refactor: Complete native Copilot migration and instruction remediation

[jonathan-vella]

Current delivery: native Copilot migration and instruction audit remediation

Current head: 51d596209bfefe808f6bc4a62bef111ae1afa3e7 (previous head: 03c1fa9918147ac1fbaf606fcf75b229adc41503).
Latest delivery:

• Reloaded VS Code Agent Host session (7735cb43-97f0-4d6e-9a31-8edd63dcc75b) acceptance and full real-Azure cp-harness-01 E2E run (Steps 1 -> 2 -> 3.5 -> 4 -> 5 -> 6 -> 7 -> Post-Lessons, 32 resources in rg-cp-harness-01-dev, 5 structured challenger-review-subagent receipts verified via record-review.mjs + --verify-cache).
• Applied cp-harness-01 lessons learned (LL-001–LL-004, commit e480c7c1).
• Incorporated Dependabot PRs (#756, #765, #766) with 7-day packagefeedproxy.microsoft.io quarantine compatibility, aligned collect-governance-baseline.ps1 with discover.py (#763), archived migration packets into .archive/post-cpharness-cleanup-20261019.tar.gz (e0e46517), and added downstream apex-accelerator validation compatibility (51d59620).

Full-repo workflow contract audit & validator remediation (03c1fa99)

• Aligned tools/apex-recall/docs/decision-keys.md complexity enum (simple | standard | complex) with workflow-graph.json and validate-session-state.mjs, and registered workflow toggles (governance_depth, identity_resolution, diagnostics_strategy) and system keys (sku_overrides, challenger_skip, compliance, budget, architecture_pattern).
• Synced top-level iac_tool and region in apex-recall decide, transition, and show, and updated complete-step to validate multi-pass (pass1–pass3) and simple-tier deep reviews.
• Documented subnet-plan.schema.json and lesson-log.schema.json enum constraints in vnet-planning.md, lesson-collection.instructions.md, 01-orchestrator.agent.md, 02-requirements.agent.md, and 03-architect.agent.md.
• Fixed validator false negatives and logic gaps across validate-decision-keys.mjs, validate-lens-references.mjs, validate-context-budget.mjs, validate-challenger-presence.mjs, validate-iac-contract-consistency.mjs, validate-iac-handoff.mjs, validate-workflow-graph.mjs, validate-environment-manifest.mjs, validate-policy-property-map.mjs, validate-session-state.mjs, validate-no-hardcoded-counts.mjs, validate-orphaned-content.mjs, and tools/tests/workflow-handoffs/run.test.mjs.
• Wired all standalone contract validators and unit test suites into validate:_node and validate:_node-ci, eliminated all skill/orphaned-content lint warnings, and regenerated tools/registry/architecture-explorer-graph.json (67/67 Node checks + 331/331 Python apex-recall tests passing).

Shared structured reviewer candidate

• Automatic producers, Orchestrator and optional 10-Challenger use the existing
  challenger-review-subagent; no new reviewer or model pin was added.
• The shared leaf has read/search tools only and returns JSON. It never writes findings/scratch,
  runs shell/code, asks questions or delegates. The parent captures inputs and records actual events.
• New metadata binds both shared procedure and actual leaf definition. New recorder publication accepts
  that actual identity only; explicit JSON execution failures surface their real stage/error without publication.
  Historical file-output schemas and rubber-duck receipts/extraction retain read-only compatibility.
• All caller allowlists, graph/exported registry, authoring/operating/root instructions and related skills
  were audited and aligned: Azure defaults review/deep/gate references, workflow-engine execution/integration/
  handoff/lifecycle references, agent-authoring guardrails and golden principles.
• Manual batches use lenses, with the same recorded batch_results; prior findings are null or compact
  actual-finding arrays, retaining IDs/severity/source paths. No duplicated manual file-output review mode remains.
• The profiler now recognizes both historical/current reviewer identities, verifies the actual linked worker,
  and counts the real successful CLI dispatch as one Step 1 review. Existing attempts/caps are not reset.
• After reloading the VS Code window, a fresh VS Code Agent Host session (7735cb43-97f0-4d6e-9a31-8edd63dcc75b)
  attached the updated challenger-review-subagent definition and ran the bounded Step 1 cp-harness-01
  requirements review probe (request_id: cp-harness-01-requirements-review-1, worker 05389820-d0af-4cee-a589-62331b976da3,
  tool call call_MHxNZTd5UndiM0hLVEVxYlFJYmk, completed 2026-10-19T11:27:38.449Z). It performed read-only file/search
  inspection without writing files, returned raw typed JSON (overall_assessment: "APPROVED", 0 must_fix, 0 should_fix,
  2 suggestion), and passed both record-review.mjs atomic publication and validate-challenger-findings.mjs --verify-cache
  with 0 errors. (Two earlier pre-reload probes in the previous VS Code window had returned the old file-output refusal.)
• The owner chose one fresh CLI test rather than an override/wrapper fallback. CLI session
  1a7ac903-df65-4910-ab0e-776f00b4051f invoked actual worker d25e954f-4c0e-47f7-82c7-9f8ccf6878a1.
  It returned typed JSON; actual-event recording and strict schema/provenance/freshness passed, also
  against final current source. Refused replay preserved the receipt bytes. Its fixture verdict is not user approval.
• Recorder tests: 108 passed; SDK accounting tests: 117 passed. Final isolated validate:all passed
  53 Node entries and external Python suites. Existing projects were excluded, not repaired or waived.
• Docs candidate is 82a0261b937834dcde6de2301682cde853f9da95, with build/content/internal links and 13 tests passing.
  Current remote source/docs status is in the Checks tabs.
• No real project/state/review history, counters, credentials or Azure resources changed.
  No merge, auto-merge, package/site publication or production approval occurred.

Earlier model-backed CLI findings, October 19

Earlier backend failure, preserved as history. The built-in CLI reviewer returned prose, so the unchanged
recorder rejected it. No valid review receipt or Gate 1 approval was created.
This is CLI evidence, not proof of the same behaviour in the supported VS Code harness.

