@apexops/contracts 0.10.0-next.4 → 0.11.0-next.0

package/dist/targets.d.ts

@@ -4,6 +4,8 @@ export declare const SeveritySchema: import("@sinclair/typebox").TUnion<[import(
 export declare const DispositionSchema: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"open">, import("@sinclair/typebox").TLiteral<"accepted">, import("@sinclair/typebox").TLiteral<"remediated">, import("@sinclair/typebox").TLiteral<"dismissed">]>;
 export declare const ConfidenceSchema: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"low">, import("@sinclair/typebox").TLiteral<"medium">, import("@sinclair/typebox").TLiteral<"high">]>;
 export declare const CurrencySchema: import("@sinclair/typebox").TString;
+export declare const WellArchitectedPillarSchema: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"security">, import("@sinclair/typebox").TLiteral<"reliability">, import("@sinclair/typebox").TLiteral<"performance-efficiency">, import("@sinclair/typebox").TLiteral<"cost-optimization">, import("@sinclair/typebox").TLiteral<"operational-excellence">]>;
+export declare const WellArchitectedStatusSchema: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"aligned">, import("@sinclair/typebox").TLiteral<"concern">, import("@sinclair/typebox").TLiteral<"blocker">, import("@sinclair/typebox").TLiteral<"not-applicable">]>;
 export declare const WorkloadDecisionManifestV1Schema: import("@sinclair/typebox").TObject<{
     schemaVersion: import("@sinclair/typebox").TLiteral<"1.0.0">;
     projectId: import("@sinclair/typebox").TString;
@@ -69,12 +71,50 @@ export declare const ArchitectureV1Schema: import("@sinclair/typebox").TObject<{
     components: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
         id: import("@sinclair/typebox").TString;
         service: import("@sinclair/typebox").TString;
+        resourceTypes: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
         purpose: import("@sinclair/typebox").TString;
         requirementIds: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
         dependsOn: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
     }>>;
     decisions: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+    decisionRecords: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+        id: import("@sinclair/typebox").TString;
+        title: import("@sinclair/typebox").TString;
+        context: import("@sinclair/typebox").TString;
+        decision: import("@sinclair/typebox").TString;
+        requirementIds: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+        alternatives: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+            option: import("@sinclair/typebox").TString;
+            benefits: import("@sinclair/typebox").TString;
+            drawbacks: import("@sinclair/typebox").TString;
+            rejectionReason: import("@sinclair/typebox").TString;
+        }>>;
+        positiveConsequences: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+        negativeConsequences: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+        wafImpacts: import("@sinclair/typebox").TObject<{
+            security: import("@sinclair/typebox").TString;
+            reliability: import("@sinclair/typebox").TString;
+            "performance-efficiency": import("@sinclair/typebox").TString;
+            "cost-optimization": import("@sinclair/typebox").TString;
+            "operational-excellence": import("@sinclair/typebox").TString;
+        }>;
+        complianceConsiderations: import("@sinclair/typebox").TString;
+        implementationNotes: import("@sinclair/typebox").TString;
+    }>>>;
     risks: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+    wellArchitectedAssessment: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+        framework: import("@sinclair/typebox").TLiteral<"azure-well-architected-framework">;
+        assessmentType: import("@sinclair/typebox").TLiteral<"qualitative">;
+        pillars: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+            pillar: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"security">, import("@sinclair/typebox").TLiteral<"reliability">, import("@sinclair/typebox").TLiteral<"performance-efficiency">, import("@sinclair/typebox").TLiteral<"cost-optimization">, import("@sinclair/typebox").TLiteral<"operational-excellence">]>;
+            status: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"aligned">, import("@sinclair/typebox").TLiteral<"concern">, import("@sinclair/typebox").TLiteral<"blocker">, import("@sinclair/typebox").TLiteral<"not-applicable">]>;
+            assessment: import("@sinclair/typebox").TString;
+            requirementIds: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+            evidenceRefs: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+            recommendations: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+            tradeoffs: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+        }>>;
+    }>>;
 }>;
 export declare const CostLineItemV1Schema: import("@sinclair/typebox").TObject<{
