@atmem/architect 0.0.0-stage → 0.2.0-alpha.4.1

package/src/faq-lambda-build.mjs

@@ -0,0 +1,28 @@
+export function faqLambdaBuild(addresses){
+ if(!addresses.length||addresses.some(n=>!/^block_[0-9a-f]+$/.test(n)))throw Error('Invalid owned Lambda application addresses');
+ return {'build-runtime.py':`"""Build deterministic Python 3.13 / Linux x86_64 public FAQ ZIPs."""
+from pathlib import Path
+import hashlib,json,shutil,subprocess,sys,zipfile
+root=Path(__file__).resolve().parent
+receipts=[]
+for address in ${JSON.stringify(addresses)}:
+    source=root/'applications'/address;folder=root/'build'/address
+    if folder.exists():shutil.rmtree(folder)
+    folder.mkdir(parents=True)
+    subprocess.run([sys.executable,'-I','-m','pip','--isolated','install','--disable-pip-version-check','--no-compile','--only-binary=:all:','--require-hashes','--python-version','3.13','--implementation','cp','--abi','cp313','--abi','abi3','--platform','manylinux_2_34_x86_64','--platform','manylinux_2_28_x86_64','--platform','manylinux2014_x86_64','--index-url','https://pypi.org/simple','--target',str(folder),'-r',str(source/'requirements.lock')],check=True)
+    modules=['public_faq.py','public_catalog_store.py','public_faq_app.py','structured_http.py','structured_output.py','aws_json_model.py','lambda_faq.py']
+    for name in modules+['output-contract.json','faq-deployment.json']:
+        shutil.copyfile(source/name,folder/name)
+    shutil.copytree(source/'web',folder/'web')
+    archive=root/'build'/(address+'.zip')
+    with zipfile.ZipFile(archive,'w',compression=zipfile.ZIP_DEFLATED,compresslevel=9)as output:
+        for file in sorted(folder.rglob('*')):
+            if not file.is_file() or '__pycache__' in file.parts or 'bin' in file.relative_to(folder).parts:continue
+            item=zipfile.ZipInfo(file.relative_to(folder).as_posix(),date_time=(1980,1,1,0,0,0));item.create_system=3;item.external_attr=0o100644<<16;item.compress_type=zipfile.ZIP_DEFLATED
+            output.writestr(item,file.read_bytes(),compress_type=zipfile.ZIP_DEFLATED,compresslevel=9)
+    if archive.stat().st_size>50*1024*1024:raise ValueError('ZIP exceeds direct Lambda upload boundary; implement an artifact-store publication contract rather than silently changing deployment')
+    receipts.append({'component':address,'sha256':hashlib.sha256(archive.read_bytes()).hexdigest(),'target':'python3.13-linux-x86_64','sourceFiles':{str(p.relative_to(source)):hashlib.sha256(p.read_bytes()).hexdigest()for p in source.rglob('*')if p.is_file()}})
+(root/'build'/'artifact-hashes.json').write_text(json.dumps(receipts,indent=2)+'\\n')
+print(json.dumps({'status':'built','artifacts':receipts}))
+`};
+}

