feat(P40): contract interpolation + environment JSON schema

---ci---
project: acdl
phase: 40
milestone: v1.9
status: execute
---/ci---

Phase 40 — contract-interpolation (REQ-103, REQ-104, D-081):

Interpolation:
- core/contract_resolver.py: _expand_vars(value, context) recursively
  expands ${env.<field>} + ${contract.<field>} tokens (dotted paths
  supported, e.g. ${env.state_backend.bucket}). Unknown tokens raise
  ValueError (fail loud). Expansion is post-schema-validation,
  pre-IR-resolution.
- resolve() accepts environment_override (D-088) — overrides the
  contract's environment field BEFORE schema validation so interpolation
  context is consistent.
- env context loaded via _load_env (self-contained, works as script +
  package import); 'environment' alias for env 'name' so
  ${env.environment} resolves.

Environment schema + bindings:
- schemas/environment.schema.json (draft 2020-12): name, account_id,
  region, state_backend, network, runner_role_arn, autonomy, confidence_threshold.
- core/environments/qa.json, prod.json, dr.json placeholder bindings
  (attested, thresholds 0.75/0.90/0.95, placeholder account_id with
  stderr warning at load).
- core/environment_check.py: load(env_name) helper + placeholder warning.

Sample contracts:
- contracts/static-assets.yaml + microservice.yaml use
  acdl-${env.environment}-${contract.module}-${env.account_id}-${env.region}
  naming pattern (region + account id + environment).

Tests: +35 (test_environment_schema.py, test_interpolation.py,
test_sample_contracts_interpolate.py). 406 passed; run_ci.sh green;
run_platform.sh --check-only green. Existing fixture-based tests
preserved (instance.json static fixtures unaffected).

core/contract_resolver.py

@@ -20,12 +20,34 @@ CLI: contract_resolver.py <contract.yaml> <out.json>
 
 import json
 import os
+import re
 import sys
 
 import yaml
 import jsonschema
 
 
+def _load_env(env_name, repo_root):
+    """Load the environment onboarding JSON for env_name.
+
+    Mirrors core.environment_check.load() but is self-contained so the
+    resolver works both as a package import (`from core.contract_resolver
+    import resolve`) and as a script (`python3 core/contract_resolver.py`).
+    Emits a stderr warning when account_id is the placeholder and env != dev.
+    """
+    env_file = os.path.join(repo_root, "core", "environments", f"{env_name}.json")
+    if not os.path.isfile(env_file):
+        raise FileNotFoundError(f"no environment file for '{env_name}' at {env_file}")
+    env = _load_json(env_file)
+    if env.get("account_id") == "000000000000" and env_name != "dev":
+        sys.stderr.write(
+            f"WARNING: environment '{env_name}' has the placeholder account_id "
+            f"000000000000 — replace it with the real {env_name} account id "
+            f"before deploying (onboarding scaffold).\n"
+        )
+    return env
+
+
 def _load_json(path):
     with open(path, "r") as fh:
         return json.load(fh)
@@ -36,6 +58,51 @@ def _load_yaml(path):
         return yaml.safe_load(fh)
 
 
+_TOKEN_RE = re.compile(r"\$\{([a-zA-Z_][a-zA-Z0-9_.]*)\}")
+
+
+def _lookup_dotted(context, dotted):
+    """Look up a dotted path (e.g. 'env.state_backend.bucket') in context.
+
+    context is a dict of top-level namespaces (e.g. {'env': {...}, 'contract': {...}}).
+    Returns the value or raises KeyError if any segment is missing.
+    """
+    parts = dotted.split(".")
+    cur = context
+    for part in parts:
+        if isinstance(cur, dict) and part in cur:
+            cur = cur[part]
+        else:
+            raise KeyError(dotted)
+    return cur
+
+
+def _expand_vars(value, context):
+    """Recursively expand ${env.<field>} and ${contract.<field>} tokens in value.
+
+    Walks dicts, lists, and strings. Unknown tokens raise ValueError (fail
+    loud, no silent passthrough — D-081). Dotted paths are supported
+    (e.g. ${env.state_backend.bucket}). The expansion is recursive per D-087
+    so nested map/list values expand too.
+    """
+    if isinstance(value, str):
+        def _replace(match):
+            token = match.group(1)
+            try:
+                resolved = _lookup_dotted(context, token)
+            except KeyError:
+                raise ValueError(f"unresolved interpolation token: ${{{token}}}")
+            if isinstance(resolved, (dict, list)):
+                return json.dumps(resolved)
+            return str(resolved)
+        return _TOKEN_RE.sub(_replace, value)
+    if isinstance(value, dict):
+        return {k: _expand_vars(v, context) for k, v in value.items()}
+    if isinstance(value, list):
+        return [_expand_vars(v, context) for v in value]
+    return value
+
+
 def _resolve_wire_value(wire, contract_inputs, child_outputs):
     """Resolve a wire 'from' reference to a concrete value.
 
@@ -323,12 +390,16 @@ def decommission_transform(stack_instance):
     return stack_instance
 
 
-def resolve(contract_path, repo_root=None):
+def resolve(contract_path, repo_root=None, environment_override=None):
     """Resolve a consumer contract to a Target Stack instance.
 
     Args:
         contract_path: Path to the contract YAML file.
         repo_root: Root of the ACDL repo (defaults to two levels up from this file).
+        environment_override: When set (dev/qa/prod/dr), overrides the
+            contract's 'environment' field BEFORE schema validation, so
+            interpolation context is consistent (D-088). Used by
+            run_platform.sh --environment.
 
