docs(P06): create Phase 06 plan (archive-demo-and-reorient)

---ci--- project: acdl phase: 6 milestone: v1.1 status: plan plan: waves: 3 tasks: 6 requirements: [] # repo hygiene; no new REQ ---/ci--- Phase 06 plan authored by ci-planner. 3 waves (strictly ordered): - Wave 1 (lead-developer): T-6.1 git mv demo dirs, T-6.2 scaffold new dirs, T-6.3 write scripts/verify_phase06.sh at top-level, T-6.4 rewrite README + .gitignore - Wave 2 (frontend-engineer): T-6.5 confirm demo/evidence-ui/ moved cleanly (confirm-only) - Wave 3 (lead-developer): T-6.6 run verify_phase06.sh + typecheck gate Key design: v1.1 verify scripts live at a new top-level scripts/ (not demo/scripts/ which holds the archived v1.0 verify scripts). All git mv commands enumerated verbatim in T-6.1, cross-checked against RESEARCH.md TARGET 10.
2026-07-21 18:26:24 +00:00
parent 930c24be6d
commit b927f9026a
1 changed files with 433 additions and 43 deletions
@@ -1,63 +1,453 @@
 ---
-phase: 0
-name: v1.1-specify
+phase: 6
+name: archive-demo-and-reorient
 milestone: v1.1
 milestone_type: feature
-status: specify
-requirements: [REQ-16..REQ-28]
+status: planned
+requirements: []   # Phase 06 introduces NO new REQ — it is repo hygiene (ROADMAP §Phase 06).
 must_haves:
-  - "config.json project.milestone = v1.1, status = specify"
-  - "PROJECT.md reframed from stub demo to real platform (vision tenets + 4-layer/6-concern model + 11 open-decision resolutions + D-034..D-038)"
-  - "ARCHITECTURE.md rewritten to the target architecture (IR, confidence, ledger, HITL, SoD, substrate abstraction) with v1.1 spike scope"
-  - "REQUIREMENTS.md adds v1.1 section (REQ-16..REQ-28) + traceability"
-  - "ROADMAP.md adds v1.1 Phases 06–10"
-  - "PERSONAS.md adds platform-engineer + security-engineer, retires infra-stub-engineer, updates territories + verification toolchain"
-  - "docs/vision.md + docs/architecture.md (upstream) referenced as the why/how source of truth"
+  - "demo/ contains the full v1.0 demo (modules/, scripts/, evidence-ui/, contracts/, contracts-repo/, .gitea/workflows/, ACDL_DEMO.md)"
+  - "demo/scripts/run_demo.sh --no-upload exits 0 (regression: the archived demo still runs from demo/)"
+  - "New top-level dirs exist and are empty-but-scaffolded with a .gitkeep: platform/, schemas/, adapters/, terraform/, modules-ir/"
+  - "A new top-level scripts/ dir exists with scripts/verify_phase06.sh (v1.1 verify scripts live at top-level scripts/, NOT demo/scripts/)"
+  - "README.md reflects the real platform (vision + architecture links, new layout); the v1.0 demo README content moves to demo/ACDL_DEMO.md (already there)"
+  - ".gitignore updated to ignore runner-data/ (untracked demo runner artifact) if not already"
+  - "No stray empty dirs left at repo root from the moves (contracts-repo/ etc.)"
 verification:
-  typecheck: "python3 -m jsonschema schemas/*.schema.json 2>/dev/null || true  # schemas authored in Phase 07"
-  test: "scripts/verify_phase06.sh  # authored in Phase 06"
-  build: no-op
+  typecheck: "bash -n demo/scripts/*.sh && python3 -m py_compile demo/scripts/*.py"
+  test: "scripts/verify_phase06.sh   # lives at TOP-LEVEL scripts/, not demo/scripts/"
+  build: "no-op   # Phase 06 is repo hygiene; terraform init is Phase 09+"
 ---

-# v1.1 — Specify PLAN
+# Phase 06 — archive-demo-and-reorient PLAN

 ## Goal

-Ingest `docs/vision.md` + `docs/architecture.md` and update all `.ciagent`
-files to reframe the project from the v1.0 stub demo to the real Agentic
-Cloud Delivery Platform, milestone v1.1 (architecture finalization + v1
-spike).
