@apexops/cli 0.10.0-next.0 → 0.10.0-next.2

package/dist/azure-mcp-environment.d.ts

@@ -0,0 +1,2 @@
+export declare function azureMcpEnvironment(environment: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+//# sourceMappingURL=azure-mcp-environment.d.ts.map

package/dist/azure-mcp-environment.js

@@ -0,0 +1,7 @@
+export function azureMcpEnvironment(environment) {
+    return {
+        ...environment,
+        DOTNET_SYSTEM_GLOBALIZATION_INVARIANT: environment.DOTNET_SYSTEM_GLOBALIZATION_INVARIANT ?? "1",
+    };
+}
+//# sourceMappingURL=azure-mcp-environment.js.map

package/dist/azure-mcp.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=azure-mcp.d.ts.map

package/dist/azure-mcp.js

@@ -0,0 +1,21 @@
+import { spawn } from "node:child_process";
+import { createRequire } from "node:module";
+import process from "node:process";
+import { azureMcpEnvironment } from "./azure-mcp-environment.js";
+const require = createRequire(import.meta.url);
+const azureMcpEntrypoint = require.resolve("@azure/mcp");
+const child = spawn(process.execPath, [azureMcpEntrypoint, "server", "start"], {
+    stdio: "inherit",
+    env: azureMcpEnvironment(process.env),
+});
+child.on("error", (error) => {
+    process.stderr.write(`${error.message}\n`);
+    process.exitCode = 1;
+});
+child.on("exit", (code, signal) => {
+    if (signal !== null)
+        process.kill(process.pid, signal);
+    else
+        process.exitCode = code ?? 1;
+});
+//# sourceMappingURL=azure-mcp.js.map

package/dist/cli.js

@@ -426,6 +426,9 @@ export async function execute(argv, root = process.cwd(), options = {}) {
                 ...(typeof flags.target === "string" ? { targetScope: flags.target } : {}),
                 iacTool: flags.iac === "terraform" ? "terraform" : "bicep",
             });
+        case "project delete":
+            confirmed(flags, "project delete");
+            return service.deleteProject(required(flags, "project"), true);
         case "project use":
             return service.use(required(flags, "project"), typeof flags.run === "string" ? flags.run : undefined);
         case "project show":

package/dist/mcp.js

@@ -53,6 +53,18 @@ const inputSubmission = z
         .min(1),
 })
     .strict();
+const projectCreateInput = z
+    .object({
+    projectId: z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/),
+    displayName: z.string().min(1).max(256),
+    environment: z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/),
+    targetScope: z.string().min(1).max(1024).optional(),
+    iacTool: z.enum(["bicep", "terraform"]),
+})
+    .strict();
+const projectIdInput = z.object({ projectId: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/) }).strict();
+const projectUseInput = projectIdInput.extend({ runId: z.string().min(1).optional() });
+const projectDeleteInput = projectIdInput.extend({ confirm: z.literal(true) });
 const normalizeOutputs = (outputs) => outputs.map(({ kind, value, summary }) => ({
     kind,
     value,
@@ -75,6 +87,16 @@ export function createMcpServer(service) {
         inputSchema: { taskId: z.string() },
     }, async ({ taskId }) => result(await service.taskContext(taskId)));
     server.registerTool("recordInput", { description: "Record answers for the exact pending kernel input request", inputSchema: inputSubmission }, async (input) => result(await service.recordInput(input)));
+    server.registerTool("projectCreate", {
+        description: "Create and select a new project with its initial environment run",
+        inputSchema: projectCreateInput,
+    }, async (input) => result(await service.createProject(input)));
+    server.registerTool("projectList", { description: "List projects in the current workspace" }, async () => result({ projects: await service.listProjects() }));
+    server.registerTool("projectUse", { description: "Select an existing project and optionally one of its runs", inputSchema: projectUseInput }, async ({ projectId, runId }) => result(await service.use(projectId, runId)));
+    server.registerTool("projectDelete", {
+        description: "Delete a project and all of its run-bound state after explicit confirmation",
+        inputSchema: projectDeleteInput,
+    }, async ({ projectId, confirm }) => result(await service.deleteProject(projectId, confirm)));
     server.registerTool("stageArtifact", {
         inputSchema: {
             taskId: z.string(),

