docs(milestone): complete v1.8 — P1 remediation + uptime + standards + encryption + decommission + docs

---ci---
project: acdl
phase: 0
milestone: v1.8
status: complete
requirements:
  covered: [REQ-76, REQ-77, REQ-78, REQ-79, REQ-80, REQ-81, REQ-82, REQ-83, REQ-84, REQ-85, REQ-86, REQ-87, REQ-88, REQ-89, REQ-90, REQ-91, REQ-92, REQ-93, REQ-94, REQ-95, REQ-96, REQ-97, REQ-98, REQ-99]
  partial: []
---/ci---

v1.8 milestone complete. 11 phases (28-38), 24 requirements (REQ-76..99).

Track 1 — P1 Remediation (8 issues, all resolved):
- P1-3: SSM fail-loud without CMK + escape hatch
- P1-4: WAF custom rules emit nested HCL blocks
- P1-5: WAF default_action input honored
- P1-6: Terraform-rendered invoke policy (no placeholder account ID)
- P1-7: L2 composition outputs resolved + adapter output blocks
- P1-8: Per-run temp dir (terraform/spike removed)
- P1-9: Forge-agnostic API URLs (GITHUB_API_BASE)
- S1: Static-key override wired to configure-aws-credentials inputs

Track 2 — Encryption + Deletion Protection by Default:
- Per-stack CMK (kms-key primitive, 90-day rotation, no shared keys)
- All 12 primitives have encryption_enabled NFR + kms_key_arn input
- L2 modules wire per-stack CMK to all children
- All 12 primitives have deletion_protection NFR (default true)
- Adapter emits lifecycle { prevent_destroy = true }
- L2 feature flag propagation (inputs.deletion_protection)

Track 3 — Uptime + Standards + Docs:
- uptime-kuma primitive (ECS Fargate, feature flag, alert channels)
- deploy-uptime pipeline stage (separate state)
- Decommission mode (2-step HITL SRE gates + CMDB validation)
- modules/STANDARDS.md (L1+L2 authoring + review standards)
- schemas/README.md, pipelines/README.md, adapters/README.md

Tests: 275 -> 350 (+75 new). All pass. run_ci.sh + check-only green.
Zero pending P1 issues remaining.

.ciagent/REQUIREMENTS.md

@@ -357,31 +357,31 @@
 | REQ-74 | 27 | complete (v1.7.0) |
 | REQ-75 | 27 | complete (v1.7.0) |
 
-### v1.8 (active — P1 remediation + uptime + standards + encryption/deletion-protection by default + decommission + docs)
+### v1.8 (complete — P1 remediation + uptime + standards + encryption/deletion-protection by default + decommission + docs, tag `v1.8.0`)
 
 | Requirement | Phase | Status |
 |-------------|-------|--------|
-| REQ-76 | 28 | pending |
+| REQ-76 | 28 | complete (v1.8.0) |
-| REQ-77 | 28 | pending |
+| REQ-77 | 28 | complete (v1.8.0) |
-| REQ-78 | 29 | pending |
+| REQ-78 | 29 | complete (v1.8.0) |
-| REQ-79 | 29 | pending |
+| REQ-79 | 29 | complete (v1.8.0) |
-| REQ-80 | 30 | pending |
+| REQ-80 | 30 | complete (v1.8.0) |
-| REQ-81 | 30 | pending |
+| REQ-81 | 30 | complete (v1.8.0) |
-| REQ-82 | 30 | pending |
+| REQ-82 | 30 | complete (v1.8.0) |
-| REQ-83 | 31 | pending |
+| REQ-83 | 31 | complete (v1.8.0) |
-| REQ-84 | 31 | pending |
+| REQ-84 | 31 | complete (v1.8.0) |
-| REQ-85 | 31 | pending |
+| REQ-85 | 31 | complete (v1.8.0) |
-| REQ-86 | 32 | pending |
+| REQ-86 | 32 | complete (v1.8.0) |
-| REQ-87 | 32 | pending |
+| REQ-87 | 32 | complete (v1.8.0) |
-| REQ-88 | 33 | pending |
+| REQ-88 | 33 | complete (v1.8.0) |
-| REQ-89 | 33 | pending |
+| REQ-89 | 33 | complete (v1.8.0) |
-| REQ-90 | 33 | pending |
+| REQ-90 | 33 | complete (v1.8.0) |
-| REQ-91 | 33 | pending |
+| REQ-91 | 33 | complete (v1.8.0) |
-| REQ-92 | 34 | pending |
+| REQ-92 | 34 | complete (v1.8.0) |
-| REQ-93 | 34 | pending |
+| REQ-93 | 34 | complete (v1.8.0) |
-| REQ-94 | 34 | pending |
+| REQ-94 | 34 | complete (v1.8.0) |
-| REQ-95 | 35 | pending |
+| REQ-95 | 35 | complete (v1.8.0) |
-| REQ-96 | 35 | pending |
+| REQ-96 | 35 | complete (v1.8.0) |
-| REQ-97 | 36 | pending |
+| REQ-97 | 36 | complete (v1.8.0) |
-| REQ-98 | 36 | pending |
+| REQ-98 | 36 | complete (v1.8.0) |
-| REQ-99 | 36 | pending |
+| REQ-99 | 36 | complete (v1.8.0) |

