feat(P19): central pipeline contract + shell reproducibility + output streaming (v1.4.1)

---ci---
project: acdl
phase: 19
milestone: v1.4
status: execute
---

Add declarative pipeline contract (schemas/pipeline.schema.json +
pipelines/ci.yaml) as single source of truth for both Gitea Actions (dev)
and GitHub Actions (production) workflows. Both workflow files are
byte-identical and validated against the contract by 32 new tests.

Add scripts/run_ci.sh for shell reproducibility — mirrors the CI pipeline
locally (lint → test → check-only), exits 0 with 'CI PIPELINE OK'.

Update scripts/run_platform.sh to stream output by default: terraform
init/validate/plan via tee, Checkov compliance results with per-record
severity/rule/pass-fail, and emitted Terraform in --check-only. New
--quiet flag for log-only mode.

Requirements: REQ-43 (central pipeline contract), REQ-44 (shell
reproducibility), REQ-45 (output streaming). 122 tests pass (90 + 32).

.ciagent/ARCHITECTURE.md

@@ -1,323 +1,378 @@
-# ACDL — Architecture (initial)
+# ACDL — Architecture (v1.1 target)
 
-> Initial architecture for the ACDL demo. May be incomplete; refined at phase boundaries.
+> Target architecture for the real Agentic Cloud Delivery Platform.
+> Source of truth for **how**: `docs/architecture.md` (v0.2) is the upstream
+> draft; this file is the ACDL-repo operating copy, refined at phase
+> boundaries. Where this file and `docs/vision.md` conflict, the vision wins.
+
+## Status
+
+Architecture is at **v0.2** upstream (`docs/architecture.md`). Milestone v1.1
+**finalizes it to v1.0** in Phase 07 by resolving the 11 open decisions
+(see `PROJECT.md` open-decision resolutions table). This file records the
+locked commitments and the v1.1 spike scope.
 
 ## Overview
 
-The demo is a three-repo, stub-driven system that simulates an autonomous cloud delivery platform. No real cloud or AI is used; every "infrastructure" action is a bash/Python stub that emits structured evidence. The platform is driven by either a developer-supplied `contract.yaml` (L3A) or a natural-language GitHub Issue parsed by a keyword script (L3B), then flows through an autonomous Dev stage, manual QA and Prod approval gates, and finally publishes a hash-chained audit trail to a Pages site.
+The platform is **four layers + six cross-cutting concerns**. The sixth
+concern — the substrate abstraction (§12) — is first-class, not an
+implementation detail. The vision's "Two Consumer Surfaces, One Platform"
+tenet binds everything: L3A and L3B converge on the same contract schema,
+the same policy envelope, and the same evidence stream.
 
 ```
-                 ┌──────────────── acdl-contracts ─────────────────┐
-  Developer ───▶ │ commit contract.yaml      Issue (NL intent)     │
-                 └────────────┬───────────────────┬────────────────┘
-                              │ (push)            │ (issue opened)
-                              ▼                   ▼
-                    ┌─────────────────┐  ┌──────────────────────┐
-                    │ reusable        │  │ issue workflow →      │
-                    │ pipeline        │  │ l3b_agent_stub.py →   │
-                    │ (acdl repo)     │  │ contract.yaml → push  │
-                    └────────┬────────┘  └──────────────────────┘
-                             │
-        ┌────────────────────┼────────────────────┐
-        ▼                    ▼                    ▼
-  Dev (autonomous)     QA (approval)        Prod (approval)
-  mock_executor.sh     environment gate     environment gate
-  policy_checker.py
-  confidence_signal.py
+                  ┌──────────── acdl-contracts ────────────┐
+  Developer ───▶  │ commit contract.yaml                   │   (L3A)
+  Citizen dev ──▶ │ Issue → agent → contract.yaml            │   (L3B)
+                  └────────────────┬───────────────────────┘
+                                   │ (push)
+                                   ▼
+                         ┌──────────────────────┐
+                         │ central pipeline      │
+                         │ (acdl repo, Gitea      │
+                         │  Actions / act_runner) │
+                         └────────┬─────────────┘
+                                  │
+        ┌─────────────────────────┼─────────────────────────┐
+        ▼                         ▼                           ▼
+  contract→IR resolution   policy (Checkov/Kyverno)    confidence signal
+        │                         │                           │
+        ▼                         ▼                           ▼
+  Terraform adapter ──▶ terraform plan ──▶ PolicyCheckResult ──▶ {score,band}
+        │                                                                │
+        ▼                                                                ▼
+  dev (autonomous, ≥0.50)   qa (HITL, ≥0.75)   prod (HITL, ≥0.90)   dr (HITL, ≥0.95)
         │
         ▼
-  evidence_writer.py ──▶ audit.json (hash-chained) ──▶ acdl-evidence
-                                                          │
-                                                          ▼
-                                                   index.html (Pages)
-                                                   timeline UI
+  DynamoDB outbox ──▶ S3 Object Lock (7-yr, source of truth) ──▶ GitHub audit repo (hot index)
+        │
+        ▼
+  acdl-evidence (timeline UI)
 ```
 
-## Components
+## Layers
 
-| Name | Description | Boundaries | Depends On |
-|------|-------------|-----------|------------|
-| `acdl` repo | Platform meta repo: reusable workflows, L1/L2 stub modules, core scripts | Owns workflows + stubs; does not hold contracts or evidence | — |
-| L1 modules | Single-purpose infra primitives (EKS Fargate, IAM, Lambda, API Gateway, EventBridge, SQS, S3, CloudWatch) | One folder per L1; `manifest.yaml` + `mock_apply.sh`; do not compose with other L1s | `acdl` repo |
-| L2 modules | Composed stacks (invoice, commodity-price-feed, energy-analytics-api, regulatory-reporting) | Reference L1s by name; max depth 5; expressed as a composition manifest | L1 modules |
-| `mock_executor.sh` | Reads an L2 composition, invokes each L1 `mock_apply.sh`, writes `state.json` | Bash; reads L2 manifest + L1 manifests | L1/L2 modules |
-| `policy_checker.py` | Reads `contract.yaml`; fails on forbidden keys (e.g. `public-ingress: true`) | Python; emits `POLICY_VIOLATION:<REASON>` or pass | contract.yaml |
-| `confidence_signal.py` | Base 0.90; on policy failure drops to 0.40 and echoes reason | Python; calls policy_checker | policy_checker.py |
-| `evidence_writer.py` | Appends an event to `audit.json`, links to previous event via SHA-256 chain | Python; canonical-JSON hashing | audit.json |
-| `l3b_agent_stub.py` | Parses Issue text by keywords, emits `contract.yaml` | Python keyword map; no external APIs | contract.yaml schema |
-| `acdl-contracts` repo | Developer + agentic entry surface; holds contracts + issue workflow | Triggers main pipeline on push | `acdl` reusable workflow |
-| `acdl-evidence` repo | Pages host for `audit.json` + `index.html` timeline | Read-only for the pipeline; written at finalize stage | evidence_writer.py output |
-| Reusable pipeline workflow | Dev → QA → Prod → Finalize stages with environment gates | Gitea Actions; calls core scripts | All core scripts |
-| `evidence-ui/index.html` | Vanilla-JS timeline UI (Phase 05); fetches `./audit.json` and renders events | Single HTML file with inline CSS+JS; no frameworks (REQ-14) | `audit.json` on `acdl-evidence` main |
-| `scripts/run_demo.sh` | Phase 05 dry-run simulation of the 4 demo acts; calls core scripts + writes evidence + uploads `audit.json` + `index.html` to `acdl-evidence` | Bash; uses `evidence_writer.py` + `finalize_evidence.py` + the file-contents API | All Phase 03/04 artifacts |
+### Layer 1 — Foundational Primitives
+Single-purpose, **substrate-agnostic** primitive modules. L1 modules do
+not compose with other L1s; L1 takes its environment as input. The L1
+interface is defined against the **Target Stack IR**, not against Terraform
+directly (the IR is shaped to round-trip to Terraform in v1, per §12.1).
 
-## Phase 04 pipeline topology (research)
+- No inter-L1 references. L1 may call Terraform data sources.
+- Semver: interface → MAJOR, behavior → MINOR, lifecycle → PATCH (W3.D).
+- Immutability on publication. 12-month deprecation window.
+- AI refinement is a flag; the trigger is the W1.A joint condition.
 
-Gitea Actions limitations (confirmed via research, supersedes any
-GitHub-Actions assumptions):
+### Layer 2 — Composed Stacks
+Combine L1 primitives into deployable shapes. Each codebase maps to one
+canonical L2 stack (`multiStack: true` only per W1.B). Shape X
+(parameterized module) or Shape Y (thin-composition layer). Hierarchical
+composition, max depth 5, only registered L1s. The thin-composition tree's
+`wires` field is defined against the IR's relationship type, not a Terraform
+module block.
 
-- `actions/upload-artifact@v3` / `download-artifact@v3` work; v4 is NOT supported by act_runner.
-- Artifacts are scoped to a single workflow run; **re-dispatch starts a new run, so artifacts do NOT survive between dispatches**.
-- `workflow_dispatch` API: `POST /api/v1/repos/{owner}/{repo}/actions/workflows/{filename}.yml/dispatches` with body `{ "ref": "<branch>", "inputs": {...} }`.
-- `on: workflow_call` + `uses: <owner>/<repo>/.gitea/workflows/<file>@<ref>` works; pin to `@milestone/v1.0-initial`.
-- `actions/checkout@v4` supports cross-repo (pass `repository:` + `ref:` + `token: ${{ secrets.GITEA_TOKEN }}` for private repos).
-- File-contents API: POST to create (201), PUT to update (must include current `sha`, obtained via GET).
-- `${{ secrets.GITEA_TOKEN }}` is a manually-created PAT secret on the `acdl` + `acdl-contracts` repos; the auto-injected token is current-repo only and cannot cross-repo.
-- No native approval-gate UI; gates are `workflow_dispatch` inputs (`approve_qa`, `approve_prod`).
+Pipeline quality checks: secrets-in-plaintext, public ingress, IAM
+wildcard, KMS key reference, tag compliance, naming convention. Restricted
+from thin-composition: IAM principal creation, network boundary creation,
+key/secret creation, external data transfer. Auto-promote after 3 observed
+usages.
 
-### Approval-gate + state-persistence approach (D-027, D-028 refined)
+### Layer 3A — Developer Consumer Surface
+Tag-based reference to the central pipeline template. Developer-owned
+workflow file, no platform auto-sync. L3A and L3B are parallel paths, not a
+progression. **W2.A (Path B):** tag for dev/qa, SHA for prod; platform CLI
+resolves tag→SHA for prod-bound workflows.
 
-Because re-dispatch starts a new run and artifacts do not survive:
+### Layer 3B — Agentic Consumer Surface
+Hybrid runtime, skill as markdown, agent as executor. Trust model: trust
+and always verify on the platform side. Skill envelope (4 dimensions).
+Stateless agents, all state in the platform. `profile: agentic` marker
+unlocks `naturalLanguageIntent`, `confidenceAtSubmission`, `agentTrace`.
+Initial skill catalog (BA.A): web API, worker, scheduled job, static asset,
+basic observability bootstrap.
 
-1. The pipeline workflow has `workflow_dispatch` inputs:
-   - `contract-ref` (string; default `main`) — the ref on `acdl-contracts` carrying the contract.
-   - `approve_qa` (boolean; default `false`) — the human sets this to `true` to advance past QA.
-   - `approve_prod` (boolean; default `false`) — the human sets this to `true` to advance past Prod.
+Environment progression:
 
-2. Each stage job (`dev`, `qa-gate`, `prod-gate`, `finalize`) writes its evidence to `acdl-evidence` via the file-contents API (PUT `audit.json` with the new event appended). This is the persistent state across re-dispatches.
+| Environment | Autonomy | Attester | Gate |
+|---|---|---|---|
+| dev | Full autonomy (no HITL) | — | Confidence ≥ 0.50, all six inputs present |
+| qa | Held for attestation | QA | GitHub Deployment approval + full QA matrix (§10) |
+| prod | Held for attestation | SRE | GitHub Deployment approval + full SRE matrix (§10) |
+| dr | Held for attestation | SRE | GitHub Deployment approval + dr-drill evidence |
 
-3. **Dev stage** (always runs on dispatch): check out `acdl` + `acdl-contracts@<contract-ref>`, run `policy_checker.py` + `confidence_signal.py`; if `score < 0.50`, write a `dev_rejected` evidence event and exit 1 (Act 4). Otherwise run `mock_executor.sh`, write a `dev_applied` evidence event, and exit 0. The run ends here.
+**Staging is removed.** Dev is the only autonomous environment.
 
-4. **QA gate** (next dispatch with `approve_qa=true`): check out, run `evidence_writer.py --stage qa --event "qa approved"`, commit updated `audit.json` to `acdl-evidence`. Exit 0. The run ends.
+## Cross-cutting concerns
 
-5. **Prod gate** (next dispatch with `approve_prod=true`): same as QA but `--stage prod`.
+### Central pipeline template (§6)
+JSON Schema (draft 2020-12) with a thin domain wrapper. Central repo +
+generated client libraries. Multi-stage validation: schema → policy → NFR →
+confidence. Distributed enrichment. GitOps reconciler (K8s API; cdlc-gitops
+state → CRDs) + Terraform execution layer (§12.5). The pipeline emits one
+`PolicyCheckResult` per policy rule; the confidence signal consumes them as
+one normalized input.
 
-6. **Finalize** (same dispatch as Prod, chained via `needs: prod-gate`): write the `finalize` evidence event, commit final `audit.json` to `acdl-evidence`. The raw URL now serves the updated timeline.
+### Contract schema (§7)
+Central repo + generated client libraries. Strict fail-fast at schema
+stage, multi-stage validation with reason codes from a published
+vocabulary. **W3.E:** per-env mandatory inputs —
+- dev: `stack`, `environment`
+- qa adds: `validation.e2eSuite`, `validation.loadTest`
+- prod adds: `runbook`, `dashboard`, `oncall`
+- dr adds: `drDrillRef`
+- `inputs` always optional; `profile: agentic` fields optional everywhere.
 
-Because each stage is a separate dispatch, the workflow file uses `if:` conditions on each job:
-- `dev` runs when `inputs.approve_qa != true && inputs.approve_prod != true` (the initial dispatch).
-- `qa-gate` runs when `inputs.approve_qa == true && inputs.approve_prod != true`.
-- `prod-gate` runs when `inputs.approve_prod == true`.
-- `finalize` runs after `prod-gate` (`needs: prod-gate`).
+### Confidence signal (§8)
+Six canonical inputs, weighted sum with per-input breakdown. Per-env
+thresholds: dev ≥ 0.50, qa ≥ 0.75, prod ≥ 0.90, dr ≥ 0.95. Structured output
+`{ score, band, perInput, reasonCodes }`. 1-year storage, no retraining in
+v1. Halt with explicit reason on missing input.
 
-This means a full pipeline = 3 dispatches (initial, qa-approve, prod-approve). The human drives each via the Gitea UI or the dispatch API.
+Policy input = list of `PolicyCheckResult` records (engine-agnostic).
+Severity → penalty: critical → hard override to mandatory block; high →
+-0.2; medium → -0.05; low → -0.01; info → 0.0. One critical finding
+hard-overrides the score regardless of all other inputs.
 
-## Phase 05 dry-run + UI (research)
+**BA.B:** thresholds frozen for v1; tuning begins v1.2 (quarterly FP/FN
+tracking; override = Infra & Ops + SRE joint sign-off, itself a
+confidence-event).
 
-Phase 05 has no act_runner available in this environment, so the "dry run"
-is a local bash simulation (`scripts/run_demo.sh`) that produces the same
-`audit.json` shape a real pipeline run would, then uploads it (plus the
-UI) to `acdl-evidence` via the file-contents API. The simulation covers:
+### Audit and evidence stream (§9)
+Tiered ledger: **S3 with Object Lock in compliance mode** (cold, source of
+truth, 7-year retention) + **GitHub audit repo** (`acdl-evidence`, hot
+query index, not part of the chain). Daily checkpoints. Event schema: JWS
+detached signature, `prev_event_hash` chain, controlled-vocabulary
+`event_type`. Outbox pattern: local durable outbox + async worker.
 
-- **Act 1 — Friction:** a single evidence event "manual 2-week deployment (legacy process)" at `stage: dev` with a red-colored timeline marker.
-- **Act 2 — Developer Self-Service:** `l2-commodity-price-feed` contract, full pipeline (dev → qa → prod → finalize), 4 evidence events.
-- **Act 3 — Citizen Developer:** Issue body fed to `l3b_agent_stub.py`, generates the same `l2-commodity-price-feed` contract, identical pipeline, 4 evidence events.
-- **Act 4 — Safety Net:** `l2-regulatory-reporting` contract with `public-ingress: true`, dev rejects (confidence 0.40 < 0.50), 1 evidence event "dev rejected: POLICY_VIOLATION:PUBLIC_INGRESS".
+Outbox database = **DynamoDB**. RPO = 0 (synchronous write to local outbox
+before contract submission ack); RTO = async worker's dead-letter recovery.
+Single-region in v1. The outbox also stores per-contract QA and prod
+approver identities (the only durable record outside GitHub's audit log).
 
-The `audit.json` after `run_demo.sh` contains the genesis + all act
-events (typically ~14 events). The UI fetches `./audit.json` and renders
-a vertical timeline with stage-colored markers and a per-event hash
-preview.
+### Human-in-the-Loop mechanics (§10)
+Pre-execution gates. qa, prod, dr are PR-based attestation gates backed by
+GitHub Environments with required reviewers. No partial deployment to roll
+back on rejection (qa, prod); dr is a separate GitHub Deployment against a
+separate cluster/region.
 
-### UI rendering contract (D-032, D-033)
+Reviewer routing: GitHub CODEOWNERS + Environment required reviewers
+(qa → QA; prod → SRE; dr → SRE). CODEOWNERS routes, does not enforce
+identity distinctness.
 
-`evidence-ui/index.html`:
-- Single file, inline CSS + JS, no external resources.
-- Fetches `./audit.json` (relative URL; works against any raw-URL origin).
-- Renders events as a vertical timeline; each event card shows `seq`, `ts`, `stage` (color-coded: `dev` blue, `qa` yellow, `prod` orange, `finalize` green, `genesis` gray, rejected events red), `event` text, and a 12-char hash preview (`hash.slice(0, 12)…`).
-- Handles fetch failure with a "No audit data yet" message.
-- Refresh button to re-fetch.
+**Separation of duties** (platform-internal, not GitHub-native, not Kyverno
+in v1): on dev→qa promotion the platform writes the QA approver's GitHub
+identity to the DynamoDB outbox keyed by `contractId`; on qa→prod it reads
+the stored QA approver and the new SRE approver; if equal, it blocks, emits
+`SEPARATION_OF_DUTIES_VIOLATION`, and routes a halt artifact to SRE on-call.
 
-## Data Flow
+Full 8-concern attestation matrix (functional, performance, security
+posture, contract NFRs, operational readiness, incident response,
+capacity/cost, resilience) — see `docs/architecture.md` §10.4.
 
-1. A `contract.yaml` arrives either by direct push (L3A) or by the issue workflow running `l3b_agent_stub.py` (L3B).
-2. Push to `acdl-contracts` triggers the reusable pipeline in the `acdl` repo.
-3. **Dev stage:** `policy_checker.py` validates the contract; `mock_executor.sh` applies the L2 composition's L1s; `confidence_signal.py` computes the score; `evidence_writer.py` records each step. If score < 0.50, the stage fails and evidence records the rejection.
-4. **QA stage:** the workflow pauses on the `qa` environment; a human approves.
-5. **Prod stage:** same gate on the `prod` environment.
-6. **Finalize:** the workflow commits the updated `audit.json` to `acdl-evidence`; Pages republishes `index.html`, which fetches and renders the timeline.
+Timeout: 1 business day = warn + escalate; 2 business days = auto-freeze +
+re-submit (linked via `supersedes`). Rejection returns the contract to HELD;
+the audit chain is extended, not torn up.
 
-## Build Order
+### Agentic stack (§11)
+Hybrid runtime: platform-managed control plane + consumer-owned agent.
+Versioned, signed skill catalog over MCP. Skill envelope enforced on
+invocation and result submission. Consumer-owned skill execution; the
+platform does not run the skill. Stateless agents, all state in the
+platform. Skills are reviewed for sensitive data before release (Infra &
+Ops owns the review; it is the mandatory release gate).
 
-1. Repo scaffolding: create `acdl-contracts` and `acdl-evidence` in the org; seed `acdl` directory layout.
-2. L1 modules (8 stubs).
-3. L2 modules (4 compositions).
-4. Core scripts (`mock_executor.sh`, `policy_checker.py`, `confidence_signal.py`, `evidence_writer.py`, `l3b_agent_stub.py`).
-5. Reusable pipeline workflow (Dev → QA → Prod → Finalize) + environment gates.
-6. Issue-triggered L3B workflow in `acdl-contracts`.
-7. Evidence UI (`index.html` + Pages config).
-8. Demo dry-run + the four scripted acts.
+### Substrate execution (§12) — the binding constraint
+**Target Stack IR** (locked): a substrate-neutral description of resources
+(typed inputs/outputs/NFRs), relationships (single parent per child),
+composition (tree, max depth 5), and policy hooks. The L1 registry, L2
+thin-composition tree, contract YML, and PolicyCheckResult schema are all
+defined against the IR — none against any specific substrate.
 
-## Gitea API Surface (Phase 01 research)
+**Substrate adapters** are the only substrate-specific code. An adapter
+compiles the IR into a substrate execution plan. **v1 ships exactly one
+adapter: the Terraform adapter.** v2+ may add OpenTofu, Pulumi, K8s CRDs
+without architectural change.
 
-Authoritative findings from the Gitea docs (added in RESEARCH; supersedes any
-GitHub-Pages / GitHub-Environments assumptions carried over from the spec):
+v1 reality: the IR is shaped to round-trip cleanly to Terraform (nearly
+isomorphic). As more adapters appear, the IR gets more expressive and the
+adapters gain translation logic; the L1 content, the YML standard, and the
+thin-composition tree do not change.
 
-| Capability | Gitea support | ACDL approach |
-|------------|---------------|---------------|
-| Org-scoped repo create | `POST /api/v1/orgs/{org}/repos` (`CreateRepoOption`) | Used to create `acdl-contracts` + `acdl-evidence` |
-| Native Pages | **None** (no `[pages]` config section) | Serve `acdl-evidence` via raw file URLs: `https://git.cloudinit.dev/continuous-intelligence/acdl-evidence/raw/branch/main/index.html`; `index.html` fetches `audit.json` from the same raw path. Requires `[cors] ENABLED=true` on the server if the UI is loaded cross-origin. |
-| Environments API | **None**; `jobs.<id>.environment` is ignored by act_runner | Model QA/Prod gates as `workflow_dispatch` approval inputs (D-004 / D-013); optionally create `qa` and `prod` branches as a visible stand-in |
-| `repository_dispatch` trigger | **Not supported** | Cross-repo trigger via `workflow_dispatch` API: `POST /api/v1/repos/{owner}/{repo}/actions/workflows/{workflow_id}/dispatches` called from a step using `$GITEA_TOKEN` |
-| Reusable workflows (`workflow_call`) | Supported | `acdl/.gitea/workflows/pipeline.yml` called via `uses: continuous-intelligence/acdl/.gitea/workflows/pipeline.yml@milestone/v1.0-initial` |
-| `workflow_dispatch` | Supported (trigger + API) | Used for the manual-approval fallback and the issue workflow's cross-repo trigger |
-| `issues.opened` trigger | Supported | Drives the L3B issue-trigger workflow in `acdl-contracts` |
-| `act_runner` labels | Single label only (`runs-on: ubuntu-latest`) | All workflows use `runs-on: ubuntu-latest` |
-| Context | `${{ gitea.* }}` and `${{ github.* }}` both work | Workflows use `gitea.*` for clarity |
+**Terraform adapter (v1):** translates IR-typed L1 interface → Terraform
+`variable`/`output` blocks; IR-typed L2 thin-composition tree → Terraform
+root module; IR-typed relationships → module references; emits a
+`terraform plan` from the IR. The adapter is a thin layer; it does not own
+L1/L2 content.
 
-### Branch pinning rule
+State storage: S3 (state) + DynamoDB (locking), cloud-managed,
+single-region in v1.
 
-The reusable workflow in the `acdl` repo lives on `milestone/v1.0-initial`
-(that is the repo's default branch). `uses:` references from `acdl-contracts`
-must pin to `@milestone/v1.0-initial`, not `@main` (the `acdl` repo has no
-`main` branch). The new repos `acdl-contracts` and `acdl-evidence` use
-`default_branch: "main"` (D-015) so their default branch exists immediately
-for pushes.
+Policy toolchain: **Checkov** for Terraform plan policy (the L2 checks +
+tag/naming); **Kyverno** for K8s-native/platform-internal policy; **OPA**
+reserved for cross-resource cases, explicitly last resort.
 
-### Default verification toolchain
-
-There is no `package.json`; ACDL is bash + python stubs. The verification gate
-substitutes `bash -n` and `python -m py_compile` for `npm run typecheck`, and
-per-phase `scripts/verify_phaseNN.sh` for `npm test`. `npm run build` is a
-no-op (no build step). See PERSONAS.md / VERIFICATION note.
-
-## L1 module schema (Phase 02 research)
-
-Each L1 module lives at `modules/l1/<name>/` with exactly two files:
-
-- `manifest.yaml` — declares the L1's identity + a flat `inputs:` map.
-  Schema (D-017):
-  ```yaml
-  name: l1-eks-fargate        # matches the folder name
-  kind: l1                    # literal "l1"; substrate-agnostic
-  description: <one-line>
-  inputs:
-    <key>:
-      description: <one-line>
-      type: string            # only "string" allowed (flat, max-depth-1)
-  ```
-- `mock_apply.sh` — uniform stub per D-007 + D-018:
-  ```bash
-  #!/usr/bin/env bash
-  set -euo pipefail
-  echo "[L1: <name>] applying..."
-  sleep 1
-  echo "[L1: <name>] OK"
-  exit 0
-  ```
-  `mock_apply.sh` does NOT read input values; the manifest is for traceability
-  and for Phase 03's `mock_executor.sh` to enumerate the L1s in an L2.
-
-### L1 list (fixed per REQ-02 / D-019)
-
-| Folder | Description |
-|--------|-------------|
-| `l1-eks-fargate` | Serverless container compute substrate |
-| `l1-iam-role` | Identity and access role primitive |
-| `l1-lambda` | Event-driven function primitive |
-| `l1-api-gateway` | HTTP routing primitive |
-| `l1-eventbridge` | Event bus primitive |
-| `l1-sqs` | Queue primitive |
-| `l1-s3` | Object store primitive |
-| `l1-cloudwatch` | Observability primitive |
-
-L1 modules are single-purpose, substrate-agnostic, max-depth-1 (per
-PROJECT.md Constraints). They do not compose with other L1s.
-
-## L2 module schema + core scripts (Phase 03 research)
-
-### L2 manifest.yaml schema (D-020)
-
-```yaml
-name: l2-commodity-price-feed      # matches the folder name
-kind: l2                            # literal "l2"
-description: <one-line>
-l1s:                                # ordered list of L1 references
-  - name: l1-eks-fargate            # MUST match an existing L1 folder name
-    inputs:
-      cluster_name: price-feed-cluster
-      region: us-east-1
-      cpu_arch: arm64
-  - name: l1-lambda
-    inputs:
-      function_name: price-ingest
-      runtime: python3.11
-      handler: index.handler
-  # ... up to 5 L1 references per L2 (max-depth-5 per REQ-05; L2->L1 is depth 1)
-```
-
-L2s reference L1s **by name only** (no path); `mock_executor.sh` resolves
-the name to `modules/l1/<name>/`.
-
-### L2 list (fixed per REQ-04)
-
-| Folder | Description | L1s (per S&P Global Energy / Platts use cases) |
-|--------|-------------|------------------------------------------------|
-| `l2-invoice-service` | Billing + invoicing microservice | `l1-eks-fargate`, `l1-iam-role`, `l1-lambda`, `l1-sqs`, `l1-s3` |
-| `l2-commodity-price-feed` | Real-time price ingestion | `l1-eks-fargate`, `l1-lambda`, `l1-api-gateway`, `l1-eventbridge`, `l1-s3` |
-| `l2-energy-analytics-api` | Historical query API | `l1-eks-fargate`, `l1-api-gateway`, `l1-lambda`, `l1-s3`, `l1-cloudwatch` |
-| `l2-regulatory-reporting` | Compliance + reporting | `l1-eks-fargate`, `l1-iam-role`, `l1-lambda`, `l1-sqs`, `l1-s3` |
-
-Each L2 references exactly 5 L1s (within the max-depth-5 constraint; L2→L1
-is depth 1, so depth-5 is generous but the spec caps composition depth at
-5 — the count is 5 to demonstrate a realistic composed stack).
-
-### contract.yaml schema (D-021)
-
-```yaml
-stack: l2-commodity-price-feed      # MUST match an existing L2 folder name
-inputs:                              # top-level params for the L2 (optional)
-  environment: dev
-  owner: platform-team
-public-ingress: false                # bool; true triggers POLICY_VIOLATION:PUBLIC_INGRESS
-```
-
-The `public-ingress` key is the only policy-enforced field in Phase 03.
-Phase 04's pipeline reads `contract.yaml`, runs `policy_checker.py`, then
-`mock_executor.sh` to apply the L2.
-
-### state.json shape (D-022)
-
-`mock_executor.sh` writes `state.json` to its working directory:
+**Policy result normalization (§12.6):** the confidence signal consumes a
+normalized `PolicyCheckResult` schema, not raw engine output.
 
 ```json
 {
-  "l2": "l2-commodity-price-feed",
-  "l1s": [
-    {"name": "l1-eks-fargate", "applied": true, "exit_code": 0},
-    {"name": "l1-lambda", "applied": true, "exit_code": 0},
-    ...
-  ],
-  "contract": {
-    "stack": "l2-commodity-price-feed",
-    "inputs": {...},
-    "public-ingress": false
-  }
+  "contractId": "uuid",
+  "evaluatedAt": "ISO-8601",
+  "engine": "checkov | kyverno | opa",
+  "ruleId": "CKV_AWS_24 | KYVERNO_NO_PRIVILEGED | ...",
+  "severity": "critical | high | medium | low | info",
+  "result": "pass | fail | skipped | error",
+  "message": "human-readable",
+  "evidence": { "...engine-specific, opaque to the signal..." },
+  "resourceRef": "IR-typed resource identifier"
 }
 ```
 
-### audit.json event + hash chain (D-023)
+Execution layer: GitHub/Gitea Actions in the central pipeline repo. State
+locking via DynamoDB. **AWS credentials via OIDC federation — long-lived
+credentials are forbidden** (§12.5). The platform does not run
+`terraform apply` against a developer's workstation; all execution is in
+the central pipeline.
 
-`audit.json` is a JSON array of event objects. `evidence_writer.py`
-appends one event per call. Hash chain:
+Registry maintenance: L1 publication updates the L1 registry in the same
+PR. The registry is the IR-typed contract, not a Terraform-specific
+variable schema.
 
-1. Construct the event dict with `hash` set to empty string.
-2. Serialize via `json.dumps(event, sort_keys=True, separators=(",", ":"))` — canonical JSON (deterministic key order, no whitespace).
-3. Compute `hash = sha256(canonical_json.encode("utf-8")).hexdigest()`.
-4. Set `event["hash"] = hash`.
-5. Append to `audit.json`.
+Contract→IR resolution: the contract declares intent in IR-typed terms;
+the pipeline resolves it to a target stack (list of L1 instances + inputs +
+relationships); the Terraform adapter compiles the target stack to a plan.
 
-Genesis event (when `audit.json` is empty or missing):
+## v1.1 spike scope
 
-```json
-{
-  "seq": 0,
-  "ts": "2026-07-21T13:00:00Z",
-  "stage": "genesis",
-  "event": "audit log initialized",
-  "prev_hash": "GENESIS",
-  "hash": "<sha256 of the canonical json of this event with hash empty>"
-}
-```
+The spike (Phases 08–10) materializes the **minimum** that proves the IR
+commitments hold (no polyglot mess):
 
-Subsequent events: `seq = prev.seq + 1`, `prev_hash = prev.hash`.
+- One L1: `l1-s3` (IR-typed interface; the only AWS resource in the spike).
+- One L2 thin-composition: `l2-static-asset` (references `l1-s3` only).
+- Terraform adapter: IR → `terraform plan` against AWS via OIDC.
+- One contract submission → contract→IR → `terraform plan` → Checkov
+  `PolicyCheckResult` → confidence signal → evidence event to the DynamoDB
+  outbox.
+- State: S3 + DynamoDB (real AWS, single-region).
 
-### Core script I/O contracts
+Out of spike scope: full HITL matrix wiring, Kyverno, OPA, MCP skill
+catalog, GitOps reconciler, multi-region, prod/dr environments, the 5-skill
+L3B catalog. Those are post-spike (v1.2+) platform build-out.
 
-| Script | Input | Output | Exit |
-|--------|-------|--------|------|
-| `mock_executor.sh` | `<contract.yaml path>` (argv[1]); reads L2 manifest from `modules/l2/<contract.stack>/manifest.yaml` | writes `state.json` to cwd; prints per-L1 progress | 0 on all-L1s-pass; non-zero on any L1 failure |
-| `policy_checker.py` | `<contract.yaml path>` (argv[1]) | stdout: `POLICY_PASS` or `POLICY_VIOLATION:PUBLIC_INGRESS` | 0 on pass; 1 on violation |
-| `confidence_signal.py` | `<contract.yaml path>` (argv[1]); calls policy_checker | stdout: `{"score": 0.90|0.40, "reason": "..."}` | 0 always (per D-024; pipeline decides gate) |
-| `evidence_writer.py` | argv: `--stage <dev|qa|prod|finalize|genesis>` `--event "<text>"` `--audit <path to audit.json>` (default `./audit.json`) | appends event to audit.json; prints the new event's hash + seq | 0 on success; 1 on I/O error |
-| `l3b_agent_stub.py` | argv[1] = issue body text (or stdin if no argv); optional `-o <path>` (default stdout) | writes a `contract.yaml` (D-021 schema) with `stack` set by the D-008 keyword map | 0 on success; 1 on empty input |
+## Gitea API surface (carried from v1.0, refined)
+
+| Capability | Gitea support | ACDL approach (v1.1) |
+|------------|---------------|----------------------|
+| Org-scoped repo create | `POST /api/v1/orgs/{org}/repos` | Used for any new repos |
+| Native Pages | **None** | Serve `acdl-evidence` via raw file URLs (unchanged from v1.0) |
+| Environments API | **None**; act_runner ignores `environment:` | Model HITL gates via `workflow_dispatch` approval inputs (v1.0 D-013 pattern) — **refined in Phase 07** for the real pre-execution gate model |
+| `repository_dispatch` | Not supported | Cross-repo trigger via `workflow_dispatch` API (unchanged) |
+| Reusable workflows | Supported | `acdl/.gitea/workflows/pipeline.yml` via `uses: ...@<ref>` |
+| `id-token: write` / OIDC | **Not supported** (RESEARCH TARGET 1, conf 0.95). Gitea docs list `id-token` as an unsupported GitHub-only scope; open proposal go-gitea/gitea#33681; draft PR go-gitea/gitea#36988 unmerged. Even Gitea's own CI uses long-lived AWS keys (issue #37980). | **Spike waiver D-039:** per-run-rotated long-lived key (rotated after each run by `scripts/rotate_spike_key.sh`). Real OIDC deferred to v1.2, blocked on PR #36988. |
+| `actions/configure-aws-credentials` | Unusable without OIDC | Spike uses static AWS creds from a (rotated) Gitea Actions secret via the `aws-actions/configure-aws-credentials@v4` `access-key-id`/`secret-access-key` inputs, or plain `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY` env vars. v1.2 switches to `role-to-assume` when OIDC lands. |
+
+### Branch pinning rule (refined for W2.A)
+
+- Dev/qa contracts reference the reusable workflow by **tag**
+  (`@v1.1-spike`).
+- Prod-bound workflows reference by **SHA**; the platform CLI
+  (`platform/cli/resolve-tag.ts`, Phase 07) resolves the current tag to its
+  SHA. (Spike scope: the CLI is a stub; the real CLI lands in v1.2.)
+
+### Verification toolchain
+
+ACDL has no `package.json`. The verification gate substitutes:
+- **typecheck:** `terraform validate`, `python3 -m py_compile`, JSON Schema
+  validation (`ajv` or `python -m jsonschema`) against `schemas/`.
+- **test:** per-phase `scripts/verify_phaseNN.sh` (Phase 06: archive integrity;
+  Phase 07: schema validation + decision-resolution completeness; Phase 08:
+  OIDC assume-role + state backend; Phase 09: IR + L1 + adapter `terraform
+  plan`; Phase 10: end-to-end contract submission).
+- **build:** `terraform init` (real build for the spike).
+- See `PERSONAS.md` verification_toolchain.
+
+## Build order (v1.1)
+
+1. Phase 06 — archive demo, reorient repo.
+2. Phase 07 — finalize architecture v1.0; author schemas + designs.
+3. Phase 08 — AWS OIDC bootstrap (use temp key once, rotate).
+4. Phase 09 — IR + `l1-s3` + Terraform adapter → `terraform plan`.
+5. Phase 10 — `l2-static-asset` + contract→IR → end-to-end spike.
+6. COMPLETE gate — review → ship `v1.2.0` → audit. **DONE.**
+
+## v1.2 build-out scope
+
+v1.2 takes the v1.1 spike (dev-only, `plan`-only, single S3 L1) to a real,
+simpler, better-documented platform that delivers a microservice to AWS ECS
+Fargate end-to-end. The locked architecture (§1–§12) is unchanged — v1.2
+extends the *implementation*, not the design.
+
+### In scope (five axes, user-directed 2026-07-21)
+
+1. **Re-evaluate the current state.** go-gitea/gitea#36988 (OIDC for Gitea
+   Actions) re-checked 2026-07-21: still **open** (last updated 2026-05-27,
+   not merged). Real OIDC remains deferred to v1.3+; v1.2 extends the D-039
+   per-run-rotated-key waiver as **D-047**. The waiver continues to satisfy
+   §12.5's *intent* (no *persistently* long-lived key): the spike key is
+   rotated after each run by `scripts/rotate_spike_key.sh`, and Phase 12
+   tightens the IAM scoping + rotation hygiene.
+2. **NFR improvements on the existing spike.** Least-privilege IAM audit of
+   `spike_runner_policy.json`; idempotent `create_state_backend.py` /
+   `create_iam_user.py`; proper exit codes / error handling; P1-1 redaction
+   (two AWS access key IDs in `.ciagent/VERIFY.md` Phase 09 narrative).
+3. **Streamline / simplify the current setup.** Consolidate
+   `run_spike_plan.sh` + `run_spike_e2e.sh` into one
+   `scripts/run_platform.sh`; remove dead code and stale `platform/` paths.
+4. **README.md fully up to date on how the platform works.** Reflect v1.1
+   complete; document the actual spike flow, `scripts/run_platform.sh`, the
+   real repo layout, and the v1.2 objective.
+5. **Bootstrap a consumer repo with a basic microservice deployed to ECS
+   end-to-end.** New Gitea repo `acdl-consumer-microservice` (org
+   `continuous-intelligence`); new IR-typed L1s (`l1-vpc`, `l1-ecs-cluster`,
+   `l1-ecs-service`, `l1-iam-role`, `l1-alb`, `l1-ecr`); new
+   `l2-microservice` thin-composition; one contract submission →
+   `terraform apply` (dev, autonomous per §10, confidence ≥ 0.50) → a live
+   ECS Fargate service serving HTTP 200 → evidence event to the DynamoDB
+   outbox → acdl-evidence timeline.
+
+### Substrate extension (ECS Fargate)
+
+The Terraform adapter (§12) remains the only substrate-specific code. v1.2
+expands the adapter `TYPE_MAP` to cover the six new ECS-shaped IR resource
+types. The L1 interface shape (IR-typed inputs/outputs/NFRs, registered in
+`modules-ir/registry.json`) is unchanged — only the set of registered L1s
+grows. The IR commitments (REQ-28) continue to hold: `modules-ir/`,
+`schemas/`, `contracts/`, `acdl_platform/confidence_signal.py`,
+`acdl_platform/contract_resolver.py`, `acdl_platform/outbox_writer.py`
+remain substrate-agnostic.
+
+### `terraform apply` (dev only)
+
+v1.2 lifts the substrate execution from `plan` to `apply` for the `dev`
+environment only. Dev is autonomous per §10 (confidence ≥ 0.50, no HITL).
+`apply` for qa/prod/dr remains HITL-gated and out of scope for v1.2. The
+apply result (resources created, plan diff) is captured in the evidence
+stream as a `terraform.apply` event.
+
+### Out of scope for v1.2 (deferred to v1.3+)
+
+| Feature | Reason |
+|---------|--------|
+| Real OIDC federation | go-gitea/gitea#36988 still open. v1.2 extends D-039 waiver (D-047); real OIDC is v1.3+. |
+| Full HITL matrix wiring (qa/prod/dr) | v1.2 is dev-only autonomous `apply`; HITL wiring is v1.3. |
+| Kyverno + OPA policy engines | v1.2 keeps Checkov only; Kyverno/OPA are v1.3. |
+| MCP skill catalog + real L3B agent | v1.2 keeps the L3B stub; the 5-skill catalog is v1.3. |
+| Audit ledger build-out (S3 Object Lock + JWS + async worker + DLQ + daily checkpoints) | v1.2 keeps the v1.1 outbox; the regulatory ledger is v1.3. |
+| Multi-region state / outbox | Single-region in v1 (§9, §12.3); multi-region is v1.3+. |
+| Prod/dr environments | v1.2 is dev-only; prod/dr are v1.3. |
+| GitOps reconciler (ArgoCD/Flux) | v1.3+. |
+
+## Build order (v1.2)
+
+1. Phase 11 — re-eval #36988 + NFR audit + simplification findings + README rewrite.
+2. Phase 12 — NFR harden + simplify (idempotent bootstrap, one `run_platform.sh`, IAM audit, redactions).
+3. Phase 13 — six ECS L1s + adapter `TYPE_MAP` expansion.
+4. Phase 14 — `l2-microservice` + contract schema extension.
+5. Phase 15 — consumer repo + `terraform apply` (dev) → live ECS service.
+6. Phase 16 — capstone e2e: consumer commit → live HTTP 200 → evidence → timeline.
+7. COMPLETE gate — review → ship `v1.3.0` → audit.

.ciagent/AUDIT.md

@@ -0,0 +1,43 @@
+# Phase 18 — Audit (v1.3.2)
+
+**Date:** 2026-07-22
+**Phase:** 18 — testing-and-cicd-pipelines
+**Milestone:** v1.3 (active, NFR)
+**Tag:** v1.3.2
+
+## 1. Reconstruction Test
+
+Git log (2 commits for phase 18) matches `.ciagent/` files:
+
+| Commit | Status | .ciagent match |
+|--------|--------|----------------|
+| 1598c54 | verify | VERIFY.md updated, ROADMAP/REQUIREMENTS marked complete |
+| (specify was done in prior commit ae86a29 for phase 17) | | |
+
+ROADMAP.md has Phase 18 with `Status: complete (v1.3.2)`.
+REQUIREMENTS.md has REQ-39, REQ-40, REQ-41, REQ-42 marked `complete (v1.3.2)`.
+VERIFY.md has `VERIFY PASS` verdict.
+Tag `v1.3.2` exists. **PASS.**
+
+## 2. File Discipline
+
+Working tree clean. All new files present (pyproject.toml,
+requirements-test.txt, 7 test files, 2 workflow YAMLs). Modified files
+(run_platform.sh, README.md, terraform/spike/terraform.tf) are expected.
+**PASS.**
+
+## 3. Branch Hygiene
+
+On `main`, no stale phase branches. `milestone/v1.0-initial` is
+historical. **PASS.**
+
+## 4. Commit Discipline
+
+All phase-18 commits have `---ci---` blocks with correct closing
+`---/ci---` tag. Tag `v1.3.2` follows NFR patch versioning (v1.3.1 →
+v1.3.2). **PASS.**
+
+## Verdict
+
+**AUDIT CLEAN** — reconstruction, file discipline, branch hygiene, and
+commit discipline all pass. No critical issues.

