@atmem/architect 0.0.0-stage → 0.2.0

package/src/emulation-guidance.mjs

@@ -0,0 +1,37 @@
+import {resourcePlan} from './resources.mjs';
+import {containerContract} from './container-contracts.mjs';
+
+// These are next-step explanations, not evidence of implemented or tested behavior.
+export function emulationGuidance(project,report,{beforeRun=false}={}){
+ if(!report||(report.checks||[]).length)return null;
+ let plan;try{if(project)plan=resourcePlan(project);}catch{}
+ const base={title:'Testing couldn’t start',reason:'The local test setup is incomplete.',next:'Prepare a repair task so the missing implementation can be fixed.',owner:'engineering',needsModel:false,componentId:null};
+ if(report.status==='unavailable')return {...base,reason:'The local test runner is not available.',next:'Enable the test runner, then try again.'};
+ if(report.status==='failed')return {...base,reason:'The test runner stopped before it could check your application.',next:'Use the report to fix the test runner, then try again.'};
+ if(plan&&!plan.rows.length)return {...base,reason:'There is no system drawn yet.',next:'Describe what you want to build so Architect can draw a first design.',owner:'user'};
+ const browserIds=new Set((project?.nodes||[]).filter(n=>n.data.origin==='existing'&&n.data.provider==='tools'&&!n.data.binding&&/\bbrowser\b/i.test(n.data.label)).map(n=>n.id));
+ const missing=plan?.rows.find(r=>!r.implemented&&!browserIds.has(r.id));
+ if(missing)return {...base,title:'Application code is needed before testing',reason:`${missing.label} is in your design, but runnable application code is not available for this test.`,next:'Choose “Implement and check”. Architect will generate code and connections, attempt local tests, and show results in Implementation. Nothing is deployed to the cloud.',action:'build-and-test',componentId:missing.id};
+ if(browserIds.size)return {...base,reason:'The browser needs to be marked as an external client.',next:'Architect can propose that small correction, then try the test again.',owner:'architect',needsModel:true,componentId:[...browserIds][0]};
+ const access=plan?.gapDetails.find(g=>g.id.startsWith('access-'));
+ if(access)return {...base,reason:'An access rule is missing.',next:'Confirm who should be allowed to use this block; Architect can add the rule.',owner:'user',needsModel:true,componentId:access.componentIds?.[0]};
+ const connection=plan?.connections.find(e=>!e.generated);
+ if(connection)return {...base,reason:'The connections between the application’s parts are not implemented yet.',next:'Choose “Implement and check” to generate its connections and run local checks.',action:'build-and-test',componentId:connection.source};
+ const container=project?.nodes.find(containerContract);
+ if(container&&!beforeRun)return {...base,reason:`${container.data.label} has infrastructure defined, but no supported local application test yet.`,next:'Choose “Implement and check” to use its supplied image and run local checks.',action:'build-and-test',componentId:container.id};
+ return beforeRun?null:base;
+}
+export function guidanceMessage(guidance){
+ return `**${guidance.title}.**\n\n${guidance.reason}\n\n**Next:** ${guidance.next}`;
+}
+export function emulationRepairTask(project,report){
+ const guidance=report?emulationGuidance(project,report):emulationPreflight(project);
+ report=report||{};
+ return `# Architect repair task\n\n${guidance?.reason||'Investigate the test failure.'}\n\n## Next engineering step\n\n${guidance?.next||'Reproduce the failure and repair its cause.'}\n\n## Reproduce\n\n- Design: ${project.name}\n- Saved design version (internal): ${report.designRevision??project.revision}\n- Artifact: ${report.artifactDigest||'not available'}\n- Checks executed: ${(report.checks||[]).length}\n- Affected component: ${guidance?.componentId||'test runner / implementation pipeline'}\n\n## Preserve\n\nKeep all requested scope, existing systems, component IDs, connections and access boundaries. Fix the generator or test runner, not an exported copy. Do not clear gates or report success without executing the relevant checks.\n\n## Reported blockers\n\n${(report.blockers||[]).map(b=>'- '+String(b)).join('\n')||'- No structured blocker was returned; inspect the full report.'}\n\n## Acceptance\n\nRegenerate from this project, execute the affected tests and regression checks, and retain a fresh report tied to the generated files. Separate local checks from cloud plans and deployment. This task is a work request, not evidence of a completed fix.\n`;
+}
+
+// Readiness guidance is not a test report and must never be stored as evidence.
+export function emulationPreflight(project){
+ const guidance=emulationGuidance(project,{status:'blocked',checks:[]},{beforeRun:true});
+ return guidance?.action==='build-and-test'?guidance:null;
+}

