@atmem/architect 0.0.0-stage → 0.2.0-alpha.4.1

package/src/WorkbenchDialogs.jsx

@@ -0,0 +1,532 @@
+import {BrainActivity} from "./BrainActivity.jsx";
+import React, { useState } from "react";
+import { Cloud, Code2, GitBranch, Plus, ShieldCheck, Sparkles, Upload } from "lucide-react";
+import { PROVIDERS, pdmTemplate, template } from "./core.mjs";
+import {
+  UPSTREAM_TEMPLATES,
+  importDiagram,
+  loadUpstreamTemplate,
+} from "./integrations.ts";
+import { importPulumiSnapshot, snapshotToProject } from "./pulumi.mjs";
+const PROVIDER_OPTIONS = [
+  ["claude-code", "Claude", "account"],
+  ["codex", "ChatGPT", "account"],
+  ["copilot", "GitHub Copilot", "account"],
+  ["gemini-cli", "Gemini", "account"],
+  ["anthropic", "Claude", "key"],
+  ["openai", "OpenAI", "key"],
+  ["gemini-api", "Gemini", "key"],
+  ["xai", "Grok", "key"],
+  ["bedrock", "Amazon Bedrock", "aws"],
+];
+const DEFAULT_MODEL = { anthropic: "claude-opus-5-5" };
+// Neutral monograms in each provider's familiar colour (no vendor logo files are bundled).
+const MONO = {
+  "claude-code": ["C", "#d97757"],
+  codex: ["G", "#10a37f"],
+  copilot: ["Co", "#24292f"],
+  "gemini-cli": ["G", "#4285f4"],
+  anthropic: ["C", "#b4583a"],
+  openai: ["O", "#0d8a6a"],
+  "gemini-api": ["G", "#1a73e8"],
+  xai: ["X", "#000000"],
+  bedrock: ["B", "#1f777c"],
+};
+export const EFFORT_LABEL = { none: "Instant", minimal: "Instant", low: "Fast", medium: "Balanced", high: "Deep", xhigh: "Deeper", max: "Max", ultra: "Ultra" };
+
+// Pick the readable foreground for each solid provider badge background.
+function badgeInk(hex){
+ const channels=hex.replace('#','').match(/../g).map(v=>parseInt(v,16)/255).map(v=>v<=.04045?v/12.92:((v+.055)/1.055)**2.4);
+ const luminance=.2126*channels[0]+.7152*channels[1]+.0722*channels[2];
+ return luminance>.179?'#000':'#fff';
+}
+
+// Check your connection: pick a provider, sign in from here if needed, check, continue.
+export function Connections({ session, connection, onCheck, onSave, onRetry, welcome = false }) {
+  const [choice, setChoice] = useState(connection?.provider || "claude-code"),
+    [model, setModel] = useState(connection?.model || "claude-opus-5-5"),
+    [key, setKey] = useState(""),
+    [state, setState] = useState("idle"),
+    [error, setError] = useState(""),
+    [list, setList] = useState([]),
+    [effort, setEffort] = useState(connection?.effort || ""),
+    [reason, setReason] = useState(""),
+    [keyStored, setKeyStored] = useState(0);
+  const kind = PROVIDER_OPTIONS.find((o) => o[0] === choice)?.[2];
+  const capability = session?.providers?.[choice];
+  const name = PROVIDER_OPTIONS.find((o) => o[0] === choice)?.[1];
+  const signedIn = capability?.signedIn;
+  // Step 1 is signing in (or a working key); only then do models appear to choose from.
+  const ready =
+    !!session &&
+    (kind === "account" ? capability?.installed && signedIn !== false : capability?.available);
+  const listed = list.find((m) => m.id === model);
+  const efforts = listed?.efforts || [];
+  const choiceNow = { provider: choice, model: model.trim(), ...(effort && efforts.includes(effort) ? { effort } : {}) };
+  // Real models and thinking levels, as the provider's own CLI reports them.
+  React.useEffect(() => {
+    if (!session) return;
+    let live = true;
+    fetch("/api/models", {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${session.token}` },
+      body: JSON.stringify({ provider: choice }),
+    })
+      .then((r) => (r.ok ? r.json() : Promise.reject(Error(r.status === 404 ? "AtMem AI Architect's helper is out of date — restart it with npm run local." : "Couldn't load models."))))
