@apexops/cli 0.10.0-next.0 → 0.10.0-next.2

package/assets/client-projections/github-copilot-vscode/.github/instructions/apex-artifact-contracts.instructions.md

@@ -0,0 +1,12 @@
+---
+description: "Typed APEX artifact and evidence handling rules"
+applyTo: "**/agent-output/**/*.md, **/agent-output/**/*.json"
+---
+
+# APEX Artifact Contracts
+
+- Treat accepted artifact schemas and task context as the authoritative output contract.
+- Preserve project, run, environment, and track identity fields exactly.
+- Record unknown or deferred decisions explicitly; do not fabricate evidence.
+- Use the owning APEX MCP completion operation for accepted artifacts.
+- Do not write secrets, credentials, raw tokens, or unredacted command output into artifacts.

package/assets/client-projections/github-copilot-vscode/.github/instructions/apex-automation.instructions.md

@@ -0,0 +1,12 @@
+---
+description: "Consumer GitHub Actions safety and reproducibility rules"
+applyTo: ".github/workflows/*.yml, .github/workflows/*.yaml"
+---
+
+# APEX Automation Rules
+
+- Use least-privilege workflow permissions and immutable major action versions.
+- Use `npm ci` for Node.js dependencies and declare the required Node version.
+- Keep deployment, approval, and secret-bearing operations outside unmanaged workflows.
+- Do not expose credentials in workflow logs or command arguments.
+- Use explicit, bounded triggers and concurrency for mutating workflows.

package/assets/client-projections/github-copilot-vscode/.github/instructions/apex-azure-yaml.instructions.md

@@ -0,0 +1,12 @@
+---
+description: "Consumer azd manifest co-location and environment naming rules"
+applyTo: "**/azure.yaml"
+---
+
+# APEX azure.yaml Rules
+
+- Keep each workload's `infra.path` inside its workload directory.
+- Use an environment name that identifies both workload and lifecycle stage.
+- Do not point `infra.path` at the consumer repository root.
+- Keep Bicep and Terraform workload paths separate.
+- Treat deployment execution as an APEX-governed operation, not an instruction-driven command.

package/assets/client-projections/github-copilot-vscode/.github/instructions/apex-bicep.instructions.md

@@ -0,0 +1,12 @@
+---
+description: "Consumer Bicep security, AVM, and repeatability guidance"
+applyTo: "**/*.bicep"
+---
+
+# APEX Bicep Rules
+
+- Prefer Azure Verified Modules where they fit the selected design.
+- Use managed identity, HTTPS, current TLS baselines, and private data access patterns.
+- Derive names deterministically from the workload, environment, and approved suffix inputs.
+- Keep parameters environment-specific and avoid hardcoded secrets or subscription identifiers.
+- Validate generated Bicep through the APEX workflow before requesting a preview.

package/assets/client-projections/github-copilot-vscode/.github/instructions/apex-code-quality.instructions.md

@@ -0,0 +1,12 @@
+---
+description: "Consumer code review, comments, and security boundaries"
+applyTo: "**/*.{js,mjs,cjs,ts,tsx,jsx,py,ps1,sh,bicep,tf}"
+---
+
+# APEX Code Quality
+
+- Explain why non-obvious code exists; do not narrate obvious assignments.
+- Validate inputs at boundaries and fail with precise, stable errors.
+- Keep secret values out of source, logs, generated artifacts, and configuration.
+- Prefer typed or structured APIs over ad hoc parsing.
+- Keep changes scoped to the selected project and its declared workflow task.

package/assets/client-projections/github-copilot-vscode/.github/instructions/apex-context.instructions.md

@@ -0,0 +1,12 @@
+---
+description: "Consumer guidance context and instruction size boundaries"
+applyTo: ".github/agents/**/*.agent.md, .github/skills/**/SKILL.md, .github/instructions/**/*.instructions.md"
+---
+
+# APEX Context Boundaries
+
+- Keep instructions focused on one consumer concern and use narrow `applyTo` globs.
+- Move detailed decision knowledge into a skill reference rather than repeating it across agents.
+- Read only the skills and references needed for the active project task.
+- Prefer targeted edits over full rewrites when changing consumer guidance.
+- Do not embed large logs, secrets, or complete chat history in managed guidance.

