@apexops/cli 0.10.0-next.1 → 0.10.0-next.3

package/dist/service.js

@@ -161,8 +161,7 @@ const REQUIREMENTS_INTAKE = [
     {
         round: "service-preferences",
         questions: [
-            { id: "retained-services", prompt: "List Azure services or integrations that must be retained, or 'none'." },
-            { id: "prohibited-services", prompt: "List prohibited services or use 'none'." },
+            { id: "prohibited-services", prompt: "List prohibited services, or explicitly defer the constraint." },
             {
                 id: "service-preferences",
                 prompt: "Select preferred Azure services. Select all that apply; architecture chooses the exact combination.",
@@ -222,10 +221,22 @@ const REQUIREMENTS_INTAKE = [
                 prompt: "Choose the Azure region, or explicitly defer the decision.",
                 options: ["swedencentral", "westeurope", "germanywestcentral"],
             },
-            { id: "availability-recovery", prompt: "State availability, RTO, RPO, backup, and recovery requirements." },
+            {
+                id: "availability-recovery",
+                prompt: "Select required availability, backup, and disaster-recovery capabilities.",
+                options: [
+                    "single-region-availability",
+                    "availability-zones",
+                    "automated-backups",
+                    "point-in-time-restore",
+                    "immutable-backups",
+                    "cross-region-disaster-recovery",
+                ],
+                multiSelect: true,
+            },
             {
                 id: "recovery",
-                prompt: "Provide RTO and RPO in whole minutes or explicitly defer them.",
+                prompt: "Set exact recovery targets: provide RTO and RPO in whole minutes, or explicitly defer them.",
                 valueType: "recovery",
             },
             {
@@ -1078,6 +1089,42 @@ export class ApexService {
                 }),
             legacy,
         });
+        if (descriptor.id === "requirements" && renderedDocument !== undefined) {
+            await this.materializeRequirementsReviewPackage(run, requirementsOutput.value, renderedDocument.outputHash, events);
+        }
+        if (descriptor.id === "requirements-review") {
+            await this.materializeRequirementsChallengeFindings(run, outputs[0].value);
+        }
+        if (descriptor.id === "architecture") {
+            const architectureOutput = outputs.find(({ kind }) => kind === "architecture");
+            const costOutput = outputs.find(({ kind }) => kind === "cost-estimate");
+            const decisionsOutput = outputs.find(({ kind }) => kind === "workload-decision-manifest");
+            if (architectureOutput === undefined || costOutput === undefined || decisionsOutput === undefined) {
+                throw new ApexError("APEX_INTERNAL", "Architecture review package is missing an accepted output", EXIT_CODES.internal);
+            }
+            await this.materializeArchitectureReviewPackage(run, architectureOutput.value, costOutput.value, decisionsOutput.value, outputHashes);
+        }
+        if (descriptor.id === "architecture-review") {
+            await this.materializeArchitectureChallengeFindings(run, outputs[0].value);
+        }
+        if (descriptor.id === "plan") {
+            const intentOutput = outputs.find(({ kind }) => kind === "implementation-intent");
+            const bindingOutput = outputs.find(({ kind }) => kind === "iac-binding");
+            const inputsOutput = outputs.find(({ kind }) => kind === "environment-inputs");
+            if (intentOutput === undefined || bindingOutput === undefined || inputsOutput === undefined) {
+                throw new ApexError("APEX_INTERNAL", "Planner review package is missing an accepted output", EXIT_CODES.internal);
+            }
+            await this.materializePlanReviewPackage(run, intentOutput.value, bindingOutput.value, inputsOutput.value, outputHashes);
+        }
+        if (descriptor.id === "plan-review") {
+            await this.materializePlanChallengeFindings(run, outputs[0].value);
+        }
+        if (descriptor.reviewSubject !== undefined) {
+            await this.materializeReviewerSummary(run, descriptor.reviewSubject, outputs[0].value);
+        }
+        if (descriptor.id === "validation-bicep" || descriptor.id === "validation-terraform") {
+            await this.materializeValidationReport(run, outputs[0].value, descriptor.id);
+        }
         if (descriptor.reviewSubject !== undefined) {
