docs(P14): plan-as-execute + verify (v1.2.4)

---ci---
project: acdl
phase: 14
milestone: v1.2
status: verify
verdict: VERIFIED
requirements:
  covered: [REQ-32]
---/ci---

Phase 14 plan-as-execute + verify. scripts/verify_phase14.sh green.
l2-microservice composition (6 L1s, 2 wire kinds); contract schema
extended (inputs allow objects + healthcheck); resolver extended
(array-form wires, child->child refs, multi-resource L1 expansion);
adapter extended (ref: interpolation translation). v1.2 IR: 11 resources.
v1.1 S3 regression byte-identical. Ready to ship v1.2.4.

adapters/terraform/adapter.py

@@ -82,13 +82,49 @@ def _tf_value(value):
     if isinstance(value, (int, float)) and not isinstance(value, bool):
         return str(value)
     if isinstance(value, str):
+        if value.startswith("ref:"):
+            raise ValueError("ref: values must be resolved via _ref_expr, not _tf_value")
         return f'"{value}"'
     if isinstance(value, (dict, list)):
         return f"jsonencode({json.dumps(value, sort_keys=True)})"
     raise ValueError(f"unsupported input value type {type(value).__name__}")
 
 
-def _emit_resource(resource):
+def _ref_expr(ref_value, type_by_id):
+    """Translate a "ref:<ir_resource_id>.<output>" string to a Terraform
+    interpolation "${<tf_type>.<id>.<attr>}".
+
+    <ir_resource_id> is the IR resource id of the producing resource;
+    <output> is the per-resource output name (e.g. `subnet_id`,
+    `cluster_arn`); the attribute is mapped through OUTPUT_MAP for the
+    referenced resource's IR type. The resolver emits the ref using the
+    IR resource id directly (not the child id), so no child->resource
+    lookup table is needed here.
+    """
+    body = ref_value[len("ref:"):]
+    rid, out_name = body.split(".", 1)
+    rtype = type_by_id.get(rid)
+    if not rtype:
+        raise ValueError(f"ref to unknown IR resource id {rid!r}")
+    tf_type = TYPE_MAP.get(rtype)
+    if not tf_type:
+        raise ValueError(f"ref target {rid!r} has unknown IR type {rtype!r}")
+    out_map = OUTPUT_MAP.get(rtype, {})
+    tf_attr = out_map.get(out_name, out_name)
+    return f"${{{tf_type}.{rid}.{tf_attr}}}"
+
+
+def _value_expr(value, type_by_id=None):
+    """Render a value as a Terraform expression fragment. A "ref:<id>.<output>"
+    string becomes a Terraform interpolation; other values use _tf_value."""
+    if isinstance(value, str) and value.startswith("ref:"):
+        if type_by_id is None:
+            raise ValueError("ref: value encountered without a type_by_id table")
+        return _ref_expr(value, type_by_id)
+    return _tf_value(value)
+
+
+def _emit_resource(resource, type_by_id=None):
     rtype = resource["type"]
     rid = resource["id"]
     tf_type = TYPE_MAP.get(rtype)
@@ -106,14 +142,20 @@ def _emit_resource(resource):
         if rtype == "aws:iam:role" and in_name == "managed_policies":
             continue
         if rtype == "aws:elbv2:loadbalancer" and in_name == "subnets":
-            body.append(f"subnets = [{value}]" if isinstance(value, str) else f"subnets = {_tf_value(value)}")
+            if isinstance(value, str) and value.startswith("ref:"):
+                body.append(f"subnets = [{_ref_expr(value, type_by_id)}]")
+            else:
+                body.append(f"subnets = [{value}]" if isinstance(value, str) else f"subnets = {_tf_value(value)}")
             continue
         if rtype == "aws:elbv2:loadbalancer" and in_name == "security_group":
-            body.append(f"security_groups = [{value}]" if isinstance(value, str) else f"security_groups = {_tf_value(value)}")
+            if isinstance(value, str) and value.startswith("ref:"):
+                body.append(f"security_groups = [{_ref_expr(value, type_by_id)}]")
+            else:
+                body.append(f"security_groups = [{value}]" if isinstance(value, str) else f"security_groups = {_tf_value(value)}")
             continue
         if rtype == "aws:ec2:routetable" and in_name == "igw_id":
             continue
-        body.append(f"{arg} = {_tf_value(value)}")
+        body.append(f"{arg} = {_value_expr(value, type_by_id)}")
     nfrs = resource.get("nfrs", {})
     if isinstance(nfrs, dict) and "versioning" in nfrs and rtype == "aws:s3:bucket":
         versioning = nfrs.get("versioning", True)
@@ -209,9 +251,13 @@ def adapt(ir_instance, out_dir):
     )
 
     # --- main.tf: resources + outputs ---
+    # Build an IR-resource-id -> IR-type table so `ref:` input values can
+    # be resolved to Terraform interpolations without a child->resource
+    # lookup (the resolver emits refs with the IR resource id directly).
+    type_by_id = {r["id"]: r["type"] for r in resources}
     main_tf_parts = []
     for r in resources:
-        main_tf_parts.append(_emit_resource(r))
+        main_tf_parts.append(_emit_resource(r, type_by_id))
         rid = r["id"]
         rtype = r["type"]
         tf_type = TYPE_MAP.get(rtype)