@apexops/cli 0.10.0-next.5 → 0.11.0-next.1

package/dist/workflow-validators.js

@@ -1,6 +1,195 @@
-import { ArchitectureV1Schema, GovernanceConstraintsV1Schema, IacBindingV1Schema, ImplementationIntentV1Schema, PolicyPropertyMapV1Schema, RequirementsV1Schema, WorkloadDecisionManifestV1Schema, SECRET_FIELD_PATTERN, SECRET_VALUE_PATTERN, hasValidCostArithmetic, } from "@apexops/contracts";
+import { ArchitectureV1Schema, GovernanceConstraintsV1Schema, IacBindingV1Schema, ImplementationIntentV1Schema, PolicyPropertyMapV1Schema, RequirementsV1Schema, WorkloadDecisionManifestV1Schema, SECRET_FIELD_PATTERN, SECRET_VALUE_PATTERN, hasValidCostArithmetic, isGovernanceObservationCurrent, } from "@apexops/contracts";
 import { WORKFLOW_VALIDATOR_OWNERSHIP, sha256Json, } from "@apexops/kernel";
 import { evaluateQualityScorecard } from "@apexops/renderers";
+import { Value } from "@sinclair/typebox/value";
+const bicepResourceGroupScopePattern = /^\/subscriptions\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\/resourceGroups\/[A-Za-z0-9_()-][A-Za-z0-9_.()-]*$(?![\s\S])/i;
+const bicepPhysicalResourcesSchema = IacBindingV1Schema.properties.resourceBindings.patternProperties["^(.*)$"].properties.physicalResources;
+function exactBicepPhysicalResourceType(resourceId, targetScope) {
+    if (!resourceId.toLowerCase().startsWith(`${targetScope}/providers/`.toLowerCase()))
+        return undefined;
+    const segments = resourceId.slice(targetScope.length + 1).split("/");
+    if (segments.some((segment) => !/^[A-Za-z0-9_()-][A-Za-z0-9_.()-]*$/.test(segment)))
+        return undefined;
+    let offset = 0;
+    let resourceType;
+    while (offset < segments.length) {
+        if (segments[offset].toLowerCase() !== "providers" ||
+            !/^Microsoft\.[A-Za-z0-9.]+$/i.test(segments[offset + 1] ?? ""))
+            return undefined;
+        const namespace = segments[offset + 1];
+        offset += 2;
+        const types = [];
+        while (offset < segments.length && segments[offset].toLowerCase() !== "providers") {
+            if (!/^[A-Za-z][A-Za-z0-9]*$/.test(segments[offset]) || segments[offset + 1] === undefined)
+                return undefined;
+            types.push(segments[offset]);
+            offset += 2;
+        }
+        if (types.length === 0)
+            return undefined;
+        resourceType = `${namespace}/${types.join("/")}`;
+    }
+    return resourceType;
+}
+function bicepPhysicalResourceIssues(binding, intentType, targetScope, path, physicalIds) {
+    const physicalResources = binding.physicalResources;
+    if (!binding.implementation.startsWith("avm:") ||
+        physicalResources === undefined ||
+        !Value.Check(bicepPhysicalResourcesSchema, physicalResources)) {
+        return [
+            { path, message: "Bicep module ownership is unresolved; AVM requires a bounded exact physical resource map" },
+        ];
+    }
+    if (!bicepResourceGroupScopePattern.test(targetScope)) {
+        return [{ path, message: "AVM ownership requires an exact resource-group scope" }];
+    }
+    const issues = [];
+    const primary = physicalResources.filter(({ role }) => role === "primary");
+    if (primary.length !== 1 ||
+        primary[0].ownership !== "managed" ||
+        primary[0].type.toLowerCase() !== intentType.toLowerCase()) {
+        issues.push({ path, message: "AVM ownership requires exactly one managed primary of the intent type" });
+    }
+    for (const { resourceId, type } of physicalResources) {
+        if (exactBicepPhysicalResourceType(resourceId, targetScope)?.toLowerCase() !== type.toLowerCase()) {
+            issues.push({ path, message: "AVM ownership requires exact target RG resource IDs with matching ARM types" });
+            continue;
+        }
+        const normalizedId = resourceId.toLowerCase();
+        if (physicalIds.has(normalizedId)) {
+            issues.push({ path, message: "Bicep bindings resolve to duplicate resource IDs" });
+        }
+        physicalIds.add(normalizedId);
+    }
+    return issues;
+}
+export function resolveNativeBicepResourceOwnership(context) {
+    const { intent, binding, manifest, targetScope } = context;
+    const issues = [];
+    const resourceIdsByLogicalId = Object.create(null);
+    const expectedResourceIds = [];
+    const protectedResourceIds = [];
+    if (!bicepResourceGroupScopePattern.test(targetScope)) {
+        issues.push({ path: "/targetScope", message: "Native Bicep ownership requires an exact resource-group scope" });
+    }
+    const intentIds = intent.resources.map(({ id }) => id).sort();
+    if (binding.track !== "bicep" ||
+        manifest.track !== "bicep" ||
+        binding.projectId !== intent.projectId ||
