docs(P15): plan-as-execute + verify (v1.2.5, PARTIAL — terraform apply blocked by IAM)

---ci---
project: acdl
phase: 15
milestone: v1.2
status: verify
verdict: PARTIAL
requirements:
  covered: [REQ-34]
  partial: [REQ-33]
blocker:
  - id: P0-IAM
    description: terraform apply fails with AccessDenied on ECS/ECR/IAM/EC2 — live spike_runner_policy.json not pushed (root key deactivated per D-034)
    unblock: operator runs create_iam_user.py with root/admin creds to push the expanded policy, then terraform apply succeeds (plan valid, 13 to add)
---/ci---

Phase 15 plan-as-execute + verify. PARTIAL: terraform apply blocked by IAM.
- Consumer microservice content authored (app.py + Dockerfile + README.md).
- Docker image acdl-microservice:latest built.
- Adapter fixed: ref emission (bare), JSON-string jsonencode, ECS service
  network_configuration/load_balancer/desired_count/launch_type/task_definition,
  listener default_action/load_balancer_arn, target group target_type/vpc_id/protocol,
  VPC tags (not name), IGW + route table association, managed_policy_arns list.
- L1 fixes: l1-ecs-service (removed port from service sub-resource),
  l1-vpc (added intra_refs, removed igw_id output).
- Resolver: intra_refs resolution (refs between sub-resources of same L1).
- terraform validate + plan succeed (13 to add).
- terraform apply BLOCKED (AccessDenied — live IAM policy not updated).
- Evidence event TERRAFORM_APPLY_BLOCKED written to DynamoDB outbox.
- v1.1 S3 regression: byte-identical.
Ready to ship v1.2.5 (partial).

acdl_platform/contract_resolver.py

@@ -207,6 +207,17 @@ def resolve(contract_path, repo_root=None):
                     "outputs": sub_outputs,
                 })
                 relationships.append({"from": "root", "to": ir_id, "kind": "parent"})
+            # Resolve intra-L1 refs (refs between sub-resources of the same L1).
+            intra_refs = l1_iface.get("intra_refs", [])
+            for iref in intra_refs:
+                from_type, from_input = iref["from"].split(".", 1)
+                to_type, to_output = iref["to"].split(".", 1)
+                from_ir_id = next((ir_ids[i] for i, s in enumerate(sub_resources) if s["type"] == from_type), None)
+                to_ir_id = next((ir_ids[i] for i, s in enumerate(sub_resources) if s["type"] == to_type), None)
+                if from_ir_id and to_ir_id:
+                    for r in resources:
+                        if r["id"] == from_ir_id:
+                            r["inputs"][from_input] = f"ref:{to_ir_id}.{to_output}"
         else:
             resources.append({
                 "id": child_id,