+      .then(({ models, reason }) => {
+        if (!live) return;
+        setList(models || []);
+        setReason(reason || "");
+        const keep = (models || []).find((m) => m.id === model);
+        const pick = keep || models?.[0];
+        if (pick) {
+          setModel(pick.id);
+          if (!pick.efforts?.includes(effort)) setEffort(pick.defaultEffort || pick.efforts?.[0] || "");
+        } else setModel("");
+      })
+      .catch((e) => {
+        if (!live) return;
+        setError(e.message);
+      });
+    return () => {
+      live = false;
+    };
+  }, [choice, session?.token, signedIn, capability?.available, keyStored]);
+
+  async function signIn() {
+    setError("");
+    setState("signing-in");
+    try {
+      const response = await fetch("/api/login", {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Authorization: `Bearer ${session.token}` },
+        body: JSON.stringify({ provider: choice }),
+      });
+      const result = await response.json();
+      if (!response.ok) throw Error(result.detail || "Couldn't start sign-in.");
+      if (result.url) window.open(result.url, "_blank", "noopener");
+      // Wait for the provider's page to finish; the CLI reports when it's done.
+      for (let i = 0; i < 60; i++) {
+        await new Promise((r) => setTimeout(r, 2000));
+        const latest = await onRetry();
+        if (latest?.providers?.[choice]?.signedIn) return setState("idle");
+      }
+      setState("idle");
+      setError("Sign-in didn't finish. Try again.");
+    } catch (e) {
+      setState("idle");
+      setError(e.message);
+    }
+  }
+  async function storeKey() {
+    setError("");
+    try {
+      const response = await fetch("/api/credentials", {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Authorization: `Bearer ${session.token}` },
+        body: JSON.stringify({ provider: choice, key: key.trim() }),
+      });
+      if (!response.ok) throw Error("Couldn't use that key.");
+      setKey("");
+      setKeyStored((n) => n + 1);
+      await onRetry();
+    } catch (e) {
+      setError(e.message);
+    }
+  }
+  async function check() {
+    setError("");
+    setState("checking");
+    try {
+      if (kind === "key" && key.trim()) await storeKey();
+      await onCheck(choiceNow);
+      setState("ok");
+    } catch (e) {
+      setState("idle");
+      setError(e.message);
+    }
+  }
+  const blocked =
+    !ready ||
+    !model ||
+    (kind === "account" && !capability?.installed) ||
+    (kind === "key" && !capability?.available && !key.trim()) ||
+    (kind === "aws" && !capability?.available);
+  return (
+    <div className="connect">
+      <h2>{welcome ? "Check your connection" : "Connection"}</h2>
+      {!session && (
+        <p className="error-box">
+          Looks like AtMem AI Architect's helper isn't running. Start it with <code>npm run local</code>, then{" "}
+          <button className="link" onClick={onRetry}>
+            retry
+          </button>
+          .
+        </p>
+      )}
+      <div className="provider-grid" role="radiogroup" aria-label="Provider">
+        {PROVIDER_OPTIONS.map(([id, label, how]) => {
+          const cap = session?.providers?.[id];
+          return (
+            <button
+              key={id}
+              role="radio"
+              aria-checked={choice === id}
+              aria-label={label}
+              className={`provider-tile ${choice === id ? "on" : ""}`}
+              disabled={state === "checking" || state === "signing-in"}
+              onClick={() => {
+                setChoice(id);
+                setModel(DEFAULT_MODEL[id] || "");
+                setList([]);
+                setKey("");
+                setError("");
+                setState("idle");
+              }}
+            >
+              <span className="mono" style={{ background: MONO[id][1], color:badgeInk(MONO[id][1]) }}>
+                {MONO[id][0]}
+              </span>
+              <span>
+                {label}
+                <small>{how === "account" ? (cap?.signedIn ? "Signed in" : "Sign in") : how === "key" ? "API key" : "AWS credentials"}</small>
+              </span>
+              {cap?.signedIn && (
+                <span className="signed" aria-hidden="true">
+                  ✓
+                </span>
+              )}
+            </button>
+          );
+        })}
+      </div>
+      {kind === "account" && session && (
+        <div className="signin">
+          {!capability?.installed ? (
+            <span className="warn-text">{name} app not found on this computer.</span>
+          ) : signedIn ? (
+            <span className="ok-text">✓ Signed in</span>
+          ) : state === "signing-in" ? (
+            <span className="muted">Finish signing in on the page that opened…</span>
+          ) : capability?.canSignInFromApp ? (
+            <button className="btn" onClick={signIn}>
+              Sign in to {name}
+            </button>
+          ) : (
+            <span className="muted">Sign-in is checked when you press Check.</span>
