsed["retiredAt"] !== null)
+	) {
+		throw new ServiceControlError("CONTROL_STATE_CORRUPT");
+	}
+	return {
+		version: parsed["version"],
+		status: parsed["status"],
+		activatedAt: parsed["activatedAt"],
+		retiredAt: parsed["retiredAt"],
+		changedBy: parsed["changedBy"],
+		updatedAt: parsed["updatedAt"],
+	};
+}
+
 async function hashToken(token: string): Promise<string> {
 	const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(token));
 	return base64url.encode(new Uint8Array(digest));
@@ -300,6 +395,18 @@ export class ServiceControlDurableObject extends DurableObject<Env> {
 			);
 			CREATE UNIQUE INDEX IF NOT EXISTS idx_encryption_keys_active
 				ON encryption_keys(status) WHERE status = 'active';
+			INSERT OR IGNORE INTO encryption_keys (
+				version, status, activated_at, retired_at, operator_identity, updated_at
+			) VALUES (1, 'active', 0, NULL, 'system:bootstrap', 0);
+			CREATE TABLE IF NOT EXISTS encryption_verifications (
+				target_key_version INTEGER PRIMARY KEY CHECK (target_key_version >= 1),
+				workflow_id TEXT NOT NULL,
+				publishers INTEGER NOT NULL CHECK (publishers >= 0),
+				approvers INTEGER NOT NULL CHECK (approvers >= 0),
+				records INTEGER NOT NULL CHECK (records >= 0),
+				rotated INTEGER NOT NULL CHECK (rotated >= 0),
+				verified_at INTEGER NOT NULL
+			);
 			CREATE TABLE IF NOT EXISTS publisher_controls (
 				publisher_did TEXT PRIMARY KEY,
 				status TEXT NOT NULL CHECK (status IN ('allowed', 'suspended')),
@@ -324,6 +431,7 @@ export class ServiceControlDurableObject extends DurableObject<Env> {
 				publisher_did TEXT NOT NULL,
 				intent_id TEXT NOT NULL,
 				mode_epoch INTEGER NOT NULL CHECK (mode_epoch >= 1),
+				encryption_key_version INTEGER NOT NULL CHECK (encryption_key_version >= 1),
 				expires_at INTEGER NOT NULL,
 				consumed_at INTEGER,
 				created_at INTEGER NOT NULL
@@ -418,6 +526,98 @@ export class ServiceControlDurableObject extends DurableObject<Env> {
 				};
 	}
 
+	#encryptionKeyState(row: EncryptionKeyRow): EncryptionKeyState {
+		if (
+			!validKeyVersion(row.version) ||
+			(row.status !== "active" && row.status !== "readable" && row.status !== "retired") ||
+			row.activated_at === null ||
+			!validTimestamp(row.activated_at) ||
+			(row.retired_at !== null && !validTimestamp(row.retired_at)) ||
+			!ACTOR_IDENTITY_PATTERN.test(row.operator_identity) ||
+			!validTimestamp(row.updated_at) ||
+			(row.status === "retired") !== (row.retired_at !== null)
+		) {
+			throw new ServiceControlError("CONTROL_STATE_CORRUPT");
+		}
+		return {
+			version: row.version,
+			status: row.status,
+			activatedAt: row.activated_at,
+			retiredAt: row.retired_at,
+			changedBy: row.operator_identity,
+			updatedAt: row.updated_at,
+		};
+	}
+
+	#readEncryptionKeys(): EncryptionKeyState[] {
+		return this.ctx.storage.sql
+			.exec<EncryptionKeyRow>(
+				`SELECT version, status, activated_at, retired_at, operator_identity, updated_at
+				 FROM encryption_keys ORDER BY version`,
+			)
+			.toArray()
+			.map((row) => this.#encryptionKeyState(row));
+	}
+
+	#readEncryptionKey(version: number): EncryptionKeyState | null {
+		const row = this.ctx.storage.sql
+			.exec<EncryptionKeyRow>(
+				`SELECT version, status, activated_at, retired_at, operator_identity, updated_at
+				 FROM encryption_keys WHERE version = ?`,
+				version,
+			)
+			.toArray()[0];
+		return row ? this.#encryptionKeyState(row) : null;
+	}
+
+	#readActiveEncryptionKey(): EncryptionKeyState {
+		const rows = this.ctx.storage.sql
+			.exec<EncryptionKeyRow>(
+				`SELECT version, status, activated_at, retired_at, operator_identity, updated_at
+				 FROM encryption_keys WHERE status = 'active'`,
+			)
+			.toArray();
+		if (rows.length !== 1 || !rows[0]) {
+			throw new ServiceControlError("CONTROL_STATE_CORRUPT");
+		}
+		return this.#encryptionKeyState(rows[0]);
+	}
+
+	#encryptionVerificationState(row: EncryptionVerificationRow): EncryptionVerificationState {
+		if (
+			!validKeyVersion(row.target_key_version) ||
+			!DIGEST_PATTERN.test(row.workflow_id) ||
+			!validTimestamp(row.publishers) ||
+			!validTimestamp(row.approvers) ||
+			!validTimestamp(row.records) ||
+			!validTimestamp(row.rotated) ||
+			!validTimestamp(row.verified_at)
+		) {
+			throw new ServiceControlError("CONTROL_STATE_CORRUPT");
+		}
+		return {
+			targetKeyVersion: row.target_key_version,
+			workflowId: row.workflow_id,
+			publishers: row.publishers,
+			approvers: row.approvers,
+			records: row.records,
+			rotated: row.rotated,
+			verifiedAt: row.verified_at,
+		};
+	}
+
+	#readEncryptionVerification(targetKeyVersion: number): EncryptionVerificationState | null {
+		const row = this.ctx.storage.sql
+			.exec<EncryptionVerificationRow>(
+				`SELECT target_key_version, workflow_id, publishers, approvers,
+				        records, rotated, verified_at
+				 FROM encryption_verifications WHERE target_key_version = ?`,
+				targetKeyVersion,
+			)
+			.toArray()[0];
+		return row ? this.#encryptionVerificationState(row) : null;
+	}
+
 	#readIdempotency(actorIdentity: string, mutationKey: string, now: number): IdempotencyRow | null {
 		const row = this.ctx.storage.sql
 			.exec<IdempotencyRow>(
@@ -441,7 +641,7 @@ export class ServiceControlDurableObject extends DurableObject<Env> {
 	#writeIdempotency(
 		input: OperatorMutationInput,
 		action: string,
-		result: ServiceState | PublisherControl,
+		result: EncryptionKeyState | PublisherControl | ServiceState,
 		now: number,
 	): void {
 		this.ctx.storage.sql.exec(
@@ -504,9 +704,228 @@ export class ServiceControlDurableObject extends DurableObject<Env> {
 		return this.#readState();
 	}
 
-	async checkReadiness(): Promise<void> {
+	async readEncryptionKeys(actor: AccessActor): Promise<readonly EncryptionKeyState[]> {
+		this.#assertObjectName();
+		this.#assertActor(actor, "viewer");
+		return this.#readEncryptionKeys();
+	}
+
+	async readEncryptionVerification(
+		actor: AccessActor,
+		targetKeyVersion: number,
+	): Promise<EncryptionVerificationState | null> {
+		this.#assertObjectName();
+		this.#assertActor(actor, "viewer");
+		if (!validKeyVersion(targetKeyVersion)) {
+			throw new ServiceControlError("CONTROL_INPUT_INVALID");
+		}
+		return this.#readEncryptionVerification(targetKeyVersion);
+	}
+
+	async recordEncryptionVerification(
+		input: RecordEncryptionVerificationInput,
+	): Promise<EncryptionVerificationState> {
+		this.#assertObjectName();
+		if (
+			!validKeyVersion(input.targetKeyVersion) ||
+			!DIGEST_PATTERN.test(input.workflowId) ||
+			!ACTOR_IDENTITY_PATTERN.test(input.actorIdentity) ||
+			!validTimestamp(input.publishers) ||
+			!validTimestamp(input.approvers) ||
+			!validTimestamp(input.records) ||
+			!validTimestamp(input.rotated) ||
+			!validTimestamp(input.verifiedAt)
+		) {
+			throw new ServiceControlError("CONTROL_INPUT_INVALID");
+		}
+		return this.ctx.storage.transactionSync(() => {
+			if (
+				this.#readState().mode !== "publication-paused" ||
+				this.#readActiveEncryptionKey().version !== input.targetKeyVersion
+			) {
+				throw new ServiceControlError("CONTROL_INPUT_INVALID");
+			}
+			const existing = this.#readEncryptionVerification(input.targetKeyVersion);
+			if (existing && existing.verifiedAt > input.verifiedAt) return existing;
+			this.ctx.storage.sql.exec(
+				`INSERT INTO encryption_verifications (
+					target_key_version, workflow_id, publishers, approvers,
+					records, rotated, verified_at
+				) VALUES (?, ?, ?, ?, ?, ?, ?)
+				ON CONFLICT(target_key_version) DO UPDATE SET
+					workflow_id = excluded.workflow_id,
+					publishers = excluded.publishers,
+					approvers = excluded.approvers,
+					records = excluded.records,
+					rotated = excluded.rotated,
+					verified_at = excluded.verified_at`,
+				input.targetKeyVersion,
+				input.workflowId,
+				input.publishers,
+				input.approvers,
+				input.records,
+				input.rotated,
+				input.verifiedAt,
+			);
+			this.#appendAudit(
+				"encryption-key-verified",
+				"system",
+				input.actorIdentity,
+				null,
+				String(input.targetKeyVersion),
+				null,
+				input.verifiedAt,
+			);
+			return {
+				targetKeyVersion: input.targetKeyVersion,
+				workflowId: input.workflowId,
+				publishers: input.publishers,
+				approvers: input.approvers,
+				records: input.records,
+				rotated: input.rotated,
+				verifiedAt: input.verifiedAt,
+			};
+		});
+	}
+
+	async checkReadiness(expectedEncryptionKeyVersion?: number): Promise<boolean> {
 		this.#assertObjectName();
 		this.#readState();
+		const activeKey = this.#readActiveEncryptionKey();
+		return (
+			expectedEncryptionKeyVersion === undefined ||
+			(validKeyVersion(expectedEncryptionKeyVersion) &&
+				activeKey.version === expectedEncryptionKeyVersion)
+		);
+	}
+
+	async activateEncryptionKey(
+		input: ActivateEncryptionKeyInput,
+	): Promise<OperatorMutationResult<EncryptionKeyState>> {
+		this.#assertObjectName();
+		const now = this.#assertOperatorMutation(input);
+		if (!validKeyVersion(input.version)) {
+			throw new ServiceControlError("CONTROL_INPUT_INVALID");
+		}
+		const action = `encryption-key-activate:${input.version}`;
+		const result = this.ctx.storage.transactionSync(() => {
+			const existing = this.#readIdempotency(input.actor.identity, input.idempotencyKey, now);
+			if (existing) {
+				if (existing.action !== action || existing.request_digest !== input.requestDigest) {
+					return { ok: false, code: "IDEMPOTENCY_CONFLICT" } as const;
+				}
+				return {
+					ok: true,
+					value: parseEncryptionKeyState(existing.result_json),
+					replayed: true,
+				} as const;
+			}
+			if (this.#readState().mode !== "publication-paused") {
+				throw new ServiceControlError("CONTROL_INPUT_INVALID");
+			}
+			const current = this.#readActiveEncryptionKey();
+			let next = current;
+			if (current.version !== input.version) {
+				if (input.version <= current.version || this.#readEncryptionKey(input.version) !== null) {
+					throw new ServiceControlError("CONTROL_INPUT_INVALID");
+				}
+				this.ctx.storage.sql.exec(
+					`UPDATE encryption_keys SET status = 'readable', operator_identity = ?, updated_at = ?
+					 WHERE version = ? AND status = 'active'`,
+					input.actor.identity,
+					now,
+					current.version,
+				);
+				this.ctx.storage.sql.exec(
+					`INSERT INTO encryption_keys (
+						version, status, activated_at, retired_at, operator_identity, updated_at
+					) VALUES (?, 'active', ?, NULL, ?, ?)`,
+					input.version,
+					now,
+					input.actor.identity,
+					now,
+				);
+				next = this.#readEncryptionKey(input.version)!;
+				this.#appendAudit(
+					"encryption-key-activated",
+					"access",
+					input.actor.identity,
+					input.actor.role,
+					String(input.version),
+					null,
+					now,
+				);
+			}
+			this.#writeIdempotency(input, action, next, now);
+			return { ok: true, value: next, replayed: false } as const;
+		});
+		await this.#scheduleCleanup(now);
+		return result;
+	}
+
+	async retireEncryptionKey(
+		input: RetireEncryptionKeyInput,
+	): Promise<OperatorMutationResult<EncryptionKeyState>> {
+		this.#assertObjectName();
+		const now = this.#assertOperatorMutation(input);
+		if (!validKeyVersion(input.version)) {
+			throw new ServiceControlError("CONTROL_INPUT_INVALID");
+		}
+		const action = `encryption-key-retire:${input.version}`;
+		const result = this.ctx.storage.transactionSync(() => {
+			const existing = this.#readIdempotency(input.actor.identity, input.idempotencyKey, now);
+			if (existing) {
+				if (existing.action !== action || existing.request_digest !== input.requestDigest) {
+					return { ok: false, code: "IDEMPOTENCY_CONFLICT" } as const;
+				}
+				return {
+					ok: true,
+					value: parseEncryptionKeyState(existing.result_json),
+					replayed: true,
+				} as const;
+			}
+			if (this.#readState().mode !== "publication-paused") {
+				throw new ServiceControlError("CONTROL_INPUT_INVALID");
+			}
+			const current = this.#readActiveEncryptionKey();
+			const key = this.#readEncryptionKey(input.version);
+			const verification = this.#readEncryptionVerification(current.version);
+			if (
+				!key ||
+				key.status === "active" ||
+				key.version >= current.version ||
+				!verification ||
+				verification.verifiedAt < current.activatedAt
+			) {
+				throw new ServiceControlError("CONTROL_INPUT_INVALID");
+			}
+			let next = key;
+			if (key.status !== "retired") {
+				this.ctx.storage.sql.exec(
+					`UPDATE encryption_keys SET status = 'retired', retired_at = ?,
+					        operator_identity = ?, updated_at = ?
+					 WHERE version = ? AND status = 'readable'`,
+					now,
+					input.actor.identity,
+					now,
+					input.version,
+				);
+				next = this.#readEncryptionKey(input.version)!;
+				this.#appendAudit(
+					"encryption-key-retired",
+					"access",
+					input.actor.identity,
+					input.actor.role,
+					String(input.version),
+					null,
+					now,
+				);
+			}
+			this.#writeIdempotency(input, action, next, now);
+			return { ok: true, value: next, replayed: false } as const;
+		});
+		await this.#scheduleCleanup(now);
+		return result;
 	}
 
 	async setServiceMode(input: SetServiceModeInput): Promise<OperatorMutationResult<ServiceState>> {
@@ -674,6 +1093,7 @@ export class ServiceControlDurableObject extends DurableObject<Env> {
 		publisherDid: string,
 		intentId: string,
 		ttlMs: number,
+		encryptionKeyVersion: number,
 		now = Date.now(),
 	): Promise<IssuePublicationPermitResult> {
 		this.#assertObjectName();
@@ -683,6 +1103,7 @@ export class ServiceControlDurableObject extends DurableObject<Env> {
 			!Number.isSafeInteger(ttlMs) ||
 			ttlMs < 1 ||
 			ttlMs > MAX_PERMIT_TTL_MS ||
+			!validKeyVersion(encryptionKeyVersion) ||
 			!validTimestamp(now) ||
 			now > Number.MAX_SAFE_INTEGER - ttlMs
 		) {
@@ -696,20 +1117,24 @@ export class ServiceControlDurableObject extends DurableObject<Env> {
 			if (state.mode === "publication-paused") {
 				return { ok: false, code: "PUBLICATION_PAUSED" } as const;
 			}
+			if (this.#readActiveEncryptionKey().version !== encryptionKeyVersion) {
+				return { ok: false, code: "ENCRYPTION_KEY_INACTIVE" } as const;
+			}
 			if (this.#readPublisherControl(publisherDid).status === "suspended") {
 				return { ok: false, code: "PUBLISHER_SUSPENDED" } as const;
 			}
 			const expiresAt = now + ttlMs;
 			this.ctx.storage.sql.exec(
 				`INSERT INTO publication_permits (
-					id, token_hash, publisher_did, intent_id, mode_epoch,
+					id, token_hash, publisher_did, intent_id, mode_epoch, encryption_key_version,
 					expires_at, consumed_at, created_at
-				) VALUES (?, ?, ?, ?, ?, ?, NULL, ?)`,
+				) VALUES (?, ?, ?, ?, ?, ?, ?, NULL, ?)`,
 				id,
 				tokenHash,
 				publisherDid,
 				intentId,
 				state.epoch,
+				encryptionKeyVersion,
 				expiresAt,
 				now,
 			);
@@ -724,7 +1149,15 @@ export class ServiceControlDurableObject extends DurableObject<Env> {
 			);
 			return {
 				ok: true,
-				permit: { id, token, publisherDid, intentId, modeEpoch: state.epoch, expiresAt },
+				permit: {
+					id,
+					token,
+					publisherDid,
+					intentId,
+					modeEpoch: state.epoch,
+					encryptionKeyVersion,
+					expiresAt,
+				},
 			} as const;
 		});
 		if (result.ok) await this.#scheduleCleanup(now);
@@ -749,7 +1182,8 @@ export class ServiceControlDurableObject extends DurableObject<Env> {
 		return this.ctx.storage.transactionSync(() => {
 			const permit = this.ctx.storage.sql
 				.exec<PublicationPermitRow>(
-					`SELECT token_hash, publisher_did, intent_id, mode_epoch, expires_at, consumed_at
+					`SELECT token_hash, publisher_did, intent_id, mode_epoch,
+					        encryption_key_version, expires_at, consumed_at
 					 FROM publication_permits WHERE id = ?`,
 					input.id,
 				)
@@ -776,6 +1210,9 @@ export class ServiceControlDurableObject extends DurableObject<Env> {
 			if (permit.mode_epoch !== state.epoch) {
 				return { ok: false, code: "PERMIT_STALE" } as const;
 			}
+			if (permit.encryption_key_version !== this.#readActiveEncryptionKey().version) {
+				return { ok: false, code: "PERMIT_STALE" } as const;
+			}
 			this.ctx.storage.sql.exec(
 				"UPDATE publication_permits SET consumed_at = ? WHERE id = ? AND consumed_at IS NULL",
 				now,
diff --git a/apps/release-service/src/crypto/encryption.ts b/apps/release-service/src/crypto/encryption.ts
index c785b89459..da0963b0d8 100644
--- a/apps/release-service/src/crypto/encryption.ts
+++ b/apps/release-service/src/crypto/encryption.ts
@@ -134,6 +134,7 @@ interface ParsedEnvelope {
 
 export interface EnvelopeEncryption {
 	readonly currentKeyVersion: number;
+	readonly availableKeyVersions: readonly number[];
 	encrypt(plaintext: Uint8Array, context: EncryptionContext): Promise<EncryptedValue>;
 	decrypt(envelope: string, context: EncryptionContext): Promise<Uint8Array<ArrayBuffer>>;
 	needsRotation(envelope: string): boolean;
@@ -339,6 +340,7 @@ async function createContextDigest(
 
 class JoseEnvelopeEncryption implements EnvelopeEncryption {
 	readonly currentKeyVersion: number;
+	readonly availableKeyVersions: readonly number[];
 	readonly #keys: ReadonlyMap<number, Uint8Array>;
 	readonly #deploymentId: string;
 
@@ -347,6 +349,7 @@ class JoseEnvelopeEncryption implements EnvelopeEncryption {
 			throw new EncryptionError("ENCRYPTION_CONFIGURATION_INVALID");
 		}
 		this.currentKeyVersion = keyring.currentVersion;
+		this.availableKeyVersions = Object.freeze([...keyring.keys.keys()].toSorted((a, b) => a - b));
 		this.#keys = keyring.keys;
 		this.#deploymentId = deploymentId;
 	}
diff --git a/apps/release-service/src/index.ts b/apps/release-service/src/index.ts
index 5decea1e69..c2225440a2 100644
--- a/apps/release-service/src/index.ts
+++ b/apps/release-service/src/index.ts
@@ -24,6 +24,7 @@ export { ApproverDurableObject } from "./approver-do/approver-do.js";
 export { OAuthStateDurableObject } from "./oauth/state-do.js";
 export { ReleaseIntentWorkflow } from "./workflows/release-intent.js";
 export { PublisherArchiveWorkflow } from "./workflows/publisher-archive.js";
+export { EncryptionVerificationWorkflow } from "./workflows/encryption-verification.js";
 export { ServiceControlDurableObject } from "./control-do/service-control-do.js";
 export { IdentityDirectoryDurableObject } from "./directory/identity-directory-do.js";
 
diff --git a/apps/release-service/src/intents/routes.ts b/apps/release-service/src/intents/routes.ts
index d65d59dc37..0f458ee552 100644
--- a/apps/release-service/src/intents/routes.ts
+++ b/apps/release-service/src/intents/routes.ts
@@ -57,6 +57,10 @@ export interface SubmitIntentDependencies {
 	startWorkflow?: typeof startReleaseIntentWorkflow;
 }
 
+export interface DryRunIntentDependencies {
+	keyResolver?: JWTVerifyGetKey;
+}
+
 function hasExactKeys(value: Record<string, unknown>, expected: readonly string[]): boolean {
 	const keys = Object.keys(value);
 	return keys.length === expected.length && keys.every((key) => expected.includes(key));
@@ -418,6 +422,70 @@ export async function handleSubmitReleaseIntent(
 	}
 }
 
+export async function handleDryRunReleaseIntent(
+	request: Request,
+	requestId: string,
+	configuration: ServiceConfiguration,
+	dependencies: DryRunIntentDependencies = {},
+): Promise<Response> {
+	try {
+		const identity = await authenticateWorkload(request, configuration, dependencies.keyResolver);
+		const body = await readJsonObject(request, MAX_INTENT_BODY_BYTES);
+		if (
+			!hasExactKeys(body, ["publisherDid", "packageSlug", "version", "release"]) ||
+			typeof body["publisherDid"] !== "string" ||
+			!isDid(body["publisherDid"]) ||
+			typeof body["packageSlug"] !== "string" ||
+			!PACKAGE_SLUG_PATTERN.test(body["packageSlug"]) ||
+			typeof body["version"] !== "string" ||
+			!VERSION_PATTERN.test(body["version"])
+		) {
+			throw new ApiError("INVALID_REQUEST", 400, "Invalid release intent request");
+		}
+		const release = parseDelegatedReleaseSourceRecord(body["release"], {
+			packageSlug: body["packageSlug"],
+			version: body["version"],
+		});
+		if (!release) {
+			throw new ApiError("INVALID_REQUEST", 400, "Invalid release intent request");
+		}
+		const publisherDid = body["publisherDid"];
+		const admission = await env.SERVICE_CONTROL_DO.getByName(
+			SERVICE_CONTROL_OBJECT_NAME,
+		).getAdmissionDecision(publisherDid);
+		if (!admission.allowed) {
+			throw new ApiError(
+				admission.code === "PUBLISHER_SUSPENDED" ? "PUBLISHER_SUSPENDED" : "SERVICE_PAUSED",
+				503,
+				admission.code === "PUBLISHER_SUSPENDED"
+					? "Publisher is suspended"
+					: "Release admission is paused",
+			);
+		}
+		const policy = await env.PUBLISHER_DO.getByName(publisherDid).getWorkloadPolicyIfInitialized(
+			publisherDid,
+			release.package,
+		);
+		if (!policy || !evaluateWorkloadPolicy(identity, policy).ok) {
+			throw new ApiError("WORKLOAD_NOT_ALLOWED", 403, "Workload is not authorized");
+		}
+		return apiSuccess(
+			{
+				allowed: true,
+				publisherDid,
+				packageSlug: release.package,
+				version: release.version,
+				workloadPolicyVersion: policy.stateVersion,
+				workloadIdentityDigest: await digestWorkloadIdentity(identity),
+				requestDigest: await digest(["release-intent", 1, publisherDid, release]),
+			},
+			requestId,
+		);
+	} catch (error) {
+		return routeFailure(error, requestId);
+	}
+}
+
 export async function handleGetReleaseIntent(
 	request: Request,
 	requestId: string,
diff --git a/apps/release-service/src/oauth/routes.ts b/apps/release-service/src/oauth/routes.ts
index e079ba0b7c..8b3a7b156f 100644
--- a/apps/release-service/src/oauth/routes.ts
+++ b/apps/release-service/src/oauth/routes.ts
@@ -27,6 +27,10 @@ const OAUTH_NETWORK_TIMEOUT_MS = 30_000;
 const ERROR_NAME_PATTERN = /^[A-Za-z][A-Za-z0-9]{0,63}$/;
 const ERROR_CODE_PATTERN = /^[A-Za-z][A-Za-z0-9_]{0,63}$/;
 
+export interface OAuthRouteDependencies {
+	registerDirectoryIdentity?: typeof registerDirectoryIdentity;
+}
+
 export async function handleApproverIdentityAuthorize(
 	request: Request,
 	requestId: string,
@@ -299,6 +303,7 @@ export async function handleOAuthCallback(
 	request: Request,
 	requestId: string,
 	configuration: ServiceConfiguration,
+	dependencies: OAuthRouteDependencies = {},
 ): Promise<Response> {
 	try {
 		const params = new URL(request.url).searchParams;
@@ -339,26 +344,35 @@ export async function handleOAuthCallback(
 						},
 						fetch: callbackFetch,
 					});
+		const identityKinds =
+			route.purpose === "release_delegation"
+				? (["publisher"] as const)
+				: (["publisher", "approver"] as const);
+		const register = dependencies.registerDirectoryIdentity ?? registerDirectoryIdentity;
+		const registerIdentities = async () => {
+			for (const identityKind of identityKinds) {
+				try {
+					await register(identityKind, route.expectedDid);
+				} catch (error) {
+					writeOperationsMetric({
+						event: "directory_failure",
+						outcome: identityKind,
+						requestId,
+					});
+					console.error(
+						JSON.stringify({
+							event: "identity_directory_registration_failed",
+							requestId,
+							name: error instanceof Error ? error.name : "UnknownError",
+						}),
+					);
+					throw error;
+				}
+			}
+		};
+		if (route.purpose === "release_delegation") await registerIdentities();
 		await client.callback(params);
-		try {
-			await registerDirectoryIdentity(
-				route.purpose === "approver_identity" ? "approver" : "publisher",
-				route.expectedDid,
-			);
-		} catch (error) {
-			writeOperationsMetric({
-				event: "directory_failure",
-				outcome: route.purpose === "approver_identity" ? "approver" : "publisher",
-				requestId,
-			});
-			console.error(
-				JSON.stringify({
-					event: "identity_directory_registration_failed",
-					requestId,
-					name: error instanceof Error ? error.name : "UnknownError",
-				}),
-			);
-		}
+		if (route.purpose !== "release_delegation") await registerIdentities();
 		const headers = new Headers({
 			"cache-control": "no-store",
 			location: new URL(route.redirectTarget, configuration.publicOrigin).toString(),
@@ -366,13 +380,14 @@ export async function handleOAuthCallback(
 			"x-request-id": requestId,
 		});
 		headers.append("set-cookie", clearOAuthRouteCookie());
-		if (route.purpose === "publisher_identity") {
-			await client.revoke();
-			const created = await createPublisherApplicationSession(env.PUBLISHER_DO, route.expectedDid);
-			for (const cookie of created.setCookieHeaders) headers.append("set-cookie", cookie);
-		} else if (route.purpose === "approver_identity") {
-			const created = await createApproverApplicationSession(env.APPROVER_DO, route.expectedDid);
-			for (const cookie of created.setCookieHeaders) headers.append("set-cookie", cookie);
+		if (route.purpose !== "release_delegation") {
+			if (route.purpose === "publisher_identity") await client.revoke();
+			const [publisherSession, approverSession] = await Promise.all([
+				createPublisherApplicationSession(env.PUBLISHER_DO, route.expectedDid),
+				createApproverApplicationSession(env.APPROVER_DO, route.expectedDid),
+			]);
+			for (const cookie of publisherSession.setCookieHeaders) headers.append("set-cookie", cookie);
+			for (const cookie of approverSession.setCookieHeaders) headers.append("set-cookie", cookie);
 		}
 		return new Response(null, { status: 303, headers });
 	} catch (error) {
diff --git a/apps/release-service/src/operations/encryption-routes.ts b/apps/release-service/src/operations/encryption-routes.ts
index 71a450745d..7e17f156b8 100644
--- a/apps/release-service/src/operations/encryption-routes.ts
+++ b/apps/release-service/src/operations/encryption-routes.ts
@@ -156,7 +156,7 @@ async function rotateEncryptionRecords(
 			rotated,
 			raced,
 			nextCursor,
-			complete: nextCursor === null,
+			complete: nextCursor === null && rotated === 0 && raced === 0,
 		},
 		requestId,
 	);
diff --git a/apps/release-service/src/publisher-do/intent-state.ts b/apps/release-service/src/publisher-do/intent-state.ts
index 27cbe5de93..1dcac6b559 100644
--- a/apps/release-service/src/publisher-do/intent-state.ts
+++ b/apps/release-service/src/publisher-do/intent-state.ts
@@ -11,6 +11,7 @@ const MAX_WORKLOAD_JSON_CHARS = 16 * 1024;
 const MAX_RELEASE_INPUT_JSON_CHARS = 64 * 1024;
 const MAX_STATE_DATA_JSON_CHARS = 64 * 1024;
 const MAX_INTENT_LIFETIME_MS = 7 * 24 * 60 * 60_000;
+const MAX_LIST_LIMIT = 101;
 
 export type IntentState =
 	| "received"
@@ -634,7 +635,7 @@ export class IntentStateStore {
 			(afterIntentId !== null && !ULID_PATTERN.test(afterIntentId)) ||
 			!Number.isSafeInteger(limit) ||
 			limit < 1 ||
-			limit > 100
+			limit > MAX_LIST_LIMIT
 		) {
 			throw new IntentStateError();
 		}
diff --git a/apps/release-service/src/publisher-do/publisher-do.ts b/apps/release-service/src/publisher-do/publisher-do.ts
index 83d8193e36..1387a83592 100644
--- a/apps/release-service/src/publisher-do/publisher-do.ts
+++ b/apps/release-service/src/publisher-do/publisher-do.ts
@@ -54,6 +54,15 @@ import {
 	type StoredVerificationStep,
 	type VerificationStepName,
 } from "./verification-step.js";
+import {
+	initializeWorkflowPairingSchema,
+	WorkflowPairingStore,
+	type ClaimWorkflowPairingInput,
+	type ClaimWorkflowPairingResult,
+	type CreateWorkflowPairingInput,
+	type CreateWorkflowPairingResult,
+	type StoredWorkflowPairing,
+} from "./workflow-pairing.js";
 import {
 	initializeWorkloadPolicySchema,
 	WorkloadPolicyStore,
@@ -109,14 +118,25 @@ export type {
 	PublisherRestoreKind,
 } from "./operations-restore.js";
 export type { ConsumeIntentRateLimitInput, ConsumeIntentRateLimitResult } from "./rate-limit.js";
+export type {
+	ClaimWorkflowPairingInput,
+	ClaimWorkflowPairingResult,
+	CreateWorkflowPairingInput,
+	CreateWorkflowPairingResult,
+	StoredWorkflowPairing,
+	WorkflowPairingClaim,
+	WorkflowPairingState,
+} from "./workflow-pairing.js";
 
 const DID_PATTERN = /^did:[a-z][a-z0-9]*:[A-Za-z0-9._:%-]+$/;
 const HASH_PATTERN = /^[A-Za-z0-9_-]{32,128}$/;
 const TOKEN_PATTERN = /^[A-Za-z0-9_-]{43}$/;
 const ACTOR_IDENTITY_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,255}$/;
 const MAX_CIPHERTEXT_CHARS = 1_500_000;
+const MAX_ACTIVE_OAUTH_STATES = 20;
 const MAX_REFRESH_LEASE_MS = 5 * 60_000;
 const MAX_PUBLISHER_SESSION_MS = 24 * 60 * 60_000;
+const MAX_ACTIVE_PUBLISHER_SESSIONS = 20;
 const MAINTENANCE_BATCH_SIZE = 100;
 const REFRESH_TOKEN_BYTES = 32;
 const BASE64_PADDING_PATTERN = /=+$/;
@@ -160,6 +180,7 @@ export interface PutOAuthStateInput {
 	clientKeyId: string;
 	redirectTarget: string;
 	expiresAt: number;
+	now?: number;
 }
 
 export interface StoredOAuthState {
@@ -170,7 +191,9 @@ export interface StoredOAuthState {
 	expiresAt: number;
 }
 
-export type PutOAuthStateResult = { ok: true } | { ok: false; code: "OAUTH_STATE_EXISTS" };
+export type PutOAuthStateResult =
+	| { ok: true }
+	| { ok: false; code: "OAUTH_STATE_EXISTS" | "OAUTH_STATE_LIMIT_REACHED" };
 
 export interface PutDelegationInput {
 	publisherDid: string;
@@ -322,7 +345,10 @@ export interface StoredPublisherSession {
 
 export type CreatePublisherSessionResult =
 	| { ok: true; session: StoredPublisherSession }
-	| { ok: false; code: "PUBLISHER_SESSION_EXISTS" | "PUBLISHER_SUSPENDED" };
+	| {
+			ok: false;
+			code: "PUBLISHER_SESSION_EXISTS" | "PUBLISHER_SESSION_LIMIT_REACHED" | "PUBLISHER_SUSPENDED";
+	  };
 
 export type ValidatePublisherSessionResult =
 	| { ok: true; session: StoredPublisherSession }
@@ -331,6 +357,18 @@ export type ValidatePublisherSessionResult =
 			code: "PUBLISHER_SESSION_INVALID" | "PUBLISHER_SESSION_EXPIRED" | "PUBLISHER_SUSPENDED";
 	  };
 
+export type ConfirmWorkflowPairingResult =
+	| {
+			ok: true;
+			pairing: StoredWorkflowPairing;
+			policy: StoredWorkloadPolicy;
+			replayed: boolean;
+	  }
+	| {
+			ok: false;
+			code: "PAIRING_CONFLICT" | "PAIRING_EXPIRED" | "PAIRING_INVALID" | "PAIRING_NOT_CLAIMED";
+	  };
+
 interface OAuthStateRow {
 	[key: string]: string | number | ArrayBuffer | null;
 	encrypted_state: string;
@@ -448,6 +486,32 @@ async function expirationDigest(intentId: string, expiresAt: number): Promise<st
 	return encodeBase64Url(new Uint8Array(digest));
 }
 
+function workflowPairingPolicyMatches(
+	policy: StoredWorkloadPolicy,
+	expected: Pick<
+		StoredWorkloadPolicy,
+		| "active"
+		| "allowedEnvironments"
+		| "allowedRefs"
+		| "packageSlug"
+		| "repository"
+		| "repositoryId"
+		| "repositoryOwnerId"
+		| "workflowRef"
+	>,
+): boolean {
+	return (
+		policy.packageSlug === expected.packageSlug &&
+		policy.repository === expected.repository &&
+		policy.repositoryId === expected.repositoryId &&
+		policy.repositoryOwnerId === expected.repositoryOwnerId &&
+		policy.workflowRef === expected.workflowRef &&
+		JSON.stringify(policy.allowedRefs) === JSON.stringify(expected.allowedRefs) &&
+		JSON.stringify(policy.allowedEnvironments) === JSON.stringify(expected.allowedEnvironments) &&
+		policy.active === expected.active
+	);
+}
+
 export class PublisherDurableObject extends DurableObject<Env> {
 	readonly #objectName: string | undefined;
 	readonly #workloadPolicies: WorkloadPolicyStore;
@@ -457,6 +521,7 @@ export class PublisherDurableObject extends DurableObject<Env> {
 	readonly #verificationSteps: VerificationStepStore;
 	readonly #operationsRestore: OperationsRestoreStore;
 	readonly #intentRateLimits: IntentRateLimitStore;
+	readonly #workflowPairings: WorkflowPairingStore;
 
 	constructor(ctx: DurableObjectState, env: Env) {
 		super(ctx, env);
@@ -468,6 +533,7 @@ export class PublisherDurableObject extends DurableObject<Env> {
 		this.#verificationSteps = new VerificationStepStore(ctx.storage);
 		this.#operationsRestore = new OperationsRestoreStore(ctx.storage);
 		this.#intentRateLimits = new IntentRateLimitStore(ctx.storage);
+		this.#workflowPairings = new WorkflowPairingStore(ctx.storage);
 		void ctx.blockConcurrencyWhile(() => {
 			this.#initializeSchema();
 			return Promise.resolve();
@@ -554,6 +620,7 @@ export class PublisherDurableObject extends DurableObject<Env> {
 		initializeVerificationStepSchema(this.ctx.storage);
 		initializeOperationsRestoreSchema(this.ctx.storage);
 		initializeIntentRateLimitSchema(this.ctx.storage);
+		initializeWorkflowPairingSchema(this.ctx.storage);
 	}
 
 	#assertPublisherObjectName(publisherDid: string): void {
@@ -659,6 +726,21 @@ export class PublisherDurableObject extends DurableObject<Env> {
 		return this.#workloadPolicies.get(packageSlug);
 	}
 
+	getWorkloadPolicyIfInitialized(
+		publisherDid: string,
+		packageSlug: string,
+	): StoredWorkloadPolicy | null {
+		this.#assertPublisherObjectName(publisherDid);
+		const owner = this.ctx.storage.sql
+			.exec<PublisherRow>("SELECT did FROM publisher WHERE id = 1")
+			.toArray()[0];
+		if (!owner) return null;
+		if (owner.did !== publisherDid) {
+			throw new PublisherStateError("PUBLISHER_DID_MISMATCH");
+		}
+		return this.#workloadPolicies.get(packageSlug);
+	}
+
 	listWorkloadPolicies(
 		publisherDid: string,
 		afterPackageSlug: string | null,
@@ -668,6 +750,83 @@ export class PublisherDurableObject extends DurableObject<Env> {
 		return this.#workloadPolicies.list(afterPackageSlug, limit);
 	}
 
+	async createWorkflowPairing(
+		input: CreateWorkflowPairingInput,
+	): Promise<CreateWorkflowPairingResult> {
+		this.#assertPublisherDid(input.publisherDid);
+		const currentPolicy = this.#workloadPolicies.get(input.packageSlug);
+		const result = this.#workflowPairings.create(input, currentPolicy?.stateVersion ?? null);
+		if (result.ok) await this.#scheduleNextAlarm(input.now ?? Date.now());
+		return result;
+	}
+
+	getWorkflowPairing(
+		publisherDid: string,
+		pairingId: string,
+		now = Date.now(),
+	): StoredWorkflowPairing | null {
+		this.#assertPublisherDid(publisherDid);
+		return this.#workflowPairings.get(pairingId, now);
+	}
+
+	claimWorkflowPairing(input: ClaimWorkflowPairingInput): ClaimWorkflowPairingResult {
+		this.#assertPublisherDid(input.publisherDid);
+		return this.#workflowPairings.claim(input);
+	}
+
+	confirmWorkflowPairing(
+		publisherDid: string,
+		pairingId: string,
+		now = Date.now(),
+	): ConfirmWorkflowPairingResult {
+		this.#assertPublisherDid(publisherDid);
+		const prepared = this.#workflowPairings.prepareConfirmation(pairingId, now);
+		if (!prepared.ok) return prepared;
+		const claim = prepared.pairing.claim;
+		if (!claim) return { ok: false, code: "PAIRING_NOT_CLAIMED" };
+		const expectedVersion = prepared.pairing.expectedPolicyVersion;
+		const expectedPolicy = {
+			packageSlug: prepared.pairing.packageSlug,
+			repository: claim.repository,
+			repositoryId: claim.repositoryId,
+			repositoryOwnerId: claim.repositoryOwnerId,
+			workflowRef: claim.workflowRef,
+			allowedRefs: [claim.ref],
+			allowedEnvironments: claim.environment ? [claim.environment] : [],
+			active: true,
+		} as const;
+		if (prepared.replayed) {
+			const policy = this.#workloadPolicies.get(expectedPolicy.packageSlug);
+			return policy && workflowPairingPolicyMatches(policy, expectedPolicy)
+				? { ok: true, pairing: prepared.pairing, policy, replayed: true }
+				: { ok: false, code: "PAIRING_CONFLICT" };
+		}
+		const result = this.#workloadPolicies.put({
+			publisherDid,
+			...expectedPolicy,
+			expectedVersion,
+			now,
+		});
+		let policy: StoredWorkloadPolicy | null = result.ok ? result.policy : null;
+		if (!policy) {
+			const current = this.#workloadPolicies.get(expectedPolicy.packageSlug);
+			if (
+				current &&
+				current.stateVersion === (expectedVersion ?? 0) + 1 &&
+				workflowPairingPolicyMatches(current, expectedPolicy)
+			) {
+				policy = current;
+			}
+		}
+		if (!policy) return { ok: false, code: "PAIRING_CONFLICT" };
+		return {
+			ok: true,
+			pairing: this.#workflowPairings.complete(pairingId, now),
+			policy,
+			replayed: false,
+		};
+	}
+
 	async createIntent(input: CreateIntentInput): Promise<CreateIntentResult> {
 		this.#assertPublisherDid(input.publisherDid);
 		const result = this.#intents.create(input);
@@ -845,6 +1004,12 @@ export class PublisherDurableObject extends DurableObject<Env> {
 				.toArray()[0];
 			if (existing) return { ok: false, code: "PUBLISHER_SESSION_EXISTS" } as const;
 			this.ctx.storage.sql.exec("DELETE FROM publisher_sessions WHERE expires_at <= ?", now);
+			const count = this.ctx.storage.sql
+				.exec<{ count: number }>("SELECT COUNT(*) AS count FROM publisher_sessions")
+				.one().count;
+			if (count >= MAX_ACTIVE_PUBLISHER_SESSIONS) {
+				return { ok: false, code: "PUBLISHER_SESSION_LIMIT_REACHED" } as const;
+			}
 			this.ctx.storage.sql.exec(
 				`INSERT INTO publisher_sessions (
 					token_hash, csrf_hash, session_epoch, expires_at, created_at, last_seen_at
@@ -872,7 +1037,7 @@ export class PublisherDurableObject extends DurableObject<Env> {
 				},
 			} as const;
 		});
-		await this.#scheduleNextAlarm(now);
+		if (result.ok) await this.#scheduleNextAlarm(now);
 		return result;
 	}
 
@@ -973,6 +1138,7 @@ export class PublisherDurableObject extends DurableObject<Env> {
 
 	async putOAuthState(input: PutOAuthStateInput): Promise<PutOAuthStateResult> {
 		this.#assertPublisherDid(input.publisherDid);
+		const now = input.now ?? Date.now();
 		if (
 			!HASH_PATTERN.test(input.stateHash) ||
 			!validBoundedString(input.encryptedState, MAX_CIPHERTEXT_CHARS) ||
@@ -981,7 +1147,9 @@ export class PublisherDurableObject extends DurableObject<Env> {
 			!validBoundedString(input.clientKeyId, 128) ||
 			!validRelativeRedirectPath(input.redirectTarget) ||
 			!Number.isSafeInteger(input.expiresAt) ||
-			input.expiresAt <= Date.now()
+			input.expiresAt <= now ||
+			!Number.isSafeInteger(now) ||
+			now < 0
 		) {
 			throw new PublisherStateError("OAUTH_STATE_INVALID");
 		}
@@ -993,6 +1161,13 @@ export class PublisherDurableObject extends DurableObject<Env> {
 				)
 				.toArray()[0];
 			if (existing) return { ok: false, code: "OAUTH_STATE_EXISTS" } as const;
+			this.ctx.storage.sql.exec("DELETE FROM oauth_states WHERE expires_at <= ?", now);
+			const count = this.ctx.storage.sql
+				.exec<{ count: number }>("SELECT COUNT(*) AS count FROM oauth_states")
+				.one().count;
+			if (count >= MAX_ACTIVE_OAUTH_STATES) {
+				return { ok: false, code: "OAUTH_STATE_LIMIT_REACHED" } as const;
+			}
 			this.ctx.storage.sql.exec(
 				`INSERT INTO oauth_states (
 						state_hash, encrypted_state, encryption_key_version, encryption_purpose, client_key_id,
@@ -1005,31 +1180,31 @@ export class PublisherDurableObject extends DurableObject<Env> {
 				input.clientKeyId,
 				input.redirectTarget,
 				input.expiresAt,
-				Date.now(),
+				now,
 			);
 			this.#appendAudit(
 				"oauth-state-created",
 				"publisher",
 				input.publisherDid,
 				input.stateHash,
-				Date.now(),
+				now,
 			);
 			return { ok: true } as const;
 		});
-		await this.#scheduleNextAlarm(Date.now());
+		if (result.ok) await this.#scheduleNextAlarm(now);
 		return result;
 	}
 
-	consumeOAuthState(
+	async consumeOAuthState(
 		publisherDid: string,
 		stateHash: string,
 		now = Date.now(),
-	): StoredOAuthState | null {
+	): Promise<StoredOAuthState | null> {
 		this.#assertPublisherDid(publisherDid);
 		if (!HASH_PATTERN.test(stateHash) || !Number.isSafeInteger(now)) {
 			throw new PublisherStateError("OAUTH_STATE_INVALID");
 		}
-		return this.ctx.storage.transactionSync(() => {
+		const result = this.ctx.storage.transactionSync(() => {
 			const row = this.ctx.storage.sql
 				.exec<OAuthStateRow>(
 					`SELECT encrypted_state, encryption_key_version, client_key_id, redirect_target, expires_at
@@ -1059,6 +1234,8 @@ export class PublisherDurableObject extends DurableObject<Env> {
 				expiresAt: row.expires_at,
 			};
 		});
+		await this.#scheduleNextAlarm(now);
+		return result;
 	}
 
 	putDelegation(input: PutDelegationInput): PutDelegationResult {
@@ -1239,6 +1416,7 @@ export class PublisherDurableObject extends DurableObject<Env> {
 			this.ctx.storage.sql.exec("DELETE FROM deadlines");
 			this.ctx.storage.sql.exec("DELETE FROM intents");
 			this.ctx.storage.sql.exec("DELETE FROM workload_policies");
+			this.ctx.storage.sql.exec("DELETE FROM workflow_pairings");
 			this.ctx.storage.sql.exec("DELETE FROM publisher_sessions");
 			this.ctx.storage.sql.exec("DELETE FROM oauth_states");
 			this.ctx.storage.sql.exec("DELETE FROM delegation");
@@ -1344,7 +1522,7 @@ export class PublisherDurableObject extends DurableObject<Env> {
 			afterSequence < 0 ||
 			!Number.isSafeInteger(limit) ||
 			limit < 1 ||
-			limit > 100
+			limit > 101
 		) {
 			throw new PublisherStateError("OPERATIONS_EXPORT_INVALID");
 		}
@@ -1809,6 +1987,7 @@ export class PublisherDurableObject extends DurableObject<Env> {
 				idempotency_expiry: number | null;
 				rate_expiry: number | null;
 				intent_expiry: number | null;
+				pairing_expiry: number | null;
 			}>(
 				`SELECT
 					(SELECT MIN(scheduled_at) FROM deadlines) AS operation_deadline,
@@ -1819,7 +1998,9 @@ export class PublisherDurableObject extends DurableObject<Env> {
 					(SELECT MIN(expires_at) FROM intents
 					 WHERE state IN (
 					   'received', 'verifying', 'verified', 'awaiting_approval', 'ready'
-					 )) AS intent_expiry`,
+					 )) AS intent_expiry,
+					(SELECT MIN(expires_at) FROM workflow_pairings
+					 WHERE state IN ('pending', 'claimed')) AS pairing_expiry`,
 			)
 			.one();
 		const deadlines = Object.values(candidates).filter(
@@ -1859,6 +2040,7 @@ export class PublisherDurableObject extends DurableObject<Env> {
 			this.ctx.storage.sql.exec("DELETE FROM publisher_sessions WHERE expires_at <= ?", now);
 			this.ctx.storage.sql.exec("DELETE FROM intent_idempotency WHERE expires_at <= ?", now);
 			this.ctx.storage.sql.exec("DELETE FROM intent_rate_idempotency WHERE expires_at <= ?", now);
+			this.#workflowPairings.expire(now);
 		});
 		await this.#scheduleNextAlarm(now);
 	}
diff --git a/apps/release-service/src/publisher-do/workflow-pairing.ts b/apps/release-service/src/publisher-do/workflow-pairing.ts
new file mode 100644
index 0000000000..de8a305a22
--- /dev/null
+++ b/apps/release-service/src/publisher-do/workflow-pairing.ts
@@ -0,0 +1,428 @@
+const DID_PATTERN = /^did:[a-z0-9]+:[A-Za-z0-9._:%-]+$/;
+const ULID_PATTERN = /^[0-9A-HJKMNP-TV-Z]{26}$/;
+const TOKEN_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+const IDEMPOTENCY_KEY_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{15,127}$/;
+const PACKAGE_SLUG_PATTERN = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
+const REPOSITORY_PATTERN = /^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/;
+const DECIMAL_ID_PATTERN = /^[1-9][0-9]*$/;
+const REF_PATTERN = /^refs\/[A-Za-z0-9._/-]{1,507}$/;
+const WORKFLOW_REF_PATTERN =
+	/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/\.github\/workflows\/[A-Za-z0-9_./-]+\.ya?ml@refs\/[A-Za-z0-9._/-]+$/;
+const MAX_ACTIVE_PAIRINGS = 10;
+const MAX_PAIRING_LIFETIME_MS = 30 * 60_000;
+const PAIRING_RETENTION_MS = 24 * 60 * 60_000;
+const encoder = new TextEncoder();
+
+export type WorkflowPairingState = "claimed" | "confirmed" | "expired" | "pending";
+
+export interface WorkflowPairingClaim {
+	repository: string;
+	repositoryId: string;
+	repositoryOwner: string;
+	repositoryOwnerId: string;
+	repositoryVisibility: "internal" | "private" | "public";
+	workflowRef: string;
+	ref: string;
+	environment: string | null;
+}
+
+export interface StoredWorkflowPairing {
+	id: string;
+	packageSlug: string;
+	state: WorkflowPairingState;
+	claim: WorkflowPairingClaim | null;
+	expectedPolicyVersion: number | null;
+	expiresAt: number;
+	createdAt: number;
+	claimedAt: number | null;
+	confirmedAt: number | null;
+}
+
+export interface CreateWorkflowPairingInput {
+	publisherDid: string;
+	pairingId: string;
+	pairingToken: string;
+	mutationKey: string;
+	packageSlug: string;
+	expiresAt: number;
+	now?: number;
+}
+
+export type CreateWorkflowPairingResult =
+	| {
+			ok: true;
+			pairing: StoredWorkflowPairing;
+			pairingToken: string;
+			replayed: boolean;
+	  }
+	| { ok: false; code: "PAIRING_CONFLICT" | "PAIRING_LIMIT_REACHED" };
+
+export interface ClaimWorkflowPairingInput {
+	publisherDid: string;
+	pairingId: string;
+	pairingToken: string;
+	claim: WorkflowPairingClaim;
+	now?: number;
+}
+
+export type ClaimWorkflowPairingResult =
+	| { ok: true; pairing: StoredWorkflowPairing; replayed: boolean }
+	| { ok: false; code: "PAIRING_CONFLICT" | "PAIRING_EXPIRED" | "PAIRING_INVALID" };
+
+export type PrepareWorkflowPairingConfirmationResult =
+	| { ok: true; pairing: StoredWorkflowPairing; replayed: boolean }
+	| { ok: false; code: "PAIRING_EXPIRED" | "PAIRING_INVALID" | "PAIRING_NOT_CLAIMED" };
+
+interface WorkflowPairingRow {
+	[key: string]: string | number | ArrayBuffer | null;
+	id: string;
+	mutation_key: string;
+	package_slug: string;
+	pairing_token: string;
+	state: WorkflowPairingState;
+	claim_json: string | null;
+	expected_policy_version: number | null;
+	expires_at: number;
+	created_at: number;
+	claimed_at: number | null;
+	confirmed_at: number | null;
+}
+
+export class WorkflowPairingError extends Error {
+	constructor() {
+		super("WORKFLOW_PAIRING_INVALID");
+		this.name = "WorkflowPairingError";
+	}
+}
+
+function validEnvironment(value: unknown): value is string | null {
+	if (value === null) return true;
+	if (typeof value !== "string" || value.length === 0 || value.length > 255) return false;
+	for (const character of value) {
+		const codePoint = character.codePointAt(0)!;
+		if (codePoint <= 31 || codePoint === 127) return false;
+	}
+	return true;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function normalizeClaim(value: unknown): WorkflowPairingClaim | null {
+	if (!isRecord(value)) return null;
+	const record = value;
+	const keys = Object.keys(record);
+	if (
+		keys.length !== 8 ||
+		!keys.every((key) =>
+			[
+				"repository",
+				"repositoryId",
+				"repositoryOwner",
+				"repositoryOwnerId",
+				"repositoryVisibility",
+				"workflowRef",
+				"ref",
+				"environment",
+			].includes(key),
+		)
+	) {
+		return null;
+	}
+	const repository = record["repository"];
+	const repositoryId = record["repositoryId"];
+	const repositoryOwner = record["repositoryOwner"];
+	const repositoryOwnerId = record["repositoryOwnerId"];
+	const repositoryVisibility = record["repositoryVisibility"];
+	const workflowRef = record["workflowRef"];
+	const ref = record["ref"];
+	const environment = record["environment"];
+	if (
+		typeof repository !== "string" ||
+		!REPOSITORY_PATTERN.test(repository) ||
+		repository !== repository.toLowerCase() ||
+		typeof repositoryId !== "string" ||
+		!DECIMAL_ID_PATTERN.test(repositoryId) ||
+		typeof repositoryOwner !== "string" ||
+		repositoryOwner.length === 0 ||
+		repositoryOwner.length > 64 ||
+		repositoryOwner !== repositoryOwner.toLowerCase() ||
+		typeof repositoryOwnerId !== "string" ||
+		!DECIMAL_ID_PATTERN.test(repositoryOwnerId) ||
+		(repositoryVisibility !== "public" &&
+			repositoryVisibility !== "private" &&
+			repositoryVisibility !== "internal") ||
+		typeof workflowRef !== "string" ||
+		!WORKFLOW_REF_PATTERN.test(workflowRef) ||
+		!workflowRef.toLowerCase().startsWith(`${repository}/.github/workflows/`) ||
+		typeof ref !== "string" ||
+		!REF_PATTERN.test(ref) ||
+		!validEnvironment(environment)
+	) {
+		return null;
+	}
+	return {
+		repository,
+		repositoryId,
+		repositoryOwner,
+		repositoryOwnerId,
+		repositoryVisibility,
+		workflowRef,
+		ref,
+		environment,
+	};
+}
+
+function claimsEqual(left: WorkflowPairingClaim, right: WorkflowPairingClaim): boolean {
+	return JSON.stringify(left) === JSON.stringify(right);
+}
+
+function tokensEqual(left: string, right: string): boolean {
+	if (!TOKEN_PATTERN.test(left) || !TOKEN_PATTERN.test(right)) return false;
+	return crypto.subtle.timingSafeEqual(encoder.encode(left), encoder.encode(right));
+}
+
+function rowToPairing(row: WorkflowPairingRow): StoredWorkflowPairing {
+	let claim: WorkflowPairingClaim | null = null;
+	if (row.claim_json !== null) {
+		try {
+			claim = normalizeClaim(JSON.parse(row.claim_json));
+		} catch {
+			claim = null;
+		}
+		if (!claim || JSON.stringify(claim) !== row.claim_json) throw new WorkflowPairingError();
+	}
+	return {
+		id: row.id,
+		packageSlug: row.package_slug,
+		state: row.state,
+		claim,
+		expectedPolicyVersion: row.expected_policy_version,
+		expiresAt: row.expires_at,
+		createdAt: row.created_at,
+		claimedAt: row.claimed_at,
+		confirmedAt: row.confirmed_at,
+	};
+}
+
+export function initializeWorkflowPairingSchema(storage: DurableObjectStorage): void {
+	storage.sql.exec(`
+		CREATE TABLE IF NOT EXISTS workflow_pairings (
+			id TEXT PRIMARY KEY,
+			mutation_key TEXT NOT NULL UNIQUE,
+			package_slug TEXT NOT NULL,
+			pairing_token TEXT NOT NULL,
+			state TEXT NOT NULL CHECK (state IN ('pending', 'claimed', 'confirmed', 'expired')),
+			claim_json TEXT,
+			expected_policy_version INTEGER,
+			expires_at INTEGER NOT NULL,
+			created_at INTEGER NOT NULL,
+			claimed_at INTEGER,
+			confirmed_at INTEGER,
+			CHECK (
+				(state = 'pending' AND claim_json IS NULL AND claimed_at IS NULL AND confirmed_at IS NULL)
+				OR (state = 'claimed' AND claim_json IS NOT NULL AND claimed_at IS NOT NULL AND confirmed_at IS NULL)
+				OR (state = 'confirmed' AND claim_json IS NOT NULL AND claimed_at IS NOT NULL AND confirmed_at IS NOT NULL)
+				OR state = 'expired'
+			)
+		);
+		CREATE INDEX IF NOT EXISTS idx_workflow_pairings_expiry
+			ON workflow_pairings(state, expires_at);
+	`);
+}
+
+export class WorkflowPairingStore {
+	constructor(private readonly storage: DurableObjectStorage) {}
+
+	#createRow(input: CreateWorkflowPairingInput, expectedPolicyVersion: number | null, now: number) {
+		this.storage.sql.exec(
+			`INSERT INTO workflow_pairings (
+				id, mutation_key, package_slug, pairing_token, state, claim_json,
+				expected_policy_version, expires_at, created_at, claimed_at, confirmed_at
+			) VALUES (?, ?, ?, ?, 'pending', NULL, ?, ?, ?, NULL, NULL)`,
+			input.pairingId,
+			input.mutationKey,
+			input.packageSlug,
+			input.pairingToken,
+			expectedPolicyVersion,
+			input.expiresAt,
+			now,
+		);
+		return this.#read(input.pairingId)!;
+	}
+
+	#read(pairingId: string): WorkflowPairingRow | null {
+		return (
+			this.storage.sql
+				.exec<WorkflowPairingRow>(
+					`SELECT id, mutation_key, package_slug, pairing_token, state, claim_json,
+					        expected_policy_version, expires_at, created_at, claimed_at, confirmed_at
+					 FROM workflow_pairings WHERE id = ?`,
+					pairingId,
+				)
+				.toArray()[0] ?? null
+		);
+	}
+
+	#expire(now: number): void {
+		this.storage.sql.exec(
+			`UPDATE workflow_pairings SET state = 'expired'
+			 WHERE state IN ('pending', 'claimed') AND expires_at <= ?`,
+			now,
+		);
+		this.storage.sql.exec(
+			"DELETE FROM workflow_pairings WHERE state IN ('confirmed', 'expired') AND expires_at <= ?",
+			now - PAIRING_RETENTION_MS,
+		);
+	}
+
+	create(
+		input: CreateWorkflowPairingInput,
+		expectedPolicyVersion: number | null,
+	): CreateWorkflowPairingResult {
+		const now = input.now ?? Date.now();
+		if (
+			!DID_PATTERN.test(input.publisherDid) ||
+			!ULID_PATTERN.test(input.pairingId) ||
+			!TOKEN_PATTERN.test(input.pairingToken) ||
+			!IDEMPOTENCY_KEY_PATTERN.test(input.mutationKey) ||
+			!PACKAGE_SLUG_PATTERN.test(input.packageSlug) ||
+			(expectedPolicyVersion !== null &&
+				(!Number.isSafeInteger(expectedPolicyVersion) || expectedPolicyVersion < 1)) ||
+			!Number.isSafeInteger(now) ||
+			!Number.isSafeInteger(input.expiresAt) ||
+			input.expiresAt <= now ||
+			input.expiresAt - now > MAX_PAIRING_LIFETIME_MS
+		) {
+			throw new WorkflowPairingError();
+		}
+		return this.storage.transactionSync(() => {
+			this.#expire(now);
+			const existing = this.storage.sql
+				.exec<WorkflowPairingRow>(
+					`SELECT id, mutation_key, package_slug, pairing_token, state, claim_json,
+					        expected_policy_version, expires_at, created_at, claimed_at, confirmed_at
+					 FROM workflow_pairings WHERE mutation_key = ?`,
+					input.mutationKey,
+				)
+				.toArray()[0];
+			if (existing) {
+				if (existing.package_slug !== input.packageSlug) {
+					return { ok: false, code: "PAIRING_CONFLICT" } as const;
+				}
+				return {
+					ok: true,
+					pairing: rowToPairing(existing),
+					pairingToken: existing.pairing_token,
+					replayed: true,
+				} as const;
+			}
+			const active = this.storage.sql
+				.exec<{ count: number }>(
+					"SELECT COUNT(*) AS count FROM workflow_pairings WHERE state IN ('pending', 'claimed')",
+				)
+				.one().count;
+			if (active >= MAX_ACTIVE_PAIRINGS) {
+				return { ok: false, code: "PAIRING_LIMIT_REACHED" } as const;
+			}
+			const row = this.#createRow(input, expectedPolicyVersion, now);
+			return {
+				ok: true,
+				pairing: rowToPairing(row),
+				pairingToken: input.pairingToken,
+				replayed: false,
+			} as const;
+		});
+	}
+
+	get(pairingId: string, now = Date.now()): StoredWorkflowPairing | null {
+		if (!ULID_PATTERN.test(pairingId) || !Number.isSafeInteger(now)) {
+			throw new WorkflowPairingError();
+		}
+		this.#expire(now);
+		const row = this.#read(pairingId);
+		return row ? rowToPairing(row) : null;
+	}
+
+	claim(input: ClaimWorkflowPairingInput): ClaimWorkflowPairingResult {
+		const now = input.now ?? Date.now();
+		const claim = normalizeClaim(input.claim);
+		if (
+			!DID_PATTERN.test(input.publisherDid) ||
+			!ULID_PATTERN.test(input.pairingId) ||
+			!TOKEN_PATTERN.test(input.pairingToken) ||
+			!claim ||
+			!Number.isSafeInteger(now)
+		) {
+			throw new WorkflowPairingError();
+		}
+		return this.storage.transactionSync(() => {
+			this.#expire(now);
+			const row = this.#read(input.pairingId);
+			if (!row || !tokensEqual(row.pairing_token, input.pairingToken)) {
+				return { ok: false, code: "PAIRING_INVALID" } as const;
+			}
+			if (row.state === "expired") return { ok: false, code: "PAIRING_EXPIRED" } as const;
+			const current = rowToPairing(row);
+			if (current.claim) {
+				if (!claimsEqual(current.claim, claim)) {
+					return { ok: false, code: "PAIRING_CONFLICT" } as const;
+				}
+				return { ok: true, pairing: current, replayed: true } as const;
+			}
+			this.storage.sql.exec(
+				`UPDATE workflow_pairings
+				 SET state = 'claimed', claim_json = ?, claimed_at = ?
+				 WHERE id = ? AND state = 'pending'`,
+				JSON.stringify(claim),
+				now,
+				input.pairingId,
+			);
+			return {
+				ok: true,
+				pairing: rowToPairing(this.#read(input.pairingId)!),
+				replayed: false,
+			} as const;
+		});
+	}
+
+	prepareConfirmation(
+		pairingId: string,
+		now = Date.now(),
+	): PrepareWorkflowPairingConfirmationResult {
+		const pairing = this.get(pairingId, now);
+		if (!pairing) return { ok: false, code: "PAIRING_INVALID" };
+		if (pairing.state === "expired") return { ok: false, code: "PAIRING_EXPIRED" };
+		if (pairing.state === "pending") return { ok: false, code: "PAIRING_NOT_CLAIMED" };
+		return { ok: true, pairing, replayed: pairing.state === "confirmed" };
+	}
+
+	complete(pairingId: string, now = Date.now()): StoredWorkflowPairing {
+		if (!ULID_PATTERN.test(pairingId) || !Number.isSafeInteger(now)) {
+			throw new WorkflowPairingError();
+		}
+		this.storage.sql.exec(
+			`UPDATE workflow_pairings SET state = 'confirmed', confirmed_at = ?
+			 WHERE id = ? AND state = 'claimed'`,
+			now,
+			pairingId,
+		);
+		const row = this.#read(pairingId);
+		if (!row || row.state !== "confirmed") throw new WorkflowPairingError();
+		return rowToPairing(row);
+	}
+
+	expire(now: number): void {
+		if (!Number.isSafeInteger(now)) throw new WorkflowPairingError();
+		this.#expire(now);
+	}
+
+	nextExpiry(): number | null {
+		return this.storage.sql
+			.exec<{ expires_at: number | null }>(
+				"SELECT MIN(expires_at) AS expires_at FROM workflow_pairings WHERE state IN ('pending', 'claimed')",
+			)
+			.one().expires_at;
+	}
+}
diff --git a/apps/release-service/src/publisher-do/workload-policy.ts b/apps/release-service/src/publisher-do/workload-policy.ts
index 95f394828f..fd20525d1a 100644
--- a/apps/release-service/src/publisher-do/workload-policy.ts
+++ b/apps/release-service/src/publisher-do/workload-policy.ts
@@ -6,6 +6,7 @@ const REF_PATTERN = /^refs\/[A-Za-z0-9._/-]{1,507}$/;
 const WORKFLOW_REF_PATTERN =
 	/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+\/\.github\/workflows\/[A-Za-z0-9_./-]+\.ya?ml@refs\/[A-Za-z0-9._/-]+$/;
 const MAX_POLICY_VALUES = 32;
+const MAX_LIST_LIMIT = 101;
 
 export interface StoredWorkloadPolicy {
 	packageSlug: string;
@@ -74,7 +75,7 @@ function normalizeValues(
 	if (normalized.some((value) => typeof value !== "string" || !validate(value))) {
 		throw new WorkloadPolicyError();
 	}
-	normalized.sort((left, right) => left.localeCompare(right));
+	normalized.sort((left, right) => (left < right ? -1 : left > right ? 1 : 0));
 	if (new Set(normalized).size !== normalized.length) throw new WorkloadPolicyError();
 	return normalized;
 }
@@ -254,7 +255,7 @@ export class WorkloadPolicyStore {
 			(afterPackageSlug !== null && !PACKAGE_SLUG_PATTERN.test(afterPackageSlug)) ||
 			!Number.isSafeInteger(limit) ||
 			limit < 1 ||
-			limit > 100
+			limit > MAX_LIST_LIMIT
 		) {
 			throw new WorkloadPolicyError();
 		}
diff --git a/apps/release-service/src/publisher/routes.ts b/apps/release-service/src/publisher/routes.ts
index 834270af46..d8744feecc 100644
--- a/apps/release-service/src/publisher/routes.ts
+++ b/apps/release-service/src/publisher/routes.ts
@@ -1,12 +1,18 @@
+import type { ActorResolver } from "@atcute/identity-resolver";
 import { isDid } from "@atcute/lexicons/syntax";
 import { env } from "cloudflare:workers";
 
 import { readJsonObject } from "../api/body.js";
 import { ApiError } from "../api/errors.js";
 import { apiFailure, apiSuccess } from "../api/response.js";
+import {
+	ApprovalAuthorityError,
+	loadCurrentApprovalPolicy,
+	type CurrentApprovalPolicy,
+} from "../approvals/authority.js";
 import type { ServiceConfiguration } from "../config.js";
 import { serializeIntentResource } from "../intents/routes.js";
-import { createPublisherOAuthClient } from "../oauth/custody.js";
+import { createPublisherOAuthClient, createWorkerActorResolver } from "../oauth/custody.js";
 import type { StoredWorkloadPolicy } from "../publisher-do/publisher-do.js";
 import { WorkloadPolicyError } from "../publisher-do/workload-policy.js";
 import {
@@ -19,11 +25,44 @@ const ULID_PATTERN = /^[0-9A-HJKMNP-TV-Z]{26}$/;
 const IDEMPOTENCY_KEY_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{15,127}$/;
 const POSITIVE_INTEGER_PATTERN = /^[1-9][0-9]*$/;
 const WORKLOAD_PATH_PATTERN = /^\/v1\/publisher\/workloads\/([A-Za-z][A-Za-z0-9_-]{0,63})$/;
+const APPROVER_STATUS_PATH_PATTERN =
+	/^\/v1\/publisher\/workloads\/([A-Za-z][A-Za-z0-9_-]{0,63})\/approvers$/;
 const DEFAULT_LIMIT = 50;
 const MAX_LIMIT = 100;
+const MAX_AUDIT_ACTOR_RESOLUTIONS = 16;
 
 export interface PublisherRouteDependencies {
 	revokeDelegation?: (publisherDid: `did:${string}:${string}`) => Promise<void>;
+	loadCurrentApprovalPolicy?: (
+		publisherDid: string,
+		packageSlug: string,
+	) => Promise<CurrentApprovalPolicy>;
+	actorResolver?: ActorResolver;
+}
+
+async function resolveAuditActorHandles(
+	rows: readonly { actorIdentity: string }[],
+	resolver: ActorResolver,
+): Promise<ReadonlyMap<string, string>> {
+	const actorDids = [...new Set(rows.map((row) => row.actorIdentity).filter(isDid))].slice(
+		0,
+		MAX_AUDIT_ACTOR_RESOLUTIONS,
+	);
+	const entries = await Promise.all(
+		actorDids.map(async (actorDid) => {
+			try {
+				const actor = await resolver.resolve(actorDid, { signal: AbortSignal.timeout(5_000) });
+				return actor.handle === "handle.invalid" ? null : ([actorDid, actor.handle] as const);
+			} catch {
+				return null;
+			}
+		}),
+	);
+	const handles = new Map<string, string>();
+	for (const entry of entries) {
+		if (entry) handles.set(entry[0], entry[1]);
+	}
+	return handles;
 }
 
 function hasExactKeys(value: Record<string, unknown>, expected: readonly string[]): boolean {
@@ -85,6 +124,12 @@ function routeFailure(error: unknown, requestId: string): Response {
 			requestId,
 		);
 	}
+	if (error instanceof ApprovalAuthorityError) {
+		return apiFailure(
+			new ApiError("PROFILE_FETCH_FAILED", 503, "Package profile could not be verified"),
+			requestId,
+		);
+	}
 	throw error;
 }
 