package/src/engagement.mjs

@@ -0,0 +1,274 @@
+import topicsFile from "../agent-skills/discovery/topics.json" with { type: "json" };
+import { cleanAssumption, cleanQuestion, cleanRequirement } from "./records.mjs";
+// The consultant's engagement record: brief, cloud options, decisions.
+// Kept beside the design so every deliverable traces back to the board.
+
+export const CRITERIA = [
+  { id: "cost", label: "Cost", hint: "Build and run cost, licence fit, cost controls" },
+  { id: "risk", label: "Risk", hint: "Delivery risk, skills, lock-in, vendor maturity" },
+  { id: "scalability", label: "Scalability", hint: "Fleet size, latency, throughput, regions" },
+  { id: "security", label: "Security", hint: "Identity, data residency, guardrails, compliance" },
+];
+export const OPTIONS = ["current", "aws", "azure", "gcp", "ibm"];
+export const STATUSES = ["Proposed", "Accepted", "Superseded"];
+// Discovery topics come from the agent skill, so the planner, UI and outputs agree.
+export const BRIEF_FIELDS = [...topicsFile.topics]
+  .sort((x, y) => x.order - y.order)
+  .map((t) => ({ id: t.id, label: t.label, question: t.question, beginner: t.beginner, essential: t.essential }));
+export const VERDICTS = ["Pursue", "Park", "Rule out"];
+export const LEVELS = ["High", "Medium", "Low"];
+export const GATE = [
+  { id: "adoption", label: "Adoption evidence", hint: "Who used the prototype, and what changed?" },
+  { id: "economics", label: "Value vs cost", hint: "Measured value against run and build cost" },
+  { id: "risks", label: "Residual risk", hint: "Open risks and who accepted them" },
+];
+
+const text = (value, max = 2000) => {const result=String(value??"");if(result.length>max)throw Error(`A project field exceeds ${max.toLocaleString('en')} characters. Split it into linked requirements; no content was truncated.`);return result;};
+const score = (value) => (Number.isInteger(value) && value >= 1 && value <= 5 ? value : null);
+
+export function defaultAssessment() {
+  return {
+    weights: Object.fromEntries(CRITERIA.map((c) => [c.id, 1])),
+    scores: Object.fromEntries(OPTIONS.map((o) => [o, Object.fromEntries(CRITERIA.map((c) => [c.id, null]))])),
+    notes: Object.fromEntries(OPTIONS.map((o) => [o, ""])),
+    current: "",
+  };
+}
+
+export function cleanMeasures(list) {
+  return list.slice(0, 10).flatMap((m) => {
+    if (!m || !/^[a-z_][a-z0-9_.]{0,79}$/i.test(m.path || "") || ![">=", "<=", "=="].includes(m.op)) return [];
+    const target =
+      typeof m.target === "number" && Number.isFinite(m.target)
+        ? m.target
+        : typeof m.target === "boolean"
+          ? m.target
+          : text(m.target, 100);
+    return [{ label: text(m.label || m.path, 150), path: m.path, op: m.op, target }];
+  });
+}
+
+export function cleanEngagement(p) {
+  for(const name of ['needs','assumptions','openQuestions','facts'])if(Array.isArray(p[name])&&p[name].length>300)throw Error(`The project has more than 300 ${name}; no records were truncated.`);
+  const out = {};
+  if (["maintenance", "churn"].includes(p.domain)) out.domain = p.domain;
+  if (typeof p.id === "string" && p.id) out.id = text(p.id, 100);
+  if (typeof p.createdAt === "string" && !isNaN(Date.parse(p.createdAt))) out.createdAt = p.createdAt;
+  if (Array.isArray(p.needs)) out.needs = p.needs.slice(0, 300).map(cleanRequirement);
+  if (Array.isArray(p.assumptions)) out.assumptions = p.assumptions.slice(0, 300).map(cleanAssumption);
+  if (Array.isArray(p.openQuestions)) out.openQuestions = p.openQuestions.slice(0, 300).map(cleanQuestion);
+  if (p.extensions && typeof p.extensions === "object" && !Array.isArray(p.extensions)) out.extensions = p.extensions;
+  if (p.brief && typeof p.brief === "object") {
+    // Older briefs used consultant headings; fold them into the discovery topics.
+    const brief = Object.fromEntries(BRIEF_FIELDS.map(({ id }) => [id, text(p.brief[id])]));
+    for (const [old, id] of Object.entries(topicsFile.legacy)) {
+      const value = text(p.brief[old]).trim();
+      if (value && !brief[id].includes(value)) brief[id] = brief[id] ? `${brief[id]}\n${value}` : value;
+    }
+    out.brief = brief;
+  }
+  if (Array.isArray(p.facts))
+    out.facts = p.facts.slice(0, 300).map((f) => ({
+      id: text(f?.id, 60),
+      name: text(f?.name, 60),
+      value: typeof f?.value === "number" || typeof f?.value === "boolean" ? f.value : text(f?.value, 100),
+      unit: text(f?.unit, 40),
+      text: text(f?.text, 300),
+      madeAt: /^\d{4}-\d{2}-\d{2}$/.test(f?.madeAt) ? f.madeAt : new Date().toLocaleDateString("en-CA"),
+      ...(f?.item ? { item: text(f.item, 40) } : {}),
+      ...(f?.period ? { period: text(f.period, 40) } : {}),
+      ...(f?.conflictsWith ? { conflictsWith: text(f.conflictsWith, 60) } : {}),
+    }));
+  if (typeof p.workflow === "string") out.workflow = text(p.workflow, 60);
+  if (Array.isArray(p.asked)) out.asked = p.asked.slice(0, 100).map((a) => text(a, 80));
+  if (p.lastAsked && typeof p.lastAsked === "object")
+    out.lastAsked = Object.fromEntries(["id", "topic", "question", "beginner", "why"].map((k) => [k, text(p.lastAsked[k], 400)]));
+  if (p.sketchOffered) out.sketchOffered = true;
+  if (typeof p.conceptSig === "string") out.conceptSig = p.conceptSig.slice(0, 20000);
+  if (p.choices && typeof p.choices === "object")
+    out.choices = Object.fromEntries(Object.entries(p.choices).slice(0, 100).filter(([, v]) => typeof v === "boolean").map(([k, v]) => [text(k, 80), v]));
+  if (p.reviewAccepted && typeof p.reviewAccepted === "object")
+    out.reviewAccepted = Object.fromEntries(
+      Object.entries(p.reviewAccepted)
+        .slice(0, 200)
+        .map(([k, v]) => [text(k, 300), { reason: text(v?.reason, 1000), owner: text(v?.owner, 120), date: text(v?.date, 10) }]),
+    );
+  if (p.estimate && typeof p.estimate === "object") {
+    const num = (v) => (typeof v === "number" && Number.isFinite(v) && v >= 0 ? v : undefined);
+    out.estimate = {
+      ...(["small","medium","large","extra-large"].includes(p.estimate.projectSize) ? {projectSize:p.estimate.projectSize} : {}),
+      details: (Array.isArray(p.estimate.details) ? p.estimate.details : []).slice(0, 500).map((l, i) => ({
+        id: text(l?.id || `charge-${i + 1}`, 100), componentId: text(l?.componentId, 100),
+        description: text(l?.description, 200), quantity: num(l?.quantity), price: num(l?.price),
+        unit: text(l?.unit, 80), currency: text(l?.currency || "USD", 3).toUpperCase(),
+        source: text(l?.source, 500), date: text(l?.date, 10), region: text(l?.region, 80), service: text(l?.service, 200),
+      })),
+      ...(p.estimate.consulting ? { consulting: {
+        currency: text(p.estimate.consulting.currency || "USD", 3).toUpperCase(),
+        phases: Object.fromEntries(["discovery", "design", "build", "test", "deploy"].map((id) => {
+          const l = p.estimate.consulting.phases?.[id] || {};
+          return [id, { lowDays: num(l.lowDays), days: num(l.days), highDays: num(l.highDays), rate: num(l.rate), basis: text(l.basis, 1000) }];
+        })),
+      } } : {}),
+      usage: Object.fromEntries(Object.entries(p.estimate.usage || {}).filter(([, v]) => num(v) !== undefined).slice(0, 20).map(([k, v]) => [text(k, 40), v])),
+      prices: Object.fromEntries(
+        Object.entries(p.estimate.prices || {})
+          .slice(0, 200)
+          .map(([k, v]) => [
+            text(k, 100),
