docs(P56): research findings for v1.11

RESEARCH stage. Verified the technical assumptions behind the 8-phase
v1.11 plan against the live codebase.

Findings:
- spike_runner_policy.json (terraform/bootstrap/) already grants
  ECS/ECR/ELB/IAM/EC2/S3-tfstate/DynamoDB-outbox. MISSING for CAP-017..022:
  cloudfront, waf, lambda, dynamodb (acdl-contracts + acdl-change-requests),
  secretsmanager, sns, ce (Cost Explorer). Phase 56 extends this exact file.
- terraform/platform/main.tf already defines acdl_contracts table, Lambda
  contract_ingestor + Function URL, acdl_change_requests table, acdl-sod-halt
  SNS topic. CAP-017/018 verification = terraform apply platform stack +
  Lambda Function URL probe.
- modules/l2/{microservice,static-assets}/composition.json confirm the L2
  wiring; contracts/*.yml use the v1.10.2 contract shape (id/name/
  infrastructure map).
- scripts/run_platform.sh implements decommission mode (D-070, REQ-92) with
  2-step pipeline + SRE gates + changeRequestId validation. Phase 61 reuses
  this exact path for teardown (REQ-122).
- scripts/run_regression.sh + core/regression_verify.py implement the D-091
  regression gate. v1.11 milestone COMPLETE re-runs this; CAP-017..022 must
  be added to the capability registry so the regression gate covers them.
- Decks (docs/presentations/*-marp.md + source .md) carry the "6 IAM-gated
  cloud resources escalated (require an admin principal)" framing in 4
  locations. Phase 62 rewrites all 4 to "Verified live-aws on <date>".

PERSONAS.md updated for v1.11:
- lambda-engineer reactivated (Phase 57 live Lambda probe).
- NEW cost-engineer persona (Phase 59 Cost Explorer + COST.md).
- Domain priority: coordination → security → platform → backend → lambda
  → cost → frontend.
- Phase-specific overrides 56-63 added.
- Territory enforcement: warn (co-authoring expected on spike_runner_policy
  + terraform/platform/main.tf).

Env state: ACDL_BOOTSTRAP_AWS_* NOT set in this shell. Phase 56 will
escalate per D-095 (escalate to human for fresh access keys, not silent
fallback).

---ci---
project: acdl
phase: 0
milestone: v1.11
status: research
---/ci---

.ciagent/PERSONAS.md

@@ -1,8 +1,10 @@
 ---
 project: acdl
-milestone: v1.9
-generated_at: 2026-07-23
+milestone: v1.11
+generated_at: 2026-07-28
 generator: lead-developer
+supersedes: v1.9 PERSONAS.md (lambda-engineer reactivated for v1.11;
+  new cost-engineer persona added for the AWS spend tier)
 verification_toolchain:
   typecheck: "terraform validate && python3 -m py_compile core/**/*.py && python3 -m jsonschema schemas/*.schema.json"
   test: "scripts/verify_phaseNN.sh"
@@ -56,14 +58,14 @@ verification_toolchain:
 - **Territory:** `core/hitl_matrix_design.md`, `core/audit_ledger_design.md`, `adapters/terraform/policy/**` (Checkov adapter + custom rules), `adapters/wiz/**` (Wiz adapter), `adapters/kyverno/**` (Kyverno adapter + sample policies), `core/separation_of_duties.py`, `schemas/tagging-standard.json`, `schemas/policy_check_result.schema.json` (engine enum)
 - **Reason:** Owns the HITL matrix design, separation-of-duties, the audit ledger design, the Checkov→PolicyCheckResult adapter + the custom tagging rule (D-054, D-043 closure), the Wiz adapter (D-052), the Kyverno adapter (D-053), and the tagging standard. Enforces the "Safety is Computed, Not Assumed" + "Audit truth lives outside the repository" vision tenets.
 