             if (reviewBlockers.length === 0 && descriptor.gate !== undefined) {
                 await this.openRunGate(await this.currentRun(), descriptor.gate, dependencyHash);
@@ -1097,6 +1144,172 @@ export class ApexService {
             outputHash: await this.objects.putJson({ contentType: "text/markdown", content }),
         };
     }
+    requirementsReviewDirectory(run) {
+        return join(this.root, "agent-output", run.projectId, run.runId);
+    }
+    reviewMarkdownText(value) {
+        return value.replaceAll("\\", "\\\\").replaceAll("|", "\\|").replaceAll("\r\n", "\n").replaceAll("\n", "<br>");
+    }
+    async materializeRequirementsReviewPackage(run, requirements, requirementsDocumentHash, events) {
+        const directory = this.requirementsReviewDirectory(run);
+        const document = await this.objects.getJson(requirementsDocumentHash);
+        if (document.contentType !== "text/markdown") {
+            throw new ApexError("APEX_INTERNAL", "Requirements review document is invalid", EXIT_CODES.internal);
+        }
+        const input = this.recordedRequirementsInput(events) ?? {};
+        const text = (value) => {
+            if (value === undefined)
+                return "Deferred";
+            if (typeof value === "string")
+                return this.reviewMarkdownText(value);
+            if (Array.isArray(value))
+                return value.map((item) => this.reviewMarkdownText(item)).join(", ");
+            if (value.kind === "budget")
+                return `${value.amount} ${this.reviewMarkdownText(value.currency)} monthly`;
+            if (value.kind === "recovery")
+                return `RTO ${value.rtoMinutes} minutes; RPO ${value.rpoMinutes} minutes`;
+            if (value.kind === "data-classification")
+                return this.reviewMarkdownText(value.classification);
+            if (value.kind === "compliance")
+                return value.scopes.map((scope) => this.reviewMarkdownText(scope)).join(", ");
+            return value.kind === "deferred" ? `Deferred to ${this.reviewMarkdownText(value.owner)}` : "Unknown";
+        };
+        const list = (value) => {
+            if (!Array.isArray(value) || value.length === 0)
+                return "- None recorded.";
+            return value.map((item) => `- ${this.reviewMarkdownText(item)}`).join("\n");
+        };
+        await mkdir(directory, { recursive: true });
+        await Promise.all([
+            atomicWriteBytes(join(directory, "01-requirements.md"), Buffer.from(document.content, "utf8")),
+            atomicWriteBytes(join(directory, "README.md"), Buffer.from(`# ${this.reviewMarkdownText(run.projectId)}\n\nGenerated Gate 1 review package for run \`${this.reviewMarkdownText(run.runId)}\`. The APEX kernel state remains authoritative.\n\n- Environment: ${this.reviewMarkdownText(run.environment)}\n- Business context: ${this.reviewMarkdownText(requirements.businessContext ?? "Deferred")}\n- Requirements document hash: ${requirementsDocumentHash}\n- Review status: challenger findings pending\n`, "utf8")),
+            atomicWriteBytes(join(directory, "service-recommendations.md"), Buffer.from(`# Service Recommendations\n\nThese are user-reviewed candidate services, not Architecture decisions.\n\n## Candidate Services\n${list(input["service-preferences"])}\n\n## Recommendation Rationale\n${this.reviewMarkdownText(requirements.architectureHandoff ?? "Architecture must evaluate the candidate services against approved requirements and current evidence.")}\n\n## Constraints\n- Retained services: ${text(input["retained-services"])}\n- Prohibited services: ${text(input["prohibited-services"])}\n- Environment overrides: ${text(input["environment-overrides"])}\n\nArchitecture must validate candidates against approved requirements, governance, and current evidence.\n`, "utf8")),
+            atomicWriteBytes(join(directory, "sku-preferences.md"), Buffer.from(`# SKU Preferences\n\nUser constraints only. Architecture owns SKU selection.\n\n- Preference: ${text(input["sku-preferences"])}\n- Budget posture: ${text(input.budget)}\n- Scale: ${text(input.scale)}\n`, "utf8")),
+            atomicWriteBytes(join(directory, "challenger-findings.md"), Buffer.from("# Challenger Findings\n\nRequirements challenger review is pending. Gate 1 cannot be approved until the reviewer completes this document.\n", "utf8")),
+        ]);
+    }
+    async materializeRequirementsChallengeFindings(run, review) {
+        const findings = review.findings.length === 0
+            ? "No challenger findings remain open."