+            { price: num(v?.price), currency: text(v?.currency || "USD", 3).toUpperCase(), source: text(v?.source, 300), url: text(v?.url, 500), date: text(v?.date, 10), note: text(v?.note, 300), region: text(v?.region, 80), service: text(v?.service, 200), ...(num(v?.tierLimit) !== undefined ? { tierLimit:v.tierLimit } : {}) },
+          ]),
+      ),
+      ...(num(p.estimate.low) !== undefined ? { low: p.estimate.low } : {}),
+      ...(num(p.estimate.high) !== undefined ? { high: p.estimate.high } : {}),
+    };
+  }
+  if (Array.isArray(p.useCases))
+    out.useCases = p.useCases.slice(0, 20).map((u, i) => ({
+      id: text(u?.id || `uc-${i + 1}`, 60),
+      title: text(u?.title, 200),
+      value: LEVELS.includes(u?.value) ? u.value : "Medium",
+      risk: LEVELS.includes(u?.risk) ? u.risk : "Medium",
+      fit: LEVELS.includes(u?.fit) ? u.fit : "Medium",
+      verdict: VERDICTS.includes(u?.verdict) ? u.verdict : "Park",
+      reason: text(u?.reason, 1000),
+    }));
+  if (p.gate && typeof p.gate === "object")
+    out.gate = Object.fromEntries(GATE.map(({ id }) => [id, text(p.gate[id])]));
+  if (p.assessment && typeof p.assessment === "object") {
+    const base = defaultAssessment();
+    const a = p.assessment;
+    out.assessment = {
+      weights: Object.fromEntries(
+        CRITERIA.map((c) => {
+          const w = a.weights?.[c.id];
+          return [c.id, Number.isInteger(w) && w >= 0 && w <= 5 ? w : 1];
+        }),
+      ),
+      scores: Object.fromEntries(
+        OPTIONS.map((o) => [o, Object.fromEntries(CRITERIA.map((c) => [c.id, score(a.scores?.[o]?.[c.id])]))]),
+      ),
+      notes: Object.fromEntries(OPTIONS.map((o) => [o, text(a.notes?.[o], 1000)])),
+      current: text(a.current ?? base.current, 1000),
+    };
+  }
+  if (Array.isArray(p.decisions))
+    out.decisions = p.decisions.slice(0, 200).map((d, i) => ({
+      id: text(d?.id || `adr-${i + 1}`, 60),
+      subject: text(d?.subject || `general.${d?.id || i + 1}`, 120),
+      title: text(d?.title, 200),
+      owner: text(d?.owner, 120),
+      status: STATUSES.includes(d?.status) ? d.status : "Proposed",
+      date: /^\d{4}-\d{2}-\d{2}$/.test(d?.date) ? d.date : new Date().toLocaleDateString("en-CA"),
+      context: text(d?.context),
+      options: text(d?.options),
+      decision: text(d?.decision),
+      consequences: text(d?.consequences),
+      revision: Number.isInteger(d?.revision) ? d.revision : null,
+      supersedes: d?.supersedes ? text(d.supersedes, 60) : null,
+      supersededBy: d?.supersededBy ? text(d.supersededBy, 60) : null,
+      reason: text(d?.reason, 1000),
+    }));
+  return out;
+}
+
+// Weighted mean on the 1–5 scale; null until every weighted criterion is scored.
+export function optionScore(assessment, option) {
+  const scores = assessment.scores[option];
+  let total = 0,
+    weight = 0;
+  for (const c of CRITERIA) {
+    const w = assessment.weights[c.id];
+    if (!w) continue;
+    if (scores[c.id] == null) return null;
+    total += w * scores[c.id];
+    weight += w;
+  }
+  return weight ? Math.round((total / weight) * 10) / 10 : null;
+}
+
+export function newDecision(project, fields = {}) {
+  const decisions = project.decisions || [];
+  const n = Math.max(0, ...decisions.map((d) => Number(/^adr-(\d+)$/.exec(d.id)?.[1] || 0))) + 1;
+  const id = `adr-${String(n).padStart(3, "0")}`;
+  return {
+    id,
+    subject: fields.subject || `general.${id}`,
+    title: "",
+    owner: "",
+    status: "Proposed",
+    date: new Date().toLocaleDateString("en-CA"),
+    context: "",
+    options: "",
+    decision: "",
+    consequences: "",
+    revision: project.revision,
+    supersedes: null,
+    supersededBy: null,
+    reason: "",
+    ...fields,
+  };
+}
+
+export function recommendationDecision(project, option, names) {
+  const a = project.assessment || defaultAssessment();
+  const line = (o) => {
+    const s = optionScore(a, o);
+    return `- ${names[o]}: ${s ?? "not fully scored"}${a.notes[o] ? ` — ${a.notes[o]}` : ""}`;
+  };
+  return newDecision(project, {
+    subject: "platform.cloud",
+    title: `Platform for ${project.domain === "maintenance" ? "predictive maintenance" : project.name}: ${names[option]}`,
+    context: project.requirements || "",
+    options: [
+      `Weights: ${CRITERIA.map((c) => `${c.label} ×${a.weights[c.id]}`).join(", ")} (scores 1–5, higher is better).`,
+      ...OPTIONS.map(line),
+    ].join("\n"),
+    decision: `Recommend ${names[option]}.`,
+    consequences: "",
+  });
+}
+
+// Proposals and templates replace the design, never the engagement record.
+export function keepEngagement(next, current) {
+  const kept = {};
+  for (const key of ["id", "createdAt", "requirements", "brief", "useCases", "assessment", "decisions", "gate", "needs", "assumptions", "openQuestions", "extensions", "facts", "workflow", "asked", "lastAsked", "sketchOffered", "estimate", "reviewAccepted", "conceptSig", "choices"]) if (current[key] !== undefined) kept[key] = current[key];
+  // The problem statement is the client's, not the design's.
+  if (current.requirements?.trim()) kept.requirements = current.requirements;
+  return { ...next, ...kept };
+}
+
+// Offline consultant answers for questions about the engagement itself.
+export function consult(message, project) {
+  const t = message.toLowerCase();
+  const brief = project.brief || {};
+  const cases = project.useCases || [];
+  const open = BRIEF_FIELDS.filter((f) => !brief[f.id]?.trim());
+  if (/ask next|next question|what should i ask/.test(t))
+    return open.length
+      ? `Ask about ${open[0].label.toLowerCase()}: “${open[0].question}”${open[1] ? `\n\nThen ${open[1].label.toLowerCase()}.` : ""}`
+      : "The brief is complete. Play it back to the client to confirm, then qualify the use cases.";
+  if (/summari[sz]e|what we know|play back/.test(t)) {
+    const known = BRIEF_FIELDS.filter((f) => brief[f.id]?.trim());
+    return [
+      project.requirements ? `Problem: ${project.requirements}` : "Problem: not captured yet.",
+      ...known.map((f) => `${f.label}: ${brief[f.id].replace(/\n/g, "; ")}`),
+      open.length ? `Still unknown: ${open.map((f) => f.label.toLowerCase()).join(", ")}.` : "Nothing major unknown.",
+    ].join("\n");
+  }
+  if (/viable|qualif|rule out|use cases?/.test(t)) {
+    if (!cases.length)
+      return "No use cases listed yet. Add each one you heard in Discover. Pursue only what is high value with acceptable risk and a clear strategic fit; rule out the rest explicitly so nobody invests in them by accident.";
+    const by = (v) => cases.filter((c) => c.verdict === v).map((c) => c.title || "untitled");
+    const risky = cases.filter((c) => c.verdict === "Pursue" && (c.risk === "High" || c.value === "Low"));
+    return [
+      `Pursue: ${by("Pursue").join(", ") || "none"}.`,
+      `Park: ${by("Park").join(", ") || "none"}.`,
+      `Ruled out: ${by("Rule out").join(", ") || "none"}.`,
+      ...risky.map((c) => `Check “${c.title}”: marked Pursue with ${c.risk === "High" ? "high risk" : "low value"}. Is that defensible?`),
+    ].join("\n");
+  }
+  if (/evidence|scale|go live|production/.test(t))
+    return "Scale only when value demonstrably exceeds cost and risk. Before scaling, record in Build: who used the prototype and what changed (adoption), measured value against run and build cost (economics), and the open risks with who accepted them. Every success measure should pass on the current design.";
+  return null;
+}