package/dist/service.d.ts

@@ -88,6 +88,13 @@ declare const ARTIFACTS: {
         }>>;
         assumptions: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
         unknowns: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+        businessContext: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        successCriteria: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        nonFunctionalRequirements: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        securityAndCompliance: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        budgetAndOperations: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        regionalConstraints: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        architectureHandoff: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     }>];
     readonly "workload-decision-manifest": readonly ["workload-decision-manifest", import("@sinclair/typebox").TObject<{
         schemaVersion: import("@sinclair/typebox").TLiteral<"1.0.0">;
@@ -579,6 +586,10 @@ export declare class ApexService {
         projectId: string;
         displayName: string;
     }>>;
+    deleteProject(projectId: ProjectId, confirmed: boolean): Promise<{
+        deleted: ProjectId;
+        selected?: Selection;
+    }>;
     use(projectId: ProjectId, runId?: RunId): Promise<Selection>;
     show(projectId?: ProjectId): Promise<unknown>;
     search(term: string, limit?: number): Promise<Array<{
@@ -649,6 +660,18 @@ export declare class ApexService {
     }>;
     private acceptTaskOutputs;
     private renderRequirementsDocument;
+    private requirementsReviewDirectory;
+    private reviewMarkdownText;
+    private materializeRequirementsReviewPackage;
+    private materializeRequirementsChallengeFindings;
+    private architectureReviewDirectory;
+    private materializeArchitectureReviewPackage;
+    private materializeArchitectureChallengeFindings;
+    private planReviewDirectory;
+    private materializePlanReviewPackage;
+    private materializePlanChallengeFindings;
+    private materializeReviewerSummary;
+    private materializeValidationReport;
     private requirementsDocumentMarkdown;
     private requirementsDocumentTemplateContent;
     cancelTask(taskId: string): Promise<void>;
@@ -656,6 +679,9 @@ export declare class ApexService {
     private assertReviewResolution;
     decideGateNumber(gateNumber: number, decision: "approved" | "rejected", actor: string, options?: GateDecisionOptions): Promise<ApprovalEvidenceV1>;
     preview(options: PreviewOptions): Promise<DeploymentPreviewV1>;
+    private operationsReviewDirectory;
+    private materializeOperationsPreviewPackage;
+    private materializeOperationsApprovalPackage;
     currentPreview(): Promise<string>;
     currentApproval(): Promise<ApprovalEvidenceV1>;
     deploy(expectedPreviewHash?: string): Promise<{

