feat(P19): central pipeline contract + shell reproducibility + output streaming (v1.4.1)

---ci---
project: acdl
phase: 19
milestone: v1.4
status: execute
---

Add declarative pipeline contract (schemas/pipeline.schema.json +
pipelines/ci.yaml) as single source of truth for both Gitea Actions (dev)
and GitHub Actions (production) workflows. Both workflow files are
byte-identical and validated against the contract by 32 new tests.

Add scripts/run_ci.sh for shell reproducibility — mirrors the CI pipeline
locally (lint → test → check-only), exits 0 with 'CI PIPELINE OK'.

Update scripts/run_platform.sh to stream output by default: terraform
init/validate/plan via tee, Checkov compliance results with per-record
severity/rule/pass-fail, and emitted Terraform in --check-only. New
--quiet flag for log-only mode.

Requirements: REQ-43 (central pipeline contract), REQ-44 (shell
reproducibility), REQ-45 (output streaming). 122 tests pass (90 + 32).

.ciagent/PROJECT.md

@@ -84,7 +84,7 @@ id 202 published. D-034 closed (root key deactivated by user).**
 Milestone COMPLETE gate: review → ship `v1.2.0` (feature milestone, next
 minor per ship.md) → audit. **DONE.**
 
-## Objective for Milestone v1.2 (active)
+## Objective for Milestone v1.2 (prior — complete)
 
 Platform hardening + first real consumer deployment. The v1.1 spike proved
 the IR commitments hold on a single dev-only `terraform plan` for one S3
@@ -133,6 +133,40 @@ microservice), not just a plan.
 Milestone COMPLETE gate: review → ship `v1.3.0` (feature milestone, next
 minor per ship.md — v1.1 shipped `v1.2.0`) → audit.
 
+## Objective for Milestone v1.4 (active)
+
+Central pipeline contract + shell reproducibility + output streaming. The
+v1.3 milestone (Phases 17–18) created identical CI/CD pipelines for Gitea
+and GitHub but they were duplicated copies with no single source of truth.
+v1.4 makes the pipeline a declarative contract, enables full shell
+reproducibility, and streams terraform/checkov output so users can see
+what the platform is doing.
+
+Three scope axes:
+
+1. **Central pipeline contract.** A JSON Schema
+   (`schemas/pipeline.schema.json`) + YAML instance (`pipelines/ci.yaml`)
+   declares the pipeline stages, commands, triggers, and runner. Both
+   `.gitea/workflows/ci.yml` (Gitea Actions, dev) and
+   `.github/workflows/ci.yml` (GitHub Actions, production) implement the
+   contract. A test validates conformance.
+2. **Shell reproducibility.** `scripts/run_ci.sh` mirrors the CI pipeline
+   locally — runs the same 3 stages (lint, test, check-only) in sequence.
+   The pipeline is fully reproducible from the shell, not just in CI.
+3. **Output streaming.** `scripts/run_platform.sh` streams terraform
+   init/validate/plan output, Checkov compliance results, and
+   PolicyCheckResult records to stdout by default, so the user sees what
+   is happening. A `--quiet` flag suppresses streaming for log-only mode.
+
+## Milestone v1.4 Phases
+
+| Phase | Name | Goal |
+|-------|------|------|
+| 19 | central-pipeline-contract-and-shell-reproducibility | Create the central pipeline contract (JSON Schema + YAML instance). Create `scripts/run_ci.sh` for shell reproducibility. Update `run_platform.sh` to stream terraform/checkov output. Update both workflow YAMLs with contract references (staying byte-identical). Add tests for contract validation, workflow conformance, and streaming. |
+
+Milestone COMPLETE gate: review → ship `v1.4.1` (feature milestone, next
+minor per ship.md — v1.3 shipped `v1.3.2`) → audit.
+
 ## Requirements
 
 ### v1.0 (Prior milestone — the demo)
@@ -168,7 +202,7 @@ New requirements REQ-16..REQ-28 — see `REQUIREMENTS.md` §v1.1. Summary:
 - **REQ-28:** Spike verification proves the IR-shaped commitments hold (no
   polyglot mess; the adapter is the only substrate-specific code).
 
-### v1.2 (Active milestone — platform hardening + first real consumer deployment)
+### v1.2 (Prior milestone — platform hardening + first real consumer deployment, complete)
 
 New requirements REQ-29..REQ-35 — see `REQUIREMENTS.md` §v1.2. Summary:
 
@@ -189,6 +223,18 @@ New requirements REQ-29..REQ-35 — see `REQUIREMENTS.md` §v1.2. Summary:
 - **REQ-35:** End-to-end verification — consumer commit → live ECS service
   (HTTP 200) → evidence event → timeline.
 
+### v1.4 (Active milestone — central pipeline contract + shell reproducibility + streaming)
+
+New requirements REQ-43..REQ-45 — see `REQUIREMENTS.md` §v1.4. Summary:
+
+- **REQ-43:** Central pipeline contract — `schemas/pipeline.schema.json` +
+  `pipelines/ci.yaml`. Both Gitea and GitHub workflows implement the
+  contract; a test validates conformance.
+- **REQ-44:** `scripts/run_ci.sh` mirrors the CI pipeline locally (lint →
+  test → check-only), exiting 0 with "CI PIPELINE OK".
+- **REQ-45:** `scripts/run_platform.sh` streams terraform/checkov output by
+  default (with `--quiet` for log-only mode). Both workflows byte-identical.
+
 ## Constraints
 
 - **Forge:** Gitea at `https://git.cloudinit.dev`, org `continuous-intelligence`.