+        manifest.projectId !== intent.projectId ||
+        binding.runId !== intent.runId ||
+        manifest.runId !== intent.runId ||
+        binding.intentHash !== sha256Json(intent) ||
+        new Set(intentIds).size !== intentIds.length ||
+        JSON.stringify(Object.keys(binding.resourceBindings).sort()) !== JSON.stringify(intentIds) ||
+        JSON.stringify(manifest.resources.map(({ logicalId }) => logicalId).sort()) !== JSON.stringify(intentIds)) {
+        issues.push({
+            path: "/binding",
+            message: "Bicep ownership requires matching accepted intent, binding, and manifest coverage",
+        });
+    }
+    if (issues.length > 0) {
+        return { expectedResourceIds: [], resourceIdsByLogicalId, protectedResourceIds, issues };
+    }
+    const manifestResources = new Map(manifest.resources.map((resource) => [resource.logicalId, resource]));
+    const physicalIds = new Set();
+    const orderedResources = [
+        ...intent.resources.filter(({ id }) => binding.resourceBindings[id].scopeLogicalId === undefined),
+        ...intent.resources.filter(({ id }) => binding.resourceBindings[id].scopeLogicalId !== undefined),
+    ];
+    for (const resource of orderedResources) {
+        const resourceBinding = binding.resourceBindings[resource.id];
+        const entry = manifestResources.get(resource.id);
+        const path = `/binding/resourceBindings/${resource.id}`;
+        if (entry.type !== resource.type || entry.implementationAddress !== resourceBinding.implementation) {
+            issues.push({ path, message: "Manifest resource does not match the accepted binding and type" });
+            continue;
+        }
+        const scopeId = resourceBinding.scopeLogicalId;
+        if (scopeId !== undefined &&
+            (resource.type.toLowerCase() !== "microsoft.insights/diagnosticsettings" ||
+                !resourceBinding.implementation.startsWith("native:Microsoft.Insights/diagnosticSettings@") ||
+                !resource.dependsOn.includes(scopeId) ||
+                scopeId === resource.id ||
+                binding.resourceBindings[scopeId]?.scopeLogicalId !== undefined ||
+                !binding.resourceBindings[scopeId]?.implementation.startsWith("native:") ||
+                manifestResources.get(scopeId)?.ownership !== "managed" ||
+                entry.ownership !== "managed" ||
+                !Object.hasOwn(resourceIdsByLogicalId, scopeId) ||
+                Object.hasOwn(resourceBinding.parameters, "scope") ||
+                Object.hasOwn(resourceBinding.parameters, "parent"))) {
+            issues.push({ path, message: "Diagnostic scope requires an exactly resolved managed native dependency" });
+            continue;
+        }
+        if (resourceBinding.implementation.startsWith("avm:") || entry.implementationKind === "module") {
+            if (entry.ownership !== "managed" || entry.implementationKind !== "module") {
+                issues.push({
+                    path,
+                    message: "Bicep module ownership is unresolved; only managed AVM logical modules are supported",
+                });
+                continue;
+            }
+            const mapIssues = bicepPhysicalResourceIssues(resourceBinding, resource.type, targetScope, path, physicalIds);
+            issues.push(...mapIssues);
+            if (mapIssues.length > 0)
+                continue;
+            for (const { resourceId, ownership, role } of resourceBinding.physicalResources) {
+                if (ownership === "existing")
+                    protectedResourceIds.push(resourceId);
+                else {
+                    expectedResourceIds.push(resourceId);
+                    if (role === "primary")
+                        resourceIdsByLogicalId[resource.id] = resourceId;
+                }
+            }
+            continue;
+        }
+        if (resourceBinding.physicalResources !== undefined) {
+            issues.push({ path, message: "Physical resource maps are not supported on native Bicep declarations" });
+            continue;
+        }
+        const descriptor = /^native:(Microsoft\.[A-Za-z0-9.]+(?:\/[A-Za-z][A-Za-z0-9]*)+)@([0-9]{4}-[0-9]{2}-[0-9]{2}(?:-preview)?)$/.exec(resourceBinding.implementation);
+        const { name, parentId } = resourceBinding.parameters;
+        const typeSegments = descriptor?.[1]?.split("/") ?? [];
+        const nameSegments = typeof name === "string" ? name.split("/") : [];
+        if (descriptor === null ||
+            descriptor[1].toLowerCase() !== resource.type.toLowerCase() ||
+            resourceBinding.version !== descriptor[2] ||
+            typeof name !== "string" ||
