Publish canonical external request application artifacts

CHANGELOG.md

@@ -25,6 +25,16 @@ versions still track specification maturity rather than a released product.
 
 ### Added
 
+- Added explicit `externalAction` application builds that validate one exact
+  request-only source, lawpack/adapter/configuration closure, and provider-owned
+  target profile before publishing canonical `core.cbor` and `target-ir.cbor`.
+  The route requires a typed request, rejects callable Target IR steps and
+  substituted capability manifests, invokes no provider component, replaces
+  the output pair transactionally, and clears stale executable-operation
+  outputs. Request-only lawpack profiles now bind their own exact budget and
+  opaque target configuration while carrying no semantic effect or target
+  intrinsic. A generator-owned workspace-snapshot closure and mirrored
+  Echo-owned target profile make the full public build reproducible in Edict.
 - Added typed external-action request values without adding external execution
   authority to Edict. Digest-locked capability imports and `request` statements
   preserve exact operation, schema, scope, basis, budget, input, reconciliation,

README.md

@@ -578,6 +578,9 @@ What exists today:
 - Typed external-action request construction: digest-locked operation families,
   schemas, scope, basis, budgets, and reconciliation law lower as non-callable
   Core and Target IR data with exact capability closure
+- Public request-only application builds: exact source, lawpack, declarative
+  adapter, target configuration, and target-profile closure publish canonical
+  Core and Target IR without provider-component invocation or external I/O
 - Reference `edict.canonical-cbor/v1` Core encoder and canonical byte validation
   path for the current in-memory Core module model
 - Reviewed Core golden bytes and exact `edict.core.module/v1` digest fixture for