@apexops/cli 0.10.0-next.0

package/assets/client-projections/github-copilot-cli/.github/skills/apex-bicep-patterns/references/compiler-and-provider-gotchas.md

@@ -0,0 +1,74 @@
+# Compiler And Provider Gotchas
+
+Read this reference before accepting a new AVM binding and when build, preview, and apply results disagree.
+
+## Exact Module Schema Wins
+
+AVM parameter names, nested object fields, required values, and outputs can change between module versions. Inspect the
+schema for the exact selected version before authoring its binding. Do not copy parameter shapes from model memory, an
+older project, or documentation for another version.
+
+Record the inspected inputs and outputs in validation evidence. If the exact schema cannot be inspected, return a
+blocker rather than guessing.
+
+AVM use also requires these checks:
+
+- pin the version selected by the authorized resolver
+- verify output names before creating downstream dependencies
+- confirm required policy tags survive any module-internal tag merge
+- verify diagnostics are emitted by the module or by an explicit companion binding
+- wrap a module to override incompatible defaults; record an exception before replacing AVM with a raw resource
+
+## Bicep Language Constraints
+
+- `utcNow()` is valid only as a parameter default. Do not use it in a variable or resource expression.
+- A child resource `parent` must be calculable at deployment start. A module output is not a static parent name; use a
+  parameter-derived existing resource and an explicit dependency when ordering is otherwise lost.
+- A subscription-scope module called from a resource-group deployment requires an explicit subscription scope.
+- An `existing` resource reference does not prove that its creating module has completed. Add an explicit dependency
+  when a child or extension resource targets something created in the same deployment.
+
+## Identity And RBAC
+
+Keep identity creation separate from target-resource authorization. Putting a target resource's role assignment inside
+the identity module can create a dependency cycle when each module needs the other's output. Place the assignment with
+the target resource and use the identity principal output as an input.
+
+A runtime managed identity is not a data-plane administrator. Use a dedicated administration principal for SQL or other
+data-plane administration, then grant the runtime identity only the application permissions it needs. Deploy-time
+principal IDs remain required environment inputs; CodeGen must not invent or bake them into parameter files.
+
+## Validation Green, Apply Red
+
+A successful build or preview does not prove resource-provider compatibility. Review the rendered resource properties
+when an AVM default may be SKU-dependent. Reject premium-only networking, zone, quarantine, trust, or data-endpoint
+properties on a lower tier unless the exact provider contract supports them.
+
+For scheduled query rules, validate KQL against the target table schema. Bicep treats the query as an opaque string and
+preview does not run the service query parser. Ingestion quota alert queries against `_LogOperation` must use that
+table's columns rather than fields copied from `AzureActivity`, `AzureDiagnostics`, or application tables.
+
+## Service Topology Traps
+
+- AKS egress mode must match the accepted topology: subnet NAT gateway, AKS-managed NAT gateway, explicit default route
+  to an operator-managed firewall, or load balancer are different designs. Fixed-size pools must not carry autoscaling
+  bounds, and a control-plane identity using an existing VNet needs the accepted network role assignment.
+- An Application Gateway backend pool may be empty until its real backend exists. Never use a loopback address as a
+  placeholder.
+- MySQL private endpoint and delegated-subnet injection are different, mutually exclusive topologies. A shared private
+  endpoint subnet is not a delegated MySQL subnet. Treat read-only authentication settings and other post-deployment
+  operations as deployment tasks, not writable Bicep properties.
+- A database major-version upgrade is an isolated lifecycle operation. Do not combine it with unrelated property
+  changes. Resolve supported versions from current service evidence rather than retaining a version literal here.
+- Subscription-scoped cost alerts require a scope-compatible view and module scope.
+- Automation schedules cannot attach to an unpublished runbook. Keep publish-and-link work as an explicit
+  post-deployment task when the resource provider requires it.
+
+## Repair Loop
+
+1. Classify the failure as Bicep language, exact module schema, rendered-template, or provider apply-time behavior.
+2. Check the exact selected schema and accepted architecture/SKU evidence.
+3. Correct the typed binding or record an explicit module exception; do not add a speculative property.
+4. Re-run the owning build, lint, security, policy, and preview validators.
+5. Proceed only when the new receipts are current; an apply-only limitation remains a documented deployment risk or
+   blocker.