.ciagent/PERSONAS.md

@@ -1,21 +1,22 @@
 ---
 project: acdl
-milestone: v1.0
+milestone: v1.1
 generated_at: 2026-07-21
 generator: lead-developer
 verification_toolchain:
-  typecheck: "bash -n scripts/**/*.sh modules/**/*.sh && python3 -m py_compile scripts/**/*.py"
+  typecheck: "terraform validate && python3 -m py_compile acdl_platform/**/*.py && python3 -m jsonschema schemas/*.schema.json"
   test: "scripts/verify_phaseNN.sh"
-  build: "no-op (no build step; bash + python stubs)"
+  build: "terraform init"
   note: |
     ACDL has no package.json. The execute/verify/ship workflows substitute
-    bash -n and python -m py_compile for npm run typecheck, a per-phase
-    verify script for npm test, and treat npm run build as a no-op. This
-    override is documented here as the single source of truth; the ci-*
-    agents read PERSONAS.md before running verification commands.
+    `terraform validate` + `python -m py_compile` + JSON Schema validation
+    (`python -m jsonschema` or `ajv`) for npm run typecheck, a per-phase
+    verify script for npm test, and `terraform init` for npm run build.
+    This override is documented here as the single source of truth; the
+    ci-* agents read PERSONAS.md before running verification commands.
 ---
 
-# ACDL — Persona Roster (project-level)
+# ACDL — Persona Roster (project-level, v1.1)
 
 ## Active personas
 
@@ -24,68 +25,94 @@ verification_toolchain:
 - **Active:** true
 - **Phase-specific:** false
 - **Frameworks:** (none)
-- **Constraints:** pragmatic, battle-tested defaults, no-cross-territory-edits
-- **Territory:** `.ciagent/**`, `scripts/verify_phase*.sh`, `README.md`, `.gitignore`
-- **Reason:** Owns CIAgent metadata and cross-phase verification scripts.
+- **Constraints:** pragmatic, battle-tested defaults, no-cross-territory-edits, vision-is-source-of-truth-for-why
+- **Territory:** `.ciagent/**`, `scripts/verify_phase*.sh`, `README.md`, `docs/**` (meta only — not architecture authoring), `.gitignore`
+- **Reason:** Owns CIAgent metadata, cross-phase verification scripts, and the v1.1 phase orchestration. Resolves the 11 open decisions (D-038) and arbitrates persona conflicts.
 
 ### backend-engineer
 - **Domain:** backend
 - **Active:** true
 - **Phase-specific:** false
-- **Frameworks:** gitea-actions, act_runner, bash, python, yaml
-- **Constraints:** no-cloud, no-ai, stub-only, hash-chain-must-be-deterministic, max-depth-5
-- **Territory:** `.gitea/workflows/**`, `scripts/**` (except `scripts/verify_phase*.sh`), `modules/l2/**/manifest.yaml`
-- **Reason:** Owns workflow YAML, core scripts (mock_executor, policy_checker, confidence_signal, evidence_writer, l3b_agent_stub), and L2 composition manifests.
+- **Frameworks:** python, json-schema, gitea-actions, act_runner, bash, yaml
+- **Constraints:** contract-schema-first, fail-fast-with-reason-codes, no-long-lived-credentials, severity-to-penalty-mapping-immutable
+- **Territory:** `acdl_platform/confidence_signal.py`, `acdl_platform/contract_resolver.py`, `acdl_platform/outbox_writer.py`, `schemas/**` (contract + IR + PolicyCheckResult), `contracts/**` (sample contracts), `.gitea/workflows/**` (pipeline)
+- **Reason:** Owns the contract schema, contract→IR resolution, the confidence signal (6 inputs + severity mapping), the DynamoDB outbox writer, and the central pipeline workflow.
 
-### infra-stub-engineer (custom)
-- **Domain:** backend
+### platform-engineer (custom)
+- **Domain:** infra
 - **Active:** true
 - **Phase-specific:** false
-- **Frameworks:** bash, yaml
-- **Constraints:** mock-only, echo-contract-from-D-007, sleep-1s-exit-0, substrate-agnostic, single-purpose
-- **Territory:** `modules/l1/**`
-- **Reason:** Created to own L1 stub modules (Phase 02) and their uniform mock_apply.sh behavior per D-007. Domain is backend (bash stubs) but territory is strictly L1 modules to keep L1/L2 concerns separated from workflow YAML.
+- **Frameworks:** terraform, aws-iam, aws-s3, aws-dynamodb, oidc, json-schema
+- **Constraints:** ir-is-substrate-agnostic, adapter-is-only-substrate-specific-code, state-in-s3+dynamodb-single-region, oidc-only-no-long-lived-keys (waiver D-034 for bootstrap), terraform-plan-only-in-spike
+- **Territory:** `adapters/terraform/**`, `modules-ir/**`, `terraform/**` (state backend, provider config), `modules-ir/registry.json`
+- **Reason:** Owns the Target Stack IR, the L1/L2 IR-typed modules, the Terraform adapter, the AWS OIDC bootstrap, and the state backend. The IR is substrate-agnostic; the adapter is the only substrate-specific code (the binding constraint per §12).
+
+### security-engineer (custom)
+- **Domain:** security
+- **Active:** true
+- **Phase-specific:** false
+- **Frameworks:** aws-iam, oidc, checkov, json-schema
+- **Constraints:** least-privilege, separation-of-duties-identity-distinctness, no-secrets-in-skill-markdown, audit-chain-extends-not-tears-up, critical-finding-hard-overrides-confidence
+- **Territory:** `acdl_platform/hitl_matrix_design.md`, `acdl_platform/audit_ledger_design.md`, `adapters/terraform/policy/**` (Checkov adapter → PolicyCheckResult), `acdl_platform/separation_of_duties.py`
+- **Reason:** Owns the HITL matrix design, separation-of-duties (DynamoDB identity-distinctness), the audit ledger design (S3 Object Lock + JWS + chain), and the Checkov→PolicyCheckResult adapter. Enforces the "Safety is Computed, Not Assumed" + "Audit truth lives outside the repository" vision tenets.
+
+### frontend-engineer
+- **Domain:** frontend
+- **Active:** true
+- **Phase-specific:** false
+- **Frameworks:** vanilla-js, dom-api, fetch-api
+- **Constraints:** no-frameworks, single-file, fetch-from-same-origin-raw-url, relative-url-for-audit-json
+- **Territory:** `evidence-ui/**` (the timeline UI; pushed to `acdl-evidence`)
+- **Reason:** Owns the evidence timeline UI (`index.html`). Carried over from v1.0; the UI continues to render the audit stream. The v1.1 spike writes events to the DynamoDB outbox; the UI continues to read `audit.json` published to `acdl-evidence`.
 
 ## Deactivated personas
 
+### infra-stub-engineer (custom, v1.0 only)
+- **Domain:** backend
+- **Active:** false
+- **Reason:** Owned L1 stub modules (`modules/l1/**`) in the v1.0 demo. The demo is archived to `demo/` in Phase 06; real L1 modules (`modules-ir/l1/**`) are owned by platform-engineer (substrate-agnostic IR + Terraform adapter). The stub engineer is no longer needed.
+- **Phase-specific:** false (was v1.0)
+- **Territory (would have been):** `demo/modules/l1/**`
+
 ### data-engineer
 - **Domain:** data
 - **Active:** false
-- **Reason:** No persistence layer. ACDL state is flat JSON files (`audit.json`, `state.json`) written by bash/python scripts; no ORM, no migrations, no DB. Schema contracts live in `manifest.yaml` (owned by backend-engineer / infra-stub-engineer).
+- **Reason:** No ORM/persistence framework. The v1.1 outbox is DynamoDB but accessed via boto3 calls inside `acdl_platform/outbox_writer.py` (owned by backend-engineer); the audit ledger is S3 Object Lock + JWS (owned by security-engineer). No schema-migration layer, no ORM, no data-engineer territory.
 - **Phase-specific:** false
 - **Frameworks:** (would have been: drizzle, prisma)
 - **Constraints:** (would have been: schema-first, type-safe-orm)
 - **Territory:** (would have been: `**/db/**`, `**/migrations/**`)
 
-### frontend-engineer
-- **Domain:** frontend
-- **Active:** true  # REACTIVATED for Phase 05 (evidence UI + dry run)
-- **Reason:** Phase 05 builds the vanilla-JS `index.html` timeline UI (REQ-14) and runs the 4 demo acts end-to-end dry run (REQ-15). Inactive for Phases 01-04 (no UI).
-- **Phase-specific:** true (this reactivation is for Phase 05 only; will be deactivated again after the milestone ships if the project continues)
-- **Frameworks:** vanilla-js, dom-api, fetch-api
-- **Constraints:** no-frameworks, single-file, fetch-from-same-origin-raw-url, relative-url-for-audit-json
-- **Territory:** `evidence-ui/**` (the source-of-truth `index.html` in the `acdl` repo; pushed to `acdl-evidence` by `run_demo.sh`)
-
 ## Phase-specific overrides
 
-| Phase | Personas active | Reactivations / notes |
-|-------|-----------------|----------------------|
-| 01 repo-scaffolding | lead-developer, backend-engineer | infra-stub-engineer idle (no L1 work this phase) |
-| 02 l1-modules | lead-developer, backend-engineer, infra-stub-engineer | infra-stub-engineer owns L1 stubs |
-| 03 l2-modules-and-core-scripts | lead-developer, backend-engineer, infra-stub-engineer | backend-engineer owns core scripts + L2 manifests; infra-stub-engineer only updates L1 manifests if referenced |
-| 04 pipeline-and-approval-gates | lead-developer, backend-engineer | infra-stub-engineer idle; frontend-engineer still off |
-| 05 evidence-ui-and-demo-dry-run | lead-developer, backend-engineer, frontend-engineer | frontend-engineer REACTIVATED for `index.html` only; backend-engineer owns the dry-run script and audit.json wiring |
+| Phase | Personas active | Notes |
+|-------|------------------|-------|
+| 06 archive-demo-and-reorient | lead-developer, frontend-engineer (demo UI move only) | backend/platform/security idle |
+| 07 architecture-v1-finalization | lead-developer, backend-engineer (schemas), security-engineer (HITL/ledger/SoD), platform-engineer (IR) | frontend idle |
+| 08 aws-oidc-bootstrap | platform-engineer (lead), security-engineer (trust policy review) | backend/frontend idle |
+| 09 v1-spike-ir-and-l1-and-adapter | platform-engineer (lead), backend-engineer (IR schema co-author) | security/frontend idle |
+| 10 v1-spike-l2-and-contract-e2e | platform-engineer (L2 + adapter), backend-engineer (contract→IR + confidence + outbox), security-engineer (Checkov→PolicyCheckResult), frontend-engineer (evidence event surfaces in timeline) | Full roster |
 
 ## Domain priority (used by TaskDecomposer)
 
-`coordination -> backend -> infra-stub-engineer -> frontend-engineer (Phase 05 only)`
+`coordination → security → platform → backend → frontend`
+
+Rationale: in v1.1, the security/architecture commitments (IR, confidence,
+HITL, ledger, SoD) are the binding constraints; the platform layer
+materializes them; backend wires the pipeline; frontend surfaces the
+evidence. The spike's correctness depends on the security + platform layers
+being right before backend wiring.
 
 ## Conflict resolutions (lead-developer arbitration)
 
-- `backend-engineer` vs `infra-stub-engineer` over `modules/l2/**/manifest.yaml`: backend-engineer owns L2 manifests; infra-stub-engineer owns L1 manifests. No overlap.
-- `backend-engineer` vs `frontend-engineer` over `acdl-evidence/index.html`: frontend-engineer owns the file in Phase 05; backend-engineer provides the `audit.json` schema contract (event shape) via `evidence_writer.py` and a `SCHEMA.md` note in ARCHITECTURE.md.
-- `lead-developer` vs any: lead-developer owns `.ciagent/**` and verification scripts; persona engineers do not edit CIAgent metadata.
+- `backend-engineer` vs `platform-engineer` over `schemas/ir.schema.json`: platform-engineer owns the IR (it is substrate-agnostic but infra-shaped); backend-engineer owns the contract schema and the contract→IR resolution (contract is the consumer surface). Co-authoring is expected; conflict goes to lead-developer.
+- `backend-engineer` vs `security-engineer` over `acdl_platform/confidence_signal.py`: security-engineer owns the severity→penalty mapping + critical-override semantics; backend-engineer owns the 6-input weighted sum + per-env thresholds. The confidence signal is co-owned; conflicts go to lead-developer.
+- `platform-engineer` vs `security-engineer` over `adapters/terraform/policy/**`: security-engineer owns the Checkov→PolicyCheckResult adapter (policy is a security concern); platform-engineer owns the Terraform adapter (substrate translation). No overlap.
+- `lead-developer` vs any: lead-developer owns `.ciagent/**` + `docs/**` meta + verification scripts; persona engineers do not edit CIAgent metadata or the vision/architecture source docs.
 
 ## Territory enforcement mode
 
-`warn` — config.json has no `personas.territory_enforcement` field, so the default per execute.md is `warn`. Cross-territory edits are logged in the commit message but do not fail the task.
+`warn` — config.json has no `personas.territory_enforcement` field, so the
+default per execute.md is `warn`. Cross-territory edits are logged in the
+commit message but do not fail the task. The spike's small scope means
+co-authoring across territories is likely; `warn` keeps it frictionless.

.ciagent/PLAN.md

@@ -1,100 +1,41 @@
 ---
-phase: 05
-name: evidence-ui-and-demo-dry-run
-milestone: v1.0
-milestone_type: feature
-status: planned
-requirements: [REQ-13, REQ-14, REQ-15]
-must_haves:
-  - "evidence-ui/index.html exists: single HTML file with inline CSS + JS, no external resources, no frameworks (D-032, REQ-14)"
-  - "index.html fetches ./audit.json (relative URL) and renders events as a vertical timeline with stage color-coding (dev/qa/prod/finalize/genesis) + 12-char hash preview"
-  - "scripts/run_demo.sh exists: simulates all 4 acts (Friction, Dev Self-Service, Citizen Developer, Safety Net) by calling the Phase 03 core scripts + evidence_writer.py + finalize_evidence.py; writes a final audit.json; uploads audit.json + evidence-ui/index.html to acdl-evidence main via the Gitea file-contents API (D-031/D-033)"
-  - "scripts/run_demo.sh is idempotent: re-running overwrites both files on acdl-evidence and produces the same audit.json (deterministic hash chain)"
-  - "Act 4 produces a 'dev rejected: POLICY_VIOLATION:PUBLIC_INGRESS' evidence event with score 0.40 (the Safety Net)"
-  - "scripts/verify_phase05.sh passes: validates index.html structure (single file, inline, fetch call), runs run_demo.sh, fetches the raw audit.json + index.html URLs from acdl-evidence and confirms HTTP 200"
-verification:
-  typecheck: "bash -n scripts/*.sh && python3 -m py_compile scripts/*.py"
-  test: "scripts/verify_phase05.sh"
-  build: no-op
+phase: 16
+name: v1.2-capstone-e2e
+milestone: v1.2
+requirements: [REQ-35]
+type: feat/verify
+branch: phase/16-v1.2-capstone-e2e
 ---
 
-# Phase 05 — evidence-ui-and-demo-dry-run PLAN
+# Phase 16 — v1.2-capstone-e2e (v1.2) PLAN
 
 ## Goal
 
-Build the vanilla-JS timeline UI and run the 4 demo acts as a local dry
-run that produces a real `audit.json` and publishes it (plus the UI) to
-`acdl-evidence` main. This is the milestone's capstone phase.
+End-to-end verification of the v1.2 platform: consumer commit → pipeline →
+`terraform apply` (dev) → live ECS service → evidence event → timeline. The
+`terraform apply` is blocked by the IAM P0 (Phase 15); Phase 16 ships the
+capstone verification of everything *up to* the apply + documents the
+operator's unblock step. After the operator pushes the policy, the apply +
+HTTP 200 check complete REQ-33/35.
 
-## Requirements covered
+## Tasks
 
-- REQ-13: `acdl-evidence` is Pages-enabled and serves `audit.json` plus `index.html` (substituted by D-012: raw-URL 200 on both files)
-- REQ-14: `index.html` uses vanilla JS to fetch `audit.json` and render events as a timeline
-- REQ-15: All four demo acts reproduce deterministically in a dry run
+### T-16.1 — Capstone verify script
+`scripts/verify_phase16.sh` runs the full v1.2 platform flow (consumer
+content → contract → IR → adapter → terraform validate + plan) + verifies
+the v1.1 regression + the NFR improvements (run_platform.sh, IAM policy
+expansion, P1-1 redaction) + the documentation (README accuracy). The
+`terraform apply` + HTTP 200 check are documented as the operator's
+post-unblock step.
 
-## Waves (vertical slices, domain priority order)
+### T-16.2 — Capstone evidence event
+Write a `MILESTONE_CAPSTONE_VERIFIED` evidence event to the outbox (the
+v1.2 platform is verified up to the IAM-blocked apply).
 
-### Wave 1 — frontend-engineer (the UI)
+### T-16.3 — Phase 16 README update
+Update README to reflect the v1.2 status (Phase 15 partial, Phase 16
+capstone, the IAM unblock step).
 
-**Tasks:**
+## Ship
 
-- **T-5.1** Create `evidence-ui/index.html` — single HTML file with inline `<style>` + `<script>`. The JS fetches `./audit.json` (relative URL), parses the JSON array, and renders a vertical timeline. Each event card shows: `seq` (badge), `ts` (timestamp), `stage` (color-coded chip: dev=blue, qa=yellow, prod=orange, finalize=green, genesis=gray, rejected=red), `event` text, and `hash.slice(0, 12) + "…"` (a 12-char preview). Includes a refresh button that re-fetches. Handles fetch failure with a "No audit data yet" message. No external resources (no CDN, no fetch libraries); vanilla JS only. The file is self-contained.
-
-**Files owned:** `evidence-ui/index.html`
-
-**Commits:** one commit, `phase: 5, status: plan-as-execute, persona: frontend-engineer, task: T-5.1, requirements.covered: [REQ-14]`.
-
-### Wave 2 — backend-engineer (the dry-run script)
-
-**Tasks:**
-
-- **T-5.2** Create `scripts/run_demo.sh` — the Phase 05 dry-run simulation. It:
-  1. Accepts an optional `--no-upload` flag (for testing without hitting Gitea).
-  2. Creates a clean working directory under `/tmp/acdl_demo_run/`; sets `AUDIT=/tmp/acdl_demo_run/audit.json`.
-  3. Initializes the audit log: `python3 scripts/evidence_writer.py --stage genesis --event "audit log initialized" --audit "$AUDIT"`.
-  4. **Act 1 — Friction:** write a single event `--stage dev --event "Act 1 Friction: manual 2-week deployment (legacy process)"`.
-  5. **Act 2 — Developer Self-Service:** write `contracts/act2.yaml` with `stack: l2-commodity-price-feed`, `public-ingress: false`. Run `policy_checker.py` + `confidence_signal.py` + `mock_executor.sh`. Write events: `dev applied: l2-commodity-price-feed`, `qa approved`, `prod approved`, `finalize: audit.json committed`.
-  6. **Act 3 — Citizen Developer:** feed an Issue body ("We need to ingest natural gas prices from Platts...") to `l3b_agent_stub.py -o contracts/act3.yaml`. Run the same pipeline as Act 2 against the generated contract. Write 4 events.
-  7. **Act 4 — Safety Net:** write `contracts/act4.yaml` with `stack: l2-regulatory-reporting`, `public-ingress: true`. Run `policy_checker.py` (fails) + `confidence_signal.py` (score 0.40). Since score < 0.50, write `dev rejected: POLICY_VIOLATION:PUBLIC_INGRESS` and skip QA/Prod/Finalize.
-  8. Print a summary of all events.
-  9. If `--no-upload` is NOT set: call `python3 scripts/finalize_evidence.py --audit "$AUDIT"` to upload `audit.json` to `acdl-evidence`, then call `finalize_evidence.py --audit evidence-ui/index.html --path index.html --message "chore(ui): update index.html"` to upload the UI. (Reuses `finalize_evidence.py` with `--path` override for `index.html`.)
-  10. Exit 0 if all 4 acts produced the expected evidence events; non-zero otherwise.
-
-  Cleanup: write contracts under `contracts/` (gitignored) so the working tree stays clean.
-
-**Files owned:** `scripts/run_demo.sh`
-
-**Commits:** one commit, `phase: 5, status: plan-as-execute, persona: backend-engineer, task: T-5.2, requirements.covered: [REQ-13, REQ-15]`.
-
-### Wave 3 — lead-developer (verify script + traceability)
-
-**Tasks:**
-
-- **T-5.3** Create `scripts/verify_phase05.sh`. Checks:
-  1. `evidence-ui/index.html` exists, is a single file, contains `<style>` and `<script>` inline tags, contains `fetch('./audit.json'` (relative URL), no `https://` external resource references (no CDN).
-  2. `scripts/run_demo.sh` is `bash -n` clean.
-  3. Run `scripts/run_demo.sh --no-upload` and confirm:
-     - It exits 0.
-     - It produces a non-empty `audit.json` with at least 14 events (genesis + act1 + act2[4] + act3[4] + act4[1] = 11 minimum, but with markers it may be more — use `>= 11`).
-     - The audit chain is valid (re-run the hash check).
-     - The Act 4 event contains "POLICY_VIOLATION:PUBLIC_INGRESS".
-  4. If `ACDL_GITEA_TOKEN` is set: run `scripts/run_demo.sh` (with upload), then curl the raw URLs for `audit.json` and `index.html` on `acdl-evidence` and confirm HTTP 200 + that the audit.json matches the local one (or at least parses as JSON with the expected number of events) + that index.html contains "ACDL Evidence" or "audit.json" reference.
-  5. If `ACDL_GITEA_TOKEN` is NOT set: skip the upload check with a clear "SKIP (no token)" message; the dry-run + structural checks are sufficient.
-- **T-5.4** Update `.ciagent/REQUIREMENTS.md` (REQ-13/14/15 → covered pending VERIFY) and `.ciagent/ROADMAP.md` (Phase 05 → executing).
-
-**Files owned:** `scripts/verify_phase05.sh`, `.ciagent/REQUIREMENTS.md`, `.ciagent/ROADMAP.md`
-
-**Commits:** one per task, `phase: 5, status: plan-as-execute, persona: lead-developer, task: T-5.3/5.4`.
-
-## Wave ordering
-
-- Wave 1 (frontend) builds the UI.
-- Wave 2 (backend) builds the dry-run script.
-- Wave 3 (lead-developer) verifies + traceability.
-
-Wave 1 and Wave 2 can run in parallel (no file overlap), but per execute.md the domain priority is `coordination → backend → frontend → custom`. Here `frontend-engineer` and `backend-engineer` have no territory overlap, so they can run sequentially in priority order: backend first (Wave 2), then frontend (Wave 1) — but for clarity I'll keep Wave 1 = frontend, Wave 2 = backend (the UI is the visible artifact; the script needs to upload it). Actually, `run_demo.sh` references `evidence-ui/index.html`, so the UI must exist before the script is tested end-to-end. Order: Wave 1 (UI) → Wave 2 (script) → Wave 3 (verify).
-
-## Dependencies
-
-- Depends on Phases 01-04 (all core scripts, workflows, and the acdl-evidence repo must exist).
-- This is the last phase in the milestone. After Phase 05 ships, the COMPLETE gate runs: review → ship(milestone v1.1.0) → audit.
+Merge → `main` (--no-ff). Tag `v1.2.6`.

.ciagent/PROJECT.md

@@ -2,94 +2,348 @@
 
 ## Vision / Core Value
 
-A 30-minute executive demo proving that infrastructure can be delivered **automatically, safely, and with a complete audit trail** — without the usual weeks of manual tickets, reviews, and copy-pasted configuration. Because the demo runs entirely on **local stubs** (no AWS/GCP/Azure, no external LLM APIs), it shows intent and safety behavior rather than provisioning real cloud resources.
+Consumers declare intent; the platform delivers safe production
+deployment through an agentic stack. The platform absorbs two frictions:
+the cognitive load of getting the infrastructure right, and the
+operational work of getting the change to production safely.
 
-## Objective
+Source of truth for **why**: `docs/vision.md`.
+Source of truth for **how**: `docs/architecture.md` + `.ciagent/ARCHITECTURE.md`.
+Where the two conflict, the vision wins.
 
-Build a runnable demo (Linux + GitHub/Gitea Actions) that walks executives through four acts:
+## North Star
 
-1. **Act 1 — The Friction:** the old manual 2-week deployment process.
-2. **Act 2 — Developer Self-Service:** commit a valid `contract.yaml` for `l2-commodity-price-feed`, watch Dev auto-run, QA + Prod approval gates, then the evidence timeline.
-3. **Act 3 — Citizen Developer:** open a GitHub Issue with natural-language intent; the Python keyword parser generates the same `contract.yaml` and triggers the identical pipeline.
-4. **Act 4 — The Safety Net:** commit a malicious `contract.yaml` (`public-ingress: true`) for `l2-regulatory-reporting`; the pipeline halts in Dev because the confidence signal drops below 0.50, and the rejection is visible on the evidence stream.
+A merged change progresses through lower environments end-to-end without a
+platform engineer joining a thread, approving a ticket, or manually
+triggering a stage gate. A non-technical consumer ships a production
+deployment by declaring intent — without authoring a workflow, a
+configuration file, or a Terraform module. Every production change is
+traceable to a human attestation and an immutable evidence stream.
+
+## Core Tenets (from `docs/vision.md`)
+
+1. **Operations are Declared, Not Executed.** Consumers define what they
+   need; the platform reconciles, provisions, and progresses.
+2. **The Delivery Lifecycle is a Sovereign Boundary.** The platform
+   governs infra and delivery; it does not penetrate upstream product/SDLC.
+   Integration is only through validated, published contracts.
+3. **Lower Environments are Autonomous; Higher Environments are Attested.**
+   Dev = zero-touch agentic. QA/prod/dr = deliberate human attestation, not
+   rubber stamps.
+4. **Safety is Computed, Not Assumed.** Every action produces a measurable,
+   explainable confidence signal. The signal is the platform's certified
+   answer to "is this safe to proceed?"
+5. **Infrastructure is Consumed, Not Maintained.** Compute is abstract,
+   containerized, or serverless. No node/OS/bare-metal lifecycle.
+6. **Two Consumer Surfaces, One Platform.** Technical developers (L3A) and
+   non-technical consumers (L3B) converge on the same contract schema, the
+   same policy envelope, and the same evidence stream.
+
+## Domain Boundaries
+
+- **In scope:** environment progression; cloud resource lifecycle; operational
+  security and observability NFRs; policy enforcement; immutable audit
+  lineage; confidence frameworks; two consumer surfaces (developer + agentic).
+- **Out of scope:** application business logic; IDE workflows; product
+  backlog / sprint planning; compute requiring node-level or OS-level management.
+- **Interface:** upstream systems integrate through a strict contract
+  boundary. The platform validates, enriches with operational standards,
+  and reconciles the target state.
+
+## Objective for Milestone v1.1 (prior — complete, tag `v1.2.0`)
+
+Finalize the architecture to v1.0 (resolve all 11 open design decisions in
+`docs/architecture.md` §13) and prove the locked commitments with one
+end-to-end v1 implementation spike:
+
+- **One L1 module** (`l1-s3`) — substrate-agnostic, IR-typed interface.
+- **One L2 thin-composition** (`l2-static-asset`) — references the L1.
+- **Terraform adapter** — compiles the IR to a real `terraform plan`
+  against AWS via OIDC (no long-lived credentials, per §12.5).
+- **One contract submission** → contract→IR resolution →
+  `terraform plan` → PolicyCheckResult (Checkov) → confidence signal →
+  evidence event to the DynamoDB outbox.
+
+The spike validates the architecture's claim that the IR-shaped commitments
+do not require a polyglot mess (`docs/architecture.md` §14, step 2).
+
+**Status: COMPLETE — all 5 phases shipped (v1.1.1..v1.1.5) + verified; review
+READY TO SHIP (0 P0); audit CLEAN; milestone tag `v1.2.0`; Gitea release
+id 202 published. D-034 closed (root key deactivated by user).**
+
+## Milestone v1.1 Phases (prior — complete)
+
+| Phase | Name | Goal |
+|-------|------|------|
+| 06 | archive-demo-and-reorient | Move the v1.0 demo (`modules/`, `scripts/`, `evidence-ui/`, `contracts/`, demo workflows) to `demo/`; establish the new repo layout (`platform/`, `schemas/`, `adapters/`, `terraform/`, `modules-ir/`); rewrite README. |
+| 07 | architecture-v1-finalization | Resolve the 11 open decisions → architecture v1.0. Author IR JSON Schema, PolicyCheckResult schema, contract schema, confidence-signal spec, HITL matrix, outbox/ledger design under `schemas/` + `platform/`. |
+| 08 | aws-oidc-bootstrap | One-shot use of a temporary long-lived key (waiver D-034) to create an IAM role + OIDC trust policy for the act_runner, an S3 state bucket, and a DynamoDB lock table. Rotate the key. Verify the runner assumes the role via OIDC with no long-lived secret. |
+| 09 | v1-spike-ir-and-l1-and-adapter | Target Stack IR; one real L1 (`l1-s3`) with IR-typed interface; L1 registry; Terraform adapter (IR → Terraform var/output + `terraform plan`) running against AWS via OIDC. |
+| 10 | v1-spike-l2-and-contract-e2e | One L2 thin-composition (`l2-static-asset`) referencing `l1-s3`; contract schema + contract→IR resolution; one end-to-end contract submission → `terraform plan` → Checkov → confidence signal → evidence event to outbox. Verify the IR commitments hold. |
+
+Milestone COMPLETE gate: review → ship `v1.2.0` (feature milestone, next
+minor per ship.md) → audit. **DONE.**
+
+## Objective for Milestone v1.2 (prior — complete)
+
+Platform hardening + first real consumer deployment. The v1.1 spike proved
+the IR commitments hold on a single dev-only `terraform plan` for one S3
+bucket. v1.2 takes the spike to a real, simpler, better-documented platform
+that actually delivers a microservice to AWS ECS Fargate end-to-end.
+
+Five scope axes (user-directed, 2026-07-21):
+
+1. **Re-evaluate the current state.** Confirm go-gitea/gitea#36988 (OIDC for
+   Gitea Actions) is still unmerged (re-checked 2026-07-21: **open**, last
+   updated 2026-05-27). Extend the D-039 per-run-rotated-key waiver for
+   v1.2; real OIDC is deferred to v1.3+ (D-047).
+2. **NFR improvements on the existing spike.** Least-privilege IAM audit,
+   idempotent bootstrap, proper exit codes / error handling, rotation
+   hygiene, P1-1 / P1-B redaction carried forward from the v1.1 audit.
+3. **Streamline / simplify the current setup.** Consolidate the
+   `run_spike_*.sh` scripts into one `scripts/run_platform.sh`; remove
+   dead code and stale paths; one command runs the whole pipeline.
+4. **README.md fully up to date on how the platform works.** The current
+   README still says "v1.1 (active)" — it must reflect v1.1 complete, the
+   actual spike flow, how to run it, the real repo layout, and the v1.2
+   objective.
+5. **Bootstrap a consumer repo with a basic microservice deployed to ECS
+   end-to-end.** New Gitea repo `acdl-consumer-microservice` (org
+   `continuous-intelligence`) holding a tiny HTTP container + Dockerfile;
+   new IR-typed L1s (`l1-vpc`, `l1-ecs-cluster`, `l1-ecs-service`,
+   `l1-iam-role`, `l1-alb`, `l1-ecr`); new `l2-microservice`
+   thin-composition; one contract submission → `terraform apply` (dev,
+   autonomous) → a live ECS Fargate service serving HTTP 200 → evidence
+   event to the DynamoDB outbox → acdl-evidence timeline.
+
+The milestone proves the platform delivers real value (a running
+microservice), not just a plan.
+
+## Milestone v1.2 Phases
+
+| Phase | Name | Goal |
+|-------|------|------|
+| 11 | v1.2-research-and-readme | Re-eval #36988 (confirm open → extend D-039 as D-047). Audit the v1.1 spike for NFR gaps (least-privilege, idempotency, error handling, rotation hygiene) + simplification opportunities. **Rewrite README.md** to reflect v1.1 complete + how the platform actually works (spike flow, how to run, repo layout, v1.2 objective). Output: RESEARCH.md v1.2 addendum; updated README. |
+| 12 | nfr-harden-and-simplify | Apply Phase 11 findings: tighten `spike_runner_policy.json` (least-privilege audit); make `terraform/bootstrap/create_*.py` idempotent; consolidate `run_spike_*.sh` → one `scripts/run_platform.sh`; proper exit codes / error handling; redact P1-1 AWS key IDs in `VERIFY.md`; fix any remaining stale `platform/` paths. Spike still runs e2e after the refactor. |
+| 13 | l1-catalog-for-ecs | Author IR-typed L1s for an ECS Fargate microservice: `l1-vpc`, `l1-ecs-cluster`, `l1-ecs-service`, `l1-iam-role` (task + exec role), `l1-alb`, `l1-ecr`. Register all in `modules-ir/registry.json`. Expand the Terraform adapter `TYPE_MAP`. Each L1 produces a valid `terraform plan` fragment. |
+| 14 | l2-microservice-and-contract-schema | Author `l2-microservice` thin-composition (references the ECS L1s, depth ≤ 5). Extend `schemas/contract.schema.json` for microservice inputs (image, port, env, healthcheck). Verify contract→IR resolution yields a complete target stack. |
+| 15 | consumer-repo-and-terraform-apply | Create consumer repo `acdl-consumer-microservice` (Gitea org) with a basic microservice (tiny HTTP container + Dockerfile + ECR push). Lift the platform from `plan` → **`apply`** (dev, autonomous per §10). Submit `contracts/microservice.yaml` → pipeline → IR → plan → apply → a real ECS Fargate service running. |
+| 16 | v1.2-capstone-e2e | End-to-end verification: consumer commit → pipeline → ECS service live serving HTTP 200 → evidence event to the DynamoDB outbox → acdl-evidence timeline renders it. Verify NFR improvements hold, the setup is simpler (one `run_platform.sh`), and the README is accurate. |
+
+Milestone COMPLETE gate: review → ship `v1.3.0` (feature milestone, next
+minor per ship.md — v1.1 shipped `v1.2.0`) → audit.
+
+## Objective for Milestone v1.4 (active)
+
+Central pipeline contract + shell reproducibility + output streaming. The
+v1.3 milestone (Phases 17–18) created identical CI/CD pipelines for Gitea
+and GitHub but they were duplicated copies with no single source of truth.
+v1.4 makes the pipeline a declarative contract, enables full shell
+reproducibility, and streams terraform/checkov output so users can see
+what the platform is doing.
+
+Three scope axes:
+
+1. **Central pipeline contract.** A JSON Schema
+   (`schemas/pipeline.schema.json`) + YAML instance (`pipelines/ci.yaml`)
+   declares the pipeline stages, commands, triggers, and runner. Both
+   `.gitea/workflows/ci.yml` (Gitea Actions, dev) and
+   `.github/workflows/ci.yml` (GitHub Actions, production) implement the
+   contract. A test validates conformance.
+2. **Shell reproducibility.** `scripts/run_ci.sh` mirrors the CI pipeline
+   locally — runs the same 3 stages (lint, test, check-only) in sequence.
+   The pipeline is fully reproducible from the shell, not just in CI.
+3. **Output streaming.** `scripts/run_platform.sh` streams terraform
+   init/validate/plan output, Checkov compliance results, and
+   PolicyCheckResult records to stdout by default, so the user sees what
+   is happening. A `--quiet` flag suppresses streaming for log-only mode.
+
+## Milestone v1.4 Phases
+
+| Phase | Name | Goal |
+|-------|------|------|
+| 19 | central-pipeline-contract-and-shell-reproducibility | Create the central pipeline contract (JSON Schema + YAML instance). Create `scripts/run_ci.sh` for shell reproducibility. Update `run_platform.sh` to stream terraform/checkov output. Update both workflow YAMLs with contract references (staying byte-identical). Add tests for contract validation, workflow conformance, and streaming. |
+
+Milestone COMPLETE gate: review → ship `v1.4.1` (feature milestone, next
+minor per ship.md — v1.3 shipped `v1.3.2`) → audit.
 
 ## Requirements
 
-### Validated
-- Three repos under the `continuous-intelligence` Gitea org: `acdl` (platform + stubs + reusable workflows), `acdl-contracts` (developer surface), `acdl-evidence` (GitHub Pages audit timeline).
-- L1 modules (single-purpose, substrate-agnostic, max-depth-1 primitives) as folders with `manifest.yaml` + `mock_apply.sh`.
-- L2 modules (composed stacks, max-depth-5) grouping L1s into deployable service shapes.
-- L3A developer surface: commit `contract.yaml` to `acdl-contracts`.
-- L3B agentic surface: Python keyword parser turning an Issue body into `contract.yaml`.
-- Confidence signal: base 0.90, drops to 0.40 on policy violation; gate threshold ≥ 0.50.
-- Evidence stream: hash-chained `audit.json` published via Pages + vanilla-JS `index.html` timeline.
-- Reusable CI workflow: Dev (autonomous) → QA (manual approval) → Prod (manual approval) → finalize.
+### v1.0 (Prior milestone — the demo)
 
-### Active
-- 8 L1 modules (serverless/container focus): `l1-eks-fargate`, `l1-iam-role`, `l1-lambda`, `l1-api-gateway`, `l1-eventbridge`, `l1-sqs`, `l1-s3`, `l1-cloudwatch`.
-- 4 L2 modules mirroring S&P Global Energy / Platts use cases: `l2-invoice-service`, `l2-commodity-price-feed`, `l2-energy-analytics-api`, `l2-regulatory-reporting`.
-- 5 core scripts: `mock_executor.sh`, `policy_checker.py`, `confidence_signal.py`, `evidence_writer.py`, `l3b_agent_stub.py`.
-- Issue-triggered workflow in `acdl-contracts` that runs the L3B parser, commits a new branch, closes the issue, and triggers the main pipeline.
-- Evidence stream UI (`index.html`) fetching `audit.json` and rendering events as a timeline.
+Status: complete. Tag `v1.1.0`. All REQ-01..15 satisfied by the stub-driven
+executive demo. See `REQUIREMENTS.md` §v1 and the prior decisions table
+appendix below. The demo is **archived** to `demo/` in Phase 06.
 
-### Out of Scope
-- Real cloud provisioning (AWS/GCP/Azure).
-- Real LLM inference / external AI APIs.
-- Production-grade infrastructure or multi-tenant isolation.
-- Real cryptographic tamper-proofing (the hash chain is demonstrative, not adversarially secure).
+### v1.1 (Prior milestone — architecture finalization + v1 spike, complete)
+
+New requirements REQ-16..REQ-28 — see `REQUIREMENTS.md` §v1.1. Summary:
+
+- **REQ-16:** Architecture finalized to v1.0 (11 open decisions resolved).
+- **REQ-17:** Target Stack IR defined as JSON Schema; substrate-agnostic.
+- **REQ-18:** PolicyCheckResult normalized schema defined; Checkov adapter.
+- **REQ-19:** Six-input confidence signal specified with per-env thresholds
+  (dev 0.50 / qa 0.75 / prod 0.90 / dr 0.95) and severity→penalty mapping.
+- **REQ-20:** Tiered audit ledger design (S3 Object Lock 7-yr + DynamoDB
+  outbox, RPO=0, JWS detached signatures, `prev_event_hash` chain).
+- **REQ-21:** Full 8-concern HITL matrix + separation-of-duties design
+  (CODEOWNERS + DynamoDB identity-distinctness).
+- **REQ-22:** Contract schema (JSON Schema draft 2020-12) with per-env
+  mandatory/optional inputs and `profile: agentic` marker for L3B.
+- **REQ-23:** AWS OIDC bootstrap (IAM role + trust policy for act_runner);
+  the long-lived key is used once then rotated (waiver D-034).
+- **REQ-24:** One real L1 module (`l1-s3`) with an IR-typed interface.
+- **REQ-25:** One real L2 thin-composition (`l2-static-asset`) referencing
+  `l1-s3`.
+- **REQ-26:** Terraform adapter compiles the IR to a real `terraform plan`
+  against AWS via OIDC; state in S3 + DynamoDB.
+- **REQ-27:** One end-to-end contract submission → contract→IR resolution →
+  `terraform plan` → Checkov → confidence signal → evidence event to outbox.
+- **REQ-28:** Spike verification proves the IR-shaped commitments hold (no
+  polyglot mess; the adapter is the only substrate-specific code).
+
+### v1.2 (Prior milestone — platform hardening + first real consumer deployment, complete)
+
+New requirements REQ-29..REQ-35 — see `REQUIREMENTS.md` §v1.2. Summary:
+
+- **REQ-29:** README.md fully documents the v1.1-complete platform: spike
+  flow, how to run, repo layout, v1.2 objective.
+- **REQ-30:** NFR hardening — least-privilege IAM audit, idempotent
+  bootstrap, consolidated `run_platform.sh`, error handling, P1-1/P1-B
+  redaction.
+- **REQ-31:** L1 catalog expanded for ECS — 6 new IR-typed L1s
+  (`l1-vpc`, `l1-ecs-cluster`, `l1-ecs-service`, `l1-iam-role`, `l1-alb`,
+  `l1-ecr`) registered and adapter-compiled.
+- **REQ-32:** `l2-microservice` thin-composition + contract schema extended
+  for microservice inputs (image, port, env, healthcheck).
+- **REQ-33:** `terraform apply` (dev, autonomous) — real provisioning, not
+  just `plan`.
+- **REQ-34:** Consumer repo `acdl-consumer-microservice` with a basic
+  microservice (ECR image, Dockerfile, contract).
+- **REQ-35:** End-to-end verification — consumer commit → live ECS service
+  (HTTP 200) → evidence event → timeline.
+
+### v1.4 (Active milestone — central pipeline contract + shell reproducibility + streaming)
+
+New requirements REQ-43..REQ-45 — see `REQUIREMENTS.md` §v1.4. Summary:
+
+- **REQ-43:** Central pipeline contract — `schemas/pipeline.schema.json` +
+  `pipelines/ci.yaml`. Both Gitea and GitHub workflows implement the
+  contract; a test validates conformance.
+- **REQ-44:** `scripts/run_ci.sh` mirrors the CI pipeline locally (lint →
+  test → check-only), exiting 0 with "CI PIPELINE OK".
+- **REQ-45:** `scripts/run_platform.sh` streams terraform/checkov output by
+  default (with `--quiet` for log-only mode). Both workflows byte-identical.
 
 ## Constraints
 
-- Environment: local Linux OS.
-- CI/CD: GitHub/Gitea Actions + Environments (QA, Prod approval gates).
-- **No cloud** — absolutely no AWS, GCP, or Azure resources.
-- **No AI** — no OpenAI or external LLM APIs; the "Agentic" part is a keyword parser.
-- All state in flat JSON files or CI artifacts.
-- Compute strategy: EKS Fargate + serverless primitives (no VPC module).
-- L1 modules are single-purpose, substrate-agnostic, do not compose with other L1s.
-- L2 modules combine L1 primitives into deployable shapes, max depth 5.
+- **Forge:** Gitea at `https://git.cloudinit.dev`, org `continuous-intelligence`.
+- **CI runtime:** act_runner / Gitea Actions (reuses GitHub Actions workflow YAML).
+- **Cloud:** AWS via OIDC federation. **Long-lived credentials are forbidden**
+  (§12.5). The v1.1 spike uses a temporary long-lived key **once** to bootstrap
+  OIDC (waiver D-034), then rotates it.
+- **Substrate:** Terraform adapter in v1 (the only adapter). L1/L2 are
+  substrate-agnostic in shape; the adapter is the only substrate-specific code.
+- **State:** S3 (state files) + DynamoDB (locking), single-region in v1.
+- **Environments:** dev (autonomous) → qa (QA HITL) → prod (SRE HITL) → dr
+  (SRE HITL). **Staging does not exist** (Path A locked).
+- **Compute:** abstract / containerized / serverless. No VMs, bare metal, OS
+  lifecycle.
+- **Autonomy:** Full. Escalation hooks: deploy, delete_data, merge_to_main.
+
+## Anti-Goals (from `docs/vision.md` §7)
+
+- Not an upstream development platform (no product backlogs, IDE, code authorship).
+- Not a general-purpose AI (autonomy is narrow, bounded by policy envelopes).
+- Not a legacy infrastructure bridge (no VMs/bare metal/OS).
+- Not a permissive delivery highway (no escape hatches past confidence or HITL).
+- Not a mutable audit log (VCS history ≠ regulatory evidence).
 
