diff --git a/.github/AGENTS.md b/.github/AGENTS.md
index 136957d..a646ec4 100644
--- a/.github/AGENTS.md
+++ b/.github/AGENTS.md
@@ -1,11 +1,12 @@
-# Generated by Velnor Actions 0.1.0; edit .velnor/config.toml and regenerate.
+# Generated by Velnor Actions 0.1.6; edit .velnor/config.toml and regenerate.
 # Generated GitHub Workflows and Configurations
 
-All files and subdirectories under `.github/` are generated by `velnor-actions` from [tailrocks/velnor-new](https://github.com/tailrocks/velnor-new).
+`velnor-actions` from [tailrocks/velnor-new](https://github.com/tailrocks/velnor-new) owns its declared generated paths, the complete `.github/workflows/` namespace, and marked shared action definitions under `.github/actions/`. Successful generation replaces emitted owned paths and retires owned paths no longer emitted. Do not hand-edit these managed paths; change their inputs and run `velnor-actions generate`.
 
-## Do Not Hand-Edit `.github/`
+Other existing files and directories under `.github/` are repository-owned and preserved by generation, including empty directories. A directory emptied solely by retiring its managed generated outputs may be pruned. Put custom files outside `.github/workflows/`, which is reserved for generated workflows. Generation refuses to overwrite an unmarked custom action when its path collides with a generated shared action.
+
+## Generation Inputs
 
-- **Never hand-edit any file inside `.github/`**: Every manual change will be overwritten on the next run of `velnor-actions generate`.
 - **Keep generation inputs outside `.github/`**: Repository configuration belongs in `.velnor/config.toml`, workspace manifests, and toolchain settings outside `.github/`.
 - **Regenerate via CLI**: Apply configuration changes by running `velnor-actions generate`.
 
@@ -13,8 +14,8 @@ All files and subdirectories under `.github/` are generated by `velnor-actions`
 
 When issues, bugs, limitations, or enhancements are observed in generated GitHub Actions workflows:
 
-1. **Do NOT patch `.github/` directly or create repo-specific workarounds**:
-   - Avoid local ad-hoc patches, overrides, or shims inside `.github/`.
+1. **Do NOT patch generator-owned outputs or create repo-specific workflow workarounds**:
+   - Avoid local patches, overrides, or shims to managed workflow, config, or action files.
 2. **Research generic solutions in `velnor-actions` / `velnor-new`**:
    - Investigate solutions in the upstream generator: [tailrocks/velnor-new](https://github.com/tailrocks/velnor-new).
    - Verify that potential changes align with the vision and architectural invariants of Velnor Actions (generic workflow generator, strict safety invariants, zero legacy, fast CI).
diff --git a/.github/CLAUDE.md b/.github/CLAUDE.md
deleted file mode 120000
index 47dc3e3..0000000
--- a/.github/CLAUDE.md
+++ /dev/null
@@ -1 +0,0 @@
-AGENTS.md
\ No newline at end of file
diff --git a/.github/CLAUDE.md b/.github/CLAUDE.md
new file mode 100644
index 0000000..43c994c
--- /dev/null
+++ b/.github/CLAUDE.md
@@ -0,0 +1 @@
+@AGENTS.md
diff --git a/.github/actionlint.yaml b/.github/actionlint.yaml
index a511b22..c37bc0c 100644
--- a/.github/actionlint.yaml
+++ b/.github/actionlint.yaml
@@ -1,4 +1,4 @@
-# Generated by Velnor Actions 0.1.0; edit .velnor/config.toml and regenerate.
+# Generated by Velnor Actions 0.1.6; edit .velnor/config.toml and regenerate.
 
 config-variables: []
 
diff --git a/.github/actions/tofu-provider-admission/action.yml b/.github/actions/tofu-provider-admission/action.yml
new file mode 100644
index 0000000..0053c93
--- /dev/null
+++ b/.github/actions/tofu-provider-admission/action.yml
@@ -0,0 +1,34 @@
+# Generated by Velnor Actions 0.1.6; edit .velnor/config.toml and regenerate.
+name: Admit OpenTofu provider cache
+description: Restore and admit the exact OpenTofu provider cache entry.
+inputs:
+  cache-key:
+    description: Provider cache cache-key
+    required: true
+  cache-path:
+    description: Provider cache cache-path
+    required: true
+outputs:
+  cache-key:
+    description: Provider cache cache-key
+    value: ${{ inputs.cache-key }}
+  cache-path:
+    description: Provider cache cache-path
+    value: ${{ inputs.cache-path }}
+runs:
+  using: composite
+  steps:
+    - name: Restore Tofu providers
+      id: restore
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+      with:
+        key: ${{ inputs.cache-key }}
+        path: ${{ inputs.cache-path }}
+    - name: Discard provider bytes unless the exact restore key matched
+      shell: bash
+      env:
+        TOFU_CACHE_HIT: ${{ steps.restore.outputs.cache-hit }}
+        TOFU_EXPECTED_KEY: ${{ inputs.cache-key }}
+        TOFU_MATCHED_KEY: ${{ steps.restore.outputs.cache-matched-key }}
+        TOFU_PROVIDER_CACHE_PATH: ${{ inputs.cache-path }}
+      run: "set -eu\ncd -P \"$RUNNER_TEMP\"\nrt=$PWD\nv=\"$rt/velnor\"\np=\"$v/tofu-cache\"\n[ ! -L \"$v\" ] && [ ! -L \"$p\" ] || exit 1\nmkdir -p \"$p\"\ncd -P \"$p\"\n[ \"$PWD\" = \"$p\" ] || exit 1\nprefix=\"$p/\"\ncase \"$TOFU_PROVIDER_CACHE_PATH\" in\n    \"$prefix\"*) slug=${TOFU_PROVIDER_CACHE_PATH#\"$prefix\"} ;;\n    *) exit 1 ;;\nesac\ncase \"$slug\" in\n    ''|*/*|*[!A-Za-z0-9_-]*) exit 1 ;;\nesac\nd=\"$PWD/$slug\"\n[ \"$TOFU_PROVIDER_CACHE_PATH\" = \"$d\" ] || exit 1\nif [ \"$TOFU_CACHE_HIT\" = true ] \\\n    && [ -n \"$TOFU_EXPECTED_KEY\" ] \\\n    && [ \"$TOFU_MATCHED_KEY\" = \"$TOFU_EXPECTED_KEY\" ] \\\n    && [ -d \"$d\" ] \\\n    && [ ! -L \"$d\" ]; then\n    exit 0\nfi\nrm -rf \"$d\"\nmkdir -m 700 \"$d\""
diff --git a/.github/actions/u26/action.yml b/.github/actions/u26/action.yml
new file mode 100644
index 0000000..e335f13
--- /dev/null
+++ b/.github/actions/u26/action.yml
@@ -0,0 +1,40 @@
+# Generated by Velnor Actions 0.1.6; edit .velnor/config.toml and regenerate.
+name: Velnor Mise cache identity
+description: Qualify the hosted image and cache roots before V2 restore.
+inputs:
+  d:
+    description: Static V2 identity of the tool pins and owned paths.
+    required: true
+outputs:
+  enabled:
+    description: Whether the image and absolute roots qualify for restore.
+    value: ${{ steps.v2.outputs.enabled }}
+  identity:
+    description: SHA-256 runtime fingerprint for the qualified host.
+    value: ${{ steps.v2.outputs.identity }}
+runs:
+  using: composite
+  steps:
+    - name: V2 identity
+      id: v2
+      env:
+        ACTIONS_ID_TOKEN_REQUEST_TOKEN: ""
+        ACTIONS_ID_TOKEN_REQUEST_URL: ""
+        ACTIONS_RUNTIME_TOKEN: ""
+        CARGO_HOME: ${{ runner.temp }}/velnor/cargo
+        CARGO_REGISTRY_TOKEN: ""
+        GH_CONFIG_DIR: ""
+        GH_HOST: ""
+        GH_TOKEN: ""
+        GITHUB_TOKEN: ""
+        MISE_CARGO_HOME: ${{ runner.temp }}/velnor/cargo
+        MISE_GITHUB_TOKEN: ""
+        MISE_RUSTUP_HOME: ${{ runner.temp }}/velnor/rustup
+        NODE_AUTH_TOKEN: ""
+        NPM_TOKEN: ""
+        RUNNER_TEMP: ${{ runner.temp }}
+        RUSTUP_HOME: ${{ runner.temp }}/velnor/rustup
+        VELNOR_CACHE_LANE: ubuntu-26.04
+        VELNOR_CACHE_STATIC_DIGEST: ${{ inputs.d }}
+      shell: bash
+      run: "bash -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; bash \"$GITHUB_ACTION_PATH/../../scripts/velnor-tools-cache-identity.sh\"'"
diff --git a/.github/actions/velnor-tool-seed/action.yml b/.github/actions/velnor-tool-seed/action.yml
new file mode 100644
index 0000000..9d1efb0
--- /dev/null
+++ b/.github/actions/velnor-tool-seed/action.yml
@@ -0,0 +1,26 @@
+# Generated by Velnor Actions 0.1.6; edit .velnor/config.toml and regenerate.
+name: Restore Velnor tool seed
+description: Copy a matching host tool seed into this job.
+inputs:
+  cache_key:
+    description: Exact Mise cache key.