package/dist/service.js

@@ -111,7 +111,20 @@ const REQUIREMENTS_INTAKE = [
         round: "business-discovery",
         questions: [
             { id: "workload", prompt: "Briefly describe the workload and its users." },
-            { id: "industry", prompt: "Which industry or domain does this workload serve?" },
+            {
+                id: "industry",
+                prompt: "Choose the industry or domain that best fits the workload.",
+                options: [
+                    "financial-services",
+                    "healthcare",
+                    "retail",
+                    "public-sector",
+                    "manufacturing",
+                    "education",
+                    "technology",
+                    "other",
+                ],
+            },
             {
                 id: "delivery-scenario",
                 prompt: "Is this a greenfield build, migration, modernization, or extension?",
@@ -139,6 +152,7 @@ const REQUIREMENTS_INTAKE = [
             {
                 id: "data-sensitivity",
                 prompt: "Choose the data classification or explicitly defer it.",
+                options: ["public", "internal", "confidential", "restricted"],
                 valueType: "data-classification",
             },
             { id: "iac-preference", prompt: "Choose the preferred infrastructure tool.", options: ["bicep", "terraform"] },
@@ -151,7 +165,22 @@ const REQUIREMENTS_INTAKE = [
             { id: "prohibited-services", prompt: "List prohibited services or use 'none'." },
             {
                 id: "service-preferences",
-                prompt: "State preferred compute, database, integration, and observability services.",
+                prompt: "Select preferred Azure services. Select all that apply; architecture chooses the exact combination.",
+                options: [
+                    "app-service",
+                    "container-apps",
+                    "azure-functions",
+                    "aks",
+                    "azure-sql",
+                    "azure-cosmos-db",
+                    "storage",
+                    "service-bus",
+                    "event-hubs",
+                    "api-management",
+                    "azure-monitor",
+                    "application-insights",
+                ],
+                multiSelect: true,
             },
             { id: "sku-preferences", prompt: "State required SKUs, tier floors, reservations, or use 'no preference'." },
             { id: "environment-overrides", prompt: "State environment-specific service or sizing overrides, or 'none'." },
@@ -162,22 +191,49 @@ const REQUIREMENTS_INTAKE = [
         questions: [
             {
                 id: "compliance",
-                prompt: "List compliance and regulatory scopes or explicitly defer them.",
+                prompt: "Select applicable compliance and regulatory scopes, or explicitly defer them.",
+                options: ["gdpr", "hipaa", "pci-dss", "iso-27001", "soc-2", "other"],
+                multiSelect: true,
                 valueType: "compliance",
             },
             {
                 id: "security-controls",
-                prompt: "List required identity, network, encryption, and secret-management controls.",
+                prompt: "Select required security controls. The Azure baseline recommends managed identity, private access, Key Vault, and diagnostic logging.",
+                options: [
+                    "managed-identity",
+                    "private-endpoints",
+                    "private-dns",
+                    "disable-public-network-access",
+                    "key-vault",
+                    "platform-managed-encryption",
+                    "customer-managed-keys",
+                    "diagnostic-logging",
+                ],
+                multiSelect: true,
+            },
+            {
+                id: "authentication",
+                prompt: "Select the required authentication and authorization mechanisms.",
+                options: ["microsoft-entra-id", "managed-identity", "external-oidc", "api-key", "anonymous"],
+                multiSelect: true,
+            },
+            {
+                id: "region",
+                prompt: "Choose the Azure region, or explicitly defer the decision.",
+                options: ["swedencentral", "westeurope", "germanywestcentral"],
             },
-            { id: "authentication", prompt: "Describe authentication and authorization requirements." },
-            { id: "region", prompt: "State the required Azure region or use 'deferred: <owner>'." },
             { id: "availability-recovery", prompt: "State availability, RTO, RPO, backup, and recovery requirements." },
             {
                 id: "recovery",
                 prompt: "Provide RTO and RPO in whole minutes or explicitly defer them.",
                 valueType: "recovery",
             },
-            { id: "operations", prompt: "State monitoring, alerting, support, and operational requirements." },
+            {
+                id: "operations",
+                prompt: "Select operational capabilities required for the workload.",
+                options: ["azure-monitor", "application-insights", "log-analytics", "managed-alerts", "24x7-support"],
+                multiSelect: true,
+            },
         ],
     },
 ];
@@ -536,6 +592,45 @@ export class ApexService {
         const projects = await Promise.all(names.sort().map(async (projectId) => this.projects.getProject(projectId)));
         return projects.map(({ projectId, displayName }) => ({ projectId, displayName }));
     }
+    async deleteProject(projectId, confirmed) {
+        if (!confirmed)
