Merge milestone/v1.14-refinement — v1.14 complete (NFR Refinement: bug fixes, security, stubs, tests, docs; 20 phases + final; tag v1.13.24)

v1.14 NFR Refinement milestone complete. 20 execution phases (P1-P20) +
1 final (P21). All P1/P2 backlog from v1.11 review resolved. Security
posture hardened (swallowed errors, account ID externalized, IAM scoped,
schema validation, credential hygiene). Stubs resolved (kyverno --kube-
version removed). 7 untested scripts gained coverage. Documentation
synced (ARCHITECTURE v1.11-v1.14 addenda, stale @v1.6-1.9 -> @v1.13,
GRILL G-005/G-008 resolved, COST.md window extended, D-083 deferral
recorded). Platform VPC parameterized.

561 tests pass (was 528 at v1.13.2; +33). 22/22 capabilities Verified.
6 grill binding decisions (G-101..G-106) applied. 1 escalation (E-001)
auto-resolved at full autonomy (D-101).

---ci---
project: acdl
phase: 21
milestone: v1.14
status: complete
---/ci---

modules/STANDARDS.md

@@ -207,9 +207,12 @@ declares intra-refs from the subnet and route table to the VPC's
   - `aws:wafv2:webacl`
   - `aws:rds:instance`
   - `aws:kms:key`, `aws:kms:alias`
-- The engine adapter's `TYPE_MAP` is the registry of stack types the
-  adapter can compile (see §8). A new stack type requires a `TYPE_MAP`
-  entry before the primitive can be deployed.
+- The engine adapter is a **stateless assembler** (v1.11, D-098): it reads
+  the registry, emits a root `main.tf` instantiating each L1 as
+  `module "x" { source = "..." }` with resolved inputs and wired refs. There
+  is no `TYPE_MAP` (deleted in the v1.11 stateless rewrite). A new stack
+  type requires a `terraform/` dir in the L1 module + a registry entry with
+  a `terraform_dir` field.
 
 ## 3. L2 Module Standards
 
@@ -580,8 +583,10 @@ must be checked before the module is registered and published.
 ### 9.4 Adapter (stateless assembler)
 
 - [ ] The new primitive's `terraform/` subdir exists with
-  `versions.tf`/`variables.tf`/`locals.tf`/`main.tf`/`outputs.tf` and
-  passes `terraform init + validate` standalone.
+  `versions.tf`/`variables.tf`/`main.tf`/`outputs.tf` and
+  passes `terraform init + validate` standalone. `locals.tf` is required
+  for multi-resource modules; trivial single-resource modules (e.g.
+  `kms-key`, `ecr`, `ecs-cluster`) may inline locals in `main.tf`.
 - [ ] `registry.json` has a `terraform_dir` field for the new primitive.
 - [ ] No adapter code changes are needed (the adapter is generic; it
   assembles any module with a `terraform_dir` in the registry).