fix(ci): separate short-lived CI VPC + fix 8 module lifecycle failures

Two architectural changes:
1. Created terraform/ci-vpc/ — a short-lived VPC for L1 module lifecycle
   testing, separate from the long-lived platform VPC. Created before
   VPC-dependent modules (alb, ecs-service, rds, uptime) are tested,
   destroyed after. Outputs (vpc_id, subnet_ids, sg_id, cluster_arn) are
   passed to those modules via scripts/run_lifecycle_test.sh +
   run_lifecycle_destroy.sh wrappers that inject the CI VPC outputs into
   the example contracts.
2. Updated the workflow to use ci-vpc-apply → lifecycle (with artifact
   passing) → ci-vpc-destroy (always runs).

8 module-specific fixes:
- s3: unique bucket names (acdl-ci-s3a-simple/complex) instead of
  globally-taken 'my-simple-bucket'
- kms-key: alias name with no spaces (locals.tf → alias/acdl-ci-kms)
- iam-role: example contract uses role_name (not name, which the interface
  doesn't declare)
- ecs-service: example contract uses family (not name); VPC inputs
  (cluster_arn, subnets, security_group) injected by CI VPC wrapper
- uptime: added subnets, security_group, cluster_arn to interface + module;
  network_configuration is dynamic (only when subnets provided)
- rds: added subnet_ids input + db_subnet_group resource (conditional
  on subnet_ids being non-empty)
- alb: removed hardcoded placeholder sg/subnet values from examples;
  vpc_id + subnets + security_group injected by CI VPC wrapper
- cloudfront: removed invalid placeholder WAF ARN from complex example

Regression: 479 passed, 0 skipped, 5 deselected. All 24 example contracts
pass --check-only.

---ci---
project: acdl
phase: P59
milestone: v1.11
status: execute
---/ci---

.gitea/workflows/modules-lifecycle.yml

@@ -7,8 +7,9 @@
 # This workflow implements pipelines/modules-lifecycle.yml (byte-identical
 # in .gitea/workflows/ and .github/workflows/).
 #
-# VPC-dependent L1s (alb, ecs-service, rds, uptime) reference the platform VPC
+# A short-lived CI VPC (terraform/ci-vpc/) is created before testing VPC-dependent
-# applied by a prerequisite job. Non-VPC L1s run independent.
+# modules (alb, ecs-service, rds, uptime) and destroyed after all tests complete.
+# The CI VPC is separate from the long-lived platform VPC.
 name: acdl-modules-lifecycle
 
 on:
@@ -20,9 +21,9 @@ permissions:
   contents: read
 
 jobs:
-  # Prerequisite: apply the shared platform VPC (needed by VPC-dependent L1s)
+  # Prerequisite: apply the short-lived CI VPC (needed by VPC-dependent L1s)
-  platform-vpc-apply:
+  ci-vpc-apply:
-    name: Platform VPC apply
+    name: CI VPC apply
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -34,31 +35,29 @@ jobs:
           wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
           echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
           sudo apt-get update && sudo apt-get install -y terraform=1.9.*
-      - name: Configure AWS credentials
+      - name: Install dependencies
-        run: |
+        run: pip install jsonschema pyyaml boto3
-          echo "AWS_ACCESS_KEY_ID=${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}" >> $GITHUB_ENV
+      - name: Apply CI VPC
-          echo "AWS_SECRET_ACCESS_KEY=${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}" >> $GITHUB_ENV
+        working-directory: terraform/ci-vpc
-          echo "AWS_DEFAULT_REGION=us-east-1" >> $GITHUB_ENV
-      - name: Apply platform VPC
-        working-directory: terraform/platform
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
           AWS_DEFAULT_REGION: us-east-1
         run: |
           terraform init -input=false -lock=false
-          terraform apply -auto-approve -lock=false \
+          terraform apply -auto-approve -lock=false
-            -target=aws_vpc.acdl_shared \
+          terraform output -json > /tmp/ci-vpc-outputs.json
-            -target=aws_subnet.acdl_shared \
+          cat /tmp/ci-vpc-outputs.json
-            -target=aws_internet_gateway.acdl_shared \
+      - name: Upload CI VPC outputs
-            -target=aws_route_table.acdl_shared \
+        uses: actions/upload-artifact@v4
-            -target=aws_route_table_association.acdl_shared \
+        with:
-            -target=aws_security_group.ecs
+          name: ci-vpc-outputs
+          path: /tmp/ci-vpc-outputs.json
 