• Copilot CLI 1.0.98 made five model-backed launches, including one exact-session resume:
  four distinct root sessions and one independent native reviewer context.
  Counting the resume and child conservatively gives six context launches.
• Actual events showed custom-agent selection and attached role/repository instructions.
  Read-only tool projection and disabled MCP status were observed; no general credential-isolation
  guarantee is inferred. Existing projects and credentials were not changed.
• Requirements offered only missing industry/timeline choices, but its first wrapper added unsupported
  root type/required. The existing native-form validator rejected it.
  Producer/parent guidance now requires only requestedSchema.properties, keeps envelope metadata
  outside direct tool calls and bounds schema correction without repeating settled answers.
• A fresh session using the unchanged original prompt passed after the initial guidance repair.
  Exact-session continuation also retained custom answers and returned guided workload questions.
• A separate Requirements session returned actual REVIEW_REQUIRED. The parent dispatched exactly one
  synchronous rubber-duck; the actual request matched prepared scope and captured metadata.
• That worker completed its reads but returned prose and reported a configured critic-format conflict.
  The response was preserved, not converted to findings, retried or approved. Recorder integrity,
  review budgets and reviewer selection are unchanged.
• Native usage was complete for every launch. Latest cumulative usage per root session totals
  33932850000 in the emitted totalNanoAiu field and 5 in the native legacy premium-request-cost field.
  Resumed and child usage is not counted twice. No USD or unverified credit conversion is claimed.
• Focused tests: 129 passed; native-form Python: 31 passed; full isolated source validation:
  53 Node entries plus external Python passed. Docs build/content/internal links and 13 tests passed.
• Exact IDs, prompts, raw events, usage and expected/observed results remain in the session-owned
  evidence directory outside the checkout. Current remote results are in the Checks tab.
• Next acceptance step: a separately authorized typed-review probe in supported VS Code before
  changing production review architecture. No CLI-only adaptation expands product support.

Instruction audit remediation

• Removed blind terminal confirmation and distinguished noninteractive execution from authorization.
• Corrected governance JSON guidance to required_value and conditional mapping fields.
• Reconciled Markdown/artifact templates and enforcement scopes; fixed the model-policy link.
• Expanded documentation triggers and clarified CI jobs, shell-linter scope and canonical policy ownership.
• Removed ineffective Local-only customization-location settings from workspace/devcontainer configuration.
  The validator now rejects them; Copilot uses conventional or explicitly configured SDK discovery roots.
• Added pinned PSScriptAnalyzer 1.24.0 provisioning, fail-closed maintained-source analysis,
  negative fixtures, package commands, development-container setup, CI and Git-hook integration.
• Retired fix:artifact-h2: use npm run fix:artifacts -- <artifact-path> to preview,
  then add --apply for reviewed changes. Updated callers and migration documentation.
• Preserved main/leaf boundaries, approval/review integrity, live-policy precedence and historical evidence.
  Existing project/state/lock and project-infrastructure files remain outside the commit.

Earlier zero-credit unattended validation and repair

• Owner authorized a bounded validate/fix/publish pass with zero Copilot CLI AI credits.
  Copilot CLI 1.0.98 was identified through version/help; no model-backed CLI sessions or new reviewers ran.
• The exact source-only baseline and final staged repair both passed full npm run validate:all:
  53 Node validation entries, no failures, plus the external Python suites.
• Additional Git-hook tests, full JavaScript lint/format checks and CI-only reference validation passed.
• Extra edge-case probes found that negated Greenfield labels suppressed valid migration intake,
  while coordinated negated migration/modernization labels triggered irrelevant questions.
  The helper now strips the complete explicitly negated scenario list before branching.
• Seven new regression cases failed before the fix and pass afterward. The focused
  discovery/recorder/Orchestrator suite passed 128 tests.
• Four complete synthetic discovery ledgers passed the actual Python native-form validator,
  preserving captured answers and explicit unknowns without duplicate questions.
• Existing synthetic review/recovery/risk-boundary tests passed 84 cases.
  These are offline fixtures, not real reviewer or human-approval evidence.
• Documentation build/content/links and editorial/anchor checks passed; existing documentation
  compatibility tests also passed. No existing projects, reviews, attempt counters or credentials changed.
• Current remote results are in the Checks tab. No VS Code UI or CLI runtime acceptance is inferred
  from deterministic tests, and no Azure operation or review retry was authorized by this pass.

Instruction-audit verification at a96c6a3

• 65 focused instruction, shell, setup and PowerShell regressions passed without skips.
• 114 preserved guidance/vendor/runtime-contract regressions passed.
• The complete configured external validation suite passed, as did JavaScript/Markdown lint,
  instruction checks, strict Explorer registry checks, changed-file formatting and Git-hook tests.
• Commit hooks passed, including artifact snapshot validation, formatting/lint, PowerShell and secret scanning.
• All ten diff-based pre-push checks passed; no hooks or protections were bypassed.
• Full validation against the current local workspace is not green: seven checks fail on pre-existing,
  untracked project artifacts (structure, state, review provenance/presence, lesson schema,
  SKU coverage and decision schemas). These were not rewritten or waived.
• Repository-wide formatting flags 101 unchanged files; all changed/new remediation files pass.
• Optional MCP SDK lifecycle cases and CairoSVG-dependent rendering cases remain skipped;
  no runtime/protocol or rendering acceptance is inferred.
• All remote Actions checks at a96c6a31 subsequently passed, including both container architectures
  and the baseline/candidate verdict comparison. Earlier migration results below remain historical.

Official evidence: Copilot customization migration,
SDK discovery locations,
GitHub job semantics,
and PSScriptAnalyzer.

Delivered

• Removed active UI handoff metadata after the owner selected Copilot/Probe Source and observed no controls.
  This is tested-client evidence, not a universal platform claim. 00-handoff.md remains recovery data.
• Removed custom worker readiness/nonce/execution envelopes and per-worker log preflights from every body.
  Native tasks use actual results and supported same-task handles; one-shot tasks are not universally resumable.
• Every interactive main declares native ask_user, including Requirements, Architect, Design and Governance.
  Direct selection can ask material questions; delegated mains return the form to their interactive parent.
• Every leaf retains its exact file/text/verdict failure/output mode without questions or nested delegation.
• Preserved Azure governance/security, SKU/AVM/contracts, review cadence, actual reviewer receipt/freshness,
  durable state trust, destructive/change approval and ownership constraints.
• Updated all relevant shared guidance, meaningful validators, tests, graph annotations and generated metadata.
• At the full-body migration baseline, active agent source changed from 9,889 to 4,151 lines.
  Later correctness fixes are included in the current head; no token/cost/latency savings are claimed.
• Kept owner-deleted runtime hooks absent and existing Git/security checks intact.
• Repaired the CI-only legacy reference checker to accept zero UI handoffs while retaining invalid-target,
  empty-inventory and literal-name failures. The initial remote failure was reproduced and regression-tested.

