Publish canonical external request application artifacts

CHANGELOG.md

@@ -25,6 +25,20 @@ versions still track specification maturity rather than a released product.
 
 ### Added
 
+- Added explicit `externalAction` application builds that validate one exact
+  request-only source, lawpack/adapter/configuration closure, and provider-owned
+  target profile before publishing canonical `core.cbor` and `target-ir.cbor`.
+  The route requires a typed request, rejects callable Target IR steps and
+  substituted capability manifests, binds authority by exact root-reachable
+  manifest digest without inventing a coordinate-version relationship, invokes
+  no provider component, replaces the output pair transactionally, and clears
+  stale executable-operation outputs. Request-only lawpack profiles now bind
+  their own exact budget and opaque target configuration while carrying no
+  semantic effect or target intrinsic; compilation rejects another profile's
+  budget, and application builds reject supplied lawpacks outside the ordered
+  root's dependency closure. A generator-owned workspace-snapshot closure and
+  mirrored Echo-owned target profile make the full public build reproducible in
+  Edict.
 - Added typed external-action request values without adding external execution
   authority to Edict. Digest-locked capability imports and `request` statements
   preserve exact operation, schema, scope, basis, budget, input, reconciliation,

README.md

@@ -578,6 +578,9 @@ What exists today:
 - Typed external-action request construction: digest-locked operation families,
   schemas, scope, basis, budgets, and reconciliation law lower as non-callable
   Core and Target IR data with exact capability closure
+- Public request-only application builds: exact source, lawpack, declarative
+  adapter, target configuration, and target-profile closure publish canonical
+  Core and Target IR without provider-component invocation or external I/O
 - Reference `edict.canonical-cbor/v1` Core encoder and canonical byte validation
   path for the current in-memory Core module model
 - Reviewed Core golden bytes and exact `edict.core.module/v1` digest fixture for