     id: import("@sinclair/typebox").TString;
@@ -103,6 +143,7 @@ export declare const CostEstimateV1Schema: import("@sinclair/typebox").TObject<{
     runId: import("@sinclair/typebox").TString;
     currency: import("@sinclair/typebox").TString;
     pricingDate: import("@sinclair/typebox").TString;
+    pricingStatus: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"complete">, import("@sinclair/typebox").TLiteral<"partial">]>>;
     lineItems: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
         id: import("@sinclair/typebox").TString;
         service: import("@sinclair/typebox").TString;
@@ -124,9 +165,52 @@ export declare const CostEstimateV1Schema: import("@sinclair/typebox").TObject<{
             basis: import("@sinclair/typebox").TString;
         }>;
     }>>;
+    unpricedItems: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+        id: import("@sinclair/typebox").TString;
+        service: import("@sinclair/typebox").TString;
+        sku: import("@sinclair/typebox").TString;
+        quantity: import("@sinclair/typebox").TNumber;
+        attemptedAt: import("@sinclair/typebox").TString;
+        reason: import("@sinclair/typebox").TString;
+    }>>>;
     totalMonthlyCost: import("@sinclair/typebox").TNumber;
     assumptions: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
 }>;
+export declare const ReviewNonceSchema: import("@sinclair/typebox").TString;
+/** The kernel-issued rubber-duck review request for one review task (DECISION-031), kept in the object store. */
+export declare const ReviewRequestV1Schema: import("@sinclair/typebox").TObject<{
+    schemaVersion: import("@sinclair/typebox").TLiteral<"1.0.0">;
+    nonce: import("@sinclair/typebox").TString;
+    agentType: import("@sinclair/typebox").TLiteral<"rubber-duck">;
+    mode: import("@sinclair/typebox").TLiteral<"sync">;
+    gate: import("@sinclair/typebox").TInteger;
+    subjectKind: import("@sinclair/typebox").TString;
+    subjectHash: import("@sinclair/typebox").TString;
+    attempt: import("@sinclair/typebox").TInteger;
+    maxAttempts: import("@sinclair/typebox").TInteger;
+    prompt: import("@sinclair/typebox").TString;
+    promptSha256: import("@sinclair/typebox").TString;
+    files: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+        label: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"instructions">, import("@sinclair/typebox").TLiteral<"subject">, import("@sinclair/typebox").TLiteral<"input">]>;
+        kind: import("@sinclair/typebox").TString;
+        path: import("@sinclair/typebox").TString;
+        sha256: import("@sinclair/typebox").TString;
+    }>>;
+}>;
+/** The record the managed postToolUse hook writes for one rubber-duck task call (DECISION-031). */
+export declare const ReviewCaptureV1Schema: import("@sinclair/typebox").TObject<{
+    schema: import("@sinclair/typebox").TLiteral<"apex-review-capture-v1">;
+    nonce: import("@sinclair/typebox").TString;
+    sessionId: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TString, import("@sinclair/typebox").TNull]>;
+    toolName: import("@sinclair/typebox").TString;
+    agentType: import("@sinclair/typebox").TString;
+    prompt: import("@sinclair/typebox").TString;
+    requestSha256: import("@sinclair/typebox").TString;
+    response: import("@sinclair/typebox").TString;
+    responseSha256: import("@sinclair/typebox").TString;
+    capturedAt: import("@sinclair/typebox").TString;
+    signature: import("@sinclair/typebox").TString;
+}>;
 export declare const ReviewFindingsV1Schema: import("@sinclair/typebox").TObject<{
     schemaVersion: import("@sinclair/typebox").TLiteral<"1.0.0">;
     projectId: import("@sinclair/typebox").TString;
@@ -134,6 +218,13 @@ export declare const ReviewFindingsV1Schema: import("@sinclair/typebox").TObject
     subjectKind: import("@sinclair/typebox").TString;
     subjectHash: import("@sinclair/typebox").TString;
     reviewedAt: import("@sinclair/typebox").TString;
+    capture: import("@sinclair/typebox").TObject<{
+        reviewer: import("@sinclair/typebox").TLiteral<"rubber-duck">;
+        nonce: import("@sinclair/typebox").TString;
+        captureHash: import("@sinclair/typebox").TString;
+        promptSha256: import("@sinclair/typebox").TString;
+        responseSha256: import("@sinclair/typebox").TString;
+    }>;
     findings: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
         id: import("@sinclair/typebox").TString;
         severity: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"critical">, import("@sinclair/typebox").TLiteral<"high">, import("@sinclair/typebox").TLiteral<"medium">, import("@sinclair/typebox").TLiteral<"low">, import("@sinclair/typebox").TLiteral<"info">]>;
@@ -143,12 +234,19 @@ export declare const ReviewFindingsV1Schema: import("@sinclair/typebox").TObject
         evidenceRefs: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
         resolution: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     }>>;