.ciagent/ROADMAP.md

@@ -10,7 +10,7 @@
 - **v1.5 (complete, tag `v1.5.0`):** consumer happy path + zero-trust docs + reusable deploy workflow. README rewritten so the consumer model is unambiguous (consumer owns only contract + app code; the rest is the platform source). Platform-flow + consumer-guide diagrams converted to mermaid. Legacy surface + implementation nomenclature removed from docs. Credentials section rewritten for zero-trust OIDC + ABAC (with a static-key override + daily rotation). A generic `docs/CONSUMER_GUIDE.md` (all L2 modules, versioned `uses:`, consumer-scoped prereqs, run-time platform fetch) replaces the module-specific guide. A byte-identical reusable `deploy.yml` workflow (Gitea + GitHub) implements `pipelines/deploy.yaml` and is invoked by consumer repos via a versioned tag.
 - **v1.6 (complete, tag `v1.6.0`):** consumer-facing docs restructure + terminology normalization + environments concept. `docs/` becomes a Jekyll-style GitHub Pages site. `acdl_platform/` is renamed to `core/`. L2 → "modules", L1 → "primitives", "composition" → "pattern" in prose. README restructured: Features + Roadmap (no internal status), repository roles restated (consumer = app code + contracts + CI definitions), mermaid fixed (visible text, security-checks + infrastructure-apply stages, no tool names), credentials section minus go-gitea/waivers. Platform-managed environments concept + a minimal onboarding scaffold. `.ciagent/` + `.gitea/` references removed from all consumer-facing docs.
 - **v1.7 (complete, tag `v1.7.0`):** production platform + contract ingestion + pipeline maturation. Rename `static-assets` → `static-assets` (D-048 — incl. `.ciagent/` historical narrative). Author `cloudfront` + `waf` primitives; augment `static-assets` to a production-ready S3 + CloudFront (OAC) + WAF stack (D-049). Tagging-standard enforcement (Checkov custom rule, D-043 closure, D-054). Wiz adapter stub (D-052) + Kyverno K8s-native adapter (D-053). Platform Lambda + DynamoDB `acdl-contracts` table for contract ingestion (D-051) + cross-account IAM. Deploy outputs via SSM SecureString + GitHub PR comment (D-050). Uniform error reporting via the Lambda `report_error` action → GitHub issue on the platform repo (D-055); Gitea excluded. Stage comments after every successful pipeline stage. Three platform pipelines (platform-test unit+integration, primitives-plan, patterns-plan). Release job with semver + MAJOR.MINOR/MAJOR tag maintenance (D-057). `uses:`/`ref:` bumped to `@v1.6`; floating `v1.6` + `v1` tags created in Phase 22. Remove the legacy consumer-repos directory (a v1.2 artifact, removed in v1.7); add validated per-module examples (`modules/<name>/examples/`, D-058) including a new RDS primitive demonstrating multi-engine variation (D-059).
-- **v1.8 (active):** P1 remediation + uptime monitoring + engineering standards + encryption/deletion-protection by default + decommission alias + path documentation. Clears 8 pending P1 issues (P1-3..P1-9 + S1). Adds per-stack CMK + encryption-by-default for all primitives. Adds deletion-protection-by-default + L2 feature flag. Adds uptime-kuma primitive (ECS Fargate, deployed by default after L2, separate state, feature flag, alert channels). Adds decommission mode (2-step pipeline with HITL SRE gates + CMDB-validated change request). Adds `modules/STANDARDS.md` (L1+L2 authoring + review standards). Adds `schemas/README.md`, `pipelines/README.md`, `adapters/README.md`.
+- **v1.8 (complete, tag `v1.8.0`):** P1 remediation + uptime monitoring + engineering standards + encryption/deletion-protection by default + decommission alias + path documentation. Clears 8 pending P1 issues (P1-3..P1-9 + S1). Adds per-stack CMK + encryption-by-default for all primitives. Adds deletion-protection-by-default + L2 feature flag. Adds uptime-kuma primitive (ECS Fargate, deployed by default after L2, separate state, feature flag, alert channels). Adds decommission mode (2-step pipeline with HITL SRE gates + CMDB-validated change request). Adds `modules/STANDARDS.md` (L1+L2 authoring + review standards). Adds `schemas/README.md`, `pipelines/README.md`, `adapters/README.md`.
 - **v1.0 demo URL:** https://git.cloudinit.dev/continuous-intelligence/acdl-evidence/raw/branch/main/index.html
 