@@ -151,20 +196,33 @@ export function matchPublisherWorkloadPath(
 	return match?.[1] ? { packageSlug: match[1] } : null;
 }
 
+export function matchPublisherApproverStatusPath(
+	pathname: string,
+): Readonly<Record<string, string>> | null {
+	const match = APPROVER_STATUS_PATH_PATTERN.exec(pathname);
+	return match?.[1] ? { packageSlug: match[1] } : null;
+}
+
 export async function handleGetPublisher(
 	request: Request,
 	requestId: string,
 	configuration: ServiceConfiguration,
+	dependencies: PublisherRouteDependencies = {},
 ): Promise<Response> {
 	try {
 		const session = await publisherSession(request, configuration);
-		const delegation = await env.PUBLISHER_DO.getByName(session.publisherDid).getDelegation(
-			session.publisherDid,
-		);
+		const [delegation, actorHandles] = await Promise.all([
+			env.PUBLISHER_DO.getByName(session.publisherDid).getDelegation(session.publisherDid),
+			resolveAuditActorHandles(
+				[{ actorIdentity: session.publisherDid }],
+				dependencies.actorResolver ?? createWorkerActorResolver(),
+			),
+		]);
 		return apiSuccess(
 			{
 				publisher: {
 					did: session.publisherDid,
+					handle: actorHandles.get(session.publisherDid) ?? null,
 					delegation: sanitizedDelegation(delegation),
 					sessionExpiresAt: session.expiresAt,
 				},
@@ -253,6 +311,69 @@ export async function handleListPublisherWorkloads(
 	}
 }
 
+export async function handleGetPublisherApproverStatus(
+	request: Request,
+	requestId: string,
+	configuration: ServiceConfiguration,
+	params: Readonly<Record<string, string>>,
+	dependencies: PublisherRouteDependencies = {},
+): Promise<Response> {
+	try {
+		const session = await publisherSession(request, configuration);
+		const url = new URL(request.url);
+		if ([...url.searchParams].length > 0) {
+			throw new ApiError(
+				"INVALID_REQUEST",
+				400,
+				"Approver status query does not accept parameters",
+			);
+		}
+		const packageSlug = params["packageSlug"];
+		if (!packageSlug || !PACKAGE_SLUG_PATTERN.test(packageSlug)) {
+			throw new ApiError("NOT_FOUND", 404, "Workload policy not found");
+		}
+		const publisher = env.PUBLISHER_DO.getByName(session.publisherDid);
+		if (!(await publisher.getWorkloadPolicy(session.publisherDid, packageSlug))) {
+			throw new ApiError("NOT_FOUND", 404, "Workload policy not found");
+		}
+		const policy = dependencies.loadCurrentApprovalPolicy
+			? await dependencies.loadCurrentApprovalPolicy(session.publisherDid, packageSlug)
+			: await loadCurrentApprovalPolicy(session.publisherDid, packageSlug);
+		const items = await Promise.all(
+			policy.approverDids.map(async (approverDid) => {
+				const enrollment =
+					await env.APPROVER_DO.getByName(approverDid).getEnrollmentStatus(approverDid);
+				return {
+					did: approverDid,
+					status:
+						enrollment.activeCredentialCount > 0
+							? ("enrolled" as const)
+							: enrollment.credentialCount > 0
+								? ("revoked" as const)
+								: ("not_enrolled" as const),
+				};
+			}),
+		);
+		const actorHandles = await resolveAuditActorHandles(
+			items.map((item) => ({ actorIdentity: item.did })),
+			dependencies.actorResolver ?? createWorkerActorResolver(),
+		);
+		return apiSuccess(
+			{
+				packageSlug,
+				profileCid: policy.profileCid,
+				items: items.map((item) => ({
+					...item,
+					handle: actorHandles.get(item.did) ?? null,
+				})),
+			},
+			requestId,
+		);
+	} catch (error) {
+		return routeFailure(error, requestId);
+	}
+}
+
 export async function handlePutPublisherWorkload(
 	request: Request,
 	requestId: string,
@@ -386,3 +507,54 @@ export async function handleListPublisherIntents(
 		return routeFailure(error, requestId);
 	}
 }
+
+export async function handleListPublisherAudit(
+	request: Request,
+	requestId: string,
+	configuration: ServiceConfiguration,
+	dependencies: PublisherRouteDependencies = {},
+): Promise<Response> {
+	try {
+		const session = await publisherSession(request, configuration);
+		const url = new URL(request.url);
+		if ([...url.searchParams.keys()].some((key) => key !== "cursor" && key !== "limit")) {
+			throw new ApiError("INVALID_REQUEST", 400, "Invalid pagination parameters");
+		}
+		const cursorValue = url.searchParams.get("cursor");
+		if (
+			url.searchParams.getAll("cursor").length > 1 ||
+			url.searchParams.getAll("limit").length > 1 ||
+			(cursorValue !== null && !POSITIVE_INTEGER_PATTERN.test(cursorValue))
+		) {
+			throw new ApiError("INVALID_REQUEST", 400, "Invalid pagination parameters");
+		}
+		const cursor = cursorValue === null ? 0 : Number(cursorValue);
+		if (!Number.isSafeInteger(cursor)) {
+			throw new ApiError("INVALID_REQUEST", 400, "Invalid pagination parameters");
+		}
+		const limit = parseLimit(url);
+		const rows = await env.PUBLISHER_DO.getByName(session.publisherDid).listAuditEvents(
+			session.publisherDid,
+			cursor,
+			limit + 1,
+		);
+		const actorHandles = await resolveAuditActorHandles(
+			rows.slice(0, limit),
+			dependencies.actorResolver ?? createWorkerActorResolver(),
+		);
+		const items = rows.slice(0, limit).map((row) => ({
+			sequence: row.sequence,
+			eventType: row.eventType,
+			actorRealm: row.actorRealm,
+			actorIdentity: row.actorIdentity,
+			actorHandle: actorHandles.get(row.actorIdentity) ?? null,
+			subject: row.subject,
+			reasonCode: row.reasonCode,
+			createdAt: row.createdAt,
+		}));
+		const nextCursor = rows.length > limit ? String(items.at(-1)?.sequence) : undefined;
+		return apiSuccess({ items, ...(nextCursor ? { nextCursor } : {}) }, requestId);
+	} catch (error) {
+		return routeFailure(error, requestId);
+	}
+}
diff --git a/apps/release-service/src/publishing/workflow.ts b/apps/release-service/src/publishing/workflow.ts
index bea70ee8b6..f97a262f08 100644
--- a/apps/release-service/src/publishing/workflow.ts
+++ b/apps/release-service/src/publishing/workflow.ts
@@ -78,7 +78,7 @@ const STEP_SLOT_PATTERN = /[[\]]/g;
 
 export interface PublicationWorkflowOutput {
 	intentId: string;
-	state: "conflict" | "failed" | "invalid" | "published" | "ready";
+	state: "conflict" | "expired" | "failed" | "invalid" | "published" | "ready";
 	reasonCode: string | null;
 }
 
@@ -94,6 +94,7 @@ type TransitionSummary =
 type AttemptResult =
 	| { state: "published"; uri: string; cid: string }
 	| { state: "reconciling" }
+	| { state: "expired" }
 	| { state: "blocked"; reasonCode: string }
 	| { state: "failed"; reasonCode: string };
 
@@ -149,6 +150,7 @@ function publisherSnapshotErrorCode(error: unknown): PublisherSnapshotError["cod
 
 function isRetryablePublicationBlock(code: string): boolean {
 	return (
+		code === "ENCRYPTION_KEY_INACTIVE" ||
 		code === "PERMIT_EXPIRED" ||
 		code === "PERMIT_STALE" ||
 		code === "PUBLICATION_PAUSED" ||
@@ -666,6 +668,21 @@ export async function publishVerifiedIntent(
 			if (!current || (current.state !== "ready" && current.state !== "publishing")) {
 				return { state: "failed", reasonCode: "INTENT_NOT_READY" };
 			}
+			if (current.state === "ready" && current.expiresAt <= Date.now()) {
+				const expired = await transition(publisher, {
+					publisherDid,
+					intentId: originalIntent.id,
+					expectedState: "ready",
+					expectedGeneration: current.stateGeneration,
+					toState: "expired",
+					transitionDigest: await digest(["expired", originalIntent.id, current.expiresAt]),
+					actorRealm: "system",
+					actorIdentity: "release-service",
+					reasonCode: "INTENT_EXPIRED",
+					stateDataJson: JSON.stringify({ reasonCode: "INTENT_EXPIRED" }),
+				});
+				return expired.ok ? { state: "expired" } : { state: "failed", reasonCode: expired.code };
+			}
 			const staged = await step.do<MaterializationStageResult>(
 				"publication-stage",
 				MATERIALIZATION_STEP_CONFIG,
@@ -834,6 +851,7 @@ export async function publishVerifiedIntent(
 			return await step.do<AttemptResult>(`publication-create-${attempt}`, async () => {
 				let writeStarted = false;
 				try {
+					const serviceConfiguration = await loadConfiguration(env);
 					const restored = await restorePublicationSession(env, publisherDid);
 					const delegation = await publisher.getDelegation(publisherDid);
 					if (
@@ -846,6 +864,7 @@ export async function publishVerifiedIntent(
 						publisherDid,
 						originalIntent.id,
 						PUBLICATION_PERMIT_TTL_MS,
+						serviceConfiguration.encryption.currentKeyVersion,
 					);
 					if (!permit.ok) {
 						return failBeforeWrite(permit.code, isRetryablePublicationBlock(permit.code));
@@ -957,6 +976,9 @@ export async function publishVerifiedIntent(
 		if (attemptResult.state === "published") {
 			return { intentId: originalIntent.id, state: "published", reasonCode: null };
 		}
+		if (attemptResult.state === "expired") {
+			return { intentId: originalIntent.id, state: "expired", reasonCode: "INTENT_EXPIRED" };
+		}
 		if (attemptResult.state === "failed") {
 			await step.do(`publication-terminal-staging-cleanup-${attempt}`, async () => {
 				const stored = await publisher.getPublicationMaterialization(
diff --git a/apps/release-service/src/routes.ts b/apps/release-service/src/routes.ts
index b17666eacd..ae09350254 100644
--- a/apps/release-service/src/routes.ts
+++ b/apps/release-service/src/routes.ts
@@ -29,14 +29,20 @@ import {
 } from "./backup/workflow-route.js";
 import type { ServiceConfiguration } from "./config.js";
 import {
+	handleActivateEncryptionKey,
 	handleControlAudit,
+	handleEncryptionKeyStatus,
 	handleReadiness,
+	handleRetireEncryptionKey,
 	handleServiceStatus,
 	handleSetServiceMode,
+	handleStartEncryptionVerification,
+	matchRetireEncryptionKeyPath,
 } from "./control-do/routes.js";
 import { handleListDirectory } from "./directory/routes.js";
 import {
 	handleCancelReleaseIntent,
+	handleDryRunReleaseIntent,
 	handleGetReleaseIntent,
 	handleSubmitReleaseIntent,
 	matchIntentCancelPath,
@@ -69,13 +75,25 @@ import {
 } from "./operator/routes.js";
 import {
 	handleDisablePublisherWorkload,
+	handleGetPublisherApproverStatus,
 	handleGetPublisher,
+	handleListPublisherAudit,
 	handleListPublisherIntents,
 	handleListPublisherWorkloads,
 	handlePutPublisherWorkload,
 	handleRevokePublisherDelegation,
+	matchPublisherApproverStatusPath,
 	matchPublisherWorkloadPath,
 } from "./publisher/routes.js";
+import {
+	handleClaimWorkflowPairing,
+	handleConfirmWorkflowPairing,
+	handleCreateWorkflowPairing,
+	handleGetWorkflowPairing,
+	matchWorkflowPairingClaimPath,
+	matchWorkflowPairingConfirmPath,
+	matchWorkflowPairingPath,
+} from "./workflow-pairing/routes.js";
 
 export interface RouteDefinition {
 	method: "DELETE" | "GET" | "PATCH" | "POST" | "PUT";
@@ -110,6 +128,12 @@ export const ROUTES = Object.freeze([
 		handler: (request, requestId, configuration) =>
 			handleSubmitReleaseIntent(request, requestId, configuration),
 	},
+	{
+		method: "POST",
+		path: "/v1/release-intents/dry-run",
+		handler: (request, requestId, configuration) =>
+			handleDryRunReleaseIntent(request, requestId, configuration),
+	},
 	{
 		method: "GET",
 		path: "/v1/release-intents/{intentId}",
@@ -132,7 +156,8 @@ export const ROUTES = Object.freeze([
 	{
 		method: "GET",
 		path: "/v1/publisher",
-		handler: handleGetPublisher,
+		handler: (request, requestId, configuration) =>
+			handleGetPublisher(request, requestId, configuration),
 	},
 	{
 		method: "DELETE",
@@ -145,6 +170,33 @@ export const ROUTES = Object.freeze([
 		path: "/v1/publisher/workloads",
 		handler: handleListPublisherWorkloads,
 	},
+	{
+		method: "POST",
+		path: "/v1/publisher/workflow-pairings",
+		handler: (request, requestId, configuration) =>
+			handleCreateWorkflowPairing(request, requestId, configuration),
+	},
+	{
+		method: "GET",
+		path: "/v1/publisher/workflow-pairings/{pairingId}",
+		match: matchWorkflowPairingPath,
+		handler: (request, requestId, configuration, params) =>
+			handleGetWorkflowPairing(request, requestId, configuration, params),
+	},
+	{
+		method: "POST",
+		path: "/v1/publisher/workflow-pairings/{pairingId}/confirm",
+		match: matchWorkflowPairingConfirmPath,
+		handler: (request, requestId, configuration, params) =>
+			handleConfirmWorkflowPairing(request, requestId, configuration, params),
+	},
+	{
+		method: "POST",
+		path: "/v1/workflow-pairings/{pairingId}/claim",
+		match: matchWorkflowPairingClaimPath,
+		handler: (request, requestId, configuration, params) =>
+			handleClaimWorkflowPairing(request, requestId, configuration, params),
+	},
 	{
 		method: "POST",
 		path: "/v1/publisher/workloads",
@@ -156,11 +208,23 @@ export const ROUTES = Object.freeze([
 		match: matchPublisherWorkloadPath,
 		handler: handleDisablePublisherWorkload,
 	},
+	{
+		method: "GET",
+		path: "/v1/publisher/workloads/{packageSlug}/approvers",
+		match: matchPublisherApproverStatusPath,
+		handler: (request, requestId, configuration, params) =>
+			handleGetPublisherApproverStatus(request, requestId, configuration, params),
+	},
 	{
 		method: "GET",
 		path: "/v1/publisher/intents",
 		handler: handleListPublisherIntents,
 	},
+	{
+		method: "GET",
+		path: "/v1/publisher/audit",
+		handler: handleListPublisherAudit,
+	},
 	{
 		method: "POST",
 		path: "/v1/approver/session/authorize",
@@ -328,4 +392,29 @@ export const ROUTES = Object.freeze([
 		accessRole: "viewer",
 		handler: handleControlAudit,
 	},
+	{
+		method: "GET",
+		path: "/admin/api/encryption/keys",
+		accessRole: "viewer",
+		handler: handleEncryptionKeyStatus,
+	},
+	{
+		method: "POST",
+		path: "/admin/api/encryption/keys/activate",
+		accessRole: "admin",
+		handler: handleActivateEncryptionKey,
+	},
+	{
+		method: "POST",
+		path: "/admin/api/encryption/verify",
+		accessRole: "admin",
+		handler: handleStartEncryptionVerification,
+	},
+	{
+		method: "POST",
+		path: "/admin/api/encryption/keys/{version}/retire",
+		match: matchRetireEncryptionKeyPath,
+		accessRole: "admin",
+		handler: handleRetireEncryptionKey,
+	},
 ] as const satisfies readonly RouteDefinition[]);
diff --git a/apps/release-service/src/ui/App.test.tsx b/apps/release-service/src/ui/App.test.tsx
index 071c386676..8725a2aeec 100644
--- a/apps/release-service/src/ui/App.test.tsx
+++ b/apps/release-service/src/ui/App.test.tsx
@@ -1,5 +1,5 @@
 import { I18nProvider } from "@lingui/react";
-import { render, screen } from "@testing-library/react";
+import { fireEvent, render, screen } from "@testing-library/react";
 import { afterEach, describe, expect, it, vi } from "vitest";
 
 import { getApproval, listApproverCredentials } from "./api.js";
@@ -9,8 +9,8 @@ import { applyLocale, i18n } from "./i18n.js";
 const PUBLISHER_DID = "did:web:publisher.example.com";
 const INTENT_ID = "01JABCDEFGHJKMNPQRSTVWXYZ0";
 
-function success(data: unknown): Response {
-	return Response.json({ data, requestId: "request-1" });
+function success(data: unknown, status = 200): Response {
+	return Response.json({ data, requestId: "request-1" }, { status });
 }
 
 function renderApp(path: string) {
@@ -24,11 +24,12 @@ function renderApp(path: string) {
 
 afterEach(() => {
 	vi.unstubAllGlobals();
+	document.cookie = "__Host-emdash_publisher_csrf=; Max-Age=0; Path=/; Secure";
 	applyLocale("en");
 });
 
 describe("release-service web surfaces", () => {
-	it("shows publisher identity login when no application session exists", async () => {
+	it("shows one account login without role navigation", async () => {
 		vi.stubGlobal(
 			"fetch",
 			vi.fn(async () =>
@@ -43,11 +44,17 @@ describe("release-service web surfaces", () => {
 		);
 		renderApp("/publisher");
 
-		expect(await screen.findByRole("heading", { name: "Sign in as a publisher" })).toBeTruthy();
-		expect(screen.getByRole("button", { name: "Continue with Atmosphere" })).toBeTruthy();
+		expect(await screen.findByRole("heading", { name: "Sign in" })).toBeTruthy();
+		expect(
+			screen.getByText("Use your Atmosphere account to view and manage your plugin releases."),
+		).toBeTruthy();
+		expect(screen.getByLabelText("Account handle")).toBeTruthy();
+		expect(screen.getByRole("button", { name: "Sign in with Atmosphere" })).toBeTruthy();
+		expect(screen.queryByRole("navigation")).toBeNull();
 	});
 
 	it("renders publisher authority, workloads, and intent state", async () => {
+		let auditRequests = 0;
 		vi.stubGlobal(
 			"fetch",
 			vi.fn(async (input: RequestInfo | URL) => {
@@ -59,9 +66,11 @@ describe("release-service web surfaces", () => {
 					return success({
 						publisher: {
 							did: PUBLISHER_DID,
+							handle: "publisher.example.com",
 							delegation: {
 								releaseNsid: "com.emdashcms.experimental.package.release",
-								scope: "atproto repo:com.emdashcms.experimental.package.release?action=create",
+								scope:
+									"atproto repo:com.emdashcms.experimental.package.release?action=create blob:application/gzip blob:image/*",
 								issuer: "https://authorization.example.com",
 								pdsUrl: "https://pds.example.com",
 								expiresAt: null,
@@ -92,6 +101,51 @@ describe("release-service web surfaces", () => {
 						],
 					});
 				}
+				if (path === "/v1/publisher/audit") {
+					auditRequests += 1;
+					return success({
+						items: [
+							{
+								sequence: auditRequests === 1 ? 3 : 4,
+								eventType: auditRequests === 1 ? "workload-policy-stored" : "delegation-revoked",
+								actorRealm: "publisher",
+								actorIdentity: PUBLISHER_DID,
+								actorHandle: "publisher.example.com",
+								subject: "gallery",
+								reasonCode: null,
+								createdAt: 1_799_999_250_000,
+							},
+						],
+						...(auditRequests === 1 ? { nextCursor: "3" } : {}),
+					});
+				}
+				if (path === "/v1/publisher/workloads/gallery/approvers") {
+					return success({
+						packageSlug: "gallery",
+						profileCid: "bafyprofile",
+						items: [
+							{
+								did: "did:plc:approver",
+								handle: "approver.example.com",
+								status: "enrolled",
+							},
+						],
+					});
+				}
+				if (path === "/v1/approver/credentials") {
+					return success({
+						items: [
+							{
+								id: "credential",
+								name: "Work laptop",
+								transports: ["internal"],
+								createdAt: 1_799_999_000_000,
+								lastUsedAt: null,
+								revokedAt: null,
+							},
+						],
+					});
+				}
 				return success({
 					items: [
 						{
@@ -115,9 +169,201 @@ describe("release-service web surfaces", () => {
 		);
 		renderApp("/publisher");
 
-		expect(await screen.findByText(PUBLISHER_DID)).toBeTruthy();
+		await screen.findByText("Signed in as @publisher.example.com");
+		expect(screen.queryByText(PUBLISHER_DID)).toBeNull();
 		expect(screen.getAllByText("gallery").length).toBeGreaterThan(0);
 		expect(screen.getByText("Awaiting approval")).toBeTruthy();
+		expect(screen.getByRole("heading", { name: "Account activity" })).toBeTruthy();
+		expect(
+			screen.getByRole("heading", { name: "Connect another GitHub Actions workflow" }),
+		).toBeTruthy();
+		expect(
+			screen.getByText(
+				"Choose which workflow may publish releases for one of your plugin packages. GitHub proves the repository, workflow file, and branch when you run it.",
+			),
+		).toBeTruthy();
+		expect(screen.getAllByText("@publisher.example.com")).toHaveLength(1);
+		expect(screen.getByRole("heading", { name: "Release approval passkeys" })).toBeTruthy();
+		expect(screen.getByText("Work laptop")).toBeTruthy();
+		expect(screen.getByText("GitHub workflow connected")).toBeTruthy();
+		expect(screen.queryByText("Technical details")).toBeNull();
+		fireEvent.click(
+			screen.getByRole("button", { name: "View details for GitHub workflow connected" }),
+		);
+		expect(await screen.findByText("Activity details")).toBeTruthy();
+		expect(screen.getByText(PUBLISHER_DID)).toBeTruthy();
+		expect(screen.getByText("workload-policy-stored")).toBeTruthy();
+		fireEvent.click(screen.getByRole("button", { name: "Show older activity" }));
+		expect(await screen.findByText("Automated publishing turned off")).toBeTruthy();
+		expect(screen.getByText("GitHub workflow connected")).toBeTruthy();
+		fireEvent.click(screen.getByRole("button", { name: "Check approval readiness" }));
+		expect(await screen.findByRole("heading", { name: "Approval readiness" })).toBeTruthy();
+		expect(screen.getByText("@approver.example.com")).toBeTruthy();
+	});
+
+	it("keeps workflow setup unavailable until publishing is authorized", async () => {
+		vi.stubGlobal(
+			"fetch",
+			vi.fn(async (input: RequestInfo | URL) => {
+				const path = new URL(
+					input instanceof Request ? input.url : input.toString(),
+					location.origin,
+				).pathname;
+				if (path === "/v1/publisher") {
+					return success({
+						publisher: {
+							did: PUBLISHER_DID,
+							handle: "publisher.example.com",
+							delegation: null,
+						},
+					});
+				}
+				return success({ items: [] });
+			}),
+		);
+		renderApp("/publisher");
+
+		expect(await screen.findByText("Signed in as @publisher.example.com")).toBeTruthy();
+		expect(screen.getByRole("button", { name: "Authorize publishing" })).toBeTruthy();
+		expect(
+			screen.getByText("Authorize publishing before connecting a GitHub workflow."),
+		).toBeTruthy();
+		expect(screen.getByLabelText("Plugin ID").hasAttribute("disabled")).toBe(true);
+		expect(screen.getByRole("button", { name: "Start connection" }).hasAttribute("disabled")).toBe(
+			true,
+		);
+		expect(screen.queryByText(PUBLISHER_DID)).toBeNull();
+	});
+
+	it("connects a GitHub workflow without asking for GitHub identifiers", async () => {
+		document.cookie = `__Host-emdash_publisher_csrf=${"C".repeat(43)}; Path=/; Secure`;
+		const requests: Request[] = [];
+		vi.stubGlobal(
+			"fetch",
+			vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
+				const url = new URL(
+					input instanceof Request ? input.url : input.toString(),
+					location.origin,
+				);
+				const request = new Request(url, init);
+				requests.push(request);
+				const path = url.pathname;
+				if (path === "/v1/publisher") {
+					return success({
+						publisher: {
+							did: PUBLISHER_DID,
+							handle: "publisher.example.com",
+							delegation: {
+								releaseNsid: "com.emdashcms.experimental.package.release",
+								scope:
+									"atproto repo:com.emdashcms.experimental.package.release?action=create blob:application/gzip blob:image/*",
+								issuer: "https://authorization.example.com",
+								pdsUrl: "https://pds.example.com",
+								expiresAt: null,
+								refreshBefore: null,
+								status: "active",
+								stateVersion: 1,
+							},
+						},
+					});
+				}
+				if (path === "/v1/publisher/workloads") return success({ items: [] });
+				if (path === "/v1/publisher/intents") return success({ items: [] });
+				if (path === "/v1/publisher/audit") return success({ items: [] });
+				if (path === "/v1/approver/credentials") return success({ items: [] });
+				const basePairing = {
+					id: "01JABCDEFGHJKMNPQRSTVWXYZ1",
+					packageSlug: "gallery",
+					expiresAt: 1_900_000_000_000,
+					createdAt: 1_800_000_000_000,
+				};
+				if (path.endsWith("/confirm")) {
+					return success({
+						pairing: {
+							...basePairing,
+							state: "confirmed",
+							claim: {
+								repository: "example/gallery",
+								repositoryId: "123",
+								repositoryOwner: "example",
+								repositoryOwnerId: "456",
+								repositoryVisibility: "private",
+								workflowRef: "example/gallery/.github/workflows/release.yml@refs/heads/main",
+								ref: "refs/heads/main",
+								environment: null,
+							},
+							claimedAt: 1_800_000_001_000,
+							confirmedAt: 1_800_000_002_000,
+						},
+						policy: {
+							packageSlug: "gallery",
+							repository: "example/gallery",
+							repositoryId: "123",
+							repositoryOwnerId: "456",
+							workflowRef: "example/gallery/.github/workflows/release.yml@refs/heads/main",
+							allowedRefs: ["refs/heads/main"],
+							allowedEnvironments: [],
+							active: true,
+							stateVersion: 1,
+							authorizedBy: PUBLISHER_DID,
+							createdAt: 1_800_000_002_000,
+							updatedAt: 1_800_000_002_000,
+						},
+						replayed: false,
+					});
+				}
+				if (request.method === "GET") {
+					return success({
+						pairing: {
+							...basePairing,
+							state: "claimed",
+							claim: {
+								repository: "example/gallery",
+								repositoryId: "123",
+								repositoryOwner: "example",
+								repositoryOwnerId: "456",
+								repositoryVisibility: "private",
+								workflowRef: "example/gallery/.github/workflows/release.yml@refs/heads/main",
+								ref: "refs/heads/main",
+								environment: null,
+							},
+							claimedAt: 1_800_000_001_000,
+							confirmedAt: null,
+						},
+					});
+				}
+				return success(
+					{
+						pairing: {
+							...basePairing,
+							state: "pending",
+							claim: null,
+							claimedAt: null,
+							confirmedAt: null,
+						},
+						pairingToken: "T".repeat(43),
+						replayed: false,
+					},
+					201,
+				);
+			}),
+		);
+		renderApp("/publisher");
+
+		await screen.findByRole("heading", { name: "2. Connect a GitHub Actions workflow" });
+		fireEvent.change(screen.getByLabelText("Plugin ID"), { target: { value: "gallery" } });
+		fireEvent.click(screen.getByRole("button", { name: "Start connection" }));
+		expect(await screen.findByText("Run the workflow once to identify it")).toBeTruthy();
+		expect(screen.getByText(/id-token: write/)).toBeTruthy();
+		expect(screen.getByText(/release connect/)).toBeTruthy();
+		fireEvent.click(screen.getByRole("button", { name: "I've run the workflow" }));
+		expect(await screen.findByText("Confirm this GitHub workflow")).toBeTruthy();
+		expect(screen.getByText("example/gallery")).toBeTruthy();
+		expect(screen.getByText(".github/workflows/release.yml")).toBeTruthy();
+		expect(screen.getByText("main")).toBeTruthy();
+		fireEvent.click(screen.getByRole("button", { name: "Allow this workflow" }));
+		await screen.findByRole("button", { name: "Start connection" });
+		expect(requests.some((request) => request.url.endsWith("/confirm"))).toBe(true);
 	});
 
 	it("shows immutable workload and provenance evidence before approval", async () => {
@@ -191,19 +437,68 @@ describe("release-service web surfaces", () => {
 		});
 		renderApp(`/approvals/${INTENT_ID}?publisher=${encodeURIComponent(PUBLISHER_DID)}`);
 
-		expect(await screen.findByText("example/gallery")).toBeTruthy();
-		expect(screen.getByText("sha256:artifact")).toBeTruthy();
-		expect(screen.getByText("sha256:provenance")).toBeTruthy();
+		expect(await screen.findByRole("heading", { name: "Review plugin release" })).toBeTruthy();
+		expect(screen.getByText("example/gallery")).toBeTruthy();
+		expect(screen.getByText(".github/workflows/release.yml")).toBeTruthy();
+		expect(screen.getByText("Adds permission to connect to external websites")).toBeTruthy();
+		for (const technicalValue of [PUBLISHER_DID, "sha256:artifact", "sha256:provenance"]) {
+			expect(screen.getByText(technicalValue).closest("details")).not.toBeNull();
+		}
 		const approve = screen.getByRole("button", { name: "Approve release" });
 		expect(approve).toBeInstanceOf(HTMLButtonElement);
 		expect(approve.hasAttribute("disabled")).toBe(false);
 	});
 
-	it("renders the Access operator control surface", async () => {
+	it("manages approver passkeys without requiring an active release", async () => {
 		vi.stubGlobal(
 			"fetch",
 			vi.fn(async () =>
 				success({
+					items: [
+						{
+							id: "credential",
+							name: "Work laptop",
+							transports: ["internal"],
+							createdAt: 1_799_999_000_000,
+							lastUsedAt: null,
+							revokedAt: null,
+						},
+					],
+				}),
+			),
+		);
+		renderApp("/approver");
+
+		expect(await screen.findByRole("heading", { name: "Release approval passkeys" })).toBeTruthy();
+		expect(screen.getByText("Work laptop")).toBeTruthy();
+		expect(screen.getByRole("button", { name: "Add passkey" })).toBeTruthy();
+	});
+
+	it("renders the Access operator control surface", async () => {
+		vi.stubGlobal(
+			"fetch",
+			vi.fn(async (input: RequestInfo | URL) => {
+				const path = new URL(
+					input instanceof Request ? input.url : input.toString(),
+					location.origin,
+				).pathname;
+				if (path === "/admin/api/encryption/keys") {
+					return success({
+						configured: { activeVersion: 1, versions: [1] },
+						keys: [
+							{
+								version: 1,
+								status: "active",
+								activatedAt: 0,
+								retiredAt: null,
+								changedBy: "system:bootstrap",
+								updatedAt: 0,
+							},
+						],
+						verification: null,
+					});
+				}
+				return success({
 					state: {
 						mode: "active",
 						epoch: 1,
@@ -211,8 +506,8 @@ describe("release-service web surfaces", () => {
 						changedBy: "system:bootstrap",
 						changedAt: 0,
 					},
-				}),
-			),
+				});
+			}),
 		);
 		renderApp("/admin");
 
@@ -220,9 +515,23 @@ describe("release-service web surfaces", () => {
 		expect(screen.getByRole("button", { name: "Pause admission" })).toBeTruthy();
 		expect(screen.getByRole("heading", { name: "Operations directory" })).toBeTruthy();
 		expect(screen.getByRole("button", { name: "List publishers" })).toBeTruthy();
+		expect(screen.getByRole("heading", { name: "Service audit" })).toBeTruthy();
+		expect(screen.getByRole("button", { name: "Load audit" })).toBeTruthy();
 		expect(screen.getByRole("heading", { name: "Publisher archive" })).toBeTruthy();
 		expect(screen.getByRole("button", { name: "Start archive workflow" })).toBeTruthy();
+		expect(screen.getByRole("heading", { name: "Restore publisher shard" })).toBeTruthy();
+		expect(screen.getByRole("button", { name: "Prepare restore" })).toBeTruthy();
+		fireEvent.change(screen.getByLabelText("Page number"), { target: { value: "-1" } });
+		expect(
+			(screen.getByRole("button", { name: "Write archive page" }) as HTMLButtonElement).disabled,
+		).toBe(true);
+		fireEvent.change(screen.getByLabelText("Restore page"), { target: { value: "-1" } });
+		expect(
+			(screen.getByRole("button", { name: "Apply restore page" }) as HTMLButtonElement).disabled,
+		).toBe(true);
 		expect(screen.getByRole("heading", { name: "Encryption maintenance" })).toBeTruthy();
+		expect(screen.getByText("Configured active key: 1. Available versions: 1.")).toBeTruthy();
+		expect(screen.getByRole("button", { name: "Activate configured key" })).toBeTruthy();
 		expect(screen.getByRole("heading", { name: "Publisher lookup" })).toBeTruthy();
 	});
 
diff --git a/apps/release-service/src/ui/App.tsx b/apps/release-service/src/ui/App.tsx
index 474409455a..e3598982b7 100644
--- a/apps/release-service/src/ui/App.tsx
+++ b/apps/release-service/src/ui/App.tsx
@@ -7,10 +7,13 @@ export function App() {
 	const path = location.pathname;
 	const content = path.startsWith("/admin") ? (
 		<OperatorPage />
-	) : path.startsWith("/approvals/") ? (
+	) : path === "/approver" || path.startsWith("/approvals/") ? (
 		<ApproverPage />
 	) : (
-		<PublisherPage />
+		<div className="flex flex-col gap-6">
+			<PublisherPage />
+			<ApproverPage embedded />
+		</div>
 	);
 	return <Page>{content}</Page>;
 }
diff --git a/apps/release-service/src/ui/ApproverPage.tsx b/apps/release-service/src/ui/ApproverPage.tsx
index 179df7e0fb..627dae5ff3 100644
--- a/apps/release-service/src/ui/ApproverPage.tsx
+++ b/apps/release-service/src/ui/ApproverPage.tsx
@@ -25,14 +25,84 @@ function detail(value: string | null, fallback: string): string {
 	return value || fallback;
 }
 
-export function ApproverPage() {
+function workflowFile(repository: string | null, workflowRef: string | null): string | null {
+	if (!workflowRef) return null;
+	const repositoryPrefix = repository ? `${repository}/` : "";
+	const withoutRepository =
+		repositoryPrefix && workflowRef.startsWith(repositoryPrefix)
+			? workflowRef.slice(repositoryPrefix.length)
+			: workflowRef;
+	return withoutRepository.split("@", 1)[0] ?? withoutRepository;
+}
+
+function accessCapability(
+	t: ReturnType<typeof useT>,
+	category: string,
+	operation: string | null,
+): string {
+	if (category === "content" && operation === "read")
+		return t("approval.access.capability.contentRead", "read site content");
+	if (category === "content" && operation === "write")
+		return t("approval.access.capability.contentWrite", "change site content");
+	if (category === "email" && operation === "events")
+		return t("approval.access.capability.emailEvents", "respond to incoming email");
+	if (category === "email" && operation === "send")
+		return t("approval.access.capability.emailSend", "send email");
+	if (category === "email" && operation === "transport")
+		return t("approval.access.capability.emailTransport", "use email delivery");
+	if (category === "media" && operation === "read")
+		return t("approval.access.capability.mediaRead", "read media files");
+	if (category === "media" && operation === "write")
+		return t("approval.access.capability.mediaWrite", "change media files");
+	if (category === "network" && operation === "request")
+		return t("approval.access.capability.networkRequest", "connect to external websites");
+	if (category === "page" && operation === "fragments")
+		return t("approval.access.capability.pageFragments", "add content to admin pages");
+	if (category === "users" && operation === "read")
+		return t("approval.access.capability.usersRead", "read user accounts");
+	if (category === "content") return t("approval.access.category.content", "site content");
+	if (category === "email") return t("approval.access.category.email", "email");
+	if (category === "media") return t("approval.access.category.media", "media files");
+	if (category === "network") return t("approval.access.category.network", "external websites");
+	if (category === "page") return t("approval.access.category.page", "admin pages");
+	if (category === "users") return t("approval.access.category.users", "user accounts");
+	return t("approval.access.category.other", "plugin data");
+}
+
+function accessChangeLabel(
+	t: ReturnType<typeof useT>,
+	change: ApprovalResource["review"]["accessDiff"]["changes"][number],
+): string {
+	const capability = accessCapability(t, change.category, change.operation);
+	if (
+		change.kind === "category-added" ||
+		change.kind === "operation-added" ||
+		change.kind === "constraint-added"
+	) {
+		return t("approval.access.adds", "Adds permission to {capability}", { capability });
+	}
+	if (
+		change.kind === "category-removed" ||
+		change.kind === "operation-removed" ||
+		change.kind === "constraint-removed"
+	) {
+		return t("approval.access.removes", "Removes permission to {capability}", { capability });
+	}
+	return t("approval.access.changes", "Changes permission limits for {capability}", {
+		capability,
+	});
+}
+
+export function ApproverPage({ embedded = false }: { embedded?: boolean }) {
 	const t = useT();
+	const standalone = embedded || location.pathname === "/approver";
 	const intentId = location.pathname.startsWith("/approvals/")
 		? location.pathname.slice("/approvals/".length)
 		: "";
 	const publisherDid = new URLSearchParams(location.search).get("publisher") ?? "";
 	const [approval, setApproval] = useState<ApprovalResource | null>(null);
 	const [credentials, setCredentials] = useState<ApproverCredential[]>([]);
+	const [loaded, setLoaded] = useState(false);
 	const [loginRequired, setLoginRequired] = useState(false);
 	const [credentialName, setCredentialName] = useState("");
 	const [error, setError] = useState<unknown>(null);
@@ -41,8 +111,24 @@ export function ApproverPage() {
 
 	const refresh = useCallback(async () => {
 		setError(null);
+		if (standalone) {
+			try {
+				setCredentials(await listApproverCredentials());
+				setLoginRequired(false);
+			} catch (cause) {
+				if (cause instanceof UiApiError && cause.code === "APPROVER_SESSION_INVALID") {
+					setLoginRequired(true);
+					return;
+				}
+				setError(cause);
+			} finally {
+				setLoaded(true);
+			}
+			return;
+		}
 		if (!intentId || !publisherDid) {
 			setError(new UiApiError("INVALID_REQUEST", 400, "Approval link is incomplete"));
+			setLoaded(true);
 			return;
 		}
 		try {
@@ -59,8 +145,10 @@ export function ApproverPage() {
 				return;
 			}
 			setError(cause);
+		} finally {
+			setLoaded(true);
 		}
-	}, [intentId, publisherDid]);
+	}, [intentId, publisherDid, standalone]);
 
 	useEffect(() => {
 		void refresh();
@@ -110,8 +198,51 @@ export function ApproverPage() {
 		}
 	}
 
-	if (loginRequired) return <LoginPanel realm="approver" />;
-	if (!approval && !error) return <LoadingPanel />;
+	const credentialsPanel = (
+		<Surface className="rounded-xl border bg-kumo-base p-6">
+			<h2 className="text-xl font-semibold text-kumo-strong">
+				{t("approval.credentials.title", "Release approval passkeys")}
+			</h2>
+			<p className="mt-1 text-sm text-kumo-subtle">
+				{t(
+					"approval.credentials.description",
+					"A passkey confirms it is you when you approve or reject a plugin release.",
+				)}
+			</p>
+			<div className="mt-4 flex flex-wrap gap-2">
+				{credentials.map((credential) => (
+					<Badge key={credential.id} variant={credential.revokedAt ? "error" : "success"}>
+						{credential.name}
+					</Badge>
+				))}
+			</div>
+			<form className="mt-5 flex flex-col gap-4 sm:flex-row sm:items-end" onSubmit={enrol}>
+				<Input
+					className="flex-1"
+					label={t("approval.credentials.name", "Passkey name")}
+					placeholder={t("approval.credentials.placeholder", "Work laptop")}
+					required
+					value={credentialName}
+					onChange={(event) => setCredentialName(event.currentTarget.value)}
+				/>
+				<Button loading={busy} type="submit" variant="secondary">
+					{t("approval.credentials.enrol", "Add passkey")}
+				</Button>
+			</form>
+		</Surface>
+	);
+
+	if (loginRequired) return embedded ? null : <LoginPanel realm="approver" />;
+	if (!loaded && !error) return embedded ? null : <LoadingPanel />;
+	if (embedded && credentials.length === 0 && !error) return null;
+	if (standalone) {
+		return (
+			<div className="flex flex-col gap-6">
+				{error ? <ErrorBanner error={error} /> : null}
+				{credentialsPanel}
+			</div>
+		);
+	}
 	if (!approval) return <ErrorBanner error={error} />;
 	const review = approval.review;
 	const none = t("approval.none", "Not available");
@@ -136,7 +267,7 @@ export function ApproverPage() {
 				<div className="flex flex-wrap items-start justify-between gap-4">
 					<div>
 						<h2 className="text-xl font-semibold text-kumo-strong">
-							{t("approval.title", "Review delegated release")}
+							{t("approval.title", "Review plugin release")}
 						</h2>
 						<p className="mt-1 text-sm text-kumo-subtle">
 							{t("approval.package", "{packageSlug} version {version}", {
@@ -145,63 +276,74 @@ export function ApproverPage() {
 							})}
 						</p>
 					</div>
-					<Badge variant="warning">{t("approval.required", "Approval required")}</Badge>
+					<Badge variant="warning">{t("approval.required", "Approval needed")}</Badge>
 				</div>
 				<dl className="mt-6 grid gap-4 sm:grid-cols-2">
-					<ReviewItem label={t("approval.publisher", "Publisher")} value={publisherDid} />
 					<ReviewItem
 						label={t("approval.repository", "Repository")}
 						value={detail(review.source.repository, none)}
 					/>
 					<ReviewItem
-						label={t("approval.workflow", "Workflow")}
-						value={detail(review.source.workflowRef, none)}
+						label={t("approval.workflow", "Workflow file")}
+						value={detail(workflowFile(review.source.repository, review.source.workflowRef), none)}
 					/>
 					<ReviewItem
-						label={t("approval.commit", "Commit")}
-						value={detail(review.source.commitSha, none)}
-					/>
-					<ReviewItem
-						label={t("approval.run", "Run ID")}
-						value={detail(review.source.runId, none)}
-					/>
-					<ReviewItem
-						label={t("approval.actor", "GitHub actor")}
+						label={t("approval.actor", "GitHub account")}
 						value={detail(review.source.actor, none)}
 					/>
-					<ReviewItem
-						label={t("approval.artifact", "Artifact checksum")}
-						value={review.artifact.checksum}
-					/>
-					<ReviewItem
-						label={t("approval.provenance", "Provenance checksum")}
-						value={review.provenance?.checksum ?? none}
-					/>
-					<ReviewItem
-						label={t("approval.profileCid", "Profile CID")}
-						value={String(approval.evidence["profileCid"] ?? none)}
-					/>
-					<ReviewItem
-						label={t("approval.evidenceDigest", "Approval digest")}
-						value={approval.evidenceDigest}
-					/>
 				</dl>
+				<details className="mt-6 text-sm text-kumo-subtle">
+					<summary>{t("approval.technicalDetails", "Technical details")}</summary>
+					<dl className="mt-4 grid gap-4 sm:grid-cols-2">
+						<ReviewItem
+							label={t("approval.publisher", "Publishing account ID")}
+							value={publisherDid}
+						/>
+						<ReviewItem
+							label={t("approval.commit", "Git commit")}
+							value={detail(review.source.commitSha, none)}
+						/>
+						<ReviewItem
+							label={t("approval.run", "GitHub workflow run")}
+							value={detail(review.source.runId, none)}
+						/>
+						<ReviewItem
+							label={t("approval.artifact", "Plugin package checksum")}
+							value={review.artifact.checksum}
+						/>
+						<ReviewItem
+							label={t("approval.provenance", "Build record checksum")}
+							value={review.provenance?.checksum ?? none}
+						/>
+						<ReviewItem
+							label={t("approval.profileCid", "Plugin profile version")}
+							value={String(approval.evidence["profileCid"] ?? none)}
+						/>
+						<ReviewItem
+							label={t("approval.evidenceDigest", "Approval proof")}
+							value={approval.evidenceDigest}
+						/>
+					</dl>
+				</details>
 			</Surface>
 
 			<Surface className="rounded-xl border bg-kumo-base p-6">
 				<div className="flex flex-wrap items-center justify-between gap-3">
 					<h2 className="text-xl font-semibold text-kumo-strong">
-						{t("approval.access.title", "Declared access changes")}
+						{t("approval.access.title", "Plugin permissions")}
 					</h2>
 					<Badge variant={review.accessDiff.escalation ? "warning" : "neutral"}>
 						{review.accessDiff.escalation
-							? t("approval.access.escalation", "Escalation")
-							: t("approval.access.noEscalation", "No escalation")}
+							? t("approval.access.escalation", "Permissions increase")
+							: t("approval.access.noEscalation", "No permission increase")}
 					</Badge>
 				</div>
 				{review.accessDiff.changes.length === 0 ? (
 					<p className="mt-4 text-sm text-kumo-subtle">
-						{t("approval.access.empty", "This release does not change declared access.")}
+						{t(
+							"approval.access.empty",
+							"This release requests the same plugin permissions as the current release.",
+						)}
 					</p>
 				) : (
 					<ul className="mt-4 flex flex-col gap-3">
@@ -210,50 +352,20 @@ export function ApproverPage() {
 								className="rounded-lg bg-kumo-tint p-3 text-sm"
 								key={`${change.kind}:${change.path.join(".")}`}
 							>
-								<p className="font-medium text-kumo-strong">
-									{t("approval.access.change", "{kind}: {category}", {
-										kind: change.kind,
-										category: change.category,
-									})}
-								</p>
-								{change.operation ? (
-									<p className="mt-1 text-kumo-subtle">
-										{t("approval.access.operation", "Operation: {operation}", {
-											operation: change.operation,
-										})}
-									</p>
-								) : null}
+								<p className="font-medium text-kumo-strong">{accessChangeLabel(t, change)}</p>
+								<details className="mt-1 text-xs text-kumo-subtle">
+									<summary>{t("approval.technicalDetails", "Technical details")}</summary>
+									<code className="mt-1 block break-all">
+										{change.kind}: {change.path.join(".")}
+									</code>
+								</details>
 							</li>
 						))}
 					</ul>
 				)}
 			</Surface>
 
-			<Surface className="rounded-xl border bg-kumo-base p-6">
-				<h2 className="text-xl font-semibold text-kumo-strong">
-					{t("approval.credentials.title", "Approver passkeys")}
-				</h2>
-				<div className="mt-4 flex flex-wrap gap-2">
-					{credentials.map((credential) => (
-						<Badge key={credential.id} variant={credential.revokedAt ? "error" : "success"}>
-							{credential.name}
-						</Badge>
-					))}
-				</div>
-				<form className="mt-5 flex flex-col gap-4 sm:flex-row sm:items-end" onSubmit={enrol}>
-					<Input
-						className="flex-1"
-						label={t("approval.credentials.name", "Passkey name")}
-						placeholder={t("approval.credentials.placeholder", "Work laptop")}
-						required
-						value={credentialName}
-						onChange={(event) => setCredentialName(event.currentTarget.value)}
-					/>
-					<Button loading={busy} type="submit" variant="secondary">
-						{t("approval.credentials.enrol", "Enrol passkey")}
-					</Button>
-				</form>
-			</Surface>
+			{credentialsPanel}
 
 			<div className="flex flex-wrap justify-end gap-3">
 				<Button
diff --git a/apps/release-service/src/ui/OperatorPage.tsx b/apps/release-service/src/ui/OperatorPage.tsx
index 891c3d39ec..09079acb98 100644
--- a/apps/release-service/src/ui/OperatorPage.tsx
+++ b/apps/release-service/src/ui/OperatorPage.tsx
@@ -1,12 +1,15 @@
-import { Badge, Button, Input, Surface, Table } from "@cloudflare/kumo";
+import { Badge, Button, Dialog, Input, Surface, Table } from "@cloudflare/kumo";
 import {
 	ReleaseServiceOperatorClient,
 	createReleaseIdempotencyKey,
+	type ControlAuditEventResource,
 	type DirectoryIdentityKind,
 	type DirectoryIdentityResource,
+	type EncryptionKeyStatusResource,
 	type EncryptionRotationResult,
 	type OperatorPublisherResource,
 	type PublisherArchivePageResult,
+	type PublisherRestorePageResult,
 	type ServiceControlState,
 	type StartPublisherArchiveResult,
 } from "@emdash-cms/registry-client/release-service";
@@ -54,6 +57,10 @@ export function OperatorPage() {
 	const [publisherRotationCursor, setPublisherRotationCursor] = useState("");
 	const [approverRotationCursor, setApproverRotationCursor] = useState("");
 	const [rotation, setRotation] = useState<EncryptionRotationResult | null>(null);
+	const [encryptionKeys, setEncryptionKeys] = useState<EncryptionKeyStatusResource | null>(null);
+	const [retireKeyVersion, setRetireKeyVersion] = useState("");
+	const [retireKeyConfirmOpen, setRetireKeyConfirmOpen] = useState(false);
+	const [verificationWorkflowId, setVerificationWorkflowId] = useState<string | null>(null);
 	const [archiveId, setArchiveId] = useState(() => `archive-${crypto.randomUUID()}`);
 	const [archiveCursor, setArchiveCursor] = useState("");
 	const [archivePage, setArchivePage] = useState("0");
@@ -62,12 +69,22 @@ export function OperatorPage() {
 	const [directoryKind, setDirectoryKind] = useState<DirectoryIdentityKind>("publisher");
 	const [directoryCursor, setDirectoryCursor] = useState("");
 	const [directoryItems, setDirectoryItems] = useState<DirectoryIdentityResource[]>([]);
+	const [auditItems, setAuditItems] = useState<ControlAuditEventResource[]>([]);
+	const [auditCursor, setAuditCursor] = useState("");
+	const [restorePage, setRestorePage] = useState("0");
+	const [restoreResult, setRestoreResult] = useState<PublisherRestorePageResult | null>(null);
+	const [restoreConfirmOpen, setRestoreConfirmOpen] = useState(false);
 	const [error, setError] = useState<unknown>(null);
 	const [busy, setBusy] = useState(false);
 
 	const refreshStatus = useCallback(async () => {
 		try {
-			setState(await client.getStatus());
+			const [serviceState, keyStatus] = await Promise.all([
+				client.getStatus(),
+				client.getEncryptionKeyStatus(),
+			]);
+			setState(serviceState);
+			setEncryptionKeys(keyStatus);
 		} catch (cause) {
 			setError(cause);
 		}
@@ -164,6 +181,70 @@ export function OperatorPage() {
 		}
 	}
 
+	async function activateConfiguredEncryptionKey() {
+		if (!encryptionKeys) return;
+		setBusy(true);
+		setError(null);
+		try {
+			await client.activateEncryptionKey(encryptionKeys.configured.activeVersion, {
+				idempotencyKey: createReleaseIdempotencyKey("web-key-activate"),
+			});
+			setEncryptionKeys(await client.getEncryptionKeyStatus());
+		} catch (cause) {
+			setError(cause);
+		} finally {
+			setBusy(false);
+		}
+	}
+
+	async function retireEncryptionKey() {
+		const version = Number(retireKeyVersion);
+		if (!Number.isSafeInteger(version) || version < 1) return;
+		setBusy(true);
+		setError(null);
+		try {
+			await client.retireEncryptionKey(version, {
+				idempotencyKey: createReleaseIdempotencyKey("web-key-retire"),
+			});
+			setEncryptionKeys(await client.getEncryptionKeyStatus());
+			setRetireKeyVersion("");
+			setRetireKeyConfirmOpen(false);
+		} catch (cause) {
+			setError(cause);
+		} finally {
+			setBusy(false);
+		}
+	}
+
+	async function startEncryptionVerification() {
+		const version = Number(retireKeyVersion);
+		if (!Number.isSafeInteger(version) || version < 1) return;
+		setBusy(true);
+		setError(null);
+		try {
+			const result = await client.startEncryptionVerification(version, {
+				idempotencyKey: createReleaseIdempotencyKey("web-key-verify"),
+			});
+			setVerificationWorkflowId(result.workflowId);
+		} catch (cause) {
+			setError(cause);
+		} finally {
+			setBusy(false);
+		}
+	}
+
+	async function refreshEncryptionKeyStatus() {
+		setBusy(true);
+		setError(null);
+		try {
+			setEncryptionKeys(await client.getEncryptionKeyStatus());
+		} catch (cause) {
+			setError(cause);
+		} finally {
+			setBusy(false);
+		}
+	}
+
 	async function archivePublisher() {
 		setBusy(true);
 		setError(null);
@@ -222,6 +303,58 @@ export function OperatorPage() {
 		}
 	}
 
+	async function listAudit(reset: boolean) {
+		setBusy(true);
+		setError(null);
+		try {
+			const result = await client.listAudit({
+				...(reset || !auditCursor ? {} : { cursor: auditCursor }),
+				limit: 50,
+			});
+			setAuditItems(result.items);
+			setAuditCursor(result.nextCursor ?? "");
+		} catch (cause) {
+			setError(cause);
+		} finally {
+			setBusy(false);
+		}
+	}
+
+	async function preparePublisherRestore() {
+		setBusy(true);
+		setError(null);
+		try {
+			await client.preparePublisherRestore(publisherDid, archiveId, {
+				idempotencyKey: createReleaseIdempotencyKey("web-publisher-restore-prepare"),
+			});
+			setRestorePage("0");
+			setRestoreResult(null);
+			setRestoreConfirmOpen(false);
+		} catch (cause) {
+			setError(cause);
+		} finally {
+			setBusy(false);
+		}
+	}
+
+	async function restorePublisherPage() {
+		setBusy(true);
+		setError(null);
+		try {
+			const result = await client.restorePublisher(
+				publisherDid,
+				{ archiveId, page: Number(restorePage) },
+				{ idempotencyKey: createReleaseIdempotencyKey("web-publisher-restore") },
+			);
+			setRestoreResult(result);
+			setRestorePage(String(result.nextPage));
+		} catch (cause) {
+			setError(cause);
+		} finally {
+			setBusy(false);
+		}
+	}
+
 	async function operateIntent(action: "cancel" | "reconcile") {
 		setBusy(true);
 		setError(null);
@@ -277,6 +410,63 @@ export function OperatorPage() {
 				</div>
 			</Surface>
 