package/assets/client-projections/github-copilot-cli/.github/skills/apex-bicep-patterns/references/module-interfaces-and-parameters.md

@@ -0,0 +1,56 @@
+# Module Interfaces And Parameters
+
+Read this reference when a Bicep binding introduces a reusable module or environment-specific inputs.
+
+## Stable Module Interface
+
+Give reusable modules a predictable contract so composition, diagnostics, identity, and downstream dependencies do not
+rely on module-specific guesswork.
+
+Required inputs normally include:
+
+- `name`
+- `location`
+- `tags`
+- the accepted monitoring workspace binding when the resource supports diagnostics
+
+Required outputs normally include:
+
+- `resourceId`
+- `resourceName`
+- `principalId` when managed identity is supported
+
+When a resource has no managed identity, expose an explicitly optional or empty principal value according to the typed
+binding contract. Do not invent an identity merely to satisfy a uniform output shape.
+
+Add service-specific inputs and outputs only when a downstream binding needs them. Keep secrets out of outputs, and do
+not leak generated credentials through module composition.
+
+## Environment Inputs
+
+Keep the generated Bicep tree environment-neutral. Environment-specific subscription IDs, tenant IDs, object IDs,
+notification recipients, budget values, and existing-resource bindings must come from the accepted environment input
+contract rather than literals or environment branches in `main.bicep`.
+
+Use `.bicepparam` files as generated binding surfaces when the selected toolchain supports them. Each parameter must map
+to an accepted typed input. Values resolved at deployment time remain unresolved in source; CodeGen must not fabricate a
+placeholder GUID, address, secret, or recipient.
+
+Reject these patterns:
+
+- project-specific GUIDs or subscription IDs embedded in Bicep or parameter files
+- secret defaults
+- production and non-production identifiers selected by conditional literals in `main.bicep`
+- parameters that are not present in the accepted IaC binding contract
+- environment input names that are silently renamed between planning, CodeGen, and deployment
+
+## Acceptance Check
+
+Before staging CodeGen intent, verify:
+
+- every module input traces to accepted architecture, governance, defaults, or environment intent
+- every output has a known consumer or documented compatibility purpose
+- required monitoring and identity bindings are explicit
+- environment-specific values remain external to the generated source tree
+- parameter names and types match the selected module interface
+- missing deploy-time values return a blocker instead of a generated placeholder

package/assets/client-projections/github-copilot-cli/.github/skills/apex-bicep-patterns/references/network-and-observability.md

@@ -0,0 +1,52 @@
+# Network And Observability
+
+Read this reference when a Bicep binding includes hub-spoke networking, private connectivity, or resource diagnostics.
+
+## Hub-Spoke Composition
+
+Use hub-spoke topology only when shared connectivity, inspection, DNS, or platform services are accepted architectural
+requirements. Bind peering, routing, subnet, and network-security intent explicitly; do not imply those choices from a
+resource name or a module default.
+
+The hub owns accepted shared services. Spokes peer to the hub and do not peer directly unless the architecture records
+a specific exception. Pass the hub resource ID through module outputs rather than reconstructing it. Apply network
+security at the subnet boundary, and verify address spaces and service CIDRs do not overlap before generation.
+
+## Private Endpoint And DNS
+
+Private endpoint intent includes the target subresource, approved subnet, private DNS zone, and DNS zone group. A
+private endpoint without its DNS and network dependencies is incomplete. Public access exceptions require an accepted
+risk and policy-compatible boundary.
+
+When shared private DNS is not provided by the platform, the owning binding must create the zone, link it to the
+accepted VNet, and pass the created zone resource ID to the endpoint. Do not construct an ID for a zone that no binding
+creates or accepts as existing evidence.
+
+Common service subresources and zones include:
+
+| Service | Subresource | Private DNS zone |
+| --- | --- | --- |
+| Blob storage | `blob` | `privatelink.blob.core.windows.net` |
+| Table storage | `table` | `privatelink.table.core.windows.net` |
+| Key Vault | `vault` | `privatelink.vaultcore.azure.net` |
+| Azure SQL | `sqlServer` | `privatelink.database.windows.net` |
+| Cosmos DB for NoSQL | `Sql` | `privatelink.documents.azure.com` |
+| App Service | `sites` | `privatelink.azurewebsites.net` |
+| Event Hubs | `namespace` | `privatelink.servicebus.windows.net` |
+| Container Registry | `registry` | `privatelink.azurecr.io` |
+
+Treat this table as a pattern aid, not live service-availability evidence. Confirm the exact target resource contract
+when accepting a binding.
+
+## Diagnostics And Dependencies
+
+Every governed resource should have diagnostics and metrics mapped to the accepted monitoring destination. Category
+selection, retention, cost, and ownership remain typed planning decisions; generated settings and deployment success
+require validator and operation receipts.
+
+Prefer supported category groups when they satisfy the accepted requirement; otherwise bind explicit categories from
+current provider evidence. Include metrics only when the resource supports them.
+
+An `existing` resource reference does not create an implicit dependency on a module that creates that resource in the
+same deployment. Extension resources such as diagnostics and private DNS zone groups need explicit ordering when their
+parent is created by another module.

