diff --git a/.github/workflows/validate.yml b/.github/workflows/validate.yml
index 584f504..2f01472 100644
--- a/.github/workflows/validate.yml
+++ b/.github/workflows/validate.yml
@@ -26,6 +26,9 @@ jobs:
       - name: Validate all plugin manifests
         run: bash scripts/validate-manifests.sh
 
+      - name: Test plugin archive roles and Atlas capabilities
+        run: bash tests/test-validate-manifests-artifacts.sh
+
       - name: Validate every plugin has a category assigned
         run: bash scripts/categorize-manifests.sh --check
 
diff --git a/plugins/admin/manifest.json b/plugins/admin/manifest.json
index 78c713c..b11a047 100644
--- a/plugins/admin/manifest.json
+++ b/plugins/admin/manifest.json
@@ -23,26 +23,26 @@
     {
       "arch": "amd64",
       "os": "darwin",
-      "sha256": "71027b8f52498ea10224a2076e62c165d5a38cb733047f4871acbc4d3e0e8f66",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-admin/releases/download/v1.1.18/workflow-plugin-admin-darwin-amd64.tar.gz"
+      "sha256": "7f443d98682f509aeb27527e40d299f1504d8aad7e1c78e2b5dd48099208ec3d",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-admin/releases/download/v1.1.19/workflow-plugin-admin-darwin-amd64.tar.gz"
     },
     {
       "arch": "arm64",
       "os": "darwin",
-      "sha256": "d90522244334c7b99e017ad48b7f02e4f74066c015720d370d339afe3a450f55",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-admin/releases/download/v1.1.18/workflow-plugin-admin-darwin-arm64.tar.gz"
+      "sha256": "b7af2c1a44c8cdae3e9707438dba575fde77531c82f072bb96eed1c7e07ffc98",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-admin/releases/download/v1.1.19/workflow-plugin-admin-darwin-arm64.tar.gz"
     },
     {
       "arch": "amd64",
       "os": "linux",
-      "sha256": "1ba7e01979c1f22ba4cf6493eff0bc9019bec6031446d1c636d85445d35e235f",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-admin/releases/download/v1.1.18/workflow-plugin-admin-linux-amd64.tar.gz"
+      "sha256": "86a0433a1bb4e3720a789c834cd58265891c1621a6391fcc67e4459a47c015c9",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-admin/releases/download/v1.1.19/workflow-plugin-admin-linux-amd64.tar.gz"
     },
     {
       "arch": "arm64",
       "os": "linux",
-      "sha256": "8b712722db7924287df2c3fa71b40ec2bc7865a5c5f2ae92b95c51cee1aff501",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-admin/releases/download/v1.1.18/workflow-plugin-admin-linux-arm64.tar.gz"
+      "sha256": "0c88fab84bbf691ca386d80e46d199e4ad90a5f1df642ea5833ca766d4a3c68b",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-admin/releases/download/v1.1.19/workflow-plugin-admin-linux-arm64.tar.gz"
     }
   ],
   "homepage": "https://github.com/GoCodeAlone/workflow-plugin-admin",
@@ -63,5 +63,5 @@
   "status": "experimental",
   "tier": "core",
   "type": "external",
-  "version": "1.1.18"
+  "version": "1.1.19"
 }
diff --git a/plugins/authz-ui/manifest.json b/plugins/authz-ui/manifest.json
index d095f33..5ab0f9d 100644
--- a/plugins/authz-ui/manifest.json
+++ b/plugins/authz-ui/manifest.json
@@ -22,26 +22,26 @@
     {
       "arch": "amd64",
       "os": "darwin",
-      "sha256": "30dd496209a3dc3ee18214c79fb3f7f58457dca204f908b485fbff8b257ad95f",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-authz-ui/releases/download/v1.0.12/workflow-plugin-authz-ui-darwin-amd64.tar.gz"
+      "sha256": "0e2abb50cab0f4fed4a4873ad1d3e91d9b67ed7d74b36e9d920bcbacb910acc2",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-authz-ui/releases/download/v1.0.13/workflow-plugin-authz-ui-darwin-amd64.tar.gz"
     },
     {
       "arch": "arm64",
       "os": "darwin",
-      "sha256": "3d1bb0801ba74cf920d2c367e314ac976548574f5658fdfc0af5166d3f90c194",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-authz-ui/releases/download/v1.0.12/workflow-plugin-authz-ui-darwin-arm64.tar.gz"
+      "sha256": "c7f4842dfcfa2ab8ce6989320389d4dec4a05edc925dd5ce027faa5df0793119",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-authz-ui/releases/download/v1.0.13/workflow-plugin-authz-ui-darwin-arm64.tar.gz"
     },
     {
       "arch": "amd64",
       "os": "linux",
-      "sha256": "d4a6472933286cb85e29d875bae20ee0a09200715c77c32a04f627a2010f1afb",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-authz-ui/releases/download/v1.0.12/workflow-plugin-authz-ui-linux-amd64.tar.gz"
+      "sha256": "f798e3dd027fbe138b2e635f5ec6ba5415de45f099b7ff40f18f6b209b5ea7c4",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-authz-ui/releases/download/v1.0.13/workflow-plugin-authz-ui-linux-amd64.tar.gz"
     },
     {
       "arch": "arm64",
       "os": "linux",
-      "sha256": "f94704fae951655f7d8e4ab351e71865d5fc84a5813668c04f853fe080e6be18",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-authz-ui/releases/download/v1.0.12/workflow-plugin-authz-ui-linux-arm64.tar.gz"
+      "sha256": "bb9bf14172917a58e6d936b82731beb54c5380b234476948a22889808ac9a813",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-authz-ui/releases/download/v1.0.13/workflow-plugin-authz-ui-linux-arm64.tar.gz"
     }
   ],
   "homepage": "https://github.com/GoCodeAlone/workflow-plugin-authz-ui",
@@ -63,5 +63,5 @@
   "source": "github.com/GoCodeAlone/workflow-plugin-authz-ui",
   "tier": "premium",
   "type": "external",
-  "version": "1.0.12"
+  "version": "1.0.13"
 }
diff --git a/plugins/github/manifest.json b/plugins/github/manifest.json
index 41e3f0f..44330bd 100644
--- a/plugins/github/manifest.json
+++ b/plugins/github/manifest.json
@@ -5,6 +5,13 @@
   },
   "author": "GoCodeAlone",
   "capabilities": {
+    "cliCommands": [
+      {
+        "description": "Audited GitHub runner policy reconciliation",
+        "flagsPassthrough": true,
+        "name": "github"
+      }
+    ],
     "configProvider": false,
     "moduleTypes": [
       "git.webhook",
@@ -37,38 +44,38 @@
     {
       "arch": "amd64",
       "os": "darwin",
-      "sha256": "bde56c1dfd374434ce475a0c2b5050a2d0610f8394371f2b1b4829b3ab02a7e2",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-github/releases/download/v1.0.31/workflow-plugin-github-darwin-amd64.tar.gz"
+      "sha256": "cc1cf2c122badd3ce34aabe7df8dba191dff84d3bdc1242c143791d0f48f37e0",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-github/releases/download/v1.0.34/workflow-plugin-github-darwin-amd64.tar.gz"
     },
     {
       "arch": "arm64",
       "os": "darwin",