+            throw new ApexError("APEX_USAGE", "project deletion requires explicit confirmation", EXIT_CODES.usage);
+        const projects = await this.listProjects();
+        if (!projects.some((project) => project.projectId === projectId)) {
+            throw new ApexError("APEX_NOT_FOUND", `Project not found: ${projectId}`, EXIT_CODES.notFound);
+        }
+        if (projects.length <= 1) {
+            throw new ApexError("APEX_CONFLICT", "Cannot delete the only project in a workspace", EXIT_CODES.conflict);
+        }
+        const selection = await this.selection();
+        const nextSelection = selection.projectId !== projectId
+            ? undefined
+            : await (async () => {
+                const replacement = projects.find((project) => project.projectId !== projectId);
+                const replacementProjectId = replacement.projectId;
+                const runId = await this.latestRun(replacementProjectId);
+                await this.projects.getRun(replacementProjectId, runId);
+                return { projectId: replacementProjectId, runId };
+            })();
+        const projectDirectory = this.projects.projectDirectory(projectId);
+        await this.assertSafeExistingPath(join(this.root, ".apex"), projectDirectory);
+        const runDirectory = join(projectDirectory, "runs");
+        await this.assertSafeExistingPath(projectDirectory, runDirectory);
+        const runIds = await readdir(runDirectory);
+        for (const runId of runIds) {
+            const workDirectory = join(this.root, ".apex", "work", runId);
+            if (await this.pathExistsLstat(workDirectory)) {
+                await this.assertSafeExistingPath(join(this.root, ".apex"), workDirectory);
+                await rm(workDirectory, { recursive: true, force: true });
+            }
+        }
+        await rm(projectDirectory, { recursive: true, force: true });
+        if (nextSelection === undefined)
+            return { deleted: projectId };
+        await this.writeSelection(nextSelection);
+        await this.append(await this.run(nextSelection), "selection.changed", nextSelection);
+        return { deleted: projectId, selected: nextSelection };
+    }
     async use(projectId, runId) {
         await this.projects.getProject(projectId);
         const selectedRun = runId ?? (await this.latestRun(projectId));
@@ -983,6 +1078,42 @@ export class ApexService {
                 }),
             legacy,
         });
+        if (descriptor.id === "requirements" && renderedDocument !== undefined) {
+            await this.materializeRequirementsReviewPackage(run, requirementsOutput.value, renderedDocument.outputHash, events);
+        }
+        if (descriptor.id === "requirements-review") {
+            await this.materializeRequirementsChallengeFindings(run, outputs[0].value);
+        }
+        if (descriptor.id === "architecture") {
+            const architectureOutput = outputs.find(({ kind }) => kind === "architecture");
+            const costOutput = outputs.find(({ kind }) => kind === "cost-estimate");
+            const decisionsOutput = outputs.find(({ kind }) => kind === "workload-decision-manifest");
+            if (architectureOutput === undefined || costOutput === undefined || decisionsOutput === undefined) {
+                throw new ApexError("APEX_INTERNAL", "Architecture review package is missing an accepted output", EXIT_CODES.internal);
+            }
+            await this.materializeArchitectureReviewPackage(run, architectureOutput.value, costOutput.value, decisionsOutput.value, outputHashes);
+        }
+        if (descriptor.id === "architecture-review") {
+            await this.materializeArchitectureChallengeFindings(run, outputs[0].value);
+        }
+        if (descriptor.id === "plan") {
+            const intentOutput = outputs.find(({ kind }) => kind === "implementation-intent");
+            const bindingOutput = outputs.find(({ kind }) => kind === "iac-binding");
+            const inputsOutput = outputs.find(({ kind }) => kind === "environment-inputs");
+            if (intentOutput === undefined || bindingOutput === undefined || inputsOutput === undefined) {
+                throw new ApexError("APEX_INTERNAL", "Planner review package is missing an accepted output", EXIT_CODES.internal);
+            }
+            await this.materializePlanReviewPackage(run, intentOutput.value, bindingOutput.value, inputsOutput.value, outputHashes);
+        }
+        if (descriptor.id === "plan-review") {
+            await this.materializePlanChallengeFindings(run, outputs[0].value);
+        }
+        if (descriptor.reviewSubject !== undefined) {
+            await this.materializeReviewerSummary(run, descriptor.reviewSubject, outputs[0].value);
+        }
+        if (descriptor.id === "validation-bicep" || descriptor.id === "validation-terraform") {
+            await this.materializeValidationReport(run, outputs[0].value, descriptor.id);
+        }
         if (descriptor.reviewSubject !== undefined) {
             if (reviewBlockers.length === 0 && descriptor.gate !== undefined) {
                 await this.openRunGate(await this.currentRun(), descriptor.gate, dependencyHash);
@@ -1002,6 +1133,172 @@ export class ApexService {
             outputHash: await this.objects.putJson({ contentType: "text/markdown", content }),
         };
     }
+    requirementsReviewDirectory(run) {
+        return join(this.root, "agent-output", run.projectId, run.runId);
+    }
+    reviewMarkdownText(value) {
+        return value.replaceAll("\\", "\\\\").replaceAll("|", "\\|").replaceAll("\r\n", "\n").replaceAll("\n", "<br>");
+    }
+    async materializeRequirementsReviewPackage(run, requirements, requirementsDocumentHash, events) {
