docs(milestone): complete v1.7 — production platform + contract ingestion

---ci---
project: acdl
phase: 0
milestone: v1.7
status: complete
requirements:
  covered: [REQ-62, REQ-63, REQ-64, REQ-65, REQ-66, REQ-67, REQ-68, REQ-69, REQ-70, REQ-71, REQ-72, REQ-73, REQ-74, REQ-75]
  partial: []
---/ci---

v1.7 milestone COMPLETE. 6 phases (22-27), 14 requirements (REQ-62..REQ-75),
all shipped + verified. 272 tests pass. CI pipeline green.

Phase summary:
  P22: rename static-asset -> static-assets (D-048) + cloudfront/waf
       primitives + production stack (D-049) + @v1.6 bump (D-057).
  P23: tagging standard (D-054, D-043 closure) + Wiz adapter (D-052) +
       Kyverno adapter (D-053).
  P24: platform Lambda + DynamoDB acdl-contracts (D-051) + cross-account IAM.
  P25: deploy outputs SSM+PR comment (D-050) + error reporting via Lambda
       (D-055) + stage comments.
  P26: 3 platform pipelines (platform-test, primitives-plan, patterns-plan) +
       release job (D-057) + multi-resource L1 ref fix.
  P27: remove consumer-repos + validated per-module examples (D-058) +
       RDS primitive (D-059).

Ship tag: v1.7.0 (feature milestone, next minor per ship.md;
v1.6 shipped v1.6.0).

.ciagent/PROJECT.md

@@ -167,10 +167,10 @@ Three scope axes:
 Milestone COMPLETE gate: review → ship `v1.4.1` (feature milestone, next
 minor per ship.md — v1.3 shipped `v1.3.2`) → audit.
 
-## Objective for Milestone v1.7 (active)
+## Objective for Milestone v1.7 (complete)
 
 Production platform + contract ingestion + pipeline maturation. The v1.6
-milestone left the platform documented and environments-aware; v1.7 takes it
+milestone left the platform documented and environments-aware; v1.7 took it
 to a production-grade platform. 12 user-directed scope axes (2026-07-22):
 
 1. **Rename `static-assets` → `static-assets`** (D-048 — including

.ciagent/REQUIREMENTS.md

@@ -298,21 +298,21 @@
 | REQ-60 | 21 | complete (v1.6.0) |
 | REQ-61 | 21 | complete (v1.6.0) |
 
-### v1.7 (active — production platform + contract ingestion + pipeline maturation)
+### v1.7 (complete — production platform + contract ingestion + pipeline maturation, tag `v1.7.0`)
 
 | Requirement | Phase | Status |
 |-------------|-------|--------|
-| REQ-62 | 22 | active |
-| REQ-63 | 22 | active |
-| REQ-64 | 22 | active |
-| REQ-65 | 23 | active |
-| REQ-66 | 23 | active |
-| REQ-67 | 23 | active |
-| REQ-68 | 24 | active |
-| REQ-69 | 25 | active |
-| REQ-70 | 25 | active |
-| REQ-71 | 25 | active |
-| REQ-72 | 26 | active |
-| REQ-73 | 26 | active |
-| REQ-74 | 27 | active |
-| REQ-75 | 27 | active |
+| REQ-62 | 22 | complete (v1.7.0) |
+| REQ-63 | 22 | complete (v1.7.0) |
+| REQ-64 | 22 | complete (v1.7.0) |
+| REQ-65 | 23 | complete (v1.7.0) |
+| REQ-66 | 23 | complete (v1.7.0) |
+| REQ-67 | 23 | complete (v1.7.0) |
+| REQ-68 | 24 | complete (v1.7.0) |
+| REQ-69 | 25 | complete (v1.7.0) |
+| REQ-70 | 25 | complete (v1.7.0) |
+| REQ-71 | 25 | complete (v1.7.0) |
+| REQ-72 | 26 | complete (v1.7.0) |
+| REQ-73 | 26 | complete (v1.7.0) |
+| REQ-74 | 27 | complete (v1.7.0) |
+| REQ-75 | 27 | complete (v1.7.0) |