-      "sha256": "fa1dd306286a231e9a20c6498f6a3657d759a2bc7716b1928fe6ce1b4416462b",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-github/releases/download/v1.0.31/workflow-plugin-github-darwin-arm64.tar.gz"
+      "sha256": "def4c8f17176e464db31515370022da739085b5573a77e4a47a45e38b0fbd781",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-github/releases/download/v1.0.34/workflow-plugin-github-darwin-arm64.tar.gz"
     },
     {
       "arch": "amd64",
       "os": "linux",
-      "sha256": "579417795770db4460b20190d11f88878f334883407a110727a51c47bb238972",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-github/releases/download/v1.0.31/workflow-plugin-github-linux-amd64.tar.gz"
+      "sha256": "0d4e4b1a145649c5b41e8211d06bf9126c3f74dc457c8caacb9b1a77a2e5d882",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-github/releases/download/v1.0.34/workflow-plugin-github-linux-amd64.tar.gz"
     },
     {
       "arch": "arm64",
       "os": "linux",
-      "sha256": "6bd2427e299e4eb0a97dd89d3249460880486824e45c7c86e02ddf14d6b35a47",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-github/releases/download/v1.0.31/workflow-plugin-github-linux-arm64.tar.gz"
+      "sha256": "437f7b69e14f81a52f74a5130974324c99deef02d4f4ce92b1dc2c69df4864e1",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-github/releases/download/v1.0.34/workflow-plugin-github-linux-arm64.tar.gz"
     },
     {
       "arch": "amd64",
       "os": "windows",
-      "sha256": "9cce24e13f1c7f5e4f1f2c607dc09fdec06f727654db3f90bc4f14d67732f3c2",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-github/releases/download/v1.0.31/workflow-plugin-github-windows-amd64.tar.gz"
+      "sha256": "6604183f851f7c009737a9bbc295ff81b6e15514a2f82b66dec187cf32e8b4de",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-github/releases/download/v1.0.34/workflow-plugin-github-windows-amd64.tar.gz"
     },
     {
       "arch": "arm64",
       "os": "windows",
-      "sha256": "cf0ce76ff2d96224614ba7950069b7fc15e84116c846105834f713a72d16fb89",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-github/releases/download/v1.0.31/workflow-plugin-github-windows-arm64.tar.gz"
+      "sha256": "ce81556d631bb24ec52200eeeb045956b953a912afc47bb7b24718b77c3b9f94",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-github/releases/download/v1.0.34/workflow-plugin-github-windows-arm64.tar.gz"
     }
   ],
   "homepage": "https://github.com/GoCodeAlone/workflow-plugin-github",
@@ -84,7 +91,7 @@
     "release"
   ],
   "license": "MIT",
-  "minEngineVersion": "0.61.0",
+  "minEngineVersion": "0.86.0",
   "name": "github",
   "repository": "https://github.com/GoCodeAlone/workflow-plugin-github",
   "required_secrets": [
@@ -146,5 +153,5 @@
   "status": "experimental",
   "tier": "core",
   "type": "external",
-  "version": "1.0.31"
+  "version": "1.0.34"
 }
diff --git a/plugins/workflow-plugin-atlas-migrate/manifest.json b/plugins/workflow-plugin-atlas-migrate/manifest.json
index b406541..0c59e8d 100644
--- a/plugins/workflow-plugin-atlas-migrate/manifest.json
+++ b/plugins/workflow-plugin-atlas-migrate/manifest.json
@@ -2,70 +2,16 @@
   "author": "GoCodeAlone",
   "capabilities": {
     "buildHooks": [],
-    "cliCommands": [
-      {
-        "description": "Run and inspect database migrations",
-        "flagsPassthrough": true,
-        "name": "db-migrate",
-        "subcommands": [
-          {
-            "description": "Apply all pending migrations",
-            "name": "up"
-          },
-          {
-            "description": "Roll back migrations",
-            "name": "down"
-          },
-          {
-            "description": "Show migration status",
-            "name": "status"
-          },
-          {
-            "description": "Migrate to a specific version",
-            "name": "goto"
-          },
-          {
-            "description": "Force-set the recorded migration version",
-            "name": "force"
-          },
-          {
-            "description": "Repair a known dirty migration metadata state",
-            "name": "repair-dirty"
-          },
-          {
-            "description": "Validate a candidate migration directory against a baseline",
-            "name": "validate-upgrade"
-          },
-          {
-            "description": "Static analysis for migration files",
-            "name": "lint"
-          },
-          {
-            "description": "Run full-cycle and checkpoint migration tests",
-            "name": "test"
-          },
-          {
-            "description": "Ensure a tenant schema exists in the database",
-            "name": "tenant-ensure"
-          }
-        ]
-      }
-    ],
+    "cliCommands": [],
     "configProvider": false,
     "migrationDrivers": [
-      "golang-migrate",
-      "goose"
+      "atlas"
     ],
     "moduleTypes": [
       "database.migrations",
       "database.migration_driver"
     ],
-    "stepTypes": [
-      "step.migrate_up",
-      "step.migrate_down",
-      "step.migrate_status",
-      "step.migrate_to"
-    ],
+    "stepTypes": [],
     "triggerTypes": []
   },
   "category": "data",
@@ -74,86 +20,26 @@
     {
       "arch": "amd64",
       "os": "darwin",
-      "sha256": "f777262dcaa897174458be211da1117327cf5dd9c3093f719e5852a253cef703",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.3.12/workflow-migrate-darwin-amd64.tar.gz"
-    },
-    {
-      "arch": "arm64",
-      "os": "darwin",
-      "sha256": "88412be1c0a30dc4f1132c387754ca58ff066d6e935c688a34116531964a7550",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.3.12/workflow-migrate-darwin-arm64.tar.gz"
-    },
-    {
-      "arch": "amd64",
-      "os": "linux",
-      "sha256": "4e86009fadf24af5c2a5af142bb5d5fc0b21c01fc9c56bd0f97972202e9b4df6",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.3.12/workflow-migrate-linux-amd64.tar.gz"
-    },
-    {
-      "arch": "arm64",
-      "os": "linux",
-      "sha256": "fd589260bca2eaa7275bff3f29a3203155c65a07939abda2e070468c2f08af57",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.3.12/workflow-migrate-linux-arm64.tar.gz"
-    },
-    {
-      "arch": "amd64",
-      "os": "darwin",
-      "sha256": "490005c3bc7105d8b16c2b25742d591f6255ffedf3e14727020eb8c54c8c0099",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.3.12/workflow-plugin-atlas-migrate-darwin-amd64.tar.gz"
-    },
-    {
-      "arch": "arm64",
-      "os": "darwin",