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Copy matching tool seed
+      env:
+        ACTIONS_ID_TOKEN_REQUEST_TOKEN: ""
+        ACTIONS_ID_TOKEN_REQUEST_URL: ""
+        ACTIONS_RUNTIME_TOKEN: ""
+        CARGO_REGISTRY_TOKEN: ""
+        GH_CONFIG_DIR: ""
+        GH_HOST: ""
+        GH_TOKEN: ""
+        GITHUB_TOKEN: ""
+        MISE_GITHUB_TOKEN: ""
+        NODE_AUTH_TOKEN: ""
+        NPM_TOKEN: ""
+        SEED_KEY: ${{ inputs.cache_key }}
+      shell: bash
+      run: "bash -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; set -euo pipefail; seed=\"/opt/velnor/seed\"; key=\"$SEED_KEY\"; if [ -z \"$key\" ]; then echo \"tool seed disabled\"; exit 0; fi; trusted_seed_owner_root() { if [ \"${RUNNER_OS-}\" = macOS ]; then /usr/bin/stat -f %u \"$1\" | /usr/bin/grep -qx 0; else /usr/bin/stat -c %u -- \"$1\" | /usr/bin/grep -qx 0; fi; }; trusted_seed_file_matches() { local file=\"$1\" expected=\"$2\" actual=\"\" size=\"\" newline=\"\"; [ -f \"$file\" ] && [ ! -L \"$file\" ] || return 1; if [ \"${RUNNER_OS-}\" = macOS ]; then IFS= read -r size < <(/usr/bin/stat -f %z \"$file\") || return 1; else IFS= read -r size < <(/usr/bin/stat -c %s -- \"$file\") || return 1; fi; case \"$size\" in '\\'''\\''|*[!0-9]*) return 1 ;; esac; [ \"$size\" -le 512 ] || return 1; if IFS= read -r -d '\\'''\\'' actual < \"$file\"; then return 1; fi; printf -v newline '\\''\\n'\\''; [ \"$actual\" = \"$expected\" ] || [ \"$actual\" = \"$expected$newline\" ]; }; trusted_seed_path_is_real() { local current=\"$1\"; while [ \"$current\" != / ]; do [ ! -L \"$current\" ] || return 1; current=\"${current%/*}\"; [ -n \"$current\" ] || current=/; done; }; trusted_seed_mount_is_immutable() { if [ \"${RUNNER_OS-}\" = macOS ]; then /sbin/mount | /usr/bin/awk -v seed=\"$1\" '\\''index($0, \" on \") { marker=index($0, \" on \"); source=substr($0, 1, marker-1); rest=substr($0, marker+4); options_at=index(rest, \" (\"); target=substr(rest, 1, options_at-1); mount_options=substr(rest, options_at+2); targets[NR]=target; sources[NR]=source; options[NR]=mount_options; if (target == seed) { exact++; seed_source=source; if (mount_options ~ /read-only|rdonly/) readonly=1 } else if (index(target, seed \"/\") == 1) nested=1 } END { for (i=1; i<=NR; i++) if (sources[i] == seed_source && targets[i] != seed && options[i] !~ /read-only|rdonly/) writable_alias=1; exit !(exact == 1 && readonly && !nested && !writable_alias) }'\\''; else /usr/bin/findmnt -arn -o TARGET,FSTYPE,MAJ:MIN,OPTIONS | /usr/bin/awk -v seed=\"$1\" '\\''{ target=$1; targets[NR]=target; devices[NR]=$3; options[NR]=$4; if (target == seed) { exact++; device=$3; if ($2 != \"overlay\" && $2 != \"fuse.overlayfs\" && $4 ~ /(^|,)ro(,|$)/) readonly=1 } else if (index(target, seed \"/\") == 1) nested=1 } END { for (i=1; i<=NR; i++) if (devices[i] == device && targets[i] != seed && options[i] ~ /(^|,)rw(,|$)/) writable_alias=1; exit !(exact == 1 && readonly && !nested && !writable_alias) }'\\''; fi; }; trusted_seed_tree_bounded() { local root=\"$1\" count=0 entry relative depth; if ! /usr/bin/find \"$root\" -xdev -print0 | while IFS= read -r -d '\\'''\\'' entry; do ((count+=1)); [ \"$count\" -le 100000 ] || exit 1; case \"$entry\" in \"$root\") depth=0 ;; \"$root\"/*) relative=\"${entry#\"$root\"/}\"; depth=1; while [[ \"$relative\" == */* ]]; do relative=\"${relative#*/}\"; ((depth+=1)); done ;; *) exit 1 ;; esac; [ \"$depth\" -le 16 ] || exit 1; done; then return 1; fi; }; trusted_seed_tree_entries_are_safe() { if ! /usr/bin/find \"$1\" -xdev \\( ! -type d -a ! -type f -o ! -uid 0 \\) -print0 | while IFS= read -r -d '\\'''\\'' entry; do exit 1; done; then return 1; fi; }; trusted_seed_tree_is_safe() { trusted_seed_tree_bounded \"$1\" && trusted_seed_tree_entries_are_safe \"$1\"; }; trusted_seed_is_trusted() { [ -d \"$1\" ] && [ ! -L \"$1\" ] || return 1; trusted_seed_path_is_real \"$1\" || return 1; [ -f \"$1/PROVENANCE\" ] && [ ! -L \"$1/PROVENANCE\" ] || return 1; trusted_seed_owner_root \"$1\" || return 1; trusted_seed_owner_root \"$1/PROVENANCE\" || return 1; trusted_seed_file_matches \"$1/PROVENANCE\" \"velnor-host-seed-v1\" || return 1; trusted_seed_mount_is_immutable \"$1\" || return 1; trusted_seed_tree_is_safe \"$1\"; }; if [ ! -e \"$seed\" ]; then echo \"tool seed absent\"; exit 0; fi; if ! trusted_seed_is_trusted \"$seed\"; then echo \"untrusted tool seed; continuing cold\"; exit 0; fi; if [[ ! \"$key\" =~ ^mise-tools-v2-[0-9a-f]{64}$ ]] || [ ! -f \"$seed/mise/KEY\" ]; then echo \"tool seed key mismatch\"; exit 0; fi; if ! trusted_seed_file_matches \"$seed/mise/KEY\" \"$key\"; then echo \"tool seed key mismatch\"; exit 0; fi; if [ -d \"$seed/mise/tree\" ]; then /bin/mkdir -p \"$HOME/.local/share/mise\"; /bin/cp -R \"$seed/mise/tree/.\" \"$HOME/.local/share/mise/\"; echo \"tool seed restored share-dir\"; fi; if [ -d \"$seed/rustup/tree\" ]; then /bin/mkdir -p \"$RUNNER_TEMP/velnor/rustup\"; /bin/cp -R \"$seed/rustup/tree/.\" \"$RUNNER_TEMP/velnor/rustup/\"; echo \"tool seed restored toolchain-dir\"; fi'"
diff --git a/.github/actions/velnor-tools-cache-restore/action.yml b/.github/actions/velnor-tools-cache-restore/action.yml
new file mode 100644
index 0000000..7c4b833
--- /dev/null
+++ b/.github/actions/velnor-tools-cache-restore/action.yml
@@ -0,0 +1,24 @@
+# Generated by Velnor Actions 0.1.6; edit .velnor/config.toml and regenerate.
+name: Velnor Mise tools cache restore
+description: Restore the exact renderer-owned V2 Mise tools paths.
+inputs:
+  key:
+    description: Exact runtime-qualified V2 tools key.
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Restore Mise tools
+      id: restore
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+      with:
+        key: ${{ inputs.key }}
+        path: "~/.local/share/mise\n${{ runner.temp }}/velnor/rustup\n${{ runner.temp }}/velnor/cargo/.crates.toml\n${{ runner.temp }}/velnor/cargo/.crates2.json\n${{ runner.temp }}/velnor/cargo/bin"
+        restore-keys: ""
+    - name: Discard tools bytes unless the exact restore key matched
+      shell: bash
+      env:
+        TOOLS_CACHE_HIT: ${{ steps.restore.outputs.cache-hit }}
+        TOOLS_EXPECTED_KEY: ${{ inputs.key }}
+        TOOLS_MATCHED_KEY: ${{ steps.restore.outputs.cache-matched-key }}
+      run: "set -eu;\n[ -n \"$HOME\" ] && [ -n \"$RUNNER_TEMP\" ] || exit 1;\ncase \"$HOME\" in /*) ;; *) exit 1 ;; esac;\ncase \"$RUNNER_TEMP\" in /*) ;; *) exit 1 ;; esac;\n[ \"$HOME\" != / ] && [ \"$RUNNER_TEMP\" != / ] || exit 1;\nif [ \"$TOOLS_CACHE_HIT\" = true ] && [ -n \"$TOOLS_EXPECTED_KEY\" ] && [ \"$TOOLS_MATCHED_KEY\" = \"$TOOLS_EXPECTED_KEY\" ]; then\n[ ! -L \"$HOME/.local/share/mise\" ] || exit 1;\n[ ! -L \"$RUNNER_TEMP/velnor/rustup\" ] || exit 1;\n[ ! -L \"$RUNNER_TEMP/velnor/cargo/bin\" ] || exit 1;\n[ ! -L \"$RUNNER_TEMP/velnor/cargo/.crates.toml\" ] || exit 1;\n[ ! -L \"$RUNNER_TEMP/velnor/cargo/.crates2.json\" ] || exit 1;\nexit 0;\nfi;\nfor d in \"$HOME/.local/share/mise\" \"$RUNNER_TEMP/velnor/rustup\" \"$RUNNER_TEMP/velnor/cargo/bin\"; do\n[ ! -L \"$d\" ] || exit 1;\nrm -rf \"$d\";\ndone;\nfor f in \"$RUNNER_TEMP/velnor/cargo/.crates.toml\" \"$RUNNER_TEMP/velnor/cargo/.crates2.json\"; do\n[ ! -L \"$f\" ] || exit 1;\nrm -f \"$f\";\ndone"
diff --git a/.github/actions/velnor-tools-prelude-u26/action.yml b/.github/actions/velnor-tools-prelude-u26/action.yml
new file mode 100644
index 0000000..b0fe9c6
--- /dev/null
+++ b/.github/actions/velnor-tools-prelude-u26/action.yml
@@ -0,0 +1,25 @@
+# Generated by Velnor Actions 0.1.6; edit .velnor/config.toml and regenerate.