+            : review.findings
+                .map(({ id, severity, title, detail, resolution }) => `## ${this.reviewMarkdownText(id)}: ${this.reviewMarkdownText(title)}\n\n- Severity: ${this.reviewMarkdownText(severity)}\n- Finding: ${this.reviewMarkdownText(detail)}${resolution === undefined ? "" : `\n- Resolution: ${this.reviewMarkdownText(resolution)}`}`)
+                .join("\n\n");
+        await atomicWriteBytes(join(this.requirementsReviewDirectory(run), "challenger-findings.md"), Buffer.from(`# Challenger Findings\n\n${findings}\n`, "utf8"));
+    }
+    architectureReviewDirectory(run) {
+        return join(this.root, "agent-output", run.projectId, run.runId, "architecture");
+    }
+    async materializeArchitectureReviewPackage(run, architecture, cost, decisions, hashes) {
+        const directory = this.architectureReviewDirectory(run);
+        const list = (items) => items.length === 0 ? "- None." : items.map((item) => `- ${this.reviewMarkdownText(item)}`).join("\n");
+        const table = (headers, rows) => [
+            `| ${headers.join(" | ")} |`,
+            `| ${headers.map(() => "---").join(" | ")} |`,
+            ...rows.map((row) => `| ${row.join(" | ")} |`),
+        ].join("\n");
+        const costRows = cost.lineItems.map((item) => [
+            this.reviewMarkdownText(item.service),
+            this.reviewMarkdownText(item.sku),
+            String(item.quantity),
+            `${item.monthlyCost.toFixed(2)} ${this.reviewMarkdownText(cost.currency)}`,
+            this.reviewMarkdownText(item.uncertainty.confidence),
+        ]);
+        const skuRows = decisions.skuDecisions.map((decision) => [
+            this.reviewMarkdownText(decision.logicalId),
+            this.reviewMarkdownText(decision.service),
+            this.reviewMarkdownText(decision.sku),
+            String(decision.quantity),
+            this.reviewMarkdownText(decision.rationale),
+        ]);
+        await mkdir(directory, { recursive: true });
+        await Promise.all([
+            atomicWriteBytes(join(directory, "README.md"), Buffer.from(`# ${this.reviewMarkdownText(architecture.title)}\n\nGenerated Gate 2 review package for run \`${this.reviewMarkdownText(run.runId)}\`. The APEX kernel state remains authoritative.\n\n- Architecture hash: ${hashes.architecture}\n- Cost estimate hash: ${hashes["cost-estimate"]}\n- Decision manifest hash: ${hashes["workload-decision-manifest"]}\n- Review status: challenger findings pending\n`, "utf8")),
+            atomicWriteBytes(join(directory, "architecture-assessment.md"), Buffer.from(`# Architecture Assessment\n\n## Summary\n\n${this.reviewMarkdownText(architecture.summary)}\n\n## Components\n\n${table(["ID", "Service", "Purpose", "Requirements"], architecture.components.map((component) => [
+                this.reviewMarkdownText(component.id),
+                this.reviewMarkdownText(component.service),
+                this.reviewMarkdownText(component.purpose),
+                component.requirementIds.map((id) => this.reviewMarkdownText(id)).join(", "),
+            ]))}\n\n## Five WAF Pillars\n\n### Security\n\n${list(architecture.decisions)}\n\n### Reliability\n\n${list(decisions.sloDecisions.map((decision) => `${decision.logicalId}: ${decision.availabilityPercent}% availability, RTO ${decision.rtoMinutes}m, RPO ${decision.rpoMinutes}m`))}\n\n### Performance Efficiency\n\n- Review component capacity and scale decisions in the SKU comparison.\n\n### Cost Optimization\n\n- Review the current evidence-backed cost estimate.\n\n### Operational Excellence\n\n${list(architecture.risks)}\n\n## Alternatives And Trade-offs\n\nUser-confirmed decisions:\n${list(architecture.decisions)}\n\n## Risks\n\n${list(architecture.risks)}\n`, "utf8")),
