@apexops/cli 0.10.0-next.0

package/assets/client-projections/github-copilot-cli/.github/skills/apex-artifacts/SKILL.md

@@ -0,0 +1,65 @@
+---
+name: apex-artifacts
+description: "Presents accepted APEX typed artifacts as bounded Markdown views. Use for renderer templates, document slots, provenance receipts, resource inventories, cost views, runbooks, and reference-only document outlines."
+user-invocable: false
+---
+
+# APEX Artifact Presentations
+
+Present accepted typed artifacts without creating a second source of truth. The artifact schema, accepted values,
+kernel decisions, and accepted object hash remain canonical; Markdown is a derived view.
+
+## Prerequisites
+
+- An accepted typed artifact and `apex/taskContext` are available.
+- The document registry exposes the matching renderer and all required slots.
+- Any referenced evidence is accepted, immutable, and safe to disclose.
+
+## Rules
+
+1. Select an active template only when the renderer binds it to the accepted artifact kind.
+2. Preserve the selected template's heading order, slot meaning, and provenance receipt.
+3. Fill slots only from `apex/taskContext`, accepted artifact values, accepted evidence, or explicit kernel decisions.
+4. Preserve accepted unknown, unavailable, not-applicable, and deferred states exactly; never turn them into facts.
+5. Stop when a required slot, source identifier, template identifier, or renderer capability is unavailable.
+6. Return the bounded document request or kernel-rendered receipt. Never write workflow files or mutate artifact state.
+7. Do not use Markdown as gate evidence, claim validation or deployment occurred, or alter values to fit an outline.
+
+## Workflow
+
+1. Confirm artifact acceptance, kind, disclosure boundary, and renderer support.
+2. Choose an active binding below. Use an advisory outline only to shape a supported custom presentation.
+3. Map every required slot to an accepted source and retain source identifiers for traceability.
+4. Render once, then check heading order, unresolved slots, status language, links, and provenance.
+5. Correct the bounded request and re-render until the renderer accepts it; otherwise return the blocker.
+
+Read [presentation conventions](references/presentation-conventions.md) before preparing any document request.
+
+## Available Documents
+
+- [Requirements document](templates/requirements.md) - present an accepted `requirements` artifact.
+
+The registry also exposes direct, non-template renderers for run status, deployment preview, approval evidence, and
+resource inventory. They are read-only views of their accepted typed sources.
+
+## Reference-Only Outlines
+
+- [Architecture assessment](templates/architecture-assessment.md), [cost estimate](templates/cost-estimate.md),
+  [governance constraints](templates/governance-constraints.md), [implementation plan](templates/implementation-plan.md),
+  [deployment summary](templates/deployment-summary.md), [operations runbook](templates/operations-runbook.md), and
+  [resource inventory](templates/resource-inventory.md) are reference-only until the registry has a matching source
+  producer and renderer.
+- [Additional document outlines](references/reference-only-outlines.md) preserve useful source-document semantics.
+
+Reference-only outlines never authorize rendering, file creation, cloud queries, repository reads, or state changes.
+If a caller needs one, require a supported custom-document capability or clearly report that the capability is absent.
+
+Source template structure may inform an outline, but it is not a producer or renderer registration. A template becomes
+renderable only when a typed producer, registry binding, and document receipt are all available.
+
+The current registry declares no Mermaid-capable slots. Do not request inline diagrams for these documents.
+
+## Output
+
+Return a bounded document request or kernel-rendered Markdown receipt. Include projected source and template identifiers,
+unknowns, deferrals, evidence references, and capability blockers.

package/assets/client-projections/github-copilot-cli/.github/skills/apex-artifacts/references/presentation-conventions.md

