diff --git a/.ciagent/VERIFY.md b/.ciagent/VERIFY.md
index d435b7c..8e7dc02 100644
--- a/.ciagent/VERIFY.md
+++ b/.ciagent/VERIFY.md
@@ -1,45 +1,46 @@
-# Phase 18 — Verify (v1.3.2)
+# Phase 28-36 — Verify (v1.8)
 
 ## Structural
-
-All 11 new files confirmed present: pyproject.toml, requirements-test.txt,
-tests/__init__.py, tests/conftest.py, tests/test_adapter.py,
-tests/test_confidence_signal.py, tests/test_checkov_adapter.py,
-tests/test_outbox_writer.py, tests/test_pipeline.py,
-.gitea/workflows/ci.yml, .github/workflows/ci.yml. **PASS.**
+All 14 new files present (kms-key primitive, uptime primitive, STANDARDS.md,
+3 READMEs, seed script, 4 test files). terraform/spike removed. Registry
+has 14 entries. **PASS.**
 
 ## Behavioral
-
-- `py_compile` passes on all Python files. **PASS.**
-- `pytest` — 90 tests, all passing, all offline (moto for DynamoDB
-  mocking). **PASS.**
-- `run_platform.sh --check-only` — exits 0, outputs
-  "PLATFORM CHECK OK", requires no AWS credentials. **PASS.**
-- `run_platform.sh --plan-only` — syntax valid (unchanged from phase 17).
-  **PASS.**
-- Both workflow YAMLs are valid YAML, parseable. **PASS.**
-- Workflows are byte-identical (diff confirms). **PASS.**
+- `pytest`: 350 tests, all passing (was 275 at v1.7 → 350 at v1.8, +75 new).
+- `run_ci.sh`: exits 0 with "CI PIPELINE OK".
+- `run_platform.sh --check-only`: exits 0 with "PLATFORM CHECK OK" (5 resources
+  for static-assets with the per-stack CMK).
+**PASS.**
 
 ## Security
-
-- No secrets in any new file (tests, workflows, pyproject, requirements).
-  **PASS.**
-- CI pipelines do not use any AWS credentials — `--check-only` is fully
-  offline. **PASS.**
+- No placeholder account ID in consumer_invoke_policy.json.
+- No hardcoded GitHub API URLs in contract_ingestor.py (uses GITHUB_API_BASE).
+- Deploy workflows byte-identical.
+- SSM fails loud without ACDL_KMS_KEY_ID (RuntimeError).
+- Deletion protection on by default for all primitives.
+- Encryption enabled by default for all primitives.
+**PASS.**
 
 ## Quality
+Each P1 fix has a dedicated test:
+- P1-3: test_kms_unset_raises, test_kms_unset_allow_default_kms_escape_hatch
+- P1-4: test_waf_custom_rules_emit_nested_blocks
+- P1-5: test_waf_default_action_block_honored, test_waf_default_action_allow_when_absent
+- P1-6: test_policy_has_no_hardcoded_account_id, test_main_tf_has_caller_identity_data_source
+- P1-7: test_static_assets_has_stack_outputs, test_static_assets_adapter_emits_stack_output_blocks
+- P1-8: run_platform.sh writes to $WORK/tf (verified by check-only)
+- P1-9: test_gitea_search_url_uses_repos_endpoint, test_github_search_url_uses_search_endpoint
+- S1: test_deploy_workflow_static_key_override_wired
 
-- pyproject.toml has pytest config (testpaths, markers, addopts).
-  **PASS.**
-- requirements-test.txt pins all test deps. **PASS.**
-- Test suite covers all 4 platform components (adapter, confidence
-  signal, checkov adapter, outbox writer) + pipeline integration.
-  **PASS.**
-- Both workflows run 3 stages: lint, test, check-only. **PASS.**
-- README updated with "Test the platform" section + CI/CD documentation.
-  **PASS.**
+Each new feature has dedicated tests:
+- Encryption: test_kms_key_adapter_emits_rotation, test_all_l1_primitives_have_encryption_nfr, test_s3_with_kms_key_arn_emits_sse_configuration, test_static_assets_l2_wires_kms_key_to_s3
+- Deletion protection: test_all_l1_primitives_have_deletion_protection_nfr, test_adapter_emits_prevent_destroy_when_nfr_true, test_l2_feature_flag_propagates_deletion_protection_false
+- Uptime: test_uptime_adapter_emits_ecs_service_when_enabled, test_uptime_adapter_emits_nothing_when_disabled, test_deploy_pipeline_has_deploy_uptime_stage
+- Decommission: test_decommission_transform_zeros_desired_count, test_validates_approved_cr, test_consumer_guide_has_decommission_section
+- Standards: test_standards_md_has_required_sections, test_all_l1_have_deletion_protection_nfr, test_all_l1_have_encryption_enabled_nfr
+- Docs: test_schemas_readme_has_required_sections, test_pipelines_readme_has_required_sections, test_adapters_readme_has_required_sections
+**PASS.**
 
 ## Verdict
 
-**VERIFY PASS** — all four layers pass. 90 offline tests, no AWS
-required for CI.
\ No newline at end of file
+**VERIFY PASS** — all four layers pass. 350 offline tests, no AWS required for CI.
\ No newline at end of file