-### lambda-engineer (custom, v1.9)
+### lambda-engineer (custom, v1.9, reactivated v1.11)
 - **Domain:** serverless
 - **Active:** true
-- **Phase-specific:** true (reactivated for v1.9; removed after milestone COMPLETE)
+- **Phase-specific:** true (reactivated for v1.11 Phases 56/57/58; removed after milestone COMPLETE)
 - **Frameworks:** python, aws-lambda, boto3, dynamodb, aws-secretsmanager, aws-sns, github-api, gitea-api
 - **Constraints:** lambda-is-stateless, dynamodb-is-the-state-store, secrets-from-secrets-manager-never-logged, idempotent-actions, cross-account-iam-via-abac, forge-agnostic-api-urls, sns-topic-arn-from-env
 - **Territory:** `core/lambda/**` (contract_ingestor.py + handler), `terraform/platform/main.tf` (Lambda + Function URL + DynamoDB + KMS + Secrets Manager + IAM + acdl-change-requests table + acdl-sod-halt SNS topic), `terraform/platform/consumer_invoke_policy.json`, `terraform/platform/variables.tf`
-- **Reason:** Reactivated for v1.9 Phase 42 (acdl-sod-halt SNS topic for `route_halt_artifact`, defined in `terraform/platform/main.tf`). The Lambda is stateless; all state is in DynamoDB. Forge-agnostic API URLs (GitHub + Gitea) via GITHUB_API_BASE env var. Removed from the roster after milestone COMPLETE (the code persists, but the persona is no longer active).
+- **Reason:** Reactivated for v1.11 Phase 57 — CAP-018 (Lambda contract-ingestor deployed + invocable) needs the lambda-engineer to verify the live Lambda Function URL responds to an ingest request with a real record written to `acdl-contracts`. The persona is removed from the roster after v1.11 milestone COMPLETE (the code persists, but the persona is no longer active).
 
 ### frontend-engineer
 - **Domain:** frontend
@@ -74,6 +76,15 @@ verification_toolchain:
 - **Territory:** `evidence-ui/**` (the timeline UI; pushed to `acdl-evidence`)
 - **Reason:** Owns the evidence timeline UI (`index.html`). Carried over from v1.0; the UI continues to render the audit stream. The v1.7 spike writes events to the DynamoDB outbox; the UI continues to read `audit.json` published to `acdl-evidence`.
 
+### cost-engineer (custom, v1.11)
+- **Domain:** finops
+- **Active:** true
+- **Phase-specific:** true (created for v1.11 Phase 59; removed after milestone COMPLETE)
+- **Frameworks:** aws-cost-explorer, aws-billing, boto3-ce, markdown
+- **Constraints:** document-real-spend-not-estimates, cost-avoidance-via-local-emulators-primary-tier, teardown-is-mandatory-pre-complete (D-096), no-permanent-live-spend-beyond-milestone-window, per-service-breakdown-not-lump-sum
+- **Territory:** `.ciagent/COST.md` (new), `scripts/query_aws_spend.py` (new, Phase 59), `.ciagent/REGRESSION_REPORT.md` (cost-section addendum only)
+- **Reason:** Created for v1.11 Phase 59 (REQ-119, G-008 escalation). Owns the Cost Explorer query + the COST.md document + the teardown-cost-ceiling guidance for downstream clones. Distinct from platform-engineer (which owns infra-as-code but not the spend accounting) and from lead-developer (which owns `.ciagent/` metadata but the cost doc is a finops deliverable, not pure metadata). Removed after milestone COMPLETE; COST.md persists but the persona is inactive going forward.
+
 ## Deactivated personas
 
