@apexops/cli 0.10.0-next.5 → 0.11.0-next.1

package/assets/client-projections/github-copilot-cli/.github/skills/apex-bicep-patterns/references/network-and-observability.md

@@ -1,52 +0,0 @@
-# Network And Observability
-
-Read this reference when a Bicep binding includes hub-spoke networking, private connectivity, or resource diagnostics.
-
-## Hub-Spoke Composition
-
-Use hub-spoke topology only when shared connectivity, inspection, DNS, or platform services are accepted architectural
-requirements. Bind peering, routing, subnet, and network-security intent explicitly; do not imply those choices from a
-resource name or a module default.
-
-The hub owns accepted shared services. Spokes peer to the hub and do not peer directly unless the architecture records
-a specific exception. Pass the hub resource ID through module outputs rather than reconstructing it. Apply network
-security at the subnet boundary, and verify address spaces and service CIDRs do not overlap before generation.
-
-## Private Endpoint And DNS
-
-Private endpoint intent includes the target subresource, approved subnet, private DNS zone, and DNS zone group. A
-private endpoint without its DNS and network dependencies is incomplete. Public access exceptions require an accepted
-risk and policy-compatible boundary.
-
-When shared private DNS is not provided by the platform, the owning binding must create the zone, link it to the
-accepted VNet, and pass the created zone resource ID to the endpoint. Do not construct an ID for a zone that no binding
-creates or accepts as existing evidence.
-
-Common service subresources and zones include:
-
-| Service | Subresource | Private DNS zone |
-| --- | --- | --- |
-| Blob storage | `blob` | `privatelink.blob.core.windows.net` |
-| Table storage | `table` | `privatelink.table.core.windows.net` |
-| Key Vault | `vault` | `privatelink.vaultcore.azure.net` |
-| Azure SQL | `sqlServer` | `privatelink.database.windows.net` |
-| Cosmos DB for NoSQL | `Sql` | `privatelink.documents.azure.com` |
-| App Service | `sites` | `privatelink.azurewebsites.net` |
-| Event Hubs | `namespace` | `privatelink.servicebus.windows.net` |
-| Container Registry | `registry` | `privatelink.azurecr.io` |
-
-Treat this table as a pattern aid, not live service-availability evidence. Confirm the exact target resource contract
-when accepting a binding.
-
-## Diagnostics And Dependencies
-
-Every governed resource should have diagnostics and metrics mapped to the accepted monitoring destination. Category
-selection, retention, cost, and ownership remain typed planning decisions; generated settings and deployment success
-require validator and operation receipts.
-
-Prefer supported category groups when they satisfy the accepted requirement; otherwise bind explicit categories from
-current provider evidence. Include metrics only when the resource supports them.
-
-An `existing` resource reference does not create an implicit dependency on a module that creates that resource in the
-same deployment. Extension resources such as diagnostics and private DNS zone groups need explicit ordering when their
-parent is created by another module.

package/assets/client-projections/github-copilot-cli/.github/skills/apex-codegen/SKILL.md

@@ -1,32 +0,0 @@
----
-name: apex-codegen
-description: "Provides hidden-worker guidance for one bounded APEX IaC generation task with approved intent and binding."
-user-invocable: false
----
-
-## APEX Code Generation
-
-Use this skill only inside the hidden CodeGen worker.
-
-## Prerequisites
-
-- `apex/taskContext` supplies approved intent, one selected-track binding, policy obligations, output paths, and limits.
-- The task identifies a single dependency-sized generation batch.
-
-## Workflow
-
-1. Call `apex/generateIac` once for the issued task ID, accepted intent, and selected-track binding.
-2. Preserve exact module, provider, API, security, naming, ownership, and environment-input obligations.
-3. Keep secret values out of generated content; use only typed references supplied by the kernel. Use `apex/stageFile`
-   only for additional assigned files before completion.
-4. Complete the issued task with the generated output. After completion, return the kernel receipt and perform no
-   follow-up staging, generation, validation, delegation, or repository work.
-5. Return `needs_input` when a required binding or value is absent.
-
-## Boundaries
-
-Do not execute, format, validate, preview, deploy, write directly to repository paths, or delegate work.
-
-## Output
-
-Return the typed completion or `needs_input` result with affected field IDs.

