Merge milestone/v1.14-refinement — v1.14 complete (NFR Refinement: bug fixes, security, stubs, tests, docs; 20 phases + final; tag v1.13.24)

v1.14 NFR Refinement milestone complete. 20 execution phases (P1-P20) +
1 final (P21). All P1/P2 backlog from v1.11 review resolved. Security
posture hardened (swallowed errors, account ID externalized, IAM scoped,
schema validation, credential hygiene). Stubs resolved (kyverno --kube-
version removed). 7 untested scripts gained coverage. Documentation
synced (ARCHITECTURE v1.11-v1.14 addenda, stale @v1.6-1.9 -> @v1.13,
GRILL G-005/G-008 resolved, COST.md window extended, D-083 deferral
recorded). Platform VPC parameterized.

561 tests pass (was 528 at v1.13.2; +33). 22/22 capabilities Verified.
6 grill binding decisions (G-101..G-106) applied. 1 escalation (E-001)
auto-resolved at full autonomy (D-101).

---ci---
project: acdl
phase: 21
milestone: v1.14
status: complete
---/ci---

core/lambda/contract_ingestor.py

@@ -17,6 +17,7 @@ requests. The invoke policy is scoped via ABAC (consumer repo identity).
 import datetime
 import json
 import os
+import urllib.error
 import urllib.parse
 
 import boto3
@@ -154,7 +155,16 @@ def _report_error(payload):
         with urllib.request.urlopen(req, timeout=10) as resp:
             search_result = json.loads(resp.read())
         existing = search_result.get("items", [])
-    except Exception:
+    except urllib.error.HTTPError as e:
+        if e.code == 404:
+            existing = []
+        else:
+            import sys
+            print(f"WARNING: GitHub issue search failed (HTTP {e.code}): {e}", file=sys.stderr)
+            existing = []
+    except urllib.error.URLError as e:
+        import sys
+        print(f"WARNING: GitHub issue search network error: {e}", file=sys.stderr)
         existing = []
 
     body = f"""## Deploy Failure Report
@@ -228,21 +238,42 @@ def _validate_caller_identity(event, payload):
 
     If the identity is not available (e.g. local testing or non-IAM auth), the
     check is skipped (the ABAC policy at the IAM layer enforces the scope).
+
+    v1.14 (REQ-144): also validates contractId format, environment enum, and
+    error length. The ABAC reliance is documented here: the Function URL IAM
+    identity does not expose principal tags in the event, so full enforcement
+    of consumerRepo ownership is at the IAM layer (ABAC via
+    aws:PrincipalTag/acdl:owner). This function validates format only, not
+    ownership.
     """
     identity = event.get("requestContext", {}).get("identity", {})
     caller_arn = identity.get("userArn", "")
     if not caller_arn:
-        return  # no identity available — rely on IAM ABAC enforcement
+        pass  # no identity available — rely on IAM ABAC enforcement
     payload_repo = payload.get("consumerRepo", "")
-    if not payload_repo:
-        return
-    # Extract the session name or principal tag from the ARN. The ABAC policy
-    # scopes via aws:PrincipalTag/acdl:owner = <consumerRepo>. The Function URL
-    # IAM identity does not expose principal tags in the event, so we do a
-    # best-effort check: the consumerRepo must not be empty and must be a valid
-    # repo identifier (org/repo format). Full enforcement is at the IAM layer.
-    if "/" not in payload_repo or len(payload_repo) > 128:
-        raise ValueError(f"invalid consumerRepo format: {payload_repo!r}")
+    if payload_repo:
+        # consumerRepo must be org/repo format, <=128 chars
+        if "/" not in payload_repo or len(payload_repo) > 128:
+            raise ValueError(f"invalid consumerRepo format: {payload_repo!r}")
+
+    # v1.14 (REQ-144): contractId format validation
+    contract_id = payload.get("contractId", "")
+    if contract_id:
+        import re
+        if not re.match(r'^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$', contract_id):
+            raise ValueError(f"invalid contractId format: {contract_id!r} (alphanumeric, hyphen, underscore; max 64 chars)")
+
+    # v1.14 (REQ-144): environment enum validation
+    environment = payload.get("environment", "")
+    if environment:
+        valid_envs = {"dev", "qa", "prod", "dr"}
+        if environment not in valid_envs:
+            raise ValueError(f"invalid environment: {environment!r} (must be one of {valid_envs})")
+
+    # v1.14 (REQ-144): error length cap (for report_error action)
+    error_msg = payload.get("error", "")
+    if error_msg and len(str(error_msg)) > 10000:
+        payload["error"] = str(error_msg)[:10000]
 
 
 def _validate_change_request(payload):

core/local_emulators.py

@@ -371,8 +371,9 @@ class LocalLambdaStub:
                 return _FakeResponse(
                     json.dumps([{"number": 1, "title": "stub"}]).encode())
             urllib.request.urlopen = _fake_urlopen
-        except Exception:
-            pass
+        except (AttributeError, TypeError) as e:
+            import sys
+            print(f"WARNING: could not patch urlopen for local Lambda stub: {e}", file=sys.stderr)
 
         try:
             event = {

core/output_publisher.py

@@ -97,8 +97,10 @@ def publish_to_ssm(outputs, environment, contract_id):
                 Overwrite=True,
             )
             results[name] = param_name
-        except Exception:
-            # Don't fail the pipeline if one output fails to publish
+        except Exception as e:
+            # Don't fail the pipeline if one output fails to publish, but log it
+            import sys
+            print(f"WARNING: SSM put_parameter failed for {name}: {e}", file=sys.stderr)
             results[name] = None
     return results
 