@@ -0,0 +1,52 @@
+## Presentation Conventions
+
+Use a template only after the kernel accepts the matching typed artifact. Keep the artifact and its kernel-rendered
+document receipt canonical; the Markdown presentation is a derived view.
+
+### Authority And Provenance
+
+- Record the renderer-projected artifact identifier and template identifier.
+- Keep accepted values, units, scopes, status, and evidence references unchanged.
+- Label design, planned, simulated, expected, and observed values distinctly.
+- Never claim current Azure state, successful validation, or deployment from a template placeholder.
+
+### Slot Rules
+
+- Replace every required `{slot-name}` from accepted values or explicit kernel decisions.
+- Preserve `unknown`, `deferred`, `unavailable`, and `not applicable` as supplied by the renderer.
+- Keep optional sections only when accepted data supports them; do not manufacture empty success claims.
+- Stop and report a blocker when a required slot, renderer, artifact kind, or disclosure permission is unavailable.
+- Do not infer, invent, normalize, or use a presentation to change artifact meaning.
+
+### Traceability
+
+- Connect requirements to decisions, controls, implementation intent, risks, and accepted evidence where slots permit.
+- For governance, map each accepted constraint to a control, adaptation, exemption, or unsatisfied blocker.
+- For plans and inventories, account for every accepted resource and identify coverage gaps explicitly.
+- For as-built views, show design-versus-observed variance only when both accepted values exist.
+
+### Cost Semantics
+
+- State currency, region, pricing basis, usage quantities, query or evidence time, and expected variance.
+- Separate fixed or baseline cost from usage-sensitive cost and list redesign or scale triggers.
+- Represent savings as `quantified`, `not quantified`, or `not applicable`; never render zero as "not evaluated."
+- Do not present mutable prices as current unless accepted pricing evidence carries that claim.
+
+### Document Shape
+
+- Preserve template H2 order and use H3 sections for detail.
+- Prefer concise tables for comparisons, controls, resources, risks, and ownership.
+- Use callouts only for material notes, warnings, blockers, or irreversible consequences.
+- Include inline Mermaid only for a supported diagram slot and only from accepted nodes and relationships.
+- Keep links relative or from accepted source URLs; do not invent repository paths or portal links.
+
+### Receipt
+
+When available, include renderer-provided artifact and template identifiers, evidence identifiers, and render status.
+
+### Validation Loop
+
+1. Check required slots and accepted source mappings before rendering.
+2. Render through the kernel capability.
+3. Check unresolved placeholders, heading order, status wording, disclosure, links, and receipt identifiers.
+4. Correct the request and re-render. If the renderer still cannot satisfy a required slot, return the blocker.

package/assets/client-projections/github-copilot-cli/.github/skills/apex-artifacts/references/reference-only-outlines.md

@@ -0,0 +1,78 @@
+## Reference-Only Document Outlines
+
+These outlines preserve useful document semantics from the source skill. They do not declare artifact kinds, renderer
+bindings, workflow phases, file names, or authority to read repositories or query Azure. Use one only when a supported
+custom-document capability supplies accepted values for every required slot.
+
+### Preflight Evidence
+
+- Purpose and validation scope
+- Module or provider schema checks
+- Parameter type and interface checks
+- Region or service availability constraints
+- Known pitfalls, pass/fail evidence, and unresolved blockers
+
+Never infer a pass from planned configuration. Without accepted validation evidence, report the capability as absent.
+
+### Implementation Reference
+
+- Accepted implementation location or identifier
+- File or module structure from accepted inventory
+- Validation status with evidence references
+- Resources represented by the implementation
+- Key interfaces, decisions, limitations, and follow-up
+
+Do not add deployment commands or claim files exist unless accepted evidence provides them.
+
+### Documentation Package Index
+
+- Package contents and status
+- Accepted source artifacts and provenance
+- Workload summary
+- Related accepted resources and bounded links
+- Missing package items and deferrals
+
+### Design Document
+
+- Purpose, audience, objectives, constraints, assumptions, and stakeholders
+- Architecture overview and accepted relationships
+- Networking, storage, compute, identity, security, compliance, backup, and monitoring
+- Design decisions, operational implications, evidence, risks, and appendices
+
+Only include domains represented by accepted inputs. Keep planned and observed state distinct.
+
+### Backup And Recovery Plan
+
+- Recovery objectives by service tier
+- Backup scope, retention, restore approach, and ownership
+- Failover and failback decision points
+- Test schedule and accepted test evidence
+- Communications, dependencies, recovery procedures, and blockers
+
+Do not invent executable recovery commands. A missing tested procedure or owner is a blocker, not a placeholder success.
+
+### Compliance Matrix
+
+- Framework and scope
+- Requirement-to-control-to-evidence mapping
+- Gaps with severity, risk, owner, and remediation state
+- Evidence collection metadata and audit trail
+- Exceptions, expirations, deferrals, and residual risk
+
+Compliance percentages require accepted numerator, denominator, and scope. Otherwise present coverage as unknown.
+
+### Project Index
+
+- Workload summary and status
+- Accepted artifact catalog with provenance
+- Architecture preview only when a supported media slot exists
+- Resource summary, unresolved blockers, and related bounded links
+
+### Lessons And Improvement View
+
+- Accepted observations grouped by severity and workflow area
+- What happened, impact, corrective action, and evidence
+- Recommendations with owners and affected capability or contract
+- Deferred improvements and rationale
+
+Do not create improvement state or claim a correction was applied; project only kernel-accepted decisions.