+Archive the complete v1.0 demo under `demo/` (preserve it as the intent
+reference per D-037), establish the new v1.1 repo layout
+(`platform/`, `schemas/`, `adapters/`, `terraform/`, `modules-ir/`), and
+rewrite `README.md` to reflect the real Agentic Cloud Delivery Platform.
+Verify the archived demo still runs end-to-end from `demo/` via
+`demo/scripts/run_demo.sh --no-upload` (regression gate).

-## Scope of this stage (SPECIFY only)
+This is **repo hygiene only** — no new code, no new REQ. It reorients the
+repo from "the v1.0 demo is the repo" to "the v1.0 demo is an archived
+artifact under `demo/`; the repo root is now the real platform's home."

-Rewrite the five `.ciagent/` files + `config.json`:
- `config.json` — milestone `v1.1`, status `specify`.
- `PROJECT.md` — reframe; carry the 6 vision tenets; record the 11
-  open-decision resolutions (D-038) + the OIDC waiver (D-034) + spike picks
-  (D-036) + archive decision (D-037) + version (D-035).
- `ARCHITECTURE.md` — target architecture (4 layers + 6 cross-cutting
-  concerns incl. substrate abstraction); v1.1 spike scope.
- `REQUIREMENTS.md` — add REQ-16..REQ-28 + traceability.
- `ROADMAP.md` — add v1.1 Phases 06–10.
- `PERSONAS.md` — add platform-engineer + security-engineer; retire
-  infra-stub-engineer; update territories + verification toolchain.
+## Requirements covered
+
+**None new.** Phase 06 carries no REQ-NN entry (ROADMAP §Phase 06:
+"Requirements: (no new REQ; repo hygiene)"). It is a structural
+prerequisite for Phase 07 (architecture-v1-finalization), which owns
+REQ-16..REQ-22.
+
+**Dependency:** the v1.0 demo must be complete and tagged. It is — tag
+`v1.1.0` exists (verified: `git tag` lists `v1.0.1`..`v1.0.5`, `v1.1.0`).
+All v1.0 phases shipped and audited PASS (ROADMAP §v1.0). The archive
+preserves the demo immutably; v1.0 tags are not rewritten (PROJECT.md
+operational parameter: "v1.0 tags preserved").
+
+**No upstream phase dependency within v1.1** — Phase 06 is the first
+v1.1 phase. RESEARCH TARGET 10 (conf 0.90) provides the authoritative
+move list and confirms via static analysis that no path fixups are
+needed: all demo scripts resolve paths via `SCRIPT_DIR`/`REPO_ROOT`
+relative-to-script, which auto-adjust when the tree moves to `demo/`.

 ## Waves

-Single wave (lead-developer only — this is metadata work):
- **T-0.1** Rewrite `config.json` + `PROJECT.md` + `ARCHITECTURE.md`.
- **T-0.2** Rewrite `REQUIREMENTS.md` + `ROADMAP.md` + `PERSONAS.md`.
- **T-0.3** Commit with `---ci---` block (phase 0, milestone v1.1, status specify).
+Domain priority order from `PERSONAS.md`:
+`coordination → security → platform → backend → frontend`.
+
+Phase 06 active personas (PERSONAS.md "Phase-specific overrides"):
+**lead-developer** (coordination — owns the moves, the new layout, the
+README, and the verify script) + **frontend-engineer** (demo UI move
+confirmation only). Backend/platform/security are idle this phase.
+
+Three waves, strictly ordered (each wave's tasks depend on the prior
+wave completing):
+
+---
+
+### Wave 1 — lead-developer: file moves + new layout + README + verify script
+
+The structural reorientation. All moves use `git mv` to preserve history.
