phase: 7, status: plan-as-execute, persona: lead-developer, task: T-7.10

---ci---
project: acdl
phase: 7
milestone: v1.1
status: plan-as-execute
persona: lead-developer
task: T-7.10
---/ci---

Wave 5: scripts/verify_phase07.sh + traceability.

verify_phase07.sh asserts all 9 deliverable files exist, 3 JSON Schemas
validate as Draft 2020-12 (run from /tmp to avoid the repo platform/
package shadowing stdlib platform which jsonschema's uuid import needs),
3 .py files py_compile, 3 .md files non-empty, all 11 decision IDs +
OpenTofu in PROJECT.md, architecture-v1.0.md status is v1.0, D-040..D-044
present, spike contract validates against contract schema, minimal IR
validates against IR schema. All checks pass: 'VERIFIED - Phase 07:
architecture v1.0 finalized; 6 files authored + 11 decisions resolved'.

Traceability: REQUIREMENTS REQ-16..22 -> complete (v1.1.2); ROADMAP
Phase 07 -> complete (v1.1.2).

scripts/verify_phase07.sh

@@ -0,0 +1,84 @@
+#!/usr/bin/env bash
+# scripts/verify_phase07.sh - Phase 07 architecture-v1-finalization gate.
+set -u
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+fail() { echo "FAIL: $*" >&2; exit 1; }
+ok()   { echo "ok: $*"; }
+
+# --- Check 1: all 9 deliverable files exist ---
+for f in docs/architecture-v1.0.md \
+         schemas/ir.schema.json \
+         schemas/policy_check_result.schema.json \
+         schemas/contract.schema.json \
+         platform/confidence_signal.py \
+         platform/audit_ledger_design.md \
+         platform/hitl_matrix_design.md \
+         platform/separation_of_duties.py \
+         adapters/terraform/policy/checkov_adapter.py; do
+  [ -f "$f" ] || fail "missing $f"
+done
+ok "all 9 deliverable files exist"
+
+# --- Check 2: 3 JSON Schemas are valid Draft 2020-12 ---
+# Run python from /tmp so the repo's `platform/` package does not shadow the
+# stdlib `platform` module (jsonschema imports uuid -> platform.system();
+# our platform/ shadows it when cwd is repo root and on sys.path[0]).
+check_schema() {
+  ( cd /tmp && python3 -c "
+import json, jsonschema
+s = json.load(open('$1'))
+jsonschema.Draft202012Validator.check_schema(s)
+" >/dev/null 2>&1 )
+}
+for s in "$ROOT/schemas/ir.schema.json" "$ROOT/schemas/policy_check_result.schema.json" "$ROOT/schemas/contract.schema.json"; do
+  check_schema "$s" || fail "$(basename "$s") is not valid Draft 2020-12"
+done
+ok "3 JSON Schemas validate as Draft 2020-12"
+
+# --- Check 3: 3 .py files py_compile ---
+for p in platform/confidence_signal.py platform/separation_of_duties.py adapters/terraform/policy/checkov_adapter.py; do
+  python3 -m py_compile "$p" || fail "$p py_compile failed"
+done
+ok "3 .py files py_compile"
+
+# --- Check 4: 3 .md design files non-empty ---
+for m in platform/audit_ledger_design.md platform/hitl_matrix_design.md docs/architecture-v1.0.md; do
+  [ -s "$m" ] || fail "$m is empty"
+done
+ok "3 .md design files non-empty"
+
+# --- Check 5: all 11 decision IDs + OpenTofu in PROJECT.md ---
+for id in W1.A W1.B W2.A W3.D W3.E BA.A BA.B BA.C BA.D BA.E BA.F; do
+  grep -q "$id" .ciagent/PROJECT.md || fail "missing $id in PROJECT.md"
+done
+grep -qi "opentofu" .ciagent/PROJECT.md || fail "missing OpenTofu in PROJECT.md"
+ok "all 11 decision IDs + OpenTofu present in PROJECT.md"
+
+# --- Check 6: docs/architecture-v1.0.md status is v1.0 ---
+grep -q "v1.0" docs/architecture-v1.0.md || fail "architecture-v1.0.md missing v1.0"
+ok "docs/architecture-v1.0.md status is v1.0"
+
+# --- Check 7: D-040..D-044 present in PROJECT.md ---
+for d in D-040 D-041 D-042 D-043 D-044; do
+  grep -q "$d" .ciagent/PROJECT.md || fail "missing $d in PROJECT.md"
+done
+ok "D-040..D-044 present in PROJECT.md"
+
+# --- Check 8: spike contract validates against contract schema ---
+echo '{"stack":"l2-static-asset","environment":"dev","inputs":{"bucket_name":"x","region":"us-east-1"}}' > /tmp/spike-contract.json
+( cd /tmp && python3 -c "
+import json, jsonschema
+jsonschema.validate(json.load(open('/tmp/spike-contract.json')), json.load(open('$ROOT/schemas/contract.schema.json')))
+" ) || fail "spike contract does not validate against contract schema"
+ok "spike contract validates against contract schema"
+
+# --- Check 9: minimal IR validates against IR schema ---
+echo '{"version":"1.0.0","stack":{"name":"l2-static-asset","kind":"l2","depth":1},"resources":[{"id":"s3","type":"aws:s3:bucket","module":"l1-s3@1.0.0","inputs":{"bucket_name":"x","region":"us-east-1"}}]}' > /tmp/spike-ir.json
+( cd /tmp && python3 -c "
+import json, jsonschema
+jsonschema.validate(json.load(open('/tmp/spike-ir.json')), json.load(open('$ROOT/schemas/ir.schema.json')))
+" ) || fail "minimal IR does not validate against IR schema"
+ok "minimal IR validates against IR schema"
+
+echo "VERIFIED — Phase 07: architecture v1.0 finalized; 6 files authored + 11 decisions resolved"