.ciagent/ROADMAP.md

@@ -9,7 +9,7 @@
 - **v1.4 (complete):** central pipeline contract + shell reproducibility + output streaming. A declarative pipeline contract (`schemas/pipeline.schema.json` + `pipelines/ci.yaml`) binds the Gitea and GitHub workflows to a single source of truth. `scripts/run_ci.sh` mirrors the CI pipeline locally. `scripts/run_platform.sh` streams terraform/checkov output by default.
 - **v1.5 (complete, tag `v1.5.0`):** consumer happy path + zero-trust docs + reusable deploy workflow. README rewritten so the consumer model is unambiguous (consumer owns only contract + app code; the rest is the platform source). Platform-flow + consumer-guide diagrams converted to mermaid. Legacy surface + implementation nomenclature removed from docs. Credentials section rewritten for zero-trust OIDC + ABAC (with a static-key override + daily rotation). A generic `docs/CONSUMER_GUIDE.md` (all L2 modules, versioned `uses:`, consumer-scoped prereqs, run-time platform fetch) replaces the module-specific guide. A byte-identical reusable `deploy.yml` workflow (Gitea + GitHub) implements `pipelines/deploy.yaml` and is invoked by consumer repos via a versioned tag.
 - **v1.6 (complete, tag `v1.6.0`):** consumer-facing docs restructure + terminology normalization + environments concept. `docs/` becomes a Jekyll-style GitHub Pages site. `acdl_platform/` is renamed to `core/`. L2 → "modules", L1 → "primitives", "composition" → "pattern" in prose. README restructured: Features + Roadmap (no internal status), repository roles restated (consumer = app code + contracts + CI definitions), mermaid fixed (visible text, security-checks + infrastructure-apply stages, no tool names), credentials section minus go-gitea/waivers. Platform-managed environments concept + a minimal onboarding scaffold. `.ciagent/` + `.gitea/` references removed from all consumer-facing docs.
-- **v1.7 (active, tag `v1.7.0`):** production platform + contract ingestion + pipeline maturation. Rename `static-assets` → `static-assets` (D-048 — incl. `.ciagent/` historical narrative). Author `cloudfront` + `waf` primitives; augment `static-assets` to a production-ready S3 + CloudFront (OAC) + WAF stack (D-049). Tagging-standard enforcement (Checkov custom rule, D-043 closure, D-054). Wiz adapter stub (D-052) + Kyverno K8s-native adapter (D-053). Platform Lambda + DynamoDB `acdl-contracts` table for contract ingestion (D-051) + cross-account IAM. Deploy outputs via SSM SecureString + GitHub PR comment (D-050). Uniform error reporting via the Lambda `report_error` action → GitHub issue on the platform repo (D-055); Gitea excluded. Stage comments after every successful pipeline stage. Three platform pipelines (platform-test unit+integration, primitives-plan, patterns-plan). Release job with semver + MAJOR.MINOR/MAJOR tag maintenance (D-057). `uses:`/`ref:` bumped to `@v1.6`; floating `v1.6` + `v1` tags created in Phase 22. Remove the legacy consumer-repos directory (a v1.2 artifact, removed in v1.7); add validated per-module examples (`modules/<name>/examples/`, D-058) including a new RDS primitive demonstrating multi-engine variation (D-059).
+- **v1.7 (complete, tag `v1.7.0`):** production platform + contract ingestion + pipeline maturation. Rename `static-assets` → `static-assets` (D-048 — incl. `.ciagent/` historical narrative). Author `cloudfront` + `waf` primitives; augment `static-assets` to a production-ready S3 + CloudFront (OAC) + WAF stack (D-049). Tagging-standard enforcement (Checkov custom rule, D-043 closure, D-054). Wiz adapter stub (D-052) + Kyverno K8s-native adapter (D-053). Platform Lambda + DynamoDB `acdl-contracts` table for contract ingestion (D-051) + cross-account IAM. Deploy outputs via SSM SecureString + GitHub PR comment (D-050). Uniform error reporting via the Lambda `report_error` action → GitHub issue on the platform repo (D-055); Gitea excluded. Stage comments after every successful pipeline stage. Three platform pipelines (platform-test unit+integration, primitives-plan, patterns-plan). Release job with semver + MAJOR.MINOR/MAJOR tag maintenance (D-057). `uses:`/`ref:` bumped to `@v1.6`; floating `v1.6` + `v1` tags created in Phase 22. Remove the legacy consumer-repos directory (a v1.2 artifact, removed in v1.7); add validated per-module examples (`modules/<name>/examples/`, D-058) including a new RDS primitive demonstrating multi-engine variation (D-059).
 - **v1.0 demo URL:** https://git.cloudinit.dev/continuous-intelligence/acdl-evidence/raw/branch/main/index.html
 
