@apexops/contracts 0.10.0-next.4 → 0.11.0-next.0

package/dist/test/contracts.test.js

@@ -4,7 +4,7 @@ import { describe, it } from "node:test";
 import { fileURLToPath } from "node:url";
 import { FormatRegistry } from "@sinclair/typebox";
 import { Value } from "@sinclair/typebox/value";
-import { ApprovalEvidenceV1Schema, ArchitectureV1Schema, CapabilityPackManifestV1Schema, CONTRACT_VERSION, CostEstimateV1Schema, CustomizationLockV1Schema, DeploymentPreviewV1Schema, DiagnosisV1Schema, EnvironmentInputsV1Schema, ExecutionPlanAttestationV1Schema, GovernanceConstraintsV1Schema, hasValidInputRequestQuestions, IacHandoffV1Schema, ImprovementDecisionV1Schema, ImprovementObservationV1Schema, ImprovementPolicyV1Schema, ImprovementProposalV1Schema, ImprovementRecurrenceV1Schema, InputRequestV1Schema, InputSubmissionV1Schema, LogicalResourceManifestV1Schema, LiveQualificationV1Schema, LIVE_QUALIFICATION_SCENARIO_IDS, OnboardingConfigV1Schema, PolicyPropertyMapV1Schema, PricingEvidenceV1Schema, PricingRequestV1Schema, QualityReportV1Schema, QualityMeasurementsV1Schema, ArchitectureAvailabilityV1Schema, RequirementsV1Schema, ReviewFindingsV1Schema, RuntimeBundleLockV1Schema, ScenarioV1Schema, TelemetryV1Schema, WorkloadDecisionManifestV1Schema, contractMetadata, contractSchemas, hasCompleteContractMetadata, hasOnlyTypedSecretReferences, hasValidLiveQualification, hasValidCostArithmetic, hasValidLogicalResourceReferences, hasValidPreviewApprovalBinding, calculatePricingEvidenceId, calculatePricingRequestId, hasValidPricingEvidence, schemaById, } from "../index.js";
+import { ApprovalEvidenceV1Schema, ArchitectureV1Schema, CapabilityPackManifestV1Schema, CONTRACT_VERSION, CostEstimateV1Schema, CustomizationLockV1Schema, DeploymentPreviewV1Schema, DiagnosisV1Schema, EnvironmentInputsV1Schema, ExecutionPlanAttestationV1Schema, GovernanceConstraintsV1Schema, GovernanceObservationReceiptV1Schema, hasValidInputRequestQuestions, isGovernanceObservationCurrent, IacBindingV1Schema, IacHandoffV1Schema, ImprovementDecisionV1Schema, ImprovementObservationV1Schema, ImprovementPolicyV1Schema, ImprovementProposalV1Schema, ImprovementRecurrenceV1Schema, InputRequestV1Schema, InputSubmissionV1Schema, LogicalResourceManifestV1Schema, NativeValidationReceiptV1Schema, NATIVE_VALIDATION_COMMANDS, calculateNativeValidationCommandHash, calculateNativeValidationReceiptHash, calculatePolicyValidationDigest, hasValidArchetypeSourceProposal, hasValidNativeValidationReceipt, LiveQualificationV1Schema, LIVE_QUALIFICATION_SCENARIO_IDS, OnboardingConfigV1Schema, BootstrapPlanV1Schema, GovernanceSetupConfigV1Schema, GovernanceSetupPlanV1Schema, ArchetypeBatchConfigV1Schema, PolicyPropertyMapV1Schema, PricingEvidenceV1Schema, PricingRequestV1Schema, QualityReportV1Schema, QualityMeasurementsV1Schema, ArchitectureAvailabilityV1Schema, RequirementsV1Schema, RequirementsAmendmentV1Schema, RequirementsChangeProposalV1Schema, RepeatGuardRecordsV1Schema, ReviewCaptureV1Schema, ReviewRequestV1Schema, ReviewFindingsV1Schema, RuntimeBundleLockV1Schema, ScenarioV1Schema, TelemetryV1Schema, WorkloadDecisionManifestV1Schema, contractMetadata, contractSchemas, hasCompleteContractMetadata, hasOnlyTypedSecretReferences, hasValidLiveQualification, hasValidCostArithmetic, hasValidLogicalResourceReferences, hasValidPreviewApprovalBinding, calculatePricingEvidenceId, calculatePricingRequestId, hasValidPricingEvidence, schemaById, } from "../index.js";
 import { CONTRACT_METADATA_FILENAME, JSON_SCHEMA_DIALECT, createContractMetadataFile, createContractSchemaFiles, } from "../schema-export.js";
 const hash = "a".repeat(64);
 const otherHash = "b".repeat(64);
@@ -14,6 +14,452 @@ const completion = "2026-07-13T14:00:00.000Z";
 FormatRegistry.Set("date-time", (value) => Number.isFinite(Date.parse(value)));
 FormatRegistry.Set("date", (value) => /^\d{4}-\d{2}-\d{2}$/.test(value) && Number.isFinite(Date.parse(`${value}T00:00:00Z`)));
 describe("Wave 1 contracts", () => {
+    it("requires compact, strictly typed governance observation bindings without raw baseline data", () => {
+        const receipt = {
+            schemaVersion: CONTRACT_VERSION,
+            projectId: "demo",
+            runId: "run-1",
+            targetScope: "/subscriptions/11111111-1111-1111-1111-111111111111",
+            governanceHash: hash,
+            snapshotDigest: otherHash,
+            contentHash: hash,
+            observedAt: timestamp,
+            expiresAt: expiry,
+            rawSourceDigest: otherHash,
+        };
+        assert.equal(Value.Check(GovernanceObservationReceiptV1Schema, receipt), true);
+        for (const field of Object.keys(receipt)) {
+            const incomplete = { ...receipt };
+            delete incomplete[field];
+            assert.equal(Value.Check(GovernanceObservationReceiptV1Schema, incomplete), false, field);
+        }
+        for (const invalid of [
+            { ...receipt, baseline: {} },
+            { ...receipt, rawSourceDigest: "invalid" },
+            { ...receipt, observedAt: "invalid" },
+            { ...receipt, targetScope: "" },
+        ])
+            assert.equal(Value.Check(GovernanceObservationReceiptV1Schema, invalid), false);
+        assert.equal(schemaById[GovernanceObservationReceiptV1Schema.$id], GovernanceObservationReceiptV1Schema);
+        assert.equal(contractMetadata[GovernanceObservationReceiptV1Schema.$id]?.maxBytes, 16_384);
+    });
+    it("uses precise elapsed UTC age and rejects malformed governance observation dates", () => {
+        const observed = "2026-09-01T00:00:00Z";
+        assert.equal(isGovernanceObservationCurrent(observed, "2026-09-30T23:59:59.999Z"), true);
+        assert.equal(isGovernanceObservationCurrent(observed, "2026-10-01T00:00:00Z"), false);
+        assert.equal(isGovernanceObservationCurrent("2026-09-01T02:00:00+02:00", "2026-10-01T00:00:00Z"), false);
+        assert.equal(isGovernanceObservationCurrent(observed, "2026-08-31T23:59:59Z"), false);
+        for (const invalid of ["2026-09-01", "2026-09-01T00:00:00", "2026-02-30T00:00:00Z", "invalid"]) {