package/src/engineering-client.mjs

@@ -0,0 +1,73 @@
+// Backend-owned jobs: no native thread IDs, host paths or model credentials.
+import {unzipSync} from 'fflate';
+export async function engineeringCall(session, action, payload, {signal,fetcher=fetch}={}) {
+  if(!session?.token)throw new Error('Connect to the session service first.');
+  const response=await fetcher(`/api/engineering/${action}`,{method:'POST',signal,
+    headers:{'Content-Type':'application/json',Authorization:`Bearer ${session.token}`},body:JSON.stringify(payload)});
+  if(!response.ok){
+    let detail;try{detail=(await response.json()).detail;}catch{}
+    const error=new Error(typeof detail==='string'?detail:'The engineering request could not be accepted. Your draft is retained.');
+    error.status=response.status;throw error;
+  }
+  if(action==='download'||action==='handoff')return response;
+  return response.json();
+}
+
+export function mergeEngineeringEvents(current,incoming){
+  const bySequence=new Map(current.map(event=>[event.sequence,event]));
+  for(const event of incoming)bySequence.set(event.sequence,event);
+  return [...bySequence.values()].sort((a,b)=>a.sequence-b.sequence);
+}
+
+export async function verifiedEngineeringDownload(session,payload,manifest,options){
+  const response=await engineeringCall(session,'download',payload,options);
+  const bytes=await response.arrayBuffer();
+  const digest=[...new Uint8Array(await crypto.subtle.digest('SHA-256',bytes))].map(x=>x.toString(16).padStart(2,'0')).join('');
+  if(digest!==manifest.sha256 || response.headers.get('X-Artifact-Sha256')!==digest)
+    throw new Error('The package digest did not match its capture receipt. Download was stopped.');
+  return new Blob([bytes],{type:'application/zip'});
+}
+
+export async function verifiedHandoffDownload(session,payload,manifest,options){
+  const response=await engineeringCall(session,'handoff',payload,options);
+  const bytes=await response.arrayBuffer();
+  const digest=[...new Uint8Array(await crypto.subtle.digest('SHA-256',bytes))].map(x=>x.toString(16).padStart(2,'0')).join('');
+  if(response.headers.get('X-Artifact-Sha256')!==digest||response.headers.get('X-Source-Artifact-Sha256')!==manifest.sha256)
+    throw new Error('The handoff digest or source package did not match its receipt. Download was stopped.');
+  let expanded=0;
+  const files=unzipSync(new Uint8Array(bytes),{filter:entry=>{
+    expanded+=entry.originalSize;
+    if(expanded>150_000_000)throw new Error('The handoff exceeds its receiving size bound. Download was stopped.');
+    return true;
+  }});
+  const sha=async value=>[...new Uint8Array(await crypto.subtle.digest('SHA-256',value))].map(x=>x.toString(16).padStart(2,'0')).join('');
+  const original=files['evidence/original-implementation.zip'];
+  if(!original||await sha(original)!==manifest.sha256)
+    throw new Error('The original implementation inside the handoff did not match its receipt. Download was stopped.');
+  const expected=manifest.files.filter(file=>file.kind==='file');
+  const receiving=Object.keys(files).filter(name=>name.startsWith('implementation/')&&!name.endsWith('/'));
+  if(receiving.length!==expected.length)throw new Error('The handoff file inventory changed. Download was stopped.');
+  for(const file of expected){
+    const content=files['implementation/'+file.path];
+    if(!content||content.byteLength!==file.bytes||await sha(content)!==file.sha256)
+      throw new Error('An implementation file inside the handoff did not match its receipt. Download was stopped.');
+  }
+  return new Blob([bytes],{type:'application/zip'});
+}
+
+
+// User requests and model deltas remain separate from tool-progress/acceptance claims.
+export function engineeringConversation(events){
+  const ordered=mergeEngineeringEvents([],events),accepted=new Set(ordered.filter(e=>e.kind==='steering_accepted').map(e=>e.requestId)),uncertain=new Set(ordered.filter(e=>e.kind==='steering_delivery_uncertain').map(e=>e.requestId));
+  const entries=[];
+  for(const event of ordered){
+    if(event.kind==='accepted'&&event.origin!=='automatic_repair'&&typeof event.text==='string')entries.push({id:event.sequence,role:'user',text:event.text,status:'accepted'});
+    else if(event.kind==='steering_submitted'&&typeof event.text==='string')entries.push({id:event.sequence,role:'user',text:event.text,status:accepted.has(event.requestId)?'accepted':uncertain.has(event.requestId)?'uncertain':'pending'});
+    else if(event.kind==='message'&&typeof event.text==='string'){
+      const previous=entries.at(-1);
+      if(previous?.role==='assistant'&&previous.runId===event.runId)previous.text+=event.text;
+      else entries.push({id:event.sequence,role:'assistant',runId:event.runId,text:event.text});
+    }
+  }
+  return entries;
+}