   # L1 lifecycle matrix: apply simple → apply complex (modify) → destroy
   lifecycle:
     name: L1 lifecycle (${{ matrix.module }})
-    needs: platform-vpc-apply
+    needs: ci-vpc-apply
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -76,28 +75,33 @@ jobs:
           wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
           echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
           sudo apt-get update && sudo apt-get install -y terraform=1.9.*
+      - name: Download CI VPC outputs
+        uses: actions/download-artifact@v4
+        with:
+          name: ci-vpc-outputs
+          path: /tmp
       - name: Apply (simple)
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
           AWS_DEFAULT_REGION: us-east-1
-        run: bash scripts/run_platform.sh --apply "modules/l1/${{ matrix.module }}/examples/simple.yml"
+        run: bash scripts/run_lifecycle_test.sh ${{ matrix.module }} simple /tmp/ci-vpc-outputs.json
       - name: Modify (complex)
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
           AWS_DEFAULT_REGION: us-east-1
-        run: bash scripts/run_platform.sh --apply "modules/l1/${{ matrix.module }}/examples/complex.yml"
+        run: bash scripts/run_lifecycle_test.sh ${{ matrix.module }} complex /tmp/ci-vpc-outputs.json
       - name: Destroy
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
           AWS_DEFAULT_REGION: us-east-1
-        run: bash scripts/run_platform.sh --destroy "modules/l1/${{ matrix.module }}/examples/complex.yml"
+        run: bash scripts/run_lifecycle_destroy.sh ${{ matrix.module }} /tmp/ci-vpc-outputs.json
 
-  # Cleanup: destroy the platform VPC (always runs, even if lifecycle fails)
+  # Cleanup: destroy the CI VPC (always runs, even if lifecycle fails)
-  platform-vpc-destroy:
+  ci-vpc-destroy:
-    name: Platform VPC destroy
+    name: CI VPC destroy
     needs: lifecycle
     runs-on: ubuntu-latest
     if: always()
@@ -111,18 +115,12 @@ jobs:
           wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
           echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
           sudo apt-get update && sudo apt-get install -y terraform=1.9.*
-      - name: Destroy platform VPC
+      - name: Destroy CI VPC
-        working-directory: terraform/platform
+        working-directory: terraform/ci-vpc
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
           AWS_DEFAULT_REGION: us-east-1
         run: |
           terraform init -input=false -lock=false
-          terraform destroy -auto-approve -lock=false \
+          terraform destroy -auto-approve -lock=false
-            -target=aws_vpc.acdl_shared \
-            -target=aws_subnet.acdl_shared \
-            -target=aws_internet_gateway.acdl_shared \
-            -target=aws_route_table.acdl_shared \
-            -target=aws_route_table_association.acdl_shared \
-            -target=aws_security_group.ecs

.github/workflows/modules-lifecycle.yml

@@ -7,8 +7,9 @@
 # This workflow implements pipelines/modules-lifecycle.yml (byte-identical
 # in .gitea/workflows/ and .github/workflows/).
 #
-# VPC-dependent L1s (alb, ecs-service, rds, uptime) reference the platform VPC
+# A short-lived CI VPC (terraform/ci-vpc/) is created before testing VPC-dependent
-# applied by a prerequisite job. Non-VPC L1s run independent.
+# modules (alb, ecs-service, rds, uptime) and destroyed after all tests complete.
+# The CI VPC is separate from the long-lived platform VPC.
 name: acdl-modules-lifecycle
 