package/assets/client-projections/github-copilot-cli/.github/skills/apex-entra-app-registration/SKILL.md

@@ -1,53 +0,0 @@
----
-name: apex-entra-app-registration
-description: "Model Microsoft Entra application registration and OAuth design intent in APEX. Use for application type, flow, API permission, redirect URI, credential, and consent trade-offs."
-user-invocable: false
----
-
-# APEX Entra App Registration Guidance
-
-Use this skill only for an active architecture, planning, or approved implementation-binding task. The kernel owns
-task state, evidence freshness, authorization, artifact acceptance, and all state-changing work.
-
-## Prerequisites
-
-- `apex/taskContext` identifies the active task, allowed outputs, applicable requirements, and evidence references.
-- The workload purpose, client type, tenant boundary, target APIs, and user-interaction model are known; otherwise
-  return `needs_input`.
-- An identity operation is available only through a kernel-authorized capability. A request alone is not authority to
-  create or alter an application registration.
-
-## Workflow
-
-1. Model the application type, audience, tenant model, redirect-URI class, and OAuth interaction.
-   Record the selected flow and rationale without protocol requests or application configuration.
-2. Map each business operation to the minimum delegated or application permission requirement.
-   Record consent ownership, scope, and unresolved permission evidence; do not infer or approve consent.
-3. Select a credential posture: public clients hold no credential; Azure-hosted workloads prefer managed identity.
-   Confidential workloads prefer federation or certificates over secrets; record lifecycle ownership, never a value.
-4. Submit typed identity intent only through the kernel-authorized capability named in the task envelope.
-   Preserve its receipt or blocker in the architecture, plan, or binding artifact.
-5. Handoff approved identity intent to the authorized implementation, validation, or operations capability.
-   Do not claim that registration, permissions, credentials, or consent exist without an accepted receipt.
-6. Classify observed identity failures with [Identity design and diagnostic rules](references/design-and-diagnostics.md).
-   Return the responsible owner and evidence gap without attempting remediation.
-
-## Boundaries
-
-Do not use portal, CLI, Microsoft Graph, SDK, HTTP, IaC, repository, source-scanning, or file-mutation actions. Do
-not create registrations, configure redirect URIs, grant consent, assign permissions, create or handle credentials,
-expose identifiers or secret material, test authentication, or deploy. Direct operational requests must be converted
-into bounded intent and an authorized capability handoff.
-
-## References
-
-- [OAuth and registration model](references/oauth-registration-model.md) - client, audience, flow, and redirect-URI decisions.
-- [Permissions and credential posture](references/permissions-and-credentials.md) - least privilege and credential trade-offs.
-- [Capability receipt and handoff](references/capability-receipts.md) - required evidence, blockers, and next-task rules.
-- [Identity design and diagnostic rules](references/design-and-diagnostics.md) - source-derived flow, permission, and
-   troubleshooting rules without configuration or protocol operations.
-
-## Output
-
-Return typed identity design intent, requirement traces, authorized capability receipt references, explicit blockers,
-and the next kernel-controlled task.

package/assets/client-projections/github-copilot-cli/.github/skills/apex-entra-app-registration/references/capability-receipts.md

@@ -1,21 +0,0 @@
-# Capability Receipts And Handoff
-
-An identity decision becomes operational only after an authorized capability returns an accepted receipt. Intent is not
-evidence that an application registration, permission, consent, redirect URI, or credential exists.
-
-## Required Intent Fields
-
-- Requirement references and active task identifier.
-- Application, tenant, audience, flow, and redirect-URI design intent.
-- Permission and consent intent, including the unresolved items.
-- Credential posture, lifecycle owner, and validation obligation.
-
-## Receipt Rules
-
-Preserve the capability name, receipt identifier, status, evidence reference, and any explicit blocker. A missing,
-stale, rejected, or incomplete receipt blocks downstream claims and requires kernel-directed recovery.
-
-## Handoff
-
-Route accepted intent to the task-envelope capability for implementation, then to the authorized validation or operations
-capability. Return the next task and blocker state; do not perform or simulate the handoff.