package/assets/client-projections/github-copilot-cli/.github/skills/apex-codegen/SKILL.md

@@ -0,0 +1,32 @@
+---
+name: apex-codegen
+description: "Provides hidden-worker guidance for one bounded APEX IaC generation task with approved intent and binding."
+user-invocable: false
+---
+
+## APEX Code Generation
+
+Use this skill only inside the hidden CodeGen worker.
+
+## Prerequisites
+
+- `apex/taskContext` supplies approved intent, one selected-track binding, policy obligations, output paths, and limits.
+- The task identifies a single dependency-sized generation batch.
+
+## Workflow
+
+1. Call `apex/generateIac` once for the issued task ID, accepted intent, and selected-track binding.
+2. Preserve exact module, provider, API, security, naming, ownership, and environment-input obligations.
+3. Keep secret values out of generated content; use only typed references supplied by the kernel. Use `apex/stageFile`
+   only for additional assigned files before completion.
+4. Complete the issued task with the generated output. After completion, return the kernel receipt and perform no
+   follow-up staging, generation, validation, delegation, or repository work.
+5. Return `needs_input` when a required binding or value is absent.
+
+## Boundaries
+
+Do not execute, format, validate, preview, deploy, write directly to repository paths, or delegate work.
+
+## Output
+
+Return the typed completion or `needs_input` result with affected field IDs.

package/assets/client-projections/github-copilot-cli/.github/skills/apex-entra-app-registration/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: apex-entra-app-registration
+description: "Model Microsoft Entra application registration and OAuth design intent in APEX. Use for application type, flow, API permission, redirect URI, credential, and consent trade-offs."
+user-invocable: false
+---
+
+# APEX Entra App Registration Guidance
+
+Use this skill only for an active architecture, planning, or approved implementation-binding task. The kernel owns
+task state, evidence freshness, authorization, artifact acceptance, and all state-changing work.
+
+## Prerequisites
+
+- `apex/taskContext` identifies the active task, allowed outputs, applicable requirements, and evidence references.
+- The workload purpose, client type, tenant boundary, target APIs, and user-interaction model are known; otherwise
+  return `needs_input`.
+- An identity operation is available only through a kernel-authorized capability. A request alone is not authority to
+  create or alter an application registration.
+
+## Workflow
+
+1. Model the application type, audience, tenant model, redirect-URI class, and OAuth interaction.
+   Record the selected flow and rationale without protocol requests or application configuration.
+2. Map each business operation to the minimum delegated or application permission requirement.
+   Record consent ownership, scope, and unresolved permission evidence; do not infer or approve consent.
+3. Select a credential posture: public clients hold no credential; Azure-hosted workloads prefer managed identity.
+   Confidential workloads prefer federation or certificates over secrets; record lifecycle ownership, never a value.
+4. Submit typed identity intent only through the kernel-authorized capability named in the task envelope.
+   Preserve its receipt or blocker in the architecture, plan, or binding artifact.
+5. Handoff approved identity intent to the authorized implementation, validation, or operations capability.
+   Do not claim that registration, permissions, credentials, or consent exist without an accepted receipt.
+6. Classify observed identity failures with [Identity design and diagnostic rules](references/design-and-diagnostics.md).
+   Return the responsible owner and evidence gap without attempting remediation.
+
+## Boundaries
+
+Do not use portal, CLI, Microsoft Graph, SDK, HTTP, IaC, repository, source-scanning, or file-mutation actions. Do
+not create registrations, configure redirect URIs, grant consent, assign permissions, create or handle credentials,
+expose identifiers or secret material, test authentication, or deploy. Direct operational requests must be converted
+into bounded intent and an authorized capability handoff.
+
+## References
+
+- [OAuth and registration model](references/oauth-registration-model.md) - client, audience, flow, and redirect-URI decisions.
+- [Permissions and credential posture](references/permissions-and-credentials.md) - least privilege and credential trade-offs.
+- [Capability receipt and handoff](references/capability-receipts.md) - required evidence, blockers, and next-task rules.
+- [Identity design and diagnostic rules](references/design-and-diagnostics.md) - source-derived flow, permission, and
+   troubleshooting rules without configuration or protocol operations.
+
+## Output
+
+Return typed identity design intent, requirement traces, authorized capability receipt references, explicit blockers,
+and the next kernel-controlled task.