+			<Surface className="rounded-xl border bg-kumo-base p-6">
+				<div className="flex flex-wrap items-start justify-between gap-4">
+					<div>
+						<h2 className="text-xl font-semibold text-kumo-strong">
+							{t("operator.audit.title", "Service audit")}
+						</h2>
+						<p className="mt-1 text-sm text-kumo-subtle">
+							{t(
+								"operator.audit.description",
+								"Review sanitized Access and service-control events in sequence.",
+							)}
+						</p>
+					</div>
+					<Button loading={busy} onClick={() => listAudit(true)} variant="outline">
+						{t("operator.audit.load", "Load audit")}
+					</Button>
+				</div>
+				{auditItems.length > 0 ? (
+					<div className="mt-5 overflow-x-auto">
+						<Table>
+							<Table.Header>
+								<Table.Row>
+									<Table.Head>{t("operator.audit.sequence", "Sequence")}</Table.Head>
+									<Table.Head>{t("operator.audit.event", "Event")}</Table.Head>
+									<Table.Head>{t("operator.audit.actor", "Actor")}</Table.Head>
+									<Table.Head>{t("operator.audit.subject", "Subject")}</Table.Head>
+									<Table.Head>{t("operator.audit.time", "Time")}</Table.Head>
+								</Table.Row>
+							</Table.Header>
+							<Table.Body>
+								{auditItems.map((item) => (
+									<Table.Row key={item.sequence}>
+										<Table.Cell>{item.sequence}</Table.Cell>
+										<Table.Cell>{item.eventType}</Table.Cell>
+										<Table.Cell className="break-all">{item.actorIdentity}</Table.Cell>
+										<Table.Cell className="break-all">{item.subject}</Table.Cell>
+										<Table.Cell>
+											{new Intl.DateTimeFormat(document.documentElement.lang, {
+												dateStyle: "medium",
+												timeStyle: "short",
+											}).format(item.createdAt)}
+										</Table.Cell>
+									</Table.Row>
+								))}
+							</Table.Body>
+						</Table>
+						{auditCursor ? (
+							<div className="mt-4 flex justify-end">
+								<Button loading={busy} onClick={() => listAudit(false)} variant="outline">
+									{t("operator.audit.next", "Next audit page")}
+								</Button>
+							</div>
+						) : null}
+					</div>
+				) : null}
+			</Surface>
+
 			<Surface className="rounded-xl border bg-kumo-base p-6">
 				<div className="flex flex-wrap items-start justify-between gap-4">
 					<div>
@@ -387,7 +577,12 @@ export function OperatorPage() {
 						{t("operator.archive.start", "Start archive workflow")}
 					</Button>
 					<Button
-						disabled={!publisherDid || !archiveId || !Number.isSafeInteger(Number(archivePage))}
+						disabled={
+							!publisherDid ||
+							!archiveId ||
+							!Number.isSafeInteger(Number(archivePage)) ||
+							Number(archivePage) < 0
+						}
 						loading={busy}
 						onClick={archivePublisher}
 						variant="outline"
@@ -410,8 +605,85 @@ export function OperatorPage() {
 						</p>
 					) : null}
 				</div>
+				<div className="mt-6 border-t pt-5">
+					<h3 className="font-semibold text-kumo-strong">
+						{t("operator.restore.title", "Restore publisher shard")}
+					</h3>
+					<p className="mt-1 text-sm text-kumo-subtle">
+						{t(
+							"operator.restore.description",
+							"Preparation deletes the suspended publisher shard before encrypted pages are applied in order.",
+						)}
+					</p>
+					<div className="mt-4 flex flex-wrap items-end gap-3">
+						<Input
+							label={t("operator.restore.page", "Restore page")}
+							type="number"
+							value={restorePage}
+							onChange={(event) => setRestorePage(event.currentTarget.value)}
+						/>
+						<Button
+							disabled={!publisherDid || !archiveId}
+							loading={busy}
+							onClick={() => setRestoreConfirmOpen(true)}
+							variant="secondary-destructive"
+						>
+							{t("operator.restore.prepare", "Prepare restore")}
+						</Button>
+						<Button
+							disabled={
+								!publisherDid ||
+								!archiveId ||
+								!Number.isSafeInteger(Number(restorePage)) ||
+								Number(restorePage) < 0
+							}
+							loading={busy}
+							onClick={restorePublisherPage}
+							variant="outline"
+						>
+							{t("operator.restore.apply", "Apply restore page")}
+						</Button>
+					</div>
+					{restoreResult ? (
+						<p className="mt-4 text-sm text-kumo-subtle">
+							{restoreResult.complete
+								? t("operator.restore.complete", "Restore complete. Reauthorization is required.")
+								: t("operator.restore.next", "Restore page stored. Apply the next page.")}
+						</p>
+					) : null}
+				</div>
 			</Surface>
 
+			<Dialog.Root
+				disablePointerDismissal
+				onOpenChange={setRestoreConfirmOpen}
+				open={restoreConfirmOpen}
+			>
+				<Dialog className="p-6" size="sm">
+					<Dialog.Title className="text-lg font-semibold">
+						{t("operator.restore.confirmTitle", "Delete publisher state for restore?")}
+					</Dialog.Title>
+					<Dialog.Description className="mt-2 text-sm text-kumo-subtle">
+						{t(
+							"operator.restore.confirmDescription",
+							"The publisher must be suspended. This deletes current workload and intent state before archive pages can be restored.",
+						)}
+					</Dialog.Description>
+					<div className="mt-6 flex justify-end gap-3">
+						<Button onClick={() => setRestoreConfirmOpen(false)} variant="secondary">
+							{t("common.cancel", "Cancel")}
+						</Button>
+						<Button
+							loading={busy}
+							onClick={preparePublisherRestore}
+							variant="secondary-destructive"
+						>
+							{t("operator.restore.confirm", "Delete and prepare")}
+						</Button>
+					</div>
+				</Dialog>
+			</Dialog.Root>
+
 			<Surface className="rounded-xl border bg-kumo-base p-6">
 				<div className="flex flex-wrap items-start justify-between gap-4">
 					<div>
@@ -421,7 +693,7 @@ export function OperatorPage() {
 						<p className="mt-1 text-sm text-kumo-subtle">
 							{t(
 								"operator.encryption.description",
-								"Rotate one bounded shard page, then resume from the returned cursor until verification completes.",
+								"Keep publication paused while activating, rotating, verifying, or retiring encryption keys.",
 							)}
 						</p>
 					</div>
@@ -433,6 +705,137 @@ export function OperatorPage() {
 						</Badge>
 					) : null}
 				</div>
+				{encryptionKeys ? (
+					<div className="mt-5 flex flex-col gap-4">
+						<p className="text-sm text-kumo-subtle">
+							{t(
+								"operator.encryption.configured",
+								"Configured active key: {activeVersion}. Available versions: {versions}.",
+								{
+									activeVersion: encryptionKeys.configured.activeVersion,
+									versions: encryptionKeys.configured.versions.join(", "),
+								},
+							)}
+						</p>
+						<div className="overflow-x-auto">
+							<Table>
+								<Table.Header>
+									<Table.Row>
+										<Table.Head>{t("operator.encryption.version", "Version")}</Table.Head>
+										<Table.Head>{t("operator.encryption.status", "Status")}</Table.Head>
+										<Table.Head>{t("operator.encryption.updated", "Updated")}</Table.Head>
+									</Table.Row>
+								</Table.Header>
+								<Table.Body>
+									{encryptionKeys.keys.map((key) => (
+										<Table.Row key={key.version}>
+											<Table.Cell>{key.version}</Table.Cell>
+											<Table.Cell>
+												<Badge
+													variant={
+														key.status === "active"
+															? "success"
+															: key.status === "readable"
+																? "warning"
+																: "neutral"
+													}
+												>
+													{key.status === "active"
+														? t("operator.encryption.active", "Active")
+														: key.status === "readable"
+															? t("operator.encryption.readable", "Readable")
+															: t("operator.encryption.retired", "Retired")}
+												</Badge>
+											</Table.Cell>
+											<Table.Cell>
+												{key.updatedAt === 0
+													? t("operator.encryption.bootstrap", "Bootstrap")
+													: new Intl.DateTimeFormat(document.documentElement.lang, {
+															dateStyle: "medium",
+															timeStyle: "short",
+														}).format(key.updatedAt)}
+											</Table.Cell>
+										</Table.Row>
+									))}
+								</Table.Body>
+							</Table>
+						</div>
+						{encryptionKeys.verification ? (
+							<p className="text-sm text-kumo-subtle">
+								{t(
+									"operator.encryption.verification",
+									"Key {keyVersion} verified {publishers} publisher shards, {approvers} approver shards, and {records} retained records.",
+									{
+										keyVersion: encryptionKeys.verification.targetKeyVersion,
+										publishers: encryptionKeys.verification.publishers,
+										approvers: encryptionKeys.verification.approvers,
+										records: encryptionKeys.verification.records,
+									},
+								)}
+							</p>
+						) : null}
+						{verificationWorkflowId ? (
+							<p className="break-all text-sm text-kumo-subtle">
+								{t("operator.encryption.workflow", "Verification Workflow: {workflowId}", {
+									workflowId: verificationWorkflowId,
+								})}
+							</p>
+						) : null}
+						<div className="flex flex-wrap items-end gap-3">
+							<Button loading={busy} onClick={refreshEncryptionKeyStatus} variant="outline">
+								{t("operator.encryption.refresh", "Refresh key status")}
+							</Button>
+							<Button
+								disabled={
+									state?.mode !== "publication-paused" ||
+									encryptionKeys.keys.find((key) => key.status === "active")?.version ===
+										encryptionKeys.configured.activeVersion
+								}
+								loading={busy}
+								onClick={activateConfiguredEncryptionKey}
+								variant="outline"
+							>
+								{t("operator.encryption.activate", "Activate configured key")}
+							</Button>
+							<Input
+								label={t("operator.encryption.previousVersion", "Previous key version")}
+								type="number"
+								value={retireKeyVersion}
+								onChange={(event) => setRetireKeyVersion(event.currentTarget.value)}
+							/>
+							<Button
+								disabled={
+									state?.mode !== "publication-paused" ||
+									!Number.isSafeInteger(Number(retireKeyVersion)) ||
+									Number(retireKeyVersion) < 1 ||
+									!encryptionKeys.configured.versions.includes(Number(retireKeyVersion))
+								}
+								loading={busy}
+								onClick={startEncryptionVerification}
+								variant="outline"
+							>
+								{t("operator.encryption.verify", "Start fleet verification")}
+							</Button>
+							<Button
+								disabled={
+									state?.mode !== "publication-paused" ||
+									!Number.isSafeInteger(Number(retireKeyVersion)) ||
+									Number(retireKeyVersion) < 1 ||
+									encryptionKeys.configured.versions.includes(Number(retireKeyVersion)) ||
+									encryptionKeys.verification === null
+								}
+								loading={busy}
+								onClick={() => setRetireKeyConfirmOpen(true)}
+								variant="secondary-destructive"
+							>
+								{t("operator.encryption.retire", "Retire removed key")}
+							</Button>
+						</div>
+					</div>
+				) : null}
+				<h3 className="mt-6 font-semibold text-kumo-strong">
+					{t("operator.encryption.rotationTitle", "Shard rotation")}
+				</h3>
 				<div className="mt-5 grid gap-4 md:grid-cols-2">
 					<div className="flex flex-col gap-3">
 						<Input
@@ -491,6 +894,32 @@ export function OperatorPage() {
 				) : null}
 			</Surface>
 
+			<Dialog.Root
+				disablePointerDismissal
+				onOpenChange={setRetireKeyConfirmOpen}
+				open={retireKeyConfirmOpen}
+			>
+				<Dialog className="p-6" size="sm">
+					<Dialog.Title className="text-lg font-semibold">
+						{t("operator.encryption.retireConfirmTitle", "Retire encryption key?")}
+					</Dialog.Title>
+					<Dialog.Description className="mt-2 text-sm text-kumo-subtle">
+						{t(
+							"operator.encryption.retireConfirmDescription",
+							"Retire this version only after two zero-change verification scans and after removing it from the configured keyring. Remaining ciphertext for this version will become unreadable.",
+						)}
+					</Dialog.Description>
+					<div className="mt-6 flex justify-end gap-3">
+						<Button onClick={() => setRetireKeyConfirmOpen(false)} variant="secondary">
+							{t("common.cancel", "Cancel")}
+						</Button>
+						<Button loading={busy} onClick={retireEncryptionKey} variant="secondary-destructive">
+							{t("operator.encryption.retireConfirm", "Retire key")}
+						</Button>
+					</div>
+				</Dialog>
+			</Dialog.Root>
+
 			<Surface className="rounded-xl border bg-kumo-base p-6">
 				<h2 className="text-xl font-semibold text-kumo-strong">
 					{t("operator.publisher.title", "Publisher lookup")}
diff --git a/apps/release-service/src/ui/PublisherPage.tsx b/apps/release-service/src/ui/PublisherPage.tsx
index 2952f06ecb..c798ad805a 100644
--- a/apps/release-service/src/ui/PublisherPage.tsx
+++ b/apps/release-service/src/ui/PublisherPage.tsx
@@ -1,8 +1,11 @@
-import { Badge, Button, Input, Surface, Table } from "@cloudflare/kumo";
+import { Badge, Button, Input, Popover, Surface, Table } from "@cloudflare/kumo";
 import {
 	ReleaseServiceClient,
 	ReleaseServiceError,
 	createReleaseIdempotencyKey,
+	type CreateWorkflowPairingResult,
+	type PublisherApproverStatusResult,
+	type PublisherAuditEventResource,
 	type PublisherResource,
 	type ReleaseIntentResource,
 	type WorkloadPolicyResource,
@@ -13,10 +16,14 @@ import { beginPublisherDelegation, publisherCsrfToken } from "./api.js";
 import { ErrorBanner, LoadingPanel, LoginPanel } from "./components.js";
 import { useT } from "./i18n.js";
 
+const GIT_REF_PREFIX_PATTERN = /^refs\/(?:heads|tags)\//;
+
 interface PublisherData {
 	publisher: PublisherResource;
 	workloads: WorkloadPolicyResource[];
 	intents: ReleaseIntentResource[];
+	audit: PublisherAuditEventResource[];
+	auditCursor?: string;
 }
 
 function stateVariant(state: string): "error" | "neutral" | "success" | "warning" {
@@ -69,6 +76,195 @@ function stateLabel(t: ReturnType<typeof useT>, state: string): string {
 	}
 }
 
+function activityEventLabel(t: ReturnType<typeof useT>, eventType: string): string {
+	if (eventType === "publisher-session-created") return t("activity.signedIn", "Signed in");
+	if (eventType === "publisher-session-revoked") return t("activity.signedOut", "Signed out");
+	if (eventType === "publisher-sessions-revoked")
+		return t("activity.sessionsEnded", "Account sessions ended");
+	if (eventType === "oauth-state-created")
+		return t("activity.signInStarted", "Account connection started");
+	if (eventType === "oauth-state-consumed")
+		return t("activity.signInCompleted", "Account connection completed");
+	if (eventType === "oauth-state-expired")
+		return t("activity.signInExpired", "Account connection expired");
+	if (eventType === "workload-policy-stored")
+		return t("activity.workflowConnected", "GitHub workflow connected");
+	if (eventType === "delegation-stored")
+		return t("activity.publishingEnabled", "Automated publishing enabled");
+	if (eventType === "delegation-revoked")
+		return t("activity.publishingDisabled", "Automated publishing turned off");
+	if (eventType === "publisher-suspension-changed")
+		return t("activity.accountAccessChanged", "Account access changed");
+	if (eventType === "delegation-reauthorization-required")
+		return t("activity.publishingReconnectNeeded", "Publishing account needs reconnecting");
+	if (eventType === "delegation-refresh-started")
+		return t("activity.publishingRefreshStarted", "Publishing account refresh started");
+	if (eventType === "delegation-refresh-completed")
+		return t("activity.publishingRefreshCompleted", "Publishing account refreshed");
+	if (eventType === "delegation-refresh-released")
+		return t("activity.publishingRefreshReleased", "Publishing account refresh released");
+	if (eventType === "intent-received") return t("activity.releaseSubmitted", "Release submitted");
+	if (eventType === "intent-transitioned")
+		return t("activity.releaseStatusChanged", "Release status changed");
+	if (eventType === "intent-restored") return t("activity.releaseRestored", "Release restored");
+	if (eventType === "verification-step-recorded")
+		return t("activity.releaseChecksUpdated", "Release checks updated");
+	if (eventType === "publication-operation-started")
+		return t("activity.releasePublishingStarted", "Release publishing started");
+	if (eventType === "publication-operation-completed")
+		return t("activity.releasePublished", "Release published");
+	if (
+		eventType === "publication-operation-recovery-required" ||
+		eventType === "publication-operation-retry-required"
+	) {
+		return t("activity.releaseRecoveryNeeded", "Release publishing needs attention");
+	}
+	if (eventType === "publisher-restore-prepared")
+		return t("activity.restorePrepared", "Account recovery prepared");
+	if (eventType === "publisher-restore-started")
+		return t("activity.restoreStarted", "Account recovery started");
+	if (eventType === "publisher-restore-completed")
+		return t("activity.restoreCompleted", "Account recovery completed");
+	if (eventType === "publisher-restore-aborted")
+		return t("activity.restoreCancelled", "Account recovery cancelled");
+	if (eventType === "encryption-rotated")
+		return t("activity.securityUpdated", "Account security updated");
+	return t("activity.recorded", "Account activity recorded");
+}
+
+function workflowPairingStep(
+	pairing: CreateWorkflowPairingResult,
+	publisherDid: string,
+	stepName: string,
+): string {
+	return [
+		`- name: ${stepName}`,
+		"  run: |",
+		"    npx @emdash-cms/plugin-cli release connect \\",
+		`      --service-url ${location.origin} \\`,
+		`      --publisher-did ${publisherDid} \\`,
+		`      --pairing-id ${pairing.pairing.id} \\`,
+		`      --pairing-token ${pairing.pairingToken}`,
+	].join("\n");
+}
+
+function activityActorLabel(t: ReturnType<typeof useT>, item: PublisherAuditEventResource): string {
+	if (item.actorHandle) return formatHandle(item.actorHandle);
+	if (item.actorRealm === "system") return t("activity.actor.service", "EmDash release service");
+	if (item.actorIdentity.startsWith("did:"))
+		return t("activity.actor.atmosphere", "Atmosphere account");
+	return item.actorIdentity;
+}
+
+function formatHandle(handle: string): string {
+	return handle.startsWith("@") ? handle : `@${handle}`;
+}
+
+function ActivityDetails({
+	action,
+	item,
+	t,
+}: {
+	action: string;
+	item: PublisherAuditEventResource;
+	t: ReturnType<typeof useT>;
+}) {
+	return (
+		<Popover>
+			<Popover.Trigger
+				render={
+					<Button
+						aria-label={t("publisher.audit.viewDetails", "View details for {action}", {
+							action,
+						})}
+						icon={
+							<span aria-hidden="true" className="text-base leading-none">
+								•••
+							</span>
+						}
+						shape="square"
+						size="sm"
+						variant="ghost"
+					/>
+				}
+			/>
+			<Popover.Content align="end" className="w-80 max-w-[calc(100vw-2rem)] p-4">
+				<Popover.Title>{t("publisher.audit.detailsTitle", "Activity details")}</Popover.Title>
+				<dl className="mt-3 grid gap-3 text-sm">
+					<div>
+						<dt className="text-kumo-subtle">{t("publisher.audit.eventType", "Event type")}</dt>
+						<dd>
+							<code className="break-all">{item.eventType}</code>
+						</dd>
+					</div>
+					<div>
+						<dt className="text-kumo-subtle">{t("publisher.audit.actorId", "Actor ID")}</dt>
+						<dd>
+							<code className="break-all">{item.actorIdentity}</code>
+						</dd>
+					</div>
+					<div>
+						<dt className="text-kumo-subtle">{t("publisher.audit.subject", "Subject")}</dt>
+						<dd>
+							<code className="break-all">{item.subject}</code>
+						</dd>
+					</div>
+					{item.reasonCode ? (
+						<div>
+							<dt className="text-kumo-subtle">{t("publisher.audit.reason", "Reason")}</dt>
+							<dd>
+								<code className="break-all">{item.reasonCode}</code>
+							</dd>
+						</div>
+					) : null}
+				</dl>
+			</Popover.Content>
+		</Popover>
+	);
+}
+
+function AccountIdentifier({
+	did,
+	handle,
+	t,
+}: {
+	did: string;
+	handle: string | null;
+	t: ReturnType<typeof useT>;
+}) {
+	if (handle) return formatHandle(handle);
+	return (
+		<span className="flex items-center gap-1">
+			{t("publisher.approvers.account", "Atmosphere account")}
+			<Popover>
+				<Popover.Trigger
+					render={
+						<Button
+							aria-label={t("publisher.approvers.viewAccountId", "View account ID")}
+							icon={<span aria-hidden="true">•••</span>}
+							shape="square"
+							size="xs"
+							variant="ghost"
+						/>
+					}
+				/>
+				<Popover.Content align="start" className="w-72 max-w-[calc(100vw-2rem)] p-4">
+					<Popover.Title>{t("publisher.approvers.accountId", "Account ID")}</Popover.Title>
+					<code className="mt-2 block break-all text-sm">{did}</code>
+				</Popover.Content>
+			</Popover>
+		</span>
+	);
+}
+
+function workflowFile(repository: string, workflowRef: string): string {
+	return workflowRef.slice(`${repository}/`.length).split("@", 1)[0] ?? workflowRef;
+}
+
+function friendlyRef(ref: string): string {
+	return ref.replace(GIT_REF_PREFIX_PATTERN, "");
+}
+
 export function PublisherPage() {
 	const t = useT();
 	const client = useMemo(
@@ -80,25 +276,30 @@ export function PublisherPage() {
 		[],
 	);
 	const [data, setData] = useState<PublisherData | null>(null);
+	const [approverStatus, setApproverStatus] = useState<PublisherApproverStatusResult | null>(null);
 	const [loginRequired, setLoginRequired] = useState(false);
 	const [error, setError] = useState<unknown>(null);
 	const [busy, setBusy] = useState(false);
 	const [packageSlug, setPackageSlug] = useState("");
-	const [repository, setRepository] = useState("");
-	const [repositoryId, setRepositoryId] = useState("");
-	const [repositoryOwnerId, setRepositoryOwnerId] = useState("");
-	const [workflowRef, setWorkflowRef] = useState("");
-	const [allowedRef, setAllowedRef] = useState("refs/heads/main");
+	const [workflowPairing, setWorkflowPairing] = useState<CreateWorkflowPairingResult | null>(null);
 
 	const refresh = useCallback(async () => {
 		setError(null);
 		try {
-			const [publisher, workloads, intents] = await Promise.all([
+			const [publisher, workloads, intents, audit] = await Promise.all([
 				client.getPublisher(),
 				client.listWorkloads({ limit: 100 }),
 				client.listPublisherIntents({ limit: 100 }),
+				client.listPublisherAudit({ limit: 50 }),
 			]);
-			setData({ publisher, workloads: workloads.items, intents: intents.items });
+			setData({
+				publisher,
+				workloads: workloads.items,
+				intents: intents.items,
+				audit: audit.items,
+				...(audit.nextCursor ? { auditCursor: audit.nextCursor } : {}),
+			});
+			setApproverStatus(null);
 			setLoginRequired(false);
 		} catch (cause) {
 			if (
@@ -140,29 +341,50 @@ export function PublisherPage() {
 		}
 	}
 
-	async function saveWorkload(event: FormEvent) {
+	async function startWorkflowPairing(event: FormEvent) {
 		event.preventDefault();
+		if (data?.publisher.delegation?.status !== "active") return;
 		setBusy(true);
 		setError(null);
 		try {
-			await client.putWorkload(
-				{
-					packageSlug,
-					repository,
-					repositoryId,
-					repositoryOwnerId,
-					workflowRef,
-					allowedRefs: [allowedRef],
-					allowedEnvironments: [],
-					expectedVersion: null,
-				},
-				{ idempotencyKey: createReleaseIdempotencyKey("web-workload") },
+			setWorkflowPairing(
+				await client.createWorkflowPairing(packageSlug, {
+					idempotencyKey: createReleaseIdempotencyKey("web-workflow-pairing"),
+				}),
 			);
+		} catch (cause) {
+			setError(cause);
+		} finally {
+			setBusy(false);
+		}
+	}
+
+	async function checkWorkflowPairing() {
+		if (!workflowPairing) return;
+		setBusy(true);
+		setError(null);
+		try {
+			setWorkflowPairing({
+				...workflowPairing,
+				pairing: await client.getWorkflowPairing(workflowPairing.pairing.id),
+			});
+		} catch (cause) {
+			setError(cause);
+		} finally {
+			setBusy(false);
+		}
+	}
+
+	async function confirmWorkflowPairing() {
+		if (!workflowPairing) return;
+		setBusy(true);
+		setError(null);
+		try {
+			await client.confirmWorkflowPairing(workflowPairing.pairing.id, {
+				idempotencyKey: createReleaseIdempotencyKey("web-workflow-confirm"),
+			});
+			setWorkflowPairing(null);
 			setPackageSlug("");
-			setRepository("");
-			setRepositoryId("");
-			setRepositoryOwnerId("");
-			setWorkflowRef("");
 			await refresh();
 		} catch (cause) {
 			setError(cause);
@@ -171,10 +393,48 @@ export function PublisherPage() {
 		}
 	}
 
+	async function loadNextAuditPage() {
+		if (!data?.auditCursor) return;
+		setBusy(true);
+		setError(null);
+		try {
+			const audit = await client.listPublisherAudit({ cursor: data.auditCursor, limit: 50 });
+			setData((current) =>
+				current
+					? {
+							...current,
+							audit: [...current.audit, ...audit.items],
+							...(audit.nextCursor
+								? { auditCursor: audit.nextCursor }
+								: { auditCursor: undefined }),
+						}
+					: current,
+			);
+		} catch (cause) {
+			setError(cause);
+		} finally {
+			setBusy(false);
+		}
+	}
+
+	async function loadApproverStatus(workloadPackageSlug: string) {
+		setBusy(true);
+		setError(null);
+		try {
+			setApproverStatus(await client.getPublisherApproverStatus(workloadPackageSlug));
+		} catch (cause) {
+			setError(cause);
+		} finally {
+			setBusy(false);
+		}
+	}
+
 	if (loginRequired) return <LoginPanel realm="publisher" />;
 	if (!data && !error) return <LoadingPanel />;
 	if (!data) return <ErrorBanner error={error} />;
 	const delegation = data.publisher.delegation;
+	const publishingEnabled = delegation?.status === "active";
+	const publisherHandle = data.publisher.handle ? formatHandle(data.publisher.handle) : null;
 
 	return (
 		<div className="flex flex-col gap-6">
@@ -183,31 +443,39 @@ export function PublisherPage() {
 				<div className="flex flex-wrap items-start justify-between gap-4">
 					<div>
 						<h2 className="text-xl font-semibold text-kumo-strong">
-							{t("publisher.authority.title", "Publishing authority")}
+							{publishingEnabled
+								? t("publisher.authority.title", "Automated publishing")
+								: t("publisher.authority.setupTitle", "1. Allow EmDash to publish releases")}
 						</h2>
-						<p className="mt-1 break-all text-sm text-kumo-subtle">{data.publisher.did}</p>
+						<p className="mt-1 text-sm text-kumo-subtle">
+							{publisherHandle
+								? t("publisher.signedInAs", "Signed in as {handle}", {
+										handle: publisherHandle,
+									})
+								: t("publisher.signedIn", "Signed in with Atmosphere")}
+						</p>
 					</div>
-					<Badge variant={stateVariant(delegation?.status ?? "revoked")}>
-						{delegation
-							? stateLabel(t, delegation.status)
-							: t("publisher.delegation.missing", "Not delegated")}
+					<Badge variant={publishingEnabled ? "success" : "warning"}>
+						{publishingEnabled
+							? t("status.active", "Active")
+							: t("publisher.delegation.missing", "Setup needed")}
 					</Badge>
 				</div>
 				<p className="mt-4 text-sm text-kumo-subtle">
 					{t(
 						"publisher.authority.description",
-						"The service can only create package release records. It cannot update or delete records.",
+						"EmDash may create new plugin release records and upload their files. It cannot change or delete existing records.",
 					)}
 				</p>
 				<div className="mt-5 flex flex-wrap gap-2">
-					<Button loading={busy} onClick={authorizeDelegation} variant="primary">
-						{delegation?.status === "active"
-							? t("publisher.delegation.replace", "Reauthorize delegation")
-							: t("publisher.delegation.authorize", "Authorize delegation")}
+					<Button disabled={busy} onClick={authorizeDelegation} variant="primary">
+						{publishingEnabled
+							? t("publisher.delegation.replace", "Reconnect publishing")
+							: t("publisher.delegation.authorize", "Authorize publishing")}
 					</Button>
 					{delegation && delegation.status !== "revoked" ? (
-						<Button loading={busy} onClick={revokeDelegation} variant="secondary-destructive">
-							{t("publisher.delegation.revoke", "Revoke delegation")}
+						<Button disabled={busy} onClick={revokeDelegation} variant="secondary-destructive">
+							{t("publisher.delegation.revoke", "Turn off automated publishing")}
 						</Button>
 					) : null}
 				</div>
@@ -215,112 +483,359 @@ export function PublisherPage() {
 
 			<Surface className="rounded-xl border bg-kumo-base p-6">
 				<h2 className="text-xl font-semibold text-kumo-strong">
-					{t("publisher.workload.addTitle", "Add GitHub workload")}
+					{data.workloads.length === 0
+						? t("publisher.workload.setupTitle", "2. Connect a GitHub Actions workflow")
+						: t("publisher.workload.addTitle", "Connect another GitHub Actions workflow")}
 				</h2>
-				<form className="mt-5 grid gap-4 md:grid-cols-2" onSubmit={saveWorkload}>
-					<Input
-						label={t("publisher.workload.package", "Package slug")}
-						required
-						value={packageSlug}
-						onChange={(event) => setPackageSlug(event.currentTarget.value)}
-					/>
-					<Input
-						label={t("publisher.workload.repository", "Repository")}
-						placeholder={t("publisher.workload.repositoryPlaceholder", "owner/repository")}
-						required
-						value={repository}
-						onChange={(event) => setRepository(event.currentTarget.value)}
-					/>
-					<Input
-						label={t("publisher.workload.repositoryId", "Repository ID")}
-						required
-						value={repositoryId}
-						onChange={(event) => setRepositoryId(event.currentTarget.value)}
-					/>
-					<Input
-						label={t("publisher.workload.ownerId", "Repository owner ID")}
-						required
-						value={repositoryOwnerId}
-						onChange={(event) => setRepositoryOwnerId(event.currentTarget.value)}
-					/>
-					<Input
-						className="md:col-span-2"
-						label={t("publisher.workload.workflow", "Workflow reference")}
-						required
-						value={workflowRef}
-						onChange={(event) => setWorkflowRef(event.currentTarget.value)}
-					/>
-					<Input
-						label={t("publisher.workload.ref", "Allowed Git ref")}
-						required
-						value={allowedRef}
-						onChange={(event) => setAllowedRef(event.currentTarget.value)}
-					/>
-					<div className="flex items-end">
-						<Button loading={busy} type="submit" variant="primary">
-							{t("publisher.workload.save", "Save workload")}
+				{publishingEnabled ? (
+					<p className="mt-1 text-sm text-kumo-subtle">
+						{t(
+							"publisher.workload.description",
+							"Choose which workflow may publish releases for one of your plugin packages. GitHub proves the repository, workflow file, and branch when you run it.",
+						)}
+					</p>
+				) : (
+					<p className="mt-1 text-sm text-kumo-subtle">
+						{t(
+							"publisher.workload.authorizationRequired",
+							"Authorize publishing before connecting a GitHub workflow.",
+						)}
+					</p>
+				)}
+				{!workflowPairing ? (
+					<form className="mt-5 max-w-2xl" onSubmit={startWorkflowPairing}>
+						<div className="grid gap-3 sm:grid-cols-[minmax(0,1fr)_auto] sm:items-end">
+							<Input
+								aria-describedby="workflow-plugin-id-description"
+								disabled={!publishingEnabled || busy}
+								label={t("publisher.workload.package", "Plugin ID")}
+								placeholder={t("publisher.workload.packagePlaceholder", "gallery")}
+								required
+								value={packageSlug}
+								onChange={(event) => setPackageSlug(event.currentTarget.value)}
+							/>
+							<Button disabled={!publishingEnabled || busy} type="submit" variant="primary">
+								{t("publisher.workload.start", "Start connection")}
+							</Button>
+						</div>
+						<p id="workflow-plugin-id-description" className="mt-2 text-sm text-kumo-subtle">
+							{t(
+								"publisher.workload.packageDescription",
+								"Use the plugin ID from emdash-plugin.jsonc for the plugin this workflow will publish.",
+							)}
+						</p>
+					</form>
+				) : workflowPairing.pairing.state === "pending" ? (
+					<div className="mt-5">
+						<h3 className="font-semibold text-kumo-strong">
+							{t("publisher.pairing.runTitle", "Run the workflow once to identify it")}
+						</h3>
+						<p className="mt-1 text-sm text-kumo-subtle">
+							{t(
+								"publisher.pairing.runDescription",
+								"Add a temporary connection step to the GitHub Actions job that should publish this plugin. EmDash will show you what GitHub identifies before you approve anything.",
+							)}
+						</p>
+						<p className="mt-4 text-sm font-medium text-kumo-strong">
+							{t(
+								"publisher.pairing.permissionTitle",
+								"Grant the job permission to identify itself",
+							)}
+						</p>
+						<pre className="mt-4 overflow-x-auto rounded-lg bg-kumo-tint p-4 text-sm text-kumo-default">
+							<code>{"permissions:\n  id-token: write"}</code>
+						</pre>
+						<p className="mt-4 text-sm font-medium text-kumo-strong">
+							{t("publisher.pairing.stepTitle", "Add this temporary step and run the workflow")}
+						</p>
+						<pre className="mt-4 overflow-x-auto rounded-lg bg-kumo-tint p-4 text-sm text-kumo-default">
+							<code>
+								{workflowPairingStep(
+									workflowPairing,
+									data.publisher.did,
+									t("publisher.pairing.stepName", "Connect EmDash publishing"),
+								)}
+							</code>
+						</pre>
+						<p className="mt-3 text-sm text-kumo-subtle">
+							{t(
+								"publisher.pairing.removeStep",
+								"You can remove the temporary step after you confirm the connection.",
+							)}
+						</p>
+						<div className="mt-4 flex flex-wrap gap-2">
+							<Button disabled={busy} onClick={checkWorkflowPairing} variant="primary">
+								{t("publisher.pairing.check", "I've run the workflow")}
+							</Button>
+							<Button onClick={() => setWorkflowPairing(null)} variant="outline">
+								{t("publisher.pairing.cancel", "Cancel")}
+							</Button>
+						</div>
+					</div>
+				) : workflowPairing.pairing.state === "claimed" && workflowPairing.pairing.claim ? (
+					<div className="mt-5">
+						<h3 className="font-semibold text-kumo-strong">
+							{t("publisher.pairing.confirmTitle", "Confirm this GitHub workflow")}
+						</h3>
+						<dl className="mt-4 grid gap-3 text-sm sm:grid-cols-2">
+							<div>
+								<dt className="text-kumo-subtle">
+									{t("publisher.pairing.repository", "Repository")}
+								</dt>
+								<dd className="font-medium text-kumo-strong">
+									{workflowPairing.pairing.claim.repository}
+								</dd>
+							</div>
+							<div>
+								<dt className="text-kumo-subtle">
+									{t("publisher.pairing.workflow", "Workflow file")}
+								</dt>
+								<dd className="font-medium text-kumo-strong">
+									{workflowFile(
+										workflowPairing.pairing.claim.repository,
+										workflowPairing.pairing.claim.workflowRef,
+									)}
+								</dd>
+							</div>
+							<div>
+								<dt className="text-kumo-subtle">
+									{t("publisher.pairing.branch", "Branch or tag")}
+								</dt>
+								<dd className="font-medium text-kumo-strong">
+									{friendlyRef(workflowPairing.pairing.claim.ref)}
+								</dd>
+							</div>
+							{workflowPairing.pairing.claim.environment ? (
+								<div>
+									<dt className="text-kumo-subtle">
+										{t("publisher.pairing.environment", "Environment")}
+									</dt>
+									<dd className="font-medium text-kumo-strong">
+										{workflowPairing.pairing.claim.environment}
+									</dd>
+								</div>
+							) : null}
+						</dl>
+						<div className="mt-5 flex flex-wrap gap-2">
+							<Button disabled={busy} onClick={confirmWorkflowPairing} variant="primary">
+								{t("publisher.pairing.confirm", "Allow this workflow")}
+							</Button>
+							<Button onClick={() => setWorkflowPairing(null)} variant="outline">
+								{t("publisher.pairing.cancel", "Cancel")}
+							</Button>
+						</div>
+					</div>
+				) : (
+					<div className="mt-5">
+						<p className="text-sm text-kumo-subtle">
+							{t(
+								"publisher.pairing.expired",
+								"This connection has expired. Start again to create a new one.",
+							)}
+						</p>
+						<Button className="mt-4" onClick={() => setWorkflowPairing(null)} variant="primary">
+							{t("publisher.pairing.restart", "Start again")}
 						</Button>
 					</div>
-				</form>
+				)}
 			</Surface>
 
-			<Surface className="overflow-x-auto rounded-xl border bg-kumo-base p-0">
-				<Table>
-					<Table.Header>
-						<Table.Row>
-							<Table.Head>{t("publisher.workloads.package", "Package")}</Table.Head>
-							<Table.Head>{t("publisher.workloads.repository", "Repository")}</Table.Head>
-							<Table.Head>{t("publisher.workloads.workflow", "Workflow")}</Table.Head>
-							<Table.Head>{t("publisher.workloads.status", "Status")}</Table.Head>
-						</Table.Row>
-					</Table.Header>
-					<Table.Body>
-						{data.workloads.map((workload) => (
-							<Table.Row key={workload.packageSlug}>
-								<Table.Cell>{workload.packageSlug}</Table.Cell>
-								<Table.Cell>{workload.repository}</Table.Cell>
-								<Table.Cell className="break-all">{workload.workflowRef}</Table.Cell>
-								<Table.Cell>
-									<Badge variant={workload.active ? "success" : "neutral"}>
-										{workload.active
-											? t("status.active", "Active")
-											: t("status.disabled", "Disabled")}
-									</Badge>
-								</Table.Cell>
+			{data.workloads.length > 0 ? (
+				<Surface className="overflow-x-auto rounded-xl border bg-kumo-base p-0">
+					<div className="p-6 pb-0">
+						<h2 className="text-xl font-semibold text-kumo-strong">
+							{t("publisher.workloads.title", "Connected GitHub workflows")}
+						</h2>
+					</div>
+					<Table>
+						<Table.Header>
+							<Table.Row>
+								<Table.Head>{t("publisher.workloads.package", "Package")}</Table.Head>
+								<Table.Head>{t("publisher.workloads.repository", "Repository")}</Table.Head>
+								<Table.Head>{t("publisher.workloads.workflow", "Workflow")}</Table.Head>
+								<Table.Head>{t("publisher.workloads.status", "Status")}</Table.Head>
+								<Table.Head>{t("publisher.workloads.approvers", "Approval setup")}</Table.Head>
 							</Table.Row>
-						))}
-					</Table.Body>
-				</Table>
-			</Surface>
+						</Table.Header>
+						<Table.Body>
+							{data.workloads.map((workload) => (
+								<Table.Row key={workload.packageSlug}>
+									<Table.Cell>{workload.packageSlug}</Table.Cell>
+									<Table.Cell>{workload.repository}</Table.Cell>
+									<Table.Cell>{workflowFile(workload.repository, workload.workflowRef)}</Table.Cell>
+									<Table.Cell>
+										<Badge variant={workload.active ? "success" : "neutral"}>
+											{workload.active
+												? t("status.active", "Active")
+												: t("status.disabled", "Disabled")}
+										</Badge>
+									</Table.Cell>
+									<Table.Cell>
+										<Button
+											disabled={busy}
+											onClick={() => loadApproverStatus(workload.packageSlug)}
+											variant="outline"
+										>
+											{t("publisher.workloads.checkApprovers", "Check approval readiness")}
+										</Button>
+									</Table.Cell>
+								</Table.Row>
+							))}
+						</Table.Body>
+					</Table>
+				</Surface>
+			) : null}
 
-			<Surface className="overflow-x-auto rounded-xl border bg-kumo-base p-0">
-				<Table>
-					<Table.Header>
-						<Table.Row>
-							<Table.Head>{t("publisher.intents.package", "Package")}</Table.Head>
-							<Table.Head>{t("publisher.intents.version", "Version")}</Table.Head>
-							<Table.Head>{t("publisher.intents.state", "State")}</Table.Head>
-							<Table.Head>{t("publisher.intents.updated", "Updated")}</Table.Head>
-						</Table.Row>
-					</Table.Header>
-					<Table.Body>
-						{data.intents.map((intent) => (
-							<Table.Row key={intent.id}>
-								<Table.Cell>{intent.packageSlug}</Table.Cell>
-								<Table.Cell>{intent.version}</Table.Cell>
-								<Table.Cell>
-									<Badge variant={stateVariant(intent.state)}>{stateLabel(t, intent.state)}</Badge>
-								</Table.Cell>
-								<Table.Cell>
-									{new Intl.DateTimeFormat(document.documentElement.lang, {
-										dateStyle: "medium",
-										timeStyle: "short",
-									}).format(intent.updatedAt)}
-								</Table.Cell>
+			{approverStatus ? (
+				<Surface className="rounded-xl border bg-kumo-base p-6">
+					<div>
+						<h2 className="text-xl font-semibold text-kumo-strong">
+							{t("publisher.approvers.title", "Approval readiness")}
+						</h2>
+						<p className="mt-1 text-sm text-kumo-subtle">
+							{t(
+								"publisher.approvers.description",
+								"Security-key setup for the accounts allowed to approve {packageSlug} releases.",
+								{ packageSlug: approverStatus.packageSlug },
+							)}
+						</p>
+						<details className="mt-3 text-sm text-kumo-subtle">
+							<summary>{t("publisher.profileReference", "Show profile reference")}</summary>
+							<code className="mt-2 block break-all">{approverStatus.profileCid}</code>
+						</details>
+					</div>
+					{approverStatus.items.length > 0 ? (
+						<div className="mt-5 overflow-x-auto">
+							<Table>
+								<Table.Header>
+									<Table.Row>
+										<Table.Head>{t("publisher.approvers.did", "Account")}</Table.Head>
+										<Table.Head>{t("publisher.approvers.status", "Status")}</Table.Head>
+									</Table.Row>
+								</Table.Header>
+								<Table.Body>
+									{approverStatus.items.map((item) => (
+										<Table.Row key={item.did}>
+											<Table.Cell>
+												<AccountIdentifier did={item.did} handle={item.handle} t={t} />
+											</Table.Cell>
+											<Table.Cell>
+												<Badge variant={item.status === "enrolled" ? "success" : "warning"}>
+													{item.status === "enrolled"
+														? t("publisher.approvers.enrolled", "Enrolled")
+														: item.status === "revoked"
+															? t("publisher.approvers.revoked", "Credentials revoked")
+															: t("publisher.approvers.notEnrolled", "Not enrolled")}
+												</Badge>
+											</Table.Cell>
+										</Table.Row>
+									))}
+								</Table.Body>
+							</Table>
+						</div>
+					) : (
+						<p className="mt-5 text-sm text-kumo-subtle">
+							{t("publisher.approvers.empty", "No accounts are configured to approve this plugin.")}
+						</p>
+					)}
+				</Surface>
+			) : null}
+
+			{data.intents.length > 0 ? (
+				<Surface className="overflow-x-auto rounded-xl border bg-kumo-base p-0">
+					<div className="p-6 pb-0">
+						<h2 className="text-xl font-semibold text-kumo-strong">
+							{t("publisher.intents.title", "Recent releases")}
+						</h2>
+					</div>
+					<Table>
+						<Table.Header>
+							<Table.Row>
+								<Table.Head>{t("publisher.intents.package", "Package")}</Table.Head>
+								<Table.Head>{t("publisher.intents.version", "Version")}</Table.Head>
+								<Table.Head>{t("publisher.intents.state", "Status")}</Table.Head>
+								<Table.Head>{t("publisher.intents.updated", "Updated")}</Table.Head>
 							</Table.Row>
-						))}
-					</Table.Body>
-				</Table>
+						</Table.Header>
+						<Table.Body>
+							{data.intents.map((intent) => (
+								<Table.Row key={intent.id}>
+									<Table.Cell>{intent.packageSlug}</Table.Cell>
+									<Table.Cell>{intent.version}</Table.Cell>
+									<Table.Cell>
+										<Badge variant={stateVariant(intent.state)}>
+											{stateLabel(t, intent.state)}
+										</Badge>
+									</Table.Cell>
+									<Table.Cell>
+										{new Intl.DateTimeFormat(document.documentElement.lang, {
+											dateStyle: "medium",
+											timeStyle: "short",
+										}).format(intent.updatedAt)}
+									</Table.Cell>
+								</Table.Row>
+							))}
+						</Table.Body>
+					</Table>
+				</Surface>
+			) : null}
+
+			<Surface className="rounded-xl border bg-kumo-base p-6">
+				<div className="flex flex-wrap items-start justify-between gap-4">
+					<div>
+						<h2 className="text-xl font-semibold text-kumo-strong">
+							{t("publisher.audit.title", "Account activity")}
+						</h2>
+					</div>
+				</div>
+				{data.audit.length > 0 ? (
+					<div className="mt-5 overflow-x-auto">
+						<Table>
+							<Table.Header>
+								<Table.Row>
+									<Table.Head>{t("publisher.audit.event", "Action")}</Table.Head>
+									<Table.Head>{t("publisher.audit.actor", "By")}</Table.Head>
+									<Table.Head>{t("publisher.audit.time", "When")}</Table.Head>
+									<Table.Head>
+										<span className="sr-only">{t("publisher.audit.details", "Details")}</span>
+									</Table.Head>
+								</Table.Row>
+							</Table.Header>
+							<Table.Body>
+								{data.audit.map((item) => (
+									<Table.Row key={item.sequence}>
+										<Table.Cell>{activityEventLabel(t, item.eventType)}</Table.Cell>
+										<Table.Cell>{activityActorLabel(t, item)}</Table.Cell>
+										<Table.Cell>
+											{new Intl.DateTimeFormat(document.documentElement.lang, {
+												dateStyle: "medium",
+												timeStyle: "short",
+											}).format(item.createdAt)}
+										</Table.Cell>
+										<Table.Cell>
+											<ActivityDetails
+												action={activityEventLabel(t, item.eventType)}
+												item={item}
+												t={t}
+											/>
+										</Table.Cell>
+									</Table.Row>
+								))}
+							</Table.Body>
+						</Table>
+					</div>
+				) : (
+					<p className="mt-5 text-sm text-kumo-subtle">
+						{t("publisher.audit.empty", "No account activity yet")}
+					</p>
+				)}
+				{data.auditCursor ? (
+					<div className="mt-4 flex justify-end">
+						<Button disabled={busy} onClick={loadNextAuditPage} variant="outline">
+							{t("publisher.audit.next", "Show older activity")}
+						</Button>
+					</div>
+				) : null}
 			</Surface>
 		</div>
 	);
diff --git a/apps/release-service/src/ui/components.tsx b/apps/release-service/src/ui/components.tsx
index 9381f8392f..31735e87e6 100644
--- a/apps/release-service/src/ui/components.tsx
+++ b/apps/release-service/src/ui/components.tsx
@@ -1,4 +1,4 @@
-import { Banner, Button, Input, Link, Loader, Surface } from "@cloudflare/kumo";
+import { Banner, Button, Input, Loader, Surface } from "@cloudflare/kumo";
 import { type FormEvent, type ReactNode, useState } from "react";
 
 import { beginIdentityAuthorization, UiApiError } from "./api.js";
@@ -8,17 +8,13 @@ export function Page({ children }: { children: ReactNode }) {
 	const t = useT();
 	return (
 		<main className="mx-auto flex min-h-screen w-full max-w-6xl flex-col gap-6 p-6 sm:p-10">
-			<header className="flex flex-wrap items-center justify-between gap-4">
+			<header>
 				<div>
 					<p className="text-sm text-kumo-subtle">{t("brand.name", "EmDash")}</p>
 					<h1 className="text-2xl font-semibold text-kumo-strong">
-						{t("brand.releaseService", "Delegated release service")}
+						{t("brand.releaseService", "Plugin releases")}
 					</h1>
 				</div>
-				<nav aria-label={t("nav.label", "Release service sections")} className="flex gap-2">
-					<Link href="/publisher">{t("nav.publisher", "Publisher")}</Link>
-					<Link href="/admin">{t("nav.operator", "Operator")}</Link>
-				</nav>
 			</header>
 			{children}
 		</main>
@@ -53,10 +49,6 @@ export function LoginPanel({ realm }: { realm: "approver" | "publisher" }) {
 	const [identifier, setIdentifier] = useState("");
 	const [error, setError] = useState<unknown>(null);
 	const [loading, setLoading] = useState(false);
-	const label =
-		realm === "publisher"
-			? t("login.publisherTitle", "Sign in as a publisher")
-			: t("login.approverTitle", "Sign in as an approver");
 
 	async function submit(event: FormEvent) {
 		event.preventDefault();
@@ -79,21 +71,24 @@ export function LoginPanel({ realm }: { realm: "approver" | "publisher" }) {
 		<Surface className="mx-auto w-full max-w-xl rounded-xl border bg-kumo-base p-6 sm:p-8">
 			<form className="flex flex-col gap-5" onSubmit={submit}>
 				<div>
-					<h2 className="text-xl font-semibold text-kumo-strong">{label}</h2>
+					<h2 className="text-xl font-semibold text-kumo-strong">{t("login.title", "Sign in")}</h2>
 					<p className="mt-1 text-sm text-kumo-subtle">
-						{t("login.description", "Use the Atmosphere account that owns this release role.")}
+						{t(
+							"login.description",
+							"Use your Atmosphere account to view and manage your plugin releases.",
+						)}
 					</p>
 				</div>
 				{error ? <ErrorBanner error={error} /> : null}
 				<Input
-					label={t("login.identifier", "Handle or DID")}
-					placeholder={t("login.placeholder", "publisher.example.com")}
+					label={t("login.identifier", "Account handle")}
+					placeholder={t("login.placeholder", "your-handle.example")}
 					value={identifier}
 					onChange={(event) => setIdentifier(event.currentTarget.value)}
 					required
 				/>
 				<Button loading={loading} type="submit" variant="primary">
-					{t("login.continue", "Continue with Atmosphere")}
+					{t("login.continue", "Sign in with Atmosphere")}
 				</Button>
 			</form>
 		</Surface>
diff --git a/apps/release-service/src/verification/evaluate.ts b/apps/release-service/src/verification/evaluate.ts
index ac0255c8ff..f613ef38e5 100644
--- a/apps/release-service/src/verification/evaluate.ts
+++ b/apps/release-service/src/verification/evaluate.ts
@@ -7,12 +7,12 @@ import {
 	PackageRelease,
 	PackageReleaseExtension,
 } from "@emdash-cms/registry-lexicons";
+import { decodeMultihash } from "@emdash-cms/registry-verification/checksum";
 import {
-	decodeMultihash,
 	verifyPackageReleaseRecords,
 	type ProvenanceVerifier,
 	type VerifiedRecordContext,
-} from "@emdash-cms/registry-verification";
+} from "@emdash-cms/registry-verification/records";
 import { base64url } from "jose";
 
 import type {
diff --git a/apps/release-service/src/verification/pds.ts b/apps/release-service/src/verification/pds.ts
index 492615e989..f4fe240bf6 100644
--- a/apps/release-service/src/verification/pds.ts
+++ b/apps/release-service/src/verification/pds.ts
@@ -6,7 +6,7 @@ import {
 	type DirectPdsDidDocumentResolver,
 } from "@emdash-cms/registry-client/direct-pds";
 import { NSID } from "@emdash-cms/registry-lexicons";
-import { fetchVerifiedResource } from "@emdash-cms/registry-verification";
+import { fetchVerifiedResource } from "@emdash-cms/registry-verification/fetch";
 import compareVersions from "semver/functions/compare.js";
 import validVersion from "semver/functions/valid.js";
 
