feat(P56): IAM re-bootstrap live step — managed policy + OIDC role

D-095 RESOLVED. User provided fresh root credentials in .env.secrets;
the run resumed and applied the IAM baseline against account
581513795199.

Live actions (2026-07-28):
1. Converted spike_runner_policy.json from an inline user policy to a
   customer-managed policy acdl-spike-runner-policy (ARN
   arn:aws:iam::581513795199:policy/acdl-spike-runner-policy). The
   extended policy (5917 bytes) exceeded the 2048-byte inline limit;
   the managed-policy path supports 6144 bytes per version + 5
   versions. Inline policy deleted; managed policy attached.
2. Re-created the acdl-act-runner-role OIDC role (CAP-022 — was gone
   since Phase 08). Trust policy permits root assume until
   go-gitea/gitea#36988 merges real OIDC federation. Same managed
   policy attached so the runner inherits spike-runner-equivalent
   permissions, no long-lived key needed.

Grant verification (all OK):
- cloudfront:ListDistributions — OK (0 items, stacks not yet deployed)
- wafv2:ListWebAcls(CLOUDFRONT) — OK
- lambda:ListFunctions — OK
- dynamodb:DescribeTable(acdl-contracts) — ResourceNotFound (table not
  yet created — Phase 57 applies it; grant works, no AccessDenied)
- ce:GetCostAndUsage (7-day window) — OK (7 results — Phase 59 queries
  the full window)
- secretsmanager:ListSecrets — OK
- sns:ListTopics — OK
- iam:GetRole(acdl-act-runner-role) — OK

terraform/bootstrap/apply_iam_baseline.py — new idempotent script that
records the live step (create/version managed policy, attach to user +
role, delete leftover inline, ensure runner role). Re-ran to confirm
idempotency (created v2, deleted v1).

.ciagent/IAM_POLICY.md — updated with the managed-policy note, the
OIDC role ARN + trust policy, the grant verification table, and the
D-095 resolution note.

terraform/bootstrap/README.md — added the v1.11 Phase 56 section
documenting apply_iam_baseline.py.

Baseline test: 15/15 pass.

---ci---
project: acdl
phase: 56
milestone: v1.11
status: execute
escalation:
  type: deploy
  id: D-095
  status: resolved
  resolved_at: 2026-07-28
  resolution: user provided fresh root credentials in .env.secrets;
    managed policy applied + OIDC role re-created
---/ci---

.ciagent/IAM_POLICY.md

@@ -1,7 +1,11 @@
 # ACDL — IAM Policy Baseline (v1.11, REQ-116)
 
 > Source of truth: `terraform/bootstrap/spike_runner_policy.json`.
+> Applied as: customer-managed policy `acdl-spike-runner-policy`
+> (ARN `arn:aws:iam::581513795199:policy/acdl-spike-runner-policy`), v1.
 > Regression-tested by: `tests/test_iam_policy_baseline.py` (Phase 56).
+> Applied: 2026-07-28, Phase 56 live step (D-095 resolved — fresh root
+> key provided by the user).
 
 The `acdl-spike-runner` IAM user is the principal that runs the ACDL
 platform pipeline (plan + apply) against account `581513795199`. This
@@ -10,6 +14,18 @@ minimum required for the v1.11 milestone (Operating Model + Deploy
 Verification, REQ-116..122). Any future grant must be documented here
 and covered by the baseline test.
 
+> **Managed-policy note (v1.11 Phase 56).** The original v1.1 bootstrap
+> applied this policy as an inline user policy
+> (`iam:put_user_policy`). The v1.11 extension grew the policy document
+> beyond the 2048-byte inline limit (5917 bytes), so Phase 56 converted
+> it to a customer-managed policy (`iam:create_policy` + `attach_user_policy`)
+> with the same name `acdl-spike-runner-policy`. The managed-policy path
+> supports 6144 bytes per version + up to 5 versions, leaving room for
+> future growth. The inline policy was deleted after the managed policy
+> was attached. The same managed policy is also attached to the
+> `acdl-act-runner-role` (CAP-022) so the OIDC runner inherits the
+> spike-runner-equivalent permissions once act_runner adoption lands.
+
 ## Original grants (v1.1–v1.10)
 
 | Capability | Actions | Resource scope |
@@ -53,6 +69,47 @@ bootstrap root key; the runner then assumes the role.
 > REQUIREMENTS.md §Out of Scope v1.11). The role exists so the
 > spike-runner can be rotated out once Gitea merges OIDC support.
 