Requirements and automatic-review corrections

• A selected Orchestrator continues into Requirements instead of asking the owner to select the same role again.
• Guided industry, outcome, scenario, timeline, sizing, budget and private-access menus replace vague intake.
  Native freeform values stay in the same field; there are no separate Other companions.
• Greenfield skips migration-only questions. Captured answers and explicit unknowns accompany every continuation.
  Existing company-size/workload answers are not asked again. Implementation contacts, principal IDs and runtime
  bindings are deferred to the stage that consumes them, without relaxing security or later gates.
• If a delegated producer cannot nest tasks, REVIEW_REQUIRED routes the same independent native rubber-duck
  through the authorized interactive parent as a sibling. Manual Challenger is not a routine detour.
• The owner-supplied cp-harness-01 retry reached this reviewer dispatch, but a reviewer shell command was
  safety-blocked. The recorder correctly rejected the interaction. No valid review sidecar or approval resulted.
• Removed the unnecessary executable-draft requirement. The reviewer returns substantive JSON directly;
  the unchanged recorder derives IDs/counts and checks schema, attribution, original metadata and freshness.
  Failed-command rejection remains intact. Requirements review is stage-aware and cannot invent approved
  operational targets, authentication exceptions or automatic hard-cap spending enforcement.

Earlier migration validation (before instruction remediation)

• Full npm run validate:all in an isolated exact source candidate: 53 Node validation entries pass,
  no failures, with external Python suites passing.
• Pre-remediation tooling aggregate: 851 passed, 2 skipped; direct-JSON/recorder/agent tests: 109 passed.
  Guided-discovery/agent-policy tests: 65 passed; native rich-form Python tests: 30 passed.
• Preserved review-recording/risk/historical-event suites: 272 passed; review-ceiling checks/tests also pass.
• Independent all-agent source review found no blocking domain loss; recovery clarifications were fixed.
• Agent, skill, instruction, registry/model, graph, formatting/lint and changed live-link checks pass.
• The earlier head's GitHub PR checks passed, including source CI, external Python, security checks and
  baseline/candidate amd64/arm64 container builds and verdict comparison.
• All migration source and documentation changes are committed and pushed. The owner explicitly confirmed
  migration-only publication: generated project/state/lock and project-infrastructure files remain untracked,
  untouched and outside this PR. No empty commit was created.

Runtime limits: do not call this full certification

Actual named Requirements/Architect/Design/Governance tasks returned delegated missing-input forms.
Validation/manual-review leaves returned declared missing-input failures without fabricated execution.
Earlier current-session what-if/Terraform-plan tasks returned bare blocked, and cost demanded an obsolete
handshake despite updated source. The owner subsequently supplied fresh-session native-form transcripts for
all current user-facing main agents and role-specific missing-input failures for what-if/plan/cost,
without obsolete handshake requests. The bounded retests pass; older observations remain history.
This is owner-reported evidence, not a newly collected raw capture or proof of the earlier mismatch's cause.

The owner probe also showed Read/search with tools: []; tool restrictions and credential isolation
are not certified by source metadata. Cancellation/restart,
successful preview/pricing execution, genuine consequential approval and real-Azure E2E remain unverified.
Existing project/state validation failures and review freshness impacts are not waived or restamped.
Azure scope/budget/actions remain unprovided; no active account/default was substituted.

The latest retry establishes answer reuse during that resume and actual sibling review dispatch,
not a fresh guided-intake acceptance test or successful production recording.
The failed review attempt is preserved. No project review was rerun, no counter was reset, and
no historical hash, finding or approval was repaired by these source changes.
A further project review still requires explicit authorization within the existing allowance.

Delivery evidence

• All-agent body audit
• Execution status
• PRD
• Backlog

Companion documentation: jonathan-vella/apex-docs#43 at 82a0261b937834dcde6de2301682cde853f9da95.
Current documentation verify/smoke results are in that PR's Checks tab.
Full migration/consequential/Azure acceptance remains BLOCKED where genuine evidence is missing.
Source body completion is not a roster-retirement claim, new approval or permission to merge.

[Copilot]

🟡 Changes recommended

Critical shared-guidance conflicts block default direct dispatch; reconcile execution contracts while preserving approval and attribution checks.

6 open issues

• Reconcile direct dispatch with the shared execution handshake contract · New
• Align startup instructions with diagnostic-only handshake behavior · New
• Scope tool-free continuation requirements to diagnostic handshakes · New
• Clarify manual batch output versus automatic per-pass files · New
• Update migration guidance for direct dispatch and diagnostics · New
• Remove unsupported model-attestation requirement from feature description · New

What changed in this PR

Reopens the APEX migration to the Copilot SDK harness in VS Code, including Autopilot support.

Changes:

• Archives legacy prompt adapters and introduces canonical manual skills.
• Updates worker routing, native interactions, reviews, hooks, and telemetry.
• Revises validators, tests, schemas, CI, and migration acceptance plans.