package/assets/client-projections/github-copilot-cli/.github/skills/apex-entra-app-registration/references/design-and-diagnostics.md

@@ -1,36 +0,0 @@
-# Identity Design And Diagnostic Rules
-
-Use this reference to model identity intent and classify observed failures. It does not create registrations, issue
-tokens, call Microsoft Graph, grant consent, or handle credentials.
-
-## Flow And Registration Intent
-
-Record workload purpose, client class, interactive-user model, tenant boundary, API audience, redirect-URI class, and
-the owning application before implementation begins. Use authorization code for web applications, authorization code
-with PKCE for SPA or mobile public clients, device code only for supported browserless user interaction, and client
-credentials for service-to-service workloads. Treat the selection as design intent, not a configured flow.
-
-Redirect URIs must be an exact registered match and belong to the correct client platform. Unknown callback locations,
-tenant model, or audience block implementation intent rather than being filled with placeholders.
-
-## Permission And Credential Intent
-
-Map each accepted business operation to its minimum required permission and target resource. Model delegated access
-when the operation acts for a signed-in user and application access for a background workload without a user. Record
-the consent owner and evidence; application permissions and privileged delegated permissions require an explicit
-consent decision and must never be inferred as granted.
-
-Public clients have no client credential. Prefer managed identity for supported Azure-hosted workloads and federation
-or certificates for external confidential workloads. A secret-only design needs an explicit exception, lifecycle owner,
-and replacement plan. Record credential type and rotation requirement, never credential material or identifiers.
-
-## Diagnostic Classification
-
-Classify a redirect mismatch by comparing the exact requested URI, registered URI, and platform class. Classify consent
-or insufficient-privilege failures by checking the requested permission type, consent owner, target resource, and
-accepted configuration evidence. Classify invalid-client or expired-credential failures as a credential-lifecycle
-blocker. Classify application-not-found or tenant failures as an identity-boundary mismatch. Do not expose tokens or
-use diagnostic observations as authority to change an application registration.
-
-Return the evidence gap, responsible owner, and required kernel-authorized next task. Direct configuration, consent,
-credential, SDK, CLI, IaC, and HTTP remediation stays outside this skill.

package/assets/client-projections/github-copilot-cli/.github/skills/apex-entra-app-registration/references/oauth-registration-model.md

@@ -1,26 +0,0 @@
-# OAuth And Registration Model
-
-Model identity before requesting an implementation capability. The design artifact must identify the workload purpose,
-client class, users or services that authenticate, target API audience, tenant boundary, and redirect-URI class.
-
-## Flow Selection
-
-| Workload | Default intent | Constraints to record |
-| --- | --- | --- |
-| Web app | Authorization code | Redirect URI ownership and session boundary |
-| SPA or mobile app | Authorization code with PKCE | Public-client posture and redirect URI class |
-| Browserless user workflow | Device code only when interaction is supported | User consent and device interaction boundary |
-| Service-to-service | Client credentials | Application permission and workload identity posture |
-
-Do not describe token requests, generate protocol values, or claim that a flow is configured. The selected flow is a
-traceable design choice that an authorized capability may later implement and validate.
-
-## Redirect URI Intent
-
-Record the owning application, URI class, environment boundary, and exact-match requirement. Unknown redirect URIs
-block implementation intent; do not substitute placeholders or broaden accepted callback locations.
-
-## Tenant And Audience
-
-Record whether the application is single-tenant, multi-tenant, or otherwise restricted, and name the intended API
-audience. Treat both as user-owned decisions when requirements lack evidence.