 ---
@@ -432,7 +432,7 @@ After Phase 27: COMPLETE gate — review → ship `v1.7.0` → audit. **DONE.**
 
 ---
 
-## v1.8 (Active — P1 remediation + uptime + engineering standards + encryption/deletion-protection by default + decommission + docs)
+## v1.8 (Complete — P1 remediation + uptime + engineering standards + encryption/deletion-protection by default + decommission + docs)
 
 The v1.8 milestone clears all pending P1 issues from v1.5–v1.7 verify
 reviews AND delivers three user-directed tracks: encryption + deletion
@@ -444,7 +444,7 @@ shipped `v1.7.0`). Phase patches `v1.7.1`..`v1.7.9`.
 
 ### Phase 28 — adapter-waf-and-resolver-outputs
 - **Description:** Fix WAF HCL emission: custom `rules` input emits nested `rules { ... }` blocks (not `rules = [...]` attribute syntax — P1-4). Honor `default_action` input (allow/block) instead of hardcoding `allow {}` (P1-5). Implement L2 composition `outputs[]` processing in `resolve_l2()` — build `stack.outputs` dict + adapter emits `output` blocks (P1-7). Tests for all three fixes.
-- **Status:** pending
+- **Status:** complete (v1.8.0)
 - **Depends on:** —
 - **Requirements:** REQ-76, REQ-77
 - **Success Criteria:**
@@ -456,7 +456,7 @@ shipped `v1.7.0`). Phase patches `v1.7.1`..`v1.7.9`.
 
 ### Phase 29 — ssm-kms-and-invoke-policy
 - **Description:** SSM publisher fails loud (`RuntimeError`) when `ACDL_KMS_KEY_ID` unset; `ACDL_ALLOW_DEFAULT_KMS=1` escape hatch for local testing (P1-3). Convert `consumer_invoke_policy.json` to a Terraform-rendered template using `data.aws_caller_identity` + `templatestring` — no `000000000000` placeholder (P1-6). Tests for both.
-- **Status:** pending
+- **Status:** complete (v1.8.0)
 - **Depends on:** [28]
 - **Requirements:** REQ-78, REQ-79
 - **Success Criteria:**
@@ -466,7 +466,7 @@ shipped `v1.7.0`). Phase patches `v1.7.1`..`v1.7.9`.
 
