@apexops/cli 0.10.0-next.5 → 0.11.0-next.1

package/assets/config/recipe-packs.v1.json

@@ -1,29 +1,4 @@
 {
   "schemaVersion": "1.0.0",
-  "recipePacks": [
-    {
-      "id": "azure-functions-recipes",
-      "version": "1.0.0",
-      "source": {
-        "root": ".github/skills/azure-prepare/references/services/functions",
-        "digestAlgorithm": "sha256(path-nul-file-sha256-newline)",
-        "treeSha256": "e05b0efab3d3d9e7ad85601fd89f7d17140d7b6361b136cc9a36e1b67dca42a9"
-      },
-      "inventory": {
-        "includes": ["service guidance", "base specifications", "recipe templates", "evaluation fixtures"],
-        "recipeRoots": [
-          "templates/base",
-          "templates/recipes/blob-eventgrid",
-          "templates/recipes/cosmosdb",
-          "templates/recipes/durable"
-        ]
-      },
-      "availability": {
-        "status": "deferred",
-        "reason": "No authorized recipe materializer capability is available in this release line.",
-        "requiredCapability": "recipe-materializer",
-        "behavior": "Return unavailable; do not read, compose, stage, or publish a recipe."
-      }
-    }
-  ]
+  "recipePacks": []
 }

package/assets/config/runtime-bundle.v1.json

@@ -1,31 +1,31 @@
 {
   "schemaVersion": "1.0.0",
-  "bundleVersion": "0.10.0-next.5",
+  "bundleVersion": "0.11.0-next.1",
   "capabilityProtocolVersion": "1.0.0",
   "components": {
     "cli": {
       "source": "local",
-      "version": "0.10.0-next.5"
+      "version": "0.11.0-next.1"
     },
     "contracts": {
       "source": "local",
-      "version": "0.10.0-next.5"
+      "version": "0.11.0-next.1"
     },
     "kernel": {
       "source": "local",
-      "version": "0.10.0-next.5"
+      "version": "0.11.0-next.1"
     },
     "capabilities": {
       "source": "local",
-      "version": "0.10.0-next.5"
+      "version": "0.11.0-next.1"
     },
     "renderers": {
       "source": "local",
-      "version": "0.10.0-next.5"
+      "version": "0.11.0-next.1"
     },
     "customizationBundle": {
       "source": "local",
-      "version": "0.10.0-next.5",
+      "version": "0.11.0-next.1",
       "manifest": "@apexops/cli/assets/customizations/manifest.json",
       "assetManifest": "@apexops/cli/assets/manifest.json",
       "compositionId": "apex-managed-workspace"

