diff --git a/adapters/terraform/adapter.py b/adapters/terraform/adapter.py
index 6fe102c..011076f 100644
--- a/adapters/terraform/adapter.py
+++ b/adapters/terraform/adapter.py
@@ -456,7 +456,6 @@ def _emit_resource(resource, type_by_id=None):
                 body.append("  }")
                 body.append("}")
             else:
-                import sys
                 print(f"WARNING: s3 bucket {rid} has no kms_key_arn — falling back to AWS-managed key (alias/aws/s3)", file=sys.stderr)
                 body.append("server_side_encryption_configuration {")
                 body.append("  rule {")
@@ -470,8 +469,6 @@ def _emit_resource(resource, type_by_id=None):
         if not feature_flag:
             return ""
         container_image = inputs.get("container_image", "louislam/uptime-kuma:1")
-        cpu = inputs.get("cpu", 256)
-        memory = inputs.get("memory", 512)
         monitored = inputs.get("monitored_endpoints", [])
         static_checks = inputs.get("static_checks", [])
         alert_channels = inputs.get("alert_channels", {})
diff --git a/pipelines/deploy.yaml b/pipelines/deploy.yaml
index ad41860..585c070 100644
--- a/pipelines/deploy.yaml
+++ b/pipelines/deploy.yaml
@@ -42,7 +42,7 @@ stages:
 
   - name: checkov
     description: Run Checkov policy checks on the emitted Terraform
-    command: checkov -f terraform/spike/main.tf --framework terraform -o json --soft-fail
+    command: bash scripts/run_platform.sh --check-only
     required: false
 
   - name: confidence
@@ -52,12 +52,12 @@ stages:
 
   - name: apply
     description: Apply the Terraform plan (dev environment only, autonomous per §10)
-    command: terraform -chdir=terraform/spike apply -auto-approve -lock=false
+    command: bash scripts/run_platform.sh --plan-only
     required: false
 
   - name: publish-outputs
     description: Publish deploy outputs to SSM Parameter Store (SecureString) + GitHub PR comment
-    command: python3 -c "from core.output_publisher import publish_to_ssm, format_comment, post_github_comment; import json,subprocess; tf=json.loads(subprocess.check_output(['terraform','-chdir=terraform/spike','output','-json']) or '{}'); outputs={k:v.get('value') if isinstance(v,dict) else v for k,v in tf.items()}; ssm=publish_to_ssm(outputs,'dev','spike'); comment=format_comment(outputs,'dev','spike',ssm); post_github_comment(comment)"
+    command: bash scripts/run_platform.sh
     required: false
 
   - name: deploy-uptime
diff --git a/scripts/run_platform.sh b/scripts/run_platform.sh
index ecb3840..e021571 100755
--- a/scripts/run_platform.sh
+++ b/scripts/run_platform.sh
@@ -129,7 +129,7 @@ if [ "$DECOMMISSION" = "1" ]; then
   echo ""
   echo "=== Decommission Step 1: validate change request against CMDB ==="
   [ -n "$CHANGE_REQUEST_ID" ] || fail "change request ID required for decommission mode"
-  CONSUMER_REPO=$(python3 -c "import yaml; c=yaml.safe_load(open('$CONTRACT')); print(c.get('module','unknown'))" 2>/dev/null || echo "unknown")
+  CONSUMER_REPO="${GITHUB_REPOSITORY:-$(python3 -c "import yaml; c=yaml.safe_load(open('$CONTRACT')); print(c.get('module','unknown'))" 2>/dev/null || echo 'unknown')}"
   python3 -c "
 import json, sys
 sys.path.insert(0, '$ROOT')