+name: Velnor hosted tools prelude
+description: Qualify the hosted image and copy a matching tool seed.
+inputs:
+  d:
+    description: Static V2 identity of the tool pins and owned paths.
+    required: true
+outputs:
+  enabled:
+    value: ${{ steps.v2.outputs.enabled }}
+  identity:
+    value: ${{ steps.v2.outputs.identity }}
+runs:
+  using: composite
+  steps:
+    - name: V2 identity
+      id: v2
+      uses: ./.github/actions/u26 # zizmor: ignore[self-repository]
+      with:
+        d: ${{ inputs.d }}
+    - name: Restore Velnor tool seed
+      if: steps.v2.outputs.enabled == 'true'
+      uses: ./.github/actions/velnor-tool-seed # zizmor: ignore[self-repository]
+      with:
+        cache_key: mise-tools-v2-${{steps.v2.outputs.identity}}
diff --git a/.github/scripts/velnor-tools-cache-identity.sh b/.github/scripts/velnor-tools-cache-identity.sh
new file mode 100644
index 0000000..870638a
--- /dev/null
+++ b/.github/scripts/velnor-tools-cache-identity.sh
@@ -0,0 +1,2 @@
+# Generated by Velnor Actions 0.1.6; edit .velnor/config.toml and regenerate.
+export LC_ALL=C; set -eu; umask 077; : "${GITHUB_OUTPUT:?missing GITHUB_OUTPUT}"; scratch_root=; scratch_dir=; runner_os=${RUNNER_OS-}; runner_arch=${RUNNER_ARCH-}; image_os=${ImageOS-}; image_version=${ImageVersion-}; home=${HOME-}; runner_temp=${RUNNER_TEMP-}; mise_rustup=${MISE_RUSTUP_HOME-}; rustup_home=${RUSTUP_HOME-}; mise_cargo=${MISE_CARGO_HOME-}; cargo_home=${CARGO_HOME-}; valid_path() { value=$1; case "$value" in /*) ;; *) return 1 ;; esac; [ "$value" != / ] || return 1; case "$value" in *[![:print:]]*|*//*|*/./*|*/../*|*/.|*/..) return 1 ;; esac; remaining=${value#/}; prefix=; while [ -n "$remaining" ]; do case "$remaining" in */*) part=${remaining%%/*}; remaining=${remaining#*/} ;; *) part=$remaining; remaining= ;; esac; [ -n "$part" ] || return 1; prefix="$prefix/$part"; [ ! -L "$prefix" ] || return 1; done; }; cleanup_scratch() { [ -n "$scratch_dir" ] || return 0; case "$scratch_dir" in "$scratch_root"/runtime-identity.*) ;; *) return 1 ;; esac; [ -d "$scratch_dir" ] && [ ! -L "$scratch_dir" ] || return 1; rm -rf -- "$scratch_dir" || return 1; scratch_dir=; }; on_exit() { status=$1; trap - EXIT; if ! cleanup_scratch; then status=1; fi; exit "$status"; }; trap 'status=$?; on_exit "$status"' EXIT; trap 'exit 129' HUP; trap 'exit 130' INT; trap 'exit 143' TERM; disable() { reason=$1; if ! cleanup_scratch; then printf 'enabled=false\nreason=identity_scratch_cleanup_failed\n' >> "$GITHUB_OUTPUT"; exit 1; fi; printf 'enabled=false\nreason=%s\n' "$reason" >> "$GITHUB_OUTPUT"; exit 0; }; case "$VELNOR_CACHE_LANE" in scale-set:*) disable scale_set_image_unqualified ;; esac; case "$VELNOR_CACHE_LANE" in ubuntu-22.04) expected_image_os=ubuntu22 ;; ubuntu-24.04) expected_image_os=ubuntu24 ;; ubuntu-26.04) expected_image_os=ubuntu26 ;; *) disable lane_image_unqualified ;; esac; expected_arch=X64; expected_target=x86_64-unknown-linux-gnu; [ -n "$runner_os" ] || disable runner_os_missing; [ "$runner_os" = Linux ] || disable runner_os_mismatch; [ -n "$runner_arch" ] || disable runner_arch_missing; [ "$runner_arch" = "$expected_arch" ] || disable runner_arch_mismatch; [ -n "$image_os" ] || disable image_os_missing; [ "$image_os" = "$expected_image_os" ] || disable image_os_mismatch; [ -n "$image_version" ] || disable image_version_missing; case "$image_version" in *[!0-9.]*) disable image_version_invalid ;; esac; case "$image_version" in *[0-9]*) ;; *) disable image_version_invalid ;; esac; [ -n "$home" ] && [ -d "$home" ] || disable home_missing; [ -n "$runner_temp" ] && [ -d "$runner_temp" ] || disable runner_temp_missing; valid_path "$home" || disable home_aliased; valid_path "$runner_temp" || disable runner_temp_aliased; expected_mise="$home/.local/share/mise"; effective_mise=${MISE_DATA_DIR-}; if [ -z "$effective_mise" ]; then if [ -n "${XDG_DATA_HOME-}" ]; then effective_mise="$XDG_DATA_HOME/mise"; else effective_mise=$expected_mise; fi; fi; valid_path "$expected_mise" || disable mise_root_aliased; valid_path "$effective_mise" || disable mise_root_invalid; [ "$effective_mise" = "$expected_mise" ] || disable mise_root_not_archived; expected_rustup="$runner_temp/velnor/rustup"; expected_cargo="$runner_temp/velnor/cargo"; [ "$mise_rustup" = "$expected_rustup" ] || disable mise_rustup_home_mismatch; [ "$rustup_home" = "$expected_rustup" ] || disable rustup_home_mismatch; [ "$mise_cargo" = "$expected_cargo" ] || disable mise_cargo_home_mismatch; [ "$cargo_home" = "$expected_cargo" ] || disable cargo_home_mismatch; valid_path "$expected_rustup" || disable rustup_root_invalid; valid_path "$expected_cargo" || disable cargo_root_invalid; scratch_root="$runner_temp/velnor"; valid_path "$scratch_root" || disable cache_scratch_aliased; mkdir -p "$scratch_root" || disable cache_scratch_unavailable; [ -d "$scratch_root" ] && [ ! -L "$scratch_root" ] || disable cache_scratch_invalid; scratch_dir="$scratch_root/runtime-identity.$$"; if ! mkdir -m 700 "$scratch_dir"; then scratch_dir=; disable identity_scratch_unavailable; fi; case "$scratch_dir" in "$scratch_root"/runtime-identity.*) ;; *) disable cache_scratch_invalid ;; esac; valid_path "$scratch_dir" && [ -d "$scratch_dir" ] && [ ! -L "$scratch_dir" ] || disable cache_scratch_invalid; identity_file="$scratch_dir/preimage"; sum_file="$scratch_dir/digest"; set -C; if ! : > "$identity_file"; then set +C; disable identity_file_unavailable; fi; if ! : > "$sum_file"; then set +C; disable identity_file_unavailable; fi; set +C; valid_path "$identity_file" && [ -f "$identity_file" ] && [ ! -L "$identity_file" ] || disable identity_file_invalid; valid_path "$sum_file" && [ -f "$sum_file" ] && [ ! -L "$sum_file" ] || disable identity_file_invalid; for value in "velnor-tools-runtime-v2" "$VELNOR_CACHE_STATIC_DIGEST" "$VELNOR_CACHE_LANE" "$expected_target" "$runner_os" "$runner_arch" "$image_os" "$image_version" "$home" "$runner_temp" "$effective_mise" "$expected_rustup" "$expected_cargo"; do if ! printf '%s:%s\n' "${#value}" "$value" >> "$identity_file"; then disable identity_file_write_failed; fi; done; if command -v sha256sum >/dev/null 2>&1; then if ! sha256sum < "$identity_file" > "$sum_file"; then disable identity_hash_failed; fi; elif command -v shasum >/dev/null 2>&1; then if ! shasum -a 256 < "$identity_file" > "$sum_file"; then disable identity_hash_failed; fi; else disable sha256_tool_missing; fi; if ! IFS=' ' read -r fingerprint _ < "$sum_file"; then disable fingerprint_missing; fi; [ ${#fingerprint} -eq 64 ] || disable fingerprint_invalid; case "$fingerprint" in *[!0-9a-f]*) disable fingerprint_invalid ;; esac; if ! cleanup_scratch; then disable identity_scratch_cleanup_failed; fi; printf 'identity=%s\nenabled=true\nreason=qualified_hosted_image\n' "$fingerprint" >> "$GITHUB_OUTPUT"
\ No newline at end of file
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index bc46356..ad71e10 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,4 +1,4 @@
-# Generated by Velnor Actions 0.1.0; edit .velnor/config.toml and regenerate.