 ---
@@ -337,7 +337,7 @@ After Phase 21: COMPLETE gate — review → ship `v1.6.0` → audit. **DONE.**
 
 ---
 
-## v1.7 (Active — production platform + contract ingestion + pipeline maturation)
+## v1.7 (Complete — production platform + contract ingestion + pipeline maturation, tag `v1.7.0`)
 
 The v1.7 milestone takes the platform from a documented, environments-aware
 foundation to a production-grade platform with a production-ready
@@ -356,7 +356,7 @@ reference is never broken, and the release job (Phase 26) owns ongoing updates.
 
 ### Phase 22 — rename-and-production-static-assets-stack
 - **Description:** Rename `static-assets` → `static-assets` everywhere (D-048 — including `.ciagent/` historical narrative, overriding the v1.6 preservation precedent). Author two new primitives: `cloudfront` (distribution + OAC, stack types `aws:cloudfront:distribution` + `aws:cloudfront:originaccesscontrol`) and `waf` (WAFv2 web ACL, stack type `aws:wafv2:webacl`). Augment the `static-assets` module to a production-ready stack referencing s3 + cloudfront + waf (depth 1, D-049). Expand the Terraform adapter `TYPE_MAP`/`INPUT_MAP`/`OUTPUT_MAP` for the new stack types. Bump `uses:`/`ref:` from `@v1.4` to `@v1.6` (D-056/D-057); create the floating `v1.6` + `v1` git tags pointing at `v1.6.0` so the reference resolves immediately.
-- **Status:** active
+- **Status:** complete (v1.7.0)
 - **Depends on:** [21]
 - **Requirements:** REQ-62, REQ-63, REQ-64
 - **Success Criteria:**
@@ -369,7 +369,7 @@ reference is never broken, and the release job (Phase 26) owns ongoing updates.
 
 ### Phase 23 — tagging-standards-and-security-adapters
 - **Description:** Define a required-tag set (`acdl:owner`, `acdl:contract`, `acdl:environment`, `acdl:cost-center`) in `schemas/tagging-standard.json` (D-054). Author a Checkov custom YAML rule at `adapters/terraform/policy/custom_rules/acdl_tagging.yaml` that fails when required tags are missing on taggable resources. Remove the `_emit_tag_naming_skipped()` placeholder in `checkov_adapter.py` (D-043 closure) and add `ACDL_TAG_NAMING` to `RULE_MAP` as a real rule. Author a Wiz adapter stub (`adapters/wiz/wiz_adapter.py`) translating Wiz API issues → `PolicyCheckResult` records (`engine: "wiz"`), degrading gracefully when unconfigured (D-052). Author a Kyverno K8s-native adapter (`adapters/kyverno/kyverno_adapter.py`) translating Kyverno `PolicyReport` results → `PolicyCheckResult` records (`engine: "kyverno"`), with sample policies as documentation; inactive for Terraform-only stacks, ready for the GitOps reconciler roadmap item (D-053). Add `wiz` + `kyverno` to the `schemas/policy_check_result.schema.json` engine enum.
-- **Status:** active
+- **Status:** complete (v1.7.0)
 - **Depends on:** [22]
 - **Requirements:** REQ-65, REQ-66, REQ-67
 - **Success Criteria:**
@@ -381,7 +381,7 @@ reference is never broken, and the release job (Phase 26) owns ongoing updates.
 
 ### Phase 24 — platform-lambda-and-contract-ingestion
 - **Description:** Author a platform Lambda (`core/lambda/contract_ingestor.py`) invoked via a Function URL (IAM auth) that accepts `{ consumerRepo, contractId, contract, environment, action }` and writes contracts to a DynamoDB table `acdl-contracts` (PK `consumerRepo`, SK `contractId#submittedAt`, SSE via a customer-managed CMK) (D-051). Define the Terraform (`terraform/platform/main.tf`) for the table, Lambda, Function URL, KMS key, Secrets Manager secret (`acdl/github-token`), and Lambda execution role. Define the cross-account consumer-invoke IAM policy (`terraform/platform/consumer_invoke_policy.json`) granting the consumer's deploy role `lambda:InvokeFunctionUrl` on the Lambda ARN, scoped via ABAC. The `report_error` action (Phase 25) is prepared but not yet implemented. Update `docs/environments/index.md` to document that onboarding now also grants Lambda-invoke permission.
-- **Status:** active
+- **Status:** complete (v1.7.0)
 - **Depends on:** [23]
 - **Requirements:** REQ-68
 - **Success Criteria:**
@@ -393,7 +393,7 @@ reference is never broken, and the release job (Phase 26) owns ongoing updates.
 