+The v1.0 verify scripts move *with* `scripts/` into `demo/scripts/` (they
+are demo artifacts); the *new* v1.1 verify script lives at a *new*
+top-level `scripts/` dir (created fresh in this wave).
+
+#### T-6.1 — Move the v1.0 demo tree into `demo/`
+
+- **Owner:** lead-developer (territory: `.ciagent/**`, `README.md`,
+  `.gitignore`, top-level layout).
+- **Files owned:** `demo/` (new), everything moved into it.
+- **Commit message:**
+  `phase: 6, status: plan-as-execute, persona: lead-developer, task: T-6.1`
+- **Commands to run verbatim** (cross-checked against RESEARCH.md
+  TARGET 10's move list; verified the dirs exist and are tracked
+  via `git ls-files`):
+
+  ```bash
+  # From the repo root (/root/acdl). All moves via `git mv` to preserve history.
+  # 1. Create the demo/ container.
+  mkdir -p demo
+
+  # 2. Move the five demo dirs + the demo deck + the demo contracts-repo.
+  git mv modules            demo/modules
+  git mv scripts            demo/scripts          # carries verify_phase01..05.sh (v1.0 demo verify scripts)
+  git mv evidence-ui        demo/evidence-ui
+  git mv contracts          demo/contracts        # only holds examples/ (v1.0 sample contracts)
+  git mv contracts-repo     demo/contracts-repo  # tracked: .gitea/workflows/{.gitkeep,issue-to-contract.yml}
+  git mv .gitea             demo/.gitea           # carries workflows/{.gitkeep,pipeline.yml}
+  git mv ACDL_DEMO.md       demo/ACDL_DEMO.md     # the v1.0 presentation deck (was untracked — `git add` it first)
+
+  # 3. Handle the untracked demo runner artifact: do NOT git mv (it's untracked).
+  #    Move it out of the repo root so it doesn't linger as a stray dir.
+  mv runner-data demo/runner-data   # plain mv — not tracked; runner-data/.runner
+  #    (runner-data/ is added to .gitignore in T-6.4 so it stays a local artifact.)
+
+  # 4. Sanity: no empty stray dirs remain at repo root.
+  #    (git mv removes the source dir when it becomes empty; verify with `ls`.)
+  ```
+
+  **Cross-check vs RESEARCH.md TARGET 10 move list:**
+  - `modules/ → demo/modules/` ✓
+  - `scripts/ → demo/scripts/` ✓ (carries v1.0 verify_phase01..05.sh — those
+    are *demo* verify scripts; the v1.1 verify script is created in T-6.3
+    at a *new* top-level `scripts/` dir)
+  - `evidence-ui/ → demo/evidence-ui/` ✓
+  - `contracts/ → demo/contracts/` ✓
+  - `.gitea/workflows/{.gitkeep,pipeline.yml} → demo/.gitea/workflows/` ✓
+    (achieved by moving the whole `.gitea/` dir)
+  - `ACDL_DEMO.md → demo/ACDL_DEMO.md` ✓
+  - `contracts-repo/ → demo/contracts-repo/` ✓ (tracked; confirmed via
+    `git ls-files contracts-repo/` → `.gitea/workflows/.gitkeep` +
+    `.gitea/workflows/issue-to-contract.yml`)
+  - `runner-data/ → demo/runner-data/` ✓ (untracked; plain `mv`)
+
+  **Subtlety (per task instructions):** the v1.1 verify scripts live at a
+  *new* top-level `scripts/` dir (created in T-6.3), NOT inside `demo/scripts/`
+  (which holds the v1.0 demo verify scripts `verify_phase01..05.sh`). This
+  avoids colliding the v1.1 verification toolchain with the archived demo's.
+
+  **Risk note (R-5 from RESEARCH.md):** static analysis found only
+  `/tmp/...` temp-file writes in the demo scripts (e.g.
