feat(P41): per-environment CI jobs + environment workflow input

---ci---
project: acdl
phase: 41
milestone: v1.9
status: execute
---/ci---

Phase 41 — per-environment-ci-jobs (REQ-105, REQ-106, D-082):

Per-env contracts (REQ-105):
- contracts/static-assets.{dev,qa,prod,dr}.yaml + microservice.{dev,qa,prod,dr}.yaml
  (8 files, each sets environment: to its own name, uses interpolation).
- Default contracts/static-assets.yaml + microservice.yaml preserved (backwards compat).

Deploy workflow environment input (REQ-106):
- .github/workflows/deploy.yml + .gitea/workflows/deploy.yml (byte-identical):
  new 'environment' workflow_call input (default empty, override).
- scripts/run_platform.sh: --environment <name> flag; exports
  ACDL_ENVIRONMENT_OVERRIDE; re-runs env check against the override.
- core/contract_resolver.py: resolve(environment_override=...) (D-088);
  CLI honors --environment flag + ACDL_ENVIRONMENT_OVERRIDE env var.

Consumer guide (REQ-106):
- docs/consumer-guide.md: 'Per-environment deployment' section with 4
  caller-workflow examples (dev/qa/prod/dr), HITL gate structure
  (approve_qa/approve_prod/approve_dr, D-042), interpolation reference table.
- Documents promotion-without-editing + hybrid model (per-env contracts
  OR single contract + env input).

Tests: +40 (test_per_env_contracts.py, test_deploy_workflow_env_input.py,
test_consumer_guide_per_env_section.py). 446 passed; run_ci.sh green;
deploy workflows byte-identical.

tests/test_consumer_guide_per_env_section.py

@@ -0,0 +1,45 @@
+"""REQ-106: consumer guide documents per-env caller workflows."""
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent
+GUIDE = ROOT / "docs" / "consumer-guide.md"
+
+
+def test_consumer_guide_has_per_env_section():
+    text = GUIDE.read_text()
+    assert "Per-environment deployment" in text
+    assert "promotion-without-editing" in text.lower() or "promotion = running the matching job" in text.lower()
+
+
+def test_consumer_guide_has_four_caller_examples():
+    text = GUIDE.read_text()
+    assert "deploy-dev" in text
+    assert "deploy-qa" in text
+    assert "deploy-prod" in text
+    assert "deploy-dr" in text
+
+
+def test_consumer_guide_documents_environment_input():
+    text = GUIDE.read_text()
+    assert "environment" in text
+    assert "workflow input" in text.lower() or "workflow_call" in text.lower() or "environment:" in text
+
+
+def test_consumer_guide_documents_hitl_gates():
+    text = GUIDE.read_text()
+    assert "approve_qa" in text
+    assert "approve_prod" in text
+    assert "approve_dr" in text
+    assert "separation-of-duties" in text.lower() or "separation of duties" in text.lower()
+
+
+def test_consumer_guide_has_interpolation_reference():
+    text = GUIDE.read_text()
+    assert "${env.environment}" in text
+    assert "${env.account_id}" in text
+    assert "${contract.module}" in text
+
+
+def test_consumer_guide_states_no_field_editing():
+    text = GUIDE.read_text()
+    assert "no" in text.lower() and "environment" in text.lower() and "editing" in text.lower()

tests/test_deploy_workflow_env_input.py

@@ -0,0 +1,81 @@
+"""REQ-106: deploy workflow environment input + run_platform.sh --environment.
+Both deploy workflows (Gitea + GitHub) declare the environment input,
+are byte-identical, and the resolver supports environment_override.
+"""
+import sys
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(ROOT))
+
+from core.contract_resolver import resolve
+
+GITHUB = ROOT / ".github" / "workflows" / "deploy.yml"
+GITEA = ROOT / ".gitea" / "workflows" / "deploy.yml"
+
+
+def test_both_deploy_workflows_exist():
+    assert GITHUB.is_file()
+    assert GITEA.is_file()
+
+
+def test_deploy_workflows_byte_identical():
+    assert GITHUB.read_text() == GITEA.read_text(), "deploy workflows must be byte-identical"
+
+
+def test_deploy_workflow_has_environment_input():
+    text = GITHUB.read_text()
+    assert "environment:" in text
+    assert "Target environment override" in text
+    # The input is declared in the workflow_call inputs section.
+    assert 'default: ""' in text
+
+
+def test_deploy_workflow_passes_env_flag_to_run_platform():
+    text = GITHUB.read_text()
+    assert "--environment" in text
+    assert "ENV_FLAG" in text
+    assert "inputs.environment" in text
+
+
+def test_resolver_environment_override_changes_env():
+    """D-088: environment_override changes the resolved environment."""
+    stack = resolve(str(ROOT / "contracts" / "static-assets.yaml"),
+                    environment_override="qa")
+    s3 = [r for r in stack["resources"] if r["type"] == "aws:s3:bucket"][0]
+    assert "qa" in s3["inputs"]["bucket_name"]
+
+
+def test_resolver_environment_override_prod():
+    stack = resolve(str(ROOT / "contracts" / "static-assets.yaml"),
+                    environment_override="prod")
+    s3 = [r for r in stack["resources"] if r["type"] == "aws:s3:bucket"][0]
+    assert "prod" in s3["inputs"]["bucket_name"]
+
+
+def test_resolver_environment_override_dr():
+    stack = resolve(str(ROOT / "contracts" / "static-assets.yaml"),
+                    environment_override="dr")
+    s3 = [r for r in stack["resources"] if r["type"] == "aws:s3:bucket"][0]
+    assert "dr" in s3["inputs"]["bucket_name"]
+
+
+def test_resolver_no_override_uses_contract_env():
+    stack = resolve(str(ROOT / "contracts" / "static-assets.yaml"))
+    s3 = [r for r in stack["resources"] if r["type"] == "aws:s3:bucket"][0]
+    assert "dev" in s3["inputs"]["bucket_name"]
+
+
+def test_resolver_override_none_uses_contract_env():
+    """Passing environment_override=None uses the contract's environment."""
+    stack = resolve(str(ROOT / "contracts" / "static-assets.yaml"),
+                    environment_override=None)
+    s3 = [r for r in stack["resources"] if r["type"] == "aws:s3:bucket"][0]
+    assert "dev" in s3["inputs"]["bucket_name"]
+
+
+def test_run_platform_sh_has_environment_flag():
+    text = (ROOT / "scripts" / "run_platform.sh").read_text()
+    assert "--environment" in text
+    assert "ENVIRONMENT_OVERRIDE" in text
+    assert "ACDL_ENVIRONMENT_OVERRIDE" in text