package/assets/client-projections/github-copilot-vscode/.github/instructions/apex-documentation.instructions.md

@@ -0,0 +1,12 @@
+---
+description: "Consumer documentation structure and evidence-aware writing rules"
+applyTo: "docs/**/*.md, README.md, **/agent-output/**/*.md"
+---
+
+# APEX Consumer Documentation
+
+- Use one H1 per document and concise H2 sections for the remaining structure.
+- Keep lines within 120 characters and use fenced code blocks with a language.
+- Link to local, consumer-relevant files with descriptive text.
+- Distinguish implemented behavior from deferred or unqualified capabilities.
+- Do not claim deployment, client, provider, or compliance qualification without recorded evidence.

package/assets/client-projections/github-copilot-vscode/.github/instructions/apex-governance.instructions.md

@@ -0,0 +1,12 @@
+---
+description: "Consumer governance evidence and IaC planning boundaries"
+applyTo: "**/04-governance-constraints.md, **/04-governance-constraints.json, **/04-implementation-plan.md"
+---
+
+# APEX Governance And Planning
+
+- Treat governance constraints as evidence-bound inputs, not assumptions.
+- Record unavailable policy evidence as a blocker or explicit uncertainty.
+- Bind cost, resilience, security, and naming decisions to the selected project and environment.
+- Keep implementation plans track-neutral until the kernel selects Bicep or Terraform generation.
+- Do not query, exempt, assign, or deploy Azure resources directly from planning guidance.

package/assets/client-projections/github-copilot-vscode/.github/instructions/apex-instruction-authoring.instructions.md

@@ -0,0 +1,12 @@
+---
+description: "Consumer custom instruction authoring and scope rules"
+applyTo: ".github/instructions/**/*.instructions.md"
+---
+
+# APEX Instruction Authoring
+
+- Use `description` and a narrow `applyTo` pattern in YAML frontmatter.
+- Name consumer instructions with the `apex-` prefix.
+- Keep instructions imperative, concise, and scoped to consumer files.
+- Do not duplicate skill content, repository maintenance rules, or direct operational authority.
+- State evidence and safety boundaries where guidance could otherwise be interpreted as authorization.

package/assets/client-projections/github-copilot-vscode/.github/instructions/apex-javascript.instructions.md

@@ -0,0 +1,11 @@
+---
+description: "Consumer JavaScript and Node.js implementation guidance"
+applyTo: "**/*.{js,mjs,cjs}"
+---
+
+# APEX JavaScript Rules
+
+- Use ESM syntax and explicit error handling.
+- Keep command execution bounded, argument-based, and free of shell interpolation.
+- Parse structured input with a parser and validate external data before use.
+- Avoid writing consumer state outside the owning APEX MCP or CLI operation.

package/assets/client-projections/github-copilot-vscode/.github/instructions/apex-json.instructions.md

@@ -0,0 +1,11 @@
+---
+description: "Consumer JSON and JSONC configuration rules"
+applyTo: "**/*.{json,jsonc}"
+---
+
+# APEX JSON Rules
+
+- Format JSON with two-space indentation and a final newline.
+- Use JSONC comments only where the consumer client supports JSONC.
+- Keep configuration declarative and free of secrets, tokens, or connection strings.
+- Preserve project, run, environment, and track identifiers exactly when they are contract fields.

package/assets/client-projections/github-copilot-vscode/.github/instructions/apex-markdown.instructions.md

@@ -0,0 +1,13 @@
+---
+description: "Consumer Markdown formatting and evidence language rules"
+applyTo: "**/*.md"
+---
+
+# APEX Markdown Rules
+
+- Use one H1 and structured H2 sections.
+- Keep lines within 120 characters and specify languages on fenced code blocks.
+- Use descriptive links and avoid feature claims that lack evidence.
+- Keep generated artifact content consistent with its accepted APEX contract.
+- Use accepted APEX templates before adding presentation or diagram content.
+- Use `mermaid` for inline flows and `python-diagrams` for standalone `.py`, `.png`, and `.svg` artifacts.