 ### Phase 30 — run-platform-isolation-and-api-portability
 - **Description:** `run_platform.sh` emits adapter output to `$WORK/tf` (per-run temp dir), not `terraform/spike/`; remove committed `terraform/spike/*.tf` (P1-8). `contract_ingestor.py` reads `GITHUB_API_BASE` env for forge-agnostic API URLs (GitHub + Gitea); `_forge_type()` branches search URL (P1-9). Deploy workflow `configure-aws-credentials` step restructured as single conditional step: OIDC when no static key, `access-key`/`secret-key` inputs when static key present (S1). Both deploy workflows remain byte-identical.
-- **Status:** pending
+- **Status:** complete (v1.8.0)
 - **Depends on:** [29]
 - **Requirements:** REQ-80, REQ-81, REQ-82
 - **Success Criteria:**
@@ -477,7 +477,7 @@ shipped `v1.7.0`). Phase patches `v1.7.1`..`v1.7.9`.
 
 ### Phase 31 — encryption-by-default-and-per-stack-cmk
 - **Description:** Create `kms-key` L1 primitive (type `aws:kms:key`, inputs: description/region/deletion_window_days, outputs: kms_key_arn/kms_key_id, NFRs: enable_rotation default true, deletion_protection default true). Adapter emits `aws_kms_key` + `aws_kms_alias` + `enable_key_rotation = true`. Add `encryption_enabled` NFR (default true) + `kms_key_arn` input to all primitives. L2 modules wire a `kms-key` child + connect its output to all children. Managed KMS fallback when no CMK provided (with stderr warning).
-- **Status:** pending
+- **Status:** complete (v1.8.0)
 - **Depends on:** [30]
 - **Requirements:** REQ-83, REQ-84, REQ-85
 - **Success Criteria:**
@@ -489,7 +489,7 @@ shipped `v1.7.0`). Phase patches `v1.7.1`..`v1.7.9`.
 
 ### Phase 32 — deletion-protection-by-default-and-l2-feature-flag
 - **Description:** Add `deletion_protection` NFR (boolean, default true) to every L1 primitive. Adapter emits `lifecycle { prevent_destroy = true }` when true; omits it when false. L2 modules expose `features.deletion_protection` flag (default true); resolver propagates to each child's NFR. Consumers can set `inputs.deletion_protection: false` in contract. Update contract schema.
-- **Status:** pending
+- **Status:** complete (v1.8.0)
 - **Depends on:** [31]
 - **Requirements:** REQ-86, REQ-87
 - **Success Criteria:**
@@ -500,7 +500,7 @@ shipped `v1.7.0`). Phase patches `v1.7.1`..`v1.7.9`.
 
 ### Phase 33 — uptime-kuma-primitive
 - **Description:** Create `uptime` L1 primitive (ECS Fargate running `louislam/uptime-kuma:1`). Inputs: container_image, region, monitored_endpoints (array of {name, url, type, interval, timeout}), static_checks, alert_channels ({teams_webhook, email_addresses, sms_numbers, github_issue_repo}), feature_flag_enabled (default true), cpu, memory. Outputs: uptime_url, service_arn, task_definition_arn. NFRs: deletion_protection, encryption_enabled. Adapter emits ECS service + ALB + log group; no resources when feature_flag_enabled=false. Register in registry. Add `deploy-uptime` pipeline stage (separate state, after publish-outputs) to `pipelines/deploy.yaml` + both deploy workflows. `run_platform.sh` constructs synthetic uptime contract from L2 outputs + runs second terraform apply. Uptime URL published via PR comment. Feature flag from `inputs.uptime_enabled` (default true).
-- **Status:** pending
+- **Status:** complete (v1.8.0)
 - **Depends on:** [32]
 - **Requirements:** REQ-88, REQ-89, REQ-90, REQ-91
 - **Success Criteria:**
@@ -513,7 +513,7 @@ shipped `v1.7.0`). Phase patches `v1.7.1`..`v1.7.9`.
 