+        const directory = this.requirementsReviewDirectory(run);
+        const document = await this.objects.getJson(requirementsDocumentHash);
+        if (document.contentType !== "text/markdown") {
+            throw new ApexError("APEX_INTERNAL", "Requirements review document is invalid", EXIT_CODES.internal);
+        }
+        const input = this.recordedRequirementsInput(events) ?? {};
+        const text = (value) => {
+            if (value === undefined)
+                return "Deferred";
+            if (typeof value === "string")
+                return this.reviewMarkdownText(value);
+            if (Array.isArray(value))
+                return value.map((item) => this.reviewMarkdownText(item)).join(", ");
+            if (value.kind === "budget")
+                return `${value.amount} ${this.reviewMarkdownText(value.currency)} monthly`;
+            if (value.kind === "recovery")
+                return `RTO ${value.rtoMinutes} minutes; RPO ${value.rpoMinutes} minutes`;
+            if (value.kind === "data-classification")
+                return this.reviewMarkdownText(value.classification);
+            if (value.kind === "compliance")
+                return value.scopes.map((scope) => this.reviewMarkdownText(scope)).join(", ");
+            return value.kind === "deferred" ? `Deferred to ${this.reviewMarkdownText(value.owner)}` : "Unknown";
+        };
+        const list = (value) => {
+            if (!Array.isArray(value) || value.length === 0)
+                return "- None recorded.";
+            return value.map((item) => `- ${this.reviewMarkdownText(item)}`).join("\n");
+        };
+        await mkdir(directory, { recursive: true });
+        await Promise.all([
+            atomicWriteBytes(join(directory, "01-requirements.md"), Buffer.from(document.content, "utf8")),
+            atomicWriteBytes(join(directory, "README.md"), Buffer.from(`# ${this.reviewMarkdownText(run.projectId)}\n\nGenerated Gate 1 review package for run \`${this.reviewMarkdownText(run.runId)}\`. The APEX kernel state remains authoritative.\n\n- Environment: ${this.reviewMarkdownText(run.environment)}\n- Business context: ${this.reviewMarkdownText(requirements.businessContext ?? "Deferred")}\n- Requirements document hash: ${requirementsDocumentHash}\n- Review status: challenger findings pending\n`, "utf8")),
+            atomicWriteBytes(join(directory, "service-recommendations.md"), Buffer.from(`# Service Recommendations\n\nThese are user-reviewed candidate services, not Architecture decisions.\n\n## Candidate Services\n${list(input["service-preferences"])}\n\n## Recommendation Rationale\n${this.reviewMarkdownText(requirements.architectureHandoff ?? "Architecture must evaluate the candidate services against approved requirements and current evidence.")}\n\n## Constraints\n- Retained services: ${text(input["retained-services"])}\n- Prohibited services: ${text(input["prohibited-services"])}\n- Environment overrides: ${text(input["environment-overrides"])}\n\nArchitecture must validate candidates against approved requirements, governance, and current evidence.\n`, "utf8")),
+            atomicWriteBytes(join(directory, "sku-preferences.md"), Buffer.from(`# SKU Preferences\n\nUser constraints only. Architecture owns SKU selection.\n\n- Preference: ${text(input["sku-preferences"])}\n- Budget posture: ${text(input.budget)}\n- Scale: ${text(input.scale)}\n`, "utf8")),
+            atomicWriteBytes(join(directory, "challenger-findings.md"), Buffer.from("# Challenger Findings\n\nRequirements challenger review is pending. Gate 1 cannot be approved until the reviewer completes this document.\n", "utf8")),
+        ]);
+    }
+    async materializeRequirementsChallengeFindings(run, review) {
+        const findings = review.findings.length === 0
+            ? "No challenger findings remain open."
+            : review.findings
+                .map(({ id, severity, title, detail, resolution }) => `## ${this.reviewMarkdownText(id)}: ${this.reviewMarkdownText(title)}\n\n- Severity: ${this.reviewMarkdownText(severity)}\n- Finding: ${this.reviewMarkdownText(detail)}${resolution === undefined ? "" : `\n- Resolution: ${this.reviewMarkdownText(resolution)}`}`)
+                .join("\n\n");
+        await atomicWriteBytes(join(this.requirementsReviewDirectory(run), "challenger-findings.md"), Buffer.from(`# Challenger Findings\n\n${findings}\n`, "utf8"));
+    }
+    architectureReviewDirectory(run) {
+        return join(this.root, "agent-output", run.projectId, run.runId, "architecture");
+    }
+    async materializeArchitectureReviewPackage(run, architecture, cost, decisions, hashes) {
+        const directory = this.architectureReviewDirectory(run);
+        const list = (items) => items.length === 0 ? "- None." : items.map((item) => `- ${this.reviewMarkdownText(item)}`).join("\n");
+        const table = (headers, rows) => [
+            `| ${headers.join(" | ")} |`,
+            `| ${headers.map(() => "---").join(" | ")} |`,
+            ...rows.map((row) => `| ${row.join(" | ")} |`),
+        ].join("\n");
+        const costRows = cost.lineItems.map((item) => [
+            this.reviewMarkdownText(item.service),
+            this.reviewMarkdownText(item.sku),
+            String(item.quantity),
+            `${item.monthlyCost.toFixed(2)} ${this.reviewMarkdownText(cost.currency)}`,
+            this.reviewMarkdownText(item.uncertainty.confidence),
+        ]);
+        const skuRows = decisions.skuDecisions.map((decision) => [
+            this.reviewMarkdownText(decision.logicalId),
+            this.reviewMarkdownText(decision.service),
+            this.reviewMarkdownText(decision.sku),
+            String(decision.quantity),