 ### infra-stub-engineer (custom, v1.0 only)
@@ -112,18 +123,26 @@ verification_toolchain:
 | 41 per-environment-ci-jobs | backend-engineer (lead: deploy.yml environment input + run_platform.sh --environment + per-env contracts + caller-workflow docs), security-engineer (HITL gate structure review) | platform/lambda/frontend idle |
 | 42 stub-implementation | security-engineer (lead: route_halt_artifact SNS + hitl_gates.py + attestation_matrix.py + Wiz real client + Kyverno fleshed out), backend-engineer (run_platform.sh HITL gate wiring), lambda-engineer (acdl-sod-halt SNS topic in terraform/platform/main.tf) | platform/frontend idle |
 | 43 verify-review-audit-complete | lead-developer (lead: 4-layer verify + review + audit + milestone completion), all personas (review participation) | — |
+| 56 iam-re-bootstrap-and-deploy-grant | security-engineer (lead: least-privilege policy scope + IAM_POLICY.md), platform-engineer (terraform/bootstrap + spike_runner_policy.json extension + OIDC role re-creation) | backend/lambda/cost/frontend idle |
+| 57 live-deploy-verify-microservice | platform-engineer (lead: terraform apply microservice stack + ECS/ALB/VPC/ECR live), lambda-engineer (Lambda ingest probe + DynamoDB acdl-contracts describe), security-engineer (deploy escalation review) | backend/cost/frontend idle |
+| 58 live-deploy-verify-static-assets-uptime | platform-engineer (lead: terraform apply static-assets + CloudFront+WAF+S3 + uptime-kumo + poll loop), security-engineer (WAF ACL attachment review) | backend/lambda/cost/frontend idle |
+| 59 cost-documentation-from-billing | cost-engineer (lead: Cost Explorer query + COST.md + teardown-cost-ceiling guidance), lead-developer (.ciagent/ metadata review) | platform/backend/lambda/security/frontend idle |
+| 60 pre-mortem-doc | lead-developer (lead: PRE_MORTEM.md), security-engineer (failure-mode input — IAM drift + cost spike) | platform/backend/lambda/cost/frontend idle |
+| 61 teardown-deployed-stacks | platform-engineer (lead: D-070 decommission mode 2-step + HITL SRE gates), security-engineer (delete_data escalation review), lambda-engineer (Lambda + DynamoDB teardown if not torn down by terraform destroy) | backend/cost/frontend idle |
+| 62 decks-to-deploy-verified-reality | lead-developer (lead: CAPABILITY_INVENTORY.md + PROJECT.md + decks + HTML re-render + PPTX), cost-engineer (cost appendix slide content), security-engineer (deploy-unverified→Verified transition review) | platform/backend/lambda/frontend idle |
+| 63 verify-review-audit-complete | lead-developer (lead: 4-layer verify + review + ship v1.11.0 + audit + milestone completion), all personas (review participation) | — |
 
 ## Domain priority (used by TaskDecomposer)
 
-`coordination → security → platform → backend → lambda → frontend`
+`coordination → security → platform → backend → lambda → cost → frontend`
 
-Rationale: in v1.9, the security commitments (HITL gates, attestation
-matrix, SoD halt artifact, Wiz/Kyverno adapters) and the design-doc
-accuracy are the binding constraints; platform owns the P1-1 adapter
-parameterization + L1 interface inputs; backend owns the contract
-interpolation + per-env CI jobs + the deploy workflow env input;
-lambda owns the SNS topic Terraform; frontend is unchanged from v1.0
-(evidence timeline).
+Rationale: in v1.11, the binding constraints are the IAM re-bootstrap
+(security owns least-privilege policy scope), the live terraform apply
+(platform owns the stacks), the Lambda ingest verification (lambda owns
+the live probe), the cost documentation (cost owns the spend query +
+COST.md), and the deck rewrite (lead-developer owns `.ciagent/` + the
+deck edits). frontend is unchanged from v1.0 (evidence timeline, idle
+this milestone).
 
 ## Conflict resolutions (lead-developer arbitration)
 
@@ -138,6 +157,7 @@ lambda owns the SNS topic Terraform; frontend is unchanged from v1.0
 
 `warn` — config.json has no `personas.territory_enforcement` field, so the
 default per execute.md is `warn`. Cross-territory edits are logged in the
-commit message but do not fail the task. v1.7's broad scope means
-co-authoring across territories is likely (e.g. lambda + platform on
+commit message but do not fail the task. v1.11's IAM + deploy + teardown
+scope means co-authoring across territories is likely (e.g. security +
+platform on `spike_runner_policy.json`; lambda + platform on
 `terraform/platform/main.tf`); `warn` keeps it frictionless.