package/assets/client-projections/github-copilot-cli/.github/skills/apex-artifacts/templates/architecture-assessment.md

@@ -0,0 +1,35 @@
+## {artifact-title}
+
+> Presentation receipt: artifact `{artifact-identifier}`; template `{template-identifier}`.
+
+## Requirements Validation
+
+{requirements-validation}
+
+## Executive Summary
+
+{executive-summary}
+
+## Well-Architected Assessment
+
+{waf-assessment}
+
+## Resource And SKU Recommendations
+
+{resource-recommendations}
+
+## Architecture Decisions
+
+{architecture-decisions}
+
+## Implementation Handoff
+
+{implementation-handoff}
+
+## Risks And Deferrals
+
+{risks-and-deferrals}
+
+## References
+
+{references}

package/assets/client-projections/github-copilot-cli/.github/skills/apex-artifacts/templates/cost-estimate.md

@@ -0,0 +1,47 @@
+## {artifact-title}
+
+> Presentation receipt: artifact `{artifact-identifier}`; template `{template-identifier}`.
+
+## Cost At A Glance
+
+{cost-at-a-glance}
+
+## Decision Summary
+
+{decision-summary}
+
+## Requirements To Cost Mapping
+
+{requirements-cost-mapping}
+
+## Cost Drivers And Sensitivities
+
+{cost-drivers-and-sensitivities}
+
+## Assumptions
+
+{assumptions}
+
+## Cost Breakdown
+
+{cost-breakdown}
+
+## Savings Opportunities
+
+{savings-state-and-opportunities}
+
+## Guardrails And Change Triggers
+
+{guardrails-and-change-triggers}
+
+## Risks And Deferrals
+
+{risks-and-deferrals}
+
+## Pricing Evidence
+
+{pricing-evidence}
+
+## References
+
+{references}

package/assets/client-projections/github-copilot-cli/.github/skills/apex-artifacts/templates/deployment-summary.md

@@ -0,0 +1,35 @@
+## {artifact-title}
+
+> Presentation receipt: artifact `{artifact-identifier}`; template `{template-identifier}`.
+
+## Preflight Evidence
+
+{preflight-evidence}
+
+## Execution Context
+
+{execution-context}
+
+## Change Summary
+
+{change-summary}
+
+## Resource Results
+
+{resource-results}
+
+## Outputs
+
+{outputs}
+
+## Outputs And Follow-Up
+
+{outputs-and-follow-up}
+
+## Exceptions And Deferrals
+
+{exceptions-and-deferrals}
+
+## References
+
+{references}

package/assets/client-projections/github-copilot-cli/.github/skills/apex-artifacts/templates/governance-constraints.md