+            this.reviewMarkdownText(decision.rationale),
+        ]);
+        await mkdir(directory, { recursive: true });
+        await Promise.all([
+            atomicWriteBytes(join(directory, "README.md"), Buffer.from(`# ${this.reviewMarkdownText(architecture.title)}\n\nGenerated Gate 2 review package for run \`${this.reviewMarkdownText(run.runId)}\`. The APEX kernel state remains authoritative.\n\n- Architecture hash: ${hashes.architecture}\n- Cost estimate hash: ${hashes["cost-estimate"]}\n- Decision manifest hash: ${hashes["workload-decision-manifest"]}\n- Review status: challenger findings pending\n`, "utf8")),
+            atomicWriteBytes(join(directory, "architecture-assessment.md"), Buffer.from(`# Architecture Assessment\n\n## Summary\n\n${this.reviewMarkdownText(architecture.summary)}\n\n## Components\n\n${table(["ID", "Service", "Purpose", "Requirements"], architecture.components.map((component) => [
+                this.reviewMarkdownText(component.id),
+                this.reviewMarkdownText(component.service),
+                this.reviewMarkdownText(component.purpose),
+                component.requirementIds.map((id) => this.reviewMarkdownText(id)).join(", "),
+            ]))}\n\n## Five WAF Pillars\n\n### Security\n\n${list(architecture.decisions)}\n\n### Reliability\n\n${list(decisions.sloDecisions.map((decision) => `${decision.logicalId}: ${decision.availabilityPercent}% availability, RTO ${decision.rtoMinutes}m, RPO ${decision.rpoMinutes}m`))}\n\n### Performance Efficiency\n\n- Review component capacity and scale decisions in the SKU comparison.\n\n### Cost Optimization\n\n- Review the current evidence-backed cost estimate.\n\n### Operational Excellence\n\n${list(architecture.risks)}\n\n## Alternatives And Trade-offs\n\nUser-confirmed decisions:\n${list(architecture.decisions)}\n\n## Risks\n\n${list(architecture.risks)}\n`, "utf8")),
+            atomicWriteBytes(join(directory, "cost-estimate.md"), Buffer.from(`# Cost Estimate\n\n- Pricing date: ${this.reviewMarkdownText(cost.pricingDate)}\n- Monthly total: ${cost.totalMonthlyCost.toFixed(2)} ${this.reviewMarkdownText(cost.currency)}\n\n## Line Items\n\n${table(["Service", "SKU", "Quantity", "Monthly", "Confidence"], costRows)}\n\n## Evidence Appendix\n\n${cost.lineItems.map((item) => `- ${this.reviewMarkdownText(item.service)} / ${this.reviewMarkdownText(item.sku)}: ${this.reviewMarkdownText(item.source.provider)} — ${this.reviewMarkdownText(item.source.uri)} — retrieved ${this.reviewMarkdownText(item.source.retrievedAt)}; uncertainty ${this.reviewMarkdownText(item.uncertainty.basis)}`).join("\n")}\n\n## Assumptions\n\n${list(cost.assumptions)}\n`, "utf8")),
+            atomicWriteBytes(join(directory, "sku-comparison.md"), Buffer.from(`# SKU Comparison\n\n${table(["Logical ID", "Service", "Selected SKU", "Quantity", "Rationale"], skuRows)}\n\nThese are user-confirmed Architecture decisions. Alternatives and rejected options must be recorded in the architecture assessment before Gate 2 approval.\n`, "utf8")),
+            atomicWriteBytes(join(directory, "challenger-findings.md"), Buffer.from("# Challenger Findings\n\nArchitecture challenger review is pending. Gate 2 cannot be approved until the reviewer completes this document.\n", "utf8")),
+        ]);
+    }
+    async materializeArchitectureChallengeFindings(run, review) {
+        const findings = review.findings.length === 0
+            ? "No challenger findings remain open."
+            : review.findings
+                .map(({ id, severity, title, detail, resolution }) => `## ${this.reviewMarkdownText(id)}: ${this.reviewMarkdownText(title)}\n\n- Severity: ${this.reviewMarkdownText(severity)}\n- Finding: ${this.reviewMarkdownText(detail)}${resolution === undefined ? "" : `\n- Resolution: ${this.reviewMarkdownText(resolution)}`}`)
+                .join("\n\n");
+        await atomicWriteBytes(join(this.architectureReviewDirectory(run), "challenger-findings.md"), Buffer.from(`# Challenger Findings\n\n${findings}\n`, "utf8"));
+    }
+    planReviewDirectory(run) {
+        return join(this.root, "agent-output", run.projectId, run.runId, "plan");
+    }
+    async materializePlanReviewPackage(run, intent, binding, inputs, hashes) {
+        const directory = this.planReviewDirectory(run);
+        const table = (headers, rows) => [
+            `| ${headers.join(" | ")} |`,
+            `| ${headers.map(() => "---").join(" | ")} |`,
+            ...rows.map((row) => `| ${row.join(" | ")} |`),
+        ].join("\n");
+        const resourceRows = intent.resources.map((resource) => [
+            this.reviewMarkdownText(resource.id),
+            this.reviewMarkdownText(resource.type),
+            this.reviewMarkdownText(resource.purpose),
+            resource.dependsOn.map((dependency) => this.reviewMarkdownText(dependency)).join(", "),
+            resource.controls.map((control) => this.reviewMarkdownText(control)).join(", "),
+        ]);
+        const bindingRows = Object.entries(binding.resourceBindings).map(([id, value]) => [
+            this.reviewMarkdownText(id),
+            this.reviewMarkdownText(value.implementation),
+            this.reviewMarkdownText(value.version),
+            this.reviewMarkdownText(JSON.stringify(value.parameters)),
+        ]);
+        const inputRows = Object.entries(inputs.inputs).map(([name, value]) => [
+            this.reviewMarkdownText(name),
+            value.kind === "value" ? "value" : "secret-reference",
+            this.reviewMarkdownText(value.kind === "value" ? String(value.value) : `${value.provider}:${value.reference}`),
+        ]);
+        await mkdir(directory, { recursive: true });
+        await Promise.all([