package/src/gcp-structured.mjs

@@ -0,0 +1,104 @@
+import {pythonContainer} from './python-container.mjs';
+import sources from './runtime/gcp-sources.json' with {type:'json'};
+import lock from './runtime/web-python-lock.json' with {type:'json'};
+import testLock from './runtime/azure-test-lock.json' with {type:'json'};
+import base from './runtime/python-container-lock.json' with {type:'json'};
+import webSource from './runtime/iap-web-source.json' with {type:'json'};
+import {STRUCTURED_WEB_HTML,STRUCTURED_WEB_CSS} from './structured-web.mjs';
+import {structuredContract} from './structured-contract.mjs';
+import {existingDeployment} from './deployment-ownership.mjs';
+import {existingReferenceFiles} from './existing-references.mjs';
+import {CLOUD_PROVIDER_LOCKS} from './cloud-provider-locks.mjs';
+
+export function gcpStructuredPlan(project,rows){
+ const entries=[];
+ for(const node of project.nodes){
+  if(node.data.provider!=='gcp'||node.data.implementation!=='gcp-structured-app'||node.data.service!=='Google Cloud Run'||existingDeployment(node))continue;
+  const contract=structuredContract(node.data.config?.outputContract);if(!contract)continue;
+  const maxInput=node.data.config?.maxInputBytes??20000,maxTokens=node.data.config?.maxOutputTokens??1024;
+  if(!Number.isInteger(maxInput)||maxInput<1||maxInput>20000||!Number.isInteger(maxTokens)||maxTokens<32||maxTokens>4096)throw Error('Google structured application limits must be 1–20000 input bytes and 32–4096 output tokens.');
+  entries.push({row:rows.find(r=>r.id===node.id),contract,maxInput,maxTokens});
+ }
+ const ids=new Set(entries.map(e=>e.row.id)),browsers=new Set(project.nodes.filter(n=>existingDeployment(n)&&n.data.provider==='tools'&&n.data.binding==='web-browser').map(n=>n.id));
+ return {entries,componentIds:[...ids],edgeIds:project.edges.filter(e=>e.integration==='browser-https'&&browsers.has(e.source)&&ids.has(e.target)).map(e=>e.id)};
+}
+const v=n=>'${var.'+n+'}',ref=(type,n,key)=>'${'+type+'.'+n+'.'+key+'}';
+export function gcpStructuredTerraform(project,plan,environment='staging'){
+ const entries=plan.gcpStructuredPlan.entries;if(!entries.length)throw Error('No Google structured application composition.');
+ const variable={review_approved:{type:'bool',default:false}},examples={review_approved:false},resource={},output={},files={},tests=[];
+ const input=(name,description,example,pattern)=>{variable[name]={type:'string',nullable:false,description,validation:{condition:'${can(regex('+JSON.stringify(pattern)+', var.'+name+'))}',error_message:'Supply the reviewed '+name+' value.'}};examples[name]=example;return v(name);};
+ const destination=input('project_id','Existing reviewed organization-owned Google Cloud project with billing. No project is recreated.','reviewed-project','^[a-z][a-z0-9-]{4,28}[a-z0-9]$');
+ const registryLocation=input('registry_location','Location of the existing Artifact Registry Docker repository.','australia-southeast1','^[a-z]+(?:-[a-z]+[0-9])?$');
+ const registry=input('registry_repository','Existing Docker repository in the selected project; no registry is recreated.','reviewed-images','^[a-z][a-z0-9-]{1,61}[a-z0-9]$');
+ const gaps=[...plan.gapDetails.map(g=>g.id),...(environment==='production'?['production-state-backup-and-operating-review-required']:[])];
+ resource.terraform_data={review_gate:{input:{design_revision:project.revision,environment},lifecycle:{precondition:[{condition:'${var.review_approved && length(local.unfinished_work) == 0}',error_message:'Review the destination, code, access, policy, costs and unresolved scope before planning deployment.'}]}}};
+ const add=(type,name,body)=>((resource[type]||={})[name]={...body,depends_on:['terraform_data.review_gate',...(body.depends_on||[])]});
+ for(const [name,service]of Object.entries({run:'run.googleapis.com',iap:'iap.googleapis.com',model:'aiplatform.googleapis.com',registry:'artifactregistry.googleapis.com'}))add('google_project_service','required_'+name,{project:destination,service,disable_on_destroy:false});
+ for(const name of ['run','iap'])add('google_project_service_identity','required_'+name,{provider:'google-beta',project:destination,service:name+'.googleapis.com',depends_on:['google_project_service.required_'+name]});
+ add('google_artifact_registry_repository_iam_member','image_pull',{project:destination,location:registryLocation,repository:registry,role:'roles/artifactregistry.reader',member:ref('google_project_service_identity','required_run','member'),depends_on:['google_project_service.required_registry']});
+ const number='${data.google_project.destination.number}';
+ for(const {row,contract,maxInput,maxTokens}of entries){
+  const n=row.address;
+  const name=input(n+'_name','Cloud Run service and dedicated runtime service-account name, kept short for the deterministic URL.','reviewed-ai-app','^[a-z][a-z0-9-]{4,28}[a-z0-9]$');
+  const region=input(n+'_region','Explicit regional application/model location. No global model fallback. Verify selected model support and quota.','australia-southeast1','^[a-z]+-[a-z]+[0-9]$');
+  if(/^[a-z]+-[a-z]+[0-9]$/.test(row.region)){variable[n+'_region'].default=row.region;examples[n+'_region']=row.region;}
+  const imageRepository=input(n+'_image_repository','Repository path for building/publishing this emitted application source.','architect/app','^[a-z0-9]+(?:[._/-][a-z0-9]+)*$');
+  const digest=input(n+'_image_digest','Digest from the built, scanned and tested emitted source, pushed with authorization to the existing registry.','sha256:'+'0'.repeat(64),'^sha256:[0-9a-f]{64}$');
+  const model=input(n+'_model_id','Reviewed compatible regional Gemini model/version; check lifecycle and quotas. No model availability or price is invented.','gemini-reviewed-version','^gemini-[a-z0-9.-]{1,80}$');
+  const group=input(n+'_access_group','Existing authorized company Google group email. IAP manages membership authorization; no group/users are created.','architect-staff@example.test','^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$');
+  const reviewName=n+'_policy_review';
+  variable[reviewName]={type:'object({ projectId = string, region = string, model = string, abuseLogging = string, approvedBy = string, evidenceSha256 = string, expiresAt = string })',nullable:false,description:'Destination owner review of actual abuse-monitoring terms/exemption, with retained evidence digest and expiry within 31 days. This is operator-attested evidence, not a fabricated provider approval API. The runtime separately reads caching/logging controls before inference.'};
+  examples[reviewName]={projectId:'reviewed-project',region:examples[n+'_region'],model:'gemini-reviewed-version',abuseLogging:'REVIEW_REQUIRED',approvedBy:'REVIEW_REQUIRED',evidenceSha256:'0'.repeat(64),expiresAt:'REPLACE_AFTER_REVIEW'};
+  const origin='https://'+name+'-'+number+'.'+region+'.run.app';
+  add('google_service_account',n,{project:destination,account_id:name,display_name:'Structured AI application runtime'});
+  add('google_project_iam_custom_role',n,{project:destination,role_id:'${replace(var.'+n+'_name, "-", "_")}_runtime',title:'Structured application model and policy reader',permissions:['aiplatform.endpoints.predict','aiplatform.cacheConfigs.get','aiplatform.endpoints.fetchPublisherModelConfig'],stage:'GA'});
+  add('google_project_iam_member',n,{project:destination,role:ref('google_project_iam_custom_role',n,'name'),member:'serviceAccount:'+ref('google_service_account',n,'email'),depends_on:['google_project_service.required_model']});
+  const settings={PROJECT_ID:destination,PROJECT_NUMBER:number,REGION:region,SERVICE_NAME:name,MODEL_ID:model,PUBLIC_ORIGIN:origin,MAX_INPUT_BYTES:String(maxInput),MAX_OUTPUT_TOKENS:String(maxTokens),OUTPUT_CONTRACT_BASE64:btoa(unescape(encodeURIComponent(JSON.stringify(contract)))),POLICY_REVIEW_BASE64:'${base64encode(jsonencode(var.'+reviewName+'))}'};
+  const image=registryLocation+'-docker.pkg.dev/'+destination+'/'+registry+'/'+imageRepository+'@'+digest;
+  add('google_cloud_run_v2_service',n,{project:destination,name,location:region,deletion_protection:true,ingress:'INGRESS_TRAFFIC_ALL',iap_enabled:true,invoker_iam_disabled:false,labels:{managed_by:'atmem-ai-architect',environment},template:{service_account:ref('google_service_account',n,'email'),timeout:'30s',max_instance_request_concurrency:5,scaling:{min_instance_count:0,max_instance_count:2},containers:{name:'application',image,ports:{container_port:8080},resources:{limits:{cpu:'1',memory:'512Mi'},cpu_idle:true,startup_cpu_boost:true},env:Object.entries(settings).map(([name,value])=>({name,value})),startup_probe:{http_get:{path:'/healthz',port:8080},initial_delay_seconds:0,period_seconds:5,timeout_seconds:2,failure_threshold:12}}},depends_on:['google_project_service.required_run','google_project_service_identity.required_iap','google_project_service_identity.required_run','google_artifact_registry_repository_iam_member.image_pull','google_project_iam_member.'+n]});
+  add('google_cloud_run_v2_service_iam_member',n,{project:destination,location:region,name:ref('google_cloud_run_v2_service',n,'name'),role:'roles/run.invoker',member:ref('google_project_service_identity','required_iap','member')});
+  add('google_iap_web_cloud_run_service_iam_member',n,{project:destination,location:region,cloud_run_service_name:ref('google_cloud_run_v2_service',n,'name'),role:'roles/iap.httpsResourceAccessor',member:'group:'+group});
+  output[n+'_url']={value:origin};
+  const folder='applications/'+n+'/';
+  for(const [path,body]of Object.entries(sources))files[folder+path]=body;
+  files[folder+'web/index.html']=STRUCTURED_WEB_HTML.replace('<button id="sign-in">Sign in</button><button id="sign-out" hidden>Sign out</button>','<button id="clear" type="button">Clear input and result</button>');
+  files[folder+'web/app.css']=STRUCTURED_WEB_CSS;files[folder+'web/app.js']=webSource;
+  files[folder+'output-contract.json']=JSON.stringify(contract,null,2);
+  files[folder+'requirements.lock']=lock.requirements;files[folder+'dependency-sources.json']=JSON.stringify(lock.sources,null,2);
+  files[folder+'test-requirements.lock']=testLock.requirements;files[folder+'test-dependency-sources.json']=JSON.stringify(testLock.sources,null,2);
+  files[folder+'container-base.json']=JSON.stringify(base,null,2);
+  files[folder+'Dockerfile']=pythonContainer('gcp_structured',['gcp_structured.py','structured_output.py','structured_http.py','policy_review.py']);
+  files[folder+'.dockerignore']='*\n!requirements.lock\n!output-contract.json\n!gcp_structured.py\n!structured_output.py\n!structured_http.py\n!policy_review.py\n!web/\n!web/*\n';
+  files[folder+'BUILD.md']=`# Generated Cloud Run application\n\nIn this directory, create an isolated Python 3.13 environment, install test-requirements.lock with --only-binary=:all: --require-hashes, then run gcp_acceptance.py -v. Tests use ephemeral signed JWTs and scripted transport fixtures. They do not contact Google Cloud.\n\nBuild this source with docker build --platform linux/amd64 --pull -t REVIEWED_LOCATION-docker.pkg.dev/REVIEWED_PROJECT/REVIEWED_REPOSITORY/REVIEWED_IMAGE:REVIEWED_BUILD . ; scan, run container startup/acceptance checks and retain source/image digests. Obtain authorization before authenticating to the existing Artifact Registry and pushing. Supply that exact registry digest as ${n}_image_digest. Terraform does not run build/publish provisioners.\n\nProvide the reviewed project/model/region and destination-owner policy evidence using ${reviewName}; the supplied example is intentionally unapproved. Runtime verifies its scope/expiry, reads disabled project caching and model logging/sharing settings, and blocks before inference if any check is unknown. The owner review covers abuse-monitoring terms/exemption that this application cannot discover through a reliable API. It is an attestation, not independent proof of approval. The application never modifies those project/account-wide controls.\n`;
+  tests.push(`run "${n}_identity" {\n command = plan\n assert {\n condition = google_cloud_run_v2_service.${n}.iap_enabled && !google_cloud_run_v2_service.${n}.invoker_iam_disabled\n error_message = "IAP and Cloud Run IAM must remain enabled."\n }\n assert {\n condition = google_cloud_run_v2_service_iam_member.${n}.member == google_project_service_identity.required_iap.member && google_iap_web_cloud_run_service_iam_member.${n}.member == "group:\${var.${n}_access_group}"\n error_message = "Only the IAP agent invokes the service; only the reviewed group receives IAP access."\n }\n assert {\n condition = length(google_project_iam_custom_role.${n}.permissions) == 3 && !contains(google_project_iam_custom_role.${n}.permissions, "aiplatform.endpoints.setPublisherModelConfig")\n error_message = "Runtime must not modify project/account-wide model policy."\n }\n}\nrun "${n}_reject_mutable_image" {\n command = plan\n variables { ${n}_image_digest = "latest" }\n expect_failures = [var.${n}_image_digest]\n}`);
+ }
+ const config={terraform:{required_version:'>= 1.17.1, < 2.0.0',required_providers:{google:{source:'hashicorp/google',version:'7.46.2'},'google-beta':{source:'hashicorp/google-beta',version:'7.46.2'}}},provider:{google:{project:destination},'google-beta':{project:destination}},data:{google_project:{destination:{project_id:destination}}},variable,locals:{unfinished_work:gaps},resource,output};
+ const values=Object.entries({...examples,review_approved:true}).map(([k,value])=>k+' = '+JSON.stringify(value)).join('\n');
+ return {...files,...existingReferenceFiles(project),'.terraform.lock.hcl':CLOUD_PROVIDER_LOCKS.gcp+'\n'+CLOUD_PROVIDER_LOCKS.gcpBeta,'main.tf.json':JSON.stringify(config,null,2),'resource-schedule.json':JSON.stringify(plan,null,2),'deployment.tfvars.json.example':JSON.stringify(examples,null,2),'.gitignore':'.terraform/\n*.tfstate*\n*.tfplan\n*.tfvars\n*.tfvars.json\n!deployment.tfvars.json.example\n.venv/\n__pycache__/\n','tests/gcp-structured.tftest.hcl':`mock_provider "google" {\n override_during = plan\n mock_data "google_project" { defaults = { number = "123456789012" } }\n mock_resource "google_service_account" { defaults = { email = "runtime@reviewed-project.iam.gserviceaccount.com" } }\n}\nmock_provider "google-beta" {\n override_during = plan\n mock_resource "google_project_service_identity" { defaults = { email = "service-123456789012@gcp-sa-iap.iam.gserviceaccount.com", member = "serviceAccount:service-123456789012@gcp-sa-iap.iam.gserviceaccount.com" } }\n}\nvariables {\n${values}\n}\n${tests.join('\n')}\nrun "unapproved_blocked" {\n command = plan\n variables { review_approved = false }\n expect_failures = [terraform_data.review_gate]\n}\n`,'README.md':GCP_STRUCTURED_GUIDE};
+}
+
+export const GCP_STRUCTURED_GUIDE=`# Google Cloud structured AI application
+
+An explicit gcp-structured-app block composes a Cloud Run browser/API, dedicated keyless runtime service account, narrow project-level model/policy-read role, IAP service identity and company-group access. The Google beta provider is used only for generating Google-managed IAP/Cloud Run service identities; these identities cannot be destroyed through that resource. Existing projects, groups and Artifact Registry repositories are preserved. Required APIs are enabled but never disabled on destroy. Unrelated services/connections remain gaps.
+
+IAP is enabled directly on Cloud Run with IAM checks retained. Only its service agent receives the emitted run.invoker grant. The existing company group receives IAP access; no allUsers/allAuthenticatedUsers grant is emitted. Use an organization-owned project with the Google-managed OAuth client; first-time nonorganization/external-identity OAuth flows require a separately reviewed configuration. Reconcile inherited IAM permissions and organizational policies in the real account.
+
+The app verifies every non-health request using the signed ES256 IAP JWT, fixed Google key endpoint, exact service audience, issuer, lifetime and user identity. Unsigned identity headers, a caller Authorization header and service-account identities grant no application access. API requests additionally require the exact same-origin browser Origin. The deterministic run.app URL is used deliberately; the service name stays short enough for its DNS limit. Do not use the alternate hashed URL for this browser without updating the reviewed origin contract. IAP membership/organization session policy is the authorization boundary. This is not a continuous directory check or proof of MFA/revocation behavior; issued IAP headers remain valid until expiry/skew. The browser clears input/result without claiming to sign out of the company session.
+
+Workload tokens come only from Cloud Run's fixed metadata endpoint with Metadata-Flavor verification, no inherited proxy/netrc configuration, redirects or static key file. A custom role admits prediction and read-only cache/model-policy queries in the selected project. It is project-scoped, not an invented per-publisher-model IAM restriction. The application selects only the reviewed regional Gemini model. Only the Cloud Run platform agent receives reader access on the exact existing image repository.
+
+No application input/result is persisted. Before inference, a scoped, expiring destination-owner review must cover actual abuse-monitoring terms/exemption, with retained evidence digest. This is operator-attested evidence, not a provider approval API. Runtime separately reads disabled project caching and disabled model request/response logging and sharing. Unknown/denied controls stop inference. A documented model-policy 404 NOT_FOUND indicates default disabled configuration; other failures do not. The global project caching read uses Google's documented us-central1 control endpoint, sends no ticket input and never changes settings. Review that metadata location, IAP/global identity processing, actual model geography/availability and provider terms against residency requirements. The app does not claim universal zero retention. No tools, grounding, cachedContent or stateful interactions API is used.
+
+Build/scan/test emitted applications/* source and the pinned Linux/amd64 image, then obtain authorization to publish to the existing Artifact Registry. Supply the exact image digest and reviewed destination/model/group/policy inputs. The example policy is intentionally unapproved. Protect Terraform state and private variable files. Terraform never builds, publishes, executes a provisioner or authorizes its own policy changes.
+
+Use Terraform 1.17.1 or newer (the locally qualified CLI; tests use plan-time mock values). Run terraform init -backend=false, terraform validate and terraform test. Mock plans inspect configuration, not Google account behavior. Run real IAP sign-in/group/expiry tests, metadata identity exchange, policy/model-quality tests, image startup/scan, authorized account plan and operational review before deployment. Scaling/concurrency and token bounds are not invoice caps or availability/latency SLAs. Production remains blocked pending state, backup and operations review. No export proves deployment.
+
+References:
+- https://docs.cloud.google.com/run/docs/securing/identity-aware-proxy-cloud-run
+- https://docs.cloud.google.com/iap/docs/signed-headers-howto
+- https://docs.cloud.google.com/run/docs/securing/service-identity
+- https://docs.cloud.google.com/run/docs/triggering/https-request
+- https://docs.cloud.google.com/gemini-enterprise-agent-platform/resources/zero-data-retention
+- https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/capabilities/request-response-logging
+- https://registry.terraform.io/providers/hashicorp/google/7.46.2/docs/resources/cloud_run_v2_service
+`;