+            atomicWriteBytes(join(directory, "cost-estimate.md"), Buffer.from(`# Cost Estimate\n\n- Pricing date: ${this.reviewMarkdownText(cost.pricingDate)}\n- Monthly total: ${cost.totalMonthlyCost.toFixed(2)} ${this.reviewMarkdownText(cost.currency)}\n\n## Line Items\n\n${table(["Service", "SKU", "Quantity", "Monthly", "Confidence"], costRows)}\n\n## Evidence Appendix\n\n${cost.lineItems.map((item) => `- ${this.reviewMarkdownText(item.service)} / ${this.reviewMarkdownText(item.sku)}: ${this.reviewMarkdownText(item.source.provider)} — ${this.reviewMarkdownText(item.source.uri)} — retrieved ${this.reviewMarkdownText(item.source.retrievedAt)}; uncertainty ${this.reviewMarkdownText(item.uncertainty.basis)}`).join("\n")}\n\n## Assumptions\n\n${list(cost.assumptions)}\n`, "utf8")),
+            atomicWriteBytes(join(directory, "sku-comparison.md"), Buffer.from(`# SKU Comparison\n\n${table(["Logical ID", "Service", "Selected SKU", "Quantity", "Rationale"], skuRows)}\n\nThese are user-confirmed Architecture decisions. Alternatives and rejected options must be recorded in the architecture assessment before Gate 2 approval.\n`, "utf8")),
+            atomicWriteBytes(join(directory, "challenger-findings.md"), Buffer.from("# Challenger Findings\n\nArchitecture challenger review is pending. Gate 2 cannot be approved until the reviewer completes this document.\n", "utf8")),
+        ]);
+    }
+    async materializeArchitectureChallengeFindings(run, review) {
+        const findings = review.findings.length === 0
+            ? "No challenger findings remain open."
+            : review.findings
+                .map(({ id, severity, title, detail, resolution }) => `## ${this.reviewMarkdownText(id)}: ${this.reviewMarkdownText(title)}\n\n- Severity: ${this.reviewMarkdownText(severity)}\n- Finding: ${this.reviewMarkdownText(detail)}${resolution === undefined ? "" : `\n- Resolution: ${this.reviewMarkdownText(resolution)}`}`)
+                .join("\n\n");
+        await atomicWriteBytes(join(this.architectureReviewDirectory(run), "challenger-findings.md"), Buffer.from(`# Challenger Findings\n\n${findings}\n`, "utf8"));
+    }
+    planReviewDirectory(run) {
+        return join(this.root, "agent-output", run.projectId, run.runId, "plan");
+    }
+    async materializePlanReviewPackage(run, intent, binding, inputs, hashes) {
+        const directory = this.planReviewDirectory(run);
+        const table = (headers, rows) => [
+            `| ${headers.join(" | ")} |`,
+            `| ${headers.map(() => "---").join(" | ")} |`,
+            ...rows.map((row) => `| ${row.join(" | ")} |`),
+        ].join("\n");
+        const resourceRows = intent.resources.map((resource) => [
+            this.reviewMarkdownText(resource.id),
+            this.reviewMarkdownText(resource.type),
+            this.reviewMarkdownText(resource.purpose),
+            resource.dependsOn.map((dependency) => this.reviewMarkdownText(dependency)).join(", "),
+            resource.controls.map((control) => this.reviewMarkdownText(control)).join(", "),
+        ]);
+        const bindingRows = Object.entries(binding.resourceBindings).map(([id, value]) => [
+            this.reviewMarkdownText(id),
+            this.reviewMarkdownText(value.implementation),
+            this.reviewMarkdownText(value.version),
+            this.reviewMarkdownText(JSON.stringify(value.parameters)),
+        ]);
+        const inputRows = Object.entries(inputs.inputs).map(([name, value]) => [
+            this.reviewMarkdownText(name),
+            value.kind === "value" ? "value" : "secret-reference",
+            this.reviewMarkdownText(value.kind === "value" ? String(value.value) : `${value.provider}:${value.reference}`),
+        ]);
+        await mkdir(directory, { recursive: true });
+        await Promise.all([