 ## Context
 
-- Forge: Gitea at `https://git.cloudinit.dev`, org `continuous-intelligence`.
-- The `acdl` repo already exists (empty) at org root and serves as the platform/meta repo.
-- `acdl-contracts` and `acdl-evidence` will be created as additional repos in the same org.
-- act_runner / Gitea Actions is the CI runtime; "GitHub Actions" workflow YAML is reused as-is.
+- The `acdl` repo exists at the org root. `acdl-contracts` and
+  `acdl-evidence` exist from the v1.0 demo and continue as the developer
+  surface and the audit-timeline host respectively.
+- `docs/vision.md` and `docs/architecture.md` (v0.2) are the upstream
+  vision/architecture sources, pulled from `origin/main` at the start of v1.1.
+- The v1.0 demo (tag `v1.1.0`) is the reference of intent — it proved the
+  shape (L1/L2/contract/confidence/evidence/HITL) on stubs. v1.1 replaces the
+  stubs with the real platform substrate.
 
-## Key Decisions
+## Key Decisions (v1.1)
+
+Carries forward the still-valid v1.0 decisions (see appendix). New v1.1
+decisions:
 
 | ID | Decision | Rationale | Outcome |
 |----|----------|-----------|---------|
-| D-001 | Use Gitea org `continuous-intelligence` for all repos | User-specified target org; already exists | Single source of truth for the demo |
-| D-002 | Map "GitHub Actions" to Gitea Actions (act_runner) | Environment is Gitea; same workflow YAML syntax | Demo runs on the actual forge |
-| D-003 | Collapse `acdl-platform` into the existing `acdl` repo | `acdl` already exists empty at org root | 3 repos total: `acdl`, `acdl-contracts`, `acdl-evidence` |
-| D-004 | Use Gitea `environment` blocks + required reviewers for QA/Prod; fallback to manual `workflow_dispatch` with approval input | Approval gates required by spec; forge supports environment protection | Frictionless approval gates |
-| D-005 | Hash-chained ledger (`prev_hash` + own `hash`) for evidence; declared demonstrative | Spec asks for simple JSON; chain gives visible tamper-evidence | Visible audit timeline without overengineering |
-| D-006 | Confidence gate threshold = 0.50 exactly | Explicit in spec | Acts 2/4 behave as scripted |
-| D-007 | Each `mock_apply.sh` echoes `[L1: <name>] applying...` + `OK`, sleeps 1s, exits 0 | Spec literal; uniformity aids timeline parsing | Predictable evidence events |
-| D-008 | Keyword→stack mapping for L3B: gas/price/ingest/data-lake → commodity-price-feed; invoice/billing → invoice-service; analytics/historical/query → energy-analytics-api; regulatory/compliance/reporting/trading → regulatory-reporting; fallback → invoice-service | Mirrors the 4 L2 modules + Act 3 example issue | Act 3 reproduces deterministic behavior |
-| D-009 | Init milestone = `v1.0`, branch `milestone/v1.0-initial` | init.md Step 5 mandate | Branching strategy follows convention |
-| D-010 | Single-project mode for the `acdl` checkout | User chose standalone single-project | `---ci---` blocks omit `project:` field |
-| D-011 | Single-project mode explicitly enforced via `config.json mode: "single"` overriding `projects[]` length signal | run.md Step 0 reads `projects[]` length as multi-project trigger; explicit flag disambiguates | No `project:` prefix in commits or branches |
-| D-012 | Gitea has no native Pages — serve `acdl-evidence` via raw file URLs (`/raw/branch/main/...`) and a CORS note in ARCHITECTURE.md | Research confirms Gitea has no `[pages]` section | Demo can render `index.html` via raw URL without server-side Pages config |
-| D-013 | Gitea has no environments API and ignores `jobs.<id>.environment` — model QA/Prod gates as `workflow_dispatch` approval inputs (D-004 fallback) | Research confirms `environment:` blocks are ignored by act_runner | Approval gates become dispatch inputs; "environments" become workflow job names + optional branch protection on `qa`/`prod` branches |
-| D-014 | Cross-repo triggering uses the `workflow_dispatch` Gitea API (POST `/actions/workflows/{id}/dispatches`) from inside a step instead of `repository_dispatch` | Gitea Actions does not support `repository_dispatch` | Issue-trigger workflow calls the main pipeline via authenticated dispatch from a step |
-| D-015 | New repos `acdl-contracts` and `acdl-evidence` use `default_branch: "main"` with `auto_init: true` | Matches Gitea `DEFAULT_BRANCH=main`; required for the default branch to exist before any push | Reusable-workflow `uses:` references still pin `acdl` workflows to `@milestone/v1.0-initial` |
-| D-016 | Pages placeholder for Phase 01 is a minimal HTML stub (`<title>ACDL Evidence</title>` + "evidence stream coming soon"); full UI deferred to Phase 05 | Phase 01 success criterion is "Pages returns 200 with placeholder index.html" but Gitea has no Pages | Raw-URL HTTP 200 against `index.html` substitutes for the Pages check; full timeline UI built in Phase 05 |
-| D-017 | Each L1 `manifest.yaml` declares a single `inputs:` map of named string keys with descriptions; no nested types (substrate-agnostic, max-depth-1) | REQ-02/03 say "declared inputs"; spec forbids composition and cloud-specific types | Uniform, parseable schema that Phase 03's `mock_executor.sh` can read with python+yaml |
-| D-018 | L1 `mock_apply.sh` reads its own `manifest.yaml` for self-identification but ignores the input values (uniform stub per D-007) | D-007 mandates a literal echo + 1s sleep + exit 0; inputs are declared for traceability, not consumed | Predictable evidence events + clean separation from Phase 03 where L2s pass inputs to L1s |
-| D-019 | The 8 L1 names are fixed per REQ-02: `l1-eks-fargate`, `l1-iam-role`, `l1-lambda`, `l1-api-gateway`, `l1-eventbridge`, `l1-sqs`, `l1-s3`, `l1-cloudwatch` | REQ-02 literal | Phase 02 enumerates them exactly; no naming freedom |
-| D-020 | L2 `manifest.yaml` schema: `name`, `kind: l2`, `description`, `l1s:` (list of `{name, inputs: map}` entries). L2 references L1s by name (no path); inputs are string maps per L1 manifest declarations | REQ-04 says L2 "composes L1s"; REQ-05 caps depth at 5 (L2→L1 is depth 1) | mock_executor.sh reads `l1s:` and invokes each L1's `mock_apply.sh` |
-| D-021 | `contract.yaml` schema: `stack` (L2 name), `inputs` (string map for the L2's top-level params), optional `public-ingress: bool` (the policy violation key per REQ-07) | REQ-07 cites `public-ingress: true` as the forbidden key; REQ-08's confidence signal keys off policy pass/fail | Single flat schema drives both policy_checker and the mock_executor |
-| D-022 | `mock_executor.sh` writes `state.json` with shape `{"l2": "<name>", "l1s": [{"name":"...","applied":true,"exit_code":0}], "contract": <contract.yaml parsed>}` to the cwd; idempotent (overwrites) | REQ-06 says "writes state.json" but does not specify shape | Deterministic, parseable; Phase 05's evidence UI can include it in the audit trail |
-| D-023 | `evidence_writer.py` appends events to `audit.json` (a JSON array of event objects). Each event: `{"seq": N, "ts": <iso8601>, "stage": "dev|qa|prod|finalize", "event": "<string>", "prev_hash": "<sha256>", "hash": "<sha256 of canonical json of this event with hash field empty>"}`. The genesis event has `prev_hash: "GENESIS"` and `seq: 0` | D-005 mandates hash-chained ledger; canonical JSON for deterministic hashing | Visible tamper-evidence without overengineering; Phase 05 UI reads the array |
-| D-024 | `confidence_signal.py` reads `contract.yaml`, calls `policy_checker.py` (as a subprocess or import), returns base 0.90 on pass and 0.40 with reason code on policy failure; prints `{"score": 0.90|0.40, "reason": "<POLICY_VIOLATION:...|>"}` to stdout; exit 0 always | REQ-08 literal: base 0.90, drops to 0.40, gate ≥ 0.50 | Deterministic JSON output for the pipeline to consume |
-| D-025 | `policy_checker.py` reads `contract.yaml`, fails with exit code 1 and stdout `POLICY_VIOLATION:PUBLIC_INGRESS` if `public-ingress: true`; otherwise exits 0 with stdout `POLICY_PASS` | REQ-07 literal | Single source of policy truth; called by confidence_signal and the pipeline directly |
-| D-026 | `l3b_agent_stub.py` reads Issue body text from argv[1] (or stdin if no argv), applies the D-008 keyword map, writes a `contract.yaml` to stdout (or to `-o <path>`). Output contract uses the D-021 schema with `stack:` set to the mapped L2 name and a fixed `inputs:` map per L2 | D-008 + Act 3 example; L3B must produce the same contract format as L3A | Deterministic keyword parser; no external APIs |
-| D-027 | Phase 04 models the pipeline as TWO Gitea Actions workflows: (1) `acdl/.gitea/workflows/pipeline.yml` — `on: workflow_call` + `on: workflow_dispatch` (so it can be both called by the contracts-repo trigger AND manually re-dispatched for approvals); (2) `acdl-contracts/.gitea/workflows/issue-to-contract.yml` — `on: issues [opened]`. Approval gates are implemented as separate workflow_dispatch inputs (`approve_qa: bool`, `approve_prod: bool`) on the pipeline workflow, since Gitea ignores `environment:` blocks (D-013) | Gitea Actions has no environment reviewers, no `repository_dispatch`, no native approval UI | Pipeline can be re-dispatched by a human at each gate; the workflow_dispatch API call from a step (D-014) drives cross-repo triggering |
-| D-028 | The pipeline workflow runs all 4 stages (dev, qa-gate, prod-gate, finalize) in a single workflow run, with each gate job checking a workflow_dispatch input (`approve_qa`/`approve_prod`). When the input is false (the default), the gate job fails with a clear "awaiting approval" message; the human re-dispatches with `approve_qa=true` to advance. State (state.json, audit.json, contract ref) is passed via workflow artifacts (upload/download between jobs) because Gitea Actions artifacts work the same as GitHub Actions | Gitea Actions supports `actions/upload-artifact` and `actions/download-artifact`; the alternative is committing state between jobs, which is heavier | Deterministic, observable pipeline; artifacts keep the audit trail within one run |
-| D-029 | The finalize step commits `audit.json` to `acdl-evidence` main via the Gitea file-contents API (POST `/repos/{owner}/{repo}/contents/{path}` with the base64 content + a commit message referencing the pipeline run id), exactly like Phase 01's `gitea_setup.sh` does for `index.html`. It uses `${GITEA_TOKEN}` (a repo secret) for auth | D-012 raw-URL approach requires the file to be on main; the API is the only way to put it there from a workflow step | The evidence timeline (Phase 05 UI) fetches the raw URL after finalize completes |
-| D-030 | The issue-to-contract workflow in `acdl-contracts` checks out `l3b_agent_stub.py` from the `acdl` repo (pinned to `@milestone/v1.0-initial` per the branch-pin rule), parses the Issue body, commits `contract.yaml` to a new branch `contract/<issue-number>` on `acdl-contracts`, then dispatches the pipeline workflow on the `acdl` repo via `curl POST /actions/workflows/<id>/dispatches` with `inputs: {contract-ref: contract/<issue-number>}` (D-014). The pipeline workflow checks out `acdl-contracts` at that ref to read the contract | Gitea Actions cannot trigger across repos without an explicit API call; the branch carries the contract ref | Reproducible Act 3: Issue → contract.yaml → pipeline run with the same contract as Act 2 |
-| D-031 | Phase 05 "dry run" = a local bash script (`scripts/run_demo.sh`) that simulates the full pipeline by calling the core scripts in sequence + writing evidence events via `evidence_writer.py` + uploading `audit.json` to `acdl-evidence` via `finalize_evidence.py`. It does NOT use act_runner (no runner is registered in this environment). It exercises all 4 acts: (1) Friction — a static "manual 2-week" log entry; (2) Developer Self-Service — a valid `contract.yaml` for `l2-commodity-price-feed`, full pipeline (dev→qa→prod→finalize), all evidence events; (3) Citizen Developer — an Issue body, `l3b_agent_stub.py` produces the contract, identical pipeline; (4) Safety Net — a malicious `public-ingress: true` contract for `l2-regulatory-reporting`, dev rejects with confidence < 0.50, rejection visible in the timeline | The spec says "4 scripted acts reproduce deterministically in a dry run"; without a runner, the bash simulation IS the deterministic reproduction | The same `audit.json` shape is produced as a real pipeline run would produce, so the `index.html` UI renders the timeline identically |
-| D-032 | `index.html` (vanilla JS) is committed to the `acdl` repo at `evidence-ui/index.html` as the source of truth, and pushed to `acdl-evidence` main by `scripts/run_demo.sh` (via the file-contents API) alongside `audit.json`. The UI fetches `audit.json` from the same raw-URL origin (D-012). It renders events as a vertical timeline with `seq`, `ts`, `stage` (color-coded), `event` text, and a truncated `hash` per event. No frameworks; one HTML file with inline CSS + JS | D-012 raw-URL approach; the UI must be a single file (no separate JS/CSS) for simplicity; vanilla JS per REQ-14 | The UI loads in any browser by visiting the raw URL; it fetches the sibling `audit.json` and renders |
-| D-033 | The `audit.json` raw URL on `acdl-evidence` main is the single source of truth for the timeline. `run_demo.sh` writes the final `audit.json` (after all 4 acts) and the final `index.html` in two API calls. Re-running `run_demo.sh` overwrites both (idempotent). The UI's fetch URL is relative (`./audit.json`) so the same `index.html` works against any raw-URL origin | D-012 + D-029; relative URL avoids hardcoding the host | Deterministic re-run; UI always reflects the latest audit |
+| D-034 | Temporary long-lived AWS key (waiver) used once in Phase 08 to bootstrap the state backend + IAM user; rotated/deactivated immediately after | §12.5 forbids long-lived creds; the bootstrap needed one `aws iam` call before the spike user + rotated key could take over | Spike achieves real `terraform plan` against AWS without violating the locked target after bootstrap. **CLOSED 2026-07-21: root key `AKIA…ROOT-DEACTIVATED` deactivated by the user in the AWS IAM console (verified — `InvalidClientTokenId`); the spike uses the rotated `acdl-spike-runner` key per D-039. Key ID redacted in v1.2 Phase 12 (P1-1).** |
+| D-035 | Milestone version = `v1.1` (feature), ship tag `v1.2.0` | Real platform is a breaking reframing of the demo, but treated as the next incremental milestone per user choice; ship.md: feature milestone → next minor | Tag `v1.2.0` on milestone COMPLETE |
+| D-036 | Spike picks `l1-s3` + `l2-static-asset` | Simplest real AWS resource (no IAM/network deps); smallest real `terraform plan`; proves the IR + adapter end-to-end | Spike scope fixed |
+| D-037 | Demo archived to `demo/` (not deleted) | Preserves the working v1.0 demo as intent reference; new platform layout under `platform/`, `schemas/`, `adapters/`, `terraform/`, `modules-ir/` | No churn on demo code; clean separation |
+| D-038 | Open decisions resolved in "accept recommendations + decide rest" mode | User-locked mode: accept architecture's stated recommendations (W1.A, W1.B, W2.A, BA.A); lead-developer decides the remaining 8 (W3.D, W3.E, BA.B, BA.C, BA.D, BA.E, BA.F, OpenTofu timing) with rationale | Architecture reaches v1.0 in Phase 07 |
+| D-039 | Spike-only waiver: per-run-rotated long-lived AWS key. OIDC federation deferred to v1.2, blocked on go-gitea/gitea#36988. | **RESEARCH TARGET 1 verdict (conf 0.95):** Gitea Actions does NOT support `id-token: write` / OIDC token issuance as of Gitea 1.27.x / gitea-runner v2.1.0. GitHub's OIDC pattern is not portable. The waiver satisfies §12.5's *intent* (no persistent long-lived key) for the spike: the key is rotated after each run by `scripts/rotate_spike_key.sh`. v1.2 implements real OIDC when the Gitea PR merges. | Spike achieves real `terraform plan` against AWS without a *persistently* long-lived key; real OIDC is a v1.2 deliverable |
+| D-040 | The 6 confidence-signal inputs are: policy (0.30), validation (0.25), freshness (0.10), source (0.15), history (0.10), nfrs (0.10). Weights frozen for v1, tuned in v1.2 alongside thresholds (BA.B). | Architecture §8 locks "six canonical inputs" but does not enumerate them; RESEARCH TARGET 6 chose the platform-computable subset present in every environment (incl. dev). | Confidence signal (Phase 10) has a concrete input enumeration |
+| D-041 | Spike audit ledger = v1.0 hash chain + DynamoDB outbox + `acdl-evidence` mirror. S3 Object Lock (compliance mode, 7-yr) + JWS (platform KMS key, quarterly rotation) + daily checkpoints are v1.2 build-out, authored as design in Phase 07. | REQ-20 is "design authored," not "implemented." The spike proves the outbox write path; the regulatory ledger is v1.2. | Spike scope stays bounded; REQ-20 satisfied by the Phase 07 design doc |
+| D-042 | HITL approver identity in Gitea = `gitea.actor` of the `workflow_dispatch` run that sets `approve_qa=true`/`approve_prod=true`/`approve_dr=true`. Separation-of-duties reads `approver_qa` from the DynamoDB outbox and compares to the prod-dispatch `gitea.actor`. | Gitea has no Environments API (re-confirmed in RESEARCH); `gitea.actor` is the only approval-identity signal. | SoD design (Phase 07) is concrete for the Gitea forge |
+| D-043 | Tag/naming compliance deferred for the spike: the Checkov adapter emits a single `SKIPPED` PolicyCheckResult (`ruleId: ACDL_TAG_NAMING`, `severity: info`) so the confidence policy input is non-empty. Custom Checkov YAML rule lands in v1.2. | Checkov has no built-in tag-presence check; a custom rule in the spike is scope creep. | Spike's policy input is non-empty without a custom-rule dependency |
+| D-044 | DynamoDB outbox = `PAY_PER_REQUEST`; PK `contractId`, SK `eventType#eventTs`, TTL `expire_at` = now + 365d. No separate async worker/DLQ in the spike (RTO = workflow re-run); v1.2 outbox worker + DLQ is a Phase 07 design artifact. | On-demand is zero-cost-at-idle for the spike's single dev submission. | Spike outbox is minimal; v1.2 worker design authored in Phase 07 |
+| D-045 | Runner tooling: `runs-on: ubuntu-latest`; install `terraform` via HashiCorp apt repo (pin `1.9.*`), `checkov` via pip (pin `>=3.2,<4`, `--break-system-packages`). Neither is pre-installed on the default runner image. | RESEARCH TARGET 2; pinning avoids mid-spike version drift. | Phase 09/10 workflows have a concrete setup step |
+| D-046 | `act_runner` → `gitea-runner` rename: Phase 07 updates docs to use the current name `gitea-runner` (renamed 2026-04 in gitea/runner#850). | RESEARCH TARGET 1 + R-4: naming drift between v1.0 docs and the current runner. | Docs reflect the current binary name |
+| D-047 | v1.2 carries forward the D-039 per-run-rotated-key waiver. Real OIDC federation remains deferred to v1.3+, blocked on go-gitea/gitea#36988 (re-checked 2026-07-21: still **open**, last updated 2026-05-27, not merged). | §12.5 forbids long-lived creds; the Gitea Actions OIDC provider is still not merged. The waiver continues to satisfy §12.5's *intent* (no *persistently* long-lived key) for v1.2: `scripts/rotate_spike_key.sh` rotates the key, and Phase 12 tightens the IAM scoping + rotation hygiene. | v1.2 achieves `terraform apply` against AWS without a persistently long-lived key; real OIDC is a v1.3+ deliverable. |
+
+### Open-decision resolutions (Phase 07 deliverable — recorded here for traceability)
+
+| ID | Question | Resolution |
+|---|---|---|
+| W1.A | AI-refinement trigger | **Accept recommendation.** Joint condition: N ≥ 50 consecutive changes with zero rollbacks AND no L1/L2 incident in last 6 months AND Infra & Ops unilateral override. |
+| W1.B | Multi-stack edge case rule | **Accept recommendation.** Permitted only for (a) DR-region mirror, (b) time-boxed experimental stack with TTL ≤ 30d, (c) explicit Infra & Ops approval with `multiStack.justification`. |
+| W2.A | Tag mutability for prod | **Accept recommendation (Path B).** Tag for dev/qa, SHA for prod. Platform CLI resolves tag→SHA for prod-bound workflows. Justified by the "Audit truth lives outside the repository" bet. |
+| BA.A | Initial L3B skill catalog | **Accept recommendation.** 5 skills: web API, worker, scheduled job, static asset, basic observability bootstrap. Addition criteria: (a) reviewable for sensitive data, (b) expressible as a single contract submission, (c) documented use case. |
+| W3.D | L1/L2 standard versioning | **Decided.** Semver: interface → MAJOR, behavior → MINOR, lifecycle → PATCH (same as the v1.0 demo D-rule, lifted to the real platform). Pin model: L2 contracts pin L1 by `name@semver`; the resolver picks the highest compatible. Evolution: MAJOR bumps require a new registry entry (immutable publication); old entry enters a 12-month deprecation window. |
+| W3.E | Schema mandatory vs optional inputs | **Decided.** Per-env mandatory table: dev requires `stack` + `environment`; qa adds `validation.e2eSuite` + `validation.loadTest`; prod adds `runbook` + `dashboard` + `oncall`; dr adds `drDrillRef`. `inputs` map is always optional. `profile: agentic` fields (`naturalLanguageIntent`, `confidenceAtSubmission`, `agentTrace`) optional everywhere. |
+| BA.B | Confidence threshold tuning | **Decided.** Starting thresholds frozen for v1. Tuning begins in v1.2: track FP/FN per environment quarterly; override authority = Infra & Ops + SRE joint sign-off; any override is itself a confidence-event in the audit stream. |
+| BA.C | On-call / operational ownership | **Decided.** Platform on-call = Infra & Ops rotation. Escalation: L3A/L3B halt → platform on-call pager (Sev2); consumer-visible outage → consumer on-call (Sev1) with platform on-call support. Consumer on-call relationship is contractual, defined at onboarding (BA.E). |
+| BA.D | Cost / capacity governance | **Decided.** Cloud cost owner = Infra & Ops FinOps. Per-contract consumption reported monthly. Runaway spend: hard halt at 120% of contract-declared budget envelope via the confidence signal (cost is one of the 6 inputs); override = FinOps + SRE joint sign-off. |
+| BA.E | Consumer onboarding | **Decided.** Two paths: developer (L3A) — `getting-started` walks through contract schema + central pipeline template; citizen developer (L3B) — onboarding grants a scoped agent + skill catalog, no workflow authoring. Both end in a sandbox dev submission that must pass the confidence gate before the consumer is promoted. |
+| BA.F | Cross-platform evolution | **Decided.** The contract schema, IR, PolicyCheckResult, confidence signal, and audit stream are portable (substrate- and forge-agnostic). Forge-specific code: workflow YAML, OIDC trust, CODEOWNERS, Environments. A second forge (e.g., GitLab) requires a forge adapter + a workflow-template translator; no change to L1/L2/IR/confidence/audit. |
+| Q1.3 | OpenTofu timing | **Decided (deferred).** Not in v1 or v1.1. The substrate abstraction (§12) makes OpenTofu a future adapter, not an architecture change. Revisit when an OpenTofu adapter is requested; no version committed. |
+
+## Appendix — Prior milestone (v1.0 demo) decisions
+
+The v1.0 demo (tag `v1.1.0`) carried decisions D-001..D-033. They governed
+the stub-driven executive demo and remain valid **for the archived demo
+under `demo/`**. They are **superseded** by the v1.1 decisions above for the
+real platform. Full text preserved in git history at tag `v1.1.0`.
+
+## Operational parameters (CLARIFY auto-resolution, full autonomy)
+
+Resolved at the CLARIFY stage to unblock planning. None require user
+sign-off (autonomy = full; all within locked constraints).
+
+| Parameter | Value | Rationale |
+|---|---|---|
+| AWS region | `us-east-1` | Default; matches v1.0 demo references; single-region in v1 (§12.3) |
+| Terraform state bucket | `acdl-tfstate-<account-id>-us-east-1` | Namespaced by account id to avoid collision; region-suffixed |
+| Terraform lock table | `acdl-tflock` | DynamoDB; single-region v1 |
+| OIDC IAM role | `acdl-act-runner-role` | Assumed by the act_runner via web-identity |
+| OIDC trust subject | `repo:continuous-intelligence/acdl:ref:refs/heads/main` (+ phase branches) | Least-privilege; refined in Phase 08 |
+| Spike L1 (`l1-s3`) inputs | `bucket_name: string`, `region: string` | Minimal S3 interface per §2 |
+| Spike L2 (`l2-static-asset`) | thin-composition referencing `l1-s3` only; depth 1 | Smallest real plan per D-036 |
+| Spike contract | `contracts/spike.yaml`: `stack: l2-static-asset`, `environment: dev`, `inputs: { bucket_name: acdl-spike-bucket, region: us-east-1 }` | One end-to-end submission (REQ-27) |
+| Spike `terraform` command | `plan` only | `apply` is out of scope (Out of Scope table); HITL-gated in v1.2 |
+| Checkov ruleset (spike) | the 4 L2 checks (secrets-in-plaintext, public ingress, IAM wildcard, KMS key reference) + tag/naming | §3 + §12.4; Kyverno/OPA deferred |
+| v1.0 tags preserved | `v1.0.1`..`v1.0.5`, `v1.1.0` retained | Immutability; demo archive does not rewrite history |
+| Next ship tag | `v1.3.0` | Feature milestone → next minor per ship.md (v1.1 shipped `v1.2.0`; v1.2 ships `v1.3.0`) |
+
+### Items deferred to RESEARCH (not clarifications)
+
+- **Gitea/act_runner OIDC support** — does act_runner emit an OIDC
+  `id-token`? Determines whether real-AWS plan is achievable in this
+  environment or whether a spike-only waiver is needed. Highest-priority
+  research target.
+- **Terraform + Checkov availability on the runner image** — install in the
+  workflow if missing.
+- **`actions/configure-aws-credentials` action on act_runner** — if
+  unavailable, fall back to `aws sts assume-role-with-web-identity` from a
+  step.

.ciagent/REQUIREMENTS.md

@@ -35,7 +35,92 @@
 
 (None — v1 covers the complete demo.)
 
-## Clarifications (Phase 01)
+## v1.1 (Prior milestone — architecture finalization + v1 spike, complete)
+
+### Category: Architecture Finalization
+- **REQ-16:** Architecture reaches v1.0 — all 11 open decisions in `docs/architecture.md` §13 are resolved and recorded in `PROJECT.md` (W1.A, W1.B, W2.A, W3.D, W3.E, BA.A–F, OpenTofu timing).
+- **REQ-17:** Target Stack IR is defined as a JSON Schema under `schemas/ir.schema.json`; substrate-agnostic (resources, relationships, composition max-depth-5, policy hooks).
+- **REQ-18:** `PolicyCheckResult` normalized schema is defined under `schemas/policy_check_result.schema.json`; a Checkov adapter translates Checkov JSON to this schema.
+- **REQ-19:** Six-input confidence signal is specified under `platform/confidence_signal.py` with per-env thresholds (dev 0.50 / qa 0.75 / prod 0.90 / dr 0.95) and severity→penalty mapping (critical=hard override, high=-0.2, medium=-0.05, low=-0.01, info=0.0).
+- **REQ-20:** Tiered audit ledger design is authored: S3 Object Lock (compliance mode, 7-yr) + DynamoDB outbox (RPO=0, JWS detached signatures, `prev_event_hash` chain, daily checkpoints).
+- **REQ-21:** Full 8-concern HITL matrix + separation-of-duties design is authored (CODEOWNERS routing + DynamoDB identity-distinctness check; pre-execution gate model; 1d warn / 2d freeze timeout).
+- **REQ-22:** Contract schema (JSON Schema draft 2020-12) is defined under `schemas/contract.schema.json` with per-env mandatory/optional inputs (W3.E) and `profile: agentic` marker for L3B fields.
+
+### Category: AWS OIDC Bootstrap
+- **REQ-23:** AWS auth bootstrap + state backend for the spike: an S3 state bucket + DynamoDB lock/outbox table + an IAM user with a minimal scoped policy (S3 + DynamoDB + plan-only). The temporary long-lived key is used once (waiver D-034) then rotated via `scripts/rotate_spike_key.sh` after each spike run (D-039). **Real OIDC federation is deferred to v1.2** — Gitea Actions does not support `id-token: write` (RESEARCH TARGET 1, conf 0.95), blocked on go-gitea/gitea#36988.
+
+### Category: v1 Spike — IR, L1, Adapter
+- **REQ-24:** One real L1 module `l1-s3` exists under `modules-ir/l1/l1-s3/` with an IR-typed interface (typed inputs/outputs/NFRs) registered in the L1 registry.
+- **REQ-25:** One real L2 thin-composition `l2-static-asset` exists under `modules-ir/l2/l2-static-asset/` referencing `l1-s3` only (depth 1, within max-depth-5).
+- **REQ-26:** The Terraform adapter (`adapters/terraform/`) compiles the IR-typed L1 interface to Terraform `variable`/`output` blocks and the L2 thin-composition tree to a Terraform root module; it emits a real `terraform plan` against AWS via OIDC; state is stored in S3 + DynamoDB.
+
+### Category: v1 Spike — End-to-End
+- **REQ-27:** One end-to-end contract submission (`contracts/spike.yaml` for `l2-static-asset`) flows through: contract schema validation → contract→IR resolution → `terraform plan` (real AWS) → Checkov `PolicyCheckResult` → confidence signal → evidence event written to the DynamoDB outbox.
+- **REQ-28:** Spike verification (`scripts/verify_phase10.sh`) proves the IR-shaped commitments hold: the adapter is the only substrate-specific code; no polyglot mess; the L1 content, contract YML, and thin-composition tree are substrate-agnostic.
+
+## Out of Scope (v1.1)
+
+| Feature | Reason |
+|---------|--------|
+| Full HITL matrix wiring (qa/prod/dr) | Spike is dev-only (`terraform plan`); HITL wiring is v1.2. |
+| Kyverno + OPA policy engines | Spike uses Checkov only; Kyverno/OPA are v1.2. |
+| MCP skill catalog + real L3B agent | L3B spike = a single stub contract submission; the 5-skill catalog is v1.2. |
+| GitOps reconciler (ArgoCD/Flux) | v1.2. |
+| Multi-region state / outbox | Single-region in v1 (§9, §12.3). |
+| Prod/dr environments | v1.2. |
+| Terraform `apply` (real provisioning) | Spike runs `plan` only; `apply` is gated by HITL in v1.2. |
+
+## v1.2 (Prior milestone — platform hardening + first real consumer deployment, complete, tag `v1.3.0`)
+
+### Category: Documentation & Simplification
+- **REQ-29:** `README.md` is fully rewritten to reflect the v1.1-complete platform: the actual spike flow (contract → IR → `terraform plan` → Checkov → confidence signal → outbox), how to run it (`scripts/run_platform.sh`), the real repo layout (`acdl_platform/`, `schemas/`, `adapters/`, `terraform/`, `modules-ir/`, `contracts/`, `demo/`), and the v1.2 objective. No stale "v1.1 (active)" framing.
+- **REQ-30:** NFR hardening of the v1.1 spike: (a) `terraform/bootstrap/spike_runner_policy.json` audited to least-privilege (S3 + DynamoDB + ECS + ECR + ELB + IAM plan-only, no wildcards beyond the documented exceptions); (b) `create_state_backend.py` and `create_iam_user.py` are idempotent (re-running exits 0 without duplicating resources); (c) `run_spike_plan.sh` + `run_spike_e2e.sh` consolidated into a single `scripts/run_platform.sh` with proper exit codes and error handling; (d) P1-1 carried forward from the v1.1 audit — the two AWS access key IDs in `.ciagent/VERIFY.md` Phase 09 narrative are redacted to placeholders; (e) any remaining stale `platform/` paths in `.ciagent/` are corrected to `acdl_platform/`.
+
+### Category: L1 Catalog Expansion (ECS Fargate)
+- **REQ-31:** Six new IR-typed L1 modules exist under `modules-ir/l1/` and are registered in `modules-ir/registry.json`: `l1-vpc` (VPC + subnets + route tables), `l1-ecs-cluster` (ECS Fargate cluster), `l1-ecs-service` (ECS service + task definition), `l1-iam-role` (task execution + task role), `l1-alb` (application load balancer + listener + target group), `l1-ecr` (ECR repository). Each has an `interface.json` valid against `schemas/ir.schema.json` and produces a valid `terraform plan` fragment via the Terraform adapter. The adapter `TYPE_MAP` is expanded to cover all six IR resource types.
+
+### Category: L2 Composition & Contract Schema
+- **REQ-32:** `l2-microservice` thin-composition exists under `modules-ir/l2/l2-microservice/` referencing the six ECS L1s (depth ≤ 5, within max-depth-5). `schemas/contract.schema.json` is extended with microservice inputs (`image: string`, `port: integer`, `env: map`, `healthcheck: object`) and validates a `contracts/microservice.yaml` submission. Contract→IR resolution (`acdl_platform/contract_resolver.py`) yields a complete target stack for `l2-microservice`.
+
+### Category: Real Provisioning
+- **REQ-33:** The platform runs `terraform apply` (not just `plan`) for the `dev` environment, autonomous per §10 (confidence ≥ 0.50, no HITL). The apply creates real AWS resources (VPC, ECS cluster, ECR repo, ALB, ECS service) and the result is captured in the evidence stream. `apply` for qa/prod/dr remains HITL-gated and out of scope for v1.2.
+
+### Category: Consumer Repo
+- **REQ-34:** A new Gitea repo `acdl-consumer-microservice` exists under the `continuous-intelligence` org, containing: a basic HTTP microservice (e.g., a tiny Python/Go server returning 200), a `Dockerfile`, an ECR push step, and a `contracts/microservice.yaml` submission for `l2-microservice` (dev environment).
+
+### Category: End-to-End Verification
+- **REQ-35:** One end-to-end flow: consumer commit to `acdl-consumer-microservice` → pipeline triggered → contract→IR resolution → `terraform plan` → `terraform apply` (dev) → a live ECS Fargate service serving HTTP 200 on its ALB → evidence event written to the DynamoDB outbox → the event renders on the `acdl-evidence` timeline. `scripts/verify_phase16.sh` proves the full flow green.
+
+## v1.3 (Prior — module documentation + thin-composition removal, complete)
+
+### Category: Thin-Composition Removal
+- **REQ-36:** The L2 thin-composition layer is removed completely: `composition.json` files, `acdl_platform/contract_resolver.py`, `schemas/contract.schema.json`, `contracts/spike.yaml`, `contracts/microservice.yaml`, and L2 entries in `modules-ir/registry.json` are deleted. The L2 directories are kept as placeholders with READMEs. The downstream pipeline (adapter → checkov → confidence → outbox) is patched to load a pre-existing IR instance instead of resolving a contract.
+- **REQ-37:** A `modules-ir/README-TEMPLATE.md` exists that works for both L1 and L2 modules, written in plain language (no jargon), with sections for Overview, Resources, Inputs, Outputs, Usage, Compliance extension points, and Versioning.
+- **REQ-38:** Every module has a `README.md`: the 7 L1 modules have full READMEs with Resources/Inputs/Outputs/Usage/Compliance-extension-points/Versioning sections derived from their `interface.json`; the 2 L2 modules have placeholder READMEs noting the composition is under redesign. A `modules-ir/README.md` catalog index lists all modules with one-line descriptions and links.
+
+### Category: Testing
+- **REQ-39:** A pytest test suite exists under `tests/` covering the platform components offline (no AWS, no Checkov, no DynamoDB): the Terraform adapter (`adapters/terraform/adapter.py`), the confidence signal (`acdl_platform/confidence_signal.py`), the Checkov adapter (`adapters/terraform/policy/checkov_adapter.py`), and the outbox writer (`acdl_platform/outbox_writer.py`). The suite validates the IR schema, registry, spike_instance, and adapter output structure. `pyproject.toml` + `requirements-test.txt` pin test dependencies (pytest, jsonschema, pyyaml, boto3-stubs or moto for outbox mocking).
+
+### Category: Shell Reproducibility
+- **REQ-40:** `scripts/run_platform.sh` has a `--check-only` mode that runs offline: loads the pre-existing IR instance, runs the adapter to emit Terraform, validates the JSON structure — without AWS credentials, Checkov, or DynamoDB. The existing `--plan-only` and full modes continue to require AWS. The `--check-only` mode is what CI pipelines run.
+
+### Category: CI/CD Pipelines
+- **REQ-41:** Identical CI/CD pipelines exist for both Gitea Actions (`.gitea/workflows/ci.yml`, dev environment) and GitHub Actions (`.github/workflows/ci.yml`, production). Both run the same three stages: (1) lint — `py_compile` all Python files, (2) test — `pytest`, (3) check-only — `bash scripts/run_platform.sh --check-only`. Both trigger on push to main + pull request. Both use `ubuntu-latest`. Identical outcomes — the only difference is the runner environment.
+
+- **REQ-42:** `pyproject.toml` exists at the repo root with pytest configuration (testpaths, markers) and the project metadata. `requirements-test.txt` pins test-only dependencies separate from runtime dependencies.
+
+## v1.4 (Active — central pipeline contract + shell reproducibility + streaming)
+
+### Category: Central Pipeline Contract
+- **REQ-43:** A central pipeline contract exists as `schemas/pipeline.schema.json` (JSON Schema draft 2020-12) + `pipelines/ci.yaml` (YAML instance). The contract declares the pipeline name, triggers (push/PR branches), runner, Python version, and stages (name + command + required + install + description). Both `.gitea/workflows/ci.yml` (Gitea Actions, dev) and `.github/workflows/ci.yml` (GitHub Actions, production) implement the same stages, commands, triggers, and runner as declared in the contract. A test (`tests/test_pipeline_contract.py`) validates the contract against the schema and asserts both workflows conform (same jobs, same commands, same triggers, same runner, byte-identical).
+
+### Category: Shell Reproducibility
+- **REQ-44:** `scripts/run_ci.sh` reproduces the CI pipeline locally — runs the same 3 stages (lint, test, check-only) in sequence with proper exit codes, failing on first error. The script exits 0 with "CI PIPELINE OK" on success. A `--quiet` flag suppresses per-stage banners. The script mirrors the central pipeline contract (`pipelines/ci.yaml`) so the shell and CI environments produce identical outcomes.
+
+### Category: Pipeline Streaming
+- **REQ-45:** `scripts/run_platform.sh` streams output by default: terraform init/validate/plan output is piped to stdout via `tee` (visible to the user and logged), Checkov results are printed in human-readable form, and PolicyCheckResult records are displayed with severity, rule ID, and pass/fail status per record. The `--check-only` mode streams the emitted Terraform file content. A `--quiet` flag suppresses streaming (output to log files only) for backwards compatibility. Both gitea and github workflows are byte-identical (identical outcomes — the only difference is the forge runtime).
+
+## Out of Scope (v1.2)
 
 | REQ | Original criterion | Clarified criterion (effective) | Decision |
 |-----|--------------------|----------------------------------|----------|
@@ -43,7 +128,7 @@
 | REQ-10 | "Pages returns 200 with placeholder `index.html`" on `acdl-evidence` | Gitea has no Pages; substitute: an HTTP GET against the raw file URL `https://git.cloudinit.dev/continuous-intelligence/acdl-evidence/raw/branch/main/index.html` returns 200 with the placeholder HTML body | D-012, D-016 |
 | REQ-10 | "`qa` and `prod` environments exist on `acdl-contracts`" | Gitea has no environments API and ignores `environment:` blocks; substitute: the reusable workflow defines `qa-gate` and `prod-gate` jobs gated by `workflow_dispatch` approval inputs (D-004 fallback); a `qa` and `prod` branch may be created on `acdl-contracts` as a visible stand-in for environments | D-013 |
 
-## Out of Scope
+## Out of Scope (v1.0 demo — retained for history)
 
 | Feature | Reason |
 |---------|--------|
@@ -55,6 +140,8 @@
 
 ## Traceability
 
+### v1.0 (prior — demo)
+
 | Requirement | Phase | Status |
 |-------------|-------|--------|
 | REQ-01 | 1 | complete (v1.0.1) |
@@ -71,4 +158,54 @@
 | REQ-12 | 4 | complete (v1.0.4) |
 | REQ-13 | 5 | complete (v1.0.5) |
 | REQ-14 | 5 | complete (v1.0.5) |
-| REQ-15 | 5 | complete (v1.0.5) |
+| REQ-15 | 5 | complete (v1.0.5) |
+
+### v1.1 (prior — architecture finalization + v1 spike, complete)
+
+| Requirement | Phase | Status |
+|-------------|-------|--------|
+| REQ-16 | 07 | complete (v1.1.2) |
+| REQ-17 | 07 | complete (v1.1.2) |
+| REQ-18 | 07 | complete (v1.1.2) |
+| REQ-19 | 07 | complete (v1.1.2) |
+| REQ-20 | 07 | complete (v1.1.2) |
+| REQ-21 | 07 | complete (v1.1.2) |
+| REQ-22 | 07 | complete (v1.1.2) |
+| REQ-23 | 08 | complete (v1.1.3) |
+| REQ-24 | 09 | complete (v1.1.4) |
+| REQ-25 | 10 | complete (v1.1.5) |
+| REQ-26 | 09 | complete (v1.1.4) |
+| REQ-27 | 10 | complete (v1.1.5) |
+| REQ-28 | 10 | complete (v1.1.5) |
+
+### v1.2 (prior — platform hardening + first real consumer deployment, complete)
+
+| Requirement | Phase | Status |
+|-------------|-------|--------|
+| REQ-29 | 11 | complete (v1.2.1) |
+| REQ-30 | 12 | complete (v1.2.2) |
+| REQ-31 | 13 | complete (v1.2.3) |
+| REQ-32 | 14 | complete (v1.2.4) |
+| REQ-33 | 15 | partial (v1.2.5, IAM-blocked) |
+| REQ-34 | 15 | complete (v1.2.5) |
+| REQ-35 | 16 | partial (v1.2.6, IAM-blocked) |
+
+### v1.3 (prior — module documentation + thin-composition removal, complete)
+
+| Requirement | Phase | Status |
+|-------------|-------|--------|
+| REQ-36 | 17 | complete (v1.3.1) |
+| REQ-37 | 17 | complete (v1.3.1) |
+| REQ-38 | 17 | complete (v1.3.1) |
+| REQ-39 | 18 | complete (v1.3.2) |
+| REQ-40 | 18 | complete (v1.3.2) |
+| REQ-41 | 18 | complete (v1.3.2) |
+| REQ-42 | 18 | complete (v1.3.2) |
+
+### v1.4 (active — central pipeline contract + shell reproducibility + streaming)
+
+| Requirement | Phase | Status |
+|-------------|-------|--------|
+| REQ-43 | 19 | complete (v1.4.1) |
+| REQ-44 | 19 | complete (v1.4.1) |
+| REQ-45 | 19 | complete (v1.4.1) |

.ciagent/REVIEW.md

@@ -0,0 +1,106 @@
+# ACDL v1.2 Milestone — Multi-Persona Code Review
+
+**Reviewer:** ci-code-reviewer (model: glm-5.2)
+**Scope:** v1.2 milestone — Phases 11–16 (tags v1.2.1..v1.2.6), diff `v1.2.0..HEAD`
+**Date:** 2026-07-21
+**Verdict:** **READY TO SHIP** — 1 P0 (operator action, non-code), 1 P1 (adapter hardening for v1.3)
+
+---
+
+## Summary
+
+v1.2 hardens the v1.1 spike, simplifies the setup, rewrites the docs, and
+takes the platform to a real ECS Fargate microservice deployment. 6 phases
+shipped (v1.2.1–v1.2.6): research + README, NFR hardening + simplification,
+6 ECS L1s + adapter generalization, l2-microservice + contract schema +
+resolver wiring, consumer repo + terraform apply (blocked by IAM),
+capstone e2e.
+
+## P0 issues
+
+### P0-IAM (operator action, NOT a code fix)
+**The `terraform apply` (Phase 15) is blocked by the live IAM policy.** The
+Phase 12 `spike_runner_policy.json` expansion (ECS/ECR/ELB/IAM/EC2) was
+committed to the repo but never pushed to the live AWS account — the root
+key was deactivated per D-034, and the `acdl-spike-runner` user cannot
+self-elevate via `iam:PutUserPolicy`.
+
+**Unblock step (operator):**
+```bash
+ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID=<root-or-admin-key> \
+ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY=<root-or-admin-secret> \
+python3 terraform/bootstrap/create_iam_user.py
+```
+This re-PUTs the expanded policy (idempotent). Then `terraform apply`
+(plan is valid, 13 to add) → live ECS Fargate service → HTTP 200.
+
+**Why this is not a code fix:** the code + plan are correct + verified
+(`terraform validate` + `terraform plan` succeed). The blocker is purely
+the live IAM policy state, which requires a privileged credential that
+was deliberately deactivated (D-034 closure).
+
+## P1 issues
+
+### P1-1 (adapter hardening, deferred to v1.3)
+The adapter's ECS/ALB/VPC emission includes several resource-type-specific
+defaults (`desired_count = 1`, `launch_type = "FARGATE"`, `target_type = "ip"`,
+`load_balancer_type = "application"`, `tags = { Name = ... }`, `family = "app"`).
+These are pragmatic for the v1.2 spike but should be parameterized via the
+L1 interfaces in v1.3 (the adapter should remain a thin translator; these
+defaults belong in the L1 contract, not the adapter).
+
+## Per-lens review
+
+### Correctness
+- The contract→IR→adapter pipeline produces valid HCL (`terraform validate`
+  passes; `terraform plan` succeeds with 13 to add).
+- The v1.1 S3 regression passes (byte-identical `main.tf`) across all
+  adapter changes (ref emission, JSON-string detection, ECS service
+  network_configuration/load_balancer, listener default_action, target
+  group defaults, VPC tags, IGW emission, managed_policy_arns).
+- The `intra_refs` mechanism (L1-declared refs between sub-resources of
+  the same L1) correctly resolves subnet→vpc.vpc_id + routetable→vpc.vpc_id.
+- The resolver's array-form wires + child→child `ref:` emission are
+  backward-compatible (v1.1 single-object wires still work).
+
+### Testing
+- 6 per-phase verify scripts (`verify_phase11.sh`..`verify_phase16.sh`),
+  all green.
+- The capstone verify (`verify_phase16.sh`) exercises every v1.2
+  deliverable + the v1.1 regression + NFR + docs + L1 catalog + outbox.
+- The `terraform apply` + HTTP 200 check are the operator's post-unblock
+  step (documented in Phase 15/16 VERIFY).
+
+### Security
+- No credentials introduced. The `P1-1` AWS key ID redaction (carried from
+  v1.1) is closed — no live key IDs in `.ciagent/`.
+- The IAM blocker is a security positive: least-privilege enforced; the
+  policy push requires a deliberate privileged action.
+- The `assume_role_policy` in the contract is the standard ECS task
+  execution trust policy (not a secret).
+
+### Performance
+- N/A (this milestone is about correctness + simplification, not perf).
+
+### Maintainability
+- `run_platform.sh` consolidates two scripts (D-048) — one entry point.
+- The adapter's `TYPE_MAP` + `INPUT_MAP` + `OUTPUT_MAP` tables make adding
+  future L1s a table-extension, not new emit logic.
+- The `intra_refs` mechanism is a clean L1-declared extension.
+
+### Adversarial
+- The `terraform apply` failure was investigated thoroughly: the subagent
+  attempted one fix (adapter HCL correctness), then correctly identified
+  the IAM root cause + documented the unblock step. No half-applied AWS
+  state (all 5 creates failed at the API; state is empty).
+- The `TERRAFORM_APPLY_BLOCKED` + `MILESTONE_CAPSTONE_VERIFIED` evidence
+  events truthfully record the state (not faking success).
+
+## Conclusion
+
+v1.2 is READY TO SHIP. The 1 P0 is an operator action (not a code fix), and
+the 1 P1 is deferred to v1.3. The milestone's code is complete + verified:
+the platform flow works end-to-end up to `terraform plan` (13 to add), and
+the one remaining step (`terraform apply` → live ECS service) is the
+operator's IAM policy push. Ship tag: `v1.3.0` (feature milestone, next
+minor per ship.md — v1.1 shipped `v1.2.0`).

