@apexops/cli 0.10.0-next.2 → 0.10.0-next.4

package/assets/client-projection-metadata/copilot-cli-agent-tools.json

@@ -44,11 +44,13 @@
     "apex/projectList",
     "apex/projectUse",
     "apex/projectDelete",
+    "apex/gateDecide",
     "apex/stageArtifact",
     "apex/stageFile",
     "apex/generateIac",
     "apex/validateTask",
     "apex/completeTask",
+    "apex/planComplete",
     "apex/preview",
     "apex/reconcile",
     "apex/inventory",
@@ -72,11 +74,13 @@
     "projectList",
     "projectUse",
     "projectDelete",
+    "gateDecide",
     "stageArtifact",
     "stageFile",
     "generateIac",
     "validateTask",
     "completeTask",
+    "planComplete",
     "preview",
     "reconcile",
     "inventory",

package/assets/client-projections/github-copilot-cli/.github/agents/apex-planner.agent.md

@@ -13,6 +13,7 @@ tools:
   - apex/taskContext
   - apex/stageArtifact
   - apex/completeTask
+  - apex/planComplete
   - azure-resource-manager-mcp/get_retail_prices
   - azure-resource-manager-mcp/query_costs
   - azure-resource-manager-mcp/query_aks_costs
@@ -45,9 +46,9 @@ Gate 3.
   secret reference must include `kind`, `provider`, and `reference`.
 4. Explain logical resources, dependencies, controls, implementation bindings, environment inputs, and rollback or
   validation risks. Ask targeted follow-ups only for unresolved user-owned choices; never infer secret values.
-5. Stage `implementation-intent` first. Use its returned hash as `iac-binding.intentHash`, then stage the binding and
-  environment inputs. Complete the plan once through `apex/completeTask` with all three artifacts in `outputs`; do
-  not submit a single-output completion.
+5. Complete plans through `apex/planComplete` with the implementation intent, binding without `intentHash`, and
+  environment inputs. The kernel derives the canonical intent hash and atomically validates all three outputs. Do not
+  call `apex/completeTask` with a partial plan bundle or a placeholder `intentHash`.
 6. APEX materializes a read-only Gate 3 package at `agent-output/<project>/<run>/plan/`. Report
   `implementation-plan.md`, `iac-binding.md`, `environment-inputs.md`, and `challenger-findings.md` for human review.
 7. When the kernel issues `plan-review`, delegate the exact task to `APEX Reviewer`. Present findings and use targeted

package/assets/client-projections/github-copilot-cli/.github/agents/apex-requirements.agent.md

@@ -58,10 +58,14 @@ candidate Azure services without deciding architecture, and produces a human-rev
   rationale for Architecture.
 7. Stage and submit the typed requirements artifact. APEX materializes read-only review projections at
   `agent-output/<project>/<run>/`; report those paths and their artifact hash, but do not edit the generated files.
-8. When the kernel issues `requirements-review`, delegate the exact task to `APEX Reviewer`. Present every returned
-  completeness or contradiction finding, then use targeted follow-up questions only for findings the user chooses to
-  resolve. Findings must be remediated, accepted with rationale, or explicitly deferred before Gate 1 can open.
-9. When review completes, direct the user to review `01-requirements.md`, `README.md`, `service-recommendations.md`,
+8. Immediately call `apex/nextTask` after submitting requirements. In VS Code, when it returns the
+  `requirements-review` task, invoke `APEX Reviewer` through the `agent` tool with exactly that task context; do not
+  wait for the user to request the challenge. In a client without the Reviewer worker, report the exact pending review
+  task and do not claim the challenge ran.
+9. Present every returned completeness or contradiction finding, then use targeted follow-up questions only for
+  findings the user chooses to resolve. Findings must be remediated, accepted with rationale, or explicitly deferred
+  before Gate 1 can open.
+10. When review completes, direct the user to review `01-requirements.md`, `README.md`, `service-recommendations.md`,
   `sku-preferences.md`, and `challenger-findings.md`. Gate 1 remains a human terminal ceremony; never approve it.
 
 Do not read repository files to discover artifact schemas; `apex/taskContext` is the complete output contract for this

package/assets/client-projections/github-copilot-cli/.github/agents/apex.agent.md

@@ -13,6 +13,7 @@ tools:
   - apex/projectList
   - apex/projectUse
   - apex/projectDelete
+  - apex/gateDecide
   - azure-resource-manager-mcp/get_retail_prices
   - azure-resource-manager-mcp/query_costs
   - azure-resource-manager-mcp/query_aks_costs
@@ -69,6 +70,9 @@ Coordinate APEX without authoring project artifacts or inferring workflow state.
   `apex gate decide --gate <N> --decision <approved|rejected> --actor <USER_ID> --json`. At Gate 4, also require
   review of the exact preview, target, expiry, and approval recipient before directing
   `apex gate decide --gate 4 --decision <approved|rejected> --actor <USER_ID> --recipient <RECIPIENT_ID> --json`.
+9. When the user explicitly says `approve Gate 1`, `approve Gate 2`, `approve Gate 3`, or the equivalent rejection,
+  call `apex/gateDecide` with that gate, decision, and `confirm: true`. The operation derives the actor from the local
+  OS username. Do not use it for Gate 4, and do not infer confirmation from an ambiguous message.
 