package/assets/client-projections/github-copilot-cli/.github/skills/apex-entra-app-registration/references/permissions-and-credentials.md

@@ -1,27 +0,0 @@
-# Permissions And Credentials
-
-## Permission Intent
-
-Map each accepted operation to one minimum API permission requirement. Specify whether the operation acts for a signed-in
-user (delegated) or without a user (application), the target resource, consent owner, and evidence for necessity.
-
-| Condition | Decision |
-| --- | --- |
-| User-context operation | Model delegated permission intent |
-| Background workload operation | Model application permission intent |
-| Permission necessity is unknown | Return `needs_input` or a blocker |
-| Consent authority is absent | Preserve a consent blocker |
-
-Never infer elevated permissions, grant consent, or treat requested permissions as approved access.
-
-## Credential Posture
-
-| Client or hosting model | Preferred posture |
-| --- | --- |
-| Public client | No client credential |
-| Azure-hosted workload | Managed identity when the target supports it |
-| External confidential workload | Federated identity credential or certificate |
-| Secret-only integration | Explicit exception, lifecycle owner, and replacement plan |
-
-Do not create, retrieve, transmit, store, rotate, or reveal secret material. Record only credential type, owner,
-validity or rotation requirement, and the capability receipt needed to establish it.

package/assets/client-projections/github-copilot-cli/.github/skills/apex-mermaid/SKILL.md

@@ -1,44 +0,0 @@
----
-name: apex-mermaid
-description: "Requests safe inline Mermaid for supported APEX Markdown slots. Use for compact flowcharts, sequences, state machines, ER models, Gantt views, renderer validation, accessible theming, and syntax troubleshooting from accepted artifact data."
-user-invocable: false
----
-
-# APEX Inline Mermaid
-
-The current APEX document registry declares no Mermaid-capable slots. Do not request or emit an inline Mermaid fence
-until a renderer registers a typed source, a supported slot, syntax validation, and a returned document receipt.
-
-## Prerequisites
-
-- The target template exposes a Mermaid-capable inline slot.
-- Accepted artifact data contains every node, relationship, label, and time value to be shown.
-- The renderer declares supported Mermaid syntax and validation behavior.
-
-## Future Renderer Contract
-
-When a renderer-supported slot exists, select the simplest diagram type that preserves accepted relationships. Apply
-[syntax guidance](references/syntax.md) and [styling guidance](references/styling.md), then submit only the bounded
-fence to that renderer. The renderer, rather than this skill, must validate syntax and return the document receipt.
-
-Syntax and styling references are guidance targets, not active renderer slots. They do not make Mermaid output
-available until a typed source, renderer registration, and receipt exist.
-
-## Boundaries
-
-- Do not create standalone architecture, network, runtime, as-built, WAF, cost, or compliance diagrams.
-- Do not write or edit files, invoke deployment, or mutate source-of-truth artifacts, templates, schemas, or state.
-- Do not use unaccepted inputs, infer missing values, or treat rendered Markdown as gate evidence.
-- Do not embed Azure service icons, custom SVG, secrets, physical principal IDs, unsafe links, or Mermaid click actions.
-- Do not claim syntax or visual validation from model inspection; only the renderer receipt supplies that evidence.
-
-## Blockers
-
-When the requested document slot is unsupported, absent, or cannot be filled from accepted data, return a blocker that
-names the slot, diagram type, and missing renderer support or artifact data. Also block when renderer-version syntax,
-escaping, or accessibility cannot be validated. Do not emit a substitute diagram or alter any source.
-
-## Output
-
-Return only the renderer request or its rendered inline document result and receipt. Preserve any projected artifact and
-template hashes, validation status, and unresolved blockers.

package/assets/client-projections/github-copilot-cli/.github/skills/apex-mermaid/references/styling.md