+            nameSegments.length !== typeSegments.length - 1 ||
+            nameSegments.some((segment) => !/^[A-Za-z0-9][A-Za-z0-9_.-]*$(?![\s\S])/.test(segment)) ||
+            typeof parentId !== "string" ||
+            (parentId !== "/" && parentId.toLowerCase() !== targetScope.toLowerCase()) ||
+            (entry.ownership === "managed" && entry.implementationKind !== "resource")) {
+            issues.push({
+                path,
+                message: "Native Bicep ownership requires a matching type, exact literal name segments, and target RG parent",
+            });
+            continue;
+        }
+        const resourceId = `${scopeId === undefined ? targetScope : resourceIdsByLogicalId[scopeId]}/providers/${typeSegments[0]}/${typeSegments
+            .slice(1)
+            .map((segment, index) => `${segment}/${nameSegments[index]}`)
+            .join("/")}`;
+        const normalizedId = resourceId.toLowerCase();
+        if (physicalIds.has(normalizedId)) {
+            issues.push({ path, message: "Bicep bindings resolve to duplicate resource IDs" });
+        }
+        physicalIds.add(normalizedId);
+        if (entry.ownership === "existing")
+            protectedResourceIds.push(resourceId);
+        else {
+            expectedResourceIds.push(resourceId);
+            resourceIdsByLogicalId[resource.id] = resourceId;
+        }
+    }
+    return {
+        expectedResourceIds: issues.length === 0 ? expectedResourceIds : [],
+        resourceIdsByLogicalId: issues.length === 0 ? resourceIdsByLogicalId : {},
+        protectedResourceIds,
+        issues,
+    };
+}
 const VALIDATION_EVIDENCE_IDS = new Set([
     "bicep:build",
     "bicep:format",
@@ -12,6 +201,13 @@ const VALIDATION_EVIDENCE_IDS = new Set([
     "terraform:init-backend-false",
     "terraform:validate",
 ]);
+const WELL_ARCHITECTED_PILLARS = [
+    "security",
+    "reliability",
+    "performance-efficiency",
+    "cost-optimization",
+    "operational-excellence",
+];
 function issue(path, message) {
     return [{ path, message }];
 }
@@ -47,6 +243,10 @@ function requirementsTraceability(value) {
     if (requirements === undefined)
         return issue("/artifacts/requirements", "Accepted requirements are required");
     const knownIds = new Set(requirements.requirements.map(({ id }) => id));
+    const records = architecture.decisionRecords ?? [];
+    if (new Set(records.map(({ id }) => id)).size !== records.length ||
+        records.some(({ requirementIds }) => requirementIds.some((id) => !knownIds.has(id))))
+        return issue("/outputs/architecture/decisionRecords", "Decision records require unique IDs and accepted requirement references");
     const referencedIds = architecture.components.flatMap(({ requirementIds }) => requirementIds);
     const unknown = [...new Set(referencedIds.filter((id) => !knownIds.has(id)))].sort();
     if (unknown.length > 0) {
@@ -61,6 +261,42 @@ function requirementsTraceability(value) {
         ? []
         : issue("/outputs/architecture/components", `Uncovered confirmed must requirements: ${missing.join(", ")}`);
 }
+function wellArchitectedAssessmentComplete(value) {
+    const context = taskContext(value);
+    const architecture = context.outputs.architecture;
+    const requirements = context.artifacts.requirements;
+    const assessment = architecture.wellArchitectedAssessment;
+    if (requirements === undefined)
+        return issue("/artifacts/requirements", "Accepted requirements are required");
+    if (assessment === undefined) {
+        return issue("/outputs/architecture/wellArchitectedAssessment", "Well-Architected assessment is required");
+    }
+    const expectedPillars = [...WELL_ARCHITECTED_PILLARS].sort();
+    const actualPillars = assessment.pillars.map(({ pillar }) => pillar).sort();
+    if (new Set(actualPillars).size !== expectedPillars.length ||
+        JSON.stringify(actualPillars) !== JSON.stringify(expectedPillars)) {
+        return issue("/outputs/architecture/wellArchitectedAssessment/pillars", "Assessment must cover exactly the five Azure Well-Architected pillars");
+    }
+    const knownRequirementIds = new Set(requirements.requirements.map(({ id }) => id));
+    const acceptedEvidence = new Set([...context.inputRefs, ...Object.values(context.artifactHashes)]);
+    for (const pillar of assessment.pillars) {
+        if (pillar.requirementIds.length === 0 && pillar.evidenceRefs.length === 0) {
+            return issue("/outputs/architecture/wellArchitectedAssessment/pillars", `${pillar.pillar} must reference at least one accepted requirement or evidence item`);
+        }
+        const unknownRequirements = pillar.requirementIds.filter((id) => !knownRequirementIds.has(id));