+# Generated by Velnor Actions 0.1.6; edit .velnor/config.toml and regenerate.
 name: CI
 "on":
   pull_request:
@@ -13,7 +13,24 @@ name: CI
   merge_group:
 permissions:
   contents: read
-  actions: read
+env:
+  ACTIONS_ID_TOKEN_REQUEST_TOKEN: ""
+  ACTIONS_ID_TOKEN_REQUEST_URL: ""
+  ACTIONS_RUNTIME_TOKEN: ""
+  CARGO_REGISTRY_TOKEN: ""
+  GH_CONFIG_DIR: ""
+  GH_HOST: ""
+  GH_TOKEN: ""
+  GITHUB_TOKEN: ""
+  MISE_AUTO_INSTALL: "false"
+  MISE_EXEC_AUTO_INSTALL: "false"
+  MISE_GITHUB_TOKEN: ""
+  MISE_LOCKFILE: "0"
+  MISE_NO_CONFIG: "1"
+  MISE_NO_ENV: "1"
+  MISE_NO_HOOKS: "1"
+  NODE_AUTH_TOKEN: ""
+  NPM_TOKEN: ""
 concurrency:
   group: velnor-${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: ${{ github.event_name == 'pull_request' }}
@@ -27,107 +44,92 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: "false"
+      - name: V2 identity
+        id: v2
+        uses: ./.github/actions/velnor-tools-prelude-u26 # zizmor: ignore[self-repository]
+        with:
+          d: e370bd368b58262d774e5f0c13ab43e7fbafaf445dd1ad4263c70221ad2a15a4
+      - name: Restore Mise tools
+        if: steps.v2.outputs.enabled == 'true'
+        uses: ./.github/actions/velnor-tools-cache-restore # zizmor: ignore[self-repository]
+        with:
+          key: mise-tools-v2-${{steps.v2.outputs.identity}}
       - name: Setup Mise
-        uses: jdx/mise-action@9149ea85001c7435d5a66bb127d6a1b6227cb0a5
+        uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca
         with:
-          cache: "true"
-          cache_key: mise-v1-x86_64-unknown-linux-gnu-2026.9.18-75c77caa4018556f
+          cache: "false"
           cache_save: "false"
           env: "false"
           install: "false"
-          sha256: d24fe0bf7e613824ad99f7b8dac3f2b381a37b9f75f84dd250855217095a8de4
-          version: 2026.9.18
+          sha256: 3f44343eebc7e0d6623bcea46e304864f02dff648edd75c82871b53cc697b366
+          version: 2026.10.6
+      - name: Prepare pinned tools
+        run: mise --no-config --no-env --no-hooks install actionlint@1.7.12 shellcheck@0.11.0
       - name: Run actionlint
-        run: mise --no-config --no-env --no-hooks exec actionlint@1.7.12 shellcheck@0.11.0 -- actionlint -color
+        run: env -u ACTIONS_ID_TOKEN_REQUEST_TOKEN -u ACTIONS_ID_TOKEN_REQUEST_URL -u ACTIONS_RUNTIME_TOKEN -u GITHUB_TOKEN -u MISE_GITHUB_TOKEN -u GH_TOKEN -u GH_HOST -u GH_CONFIG_DIR mise --no-config --no-env --no-hooks exec actionlint@1.7.12 shellcheck@0.11.0 -- actionlint -color
       - name: Save Mise tools
-        if: success() && github.event_name == 'push'
+        if: success() && github.event_name == 'push' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && github.ref_protected == true && steps.v2.outputs.enabled == 'true'
         uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
         with:
-          key: mise-v1-x86_64-unknown-linux-gnu-2026.9.18-75c77caa4018556f
-          path: ~/.local/share/mise
+          key: mise-tools-v2-${{steps.v2.outputs.identity}}
+          path: "~/.local/share/mise\n${{ runner.temp }}/velnor/rustup\n${{ runner.temp }}/velnor/cargo/.crates.toml\n${{ runner.temp }}/velnor/cargo/.crates2.json\n${{ runner.temp }}/velnor/cargo/bin"
   plan:
     name: Plan
     runs-on: ubuntu-26.04
-    timeout-minutes: 10
+    timeout-minutes: 20
+    env:
+      VELNOR_ASSET_SHA256: 411db6702e5f627ba106f5a5f1d2b324d32844e6520bd7b3c00139b0029b12d1
+      VELNOR_ASSET_URL: https://github.com/tailrocks/velnor-new/releases/download/v0.1.6/velnor-actions-0.1.6-x86_64-unknown-linux-gnu
+      VELNOR_RELEASE_COMMIT: e0cebf8ea523589a335d3cbc3699c973ce1e18a4
     outputs:
       covered_tasks: ${{ steps.plan.outputs.covered_tasks }}
+      qualification_campaign: ${{ steps.plan.outputs.qualification_campaign }}
+      qualification_phase: ${{ steps.plan.outputs.qualification_phase }}
+      qualification_cache_enabled: ${{ steps.plan.outputs.qualification_cache_enabled }}
+      qualification_cache_write: ${{ steps.plan.outputs.qualification_cache_write }}
+      qualification_cache_directives: ${{ steps.plan.outputs.qualification_cache_directives }}
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           fetch-depth: "0"
           persist-credentials: "false"
+      - name: V2 identity
+        id: v2
+        uses: ./.github/actions/velnor-tools-prelude-u26 # zizmor: ignore[self-repository]
+        with:
+          d: 6a3893cbcdceacb96419ede57ddc9a61a54dd4b84c7d0cb1cbf7bd101df5af0f
+      - name: Restore Mise tools
+        if: steps.v2.outputs.enabled == 'true'
+        uses: ./.github/actions/velnor-tools-cache-restore # zizmor: ignore[self-repository]
+        with:
+          key: mise-tools-v2-${{steps.v2.outputs.identity}}
       - name: Setup Mise
-        uses: jdx/mise-action@9149ea85001c7435d5a66bb127d6a1b6227cb0a5
+        uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca
         with:
-          cache: "true"
-          cache_key: mise-v1-x86_64-unknown-linux-gnu-2026.9.18-64e72d03bb372bc4
+          cache: "false"
           cache_save: "false"
           env: "false"
           install: "false"
-          sha256: d24fe0bf7e613824ad99f7b8dac3f2b381a37b9f75f84dd250855217095a8de4
-          version: 2026.9.18
+          sha256: 3f44343eebc7e0d6623bcea46e304864f02dff648edd75c82871b53cc697b366
+          version: 2026.10.6
       - name: Prepare pinned tools
-        env:
-          MISE_LOCKFILE: "0"
-          MISE_NO_CONFIG: "1"
-          MISE_NO_ENV: "1"
-          MISE_NO_HOOKS: "1"
         run: mise --no-config --no-env --no-hooks install actionlint@1.7.12 shellcheck@0.11.0 zizmor@1.30.1 opentofu@1.13.1
       - name: Acquire Velnor
-        env:
-          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ""
-          ACTIONS_ID_TOKEN_REQUEST_URL: ""
-          ACTIONS_RUNTIME_TOKEN: ""
-          CARGO_REGISTRY_TOKEN: ""
-          GH_CONFIG_DIR: ""
-          GH_HOST: ""
-          GH_TOKEN: ""
-          GITHUB_TOKEN: ""
-          MISE_GITHUB_TOKEN: ""
-          NODE_AUTH_TOKEN: ""
-          NPM_TOKEN: ""
-          VELNOR_ASSET_SHA256: aa7e44d6579e9c586106d120ed3658fcf1c9b041027ad9f03473e8efacd3b5d5
-          VELNOR_ASSET_URL: https://github.com/tailrocks/velnor-new/releases/download/v0.1.0/velnor-actions-0.1.0-x86_64-unknown-linux-gnu
-          VELNOR_RELEASE_COMMIT: c57c700459bbe1549fe7eedcb7d8689585c38986
-        run: "sh -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; mkdir -p \"$RUNNER_TEMP/velnor/bin\" && curl -fsSL --proto '\\''=https'\\'' --tlsv1.2 \"$VELNOR_ASSET_URL\" -o \"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.0\" && echo \"$VELNOR_ASSET_SHA256  $RUNNER_TEMP/velnor/bin/velnor-actions-0.1.0\" | sha256sum -c - && chmod +x \"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.0\"'"
+        run: "sh -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; d=\"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.6\"&&mkdir -p \"${d%/*}\"&&s=\"/opt/velnor/seed/generator/${d##*/}\"&&p=\"$VELNOR_ASSET_SHA256  \"&&if [ -f \"$s\" ]&&echo \"$p$s\"|sha256sum -c -;then cp \"$s\" \"$d\";else curl -fsSL --retry 5 --retry-all-errors --proto '\\''=https'\\'' --tlsv1.2 \"$VELNOR_ASSET_URL\" -o \"$d\"&&echo \"$p$d\"|sha256sum -c -;fi&&chmod +x \"$d\"'"
       - name: Write request
         env:
           VELNOR_INTERNAL_OP: write-request-v1
           VELNOR_REQUEST_FILE: ${{ runner.temp }}/velnor/request/plan-v1-request.json