+  `scripts/gitea_setup.sh`, `scripts/verify_phase01.sh`) — no source-root
+  absolute paths. All demo scripts use `SCRIPT_DIR`/`REPO_ROOT`
+  relative-to-script, which auto-resolve to `demo/` after the move. The
+  regression check in T-6.3 / Wave 3 confirms this empirically.
+
+#### T-6.2 — Scaffold the new v1.1 top-level dirs (empty, .gitkeep'd)
+
+- **Owner:** lead-developer (territory: top-level layout).
+- **Files owned:** `platform/.gitkeep`, `schemas/.gitkeep`,
+  `adapters/.gitkeep`, `terraform/.gitkeep`, `modules-ir/.gitkeep`.
+- **Commit message:**
+  `phase: 6, status: plan-as-execute, persona: lead-developer, task: T-6.2`
+- **Commands:**
+
+  ```bash
+  # From the repo root. Five new empty-but-scaffolded dirs per ROADMAP §Phase 06.
+  # These are populated in Phases 07–10; here they only need to exist + be tracked.
+  for d in platform schemas adapters terraform modules-ir; do
+    mkdir -p "$d"
+    : > "$d/.gitkeep"   # empty placeholder so git tracks the dir
+  done
+  git add platform/.gitkeep schemas/.gitkeep adapters/.gitkeep terraform/.gitkeep modules-ir/.gitkeep
+  ```
+
+  **Territory note (PERSONAS.md):** these dirs are owned in later phases
+  by backend-engineer (`platform/confidence_signal.py`, `schemas/**`,
+  `platform/outbox/**`), platform-engineer (`adapters/terraform/**`,
+  `modules-ir/**`, `terraform/**`, `platform/registry/**`), and
+  security-engineer (`platform/hitl_matrix_design.md`,
+  `platform/audit_ledger_design.md`, `adapters/terraform/policy/**`). In
+  Phase 06 they are *empty* — no territory conflict.
+
+#### T-6.3 — Create the new top-level `scripts/` + write `scripts/verify_phase06.sh`
+
+- **Owner:** lead-developer (territory: `scripts/verify_phase*.sh`).
+- **Files owned:** `scripts/.gitkeep` (or the verify script itself acts as
+  the dir anchor), `scripts/verify_phase06.sh`.
+- **Commit message:**
+  `phase: 6, status: plan-as-execute, persona: lead-developer, task: T-6.3`
+- **What `scripts/verify_phase06.sh` must assert** (the Phase 06 success
+  criteria from ROADMAP, made executable):
+
+  ```bash
+  #!/usr/bin/env bash
+  # scripts/verify_phase06.sh — Phase 06 archive regression + layout check.
+  # Lives at TOP-LEVEL scripts/ (v1.1 verify scripts), NOT demo/scripts/.
+  set -u
+  ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+  cd "$ROOT"
+  fail() { echo "FAIL: $*" >&2; exit 1; }
+  ok()   { echo "ok: $*"; }
+
+  # --- Check 1: demo/ contains the full v1.0 demo tree ---
+  for d in demo/modules demo/scripts demo/evidence-ui demo/contracts \
+           demo/contracts-repo demo/.gitea/workflows; do
+    [ -d "$d" ] || fail "missing $d"
+  done
+  [ -f demo/ACDL_DEMO.md ] || fail "missing demo/ACDL_DEMO.md"
+  [ -f demo/scripts/run_demo.sh ] || fail "missing demo/scripts/run_demo.sh"
+  ok "demo/ contains the full v1.0 demo"
+
+  # --- Check 2: regression — the archived demo still runs from demo/ ---
+  #    run_demo.sh uses WORKDIR=/tmp/acdl_demo_run (absolute temp), so it
+  #    does not pollute the repo. --no-upload skips Gitea API calls.
+  out=$(ACDL_GITEA_TOKEN= bash demo/scripts/run_demo.sh --no-upload 2>&1); rc=$?