@@ -0,0 +1,35 @@
+## {artifact-title}
+
+> Presentation receipt: artifact `{artifact-identifier}`; template `{template-identifier}`.
+
+## Discovery And Attestation
+
+{discovery-and-attestation}
+
+## Constraint Summary
+
+{constraint-summary}
+
+## Policy And Control Mapping
+
+{policy-and-control-mapping}
+
+## Adaptations And Exceptions
+
+{adaptations-and-exceptions}
+
+## Required Tags And Security Controls
+
+{tags-and-security-controls}
+
+## Cost And Network Constraints
+
+{cost-and-network-constraints}
+
+## Blockers And Deferrals
+
+{blockers-and-deferrals}
+
+## References
+
+{references}

package/assets/client-projections/github-copilot-cli/.github/skills/apex-artifacts/templates/implementation-plan.md

@@ -0,0 +1,43 @@
+## {artifact-title}
+
+> Presentation receipt: artifact `{artifact-identifier}`; template `{template-identifier}`.
+
+## Plan Summary
+
+{plan-summary}
+
+## Resource Inventory
+
+{resource-inventory}
+
+## Governance Coverage
+
+{governance-coverage}
+
+## Module And Interface Structure
+
+{module-and-interface-structure}
+
+## Planned Work
+
+{planned-work}
+
+## Code Generation Contract
+
+{code-generation-contract}
+
+## Dependencies And Delivery Sequence
+
+{dependencies-and-delivery-sequence}
+
+## Naming And Security Decisions
+
+{naming-and-security-decisions}
+
+## Risks And Deferrals
+
+{risks-and-deferrals}
+
+## References
+
+{references}

package/assets/client-projections/github-copilot-cli/.github/skills/apex-artifacts/templates/operations-runbook.md

@@ -0,0 +1,35 @@
+## {artifact-title}
+
+> Presentation receipt: artifact `{artifact-identifier}`; template `{template-identifier}`.
+
+## Quick Reference
+
+{quick-reference}
+
+## Health And Routine Operations
+
+{health-and-routine-operations}
+
+## Monitoring And Incident Response
+
+{monitoring-and-incident-response}
+
+## Common Procedures
+
+{common-procedures}
+
+## Maintenance And Recovery
+
+{maintenance-and-recovery}
+
+## Escalation And Ownership
+
+{escalation-and-ownership}
+
+## Change Evidence
+
+{change-evidence}
+
+## References
+
+{references}

package/assets/client-projections/github-copilot-cli/.github/skills/apex-artifacts/templates/requirements.md

@@ -0,0 +1,42 @@
+# Requirements: {workload}
+
+> Derived from accepted APEX requirements artifact `{artifact-hash}` using template `{template-hash}`.
+
+## Project Overview
+
+- Environment: {environment}
+- Status: {artifact-status}
+- Business context: {business-context}
+- Success criteria: {success-criteria}
+
+## Functional Requirements
+
+{requirements-table}
+
+## Non-Functional Requirements
+
+{nfr-table}
+
+## Security And Compliance
+
+{security-and-compliance-table}
+
+## Budget And Operations
+
+{budget-and-operations}
+
+## Regional And Residency Constraints
+
+{regional-constraints}
+
+## Assumptions
+
+{assumptions-list}
+
+## Unknowns And Deferrals
+
+{unknowns-list}
+
+## Architecture Handoff
+
+{architecture-handoff}

package/assets/client-projections/github-copilot-cli/.github/skills/apex-artifacts/templates/resource-inventory.md

@@ -0,0 +1,29 @@
+## {artifact-title}
+
+> Reference-only outline: no active renderer binding is declared for this template.
+>
+> Presentation receipt: artifact `{artifact-identifier}`; template `{template-identifier}`.
+
+## Inventory Summary
+
+{inventory-summary-by-category}
+
+## Resource Listing
+
+{resource-listing-with-type-sku-location-purpose-and-status}
+
+## Identity Network And Dependency Context
+
+{identity-network-and-dependency-context}
+
+## Cost And Operational Context
+
+{accepted-cost-monitoring-backup-and-ownership-context}
+
+## Coverage Gaps And Deferrals
+
+{coverage-gaps-and-deferrals}
+
+## References
+
+{references}

package/assets/client-projections/github-copilot-cli/.github/skills/apex-azure-adr/SKILL.md