+    criteria: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+        criterionId: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"security">, import("@sinclair/typebox").TLiteral<"reliability">, import("@sinclair/typebox").TLiteral<"performance-efficiency">, import("@sinclair/typebox").TLiteral<"cost-optimization">, import("@sinclair/typebox").TLiteral<"operational-excellence">]>;
+        outcome: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"pass">, import("@sinclair/typebox").TLiteral<"finding">, import("@sinclair/typebox").TLiteral<"not-applicable">]>;
+        rationale: import("@sinclair/typebox").TString;
+        findingIds: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+    }>>>;
 }>;
 export declare const GovernanceConstraintsV1Schema: import("@sinclair/typebox").TObject<{
     schemaVersion: import("@sinclair/typebox").TLiteral<"1.0.0">;
     projectId: import("@sinclair/typebox").TString;
     runId: import("@sinclair/typebox").TString;
     targetScope: import("@sinclair/typebox").TString;
+    source: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"collected">, import("@sinclair/typebox").TLiteral<"reference">]>;
     discoveredAt: import("@sinclair/typebox").TString;
     expiresAt: import("@sinclair/typebox").TString;
     summary: import("@sinclair/typebox").TObject<{
@@ -172,11 +270,14 @@ export declare const PolicyPropertyMapV1Schema: import("@sinclair/typebox").TObj
     governanceHash: import("@sinclair/typebox").TString;
     mappings: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
         policyAssignmentId: import("@sinclair/typebox").TString;
+        policyDefinitionId: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
+        policyDefinitionReferenceId: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
         effect: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"deny">, import("@sinclair/typebox").TLiteral<"modify">, import("@sinclair/typebox").TLiteral<"append">, import("@sinclair/typebox").TLiteral<"audit">, import("@sinclair/typebox").TLiteral<"deployIfNotExists">, import("@sinclair/typebox").TLiteral<"disabled">]>;
         logicalResourceId: import("@sinclair/typebox").TString;
         propertyPath: import("@sinclair/typebox").TString;
         expectedValue: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TUnknown>;
-        disposition: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"satisfied">, import("@sinclair/typebox").TLiteral<"planned">, import("@sinclair/typebox").TLiteral<"exempt">, import("@sinclair/typebox").TLiteral<"blocked">]>;
+        disposition: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"satisfied">, import("@sinclair/typebox").TLiteral<"planned">, import("@sinclair/typebox").TLiteral<"exempt">, import("@sinclair/typebox").TLiteral<"blocked">, import("@sinclair/typebox").TLiteral<"not-applicable">]>;
+        reason: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
     }>>;
 }>;
 export declare const SecretReferenceV1Schema: import("@sinclair/typebox").TObject<{
@@ -209,6 +310,7 @@ export declare const LogicalResourceManifestV1Schema: import("@sinclair/typebox"
         logicalId: import("@sinclair/typebox").TString;
         type: import("@sinclair/typebox").TString;
         implementationAddress: import("@sinclair/typebox").TString;
+        executionAddress: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TString>;
         implementationKind: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"resource">, import("@sinclair/typebox").TLiteral<"module">, import("@sinclair/typebox").TLiteral<"data">, import("@sinclair/typebox").TLiteral<"existing">]>;
         ownership: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"existing">, import("@sinclair/typebox").TLiteral<"managed">]>;
         dependsOn: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
@@ -307,6 +409,57 @@ export declare const DiagnosisV1Schema: import("@sinclair/typebox").TObject<{
     diagnosedAt: import("@sinclair/typebox").TString;
     status: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TLiteral<"healthy">, import("@sinclair/typebox").TLiteral<"degraded">, import("@sinclair/typebox").TLiteral<"failed">, import("@sinclair/typebox").TLiteral<"unknown">]>;
     observations: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+    operationalHandoff: import("@sinclair/typebox").TOptional<import("@sinclair/typebox").TObject<{
+        owner: import("@sinclair/typebox").TString;
+        escalation: import("@sinclair/typebox").TString;
+        maintenanceWindow: import("@sinclair/typebox").TString;
+        accessPrerequisites: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+        configurationReferences: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+            name: import("@sinclair/typebox").TString;
+            source: import("@sinclair/typebox").TString;
+        }>>;
+        healthChecks: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
+            resourceId: import("@sinclair/typebox").TString;
+            check: import("@sinclair/typebox").TString;