 on:
@@ -20,9 +21,9 @@ permissions:
   contents: read
 
 jobs:
-  # Prerequisite: apply the shared platform VPC (needed by VPC-dependent L1s)
+  # Prerequisite: apply the short-lived CI VPC (needed by VPC-dependent L1s)
-  platform-vpc-apply:
+  ci-vpc-apply:
-    name: Platform VPC apply
+    name: CI VPC apply
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
@@ -34,31 +35,29 @@ jobs:
           wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
           echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
           sudo apt-get update && sudo apt-get install -y terraform=1.9.*
-      - name: Configure AWS credentials
+      - name: Install dependencies
-        run: |
+        run: pip install jsonschema pyyaml boto3
-          echo "AWS_ACCESS_KEY_ID=${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}" >> $GITHUB_ENV
+      - name: Apply CI VPC
-          echo "AWS_SECRET_ACCESS_KEY=${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}" >> $GITHUB_ENV
+        working-directory: terraform/ci-vpc
-          echo "AWS_DEFAULT_REGION=us-east-1" >> $GITHUB_ENV
-      - name: Apply platform VPC
-        working-directory: terraform/platform
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
           AWS_DEFAULT_REGION: us-east-1
         run: |
           terraform init -input=false -lock=false
-          terraform apply -auto-approve -lock=false \
+          terraform apply -auto-approve -lock=false
-            -target=aws_vpc.acdl_shared \
+          terraform output -json > /tmp/ci-vpc-outputs.json
-            -target=aws_subnet.acdl_shared \
+          cat /tmp/ci-vpc-outputs.json
-            -target=aws_internet_gateway.acdl_shared \
+      - name: Upload CI VPC outputs
-            -target=aws_route_table.acdl_shared \
+        uses: actions/upload-artifact@v4
-            -target=aws_route_table_association.acdl_shared \
+        with:
-            -target=aws_security_group.ecs
+          name: ci-vpc-outputs
+          path: /tmp/ci-vpc-outputs.json
 
   # L1 lifecycle matrix: apply simple → apply complex (modify) → destroy
   lifecycle:
     name: L1 lifecycle (${{ matrix.module }})
-    needs: platform-vpc-apply
+    needs: ci-vpc-apply
     runs-on: ubuntu-latest
     strategy:
       fail-fast: false
@@ -76,28 +75,33 @@ jobs:
           wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
           echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
           sudo apt-get update && sudo apt-get install -y terraform=1.9.*
+      - name: Download CI VPC outputs
+        uses: actions/download-artifact@v4
+        with:
+          name: ci-vpc-outputs
+          path: /tmp
       - name: Apply (simple)
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
           AWS_DEFAULT_REGION: us-east-1
-        run: bash scripts/run_platform.sh --apply "modules/l1/${{ matrix.module }}/examples/simple.yml"
+        run: bash scripts/run_lifecycle_test.sh ${{ matrix.module }} simple /tmp/ci-vpc-outputs.json
       - name: Modify (complex)
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
           AWS_DEFAULT_REGION: us-east-1
-        run: bash scripts/run_platform.sh --apply "modules/l1/${{ matrix.module }}/examples/complex.yml"
+        run: bash scripts/run_lifecycle_test.sh ${{ matrix.module }} complex /tmp/ci-vpc-outputs.json
       - name: Destroy
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
           AWS_DEFAULT_REGION: us-east-1
-        run: bash scripts/run_platform.sh --destroy "modules/l1/${{ matrix.module }}/examples/complex.yml"
+        run: bash scripts/run_lifecycle_destroy.sh ${{ matrix.module }} /tmp/ci-vpc-outputs.json
 
