docs(P62): create phase plan — L2 lifecycle pipeline live run

---ci---
project: acdl
phase: P62
milestone: v1.11
status: plan
---/ci---

.ciagent/PLAN.md

@@ -1,91 +1,58 @@
 ---
-phase: P61
+phase: P62
-name: l2-lifecycle-pipeline-author
+name: l2-lifecycle-pipeline-live-run
 milestone: v1.11
 requirements: [REQ-128]
 wave: 3
-depends_on: [P60]
+depends_on: [P61]
 ---
 
-# P61 — L2 Lifecycle Pipeline (Author)
+# P62 — L2 Lifecycle Pipeline (Live Run)
 
-**Phase:** P61
+**Phase:** P62
 **Milestone:** v1.11 (RESTART)
-**Requirement:** REQ-128
+**Requirement:** REQ-128 (shared with P61)
-**Wave:** 3 (author the L2 lifecycle pipeline, P62 runs it live)
+**Wave:** 3 (P61 authored the L2 pipeline, P62 runs it live)
 **Branch:** `milestone/v1.11-restart`
 
 ## Goal
 
-Extend the `modules-lifecycle` pipeline + both forge workflows with an L2
+Run the L2 lifecycle pipeline against live AWS; fix composition wiring +
-matrix: `static-assets` × `contracts/static-assets.yml` (apply → modify: add
+adapter assembly until green. This replaces the deleted
-WAF rule → destroy) and `microservice` × `contracts/microservice.yml` (apply
+`verify_deploy_microservice.py` — the pipeline IS the verify. CAP-017..022
-→ modify: `desired_count` 1→2 → destroy, references platform VPC). L2 =
+boto3 probes are deferred to a future QA milestone. Fixes land in
-composition only (no L2 terraform files); the composition must be
+`modules/l2/<module>/composition.json`, `modules/l2/<module>/examples/*.yml`,
-deterministic (same contract → same resolved stack → same state key).
+`core/contract_resolver.py`, and rarely the adapter. No new Python files.
 
-## Tasks (single wave)
+## Tasks
 
-### Task 1 — Extend pipelines/modules-lifecycle.yml
+### Task 1 — Run L2 lifecycle matrix live
 
-Add L2 stages to the declarative pipeline contract:
+The L2 lifecycle jobs (`l2-lifecycle` matrix over [static-assets,
-- `l2-lifecycle-apply`: `run_platform.sh --apply modules/l2/${MODULE}/examples/simple.yml`
+microservice]) run as part of the `acdl-modules-lifecycle` workflow on PR #7.
-- `l2-lifecycle-modify`: `run_platform.sh --apply modules/l2/${MODULE}/examples/complex.yml`
+Each cell: apply simple → modify complex → destroy.
-- `l2-lifecycle-destroy`: `run_platform.sh --destroy modules/l2/${MODULE}/examples/complex.yml`
 
-Add L2 matrix entries: `l2_modules: [static-assets, microservice]`
+### Task 2 — Fix failures
 
-### Task 2 — Extend .gitea/workflows/modules-lifecycle.yml + .github/workflows/modules-lifecycle.yml
+Fix any composition wiring or adapter assembly issues discovered by the
+live run. Likely areas:
+- `static-assets`: WAF scope (fixed in P60), CloudFront distribution
+  origin/aliases, S3 bucket policy for CloudFront access.
+- `microservice`: terraform_remote_state pointing to CI VPC state (fixed
+  via ACDL_REMOTE_STATE_KEY in P61), ECS task definition family/image
+  stability across modify, ALB listener port stability.
 
-Add an `l2-lifecycle` job (byte-identical in both forges) that matrix-runs
+### Task 3 — Verify determinism
-over `[static-assets, microservice]`. Each cell:
-- Checkout + Python 3.12 + Terraform 1.9.* + AWS creds (from secrets).
-- `run_platform.sh --apply modules/l2/<module>/examples/simple.yml`
-- `run_platform.sh --apply modules/l2/<module>/examples/complex.yml` (same state key → modify)
-- `run_platform.sh --destroy modules/l2/<module>/examples/complex.yml`
 
-The `l2-lifecycle` job needs the CI VPC (for microservice which references
+Same contract + env → same resolved stack → same state key. Verify that
-the platform VPC via `terraform_remote_state`). It runs after `ci-vpc-apply`
+re-applying the same contract produces no changes (idempotent).
-and before `ci-vpc-destroy`.
-
-### Task 3 — Author modules/l2/static-assets/examples/complex.yml (modify variant)
-
-The complex example already exists and adds CloudFront + WAF. Verify it's a
-valid modify variant (same state key, adds resources without forcing
-replacement of the simple S3 bucket). If the bucket_name changes between
-simple and complex, that forces replacement — fix to keep the same
-bucket_name so terraform modifies in-place.
-
-### Task 4 — Author modules/l2/microservice/examples/complex.yml (modify variant)
-
-The complex example already exists and adds ALB + env vars. The modify
-variant should change `desired_count` (1→2) to demonstrate in-place modify.
-Fix the complex example to keep the same `family` and `image` as simple
-(so terraform modifies rather than replaces the ECS task definition).
-
-### Task 5 — Extend schemas/modules-lifecycle-pipeline.schema.json
-
-Add `l2_modules` to the matrix properties. Add L2 stages to the stages array.
-
-### Task 6 — Extend tests/test_pipeline_contract.py
-
-Add a TestL2LifecyclePipeline class:
-- L2 matrix lists both modules.
-- L2 lifecycle job has apply/modify/destroy steps.
-- L2 job depends on ci-vpc-apply.
-- Pipeline contract validates against the extended schema.
-- Gitea + GitHub workflows remain byte-identical.
-
-### Task 7 — Extend pipelines/README.md
-
-Add L2 lifecycle stages to the pipeline description.
 
 ## Success Criteria (phase gate)
 
-1. `pipelines/modules-lifecycle.yml` validates against its schema.
+1. L2 matrix green: static-assets + microservice, each apply→modify→destroy
-2. `.gitea/workflows/modules-lifecycle.yml` and `.github/workflows/modules-lifecycle.yml` are byte-identical.
+   exit 0. **Evidence = green PR check on l2-lifecycle jobs.**
-3. L2 matrix lists both `static-assets` and `microservice`.
+2. Microservice apply creates NO inline VPC (references platform VPC via
-4. L2 lifecycle job has apply→modify→destroy steps.
+   terraform_remote_state data source).
-5. `test_pipeline_contract.py` passes (offline).
+3. Same state key across apply/modify/destroy (deterministic).
-6. Composition resolution is deterministic (same contract → same stack).
+4. `patterns-plan.yml` (plan-only) still passes.
-7. Full offline pytest suite green.
+5. Full offline pytest suite green.