.ciagent/ROADMAP.md

@@ -2,7 +2,21 @@
 
 ## Overview
 
-Five-phase breakdown to take ACDL from empty repo to a reproducible 4-act executive demo. Milestone `v1.0-initial` covers the full demo build. Each phase produces a runnable increment and ends with a phase-completion commit + tag.
+- **v1.0 (demo):** complete — tag `v1.1.0`, 2026-07-21. All 5 phases shipped + audited PASS.
+- **v1.1 (complete):** architecture finalization + v1 spike. 5 phases (06–10). Tag `v1.2.0`, 2026-07-21. All 5 phases shipped + verified; review READY TO SHIP (0 P0); audit CLEAN. Gitea release id 202.
+- **v1.2 (complete):** platform hardening + first real consumer deployment. 6 phases (11–16). Tag `v1.3.0`, 2026-07-21. All 6 phases shipped + verified; review READY TO SHIP (1 P0 operator action, 1 P1 deferred); audit CLEAN.
+- **v1.3 (complete):** module documentation + thin-composition removal. The L2 composition layer is removed; module READMEs are built out. Tag `v1.3.2`.
+- **v1.4 (active):** central pipeline contract + shell reproducibility + output streaming. A declarative pipeline contract (`schemas/pipeline.schema.json` + `pipelines/ci.yaml`) binds the Gitea and GitHub workflows to a single source of truth. `scripts/run_ci.sh` mirrors the CI pipeline locally. `scripts/run_platform.sh` streams terraform/checkov output by default.
+- **v1.0 demo URL:** https://git.cloudinit.dev/continuous-intelligence/acdl-evidence/raw/branch/main/index.html
+
+---
+
+## v1.0 (Prior — the demo, complete)
+
+Five-phase breakdown that took ACDL from empty repo to a reproducible 4-act
+executive demo. Milestone `v1.0-initial` covered the full demo build. Each
+phase produced a runnable increment and ended with a phase-completion commit
++ tag. All phases complete; demo archived to `demo/` in v1.1 Phase 06.
 
 ## Phases
 
@@ -56,4 +70,209 @@ Five-phase breakdown to take ACDL from empty repo to a reproducible 4-act execut
   - Pages timeline renders events from `audit.json`.
   - Act 2: valid contract passes through all gates; timeline shows the full flow.
   - Act 3: Issue text produces the expected `l2-commodity-price-feed` contract and triggers the pipeline.
-  - Act 4: malicious `public-ingress: true` contract halts in Dev with confidence < 0.50 and a visible rejection reason on the timeline.
+  - Act 4: malicious `public-ingress: true` contract halts in Dev with confidence < 0.50 and a visible rejection reason on the timeline.
+
+---
+
+## v1.1 (Complete — architecture finalization + v1 spike, 2026-07-21, tag `v1.2.0`)
+
+Five-phase breakdown to finalize the architecture to v1.0 and prove the
+locked commitments with one end-to-end implementation spike. Milestone
+`v1.1-spike` covered the real platform's first materialization. Ship tag
+at milestone COMPLETE: **`v1.2.0`** (feature milestone, next minor per
+ship.md). **Status: COMPLETE — all 5 phases shipped (v1.1.1..v1.1.5) +
+verified; review READY TO SHIP (0 P0); audit CLEAN; Gitea release id 202.
+D-034 closed (root key deactivated by user).**
+
+### Phase 06 — archive-demo-and-reorient
+- **Description:** Move the v1.0 demo (`modules/`, `scripts/`, `evidence-ui/`, `contracts/`, demo `.gitea/workflows/`) to `demo/`. Establish the new repo layout (`platform/`, `schemas/`, `adapters/`, `terraform/`, `modules-ir/`). Rewrite README to reflect the real platform. Verify the demo still runs from `demo/` (regression check).
+- **Status:** complete (v1.1.1)
+- **Depends on:** —
+- **Requirements:** (no new REQ; repo hygiene)
+- **Success Criteria:**
+  - `demo/` contains the full v1.0 demo; `demo/scripts/run_demo.sh --no-upload` still exits 0.
+  - New top-level dirs exist and are empty-but-scaffolded: `platform/`, `schemas/`, `adapters/`, `terraform/`, `modules-ir/`.
+  - README reflects the real platform (vision + architecture links, new layout).
+
+### Phase 07 — architecture-v1-finalization
+- **Description:** Resolve the 11 open decisions in `docs/architecture.md` §13 (already recorded in `PROJECT.md`). Author the locked schemas + designs: `schemas/ir.schema.json` (REQ-17), `schemas/policy_check_result.schema.json` (REQ-18), `schemas/contract.schema.json` (REQ-22), `platform/confidence_signal.py` spec (REQ-19), `platform/audit_ledger_design.md` (REQ-20), `platform/hitl_matrix_design.md` (REQ-21). Mark architecture v1.0.
+- **Status:** complete (v1.1.2)
+- **Depends on:** [06]
+- **Requirements:** REQ-16, REQ-17, REQ-18, REQ-19, REQ-20, REQ-21, REQ-22
+- **Success Criteria:**
+  - All 11 open decisions resolved and recorded in `PROJECT.md`.
+  - All 6 schema/design files exist and validate (`ajv` / `python -m jsonschema`).
+  - `docs/architecture.md` status note updated to v1.0 (or a `docs/architecture-v1.0.md` snapshot).
+
+### Phase 08 — aws-oidc-bootstrap
+- **Description:** **Re-scoped per RESEARCH TARGET 1 + D-039.** Gitea Actions does not support `id-token: write` (conf 0.95), so real OIDC is deferred to v1.2. This phase instead: uses the temporary long-lived key (waiver D-034) once to create an S3 state bucket, a DynamoDB lock/outbox table, and an IAM user with a minimal scoped policy (S3 + DynamoDB + plan-only); stores the key as a Gitea Actions secret; implements `scripts/rotate_spike_key.sh` to rotate the key after each spike run. Real OIDC federation is tracked via go-gitea/gitea#36988 for v1.2.
+- **Status:** complete (v1.1.3)
+- **Depends on:** [07]
+- **Requirements:** REQ-23 (re-interpreted: AWS auth bootstrap + state backend; OIDC deferred to v1.2 per D-039)
+- **Success Criteria:**
+  - S3 state bucket + DynamoDB lock/outbox table exist.
+  - An IAM user with a minimal scoped policy exists; its access key is stored as a Gitea Actions secret.
+  - `scripts/rotate_spike_key.sh` rotates the key (deactivates old, creates new, updates the secret) and is idempotent.
+  - A workflow step authenticates to AWS with the rotated secret and runs `aws sts get-caller-identity` successfully.
+  - D-034 is closed: the bootstrap long-lived key is rotated/deactivated (logged in `PROJECT.md`).
+
+### Phase 09 — v1-spike-ir-and-l1-and-adapter
+- **Description:** Implement the Target Stack IR, one real L1 `l1-s3` (IR-typed interface, registered), and the Terraform adapter that compiles the IR → Terraform `variable`/`output` + root module and emits a real `terraform plan` against AWS (via the rotated-key secret per D-039; OIDC is v1.2). State in S3 + DynamoDB.
+- **Status:** complete (v1.1.4)
+- **Depends on:** [08]
+- **Requirements:** REQ-24, REQ-26
+- **Success Criteria:**
+  - `schemas/ir.schema.json` is satisfied by `modules-ir/l1/l1-s3/` interface.
+  - The Terraform adapter translates `l1-s3` to a valid `terraform plan` (real AWS).
+  - `terraform validate` + `terraform plan` succeed; no long-lived credential in the workflow.
+
+### Phase 10 — v1-spike-l2-and-contract-e2e
+- **Description:** Implement `l2-static-asset` (thin-composition referencing `l1-s3`), the contract schema + contract→IR resolution, and one end-to-end contract submission (`contracts/spike.yaml` for `l2-static-asset`) flowing through schema validation → IR resolution → `terraform plan` → Checkov `PolicyCheckResult` → confidence signal → evidence event to the DynamoDB outbox. Verify the IR commitments hold (no polyglot mess).
+- **Status:** complete (v1.1.5)
+- **Depends on:** [09]
+- **Requirements:** REQ-25, REQ-27, REQ-28
+- **Success Criteria:**
+  - `l2-static-asset` references `l1-s3` only (depth 1).
+  - One contract submission completes the full pipeline end-to-end.
+  - `scripts/verify_phase10.sh` proves the adapter is the only substrate-specific code.
+  - Evidence event is written to the DynamoDB outbox.
+
+After Phase 10: COMPLETE gate — review → ship `v1.2.0` → audit. **DONE.**
+
+---
+
+## v1.2 (Complete — platform hardening + first real consumer deployment, 2026-07-21, tag `v1.3.0`)
+
+Six-phase breakdown to harden the v1.1 spike, simplify the setup, update
+the docs, and prove the platform delivers real value by deploying a basic
+microservice to AWS ECS Fargate end-to-end. Ship tag at milestone COMPLETE:
+**`v1.3.0`** (feature milestone, next minor per ship.md — v1.1 shipped
+`v1.2.0`). Phase patches `v1.2.1`..`v1.2.6`. **Status: COMPLETE — all 6
+phases shipped (v1.2.1..v1.2.6) + verified; review READY TO SHIP (1 P0
+operator action, 1 P1 deferred to v1.3); audit CLEAN. The terraform apply
+is blocked by the live IAM policy (P0-IAM, operator action); the platform
+flow is verified end-to-end up to terraform plan (13 to add).**
+
+### Phase 11 — v1.2-research-and-readme
+- **Description:** Re-evaluate go-gitea/gitea#36988 (OIDC for Gitea Actions) — confirm still open (re-checked 2026-07-21: open, last updated 2026-05-27, not merged) and record the decision to extend D-039 as D-047. Audit the v1.1 spike for NFR gaps (least-privilege IAM, idempotency, error handling, rotation hygiene) and simplification opportunities (script consolidation, dead code, stale paths). Rewrite `README.md` to reflect v1.1 complete + the actual spike flow + how to run + the real repo layout + the v1.2 objective.
+- **Status:** complete (v1.2.1)
+- **Depends on:** —
+- **Requirements:** REQ-29
+- **Success Criteria:**
+  - `RESEARCH.md` has a v1.2 addendum with the #36988 re-check + NFR audit + simplification findings.
+  - `README.md` reflects v1.1 complete; documents the spike flow, `scripts/run_platform.sh`, the repo layout, and the v1.2 objective; no stale "v1.1 (active)" framing.
+  - D-047 is recorded in `PROJECT.md`.
+
+### Phase 12 — nfr-harden-and-simplify
+- **Description:** Apply Phase 11's findings. Tighten `terraform/bootstrap/spike_runner_policy.json` to least-privilege (add ECS + ECR + ELB + IAM plan-only permissions for v1.2; audit for wildcards). Make `create_state_backend.py` and `create_iam_user.py` idempotent. Consolidate `run_spike_plan.sh` + `run_spike_e2e.sh` into a single `scripts/run_platform.sh` with proper exit codes and error handling. Redact P1-1 (the two AWS access key IDs in `.ciagent/VERIFY.md` Phase 09 narrative). Fix any remaining stale `platform/` paths in `.ciagent/`. The v1.1 spike still runs e2e after the refactor.
+- **Status:** complete (v1.2.2)
+- **Depends on:** [11]
+- **Requirements:** REQ-30
+- **Success Criteria:**
+  - `scripts/run_platform.sh` runs the full v1.1 spike e2e and exits 0.
+  - `create_state_backend.py` / `create_iam_user.py` re-runs are idempotent (no duplicate resources; exit 0).
+  - `spike_runner_policy.json` passes a least-privilege audit (no `*` actions beyond documented exceptions).
+  - `.ciagent/VERIFY.md` Phase 09 narrative has no live AWS access key IDs.
+  - No stale `platform/` paths remain in `.ciagent/`.
+
+### Phase 13 — l1-catalog-for-ecs
+- **Description:** Author six IR-typed L1 modules for an ECS Fargate microservice: `l1-vpc` (VPC + subnets + route tables), `l1-ecs-cluster` (ECS Fargate cluster), `l1-ecs-service` (ECS service + task definition), `l1-iam-role` (task execution + task role), `l1-alb` (ALB + listener + target group), `l1-ecr` (ECR repository). Each has an `interface.json` valid against `schemas/ir.schema.json`. Register all six in `modules-ir/registry.json`. Expand the Terraform adapter `TYPE_MAP` to cover the new IR resource types. Each L1 produces a valid `terraform plan` fragment.
+- **Status:** complete (v1.2.3)
+- **Depends on:** [12]
+- **Requirements:** REQ-31
+- **Success Criteria:**
+  - All six L1s exist under `modules-ir/l1/` with `interface.json` valid against `schemas/ir.schema.json`.
+  - `modules-ir/registry.json` lists all six.
+  - The adapter `TYPE_MAP` covers all six IR resource types.
+  - Each L1 produces a valid `terraform plan` fragment.
+
+### Phase 14 — l2-microservice-and-contract-schema
+- **Description:** Author `l2-microservice` thin-composition under `modules-ir/l2/l2-microservice/` referencing the six ECS L1s (depth ≤ 5). Extend `schemas/contract.schema.json` with microservice inputs (`image: string`, `port: integer`, `env: map`, `healthcheck: object`). Verify contract→IR resolution yields a complete target stack.
+- **Status:** complete (v1.2.4)
+- **Depends on:** [13]
+- **Requirements:** REQ-32
+- **Success Criteria:**
+  - `l2-microservice` references the six ECS L1s only (depth ≤ 5).
+  - `schemas/contract.schema.json` validates a `contracts/microservice.yaml` with the new inputs.
+  - Contract→IR resolution yields a complete target stack (all six L1 instances + relationships).
+
+### Phase 15 — consumer-repo-and-terraform-apply
+- **Description:** Create a new Gitea repo `acdl-consumer-microservice` under the `continuous-intelligence` org containing a basic HTTP microservice (tiny Python/Go server returning 200), a `Dockerfile`, an ECR push step, and a `contracts/microservice.yaml` submission for `l2-microservice` (dev environment). Lift the platform from `plan` to **`apply`** for the `dev` environment (autonomous per §10, confidence ≥ 0.50, no HITL). Submit the contract → pipeline → IR → plan → apply → a real ECS Fargate service running.
+- **Status:** complete (v1.2.5, PARTIAL — terraform apply blocked by IAM P0)
+- **Depends on:** [14]
+- **Requirements:** REQ-33 (partial), REQ-34
+- **Success Criteria:**
+  - `acdl-consumer-microservice` repo exists under `continuous-intelligence`.
+  - The microservice builds into a Docker image and is pushed to ECR.
+  - `terraform apply` (dev) creates real AWS resources (VPC, ECS cluster, ECR repo, ALB, ECS service).
+  - The apply result is captured in the evidence stream.
+
+### Phase 16 — v1.2-capstone-e2e
+- **Description:** End-to-end verification: consumer commit to `acdl-consumer-microservice` triggers the pipeline → contract→IR resolution → `terraform plan` → `terraform apply` (dev) → a live ECS Fargate service serving HTTP 200 on its ALB → evidence event written to the DynamoDB outbox → the event renders on the `acdl-evidence` timeline. Verify the NFR improvements from Phase 12 hold, the setup is simpler (one `scripts/run_platform.sh`), and the README is accurate. `scripts/verify_phase16.sh` proves the full flow green.
+- **Status:** complete (v1.2.6, capstone — terraform apply blocked by IAM P0, verified up to plan)
+- **Depends on:** [15]
+- **Requirements:** REQ-35 (partial — IAM-blocked)
+- **Success Criteria:**
+  - One consumer commit produces a live ECS service serving HTTP 200.
+  - An evidence event for the apply is in the DynamoDB outbox and renders on the timeline.
+  - `scripts/verify_phase16.sh` exits 0.
+  - README accurately documents the v1.2 platform flow.
+
+After Phase 16: COMPLETE gate — review → ship `v1.3.0` → audit.
+
+---
+
+## v1.3 (Complete — module documentation + thin-composition removal)
+
+The v1.3 milestone starts with simplification: removing the unsatisfactory
+thin-composition layer and building out proper module documentation. The
+L2 composition mechanism will be redesigned in a later phase.
+
+### Phase 17 — remove-thin-composition-and-module-readmes
+- **Description:** Remove the L2 thin-composition layer completely (composition.json files, contract_resolver.py, contract schema, sample contracts) and build out proper module READMEs. Create a README template for both L1 and L2 modules, rewrite all 7 L1 module READMEs in plain language (no jargon, with Resources/Inputs/Outputs/Usage/Compliance-extension-points/Versioning sections), write 2 L2 placeholder READMEs noting the composition is under redesign, create a catalog index, and patch run_platform.sh to load a pre-existing IR instance instead of resolving a contract. Prune L2 entries from the registry.
+- **Status:** complete (v1.3.1)
+- **Depends on:** —
+- **Requirements:** REQ-36, REQ-37, REQ-38
+- **Success Criteria:**
+  - The thin-composition layer is fully removed (composition.json, contract_resolver.py, contract schema, contracts/).
+  - run_platform.sh loads a pre-existing IR instance; the downstream adapter/checkov/confidence/outbox pipeline still works.
+  - A README-TEMPLATE.md exists for both L1 and L2 modules.
+  - Every L1 module has a README.md with Resources/Inputs/Outputs/Usage/Compliance-extension-points/Versioning.
+  - Every L2 module has a placeholder README.md noting the composition is under redesign.
+  - A modules-ir/README.md catalog index exists.
+
+### Phase 18 — testing-and-cicd-pipelines
+- **Description:** Create a pytest test suite that reproduces the platform pipeline offline (adapter, confidence_signal, checkov_adapter, outbox_writer). Add an offline `--check-only` mode to `run_platform.sh` that runs the pipeline up to adapter emission without AWS/Checkov/outbox. Create identical CI/CD pipelines for both Gitea Actions (`.gitea/workflows/ci.yml`, dev environment) and GitHub Actions (`.github/workflows/ci.yml`, production) that run: lint, pytest, `run_platform.sh --check-only`. Add `pyproject.toml` + `requirements-test.txt` for dependency pinning.
+- **Status:** complete (v1.3.2)
+- **Depends on:** [17]
+- **Requirements:** REQ-39, REQ-40, REQ-41, REQ-42
+- **Success Criteria:**
+  - `pytest` runs and passes offline (no AWS, no Checkov, no DynamoDB).
+  - `run_platform.sh --check-only` runs offline and exits 0.
+  - `.gitea/workflows/ci.yml` and `.github/workflows/ci.yml` exist with identical job stages (lint, test, check-only).
+  - `pyproject.toml` + `requirements-test.txt` pin test dependencies.
+
+After Phase 18: COMPLETE gate — review → ship `v1.3.2` → audit.
+
+---
+
+## v1.4 (Active — central pipeline contract + shell reproducibility + streaming)
+
+The v1.4 milestone makes the CI/CD pipeline a declarative contract rather
+than duplicated workflow copies, enables full shell reproducibility of the
+CI pipeline, and streams terraform/checkov output so users can see what
+the platform is doing.
+
+### Phase 19 — central-pipeline-contract-and-shell-reproducibility
+- **Description:** Create a central pipeline contract (`schemas/pipeline.schema.json` JSON Schema + `pipelines/ci.yaml` YAML instance) that both `.gitea/workflows/ci.yml` (Gitea Actions, dev) and `.github/workflows/ci.yml` (GitHub Actions, production) implement. Create `scripts/run_ci.sh` that mirrors the CI pipeline locally (lint → test → check-only). Update `scripts/run_platform.sh` to stream terraform init/validate/plan output, Checkov compliance results, and PolicyCheckResult records to stdout by default (with `--quiet` for log-only mode). Add `tests/test_pipeline_contract.py` validating the contract schema, workflow conformance, and run_ci.sh. Update both workflow YAMLs with contract reference headers (staying byte-identical).
+- **Status:** complete (v1.4.1)
+- **Depends on:** [18]
+- **Requirements:** REQ-43, REQ-44, REQ-45
+- **Success Criteria:**
+  - `pipelines/ci.yaml` validates against `schemas/pipeline.schema.json`.
+  - Both `.gitea/workflows/ci.yml` and `.github/workflows/ci.yml` are byte-identical.
+  - A test parses both workflows and asserts their stages/commands match the contract.
+  - `scripts/run_ci.sh` exits 0 and outputs "CI PIPELINE OK".
+  - `scripts/run_platform.sh --check-only` streams the emitted Terraform to stdout.
+  - `scripts/run_platform.sh --check-only --quiet` suppresses the Terraform stream.
+  - `pytest` total count increases from 90 to 122 (32 new contract/streaming tests).

.ciagent/VERIFY.md

@@ -0,0 +1,45 @@
+# Phase 18 — Verify (v1.3.2)
+
+## Structural
+
+All 11 new files confirmed present: pyproject.toml, requirements-test.txt,
+tests/__init__.py, tests/conftest.py, tests/test_adapter.py,
+tests/test_confidence_signal.py, tests/test_checkov_adapter.py,
+tests/test_outbox_writer.py, tests/test_pipeline.py,
+.gitea/workflows/ci.yml, .github/workflows/ci.yml. **PASS.**
+
+## Behavioral
+
+- `py_compile` passes on all Python files. **PASS.**
+- `pytest` — 90 tests, all passing, all offline (moto for DynamoDB
+  mocking). **PASS.**
+- `run_platform.sh --check-only` — exits 0, outputs
+  "PLATFORM CHECK OK", requires no AWS credentials. **PASS.**
+- `run_platform.sh --plan-only` — syntax valid (unchanged from phase 17).
+  **PASS.**
+- Both workflow YAMLs are valid YAML, parseable. **PASS.**
+- Workflows are byte-identical (diff confirms). **PASS.**
+
+## Security
+
+- No secrets in any new file (tests, workflows, pyproject, requirements).
+  **PASS.**
+- CI pipelines do not use any AWS credentials — `--check-only` is fully
+  offline. **PASS.**
+
+## Quality
+
+- pyproject.toml has pytest config (testpaths, markers, addopts).
+  **PASS.**
+- requirements-test.txt pins all test deps. **PASS.**
+- Test suite covers all 4 platform components (adapter, confidence
+  signal, checkov adapter, outbox writer) + pipeline integration.
+  **PASS.**
+- Both workflows run 3 stages: lint, test, check-only. **PASS.**
+- README updated with "Test the platform" section + CI/CD documentation.
+  **PASS.**
+
+## Verdict
+
+**VERIFY PASS** — all four layers pass. 90 offline tests, no AWS
+required for CI.

.ciagent/config.json

@@ -4,8 +4,8 @@
     {
       "slug": "acdl",
       "name": "Agentic Cloud Delivery Platform",
-      "milestone": "v1.0",
-      "status": "specify"
+      "milestone": "v1.4",
+      "status": "active"
     }
   ],
   "active_project": "acdl",

.gitea/workflows/ci.yml

@@ -0,0 +1,74 @@
+# ACDL CI Pipeline — Gitea Actions (dev environment)
+#
+# This workflow implements the central pipeline contract:
+#   pipelines/ci.yaml (validated against schemas/pipeline.schema.json)
+#
+# The same contract is implemented by .github/workflows/ci.yml (GitHub
+# Actions, production). Both files must be byte-identical — the only
+# declared difference is the forge/runtime, not the stages or commands.
+#
+# Shell reproducibility: scripts/run_ci.sh runs the same 3 stages locally.
+#
+# Stages (from the contract):
+#   1. lint       — py_compile all Python files
+#   2. test       — pytest test suite (offline, no AWS)
+#   3. check-only — run_platform.sh --check-only (offline, no AWS)
+name: acdl-ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Compile all Python files
+        run: |
+          python3 -m py_compile \
+            acdl_platform/confidence_signal.py \
+            acdl_platform/outbox_writer.py \
+            adapters/terraform/adapter.py \
+            adapters/terraform/policy/checkov_adapter.py \
+            scripts/push_consumer_image.py
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install test dependencies
+        run: pip install -r requirements-test.txt
+
+      - name: Run pytest
+        run: python3 -m pytest tests/ -v --tb=short
+
+  check-only:
+    name: Platform check-only (offline)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install runtime dependencies
+        run: pip install jsonschema pyyaml boto3
+
+      - name: Run platform check-only
+        run: bash scripts/run_platform.sh --check-only

.github/workflows/ci.yml

@@ -0,0 +1,74 @@
+# ACDL CI Pipeline — Gitea Actions (dev environment)
+#
+# This workflow implements the central pipeline contract:
+#   pipelines/ci.yaml (validated against schemas/pipeline.schema.json)
+#
+# The same contract is implemented by .github/workflows/ci.yml (GitHub
+# Actions, production). Both files must be byte-identical — the only
+# declared difference is the forge/runtime, not the stages or commands.
+#
+# Shell reproducibility: scripts/run_ci.sh runs the same 3 stages locally.
+#
+# Stages (from the contract):
+#   1. lint       — py_compile all Python files
+#   2. test       — pytest test suite (offline, no AWS)
+#   3. check-only — run_platform.sh --check-only (offline, no AWS)
+name: acdl-ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Compile all Python files
+        run: |
+          python3 -m py_compile \
+            acdl_platform/confidence_signal.py \
+            acdl_platform/outbox_writer.py \
+            adapters/terraform/adapter.py \
+            adapters/terraform/policy/checkov_adapter.py \
+            scripts/push_consumer_image.py
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install test dependencies
+        run: pip install -r requirements-test.txt
+
+      - name: Run pytest
+        run: python3 -m pytest tests/ -v --tb=short
+
+  check-only:
+    name: Platform check-only (offline)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install runtime dependencies
+        run: pip install jsonschema pyyaml boto3
+
+      - name: Run platform check-only
+        run: bash scripts/run_platform.sh --check-only

.gitignore

@@ -6,4 +6,15 @@ __pycache__/
 state.json
 audit.json
 *.tmp
-.DS_Store
+.DS_Store
+runner-data/
+.env.secrets
+terraform/bootstrap/.bootstrap_state.json
+terraform/spike/.terraform/
+terraform/spike/.terraform.lock.hcl
+terraform/spike/tfplan
+terraform/spike/*.tfstate*
+terraform/microservice/.terraform/
+terraform/microservice/.terraform.lock.hcl
+terraform/microservice/tfplan
+terraform/microservice/*.tfstate*

README.md

@@ -1,55 +1,239 @@
 # ACDL — Agentic Cloud Delivery Platform
 
-A 30-minute executive demo proving that infrastructure can be delivered
-**automatically, safely, and with a complete audit trail** — without the
-usual weeks of manual tickets, reviews, and copy-pasted configuration.
+Consumers declare intent; the platform delivers safe production deployment
+through an agentic stack — automatically, safely, and with a complete audit
+trail. A merged change progresses through lower environments end-to-end
+without a platform engineer joining a thread; a non-technical consumer ships
+a production deployment by declaring intent, without authoring a workflow,
+a configuration file, or a Terraform module.
 
-The demo runs entirely on **local stubs** (no AWS/GCP/Azure, no external LLM
-APIs). It shows intent and safety behavior rather than provisioning real
-cloud resources.
+- **Vision** (the why): [`docs/vision.md`](docs/vision.md)
+- **Architecture** (the how): [`docs/architecture.md`](docs/architecture.md) + [`.ciagent/ARCHITECTURE.md`](.ciagent/ARCHITECTURE.md)
+- **Decisions**: [`.ciagent/PROJECT.md`](.ciagent/PROJECT.md)
+- **Phase plan**: [`.ciagent/ROADMAP.md`](.ciagent/ROADMAP.md)
 
-## Four acts
+## Status
 
-1. **Act 1 — The Friction:** the old manual 2-week deployment process.
-2. **Act 2 — Developer Self-Service:** commit a valid `contract.yaml` for
-   `l2-commodity-price-feed`, watch Dev auto-run, QA + Prod approval gates,
-   then the evidence timeline.
-3. **Act 3 — Citizen Developer:** open a GitHub/Gitea Issue with natural-
-   language intent; the Python keyword parser generates the same
-   `contract.yaml` and triggers the identical pipeline.
-4. **Act 4 — The Safety Net:** commit a malicious `contract.yaml`
-   (`public-ingress: true`) for `l2-regulatory-reporting`; the pipeline
-   halts in Dev because the confidence signal drops below 0.50, and the
-   rejection is visible on the evidence stream.
+- **v1.4 (active):** central pipeline contract + shell reproducibility +
+  output streaming. A declarative pipeline contract
+  (`schemas/pipeline.schema.json` + `pipelines/ci.yaml`) binds the Gitea
+  and GitHub workflows to a single source of truth. `scripts/run_ci.sh`
+  mirrors the CI pipeline locally. `scripts/run_platform.sh` streams
+  terraform/checkov output by default. Ship tag `v1.4.1`.
+- **v1.3 (complete, tag `v1.3.2`):** module documentation + thin-composition
+  removal. The L2 composition layer is removed; module READMEs are built
+  out. Testing + CI/CD pipelines (pytest, `--check-only`, Gitea + GitHub
+  workflows).
+- **v1.2 (complete, tag `v1.3.0`):** platform hardening + first real
+  consumer deployment. Harden the v1.1 spike's NFRs, simplify the setup,
+  rewrite the docs, and prove the platform delivers real value by
+  deploying a basic microservice to AWS ECS Fargate end-to-end (`terraform
+  apply`, dev autonomous).
+- **v1.1 (complete, tag `v1.2.0`):** architecture finalization + v1 spike.
+  Finalized the architecture to v1.0 (resolved all 11 open design
+  decisions) and proved the IR commitments hold with one end-to-end spike
+  (`l1-s3` + `l2-static-asset` + Terraform adapter → real `terraform plan`
+  against AWS). Gitea release id 202.
+- **v1.0 demo (complete, archived under `demo/`, tag `v1.1.0`):** the
+  30-minute stub-driven executive demo. Preserved as the intent reference;
+  it is not the platform.
 
-## Repositories
+## How the platform works
 
-All under the `continuous-intelligence` Gitea org at
-`https://git.cloudinit.dev`:
+The platform is **four layers + six cross-cutting concerns**, bound by the
+vision's "Two Consumer Surfaces, One Platform" tenet: technical developers
+(L3A) and non-technical consumers (L3B) converge on the same contract
+schema, the same policy envelope, and the same evidence stream.
 
-- `acdl` (this repo) — platform + stubs + reusable workflows
-- `acdl-contracts` — developer surface (`contract.yaml` + issue trigger)
-- `acdl-evidence` — audit timeline (served via raw file URLs; Gitea has no
-  native Pages — see `.ciagent/ARCHITECTURE.md` Gitea API Surface table)
+### The v1.1 spike flow (end-to-end)
 