+            atomicWriteBytes(join(directory, "README.md"), Buffer.from(`# Implementation Plan\n\nGenerated Gate 3 review package for run \`${this.reviewMarkdownText(run.runId)}\`. The APEX kernel state remains authoritative.\n\n- Intent hash: ${hashes["implementation-intent"]}\n- Binding hash: ${hashes["iac-binding"]}\n- Environment input hash: ${hashes["environment-inputs"]}\n- Review status: challenger findings pending\n`, "utf8")),
+            atomicWriteBytes(join(directory, "implementation-plan.md"), Buffer.from(`# Implementation Plan\n\n## Logical Resources\n\n${table(["ID", "Type", "Purpose", "Depends On", "Controls"], resourceRows)}\n\n## Outputs\n\n${intent.outputs.map((output) => `- ${this.reviewMarkdownText(output)}`).join("\n")}\n\n## Source Artifacts\n\n${Object.entries(intent.sourceHashes)
+                .map(([kind, hash]) => `- ${this.reviewMarkdownText(kind)}: ${hash}`)
+                .join("\n")}\n`, "utf8")),
+            atomicWriteBytes(join(directory, "iac-binding.md"), Buffer.from(`# IaC Binding\n\n- Track: ${this.reviewMarkdownText(binding.track)}\n- Intent hash: ${binding.intentHash}\n\n${table(["Logical ID", "Implementation", "Version", "Parameters"], bindingRows)}\n`, "utf8")),
+            atomicWriteBytes(join(directory, "environment-inputs.md"), Buffer.from(`# Environment Inputs\n\n- Environment: ${this.reviewMarkdownText(inputs.environment)}\n\n${table(["Name", "Kind", "Reference or Value"], inputRows)}\n`, "utf8")),
+            atomicWriteBytes(join(directory, "challenger-findings.md"), Buffer.from("# Challenger Findings\n\nImplementation-plan challenger review is pending. Gate 3 cannot be approved until the reviewer completes this document.\n", "utf8")),
+        ]);
+    }
+    async materializePlanChallengeFindings(run, review) {
+        const findings = review.findings.length === 0
+            ? "No challenger findings remain open."
+            : review.findings
+                .map(({ id, severity, title, detail, resolution }) => `## ${this.reviewMarkdownText(id)}: ${this.reviewMarkdownText(title)}\n\n- Severity: ${this.reviewMarkdownText(severity)}\n- Finding: ${this.reviewMarkdownText(detail)}${resolution === undefined ? "" : `\n- Resolution: ${this.reviewMarkdownText(resolution)}`}`)
+                .join("\n\n");
+        await atomicWriteBytes(join(this.planReviewDirectory(run), "challenger-findings.md"), Buffer.from(`# Challenger Findings\n\n${findings}\n`, "utf8"));
+    }
+    async materializeReviewerSummary(run, subject, review) {
+        const findings = review.findings.length === 0
+            ? "No findings remain open."
+            : review.findings
+                .map(({ id, severity, disposition, title, detail, evidenceRefs, resolution }) => `## ${this.reviewMarkdownText(id)}: ${this.reviewMarkdownText(title)}\n\n- Severity: ${this.reviewMarkdownText(severity)}\n- Disposition: ${this.reviewMarkdownText(disposition)}\n- Finding: ${this.reviewMarkdownText(detail)}\n- Evidence: ${evidenceRefs.map((reference) => this.reviewMarkdownText(reference)).join(", ") || "None"}${resolution === undefined ? "" : `\n- Resolution: ${this.reviewMarkdownText(resolution)}`}`)
+                .join("\n\n");
+        const directory = join(this.root, "agent-output", run.projectId, run.runId, "reviews");
+        await mkdir(directory, { recursive: true });
+        await atomicWriteBytes(join(directory, `${subject}-findings.md`), Buffer.from(`# ${this.reviewMarkdownText(subject)} Challenger Findings\n\n- Reviewed artifact kind: ${this.reviewMarkdownText(review.subjectKind)}\n- Review subject hash: ${review.subjectHash}\n- Reviewed at: ${this.reviewMarkdownText(review.reviewedAt)}\n\n${findings}\n`, "utf8"));
+    }
+    async materializeValidationReport(run, evidence, taskType) {
+        const directory = join(this.root, "agent-output", run.projectId, run.runId, "validation");
+        const entries = evidence.entries.length === 0
+            ? "- No validation evidence entries were produced."
+            : evidence.entries
+                .map(({ kind, hash, bytes, required, retention }) => `- ${this.reviewMarkdownText(kind)}: ${hash} (${bytes} bytes; ${required ? "required" : "optional"}; ${this.reviewMarkdownText(retention)})`)
+                .join("\n");
+        await mkdir(directory, { recursive: true });
+        await atomicWriteBytes(join(directory, "validation-report.md"), Buffer.from(`# Validation Report\n\n- Task: ${this.reviewMarkdownText(taskType)}\n- Track: ${this.reviewMarkdownText(run.iacTool)}\n- Created: ${this.reviewMarkdownText(evidence.createdAt)}\n- Verdict: accepted deterministic validation evidence\n\n## Validator Evidence\n\n${entries}\n\nThe Validator reports evidence only. Artifact repair, risk acceptance, and gate decisions remain with their authorized owners.\n`, "utf8"));
+    }
     async requirementsDocumentMarkdown(value, artifactHash) {
         if (!Value.Check(RequirementsV1Schema, value)) {
             throw new ApexError("APEX_INTERNAL", "Requirements document source is invalid", EXIT_CODES.internal);
@@ -1272,6 +1485,8 @@ export class ApexService {
             ...(previewHash === undefined ? {} : { previewHash }),
             ...(validatorIds.length === 0 ? {} : { validatorIds }),
         }, gateNumber === 4 ? (events.at(-1)?.hash ?? null) : undefined);
+        if (gateNumber === 4)
+            await this.materializeOperationsApprovalPackage(run, approval, approvalHash);
         return approval;
     }
     async preview(options) {
@@ -1343,6 +1558,7 @@ export class ApexService {
                 ...(validation.omittedValidatorIds.length === 0 ? {} : { omittedValidatorIds: validation.omittedValidatorIds }),
                 ...(attestationHash === undefined ? {} : { attestationHash }),
             });
+            await this.materializeOperationsPreviewPackage(run, preview, previewObjectHash);
             await this.openRunGate(await this.currentRun(), 4, preview.previewHash);
             return preview;
         }
@@ -1390,9 +1606,64 @@ export class ApexService {
             evidenceMode: validation.evidenceMode,
             ...(validation.omittedValidatorIds.length === 0 ? {} : { omittedValidatorIds: validation.omittedValidatorIds }),
         });
+        await this.materializeOperationsPreviewPackage(run, preview, previewObjectHash);
         await this.openRunGate(await this.currentRun(), 4, preview.previewHash);
         return preview;
     }
+    operationsReviewDirectory(run) {
+        return join(this.root, "agent-output", run.projectId, run.runId, "operations");
+    }
+    async materializeOperationsPreviewPackage(run, preview, previewObjectHash) {
+        const directory = this.operationsReviewDirectory(run);
+        const changes = preview.changes.length === 0
+            ? "- No changes."
+            : preview.changes
+                .map(({ resourceId, action, material, details }) => {
+                const detail = details === undefined ? "" : `: ${this.reviewMarkdownText(details)}`;
+                return `- ${this.reviewMarkdownText(action)} ${this.reviewMarkdownText(resourceId)}${material ? " (material)" : ""}${detail}`;
+            })
+                .join("\n");
+        const previewContent = [
+            "# Deployment Preview",
+            "",
+            `- Operation: ${this.reviewMarkdownText(preview.operation)}`,
+            `- Target: ${this.reviewMarkdownText(preview.target)}`,
+            `- Expires: ${this.reviewMarkdownText(preview.expiresAt)}`,
+            "- Recipient: bound by the Gate 4 approval evidence",
+            "",
+            "## Changes",
+            "",
+            changes,
+            "",
+            "## Blockers",
+            "",
+            preview.blockers.length === 0
+                ? "- None."