-  # Cleanup: destroy the platform VPC (always runs, even if lifecycle fails)
+  # Cleanup: destroy the CI VPC (always runs, even if lifecycle fails)
-  platform-vpc-destroy:
+  ci-vpc-destroy:
-    name: Platform VPC destroy
+    name: CI VPC destroy
     needs: lifecycle
     runs-on: ubuntu-latest
     if: always()
@@ -111,18 +115,12 @@ jobs:
           wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
           echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
           sudo apt-get update && sudo apt-get install -y terraform=1.9.*
-      - name: Destroy platform VPC
+      - name: Destroy CI VPC
-        working-directory: terraform/platform
+        working-directory: terraform/ci-vpc
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
           AWS_DEFAULT_REGION: us-east-1
         run: |
           terraform init -input=false -lock=false
-          terraform destroy -auto-approve -lock=false \
+          terraform destroy -auto-approve -lock=false
-            -target=aws_vpc.acdl_shared \
-            -target=aws_subnet.acdl_shared \
-            -target=aws_internet_gateway.acdl_shared \
-            -target=aws_route_table.acdl_shared \
-            -target=aws_route_table_association.acdl_shared \
-            -target=aws_security_group.ecs

modules/l1/alb/examples/complex.yml

@@ -1,14 +1,12 @@
-# Complex ALB with HTTPS + ACM cert (requires a consumer-supplied domain)
+# Complex ALB with HTTPS
 environment: dev
 id: alb
 infrastructure:
   alb:
     inputs:
-      name: my-production-alb
+      name: acdl-ci-alb
       port: 443
       protocol: HTTPS
       region: us-east-1
-      security_group: sg-xxx
-      subnets: subnet-aaa,subnet-bbb
     version: 1.0.0
 name: alb-loadbalancer

modules/l1/alb/examples/simple.yml

@@ -3,11 +3,9 @@ id: alb
 infrastructure:
   alb:
     inputs:
-      name: my-alb
+      name: acdl-ci-alb
       port: 80
       protocol: HTTP
       region: us-east-1
-      security_group: sg-xxx
-      subnets: subnet-aaa,subnet-bbb
     version: 1.0.0
 name: alb-loadbalancer

modules/l1/cloudfront/examples/complex.yml

@@ -1,15 +1,14 @@
-# Complex CloudFront with WAF + custom TTL + viewer protocol redirect
+# Complex CloudFront with custom TTL + viewer protocol redirect
 environment: dev
 id: cdn
 infrastructure:
   cloudfront:
     inputs:
       bucket_regional_domain_name: my-bucket.s3.us-east-1.amazonaws.com
-      default_ttl: 3600
+      default_ttl: 7200
       max_ttl: 86400
       price_class: PriceClass_100
       region: us-east-1
       viewer_protocol_policy: redirect-to-https
-      waf_web_acl_arn: arn:aws:wafv2:us-east-1:000000000000:webacl/my-waf
     version: 1.0.0
 name: cloudfront

modules/l1/ecs-service/examples/complex.yml

@@ -8,7 +8,7 @@ infrastructure:
         ENVIRONMENT: production
         LOG_LEVEL: info
       image: public.ecr.aws/docker/library/nginx:latest
-      name: my-production-service
+      family: acdl-ci-svc
       port: 8080
       region: us-east-1
     version: 1.0.0

modules/l1/ecs-service/examples/simple.yml

@@ -4,7 +4,7 @@ infrastructure:
   ecs-service:
     inputs:
       image: public.ecr.aws/docker/library/nginx:latest
-      name: my-service
+      family: acdl-ci-svc
       port: 80
       region: us-east-1
     version: 1.0.0

modules/l1/iam-role/examples/complex.yml

@@ -4,7 +4,7 @@ id: role
 infrastructure:
   iam-role:
     inputs:
-      name: my-production-task-role
+      role_name: acdl-ci-role
       region: us-east-1
     version: 1.0.0
 name: iam role

modules/l1/iam-role/examples/simple.yml

@@ -3,7 +3,7 @@ id: role
 infrastructure:
   iam-role:
     inputs:
-      name: my-task-role
+      role_name: acdl-ci-role
       region: us-east-1
     version: 1.0.0
 name: iam role

