feat(P22): rename static-asset→static-assets + cloudfront/waf primitives + production stack + @v1.6 bump

---ci---
phase: 22
title: rename-and-production-static-assets-stack
status: complete
verification:
  - scripts/run_ci.sh: PASS (CI PIPELINE OK)
  - python3 -m pytest tests/ -v: 175 passed
  - scripts/run_platform.sh --check-only: PASS (PLATFORM CHECK OK)
  - grep -R "static-asset[^s]" . (excl .git/): 0 hits
  - grep -R "static-asset$" . (excl .git/): 0 hits
  - floating git tags v1.6 + v1 point at v1.6.0 (a90a756)
changed_files:
  - Task 1 (rename): contracts/static-asset.yaml→static-assets.yaml (git mv); modules/l2/static-asset→static-assets (git mv); sed replaceAll static-asset→static-assets in 22 files (README, docs, scripts/run_platform.sh, pipelines/deploy.yaml, modules/registry.json, tests/*, .ciagent/* historical narrative)
  - Task 2 (cloudfront primitive): modules/l1/cloudfront/interface.json + README.md
  - Task 3 (waf primitive): modules/l1/waf/interface.json + README.md
  - Task 4 (registry): modules/registry.json (+cloudfront, +waf, static-assets renamed)
  - Task 5 (augment static-assets): modules/l2/static-assets/composition.json (s3+cloudfront+waf, depth 1); modules/l1/s3/interface.json +instance.json (+bucket_regional_domain_name output); modules/l2/static-assets/README.md (production stack docs)
  - Task 6 (adapter): adapters/terraform/adapter.py (+TYPE_MAP/INPUT_MAP/OUTPUT_MAP for cloudfront distribution+OAC+wafv2 webacl; special handling in _emit_resource for OAC defaults, distribution origin/cache_behavior/restrictions/viewer_certificate/web_acl_id, waf scope/default_action/visibility_config/managed rules)
  - Task 7 (contract schema): no change needed (generic inputs object; new module names match ^[a-z][a-z0-9-]*$)
  - Task 8 (@v1.6 bump): contracts/static-assets.yaml, .gitea/.github/workflows/deploy.yml (ref: v1.6 + header comments), docs/consumer-guide.md, docs/contracts/index.md, docs/pipeline/versioning.md, docs/pipeline/index.md, docs/architecture.md, README.md, modules/l2/microservice/README.md, tests/test_environment_check.py, tests/test_pipeline_contract.py
  - Task 9 (floating tags): git tag -f v1.6 v1.6.0; git tag -f v1 v1.6.0
  - Task 10 (tests): tests/test_adapter.py (registry 11 entries/9 L1/2 L2; cloudfront+waf type map tests; TestS3Output bucket_regional_domain_name; TestStaticAssetsStack 4 tests); tests/test_contract_resolver.py (+s3/cloudfront/waf resource assertions)
generated:
  - terraform/spike/main.tf + terraform.tf (regenerated by run_platform.sh --check-only; reflect static-assets production stack + backend key spike/static-assets/)
notes:
  - D-048 full rewrite of .ciagent/ historical narrative (verbatim phase descriptions, REQ-25/27/50, D-036) — produces intentional tautologies (e.g. "Rename static-assets → static-assets") per the decision to override the v1.6 preservation precedent.
  - cloudfront interface.json resources array ordered distribution-first so the resolver (first-match wire resolution) routes bucket_regional_domain_name/waf_web_acl_arn/region to the distribution; the OAC gets adapter-provided defaults (name=acdl-oac, origin_type=s3, signing_behavior=always).
  - .ciagent/ @v1.4 references left as historical record (D-048 scope was static-asset rename only; @v1.4 is historical narrative of Phase 20).
  - s3 OUTPUT_MAP bucket_regional_domain_name not added (identity fallback in adapt() already handles it; OUTPUT_MAP documents non-identity mappings only).
---ci---

adapters/terraform/adapter.py

@@ -36,6 +36,9 @@ TYPE_MAP = {
     "aws:elbv2:listener": "aws_lb_listener",
     "aws:elbv2:targetgroup": "aws_lb_target_group",
     "aws:ecr:repository": "aws_ecr_repository",
+    "aws:cloudfront:distribution": "aws_cloudfront_distribution",
+    "aws:cloudfront:originaccesscontrol": "aws_cloudfront_origin_access_control",
+    "aws:wafv2:webacl": "aws_wafv2_web_acl",
 }
 