+            expectedOutcome: import("@sinclair/typebox").TString;
+            evidenceRefs: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+        }>>;
+        monitoring: import("@sinclair/typebox").TString;
+        incidentResponse: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TObject<{
+            applicability: import("@sinclair/typebox").TLiteral<"applicable">;
+            owner: import("@sinclair/typebox").TString;
+            prerequisites: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+            steps: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+            verification: import("@sinclair/typebox").TString;
+            executionStatus: import("@sinclair/typebox").TLiteral<"untested">;
+        }>, import("@sinclair/typebox").TObject<{
+            applicability: import("@sinclair/typebox").TLiteral<"not-applicable">;
+            rationale: import("@sinclair/typebox").TString;
+        }>]>;
+        rollback: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TObject<{
+            applicability: import("@sinclair/typebox").TLiteral<"applicable">;
+            owner: import("@sinclair/typebox").TString;
+            prerequisites: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+            steps: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+            verification: import("@sinclair/typebox").TString;
+            executionStatus: import("@sinclair/typebox").TLiteral<"untested">;
+        }>, import("@sinclair/typebox").TObject<{
+            applicability: import("@sinclair/typebox").TLiteral<"not-applicable">;
+            rationale: import("@sinclair/typebox").TString;
+        }>]>;
+        recovery: import("@sinclair/typebox").TUnion<[import("@sinclair/typebox").TObject<{
+            applicability: import("@sinclair/typebox").TLiteral<"applicable">;
+            owner: import("@sinclair/typebox").TString;
+            prerequisites: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+            steps: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+            verification: import("@sinclair/typebox").TString;
+            executionStatus: import("@sinclair/typebox").TLiteral<"untested">;
+        }>, import("@sinclair/typebox").TObject<{
+            applicability: import("@sinclair/typebox").TLiteral<"not-applicable">;
+            rationale: import("@sinclair/typebox").TString;
+        }>]>;
+        limitations: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TString>;
+    }>>;
     causes: import("@sinclair/typebox").TArray<import("@sinclair/typebox").TObject<{
         id: import("@sinclair/typebox").TString;
         summary: import("@sinclair/typebox").TString;
@@ -340,6 +493,8 @@ export type WorkloadDecisionManifestV1 = Static<typeof WorkloadDecisionManifestV
 export type ArchitectureV1 = Static<typeof ArchitectureV1Schema>;
 export type CostEstimateV1 = Static<typeof CostEstimateV1Schema>;
 export type ReviewFindingsV1 = Static<typeof ReviewFindingsV1Schema>;
+export type ReviewCaptureV1 = Static<typeof ReviewCaptureV1Schema>;
+export type ReviewRequestV1 = Static<typeof ReviewRequestV1Schema>;
 export type GovernanceConstraintsV1 = Static<typeof GovernanceConstraintsV1Schema>;
 export type PolicyPropertyMapV1 = Static<typeof PolicyPropertyMapV1Schema>;
 export type EnvironmentInputsV1 = Static<typeof EnvironmentInputsV1Schema>;
@@ -352,6 +507,8 @@ export type TelemetryV1 = Static<typeof TelemetryV1Schema>;
 export type DiagnosisV1 = Static<typeof DiagnosisV1Schema>;
 export type CapabilityPackManifestV1 = Static<typeof CapabilityPackManifestV1Schema>;
 export type CustomizationLockV1 = Static<typeof CustomizationLockV1Schema>;
+export declare const GOVERNANCE_MAX_AGE_MS: number;
+export declare function isGovernanceObservationCurrent(discoveredAt: string, now: string): boolean;
 export declare function hasValidCostArithmetic(estimate: CostEstimateV1): boolean;
 export declare function hasOnlyTypedSecretReferences(inputs: EnvironmentInputsV1): boolean;
 export declare function hasValidLogicalResourceReferences(manifest: LogicalResourceManifestV1): boolean;

package/dist/targets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"targets.d.ts","sourceRoot":"","sources":["../src/targets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAWtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAE/E,eAAO,MAAM,cAAc,iRAMzB,CAAC;AACH,eAAO,MAAM,iBAAiB,6OAK5B,CAAC;AACH,eAAO,MAAM,gBAAgB,iLAAkF,CAAC;AAChH,eAAO,MAAM,cAAc,qCAAyC,CAAC;AAuBrE,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuE5C,CAAC;AAEF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;EAyBhC,CAAC;AAEF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;EA6BhC,CAAC;AAEF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAYhC,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;EAwBlC,CAAC;AAEF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;EA6BzC,CAAC;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;EAiCrC,CAAC;AAEF,eAAO,MAAM,uBAAuB;;;;;EAYnC,CAAC;