+                : preview.blockers.map((blocker) => `- ${this.reviewMarkdownText(blocker)}`).join("\n"),
+            "",
+        ].join("\n");
+        await mkdir(directory, { recursive: true });
+        await Promise.all([
+            atomicWriteBytes(join(directory, "README.md"), Buffer.from(`# Operations Review\n\nGenerated from exact kernel evidence for run \`${this.reviewMarkdownText(run.runId)}\`. The APEX kernel state remains authoritative.\n\n- Preview hash: ${preview.previewHash}\n- Preview object hash: ${previewObjectHash}\n- Gate 4 status: pending human terminal approval\n`, "utf8")),
+            atomicWriteBytes(join(directory, "deployment-preview.md"), Buffer.from(previewContent, "utf8")),
+        ]);
+    }
+    async materializeOperationsApprovalPackage(run, approval, approvalHash) {
+        const content = [
+            "# Gate 4 Approval",
+            "",
+            `- Decision: ${this.reviewMarkdownText(approval.decision)}`,
+            `- Actor: ${this.reviewMarkdownText(approval.actor)}`,
+            `- Recipient: ${this.reviewMarkdownText(approval.recipientIdentity ?? "Unavailable")}`,
+            `- Preview hash: ${approval.previewHash ?? "Unavailable"}`,
+            `- Approval hash: ${approvalHash}`,
+            `- Expires: ${approval.expiresAt === undefined ? "Unavailable" : this.reviewMarkdownText(approval.expiresAt)}`,
+            "",
+            "This approval authorizes only the exact preview above.",
+            "",
+        ].join("\n");
+        await atomicWriteBytes(join(this.operationsReviewDirectory(run), "approval.md"), Buffer.from(content, "utf8"));
+    }
     async currentPreview() {
         const run = await this.currentRun();
         const events = await this.journal(run).replay();
@@ -2201,6 +2472,15 @@ export class ApexService {
         return this.inputRequest(event, run.ownerEpoch);
     }
     requirementsIntakeQuestions(round, events) {
+        if (round.round === "service-preferences") {
+            const scenario = this.recordedRequirementsInput(events)?.["delivery-scenario"];
+            if (scenario !== "migration" && scenario !== "modernization" && scenario !== "extension")
+                return round.questions;
+            return [
+                { id: "retained-services", prompt: "List Azure services or integrations that must be retained." },
+                ...round.questions,
+            ];
+        }
         if (round.round !== "workload-pattern")
             return round.questions;
         const scenario = this.recordedRequirementsInput(events)?.["delivery-scenario"];
@@ -2496,6 +2776,23 @@ export class ApexService {
             return typeof text === "string" && text.length > 0 ? [`${id}: ${text}`] : [];
         });
         const unknowns = requirements.filter(({ status }) => status !== "confirmed").map(({ statement }) => statement);
+        const text = (id) => {
+            const value = this.renderInputValue(input?.[id]);
+            return typeof value === "string" && value.length > 0 ? value : undefined;
+        };
+        const joinValues = (...ids) => {
+            const values = ids.map(text).filter((value) => value !== undefined);
+            return values.length === 0 ? undefined : values.join("; ");
+        };
+        const reviewFields = {
+            businessContext: joinValues("industry", "delivery-scenario", "workload-pattern"),
+            successCriteria: text("scale"),
+            nonFunctionalRequirements: text("availability-recovery") ?? text("recovery"),
+            securityAndCompliance: joinValues("security-controls", "compliance", "authentication", "data-sensitivity"),
+            budgetAndOperations: joinValues("budget", "operations"),
+            regionalConstraints: text("region"),
+            architectureHandoff: text("service-preferences"),
+        };
         return {
             requirements: requirements.length > 0
                 ? requirements
@@ -2510,6 +2807,7 @@ export class ApexService {
                 ],
             assumptions,
             unknowns,
+            ...Object.fromEntries(Object.entries(reviewFields).filter(([, value]) => value !== undefined)),
         };
     }
     renderInputValue(value) {

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const APEX_VERSION: "0.10.0-next.1";
+export declare const APEX_VERSION: "0.10.0-next.3";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,2 +1,2 @@
-export const APEX_VERSION = "0.10.0-next.1";
+export const APEX_VERSION = "0.10.0-next.3";
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apexops/cli",
-  "version": "0.10.0-next.1",
+  "version": "0.10.0-next.3",
   "description": "Portable no-shell CLI and MCP facade for APEX",
   "license": "MIT",
   "repository": {
@@ -32,10 +32,10 @@
     "assets"
   ],
   "dependencies": {
-    "@apexops/capabilities": "0.10.0-next.1",
-    "@apexops/contracts": "0.10.0-next.1",
-    "@apexops/kernel": "0.10.0-next.1",
-    "@apexops/renderers": "0.10.0-next.1",
+    "@apexops/capabilities": "0.10.0-next.3",
+    "@apexops/contracts": "0.10.0-next.3",
+    "@apexops/kernel": "0.10.0-next.3",
+    "@apexops/renderers": "0.10.0-next.3",
     "@azure/mcp": "3.0.0-beta.37",
     "@hono/node-server": "2.0.11",
     "@modelcontextprotocol/sdk": "1.29.0",