 # Stack input name -> Terraform arg name, per stack type. Only non-identity
@@ -54,6 +57,9 @@ INPUT_MAP = {
     "aws:elbv2:listener": {},
     "aws:elbv2:targetgroup": {"port": "port", "protocol": "protocol"},
     "aws:ecr:repository": {},
+    "aws:cloudfront:distribution": {"bucket_regional_domain_name": "origin_domain_name", "price_class": "price_class", "viewer_protocol_policy": "viewer_protocol_policy", "default_ttl": "default_ttl", "max_ttl": "max_ttl", "waf_web_acl_arn": "web_acl_id"},
+    "aws:cloudfront:originaccesscontrol": {"name": "name", "origin_type": "origin_access_control_origin_type", "signing_behavior": "origin_access_control_signing_behavior"},
+    "aws:wafv2:webacl": {"name": "name", "scope": "scope", "default_action": "default_action", "rules": "rules"},
 }
 
 # Stack output name -> Terraform attribute name, per stack type. Only
@@ -72,6 +78,9 @@ OUTPUT_MAP = {
     "aws:elbv2:listener": {"listener_arn": "id"},
     "aws:elbv2:targetgroup": {"target_group_arn": "arn"},
     "aws:ecr:repository": {"repository_arn": "arn"},
+    "aws:cloudfront:distribution": {"distribution_arn": "arn", "distribution_domain_name": "domain_name", "oac_id": "origin_access_control_id"},
+    "aws:cloudfront:originaccesscontrol": {"oac_id": "id"},
+    "aws:wafv2:webacl": {"web_acl_arn": "arn"},
 }
 