package/src/generation-provider.mjs

@@ -0,0 +1,7 @@
+import {existingDeployment} from './deployment-ownership.mjs';
+// Select from explicit deployment ownership, never from a default cloud.
+export function generationProviders(project){
+ const deployed=project.nodes.filter(n=>n.data.kind!=='note'&&!existingDeployment(n)&&n.data.provider!=='tools').map(n=>n.data.provider);
+ return [...new Set(deployed.length?deployed:project.provider&&project.provider!=='tools'?[project.provider]:[])].sort();
+}
+export function isAwsGeneration(project){const p=generationProviders(project);return p.length===1&&p[0]==='aws';}

package/src/generation-quality.mjs

@@ -0,0 +1,69 @@
+import {inspectContainerConfiguration} from './container-inspection.mjs';
+import {inspectStateCustody} from './state-inspection.mjs';
+import {inspectOwnership,ownershipInventory} from './ownership-inspection.mjs';
+import {inspectTerraformModules} from './terraform-admission.mjs';
+import {existingDeployment} from './deployment-ownership.mjs';
+import catalogue from '../agent-skills/generation-capabilities.json' with {type:'json'};
+import skillDigests from '../agent-skills/specialists/manifest.json' with {type:'json'};
+import lifecycle from '../agent-skills/service-lifecycle.json' with {type:'json'};
+import {generationProviders} from './generation-provider.mjs';
+import {artifactWorkProjection} from './artifact-work.mjs';
+export function generationQuality(project,plan,files,{environment='staging'}={}){
+ const config=JSON.parse(files['main.tf.json']);
+ const providers=generationProviders(project),findings=[];
+ const add=(code,message,componentId)=>findings.push({code,message,...(componentId?{componentId}:{})});
+ inspectStateCustody(project,plan,files,config,environment,add);
+ const sources={aws:'hashicorp/aws',azurerm:'hashicorp/azurerm',azuread:'hashicorp/azuread',azapi:'azure/azapi',google:'hashicorp/google','google-beta':'hashicorp/google-beta',ibm:'ibm-cloud/ibm'};
+ const admission=inspectTerraformModules(project,plan,files,config,add);
+ inspectOwnership(project,admission.configs,add);
+ if(files['deployment-ownership.json']!==undefined){
+  const stable=value=>JSON.stringify(value,(_,v)=>v&&typeof v==='object'&&!Array.isArray(v)?Object.fromEntries(Object.keys(v).sort().map(k=>[k,v[k]])):v);
+  try{if(stable(JSON.parse(files['deployment-ownership.json']))!==stable(ownershipInventory(project,admission.configs)))add('ownership-inventory-mismatch','The ownership inventory changed actual project provenance, disposition, managed addresses or unverified authorization.');}catch{add('ownership-inventory-mismatch','The ownership inventory is invalid.');}
+ }
+ const prefixes={aws:'aws_',azure:'azurerm_',gcp:'google_',ibm:'ibm_'},emitted=[];
+ for(const scope of admission.configs){
+  const current=scope.config;
+  for(const [name,body]of Object.entries(current.terraform?.required_providers||{}))if(sources[name]!==String(body.source||'').toLowerCase())add('unreviewed-provider',`Provider ${name} in ${scope.path||'root'} is not the reviewed official provider source.`);
+  for(const [name,values]of Object.entries(current.provider||{}))for(const body of Array.isArray(values)?values:[values])for(const key of ['access_key','secret_key','token','client_secret','credentials','ibmcloud_api_key'])if(body?.[key])add('embedded-provider-credential',`Provider ${name} in ${scope.path||'root'} contains ${key}; use the operator credential chain.`);
+  for(const [type,items]of Object.entries(current.resource||{}))for(const [name,body]of Object.entries(items))if(body?.provisioner)add('execution-hook',`${scope.prefix}${type}.${name} contains an unreviewed provisioner.`);
+  if(current.data?.external||current.data?.terraform_remote_state)add('external-execution-or-state','External execution and remote-state readers require a separately reviewed adapter.');
+  for(const rule of lifecycle.rules)if(!rule.newCustomerDefaultAllowed&&rule.resourceTypes.some(type=>Object.keys(current.resource?.[type]||{}).length))add('service-eligibility-unverified',`${rule.id}: ${rule.requiredEvidence} Source: ${rule.source.url}`);
+  for(const [type,items]of Object.entries(current.resource||{}).filter(([type])=>type!=='terraform_data')){
+   emitted.push([scope.prefix+type,items]);const owner=/^(azuread_|azapi_)/.test(type)?'azure':Object.keys(prefixes).find(p=>type.startsWith(prefixes[p]));
+   if(!owner||!providers.includes(owner)||scope.provider&&scope.provider!==owner)add('provider-mismatch',`Resource ${scope.prefix}${type} does not match its requested deployment provider.`);
+  }
+ }
+ for(const node of project.nodes.filter(n=>n.data.kind!=='note'))if(plan.rows.filter(r=>r.id===node.id).length!==1)add('unregistered-implementation','The resource schedule must retain each component identity exactly once.',node.id);
+ const components=plan.rows.map(row=>{
+  const node=project.nodes.find(n=>n.id===row.id),d=node?.data||{},scope=admission.scopes.get(row.id),actual=scope?.config||(admission.composed?{}:config),prefix=scope?.prefix||'';
+  if(d.implementation==='approval-workflow'){
+   add('application-resource-linkage-required','The approval API source is partial assembly; provider resources, worker/domain behavior and operating acceptance remain required.',row.id);
+   if(row.implemented)add('unregistered-implementation','Shared approval source cannot be presented as completed infrastructure.',row.id);
+  }
+  if(node&&!existingDeployment(node)&&d.provider==='aws'&&d.implementation==='invoice-workflow'&&/^(cn-|us-gov-)/.test(d.config?.region||'')){
+   add('partition-implementation-required','The requested invoice partition is retained, but its complete ARN/registry/model policy is not implemented by the commercial adapter.',row.id);
+   const blocker=(scope?scope.module+':':'')+'invoice-config-region';
+   if(!config.locals?.unfinished_work?.includes(blocker))add('missing-work-gate','The unsupported invoice partition lost its component-owned implementation blocker.',row.id);
+  }
+  if(node)inspectContainerConfiguration(node,row,actual,plan,add,{root:config,scope});
+  if(!node||row.provider!==d.provider||!!row.existing!==!!(node&&existingDeployment(node)))add('unregistered-implementation','The schedule changed a component provider or ownership identity.',row.id);
+  const contracts=catalogue.contracts.filter(c=>c.provider===d.provider&&(!c.service||c.service===row.service)&&(!c.implementation||c.implementation===d.implementation));
+  if(!row.existing&&row.implemented){
+   if(!contracts.length)add('unregistered-implementation',`No reviewed compiler contract matches the claimed implementation for ${row.label}.`,row.id);
+   for(const c of contracts){
+    for(const type of c.resources)if(!actual.resource?.[type]?.[row.address])add('missing-resource',`Compiler claims ${c.id} for ${row.label}, but ${prefix}${type}.${row.address} is absent.`,row.id);
+    for(const instance of c.resourceInstances||[]){const name=row.address+instance.suffix;if(!actual.resource?.[instance.type]?.[name])add('missing-resource',`Compiler claims ${c.id} for ${row.label}, but required deployment unit ${prefix}${instance.type}.${name} is absent.`,row.id);}
+   }
+  }
+  return {id:row.id,...(scope?{terraformModule:scope.module}:{}),provider:row.provider,ownership:row.existing?'existing':'proposed',contracts:contracts.map(c=>c.id),coverage:row.existing?'reference_or_external_contract':row.implemented?'generated_unverified':'implementation_required'};
+ });
+ for(const row of plan.rows.filter(r=>!r.implemented))add('implementation-required',`${row.label}: implementation remains required.`,row.id);
+ for(const edge of plan.connections.filter(e=>!e.generated))add('connection-required',`Connection ${edge.id} has no generated integration.`);
+ const unfinished=config.locals?.unfinished_work||[];
+ if(!Array.isArray(unfinished))add('missing-work-gate','Unfinished scope must remain an explicit array of blockers.');
+ for(const gap of plan.gapDetails||[]){add('unfinished-scope',gap.message);if(!Array.isArray(unfinished)||!unfinished.includes(gap.id))add('missing-work-gate','The root configuration omits required unfinished scope: '+gap.id+'.');}
+ const skills=[...new Set([...catalogue.skills,...providers])].filter(id=>skillDigests[id]).map(id=>({id,sha256:skillDigests[id]}));
+ const fatalCodes=new Set(['ownership-inventory-mismatch','ownership-transition-unreviewed','existing-resource-managed','state-custody-mismatch','container-constraint-mismatch','provider-mismatch','missing-resource','unreviewed-provider','embedded-provider-credential','execution-hook','external-execution-or-state','unreviewed-module','unregistered-implementation','service-eligibility-unverified','missing-work-gate']);
+ const artifactMappings=artifactWorkProjection(project);
+ return {version:1,modules:[...admission.scopes].map(([id,scope])=>({id,module:scope.module,path:scope.path})),fatalFindings:findings.filter(f=>fatalCodes.has(f.code)),designRevision:project.revision,catalogueVersion:catalogue.version,providers,skills,skillUsage:"Referenced reviewed guidance; model execution of skills is not attested by this export.",components,findings,artifactMappings:{file:'architecture-artifact-mappings.json',references:artifactMappings.mappings.map(m=>({id:m.id,artifactId:m.artifactId,artifactSha256:m.artifactSha256,contextStatus:m.contextStatus,recordIds:m.records.map(r=>r.id)})),boundary:artifactMappings.boundary},infrastructureComplete:findings.length===0&&unfinished.length===0&&emitted.length>0,validation:{schema:'not_run',runtime:'not_run',cloudPlan:'not_run'},deploymentCandidate:false,evidenceBoundary:catalogue.evidenceBoundary};
+}