-## Project metadata
-
-See `.ciagent/PROJECT.md` for the full spec, `.ciagent/ROADMAP.md` for the
-5-phase breakdown, `.ciagent/REQUIREMENTS.md` for traceable requirements,
-and `.ciagent/PERSONAS.md` for the active persona roster.
-
-## Phase 01 verification
-
-After running `scripts/gitea_setup.sh` (which creates `acdl-contracts` and
-`acdl-evidence` in the org and pushes the placeholder `index.html`), run:
-
-```bash
-ACDL_GITEA_TOKEN=<token> scripts/verify_phase01.sh
+```
+contracts/spike.yaml
+        │  (contract schema validation)
+        ▼
+acdl_platform/contract_resolver.py  ──▶ Target Stack IR (JSON)
+        │  (IR schema validation)
+        ▼
+adapters/terraform/adapter.py  ──▶ terraform/spike/{main,terraform,providers}.tf
+        │  (the only substrate-specific code)
+        ▼
+terraform plan  (real AWS, via the rotated spike key — D-039/D-047)
+        │
+        ▼
+adapters/terraform/policy/checkov_adapter.py  ──▶ PolicyCheckResult (JSON list)
+        │  (normalized, engine-agnostic)
+        ▼
+acdl_platform/confidence_signal.py  ──▶ { score, band, perInput, reasonCodes }
+        │  (6 inputs: policy, validation, freshness, source, history, nfrs)
+        ▼
+acdl_platform/outbox_writer.py  ──▶ DynamoDB outbox (acdl-outbox)
+        │  (hash-chained evidence event)
+        ▼
+acdl-evidence timeline (acdl-evidence repo, raw-file served)
 ```
 
-The script confirms:
-- both new repos exist via the Gitea API
-- the raw `index.html` URL on `acdl-evidence` returns HTTP 200
-- the `qa` and `prod` branches exist on `acdl-contracts`
+The spike validates the architecture's claim that the **IR-shaped
+commitments do not require a polyglot mess**: the adapter is the only
+substrate-specific code. `modules-ir/`, `schemas/`, `contracts/`,
+`acdl_platform/confidence_signal.py`, `acdl_platform/contract_resolver.py`,
+and `acdl_platform/outbox_writer.py` are all substrate-agnostic (no
+`aws_s3_bucket` / `aws_` Terraform terms).
 
-Exit 0 = Phase 01 success criteria met.
+### What's different in v1.2
+
+v1.2 extends the spike to a real, simpler, better-documented platform that
+**deploys a microservice to ECS Fargate**:
+
+- Six new IR-typed L1s: `l1-vpc`, `l1-ecs-cluster`, `l1-ecs-service`,
+  `l1-iam-role`, `l1-alb`, `l1-ecr`.
+- One new L2 thin-composition: `l2-microservice` (references the six L1s).
+- `terraform apply` (dev, autonomous per §10, confidence ≥ 0.50) — real
+  provisioning, not just `plan`.
+- A new consumer repo `acdl-consumer-microservice` with a basic HTTP
+  container + Dockerfile + ECR push + contract submission.
+- One `scripts/run_platform.sh` (consolidated from the v1.1 spike scripts).
+- NFR hardening: least-privilege IAM (expanded for ECS), idempotent
+  bootstrap, proper error handling, P1-1 redaction.
+
+## How to run
+
+### Prerequisites
+
+- AWS account + the rotated spike key in `.env.secrets` (see
+  `scripts/rotate_spike_key.sh`; the bootstrap root key was deactivated
+  per D-034 closure).
+- `terraform` (pin `1.9.*`), `checkov` (pin `>=3.2,<4`), `python3` + `boto3`
+  + `jsonschema`.
+
+### Run the platform pipeline end-to-end
+
+```bash
+# 1. Bootstrap the AWS state backend + spike IAM user (one-time, idempotent)
+#    (requires the bootstrap root key in env — now deactivated; skip if
+#    the state bucket + acdl-spike-runner already exist)
+ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID=... ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY=... \
+  python3 terraform/bootstrap/create_state_backend.py
+ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID=... ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY=... \
+  python3 terraform/bootstrap/create_iam_user.py  # prints the initial key
+
+# 2. Rotate the spike key (writes .env.secrets, gitignored)
+ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID=... ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY=... \
+  bash scripts/rotate_spike_key.sh
+
+# 3. Run the full platform pipeline (IR -> adapter -> plan -> Checkov ->
+#    confidence -> outbox). Output is streamed to stdout by default.
+bash scripts/run_platform.sh
+# Expected: "=== PLATFORM E2E OK ==="
+
+# Or plan-only (IR -> adapter -> terraform plan; no Checkov/outbox):
+bash scripts/run_platform.sh --plan-only
+
+# Add --quiet to suppress streaming (output to log files only):
+bash scripts/run_platform.sh --quiet
+```
+
+### Test the platform (offline, no AWS required)
+
+```bash
+# Install test dependencies
+pip install -r requirements-test.txt
+
+# Run the test suite (122 tests, all offline — uses moto for DynamoDB mocking)
+python3 -m pytest tests/ -v
+
+# Run the platform in check-only mode (offline — no AWS, no Checkov, no outbox)
+# Streams the emitted Terraform to stdout by default; --quiet suppresses it
+bash scripts/run_platform.sh --check-only
+# Expected: "=== PLATFORM CHECK OK ==="
+
+# Reproduce the full CI pipeline locally (lint → test → check-only)
+bash scripts/run_ci.sh
+# Expected: "=== CI PIPELINE OK ==="
+```
+
+### CI/CD pipelines
+
+The CI/CD pipeline is defined by a **central pipeline contract** — a
+declarative YAML instance (`pipelines/ci.yaml`) validated against a JSON
+Schema (`schemas/pipeline.schema.json`). Both forge workflows implement
+the same contract:
+
+- `.gitea/workflows/ci.yml` — Gitea Actions (dev environment)
+- `.github/workflows/ci.yml` — GitHub Actions (production)
+
+Both workflow files are **byte-identical** — the only difference is the
+forge runtime. Both run three stages: **lint** (py_compile), **test**
+(pytest), and **check-only** (`run_platform.sh --check-only`). Both
+trigger on push to `main` and on pull requests. A test
+(`tests/test_pipeline_contract.py`) validates that both workflows conform
+to the contract.
+
+`scripts/run_ci.sh` mirrors the CI pipeline locally — running the same
+three stages in sequence. This makes the pipeline fully reproducible from
+the shell, not just in CI:
+
+```bash
+bash scripts/run_ci.sh           # run all 3 stages (lint, test, check-only)
+bash scripts/run_ci.sh --quiet    # suppress per-stage banners
+```
+
+### Output streaming (run_platform.sh)
+
+`scripts/run_platform.sh` streams output by default so the user can see
+what the platform is doing:
+
+- **`--check-only`**: streams the emitted Terraform file content to stdout
+- **`--plan-only`** and **full mode**: streams `terraform init`, `terraform
+  validate`, and `terraform plan` output via `tee` (visible and logged)
+- **Full mode**: prints Checkov compliance results and each
+  PolicyCheckResult record with severity, rule ID, and pass/fail status
+
+A `--quiet` flag suppresses streaming (output to log files only) for
+backwards-compatible log-only mode.
+
+### Re-run the archived v1.0 demo (stubs only, no AWS)
+
+```bash
+bash demo/scripts/run_demo.sh --no-upload
+```
+
+The demo deck is at [`demo/ACDL_DEMO.md`](demo/ACDL_DEMO.md). It runs
+entirely on local stubs — no AWS, no AI — and shows intent and safety
+behavior rather than provisioning real cloud resources.
+
+## Repository layout
+
+| Path | Purpose | Status |
+|------|---------|--------|
+| `acdl_platform/` | Platform code: confidence signal, outbox writer, separation of duties, HITL/ledger designs | v1.1 complete; v1.3 removes contract_resolver |
+| `schemas/` | JSON Schemas: IR, PolicyCheckResult, pipeline contract (draft 2020-12) | v1.1 complete; v1.4 adds pipeline schema |
+| `pipelines/` | Central pipeline contract: `ci.yaml` (YAML instance validated against `schemas/pipeline.schema.json`) | v1.4 |
+| `adapters/` | Substrate adapters — Terraform adapter (the only substrate-specific code per §12) + Checkov policy adapter | v1.1 complete; v1.2 expands `TYPE_MAP` |
+| `terraform/` | State backend (S3 + DynamoDB) + spike TF (`terraform/spike/`) + bootstrap scripts (`terraform/bootstrap/`) | v1.1 complete; v1.2 adds ECS apply |
+| `modules-ir/` | IR-typed L1/L2 modules + `registry.json`. v1.1: `l1-s3`. v1.2: + 6 ECS L1s. v1.3: L2 removed (placeholders) | v1.3 |
+| `scripts/` | Platform run script (`run_platform.sh` with `--check-only`/`--plan-only`/`--quiet`), CI pipeline script (`run_ci.sh`), verify scripts, key rotation | v1.4 |
+| `tests/` | Pytest suite (122 tests, all offline — adapter, confidence signal, checkov adapter, outbox writer, pipeline contract, streaming) | v1.4 |
+| `demo/` | Archived v1.0 executive demo (tag `v1.1.0`); runs locally via `demo/scripts/run_demo.sh --no-upload` | complete (archived) |
+| `.ciagent/` | CIAgent metadata (config, project, architecture, requirements, roadmap, personas, plans, research, verify, review, audit) | active |
+| `docs/` | Upstream vision + architecture sources (`vision.md`, `architecture.md`) | active |
+
+## Environments
+
+| Environment | Autonomy | Gate | Status |
+|---|---|---|---|
+| dev | Full autonomy (no HITL) | Confidence ≥ 0.50 | v1.1 spike (`plan`); v1.2 (`apply`) |
+| qa | Held for attestation | QA HITL + confidence ≥ 0.75 | v1.3+ |
+| prod | Held for attestation | SRE HITL + confidence ≥ 0.90 | v1.3+ |
+| dr | Held for attestation | SRE HITL + confidence ≥ 0.95 + dr-drill | v1.3+ |
+
+**Staging does not exist** (Path A locked).
+
+## Credentials
+
+**Long-lived AWS credentials are forbidden** (§12.5). The v1.1 spike uses a
+temporary long-lived key **once** to bootstrap (waiver D-034, now closed —
+the root key was deactivated by the user), then rotates the spike key
+per-run via `scripts/rotate_spike_key.sh` (waiver D-039, extended for v1.2
+as D-047). Real OIDC federation is deferred to v1.3+, blocked on
+[go-gitea/gitea#36988](https://github.com/go-gitea/gitea/pull/36988) (still
+open as of 2026-07-21).

acdl_platform/audit_ledger_design.md

@@ -0,0 +1,103 @@
+# ACDL Tiered Audit Ledger Design (REQ-20)
+
+> **Status:** design authored in Phase 07 (milestone v1.1); the spike
+> (Phases 08-10) implements the **v1.0 hash chain + DynamoDB outbox write**
+> (D-041); the v1.2 build-out implements S3 Object Lock + JWS + async
+> worker + DLQ + daily checkpoints.
+
+The audit stream is the platform's tamper-evident record of every delivery
+action. The vision's "Audit truth lives outside the repository" bet [1]
+and "Not a mutable audit log" anti-goal [1] are the binding constraints.
+Version-control history does not satisfy regulatory evidence; the ledger
+is the source of truth.
+
+## Three tiers
+
+- **Cold tier (source of truth):** S3 with **Object Lock in compliance
+  mode**, **7-year retention** (ARCHITECTURE.md §9). No one — including
+  root — can delete or overwrite until retention expires. The regulatory
+  record.
+- **Hot tier (query index):** the `acdl-evidence` audit repo (unchanged
+  from the v1.0 demo). Not part of the chain; a queryable mirror the
+  evidence UI (`evidence-ui/index.html`) reads. Lightweight attestation
+  linkage lives in the repo; the regulatory event body lives in S3.
+- **Outbox (write path):** DynamoDB, **RPO = 0** (synchronous write before
+  contract submission ack). Single-region in v1 (`us-east-1`).
+
+## Spike scope (D-041) — what Phases 08-10 implement
+
+- **DynamoDB outbox:** table `acdl-outbox`, `PAY_PER_REQUEST` (D-044),
+  PK `contractId`, SK `eventType#eventTs`, TTL `expire_at` = now + 365d
+  (1-year storage per ARCHITECTURE.md §8).
+- **`prev_event_hash` chain:** SHA-256 over canonical JSON
+  (`json.dumps(event, sort_keys=True, separators=(",", ":"))`), lifted
+  from the v1.0 demo's `evidence_writer.py`. Auto-genesis: first event
+  has `prev_hash="GENESIS"`.
+- **Synchronous write** via boto3 `put_item` (strong-consistent by
+  default). No separate async worker / DLQ in the spike (RTO = workflow
+  re-run).
+- **Mirror to `acdl-evidence`:** unchanged from v1.0 — the finalize step
+  commits `audit.json` to the evidence repo (the hot tier).
+- **Spike evidence event shape:**
+  `{seq, ts, stage, event, prev_hash, hash, contractId, environment, stack, score, band}`.
+
+## v1.2 build-out — what Phase 07 designs but the spike defers
+
+- **S3 Object Lock:** bucket `acdl-evidence-lock-<account-id>`, Object
+  Lock enabled at creation, compliance mode, 7-yr retention
+  (`RetainUntilDate` = now + 7y). The outbox→S3 path is an async worker
+  that reads from the outbox and writes to Object Lock.
+- **JWS detached signature (RFC 7515):** the event payload is
+  canonical-JSON-serialized, SHA-256 hashed, signed with a private key;
+  the signature is stored *detached* alongside the payload. Signing key =
+  **platform-level KMS key** (not per-contract — a per-contract key would
+  explode the key-management surface), rotated **quarterly**. The `jws`
+  field is added to the event shape in v1.2.
+- **Async worker + DLQ:** a Lambda (or a Gitea Actions scheduled workflow)
+  reads the outbox, writes to S3 Object Lock, signs with KMS. DLQ = an
+  SQS dead-letter queue for failed writes. RTO = DLQ replay.
+- **Daily checkpoints (§9):** a daily job reads the last event hash and
+  writes a "checkpoint" event to the ledger (+ optionally to a public
+  notarization service). The spike runs in minutes, not days — no
+  checkpoint in spike.
+
+## JWS vs chain — orthogonality note
+
+The `prev_event_hash` chain gives ordering/tamper-evidence *within* the
+log (a deleted event breaks the chain visibly); JWS gives authenticity
+*per event* (a forged event is detectable without re-reading the whole
+chain). The chain is spike-scope; JWS is v1.2. Together they cover both
+integrity properties the vision's "Not a mutable audit log" anti-goal
+requires.
+
+## Outbox item shape (full, spike + v1.2)
+
+- PK `contractId` (UUID).
+- SK `eventType#eventTs` (e.g. `POLICY_CHECKED#2026-07-21T12:00:00Z`).
+- `payload` (the event body — hash-chained in spike, JWS-signed in v1.2).
+- `prev_event_hash` (chain link; `GENESIS` for the first event).
+- `hash` (this event's SHA-256 over canonical JSON).
+- `approver_qa` (Gitea username of the QA approver; empty in dev-only
+  spike; populated on qa-promotion — D-042).
+- `approver_prod` (SRE username; empty in spike).
+- `environment`, `stack`, `score`, `band`.
+- `expire_at` (TTL = now + 365d).
+- **v1.2 only:** `jws` (detached signature), `checkpoint_ref`.
+
+## RPO / RTO table
+
+| Phase | RPO | RTO |
+|-------|-----|-----|
+| Spike (D-041) | 0 (sync outbox write) | workflow re-run |
+| v1.2 | 0 (sync outbox) | async worker DLQ replay |
+
+## Decision trail
+
+- **D-041** — spike scope = hash chain + outbox write; Object Lock + JWS
+  + worker + DLQ are v1.2.
+- **D-044** — outbox mode `PAY_PER_REQUEST`; PK/SK; TTL `expire_at` =
+  now + 365d; no separate async worker in spike.
+- **D-042** — approver identities (`approver_qa`, `approver_prod`) live
+  in the outbox; the separation-of-duties check
+  (`platform/separation_of_duties.py`) reads `approver_qa` and compares
+  to the prod-dispatch `gitea.actor`.

acdl_platform/confidence_signal.py

@@ -0,0 +1,175 @@
+"""ACDL Confidence Signal (REQ-19).
+
+The platform's certified answer to "is this safe to proceed?" (vision
+tenet: "Safety is Computed, Not Assumed"). Every delivery action produces
+a measurable, explainable confidence signal; reliance on operator
+instinct is not a substitute.
+
+Inputs (weights sum to 1.0, D-040):
+  1. policy_results  (0.30) — list[PolicyCheckResult] (schemas/policy_check_result.schema.json)
+  2. validation     (0.25) — {schema: bool, ir_resolved: bool, tf_validated: bool, tf_planned: bool}
+  3. freshness      (0.10) — {age_days: float, max_age_days: float}
+  4. source         (0.15) — {submitter: str, commit_sha: str, signed: bool}
+  5. history        (0.10) — {prior_rollbacks: int, prior_policy_fails: int}
+  6. nfrs           (0.10) — {declared: list[str], conformance: float|None}
+
+Severity -> penalty (locked, ARCHITECTURE.md §8):
+  critical -> hard override (score = 0, block)
+  high     -> -0.20
+  medium   -> -0.05
+  low      -> -0.01
+  info     ->  0.00
+
+Per-env thresholds (locked, ARCHITECTURE.md §8): dev 0.50, qa 0.75, prod 0.90, dr 0.95.
+Output: {score, band, perInput, reasonCodes}.
+Halt with explicit reason on missing input (§8).
+
+Spike cold-start (A-6.2): inputs 3 (freshness), 5 (history), 6 (nfrs) are
+'present + neutral 0.5' because the spike is the first submission with no
+history and no declared NFRs. The gate is *presence*, not *conformance* —
+the 'all six inputs present' dev gate (§5) is satisfied by non-null
+per-input scores.
+"""
+
+from dataclasses import dataclass, asdict
+from typing import List, Literal, Optional, Dict, Any
+import json
+import sys
+
+
+WEIGHTS = {
+    "policy": 0.30,
+    "validation": 0.25,
+    "freshness": 0.10,
+    "source": 0.15,
+    "history": 0.10,
+    "nfrs": 0.10,
+}
+
+PENALTY = {
+    "critical": None,
+    "high": 0.20,
+    "medium": 0.05,
+    "low": 0.01,
+    "info": 0.0,
+}
+
+THRESHOLDS = {"dev": 0.50, "qa": 0.75, "prod": 0.90, "dr": 0.95}
+
+
+@dataclass
+class Signal:
+    score: float
+    band: Literal["pass", "warn", "block"]
+    perInput: Dict[str, float]
+    reasonCodes: List[str]
+
+
+def _per_input_score(name: str, raw: Any) -> tuple:
+    """Return (score in [0,1], reasons list). Unknown/missing -> 0.5 + INPUT_MISSING."""
+    reasons: List[str] = []
+    if raw is None:
+        return 0.5, [f"INPUT_MISSING:{name}"]
+    if name == "policy":
+        pcrs = raw if isinstance(raw, list) else []
+        if not pcrs:
+            return 0.5, []
+        scores = []
+        for pcr in pcrs:
+            r = pcr.get("result", "skipped")
+            if r == "pass" or r == "skipped":
+                scores.append(1.0)
+            else:
+                scores.append(0.0)
+        return sum(scores) / len(scores), []
+    if name == "validation":
+        keys = ("schema", "ir_resolved", "tf_validated", "tf_planned")
+        if not isinstance(raw, dict):
+            return 0.5, []
+        trues = sum(1 for k in keys if raw.get(k))
+        return trues / 4.0, []
+    if name == "freshness":
+        if not isinstance(raw, dict):
+            return 0.5, []
+        age = float(raw.get("age_days", 0))
+        mx = float(raw.get("max_age_days", 1)) or 1
+        s = 1.0 - (age / mx)
+        return max(0.0, min(1.0, s)), []
+    if name == "source":
+        if not isinstance(raw, dict):
+            return 0.5, []
+        if raw.get("submitter") and raw.get("commit_sha"):
+            return 1.0, []
+        return 0.5, []
+    if name == "history":
+        if not isinstance(raw, dict):
+            return 0.5, []
+        rollbacks = int(raw.get("prior_rollbacks", 0))
+        fails = int(raw.get("prior_policy_fails", 0))
+        s = 1.0 - (rollbacks * 0.2 + fails * 0.1)
+        return max(0.0, min(1.0, s)), []
+    if name == "nfrs":
+        if not isinstance(raw, dict):
+            return 0.5, []
+        conf = raw.get("conformance")
+        if conf is None:
+            return 0.5, []
+        return float(conf), []
+    return 0.5, []
+
+
+def compute(contract_id: str, environment: str,
+            inputs: Dict[str, Any]) -> Signal:
+    """Orchestrate the 6-input weighted sum + severity penalty + band."""
+    missing = sorted(set(WEIGHTS.keys()) - set(inputs.keys()))
+    if missing:
+        return Signal(0.0, "block", {},
+                      [f"INPUT_MISSING:{m}" for m in missing])
+
+    per_input: Dict[str, float] = {}
+    reasons: List[str] = []
+    base = 0.0
+    for name, weight in WEIGHTS.items():
+        raw = inputs.get(name)
+        s, r = _per_input_score(name, raw)
+        per_input[name] = s
+        reasons.extend(r)
+        base += s * weight
+
+    penalty = 0.0
+    policy_input = inputs.get("policy")
+    pcrs = policy_input if isinstance(policy_input, list) else []
+    for pcr in pcrs:
+        if not isinstance(pcr, dict):
+            continue
+        if pcr.get("result") != "fail":
+            continue
+        sev = pcr.get("severity")
+        p = PENALTY.get(sev, 0.0)
+        if p is None:
+            return Signal(0.0, "block", per_input,
+                          reasons + [f"CRITICAL_OVERRIDE:{pcr.get('ruleId','?')}"])
+        penalty += p
+
+    score = max(0.0, min(1.0, base - penalty))
+    threshold = THRESHOLDS[environment]
+    if score >= threshold:
+        band = "pass"
+    elif score < threshold - 0.10:
+        band = "block"
+    else:
+        band = "warn"
+    if environment == "dev" and band == "warn":
+        band = "block"
+    return Signal(score, band, per_input, reasons)
+
+
+if __name__ == "__main__":
+    if len(sys.argv) < 3:
+        print("usage: confidence_signal.py <inputs.json> <environment>", file=sys.stderr)
+        sys.exit(2)
+    env = sys.argv[2]
+    with open(sys.argv[1], "r", encoding="utf-8") as fh:
+        inputs = json.load(fh)
+    sig = compute("cli", env, inputs)
+    print(json.dumps(asdict(sig), indent=2))

acdl_platform/hitl_matrix_design.md

@@ -0,0 +1,115 @@
+# ACDL Human-in-the-Loop Matrix + Separation-of-Duties Design (REQ-21)
+
+> **Status:** design authored in Phase 07 (milestone v1.1); v1.2 wires the
+> gates. The spike (Phases 08-10) is **dev-only**; HITL is not exercised
+> (the spike contract has `environment: dev`).
+
+The vision's "Lower Environments are Autonomous; Higher Environments are
+Attested" tenet [1] and the "deliberate human attestation — not as a
+rubber stamp" requirement [1] are the binding constraints.
+
+## Gate model (ARCHITECTURE.md §10.1)
+
+**Pre-execution gates.** The contract is held in a "validated but not
+applied" state until the human attests. qa, prod, dr are attestation
+gates. No partial deployment to roll back on rejection (qa, prod); dr is
+a separate deployment against a separate cluster/region. The
+canary/deployment-rollback model is explicitly not in scope for v1.
+
+## Gitea-specific gate mechanics (D-042)
+
+Gitea has **no Environments API** and ignores `environment:` blocks
+(v1.0 D-013; re-confirmed in RESEARCH TARGET 1). The pre-execution gate
+is modeled as a `workflow_dispatch` with approval inputs:
+
+- **qa gate:** `workflow_dispatch` with `approve_qa: true`; the dispatch
+  run's `gitea.actor` is the QA approver.
+- **prod gate:** `workflow_dispatch` with `approve_prod: true`;
+  `gitea.actor` is the SRE approver.
+- **dr gate:** `workflow_dispatch` with `approve_dr: true`; same.
+
+The approver identity of record = `gitea.actor` of the dispatch run
+(D-042). There is no other approval-identity signal in Gitea. The v1.2
+real-OIDC path (blocked on go-gitea/gitea#36988) does not change this —
+OIDC authorizes the *runner* to AWS, it does not change how the platform
+records the *human* approver.
+
+## Reviewer routing (ARCHITECTURE.md §10.2)
+
+Gitea CODEOWNERS routes the right reviewer to the right gate:
+
+- qa → QA team
+- prod → SRE team
+- dr → SRE team
+
+CODEOWNERS **routes**; it does **not** enforce identity distinctness (that
+is the platform-internal outbox check in
+`platform/separation_of_duties.py`).
+
+## Full 8-concern attestation matrix (§10.4, lifted verbatim)
+
+| Env | Concern | Evidence artifact | Freshness | Source | Attester |
+|---|---|---|---|---|---|
+| qa | Functional correctness | Last successful run of contract-declared validation.e2eSuite with pass rate ≥ 99% | Last 24h | Test runner declared in contract | QA |
+| qa | Performance baseline | Load test report (k6 / Gatling / Locust) showing p99 latency < declared NFR and throughput > declared minimum | Last 7d | Load test runner declared in contract | QA |
+| qa | Security posture | Vulnerability scan (Trivy, Snyk, or contract-declared equivalent) with no criticals/highs, signed by Security on-call | Last 24h | Security scanner + Security team signature | QA |
+| qa | Contract NFRs | Platform-generated report: schema valid, NFR assertions (latency, throughput, error rate) within declared bounds | At submission | Platform contract validator | QA |
+| prod | Operational readiness | Runbook published, dashboard exists, on-call rotation assigned, alerts configured | At submission, validated against last 30d history | Platform + SRE | SRE |
+| prod | Incident response | Sev-1 runbook tabletop or live drill completed | Last 90d | SRE drill record | SRE |
+| prod | Capacity / cost | FinOps forecast for next 30d within budget envelope, cost anomaly baseline stored, budget alert configured | Forecast valid for next 30d | FinOps + SRE | SRE |
+| prod | Resilience | DR drill, chaos engineering report, backup verified | DR: 180d; chaos: 90d; backup: 30d | SRE + Platform | SRE |
+| dr | dr-region deploy with the most recent prod-bound dr drill as canary evidence | dr drill report | Last 180d | SRE | SRE |
+
+## Timeout behavior (§10.5)
+
+| Time | State | Action |
+|---|---|---|
+| Submission | PENDING_ATTESTATION | Notify responsible team |
+| 1 business day | PENDING_ATTESTATION_WARNING | Notify team + platform on-call (elevated path); emit `PENDING_ATTESTATION_TIMEOUT_WARNING` event |
+| 2 business days | PENDING_ATTESTATION_AUTO_FREEZE | Auto-freeze; require re-submission; emit `PENDING_ATTESTATION_AUTO_FREEZE` event; new submission linked via `supersedes` |
+
+**Implementation:** a Gitea `on: schedule` workflow (runs hourly) that
+scans the DynamoDB outbox for `PENDING_ATTESTATION` events with `ts`
+older than 1/2 business days and emits the warn/freeze events. Not
+implemented in the spike (dev-only).
+
+## Rejection and rollback (§10.6)
+
+Rejection returns the contract to a `HELD` state with the rejection
+reason captured as a `PROMOTION_REJECTED` event. The consumer fixes the
+cause and re-submits; the new submission is linked to the rejected one
+via `supersedes` (a contract-schema field — `schemas/contract.schema.json`).
+The audit chain is **extended, not torn up** (the "Not a mutable audit
+log" anti-goal). No partial deployment to roll back at any v1 gate.
+
+## Separation of duties (§10.3) — pointer to the .py
+
+The identity-distinctness check is platform-internal, not GitHub-native,
+not Kyverno (in v1). Sequence:
+
+1. On promotion dev → qa, the platform reads the QA approver's identity
+   from the `workflow_dispatch` run's `gitea.actor` and writes it to the
+   DynamoDB outbox keyed by `contractId` (attribute `approver_qa`).
+2. On promotion qa → prod, the platform reads the stored `approver_qa`
+   from the outbox and the new SRE approver's `gitea.actor` from the
+   prod-dispatch run.
+3. If `approver_qa == approver_prod`, the platform blocks the prod
+   promotion, writes a `SEPARATION_OF_DUTIES_VIOLATION` event to the
+   evidence stream, and routes a halt artifact to the SRE on-call.
+4. The check is implemented in `platform/separation_of_duties.py`
+   (T-7.8). The platform is the only writer to the outbox; the check is
+   in the same process that has authority to block the promotion.
+
+## Spike scope note
+
+The spike is dev-only (REQ-27 contract has `environment: dev`), so HITL
+is not exercised. Phase 07 authors the design; Phase 10's
+`verify_phase10.sh` does not assert HITL behavior. v1.2 wires the gates
+against this design.
+
+## Decision trail
+
+- **D-042** — approver identity = `gitea.actor` of the `workflow_dispatch`
+  run; no Environments API in Gitea.
+- **D-013** (v1.0) — the `workflow_dispatch` approval-input fallback,
+  re-used for the real platform's pre-execution gate model.

acdl_platform/outbox_writer.py

@@ -0,0 +1,71 @@
+"""ACDL Outbox Writer — write an evidence event to the DynamoDB outbox.
+
+ARCHITECTURE.md §9: DynamoDB outbox, RPO=0 (synchronous write before
+ack). The event is hash-chained (SHA-256 over canonical JSON); the first
+event has prev_event_hash="GENESIS". D-P10-3: the spike writes ONE
+CONFIDENCE_COMPUTED event.
+
+The outbox table (Phase 08): acdl-outbox, PAY_PER_REQUEST, PK contractId,
+SK eventType#eventTs, TTL expire_at = now + 365d (D-044).
+
+CLI: outbox_writer.py <event.json>  (uses AWS creds from env)
+"""
+
+import datetime
+import hashlib
+import json
+import os
+import sys
+
+import boto3
+
+
+OUTBOX_TABLE = "acdl-outbox"
+REGION = os.environ.get("AWS_DEFAULT_REGION", "us-east-1")
+
+
+def _canonical_hash(event):
+    """SHA-256 over canonical JSON (sort_keys, compact separators)."""
+    canonical = json.dumps(event, sort_keys=True, separators=(",", ":"))
+    return hashlib.sha256(canonical.encode("utf-8")).hexdigest()
+
+
+def write_event(event, outbox_table=OUTBOX_TABLE, region=REGION):
+    """Write an evidence event to the DynamoDB outbox. Returns the item dict."""
+    contract_id = event["contractId"]
+    event_type = event.get("eventType", "CONFIDENCE_COMPUTED")
+    event_ts = event.get("ts") or datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+    sk = f"{event_type}#{event_ts}"
+
+    # Chain: first event = GENESIS (D-P10-3 spike writes one event).
+    prev_hash = event.get("prev_event_hash", "GENESIS")
+    event_hash = _canonical_hash(event)
+
+    item = {
+        "contractId": {"S": contract_id},
+        "eventType#eventTs": {"S": sk},
+        "payload": {"S": json.dumps(event, sort_keys=True)},
+        "prev_event_hash": {"S": prev_hash},
+        "hash": {"S": event_hash},
+        "environment": {"S": str(event.get("environment", ""))},
+        "stack": {"S": str(event.get("stack", ""))},
+        "score": {"N": str(event.get("score", 0))},
+        "band": {"S": str(event.get("band", ""))},
+        "expire_at": {"N": str(int((datetime.datetime.now(datetime.timezone.utc) +
+                                     datetime.timedelta(days=365)).timestamp()))},
+    }
+
+    session = boto3.Session(region_name=region)
+    dyn = session.client("dynamodb")
+    dyn.put_item(TableName=outbox_table, Item=item)
+    return item
+
+
+if __name__ == "__main__":
+    if len(sys.argv) != 2:
+        print("usage: outbox_writer.py <event.json>", file=sys.stderr)
+        sys.exit(2)
+    with open(sys.argv[1], "r") as fh:
+        event = json.load(fh)
+    item = write_event(event)
+    print(json.dumps({k: list(v.values())[0] for k, v in item.items()}, indent=2))

acdl_platform/separation_of_duties.py

@@ -0,0 +1,42 @@
+"""Check that qaApprover != prodApprover for a contract (ARCHITECTURE.md
+§10.3, D-042). Reads `approver_qa` from the DynamoDB outbox for the
+contractId, compares to the prod-dispatch `gitea.actor`. Blocks on
+equality, emits `SEPARATION_OF_DUTIES_VIOLATION`, routes a halt artifact
+to SRE on-call.
+
+Spike scope (A-8.1): the spike is dev-only (REQ-27 contract has
+environment: dev); HITL is not exercised. This module is authored to its
+full v1.2 shape but the spike calls it with current_prod_approver=None
+and a None outbox_client — the check returns (True, 'no QA approver
+recorded (dev-only spike)').
+"""
+
+from typing import Optional, Tuple
+
+
+def check(outbox_client, contract_id: str,
+          current_prod_approver: Optional[str]) -> Tuple[bool, str]:
+    """Return (ok, reason). ok=False means block the prod promotion."""
+    if outbox_client is None:
+        return (True, "no outbox client (dev-only spike)")
+    item = outbox_client.get(contract_id)
+    if item is None:
+        return (True, "no prior approver (first promotion)")
+    qa_approver = item.get("approver_qa")
+    if not qa_approver:
+        return (True, "no QA approver recorded (dev-only spike)")
+    if current_prod_approver is None:
+        return (True, "no prod approver supplied (dev-only spike)")
+    if qa_approver == current_prod_approver:
+        return (False,
+                f"SEPARATION_OF_DUTIES_VIOLATION: "
+                f"qaApprover==prodApprover=={qa_approver}")
+    return (True, "distinct")
+
+
+def route_halt_artifact(contract_id: str, violation_reason: str,
+                        oncall_client) -> None:
+    """Route a halt artifact to SRE on-call. Spike: stub that logs. v1.2
+    wires a real pager."""
+    print(f"[halt-artifact] contract={contract_id} reason={violation_reason} "
+          f"oncall={oncall_client}", flush=True)

adapters/terraform/adapter.py

@@ -0,0 +1,384 @@
+"""ACDL Terraform adapter — compile a Target Stack IR instance to Terraform.
+
+ARCHITECTURE.md §12.2: the adapter translates the IR-typed L1 interface
+to a Terraform variable/output block, the L2 thin-composition tree to a
+root module that calls the L1 modules, the IR-typed relationships to
+Terraform module references, and emits a Terraform plan from the IR.
+
+The adapter is a THIN LAYER; it does not own L1/L2 content — it only
+translates. Substrate-agnostic in, Terraform out.
+
+Phase 09 spike: handled one L1 (l1-s3, IR type aws:s3:bucket).
+Phase 13: generalized the resource/output emission via TYPE_MAP +
+INPUT_MAP + OUTPUT_MAP tables; added ECS Fargate IR types. S3 behavior
+is preserved (regression baseline: modules-ir/l1/l1-s3/spike_instance.json).
+
+CLI: adapter.py <ir_instance.json> <out_dir>
+"""
+
+import json
+import os
+import sys
+
+
+# IR type -> Terraform resource type. The only substrate-specific table.
+# As more L1s land, this grows; the L1 content + IR do not change.
+TYPE_MAP = {
+    "aws:s3:bucket": "aws_s3_bucket",
+    "aws:ec2:vpc": "aws_vpc",
+    "aws:ec2:subnet": "aws_subnet",
+    "aws:ec2:routetable": "aws_route_table",
+    "aws:ecs:cluster": "aws_ecs_cluster",
+    "aws:ecs:task_definition": "aws_ecs_task_definition",
+    "aws:ecs:service": "aws_ecs_service",
+    "aws:iam:role": "aws_iam_role",
+    "aws:elbv2:loadbalancer": "aws_lb",
+    "aws:elbv2:listener": "aws_lb_listener",
+    "aws:elbv2:targetgroup": "aws_lb_target_group",
+    "aws:ecr:repository": "aws_ecr_repository",
+}
+
+# IR input name -> Terraform arg name, per IR type. Only non-identity
+# mappings are listed; any input not present here uses the IR name as
+# the Terraform arg name (identity).
+INPUT_MAP = {
+    "aws:s3:bucket": {"bucket_name": "bucket"},
+    "aws:ec2:vpc": {"cidr": "cidr_block", "name": "_tag_name"},
+    "aws:ec2:subnet": {"cidr": "cidr_block", "az": "availability_zone", "name": "_tag_name", "vpc_id": "vpc_id"},
+    "aws:ec2:routetable": {"vpc_id": "vpc_id", "name": "_tag_name"},
+    "aws:ecs:cluster": {},
+    "aws:ecs:task_definition": {},
+    "aws:ecs:service": {"security_group": "security_groups", "subnets": "subnets", "cluster_arn": "cluster"},
+    "aws:iam:role": {"role_name": "name", "assume_role_policy": "assume_role_policy"},
+    "aws:elbv2:loadbalancer": {"subnets": "subnets", "security_group": "security_groups"},
+    "aws:elbv2:listener": {},
+    "aws:elbv2:targetgroup": {"port": "port", "protocol": "protocol"},
+    "aws:ecr:repository": {},
+}
+
+# IR output name -> Terraform attribute name, per IR type. Only
+# non-identity mappings are listed; any output not present here uses the
+# IR name as the Terraform attribute name (identity).
+OUTPUT_MAP = {
+    "aws:s3:bucket": {"bucket_arn": "arn", "bucket_name": "id"},
+    "aws:ec2:vpc": {"vpc_id": "id"},
+    "aws:ec2:subnet": {"subnet_id": "id"},
+    "aws:ec2:routetable": {},
+    "aws:ecs:cluster": {"cluster_arn": "arn", "cluster_id": "id"},
+    "aws:ecs:task_definition": {"task_def_arn": "arn"},
+    "aws:ecs:service": {"service_arn": "id"},
+    "aws:iam:role": {"role_arn": "arn", "role_id": "id"},
+    "aws:elbv2:loadbalancer": {"lb_arn": "id"},
+    "aws:elbv2:listener": {"listener_arn": "id"},
+    "aws:elbv2:targetgroup": {"target_group_arn": "arn"},
+    "aws:ecr:repository": {"repository_arn": "arn"},
+}
+
+
+def _tf_value(value):
+    """Render a Python value as a Terraform expression fragment."""
+    if isinstance(value, bool):
+        return "true" if value else "false"
+    if isinstance(value, (int, float)) and not isinstance(value, bool):
+        return str(value)
+    if isinstance(value, str):
+        if value.startswith("ref:"):
+            raise ValueError("ref: values must be resolved via _ref_expr, not _tf_value")
+        # Detect a JSON string (object/array) and emit jsonencode() so inner
+        # quotes don't break HCL. Plain strings stay double-quoted.
+        stripped = value.lstrip()
+        if stripped and stripped[0] in "{[" :
+            try:
+                parsed = json.loads(value)
+                if isinstance(parsed, (dict, list)):
+                    return f"jsonencode({json.dumps(parsed, sort_keys=True)})"
+            except json.JSONDecodeError:
+                pass
+        return f'"{value}"'
+    if isinstance(value, (dict, list)):
+        return f"jsonencode({json.dumps(value, sort_keys=True)})"
+    raise ValueError(f"unsupported input value type {type(value).__name__}")
+
+
+def _ref_expr(ref_value, type_by_id):
+    """Translate a "ref:<ir_resource_id>.<output>" string to a Terraform
+    interpolation "${<tf_type>.<id>.<attr>}".
+
+    <ir_resource_id> is the IR resource id of the producing resource;
+    <output> is the per-resource output name (e.g. `subnet_id`,
+    `cluster_arn`); the attribute is mapped through OUTPUT_MAP for the
+    referenced resource's IR type. The resolver emits the ref using the
+    IR resource id directly (not the child id), so no child->resource
+    lookup table is needed here.
+    """
+    body = ref_value[len("ref:"):]
+    rid, out_name = body.split(".", 1)
+    rtype = type_by_id.get(rid)
+    if not rtype:
+        raise ValueError(f"ref to unknown IR resource id {rid!r}")
+    tf_type = TYPE_MAP.get(rtype)
+    if not tf_type:
+        raise ValueError(f"ref target {rid!r} has unknown IR type {rtype!r}")
+    out_map = OUTPUT_MAP.get(rtype, {})
+    tf_attr = out_map.get(out_name, out_name)
+    return f"{tf_type}.{rid}.{tf_attr}"
+
+
+def _value_expr(value, type_by_id=None):
+    """Render a value as a Terraform expression fragment. A "ref:<id>.<output>"
+    string becomes a Terraform interpolation; other values use _tf_value."""
+    if isinstance(value, str) and value.startswith("ref:"):
+        if type_by_id is None:
+            raise ValueError("ref: value encountered without a type_by_id table")
+        return _ref_expr(value, type_by_id)
+    return _tf_value(value)
+
+
+def _emit_resource(resource, type_by_id=None):
+    rtype = resource["type"]
+    rid = resource["id"]
+    tf_type = TYPE_MAP.get(rtype)
+    if not tf_type:
+        raise ValueError(f"unknown IR type {rtype!r} (adapter TYPE_MAP has no entry)")
+    in_map = INPUT_MAP.get(rtype, {})
+    body = []
+    inputs = resource.get("inputs", {})
+    for in_name, value in inputs.items():
+        if in_name == "region":
+            continue
+        arg = in_map.get(in_name, in_name)
+        if arg == "_tag_name":
+            if isinstance(value, str) and not value.startswith("ref:"):
+                tag_name = value
+            else:
+                tag_name = "app"
+            continue
+        if rtype == "aws:ecs:task_definition" and in_name in ("image", "port", "env"):
+            continue
+        if rtype == "aws:iam:role" and in_name == "managed_policies":
+            continue
+        if rtype == "aws:elbv2:loadbalancer" and in_name == "subnets":
+            if isinstance(value, str) and value.startswith("ref:"):
+                body.append(f"subnets = [{_ref_expr(value, type_by_id)}]")
+            else:
+                body.append(f"subnets = [{value}]" if isinstance(value, str) else f"subnets = {_tf_value(value)}")
+            continue
+        if rtype == "aws:elbv2:loadbalancer" and in_name == "security_group":
+            if isinstance(value, str) and value.startswith("ref:"):
+                body.append(f"security_groups = [{_ref_expr(value, type_by_id)}]")
+            else:
+                body.append(f"security_groups = [{value}]" if isinstance(value, str) else f"security_groups = {_tf_value(value)}")
+            continue
+        if rtype == "aws:ec2:routetable" and in_name == "igw_id":
+            continue
+        if rtype == "aws:ecs:service" and in_name == "lb_target_group_arn":
+            if isinstance(value, str) and value.startswith("ref:"):
+                tg_arn = _ref_expr(value, type_by_id)
+            else:
+                tg_arn = _tf_value(value)
+            body.append("load_balancer {")
+            body.append(f"  target_group_arn = {tg_arn}")
+            body.append("  container_name = \"app\"")
+            body.append("  container_port = 8080")
+            body.append("}")
+            continue
+        if rtype == "aws:ecs:service" and in_name in ("subnets", "security_group"):
+            # Collected into network_configuration block (emitted after all inputs).
+            continue
+        body.append(f"{arg} = {_value_expr(value, type_by_id)}")
+    if rtype == "aws:ecs:service":
+        subnets_val = inputs.get("subnets")
+        sg_val = inputs.get("security_group")
+        body.append("network_configuration {")
+        body.append("  subnets = " + (
+            f"[{_ref_expr(subnets_val, type_by_id)}]" if isinstance(subnets_val, str) and subnets_val.startswith("ref:")
+            else _tf_value([subnets_val] if isinstance(subnets_val, str) else subnets_val or [])
+        ))
+        body.append("  security_groups = " + (
+            f"[{_ref_expr(sg_val, type_by_id)}]" if isinstance(sg_val, str) and sg_val.startswith("ref:")
+            else _tf_value([sg_val] if isinstance(sg_val, str) else sg_val or [])
+        ))
+        body.append("}")
+        body.append("desired_count = 1")
+        body.append("launch_type = \"FARGATE\"")
+        body.append("task_definition = aws_ecs_task_definition.service-taskdefinition.arn")
+        body.append("name = \"acdl-microservice\"")
+    nfrs = resource.get("nfrs", {})
+    if isinstance(nfrs, dict) and "versioning" in nfrs and rtype == "aws:s3:bucket":
+        versioning = nfrs.get("versioning", True)
+        body.append("versioning {")
+        body.append(f'  enabled = {"true" if versioning else "false"}')
+        body.append("}")
+    elif rtype == "aws:s3:bucket":
+        body.append("versioning {")
+        body.append("  enabled = true")
+        body.append("}")
+    if rtype == "aws:ecs:task_definition":
+        body.append(_container_definitions(inputs))
+        family = inputs.get("family", "app")
+        body.append(f'family = "{family}"')
+    if rtype in ("aws:ec2:vpc", "aws:ec2:subnet") and "_tag_name" in in_map.values():
+        tag_name = inputs.get("name", "acdl")
+        if isinstance(tag_name, str) and not tag_name.startswith("ref:"):
+            body.append("tags = {")
+            body.append(f'  Name = "{tag_name}"')
+            body.append("}")
+    if rtype == "aws:iam:role" and "managed_policies" in inputs:
+        arns = [a.strip() for a in str(inputs["managed_policies"]).split(",") if a.strip()]
+        body.append("managed_policy_arns = [" + ", ".join(f'"{a}"' for a in arns) + "]")
+    if rtype == "aws:elbv2:listener":
+        body.append("default_action {")
+        body.append("  type = \"forward\"")
+        body.append("  target_group_arn = aws_lb_target_group.alb-targetgroup.arn")
+        body.append("}")
+        body.append("load_balancer_arn = aws_lb.alb-loadbalancer.id")
+    if rtype == "aws:elbv2:loadbalancer":
+        body.append("load_balancer_type = \"application\"")
+    if rtype == "aws:elbv2:targetgroup":
+        body.append("target_type = \"ip\"")
+        body.append("vpc_id = aws_vpc.vpc-vpc.id")
+        body.append("protocol = \"HTTP\"")
+    if rtype == "aws:ec2:routetable":
+        body.append("route {")
+        body.append("  cidr_block = \"0.0.0.0/0\"")
+        body.append("  gateway_id = aws_internet_gateway.vpc-igw.id")
+        body.append("}")
+        body.append("tags = {")
+        body.append('  Name = "acdl-microservice-rt"')
+        body.append("}")
+    return _resource_block(rid, tf_type, body)
+
+
+def _emit_igw(resources):
+    """Emit an internet gateway + route table associations for the VPC."""
+    vpc_id = next((r["id"] for r in resources if r["type"] == "aws:ec2:vpc"), "vpc-vpc")
+    subnet_id = next((r["id"] for r in resources if r["type"] == "aws:ec2:subnet"), "vpc-subnet")
+    rt_id = next((r["id"] for r in resources if r["type"] == "aws:ec2:routetable"), "vpc-routetable")
+    parts = []
+    parts.append(_resource_block("vpc-igw", "aws_internet_gateway", [
+        f"vpc_id = aws_vpc.{vpc_id}.id",
+        "tags = {",
+        '  Name = "acdl-microservice-igw"',
+        "}",
+    ]))
+    parts.append(_resource_block("vpc-rta", "aws_route_table_association", [
+        f"subnet_id = aws_subnet.{subnet_id}.id",
+        f"route_table_id = aws_route_table.{rt_id}.id",
+    ]))
+    return "\n".join(parts)
+
+
+def _container_definitions(inputs):
+    image = inputs.get("image", "")
+    port = inputs.get("port", 80)
+    env_raw = inputs.get("env")
+    environment = []
+    if isinstance(env_raw, dict):
+        for k, v in env_raw.items():
+            environment.append({"name": k, "value": str(v)})
+    elif isinstance(env_raw, str) and env_raw:
+        try:
+            parsed = json.loads(env_raw)
+            if isinstance(parsed, dict):
+                for k, v in parsed.items():
+                    environment.append({"name": k, "value": str(v)})
+        except json.JSONDecodeError:
+            pass
+    container = {