package/assets/config/toolchain.v1.json

@@ -1,9 +1,9 @@
 {
   "schemaVersion": "1.0.0",
-  "observationCutoff": "2026-07-13",
+  "observationCutoff": "2026-09-20",
   "supportPolicy": {
     "selection": "newest-production-supported-mutually-compatible-set-at-cutoff",
-    "node": "newest-supported-lts-patch",
+    "node": "newest-lts-patch",
     "npm": "newest-stable-compatible-with-selected-node",
     "typescript": "newest-stable-ga-compatible-with-selected-node-and-npm",
     "vscode": "newest-stable-release-qualified-by-manual-host-tests",
@@ -13,20 +13,20 @@
   },
   "core": {
     "node": {
-      "authoritativeSource": "https://nodejs.org/en/about/previous-releases",
+      "authoritativeSource": "https://nodejs.org/dist/index.json",
       "releaseChannel": "lts",
-      "newestObservedVersion": "24.18.0",
-      "selectedExactVersion": "24.18.0",
-      "installedVersion": "24.18.0",
-      "observedAt": "2026-07-13"
+      "newestObservedVersion": "24.21.0",
+      "selectedExactVersion": "24.21.0",
+      "installedVersion": "24.21.0",
+      "observedAt": "2026-10-05"
     },
     "npm": {
       "authoritativeSource": "https://www.npmjs.com/package/npm",
       "releaseChannel": "stable",
-      "newestObservedVersion": "11.16.0",
-      "selectedExactVersion": "11.16.0",
-      "installedVersion": "11.16.0",
-      "observedAt": "2026-07-13"
+      "newestObservedVersion": "12.0.2",
+      "selectedExactVersion": "12.0.2",
+      "installedVersion": "12.0.2",
+      "observedAt": "2026-09-20"
     },
     "typescript": {
       "authoritativeSource": "https://www.npmjs.com/package/typescript",
@@ -34,28 +34,28 @@
       "newestObservedVersion": "7.0.2",
       "selectedExactVersion": "7.0.2",
       "installedVersion": "7.0.2",
-      "observedAt": "2026-07-13"
+      "observedAt": "2026-09-20"
     },
     "vscode": {
       "authoritativeSource": "https://code.visualstudio.com/updates",
       "releaseChannel": "stable",
-      "newestObservedVersion": "1.130.0",
-      "minimumSupportedVersion": "1.130.0",
-      "installedVersion": "1.130.0",
-      "installedCopilotChatVersion": "0.58.0",
+      "newestObservedVersion": "1.141.0",
+      "minimumSupportedVersion": "1.140.0",
+      "installedVersion": "1.141.0",
+      "installedCopilotChatVersion": "0.69.0",
       "historicalFixtureVersion": "1.130.0",
       "historicalFixtureCopilotChatVersion": "0.58.0",
-      "observedAt": "2026-07-28",
+      "observedAt": "2026-10-08",
       "selectionStatus": "selected-qualification-required",
       "selectionEvidence": {
         "receipt": "tools/registry/client-context-baseline-receipt.json",
         "sha256": "197cbc48abfebc3d01c8511557d7b852ed35b5169e8cb2fdcb747d1dc013f42a"
       },
       "postCutoffObservation": {
-        "version": "1.130.0",
-        "copilotChatVersion": "0.58.0",
-        "observedAt": "2026-07-27",
-        "disposition": "selected-next-candidate-input"
+        "version": "1.141.0",
+        "copilotChatVersion": "0.69.0",
+        "observedAt": "2026-10-08",
+        "disposition": "selected-current-candidate"
       },
       "requiredQualification": [
         "workspace-agent-discovery",
@@ -68,22 +68,24 @@
     },
     "copilotCli": {
       "authoritativeSource": "https://docs.github.com/en/copilot/how-tos/set-up/install-copilot-cli",
-      "authoritativeReleaseSource": "https://github.com/github/copilot-cli/releases/tag/v1.0.73",
+      "authoritativeReleaseSource": "https://github.com/github/copilot-cli/releases/tag/v1.0.86",
       "package": "@github/copilot",
       "releaseChannel": "stable",
-      "newestObservedVersion": "1.0.73",
-      "selectedExactVersion": "1.0.73",
-      "installedVersion": null,
-      "observedAt": "2026-07-21",
+      "newestObservedVersion": "1.0.86",
+      "selectedExactVersion": "1.0.86",
+      "installedVersion": "1.0.86",
+      "historicalFixtureVersion": "1.0.73",
+      "historicalFixtureArtifactHash": "8f9bb5f7e364c267265d1e24ac2aea69ed559ddb956719c6db12a353de6c5970",
+      "observedAt": "2026-09-20",
       "selectionStatus": "selected-qualification-required",
       "releaseArtifact": {
         "name": "copilot-linux-x64.tar.gz",
-        "sha256": "8f9bb5f7e364c267265d1e24ac2aea69ed559ddb956719c6db12a353de6c5970",
+        "sha256": "ea4a519d7b2ff54e9c7d10ae9921cf4ab3f5041489ec340852f47f4f63fc535b",
         "verification": "digest-and-version-command-pass"
       },
       "channelObservation": {
-        "githubRelease": "1.0.73",
-        "npmLatest": "1.0.71-1",
+        "githubRelease": "1.0.86",
+        "npmLatest": "1.0.86",
         "selectedSource": "github-release"
       },
       "requiredQualification": [
@@ -99,11 +101,11 @@
     }
   },
   "compatibilitySet": {
-    "node": "24.18.0",
-    "npm": "11.16.0",
+    "node": "24.21.0",
+    "npm": "12.0.2",
     "typescript": "7.0.2",
-    "minimumVscode": "1.130.0",
-    "copilotCli": "1.0.73"
+    "minimumVscode": "1.140.0",
+    "copilotCli": "1.0.86"
   },
   "clientQualificationPolicy": {
     "mode": "rolling-observed",

package/assets/config/workflow.v1.json

@@ -30,7 +30,6 @@
         "gate-1",
         "architecture",
         "governance-discovery",
-        "governance-reconciliation",
         "plan",
         "codegen-bicep",
         "codegen-terraform",
@@ -58,6 +57,36 @@
       "validators": ["gate:requirements-ready"],
       "invalidates": []
     },
+    {
+      "id": "governance-discovery",
+      "kind": "capability",
+      "ownerRole": "governance-operator",
+      "sourceDependencies": ["gate-1", "run-config.targetScope", "governance-capability-lock"],
+      "outputs": ["governance-constraints-v1"],
+      "validators": [
+        "schema:governance-constraints-v1",
+        "business:governance-completeness",
+        "business:governance-freshness"
+      ],
+      "invalidates": [
+        "architecture",
+        "gate-2",
+        "plan",
+        "gate-3",
+        "validation-bicep",
+        "validation-terraform",
+        "preview-bicep",
+        "preview-terraform",
+        "gate-4",
+        "deploy-bicep",
+        "deploy-terraform",
+        "inventory",
+        "diagnosis",
+        "quality",
+        "governance-refresh",
+        "policy-refresh"
+      ]
+    },
     {
       "id": "architecture",
       "kind": "creative",
@@ -65,24 +94,27 @@
       "sourceDependencies": [
         "gate-1",
         "requirements-v1",
+        "governance-constraints-v1",
         "defaults",
         "pricing-evidence",
         "quota-evidence",
         "regional-availability-evidence"
       ],
-      "outputs": ["architecture-v1", "cost-estimate-v1", "workload-decision-manifest-v1"],
+      "outputs": ["architecture-v1", "cost-estimate-v1", "workload-decision-manifest-v1", "policy-property-map-v1"],
       "validators": [
         "schema:architecture-v1",
         "schema:workload-decision-manifest-v1",
+        "schema:policy-property-map-v1",
         "business:requirements-traceability",
+        "business:well-architected-assessment-complete",
         "business:workload-decision-manifest-coverage",
         "business:cost-arithmetic",
-        "business:availability-current",
-        "review:architecture-comprehensive"
+        "business:policy-effect-coverage",
+        "review:architecture-comprehensive",
+        "review:well-architected-criteria-complete"
       ],
       "invalidates": [
         "gate-2",
-        "governance-reconciliation",
         "plan",
         "gate-3",
         "codegen-bicep",
@@ -96,14 +128,33 @@
         "deploy-terraform",
         "inventory",
         "diagnosis",
-        "quality"
+        "quality",
+        "policy-refresh"
       ]
     },
     {
-      "id": "governance-discovery",
+      "id": "gate-2",
+      "kind": "gate",
+      "gateNumber": 2,
+      "name": "Architecture and Cost",
+      "ownerRole": "approver",
+      "sourceDependencies": [
+        "architecture-v1",
+        "cost-estimate-v1",
+        "workload-decision-manifest-v1",
+        "governance-constraints-v1",
+        "policy-property-map-v1",
+        "architecture-review",
+        "accepted-risk-scopes"
+      ],
+      "validators": ["gate:architecture-cost-governance-ready"],
+      "invalidates": []
+    },
+    {
+      "id": "governance-refresh",
       "kind": "capability",
       "ownerRole": "governance-operator",
-      "sourceDependencies": ["gate-1", "run-config.targetScope", "governance-capability-lock"],
+      "sourceDependencies": ["gate-2", "run-config.targetScope", "governance-capability-lock"],
       "outputs": ["governance-constraints-v1"],
       "validators": [
         "schema:governance-constraints-v1",
@@ -111,8 +162,7 @@
         "business:governance-freshness"
       ],
       "invalidates": [
-        "governance-reconciliation",
-        "gate-2",
+        "policy-refresh",
         "plan",
         "gate-3",
         "validation-bicep",
@@ -125,21 +175,24 @@
         "inventory",
         "diagnosis",
         "quality"
-      ]
+      ],
+      "condition": {
+        "equals": [
+          {
+            "path": "run.governanceRefreshRequired"
+          },
+          true
+        ]
+      }
     },
     {
-      "id": "governance-reconciliation",
-      "kind": "deterministic",
-      "ownerRole": "governance-operator",
-      "sourceDependencies": ["architecture-v1", "governance-constraints-v1", "defaults"],
+      "id": "policy-refresh",
+      "kind": "creative",
+      "ownerRole": "architect",
+      "sourceDependencies": ["gate-2", "architecture-v1", "governance-constraints-v1"],
       "outputs": ["policy-property-map-v1"],
-      "validators": [
-        "schema:policy-property-map-v1",
-        "business:policy-effect-coverage",
-        "review:governance-reconciliation"
-      ],
+      "validators": ["schema:policy-property-map-v1", "business:policy-effect-coverage"],
       "invalidates": [
-        "gate-2",
         "plan",
         "gate-3",
         "validation-bicep",
@@ -152,26 +205,15 @@
         "inventory",
         "diagnosis",
         "quality"
-      ]
-    },
-    {
-      "id": "gate-2",
-      "kind": "gate",
-      "gateNumber": 2,
-      "name": "Architecture and Cost",
-      "ownerRole": "approver",
-      "sourceDependencies": [
-        "architecture-v1",
-        "cost-estimate-v1",
-        "workload-decision-manifest-v1",
-        "governance-constraints-v1",
-        "policy-property-map-v1",
-        "architecture-review",
-        "governance-reconciliation-review",
-        "accepted-risk-scopes"
       ],
-      "validators": ["gate:architecture-cost-governance-ready"],
-      "invalidates": []
+      "condition": {
+        "equals": [
+          {
+            "path": "run.policyRefreshRequired"
+          },
+          true
+        ]
+      }
     },
     {
       "id": "plan",
@@ -310,6 +352,7 @@
         "iac-handoff-v1",
         "logical-resource-manifest-v1",
         "governance-constraints-v1",
+        "policy-property-map-v1",
         "defaults",
         "toolchain"
       ],
@@ -341,6 +384,7 @@
         "iac-handoff-v1",
         "logical-resource-manifest-v1",
         "governance-constraints-v1",
+        "policy-property-map-v1",
         "defaults",
         "toolchain"
       ],
@@ -562,41 +606,19 @@
       "to": "gate-1",
       "event": "completed"
     },
-    {
-      "from": "gate-1",
-      "to": "architecture",
-      "event": "approved",
-      "fanout": true
-    },
     {
       "from": "gate-1",
       "to": "governance-discovery",
-      "event": "approved",
-      "fanout": true
+      "event": "approved"
     },
     {
       "from": "architecture",
-      "to": "governance-reconciliation",
-      "event": "completed",
-      "condition": {
-        "exists": {
-          "path": "artifacts.governance-constraints-v1"
-        }
-      }
+      "to": "gate-2",
+      "event": "completed"
     },
     {
       "from": "governance-discovery",
-      "to": "governance-reconciliation",
-      "event": "completed",
-      "condition": {
-        "exists": {
-          "path": "artifacts.architecture-v1"
-        }
-      }
-    },
-    {
-      "from": "governance-reconciliation",
-      "to": "gate-2",
+      "to": "architecture",
       "event": "completed"
     },
     {
@@ -715,6 +737,21 @@
       "from": "quality",
       "to": "completed",
       "event": "completed"
+    },
+    {
+      "from": "gate-2",
+      "to": "governance-refresh",
+      "event": "approved"
+    },
+    {
+      "from": "governance-refresh",
+      "to": "policy-refresh",
+      "event": "completed"
+    },
+    {
+      "from": "policy-refresh",
+      "to": "plan",
+      "event": "completed"
     }
   ],
   "returnRoutes": [
@@ -724,12 +761,6 @@
       "reasonCode": "requirements-refinement",
       "reopensFromGate": 1
     },
-    {
-      "from": "governance-reconciliation",
-      "to": "architecture",
-      "reasonCode": "governance-architecture-conflict",
-      "reopensFromGate": 2
-    },
     {
       "from": "plan",
       "to": "architecture",

package/assets/customizations/.github/agents/apex-codegen.agent.md

@@ -1,30 +1,16 @@
 ---
 name: APEX CodeGen
 description: Hidden worker that generates one bounded IaC batch in APEX staging.
-argument-hint: Generate the assigned IaC batch
-model: ["GPT-5.6 Terra"]
 user-invocable: false
 tools:
-  - agent
   - apex/taskContext
   - apex/stageFile
   - apex/generateIac
-  - apex/completeTask
-  - azure-resource-manager-mcp/get_retail_prices
-  - azure-resource-manager-mcp/query_costs
-  - azure-resource-manager-mcp/query_aks_costs
-  - azure-resource-manager-mcp/forecast_costs
-  - azure-resource-manager-mcp/list_dimensions
-  - azure-resource-manager-mcp/list_budgets
-  - azure-resource-manager-mcp/get_budget
-  - azure-resource-manager-mcp/list_alerts
-  - azure-resource-manager-mcp/list_benefit_utilization
-  - azure-resource-manager-mcp/get_benefit_recommendations
-  - azure-resource-manager-mcp/list_reservation_transactions
-agents:
-  - APEX Validator
 ---
 
+When calling any `apex/*` MCP tool, include the current session checkout or worktree as the required absolute
+`workspace` path.
+
 # Goal
 
 Generate only the assigned IaC batch and return a traceable handoff that validation and human review can inspect.
@@ -36,16 +22,16 @@ Generate only the assigned IaC batch and return a traceable handoff that validat
   Read `.github/skills/apex-azure-defaults/SKILL.md` only for projected security, naming, tag, or AVM/module rules.
   Read `.github/skills/apex-bicep-patterns/SKILL.md` only for an assigned Bicep binding.
   Read `.github/skills/apex-terraform-patterns/SKILL.md` only for an assigned Terraform binding.
-3. Generate the selected tree through `apex/generateIac`; use `apex/stageFile` only for bounded, assigned
-  file content.
+3. Generate the selected tree through `apex/generateIac`. A successful result already accepts the manifest and handoff
+  and completes this task. Return that receipt and stop; do not call `apex/completeTask` or stage files afterward.
+  Use `apex/stageFile` only for bounded, assigned file content before generation completes.
 4. Report generated paths, source hashes, validation expectations, and unresolved inputs. Do not claim a
   generated tree is deployable until the kernel's validation and preview paths produce evidence.
-5. Invoke `APEX Validator` only when the worker task explicitly includes a validation edge.
 
 # Constraints
 
-Do not ask the user, infer missing values, or write directly to the repository. ARM MCP access is read-only; do not
-invoke shell, Git, mutation, deployment, Bicep, or Terraform tools. The kernel owns source hashes, paths, validation,
+Do not ask the user, infer missing values, or write directly to the repository. Use accepted bindings; do not query ARM
+or invoke shell, Git, mutation, deployment, Bicep, or Terraform tools. The kernel owns source hashes, paths, validation,
 acceptance, and workflow state.
 
