Merge milestone/v1.14-refinement — v1.14 complete (NFR Refinement: bug fixes, security, stubs, tests, docs; 20 phases + final; tag v1.13.24)

v1.14 NFR Refinement milestone complete. 20 execution phases (P1-P20) +
1 final (P21). All P1/P2 backlog from v1.11 review resolved. Security
posture hardened (swallowed errors, account ID externalized, IAM scoped,
schema validation, credential hygiene). Stubs resolved (kyverno --kube-
version removed). 7 untested scripts gained coverage. Documentation
synced (ARCHITECTURE v1.11-v1.14 addenda, stale @v1.6-1.9 -> @v1.13,
GRILL G-005/G-008 resolved, COST.md window extended, D-083 deferral
recorded). Platform VPC parameterized.

561 tests pass (was 528 at v1.13.2; +33). 22/22 capabilities Verified.
6 grill binding decisions (G-101..G-106) applied. 1 escalation (E-001)
auto-resolved at full autonomy (D-101).

---ci---
project: acdl
phase: 21
milestone: v1.14
status: complete
---/ci---

core/lambda/contract_ingestor.py

@@ -17,6 +17,7 @@ requests. The invoke policy is scoped via ABAC (consumer repo identity).
 import datetime
 import json
 import os
+import urllib.error
 import urllib.parse
 
 import boto3
@@ -154,7 +155,16 @@ def _report_error(payload):
         with urllib.request.urlopen(req, timeout=10) as resp:
             search_result = json.loads(resp.read())
         existing = search_result.get("items", [])
-    except Exception:
+    except urllib.error.HTTPError as e:
+        if e.code == 404:
+            existing = []
+        else:
+            import sys
+            print(f"WARNING: GitHub issue search failed (HTTP {e.code}): {e}", file=sys.stderr)
+            existing = []
+    except urllib.error.URLError as e:
+        import sys
+        print(f"WARNING: GitHub issue search network error: {e}", file=sys.stderr)
         existing = []
 
     body = f"""## Deploy Failure Report
@@ -228,21 +238,42 @@ def _validate_caller_identity(event, payload):
 
     If the identity is not available (e.g. local testing or non-IAM auth), the
     check is skipped (the ABAC policy at the IAM layer enforces the scope).
+
+    v1.14 (REQ-144): also validates contractId format, environment enum, and
+    error length. The ABAC reliance is documented here: the Function URL IAM
+    identity does not expose principal tags in the event, so full enforcement
+    of consumerRepo ownership is at the IAM layer (ABAC via
+    aws:PrincipalTag/acdl:owner). This function validates format only, not
+    ownership.
     """
     identity = event.get("requestContext", {}).get("identity", {})
     caller_arn = identity.get("userArn", "")
     if not caller_arn:
-        return  # no identity available — rely on IAM ABAC enforcement
+        pass  # no identity available — rely on IAM ABAC enforcement
     payload_repo = payload.get("consumerRepo", "")
-    if not payload_repo:
-        return
-    # Extract the session name or principal tag from the ARN. The ABAC policy
-    # scopes via aws:PrincipalTag/acdl:owner = <consumerRepo>. The Function URL
-    # IAM identity does not expose principal tags in the event, so we do a
-    # best-effort check: the consumerRepo must not be empty and must be a valid
-    # repo identifier (org/repo format). Full enforcement is at the IAM layer.
-    if "/" not in payload_repo or len(payload_repo) > 128:
-        raise ValueError(f"invalid consumerRepo format: {payload_repo!r}")
+    if payload_repo:
+        # consumerRepo must be org/repo format, <=128 chars
+        if "/" not in payload_repo or len(payload_repo) > 128:
+            raise ValueError(f"invalid consumerRepo format: {payload_repo!r}")
+
+    # v1.14 (REQ-144): contractId format validation
+    contract_id = payload.get("contractId", "")
+    if contract_id:
+        import re
+        if not re.match(r'^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$', contract_id):
+            raise ValueError(f"invalid contractId format: {contract_id!r} (alphanumeric, hyphen, underscore; max 64 chars)")
+
+    # v1.14 (REQ-144): environment enum validation
+    environment = payload.get("environment", "")
+    if environment:
+        valid_envs = {"dev", "qa", "prod", "dr"}
+        if environment not in valid_envs:
+            raise ValueError(f"invalid environment: {environment!r} (must be one of {valid_envs})")
+
+    # v1.14 (REQ-144): error length cap (for report_error action)
+    error_msg = payload.get("error", "")
+    if error_msg and len(str(error_msg)) > 10000:
+        payload["error"] = str(error_msg)[:10000]
 
 
 def _validate_change_request(payload):