@apexops/cli 0.10.0-next.5 → 0.11.0-next.1

package/assets/capability-packs/registry.v1.json

@@ -8,66 +8,5 @@
     "transitiveLocksRequired": true,
     "installOnlyForDeclaredWorkflow": true
   },
-  "packs": [
-    {
-      "id": "azure-governance-discovery",
-      "availability": "optional-required-by-workflow",
-      "implementation": "python",
-      "source": ".github/skills/azure-governance-discovery",
-      "lazyInstall": true,
-      "requiredWorkflows": [
-        "governance-discovery",
-        "governance-reconciliation",
-        "preview-bicep",
-        "preview-terraform"
-      ],
-      "lockOwnership": {
-        "manifest": "config/capability-packs.v1.json",
-        "runtimeVersion": "pack-lock",
-        "directDependencies": "pack-lock",
-        "transitiveDependencies": "pack-lock",
-        "resolvedArtifactDigest": "runtime-bundle-build"
-      },
-      "absentBehavior": {
-        "affectedWorkflow": "blocked-capability-unavailable",
-        "unaffectedWorkflows": "continue",
-        "projectStatus": "available",
-        "emptyGovernanceResultAllowed": false
-      },
-      "replacementCriteria": {
-        "minimumMeasuredRuns": 100,
-        "candidateCompletenessMustBeNoLessThanCurrent": true,
-        "candidateFailureRateMustBeNoGreaterThanCurrent": true,
-        "candidateP95LatencyMustBeNoGreaterThanCurrent": true,
-        "securityFindingsMustNotIncrease": true,
-        "maintenanceBurdenReductionEvidenceRequired": true,
-        "owner": "governance"
-      },
-      "version": "1.0.0",
-      "runtime": "python",
-      "artifact": {
-        "type": "local-directory",
-        "spec": "capability-packs/azure-governance-discovery/source",
-        "digest": "e8b097a5664f9651ee55d6d2e64d733b797decb32b6a309fdbf489fcd65a8b70"
-      },
-      "lock": {
-        "installer": "pip-hashes",
-        "digest": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
-        "directDigest": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
-        "transitiveDigest": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
-      },
-      "executable": {
-        "command": "python",
-        "args": [
-          "scripts/discover.py"
-        ]
-      },
-      "dependencyFree": true,
-      "script": "scripts/discover.py",
-      "scriptDigest": "e14cd39d279f75d353a0578928004cdfc2c7a98c43a0ba9b111332603b9829e2",
-      "capabilities": [
-        "governance-discovery"
-      ]
-    }
-  ]
+  "packs": []
 }

package/assets/client-projection-metadata/copilot-cli-agent-tools.json

@@ -32,13 +32,16 @@
     "askUser": "ask_user",
     "delegate": "task"
   },
+  "agentReadTools": ["view", "glob", "rg"],
   "mcpSelectorFormat": "{server}/{operation}",
   "verifiedSelectors": [
     "apex/status",
+    "apex/releaseWriter",
     "apex/capabilityList",
     "apex/capabilityStatus",
     "apex/nextTask",
     "apex/taskContext",
+    "apex/readTaskInput",
     "apex/recordInput",
     "apex/projectCreate",
     "apex/projectList",
@@ -55,6 +58,8 @@
     "apex/reviewComplete",
     "apex/reviewDecide",
     "apex/planComplete",
+    "apex/governanceImport",
+    "apex/governanceSelect",
     "apex/preview",
     "apex/reconcile",
     "apex/inventory",
@@ -65,14 +70,17 @@
     "apex/render",
     "apex/promote",
     "apex/doctor",
+    "apex/doctorChecks",
     "apex/submitEvidence"
   ],
   "operationIds": [
     "status",
+    "releaseWriter",
     "capabilityList",
     "capabilityStatus",
     "nextTask",
     "taskContext",
+    "readTaskInput",
     "recordInput",
     "projectCreate",
     "projectList",
@@ -89,6 +97,8 @@
     "reviewComplete",
     "reviewDecide",
     "planComplete",
+    "governanceImport",
+    "governanceSelect",
     "preview",
     "reconcile",
     "inventory",
@@ -99,9 +109,11 @@
     "render",
     "promote",
     "doctor",
+    "doctorChecks",
     "submitEvidence"
   ],
   "evidence": {
+    "agentReadToolProbe": "CLI 1.0.88 session 787aebd7: agent frontmatter view, glob and rg were granted; grep and shell(bicep:*) were ignored",
     "nativeToolProbe": "isolated CLI 1.0.77 run with MCP, remote control, custom instructions, and ask_user disabled; bash, view, glob, rg, and apply_patch were recognized while edit and grep were rejected as unknown",
     "collection": "trusted disposable workspace; built-in MCP disabled; full workspace allowlist; --available-tools and --allow-tool set to every apex/<operation>; no tool invocation",
     "probeSha256": "3d3d3e985aa2599584303c16098d12d4efd9f7fbd07876b42a59baabd6f0cb22",

package/assets/client-projections/github-copilot-cli/.github/copilot/settings.json

@@ -0,0 +1,13 @@
+{
+  "enabledPlugins": {
+    "apex@apex-plugins": true
+  },
+  "extraKnownMarketplaces": {
+    "apex-plugins": {
+      "source": {
+        "source": "github",
+        "repo": "jonathan-vella/apex-plugins"
+      }
+    }
+  }
+}

package/assets/client-projections/github-copilot-cli/.github/instructions/apex-prompt-authoring.instructions.md

@@ -5,7 +5,7 @@ applyTo: ".github/agents/**/*.agent.md, .github/prompts/**/*.prompt.md"
 
 # APEX Prompt Rules
 
-- Use the model assigned by the managed role and do not override it redundantly.
+- Omit `model`, `model-policy` and `reasoning-effort`; the session model the user picks applies.
 - Keep prompts outcome-focused with explicit scope, input, output, and stop conditions.
 - Keep tool lists minimal and use native client questions for user-owned decisions.
 - Do not grant direct mutation, secrets, repository maintenance, or cloud lifecycle authority.

package/assets/client-projections/github-copilot-cli/.github/workflows/governance-policy-baseline.yml

@@ -0,0 +1,101 @@
+name: Governance Policy Baseline
+
+on:
+  schedule:
+    - cron: "0 5 * * 1"
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  collect-baseline:
+    if: vars.GOVERNANCE_BASELINE_ENABLED == 'true'
+    runs-on: ubuntu-latest
+    environment: governance
+    permissions:
+      contents: write
+      pull-requests: write
+      id-token: write
+    env:
+      AZURE_CLIENT_ID: ${{ vars.AZURE_CLIENT_ID || secrets.AZURE_CLIENT_ID }}
+      AZURE_TENANT_ID: ${{ vars.AZURE_TENANT_ID || secrets.AZURE_TENANT_ID }}
+      AZURE_SUBSCRIPTION_ID: ${{ vars.AZURE_SUBSCRIPTION_ID || secrets.AZURE_SUBSCRIPTION_ID }}
+      GOVERNANCE_MG_ID: ${{ vars.GOVERNANCE_MG_ID }}
+      GOVERNANCE_SUBSCRIPTION_ID: ${{ vars.GOVERNANCE_SUBSCRIPTION_ID }}
+      GOVERNANCE_MAX_SUBSCRIPTIONS: ${{ vars.GOVERNANCE_MAX_SUBSCRIPTIONS || '100' }}
+    steps:
+      - name: Validate collection configuration
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $hasManagementGroup = -not [string]::IsNullOrEmpty($env:GOVERNANCE_MG_ID)
+          $hasSubscription = -not [string]::IsNullOrEmpty($env:GOVERNANCE_SUBSCRIPTION_ID)
+          if ($hasManagementGroup -eq $hasSubscription) {
+            throw 'Configure exactly one governance management group or subscription.'
+          }
+          if ($hasManagementGroup -and $env:GOVERNANCE_MG_ID -cnotmatch '\A[a-zA-Z0-9](?:[a-zA-Z0-9_().-]{0,88}[a-zA-Z0-9_()-])?\z') {
+            throw 'Invalid governance management group ID.'
+          }
+          $guidPattern = '\A[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}\z'
+          if ($hasSubscription -and $env:GOVERNANCE_SUBSCRIPTION_ID -cnotmatch $guidPattern) {
+            throw 'Invalid governance subscription ID.'
+          }
+          foreach ($value in @($env:AZURE_CLIENT_ID, $env:AZURE_TENANT_ID, $env:AZURE_SUBSCRIPTION_ID)) {
+            if ([string]::IsNullOrEmpty($value) -or $value -cnotmatch $guidPattern) {
+              throw 'Configure valid Azure OIDC client, tenant, and login subscription IDs.'
+            }
+          }
+          $maximum = 0
+          if ($env:GOVERNANCE_MAX_SUBSCRIPTIONS -cnotmatch '\A[0-9]+\z' -or
+              -not [int]::TryParse($env:GOVERNANCE_MAX_SUBSCRIPTIONS, [ref]$maximum) -or $maximum -lt 1) {
+            throw 'Maximum subscriptions must be an integer from 1 through 2147483647.'
+          }
+
+      - name: Checkout repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Azure Login (OIDC)
+        uses: azure/login@a641126d1b8aa4d1fa005f4f92df94a3a4c4c906 # v3.1.0
+        with:
+          client-id: ${{ env.AZURE_CLIENT_ID }}
+          tenant-id: ${{ env.AZURE_TENANT_ID }}
+          subscription-id: ${{ env.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Collect governance baseline
+        shell: pwsh
+        run: |
+          $ErrorActionPreference = 'Stop'
+          $parameters = @{ MaxSubscriptions = [int]$env:GOVERNANCE_MAX_SUBSCRIPTIONS; IncludeDefenderAuto = $true; IncludeDescendants = $true }
+          if ($env:GOVERNANCE_MG_ID) {
+            $parameters.ManagementGroupId = $env:GOVERNANCE_MG_ID
+          } else {
+            $parameters.SubscriptionId = $env:GOVERNANCE_SUBSCRIPTION_ID
+          }
+          try {
+            & ./tools/scripts/collect-governance-baseline.ps1 @parameters *> $null
+            $baseline = Get-Content -LiteralPath '.github/data/governance-policy-baseline.json' -Raw
+            if (-not (Test-Json -Json $baseline -SchemaFile './tools/schemas/governance-baseline.schema.json' -ErrorAction Stop)) {
+              throw 'Invalid baseline.'
+            }
+          } catch {
+            throw 'Governance collection or schema validation failed; no baseline PR will be created.'
+          }
+
+      - name: Create pull request
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          add-paths: .github/data/governance-policy-baseline.json
+          commit-message: "chore(data): Update governance policy baseline"
+          branch: "chore/governance-baseline-update"
+          delete-branch: true
+          title: "chore(data): Update governance policy baseline"
+          body: |
+            Updates only `.github/data/governance-policy-baseline.json`.
+            Human review and manual merge are required. Review scope, coverage,
+            exclusions, and policy changes before approving this baseline.