-        run: "\"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.0\""
+        run: "\"$RUNNER_TEMP\"'/velnor/bin/velnor-actions-0.1.6'"
       - name: Check generated files
-        env:
-          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ""
-          ACTIONS_ID_TOKEN_REQUEST_URL: ""
-          ACTIONS_RUNTIME_TOKEN: ""
-          CARGO_REGISTRY_TOKEN: ""
-          GH_CONFIG_DIR: ""
-          GH_HOST: ""
-          GH_TOKEN: ""
-          GITHUB_TOKEN: ""
-          MISE_AUTO_INSTALL: "false"
-          MISE_EXEC_AUTO_INSTALL: "false"
-          MISE_GITHUB_TOKEN: ""
-          MISE_LOCKFILE: "0"
-          MISE_NO_CONFIG: "1"
-          MISE_NO_ENV: "1"
-          MISE_NO_HOOKS: "1"
-          NODE_AUTH_TOKEN: ""
-          NPM_TOKEN: ""
-        run: "sh -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; $RUNNER_TEMP/velnor/bin/velnor-actions-0.1.0 generate --output-dir \"$RUNNER_TEMP/velnor-actions-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}\" && diff -r --brief .github \"$RUNNER_TEMP/velnor-actions-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}/.github\"'"
+        run: "sh -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; $RUNNER_TEMP/velnor/bin/velnor-actions-0.1.6 generate --output-dir \"$RUNNER_TEMP/velnor-actions-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}\" && diff -r --brief .github \"$RUNNER_TEMP/velnor-actions-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}/.github\"'"
       - name: Plan
         id: plan
         env:
           VELNOR_INTERNAL_OP: plan-v1
           VELNOR_REQUEST_FILE: ${{ runner.temp }}/velnor/request/plan-v1-request.json
-          MISE_AUTO_INSTALL: "false"
-          MISE_EXEC_AUTO_INSTALL: "false"
-          MISE_LOCKFILE: "0"
-          MISE_NO_CONFIG: "1"
-          MISE_NO_ENV: "1"
-          MISE_NO_HOOKS: "1"
-        run: "\"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.0\""
+        run: "\"$RUNNER_TEMP\"'/velnor/bin/velnor-actions-0.1.6'"
       - name: Publish plan
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
@@ -137,36 +139,25 @@ jobs:
           path: ${{ runner.temp }}/velnor/r${{ github.run_id }}-a${{ github.run_attempt }}
           retention-days: "30"
       - name: Save Mise tools
-        if: success() && github.event_name == 'push'
+        if: success() && github.event_name == 'push' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch) && github.ref_protected == true && steps.v2.outputs.enabled == 'true'
         uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
         with:
-          key: mise-v1-x86_64-unknown-linux-gnu-2026.9.18-64e72d03bb372bc4
-          path: ~/.local/share/mise
+          key: mise-tools-v2-${{steps.v2.outputs.identity}}
+          path: "~/.local/share/mise\n${{ runner.temp }}/velnor/rustup\n${{ runner.temp }}/velnor/cargo/.crates.toml\n${{ runner.temp }}/velnor/cargo/.crates2.json\n${{ runner.temp }}/velnor/cargo/bin"
   publish-baseline:
     name: Publish baseline
     runs-on: ubuntu-26.04
     timeout-minutes: 10
+    env:
+      VELNOR_ASSET_SHA256: 411db6702e5f627ba106f5a5f1d2b324d32844e6520bd7b3c00139b0029b12d1
+      VELNOR_ASSET_URL: https://github.com/tailrocks/velnor-new/releases/download/v0.1.6/velnor-actions-0.1.6-x86_64-unknown-linux-gnu
+      VELNOR_RELEASE_COMMIT: e0cebf8ea523589a335d3cbc3699c973ce1e18a4
     needs:
       - required
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     steps:
       - name: Acquire Velnor
-        env:
-          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ""
-          ACTIONS_ID_TOKEN_REQUEST_URL: ""
-          ACTIONS_RUNTIME_TOKEN: ""
-          CARGO_REGISTRY_TOKEN: ""
-          GH_CONFIG_DIR: ""
-          GH_HOST: ""
-          GH_TOKEN: ""
-          GITHUB_TOKEN: ""
-          MISE_GITHUB_TOKEN: ""
-          NODE_AUTH_TOKEN: ""
-          NPM_TOKEN: ""
-          VELNOR_ASSET_SHA256: aa7e44d6579e9c586106d120ed3658fcf1c9b041027ad9f03473e8efacd3b5d5
-          VELNOR_ASSET_URL: https://github.com/tailrocks/velnor-new/releases/download/v0.1.0/velnor-actions-0.1.0-x86_64-unknown-linux-gnu
-          VELNOR_RELEASE_COMMIT: c57c700459bbe1549fe7eedcb7d8689585c38986
-        run: "sh -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; mkdir -p \"$RUNNER_TEMP/velnor/bin\" && curl -fsSL --proto '\\''=https'\\'' --tlsv1.2 \"$VELNOR_ASSET_URL\" -o \"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.0\" && echo \"$VELNOR_ASSET_SHA256  $RUNNER_TEMP/velnor/bin/velnor-actions-0.1.0\" | sha256sum -c - && chmod +x \"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.0\"'"
+        run: "sh -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; d=\"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.6\"&&mkdir -p \"${d%/*}\"&&s=\"/opt/velnor/seed/generator/${d##*/}\"&&p=\"$VELNOR_ASSET_SHA256  \"&&if [ -f \"$s\" ]&&echo \"$p$s\"|sha256sum -c -;then cp \"$s\" \"$d\";else curl -fsSL --retry 5 --retry-all-errors --proto '\\''=https'\\'' --tlsv1.2 \"$VELNOR_ASSET_URL\" -o \"$d\"&&echo \"$p$d\"|sha256sum -c -;fi&&chmod +x \"$d\"'"
       - name: Download plan
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
         with:
@@ -176,25 +167,33 @@ jobs:
         env:
           VELNOR_INTERNAL_OP: write-request-v1
           VELNOR_REQUEST_FILE: ${{ runner.temp }}/velnor/request/publish-baseline-v1-request.json
-        run: "\"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.0\""
+        run: "\"$RUNNER_TEMP\"'/velnor/bin/velnor-actions-0.1.6'"
       - name: Publish baseline
         id: publish-baseline
         env:
           VELNOR_INTERNAL_OP: publish-baseline-v1
           VELNOR_REQUEST_FILE: ${{ runner.temp }}/velnor/request/publish-baseline-v1-request.json
-        run: "\"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.0\""
+        run: "\"$RUNNER_TEMP\"'/velnor/bin/velnor-actions-0.1.6'"
       - name: Upload baseline
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
         with:
           if-no-files-found: error
           name: ${{ steps.publish-baseline.outputs.artifact_name }}
-          path: ${{ runner.temp }}/velnor/r${{ github.run_id }}-a${{ github.run_attempt }}/baseline.json
+          path: ${{ runner.temp }}/velnor/r${{ github.run_id }}-a${{ github.run_attempt }}/published-baseline/baseline.json
           retention-days: "90"
   required:
     name: Required
     runs-on: ubuntu-26.04
     timeout-minutes: 10
+    env:
+      RUSTUP_TOOLCHAIN: 1.98.1
+      VELNOR_ASSET_SHA256: 411db6702e5f627ba106f5a5f1d2b324d32844e6520bd7b3c00139b0029b12d1
+      VELNOR_ASSET_URL: https://github.com/tailrocks/velnor-new/releases/download/v0.1.6/velnor-actions-0.1.6-x86_64-unknown-linux-gnu
+      VELNOR_RELEASE_COMMIT: e0cebf8ea523589a335d3cbc3699c973ce1e18a4
+    permissions:
+      contents: read
+      actions: read
     needs:
       - plan
       - tofu-workspace
@@ -202,41 +201,20 @@ jobs:
     if: always()
     steps:
       - name: Setup Mise
-        uses: jdx/mise-action@9149ea85001c7435d5a66bb127d6a1b6227cb0a5
+        uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca
         with:
-          cache: "true"
-          cache_key: mise-v1-x86_64-unknown-linux-gnu-2026.9.18-14ee3a9bbb90604c
+          cache: "false"
           cache_save: "false"
           env: "false"
           install: "false"
-          sha256: d24fe0bf7e613824ad99f7b8dac3f2b381a37b9f75f84dd250855217095a8de4