+  [ "$rc" -eq 0 ] || { echo "$out" >&2; fail "demo/scripts/run_demo.sh --no-upload exited $rc"; }
+  ok "demo/scripts/run_demo.sh --no-upload exits 0"
+
+  # --- Check 3: new top-level dirs exist and are scaffolded ---
+  for d in platform schemas adapters terraform modules-ir; do
+    [ -d "$d" ] || fail "missing new top-level dir $d"
+    [ -f "$d/.gitkeep" ] || fail "missing $d/.gitkeep"
+  done
+  ok "new top-level dirs exist: platform/ schemas/ adapters/ terraform/ modules-ir/"
+
+  # --- Check 4: no stray v1.0 dirs left at repo root ---
+  for stray in modules evidence-ui contracts contracts-repo ACDL_DEMO.md; do
+    [ -e "$stray" ] && fail "stray $stray left at repo root (should be under demo/)"
+  done
+  # .gitea/ at repo root is OK *only if* it's a new v1.1 workflow dir; in Phase 06
+  # we moved the demo's .gitea/ to demo/.gitea/, so repo-root .gitea/ should NOT
+  # exist yet (Phase 07+ may re-create it for the real pipeline).
+  [ -e ".gitea" ] && fail "stray .gitea/ left at repo root (moved to demo/.gitea/)"
+  ok "no stray v1.0 dirs at repo root"
+
+  # --- Check 5: README reflects the real platform ---
+  grep -q "Agentic Cloud Delivery Platform" README.md || fail "README missing platform name"
+  grep -q "demo/" README.md || fail "README does not reference the archived demo/"
+  grep -qi "vision\|architecture" README.md || fail "README missing vision/architecture links"
+  ok "README reflects the real platform (name + demo/ ref + vision/arch links)"
+
+  echo "Phase 06: ALL CHECKS PASS"
+  ```
+
+  **Note on `bash -n` / `py_compile` (typecheck gate):** the verify script
+  itself is covered by `bash -n scripts/verify_phase06.sh`; the moved demo
+  scripts are covered by `bash -n demo/scripts/*.sh` + `python3 -m py_compile
+  demo/scripts/*.py` (the typecheck gate in the frontmatter). These run in
+  Wave 3 before the full verify.
+
+#### T-6.4 — Rewrite `README.md` + update `.gitignore`
+
+- **Owner:** lead-developer (territory: `README.md`, `.gitignore`).
+- **Files owned:** `README.md`, `.gitignore`.
+- **Commit message:**
+  `phase: 6, status: plan-as-execute, persona: lead-developer, task: T-6.4`
+- **`README.md` must contain:**
+  - Project name: "ACDL — Agentic Cloud Delivery Platform".
+  - One-line vision lift from `PROJECT.md` (consumers declare intent; the
+    platform delivers safe production deployment through an agentic stack).
+  - Links: `docs/vision.md` (the why), `docs/architecture.md` (the how),
+    `.ciagent/PROJECT.md` (decisions), `.ciagent/ARCHITECTURE.md` (target
+    architecture), `.ciagent/ROADMAP.md` (phase plan).
+  - **New layout section** listing the top-level dirs and what each is for:
+    - `platform/` — platform code (confidence signal, contract resolver,
+      outbox, HITL/ledger designs) [populated Phase 07+].
+    - `schemas/` — JSON Schemas (IR, PolicyCheckResult, contract) [Phase 07].
+    - `adapters/` — substrate adapters (Terraform adapter in v1) [Phase 09].
+    - `terraform/` — state backend + provider config [Phase 08+].
+    - `modules-ir/` — IR-typed L1/L2 modules (`l1-s3`, `l2-static-asset`)
+      [Phase 09–10].
+    - `scripts/` — v1.1 verify scripts (`verify_phaseNN.sh`).
+    - `demo/` — the archived v1.0 executive demo (tag `v1.1.0`); runs locally
+      via `demo/scripts/run_demo.sh --no-upload`. Intent reference; not the
+      platform.