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;EAqBrC,CAAC;AAEF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;EA6B3C,CAAC;AAEF,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;EAgB9B,CAAC;AAEF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiC5C,CAAC;AAEF,eAAO,MAAM,gBAAgB;;;;;;;;EAW5B,CAAC;AAEF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;EAyBjC,CAAC;AAEF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;EAyB7B,CAAC;AAEF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;EA2B7B,CAAC;AAEF,eAAO,MAAM,8BAA8B;;;;;;;;EAW1C,CAAC;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;;;EAoBrC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,MAAM,CAAC,OAAO,gCAAgC,CAAC,CAAC;AACzF,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,oBAAoB,CAAC,CAAC;AACjE,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,oBAAoB,CAAC,CAAC;AACjE,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACrE,MAAM,MAAM,uBAAuB,GAAG,MAAM,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACnF,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC3E,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC3E,MAAM,MAAM,yBAAyB,GAAG,MAAM,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACvF,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC7D,MAAM,MAAM,0BAA0B,GAAG,MAAM,CAAC,OAAO,gCAAgC,CAAC,CAAC;AACzF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,gBAAgB,CAAC,CAAC;AACzD,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACnE,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC3D,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC3D,MAAM,MAAM,wBAAwB,GAAG,MAAM,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACrF,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAI3E,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,cAAc,GAAG,OAAO,CASxE;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAIjF;AAED,wBAAgB,iCAAiC,CAAC,QAAQ,EAAE,yBAAyB,GAAG,OAAO,CAO9F;AAED,wBAAgB,8BAA8B,CAC5C,WAAW,EAAE,0BAA0B,EACvC,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,kBAAkB,GAC3B,OAAO,CAqBT"}
+{"version":3,"file":"targets.d.ts","sourceRoot":"","sources":["../src/targets.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAWtD,OAAO,KAAK,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAE/E,eAAO,MAAM,cAAc,iRAMzB,CAAC;AACH,eAAO,MAAM,iBAAiB,6OAK5B,CAAC;AACH,eAAO,MAAM,gBAAgB,iLAAkF,CAAC;AAChH,eAAO,MAAM,cAAc,qCAAyC,CAAC;AACrE,eAAO,MAAM,2BAA2B,wUAMtC,CAAC;AACH,eAAO,MAAM,2BAA2B,iPAKtC,CAAC;AAuBH,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuE5C,CAAC;AAEF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA8FhC,CAAC;AAEF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;EA6BhC,CAAC;AAEF,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6BhC,CAAC;AAEF,eAAO,MAAM,iBAAiB,qCAA6C,CAAC;AAE5E,iHAAiH;AACjH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;EA2BjC,CAAC;AAEF,mGAAmG;AACnG,eAAO,MAAM,qBAAqB;;;;;;;;;;;;EAejC,CAAC;AAEF,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgDlC,CAAC;AAEF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;EA8BzC,CAAC;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;EAqCrC,CAAC;AAEF,eAAO,MAAM,uBAAuB;;;;;EAYnC,CAAC;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;EAqBrC,CAAC;AAEF,eAAO,MAAM,+BAA+B;;;;;;;;;;;;;;;;EA8B3C,CAAC;AAEF,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;EAgB9B,CAAC;AAEF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;;;;;;;;;;;;;EAiC5C,CAAC;AAEF,eAAO,MAAM,gBAAgB;;;;;;;;EAW5B,CAAC;AAEF,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;EAyBjC,CAAC;AAEF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;EAyB7B,CAAC;AAoBF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2D7B,CAAC;AAEF,eAAO,MAAM,8BAA8B;;;;;;;;EAW1C,CAAC;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;;;EAoBrC,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG,MAAM,CAAC,OAAO,gCAAgC,CAAC,CAAC;AACzF,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,oBAAoB,CAAC,CAAC;AACjE,MAAM,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,oBAAoB,CAAC,CAAC;AACjE,MAAM,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,sBAAsB,CAAC,CAAC;AACrE,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACnE,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACnE,MAAM,MAAM,uBAAuB,GAAG,MAAM,CAAC,OAAO,6BAA6B,CAAC,CAAC;AACnF,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC3E,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAC3E,MAAM,MAAM,yBAAyB,GAAG,MAAM,CAAC,OAAO,+BAA+B,CAAC,CAAC;AACvF,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAC7D,MAAM,MAAM,0BAA0B,GAAG,MAAM,CAAC,OAAO,gCAAgC,CAAC,CAAC;AACzF,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,gBAAgB,CAAC,CAAC;AACzD,MAAM,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACnE,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC3D,MAAM,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,iBAAiB,CAAC,CAAC;AAC3D,MAAM,MAAM,wBAAwB,GAAG,MAAM,CAAC,OAAO,8BAA8B,CAAC,CAAC;AACrF,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAI3E,eAAO,MAAM,qBAAqB,QAAkB,CAAC;AAErD,wBAAgB,8BAA8B,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAoBzF;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,cAAc,GAAG,OAAO,CASxE;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAIjF;AAED,wBAAgB,iCAAiC,CAAC,QAAQ,EAAE,yBAAyB,GAAG,OAAO,CAc9F;AAED,wBAAgB,8BAA8B,CAC5C,WAAW,EAAE,0BAA0B,EACvC,OAAO,EAAE,mBAAmB,EAC5B,QAAQ,EAAE,kBAAkB,GAC3B,OAAO,CAqBT"}