-      "sha256": "be3e32c997fa951f5497b54aec4f3e642b6fa1c808214d34d968dcd3122d4460",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.3.12/workflow-plugin-atlas-migrate-darwin-arm64.tar.gz"
-    },
-    {
-      "arch": "amd64",
-      "os": "linux",
-      "sha256": "7e8e11b614bcaae8491da436f17d4c966164cfd659a0061a1a491f76c23cb3a6",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.3.12/workflow-plugin-atlas-migrate-linux-amd64.tar.gz"
-    },
-    {
-      "arch": "arm64",
-      "os": "linux",
-      "sha256": "edefa0f0fe66ab317c647f7aee391355dcc9d7005b714e4bb3601e23e64de34b",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.3.12/workflow-plugin-atlas-migrate-linux-arm64.tar.gz"
-    },
-    {
-      "arch": "amd64",
-      "os": "darwin",
-      "sha256": "58085a2eedf85efa2ba36bd5a48063181fa65018878562afcebbc4719d32ea07",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.3.12/workflow-plugin-migrations-darwin-amd64.tar.gz"
+      "sha256": "c8b1ffbaffd5f5ac3eaea24f66463b9cf60b4f2c03bef28c7ebde0378f57a6ae",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.4.1/workflow-plugin-atlas-migrate-darwin-amd64.tar.gz"
     },
     {
       "arch": "arm64",
       "os": "darwin",
-      "sha256": "b75d5999a6e467a79fb340da3f7d078cb9101c4ebdb77afbb3a2f6c841d6d58f",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.3.12/workflow-plugin-migrations-darwin-arm64.tar.gz"
+      "sha256": "d765297ea18119d276fa5f8dc2bdd88b39800842627a5a9afe39a7aca84aa060",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.4.1/workflow-plugin-atlas-migrate-darwin-arm64.tar.gz"
     },
     {
       "arch": "amd64",
       "os": "linux",
-      "sha256": "c2f07854a6e37b1e85867aa696b3012154acaccb24c9b4d268b273d34b3659ed",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.3.12/workflow-plugin-migrations-linux-amd64.tar.gz"
+      "sha256": "7a6e381ba2c1543ee45b15d97fdeb8464cd6eac5c23822c9e8b0e43e5a3cb9a2",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.4.1/workflow-plugin-atlas-migrate-linux-amd64.tar.gz"
     },
     {
       "arch": "arm64",
       "os": "linux",
-      "sha256": "8a9365ea467159645fe903053ab057c0d99ed03b7e8953ebba733885f1bafe20",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.3.12/workflow-plugin-migrations-linux-arm64.tar.gz"
-    },
-    {
-      "arch": "amd64",
-      "os": "windows",
-      "sha256": "b62e93333afb6e641eb8c860d67780d7fe0ca8c16ad39469c18562d5333c2996",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.3.12/workflow-plugin-migrations-windows-amd64.tar.gz"
-    },
-    {
-      "arch": "arm64",
-      "os": "windows",
-      "sha256": "a946dde708644c75a9228da6a08b8953d7e3a4b381ffba154d5b72250486f8aa",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.3.12/workflow-plugin-migrations-windows-arm64.tar.gz"
+      "sha256": "e0b1834f30becfb36faec6dd1487857db6a94fbea943c82b7343490ee02e3f79",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.4.1/workflow-plugin-atlas-migrate-linux-arm64.tar.gz"
     }
   ],
   "homepage": "https://github.com/GoCodeAlone/workflow-plugin-migrations",
@@ -168,5 +54,5 @@
   "repository": "https://github.com/GoCodeAlone/workflow-plugin-migrations",
   "tier": "community",
   "type": "external",
-  "version": "0.3.12"
+  "version": "0.4.1"
 }
diff --git a/plugins/workflow-plugin-auth/manifest.json b/plugins/workflow-plugin-auth/manifest.json
index 0d53da9..033cc97 100644
--- a/plugins/workflow-plugin-auth/manifest.json
+++ b/plugins/workflow-plugin-auth/manifest.json
@@ -50,26 +50,26 @@
     {
       "arch": "amd64",
       "os": "darwin",
-      "sha256": "c1fcb7ca9834eaae2be3a7599485b266985134c253349381f2ac962547039da7",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-auth/releases/download/v0.4.0/workflow-plugin-auth_0.4.0_darwin_amd64.tar.gz"
+      "sha256": "8ed80691daa7ae754a10b74cf66b7948aacbd0037bf643e3ba84f5056649cb26",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-auth/releases/download/v0.5.0/workflow-plugin-auth_0.5.0_darwin_amd64.tar.gz"
     },
     {
       "arch": "arm64",
       "os": "darwin",
-      "sha256": "1a18d75c3cb7744d6cd4ef2fb57a24928329709a9265b83c6ce76473a375db3a",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-auth/releases/download/v0.4.0/workflow-plugin-auth_0.4.0_darwin_arm64.tar.gz"
+      "sha256": "0d9509b2cfe7d7b87d346e3e4caec4d48ff70bc8fcd5bbbb3f71202f4def0fc5",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-auth/releases/download/v0.5.0/workflow-plugin-auth_0.5.0_darwin_arm64.tar.gz"
     },
     {
       "arch": "amd64",
       "os": "linux",
-      "sha256": "01ee3ee7a8abff7f1fc27efff66cbe690c4c7b4584b66a919e62eec87c2bff86",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-auth/releases/download/v0.4.0/workflow-plugin-auth_0.4.0_linux_amd64.tar.gz"
+      "sha256": "551bc0eb53fbea17408a974c813a1552f960f85a1cbeb2093ce8a46eedb9440e",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-auth/releases/download/v0.5.0/workflow-plugin-auth_0.5.0_linux_amd64.tar.gz"
     },
     {
       "arch": "arm64",
       "os": "linux",
-      "sha256": "36c4c3b0fe12dcc0bdf476bbba41fa1b75a78f4b8998d5a51acfdc4163da2370",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-auth/releases/download/v0.4.0/workflow-plugin-auth_0.4.0_linux_arm64.tar.gz"
+      "sha256": "f2553ae4a321dd47f907ec80c3c39a9f02c4565506295b2cf1c20e062e21ec6c",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-auth/releases/download/v0.5.0/workflow-plugin-auth_0.5.0_linux_arm64.tar.gz"
     }
   ],
   "homepage": "https://github.com/GoCodeAlone/workflow-plugin-auth",
@@ -88,5 +88,5 @@
   "repository": "https://github.com/GoCodeAlone/workflow-plugin-auth",
   "tier": "core",
   "type": "external",
-  "version": "0.4.0"
+  "version": "0.5.0"
 }
diff --git a/plugins/workflow-plugin-cms/manifest.json b/plugins/workflow-plugin-cms/manifest.json
index 48b3aff..46c9232 100644
--- a/plugins/workflow-plugin-cms/manifest.json
+++ b/plugins/workflow-plugin-cms/manifest.json
@@ -20,26 +20,26 @@
     {
       "arch": "amd64",
       "os": "darwin",
-      "sha256": "3a0497bfb53e825ff6c6e24b7dd86583b5039a8b951a5ddf2c24789c73e4b18c",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-cms/releases/download/v0.1.5/workflow-plugin-cms-darwin-amd64.tar.gz"
+      "sha256": "9c89a464767079590e88c50817c8b1391d635ba0fa652e13e0c881d025476bf2",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-cms/releases/download/v0.1.9/workflow-plugin-cms-darwin-amd64.tar.gz"