 Use the active client projection's question mechanism only for project creation or kernel-owned routing choices. Read
 `.github/skills/apex-workflow/SKILL.md` only when status, resume, or project selection needs more guidance.

package/assets/client-projections/github-copilot-cli/.github/mcp.json

@@ -16,11 +16,13 @@
         "projectList",
         "projectUse",
         "projectDelete",
+        "gateDecide",
         "stageArtifact",
         "stageFile",
         "generateIac",
         "validateTask",
         "completeTask",
+        "planComplete",
         "preview",
         "reconcile",
         "inventory",

package/assets/client-projections/github-copilot-vscode/.github/agents/apex-planner.agent.md

@@ -13,6 +13,7 @@ tools:
   - apex/taskContext
   - apex/stageArtifact
   - apex/completeTask
+  - apex/planComplete
   - azure-resource-manager-mcp/get_retail_prices
   - azure-resource-manager-mcp/query_costs
   - azure-resource-manager-mcp/query_aks_costs
@@ -55,9 +56,9 @@ Gate 3.
   secret reference must include `kind`, `provider`, and `reference`.
 4. Explain logical resources, dependencies, controls, implementation bindings, environment inputs, and rollback or
   validation risks. Ask targeted follow-ups only for unresolved user-owned choices; never infer secret values.
-5. Stage `implementation-intent` first. Use its returned hash as `iac-binding.intentHash`, then stage the binding and
-  environment inputs. Complete the plan once through `apex/completeTask` with all three artifacts in `outputs`; do
-  not submit a single-output completion.
+5. Complete plans through `apex/planComplete` with the implementation intent, binding without `intentHash`, and
+  environment inputs. The kernel derives the canonical intent hash and atomically validates all three outputs. Do not
+  call `apex/completeTask` with a partial plan bundle or a placeholder `intentHash`.
 6. APEX materializes a read-only Gate 3 package at `agent-output/<project>/<run>/plan/`. Report
   `implementation-plan.md`, `iac-binding.md`, `environment-inputs.md`, and `challenger-findings.md` for human review.
 7. When the kernel issues `plan-review`, delegate the exact task to `APEX Reviewer`. Present findings and use targeted

package/assets/client-projections/github-copilot-vscode/.github/agents/apex-requirements.agent.md

@@ -67,10 +67,14 @@ candidate Azure services without deciding architecture, and produces a human-rev
   rationale for Architecture.
 7. Stage and submit the typed requirements artifact. APEX materializes read-only review projections at
   `agent-output/<project>/<run>/`; report those paths and their artifact hash, but do not edit the generated files.
-8. When the kernel issues `requirements-review`, delegate the exact task to `APEX Reviewer`. Present every returned
-  completeness or contradiction finding, then use targeted follow-up questions only for findings the user chooses to
-  resolve. Findings must be remediated, accepted with rationale, or explicitly deferred before Gate 1 can open.
-9. When review completes, direct the user to review `01-requirements.md`, `README.md`, `service-recommendations.md`,
+8. Immediately call `apex/nextTask` after submitting requirements. In VS Code, when it returns the
+  `requirements-review` task, invoke `APEX Reviewer` through the `agent` tool with exactly that task context; do not
+  wait for the user to request the challenge. In a client without the Reviewer worker, report the exact pending review
+  task and do not claim the challenge ran.
+9. Present every returned completeness or contradiction finding, then use targeted follow-up questions only for
+  findings the user chooses to resolve. Findings must be remediated, accepted with rationale, or explicitly deferred
+  before Gate 1 can open.
+10. When review completes, direct the user to review `01-requirements.md`, `README.md`, `service-recommendations.md`,
   `sku-preferences.md`, and `challenger-findings.md`. Gate 1 remains a human terminal ceremony; never approve it.
 
 Do not read repository files to discover artifact schemas; `apex/taskContext` is the complete output contract for this

package/assets/client-projections/github-copilot-vscode/.github/agents/apex.agent.md

@@ -14,6 +14,7 @@ tools:
   - apex/projectList
   - apex/projectUse
   - apex/projectDelete
+  - apex/gateDecide
   - azure-resource-manager-mcp/get_retail_prices
   - azure-resource-manager-mcp/query_costs
   - azure-resource-manager-mcp/query_aks_costs
@@ -88,6 +89,9 @@ Coordinate APEX without authoring project artifacts or inferring workflow state.
   `apex gate decide --gate <N> --decision <approved|rejected> --actor <USER_ID> --json`. At Gate 4, also require
   review of the exact preview, target, expiry, and approval recipient before directing
   `apex gate decide --gate 4 --decision <approved|rejected> --actor <USER_ID> --recipient <RECIPIENT_ID> --json`.
+9. When the user explicitly says `approve Gate 1`, `approve Gate 2`, `approve Gate 3`, or the equivalent rejection,
+  call `apex/gateDecide` with that gate, decision, and `confirm: true`. The operation derives the actor from the local
+  OS username. Do not use it for Gate 4, and do not infer confirmation from an ambiguous message.
 