package/src/engineering-defaults.mjs

@@ -0,0 +1,17 @@
+// Reuse user-accepted placement without asking for the same fact on every block.
+// This does not verify regional service availability or invent a residency decision.
+export function prefillAcceptedSettings(project){
+ const accepted=subject=>(project.decisions||[]).filter(d=>d.subject===subject&&d.status==='Accepted').at(-1)?.decision;
+ const region=accepted('cloud.region'),provider=accepted('platform.cloud')||project.provider;
+ if(typeof region!=='string'||!region.trim()||!['aws','azure','gcp','ibm'].includes(provider))return project;
+ const applied=[];
+ const nodes=project.nodes.map(n=>{
+  const d=n.data,current=d.config?.region;
+  if(d.kind==='note'||d.provider!==provider||(d.origin==='existing'&&d.deploymentMode!=='create')||(current&&!/^(to be selected|unknown|undecided|tbd)$/i.test(current.trim())))return n;
+  applied.push({componentId:n.id,field:'config.region',value:region,basis:'User-accepted project cloud.region decision'});
+  return {...n,data:{...d,config:{...d.config,region}}};
+ });
+ if(!applied.length)return project;
+ const previous=(project.extensions?.engineeringDefaults||[]).filter(x=>!applied.some(a=>a.componentId===x.componentId&&a.field===x.field));
+ return {...project,nodes,extensions:{...project.extensions,engineeringDefaults:[...previous,...applied]}};
+}

package/src/engineering.css

@@ -0,0 +1,31 @@
+.engineering-panel { min-width: 0; }
+.engineering-panel form { display: grid; gap: .6rem; margin: 1rem 0; }
+.engineering-panel textarea { width: 100%; box-sizing: border-box; resize: vertical; font: inherit; min-height: 7rem; }
+.engineering-panel button { max-width: 100%; white-space: normal; }
+.engineering-actions { display: flex; flex-wrap: wrap; gap: .5rem; margin: 1rem 0; }
+.engineering-message { white-space: pre-wrap; overflow-wrap: anywhere; font: inherit; max-height: 22rem; overflow: auto; }
+.engineering-panel details { max-height: 16rem; overflow: auto; overflow-wrap: anywhere; }
+.engineering-panel ol { padding-left: 1.5rem; }
+.engineering-panel li { margin: .4rem 0; }
+.engineering-artifact { margin-top: 1rem; padding: .8rem; border: 1px solid currentColor; border-radius: .5rem; }
+.artifact-checks { margin-top: 1rem; border-top: 1px solid currentColor; padding-top: .8rem; }
+.artifact-checks h3 { margin: 0; }
+.artifact-checks button { margin: .3rem .3rem .3rem 0; }
+.artifact-checks pre { white-space: pre-wrap; overflow-wrap: anywhere; font-size: .8rem; }
+
+.app.build-workspace { grid-template-columns:minmax(0,1fr); grid-template-rows:auto minmax(0,1fr); height:100dvh; min-height:100vh; }
+.build-workspace .canvas { overflow:auto; background:var(--paper); }
+.build-workspace .component-navigator,.build-workspace .current-view { display:none; }
+.native-work-area { max-width:960px; margin:0 auto; padding:clamp(16px,3vw,40px); }
+.engineering-conversation { display:grid; gap:1rem; margin:1.5rem 0; }
+.engineering-entry { min-width:0; border-left:3px solid var(--line); padding:.5rem 1rem; }
+.engineering-entry.user { background:var(--board); border-radius:.5rem; }
+.engineering-entry pre { white-space:pre-wrap; overflow-wrap:anywhere; font:inherit; max-height:24rem; overflow:auto; }
+.engineering-panel textarea { border:1px solid var(--color-line-strong); border-radius:10px; padding:12px; background:var(--board); }
+.engineering-panel button { border:1px solid var(--line); border-radius:8px; background:var(--paper); padding:8px 12px; min-height:38px; }
+.engineering-panel form > button { justify-self:start; background:var(--action); color:var(--color-brand-ink); border-color:transparent; font-weight:600; min-width:128px; }
+.architecture-work { margin: .8rem 0; }
+.engineering-panel details.architecture-work { max-height: none; overflow: visible; }
+.architecture-work > ul { max-height: 24rem; overflow: auto; padding-left: 1.3rem; }
+.architecture-work pre { white-space: pre-wrap; overflow-wrap: anywhere; font-size: .8rem; }
+.architecture-work small { display: block; }