package/assets/client-projections/github-copilot-cli/.github/skills/apex-entra-app-registration/references/capability-receipts.md

@@ -0,0 +1,21 @@
+# Capability Receipts And Handoff
+
+An identity decision becomes operational only after an authorized capability returns an accepted receipt. Intent is not
+evidence that an application registration, permission, consent, redirect URI, or credential exists.
+
+## Required Intent Fields
+
+- Requirement references and active task identifier.
+- Application, tenant, audience, flow, and redirect-URI design intent.
+- Permission and consent intent, including the unresolved items.
+- Credential posture, lifecycle owner, and validation obligation.
+
+## Receipt Rules
+
+Preserve the capability name, receipt identifier, status, evidence reference, and any explicit blocker. A missing,
+stale, rejected, or incomplete receipt blocks downstream claims and requires kernel-directed recovery.
+
+## Handoff
+
+Route accepted intent to the task-envelope capability for implementation, then to the authorized validation or operations
+capability. Return the next task and blocker state; do not perform or simulate the handoff.

package/assets/client-projections/github-copilot-cli/.github/skills/apex-entra-app-registration/references/design-and-diagnostics.md

@@ -0,0 +1,36 @@
+# Identity Design And Diagnostic Rules
+
+Use this reference to model identity intent and classify observed failures. It does not create registrations, issue
+tokens, call Microsoft Graph, grant consent, or handle credentials.
+
+## Flow And Registration Intent
+
+Record workload purpose, client class, interactive-user model, tenant boundary, API audience, redirect-URI class, and
+the owning application before implementation begins. Use authorization code for web applications, authorization code
+with PKCE for SPA or mobile public clients, device code only for supported browserless user interaction, and client
+credentials for service-to-service workloads. Treat the selection as design intent, not a configured flow.
+
+Redirect URIs must be an exact registered match and belong to the correct client platform. Unknown callback locations,
+tenant model, or audience block implementation intent rather than being filled with placeholders.
+
+## Permission And Credential Intent
+
+Map each accepted business operation to its minimum required permission and target resource. Model delegated access
+when the operation acts for a signed-in user and application access for a background workload without a user. Record
+the consent owner and evidence; application permissions and privileged delegated permissions require an explicit
+consent decision and must never be inferred as granted.
+
+Public clients have no client credential. Prefer managed identity for supported Azure-hosted workloads and federation
+or certificates for external confidential workloads. A secret-only design needs an explicit exception, lifecycle owner,
+and replacement plan. Record credential type and rotation requirement, never credential material or identifiers.
+
+## Diagnostic Classification
+
+Classify a redirect mismatch by comparing the exact requested URI, registered URI, and platform class. Classify consent
+or insufficient-privilege failures by checking the requested permission type, consent owner, target resource, and
+accepted configuration evidence. Classify invalid-client or expired-credential failures as a credential-lifecycle
+blocker. Classify application-not-found or tenant failures as an identity-boundary mismatch. Do not expose tokens or
+use diagnostic observations as authority to change an application registration.
+
+Return the evidence gap, responsible owner, and required kernel-authorized next task. Direct configuration, consent,
+credential, SDK, CLI, IaC, and HTTP remediation stays outside this skill.

package/assets/client-projections/github-copilot-cli/.github/skills/apex-entra-app-registration/references/oauth-registration-model.md

@@ -0,0 +1,26 @@
+# OAuth And Registration Model
+
+Model identity before requesting an implementation capability. The design artifact must identify the workload purpose,
+client class, users or services that authenticate, target API audience, tenant boundary, and redirect-URI class.
+
+## Flow Selection
+
+| Workload | Default intent | Constraints to record |
+| --- | --- | --- |
+| Web app | Authorization code | Redirect URI ownership and session boundary |
+| SPA or mobile app | Authorization code with PKCE | Public-client posture and redirect URI class |
+| Browserless user workflow | Device code only when interaction is supported | User consent and device interaction boundary |
+| Service-to-service | Client credentials | Application permission and workload identity posture |
+
+Do not describe token requests, generate protocol values, or claim that a flow is configured. The selected flow is a
+traceable design choice that an authorized capability may later implement and validate.
+
+## Redirect URI Intent
+
+Record the owning application, URI class, environment boundary, and exact-match requirement. Unknown redirect URIs
+block implementation intent; do not substitute placeholders or broaden accepted callback locations.
+
+## Tenant And Audience
+
+Record whether the application is single-tenant, multi-tenant, or otherwise restricted, and name the intended API
+audience. Treat both as user-owned decisions when requirements lack evidence.

package/assets/client-projections/github-copilot-cli/.github/skills/apex-entra-app-registration/references/permissions-and-credentials.md

@@ -0,0 +1,27 @@
+# Permissions And Credentials
+
+## Permission Intent
+
+Map each accepted operation to one minimum API permission requirement. Specify whether the operation acts for a signed-in
+user (delegated) or without a user (application), the target resource, consent owner, and evidence for necessity.
+
+| Condition | Decision |
+| --- | --- |
+| User-context operation | Model delegated permission intent |
+| Background workload operation | Model application permission intent |
+| Permission necessity is unknown | Return `needs_input` or a blocker |
+| Consent authority is absent | Preserve a consent blocker |
+
+Never infer elevated permissions, grant consent, or treat requested permissions as approved access.
+
+## Credential Posture
+
+| Client or hosting model | Preferred posture |
+| --- | --- |
+| Public client | No client credential |
+| Azure-hosted workload | Managed identity when the target supports it |
+| External confidential workload | Federated identity credential or certificate |
+| Secret-only integration | Explicit exception, lifecycle owner, and replacement plan |
+
+Do not create, retrieve, transmit, store, rotate, or reveal secret material. Record only credential type, owner,
+validity or rotation requirement, and the capability receipt needed to establish it.

package/assets/client-projections/github-copilot-cli/.github/skills/apex-mermaid/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: apex-mermaid
+description: "Requests safe inline Mermaid for supported APEX Markdown slots. Use for compact flowcharts, sequences, state machines, ER models, Gantt views, renderer validation, accessible theming, and syntax troubleshooting from accepted artifact data."
+user-invocable: false
+---
+
+# APEX Inline Mermaid
+
+The current APEX document registry declares no Mermaid-capable slots. Do not request or emit an inline Mermaid fence
+until a renderer registers a typed source, a supported slot, syntax validation, and a returned document receipt.
+
+## Prerequisites
+
+- The target template exposes a Mermaid-capable inline slot.
+- Accepted artifact data contains every node, relationship, label, and time value to be shown.
+- The renderer declares supported Mermaid syntax and validation behavior.
+
+## Future Renderer Contract
+
+When a renderer-supported slot exists, select the simplest diagram type that preserves accepted relationships. Apply
+[syntax guidance](references/syntax.md) and [styling guidance](references/styling.md), then submit only the bounded
+fence to that renderer. The renderer, rather than this skill, must validate syntax and return the document receipt.
+
+Syntax and styling references are guidance targets, not active renderer slots. They do not make Mermaid output
+available until a typed source, renderer registration, and receipt exist.
+
+## Boundaries
+
+- Do not create standalone architecture, network, runtime, as-built, WAF, cost, or compliance diagrams.
+- Do not write or edit files, invoke deployment, or mutate source-of-truth artifacts, templates, schemas, or state.
+- Do not use unaccepted inputs, infer missing values, or treat rendered Markdown as gate evidence.
+- Do not embed Azure service icons, custom SVG, secrets, physical principal IDs, unsafe links, or Mermaid click actions.
+- Do not claim syntax or visual validation from model inspection; only the renderer receipt supplies that evidence.
+
+## Blockers
+
+When the requested document slot is unsupported, absent, or cannot be filled from accepted data, return a blocker that
+names the slot, diagram type, and missing renderer support or artifact data. Also block when renderer-version syntax,
+escaping, or accessibility cannot be validated. Do not emit a substitute diagram or alter any source.
+
+## Output
+
+Return only the renderer request or its rendered inline document result and receipt. Preserve any projected artifact and
+template hashes, validation status, and unresolved blockers.