 Use the active client projection's question mechanism only for project creation or kernel-owned routing choices. Read
 `.github/skills/apex-workflow/SKILL.md` only when status, resume, or project selection needs more guidance.

package/assets/config/runtime-bundle.v1.json

@@ -1,31 +1,31 @@
 {
   "schemaVersion": "1.0.0",
-  "bundleVersion": "0.10.0-next.2",
+  "bundleVersion": "0.10.0-next.4",
   "capabilityProtocolVersion": "1.0.0",
   "components": {
     "cli": {
       "source": "local",
-      "version": "0.10.0-next.2"
+      "version": "0.10.0-next.4"
     },
     "contracts": {
       "source": "local",
-      "version": "0.10.0-next.2"
+      "version": "0.10.0-next.4"
     },
     "kernel": {
       "source": "local",
-      "version": "0.10.0-next.2"
+      "version": "0.10.0-next.4"
     },
     "capabilities": {
       "source": "local",
-      "version": "0.10.0-next.2"
+      "version": "0.10.0-next.4"
     },
     "renderers": {
       "source": "local",
-      "version": "0.10.0-next.2"
+      "version": "0.10.0-next.4"
     },
     "customizationBundle": {
       "source": "local",
-      "version": "0.10.0-next.2",
+      "version": "0.10.0-next.4",
       "manifest": "@apexops/cli/assets/customizations/manifest.json",
       "assetManifest": "@apexops/cli/assets/manifest.json",
       "compositionId": "apex-managed-workspace"

package/assets/customizations/.github/agents/apex-planner.agent.md

@@ -12,6 +12,7 @@ tools:
   - apex/taskContext
   - apex/stageArtifact
   - apex/completeTask
+  - apex/planComplete
   - azure-resource-manager-mcp/get_retail_prices
   - azure-resource-manager-mcp/query_costs
   - azure-resource-manager-mcp/query_aks_costs
@@ -48,9 +49,9 @@ Gate 3.
   secret reference must include `kind`, `provider`, and `reference`.
 4. Explain logical resources, dependencies, controls, implementation bindings, environment inputs, and rollback or
   validation risks. Ask targeted follow-ups only for unresolved user-owned choices; never infer secret values.
-5. Stage `implementation-intent` first. Use its returned hash as `iac-binding.intentHash`, then stage the binding and
-  environment inputs. Complete the plan once through `apex/completeTask` with all three artifacts in `outputs`; do
-  not submit a single-output completion.
+5. Complete plans through `apex/planComplete` with the implementation intent, binding without `intentHash`, and
+  environment inputs. The kernel derives the canonical intent hash and atomically validates all three outputs. Do not
+  call `apex/completeTask` with a partial plan bundle or a placeholder `intentHash`.
 6. APEX materializes a read-only Gate 3 package at `agent-output/<project>/<run>/plan/`. Report
   `implementation-plan.md`, `iac-binding.md`, `environment-inputs.md`, and `challenger-findings.md` for human review.
 7. When the kernel issues `plan-review`, delegate the exact task to `APEX Reviewer`. Present findings and use targeted

package/assets/customizations/.github/agents/apex-requirements.agent.md

@@ -60,10 +60,14 @@ candidate Azure services without deciding architecture, and produces a human-rev
   rationale for Architecture.
 7. Stage and submit the typed requirements artifact. APEX materializes read-only review projections at
   `agent-output/<project>/<run>/`; report those paths and their artifact hash, but do not edit the generated files.
-8. When the kernel issues `requirements-review`, delegate the exact task to `APEX Reviewer`. Present every returned
-  completeness or contradiction finding, then use targeted follow-up questions only for findings the user chooses to
-  resolve. Findings must be remediated, accepted with rationale, or explicitly deferred before Gate 1 can open.
-9. When review completes, direct the user to review `01-requirements.md`, `README.md`, `service-recommendations.md`,
+8. Immediately call `apex/nextTask` after submitting requirements. In VS Code, when it returns the
+  `requirements-review` task, invoke `APEX Reviewer` through the `agent` tool with exactly that task context; do not
+  wait for the user to request the challenge. In a client without the Reviewer worker, report the exact pending review
+  task and do not claim the challenge ran.
+9. Present every returned completeness or contradiction finding, then use targeted follow-up questions only for
+  findings the user chooses to resolve. Findings must be remediated, accepted with rationale, or explicitly deferred
+  before Gate 1 can open.
+10. When review completes, direct the user to review `01-requirements.md`, `README.md`, `service-recommendations.md`,
   `sku-preferences.md`, and `challenger-findings.md`. Gate 1 remains a human terminal ceremony; never approve it.
 
