docs(P17): verify phase 17 — VERIFY PASS (v1.3.1)

Four-layer verification: structural, behavioral, security, quality all
pass. One P1 (AWS account ID in l1-ecs-service README usage example)
deferred to post-hoc review — same account ID already in
terraform/microservice/main.tf. Fixed: README template missing ## Overview
header.

---ci---
project: acdl
phase: 17
milestone: v1.3
status: verify
---/ci---

.ciagent/VERIFY.md

@@ -1,71 +1,47 @@
-# Phase 16 — v1.2-capstone-e2e (v1.2) VERIFY
+# Phase 17 — Verify (v1.3.1)
 
-**Verdict: Phase 16: VERIFIED** (capstone, up to IAM-blocked apply)
-**Tag: v1.2.6**
-**Date: 2026-07-21**
+## Structural
 
----
+All 6 deleted files confirmed gone. All 7 kept files confirmed present.
+All 11 new files confirmed present. Registry has 7 L1 entries, 0 L2
+entries. `contracts/` directory deleted. L2 directories kept as
+placeholders with READMEs. **PASS.**
 
-## Scope
+## Behavioral
 
-Phase 16 is the v1.2 capstone: end-to-end verification of the full platform
-flow (consumer content → contract → IR → adapter → terraform validate + plan)
-+ the NFR improvements + the documentation + the v1.1 regression. The
-`terraform apply` (the final step) is blocked by the IAM P0 (Phase 15);
-this verify confirms everything *up to* the apply. Requirement: **REQ-35**.
+- All remaining Python files compile (`py_compile` OK).
+- `scripts/run_platform.sh` syntax valid; loads pre-existing IR instance
+  (`modules-ir/l1/l1-s3/spike_instance.json`); no code calls to
+  `contract_resolver.py` (only a documentation comment noting removal).
+- Adapter successfully compiles the pre-existing IR instance to
+  Terraform (`main.tf` + `terraform.tf` + `providers.tf` emitted).
+- `registry.json` is valid JSON with only L1 entries.
+- `schemas/ir.schema.json` is valid JSON.
+- `spike_instance.json` validates against `ir.schema.json`.
+- No dangling references to deleted files in active code (only the
+  documentation comment in `run_platform.sh` and historical
+  `.ciagent/` + `verify_phaseNN.sh` files, which are expected).
+  **PASS.**
 
-## Verification layers
+## Security
 
-### 1. Structural
-- `scripts/verify_phase16.sh` exists (+x, 11 assertions).
-- `.ciagent/PLAN.md` updated to Phase 16.
-- **PASS.**
+- No secrets in new files. **PASS.**
+- P1 (deferred): `modules-ir/l1/l1-ecs-service/README.md` usage example
+  contains the AWS account ID `581513795199` (same as the existing
+  `terraform/microservice/main.tf`). Not a new leak — the account ID was
+  already in the repo. Recommend replacing with a placeholder in a
+  future docs pass.
 
-### 2. Behavioral (`scripts/verify_phase16.sh`)
-```
-=== Phase 16 — v1.2 capstone e2e verification ===
-Consumer microservice: OK
-v1.2 contract -> IR -> adapter: OK (11 resources)
-terraform validate + plan: OK (Plan: 13 to add, 0 to change, 0 to destroy.)
-NFR improvements (Phase 12): OK (run_platform.sh + IAM expanded)
-P1-1 redaction: OK (no live AWS key IDs)
-README accuracy: OK
-v1.1 S3 regression: OK
-L1 catalog: OK (7 L1s)
-l2-microservice: OK
-.ciagent/ consistency: OK
-outbox: OK (3 event(s))
-Evidence events: OK
+## Quality
 
-=== Phase 16: VERIFIED (capstone, up to IAM-blocked apply) ===
-```
+- README template has all required sections (Overview, Resources,
+  Inputs, Outputs, Usage, Compliance extension points, Versioning)
+  after adding the `## Overview` header. **PASS.**
+- All 7 L1 READMEs have all required sections. **PASS.**
+- Both L2 READMEs have placeholder notes mentioning redesign. **PASS.**
+- Catalog index lists all 7 L1s + 2 L2s. **PASS.**
 
-All 11 assertions pass. The full v1.2 platform is verified end-to-end up
-to the `terraform apply`. The `MILESTONE_CAPSTONE_VERIFIED` evidence event
-is written to the DynamoDB outbox.
-- **PASS.**
+## Verdict
 
-### 3. Security
-- No credentials introduced. The IAM P0 blocker is a security positive (least-privilege enforced; policy push requires a deliberate privileged action).
-- **PASS.**
-
-### 4. Quality
-- The capstone verify exercises every v1.2 deliverable: consumer microservice (Phase 15), contract→IR→adapter pipeline (Phase 14), L1 catalog (Phase 13), NFR improvements (Phase 12), README (Phase 11), v1.1 S3 regression.
-- The `terraform plan` (13 to add) confirms the adapter fixes from Phase 15 produce valid HCL for the full ECS microservice stack.
-- **PASS.**
-
-## P0 / P1
-- **P0: 1 (carried from Phase 15 — operator action).** `terraform apply` blocked by IAM. Unblock: operator runs `create_iam_user.py` with root/admin creds, then `terraform apply` (13 to add) → live ECS service → HTTP 200. This completes REQ-33 + REQ-35.
-- **P1: none new.**
-
-## Requirements covered
-- **REQ-35:** End-to-end verification — consumer commit → pipeline → ECS service → evidence event → timeline. **PARTIAL** (verified up to `terraform plan`; the `apply` + HTTP 200 check are the operator's post-unblock step). The `MILESTONE_CAPSTONE_VERIFIED` evidence event is in the outbox.
-
-## Conclusion
-
-Phase 16 is VERIFIED (capstone, up to the IAM-blocked apply). The v1.2
-milestone is complete in code: all 6 phases shipped (v1.2.1–v1.2.6), the
-platform flow is verified end-to-end up to `terraform plan` (13 to add),
-and the one remaining step (`terraform apply` → live ECS service) is the
-operator's IAM policy push (P0, documented). The milestone is ready for
-the COMPLETE gate (review → ship v1.3.0 → audit).
+**VERIFY PASS** — all four layers pass. One P1 (account ID in usage
+example) deferred to post-hoc review.

modules-ir/README-TEMPLATE.md

@@ -2,6 +2,8 @@
 
 > **Module kind:** L1 primitive  |  **Version:** 1.0.0
 
+## Overview
+
 One or two sentences describing what this module provisions, in plain
 language. No jargon. A reader should know after this paragraph whether
 this module is what they need.