+          )}
+        </div>
+      )}
+      {kind === "key" && (
+        <label className="dialog-field">
+          API key
+          <input
+            type="password"
+            autoComplete="off"
+            aria-label="Provider API key"
+            value={key}
+            onChange={(e) => setKey(e.target.value)}
+            placeholder={capability?.available ? "Already set" : "Paste key"}
+          />
+          {key.trim() && (
+            <button type="button" className="btn ghost" onClick={storeKey}>
+              Use this key
+            </button>
+          )}
+        </label>
+      )}
+      {ready && (
+        <>
+      <label className="dialog-field">
+        Model {!list.length&&!reason&&<BrainActivity size={22}/>}
+        <select
+          aria-label="Model"
+          value={model}
+          disabled={!list.length}
+          onChange={(e) => {
+            const m = list.find((x) => x.id === e.target.value);
+            setModel(e.target.value);
+            if (!m?.efforts?.includes(effort)) setEffort(m?.defaultEffort || m?.efforts?.[0] || "");
+          }}
+        >
+          {list.length ? (
+            list.map((m) => (
+              <option key={m.id} value={m.id}>
+                {m.name}
+              </option>
+            ))
+          ) : (
+            <option value="">{!session ? "Waiting for AtMem AI Architect's helper…" : reason || "Loading your models…"}</option>
+          )}
+        </select>
+      </label>
+      {efforts.length > 0 && (
+        <div className="dialog-field">
+          Thinking
+          <div className="seg effort" role="radiogroup" aria-label="Thinking">
+            {efforts.map((e) => (
+              <button key={e} role="radio" aria-checked={effort === e} className={effort === e ? "on" : ""} onClick={() => setEffort(e)}>
+                {EFFORT_LABEL[e] || e}
+              </button>
+            ))}
+          </div>
+        </div>
+      )}
+        </>
+      )}
+      {error && (
+        <p role="status" className="error-box">
+          {error}
+        </p>
+      )}
+      {state === "ok" ? (
+        <>
+          <p className="ok-text">
+            ✓ Works — {name} · {listed?.name || model}
+            {choiceNow.effort ? ` · ${EFFORT_LABEL[choiceNow.effort] || choiceNow.effort}` : ""}
+          </p>
+          <button className="button run-button full" onClick={() => onSave(choiceNow)}>
+            Continue
+          </button>
+        </>
+      ) : (
+        <button className="button run-button full" disabled={blocked || state !== "idle"} onClick={check}>
+          {state === "checking" ? <><BrainActivity/> Checking…</> : "Check"}
+        </button>
+      )}
+    </div>
+  );
+}
+
+export function TemplateDialog({ onLoad }) {
+  return (
+    <>
+      <h2>Templates</h2>
+      <div className="section-label">Predictive maintenance · runnable</div>
+      <div className="template-list">
+        {["aws", "azure", "gcp", "ibm"].map((p) => (
+          <button key={p} onClick={() => onLoad(pdmTemplate(p))}>
+            <Sparkles size={19} />
+            <span>
+              <strong>Predictive maintenance · {PROVIDERS[p].name}</strong>
+              <small>Sensors → ML pipeline → GenAI insights → existing app</small>
+            </span>
+            <Plus size={16} />
+          </button>
+        ))}
+      </div>
+      <div className="section-label">Analytics assistant · runnable</div>
+      <div className="template-list">
+        {["aws", "azure", "gcp", "ibm"].map((p) => (
+          <button key={p} onClick={() => onLoad(template(p))}>
+            <Sparkles size={21} />
+            <span>
+              <strong>{PROVIDERS[p].name} · Predictive AI assistant</strong>
+              <small>
+                Data → model → AI → policy → response · local fixtures
+              </small>
+            </span>
+            <Plus size={16} />
+          </button>
+        ))}
+      </div>
+      <div className="section-label">OPENARCHFLOW TEMPLATES · DESIGN ONLY</div>
+      <div className="template-list">
+        {UPSTREAM_TEMPLATES.map((t) => (
+          <button key={t.id} onClick={() => onLoad(loadUpstreamTemplate(t.id))}>
+            <Cloud size={19} />
+            <span>
+              <strong>{t.name}</strong>
+              <small>{t.description}</small>
+            </span>
+            <Plus size={16} />
+          </button>
+        ))}
+      </div>
+    </>
+  );
+}
+export function ImportDialog({ onLoad, onNotify }) {
+  const [format, setFormat] = useState("mermaid"),
+    [code, setCode] = useState(
+      "flowchart LR\n  Data[Customer data]\n  Model[Prediction model]\n  Agent[AI assistant]\n  Data --> Model\n  Model --> Agent",
+    );
+  return (
+    <>
+      <div className="eyebrow">OPENARCHFLOW IMPORT ENGINE</div>
+      <h2>Bring an existing design.</h2>
+      <p>
+        Parsers are integrated from the pinned upstream. Imported blocks are
+        architecture references; they are not runnable cloud resources.