+    - `.ciagent/` — CIAgent metadata (plans, decisions, personas, roadmap).
+    - `docs/` — upstream vision + architecture sources.
+  - A "Status" line: v1.1 active — architecture finalization + v1 spike.
+    v1.0 demo complete (tag `v1.1.0`), archived under `demo/`.
+  - **No** v1.0 demo run instructions in the root README — point at
+    `demo/ACDL_DEMO.md` for the demo deck and `demo/scripts/run_demo.sh`.
+
+- **`.gitignore` update:**
+  - Add `runner-data/` (the untracked demo runner artifact; moved to
+    `demo/runner-data/` in T-6.1, but any future local runner registration
+    should be ignored at the repo root too).
+  - Keep existing entries (`__pycache__/`, `*.pyc`, `*.pyo`, `.env*`,
+    `state.json`, `audit.json`, `*.tmp`, `.DS_Store`).
+  - The existing `.gitignore` (read) is:
+    ```
+    __pycache__/
+    *.pyc
+    *.pyo
+    .env
+    .env.*
+    state.json
+    audit.json
+    *.tmp
+    .DS_Store
+    ```
+    Append `runner-data/` (and optionally `demo/runner-data/` for
+    completeness).
+
+---
+
+### Wave 2 — frontend-engineer: confirm `demo/evidence-ui/` moved cleanly
+
+The UI is frozen as a demo artifact (D-033: relative fetch URL). No code
+changes unless the move broke the fetch path — which static analysis says
+it cannot (the UI is a single static `index.html` with a relative URL to
+`audit.json` on the `acdl-evidence` raw URL). This wave is a confirmation,
+not a build.
+
+#### T-6.5 — Confirm `demo/evidence-ui/index.html` integrity + fetch path
+
+- **Owner:** frontend-engineer (territory: `evidence-ui/**`, now
+  `demo/evidence-ui/**`).
+- **Files owned:** `demo/evidence-ui/index.html` (read-only confirmation;
+  edit only if the fetch URL is broken, which it is not per D-033).
+- **Commit message (if no edit needed — confirmation only, may be a
+  no-op commit or folded into Wave 3's verify):**
+  `phase: 6, status: plan-as-execute, persona: frontend-engineer, task: T-6.5`
+- **Checks the frontend-engineer performs:**
+  1. `demo/evidence-ui/index.html` exists and is byte-identical to the
+     pre-move file (git history preserved via `git mv`).
+  2. The fetch URL inside `index.html` is relative (per D-033) — e.g.
+     `fetch('audit.json')` or a raw-URL reference to `acdl-evidence`.
+     It must NOT reference a repo-root-relative path that broke when
+     moved under `demo/`.
+  3. If (and only if) `scripts/verify_phase06.sh` (run in Wave 3) reports
+     the UI fetch path broken, the frontend-engineer patches
+     `demo/evidence-ui/index.html`'s fetch URL to be relative. Per D-033
+     and RESEARCH TARGET 10 finding #5, **no patch is expected** — this
+     is a confirm-only task.
+- **No code changes expected.** If a patch is needed, it is a one-line
+  fetch-URL fix and the commit message above applies.
+
+---
+
+### Wave 3 — lead-developer: run the full Phase 06 verification
+
+The regression gate. Runs only after Wave 1 (moves done) and Wave 2
+(frontend confirmation done).
+
+#### T-6.6 — Run `scripts/verify_phase06.sh` + typecheck gate
+
+- **Owner:** lead-developer (territory: `scripts/verify_phase*.sh`).
+- **Files owned:** none (execution-only).