@@ -1,33 +0,0 @@
-# Styling Guidance
-
-Use a renderer-compatible neutral theme and limited semantic classes. Meaning must remain clear without color.
-
-```mermaid
-%%{init: {'theme': 'neutral'}}%%
-graph LR
-    classDef gate stroke:#2563eb,stroke-width:2px;
-    INPUT["Accepted data"] --> GATE{"Supported slot"}:::gate
-    GATE --> OUTPUT["Rendered inline view"]
-```
-
-## Styling Rules
-
-- Prefer one layout direction, consistent node shapes, and a small semantic class set.
-- Use shape, border, and text labels together; never encode status or severity by color alone.
-- Keep contrast readable in light and dark Markdown renderers. Use renderer-projected colors when available.
-- Use subgraphs only for accepted ownership, trust, lifecycle, or resource boundaries.
-- Keep edge labels short and place detail in surrounding prose when the slot permits it.
-- Avoid service icons, custom SVG, background images, animations, click actions, and external CSS.
-- Do not use emoji as the only identifier; assistive text must carry the meaning.
-
-## Complexity Limits
-
-When labels overlap, crossings obscure meaning, or the renderer cannot fit the slot, reduce the diagram to its primary
-accepted relationship. Split independent concerns into supported slots or use a standalone diagram capability. Do not
-hide nodes or drop material edges merely to make the view attractive.
-
-## Renderer Validation
-
-The renderer decides whether the slot accepts Mermaid, the theme directive is supported, syntax parses, and the result
-fits the document. Inspect the renderer receipt for validation errors. Model inspection, Markdown source appearance, or
-a successful document request is not visual-validation evidence.

package/assets/client-projections/github-copilot-cli/.github/skills/apex-mermaid/references/syntax.md

@@ -1,99 +0,0 @@
-# Syntax Guidance
-
-Use one compact diagram in a fenced `mermaid` block for a renderer-supported inline slot.
-
-## Choose The Diagram Type
-
-| Accepted relationship | Diagram type |
-| --- | --- |
-| Branching process, dependency, or decision | `flowchart` or `graph` |
-| Ordered interaction among actors | `sequenceDiagram` |
-| Lifecycle states and transitions | `stateDiagram-v2` |
-| Entity relationships and cardinality | `erDiagram` |
-| Dated tasks and dependencies | `gantt` |
-
-Use a standalone diagram capability for architecture, network, runtime, as-built, WAF, cost, or compliance visuals.
-
-## Flowchart
-
-```mermaid
-graph TB
-    START["Accepted input"] --> CHECK{"Gate"}
-    CHECK -->|"Pass"| RENDER["Render slot"]
-    CHECK -->|"Block"| STOP["Return blocker"]
-```
-
-Use `TB` for vertical flows and `LR` for short horizontal flows. Group related nodes only when an accepted boundary
-exists. Use `-->` for primary flow, `-.->` for an accepted optional relationship, and `==>` sparingly for an accepted
-critical path. Label decisions and non-obvious edges.
-
-## Sequence
-
-```mermaid
-sequenceDiagram
-    participant CLIENT as Client
-    participant API as API
-    participant STORE as Data store
-    CLIENT->>API: Accepted request
-    API->>STORE: Read accepted record
-    STORE-->>API: Result
-    API-->>CLIENT: Response
-```
-
-Declare participants in first-use order. Use solid arrows for calls and dashed arrows for responses. Do not invent
-authentication, retries, timing, or failure paths absent from accepted data.
-
-## State
-
-```mermaid
-stateDiagram-v2
-    [*] --> Proposed
-    Proposed --> Accepted: Approve
-    Accepted --> Superseded: Replace
-    Superseded --> [*]
-```
-
-Use explicit transition labels and only accepted states. Avoid modeling an action as a state or implying a transition
-the kernel does not authorize.
-
-## Entity Relationship
-
-```mermaid
-erDiagram
-    WORKLOAD ||--o{ RESOURCE : contains
-    RESOURCE ||--o{ EVIDENCE : supported_by
-```
-
-Use accepted cardinality. Keep entity and relationship names concise; do not expose sensitive field values.
-
-## Gantt
-
-```mermaid
-gantt
-    title Accepted delivery window
-    dateFormat YYYY-MM-DD
-    section Delivery
-        Foundation :foundation, 2030-01-01, 2d
-        Validation :validation, after foundation, 1d
-```
-
-Use dates and durations only from accepted schedule data. A Gantt chart is a presentation, not authorization or proof
-that a task started or completed.
-
-## Safe Identifiers And Labels
-
-- Use short, unique ASCII IDs; keep human-readable text in quoted labels or participant aliases.
-- Keep labels factual and concise. Use renderer-supported line breaks only when validation confirms them.
-- Avoid reserved keywords as IDs, duplicate IDs, unescaped quote characters, raw URLs, and HTML labels.
-- Preserve accepted relationship direction; do not reverse arrows to improve layout.
-- Omit unavailable values rather than inserting placeholders or guessed nodes.
-
-## Troubleshooting
-
-| Renderer finding | Correction |
-| --- | --- |
-| Parse error near label | Replace the display label with a quoted label and a simple ASCII ID. |
-| Duplicate or merged nodes | Give every semantic node a unique ID while retaining its accepted display label. |
-| Unsupported directive or diagram | Use the renderer-supported syntax or return an unsupported-capability blocker. |
-| Unreadable dense graph | Split by accepted concern or use the standalone diagram capability. |
-| Relationship appears wrong | Check the accepted source mapping; never fix layout by changing semantics. |