 
@@ -185,6 +194,23 @@ def _emit_resource(resource, type_by_id=None):
         if rtype == "aws:ecs:service" and in_name in ("subnets", "security_group"):
             # Collected into network_configuration block (emitted after all inputs).
             continue
+        if rtype == "aws:cloudfront:distribution" and in_name in (
+            "bucket_regional_domain_name", "price_class", "viewer_protocol_policy",
+            "default_ttl", "max_ttl", "waf_web_acl_arn", "oac_id",
+        ):
+            # Collected into the origin/default_cache_behavior/web_acl_id blocks
+            # emitted after all inputs.
+            continue
+        if rtype == "aws:cloudfront:originaccesscontrol" and in_name in (
+            "name", "origin_type", "signing_behavior",
+        ):
+            # Defaults emitted after all inputs.
+            continue
+        if rtype == "aws:wafv2:webacl" and in_name in (
+            "name", "scope", "default_action", "rules",
+        ):
+            # Structured blocks emitted after all inputs.
+            continue
         body.append(f"{arg} = {_value_expr(value, type_by_id)}")
     if rtype == "aws:ecs:service":
         subnets_val = inputs.get("subnets")
@@ -246,6 +272,96 @@ def _emit_resource(resource, type_by_id=None):
         body.append("tags = {")
         body.append('  Name = "acdl-microservice-rt"')
         body.append("}")
+    if rtype == "aws:cloudfront:originaccesscontrol":
+        name = inputs.get("name", "acdl-oac")
+        if isinstance(name, str) and name.startswith("ref:"):
+            name = _ref_expr(name, type_by_id)
+        else:
+            name = _tf_value(name)
+        body.append(f"name = {name}")
+        body.append("origin_access_control_origin_type = \"s3\"")
+        body.append("origin_access_control_signing_behavior = \"always\"")
+    if rtype == "aws:cloudfront:distribution":
+        origin_domain = inputs.get("bucket_regional_domain_name")
+        if isinstance(origin_domain, str) and origin_domain.startswith("ref:"):
+            origin_domain = _ref_expr(origin_domain, type_by_id)
+        else:
+            origin_domain = _tf_value(origin_domain)
+        # The OAC resource id follows the convention "<childId>-originaccesscontrol";
+        # derive it from this distribution's id.
+        if rid.endswith("-distribution"):
+            oac_rid = rid[: -len("distribution")] + "originaccesscontrol"
+        else:
+            oac_rid = "cloudfront-originaccesscontrol"
+        body.append("origin {")
+        body.append(f"  domain_name = {origin_domain}")
+        body.append(f"  origin_access_control = aws_cloudfront_origin_access_control.{oac_rid}.id")
+        body.append("  s3_origin_config {}")
+        body.append("}")
+        body.append("enabled = true")
+        price_class = inputs.get("price_class", "PriceClass_100")
+        vpp = inputs.get("viewer_protocol_policy", "redirect-to-https")
+        default_ttl = inputs.get("default_ttl", 3600)
+        max_ttl = inputs.get("max_ttl", 86400)
+        body.append("default_cache_behavior {")
+        body.append(f"  viewer_protocol_policy = {_value_expr(vpp, type_by_id)}")
+        body.append(f"  target_origin_id = {_tf_value(rid)}")
+        body.append("  min_ttl = 0")
+        body.append(f"  default_ttl = {_value_expr(default_ttl, type_by_id)}")
+        body.append(f"  max_ttl = {_value_expr(max_ttl, type_by_id)}")
+        body.append("  allowed_methods = [\"GET\", \"HEAD\"]")
+        body.append("  cached_methods = [\"GET\", \"HEAD\"]")
+        body.append("}")
+        body.append(f"price_class = {_value_expr(price_class, type_by_id)}")
+        body.append("restrictions {")
+        body.append("  geo_restriction {")
+        body.append("    restriction_type = \"none\"")
+        body.append("  }")
+        body.append("}")
+        body.append("viewer_certificate {")
+        body.append("  cloudfront_default_certificate = true")
+        body.append("}")
+        waf_arn = inputs.get("waf_web_acl_arn")
+        if waf_arn is not None:
+            if isinstance(waf_arn, str) and waf_arn.startswith("ref:"):
+                waf_expr = _ref_expr(waf_arn, type_by_id)
+            else:
+                waf_expr = _tf_value(waf_arn)
+            body.append(f"web_acl_id = {waf_expr}")
+    if rtype == "aws:wafv2:webacl":
+        name = inputs.get("name", "acdl-waf")
+        body.append(f"name = {_tf_value(name) if not isinstance(name, str) or not name.startswith('ref:') else _ref_expr(name, type_by_id)}")
+        body.append("scope = \"cloudfront\"")
+        body.append("default_action {")
+        body.append("  allow {}")
+        body.append("}")
+        body.append("visibility_config {")
+        body.append("  cloudwatch_metrics_enabled = true")
+        body.append("  metric_name = \"acdl-waf-metrics\"")
+        body.append("  sampled_requests_enabled = true")
+        body.append("}")
+        rules_input = inputs.get("rules")
+        if rules_input:
+            body.append(f"rules = {_value_expr(rules_input, type_by_id)}")
+        else:
+            body.append("rules {")
+            body.append("  name = \"aws-managed-rules\"")
+            body.append("  priority = 0")
+            body.append("  override_action {")
+            body.append("    none {}")
+            body.append("  }")
+            body.append("  statement {")
+            body.append("    managed_rule_group_statement {")
+            body.append("      name = \"AWSManagedRulesCommonRuleSet\"")
+            body.append("      vendor_name = \"AWS\"")
+            body.append("    }")
+            body.append("  }")
+            body.append("  visibility_config {")
+            body.append("    cloudwatch_metrics_enabled = true")
+            body.append("    metric_name = \"aws-managed-rules-metrics\"")
+            body.append("    sampled_requests_enabled = true")
+            body.append("  }")
+            body.append("}")
     return _resource_block(rid, tf_type, body)