+      </p>
+      <label className="dialog-field">
+        Format
+        <select
+          aria-label="Diagram import format"
+          value={format}
+          onChange={(e) => setFormat(e.target.value)}
+        >
+          <option value="mermaid">Mermaid flowchart</option>
+          <option value="sql">SQL CREATE TABLE (basic syntax)</option>
+        </select>
+      </label>
+      <textarea
+        className="code-input"
+        aria-label="Diagram source"
+        value={code}
+        onChange={(e) => setCode(e.target.value)}
+      />
+      <button
+        className="button run-button full"
+        onClick={() => {
+          try {
+            onLoad(importDiagram(code, format));
+          } catch (error) {
+            onNotify(error.message);
+          }
+        }}
+      >
+        <Upload size={15} />
+        Import as architecture
+      </button>
+    </>
+  );
+}
+export function PulumiDialog({
+  snapshot,
+  onSnapshot,
+  onLoad,
+  onExport,
+  onNotify,
+  environment,
+}) {
+  return (
+    <>
+      <div className="eyebrow">PULUMI · PREFERRED INFRASTRUCTURE PATH</div>
+      <h2>Design ↔ managed resources.</h2>
+      <p>
+        Keep design intent and observed state separate, then review changes
+        before adopting them.
+      </p>
+      <div className="pulumi-path">
+        <span>Canvas</span>
+        <GitBranch size={18} />
+        <span>Pulumi program</span>
+        <GitBranch size={18} />
+        <span>Stack state</span>
+      </div>
+      <button className="button run-button full" onClick={onExport}>
+        <Code2 size={15} />
+        Export {environment} Pulumi scaffold
+      </button>
+      <p className="modal-fine">
+        Scaffold only: metadata components and graph dependencies.
+        Provider-specific cloud resource implementations are not generated yet.
+      </p>
+      <label className="snapshot-upload">
+        <Upload size={20} />
+        <strong>Import a Pulumi stack export</strong>
+        <small>Metadata only · inputs, outputs and secrets discarded</small>
+        <input
+          type="file"
+          accept=".json,application/json"
+          aria-label="Import Pulumi snapshot"
+          onChange={async (e) => {
+            try {
+              const file = e.target.files?.[0];
+              if (!file) return;
+              if (file.size > 10_000_000)
+                throw Error("Snapshot must be smaller than 10 MB.");
+              onSnapshot(importPulumiSnapshot(JSON.parse(await file.text())));
+            } catch (error) {
+              onNotify(error.message);
+            }
+            e.target.value = "";
+          }}
+        />
+      </label>
+      {snapshot && (
+        <div className="snapshot-result">
+          <strong>
+            {snapshot.resources.length} resource references imported
+          </strong>
+          <p>{snapshot.notice}</p>
+          <div className="snapshot-resources">
+            {snapshot.resources.slice(0, 12).map((r) => (
+              <div key={r.id}>
+                <span>{PROVIDERS[r.provider].name}</span>
+                <strong>{r.name}</strong>
+                <small>{r.type}</small>
+              </div>
+            ))}
+          </div>
+          <button
+            className="button subtle full"
+            onClick={() => {
+              try {
+                onLoad(snapshotToProject(snapshot));
+              } catch (error) {
+                onNotify(error.message);
+              }
+            }}
+          >
+            Review these references on the canvas
+          </button>
+        </div>
+      )}
+      <div className="inspector-info">
+        <ShieldCheck size={17} />
+        <span>
+          Pulumi import can generate code for existing resources. Refresh
+          updates recorded state; it does not automatically rewrite source. This
+          MVP imports snapshot metadata only. No Pulumi commands or cloud APIs
+          are executed.