+        if (unknownRequirements.length > 0) {
+            return issue("/outputs/architecture/wellArchitectedAssessment/pillars/requirementIds", `${pillar.pillar} references unknown requirements: ${unknownRequirements.join(", ")}`);
+        }
+        const unknownEvidence = pillar.evidenceRefs.filter((hash) => !acceptedEvidence.has(hash));
+        if (unknownEvidence.length > 0) {
+            return issue("/outputs/architecture/wellArchitectedAssessment/pillars/evidenceRefs", `${pillar.pillar} references evidence not accepted for this task`);
+        }
+        if ((pillar.status === "concern" || pillar.status === "blocker") && pillar.recommendations.length === 0) {
+            return issue("/outputs/architecture/wellArchitectedAssessment/pillars/recommendations", `${pillar.pillar} ${pillar.status} requires a recommendation`);
+        }
+    }
+    return [];
+}
 function costArithmetic(value) {
     const estimate = taskContext(value).outputs["cost-estimate"];
     return hasValidCostArithmetic(estimate) ? [] : issue("/outputs/cost-estimate", "Cost arithmetic does not reconcile");
@@ -101,13 +337,20 @@ function workloadDecisionCoverage(value) {
     for (const decision of manifest.skuDecisions) {
         const component = components.get(decision.logicalId);
         const costMatches = estimate.lineItems.filter((line) => line.service === decision.service && line.sku === decision.sku && line.quantity === decision.quantity);
+        const unavailableMatches = (estimate.unpricedItems ?? []).filter((line) => line.service === decision.service && line.sku === decision.sku && line.quantity === decision.quantity);
         if (component === undefined ||
             component.service !== decision.service ||
             !decision.requirementIds.every((id) => component.requirementIds.includes(id)) ||
-            costMatches.length !== 1) {
+            costMatches.length + unavailableMatches.length !== 1) {
             return issue("/outputs/workload-decision-manifest/skuDecisions", `SKU decision ${decision.id} is not architecture and cost traceable`);
         }
     }
+    const unpricedItems = estimate.unpricedItems ?? [];
+    if ((unpricedItems.length > 0 && estimate.pricingStatus !== "partial") ||
+        (unpricedItems.length === 0 && estimate.pricingStatus === "partial") ||
+        estimate.lineItems.length + unpricedItems.length === 0) {
+        return issue("/outputs/cost-estimate", "Partial pricing requires explicit unpriced items; complete pricing requires priced line items");
+    }
     for (const decision of manifest.sloDecisions) {
         const component = components.get(decision.logicalId);
         if (component === undefined || !decision.requirementIds.every((id) => component.requirementIds.includes(id))) {
@@ -116,53 +359,6 @@ function workloadDecisionCoverage(value) {
     }
     return [];
 }
-function availabilityCurrent(value) {
-    const context = taskContext(value);
-    const evidence = context.availabilityEvidence;
-    if (evidence === undefined)
-        return issue("/availabilityEvidence", "Current architecture availability evidence is required");
-    const architecture = context.outputs.architecture;
-    const issues = [];
-    if (evidence.projectId !== architecture.projectId ||
-        evidence.runId !== architecture.runId ||
-        evidence.targetScope !== context.targetScope) {
-        issues.push({
-            path: "/availabilityEvidence",
-            message: "Availability evidence does not match the architecture run",
-        });
-    }
-    const missingSourceRefs = Object.values(evidence.checks)
-        .map(({ evidenceRef }) => evidenceRef)
-        .filter((reference) => !context.inputRefs.includes(reference))
-        .sort();
-    if (missingSourceRefs.length > 0) {
-        issues.push({
-            path: "/availabilityEvidence/checks",
-            message: `Availability source evidence was not pinned to the task: ${missingSourceRefs.join(", ")}`,
-        });
-    }
-    const now = Date.parse(context.now);
-    if (Date.parse(evidence.collectedAt) > now) {
-        issues.push({
-            path: "/availabilityEvidence/collectedAt",
-            message: "Architecture availability evidence has a future collection timestamp",
-        });
-    }
-    if (Date.parse(evidence.expiresAt) <= now) {
-        issues.push({ path: "/availabilityEvidence/expiresAt", message: "Architecture availability evidence is expired" });
-    }
-    const unavailable = Object.entries(evidence.checks)
-        .filter(([, check]) => check.status !== "current")
-        .map(([name]) => name)
-        .sort();
-    if (unavailable.length > 0) {
-        issues.push({