File	Description
tools/​tests/​scripts/​test_validate_review_ceiling.py	Tests rejection of missing budget evidence.
tools/​tests/​scripts/​test_validate_question_batching.py	Updates native-form validation assertions.
tools/​tests/​scripts/​test_skill_ownership.mjs	Checks legacy adapter archival.
tools/​tests/​scripts/​test_risk_authorization.mjs	Updates supporting-input assertions.
tools/​tests/​scripts/​test_phase_a_runtime_guidance.mjs	Uses native SDK session fixtures.
tools/​tests/​scripts/​test_guidance_remediation.mjs	Updates routing and recovery assertions.
tools/​tests/​scripts/​test_execution_subagent_contract.mjs	Tests the active execution contract.
tools/​tests/​scripts/​test_context_baseline.mjs	Removes retired prompt expectations.
tools/​tests/​lib/​npm-script-graph.test.mjs	Expects no active prompt sources.
tools/​tests/​exec-plans/​active/​apex-workflow-audit.md	Links historical guidance to its archive.
tools/​tests/​bats/​subagent-validation.bats	Covers SDK responses and advisories.
tools/​scripts/​validate-skills.mjs	Updates replacement entry-point guidance.
tools/​scripts/​validate-orphaned-content.mjs	Removes retired prompt inputs.
tools/​scripts/​validate-no-hardcoded-counts.mjs	Excludes archived content.
tools/​scripts/​validate-models.mjs	Allows absent legacy model pins.
tools/​scripts/​validate-mcp-tool-refs.mjs	Stops scanning retired prompt roots.
tools/​scripts/​validate-instruction-checks.mjs	Limits scanning to active guidance.
tools/​scripts/​validate-explorer-graph.mjs	Removes retired source directories.
tools/​scripts/​validate-agent-registry.mjs	Handles optional legacy model mirrors.
tools/​scripts/​validate_question_batching.py	Validates native structured forms.
tools/​scripts/​snapshot-agent-context.sh	Removes retired prompt snapshot targets.
tools/​scripts/​safe-shell.mjs	Updates scanning and input-tool guidance.
tools/​scripts/​lint-json.mjs	Excludes archived JSON.
tools/​scripts/​generate-model-catalog.mjs	Clarifies legacy-pin generation.
tools/​scripts/​generate-explorer-graph.mjs	Represents the built-in reviewer.
tools/​scripts/​diff-context-baseline.sh	Removes retired prompt categories.
tools/​scripts/​check-repository-links.mjs	Skips missing cached paths.
tools/​scripts/​_lib/​paths.mjs	Clears active prompt sources.
tools/​scripts/​_lib/​model-helpers.mjs	Clarifies legacy assignment metadata.
tools/​schemas/​workflow-graph.schema.json	Distinguishes automatic and manual reviewers.
tools/​schemas/​model-catalog.schema.json	Supports descriptive runtime model identifiers.
tools/​schemas/​agent-scorecard.schema.json	Updates the assessment reference.
tools/​schemas/​agent-registry.schema.json	Makes legacy model metadata optional.
tools/​registry/​count-manifest.json	Removes retired prompt inventory tracking.
tools/​plans/​copilot-harness-migration/​roadmap.md	Defines staged migration acceptance.
tools/​plans/​copilot-harness-migration/​issues/​CHM-08-release-readiness.md	Records release acceptance requirements.
tools/​plans/​copilot-harness-migration/​issues/​CHM-07-published-docs.md	Defines documentation acceptance scope.
tools/​plans/​copilot-harness-migration/​issues/​CHM-06-observability.md	Defines telemetry acceptance; nit: model-identity requirements conflict with strict validation accepting missing model metadata.
tools/​plans/​copilot-harness-migration/​issues/​CHM-05-mcp-hooks.md	Defines MCP and hook verification.
tools/​plans/​copilot-harness-migration/​issues/​CHM-03-worker-readiness.md	Defines worker runtime verification.
tools/​plans/​copilot-harness-migration/​issues/​CHM-02-source-acceptance.md	Defines revision-bound source acceptance.
tools/​plans/​copilot-harness-migration/​issues/​CHM-01-ci-format.md	Scopes formatting remediation.
README.md	Introduces SDK entry points; nit: mandatory continuation claims do not distinguish diagnostic handshakes from direct execution attribution.
package.json	Exposes worker-readiness verification.
eslint.config.mjs	Excludes archived JavaScript.
CHANGELOG.md	Documents migration; nits: checklist incorrectly requires handshake/model evidence, and feature text promises model attestation the verifier no longer enforces.
AGENTS.md	Updates runtime guidance; critical: mandatory tool-free continuation conflicts with default direct dispatch.
.github/​workflows/​ci.yml	Adds Python setup for executable tooling tests.
.github/​terminology-blocklist.json	Excludes historical terminology.
.github/​skills/​README.md	Updates canonical manual skill names.
.github/​skills/​apex-workflow-start/​SKILL.md	Adds start/resume entry; critical: unconditional handshake requirement conflicts with default direct dispatch.
.github/​skills/​apex-workflow-engine/​templates/​workflow-graph.json	Selects the built-in automatic reviewer.
.github/​skills/​apex-workflow-engine/​SKILL.md	Updates dispatch and entry-point references.
.github/​skills/​apex-workflow-engine/​references/​review-imported-iac.md	Removes adapter dependency and updates input guidance.
.github/​skills/​apex-workflow-engine/​references/​project-wide-review.md	Inventories manual skills instead of prompts.
.github/​skills/​apex-workflow-engine/​references/​operational-safety.md	Updates SDK ownership and worker boundaries.
.github/​skills/​apex-workflow-engine/​references/​handoff-validation-rules.md	Recognizes the built-in reviewer.
.github/​skills/​apex-iac-common/​references/​placeholder-scan-protocol.md	Updates input-tool references.
.github/​skills/​apex-iac-common/​references/​iac-planner-approval-gate.md	Updates decision-panel guidance.
.github/​skills/​apex-iac-common/​references/​deploy-validation-checklist.md	Updates placeholder-input guidance.
.github/​skills/​apex-iac-common/​references/​deploy-shared-workflow.md	Updates deployment approval interactions.
.github/​skills/​apex-iac-common/​references/​codegen-shared-workflow.md	Updates native input and batching guidance.
.github/​skills/​apex-iac-common/​references/​codegen-do-dont.md	Updates interaction and reviewer terminology.
.github/​skills/​apex-golden-principles/​references/​principles.md	Updates independent-review boundaries.
.github/​skills/​apex-github-operations/​SKILL.md	Links the canonical commit entry point.
.github/​skills/​apex-github-operations/​references/​merge-sensei-free-pr.md	Replaces retired authoring references.
.github/​skills/​apex-github-operations/​references/​git-commit.md	Updates PR-decision input guidance.
.github/​skills/​apex-git-commit/​SKILL.md	Adds the manual commit entry point.
.github/​skills/​apex-debug-log-export/​SKILL.md	Adds the native-log export entry point.
.github/​skills/​apex-context-management/​SKILL.md	Updates native-log prerequisites and references.
.github/​skills/​apex-context-management/​references/​context-audit.md	Uses repository-scoped native logs.
.github/​skills/​apex-context-management/​references/​audit-setup.md	Documents native-log discovery and dependencies.
.github/​skills/​apex-azure-governance-discovery/​references/​resume-checks.md	Uses model-policy cache terminology.
.github/​skills/​apex-azure-governance-discovery/​references/​reconciliation-disposition.md	Returns recovery to the interactive parent.