+        </span>
+      </div>
+    </>
+  );
+}
+export function FrontPanel({ project, run, onSelect }) {
+  return (
+    <section className="front-panel" aria-label="Front panel">
+      {project.nodes.map((n, i) => {
+        const step = run?.steps.find((s) => s.id === n.id);
+        const o = step?.output;
+        const value = o?.measures
+          ? `${o.measures.filter((m) => m.pass).length}/${o.measures.length} ✓`
+          : o?.work_order && n.data.kind === "tool"
+            ? o.work_order.id
+            : o?.drift && n.data.kind === "monitor"
+              ? `PSI ${o.drift.psi}`
+              : o?.prediction && n.data.kind === "predict"
+                ? `${Math.round(o.prediction.failure_probability * 100)}%`
+                : o?.training && n.data.kind === "train"
+                  ? `P ${o.training.precision}`
+                  : o?.coverage !== undefined && n.data.kind === "stream"
+                    ? `${Math.round(o.coverage * 100)}%`
+                    :
+          step?.output?.churn_probability !== undefined
+            ? `${Math.round(step.output.churn_probability * 100)}%`
+            : step?.output?.assertions
+              ? `${Object.values(step.output.assertions).filter(Boolean).length} ✓`
+              : step?.status === "failed"
+                ? "✕"
+                : step
+                  ? "✓"
+                  : "—";
+        return (
+          <button
+            key={n.id}
+            onClick={() => onSelect(n.id)}
+            className={`indicator ${step?.status || ""}`}
+            title={step?.error || step?.status || "Not run"}
+          >
+            <span className="indicator-number">{i + 1}</span>
+            <strong>{value}</strong>
+            <span>{n.data.label}</span>
+          </button>
+        );
+      })}
+    </section>
+  );
+}

package/src/activity-presentation.mjs

@@ -0,0 +1,28 @@
+const toolNames={'project.read':'Read the current design','memory.lookup':'Looked up project memory','knowledge.lookup':'Looked up engineering sources','skills.lookup':'Checked engineering guidance','pricing.lookup':'Checked provider pricing evidence','pricing.aws_s3':'Checked provider pricing evidence'};
+export function publicStepText(event){
+ const names={context_started:'Reading the design context',context_ready:'Design context ready',pass_started:'Preparing the next response',model_started:'Preparing a response',model_checked:'Checked the response',response_repair:'Retrying the reply format',response_ready:'Response ready',failed:'Could not finish',cancelled:'Stopped waiting'};
+ if(event.kind==='model_message')return event.text;
+ if(event.details?.tool){const label=toolNames[event.details.tool]||'Checked supporting evidence';return (event.kind==='tool_started'?label.replace('Looked up','Looking up').replace('Checked','Checking').replace('Read the','Reading the'):label)+(event.kind==='tool_cached'?' · used a saved result':event.kind==='tool_finished'&&event.details.success===false?' · evidence unavailable':'');}
+ return names[event.kind]||event.text||'Work update recorded';
+}
+const detail=event=>[...(event.details?.recordCount!==undefined?[event.details.recordCount+' relevant memory references']:[]),...(event.details?.skillIds?.length?['Guidance: '+event.details.skillIds.join(', ')]:[])].join(' · ');
+export function architectureSteps(events){
+ const steps=[],pending=new Map();
+ for(const event of events){
+  const tool=event.details?.tool;
+  if(event.kind==='tool_started'&&tool){
+   // Without call IDs, overlapping starts are ambiguous and stay separate.
+   if(pending.has(tool))pending.set(tool,null);else pending.set(tool,steps.length);
+  }
+  if(['tool_finished','tool_cached'].includes(event.kind)&&tool&&pending.get(tool)!=null){
+   const index=pending.get(tool);steps[index]={...steps[index],text:publicStepText(event),detail:detail(event)||steps[index].detail,sources:[...steps[index].sources,event.sequence]};pending.delete(tool);continue;
+  }
+  if(['tool_finished','tool_cached'].includes(event.kind)&&tool)pending.delete(tool);
+  steps.push({id:event.sequence,text:publicStepText(event),message:event.kind==='model_message',sources:[event.sequence],...(detail(event)?{detail:detail(event)}:{})});
+ }
+ return steps;
+}
+export function architectureActivityLabel(turn,state,active){
+ const current=turn.clientStatus==='response_received'&&state==='running'?'response_ready':state;
+ return ({running:active?'Working':'Awaiting details',response_ready:'Response received',failed:'Could not finish',cancelled:'Stopped waiting',recovery_required:'Outcome unknown after restart',details_unavailable:'Some details unavailable'}[current])||({submitted:active?'Working':'Awaiting details',response_received:'Response received',failed:'Request failed',cancelled:'Stopped waiting'}[turn.clientStatus])||'Activity';
+}

package/src/ai-qualification-scenarios.mjs

@@ -0,0 +1,31 @@
+// Qualification requirements, not implemented-resource or emulator capability claims.