-            path: "/availabilityEvidence/checks",
-            message: `Architecture availability checks are not current: ${unavailable.join(", ")}`,
-        });
-    }
-    return issues;
-}
 function governanceCompleteness(value) {
     const governance = taskContext(value).outputs["governance-constraints"];
     const discoveredItems = Object.values(governance.summary).reduce((total, count) => total + count, 0);
@@ -173,6 +369,11 @@ function governanceCompleteness(value) {
 function governanceFreshness(value) {
     const context = taskContext(value);
     const governance = context.outputs["governance-constraints"];
+    if (governance.constraintsRef.uri === `apex-object:${governance.constraintsRef.digest}`) {
+        return isGovernanceObservationCurrent(governance.discoveredAt, context.now)
+            ? []
+            : issue("/outputs/governance-constraints/discoveredAt", "Governance snapshot requires refresh at 30 days");
+    }
     const now = Date.parse(context.now);
     if (Date.parse(governance.discoveredAt) > now) {
         return issue("/outputs/governance-constraints/discoveredAt", "Governance discovery is from the future");
@@ -191,11 +392,17 @@ function policyEffectCoverage(value) {
     const counts = new Map();
     for (const mapping of policyMap.mappings)
         counts.set(mapping.effect, (counts.get(mapping.effect) ?? 0) + 1);
-    const missing = [
-        ["deny", governance.summary.denyCount],
-        ["modify", governance.summary.modifyCount],
-        ["audit", governance.summary.auditCount],
-    ].flatMap(([effect, required]) => (counts.get(effect) ?? 0) < required ? [effect] : []);
+    const requiredCounts = context.importedPolicyEffects === undefined
+        ? [
+            ["deny", governance.summary.denyCount],
+            ["modify", governance.summary.modifyCount],
+            ["audit", governance.summary.auditCount],
+        ]
+        : ["deny", "modify", "deployIfNotExists"].map((effect) => [
+            effect,
+            context.importedPolicyEffects.filter((value) => value === effect).length,
+        ]);
+    const missing = requiredCounts.flatMap(([effect, required]) => (counts.get(effect) ?? 0) < required ? [effect] : []);
     return missing.length === 0
         ? []
         : issue("/outputs/policy-property-map/mappings", `Missing policy effect coverage: ${missing.join(", ")}`);
@@ -205,9 +412,27 @@ function planSourceCoverage(value) {
     const intent = context.outputs["implementation-intent"];
     const requiredSources = ["requirements", "architecture", "governance-constraints", "policy-property-map"].filter((kind) => context.artifactHashes[kind] !== undefined);
     const invalid = requiredSources.filter((kind) => intent.sourceHashes[kind] !== context.artifactHashes[kind]);
-    return invalid.length === 0
+    const issues = invalid.length === 0
         ? []
         : issue("/outputs/implementation-intent/sourceHashes", `Missing or stale source hashes: ${invalid.join(", ")}`);
+    const policy = context.artifacts["policy-property-map"];
+    if (context.artifactHashes["policy-property-map"] !== undefined && policy === undefined) {
+        issues.push({ path: "/artifacts/policy-property-map", message: "Accepted policy mappings are required" });
+    }
+    const resources = new Set(intent.resources.map(({ id }) => id));
+    for (const mapping of policy?.mappings ?? []) {
+        if (mapping.disposition !== "not-applicable" && !resources.has(mapping.logicalResourceId))
+            issues.push({
+                path: "/outputs/implementation-intent/resources",
+                message: "Policy mapping references a resource absent from the plan",
+            });
+        if (mapping.disposition === "blocked")
+            issues.push({
+                path: "/artifacts/policy-property-map/mappings",
+                message: "Blocked policy controls must be resolved before plan acceptance",
+            });
+    }
+    return issues;
 }
 function bindingTrackMatch(value) {
     const context = taskContext(value);
@@ -215,12 +440,46 @@ function bindingTrackMatch(value) {
     const binding = context.outputs["iac-binding"];
     const resourceIds = new Set(intent.resources.map(({ id }) => id));
     const bindingIds = Object.keys(binding.resourceBindings);
-    return binding.track === context.track &&
+    const issues = binding.track === context.track &&
         binding.intentHash === sha256Json(intent) &&
         bindingIds.length === resourceIds.size &&
         bindingIds.every((id) => resourceIds.has(id))
         ? []
         : issue("/outputs/iac-binding", "IaC binding track, intent, or resource coverage is invalid");