diff --git a/apps/release-service/src/workflow-pairing/routes.ts b/apps/release-service/src/workflow-pairing/routes.ts
new file mode 100644
index 0000000000..54a77fd083
--- /dev/null
+++ b/apps/release-service/src/workflow-pairing/routes.ts
@@ -0,0 +1,300 @@
+import { isDid } from "@atcute/lexicons/syntax";
+import { env } from "cloudflare:workers";
+import { base64url, type JWTVerifyGetKey } from "jose";
+import { ulid } from "ulidx";
+
+import { readJsonObject } from "../api/body.js";
+import { ApiError } from "../api/errors.js";
+import { apiFailure, apiSuccess } from "../api/response.js";
+import type { ServiceConfiguration } from "../config.js";
+import {
+	WorkflowPairingError,
+	type StoredWorkflowPairing,
+} from "../publisher-do/workflow-pairing.js";
+import {
+	PublisherSessionError,
+	requirePublisherApplicationSession,
+} from "../publisher-session/session.js";
+import { verifyGitHubActionsToken } from "../workload/github-oidc.js";
+import { WorkloadIdentityError } from "../workload/types.js";
+
+const PAIRING_PATH_PATTERN = /^\/v1\/publisher\/workflow-pairings\/([0-9A-HJKMNP-TV-Z]{26})$/;
+const PAIRING_CONFIRM_PATH_PATTERN =
+	/^\/v1\/publisher\/workflow-pairings\/([0-9A-HJKMNP-TV-Z]{26})\/confirm$/;
+const PAIRING_CLAIM_PATH_PATTERN = /^\/v1\/workflow-pairings\/([0-9A-HJKMNP-TV-Z]{26})\/claim$/;
+const PACKAGE_SLUG_PATTERN = /^[A-Za-z][A-Za-z0-9_-]{0,63}$/;
+const IDEMPOTENCY_KEY_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{15,127}$/;
+const TOKEN_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+const PAIRING_LIFETIME_MS = 15 * 60_000;
+
+export interface WorkflowPairingRouteDependencies {
+	keyResolver?: JWTVerifyGetKey;
+	now?: () => number;
+	pairingId?: (now: number) => string;
+	pairingToken?: () => string;
+}
+
+function hasExactKeys(value: Record<string, unknown>, expected: readonly string[]): boolean {
+	const keys = Object.keys(value);
+	return keys.length === expected.length && keys.every((key) => expected.includes(key));
+}
+
+function pairingFailure(code: string, requestId: string): Response {
+	if (code === "PAIRING_EXPIRED") {
+		return apiFailure(new ApiError(code, 410, "Workflow connection expired"), requestId);
+	}
+	if (code === "PAIRING_LIMIT_REACHED") {
+		return apiFailure(new ApiError(code, 429, "Too many pending workflow connections"), requestId);
+	}
+	if (code === "PAIRING_NOT_CLAIMED" || code === "PAIRING_CONFLICT") {
+		return apiFailure(
+			new ApiError(code, 409, "Workflow connection could not be confirmed"),
+			requestId,
+		);
+	}
+	return apiFailure(
+		new ApiError("PAIRING_INVALID", 404, "Workflow connection not found"),
+		requestId,
+	);
+}
+
+function routeFailure(error: unknown, requestId: string): Response {
+	if (error instanceof ApiError) return apiFailure(error, requestId);
+	if (error instanceof PublisherSessionError) {
+		const suspended = error.code === "PUBLISHER_SUSPENDED";
+		return apiFailure(
+			new ApiError(
+				suspended ? "PUBLISHER_SUSPENDED" : "PUBLISHER_SESSION_INVALID",
+				suspended ? 403 : 401,
+				suspended ? "Account is suspended" : "Account session is not valid",
+			),
+			requestId,
+		);
+	}
+	if (error instanceof WorkloadIdentityError) {
+		return apiFailure(new ApiError("AUTH_INVALID", 401, "GitHub authentication failed"), requestId);
+	}
+	if (error instanceof WorkflowPairingError) {
+		return apiFailure(
+			new ApiError("INVALID_REQUEST", 400, "Invalid workflow connection"),
+			requestId,
+		);
+	}
+	throw error;
+}
+
+function serializePairing(pairing: StoredWorkflowPairing) {
+	return {
+		id: pairing.id,
+		packageSlug: pairing.packageSlug,
+		state: pairing.state,
+		claim: pairing.claim,
+		expiresAt: pairing.expiresAt,
+		createdAt: pairing.createdAt,
+		claimedAt: pairing.claimedAt,
+		confirmedAt: pairing.confirmedAt,
+	};
+}
+
+function pairingId(params: Readonly<Record<string, string>>): string {
+	const value = params["pairingId"];
+	if (!value) throw new ApiError("PAIRING_INVALID", 404, "Workflow connection not found");
+	return value;
+}
+
+function requireIdempotencyKey(request: Request): string {
+	const value = request.headers.get("idempotency-key");
+	if (!value || !IDEMPOTENCY_KEY_PATTERN.test(value)) {
+		throw new ApiError("IDEMPOTENCY_KEY_INVALID", 400, "Valid idempotency key required");
+	}
+	return value;
+}
+
+async function publisherSession(
+	request: Request,
+	configuration: ServiceConfiguration,
+	requireCsrf = false,
+) {
+	return await requirePublisherApplicationSession(
+		request,
+		env.PUBLISHER_DO,
+		configuration.publicOrigin,
+		{ requireCsrf },
+	);
+}
+
+export function matchWorkflowPairingPath(
+	pathname: string,
+): Readonly<Record<string, string>> | null {
+	const match = PAIRING_PATH_PATTERN.exec(pathname);
+	return match?.[1] ? { pairingId: match[1] } : null;
+}
+
+export function matchWorkflowPairingConfirmPath(
+	pathname: string,
+): Readonly<Record<string, string>> | null {
+	const match = PAIRING_CONFIRM_PATH_PATTERN.exec(pathname);
+	return match?.[1] ? { pairingId: match[1] } : null;
+}
+
+export function matchWorkflowPairingClaimPath(
+	pathname: string,
+): Readonly<Record<string, string>> | null {
+	const match = PAIRING_CLAIM_PATH_PATTERN.exec(pathname);
+	return match?.[1] ? { pairingId: match[1] } : null;
+}
+
+export async function handleCreateWorkflowPairing(
+	request: Request,
+	requestId: string,
+	configuration: ServiceConfiguration,
+	dependencies: WorkflowPairingRouteDependencies = {},
+): Promise<Response> {
+	try {
+		const mutationKey = requireIdempotencyKey(request);
+		const session = await publisherSession(request, configuration, true);
+		const body = await readJsonObject(request);
+		if (
+			!hasExactKeys(body, ["packageSlug"]) ||
+			typeof body["packageSlug"] !== "string" ||
+			!PACKAGE_SLUG_PATTERN.test(body["packageSlug"])
+		) {
+			throw new ApiError("INVALID_REQUEST", 400, "Valid plugin package required");
+		}
+		const now = dependencies.now?.() ?? Date.now();
+		const result = await env.PUBLISHER_DO.getByName(session.publisherDid).createWorkflowPairing({
+			publisherDid: session.publisherDid,
+			pairingId: dependencies.pairingId?.(now) ?? ulid(now),
+			pairingToken:
+				dependencies.pairingToken?.() ??
+				base64url.encode(crypto.getRandomValues(new Uint8Array(32))),
+			mutationKey,
+			packageSlug: body["packageSlug"],
+			expiresAt: now + PAIRING_LIFETIME_MS,
+			now,
+		});
+		if (!result.ok) return pairingFailure(result.code, requestId);
+		return apiSuccess(
+			{
+				pairing: serializePairing(result.pairing),
+				pairingToken: result.pairingToken,
+				replayed: result.replayed,
+			},
+			requestId,
+			result.replayed ? 200 : 201,
+		);
+	} catch (error) {
+		return routeFailure(error, requestId);
+	}
+}
+
+export async function handleGetWorkflowPairing(
+	request: Request,
+	requestId: string,
+	configuration: ServiceConfiguration,
+	params: Readonly<Record<string, string>>,
+	dependencies: WorkflowPairingRouteDependencies = {},
+): Promise<Response> {
+	try {
+		const session = await publisherSession(request, configuration);
+		const current = await env.PUBLISHER_DO.getByName(session.publisherDid).getWorkflowPairing(
+			session.publisherDid,
+			pairingId(params),
+			dependencies.now?.() ?? Date.now(),
+		);
+		return current
+			? apiSuccess({ pairing: serializePairing(current) }, requestId)
+			: pairingFailure("PAIRING_INVALID", requestId);
+	} catch (error) {
+		return routeFailure(error, requestId);
+	}
+}
+
+export async function handleClaimWorkflowPairing(
+	request: Request,
+	requestId: string,
+	configuration: ServiceConfiguration,
+	params: Readonly<Record<string, string>>,
+	dependencies: WorkflowPairingRouteDependencies = {},
+): Promise<Response> {
+	try {
+		if (request.headers.has("cookie")) {
+			throw new ApiError("AUTH_INVALID", 401, "GitHub authentication failed");
+		}
+		const authorization = request.headers.get("authorization");
+		if (!authorization?.startsWith("Bearer ") || authorization.slice(7).includes(" ")) {
+			throw new ApiError("AUTH_INVALID", 401, "GitHub authentication failed");
+		}
+		const body = await readJsonObject(request);
+		if (
+			!hasExactKeys(body, ["publisherDid", "pairingToken"]) ||
+			typeof body["publisherDid"] !== "string" ||
+			!isDid(body["publisherDid"]) ||
+			typeof body["pairingToken"] !== "string" ||
+			!TOKEN_PATTERN.test(body["pairingToken"])
+		) {
+			throw new ApiError("PAIRING_INVALID", 404, "Workflow connection not found");
+		}
+		const identity = await verifyGitHubActionsToken(
+			authorization.slice(7),
+			configuration.publicOrigin,
+			dependencies.keyResolver,
+		);
+		const result = await env.PUBLISHER_DO.getByName(body["publisherDid"]).claimWorkflowPairing({
+			publisherDid: body["publisherDid"],
+			pairingId: pairingId(params),
+			pairingToken: body["pairingToken"],
+			claim: {
+				repository: identity.repository.name,
+				repositoryId: identity.repository.id,
+				repositoryOwner: identity.repository.owner,
+				repositoryOwnerId: identity.repository.ownerId,
+				repositoryVisibility: identity.repository.visibility,
+				workflowRef: identity.workflow.ref,
+				ref: identity.run.ref,
+				environment: identity.run.environment,
+			},
+			now: dependencies.now?.() ?? Date.now(),
+		});
+		if (!result.ok) return pairingFailure(result.code, requestId);
+		return apiSuccess(
+			{ pairing: serializePairing(result.pairing), replayed: result.replayed },
+			requestId,
+		);
+	} catch (error) {
+		return routeFailure(error, requestId);
+	}
+}
+
+export async function handleConfirmWorkflowPairing(
+	request: Request,
+	requestId: string,
+	configuration: ServiceConfiguration,
+	params: Readonly<Record<string, string>>,
+	dependencies: WorkflowPairingRouteDependencies = {},
+): Promise<Response> {
+	try {
+		requireIdempotencyKey(request);
+		const session = await publisherSession(request, configuration, true);
+		const body = await readJsonObject(request);
+		if (!hasExactKeys(body, [])) {
+			throw new ApiError("INVALID_REQUEST", 400, "Invalid workflow confirmation");
+		}
+		const result = await env.PUBLISHER_DO.getByName(session.publisherDid).confirmWorkflowPairing(
+			session.publisherDid,
+			pairingId(params),
+			dependencies.now?.() ?? Date.now(),
+		);
+		if (!result.ok) return pairingFailure(result.code, requestId);
+		return apiSuccess(
+			{
+				pairing: serializePairing(result.pairing),
+				policy: result.policy,
+				replayed: result.replayed,
+			},
+			requestId,
+		);
+	} catch (error) {
+		return routeFailure(error, requestId);
+	}
+}
diff --git a/apps/release-service/src/workflows/encryption-verification.ts b/apps/release-service/src/workflows/encryption-verification.ts
new file mode 100644
index 0000000000..cd6661a7b9
--- /dev/null
+++ b/apps/release-service/src/workflows/encryption-verification.ts
@@ -0,0 +1,343 @@
+import { WorkflowEntrypoint, type WorkflowEvent, type WorkflowStep } from "cloudflare:workers";
+import { NonRetryableError } from "cloudflare:workflows";
+import { base64url } from "jose";
+
+import type { AccessActor } from "../access/auth.js";
+import { loadConfiguration, type ServiceConfiguration } from "../config.js";
+import { SERVICE_CONTROL_OBJECT_NAME } from "../control-do/service-control-do.js";
+import { EncryptionError } from "../crypto/encryption.js";
+import type { DirectoryIdentityKind } from "../directory/identity-directory-do.js";
+
+const ACTOR_IDENTITY_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,255}$/;
+const CAMPAIGN_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{15,127}$/;
+const MAX_KEY_VERSION = 2_147_483_647;
+const DIRECTORY_PAGE_SIZE = 25;
+const MAX_DIRECTORY_PAGES = 400;
+const DIRECTORY_SHARDS_PER_STEP = 16;
+const MAX_ROTATION_PASSES = 5;
+const REQUIRED_ZERO_CHANGE_PASSES = 2;
+const STEP_CONFIG = {
+	retries: { limit: 5, delay: "2 seconds", backoff: "exponential" },
+	timeout: "5 minutes",
+} as const;
+
+export interface EncryptionVerificationWorkflowParams {
+	campaignId: string;
+	targetKeyVersion: number;
+	retiringKeyVersion: number | null;
+	actorIdentity: string;
+}
+
+export interface EncryptionVerificationWorkflowOutput {
+	targetKeyVersion: number;
+	retiringKeyVersion: number | null;
+	publishers: number;
+	approvers: number;
+	records: number;
+	rotated: number;
+	verifiedAt: number;
+}
+
+export type StartEncryptionVerificationWorkflowResult =
+	| { ok: true; workflowId: string; created: boolean }
+	| { ok: false; code: "ENCRYPTION_WORKFLOW_UNAVAILABLE" };
+
+interface ShardVerificationResult {
+	identities: number;
+	records: number;
+	rotated: number;
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+	return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function validKeyVersion(value: unknown): value is number {
+	return Number.isSafeInteger(value) && Number(value) >= 1 && Number(value) <= MAX_KEY_VERSION;
+}
+
+function validParams(value: unknown): value is EncryptionVerificationWorkflowParams {
+	return (
+		isRecord(value) &&
+		typeof value["campaignId"] === "string" &&
+		CAMPAIGN_ID_PATTERN.test(value["campaignId"]) &&
+		validKeyVersion(value["targetKeyVersion"]) &&
+		(value["retiringKeyVersion"] === null ||
+			(validKeyVersion(value["retiringKeyVersion"]) &&
+				Number(value["retiringKeyVersion"]) < Number(value["targetKeyVersion"]))) &&
+		typeof value["actorIdentity"] === "string" &&
+		ACTOR_IDENTITY_PATTERN.test(value["actorIdentity"])
+	);
+}
+
+async function workflowId(params: EncryptionVerificationWorkflowParams): Promise<string> {
+	return base64url.encode(
+		new Uint8Array(
+			await crypto.subtle.digest(
+				"SHA-256",
+				new TextEncoder().encode(
+					JSON.stringify([
+						"encryption-verification-workflow",
+						1,
+						params.campaignId,
+						params.targetKeyVersion,
+						params.retiringKeyVersion,
+					]),
+				),
+			),
+		),
+	);
+}
+
+export async function startEncryptionVerificationWorkflow(
+	workflow: Workflow<EncryptionVerificationWorkflowParams>,
+	params: EncryptionVerificationWorkflowParams,
+): Promise<StartEncryptionVerificationWorkflowResult> {
+	if (!validParams(params)) return { ok: false, code: "ENCRYPTION_WORKFLOW_UNAVAILABLE" };
+	const id = await workflowId(params);
+	try {
+		await workflow.create({ id, params });
+		return { ok: true, workflowId: id, created: true };
+	} catch {
+		try {
+			const existing = await workflow.get(id);
+			const status = await existing.status();
+			if (status.status === "unknown") {
+				return { ok: false, code: "ENCRYPTION_WORKFLOW_UNAVAILABLE" };
+			}
+			if (status.status === "errored" || status.status === "terminated") {
+				await existing.restart();
+			}
+			return { ok: true, workflowId: id, created: false };
+		} catch {
+			return { ok: false, code: "ENCRYPTION_WORKFLOW_UNAVAILABLE" };
+		}
+	}
+}
+
+function assertConfiguration(
+	configuration: ServiceConfiguration,
+	params: EncryptionVerificationWorkflowParams,
+): void {
+	if (
+		configuration.encryption.currentKeyVersion !== params.targetKeyVersion ||
+		!configuration.encryption.availableKeyVersions.includes(params.targetKeyVersion) ||
+		(params.retiringKeyVersion !== null &&
+			!configuration.encryption.availableKeyVersions.includes(params.retiringKeyVersion))
+	) {
+		throw new NonRetryableError("Encryption verification keyring changed");
+	}
+}
+
+async function verifyOwner(
+	env: Env,
+	configuration: ServiceConfiguration,
+	kind: DirectoryIdentityKind,
+	did: string,
+	actorIdentity: string,
+): Promise<{ records: number; rotated: number }> {
+	let totalRotated = 0;
+	let recordCount = 0;
+	let consecutiveZeroChangePasses = 0;
+	for (let pass = 0; pass < MAX_ROTATION_PASSES; pass += 1) {
+		const page =
+			kind === "publisher"
+				? await env.PUBLISHER_DO.getByName(did).listEncryptionRecords(did, null, 100)
+				: await env.APPROVER_DO.getByName(did).listEncryptionRecords(did, null, 100);
+		if (page.nextCursor !== null) {
+			throw new NonRetryableError("Encryption shard exceeds the bounded record page");
+		}
+		recordCount = page.items.length;
+		let changed = 0;
+		let raced = 0;
+		for (const record of page.items) {
+			let replacement;
+			try {
+				replacement = await configuration.encryption.rotate(record.envelope, record.context);
+			} catch (error) {
+				if (error instanceof EncryptionError) {
+					throw new NonRetryableError("Retained ciphertext could not be verified");
+				}
+				throw error;
+			}
+			if (
+				replacement.envelope === record.envelope &&
+				replacement.keyVersion === record.keyVersion
+			) {
+				continue;
+			}
+			const replaced =
+				kind === "publisher"
+					? await env.PUBLISHER_DO.getByName(did).replaceEncryptionRecord({
+							publisherDid: did,
+							cursor: record.cursor,
+							expectedEnvelope: record.envelope,
+							replacementEnvelope: replacement.envelope,
+							replacementKeyVersion: replacement.keyVersion,
+							actorIdentity,
+						})
+					: await env.APPROVER_DO.getByName(did).replaceEncryptionRecord({
+							approverDid: did,
+							cursor: record.cursor,
+							expectedEnvelope: record.envelope,
+							replacementEnvelope: replacement.envelope,
+							replacementKeyVersion: replacement.keyVersion,
+							actorIdentity,
+						});
+			if (replaced) changed += 1;
+			else raced += 1;
+		}
+		totalRotated += changed;
+		consecutiveZeroChangePasses =
+			changed === 0 && raced === 0 ? consecutiveZeroChangePasses + 1 : 0;
+		if (consecutiveZeroChangePasses >= REQUIRED_ZERO_CHANGE_PASSES) {
+			return { records: recordCount, rotated: totalRotated };
+		}
+	}
+	throw new Error("Encryption shard did not reach a stable verified state");
+}
+
+async function verifyDirectoryShard(
+	env: Env,
+	configuration: ServiceConfiguration,
+	params: EncryptionVerificationWorkflowParams,
+	kind: DirectoryIdentityKind,
+	shard: string,
+): Promise<ShardVerificationResult> {
+	const directory = env.IDENTITY_DIRECTORY_DO.getByName(shard);
+	let afterDid: string | null = null;
+	let identities = 0;
+	let records = 0;
+	let rotated = 0;
+	for (let pageNumber = 0; pageNumber < MAX_DIRECTORY_PAGES; pageNumber += 1) {
+		const page = await directory.list(kind, afterDid, DIRECTORY_PAGE_SIZE);
+		const results = await Promise.all(
+			page.map((identity) =>
+				verifyOwner(env, configuration, kind, identity.did, params.actorIdentity),
+			),
+		);
+		identities += page.length;
+		for (const result of results) {
+			records += result.records;
+			rotated += result.rotated;
+		}
+		if (page.length < DIRECTORY_PAGE_SIZE) return { identities, records, rotated };
+		afterDid = page.at(-1)!.did;
+	}
+	throw new NonRetryableError("Encryption verification directory shard exceeds its page limit");
+}
+
+async function verifyDirectoryGroup(
+	env: Env,
+	params: EncryptionVerificationWorkflowParams,
+	kind: DirectoryIdentityKind,
+	group: number,
+): Promise<ShardVerificationResult> {
+	const configuration = await loadConfiguration(env);
+	assertConfiguration(configuration, params);
+	let identities = 0;
+	let records = 0;
+	let rotated = 0;
+	const firstShard = group * DIRECTORY_SHARDS_PER_STEP;
+	for (
+		let shardNumber = firstShard;
+		shardNumber < firstShard + DIRECTORY_SHARDS_PER_STEP;
+		shardNumber += 1
+	) {
+		const result = await verifyDirectoryShard(
+			env,
+			configuration,
+			params,
+			kind,
+			shardNumber.toString(16).padStart(2, "0"),
+		);
+		identities += result.identities;
+		records += result.records;
+		rotated += result.rotated;
+	}
+	return { identities, records, rotated };
+}
+
+export class EncryptionVerificationWorkflow extends WorkflowEntrypoint<
+	Env,
+	EncryptionVerificationWorkflowParams
+> {
+	override async run(
+		event: Readonly<WorkflowEvent<EncryptionVerificationWorkflowParams>>,
+		step: WorkflowStep,
+	): Promise<EncryptionVerificationWorkflowOutput> {
+		if (!validParams(event.payload)) {
+			throw new NonRetryableError("Invalid encryption-verification Workflow parameters");
+		}
+		const params = event.payload;
+		const actor: AccessActor = {
+			realm: "access",
+			identity: params.actorIdentity,
+			email: "encryption-workflow@emdash.invalid",
+			role: "admin",
+		};
+		await step.do("validate-encryption-campaign", STEP_CONFIG, async () => {
+			const configuration = await loadConfiguration(this.env);
+			assertConfiguration(configuration, params);
+			const control = this.env.SERVICE_CONTROL_DO.getByName(SERVICE_CONTROL_OBJECT_NAME);
+			const [state, keys] = await Promise.all([
+				control.readServiceState(actor),
+				control.readEncryptionKeys(actor),
+			]);
+			if (
+				state.mode !== "publication-paused" ||
+				keys.find((key) => key.status === "active")?.version !== params.targetKeyVersion ||
+				(params.retiringKeyVersion !== null &&
+					keys.find((key) => key.version === params.retiringKeyVersion)?.status !== "readable")
+			) {
+				throw new NonRetryableError("Encryption campaign control state is invalid");
+			}
+		});
+		let publishers = 0;
+		let approvers = 0;
+		let records = 0;
+		let rotated = 0;
+		for (const kind of ["publisher", "approver"] as const) {
+			for (let group = 0; group < 256 / DIRECTORY_SHARDS_PER_STEP; group += 1) {
+				const result = await step.do<ShardVerificationResult>(
+					`encryption-${kind}-${group.toString(16).padStart(2, "0")}`,
+					STEP_CONFIG,
+					() => verifyDirectoryGroup(this.env, params, kind, group),
+				);
+				if (kind === "publisher") publishers += result.identities;
+				else approvers += result.identities;
+				records += result.records;
+				rotated += result.rotated;
+			}
+		}
+		const id = await workflowId(params);
+		const verification = await step.do<{ verifiedAt: number }>(
+			"record-encryption-verification",
+			STEP_CONFIG,
+			async () => {
+				const recorded = await this.env.SERVICE_CONTROL_DO.getByName(
+					SERVICE_CONTROL_OBJECT_NAME,
+				).recordEncryptionVerification({
+					targetKeyVersion: params.targetKeyVersion,
+					workflowId: id,
+					actorIdentity: "release-service",
+					publishers,
+					approvers,
+					records,
+					rotated,
+					verifiedAt: Date.now(),
+				});
+				return { verifiedAt: recorded.verifiedAt };
+			},
+		);
+		return {
+			targetKeyVersion: params.targetKeyVersion,
+			retiringKeyVersion: params.retiringKeyVersion,
+			publishers,
+			approvers,
+			records,
+			rotated,
+			verifiedAt: verification.verifiedAt,
+		};
+	}
+}
diff --git a/apps/release-service/src/workflows/publisher-archive.ts b/apps/release-service/src/workflows/publisher-archive.ts
index c82c298dd7..7f1fb1b948 100644
--- a/apps/release-service/src/workflows/publisher-archive.ts
+++ b/apps/release-service/src/workflows/publisher-archive.ts
@@ -81,9 +81,13 @@ export async function startPublisherArchiveWorkflow(
 		try {
 			const existing = await workflow.get(id);
 			const status = await existing.status();
-			return status.status === "unknown"
-				? { ok: false, code: "ARCHIVE_WORKFLOW_UNAVAILABLE" }
-				: { ok: true, workflowId: id, created: false };
+			if (status.status === "unknown") {
+				return { ok: false, code: "ARCHIVE_WORKFLOW_UNAVAILABLE" };
+			}
+			if (status.status === "errored" || status.status === "terminated") {
+				await existing.restart();
+			}
+			return { ok: true, workflowId: id, created: false };
 		} catch {
 			return { ok: false, code: "ARCHIVE_WORKFLOW_UNAVAILABLE" };
 		}
diff --git a/apps/release-service/test/access-auth.test.ts b/apps/release-service/test/access-auth.test.ts
index a03a9ee9b9..845f2ec920 100644
--- a/apps/release-service/test/access-auth.test.ts
+++ b/apps/release-service/test/access-auth.test.ts
@@ -98,6 +98,22 @@ describe("Cloudflare Access authentication", () => {
 		},
 	);
 
+	it("authenticates any configured application audience for a role", async () => {
+		const secondAdminAudience = "d".repeat(64);
+		const configuration = {
+			...ACCESS_CONFIGURATION,
+			audiences: {
+				...ACCESS_CONFIGURATION.audiences,
+				admin: [ACCESS_CONFIGURATION.audiences.admin, secondAdminAudience],
+			},
+		};
+		const token = await createAccessToken({ audience: secondAdminAudience });
+
+		await expect(
+			authenticateAccessRequest(authenticatedRequest(token), "admin", configuration, keyResolver),
+		).resolves.toMatchObject({ role: "admin" });
+	});
+
 	it("requires the Access assertion header and does not trust the browser cookie", async () => {
 		const request = new Request("https://release.example.com/admin/api/viewer/test", {
 			headers: { cookie: "CF_Authorization=unverified" },
diff --git a/apps/release-service/test/approval-authority.test.ts b/apps/release-service/test/approval-authority.test.ts
index fc4a6c1319..e0f737b464 100644
--- a/apps/release-service/test/approval-authority.test.ts
+++ b/apps/release-service/test/approval-authority.test.ts
@@ -6,6 +6,7 @@ import { afterEach, describe, expect, it } from "vitest";
 
 import {
 	ApprovalAuthorityError,
+	loadCurrentApprovalPolicy,
 	loadApprovalIntent,
 	verifyCurrentApprover,
 } from "../src/approvals/authority.js";
@@ -227,6 +228,21 @@ describe("approval authority", () => {
 		).rejects.toMatchObject({ code: "PROFILE_CHANGED" });
 	});
 
+	it("loads the current signed approver policy for publisher status views", async () => {
+		await expect(
+			loadCurrentApprovalPolicy(PUBLISHER_DID, "gallery", {
+				actorResolver: actorResolver(),
+				fetch: authorityFetch(),
+			}),
+		).resolves.toEqual({ profileCid: PROFILE_CID, approverDids: [APPROVER_DID] });
+		await expect(
+			loadCurrentApprovalPolicy(PUBLISHER_DID, "gallery", {
+				actorResolver: actorResolver(),
+				fetch: authorityFetch({ approvers: [APPROVER_DID, APPROVER_DID] }),
+			}),
+		).rejects.toMatchObject({ code: "PROFILE_FETCH_FAILED" });
+	});
+
 	it("rejects private PDS resolution before fetching the record", async () => {
 		await expect(
 			verifyCurrentApprover(EVIDENCE, APPROVER_DID, {
diff --git a/apps/release-service/test/approval-digest.test.ts b/apps/release-service/test/approval-digest.test.ts
index f1f4bc2f80..de3deacd87 100644
--- a/apps/release-service/test/approval-digest.test.ts
+++ b/apps/release-service/test/approval-digest.test.ts
@@ -109,6 +109,13 @@ describe("approval digest", () => {
 		);
 	});
 
+	it("uses ordinal ordering for canonical approver DIDs", async () => {
+		const encoded = await encodeAwaitingApprovalState(EVIDENCE, ["did:plc:a", "did:plc:B"]);
+		const parsed = JSON.parse(encoded) as { approverDids: string[] };
+
+		expect(parsed.approverDids).toEqual(["did:plc:B", "did:plc:a"]);
+	});
+
 	it("rejects a substituted evidence digest", async () => {
 		const encoded = await encodeAwaitingApprovalState(EVIDENCE, ["did:plc:approver"]);
 		const substituted = encoded.replace(await computeApprovalEvidenceDigest(EVIDENCE), DIGEST_A);
diff --git a/apps/release-service/test/approver-do.test.ts b/apps/release-service/test/approver-do.test.ts
index 6a6067468a..3543a2ff43 100644
--- a/apps/release-service/test/approver-do.test.ts
+++ b/apps/release-service/test/approver-do.test.ts
@@ -104,6 +104,33 @@ describe("ApproverDurableObject", () => {
 		expect(JSON.stringify(persisted.audit)).not.toContain("encrypted-identity-state");
 	});
 
+	it("bounds retained identity transaction tombstones", async () => {
+		const stub = approver();
+		const now = 1_800_000_000_000;
+		for (let index = 0; index < 30; index += 1) {
+			const stateHash = String(index).padStart(43, "a");
+			await stub.putIdentityTransaction({
+				approverDid: APPROVER_DID,
+				stateHash,
+				encryptedState: "encrypted-identity-state",
+				encryptionKeyVersion: 1,
+				clientKeyId: "assertion-1",
+				redirectTarget: "/approver",
+				expiresAt: now + 60_000,
+				now,
+			});
+			await stub.consumeIdentityTransaction(APPROVER_DID, stateHash, now + 1);
+		}
+
+		await expect(
+			runInDurableObject(stub, (_instance, state) =>
+				state.storage.sql
+					.exec<{ count: number }>("SELECT COUNT(*) AS count FROM identity_transactions")
+					.one(),
+			),
+		).resolves.toEqual({ count: 1 });
+	});
+
 	it("rejects expired identity proof state without returning encrypted material", async () => {
 		const stub = approver();
 		const now = 1_800_000_000_000;
@@ -289,6 +316,36 @@ describe("ApproverDurableObject", () => {
 		).resolves.toEqual({ ok: false, code: "CREDENTIAL_STATE_CHANGED" });
 	});
 
+	it("reports enrolment and revocation state without initializing an empty shard", async () => {
+		const empty = env.APPROVER_DO.getByName(OTHER_APPROVER_DID);
+		await expect(empty.getEnrollmentStatus(OTHER_APPROVER_DID)).resolves.toEqual({
+			credentialCount: 0,
+			activeCredentialCount: 0,
+			firstEnrolledAt: null,
+			lastEnrolledAt: null,
+			lastRevokedAt: null,
+		});
+		await expect(
+			runInDurableObject(empty, (_instance, state) =>
+				state.storage.sql.exec<{ count: number }>("SELECT COUNT(*) AS count FROM approver").one(),
+			),
+		).resolves.toEqual({ count: 0 });
+
+		const stub = approver();
+		const now = 1_800_000_000_000;
+		await stub.enrolCredential(APPROVER_DID, credentialInput(CREDENTIAL_ID, now));
+		await stub.enrolCredential(APPROVER_DID, credentialInput(SECOND_CREDENTIAL_ID, now + 1));
+		await stub.revokeCredential(APPROVER_DID, CREDENTIAL_ID, now + 2);
+
+		await expect(stub.getEnrollmentStatus(APPROVER_DID)).resolves.toEqual({
+			credentialCount: 2,
+			activeCredentialCount: 1,
+			firstEnrolledAt: now,
+			lastEnrolledAt: now + 1,
+			lastRevokedAt: now + 2,
+		});
+	});
+
 	it("binds approval challenges to intent inputs and consumes them once", async () => {
 		const stub = approver();
 		const now = 1_800_000_000_000;
@@ -339,6 +396,30 @@ describe("ApproverDurableObject", () => {
 		).resolves.toEqual({ ok: true });
 	});
 
+	it("bounds retained challenge tombstones while issuing new challenges", async () => {
+		const stub = approver();
+		const now = 1_800_000_000_000;
+		for (let index = 0; index < 75; index += 1) {
+			const challengeHash = String(index).padStart(43, "a");
+			await stub.createChallenge(APPROVER_DID, {
+				challengeHash,
+				kind: "registration",
+				context: "registration-context",
+				expiresAt: now + 60_000,
+				now,
+			});
+			await stub.consumeChallenge(APPROVER_DID, challengeHash, "registration", now + 1);
+		}
+
+		await expect(
+			runInDurableObject(stub, (_instance, state) =>
+				state.storage.sql
+					.exec<{ count: number }>("SELECT COUNT(*) AS count FROM approval_challenges")
+					.one(),
+			),
+		).resolves.toEqual({ count: 1 });
+	});
+
 	it("invalidates outstanding intent challenges on credential revocation", async () => {
 		const stub = approver();
 		const now = 1_800_000_000_000;
diff --git a/apps/release-service/test/config.test.ts b/apps/release-service/test/config.test.ts
index f65452f78d..57156b69cc 100644
--- a/apps/release-service/test/config.test.ts
+++ b/apps/release-service/test/config.test.ts
@@ -48,6 +48,19 @@ describe("release-service OAuth configuration", () => {
 		expect(configuration.access.teamDomain).toBe("https://access.example.com");
 	});
 
+	it("accepts multiple Access applications for one operator role", async () => {
+		const secondAdminAudience = "d".repeat(64);
+		const configuration = await loadConfiguration({
+			...TEST_BINDINGS,
+			ACCESS_ADMIN_AUD: JSON.stringify([TEST_BINDINGS.ACCESS_ADMIN_AUD, secondAdminAudience]),
+		});
+
+		expect(configuration.access.audiences.admin).toEqual([
+			TEST_BINDINGS.ACCESS_ADMIN_AUD,
+			secondAdminAudience,
+		]);
+	});
+
 	it.each([
 		["empty origin", { ...TEST_BINDINGS, PUBLIC_ORIGIN: "" }],
 		["empty deployment ID", { ...TEST_BINDINGS, DEPLOYMENT_ID: "" }],
@@ -65,6 +78,26 @@ describe("release-service OAuth configuration", () => {
 			{ ...TEST_BINDINGS, ACCESS_TEAM_DOMAIN: "https://emdash-test.cloudflareaccess.com:8443" },
 		],
 		["malformed Access audience", { ...TEST_BINDINGS, ACCESS_ADMIN_AUD: "not-an-aud" }],
+		["empty Access audience list", { ...TEST_BINDINGS, ACCESS_ADMIN_AUD: "[]" }],
+		[
+			"duplicate Access audience list",
+			{
+				...TEST_BINDINGS,
+				ACCESS_ADMIN_AUD: JSON.stringify([
+					TEST_BINDINGS.ACCESS_ADMIN_AUD,
+					TEST_BINDINGS.ACCESS_ADMIN_AUD,
+				]),
+			},
+		],
+		[
+			"oversized Access audience list",
+			{
+				...TEST_BINDINGS,
+				ACCESS_ADMIN_AUD: JSON.stringify(
+					Array.from({ length: 9 }, (_value, index) => index.toString(16).repeat(64)),
+				),
+			},
+		],
 		[
 			"duplicate Access audiences",
 			{ ...TEST_BINDINGS, ACCESS_ADMIN_AUD: TEST_BINDINGS.ACCESS_REVIEWER_AUD },
diff --git a/apps/release-service/test/control-routes.test.ts b/apps/release-service/test/control-routes.test.ts
index 7823472db9..f49925ed7d 100644
--- a/apps/release-service/test/control-routes.test.ts
+++ b/apps/release-service/test/control-routes.test.ts
@@ -1,4 +1,5 @@
 import { reset } from "cloudflare:test";
+import { env } from "cloudflare:workers";
 import { createLocalJWKSet, exportJWK, generateKeyPair, SignJWT, type JWTVerifyGetKey } from "jose";
 import { afterEach, beforeAll, describe, expect, it } from "vitest";
 
@@ -10,6 +11,10 @@ import { TEST_ACCESS_AUDIENCES, TEST_BINDINGS } from "./fixtures/oauth.js";
 const ACCESS_KEY_ID = "control-route-access-key";
 const OPERATOR_SUBJECT = "7335d417-61da-459d-899c-0a01c76a2f94";
 const DID = "did:plc:publisher";
+const KEYRING_V2 =
+	'{"current":2,"keys":[{"version":1,"key":"AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8"},{"version":2,"key":"ICEiIyQlJicoKSorLC0uLzAxMjM0NTY3ODk6Ozw9Pj8"}]}';
+const KEYRING_V2_RETIRED =
+	'{"current":2,"keys":[{"version":2,"key":"ICEiIyQlJicoKSorLC0uLzAxMjM0NTY3ODk6Ozw9Pj8"}]}';
 
 let privateKey: CryptoKey;
 let keyResolver: JWTVerifyGetKey;
@@ -45,6 +50,7 @@ async function operatorRequest(
 	path: string,
 	role: AccessRole,
 	init: RequestInit = {},
+	bindings = TEST_BINDINGS,
 ): Promise<Response> {
 	const headers = new Headers(init.headers);
 	headers.set("cf-access-jwt-assertion", await accessToken(role));
@@ -57,7 +63,7 @@ async function operatorRequest(
 	}
 	return handleRequest(
 		new Request(`${TEST_BINDINGS.PUBLIC_ORIGIN}${path}`, { ...init, headers }),
-		TEST_BINDINGS,
+		bindings,
 		ROUTES,
 		keyResolver,
 	);
@@ -110,6 +116,112 @@ describe("Access service-control routes", () => {
 		});
 	});
 
+	it("activates and retires configured encryption keys through Access", async () => {
+		const configuredV2 = { ...TEST_BINDINGS, ENCRYPTION_KEYRING: KEYRING_V2 };
+		const retiredV1 = { ...TEST_BINDINGS, ENCRYPTION_KEYRING: KEYRING_V2_RETIRED };
+		const initiallyNotReady = await handleRequest(
+			new Request(`${TEST_BINDINGS.PUBLIC_ORIGIN}/ready`),
+			configuredV2,
+			ROUTES,
+			keyResolver,
+		);
+		expect(initiallyNotReady.status).toBe(503);
+		const initial = await operatorRequest("/admin/api/encryption/keys", "viewer", {}, configuredV2);
+		await expect(initial.json()).resolves.toMatchObject({
+			data: {
+				configured: { activeVersion: 2, versions: [1, 2] },
+				keys: [{ version: 1, status: "active" }],
+			},
+		});
+
+		await operatorRequest(
+			"/admin/api/pause",
+			"admin",
+			{
+				method: "POST",
+				headers: {
+					"content-type": "application/json",
+					"idempotency-key": "key-lifecycle-pause-0001",
+				},
+				body: JSON.stringify({ mode: "publication-paused", reasonCode: "KEY_ROTATION" }),
+			},
+			configuredV2,
+		);
+		const activated = await operatorRequest(
+			"/admin/api/encryption/keys/activate",
+			"admin",
+			{
+				method: "POST",
+				headers: {
+					"content-type": "application/json",
+					"idempotency-key": "key-lifecycle-activate-0001",
+				},
+				body: JSON.stringify({ version: 2 }),
+			},
+			configuredV2,
+		);
+		expect(activated.status).toBe(200);
+		await expect(activated.json()).resolves.toMatchObject({
+			data: {
+				key: { version: 2, status: "active", changedBy: OPERATOR_SUBJECT },
+				replayed: false,
+			},
+		});
+		const ready = await handleRequest(
+			new Request(`${TEST_BINDINGS.PUBLIC_ORIGIN}/ready`),
+			configuredV2,
+			ROUTES,
+			keyResolver,
+		);
+		expect(ready.status).toBe(200);
+		await env.SERVICE_CONTROL_DO.getByName("global").recordEncryptionVerification({
+			targetKeyVersion: 2,
+			workflowId: "V".repeat(43),
+			actorIdentity: "release-service",
+			publishers: 0,
+			approvers: 0,
+			records: 0,
+			rotated: 0,
+			verifiedAt: Date.now(),
+		});
+
+		const retained = await operatorRequest(
+			"/admin/api/encryption/keys/1/retire",
+			"admin",
+			{
+				method: "POST",
+				headers: {
+					"content-type": "application/json",
+					"idempotency-key": "key-lifecycle-retire-0001",
+				},
+				body: "{}",
+			},
+			configuredV2,
+		);
+		expect(retained.status).toBe(409);
+		await expect(retained.json()).resolves.toMatchObject({
+			error: { code: "ENCRYPTION_OPERATION_FAILED" },
+		});
+
+		const retired = await operatorRequest(
+			"/admin/api/encryption/keys/1/retire",
+			"admin",
+			{
+				method: "POST",
+				headers: {
+					"content-type": "application/json",
+					"idempotency-key": "key-lifecycle-retire-0002",
+				},
+				body: "{}",
+			},
+			retiredV1,
+		);
+		expect(retired.status).toBe(200);
+		await expect(retired.json()).resolves.toMatchObject({
+			data: { key: { version: 1, status: "retired" }, replayed: false },
+		});
+	});
+
 	it("sets and reads a publisher suspension without exposing operator email", async () => {
 		const changed = await operatorRequest(
 			`/admin/api/publishers/${encodeURIComponent(DID)}/suspend`,
@@ -191,8 +303,12 @@ describe("Access service-control routes", () => {
 		["GET", "/admin/api/viewer/status", "viewer"],
 		["GET", `/admin/api/viewer/publisher-control?did=${encodeURIComponent(DID)}`, "viewer"],
 		["GET", "/admin/api/viewer/audit", "viewer"],
+		["GET", "/admin/api/viewer/encryption/keys", "viewer"],
 		["POST", "/admin/api/admin/service-mode", "admin"],
 		["POST", "/admin/api/admin/publisher-control", "admin"],
+		["POST", "/admin/api/admin/encryption/keys/activate", "admin"],
+		["POST", "/admin/api/admin/encryption/verify", "admin"],
+		["POST", "/admin/api/admin/encryption/keys/1/retire", "admin"],
 	] as const)("does not expose the legacy %s %s operator route", async (method, path, role) => {
 		const response = await operatorRequest(path, role, {
 			method,
diff --git a/apps/release-service/test/encryption-operations-routes.test.ts b/apps/release-service/test/encryption-operations-routes.test.ts
index 9a44ad80f5..b211adb06f 100644
--- a/apps/release-service/test/encryption-operations-routes.test.ts
+++ b/apps/release-service/test/encryption-operations-routes.test.ts
@@ -125,7 +125,17 @@ describe("Access encryption operations", () => {
 		);
 		expect(second.status).toBe(200);
 		await expect(second.json()).resolves.toMatchObject({
-			data: { scanned: 1, rotated: 1, raced: 0, nextCursor: null },
+			data: { scanned: 1, rotated: 1, raced: 0, nextCursor: null, complete: false },
+		});
+		const verification = await handleRotatePublisherEncryption(
+			request({ afterCursor: null, limit: 10 }),
+			"request-3",
+			rotating,
+			{ publisherDid: PUBLISHER_DID },
+			ADMIN,
+		);
+		await expect(verification.json()).resolves.toMatchObject({
+			data: { scanned: 2, rotated: 0, raced: 0, nextCursor: null, complete: true },
 		});
 
 		const records = await publisher.listEncryptionRecords(PUBLISHER_DID, null, 10, now);
@@ -246,7 +256,19 @@ describe("Access encryption operations", () => {
 		);
 		expect(rescan.status).toBe(200);
 		await expect(rescan.json()).resolves.toMatchObject({
-			data: { complete: true, nextCursor: null, rotated: 1, raced: 0 },
+			data: { complete: false, nextCursor: null, rotated: 1, raced: 0 },
+		});
+
+		const cleanRescan = await handleRotatePublisherEncryption(
+			request({ afterCursor: null, limit: 10 }),
+			"race-clean-rescan",
+			rotating,
+			{ publisherDid: PUBLISHER_DID },
+			ADMIN,
+		);
+		expect(cleanRescan.status).toBe(200);
+		await expect(cleanRescan.json()).resolves.toMatchObject({
+			data: { complete: true, nextCursor: null, rotated: 0, raced: 0 },
 		});
 	});
 
diff --git a/apps/release-service/test/encryption-verification-workflow.test.ts b/apps/release-service/test/encryption-verification-workflow.test.ts
new file mode 100644
index 0000000000..687297b278
--- /dev/null
+++ b/apps/release-service/test/encryption-verification-workflow.test.ts
@@ -0,0 +1,78 @@
+import { reset } from "cloudflare:test";
+import { env } from "cloudflare:workers";
+import { afterEach, describe, expect, it } from "vitest";
+
+import type { AccessActor } from "../src/access/auth.js";
+import { SERVICE_CONTROL_OBJECT_NAME } from "../src/control-do/service-control-do.js";
+import { startEncryptionVerificationWorkflow } from "../src/workflows/encryption-verification.js";
+
+const PUBLISHER_DID = "did:plc:encryption-workflow-publisher";
+const ADMIN = {
+	realm: "access",
+	identity: "admin@example.com",
+	email: "admin@example.com",
+	role: "admin",
+} as const satisfies AccessActor;
+
+async function directoryShard(did: string): Promise<string> {
+	const digest = new Uint8Array(
+		await crypto.subtle.digest("SHA-256", new TextEncoder().encode(did)),
+	);
+	return digest[0]!.toString(16).padStart(2, "0");
+}
+
+afterEach(async () => {
+	await reset();
+});
+
+describe("EncryptionVerificationWorkflow", () => {
+	it("verifies every directory partition and records the active key proof", async () => {
+		const control = env.SERVICE_CONTROL_DO.getByName(SERVICE_CONTROL_OBJECT_NAME);
+		await control.setServiceMode({
+			actor: ADMIN,
+			idempotencyKey: "encryption-workflow-pause-0001",
+			requestDigest: "P".repeat(43),
+			mode: "publication-paused",
+			reasonCode: "KEY_ROTATION",
+		});
+		await env.PUBLISHER_DO.getByName(PUBLISHER_DID).initializePublisher(PUBLISHER_DID);
+		await env.IDENTITY_DIRECTORY_DO.getByName(await directoryShard(PUBLISHER_DID)).register(
+			"publisher",
+			PUBLISHER_DID,
+		);
+
+		const started = await startEncryptionVerificationWorkflow(
+			env.ENCRYPTION_VERIFICATION_WORKFLOW,
+			{
+				campaignId: "encryption-verification-0001",
+				targetKeyVersion: 1,
+				retiringKeyVersion: null,
+				actorIdentity: ADMIN.identity,
+			},
+		);
+		expect(started).toMatchObject({ ok: true, created: true });
+		if (!started.ok) return;
+		const instance = await env.ENCRYPTION_VERIFICATION_WORKFLOW.get(started.workflowId);
+		let status = await instance.status();
+		for (let attempt = 0; attempt < 2_000 && status.status !== "complete"; attempt += 1) {
+			if (status.status === "errored" || status.status === "terminated") break;
+			await new Promise<void>((resolve) => setTimeout(resolve, 10));
+			status = await instance.status();
+		}
+
+		expect(status.status, JSON.stringify(status.error)).toBe("complete");
+		expect(status.output).toMatchObject({
+			targetKeyVersion: 1,
+			retiringKeyVersion: null,
+			publishers: 1,
+			approvers: 0,
+			records: 0,
+			rotated: 0,
+		});
+		await expect(control.readEncryptionVerification(ADMIN, 1)).resolves.toMatchObject({
+			workflowId: started.workflowId,
+			publishers: 1,
+			approvers: 0,
+		});
+	}, 30_000);
+});
diff --git a/apps/release-service/test/encryption-verification-workflow.v2.ts b/apps/release-service/test/encryption-verification-workflow.v2.ts
new file mode 100644
index 0000000000..1cc00bcbb0
--- /dev/null
+++ b/apps/release-service/test/encryption-verification-workflow.v2.ts
@@ -0,0 +1,110 @@
+import { reset } from "cloudflare:test";
+import { env } from "cloudflare:workers";
+import { afterEach, describe, expect, it } from "vitest";
+
+import type { AccessActor } from "../src/access/auth.js";
+import { loadConfiguration } from "../src/config.js";
+import { SERVICE_CONTROL_OBJECT_NAME } from "../src/control-do/service-control-do.js";
+import { createEnvelopeEncryption } from "../src/crypto/encryption.js";
+import { startEncryptionVerificationWorkflow } from "../src/workflows/encryption-verification.js";
+
+const PUBLISHER_DID = "did:plc:encryption-workflow-v2";
+const KEYRING_V1 =
+	'{"current":1,"keys":[{"version":1,"key":"AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8"}]}';
+const ADMIN = {
+	realm: "access",
+	identity: "admin@example.com",
+	email: "admin@example.com",
+	role: "admin",
+} as const satisfies AccessActor;
+
+async function directoryShard(did: string): Promise<string> {
+	const digest = new Uint8Array(
+		await crypto.subtle.digest("SHA-256", new TextEncoder().encode(did)),
+	);
+	return digest[0]!.toString(16).padStart(2, "0");
+}
+
+afterEach(async () => {
+	await reset();
+});
+
+describe("EncryptionVerificationWorkflow key rotation", () => {
+	it("rotates retained version-one ciphertext and verifies version two", async () => {
+		const control = env.SERVICE_CONTROL_DO.getByName(SERVICE_CONTROL_OBJECT_NAME);
+		await control.setServiceMode({
+			actor: ADMIN,
+			idempotencyKey: "encryption-workflow-v2-pause",
+			requestDigest: "P".repeat(43),
+			mode: "publication-paused",
+			reasonCode: "KEY_ROTATION",
+		});
+		await control.activateEncryptionKey({
+			actor: ADMIN,
+			idempotencyKey: "encryption-workflow-v2-activate",
+			requestDigest: "A".repeat(43),
+			version: 2,
+		});
+		const configuration = await loadConfiguration(env);
+		const context = {
+			purpose: "oauth-session",
+			objectClass: "PublisherDurableObject",
+			table: "delegation",
+			primaryKey: "1",
+			ownerDid: PUBLISHER_DID,
+		} as const;
+		const retained = await createEnvelopeEncryption(KEYRING_V1, configuration.deploymentId).encrypt(
+			new TextEncoder().encode("retained-session"),
+			context,
+		);
+		const publisher = env.PUBLISHER_DO.getByName(PUBLISHER_DID);
+		await publisher.putDelegation({
+			publisherDid: PUBLISHER_DID,
+			releaseNsid: configuration.oauth.releaseNsid,
+			scope: configuration.oauth.releaseScope,
+			clientKeyId: configuration.oauth.activeAssertionKeyId,
+			encryptedSession: retained.envelope,
+			encryptionKeyVersion: retained.keyVersion,
+			issuer: "https://authorization.example.com",
+			pdsUrl: "https://pds.example.com",
+			expiresAt: null,
+			refreshBefore: null,
+			expectedVersion: null,
+		});
+		await env.IDENTITY_DIRECTORY_DO.getByName(await directoryShard(PUBLISHER_DID)).register(
+			"publisher",
+			PUBLISHER_DID,
+		);
+
+		const started = await startEncryptionVerificationWorkflow(
+			env.ENCRYPTION_VERIFICATION_WORKFLOW,
+			{
+				campaignId: "encryption-verification-v2-0001",
+				targetKeyVersion: 2,
+				retiringKeyVersion: 1,
+				actorIdentity: ADMIN.identity,
+			},
+		);
+		expect(started).toMatchObject({ ok: true, created: true });
+		if (!started.ok) return;
+		const instance = await env.ENCRYPTION_VERIFICATION_WORKFLOW.get(started.workflowId);
+		let status = await instance.status();
+		for (let attempt = 0; attempt < 2_000 && status.status !== "complete"; attempt += 1) {
+			if (status.status === "errored" || status.status === "terminated") break;
+			await new Promise<void>((resolve) => setTimeout(resolve, 10));
+			status = await instance.status();
+		}
+
+		expect(status.status, JSON.stringify(status.error)).toBe("complete");
+		expect(status.output).toMatchObject({
+			targetKeyVersion: 2,
+			retiringKeyVersion: 1,
+			publishers: 1,
+			records: 1,
+			rotated: 1,
+		});
+		await expect(publisher.listEncryptionRecords(PUBLISHER_DID, null, 100)).resolves.toMatchObject({
+			items: [{ keyVersion: 2 }],
+		});
+	}, 30_000);
+});
diff --git a/apps/release-service/test/intent-routes.test.ts b/apps/release-service/test/intent-routes.test.ts
index d2f1d3e6d6..5425b5da13 100644
--- a/apps/release-service/test/intent-routes.test.ts
+++ b/apps/release-service/test/intent-routes.test.ts
@@ -10,6 +10,7 @@ import { loadConfiguration } from "../src/config.js";
 import { SERVICE_CONTROL_OBJECT_NAME } from "../src/control-do/service-control-do.js";
 import {
 	handleCancelReleaseIntent,
+	handleDryRunReleaseIntent,
 	handleGetReleaseIntent,
 	handleSubmitReleaseIntent,
 } from "../src/intents/routes.js";
@@ -187,6 +188,111 @@ describe("release intent API", () => {
 		).resolves.toEqual({ intents: 0, reservations: 0 });
 	});
 
+	it("dry-runs admission without reserving, rate limiting, or starting a Workflow", async () => {
+		await putPolicy();
+		const configuration = await loadConfiguration(TEST_BINDINGS);
+		const response = await handleDryRunReleaseIntent(
+			request("/v1/release-intents/dry-run", await token(), {
+				method: "POST",
+				body: {
+					publisherDid: PUBLISHER_DID,
+					packageSlug: "gallery",
+					version: "1.2.3",
+					release: release(),
+				},
+			}),
+			"request-dry-run",
+			configuration,
+			{ keyResolver },
+		);
+
+		expect(response.status).toBe(200);
+		await expect(response.json()).resolves.toMatchObject({
+			data: {
+				allowed: true,
+				publisherDid: PUBLISHER_DID,
+				packageSlug: "gallery",
+				version: "1.2.3",
+				workloadPolicyVersion: 1,
+				workloadIdentityDigest: expect.stringMatching(/^[A-Za-z0-9_-]{43}$/),
+				requestDigest: expect.stringMatching(/^[A-Za-z0-9_-]{43}$/),
+			},
+		});
+		await expect(
+			runInDurableObject(env.PUBLISHER_DO.getByName(PUBLISHER_DID), (_instance, state) =>
+				state.storage.sql
+					.exec<{ intents: number; reservations: number; rate_windows: number }>(
+						`SELECT
+							(SELECT COUNT(*) FROM intents) AS intents,
+							(SELECT COUNT(*) FROM release_reservations) AS reservations,
+							(SELECT COUNT(*) FROM intent_rate_windows) AS rate_windows`,
+					)
+					.one(),
+			),
+		).resolves.toEqual({ intents: 0, reservations: 0, rate_windows: 0 });
+	});
+
+	it("rejects an invalid dry-run source before admission state", async () => {
+		const invalidRelease = release();
+		Object.assign(invalidRelease.artifacts.package, {
+			blob: {
+				$type: "blob",
+				ref: { $link: "bafkreicoew2cifs6fwqhqpkvkezdokuvpquj6p7aosznuf7jhxkehsltpe" },
+				mimeType: "application/gzip",
+				size: 128,
+			},
+		});
+		const response = await handleDryRunReleaseIntent(
+			request("/v1/release-intents/dry-run", await token(), {
+				method: "POST",
+				body: {
+					publisherDid: PUBLISHER_DID,
+					packageSlug: "gallery",
+					version: "1.2.3",
+					release: invalidRelease,
+				},
+			}),
+			"request-invalid-dry-run",
+			await loadConfiguration(TEST_BINDINGS),
+			{ keyResolver },
+		);
+
+		expect(response.status).toBe(400);
+		await expect(response.json()).resolves.toMatchObject({
+			error: { code: "INVALID_REQUEST" },
+		});
+		await expect(
+			runInDurableObject(env.PUBLISHER_DO.getByName(PUBLISHER_DID), (_instance, state) =>
+				state.storage.sql.exec<{ count: number }>("SELECT COUNT(*) AS count FROM publisher").one(),
+			),
+		).resolves.toEqual({ count: 0 });
+	});
+
+	it("does not initialize an unknown publisher shard during dry-run", async () => {
+		const publisherDid = "did:plc:unknownpublisher";
+		const response = await handleDryRunReleaseIntent(
+			request("/v1/release-intents/dry-run", await token(), {
+				method: "POST",
+				body: {
+					publisherDid,
+					packageSlug: "gallery",
+					version: "1.2.3",
+					release: release(),
+				},
+			}),
+			"request-unknown-dry-run",
+			await loadConfiguration(TEST_BINDINGS),
+			{ keyResolver },
+		);
+
+		expect(response.status).toBe(403);
+		await expect(
+			runInDurableObject(env.PUBLISHER_DO.getByName(publisherDid), (_instance, state) =>
+				state.storage.sql.exec<{ count: number }>("SELECT COUNT(*) AS count FROM publisher").one(),
+			),
+		).resolves.toEqual({ count: 0 });
+	});
+
 	it("submits asynchronously, replays with a fresh matching token, and never stores the token", async () => {
 		await putPolicy();
 		const configuration = await loadConfiguration(TEST_BINDINGS);
diff --git a/apps/release-service/test/oauth-routes.test.ts b/apps/release-service/test/oauth-routes.test.ts
index a07698a0bd..5307ecb510 100644
--- a/apps/release-service/test/oauth-routes.test.ts
+++ b/apps/release-service/test/oauth-routes.test.ts
@@ -22,7 +22,6 @@ function cookiePair(setCookie: string): string {
 
 function oauthNetwork() {
 	const requests: Array<{ path: string; body: URLSearchParams }> = [];
-	let issuedScope = "atproto";
 	const fetch: typeof globalThis.fetch = async (input, init) => {
 		const url = new URL(input instanceof Request ? input.url : input.toString());
 		if (url.hostname === "publisher.example.com" && url.pathname === "/.well-known/did.json") {
@@ -71,7 +70,6 @@ function oauthNetwork() {
 			} else if (typeof init?.body === "string") {
 				for (const [key, value] of new URLSearchParams(init.body)) body.append(key, value);
 			}
-			issuedScope = body.get("scope") ?? issuedScope;
 			requests.push({ path: url.pathname, body });
 			return Response.json({
 				request_uri: "urn:ietf:params:oauth:request_uri:test",
@@ -84,7 +82,7 @@ function oauthNetwork() {
 				refresh_token: "refresh-token",
 				token_type: "DPoP",
 				sub: DID,
-				scope: issuedScope,
+				scope: requests.at(-1)?.body.get("scope") ?? "atproto",
 				expires_in: 3600,
 			});
 		}
@@ -177,6 +175,8 @@ describe("publisher OAuth routes", () => {
 		const setCookie = callback.headers.get("set-cookie") ?? "";
 		expect(setCookie).toContain("__Host-emdash_publisher_session=");
 		expect(setCookie).toContain("__Host-emdash_publisher_csrf=");
+		expect(setCookie).toContain("__Host-emdash_approver_session=");
+		expect(setCookie).toContain("__Host-emdash_approver_csrf=");
 		expect(setCookie).toContain("__Host-emdash_oauth_route=");
 		expect(network.requests.some((request) => request.path === "/revoke")).toBe(true);
 		await expect(env.PUBLISHER_DO.getByName(DID).getDelegation(DID)).resolves.toBeNull();
@@ -187,9 +187,57 @@ describe("publisher OAuth routes", () => {
 				10,
 			),
 		).resolves.toEqual([expect.objectContaining({ did: DID, kind: "publisher" })]);
+		await expect(
+			env.IDENTITY_DIRECTORY_DO.getByName(await identityDirectoryShard(DID)).list(
+				"approver",
+				null,
+				10,
+			),
+		).resolves.toEqual([expect.objectContaining({ did: DID, kind: "approver" })]);
 	});
 
-	it("keeps approver identity state and cookies in the approver realm", async () => {
+	it("fails the callback before issuing an app session when directory registration fails", async () => {
+		const network = oauthNetwork();
+		vi.stubGlobal("fetch", network.fetch);
+		const config = await configuration();
+		const start = await handlePublisherIdentityAuthorize(
+			new Request(`${ORIGIN}/v1/publisher/session/authorize`, {
+				method: "POST",
+				headers: {
+					"content-type": "application/json",
+					origin: ORIGIN,
+					"x-emdash-request": "1",
+				},
+				body: JSON.stringify({ identifier: DID, redirectTarget: "/publisher" }),
+			}),
+			"route-start-directory-failure",
+			config,
+		);
+		const routeCookie = cookiePair(start.headers.get("set-cookie") ?? "");
+		const state =
+			network.requests.find((request) => request.path === "/par")?.body.get("state") ?? "";
+
+		const callback = await handleOAuthCallback(
+			new Request(
+				`${ORIGIN}/oauth/callback?code=code-1&state=${encodeURIComponent(state)}&iss=${encodeURIComponent("https://authorization.example")}`,
+				{ headers: { cookie: routeCookie } },
+			),
+			"route-callback-directory-failure",
+			config,
+			{
+				registerDirectoryIdentity: async () => {
+					throw new Error("directory unavailable");
+				},
+			},
+		);
+
+		expect(callback.status).toBe(400);
+		const setCookie = callback.headers.get("set-cookie") ?? "";
+		expect(setCookie).not.toContain("__Host-emdash_publisher_session=");
+		expect(setCookie).not.toContain("__Host-emdash_publisher_csrf=");
+	});
+
+	it("establishes both account sessions from approver identity", async () => {
 		const network = oauthNetwork();
 		vi.stubGlobal("fetch", network.fetch);
 		const config = await configuration();
@@ -225,7 +273,8 @@ describe("publisher OAuth routes", () => {
 		const setCookie = callback.headers.get("set-cookie") ?? "";
 		expect(setCookie).toContain("__Host-emdash_approver_session=");
 		expect(setCookie).toContain("__Host-emdash_approver_csrf=");
-		expect(setCookie).not.toContain("__Host-emdash_publisher_session=");
+		expect(setCookie).toContain("__Host-emdash_publisher_session=");
+		expect(setCookie).toContain("__Host-emdash_publisher_csrf=");
 		await expect(env.APPROVER_DO.getByName(DID).listCredentials(DID, null, 10)).resolves.toEqual(
 			[],
 		);
@@ -236,6 +285,13 @@ describe("publisher OAuth routes", () => {
 				10,
 			),
 		).resolves.toEqual([expect.objectContaining({ did: DID, kind: "approver" })]);
+		await expect(
+			env.IDENTITY_DIRECTORY_DO.getByName(await identityDirectoryShard(DID)).list(
+				"publisher",
+				null,
+				10,
+			),
+		).resolves.toEqual([expect.objectContaining({ did: DID, kind: "publisher" })]);
 	});
 
 	it("keeps attacker-triggerable publisher authorization state out of the publisher shard", async () => {
@@ -367,13 +423,13 @@ describe("publisher OAuth routes", () => {
 		expect(par?.body.get("scope")).not.toContain("transition:generic");
 	});
 
-	it("completes delegation callback into the publisher custody shard", async () => {
+	it("completes delegation callback after directory registration", async () => {
 		const network = oauthNetwork();
 		vi.stubGlobal("fetch", network.fetch);
 		const config = await configuration();
 		const session = await createPublisherApplicationSession(env.PUBLISHER_DO, DID);
 		const sessionCookies = session.setCookieHeaders.map(cookiePair);
-		const csrf = cookiePair(session.setCookieHeaders[1]).split("=", 2)[1] ?? "";
+		const csrf = sessionCookies[1]?.split("=", 2)[1] ?? "";
 		const start = await handlePublisherDelegationAuthorize(
 			new Request(`${ORIGIN}/v1/publisher/delegation/authorize`, {
 				method: "POST",
@@ -400,6 +456,7 @@ describe("publisher OAuth routes", () => {
 			),
 			"delegation-callback",
 			config,
+			{ registerDirectoryIdentity: async () => ({ shard: "00", created: true }) },
 		);
 
 		expect(callback.status).toBe(303);
@@ -411,26 +468,73 @@ describe("publisher OAuth routes", () => {
 		});
 	});
 
-	it("rejects callback state substitution and clears the routing cookie", async () => {
+	it("does not retain delegated authority when directory registration fails", async () => {
+		const network = oauthNetwork();
+		vi.stubGlobal("fetch", network.fetch);
 		const config = await configuration();
-		const created = await createPublisherApplicationSession(env.PUBLISHER_DO, DID);
-		const errorLog = vi.spyOn(console, "error").mockImplementation(() => {});
-		const response = await handleOAuthCallback(
-			new Request(`${ORIGIN}/oauth/callback?state=unknown-state-value`, {
-				headers: { cookie: created.setCookieHeaders.map(cookiePair).join("; ") },
+		const session = await createPublisherApplicationSession(env.PUBLISHER_DO, DID);
+		const sessionCookies = session.setCookieHeaders.map(cookiePair);
+		const csrf = sessionCookies[1]?.split("=", 2)[1] ?? "";
+		const start = await handlePublisherDelegationAuthorize(
+			new Request(`${ORIGIN}/v1/publisher/delegation/authorize`, {
+				method: "POST",
+				headers: {
+					"content-type": "application/json",
+					cookie: sessionCookies.join("; "),
+					origin: ORIGIN,
+					"x-emdash-request": "1",
+					"x-emdash-csrf": csrf,
+				},
+				body: JSON.stringify({ redirectTarget: "/publisher" }),
 			}),
-			"bad-callback",
+			"delegation-directory-start",
 			config,
 		);
-		expect(response.status).toBe(400);
-		expect(response.headers.get("set-cookie")).toContain("__Host-emdash_oauth_route=");
-		expect(await response.text()).not.toContain("unknown-state-value");
-		expect(errorLog).toHaveBeenCalledWith(
-			expect.stringContaining('"event":"oauth_callback_error"'),
-		);
-		expect(errorLog).toHaveBeenCalledWith(
-			expect.stringContaining('"code":"PUBLISHER_SESSION_INVALID"'),
+		const routeCookie = cookiePair(start.headers.get("set-cookie") ?? "");
+		const state =
+			network.requests.find((request) => request.path === "/par")?.body.get("state") ?? "";
+
+		const callback = await handleOAuthCallback(
+			new Request(
+				`${ORIGIN}/oauth/callback?code=code-1&state=${encodeURIComponent(state)}&iss=${encodeURIComponent("https://authorization.example")}`,
+				{ headers: { cookie: [...sessionCookies, routeCookie].join("; ") } },
+			),
+			"delegation-directory-callback",
+			config,
+			{
+				registerDirectoryIdentity: async () => {
+					throw new Error("directory unavailable");
+				},
+			},
 		);
-		errorLog.mockRestore();
+
+		expect(callback.status).toBe(400);
+		await expect(env.PUBLISHER_DO.getByName(DID).getDelegation(DID)).resolves.toBeNull();
+	});
+
+	it("rejects callback state substitution and clears the routing cookie", async () => {
+		const config = await configuration();
+		const created = await createPublisherApplicationSession(env.PUBLISHER_DO, DID);
+		const errorLog = vi.spyOn(console, "error").mockImplementation(() => {});
+		try {
+			const response = await handleOAuthCallback(
+				new Request(`${ORIGIN}/oauth/callback?state=unknown-state-value`, {
+					headers: { cookie: created.setCookieHeaders.map(cookiePair).join("; ") },
+				}),
+				"bad-callback",
+				config,
+			);
+			expect(response.status).toBe(400);
+			expect(response.headers.get("set-cookie")).toContain("__Host-emdash_oauth_route=");
+			expect(await response.text()).not.toContain("unknown-state-value");
+			expect(errorLog).toHaveBeenCalledWith(
+				expect.stringContaining('"event":"oauth_callback_error"'),
+			);
+			expect(errorLog).toHaveBeenCalledWith(
+				expect.stringContaining('"code":"PUBLISHER_SESSION_INVALID"'),
+			);
+		} finally {
+			errorLog.mockRestore();
+		}
 	});
 });
diff --git a/apps/release-service/test/publisher-archive-routes.test.ts b/apps/release-service/test/publisher-archive-routes.test.ts
index 441deab696..936853cb5a 100644
--- a/apps/release-service/test/publisher-archive-routes.test.ts
+++ b/apps/release-service/test/publisher-archive-routes.test.ts
@@ -1,6 +1,6 @@
 import { abortAllDurableObjects, reset, runInDurableObject } from "cloudflare:test";
 import { env } from "cloudflare:workers";
-import { afterEach, describe, expect, it } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
 
 import type { AccessActor } from "../src/access/auth.js";
 import {
@@ -74,10 +74,35 @@ function maximalCanonicalObject(maxChars: number): string {
 }
 
 afterEach(async () => {
+	vi.restoreAllMocks();
 	await reset();
 });
 
 describe("publisher operations archive", () => {
+	it("rejects an oversized conflicting snapshot without reading its body", async () => {
+		const configuration = await loadConfiguration(TEST_BINDINGS);
+		const text = vi.fn(async () => {
+			throw new Error("oversized body must not be read");
+		});
+		// @ts-expect-error - conditional R2 writes return null when the precondition fails
+		vi.spyOn(env.OPERATIONS_ARCHIVE, "put").mockResolvedValue(null);
+		vi.spyOn(env.OPERATIONS_ARCHIVE, "get").mockResolvedValue({
+			size: 1_500_001,
+			text,
+		} as unknown as R2ObjectBody);
+
+		const response = await handleArchivePublisher(
+			request(null, 0),
+			"oversized-conflict",
+			configuration,
+			{ publisherDid: PUBLISHER_DID },
+			ADMIN,
+		);
+
+		expect(response.status).toBe(409);
+		expect(text).not.toHaveBeenCalled();
+	});
+
 	it("writes resumable encrypted snapshots and append-only sanitized audit pages", async () => {
 		const configuration = await loadConfiguration(TEST_BINDINGS);
 		const publisher = env.PUBLISHER_DO.getByName(PUBLISHER_DID);
diff --git a/apps/release-service/test/publisher-archive-workflow.test.ts b/apps/release-service/test/publisher-archive-workflow.test.ts
index fd127f8303..342ec5631d 100644
--- a/apps/release-service/test/publisher-archive-workflow.test.ts
+++ b/apps/release-service/test/publisher-archive-workflow.test.ts
@@ -1,6 +1,6 @@
 import { reset } from "cloudflare:test";
 import { env } from "cloudflare:workers";
-import { afterEach, describe, expect, it } from "vitest";
+import { afterEach, describe, expect, it, vi } from "vitest";
 
 import type { AccessActor } from "../src/access/auth.js";
 import { handleStartPublisherArchive } from "../src/backup/workflow-route.js";
@@ -55,6 +55,28 @@ describe("PublisherArchiveWorkflow", () => {
 		});
 	});
 
+	it("restarts an errored deterministic archive instance", async () => {
+		const restart = vi.fn(async () => undefined);
+		const workflow = {
+			create: vi.fn(async () => {
+				throw new Error("instance already exists");
+			}),
+			get: vi.fn(async () => ({
+				status: async () => ({ status: "errored" }),
+				restart,
+			})),
+		} as unknown as Parameters<typeof startPublisherArchiveWorkflow>[0];
+
+		await expect(
+			startPublisherArchiveWorkflow(workflow, {
+				publisherDid: PUBLISHER_DID,
+				archiveId: ARCHIVE_ID,
+				actorIdentity: "admin@example.com",
+			}),
+		).resolves.toMatchObject({ ok: true, created: false });
+		expect(restart).toHaveBeenCalledOnce();
+	});
+
 	it("resumes bounded pages to an encrypted completion manifest", async () => {
 		await env.PUBLISHER_DO.getByName(PUBLISHER_DID).initializePublisher(PUBLISHER_DID);
 		const started = await startPublisherArchiveWorkflow(env.PUBLISHER_ARCHIVE_WORKFLOW, {
diff --git a/apps/release-service/test/publisher-do.test.ts b/apps/release-service/test/publisher-do.test.ts
index a756065e82..6ca5dbf859 100644
--- a/apps/release-service/test/publisher-do.test.ts
+++ b/apps/release-service/test/publisher-do.test.ts
@@ -1,4 +1,9 @@
-import { abortAllDurableObjects, reset, runInDurableObject } from "cloudflare:test";
+import {
+	abortAllDurableObjects,
+	reset,
+	runDurableObjectAlarm,
+	runInDurableObject,
+} from "cloudflare:test";
 import { env } from "cloudflare:workers";
 import { afterEach, describe, expect, it } from "vitest";
 