+        "name": "app",
+        "image": image,
+        "essential": True,
+        "portMappings": [{"containerPort": port}],
+    }
+    if environment:
+        container["environment"] = environment
+    return "container_definitions = " + _tf_value([container])
+
+
+def _resource_block(rid, tf_type, body):
+    """Emit a top-level resource block."""
+    head = f'resource "{tf_type}" "{rid}" {{'
+    body_str = "\n".join(f"  {l}" for l in body)
+    return f"{head}\n{body_str}\n}}\n"
+
+
+def _emit_output(output_name, value_expr):
+    return f'output "{output_name}" {{\n  value = {value_expr}\n}}\n'
+
+
+def adapt(ir_instance, out_dir):
+    """Emit main.tf + terraform.tf + providers.tf to out_dir for the IR instance."""
+    os.makedirs(out_dir, exist_ok=True)
+    stack = ir_instance["stack"]
+    resources = ir_instance["resources"]
+
+    # --- providers.tf: aws provider, region from the first resource's inputs.region ---
+    region = "us-east-1"
+    for r in resources:
+        if "region" in r.get("inputs", {}):
+            region = r["inputs"]["region"]
+            break
+    providers_tf = (
+        f'provider "aws" {{\n'
+        f'  region = "{region}"\n'
+        f'}}\n'
+    )
+
+    # --- terraform.tf: required_version + required_providers + S3 backend (no DynamoDB lock per D-P09-1) ---
+    # The backend key is derived from the stack name so l1 vs l2 spikes use separate state keys (D-P10-1).
+    stack_name = stack.get("name", "spike")
+    terraform_tf = (
+        'terraform {\n'
+        '  required_version = ">= 1.9, < 1.10"\n'
+        '  required_providers {\n'
+        '    aws = {\n'
+        '      source  = "hashicorp/aws"\n'
+        '      version = "~> 5.0"\n'
+        '    }\n'
+        '  }\n'
+        '  backend "s3" {\n'
+        '    bucket = "acdl-tfstate-581513795199-us-east-1"\n'
+        f'    key    = "spike/{stack_name}/terraform.tfstate"\n'
+        '    region = "us-east-1"\n'
+        '  }\n'
+        '}\n'
+    )
+
+    # --- main.tf: resources + outputs ---
+    # Build an IR-resource-id -> IR-type table so `ref:` input values can
+    # be resolved to Terraform interpolations without a child->resource
+    # lookup (the resolver emits refs with the IR resource id directly).
+    type_by_id = {r["id"]: r["type"] for r in resources}
+    main_tf_parts = []
+    has_vpc = any(r["type"] == "aws:ec2:vpc" for r in resources)
+    for r in resources:
+        main_tf_parts.append(_emit_resource(r, type_by_id))
+        rid = r["id"]
+        rtype = r["type"]
+        tf_type = TYPE_MAP.get(rtype)
+        out_map = OUTPUT_MAP.get(rtype, {})
+        outputs = r.get("outputs", {})
+        for out_name in outputs:
+            tf_attr = out_map.get(out_name, out_name)
+            main_tf_parts.append(_emit_output(out_name, f"{tf_type}.{rid}.{tf_attr}"))
+    if has_vpc:
+        main_tf_parts.append(_emit_igw(resources))
+    main_tf = "\n".join(main_tf_parts)
+
+    with open(os.path.join(out_dir, "main.tf"), "w") as fh:
+        fh.write(main_tf)
+    with open(os.path.join(out_dir, "terraform.tf"), "w") as fh:
+        fh.write(terraform_tf)
+    with open(os.path.join(out_dir, "providers.tf"), "w") as fh:
+        fh.write(providers_tf)
+    return out_dir
+
+
+if __name__ == "__main__":
+    if len(sys.argv) != 3:
+        print("usage: adapter.py <ir_instance.json> <out_dir>", file=sys.stderr)
+        sys.exit(2)
+    with open(sys.argv[1], "r") as fh:
+        ir = json.load(fh)
+    adapt(ir, sys.argv[2])
+    print(f"adapter: emitted terraform to {sys.argv[2]}", file=sys.stderr)

adapters/terraform/policy/checkov_adapter.py

@@ -0,0 +1,99 @@
+"""Translate Checkov JSON output to ACDL PolicyCheckResult records.
+
+Reads Checkov's JSON output (one framework key, e.g. terraform_plan),
+emits a list of PolicyCheckResult dicts conforming to
+schemas/policy_check_result.schema.json. Run Checkov with --soft-fail so
+Checkov never exits non-zero; the confidence signal decides the gate, not
+Checkov's exit code.
+
+Spike scope (D-043): tag/naming is a single SKIPPED record. A custom
+Checkov YAML rule for tag presence lands in v1.2.
+"""
+
+import datetime
+import json
+import sys
+
+
+RULE_MAP = {
+    "CKV_AWS_41": ("secrets-in-plaintext", "high"),
+    "CKV_AWS_45": ("secrets-in-plaintext", "high"),
+    "CKV_AWS_46": ("secrets-in-plaintext", "high"),
+    "CKV_AWS_20": ("public-ingress", "high"),
+    "CKV_AWS_57": ("public-ingress", "high"),
+    "CKV_AWS_24": ("public-ingress", "medium"),
+    "CKV_AWS_25": ("public-ingress", "medium"),
+    "CKV_AWS_1": ("iam-wildcard", "high"),
+    "CKV_AWS_40": ("iam-wildcard", "medium"),
+    "CKV_AWS_7": ("kms-key-reference", "medium"),
+    "CKV_AWS_33": ("kms-key-reference", "medium"),
+}
+
+_RESULT_MAP = {"PASSED": "pass", "FAILED": "fail", "SKIPPED": "skipped"}
+
+
+def _iso8601_now():
+    return datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+
+
+def _to_pcr(checkov_record, contract_id, result_str):
+    check_id = checkov_record.get("check_id", "")
+    default_sev = RULE_MAP.get(check_id, (check_id, "info"))[1]
+    severity = checkov_record.get("severity", default_sev)
+    if isinstance(severity, str):
+        severity = severity.lower()
+    return {
+        "contractId": contract_id,
+        "evaluatedAt": _iso8601_now(),
+        "engine": "checkov",
+        "ruleId": check_id,
+        "severity": severity,
+        "result": _RESULT_MAP.get(result_str, "error"),
+        "message": checkov_record.get("check_name", ""),
+        "evidence": {
+            "file_path": checkov_record.get("file_path"),
+            "resource": checkov_record.get("resource"),
+            "resource_address": checkov_record.get("resource_address"),
+            "code_block": checkov_record.get("code_block"),
+        },
+        "resourceRef": checkov_record.get("resource_address") or checkov_record.get("resource", ""),
+    }
+
+
+def _emit_tag_naming_skipped(contract_id):
+    return {
+        "contractId": contract_id,
+        "evaluatedAt": _iso8601_now(),
+        "engine": "checkov",
+        "ruleId": "ACDL_TAG_NAMING",
+        "severity": "info",
+        "result": "skipped",
+        "message": "tag/naming check deferred to v1.2 (D-043)",
+        "evidence": {},
+        "resourceRef": "",
+    }
+
+
+def adapt(checkov_json_path, contract_id):
+    with open(checkov_json_path, "r", encoding="utf-8") as fh:
+        data = json.load(fh)
+    out = []
+    for framework, body in data.items():
+        results = body.get("results", body) if isinstance(body, dict) else {}
+        if not isinstance(results, dict):
+            continue
+        for rec in results.get("passed_checks", []):
+            out.append(_to_pcr(rec, contract_id, "PASSED"))
+        for rec in results.get("failed_checks", []):
+            out.append(_to_pcr(rec, contract_id, "FAILED"))
+        for rec in results.get("skipped_checks", []):
+            out.append(_to_pcr(rec, contract_id, "SKIPPED"))
+    out.append(_emit_tag_naming_skipped(contract_id))
+    return out
+
+
+if __name__ == "__main__":
+    if len(sys.argv) != 3:
+        print("usage: checkov_adapter.py <checkov.json> <contract-id>", file=sys.stderr)
+        sys.exit(2)
+    print(json.dumps(adapt(sys.argv[1], sys.argv[2]), indent=2))

consumer-repos/acdl-consumer-microservice/Dockerfile

@@ -0,0 +1,7 @@
+FROM python:3.12-slim
+
+WORKDIR /app
+COPY app.py /app/app.py
+
+EXPOSE 8080
+CMD ["python", "/app/app.py"]

consumer-repos/acdl-consumer-microservice/README.md

@@ -0,0 +1,34 @@
+# acdl-consumer-microservice
+
+A basic HTTP microservice for the ACDL v1.2 milestone. Returns 200 on `/`
+and `/health` with a JSON status body. Deployed to AWS ECS Fargate via the
+ACDL platform's `l2-microservice` contract.
+
+## Build + push to ECR
+
+```bash
+# Build
+docker build -t acdl-microservice .
+
+# Tag for ECR
+docker tag acdl-microservice:latest 581513795199.dkr.ecr.us-east-1.amazonaws.com/acdl-microservice:latest
+
+# Authenticate to ECR
+aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin 581513795199.dkr.ecr.us-east-1.amazonaws.com
+
+# Push
+docker push 581513795199.dkr.ecr.us-east-1.amazonaws.com/acdl-microservice:latest
+```
+
+## Contract
+
+The contract submission is at `contracts/microservice.yaml` (or the
+platform's `contracts/microservice.yaml`). Submitting it to the ACDL
+pipeline triggers: contract → IR resolution → `terraform plan` →
+`terraform apply` (dev) → a live ECS Fargate service.
+
+## Endpoints
+
+- `GET /` — 200, `{"status":"ok","service":"acdl-microservice","version":"1.0.0"}`
+- `GET /health` — 200, same body
+- any other path — 404

consumer-repos/acdl-consumer-microservice/app.py

@@ -0,0 +1,37 @@
+"""ACDL consumer microservice — a tiny HTTP server returning 200 on /.
+
+This is the reference consumer microservice for the v1.2 milestone. It's
+intentionally minimal: stdlib only, no framework, no dependencies. The
+platform deploys it to ECS Fargate via the l2-microservice contract.
+"""
+import json
+import os
+from http.server import BaseHTTPRequestHandler, HTTPServer
+
+
+class Handler(BaseHTTPRequestHandler):
+    def do_GET(self):
+        if self.path == "/" or self.path == "/health":
+            body = json.dumps({
+                "status": "ok",
+                "service": "acdl-microservice",
+                "version": "1.0.0",
+            }).encode()
+            self.send_response(200)
+            self.send_header("Content-Type", "application/json")
+            self.send_header("Content-Length", str(len(body)))
+            self.end_headers()
+            self.wfile.write(body)
+        else:
+            self.send_response(404)
+            self.end_headers()
+
+    def log_message(self, format, *args):
+        print(f"{self.address_string()} - {format % args}")
+
+
+if __name__ == "__main__":
+    port = int(os.environ.get("PORT", "8080"))
+    server = HTTPServer(("0.0.0.0", port), Handler)
+    print(f"acdl-microservice listening on :{port}", flush=True)
+    server.serve_forever()

demo/ACDL_DEMO.md

@@ -0,0 +1,368 @@
+---
+marp: true
+theme: default
+paginate: true
+size: 16:9
+header: 'ACDL · Agentic Cloud Delivery Platform'
+footer: 'Executive Demo · v1.0'
+style: |
+  /* S&P Global-inspired palette */
+  :root {
+    --sp-red: #C8102E;
+    --sp-red-dark: #8E0B20;
+    --sp-ink: #1A1A1A;
+    --sp-slate: #4A4A4A;
+    --sp-gray: #6E6E6E;
+    --sp-line: #D6D6D6;
+    --sp-bg: #FFFFFF;
+    --sp-tint: #F4F4F4;
+  }
+  section {
+    font-size: 24px;
+    color: var(--sp-ink);
+    background: var(--sp-bg);
+    font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif;
+    padding: 50px 60px;
+  }
+  section.title {
+    text-align: center;
+    background: var(--sp-red);
+    color: #FFFFFF;
+    display: flex;
+    flex-direction: column;
+    justify-content: center;
+  }
+  section.title h1 {
+    color: #FFFFFF;
+    font-size: 64px;
+    margin-bottom: 0;
+    border: none;
+  }
+  section.title h2 {
+    color: #FFFFFF;
+    border: none;
+    font-weight: 400;
+  }
+  section.title strong { color: #FFFFFF; }
+  h1 {
+    color: var(--sp-red);
+    font-size: 40px;
+    font-weight: 700;
+    margin-bottom: 12px;
+  }
+  h2 {
+    color: var(--sp-red);
+    border-bottom: 3px solid var(--sp-red);
+    padding-bottom: 6px;
+    font-weight: 700;
+  }
+  h3 {
+    color: var(--sp-red-dark);
+    font-weight: 600;
+    margin-top: 24px;
+  }
+  ul, ol { color: var(--sp-slate); }
+  li { margin-bottom: 6px; }
+  strong { color: var(--sp-ink); }
+  table {
+    font-size: 18px;
+    width: 100%;
+    border-collapse: collapse;
+    margin: 12px 0;
+  }
+  th {
+    background: var(--sp-red);
+    color: #FFFFFF;
+    text-align: left;
+    padding: 10px 12px;
+    font-weight: 600;
+    border: 1px solid var(--sp-red-dark);
+  }
+  td {
+    padding: 8px 12px;
+    border: 1px solid var(--sp-line);
+    color: var(--sp-slate);
+  }
+  tr:nth-child(even) td { background: var(--sp-tint); }
+  pre {
+    font-size: 13px;
+    background: var(--sp-tint);
+    border-left: 4px solid var(--sp-red);
+    padding: 14px 16px;
+    border-radius: 0;
+    color: var(--sp-ink);
+  }
+  code {
+    background: var(--sp-tint);
+    color: var(--sp-red-dark);
+    padding: 1px 5px;
+    border-radius: 2px;
+    font-family: 'Menlo', 'Consolas', monospace;
+  }
+  pre code {
+    background: none;
+    color: var(--sp-ink);
+    padding: 0;
+  }
+  blockquote {
+    border-left: 5px solid var(--sp-red);
+    background: var(--sp-tint);
+    padding: 10px 16px;
+    color: var(--sp-slate);
+    font-style: italic;
+    border-radius: 0;
+  }
+  header {
+    color: var(--sp-red);
+    font-weight: 700;
+    font-size: 14px;
+  }
+  footer {
+    color: var(--sp-gray);
+    font-size: 12px;
+  }
+  section::after {
+    color: var(--sp-red);
+    font-weight: 700;
+  }
+---
+
+<!-- _class: title -->
+
+# ACDL
+## Agentic Cloud Delivery Platform
+
+Automatic. Safe. Audited. — in 30 minutes, on stubs.
+
+v1.0 · GitHub Actions · stub-driven
+
+<!--
+30-min exec demo. Emphasize: we prove INTENT and SAFETY, not provision real infra.
+Everything runs as local stubs on Linux via GitHub Actions. No AWS.
+-->
+
+---
+
+# The Problem
+
+### Today, deploying infrastructure takes **weeks**
+
+- Ticket → triage queue → copy-paste config → peer review → security review → waiting for central IT to release
+
+> Two weeks of human latency for a service that should take minutes.
+
+### What we want instead
+
+- Developer commits a **contract** → pipeline runs
+- Safety **computed** automatically (confidence signal)
+- Manual gates only where they matter (QA, Prod)
+- Every step written to a tamper-evident **evidence stream**
+
+<!--
+Set the pain. Ask: who has lived this? Then pivot to the vision.
+-->
+
+---
+
+# How It Works
+
+```
+              ┌────────────── acdl-contracts ──────────────┐
+ Developer ──▶│ commit contract.yaml                     │
+              └───────┬───────────────────────────────────┘
+                      │ (push)
+ Citizen    ┌─────────┴──────────┐
+  │ "ingest gas pricing into data lake"
+  ▼
+ Claude agent ──▶ contract.yaml ─┘
+                      │ (push)
+                      ▼
+            ┌─────────────────┐
+            │ reusable         │
+            │ GitHub Actions   │
+            │ pipeline         │
+            └────────┬────────┘
+                     │
+       ┌─────────────┼─────────────┐
+       ▼             ▼             ▼
+ Dev (auto)   QA (approval)   Prod (approval)
+       │
+       ▼
+ evidence_writer ─▶ audit.json (hash-chained) ─▶ Pages timeline
+```
+
+Two entry paths, **one** pipeline, **one** audit trail — developer via GitHub, citizen developer via their own Claude agent.
+
+<!--
+Two surfaces: developers push contracts directly to GitHub; citizen developers prompt a Claude agent they own, which writes and pushes the contract for them.
+Both converge on one GitHub Actions pipeline with three stages.
+-->
+
+---
+
+# The Safety Story
+
+### Computed, not requested
+
+| Signal | Behavior |
+|--------|----------|
+| **Base confidence** | 0.90 |
+| **On policy violation** | drop to 0.40 + reason code |
+| **Gate threshold** | ≥ 0.50 to proceed past Dev |
+
+### Policy (v1)
+- `public-ingress: true` → `POLICY_VIOLATION:PUBLIC_INGRESS`
+
+### Evidence
+- Each event appended to `audit.json` with SHA-256 link to previous (`prev_hash` + `hash`)
+- Published to Pages → vanilla-JS timeline
+
+<!--
+Safety is computed by the platform, not asked of the developer.
+Threshold 0.50 is exact → 0.90 passes, 0.40 halts. That's what makes the three scenarios deterministic.
+-->
+
+---
+
+# Scenario 1 — Developer Self-Service
+
+### Trigger
+Developer commits a valid `contract.yaml` requesting **`l2-commodity-price-feed`** via **GitHub**.
+
+### What you'll see
+- **Dev:** policy ✅ → apply api-gateway, lambda, s3 → confidence **0.90** → proceed
+- **QA:** pipeline pauses → click **Approve**
+- **Prod:** pipeline pauses → click **Approve**
+- **Finalize:** `audit.json` committed → Pages timeline updates
+
+### Evidence outcome
+Timeline shows: contract received → policy pass → apply × 3 → confidence 0.90 → QA → Prod → published.
+
+<!--
+Normal developer flow: human writes the contract, pushes to GitHub, the GitHub Action pipeline runs.
+Narrate: developer commits and walks away; platform does the rest.
+Pause visibly at each gate so the audience sees human-in-the-loop.
+End by refreshing the Pages timeline.
+-->
+
+---
+
+# Scenario 1 — Journey
+
+```mermaid
+flowchart LR
+  classDef gh fill:#F4F4F4,stroke:#1A1A1A,stroke-width:2px,color:#1A1A1A
+  classDef stage fill:#C8102E,stroke:#8E0B20,stroke-width:1px,color:#FFFFFF
+  classDef gate fill:#FFFFFF,stroke:#1A1A1A,stroke-width:2px,color:#1A1A1A
+  classDef evidence fill:#F4F4F4,stroke:#C8102E,stroke-width:1px,color:#1A1A1A
+
+  D["Developer"]:::gh -->|"writes contract.yaml"| GH["GitHub<br/>acdl-contracts"]:::gh
+  GH -->|"push triggers<br/>GitHub Action"| DEV["Dev<br/>(autonomous)"]:::stage
+  DEV -->|"policy ✅ · confidence 0.90"| QA["QA<br/>approval gate"]:::gate
+  QA -->|"approve"| PROD["Prod<br/>approval gate"]:::gate
+  PROD -->|"approve"| FIN["Finalize<br/>commit audit.json"]:::stage
+  FIN --> TL["GitHub Pages<br/>timeline"]:::evidence
+```
+
+<!--
+Point to the two approval gates — QA and Prod — both human clicks.
+The whole chain from commit to timeline is one GitHub Actions workflow.
+-->
+
+---
+
+# Scenario 2 — Citizen Developer
+
+### Trigger
+Non-technical user prompts their **own Claude agent** in natural language:
+
+> "I need a new service to ingest real-time natural gas pricing data into our data lake."
+
+### What you'll see
+- Claude agent parses intent, writes `contract.yaml` for **`l2-commodity-price-feed`**, pushes a branch
+- Issue **closed**; branch push triggers the **identical** pipeline from Scenario 1
+- Citizen developer follows the run all the way to **Prod**
+
+### Evidence outcome
+Timeline is **indistinguishable** from Scenario 1 — the agentic surface is first-class, not a bolt-on.
+
+<!--
+Punchline: same timeline, same safety, same audit — different entry.
+The citizen developer owns and drives their own Claude agent; they are the actor, not the platform.
+Normal developers (Scenario 1) keep using GitHub directly — two surfaces, one pipeline, one audit.
+-->
+
+---
+
+# Scenario 2 — Journey
+
+```mermaid
+flowchart LR
+  classDef cit fill:#F4F4F4,stroke:#C8102E,stroke-width:2px,color:#1A1A1A
+  classDef agent fill:#C8102E,stroke:#8E0B20,stroke-width:1px,color:#FFFFFF
+  classDef stage fill:#1A1A1A,stroke:#1A1A1A,stroke-width:1px,color:#FFFFFF
+  classDef gate fill:#FFFFFF,stroke:#1A1A1A,stroke-width:2px,color:#1A1A1A
+  classDef evidence fill:#F4F4F4,stroke:#C8102E,stroke-width:1px,color:#1A1A1A
+
+  CD["Citizen developer"]:::cit -->|"natural-language<br/>prompt"| CL["Claude agent<br/>(citizen-owned)"]:::agent
+  CL -->|"generates<br/>contract.yaml"| GH["GitHub<br/>acdl-contracts"]:::cit
+  GH -->|"push triggers<br/>GitHub Action"| DEV["Dev<br/>(autonomous)"]:::stage
+  DEV -->|"policy ✅ · confidence 0.90"| QA["QA<br/>approval gate"]:::gate
+  QA -->|"approve"| PROD["Prod<br/>approval gate"]:::gate
+  PROD -->|"approve"| FIN["Finalize<br/>commit audit.json"]:::stage
+  FIN --> TL["GitHub Pages<br/>timeline"]:::evidence
+```
+
+<!--
+Highlight the red Claude-agent node — owned by the citizen, not by the platform.
+From GitHub onward the journey is identical to Scenario 1.
+-->
+
+---
+
+# Scenario 3 — The Safety Net
+
+### Trigger
+Developer commits a **malicious** `contract.yaml` for `l2-regulatory-reporting` via **GitHub**:
+
+```yaml
+stack: l2-regulatory-reporting
+public-ingress: true
+```
+
+### What you'll see
+- **Dev:** `policy_checker` → `POLICY_VIOLATION:PUBLIC_INGRESS`
+- `confidence_signal` drops 0.90 → **0.40**
+- `0.40 < 0.50` → pipeline **halts in Dev**
+- Rejection reason written to the evidence stream
+
+### Evidence outcome
+Timeline shows the attempted deploy, the violation, the confidence drop, and the **halt** — visible and explained.
+
+<!--
+The safety money shot. The platform said NO, and said WHY, on the record.
+No human had to catch it — the confidence signal computed the risk.
+Contrast with The Problem's old-world review queue.
+-->
+
+---
+
+# Scenario 3 — Journey
+
+```mermaid
+flowchart LR
+  classDef gh fill:#F4F4F4,stroke:#1A1A1A,stroke-width:2px,color:#1A1A1A
+  classDef stage fill:#C8102E,stroke:#8E0B20,stroke-width:1px,color:#FFFFFF
+  classDef halt fill:#1A1A1A,stroke:#1A1A1A,stroke-width:1px,color:#FFFFFF
+  classDef evidence fill:#F4F4F4,stroke:#C8102E,stroke-width:1px,color:#1A1A1A
+
+  D["Developer"]:::gh -->|"writes malicious<br/>contract.yaml"| GH["GitHub<br/>acdl-contracts"]:::gh
+  GH -->|"push triggers<br/>GitHub Action"| DEV["Dev<br/>(autonomous)"]:::stage
+  DEV -->|"POLICY_VIOLATION:PUBLIC_INGRESS<br/>confidence 0.90 → 0.40"| HALT["Halt in Dev<br/>+ rejection reason"]:::halt
+  HALT --> TL["GitHub Pages<br/>timeline"]:::evidence
+```
+
+<!--
+The black halt node is the whole point — pipeline stops, evidence records why.
+Notice there are no QA/Prod gates on this path; the journey ends at Dev.
+-->

demo/contracts/examples/contract-commodity-price-feed-prod.yaml

@@ -0,0 +1,55 @@
+# Elaborate developer contract — energy trading price feed.
+#
+# Schema (D-021): stack + inputs (open-ended string map) + public-ingress.
+# The `stack` field MUST match an L2 folder name under modules/l2/.
+# The `inputs` map is free-form string values; these are L2-level params
+# that travel with the deployment into state.json and the audit trail.
+# The L1 input values are declared by the L2's manifest.yaml, not here.
+#
+# Commit this to acdl-contracts as contract.yaml to trigger the pipeline:
+#   git add contract.yaml && git commit -m "feat: deploy price feed (prod)" && git push
+
+stack: l2-commodity-price-feed
+
+inputs:
+  # --- Environment + ownership ---
+  environment: prod
+  owner: commodity-trading-platform-team
+  team: power-and-gas-desk
+  cost_center: CC-TRD-4471
+  change_ticket: CHG-2026-07-21-093
+
+  # --- Business context (rides into the audit timeline) ---
+  business_owner: kchen@jccapital.xyz
+  oncall_email: sre-commodity@example.com
+  sla_tier: T1
+  business_hours: "Mon-Fri 07:00-19:00 ET"
+  data_classification: internal
+
+  # --- Source feed contract (business-facing) ---
+  feed_vendor: Platts
+  feed_name: natural-gas-daily-settlement
+  feed_cadence: daily
+  feed_timezone: US/Eastern
+  symbols: "NG-WTI-HH,NG-HH-M,NG-PJM"
+  retry_policy: backoff-3x-15min
+  dead_letter_queue: commodity-price-dlq
+
+  # --- Deployment knobs (consumed by the pipeline; passed to L1s via L2 manifest) ---
+  replicas: "3"
+  cpu_request: "500m"
+  memory_request: "1Gi"
+  autoscale_min: "2"
+  autoscale_max: "8"
+  log_retention_days: "90"
+  archive_retention_days: "2555"
+
+  # --- Operational flags ---
+  enable_canary: "true"
+  canary_percentage: "10"
+  enable_pagerduty: "true"
+  enable_cost_alerts: "true"
+  cost_alert_threshold_usd: "500"
+
+# Policy-gated field. true -> POLICY_VIOLATION:PUBLIC_INGRESS -> confidence 0.40 < 0.50 -> Dev rejects (Act 4).
+public-ingress: false

demo/contracts/examples/contract-regulatory-reporting-violation.yaml

@@ -0,0 +1,55 @@
+# Elaborate developer contract — regulatory reporting (with policy violation).
+#
+# Same schema as the price-feed example, but with public-ingress: true,
+# which triggers Act 4: the policy_checker fails, the confidence_signal
+# drops to 0.40, the 0.50 gate halts the pipeline in Dev, and the
+# rejection appears on the evidence timeline.
+#
+# Commit this to acdl-contracts as contract.yaml to reproduce Act 4:
+#   git add contract.yaml && git commit -m "feat: deploy regulatory reporting" && git push
+
+stack: l2-regulatory-reporting
+
+inputs:
+  # --- Environment + ownership ---
+  environment: prod
+  owner: compliance-and-controls-team
+  team: regulatory-reporting-desk
+  cost_center: CC-CMP-9902
+  change_ticket: CHG-2026-07-21-118
+  business_owner: compliance@jccapital.xyz
+  oncall_email: sre-regulatory@example.com
+  sla_tier: T0
+  business_hours: "24x7"
+  data_classification: confidential
+
+  # --- Regulatory context ---
+  regulator: FERC
+  filing_frequency: monthly
+  filing_deadline_day_of_month: "15"
+  reporting_period: 2026-Q3
+  jurisdiction: US-Federal
+  legal_hold: "false"
+
+  # --- Deployment knobs ---
+  replicas: "2"
+  cpu_request: "1000m"
+  memory_request: "2Gi"
+  autoscale_min: "2"
+  autoscale_max: "4"
+  log_retention_days: "365"
+  archive_retention_days: "2555"
+  enable_encryption_at_rest: "true"
+  enable_kms_rotation: "true"
+
+  # --- Operational flags ---
+  enable_canary: "false"
+  enable_pagerduty: "true"
+  enable_cost_alerts: "true"
+  cost_alert_threshold_usd: "1000"
+
+# POLICY VIOLATION — this is the Act 4 trigger.
+# The policy_checker.py will emit: POLICY_VIOLATION:PUBLIC_INGRESS
+# The confidence_signal.py will return: {"score": 0.40, "reason": "POLICY_VIOLATION:PUBLIC_INGRESS"}
+# The 0.50 gate halts the pipeline in Dev; mock_executor never runs.
+public-ingress: true

docs/architecture-v1.0.md

@@ -0,0 +1,458 @@
+# Architecture Document v1.0
+
+> **Snapshot status:** v1.0 — taken in ACDL Phase 07 (milestone v1.1).
+> All 11 open decisions in §13 are **resolved** — see `PROJECT.md`
+> "Open-decision resolutions" table + decisions D-034..D-046.
+> The body §§1-12 is copied verbatim from the upstream
+> `docs/architecture.md` v0.2; only the header status line, the resolution
+> session log, §13, §14, and the new §15 are Phase 07 additions. The
+> `act_runner` → `gitea-runner` rename (D-046, 2026-04 in gitea/runner#850)
+> is applied; `act_runner` appears only in a "formerly" note.
+
+# Agentic Cloud Delivery Platform — Architecture Document
+
+Status: **v1.0** (snapshot taken in ACDL Phase 07, milestone v1.1). All 11
+open decisions in §13 are resolved — see `PROJECT.md` "Open-decision
+resolutions" table + decisions D-034..D-046.
+
+Companion to: Agentic Cloud Delivery Vision [1].
+
+Authoring principle: The vision is the source of truth for why [1]; this document is the source of truth for how. Where the two conflict, the vision wins.
+
+Resolution session log (v1.0 snapshot — see PROJECT.md for full text):
+
+| ID | Question | Resolution (one-line — see PROJECT.md for rationale) |
+|---|---|---|
+| W1.A | AI-refinement trigger | ✅ RESOLVED — joint condition: N ≥ 50 consecutive zero-rollback changes AND no L1/L2 incident in 6 months AND Infra & Ops unilateral override. |
+| W1.B | Multi-stack edge case rule | ✅ RESOLVED — permitted only for (a) DR-region mirror, (b) time-boxed experimental stack TTL ≤ 30d, (c) explicit Infra & Ops approval with `multiStack.justification`. |
+| W2.A | Tag mutability for prod | ✅ RESOLVED — Path B: tag for dev/qa, SHA for prod; platform CLI resolves tag→SHA. |
+| W3.D | L1/L2 standard versioning | ✅ RESOLVED — semver (interface→MAJOR, behavior→MINOR, lifecycle→PATCH); L2 pins L1 by `name@semver`; MAJOR bump = new registry entry + 12-month deprecation. |
+| W3.E | Schema mandatory vs. optional inputs | ✅ RESOLVED — dev: stack+environment; qa adds validation.e2eSuite+loadTest; prod adds runbook+dashboard+oncall; dr adds drDrillRef; `inputs` always optional; `profile: agentic` fields optional everywhere (naturalLanguageIntent required when profile is agentic). |
+| BA.A | Initial L3B skill catalog | ✅ RESOLVED — 5 skills: web API, worker, scheduled job, static asset, basic observability bootstrap; addition criteria: (a) sensitive-data reviewable, (b) single contract submission, (c) documented use case. |
+| BA.B | Confidence threshold tuning | ✅ RESOLVED — thresholds frozen for v1; tuning begins v1.2 (quarterly FP/FN tracking; override = Infra & Ops + SRE joint sign-off, itself a confidence-event). |
+| BA.C | On-call / operational ownership | ✅ RESOLVED — platform on-call = Infra & Ops; L3A/L3B halt → platform on-call (Sev2); consumer-visible outage → consumer on-call (Sev1) + platform support. |
+| BA.D | Cost / capacity governance | ✅ RESOLVED — FinOps owns cloud cost; per-contract monthly reporting; runaway spend hard-halts at 120% of declared budget via the confidence signal; override = FinOps + SRE joint sign-off. |
+| BA.E | Consumer onboarding | ✅ RESOLVED — developer (L3A): `getting-started` → contract schema + central pipeline template; citizen (L3B): scoped agent + skill catalog, no workflow authoring; both end in a sandbox dev submission that must pass the confidence gate. |
+| BA.F | Cross-platform evolution | ✅ RESOLVED — contract schema, IR, PolicyCheckResult, confidence signal, audit stream are portable (forge-agnostic); forge-specific code = workflow YAML, OIDC trust, CODEOWNERS, Environments; a second forge needs a forge adapter + workflow-template translator, no change to L1/L2/IR/confidence/audit. |
+| Q1.3 | OpenTofu timing | ✅ RESOLVED (deferred) — not in v1 or v1.1; the substrate abstraction (§12) makes OpenTofu a future adapter, not an architecture change; revisit when an OpenTofu adapter is requested. |
+
+---
+
+## 0. Purpose
+
+This document encodes the architectural commitments that realize the vision [1]. The resolution session has closed eight open items; the document is now at v0.2 with eleven open items remaining, listed in Section 13. Every locked commitment is grounded in either a vision tenet or a specific decision made during resolution.
+
+The structure remains: four layers (L1 primitives, L2 composed stacks, L3A developer surface, L3B agentic surface) plus five cross-cutting concerns (central pipeline, contract schema, confidence signal, audit stream, HITL mechanics), with one addition: the substrate abstraction layer (Section 12) is now a first-class architectural concern, not an implementation detail.
+
+## 1. Architectural Overview
+
+The platform remains four layers and five cross-cutting concerns. The substrate abstraction is added as a sixth cross-cutting concern in Section 12 because it is the binding constraint for the L1/L2 model, the central pipeline, and the policy toolchain.
+
+The vision's "Two Consumer Surfaces, One Platform" tenet [1] remains the constraint that binds all concerns: L3A and L3B converge on the same contract schema, the same policy envelope, and the same evidence stream.
+
+Locked additions this revision:
+
+- The environment model is dev (autonomous) → qa (QA HITL) → prod (SRE HITL) → dr (SRE HITL). Staging does not exist.
+
+- L1/L2 are substrate-agnostic in shape; substrate adapters are the only substrate-specific component.
+
+## 2. Layer 1 — Foundational Primitives
+
+Purpose. Single-purpose, substrate-agnostic primitive modules representing the smallest reusable infrastructure pieces. L1 modules do not compose with other L1 modules; L1 takes its environment as input.
+
+Locked commitments (unchanged from v0.1):
+
+- No inter-L1 references. L1 may call Terraform data sources.
+
+- Semver with three triggers (interface → MAJOR, behavior → MINOR, lifecycle → PATCH).
+
+- Immutability on publication.
+
+- 12-month deprecation window.
+
+- AI refinement is a flag.
+
+✅ RESOLVED (see PROJECT.md W1.A): AI-refinement operational trigger — joint condition: N ≥ 50 consecutive changes with zero rollbacks AND no L1/L2 incident in last 6 months AND Infra & Ops holds a unilateral override.
+
+✅ RESOLVED (sub-decision): The L1 module's interface field is defined against the Target Stack IR, not against Terraform's variable block directly. In v1, the IR is shaped to round-trip cleanly to Terraform, but the schema is substrate-agnostic. Pending v1 implementation details in Section 12.
+
+## 3. Layer 2 — Composed Stacks
+
+Purpose. Combine L1 primitives into deployable infrastructure shapes. Each codebase maps to one canonical L2 stack; the stack is either a parameterized module (Shape X) or a thin-composition layer (Shape Y).
+
+Locked commitments (unchanged from v0.1):
+
+- 1 codebase = 1 L2 stack (default), with multiStack: true for exceptions.
+
+- Shape X or Shape Y.
+
+- Hierarchical composition, max depth 5, only registered L1s.
+
+- Pipeline quality checks: secrets-in-plaintext, public ingress, IAM wildcard, KMS key reference, tag compliance, naming convention.
+
+- Restricted from thin-composition: IAM principal creation, network boundary creation, key/secret creation, external data transfer.
+
+- Auto-promote after 3 observed usages.
+
+✅ RESOLVED (see PROJECT.md W1.B): Multi-stack edge case rule — permitted only for (a) DR-region mirror, (b) time-boxed experimental stack with TTL ≤ 30 days, (c) explicit Infra & Ops approval for a documented reason captured in multiStack.justification.
+
+✅ RESOLVED (sub-decision): The L2 thin-composition tree's wires field is defined against the IR's relationship type, not against a Terraform module block. The IR → Terraform translation is the Terraform adapter's job (Section 12). The thin-composition pipeline itself is substrate-agnostic.
+
+## 4. Layer 3A — Developer Consumer Surface
+
+Locked commitments (unchanged from v0.1):
+
+- Tag-based reference to the central pipeline template.
+
+- Developer-owned workflow file, no platform auto-sync.
+
+- L3A and L3B are parallel paths, not a progression.
+
+✅ RESOLVED (see PROJECT.md W2.A): Tag mutability for production-bound references — Path B (tag for dev/qa, SHA for prod). The platform provides a CLI command that resolves the current tag to its SHA for prod-bound workflows.
+
+## 5. Layer 3B — Agentic Consumer Surface
+
+Locked commitments (unchanged from v0.1):
+
+- Hybrid runtime, skill as markdown, agent as executor.
+
+- Trust model: trust and always verify on the platform side.
+
+- Skill envelope (4 dimensions).
+
+- Stateless agents, all state in the platform.
+
+Environment progression — locked (this revision):
+
+| Environment | Autonomy | Attester | Gate |
+|---|---|---|---|
+| dev | Full autonomy (no HITL) | — | Confidence signal ≥ 0.50, all six inputs present |
+| qa | Held for attestation | QA | GitHub Deployment approval + full QA matrix (see §10) |
+| prod | Held for attestation | SRE | GitHub Deployment approval + full SRE matrix (see §10) |
+| dr | Held for attestation | SRE | GitHub Deployment approval + dr-drill evidence (see §10) |
+
+Staging is removed. Dev is the only autonomous environment and absorbs integration, contract, security smoke, and performance smoke validation. The CDLC reference document's environment model is a doc-sync item flagged at the top of this document.
+
+Profile marker: profile: agentic unlocks L3B-specific fields naturalLanguageIntent, confidenceAtSubmission, agentTrace).
+
+✅ RESOLVED (see PROJECT.md BA.A): Skill catalog — initial set: web API, worker, scheduled job, static asset, basic observability bootstrap. Addition criteria: (a) reviewable for sensitive data, (b) expressible as a single contract submission, (c) documented use case.
+
+## 6. Cross-Cutting — Central Pipeline Template
+
+Locked commitments (unchanged from v0.1):
+
+- JSON Schema (draft 2020-12) with thin domain-specific wrapper.
+
+- Central repo + generated client libraries.
+
+- Multi-stage validation pipeline (schema → policy → NFR → confidence).
+
+- Distributed enrichment.
+
+- GitOps reconciler + Terraform execution layer.
+
+Locked additions this revision:
+
+- The GitOps reconciler is the platform's K8s API. The cdlc-gitops repository's state materializes into K8s CRDs (ArgoCD Applications or Flux Kustomizations) that the reconciler watches. This is the platform's internal state surface.
+
+- The pipeline emits a PolicyCheckResult record per policy rule evaluated. The confidence signal consumes these as one normalized input (Section 8).
+
+✅ RESOLVED (see PROJECT.md W3.D): L1/L2 standard versioning details — semver (interface→MAJOR, behavior→MINOR, lifecycle→PATCH); L2 contracts pin L1 by `name@semver`; the resolver picks the highest compatible; MAJOR bumps require a new registry entry (immutable publication); old entry enters a 12-month deprecation window.
+
+✅ RESOLVED (see PROJECT.md W3.E): Schema mandatory vs. optional inputs — dev requires stack+environment; qa adds validation.e2eSuite + validation.loadTest; prod adds runbook + dashboard + oncall; dr adds drDrillRef; `inputs` always optional; `profile: agentic` fields optional everywhere (naturalLanguageIntent required when profile is agentic).
+
+## 7. Cross-Cutting — Contract Schema
+
+Locked commitments (unchanged from v0.1):
+
+- Central repo + generated client libraries.
+
+- Strict fail-fast at schema stage, multi-stage validation pipeline with reason codes from a published vocabulary.
+
+✅ RESOLVED (see PROJECT.md W3.E): Schema mandatory vs. optional inputs. The CDLC reference contract example [1] is illustrative; the v1 contract schema has explicit per-field mandatory/optional declarations per environment.
+
+## 8. Cross-Cutting — Confidence Signal
+
+Locked commitments (unchanged from v0.1):
+
+- Six canonical inputs.
+
+- Weighted sum with per-input breakdown.
+
+- Per-environment thresholds: dev ≥ 0.50, qa ≥ 0.75, prod ≥ 0.90, dr ≥ 0.95.
+
+- Structured output { score, band, perInput, reasonCodes }.
+
+- 1-year storage, no algorithm retraining in v1.
+
+- Halt with explicit reason on missing input.
+
+Locked additions this revision:
+
+- The policy check results input is a list of PolicyCheckResult records from the normalized schema (Section 9, 12). The signal does not know which engine produced which result.
+
+- Severity → score penalty mapping: critical → hard override to mandatory block, high → -0.2, medium → -0.05, low → -0.01, info → 0.0. One critical finding hard-overrides the score regardless of all other inputs.
+
+✅ RESOLVED (see PROJECT.md BA.B): Threshold tuning policy. Thresholds frozen for v1. Tuning begins v1.2: quarterly FP/FN tracking per environment; override authority = Infra & Ops + SRE joint sign-off; any override is itself a confidence-event in the audit stream.
+
+## 9. Cross-Cutting — Audit and Evidence Stream
+
+Locked commitments (unchanged from v0.1):
+
+- Tiered audit ledger: S3 with Object Lock in compliance mode (cold, source of truth, 7-year retention) + GitHub audit repo (hot, query index, not part of the chain).
+
+- Daily checkpoints.
+
+- Event schema: JWS detached signature, prev_event_hash chain, controlled-vocabulary event_type.
+
+- Outbox pattern with local durable outbox + async worker.
+
+- Linkage via workflow run ID or agent invocation ID.
+
+Locked additions this revision:
+
+- The outbox database is DynamoDB. RPO is zero (synchronous write to local outbox before contract submission ack); RTO is the async worker's recovery from the dead-letter queue. Single-region in v1; multi-region is a v2 concern.
+
+- The outbox also stores the per-contract QA and prod approver identities (Section 10). The platform-internal identity-distinctness check reads from this outbox. This is the only durable record of the approver identities outside GitHub's audit log.
+
+## 10. Cross-Cutting — Human-in-the-Loop Mechanics
+
+Purpose. The human gates at higher environments. The vision's "Lower Environments are Autonomous; Higher Environments are Attested" tenet [1] and the "deliberate human attestation — not as a rubber stamp" requirement [1] are the binding constraints.
+
+### 10.1 Gate model
+
+Pre-execution gates. The contract is held in a "validated but not applied" state until the human attests. qa, prod, and dr are PR-based attestation gates backed by GitHub Environments with required reviewers.
+
+For qa and prod, there is no partial deployment to roll back on rejection. For dr, the same model — promotion to the DR environment is a separate GitHub Deployment, gated by SRE, against a separate cluster/region. The canary/deployment-rollback model is explicitly not in scope for v1.
+
+### 10.2 Reviewer routing
+
+GitHub CODEOWNERS + GitHub Environment required reviewers. qa → QA team; prod → SRE team; dr → SRE team. CODEOWNERS is the routing layer; it does not enforce identity distinctness.
+
+### 10.3 Separation of duties — identity distinctness
+
+Mechanism is platform-internal, not GitHub-native, not Kyverno (in v1).
+
+Sequence:
+
+1. On promotion dev → qa, the platform reads the QA approver's GitHub identity from the GitHub Deployment approval event and writes it to the DynamoDB outbox keyed by contractId.
+
+2. On promotion qa → prod, the platform reads the stored QA approver identity from the outbox and the new SRE approver identity from the GitHub Deployment approval event.
+
+3. If qaApprover == prodApprover, the platform blocks the prod promotion, writes a SEPARATION_OF_DUTIES_VIOLATION event to the evidence stream, and routes a halt artifact to the SRE on-call.
+
+4. The check is implemented in the central pipeline repo, not as an external policy. The platform is the only writer to the outbox; the check is in the same process that has authority to block the promotion.
+
+### 10.4 Full HITL attestation matrix
+
+| Env | Concern | Evidence artifact | Freshness | Source | Attester |
+|---|---|---|---|---|---|
+| qa | Functional correctness | Last successful run of contract-declared validation.e2eSuite with pass rate ≥ 99% | Last 24h | Test runner declared in contract | QA |
+| qa | Performance baseline | Load test report (k6 / Gatling / Locust) showing p99 latency < declared NFR and throughput > declared minimum | Last 7d | Load test runner declared in contract | QA |
+| qa | Security posture | Vulnerability scan (Trivy, Snyk, or contract-declared equivalent) with no criticals/highs, signed by Security on-call | Last 24h | Security scanner + Security team signature | QA |
+| qa | Contract NFRs | Platform-generated report: schema valid, NFR assertions (latency, throughput, error rate) within declared bounds | At submission | Platform contract validator | QA |
+| prod | Operational readiness | Runbook published, dashboard exists, on-call rotation assigned, alerts configured | At submission, validated against last 30d history | Platform + SRE | SRE |
+| prod | Incident response | Sev-1 runbook tabletop or live drill completed | Last 90d | SRE drill record | SRE |
+| prod | Capacity / cost | FinOps forecast for next 30d within budget envelope, cost anomaly baseline stored, budget alert configured | Forecast valid for next 30d | FinOps + SRE | SRE |
+| prod | Resilience | DR drill, chaos engineering report, backup verified | DR: 180d; chaos: 90d; backup: 30d | SRE + Platform | SRE |
+| dr | dr-region deploy with the most recent prod-bound dr drill as canary evidence | dr drill report | Last 180d | SRE | SRE |
+
+### 10.5 Timeout behavior
+
+| Time | State | Action |
+|---|---|---|
+| Submission | PENDING_ATTESTATION | Notify responsible team |
+| 1 business day | PENDING_ATTESTATION_WARNING | Notify team + platform on-call (elevated path); emit PENDING_ATTESTATION_TIMEOUT_WARNING event |
+| 2 business days | PENDING_ATTESTATION_AUTO_FREEZE | Auto-freeze; require re-submission; emit PENDING_ATTESTATION_AUTO_FREEZE event; new submission linked via supersedes |
+
+### 10.6 Rejection and rollback
+
+Rejection returns the contract to a HELD state with the rejection reason captured as a PROMOTION_REJECTED event. The consumer fixes the cause and re-submits; the new submission is linked to the rejected one via supersedes. The audit chain is extended, not torn up — matching the resolution session's answer.
+
+There is no partial deployment to roll back at any v1 gate.
+
+## 11. Cross-Cutting — Agentic Stack
+
+Locked commitments (unchanged from v0.1):
+
+- Hybrid runtime, platform-managed control plane + consumer-owned agent.
+
+- Versioned, signed skill catalog over MCP.
+
+- Skill envelope enforced on invocation and result submission.
+
+- Consumer-owned skill execution environment. Platform does not run the skill.
+
+- Stateless agents, all state in the platform.
+
+Locked additions this revision:
+
+- Skills are reviewed for sensitive data before release. Secrets, customer data, internal IPs, and other sensitive payloads are forbidden in skill markdown. The review is owned by Infra & Ops and is the mandatory release gate for any new skill. This is the trade-off for accepting the L3B runtime threat model (skill content is consumer-readable, so the platform must not put anything sensitive in it).
+
+✅ RESOLVED (see PROJECT.md BA.A): Skill catalog — initial set, addition process, deprecation process per the resolution.
+
+## 12. Cross-Cutting — L1/L2 Substrate Execution
+
+Purpose. The technical execution layer for the L1/L2 substrate, including the substrate abstraction that protects v1 from polyglot mess while leaving v2+ room to grow.
+
+### 12.1 Substrate abstraction (locked this revision)
+
+L1/L2 are substrate-agnostic in shape. The architecture defines a Target Stack Intermediate Representation (IR) — a substrate-neutral description of:
+
+- Resources with typed input contracts, typed output contracts, and declared NFRs.
+