+    if (Object.values(binding.resourceBindings).some(({ physicalResources, scopeLogicalId }) => physicalResources !== undefined || scopeLogicalId !== undefined)) {
+        if (binding.track !== "bicep") {
+            issues.push({
+                path: "/outputs/iac-binding",
+                message: "Exact physical resource maps and diagnostic scope references are supported only for Bicep bindings",
+            });
+        }
+        else if (issues.length === 0) {
+            issues.push(...resolveNativeBicepResourceOwnership({
+                intent,
+                binding,
+                targetScope: context.targetScope,
+                manifest: {
+                    schemaVersion: "1.0.0",
+                    projectId: intent.projectId,
+                    runId: intent.runId,
+                    track: "bicep",
+                    resources: intent.resources.map((resource) => ({
+                        logicalId: resource.id,
+                        type: resource.type,
+                        implementationAddress: binding.resourceBindings[resource.id].implementation,
+                        implementationKind: binding.resourceBindings[resource.id].implementation.startsWith("avm:")
+                            ? "module"
+                            : "resource",
+                        ownership: "managed",
+                        dependsOn: resource.dependsOn,
+                        generatedDependencies: [],
+                        sourcePath: "main.bicep",
+                    })),
+                },
+            }).issues);
+        }
+    }
+    return issues;
 }
 function dependencyAcyclic(value) {
     const intent = taskContext(value).outputs["implementation-intent"];
@@ -267,17 +526,27 @@ function bindingCoverage(expectedTrack, value) {
     const expectedIds = intent.resources.map(({ id }) => id).sort();
     const bindingIds = Object.keys(binding.resourceBindings).sort();
     const manifestIds = manifest.resources.map(({ logicalId }) => logicalId).sort();
+    const intentById = new Map(intent.resources.map((resource) => [resource.id, resource]));
     return binding.track === expectedTrack &&
         manifest.track === expectedTrack &&
         JSON.stringify(bindingIds) === JSON.stringify(expectedIds) &&
-        JSON.stringify(manifestIds) === JSON.stringify(expectedIds)
+        JSON.stringify(manifestIds) === JSON.stringify(expectedIds) &&
+        manifest.resources.every((resource) => {
+            const approved = intentById.get(resource.logicalId);
+            const implementation = binding.resourceBindings[resource.logicalId];
+            return (approved !== undefined &&
+                implementation !== undefined &&
+                resource.type === approved.type &&
+                resource.implementationAddress === implementation.implementation &&
+                JSON.stringify([...resource.dependsOn].sort()) === JSON.stringify([...approved.dependsOn].sort()));
+        })
         ? []
         : issue("/outputs/logical-resource-manifest", `${expectedTrack} binding coverage is incomplete`);
 }
 function comprehensiveReview(expectedNode, value) {
     const context = taskContext(value);
     const review = context.outputs["review-findings"];
-    const subjectKind = expectedNode === "governance-reconciliation" ? "policy-property-map" : expectedNode;
+    const subjectKind = expectedNode;
     const artifactKind = subjectKind === "plan" ? "implementation-intent" : subjectKind;
     const expectedHash = context.artifactHashes[artifactKind];
     const findingIds = review.findings.map(({ id }) => id);
@@ -288,6 +557,41 @@ function comprehensiveReview(expectedNode, value) {
         ? []
         : issue("/outputs/review-findings", `Review does not bind the accepted ${subjectKind} artifact`);
 }
+function wellArchitectedCriteriaComplete(value) {
+    const context = taskContext(value);
+    const review = context.outputs["review-findings"];
+    const architecture = context.artifacts.architecture;
+    if (architecture?.wellArchitectedAssessment === undefined) {
+        return issue("/artifacts/architecture/wellArchitectedAssessment", "Accepted Well-Architected assessment is required");
+    }
+    const criteria = review.criteria;
+    if (criteria === undefined) {
+        return issue("/outputs/review-findings/criteria", "Well-Architected review criteria are required");
+    }
+    const expectedPillars = [...WELL_ARCHITECTED_PILLARS].sort();
+    const actualPillars = criteria.map(({ criterionId }) => criterionId).sort();
+    if (new Set(actualPillars).size !== expectedPillars.length ||
+        JSON.stringify(actualPillars) !== JSON.stringify(expectedPillars)) {
