diff --git a/core/contract_resolver.py b/core/contract_resolver.py
index 676ae8a..5b1ff1c 100644
--- a/core/contract_resolver.py
+++ b/core/contract_resolver.py
@@ -186,7 +186,7 @@ def _resolve_l1(module_name, version, inputs, registry, repo_root):
 
     # Build the resource
     resource = {
-        "id": iface.get("type", module_name).split(":")[-1]
+        "id": iface.get("type", module_name).split(":")[-1].replace("_", "-")
         if ":" in iface.get("type", "") else module_name,
         "type": iface["type"],
         "module": module_ref,
diff --git a/schemas/stack.schema.json b/schemas/stack.schema.json
index 4167a14..971f8d6 100644
--- a/schemas/stack.schema.json
+++ b/schemas/stack.schema.json
@@ -92,7 +92,7 @@
         "inputs": {
           "type": "object",
           "description": "Input values keyed by the module's declared inputs. Free-form in v1 (validated at contract->stack resolution against the module registry); typed per-module in v1.2.",
-          "additionalProperties": {"type": ["string", "number", "boolean"]}
+          "additionalProperties": {"type": ["string", "number", "boolean", "array", "object"]}
         },
         "outputs": {
           "type": "object",
diff --git a/scripts/run_platform.sh b/scripts/run_platform.sh
index c3a4760..03fa1b0 100755
--- a/scripts/run_platform.sh
+++ b/scripts/run_platform.sh
@@ -277,14 +277,18 @@ print(f\"adapter output: OK ({d['stack']['name']}, {len(d['resources'])} resourc
 fi
 
 echo "=== Loading AWS credentials (not needed for --check-only) ==="
-ENV_FILE="$ROOT/.env.secrets"
-[ -f "$ENV_FILE" ] || fail ".env.secrets missing (run scripts/rotate_spike_key.sh)"
-set -a
-. "$ENV_FILE"
-set +a
-export AWS_ACCESS_KEY_ID="$ACDL_AWS_ACCESS_KEY_ID"
-export AWS_SECRET_ACCESS_KEY="$ACDL_AWS_SECRET_ACCESS_KEY"
-export AWS_DEFAULT_REGION="$AWS_DEFAULT_REGION"
+# In CI, the configure-aws-credentials action sets AWS_ACCESS_KEY_ID and
+# AWS_SECRET_ACCESS_KEY as env vars directly. Locally, we load from .env.secrets.
+if [ -z "${AWS_ACCESS_KEY_ID:-}" ] || [ -z "${AWS_SECRET_ACCESS_KEY:-}" ]; then
+  ENV_FILE="$ROOT/.env.secrets"
+  [ -f "$ENV_FILE" ] || fail ".env.secrets missing (run scripts/rotate_spike_key.sh) or set AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY env vars"
+  set -a
+  . "$ENV_FILE"
+  set +a
+  export AWS_ACCESS_KEY_ID="$ACDL_AWS_ACCESS_KEY_ID"
+  export AWS_SECRET_ACCESS_KEY="$ACDL_AWS_SECRET_ACCESS_KEY"
+  export AWS_DEFAULT_REGION="$AWS_DEFAULT_REGION"
+fi
 
 echo "=== Step 4: terraform init + validate + plan -lock=false (real AWS) ==="
 cd "$TF_DIR"