diff --git a/.ciagent/REQUIREMENTS.md b/.ciagent/REQUIREMENTS.md
index 1e9b1b9..1159a27 100644
--- a/.ciagent/REQUIREMENTS.md
+++ b/.ciagent/REQUIREMENTS.md
@@ -167,7 +167,7 @@
 | Requirement | Phase | Status |
 |-------------|-------|--------|
 | REQ-29 | 11 | complete (v1.2.1) |
-| REQ-30 | 12 | planned |
+| REQ-30 | 12 | complete (v1.2.2) |
 | REQ-31 | 13 | planned |
 | REQ-32 | 14 | planned |
 | REQ-33 | 15 | planned |
diff --git a/.ciagent/ROADMAP.md b/.ciagent/ROADMAP.md
index cfade29..5640bf3 100644
--- a/.ciagent/ROADMAP.md
+++ b/.ciagent/ROADMAP.md
@@ -159,7 +159,7 @@ microservice to AWS ECS Fargate end-to-end. Ship tag at milestone COMPLETE:
 
 ### Phase 12 — nfr-harden-and-simplify
 - **Description:** Apply Phase 11's findings. Tighten `terraform/bootstrap/spike_runner_policy.json` to least-privilege (add ECS + ECR + ELB + IAM plan-only permissions for v1.2; audit for wildcards). Make `create_state_backend.py` and `create_iam_user.py` idempotent. Consolidate `run_spike_plan.sh` + `run_spike_e2e.sh` into a single `scripts/run_platform.sh` with proper exit codes and error handling. Redact P1-1 (the two AWS access key IDs in `.ciagent/VERIFY.md` Phase 09 narrative). Fix any remaining stale `platform/` paths in `.ciagent/`. The v1.1 spike still runs e2e after the refactor.
-- **Status:** planned
+- **Status:** complete (v1.2.2)
 - **Depends on:** [11]
 - **Requirements:** REQ-30
 - **Success Criteria:**