@@ -165,7 +167,9 @@ def post_github_comment(comment_text, token=None, repo=None, pr_number=None):
         req.add_header("Accept", "application/vnd.github+json")
         urllib.request.urlopen(req, timeout=10)
         return True
-    except Exception:
+    except Exception as e:
+        import sys
+        print(f"WARNING: GitHub PR comment failed: {e}", file=sys.stderr)
         return False
 
 

core/regression_verify.py

@@ -421,8 +421,10 @@ def _check_s3_state_bucket() -> Tuple[Status, str]:
         s3 = boto3.client("s3", region_name=env.get("AWS_DEFAULT_REGION", "us-east-1"),
                           aws_access_key_id=env.get("AWS_ACCESS_KEY_ID"),
                           aws_secret_access_key=env.get("AWS_SECRET_ACCESS_KEY"))
-        s3.head_bucket(Bucket="acdl-tfstate-581513795199-us-east-1")
-        r = s3.list_objects_v2(Bucket="acdl-tfstate-581513795199-us-east-1", MaxKeys=5)
+        account_id = os.environ.get("ACDL_AWS_ACCOUNT_ID", "581513795199")
+        state_bucket = f"acdl-tfstate-{account_id}-us-east-1"
+        s3.head_bucket(Bucket=state_bucket)
+        r = s3.list_objects_v2(Bucket=state_bucket, MaxKeys=5)
         keys = [o["Key"] for o in r.get("Contents", [])]
         return "Verified", f"state bucket exists, keys={keys}"
     except Exception as e:
@@ -431,13 +433,19 @@ def _check_s3_state_bucket() -> Tuple[Status, str]:
 
 def _check_lifecycle_module_terraform(module: str) -> Tuple[Status, str]:
     """Helper: verify an L1 module's terraform dir exists with the required
-    files + its example contracts resolve. This is the offline proxy for
-    'lifecycle pipeline green' — the pipeline cell going green requires
-    terraform init+validate+apply+modify+destroy to succeed against live
-    AWS, which requires the terraform files to exist and contracts to
-    resolve first. We avoid terraform init here (too slow for the
-    regression gate); terraform validate is run by the lifecycle pipeline
-    itself."""
+    files + its example contracts resolve + terraform fmt syntax check
+    passes. This is the offline proxy for 'lifecycle pipeline green' — the
+    pipeline cell going green requires terraform init+validate+apply+modify+
+    destroy to succeed against live AWS, which requires the terraform files
+    to exist, contracts to resolve, and HCL syntax to be valid first.
+
+    We run `terraform fmt -check` (fast, no init required) as a syntax probe.
+    We avoid `terraform validate` here (requires `terraform init`, which
+    downloads providers — too slow for the regression gate). Full
+    `terraform validate` is run by the lifecycle pipeline itself. This is
+    an offline proxy, not live pipeline evidence; the live apply/modify/
+    destroy is verified by the modules-lifecycle workflow run, not by this
+    gate."""
     tf_dir = ROOT / "modules" / "l1" / module / "terraform"
     if not tf_dir.is_dir():
         return "Broken", f"modules/l1/{module}/terraform/ does not exist"
@@ -450,6 +458,11 @@ def _check_lifecycle_module_terraform(module: str) -> Tuple[Status, str]:
     tf_text = "".join((tf_dir / f).read_text() for f in ["variables.tf", "main.tf", "outputs.tf"] if (tf_dir / f).is_file())
     if "local." in tf_text and not (tf_dir / "locals.tf").is_file():
         return "Broken", "missing terraform files: ['locals.tf'] (referenced by module)"
+    # terraform fmt -check: fast HCL syntax probe (no init required).
+    rc, out, err = _run_subprocess(
+        ["terraform", "fmt", "-check", "-diff", str(tf_dir)], timeout=30)
+    if rc != 0:
+        return "Broken", f"terraform fmt -check failed: {err.strip()[-200:]}"
     for ex in ["simple", "complex"]:
         contract = ROOT / "modules" / "l1" / module / "examples" / f"{ex}.yml"
         if not contract.is_file():
@@ -459,12 +472,15 @@ def _check_lifecycle_module_terraform(module: str) -> Tuple[Status, str]:
         ], timeout=30)
         if rc != 0:
             return "Broken", f"{ex}.yml resolver failed: {err.strip()[-200:]}"
-    return "Verified", f"terraform files present + simple/complex contracts resolve"
+    return "Verified", f"terraform files present + fmt -check passes + simple/complex contracts resolve"
 
 
 def _check_lifecycle_l2_module(module: str) -> Tuple[Status, str]:
     """Helper: verify an L2 module's composition resolves + its example
-    contracts resolve. Offline proxy for 'L2 lifecycle pipeline green'."""
+    contracts resolve. Offline proxy for 'L2 lifecycle pipeline green'.
+    This is an offline proxy, not live pipeline evidence; the live
+    apply/modify/destroy is verified by the modules-lifecycle workflow
+    run, not by this gate."""
     for ex in ["simple", "complex"]:
         contract = ROOT / "modules" / "l2" / module / "examples" / f"{ex}.yml"
         if not contract.is_file():
@@ -474,7 +490,7 @@ def _check_lifecycle_l2_module(module: str) -> Tuple[Status, str]:
         ], timeout=30)
         if rc != 0:
             return "Broken", f"{ex}.yml resolver failed: {err.strip()[-200:]}"
-    return "Verified", f"L2 composition resolves (simple + complex contracts)"
+    return "Verified", f"L2 composition resolves (simple + complex contracts; offline proxy)"
 
 
 def _check_cap_017_dynamodb() -> Tuple[Status, str]: