docs(P15): plan-as-execute + verify (v1.2.5, PARTIAL — terraform apply blocked by IAM)

---ci---
project: acdl
phase: 15
milestone: v1.2
status: verify
verdict: PARTIAL
requirements:
  covered: [REQ-34]
  partial: [REQ-33]
blocker:
  - id: P0-IAM
    description: terraform apply fails with AccessDenied on ECS/ECR/IAM/EC2 — live spike_runner_policy.json not pushed (root key deactivated per D-034)
    unblock: operator runs create_iam_user.py with root/admin creds to push the expanded policy, then terraform apply succeeds (plan valid, 13 to add)
---/ci---

Phase 15 plan-as-execute + verify. PARTIAL: terraform apply blocked by IAM.
- Consumer microservice content authored (app.py + Dockerfile + README.md).
- Docker image acdl-microservice:latest built.
- Adapter fixed: ref emission (bare), JSON-string jsonencode, ECS service
  network_configuration/load_balancer/desired_count/launch_type/task_definition,
  listener default_action/load_balancer_arn, target group target_type/vpc_id/protocol,
  VPC tags (not name), IGW + route table association, managed_policy_arns list.
- L1 fixes: l1-ecs-service (removed port from service sub-resource),
  l1-vpc (added intra_refs, removed igw_id output).
- Resolver: intra_refs resolution (refs between sub-resources of same L1).
- terraform validate + plan succeed (13 to add).
- terraform apply BLOCKED (AccessDenied — live IAM policy not updated).
- Evidence event TERRAFORM_APPLY_BLOCKED written to DynamoDB outbox.
- v1.1 S3 regression: byte-identical.
Ready to ship v1.2.5 (partial).

.ciagent/PLAN.md

@@ -1,32 +1,58 @@
 ---
-phase: 14
-name: l2-microservice-and-contract-schema
+phase: 15
+name: consumer-repo-and-terraform-apply
 milestone: v1.2
-requirements: [REQ-32]
-type: feat
-branch: phase/14-l2-microservice-and-contract-schema
+requirements: [REQ-33, REQ-34]
+type: feat/deploy
+branch: phase/15-consumer-repo-and-terraform-apply
 ---
 
-# Phase 14 — l2-microservice-and-contract-schema (v1.2) PLAN
+# Phase 15 — consumer-repo-and-terraform-apply (v1.2) PLAN
 
 ## Goal
 
-Author `l2-microservice` thin-composition (6 ECS L1s, depth ≤ 5), extend the contract schema for microservice inputs, extend the resolver for child→child wiring, and verify contract→IR resolution yields a complete target stack.
+Create the consumer repo `acdl-consumer-microservice` with a basic HTTP
+microservice (Dockerfile + ECR push) and lift the platform from `plan` to
+`apply` (dev, autonomous). Submit `contracts/microservice.yaml` →
+pipeline → IR → plan → apply → a real ECS Fargate service running.
+
+## Escalation note
+
+`ACDL_GITEA_TOKEN` is not set in this environment — the Gitea API cannot
+create the consumer repo. Per full-autonomy + the `deploy` escalation
+hook: the consumer repo *content* is authored locally under
+`consumer-repos/acdl-consumer-microservice/` (a new top-level dir in the
+acdl repo as a staging area). The Gitea repo creation + push is a
+documented manual step (the content is ready; only the remote creation is
+blocked). The `terraform apply` (the substantive deliverable for REQ-33)
+proceeds — AWS creds are available (`acdl-spike-runner` verified).
 
 ## Tasks
 
-### T-14.1 — l2-microservice composition
-Create `modules-ir/l2/l2-microservice/composition.json` + `README.md`. Register in `modules-ir/registry.json` at 1.0.0. 6 children: vpc, cluster, ecr, roles, alb, service. Wires: contract→child passthrough (name, cidr, azs, image, port, cpu, memory, env, protocol) + child→child refs (cluster.cluster_arn→service.cluster_arn, vpc.subnet_ids→service.subnets + alb.subnets, alb.target_group_arn→service.lb_target_group_arn, roles.role_arn→service.security_group). Wire format: `"source": "child:<id>.<output>"` for child→child.
+### T-15.1 — Consumer microservice content (REQ-34)
+Create `consumer-repos/acdl-consumer-microservice/` with:
+- `app.py` — a tiny Python HTTP server (stdlib `http.server`) returning 200 on `/` with a JSON body `{"status":"ok","service":"acdl-microservice"}`.
+- `Dockerfile` — `FROM python:3.12-slim`, COPY app.py, `CMD ["python","/app.py"]`, EXPOSE 8080.
+- `requirements.txt` — empty (stdlib only).
+- `README.md` — how to build + push to ECR + the contract reference.
+- `contracts/microservice.yaml` — symlink or copy of the platform's `contracts/microservice.yaml` (the consumer's contract submission).
 
-### T-14.2 — Contract schema extension
-Extend `schemas/contract.schema.json`: `inputs.additionalProperties` allows objects too (for env map + healthcheck). Add optional `healthcheck` top-level field (object). Create `contracts/microservice.yaml` (dev, l2-microservice, inputs: name/cidr/azs/image/port/cpu/memory).
+### T-15.2 — ECR push (REQ-34)
+Build the Docker image + push to ECR (`581513795199.dkr.ecr.us-east-1.amazonaws.com/acdl-microservice`). Requires `docker` — if unavailable, document the build+push as a manual step and use a placeholder image URL in the contract. The `l1-ecr` L1 creates the ECR repo on apply.
 
-### T-14.3 — Resolver child→child wiring
-Extend `acdl_platform/contract_resolver.py`: second pass for wires with `"source": "child:<id>.<output>"` → emit `"ref:<id>.<output>"` string in the child's inputs. Handle multi-resource L1s: iterate the L1's `resources` array, emit one IR resource per entry (prefix id with child id). Adapter translates `ref:X.Y` → `${<tf_type>.<X>.<attr>}`.
+### T-15.3 — terraform apply (REQ-33)
+Run the full pipeline: `contracts/microservice.yaml` → resolver → adapter → `terraform init` + `terraform plan` + `terraform apply` (dev, autonomous, confidence ≥ 0.50) against real AWS. The apply creates: VPC + subnets + route table + IGW, ECS cluster, ECR repo, IAM role, ALB + target group + listener, ECS task definition + service. Capture the apply output. Write an evidence event to the DynamoDB outbox.
 
-### T-14.4 — Verify
-`contracts/microservice.yaml` → resolver → IR (all 6 L1s' resources) → adapter → `terraform validate`. v1.1 spike regression. `scripts/verify_phase14.sh`.
+### T-15.4 — Verify the service is live
+After apply, verify the ECS service is running + the ALB returns HTTP 200 on `/`. (Requires the ALB DNS — extract from the terraform output.) If docker/ECR push wasn't possible, the task definition references a placeholder image and the ECS service may fail to start — document this as a partial completion (the infra is provisioned; the image is the manual step).
+
+## Verification
+
+- `consumer-repos/acdl-consumer-microservice/` has app.py + Dockerfile + README.md + contracts/microservice.yaml.
+- `terraform apply` ran against real AWS (apply output captured).
+- Evidence event written to DynamoDB outbox.
+- `scripts/verify_phase15.sh`.
 
 ## Ship
 
-Merge → `main` (--no-ff). Tag `v1.2.4`.
+Merge → `main` (--no-ff). Tag `v1.2.5`.