+            assert.equal(isGovernanceObservationCurrent(invalid, "2026-09-02T00:00:00Z"), false, invalid);
+            assert.equal(isGovernanceObservationCurrent(observed, invalid), false, invalid);
+        }
+    });
+    it("requires Bicep format, build and lint rather than accepting build-only receipts", () => {
+        assert.deepEqual(NATIVE_VALIDATION_COMMANDS.bicep.map(({ validatorId }) => validatorId), ["bicep:format", "bicep:build", "bicep:lint"]);
+    });
+    for (const track of ["bicep", "terraform"]) {
+        it(`validates strict source-bound native validation receipts for ${track}`, () => {
+            const body = {
+                schemaVersion: CONTRACT_VERSION,
+                projectId: "project",
+                runId: "run",
+                track,
+                sourceHash: hash,
+                treeHash: otherHash,
+                policyHash: hash,
+                inputHash: hash,
+                outcome: "pass",
+                commands: NATIVE_VALIDATION_COMMANDS[track].map((command) => ({
+                    validatorId: command.validatorId,
+                    commandHash: calculateNativeValidationCommandHash(command),
+                    exitCode: 0,
+                    signal: null,
+                    timedOut: false,
+                    outputTruncated: false,
+                })),
+            };
+            const receipt = { ...body, receiptHash: calculateNativeValidationReceiptHash(body) };
+            assert.equal(Value.Check(NativeValidationReceiptV1Schema, receipt), true);
+            assert.equal(hasValidNativeValidationReceipt(receipt, body), true);
+            const applicable = {
+                ...body,
+                policyApplicability: { status: "no-actionable-mappings", policyMapContentHash: body.policyHash },
+            };
+            assert.equal(hasValidNativeValidationReceipt({ ...applicable, receiptHash: calculateNativeValidationReceiptHash(applicable) }, body), true);
+            for (const mutation of [
+                { ...applicable, policyApplicability: { ...applicable.policyApplicability, policyMapContentHash: otherHash } },
+                { ...applicable, policyApplicability: { ...applicable.policyApplicability, status: "compliant" } },
+            ])
+                assert.equal(hasValidNativeValidationReceipt({ ...mutation, receiptHash: calculatePolicyValidationDigest(mutation) }, body), false);
+            if (track === "bicep") {
+                const routing = {
+                    ...body,
+                    storageDiagnostics: {
+                        storage: {
+                            coverage: "bicep-storage-service-diagnostics-v1",
+                            fullBaselineEvaluated: false,
+                            sourceHash: body.sourceHash,
+                            inputHash: otherHash,
+                            bindingHash: hash,
+                            outcome: "pass",
+                            reason: "matched",
+                        },
+                    },
+                };
+                assert.equal(hasValidNativeValidationReceipt({ ...routing, receiptHash: calculateNativeValidationReceiptHash(routing) }, body), true);
+                for (const patch of [
+                    { sourceHash: otherHash },
+                    { fullBaselineEvaluated: true },
+                    { outcome: "fail" },
+                    { reason: "workspace-mismatch" },
+                ]) {
+                    const altered = {
+                        ...routing,
+                        storageDiagnostics: { storage: { ...routing.storageDiagnostics.storage, ...patch } },
+                    };
+                    assert.equal(hasValidNativeValidationReceipt({ ...altered, receiptHash: calculatePolicyValidationDigest(altered) }, body), false);
+                }
+                const parityBody = {
+                    ...body,
+                    resourceParity: {
+                        coverage: "bicep-symbolic-resource-parity-v1",
+                        sourceHash: body.sourceHash,
+                        manifestHash: hash,
+                        inputHash: otherHash,
+                        outcome: "pass",
+                        reason: "matched",
+                    },
+                };
+                assert.equal(hasValidNativeValidationReceipt({ ...parityBody, receiptHash: calculateNativeValidationReceiptHash(parityBody) }, body), true);
+                for (const patch of [
+                    { sourceHash: otherHash },
+                    { outcome: "fail" },
+                    { reason: "coverage-mismatch" },
+                    { coverage: "full" },
+                ]) {
+                    const altered = { ...parityBody, resourceParity: { ...parityBody.resourceParity, ...patch } };
+                    assert.equal(hasValidNativeValidationReceipt({ ...altered, receiptHash: calculatePolicyValidationDigest(altered) }, body), false);
+                }
+                const baselineBody = {
+                    ...parityBody,
+                    resourceParity: { ...parityBody.resourceParity, bindingHash: hash },
+                    securityBaseline: {
+                        coverage: "bicep-storage-only-baseline-v1",
+                        sourceHash: body.sourceHash,
+                        inputHash: otherHash,
+                        manifestHash: hash,
+                        bindingHash: hash,
+                        outcome: "pass",
+                        reason: "matched",
+                    },
+                };
+                assert.equal(hasValidNativeValidationReceipt({ ...baselineBody, receiptHash: calculateNativeValidationReceiptHash(baselineBody) }, body), true);
+                for (const patch of [
+                    { bindingHash: otherHash },
+                    { manifestHash: otherHash },
+                    { inputHash: hash },
+                    { sourceHash: otherHash },
+                    { reason: "storage-controls" },