 Do not read repository files to discover artifact schemas; `apex/taskContext` is the complete output contract for this

package/assets/customizations/.github/agents/apex.agent.md

@@ -13,6 +13,7 @@ tools:
   - apex/projectList
   - apex/projectUse
   - apex/projectDelete
+  - apex/gateDecide
   - azure-resource-manager-mcp/get_retail_prices
   - azure-resource-manager-mcp/query_costs
   - azure-resource-manager-mcp/query_aks_costs
@@ -81,6 +82,9 @@ Coordinate APEX without authoring project artifacts or inferring workflow state.
   `apex gate decide --gate <N> --decision <approved|rejected> --actor <USER_ID> --json`. At Gate 4, also require
   review of the exact preview, target, expiry, and approval recipient before directing
   `apex gate decide --gate 4 --decision <approved|rejected> --actor <USER_ID> --recipient <RECIPIENT_ID> --json`.
+9. When the user explicitly says `approve Gate 1`, `approve Gate 2`, `approve Gate 3`, or the equivalent rejection,
+  call `apex/gateDecide` with that gate, decision, and `confirm: true`. The operation derives the actor from the local
+  OS username. Do not use it for Gate 4, and do not infer confirmation from an ambiguous message.
 
 Use the active client projection's question mechanism only for project creation or kernel-owned routing choices. Read
 `.github/skills/apex-workflow/SKILL.md` only when status, resume, or project selection needs more guidance.

package/assets/customizations/.github/mcp.json

@@ -16,11 +16,13 @@
         "projectList",
         "projectUse",
         "projectDelete",
+        "gateDecide",
         "stageArtifact",
         "stageFile",
         "generateIac",
         "validateTask",
         "completeTask",
+        "planComplete",
         "preview",
         "reconcile",
         "inventory",

package/assets/customizations/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.10.0-next.2",
+  "version": "0.10.0-next.4",
   "bundle": {
     "id": "apex-managed-workspace",
     "authority": "npm:@apexops/cli",