     },
     {
       "arch": "arm64",
       "os": "darwin",
-      "sha256": "33d839532ff85102fb3de343da73e28764d05b9dd3c9e5770734f2524378e6b2",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-cms/releases/download/v0.1.5/workflow-plugin-cms-darwin-arm64.tar.gz"
+      "sha256": "8c59b22d208c436486ed2c8c4f444439d63b7a541a996846ae6505dd05f27381",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-cms/releases/download/v0.1.9/workflow-plugin-cms-darwin-arm64.tar.gz"
     },
     {
       "arch": "amd64",
       "os": "linux",
-      "sha256": "c15edd12e39834267a080eeccbae4b7b8bdc57e323c34b9f732af7caf7c6e2fc",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-cms/releases/download/v0.1.5/workflow-plugin-cms-linux-amd64.tar.gz"
+      "sha256": "43b854d54e4a20320a6579fa30719f6805842c16c8b9f141ed1a461c3430cf1e",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-cms/releases/download/v0.1.9/workflow-plugin-cms-linux-amd64.tar.gz"
     },
     {
       "arch": "arm64",
       "os": "linux",
-      "sha256": "c26f6a9e62aabcbae46dfb2b0f2f9b50b467ad64e1a4dea9c06c7ace8b48cdef",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-cms/releases/download/v0.1.5/workflow-plugin-cms-linux-arm64.tar.gz"
+      "sha256": "d95f46468eac0af02df44f786bd1cea747dc9235a4d123e03f8218904a06059f",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-cms/releases/download/v0.1.9/workflow-plugin-cms-linux-arm64.tar.gz"
     }
   ],
   "homepage": "https://github.com/GoCodeAlone/workflow-plugin-cms",
@@ -59,5 +59,5 @@
   "status": "experimental",
   "tier": "community",
   "type": "external",
-  "version": "0.1.5"
+  "version": "0.1.9"
 }
diff --git a/plugins/workflow-plugin-compute-core/manifest.json b/plugins/workflow-plugin-compute-core/manifest.json
index ae32429..e6f04b4 100644
--- a/plugins/workflow-plugin-compute-core/manifest.json
+++ b/plugins/workflow-plugin-compute-core/manifest.json
@@ -12,38 +12,38 @@
     {
       "arch": "amd64",
       "os": "darwin",
-      "sha256": "f74938ae765b3102530a319fbc9ec32c6e53c24651326150e261f9e68552aa71",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-compute-core/releases/download/v0.8.4/workflow-plugin-compute-core-darwin-amd64.tar.gz"
+      "sha256": "d601383c60986403d2cb416826acb4c750b141f2207114f7b0e69a50bace4981",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-compute-core/releases/download/v0.9.1/workflow-plugin-compute-core-darwin-amd64.tar.gz"
     },
     {
       "arch": "arm64",
       "os": "darwin",
-      "sha256": "fe6b4c65cb99259e1c761e1f2bd20dac79be5f2c920fb6f6a1d0b9a2a51a3dd3",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-compute-core/releases/download/v0.8.4/workflow-plugin-compute-core-darwin-arm64.tar.gz"
+      "sha256": "d568e7ea11d3f3ba277509104508773658e0e0d2bb83196b00ca717aecd863f9",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-compute-core/releases/download/v0.9.1/workflow-plugin-compute-core-darwin-arm64.tar.gz"
     },
     {
       "arch": "amd64",
       "os": "linux",
-      "sha256": "afc2d1f94773263f7e853686e8990199304fd19bdc27b4e98a13ce63d24c81e0",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-compute-core/releases/download/v0.8.4/workflow-plugin-compute-core-linux-amd64.tar.gz"
+      "sha256": "a5c0271eea500ecf39d396b549fb3f82333303fc4cc94f6ea81fffbe6d12abf1",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-compute-core/releases/download/v0.9.1/workflow-plugin-compute-core-linux-amd64.tar.gz"
     },
     {
       "arch": "arm64",
       "os": "linux",
-      "sha256": "de84d8d4d1318963413d3fab3bef14d362b440a1216c88fce6d781610e9348be",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-compute-core/releases/download/v0.8.4/workflow-plugin-compute-core-linux-arm64.tar.gz"
+      "sha256": "02e0a53aca6277c8df2d9b1c8fa38c93a98a33c6126223bc0a7770984bf170ef",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-compute-core/releases/download/v0.9.1/workflow-plugin-compute-core-linux-arm64.tar.gz"
     },
     {
       "arch": "amd64",
       "os": "windows",
-      "sha256": "ab48944c73bf430e9b6e14302d72142fd21214bb0652e89ee1e74a0917853342",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-compute-core/releases/download/v0.8.4/workflow-plugin-compute-core-windows-amd64.tar.gz"
+      "sha256": "6d5821f949a37450ccb3f1a05face0f9e259d7e3af579023a07b86ccca59d669",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-compute-core/releases/download/v0.9.1/workflow-plugin-compute-core-windows-amd64.tar.gz"
     },
     {
       "arch": "arm64",
       "os": "windows",
-      "sha256": "28e9ce6e351b4db8ba47497b144b60916ffa2dbe30880d7756dd812cfa0a594c",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-compute-core/releases/download/v0.8.4/workflow-plugin-compute-core-windows-arm64.tar.gz"
+      "sha256": "b74e1d13ebe211734f9c892de57f05df5c7f96cc8aa6f106e46c0abe4db0c27a",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-compute-core/releases/download/v0.9.1/workflow-plugin-compute-core-windows-arm64.tar.gz"
     }
   ],
   "homepage": "https://github.com/GoCodeAlone/workflow-plugin-compute-core",
@@ -53,12 +53,12 @@
     "provider-catalog"
   ],
   "license": "MIT",
-  "minEngineVersion": "0.64.7",
+  "minEngineVersion": "0.86.0",
   "name": "workflow-plugin-compute-core",
   "private": false,
   "repository": "https://github.com/GoCodeAlone/workflow-plugin-compute-core",
   "status": "experimental",
   "tier": "community",
   "type": "external",
-  "version": "0.8.4"
+  "version": "0.9.1"
 }
diff --git a/plugins/workflow-plugin-digitalocean/manifest.json b/plugins/workflow-plugin-digitalocean/manifest.json
index fe9465e..eb44e0f 100644
--- a/plugins/workflow-plugin-digitalocean/manifest.json
+++ b/plugins/workflow-plugin-digitalocean/manifest.json
@@ -8,6 +8,26 @@
     "configProvider": false,
     "iacProvider": {
       "configSchema": {
+        "digitalocean.database_user": {
+          "description": "Managed database user with provider-generated credentials and opt-in epoch-controlled password rotation.",
+          "fields": {
+            "database_id": {
+              "description": "Parent managed database's canonical UUID.",
+              "required": true,
+              "type": "string"
+            },
+            "rotation_epoch": {
+              "description": "Nonempty opaque epoch. Changing it requests password rotation; returned password and TLS URI are sensitive outputs, not desired inputs.",