+                    { outcome: "unsupported" },
+                    { coverage: "full" },
+                ]) {
+                    const changed = { ...baselineBody, securityBaseline: { ...baselineBody.securityBaseline, ...patch } };
+                    assert.equal(hasValidNativeValidationReceipt({ ...changed, receiptHash: calculatePolicyValidationDigest(changed) }, body), false);
+                }
+                const withoutParity = { ...baselineBody };
+                delete withoutParity.resourceParity;
+                assert.equal(hasValidNativeValidationReceipt({ ...withoutParity, receiptHash: calculateNativeValidationReceiptHash(withoutParity) }, body), false);
+                const controls = [
+                    ["properties.minimumTlsVersion", "TLS1_2"],
+                    ["properties.supportsHttpsTrafficOnly", true],
+                    ["properties.allowBlobPublicAccess", false],
+                    ["properties.allowSharedKeyAccess", false],
+                ];
+                const diagnostics = {
+                    storage: {
+                        coverage: "storage-account-property-hardening-v1",
+                        fullBaselineEvaluated: false,
+                        sourceHash: hash,
+                        inputHash: otherHash,
+                        bindingHash: hash,
+                        outcome: "pass",
+                        results: controls.map(([propertyPath, expected]) => ({
+                            propertyPath,
+                            expectedValueDigest: calculatePolicyValidationDigest(expected),
+                            observedValueDigest: calculatePolicyValidationDigest(expected),
+                            outcome: "pass",
+                            reason: "matched",
+                        })),
+                    },
+                };
+                const check = (storageSecurity) => {
+                    const changed = { ...body, storageSecurity };
+                    return hasValidNativeValidationReceipt({ ...changed, receiptHash: calculateNativeValidationReceiptHash(changed) }, body);
+                };
+                assert.equal(check(diagnostics), true);
+                for (const mutation of [
+                    "path",
+                    "expected",
+                    "duplicate",
+                    "reason",
+                    "mismatch-digests",
+                    "missing-observed",
+                    "mixed-inputs",
+                ]) {
+                    const changed = structuredClone(diagnostics);
+                    const result = changed.storage.results[0];
+                    if (mutation === "path")
+                        result.propertyPath = "unrelated";
+                    else if (mutation === "expected")
+                        result.expectedValueDigest = result.observedValueDigest = hash;
+                    else if (mutation === "duplicate")
+                        changed.storage.results[1] = { ...result };
+                    else if (mutation === "mixed-inputs")
+                        changed.other = { ...changed.storage, inputHash: hash };
+                    else {
+                        changed.storage.outcome = result.outcome = "fail";
+                        result.reason = mutation === "reason" ? "unsupported-expression" : "value-mismatch";
+                        if (mutation === "missing-observed")
+                            delete result.observedValueDigest;
+                    }
+                    assert.equal(check(changed), false, mutation);
+                }
+            }
+            assert.equal(schemaById[NativeValidationReceiptV1Schema.$id], NativeValidationReceiptV1Schema);
+            assert.equal(contractMetadata[NativeValidationReceiptV1Schema.$id]?.maxBytes, 8_404_992);
+            assert.equal(calculateNativeValidationReceiptHash(Object.fromEntries(Object.entries(body).reverse())), receipt.receiptHash);
+            for (const key of ["projectId", "runId", "track", "sourceHash", "treeHash", "policyHash", "inputHash"]) {
+                assert.equal(hasValidNativeValidationReceipt(receipt, { ...body, [key]: "different" }), false, key);
+                assert.equal(hasValidNativeValidationReceipt({ ...receipt, [key]: "different" }, body), false, key);
+            }
+            for (const invalid of [
+                { ...receipt, receiptHash: otherHash },
+                { ...receipt, schemaVersion: "2.0.0" },
+                { ...receipt, stdout: "private-source" },
+                { ...receipt, rootPath: "/private/path" },
+                { ...receipt, compliance: "pass" },
+                { ...receipt, outcome: "block" },
+                { ...receipt, commands: [] },
+                { ...receipt, commands: [...receipt.commands, ...receipt.commands, ...receipt.commands, ...receipt.commands] },
+                ...[
+                    { stdout: "private-source" },
+                    { stderr: "private-diagnostic" },
+                    { path: "/private/path" },
+                    { exitCode: 1 },
+                    { signal: "SIGTERM" },
+                    { timedOut: true },
+                    { outputTruncated: true },
+                    { validatorId: "bicep:lint" },
+                    { commandHash: "invalid" },
+                ].map((extra) => ({
+                    ...receipt,
+                    commands: [{ ...receipt.commands[0], ...extra }, ...receipt.commands.slice(1)],
+                })),
+            ]) {
+                assert.equal(hasValidNativeValidationReceipt(invalid, body), false);
+            }
+            for (const commands of [
+                body.commands.slice(1),
+                body.commands.filter(({ validatorId }) => validatorId === "bicep:build"),
+                [...body.commands, body.commands[0]],
+                body.commands.map((command) => ({ ...command, commandHash: otherHash })),
+                body.commands.map((command) => ({ ...command, validatorId: "terraform:validate" })),
+            ]) {