package/assets/client-projections/github-copilot-cli/.github/skills/apex-microsoft-docs/SKILL.md

@@ -1,53 +0,0 @@
----
-name: apex-microsoft-docs
-description: "Researches official Microsoft documentation for APEX decisions. Use for Microsoft Learn concepts, limits, version support, WAF and architecture guidance, configuration, tutorials, and official code samples with cited evidence."
----
-
-# APEX Microsoft Documentation
-
-Use this skill only for an active APEX architecture or planning task that needs current official Microsoft guidance.
-The documentation capability is currently unavailable until it is activated and qualified for the selected client.
-
-## Prerequisites
-
-- `apex/taskContext` identifies the current task and the decision that needs evidence.
-- An activated, client-qualified, read-only documentation capability is available for the selected projection.
-
-Until that capability is active, return a missing-evidence blocker. Do not substitute model memory, a web scrape, a
-CLI fallback, or an unverified third-party source.
-
-## Workflow
-
-1. Frame a specific question with product, service, version, platform, task intent, and the decision it supports.
-2. Search through the qualified documentation capability before retrieving content.
-3. Rank official results by directness, version/platform fit, scope, and currency.
-4. Use the search excerpt when sufficient; otherwise fetch only the relevant page or section.
-5. Request an official code-sample search only when runnable example code is part of the question.
-6. Reconcile conflicting or incomplete sources and preserve unresolved applicability as a blocker.
-7. Record concise evidence with URL, title, heading, retrieval time, applicability, and uncertainty.
-8. Check that each material claim is supported and that documentation is not standing in for another evidence type.
-
-Read [the research method](references/research-method.md) before issuing a documentation request.
-
-## Boundaries
-
-- This skill is advisory. It does not configure MCP servers, execute commands, or modify files.
-- Azure pricing remains the read-only ARM MCP pricing evidence path, not a documentation lookup.
-- Documentation does not replace governance, quota, availability, approval, or deployment evidence.
-- Official examples are illustrative inputs to a later implementation decision, not proof that code compiles or deploys.
-- Do not fetch broad documentation trees, copy long page bodies, or use model memory to fill a missing source.
-
-## Blockers
-
-Return a missing-evidence blocker when the qualified capability is absent, no official source covers the target version
-or platform, sources materially conflict, the page is stale or inaccessible, or applicability cannot be established.
-Name the unresolved question and the evidence needed; do not fall back to CLI, web scraping, or third-party summaries.
-
-## References
-
-- [Research method](references/research-method.md) covers query framing, source selection, samples, conflicts, and evidence.
-
-## Output
-
-Return a bounded evidence result for the active APEX decision. Include supported claims, source URLs, applicability,
-retrieval metadata, uncertainty, conflicts, and missing-evidence blockers without changing task state.