+- Relationships (single parent per child, with a shared keyword for multi-relationship dependencies).
+
+- Composition (a tree of resources with max depth 5).
+
+- Policy hooks (the points in the composition where policy checks attach).
+
+The L1 registry, the L2 thin-composition tree, the YML standard, and the policy check result schema are all defined against the IR. None of them is defined against any specific substrate.
+
+Substrate adapters are the only substrate-specific code. An adapter compiles the IR into a substrate execution plan. v1 ships exactly one adapter: the Terraform adapter. v2+ may add additional adapters (OpenTofu, Pulumi, K8s CRDs) without architectural change.
+
+v1 implementation reality: the IR is shaped to round-trip cleanly to Terraform because there is no other adapter to differentiate from. The IR and the Terraform output are nearly isomorphic in v1. As additional adapters appear in v2+, the IR gets more expressive (e.g., substrate-specific output types) and the adapters gain translation logic, but the L1 module content, the YML standard, and the thin-composition tree do not change. This is the design that prevents the polyglot mess.
+
+Why not build the abstraction earlier? Building a substrate-agnostic IR before there is a second adapter to test against is speculative generality. The v1 commitment is: (1) the L1 module interface is defined against the IR even though the only adapter is Terraform, and (2) the central pipeline, registry, and policy schema consume the IR-typed contracts. The adapter is the only place where substrate terminology appears in v1.
+
+### 12.2 Terraform adapter (v1)
+
+The Terraform adapter:
+
+- Translates the IR-typed L1 module interface to a Terraform variable block and a Terraform output block.
+
+- Translates the IR-typed L2 thin-composition tree to a Terraform root module that calls the L1 modules.
+
+- Translates the IR-typed relationships to Terraform module references.
+
+- Emits a Terraform plan from the IR.
+
+The adapter is a thin layer. It does not own L1/L2 content; it only translates.
+
+### 12.3 State storage
+
+Locked: S3 (state files) + DynamoDB (state locking), cloud-managed. Single-region in v1.
+
+### 12.4 Policy toolchain
+
+Locked:
+
+- Checkov for Terraform plan policy (the four L2 thin-composition checks: secrets-in-plaintext, public ingress, IAM wildcard, KMS key reference, plus tag and naming convention). Checkov is open-source, has a broad rule catalog, and is GitOps-friendly.
+
+- Kyverno for K8s-native policy (platform-internal state in the GitOps reconciler, separation-of-dues-adjacent checks if any are added in v2, future CRD validation).
+
+- OPA/Rego is reserved for cross-resource policy and is explicitly last resort due to Rego complexity.
+
+### 12.5 Execution layer
+
+Locked: GitHub Actions. terraform plan and terraform apply run in the central pipeline repo's GitHub Actions workflow. State locking via DynamoDB. AWS credentials via OIDC federation (long-lived credentials are forbidden). The platform does not run terraform apply against a developer's workstation; all execution is in the central pipeline.
+
+> **ACDL Phase 07 note (D-039):** Gitea Actions (the ACDL forge) does not
+> support `id-token: write` / OIDC token issuance as of Gitea 1.27.x /
+> gitea-runner v2.1.0 (formerly `act_runner`, renamed 2026-04 in
+> gitea/runner#850). The v1.1 spike uses a per-run-rotated long-lived key
+> waiver; real OIDC federation is a v1.2 deliverable, blocked on
+> go-gitea/gitea#36988. The §12.5 "long-lived credentials are forbidden"
+> commitment is the locked target; the waiver is a time-boxed spike
+> exception.
+
+### 12.6 Policy result normalization (locked this revision)
+
+The confidence signal does not consume raw Checkov or Kyverno output. It consumes a normalized PolicyCheckResult schema produced by substrate-specific adapters.
+
+Schema (canonical form, lives in the central pipeline repo):
+
+```json
+{
+  "contractId": "uuid",
+  "evaluatedAt": "ISO-8601",
+  "engine": "checkov | kyverno | opa",
+  "ruleId": "CKV_AWS_24 | KYVERNO_NO_PRIVILEGED | ...",
+  "severity": "critical | high | medium | low | info",
+  "result": "pass | fail | skipped | error",
+  "message": "human-readable",
+  "evidence": { "...engine-specific payload, opaque to the signal..." },
+  "resourceRef": "IR-typed resource identifier"
+}
+```
+
+The Checkov adapter runs in the same GitHub Actions step as Checkov itself and translates Checkov JSON to PolicyCheckResult records. The Kyverno adapter runs as a controller in the platform's K8s cluster and translates Kyverno PolicyReport CRDs to PolicyCheckResult records. The confidence signal's policy input component is the union of all PolicyCheckResult records, regardless of engine. The signal does not know which engine produced which result — substrate-agnostic over its inputs, matching the L1/L2 model's substrate-agnostic over its outputs.
+
+### 12.7 Registry maintenance
+
+Locked: L1 module publication updates the L1 registry in the same PR as the module. Registry and module land together. The registry is the IR-typed contract, not a Terraform-specific variable schema. The L1 registry, the central pipeline, and the policy schema all consume the same IR-typed contract — there is one source of truth for the L1 interface, not multiple substrate-specific copies.
+
+### 12.8 Contract-schema-to-IR resolution
+
+The contract schema declares the consumer's intent in IR-typed terms. The central pipeline resolves the contract to a target stack (a list of L1 module instances with their inputs and the relationships between them). The Terraform adapter compiles the target stack to a Terraform execution plan. This resolution is substrate-agnostic — the target stack is in the IR.
+
+## 13. Consolidated Open Design Decisions
+
+✅ **All 11 decisions are RESOLVED (see PROJECT.md).** The §13 subsections
+below preserve the upstream structure with the `🟡 OPEN` markers replaced
+by `✅ RESOLVED (see PROJECT.md)`.
+
+### From Wave 1 (L1/L2 Substrate)
+
+- (W1.A) AI-refinement trigger. ✅ RESOLVED (see PROJECT.md) — joint condition: N ≥ 50 consecutive zero-rollback changes AND no L1/L2 incident in 6 months AND Infra & Ops unilateral override.
+
+- (W1.B) Multi-stack edge case rule. ✅ RESOLVED (see PROJECT.md) — permitted only for (a) DR-region mirror, (b) time-boxed experimental stack TTL ≤ 30d, (c) explicit Infra & Ops approval with `multiStack.justification`.
+
+### From Wave 2 (L3A/L3B)
+
+- (W2.A) Tag mutability for production-bound references. ✅ RESOLVED (see PROJECT.md) — Path B (tag for dev/qa, SHA for prod) with platform-provided CLI to resolve tag → SHA.
+
+### From Wave 3 (Technical Execution)
+
+- (W3.D) L1/L2 standard versioning details. ✅ RESOLVED (see PROJECT.md) — semver (interface→MAJOR, behavior→MINOR, lifecycle→PATCH); L2 pins L1 by `name@semver`; MAJOR bump = new registry entry + 12-month deprecation.
+
+- (W3.E) Schema mandatory vs. optional inputs. ✅ RESOLVED (see PROJECT.md) — per-env mandatory table (dev: stack+environment; qa adds validation.e2eSuite+loadTest; prod adds runbook+dashboard+oncall; dr adds drDrillRef); `inputs` always optional; `profile: agentic` fields optional everywhere.
+
+### From Beyond Architecture
+
+- (BA.A) Skill catalog. ✅ RESOLVED (see PROJECT.md) — 5 skills (web API, worker, scheduled job, static asset, basic observability bootstrap); addition criteria locked.
+
+- (BA.B) Confidence signal threshold tuning. ✅ RESOLVED (see PROJECT.md) — frozen for v1; tuning begins v1.2 (quarterly FP/FN; override = Infra & Ops + SRE joint sign-off).
+
+- (BA.C) On-call and operational ownership. ✅ RESOLVED (see PROJECT.md) — platform on-call = Infra & Ops; L3A/L3B halt → Sev2; consumer outage → Sev1.
+
+- (BA.D) Cost and capacity governance. ✅ RESOLVED (see PROJECT.md) — FinOps owns; per-contract monthly reporting; hard halt at 120% of declared budget via the confidence signal; override = FinOps + SRE joint sign-off.
+
+- (BA.E) Consumer onboarding. ✅ RESOLVED (see PROJECT.md) — developer (L3A): getting-started → contract schema + central pipeline template; citizen (L3B): scoped agent + skill catalog; both end in a sandbox dev submission that must pass the confidence gate.
+
+- (BA.F) Cross-platform evolution. ✅ RESOLVED (see PROJECT.md) — contract schema, IR, PolicyCheckResult, confidence signal, audit stream are portable; forge-specific code = workflow YAML, OIDC trust, CODEOWNERS, Environments; a second forge needs a forge adapter + workflow-template translator.
+
+- (Q1.3) OpenTofu timing. ✅ RESOLVED (deferred — see PROJECT.md) — not in v1 or v1.1; the substrate abstraction makes OpenTofu a future adapter, not an architecture change.
+
+## 14. Document Status and Next Steps
+
+Status: **v1.0**. All 11 open items in §13 are resolved. The architecture is
+internally consistent; the v1.1 implementation spike (ACDL Phases 08-10)
+validates the locked substrate abstraction + contract→IR→adapter path
+against real AWS via a per-run-rotated key (D-039; OIDC deferred to v1.2).
+The v1.2 build-out (S3 Object Lock, JWS, HITL wiring, L3B skill catalog,
+Kyverno/OPA, real OIDC federation, multi-region) is design-authored in
+Phase 07 and implemented post-spike.
+
+Doc-sync items (out of scope of this document but flagged for the same change set):
+
+- The CDLC reference document's environment model assumes staging exists. Path A invalidates that. The CDLC contract example's targetEnvironments: [staging, production] must be revised to [dev, qa, prod, dr].
+
+## 15. Phase 07 authored artifacts
+
+The 11 resolutions are recorded in `PROJECT.md` (decisions D-034..D-046 +
+the "Open-decision resolutions" table). Phase 07 formalizes the locked
+commitments into these schema/design files (landed in Waves 2-4 of
+Phase 07):
+
+| REQ | File | Owner persona |
+|-----|------|--------------|
+| REQ-17 | `schemas/ir.schema.json` | platform-engineer |
+| REQ-18 | `schemas/policy_check_result.schema.json` + `adapters/terraform/policy/checkov_adapter.py` | security-engineer |
+| REQ-19 | `platform/confidence_signal.py` | backend-engineer + security-engineer (co-authored) |
+| REQ-20 | `platform/audit_ledger_design.md` | security-engineer |
+| REQ-21 | `platform/hitl_matrix_design.md` + `platform/separation_of_duties.py` | security-engineer |
+| REQ-22 | `schemas/contract.schema.json` | backend-engineer |
+
+The spike scope (D-041, D-043) vs v1.2 build-out boundary for each design
+is documented in the respective file.

docs/architecture.md

@@ -0,0 +1,452 @@
+# Architecture Document v0.2 + Executive Demo Plan
+
+Three things to set up before I deliver the document, because they determine how I write the doc:
+
+1. What is locked from the resolution session. Eight items: environment model (Path A — dev-only autonomous, no staging), substrate abstraction (Target Stack IR + adapter pattern, Terraform adapter in v1), policy toolchain (Checkov for Terraform plan, Kyverno for K8s, OPA last resort), separation of duties (CODEOWNERS for routing + DynamoDB outbox for identity distinctness), policy normalization PolicyCheckResult schema with engine adapters), HITL matrix (full 8-concern matrix with evidence, freshness, source), HITL timeout (1d warn, 2d freeze), HITL rollback (pre-execution model, audit chain extended, no partial deploy).
+
+2. What is still open after the session. Eleven items, listed in the updated Section 13. They are the gating items for v1.0.
+
+3. Doc-sync item. The CDLC reference document (not in scope of this architecture) describes staging as an environment and uses targetEnvironments: [staging, production] in its contract example. Path A invalidates that. The CDLC document is the responsibility of its own owners, but this architecture flags the inconsistency so the CDLC revision can be scheduled in the same change set.
+
+The architecture document is below, followed by the executive demo plan, followed by the final three questions I need resolved before v1.0.
+
+---
+
+# Agentic Cloud Delivery Platform — Architecture Document
+
+Status: Draft v0.2. Section 13 lists 11 open decisions. Eight of the original 15 open items are now locked; seven remain from Section 13 plus four new sub-decisions surfaced during resolution.
+
+Companion to: Agentic Cloud Delivery Vision [1].
+
+Authoring principle: The vision is the source of truth for why [1]; this document is the source of truth for how. Where the two conflict, the vision wins.
+
+Resolution session log (this revision):
+
+| ID | Question | Resolution |
+|---|---|---|
+| Q1 | Environment model | Path A locked. Dev is the only autonomous environment. QA HITL at qa. SRE HITL at prod and dr. Staging does not exist. |
+| Q1.2 | Substrate trajectory | Substrate abstraction locked. L1/L2 are defined against a Target Stack IR. Substrate adapters compile the IR to a substrate execution plan. v1 ships only the Terraform adapter. |
+| Q1.3 | OpenTofu timing | 🟡 OPEN (W3.D-adjacent). No specific version or trigger committed. |
+| Q2.1 | Policy toolchain | Locked. Checkov for Terraform plan policy. Kyverno for K8s-native and platform-internal policy. OPA/Rego reserved for cross-resource cases; explicitly last resort due to Rego complexity. |
+| Q2.2 | Separation of duties | Locked. GitHub CODEOWNERS routes the right reviewer to the right environment. Platform-internal identity record in DynamoDB outbox enforces qaApprover ≠ prodApprover for the same contract. |
+| Q2.3 | Policy normalization | Locked. PolicyCheckResult JSON schema is the contract between engines and the confidence signal. Engine-specific adapters translate native output to the schema. |
+| Q3 | HITL matrix + timeout + rollback | Locked (full 8-concern matrix in §10). Pre-execution gate model. 1 business day = warn + escalate. 2 business days = auto-freeze + re-submit. Rejection extends the audit chain, no partial deploy to roll back. |
+| W1.A | AI-refinement trigger | 🟡 OPEN. Recommendation pending sign-off. |
+| W1.B | Multi-stack edge case rule | 🟡 OPEN. Recommendation pending sign-off. |
+| W2.A | Tag mutability for prod | 🟡 OPEN. Recommendation pending sign-off. |
+| W3.D | L1/L2 standard versioning details | 🟡 OPEN. |
+| W3.E | Schema mandatory vs. optional inputs | 🟡 OPEN. |
+| BA.A–F | Beyond-architecture questions | 🟡 OPEN (6 items). |
+
+---
+
+## 0. Purpose
+
+This document encodes the architectural commitments that realize the vision [1]. The resolution session has closed eight open items; the document is now at v0.2 with eleven open items remaining, listed in Section 13. Every locked commitment is grounded in either a vision tenet or a specific decision made during resolution.
+
+The structure remains: four layers (L1 primitives, L2 composed stacks, L3A developer surface, L3B agentic surface) plus five cross-cutting concerns (central pipeline, contract schema, confidence signal, audit stream, HITL mechanics), with one addition: the substrate abstraction layer (Section 12) is now a first-class architectural concern, not an implementation detail.
+
+## 1. Architectural Overview
+
+The platform remains four layers and five cross-cutting concerns. The substrate abstraction is added as a sixth cross-cutting concern in Section 12 because it is the binding constraint for the L1/L2 model, the central pipeline, and the policy toolchain.
+
+The vision's "Two Consumer Surfaces, One Platform" tenet [1] remains the constraint that binds all concerns: L3A and L3B converge on the same contract schema, the same policy envelope, and the same evidence stream.
+
+Locked additions this revision:
+
+- The environment model is dev (autonomous) → qa (QA HITL) → prod (SRE HITL) → dr (SRE HITL). Staging does not exist.
+
+- L1/L2 are substrate-agnostic in shape; substrate adapters are the only substrate-specific component.
+
+## 2. Layer 1 — Foundational Primitives
+
+Purpose. Single-purpose, substrate-agnostic primitive modules representing the smallest reusable infrastructure pieces. L1 modules do not compose with other L1 modules; L1 takes its environment as input.
+
+Locked commitments (unchanged from v0.1):
+
+- No inter-L1 references. L1 may call Terraform data sources.
+
+- Semver with three triggers (interface → MAJOR, behavior → MINOR, lifecycle → PATCH).
+
+- Immutability on publication.
+
+- 12-month deprecation window.
+
+- AI refinement is a flag.
+
+🟡 OPEN (W1.A): AI-refinement operational trigger. The criterion for flipping aiRefinement from false to true needs a falsifiable operational signal. Recommendation: joint condition — N ≥ 50 consecutive changes with zero rollbacks AND no L1/L2 incident in the last 6 months AND Infra & Ops holds a unilateral override. Pending sign-off.
+
+🟡 OPEN (sub-decision surfaced this revision): The L1 module's interface field is defined against the Target Stack IR, not against Terraform's variable block directly. In v1, the IR is shaped to round-trip cleanly to Terraform, but the schema is substrate-agnostic. Pending v1 implementation details in Section 12.
+
+## 3. Layer 2 — Composed Stacks
+
+Purpose. Combine L1 primitives into deployable infrastructure shapes. Each codebase maps to one canonical L2 stack; the stack is either a parameterized module (Shape X) or a thin-composition layer (Shape Y).
+
+Locked commitments (unchanged from v0.1):
+
+- 1 codebase = 1 L2 stack (default), with multiStack: true for exceptions.
+
+- Shape X or Shape Y.
+
+- Hierarchical composition, max depth 5, only registered L1s.
+
+- Pipeline quality checks: secrets-in-plaintext, public ingress, IAM wildcard, KMS key reference, tag compliance, naming convention.
+
+- Restricted from thin-composition: IAM principal creation, network boundary creation, key/secret creation, external data transfer.
+
+- Auto-promote after 3 observed usages.
+
+🟡 OPEN (W1.B): Multi-stack edge case rule. The multiStack: true exception needs a falsifiable rule. Recommendation: permitted only for (a) DR-region mirror of the primary stack, (b) time-boxed experimental stack with TTL ≤ 30 days, (c) explicit Infra & Ops approval for a documented reason captured in multiStack.justification. Pending sign-off.
+
+🟡 OPEN (sub-decision surfaced this revision): The L2 thin-composition tree's wires field is defined against the IR's relationship type, not against a Terraform module block. The IR → Terraform translation is the Terraform adapter's job (Section 12). The thin-composition pipeline itself is substrate-agnostic.
+
+## 4. Layer 3A — Developer Consumer Surface
+
+Locked commitments (unchanged from v0.1):
+
+- Tag-based reference to the central pipeline template.
+
+- Developer-owned workflow file, no platform auto-sync.
+
+- L3A and L3B are parallel paths, not a progression.
+
+🟡 OPEN (W2.A): Tag mutability for production-bound references. Path A (tag throughout with protection) vs. Path B (tag for dev/qa, SHA for prod). Recommendation: Path B, justified by the vision's "Audit truth lives outside the repository" bet [1] and the "Not a mutable audit log" anti-goal [1]; SHA-pinning is the only guarantee that the exact bytes reviewed in dev/qa are the bytes deployed to prod. The platform provides a CLI command that resolves the current tag to its SHA for prod-bound workflows. Pending sign-off.
+
+## 5. Layer 3B — Agentic Consumer Surface
+
+Locked commitments (unchanged from v0.1):
+
+- Hybrid runtime, skill as markdown, agent as executor.
+
+- Trust model: trust and always verify on the platform side.
+
+- Skill envelope (4 dimensions).
+
+- Stateless agents, all state in the platform.
+
+Environment progression — locked (this revision):
+
+| Environment | Autonomy | Attester | Gate |
+|---|---|---|---|
+| dev | Full autonomy (no HITL) | — | Confidence signal ≥ 0.50, all six inputs present |
+| qa | Held for attestation | QA | GitHub Deployment approval + full QA matrix (see §10) |
+| prod | Held for attestation | SRE | GitHub Deployment approval + full SRE matrix (see §10) |
+| dr | Held for attestation | SRE | GitHub Deployment approval + dr-drill evidence (see §10) |
+
+Staging is removed. Dev is the only autonomous environment and absorbs integration, contract, security smoke, and performance smoke validation. The CDLC reference document's environment model is a doc-sync item flagged at the top of this document.
+
+Profile marker: profile: agentic unlocks L3B-specific fields naturalLanguageIntent, confidenceAtSubmission, agentTrace).
+
+🟡 OPEN (BA.A): Skill catalog. Which skills exist in the initial L3B capability set, who decides what gets added, how are skills deprecated. Pending resolution.
+
+## 6. Cross-Cutting — Central Pipeline Template
+
+Locked commitments (unchanged from v0.1):
+
+- JSON Schema (draft 2020-12) with thin domain-specific wrapper.
+
+- Central repo + generated client libraries.
+
+- Multi-stage validation pipeline (schema → policy → NFR → confidence).
+
+- Distributed enrichment.
+
+- GitOps reconciler + Terraform execution layer.
+
+Locked additions this revision:
+
+- The GitOps reconciler is the platform's K8s API. The cdlc-gitops repository's state materializes into K8s CRDs (ArgoCD Applications or Flux Kustomizations) that the reconciler watches. This is the platform's internal state surface.
+
+- The pipeline emits a PolicyCheckResult record per policy rule evaluated. The confidence signal consumes these as one normalized input (Section 8).
+
+🟡 OPEN (W3.D): L1/L2 standard versioning details — semver scheme, pin model, evolution compatibility contract.
+
+🟡 OPEN (W3.E): Schema mandatory vs. optional inputs — which are required for all consumers, which are required only for higher environments, which are always optional.
+
+## 7. Cross-Cutting — Contract Schema
+
+Locked commitments (unchanged from v0.1):
+
+- Central repo + generated client libraries.
+
+- Strict fail-fast at schema stage, multi-stage validation pipeline with reason codes from a published vocabulary.
+
+🟡 OPEN (W3.E): Schema mandatory vs. optional inputs. The CDLC reference contract example [1] is illustrative; the v1 contract schema needs explicit per-field mandatory/optional declarations per environment.
+
+## 8. Cross-Cutting — Confidence Signal
+
+Locked commitments (unchanged from v0.1):
+
+- Six canonical inputs.
+
+- Weighted sum with per-input breakdown.
+
+- Per-environment thresholds: dev ≥ 0.50, qa ≥ 0.75, prod ≥ 0.90, dr ≥ 0.95.
+
+- Structured output { score, band, perInput, reasonCodes }.
+
+- 1-year storage, no algorithm retraining in v1.
+
+- Halt with explicit reason on missing input.
+
+Locked additions this revision:
+
+- The policy check results input is a list of PolicyCheckResult records from the normalized schema (Section 9, 12). The signal does not know which engine produced which result.
+
+- Severity → score penalty mapping: critical → hard override to mandatory block, high → -0.2, medium → -0.05, low → -0.01, info → 0.0. One critical finding hard-overrides the score regardless of all other inputs.
+
+🟡 OPEN (BA.B): Threshold tuning policy. The initial thresholds (dev 0.50, qa 0.75, prod 0.90, dr 0.95) are starting values. The tuning process, false-positive/false-negative tracking, and override authority are pending.
+
+## 9. Cross-Cutting — Audit and Evidence Stream
+
+Locked commitments (unchanged from v0.1):
+
+- Tiered audit ledger: S3 with Object Lock in compliance mode (cold, source of truth, 7-year retention) + GitHub audit repo (hot, query index, not part of the chain).
+
+- Daily checkpoints.
+
+- Event schema: JWS detached signature, prev_event_hash chain, controlled-vocabulary event_type.
+
+- Outbox pattern with local durable outbox + async worker.
+
+- Linkage via workflow run ID or agent invocation ID.
+
+Locked additions this revision:
+
+- The outbox database is DynamoDB. RPO is zero (synchronous write to local outbox before contract submission ack); RTO is the async worker's recovery from the dead-letter queue. Single-region in v1; multi-region is a v2 concern.
+
+- The outbox also stores the per-contract QA and prod approver identities (Section 10). The platform-internal identity-distinctness check reads from this outbox. This is the only durable record of the approver identities outside GitHub's audit log.
+
+🟡 OPEN (BA.C): On-call and operational ownership. The platform's on-call rotation, escalation paths when L3A or L3B halts unexpectedly, and the relationship to consumer on-call.
+
+## 10. Cross-Cutting — Human-in-the-Loop Mechanics
+
+Purpose. The human gates at higher environments. The vision's "Lower Environments are Autonomous; Higher Environments are Attested" tenet [1] and the "deliberate human attestation — not as a rubber stamp" requirement [1] are the binding constraints.
+
+### 10.1 Gate model
+
+Pre-execution gates. The contract is held in a "validated but not applied" state until the human attests. qa, prod, and dr are PR-based attestation gates backed by GitHub Environments with required reviewers.
+
+For qa and prod, there is no partial deployment to roll back on rejection. For dr, the same model — promotion to the DR environment is a separate GitHub Deployment, gated by SRE, against a separate cluster/region. The canary/deployment-rollback model is explicitly not in scope for v1.
+
+### 10.2 Reviewer routing
+
+GitHub CODEOWNERS + GitHub Environment required reviewers. qa → QA team; prod → SRE team; dr → SRE team. CODEOWNERS is the routing layer; it does not enforce identity distinctness.
+
+### 10.3 Separation of duties — identity distinctness
+
+Mechanism is platform-internal, not GitHub-native, not Kyverno (in v1).
+
+Sequence:
+
+1. On promotion dev → qa, the platform reads the QA approver's GitHub identity from the GitHub Deployment approval event and writes it to the DynamoDB outbox keyed by contractId.
+
+2. On promotion qa → prod, the platform reads the stored QA approver identity from the outbox and the new SRE approver identity from the GitHub Deployment approval event.
+
+3. If qaApprover == prodApprover, the platform blocks the prod promotion, writes a SEPARATION_OF_DUTIES_VIOLATION event to the evidence stream, and routes a halt artifact to the SRE on-call.
+
+4. The check is implemented in the central pipeline repo, not as an external policy. The platform is the only writer to the outbox; the check is in the same process that has authority to block the promotion.
+
+### 10.4 Full HITL attestation matrix
+
+| Env | Concern | Evidence artifact | Freshness | Source | Attester |
+|---|---|---|---|---|---|
+| qa | Functional correctness | Last successful run of contract-declared validation.e2eSuite with pass rate ≥ 99% | Last 24h | Test runner declared in contract | QA |
+| qa | Performance baseline | Load test report (k6 / Gatling / Locust) showing p99 latency < declared NFR and throughput > declared minimum | Last 7d | Load test runner declared in contract | QA |
+| qa | Security posture | Vulnerability scan (Trivy, Snyk, or contract-declared equivalent) with no criticals/highs, signed by Security on-call | Last 24h | Security scanner + Security team signature | QA |
+| qa | Contract NFRs | Platform-generated report: schema valid, NFR assertions (latency, throughput, error rate) within declared bounds | At submission | Platform contract validator | QA |
+| prod | Operational readiness | Runbook published, dashboard exists, on-call rotation assigned, alerts configured | At submission, validated against last 30d history | Platform + SRE | SRE |
+| prod | Incident response | Sev-1 runbook tabletop or live drill completed | Last 90d | SRE drill record | SRE |
+| prod | Capacity / cost | FinOps forecast for next 30d within budget envelope, cost anomaly baseline stored, budget alert configured | Forecast valid for next 30d | FinOps + SRE | SRE |
+| prod | Resilience | DR drill, chaos engineering report, backup verified | DR: 180d; chaos: 90d; backup: 30d | SRE + Platform | SRE |
+| dr | dr-region deploy with the most recent prod-bound dr drill as canary evidence | dr drill report | Last 180d | SRE | SRE |
+
+### 10.5 Timeout behavior
+
+| Time | State | Action |
+|---|---|---|
+| Submission | PENDING_ATTESTATION | Notify responsible team |
+| 1 business day | PENDING_ATTESTATION_WARNING | Notify team + platform on-call (elevated path); emit PENDING_ATTESTATION_TIMEOUT_WARNING event |
+| 2 business days | PENDING_ATTESTATION_AUTO_FREEZE | Auto-freeze; require re-submission; emit PENDING_ATTESTATION_AUTO_FREEZE event; new submission linked via supersedes |
+
+### 10.6 Rejection and rollback
+
+Rejection returns the contract to a HELD state with the rejection reason captured as a PROMOTION_REJECTED event. The consumer fixes the cause and re-submits; the new submission is linked to the rejected one via supersedes. The audit chain is extended, not torn up — matching the resolution session's answer.
+
+There is no partial deployment to roll back at any v1 gate.
+
+## 11. Cross-Cutting — Agentic Stack
+
+Locked commitments (unchanged from v0.1):
+
+- Hybrid runtime, platform-managed control plane + consumer-owned agent.
+
+- Versioned, signed skill catalog over MCP.
+
+- Skill envelope enforced on invocation and result submission.
+
+- Consumer-owned skill execution environment. Platform does not run the skill.
+
+- Stateless agents, all state in the platform.
+
+Locked additions this revision:
+
+- Skills are reviewed for sensitive data before release. Secrets, customer data, internal IPs, and other sensitive payloads are forbidden in skill markdown. The review is owned by Infra & Ops and is the mandatory release gate for any new skill. This is the trade-off for accepting the L3B runtime threat model (skill content is consumer-readable, so the platform must not put anything sensitive in it).
+
+🟡 OPEN (BA.A): Skill catalog. Initial skill set, addition process, deprecation process.
+
+## 12. Cross-Cutting — L1/L2 Substrate Execution
+
+Purpose. The technical execution layer for the L1/L2 substrate, including the substrate abstraction that protects v1 from polyglot mess while leaving v2+ room to grow.
+
+### 12.1 Substrate abstraction (locked this revision)
+
+L1/L2 are substrate-agnostic in shape. The architecture defines a Target Stack Intermediate Representation (IR) — a substrate-neutral description of:
+
+- Resources with typed input contracts, typed output contracts, and declared NFRs.
+
+- Relationships (single parent per child, with a shared keyword for multi-relationship dependencies).
+
+- Composition (a tree of resources with max depth 5).
+
+- Policy hooks (the points in the composition where policy checks attach).
+
+The L1 registry, the L2 thin-composition tree, the YML standard, and the policy check result schema are all defined against the IR. None of them is defined against any specific substrate.
+
+Substrate adapters are the only substrate-specific code. An adapter compiles the IR into a substrate execution plan. v1 ships exactly one adapter: the Terraform adapter. v2+ may add additional adapters (OpenTofu, Pulumi, K8s CRDs) without architectural change.
+
+v1 implementation reality: the IR is shaped to round-trip cleanly to Terraform because there is no other adapter to differentiate from. The IR and the Terraform output are nearly isomorphic in v1. As additional adapters appear in v2+, the IR gets more expressive (e.g., substrate-specific output types) and the adapters gain translation logic, but the L1 module content, the YML standard, and the thin-composition tree do not change. This is the design that prevents the polyglot mess.
+
+Why not build the abstraction earlier? Building a substrate-agnostic IR before there is a second adapter to test against is speculative generality. The v1 commitment is: (1) the L1 module interface is defined against the IR even though the only adapter is Terraform, and (2) the central pipeline, registry, and policy schema consume the IR-typed contracts. The adapter is the only place where substrate terminology appears in v1.
+
+### 12.2 Terraform adapter (v1)
+
+The Terraform adapter:
+
+- Translates the IR-typed L1 module interface to a Terraform variable block and a Terraform output block.
+
+- Translates the IR-typed L2 thin-composition tree to a Terraform root module that calls the L1 modules.
+
+- Translates the IR-typed relationships to Terraform module references.
+
+- Emits a Terraform plan from the IR.
+
+The adapter is a thin layer. It does not own L1/L2 content; it only translates.
+
+### 12.3 State storage
+
+Locked: S3 (state files) + DynamoDB (state locking), cloud-managed. Single-region in v1.
+
+### 12.4 Policy toolchain
+
+Locked:
+
+- Checkov for Terraform plan policy (the four L2 thin-composition checks: secrets-in-plaintext, public ingress, IAM wildcard, KMS key reference, plus tag and naming convention). Checkov is open-source, has a broad rule catalog, and is GitOps-friendly.
+
+- Kyverno for K8s-native policy (platform-internal state in the GitOps reconciler, separation-of-dues-adjacent checks if any are added in v2, future CRD validation).
+
+- OPA/Rego is reserved for cross-resource policy and is explicitly last resort due to Rego complexity.
+
+### 12.5 Execution layer
+
+Locked: GitHub Actions. terraform plan and terraform apply run in the central pipeline repo's GitHub Actions workflow. State locking via DynamoDB. AWS credentials via OIDC federation (long-lived credentials are forbidden). The platform does not run terraform apply against a developer's workstation; all execution is in the central pipeline.
+
+### 12.6 Policy result normalization (locked this revision)
+
+The confidence signal does not consume raw Checkov or Kyverno output. It consumes a normalized PolicyCheckResult schema produced by substrate-specific adapters.
+
+Schema (canonical form, lives in the central pipeline repo):
+
+```json
+{
+  "contractId": "uuid",
+  "evaluatedAt": "ISO-8601",
+  "engine": "checkov | kyverno | opa",
+  "ruleId": "CKV_AWS_24 | KYVERNO_NO_PRIVILEGED | ...",
+  "severity": "critical | high | medium | low | info",
+  "result": "pass | fail | skipped | error",
+  "message": "human-readable",
+  "evidence": { "...engine-specific payload, opaque to the signal..." },
+  "resourceRef": "IR-typed resource identifier"
+}
+```
+
+The Checkov adapter runs in the same GitHub Actions step as Checkov itself and translates Checkov JSON to PolicyCheckResult records. The Kyverno adapter runs as a controller in the platform's K8s cluster and translates Kyverno PolicyReport CRDs to PolicyCheckResult records. The confidence signal's policy input component is the union of all PolicyCheckResult records, regardless of engine. The signal does not know which engine produced which result — substrate-agnostic over its inputs, matching the L1/L2 model's substrate-agnostic over its outputs.
+
+### 12.7 Registry maintenance
+
+Locked: L1 module publication updates the L1 registry in the same PR as the module. Registry and module land together. The registry is the IR-typed contract, not a Terraform-specific variable schema. The L1 registry, the central pipeline, and the policy schema all consume the same IR-typed contract — there is one source of truth for the L1 interface, not multiple substrate-specific copies.
+
+### 12.8 Contract-schema-to-IR resolution
+
+The contract schema declares the consumer's intent in IR-typed terms. The central pipeline resolves the contract to a target stack (a list of L1 module instances with their inputs and the relationships between them). The Terraform adapter compiles the target stack to a Terraform execution plan. This resolution is substrate-agnostic — the target stack is in the IR.
+
+🟡 OPEN (W3.D): L1/L2 standard versioning details, including pin model and evolution compatibility contract.
+
+## 13. Consolidated Open Design Decisions
+
+The following 11 decisions remain open. They are the gating items for v1.0.
+
+### From Wave 1 (L1/L2 Substrate)
+
+- (W1.A) AI-refinement trigger. Recommendation: joint condition — N ≥ 50 consecutive changes with zero rollbacks AND no L1/L2 incident in last 6 months AND Infra & Ops unilateral override. Pending sign-off.
+
+- (W1.B) Multi-stack edge case rule. Recommendation: permitted only for (a) DR-region mirror, (b) time-boxed experimental stack with TTL ≤ 30d, (c) explicit Infra & Ops approval with documented justification in multiStack.justification. Pending sign-off.
+
+### From Wave 2 (L3A/L3B)
+
+- (W2.A) Tag mutability for production-bound references. Recommendation: Path B (tag for dev/qa, SHA for prod) with platform-provided CLI to resolve tag → SHA. Pending sign-off.
+
+### From Wave 3 (Technical Execution)
+
+- (W3.D) L1/L2 standard versioning details. Semver scheme, pin model, evolution compatibility contract.
+
+- (W3.E) Schema mandatory vs. optional inputs. Per-field mandatory/optional declarations per environment.
+
+### From Beyond Architecture
+
+- (BA.A) Skill catalog. Initial L3B skill set, addition process, deprecation process.
+
+- (BA.B) Confidence signal threshold tuning. Initial thresholds are starting values; tuning process, FP/FN tracking, override authority.
+
+- (BA.C) On-call and operational ownership. Platform on-call rotation, escalation paths, relationship to consumer on-call.
+
+- (BA.D) Cost and capacity governance. Cloud cost ownership, consumption reporting, runaway spend detection and halting.
+
+- (BA.E) Consumer onboarding. Developer and citizen developer onboarding flow, "getting started" path through the contract schema.
+
+- (BA.F) Cross-platform evolution. What changes if a second source-control system (e.g., GitLab) is added; which architectural decisions are portable.
+
+## 14. Document Status and Next Steps
+
+Status: v0.2. Eight of the original 15 open items are locked. Eleven remain open. The architecture is internally consistent for the locked items; resolution of the open items is the path to v1.0.
+
+Doc-sync items (out of scope of this document but flagged for the same change set):
+
+- The CDLC reference document's environment model assumes staging exists. Path A invalidates that. The CDLC contract example's targetEnvironments: [staging, production] must be revised to [dev, qa, prod, dr].
+
+To finalize to v1.0:
+
+1. Resolve the 11 open items in Section 13.
+
+2. Validate the locked substrate abstraction against a real v1 implementation spike (one L1 module, one L2 thin-composition, one Terraform adapter, one contract submission end-to-end). The spike validates that the IR-shaped commitments do not require a polyglot mess.
+
+3. Validate the locked HITL matrix against a tabletop exercise with QA and SRE.
+
+4. Sign-off pass.
+
+---
+
+# Final Asks — three remaining open questions, then sign-off
+
+I have three open questions that gate v1.0. Resolve them and I will revise the architecture document to v1.0 and mark it ready for implementation.
+
+Q1. W1.A + W1.B — AI-refinement trigger and multi-stack edge case rule. The recommendations are in the document. Do you accept them as committed, or do you want to amend?
+
+Q2. W2.A — Tag mutability for production-bound references. Path A (tag throughout with protection) vs. Path B (tag for dev/qa, SHA for prod). My recommendation is Path B with a platform CLI to resolve tag → SHA. Accept or amend?
+
+Q3. BA.A — Initial L3B skill catalog. The demo plan uses 3 stub skills deploy-web-api, add-observability, add-basic-auth). For v1.0, the real platform needs a defensible initial skill set. My recommendation: start with the 5 most common infrastructure intents (web API, worker, scheduled job, static asset, basic observability bootstrap) and grow from there. The criteria for addition: a skill must (a) be reviewable for sensitive data per the locked skill-review gate, (b) be expressible as a single contract submission, and (c) have a documented use case. Accept or amend?
+
+Once these three are resolved, plus the 8 remaining items (W3.D, W3.E, BA.B, BA.C, BA.D, BA.E, BA.F, and the OpenTofu timing sub-decision), the architecture moves to v1.0.
+
+Sign-off request. Are you ready for me to draft v1.0 once these are resolved, or do you want to amend the v0.2 above first?

docs/vision.md

@@ -0,0 +1,71 @@
+# Agentic Cloud Delivery Vision
+
+## 1. The Friction
+
+Software delivery scales with the coordination surface around it, not the engineering inside it. Most teams know how to write code; far fewer know how to author the infrastructure that runs it correctly. The result is a long tail of well-meaning services that are difficult to deploy, hard to operate, and inconsistent in their security and observability posture.
+
+Once code is merged, the second friction begins. Moving a service from "merged" to "running in production with policy, observability, and security enforced" requires manual work that scales with the system, not with the change. The platform's job is to absorb both frictions — the cognitive load of getting the infrastructure right, and the operational work of getting the change to production safely.
+
+## 2. The North Star
+
+Consumers declare intent; the platform delivers safe production deployment through an agentic stack.
+
+## 3. Core Tenets
+
+* **Operations are Declared, Not Executed.** Consumers define what they need — workload shape, dependencies, non-functional requirements, policy constraints. The platform handles reconciliation, provisioning, and environment progression. The execution burden moves from the human to the platform.
+* **The Delivery Lifecycle is a Sovereign Boundary.** The platform governs the infrastructure and delivery substrate. It does not penetrate upstream product or software development lifecycles. Integration happens exclusively through validated, published contracts.
+* **Lower Environments are Autonomous; Higher Environments are Attested.** Progression through lower environments proceeds through zero-touch agentic automation. Promotion to higher-stakes environments requires deliberate human attestation — not as a rubber stamp, but as a policy-mandated act of accountability.
+* **Safety is Computed, Not Assumed.** Every delivery action produces a measurable, explainable confidence signal aggregating policy conformance, validation evidence, and historical behavior. The signal is the platform's certified answer to "is this safe to proceed?" Reliance on operator instinct or tenure is not a substitute.
+* **Infrastructure is Consumed, Not Maintained.** Compute is abstract, containerized, or serverless. The platform does not manage node, OS, or bare-metal lifecycles. Infrastructure is treated as a utility, not a craft.
+* **Two Consumer Surfaces, One Platform.** The platform serves technical developers and non-technical consumers through two coordinated interfaces. Both converge on the same contract schema, the same policy envelope, and the same evidence stream. The platform is opinionated in what it accepts, regardless of who is declaring.
+
+## 4. Domain Boundaries
+
+The platform begins where the artifact is compiled and ends where it runs in production under operational guardrails.
+
+* **In scope:** Environment progression, cloud resource lifecycle, operational security and observability NFRs, policy enforcement, immutable audit lineage, confidence frameworks, two consumer surfaces (developer and agentic).
+* **Out of scope:** Application business logic, IDE workflows, product backlog management, sprint planning, compute requiring node-level or OS-level management.
+* **Interface:** Upstream systems interact with the platform through a strict contract boundary. The platform validates, enriches with operational standards, and reconciles the target state. Visibility into how software is authored is not required — only assurance about what is being delivered and under what policy constraints.
+
+## 5. Strategic Bets
+
+These are the leaps of faith underlying this vision. If any prove false, the vision requires fundamental revision.
+
+* **Autonomous progression through lower environments is sufficiently safe.** End-to-end agentic progression through non-production environments — with rigorous policy, testing, and observability gates — is less risky than human-driven pipelines that rely on manual checklist discipline.
+* **Confidence can replace presumption.** A computed, policy-derived confidence signal is a legitimate arbiter for autonomous action, replacing the instinct of an operator who "knows the system."
+* **Narrow capability interfaces beat broad access.** Infrastructure capabilities are exposed to autonomous systems through constrained, domain-specific interfaces — never through raw, unbounded platform credentials. Agents call capabilities, not APIs.
+* **Audit truth lives outside the repository.** Version control is a coordination tool, not an evidentiary fortress. True compliance requires an immutable, externally-stored ledger to which the platform writes; repositories hold only lightweight attestation linkage.
+* **Pattern recognition can compound platform value over time.** As the platform observes recurring contract patterns, it can synthesize and offer reusable infrastructure compositions. This is a future capability, not a current commitment — but the platform's design must allow it.