-          version: 2026.9.18
+          sha256: 3f44343eebc7e0d6623bcea46e304864f02dff648edd75c82871b53cc697b366
+          version: 2026.10.6
       - name: Acquire Velnor
-        env:
-          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ""
-          ACTIONS_ID_TOKEN_REQUEST_URL: ""
-          ACTIONS_RUNTIME_TOKEN: ""
-          CARGO_REGISTRY_TOKEN: ""
-          GH_CONFIG_DIR: ""
-          GH_HOST: ""
-          GH_TOKEN: ""
-          GITHUB_TOKEN: ""
-          MISE_GITHUB_TOKEN: ""
-          NODE_AUTH_TOKEN: ""
-          NPM_TOKEN: ""
-          VELNOR_ASSET_SHA256: aa7e44d6579e9c586106d120ed3658fcf1c9b041027ad9f03473e8efacd3b5d5
-          VELNOR_ASSET_URL: https://github.com/tailrocks/velnor-new/releases/download/v0.1.0/velnor-actions-0.1.0-x86_64-unknown-linux-gnu
-          VELNOR_RELEASE_COMMIT: c57c700459bbe1549fe7eedcb7d8689585c38986
-        run: "sh -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; mkdir -p \"$RUNNER_TEMP/velnor/bin\" && curl -fsSL --proto '\\''=https'\\'' --tlsv1.2 \"$VELNOR_ASSET_URL\" -o \"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.0\" && echo \"$VELNOR_ASSET_SHA256  $RUNNER_TEMP/velnor/bin/velnor-actions-0.1.0\" | sha256sum -c - && chmod +x \"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.0\"'"
+        run: "sh -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; d=\"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.6\"&&mkdir -p \"${d%/*}\"&&s=\"/opt/velnor/seed/generator/${d##*/}\"&&p=\"$VELNOR_ASSET_SHA256  \"&&if [ -f \"$s\" ]&&echo \"$p$s\"|sha256sum -c -;then cp \"$s\" \"$d\";else curl -fsSL --retry 5 --retry-all-errors --proto '\\''=https'\\'' --tlsv1.2 \"$VELNOR_ASSET_URL\" -o \"$d\"&&echo \"$p$d\"|sha256sum -c -;fi&&chmod +x \"$d\"'"
       - name: Prepare pinned tools
         env:
           MISE_CARGO_HOME: ${{ runner.temp }}/velnor/cargo
-          MISE_LOCKFILE: "0"
-          MISE_NO_CONFIG: "1"
-          MISE_NO_ENV: "1"
-          MISE_NO_HOOKS: "1"
           MISE_RUSTUP_HOME: ${{ runner.temp }}/velnor/rustup
-          RUSTUP_TOOLCHAIN: 1.98.1
         run: mise --no-config --no-env --no-hooks install gh@2.102.0
       - name: Download plan
         continue-on-error: true
@@ -249,27 +227,21 @@ jobs:
           GH_REPO: ${{ github.repository }}
           GH_TOKEN: ${{ github.token }}
           VELNOR_INTERNAL_OP: fetch-reports-v1
-        run: "\"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.0\""
+        run: "\"$RUNNER_TEMP\"'/velnor/bin/velnor-actions-0.1.6'"
       - name: Write request
         env:
           VELNOR_INTERNAL_OP: write-request-v1
           VELNOR_NEEDS_JSON: ${{ toJSON(needs) }}
           VELNOR_NEEDS_EXPECTED: "[\"actionlint\",\"plan\",\"tofu-workspace\"]"
           VELNOR_REQUEST_FILE: ${{ runner.temp }}/velnor/request/merge-v1-request.json
-        run: "\"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.0\""
+        run: "\"$RUNNER_TEMP\"'/velnor/bin/velnor-actions-0.1.6'"
       - name: Merge reports
         env:
           VELNOR_INTERNAL_OP: merge-v1
           VELNOR_NEEDS_JSON: ${{ toJSON(needs) }}
           VELNOR_NEEDS_EXPECTED: "[\"actionlint\",\"plan\",\"tofu-workspace\"]"
           VELNOR_REQUEST_FILE: ${{ runner.temp }}/velnor/request/merge-v1-request.json
-        run: "\"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.0\""
-      - name: Save Mise tools
-        if: success() && github.event_name == 'push'
-        uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
-        with:
-          key: mise-v1-x86_64-unknown-linux-gnu-2026.9.18-14ee3a9bbb90604c
-          path: ~/.local/share/mise
+        run: "\"$RUNNER_TEMP\"'/velnor/bin/velnor-actions-0.1.6'"
       - name: Publish final report
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
@@ -282,6 +254,10 @@ jobs:
     name: OpenToFu — .
     runs-on: ubuntu-26.04
     timeout-minutes: 30
+    env:
+      VELNOR_ASSET_SHA256: 411db6702e5f627ba106f5a5f1d2b324d32844e6520bd7b3c00139b0029b12d1
+      VELNOR_ASSET_URL: https://github.com/tailrocks/velnor-new/releases/download/v0.1.6/velnor-actions-0.1.6-x86_64-unknown-linux-gnu
+      VELNOR_RELEASE_COMMIT: e0cebf8ea523589a335d3cbc3699c973ce1e18a4
     needs:
       - plan
     strategy:
@@ -291,140 +267,76 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
         with:
           persist-credentials: "false"
+      - name: V2 identity
+        id: v2
+        uses: ./.github/actions/velnor-tools-prelude-u26 # zizmor: ignore[self-repository]
+        with:
+          d: 6a3893cbcdceacb96419ede57ddc9a61a54dd4b84c7d0cb1cbf7bd101df5af0f
+      - name: Restore Mise tools
+        if: steps.v2.outputs.enabled == 'true'
+        uses: ./.github/actions/velnor-tools-cache-restore # zizmor: ignore[self-repository]
+        with:
+          key: mise-tools-v2-${{steps.v2.outputs.identity}}
       - name: Setup Mise
-        uses: jdx/mise-action@9149ea85001c7435d5a66bb127d6a1b6227cb0a5
+        uses: jdx/mise-action@2d8d4cafcbd33be2ea37d2b6f5ad595363d1f1ca
         with:
-          cache: "true"
-          cache_key: mise-v1-x86_64-unknown-linux-gnu-2026.9.18-64e72d03bb372bc4
+          cache: "false"
           cache_save: "false"
           env: "false"
           install: "false"
-          sha256: d24fe0bf7e613824ad99f7b8dac3f2b381a37b9f75f84dd250855217095a8de4
-          version: 2026.9.18
+          sha256: 3f44343eebc7e0d6623bcea46e304864f02dff648edd75c82871b53cc697b366
+          version: 2026.10.6
       - name: Acquire Velnor
-        env:
-          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ""
-          ACTIONS_ID_TOKEN_REQUEST_URL: ""
-          ACTIONS_RUNTIME_TOKEN: ""
-          CARGO_REGISTRY_TOKEN: ""
-          GH_CONFIG_DIR: ""
-          GH_HOST: ""
-          GH_TOKEN: ""
-          GITHUB_TOKEN: ""
-          MISE_GITHUB_TOKEN: ""
-          NODE_AUTH_TOKEN: ""
-          NPM_TOKEN: ""
-          VELNOR_ASSET_SHA256: aa7e44d6579e9c586106d120ed3658fcf1c9b041027ad9f03473e8efacd3b5d5
-          VELNOR_ASSET_URL: https://github.com/tailrocks/velnor-new/releases/download/v0.1.0/velnor-actions-0.1.0-x86_64-unknown-linux-gnu
-          VELNOR_RELEASE_COMMIT: c57c700459bbe1549fe7eedcb7d8689585c38986
-        run: "sh -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; mkdir -p \"$RUNNER_TEMP/velnor/bin\" && curl -fsSL --proto '\\''=https'\\'' --tlsv1.2 \"$VELNOR_ASSET_URL\" -o \"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.0\" && echo \"$VELNOR_ASSET_SHA256  $RUNNER_TEMP/velnor/bin/velnor-actions-0.1.0\" | sha256sum -c - && chmod +x \"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.0\"'"
+        run: "sh -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; d=\"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.6\"&&mkdir -p \"${d%/*}\"&&s=\"/opt/velnor/seed/generator/${d##*/}\"&&p=\"$VELNOR_ASSET_SHA256  \"&&if [ -f \"$s\" ]&&echo \"$p$s\"|sha256sum -c -;then cp \"$s\" \"$d\";else curl -fsSL --retry 5 --retry-all-errors --proto '\\''=https'\\'' --tlsv1.2 \"$VELNOR_ASSET_URL\" -o \"$d\"&&echo \"$p$d\"|sha256sum -c -;fi&&chmod +x \"$d\"'"
       - name: Download plan
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c
         with:
           name: velnor-plan-r${{ github.run_id }}-a${{ github.run_attempt }}
           path: ${{ runner.temp }}/velnor/r${{ github.run_id }}-a${{ github.run_attempt }}
       - name: Prepare pinned tools
-        env:
-          MISE_LOCKFILE: "0"
-          MISE_NO_CONFIG: "1"
-          MISE_NO_ENV: "1"
-          MISE_NO_HOOKS: "1"
         run: mise --no-config --no-env --no-hooks install opentofu@1.13.1 actionlint@1.7.12 shellcheck@0.11.0 zizmor@1.30.1
       - name: Restore Tofu providers
-        uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
+        id: tofu-providers
+        uses: ./.github/actions/tofu-provider-admission # zizmor: ignore[self-repository]
         with:
-          key: velnor-v1-tofu-providers-x86_64-unknown-linux-gnu-1.13.1-root-af1349b9f5f9-${{hashFiles('.terraform.lock.hcl')}}
-          path: ${{ runner.temp }}/velnor/tofu-cache/root-af1349b9f5f9
-          restore-keys: ""
+          cache-key: velnor-v1-tofu-providers-x86_64-unknown-linux-gnu-1.13.1-b3-d1e3f385428fcc1037c389c08e5fe9a9d4b2ca17c65809c27574ef265fc7708b-${{hashFiles('.terraform.lock.hcl')}}
+          cache-path: ${{ runner.temp }}/velnor/tofu-cache/b3-d1e3f385428fcc1037c389c08e5fe9a9d4b2ca17c65809c27574ef265fc7708b
       - name: Format
-        if: "!contains(needs.plan.outputs.covered_tasks, ',stack/tofu/root/fmt/default,')"
+        if: "!contains(needs.plan.outputs.covered_tasks, ',stack/tofu/dir-/fmt/default,')"
         env:
-          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ""
-          ACTIONS_ID_TOKEN_REQUEST_URL: ""
-          ACTIONS_RUNTIME_TOKEN: ""
-          CARGO_REGISTRY_TOKEN: ""
-          GH_CONFIG_DIR: ""
-          GH_HOST: ""
-          GH_TOKEN: ""
-          GITHUB_TOKEN: ""
-          MISE_AUTO_INSTALL: "false"
-          MISE_EXEC_AUTO_INSTALL: "false"
-          MISE_GITHUB_TOKEN: ""
-          MISE_LOCKFILE: "0"
-          MISE_NO_CONFIG: "1"
-          MISE_NO_ENV: "1"
-          MISE_NO_HOOKS: "1"
-          NODE_AUTH_TOKEN: ""
-          NPM_TOKEN: ""
-          TF_DATA_DIR: ${{ runner.temp }}/velnor/tofu-data/root-af1349b9f5f9
+          TF_DATA_DIR: ${{ runner.temp }}/velnor/tofu-data/b3-d1e3f385428fcc1037c389c08e5fe9a9d4b2ca17c65809c27574ef265fc7708b
           TF_INPUT: "0"
           TF_IN_AUTOMATION: "1"
-          TF_PLUGIN_CACHE_DIR: ${{ runner.temp }}/velnor/tofu-cache/root-af1349b9f5f9
-          VELNOR_DOWNSTREAM_TASK_IDS: stack/tofu/root/init/default,stack/tofu/root/validate/default
-          VELNOR_MATRIX_ID: stack:tofu|task:stack/tofu/root/fmt/default
-          VELNOR_MATRIX_KEY: m-81f8adce7c6d2d17
-          VELNOR_TASK_DIGEST: b3-01f46840ede6c206cfec81ed91f0d46aa2457ed9a06171a2ee94c128c4b61fd4
-          VELNOR_TASK_ID: stack/tofu/root/fmt/default
-        run: "sh -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; date +%s%3N > \"$RUNNER_TEMP/velnor/start-m-81f8adce7c6d2d17\"; mise --no-config --no-env --no-hooks exec opentofu@1.13.1 -- tofu fmt -check -recursive -no-color; code=$?; read -r start_ms rest < \"$RUNNER_TEMP/velnor/start-m-81f8adce7c6d2d17\"; VELNOR_EXIT_CODE=\"$code\" VELNOR_START_MS=\"$start_ms\" VELNOR_INTERNAL_OP=write-task-report-v1 \"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.0\"; helper_code=$?; if [ \"$code\" -ne 0 ]; then exit \"$code\"; fi; exit \"$helper_code\"'"
+          TF_PLUGIN_CACHE_DIR: ${{ runner.temp }}/velnor/tofu-cache/b3-d1e3f385428fcc1037c389c08e5fe9a9d4b2ca17c65809c27574ef265fc7708b
+          VELNOR_MATRIX_ID: stack:tofu|task:stack/tofu/dir-/fmt/default
+          VELNOR_MATRIX_KEY: m-3c8679d9275e8dda
+          VELNOR_TASK_DIGEST: b3-31fb3885e2c8c470833d4bccfd842757a4c93d268142f89d70c4ddbc3d3dd565
+          VELNOR_TASK_ID: stack/tofu/dir-/fmt/default
+        run: "sh -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; s=$(date +%s%3N); mise --no-config --no-env --no-hooks exec opentofu@1.13.1 -- tofu fmt -check -recursive -no-color; code=$?; VELNOR_EXIT_CODE=\"$code\" VELNOR_START_MS=\"$s\" VELNOR_INTERNAL_OP=write-task-report-v1 \"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.6\"; helper_code=$?; if [ \"$code\" -ne 0 ]; then exit \"$code\"; fi; exit \"$helper_code\"'"
       - name: Init for validate
-        if: "!contains(needs.plan.outputs.covered_tasks, ',stack/tofu/root/init/default,')"
+        if: "!contains(needs.plan.outputs.covered_tasks, ',stack/tofu/dir-/init/default,')"
         env:
-          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ""
-          ACTIONS_ID_TOKEN_REQUEST_URL: ""
-          ACTIONS_RUNTIME_TOKEN: ""
-          CARGO_REGISTRY_TOKEN: ""
-          GH_CONFIG_DIR: ""
-          GH_HOST: ""
-          GH_TOKEN: ""
-          GITHUB_TOKEN: ""
-          MISE_AUTO_INSTALL: "false"
-          MISE_EXEC_AUTO_INSTALL: "false"
-          MISE_GITHUB_TOKEN: ""
-          MISE_LOCKFILE: "0"
-          MISE_NO_CONFIG: "1"
-          MISE_NO_ENV: "1"
-          MISE_NO_HOOKS: "1"
-          NODE_AUTH_TOKEN: ""
-          NPM_TOKEN: ""
-          TF_DATA_DIR: ${{ runner.temp }}/velnor/tofu-data/root-af1349b9f5f9
+          TF_DATA_DIR: ${{ runner.temp }}/velnor/tofu-data/b3-d1e3f385428fcc1037c389c08e5fe9a9d4b2ca17c65809c27574ef265fc7708b
           TF_INPUT: "0"
           TF_IN_AUTOMATION: "1"
-          TF_PLUGIN_CACHE_DIR: ${{ runner.temp }}/velnor/tofu-cache/root-af1349b9f5f9
-          VELNOR_DOWNSTREAM_TASK_IDS: stack/tofu/root/validate/default
-          VELNOR_MATRIX_ID: stack:tofu|task:stack/tofu/root/init/default
-          VELNOR_MATRIX_KEY: m-ea1d15bd0ffb2cc6
-          VELNOR_TASK_DIGEST: b3-c0935f88688ab07fe76ed6ea12dc3479149c621564dc767c7a04589c9324c239
-          VELNOR_TASK_ID: stack/tofu/root/init/default
-        run: "sh -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; date +%s%3N > \"$RUNNER_TEMP/velnor/start-m-ea1d15bd0ffb2cc6\"; mise --no-config --no-env --no-hooks exec opentofu@1.13.1 -- tofu init -backend=false -input=false -lockfile=readonly -no-color; code=$?; read -r start_ms rest < \"$RUNNER_TEMP/velnor/start-m-ea1d15bd0ffb2cc6\"; VELNOR_EXIT_CODE=\"$code\" VELNOR_START_MS=\"$start_ms\" VELNOR_INTERNAL_OP=write-task-report-v1 \"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.0\"; helper_code=$?; if [ \"$code\" -ne 0 ]; then exit \"$code\"; fi; exit \"$helper_code\"'"
+          TF_PLUGIN_CACHE_DIR: ${{ runner.temp }}/velnor/tofu-cache/b3-d1e3f385428fcc1037c389c08e5fe9a9d4b2ca17c65809c27574ef265fc7708b
+          VELNOR_MATRIX_ID: stack:tofu|task:stack/tofu/dir-/init/default
+          VELNOR_MATRIX_KEY: m-dd8cb3a035daf865
+          VELNOR_TASK_DIGEST: b3-5ec299f3808a7018d7b433404d75005f0da6af0d189053e01407a9bdecdea694
+          VELNOR_TASK_ID: stack/tofu/dir-/init/default
+        run: "sh -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; s=$(date +%s%3N); mise --no-config --no-env --no-hooks exec opentofu@1.13.1 -- tofu init -backend=false -input=false -lockfile=readonly -no-color; code=$?; VELNOR_EXIT_CODE=\"$code\" VELNOR_START_MS=\"$s\" VELNOR_INTERNAL_OP=write-task-report-v1 \"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.6\"; helper_code=$?; if [ \"$code\" -ne 0 ]; then exit \"$code\"; fi; exit \"$helper_code\"'"
       - name: Validate
-        if: "!contains(needs.plan.outputs.covered_tasks, ',stack/tofu/root/validate/default,')"
+        if: "!contains(needs.plan.outputs.covered_tasks, ',stack/tofu/dir-/validate/default,')"
         env:
-          ACTIONS_ID_TOKEN_REQUEST_TOKEN: ""
-          ACTIONS_ID_TOKEN_REQUEST_URL: ""
-          ACTIONS_RUNTIME_TOKEN: ""
-          CARGO_REGISTRY_TOKEN: ""
-          GH_CONFIG_DIR: ""
-          GH_HOST: ""
-          GH_TOKEN: ""