package/assets/manifest.json

@@ -1,7 +1,7 @@
 {
   "version": 1,
   "sources": {
-    "customizations": "0.10.0-next.2",
+    "customizations": "0.10.0-next.4",
     "config": "1.0.0"
   },
   "composition": {
@@ -190,7 +190,7 @@
         "client-projections/github-copilot-cli/.github/skills/apex-terraform-test/references/test-design.md",
         "client-projections/github-copilot-cli/.github/skills/apex-workflow/SKILL.md"
       ],
-      "digest": "5e312275847b3433ec55ce0d35d0b7c55025247a958a5b239af806c2f5621498"
+      "digest": "f0890a928676c476f4de0e3260b65ab95cf89c34e45c5a8b66ff394ed88fdb09"
     },
     {
       "id": "github-copilot-vscode",
@@ -338,7 +338,7 @@
         "client-projections/github-copilot-vscode/.github/skills/apex-workflow/SKILL.md",
         "client-projections/github-copilot-vscode/.vscode/mcp.json"
       ],
-      "digest": "e879f9c46bbf2f8de5eb76449d41a11af533714148331441f2f0cb6f5660c160"
+      "digest": "2fc2af31e4f004f6ec5803f88c8d440896f960b45bed8af535d8e5b655a44e22"
     }
   ],
   "files": [
@@ -378,8 +378,8 @@
         "path": "tools/registry/copilot-cli-agent-tools.json",
         "mapping": "copilot-cli-tool-inventory"
       },
-      "sha256": "eaa67e61da99a42fca622f5e0c75f2778bf19d78016f176e0ac0a4620f6e1dca",
-      "bytes": 3008
+      "sha256": "a6278e6ab4784d81f84b3b036a360e517e72844478b1ba74718b18903a268fdc",
+      "bytes": 3094
     },
     {
       "path": "client-projections/github-copilot-cli/.github/agents/apex-architect.agent.md",
@@ -418,13 +418,13 @@
         "composition": "client-projections",
         "roleId": "planning",
         "sourcePath": ".github/agents/apex-planner.agent.md",
-        "sourceHash": "15934864666d9b4f3936f526942d1f56c1a5e8fc608b5ce2047db139eab9d2fa",
+        "sourceHash": "9a6bb99cd4784f7afc84f49168933ff8ae0f234386a55ad962382272cb5083ec",
         "clientId": "github-copilot-cli",
         "target": ".github/agents/apex-planner.agent.md",
         "adapterVersion": "1.1.0"
       },
-      "sha256": "039d8f4d5ca4b5b6920a6bce4e052acb6a81d20844668bc5d6da61a1ed6a211b",
-      "bytes": 4661
+      "sha256": "92a748d52adf590387cd819f565172cd4a023390afb17337a571e6feb784de17",
+      "bytes": 4724
     },
     {
       "path": "client-projections/github-copilot-cli/.github/agents/apex-requirements.agent.md",
@@ -433,13 +433,13 @@
         "composition": "client-projections",
         "roleId": "requirements",
         "sourcePath": ".github/agents/apex-requirements.agent.md",
-        "sourceHash": "1e7c8d6d7992fc5d59499f662f00a20fe9814c80fb5a321cb063ec5067ebf04f",
+        "sourceHash": "87ac351f363c7b782ebbdeda40f15d6e8a7faabc2f400ffadcb0bca4ce66b2f3",
         "clientId": "github-copilot-cli",
         "target": ".github/agents/apex-requirements.agent.md",
         "adapterVersion": "1.1.0"
       },
-      "sha256": "00a54b4a8f43b47184ec72f62f730e0dbe1ad3319ea0c09300b9cecf28cae8db",
-      "bytes": 5143
+      "sha256": "6843fcf9f5ff5f7a764eb9bc8253ab2baa06195ea20f1febcf38f366839639a9",
+      "bytes": 5432
     },
     {
       "path": "client-projections/github-copilot-cli/.github/agents/apex.agent.md",
@@ -448,13 +448,13 @@
         "composition": "client-projections",
         "roleId": "coordinator",
         "sourcePath": ".github/agents/apex.agent.md",
-        "sourceHash": "a9a64bb9f743ba73f0ea2237f0e2702a1881dee7f90ca83f9cf588de37bbed45",
+        "sourceHash": "a7440e67b68177d9877a9d5b2201917d1bdf56fda9431ef106ffa1cb7a30298c",
         "clientId": "github-copilot-cli",
         "target": ".github/agents/apex.agent.md",
         "adapterVersion": "1.1.0"
       },
-      "sha256": "73f6d4fb101c4b7eff22472eca46c931c6b7e96a72810c0f10136e6568d39aea",
-      "bytes": 4908
+      "sha256": "65da2837858c0251432818f2819f21877253152d5626fd4715c79ce47ff0fc4f",
+      "bytes": 5261
     },
     {
       "path": "client-projections/github-copilot-cli/.github/copilot-instructions.md",
@@ -773,10 +773,10 @@
         "target": ".github/mcp.json",
         "adapterVersion": "1.1.0",
         "sourcePath": ".github/mcp.json",
-        "sourceHash": "dd39613c4d01b6f7146afe6c09548d6153fbfad550dba6bfcdbecf8188cb2209"
+        "sourceHash": "dda22ba7b91f17796dc5bc723bdcd66a1ba5f9b971bddb080b21d68062d19a8c"
       },
-      "sha256": "dd39613c4d01b6f7146afe6c09548d6153fbfad550dba6bfcdbecf8188cb2209",
-      "bytes": 1350
+      "sha256": "dda22ba7b91f17796dc5bc723bdcd66a1ba5f9b971bddb080b21d68062d19a8c",
+      "bytes": 1396
     },
     {
       "path": "client-projections/github-copilot-cli/.github/skills/apex-architecture/SKILL.md",
@@ -2384,13 +2384,13 @@
         "composition": "client-projections",
         "roleId": "planning",
         "sourcePath": ".github/agents/apex-planner.agent.md",
-        "sourceHash": "15934864666d9b4f3936f526942d1f56c1a5e8fc608b5ce2047db139eab9d2fa",