package/dist/targets.js

@@ -15,6 +15,19 @@ export const DispositionSchema = Type.Union([
 ]);
 export const ConfidenceSchema = Type.Union([Type.Literal("low"), Type.Literal("medium"), Type.Literal("high")]);
 export const CurrencySchema = Type.String({ pattern: "^[A-Z]{3}$" });
+export const WellArchitectedPillarSchema = Type.Union([
+    Type.Literal("security"),
+    Type.Literal("reliability"),
+    Type.Literal("performance-efficiency"),
+    Type.Literal("cost-optimization"),
+    Type.Literal("operational-excellence"),
+]);
+export const WellArchitectedStatusSchema = Type.Union([
+    Type.Literal("aligned"),
+    Type.Literal("concern"),
+    Type.Literal("blocker"),
+    Type.Literal("not-applicable"),
+]);
 const RevisionV1Schema = Type.Object({
     number: Type.Integer({ minimum: 1 }),
     createdAt: IsoDateTimeSchema,
@@ -79,12 +92,50 @@ export const ArchitectureV1Schema = Type.Object({
     components: Type.Array(Type.Object({
         id: NonEmptyStringSchema,
         service: NonEmptyStringSchema,
+        resourceTypes: Type.Array(Type.String({ pattern: "^[A-Za-z][A-Za-z0-9]*\\.[A-Za-z][A-Za-z0-9.]*(?:/[A-Za-z][A-Za-z0-9]*)+$" }), { minItems: 1, uniqueItems: true }),
         purpose: NonEmptyStringSchema,
         requirementIds: Type.Array(NonEmptyStringSchema, { uniqueItems: true }),
         dependsOn: Type.Array(NonEmptyStringSchema, { uniqueItems: true }),
     }, { additionalProperties: false }), { minItems: 1 }),
     decisions: Type.Array(NonEmptyStringSchema),
+    decisionRecords: Type.Optional(Type.Array(Type.Object({
+        id: Type.String({ pattern: "^ADR-[0-9]{4}$" }),
+        title: Type.String({ minLength: 1, maxLength: 256 }),
+        context: Type.String({ minLength: 1, maxLength: 4096 }),
+        decision: Type.String({ minLength: 1, maxLength: 4096 }),
+        requirementIds: Type.Array(NonEmptyStringSchema, { minItems: 1, maxItems: 256, uniqueItems: true }),
+        alternatives: Type.Array(Type.Object({
+            option: Type.String({ minLength: 1, maxLength: 256 }),
+            benefits: Type.String({ minLength: 1, maxLength: 2048 }),
+            drawbacks: Type.String({ minLength: 1, maxLength: 2048 }),
+            rejectionReason: Type.String({ minLength: 1, maxLength: 2048 }),
+        }, { additionalProperties: false }), { minItems: 2, maxItems: 10 }),
+        positiveConsequences: Type.Array(NonEmptyStringSchema, { minItems: 1, maxItems: 32 }),
+        negativeConsequences: Type.Array(NonEmptyStringSchema, { minItems: 1, maxItems: 32 }),
+        wafImpacts: Type.Object({
+            security: NonEmptyStringSchema,
+            reliability: NonEmptyStringSchema,
+            "performance-efficiency": NonEmptyStringSchema,
+            "cost-optimization": NonEmptyStringSchema,
+            "operational-excellence": NonEmptyStringSchema,
+        }, { additionalProperties: false }),
+        complianceConsiderations: NonEmptyStringSchema,
+        implementationNotes: NonEmptyStringSchema,
+    }, { additionalProperties: false }), { minItems: 1, maxItems: 64 })),
     risks: Type.Array(NonEmptyStringSchema),
+    wellArchitectedAssessment: Type.Optional(Type.Object({
+        framework: Type.Literal("azure-well-architected-framework"),
+        assessmentType: Type.Literal("qualitative"),
+        pillars: Type.Array(Type.Object({
+            pillar: WellArchitectedPillarSchema,
+            status: WellArchitectedStatusSchema,
+            assessment: NonEmptyStringSchema,
+            requirementIds: Type.Array(NonEmptyStringSchema, { uniqueItems: true }),
+            evidenceRefs: Type.Array(Sha256Schema, { uniqueItems: true }),
+            recommendations: Type.Array(NonEmptyStringSchema, { uniqueItems: true }),
+            tradeoffs: Type.Array(NonEmptyStringSchema, { uniqueItems: true }),
+        }, { additionalProperties: false }), { minItems: 5, maxItems: 5 }),
+    }, { additionalProperties: false })),
 }, { $id: "https://schemas.apexops.dev/architecture-v1.json", additionalProperties: false });
 export const CostLineItemV1Schema = Type.Object({
     id: NonEmptyStringSchema,
@@ -113,10 +164,54 @@ export const CostEstimateV1Schema = Type.Object({
     runId: RunIdSchema,
     currency: CurrencySchema,
     pricingDate: Type.String({ format: "date" }),
-    lineItems: Type.Array(CostLineItemV1Schema, { minItems: 1 }),
+    pricingStatus: Type.Optional(Type.Union([Type.Literal("complete"), Type.Literal("partial")])),
+    lineItems: Type.Array(CostLineItemV1Schema),
+    unpricedItems: Type.Optional(Type.Array(Type.Object({
+        id: NonEmptyStringSchema,
+        service: NonEmptyStringSchema,
+        sku: NonEmptyStringSchema,
+        quantity: Type.Number({ exclusiveMinimum: 0 }),