package/src/handoff.mjs

@@ -0,0 +1,141 @@
+// Derived engineering evidence. Presence of prose is not implementation or approval.
+import {resourcePlan} from './resources.mjs';
+import {estimate} from './estimate.mjs';
+import {review} from './review.mjs';
+import {requirementNumber} from './derive.mjs';
+export const handoffKey=value=>Array.from(new TextEncoder().encode(String(value)),v=>v.toString(16).padStart(2,'0')).join('');
+const resourceTask=id=>`TASK-RESOURCE-${handoffKey(id)}`;
+
+const PROFILES = {
+ 'Amazon S3': [
+  'Agree object ownership, retention/deletion, lifecycle and encryption/key policy; distinguish source data from Terraform state and build artifacts.',
+  'Add least-privilege bucket access and transport policy; test denied access, version recovery and deletion behavior.'
+ ],
+ 'AWS Lambda': [
+  'Specify runtime, entry point, immutable package/image, memory, timeout and concurrency; identify the trigger and its invocation permissions.',
+  'Define execution IAM, network egress, secret references and log retention; implement retries, idempotency, checkpoints and dead-letter handling where asynchronous.',
+  'Test representative payload sizes, duplicate events, throttling and downstream failures; measure cold and warm execution where latency matters.'
+ ],
+ 'Amazon OpenSearch': [
+  'Choose a provisioned domain or Serverless explicitly; select lexical, vector or hybrid retrieval before creating resources.',
+  'Define index mappings, document/version IDs, ACL and region filters, deletion propagation and reindexing; for vectors select embedding model and dimensions.',
+  'Specify encryption, network and data-access policies, capacity and recovery; prove filtered retrieval excludes unauthorized titles, snippets and documents.'
+ ],
+ 'Amazon OpenSearch Serverless': [
+  'Specify collection type, encryption, network and data-access policies, private connectivity and capacity limits.',
+  'Define index mappings and creation ownership; for vector search select embedding model/dimensions and query strategy.',
+  'Test permissions, document deletion, capacity, reindex/recovery and source ACL freshness.'
+ ],
+ 'Amazon OpenSearch domain': [
+  'Specify engine version, node/storage sizing, availability layout, encryption, private connectivity and fine-grained access.',
+  'Define index mappings, snapshot/restore, upgrades and capacity; for vectors select embedding model and dimensions.',
+  'Test recovery, document deletion and ACL/region-filtered retrieval under the agreed workload.'
+ ],
+ 'Amazon Bedrock': [
+  'Select exact generation and, if needed, embedding model IDs, invocation API and inference mode; verify account access, regional availability and quotas with dated evidence.',
+  'Map every inference destination to the agreed processing boundary; a regional endpoint or APAC profile does not by itself establish country-only processing.',
+  'Implement scoped invocation IAM, token/time limits, retries and budget controls; keep source authorization before model invocation.',
+  'Define prompt-injection handling, authorized citations, insufficient-evidence responses and output checks; test these separately from model guardrails.'
+ ],
+ 'Amazon Bedrock Guardrails': [
+  'Select supported policies, thresholds and a versioned guardrail; specify input/output invocation and behavior when checks fail or are unavailable.',
+  'Evaluate false positives, bypasses and restricted content with fixtures; guardrails do not substitute for source ACL enforcement.'
+ ],
+ 'Amazon Bedrock Knowledge Bases': [
+  'Select the embedding model, backing store, data sources, chunking, synchronization and service roles explicitly.',
+  'Verify connector support for source ACLs, deletions and freshness; implement missing permission enforcement before retrieval.',
+  'Test sync failures, reindexing, authorized citations and country boundaries for ingestion, embeddings and generation.'
+ ],
+ 'AWS App Runner': [
+  'Verify account eligibility before retaining App Runner; it is closed to new customers. Record the hosting decision and current official availability evidence.',
+  'Specify one deployment unit per actual application, immutable image, registry access, instance role, ingress/egress, health checks and scaling.',
+  'Design identity sessions, secrets, custom domain/TLS, logs and rollback; test deployment health and source dependency failures.'
+ ],
+ 'Amazon ECS': [
+  'Choose explicit ECS/Fargate resources or a reviewed managed deployment mode; define the task image, execution/task roles and secret references.',
+  'Specify subnets, security groups, ingress/load balancing, egress, health checks, scaling and deployment rollback.',
+  'Measure resource limits and request latency; test unhealthy deployments, dependency failures and recovery.'
+ ],
+ 'Amazon DynamoDB': [
+  'Define partition/sort keys and access patterns, capacity mode, indexes, encryption, point-in-time recovery and deletion protection.',
+  'Specify conditional writes, idempotency, TTL semantics and retention; test contention, throttling and restoration.'
+ ],
+ 'Amazon SQS': [
+  'Choose standard/FIFO semantics, encryption, queue policy, retention, visibility timeout and dead-letter/redrive settings.',
+  'Define producer/consumer IAM and retries; prove duplicate processing is safe and poison messages can be recovered.'
+ ],
+ 'Amazon CloudWatch': [
+  'Define structured redacted logs, retention, metrics, alarms, dashboards and alert ownership for each component.',
+  'Test ingestion failure, denied access and latency alarms; verify sensitive prompts, source text and credentials are excluded.'
+ ],
+};
+export function engineeringSteps(row) {
+ if(row.containerContract)return [`Review terraform/main.tf.json resource ${row.containerContract.type}.${row.address} and the associated variables in deployment.tfvars.json.example.`, `Build the supplied application image, pin ${row.address}_image to its SHA-256 digest, and verify it listens on port 8080; infrastructure does not establish application behavior.`, 'Run terraform validate and terraform test using tests/container.tftest.hcl; review private ingress, runtime identity, registry access, platform prerequisites and destination-specific startup/rollback tests before applying.'];
+ if(row.externalReference)return ['Preserve the external browser; no resource or import is required.','Define and test its HTTPS/application interactions, including denied access and unavailable service behavior.'];
+ if(row.existingServiceReference)return ['Preserve this externally managed service without creating or importing it.','Document its owner, endpoint, identity and integration contract; test actual connections separately.'];
+ if(row.reference)return ['Bind the required Terraform ARN input to a reviewed existing same-account IAM role or user; never recreate the identity.','Verify scoped bucket/object permissions, effective boundaries and organization policies, versioned reads and denied access; the generated grant is not account-access evidence.'];
+ if(row.existing)return [
+  'Identify system owner, tenant/location, supported APIs and permitted read scopes; document a reference contract instead of recreating the system.',
+  'Specify identity mapping, source permissions, pagination/rate limits, update/delete events and maximum synchronization lag.',
+  'Define credential rotation, outages and recovery; test revoked access and unavailable sources using approved fixtures before live integration.'
+ ];
+ return PROFILES[row.service] || [
+  `Confirm the exact ${row.provider} service, deployment mode, region and supported resource types using current primary documentation.`,
+  'Specify runtime/artifact, identity, network paths, secrets, capacity, health checks and operational owner; resolve whether this is infrastructure or a responsibility within another application.',
+  'Document service-specific failure modes, retention/recovery and acceptance tests; do not substitute a similarly named service or another provider.'
+ ];
+}
+
+export function handoffAssessment(project, now = new Date()) {
+ const resources=resourcePlan(project), decisions=(project.decisions||[]).filter(d=>d.status==='Accepted'), needs=project.needs||[], findings=[];
+ const add=(id,priority,area,message,action,taskIds=['TASK-SCOPE'],componentIds=[],requirementIds=[])=>findings.push({id,priority,area,message,action,taskIds,componentIds,requirementIds,status:'open'});
+ const costs=estimate(project,now);
+ if(costs.gaps.length)add('cost-coverage',2,'cost',`${costs.gaps.length} cost worksheet gaps remain; unpriced resources are not free.`,'Complete usage assumptions and dated regional price sources; reconcile all billable dimensions with the reviewed plan.',['TASK-COST-BASELINE','TASK-COST']);
+ if(!(project.facts||[]).some(f=>f.name==='budget.per_month')&&!needs.some(r=>r.category==='cost'))add('budget-target',2,'cost','No budget constraint is recorded.','Agree a budget or explicitly document that no budget limit was specified; do not invent a price target.',['TASK-COST-BASELINE']);
+ for(const f of review(project).filter(f=>f.status==='open'&&['blocker','major'].includes(f.severity)))add(`review-${handoffKey(f.key)}`,f.severity==='blocker'?1:2,'security',f.statement,f.action,['TASK-SECURITY-DESIGN','TASK-SECURITY'],f.components);
+ const regionDecisions=decisions.filter(d=>d.subject==='cloud.region').map(d=>String(d.decision||'').trim());
+ if(new Set(regionDecisions).size>1)add('region-decisions-conflict',1,'placement','Multiple accepted deployment-region decisions disagree.','Resolve or supersede conflicting decisions explicitly; do not choose the most convenient value.');
+ const agreed=subject=>decisions.some(d=>d.subject===subject&&String(d.decision||'').trim());
+ if(!project.brief?.application?.trim())add('scope-outcome',1,'scope','No structured application outcome is recorded.','Confirm a concise outcome, intended users and exclusions; raw conversation fragments are not an implementation brief.');
+ if(!(project.useCases||[]).length)add('scope-boundary',1,'scope','No explicit scope boundary is recorded.','Record included and excluded use cases before sizing or implementation.');
+ if(!resources.rows.length)add('architecture-empty',1,'architecture','No deployable or existing components are described.','Define the components and interactions; an empty Terraform configuration is not a deployment.');
+ if(resources.rows.some(r=>r.provider!=='tools'))for(const [subject,label]of [['platform.cloud','cloud provider'],['data.country','data country and processing boundary'],['cloud.region','deployment region']])if(!agreed(subject))add(`decision-${subject}`,1,'placement',`The ${label} is not independently confirmed.`,`Record an explicit ${subject} decision. Proposed diagram placement is not approval.`);
+ for(const row of resources.rows){
+  const task=[resourceTask(row.id)], ids=[row.id], key=handoffKey(row.id);
+  if(!row.existing&&regionDecisions.length===1&&regionDecisions[0]!==row.region&&!/proposed|to be|unknown|confirm|select|tbd/i.test(row.region))add(`region-conflict-${key}`,1,'placement',`${row.label}: diagram placement differs from the accepted region decision.`,'Confirm whether this is intentional multi-region placement or stale design data; reconcile without silently overriding either source.',task,ids);
+  if(row.selection==='Ambiguous service names')add(`service-ambiguous-${key}`,1,'architecture',`${row.label}: multiple service names match.`, 'Set an explicit service; do not generate infrastructure from this label.',task,ids);
+  if(row.service==='Amazon OpenSearch')add(`search-mode-${key}`,1,'architecture',`${row.label}: OpenSearch deployment mode is unresolved.`,'Choose domain or Serverless and the retrieval/index design before generating resource types.',task,ids);
+  if(!row.existing && /proposed|to be|unknown|confirm|select|tbd/i.test(row.region))add(`placement-${key}`,2,'placement',`${row.label}: placement is unresolved.`,'Verify service/model availability and record the chosen region without silently replacing proposed placement.',task,ids);
+  if(!row.existing && !row.implemented)add(`implementation-${key}`,2,'implementation',`${row.label}: native infrastructure/application implementation is absent.`,engineeringSteps(row)[0],task,ids);
+  if(row.reference)add(`existing-${key}`,2,'integration',`${row.label}: ARN input and bucket-scoped access policy are generated; account-specific verification remains.`,'Supply the existing same-account role/user ARN; verify effective IAM permissions, organization controls and positive/negative runtime access. No identity is created or modified.',task,ids);
+  else if(row.existing)add(`existing-${key}`,2,'integration',`${row.label}: existing-system contract and access are unverified.`,engineeringSteps(row)[0],task,ids);
+ }
+ const appRunner=resources.rows.filter(r=>r.service==='AWS App Runner'&&!r.existing);
+ if(appRunner.length)add('service-lifecycle-apprunner',1,'availability','App Runner eligibility needs verification.','AWS closed App Runner to new customers. Verify existing-customer eligibility or agree an alternative. Source: https://docs.aws.amazon.com/apprunner/latest/dg/apprunner-availability-change.html (reviewed 2026-11-07).',appRunner.map(r=>resourceTask(r.id)),appRunner.map(r=>r.id));
+ const apps=resources.rows.filter(r=>['AWS App Runner','Amazon ECS'].includes(r.service));
+ if(apps.length>1)add('deployment-unit-mapping',1,'architecture','Multiple application blocks may represent shared responsibilities.','Map logical blocks to physical deployment units. Preserve accepted consolidation decisions; do not create one service per diagram block automatically.',apps.map(r=>resourceTask(r.id)),apps.map(r=>r.id));
+ if(!needs.length)add('requirements-empty',1,'acceptance','No acceptance requirements are recorded.','Agree observable behavior and success criteria before declaring the handoff implementation-ready.');
+ for(const r of needs){
+  const number=requirementNumber(project,r.id),task=[`TASK-ACCEPTANCE-${handoffKey(r.id)}`],key=handoffKey(r.id);
+  if(r.source!=='user')add(`requirement-proposed-${key}`,1,'acceptance',`${number} remains proposed.`,'Confirm, revise or explicitly defer this requirement; do not promote it through generation.',task,[],[r.id]);
+  const missing=(r.links||[]).filter(id=>!resources.rows.some(row=>row.id===id));
+  if(!r.links?.length||missing.length)add(`traceability-${key}`,2,'traceability',`${number} has ${missing.length?'references to missing components':'no component links'}.`,'Map the requirement to relevant components or record why it is project-wide; do not guess the mapping.',task,[],[r.id]);
+  // A scalar measure omits workload/window/negative cases, so never marks acceptance ready.
+  add(`acceptance-${key}`,2,'acceptance',`${number}: executable acceptance evidence is not supplied.`,r.measure?'Define workload, measurement window, first-output versus completed-response boundary and repeatable positive/negative cases.':'Agree an observable pass/fail criterion, fixtures and evidence location.',task,r.links||[],[r.id]);
+ }
+ for(const q of (project.openQuestions||[]).filter(q=>q.status==='open'))add(`question-${handoffKey(q.id)}`,1,'decision',q.question,'Resolve or explicitly defer this question with an owner and affected tasks.');
+ const order=['scope','architecture','placement','availability','security','decision','cost','acceptance','traceability','implementation','integration'];
+ findings.sort((a,b)=>a.priority-b.priority||order.indexOf(a.area)-order.indexOf(b.area)||a.id.localeCompare(b.id));
+ return {
+  format:'atmem.handoff-assessment',version:1,designRevision:project.revision,
+  status:'engineering_required',
+  stages:{design:findings.some(f=>f.priority===1)?'decisions_required':'review_required',infrastructure:resources.gaps.length===0&&resources.rows.length?'generated_implementation_unverified':resources.rows.some(r=>r.implemented&&!r.existing)?'partial_implementation':'not_implemented',localValidation:'not_attached',cloudPlan:'not_run',staging:'not_verified',production:'approval_not_attached'},
+  counts:{components:resources.rows.length,generatedFoundations:resources.rows.filter(r=>r.foundation).length,connections:resources.connections.length,priorityDecisions:findings.filter(f=>f.priority===1).length},
+  nextAction:findings.find(f=>f.priority===1)?.action||'Review component engineering work and confirm the implementation scope.',
+  findings,
+  evidencePolicy:'Generated documents and asserted decisions are design evidence only. Schema validation, mock tests, account plans and deployed-system tests require separate receipts tied to the exact configuration. This export does not ingest implementation evidence.',
+ };
+}
+export function handoffMarkdown(report){
+ return `# Handoff readiness\n\nStatus: engineering required. No deployment readiness is implied.\n\n## Next action\n\n${report.nextAction}\n\n## Evidence stages\n\n${Object.entries(report.stages).map(([k,v])=>`- ${k}: ${v}`).join('\n')}\n\n${report.evidencePolicy}\n\n## Decisions and engineering gaps\n\n${report.findings.map(f=>`### ${f.id} — priority ${f.priority}\n\n${f.message}\n\nAction: ${f.action}\n\nTasks: ${f.taskIds.join(', ')}`).join('\n\n')}\n`;
+}