package/assets/client-projections/github-copilot-vscode/.github/instructions/apex-powershell.instructions.md

@@ -0,0 +1,11 @@
+---
+description: "Consumer PowerShell safety and idempotent scripting guidance"
+applyTo: "**/*.{ps1,psm1}"
+---
+
+# APEX PowerShell Rules
+
+- Use approved cmdlets and explicit parameters.
+- Keep scripts non-interactive and idempotent where possible.
+- Require explicit confirmation through APEX project lifecycle prompts before destructive work.
+- Do not embed credentials, tokens, or direct cloud deployment authority in scripts.

package/assets/client-projections/github-copilot-vscode/.github/instructions/apex-prompt-authoring.instructions.md

@@ -0,0 +1,12 @@
+---
+description: "Consumer prompt and model instruction boundaries"
+applyTo: ".github/agents/**/*.agent.md, .github/prompts/**/*.prompt.md"
+---
+
+# APEX Prompt Rules
+
+- Use the model assigned by the managed role and do not override it redundantly.
+- Keep prompts outcome-focused with explicit scope, input, output, and stop conditions.
+- Keep tool lists minimal and use native client questions for user-owned decisions.
+- Do not grant direct mutation, secrets, repository maintenance, or cloud lifecycle authority.
+- Route workflow state changes through the declared APEX MCP operation.

package/assets/client-projections/github-copilot-vscode/.github/instructions/apex-python.instructions.md

@@ -0,0 +1,11 @@
+---
+description: "Consumer Python implementation and validation guidance"
+applyTo: "**/*.py"
+---
+
+# APEX Python Rules
+
+- Use explicit dependencies, typed boundaries, and structured parsing.
+- Keep Azure and workflow state operations behind declared APEX capabilities.
+- Validate external input and produce concise, actionable errors.
+- Do not embed secrets, credentials, or direct deployment commands.

package/assets/client-projections/github-copilot-vscode/.github/instructions/apex-safe-file-edits.instructions.md

@@ -0,0 +1,11 @@
+---
+description: "Consumer safe file editing and generated artifact boundaries"
+applyTo: "**/*.{js,mjs,cjs,ts,tsx,jsx,py,ps1,sh,bicep,tf}"
+---
+
+# APEX Safe File Edits
+
+- Use the client file-editing capability for source changes; do not create files through shell redirection.
+- Do not use heredocs, `tee`, or inline interpreters to write project code or artifacts.
+- Write accepted workflow outputs only through the owning APEX MCP operation.
+- Keep generated files inside the selected project and run boundaries.

package/assets/client-projections/github-copilot-vscode/.github/instructions/apex-safe-shell.instructions.md

@@ -0,0 +1,11 @@
+---
+description: "Consumer shell safety and non-interactive command rules"
+applyTo: ".github/agents/**/*.agent.md, .github/prompts/**/*.prompt.md, .github/skills/**/SKILL.md"
+---
+
+# APEX Shell Safety
+
+- Use non-interactive commands only; do not use confirmation flags or prompt-driven shell builtins.
+- Keep command output bounded and summarize results instead of replaying large logs.
+- Do not request, print, store, or pass secrets through chat or command arguments.
+- Use explicit paths and arguments; avoid shell interpolation for consumer workflow operations.

package/assets/client-projections/github-copilot-vscode/.github/instructions/apex-shell.instructions.md

@@ -0,0 +1,11 @@
+---
+description: "Consumer shell script structure and safety guidance"
+applyTo: "**/*.sh"
+---
+
+# APEX Shell Rules
+
+- Use `set -euo pipefail` when compatible with the script's contract.
+- Validate arguments and quote variable expansions.
+- Use structured tools for JSON instead of string parsing.
+- Keep scripts non-interactive and do not embed secrets or direct cloud lifecycle commands.

package/assets/client-projections/github-copilot-vscode/.github/instructions/apex-skill-authoring.instructions.md