+        attemptedAt: IsoDateTimeSchema,
+        reason: NonEmptyStringSchema,
+    }, { additionalProperties: false }), { minItems: 1 })),
     totalMonthlyCost: Type.Number({ minimum: 0 }),
     assumptions: Type.Array(NonEmptyStringSchema),
 }, { $id: "https://schemas.apexops.dev/cost-estimate-v1.json", additionalProperties: false });
+export const ReviewNonceSchema = Type.String({ pattern: "^[0-9a-f]{32}$" });
+/** The kernel-issued rubber-duck review request for one review task (DECISION-031), kept in the object store. */
+export const ReviewRequestV1Schema = Type.Object({
+    schemaVersion: ContractVersionSchema,
+    nonce: ReviewNonceSchema,
+    agentType: Type.Literal("rubber-duck"),
+    mode: Type.Literal("sync"),
+    gate: Type.Integer({ minimum: 1, maximum: 3 }),
+    subjectKind: NonEmptyStringSchema,
+    subjectHash: Sha256Schema,
+    attempt: Type.Integer({ minimum: 1 }),
+    maxAttempts: Type.Integer({ minimum: 1 }),
+    prompt: NonEmptyStringSchema,
+    promptSha256: Sha256Schema,
+    files: Type.Array(Type.Object({
+        label: Type.Union([Type.Literal("instructions"), Type.Literal("subject"), Type.Literal("input")]),
+        kind: NonEmptyStringSchema,
+        path: NonEmptyStringSchema,
+        sha256: Sha256Schema,
+    }, { additionalProperties: false }), { minItems: 2 }),
+}, { $id: "https://schemas.apexops.dev/review-request-v1.json", additionalProperties: false });
+/** The record the managed postToolUse hook writes for one rubber-duck task call (DECISION-031). */
+export const ReviewCaptureV1Schema = Type.Object({
+    schema: Type.Literal("apex-review-capture-v1"),
+    nonce: ReviewNonceSchema,
+    sessionId: Type.Union([Type.String(), Type.Null()]),
+    toolName: Type.String(),
+    agentType: Type.String(),
+    prompt: Type.String(),
+    requestSha256: Sha256Schema,
+    response: Type.String(),
+    responseSha256: Sha256Schema,
+    capturedAt: IsoDateTimeSchema,
+    signature: Sha256Schema,
+}, { $id: "https://schemas.apexops.dev/review-capture-v1.json", additionalProperties: false });
 export const ReviewFindingsV1Schema = Type.Object({
     schemaVersion: ContractVersionSchema,
     projectId: ProjectIdSchema,
@@ -124,6 +219,13 @@ export const ReviewFindingsV1Schema = Type.Object({
     subjectKind: NonEmptyStringSchema,
     subjectHash: Sha256Schema,
     reviewedAt: IsoDateTimeSchema,
+    capture: Type.Object({
+        reviewer: Type.Literal("rubber-duck"),
+        nonce: ReviewNonceSchema,
+        captureHash: Sha256Schema,
+        promptSha256: Sha256Schema,
+        responseSha256: Sha256Schema,
+    }, { additionalProperties: false }),
     findings: Type.Array(Type.Object({
         id: NonEmptyStringSchema,
         severity: SeveritySchema,
@@ -133,12 +235,19 @@ export const ReviewFindingsV1Schema = Type.Object({
         evidenceRefs: Type.Array(Sha256Schema, { uniqueItems: true }),
         resolution: Type.Optional(NonEmptyStringSchema),
     }, { additionalProperties: false })),
+    criteria: Type.Optional(Type.Array(Type.Object({
+        criterionId: WellArchitectedPillarSchema,
+        outcome: Type.Union([Type.Literal("pass"), Type.Literal("finding"), Type.Literal("not-applicable")]),
+        rationale: NonEmptyStringSchema,
+        findingIds: Type.Array(NonEmptyStringSchema, { uniqueItems: true }),
+    }, { additionalProperties: false }), { minItems: 5, maxItems: 5 })),
 }, { $id: "https://schemas.apexops.dev/review-findings-v1.json", additionalProperties: false });
 export const GovernanceConstraintsV1Schema = Type.Object({
     schemaVersion: ContractVersionSchema,
     projectId: ProjectIdSchema,
     runId: RunIdSchema,
     targetScope: NonEmptyStringSchema,
+    source: Type.Union([Type.Literal("collected"), Type.Literal("reference")]),
     discoveredAt: IsoDateTimeSchema,
     expiresAt: IsoDateTimeSchema,
     summary: Type.Object({
@@ -162,6 +271,8 @@ export const PolicyPropertyMapV1Schema = Type.Object({
     governanceHash: Sha256Schema,
     mappings: Type.Array(Type.Object({
         policyAssignmentId: NonEmptyStringSchema,
+        policyDefinitionId: Type.Optional(NonEmptyStringSchema),
+        policyDefinitionReferenceId: Type.Optional(NonEmptyStringSchema),
         effect: Type.Union([
             Type.Literal("deny"),
             Type.Literal("modify"),
@@ -178,7 +289,9 @@ export const PolicyPropertyMapV1Schema = Type.Object({
             Type.Literal("planned"),
             Type.Literal("exempt"),
             Type.Literal("blocked"),
+            Type.Literal("not-applicable"),
         ]),
+        reason: Type.Optional(Type.String({ minLength: 1, maxLength: 1024 })),
     }, { additionalProperties: false })),
 }, { $id: "https://schemas.apexops.dev/policy-property-map-v1.json", additionalProperties: false });
 export const SecretReferenceV1Schema = Type.Object({
@@ -213,6 +326,7 @@ export const LogicalResourceManifestV1Schema = Type.Object({
         logicalId: NonEmptyStringSchema,
         type: NonEmptyStringSchema,
         implementationAddress: NonEmptyStringSchema,
