@apexops/cli 0.10.0-next.4 → 0.11.0-next.0

package/dist/service.d.ts

@@ -1,7 +1,8 @@
-import { type ApprovalEvidenceV1, type ArchitectureAvailabilityV1, type DeploymentPreviewV1, type EnvironmentInputsV1, type IacBindingV1, type InputRequestV1, type InputValueV1, type InputSubmissionV1, type ImprovementCategory, type ImprovementDecisionV1, type ImprovementObservationV1, type ImprovementPolicyV1, type ImprovementProposalV1, type ImprovementSource, type ImplementationIntentV1, type Operation, type ProjectId, type ResourceInventoryV1, type RunConfigV1, type RunId, type TaskEnvelopeV1 } from "@apexops/contracts";
+import { type ArchetypeBatchConfigV1, type ArchetypeBatchPlanV1, type ReviewRequestV1, type ApprovalEvidenceV1, type ArchitectureAvailabilityV1, type ArchitectureV1, type CostEstimateV1, type DeploymentPreviewV1, type EnvironmentInputsV1, type PolicyPropertyMapV1, type IacBindingV1, type NativeValidationReceiptV1, type InputRequestV1, type InputValueV1, type InputSubmissionV1, type ImprovementCategory, type ImprovementDecisionV1, type ImprovementObservationV1, type ImprovementPolicyV1, type ImprovementProposalV1, type ImprovementSource, type ImplementationIntentV1, type Operation, type OnboardingConfigV1, type BootstrapPlanV1, type GovernanceSetupConfigV1, type GovernanceProvisionPlanV1, type RepositoryPublishConfigV1, type RepositoryPublishPlanV1, type ProjectId, type RiskOwner, type ResourceInventoryV1, type RequirementsV1, type RequirementsAmendmentV1, type RunConfigV1, type RunId, type WorkloadDecisionManifestV1, type TaskEnvelopeV1 } from "@apexops/contracts";
 import { type CapabilityPackInstallOptions, type IacProvider, type ProcessRunnerLike } from "@apexops/capabilities";
 import { type JsonValue } from "@apexops/kernel";
 import { type BundledClientProjection } from "./assets.js";
+import { type HostEnvironment } from "./host-profile.js";
 interface Selection {
     projectId: ProjectId;
     runId: RunId;
@@ -45,16 +46,26 @@ export interface ReviewResolution {
     findingId: string;
     reviewHash: string;
     subjectHash: string;
-    disposition: "fixed" | "accepted-risk";
+    disposition: "fixed" | "accepted-risk" | "acknowledged" | "dismissed";
     actor: string;
     rationale: string;
+    owner?: RiskOwner;
     evidenceRefs: string[];
     expiresAt?: string;
     dependencyHash: string;
 }
+export interface ReviewDecision {
+    findingId: string;
+    action: "revise" | "accept-risk" | "acknowledge" | "dismiss";
+    rationale?: string;
+    owner?: string;
+    expiresAt?: string;
+}
 export interface ServiceOptions {
     clock?: () => Date;
     idSource?: () => string;
+    workspacePath?: string;
+    writerLeaseTtlMs?: number;
     providers?: Partial<Record<"fake" | "bicep" | "terraform", IacProvider>>;
     architectureAvailabilityAdapter?: (evidence: ArchitectureAvailabilityV1) => Promise<void>;
     executableChecker?: (executable: string) => Promise<boolean>;
@@ -64,14 +75,28 @@ export interface ServiceOptions {
     }>;
     customizationFailureInjector?: (index: number, destination: string) => void | Promise<void>;
     processRunner?: ProcessRunnerLike;
-    profileRoot?: string;
     improvementPolicy?: ImprovementPolicyV1;
+    diagramRasterizer?: (svg: string) => Uint8Array;
+    repeatWindowMs?: number;
+    /** Folder shared with the managed rubber-duck capture hook; defaults to `$APEX_REVIEW_HOME` or `~/.apex/reviews`. */
+    reviewHome?: string;
+    /** Host that doctor inspects; defaults to the running process. */
+    hostEnvironment?: HostEnvironment;
+}
+/** Canonical description of one state-changing call submitted through {@link ApexService.repeatSafe}. */
+export interface RepeatSafeCall {
+    operation: string;
+    arguments: Record<string, unknown>;
+    /** Argument names holding workspace-relative file paths; their current content hash joins the call identity. */
+    fileArguments?: readonly string[];
 }
 interface DoctorCheck {
     id: string;
     ok: boolean;
     value: string;
     remedy?: string;
+    /** Marks a passing advisory check; warnings never make doctor unhealthy. */
+    severity?: "warning";
 }
 declare const ARTIFACTS: {
     readonly requirements: readonly ["requirements", import("@sinclair/typebox").TObject<{
@@ -161,12 +186,50 @@ declare const ARTIFACTS: {
         components: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
             id: import("@sinclair/typebox").TString;
             service: import("@sinclair/typebox").TString;
+            resourceTypes: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
             purpose: import("@sinclair/typebox").TString;
             requirementIds: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
             dependsOn: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
         }>>;
         decisions: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+        decisionRecords: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+            id: import("@sinclair/typebox").TString;
+            title: import("@sinclair/typebox").TString;
+            context: import("@sinclair/typebox").TString;
+            decision: import("@sinclair/typebox").TString;
+            requirementIds: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+            alternatives: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+                option: import("@sinclair/typebox").TString;
+                benefits: import("@sinclair/typebox").TString;
+                drawbacks: import("@sinclair/typebox").TString;
+                rejectionReason: import("@sinclair/typebox").TString;
+            }>>;
+            positiveConsequences: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+            negativeConsequences: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+            wafImpacts: import("@sinclair/typebox").TObject<{
+                security: import("@sinclair/typebox").TString;
+                reliability: import("@sinclair/typebox").TString;
+                "performance-efficiency": import("@sinclair/typebox").TString;
+                "cost-optimization": import("@sinclair/typebox").TString;
+                "operational-excellence": import("@sinclair/typebox").TString;
+            }>;
+            complianceConsiderations: import("@sinclair/typebox").TString;
+            implementationNotes: import("@sinclair/typebox").TString;
+        }>>>;
         risks: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+        wellArchitectedAssessment: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+            framework: import("@sinclair/typebox").TLiteral<"azure-well-architected-framework">;
+            assessmentType: import("@sinclair/typebox").TLiteral<"qualitative">;
+            pillars: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+                pillar: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"security">, import("@sinclair/typebox").TLiteral<"reliability">, import("@sinclair/typebox").TLiteral<"performance-efficiency">, import("@sinclair/typebox").TLiteral<"cost-optimization">, import("@sinclair/typebox").TLiteral<"operational-excellence">]>;