 ### Phase 25 — deploy-pipeline-dx-outputs-and-error-reporting
 - **Description:** Add a `publish-outputs` step to `scripts/run_platform.sh` (after apply) that writes deploy outputs to SSM Parameter Store as `SecureString` (KMS-encrypted, namespaced `/acdl/{env}/{contractId}/{output_name}`) for runtime-injectable values, and a `comment-outputs` step that posts a structured GitHub PR comment / job summary with human-readable connection strings (D-050). Implement `core/output_publisher.py` (SSM write + GitHub comment formatting). Implement the Lambda `report_error` action (`core/lambda/contract_ingestor.py`) that creates a GitHub issue on the platform repo (`acdl/acdl`) via the GitHub API using a token from Secrets Manager; idempotent (comments on existing open issue rather than duplicating) (D-055). Add an `if: failure()` error-report step to `.github/workflows/deploy.yml` that invokes the Lambda via `aws lambda invoke-function-url` (SigV4-signed). Add a PR comment after every successful pipeline stage (D-055 extension) via `scripts/post_stage_comment.sh` (uses `GITHUB_TOKEN` + `gh api`; no-op when not in a PR context). Update `pipelines/deploy.yaml` + both deploy workflow YAMLs with the new stages (byte-identical).
-- **Status:** active
+- **Status:** complete (v1.7.0)
 - **Depends on:** [24]
 - **Requirements:** REQ-69, REQ-70, REQ-71
 - **Success Criteria:**
@@ -405,7 +405,7 @@ reference is never broken, and the release job (Phase 26) owns ongoing updates.
 
 ### Phase 26 — platform-pipelines-and-release-automation
 - **Description:** Author three platform pipelines (D-057): (1) `.github/workflows/platform-test.yml` (PR, lint + unit + integration + schema-validation — replaces `ci.yml` for PRs); (2) `.github/workflows/primitives-plan.yml` (PR, plan-only for all L1 primitives via matrix); (3) `.github/workflows/patterns-plan.yml` (PR, plan-only for all L2 modules via matrix). Author `scripts/run_primitive_plan.sh` + `scripts/run_pattern_plan.sh` (with `--check-only` mode for CI). Author the release job (`.github/workflows/release.yml`) that runs on merge to `main`, computes the next semver (PATCH per phase, MINOR on milestone COMPLETE), creates the MAJOR.MINOR.PATCH tag, force-moves the MAJOR.MINOR + MAJOR floating tags, creates a GitHub release with an auto-generated body. This is the mechanism that lets consumers on `@v1` or `@v1.7` receive updates.
-- **Status:** active
+- **Status:** complete (v1.7.0)
 - **Depends on:** [25]
 - **Requirements:** REQ-72, REQ-73
 - **Success Criteria:**
@@ -417,7 +417,7 @@ reference is never broken, and the release job (Phase 26) owns ongoing updates.
 
 ### Phase 27 — remove-legacy-consumer-repos-and-module-documentation-examples
 - **Description:** Delete the legacy consumer-repos directory entirely (a v1.2 artifact removed in v1.7; references in `.ciagent/` historical narrative are rewritten per D-048). Author a new RDS primitive (`modules/l1/rds/`) with an `engine` input (enum: postgres, mysql, etc.) demonstrating multi-engine variation (D-059). Expand the adapter `TYPE_MAP` for `aws:rds:instance` → `aws_db_instance`. For **each** module (primitives + patterns), add a `modules/<name>/examples/` directory with `simple.yaml` + `complex.yaml` (+ variation files) validated against `schemas/contract.schema.json` in the platform-test pipeline (Phase 26 schema-validation stage) (D-058). Each module's `README.md` `## Examples` section references + excerpts the validated files. Update `docs/modules/index.md` + `docs/consumer-guide.md` + `docs/contracts/index.md` with the new module names + examples.
-- **Status:** active
+- **Status:** complete (v1.7.0)
 - **Depends on:** [26]
 - **Requirements:** REQ-74, REQ-75
 - **Success Criteria:**