+## OIDC act_runner role (CAP-022, Phase 56 — re-created 2026-07-28)
+
+The OIDC role for the Gitea `act_runner` was planned in Phase 08 but
+never created (the spike used a long-lived key per D-039 waiver).
+CAPABILITY_INVENTORY.md CAP-022 recorded "iam:ListRoles shows no acdl*
+roles." Phase 56 re-created the role:
+
+- **Role name:** `acdl-act-runner-role`
+- **ARN:** `arn:aws:iam::581513795199:role/acdl-act-runner-role`
+- **Trust policy (v1):** permits `arn:aws:iam::581513795199:root` to
+  assume the role (`sts:AssumeRole`). This is the bootstrap trust —
+  once go-gitea/gitea#36988 merges real OIDC federation, the trust
+  policy is updated to the Gitea OIDC provider ARN + the runner's
+  subject claim.
+- **Attached policy:** `acdl-spike-runner-policy` (the same managed
+  policy the spike-runner user uses) — so the runner inherits the
+  spike-runner-equivalent permissions, no long-lived key needed.
+- **Tags:** `Project=acdl`, `Capability=CAP-022`, `Milestone=v1.11`,
+  `ManagedBy=ciagent`.
+
+> **Note:** Real OIDC federation (D-039) is blocked on
+> `go-gitea/gitea#36988`. Phase 56 re-creates the IAM role + trust
+> policy; act_runner adoption is out of scope for v1.11 (see
+> REQUIREMENTS.md §Out of Scope v1.11). The role exists so the
+> spike-runner can be rotated out once Gitea merges OIDC support.
+
+## Grant verification (Phase 56 live step, 2026-07-28)
+
+All new grants verified effective against account 581513795199:
+
+| Service | Verification | Result |
+|---------|-------------|--------|
+| CloudFront | `list_distributions` | OK (0 items — stacks not yet deployed) |
+| WAFv2 | `list_web_acls(CLOUDFRONT)` | OK (0 items) |
+| Lambda | `list_functions` | OK (0 items) |
+| DynamoDB `acdl-contracts` | `describe_table` | ResourceNotFound (table not yet created — Phase 57 applies it; grant works, no AccessDenied) |
+| Cost Explorer | `get_cost_and_usage` (7-day window) | OK (7 results — Phase 59 queries the full window) |
+| Secrets Manager | `list_secrets` | OK (0 items) |
+| SNS | `list_topics` | OK (0 items) |
+| IAM OIDC role | `get_role(acdl-act-runner-role)` | OK (ARN confirmed) |
+
 ## Least-privilege scoping notes
 
 - **CloudFront/WAF/KMS/CE/OIDC use `Resource: "*"`** because these
@@ -72,11 +129,12 @@ bootstrap root key; the runner then assumes the role.
   scoped to `iam::581513795199:*` (account roles only); the v1.11
   grant does not extend it.
 
-## Escalation (D-095)
+## Escalation (D-095 — resolved 2026-07-28)
 
-Applying this policy requires the bootstrap root key
-(`ACDL_BOOTSTRAP_AWS_*`). If the key is invalid (D-034 closed the
-original root key), the run escalates to human for fresh access keys
-— no silent fallback to the deck-marking path. The escalation is
-committed as a `---ci---` block with `escalation` type and the run
-pauses for the user.
+Applying this policy required the bootstrap root key
+(`ACDL_BOOTSTRAP_AWS_*`). The original root key was closed (D-034).
+Per D-095 (user-confirmed: escalate to human for fresh access keys, no
+silent fallback), the run paused at Phase 56 live step. The user
+provided fresh root credentials in `.env.secrets`; the run resumed and
+applied the managed policy + re-created the OIDC role. D-095 is
+resolved.