.github/​skills/​apex-azure-governance-discovery/​references/​inline-resolution-gate.md	Updates batched-input guidance.
.github/​skills/​apex-azure-governance-discovery/​references/​baseline-check.md	Updates baseline-selection interactions.
.github/​skills/​apex-azure-defaults/​references/​vnet-planning.md	Updates network-planning interactions.
.github/​skills/​apex-azure-defaults/​references/​plan-design-decisions.md	Updates design-panel guidance.
.github/​skills/​apex-azure-defaults/​references/​cost-estimate-parent-contract.md	Makes worker routing model-neutral.
.github/​skills/​apex-azure-defaults/​references/​cost-alerts-baseline.md	Updates missing-email input guidance.
.github/​skills/​apex-azure-defaults/​references/​adversarial-review-deep.md	Separates review persistence; nit: manual batch guidance expects per-pass files instead of its single consolidated output.
.github/​skills/​apex-azure-artifacts/​templates/​01-requirements.template.md	Replaces retired prompt attribution.
.github/​skills/​apex-agent-authoring/​SKILL.md	Updates unpinned-agent authoring guidance.
.github/​skills/​apex-agent-authoring/​references/​runtime-guardrails.md	Updates execution and reviewer recovery contracts.
.github/​skills/​apex-agent-authoring/​references/​assess-github-folder.md	Removes the retired adapter reference.
.github/​skills/​apex-agent-authoring/​references/​assess-agents.md	Updates assessment links and interaction terminology.
.github/​skills/​apex-agent-authoring/​references/​agent-file-structure.md	Clarifies SDK routing and archived metadata boundaries.
.github/​instructions/​sku-manifest.instructions.md	Updates preference-collection guidance.
.github/​instructions/​references/​precedence-matrix.md	Removes active prompt instruction layering.
.github/​instructions/​no-interactive-shell.instructions.md	Updates active scope and input-tool references.
.github/​instructions/​markdown.instructions.md	Removes retired prompt documentation scope.
.github/​instructions/​context-optimization.instructions.md	Clarifies archived prompt boundaries.
.github/​instructions/​agent-skills.instructions.md	Documents canonical SDK manual entry points.
.github/​instructions/​agent-operating-frame.instructions.md	Updates delegation, review, and runtime boundaries.
.github/​hooks/​subagent-validation/​subagent-validation.sh	Handles SDK responses and native advisories.
.github/​copilot-instructions.md	Updates SDK contracts; critical: requiring complete-phase READY_VERIFIED blocks the default WORKER_EXECUTE/EXECUTE_VERIFIED path.
.github/​CODEOWNERS	Assigns ownership to active skills.
.github/​agents/​09-diagnose.agent.md	Removes pins and adds SDK interaction rules.
.github/​agents/​_subagents/​terraform-validate-subagent.agent.md	Removes pins and adds readiness rules.
.github/​agents/​_subagents/​terraform-plan-subagent.agent.md	Removes pins and adds readiness rules.
.github/​agents/​_subagents/​policy-precheck-subagent.agent.md	Removes pins and adds readiness rules.
.github/​agents/​_subagents/​cost-estimate-subagent.agent.md	Removes pins and adds readiness rules.
.github/​agents/​_subagents/​challenger-review-subagent.agent.md	Updates readiness and runtime-managed cache metadata.
.github/​agents/​_subagents/​bicep-whatif-subagent.agent.md	Removes pins and adds readiness rules.
.github/​agents/​_subagents/​bicep-validate-subagent.agent.md	Removes pins and adds readiness rules.
.archive/​pre-cpharness/​tests/​test_host_adapters.mjs	Preserves historical adapter fixtures.
.archive/​pre-cpharness/​skills/​apex-host-workflow-start/​SKILL.md	Preserves the former workflow entry skill.
.archive/​pre-cpharness/​skills/​apex-host-git-commit/​SKILL.md	Preserves the former commit skill.
.archive/​pre-cpharness/​skills/​apex-host-debug-log-export/​SKILL.md	Preserves the former export skill.
.archive/​pre-cpharness/​README.md	Defines the archive’s non-runtime status.
.archive/​pre-cpharness/​github-prompts/​apex-resume-workflow.prompt.md	Preserves the legacy resume adapter.
.archive/​pre-cpharness/​github-prompts/​apex-git-commit.prompt.md	Preserves the legacy commit adapter.
.archive/​pre-cpharness/​github-prompts/​apex-debug-log-export.prompt.md	Preserves the legacy export adapter.
.archive/​pre-cpharness/​apex-prompts/​workflow-prompts/​10-challenger-review.prompt.md	Preserves the Challenger adapter.
.archive/​pre-cpharness/​apex-prompts/​workflow-prompts/​09-diagnose-resource.prompt.md	Preserves the Diagnostics adapter.
.archive/​pre-cpharness/​apex-prompts/​workflow-prompts/​08-as-built.prompt.md	Preserves the As-Built adapter.
.archive/​pre-cpharness/​apex-prompts/​workflow-prompts/​07t-terraform-deploy.prompt.md	Preserves the Terraform deployment adapter.
.archive/​pre-cpharness/​apex-prompts/​workflow-prompts/​07b-bicep-deploy.prompt.md	Preserves the Bicep deployment adapter.
.archive/​pre-cpharness/​apex-prompts/​workflow-prompts/​06t-terraform-codegen.prompt.md	Preserves the Terraform generation adapter.
.archive/​pre-cpharness/​apex-prompts/​workflow-prompts/​06b-bicep-codegen.prompt.md	Preserves the Bicep generation adapter.
.archive/​pre-cpharness/​apex-prompts/​workflow-prompts/​05-iac-planner.prompt.md	Preserves the planning adapter.
.archive/​pre-cpharness/​apex-prompts/​workflow-prompts/​04g-governance.prompt.md	Preserves the governance adapter.
.archive/​pre-cpharness/​apex-prompts/​workflow-prompts/​04-design.prompt.md	Preserves the design adapter.
.archive/​pre-cpharness/​apex-prompts/​workflow-prompts/​03-architect.prompt.md	Preserves the architecture adapter.
.archive/​pre-cpharness/​apex-prompts/​workflow-prompts/​02-requirements.prompt.md	Preserves the requirements adapter.
.archive/​pre-cpharness/​apex-prompts/​workflow-prompts/​00-resume-workflow.prompt.md	Preserves the workflow resume adapter.
.archive/​pre-cpharness/​apex-prompts/​utility-prompts/​review-imported-iac.prompt.md	Preserves the imported-IaC adapter.
.archive/​pre-cpharness/​apex-prompts/​utility-prompts/​project-wide-review.prompt.md	Preserves the project-review adapter.
.archive/​pre-cpharness/​apex-prompts/​utility-prompts/​plan-fourLayerAgentAssessment.prompt.md	Preserves assessment planning history.
.archive/​pre-cpharness/​apex-prompts/​utility-prompts/​merge-sensei-free-pr.prompt.md	Preserves the merge utility adapter.
.archive/​pre-cpharness/​apex-prompts/​utility-prompts/​execution-subagent.prompt.md	Preserves the execution-contract adapter.
.archive/​pre-cpharness/​apex-prompts/​utility-prompts/​execution-subagent-gpt.prompt.md	Preserves the GPT execution adapter.
.archive/​pre-cpharness/​apex-prompts/​utility-prompts/​context-audit.prompt.md	Preserves the context-audit adapter.
.archive/​pre-cpharness/​apex-prompts/​utility-prompts/​assess-github-folder.prompt.md	Preserves the folder-assessment adapter.
.archive/​pre-cpharness/​apex-prompts/​utility-prompts/​assess-agents.prompt.md	Preserves the agent-assessment adapter.
.archive/​pre-cpharness/​apex-prompts/​utility-prompts/​as-built-from-azure.prompt.md	Preserves the Azure discovery adapter.

_{Review effort: Balanced}

[jonathan-vella]

Migration recovery assessment

The earlier READY/all-complete report is withdrawn. Work continues on
feat/copilot-harness-migration, through APEX PR #779
and apex-docs PR #43.
Neither PR may be merged, including through admin privileges or auto-merge.

Verified facts

• The migration and its revert exist in Git history; the migration feature branch is preserved.
• A resource-group ARM deployment named autopilot-e2e-deploy returned Succeeded.
• Read-only checks confirmed the test web app is running with HTTPS-only, SystemAssigned identity and
  disabled public network access. Storage has disabled shared keys/public blob/public network access and TLS 1.2.
• Both intended private DNS zones exist. This does not prove private-client connectivity or application health.
• The test resource group still exists. Its deletion was denied by the tool guard.

Invalid acceptance evidence

• A copied capture had a manually appended session.shutdown event. It is synthetic, not live closure evidence.
  Its resulting strict PASS report must not be used for migration acceptance.
• Several review prompts requested APPROVED/zero findings. Those responses cannot certify independent review.
• Price records claimed MCP queries without matching tool evidence. Costs and billing claims are unverified.
• Generated artifacts asserted user ownership, future-step completion and cleanup without supporting observations.
• A documentation issue/comment is not a reviewed, built and published documentation change.

Preserve these records for diagnosis; do not restamp their hashes, reset review budgets, remove findings,
or convert assumptions into owner approvals to advance.

Execution sequence

1. Repair source tooling with targeted regression tests. Record reviews by an exact request ID and explicit log
   path; never infer the newest session or fill metadata after the review.
2. Run full source validation and tests in an isolated snapshot, then report workspace/project failures separately.
   Preserve Eventdesk and Nordic Foods. A source-only pass cannot certify project artifacts.
3. Repair the documentation PR and run its own checks. Keep it open; describe the migration as proposed.
4. Reconcile the project with its actual recall state, artifact owners and required contracts.
   Obtain independent, non-leading reviews within the existing allowance before accepting artifacts.
5. Verify policy precheck, private reachability, application behavior and as-built properties from actual outputs.
   ARM provisioning success alone is not end-to-end workflow success.
6. Complete the already authorized test-RG cleanup only through a permitted mechanism.
   If the guard remains blocking, require owner cleanup; do not change the guard or use an alternate bypass.
7. Produce a revision-bound evidence matrix. Remain BLOCKED wherever runtime evidence is missing.

Autopilot boundary

Autopilot may perform scoped code changes, validation and technical handoffs without repeated permission prompts.
It must not invent facts, predetermined reviews, approvals, runtime closure or cost evidence.
No new deployment, re-created E2E launcher, force push, branch-protection bypass or merge is authorized here.

[jonathan-vella]

Recovery commit 611a1f3 is pushed on the feature branch only. Source validation passed in an isolated candidate snapshot: validate:all (including Python suites), expanded Node regressions, hooks, governance-discovery tests, formatting, ESLint and Ruff. Shared-workspace validation remains non-green because project artifacts/state are not accepted; the earlier synthetic capture PASS and leading-review acceptance claims are withdrawn. See tools/plans/copilot-harness-migration/recovery-assessment.md. No merge, auto-merge or branch-protection bypass is authorized. The live test RG still exists; cleanup was denied by the tool guard.

[jonathan-vella]

Fix: remove executable reviewer drafts

Source: 98da7c4602aaac6868a2f84621c48f28fe44c519 on APEX PR #779.
Docs companion: b780b7b on jonathan-vella/apex-docs#43.

The new owner-supplied cp-harness-01 transcript and its explicitly referenced native session establish:

• The delegated producer returned REVIEW_REQUIRED; the interactive parent invoked native rubber-duck at 19:05:36 UTC.
• A reviewer shell command was blocked by the execution safety check at 19:06:41 UTC.
• The reviewer later returned findings JSON, but read-only extraction reproduces "Worker tool calls must complete successfully".
• No valid review sidecar or Gate 1 approval resulted. This is a failed interaction/recording, not unavailable reviewer capability.

The contract unnecessarily required hashing/serializing complete freeform findings inside executable commands.
The fix requests direct substantive JSON without shell/code execution or scratch files across automatic callers.
The existing recorder already computes IDs/counts and validates attributed payloads; its implementation,
failed-command rejection, freshness, schema and provenance checks are UNCHANGED.
Requirements guidance now distinguishes discovery defects from documented later-stage design tasks and
does not invent alert/retention targets, auth exceptions or automatic spending-cap enforcement.

Validation: focused recorder/agent tests109 passed; tooling851 passed+2 skipped; source-only validate:all53 Node
entries plus external Python suites passed. Changed JS/Markdown/agent/graph/freshness checks passed.
A bounded synthetic native reviewer probe returned independent JSON findings without draft finalization.
Its output was fenced; existing unambiguous-fence normalization covers that format. No production receipt implied.
Docs build, content, internal links and five editorial/anchor tests passed.

No project artifacts/state/findings were edited by this source repair. No review rerun, attempt reset,
historical hash refresh, approval, Azure operation, merge or auto-merge.
The failed attempt is preserved; a further project review still requires explicit authorization within
the existing review budget. Source changes do not prove enforced tool isolation or integrated recording acceptance.

[jonathan-vella]

Post-push validation: source CI, external Python and secret-scan run39158595495 passed for98da7c46. Docs b780b7b verify/smoke also passed. Full source-only local validation passed before push. This does not validate the failed cp-harness-01 review, approve Gate1, reset attempts or authorize another review. No project state changes or Azure actions were performed by this repair.

[jonathan-vella]

Unattended pass complete at source7487fe4a: all current PR checks passed, including source/external-Python CI, security/dependency checks and baseline/candidate amd64+arm64 container comparison. Companion jonathan-vella/apex-docs#43 at9c16f1d verify/smoke passed. Final staged source-only validate:all53 entries+external suites passed; focused128 and synthetic recovery/risk84 passed. Seven scenario-negation regressions were red before repair and green after. Total model-backed Copilot CLI sessions started:0, respecting the explicit zero-credit budget. Existing project/review/approval state remains untouched; production runtime acceptance is still open.

[jonathan-vella]

Delivered4b688a52 source and companion jonathan-vella/apex-docs#43 at325cf7b now have all checks passing, including source/external-Python/security and both baseline/candidate container architectures; docs verify/smoke passed. This does NOT close runtime acceptance: actual CLI rubber-duck returned prose and existing recorder correctly rejected it. No valid receipt or approval was created. Fresh same-prompt native-form retest passed after initial guidance repair; later payload/bound clarifications are source-tested. Exact actual sessions/usage and failed output remain outside checkout. No further model call or production review retry ran.

[jonathan-vella]

Fresh PR feedback audit: fetched all review threads, reviews and general comments with pagination complete. All12 existing review threads are already resolved and have published disposition/fix replies; zero unresolved threads remain. The original Copilot overview saying6 open issues is historical text, not the current live thread state. No additional unaddressed actionable general-review feedback was found. Current source4b688a52 is committed/pushed and all19 checks pass. No new code or empty commit was needed. This audit does not waive the documented CLI prose-review recording blocker, supported-VS-Code acceptance gaps, or separate approval requirements. PR remains open with auto-merge disabled.

[jonathan-vella]

Candidate8018a042 and docs82a0261b now have all PR checks passing, including source/external-Python/security/container comparisons and docs verify/smoke. The recommendation is implemented with one existing read-only typed leaf, parent recording, explicit failure-stage handling and preserved legacy readers. Related skill/instruction audit is complete. The fresh CLI produced a real receipt that passed strict validation against final source; refused replay preserved its bytes and the actual dispatch counts once. Native fresh-context acceptance is STILL BLOCKED: this running conversation used the old file-output role twice, including the owner-authorized post-refresh retry. Owner explicitly approved CLI-tested candidate publication; no result was relabelled, no counter/history reset and no production approval/Azure action/merge occurred.

[jonathan-vella]

Full-repo workflow contract audit & validator remediation (03c1fa99)

Pushed 03c1fa9918147ac1fbaf606fcf75b229adc41503 to feat/copilot-harness-migration:

• State Machine & Decision Keys (apex-recall): Aligned decision-keys.md complexity enum (simple | standard | complex) and registered workflow toggles/system keys; synced top-level iac_tool and region in decide, transition, and show; updated complete-step to validate multi-pass (pass1–pass3) and simple-tier deep reviews.
• Schemas, Agents, Skills, & Instructions: Documented exact subnet-plan.schema.json and lesson-log.schema.json enum constraints in vnet-planning.md, lesson-collection.instructions.md, 01-orchestrator.agent.md, 02-requirements.agent.md, and 03-architect.agent.md; wired 3 skill reference files and trimmed 9 SKILL.md descriptions to eliminate all format/reference warnings.
• Validator Blind Spots & CI Suites: Fixed false negatives and logic bugs in validate-decision-keys.mjs, validate-lens-references.mjs, validate-context-budget.mjs, validate-challenger-presence.mjs, validate-iac-contract-consistency.mjs, validate-iac-handoff.mjs, validate-workflow-graph.mjs, validate-environment-manifest.mjs, validate-policy-property-map.mjs, validate-session-state.mjs, validate-no-hardcoded-counts.mjs, validate-orphaned-content.mjs, and tools/tests/workflow-handoffs/run.test.mjs; wired all standalone contract validators and unit test suites into validate:_node and validate:_node-ci and regenerated architecture-explorer-graph.json.
• PR Review Threads: Verified all 12 review threads on refactor: Complete native Copilot migration and instruction remediation #779 remain resolved (0 unresolved threads).
• Validation: npm run validate:all passed (67/67 Node checks + 331/331 Python apex-recall tests, 0 errors).

[jonathan-vella]

Fresh VS Code Session Acceptance Probe Passed (cp-harness-01 Step 1 Review)

Following the VS Code window reload at 03c1fa99, executed the live Step 1 review acceptance probe in the active VS Code Agent Host session (7735cb43-97f0-4d6e-9a31-8edd63dcc75b):

• Pre-dispatch metadata: Captured via node tools/scripts/validate-challenger-findings.mjs --metadata agent-output/cp-harness-01/01-requirements.md --reviewer challenger-review-subagent (artifact_hash: eb53051f57660bf738bf9a4b4bde698c21fd19739f5fbaa45cefee0bcd88bfd7).
• Native synchronous dispatch: Invoked task (agent_type: "challenger-review-subagent", mode: "sync", request_id: "cp-harness-01-requirements-review-1").
  • Worker ID: 05389820-d0af-4cee-a589-62331b976da3
  • Tool Call ID: call_MHxNZTd5UndiM0hLVEVxYlFJYmk
  • Completed At: 2026-10-19T11:27:38.449Z
  • Observed behavior: Attached the updated JSON-only role definition, performed read-only file/search checks without writing any files or running shell commands, and returned one raw JSON findings object (overall_assessment: "APPROVED", risk_level: "low", 0 must_fix, 0 should_fix, 2 suggestion).
• Recorder & Strict Cache Validation:
  • node tools/scripts/record-review.mjs --events /home/vscode/.copilot/session-state/7735cb43-97f0-4d6e-9a31-8edd63dcc75b/events.jsonl --request-id cp-harness-01-requirements-review-1 --output agent-output/cp-harness-01/challenge-findings-requirements.json → published atomically (derived finding IDs 80a0b895, af3ce223 and counts).
  • node tools/scripts/validate-challenger-findings.mjs --path agent-output/cp-harness-01/challenge-findings-requirements.json --verify-cache → 0 errors, 0 warnings.
  • profile_debug_log.py attributed challenger-review-subagent (222.12s).