package/assets/client-projections/github-copilot-cli/.github/skills/apex-microsoft-docs/references/research-method.md

@@ -1,91 +0,0 @@
-# Official Documentation Research Method
-
-## Frame The Question
-
-Include the Microsoft product or Azure service, feature, exact or supported version family, platform, operating system,
-IaC or SDK language when relevant, task intent, environment constraint, and decision to resolve.
-
-Good query shapes name an outcome and source type:
-
-- `Azure Storage private endpoint DNS zone group configuration`
-- `Azure VMSS flexible orchestration limitations Linux`
-- `.NET supported version policy App Service Linux`
-- `Azure Well-Architected reliability checklist stateful workload`
-
-Use `overview` for concepts, `quickstart` or `tutorial` for a guided task, `reference` for exact configuration, `limits`
-for service boundaries, and `version support` or `retirement` for lifecycle questions.
-
-## Select The Source Type
-
-| Question | Preferred official source |
-| --- | --- |
-| Exact property, API, SDK, limit, or supported value | Product reference for the target version |
-| Setup sequence or learning task | Current quickstart or tutorial for the target platform |
-| Architecture trade-off | Azure Architecture Center or Well-Architected guidance |
-| Lifecycle or compatibility | Product support, release, or retirement policy |
-| Runnable example | Official code-sample result plus its parent documentation |
-
-## Retrieve Evidence
-
-1. Search first; do not begin with a full-page fetch.
-2. Keep only results on official Microsoft domains supplied by the qualified capability.
-3. Rank exact product/version/platform matches above generic, archived, training, or community pages.
-4. Stop at the excerpt when it directly answers the question and supplies a citable URL.
-5. Fetch one page or named section when qualifiers, tables, prerequisites, or exceptions are missing from the excerpt.
-6. Run code-sample search only when the user or decision needs code; bind language, SDK, and version in the query.
-
-Do not load an entire documentation tree. A second page is justified only when the first page explicitly delegates a
-material prerequisite, limit, or exception to it.
-
-## Evaluate Applicability
-
-Check service and feature, cloud or region scope, version, platform, API surface, publication/update metadata, preview or
-GA status, prerequisites, exclusions, and whether the page describes control plane, data plane, SDK, portal, or IaC.
-
-Documentation can establish published behavior but cannot prove that a target subscription has quota, a SKU is currently
-available in a region, a policy permits it, a deployment succeeded, or a price is current. Request the owning evidence
-capability for those claims.
-
-## Handle Code Samples
-
-- Treat samples as illustrative and inspect their stated version, dependencies, authentication, and prerequisites.
-- Prefer managed identity or `DefaultAzureCredential` patterns when the official sample supports them.
-- Never copy credentials, connection strings, tenant values, or deprecated authentication patterns into an artifact.
-- Record gaps between sample defaults and accepted security, governance, networking, or lifecycle requirements.
-- Require later compile, test, and deployment validation; sample provenance is not execution evidence.
-
-## Resolve Conflicts
-
-Prefer the more specific current product reference over generic architecture prose for exact behavior. Prefer the target
-version's page over an unversioned sample. When two applicable official sources materially disagree, retain both URLs,
-describe the conflict, and return a blocker rather than choosing silently.
-
-## Record The Result
-
-For every material claim, retain:
-
-- concise paraphrased claim
-- page title, URL, and relevant heading
-- retrieval time and capability evidence identifier
-- applicable product, service, version, platform, and scope
-- decision and requirement IDs informed
-- caveats, conflicts, uncertainty, and follow-up evidence needed
-
-Quote only the short phrase needed for exact terminology. Do not retain full page content in project artifacts. Treat a
-changed, unavailable, archived, or ambiguous source as missing evidence.
-
-## Validation Loop
-
-1. Match every material claim to a captured source.
-2. Check version, platform, scope, and preview/GA qualifiers.
-3. Remove claims supported only by model memory or a search-title inference.
-4. Search or fetch one narrower official source when a gap is resolvable.
-5. Return the remaining gap as a blocker when the qualified capability cannot resolve it.
-
-## Do Not
-
-- Treat a search result as approval, policy, quota, availability, or pricing evidence.
-- Fetch broad documentation trees or retain raw documentation in project artifacts.
-- Use third-party summaries when an official Microsoft source is required.
-- Add an unqualified documentation server or fallback command to a managed client projection.
-- Claim an official sample is production-ready, secure for the workload, compiled, or deployed without separate evidence.