-          GITHUB_TOKEN: ""
-          MISE_AUTO_INSTALL: "false"
-          MISE_EXEC_AUTO_INSTALL: "false"
-          MISE_GITHUB_TOKEN: ""
-          MISE_LOCKFILE: "0"
-          MISE_NO_CONFIG: "1"
-          MISE_NO_ENV: "1"
-          MISE_NO_HOOKS: "1"
-          NODE_AUTH_TOKEN: ""
-          NPM_TOKEN: ""
-          TF_DATA_DIR: ${{ runner.temp }}/velnor/tofu-data/root-af1349b9f5f9
+          TF_DATA_DIR: ${{ runner.temp }}/velnor/tofu-data/b3-d1e3f385428fcc1037c389c08e5fe9a9d4b2ca17c65809c27574ef265fc7708b
           TF_INPUT: "0"
           TF_IN_AUTOMATION: "1"
-          TF_PLUGIN_CACHE_DIR: ${{ runner.temp }}/velnor/tofu-cache/root-af1349b9f5f9
-          VELNOR_MATRIX_ID: stack:tofu|task:stack/tofu/root/validate/default
-          VELNOR_MATRIX_KEY: m-2cc3c05d21da2511
-          VELNOR_TASK_DIGEST: b3-d77a3a5a27aa6b1fc9cc896e1d5899c960b2dbbc7558b27ac8c15342a3378688
-          VELNOR_TASK_ID: stack/tofu/root/validate/default
-        run: "sh -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; date +%s%3N > \"$RUNNER_TEMP/velnor/start-m-2cc3c05d21da2511\"; mise --no-config --no-env --no-hooks exec opentofu@1.13.1 -- tofu validate -no-color; code=$?; read -r start_ms rest < \"$RUNNER_TEMP/velnor/start-m-2cc3c05d21da2511\"; VELNOR_EXIT_CODE=\"$code\" VELNOR_START_MS=\"$start_ms\" VELNOR_INTERNAL_OP=write-task-report-v1 \"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.0\"; helper_code=$?; if [ \"$code\" -ne 0 ]; then exit \"$code\"; fi; exit \"$helper_code\"'"
+          TF_PLUGIN_CACHE_DIR: ${{ runner.temp }}/velnor/tofu-cache/b3-d1e3f385428fcc1037c389c08e5fe9a9d4b2ca17c65809c27574ef265fc7708b
+          VELNOR_MATRIX_ID: stack:tofu|task:stack/tofu/dir-/validate/default
+          VELNOR_MATRIX_KEY: m-4cb0c782e5cd0eb9
+          VELNOR_TASK_DIGEST: b3-b9ea8471b2e348a63462488325d31787568b7cce6bdb27dfb951a95c331efd3a
+          VELNOR_TASK_ID: stack/tofu/dir-/validate/default
+        run: "sh -c 'unset ACTIONS_ID_TOKEN_REQUEST_TOKEN ACTIONS_ID_TOKEN_REQUEST_URL ACTIONS_RUNTIME_TOKEN GITHUB_TOKEN MISE_GITHUB_TOKEN GH_TOKEN GH_HOST GH_CONFIG_DIR; s=$(date +%s%3N); mise --no-config --no-env --no-hooks exec opentofu@1.13.1 -- tofu validate -no-color; code=$?; VELNOR_EXIT_CODE=\"$code\" VELNOR_START_MS=\"$s\" VELNOR_INTERNAL_OP=write-task-report-v1 \"$RUNNER_TEMP/velnor/bin/velnor-actions-0.1.6\"; helper_code=$?; if [ \"$code\" -ne 0 ]; then exit \"$code\"; fi; exit \"$helper_code\"'"
       - name: Upload crate reports
         if: always()
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a
@@ -437,5 +349,5 @@ jobs:
         if: success() && github.event_name == 'push'
         uses: actions/cache/save@55cc8345863c7cc4c66a329aec7e433d2d1c52a9
         with:
-          key: velnor-v1-tofu-providers-x86_64-unknown-linux-gnu-1.13.1-root-af1349b9f5f9-${{hashFiles('.terraform.lock.hcl')}}
-          path: ${{ runner.temp }}/velnor/tofu-cache/root-af1349b9f5f9
+          key: ${{ steps.tofu-providers.outputs.cache-key }}
+          path: ${{ steps.tofu-providers.outputs.cache-path }}
diff --git a/.velnor/release-manifest.json b/.velnor/release-manifest.json
index cd8c2a8..4abb380 100644
--- a/.velnor/release-manifest.json
+++ b/.velnor/release-manifest.json
@@ -1,18 +1,23 @@
 {
   "schema": 1,
-  "version": "0.1.0",
+  "version": "0.1.6",
   "repository": "tailrocks/velnor-new",
-  "commit": "c57c700459bbe1549fe7eedcb7d8689585c38986",
+  "commit": "e0cebf8ea523589a335d3cbc3699c973ce1e18a4",
   "targets": [
     {
       "target": "x86_64-unknown-linux-gnu",
-      "artifact": "https://github.com/tailrocks/velnor-new/releases/download/v0.1.0/velnor-actions-0.1.0-x86_64-unknown-linux-gnu",
-      "sha256": "aa7e44d6579e9c586106d120ed3658fcf1c9b041027ad9f03473e8efacd3b5d5"
+      "artifact": "https://github.com/tailrocks/velnor-new/releases/download/v0.1.6/velnor-actions-0.1.6-x86_64-unknown-linux-gnu",
+      "sha256": "411db6702e5f627ba106f5a5f1d2b324d32844e6520bd7b3c00139b0029b12d1"
     },
     {
       "target": "aarch64-apple-darwin",
-      "artifact": "https://github.com/tailrocks/velnor-new/releases/download/v0.1.0/velnor-actions-0.1.0-aarch64-apple-darwin",
-      "sha256": "b6f514b71e3d1d72978c66cecf23560e7f25ad51727e9f26c88870b77d61695f"
+      "artifact": "https://github.com/tailrocks/velnor-new/releases/download/v0.1.6/velnor-actions-0.1.6-aarch64-apple-darwin",
+      "sha256": "3774bb8a96eae0e029d37a1f0710b12d9478bc56b9ffed3a5e7c0eefed34fdfb"
+    },
+    {
+      "target": "x86_64-apple-darwin",
+      "artifact": "https://github.com/tailrocks/velnor-new/releases/download/v0.1.6/velnor-actions-0.1.6-x86_64-apple-darwin",
+      "sha256": "a73dcd07673337b44de9a33425e5e1bfdd57fc38018f5ad7853fcb16795bab20"
     }
   ]
 }
diff --git a/mise.lock b/mise.lock
index 0ab8216..e1e2de8 100644
--- a/mise.lock
+++ b/mise.lock
@@ -1,40 +1,5 @@
 # @generated - this file is auto-generated by `mise lock` https://mise.jdx.dev/dev-tools/mise-lock.html
 
 [[tools.opentofu]]
-version = "1.12.5"
+version = "1.13.1"
 backend = "aqua:opentofu/opentofu"
-
-[tools.opentofu."platforms.linux-arm64"]
-checksum = "sha256:e67e9da2b1ddf5050ebee62a584cb826eafe1dfd3827d7ec20899ac62791ed1a"
-url = "https://github.com/opentofu/opentofu/releases/download/v1.12.5/tofu_1.12.5_linux_arm64.tar.gz"
-url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/484602545"
-
-[tools.opentofu."platforms.linux-arm64-musl"]
-checksum = "sha256:e67e9da2b1ddf5050ebee62a584cb826eafe1dfd3827d7ec20899ac62791ed1a"
-url = "https://github.com/opentofu/opentofu/releases/download/v1.12.5/tofu_1.12.5_linux_arm64.tar.gz"
-url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/484602545"
-
-[tools.opentofu."platforms.linux-x64"]
-checksum = "sha256:a6894d45ae7a17ce83189cce8fe04b5a65f68cefceb62455b5a6a89fa53ab38f"
-url = "https://github.com/opentofu/opentofu/releases/download/v1.12.5/tofu_1.12.5_linux_amd64.tar.gz"
-url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/484602624"
-
-[tools.opentofu."platforms.linux-x64-musl"]
-checksum = "sha256:a6894d45ae7a17ce83189cce8fe04b5a65f68cefceb62455b5a6a89fa53ab38f"
-url = "https://github.com/opentofu/opentofu/releases/download/v1.12.5/tofu_1.12.5_linux_amd64.tar.gz"
-url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/484602624"
-
-[tools.opentofu."platforms.macos-arm64"]
-checksum = "sha256:2ae38150a667f5c0bd57b318d18ad8091d08f93fcca40345f3d88998661de5a9"
-url = "https://github.com/opentofu/opentofu/releases/download/v1.12.5/tofu_1.12.5_darwin_arm64.tar.gz"
-url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/484602544"
-
-[tools.opentofu."platforms.macos-x64"]
-checksum = "sha256:1012d8f3d4567bcbcd1f2c7d766feca39a30bced32fb8be47e1887fbbee2456d"
-url = "https://github.com/opentofu/opentofu/releases/download/v1.12.5/tofu_1.12.5_darwin_amd64.tar.gz"
-url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/484602621"
-
-[tools.opentofu."platforms.windows-x64"]
-checksum = "sha256:af11850b496f3720e0184084c56d8b43aa74ea92d2338978bf368d70c96473f1"
-url = "https://github.com/opentofu/opentofu/releases/download/v1.12.5/tofu_1.12.5_windows_amd64.tar.gz"
-url_api = "https://api.github.com/repos/opentofu/opentofu/releases/assets/484602547"
diff --git a/mise.toml b/mise.toml
index 011513b..c93b4c3 100644
--- a/mise.toml
+++ b/mise.toml
@@ -2,7 +2,7 @@
 # SPDX-License-Identifier: Apache-2.0
 
 [tools]
-opentofu = "1.12.5"
+opentofu = "1.13.1"
 
 [settings]
 lockfile = true