modules/l1/kms-key/terraform/locals.tf

@@ -0,0 +1,3 @@
+locals {
+  alias_name = "alias/acdl-ci-kms"
+}

modules/l1/kms-key/terraform/main.tf

@@ -5,6 +5,6 @@ resource "aws_kms_key" "this" {
 }
 
 resource "aws_kms_alias" "this" {
-  name          = "alias/acdl-${var.description != null ? var.description : "default"}"
+  name          = local.alias_name
   target_key_id = aws_kms_key.this.key_id
 }

modules/l1/rds/interface.json

@@ -9,7 +9,15 @@
       "type": "string",
       "description": "Database engine (postgres, mysql, mariadb, sqlserver, oracle).",
       "required": true,
-      "enum": ["postgres", "mysql", "mariadb", "sqlserver-ex", "sqlserver-web", "sqlserver-se", "oracle-se2"]
+      "enum": [
+        "postgres",
+        "mysql",
+        "mariadb",
+        "sqlserver-ex",
+        "sqlserver-web",
+        "sqlserver-se",
+        "oracle-se2"
+      ]
     },
     "engine_version": {
       "type": "string",
@@ -59,6 +67,12 @@
       "type": "string",
       "description": "ARN of the CMK for storage encryption; if absent, uses AWS-managed key.",
       "required": false
+    },
+    "subnet_ids": {
+      "type": "string",
+      "description": "Comma-separated subnet IDs for the DB subnet group",
+      "required": false,
+      "default": ""
     }
   },
   "outputs": {

modules/l1/rds/terraform/main.tf

@@ -1,3 +1,9 @@
+resource "aws_db_subnet_group" "this" {
+  count      = var.subnet_ids != "" ? 1 : 0
+  name       = "acdl-ci-rds-subnet-group"
+  subnet_ids = split(",", var.subnet_ids)
+}
+
 resource "aws_db_instance" "this" {
   engine               = var.engine
   engine_version       = var.engine_version
@@ -10,4 +16,5 @@ resource "aws_db_instance" "this" {
   kms_key_id           = var.kms_key_arn
   skip_final_snapshot  = true
   publicly_accessible  = false
+  db_subnet_group_name = var.subnet_ids != "" ? aws_db_subnet_group.this[0].name : null
 }

modules/l1/rds/terraform/variables.tf

@@ -52,3 +52,9 @@ variable "kms_key_arn" {
   description = "ARN of the CMK for storage encryption; if absent, uses managed key."
   default     = null
 }
+
+variable "subnet_ids" {
+  type        = string
+  description = "Comma-separated subnet IDs for the DB subnet group (VPC-dependent)."
+  default     = ""
+}

modules/l1/s3/examples/complex.yml

@@ -3,7 +3,7 @@ id: s3a
 infrastructure:
   s3:
     inputs:
-      bucket_name: my-production-bucket
+      bucket_name: acdl-ci-s3a-complex
       region: us-east-1
     version: 1.0.0
 name: s3-bucket

modules/l1/s3/examples/simple.yml

@@ -3,7 +3,7 @@ id: s3a
 infrastructure:
   s3:
     inputs:
-      bucket_name: my-simple-bucket
+      bucket_name: acdl-ci-s3a-simple
       region: us-east-1
     version: 1.0.0
 name: s3-bucket

modules/l1/uptime/interface.json

@@ -56,6 +56,21 @@
       "description": "Memory for the ECS task in MB",
       "required": false,
       "default": 512
+    },
+    "subnets": {
+      "type": "string",
+      "description": "Comma-separated subnet IDs for the ECS service ENIs",
+      "required": false
+    },
+    "security_group": {
+      "type": "string",
+      "description": "Security group ID for the ECS service ENIs",
+      "required": false
+    },
+    "cluster_arn": {
+      "type": "string",
+      "description": "ECS cluster ARN to deploy the service into",
+      "required": false
     }
   },
   "outputs": {