@@ -0,0 +1,52 @@
+---
+name: apex-azure-adr
+description: "Records bounded Azure architecture decisions. Use for ADR rationale, alternatives, WAF and compliance consequences, implementation constraints, supersession, and revisit criteria."
+user-invocable: false
+---
+
+# APEX Azure Architecture Decisions
+
+Use this skill only for an active architecture or planning task. The kernel-owned architecture artifact, recorded
+architecture decisions, requirements, and governance evidence are authoritative.
+
+## Prerequisites
+
+- A material decision question and affected requirement IDs are present in `apex/taskContext`.
+- Accepted governance, availability, cost, lifecycle, and technical evidence needed for comparison is available.
+- The kernel exposes the decision-recording capability when a new user-owned choice is required.
+
+Create a decision record for a material, cross-cutting, costly-to-reverse, compliance-relevant, or intentionally deferred
+choice. Do not create one for routine implementation detail already fixed by an accepted contract.
+
+## Decision Method
+
+1. Frame one bounded question and state why a decision is needed now.
+2. List the driving requirements, constraints, assumptions, stakeholders, and accepted evidence.
+3. Compare the selected option with viable alternatives against the same criteria.
+4. State the selected option precisely and record why each alternative was rejected.
+5. Record positive, negative, and neutral consequences, including WAF and compliance effects.
+6. Record implementation constraints, validation signals, reversal cost, and revisit triggers.
+7. Check the record with [decision quality](references/decision-quality.md); revise until it passes or return a blocker.
+
+Use kernel-projected lifecycle states. `Proposed`, `Accepted`, `Deprecated`, and `Superseded` describe recorded decision
+state, not an inferred workflow phase. A superseded decision must link to its replacement; do not rewrite history.
+
+## Boundaries
+
+Do not create ADR files, sequence document numbers, write Markdown, use shell or Git, query Azure directly, or alter
+architecture artifacts outside the authorized workflow.
+
+Do not invent mutable service facts, prices, versions, policy state, benchmark results, or implementation outcomes.
+Missing evidence or an unresolved user-owned trade-off is an explicit blocker.
+
+## References
+
+- Read [decision record fields](references/decision-record-fields.md) when constructing the typed rationale.
+- Read [decision quality](references/decision-quality.md) before returning a completed decision.
+- Read [decision guardrails](references/decision-guardrails.md) when alternatives or evidence are weak.
+- Read [decision examples](references/decision-examples.md) when a concrete decision shape is useful.
+
+## Output
+
+Return bounded architecture or plan decision guidance with rationale, alternatives, consequences, requirement
+traceability, accepted evidence references, implementation constraints, revisit triggers, and blockers.

package/assets/client-projections/github-copilot-cli/.github/skills/apex-azure-adr/references/decision-examples.md

@@ -0,0 +1,38 @@
+# Decision Examples
+
+Use these as decision-shape examples, not as automatic service recommendations.
+
+| Area | Example trade-off |
+| --- | --- |
+| Compute | Container Apps versus App Service for an API with variable demand. |
+| Data | Azure SQL Database versus Cosmos DB for transactional consistency and scale. |
+| Networking | Private endpoints versus approved public access for a data service. |
+| Identity | Managed identity versus application credential for service-to-service access. |
+| Integration | Service Bus versus Event Grid for ordered, durable processing. |
+
+For each example, bind the final choice to projected requirements, cost/availability evidence, governance constraints,
+and any kernel-recorded user decision.
+
+## Example: Compute Hosting
+
+**Question**: Which managed host satisfies burst scaling, private data access, and the team's operating model?
+
+| Option | Fit | Trade-off | Evidence needed |
+| --- | --- | --- | --- |
+| Container Apps | Event-driven scaling and container portability | More platform concepts and network constraints | Scale, region, network, and price evidence |
+| App Service | Familiar managed web hosting | Scaling and container controls differ | Plan/SKU, region, network, and price evidence |
+
+The selected option must state the hosting posture and accepted SKU family, not merely the service name. Consequences
+should cover identity, ingress, diagnostics, scaling behavior, cost sensitivity, and migration effort.
+
+## Example: Data Access Posture
+
+**Question**: Should a production data service use private access or an approved public endpoint?
+
+| Option | Fit | Trade-off | Evidence needed |
+| --- | --- | --- | --- |
+| Private endpoint | Strong isolation and policy alignment | DNS, subnet capacity, routing, and added cost | Policy, topology, DNS, capacity, and price evidence |
+| Restricted public endpoint | Simpler connectivity when policy permits | Greater exposure and compensating controls | Policy, threat model, firewall, identity, and approval evidence |
+
+If accepted governance denies public access, the public option is not viable; record that constraint rather than
+pretending the alternatives are equally available.