+const families=[
+ ['iot','AI on IoT telemetry','Analyze synthetic sensor events for anomalous device behavior. Preserve device identity, timestamps and units. Include ingestion, durable buffering, validation, inference, results and an operator alert.', ['Reject unknown device and invalid units','Duplicate events produce one result','Late and out-of-order telemetry follows an explicit policy','Disconnected input recovers by replay','Anomaly output names evidence and model version'], 'Which matters more for the first test: immediate alerts or reliable processing after a device reconnects?'],
+ ['observability','AI on logs and traces','Correlate synthetic logs and distributed traces to explain a service incident. Include collection, redaction, storage/search, an AI analysis runtime and an operator-facing answer with source evidence. Treat log text as untrusted.', ['Redact secrets before model input','Link conclusions to exact trace or log IDs','Prompt injection in a log cannot issue tool calls','Missing spans yield uncertainty rather than invented causes','Repeated ingestion preserves a consistent incident timeline'], 'Which logs and traces can we use, and which fields must never reach the model?'],
+ ['rag','Permission-aware RAG','Answer questions over a small synthetic document collection with citations. Include ingestion, retrieval, model runtime, identity enforcement and an authenticated application. Use bounded keyword retrieval for this first test and keep all source permissions.', ['Denied documents never reach the model','Known questions cite current source revisions','Unsupported questions abstain','Updates and deletions change retrieval','Revocation during generation suppresses the answer'], 'Who may read each source, and how quickly must a revoked permission take effect?'],
+ ['chatbot','Authenticated AI chatbot','Build an authenticated conversational assistant for synthetic users. Include an application, per-user conversation state, model runtime, bounded context and an escalation path. No external actions in this first test.', ['One user cannot read another conversation','Context and response sizes are bounded','Model outage produces a recoverable response','Deleting a conversation removes its stored context','Escalation retains the approved conversation context'], 'Should conversation history persist between visits, and who may inspect it?'],
+ ['version-control','AI for version control','Review a synthetic pull request from an existing repository. Retrieve only the authorized diff and relevant files, analyze it with AI, and draft review comments linked to changed lines. Preserve the existing repository. Never push, merge or execute repository code.', ['Repository and branch permissions enforced','Untrusted repository instructions cannot trigger execution','Findings link to lines in the reviewed commit','A changed head commit invalidates the review','Retry does not post duplicate comments and posting requires approval'], 'Should the first version only draft comments, or also post them after explicit approval?'],
+ ['maintenance','Predictive maintenance','Predict equipment maintenance needs from synthetic sensor histories and maintenance records. Include ingestion, feature preparation, a versioned prediction model, held-out evaluation, drift monitoring and an operator work-order draft. No automatic equipment control.', ['Time-based split prevents future-label leakage','Missing sensors produce an explicit degraded result','Prediction records include feature and model versions','Evaluate false alarms and missed faults on held-out data','Work orders require approval and are idempotent'], 'What failure are we predicting, and how much advance warning would make a prediction useful?'],
+ ['customer-support','AI customer support','Assist support staff using a synthetic ticket queue, approved knowledge and customer records from an existing CRM. Include authorized retrieval, grounded answer drafting, a staff interface and human escalation. Never issue refunds or modify customer records automatically.', ['Customer and tenant boundaries preserved','Answers cite approved knowledge','Unsupported promises escalate to staff','Sensitive customer fields excluded from model input','Approved ticket updates are idempotent and auditable'], 'Which customer information may the assistant read, and which actions must remain with a person?'],
+ ['call-center','AI call center and CRM','Assist an agent during a synthetic support call. Include consent, audio ingestion, transcription, PII redaction, grounded agent suggestions, an approved call summary and a draft update to an existing CRM. Do not place calls or write CRM records automatically.', ['No audio processed before consent','Partial and final transcripts remain ordered','Sensitive audio-derived fields are redacted before generation','Unsupported suggestions are withheld or escalated','An approved CRM update uses the final transcript and cannot duplicate on retry'], 'Are we helping a human during the call, summarizing afterwards, or both?'],