+        return issue("/outputs/review-findings/criteria", "Review must cover exactly the five Azure Well-Architected pillars");
+    }
+    const findingIds = new Set(review.findings.map(({ id }) => id));
+    const statusByPillar = new Map(architecture.wellArchitectedAssessment.pillars.map(({ pillar, status }) => [pillar, status]));
+    for (const criterion of criteria) {
+        if (criterion.findingIds.some((id) => !findingIds.has(id))) {
+            return issue("/outputs/review-findings/criteria/findingIds", `${criterion.criterionId} references an unknown finding`);
+        }
+        if (criterion.outcome === "finding" && criterion.findingIds.length === 0) {
+            return issue("/outputs/review-findings/criteria/findingIds", `${criterion.criterionId} requires a linked finding`);
+        }
+        if (criterion.outcome === "pass" && criterion.findingIds.length > 0) {
+            return issue("/outputs/review-findings/criteria/findingIds", `${criterion.criterionId} pass cannot link findings`);
+        }
+        if (criterion.outcome === "not-applicable" && statusByPillar.get(criterion.criterionId) !== "not-applicable") {
+            return issue("/outputs/review-findings/criteria/outcome", `${criterion.criterionId} can be not applicable only when the accepted assessment is not applicable`);
+        }
+    }
+    return [];
+}
 function requiredValidationEvidence(id, value) {
     const evidence = value;
     const matches = evidence.entries.filter(({ kind }) => kind === id);
@@ -306,8 +610,8 @@ function gateReady(expectedGate, value) {
         3: ["implementation-intent", "iac-binding", "environment-inputs"],
     };
     const requiredReviews = {
-        1: context.legacyRequirements ? [] : ["requirements-review"],
-        2: ["architecture-review", "governance-review"],
+        1: ["requirements-review"],
+        2: ["architecture-review"],
         3: ["plan-review"],
     };
     const issues = [];
@@ -434,8 +738,9 @@ function previewCoverage(value) {
     const context = previewContext(value);
     const changes = context.preview.changes;
     const resourceIds = changes.map(({ resourceId }) => resourceId);
-    const issues = [];
-    if (new Set(resourceIds).size !== resourceIds.length) {
+    const issues = [...(context.ownershipIssues ?? [])];
+    const uniqueIds = context.provider === "bicep" ? resourceIds.map((id) => id.toLowerCase()) : resourceIds;
+    if (new Set(uniqueIds).size !== resourceIds.length) {
         issues.push({ path: "/changes", message: "Preview contains duplicate resource changes" });
     }
     if (changes.some(({ action }) => action === "unknown")) {
@@ -448,6 +753,32 @@ function previewCoverage(value) {
             issues.push({ path: "/changes", message: "Fake preview does not cover every requested resource" });
         }
     }
+    if (context.provider === "terraform") {
+        const managedAddresses = new Set(context.expectedResourceIds);
+        if (changes.some(({ resourceId, action, material }) => (action !== "no-op" || material) && !managedAddresses.has(resourceId))) {
+            issues.push({
+                path: "/changes",
+                message: "Terraform preview would modify a resource outside accepted managed ownership",
+            });
+        }
+    }
+    if (context.provider === "bicep") {
+        const protectedIds = (context.protectedResourceIds ?? []).map((id) => id.toLowerCase());
+        if (changes.some(({ resourceId, action }) => (action === "delete" || action === "replace") &&
+            protectedIds.some((id) => id === resourceId.toLowerCase() || id.startsWith(`${resourceId.toLowerCase()}/`)))) {
+            issues.push({
+                path: "/changes",
+                message: "Bicep destructive operation would remove a protected existing resource or its ancestor",
+            });
+        }
+        const managedIds = new Set(context.expectedResourceIds.map((id) => id.toLowerCase()));
+        if (changes.some(({ resourceId, action, material }) => (action !== "no-op" || material) && !managedIds.has(resourceId.toLowerCase()))) {
+            issues.push({
+                path: "/changes",
+                message: "Bicep preview would modify a resource outside accepted managed ownership",
+            });
+        }
+    }
     return issues;
 }
 function previewFreshness(value) {
@@ -473,6 +804,7 @@ function terraformSavedPlanBinding(value) {
         lockfileHash: attestation.lockfileHash,
         recipient: attestation.recipient,
         artifactRef: attestation.artifactRef,
+        ...(context.policyValidationBinding === undefined ? {} : { policyValidation: context.policyValidationBinding }),
     });
     const valid = attestation.projectId === preview.projectId &&