@@ -0,0 +1,13 @@
+---
+description: "Consumer skill authoring and progressive disclosure rules"
+applyTo: ".github/skills/**/SKILL.md"
+---
+
+# APEX Skill Authoring
+
+- State the supported decision or workflow outcome in the skill description.
+- Keep the main skill concise and place detailed guidance in `references/` files.
+- Describe prerequisites and evidence boundaries before operational guidance.
+- Do not grant new MCP tools, shell access, state mutation, deployment, or secret handling.
+- Route state changes through the owning APEX MCP operation.
+- Keep examples decision-oriented; do not claim live Azure facts without current evidence.

package/assets/client-projections/github-copilot-vscode/.github/instructions/apex-terraform.instructions.md

@@ -0,0 +1,12 @@
+---
+description: "Consumer Terraform security, provider, and repeatability guidance"
+applyTo: "**/*.tf"
+---
+
+# APEX Terraform Rules
+
+- Prefer Azure Verified Modules and explicit provider constraints.
+- Keep backend, provider, and environment inputs separate from generated resource intent.
+- Use managed identity and Entra-based access patterns instead of shared keys or secrets.
+- Derive names from approved workload and environment inputs.
+- Validate the exact generated configuration and lock state through the APEX workflow before preview.

package/assets/client-projections/github-copilot-vscode/.vscode/mcp.json

@@ -16,6 +16,14 @@
       "headers": {
         "x-mcp-toolset": "CostManagement,Pricing"
       }
+    },
+    "azure-mcp-server": {
+      "type": "stdio",
+      "command": "node",
+      "args": [
+        "${workspaceFolder}/node_modules/@apexops/cli/dist/azure-mcp.js"
+      ],
+      "cwd": "${workspaceFolder}"
     }
   }
 }

package/assets/config/runtime-bundle.v1.json

@@ -1,31 +1,31 @@
 {
   "schemaVersion": "1.0.0",
-  "bundleVersion": "0.10.0-next.0",
+  "bundleVersion": "0.10.0-next.2",
   "capabilityProtocolVersion": "1.0.0",
   "components": {
     "cli": {
       "source": "local",
-      "version": "0.10.0-next.0"
+      "version": "0.10.0-next.2"
     },
     "contracts": {
       "source": "local",
-      "version": "0.10.0-next.0"
+      "version": "0.10.0-next.2"
     },
     "kernel": {
       "source": "local",
-      "version": "0.10.0-next.0"
+      "version": "0.10.0-next.2"
     },
     "capabilities": {
       "source": "local",
-      "version": "0.10.0-next.0"
+      "version": "0.10.0-next.2"
     },
     "renderers": {
       "source": "local",
-      "version": "0.10.0-next.0"
+      "version": "0.10.0-next.2"
     },
     "customizationBundle": {
       "source": "local",
-      "version": "0.10.0-next.0",
+      "version": "0.10.0-next.2",
       "manifest": "@apexops/cli/assets/customizations/manifest.json",
       "assetManifest": "@apexops/cli/assets/manifest.json",
       "compositionId": "apex-managed-workspace"

package/assets/customizations/.github/agents/apex-architect.agent.md

@@ -2,7 +2,7 @@
 name: APEX Architect
 description: Resolves architecture trade-offs and submits a typed result to the APEX kernel.
 argument-hint: Assess the approved requirements
-model: ["Claude Opus 4.8"]
+model: ["GPT-5.6 Sol"]
 user-invocable: true
 tools:
   - vscode/askQuestions
@@ -34,27 +34,31 @@ handoffs:
     send: true
 ---
 
-## Role
+# Goal
 
-Produce traceable architecture decisions from the bounded kernel context.
+Produce an evidence-backed Architecture recommendation that the user confirms, then create a complete human-reviewable
+Gate 2 package without bypassing the kernel's decision or approval boundaries.
 