modules/l1/uptime/terraform/locals.tf

@@ -9,4 +9,8 @@ locals {
       protocol      = "tcp"
     }]
   }])
+
+  subnet_list = var.subnets != "" ? split(",", var.subnets) : []
+  sg_list     = var.security_group != "" ? [var.security_group] : []
+  cluster_ref = var.cluster_arn != "" ? var.cluster_arn : "default"
 }

modules/l1/uptime/terraform/main.tf

@@ -9,8 +9,17 @@ resource "aws_ecs_task_definition" "uptime" {
 
 resource "aws_ecs_service" "uptime" {
   name            = "acdl-uptime"
-  cluster         = "default"
+  cluster         = local.cluster_ref
   task_definition = aws_ecs_task_definition.uptime.arn
   desired_count   = var.feature_flag_enabled ? 1 : 0
   launch_type     = "FARGATE"
+
+  dynamic "network_configuration" {
+    for_each = length(local.subnet_list) > 0 ? [1] : []
+    content {
+      subnets          = local.subnet_list
+      security_groups  = local.sg_list
+      assign_public_ip = true
+    }
+  }
 }

modules/l1/uptime/terraform/variables.tf

@@ -50,3 +50,21 @@ variable "memory" {
   description = "Task memory (MiB, Fargate)."
   default     = 512
 }
+
+variable "subnets" {
+  type        = string
+  description = "Comma-separated subnet IDs for the ECS service ENIs."
+  default     = ""
+}
+
+variable "security_group" {
+  type        = string
+  description = "Security group ID for the ECS service ENIs."
+  default     = ""
+}
+
+variable "cluster_arn" {
+  type        = string
+  description = "ECS cluster ARN to deploy the service into."
+  default     = ""
+}

scripts/run_lifecycle_destroy.sh

@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# scripts/run_lifecycle_destroy.sh — destroy an L1 module after lifecycle testing.
+#
+# Usage: run_lifecycle_destroy.sh <module> [ci-vpc-outputs.json]
+#
+# For VPC-dependent modules, injects CI VPC outputs into the complex contract
+# before destroy (so terraform can find the resources in the right VPC).
+set -euo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+MODULE="$1"
+CI_VPC_OUTPUTS="${2:-}"
+
+CONTRACT="modules/l1/${MODULE}/examples/complex.yml"
+
+VPC_DEPENDENT="alb ecs-service rds uptime"
+
+if echo "$VPC_DEPENDENT" | grep -qw "$MODULE" && [ -n "$CI_VPC_OUTPUTS" ] && [ -f "$CI_VPC_OUTPUTS" ]; then
+  TMP_CONTRACT="/tmp/acdl-lifecycle-${MODULE}-complex.yml"
+  python3 -c "
+import yaml, json
+
+with open('$CONTRACT') as f:
+    contract = yaml.safe_load(f)
+
+with open('$CI_VPC_OUTPUTS') as f:
+    raw = json.load(f)
+
+vpc = {k: v['value'] if isinstance(v, dict) and 'value' in v else v for k, v in raw.items()}
+
+m = '$MODULE'
+inputs = contract['infrastructure'][m]['inputs']
+if m == 'alb':
+    inputs['subnets'] = vpc.get('subnet_ids', '')
+    inputs['vpc_id'] = vpc.get('vpc_id', '')
+    inputs['security_group'] = vpc.get('ecs_security_group_id', '')
+elif m == 'ecs-service':
+    inputs['subnets'] = vpc.get('subnet_ids', '')
+    inputs['security_group'] = vpc.get('ecs_security_group_id', '')
+    inputs['cluster_arn'] = vpc.get('cluster_arn', '')
+elif m == 'rds':
+    inputs['subnet_ids'] = vpc.get('subnet_ids', '')
+elif m == 'uptime':
+    inputs['subnets'] = vpc.get('subnet_ids', '')
+    inputs['security_group'] = vpc.get('ecs_security_group_id', '')
+    inputs['cluster_arn'] = vpc.get('cluster_arn', '')
+
+with open('$TMP_CONTRACT', 'w') as f:
+    yaml.dump(contract, f)
+"
+  CONTRACT="$TMP_CONTRACT"
+fi
+
+bash scripts/run_platform.sh --destroy "$CONTRACT"

