feat(P22): rename static-asset→static-assets + cloudfront/waf primitives + production stack + @v1.6 bump

---ci---
phase: 22
title: rename-and-production-static-assets-stack
status: complete
verification:
  - scripts/run_ci.sh: PASS (CI PIPELINE OK)
  - python3 -m pytest tests/ -v: 175 passed
  - scripts/run_platform.sh --check-only: PASS (PLATFORM CHECK OK)
  - grep -R "static-asset[^s]" . (excl .git/): 0 hits
  - grep -R "static-asset$" . (excl .git/): 0 hits
  - floating git tags v1.6 + v1 point at v1.6.0 (a90a756)
changed_files:
  - Task 1 (rename): contracts/static-asset.yaml→static-assets.yaml (git mv); modules/l2/static-asset→static-assets (git mv); sed replaceAll static-asset→static-assets in 22 files (README, docs, scripts/run_platform.sh, pipelines/deploy.yaml, modules/registry.json, tests/*, .ciagent/* historical narrative)
  - Task 2 (cloudfront primitive): modules/l1/cloudfront/interface.json + README.md
  - Task 3 (waf primitive): modules/l1/waf/interface.json + README.md
  - Task 4 (registry): modules/registry.json (+cloudfront, +waf, static-assets renamed)
  - Task 5 (augment static-assets): modules/l2/static-assets/composition.json (s3+cloudfront+waf, depth 1); modules/l1/s3/interface.json +instance.json (+bucket_regional_domain_name output); modules/l2/static-assets/README.md (production stack docs)
  - Task 6 (adapter): adapters/terraform/adapter.py (+TYPE_MAP/INPUT_MAP/OUTPUT_MAP for cloudfront distribution+OAC+wafv2 webacl; special handling in _emit_resource for OAC defaults, distribution origin/cache_behavior/restrictions/viewer_certificate/web_acl_id, waf scope/default_action/visibility_config/managed rules)
  - Task 7 (contract schema): no change needed (generic inputs object; new module names match ^[a-z][a-z0-9-]*$)
  - Task 8 (@v1.6 bump): contracts/static-assets.yaml, .gitea/.github/workflows/deploy.yml (ref: v1.6 + header comments), docs/consumer-guide.md, docs/contracts/index.md, docs/pipeline/versioning.md, docs/pipeline/index.md, docs/architecture.md, README.md, modules/l2/microservice/README.md, tests/test_environment_check.py, tests/test_pipeline_contract.py
  - Task 9 (floating tags): git tag -f v1.6 v1.6.0; git tag -f v1 v1.6.0
  - Task 10 (tests): tests/test_adapter.py (registry 11 entries/9 L1/2 L2; cloudfront+waf type map tests; TestS3Output bucket_regional_domain_name; TestStaticAssetsStack 4 tests); tests/test_contract_resolver.py (+s3/cloudfront/waf resource assertions)
generated:
  - terraform/spike/main.tf + terraform.tf (regenerated by run_platform.sh --check-only; reflect static-assets production stack + backend key spike/static-assets/)
notes:
  - D-048 full rewrite of .ciagent/ historical narrative (verbatim phase descriptions, REQ-25/27/50, D-036) — produces intentional tautologies (e.g. "Rename static-assets → static-assets") per the decision to override the v1.6 preservation precedent.
  - cloudfront interface.json resources array ordered distribution-first so the resolver (first-match wire resolution) routes bucket_regional_domain_name/waf_web_acl_arn/region to the distribution; the OAC gets adapter-provided defaults (name=acdl-oac, origin_type=s3, signing_behavior=always).
  - .ciagent/ @v1.4 references left as historical record (D-048 scope was static-asset rename only; @v1.4 is historical narrative of Phase 20).
  - s3 OUTPUT_MAP bucket_regional_domain_name not added (identity fallback in adapt() already handles it; OUTPUT_MAP documents non-identity mappings only).
---ci---

terraform/spike/main.tf

@@ -12,3 +12,88 @@ output "bucket_arn" {
 output "bucket_name" {
   value = aws_s3_bucket.s3.id
 }
+
+output "bucket_regional_domain_name" {
+  value = aws_s3_bucket.s3.bucket_regional_domain_name
+}
+
+resource "aws_cloudfront_distribution" "cloudfront-distribution" {
+  origin {
+    domain_name = aws_s3_bucket.s3.bucket_regional_domain_name
+    origin_access_control = aws_cloudfront_origin_access_control.cloudfront-originaccesscontrol.id
+    s3_origin_config {}
+  }
+  enabled = true
+  default_cache_behavior {
+    viewer_protocol_policy = "redirect-to-https"
+    target_origin_id = "cloudfront-distribution"
+    min_ttl = 0
+    default_ttl = 3600
+    max_ttl = 86400
+    allowed_methods = ["GET", "HEAD"]
+    cached_methods = ["GET", "HEAD"]
+  }
+  price_class = "PriceClass_100"
+  restrictions {
+    geo_restriction {
+      restriction_type = "none"
+    }
+  }
+  viewer_certificate {
+    cloudfront_default_certificate = true
+  }
+  web_acl_id = aws_wafv2_web_acl.waf.arn
+}
+
+output "distribution_arn" {
+  value = aws_cloudfront_distribution.cloudfront-distribution.arn
+}
+
+output "distribution_domain_name" {
+  value = aws_cloudfront_distribution.cloudfront-distribution.domain_name
+}
+
+resource "aws_cloudfront_origin_access_control" "cloudfront-originaccesscontrol" {
+  name = "acdl-oac"
+  origin_access_control_origin_type = "s3"
+  origin_access_control_signing_behavior = "always"
+}
+
+output "oac_id" {
+  value = aws_cloudfront_origin_access_control.cloudfront-originaccesscontrol.id
+}
+
+resource "aws_wafv2_web_acl" "waf" {
+  name = "acdl-waf"
+  scope = "cloudfront"
+  default_action {
+    allow {}
+  }
+  visibility_config {
+    cloudwatch_metrics_enabled = true
+    metric_name = "acdl-waf-metrics"
+    sampled_requests_enabled = true
+  }
+  rules {
+    name = "aws-managed-rules"
+    priority = 0
+    override_action {
+      none {}
+    }
+    statement {
+      managed_rule_group_statement {
+        name = "AWSManagedRulesCommonRuleSet"
+        vendor_name = "AWS"
+      }
+    }
+    visibility_config {
+      cloudwatch_metrics_enabled = true
+      metric_name = "aws-managed-rules-metrics"
+      sampled_requests_enabled = true
+    }
+  }
+}
+
+output "web_acl_arn" {
+  value = aws_wafv2_web_acl.waf.arn
+}

terraform/spike/terraform.tf

@@ -8,7 +8,7 @@ terraform {
   }
   backend "s3" {
     bucket = "acdl-tfstate-581513795199-us-east-1"
-    key    = "spike/static-asset/terraform.tfstate"
+    key    = "spike/static-assets/terraform.tfstate"
     region = "us-east-1"
   }
 }