package/src/ibm-registry.mjs

@@ -0,0 +1,12 @@
+// Reviewed 2026-11-10: IBM's registry hostname is not its Code Engine region.
+// https://cloud.ibm.com/docs/Registry?topic=Registry-registry_overview
+export const IBM_REGISTRY_HOSTS=Object.freeze({'au-syd':'au.icr.io','br-sao':'br.icr.io','ca-mon':'ca2.icr.io','ca-tor':'ca.icr.io','eu-de':'de.icr.io','eu-es':'es.icr.io','eu-gb':'uk.icr.io','in-che':'in.icr.io','in-mum':'in2.icr.io','jp-osa':'jp2.icr.io','jp-tok':'jp.icr.io','us-south':'us.icr.io'});
+export function ibmRegistryHost(region){
+ if(!Object.hasOwn(IBM_REGISTRY_HOSTS,region))throw Error('Select an explicitly supported regional IBM registry; no global fallback is inferred');
+ return IBM_REGISTRY_HOSTS[region];
+}
+export function ibmRegistryHostExpression(variable='var.region'){
+ if(!/^var\.[a-z][a-z0-9_]*$/.test(variable))throw Error('Use a compiler-owned registry region variable');
+ return'${lookup('+JSON.stringify(IBM_REGISTRY_HOSTS)+','+variable+')}';
+}
+export function ibmRegistryRegionValidation(){return{condition:'${contains('+JSON.stringify(Object.keys(IBM_REGISTRY_HOSTS))+',var.region)}',error_message:'Use a reviewed regional Container Registry location; an invented region hostname or implicit global fallback is not supported.'};}