 ### Phase 34 — decommission-alias-and-cmdb-validation
 - **Description:** Add `mode: decommission` to deploy pipeline. Stages: validate-change-request (Lambda `validate_change_request` action queries DynamoDB `acdl-change-requests` table, asserts status=approved) → disable-deletion-protection (resolve contract with deletion_protection=false, terraform plan/apply, HITL SRE gate) → zero-counts (resolver `decommission_transform` zeroes all counts, terraform plan/apply, second HITL SRE gate) → confirm-decommission. Add `acdl-change-requests` DynamoDB table to terraform/platform/main.tf. Add `validate_change_request` to contract_ingestor.py. Document in `docs/CONSUMER_GUIDE.md`.
-- **Status:** pending
+- **Status:** complete (v1.8.0)
 - **Depends on:** [33]
 - **Requirements:** REQ-92, REQ-93, REQ-94
 - **Success Criteria:**
@@ -525,7 +525,7 @@ shipped `v1.7.0`). Phase patches `v1.7.1`..`v1.7.9`.
 
 ### Phase 35 — module-engineering-standards
 - **Description:** Scan all current modules to generate `modules/STANDARDS.md` — comprehensive L1+L2 authoring + code review standards: required files, interface schema, input/output/NFR conventions, encryption + deletion protection as mandatory NFRs, naming, multi-resource pattern, adapter extension pattern (TYPE_MAP + INPUT_MAP + OUTPUT_MAP + specialized branches), code review checklist. Fix `modules/README.md` catalog index (add rds + uptime + kms-key). Update `modules/README-TEMPLATE.md` with `## NFRs` section. Add `tests/test_module_standards.py` for automated enforcement.
-- **Status:** pending
+- **Status:** complete (v1.8.0)
 - **Depends on:** [34]
 - **Requirements:** REQ-95, REQ-96
 - **Success Criteria:**
@@ -536,7 +536,7 @@ shipped `v1.7.0`). Phase patches `v1.7.1`..`v1.7.9`.
 
 ### Phase 36 — schemas-adapters-pipelines-readmes
 - **Description:** Author `schemas/README.md` (how to write schemas, wire into platform, test in CI, dependencies, existing catalog), `pipelines/README.md` (how to write pipeline contracts, wire into workflows, test, dependencies, catalog), `adapters/README.md` (how to write adapters, wire into platform, test, dependencies, catalog). Add `tests/test_docs_coverage.py` to validate presence + required sections.
-- **Status:** pending
+- **Status:** complete (v1.8.0)
 - **Depends on:** [35]
 - **Requirements:** REQ-97, REQ-98, REQ-99
 - **Success Criteria:**
@@ -546,7 +546,7 @@ shipped `v1.7.0`). Phase patches `v1.7.1`..`v1.7.9`.
 
 ### Phase 37 — verify
 - **Description:** 4-layer verification (structural, behavioral, security, quality) of all v1.8 phases. Re-verify each P1 (P1-3..P1-9 + S1) is resolved. Verify all new features (encryption, deletion protection, uptime, decommission, standards, docs) have dedicated tests.
-- **Status:** pending
+- **Status:** complete (v1.8.0)
 - **Depends on:** [36]
 - **Requirements:** —
 - **Success Criteria:**
@@ -555,7 +555,7 @@ shipped `v1.7.0`). Phase patches `v1.7.1`..`v1.7.9`.
 
 ### Phase 38 — review-audit-complete
 - **Description:** Multi-persona code review across the full v1.8 diff. Audit (reconstruction, file discipline, branch hygiene, commit discipline). Complete: update REQUIREMENTS.md (REQ-76..99), ROADMAP.md (v1.8 complete), PROJECT.md. Tag `v1.8.0`. Update floating `v1.8` + `v1` tags. Bump `uses:`/`ref:` from `@v1.6` to `@v1.8`.
-- **Status:** pending
+- **Status:** complete (v1.8.0)
 - **Depends on:** [37]
 - **Requirements:** —
 - **Success Criteria:**

.ciagent/config.json

@@ -5,7 +5,7 @@
       "slug": "acdl",
       "name": "Agentic Cloud Delivery Platform",
       "milestone": "v1.8",
-      "status": "active"
+      "status": "complete"
     }
   ],
   "active_project": "acdl",