@@ -75,6 +80,31 @@ describe("PublisherDurableObject", () => {
 		await expect(stub.revokePublisherSession(DID, secondHash)).resolves.toBe(false);
 	});
 
+	it("limits active publisher sessions per shard", async () => {
+		const stub = publisher();
+		const now = 1_800_000_000_000;
+		for (let index = 0; index < 20; index += 1) {
+			await expect(
+				stub.createPublisherSession({
+					publisherDid: DID,
+					tokenHash: String(index).padStart(43, "A"),
+					csrfHash: SESSION_CSRF_HASH,
+					expiresAt: now + 60_000,
+					now,
+				}),
+			).resolves.toMatchObject({ ok: true });
+		}
+		await expect(
+			stub.createPublisherSession({
+				publisherDid: DID,
+				tokenHash: "Z".repeat(43),
+				csrfHash: SESSION_CSRF_HASH,
+				expiresAt: now + 60_000,
+				now,
+			}),
+		).resolves.toEqual({ ok: false, code: "PUBLISHER_SESSION_LIMIT_REACHED" });
+	});
+
 	it("invalidates all publisher sessions by epoch and blocks suspended publishers", async () => {
 		const stub = publisher();
 		const now = 1_800_000_000_000;
@@ -104,6 +134,75 @@ describe("PublisherDurableObject", () => {
 		).resolves.toEqual({ ok: false, code: "PUBLISHER_SUSPENDED" });
 	});
 
+	it("schedules one alarm for publisher state expiry and expires pending intents", async () => {
+		const stub = publisher();
+		const now = Date.now();
+		await stub.putWorkloadPolicy({
+			publisherDid: DID,
+			packageSlug: "gallery",
+			repository: "example/gallery",
+			repositoryId: "123",
+			repositoryOwnerId: "456",
+			workflowRef: "example/gallery/.github/workflows/release.yml@refs/heads/main",
+			allowedRefs: [],
+			allowedEnvironments: [],
+			active: true,
+			expectedVersion: null,
+			now,
+		});
+		await stub.createPublisherSession({
+			publisherDid: DID,
+			tokenHash: SESSION_TOKEN_HASH,
+			csrfHash: SESSION_CSRF_HASH,
+			expiresAt: now + 40_000,
+			now,
+		});
+		await stub.putOAuthState({
+			publisherDid: DID,
+			stateHash: STATE_HASH,
+			encryptedState: "encrypted-oauth-state",
+			encryptionKeyVersion: 2,
+			encryptionPurpose: "oauth-console-transaction",
+			clientKeyId: "assertion-1",
+			redirectTarget: "/publisher",
+			expiresAt: now + 30_000,
+			now,
+		});
+		await stub.createIntent({
+			publisherDid: DID,
+			intentId: "01JABCDEFGHJKMNPQRSTVWXYZ0",
+			packageSlug: "gallery",
+			version: "1.2.3",
+			workloadPolicyVersion: 1,
+			workloadIdentityDigest: "A".repeat(43),
+			workloadIdempotencyDigest: "I".repeat(43),
+			idempotencyKey: "publisher-alarm-intent-0001",
+			requestDigest: "B".repeat(43),
+			workloadIdentityJson: '{"issuer":"github-actions"}',
+			releaseInputJson: '{"release":{"package":"gallery","version":"1.2.3"}}',
+			expiresAt: now + 20_000,
+			now,
+		});
+
+		await expect(
+			runInDurableObject(stub, (_instance, state) => state.storage.getAlarm()),
+		).resolves.toBe(now + 20_000);
+		await runInDurableObject(stub, (_instance, state) => {
+			state.storage.sql.exec("UPDATE intents SET expires_at = ?", now - 1);
+			state.storage.sql.exec("UPDATE oauth_states SET expires_at = ?", now - 1);
+			state.storage.sql.exec("UPDATE publisher_sessions SET expires_at = ?", now - 1);
+		});
+		await runDurableObjectAlarm(stub);
+
+		await expect(stub.getIntent(DID, "01JABCDEFGHJKMNPQRSTVWXYZ0")).resolves.toMatchObject({
+			state: "expired",
+		});
+		await expect(stub.consumeOAuthState(DID, STATE_HASH, now)).resolves.toBeNull();
+		await expect(
+			stub.validatePublisherSession(DID, SESSION_TOKEN_HASH, null, now),
+		).resolves.toEqual({ ok: false, code: "PUBLISHER_SESSION_INVALID" });
+	});
+
 	it("isolates publisher, repository, and workload admission budgets", async () => {
 		const stub = publisher();
 		const now = 1_800_000_000_000;
@@ -338,10 +437,42 @@ describe("PublisherDurableObject", () => {
 						redirectTarget,
 						expiresAt: Date.now() + 60_000,
 					}),
-				).rejects.toEqual(expect.objectContaining({ code: "OAUTH_STATE_INVALID" }));
+				).rejects.toMatchObject({ code: "OAUTH_STATE_INVALID" });
 			});
 		},
 	);
+	it("limits active publisher OAuth states per shard", async () => {
+		const stub = publisher();
+		const now = 1_800_000_000_000;
+		for (let index = 0; index < 20; index += 1) {
+			await expect(
+				stub.putOAuthState({
+					publisherDid: DID,
+					stateHash: String(index).padStart(43, "a"),
+					encryptedState: "encrypted-oauth-state",
+					encryptionKeyVersion: 2,
+					encryptionPurpose: "oauth-console-transaction",
+					clientKeyId: "assertion-1",
+					redirectTarget: "/publisher",
+					expiresAt: now + 60_000,
+					now,
+				}),
+			).resolves.toEqual({ ok: true });
+		}
+		await expect(
+			stub.putOAuthState({
+				publisherDid: DID,
+				stateHash: "Z".repeat(43),
+				encryptedState: "encrypted-oauth-state",
+				encryptionKeyVersion: 2,
+				encryptionPurpose: "oauth-console-transaction",
+				clientKeyId: "assertion-1",
+				redirectTarget: "/publisher",
+				expiresAt: now + 60_000,
+				now,
+			}),
+		).resolves.toEqual({ ok: false, code: "OAUTH_STATE_LIMIT_REACHED" });
+	});
 
 	it("rejects duplicate state and deletes expired state on consume", async () => {
 		const stub = publisher();
@@ -394,7 +525,8 @@ describe("PublisherDurableObject", () => {
 		await stub.putDelegation({
 			publisherDid: DID,
 			releaseNsid: "com.emdashcms.experimental.package.release",
-			scope: "atproto repo:com.emdashcms.experimental.package.release?action=create",
+			scope:
+				"atproto repo:com.emdashcms.experimental.package.release?action=create blob:application/gzip blob:image/*",
 			clientKeyId: "assertion-1",
 			encryptedSession: "delegation-ciphertext-v2",
 			...DELEGATION_METADATA,
diff --git a/apps/release-service/test/publisher-routes.test.ts b/apps/release-service/test/publisher-routes.test.ts
index 8a5898a241..fe971f6bb2 100644
--- a/apps/release-service/test/publisher-routes.test.ts
+++ b/apps/release-service/test/publisher-routes.test.ts
@@ -6,11 +6,14 @@ import { loadConfiguration } from "../src/config.js";
 import { createPublisherApplicationSession } from "../src/publisher-session/session.js";
 import {
 	handleDisablePublisherWorkload,
+	handleGetPublisherApproverStatus,
 	handleGetPublisher,
+	handleListPublisherAudit,
 	handleListPublisherIntents,
 	handleListPublisherWorkloads,
 	handlePutPublisherWorkload,
 	handleRevokePublisherDelegation,
+	matchPublisherApproverStatusPath,
 } from "../src/publisher/routes.js";
 import { TEST_BINDINGS } from "./fixtures/oauth.js";
 
@@ -85,6 +88,17 @@ describe("publisher API", () => {
 			request("/v1/publisher", headers),
 			"request-1",
 			configuration,
+			{
+				actorResolver: {
+					async resolve() {
+						return {
+							did: PUBLISHER_DID,
+							handle: "publisher.example.com",
+							pds: "https://pds.example.com",
+						};
+					},
+				},
+			},
 		);
 		expect(response.status).toBe(200);
 		const value = await response.json();
@@ -92,6 +106,7 @@ describe("publisher API", () => {
 			data: {
 				publisher: {
 					did: PUBLISHER_DID,
+					handle: "publisher.example.com",
 					delegation: { status: "active", stateVersion: 1 },
 				},
 			},
@@ -146,6 +161,82 @@ describe("publisher API", () => {
 		});
 	});
 
+	it("compares signed approvers without exposing credential metadata", async () => {
+		const configuration = await loadConfiguration(TEST_BINDINGS);
+		const enrolledDid = "did:plc:enrolled-approver";
+		const missingDid = "did:plc:missing-approver";
+		const revokedDid = "did:plc:revoked-approver";
+		await env.PUBLISHER_DO.getByName(PUBLISHER_DID).putWorkloadPolicy({
+			publisherDid: PUBLISHER_DID,
+			...policyBody(),
+			active: true,
+			now: NOW,
+		});
+		await env.APPROVER_DO.getByName(enrolledDid).enrolCredential(enrolledDid, {
+			credentialId: "publisher-visible-status",
+			publicKey: new Uint8Array([1, 2, 3]),
+			algorithm: -7,
+			counter: 0,
+			transports: ["internal"],
+			name: "Private credential name",
+			now: NOW + 1,
+		});
+		await env.APPROVER_DO.getByName(revokedDid).enrolCredential(revokedDid, {
+			credentialId: "revoked-publisher-status",
+			publicKey: new Uint8Array([4, 5, 6]),
+			algorithm: -7,
+			counter: 0,
+			transports: ["internal"],
+			name: "Revoked private credential",
+			now: NOW + 1,
+		});
+		await env.APPROVER_DO.getByName(revokedDid).revokeCredential(
+			revokedDid,
+			"revoked-publisher-status",
+			NOW + 2,
+		);
+		const params = matchPublisherApproverStatusPath("/v1/publisher/workloads/gallery/approvers");
+		expect(params).toEqual({ packageSlug: "gallery" });
+
+		const response = await handleGetPublisherApproverStatus(
+			request("/v1/publisher/workloads/gallery/approvers", await sessionHeaders()),
+			"request-approvers",
+			configuration,
+			params!,
+			{
+				loadCurrentApprovalPolicy: async () => ({
+					profileCid: "bafyprofile",
+					approverDids: [enrolledDid, missingDid, revokedDid],
+				}),
+				actorResolver: {
+					async resolve(identifier) {
+						return {
+							did: identifier as `did:${string}:${string}`,
+							handle: `${identifier.split(":").at(-1)}.example.com` as `${string}.${string}`,
+							pds: "https://pds.example.com",
+						};
+					},
+				},
+			},
+		);
+
+		expect(response.status).toBe(200);
+		const body = await response.json();
+		expect(body).toMatchObject({
+			data: { packageSlug: "gallery", profileCid: "bafyprofile" },
+		});
+		if (typeof body !== "object" || body === null) throw new Error("Expected response object");
+		const data = Reflect.get(body, "data");
+		if (typeof data !== "object" || data === null) throw new Error("Expected response data");
+		expect(Reflect.get(data, "items")).toEqual([
+			{ did: enrolledDid, handle: "enrolled-approver.example.com", status: "enrolled" },
+			{ did: missingDid, handle: "missing-approver.example.com", status: "not_enrolled" },
+			{ did: revokedDid, handle: "revoked-approver.example.com", status: "revoked" },
+		]);
+		expect(JSON.stringify(body)).not.toContain("Private credential name");
+		expect(JSON.stringify(body)).not.toContain("publisher-visible-status");
+	});
+
 	it("lists only intents from the authenticated publisher shard", async () => {
 		const configuration = await loadConfiguration(TEST_BINDINGS);
 		const publisher = env.PUBLISHER_DO.getByName(PUBLISHER_DID);
@@ -182,6 +273,64 @@ describe("publisher API", () => {
 		});
 	});
 
+	it("accepts the maximum page size for workload and intent lists", async () => {
+		const configuration = await loadConfiguration(TEST_BINDINGS);
+		const headers = await sessionHeaders();
+		const workloads = await handleListPublisherWorkloads(
+			request("/v1/publisher/workloads?limit=100", headers),
+			"request-workloads",
+			configuration,
+		);
+		const intents = await handleListPublisherIntents(
+			request("/v1/publisher/intents?limit=100", headers),
+			"request-intents",
+			configuration,
+		);
+
+		expect(workloads.status).toBe(200);
+		expect(await workloads.json()).toMatchObject({ data: { items: [] } });
+		expect(intents.status).toBe(200);
+		expect(await intents.json()).toMatchObject({ data: { items: [] } });
+	});
+
+	it("paginates the authenticated publisher audit without private payloads", async () => {
+		const configuration = await loadConfiguration(TEST_BINDINGS);
+		await sessionHeaders();
+		const response = await handleListPublisherAudit(
+			request("/v1/publisher/audit?limit=1", await sessionHeaders()),
+			"request-audit",
+			configuration,
+			{
+				actorResolver: {
+					async resolve() {
+						return {
+							did: PUBLISHER_DID,
+							handle: "publisher.example.com",
+							pds: "https://pds.example.com",
+						};
+					},
+				},
+			},
+		);
+
+		expect(response.status).toBe(200);
+		const body = await response.json();
+		expect(body).toMatchObject({
+			data: {
+				items: [
+					{
+						sequence: 1,
+						eventType: "publisher-session-created",
+						actorHandle: "publisher.example.com",
+					},
+				],
+				nextCursor: "1",
+			},
+		});
+		expect(JSON.stringify(body)).not.toContain("csrf");
+		expect(JSON.stringify(body)).not.toContain("publicPayloadJson");
+	});
+
 	it("revokes retained authority idempotently without exposing OAuth errors", async () => {
 		const configuration = await loadConfiguration(TEST_BINDINGS);
 		const publisher = env.PUBLISHER_DO.getByName(PUBLISHER_DID);
diff --git a/apps/release-service/test/release-intent-workflow.test.ts b/apps/release-service/test/release-intent-workflow.test.ts
index 287dc93d55..7e0269e419 100644
--- a/apps/release-service/test/release-intent-workflow.test.ts
+++ b/apps/release-service/test/release-intent-workflow.test.ts
@@ -1132,6 +1132,72 @@ describe("ReleaseIntentWorkflow", () => {
 		expect(operation.lease_ms).toBe(5 * 60_000);
 	});
 
+	it("expires a ready intent instead of publishing it after a pause", async () => {
+		let paused = false;
+		let createAttempts = 0;
+		vi.stubGlobal(
+			"fetch",
+			workflowNetwork({
+				onAuthorizationMetadata: async () => {
+					if (paused) return;
+					paused = true;
+					await env.SERVICE_CONTROL_DO.getByName(SERVICE_CONTROL_OBJECT_NAME).setServiceMode({
+						actor: CONTROL_ACTOR,
+						idempotencyKey: "publication-expiry-pause",
+						requestDigest: "E".repeat(43),
+						mode: "publication-paused",
+						reasonCode: "TEST_PAUSE",
+					});
+				},
+				onCreateRecord: () => {
+					createAttempts += 1;
+					return Response.json({ uri: CREATED_URI, cid: CREATED_CID });
+				},
+			}),
+		);
+		await createVerifyingIntent();
+		await using introspector = await introspectWorkflowInstance(
+			env.RELEASE_INTENT_WORKFLOW,
+			INTENT_ID,
+		);
+		await env.RELEASE_INTENT_WORKFLOW.create({
+			id: INTENT_ID,
+			params: { publisherDid: PUBLISHER_DID, intentId: INTENT_ID },
+		});
+		await introspector.waitForStatus("complete");
+		await runInDurableObject(env.PUBLISHER_DO.getByName(PUBLISHER_DID), (_instance, state) => {
+			state.storage.sql.exec(
+				"UPDATE intents SET expires_at = ? WHERE id = ?",
+				Date.now() - 1,
+				INTENT_ID,
+			);
+		});
+		await env.SERVICE_CONTROL_DO.getByName(SERVICE_CONTROL_OBJECT_NAME).setServiceMode({
+			actor: CONTROL_ACTOR,
+			idempotencyKey: "publication-expiry-active",
+			requestDigest: "F".repeat(43),
+			mode: "active",
+			reasonCode: null,
+		});
+
+		await expect(
+			restartReleaseIntentWorkflow(
+				env.RELEASE_INTENT_WORKFLOW,
+				env.PUBLISHER_DO,
+				PUBLISHER_DID,
+				INTENT_ID,
+			),
+		).resolves.toEqual({ ok: true, workflowId: INTENT_ID, restarted: true });
+		await introspector.waitForStepResult({ name: "recovery-policy-decision" });
+		await introspector.waitForStatus("complete");
+		await expect(introspector.getOutput()).resolves.toEqual({
+			intentId: INTENT_ID,
+			state: "expired",
+			reasonCode: "INTENT_EXPIRED",
+		});
+		expect(createAttempts).toBe(0);
+	});
+
 	it("restarts an errored reconciliation and accepts the exact authoritative record", async () => {
 		let reconciliationAvailable = false;
 		let sourceAvailable = true;
diff --git a/apps/release-service/test/service-control-do.test.ts b/apps/release-service/test/service-control-do.test.ts
index 382db8df7a..e8528b3dec 100644
--- a/apps/release-service/test/service-control-do.test.ts
+++ b/apps/release-service/test/service-control-do.test.ts
@@ -5,6 +5,7 @@ import { afterEach, describe, expect, it } from "vitest";
 import type { AccessActor } from "../src/access/auth.js";
 import {
 	SERVICE_CONTROL_OBJECT_NAME,
+	type ActivateEncryptionKeyInput,
 	type SetServiceModeInput,
 } from "../src/control-do/service-control-do.js";
 
@@ -39,6 +40,19 @@ function modeInput(overrides: Partial<SetServiceModeInput> = {}): SetServiceMode
 	};
 }
 
+function activationInput(
+	overrides: Partial<ActivateEncryptionKeyInput> = {},
+): ActivateEncryptionKeyInput {
+	return {
+		actor: ADMIN,
+		idempotencyKey: "encryption-key-activation-0001",
+		requestDigest: "K".repeat(43),
+		version: 2,
+		now: NOW + 1,
+		...overrides,
+	};
+}
+
 afterEach(async () => {
 	await reset();
 });
@@ -102,6 +116,87 @@ describe("ServiceControlDurableObject", () => {
 		});
 	});
 
+	it("activates and retires key versions only while publication is paused", async () => {
+		const stub = control();
+		await expect(stub.readEncryptionKeys(VIEWER)).resolves.toEqual([
+			{
+				version: 1,
+				status: "active",
+				activatedAt: 0,
+				retiredAt: null,
+				changedBy: "system:bootstrap",
+				updatedAt: 0,
+			},
+		]);
+		await runInDurableObject(stub, async (instance) => {
+			await expect(instance.activateEncryptionKey(activationInput())).rejects.toMatchObject({
+				code: "CONTROL_INPUT_INVALID",
+			});
+		});
+
+		await stub.setServiceMode(modeInput());
+		const activated = await stub.activateEncryptionKey(activationInput());
+		expect(activated).toMatchObject({
+			ok: true,
+			replayed: false,
+			value: { version: 2, status: "active", activatedAt: NOW + 1 },
+		});
+		await expect(stub.activateEncryptionKey(activationInput())).resolves.toEqual({
+			...activated,
+			replayed: true,
+		});
+		await expect(stub.readEncryptionKeys(VIEWER)).resolves.toMatchObject([
+			{ version: 1, status: "readable" },
+			{ version: 2, status: "active" },
+		]);
+		await expect(
+			stub.recordEncryptionVerification({
+				targetKeyVersion: 2,
+				workflowId: "V".repeat(43),
+				actorIdentity: "release-service",
+				publishers: 3,
+				approvers: 2,
+				records: 8,
+				rotated: 5,
+				verifiedAt: NOW + 1,
+			}),
+		).resolves.toMatchObject({ targetKeyVersion: 2, records: 8, rotated: 5 });
+		await expect(stub.readEncryptionVerification(VIEWER, 2)).resolves.toMatchObject({
+			workflowId: "V".repeat(43),
+			publishers: 3,
+			approvers: 2,
+		});
+		await runInDurableObject(stub, async (instance) => {
+			await expect(
+				instance.retireEncryptionKey({
+					...activationInput({
+						idempotencyKey: "encryption-key-retirement-0001",
+						requestDigest: "R".repeat(43),
+					}),
+					version: 2,
+				}),
+			).rejects.toMatchObject({ code: "CONTROL_INPUT_INVALID" });
+		});
+		await expect(
+			stub.retireEncryptionKey({
+				...activationInput({
+					idempotencyKey: "encryption-key-retirement-0002",
+					requestDigest: "S".repeat(43),
+				}),
+				version: 1,
+			}),
+		).resolves.toMatchObject({
+			ok: true,
+			value: { version: 1, status: "retired", retiredAt: NOW + 1 },
+		});
+		await expect(stub.listAudit(VIEWER)).resolves.toEqual(
+			expect.arrayContaining([
+				expect.objectContaining({ eventType: "encryption-key-activated", subject: "2" }),
+				expect.objectContaining({ eventType: "encryption-key-retired", subject: "1" }),
+			]),
+		);
+	});
+
 	it("rejects insufficient operators and incomplete pause reasons", async () => {
 		const stub = control();
 
@@ -127,7 +222,7 @@ describe("ServiceControlDurableObject", () => {
 			mode: "admission-paused",
 			code: "ADMISSION_PAUSED",
 		});
-		const admittedPermit = await stub.issuePublicationPermit(DID, INTENT_ID, 5_000, NOW + 1);
+		const admittedPermit = await stub.issuePublicationPermit(DID, INTENT_ID, 5_000, 1, NOW + 1);
 		expect(admittedPermit).toMatchObject({ ok: true, permit: { modeEpoch: 2 } });
 
 		await stub.setServiceMode(
@@ -143,7 +238,7 @@ describe("ServiceControlDurableObject", () => {
 			mode: "publication-paused",
 			code: null,
 		});
-		await expect(stub.issuePublicationPermit(DID, INTENT_ID, 5_000, NOW + 3)).resolves.toEqual({
+		await expect(stub.issuePublicationPermit(DID, INTENT_ID, 5_000, 1, NOW + 3)).resolves.toEqual({
 			ok: false,
 			code: "PUBLICATION_PAUSED",
 		});
@@ -151,7 +246,11 @@ describe("ServiceControlDurableObject", () => {
 
 	it("issues a bound permit that can be consumed exactly once", async () => {
 		const stub = control();
-		const issued = await stub.issuePublicationPermit(DID, INTENT_ID, 5_000, NOW);
+		await expect(stub.issuePublicationPermit(DID, INTENT_ID, 5_000, 2, NOW)).resolves.toEqual({
+			ok: false,
+			code: "ENCRYPTION_KEY_INACTIVE",
+		});
+		const issued = await stub.issuePublicationPermit(DID, INTENT_ID, 5_000, 1, NOW);
 		expect(issued.ok).toBe(true);
 		if (!issued.ok) return;
 
@@ -178,7 +277,7 @@ describe("ServiceControlDurableObject", () => {
 
 	it("invalidates a cached permit when the service mode epoch changes", async () => {
 		const stub = control();
-		const issued = await stub.issuePublicationPermit(DID, INTENT_ID, 5_000, NOW);
+		const issued = await stub.issuePublicationPermit(DID, INTENT_ID, 5_000, 1, NOW);
 		expect(issued.ok).toBe(true);
 		if (!issued.ok) return;
 		await stub.setServiceMode(
@@ -192,7 +291,7 @@ describe("ServiceControlDurableObject", () => {
 
 	it("suspends publisher admission and invalidates outstanding permits", async () => {
 		const stub = control();
-		const issued = await stub.issuePublicationPermit(DID, INTENT_ID, 5_000, NOW);
+		const issued = await stub.issuePublicationPermit(DID, INTENT_ID, 5_000, 1, NOW);
 		expect(issued.ok).toBe(true);
 		if (!issued.ok) return;
 
@@ -214,7 +313,7 @@ describe("ServiceControlDurableObject", () => {
 			allowed: false,
 			code: "PUBLISHER_SUSPENDED",
 		});
-		await expect(stub.issuePublicationPermit(DID, "intent-2", 5_000, NOW + 2)).resolves.toEqual({
+		await expect(stub.issuePublicationPermit(DID, "intent-2", 5_000, 1, NOW + 2)).resolves.toEqual({
 			ok: false,
 			code: "PUBLISHER_SUSPENDED",
 		});
@@ -225,7 +324,7 @@ describe("ServiceControlDurableObject", () => {
 
 	it("never persists a plaintext permit token", async () => {
 		const stub = control();
-		const issued = await stub.issuePublicationPermit(DID, INTENT_ID, 5_000, NOW);
+		const issued = await stub.issuePublicationPermit(DID, INTENT_ID, 5_000, 1, NOW);
 		expect(issued.ok).toBe(true);
 		if (!issued.ok) return;
 
@@ -247,7 +346,7 @@ describe("ServiceControlDurableObject", () => {
 	it("cleans expired permits and operator idempotency with its alarm", async () => {
 		const stub = control();
 		const oldNow = Date.now() - 24 * 60 * 60_000 - 1_000;
-		await stub.issuePublicationPermit(DID, INTENT_ID, 1, oldNow);
+		await stub.issuePublicationPermit(DID, INTENT_ID, 1, 1, oldNow);
 		await stub.setServiceMode(
 			modeInput({
 				mode: "admission-paused",
diff --git a/apps/release-service/test/workflow-pairing-routes.test.ts b/apps/release-service/test/workflow-pairing-routes.test.ts
new file mode 100644
index 0000000000..0c6b7012a3
--- /dev/null
+++ b/apps/release-service/test/workflow-pairing-routes.test.ts
@@ -0,0 +1,191 @@
+import { reset } from "cloudflare:test";
+import { env } from "cloudflare:workers";
+import { createLocalJWKSet, exportJWK, generateKeyPair, SignJWT, type JWTVerifyGetKey } from "jose";
+import { afterEach, beforeAll, describe, expect, it } from "vitest";
+
+import { loadConfiguration } from "../src/config.js";
+import { createPublisherApplicationSession } from "../src/publisher-session/session.js";
+import {
+	handleClaimWorkflowPairing,
+	handleConfirmWorkflowPairing,
+	handleCreateWorkflowPairing,
+	handleGetWorkflowPairing,
+} from "../src/workflow-pairing/routes.js";
+import { GITHUB_ACTIONS_ISSUER } from "../src/workload/github-oidc.js";
+import { TEST_BINDINGS } from "./fixtures/oauth.js";
+
+const PUBLISHER_DID = "did:web:publisher.example.com";
+const PAIRING_ID = "01JABCDEFGHJKMNPQRSTVWXYZ0";
+const PAIRING_TOKEN = "T".repeat(43);
+const NOW = 1_800_000_000_000;
+const KEY_ID = "github-actions-pairing-test";
+
+let privateKey: CryptoKey;
+let keyResolver: JWTVerifyGetKey;
+
+beforeAll(async () => {
+	const keys = await generateKeyPair("RS256", { extractable: true });
+	privateKey = keys.privateKey;
+	const publicJwk = await exportJWK(keys.publicKey);
+	publicJwk.kid = KEY_ID;
+	publicJwk.alg = "RS256";
+	publicJwk.use = "sig";
+	keyResolver = createLocalJWKSet({ keys: [publicJwk] });
+});
+
+afterEach(async () => {
+	await reset();
+});
+
+function cookieValue(header: string): string {
+	return header.split(";", 1)[0] ?? "";
+}
+
+async function publisherHeaders(): Promise<Headers> {
+	const session = await createPublisherApplicationSession(env.PUBLISHER_DO, PUBLISHER_DID, NOW);
+	const csrf = cookieValue(session.setCookieHeaders[1]).split("=", 2)[1] ?? "";
+	return new Headers({
+		cookie: session.setCookieHeaders.map(cookieValue).join("; "),
+		"content-type": "application/json",
+		"idempotency-key": "workflow-pairing-request-0001",
+		origin: TEST_BINDINGS.PUBLIC_ORIGIN,
+		"x-emdash-request": "1",
+		"x-emdash-csrf": csrf,
+	});
+}
+
+async function workloadToken(): Promise<string> {
+	const now = Math.floor(Date.now() / 1000);
+	return new SignJWT({
+		jti: crypto.randomUUID(),
+		repository: "example/gallery",
+		repository_id: "123456789",
+		repository_owner: "example",
+		repository_owner_id: "987654321",
+		workflow_ref: "example/gallery/.github/workflows/release.yml@refs/heads/main",
+		workflow_sha: "b".repeat(40),
+		run_id: "10000000001",
+		run_attempt: "1",
+		actor: "release-bot",
+		actor_id: "11223344",
+		event_name: "workflow_dispatch",
+		ref: "refs/heads/main",
+		ref_type: "branch",
+		sha: "a".repeat(40),
+		repository_visibility: "private",
+		runner_environment: "github-hosted",
+		environment: "production",
+	})
+		.setProtectedHeader({ alg: "RS256", kid: KEY_ID, typ: "JWT" })
+		.setIssuer(GITHUB_ACTIONS_ISSUER)
+		.setAudience(TEST_BINDINGS.PUBLIC_ORIGIN)
+		.setSubject("repo:example/gallery:environment:production")
+		.setIssuedAt(now)
+		.setNotBefore(now - 1)
+		.setExpirationTime(now + 300)
+		.sign(privateKey);
+}
+
+describe("GitHub workflow pairing routes", () => {
+	it("pairs a signed workflow only after account confirmation", async () => {
+		const configuration = await loadConfiguration(TEST_BINDINGS);
+		const headers = await publisherHeaders();
+		const created = await handleCreateWorkflowPairing(
+			new Request(`${TEST_BINDINGS.PUBLIC_ORIGIN}/v1/publisher/workflow-pairings`, {
+				method: "POST",
+				headers,
+				body: JSON.stringify({ packageSlug: "gallery" }),
+			}),
+			"request-create",
+			configuration,
+			{
+				now: () => NOW,
+				pairingId: () => PAIRING_ID,
+				pairingToken: () => PAIRING_TOKEN,
+			},
+		);
+		expect(created.status).toBe(201);
+		expect(await created.json()).toMatchObject({
+			data: {
+				pairingToken: PAIRING_TOKEN,
+				pairing: { id: PAIRING_ID, packageSlug: "gallery", state: "pending" },
+			},
+		});
+
+		const claimed = await handleClaimWorkflowPairing(
+			new Request(`${TEST_BINDINGS.PUBLIC_ORIGIN}/v1/workflow-pairings/${PAIRING_ID}/claim`, {
+				method: "POST",
+				headers: {
+					authorization: `Bearer ${await workloadToken()}`,
+					"content-type": "application/json",
+				},
+				body: JSON.stringify({ publisherDid: PUBLISHER_DID, pairingToken: PAIRING_TOKEN }),
+			}),
+			"request-claim",
+			configuration,
+			{ pairingId: PAIRING_ID },
+			{ keyResolver, now: () => NOW + 1 },
+		);
+		expect(claimed.status).toBe(200);
+		expect(await claimed.json()).toMatchObject({
+			data: {
+				pairing: {
+					state: "claimed",
+					claim: {
+						repository: "example/gallery",
+						workflowRef: "example/gallery/.github/workflows/release.yml@refs/heads/main",
+						ref: "refs/heads/main",
+						environment: "production",
+					},
+				},
+			},
+		});
+
+		const current = await handleGetWorkflowPairing(
+			new Request(`${TEST_BINDINGS.PUBLIC_ORIGIN}/v1/publisher/workflow-pairings/${PAIRING_ID}`, {
+				headers,
+			}),
+			"request-get",
+			configuration,
+			{ pairingId: PAIRING_ID },
+			{ now: () => NOW + 2 },
+		);
+		expect(current.status).toBe(200);
+		expect(await current.json()).toMatchObject({
+			data: { pairing: { state: "claimed", claim: { repository: "example/gallery" } } },
+		});
+		await expect(
+			env.PUBLISHER_DO.getByName(PUBLISHER_DID).getWorkloadPolicy(PUBLISHER_DID, "gallery"),
+		).resolves.toBeNull();
+
+		const confirmed = await handleConfirmWorkflowPairing(
+			new Request(
+				`${TEST_BINDINGS.PUBLIC_ORIGIN}/v1/publisher/workflow-pairings/${PAIRING_ID}/confirm`,
+				{ method: "POST", headers, body: "{}" },
+			),
+			"request-confirm",
+			configuration,
+			{ pairingId: PAIRING_ID },
+			{ now: () => NOW + 3 },
+		);
+		expect(confirmed.status).toBe(200);
+		expect(await confirmed.json()).toMatchObject({
+			data: {
+				pairing: { state: "confirmed" },
+				policy: {
+					repository: "example/gallery",
+					repositoryId: "123456789",
+					repositoryOwnerId: "987654321",
+					allowedRefs: ["refs/heads/main"],
+					allowedEnvironments: ["production"],
+				},
+			},
+		});
+		await expect(
+			env.PUBLISHER_DO.getByName(PUBLISHER_DID).getWorkloadPolicy(PUBLISHER_DID, "gallery"),
+		).resolves.toMatchObject({
+			repository: "example/gallery",
+			workflowRef: "example/gallery/.github/workflows/release.yml@refs/heads/main",
+		});
+	});
+});
diff --git a/apps/release-service/test/workflow-pairing.test.ts b/apps/release-service/test/workflow-pairing.test.ts
new file mode 100644
index 0000000000..a949402b95
--- /dev/null
+++ b/apps/release-service/test/workflow-pairing.test.ts
@@ -0,0 +1,127 @@
+import { reset } from "cloudflare:test";
+import { env } from "cloudflare:workers";
+import { afterEach, describe, expect, it } from "vitest";
+
+const PUBLISHER_DID = "did:web:publisher.example.com";
+const PAIRING_ID = "01JABCDEFGHJKMNPQRSTVWXYZ0";
+const PAIRING_TOKEN = "T".repeat(43);
+const NOW = 1_800_000_000_000;
+
+const CLAIM = {
+	repository: "example/gallery",
+	repositoryId: "123456789",
+	repositoryOwner: "example",
+	repositoryOwnerId: "987654321",
+	repositoryVisibility: "private" as const,
+	workflowRef: "example/gallery/.github/workflows/release.yml@refs/heads/main",
+	ref: "refs/heads/main",
+	environment: "production",
+};
+
+afterEach(async () => {
+	await reset();
+});
+
+describe("GitHub workflow pairing", () => {
+	it("captures signed GitHub identity and confirms an exact publishing policy", async () => {
+		const publisher = env.PUBLISHER_DO.getByName(PUBLISHER_DID);
+		const created = await publisher.createWorkflowPairing({
+			publisherDid: PUBLISHER_DID,
+			pairingId: PAIRING_ID,
+			pairingToken: PAIRING_TOKEN,
+			mutationKey: "workflow-pairing-create-0001",
+			packageSlug: "gallery",
+			expiresAt: NOW + 15 * 60_000,
+			now: NOW,
+		});
+		expect(created).toMatchObject({
+			ok: true,
+			replayed: false,
+			pairingToken: PAIRING_TOKEN,
+			pairing: { state: "pending", claim: null },
+		});
+
+		await expect(
+			publisher.claimWorkflowPairing({
+				publisherDid: PUBLISHER_DID,
+				pairingId: PAIRING_ID,
+				pairingToken: "X".repeat(43),
+				claim: CLAIM,
+				now: NOW + 1,
+			}),
+		).resolves.toEqual({ ok: false, code: "PAIRING_INVALID" });
+
+		await expect(
+			publisher.claimWorkflowPairing({
+				publisherDid: PUBLISHER_DID,
+				pairingId: PAIRING_ID,
+				pairingToken: PAIRING_TOKEN,
+				claim: CLAIM,
+				now: NOW + 2,
+			}),
+		).resolves.toMatchObject({
+			ok: true,
+			replayed: false,
+			pairing: { state: "claimed", claim: CLAIM },
+		});
+
+		const confirmed = await publisher.confirmWorkflowPairing(PUBLISHER_DID, PAIRING_ID, NOW + 3);
+		expect(confirmed).toMatchObject({
+			ok: true,
+			replayed: false,
+			pairing: { state: "confirmed" },
+			policy: {
+				packageSlug: "gallery",
+				repository: CLAIM.repository,
+				repositoryId: CLAIM.repositoryId,
+				repositoryOwnerId: CLAIM.repositoryOwnerId,
+				workflowRef: CLAIM.workflowRef,
+				allowedRefs: [CLAIM.ref],
+				allowedEnvironments: [CLAIM.environment],
+				active: true,
+			},
+		});
+		await expect(
+			publisher.confirmWorkflowPairing(PUBLISHER_DID, PAIRING_ID, NOW + 4),
+		).resolves.toMatchObject({ ok: true, replayed: true });
+	});
+
+	it("replays creation and expires unconfirmed pairings", async () => {
+		const publisher = env.PUBLISHER_DO.getByName(PUBLISHER_DID);
+		const input = {
+			publisherDid: PUBLISHER_DID,
+			pairingId: PAIRING_ID,
+			pairingToken: PAIRING_TOKEN,
+			mutationKey: "workflow-pairing-create-0001",
+			packageSlug: "gallery",
+			expiresAt: NOW + 60_000,
+			now: NOW,
+		};
+		await publisher.createWorkflowPairing(input);
+		await expect(
+			publisher.createWorkflowPairing({
+				...input,
+				pairingId: "01JABCDEFGHJKMNPQRSTVWXYZ1",
+				pairingToken: "R".repeat(43),
+				now: NOW + 1,
+			}),
+		).resolves.toMatchObject({
+			ok: true,
+			replayed: true,
+			pairingToken: PAIRING_TOKEN,
+			pairing: { id: PAIRING_ID },
+		});
+		await expect(
+			publisher.getWorkflowPairing(PUBLISHER_DID, PAIRING_ID, NOW + 60_001),
+		).resolves.toMatchObject({ state: "expired" });
+		await expect(
+			publisher.claimWorkflowPairing({
+				publisherDid: PUBLISHER_DID,
+				pairingId: PAIRING_ID,
+				pairingToken: PAIRING_TOKEN,
+				claim: CLAIM,
+				now: NOW + 60_002,
+			}),
+		).resolves.toEqual({ ok: false, code: "PAIRING_EXPIRED" });
+	});
+});
diff --git a/apps/release-service/vitest.config.ts b/apps/release-service/vitest.config.ts
index 7b4baf4d0b..b2fb305d41 100644
--- a/apps/release-service/vitest.config.ts
+++ b/apps/release-service/vitest.config.ts
@@ -8,7 +8,9 @@ process.env["ENCRYPTION_KEYRING"] ??=
 	'{"current":1,"keys":[{"version":1,"key":"AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8"}]}';
 
 export default defineConfig({
-	test: { exclude: [...configDefaults.exclude, "src/ui/**/*.test.{ts,tsx}"] },
+	test: {
+		exclude: [...configDefaults.exclude, "src/ui/**/*.test.{ts,tsx}", "e2e/**/*.spec.ts"],
+	},
 	plugins: [
 		cloudflareTest({
 			wrangler: { configPath: "./wrangler.jsonc" },
diff --git a/apps/release-service/vitest.encryption-v2.config.ts b/apps/release-service/vitest.encryption-v2.config.ts
new file mode 100644
index 0000000000..d6836807f4
--- /dev/null
+++ b/apps/release-service/vitest.encryption-v2.config.ts
@@ -0,0 +1,44 @@
+import { cloudflareTest } from "@cloudflare/vitest-pool-workers";
+import { defineConfig } from "vitest/config";
+
+import { TEST_ACCESS_AUDIENCES, TEST_ASSERTION_KEYSET } from "./test/fixtures/oauth.js";
+
+const KEYRING_V2 =
+	'{"current":2,"keys":[{"version":1,"key":"AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8"},{"version":2,"key":"ICEiIyQlJicoKSorLC0uLzAxMjM0NTY3ODk6Ozw9Pj8"}]}';
+
+process.env["OAUTH_ASSERTION_KEYSET"] = TEST_ASSERTION_KEYSET;
+process.env["ENCRYPTION_KEYRING"] = KEYRING_V2;
+
+export default defineConfig({
+	test: {
+		include: ["test/encryption-verification-workflow.v2.ts"],
+	},
+	plugins: [
+		cloudflareTest({
+			wrangler: { configPath: "./wrangler.jsonc" },
+			miniflare: {
+				workers: [
+					{
+						name: "emdash-release-verifier",
+						modules: true,
+						script: `
+							import { WorkerEntrypoint } from "cloudflare:workers";
+							export default class ReleaseVerifier extends WorkerEntrypoint {}
+						`,
+					},
+				],
+				bindings: {
+					PUBLIC_ORIGIN: "https://release.example.com",
+					DEPLOYMENT_ID: "test-release-service",
+					ACCESS_TEAM_DOMAIN: "https://emdash-test.cloudflareaccess.com",
+					ACCESS_VIEWER_AUD: TEST_ACCESS_AUDIENCES.viewer,
+					ACCESS_REVIEWER_AUD: TEST_ACCESS_AUDIENCES.reviewer,
+					ACCESS_ADMIN_AUD: TEST_ACCESS_AUDIENCES.admin,
+					OAUTH_REDIRECT_URIS: '["https://release.example.com/oauth/callback"]',
+					OAUTH_ASSERTION_KEYSET: TEST_ASSERTION_KEYSET,
+					ENCRYPTION_KEYRING: KEYRING_V2,
+				},
+			},
+		}),
+	],
+});
diff --git a/apps/release-service/worker-configuration.d.ts b/apps/release-service/worker-configuration.d.ts
index 2152a0bc29..003df8ca06 100644
--- a/apps/release-service/worker-configuration.d.ts
+++ b/apps/release-service/worker-configuration.d.ts
@@ -1,18 +1,18 @@
 /* eslint-disable */
-// Generated by Wrangler by running `wrangler types` (hash: 6cedf1555243b18d28cdf49bc5763980)
+// Generated by Wrangler by running `wrangler types` (hash: 6d972405f92f5912a07f4c6911999ab0)
 // Runtime types generated with workerd@1.20260815.1 2026-05-14 nodejs_compat
 interface __BaseEnv_Env {
 	PUBLICATION_STAGING: R2Bucket;
 	OPERATIONS_ARCHIVE: R2Bucket;
 	OPERATIONS_METRICS: AnalyticsEngineDataset;
 	ASSETS: Fetcher;
-	PUBLIC_ORIGIN: "";
-	DEPLOYMENT_ID: "";
-	ACCESS_TEAM_DOMAIN: "";
-	ACCESS_VIEWER_AUD: "";
-	ACCESS_REVIEWER_AUD: "";
-	ACCESS_ADMIN_AUD: "";
-	OAUTH_REDIRECT_URIS: "[]";
+	PUBLIC_ORIGIN: "https://emdash-release-service.emdash-cms.workers.dev";
+	DEPLOYMENT_ID: "emdash-release-service-production";
+	ACCESS_TEAM_DOMAIN: "https://cf-emdash-cms.cloudflareaccess.com";
+	ACCESS_VIEWER_AUD: "9e94dcee531107093096e1aff1a1fe7df68f93fc599c1ee8282ed76d70fd568c";
+	ACCESS_REVIEWER_AUD: "b282de16228e3c42a0aa41d3aba8478d79d1987e37a7b5778f628552581ad8f6";
+	ACCESS_ADMIN_AUD: "[\"a53a97932d4d07decf44e727abfe0c1c9d85412c62b5e55669148d5d2296338c\",\"1a4f3f6eba0fb3c3cdfcc3f77f6e5f4a0e4af2e0f7efe31ef12fb077e7cccc64\",\"54c4eec8766ebf5ade4c9e9c95cd8e2cadfcf441850bb56f34bfe097acd68ac0\",\"4a68acabdd10af19b45d7d6bf6623aa7a18b4407999f0b769b3371ab256c292f\"]";
+	OAUTH_REDIRECT_URIS: "[\"https://emdash-release-service.emdash-cms.workers.dev/oauth/callback\"]";
 	OAUTH_ASSERTION_KEYSET: string;
 	ENCRYPTION_KEYRING: string;
 	IDENTITY_DIRECTORY_DO: DurableObjectNamespace<import("./src/index").IdentityDirectoryDurableObject>;
@@ -23,6 +23,7 @@ interface __BaseEnv_Env {
 	RELEASE_VERIFIER: Fetcher /* emdash-release-verifier */;
 	RELEASE_INTENT_WORKFLOW: Workflow<Parameters<import("./src/index").ReleaseIntentWorkflow['run']>[0]['payload']>;
 	PUBLISHER_ARCHIVE_WORKFLOW: Workflow<Parameters<import("./src/index").PublisherArchiveWorkflow['run']>[0]['payload']>;
+	ENCRYPTION_VERIFICATION_WORKFLOW: Workflow<Parameters<import("./src/index").EncryptionVerificationWorkflow['run']>[0]['payload']>;
 }
 declare namespace Cloudflare {
 	interface GlobalProps {
diff --git a/apps/release-service/wrangler.jsonc b/apps/release-service/wrangler.jsonc
index 61bc684f63..64bb9e5978 100644
--- a/apps/release-service/wrangler.jsonc
+++ b/apps/release-service/wrangler.jsonc
@@ -75,6 +75,11 @@
 			"name": "emdash-publisher-archive",
 			"class_name": "PublisherArchiveWorkflow",
 		},
+		{
+			"binding": "ENCRYPTION_VERIFICATION_WORKFLOW",
+			"name": "emdash-encryption-verification",
+			"class_name": "EncryptionVerificationWorkflow",
+		},
 	],
 	"assets": {
 		"directory": "./dist/client",
@@ -95,13 +100,13 @@
 		],
 	},
 	"vars": {
-		"PUBLIC_ORIGIN": "",
-		"DEPLOYMENT_ID": "",
-		"ACCESS_TEAM_DOMAIN": "",
-		"ACCESS_VIEWER_AUD": "",
-		"ACCESS_REVIEWER_AUD": "",
-		"ACCESS_ADMIN_AUD": "",
-		"OAUTH_REDIRECT_URIS": "[]",
+		"PUBLIC_ORIGIN": "https://emdash-release-service.emdash-cms.workers.dev",
+		"DEPLOYMENT_ID": "emdash-release-service-production",
+		"ACCESS_TEAM_DOMAIN": "https://cf-emdash-cms.cloudflareaccess.com",
+		"ACCESS_VIEWER_AUD": "9e94dcee531107093096e1aff1a1fe7df68f93fc599c1ee8282ed76d70fd568c",
+		"ACCESS_REVIEWER_AUD": "b282de16228e3c42a0aa41d3aba8478d79d1987e37a7b5778f628552581ad8f6",
+		"ACCESS_ADMIN_AUD": "[\"a53a97932d4d07decf44e727abfe0c1c9d85412c62b5e55669148d5d2296338c\",\"1a4f3f6eba0fb3c3cdfcc3f77f6e5f4a0e4af2e0f7efe31ef12fb077e7cccc64\",\"54c4eec8766ebf5ade4c9e9c95cd8e2cadfcf441850bb56f34bfe097acd68ac0\",\"4a68acabdd10af19b45d7d6bf6623aa7a18b4407999f0b769b3371ab256c292f\"]",
+		"OAUTH_REDIRECT_URIS": "[\"https://emdash-release-service.emdash-cms.workers.dev/oauth/callback\"]",
 	},
 	"secrets": {
 		"required": ["OAUTH_ASSERTION_KEYSET", "ENCRYPTION_KEYRING"],
diff --git a/apps/release-verifier/src/index.ts b/apps/release-verifier/src/index.ts
index 3cfbbaa339..53a221873e 100644
--- a/apps/release-verifier/src/index.ts
+++ b/apps/release-verifier/src/index.ts
@@ -10,6 +10,10 @@ import {
 } from "./verify.js";
 
 export default class ReleaseVerifier extends WorkerEntrypoint<Env> {
+	override fetch(_request: Request): Response {
+		return new Response(null, { status: 404 });
+	}
+
 	async verifyArtifact(input: VerifyArtifactInput): Promise<ArtifactVerificationReport> {
 		return verifyArtifact(input);
 	}
diff --git a/apps/release-verifier/test/verifier.test.ts b/apps/release-verifier/test/verifier.test.ts
index 42ee57b06c..b956d29dfd 100644
--- a/apps/release-verifier/test/verifier.test.ts
+++ b/apps/release-verifier/test/verifier.test.ts
@@ -400,6 +400,12 @@ describe("isolated release verifier", () => {
 			}),
 		).resolves.toMatchObject({ success: false, error: { code: "VERIFIER_INPUT_INVALID" } });
 	});
+
+	it("does not expose verification over HTTP", async () => {
+		const response = await exports.default.fetch(new Request("https://verifier.example.test/"));
+
+		expect(response.status).toBe(404);
+	});
 });
 
 describe("Cloudflare DNS resolver", () => {
diff --git a/apps/release-verifier/vite.config.ts b/apps/release-verifier/vite.config.ts
index f6268f8e95..c7232fa6cb 100644
--- a/apps/release-verifier/vite.config.ts
+++ b/apps/release-verifier/vite.config.ts
@@ -1,6 +1,15 @@
+import { fileURLToPath } from "node:url";
+
 import { cloudflare } from "@cloudflare/vite-plugin";
 import { defineConfig } from "vite";
 