package/src/enterprise-application.mjs

@@ -0,0 +1,76 @@
+import sources from'./runtime/enterprise-application-sources.json'with{type:'json'};
+
+// A source package is not a supported complete-project capability. Native hosting,
+// account inputs, model/source/SQL configuration and whole-export gates must bind it.
+export function enterpriseApplicationFiles(provider,address){
+ if(!['aws','azure','gcp','ibm'].includes(provider)||typeof address!=='string'||!/^block_[0-9a-f]+$/.test(address))throw Error('Use the explicit private application provider and canonical address');
+ const root='applications/'+address+'/',files={},manifest=sources.manifest;
+ const names=[...manifest.files,...manifest.providerFiles[provider]];
+ for(const name of names){if(typeof sources.files[name]!=='string')throw Error('Missing private application asset '+name);files[root+'runtime/'+name]=sources.files[name];}
+ const lockName='enterprise-runtime-'+provider+'-python-lock.json',lock=JSON.parse(sources.files[lockName]);
+ if(lock.provider!==provider||typeof lock.requirements!=='string'||!lock.requirements.includes('--hash=sha256:'))throw Error('Use the exact selected-provider dependency closure');
+ files[root+'requirements.lock']=lock.requirements;files[root+'dependency-lock.json']=sources.files[lockName];
+ files[root+'Dockerfile']=sources.files['enterprise-runtime.Dockerfile'];
+ files[root+'container-base.json']=sources.files['python-container-lock.json'];
+ files[root+'application-manifest.json']=JSON.stringify({format:manifest.format,provider,files:names,entrypoints:manifest.entrypoints,
+  sourceHashes:Object.fromEntries([...names,'enterprise-runtime.Dockerfile',lockName,'python-container-lock.json'].map(name=>[name,sources.hashes[name]])),
+  documentWorkerImplemented:manifest.nativeDocumentWorkerProviders.includes(provider),wholeProjectQualified:false},null,2)+'\n';
+ files[root+'.dockerignore']='*\n!Dockerfile\n!requirements.lock\n!runtime/\n'+names.map(name=>'!runtime/'+name+'\n').join('');
+ files[root+'configuration-contract.json']=JSON.stringify({format:'enterprise-process-configuration-v1',provider,
+  deployment:{direct:'ENTERPRISE_DEPLOYMENT_JSON',mountedFile:'ENTERPRISE_DEPLOYMENT_FILE',defaultFile:'/app/enterprise-deployment.json',schema:'enterprise-knowledge-v1',maximumBytes:32768},
+  documentExecutor:{direct:'ENTERPRISE_DOCUMENT_EXECUTOR_JSON',mountedFile:'ENTERPRISE_DOCUMENT_EXECUTOR_FILE',defaultFile:'/app/enterprise-document-executor.json',schema:'enterprise-document-executor-v1',maximumBytes:32768,provider,parserRevision:'Must equal the approved deployment/build receipt; not an invented digest.',nativeConfiguration:'Use the corresponding Terraform document_executor_configuration output.'},
+  suppliedSecrets:'Native platform injection or owned mounted files only; no secret values belong in this source package.',wholeProjectQualified:false},null,2)+'\n';
+ files[root+'BUILD.md']=BUILD;
+ for(const [directory,names,recipe]of [['parser/',manifest.parserFiles,'enterprise-document.Dockerfile'],['parser/pdf/',manifest.pdfParserFiles,'invoice-parser.Dockerfile']]){
+  for(const name of names)files[root+directory+(name===recipe?'Dockerfile':name)]=sources.files[name];
+  files[root+directory+'.dockerignore']='*\n'+names.filter(name=>name!==recipe).map(name=>'!'+name+'\n').join('');
+  files[root+directory+'source-manifest.json']=JSON.stringify({sourceHashes:Object.fromEntries(names.map(name=>[name,sources.hashes[name]])),scope:'Exact parser build sources; not a native isolation or security acceptance receipt.'},null,2)+'\n';
+ }
+ return files;
+}
+
+const BUILD=`# Private application delivery
+
+Build this exact directory as Linux/amd64 with the emitted Dockerfile and hash lock.
+The API is the default command. The manifest also records the dedicated worker and
+operator commands. Keep parser/OCR tools in their separate reviewed artifact: no
+document parser, Java runtime or Docker daemon runs in this credentialed worker.
+
+Build the supplied parser recipes separately, in this order, and record their
+actual inspected source/image identities before using them in native configuration:
+
+docker build --platform linux/amd64 -t atmem-private-pdf-base:local parser/pdf
+docker build --platform linux/amd64 --build-arg PDF_PARSER_IMAGE=atmem-private-pdf-base:local -t atmem-private-document:local parser
+docker build --platform linux/amd64 -t atmem-private-application:local .
+
+Local tags are build handles, not immutable publication evidence. Keep the exact
+image IDs/build receipts and obtain authorization before any registry publication.
+
+Supply the approved deployment as ENTERPRISE_DEPLOYMENT_JSON or an absolute
+ENTERPRISE_DEPLOYMENT_FILE mount. Supply exactly one form, never conflicting sources.
+The API reads only its deployment metadata; it does not construct a parser or model.
+For an implemented native worker, supply ENTERPRISE_DOCUMENT_EXECUTOR_JSON or its
+absolute FILE mount from the same Terraform output and parser build receipt. The
+worker checks provider, parser revision, native destination and worker identity before
+reading source/encryption secrets or SQL. No arbitrary plug-in, executable or URL
+can be selected through this configuration. Default worker concurrency is two;
+ENTERPRISE_WORKER_CONCURRENCY accepts one to four after capacity/quotas are reviewed.
+
+AWS and Google native document loading are implemented locally. Azure/IBM loading
+remains an implementation requirement; their application source/dependency emission
+does not advertise a complete worker or substitute another cloud. No complete
+private capability is promoted by these files.
+
+The configured worker attaches the durable cleanup ledger and runs recovery alongside
+question processing. Runtime startup never initializes schemas, adopts existing SQL
+state, creates company membership or generates replacement encryption keys. Use the
+operator lifecycle with separate existing native SQL identities before enabling it.
+Keep corporate OIDC/source registrations and approved directory mappings intact.
+
+Preserve image/source digests, reviewed dependency/security evidence and actual
+destination artifact publication records. Parser revision, local image configuration
+digest and registry manifest digest are distinct identities; never invent or equate
+them. Full application/worker/database/model/source networking, secrets, enrollment,
+artifact publication, operations and Spec Kit composition remain mandatory before
+whole-project acceptance. No account plan, publication or deployment ran here.
+`;