+              "required": false,
+              "type": "string"
+            },
+            "username": {
+              "description": "Nonempty database username. The provider escapes it in API paths and resource identifiers.",
+              "required": true,
+              "type": "string"
+            }
+          }
+        },
         "infra.app_domain": {
           "description": "DigitalOcean App Platform domain binding. Updates only AppSpec.Domains on an existing App Platform app so DNS/domain aliases can be reconciled without rebuilding service images or runtime environment variables.",
           "fields": {
@@ -72,6 +92,16 @@
             "type": "string"
           }
         },
+        "infra.database": {
+          "description": "Managed database. Administrator password rotation is opt-in and separate from ordinary configuration updates.",
+          "fields": {
+            "admin_rotation_epoch": {
+              "description": "Nonempty opaque epoch. Changing it requests administrator password rotation; omission preserves legacy behavior.",
+              "required": false,
+              "type": "string"
+            }
+          }
+        },
         "infra.dns": {
           "description": "DigitalOcean DNS zone and record reconciliation. Declared records are upserted; absent_records deletes targeted stale records without making the whole zone authoritative.",
           "fields": {
@@ -92,6 +122,26 @@
             }
           }
         },
+        "infra.droplet": {
+          "description": "DigitalOcean Droplet with optional fresh catalog price validation before plan, create, or destructive replacement.",
+          "fields": {
+            "max_monthly_usd": {
+              "description": "Positive finite monthly USD cap. A fresh Sizes API quote must confirm exact size and region availability and price at or below this cap; uncapped resources make no price lookup.",
+              "required": false,
+              "type": "number"
+            },
+            "region": {
+              "description": "Explicit region slug required when max_monthly_usd is present.",
+              "required": false,
+              "type": "string"
+            },
+            "size": {
+              "description": "Explicit size slug required when max_monthly_usd is present.",
+              "required": false,
+              "type": "string"
+            }
+          }
+        },
         "infra.firewall": {
           "description": "DigitalOcean cloud firewall. Attaches to Droplets by ID or by tag (which auto-attaches future Droplets / DOKS pools that receive the tag). Either `droplet_ids` or `tags` is REQUIRED; `wfctl infra apply` rejects firewalls with no targets before any DO API call. NOTE: DO firewalls do not attach to App Platform apps — for App-Platform-only deployments, use `expose: internal` services plus `trusted_sources` on managed databases.",
           "examples": [
@@ -144,6 +194,7 @@
         "infra.app_domain",
         "infra.k8s_cluster",
         "infra.database",
+        "digitalocean.database_user",
         "infra.cache",
         "infra.load_balancer",
         "infra.vpc",
@@ -173,11 +224,14 @@
       "workflow.plugin.external.iac.IaCProviderValidator",
       "workflow.plugin.external.iac.IaCProviderDriftConfigDetector",
       "workflow.plugin.external.iac.IaCProviderLogCapture",
+      "workflow.plugin.external.iac.IaCProviderRunner",
+      "workflow.plugin.external.iac.IaCProviderJobCanceler",
       "workflow.plugin.external.iac.IaCProviderRequirementMapper",
       "workflow.plugin.external.iac.IaCProviderRegionLister",
       "workflow.plugin.external.iac.IaCProviderOwnership",
       "workflow.plugin.external.iac.IaCProviderFinalizer",
       "workflow.plugin.external.iac.ResourceDriver",
+      "workflow.plugin.external.iac.ResourceSensitiveInputDeclarer",
       "workflow.plugin.external.iac.IaCStateBackend"
     ],
     "stepTypes": [
@@ -192,26 +246,26 @@
     {
       "arch": "amd64",
       "os": "darwin",
-      "sha256": "78a28e9be0516b16003c20f515c39ef62e587d1076e730694ed53182780b40a3",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-digitalocean/releases/download/v2.1.18/workflow-plugin-digitalocean-darwin-amd64.tar.gz"
+      "sha256": "e94a729a21e4a446888c0be70ce90458c6af5797cb5d2fd4e6ba75e002a82e07",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-digitalocean/releases/download/v2.1.20/workflow-plugin-digitalocean-darwin-amd64.tar.gz"
     },
     {
       "arch": "arm64",
       "os": "darwin",
-      "sha256": "903361e5d964329b6033960c9ff19a417c28ed1ea6df30fc7174d4e5db0abb8d",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-digitalocean/releases/download/v2.1.18/workflow-plugin-digitalocean-darwin-arm64.tar.gz"
+      "sha256": "889dc1085b751b5543bf3b1df562ea560116cf5d75597e7fbac6bd296534c264",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-digitalocean/releases/download/v2.1.20/workflow-plugin-digitalocean-darwin-arm64.tar.gz"
     },
     {
       "arch": "amd64",
       "os": "linux",
-      "sha256": "dc91393cd449b82e513f60f98d23b0fae5251ad21510e80226f5311397d69711",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-digitalocean/releases/download/v2.1.18/workflow-plugin-digitalocean-linux-amd64.tar.gz"
+      "sha256": "67064feb4bb4f5e6fcda01e658ed6c50da1bb6a83c185bd8cf76579464d78633",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-digitalocean/releases/download/v2.1.20/workflow-plugin-digitalocean-linux-amd64.tar.gz"
     },
     {
       "arch": "arm64",
       "os": "linux",
-      "sha256": "3f51108aa40cabb18d9c7d84c70e45148a21a7d04094aff79e9cd538690a0458",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-digitalocean/releases/download/v2.1.18/workflow-plugin-digitalocean-linux-arm64.tar.gz"
+      "sha256": "96556c53a01b23511672346d3405314c26283a8e0a951b1a7b18179b7df2ef39",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-digitalocean/releases/download/v2.1.20/workflow-plugin-digitalocean-linux-arm64.tar.gz"
     }
   ],
   "homepage": "https://github.com/GoCodeAlone/workflow-plugin-digitalocean",
@@ -231,7 +285,7 @@
     "block-storage"
   ],
   "license": "MIT",
-  "minEngineVersion": "0.80.1",
+  "minEngineVersion": "0.86.1",
   "name": "workflow-plugin-digitalocean",
   "private": false,
   "repository": "https://github.com/GoCodeAlone/workflow-plugin-digitalocean",
@@ -293,5 +347,5 @@