 # Output

package/assets/customizations/.github/agents/apex-validator.agent.md

@@ -1,27 +1,16 @@
 ---
 name: APEX Validator
 description: Hidden worker that requests deterministic kernel validation and returns a typed verdict.
-argument-hint: Validate the assigned staged result
-model: ["GPT-5.6 Terra"]
 user-invocable: false
 tools:
   - apex/taskContext
   - apex/validateTask
   - apex/completeTask
-  - azure-resource-manager-mcp/get_retail_prices
-  - azure-resource-manager-mcp/query_costs
-  - azure-resource-manager-mcp/query_aks_costs
-  - azure-resource-manager-mcp/forecast_costs
-  - azure-resource-manager-mcp/list_dimensions
-  - azure-resource-manager-mcp/list_budgets
-  - azure-resource-manager-mcp/get_budget
-  - azure-resource-manager-mcp/list_alerts
-  - azure-resource-manager-mcp/list_benefit_utilization
-  - azure-resource-manager-mcp/get_benefit_recommendations
-  - azure-resource-manager-mcp/list_reservation_transactions
-agents: []
 ---
 
+When calling any `apex/*` MCP tool, include the current session checkout or worktree as the required absolute
+`workspace` path.
+
 # Goal
 
 Run the deterministic validation set named in the active worker task and return a traceable, human-readable evidence
@@ -30,11 +19,16 @@ verdict without repairing artifacts or deciding gates.
 # Success criteria
 
 1. Call `apex/taskContext` once.
-2. Call `apex/validateTask` with the supplied task and validator IDs.
+2. For the issued IaC validation task, call `apex/validateTask` with only `taskId`. The runtime executes available native
+  checks and returns `execution` plus a typed `outputs` bundle containing only their real evidence references.
+  Do not send an unsupported validator IDs field or invent hashes, byte counts or validator results.
 3. Report the exact validator IDs, required evidence references, result state, blocked checks, and rerun boundary. Do not
   reinterpret a failed, unavailable, or blocked deterministic result as passing.
-4. Return the unchanged validator result through `apex/completeTask` when completion is requested. APEX materializes
-  accepted validation evidence at `agent-output/<project>/<run>/validation/validation-report.md` for review.
+4. When `valid` is false or `execution.blockedValidatorIds` is nonempty, report those exact unexecuted validators and
+  stop without `apex/completeTask`. Missing execution evidence is a blocker, not permission to fill in receipt entries.
+  Only when `valid` is true and no validators are blocked, submit the returned `outputs` unchanged through
+  `apex/completeTask`. Acceptance rechecks current source and native evidence; report completion only after its receipt.
+  An acknowledgement from staging supplied artifacts, without `execution`, is not executed validation evidence.
 
 Read `.github/skills/apex-azure-validate/SKILL.md` only for accepted preflight evidence interpretation.
 Read `.github/skills/apex-azure-governance/SKILL.md` only for accepted governance evidence interpretation.
@@ -43,9 +37,9 @@ Read `.github/skills/apex-terraform-test/SKILL.md` only for accepted Terraform t
 
 # Constraints
 
-Do not ask the user, repair artifacts, accept risk, or reinterpret findings. ARM MCP access is read-only and only for
-a validation set that requests current Azure evidence. The kernel owns validator selection, caches, acceptance, and
-state. The owning CodeGen, Planner, Reviewer, or Operator role handles remediation and targeted follow-up.
+Do not ask the user, repair artifacts, accept risk, or reinterpret findings. Request validation through the kernel;
+do not query ARM or replace missing validator evidence with an independent lookup. The kernel owns validator selection,
+caches, acceptance, and state. The owning CodeGen, Planner or Operator role handles remediation and follow-up.
 
 # Output