package/src/enterprise-aws-host-infrastructure.mjs

@@ -0,0 +1,62 @@
+import {resourceAddress} from './identifiers.mjs';
+import probeSource from './runtime/enterprise-aws-host-probe-source.json' with{type:'json'};
+import {CLOUD_PROVIDER_LOCKS}from'./cloud-provider-locks.mjs';
+import {awsHostVerificationTests}from'./enterprise-aws-host-tests.mjs';
+
+// Owned host-verification building block. This does not provision the EC2 pool,
+// document store, native execution permissions, application or complete export.
+export function awsHostVerificationTerraform(project,row,environment='staging'){
+ if(!project||typeof project.id!=='string'||!project.id||project.id.length>255||!Number.isSafeInteger(project.revision)||project.revision<1)throw Error('Use the owned project/revision');
+ if(!row||row.provider!=='aws'||typeof row.id!=='string'||!row.id||typeof row.region!=='string'||!(/^(af|ap|ca|eu|il|me|mx|sa|us)-(east|west|south|north|central|southeast|southwest|northeast|northwest)-[1-9]$/).test(row.region))throw Error('Preserve the explicit AWS provider and selected region');
+ encodeURIComponent(row.id);
+ const address=resourceAddress(row.id);
+ if(row.address!==address||!['staging','production','qualification'].includes(environment))throw Error('Use canonical component ownership and environment');
+ const n=address,v=name=>'${var.'+name+'}',r=(type,name,attribute)=>'${'+type+'.'+name+'.'+attribute+'}',l=name=>'${local.'+name+'}';
+ const literal=value=>value.replace(/\$\{/g,()=>'$${').replace(/%\{/g,()=>'%%{');
+ const variable={review_approved:{type:'bool',default:false,nullable:false,description:'Review the exact SSM command, existing worker IAM and host ownership before apply.'}},examples={review_approved:false};
+ function input(name,description,example,pattern,defaultValue){
+  variable[name]={type:'string',nullable:false,description,validation:{condition:'${can(regex('+JSON.stringify(pattern)+',var.'+name+'))}',error_message:'Supply the reviewed '+name+' input.'}};
+  if(defaultValue!==undefined)variable[name].default=defaultValue;examples[name]=example;return v(name);
+ }
+ const account=input('account_id','Existing destination account, never inferred from a source node.','123456789012','^[0-9]{12}$');
+ const region=input('region','Keep the selected architecture region; regenerate to change.',row.region,'^'+row.region+'$',row.region);
+ const cluster=input('cluster_arn','Existing owned parser ECS cluster. This module does not create/adopt a compute pool.','arn:aws:ecs:'+row.region+':123456789012:cluster/document-parser','^arn:aws:ecs:[a-z]{2}-[a-z]+-[1-9]:[0-9]{12}:cluster/[A-Za-z0-9_-]{1,255}$');
+ const worker=input('worker_role_arn','Existing question-worker IAM role; append one named policy without replacing its other policies.','arn:aws:iam::123456789012:role/question-worker','^arn:aws:iam::[0-9]{12}:role/[A-Za-z0-9_+=,.@/-]{1,128}$');
+ const seed='https://atmem.ai/workspaces/'+encodeURIComponent(project.id)+'/'+n+'/'+environment;
+ const locals={name:'${format("doc-host-%s",substr(sha256('+JSON.stringify(seed)+'),0,12))}',
+  policy_sha256:'${sha256(jsonencode({format="enterprise-aws-host-policy-v1",clusterArn=var.cluster_arn,probeSha256=sha256('+JSON.stringify(literal(probeSource))+')}))}',
+  expected:{format:'enterprise-aws-host-policy-v1',clusterArn:cluster,policySha256:l('policy_sha256')}};
+ const b64=btoa(Array.from(new TextEncoder().encode(probeSource),value=>String.fromCharCode(value)).join(''));
+ const launcher='import base64;exec(compile(base64.b64decode(\''+b64+'\'),"owned-host-probe","exec"))';
+ const quoted="'"+launcher.replace(/'/g,"'\"'\"'")+"'";
+ const prefix='exec /usr/bin/python3 -I -c '+quoted+' ';
+ locals.document={schemaVersion:'2.2',description:'Fixed read-only parser host inspection; no caller command or secret parameters.',parameters:{},
+  mainSteps:[{action:'aws:runShellScript',name:'verifyHost',precondition:{StringEquals:['platformType','Linux']},
+   inputs:{timeoutSeconds:'30',runCommand:['${format("%s%s",'+JSON.stringify(prefix)+',base64encode(jsonencode(local.expected)))}']}}]};
+ const resource={terraform_data:{[n+'_review']:{input:{design_revision:project.revision,source_component:literal(row.id),environment,
+  requested_worker_arn:worker,resolved_worker_arn:'${data.aws_iam_role.'+n+'_worker.arn}'},lifecycle:{precondition:[
+  {condition:v('review_approved'),error_message:'Review the selected host policy and existing worker before apply.'},
+  {condition:'${startswith(var.cluster_arn,format("arn:aws:ecs:%s:%s:cluster/",var.region,var.account_id))}',error_message:'Keep the parser cluster in the selected account/region.'},
+  {condition:'${startswith(var.worker_role_arn,format("arn:aws:iam::%s:role/",var.account_id))}',error_message:'Keep the referenced worker in the selected account.'},
+  {condition:'${data.aws_iam_role.'+n+'_worker.arn == var.worker_role_arn}',error_message:'The existing worker role must match the full accepted ARN, including its path.'}]}}}};
+ const data={aws_iam_role:{[n+'_worker']:{name:'${basename(var.worker_role_arn)}'}}};
+ const add=(type,name,body)=>((resource[type]??={})[name]={...body,depends_on:['terraform_data.'+n+'_review',...(body.depends_on||[])]});
+ add('aws_ssm_document',n,{name:l('name'),document_type:'Command',document_format:'JSON',target_type:'/AWS::EC2::Instance',content:'${jsonencode(local.document)}',
+  tags:{'atmem-document-policy':l('policy_sha256')},lifecycle:{prevent_destroy:true,postcondition:[{condition:'${self.hash_type == "Sha256" && can(regex("^[0-9a-f]{64}$",self.hash))}',error_message:'Require the native SHA256 document hash before exposing verification configuration.'}]}});
+ const doc=r('aws_ssm_document',n,'arn'),container='${format("arn:aws:ecs:%s:%s:container-instance/%s/*",var.region,var.account_id,basename(var.cluster_arn))}';
+ locals.worker_policy={Version:'2012-10-17',Statement:[
+  {Sid:'InspectOwnedCluster',Effect:'Allow',Action:['ecs:ListContainerInstances'],Resource:cluster},
+  {Sid:'InspectOwnedInstances',Effect:'Allow',Action:['ecs:DescribeContainerInstances'],Resource:container,Condition:{ArnEquals:{'ecs:cluster':cluster}}},
+  {Sid:'FixedProbeDocumentOnly',Effect:'Allow',Action:['ssm:GetDocument','ssm:SendCommand'],Resource:doc},
+  {Sid:'TaggedParserHostsOnly',Effect:'Allow',Action:['ssm:SendCommand'],Resource:'${format("arn:aws:ec2:%s:%s:instance/*",var.region,var.account_id)}',Condition:{StringEquals:{'ssm:resourceTag/atmem-document-policy':l('policy_sha256')}}},
+  {Sid:'ReadProbeInvocation',Effect:'Allow',Action:['ssm:GetCommandInvocation'],Resource:'*'}]};
+ add('aws_iam_role_policy',n,{name:l('name'),role:'${data.aws_iam_role.'+n+'_worker.name}',policy:'${jsonencode(local.worker_policy)}'});
+ const output={host_verification:{value:{clusterArn:cluster,hostPolicySha256:l('policy_sha256'),hostDocumentArn:doc,hostDocumentHash:r('aws_ssm_document',n,'hash'),hostDocumentVersion:'${tostring(aws_ssm_document.'+n+'.latest_version)}'},
+  depends_on:['aws_ssm_document.'+n,'aws_iam_role_policy.'+n],description:'Fixed command/worker policy only. Compute pool and complete private application are not provided by this module.'}};
+ const main={terraform:{required_version:'>= 1.17.1, < 2.0.0',required_providers:{aws:{source:'hashicorp/aws',version:'6.72.0'}}},provider:{aws:{region,allowed_account_ids:[account]}},variable,locals,data,resource,output};
+ return {'main.tf.json':JSON.stringify(main,null,2)+'\n','.terraform.lock.hcl':CLOUD_PROVIDER_LOCKS.aws,
+  'deployment.tfvars.json.example':JSON.stringify(examples,null,2)+'\n',
+  'tests/host-verification.tftest.hcl':awsHostVerificationTests(n,seed,row.region),
+  'host-policy-boundary.json':JSON.stringify({component:row.id,address:n,provider:'aws',region:row.region,scope:'Fixed SSM verifier and additive existing-worker policy; not a compute pool or complete private export.',wholeProjectQualified:false,cloudOperations:false},null,2)+'\n',
+  'README.md':'# Owned AWS parser-host verification\n\nThis module creates one fixed, parameterless SSM command and appends one named policy to the existing question worker. It references the selected existing parser cluster. It does not create a compute pool, replace a worker role, deploy an application or register a complete private capability.\n\nOnly this SSM document may be submitted, and only instances tagged with the exact policy fingerprint may be targeted. The worker pins native document version/hash, independently checks command content and restricts task placement to the instances it just verified. GetCommandInvocation requires resource wildcard in the native IAM contract; no command discovery, document mutation or Parameter Store read is granted. Account inherited permissions still require inspection.\n\nProvision the dedicated private host pool with matching ECS/daemon/IMDS settings and tags before use. This module deliberately emits no ready parser configuration or invented image/AMI. Runtime/identity, host drift, IAM and eventual native behavior remain subject to independent destination qualification. No account plan or deployment has run.\n'};
+}