         attestation.runId === preview.runId &&
@@ -587,7 +919,7 @@ function inventorySecretFree(value) {
 function inventorySourceCoverage(value) {
     const context = inventoryContext(value);
     const inventory = context.inventory;
-    const resourceIds = inventory.resources.map(({ resourceId }) => resourceId);
+    const resourceIds = inventory.resources.map(({ resourceId }) => /^\/subscriptions\//i.test(resourceId) ? resourceId.toLowerCase() : resourceId);
     const logicalIds = inventory.resources.map(({ logicalId }) => logicalId);
     const issues = [];
     if (new Set(resourceIds).size !== resourceIds.length || new Set(logicalIds).size !== logicalIds.length) {
@@ -596,7 +928,9 @@ function inventorySourceCoverage(value) {
     const expected = context.preview.changes
         .filter(({ material, action }) => material && action !== "delete" && action !== "no-op")
         .map(({ resourceId }) => resourceId);
-    const missing = expected.filter((expectedId) => !inventory.resources.some(({ logicalId, resourceId }) => logicalId === expectedId || resourceId === expectedId || resourceId.endsWith(`:${expectedId}`)));
+    const missing = expected.filter((expectedId) => !inventory.resources.some(({ logicalId, resourceId }) => /^\/subscriptions\//i.test(expectedId)
+        ? resourceId.toLowerCase() === expectedId.toLowerCase()
+        : logicalId === expectedId || resourceId === expectedId || resourceId.endsWith(`:${expectedId}`)));
     if (missing.length > 0) {
         issues.push({
             path: "/inventory/resources",
@@ -637,7 +971,13 @@ function diagnosisReadOnly(value) {
             message: "Diagnosis is not a read-only observation of current inventory",
         });
     }
-    const unpinned = diagnosis.causes
+    const checks = diagnosis.operationalHandoff?.healthChecks ?? [];
+    if (checks.some(({ resourceId }) => !inventory.resources.some((resource) => resource.resourceId === resourceId)))
+        issues.push({
+            path: "/outputs/diagnosis/operationalHandoff/healthChecks",
+            message: "Health checks must reference recorded inventory resources",
+        });
+    const unpinned = [...diagnosis.causes, ...checks]
         .flatMap(({ evidenceRefs }) => evidenceRefs)
         .filter((reference) => !context.inputRefs.includes(reference))
         .sort();
@@ -762,9 +1102,10 @@ export function registerWorkflowValidators(registry) {
     registry.register("schema:iac-binding-v1", IacBindingV1Schema);
     registry.registerHandler("business:requirements-completeness", requirementsCompleteness);
     registry.registerHandler("business:requirements-traceability", requirementsTraceability);
+    registry.registerHandler("business:well-architected-assessment-complete", wellArchitectedAssessmentComplete);
     registry.registerHandler("business:workload-decision-manifest-coverage", workloadDecisionCoverage);
     registry.registerHandler("business:cost-arithmetic", costArithmetic);
-    registry.registerHandler("business:availability-current", availabilityCurrent, "freshness");
+    registry.registerHandler("business:availability-current", () => [], "freshness");
     registry.registerHandler("business:governance-completeness", governanceCompleteness);
     registry.registerHandler("business:governance-freshness", governanceFreshness, "freshness");
     registry.registerHandler("business:policy-effect-coverage", policyEffectCoverage);
@@ -775,7 +1116,7 @@ export function registerWorkflowValidators(registry) {
     registry.registerHandler("business:terraform-binding-coverage", (value) => bindingCoverage("terraform", value));
     registry.registerHandler("review:requirements-comprehensive", (value) => comprehensiveReview("requirements", value));
     registry.registerHandler("review:architecture-comprehensive", (value) => comprehensiveReview("architecture", value));
-    registry.registerHandler("review:governance-reconciliation", (value) => comprehensiveReview("governance-reconciliation", value));
+    registry.registerHandler("review:well-architected-criteria-complete", wellArchitectedCriteriaComplete);
     registry.registerHandler("review:plan-comprehensive", (value) => comprehensiveReview("plan", value));
     for (const id of VALIDATION_EVIDENCE_IDS) {
         registry.registerHandler(id, (value) => requiredValidationEvidence(id, value));

package/dist/workspace-root.d.ts

@@ -0,0 +1,7 @@
+export interface ResolvedMcpWorkspace {
+    workspace: string;
+    root: string;
+}
+export declare function mcpWorkspaceRoot(start: string): Promise<string>;
+export declare function resolveMcpWorkspace(start: string): Promise<ResolvedMcpWorkspace>;
+//# sourceMappingURL=workspace-root.d.ts.map