scripts/run_lifecycle_test.sh

@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+# scripts/run_lifecycle_test.sh — run a single L1 module lifecycle test.
+#
+# Usage: run_lifecycle_test.sh <module> <example> [ci-vpc-outputs.json]
+#
+# This script wraps run_platform.sh for the modules-lifecycle pipeline.
+# If the module is VPC-dependent and a ci-vpc-outputs.json is provided,
+# it generates a temporary contract with the CI VPC outputs injected.
+#
+# The CI VPC is short-lived (created/destroyed by the pipeline), separate
+# from the long-lived platform VPC.
+set -euo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+MODULE="$1"
+EXAMPLE="$2"  # simple or complex
+CI_VPC_OUTPUTS="${3:-}"
+
+CONTRACT="modules/l1/${MODULE}/examples/${EXAMPLE}.yml"
+
+# VPC-dependent modules that need CI VPC outputs injected
+VPC_DEPENDENT="alb ecs-service rds uptime"
+
+# If the module is VPC-dependent and we have CI VPC outputs, inject them
+if echo "$VPC_DEPENDENT" | grep -qw "$MODULE" && [ -n "$CI_VPC_OUTPUTS" ] && [ -f "$CI_VPC_OUTPUTS" ]; then
+  # Generate a temporary contract with CI VPC outputs injected
+  TMP_CONTRACT="/tmp/acdl-lifecycle-${MODULE}-${EXAMPLE}.yml"
+  python3 -c "
+import yaml, json, sys
+
+# Load the original contract
+with open('$CONTRACT') as f:
+    contract = yaml.safe_load(f)
+
+# Load CI VPC outputs (terraform output -json format: {key: {value: ...}})
+with open('$CI_VPC_OUTPUTS') as f:
+    raw = json.load(f)
+
+vpc = {k: v['value'] if isinstance(v, dict) and 'value' in v else v for k, v in raw.items()}
+
+vpc_id = vpc.get('vpc_id', '')
+subnet_ids = vpc.get('subnet_ids', '')
+sg_id = vpc.get('ecs_security_group_id', '')
+cluster_arn = vpc.get('cluster_arn', '')
+
+module_name = '$MODULE'
+inputs = contract['infrastructure'][module_name]['inputs']
+
+# Inject VPC-dependent inputs based on the module
+if module_name == 'alb':
+    inputs['subnets'] = subnet_ids
+    inputs['vpc_id'] = vpc_id
+    inputs['security_group'] = sg_id
+elif module_name == 'ecs-service':
+    inputs['subnets'] = subnet_ids
+    inputs['security_group'] = sg_id
+    inputs['cluster_arn'] = cluster_arn
+elif module_name == 'rds':
+    inputs['subnet_ids'] = subnet_ids
+elif module_name == 'uptime':
+    inputs['subnets'] = subnet_ids
+    inputs['security_group'] = sg_id
+    inputs['cluster_arn'] = cluster_arn
+
+with open('$TMP_CONTRACT', 'w') as f:
+    yaml.dump(contract, f)
+print('$TMP_CONTRACT')
+"
+  CONTRACT="$TMP_CONTRACT"
+fi
+
+# Run the platform lifecycle command
+bash scripts/run_platform.sh --apply "$CONTRACT"