 export default defineConfig({
 	plugins: [cloudflare()],
+	resolve: {
+		alias: {
+			"@emdash-cms/registry-verification": fileURLToPath(
+				new URL("../../packages/registry-verification/src/index.ts", import.meta.url),
+			),
+		},
+	},
 });
diff --git a/apps/release-verifier/wrangler.jsonc b/apps/release-verifier/wrangler.jsonc
index 5140488876..827b1f0c3a 100644
--- a/apps/release-verifier/wrangler.jsonc
+++ b/apps/release-verifier/wrangler.jsonc
@@ -2,6 +2,7 @@
 	"$schema": "node_modules/wrangler/config-schema.json",
 	"name": "emdash-release-verifier",
 	"main": "./src/index.ts",
+	"workers_dev": false,
 	"compatibility_date": "2026-05-14",
 	"compatibility_flags": ["nodejs_compat"],
 	"observability": {
diff --git a/docs/technical-specs/delegated-release-service-implementation-plan.md b/docs/technical-specs/delegated-release-service-implementation-plan.md
new file mode 100644
index 0000000000..90ad39a2f9
--- /dev/null
+++ b/docs/technical-specs/delegated-release-service-implementation-plan.md
@@ -0,0 +1,972 @@
+# Delegated release service implementation plan
+
+Status: Implemented locally; PR review and deployment conformance pending
+
+Companion specification: [Delegated release service](./delegated-release-service.md)
+
+Related design: [RFC PR #1870](https://github.com/emdash-cms/emdash/pull/1870)
+
+## Outcome
+
+This plan delivers a hosted and self-hostable delegated release service in reviewable increments. A GitHub Actions workflow submits checksum-bound HTTPS artifact sources. The service stages the verified bytes, uploads bounded package and image blobs through the publisher's exact AT Protocol delegation, and creates a blob-only release record. Invalid output remains un-installable because EmDash independently repeats verification. Releases that expand declared access or use `confirmation: always` require a profile-authorized, user-verified passkey decision.
+
+Canonical service state is sharded by publisher or approver DID in SQLite-backed Durable Objects. Workflows coordinate long-running work. A 256-shard identity-directory Durable Object projection supports fleet enumeration and never participates in authorization.
+
+## Existing implementation baseline
+
+The implementation starts from current `main`, not from the #1908 integration branch.
+
+### Available on `main`
+
+- `@emdash-cms/registry-lexicons` exports the active package/profile records and `getDelegatedReleasePermission()`.
+- `@emdash-cms/plugin-types` provides manifest validation, declared-access canonicalization, comparison, and escalation detection.
+- `@emdash-cms/registry-verification` provides guarded resource fetching, multihash verification, canonical bundle validation, record/policy verification, and GitHub Sigstore/SLSA verification in Node and workerd.
+- The registry client and plugin CLI already have AT Protocol publishing and credential foundations.
+
+### Donor material on #1908
+
+The old branch contains reviewed or tested implementations for:
+
+- required-user-verification WebAuthn primitives;
+- confidential OAuth metadata and storage experiments;
+- compact JOSE envelope encryption;
+- GitHub Actions OIDC verification;
+- service API response and request-security foundations;
+- an isolated verifier Worker; and
+- create-only publishing and installer-verification prototypes.
+
+Each donor unit must be compared with current `main`, the accepted specification, and current platform APIs. Port bounded commits or code paths with provenance. Do not merge, rebase, or cherry-pick the whole integration branch.
+
+### Superseded assumptions
+
+The new implementation does not retain:
+
+- D1 as canonical service state;
+- D1 coordination leases;
+- a D1 transactional outbox as the release lifecycle;
+- AT Protocol login for service operators;
+- one large publisher/operator console;
+- Queue-plus-cron orchestration for release intents; or
+- aggregator historical-policy enforcement as a prerequisite for the first service release.
+
+### Current execution state
+
+The replacement implementation is under review in the seven-layer `gh-stack` for PRs #2743 to #2749, above metadata prerequisite PR #2765. It includes confidential OAuth custody, sharded publisher and approver authority, GitHub Actions admission, verification and publication Workflows, independent installer enforcement, passkey approval, Access operator controls, product UIs, encrypted archive/restore, encryption-key lifecycle, abuse limits, observability, self-hosting documentation, and browser conformance.
+
+Review fixes remain local until the complete stack passes its formatting, typecheck, package, Worker, browser, generated-binding, and changeset gates. The seven branches form one merge unit and do not represent deployable intermediate service versions.
+
+The earlier record-only public-client G0 lifecycle completed on both providers: exact-scope authorization, forced refresh, and server revocation passed. npmX rejected its access token immediately after revocation. Cirrus retained the already-issued access token for its remaining lifetime while preventing future refresh. The blob-enabled public-client run, deployed confidential-client run, and client-key removal observation remain required before either provider is advertised as supported by the hosted service.
+
+Closed PR #1908 remains donor history and is not a merge target. Its D1 custody and coordination model does not satisfy this plan. Draft PR #1909 is the independent metadata-labeling service and does not join the delegated-release service stack.
+
+## Execution rules
+
+- The companion specification is the source of truth. A workstream may refine an implementation detail but cannot weaken a security invariant.
+- Complete failing behavior tests with each implementation. Security and failure tests are not deferred to the conformance workstream.
+- Keep publisher, approver, operator, and CI authentication realms separate in types, middleware, cookies, and routes.
+- Keep canonical authorization state in Durable Objects. A projection or Workflow result cannot authorize a transition.
+- Use Durable Object RPC for typed state operations. Do not hold `blockConcurrencyWhile()` across external I/O.
+- Every external side effect has a generation-bound operation token, idempotency identity, or deterministic reconciliation path before it is enabled.
+- Keep incomplete authority paths unreachable. A feature flag or undocumented route is not a sufficient boundary.
+- Put package and root-workspace changes in a designated integration worktree. Parallel worktrees do not all edit `pnpm-lock.yaml`, root `package.json`, CI, or generated binding types.
+- Represent every dependent PR lane as a GitHub stack managed with `gh-stack`. Independent workstreams use separate stacks rooted on `main`.
+- Treat each GitHub stack as one merge unit. Its branches are review boundaries, not deployable service versions. A partial stack merge requires an explicit integration gate that is independently usable.
+- Before the first service deployment, define the complete initial schema and persisted formats on their owning lowest branches. Do not add migrations or legacy readers solely for intermediate branches in an unmerged stack. After the first deployment, every persisted-state change uses a forward-only migration and preserves deployed data.
+- Merging an implementation stack does not authorize a deployment. The first hosted or self-hosted release waits for the complete service and its G7 production gate.
+- New public records and fields remain additive while experimental.
+- User-facing application strings use Lingui message IDs with English fallbacks, making the surfaces localizable. Layouts are RTL-ready. The Access operator console follows the same UI quality rules even though its deployment audience is small.
+- Each published-package change includes a reviewed changeset.
+
+## Workstream dependency graph
+
+```mermaid
+flowchart TD
+    W0[W0 Design and feasibility]
+    W1[W1 Protocol and shared verification]
+    W2[W2 Service shell and control plane]
+    W3[W3 Publisher Durable Object]
+    W4[W4 Publisher OAuth delegation]
+    W5[W5 Workload identity and intent admission]
+    W6[W6 Verification Workflow]
+    W7[W7 Publication and reconciliation]
+    W8[W8 Approver Durable Object and passkeys]
+    W9[W9 Independent installer enforcement]
+    W10[W10 Clients and web surfaces]
+    W11[W11 Operations and self-hosting]
+    W12[W12 Conformance and security]
+
+    W0 --> W1
+    W0 --> W2
+    W1 --> W4
+    W1 --> W6
+    W1 --> W9
+    W2 --> W3
+    W2 --> W11
+    W3 --> W4
+    W3 --> W5
+    W3 --> W6
+    W3 --> W8
+    W4 --> W7
+    W5 --> W6
+    W6 --> W7
+    W6 --> W8
+    W7 --> W10
+    W8 --> W10
+    W9 --> W12
+    W10 --> W12
+    W11 --> W12
+    W7 --> W12
+    W8 --> W12
+```
+
+The service critical path is:
+
+```text
+W0 -> W1 -> W2 -> W3 -> W4/W5 -> W6 -> W7 -> W9/W12
+```
+
+Approval and product surfaces follow a parallel path after the publisher object contract stabilizes:
+
+```text
+W3 -> W8 -> W10 -> W12
+```
+
+## Integration gates
+
+| Gate                            | Required evidence                                                                                                                                | Unblocks                                           |
+| ------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------- |
+| **G0 Design**                   | RFC decisions reconciled; exact delegated release scope proved on every claimed PDS; no broad fallback                                           | Authority-bearing implementation                   |
+| **G1 Contracts**                | Lexicons, direct-PDS reads, shared record/bundle/provenance reports, and fixtures pass in Node and workerd                                       | Service Workflow and installer work                |
+| **G2 Durable state**            | Service shell, Access auth, control object, publisher object, initial schema, state machine, idempotency, and alarms pass real workerd tests     | OAuth, OIDC, Workflow integration                  |
+| **G3 Automatic vertical slice** | Controlled GitHub workflow materializes URL sources and publishes one valid blob-only non-escalating release; upload and create retries converge | Independent enforcement and private service trials |
+| **G4 Independent enforcement**  | A clean EmDash site accepts valid output and rejects every invalid service-output fixture                                                        | Hosted limited beta                                |
+| **G5 Approval**                 | `always` and escalation releases require a valid current approver and passkey; every invalidation path re-approves                               | Broader publisher beta                             |
+| **G6 Operational beta**         | Pause, suspension, revocation, reconciliation, key rotation, backup/export, alerts, and self-host path work without database edits               | Public beta                                        |
+| **G7 Production**               | End-to-end conformance, recovery drills, and external security review have no unresolved critical/high findings                                  | Production launch                                  |
+
+## W0 Design and feasibility
+
+Owner surface: RFC, external validation, retained conformance fixtures.
+
+Dependencies: none.
+
+### Tasks
+
+| Task   | Work                                                                                                                                                      |
+| ------ | --------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `W0.1` | Reconcile RFC #1870 with the Durable Object architecture, Access operator authentication, existing `emdash-plugin` command, and active experimental NSIDs |
+| `W0.2` | Freeze the first-release profile policy, provenance, workload policy, approval digest, intent state, and error contracts                                  |
+| `W0.3` | Validate the exact delegated release grant against the available npmX-hosted Bluesky PDS and Cirrus test accounts                                         |
+| `W0.4` | Validate confidential OAuth refresh, DPoP behavior, revocation, and client-key rotation with real authorization servers                                   |
+| `W0.5` | Confirm current Workflow event, retention, retry, and test APIs support approval and recovery; record limits outside the protocol contract                |
+| `W0.6` | Define hosted-service Access audience and group-to-role mapping and the self-host configuration contract                                                  |
+
+### Acceptance criteria
+
+- Every public contract has one normative shape and owner.
+- The exact scope creates a release and cannot update, delete, edit a profile, or write another collection on the Bluesky PDS implementation at npmX and on Cirrus.
+- Refresh and revocation observations are recorded with reproducible external steps.
+- An unsupported PDS is excluded from the support matrix instead of receiving a broader scope.
+- The Workflow design has a tested route for approval, rejection, cancellation, timeout, retry, and lost-instance recovery.
+- The RFC and technical specification contain no contradictory actor names, CLI commands, or trust claims.
+
+### Parallelism
+
+`W0.3`, `W0.4`, `W0.5`, and `W0.6` can run in separate research tasks. Only `W0.1` edits the RFC. Research tasks return concise evidence to the coordinator rather than landing prototype applications or unrelated dependencies.
+
+## W1 Protocol and shared verification
+
+Owner surface:
+
+- `packages/registry-lexicons/`
+- `packages/registry-verification/`
+- `packages/registry-client/src/direct-pds/`
+- `packages/plugin-types/` only for shared declared-access behavior
+- protocol fixtures under the owning packages
+
+Dependencies: G0 contract decisions.
+
+### Tasks
+
+| Task   | Work                                                                                                                                        |
+| ------ | ------------------------------------------------------------------------------------------------------------------------------------------- |
+| `W1.1` | Audit profile/release lexicons and generated types against the accepted RFC; keep additions optional                                        |
+| `W1.2` | Finalize the exact permission helper and create-only publishing client without update/delete escape hatches                                 |
+| `W1.3` | Complete authoritative direct-PDS profile, release, list, and deterministic-key reads                                                       |
+| `W1.4` | Produce one structured record/policy report covering normalized policy, profile CID, release CID, provenance status, and stable error codes |
+| `W1.5` | Confirm canonical bundle/manifest and declared-access reports share one implementation across service and installer                         |
+| `W1.6` | Expand real provenance fixtures for valid, missing, corrupt, substituted, foreign-source, wrong-builder, and unsupported predicates         |
+| `W1.7` | Verify packed published output in Node and workerd and retain interop fixtures outside planning documents                                   |
+
+### Acceptance criteria
+
+- Existing publishing flows preserve unknown and known extensions.
+- The create-only helper has no callable update or delete operation and rejects a mismatched collection.
+- Direct-PDS reads fail with stable codes for DID, PDS, record, CID, lexicon, identity, and policy failures.
+- The same fixtures produce equivalent reports in Node and workerd.
+- Manifest access comparison detects every broadened category, operation, and recognized constraint.
+- Unsupported supplied provenance fails as unverifiable rather than being treated as absent or valid.
+- Installer and service can consume the same public report types without importing application code.
+
+### Parallelism
+
+Split into at most two worktrees after `W1.1` freezes types:
+
+- direct-PDS and record-policy verification (`W1.2` to `W1.4`);
+- provenance and packed-output fixtures (`W1.5` to `W1.7`).
+
+Both worktrees must avoid editing the same barrel files. The contracts worktree owns final exports and generated lexicons.
+
+## W2 Service shell and control plane
+
+Owner surface:
+
+- `apps/release-service/package.json`
+- `apps/release-service/wrangler.jsonc`
+- `apps/release-service/src/index.ts`
+- `apps/release-service/src/env.ts`
+- `apps/release-service/src/api/`
+- `apps/release-service/src/access/`
+- `apps/release-service/src/control-do/`
+- root workspace and CI integration for the application
+
+Dependencies: G0 architecture and Access decisions.
+
+### Tasks
+
+| Task   | Work                                                                                                                                                               |
+| ------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
+| `W2.1` | Scaffold the Worker, static assets, test configuration, bindings, Wrangler Durable Object class migration, Workflow binding, verifier binding, and generated types |
+| `W2.2` | Add versioned JSON envelopes, request IDs, body limits, security headers, CORS policy, error handling, and route composition                                       |
+| `W2.3` | Implement Access JWT verification, role-specific audience boundaries, CSRF, and operator mutation idempotency                                                      |
+| `W2.4` | Implement `ServiceControlDurableObject`, service modes, publication permits, publisher controls, audit, and alarm-backed cleanup                                   |
+| `W2.5` | Add health and readiness behavior that distinguishes configuration, binding, and dependency failure without exposing tenant state                                  |
+| `W2.6` | Add CI lanes for Node tests, workerd tests, Worker build, binding generation, and packed-output checks                                                             |
+
+### Acceptance criteria
+
+- Production routes start only with complete required bindings and fail with public-safe configuration errors.
+- Access operator routes reject missing, wrong-audience, expired, malformed, non-human, and wrong-role JWTs.
+- Operator role boundaries prevent viewers and reviewers from executing admin-only actions.
+- CSRF and idempotency checks apply to every cookie-authenticated mutation.
+- Service mode transitions are atomic and append audit before returning success.
+- A fresh publication permit reflects the latest service mode and cannot be reused after the mode epoch changes.
+- Worker and Durable Object tests run against the real workerd runtime.
+
+### Parallelism
+
+`W2.2` API foundations and `W2.3` Access authentication may run in parallel after `W2.1` lands. `W2.4` owns the control-object schema and must not share its directory with either task. One integration owner updates root workspace files, CI, `wrangler.jsonc`, and generated binding types.
+
+## W3 Publisher Durable Object
+
+Owner surface:
+
+- `apps/release-service/src/publisher-do/`
+- publisher-shard schema and test fixtures
+- publisher RPC types exported from one package-local entry point
+
+Dependencies: W2.1 and shared state/error contracts.
+
+### Tasks
+
+| Task   | Work                                                                                                                                                                                                        |
+| ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `W3.1` | Implement the complete initial object schema with `publisher`, `delegations`, `workflow_pairings`, `workload_policies`, `intents`, reservations, transitions, operations, audit, idempotency, and deadlines |
+| `W3.2` | Implement the complete intent state machine with expected-state and generation guards                                                                                                                       |
+| `W3.3` | Implement package/version reservation and OIDC/request idempotency semantics                                                                                                                                |
+| `W3.4` | Implement generation-bound refresh and publication operation tokens without external I/O inside transactions                                                                                                |
+| `W3.5` | Implement append-only audit and public/private serializers                                                                                                                                                  |
+| `W3.6` | Implement one-alarm deadline queue for operation recovery, intent and pairing expiry, session cleanup, and audit/snapshot scheduling                                                                        |
+| `W3.7` | Implement publisher session epoch and publisher/service suspension checks                                                                                                                                   |
+
+### Acceptance criteria
+
+- `getByName(canonicalPublisherDid)` routes every package for one publisher to the same object.
+- Schema initialization is idempotent across object restarts.
+- Illegal state transitions and stale generations cannot change state.
+- Concurrent package/version reservations yield one owner and deterministic results for every loser.
+- Exact idempotent replay returns the stored intent; conflicting replay returns `IDEMPOTENCY_CONFLICT`.
+- Only the current operation token can complete refresh or publication.
+- Alarm recovery marks abandoned operations for reconciliation without losing the next scheduled deadline.
+- No RPC holds `blockConcurrencyWhile()` while calling another service or the network.
+
+### Parallelism
+
+The schema/state-machine task (`W3.1` and `W3.2`) lands first. Reservations/idempotency (`W3.3`), operations (`W3.4`), and serializers/audit (`W3.5`) can then run as stacked child branches with non-overlapping modules. Alarm and suspension integration (`W3.6` and `W3.7`) follows those contracts.
+
+## W4 Publisher OAuth delegation
+
+Owner surface:
+
+- `apps/release-service/src/oauth/`
+- `apps/release-service/src/crypto/`
+- publisher identity/session routes
+- publisher delegation RPC adapter
+
+Dependencies: W1 exact permission, W2 API, W3 delegation and operation RPCs.
+
+### Tasks
+
+| Task   | Work                                                                                                              |
+| ------ | ----------------------------------------------------------------------------------------------------------------- |
+| `W4.1` | Implement confidential-client metadata, versioned JWKS, PKCE/state/nonce transactions, and callback validation    |
+| `W4.2` | Implement identity-only publisher login and short-lived publisher application sessions                            |
+| `W4.3` | Implement exact-scope delegation authorization and returned-grant validation                                      |
+| `W4.4` | Implement and review compact JWE with `jose`, wrapped per-value content keys, and publisher/field context binding |
+| `W4.5` | Persist encrypted sessions in the publisher object and implement serialized refresh using operation tokens        |
+| `W4.6` | Implement publisher and operator revocation, client-key rotation, reauthorization, and failure classification     |
+
+### Acceptance criteria
+
+- OAuth state, PKCE, nonce, redirect URI, issuer, subject, and scope mismatches fail closed.
+- Identity login does not leave a durable PDS write session.
+- Delegation accepts only the exact active collection/create scope.
+- Ciphertext copied to another publisher, table, row, or field cannot decrypt.
+- Concurrent refresh attempts produce one accepted session generation and discard stale results.
+- Revoked or unrefreshable authority blocks new publication and requests publisher reauthorization.
+- Logs, errors, audit, fixtures, and snapshots contain no plaintext token or DPoP key.
+
+### Parallelism
+
+OAuth protocol (`W4.1` to `W4.3`) and encryption (`W4.4`) can run in parallel. Integration with publisher storage (`W4.5`) starts after both land. Revocation/rotation (`W4.6`) follows the integrated path.
+
+## W5 Workload identity and intent admission
+
+Owner surface:
+
+- `apps/release-service/src/workload/`
+- `apps/release-service/src/intents/admission/`
+- GitHub OIDC fixtures
+- workload-policy publisher routes
+
+Dependencies: W2 API, W3 workload/idempotency RPCs, frozen W1 repository canonicalization.
+
+### Tasks
+
+| Task   | Work                                                                                                                                          |
+| ------ | --------------------------------------------------------------------------------------------------------------------------------------------- |
+| `W5.1` | Define issuer-neutral verified-workload types and error codes                                                                                 |
+| `W5.2` | Implement GitHub issuer/JWKS verification and audience, expiry, repository, workflow, ref, environment, run ID, and run-attempt normalization |
+| `W5.3` | Implement publisher-authorized workload-policy create, replace, disable, and audit operations                                                 |
+| `W5.4` | Implement intent request schema, token disposal, request digest, service/publisher admission, reservation, and Workflow start                 |
+| `W5.5` | Implement OIDC-authenticated intent status and cancellation using fresh matching workload identity                                            |
+| `W5.6` | Add dry-run admission that validates OIDC and policy without reserving or publishing a version                                                |
+
+### Acceptance criteria
+
+- A valid configured GitHub workflow creates one intent and Workflow instance.
+- Wrong issuer, signature, audience, expiry, repository, workflow, ref, environment, run identity, or inactive policy fails with a stable code.
+- The raw OIDC token is absent from storage, logs, audit, Workflow parameters, and errors.
+- Repeated identical submission returns the original intent; changed payload under the same identity fails.
+- A paused or suspended publisher cannot create an intent.
+- Cancellation is valid only before publication and requires matching workload identity or publisher ownership.
+- Dry-run cannot reserve a version or create a publication operation.
+
+### Parallelism
+
+OIDC verification (`W5.1` and `W5.2`) and workload-policy CRUD (`W5.3`) can run in parallel after their interfaces freeze. Admission (`W5.4`) combines them. Status/cancel and dry-run can run as separate child tasks afterward.
+
+## W6 Verification Workflow and isolated verifier
+
+Owner surface:
+
+- `apps/release-service/src/workflows/`
+- `apps/release-service/src/verification/`
+- `apps/release-verifier/`
+- Workflow fixtures and introspection tests
+
+Dependencies: G1, W3 intent RPCs, W5 admitted intents.
+
+### Tasks
+
+| Task   | Work                                                                                                                                                  |
+| ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `W6.1` | Scaffold the verifier Worker with only the required egress/config bindings and shared-verification dependencies                                       |
+| `W6.2` | Implement bounded artifact and provenance verification reports over the service binding                                                               |
+| `W6.3` | Implement Workflow steps for authoritative profile, release-key absence, access baseline, artifact, provenance, workload binding, and policy decision |
+| `W6.4` | Persist every step result through the publisher object and make static step names replay-safe                                                         |
+| `W6.5` | Implement `awaiting_approval`, decision event, cancellation event, timeout, and expiry behavior                                                       |
+| `W6.6` | Implement lost/expired Workflow recovery from authoritative intent and audit state                                                                    |
+
+### Acceptance criteria
+
+- The verifier has no publisher OAuth, Access, Durable Object, or service-control authority.
+- SSRF, redirect, DNS rebinding, unsupported protocol, oversized, slow, and malformed-resource cases fail with bounded public-safe reports.
+- Every verification input is tied to recorded profile CID, baseline CID, artifact checksum, provenance checksum, and workload claims.
+- Workflow replay skips completed semantic work or receives the same idempotent result.
+- A Workflow crash after any step resumes without duplicating an intent transition or external side effect.
+- Approval timeout produces `expired`; rejection and cancellation cannot fall through to publication.
+- Authoritative state is sufficient to restart recovery when Workflow instance data is unavailable.
+
+### Parallelism
+
+Verifier Worker (`W6.1` and `W6.2`) and Workflow state orchestration (`W6.3` skeleton and `W6.4`) can run in separate worktrees against agreed report/RPC interfaces. Approval waiting and recovery begin after the main Workflow path integrates.
+
+## W7 Publication and reconciliation
+
+Owner surface:
+
+- `apps/release-service/src/publishing/`
+- publication steps in the release Workflow
+- create/reconcile PDS fixtures
+
+Dependencies: W4 delegation, W6 verified intents, W2 service permits.
+
+### Tasks
+
+| Task   | Work                                                                                                                                                                       |
+| ------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `W7.1` | Implement final re-fetch/reverification and invalidation of changed profile, baseline, artifact, provenance, workload, or policy                                           |
+| `W7.2` | Implement deterministic private R2 staging, immutable materialization state, replay-stable operation credentials, and serialized session refresh                           |
+| `W7.3` | Upload checksum-bound package and image blobs, persist receipts and canonical blob-only record JSON, then issue a fresh permit and create the deterministic release record |
+| `W7.4` | Implement exact-match, absence, conflict, and transient ambiguous-write reconciliation                                                                                     |
+| `W7.5` | Implement alarm/operator recovery and bounded retry policy                                                                                                                 |
+| `W7.6` | Emit terminal audit and optional projection events only after authoritative completion                                                                                     |
+
+### Acceptance criteria
+
+- No release is written from stale verification or approval inputs.
+- Pause, suspension, or delegation revocation immediately before the write blocks publication.
+- Concurrent publication within one publisher produces one active operation token.
+- URL-source bytes are fetched through the guarded path and staged under deterministic publisher/intent/slot/checksum R2 keys.
+- Every returned PDS blob matches the verified checksum, byte size, and media type; the final record contains no artifact URL.
+- Immutable receipts and canonical record JSON are committed before the permit and `creating` phase, and normal completion deletes staged objects.
+- A timeout before, during, or after `createRecord` converges without creating a second semantic release.
+- Exact existing record is successful replay; different existing record is terminal conflict.
+- Operator reconciliation cannot mark an absent or conflicting record as published.
+- Published state records the authoritative AT URI and CID and is immutable.
+
+### Parallelism
+
+Final invalidation (`W7.1`) and PDS client/reconciliation fixtures (`W7.3` and `W7.4`) can run in parallel. Coordination (`W7.2`) and recovery (`W7.5`) must be reviewed together because they define the external-side-effect boundary.
+
+## W8 Approver Durable Object and passkeys
+
+Owner surface:
+
+- `apps/release-service/src/approver-do/`
+- `apps/release-service/src/approvals/`
+- required-UV additions in `packages/auth/`
+- approver OAuth and WebAuthn fixtures
+
+Dependencies: W3 RPC conventions, W4 identity OAuth, W6 approval digest/event contract.
+
+### Tasks
+
+| Task   | Work                                                                                                                                       |
+| ------ | ------------------------------------------------------------------------------------------------------------------------------------------ |
+| `W8.1` | Port and review required-user-verification registration/authentication primitives in `@emdash-cms/auth`                                    |
+| `W8.2` | Implement the complete initial approver-object schema, identity transactions, credentials, challenges, decisions, audit, and cleanup alarm |
+| `W8.3` | Implement approver DID proof and short-lived approver sessions                                                                             |
+| `W8.4` | Implement multiple named passkeys, counter handling, revocation, and credential-safe serializers                                           |
+| `W8.5` | Define and compute the canonical approval digest and create single-use challenges                                                          |
+| `W8.6` | Verify approve/reject assertions, return idempotent receipts, validate current profile membership, and deliver the Workflow event          |
+| `W8.7` | Invalidate outstanding challenges on rejection, cancellation, expiry, digest change, or credential revocation                              |
+
+### Acceptance criteria
+
+- One approver DID routes to one object and can own multiple independently revocable credentials.
+- Registration and authentication require user verification.
+- OAuth identity must equal the DID named by the approver session and current profile.
+- Challenges are random, digest-bound, single-use, origin/RP-bound, and expire.
+- Cloned/counter-regressed, revoked, unknown, non-UV, wrong-origin, wrong-digest, replayed, and expired assertions fail closed.
+- The same valid decision replay returns the same receipt; a conflicting decision under the same key fails.
+- A stale approval receipt cannot authorize publication after any digest input changes.
+
+### Parallelism
+
+Shared auth primitives (`W8.1`) and object schema (`W8.2`) can run in parallel. DID/session integration (`W8.3`) and credential management (`W8.4`) follow the schema. Digest/decision integration (`W8.5` to `W8.7`) forms one stacked sequence.
+
+## W9 Independent installer enforcement
+
+Owner surface:
+
+- `packages/core/src/api/handlers/registry.ts`
+- registry install/update tests
+- minimal admin provenance presentation only when required for consent
+- query-count snapshots if behavior legitimately changes them
+
+Dependencies: G1 shared verification. It can proceed independently of W2 to W8.
+
+### Tasks
+
+| Task   | Work                                                                                                           |
+| ------ | -------------------------------------------------------------------------------------------------------------- |
+| `W9.1` | Replace duplicate install verification with shared record, bundle, manifest, and provenance reports            |
+| `W9.2` | Fetch authoritative profile/release records directly and evaluate current signed profile policy                |
+| `W9.3` | Enforce required provenance and fail supplied invalid/unverifiable provenance regardless of policy default     |
+| `W9.4` | Present provenance and policy status in install/update consent without trusting service or aggregator verdicts |
+| `W9.5` | Add install/update conformance fixtures shared with service output                                             |
+
+### Acceptance criteria
+
+- The installer accepts a valid delegated release without contacting the release service.
+- It rejects missing required provenance and every invalid/unverifiable supplied provenance case.
+- It detects artifact, manifest, declared-access, package, version, source, builder, and record substitution.
+- Aggregator envelope status and release-service state cannot change the verification result.
+- Update performs the same checks and requires renewed capability consent when access broadens.
+- No query is added to the logged-out public-render hot path.
+
+### Parallelism
+
+This is an independent stack after G1. Keep it separate from the service stack until shared report types stabilize, then rebase onto the merged contract PRs.
+
+## W10 Clients and web surfaces
+
+Owner surface:
+
+- `packages/registry-client/src/release-service/`
+- `packages/plugin-cli/`
+- a new official GitHub Action package or action directory
+- `apps/release-service/src/ui/`
+
+Dependencies: stable APIs from W4 to W8 and W2 Access roles.
+
+### Tasks
+
+| Task    | Work                                                                                                                                        |
+| ------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
+| `W10.1` | Add typed API client, polling, stable error mapping, and idempotency helpers                                                                |
+| `W10.2` | Build the official GitHub Action for OIDC, submission, status, approval URL, and terminal output                                            |
+| `W10.3` | Add CLI commands for workflow connection, dry run, submit/status/cancel, and browser handoffs for delegated publishing and release approval |
+| `W10.4` | Build one Atmosphere account dashboard for publishing authority, connected GitHub workflows, releases, activity, and approval passkeys      |
+| `W10.5` | Build a plain-language release review with plugin permissions and expandable protocol, provenance, and workload evidence                    |
+| `W10.6` | Build Access operator status, pause, publisher lookup, suspension, revocation, reconciliation, and audit views                              |
+| `W10.7` | Make the surfaces localizable with Lingui and cover accessibility, keyboard, responsive, and Arabic-direction RTL behavior                  |
+
+### Acceptance criteria
+
+- CI needs no static secret and prints stable intent/published outputs.
+- CLI and web clients show the same state and error semantics.
+- One identity-only OAuth flow creates both application sessions; the main interface does not present publisher and approver as separate logins.
+- Publisher UI cannot access another publisher shard.
+- Approval UI exposes enough immutable evidence to identify package, version, source, workflow, commit, artifact, provenance, policy, and access diff before passkey use.
+- Operator UI cannot call publisher or approver mutation routes.
+- All user-facing strings use Lingui message IDs with English fallbacks, and all layouts use logical direction-safe styling.
+- Browser tests cover publisher OAuth, Access roles, passkey enrolment/approval, cancellation, pause, and reconciliation.
+
+### Parallelism
+
+After the API client lands, Action/CLI (`W10.2` and `W10.3`), publisher UI (`W10.4`), approver UI (`W10.5`), and operator UI (`W10.6`) can run in four independent worktrees because they own separate directories. Localization/accessibility completion follows each UI increment rather than waiting for `W10.7` as a cleanup PR.
+
+## W11 Operations and self-hosting
+
+Owner surface:
+
+- `apps/release-service/src/directory/`
+- `apps/release-service/src/backup/`
+- operational metrics/logging modules
+- deployment configuration and runbooks
+
+Dependencies: W2 control plane and W3 publisher audit contract. Work can begin before publication is complete.
+
+### Tasks
+
+| Task    | Work                                                                                                                                                                                          |
+| ------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `W11.1` | Implement a rebuildable 256-shard Durable Object identity directory containing only actor kind, DID, and timestamps                                                                           |
+| `W11.2` | Implement encrypted publisher snapshots and append-only audit exports to R2 with bounded resumable scheduling                                                                                 |
+| `W11.3` | Implement encryption-key activation, background re-encryption, verification, retirement, and emergency rotation                                                                               |
+| `W11.4` | Add structured logs, metrics, alerts, health checks, correlation IDs, and privacy redaction                                                                                                   |
+| `W11.5` | Add per-publisher, per-repository, and per-workload abuse/rate controls without a global request bottleneck                                                                                   |
+| `W11.6` | Document and test Access, Durable Object, Workflow, verifier, Secrets Store, private publication-staging R2 with expiry, archive R2, Analytics Engine, and custom-domain self-host deployment |
+| `W11.7` | Write incident, revocation, PDS outage, ambiguous write, key compromise, shard restore, Workflow loss, and rollback runbooks                                                                  |
+
+### Acceptance criteria
+
+- Deleting the identity directory does not change authorization or release state, and registrations rebuild the projection.
+- Snapshot/export contains no plaintext secret and restore never revives revoked or expired authority automatically.
+- Key rotation can stop, resume, and prove every retained ciphertext readable before retirement.
+- Alerts cover publication pause, refresh failure, reconciliation backlog, shard migration failure, verifier failure, Access denial spikes, and audit/export gaps.
+- Abuse controls cannot let one publisher exhaust or block another publisher shard.
+- The publication-staging bucket is private, successful materialization deletes its objects, and a seven-day lifecycle rule removes abandoned objects.
+- A fresh self-host deployment passes the same service conformance suite as the hosted service.
+- Operators can execute every runbook without direct Durable Object SQLite edits.
+
+### Parallelism
+
+Directory work (`W11.1`), backup/key management (`W11.2` and `W11.3`), and observability/self-hosting (`W11.4` to `W11.7`) can run independently after the authoritative audit/event contract freezes. The directory remains non-authoritative and must not block the critical path.
+
+## W12 Conformance and security
+
+Owner surface:
+
+- cross-package conformance fixtures
+- workerd integration tests
+- browser tests
+- external test-PDS harness documentation
+- security review closure
+
+Dependencies: begins at G1 and expands after every gate.
+
+### Tasks
+
+| Task    | Work                                                                                                                                              |
+| ------- | ------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `W12.1` | Maintain one fixture corpus for records, bundles, provenance, workload claims, policy, approvals, and public/private errors                       |
+| `W12.2` | Build real workerd Durable Object and Workflow integration tests, including schema initialization, alarms, hibernation/restart, and retries       |
+| `W12.3` | Build browser OAuth, Access, WebAuthn, CSRF, isolation, localization, and RTL tests                                                               |
+| `W12.4` | Build controlled real-PDS and GitHub-OIDC end-to-end tests for hosted and self-host deployments                                                   |
+| `W12.5` | Add adversarial and fault-injection tests for replay, concurrency, substitution, SSRF, token leakage, ambiguous writes, pause races, and key loss |
+| `W12.6` | Run backup/restore, encryption rotation, Access compromise, delegation revocation, Workflow loss, PDS outage, and rollback drills                 |
+| `W12.7` | Complete external security review and track closure by severity                                                                                   |
+
+### Acceptance criteria
+
+- Every security invariant has at least one test that fails when its enforcement is removed.
+- Node and workerd share protocol fixtures but exercise their real runtime integrations.
+- After the first deployment, each Durable Object schema change adds an upgrade test from retained deployed state.
+- Fault injection at every external side-effect boundary converges to an allowed state.
+- Browser tests prove authentication-realm and publisher isolation, not only successful navigation.
+- Hosted and self-hosted end-to-end tests publish and independently install the same release.
+- No unresolved critical/high external-review finding remains at production launch.
+
+## Worktree and task strategy
+
+Implementation is consolidated in one integration worktree and one seven-layer `gh-stack`. The complete stack must pass locally before any branch is pushed or any replacement PR is opened.
+
+Each branch is a review boundary and may contain several focused commits. All seven branches merge as one unit, and no branch is a supported deployment target by itself.
+
+### Consolidated seven-layer stack
+
+| Layer | Branch                                   | Review scope                                                                   |
+| ----- | ---------------------------------------- | ------------------------------------------------------------------------------ |
+| 1     | `feat/drs-review-01-foundation`          | Worker shell, G0 harness, exact scope, OAuth metadata, encryption, and CI      |
+| 2     | `feat/drs-review-02-authority-admission` | Publisher identity and custody, workload identity, intents, and admission      |
+| 3     | `feat/drs-review-03-approvals`           | Required-UV passkeys, approver shards, and digest-bound decisions              |
+| 4     | `feat/drs-review-04-verification`        | Isolated verification, authoritative records, installer trust, and consent     |
+| 5     | `feat/drs-review-05-publication-product` | Access control, publication and reconciliation, clients, Action, CLI, and UI   |
+| 6     | `feat/drs-review-06-operations`          | Directory, abuse controls, archive/restore, encryption operations, and runbook |
+| 7     | `feat/drs-review-07-integration`         | Compatibility, browser conformance, product completion, specifications, and CI |
+
+Lower-layer fixes are committed on the owning branch and cascaded with `gh stack rebase --upstack`. Do not amend or force-push an open PR except when a rebase requires replacing its branch history.
+
+### Original workstream ownership
+
+The following worktree names record the original parallel decomposition. They are retained to map the numbered acceptance criteria to their owning surfaces; they are not active branches or PRs.
+
+| Lane            | Suggested worktree       | Suggested branch                 | Initial scope                                                 |
+| --------------- | ------------------------ | -------------------------------- | ------------------------------------------------------------- |
+| Coordinator     | `emdash-drs-integration` | `feat/drs-integration`           | Spec, dependency coordination, root workspace/CI, final gates |
+| Feasibility     | `emdash-drs-w0`          | `docs/drs-feasibility`           | W0 evidence and RFC updates                                   |
+| Contracts       | `emdash-drs-w1`          | `feat/drs-contracts`             | W1 packages and fixtures                                      |
+| Platform        | `emdash-drs-w2`          | `feat/drs-platform`              | W2 app scaffold, bindings, Access, control object             |
+| Publisher state | `emdash-drs-w3`          | `feat/drs-publisher-do`          | W3 publisher object only                                      |
+| OAuth           | `emdash-drs-w4`          | `feat/drs-oauth`                 | W4 OAuth and encryption only                                  |
+| Workload        | `emdash-drs-w5`          | `feat/drs-github-oidc`           | W5 OIDC, workload policy, admission                           |
+| Verification    | `emdash-drs-w6`          | `feat/drs-verification-workflow` | W6 Workflow and verifier                                      |
+| Publication     | `emdash-drs-w7`          | `feat/drs-publication`           | W7 PDS write/reconciliation                                   |
+| Approval        | `emdash-drs-w8`          | `feat/drs-approval`              | W8 approver object/passkeys                                   |
+| Installer       | `emdash-drs-w9`          | `feat/drs-installer-policy`      | W9 core install/update enforcement                            |
+| Clients         | `emdash-drs-w10`         | `feat/drs-clients`               | W10 API client, Action, CLI, UIs split further as needed      |
+| Operations      | `emdash-drs-w11`         | `feat/drs-operations`            | W11 projection, backup, observability, self-hosting           |
+| Conformance     | `emdash-drs-w12`         | `test/drs-conformance`           | W12 shared cross-component tests                              |
+
+These names describe logical slots, not permission to keep all worktrees active. Limit active implementation worktrees to the current execution wave.
+
+### Original dependency lanes
+
+The initial plan proposed the following independent stacks:
+
+```text
+Contract stack:
+  main -> drs-contracts -> drs-record-verification
+
+Service stack:
+  main -> drs-platform -> drs-publisher-do -> drs-oauth
+       -> drs-intent-workflow -> drs-publication
+
+Approval stack:
+  merged drs-publisher-do -> drs-approver-do -> drs-approval-integration
+
+Consumer stack:
+  merged drs-contracts -> drs-installer-policy
+
+Operations stack:
+  merged drs-platform/publisher audit contract -> drs-operations
+```
+
+The consolidated stack above replaces these lanes. They remain useful only for tracing each workstream's dependency direction.
+
+### `gh-stack` PR workflow
+
+Git worktrees own implementation branches. `gh-stack` owns the corresponding PR dependency graph and merge operation once branches reach the PR stage.
+
+Before creating stacks, configure the repository for non-interactive operation:
+
+```sh
+git config rerere.enabled true
+git config remote.pushDefault origin
+```
+
+The repository has multiple remotes, so every `gh stack` command that accepts a remote must pass `--remote origin` unless `remote.pushDefault` has already been verified.
+
+Create each template-compliant PR with its explicit parent branch, then link the existing PRs into the local stack order:
+
+1. Push each worktree branch explicitly.
+2. Create its ready-for-review PR with the correct parent branch and a fully completed `.github/PULL_REQUEST_TEMPLATE.md` body.
+3. Link the existing branch PRs into a stack from bottom to top.
+
+For example, link the first layers after their PRs exist:
+
+```sh
+gh stack link --base main --remote origin \
+	feat/drs-review-01-foundation \
+	feat/drs-review-02-authority-admission \
+	feat/drs-review-03-approvals
+```
+
+`gh stack link` finds the existing PRs, corrects their base branches, and creates or updates the GitHub stack without adding local stack state. Do not let it create a PR with an auto-generated body; every EmDash PR must use the repository template.
+
+Use the non-interactive view command for status and automation:
+
+```sh
+gh stack view --json
+```
+
+Never run `gh stack view` without `--json`. Never run `gh stack checkout`, `gh stack init`, or `gh stack add` without an explicit target branch or PR. If a stack is checked out into a dedicated integration worktree, use `gh stack sync --remote origin` for routine parent rebases and `gh stack rebase --continue` or `--abort` for conflict recovery.
+
+When review finds a lower-layer issue, fix it on the lower branch, then cascade the change upward. Do not place a protocol, schema, or API fix in a dependent UI or integration PR merely to avoid rebasing.
+
+After every PR in a stack is ready and satisfies its gate, merge through `gh-stack`, not `gh pr merge`:
+
+```sh
+gh stack merge <stack-number> --yes --squash
+```
+
+Use the repository's selected merge method if it differs from squash. Stack merge is all-or-nothing unless the repository's merge queue processes the PRs separately. Review completion, PR size, or an intermediate branch passing CI does not justify a partial merge. Scope a partial merge to a PR number only when the plan defines that PR as an independently usable integration gate.
+
+Do not add one branch to multiple stacks. When an independent stack needs a merged contract, rebase it onto updated `main`; do not share the contract branch between stacks.
+
+### Retired foundation micro-stack
+
+The first implementation used the following bottom-to-top branch chain:
+
+```text
+main
+└── feat/drs-g0-conformance
+    └── feat/drs-platform-oauth-metadata
+        └── feat/drs-envelope-encryption
+            └── feat/drs-publisher-do-oauth-custody
+                └── feat/drs-publisher-refresh-operations
+                    └── feat/drs-oauth-custody-adapter
+                        └── feat/drs-publisher-application-sessions
+                            └── feat/drs-confidential-oauth-callback
+```
+
+These PRs were closed and replaced by layers 1 and 2 of the consolidated stack. They remain donor history only.
+
+### Retired Access and control micro-stack
+
+The first implementation used this dependent chain:
+
+```text
+feat/drs-confidential-oauth-callback
+└── feat/drs-access-auth
+    └── feat/drs-service-control-do
+        └── feat/drs-service-control-api
+```
+
+PRs #2649 to #2651 were closed and replaced by layer 5 of the consolidated stack.
+
+### Retired workload identity micro-stack
+
+PRs #2653, #2654, #2656, #2657, and #2658 were closed and replaced by layer 2. Their valid review findings are incorporated into the consolidated implementation.
+
+### Retired verifier micro-stack
+
+PRs #2659 and #2660 were closed and replaced by layer 4. The isolated verifier remains a separate Worker with no OAuth, Access, Durable Object, service-control, or secret bindings.
+
+### Original planned stacks
+
+| Stack                     | Bottom-to-top branches                                                                             | Merge gate                                       |
+| ------------------------- | -------------------------------------------------------------------------------------------------- | ------------------------------------------------ |
+| **Contracts**             | `feat/drs-contracts` -> `feat/drs-record-verification`                                             | G1                                               |
+| **Platform state**        | `feat/drs-platform` -> `feat/drs-publisher-do` -> `feat/drs-publisher-operations`                  | G2                                               |
+| **Publisher authority**   | `feat/drs-encryption` -> `feat/drs-oauth` -> `feat/drs-github-oidc` -> `feat/drs-intent-admission` | G2/G3 prerequisites                              |
+| **Automatic publication** | `feat/drs-verifier` -> `feat/drs-verification-workflow` -> `feat/drs-publication`                  | G3                                               |
+| **Independent consumer**  | `feat/drs-installer-policy`                                                                        | G4; independent stack rooted on merged contracts |
+| **Approval**              | `feat/drs-required-uv` -> `feat/drs-approver-do` -> `feat/drs-approval-integration`                | G5                                               |
+| **Clients**               | `feat/drs-api-client` -> `feat/drs-github-action` -> `feat/drs-cli`                                | G5/G6                                            |
+| **Publisher UI**          | `feat/drs-publisher-ui` -> `feat/drs-approver-ui`                                                  | G5/G6                                            |
+| **Operator UI**           | `feat/drs-operator-ui`                                                                             | G6; independent after Access APIs merge          |
+| **Operations**            | `feat/drs-backup` -> `feat/drs-observability` -> `feat/drs-self-hosting`                           | G6                                               |
+| **Conformance**           | `test/drs-conformance` -> `test/drs-recovery-drills`                                               | G7                                               |
+
+The consolidated seven-layer stack supersedes this table.
+
+### Worktree task brief
+
+Every delegated task receives:
+
+1. Objective and non-goals.
+2. Exact base branch or parent PR.
+3. Allowed file/directory ownership.
+4. Interfaces it may consume and interfaces it may change.
+5. Numbered acceptance criteria from this plan.
+6. Required tests and commands.
+7. Donor commits or files that may be consulted.
+8. Explicit handoff artifacts: commits, test output, remaining risks, and migration notes.
+
+If the task discovers a required change outside its file ownership, it reports the dependency to the coordinator or lower stack owner. It does not edit another active worktree's surface.
+
+### Shared-file coordination
+
+These files are serialized through the coordinator or named owner:
+
+| Hotspot                                                          | Owner                                                |
+| ---------------------------------------------------------------- | ---------------------------------------------------- |
+| Root `package.json`, `pnpm-workspace.yaml`, and `pnpm-lock.yaml` | Coordinator                                          |
+| `.github/workflows/ci.yml`                                       | Coordinator after workstream test commands are known |
+| `apps/release-service/wrangler.jsonc` and generated Worker types | W2 platform owner                                    |
+| Registry lexicons and generated types                            | W1 contract owner                                    |
+| Package barrel exports                                           | Owning package's lowest stack branch                 |
+| Companion specification and this plan                            | Coordinator                                          |
+| Changeset consolidation                                          | Coordinator before final PR submission               |
+
+The platform configuration declares the Durable Object, Workflow, verifier, R2, Secrets Store, Analytics Engine, and static-asset bindings used by the complete service. Generated Worker types must match that configuration.
+
+### Parallel execution waves
+
+#### Wave 0: decisions
+
+Run in parallel:
+
+- W0 exact-scope/PDS validation;
+- W0 Workflow and Access validation;
+- W1 audit of already-merged shared verification.
+
+Merge condition: G0.
+
+#### Wave 1: foundations
+
+Run in parallel:
+
+- W1 contract and verification stack;
+- W2 platform/API/Access/control stack;
+- W12 fixture corpus skeleton.
+
+Merge condition: G1 and W2.1.
+
+#### Wave 2: durable ownership
+
+Run with at most three implementation worktrees:
+
+- W3 publisher object state machine;
+- W4 encryption and OAuth protocol, initially against an in-memory interface fixture;
+- W5 GitHub OIDC verifier and normalized workload types;
+- W9 installer enforcement may run separately after G1 if capacity permits.
+
+Integration order: W3, then W4/W5 adapters. Merge condition: G2.
+
+#### Wave 3: automatic release
+
+Run in parallel:
+
+- W6 isolated verifier;
+- W6 Workflow orchestration;
+- W9 installer enforcement;
+- W11 observability and backup design against frozen audit events.
+
+Then integrate W7 publication and reconciliation. Merge condition: G3, followed by G4.
+
+#### Wave 4: approval and clients
+
+Run in parallel:
+
+- W8 shared required-UV auth and approver object;
+- W10 typed client and GitHub Action;
+- W10 publisher UI;
+- W10 Access operator UI.
+
+Approval integration and approver UI follow the W8 digest/receipt contract. Merge condition: G5.
+
+#### Wave 5: operations and launch
+
+Run in parallel:
+
+- W11 optional projection and rebuild;
+- W11 backup/key rotation;
+- W11 self-hosting/runbooks;
+- W12 browser, real-PDS, fault-injection, and recovery suites.
+
+Merge condition: G6 and then G7.
+
+## Consolidated PR sequence
+
+The review stack contains seven PRs and merges as one unit. Each PR preserves the focused implementation and follow-up commits within its review scope:
+
+1. **Foundation** — Worker shell, G0 harness, exact scope, OAuth metadata, and encryption.
+2. **Publisher authority and admission** — publisher identity, confidential custody, application sessions, GitHub workload identity, publisher policy, intents, idempotency, and publication operations.
+3. **Approvals** — required-UV passkeys, approver shards, and digest-bound decisions.
+4. **Verification and independent consumption** — isolated verifier, provenance, authoritative records, installer enforcement, and verified consent.
+5. **Publication product flow** — Access authentication and service control, verification/publication Workflows, reconciliation, service API, typed client, Action, CLI, and base UIs.
+6. **Operations and recovery** — sharded directory, abuse limits, encrypted archive/restore, encryption operations, Secrets Store, metrics, runbook, and retry-safety fixes.
+7. **Integration and conformance** — Worker-safe package entrypoints, bounded state, browser conformance, compatibility fixes, completed product surfaces, specifications, and the application CI gate.
+
+## Definition of done for every implementation task
+
+- Behavior and failure behavior both have tests that would fail if enforcement were removed.
+- After the first deployment, Durable Object storage changes use forward-only, restartable application schema migrations.
+- External effects have idempotency and reconciliation before connection to real authority.
+- Public errors use stable codes and contain no provider payload, secret, assertion, stack trace, or private evidence.
+- Authentication and authorization are tested independently.
+- New API lists use cursor pagination and bounded limits.
+- New user-facing strings remain localizable through Lingui and layouts pass RTL review.
+- Published-package changes include a proportional changeset.
+- The affected package/app builds and typechecks.
+- `pnpm lint:quick`, targeted Node/workerd/browser tests, formatting, and `git diff --check` pass.
+- The task handoff records exact verification, unrun checks, migration effects, and remaining risk.
+
+## Final acceptance checklist
+
+### Protocol and authority
+
+- [ ] RFC #1870 is accepted with the final actor, scope, policy, provenance, and approval contracts.
+- [ ] The Bluesky PDS implementation at npmX and Cirrus pass exact delegated-scope, refresh, and revocation conformance.
+- [ ] No broad scope, update, delete, or profile-write path exists in retained service code.
+- [ ] Shared verification is the only implementation used by service and installer.
+
+### Durable state
+
+- [ ] Publisher and approver state route deterministically by canonical DID.
+- [ ] State-machine, reservation, idempotency, operation-token, alarm, schema-initialization, and audit tests pass in workerd.
+- [ ] Workflows and the identity directory can be lost without losing canonical authorization or terminal release state.
+- [ ] No Durable Object critical section spans external I/O.
+
+### Authentication
+
+- [ ] CI, publisher, approver, and Access operator authentication realms are isolated.
+- [ ] OAuth delegation is encrypted, refresh-safe, revocable, and exact-scope.
+- [ ] GitHub OIDC policy rejects every mismatched claim dimension.
+- [ ] Access roles cannot publish, approve, or create publisher authority.
+
+### Verification and publication
+
+- [ ] Valid non-escalating release publishes automatically.
+- [ ] Invalid record, bundle, manifest, access, artifact, provenance, source, builder, workload, or policy input never reaches publication.
+- [ ] URL-source package and image bytes become checksum-bound PDS blobs, and the final release record contains no artifact URLs.
+- [ ] Durable blob receipts and canonical record JSON precede the publication permit and `createRecord`; successful materialization removes staged R2 bytes.
+- [ ] Ambiguous writes converge through deterministic reconciliation.
+- [ ] Pause, suspension, revocation, profile change, baseline change, and approval invalidation close every pre-write race.
+
+### Approval
+
+- [ ] `confirmation: always` and access escalation require an eligible approver.
+- [ ] Passkey registration and decisions require user verification.
+- [ ] Challenge, digest, credential, identity, replay, expiry, revocation, and counter attacks fail closed.
+- [ ] Human approval cannot override failed verification.
+
+### Independent consumption and moderation
+
+- [ ] A clean installer independently accepts valid output and rejects invalid service output.
+- [ ] Installer behavior does not depend on release-service or aggregator verdicts.
+- [ ] Successfully published releases still follow independent metadata-labeller visibility policy.
+
+### Operations
+
+- [ ] Pause, publisher suspension, delegation revocation, reconciliation, key rotation, backup/export, restore, and rollback work through supported tools.
+- [ ] The private publication-staging R2 bucket has the documented seven-day expiry rule and contains no objects from successful materializations.
+- [ ] The identity directory is rebuildable and non-authoritative.
+- [ ] Hosted and self-hosted deployments pass the same conformance suite.
+- [ ] External security review has no unresolved critical/high findings.
diff --git a/docs/technical-specs/delegated-release-service-operations.md b/docs/technical-specs/delegated-release-service-operations.md
index a797001e94..d98caec73e 100644
--- a/docs/technical-specs/delegated-release-service-operations.md
+++ b/docs/technical-specs/delegated-release-service-operations.md
@@ -7,29 +7,31 @@ This runbook covers self-host deployment, routine maintenance, and incident reco
 - Publisher and approver Durable Objects are authoritative for retained authority and decisions.
 - The identity directory is a non-authoritative projection split across 256 Durable Objects. Deleting it does not change authority, release state, or approval state.
 - The initial deployment does not use D1. The operator console performs direct DID lookup and uses the sharded identity directory for fleet maintenance.
+- `PUBLICATION_STAGING` is private transient storage. Published release records reference only publisher-PDS blobs; they never reference staging objects or artifact source URLs.
 - R2 snapshot pages are encrypted before storage. Audit export objects contain only the sanitized `audit_events.public_payload` contract.
 - Restore requires a suspended publisher and a complete, decryptable archive manifest.
-- Restore clears retained OAuth authority, disables workload policies, and converts nonterminal intents to `failed`. A publisher must reauthorize before publication resumes.
+- Restore clears retained OAuth authority and pending workflow pairings, disables workload policies, and converts nonterminal intents to `failed`. A publisher must reauthorize before publication resumes.
 - Operators use supported Access routes and clients. Runbooks never require direct Durable Object SQLite edits.
 
 ## Cloudflare resources
 
 The release-service Worker expects the following resources.
 
-| Binding                      | Resource                         | Purpose                                                                                       |
-| ---------------------------- | -------------------------------- | --------------------------------------------------------------------------------------------- |
-| `PUBLISHER_DO`               | `PublisherDurableObject`         | Per-publisher delegation, workload, intent, publication, audit, restore, and rate-limit state |
-| `APPROVER_DO`                | `ApproverDurableObject`          | Per-approver sessions, passkeys, decisions, audit, and encrypted OAuth transactions           |
-| `SERVICE_CONTROL_DO`         | `ServiceControlDurableObject`    | Global pause mode, publisher suspension, publication permits, and operator audit              |
-| `IDENTITY_DIRECTORY_DO`      | `IdentityDirectoryDurableObject` | Non-authoritative publisher and approver inventory, sharded by DID hash                       |
-| `RELEASE_INTENT_WORKFLOW`    | Workflow                         | Verification, approval wait, publication, and reconciliation                                  |
-| `PUBLISHER_ARCHIVE_WORKFLOW` | Workflow                         | Bounded, retryable publisher snapshot and audit export                                        |
-| `RELEASE_VERIFIER`           | Service binding                  | Isolated artifact and provenance verification                                                 |
-| `OPERATIONS_ARCHIVE`         | R2 bucket                        | Encrypted publisher snapshot pages and append-only sanitized audit pages                      |
-| `OPERATIONS_METRICS`         | Analytics Engine dataset         | Privacy-safe operational alert events                                                         |
-| `ASSETS`                     | Worker static assets             | Publisher, approver, and Access operator web surfaces                                         |
-
-The initial Durable Object migration tag is `v1`. It contains every class and table required before the first deployment.
+| Binding                      | Resource                         | Purpose                                                                                                       |
+| ---------------------------- | -------------------------------- | ------------------------------------------------------------------------------------------------------------- |
+| `PUBLISHER_DO`               | `PublisherDurableObject`         | Per-publisher delegation, workflow pairing, policy, intent, publication, audit, restore, and rate-limit state |
+| `APPROVER_DO`                | `ApproverDurableObject`          | Per-approver sessions, passkeys, decisions, audit, and encrypted OAuth transactions                           |
+| `SERVICE_CONTROL_DO`         | `ServiceControlDurableObject`    | Global pause mode, publisher suspension, publication permits, and operator audit                              |
+| `IDENTITY_DIRECTORY_DO`      | `IdentityDirectoryDurableObject` | Non-authoritative publisher and approver inventory, sharded by DID hash                                       |
+| `RELEASE_INTENT_WORKFLOW`    | Workflow                         | Verification, approval wait, publication, and reconciliation                                                  |
+| `PUBLISHER_ARCHIVE_WORKFLOW` | Workflow                         | Bounded, retryable publisher snapshot and audit export                                                        |
+| `RELEASE_VERIFIER`           | Service binding                  | Isolated artifact and provenance verification                                                                 |
+| `PUBLICATION_STAGING`        | Private R2 bucket                | Transient checksum-verified package and image bytes awaiting PDS blob upload                                  |
+| `OPERATIONS_ARCHIVE`         | R2 bucket                        | Encrypted publisher snapshot pages and append-only sanitized audit pages                                      |
+| `OPERATIONS_METRICS`         | Analytics Engine dataset         | Privacy-safe operational alert events                                                                         |
+| `ASSETS`                     | Worker static assets             | Publisher, approver, and Access operator web surfaces                                                         |
+
+The initial Durable Object migration tag is `v1`. It contains every class required before the first deployment. Each publisher object initializes its complete schema, including short-lived `workflow_pairings`, before serving requests.
 
 ## Configure a self-hosted deployment
 
@@ -41,7 +43,7 @@ Set the following non-secret variables in `apps/release-service/wrangler.jsonc`:
 - `DEPLOYMENT_ID`: a stable identifier that remains unchanged across deployments and key rotations;
 - `OAUTH_REDIRECT_URIS`: a JSON array containing `${PUBLIC_ORIGIN}/oauth/callback`;
 - `ACCESS_TEAM_DOMAIN`: the exact HTTPS issuer origin for Cloudflare Access, including a custom Access hostname when configured, without a port or path;
-- `ACCESS_VIEWER_AUD`, `ACCESS_REVIEWER_AUD`, and `ACCESS_ADMIN_AUD`: the distinct Access application audiences described below.
+- `ACCESS_VIEWER_AUD`, `ACCESS_REVIEWER_AUD`, and `ACCESS_ADMIN_AUD`: a distinct Access application audience or a JSON array of up to eight distinct audiences for the role described below. Use multiple applications when the exact route set exceeds the Access destination limit.
 
 Changing `DEPLOYMENT_ID` makes existing encryption envelopes unreadable because the deployment identifier is part of the authenticated encryption context.
 
@@ -56,6 +58,7 @@ Create Access applications whose path specificity supplies the audience required
 | Admin    | `/admin/api/pause`, `/admin/api/publishers/*`, `/admin/api/approvers/*`                      | Pause publication, suspend or revoke publishers, rotate keys, archive, and restore |
 
 The Worker verifies the Access JWT issuer and the route-specific audience. Access group claims do not grant a role inside the Worker.
+Every configured audience must be unique across all three roles.
 
 ### Secrets
 
@@ -73,12 +76,25 @@ The base configuration uses Worker secret bindings. `loadConfiguration()` also a
 
 ### R2 and verifier
 
-Create the private operations bucket before deploying the service.
+Create separate private buckets for transient publication staging and encrypted operations archives before deploying the service.
 
 ```sh
+pnpm exec wrangler r2 bucket create emdash-release-service-publication-staging
 pnpm exec wrangler r2 bucket create emdash-release-service-operations
 ```
 
+Add a seven-day expiry rule for the deterministic `publication/` staging prefix:
+
+```sh
+pnpm exec wrangler r2 bucket lifecycle add \
+  emdash-release-service-publication-staging \
+  expire-publication-staging \
+  publication/ \
+  --expire-days 7
+```
+
+The Workflow deletes staging objects after it commits every PDS blob receipt and the canonical blob-only release record in the publisher Durable Object. The lifecycle rule is a recovery bound for objects left by an interrupted Workflow; it does not replace normal cleanup. Keep both buckets private and do not attach a public custom domain.
+
 Deploy the release verifier under the service name `emdash-release-verifier` before the release-service Worker. The release-service Worker calls it through the `RELEASE_VERIFIER` service binding rather than public HTTP.
 
 ### Validate the deployment artifact
@@ -93,15 +109,30 @@ pnpm build
 pnpm exec wrangler deploy --dry-run
 ```
 
-After deployment, `GET /health` must return `200` without loading configuration. `GET /ready` must return `200` only after configuration and the service-control Durable Object initialize successfully.
+After deployment, `GET /health` must return `200` without loading configuration. `GET /ready` returns `200` only after configuration loads, the service-control Durable Object initializes, and its active encryption-key version matches `ENCRYPTION_KEYRING.current`.
+
+Test the account and workflow connection journey against the deployed origin:
+
+1. Sign in once with a test Atmosphere account and confirm the account dashboard loads publishing state, connected workflows, recent releases, activity, and any existing approval passkeys.
+2. Start a workflow connection for a test plugin package.
+3. Add the generated temporary step to a test GitHub Actions job with `id-token: write`, then run it once.
+4. Confirm the browser shows the expected repository, workflow file, branch or tag, and environment. Verify no workload policy exists before browser confirmation.
+5. Confirm the connection and verify the resulting workload policy contains the immutable GitHub repository and owner IDs plus the displayed workflow, ref, and environment.
+6. Remove the temporary connection step and run a delegated-release dry run from the connected job.
+
+List the staging lifecycle rules and confirm that `expire-publication-staging` targets the `publication/` prefix with a seven-day expiry:
+
+```sh
+pnpm exec wrangler r2 bucket lifecycle list emdash-release-service-publication-staging
+```
 
 ## Operations directory
 
-Successful publisher and approver OAuth callbacks register the DID in one of 256 directory Durable Objects. Directory registration failure emits `directory_failure` but does not block OAuth or create authority.
+Successful publisher and approver OAuth callbacks register the DID in one of 256 directory Durable Objects before issuing an application session or retaining release delegation. Directory registration failure emits `directory_failure`, fails the callback, and leaves no new application session or delegated authority.
 
 The operator console skips empty partitions when listing publishers or approvers. API clients can resume one partition at a time with `ReleaseServiceOperatorClient.listDirectory()`. Fleet operations must retain the returned cursor until it becomes absent.
 
-Rebuild a missing directory as publishers and approvers complete OAuth again. Directory rows are not evidence of active delegation or approver eligibility; query each authoritative shard before acting.
+Rebuild a missing directory as publishers and approvers complete OAuth again. Directory rows are not evidence of active delegation or approver eligibility; query each authoritative shard before acting. Do not start fleet key verification or retire a key until every lost directory partition has been rebuilt.
 
 ## Rotate encryption keys
 
@@ -110,23 +141,22 @@ Rebuild a missing directory as publishers and approvers complete OAuth again. Di
 1. Pause publication in the operator console.
 2. Add the new key version to `ENCRYPTION_KEYRING`, retain every old key, and set `current` to the new version.
 3. Deploy the keyring change without removing old keys.
-4. Enumerate every publisher and approver from the operations directory.
-5. For each DID, run the relevant rotation operation from an empty cursor until it reports `Verified`. A compare-and-set race changes the resume cursor to a required rescan, so completion cannot discard a race reported by an earlier page.
-6. Repeat a full scan from an empty cursor. Every page must report the new target version, zero races, and completion.
-7. Confirm that no `refresh_failure`, `archive_gap`, or `restore_failure` event appeared during the scan.
-8. Remove the retired key version from `ENCRYPTION_KEYRING` and deploy the reduced keyring.
-9. Run another full verification scan. Missing retained key material must fail with `ENCRYPTION_OPERATION_FAILED`.
-10. Restore the previous service mode.
+4. Select **Activate configured key**. The service records the previous version as readable and keeps readiness closed until the configured and controlled active versions match.
+5. Enter the previous version and select **Start fleet verification**. The Workflow scans every publisher and approver in all 256 directory partitions, rotates retained ciphertext with compare-and-set writes, and requires two consecutive zero-change passes for each shard.
+6. Refresh the key status until the Workflow verification record appears. Confirm that no `refresh_failure`, `archive_gap`, or `restore_failure` event appeared during the campaign.
+7. Remove the previous version from `ENCRYPTION_KEYRING` and deploy the reduced keyring.
+8. Refresh the key status, enter the removed version, and select **Retire removed key**. Retirement fails unless publication remains paused, the active version has a completed fleet verification, and the retired version is absent from the configured keyring.
+9. Restore the previous service mode.
 
-Rotation decrypts and re-encrypts outside the Durable Object storage transaction. Each replacement uses a ciphertext compare-and-set, so concurrent refresh or OAuth completion wins safely and appears as a race that requires another scan.
+Rotation decrypts and re-encrypts outside the Durable Object storage transaction. Each replacement uses a ciphertext compare-and-set, so concurrent refresh or OAuth completion wins safely and causes another verification pass. The per-publisher and per-approver rotation controls remain available for diagnosing a failed Workflow shard.
 
 ### Compromised encryption key
 
 1. Pause publication immediately.
 2. Revoke affected publisher delegation when retained state cannot be trusted.
 3. Activate a new encryption key while retaining the compromised key only for the bounded rotation window.
-4. Rotate and verify every directory entry.
-5. Remove the compromised key after a complete zero-race verification pass.
+4. Run fleet verification and wait for its recorded two-pass result.
+5. Remove and retire the compromised key after verification completes.
 6. Require reauthorization for every publisher whose ciphertext could not be proved readable and authentic.
 
 ## Archive publisher shards
@@ -139,6 +169,8 @@ Use `Start archive workflow` in the operator console or `ReleaseServiceOperatorC
 4. sanitized audit events;
 5. an encrypted completion manifest.
 
+Short-lived workflow pairings are not archived. A restored publisher must create and confirm a new pairing before replacing a disabled workload policy.
+
 Snapshot objects use the following prefix:
 
 ```text
@@ -194,7 +226,7 @@ Archive audit pages remain in R2. Restore begins a new shard audit history with
 
 1. Pause admission when new authorization or refresh requests fail broadly.
 2. Pause publication when refresh or PDS writes cannot be distinguished from partial completion.
-3. Do not replace exact create-only scope with a broader permission.
+3. Do not replace the exact delegated scope with `transition:generic` or another broad permission.
 4. Resume after the provider succeeds and retained sessions pass refresh verification.
 
 ### Ambiguous PDS write
@@ -267,11 +299,11 @@ Configure alert queries for these event names:
 | `archive_gap`             | Resume the failed archive page and verify the manifest          |
 | `restore_failure`         | Keep the publisher suspended and inspect archive/page ordering  |
 | `configuration_failure`   | Keep readiness failed and correct variables or secrets          |
-| `directory_failure`       | Repair projection registration without changing authority       |
+| `directory_failure`       | Retry authorization so registration completes before authority  |
 | `intent_rate_limited`     | Review workload, repository, and publisher abuse patterns       |
 
 Alert delivery is deployment-specific. A production launch requires tested notification routing and an on-call owner for every event above.
 
 ## Conformance after deployment
 
-Run the same G0 create-only, refresh, and revocation probes against npmX and Cirrus. Then run the service conformance suite against the hosted and self-hosted origins. Deployment is not complete until both origins publish the same fixture and a clean installer independently verifies and installs it.
+Run the same G0 create-only, blob-upload, refresh, and revocation probes against npmX and Cirrus. Then run the service conformance suite against the hosted and self-hosted origins. Deployment is not complete until both origins publish the same blob-only fixture, the source URLs are absent from its artifact descriptors, and a clean installer independently verifies and installs it.
diff --git a/docs/technical-specs/delegated-release-service.md b/docs/technical-specs/delegated-release-service.md
new file mode 100644
index 0000000000..b1494d0f1f
--- /dev/null
+++ b/docs/technical-specs/delegated-release-service.md
@@ -0,0 +1,699 @@
+# Delegated release service
+
+Status: Implemented locally; deployment conformance pending
+
+Related design: [RFC PR #1870](https://github.com/emdash-cms/emdash/pull/1870)
+
+## Summary
+
+The delegated release service lets a plugin publisher authorize automated releases without placing an AT Protocol account credential in continuous integration. The publisher grants the service create-only access to the package-release collection and bounded blob-upload access. A GitHub Actions workflow authenticates to the service with OpenID Connect (OIDC) and submits a URL-source release record. The service verifies and stages those bytes, uploads them to the publisher's PDS, and creates a blob-only release record. The workflow receives either the published release or an intent waiting for passkey approval.
+
+The service is a delegated writer, not a registry or trust authority. It cannot edit package profiles, overwrite releases, serve public or long-lived artifacts, moderate listings, or make an invalid release installable. EmDash installers independently verify the publisher's records, artifact, manifest, provenance, and signed package policy.
+
+Canonical service state is sharded across SQLite-backed Durable Objects. A `PublisherDurableObject` owns each publisher's delegations, workload policies, release intents, reservations, and audit history. An `ApproverDurableObject` owns each approver's passkeys and challenges. A small `ServiceControlDurableObject` owns global pause and key-version state. Cloudflare Workflows orchestrate long-running verification and approval waits but do not replace the Durable Objects as the source of truth.
+
+## Goals
+
+- Publish an immutable sandboxed-plugin release from GitHub Actions without a stored AT Protocol credential in the runner.
+- Restrict the service's durable AT Protocol grant to creating records in the active release collection.
+- Bind every automated release to its source repository, workflow, commit, artifact, and provenance.
+- Require a user-verified passkey decision when signed package policy requires confirmation or declared access expands.
+- Preserve publisher ownership of package policy and approver membership in the publisher's PDS.
+- Let an EmDash installer reject invalid service output without consulting or trusting the service.
+- Provide a hosted service and the same Workers-based application for self-hosting.
+- Support operator incident response through a Cloudflare Access-protected admin surface without giving operators publisher authority.
+
+## Non-goals
+
+- Native-plugin distribution.
+- Public or long-lived artifact or provenance hosting.
+- Plugin-listing or metadata moderation.
+- Code-quality or malware assessment beyond canonical bundle, manifest, and provenance verification.
+- Editing package profiles from the release service.
+- Non-GitHub workload issuers in the first release.
+- Quorum approval or signed approval receipts verifiable by installers.
+- Generic user-defined OIDC claim expressions.
+- Billing, organization management, or a general-purpose CI platform.
+- Making the aggregator authoritative for publisher records, policy, or provenance.
+
+## Actors and authentication
+
+The service has three external authentication mechanisms. Credentials from one mechanism never authorize another.
+
+| Actor                     | Authentication                                         | Authority                                                                                         |
+| ------------------------- | ------------------------------------------------------ | ------------------------------------------------------------------------------------------------- |
+| GitHub Actions workflow   | GitHub Actions OIDC                                    | Identify the repository, workflow, ref, and environment; submit an intent after browser pairing   |
+| Atmosphere account holder | AT Protocol OAuth plus an enrolled passkey when needed | Establish or revoke delegation, confirm a GitHub workflow, and approve or reject an exact release |
+| Service operator          | Cloudflare Access                                      | Observe, pause, suspend, revoke, retry, and recover the service                                   |
+
+Cloudflare Access protects `/admin/*` and the operator API. The Worker verifies the `Cf-Access-Jwt-Assertion` signature, team issuer, role-specific audience, time claims, token type, and human identity. Access-injected identity headers and the browser cookie are not sufficient by themselves. Operator mutations retain CSRF and idempotency protection.
+
+Deployments use separate Access policy and audience boundaries for three service roles:
+
+- `viewer` reads health, publisher state, intent state, and sanitized audit data;
+- `reviewer` cancels unpublished intents and triggers bounded reconciliation; and
+- `admin` changes service mode, suspends publishers, revokes retained authority, and operates key or recovery controls.
+
+Role names and audience bindings are stable application contracts. Each deployment assigns its operator groups to the appropriate Access policies; Access evaluates membership before forwarding the request. The Worker does not authorize from optional group claims because Access may trim custom claims to fit its cookie limit. No Access role can establish publisher delegation, authorize workload policy, enrol an approver, approve an intent, or publish a release.
+
+One identity-only OAuth flow proves control of an Atmosphere account and issues short-lived publisher and approver application sessions. The separate cookies and Durable Objects preserve the internal authority boundaries without requiring two user logins. Application sessions cannot write to the PDS. The separately authorized release delegation is encrypted and stored in the publisher's Durable Object.
+
+GitHub Actions OIDC tokens are audience-bound to the service. The service persists normalized claims and token identifiers, not the raw token.
+
+## Security invariants
+
+The implementation must preserve these invariants:
+
+1. CI never receives or stores an AT Protocol refresh token, DPoP key, app password, or delegated release session.
+2. The delegated grant is the exact scope returned by `getDelegatedReleasePermission()` from `@emdash-cms/registry-lexicons`: create-only release-record authority plus gzip-package and image-blob uploads.
+3. The service never requests or stores package-profile write scope.
+4. The delegated path exposes no update or delete operation for a release record.
+5. A package version maps to one deterministic record key and one reservation in the publisher shard.
+6. Publisher records are read directly from the DID-resolved PDS. Aggregator output is never an authority input.
+7. Supplied HTTPS artifact and provenance bytes pass the shared SSRF-safe fetcher and their signed checksums. Publication replaces every artifact URL with a checksum-bound PDS blob; the final artifact descriptors contain no source URL.
+8. Record, bundle, manifest, provenance, workload, policy, and access checks run after submission and again immediately before publication.
+9. Human approval cannot override failed verification. It authorizes only a valid release that policy requires a human to confirm.
+10. Approval is bound to the intent, workload claims, profile CID, baseline release CID, artifact and provenance checksums, declared-access diff, approver DID, and decision.
+11. Passkey approval requires WebAuthn user verification, not only user presence.
+12. A listed but unenrolled DID cannot approve. Enrolment and approval are separate ceremonies.
+13. An Access operator can remove or suspend authority but cannot create publisher authority, edit signed policy, enrol an approver, or approve a release.
+14. Durable Object state and a PDS write are never treated as one transaction. Ambiguous writes are reconciled by reading the deterministic key.
+15. OAuth sessions, DPoP keys, emails, and future webhook secrets are application-encrypted before persistence.
+16. Workflows, projections, and notification queues are recoverable coordination or read models, not canonical authorization state.
+
+## Protocol contracts
+
+### Delegated permission
+
+The active release collection and OAuth scope come from `@emdash-cms/registry-lexicons`:
+
+```ts
+const permission = getDelegatedReleasePermission();
+// permission.collection identifies the release NSID.
+// permission.scope grants only create access to that collection.
+```
+
+The service does not hard-code the experimental or future stable NSID. A namespace migration requires a new publisher grant because AT Protocol repository scope is collection-specific.
+
+The first release requests this granular permission directly rather than wrapping it in an AT Protocol permission set. Permission sets are useful when an application needs many permissions under one Lexicon namespace; this service needs one create-only repository permission. Direct scope keeps the effective authority visible in client metadata, stored delegation state, audit output, and conformance evidence. A future permission-set alias is acceptable only if every supported PDS resolves it to the identical collection and `create` action and the full authorization, refresh, and revocation matrix is repeated.
+
+The initial support matrix contains:
+
+- Bluesky PDS software hosted by npmX (`npmx.social`); and
+- Cirrus.
+
+Disposable accounts are available for both implementations. Credentials and recovery material remain outside the repository. Neither implementation is advertised as supported until its conformance run passes.
+
+The supported-PDS matrix must prove that each claimed implementation:
+
+- accepts a create in the release collection;
+- rejects an update to the created release;
+- rejects deletion through the delegated path;
+- rejects profile writes and writes to unrelated collections;
+- supports refresh and explicit revocation as claimed by the service; and
+- stops accepting refreshed authority after revocation and client-key removal according to the authorization server's documented behavior.
+
+There is no broad-scope fallback.
+
+### Signed package profile policy
+
+The package profile extension supplies the publisher-controlled policy:
+
+```ts
+interface PackageProfileExtension {
+	repository: string;
+	releasePolicy?: {
+		requireProvenance?: boolean;
+		confirmation?: "escalation-only" | "always";
+		approvers?: string[];
+	};
+}
+```
+
+The service normalizes omitted values to the protocol defaults. It validates the repository as a canonical HTTPS source URL and every approver as a DID. The release service can display this policy but cannot change it.
+
+The delegated path always requires supported provenance, even when `requireProvenance` is absent. The profile field communicates the publisher's requirement to every installer and non-delegated publisher. A supplied unsupported predicate is present-but-unverifiable and fails delegated publication.
+
+### Signed release provenance
+
+The release extension identifies the provenance document and the source it must describe:
+
+```ts
+interface ReleaseProvenance {
+	predicateType: string;
+	url: string;
+	checksum: string;
+	sourceRepository: string;
+	builderId: string;
+}
+```
+
+The first release understands SLSA provenance v1 in a Sigstore bundle. The provenance checksum covers the fetched provenance document. Its subject digest covers the package artifact. The source repository and builder identity must agree with the signed package profile, registered workload policy, GitHub OIDC claims, and provenance statement.
+
+### Service-local workload policy
+
+The publisher authorizes a service-local workload policy after proving the publisher DID:
+
+```ts
+interface GitHubWorkloadPolicy {
+	publisherDid: string;
+	packageSlug: string;
+	repository: string;
+	repositoryId: string;
+	repositoryOwnerId: string;
+	workflowRef: string;
+	allowedRefs?: string[];
+	allowedEnvironments?: string[];
+	active: boolean;
+	stateVersion: number;
+}
+```
+
+Repository and owner IDs preserve the authorization boundary across GitHub renames or name reuse. This policy narrows who may submit an intent. It cannot weaken the signed package policy or change publisher records.
+
+## Architecture
+
+```text
+GitHub Actions                         Publisher or approver browser
+      | OIDC                                      | AT Protocol OAuth
+      |                                           | WebAuthn when approving
+      v                                           v
++---------------------------------------------------------------------+
+| Release-service Worker                                             |
+| Public API, publisher UI, approver UI, Access-protected admin      |
++--------------+--------------------+--------------------+-------------+
+               |                    |                    |
+               v                    v                    v
+       PublisherDurableObject  ApproverDurableObject  ServiceControlDO
+          publisher DID shard    approver DID shard      service shard
+               |
+               | intent ID
+               v
+       ReleaseIntentWorkflow -------> isolated verifier Worker
+               |                              |
+               |                              v
+               |                     artifact/provenance hosts
+               v
+      private R2 staging -----> publisher PDS blobs and release record
+
+Operational projections:
+  OAuth callbacks -> 256 IdentityDirectoryDurableObject shards
+  DO snapshots and audit exports -> R2
+```
+
+### Release-service Worker
+
+The stateless Worker owns HTTP concerns:
+
+- route and method dispatch;
+- request parsing and size limits;
+- authentication-realm selection;
+- Access JWT, application session, CSRF, OIDC, and idempotency checks;
+- deterministic routing to Durable Objects;
+- static publisher, approver, and operator assets;
+- public health responses that expose no tenant data; and
+- stable API error envelopes and request IDs.
+
+Business state transitions live in Durable Object RPC methods, not route handlers.
+
+### `PublisherDurableObject`
+
+The Worker routes with `getByName(canonicalPublisherDid)`. The DID is the coordination atom because one AT Protocol session and PDS serialize authority for all packages owned by that publisher.
+
+The object owns:
+
+- publisher status and tenancy;
+- encrypted delegated OAuth session and key version;
+- workload policies;
+- release intents and immutable transition history;
+- package/version reservations;
+- immutable publication materialization plans, staged-object bindings, blob receipts, and final record JSON;
+- OIDC and request idempotency;
+- refresh and publication operation tokens;
+- publisher-scoped audit events; and
+- publisher-session revocation epochs.
+
+SQLite constraints enforce uniqueness for package/version reservations, workload-policy identity, intent idempotency, and transition sequence numbers. RPC methods perform synchronous SQLite transactions for related state changes. The object never holds `blockConcurrencyWhile()` across an external request.
+
+Slow external work uses a persistent operation-token protocol:
+
+```text
+Workflow -> beginPublication(intentId)
+PublisherDO -> transition to publishing; return generation-bound token
+Workflow -> refresh session and call the PDS
+Workflow -> completePublication(token, result)
+```
+
+Only the current token can complete the operation. The object schedules its one alarm for the earliest refresh, publication, expiry, or cleanup deadline. The alarm marks abandoned operations for reconciliation and schedules the next pending deadline.
+
+### `ApproverDurableObject`
+
+The Worker routes with `getByName(canonicalApproverDid)`. The object owns:
+
+- identity-proof transactions;
+- enrolled WebAuthn credentials;
+- credential names, counters, transports, creation, last use, and revocation;
+- approval challenges bound to an approval digest;
+- challenge expiry and single-use state; and
+- approver-scoped audit events.
+
+The object verifies a passkey decision and returns a receipt containing the approver DID, intent ID, digest, decision, credential ID, and verification time. The publisher object stores the receipt against the intent. Cross-object calls are replay-safe but are not treated as one transaction. Final verification checks that the approver DID is still authorized by the current profile.
+
+### `ServiceControlDurableObject`
+
+One low-traffic object owns:
+
+- service mode: `active`, `admission-paused`, or `publication-paused`;
+- active and readable encryption-key versions;
+- hosted-service publisher allowlist or suspension defaults;
+- operator mutation idempotency; and
+- global operational audit events.
+
+Intent admission checks the service mode. Every publication obtains a fresh publication permit immediately before the PDS write. A cached permit cannot authorize publication.
+
+### Release Workflow
+
+One Workflow instance orchestrates one intent. The instance ID is derived from the immutable intent ID. Step names are deterministic. Each step either reads or commits its result through the publisher object before proceeding.
+
+The Workflow owns:
+
+- durable retry timing;
+- isolated verification steps;
+- waiting for approval, rejection, cancellation, or expiry;
+- guarded URL-source staging, PDS blob upload, and durable materialization;
+- publication and ambiguous-write reconciliation; and
+- non-critical completion fan-out.
+
+The Workflow does not own the authoritative intent state. If Workflow state is lost after its retention period, the publisher object and audit history remain sufficient to determine the release state and start recovery.
+
+### Verifier Worker
+
+The verifier is a separate Worker reached through a service binding. It has no publisher OAuth binding, operator authentication secret, or Durable Object namespace. It:
+
+- fetches artifacts and provenance through the shared guarded fetcher;
+- enforces redirect, DNS, protocol, time, and size policy;
+- validates checksums and canonical bundle structure;
+- reconciles the bundled manifest with the proposed record;
+- verifies supported Sigstore/SLSA provenance; and
+- returns a bounded, serializable report without artifact bytes or secrets.
+
+Artifact and provenance hosting remain the publisher's responsibility.
+
+### Sharded identity directory
+
+Cross-publisher inventory uses 256 `IdentityDirectoryDurableObject` shards selected by a digest of the canonical DID. Successful publisher and approver OAuth callbacks register only the DID, actor kind, and timestamps.
+
+The directory is a non-authoritative projection. It excludes OAuth material, approval details, OIDC claims, emails, WebAuthn credentials, package policy, and release state. All operator reads that affect a decision query the authoritative publisher or approver object, and every mutation routes directly to that object.
+
+The directory can be deleted and rebuilt as identities authenticate again without changing authorization or release outcomes.
+
+### R2 staging, backup and audit export
+
+The private `PUBLICATION_STAGING` bucket holds checksum-verified artifact bytes while the Workflow uploads them to the publisher's PDS. Object keys bind the publisher, intent, artifact slot, and checksum. The Workflow deletes each object's material after all blob receipts and the canonical final record are committed in the publisher object. A seven-day lifecycle rule removes abandoned staging objects after interrupted Workflows. Staging objects are never public, authoritative, or referenced by the published record.
+
+Encrypted publisher snapshots and append-only audit exports may be written to the separate `OPERATIONS_ARCHIVE` bucket. Snapshot production must be bounded and resumable. A restore never revives expired or revoked authority automatically. If an OAuth session cannot be restored safely, the publisher reauthorizes delegation.
+
+## Durable Object schemas
+
+The following schemas describe required data and constraints. Exact SQL belongs with the implementation.
+
+### Publisher shard
+
+| Table                               | Required properties                                                                                                                                   |
+| ----------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `publisher`                         | One row; DID, status, creation time, suspension reason code, session epoch                                                                            |
+| `delegations`                       | Encrypted session envelope, exact scope, PDS, client key ID, expiry, refresh metadata, encryption-key version, revocation state                       |
+| `workload_policies`                 | Package slug, repository, workflow reference, ref/environment restrictions, active state, authorizing publisher identity                              |
+| `intents`                           | ULID, package/version, state, Workflow ID, normalized OIDC claims, record inputs, verification summaries, approval digest, result URI/CID, error code |
+| `intent_transitions`                | Intent ID, monotonic sequence, from/to state, actor realm and identity, reason code, timestamp                                                        |
+| `release_reservations`              | Unique package/version, intent ID, reservation state                                                                                                  |
+| `idempotency_keys`                  | Realm, key, request digest, intent/result reference, expiry                                                                                           |
+| `publication_materializations`      | Intent-bound source digest, status, canonical blob-only record JSON and digest, timestamps                                                            |
+| `publication_materialization_slots` | Artifact slot, source URL digest, checksum, R2 key, media metadata, immutable PDS blob receipt                                                        |
+| `operations`                        | Kind, generation, attempt key, token hash, intent ID, phase, materialization digest, start/deadline, completion state                                 |
+| `audit_events`                      | Monotonic sequence, event type, actor realm, actor identity, subject, public-safe payload, timestamp                                                  |
+| `deadlines`                         | Kind, subject ID, scheduled time, generation                                                                                                          |
+
+Sensitive values are encrypted individually with associated data binding the publisher DID, table, row identity, and key version. The database never stores an encryption master key.
+
+### Approver shard
+
+| Table                   | Required properties                                                                  |
+| ----------------------- | ------------------------------------------------------------------------------------ |
+| `approver`              | One row; DID, status, session epoch                                                  |
+| `credentials`           | Credential ID, public key, counter, transports, name, creation, last use, revocation |
+| `identity_transactions` | OAuth state hash, PKCE state, expiry, completion                                     |
+| `approval_challenges`   | Challenge hash, intent ID, publisher DID, approval digest, expiry, consumed time     |
+| `decisions`             | Idempotency key, intent ID, digest, decision, credential ID, verification time       |
+| `audit_events`          | Monotonic sequence, event type, subject, public-safe payload, timestamp              |
+| `deadlines`             | Challenge or session cleanup deadline and generation                                 |
+
+### Service-control shard
+
+| Table                  | Required properties                                                                    |
+| ---------------------- | -------------------------------------------------------------------------------------- |
+| `service_state`        | Current mode, epoch, reason code, Access operator identity, changed time               |
+| `encryption_keys`      | Key version, status, activation and retirement metadata; never key material            |
+| `publisher_controls`   | Publisher DID, allow/suspend state, reason code, operator identity, timestamp          |
+| `operator_idempotency` | Mutation key, request digest, result, expiry                                           |
+| `audit_events`         | Monotonic sequence, operator identity, action, subject, public-safe payload, timestamp |
+
+## Release intent state machine
+
+The canonical state machine is:
+
+```text
+received -> verifying -> verified
+                         |       |
+                         |       +-> ready -> publishing -> reconciling -> published
+                         |
+                         +-> awaiting_approval -> ready
+
+Non-success terminals:
+  invalid, rejected, cancelled, expired, failed, conflict
+```
+
+Allowed transitions are explicit. Compare-and-set transition methods take the expected state and generation. Unknown or repeated transitions return the stored result when idempotent and reject when the requested payload conflicts.
+
+`failed` represents an exhausted service or dependency failure after valid input. `invalid` represents a permanent input, identity, policy, bundle, or provenance failure. Neither is manually approvable. `conflict` means the deterministic release key contains a different record.
+
+## Publisher onboarding
+
+1. The publisher signs in once with the Atmosphere account that owns the plugin.
+2. The service resolves and verifies the publisher DID and PDS.
+3. Hosted-service admission policy permits or rejects the publisher.
+4. The publisher authorizes the exact delegated release scope for create-only release records and gzip-package and image-blob uploads.
+5. The service verifies the returned grant and stores the encrypted session in the publisher object.
+6. The publisher starts a short-lived pairing for a plugin package.
+7. A temporary `release connect` step runs in the intended GitHub Actions workflow. Its audience-bound OIDC token supplies the immutable repository and owner IDs, workflow file, ref, and environment.
+8. The browser displays the human-readable repository, workflow file, branch or tag, and environment. The publisher confirms those details before the service creates the package-to-GitHub-workload policy. The pairing token and OIDC claim grant no publishing authority without this confirmation.
+9. The service fetches and validates the signed package profile.
+10. Profile-listed approvers use the same Atmosphere login and enrol passkeys before approving a release.
+11. A dry-run submission verifies OIDC identity, request shape, service admission, and workload policy without reserving, rate-limiting, starting verification, or publishing a version. It does not fetch or validate the artifact or provenance document.
+
+The publisher can revoke the delegation from the service or directly through the authorization server. The service treats refresh failure after revocation as terminal authority loss, not as a retry loop.
+
+## Release submission
+
+1. GitHub Actions builds and bundles the plugin.
+2. CI emits SLSA provenance and uploads artifact and provenance bytes to stable HTTPS URLs.
+3. CI requests an OIDC token whose audience is the release service.
+4. The Action submits the token, package/version, URL-source release record, checksums, and idempotency key. Artifact descriptors contain HTTPS URLs and no PDS blobs.
+5. The Worker verifies request shape, OIDC signature and claims, and routes to the publisher object.
+6. The publisher object verifies workload-policy admission, reserves package/version, creates the intent, and records normalized claims.
+7. The object creates the Workflow instance using the intent ID.
+8. The API returns the intent resource. Publication is always asynchronous even when it completes quickly.
+
+The idempotency identity includes publisher DID, package, version, GitHub repository, workflow, run ID, and run attempt. Repeating the same request returns the existing intent. Reusing the identity with a different request digest returns `IDEMPOTENCY_CONFLICT`.
+
+## Verification
+
+The Workflow performs these checks in order:
+
+1. Resolve the publisher DID and authoritative PDS.
+2. Fetch the current package profile and record its CID.
+3. Validate package identity, profile extension, canonical repository, policy, and approver DIDs.
+4. Confirm the proposed release key is absent.
+5. Select the highest-semver existing release as the access baseline, excluding the proposed key. Record its CID, or the empty baseline for the first release.
+6. Ask the verifier Worker to fetch and validate the artifact.
+7. Confirm bundle package, version, manifest, and declared access match the proposed release.
+8. Ask the verifier to fetch and validate provenance.
+9. Match the artifact digest, source repository, builder, workflow, commit, and relevant GitHub claims.
+10. Compute the canonical declared-access diff against the baseline.
+11. Resolve `confirmation: always` or escalation-only policy.
+12. Persist a bounded verification report and its input CIDs/checksums.
+
+A missing or invalid supported provenance document is `invalid`. Approval cannot change that result.
+
+## Approval
+
+If approval is required, the publisher object stores an approval digest and transitions to `awaiting_approval`. The Workflow waits for a decision event with a bounded expiry.
+
+An approver:
+
+1. signs in with an Atmosphere account, using the same identity flow as the account dashboard;
+2. opens the release and reviews its plugin, repository, workflow, GitHub account, and permission changes, with protocol evidence available under technical details;
+3. requests a challenge from the approver object;
+4. signs the approval digest using an active, user-verified credential; and
+5. submits `approve` or `reject` with an idempotency key.
+
+The service accepts the receipt only if the current profile still lists the approver DID. A rejection is terminal. A cancellation or expiry invalidates outstanding challenges. A new profile CID, access baseline, artifact checksum, provenance checksum, or workload claim set creates a new digest and requires a new approval.
+
+## Publication and reconciliation
+
+Before publication, the Workflow repeats every authoritative read and verification step. It then:
+
+1. fetches every URL-source artifact through the guarded verifier path and writes the verified bytes to deterministic private R2 objects;
+2. obtains a replay-stable, generation-bound publication operation from the publisher object;
+3. refreshes the encrypted AT Protocol session if required and uploads each staged package or image as a PDS blob;
+4. validates every returned blob against the source checksum, byte size, and media type, then persists immutable receipts and canonical blob-only record JSON in the publisher object;
+5. deletes the staged R2 objects after durable materialization;
+6. obtains and consumes a fresh publication permit, rechecks delegation, and moves the operation to `creating`;
+7. creates the deterministic release record without an update path;
+8. completes the operation with the confirmed URI and CID; or
+9. enters reconciliation only when the `createRecord` result is ambiguous.
+
+Reconciliation reads the deterministic release key directly from the PDS:
+
+- an exact proof-verified semantic match completes publication with the authoritative CID;
+- confirmed absence permits an idempotent create retry;
+- a different record at the key transitions to `conflict`; and
+- a transient inability to establish presence or absence remains `reconciling` with bounded retries and operator visibility.
+
+The service never reports `published` from an HTTP status alone when the response may be ambiguous.
+
+## Cancellation, revocation, and suspension
+
+- CI may cancel its own intent before `publishing` using a fresh matching OIDC identity.
+- The publisher may cancel an intent before `publishing` through its application session.
+- An approver may reject but cannot cancel on behalf of the publisher.
+- An Access operator may cancel or quarantine an intent for incident response but cannot transition it to `ready` or `published`.
+- Publisher revocation blocks new intents and refresh, and publication checks revocation immediately before the write.
+- Service pause is checked at admission and again before the write.
+- A publisher suspension blocks all publisher shards without deleting audit or encrypted state.
+
+Revocation does not remove an already published record. Record removal or yanking follows the registry protocol and publisher authority model outside this service.
+
+## HTTP API
+
+The public service API is versioned under `/v1`.
+
+Health endpoints are outside the versioned API. `GET /health` is configuration-independent process liveness. `GET /ready` loads required configuration and checks the service-control shard, but returns no tenant or operational state.
+
+### CI API
+
+| Method and path                        | Purpose                                                           |
+| -------------------------------------- | ----------------------------------------------------------------- |
+| `POST /v1/release-intents`             | Submit or replay an OIDC-authenticated intent                     |
+| `POST /v1/release-intents/dry-run`     | Check OIDC and admission policy without creating an intent        |
+| `GET /v1/release-intents/{id}`         | Read status using matching workload identity or publisher session |
+| `POST /v1/release-intents/{id}/cancel` | Cancel before publication                                         |
+
+### Publisher API
+
+| Method and path                                            | Purpose                                                   |
+| ---------------------------------------------------------- | --------------------------------------------------------- |
+| `POST /v1/publisher/session/authorize`                     | Start identity-only publisher authorization               |
+| `GET /v1/publisher`                                        | Read publisher and delegation state                       |
+| `POST /v1/publisher/delegation/authorize`                  | Start exact-scope delegation authorization                |
+| `DELETE /v1/publisher/delegation`                          | Revoke retained authority                                 |
+| `GET /v1/publisher/workloads`                              | List package workload policies                            |
+| `POST /v1/publisher/workloads`                             | Create or replace an authorized policy                    |
+| `POST /v1/publisher/workflow-pairings`                     | Start a short-lived package-to-workflow pairing           |
+| `GET /v1/publisher/workflow-pairings/{pairingId}`          | Read the GitHub identity proposed by a pairing            |
+| `POST /v1/publisher/workflow-pairings/{pairingId}/confirm` | Confirm the proposed identity and create its policy       |
+| `DELETE /v1/publisher/workloads/{packageSlug}`             | Disable a policy                                          |
+| `GET /v1/publisher/workloads/{packageSlug}/approvers`      | Read approval readiness for DIDs in the signed profile    |
+| `GET /v1/publisher/intents`                                | List publisher intents with cursor pagination             |
+| `GET /v1/publisher/audit`                                  | List publisher-scoped audit events with cursor pagination |
+
+`POST /v1/workflow-pairings/{pairingId}/claim` is the GitHub OIDC-authenticated endpoint used by `release connect`. It records a proposal in the publisher shard but cannot create a workload policy.
+
+### Approver API
+
+| Method and path                         | Purpose                           |
+| --------------------------------------- | --------------------------------- |
+| `POST /v1/approver/session/authorize`   | Start identity-only authorization |
+| `GET /v1/approver/credentials`          | List active and revoked passkeys  |
+| `POST /v1/approver/credentials/options` | Begin enrolment                   |
+| `POST /v1/approver/credentials`         | Finish enrolment                  |
+| `DELETE /v1/approver/credentials/{id}`  | Revoke one credential             |
+| `GET /v1/approvals/{intentId}`          | Read approval-safe intent details |
+| `POST /v1/approvals/{intentId}/options` | Create a digest-bound challenge   |
+| `POST /v1/approvals/{intentId}`         | Approve or reject                 |
+
+### Access operator API
+
+The typed operator client uses these canonical paths:
+
+| Method and path                                               | Minimum role | Purpose                                          |
+| ------------------------------------------------------------- | ------------ | ------------------------------------------------ |
+| `GET /admin/api/status`                                       | viewer       | Read service mode and component health           |
+| `GET /admin/api/directory`                                    | viewer       | List publisher or approver directory projections |
+| `GET /admin/api/audit`                                        | viewer       | Query global or projected operational audit data |
+| `GET /admin/api/publishers/{publisherDid}`                    | viewer       | Read authoritative publisher state               |
+| `POST /admin/api/intents/{intentId}/cancel`                   | reviewer     | Stop an unpublished intent                       |
+| `POST /admin/api/intents/{intentId}/reconcile`                | reviewer     | Trigger bounded reconciliation                   |
+| `POST /admin/api/pause`                                       | admin        | Change admission or publication mode             |
+| `POST /admin/api/publishers/{publisherDid}/suspend`           | admin        | Suspend or restore publisher admission           |
+| `POST /admin/api/publishers/{publisherDid}/revoke`            | admin        | Revoke retained service authority                |
+| `POST /admin/api/publishers/{publisherDid}/encryption/rotate` | admin        | Re-encrypt one page of publisher state           |
+| `POST /admin/api/approvers/{approverDid}/encryption/rotate`   | admin        | Re-encrypt one page of approver state            |
+| `POST /admin/api/publishers/{publisherDid}/archive`           | admin        | Produce one bounded publisher archive page       |
+| `POST /admin/api/publishers/{publisherDid}/archive/start`     | admin        | Start a resumable publisher archive Workflow     |
+| `POST /admin/api/publishers/{publisherDid}/restore/prepare`   | admin        | Validate an archive before restore               |
+| `POST /admin/api/publishers/{publisherDid}/restore`           | admin        | Restore one validated archive page               |
+| `GET /admin/api/encryption/keys`                              | viewer       | Read encryption-key lifecycle state              |
+| `POST /admin/api/encryption/keys/activate`                    | admin        | Activate a configured encryption-key version     |
+| `POST /admin/api/encryption/verify`                           | admin        | Start fleet verification for a retiring key      |
+| `POST /admin/api/encryption/keys/{version}/retire`            | admin        | Retire a verified inactive key                   |
+
+State-changing requests require content-type validation, CSRF where cookies are used, and idempotency keys. API errors expose stable codes and public-safe messages.
+
+## Error model
+
+At minimum, the API and Workflow use these error classes:
+
+| Code                   | Meaning                                                     | Retry behavior                   |
+| ---------------------- | ----------------------------------------------------------- | -------------------------------- |
+| `AUTH_INVALID`         | Authentication or session proof failed                      | Permanent for request            |
+| `ACCESS_DENIED`        | Verified actor lacks required role or ownership             | Permanent                        |
+| `PUBLISHER_SUSPENDED`  | Hosted service or operator blocked the publisher            | Retry after state change         |
+| `SERVICE_PAUSED`       | Admission or publication is paused                          | Retry after state change         |
+| `DELEGATION_REQUIRED`  | No usable exact-scope session exists                        | Publisher must reauthorize       |
+| `WORKLOAD_NOT_ALLOWED` | OIDC claims do not match active policy                      | Permanent until policy changes   |
+| `IDEMPOTENCY_CONFLICT` | Same key was used with a different request                  | Permanent                        |
+| `VERSION_RESERVED`     | Package/version belongs to another intent                   | Permanent or return owner intent |
+| `RELEASE_EXISTS`       | Proposed deterministic key already exists                   | Permanent unless exact replay    |
+| `PROFILE_CHANGED`      | Authoritative policy changed after verification or approval | Reverify and possibly reapprove  |
+| `BASELINE_CHANGED`     | Access baseline changed                                     | Reverify and possibly reapprove  |
+| `ARTIFACT_INVALID`     | Fetch, checksum, bundle, or manifest failed                 | Permanent for supplied input     |
+| `PROVENANCE_INVALID`   | Provenance or workload binding failed                       | Permanent for supplied input     |
+| `APPROVAL_REQUIRED`    | Valid release awaits human decision                         | Not an error state               |
+| `APPROVAL_INVALID`     | DID, credential, challenge, digest, or UV failed            | Permanent for attempt            |
+| `DELEGATION_REVOKED`   | Session was revoked or cannot refresh                       | Publisher must reauthorize       |
+| `PDS_TRANSIENT`        | PDS result is retryable                                     | Workflow retry                   |
+| `PDS_AMBIGUOUS`        | Create outcome is unknown                                   | Reconciliation                   |
+| `RELEASE_CONFLICT`     | Deterministic key contains different data                   | Terminal conflict                |
+| `INTERNAL_ERROR`       | Public-safe catch-all                                       | Operator-visible correlation ID  |
+
+Provider payloads, tokens, secrets, raw assertions, private evidence, and stack traces never enter public errors or persistent generic error strings.
+
+## Encryption and key management
+
+Envelope encryption uses compact JSON Web Encryption (JWE) through `jose`. A versioned 256-bit master key from Secrets Store or an equivalent Worker secret binding acts as an `A256GCMKW` key-encryption key. Each value receives a fresh content-encryption key, and `A256GCM` encrypts the payload. Master keys are read inside request or RPC scope and are never logged or persisted.
+
+Each compact JWE includes:
+
+- the key-management and content-encryption algorithms;
+- the master-key version and initial profile version;
+- a wrapped content-encryption key;
+- key-wrap and content-encryption nonces and authentication tags;
+- ciphertext; and
+- a critical SHA-256 context digest.
+
+The protected header is authenticated as JWE associated data. Its context digest binds the deployment, publisher DID, object class, table, row identity, field purpose, and master-key version. Swapping ciphertext between publishers or fields fails authentication.
+
+Routine rotation introduces a new active version, retains old versions for decryption, re-encrypts in bounded publisher-shard batches, verifies completion through audit/export data, and only then retires the old version. Emergency rotation pauses publication first. Missing key material fails closed and requires operator recovery; it never silently discards or recreates delegation.
+
+## Audit and privacy
+
+Every security-relevant state change appends an immutable audit event in the authoritative shard before returning success. Events name the actor realm (`oidc`, `publisher`, `approver`, `access`, or `system`), stable actor identity, action, subject, reason code, and timestamp.
+
+Audit payloads may include normalized repository, workflow, package, version, public record identifiers, and digest prefixes. They exclude raw tokens, assertions, OAuth sessions, DPoP keys, email bodies, WebAuthn public-key material, and artifact contents.
+
+Access operator views use the least detailed representation required for operations. Publisher and approver views cannot read another publisher's private intents or credentials.
+
+## Listing moderation integration
+
+Publishing and listing moderation remain independent:
+
+1. The delegated service creates a valid release record.
+2. The aggregator observes the record.
+3. Metadata labellers assess the exact visible profile and release CIDs.
+4. Default admin discovery requires the configured positive moderation labels.
+
+The delegated service neither issues moderation labels nor bypasses the aggregator's visibility policy. A successfully published release may remain absent from default discovery while moderation is pending.
+
+## Operations and recovery
+
+The Access admin exposes service mode, publisher lookup, stuck operations, reconciliation, authority revocation, suspension, encryption-key status, Workflow status, and sanitized audit events.
+
+Required runbooks cover:
+
+- compromised service encryption key;
+- compromised Access operator identity;
+- publisher-requested revocation;
+- authorization-server outage;
+- PDS write ambiguity;
+- Workflow loss or prolonged retry;
+- verifier egress failure;
+- Durable Object schema migration failure;
+- lost or corrupt publisher shard;
+- passkey compromise or counter anomaly; and
+- hosted-service rollback.
+
+Recovery prefers removal of authority. If encrypted session state cannot be proved correct, revoke or disable it and require publisher reauthorization.
+
+## Compatibility and rollout
+
+- The first deployment uses one complete initial Durable Object schema and one initial encryption profile. Implementation PR boundaries do not create schema versions or legacy ciphertext formats.
+- Protocol additions remain optional while the registry is experimental.
+- Interactive publisher-owned CLI publication continues to work.
+- Existing releases without provenance remain installable unless signed package policy requires provenance.
+- The delegated service itself always requires provenance for its releases.
+- A stable release-collection namespace requires a fresh delegation grant.
+- Old application versions tolerate the optional profile and release extension fields.
+- After the first deployment, a rolling service update must tolerate shards at the previous application schema version until their forward migration completes.
+
+## System acceptance criteria
+
+The service is complete only when all of the following hold:
+
+### Delegation and identity
+
+- A publisher authorizes the exact delegated release grant on the Bluesky PDS implementation at npmX and on Cirrus.
+- The retained session creates a new release and cannot update it, delete it, edit a profile, or write another collection.
+- Revocation prevents new publication and eventual refresh; emergency service revocation removes retained authority.
+- Cloudflare Access operators cannot reach publisher, approver, or CI-authorized actions.
+
+### Workload and verification
+
+- A configured GitHub workflow can submit an intent; a wrong repository, workflow, audience, ref, environment, run identity, or expired token cannot.
+- Replaying the same request returns the same intent; changing the payload under the same idempotency identity fails.
+- Artifact, bundle, manifest, declared access, provenance, source, builder, and commit substitution tests fail closed.
+- The service reads authoritative profile and release records directly from the publisher PDS.
+
+### Approval
+
+- An ordinary non-escalating release publishes automatically under `escalation-only`.
+- `confirmation: always` and declared-access expansion wait for approval.
+- An unlisted, unenrolled, revoked, cloned, non-user-verified, or digest-mismatched credential cannot approve.
+- Profile, baseline, artifact, provenance, or workload changes invalidate prior approval.
+- Approval never converts invalid verification into a publishable release.
+
+### Publication and recovery
+
+- Concurrent submissions cannot claim the same publisher/package/version.
+- OAuth refresh and PDS publication serialize within a publisher shard without holding a Durable Object-wide external-I/O lock.
+- Every package and listing image is uploaded as a checksum-bound PDS blob, and the created release record contains blob references with no artifact source URLs.
+- Blob receipts and the canonical final record are committed before a publication permit is issued or `createRecord` begins.
+- Duplicate Workflow execution cannot create a second semantic release or duplicate a terminal transition.
+- A timeout before, during, or after the PDS write converges to published, retryable absence, or conflict through reconciliation.
+- Service pause and publisher suspension are enforced immediately before the write.
+
+### Independent consumption
+
+- A clean EmDash site independently accepts a valid delegated release.
+- It rejects absent, malformed, mismatched, unsupported, or invalid required provenance even if the service marked the intent published.
+- It rejects a bundle whose manifest differs from the signed release's declared access.
+- Listing moderation remains required independently for default admin discovery.
+
+### Platform and operations
+
+- After the first deployment, Durable Object migrations preserve existing delegation, intent, credential, and audit data.
+- Successful materialization removes its R2 staging objects, and the staging bucket lifecycle removes objects abandoned for seven days.
+- Encryption-key rotation completes without losing authority or leaving values unreadable.
+- Encrypted snapshots and audit exports restore into a fresh deployment without automatically reviving expired or revoked authority.
+- Hosted and self-hosted deployments pass the same protocol and service conformance suite.
+- External security review has no unresolved critical or high findings before production launch.
diff --git a/packages/plugin-cli/README.md b/packages/plugin-cli/README.md
index 797c02df0d..426dd74e0b 100644
--- a/packages/plugin-cli/README.md
+++ b/packages/plugin-cli/README.md
@@ -25,6 +25,14 @@ emdash-plugin build                          Build dist/ artifacts (plugin.mjs,
 emdash-plugin dev                            Watch sources and rebuild on change
 emdash-plugin bundle                         Pack dist/ + assets into a registry tarball
 emdash-plugin publish                        Build, upload, and publish a release
+emdash-plugin release delegate               Print a publisher delegation browser handoff
+emdash-plugin release revoke                 Print an authority revocation browser handoff
+emdash-plugin release workload               Print a workload policy browser handoff
+emdash-plugin release enrol                  Print a passkey enrolment browser handoff
+emdash-plugin release approve <intent-id>    Print a passkey approval browser handoff
+emdash-plugin release reject <intent-id>     Print a passkey rejection browser handoff
+emdash-plugin release connect                Connect the current GitHub Actions workflow
+emdash-plugin release dry-run <release.json> Validate delegated release admission with GitHub OIDC
 emdash-plugin release submit <release.json>  Submit a delegated release with GitHub OIDC
 emdash-plugin release status <intent-id>     Read a delegated release intent
 emdash-plugin release cancel <intent-id>     Cancel an unpublished delegated release intent
@@ -37,7 +45,7 @@ emdash-plugin search <query>                 Free-text search
 emdash-plugin info <handle-or-did> <slug>    Show package details
 ```
 
-The non-interactive output commands (`whoami`, `validate`, `search`, `info`, `login`, `publish`, `release submit`, `release status`, `release cancel`) accept `--json` for machine-readable output. Discovery commands (`search`, `info`) accept `--registry-url <url>` (or `EMDASH_REGISTRY_URL`).
+The non-interactive output commands accept `--json` for machine-readable output. Discovery commands (`search`, `info`) accept `--registry-url <url>` (or `EMDASH_REGISTRY_URL`).
 
 ## Development
 
@@ -90,9 +98,15 @@ On first publish, pass `--license` and `--security-email` (or `--security-url`)
 
 ## Delegated releases
 
-The `release` commands authenticate with the current GitHub Actions OpenID Connect (OIDC) identity. Grant the job `id-token: write`; the CLI requests a token whose audience is the release-service origin for every API call.
+Use the release-service dashboard to set up delegated publishing. Sign in with the Atmosphere account that owns the plugin, allow EmDash to create plugin releases, and select the plugin package you want to connect.
 
-The following command submits a generated package release record and waits for publication or an approval request:
+The dashboard provides a short-lived `release connect` step for the GitHub Actions workflow that will publish the plugin. Add the step to a job with `id-token: write`, run the workflow once, then return to the dashboard. The dashboard shows the repository, workflow file, branch or tag, and environment reported by GitHub. Confirm those details to authorize that exact workflow. The connection token and GitHub identity do not authorize publishing until you confirm them in the browser.
+
+Remove the temporary connection step after confirmation. Keep `id-token: write` on the job that submits releases.
+
+The automation commands (`connect`, `dry-run`, `submit`, `status`, and `cancel`) authenticate with the current GitHub Actions OpenID Connect (OIDC) identity. The CLI requests a token whose audience is the release-service origin for every API call.
+
+The following command submits a generated URL-source package release record and waits for publication or an approval request:
 
 ```sh
 emdash-plugin release submit release.json \
@@ -102,6 +116,8 @@ emdash-plugin release submit release.json \
 
 Set `EMDASH_RELEASE_SERVICE_URL` and `EMDASH_PUBLISHER_DID` to omit the two target flags. The default idempotency key uses the GitHub run ID, so a re-run reuses the existing intent. Pass `--idempotency-key` when separate runs or jobs must replay the same submission.
 
+Each package or listing-image artifact in the source record must use a checksum-bound HTTPS `url` and must not include `blob`. The service verifies and uploads those bytes to the publisher's PDS. The published release record contains PDS blob references and no artifact source URLs; provenance remains URL-based.
+
 Use `--no-wait` to return after the service accepts the intent. The status and cancellation commands require the same publisher and GitHub workload identity:
 
 ```sh
@@ -111,6 +127,19 @@ emdash-plugin release cancel 01JABCDEFGHJKMNPQRSTVWXYZ0
 
 These commands fail outside GitHub Actions because no OIDC request endpoint is available. Use the delegated release Action when the workflow only needs submission and outputs.
 
+Atmosphere authorization and passkeys remain browser operations. The following commands print validated browser links instead of copying OAuth sessions or passkey assertions into the terminal:
+
+```sh
+emdash-plugin release delegate --service-url https://release.example.com
+emdash-plugin release workload --service-url https://release.example.com
+emdash-plugin release enrol --service-url https://release.example.com
+emdash-plugin release approve 01JABCDEFGHJKMNPQRSTVWXYZ0 \
+  --service-url https://release.example.com \
+  --publisher-did did:web:publisher.example.com
+```
+
+Use `release revoke` to open publisher authority revocation and `release reject` to open the rejection ceremony. The service keeps its application-session cookies and passkey ceremony at its own origin.
+
 ## `emdash-plugin.jsonc`
 
 Drop an `emdash-plugin.jsonc` file next to your plugin's `package.json`. The CLI reads it automatically from the current directory. Schema-driven IDE completion works via the bundled JSON Schema:
diff --git a/packages/plugin-cli/src/commands/release.ts b/packages/plugin-cli/src/commands/release.ts
index 09b9a7e648..703e580712 100644
--- a/packages/plugin-cli/src/commands/release.ts
+++ b/packages/plugin-cli/src/commands/release.ts
@@ -1,12 +1,19 @@
-import type { ReleaseIntentResource } from "@emdash-cms/registry-client/release-service";
+import type {
+	DryRunReleaseIntentResult,
+	ReleaseIntentResource,
+} from "@emdash-cms/registry-client/release-service";
 import { defineCommand } from "citty";
 import { consola } from "consola";
 import pc from "picocolors";
 
 import {
 	cancelDelegatedReleaseIntent,
+	connectGithubWorkflow,
+	dryRunDelegatedRelease,
 	getDelegatedReleaseIntent,
+	interactiveReleaseUrl,
 	submitDelegatedRelease,
+	type InteractiveReleaseAction,
 } from "../release-service/operations.js";
 
 const POSITIVE_INTEGER_PATTERN = /^[1-9][0-9]*$/;
@@ -27,6 +34,12 @@ function requiredTarget(args: { "publisher-did"?: string; "service-url"?: string
 	return { serviceUrl, publisherDid };
 }
 
+function requiredService(args: { "service-url"?: string }): string {
+	const serviceUrl = args["service-url"] || process.env["EMDASH_RELEASE_SERVICE_URL"];
+	if (!serviceUrl) throw new Error("Release service URL is required");
+	return serviceUrl;
+}
+
 function positiveInteger(value: string, name: string, maximum: number): number {
 	if (!POSITIVE_INTEGER_PATTERN.test(value)) throw new Error(`${name} must be a positive integer`);
 	const parsed = Number(value);
@@ -52,6 +65,26 @@ function printIntent(intent: ReleaseIntentResource, json: boolean): void {
 	if (intent.reasonCode) console.log(`  Reason: ${intent.reasonCode}`);
 }
 
+function printDryRun(result: DryRunReleaseIntentResult, json: boolean): void {
+	if (json) {
+		console.log(JSON.stringify(result, null, 2));
+		return;
+	}
+	console.log(`${pc.bold(result.packageSlug)} ${pc.dim(result.version)}`);
+	console.log("  Admission: allowed");
+	console.log(`  Policy:    ${result.workloadPolicyVersion}`);
+}
+
+function printBrowserHandoff(action: InteractiveReleaseAction, url: URL, json?: boolean): void {
+	if (json) {
+		console.log(JSON.stringify({ action, url: url.toString() }));
+		return;
+	}
+	consola.info("Open your browser to:");
+	console.log(`  ${pc.cyan(pc.bold(url.toString()))}`);
+	consola.info("OAuth sessions and passkey assertions remain in the browser.");
+}
+
 const commonArgs = {
 	"service-url": {
 		type: "string" as const,
@@ -67,6 +100,86 @@ const commonArgs = {
 	},
 };
 
+const browserArgs = {
+	"service-url": commonArgs["service-url"],
+	json: {
+		type: "boolean" as const,
+		description: "Output the browser handoff as JSON",
+	},
+};
+
+export const releaseDelegateCommand = defineCommand({
+	meta: { name: "delegate", description: "Print a browser handoff for publisher delegation" },
+	args: browserArgs,
+	async run({ args }) {
+		const url = interactiveReleaseUrl("delegate", { serviceUrl: requiredService(args) });
+		printBrowserHandoff("delegate", url, args.json);
+	},
+});
+
+export const releaseRevokeCommand = defineCommand({
+	meta: { name: "revoke", description: "Print a browser handoff for authority revocation" },
+	args: browserArgs,
+	async run({ args }) {
+		const url = interactiveReleaseUrl("revoke", { serviceUrl: requiredService(args) });
+		printBrowserHandoff("revoke", url, args.json);
+	},
+});
+
+export const releaseWorkloadCommand = defineCommand({
+	meta: { name: "workload", description: "Print a browser handoff for workload policies" },
+	args: browserArgs,
+	async run({ args }) {
+		const url = interactiveReleaseUrl("workload", { serviceUrl: requiredService(args) });
+		printBrowserHandoff("workload", url, args.json);
+	},
+});
+
+export const releaseEnrolCommand = defineCommand({
+	meta: { name: "enrol", description: "Print a browser handoff for passkey enrolment" },
+	args: browserArgs,
+	async run({ args }) {
+		const url = interactiveReleaseUrl("enrol", { serviceUrl: requiredService(args) });
+		printBrowserHandoff("enrol", url, args.json);
+	},
+});
+
+const approvalBrowserArgs = {
+	"intent-id": {
+		type: "positional" as const,
+		description: "Release intent ULID",
+		required: true,
+	},
+	...browserArgs,
+	"publisher-did": commonArgs["publisher-did"],
+};
+
+export const releaseApproveCommand = defineCommand({
+	meta: { name: "approve", description: "Print a browser handoff for passkey approval" },
+	args: approvalBrowserArgs,
+	async run({ args }) {
+		const target = requiredTarget(args);
+		const url = interactiveReleaseUrl("approve", {
+			...target,
+			intentId: args["intent-id"],
+		});
+		printBrowserHandoff("approve", url, args.json);
+	},
+});
+
+export const releaseRejectCommand = defineCommand({
+	meta: { name: "reject", description: "Print a browser handoff for passkey rejection" },
+	args: approvalBrowserArgs,
+	async run({ args }) {
+		const target = requiredTarget(args);
+		const url = interactiveReleaseUrl("reject", {
+			...target,
+			intentId: args["intent-id"],
+		});
+		printBrowserHandoff("reject", url, args.json);
+	},
+});
+
 export const releaseSubmitCommand = defineCommand({
 	meta: {
 		name: "submit",
@@ -75,7 +188,7 @@ export const releaseSubmitCommand = defineCommand({
 	args: {
 		"release-file": {
 			type: "positional",
-			description: "Package release record JSON file",
+			description: "URL-source package release JSON file",
 			required: true,
 		},
 		...commonArgs,
@@ -133,6 +246,63 @@ export const releaseSubmitCommand = defineCommand({
 	},
 });
 
+export const releaseConnectCommand = defineCommand({
+	meta: {
+		name: "connect",
+		description: "Connect this GitHub Actions workflow to a plugin package",
+	},
+	args: {
+		...commonArgs,
+		"pairing-id": {
+			type: "string",
+			description: "Short-lived connection ID from the release dashboard",
+			required: true,
+		},
+		"pairing-token": {
+			type: "string",
+			description: "Short-lived connection token from the release dashboard",
+			required: true,
+		},
+	},
+	async run({ args }) {
+		const result = await connectGithubWorkflow({
+			...requiredTarget(args),
+			pairingId: args["pairing-id"],
+			pairingToken: args["pairing-token"],
+		});
+		if (args.json) {
+			console.log(JSON.stringify(result, null, 2));
+			return;
+		}
+		const claim = result.pairing.claim;
+		if (!claim) throw new Error("GitHub workflow connection was not recorded");
+		console.log(`${pc.bold(claim.repository)} ${pc.dim(claim.ref)}`);
+		consola.success("Workflow verified. Return to the EmDash release dashboard to confirm it.");
+	},
+});
+
+export const releaseDryRunCommand = defineCommand({
+	meta: {
+		name: "dry-run",
+		description: "Validate delegated release admission without creating an intent",
+	},
+	args: {
+		"release-file": {
+			type: "positional",
+			description: "URL-source package release JSON file",
+			required: true,
+		},
+		...commonArgs,
+	},
+	async run({ args }) {
+		const result = await dryRunDelegatedRelease({
+			...requiredTarget(args),
+			releaseFile: args["release-file"],
+		});
+		printDryRun(result, args.json ?? false);
+	},
+});
+
 export const releaseStatusCommand = defineCommand({
 	meta: { name: "status", description: "Read a delegated release intent" },
 	args: {
@@ -179,8 +349,16 @@ export const releaseCancelCommand = defineCommand({
 export const releaseCommand = defineCommand({
 	meta: { name: "release", description: "Manage delegated release intents" },
 	subCommands: {
+		approve: releaseApproveCommand,
+		connect: releaseConnectCommand,
+		delegate: releaseDelegateCommand,
+		"dry-run": releaseDryRunCommand,
+		enrol: releaseEnrolCommand,
+		reject: releaseRejectCommand,
+		revoke: releaseRevokeCommand,
 		submit: releaseSubmitCommand,
 		status: releaseStatusCommand,
 		cancel: releaseCancelCommand,
+		workload: releaseWorkloadCommand,
 	},
 });
diff --git a/packages/plugin-cli/src/release-service/operations.ts b/packages/plugin-cli/src/release-service/operations.ts
index f677f3baf5..752d24d552 100644
--- a/packages/plugin-cli/src/release-service/operations.ts
+++ b/packages/plugin-cli/src/release-service/operations.ts
@@ -4,10 +4,14 @@ import {
 	ReleaseServiceClient,
 	createReleaseIdempotencyKey,
 	parseDelegatedReleaseSourceRecord,
+	type DryRunReleaseIntentResult,
+	type ClaimWorkflowPairingResult,
 	type ReleaseIntentResource,
 } from "@emdash-cms/registry-client/release-service";
 
 const POSITIVE_INTEGER_PATTERN = /^[1-9][0-9]*$/;
+const DID_PATTERN = /^did:[a-z0-9]+:[A-Za-z0-9._:%-]+$/;
+const ULID_PATTERN = /^[0-9A-HJKMNP-TV-Z]{26}$/;
 const MAX_RELEASE_FILE_BYTES = 128 * 1024;
 const MAX_OIDC_TOKEN_CHARS = 16 * 1024;
 
@@ -36,11 +40,82 @@ export interface SubmitDelegatedReleaseOptions extends ReleaseServiceTarget {
 	onUpdate?: (intent: ReleaseIntentResource) => void | Promise<void>;
 }
 
+export interface DryRunDelegatedReleaseOptions extends ReleaseServiceTarget {
+	releaseFile: string;
+}
+
 export interface MutateReleaseIntentOptions extends ReleaseServiceTarget {
 	intentId: string;
 	idempotencyKey?: string;
 }
 
+export interface ConnectGithubWorkflowOptions extends ReleaseServiceTarget {
+	pairingId: string;
+	pairingToken: string;
+}
+
+export type InteractiveReleaseAction =
+	| "approve"
+	| "delegate"
+	| "enrol"
+	| "reject"
+	| "revoke"
+	| "workload";
+
+export interface InteractiveReleaseOptions {
+	serviceUrl: string;
+	publisherDid?: string;
+	intentId?: string;
+}
+
+export function interactiveReleaseUrl(
+	action: InteractiveReleaseAction,
+	options: InteractiveReleaseOptions,
+): URL {
+	let service: URL;
+	try {
+		service = new URL(options.serviceUrl);
+	} catch {
+		throw new Error("Release service URL must be a secure origin");
+	}
+	const loopback =
+		service.hostname === "localhost" ||
+		service.hostname === "127.0.0.1" ||
+		service.hostname === "[::1]";
+	if (
+		(service.protocol !== "https:" && !(service.protocol === "http:" && loopback)) ||
+		service.username !== "" ||
+		service.password !== "" ||
+		service.pathname !== "/" ||
+		service.search !== "" ||
+		service.hash !== ""
+	) {
+		throw new Error("Release service URL must be a secure origin");
+	}
+	if (action === "delegate" || action === "revoke" || action === "workload") {
+		service.pathname = "/publisher";
+		service.searchParams.set("view", action === "workload" ? "workloads" : "delegation");
+		if (action === "revoke") service.searchParams.set("action", "revoke");
+		return service;
+	}
+	if (action === "enrol") {
+		service.pathname = "/approver";
+		return service;
+	}
+	if (
+		!options.intentId ||
+		!ULID_PATTERN.test(options.intentId) ||
+		!options.publisherDid ||
+		!DID_PATTERN.test(options.publisherDid)
+	) {
+		throw new Error("Approval browser handoff requires a publisher DID and intent ULID");
+	}
+	service.pathname = `/approvals/${options.intentId}`;
+	service.searchParams.set("publisher", options.publisherDid);
+	service.searchParams.set("decision", action);
+	return service;
+}
+
 async function defaultReadReleaseRecord(path: string): Promise<unknown> {
 	try {
 		const metadata = await stat(path);
@@ -146,6 +221,34 @@ export async function submitDelegatedRelease(
 	});
 }
 
+export async function dryRunDelegatedRelease(
+	options: DryRunDelegatedReleaseOptions,
+	dependencies: ReleaseServiceOperationDependencies = {},
+): Promise<DryRunReleaseIntentResult> {
+	const rawRelease = await (dependencies.readReleaseRecord ?? defaultReadReleaseRecord)(
+		options.releaseFile,
+	);
+	const release = parseDelegatedReleaseSourceRecord(rawRelease);
+	if (!release) throw new Error("Release record file is invalid");
+	return await releaseClient(options, dependencies).dryRunIntent({
+		publisherDid: options.publisherDid,
+		packageSlug: release.package,
+		version: release.version,
+		release,
+	});
+}
+
+export async function connectGithubWorkflow(
+	options: ConnectGithubWorkflowOptions,
+	dependencies: ReleaseServiceOperationDependencies = {},
+): Promise<ClaimWorkflowPairingResult> {
+	return await releaseClient(options, dependencies).claimWorkflowPairing({
+		publisherDid: options.publisherDid,
+		pairingId: options.pairingId,
+		pairingToken: options.pairingToken,
+	});
+}
+
 export async function getDelegatedReleaseIntent(
 	options: ReleaseServiceTarget & { intentId: string },
 	dependencies: ReleaseServiceOperationDependencies = {},
diff --git a/packages/plugin-cli/tests/release-service-operations.test.ts b/packages/plugin-cli/tests/release-service-operations.test.ts
index 269d5e2e13..7959d6152b 100644
--- a/packages/plugin-cli/tests/release-service-operations.test.ts
+++ b/packages/plugin-cli/tests/release-service-operations.test.ts
@@ -4,7 +4,10 @@ import { describe, expect, it } from "vitest";
 import releaseFixture from "../../registry-verification/fixtures/records/release.json";
 import {
 	cancelDelegatedReleaseIntent,
+	connectGithubWorkflow,
+	dryRunDelegatedRelease,
 	getDelegatedReleaseIntent,
+	interactiveReleaseUrl,
 	requestGithubOidcToken,
 	submitDelegatedRelease,
 } from "../src/release-service/operations.js";
@@ -63,6 +66,37 @@ function success(data: unknown, status = 200): Response {
 }
 
 describe("delegated release CLI operations", () => {
+	it("creates browser handoffs without carrying service credentials", () => {
+		expect(interactiveReleaseUrl("delegate", { serviceUrl: SERVICE }).toString()).toBe(
+			`${SERVICE}/publisher?view=delegation`,
+		);
+		expect(interactiveReleaseUrl("revoke", { serviceUrl: SERVICE }).toString()).toBe(
+			`${SERVICE}/publisher?view=delegation&action=revoke`,
+		);
+		expect(interactiveReleaseUrl("workload", { serviceUrl: SERVICE }).toString()).toBe(
+			`${SERVICE}/publisher?view=workloads`,
+		);
+		expect(interactiveReleaseUrl("enrol", { serviceUrl: SERVICE }).toString()).toBe(
+			`${SERVICE}/approver`,
+		);
+		expect(
+			interactiveReleaseUrl("approve", {
+				serviceUrl: SERVICE,
+				publisherDid: PUBLISHER_DID,
+				intentId: INTENT_ID,
+			}).toString(),
+		).toBe(
+			`${SERVICE}/approvals/${INTENT_ID}?publisher=${encodeURIComponent(PUBLISHER_DID)}&decision=approve`,
+		);
+		expect(() =>
+			interactiveReleaseUrl("reject", {
+				serviceUrl: "http://release.example.com",
+				publisherDid: PUBLISHER_DID,
+				intentId: INTENT_ID,
+			}),
+		).toThrow("Release service URL must be a secure origin");
+	});
+
 	it("requests a GitHub OIDC token for the release-service audience", async () => {
 		const calls: Array<{ headers: Headers; url: URL }> = [];
 		const token = await requestGithubOidcToken(SERVICE, {
@@ -81,6 +115,58 @@ describe("delegated release CLI operations", () => {
 		expect(calls[0]?.headers.get("authorization")).toBe("Bearer runner-request-token");
 	});
 
+	it("claims a browser-started workflow pairing with GitHub OIDC", async () => {
+		const serviceRequests: Request[] = [];
+		const result = await connectGithubWorkflow(
+			{
+				serviceUrl: SERVICE,
+				publisherDid: PUBLISHER_DID,
+				pairingId: "01JABCDEFGHJKMNPQRSTVWXYZ1",
+				pairingToken: "T".repeat(43),
+			},
+			{
+				environment: ENVIRONMENT,
+				fetch: async (input, init) => {
+					const url = new URL(input instanceof Request ? input.url : input.toString());
+					if (url.hostname === "token.actions.example") {
+						return Response.json({ value: "header.payload.signature" });
+					}
+					serviceRequests.push(new Request(url, init));
+					return success({
+						pairing: {
+							id: "01JABCDEFGHJKMNPQRSTVWXYZ1",
+							packageSlug: "gallery",
+							state: "claimed",
+							claim: {
+								repository: "example/gallery",
+								repositoryId: "123456789",
+								repositoryOwner: "example",
+								repositoryOwnerId: "987654321",
+								repositoryVisibility: "private",
+								workflowRef: "example/gallery/.github/workflows/release.yml@refs/heads/main",
+								ref: "refs/heads/main",
+								environment: null,
+							},
+							expiresAt: 1_800_000_900_000,
+							createdAt: 1_800_000_000_000,
+							claimedAt: 1_800_000_001_000,
+							confirmedAt: null,
+						},
+						replayed: false,
+					});
+				},
+			},
+		);
+
+		expect(result.pairing.state).toBe("claimed");
+		expect(serviceRequests[0]?.headers.get("authorization")).toBe(
+			"Bearer header.payload.signature",
+		);
+		expect(serviceRequests[0]?.url).toBe(
+			`${SERVICE}/v1/workflow-pairings/01JABCDEFGHJKMNPQRSTVWXYZ1/claim`,
+		);
+	});
+
 	it("submits with the stable GitHub run idempotency identity", async () => {
 		const serviceRequests: Request[] = [];
 		const result = await submitDelegatedRelease(
@@ -112,6 +198,73 @@ describe("delegated release CLI operations", () => {
 		);
 	});
 
+	it("dry-runs admission without sending an idempotency key", async () => {
+		let serviceRequest: Request | null = null;
+		const result = await dryRunDelegatedRelease(
+			{
+				serviceUrl: SERVICE,
+				publisherDid: PUBLISHER_DID,
+				releaseFile: "release.json",
+			},
+			{
+				environment: ENVIRONMENT,
+				readReleaseRecord: async () => sourceRelease(),
+				fetch: async (input, init) => {
+					const url = new URL(input instanceof Request ? input.url : input.toString());
+					if (url.hostname === "token.actions.example") {
+						return Response.json({ value: "header.payload.signature" });
+					}
+					serviceRequest = new Request(url, init);
+					return success({
+						allowed: true,
+						publisherDid: PUBLISHER_DID,
+						packageSlug: "gallery",
+						version: "1.2.3",
+						workloadPolicyVersion: 1,
+						workloadIdentityDigest: "W".repeat(43),
+						requestDigest: "R".repeat(43),
+					});
+				},
+			},
+		);
+
+		expect(result).toMatchObject({ allowed: true, workloadPolicyVersion: 1 });
+		expect(serviceRequest?.url).toBe(`${SERVICE}/v1/release-intents/dry-run`);
+		expect(serviceRequest?.headers.has("idempotency-key")).toBe(false);
+	});
+
+	it("rejects an invalid dry-run source before requesting OIDC", async () => {
+		const invalid = sourceRelease();
+		Object.assign(invalid.artifacts.package, {
+			blob: {
+				$type: "blob",
+				ref: { $link: "bafkreicoew2cifs6fwqhqpkvkezdokuvpquj6p7aosznuf7jhxkehsltpe" },
+				mimeType: "application/gzip",
+				size: 128,
+			},
+		});
+		let fetchCalls = 0;
+
+		await expect(
+			dryRunDelegatedRelease(
+				{
+					serviceUrl: SERVICE,
+					publisherDid: PUBLISHER_DID,
+					releaseFile: "release.json",
+				},
+				{
+					environment: ENVIRONMENT,
+					readReleaseRecord: async () => invalid,
+					fetch: async () => {
+						fetchCalls += 1;
+						throw new Error("unexpected fetch");
+					},
+				},
+			),
+		).rejects.toThrow("Release record file is invalid");
+		expect(fetchCalls).toBe(0);
+	});
+
 	it("uses fresh OIDC tokens for status and cancellation", async () => {
 		let tokenCount = 0;
 		const serviceRequests: Request[] = [];
diff --git a/packages/registry-client/src/release-service/index.ts b/packages/registry-client/src/release-service/index.ts
index 1a43876cc1..fccba7f23b 100644
--- a/packages/registry-client/src/release-service/index.ts
+++ b/packages/registry-client/src/release-service/index.ts
@@ -4,17 +4,30 @@ import { parseDelegatedReleaseSourceRecord } from "./source-record.js";
 import {
 	TERMINAL_RELEASE_INTENT_STATES,
 	type AbortPublisherRestoreResult,
+	type AuditListOptions,
+	type ClaimWorkflowPairingInput,
+	type ClaimWorkflowPairingResult,
+	type ConfirmWorkflowPairingResult,
+	type ControlAuditEventResource,
+	type CreateWorkflowPairingResult,
 	type CursorPage,
 	type DelegationResource,
+	type DryRunReleaseIntentResult,
 	type DirectoryIdentityKind,
 	type DirectoryIdentityResource,
 	type DirectoryListOptions,
+	type EncryptionKeyStateResource,
+	type EncryptionKeyStatusResource,
+	type EncryptionVerificationResource,
 	type EncryptionRotationPageInput,
 	type EncryptionRotationResult,
 	type MutationResult,
 	type OperatorPublisherResource,
 	type PreparePublisherRestoreResult,
 	type PublisherArchiveKind,
+	type PublisherApproverStatusResource,
+	type PublisherApproverStatusResult,
+	type PublisherAuditEventResource,
 	type PublisherArchivePageInput,
 	type PublisherArchivePageResult,
 	type PublisherControlResource,
@@ -29,9 +42,12 @@ import {
 	type ReleaseServiceClientErrorCode,
 	type ServiceControlState,
 	type StartPublisherArchiveResult,
+	type StartEncryptionVerificationResult,
 	type SubmitReleaseIntentInput,
 	type SubmitReleaseIntentResult,
 	type WorkloadPolicyResource,
+	type WorkflowPairingClaimResource,
+	type WorkflowPairingResource,
 } from "./types.js";
 
 export type {
@@ -46,17 +62,32 @@ export { parseDelegatedReleaseSourceRecord } from "./source-record.js";
 
 export type {
 	AbortPublisherRestoreResult,
+	AuditListOptions,
+	ClaimWorkflowPairingInput,
+	ClaimWorkflowPairingResult,
+	ConfirmWorkflowPairingResult,
+	ControlAuditEventResource,
+	CreateWorkflowPairingResult,
 	CursorPage,
 	DelegationResource,
+	DryRunReleaseIntentResult,
 	DirectoryIdentityKind,
 	DirectoryIdentityResource,
 	DirectoryListOptions,
+	EncryptionKeyLifecycleStatus,
+	EncryptionKeyStateResource,
+	EncryptionKeyStatusResource,
+	EncryptionVerificationResource,
 	EncryptionRotationPageInput,
 	EncryptionRotationResult,
 	MutationResult,
 	OperatorPublisherResource,
 	PreparePublisherRestoreResult,
 	PublisherArchiveKind,
+	PublisherApproverEnrollmentState,
+	PublisherApproverStatusResource,
+	PublisherApproverStatusResult,
+	PublisherAuditEventResource,
 	PublisherArchivePageInput,
 	PublisherArchivePageResult,
 	PublisherControlResource,
@@ -71,9 +102,13 @@ export type {
 	ReleaseServiceClientErrorCode,
 	ServiceControlState,
 	StartPublisherArchiveResult,
+	StartEncryptionVerificationResult,
 	SubmitReleaseIntentInput,
 	SubmitReleaseIntentResult,
 	WorkloadPolicyResource,
+	WorkflowPairingClaimResource,
+	WorkflowPairingResource,
+	WorkflowPairingState,
 } from "./types.js";
 export { TERMINAL_RELEASE_INTENT_STATES } from "./types.js";
 
@@ -85,9 +120,12 @@ const CID_PATTERN = /^[A-Za-z0-9]+$/;
 const IDEMPOTENCY_KEY_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:-]{15,127}$/;
 const IDEMPOTENCY_PREFIX_PATTERN = /[^A-Za-z0-9._:-]/g;
 const DIGITS_PATTERN = /^[0-9]+$/;
+const POSITIVE_INTEGER_PATTERN = /^[1-9][0-9]*$/;
 const CSRF_TOKEN_PATTERN = /^[A-Za-z0-9_-]{43}$/;
+const PAIRING_TOKEN_PATTERN = /^[A-Za-z0-9_-]{43}$/;
 const ARCHIVE_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]{15,63}$/;
 const DIRECTORY_SHARD_PATTERN = /^[0-9a-f]{2}$/;
+const DIGEST_PATTERN = /^[A-Za-z0-9_-]{43}$/;
 const API_ERROR_CODES: Readonly<Record<ReleaseServiceApiErrorCode, true>> = {
 	ACCESS_DENIED: true,
 	ACCESS_AUTH_INVALID: true,
@@ -114,6 +152,11 @@ const API_ERROR_CODES: Readonly<Record<ReleaseServiceApiErrorCode, true>> = {
 	NOT_FOUND: true,
 	OAUTH_AUTHORIZATION_FAILED: true,
 	OAUTH_CALLBACK_INVALID: true,
+	PAIRING_CONFLICT: true,
+	PAIRING_EXPIRED: true,
+	PAIRING_INVALID: true,
+	PAIRING_LIMIT_REACHED: true,
+	PAIRING_NOT_CLAIMED: true,
 	PROFILE_CHANGED: true,
 	PROFILE_FETCH_FAILED: true,
 	PUBLISHER_SESSION_INVALID: true,
@@ -278,6 +321,14 @@ function safeInteger(value: Record<string, unknown>, key: string): number | null
 	return Number.isSafeInteger(item) ? Number(item) : null;
 }
 
+function nullableSafeInteger(
+	value: Record<string, unknown>,
+	key: string,
+): number | null | undefined {
+	const item = value[key];
+	return item === null ? null : Number.isSafeInteger(item) ? Number(item) : undefined;
+}
+
 function parseIntentResult(value: unknown): ReleaseIntentResult | null | undefined {
 	if (value === null) return null;
 	if (!isRecord(value)) return undefined;
@@ -336,7 +387,7 @@ function parseIntent(value: unknown, serviceUrl?: string): ReleaseIntentResource
 		} catch {
 			throw invalidResponse();
 		}
-		if (parsedApproval.origin !== serviceUrl || parsedApproval.protocol !== "https:") {
+		if (parsedApproval.origin !== serviceUrl) {
 			throw invalidResponse();
 		}
 	}
@@ -357,6 +408,42 @@ function parseIntent(value: unknown, serviceUrl?: string): ReleaseIntentResource
 	};
 }
 
+function parseDryRunIntent(value: unknown): DryRunReleaseIntentResult {
+	if (!isRecord(value)) throw invalidResponse();
+	const publisherDid = stringValue(value, "publisherDid");
+	const packageSlug = stringValue(value, "packageSlug");
+	const version = stringValue(value, "version");
+	const workloadPolicyVersion = safeInteger(value, "workloadPolicyVersion");
+	const workloadIdentityDigest = stringValue(value, "workloadIdentityDigest");
+	const requestDigest = stringValue(value, "requestDigest");
+	if (
+		value["allowed"] !== true ||
+		!publisherDid ||
+		!DID_PATTERN.test(publisherDid) ||
+		!packageSlug ||
+		!PACKAGE_SLUG_PATTERN.test(packageSlug) ||
+		!version ||
+		!VERSION_PATTERN.test(version) ||
+		workloadPolicyVersion === null ||
+		workloadPolicyVersion < 1 ||
+		!workloadIdentityDigest ||
+		!DIGEST_PATTERN.test(workloadIdentityDigest) ||
+		!requestDigest ||
+		!DIGEST_PATTERN.test(requestDigest)
+	) {
+		throw invalidResponse();
+	}
+	return {
+		allowed: true,
+		publisherDid,
+		packageSlug,
+		version,
+		workloadPolicyVersion,
+		workloadIdentityDigest,
+		requestDigest,
+	};
+}
+
 function parseStringArray(value: unknown): readonly string[] | null {
 	return Array.isArray(value) && value.every((item) => typeof item === "string")
 		? [...value]
@@ -408,6 +495,79 @@ function parsePolicy(value: unknown): WorkloadPolicyResource {
 	};
 }
 
+function parseWorkflowPairingClaim(value: unknown): WorkflowPairingClaimResource | null {
+	if (value === null) return null;
+	if (!isRecord(value)) throw invalidResponse();
+	const repository = stringValue(value, "repository");
+	const repositoryId = stringValue(value, "repositoryId");
+	const repositoryOwner = stringValue(value, "repositoryOwner");
+	const repositoryOwnerId = stringValue(value, "repositoryOwnerId");
+	const repositoryVisibility = value["repositoryVisibility"];
+	const workflowRef = stringValue(value, "workflowRef");
+	const ref = stringValue(value, "ref");
+	const environment = nullableString(value, "environment");
+	if (
+		!repository ||
+		!repositoryId ||
+		!POSITIVE_INTEGER_PATTERN.test(repositoryId) ||
+		!repositoryOwner ||
+		!repositoryOwnerId ||
+		!POSITIVE_INTEGER_PATTERN.test(repositoryOwnerId) ||
+		(repositoryVisibility !== "public" &&
+			repositoryVisibility !== "private" &&
+			repositoryVisibility !== "internal") ||
+		!workflowRef ||
+		!ref ||
+		environment === undefined
+	) {
+		throw invalidResponse();
+	}
+	return {
+		repository,
+		repositoryId,
+		repositoryOwner,
+		repositoryOwnerId,
+		repositoryVisibility,
+		workflowRef,
+		ref,
+		environment,
+	};
+}
+
+function parseWorkflowPairing(value: unknown): WorkflowPairingResource {
+	if (!isRecord(value)) throw invalidResponse();
+	const id = stringValue(value, "id");
+	const packageSlug = stringValue(value, "packageSlug");
+	const state = value["state"];
+	const expiresAt = safeInteger(value, "expiresAt");
+	const createdAt = safeInteger(value, "createdAt");
+	const claimedAt = nullableSafeInteger(value, "claimedAt");
+	const confirmedAt = nullableSafeInteger(value, "confirmedAt");
+	if (
+		!id ||
+		!ULID_PATTERN.test(id) ||
+		!packageSlug ||
+		!PACKAGE_SLUG_PATTERN.test(packageSlug) ||
+		(state !== "pending" && state !== "claimed" && state !== "confirmed" && state !== "expired") ||
+		expiresAt === null ||
+		createdAt === null ||
+		claimedAt === undefined ||
+		confirmedAt === undefined ||
+		createdAt > expiresAt
+	) {
+		throw invalidResponse();
+	}
+	const claim = parseWorkflowPairingClaim(value["claim"]);
+	if (
+		(state === "pending" && (claim !== null || claimedAt !== null || confirmedAt !== null)) ||
+		(state === "claimed" && (claim === null || claimedAt === null || confirmedAt !== null)) ||
+		(state === "confirmed" && (claim === null || claimedAt === null || confirmedAt === null))
+	) {
+		throw invalidResponse();
+	}
+	return { id, packageSlug, state, claim, expiresAt, createdAt, claimedAt, confirmedAt };
+}
+
 function parseDelegation(value: unknown): DelegationResource | null {
 	if (value === null) return null;
 	if (!isRecord(value)) throw invalidResponse();
@@ -446,17 +606,21 @@ function parseDelegation(value: unknown): DelegationResource | null {
 function parsePublisher(value: unknown): PublisherResource {
 	if (!isRecord(value)) throw invalidResponse();
 	const did = stringValue(value, "did");
+	const handleValue = value["handle"];
+	const handle = typeof handleValue === "string" ? handleValue : null;
 	const delegation = parseDelegation(value["delegation"]);
 	const sessionExpiresAt = value["sessionExpiresAt"];
 	if (
 		!did ||
 		!DID_PATTERN.test(did) ||
+		(handleValue !== undefined && handleValue !== null && handle === null) ||
 		(sessionExpiresAt !== undefined && !Number.isSafeInteger(sessionExpiresAt))
 	) {
 		throw invalidResponse();
 	}
 	return {
 		did,
+		handle,
 		delegation,
 		...(sessionExpiresAt === undefined ? {} : { sessionExpiresAt: Number(sessionExpiresAt) }),
 	};
@@ -500,6 +664,101 @@ function parsePublisherControl(value: unknown): PublisherControlResource {
 	return { publisherDid, status, reasonCode, changedBy, changedAt };
 }
 
+function parseControlAuditEvent(value: unknown): ControlAuditEventResource {
+	if (!isRecord(value)) throw invalidResponse();
+	const sequence = safeInteger(value, "sequence");
+	const eventType = stringValue(value, "eventType");
+	const actorRealm = value["actorRealm"];
+	const actorIdentity = stringValue(value, "actorIdentity");
+	const actorRole = value["actorRole"];
+	const subject = stringValue(value, "subject");
+	const reasonCode = nullableString(value, "reasonCode");
+	const createdAt = safeInteger(value, "createdAt");
+	if (
+		sequence === null ||
+		sequence < 1 ||
+		!eventType ||
+		(actorRealm !== "access" && actorRealm !== "system") ||
+		!actorIdentity ||
+		(actorRole !== null &&
+			actorRole !== "viewer" &&
+			actorRole !== "reviewer" &&
+			actorRole !== "admin") ||
+		!subject ||
+		reasonCode === undefined ||
+		createdAt === null
+	) {
+		throw invalidResponse();
+	}
+	return {
+		sequence,
+		eventType,
+		actorRealm,
+		actorIdentity,
+		actorRole,
+		subject,
+		reasonCode,
+		createdAt,
+	};
+}
+
+function parsePublisherAuditEvent(value: unknown): PublisherAuditEventResource {
+	if (!isRecord(value)) throw invalidResponse();
+	const sequence = safeInteger(value, "sequence");
+	const eventType = stringValue(value, "eventType");
+	const actorRealm = value["actorRealm"];
+	const actorIdentity = stringValue(value, "actorIdentity");
+	const actorHandleValue = value["actorHandle"];
+	const actorHandle = typeof actorHandleValue === "string" ? actorHandleValue : null;
+	const subject = stringValue(value, "subject");
+	const reasonCode = nullableString(value, "reasonCode");
+	const createdAt = safeInteger(value, "createdAt");
+	if (
+		sequence === null ||
+		sequence < 1 ||
+		!eventType ||
+		(actorRealm !== "access" &&
+			actorRealm !== "approver" &&
+			actorRealm !== "oidc" &&
+			actorRealm !== "publisher" &&
+			actorRealm !== "system") ||
+		!actorIdentity ||
+		(actorHandleValue !== undefined && actorHandleValue !== null && actorHandle === null) ||
+		!subject ||
+		reasonCode === undefined ||
+		createdAt === null
+	) {
+		throw invalidResponse();
+	}
+	return {
+		sequence,
+		eventType,
+		actorRealm,
+		actorIdentity,
+		actorHandle,
+		subject,
+		reasonCode,
+		createdAt,
+	};
+}
+
+function parsePublisherApproverStatus(value: unknown): PublisherApproverStatusResource {
+	if (!isRecord(value)) throw invalidResponse();
+	const did = stringValue(value, "did");
+	const handleValue = value["handle"];
+	const handle = typeof handleValue === "string" ? handleValue : null;
+	const status = value["status"];
+	if (
+		!did ||
+		!DID_PATTERN.test(did) ||
+		(handleValue !== undefined && handleValue !== null && handle === null) ||
+		(status !== "enrolled" && status !== "not_enrolled" && status !== "revoked")
+	) {
+		throw invalidResponse();
+	}
+	return { did, handle, status };
+}
+
 function invalidResponse(requestId: string | null = null): ReleaseServiceError {
 	return new ReleaseServiceError({
 		code: "CLIENT_RESPONSE_INVALID",
@@ -681,6 +940,34 @@ export class ReleaseServiceClient extends BaseReleaseServiceClient {
 		);
 	}
 
+	async dryRunIntent(
+		input: SubmitReleaseIntentInput,
+		options: RequestOptions = {},
+	): Promise<DryRunReleaseIntentResult> {
+		const release = parseDelegatedReleaseSourceRecord(input.release, {
+			packageSlug: input.packageSlug,
+			version: input.version,
+		});
+		if (!release) {
+			throw new ReleaseServiceError({
+				code: "INVALID_REQUEST",
+				message: "Delegated release source record is invalid",
+			});
+		}
+		const headers = await this.#workloadHeaders();
+		headers.set("content-type", "application/json");
+		return await this.call(
+			"/v1/release-intents/dry-run",
+			{
+				method: "POST",
+				headers,
+				body: JSON.stringify({ ...input, release }),
+				signal: options.signal,
+			},
+			parseDryRunIntent,
+		);
+	}
+
 	async getIntent(
 		publisherDid: string,
 		intentId: string,
@@ -780,6 +1067,113 @@ export class ReleaseServiceClient extends BaseReleaseServiceClient {
 		);
 	}
 
+	async createWorkflowPairing(
+		packageSlug: string,
+		options: MutationOptions,
+	): Promise<CreateWorkflowPairingResult> {
+		if (!PACKAGE_SLUG_PATTERN.test(packageSlug)) throw invalidResponse();
+		return await this.call(
+			"/v1/publisher/workflow-pairings",
+			{
+				method: "POST",
+				credentials: "include",
+				headers: await this.#publisherMutationHeaders(options.idempotencyKey),
+				body: JSON.stringify({ packageSlug }),
+				signal: options.signal,
+			},
+			(value) => {
+				if (!isRecord(value) || typeof value["replayed"] !== "boolean") {
+					throw invalidResponse();
+				}
+				const pairingToken = stringValue(value, "pairingToken");
+				if (!pairingToken || !PAIRING_TOKEN_PATTERN.test(pairingToken)) throw invalidResponse();
+				return {
+					pairing: parseWorkflowPairing(value["pairing"]),
+					pairingToken,
+					replayed: value["replayed"],
+				};
+			},
+		);
+	}
+
+	async getWorkflowPairing(
+		pairingId: string,
+		options: RequestOptions = {},
+	): Promise<WorkflowPairingResource> {
+		if (!ULID_PATTERN.test(pairingId)) throw invalidResponse();
+		return await this.call(
+			`/v1/publisher/workflow-pairings/${encodeURIComponent(pairingId)}`,
+			{ method: "GET", credentials: "include", signal: options.signal },
+			(value) => {
+				if (!isRecord(value)) throw invalidResponse();
+				return parseWorkflowPairing(value["pairing"]);
+			},
+		);
+	}
+
+	async confirmWorkflowPairing(
+		pairingId: string,
+		options: MutationOptions,
+	): Promise<ConfirmWorkflowPairingResult> {
+		if (!ULID_PATTERN.test(pairingId)) throw invalidResponse();
+		return await this.call(
+			`/v1/publisher/workflow-pairings/${encodeURIComponent(pairingId)}/confirm`,
+			{
+				method: "POST",
+				credentials: "include",
+				headers: await this.#publisherMutationHeaders(options.idempotencyKey),
+				body: "{}",
+				signal: options.signal,
+			},
+			(value) => {
+				if (!isRecord(value) || typeof value["replayed"] !== "boolean") {
+					throw invalidResponse();
+				}
+				return {
+					pairing: parseWorkflowPairing(value["pairing"]),
+					policy: parsePolicy(value["policy"]),
+					replayed: value["replayed"],
+				};
+			},
+		);
+	}
+
+	async claimWorkflowPairing(
+		input: ClaimWorkflowPairingInput,
+		options: RequestOptions = {},
+	): Promise<ClaimWorkflowPairingResult> {
+		if (
+			!DID_PATTERN.test(input.publisherDid) ||
+			!ULID_PATTERN.test(input.pairingId) ||
+			!PAIRING_TOKEN_PATTERN.test(input.pairingToken)
+		) {
+			throw invalidResponse();
+		}
+		const headers = await this.#workloadHeaders();
+		headers.set("content-type", "application/json");
+		return await this.call(
+			`/v1/workflow-pairings/${encodeURIComponent(input.pairingId)}/claim`,
+			{
+				method: "POST",
+				headers,
+				body: JSON.stringify({
+					publisherDid: input.publisherDid,
+					pairingToken: input.pairingToken,
+				}),
+				signal: options.signal,
+			},
+			(value) => {
+				if (!isRecord(value) || typeof value["replayed"] !== "boolean") {
+					throw invalidResponse();
+				}
+				return {
+					pairing: parseWorkflowPairing(value["pairing"]),
+					replayed: value["replayed"],
+				};
+			},
+		);
+	}
+
 	async listWorkloads(
 		options: RequestOptions & { cursor?: string; limit?: number } = {},
 	): Promise<CursorPage<WorkloadPolicyResource>> {
@@ -850,6 +1244,61 @@ export class ReleaseServiceClient extends BaseReleaseServiceClient {
 			(value) => parsePage(value, (item) => parseIntent(item, this.serviceUrl)),
 		);
 	}
+
+	async listPublisherAudit(
+		options: RequestOptions & AuditListOptions = {},
+	): Promise<CursorPage<PublisherAuditEventResource>> {
+		const url = new URL("/v1/publisher/audit", this.serviceUrl);
+		if (options.cursor) {
+			if (!POSITIVE_INTEGER_PATTERN.test(options.cursor)) {
+				throw new ReleaseServiceError({
+					code: "CLIENT_RESPONSE_INVALID",
+					message: "Audit cursor is invalid",
+				});
+			}
+			url.searchParams.set("cursor", options.cursor);
+		}
+		if (options.limit !== undefined) {
+			if (!Number.isSafeInteger(options.limit) || options.limit < 1 || options.limit > 100) {
+				throw new ReleaseServiceError({
+					code: "CLIENT_RESPONSE_INVALID",
+					message: "Audit limit is invalid",
+				});
+			}
+			url.searchParams.set("limit", String(options.limit));
+		}
+		return await this.call(
+			`${url.pathname}${url.search}`,
+			{ method: "GET", credentials: "include", signal: options.signal },
+			(value) => parsePage(value, parsePublisherAuditEvent),
+		);
+	}
+
+	async getPublisherApproverStatus(packageSlug: string): Promise<PublisherApproverStatusResult> {
+		if (!PACKAGE_SLUG_PATTERN.test(packageSlug)) {
+			throw new ReleaseServiceError({
+				code: "CLIENT_RESPONSE_INVALID",
+				message: "Package slug is invalid",
+			});
+		}
+		return await this.call(
+			`/v1/publisher/workloads/${encodeURIComponent(packageSlug)}/approvers`,
+			{ method: "GET", credentials: "include" },
+			(value) => {
+				if (!isRecord(value) || !Array.isArray(value["items"])) throw invalidResponse();
+				const returnedPackageSlug = stringValue(value, "packageSlug");
+				const profileCid = stringValue(value, "profileCid");
+				if (returnedPackageSlug !== packageSlug || !profileCid || !CID_PATTERN.test(profileCid)) {
+					throw invalidResponse();
+				}
+				return {
+					packageSlug: returnedPackageSlug,
+					profileCid,
+					items: value["items"].map(parsePublisherApproverStatus),
+				};
+			},
+		);
+	}
 }
 
 function parsePage<T>(value: unknown, parseItem: (item: unknown) => T): CursorPage<T> {
@@ -921,7 +1370,8 @@ function parseEncryptionRotation(value: unknown): EncryptionRotationResult {
 		raced < 0 ||
 		rotated + raced > scanned ||
 		(nextCursor !== null && typeof nextCursor !== "string") ||
-		typeof value["complete"] !== "boolean"
+		typeof value["complete"] !== "boolean" ||
+		value["complete"] !== (nextCursor === null && rotated === 0 && raced === 0)
 	) {
 		throw invalidResponse();
 	}
@@ -936,6 +1386,111 @@ function parseEncryptionRotation(value: unknown): EncryptionRotationResult {
 	};
 }
 
+function parseEncryptionKeyState(value: unknown): EncryptionKeyStateResource {
+	if (!isRecord(value)) throw invalidResponse();
+	const version = safeInteger(value, "version");
+	const status = value["status"];
+	const activatedAt = safeInteger(value, "activatedAt");
+	const retiredAt = nullableSafeInteger(value, "retiredAt");
+	const changedBy = stringValue(value, "changedBy");
+	const updatedAt = safeInteger(value, "updatedAt");
+	if (
+		version === null ||
+		version < 1 ||
+		version > 2_147_483_647 ||
+		(status !== "active" && status !== "readable" && status !== "retired") ||
+		activatedAt === null ||
+		activatedAt < 0 ||
+		retiredAt === undefined ||
+		(retiredAt !== null && retiredAt < activatedAt) ||
+		(status === "retired") !== (retiredAt !== null) ||
+		!changedBy ||
+		updatedAt === null ||
+		updatedAt < activatedAt
+	) {
+		throw invalidResponse();
+	}
+	return { version, status, activatedAt, retiredAt, changedBy, updatedAt };
+}
+
+function parseEncryptionVerification(value: unknown): EncryptionVerificationResource {
+	if (!isRecord(value)) throw invalidResponse();
+	const targetKeyVersion = safeInteger(value, "targetKeyVersion");
+	const workflowId = stringValue(value, "workflowId");
+	const publishers = safeInteger(value, "publishers");
+	const approvers = safeInteger(value, "approvers");
+	const records = safeInteger(value, "records");
+	const rotated = safeInteger(value, "rotated");
+	const verifiedAt = safeInteger(value, "verifiedAt");
+	if (
+		targetKeyVersion === null ||
+		targetKeyVersion < 1 ||
+		!workflowId ||
+		!DIGEST_PATTERN.test(workflowId) ||
+		publishers === null ||
+		publishers < 0 ||
+		approvers === null ||
+		approvers < 0 ||
+		records === null ||
+		records < 0 ||
+		rotated === null ||
+		rotated < 0 ||
+		verifiedAt === null ||
+		verifiedAt < 0
+	) {
+		throw invalidResponse();
+	}
+	return {
+		targetKeyVersion,
+		workflowId,
+		publishers,
+		approvers,
+		records,
+		rotated,
+		verifiedAt,
+	};
+}
+
+function parseEncryptionKeyStatus(value: unknown): EncryptionKeyStatusResource {
+	if (!isRecord(value) || !isRecord(value["configured"]) || !Array.isArray(value["keys"])) {
+		throw invalidResponse();
+	}
+	const activeVersion = safeInteger(value["configured"], "activeVersion");
+	const versions = value["configured"]["versions"];
+	if (
+		activeVersion === null ||
+		activeVersion < 1 ||
+		!Array.isArray(versions) ||
+		versions.length === 0 ||
+		versions.some(
+			(version) =>
+				!Number.isSafeInteger(version) || Number(version) < 1 || Number(version) > 2_147_483_647,
+		) ||
+		new Set(versions).size !== versions.length ||
+		!versions.includes(activeVersion)
+	) {
+		throw invalidResponse();
+	}
+	const keys = value["keys"].map(parseEncryptionKeyState);
+	if (
+		new Set(keys.map((key) => key.version)).size !== keys.length ||
+		keys.filter((key) => key.status === "active").length !== 1
+	) {
+		throw invalidResponse();
+	}
+	const verification =
+		value["verification"] === null ? null : parseEncryptionVerification(value["verification"]);
+	const controlledActiveVersion = keys.find((key) => key.status === "active")!.version;
+	if (verification !== null && verification.targetKeyVersion !== controlledActiveVersion) {
+		throw invalidResponse();
+	}
+	return {
+		configured: { activeVersion, versions: versions.map(Number) },
+		keys,
+		verification,
+	};
+}
+
 function archivePageInput(value: PublisherArchivePageInput): PublisherArchivePageInput {
 	if (
 		!ARCHIVE_ID_PATTERN.test(value.archiveId) ||
@@ -1143,6 +1698,104 @@ export class ReleaseServiceOperatorClient extends BaseReleaseServiceClient {
 		);
 	}
 
+	async getEncryptionKeyStatus(options: RequestOptions = {}): Promise<EncryptionKeyStatusResource> {
+		return await this.call(
+			"/admin/api/encryption/keys",
+			{ method: "GET", credentials: "include", signal: options.signal },
+			parseEncryptionKeyStatus,
+		);
+	}
+
+	async activateEncryptionKey(
+		version: number,
+		options: MutationOptions,
+	): Promise<MutationResult<EncryptionKeyStateResource>> {
+		if (!Number.isSafeInteger(version) || version < 1 || version > 2_147_483_647) {
+			throw new ReleaseServiceError({
+				code: "CLIENT_RESPONSE_INVALID",
+				message: "Encryption key version is invalid",
+			});
+		}
+		return await this.call(
+			"/admin/api/encryption/keys/activate",
+			{
+				method: "POST",
+				credentials: "include",
+				headers: this.#mutationHeaders(options.idempotencyKey),
+				body: JSON.stringify({ version }),
+				signal: options.signal,
+			},
+			(value) => {
+				if (!isRecord(value) || typeof value["replayed"] !== "boolean") {
+					throw invalidResponse();
+				}
+				return { value: parseEncryptionKeyState(value["key"]), replayed: value["replayed"] };
+			},
+		);
+	}
+
+	async startEncryptionVerification(
+		retiringVersion: number,
+		options: MutationOptions,
+	): Promise<StartEncryptionVerificationResult> {
+		if (
+			!Number.isSafeInteger(retiringVersion) ||
+			retiringVersion < 1 ||
+			retiringVersion > 2_147_483_647
+		) {
+			throw new ReleaseServiceError({
+				code: "CLIENT_RESPONSE_INVALID",
+				message: "Retiring encryption key version is invalid",
+			});
+		}
+		return await this.call(
+			"/admin/api/encryption/verify",
+			{
+				method: "POST",
+				credentials: "include",
+				headers: this.#mutationHeaders(options.idempotencyKey),
+				body: JSON.stringify({ retiringVersion }),
+				signal: options.signal,
+			},
+			(value) => {
+				if (!isRecord(value) || typeof value["created"] !== "boolean") {
+					throw invalidResponse();
+				}
+				const workflowId = stringValue(value, "workflowId");
+				if (!workflowId || !DIGEST_PATTERN.test(workflowId)) throw invalidResponse();
+				return { workflowId, created: value["created"] };
+			},
+		);
+	}
+
+	async retireEncryptionKey(
+		version: number,
+		options: MutationOptions,
+	): Promise<MutationResult<EncryptionKeyStateResource>> {
+		if (!Number.isSafeInteger(version) || version < 1 || version > 2_147_483_647) {
+			throw new ReleaseServiceError({
+				code: "CLIENT_RESPONSE_INVALID",
+				message: "Encryption key version is invalid",
+			});
+		}
+		return await this.call(
+			`/admin/api/encryption/keys/${version}/retire`,
+			{
+				method: "POST",
+				credentials: "include",
+				headers: this.#mutationHeaders(options.idempotencyKey),
+				body: "{}",
+				signal: options.signal,
+			},
+			(value) => {
+				if (!isRecord(value) || typeof value["replayed"] !== "boolean") {
+					throw invalidResponse();
+				}
+				return { value: parseEncryptionKeyState(value["key"]), replayed: value["replayed"] };
+			},
+		);
+	}
+
 	async listDirectory(
 		kind: DirectoryIdentityKind,
 		options: DirectoryListOptions & RequestOptions = {},
@@ -1169,6 +1822,41 @@ export class ReleaseServiceOperatorClient extends BaseReleaseServiceClient {
 		);
 	}
 
+	async listAudit(options: AuditListOptions = {}): Promise<CursorPage<ControlAuditEventResource>> {
+		const url = new URL("/admin/api/audit", this.serviceUrl);
+		if (options.cursor) {
+			if (!DIGITS_PATTERN.test(options.cursor)) {
+				throw new ReleaseServiceError({
+					code: "CLIENT_RESPONSE_INVALID",
+					message: "Audit cursor is invalid",
+				});
+			}
+			url.searchParams.set("after", options.cursor);
+		}
+		if (options.limit !== undefined) {
+			if (!Number.isSafeInteger(options.limit) || options.limit < 1 || options.limit > 100) {
+				throw new ReleaseServiceError({
+					code: "CLIENT_RESPONSE_INVALID",
+					message: "Audit limit is invalid",
+				});
+			}
+			url.searchParams.set("limit", String(options.limit));
+		}
+		return await this.call(
+			`${url.pathname}${url.search}`,
+			{ method: "GET", credentials: "include" },
+			(value) => {
+				if (!isRecord(value) || !Array.isArray(value["items"])) throw invalidResponse();
+				const nextCursor = nullableString(value, "nextCursor");
+				if (nextCursor === undefined) throw invalidResponse();
+				return {
+					items: value["items"].map(parseControlAuditEvent),
+					...(nextCursor ? { nextCursor } : {}),
+				};
+			},
+		);
+	}
+
 	async setMode(
 		mode: ServiceControlState["mode"],
 		reasonCode: string | null,
diff --git a/packages/registry-client/src/release-service/types.ts b/packages/registry-client/src/release-service/types.ts
index 48c9e199f6..dc677c7776 100644
--- a/packages/registry-client/src/release-service/types.ts
+++ b/packages/registry-client/src/release-service/types.ts
@@ -42,6 +42,11 @@ export type ReleaseServiceApiErrorCode =
 	| "NOT_FOUND"
 	| "OAUTH_AUTHORIZATION_FAILED"
 	| "OAUTH_CALLBACK_INVALID"
+	| "PAIRING_CONFLICT"
+	| "PAIRING_EXPIRED"
+	| "PAIRING_INVALID"
+	| "PAIRING_LIMIT_REACHED"
+	| "PAIRING_NOT_CLAIMED"
 	| "PROFILE_CHANGED"
 	| "PROFILE_FETCH_FAILED"
 	| "PUBLISHER_SESSION_INVALID"
@@ -94,6 +99,16 @@ export interface SubmitReleaseIntentResult {
 	replayed: boolean;
 }
 
+export interface DryRunReleaseIntentResult {
+	allowed: true;
+	publisherDid: string;
+	packageSlug: string;
+	version: string;
+	workloadPolicyVersion: number;
+	workloadIdentityDigest: string;
+	requestDigest: string;
+}
+
 export interface WorkloadPolicyResource {
 	packageSlug: string;
 	repository: string;
@@ -120,6 +135,53 @@ export interface PutWorkloadPolicyInput {
 	expectedVersion: number | null;
 }
 
+export type WorkflowPairingState = "claimed" | "confirmed" | "expired" | "pending";
+
+export interface WorkflowPairingClaimResource {
+	repository: string;
+	repositoryId: string;
+	repositoryOwner: string;
+	repositoryOwnerId: string;
+	repositoryVisibility: "internal" | "private" | "public";
+	workflowRef: string;
+	ref: string;
+	environment: string | null;
+}
+
+export interface WorkflowPairingResource {
+	id: string;
+	packageSlug: string;
+	state: WorkflowPairingState;
+	claim: WorkflowPairingClaimResource | null;
+	expiresAt: number;
+	createdAt: number;
+	claimedAt: number | null;
+	confirmedAt: number | null;
+}
+
+export interface CreateWorkflowPairingResult {
+	pairing: WorkflowPairingResource;
+	pairingToken: string;
+	replayed: boolean;
+}
+
+export interface ClaimWorkflowPairingInput {
+	publisherDid: string;
+	pairingId: string;
+	pairingToken: string;
+}
+
+export interface ClaimWorkflowPairingResult {
+	pairing: WorkflowPairingResource;
+	replayed: boolean;
+}
+
+export interface ConfirmWorkflowPairingResult {
+	pairing: WorkflowPairingResource;
+	policy: WorkloadPolicyResource;
+	replayed: boolean;
+}
+
 export interface DelegationResource {
 	releaseNsid: string;
 	scope: string;
@@ -133,6 +195,7 @@ export interface DelegationResource {
 
 export interface PublisherResource {
 	did: string;
+	handle: string | null;
 	delegation: DelegationResource | null;
 	sessionExpiresAt?: number;
 }
@@ -172,6 +235,47 @@ export interface DirectoryListOptions {
 	limit?: number;
 }
 
+export interface AuditListOptions {
+	cursor?: string;
+	limit?: number;
+}
+
+export interface ControlAuditEventResource {
+	sequence: number;
+	eventType: string;
+	actorRealm: "access" | "system";
+	actorIdentity: string;
+	actorRole: "admin" | "reviewer" | "viewer" | null;
+	subject: string;
+	reasonCode: string | null;
+	createdAt: number;
+}
+
+export interface PublisherAuditEventResource {
+	sequence: number;
+	eventType: string;
+	actorRealm: "access" | "approver" | "oidc" | "publisher" | "system";
+	actorIdentity: string;
+	actorHandle: string | null;
+	subject: string;
+	reasonCode: string | null;
+	createdAt: number;
+}
+
+export type PublisherApproverEnrollmentState = "enrolled" | "not_enrolled" | "revoked";
+
+export interface PublisherApproverStatusResource {
+	did: string;
+	handle: string | null;
+	status: PublisherApproverEnrollmentState;
+}
+
+export interface PublisherApproverStatusResult {
+	packageSlug: string;
+	profileCid: string;
+	items: PublisherApproverStatusResource[];
+}
+
 export interface EncryptionRotationPageInput {
 	afterCursor: string | null;
 	limit: number;
@@ -187,6 +291,41 @@ export interface EncryptionRotationResult {
 	complete: boolean;
 }
 
+export type EncryptionKeyLifecycleStatus = "active" | "readable" | "retired";
+
+export interface EncryptionKeyStateResource {
+	version: number;
+	status: EncryptionKeyLifecycleStatus;
+	activatedAt: number;
+	retiredAt: number | null;
+	changedBy: string;
+	updatedAt: number;
+}
+
+export interface EncryptionKeyStatusResource {
+	configured: {
+		activeVersion: number;
+		versions: number[];
+	};
+	keys: EncryptionKeyStateResource[];
+	verification: EncryptionVerificationResource | null;
+}
+
+export interface EncryptionVerificationResource {
+	targetKeyVersion: number;
+	workflowId: string;
+	publishers: number;
+	approvers: number;
+	records: number;
+	rotated: number;
+	verifiedAt: number;
+}
+
+export interface StartEncryptionVerificationResult {
+	workflowId: string;
+	created: boolean;
+}
+
 export type PublisherArchiveKind = "audit-events" | "intents" | "metadata" | "workload-policies";
 
 export interface PublisherArchivePageInput {
diff --git a/packages/registry-client/tests/release-service.test.ts b/packages/registry-client/tests/release-service.test.ts
index 40a6af4347..eb049f57d4 100644
--- a/packages/registry-client/tests/release-service.test.ts
+++ b/packages/registry-client/tests/release-service.test.ts
@@ -11,6 +11,8 @@ import {
 const SERVICE = "https://release.example.com";
 const PUBLISHER_DID = "did:web:publisher.example.com";
 const INTENT_ID = "01JABCDEFGHJKMNPQRSTVWXYZ0";
+const PAIRING_ID = "01JABCDEFGHJKMNPQRSTVWXYZ1";
+const PAIRING_TOKEN = "T".repeat(43);
 const CSRF = "C".repeat(43);
 const CHECKSUM = "bciqcz4snxjp3biyoe3udwkwfxhrj4gywdzob7j2clzzqim3csofzqja";
 
@@ -39,7 +41,7 @@ function sourceRelease() {
 	};
 }
 
-function intent(state = "received") {
+function intent(state = "received", service = SERVICE) {
 	return {
 		id: INTENT_ID,
 		publisherDid: PUBLISHER_DID,
@@ -55,7 +57,7 @@ function intent(state = "received") {
 		result: null,
 		approvalUrl:
 			state === "awaiting_approval"
-				? `${SERVICE}/approvals/${INTENT_ID}?publisher=${encodeURIComponent(PUBLISHER_DID)}`
+				? `${service}/approvals/${INTENT_ID}?publisher=${encodeURIComponent(PUBLISHER_DID)}`
 				: null,
 	};
 }
@@ -77,6 +79,31 @@ function policy() {
 	};
 }
 
+function pairing(state: "claimed" | "confirmed" | "pending") {
+	return {
+		id: PAIRING_ID,
+		packageSlug: "gallery",
+		state,
+		claim:
+			state === "pending"
+				? null
+				: {
+						repository: "example/gallery",
+						repositoryId: "123456789",
+						repositoryOwner: "example",
+						repositoryOwnerId: "987654321",
+						repositoryVisibility: "private",
+						workflowRef: "example/gallery/.github/workflows/release.yml@refs/heads/main",
+						ref: "refs/heads/main",
+						environment: "production",
+					},
+		expiresAt: 1_800_000_900_000,
+		createdAt: 1_800_000_000_000,
+		claimedAt: state === "pending" ? null : 1_800_000_001_000,
+		confirmedAt: state === "confirmed" ? 1_800_000_002_000 : null,
+	};
+}
+
 function success(data: unknown, status = 200): Response {
 	return Response.json(
 		{ data, requestId: "request-1" },
@@ -101,6 +128,19 @@ describe("ReleaseServiceClient", () => {
 		).toThrow("HTTPS origin or a loopback");
 	});
 
+	it("accepts an approval URL on the configured loopback origin", async () => {
+		const service = "http://127.0.0.1:5175";
+		const client = new ReleaseServiceClient({
+			serviceUrl: service,
+			fetch: async () => success({ intent: intent("awaiting_approval", service) }),
+			workloadToken: "header.payload.signature",
+		});
+
+		await expect(client.getIntent(PUBLISHER_DID, INTENT_ID)).resolves.toMatchObject({
+			approvalUrl: `${service}/approvals/${INTENT_ID}?publisher=${encodeURIComponent(PUBLISHER_DID)}`,
+		});
+	});
+
 	it("submits a typed intent without retaining or exposing the workload token", async () => {
 		const calls: Array<{ init: RequestInit | undefined; url: string }> = [];
 		const workloadToken = "header.payload.signature";
@@ -148,6 +188,65 @@ describe("ReleaseServiceClient", () => {
 		expect(fetch).not.toHaveBeenCalled();
 	});
 
+	it("dry-runs workload admission without an idempotency key", async () => {
+		let request: Request | null = null;
+		const client = new ReleaseServiceClient({
+			serviceUrl: SERVICE,
+			workloadToken: "header.payload.signature",
+			fetch: async (input, init) => {
+				request = new Request(input, init);
+				return success({
+					allowed: true,
+					publisherDid: PUBLISHER_DID,
+					packageSlug: "gallery",
+					version: "1.2.3",
+					workloadPolicyVersion: 2,
+					workloadIdentityDigest: "W".repeat(43),
+					requestDigest: "R".repeat(43),
+				});
+			},
+		});
+		const release = sourceRelease();
+
+		await expect(
+			client.dryRunIntent({
+				publisherDid: PUBLISHER_DID,
+				packageSlug: "gallery",
+				version: "1.2.3",
+				release,
+			}),
+		).resolves.toMatchObject({ allowed: true, workloadPolicyVersion: 2 });
+		expect(request?.url).toBe(`${SERVICE}/v1/release-intents/dry-run`);
+		expect(request?.headers.get("authorization")).toBe("Bearer header.payload.signature");
+		expect(request?.headers.has("idempotency-key")).toBe(false);
+	});
+
+	it("rejects invalid dry-run source records before acquiring a workload token", async () => {
+		const release = sourceRelease();
+		Object.assign(release.artifacts.package, {
+			blob: {
+				$type: "blob",
+				ref: { $link: "bafkreicoew2cifs6fwqhqpkvkezdokuvpquj6p7aosznuf7jhxkehsltpe" },
+				mimeType: "application/gzip",
+				size: 128,
+			},
+		});
+		const token = vi.fn(() => "header.payload.signature");
+		const fetch = vi.fn<typeof globalThis.fetch>();
+		const client = new ReleaseServiceClient({ serviceUrl: SERVICE, fetch, workloadToken: token });
+
+		await expect(
+			client.dryRunIntent({
+				publisherDid: PUBLISHER_DID,
+				packageSlug: "gallery",
+				version: "1.2.3",
+				release,
+			}),
+		).rejects.toMatchObject({ code: "INVALID_REQUEST" });
+		expect(token).not.toHaveBeenCalled();
+		expect(fetch).not.toHaveBeenCalled();
+	});
+
 	it("maps stable server errors, retry hints, and network failures", async () => {
 		const workloadToken = "header.payload.signature";
 		const pausedFetch: typeof globalThis.fetch = async () =>
@@ -302,6 +401,133 @@ describe("ReleaseServiceClient", () => {
 		expect(mutationHeaders.has("authorization")).toBe(false);
 	});
 
+	it("pairs a GitHub workflow through separate browser and OIDC steps", async () => {
+		const calls: Request[] = [];
+		const fetch: typeof globalThis.fetch = async (input, init = {}) => {
+			const request = new Request(input, init);
+			calls.push(request);
+			if (request.url.endsWith("/claim")) {
+				return success({ pairing: pairing("claimed"), replayed: false });
+			}
+			if (request.url.endsWith("/confirm")) {
+				return success({ pairing: pairing("confirmed"), policy: policy(), replayed: false });
+			}
+			if (request.method === "GET") return success({ pairing: pairing("claimed") });
+			return success(
+				{ pairing: pairing("pending"), pairingToken: PAIRING_TOKEN, replayed: false },
+				201,
+			);
+		};
+		const client = new ReleaseServiceClient({
+			serviceUrl: SERVICE,
+			fetch,
+			csrfToken: CSRF,
+			workloadToken: "header.payload.signature",
+		});
+
+		await expect(
+			client.createWorkflowPairing("gallery", {
+				idempotencyKey: "workflow-pairing-create-0001",
+			}),
+		).resolves.toMatchObject({ pairingToken: PAIRING_TOKEN, pairing: { state: "pending" } });
+		await expect(client.getWorkflowPairing(PAIRING_ID)).resolves.toMatchObject({
+			state: "claimed",
+		});
+		await expect(
+			client.confirmWorkflowPairing(PAIRING_ID, {
+				idempotencyKey: "workflow-pairing-confirm-0001",
+			}),
+		).resolves.toMatchObject({ pairing: { state: "confirmed" }, policy: { active: true } });
+		await expect(
+			client.claimWorkflowPairing({
+				publisherDid: PUBLISHER_DID,
+				pairingId: PAIRING_ID,
+				pairingToken: PAIRING_TOKEN,
+			}),
+		).resolves.toMatchObject({ pairing: { state: "claimed" } });
+
+		expect(calls.map((request) => new URL(request.url).pathname)).toEqual([
+			"/v1/publisher/workflow-pairings",
+			`/v1/publisher/workflow-pairings/${PAIRING_ID}`,
+			`/v1/publisher/workflow-pairings/${PAIRING_ID}/confirm`,
+			`/v1/workflow-pairings/${PAIRING_ID}/claim`,
+		]);
+		expect(calls[0]?.credentials).toBe("include");
+		expect(calls[2]?.headers.get("x-emdash-csrf")).toBe(CSRF);
+		expect(calls[3]?.headers.get("authorization")).toBe("Bearer header.payload.signature");
+	});
+
+	it("lists only the authenticated publisher audit", async () => {
+		let captured = "";
+		let capturedSignal: AbortSignal | null | undefined;
+		const controller = new AbortController();
+		const client = new ReleaseServiceClient({
+			serviceUrl: SERVICE,
+			fetch: async (input, init) => {
+				captured = input instanceof Request ? input.url : input.toString();
+				capturedSignal = init?.signal;
+				return success({
+					items: [
+						{
+							sequence: 3,
+							eventType: "workload-policy-stored",
+							actorRealm: "publisher",
+							actorIdentity: PUBLISHER_DID,
+							actorHandle: "publisher.example.com",
+							subject: "gallery",
+							reasonCode: null,
+							createdAt: 1_800_000_000_000,
+						},
+					],
+					nextCursor: "3",
+				});
+			},
+		});
+
+		await expect(
+			client.listPublisherAudit({ cursor: "2", limit: 1, signal: controller.signal }),
+		).resolves.toMatchObject({
+			items: [{ sequence: 3, actorRealm: "publisher", actorHandle: "publisher.example.com" }],
+			nextCursor: "3",
+		});
+		expect(captured).toBe(`${SERVICE}/v1/publisher/audit?cursor=2&limit=1`);
+		expect(capturedSignal).toBe(controller.signal);
+		await expect(client.listPublisherAudit({ cursor: "0" })).rejects.toMatchObject({
+			code: "CLIENT_RESPONSE_INVALID",
+		});
+		await expect(client.listPublisherAudit({ cursor: "01" })).rejects.toMatchObject({
+			code: "CLIENT_RESPONSE_INVALID",
+		});
+	});
+
+	it("reads publisher-visible approver readiness", async () => {
+		let captured = "";
+		const client = new ReleaseServiceClient({
+			serviceUrl: SERVICE,
+			fetch: async (input) => {
+				captured = input instanceof Request ? input.url : input.toString();
+				return success({
+					packageSlug: "gallery",
+					profileCid: "bafyprofile",
+					items: [
+						{
+							did: "did:plc:approver",
+							handle: "approver.example.com",
+							status: "enrolled",
+						},
+					],
+				});
+			},
+		});
+
+		await expect(client.getPublisherApproverStatus("gallery")).resolves.toEqual({
+			packageSlug: "gallery",
+			profileCid: "bafyprofile",
+			items: [{ did: "did:plc:approver", handle: "approver.example.com", status: "enrolled" }],
+		});
+		expect(captured).toBe(`${SERVICE}/v1/publisher/workloads/gallery/approvers`);
+	});
+
 	it("creates valid collision-resistant idempotency keys", () => {
 		const first = createReleaseIdempotencyKey("github action");
 		const second = createReleaseIdempotencyKey("github action");
@@ -311,6 +537,37 @@ describe("ReleaseServiceClient", () => {
 });
 
 describe("ReleaseServiceOperatorClient", () => {
+	it("paginates sanitized service-control audit events", async () => {
+		let captured = "";
+		const client = new ReleaseServiceOperatorClient({
+			serviceUrl: SERVICE,
+			fetch: async (input) => {
+				captured = input instanceof Request ? input.url : input.toString();
+				return success({
+					items: [
+						{
+							sequence: 7,
+							eventType: "service-mode-changed",
+							actorRealm: "access",
+							actorIdentity: "operator-subject",
+							actorRole: "admin",
+							subject: "publication-paused",
+							reasonCode: "MAINTENANCE",
+							createdAt: 1_800_000_000_000,
+						},
+					],
+					nextCursor: "7",
+				});
+			},
+		});
+
+		await expect(client.listAudit({ cursor: "6", limit: 1 })).resolves.toMatchObject({
+			items: [{ sequence: 7, actorRole: "admin" }],
+			nextCursor: "7",
+		});
+		expect(captured).toBe(`${SERVICE}/admin/api/audit?after=6&limit=1`);
+	});
+
 	it("lists one bounded operations-directory shard", async () => {
 		let captured = "";
 		const fetch: typeof globalThis.fetch = async (input) => {
@@ -398,7 +655,7 @@ describe("ReleaseServiceOperatorClient", () => {
 				ownerDid: url.pathname.includes("/approvers/") ? "did:plc:approver" : PUBLISHER_DID,
 				targetKeyVersion: 2,
 				scanned: 1,
-				rotated: 1,
+				rotated: 0,
 				raced: 0,
 				nextCursor: null,
 				complete: true,
@@ -421,7 +678,7 @@ describe("ReleaseServiceOperatorClient", () => {
 				},
 				{ idempotencyKey: "operator-approver-rotation-0001" },
 			),
-		).resolves.toMatchObject({ ownerDid: "did:plc:approver", rotated: 1 });
+		).resolves.toMatchObject({ ownerDid: "did:plc:approver", rotated: 0 });
 
 		expect(calls).toEqual([
 			{
@@ -435,6 +692,78 @@ describe("ReleaseServiceOperatorClient", () => {
 		]);
 	});
 
+	it("reads, activates, and retires encryption key lifecycle state", async () => {
+		const calls: Array<{ body: string | null; path: string }> = [];
+		const fetch: typeof globalThis.fetch = async (input, init) => {
+			const url = new URL(input instanceof Request ? input.url : input.toString());
+			calls.push({ path: url.pathname, body: typeof init?.body === "string" ? init.body : null });
+			if (init?.method === "GET") {
+				return success({
+					configured: { activeVersion: 2, versions: [1, 2] },
+					keys: [
+						{
+							version: 1,
+							status: "readable",
+							activatedAt: 0,
+							retiredAt: null,
+							changedBy: "system:bootstrap",
+							updatedAt: 100,
+						},
+						{
+							version: 2,
+							status: "active",
+							activatedAt: 100,
+							retiredAt: null,
+							changedBy: "operator",
+							updatedAt: 100,
+						},
+					],
+					verification: null,
+				});
+			}
+			if (url.pathname.endsWith("/verify")) {
+				return success({ workflowId: "V".repeat(43), created: true });
+			}
+			const retiring = url.pathname.endsWith("/retire");
+			return success({
+				key: {
+					version: retiring ? 1 : 2,
+					status: retiring ? "retired" : "active",
+					activatedAt: retiring ? 0 : 100,
+					retiredAt: retiring ? 200 : null,
+					changedBy: "operator",
+					updatedAt: retiring ? 200 : 100,
+				},
+				replayed: false,
+			});
+		};
+		const client = new ReleaseServiceOperatorClient({ serviceUrl: SERVICE, fetch });
+		await expect(client.getEncryptionKeyStatus()).resolves.toMatchObject({
+			configured: { activeVersion: 2 },
+			keys: [
+				{ version: 1, status: "readable" },
+				{ version: 2, status: "active" },
+			],
+		});
+		await expect(
+			client.activateEncryptionKey(2, { idempotencyKey: "operator-key-activate-0001" }),
+		).resolves.toMatchObject({ value: { version: 2, status: "active" }, replayed: false });
+		await expect(
+			client.startEncryptionVerification(1, {
+				idempotencyKey: "operator-key-verification-0001",
+			}),
+		).resolves.toEqual({ workflowId: "V".repeat(43), created: true });
+		await expect(
+			client.retireEncryptionKey(1, { idempotencyKey: "operator-key-retire-0001" }),
+		).resolves.toMatchObject({ value: { version: 1, status: "retired" }, replayed: false });
+		expect(calls).toEqual([
+			{ path: "/admin/api/encryption/keys", body: null },
+			{ path: "/admin/api/encryption/keys/activate", body: '{"version":2}' },
+			{ path: "/admin/api/encryption/verify", body: '{"retiringVersion":1}' },
+			{ path: "/admin/api/encryption/keys/1/retire", body: "{}" },
+		]);
+	});
+
 	it("resumes encrypted publisher archive pages through Access", async () => {
 		let captured: { init: RequestInit | undefined; url: string } | null = null;
 		const fetch: typeof globalThis.fetch = async (input, init) => {
diff --git a/packages/registry-verification/package.json b/packages/registry-verification/package.json
index f7863d1f50..e8ea39127e 100644
--- a/packages/registry-verification/package.json
+++ b/packages/registry-verification/package.json
@@ -24,6 +24,10 @@
 		"./fetch": {
 			"types": "./dist/fetch-entry.d.ts",
 			"default": "./dist/fetch-entry.js"
+		},
+		"./records": {
+			"types": "./dist/records-entry.d.ts",
+			"default": "./dist/records-entry.js"
 		}
 	},
 	"files": [
diff --git a/packages/registry-verification/src/index.ts b/packages/registry-verification/src/index.ts
index 2b5690ebbb..04bb163433 100644
--- a/packages/registry-verification/src/index.ts
+++ b/packages/registry-verification/src/index.ts
@@ -25,7 +25,8 @@ export {
 export { validatePluginBundle } from "./bundle.js";
 export { GitHubProvenanceVerifier } from "./provenance.js";
 export { canonicalizeRepositoryUrl } from "./repository.js";
-export { inspectPackageReleaseRecords, verifyPackageReleaseRecords } from "./records.js";
+export { inspectPackageReleaseRecords } from "./records.js";
+export { verifyPackageReleaseRecords } from "./records-default.js";
 export type { DecodedMultihash, MultihashAlgorithm } from "./checksum.js";
 export type {
 	FetchedReleaseArtifact,
diff --git a/packages/registry-verification/src/records-default.ts b/packages/registry-verification/src/records-default.ts
new file mode 100644
index 0000000000..dedc202581
--- /dev/null
+++ b/packages/registry-verification/src/records-default.ts
@@ -0,0 +1,13 @@
+import { GitHubProvenanceVerifier } from "./provenance.js";
+import {
+	verifyPackageReleaseRecordsWithDefaultVerifier,
+	type RecordVerificationInput,
+	type RecordVerificationReport,
+} from "./records.js";
+
+/** Validate signed profile/release records and apply the complete provenance policy. */
+export function verifyPackageReleaseRecords(
+	input: RecordVerificationInput,
+): Promise<RecordVerificationReport> {
+	return verifyPackageReleaseRecordsWithDefaultVerifier(input, new GitHubProvenanceVerifier());
+}
diff --git a/packages/registry-verification/src/records-entry.ts b/packages/registry-verification/src/records-entry.ts
new file mode 100644
index 0000000000..9c374a4a6d
--- /dev/null
+++ b/packages/registry-verification/src/records-entry.ts
@@ -0,0 +1,32 @@
+import type { ProvenanceVerifier, VerifiedProvenance } from "./provenance.js";
+import { verifyPackageReleaseRecordsWithVerifier } from "./records.js";
+import type {
+	NormalizedReleasePolicy,
+	ProvenanceEvidence,
+	ProvenanceStatus,
+	RecordVerificationCode,
+	RecordVerificationInputWithVerifier,
+	RecordVerificationReason,
+	RecordVerificationReport,
+	VerifiedRecordContext,
+} from "./records.js";
+
+export type RecordVerificationInput = RecordVerificationInputWithVerifier;
+
+export function verifyPackageReleaseRecords(
+	input: RecordVerificationInput,
+): Promise<RecordVerificationReport> {
+	return verifyPackageReleaseRecordsWithVerifier(input);
+}
+
+export type {
+	NormalizedReleasePolicy,
+	ProvenanceEvidence,
+	ProvenanceStatus,
+	ProvenanceVerifier,
+	RecordVerificationCode,
+	RecordVerificationReason,
+	RecordVerificationReport,
+	VerifiedProvenance,
+	VerifiedRecordContext,
+};
diff --git a/packages/registry-verification/src/records.ts b/packages/registry-verification/src/records.ts
index 48d5ad9335..1783ad4de0 100644
--- a/packages/registry-verification/src/records.ts
+++ b/packages/registry-verification/src/records.ts
@@ -15,7 +15,6 @@ import {
 import { unsupportedAuthDetails, UNSUPPORTED_AUTH_MESSAGE } from "./auth.js";
 import { compareDigestBytes, decodeMultihash, multihashFromBlobCid } from "./checksum.js";
 import type { VerificationErrorCode } from "./errors.js";
-import { GitHubProvenanceVerifier } from "./provenance.js";
 import type { ProvenanceVerifier, VerifiedProvenance } from "./provenance.js";
 import { canonicalizeRepositoryUrl } from "./repository.js";
 
@@ -43,6 +42,9 @@ export interface RecordVerificationInput {
 }
 
 export type RecordInspectionInput = Omit<RecordVerificationInput, "provenance">;
+export type RecordVerificationInputWithVerifier = Omit<RecordVerificationInput, "provenance"> & {
+	provenance?: ProvenanceEvidence & { verifier: ProvenanceVerifier };
+};
 
 export type RecordVerificationCode =
 	| VerificationErrorCode
@@ -233,9 +235,9 @@ export async function inspectPackageReleaseRecords(
 	};
 }
 
-/** Validate signed records and apply the complete provenance policy. */
-export async function verifyPackageReleaseRecords(
+async function verifyPackageReleaseRecordsInternal(
 	input: RecordVerificationInput,
+	defaultVerifier: ProvenanceVerifier | null,
 ): Promise<RecordVerificationReport> {
 	const inspection = await inspectPackageReleaseRecords(input);
 	if (!inspection.success) return inspection;
@@ -283,7 +285,14 @@ export async function verifyPackageReleaseRecords(
 			"failed",
 		);
 	}
-	const verifier = input.provenance.verifier ?? new GitHubProvenanceVerifier();
+	const verifier = input.provenance.verifier ?? defaultVerifier;
+	if (!verifier) {
+		return failed(
+			"PROVENANCE_UNVERIFIABLE",
+			"The supplied provenance verifier is unavailable.",
+			"failed",
+		);
+	}
 	let provenanceResult: Awaited<ReturnType<ProvenanceVerifier["verify"]>>;
 	try {
 		provenanceResult = await verifier.verify({
@@ -317,6 +326,19 @@ export async function verifyPackageReleaseRecords(
 	};
 }
 
+export function verifyPackageReleaseRecordsWithVerifier(
+	input: RecordVerificationInputWithVerifier,
+): Promise<RecordVerificationReport> {
+	return verifyPackageReleaseRecordsInternal(input, null);
+}
+
+export function verifyPackageReleaseRecordsWithDefaultVerifier(
+	input: RecordVerificationInput,
+	defaultVerifier: ProvenanceVerifier,
+): Promise<RecordVerificationReport> {
+	return verifyPackageReleaseRecordsInternal(input, defaultVerifier);
+}
+
 function normalizePolicy(
 	value: PackageProfileExtension.ReleasePolicy | undefined,
 ): NormalizedReleasePolicy | null {
diff --git a/packages/registry-verification/tests/records.test.ts b/packages/registry-verification/tests/records.test.ts
index 3a73a9c41c..0a968fc05c 100644
--- a/packages/registry-verification/tests/records.test.ts
+++ b/packages/registry-verification/tests/records.test.ts
@@ -10,6 +10,7 @@ import type {
 	VerifiedProvenance,
 } from "../src/index.js";
 import { inspectPackageReleaseRecords, verifyPackageReleaseRecords } from "../src/index.js";
+import { verifyPackageReleaseRecords as verifyPackageReleaseRecordsWithExplicitVerifier } from "../src/records-entry.js";
 
 const publisherDid = "did:plc:publisher";
 const packageSlug = "gallery";
@@ -80,6 +81,23 @@ describe("verifyPackageReleaseRecords", () => {
 		});
 	});
 
+	it("keeps unattested releases available through the runtime-neutral entrypoint", async () => {
+		const report = await verifyPackageReleaseRecordsWithExplicitVerifier({
+			publisherDid,
+			package: packageSlug,
+			version,
+			rkey,
+			profile: cloneProfile(),
+			release: cloneRelease(),
+		});
+
+		expect(report).toMatchObject({
+			success: true,
+			status: "unattested",
+			code: "PROVENANCE_ABSENT_OPTIONAL",
+		});
+	});
+
 	it.each([
 		["profile", { profile: { nope: true } }, "PROFILE_LEXICON_INVALID"],
 		["release", { release: { nope: true } }, "RELEASE_LEXICON_INVALID"],
diff --git a/packages/registry-verification/tsdown.config.ts b/packages/registry-verification/tsdown.config.ts
index 007cfeaebd..4db5fe2093 100644
--- a/packages/registry-verification/tsdown.config.ts
+++ b/packages/registry-verification/tsdown.config.ts
@@ -14,7 +14,13 @@ const rebundleSafeRequire = {
 
 export default defineConfig([
 	{
-		entry: ["src/artifact.ts", "src/bundle.ts", "src/checksum.ts", "src/fetch-entry.ts"],
+		entry: [
+			"src/artifact.ts",
+			"src/bundle.ts",
+			"src/checksum.ts",
+			"src/fetch-entry.ts",
+			"src/records-entry.ts",
+		],
 		format: ["esm"],
 		outExtensions: () => ({ js: ".js" }),
 		dts: true,
@@ -32,6 +38,7 @@ export default defineConfig([
 		platform: "node",
 		target: "es2024",
 		plugins: [rebundleSafeRequire],
+		outputOptions: { codeSplitting: false },
 		// Sigstore is bundled so the published workerd path carries our pinned
 		// @sigstore/core algorithm-selection fix instead of resolving a pristine copy.
 		inlineOnly: false,
diff --git a/pnpm-lock.yaml b/pnpm-lock.yaml
index e97a26191d..e59d946c61 100644
--- a/pnpm-lock.yaml
+++ b/pnpm-lock.yaml
@@ -648,6 +648,9 @@ importers:
       '@cloudflare/vitest-pool-workers':
         specifier: 'catalog:'
         version: 0.16.3(@vitest/runner@4.1.5)(@vitest/snapshot@4.1.5)(vitest@4.1.5(@opentelemetry/api@1.9.0)(@types/node@24.10.13)(jsdom@26.1.0)(vite@8.0.11(@types/node@24.10.13)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.21.0)(yaml@2.9.0)))
+      '@playwright/test':
+        specifier: ^1.61.1
+        version: 1.61.1
       '@tailwindcss/vite':
         specifier: ^4.3.3
         version: 4.3.3(vite@8.0.11(@types/node@24.10.13)(esbuild@0.28.1)(jiti@2.7.0)(tsx@4.21.0)(yaml@2.9.0))