+- **Commit message (if any fixup is needed; otherwise this is a verify
+  run, not a commit):**
+  `phase: 6, status: plan-as-execute, persona: lead-developer, task: T-6.6`
+- **Commands:**
+
+  ```bash
+  # Typecheck gate (from frontmatter):
+  bash -n demo/scripts/*.sh && echo "demo shell scripts: syntax ok"
+  python3 -m py_compile demo/scripts/*.py && echo "demo python scripts: compile ok"
+  bash -n scripts/verify_phase06.sh && echo "verify_phase06.sh: syntax ok"
+
+  # Test gate (the Phase 06 regression):
+  bash scripts/verify_phase06.sh
+  # Expected output: "Phase 06: ALL CHECKS PASS"
+  # This runs demo/scripts/run_demo.sh --no-upload internally (Check 2).
+  ```
+
+  **On failure:** if `demo/scripts/run_demo.sh --no-upload` fails, the
+  cause is an undetected absolute path in a demo script (R-5 residual
+  0.10). Fix the offending path in `demo/scripts/*.sh` (make it
+  `SCRIPT_DIR`/`REPO_ROOT`-relative) and re-run. If the UI fetch path is
+  broken, Wave 2's frontend-engineer patches `demo/evidence-ui/index.html`.
+
+  **On pass:** Phase 06 is complete. The phase-completion commit +
+  `v1.1.0`-style phase tag (or the v1.1 phase-tagging convention) is
+  created by the execute workflow, not this plan.
+
+---
+
+## Wave ordering (dependency graph)
+
+```
+Wave 1 (T-6.1, T-6.2, T-6.3, T-6.4)   lead-developer
+   │  moves + scaffold + verify script + README
+   ▼
+Wave 2 (T-6.5)                         frontend-engineer
+   │  confirm demo/evidence-ui/ moved cleanly (no code change expected)
+   ▼
+Wave 3 (T-6.6)                         lead-developer
+      run scripts/verify_phase06.sh (regression + layout + README checks)
+```
+
+- **Wave 1 → Wave 2:** the UI must be moved before it can be confirmed.
+- **Wave 2 → Wave 3:** the frontend confirmation must precede the full
+  verify (so any UI fetch-path patch is in place before
+  `verify_phase06.sh` runs the demo end-to-end).
+- **Within Wave 1:** T-6.1 (moves) must precede T-6.2 (new dirs — they
+  would collide if `scripts/` still held the v1.0 verify scripts when
+  T-6.3 creates the new top-level `scripts/`). T-6.3 (verify script) can
+  be authored in parallel with T-6.2 but cannot *run* until T-6.1 + T-6.2
+  are committed. T-6.4 (README) is independent of T-6.1..T-6.3 in content
+  but should land in the same wave so the repo is coherent after Wave 1.
+
+  **Strict sub-ordering within Wave 1:** T-6.1 → T-6.2 → T-6.3 (T-6.3
+  creates the new top-level `scripts/` which must not exist during T-6.1's
+  `git mv scripts demo/scripts`). T-6.4 (README + .gitignore) may be done
+  in parallel with T-6.2/T-6.3.

 ## Dependencies

- `docs/vision.md` + `docs/architecture.md` (pulled from `origin/main`).
- User-locked parameters (milestone v1.1, spike = `l1-s3` + `l2-static-asset`,
-  real AWS via OIDC, accept-recommendations-and-decide-rest).
+- **v1.0 demo complete + tagged** — satisfied (tag `v1.1.0` present;
+  ROADMAP §v1.0 "complete").
+- **No upstream v1.1 phase dep** — Phase 06 is the first v1.1 phase.
+- **RESEARCH.md TARGET 10** — the authoritative move list + the static
+  analysis confirming no path fixups are needed (conf 0.90; R-5 residual
+  is the only open risk, caught by the Wave 3 regression check).
+- **PERSONAS.md** — Phase 06 active roster: lead-developer + frontend-
+  engineer (demo UI move only). backend/platform/security idle.

-## Next stage
+## Tasks summary

-CLARIFY — auto-resolve the 11 open decisions (already recorded in
-`PROJECT.md`); surface genuinely blocking ambiguities only. Then RESEARCH —
-delegate to ci-researcher on 10 targets (highest priority: Gitea/act_runner
-OIDC support, which gates real-AWS feasibility for the spike).