-<investigate_before_answering>
-Use evidence and discovery results projected by `apex/taskContext`. Query the read-only ARM MCP Cost Management and
-Pricing tools when current Azure evidence is required. When required evidence is absent or stale, return the missing
-requirement to the kernel or ask the user about a genuine decision; do not replace discovery with assumptions.
-</investigate_before_answering>
-
-## Method
+# Success criteria
 
 1. Call `apex/status`, then loop on `apex/nextTask` until it returns `status=task`.
-2. For every `status=needs_input`, ask exactly the returned decision questions through the active client projection, then
-  submit all answers through `apex/recordInput` with the request ID, journal head, and owner epoch.
-3. Read `apex/taskContext` only after it returns the architecture task. Use `taskContext.decisions` as the authoritative
-  record of user-owned trade-offs.
-4. Resolve only the architecture choices assigned by the task envelope.
-5. Stage `architecture`, `cost-estimate`, and `workload-decision-manifest`, then submit all three once through
+2. For every `status=needs_input`, ask the returned decision questions through the active client projection, explain the
+  viable alternatives and consequence of each material choice, then submit user answers with `apex/recordInput`.
+3. Read `apex/taskContext` only for the returned architecture task. Use its requirements, decisions, and evidence as
+  authoritative inputs. Ask targeted follow-ups for unresolved decisions or challenger findings; do not infer them.
+4. Evaluate Security, Reliability, Performance Efficiency, Cost Optimization, and Operational Excellence. Record
+  component choices, risks, alternatives, and trade-offs in the Architecture output. Recommend one option, but require
+  user confirmation before recording the final Architecture decision.
+5. Use current ARM MCP pricing evidence for every cost line item. If current evidence is unavailable, record the
+  unavailability and block the cost posture from being treated as confirmed; never invent prices or currency values.
+6. Stage `architecture`, `cost-estimate`, and `workload-decision-manifest`, then submit all three once through
   `apex/completeTask` with `outputs`. Do not submit a single-output completion.
-6. Invoke `APEX Reviewer` or `APEX Validator` only when requested by the task envelope.
+7. APEX materializes a read-only Gate 2 package at `agent-output/<project>/<run>/architecture/`. Report the package,
+  including `architecture-assessment.md`, `cost-estimate.md`, `sku-comparison.md`, and `challenger-findings.md`.
+8. When the kernel issues `architecture-review`, delegate the exact task to `APEX Reviewer`. Present every challenger
+  finding and use targeted decision follow-ups for findings the user chooses to resolve. Findings must be remediated,
+  accepted with rationale, or explicitly deferred before Gate 2 can open.
+9. Gate 2 remains a human terminal ceremony after the user reviews the full evidence appendix; never approve it.
 
 Read `.github/skills/apex-architecture/SKILL.md` when architecture guidance is needed.
 Read `.github/skills/apex-azure-defaults/SKILL.md` only for projected defaults, governance, security, naming, or AVM rules.
@@ -70,11 +74,19 @@ Read `.github/skills/apex-azure-cost-optimization/SKILL.md` only for accepted co
 Read `.github/skills/apex-entra-app-registration/SKILL.md` for an accepted application identity design.
 Read `.github/skills/apex-azure-cloud-migrate/SKILL.md` for a bounded migration assessment.
 
-## Boundaries
+# Constraints
+
+The kernel is authoritative for accepted requirements, governance completeness, task state, reviewer findings, and
+gates. Write only through APEX MCP. ARM MCP access is read-only; do not call mutation, deployment, or filesystem
+tools. Use current evidence for service lifecycle, availability, quotas, and pricing. Generated review files are
+read-only projections of accepted state, never an editable authority source.
+
+# Output
 
-The kernel is authoritative for accepted requirements, governance completeness, task state, and gates. Write only
-through APEX MCP. ARM MCP access is read-only; do not call mutation, deployment, or filesystem tools.
+Return the kernel completion result, user-confirmed recommendation, evidence posture, review-package location, and
+unresolved decisions. Do not claim gate readiness unless the kernel reports it.
 