+            atomicWriteBytes(join(directory, "README.md"), Buffer.from(`# Implementation Plan\n\nGenerated Gate 3 review package for run \`${this.reviewMarkdownText(run.runId)}\`. The APEX kernel state remains authoritative.\n\n- Intent hash: ${hashes["implementation-intent"]}\n- Binding hash: ${hashes["iac-binding"]}\n- Environment input hash: ${hashes["environment-inputs"]}\n- Review status: challenger findings pending\n`, "utf8")),
+            atomicWriteBytes(join(directory, "implementation-plan.md"), Buffer.from(`# Implementation Plan\n\n## Logical Resources\n\n${table(["ID", "Type", "Purpose", "Depends On", "Controls"], resourceRows)}\n\n## Outputs\n\n${intent.outputs.map((output) => `- ${this.reviewMarkdownText(output)}`).join("\n")}\n\n## Source Artifacts\n\n${Object.entries(intent.sourceHashes)
+                .map(([kind, hash]) => `- ${this.reviewMarkdownText(kind)}: ${hash}`)
+                .join("\n")}\n`, "utf8")),
+            atomicWriteBytes(join(directory, "iac-binding.md"), Buffer.from(`# IaC Binding\n\n- Track: ${this.reviewMarkdownText(binding.track)}\n- Intent hash: ${binding.intentHash}\n\n${table(["Logical ID", "Implementation", "Version", "Parameters"], bindingRows)}\n`, "utf8")),
+            atomicWriteBytes(join(directory, "environment-inputs.md"), Buffer.from(`# Environment Inputs\n\n- Environment: ${this.reviewMarkdownText(inputs.environment)}\n\n${table(["Name", "Kind", "Reference or Value"], inputRows)}\n`, "utf8")),
+            atomicWriteBytes(join(directory, "challenger-findings.md"), Buffer.from("# Challenger Findings\n\nImplementation-plan challenger review is pending. Gate 3 cannot be approved until the reviewer completes this document.\n", "utf8")),
+        ]);
+    }
+    async materializePlanChallengeFindings(run, review) {
+        const findings = review.findings.length === 0
+            ? "No challenger findings remain open."
+            : review.findings
+                .map(({ id, severity, title, detail, resolution }) => `## ${this.reviewMarkdownText(id)}: ${this.reviewMarkdownText(title)}\n\n- Severity: ${this.reviewMarkdownText(severity)}\n- Finding: ${this.reviewMarkdownText(detail)}${resolution === undefined ? "" : `\n- Resolution: ${this.reviewMarkdownText(resolution)}`}`)
+                .join("\n\n");
+        await atomicWriteBytes(join(this.planReviewDirectory(run), "challenger-findings.md"), Buffer.from(`# Challenger Findings\n\n${findings}\n`, "utf8"));
+    }
+    async materializeReviewerSummary(run, subject, review) {
+        const findings = review.findings.length === 0
+            ? "No findings remain open."
+            : review.findings
+                .map(({ id, severity, disposition, title, detail, evidenceRefs, resolution }) => `## ${this.reviewMarkdownText(id)}: ${this.reviewMarkdownText(title)}\n\n- Severity: ${this.reviewMarkdownText(severity)}\n- Disposition: ${this.reviewMarkdownText(disposition)}\n- Finding: ${this.reviewMarkdownText(detail)}\n- Evidence: ${evidenceRefs.map((reference) => this.reviewMarkdownText(reference)).join(", ") || "None"}${resolution === undefined ? "" : `\n- Resolution: ${this.reviewMarkdownText(resolution)}`}`)
+                .join("\n\n");
+        const directory = join(this.root, "agent-output", run.projectId, run.runId, "reviews");
+        await mkdir(directory, { recursive: true });
+        await atomicWriteBytes(join(directory, `${subject}-findings.md`), Buffer.from(`# ${this.reviewMarkdownText(subject)} Challenger Findings\n\n- Reviewed artifact kind: ${this.reviewMarkdownText(review.subjectKind)}\n- Review subject hash: ${review.subjectHash}\n- Reviewed at: ${this.reviewMarkdownText(review.reviewedAt)}\n\n${findings}\n`, "utf8"));
+    }
+    async materializeValidationReport(run, evidence, taskType) {
+        const directory = join(this.root, "agent-output", run.projectId, run.runId, "validation");
+        const entries = evidence.entries.length === 0
+            ? "- No validation evidence entries were produced."
+            : evidence.entries
+                .map(({ kind, hash, bytes, required, retention }) => `- ${this.reviewMarkdownText(kind)}: ${hash} (${bytes} bytes; ${required ? "required" : "optional"}; ${this.reviewMarkdownText(retention)})`)
+                .join("\n");
+        await mkdir(directory, { recursive: true });
+        await atomicWriteBytes(join(directory, "validation-report.md"), Buffer.from(`# Validation Report\n\n- Task: ${this.reviewMarkdownText(taskType)}\n- Track: ${this.reviewMarkdownText(run.iacTool)}\n- Created: ${this.reviewMarkdownText(evidence.createdAt)}\n- Verdict: accepted deterministic validation evidence\n\n## Validator Evidence\n\n${entries}\n\nThe Validator reports evidence only. Artifact repair, risk acceptance, and gate decisions remain with their authorized owners.\n`, "utf8"));
+    }
     async requirementsDocumentMarkdown(value, artifactHash) {
         if (!Value.Check(RequirementsV1Schema, value)) {
             throw new ApexError("APEX_INTERNAL", "Requirements document source is invalid", EXIT_CODES.internal);
@@ -1177,6 +1474,8 @@ export class ApexService {
             ...(previewHash === undefined ? {} : { previewHash }),
             ...(validatorIds.length === 0 ? {} : { validatorIds }),
         }, gateNumber === 4 ? (events.at(-1)?.hash ?? null) : undefined);
+        if (gateNumber === 4)
+            await this.materializeOperationsApprovalPackage(run, approval, approvalHash);
         return approval;
     }
     async preview(options) {
@@ -1248,6 +1547,7 @@ export class ApexService {
                 ...(validation.omittedValidatorIds.length === 0 ? {} : { omittedValidatorIds: validation.omittedValidatorIds }),
                 ...(attestationHash === undefined ? {} : { attestationHash }),
             });