   "status": "verified",
   "tier": "community",
   "type": "external",
-  "version": "2.1.18"
+  "version": "2.1.20"
 }
diff --git a/plugins/workflow-plugin-migrations/manifest.json b/plugins/workflow-plugin-migrations/manifest.json
index ad66f69..72b0b75 100644
--- a/plugins/workflow-plugin-migrations/manifest.json
+++ b/plugins/workflow-plugin-migrations/manifest.json
@@ -74,86 +74,38 @@
     {
       "arch": "amd64",
       "os": "darwin",
-      "sha256": "f777262dcaa897174458be211da1117327cf5dd9c3093f719e5852a253cef703",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.3.12/workflow-migrate-darwin-amd64.tar.gz"
+      "sha256": "30574e2d75420a1cbfe48818bef28bc2db53d6474d125f3d0a6e4093bcf9c047",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.4.1/workflow-plugin-migrations-darwin-amd64.tar.gz"
     },
     {
       "arch": "arm64",
       "os": "darwin",
-      "sha256": "88412be1c0a30dc4f1132c387754ca58ff066d6e935c688a34116531964a7550",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.3.12/workflow-migrate-darwin-arm64.tar.gz"
+      "sha256": "f04a2ad8d69d87276b29b9f78e10d4b9144a15f18e8928913d30c370f1b107fc",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.4.1/workflow-plugin-migrations-darwin-arm64.tar.gz"
     },
     {
       "arch": "amd64",
       "os": "linux",
-      "sha256": "4e86009fadf24af5c2a5af142bb5d5fc0b21c01fc9c56bd0f97972202e9b4df6",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.3.12/workflow-migrate-linux-amd64.tar.gz"
+      "sha256": "04b5369eb02b17e60f50fb95c744bddfec532ff0666756b7f20b8d0edd5ce19f",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.4.1/workflow-plugin-migrations-linux-amd64.tar.gz"
     },
     {
       "arch": "arm64",
       "os": "linux",
-      "sha256": "fd589260bca2eaa7275bff3f29a3203155c65a07939abda2e070468c2f08af57",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.3.12/workflow-migrate-linux-arm64.tar.gz"
-    },
-    {
-      "arch": "amd64",
-      "os": "darwin",
-      "sha256": "490005c3bc7105d8b16c2b25742d591f6255ffedf3e14727020eb8c54c8c0099",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.3.12/workflow-plugin-atlas-migrate-darwin-amd64.tar.gz"
-    },
-    {
-      "arch": "arm64",
-      "os": "darwin",
-      "sha256": "be3e32c997fa951f5497b54aec4f3e642b6fa1c808214d34d968dcd3122d4460",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.3.12/workflow-plugin-atlas-migrate-darwin-arm64.tar.gz"
-    },
-    {
-      "arch": "amd64",
-      "os": "linux",
-      "sha256": "7e8e11b614bcaae8491da436f17d4c966164cfd659a0061a1a491f76c23cb3a6",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.3.12/workflow-plugin-atlas-migrate-linux-amd64.tar.gz"
-    },
-    {
-      "arch": "arm64",
-      "os": "linux",
-      "sha256": "edefa0f0fe66ab317c647f7aee391355dcc9d7005b714e4bb3601e23e64de34b",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.3.12/workflow-plugin-atlas-migrate-linux-arm64.tar.gz"
-    },
-    {
-      "arch": "amd64",
-      "os": "darwin",
-      "sha256": "58085a2eedf85efa2ba36bd5a48063181fa65018878562afcebbc4719d32ea07",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.3.12/workflow-plugin-migrations-darwin-amd64.tar.gz"
-    },
-    {
-      "arch": "arm64",
-      "os": "darwin",
-      "sha256": "b75d5999a6e467a79fb340da3f7d078cb9101c4ebdb77afbb3a2f6c841d6d58f",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.3.12/workflow-plugin-migrations-darwin-arm64.tar.gz"
-    },
-    {
-      "arch": "amd64",
-      "os": "linux",
-      "sha256": "c2f07854a6e37b1e85867aa696b3012154acaccb24c9b4d268b273d34b3659ed",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.3.12/workflow-plugin-migrations-linux-amd64.tar.gz"
-    },
-    {
-      "arch": "arm64",
-      "os": "linux",
-      "sha256": "8a9365ea467159645fe903053ab057c0d99ed03b7e8953ebba733885f1bafe20",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.3.12/workflow-plugin-migrations-linux-arm64.tar.gz"
+      "sha256": "914cc5eba3133a966fac311fef5fe45504b3480f42067c3566807e6a297e7c67",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.4.1/workflow-plugin-migrations-linux-arm64.tar.gz"
     },
     {
       "arch": "amd64",
       "os": "windows",
-      "sha256": "b62e93333afb6e641eb8c860d67780d7fe0ca8c16ad39469c18562d5333c2996",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.3.12/workflow-plugin-migrations-windows-amd64.tar.gz"
+      "sha256": "333ac4c60dd873e8ba52b819224c2303b7adf17538f4422475baa411b438a075",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.4.1/workflow-plugin-migrations-windows-amd64.tar.gz"
     },
     {
       "arch": "arm64",
       "os": "windows",
-      "sha256": "a946dde708644c75a9228da6a08b8953d7e3a4b381ffba154d5b72250486f8aa",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.3.12/workflow-plugin-migrations-windows-arm64.tar.gz"
+      "sha256": "da66dff0b0010daf42cefd33e9c4cd242ad47568304faa6a026dee5be3085e63",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-migrations/releases/download/v0.4.1/workflow-plugin-migrations-windows-arm64.tar.gz"
     }
   ],
   "homepage": "https://github.com/GoCodeAlone/workflow-plugin-migrations",
@@ -171,5 +123,5 @@
   "repository": "https://github.com/GoCodeAlone/workflow-plugin-migrations",
   "tier": "community",
   "type": "external",
-  "version": "0.3.12"
+  "version": "0.4.1"
 }
diff --git a/plugins/workflow-plugin-product-capture/manifest.json b/plugins/workflow-plugin-product-capture/manifest.json
index 4a833df..e6a6527 100644
--- a/plugins/workflow-plugin-product-capture/manifest.json
+++ b/plugins/workflow-plugin-product-capture/manifest.json
@@ -27,38 +27,38 @@
     {
       "arch": "amd64",
       "os": "darwin",
-      "sha256": "592a3cf1a8966c77f5471ccd5fb4c45ba355b49d3abd654e073a5005dd9251fc",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-product-capture/releases/download/v0.1.60/workflow-plugin-product-capture-darwin-amd64.tar.gz"
+      "sha256": "cf24de015b66a54e37112ef1def65ef982cf9bab19e25df0849c610c2585b4f4",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-product-capture/releases/download/v0.1.66/workflow-plugin-product-capture-darwin-amd64.tar.gz"
     },
     {
       "arch": "arm64",
       "os": "darwin",
-      "sha256": "76238463026015872f6a7047cfed52a07f4ea90c7b9051debc50f5ca4f40dcc7",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-product-capture/releases/download/v0.1.60/workflow-plugin-product-capture-darwin-arm64.tar.gz"