package/assets/client-projections/github-copilot-cli/.github/skills/apex-operations/SKILL.md

@@ -1,34 +0,0 @@
----
-name: apex-operations
-description: "Provides internal APEX operations guidance for status, preview, inventory, reconciliation, and diagnosis."
-user-invocable: false
----
-
-## APEX Operations
-
-Use this skill only in the interactive Operator agent.
-
-## Prerequisites
-
-- `apex/status` identifies the selected run.
-- A task context is required only when the kernel issues a task-backed operation.
-
-## Workflow
-
-1. Use `apex/status` for taskless status. Use `apex/preview` only to read the current preview and explain its recorded
-   semantic changes, target, expiry, destructive actions, ignored or unevaluated items, and uncertainty.
-2. Use `apex/inventory` only to read the inventory already recorded for the selected run. Use `apex/reconcile` only for
-   an indeterminate operation; do not repeat a side effect independently.
-3. Use `apex/diagnose` only when the kernel issues a task-backed diagnosis, then read its exact `apex/taskContext`.
-4. Direct the user to `apex gate decide` and `apex deploy`; those trusted CLI ceremonies are not MCP tools.
-5. Report provider and kernel results without claiming transactional rollback, live Azure diagnostics, or a diagnosis
-   beyond the returned bounded status and doctor checks.
-
-## Output
-
-Return the operation ID, state, evidence references, blockers, and kernel-provided next action.
-
-## Boundaries
-
-Required validation, authorization, freshness, and writer-epoch checks are kernel-controlled. Do not invent operations,
-retry effects, or claim a provider inspection that the current APEX MCP result does not contain.

package/assets/client-projections/github-copilot-cli/.github/skills/apex-planning/SKILL.md

@@ -1,36 +0,0 @@
----
-name: apex-planning
-description: "Provides internal APEX planning guidance for implementation intent, controls, dependencies, and bindings."
-user-invocable: false
----
-
-## APEX Planning
-
-Use this skill only for an active planning task.
-
-## Prerequisites
-
-- The kernel projects accepted architecture and current governance inputs.
-- The selected IaC track and target environment are present in the task envelope.
-
-## Workflow
-
-1. Use accepted task-context artifacts and preserve their source hashes in implementation intent. Keep intent free of
-   Bicep or Terraform syntax.
-2. Define logical resources, controls, dependencies, identity, networking, diagnostics, outputs, and environment
-   obligations. Keep dependencies acyclic.
-3. Put modules, providers, API versions, variables, parameters, phases, backend, and stack ownership in the selected
-   binding rather than neutral intent. Bind only the selected task track.
-4. Trace every binding obligation to intent and projected policy requirements. Represent environment secrets only as
-   typed references; do not include secret values.
-5. Stage each typed output through `apex/stageArtifact`, then call `apex/completeTask` once with every required
-   output in `outputs`. Do not submit a single-output completion for a multi-output task.
-
-## Output
-
-Return the kernel result and any architecture-rooted or user-owned blocker.
-
-## Boundaries
-
-The kernel validates source hashes, track consistency, binding coverage, dependency shape, and secret safety. Do not
-claim a binding, hash format, provider capability, or gate result that is not returned by the current task contract.