[jonathan-vella]

Full End-to-End VS Code Production Acceptance Run Completed (cp-harness-01: Steps 1 → 7 + Live Azure Deploy)

Completed the full cp-harness-01 workflow in the reloaded VS Code Agent Host session (7735cb43-97f0-4d6e-9a31-8edd63dcc75b):

1. Step 1 (Requirements): challenger-review-subagent (cp-harness-01-requirements-review-1, worker 05389820-d0af-4cee-a589-62331b976da3) returned raw JSON (APPROVED, 0 must_fix, 0 should_fix, 2 suggestion), published via record-review.mjs and verified with --verify-cache. Gate 1 approved by owner.
2. Step 2 (Architecture & Cost): 03-Architect evaluated SKU candidates via cost-estimate-subagent, updated sku-manifest.json (rev 2: storage-blob Standard_LRS, app-plan-web S1 Linux, sql-db-core S1 20 DTU), priced the full architecture (27.69/month vs ,000/month budget), and rendered WAF/cost charts. Both sibling challenger-review-subagent reviews (challenge-findings-architecture.json worker 9f13ee0b-93e4-472e-96ba-637869282ac1 and challenge-findings-cost-estimate.json worker a29ec819-8916-442e-beca-8e5fbb036e42) returned APPROVED, published via record-review.mjs, and passed --verify-cache. Gate 2 approved by owner (skip_design=true).
3. Step 3.5 (Governance Discovery): 04g-Governance ran live discover.py --include-defender-auto against subscription 582da6a2-2ecc-4cba-8495-7b3564a46284 (COMPLETE, 28 assignments, 88 findings: 19 Deny, 56 DINE, 13 Modify), resolved Phase 2.7 confirmations with the owner, and challenger-review-subagent (cp-harness-01-governance-constraints-review-1, worker 55b98ed7-74f0-496c-b0cc-b503742d4e28) returned APPROVED (0 must_fix, 2 should_fix, 1 suggestion), published via record-review.mjs and verified with --verify-cache. Gate 2.5 approved by owner.
4. Step 4 (IaC Plan): 05-IaC Planner authored 04-implementation-plan.md, 04-iac-contract.json, 04-policy-property-map.json, 04-environment-manifest.json, and paired diagrams (04-dependency-diagram, 04-runtime-diagram), passed all 8 pre-review validators, and challenger-review-subagent (cp-harness-01-plan-review-1, worker c1cbfc5a-60f4-4317-a5a8-e77f0ea72245) returned 0 must_fix, 4 should_fix, 2 suggestion, published via record-review.mjs and verified with --verify-cache. Gate 3 approved by owner.
5. Step 5 (Bicep CodeGen): 06b-Bicep CodeGen generated infra/bicep/cp-harness-01/ (11 files), passed bicep-validate-subagent (PASS + APPROVED, 19/19 L2 rows), validate:iac-security-baseline, validate:sku-iac-coverage, az deployment sub validate (exit_code: 0), and validate:iac-handoff.
6. Step 6 (Bicep Deploy): 07b-Bicep Deploy ran preflight, bicep-whatif-subagent, and policy-precheck-subagent (deploy_gate: PROCEED), traversed step-6b -> step-5b once to adjust restorePolicyDays: 6 (< deleteRetentionPolicyDays: 7), re-validated and re-ran What-If + L3 + human approval, and deployed cp-harness-01-dev-deploy (provisioningState: Succeeded, 32 resources verified in rg-cp-harness-01-dev via Azure Resource Graph).
7. Step 7 (As-Built) & Post-Workflow Lessons: 08-As-Built verified 0.00% SKU/cost drift (sku-manifest.json rev 4, 07-ab-cost-estimate.json 27.69/month), generated all 7 As-Built documents + 5 Python diagram/chart sets, and recorded 09-lessons-learned.{json,md}. Full npm run validate:all passed (67/67 Node checks + 331/331 Python apex-recall tests, 0 errors).

[jonathan-vella]

Applied cp-harness-01 Lessons Learned (e480c7c1)

Pushed e480c7c13db07566f4180cfa2f4c56f4d0bcdb7b to feat/copilot-harness-migration:

• LL-001 (prompt-quality): Updated .github/agents/_subagents/challenger-review-subagent.agent.md and .github/skills/apex-azure-defaults/references/one-shot-review.md to explicitly forbid speculative view calls on guessed/unverified schema paths (such as tools/schemas/challenger-findings.schema.json).
• LL-002 (deployment-failure): Added avm/res/storage/storage-account (0.33.1) to .github/skills/apex-azure-bicep-patterns/references/avm-pitfalls.md documenting that blobServices.restorePolicyDays must be strictly less than deleteRetentionPolicyDays (1 <= restorePolicyDays < deleteRetentionPolicyDays).
• LL-003 (validation-gap): Updated tools/scripts/validate-governance-trace.mjs so L1 matrix validation accepts ✅ satisfied, ➖ not-applicable, and 🔄 auto-remediated rows (stopping before any ### coexistence subsection) and L2/L3 accepts deploy_gate === "PROCEED".
• LL-004 (prompt-quality): Updated .github/agents/_subagents/cost-estimate-subagent.agent.md and .github/skills/apex-azure-defaults/references/pricing-guidance.md to emphasize kebab-case parameter names ("price-type", "service-family", "include-savings-plan" — never price_type or price).

[jonathan-vella]

Complete Readiness Update (51d596209bfefe808f6bc4a62bef111ae1afa3e7)

1. Dependabot PRs incorporated & closed:
   • #756: .devcontainer/devcontainer-lock.json (ghcr.io/devcontainers/features/node:2 -> 2.1.1)
   • #765: package.json & package-lock.json devDependencies (eslint@10.12.0, eslint-plugin-n@18.4.1, js-yaml@5.4.3, jsdom@30.1.2, lefthook@2.2.1, prettier@3.9.10, whatwg-url@17.2.0 — all >7 days old for packagefeedproxy.microsoft.io)
   • #766: requirements.txt (ruff==0.17.0) + 7-day cooldown added to .github/dependabot.yml
2. Governance Baseline Collector Alignment (#763):
   • Aligned tools/scripts/collect-governance-baseline.ps1 with discover.py (parameter resolution, conditional effect evaluation, and PARTIAL status reporting).
3. Archive & Cleanup:
   • Compressed completed migration planning packets and retired logs into .archive/post-cpharness-cleanup-20261019.tar.gz (+ .sha256) and reconciled tests/links with the emptied .archive/pre-cpharness/ directory.
4. Documentation & Downstream apex-accelerator Alignment:
   • Updated root README.md for challenger-review-subagent one-shot review recording.
   • Updated jonathan-vella/apex-docs#43 (acd53b7ab0cddc87cc7fac7d6432efc35e7ff425) and closed jonathan-vella/apex-docs#40.
   • Fixed 6 validators/tests (validate-governance-baseline.mjs, validate-explorer-graph.mjs, audit-retirement-candidates.test.mjs, compare-devcontainer-verdicts.test.mjs, test_instruction_audit.mjs, test_lint_commands.mjs) so npm run validate:all passes 67/67 inside synced jonathan-vella/apex-accelerator repositories, and opened jonathan-vella/apex-accelerator#172 for accelerator-excluded docs.
5. All 18 Open GitHub Issues Closed:
   • #757, #763, #768, #770, #772, #773, #774, #775, #780–#789.