package/assets/client-projections/github-copilot-cli/.github/skills/apex-mermaid/references/styling.md

@@ -0,0 +1,33 @@
+# Styling Guidance
+
+Use a renderer-compatible neutral theme and limited semantic classes. Meaning must remain clear without color.
+
+```mermaid
+%%{init: {'theme': 'neutral'}}%%
+graph LR
+    classDef gate stroke:#2563eb,stroke-width:2px;
+    INPUT["Accepted data"] --> GATE{"Supported slot"}:::gate
+    GATE --> OUTPUT["Rendered inline view"]
+```
+
+## Styling Rules
+
+- Prefer one layout direction, consistent node shapes, and a small semantic class set.
+- Use shape, border, and text labels together; never encode status or severity by color alone.
+- Keep contrast readable in light and dark Markdown renderers. Use renderer-projected colors when available.
+- Use subgraphs only for accepted ownership, trust, lifecycle, or resource boundaries.
+- Keep edge labels short and place detail in surrounding prose when the slot permits it.
+- Avoid service icons, custom SVG, background images, animations, click actions, and external CSS.
+- Do not use emoji as the only identifier; assistive text must carry the meaning.
+
+## Complexity Limits
+
+When labels overlap, crossings obscure meaning, or the renderer cannot fit the slot, reduce the diagram to its primary
+accepted relationship. Split independent concerns into supported slots or use a standalone diagram capability. Do not
+hide nodes or drop material edges merely to make the view attractive.
+
+## Renderer Validation
+
+The renderer decides whether the slot accepts Mermaid, the theme directive is supported, syntax parses, and the result
+fits the document. Inspect the renderer receipt for validation errors. Model inspection, Markdown source appearance, or
+a successful document request is not visual-validation evidence.

package/assets/client-projections/github-copilot-cli/.github/skills/apex-mermaid/references/syntax.md

@@ -0,0 +1,99 @@
+# Syntax Guidance
+
+Use one compact diagram in a fenced `mermaid` block for a renderer-supported inline slot.
+
+## Choose The Diagram Type
+
+| Accepted relationship | Diagram type |
+| --- | --- |
+| Branching process, dependency, or decision | `flowchart` or `graph` |
+| Ordered interaction among actors | `sequenceDiagram` |
+| Lifecycle states and transitions | `stateDiagram-v2` |
+| Entity relationships and cardinality | `erDiagram` |
+| Dated tasks and dependencies | `gantt` |
+
+Use a standalone diagram capability for architecture, network, runtime, as-built, WAF, cost, or compliance visuals.
+
+## Flowchart
+
+```mermaid
+graph TB
+    START["Accepted input"] --> CHECK{"Gate"}
+    CHECK -->|"Pass"| RENDER["Render slot"]
+    CHECK -->|"Block"| STOP["Return blocker"]
+```
+
+Use `TB` for vertical flows and `LR` for short horizontal flows. Group related nodes only when an accepted boundary
+exists. Use `-->` for primary flow, `-.->` for an accepted optional relationship, and `==>` sparingly for an accepted
+critical path. Label decisions and non-obvious edges.
+
+## Sequence
+
+```mermaid
+sequenceDiagram
+    participant CLIENT as Client
+    participant API as API
+    participant STORE as Data store
+    CLIENT->>API: Accepted request
+    API->>STORE: Read accepted record
+    STORE-->>API: Result
+    API-->>CLIENT: Response
+```
+
+Declare participants in first-use order. Use solid arrows for calls and dashed arrows for responses. Do not invent
+authentication, retries, timing, or failure paths absent from accepted data.
+
+## State
+
+```mermaid
+stateDiagram-v2
+    [*] --> Proposed
+    Proposed --> Accepted: Approve
+    Accepted --> Superseded: Replace
+    Superseded --> [*]
+```
+
+Use explicit transition labels and only accepted states. Avoid modeling an action as a state or implying a transition
+the kernel does not authorize.
+
+## Entity Relationship
+
+```mermaid
+erDiagram
+    WORKLOAD ||--o{ RESOURCE : contains
+    RESOURCE ||--o{ EVIDENCE : supported_by
+```
+
+Use accepted cardinality. Keep entity and relationship names concise; do not expose sensitive field values.
+
+## Gantt
+
+```mermaid
+gantt
+    title Accepted delivery window
+    dateFormat YYYY-MM-DD
+    section Delivery
+        Foundation :foundation, 2030-01-01, 2d
+        Validation :validation, after foundation, 1d
+```
+
+Use dates and durations only from accepted schedule data. A Gantt chart is a presentation, not authorization or proof
+that a task started or completed.
+
+## Safe Identifiers And Labels
+
+- Use short, unique ASCII IDs; keep human-readable text in quoted labels or participant aliases.
+- Keep labels factual and concise. Use renderer-supported line breaks only when validation confirms them.
+- Avoid reserved keywords as IDs, duplicate IDs, unescaped quote characters, raw URLs, and HTML labels.
+- Preserve accepted relationship direction; do not reverse arrows to improve layout.
+- Omit unavailable values rather than inserting placeholders or guessed nodes.
+
+## Troubleshooting
+
+| Renderer finding | Correction |
+| --- | --- |
+| Parse error near label | Replace the display label with a quoted label and a simple ASCII ID. |
+| Duplicate or merged nodes | Give every semantic node a unique ID while retaining its accepted display label. |
+| Unsupported directive or diagram | Use the renderer-supported syntax or return an unsupported-capability blocker. |
+| Unreadable dense graph | Split by accepted concern or use the standalone diagram capability. |
+| Relationship appears wrong | Check the accepted source mapping; never fix layout by changing semantics. |