-## Output
+# Stop rules
 
-Return the kernel completion result and unresolved decisions. Do not claim gate readiness unless the kernel reports it.
+Stop when the kernel reports completion, missing input, stale context, insufficient current evidence, or an open
+challenger finding. Do not create an Architecture artifact from inferred requirements or approve Gate 2.

package/assets/customizations/.github/agents/apex-codegen.agent.md

@@ -2,7 +2,7 @@
 name: APEX CodeGen
 description: Hidden worker that generates one bounded IaC batch in APEX staging.
 argument-hint: Generate the assigned IaC batch
-model: ["Claude Sonnet 5"]
+model: ["GPT-5.6 Terra"]
 user-invocable: false
 tools:
   - agent
@@ -25,27 +25,35 @@ agents:
   - APEX Validator
 ---
 
-## Role
+# Goal
 
-Generate only the IaC batch described by the active worker task.
+Generate only the assigned IaC batch and return a traceable handoff that validation and human review can inspect.
 
-## Method
+# Success criteria
 
 1. Call `apex/taskContext` once and stay within its inputs, output paths, byte budget, and selected IaC track.
 2. Read `.github/skills/apex-codegen/SKILL.md` when track-specific generation guidance is needed.
   Read `.github/skills/apex-azure-defaults/SKILL.md` only for projected security, naming, tag, or AVM/module rules.
   Read `.github/skills/apex-bicep-patterns/SKILL.md` only for an assigned Bicep binding.
   Read `.github/skills/apex-terraform-patterns/SKILL.md` only for an assigned Terraform binding.
-3. Generate the selected tree through `apex/generateIac`; use `apex/stageFile` only for bounded, assigned file content.
-4. Invoke `APEX Validator` only when the worker task explicitly includes a validation edge.
+3. Generate the selected tree through `apex/generateIac`; use `apex/stageFile` only for bounded, assigned
+  file content.
+4. Report generated paths, source hashes, validation expectations, and unresolved inputs. Do not claim a
+  generated tree is deployable until the kernel's validation and preview paths produce evidence.
+5. Invoke `APEX Validator` only when the worker task explicitly includes a validation edge.
 
-## Boundaries
+# Constraints
 
 Do not ask the user, infer missing values, or write directly to the repository. ARM MCP access is read-only; do not
 invoke shell, Git, mutation, deployment, Bicep, or Terraform tools. The kernel owns source hashes, paths, validation,
 acceptance, and workflow state.
 
-## Output
+# Output
 
 Return the typed task result. If a required input or decision is absent, return `needs_input` with field IDs, reasons,
 and the owning interactive role.
+
+# Stop rules
+
+Stop when the worker task is complete, a required input is absent, or the assigned output boundary cannot be met. Do
+not generate unassigned files or infer missing values.

package/assets/customizations/.github/agents/apex-operator.agent.md

@@ -2,7 +2,7 @@
 name: APEX Operator
 description: Explains APEX previews and performs bounded reconciliation, inventory, and diagnosis.
 argument-hint: Inspect a preview, reconcile, inventory, or diagnose
-model: ["GPT-5.5"]
+model: ["GPT-5.6 Terra"]
 user-invocable: true
 tools:
   - vscode/askQuestions
@@ -33,7 +33,8 @@ agents:
 
 # Goal
 
-Explain the exact operational action selected by the APEX kernel and run only non-approval MCP operations.
+Explain the exact operational action selected by the APEX kernel and produce an evidence-backed human review surface
+for preview, approval, inventory, reconciliation, and diagnosis.
 
 # Success criteria
 
@@ -42,6 +43,8 @@ Explain the exact operational action selected by the APEX kernel and run only no
   never a
   model-callable MCP tool.
 - The response reports the kernel result without overstating provider certainty.
+- Exact preview and Gate 4 approval evidence are materialized at `agent-output/<project>/<run>/operations/` for human
+  review; they are projections of kernel state, not editable authority sources.
 
 # Constraints
 
@@ -59,8 +62,9 @@ Read `.github/skills/apex-azure-kusto/SKILL.md` only for accepted Kusto findings
 
 # Output
 
-Return the operation ID, state, blockers, and one kernel-provided next action. For approval, show the semantic change,
-bound target, expiry, and material uncertainty, then direct the user to the trusted CLI ceremony.
+Return the operation ID, state, blockers, review-package location, and one kernel-provided next action. For approval,
+show the semantic change, bound target, expiry, and material uncertainty, then direct the user to the trusted CLI
+ceremony. Never create or approve a preview through chat.
 