+ ['cloud-operations','AI cloud infrastructure operations','Analyze a synthetic cloud inventory and propose an infrastructure correction. Include read-only inventory, policy checks, plan generation, a reviewable diff and approval/audit controls. Detect drift. Never apply, delete resources or request broader credentials automatically.', ['Inventory credentials are read-only','Untrusted resource tags cannot trigger commands','Plans identify affected resources and costs as estimates','Drift after review invalidates approval','Apply requires separate authorization and a rollback or recovery plan'], 'Which infrastructure may we inspect, and should this stage stop at a reviewed Terraform plan?'],
+ ['cybersecurity','AI cybersecurity triage','Triage synthetic security alerts using approved logs and asset context. Include ingestion, redaction, evidence retrieval, AI triage, an analyst queue and an auditable response proposal. Do not isolate hosts, disable users or execute payloads automatically.', ['Payloads and log instructions are treated as untrusted data','Restricted security evidence stays within analyst permissions','Severity claims cite observed evidence and uncertainty','Duplicate alerts preserve the investigation audit trail','Containment requires explicit approval and reversible action planning'], 'Which response actions may we recommend, and who approves containment?'],
+];
+export const AI_QUALIFICATION_FAMILIES=families.map(([id,name,prompt,checks,question])=>({id,name,prompt,checks,question}));
+export const AI_QUALIFICATION_SCENARIOS=['aws','azure','gcp','ibm'].flatMap(provider=>AI_QUALIFICATION_FAMILIES.map(f=>({...f,id:`${provider}-${f.id}`,family:f.id,provider,prompt:`Use ${({aws:'AWS',azure:'Azure',gcp:'Google Cloud',ibm:'IBM Cloud'})[provider]} for this synthetic architecture qualification. ${f.prompt} Acceptance criteria: ${f.checks.join("; ")}. Draw the complete end-to-end architecture with concrete service choices and connected flows. Explain the first local test, distinguish mocked model behavior from actual model validation, and ask one useful missing-decision question. Do not reduce this application to storage to satisfy generator coverage. Do not invent successful deployment or approved region/account access.`})));
+
+// Bounded structural assessment only; label matching cannot qualify implementations.
+export function assessAiArchitecture(project,scenario){
+ const nodes=(project.nodes||[]).filter(n=>n.data.kind!=='note'),ids=new Set(nodes.map(n=>n.id)),edges=(project.edges||[]).filter(e=>ids.has(e.source)&&ids.has(e.target));
+ const seen=new Set(nodes.length?[nodes[0].id]:[]);let previous=-1;
+ while(previous!==seen.size){previous=seen.size;for(const e of edges)if(seen.has(e.source)||seen.has(e.target)){seen.add(e.source);seen.add(e.target);}}
+ const proposed=nodes.filter(n=>n.data.origin!=='existing'&&n.data.provider!=='tools');
+ const checks=[
+  {name:'Application contains at least three required components',passed:nodes.length>=3},
+  {name:'Required components form one connected graph',passed:nodes.length>0&&seen.size===nodes.length},
+  {name:'Proposed cloud resources retain the requested provider',passed:proposed.length>0&&proposed.every(n=>n.data.provider===scenario.provider)},
+  {name:'Proposed cloud components name concrete services',passed:proposed.length>0&&proposed.every(n=>typeof n.data.service==='string'&&n.data.service.trim().length>0)},
+  {name:'AI application has not collapsed into only object storage',passed:proposed.some(n=>!(/storage|bucket|blob|amazon s3/i.test(n.data.service||n.data.label)))},
+ ];
+ return {kind:'static-graph-checks',checks,passed:checks.every(c=>c.passed),limitations:['Connectivity and service labels do not prove a complete design, implemented integrations, model quality or deployability.'],acceptanceRequirements:scenario.checks};
+}

package/src/approval-application-files.mjs

@@ -0,0 +1,32 @@
+import {WORKFLOW_API_FILES} from './workflow-runtime-inventory.mjs';
+import sources from './runtime/invoice-sources.json' with {type:'json'};
+import {approvalProfiles} from './approval-applications.mjs';
+import {resourceAddress} from './identifiers.mjs';
+import {invoiceDependencies as workflowDependencies} from './invoice-dependencies.mjs';
+import {pythonContainer} from './python-container.mjs';
+const modules=WORKFLOW_API_FILES;
+export function approvalApplicationFiles(project,environment){
+ const files={},records=[];
+ for(const {node,profile}of approvalProfiles(project)){
+  const root='applications/'+resourceAddress(node.id)+'/';
+  for(const name of modules){if(typeof sources[name]!=='string')throw Error('Shared application runtime inventory is incomplete: '+name);files[root+name]=sources[name];}
+  files[root+'workflow_schema.sql']=sources['workflow_schema.sql'];
+  const deferred=profile.format==='approval-application-template-v1',metadata=deferred?'application-template.json':'application-profile.json';