package/src/ibm-structured.mjs

@@ -0,0 +1,103 @@
+import {ibmRegistryHostExpression,ibmRegistryRegionValidation}from'./ibm-registry.mjs';
+import sources from './runtime/ibm-sources.json' with {type:'json'};
+import lock from './runtime/ibm-python-lock.json' with {type:'json'};
+import testLock from './runtime/azure-test-lock.json' with {type:'json'};
+import base from './runtime/python-container-lock.json' with {type:'json'};
+import {pythonContainer} from './python-container.mjs';
+import {STRUCTURED_WEB_HTML,STRUCTURED_WEB_CSS,STRUCTURED_WEB_JS} from './structured-web.mjs';
+import {structuredContract} from './structured-contract.mjs';
+import {existingDeployment} from './deployment-ownership.mjs';
+import {existingReferenceFiles} from './existing-references.mjs';
+import {CLOUD_PROVIDER_LOCKS} from './cloud-provider-locks.mjs';
+
+export function ibmStructuredPlan(project,rows){
+ const entries=[];
+ for(const node of project.nodes){
+  if(node.data.provider!=='ibm'||node.data.implementation!=='ibm-structured-app'||node.data.service!=='IBM Code Engine'||existingDeployment(node))continue;
+  const contract=structuredContract(node.data.config?.outputContract);if(!contract)continue;
+  const maxInput=node.data.config?.maxInputBytes??20000,maxTokens=node.data.config?.maxOutputTokens??1024;
+  if(!Number.isInteger(maxInput)||maxInput<1||maxInput>20000||!Number.isInteger(maxTokens)||maxTokens<32||maxTokens>4096)throw Error('IBM structured application limits must be 1–20000 input bytes and 32–4096 output tokens.');
+  entries.push({row:rows.find(r=>r.id===node.id),contract,maxInput,maxTokens});
+ }
+ const ids=new Set(entries.map(e=>e.row.id)),browsers=new Set(project.nodes.filter(n=>existingDeployment(n)&&n.data.provider==='tools'&&n.data.binding==='web-browser').map(n=>n.id));
+ return {entries,componentIds:[...ids],edgeIds:project.edges.filter(e=>e.integration==='browser-https'&&browsers.has(e.source)&&ids.has(e.target)).map(e=>e.id)};
+}
+const v=n=>'${var.'+n+'}',ref=(type,n,key)=>'${'+type+'.'+n+'.'+key+'}';
+const UUID='^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$';
+export function ibmStructuredTerraform(project,plan,environment='staging'){
+ const entries=plan.ibmStructuredPlan.entries;if(!entries.length)throw Error('No IBM structured application composition.');
+ const variable={review_approved:{type:'bool',default:false}},examples={review_approved:false},resource={},output={},files={},tests=[];
+ const input=(name,description,example,pattern)=>{variable[name]={type:'string',nullable:false,description,validation:{condition:'${can(regex('+JSON.stringify(pattern)+', var.'+name+'))}',error_message:'Supply the reviewed '+name+' value.'}};examples[name]=example;return v(name);};
+ const account=input('account_id','Existing destination IBM account. The referenced Code Engine project must belong to it.','a'.repeat(32),'^[0-9a-f]{32}$');
+ const region=input('region','Reviewed region with Code Engine, App ID and the selected watsonx model. Verify availability, identity processing and terms; no global fallback.','au-syd','^[a-z]{2}-[a-z]+$');
+ if(entries.every(e=>e.row.region===entries[0].row.region)&&/^[a-z]{2}-[a-z]+$/.test(entries[0].row.region)){variable.region.default=entries[0].row.region;examples.region=entries[0].row.region;}
+ variable.region.validation=ibmRegistryRegionValidation();
+ const ceProject=input('code_engine_project_id','Existing Code Engine project; never recreate or import it.','11111111-1111-1111-1111-111111111111',UUID);
+ const registry=input('registry_namespace','Existing regional IBM Container Registry namespace.','reviewed-namespace','^[a-z0-9]+(?:[-_][a-z0-9]+)*$');
+ const pullSecret=input('registry_pull_secret','Existing authorized registry-pull secret NAME in that Code Engine project. No credential values are exported or written to state.','reviewed-registry-pull','^[a-z][a-z0-9-]{1,61}[a-z0-9]$');
+ const gaps=[...plan.gapDetails.map(g=>g.id),...(environment==='production'?['production-state-backup-and-operating-review-required']:[])];
+ resource.terraform_data={review_gate:{input:{design_revision:project.revision,environment},lifecycle:{precondition:[{condition:'${var.review_approved && length(local.unfinished_work) == 0}',error_message:'Review destination, code, access, model policy, costs and unresolved scope before planning deployment.'},{condition:'${data.ibm_code_engine_project.destination.account_id == var.account_id && data.ibm_code_engine_project.destination.region == var.region}',error_message:'Preserve the existing Code Engine project: account and region must match the reviewed destination.'}]}}};
+ const add=(type,name,body)=>((resource[type]||={})[name]={...body,depends_on:['terraform_data.review_gate',...(body.depends_on||[])]});
+ for(const {row,contract,maxInput,maxTokens}of entries){
+  const n=row.address;
+  const name=input(n+'_name','Application and App ID registration name.','reviewed-ai-app','^[a-z][a-z0-9-]{2,48}[a-z0-9]$');
+  const repository=input(n+'_image_repository','Reviewed path for the emitted application image in the existing registry namespace.','architect/app','^[a-z0-9]+(?:[._/-][a-z0-9]+)*$');
+  const digest=input(n+'_image_digest','Exact built, scanned and tested emitted image digest. Publishing requires authorization.','sha256:'+'0'.repeat(64),'^sha256:[0-9a-f]{64}$');
+  const wxProject=input(n+'_watsonx_project_id','Existing watsonx data-platform project; associate the reviewed runtime instance and add this generated trusted profile as an authorized collaborator. IAM access alone does not establish project membership.','22222222-2222-2222-2222-222222222222',UUID);
+  const instance=input(n+'_runtime_instance_id','Existing associated watsonx.ai Runtime service instance GUID, scoped by the generated IAM policy. Not a Cloud Projects deployment ID.','33333333-3333-3333-3333-333333333333',UUID);
+  const model=input(n+'_model_id','Reviewed regional Text Chat model with JSON-object output support; verify lifecycle, model terms and quotas.','ibm/reviewed-model','^[a-z0-9][a-z0-9_.-]{0,79}/[a-z0-9][a-z0-9_.-]{0,99}$');
+  const appidPlan=input(n+'_appid_plan','Current App ID service plan reviewed by the implementing engineer against the catalog and accepted budget. No price is invented.','graduated-tier','^[a-z][a-z0-9-]{1,79}$');
+  const subjects=n+'_authorized_user_subjects';variable[subjects]={type:'set(string)',default:[],nullable:false,description:'Admin-enrolled Cloud Directory user subjects from this NEW owned App ID tenant. Initially empty denies everyone. Enroll staff securely, then review and add exact subjects. This authoritative role assignment must not target a shared/existing tenant.',validation:{condition:'${alltrue([for subject in var.'+subjects+' : can(regex("^[A-Za-z0-9|:_@.-]{1,200}$", subject))])}',error_message:'Supply exact administrator-reviewed user subjects.'}};examples[subjects]=[];
+  const review=n+'_policy_review';variable[review]={type:'object({ accountId = string, projectId = string, runtimeInstanceId = string, region = string, model = string, retentionReview = string, approvedBy = string, evidenceSha256 = string, expiresAt = string })',nullable:false,description:'Scoped destination-owner review of actual model/provider retention and data-processing terms. Evidence digest and expiry within 31 days; operator attestation, not a fabricated approval API.'};examples[review]={accountId:examples.account_id,projectId:examples[n+'_watsonx_project_id'],runtimeInstanceId:examples[n+'_runtime_instance_id'],region:examples.region,model:examples[n+'_model_id'],retentionReview:'REVIEW_REQUIRED',approvedBy:'REVIEW_REQUIRED',evidenceSha256:'0'.repeat(64),expiresAt:'REPLACE_AFTER_REVIEW'};
+  add('ibm_resource_instance',n,{name,service:'appid',plan:appidPlan,location:region,resource_group_id:'${data.ibm_code_engine_project.destination.resource_group_id}',lifecycle:{prevent_destroy:true,postcondition:[{condition:'${self.account_id == var.account_id}',error_message:'App ID tenant must belong to the reviewed account.'}]}});
+  const tenant=ref('ibm_resource_instance',n,'guid'),client=ref('ibm_appid_application',n,'client_id');
+  add('ibm_appid_application',n,{tenant_id:tenant,name,type:'singlepageapp'});
+  add('ibm_appid_application_scopes',n,{tenant_id:tenant,client_id:client,scopes:['process']});
+  add('ibm_appid_role',n,{tenant_id:tenant,name:'WorkspaceUser',access:[{application_id:client,scopes:['process']}],depends_on:['ibm_appid_application_scopes.'+n]});
+  add('ibm_appid_user_roles',n,{for_each:v(subjects),tenant_id:tenant,subject:'${each.value}',role_ids:[ref('ibm_appid_role',n,'role_id')]});
+  add('ibm_appid_idp_cloud_directory',n,{tenant_id:tenant,is_active:true,signup_enabled:false,self_service_enabled:false,welcome_enabled:false,reset_password_enabled:true,reset_password_notification_enabled:true,identity_field:'email',identity_confirm_access_mode:'FULL',identity_confirm_methods:['email']});
+  for(const idp of ['facebook','google','saml'])add('ibm_appid_idp_'+idp,n,{tenant_id:tenant,is_active:false});
+  add('ibm_iam_trusted_profile',n,{name,description:'Keyless Code Engine model runtime; no end-user login authority'});
+  add('ibm_iam_trusted_profile_link',n,{profile_id:ref('ibm_iam_trusted_profile',n,'profile_id'),cr_type:'CE',link:{crn:'${data.ibm_code_engine_project.destination.crn}',component_name:ref('ibm_code_engine_app',n,'name'),component_type:'app'}});
+  add('ibm_iam_trusted_profile_policy',n,{iam_id:ref('ibm_iam_trusted_profile',n,'iam_id'),roles:['Writer'],resources:{service:'pm-20',resource_instance_id:instance,region},description:'Instance-scoped watsonx Runtime access. Writer includes broader instance operations; it is not an invented prediction-only IAM permission.'});
+  const settings={ACCOUNT_ID:account,WATSONX_PROJECT_ID:wxProject,RUNTIME_INSTANCE_ID:instance,MODEL_REGION:region,MODEL_ID:model,IAM_PROFILE_ID:ref('ibm_iam_trusted_profile',n,'profile_id'),APPID_TENANT_ID:tenant,APPID_CLIENT_ID:client,APPID_ISSUER:ref('ibm_appid_application',n,'oauth_server_url'),AUTH_SCOPE:name+'/process',OUTPUT_CONTRACT_BASE64:btoa(unescape(encodeURIComponent(JSON.stringify(contract)))),MAX_INPUT_BYTES:String(maxInput),MAX_OUTPUT_TOKENS:String(maxTokens),POLICY_REVIEW_BASE64:'${base64encode(jsonencode(var.'+review+'))}'};
+  add('ibm_code_engine_app',n,{project_id:ceProject,name,image_reference:ibmRegistryHostExpression()+'/'+registry+'/'+repository+'@'+digest,image_secret:pullSecret,image_port:8080,managed_domain_mappings:'local_public',run_as_user:10001,run_compute_resource_token_enabled:true,scale_cpu_limit:'0.5',scale_memory_limit:'1G',scale_min_instances:0,scale_max_instances:2,scale_concurrency:5,scale_concurrency_target:5,scale_request_timeout:30,run_env_variables:Object.entries(settings).map(([name,value])=>({name,value,type:'literal'})),probe_readiness:{type:'http',path:'/healthz',port:8080,initial_delay:2,interval:5,timeout:2,failure_threshold:12},depends_on:['ibm_iam_trusted_profile_policy.'+n]});