package/assets/client-projections/github-copilot-cli/.github/skills/apex-azure-adr/references/decision-guardrails.md

@@ -0,0 +1,36 @@
+# Decision Guardrails
+
+## Do
+
+- Keep one decision focused on one trade-off.
+- Compare viable alternatives honestly.
+- Record measurable consequences when evidence exists.
+- Trace the decision to requirements, governance, cost, availability, or recorded user choices.
+- Preserve the original record when deprecating or superseding it.
+- State what evidence or condition would cause the decision to be revisited.
+- Preserve unresolved information as a blocker, unknown, or deferred decision.
+
+## Do Not
+
+- Create or number ADR files.
+- Replace typed architecture decisions with Markdown as authority.
+- Use placeholder text, fabricated evidence, or generic implementation guidance.
+- Combine unrelated data, networking, identity, and deployment choices into one decision.
+- Present a predetermined selection with token alternatives that were never viable.
+- Treat a planned benchmark, migration, validation, or deployment as an observed result.
+- Copy prices, versions, service retirement dates, policy state, or availability claims from memory.
+- Perform Azure reads, writes, deployments, or role assignments directly.
+
+## Common Failures
+
+| Failure | Correction |
+| --- | --- |
+| Vague selected option | Name the service, posture, or constraint and its requirement traceability. |
+| Missing alternative | Record a viable option and why accepted evidence or constraints rejected it. |
+| False alternative | Remove the option or explain the mandatory constraint it violates. |
+| One-sided consequence | Include both benefits and costs, risks, or operational obligations. |
+| Missing WAF impact | State the relevant affected pillars and the resulting trade-off. |
+| Generic implementation note | Record typed module, identity, network, diagnostics, or recovery constraints. |
+| Outcome stated as intent | Label the item planned and name the future acceptance evidence. |
+| Stale decision | Preserve it as deprecated or superseded and link the accepted replacement. |
+| Multi-decision record | Split choices whose alternatives, owners, or reversal triggers differ. |

package/assets/client-projections/github-copilot-cli/.github/skills/apex-azure-adr/references/decision-quality.md

@@ -0,0 +1,21 @@
+# Decision Quality Checklist
+
+Before completing an architecture or plan artifact, verify:
+
+- The decision identifier, lifecycle state, owner, and scope are present.
+- The decision addresses one bounded material trade-off.
+- Context separates the problem from the proposed solution.
+- Drivers name mandatory requirements, assumptions, and accepted evidence.
+- The selected option is precise, scoped, and unambiguous.
+- Viable alternatives are compared against the same criteria and have rejection rationales.
+- Positive, negative, and neutral consequences are honest and measurable where evidence permits.
+- Every WAF pillar is addressed or explicitly marked as having no material effect with rationale.
+- Compliance and governance implications use accepted constraints.
+- Implementation constraints are actionable through typed bindings without embedding execution steps.
+- Validation signals and revisit or supersession triggers are testable.
+- Reversal cost, residual risk, and decision ownership are visible.
+- Unknown and deferred values remain explicit.
+- The decision does not claim live state or results that are absent from task context.
+
+If a mandatory requirement has no supported option, evidence is stale or absent, or a user-owned trade-off remains
+unresolved, return a blocker instead of weakening the record.