+            await this.materializeOperationsPreviewPackage(run, preview, previewObjectHash);
             await this.openRunGate(await this.currentRun(), 4, preview.previewHash);
             return preview;
         }
@@ -1295,9 +1595,64 @@ export class ApexService {
             evidenceMode: validation.evidenceMode,
             ...(validation.omittedValidatorIds.length === 0 ? {} : { omittedValidatorIds: validation.omittedValidatorIds }),
         });
+        await this.materializeOperationsPreviewPackage(run, preview, previewObjectHash);
         await this.openRunGate(await this.currentRun(), 4, preview.previewHash);
         return preview;
     }
+    operationsReviewDirectory(run) {
+        return join(this.root, "agent-output", run.projectId, run.runId, "operations");
+    }
+    async materializeOperationsPreviewPackage(run, preview, previewObjectHash) {
+        const directory = this.operationsReviewDirectory(run);
+        const changes = preview.changes.length === 0
+            ? "- No changes."
+            : preview.changes
+                .map(({ resourceId, action, material, details }) => {
+                const detail = details === undefined ? "" : `: ${this.reviewMarkdownText(details)}`;
+                return `- ${this.reviewMarkdownText(action)} ${this.reviewMarkdownText(resourceId)}${material ? " (material)" : ""}${detail}`;
+            })
+                .join("\n");
+        const previewContent = [
+            "# Deployment Preview",
+            "",
+            `- Operation: ${this.reviewMarkdownText(preview.operation)}`,
+            `- Target: ${this.reviewMarkdownText(preview.target)}`,
+            `- Expires: ${this.reviewMarkdownText(preview.expiresAt)}`,
+            "- Recipient: bound by the Gate 4 approval evidence",
+            "",
+            "## Changes",
+            "",
+            changes,
+            "",
+            "## Blockers",
+            "",
+            preview.blockers.length === 0
+                ? "- None."
+                : preview.blockers.map((blocker) => `- ${this.reviewMarkdownText(blocker)}`).join("\n"),
+            "",
+        ].join("\n");
+        await mkdir(directory, { recursive: true });
+        await Promise.all([
+            atomicWriteBytes(join(directory, "README.md"), Buffer.from(`# Operations Review\n\nGenerated from exact kernel evidence for run \`${this.reviewMarkdownText(run.runId)}\`. The APEX kernel state remains authoritative.\n\n- Preview hash: ${preview.previewHash}\n- Preview object hash: ${previewObjectHash}\n- Gate 4 status: pending human terminal approval\n`, "utf8")),
+            atomicWriteBytes(join(directory, "deployment-preview.md"), Buffer.from(previewContent, "utf8")),
+        ]);
+    }
+    async materializeOperationsApprovalPackage(run, approval, approvalHash) {
+        const content = [
+            "# Gate 4 Approval",
+            "",
+            `- Decision: ${this.reviewMarkdownText(approval.decision)}`,
+            `- Actor: ${this.reviewMarkdownText(approval.actor)}`,
+            `- Recipient: ${this.reviewMarkdownText(approval.recipientIdentity ?? "Unavailable")}`,
+            `- Preview hash: ${approval.previewHash ?? "Unavailable"}`,
+            `- Approval hash: ${approvalHash}`,
+            `- Expires: ${approval.expiresAt === undefined ? "Unavailable" : this.reviewMarkdownText(approval.expiresAt)}`,
+            "",
+            "This approval authorizes only the exact preview above.",
+            "",
+        ].join("\n");
+        await atomicWriteBytes(join(this.operationsReviewDirectory(run), "approval.md"), Buffer.from(content, "utf8"));
+    }
     async currentPreview() {
         const run = await this.currentRun();
         const events = await this.journal(run).replay();
@@ -2401,6 +2756,23 @@ export class ApexService {
             return typeof text === "string" && text.length > 0 ? [`${id}: ${text}`] : [];
         });
         const unknowns = requirements.filter(({ status }) => status !== "confirmed").map(({ statement }) => statement);
+        const text = (id) => {
+            const value = this.renderInputValue(input?.[id]);
+            return typeof value === "string" && value.length > 0 ? value : undefined;
+        };
+        const joinValues = (...ids) => {
+            const values = ids.map(text).filter((value) => value !== undefined);
+            return values.length === 0 ? undefined : values.join("; ");
+        };
+        const reviewFields = {
+            businessContext: joinValues("industry", "delivery-scenario", "workload-pattern"),
+            successCriteria: text("scale"),
+            nonFunctionalRequirements: text("availability-recovery") ?? text("recovery"),
+            securityAndCompliance: joinValues("security-controls", "compliance", "authentication", "data-sensitivity"),
+            budgetAndOperations: joinValues("budget", "operations"),
+            regionalConstraints: text("region"),
+            architectureHandoff: text("service-preferences"),
+        };
         return {
             requirements: requirements.length > 0
                 ? requirements
@@ -2415,6 +2787,7 @@ export class ApexService {
                 ],
             assumptions,
             unknowns,
+            ...Object.fromEntries(Object.entries(reviewFields).filter(([, value]) => value !== undefined)),
         };
     }
     renderInputValue(value) {

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const APEX_VERSION: "0.10.0-next.0";
+export declare const APEX_VERSION: "0.10.0-next.2";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,2 +1,2 @@
-export const APEX_VERSION = "0.10.0-next.0";
+export const APEX_VERSION = "0.10.0-next.2";
 //# sourceMappingURL=version.js.map