+                const tampered = { ...body, commands };
+                assert.equal(hasValidNativeValidationReceipt({ ...tampered, receiptHash: calculateNativeValidationReceiptHash(tampered) }, body), false);
+            }
+            if (body.commands.length > 1) {
+                const reordered = { ...body, commands: [...body.commands].reverse() };
+                assert.equal(hasValidNativeValidationReceipt({ ...reordered, receiptHash: calculateNativeValidationReceiptHash(reordered) }, body), false);
+            }
+        });
+    }
+    it("binds archetype origin proposals without accepting imported authority", () => {
+        const body = {
+            schemaVersion: "1.0.0",
+            repositoryPath: "/source/coe",
+            revision: "a".repeat(40),
+            selectedPath: "archetypes/storage",
+            authorityImported: false,
+            requiresConsumerReview: true,
+            files: [{ path: "main.bicep", hash, bytes: 10 }],
+            excluded: [],
+        };
+        const proposal = { ...body, contentHash: calculatePolicyValidationDigest(body) };
+        assert.equal(hasValidArchetypeSourceProposal(proposal), true);
+        for (const changed of [
+            { ...body, authorityImported: true },
+            { ...body, requiresConsumerReview: false },
+            { ...body, revision: "HEAD" },
+            { ...body, selectedPath: "../outside" },
+            { ...body, files: [{ path: "/absolute", hash, bytes: 10 }] },
+            { ...body, files: [{ path: "nested/../outside", hash, bytes: 10 }] },
+            { ...body, files: [{ path: "main.bicep", hash, bytes: 1_048_577 }] },
+            { ...body, excluded: [{ path: "MAIN.bicep", reason: "source-authority" }] },
+            { ...body, approval: true },
+        ])
+            assert.equal(hasValidArchetypeSourceProposal({ ...changed, contentHash: calculatePolicyValidationDigest(changed) }), false);
+        assert.equal(hasValidArchetypeSourceProposal({ ...proposal, revision: "b".repeat(40) }), false);
+    });
+    it("bounds requirements amendments without allowing identity or requirement-ID replacement", () => {
+        const amendment = {
+            schemaVersion: "1.0.0",
+            baseRequirementsHash: "a".repeat(64),
+            updates: [{ id: "REQ-1", changes: { statement: "Updated objective" } }],
+            additions: [],
+            removals: [],
+            fields: { budgetAndOperations: "EUR 500" },
+        };
+        assert.equal(Value.Check(RequirementsAmendmentV1Schema, amendment), true);
+        for (const changed of [
+            { ...amendment, baseRequirementsHash: "invalid" },
+            { ...amendment, updates: Array.from({ length: 129 }, () => amendment.updates[0]) },
+            { ...amendment, updates: [{ id: "REQ-1", changes: {} }] },
+            { ...amendment, updates: [{ id: "REQ-1", changes: { id: "REQ-2" } }] },
+            ...["schemaVersion", "projectId", "environment", "requirements"].map((key) => ({
+                ...amendment,
+                fields: { [key]: "changed" },
+            })),
+            { ...amendment, approved: true },
+        ])
+            assert.equal(Value.Check(RequirementsAmendmentV1Schema, changed), false);
+    });
+    it("keeps requirements change proposals bounded and distinct from deployment authority", () => {
+        const proposal = {
+            schemaVersion: "1.0.0",
+            projectId: "demo",
+            runId: "run-1",
+            expectedHead: hash,
+            ownerEpoch: 0,
+            sourceRequirementsHash: hash,
+            candidateHash: hash,
+            reason: "Change budget",
+            mode: "revise",
+            addedRequirementIds: [],
+            removedRequirementIds: [],
+            changedRequirementIds: ["budget"],
+            retainedRequirementIds: ["availability"],
+            changedFields: [],
+            invalidatedNodes: ["requirements"],
+            invalidatedGates: [1, 2, 3, 4],
+            requiresReassessment: ["cost", "policy", "security", "dependencies", "code", "documents"],
+            filesModified: false,
+            deploymentAuthorized: false,
+            proposalHash: hash,
+        };
+        assert.equal(Value.Check(RequirementsChangeProposalV1Schema, proposal), true);
+        assert.equal(Value.Check(RequirementsChangeProposalV1Schema, { ...proposal, mode: "adopt", sourceRequirementsHash: null }), true);
+        for (const changed of [
+            { ...proposal, deploymentAuthorized: true },
+            { ...proposal, filesModified: true },
+            { ...proposal, ownerEpoch: -1 },
+            { ...proposal, expectedHead: "HEAD" },
+            { ...proposal, invalidatedGates: [5] },
+            { ...proposal, changedRequirementIds: ["same", "same"] },
+            { ...proposal, reason: "x".repeat(2049) },
+            { ...proposal, approval: true },
+        ])
+            assert.equal(Value.Check(RequirementsChangeProposalV1Schema, changed), false);
+    });
+    it("requires explicit alternatives and all WAF impacts for structured Architecture decisions", () => {
+        const record = {
+            id: "ADR-0001",
+            title: "Service selection",
+            context: "Workload constraints",
+            decision: "Selected service",
+            requirementIds: ["REQ-1"],
+            alternatives: [
+                { option: "Alternative A", benefits: "Simple", drawbacks: "Capacity", rejectionReason: "Cannot meet demand" },
+                {
+                    option: "Alternative B",
+                    benefits: "Flexible",
+                    drawbacks: "Operations",
+                    rejectionReason: "Requires unavailable staffing",
+                },
+            ],
+            positiveConsequences: ["Meets demand"],
+            negativeConsequences: ["Higher baseline cost"],
+            wafImpacts: {
+                security: "Identity controls",
+                reliability: "Recovery design",
+                "performance-efficiency": "Capacity",