+| Task | Wave | Owner | Territory | Commit message tag |
+|------|------|-------|-----------|--------------------|
+| T-6.1 | 1 | lead-developer | `demo/` (new), moved dirs | `task: T-6.1` |
+| T-6.2 | 1 | lead-developer | `platform/`, `schemas/`, `adapters/`, `terraform/`, `modules-ir/` (new empty) | `task: T-6.2` |
+| T-6.3 | 1 | lead-developer | top-level `scripts/verify_phase06.sh` (new) | `task: T-6.3` |
+| T-6.4 | 1 | lead-developer | `README.md`, `.gitignore` | `task: T-6.4` |
+| T-6.5 | 2 | frontend-engineer | `demo/evidence-ui/index.html` (confirm-only) | `task: T-6.5` |
+| T-6.6 | 3 | lead-developer | (execution: `scripts/verify_phase06.sh`) | `task: T-6.6` |
+
+All commit messages follow the format:
+`phase: 6, status: plan-as-execute, persona: <name>, task: T-6.N`
+
+## Risks (specific to Phase 06)
+
+1. **R-5 (RESEARCH, residual 0.10): undetected absolute path in a demo
+   script.** Mitigation: Wave 3 runs `demo/scripts/run_demo.sh --no-upload`
+   and asserts exit 0. A failure is caught there and fixable in-phase by
+   making the offending path `SCRIPT_DIR`/`REPO_ROOT`-relative. The
+   typecheck gate (`bash -n demo/scripts/*.sh`) catches syntax issues
+   but not path issues — only the runtime regression catches those.
+
+2. **`contracts-repo/` is tracked and moves with `git mv`.** Verified:
+   `git ls-files contracts-repo/` returns
+   `.gitea/workflows/.gitkeep` + `.gitea/workflows/issue-to-contract.yml`.
+   It is a demo artifact (the v1.0 `acdl-contracts` mirror used by
+   `verify_phase04.sh`). Moving it to `demo/contracts-repo/` is correct;
+   `demo/scripts/verify_phase04.sh` references it via the
+   `ROOT`-relative path `contracts-repo/.gitea/workflows/...` which
+   auto-resolves to `demo/contracts-repo/...` after the move (ROOT =
+   parent of `demo/scripts/` = `demo/`).
+
+3. **`runner-data/` is untracked.** It is moved with plain `mv` (not
+   `git mv`) and gitignored. If a future runner registration recreates it
+   at the repo root, `.gitignore` (updated in T-6.4) keeps it untracked.
+
+4. **`ACDL_DEMO.md` was untracked** (verified: `git status` shows
+   `?? ACDL_DEMO.md`). `git mv` on an untracked file will fail; the
+   executor must `git add` it first (or use `mv` + `git add demo/ACDL_DEMO.md`).
+   The command list in T-6.1 uses `git mv ACDL_DEMO.md demo/ACDL_DEMO.md`
+   — if git rejects it as untracked, fall back to:
+   `mv ACDL_DEMO.md demo/ACDL_DEMO.md && git add demo/ACDL_DEMO.md`.
+
+5. **`verify_phase05.sh` has an anti-stray check** (lines 159-160:
+   `if [ -d "$ROOT/contracts" ]; then fail "contracts/ directory left in
+   repo root"`). After the move, `ROOT` for `demo/scripts/verify_phase05.sh`
+   is `demo/`, and `demo/contracts/` *does* exist — so this check would
+   fail if the v1.0 verify script is re-run from `demo/`. This is
+   expected: the v1.0 verify scripts are *archived demo artifacts*, not
+   re-run after Phase 06. The v1.1 verify script
+   (`scripts/verify_phase06.sh`) supersedes them. No action needed beyond
+   documenting that v1.0 verify scripts are not re-run post-archive.