     Returns:
         A dict representing the Target Stack instance.
@@ -339,12 +410,30 @@ def resolve(contract_path, repo_root=None):
     # Load contract
     contract = _load_yaml(contract_path)
 
+    # Apply environment override BEFORE schema validation (D-088) so the
+    # schema sees the overridden value and interpolation context is consistent.
+    if environment_override:
+        contract["environment"] = environment_override
+
     # Load schemas
     contract_schema = _load_json(os.path.join(repo_root, "schemas", "contract.schema.json"))
 
     # Validate contract against schema
     jsonschema.validate(contract, contract_schema)
 
+    # Interpolation (D-081): expand ${env.<field>} + ${contract.<field>}
+    # tokens AFTER schema validation (the schema sees raw tokens, which are
+    # valid strings) and BEFORE IR resolution (the resolver sees concrete
+    # values). The env context is the loaded environment onboarding JSON.
+    env_name = contract.get("environment", "dev")
+    env = _load_env(env_name, repo_root)
+    # Expose 'environment' as an alias for the env's 'name' field so
+    # ${env.environment} resolves (the env JSON uses 'name', but contracts
+    # reference the environment by ${env.environment}).
+    env["environment"] = env.get("name", env_name)
+    context = {"env": env, "contract": contract}
+    contract["inputs"] = _expand_vars(contract.get("inputs", {}), context)
+
     # Load registry
     registry = _load_json(os.path.join(repo_root, "modules", "registry.json"))
 

core/environment_check.py

@@ -10,6 +10,7 @@ Usage:
     python3 core/environment_check.py <contract.yaml>
     python3 core/environment_check.py --env dev
 """
+import json
 import sys
 from pathlib import Path
 
@@ -32,6 +33,27 @@ def _contract_environment(contract_path):
     return contract.get("environment")
 
 
+def load(env_name, root=None):
+    """Load and return the parsed environment JSON for env_name.
+
+    Returns the env dict, or raises FileNotFoundError if no <env_name>.json
+    exists. Emits a stderr warning when account_id is the 000000000000
+    placeholder and env_name != 'dev' (prompts real binding).
+    """
+    env_file = _environments_dir(root) / f"{env_name}.json"
+    if not env_file.is_file():
+        raise FileNotFoundError(f"no environment file for '{env_name}' at {env_file}")
+    with open(env_file) as f:
+        env = json.load(f)
+    if env.get("account_id") == "000000000000" and env_name != "dev":
+        sys.stderr.write(
+            f"WARNING: environment '{env_name}' has the placeholder account_id "
+            f"000000000000 — replace it with the real {env_name} account id "
+            f"before deploying (onboarding scaffold).\n"
+        )
+    return env
+
+
 def _onboarding_message(env_name):
     return (
         "=== ACDL Environment Onboarding ===\n"

core/environments/README.md

@@ -10,7 +10,17 @@ runner key — the platform manages all of that here.
 
 ## Files
 
-- `dev.json` — the default dev environment (autonomous, confidence ≥ 0.50).
+- `dev.json` — the default dev environment (autonomous, confidence >= 0.50).
+- `qa.json` — QA environment (attested, QA HITL gate, confidence >= 0.75).
+  Placeholder binding (replace account_id with the real QA account).
+- `prod.json` — Production environment (attested, SRE HITL gate, confidence >= 0.90).
+  Placeholder binding.
+- `dr.json` — DR environment (attested, SRE HITL gate, confidence >= 0.95).
+  Placeholder binding.
+
+All files validate against `schemas/environment.schema.json`. The qa/prod/dr
+placeholders use `account_id: 000000000000` with a stderr warning at load
+time (prompts real binding before deploying).
 
 ## How it is used
 

core/environments/dr.json

@@ -0,0 +1,17 @@
+{
+  "name": "dr",
+  "description": "DR environment — attested (SRE HITL gate, confidence >= 0.95). Placeholder binding; replace account_id with the real DR account.",
+  "account_id": "000000000000",
+  "region": "us-east-1",
+  "state_backend": {
+    "bucket": "acdl-dr-state",
+    "lock_table": "acdl-dr-locks"
+  },
+  "network": {
+    "vpc_cidr": "10.3.0.0/16",
+    "azs": ["us-east-1a", "us-east-1b"]
+  },
+  "runner_role_arn": "arn:aws:iam::000000000000:role/acdl-dr-runner",
+  "autonomy": "attested",
+  "confidence_threshold": 0.95
+}

core/environments/prod.json

@@ -0,0 +1,17 @@
+{
+  "name": "prod",
+  "description": "Production environment — attested (SRE HITL gate, confidence >= 0.90). Placeholder binding; replace account_id with the real prod account.",
+  "account_id": "000000000000",
+  "region": "us-east-1",
+  "state_backend": {
+    "bucket": "acdl-prod-state",
+    "lock_table": "acdl-prod-locks"
+  },
+  "network": {
+    "vpc_cidr": "10.2.0.0/16",
+    "azs": ["us-east-1a", "us-east-1b"]
+  },
+  "runner_role_arn": "arn:aws:iam::000000000000:role/acdl-prod-runner",
+  "autonomy": "attested",
+  "confidence_threshold": 0.90
+}

core/environments/qa.json

@@ -0,0 +1,17 @@
+{
+  "name": "qa",
+  "description": "QA environment — attested (QA HITL gate, confidence >= 0.75). Placeholder binding; replace account_id with the real QA account.",
+  "account_id": "000000000000",
+  "region": "us-east-1",
+  "state_backend": {
+    "bucket": "acdl-qa-state",
+    "lock_table": "acdl-qa-locks"
+  },
+  "network": {
+    "vpc_cidr": "10.1.0.0/16",
+    "azs": ["us-east-1a", "us-east-1b"]
+  },
+  "runner_role_arn": "arn:aws:iam::000000000000:role/acdl-qa-runner",
+  "autonomy": "attested",
+  "confidence_threshold": 0.75
+}