+                "cost-optimization": "Cost trade-off",
+                "operational-excellence": "Staffing",
+            },
+            complianceConsiderations: "Review against target policy",
+            implementationNotes: "Bind selected service in plan",
+        };
+        const schema = ArchitectureV1Schema.properties.decisionRecords.items;
+        assert.equal(Value.Check(schema, record), true);
+        for (const changed of [
+            { ...record, alternatives: [] },
+            { ...record, negativeConsequences: [] },
+            { ...record, wafImpacts: { security: "Only one pillar" } },
+            { ...record, approval: true },
+            { ...record, id: "../escape" },
+        ])
+            assert.equal(Value.Check(schema, changed), false);
+    });
+    it("operational handoff describes procedures without asserting unobserved execution", () => {
+        const procedure = {
+            applicability: "applicable",
+            owner: "Operations",
+            prerequisites: ["Approved maintenance"],
+            steps: ["Follow resource-specific procedure"],
+            verification: "Verify expected health",
+            executionStatus: "untested",
+        };
+        const handoff = {
+            owner: "Operations",
+            escalation: "On-call escalation",
+            maintenanceWindow: "Sunday 02:00 UTC",
+            accessPrerequisites: ["Read-only monitoring role"],
+            configurationReferences: [{ name: "SERVICE_ENDPOINT", source: "Deployment output reference" }],
+            healthChecks: [
+                { resourceId: "/resource", check: "Inspect health endpoint", expectedOutcome: "Healthy", evidenceRefs: [] },
+            ],
+            monitoring: "Review target workspace alerts",
+            incidentResponse: procedure,
+            rollback: procedure,
+            recovery: {
+                applicability: "not-applicable",
+                rationale: "Stateless component; persistent data is externally owned",
+            },
+            limitations: ["Procedures have not been exercised"],
+        };
+        const schema = DiagnosisV1Schema.properties.operationalHandoff;
+        assert.equal(Value.Check(schema, handoff), true);
+        for (const changed of [
+            { ...handoff, recovery: { applicability: "not-applicable" } },
+            { ...handoff, rollback: { ...procedure, executionStatus: "tested" } },
+            { ...handoff, healthChecks: [] },
+            { ...handoff, approval: true },
+        ])
+            assert.equal(Value.Check(schema, changed), false);
+    });
+    it("bounds native diagnostic scope references without arbitrary expressions", () => {
+        const source = {
+            schemaVersion: "1.0.0",
+            projectId: "demo",
+            runId: "run",
+            track: "bicep",
+            intentHash: hash,
+            resourceBindings: {
+                diagnostic: {
+                    implementation: "native:Microsoft.Insights/diagnosticSettings@2021-05-01-preview",
+                    version: "2021-05-01-preview",
+                    scopeLogicalId: "storage",
+                    parameters: {},
+                },
+            },
+        };
+        assert.equal(Value.Check(IacBindingV1Schema, source), true);
+        for (const scopeLogicalId of ["../outside", "[resourceId('x')]", "foreign/id", "", "x".repeat(257)])
+            assert.equal(Value.Check(IacBindingV1Schema, {
+                ...source,
+                resourceBindings: { diagnostic: { ...source.resourceBindings.diagnostic, scopeLogicalId } },
+            }), false);
+    });
     it("uses one explicit persisted contract version", () => {
         const lock = {
             schemaVersion: CONTRACT_VERSION,
@@ -49,15 +495,151 @@ describe("Wave 1 contracts", () => {
         };
         assert.equal(Value.Check(RequirementsV1Schema, requirements), true);
     });
+    it("validates optional strict bounded intended physical resource scope on bindings", () => {
+        const primary = {
+            resourceId: "/subscriptions/11111111-2222-3333-4444-555555555555/resourceGroups/workload/providers/Microsoft.Storage/storageAccounts/storage",
+            type: "Microsoft.Storage/storageAccounts",
+            ownership: "managed",
+            role: "primary",
+        };
+        const resourceBinding = {
+            implementation: "avm:br/public:avm/res/storage/storage-account@0.9.0",
+            version: "0.9.0",
+            parameters: {},
+        };
+        const binding = {
+            schemaVersion: CONTRACT_VERSION,
+            projectId: "demo",
+            runId: "run-test",
+            track: "bicep",
+            intentHash: hash,
+            resourceBindings: { storage: resourceBinding },
+        };
+        const withResources = (physicalResources) => ({
+            ...binding,
+            resourceBindings: { storage: { ...resourceBinding, physicalResources } },
+        });
+        assert.equal(Value.Check(IacBindingV1Schema, binding), true);
+        assert.equal(Value.Check(IacBindingV1Schema, withResources([primary])), true);
+        assert.equal(Value.Check(IacBindingV1Schema, withResources([{ ...primary, resourceId: primary.resourceId.toUpperCase(), type: primary.type.toUpperCase() }])), true);
+        const bounded = Array.from({ length: 128 }, (_, index) => ({
+            ...primary,
+            resourceId: `${primary.resourceId}${index}`,
+            role: index === 0 ? "primary" : "ancillary",
+            ownership: index === 0 ? "managed" : "existing",
+        }));
+        assert.equal(Value.Check(IacBindingV1Schema, withResources(bounded)), true);
+        for (const physicalResources of [
+            [],
+            null,
+            {},
+            [primary, primary],
+            [...bounded, primary],
+            [{ ...primary, unexpected: true }],
+            [{ ...primary, ownership: "observed" }],
+            [{ ...primary, role: "secondary" }],
+            [{ ...primary, type: "" }],
+            [{ ...primary, type: `Microsoft.Storage/${"a".repeat(256)}` }],