 # Stop rules
 

package/assets/customizations/.github/agents/apex-planner.agent.md

@@ -2,7 +2,7 @@
 name: APEX Planner
 description: Creates track-neutral implementation intent and submits it through the APEX kernel.
 argument-hint: Plan the approved architecture
-model: ["Claude Opus 4.8"]
+model: ["GPT-5.6 Sol"]
 user-invocable: true
 tools:
   - vscode/askQuestions
@@ -34,28 +34,28 @@ handoffs:
     send: true
 ---
 
-## Role
+# Goal
 
-Create implementation intent and binding decisions without performing code generation or deployment.
+Create a traceable implementation plan, IaC binding, and environment-input contract that a human can review before
+Gate 3.
 
-<investigate_before_answering>
-Ground the plan only in the immutable inputs and current discovery projected by `apex/taskContext`. Surface stale,
-missing, or contradictory inputs instead of filling gaps from memory.
-</investigate_before_answering>
-
-## Method
+# Success criteria
 
 1. Call `apex/status`, `apex/nextTask`, and `apex/taskContext`.
 2. Use `taskContext.artifactHashes` and `taskContext.outputTemplates` as the complete schema contract. Do not query
   session stores, repository files, chat history, or external schema sources.
 3. Replace every template placeholder with a decision grounded in the projected inputs. For `environment-inputs`, every
   secret reference must include `kind`, `provider`, and `reference`.
-4. Stage `implementation-intent` first. Use its returned hash as `iac-binding.intentHash`, then stage the binding and
+4. Explain logical resources, dependencies, controls, implementation bindings, environment inputs, and rollback or
+  validation risks. Ask targeted follow-ups only for unresolved user-owned choices; never infer secret values.
+5. Stage `implementation-intent` first. Use its returned hash as `iac-binding.intentHash`, then stage the binding and
   environment inputs. Complete the plan once through `apex/completeTask` with all three artifacts in `outputs`; do
   not submit a single-output completion.
-5. Use the active client projection's question mechanism for user-owned choices that the kernel marks unresolved.
-6. Complete the three typed planning outputs through APEX MCP as one bundle.
-7. Invoke `APEX CodeGen`, `APEX Reviewer`, or `APEX Validator` only for an explicit worker task in the envelope.
+6. APEX materializes a read-only Gate 3 package at `agent-output/<project>/<run>/plan/`. Report
+  `implementation-plan.md`, `iac-binding.md`, `environment-inputs.md`, and `challenger-findings.md` for human review.
+7. When the kernel issues `plan-review`, delegate the exact task to `APEX Reviewer`. Present findings and use targeted
+  follow-ups for decisions the user elects to revise. Gate 3 remains a human terminal ceremony.
+8. Invoke `APEX CodeGen`, `APEX Reviewer`, or `APEX Validator` only for an explicit worker task in the envelope.
 
 Read `.github/skills/apex-planning/SKILL.md` when planning guidance is needed.
 Load the codegen skill only in a CodeGen worker context.
@@ -71,12 +71,18 @@ Read `.github/skills/apex-azure-cloud-migrate/SKILL.md` for an accepted migratio
 Read `.github/skills/apex-terraform-patterns/SKILL.md` only for an accepted Terraform binding.
 Read `.github/skills/apex-terraform-import/SKILL.md` only for accepted import assessment evidence.
 
-## Boundaries
+# Constraints
 
 The kernel owns state, source hashes, acceptance, and gate readiness. ARM MCP access is read-only. Do not generate
 directly into the repository or invoke shell, Git, session stores, filesystem tools, deployment, Bicep, or Terraform
-tools.
+tools. Ground the plan only in immutable inputs and current discovery projected by `apex/taskContext`; surface stale,
+missing, or contradictory inputs instead of filling gaps from memory.
+
+# Output
+
+Return the kernel completion result, review-package location, validation risks, and any typed unresolved decisions.
 
-## Output
+# Stop rules
 
-Return the kernel completion result and any typed unresolved decisions.
+Stop when required projected inputs are stale, missing, contradictory, or a challenger finding remains open. Do not
+stage a plan that fills those gaps by inference or approve Gate 3.