package/assets/client-projections/github-copilot-cli/tools/schemas/governance-baseline.schema.json

@@ -0,0 +1,118 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/jonathan-vella/apex-vnext/schemas/governance-baseline.schema.json",
+  "title": "APEX Governance Baseline",
+  "description": "Shape of .github/data/governance-policy-baseline.json produced by the governance-policy-baseline workflow. Wraps per-subscription governance-constraints-v1 envelopes.",
+  "type": "object",
+  "required": [
+    "schema_version",
+    "coverage_status",
+    "subscriptions_discovered",
+    "subscriptions_processed",
+    "subscriptions_skipped",
+    "subscriptions_excluded",
+    "summary",
+    "subscriptions"
+  ],
+  "additionalProperties": false,
+  "oneOf": [
+    {
+      "required": ["management_group_id"],
+      "not": { "required": ["subscription_id"] }
+    },
+    {
+      "required": ["subscription_id"],
+      "not": { "required": ["management_group_id"] }
+    }
+  ],
+  "properties": {
+    "schema_version": {
+      "type": "string",
+      "const": "governance-baseline-v2"
+    },
+    "management_group_id": {
+      "type": "string",
+      "minLength": 1
+    },
+    "subscription_id": {
+      "description": "Standalone collection root; mutually exclusive with management_group_id.",
+      "type": "string",
+      "pattern": "^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$"
+    },
+    "coverage_status": {
+      "type": "string",
+      "enum": ["COMPLETE", "PARTIAL"]
+    },
+    "subscriptions_discovered": {
+      "type": "integer",
+      "minimum": 0
+    },
+    "subscriptions_processed": {
+      "type": "integer",
+      "minimum": 0
+    },
+    "subscriptions_skipped": {
+      "type": "array",
+      "items": { "type": "string" }
+    },
+    "subscriptions_excluded": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "required": ["subscription_id", "reason"],
+        "additionalProperties": true,
+        "properties": {
+          "subscription_id": { "type": "string" },
+          "reason": {
+            "type": "string",
+            "enum": ["disabled", "AAD_quota", "unreadable", "processing_error"]
+          },
+          "detail": { "type": "string" },
+          "quota_id": { "type": "string" }
+        }
+      }
+    },
+    "summary": {
+      "type": "object",
+      "required": ["total_findings", "total_blockers", "total_auto_remediate", "subscriptions_complete"],
+      "additionalProperties": true,
+      "properties": {
+        "total_findings": { "type": "integer", "minimum": 0 },
+        "total_blockers": { "type": "integer", "minimum": 0 },
+        "total_auto_remediate": { "type": "integer", "minimum": 0 },
+        "subscriptions_complete": { "type": "integer", "minimum": 0 }
+      }
+    },
+    "subscriptions": {
+      "type": "object",
+      "description": "Map of subscription ID to governance-constraints-v1 envelope. Each value must be a valid governance-constraints-v1 envelope.",
+      "additionalProperties": {
+        "type": "object",
+        "required": ["schema_version", "subscription_id", "discovered_at", "findings"],
+        "additionalProperties": true,
+        "properties": {
+          "schema_version": { "type": "string", "const": "governance-constraints-v1" },
+          "subscription_id": { "type": "string" },
+          "discovered_at": { "type": "string" },
+          "source": { "type": "string" },
+          "discovery_status": { "type": "string" },
+          "discovery_metadata": {
+            "type": "object",
+            "properties": {
+              "scope": {
+                "type": "object",
+                "properties": {
+                  "coverage": { "const": "subscription-and-descendants-v1" }
+                }
+              }
+            }
+          },
+          "findings": { "type": "array" },
+          "policies": false,
+          "tags_required": { "type": "array" },
+          "allowed_locations": { "type": "array" }
+        }
+      }
+    }
+  }
+}