+            [{ ...primary, resourceId: `${primary.resourceId}${"a".repeat(2048)}` }],
+            ...["*", "%2f", "?query", "#fragment", "[expression]", "${expression}", "\n", "\r\n"].map((suffix) => [
+                { ...primary, resourceId: `${primary.resourceId}${suffix}` },
+            ]),
+            [{ ...primary, type: `${primary.type}\n` }],
+            ...Object.keys(primary).map((key) => [
+                Object.fromEntries(Object.entries(primary).filter(([field]) => field !== key)),
+            ]),
+        ]) {
+            assert.equal(Value.Check(IacBindingV1Schema, withResources(physicalResources)), false);
+        }
+    });
+    it("bootstrap preflight cannot assert execution authority or hide unassessed operations", () => {
+        const plan = {
+            schemaVersion: "1.0.0",
+            config: { schemaVersion: "1.0.0", projectId: "demo" },
+            configHash: "a".repeat(64),
+            runtimeVersion: "0.11.0-next.0",
+            scope: "local-bootstrap-preflight-v1",
+            status: "pending",
+            checks: ["repository", "workspace-runtime", "apex-state"].map((id) => ({
+                id,
+                status: "pending",
+                reason: "Needs setup",
+            })),
+            unassessed: [
+                "machine-prerequisites",
+                "client-health",
+                "remote-coe",
+                "github-repository",
+                "governance-oidc",
+                "reviewed-baseline",
+            ],
+            filesModified: false,
+            executionAuthorized: false,
+        };
+        assert.equal(Value.Check(BootstrapPlanV1Schema, plan), true);
+        for (const changed of [
+            { ...plan, executionAuthorized: true },
+            { ...plan, filesModified: true },
+            { ...plan, unassessed: [] },
+            { ...plan, checks: [] },
+            { ...plan, configHash: "invalid" },
+            { ...plan, token: "secret" },
+        ])
+            assert.equal(Value.Check(BootstrapPlanV1Schema, changed), false);
+    });
+    it("governance setup inputs reject secrets, malformed scopes and incomplete reused identities", () => {
+        const config = {
+            schemaVersion: "1.0.0",
+            repository: "Example/COE",
+            tenantId: "a".repeat(8) + "-1111-1111-1111-111111111111",
+            subscriptionId: "22222222-2222-2222-2222-222222222222",
+            identity: { mode: "create", displayName: "coe-reader" },
+        };
+        assert.equal(Value.Check(GovernanceSetupConfigV1Schema, config), true);
+        assert.equal(Value.Check(GovernanceSetupConfigV1Schema, { ...config, managementGroupId: "a" }), true);
+        for (const invalid of [
+            { ...config, clientSecret: "forbidden" },
+            { ...config, managementGroupId: "../root" },
+            { ...config, repository: "Example/COE\n" },
+            { ...config, tenantId: config.tenantId + "\n" },
+            { ...config, managementGroupId: "platform\n" },
+            { ...config, identity: { mode: "reuse", clientId: config.tenantId } },
+            { ...config, repository: "Example/COE:environment:production" },
+            { ...config, identity: { mode: "create", displayName: "coe", role: "Owner" } },
+        ])
+            assert.equal(Value.Check(GovernanceSetupConfigV1Schema, invalid), false);
+        for (const field of ["filesModified", "executionAuthorized", "deploymentAuthorized"])
+            assert.equal(Value.Check(GovernanceSetupPlanV1Schema.properties[field], true), false);
+    });
+    it("batch archetype configuration requires bounded independent remote selections", () => {
+        const config = {
+            schemaVersion: "1.0.0",
+            repository: "https://github.com/example/coe",
+            revision: "a".repeat(40),
+            selections: [{ selectedPath: "archetypes/storage", destination: "storage" }],
+        };
+        assert.equal(Value.Check(ArchetypeBatchConfigV1Schema, config), true);
+        for (const invalid of [
+            { ...config, repository: "/local/path" },
+            { ...config, revision: "main" },
+            { ...config, selections: [] },
+            { ...config, selections: Array.from({ length: 17 }, () => config.selections[0]) },
+            { ...config, selections: [{ selectedPath: "../escape", destination: "storage" }] },
+            { ...config, selections: [{ selectedPath: "archetypes/storage", destination: "nested/workload" }] },
+            { ...config, authorityImported: true },
+        ])
+            assert.equal(Value.Check(ArchetypeBatchConfigV1Schema, invalid), false);
+    });
     it("validates strict onboarding configuration with optional defaults", () => {
         const config = {
             schemaVersion: CONTRACT_VERSION,
             projectId: "payments",
-            client: "github-copilot-vscode",
+            client: "github-copilot-cli",
             createRepository: true,
         };
         assert.equal(Value.Check(OnboardingConfigV1Schema, config), true);
-        assert.equal(Value.Check(OnboardingConfigV1Schema, { ...config, client: "unsupported" }), false);
+        for (const client of ["github-copilot-vscode", "both", "unsupported"])
+            assert.equal(Value.Check(OnboardingConfigV1Schema, { ...config, client }), false);
         assert.equal(Value.Check(OnboardingConfigV1Schema, { ...config, unexpected: true }), false);
     });
     it("binds live qualification evidence to an exact candidate", () => {
@@ -111,6 +693,32 @@ describe("Wave 1 contracts", () => {
             assert.match(schema.$id ?? "", /^https:\/\/schemas\.apexops\.dev\//);
         }
     });
+    it("validates strict bounded repeat-guard records", () => {
+        const record = {
+            fingerprint: hash,
+            callHash: otherHash,
+            operation: "stageArtifact",
+            stateBefore: null,
+            stateAfter: hash,
+            recordedAt: timestamp,
+            expiresAt: timestamp,