+                status: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"aligned">, import("@sinclair/typebox").TLiteral<"concern">, import("@sinclair/typebox").TLiteral<"blocker">, import("@sinclair/typebox").TLiteral<"not-applicable">]>;
+                assessment: import("@sinclair/typebox").TString;
+                requirementIds: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+                evidenceRefs: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+                recommendations: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+                tradeoffs: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+            }>>;
+        }>>;
     }>];
     readonly "cost-estimate": readonly ["cost-estimate", import("@sinclair/typebox").TObject<{
         schemaVersion: import("@sinclair/typebox").TLiteral<"1.0.0">;
@@ -174,6 +237,7 @@ declare const ARTIFACTS: {
         runId: import("@sinclair/typebox").TString;
         currency: import("@sinclair/typebox").TString;
         pricingDate: import("@sinclair/typebox").TString;
+        pricingStatus: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"complete">, import("@sinclair/typebox").TLiteral<"partial">]>>;
         lineItems: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
             id: import("@sinclair/typebox").TString;
             service: import("@sinclair/typebox").TString;
@@ -195,6 +259,14 @@ declare const ARTIFACTS: {
                 basis: import("@sinclair/typebox").TString;
             }>;
         }>>;
+        unpricedItems: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+            id: import("@sinclair/typebox").TString;
+            service: import("@sinclair/typebox").TString;
+            sku: import("@sinclair/typebox").TString;
+            quantity: import("@sinclair/typebox").TNumber;
+            attemptedAt: import("@sinclair/typebox").TString;
+            reason: import("@sinclair/typebox").TString;
+        }>>>;
         totalMonthlyCost: import("@sinclair/typebox").TNumber;
         assumptions: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
     }>];
@@ -205,6 +277,13 @@ declare const ARTIFACTS: {
         subjectKind: import("@sinclair/typebox").TString;
         subjectHash: import("@sinclair/typebox").TString;
         reviewedAt: import("@sinclair/typebox").TString;
+        capture: import("@sinclair/typebox").TObject<{
+            reviewer: import("@sinclair/typebox").TLiteral<"rubber-duck">;
+            nonce: import("@sinclair/typebox").TString;
+            captureHash: import("@sinclair/typebox").TString;
+            promptSha256: import("@sinclair/typebox").TString;
+            responseSha256: import("@sinclair/typebox").TString;
+        }>;
         findings: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
             id: import("@sinclair/typebox").TString;
             severity: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"critical">, import("@sinclair/typebox").TLiteral<"high">, import("@sinclair/typebox").TLiteral<"medium">, import("@sinclair/typebox").TLiteral<"low">, import("@sinclair/typebox").TLiteral<"info">]>;
@@ -214,12 +293,19 @@ declare const ARTIFACTS: {
             evidenceRefs: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
             resolution: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
         }>>;
+        criteria: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+            criterionId: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"security">, import("@sinclair/typebox").TLiteral<"reliability">, import("@sinclair/typebox").TLiteral<"performance-efficiency">, import("@sinclair/typebox").TLiteral<"cost-optimization">, import("@sinclair/typebox").TLiteral<"operational-excellence">]>;
+            outcome: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"pass">, import("@sinclair/typebox").TLiteral<"finding">, import("@sinclair/typebox").TLiteral<"not-applicable">]>;
+            rationale: import("@sinclair/typebox").TString;
+            findingIds: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+        }>>>;
     }>];
     readonly "governance-constraints": readonly ["governance-constraints", import("@sinclair/typebox").TObject<{
         schemaVersion: import("@sinclair/typebox").TLiteral<"1.0.0">;
         projectId: import("@sinclair/typebox").TString;
         runId: import("@sinclair/typebox").TString;
         targetScope: import("@sinclair/typebox").TString;
+        source: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"collected">, import("@sinclair/typebox").TLiteral<"reference">]>;
         discoveredAt: import("@sinclair/typebox").TString;
         expiresAt: import("@sinclair/typebox").TString;
         summary: import("@sinclair/typebox").TObject<{
@@ -243,11 +329,14 @@ declare const ARTIFACTS: {
         governanceHash: import("@sinclair/typebox").TString;
         mappings: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
             policyAssignmentId: import("@sinclair/typebox").TString;
+            policyDefinitionId: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+            policyDefinitionReferenceId: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
             effect: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"deny">, import("@sinclair/typebox").TLiteral<"modify">, import("@sinclair/typebox").TLiteral<"append">, import("@sinclair/typebox").TLiteral<"audit">, import("@sinclair/typebox").TLiteral<"deployIfNotExists">, import("@sinclair/typebox").TLiteral<"disabled">]>;
             logicalResourceId: import("@sinclair/typebox").TString;
             propertyPath: import("@sinclair/typebox").TString;
             expectedValue: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnknown>;
-            disposition: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"satisfied">, import("@sinclair/typebox").TLiteral<"planned">, import("@sinclair/typebox").TLiteral<"exempt">, import("@sinclair/typebox").TLiteral<"blocked">]>;
+            disposition: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"satisfied">, import("@sinclair/typebox").TLiteral<"planned">, import("@sinclair/typebox").TLiteral<"exempt">, import("@sinclair/typebox").TLiteral<"blocked">, import("@sinclair/typebox").TLiteral<"not-applicable">]>;
+            reason: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
         }>>;
     }>];
     readonly "implementation-intent": readonly ["implementation-intent", import("@sinclair/typebox").TObject<{
@@ -274,6 +363,13 @@ declare const ARTIFACTS: {
             implementation: import("@sinclair/typebox").TString;
             version: import("@sinclair/typebox").TString;
             parameters: import("@sinclair/typebox").TRecord<import("@sinclair/typebox").TString, import("@sinclair/typebox").TUnknown>;
+            scopeLogicalId: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+            physicalResources: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+                resourceId: import("@sinclair/typebox").TString;
+                type: import("@sinclair/typebox").TString;
+                ownership: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"managed">, import("@sinclair/typebox").TLiteral<"existing">]>;
+                role: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"primary">, import("@sinclair/typebox").TLiteral<"ancillary">]>;
+            }>>>;
         }>>;
     }>];
     readonly "environment-inputs": readonly ["environment-inputs", import("@sinclair/typebox").TObject<{
@@ -300,6 +396,7 @@ declare const ARTIFACTS: {
             logicalId: import("@sinclair/typebox").TString;
             type: import("@sinclair/typebox").TString;
             implementationAddress: import("@sinclair/typebox").TString;
+            executionAddress: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
             implementationKind: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"resource">, import("@sinclair/typebox").TLiteral<"module">, import("@sinclair/typebox").TLiteral<"data">, import("@sinclair/typebox").TLiteral<"existing">]>;
             ownership: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"existing">, import("@sinclair/typebox").TLiteral<"managed">]>;
             dependsOn: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
@@ -432,6 +529,57 @@ declare const ARTIFACTS: {
         diagnosedAt: import("@sinclair/typebox").TString;
         status: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"healthy">, import("@sinclair/typebox").TLiteral<"degraded">, import("@sinclair/typebox").TLiteral<"failed">, import("@sinclair/typebox").TLiteral<"unknown">]>;
         observations: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+        operationalHandoff: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+            owner: import("@sinclair/typebox").TString;
+            escalation: import("@sinclair/typebox").TString;
+            maintenanceWindow: import("@sinclair/typebox").TString;
+            accessPrerequisites: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+            configurationReferences: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+                name: import("@sinclair/typebox").TString;
+                source: import("@sinclair/typebox").TString;
+            }>>;
+            healthChecks: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+                resourceId: import("@sinclair/typebox").TString;
+                check: import("@sinclair/typebox").TString;
+                expectedOutcome: import("@sinclair/typebox").TString;
+                evidenceRefs: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+            }>>;
+            monitoring: import("@sinclair/typebox").TString;
+            incidentResponse: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TObject<{
+                applicability: import("@sinclair/typebox").TLiteral<"applicable">;
+                owner: import("@sinclair/typebox").TString;
+                prerequisites: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+                steps: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+                verification: import("@sinclair/typebox").TString;
+                executionStatus: import("@sinclair/typebox").TLiteral<"untested">;
+            }>, import("@sinclair/typebox").TObject<{
+                applicability: import("@sinclair/typebox").TLiteral<"not-applicable">;
+                rationale: import("@sinclair/typebox").TString;
+            }>]>;
+            rollback: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TObject<{
+                applicability: import("@sinclair/typebox").TLiteral<"applicable">;
+                owner: import("@sinclair/typebox").TString;
+                prerequisites: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+                steps: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+                verification: import("@sinclair/typebox").TString;
+                executionStatus: import("@sinclair/typebox").TLiteral<"untested">;
+            }>, import("@sinclair/typebox").TObject<{
+                applicability: import("@sinclair/typebox").TLiteral<"not-applicable">;
+                rationale: import("@sinclair/typebox").TString;
+            }>]>;
+            recovery: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TObject<{
+                applicability: import("@sinclair/typebox").TLiteral<"applicable">;
+                owner: import("@sinclair/typebox").TString;
+                prerequisites: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+                steps: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+                verification: import("@sinclair/typebox").TString;
+                executionStatus: import("@sinclair/typebox").TLiteral<"untested">;
+            }>, import("@sinclair/typebox").TObject<{
+                applicability: import("@sinclair/typebox").TLiteral<"not-applicable">;
+                rationale: import("@sinclair/typebox").TString;
+            }>]>;
+            limitations: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+        }>>;
         causes: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
             id: import("@sinclair/typebox").TString;
             summary: import("@sinclair/typebox").TString;
@@ -464,7 +612,10 @@ export declare const SUPPORTED_ARTIFACT_KINDS: ArtifactKind[];
 export declare class ApexService {
     readonly root: string;
     private readonly clock;
+    private readonly diagramRasterizer;
     private readonly idSource;
+    private readonly writerLeaseTtlMs;
+    private readonly repeatWindowMs;
     private readonly projects;
     private readonly objects;
     private readonly cache;
@@ -475,11 +626,25 @@ export declare class ApexService {
     private readonly azureAuthStatus;
     private readonly customizationFailureInjector?;
     private readonly processRunner;
-    private readonly profileRoot;
+    private readonly workspaceLockHold;
+    private readonly host;
+    /** Writes the running repeat-guarded call makes to the files its repeat record binds. */
+    private readonly repeatWrites;
+    /** Set while a read runs as a snapshot without the workspace lock; any write or recovery then needs the lock. */
+    private readonly snapshotRead;
     private readonly improvementPolicy;
     private improvementRuntime?;
     private requirementsDocumentTemplate?;
+    private workspacePath;
+    private readonly reviewHomeOverride;
+    private reviewGuardPeers;
     constructor(root: string, options?: ServiceOptions);
+    setWorkspacePath(workspacePath: string): void;
+    /**
+     * Other workspaces served by the same process (the MCP server resolves each caller-supplied workspace to its own
+     * service). The pending-review guard scans them too, so pointing an inherited tool at another workspace cannot evade it.
+     */
+    setReviewGuardPeers(peers: () => Iterable<ApexService>): void;
     improvementObserve(input: {
         taskId?: string;
         observedAt?: string;
@@ -522,40 +687,133 @@ export declare class ApexService {
         environment?: string;
         targetScope?: string;
         iacTool?: "bicep" | "terraform";
+        riskOwner: RiskOwner;
         customizationsSource?: string;
         clientId?: BundledClientProjection["id"];
     }): Promise<{
         projectId: ProjectId;
         runId: RunId;
     }>;
+    initializeWorkspace(input: {
+        customizationsSource?: string;
+        clientId?: BundledClientProjection["id"];
+    }): Promise<{
+        workspaceReady: true;
+        projectCreated: false;
+    }>;
+    planGovernanceSetup(config: GovernanceSetupConfigV1): Promise<{
+        schemaVersion: "1.0.0";
+        config: {
+            schemaVersion: "1.0.0";
+            repository: string;
+            tenantId: string;
+            subscriptionId: string;
+            managementGroupId?: string;
+            identity: {
+                mode: "reuse";
+                clientId: string;
+                principalId: string;
+            } | {
+                mode: "create";
+                displayName: string;
+            };
+        };
+        evidenceHash: string;
+        status: "blocked" | "pending";
+        federation?: {
+            issuer: "https://token.actions.githubusercontent.com";
+            audience: "api://AzureADTokenExchange";
+            subject: string;
+        };
+        environment: "governance";
+        proposedRole: {
+            id: "acdd72a7-3385-48ef-bd42-f606fba81ae7";
+            name: "Reader";
+            scope: string;
+        };
+        variables: {
+            [x: string]: string;
+        };
+        blockers: string[];
+        pendingActions: string[];
+        filesModified: false;
+        executionAuthorized: false;
+        deploymentAuthorized: false;
+        planHash: string;
+    }>;
+    private governanceSetupRead;
+    planGovernanceProvision(config: GovernanceSetupConfigV1): Promise<GovernanceProvisionPlanV1>;
+    provisionGovernance(config: GovernanceSetupConfigV1, expectedHash: string, confirm: boolean): Promise<{
+        schemaVersion: "1.0.0";
+        planHash: string;
+        repository: string;
+        clientId: string;
+        actions: {
+            action: string;
+            status: "started" | "verified" | "indeterminate";
+        }[];
+        deploymentAuthorized: boolean;
+        collectionEnabled: boolean;
+        status: string;
+        receiptPath: string;
+        nextAction: string;
+    }>;
+    private repositoryPublishEvidence;
+    /** Builds a reviewable GitHub repository creation and push plan. No remote state is modified. */
+    planRepositoryPublish(config: RepositoryPublishConfigV1): Promise<RepositoryPublishPlanV1>;
+    /** Executes exactly the confirmed repository creation, remote and non-forced push actions. */
+    publishRepository(config: RepositoryPublishConfigV1, expectedHash: string, confirm: boolean): Promise<{
+        schemaVersion: "1.0.0";
+        planHash: string;
+        repository: string;
+        visibility: "internal" | "private" | "public";
+        branch: string;
+        commit: string;
+        actions: {
+            action: string;
+            status: "started" | "verified" | "indeterminate";
+        }[];
+        forcePush: boolean;
+        deploymentAuthorized: boolean;
+        status: string;
+        receiptPath: string;
+        nextAction: string;
+    }>;
+    planBootstrap(config: OnboardingConfigV1): Promise<BootstrapPlanV1>;
+    private inspectBootstrapResume;
     bootstrap(input: {
         projectId: ProjectId;
         displayName?: string;
         environment?: string;
         targetScope?: string;
         iacTool?: "bicep" | "terraform";
+        riskOwner: RiskOwner;
         clientId?: BundledClientProjection["id"];
         createRepository?: boolean;
     }): Promise<{
         projectId: ProjectId;
         runId: RunId;
+        workspaceReady: true;
+        projectCreated: boolean;
         runtimeInstalled: boolean;
+        resumed: boolean;
     }>;
-    profileStatus(): Promise<{
-        installed: boolean;
-        modified: boolean;
-        version?: string;
-    }>;
-    profileInstall(): Promise<{
-        installed: boolean;
-        version: string;
-    }>;
-    profileUpdate(): Promise<{
-        updated: boolean;
-        version: string;
-    }>;
-    profileUninstall(): Promise<{
-        removed: boolean;
+    bootstrap(input: {
+        projectId?: ProjectId;
+        displayName?: string;
+        environment?: string;
+        targetScope?: string;
+        iacTool?: "bicep" | "terraform";
+        riskOwner?: RiskOwner;
+        clientId?: BundledClientProjection["id"];
+        createRepository?: boolean;
+    }): Promise<{
+        projectId?: ProjectId;
+        runId?: RunId;
+        workspaceReady: true;
+        projectCreated: boolean;
+        runtimeInstalled: boolean;
+        resumed: boolean;
     }>;
     createProject(input: {
         projectId: ProjectId;
@@ -563,21 +821,32 @@ export declare class ApexService {
         environment?: string;
         targetScope?: string;
         iacTool?: "bicep" | "terraform";
+        riskOwner: RiskOwner;
     }): Promise<{
         projectId: ProjectId;
         runId: RunId;
     }>;
     update(customizationsSource?: string): Promise<{
         updated: string[];
+        retired: string[];
+        conflicts: string[];
     }>;
     rollbackCustomizations(): Promise<{
         restored: string[];
+        removed: string[];
         conflicts: string[];
     }>;
     uninstallCustomizations(): Promise<{
         removed: string[];
         conflicts: string[];
     }>;
+    retiredProjectionInstalled(): Promise<boolean>;
+    /** Explicit replacement of a retired VS Code projection; project state is untouched. */
+    replaceRetiredProjection(): Promise<{
+        removed: string[];
+        installed: string[];
+        clientId: BundledClientProjection["id"];
+    }>;
     reinstallCustomizations(customizationsSource?: string): Promise<{
         installed: string[];
         clientId: BundledClientProjection["id"];
@@ -586,6 +855,7 @@ export declare class ApexService {
         projectId: string;
         displayName: string;
     }>>;
+    private workspaceHasNoProjects;
     deleteProject(projectId: ProjectId, confirmed: boolean): Promise<{
         deleted: ProjectId;
         selected?: Selection;
@@ -608,6 +878,132 @@ export declare class ApexService {
         artifactKinds: string[];
         payload: JsonValue;
     }>>;
+    inspectArchetype(repositoryPath: string, revision: string, selectedPath: string): Promise<{
+        schemaVersion: "1.0.0";
+        repositoryPath: string;
+        revision: string;
+        selectedPath: string;
+        authorityImported: false;
+        requiresConsumerReview: true;
+        files: {
+            path: string;
+            hash: string;
+            bytes: number;
+        }[];
+        excluded: {
+            path: string;
+            reason: "source-authority" | "unsupported-material";
+        }[];
+        contentHash: string;
+    }>;
+    listArchetypes(repositoryPath: string, revision: string, catalogPath: string): Promise<{
+        repositoryPath: string;
+        revision: string;
+        catalogPath: string;
+        candidates: {
+            selectedPath: string;
+            treeObjectId: string;
+            requiresInspection: true;
+        }[];
+    }>;
+    private copiedArchetypeMatches;
+    planArchetypeBatch(config: ArchetypeBatchConfigV1): Promise<ArchetypeBatchPlanV1>;
+    importArchetypeBatch(config: ArchetypeBatchConfigV1, expectedHash: string, confirm: boolean): Promise<{
+        status: string;
+        planHash: string;
+        entries: {
+            destination: string;
+            status: "copied" | "already-copied" | "blocked" | "pending";
+        }[];
+        nextAction: string;
+        authorityImported: boolean;
+        requiresConsumerReview: boolean;
+    }>;
+    importArchetype(request: {
+        repositoryPath: string;
+        revision: string;
+        selectedPath: string;
+        destination: string;
+        expectedHash: string;
+        confirm: boolean;
+    }): Promise<{
+        destination: string;
+        contentHash: string;
+        files: number;
+        requiresConsumerReview: true;
+    }>;
+    private readArchetypeRemoteJson;
+    private readArchetypeSelection;
+    workspaceStatus(): Promise<{
+        status: "needs_project";
+        workspaceReady: true;
+        projects: string[];
+        nextAction: string;
+    } | {
+        run: RunConfigV1;
+        head: string | null;
+        events: number;
+        task: string | null;
+        blockers: string[];
+    }>;
+    /**
+     * Runs a state-changing operation that is not repeat-guarded, such as a CLI command, under the workspace repeat lock
+     * that guarded calls hold, so it cannot land between a guarded call's state reads, execution and record publication.
+     * A `suspendable` operation, such as a CLI command, may give the lock up while it waits for interactive input through
+     * {@link waitOutsideWorkspaceLock}; MCP calls never do.
+     */
+    withWorkspaceWriteLock<T>(operation: () => Promise<T>, signal?: AbortSignal, options?: {
+        suspendable?: boolean;
+    }): Promise<T>;
+    /**
+     * Runs a `read` operation, one that writes nothing except by finishing a pending run or customization recovery. It
+     * takes the workspace lock when it is free. While a CLI command holds the lock and waits for an external process
+     * through {@link whileExternalProcessRuns}, the read runs as a snapshot without the lock instead and is answered only
+     * if the command wrote nothing meanwhile; a read that would need to recover state waits for the lock.
+     */
+    withWorkspaceReadLock<T>(operation: () => Promise<T>, signal?: AbortSignal): Promise<T>;
+    /**
+     * Runs an external process, such as a provider preview, apply or destroy, or a Git, GitHub or Azure CLI call, that
+     * writes no workspace state itself. A CLI command keeps the workspace lock meanwhile, so writers still wait, but
+     * shares it with {@link withWorkspaceReadLock} snapshot readers. Elsewhere `operation` runs as is.
+     */
+    private whileExternalProcessRuns;
+    private runExternalProcess;
+    /** Refuses a write or recovery inside a snapshot read, which then waits for the workspace lock instead. */
+    private assertNotSnapshotRead;
+    /**
+     * Runs `wait`, such as an interactive prompt, without the workspace lock when the current operation holds it as
+     * suspendable, so MCP calls in the workspace are not blocked meanwhile. The lock is then taken again and the command
+     * fails with `APEX_STALE` unless the workspace state is unchanged, so a decision taken during the wait is applied
+     * only to the state it was taken against. Elsewhere `wait` runs as is.
+     */
+    waitOutsideWorkspaceLock<T>(wait: () => Promise<T>): Promise<T>;
+    /**
+     * Token over the selected run state that repeat-guarded calls are bound to and the workspace setup files, so any
+     * change by another writer of the workspace changes it.
+     */
+    private workspaceStateToken;
+    private repeatLockDirectory;
+    /**
+     * Runs one state-changing call through the kernel repeat guard. An identical call from the same worktree while the
+     * selected run is unchanged since the original succeeded returns the original result and is audited instead of
+     * executing again; anything else executes normally under the usual kernel checks.
+     */
+    repeatSafe<T extends Record<string, unknown>>(call: RepeatSafeCall, execute: () => Promise<T>, signal?: AbortSignal): Promise<T>;
+    private repeatScope;
+    /**
+     * Roots of the files guarded operations read outside the run journal: the run's staged work tree and the latest
+     * generated source tree. The repeat guard binds them by content, so an external edit makes an identical call new and
+     * an edit while a call runs keeps its result from being stored.
+     */
+    private repeatFileRoots;
+    /** Content hash plus the inode, size and change times that any later modification of the file would alter. */
+    private repeatFileBinding;
+    releaseWriter(): Promise<{
+        released: boolean;
+        projectId: string;
+        runId: string;
+    }>;
     status(): Promise<{
         run: RunConfigV1;
         head: string | null;
@@ -618,53 +1014,259 @@ export declare class ApexService {
     nextTask(): Promise<{
         status: "needs_input";
         request: InputRequestV1;
+    } | {
+        status: "needs_review";
+        review: Awaited<ReturnType<ApexService["pendingReview"]>>;
     } | {
         status: "task";
         task: TaskEnvelopeV1;
     }>;
+    private currentIssuedTask;
     recordInput(input: InputSubmissionV1): Promise<{
         recorded: true;
         requestId: string;
     }>;
-    recordRequirementsInput(value: unknown): Promise<void>;
+    private taskReviewMetadata;
     taskContext(taskId: string): Promise<{
         task: TaskEnvelopeV1;
         inputs: unknown[];
+        inputReferences: Array<{
+            hash: string;
+            bytes: number;
+            inlined: boolean;
+        }>;
         artifactHashes: Record<string, string>;
         recordedInput: Record<string, InputValueV1> | null;
         decisions: Record<string, InputValueV1>;
         outputTemplates: Partial<Record<ArtifactKind, unknown>>;
+        reviewMetadata?: Awaited<ReturnType<ApexService["taskReviewMetadata"]>>;
+        reviewMetadataReference?: {
+            selector: "review-metadata";
+            bytes: number;
+            inlined: boolean;
+        };
+        reviewRequest?: ReviewRequestV1;
         outputRoot: string;
         status: string;
         blockers: string[];
     }>;
+    readTaskInput(taskId: string, offset?: number, limit?: number, inputHash?: string): Promise<{
+        subjectHash: string;
+        content: string;
+        offset: number;
+        nextOffset?: number;
+        outputTemplate?: unknown;
+    }>;
     stageArtifact(taskId: string, output: TaskOutput): Promise<StagedArtifact>;
+    private readGovernanceBaselineBytes;
+    private governanceBaselineValidator;
+    private governanceBaselineOptions;
+    private governanceQuestions;
+    private governanceInputRequest;
+    private governanceInputState;
+    private governanceInitialImportProof;
+    private assertGovernanceInputBinding;
+    private governanceRefreshRequired;
+    private inspectBaseline;
+    private assertGovernanceCandidate;
+    inspectGovernanceBaselineReadiness(path: string): Promise<{
+        status: string;
+        candidateHash: string;
+        targetScope: string;
+        observedAt: string;
+        refreshRequired: boolean;
+        imported: boolean;
+        deploymentAuthorized: boolean;
+        nextAction: string;
+    }>;
+    selectGovernanceBaseline(path: string, options?: {
+        reopen?: boolean;
+    }): Promise<{
+        status: "needs_input";
+        request: InputRequestV1;
+    } | {
+        status: "selected";
+        choice: "reuse" | "refresh";
+        candidateHash: string;
+        observedAt: string;
+        refreshRequired: boolean;
+    }>;
+    private governanceRevision;
+    private pendingGovernanceRevision;
+    private governanceWorkflowEvents;
+    reviseGovernanceBaseline(path: string, options: {
+        confirm: boolean;
+        reason: string;
+    }): Promise<{
+        invalidatedNodes: string[];
+        previousGovernanceHash: string;
+        candidateHash: string;
+    }>;
+    importGovernanceBaseline(path: string): Promise<{
+        outputHash: string;
+        summary: string;
+    }>;
+    importGovernanceReference(): Promise<{
+        outputHash: string;
+        summary: string;
+    }>;
     stageFile(taskId: string, relativePath: string, content: string | Uint8Array, expectedSha?: string): Promise<StagedFile>;
     generateIac(taskId: string, options?: GenerateIacOptions): Promise<{
         files: StagedFile[];
         outputHashes: Partial<Record<ArtifactKind, string>>;
         treeHash: string;
     }>;
+    private assertPreviousGeneratedSourceUnmodified;
     validateTask(taskId: string, output?: TaskOutput | TaskOutput[]): Promise<{
-        valid: true;
+        valid: boolean;
         taskId: string;
         staged?: StagedArtifact | StagedArtifact[];
+        execution?: {
+            mode: "native";
+            executedValidatorIds: string[];
+            blockedValidatorIds: string[];
+            storageSecurity?: NativeValidationReceiptV1["storageSecurity"];
+            storageDiagnostics?: NativeValidationReceiptV1["storageDiagnostics"];
+            securityBaseline?: NativeValidationReceiptV1["securityBaseline"];
+        };
+        outputs?: TaskOutput[];
     }>;
-    completeTask(taskId: string, output: TaskOutput): Promise<{
-        outputHash: string;
+    completeTaskOutputs(taskId: string, outputs: TaskOutput[]): Promise<{
+        outputHashes: Partial<Record<ArtifactKind, string>>;
         summary: string;
     }>;
-    completeTaskOutputs(taskId: string, outputs: TaskOutput[]): Promise<{
+    private reopenArchitecture;
+    completeRequirements(taskId: string, requirements: RequirementsV1): Promise<{
         outputHashes: Partial<Record<ArtifactKind, string>>;
         summary: string;
     }>;
+    private prepareRequirementsAmendment;
+    previewRequirementsAmendment(amendment: RequirementsAmendmentV1, reason: string): Promise<{
+        schemaVersion: "1.0.0";
+        projectId: string;
+        runId: string;
+        expectedHead: string;
+        ownerEpoch: number;
+        sourceRequirementsHash: string | null;
+        mode: "adopt" | "revise";
+        candidateHash: string;
+        reason: string;
+        addedRequirementIds: string[];
+        removedRequirementIds: string[];
+        changedRequirementIds: string[];
+        retainedRequirementIds: string[];
+        changedFields: string[];
+        invalidatedNodes: string[];
+        invalidatedGates: number[];
+        requiresReassessment: ["cost", "policy", "security", "dependencies", "code", "documents"];
+        filesModified: false;
+        deploymentAuthorized: false;
+        proposalHash: string;
+    }>;
+    amendRequirements(amendment: RequirementsAmendmentV1, options: {
+        reason: string;
+        expectedHash: string;
+        confirm: boolean;
+    }): Promise<{
+        candidateHash: string;
+        proposalHash: string;
+        invalidatedNodes: string[];
+        deploymentAuthorized: false;
+    }>;
+    previewRequirementsChange(candidate: RequirementsV1, reason: string, mode?: "adopt" | "revise"): Promise<{
+        schemaVersion: "1.0.0";
+        projectId: string;
+        runId: string;
+        expectedHead: string;
+        ownerEpoch: number;
+        sourceRequirementsHash: string | null;
+        mode: "adopt" | "revise";
+        candidateHash: string;
+        reason: string;
+        addedRequirementIds: string[];
+        removedRequirementIds: string[];
+        changedRequirementIds: string[];
+        retainedRequirementIds: string[];
+        changedFields: string[];
+        invalidatedNodes: string[];
+        invalidatedGates: number[];
+        requiresReassessment: ["cost", "policy", "security", "dependencies", "code", "documents"];
+        filesModified: false;
+        deploymentAuthorized: false;
+        proposalHash: string;
+    }>;
+    reviseRequirements(candidate: RequirementsV1, options: {
+        reason: string;
+        expectedHash: string;
+        confirm: boolean;
+        mode?: "adopt" | "revise";
+    }): Promise<{
+        candidateHash: string;
+        proposalHash: string;
+        invalidatedNodes: string[];
+        deploymentAuthorized: false;
+    }>;
+    private pendingRequirementsRevision;
+    private previousRequirementsHash;
+    completeArchitecture(taskId: string, architecture: ArchitectureV1, costEstimate: CostEstimateV1, decisionManifest: Omit<WorkloadDecisionManifestV1, "projectId" | "runId" | "environment" | "sourceRequirementsHash" | "architectureHash" | "costEstimateHash" | "requirementTraceability">, policyMappings: PolicyPropertyMapV1["mappings"]): Promise<{
+        outputHashes: Partial<Record<ArtifactKind, string>>;
+        summary: string;
+    }>;
+    /**
+     * Completes a review task from rubber-duck's captured output (DECISION-031). The kernel locates the single capture
+     * for the task's request nonce, verifies its signature, prompt and origin, checks that the reviewed artifact is
+     * still current, and derives every finding from the captured answer. The caller supplies no findings.
+     */
+    completeReview(taskId: string): Promise<{
+        outputHashes: Partial<Record<ArtifactKind, string>>;
+        summary: string;
+    }>;
+    /**
+     * Review requests in this workspace that still wait for their rubber-duck capture: in each run, the last issued task
+     * is a review task with a request, it is neither completed nor cancelled, and it has not expired. A rejected capture
+     * leaves the review pending until the next request or a cancellation. Unreadable task files count as pending.
+     */
+    private pendingReviews;
+    /**
+     * DECISION-031 amendment (2026-10-08): while a review waits for its capture, refuse operations that approve, delete
+     * or publish (MCP_TOOL_REVIEW_GUARDS), so an inherited rubber-duck cannot use them even when hooks fail open.
+     */
+    private assertNoPendingReview;
+    /**
+     * Best effort: removes captures of this run's used review requests whose earlier removal failed, and captures of
+     * long-expired requests. File times are wall-clock, so the sweep uses the wall clock rather than the service clock.
+     */
+    private sweepCaptures;
+    private reviewNonceConsumed;
+    private issuedReviewRequest;
+    private rejectReviewCapture;
+    /**
+     * Moves captures that will never be ingested into the run's object store as typed JSON audit evidence, so the shared
+     * review home stays bounded and state transfer can still carry (and secret-check) every journal-referenced object.
+     * Captures that cannot be archived move to the review home's quarantine first, so the caller's event records only
+     * moves that happened; the quarantine keeps them even if that event then loses the race to another writer. The
+     * caller removes `archived` once its event is committed.
+     */
+    private archiveReviewCaptures;
+    /**
+     * Writes the review inputs as readable files and builds the rubber-duck prompt that binds their hashes, the gate and
+     * a fresh single-use nonce. Returns the journal binding for `task.issued`.
+     */
+    private prepareReviewRequest;
     completePlan(taskId: string, intent: ImplementationIntentV1, binding: Omit<IacBindingV1, "intentHash">, environmentInputs: EnvironmentInputsV1): Promise<{
         outputHashes: Partial<Record<ArtifactKind, string>>;
         summary: string;
     }>;
+    private assertTaskType;
     private acceptTaskOutputs;
     private renderRequirementsDocument;
     private requirementsReviewDirectory;
+    private generatedReviewBase;
+    private assertGeneratedReviewUnmodified;
+    private assertTaskReviewFilesUnmodified;
+    private removeGeneratedReview;
+    private writeGeneratedReview;
+    private materializeOperationalIndex;
     private reviewMarkdownText;
     private materializeRequirementsReviewPackage;
     private materializeRequirementsChallengeFindings;
@@ -680,6 +1282,12 @@ export declare class ApexService {
     private requirementsDocumentTemplateContent;
     cancelTask(taskId: string): Promise<void>;
     resolveReview(resolution: ReviewResolution): Promise<void>;
+    decideReview(reviewHash: string, decisions: ReviewDecision[]): Promise<{
+        status: "revision_requested" | "resolved";
+    }>;
+    private reviewAcceptedRiskDefaults;
+    private pendingReview;
+    private reviseReview;
     private assertReviewResolution;
     decideGateNumber(gateNumber: number, decision: "approved" | "rejected", actor: string, options?: GateDecisionOptions): Promise<ApprovalEvidenceV1>;
     decideInteractiveGate(gateNumber: 1 | 2 | 3, decision: "approved" | "rejected"): Promise<ApprovalEvidenceV1>;
@@ -741,7 +1349,9 @@ export declare class ApexService {
     deleteTelemetry(): Promise<{
         deleted: true;
     }>;
-    render(kind: "status" | "requirements" | "preview" | "approval" | "inventory"): Promise<string>;
+    private renderAcceptedPlanGuide;
+    render(kind: "status" | "requirements" | "preview" | "approval" | "inventory" | "deployment-summary" | "deployment-guide" | "implementation-plan" | "operations-runbook" | "architecture-decisions"): Promise<string>;
+    private renderCompletedDeploymentSummary;
     diagnose(): Promise<unknown>;
     reconcile(): Promise<unknown>;
     setup(live?: boolean): Promise<unknown>;
@@ -756,6 +1366,9 @@ export declare class ApexService {
     private nextRequirementsIntakeRound;
     private issueRequirementsInput;
     private requirementsIntakeQuestions;
+    private recommendedWorkloadPattern;
+    private workloadScalePrompt;
+    private recommendedServiceCandidates;
     private append;
     private journal;
     private runPath;
@@ -763,18 +1376,27 @@ export declare class ApexService {
     private run;
     private assertRequirementsIntakeAdmitted;
     private runRepository;
+    private acquireRunWriterLease;
+    private releaseRunWriterLeaseIfOwned;
+    private refreshWorkspacePath;
+    private writerLeaseOwner;
     private selection;
     private writeSelection;
     private latestPayloadHash;
     private artifactHash;
     private acceptedArtifactHashes;
     private inputRefs;
+    private reviewSubjectArtifactKind;
+    private assertImportedGovernanceCurrent;
+    private latestGovernanceObservation;
+    private selectedGovernanceSnapshot;
     private recordedRequirementsInput;
     private outputTemplate;
     private requirementsTemplateFromIntake;
     private renderInputValue;
     private completedNodeIds;
     private lockedWorkflowEngine;
+    private taskLimits;
     private route;
     private gateApproved;
     private reviewBlockers;
@@ -783,15 +1405,34 @@ export declare class ApexService {
     private openReviewFindings;
     private validateOutput;
     private validateBundle;
+    private hasRequiredNativePolicyEvidence;
+    private policyResultsMatchMappings;
+    private referenceGovernanceNeedsRefresh;
+    private policyMapNeedsRefresh;
+    private refreshedPolicyMap;
+    private enforcingGovernanceFindings;
+    private governanceFindingsSummary;
+    private governanceFindingsFor;
+    private policyMappingKey;
+    private completePolicyMap;
+    private assertPolicyMapCoverage;
+    private policyMapCoverageIssues;
+    private policyValidationInput;
+    private hasBoundResourceParity;
+    private storageDiagnosticsTargets;
+    private hasBoundStorageRouting;
+    private hasBoundStorageDiagnostics;
+    private storageSecurityBindings;
     private validateTaskValidators;
     private qualityValidatorContext;
     private validateGateValidators;
+    private nativeBicepManagedResources;
+    private managedPreviewResources;
     private validatePreviewValidators;
     private validateDeployValidators;
     private deployValidatorIds;
     private validateInventoryValidators;
     private ensureTerminalCompletion;
-    private legacyPlanOutputs;
     private readTask;
     private refreshTaskHead;
     private assertNoSymlinkPath;
@@ -800,21 +1441,25 @@ export declare class ApexService {
     private looksLikeBinding;
     private looksLikeEnvironmentInputs;
     private assertValid;
+    private contractIssues;
     private invalidDateTimes;
     private improvements;
     private latestRun;
     private customizationSelection;
     private assertCleanInitialization;
     private createRuntimeLock;
+    private installRuntimeGeneration;
+    private bundledGovernanceReference;
+    private bundledToolchainMinimums;
+    private hostToolVersion;
+    private hostChecks;
+    private pluginSettingsCheck;
+    private runtimeRootForRun;
     private capabilityPacks;
     private runtimeLockChecks;
     private ensureLocalGitBoundary;
     private ensureWorkspaceRuntime;
     private ensureWorkspaceGitRepository;
-    private profilePaths;
-    private ensureProfileRoot;
-    private readProfileReceipt;
-    private readProfileOptional;
     private localGitBoundaryCheck;
     private managedFileChecks;
     private evidenceStore;