+  // Link follows app creation: making the app depend on its own link would cycle.
+  add('ibm_appid_redirect_urls',n,{tenant_id:tenant,urls:[ref('ibm_code_engine_app',n,'endpoint')+'/']});
+  output[n+'_url']={value:ref('ibm_code_engine_app',n,'endpoint')};output[n+'_appid_tenant_id']={value:tenant};output[n+'_trusted_profile_iam_id']={value:ref('ibm_iam_trusted_profile',n,'iam_id')};
+  const folder='applications/'+n+'/';for(const [path,body]of Object.entries(sources))files[folder+path]=body;
+  files[folder+'web/index.html']=STRUCTURED_WEB_HTML.replace('>Sign out</button>','>Clear workspace</button>');files[folder+'web/app.css']=STRUCTURED_WEB_CSS;files[folder+'web/app.js']=STRUCTURED_WEB_JS;
+  files[folder+'output-contract.json']=JSON.stringify(contract,null,2);
+  files[folder+'requirements.lock']=lock.requirements;files[folder+'dependency-sources.json']=JSON.stringify(lock.sources,null,2);files[folder+'test-requirements.lock']=testLock.requirements;files[folder+'test-dependency-sources.json']=JSON.stringify(testLock.sources,null,2);files[folder+'container-base.json']=JSON.stringify(base,null,2);
+  const modules=['ibm_structured.py','structured_output.py','structured_http.py','policy_review.py'];files[folder+'Dockerfile']=pythonContainer('ibm_structured',modules);files[folder+'.dockerignore']='*\n!requirements.lock\n!output-contract.json\n'+modules.map(p=>'!'+p+'\n').join('')+'!web/\n!web/*\n';
+  files[folder+'BUILD.md']=`# Generated Code Engine application\n\nCreate an isolated Python 3.13 environment; install test-requirements.lock using binary wheels and --require-hashes. Run ibm_acceptance.py -v. Local signed-JWT/ASGI/SDK/transport fixtures never establish live IBM behavior.\n\nBuild with docker build --platform linux/amd64 --pull -t REVIEWED_REGIONAL_REGISTRY/REVIEWED_NAMESPACE/REVIEWED_IMAGE:REVIEWED_BUILD . ; scan and run the exact image nonroot/read-only. Retain source/image digests. Obtain authorization before logging into the existing registry and publishing; supply that immutable digest as ${n}_image_digest. The existing Code Engine project must already contain its authorized registry-pull secret (${examples.registry_pull_secret}); Terraform references the name without exporting credential values.\n\nSupply reviewed destination/model inputs and ${review}. The example review is unapproved. Add the generated trusted profile IAM identity to the existing watsonx data-platform project with the minimum supported collaborator role, associate its runtime instance, and verify model access with synthetic data. This separate project authorization cannot be inferred from IAM Writer access. Do not add account-wide Manager/Admin or an API key to bypass a failure.\n\nThis new App ID tenant initially admits no application users. After authorized provisioning, enroll staff using its administrator workflow, distribute credentials securely, and add reviewed subjects to ${subjects}; inspect the next plan. The role assignment is authoritative only within this owned tenant. Test allowed user, wrong user/tenant, missing scope and expired/revoked sessions. No passwords or user-managed secrets belong in variables or state.\n`;
+  tests.push(`run "${n}_sydney_registry" {\n command = plan\n assert {\n condition = var.region != "au-syd" || startswith(ibm_code_engine_app.${n}.image_reference,"au.icr.io/")\n error_message = "Sydney image pulls must use au.icr.io, never a region-derived invented registry."\n }\n}`);
+  tests.push(`run "${n}_identity" {\n command = plan\n assert {\n condition = ibm_code_engine_app.${n}.run_compute_resource_token_enabled && ibm_code_engine_app.${n}.run_as_user == 10001\n error_message = "Use nonroot Code Engine compute identity."\n }\n assert {\n condition = ibm_appid_application.${n}.type == "singlepageapp" && !ibm_appid_idp_cloud_directory.${n}.signup_enabled && !ibm_appid_idp_google.${n}.is_active && !ibm_appid_idp_facebook.${n}.is_active && !ibm_appid_idp_saml.${n}.is_active\n error_message = "Only admin-enrolled scoped users belong in this owned App ID tenant."\n }\n assert {\n condition = ibm_iam_trusted_profile_policy.${n}.resources[0].resource_instance_id == var.${n}_runtime_instance_id && ibm_iam_trusted_profile_policy.${n}.resources[0].service == "pm-20" && ibm_iam_trusted_profile_policy.${n}.roles == tolist(["Writer"])\n error_message = "No account-wide model grant or substituted service."\n }\n assert {\n condition = ibm_iam_trusted_profile_link.${n}.cr_type == "CE" && ibm_iam_trusted_profile_link.${n}.link[0].component_type == "app" && length(ibm_appid_user_roles.${n}) == 0\n error_message = "Bind this compute resource; user allowlist starts empty."\n }\n}\nrun "${n}_reject_mutable_image" {\n command = plan\n variables { ${n}_image_digest = "latest" }\n expect_failures = [var.${n}_image_digest]\n}`);
+ }
+ const config={terraform:{required_version:'>= 1.17.1, < 2.0.0',required_providers:{ibm:{source:'IBM-Cloud/ibm',version:'1.89.0'}}},provider:{ibm:{region}},data:{ibm_code_engine_project:{destination:{project_id:ceProject}}},variable,locals:{unfinished_work:gaps},resource,output};
+ const values=Object.entries({...examples,review_approved:true}).map(([k,value])=>k+' = '+JSON.stringify(value)).join('\n');
+ return {...files,...existingReferenceFiles(project),'.terraform.lock.hcl':CLOUD_PROVIDER_LOCKS.ibm,'main.tf.json':JSON.stringify(config,null,2),'resource-schedule.json':JSON.stringify(plan,null,2),'deployment.tfvars.json.example':JSON.stringify(examples,null,2),'.gitignore':'.terraform/\n*.tfstate*\n*.tfplan\n*.tfvars\n*.tfvars.json\n!deployment.tfvars.json.example\n.venv/\n__pycache__/\n','tests/ibm-structured.tftest.hcl':`mock_provider "ibm" {\n override_during = plan\n mock_data "ibm_code_engine_project" { defaults = { account_id = "${examples.account_id}", region = "${examples.region}", resource_group_id = "${'b'.repeat(32)}", crn = "crn:v1:bluemix:public:codeengine:au-syd:a/${examples.account_id}:11111111-1111-1111-1111-111111111111::" } }\n}\nvariables {\n${values}\n}\n${tests.join('\n')}\nrun "wrong_account_blocked" {\n command = plan\n variables { account_id = "${'c'.repeat(32)}" }\n expect_failures = [terraform_data.review_gate]\n}\nrun "unapproved_blocked" {\n command = plan\n variables { review_approved = false }\n expect_failures = [terraform_data.review_gate]\n}\n`,'README.md':IBM_STRUCTURED_GUIDE};
+}
+
+export const IBM_STRUCTURED_GUIDE=`# IBM structured AI application
+
+The explicit ibm-structured-app module emits a Python 3.13 browser/API on Code Engine, a NEW owned App ID tenant and single-page PKCE registration, scoped WorkspaceUser role, disabled social/self-signup paths, dedicated trusted profile and exact Code Engine compute-resource link. Existing Code Engine project, private registry/pull secret, watsonx data-platform project and associated runtime instance are preserved. Independent blocks/connections retain their gaps.
+
+User and workload identities are separate. The API verifies RS256 App ID signatures from its fixed public key endpoint, exact issuer, single client audience, tenant, authenticated Cloud Directory method and application process scope before and after inference. ID/anonymous/machine tokens do not grant user access. No custom user-attribute-to-scope mapping is created. Protect tenant administration; token scopes last until expiry, and immediate revocation, existing SSO, MFA or private networking are not implemented by this module. The browser keeps access tokens in memory, verifies OAuth state and S256 PKCE, clears private input/results on access loss, and offers local workspace clearing without claiming global identity-provider logout.
+
+The fixed Code Engine compute-resource token is exchanged by the hash-pinned IBM SDK using the generated trusted profile. No application API key or client secret is emitted. The exact linked project/app is trusted; there is no account-wide compute rule. The runtime receives Writer only on the reviewed pm-20 runtime instance. This role includes broader instance operations and is not prediction-only. Data-platform project collaborator membership and associated-instance/model access are separate destination prerequisites; verify them instead of expanding IAM or introducing static credentials. The app becomes live before its compute link is created, then inference can work after account propagation and project authorization; do not create an app/link dependency cycle. Health is liveness, not model readiness.
+
+One bounded regional Text Chat request uses the reviewed model/project, JSON-object output, no tools, no automatic retry or saved session. Invalid, duplicate, extra, truncated or action-bearing output fails closed. Independent schema checks and human review do not establish semantic model quality. A scoped, expiring destination-owner review of actual retention/processing terms is required before workload authentication or inference. It is operator-attested evidence, not a fabricated IBM privacy approval API. No app input/result persistence is implemented; identity/IAM/global processing and actual model geography still need review against residency requirements.
+
+Use BUILD.md and Terraform 1.17.1+. Run terraform init -backend=false, terraform validate and terraform test; inspect the empty user allowlist and wrong-account/unapproved/mutable-image negative tests. Build, scan and locally test the exact Linux image, obtain authorization to publish, and supply its immutable registry digest. Account plan, current service/model availability, quota, costs, real App ID signup denial and role tokens, Code Engine token exchange, dataplatform model access, model quality and operations must be checked before deployment. Production state/backup/operating review remains gated. Scaling/token limits are not an invoice cap or SLA. Terraform state/variable files require protection; no export proves deployment.
+
+References:
+- https://cloud.ibm.com/docs/codeengine?topic=codeengine-trusted-profiles-authentication-file
+- https://cloud.ibm.com/docs/codeengine?topic=codeengine-inside-env-vars
+- https://cloud.ibm.com/docs/appid?topic=appid-single-page
+- https://cloud.ibm.com/docs/appid?topic=appid-access-control
+- https://cloud.ibm.com/docs/appid?topic=appid-token-validation
+- https://cloud.ibm.com/docs/apis/watsonx-ai
+- https://cloud.ibm.com/docs/iam?topic=iam-iam-service-roles-actions
+- https://registry.terraform.io/providers/IBM-Cloud/ibm/1.89.0/docs/resources/iam_trusted_profile_link
+`;