+            result: '{"staged":true}',
+        };
+        const file = { schemaVersion: CONTRACT_VERSION, records: [record, { ...record, stateBefore: otherHash }] };
+        assert.equal(Value.Check(RepeatGuardRecordsV1Schema, file), true);
+        assert.equal(contractMetadata[RepeatGuardRecordsV1Schema.$id]?.sensitivity, "confidential");
+        for (const invalid of [
+            { ...file, unexpected: true },
+            { ...file, schemaVersion: "2.0.0" },
+            { ...file, records: [{ ...record, unexpected: true }] },
+            { ...file, records: [{ ...record, callHash: "not-a-hash" }] },
+            { ...file, records: [{ ...record, operation: "1bad" }] },
+            { ...file, records: [{ ...record, result: "x".repeat(65_537) }] },
+            { ...file, records: Array.from({ length: 17 }, () => record) },
+        ]) {
+            assert.equal(Value.Check(RepeatGuardRecordsV1Schema, invalid), false);
+        }
+    });
     it("validates bounded improvement contracts", () => {
         const observation = {
             schemaVersion: CONTRACT_VERSION,
@@ -372,6 +980,7 @@ describe("target family contracts", () => {
                     {
                         id: "api",
                         service: "Azure App Service",
+                        resourceTypes: ["Microsoft.Web/sites"],
                         purpose: "Host API",
                         requirementIds: ["REQ-001"],
                         dependsOn: [],
@@ -379,6 +988,25 @@ describe("target family contracts", () => {
                 ],
                 decisions: ["Use managed identity"],
                 risks: [],
+                wellArchitectedAssessment: {
+                    framework: "azure-well-architected-framework",
+                    assessmentType: "qualitative",
+                    pillars: [
+                        "security",
+                        "reliability",
+                        "performance-efficiency",
+                        "cost-optimization",
+                        "operational-excellence",
+                    ].map((pillar) => ({
+                        pillar,
+                        status: "aligned",
+                        assessment: `${pillar} requirements are addressed`,
+                        requirementIds: ["REQ-001"],
+                        evidenceRefs: [hash],
+                        recommendations: [],
+                        tradeoffs: [],
+                    })),
+                },
             },
         ],
         [
@@ -415,6 +1043,13 @@ describe("target family contracts", () => {
                 subjectKind: "architecture-v1",
                 subjectHash: hash,
                 reviewedAt: timestamp,
+                capture: {
+                    reviewer: "rubber-duck",
+                    nonce: "0123456789abcdef0123456789abcdef",
+                    captureHash: otherHash,
+                    promptSha256: hash,
+                    responseSha256: otherHash,
+                },
                 findings: [
                     {
                         id: "finding-1",
@@ -426,6 +1061,18 @@ describe("target family contracts", () => {
                         resolution: "Added zone-redundant deployment",
                     },
                 ],
+                criteria: [
+                    "security",
+                    "reliability",
+                    "performance-efficiency",
+                    "cost-optimization",
+                    "operational-excellence",
+                ].map((criterionId) => ({
+                    criterionId,
+                    outcome: criterionId === "reliability" ? "finding" : "pass",
+                    rationale: `${criterionId} was reviewed`,
+                    findingIds: criterionId === "reliability" ? ["finding-1"] : [],
+                })),
             },
         ],
         [
@@ -435,6 +1082,7 @@ describe("target family contracts", () => {
                 projectId: "example-project",
                 runId: "run-1",
                 targetScope: "/subscriptions/example",
+                source: "collected",
                 discoveredAt: timestamp,
                 expiresAt: expiry,
                 summary: { assignmentCount: 3, denyCount: 1, modifyCount: 1, auditCount: 1, exemptionCount: 0 },
@@ -677,6 +1325,42 @@ describe("target family contracts", () => {
                 lockedAt: timestamp,
             },
         ],
+        [
+            ReviewCaptureV1Schema,
+            {
+                schema: "apex-review-capture-v1",
+                nonce: "0123456789abcdef0123456789abcdef",
+                sessionId: null,
+                toolName: "task",
+                agentType: "rubber-duck",
+                prompt: "APEX-REVIEW: nonce=0123456789abcdef0123456789abcdef",
+                requestSha256: hash,
+                response: '```apex-review\n{"findings":[]}\n```',
+                responseSha256: otherHash,
+                capturedAt: timestamp,
+                signature: hash,
+            },
+        ],
+        [
+            ReviewRequestV1Schema,
+            {
+                schemaVersion: CONTRACT_VERSION,
+                nonce: "0123456789abcdef0123456789abcdef",
+                agentType: "rubber-duck",
+                mode: "sync",
+                gate: 1,
+                subjectKind: "requirements",
+                subjectHash: hash,
+                attempt: 1,
+                maxAttempts: 2,
+                prompt: "APEX-REVIEW: nonce=0123456789abcdef0123456789abcdef",
+                promptSha256: otherHash,
+                files: [
+                    { label: "instructions", kind: "instructions", path: "/workspace/instructions.md", sha256: hash },
+                    { label: "subject", kind: "requirements", path: "/workspace/subject.json", sha256: otherHash },
+                ],
+            },
+        ],
     ];
     it("validates a representative fixture for every target family", () => {
         for (const [schema, fixture] of fixtures) {