package/src/enterprise-aws-host-tests.mjs

@@ -0,0 +1,15 @@
+export function awsHostVerificationTests(n,seed,region){
+ const name=`format("doc-host-%s",substr(sha256(${JSON.stringify(seed)}),0,12))`;
+ const run=(name,body)=>`run "${name}" {\n command = plan\n${body}\n}\n`;
+ const assertion=(condition,message)=>` assert {\n condition = ${condition}\n error_message = ${JSON.stringify(message)}\n }`;
+ let text=`mock_provider "aws" {}\noverride_resource {\n override_during = plan\n target = aws_ssm_document.${n}\n values = {\n arn = format("arn:aws:ssm:${region}:123456789012:document/%s",${name})\n hash = "${'f'.repeat(64)}"\n hash_type = "Sha256"\n latest_version = 1\n }\n}\nvariables {\n review_approved = true\n account_id = "123456789012"\n cluster_arn = "arn:aws:ecs:${region}:123456789012:cluster/document-parser"\n worker_role_arn = "arn:aws:iam::123456789012:role/question-worker"\n}\n`;
+ text+=`override_data {\n target = data.aws_iam_role.${n}_worker\n values = {\n arn = "arn:aws:iam::123456789012:role/question-worker"\n name = "question-worker"\n }\n}\n`;
+ text+=run('fixed_host_verification',assertion(`length(keys(jsondecode(aws_ssm_document.${n}.content).parameters)) == 0 && length(jsondecode(aws_ssm_document.${n}.content).mainSteps) == 1 && jsondecode(aws_ssm_document.${n}.content).mainSteps[0].action == "aws:runShellScript"`,'Only the fixed parameterless probe is allowed.')+'\n'+assertion(`output.host_verification.hostDocumentVersion == "1" && output.host_verification.hostDocumentHash == "${'f'.repeat(64)}" && output.host_verification.clusterArn == var.cluster_arn && length(output.host_verification.hostPolicySha256) == 64`,'Runtime must receive exact native document identity and selected host policy.'));
+ text+=run('worker_permission_boundary',assertion(`aws_iam_role_policy.${n}.role == "question-worker" && length(jsondecode(aws_iam_role_policy.${n}.policy).Statement) == 5 && jsondecode(aws_iam_role_policy.${n}.policy).Statement[2].Resource == aws_ssm_document.${n}.arn && toset(jsondecode(aws_iam_role_policy.${n}.policy).Statement[2].Action) == toset(["ssm:GetDocument","ssm:SendCommand"])`,'Preserve the existing worker and grant only this probe document.')+'\n'+assertion(`jsondecode(aws_iam_role_policy.${n}.policy).Statement[3].Condition.StringEquals["ssm:resourceTag/atmem-document-policy"] == output.host_verification.hostPolicySha256 && toset(jsondecode(aws_iam_role_policy.${n}.policy).Statement[4].Action) == toset(["ssm:GetCommandInvocation"])`,'Only tagged hosts and invocation reads; no caller-selected commands or Parameter Store authority.'));
+ text+=run('review_required',` variables { review_approved = false }\n expect_failures = [terraform_data.${n}_review]`);
+ text+=run('foreign_cluster_rejected',` variables { cluster_arn = "arn:aws:ecs:${region}:000000000000:cluster/foreign" }\n expect_failures = [terraform_data.${n}_review]`);
+ text+=run('foreign_worker_rejected',` variables { worker_role_arn = "arn:aws:iam::000000000000:role/foreign" }\n expect_failures = [terraform_data.${n}_review]`);
+ text+=run('wrong_worker_path_rejected',` variables { worker_role_arn = "arn:aws:iam::123456789012:role/incorrect-path/question-worker" }\n expect_failures = [terraform_data.${n}_review]`);
+ text+=run('region_drift_rejected',` variables { region = "us-east-1" }\n expect_failures = [var.region]`);
+ return text;
+}