package/src/identifiers.mjs

@@ -0,0 +1,15 @@
+import {sha256} from '@noble/hashes/sha2.js';
+const hex=bytes=>Array.from(bytes,b=>b.toString(16).padStart(2,'0')).join('');
+// Preserve established short addresses. Long Unicode identities use a bounded
+// digest token; original identities remain in project/manifest/requirement links.
+// Odd-length digest tokens cannot overlap any legacy even-length UTF-8 hex token.
+export function identityToken(value){
+ if(typeof value!=='string'||!value)throw Error('Use a nonempty component identity.');
+ try{encodeURIComponent(value);}catch{throw Error('Use a well-formed Unicode identity; no characters were replaced.');}
+ const bytes=new TextEncoder().encode(value);
+ return bytes.length<=124?hex(bytes):'d'+hex(sha256(bytes));
+}
+export const resourceAddress=id=>'block_'+identityToken(id);
+export function assertDistinctIdentifiers(ids,token=identityToken){
+ const seen=new Map();for(const id of ids){const name=token(id);if(seen.has(name))throw Error(seen.get(name)===id?'Duplicate component identity; no output was overwritten.':'Component namespace collision; retain both original identities and stop generation.');seen.set(name,id);}
+}

package/src/implementation-map.mjs

@@ -0,0 +1,14 @@
+import {inspectTerraformModules} from './terraform-admission.mjs';
+// Concrete links are derived from emitted files, not fabricated repository paths.
+export function implementationMap(project,plan,files){
+ const config=JSON.parse(files['main.tf.json']),admission=inspectTerraformModules(project,plan,files,config,()=>{});
+ const components=plan.rows.map(row=>{
+  const scope=admission.scopes.get(row.id),current=scope?.config||(admission.composed?{}:config);
+  const addresses=Object.entries(current.resource||{}).flatMap(([type,items])=>Object.keys(items).filter(name=>name===row.address||name.startsWith(row.address+'_')).map(name=>(scope?.prefix||'')+type+'.'+name));
+  const generatedFiles=Object.entries(files).filter(([name,body])=>scope?name.startsWith(scope.path+'/'):name!=='resource-schedule.json'&&(!admission.composed&&row.invoice||name.includes(row.address)||typeof body==='string'&&body.includes(row.address))).map(([name])=>'terraform/'+name);
+  const variables=scope?Object.keys(current.variable||{}).map(name=>name==='review_approved'?name:scope.module+'__'+name).filter(name=>Object.hasOwn(config.variable||{},name)):Object.keys(config.variable||{}).filter(name=>!admission.composed&&row.invoice||name.startsWith(row.address+'_'));
+  return {id:row.id,...(scope?{module:scope.module,modulePath:'terraform/'+scope.path}:{}),ownership:row.existing?'existing':row.sourceExisting?'existing_source_new_deployment':'proposed',terraformAddresses:addresses,generatedFiles,requiredInputs:variables,requirements:(project.needs||[]).filter(r=>r.links?.includes(row.id)).map(r=>r.id),applicationImplementation:project.nodes.find(n=>n.id===row.id)?.data.implementation==='approval-workflow'?'shared_api_assembly_only':row.containerContract?'supplied_image_required':row.existing?'external_behavior_unverified':generatedFiles.some(p=>p.includes('/handlers/'))?'generated_runtime_unverified':generatedFiles.some(p=>p.includes('/web/')||p.includes('/applications/'))?'generated_application_unverified':row.implemented&&addresses.length?'managed_service_configuration_unverified':'not_established'};
+ });
+ const interfaces=project.edges.map(edge=>({id:edge.id,source:edge.source,target:edge.target,purpose:edge.label||'',integration:edge.integration||null,access:edge.access||null,generated:!!plan.connections.find(e=>e.id===edge.id)?.generated,requiredContractFields:['request/event schema','response/result schema','identity and authorization','timeout','retry and idempotency','error and recovery','observability','acceptance fixtures'],status:'runtime_contract_evidence_required'}));
+ return {version:1,designRevision:project.revision,components,interfaces,commands:admission.composed?['terraform init -backend=false','terraform validate',...admission.configs.filter(s=>s.path).flatMap(s=>['terraform -chdir='+s.path+' init -backend=false','terraform -chdir='+s.path+' validate','terraform -chdir='+s.path+' test'])]:['terraform init -backend=false','terraform validate','terraform test'],evidenceBoundary:'File and resource links are generated artifact facts; runtime behavior and destination account validation require separate evidence.'};
+}