From 60f767d1256645bae4850728258957fbc6ded4c0 Mon Sep 17 00:00:00 2001
From: Jon Chery <jchery@jccapital.xyz>
Date: Tue, 28 Jul 2026 16:05:52 +0000
Subject: [PATCH] =?UTF-8?q?fix(P59):=203=20pipeline-readiness=20fixes=20?=
 =?UTF-8?q?=E2=80=94=20resolver=20id,=20schema=20inputs,=20CI=20creds?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

3 fixes found during the pipeline-readiness audit (all 24 example contracts
now resolve + adapt + pass --check-only):

1. core/contract_resolver.py: L1 resolver resource id now replaces underscores
   with hyphens (task_definition → task-definition), matching the L2 resolver
   pattern. The stack schema requires ^[a-z][a-z0-9-]*$ (no underscores).

2. schemas/stack.schema.json: relaxed input type constraint to allow array +
   object (was string/number/boolean only). Real-world inputs include lists
   (monitored_endpoints, static_checks, rules) and dicts (alert_channels).

3. scripts/run_platform.sh: AWS creds loading is now conditional — if
   AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY are already set (by the CI
   configure-aws-credentials action), skip loading .env.secrets. This makes
   the --apply/--destroy modes work in CI without the gitignored secrets file.

Regression: 479 passed, 0 skipped, 5 deselected.

---ci---
project: acdl
phase: P59
milestone: v1.11
status: execute
---/ci---
---
 core/contract_resolver.py |  2 +-
 schemas/stack.schema.json |  2 +-
 scripts/run_platform.sh   | 20 ++++++++++++--------
 3 files changed, 14 insertions(+), 10 deletions(-)

diff --git a/core/contract_resolver.py b/core/contract_resolver.py
index 676ae8a..5b1ff1c 100644
--- a/core/contract_resolver.py
+++ b/core/contract_resolver.py
@@ -186,7 +186,7 @@ def _resolve_l1(module_name, version, inputs, registry, repo_root):
 
     # Build the resource
     resource = {
-        "id": iface.get("type", module_name).split(":")[-1]
+        "id": iface.get("type", module_name).split(":")[-1].replace("_", "-")
         if ":" in iface.get("type", "") else module_name,
         "type": iface["type"],
         "module": module_ref,
diff --git a/schemas/stack.schema.json b/schemas/stack.schema.json
index 4167a14..971f8d6 100644
--- a/schemas/stack.schema.json
+++ b/schemas/stack.schema.json
@@ -92,7 +92,7 @@
         "inputs": {
           "type": "object",
           "description": "Input values keyed by the module's declared inputs. Free-form in v1 (validated at contract->stack resolution against the module registry); typed per-module in v1.2.",
-          "additionalProperties": {"type": ["string", "number", "boolean"]}
+          "additionalProperties": {"type": ["string", "number", "boolean", "array", "object"]}
         },
         "outputs": {
           "type": "object",
diff --git a/scripts/run_platform.sh b/scripts/run_platform.sh
index c3a4760..03fa1b0 100755
--- a/scripts/run_platform.sh
+++ b/scripts/run_platform.sh
@@ -277,14 +277,18 @@ print(f\"adapter output: OK ({d['stack']['name']}, {len(d['resources'])} resourc
 fi
 
 echo "=== Loading AWS credentials (not needed for --check-only) ==="
-ENV_FILE="$ROOT/.env.secrets"
-[ -f "$ENV_FILE" ] || fail ".env.secrets missing (run scripts/rotate_spike_key.sh)"
-set -a
-. "$ENV_FILE"
-set +a
-export AWS_ACCESS_KEY_ID="$ACDL_AWS_ACCESS_KEY_ID"
-export AWS_SECRET_ACCESS_KEY="$ACDL_AWS_SECRET_ACCESS_KEY"
-export AWS_DEFAULT_REGION="$AWS_DEFAULT_REGION"
+# In CI, the configure-aws-credentials action sets AWS_ACCESS_KEY_ID and
+# AWS_SECRET_ACCESS_KEY as env vars directly. Locally, we load from .env.secrets.
+if [ -z "${AWS_ACCESS_KEY_ID:-}" ] || [ -z "${AWS_SECRET_ACCESS_KEY:-}" ]; then
+  ENV_FILE="$ROOT/.env.secrets"
+  [ -f "$ENV_FILE" ] || fail ".env.secrets missing (run scripts/rotate_spike_key.sh) or set AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY env vars"
+  set -a
+  . "$ENV_FILE"
+  set +a
+  export AWS_ACCESS_KEY_ID="$ACDL_AWS_ACCESS_KEY_ID"
+  export AWS_SECRET_ACCESS_KEY="$ACDL_AWS_SECRET_ACCESS_KEY"
+  export AWS_DEFAULT_REGION="$AWS_DEFAULT_REGION"
+fi
 
 echo "=== Step 4: terraform init + validate + plan -lock=false (real AWS) ==="
 cd "$TF_DIR"