Merge milestone/v1.14-refinement — v1.14 complete (NFR Refinement: bug fixes, security, stubs, tests, docs; 20 phases + final; tag v1.13.24)

v1.14 NFR Refinement milestone complete. 20 execution phases (P1-P20) +
1 final (P21). All P1/P2 backlog from v1.11 review resolved. Security
posture hardened (swallowed errors, account ID externalized, IAM scoped,
schema validation, credential hygiene). Stubs resolved (kyverno --kube-
version removed). 7 untested scripts gained coverage. Documentation
synced (ARCHITECTURE v1.11-v1.14 addenda, stale @v1.6-1.9 -> @v1.13,
GRILL G-005/G-008 resolved, COST.md window extended, D-083 deferral
recorded). Platform VPC parameterized.

561 tests pass (was 528 at v1.13.2; +33). 22/22 capabilities Verified.
6 grill binding decisions (G-101..G-106) applied. 1 escalation (E-001)
auto-resolved at full autonomy (D-101).

---ci---
project: acdl
phase: 21
milestone: v1.14
status: complete
---/ci---

terraform/bootstrap/apply_iam_baseline.py

@@ -30,7 +30,7 @@ import boto3
 
 ROOT = Path(__file__).resolve().parent.parent.parent
 POLICY_PATH = ROOT / "terraform" / "bootstrap" / "spike_runner_policy.json"
-ACCOUNT = "581513795199"
+ACCOUNT = os.environ.get("ACDL_AWS_ACCOUNT_ID", "581513795199")
 USER = "acdl-spike-runner"
 POLICY_NAME = "acdl-spike-runner-policy"
 POLICY_ARN = f"arn:aws:iam::{ACCOUNT}:policy/{POLICY_NAME}"
@@ -75,8 +75,10 @@ def apply_managed_policy(iam, policy_doc: str) -> str:
             try:
                 iam.delete_policy_version(PolicyArn=POLICY_ARN, VersionId=default)
                 print(f"deleted old default version {default}")
+            except iam.exceptions.NoSuchEntityException:
+                pass  # already deleted
             except Exception as e:
-                print(f"could not delete old version {default}: {e}")
+                print(f"WARNING: could not delete old version {default}: {e}")
         return POLICY_ARN
     except iam.exceptions.NoSuchEntityException:
         print(f"creating managed policy {POLICY_NAME}...")

terraform/bootstrap/create_state_backend.py

@@ -30,9 +30,9 @@ import boto3
 
 
 REGION = os.environ.get("AWS_DEFAULT_REGION", "us-east-1")
-STATE_BUCKET = "acdl-tfstate-581513795199-us-east-1"
+ACCOUNT_ID = os.environ.get("ACDL_AWS_ACCOUNT_ID", "581513795199")
+STATE_BUCKET = f"acdl-tfstate-{ACCOUNT_ID}-us-east-1"
 OUTBOX_TABLE = "acdl-outbox"
-ACCOUNT_ID = "581513795199"
 
 
 def main():
@@ -48,12 +48,16 @@ def main():
     try:
         s3.head_bucket(Bucket=STATE_BUCKET)
         print(f"s3: bucket {STATE_BUCKET} already exists")
-    except Exception:
-        kwargs = {"Bucket": STATE_BUCKET}
-        if REGION != "us-east-1":
-            kwargs["CreateBucketConfiguration"] = {"LocationConstraint": REGION}
-        s3.create_bucket(**kwargs)
-        print(f"s3: created bucket {STATE_BUCKET}")
+    except s3.exceptions.ClientError as e:
+        error_code = e.response.get("Error", {}).get("Code", "")
+        if error_code in ("404", "NoSuchBucket", "NotFound"):
+            kwargs = {"Bucket": STATE_BUCKET}
+            if REGION != "us-east-1":
+                kwargs["CreateBucketConfiguration"] = {"LocationConstraint": REGION}
+            s3.create_bucket(**kwargs)
+            print(f"s3: created bucket {STATE_BUCKET}")
+        else:
+            raise
     # Enable versioning (idempotent)
     s3.put_bucket_versioning(
         Bucket=STATE_BUCKET,

terraform/bootstrap/spike_runner_policy.json

@@ -215,7 +215,10 @@
         "kms:TagResource",
         "kms:UntagResource"
       ],
-      "Resource": "*"
+      "Resource": [
+        "arn:aws:kms:*:*:key/*",
+        "arn:aws:kms:*:*:alias/acdl-*"
+      ]
     },
     {
       "Effect": "Allow",
@@ -233,7 +236,7 @@
         "iam:TagRole",
         "iam:UntagRole"
       ],
-      "Resource": "*"
+      "Resource": "arn:aws:iam::*:role/acdl-*"
     }
   ]
 }