+        "sourceHash": "9a6bb99cd4784f7afc84f49168933ff8ae0f234386a55ad962382272cb5083ec",
         "clientId": "github-copilot-vscode",
         "target": ".github/agents/apex-planner.agent.md",
         "adapterVersion": "1.1.0"
       },
-      "sha256": "1423df4a00c325f3c07eb7906da4a72990f6a221c7f271333fb22e31ae99ffcd",
-      "bytes": 4969
+      "sha256": "d62130949707e65501d62452a3cec09918781abed2bd266d64383d9e6717478e",
+      "bytes": 5032
     },
     {
       "path": "client-projections/github-copilot-vscode/.github/agents/apex-requirements.agent.md",
@@ -2399,13 +2399,13 @@
         "composition": "client-projections",
         "roleId": "requirements",
         "sourcePath": ".github/agents/apex-requirements.agent.md",
-        "sourceHash": "1e7c8d6d7992fc5d59499f662f00a20fe9814c80fb5a321cb063ec5067ebf04f",
+        "sourceHash": "87ac351f363c7b782ebbdeda40f15d6e8a7faabc2f400ffadcb0bca4ce66b2f3",
         "clientId": "github-copilot-vscode",
         "target": ".github/agents/apex-requirements.agent.md",
         "adapterVersion": "1.1.0"
       },
-      "sha256": "d053deeb51609ad24e36192f14bc7407b84c425bc87d6f607cba50ac7d295989",
-      "bytes": 5447
+      "sha256": "e69cce296049d7f9ac411889e8c094cb4278957fb4d35520e9ebb4b24a036e61",
+      "bytes": 5736
     },
     {
       "path": "client-projections/github-copilot-vscode/.github/agents/apex-reviewer.agent.md",
@@ -2444,13 +2444,13 @@
         "composition": "client-projections",
         "roleId": "coordinator",
         "sourcePath": ".github/agents/apex.agent.md",
-        "sourceHash": "a9a64bb9f743ba73f0ea2237f0e2702a1881dee7f90ca83f9cf588de37bbed45",
+        "sourceHash": "a7440e67b68177d9877a9d5b2201917d1bdf56fda9431ef106ffa1cb7a30298c",
         "clientId": "github-copilot-vscode",
         "target": ".github/agents/apex.agent.md",
         "adapterVersion": "1.1.0"
       },
-      "sha256": "cb0aea4d710e8974d137475db3edbc772a51a76696c4d6f738364ec940ae9c5a",
-      "bytes": 5726
+      "sha256": "1ebb9da1303aff993228efdc1bb29dde70c6ce9c3cb1b61306659ae2a7ecc6f2",
+      "bytes": 6079
     },
     {
       "path": "client-projections/github-copilot-vscode/.github/copilot-instructions.md",
@@ -4385,7 +4385,7 @@
         "path": "config/runtime-bundle.v1.json",
         "mapping": "config"
       },
-      "sha256": "3ebcdc4b89eda7eb5d1ed8d624096bc2240bc23db65d3266673d11e19e89e41c",
+      "sha256": "50c39bd12f0ac738fb2ac7b2dc63a761ccd4392dfc7cff57c991b43629473674",
       "bytes": 2039
     },
     {
@@ -4445,8 +4445,8 @@
         "path": "customizations/.github/agents/apex-planner.agent.md",
         "mapping": "customizations"
       },
-      "sha256": "15934864666d9b4f3936f526942d1f56c1a5e8fc608b5ce2047db139eab9d2fa",
-      "bytes": 4785
+      "sha256": "9a6bb99cd4784f7afc84f49168933ff8ae0f234386a55ad962382272cb5083ec",
+      "bytes": 4848
     },
     {
       "path": "customizations/.github/agents/apex-requirements.agent.md",
@@ -4455,8 +4455,8 @@
         "path": "customizations/.github/agents/apex-requirements.agent.md",
         "mapping": "customizations"
       },
-      "sha256": "1e7c8d6d7992fc5d59499f662f00a20fe9814c80fb5a321cb063ec5067ebf04f",
-      "bytes": 5263
+      "sha256": "87ac351f363c7b782ebbdeda40f15d6e8a7faabc2f400ffadcb0bca4ce66b2f3",
+      "bytes": 5552
     },
     {
       "path": "customizations/.github/agents/apex-reviewer.agent.md",
@@ -4485,8 +4485,8 @@
         "path": "customizations/.github/agents/apex.agent.md",
         "mapping": "customizations"
       },
-      "sha256": "a9a64bb9f743ba73f0ea2237f0e2702a1881dee7f90ca83f9cf588de37bbed45",
-      "bytes": 5542
+      "sha256": "a7440e67b68177d9877a9d5b2201917d1bdf56fda9431ef106ffa1cb7a30298c",
+      "bytes": 5895
     },
     {
       "path": "customizations/.github/copilot-instructions.md",
@@ -4715,8 +4715,8 @@
         "path": "customizations/.github/mcp.json",
         "mapping": "customizations"
       },
-      "sha256": "dd39613c4d01b6f7146afe6c09548d6153fbfad550dba6bfcdbecf8188cb2209",
-      "bytes": 1350
+      "sha256": "dda22ba7b91f17796dc5bc723bdcd66a1ba5f9b971bddb080b21d68062d19a8c",
+      "bytes": 1396
     },
     {
       "path": "customizations/.github/skills/apex-architecture/SKILL.md",
@@ -5855,13 +5855,13 @@
         "path": "customizations/manifest.json",
         "mapping": "customizations"
       },
-      "sha256": "bf106e629655739726869d8b4ac816f6fb7e498fb2dcac98fafb9372360caff7",
+      "sha256": "f1a21469470732feaf9cfda73e6e6b74ba573555548cf08eb23a5f3e0a415ae7",
       "bytes": 14078
     }
   ],
   "lock": {
     "algorithm": "sha256",
     "canonicalization": "apex-bundled-assets-v1",
-    "digest": "9e8f576c48d190ecac4d0d713fa073a7236958994bed9d026a3717a9a5d22ac0"
+    "digest": "20492f37396ff14048903cf57ebb86fe1177f22aca509d51d37b45a8afa1be93"
   }
 }