@@ -693,6 +1377,42 @@ describe("target family contracts", () => {
             questions: [{ id: "region", prompt: "Which region?", options: ["sweden", "germany"] }],
         };
         assert.equal(Value.Check(InputRequestV1Schema, request), true);
+        const { intake: _intake, ...base } = request;
+        const governance = {
+            candidatePath: "governance/baseline.json",
+            candidateHash: hash,
+            observedAt: "2026-09-01T00:00:00Z",
+            requestedAt: "2026-09-19T00:00:00Z",
+            expiresAt: "2026-09-20T00:00:00Z",
+            targetScope: "/subscriptions/11111111-1111-1111-1111-111111111111",
+            refreshRequired: false,
+        };
+        assert.equal(Value.Check(InputRequestV1Schema, { ...base, governance }), true);
+        assert.equal(Value.Check(InputRequestV1Schema, { ...request, governance }), false);
+        assert.equal(Value.Check(InputRequestV1Schema, { ...base, governance, decision: { taskId: "task-1", id: "choice" } }), false);
+        for (const candidatePath of [
+            "/baseline.json",
+            "C:/baseline.json",
+            "../baseline.json",
+            "dir/../baseline.json",
+            "./baseline.json",
+            "dir\\baseline.json",
+            "bad\u0000.json",
+            "a".repeat(4097),
+        ]) {
+            assert.equal(Value.Check(InputRequestV1Schema, { ...base, governance: { ...governance, candidatePath } }), false);
+        }
+        for (const extra of [
+            { candidateHash: "bad" },
+            { observedAt: "not-a-date" },
+            { requestedAt: undefined },
+            { requestedAt: null },
+            { requestedAt: "not-a-date" },
+            { refreshRequired: "false" },
+            { snapshot: {} },
+        ]) {
+            assert.equal(Value.Check(InputRequestV1Schema, { ...base, governance: { ...governance, ...extra } }), false);
+        }
         assert.equal(Value.Check(InputRequestV1Schema, {
             schemaVersion: CONTRACT_VERSION,
             requestId: request.requestId,
@@ -719,7 +1439,13 @@ describe("target family contracts", () => {
         }), true);
         assert.equal(hasValidInputRequestQuestions([
             { id: "one", prompt: "One?" },
-            { id: "two", prompt: "Two?", options: ["a", "b"], multiSelect: true },
+            {
+                id: "two",
+                prompt: "Two?",
+                options: ["a", "b"],
+                multiSelect: true,
+                recommendation: { value: ["a"], source: "default", rationale: "Recommended baseline." },
+            },
         ]), true);
         assert.equal(hasValidInputRequestQuestions([
             { id: "same", prompt: "One?" },
@@ -728,6 +1454,17 @@ describe("target family contracts", () => {
         assert.equal(hasValidInputRequestQuestions([{ id: "bad", prompt: "Bad?", multiSelect: true }]), false);
         assert.equal(hasValidInputRequestQuestions([{ id: "bad", prompt: "Bad?", options: [] }]), false);
         assert.equal(hasValidInputRequestQuestions([{ id: "bad", prompt: "Bad?", options: ["same", "same"] }]), false);
+        assert.equal(hasValidInputRequestQuestions([
+            {
+                id: "bad",
+                prompt: "Bad?",
+                options: ["a", "b"],
+                recommendation: { value: "c", source: "derived", rationale: "Outside options." },
+            },
+        ]), false);
+        assert.equal(hasValidInputRequestQuestions([
+            { id: "bad", prompt: "Bad?", options: ["a", "b"], recommendation: null },
+        ]), false);
         assert.equal(Value.Check(InputRequestV1Schema, {
             ...request,
             questions: [{ id: "bad", prompt: "Bad?", options: ["same", "same"] }],
@@ -748,6 +1485,16 @@ describe("target family contracts", () => {
             },
         }), false);
     });
+    it("accepts optional non-empty execution addresses without changing binding descriptors", () => {
+        const manifest = fixtures[7][1];
+        assert.equal(Value.Check(LogicalResourceManifestV1Schema, manifest), true);
+        for (const executionAddress of ["plan", "azapi_resource.plan", "data.azapi_resource.plan", "module.plan", "", 42]) {
+            assert.equal(Value.Check(LogicalResourceManifestV1Schema, {
+                ...manifest,
+                resources: manifest.resources.map((resource) => ({ ...resource, executionAddress })),
+            }), typeof executionAddress === "string" && executionAddress.length > 0);
+        }
+    });
     it("requires unique logical IDs and resolvable dependency references", () => {
         const manifest = fixtures[7][1];
         assert.equal(hasValidLogicalResourceReferences(manifest), true);
@@ -768,6 +1515,24 @@ describe("target family contracts", () => {
             ],
         }), false);
     });
+    it("requires track-specific read-only declarations for existing resource ownership", () => {
+        const manifest = fixtures[7][1];
+        for (const track of ["bicep", "terraform"]) {
+            for (const implementationKind of ["resource", "module", "data", "existing"]) {
+                for (const ownership of ["managed", "existing"]) {
+                    const referenceKind = track === "bicep" ? "existing" : "data";
+                    const expected = ownership === "existing"
+                        ? implementationKind === referenceKind
+                        : implementationKind === "resource" || implementationKind === "module";
+                    assert.equal(hasValidLogicalResourceReferences({
+                        ...manifest,
+                        track,
+                        resources: manifest.resources.map((resource) => ({ ...resource, implementationKind, ownership })),
+                    }), expected, `${track}: ${implementationKind} with ${ownership} ownership`);
+                }
+            }
+        }
+    });
     it("binds encrypted plan attestations to the preview and approval recipient", () => {
         const attestation = fixtures[9][1];
         const preview = {