+  files[root+metadata]=JSON.stringify(profile,null,2)+'\n';
+  files[root+'api.py']='"""Owned API entrypoint; unresolved bindings never start a runtime."""\nimport os\nfrom pathlib import Path\nfrom workflow_application import load_profile,create_native_api\nfrom workflow_bindings import load_bound_profile\n\ndef app_factory(*,connection=None,jwks=None,binding_directory=None):\n    root=Path(__file__).parent\n    profile=load_bound_profile(root/"application-template.json",binding_directory or root/"runtime-binding") if (root/"application-template.json").exists() else load_profile(root/"application-profile.json")\n    return create_native_api(profile,os.environ,connection=connection,jwks=jwks)\n';
+  if(deferred)files[root+'resolve-profile.py']='"""Resolve reviewed public output records offline; never query a cloud."""\nimport argparse\nfrom pathlib import Path\nimport sys\nsys.path.insert(0,str(Path(__file__).resolve().parent))\nfrom workflow_bindings import write_binding\nif __name__=="__main__":\n    parser=argparse.ArgumentParser();parser.add_argument("--outputs",required=True);parser.add_argument("--out",required=True);args=parser.parse_args()\n    write_binding(Path(__file__).with_name("application-template.json"),args.outputs,args.out)\n    print("Public bindings resolved structurally; cloud and operating acceptance remain unverified.")\n';
+  const runtime=workflowDependencies(profile.provider),testing=workflowDependencies(profile.provider,{tests:true});
+  files[root+'requirements.lock']=runtime.requirements;files[root+'test-requirements.lock']=testing.requirements;
+  files[root+'dependency-sources.json']=JSON.stringify({sources:runtime.sources,resolutions:runtime.resolutions},null,2)+'\n';
+  files[root+'Dockerfile']=pythonContainer('api',[...modules,'api.py'],[metadata],{web:false,contract:false,assets:['workflow_schema.sql'],concurrency:32});
+  files[root+'.dockerignore']='*\n!requirements.lock\n!'+metadata+'\n!workflow_schema.sql\n'+[...modules,'api.py'].map(name=>'!'+name+'\n').join('');
+  const pending=['Provider API/worker/database/identity resource and environment linkage','Domain processor and reviewed destination mapping with real application acceptance','Explicit SQL initialization, role/membership admission, recovery/retention and operating acceptance'];
+  if(deferred)pending.push('Resolve the public native-output references into a fresh profile/receipt bundle before runtime startup');
+  if(profile.environment!==environment)pending.push('Profile environment '+profile.environment+' differs from export environment '+environment+'; retain and reconcile this choice');
+  const record={componentId:node.id,provider:profile.provider,profileEnvironment:profile.environment,exportEnvironment:environment,path:root,apiEntrypoint:'api:app_factory',workerEntrypoint:null,bindingStatus:deferred?'unresolved':'declared',sourceStatus:'shared-api-assembly-generated',infrastructureStatus:'not_implemented',applicationStatus:'not_verified',pending,cloudOperations:false};
+  records.push(record);files[root+'assembly-status.json']=JSON.stringify(record,null,2)+'\n';
+  files[root+'BUILD.md']='# Typed approval application source\n\nRead the application profile or template and assembly-status.json. For a template, run python -I resolve-profile.py --outputs /ABSOLUTE/PUBLIC-OUTPUT-LEDGER.json --out /ABSOLUTE/FRESH-BINDING-DIRECTORY. Supply that owned directory as the runtime-binding mount; a matching receipt is required before startup. The resolver performs no cloud lookup or verification. The shared API entrypoint and exact locked runtime are emitted from this component contract. Build the API image with the included Dockerfile; do not publish/deploy without authorization.\n\nThis does not implement the domain processor or generate provider resources. Preserve all requirements and existing systems. Write the domain stage from the full brief, then use create_native_worker(profile, environment, processor, deliver) in a concrete worker entrypoint. It must retain fixed profile/role/kind/realm/destination bindings; no metadata-driven imports, no dummy processor or unconditional acceptance. Run positive/negative local end-to-end checks before recording implementation.\n\nInitialize SQL only through the reviewed operator role. Enroll approved native users using membership_key(profile, complete_verified_subject); token role claims do not grant membership. Keep API and worker credentials separate and outside source. Verify provider transport/IAM/network, image/source identity, retention/recovery and target environment independently. Schema/compilation or an importable API is not application acceptance. No work gate is cleared by these files.\n';
+ }
+ if(records.length)files['approval-applications.json']=JSON.stringify({version:1,applications:records,boundary:'Component-selected shared source and explicit pending work; no whole application, infrastructure, account or deployment acceptance'},null,2)+'\n';
+ return files;
+}