+      "sha256": "0e6e675fa0086b1a72d2178715a5916e2ecaaff46d985a377df60974c18fccf8",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-product-capture/releases/download/v0.1.66/workflow-plugin-product-capture-darwin-arm64.tar.gz"
     },
     {
       "arch": "amd64",
       "os": "linux",
-      "sha256": "227b49c7d1b911ad0f549741498d4e2b760510ab1e847685483b180b3818723c",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-product-capture/releases/download/v0.1.60/workflow-plugin-product-capture-linux-amd64.tar.gz"
+      "sha256": "95fd03960accb86696a9dbbba113fd83f6475f4abe84868237a560bfb7223d60",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-product-capture/releases/download/v0.1.66/workflow-plugin-product-capture-linux-amd64.tar.gz"
     },
     {
       "arch": "arm64",
       "os": "linux",
-      "sha256": "b700de705250df059f8ec2a8ba3836b30777c033ca574015f527f7d214f400c4",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-product-capture/releases/download/v0.1.60/workflow-plugin-product-capture-linux-arm64.tar.gz"
+      "sha256": "0c24a2067391bb8d2bb0280b741e2ead55f914617dda3980c12f0a72dd8371e7",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-product-capture/releases/download/v0.1.66/workflow-plugin-product-capture-linux-arm64.tar.gz"
     },
     {
       "arch": "amd64",
       "os": "windows",
-      "sha256": "84e4857100c9627f0a1f7ddfe3ff534b47f0621c9986894368bf26769000fd39",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-product-capture/releases/download/v0.1.60/workflow-plugin-product-capture-windows-amd64.tar.gz"
+      "sha256": "c08bea2f2f6ffacf3d5ac3e06f03599eb32c8ac495364191929f94cb817ae3b4",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-product-capture/releases/download/v0.1.66/workflow-plugin-product-capture-windows-amd64.tar.gz"
     },
     {
       "arch": "arm64",
       "os": "windows",
-      "sha256": "95bce3c31d1a7009baf6da40a6e76f1df27eefd0f0a3f0a7ceb2eec60b0d2612",
-      "url": "https://github.com/GoCodeAlone/workflow-plugin-product-capture/releases/download/v0.1.60/workflow-plugin-product-capture-windows-arm64.tar.gz"
+      "sha256": "3806d1c038c2fddbbec2cbf0312f7a0c5baccbb09e837200f116fa7ca2f645fb",
+      "url": "https://github.com/GoCodeAlone/workflow-plugin-product-capture/releases/download/v0.1.66/workflow-plugin-product-capture-windows-arm64.tar.gz"
     }
   ],
   "homepage": "https://github.com/GoCodeAlone/workflow-plugin-product-capture",
@@ -76,5 +76,5 @@
   "status": "verified",
   "tier": "community",
   "type": "external",
-  "version": "0.1.60"
+  "version": "0.1.66"
 }
diff --git a/scripts/validate-manifests.sh b/scripts/validate-manifests.sh
index f0825c5..e1e1867 100755
--- a/scripts/validate-manifests.sh
+++ b/scripts/validate-manifests.sh
@@ -57,6 +57,63 @@ for manifest in "$PLUGINS_DIR"/*/manifest.json; do
     echo "$manifest invalid: downloads[].url release tag must match manifest version" >&2
     errors=$((errors + 1))
   fi
+
+  # These releases contain standalone and plugin archive families. wfctl
+  # selects the first OS/arch match, so publish only the full plugin role.
+  catalog="$(basename "$(dirname "$manifest")")"
+  artifact=""
+  case "$catalog" in
+    github)
+      artifact="workflow-plugin-github"
+      repository="workflow-plugin-github"
+      operating_systems='["darwin", "linux", "windows"]'
+      download_count=6
+      ;;
+    workflow-plugin-migrations)
+      artifact="workflow-plugin-migrations"
+      repository="workflow-plugin-migrations"
+      operating_systems='["darwin", "linux", "windows"]'
+      download_count=6
+      ;;
+    workflow-plugin-atlas-migrate)
+      artifact="workflow-plugin-atlas-migrate"
+      repository="workflow-plugin-migrations"
+      operating_systems='["darwin", "linux"]'
+      download_count=4
+      ;;
+  esac
+  if [[ -n "$artifact" ]]; then
+    if ! jq -e --arg catalog "$catalog" --arg artifact "$artifact" \
+      --arg repository "$repository" --argjson operating_systems "$operating_systems" \
+      --argjson download_count "$download_count" '
+      .version as $version | (.downloads // []) as $downloads |
+      .name == $catalog and .type == "external"
+      and ($downloads | length == $download_count)
+      and ($downloads | map([.os, .arch]) | unique | length == $download_count)
+      and all($downloads[]; . as $download |
+        ($operating_systems | index($download.os)) != null
+        and (["amd64", "arm64"] | index($download.arch)) != null
+        and $download.url == ("https://github.com/GoCodeAlone/" + $repository
+          + "/releases/download/v" + $version + "/" + $artifact
+          + "-" + $download.os + "-" + $download.arch + ".tar.gz"))
+    ' "$manifest" >/dev/null; then
+      echo "$manifest invalid: catalog downloads must select full plugin archives with one entry per supported OS/arch" >&2
+      errors=$((errors + 1))
+    fi
+  fi
+  # Atlas is driver-only; use plugin.atlas.json, not the main plugin manifest.
+  if [[ "$catalog" == "workflow-plugin-atlas-migrate" ]] && ! jq -e '
+    (.capabilities | keys) == ["buildHooks", "cliCommands", "configProvider",
+      "migrationDrivers", "moduleTypes", "stepTypes", "triggerTypes"]
+    and .capabilities.configProvider == false
+    and (.capabilities.moduleTypes | sort) == ["database.migration_driver", "database.migrations"]
+    and .capabilities.migrationDrivers == ["atlas"]
+    and .capabilities.stepTypes == [] and .capabilities.cliCommands == []
+    and .capabilities.triggerTypes == [] and .capabilities.buildHooks == []
+  ' "$manifest" >/dev/null; then
+    echo "$manifest invalid: Atlas catalog must match its driver-only capabilities" >&2
+    errors=$((errors + 1))
+  fi
 done
 
 if [[ $errors -gt 0 ]]; then
diff --git a/tests/test-validate-manifests-artifacts.sh b/tests/test-validate-manifests-artifacts.sh
new file mode 100755
index 0000000..790e424
--- /dev/null
+++ b/tests/test-validate-manifests-artifacts.sh
@@ -0,0 +1,148 @@
+#!/usr/bin/env bash
+# Gate the three catalogs whose releases contain multiple archive roles.
+set -euo pipefail
+
+repo_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+tmp="$(mktemp -d "${TMPDIR:-/tmp}/registry-artifact-roles.XXXXXX")"
+trap 'rm -rf "${tmp}"' EXIT
+failures=0
+
+fail() {
+  echo "FAIL: $*" >&2
+  failures=$((failures + 1))
+}
+
+# Test real catalog inputs, including the first-match behavior used by wfctl.