package/assets/client-projections/github-copilot-cli/.github/skills/apex-microsoft-docs/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: apex-microsoft-docs
+description: "Researches official Microsoft documentation for APEX decisions. Use for Microsoft Learn concepts, limits, version support, WAF and architecture guidance, configuration, tutorials, and official code samples with cited evidence."
+---
+
+# APEX Microsoft Documentation
+
+Use this skill only for an active APEX architecture or planning task that needs current official Microsoft guidance.
+The documentation capability is currently unavailable until it is activated and qualified for the selected client.
+
+## Prerequisites
+
+- `apex/taskContext` identifies the current task and the decision that needs evidence.
+- An activated, client-qualified, read-only documentation capability is available for the selected projection.
+
+Until that capability is active, return a missing-evidence blocker. Do not substitute model memory, a web scrape, a
+CLI fallback, or an unverified third-party source.
+
+## Workflow
+
+1. Frame a specific question with product, service, version, platform, task intent, and the decision it supports.
+2. Search through the qualified documentation capability before retrieving content.
+3. Rank official results by directness, version/platform fit, scope, and currency.
+4. Use the search excerpt when sufficient; otherwise fetch only the relevant page or section.
+5. Request an official code-sample search only when runnable example code is part of the question.
+6. Reconcile conflicting or incomplete sources and preserve unresolved applicability as a blocker.
+7. Record concise evidence with URL, title, heading, retrieval time, applicability, and uncertainty.
+8. Check that each material claim is supported and that documentation is not standing in for another evidence type.
+
+Read [the research method](references/research-method.md) before issuing a documentation request.
+
+## Boundaries
+
+- This skill is advisory. It does not configure MCP servers, execute commands, or modify files.
+- Azure pricing remains the read-only ARM MCP pricing evidence path, not a documentation lookup.
+- Documentation does not replace governance, quota, availability, approval, or deployment evidence.
+- Official examples are illustrative inputs to a later implementation decision, not proof that code compiles or deploys.
+- Do not fetch broad documentation trees, copy long page bodies, or use model memory to fill a missing source.
+
+## Blockers
+
+Return a missing-evidence blocker when the qualified capability is absent, no official source covers the target version
+or platform, sources materially conflict, the page is stale or inaccessible, or applicability cannot be established.
+Name the unresolved question and the evidence needed; do not fall back to CLI, web scraping, or third-party summaries.
+
+## References
+
+- [Research method](references/research-method.md) covers query framing, source selection, samples, conflicts, and evidence.
+
+## Output
+
+Return a bounded evidence result for the active APEX decision. Include supported claims, source URLs, applicability,
+retrieval metadata, uncertainty, conflicts, and missing-evidence blockers without changing task state.