package/dist/mcp.js

@@ -65,6 +65,29 @@ const projectCreateInput = z
 const projectIdInput = z.object({ projectId: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/) }).strict();
 const projectUseInput = projectIdInput.extend({ runId: z.string().min(1).optional() });
 const projectDeleteInput = projectIdInput.extend({ confirm: z.literal(true) });
+const planCompletionInput = z
+    .object({
+    taskId: z.string().min(1),
+    implementationIntent: z.unknown(),
+    iacBinding: z
+        .object({
+        schemaVersion: z.literal("1.0.0"),
+        projectId: z.string().min(1),
+        runId: z.string().min(1),
+        track: z.enum(["bicep", "terraform"]),
+        resourceBindings: z.record(z.string().min(1), z.unknown()),
+    })
+        .strict(),
+    environmentInputs: z.unknown(),
+})
+    .strict();
+const gateDecisionInput = z
+    .object({
+    gate: z.union([z.literal(1), z.literal(2), z.literal(3)]),
+    decision: z.enum(["approved", "rejected"]),
+    confirm: z.literal(true),
+})
+    .strict();
 const normalizeOutputs = (outputs) => outputs.map(({ kind, value, summary }) => ({
     kind,
     value,
@@ -97,6 +120,10 @@ export function createMcpServer(service) {
         description: "Delete a project and all of its run-bound state after explicit confirmation",
         inputSchema: projectDeleteInput,
     }, async ({ projectId, confirm }) => result(await service.deleteProject(projectId, confirm)));
+    server.registerTool("gateDecide", {
+        description: "Record an explicitly confirmed human decision for Gate 1, 2, or 3 using the local OS username as actor. Gate 4 remains CLI-only.",
+        inputSchema: gateDecisionInput,
+    }, async ({ gate, decision }) => result(await service.decideInteractiveGate(gate, decision)));
     server.registerTool("stageArtifact", {
         inputSchema: {
             taskId: z.string(),
@@ -170,6 +197,10 @@ export function createMcpServer(service) {
         }
         return result(await service.completeTask(taskId, { kind, value, ...(summary === undefined ? {} : { summary }) }));
     });
+    server.registerTool("planComplete", {
+        description: "Atomically complete a plan. Derives the canonical implementation intent hash for the binding; do not supply intentHash.",
+        inputSchema: planCompletionInput,
+    }, async ({ taskId, implementationIntent, iacBinding, environmentInputs }) => result(await service.completePlan(taskId, implementationIntent, iacBinding, environmentInputs)));
     server.registerTool("preview", { description: "Read the current operator-created deployment preview" }, async () => result(await service.currentPreview()));
     server.registerTool("reconcile", {}, async () => result(await service.reconcile()));
     server.registerTool("inventory", {}, async () => result(await service.inventory()));

package/dist/service.d.ts

@@ -1,4 +1,4 @@
-import { type ApprovalEvidenceV1, type ArchitectureAvailabilityV1, type DeploymentPreviewV1, type InputRequestV1, type InputValueV1, type InputSubmissionV1, type ImprovementCategory, type ImprovementDecisionV1, type ImprovementObservationV1, type ImprovementPolicyV1, type ImprovementProposalV1, type ImprovementSource, type Operation, type ProjectId, type ResourceInventoryV1, type RunConfigV1, type RunId, type TaskEnvelopeV1 } from "@apexops/contracts";
+import { type ApprovalEvidenceV1, type ArchitectureAvailabilityV1, type DeploymentPreviewV1, type EnvironmentInputsV1, type IacBindingV1, type InputRequestV1, type InputValueV1, type InputSubmissionV1, type ImprovementCategory, type ImprovementDecisionV1, type ImprovementObservationV1, type ImprovementPolicyV1, type ImprovementProposalV1, type ImprovementSource, type ImplementationIntentV1, type Operation, type ProjectId, type ResourceInventoryV1, type RunConfigV1, type RunId, type TaskEnvelopeV1 } from "@apexops/contracts";
 import { type CapabilityPackInstallOptions, type IacProvider, type ProcessRunnerLike } from "@apexops/capabilities";
 import { type JsonValue } from "@apexops/kernel";
 import { type BundledClientProjection } from "./assets.js";
@@ -658,6 +658,10 @@ export declare class ApexService {
         outputHashes: Partial<Record<ArtifactKind, string>>;
         summary: string;
     }>;
+    completePlan(taskId: string, intent: ImplementationIntentV1, binding: Omit<IacBindingV1, "intentHash">, environmentInputs: EnvironmentInputsV1): Promise<{
+        outputHashes: Partial<Record<ArtifactKind, string>>;
+        summary: string;
+    }>;
     private acceptTaskOutputs;
     private renderRequirementsDocument;
     private requirementsReviewDirectory;
@@ -678,6 +682,7 @@ export declare class ApexService {
     resolveReview(resolution: ReviewResolution): Promise<void>;
     private assertReviewResolution;
     decideGateNumber(gateNumber: number, decision: "approved" | "rejected", actor: string, options?: GateDecisionOptions): Promise<ApprovalEvidenceV1>;
+    decideInteractiveGate(gateNumber: 1 | 2 | 3, decision: "approved" | "rejected"): Promise<ApprovalEvidenceV1>;
     preview(options: PreviewOptions): Promise<DeploymentPreviewV1>;
     private operationsReviewDirectory;
     private materializeOperationsPreviewPackage;

package/dist/service.js

@@ -5,7 +5,7 @@ import { ContentCache, EvidencePolicy, EvidenceStore, EventJournal, ImprovementS
 import { DOCUMENT_REGISTRY, renderApprovalEvidence, renderDeploymentPreview, renderRequirementsDocument, renderResourceInventory, renderRunStatus, } from "@apexops/renderers";
 import { constants } from "node:fs";
 import { access, cp, lstat, mkdir, readFile, readdir, realpath, rename, rm, stat } from "node:fs/promises";
-import { homedir } from "node:os";
+import { homedir, userInfo } from "node:os";
 import { basename, delimiter, isAbsolute, join, relative, resolve, sep } from "node:path";
 import { resolveBundledAssets } from "./assets.js";
 import { dependencyRevision as calculateDependencyRevision } from "./dependency-revision.js";
@@ -161,8 +161,7 @@ const REQUIREMENTS_INTAKE = [
     {
         round: "service-preferences",
         questions: [
-            { id: "retained-services", prompt: "List Azure services or integrations that must be retained, or 'none'." },
-            { id: "prohibited-services", prompt: "List prohibited services or use 'none'." },
+            { id: "prohibited-services", prompt: "List prohibited services, or explicitly defer the constraint." },
             {
                 id: "service-preferences",
                 prompt: "Select preferred Azure services. Select all that apply; architecture chooses the exact combination.",
@@ -222,10 +221,22 @@ const REQUIREMENTS_INTAKE = [
                 prompt: "Choose the Azure region, or explicitly defer the decision.",
                 options: ["swedencentral", "westeurope", "germanywestcentral"],
             },
-            { id: "availability-recovery", prompt: "State availability, RTO, RPO, backup, and recovery requirements." },
+            {
+                id: "availability-recovery",
+                prompt: "Select required availability, backup, and disaster-recovery capabilities.",
+                options: [
+                    "single-region-availability",
+                    "availability-zones",
+                    "automated-backups",
+                    "point-in-time-restore",
+                    "immutable-backups",
+                    "cross-region-disaster-recovery",
+                ],
+                multiSelect: true,
+            },
             {
                 id: "recovery",
-                prompt: "Provide RTO and RPO in whole minutes or explicitly defer them.",
+                prompt: "Set exact recovery targets: provide RTO and RPO in whole minutes, or explicitly defer them.",
                 valueType: "recovery",
             },
             {
@@ -1005,6 +1016,13 @@ export class ApexService {
     async completeTaskOutputs(taskId, outputs) {
         return this.acceptTaskOutputs(taskId, outputs, false);
     }
+    async completePlan(taskId, intent, binding, environmentInputs) {
+        return this.completeTaskOutputs(taskId, [
+            { kind: "implementation-intent", value: intent },
+            { kind: "iac-binding", value: { ...binding, intentHash: sha256Json(intent) } },
+            { kind: "environment-inputs", value: environmentInputs },
+        ]);
+    }
     async acceptTaskOutputs(taskId, outputs, legacy) {
         const run = await this.currentRun();
         const task = await this.readTask(run, taskId);
@@ -1478,6 +1496,16 @@ export class ApexService {
             await this.materializeOperationsApprovalPackage(run, approval, approvalHash);
         return approval;
     }
+    async decideInteractiveGate(gateNumber, decision) {
+        let actor = "local-user";
+        try {
+            actor = userInfo().username.trim() || actor;
+        }
+        catch {
+            // Some minimal container identities do not have an OS user entry.
+        }
+        return this.decideGateNumber(gateNumber, decision, actor);
+    }
     async preview(options) {
         const run = await this.currentRun();
         await this.assertCurrentWriterAuthority(run, new WriterTransferStore(this.projects.runDirectory(run.projectId, run.runId), this.clock));
@@ -2461,6 +2489,15 @@ export class ApexService {
         return this.inputRequest(event, run.ownerEpoch);
     }
     requirementsIntakeQuestions(round, events) {
+        if (round.round === "service-preferences") {
+            const scenario = this.recordedRequirementsInput(events)?.["delivery-scenario"];
+            if (scenario !== "migration" && scenario !== "modernization" && scenario !== "extension")
+                return round.questions;
+            return [
+                { id: "retained-services", prompt: "List Azure services or integrations that must be retained." },
+                ...round.questions,
+            ];
+        }
         if (round.round !== "workload-pattern")
             return round.questions;
         const scenario = this.recordedRequirementsInput(events)?.["delivery-scenario"];

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const APEX_VERSION: "0.10.0-next.2";
+export declare const APEX_VERSION: "0.10.0-next.4";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,2 +1,2 @@
-export const APEX_VERSION = "0.10.0-next.2";
+export const APEX_VERSION = "0.10.0-next.4";
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apexops/cli",
-  "version": "0.10.0-next.2",
+  "version": "0.10.0-next.4",
   "description": "Portable no-shell CLI and MCP facade for APEX",
   "license": "MIT",
   "repository": {
@@ -32,10 +32,10 @@
     "assets"
   ],
   "dependencies": {
-    "@apexops/capabilities": "0.10.0-next.2",
-    "@apexops/contracts": "0.10.0-next.2",
-    "@apexops/kernel": "0.10.0-next.2",
-    "@apexops/renderers": "0.10.0-next.2",
+    "@apexops/capabilities": "0.10.0-next.4",
+    "@apexops/contracts": "0.10.0-next.4",
+    "@apexops/kernel": "0.10.0-next.4",
+    "@apexops/renderers": "0.10.0-next.4",
     "@azure/mcp": "3.0.0-beta.37",
     "@hono/node-server": "2.0.11",
     "@modelcontextprotocol/sdk": "1.29.0",