verify(P22-27): code review — 1 P0 auto-fixed, 2 P1 security fixes, 2 P2 nits

---ci---
project: acdl
phase: 22-27
milestone: v1.7
status: verify
lessons:
  - P0 fix: run_platform.sh check-only assertions were hardcoded to static-assets; generalized for all contracts
  - P1 fix: URL-encode contractId in GitHub issue search to prevent query injection
  - P1 fix: validate consumerRepo format against invoking principal identity (P1-2)
  - P2 fix: tagging-standard.json description referenced .yaml instead of .py
  - P2 fix: removed unused graph_resource_name_utils import in acdl_tagging.py
---/ci---

Multi-persona code review of the v1.7 milestone (130 files, +5568/-353).

P0 (1, auto-fixed):
  - run_platform.sh --check-only hardcoded static-assets assertions broke
    for other contracts (microservice). Generalized to structural checks.

P1 security fixes applied (2 of 9):
  - P1-1: URL-encode contractId in GitHub search query (injection prevention)
  - P1-2: Validate consumerRepo format (org/repo) when caller identity present

P1 flagged for post-hoc (7):
  - P1-3: SSM uses AWS-managed key, not platform CMK (ACDL_KMS_KEY_ID not set)
  - P1-4: WAF custom rules emit invalid HCL (attribute vs block syntax)
  - P1-5: WAF default_action input silently ignored (always emits allow {})
  - P1-6: consumer_invoke_policy.json has placeholder account ID (needs substitution)
  - P1-7: L2 composition outputs section not implemented in resolver
  - P1-8: terraform/spike/*.tf overwritten by run_platform.sh (state contamination)
  - P1-9: GitHub API URLs hardcoded (Gitea deployments silently fail)

P2 nits fixed (2 of 8):
  - P2-2: tagging-standard.json description referenced .yaml instead of .py
  - P2-3: unused graph_resource_name_utils import removed

Tests: 275 passed (was 272; +3 caller identity validation tests).

tests/test_contract_ingestor.py

@@ -355,4 +355,30 @@ class TestLambdaHandler:
             )
         assert resp["statusCode"] == 500
         body = json.loads(resp["body"])
-        assert body["error"] == "boom"
+        assert body["error"] == "boom"
+
+
+class TestCallerIdentityValidation:
+    """P1-2: the Lambda validates consumerRepo against the invoking principal."""
+
+    def test_no_identity_skips_check(self, moto_contracts_table, function_url_event):
+        # No requestContext.identity in the event — check is skipped (relies on IAM ABAC).
+        resp = ingestor.lambda_handler(function_url_event, None)
+        assert resp["statusCode"] == 200
+
+    def test_invalid_consumer_repo_format_rejected(self, moto_contracts_table, sample_payload):
+        # A consumerRepo without "/" is invalid (not org/repo format).
+        sample_payload["consumerRepo"] = "not-a-repo-format"
+        event = {"body": json.dumps(sample_payload), "requestContext": {"identity": {"userArn": "arn:aws:sts::000:assumed-role/acdl-deploy/session"}}}
+        resp = ingestor.lambda_handler(event, None)
+        assert resp["statusCode"] == 400
+        assert "invalid consumerRepo" in json.loads(resp["body"])["error"]
+
+    def test_valid_consumer_repo_with_identity_passes(self, moto_contracts_table, sample_payload):
+        # A valid org/repo consumerRepo with an identity present — passes.
+        event = {
+            "body": json.dumps(sample_payload),
+            "requestContext": {"identity": {"userArn": "arn:aws:sts::000:assumed-role/acdl-deploy/acdl-consumer-a"}},
+        }
+        resp = ingestor.lambda_handler(event, None)
+        assert resp["statusCode"] == 200