+for spec in \
+  'github workflow-plugin-github 6' \
+  'workflow-plugin-migrations workflow-plugin-migrations 6' \
+  'workflow-plugin-atlas-migrate workflow-plugin-atlas-migrate 4'; do
+  read -r catalog artifact count <<< "${spec}"
+  manifest="${repo_root}/plugins/${catalog}/manifest.json"
+  selected="$(jq -r 'first(.downloads[] | select(.os == "linux" and .arch == "amd64")) | .url' "${manifest}")"
+  if [[ "${selected##*/}" != "${artifact}-linux-amd64.tar.gz" ]]; then
+    fail "${catalog} first Linux/amd64 download selects ${selected##*/}, expected full ${artifact} archive"
+  fi
+  if ! jq -e --arg artifact "${artifact}" --argjson count "${count}" '
+    (.downloads | length == $count)
+    and all(.downloads[]; . as $download |
+      $download.url | endswith("/" + $artifact + "-" + $download.os + "-" + $download.arch + ".tar.gz"))
+  ' "${manifest}" >/dev/null; then
+    fail "${catalog} catalog contains a wrong archive role or platform count"
+  fi
+done
+
+atlas="${repo_root}/plugins/workflow-plugin-atlas-migrate/manifest.json"
+if ! jq -e '
+  .capabilities.migrationDrivers == ["atlas"]
+  and .capabilities.stepTypes == []
+  and .capabilities.cliCommands == []
+' "${atlas}" >/dev/null; then
+  fail "Atlas catalog must declare Atlas with no main-plugin steps or CLI"
+fi
+
+# Valid fixtures use the published full archive roles and Atlas plugin.atlas.json
+# contract. Mutations below exercise the actual production validator.
+mkdir -p "${tmp}/good"
+for spec in \
+  'github workflow-plugin-github' \
+  'workflow-plugin-migrations workflow-plugin-migrations' \
+  'workflow-plugin-atlas-migrate workflow-plugin-atlas-migrate'; do
+  read -r catalog artifact <<< "${spec}"
+  mkdir -p "${tmp}/good/${catalog}"
+  jq --arg artifact "${artifact}" '
+    .downloads |= map(select(.url | contains("/" + $artifact + "-")))
+  ' "${repo_root}/plugins/${catalog}/manifest.json" > "${tmp}/good/${catalog}/manifest.json"
+done
+jq '.capabilities = {
+  configProvider: false,
+  moduleTypes: ["database.migrations", "database.migration_driver"],
+  stepTypes: [], triggerTypes: [], migrationDrivers: ["atlas"],
+  cliCommands: [], buildHooks: []
+}' "${tmp}/good/workflow-plugin-atlas-migrate/manifest.json" > "${tmp}/atlas.json"
+mv "${tmp}/atlas.json" "${tmp}/good/workflow-plugin-atlas-migrate/manifest.json"
+
+reset_fixtures() {
+  rm -rf "${tmp}/plugins"
+  cp -R "${tmp}/good" "${tmp}/plugins"
+}
+
+mutate() {
+  local catalog="$1" expression="$2"
+  jq "${expression}" "${tmp}/plugins/${catalog}/manifest.json" > "${tmp}/mutated.json"
+  mv "${tmp}/mutated.json" "${tmp}/plugins/${catalog}/manifest.json"
+}
+
+run_validator() {
+  REGISTRY_ROOT="${repo_root}" \
+  REGISTRY_SCHEMA="${repo_root}/schema/registry-schema.json" \
+  PLUGINS_DIR="${tmp}/plugins" \
+    bash "${repo_root}/scripts/validate-manifests.sh"
+}
+
+expect_rejection() {
+  local label="$1" message="$2"
+  if run_validator > "${tmp}/validator.out" 2>&1; then
+    fail "validator accepted ${label}"
+  elif ! grep -q "${message}" "${tmp}/validator.out"; then
+    fail "${label} rejected for an unexpected reason"
+    cat "${tmp}/validator.out" >&2
+  else
+    echo "PASS: rejects ${label}"
+  fi
+}
+
+reset_fixtures
+if ! run_validator > "${tmp}/validator.out" 2>&1; then
+  fail "validator rejected valid published archive-role fixtures"
+  cat "${tmp}/validator.out" >&2
+fi
+mutate workflow-plugin-atlas-migrate '.capabilities.moduleTypes |= reverse'
+if ! run_validator > "${tmp}/validator.out" 2>&1; then
+  fail "validator rejected equivalent Atlas module ordering"
+  cat "${tmp}/validator.out" >&2
+fi
+
+for spec in \
+  'github workflow-plugin-github github' \
+  'workflow-plugin-migrations workflow-plugin-migrations workflow-migrate' \
+  'workflow-plugin-atlas-migrate workflow-plugin-atlas-migrate workflow-migrate'; do
+  read -r catalog artifact wrong_artifact <<< "${spec}"
+  reset_fixtures
+  mutate "${catalog}" ".downloads[0].url |= sub(\"/${artifact}-\"; \"/${wrong_artifact}-\")"
+  expect_rejection "${catalog} wrong first archive role" 'catalog downloads must select full plugin archives'
+done
+
+reset_fixtures
+mutate workflow-plugin-migrations '.downloads[0].url |= sub("/workflow-plugin-migrations-"; "/workflow-plugin-atlas-migrate-")'
+expect_rejection 'main migrations with an Atlas archive' 'catalog downloads must select full plugin archives'
+
+for catalog in github workflow-plugin-migrations workflow-plugin-atlas-migrate; do
+  reset_fixtures
+  mutate "${catalog}" '.downloads[1] = .downloads[0]'
+  expect_rejection "${catalog} duplicate OS/arch" 'catalog downloads must select full plugin archives'
+done
+
+reset_fixtures
+mutate github '.downloads = []'
+expect_rejection 'empty Github downloads' 'catalog downloads must select full plugin archives'
+
+reset_fixtures
+mutate workflow-plugin-atlas-migrate '.downloads[0].os = "windows" | .downloads[0].url |= sub("-darwin-"; "-windows-")'
+expect_rejection 'unsupported Atlas Windows archive' 'catalog downloads must select full plugin archives'
+
+for expression in \
+  '.capabilities.migrationDrivers = ["golang-migrate", "goose"]' \
+  '.capabilities.stepTypes = ["step.migrate_up"]' \
+  '.capabilities.cliCommands = [{"name":"db-migrate"}]' \
+  '.capabilities.workflowHandlers = ["http"]'; do
+  reset_fixtures
+  mutate workflow-plugin-atlas-migrate "${expression}"
+  expect_rejection "Atlas metadata: ${expression}" 'Atlas catalog must match its driver-only capabilities'
+done
+
+if [[ "${failures}" -gt 0 ]]; then
+  echo "Artifact-role regression tests failed: ${failures}" >&2
+  exit 1
+fi
+echo "validate-manifests artifact-role tests passed"