+        executionAddress: Type.Optional(NonEmptyStringSchema),
         implementationKind: Type.Union([
             Type.Literal("resource"),
             Type.Literal("module"),
@@ -314,6 +428,17 @@ export const TelemetryV1Schema = Type.Object({
     confidence: ConfidenceSchema,
     dimensions: Type.Record(NonEmptyStringSchema, Type.String()),
 }, { $id: "https://schemas.apexops.dev/telemetry-v1.json", additionalProperties: false });
+const OperationalProcedureSchema = Type.Union([
+    Type.Object({
+        applicability: Type.Literal("applicable"),
+        owner: NonEmptyStringSchema,
+        prerequisites: Type.Array(NonEmptyStringSchema, { minItems: 1, maxItems: 32 }),
+        steps: Type.Array(NonEmptyStringSchema, { minItems: 1, maxItems: 64 }),
+        verification: NonEmptyStringSchema,
+        executionStatus: Type.Literal("untested"),
+    }, { additionalProperties: false }),
+    Type.Object({ applicability: Type.Literal("not-applicable"), rationale: NonEmptyStringSchema }, { additionalProperties: false }),
+]);
 export const DiagnosisV1Schema = Type.Object({
     schemaVersion: ContractVersionSchema,
     projectId: ProjectIdSchema,
@@ -326,6 +451,24 @@ export const DiagnosisV1Schema = Type.Object({
         Type.Literal("unknown"),
     ]),
     observations: Type.Array(NonEmptyStringSchema),
+    operationalHandoff: Type.Optional(Type.Object({
+        owner: NonEmptyStringSchema,
+        escalation: NonEmptyStringSchema,
+        maintenanceWindow: NonEmptyStringSchema,
+        accessPrerequisites: Type.Array(NonEmptyStringSchema, { minItems: 1, maxItems: 32 }),
+        configurationReferences: Type.Array(Type.Object({ name: NonEmptyStringSchema, source: NonEmptyStringSchema }, { additionalProperties: false }), { maxItems: 128 }),
+        healthChecks: Type.Array(Type.Object({
+            resourceId: NonEmptyStringSchema,
+            check: NonEmptyStringSchema,
+            expectedOutcome: NonEmptyStringSchema,
+            evidenceRefs: Type.Array(Sha256Schema, { maxItems: 32, uniqueItems: true }),
+        }, { additionalProperties: false }), { minItems: 1, maxItems: 256 }),
+        monitoring: NonEmptyStringSchema,
+        incidentResponse: OperationalProcedureSchema,
+        rollback: OperationalProcedureSchema,
+        recovery: OperationalProcedureSchema,
+        limitations: Type.Array(NonEmptyStringSchema, { minItems: 1, maxItems: 64 }),
+    }, { additionalProperties: false })),
     causes: Type.Array(Type.Object({
         id: NonEmptyStringSchema,
         summary: NonEmptyStringSchema,
@@ -356,6 +499,23 @@ export const CustomizationLockV1Schema = Type.Object({
     lockedAt: IsoDateTimeSchema,
 }, { $id: "https://schemas.apexops.dev/customization-lock-v1.json", additionalProperties: false });
 const arithmeticEqual = (left, right) => Math.abs(left - right) <= 0.000001;
+export const GOVERNANCE_MAX_AGE_MS = 30 * 86_400_000;
+export function isGovernanceObservationCurrent(discoveredAt, now) {
+    for (const value of [discoveredAt, now]) {
+        if (!/^\d{4}-\d{2}-\d{2}T(?:[01]\d|2[0-3]):[0-5]\d:[0-5]\d(?:\.\d+)?(?:Z|[+-](?:[01]\d|2[0-3]):[0-5]\d)$(?![\s\S])/.test(value))
+            return false;
+        const date = value.slice(0, 10);
+        const dateValue = Date.parse(`${date}T00:00:00Z`);
+        if (!Number.isFinite(dateValue) || new Date(dateValue).toISOString().slice(0, 10) !== date)
+            return false;
+    }
+    const observed = Date.parse(discoveredAt);
+    const current = Date.parse(now);
+    return (Number.isFinite(observed) &&
+        Number.isFinite(current) &&
+        current >= observed &&
+        current - observed < GOVERNANCE_MAX_AGE_MS);
+}
 export function hasValidCostArithmetic(estimate) {
     const linesAreValid = estimate.lineItems.every((line) => arithmeticEqual(line.monthlyCost, line.quantity * line.unitPrice * line.unitsPerMonth) &&
         line.uncertainty.lowerMonthlyCost <= line.monthlyCost &&
@@ -370,7 +530,13 @@ export function hasValidLogicalResourceReferences(manifest) {
     const ids = manifest.resources.map((resource) => resource.logicalId);
     const knownIds = new Set(ids);
     return (new Set(ids).size === ids.length &&
-        manifest.resources.every((resource) => resource.dependsOn.every((id) => knownIds.has(id))));
+        manifest.resources.every((resource) => {
+            const referenceKind = manifest.track === "bicep" ? "existing" : "data";
+            const ownershipMatches = resource.ownership === "existing"
+                ? resource.implementationKind === referenceKind
+                : resource.implementationKind === "resource" || resource.implementationKind === "module";
+            return ownershipMatches && resource.dependsOn.every((id) => knownIds.has(id));
+        }));
 }
 export function hasValidPreviewApprovalBinding(attestation, preview, approval) {
     const writerAuthorityMatches = (approval.writerEpoch === preview.ownerEpoch && approval.writerTransferClaimHash === undefined) ||