tests/test_per_env_contracts.py

@@ -0,0 +1,87 @@
+"""REQ-105: per-environment contract files exist + validate + resolve."""
+import json
+import sys
+from pathlib import Path
+
+import jsonschema
+import pytest
+import yaml
+
+ROOT = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(ROOT))
+
+from core.contract_resolver import resolve
+
+SCHEMA = json.loads((ROOT / "schemas" / "contract.schema.json").read_text())
+
+PER_ENV_CONTRACTS = [
+    "contracts/static-assets.dev.yaml",
+    "contracts/static-assets.qa.yaml",
+    "contracts/static-assets.prod.yaml",
+    "contracts/static-assets.dr.yaml",
+    "contracts/microservice.dev.yaml",
+    "contracts/microservice.qa.yaml",
+    "contracts/microservice.prod.yaml",
+    "contracts/microservice.dr.yaml",
+]
+
+
+@pytest.mark.parametrize("rel", PER_ENV_CONTRACTS)
+def test_per_env_contract_validates_against_schema(rel):
+    contract = yaml.safe_load((ROOT / rel).read_text())
+    jsonschema.validate(contract, SCHEMA)
+
+
+@pytest.mark.parametrize("rel", PER_ENV_CONTRACTS)
+def test_per_env_contract_resolves(rel):
+    stack = resolve(str(ROOT / rel))
+    assert stack["stack"]["name"] in ("static-assets", "microservice")
+
+
+def test_static_assets_dev_has_dev_environment():
+    c = yaml.safe_load((ROOT / "contracts/static-assets.dev.yaml").read_text())
+    assert c["environment"] == "dev"
+
+
+def test_static_assets_qa_has_qa_environment():
+    c = yaml.safe_load((ROOT / "contracts/static-assets.qa.yaml").read_text())
+    assert c["environment"] == "qa"
+
+
+def test_static_assets_prod_has_prod_environment():
+    c = yaml.safe_load((ROOT / "contracts/static-assets.prod.yaml").read_text())
+    assert c["environment"] == "prod"
+
+
+def test_static_assets_dr_has_dr_environment():
+    c = yaml.safe_load((ROOT / "contracts/static-assets.dr.yaml").read_text())
+    assert c["environment"] == "dr"
+
+
+def test_per_env_contracts_use_interpolation():
+    """Each per-env contract uses ${env.*} interpolation for the bucket name."""
+    for rel in PER_ENV_CONTRACTS:
+        text = (ROOT / rel).read_text()
+        assert "${env.environment}" in text
+        assert "${env.account_id}" in text
+
+
+def test_per_env_qa_resolves_to_qa_bucket_name():
+    stack = resolve(str(ROOT / "contracts/static-assets.qa.yaml"))
+    s3 = [r for r in stack["resources"] if r["type"] == "aws:s3:bucket"][0]
+    assert s3["inputs"]["bucket_name"] == "acdl-qa-static-assets-000000000000-us-east-1"
+
+
+def test_per_env_prod_resolves_to_prod_bucket_name():
+    stack = resolve(str(ROOT / "contracts/static-assets.prod.yaml"))
+    s3 = [r for r in stack["resources"] if r["type"] == "aws:s3:bucket"][0]
+    assert s3["inputs"]["bucket_name"] == "acdl-prod-static-assets-000000000000-us-east-1"
+
+
+def test_default_dev_contract_still_works():
+    """The existing contracts/static-assets.yaml remains the dev default."""
+    c = yaml.safe_load((ROOT / "contracts/static-assets.yaml").read_text())
+    assert c["environment"] == "dev"
+    stack = resolve(str(ROOT / "contracts/static-assets.yaml"))
+    s3 = [r for r in stack["resources"] if r["type"] == "aws:s3:bucket"][0]
+    assert s3["inputs"]["bucket_name"] == "acdl-dev-static-assets-000000000000-us-east-1"