feat(P19): central pipeline contract + shell reproducibility + output streaming (v1.4.1)

---ci---
project: acdl
phase: 19
milestone: v1.4
status: execute
---

Add declarative pipeline contract (schemas/pipeline.schema.json +
pipelines/ci.yaml) as single source of truth for both Gitea Actions (dev)
and GitHub Actions (production) workflows. Both workflow files are
byte-identical and validated against the contract by 32 new tests.

Add scripts/run_ci.sh for shell reproducibility — mirrors the CI pipeline
locally (lint → test → check-only), exits 0 with 'CI PIPELINE OK'.

Update scripts/run_platform.sh to stream output by default: terraform
init/validate/plan via tee, Checkov compliance results with per-record
severity/rule/pass-fail, and emitted Terraform in --check-only. New
--quiet flag for log-only mode.

Requirements: REQ-43 (central pipeline contract), REQ-44 (shell
reproducibility), REQ-45 (output streaming). 122 tests pass (90 + 32).

.ciagent/ROADMAP.md

@@ -5,7 +5,8 @@
 - **v1.0 (demo):** complete — tag `v1.1.0`, 2026-07-21. All 5 phases shipped + audited PASS.
 - **v1.1 (complete):** architecture finalization + v1 spike. 5 phases (06–10). Tag `v1.2.0`, 2026-07-21. All 5 phases shipped + verified; review READY TO SHIP (0 P0); audit CLEAN. Gitea release id 202.
 - **v1.2 (complete):** platform hardening + first real consumer deployment. 6 phases (11–16). Tag `v1.3.0`, 2026-07-21. All 6 phases shipped + verified; review READY TO SHIP (1 P0 operator action, 1 P1 deferred); audit CLEAN.
-- **v1.3 (active):** module documentation + thin-composition removal. The L2 composition layer is removed; module READMEs are built out.
+- **v1.3 (complete):** module documentation + thin-composition removal. The L2 composition layer is removed; module READMEs are built out. Tag `v1.3.2`.
+- **v1.4 (active):** central pipeline contract + shell reproducibility + output streaming. A declarative pipeline contract (`schemas/pipeline.schema.json` + `pipelines/ci.yaml`) binds the Gitea and GitHub workflows to a single source of truth. `scripts/run_ci.sh` mirrors the CI pipeline locally. `scripts/run_platform.sh` streams terraform/checkov output by default.
 - **v1.0 demo URL:** https://git.cloudinit.dev/continuous-intelligence/acdl-evidence/raw/branch/main/index.html
 
 ---
@@ -221,7 +222,7 @@ After Phase 16: COMPLETE gate — review → ship `v1.3.0` → audit.
 
 ---
 
-## v1.3 (Active — module documentation + thin-composition removal)
+## v1.3 (Complete — module documentation + thin-composition removal)
 
 The v1.3 milestone starts with simplification: removing the unsatisfactory
 thin-composition layer and building out proper module documentation. The
@@ -249,4 +250,29 @@ L2 composition mechanism will be redesigned in a later phase.
   - `pytest` runs and passes offline (no AWS, no Checkov, no DynamoDB).
   - `run_platform.sh --check-only` runs offline and exits 0.
   - `.gitea/workflows/ci.yml` and `.github/workflows/ci.yml` exist with identical job stages (lint, test, check-only).
-  - `pyproject.toml` + `requirements-test.txt` pin test dependencies.
+  - `pyproject.toml` + `requirements-test.txt` pin test dependencies.
+
+After Phase 18: COMPLETE gate — review → ship `v1.3.2` → audit.
+
+---
+
+## v1.4 (Active — central pipeline contract + shell reproducibility + streaming)
+
+The v1.4 milestone makes the CI/CD pipeline a declarative contract rather
+than duplicated workflow copies, enables full shell reproducibility of the
+CI pipeline, and streams terraform/checkov output so users can see what
+the platform is doing.
+
+### Phase 19 — central-pipeline-contract-and-shell-reproducibility
+- **Description:** Create a central pipeline contract (`schemas/pipeline.schema.json` JSON Schema + `pipelines/ci.yaml` YAML instance) that both `.gitea/workflows/ci.yml` (Gitea Actions, dev) and `.github/workflows/ci.yml` (GitHub Actions, production) implement. Create `scripts/run_ci.sh` that mirrors the CI pipeline locally (lint → test → check-only). Update `scripts/run_platform.sh` to stream terraform init/validate/plan output, Checkov compliance results, and PolicyCheckResult records to stdout by default (with `--quiet` for log-only mode). Add `tests/test_pipeline_contract.py` validating the contract schema, workflow conformance, and run_ci.sh. Update both workflow YAMLs with contract reference headers (staying byte-identical).
+- **Status:** complete (v1.4.1)
+- **Depends on:** [18]
+- **Requirements:** REQ-43, REQ-44, REQ-45
+- **Success Criteria:**
+  - `pipelines/ci.yaml` validates against `schemas/pipeline.schema.json`.
+  - Both `.gitea/workflows/ci.yml` and `.github/workflows/ci.yml` are byte-identical.
+  - A test parses both workflows and asserts their stages/commands match the contract.
+  - `scripts/run_ci.sh` exits 0 and outputs "CI PIPELINE OK".
+  - `scripts/run_platform.sh --check-only` streams the emitted Terraform to stdout.
+  - `scripts/run_platform.sh --check-only --quiet` suppresses the Terraform stream.
+  - `pytest` total count increases from 90 to 122 (32 new contract/streaming tests).