terraform/ci-vpc/main.tf

@@ -0,0 +1,112 @@
+# ACDL CI VPC — short-lived VPC for L1 module lifecycle testing.
+#
+# Created by the modules-lifecycle pipeline before testing VPC-dependent
+# modules (alb, ecs-service, rds, uptime). Destroyed after all tests complete.
+# Separate from the long-lived platform VPC (terraform/platform).
+#
+# State: spike/ci-vpc/terraform.tfstate (separate from platform/ and module states)
+
+terraform {
+  required_version = ">= 1.9, < 1.10"
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+  backend "s3" {
+    bucket = "acdl-tfstate-581513795199-us-east-1"
+    key    = "spike/ci-vpc/terraform.tfstate"
+    region = "us-east-1"
+  }
+}
+
+provider "aws" {
+  region = "us-east-1"
+}
+
+data "aws_availability_zones" "available" {
+  state = "available"
+}
+
+resource "aws_vpc" "ci" {
+  cidr_block = "10.1.0.0/16"
+  tags = {
+    Name               = "acdl-ci-vpc"
+    "acdl:owner"       = "acdl"
+    "acdl:environment" = "ci"
+  }
+}
+
+resource "aws_subnet" "ci" {
+  count             = 2
+  vpc_id            = aws_vpc.ci.id
+  cidr_block        = cidrsubnet(aws_vpc.ci.cidr_block, 8, count.index + 1)
+  availability_zone = data.aws_availability_zones.available.names[count.index]
+  tags = {
+    Name               = "acdl-ci-subnet-${count.index}"
+    "acdl:owner"       = "acdl"
+    "acdl:environment" = "ci"
+  }
+}
+
+resource "aws_internet_gateway" "ci" {
+  vpc_id = aws_vpc.ci.id
+  tags = {
+    Name = "acdl-ci-igw"
+  }
+}
+
+resource "aws_route_table" "ci" {
+  vpc_id = aws_vpc.ci.id
+  route {
+    cidr_block = "0.0.0.0/0"
+    gateway_id = aws_internet_gateway.ci.id
+  }
+}
+
+resource "aws_route_table_association" "ci" {
+  count          = 2
+  subnet_id      = aws_subnet.ci[count.index].id
+  route_table_id = aws_route_table.ci.id
+}
+
+resource "aws_security_group" "ecs" {
+  name        = "acdl-ci-ecs-sg"
+  description = "Security group for CI ECS services"
+  vpc_id      = aws_vpc.ci.id
+
+  ingress {
+    from_port   = 80
+    to_port     = 80
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+
+resource "aws_ecs_cluster" "ci" {
+  name = "acdl-ci-cluster"
+}
+
+output "vpc_id" {
+  value = aws_vpc.ci.id
+}
+
+output "subnet_ids" {
+  value = join(",", aws_subnet.ci[*].id)
+}
+
+output "ecs_security_group_id" {
+  value = aws_security_group.ecs.id
+}
+
+output "cluster_arn" {
+  value = aws_ecs_cluster.ci.arn
+}

tests/test_pipeline_contract.py

@@ -551,7 +551,7 @@ class TestModulesLifecyclePipeline:
 
     def test_workflow_has_three_jobs(self):
         wf = _load_workflow(".gitea/workflows/modules-lifecycle.yml")
-        assert set(wf["jobs"].keys()) == {"platform-vpc-apply", "lifecycle", "platform-vpc-destroy"}
+        assert set(wf["jobs"].keys()) == {"ci-vpc-apply", "lifecycle", "ci-vpc-destroy"}
 
     def test_workflow_triggers_match_contract(self):
         wf = _load_workflow(".gitea/workflows/modules-lifecycle.yml")
@@ -583,5 +583,5 @@ class TestModulesLifecyclePipeline:
 
     def test_platform_vpc_destroy_always_runs(self):
         wf = _load_workflow(".gitea/workflows/modules-lifecycle.yml")
-        destroy_job = wf["jobs"]["platform-vpc-destroy"]
+        destroy_job = wf["jobs"]["ci-vpc-destroy"]
-        assert destroy_job.get("if") == "always()", "platform-vpc-destroy must always run (cleanup)"
+        assert destroy_job.get("if") == "always()", "ci-vpc-destroy must always run (cleanup)"