+
+## 6. Trade-offs Accepted
+
+This vision is purchased with deliberate sacrifices:
+
+* **Velocity over Legacy Flexibility.** Standardizing on abstract, containerized, and serverless compute eliminates undifferentiated toil. Teams operating non-cloud-native workloads must modernize or route elsewhere.
+* **Abstraction over Granular Control.** Removing node-level access sacrifices fine-tuned performance optimization in favor of uniform operability and security posture.
+* **Delegated Risk over Queue-based Safety.** An autonomous agent may occasionally halt, reject, or escalate a change that a human would have greenlit. In exchange, queue-based handoffs are eliminated from lower environments.
+* **Immutability over Convenience.** Every action leaves a cryptographic shadow in an external evidence stream. The operational overhead of signing, linking, and streaming is accepted in exchange for tamper-evident assurance rather than reliance on mutable, rewritable logs.
+
+## 7. Anti-Goals
+
+* **Not an upstream development platform.** No management of product backlogs, sprint ceremonies, IDE extensions, or code authorship workflows.
+* **Not a general-purpose AI.** The platform is not an open-ended conversational assistant. Autonomy is narrow, scoped to delivery and infrastructure reconciliation, and bounded by strict policy envelopes.
+* **Not a legacy infrastructure bridge.** No management of VMs, bare metal, or OS lifecycles. The substrate will not extend to non-cloud-native patterns.
+* **Not a permissive delivery highway.** No escape hatches to bypass the confidence framework or the human attestation requirements at higher environments. Speed is a byproduct of confidence and policy compliance, not an override.
+* **Not a mutable audit log.** Version control history does not satisfy regulatory evidence. Auditability requires an immutable, externally-stored stream.
+
+## 8. Signals of Success
+
+The vision is realized when:
+
+* A merged change progresses through lower environments end-to-end without a platform engineer joining a thread, approving a ticket, or manually triggering a stage gate.
+* A developer deploys compliant, observable, and secured infrastructure by authoring a contract and a workflow — not by reading tribal runbooks or filing infrastructure requests.
+* A non-technical consumer ships a production deployment by declaring intent — without authoring a workflow, a configuration file, or a Terraform module.
+* An auditor can trace any production change to a human attestation and an immutable evidence stream without interpreting shell scripts, pipeline logs, or repository history.
+* Security, resiliency, and observability standards are satisfied automatically through platform-enriched contracts, rather than through post-hoc remediation.
+* When the platform halts a delivery, it provides a measured, explainable reason — a policy violation, an insufficient confidence signal, or a missing attestation — rather than requiring an opaque, manual-debugging exercise.
+
+## What this vision is, and what it isn't
+
+* **It is:** A principles document. The North Star, the tenets, the strategic bets, the anti-goals. It's intended to be the page that orients a new team, a new stakeholder, or a new architectural decision. It should not need to be rewritten when a tool changes.
+* **It isn't:** An architecture. The four-layer model (L1 Terraform primitives, L2 composed stacks, L3A developer surface, L3B agentic surface), the central pipeline template model, the schema location, the dual HITL mechanics, the enterprise evidence stream integration — all of that belongs in the architecture document, where it can be specific and evolve independently.

modules-ir/README-TEMPLATE.md

@@ -0,0 +1,50 @@
+# <module-name> — <plain-language description>
+
+> **Module kind:** L1 primitive  |  **Version:** 1.0.0
+
+## Overview
+
+One or two sentences describing what this module provisions, in plain
+language. No jargon. A reader should know after this paragraph whether
+this module is what they need.
+
+## Resources
+
+Terraform resources this module creates:
+
+| Resource | Type | Purpose |
+|----------|------|---------|
+| `<name>` | `aws_<type>` | what it does |
+
+## Inputs
+
+| Name | Type | Required | Default | Description |
+|------|------|----------|---------|-------------|
+| `<name>` | string | yes | — | description |
+
+## Outputs
+
+| Name | Type | Description |
+|------|------|-------------|
+| `<name>` | string | description |
+
+## Usage
+
+```
+# A concrete snippet showing how to reference this module or what a
+# consumer writes to use it.
+```
+
+## Compliance extension points
+
+Resources this module could be extended with for the future compliance
+milestone (GDPR, SOX, SOC2, HIPAA, DORA). Not implemented yet — listed
+so the redesign can plan for them.
+
+- **<area>** — <what could be added, e.g. KMS key for encryption>
+
+## Versioning
+
+`1.0.0` — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR
+bumps require a new registry entry (immutable publication); old entries
+enter a 12-month deprecation window.

modules-ir/README.md

@@ -0,0 +1,51 @@
+# ACDL Modules
+
+Reusable building blocks for cloud infrastructure. Each module is
+self-documented with a `README.md` following the
+[template](README-TEMPLATE.md).
+
+## How the modules work
+
+There are two kinds of module:
+
+- **L1 primitives** — a single cloud resource or a small group of
+  related resources (e.g. a VPC with subnets and routing). Each L1 has
+  an `interface.json` declaring its inputs and outputs, and a `README.md`
+  in plain language.
+- **L2 compositions** — a composition that references multiple L1s to
+  deploy a complete stack (e.g. an ECS Fargate microservice). **The L2
+  composition layer is being redesigned.** The previous implementation
+  has been removed; a new mechanism will be designed in a later phase.
+
+The Terraform adapter (`adapters/terraform/adapter.py`) compiles a
+module instance to Terraform. Each module's README documents which
+Terraform resources it creates.
+
+## L1 primitives
+
+| Module | What it creates | README |
+|--------|----------------|--------|
+| `l1-s3` | `aws_s3_bucket` — a single S3 bucket | [README](l1/l1-s3/README.md) |
+| `l1-vpc` | `aws_vpc` + `aws_subnet` + `aws_route_table` + `aws_internet_gateway` — VPC with subnets and routing | [README](l1/l1-vpc/README.md) |
+| `l1-ecs-cluster` | `aws_ecs_cluster` — ECS Fargate cluster | [README](l1/l1-ecs-cluster/README.md) |
+| `l1-ecs-service` | `aws_ecs_task_definition` + `aws_ecs_service` — Fargate service with task definition | [README](l1/l1-ecs-service/README.md) |
+| `l1-iam-role` | `aws_iam_role` — IAM role with assume-role policy | [README](l1/l1-iam-role/README.md) |
+| `l1-alb` | `aws_lb` + `aws_lb_target_group` + `aws_lb_listener` — Application Load Balancer | [README](l1/l1-alb/README.md) |
+| `l1-ecr` | `aws_ecr_repository` — ECR container image repository | [README](l1/l1-ecr/README.md) |
+
+## L2 compositions
+
+| Module | What it references | README |
+|--------|--------------------|--------|
+| `l2-microservice` | 6 L1s (vpc, cluster, ecr, iam-role, alb, ecs-service) — **under redesign** | [README](l2/l2-microservice/README.md) |
+| `l2-static-asset` | 1 L1 (s3) — **under redesign** | [README](l2/l2-static-asset/README.md) |
+
+## Registry
+
+Module versions are tracked in `registry.json`. Only L1 entries are
+active; L2 entries have been pruned pending the composition redesign.
+
+## Template
+
+New modules should use [README-TEMPLATE.md](README-TEMPLATE.md) as
+their starting point.

modules-ir/l1/l1-alb/README.md

@@ -0,0 +1,71 @@
+# l1-alb — Application Load Balancer (load balancer + target group + listener)
+
+> **Module kind:** L1 primitive  |  **Version:** 1.0.0
+
+An Application Load Balancer with a target group and a listener. This is
+a multi-resource module: it creates a load balancer, a target group, and
+a listener that forwards traffic to the target group. The target group
+is what `l1-ecs-service` registers its tasks with.
+
+## Resources
+
+| Resource | Type | Purpose |
+|----------|------|---------|
+| load_balancer | `aws_lb` | Application load balancer in the VPC subnets |
+| target_group | `aws_lb_target_group` | Target group for the ECS service tasks |
+| listener | `aws_lb_listener` | Listener forwarding the LB port to the target group |
+
+## Inputs
+
+| Name | Type | Required | Default | Description |
+|------|------|----------|---------|-------------|
+| `name` | string | yes | — | Name tag for the load balancer and child resources |
+| `subnets` | string | yes | — | Comma-separated subnet ids (from `l1-vpc`) |
+| `security_group` | string | yes | — | Security group id for the load balancer |
+| `port` | number | no | 80 | Listener port |
+| `protocol` | string | no | `HTTP` | Listener protocol |
+| `region` | string | yes | — | AWS region the load balancer is created in |
+
+## Outputs
+
+| Name | Type | Description |
+|------|------|-------------|
+| `lb_arn` | arn | The load balancer ARN |
+| `listener_arn` | arn | The listener ARN |
+| `target_group_arn` | arn | The target group ARN |
+
+## Usage
+
+```json
+{
+  "id": "alb",
+  "type": "aws:elbv2:loadbalancer",
+  "module": "l1-alb@1.0.0",
+  "inputs": {
+    "name": "acdl-microservice",
+    "subnets": "ref:vpc.subnet_ids",
+    "security_group": "ref:roles.role_arn",
+    "port": 8080,
+    "protocol": "HTTP",
+    "region": "us-east-1"
+  }
+}
+```
+
+The `target_group_arn` output is referenced by `l1-ecs-service` as its
+`lb_target_group_arn` input to wire the service to the ALB.
+
+## Compliance extension points
+
+- **TLS / HTTPS listener** — add `aws_acm_certificate` + `ssl_policy` + `certificate_arn` for encryption in transit (SOC2 CC6.1, PCI-DSS 4.1, HIPAA §164.312(e)(1), GDPR Art.32).
+- **Access logs** — add `access_logs { bucket = ..., prefix = ... }` to the load balancer (SOX, SOC2 CC7.2, DORA ICT audit trail).
+- **Security group rules** — add ingress/egress rules restricting traffic to known sources (SOC2 CC6.6, PCI-DSS 1.2).
+- **Health check** — add a `health_check` block to the target group (SOC2 CC7.3 monitoring, DORA operational resilience).
+- **WAF** — add `aws_wafv2_web_acl_association` for application-layer protection (SOC2 CC7.6, PCI-DSS 6.5, DORA ICT risk).
+- **Deregistration delay** — add `deregistration_delay` for graceful draining (SOC2 CC9.1 resilience).
+
+## Versioning
+
+`1.0.0` — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps
+require a new registry entry (immutable publication); old entries enter
+a 12-month deprecation window.

modules-ir/l1/l1-alb/interface.json

@@ -0,0 +1,76 @@
+{
+  "name": "l1-alb",
+  "version": "1.0.0",
+  "kind": "l1",
+  "type": "aws:elbv2:loadbalancer",
+  "description": "Application Load Balancer primitive (substrate-agnostic IR types aws:elbv2:loadbalancer + aws:elbv2:listener + aws:elbv2:targetgroup; the Terraform adapter translates to aws_lb/aws_lb_listener/aws_lb_target_group).",
+  "inputs": {
+    "name": {
+      "type": "string",
+      "description": "Name tag for the load balancer and child resources.",
+      "required": true
+    },
+    "subnets": {
+      "type": "string",
+      "description": "Comma-separated subnet ids (ref to l1-vpc).",
+      "required": true
+    },
+    "security_group": {
+      "type": "string",
+      "description": "Security group id for the load balancer.",
+      "required": true
+    },
+    "port": {
+      "type": "number",
+      "description": "Listener port (default 80).",
+      "required": false,
+      "default": 80
+    },
+    "protocol": {
+      "type": "string",
+      "description": "Listener protocol (default HTTP).",
+      "required": false,
+      "default": "HTTP"
+    },
+    "region": {
+      "type": "string",
+      "description": "AWS region the load balancer is created in.",
+      "required": true
+    }
+  },
+  "outputs": {
+    "lb_arn": {
+      "type": "arn",
+      "description": "The load balancer ARN."
+    },
+    "listener_arn": {
+      "type": "arn",
+      "description": "The listener ARN."
+    },
+    "target_group_arn": {
+      "type": "arn",
+      "description": "The target group ARN."
+    }
+  },
+  "nfrs": {},
+  "resources": [
+    {
+      "type": "aws:elbv2:loadbalancer",
+      "description": "Application load balancer in the VPC subnets.",
+      "inputs": ["name", "subnets", "security_group"],
+      "outputs": ["lb_arn"]
+    },
+    {
+      "type": "aws:elbv2:targetgroup",
+      "description": "Target group for the ECS service tasks.",
+      "inputs": ["name", "port", "protocol", "vpc_id"],
+      "outputs": ["target_group_arn"]
+    },
+    {
+      "type": "aws:elbv2:listener",
+      "description": "Listener forwarding the LB port to the target group.",
+      "inputs": ["lb_arn", "port", "protocol", "target_group_arn"],
+      "outputs": ["listener_arn"]
+    }
+  ]
+}

modules-ir/l1/l1-ecr/README.md

@@ -0,0 +1,58 @@
+# l1-ecr — ECR repository
+
+> **Module kind:** L1 primitive  |  **Version:** 1.0.0
+
+A single ECR repository that hosts the container image for the ECS
+task. The simplest container-registry module — one resource, two
+inputs, two outputs.
+
+## Resources
+
+| Resource | Type | Purpose |
+|----------|------|---------|
+| repository | `aws_ecr_repository` | The ECR repository |
+
+## Inputs
+
+| Name | Type | Required | Default | Description |
+|------|------|----------|---------|-------------|
+| `name` | string | yes | — | The ECR repository name |
+| `region` | string | yes | — | AWS region the repository is created in |
+
+## Outputs
+
+| Name | Type | Description |
+|------|------|-------------|
+| `repository_url` | string | The ECR repository URL |
+| `repository_arn` | arn | The ECR repository ARN |
+
+## Usage
+
+```json
+{
+  "id": "ecr",
+  "type": "aws:ecr:repository",
+  "module": "l1-ecr@1.0.0",
+  "inputs": {
+    "name": "acdl-microservice",
+    "region": "us-east-1"
+  }
+}
+```
+
+The `repository_url` output is used to build the `image` input for
+`l1-ecs-service` (e.g. `<repository_url>:latest`).
+
+## Compliance extension points
+
+- **Image scanning** — add `image_scanning_configuration { scan_on_push = true }` for vulnerability scanning (SOC2 CC7.6, DORA ICT risk testing, HIPAA security monitoring).
+- **Encryption** — add `encryption_configuration { encryption_type = "KMS", kms_key = ... }` with a customer-managed key (SOC2 CC6.1, HIPAA §164.312(a)(2)(iv), GDPR Art.32).
+- **Image tag immutability** — add `image_tag_mutability = "IMMUTABLE"` to prevent tag overwriting (SOX §802, SOC2 CC6.1 integrity, DORA audit integrity).
+- **Lifecycle policy** — add `aws_ecr_lifecycle_policy` to enforce image retention / cleanup (GDPR Art.5(2) data minimization, SOC2 CC5.2).
+- **Access policy** — add a repository policy restricting pull/push to known roles (SOC2 CC6.1, HIPAA §164.308(a)(4)).
+
+## Versioning
+
+`1.0.0` — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps
+require a new registry entry (immutable publication); old entries enter
+a 12-month deprecation window.

modules-ir/l1/l1-ecr/interface.json

@@ -0,0 +1,30 @@
+{
+  "name": "l1-ecr",
+  "version": "1.0.0",
+  "kind": "l1",
+  "type": "aws:ecr:repository",
+  "description": "ECR repository primitive (substrate-agnostic IR type aws:ecr:repository; the Terraform adapter translates to aws_ecr_repository).",
+  "inputs": {
+    "name": {
+      "type": "string",
+      "description": "The ECR repository name.",
+      "required": true
+    },
+    "region": {
+      "type": "string",
+      "description": "AWS region the repository is created in.",
+      "required": true
+    }
+  },
+  "outputs": {
+    "repository_url": {
+      "type": "string",
+      "description": "The ECR repository URL."
+    },
+    "repository_arn": {
+      "type": "arn",
+      "description": "The ECR repository ARN."
+    }
+  },
+  "nfrs": {}
+}

modules-ir/l1/l1-ecs-cluster/README.md

@@ -0,0 +1,56 @@
+# l1-ecs-cluster — ECS Fargate cluster
+
+> **Module kind:** L1 primitive  |  **Version:** 1.0.0
+
+An ECS Fargate cluster. The simplest ECS module — one resource, two
+inputs, two outputs. The cluster is the container orchestration
+boundary that `l1-ecs-service` references for task placement.
+
+## Resources
+
+| Resource | Type | Purpose |
+|----------|------|---------|
+| cluster | `aws_ecs_cluster` | The ECS Fargate cluster |
+
+## Inputs
+
+| Name | Type | Required | Default | Description |
+|------|------|----------|---------|-------------|
+| `name` | string | yes | — | The ECS cluster name |
+| `region` | string | yes | — | AWS region the cluster is created in |
+
+## Outputs
+
+| Name | Type | Description |
+|------|------|-------------|
+| `cluster_arn` | arn | The ECS cluster ARN |
+| `cluster_id` | string | The ECS cluster id (name) |
+
+## Usage
+
+```json
+{
+  "id": "cluster",
+  "type": "aws:ecs:cluster",
+  "module": "l1-ecs-cluster@1.0.0",
+  "inputs": {
+    "name": "acdl-microservice",
+    "region": "us-east-1"
+  }
+}
+```
+
+The `cluster_arn` output is referenced by `l1-ecs-service` as its
+`cluster_arn` input.
+
+## Compliance extension points
+
+- **Container Insights** — add `configuration { container_insights = "enabled" }` for observability (SOC2 CC7.3, DORA ICT risk monitoring).
+- **CloudWatch Logs** — add a log group with retention policy for cluster-level audit logs (SOX, SOC2 CC7.2, HIPAA §164.312(b)).
+- **Encryption** — add `settings { name = "containerInsights", value = "enabled" }` and KMS-based encryption for container data (HIPAA §164.312(a)(2)(iv), GDPR Art.32).
+
+## Versioning
+
+`1.0.0` — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps
+require a new registry entry (immutable publication); old entries enter
+a 12-month deprecation window.

modules-ir/l1/l1-ecs-cluster/interface.json

@@ -0,0 +1,30 @@
+{
+  "name": "l1-ecs-cluster",
+  "version": "1.0.0",
+  "kind": "l1",
+  "type": "aws:ecs:cluster",
+  "description": "ECS Fargate cluster primitive (substrate-agnostic IR type aws:ecs:cluster; the Terraform adapter translates to aws_ecs_cluster).",
+  "inputs": {
+    "name": {
+      "type": "string",
+      "description": "The ECS cluster name.",
+      "required": true
+    },
+    "region": {
+      "type": "string",
+      "description": "AWS region the cluster is created in.",
+      "required": true
+    }
+  },
+  "outputs": {
+    "cluster_arn": {
+      "type": "arn",
+      "description": "The ECS cluster ARN."
+    },
+    "cluster_id": {
+      "type": "string",
+      "description": "The ECS cluster id (name)."
+    }
+  },
+  "nfrs": {}
+}

modules-ir/l1/l1-ecs-service/README.md

@@ -0,0 +1,78 @@
+# l1-ecs-service — ECS Fargate service (task definition + service)
+
+> **Module kind:** L1 primitive  |  **Version:** 1.0.0
+
+An ECS Fargate service with its task definition. Runs a container image
+on Fargate, optionally behind an ALB target group. This is a
+multi-resource module: it creates a task definition and a service that
+runs it.
+
+## Resources
+
+| Resource | Type | Purpose |
+|----------|------|---------|
+| task_definition | `aws_ecs_task_definition` | Fargate task definition with container image, CPU, memory, port, env |
+| service | `aws_ecs_service` | Fargate service running the task definition in a cluster + subnets |
+
+## Inputs
+
+| Name | Type | Required | Default | Description |
+|------|------|----------|---------|-------------|
+| `image` | string | yes | — | ECR image URL for the task container |
+| `port` | number | yes | — | Container port the service listens on |
+| `cpu` | number | no | 256 | Task CPU units (Fargate) |
+| `memory` | number | no | 512 | Task memory in MiB (Fargate) |
+| `env` | string | no | — | Environment variables as a JSON map string |
+| `cluster_arn` | arn | yes | — | ECS cluster ARN (from `l1-ecs-cluster`) |
+| `subnets` | string | yes | — | Comma-separated subnet ids (from `l1-vpc`) |
+| `security_group` | string | yes | — | Security group id for the service ENIs |
+| `lb_target_group_arn` | arn | no | — | Optional ALB target group ARN (from `l1-alb`) |
+| `region` | string | yes | — | AWS region the service is created in |
+
+## Outputs
+
+| Name | Type | Description |
+|------|------|-------------|
+| `service_arn` | arn | The ECS service ARN |
+| `task_def_arn` | arn | The ECS task definition ARN |
+
+## Usage
+
+```json
+{
+  "id": "service",
+  "type": "aws:ecs:task_definition",
+  "module": "l1-ecs-service@1.0.0",
+  "inputs": {
+    "image": "581513795199.dkr.ecr.us-east-1.amazonaws.com/acdl-microservice:latest",
+    "port": 8080,
+    "cpu": 256,
+    "memory": 512,
+    "cluster_arn": "ref:cluster.cluster_arn",
+    "subnets": "ref:vpc.subnet_ids",
+    "security_group": "ref:roles.role_arn",
+    "region": "us-east-1"
+  }
+}
+```
+
+The `image`, `port`, and `env` inputs are compiled into a
+`container_definitions` JSON block by the adapter. The service is
+placed in the cluster with the given subnets and security group, and
+optionally wired to the ALB target group if `lb_target_group_arn` is
+provided.
+
+## Compliance extension points
+
+- **CloudWatch Logs** — add `logConfiguration` to the container definition with a log group + retention policy (SOX, SOC2 CC7.2, HIPAA §164.312(b), DORA ICT incident logging).
+- **Task execution role separation** — add a separate `aws_iam_role` for execution vs. the task role (SOC2 CC6.3 segregation of duties at runtime).
+- **Secrets injection** — add `secrets` block referencing AWS Secrets Manager / SSM Parameter Store with KMS encryption (SOC2 CC6.1, HIPAA §164.312(a)(2)(iv)).
+- **Execute command** — add `enable_execute_command` with KMS encryption for session audit (SOC2 CC7.2).
+- **Deployment circuit breaker** — add `deployment_circuit_breaker` block for resilience (SOC2 CC9.1, DORA operational resilience).
+- **Health check** — add a `health_check` block to the target group (currently missing despite the contract schema having a healthcheck field).
+
+## Versioning
+
+`1.0.0` — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps
+require a new registry entry (immutable publication); old entries enter
+a 12-month deprecation window.

modules-ir/l1/l1-ecs-service/interface.json

@@ -0,0 +1,86 @@
+{
+  "name": "l1-ecs-service",
+  "version": "1.0.0",
+  "kind": "l1",
+  "type": "aws:ecs:task_definition",
+  "description": "ECS Fargate service primitive (substrate-agnostic IR types aws:ecs:task_definition + aws:ecs:service; the Terraform adapter translates to aws_ecs_task_definition/aws_ecs_service).",
+  "inputs": {
+    "image": {
+      "type": "string",
+      "description": "ECR image URL for the task container.",
+      "required": true
+    },
+    "port": {
+      "type": "number",
+      "description": "Container port the service listens on.",
+      "required": true
+    },
+    "cpu": {
+      "type": "number",
+      "description": "Task CPU units (Fargate).",
+      "required": false,
+      "default": 256
+    },
+    "memory": {
+      "type": "number",
+      "description": "Task memory (MiB, Fargate).",
+      "required": false,
+      "default": 512
+    },
+    "env": {
+      "type": "string",
+      "description": "Environment variables as a JSON map string (optional).",
+      "required": false
+    },
+    "cluster_arn": {
+      "type": "arn",
+      "description": "ECS cluster ARN (ref to l1-ecs-cluster).",
+      "required": true
+    },
+    "subnets": {
+      "type": "string",
+      "description": "Comma-separated subnet ids (ref to l1-vpc).",
+      "required": true
+    },
+    "security_group": {
+      "type": "string",
+      "description": "Security group id for the service ENIs.",
+      "required": true
+    },
+    "lb_target_group_arn": {
+      "type": "arn",
+      "description": "Optional ALB target group ARN (ref to l1-alb).",
+      "required": false
+    },
+    "region": {
+      "type": "string",
+      "description": "AWS region the service is created in.",
+      "required": true
+    }
+  },
+  "outputs": {
+    "service_arn": {
+      "type": "arn",
+      "description": "The ECS service ARN."
+    },
+    "task_def_arn": {
+      "type": "arn",
+      "description": "The ECS task definition ARN."
+    }
+  },
+  "nfrs": {},
+  "resources": [
+    {
+      "type": "aws:ecs:task_definition",
+      "description": "Fargate task definition; the adapter jsonencodes image/port/env into container_definitions.",
+      "inputs": ["image", "port", "cpu", "memory", "env"],
+      "outputs": ["task_def_arn"]
+    },
+    {
+      "type": "aws:ecs:service",
+      "description": "Fargate service running the task definition in the cluster + subnets.",
+      "inputs": ["cluster_arn", "subnets", "security_group", "lb_target_group_arn"],
+      "outputs": ["service_arn"]
+    }
+  ]
+}

modules-ir/l1/l1-iam-role/README.md

@@ -0,0 +1,64 @@
+# l1-iam-role — IAM role
+
+> **Module kind:** L1 primitive  |  **Version:** 1.0.0
+
+A single IAM role with an assume-role policy and optional managed
+policy attachments. Used as the ECS task execution role.
+
+## Resources
+
+| Resource | Type | Purpose |
+|----------|------|---------|
+| role | `aws_iam_role` | The IAM role with assume-role policy |
+
+## Inputs
+
+| Name | Type | Required | Default | Description |
+|------|------|----------|---------|-------------|
+| `role_name` | string | yes | — | The IAM role name |
+| `assume_role_policy` | string | yes | — | Assume-role policy document (JSON string) |
+| `managed_policies` | string | no | — | Comma-separated list of managed policy ARNs to attach |
+| `region` | string | yes | — | AWS region the role is created in |
+
+## Outputs
+
+| Name | Type | Description |
+|------|------|-------------|
+| `role_arn` | arn | The IAM role ARN |
+| `role_id` | string | The IAM role id |
+
+## Usage
+
+```json
+{
+  "id": "roles",
+  "type": "aws:iam:role",
+  "module": "l1-iam-role@1.0.0",
+  "inputs": {
+    "role_name": "acdl-microservice-exec",
+    "assume_role_policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"ecs-tasks.amazonaws.com\"},\"Action\":\"sts:AssumeRole\"}]}",
+    "managed_policies": "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy",
+    "region": "us-east-1"
+  }
+}
+```
+
+The `assume_role_policy` is a JSON string — the adapter jsonencodes it
+into the Terraform `assume_role_policy` argument. The
+`managed_policies` input is a comma-separated list of ARNs, emitted as
+`managed_policy_arns = [...]`.
+
+## Compliance extension points
+
+- **Permissions boundary** — add `permissions_boundary` to enforce least-privilege guardrails (SOC2 CC6.1, SOX ITGC, DORA ICT access control).
+- **Inline policy** — add `aws_iam_role_policy` for fine-grained least-privilege instead of broad managed policies (SOC2 CC6.1, HIPAA §164.308(a)(4)).
+- **MFA conditions** — add `condition` blocks requiring MFA for assume-role (SOC2 CC6.1, HIPAA §164.312(d)).
+- **Source IP / region conditions** — add `aws:SourceIp` / `aws:RequestedRegion` conditions for data residency enforcement (GDPR Art.44-49, DORA ICT third-party risk).
+- **Access Analyzer** — add `aws_accessanalyzer_analyzer` to verify least-privilege (SOC2 CC6.1, GDPR Art.32).
+- **Role separation** — add a separate task role vs. execution role (SOC2 CC6.3 segregation of duties).
+
+## Versioning
+
+`1.0.0` — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps
+require a new registry entry (immutable publication); old entries enter
+a 12-month deprecation window.

modules-ir/l1/l1-iam-role/interface.json

@@ -0,0 +1,40 @@
+{
+  "name": "l1-iam-role",
+  "version": "1.0.0",
+  "kind": "l1",
+  "type": "aws:iam:role",
+  "description": "IAM role primitive (substrate-agnostic IR type aws:iam:role; the Terraform adapter translates to aws_iam_role).",
+  "inputs": {
+    "role_name": {
+      "type": "string",
+      "description": "The IAM role name.",
+      "required": true
+    },
+    "assume_role_policy": {
+      "type": "string",
+      "description": "Assume-role policy document (JSON string).",
+      "required": true
+    },
+    "managed_policies": {
+      "type": "string",
+      "description": "Comma-separated list of managed policy ARNs to attach.",
+      "required": false
+    },
+    "region": {
+      "type": "string",
+      "description": "AWS region the role is created in.",
+      "required": true
+    }
+  },
+  "outputs": {
+    "role_arn": {
+      "type": "arn",
+      "description": "The IAM role ARN."
+    },
+    "role_id": {
+      "type": "string",
+      "description": "The IAM role id."
+    }
+  },
+  "nfrs": {}
+}

modules-ir/l1/l1-s3/README.md

@@ -0,0 +1,63 @@
+# l1-s3 — S3 bucket
+
+> **Module kind:** L1 primitive  |  **Version:** 1.0.0
+
+A single S3 bucket for object storage. The simplest module — one
+resource, two inputs, two outputs. Versioning is enabled by default.
+
+## Resources
+
+| Resource | Type | Purpose |
+|----------|------|---------|
+| bucket | `aws_s3_bucket` | The S3 bucket itself |
+
+## Inputs
+
+| Name | Type | Required | Default | Description |
+|------|------|----------|---------|-------------|
+| `bucket_name` | string | yes | — | Globally-unique S3 bucket name |
+| `region` | string | yes | — | AWS region the bucket is created in |
+
+## Outputs
+
+| Name | Type | Description |
+|------|------|-------------|
+| `bucket_arn` | arn | The S3 bucket ARN |
+| `bucket_name` | string | The bucket name (echoes the input) |
+
+## NFRs
+
+| Name | Type | Default | Description |
+|------|------|---------|-------------|
+| `versioning` | boolean | true | Enable S3 versioning |
+
+## Usage
+
+```json
+{
+  "id": "s3",
+  "type": "aws:s3:bucket",
+  "module": "l1-s3@1.0.0",
+  "inputs": {
+    "bucket_name": "acdl-spike-bucket",
+    "region": "us-east-1"
+  }
+}
+```
+
+A concrete instance is at `spike_instance.json` (used by the platform
+pipeline as the regression baseline).
+
+## Compliance extension points
+
+- **Encryption at rest** — add `aws_s3_bucket_server_side_encryption_configuration` with a customer-managed KMS key (SOC2 CC6.1, HIPAA §164.312(a)(2)(iv), GDPR Art.32).
+- **Object Lock** — add `aws_s3_bucket_object_lock_configuration` in compliance mode with 7-year retention for immutable evidence (SOX §802, DORA audit trail).
+- **Access logging** — add `aws_s3_bucket_logging` to a target logging bucket (SOC2 CC7.2).
+- **Public access block** — add `aws_s3_bucket_public_access_block` to prevent data exfiltration (SOC2 CC6.1, GDPR Art.32).
+- **Lifecycle policy** — add `aws_s3_bucket_lifecycle_configuration` for retention enforcement (GDPR Art.5(2), HIPAA §164.530(j)).
+
+## Versioning
+
+`1.0.0` — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps
+require a new registry entry (immutable publication); old entries enter
+a 12-month deprecation window.

modules-ir/l1/l1-s3/interface.json

@@ -0,0 +1,36 @@
+{
+  "name": "l1-s3",
+  "version": "1.0.0",
+  "kind": "l1",
+  "type": "aws:s3:bucket",
+  "description": "S3 bucket primitive (substrate-agnostic IR type aws:s3:bucket; the Terraform adapter translates to aws_s3_bucket).",
+  "inputs": {
+    "bucket_name": {
+      "type": "string",
+      "description": "Globally-unique S3 bucket name.",
+      "required": true
+    },
+    "region": {
+      "type": "string",
+      "description": "AWS region the bucket is created in.",
+      "required": true
+    }
+  },
+  "outputs": {
+    "bucket_arn": {
+      "type": "arn",
+      "description": "The S3 bucket ARN."
+    },
+    "bucket_name": {
+      "type": "string",
+      "description": "The bucket name (echoes the input)."
+    }
+  },
+  "nfrs": {
+    "versioning": {
+      "type": "boolean",
+      "description": "Enable S3 versioning (default true).",
+      "default": true
+    }
+  }
+}

modules-ir/l1/l1-s3/spike_instance.json

@@ -0,0 +1,23 @@
+{
+  "version": "1.0.0",
+  "stack": {
+    "name": "l1-s3",
+    "kind": "l1",
+    "depth": 1
+  },
+  "resources": [
+    {
+      "id": "s3",
+      "type": "aws:s3:bucket",
+      "module": "l1-s3@1.0.0",
+      "inputs": {
+        "bucket_name": "acdl-spike-bucket",
+        "region": "us-east-1"
+      },
+      "outputs": {
+        "bucket_arn": {"type": "arn", "description": "The S3 bucket ARN."},
+        "bucket_name": {"type": "string", "description": "The bucket name."}
+      }
+    }
+  ]
+}

modules-ir/l1/l1-vpc/README.md

@@ -0,0 +1,67 @@
+# l1-vpc — VPC with subnets and routing
+
+> **Module kind:** L1 primitive  |  **Version:** 1.0.0
+
+A VPC with one subnet per availability zone and a route table with a
+default route through an internet gateway. The networking foundation
+that other modules (ALB, ECS service) reference for subnet ids.
+
+## Resources
+
+| Resource | Type | Purpose |
+|----------|------|---------|
+| vpc | `aws_vpc` | The VPC itself |
+| subnet | `aws_subnet` | One subnet per availability zone |
+| route_table | `aws_route_table` | Route table with default route 0.0.0.0/0 |
+| internet_gateway | `aws_internet_gateway` | IGW for public internet access |
+| route_table_association | `aws_route_table_association` | Binds subnet to route table |
+
+## Inputs
+
+| Name | Type | Required | Default | Description |
+|------|------|----------|---------|-------------|
+| `cidr` | string | yes | — | VPC CIDR block, e.g. `10.0.0.0/16` |
+| `azs` | string | yes | — | Comma-separated availability zones, e.g. `us-east-1a,us-east-1b` |
+| `name` | string | yes | — | Name tag for the VPC and child resources |
+| `region` | string | yes | — | AWS region the VPC is created in |
+
+## Outputs
+
+| Name | Type | Description |
+|------|------|-------------|
+| `vpc_id` | string | The VPC id |
+| `subnet_ids` | string | Comma-separated subnet ids |
+
+## Usage
+
+```json
+{
+  "id": "vpc",
+  "type": "aws:ec2:vpc",
+  "module": "l1-vpc@1.0.0",
+  "inputs": {
+    "cidr": "10.0.0.0/16",
+    "azs": "us-east-1a,us-east-1b",
+    "name": "acdl-microservice",
+    "region": "us-east-1"
+  }
+}
+```
+
+The `azs` input is split on comma; one subnet is created per zone. The
+route table gets a default route `0.0.0.0/0` → internet gateway. Other
+modules reference `subnet_ids` for their network placement.
+
+## Compliance extension points
+
+- **VPC Flow Logs** — add `aws_flow_log` + CloudWatch Logs group / S3 destination (SOX ITGC, SOC2 CC7.2, HIPAA §164.312(b), DORA ICT risk logging).
+- **Private subnets + NAT gateway** — add private subnets with a NAT gateway so ECS tasks don't need public IPs (SOC2 CC6.6, PCI-DSS 1.3, HIPAA network isolation).
+- **VPC endpoints** — add S3, ECR, KMS, DynamoDB, CloudWatch interface/gateway endpoints to keep traffic off the public internet (SOC2 CC6.7, GDPR Art.32(1)(a), DORA ICT third-party risk).
+- **Security groups** — add `aws_security_group` as a first-class sub-resource (currently missing; needed for all regulated deployments) (SOC2 CC6.6, PCI-DSS 1.2).
+- **Network ACLs** — add `aws_network_acl` for subnet-level segmentation (PCI-DSS 1.3).
+
+## Versioning
+
+`1.0.0` — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps
+require a new registry entry (immutable publication); old entries enter
+a 12-month deprecation window.

modules-ir/l1/l1-vpc/interface.json

@@ -0,0 +1,64 @@
+{
+  "name": "l1-vpc",
+  "version": "1.0.0",
+  "kind": "l1",
+  "type": "aws:ec2:vpc",
+  "description": "VPC primitive (substrate-agnostic IR types aws:ec2:vpc + aws:ec2:subnet + aws:ec2:routetable; the Terraform adapter translates to aws_vpc/aws_subnet/aws_route_table).",
+  "inputs": {
+    "cidr": {
+      "type": "string",
+      "description": "VPC CIDR block, e.g. 10.0.0.0/16.",
+      "required": true
+    },
+    "azs": {
+      "type": "string",
+      "description": "Comma-separated availability zones, e.g. us-east-1a,us-east-1b.",
+      "required": true
+    },
+    "name": {
+      "type": "string",
+      "description": "Name tag for the VPC and child resources.",
+      "required": true
+    },
+    "region": {
+      "type": "string",
+      "description": "AWS region the VPC is created in.",
+      "required": true
+    }
+  },
+  "outputs": {
+    "vpc_id": {
+      "type": "string",
+      "description": "The VPC id."
+    },
+    "subnet_ids": {
+      "type": "string",
+      "description": "Comma-separated subnet ids."
+    }
+  },
+  "nfrs": {},
+  "resources": [
+    {
+      "type": "aws:ec2:vpc",
+      "description": "The VPC itself.",
+      "inputs": ["cidr", "name"],
+      "outputs": ["vpc_id"]
+    },
+    {
+      "type": "aws:ec2:subnet",
+      "description": "One subnet per availability zone (azs split on comma).",
+      "inputs": ["cidr", "az", "vpc_id", "name"],
+      "outputs": ["subnet_id"]
+    },
+    {
+      "type": "aws:ec2:routetable",
+      "description": "Route table bound to the VPC with an internet gateway + default route.",
+      "inputs": ["vpc_id"],
+      "outputs": []
+    }
+  ],
+  "intra_refs": [
+    {"from": "aws:ec2:subnet.vpc_id", "to": "aws:ec2:vpc.vpc_id"},
+    {"from": "aws:ec2:routetable.vpc_id", "to": "aws:ec2:vpc.vpc_id"}
+  ]
+}

modules-ir/l2/l2-microservice/README.md

@@ -0,0 +1,57 @@
+# l2-microservice — ECS Fargate microservice (composition being redesigned)
+
+> **Module kind:** L2 composition  |  **Version:** TBD  |  **Status:** Under redesign
+
+A composition that references multiple L1 primitives to deploy an ECS
+Fargate microservice end-to-end (VPC, cluster, ECR, IAM role, ALB,
+ECS service).
+
+**The composition layer is being redesigned.** The previous
+thin-composition implementation (a `composition.json` with children +
+wires) has been removed. A new composition mechanism will be designed
+in a later phase.
+
+## Resources
+
+TBD — the composition will reference these L1 primitives:
+
+| L1 module | Purpose | README |
+|-----------|---------|--------|
+| `l1-vpc` | VPC, subnets, routing | [README](../l1/l1-vpc/README.md) |
+| `l1-ecs-cluster` | ECS Fargate cluster | [README](../l1/l1-ecs-cluster/README.md) |
+| `l1-ecr` | ECR image repository | [README](../l1/l1-ecr/README.md) |
+| `l1-iam-role` | IAM task execution role | [README](../l1/l1-iam-role/README.md) |
+| `l1-alb` | Application Load Balancer | [README](../l1/l1-alb/README.md) |
+| `l1-ecs-service` | ECS task definition + service | [README](../l1/l1-ecs-service/README.md) |
+
+## Inputs
+
+TBD — will be defined when the composition mechanism is redesigned.
+
+## Outputs
+
+TBD — will be defined when the composition mechanism is redesigned.
+
+## Usage
+
+TBD — the composition mechanism is being redesigned. Until then, use
+the L1 primitives directly. See each L1 module's README for usage
+examples.
+
+## Compliance extension points
+
+The composition will need to wire compliance resources across L1s
+when the compliance milestone (GDPR, SOX, SOC2, HIPAA, DORA) lands:
+
+- **KMS key** — shared encryption key referenced by S3, ECR, CloudWatch Logs, and Secrets Manager.
+- **CloudTrail** — management-plane audit trail for the entire stack.
+- **VPC Flow Logs** — network audit trail.
+- **Security groups** — proper network segmentation between ALB, service, and data tiers.
+- **Private subnets** — ECS tasks in private subnets with NAT egress.
+
+See each L1 module's README for per-module compliance extension points.
+
+## Versioning
+
+Versioning will be defined when the composition mechanism is
+redesigned.

modules-ir/l2/l2-static-asset/README.md

@@ -0,0 +1,51 @@
+# l2-static-asset — S3 static asset (composition being redesigned)
+
+> **Module kind:** L2 composition  |  **Version:** TBD  |  **Status:** Under redesign
+
+A composition that references the `l1-s3` primitive to deploy a single
+S3 bucket for static asset hosting.
+
+**The composition layer is being redesigned.** The previous
+thin-composition implementation (a `composition.json` with children +
+wires) has been removed. A new composition mechanism will be designed
+in a later phase.
+
+## Resources
+
+TBD — the composition will reference this L1 primitive:
+
+| L1 module | Purpose | README |
+|-----------|---------|--------|
+| `l1-s3` | S3 bucket | [README](../l1/l1-s3/README.md) |
+
+## Inputs
+
+TBD — will be defined when the composition mechanism is redesigned.
+
+## Outputs
+
+TBD — will be defined when the composition mechanism is redesigned.
+
+## Usage
+
+TBD — the composition mechanism is being redesigned. Until then, use
+`l1-s3` directly. See the [l1-s3 README](../l1/l1-s3/README.md) for a
+usage example.
+
+## Compliance extension points
+
+The composition will need to wire compliance resources when the
+compliance milestone (GDPR, SOX, SOC2, HIPAA, DORA) lands:
+
+- **KMS key** — shared encryption key for S3 SSE.
+- **S3 access logs** — access logging to a separate audit bucket.
+- **Object Lock** — 7-year immutable retention for evidence.
+- **Public access block** — prevent data exfiltration.
+
+See the [l1-s3 README](../l1/l1-s3/README.md) for per-module compliance
+extension points.
+
+## Versioning
+
+Versioning will be defined when the composition mechanism is
+redesigned.

modules-ir/registry.json

@@ -0,0 +1,51 @@
+{
+  "l1-s3": {
+    "1.0.0": {
+      "interface": "modules-ir/l1/l1-s3/interface.json",
+      "published_at": "2026-07-21T19:00:00Z",
+      "deprecated": false
+    }
+  },
+  "l1-vpc": {
+    "1.0.0": {
+      "interface": "modules-ir/l1/l1-vpc/interface.json",
+      "published_at": "2026-07-21T21:30:00Z",
+      "deprecated": false
+    }
+  },
+  "l1-ecs-cluster": {
+    "1.0.0": {
+      "interface": "modules-ir/l1/l1-ecs-cluster/interface.json",
+      "published_at": "2026-07-21T21:30:00Z",
+      "deprecated": false
+    }
+  },
+  "l1-ecs-service": {
+    "1.0.0": {
+      "interface": "modules-ir/l1/l1-ecs-service/interface.json",
+      "published_at": "2026-07-21T21:30:00Z",
+      "deprecated": false
+    }
+  },
+  "l1-iam-role": {
+    "1.0.0": {
+      "interface": "modules-ir/l1/l1-iam-role/interface.json",
+      "published_at": "2026-07-21T21:30:00Z",
+      "deprecated": false
+    }
+  },
+  "l1-alb": {
+    "1.0.0": {
+      "interface": "modules-ir/l1/l1-alb/interface.json",
+      "published_at": "2026-07-21T21:30:00Z",
+      "deprecated": false
+    }
+  },
+  "l1-ecr": {
+    "1.0.0": {
+      "interface": "modules-ir/l1/l1-ecr/interface.json",
+      "published_at": "2026-07-21T21:30:00Z",
+      "deprecated": false
+    }
+  }
+}

pipelines/ci.yaml

@@ -0,0 +1,49 @@
+# ACDL Central Pipeline Contract (v1.4)
+#
+# This is the single source of truth for the CI/CD pipeline. Both
+# .gitea/workflows/ci.yml (Gitea Actions, dev) and
+# .github/workflows/ci.yml (GitHub Actions, production) implement the
+# stages, commands, triggers, and runner declared here.
+# scripts/run_ci.sh mirrors the same stages for shell reproducibility.
+#
+# A test (tests/test_pipeline_contract.py) validates that both workflow
+# YAMLs conform to this contract and that run_ci.sh runs the same commands.
+#
+# The contract does NOT replace workflow YAML syntax — it declares the
+# *intent* that the forge-specific workflows implement. The workflow files
+# use Gitea/GitHub Actions syntax (checkout, setup-python, run blocks);
+# this contract declares what those blocks must contain.
+#
+# Validated against schemas/pipeline.schema.json.
+
+name: acdl-ci
+environment: dev
+triggers:
+  push: [main]
+  pull_request: [main]
+runner: ubuntu-latest
+python_version: "3.12"
+
+stages:
+  - name: lint
+    description: Compile all Python files (py_compile)
+    command: |
+      python3 -m py_compile \
+        acdl_platform/confidence_signal.py \
+        acdl_platform/outbox_writer.py \
+        adapters/terraform/adapter.py \
+        adapters/terraform/policy/checkov_adapter.py \
+        scripts/push_consumer_image.py
+    required: true
+
+  - name: test
+    description: Run the pytest test suite offline
+    command: python3 -m pytest tests/ -v --tb=short
+    install: pip install -r requirements-test.txt
+    required: true
+
+  - name: check-only
+    description: Run the platform pipeline offline (no AWS/Checkov/DynamoDB)
+    command: bash scripts/run_platform.sh --check-only
+    install: pip install jsonschema pyyaml boto3
+    required: true

pyproject.toml

@@ -0,0 +1,34 @@
+[project]
+name = "acdl"
+version = "1.3.0"
+description = "Agentic Cloud Delivery Platform — consumers declare intent; the platform delivers safe production deployment."
+requires-python = ">=3.10"
+dependencies = [
+    "boto3>=1.34",
+    "jsonschema>=4.20",
+    "pyyaml>=6.0",
+]
+
+[project.optional-dependencies]
+test = [
+    "pytest>=8.0",
+    "pytest-cov>=4.0",
+    "moto[dynamodb]>=5.0",
+]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+markers = [
+    "offline: tests that run without AWS/Checkov/DynamoDB",
+]
+addopts = "-v --tb=short"
+filterwarnings = [
+    "ignore::DeprecationWarning:botocore.*",
+]
+
+[tool.coverage]
+run.source = ["acdl_platform", "adapters"]
+
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.backends._legacy:_Backend"

requirements-test.txt

@@ -0,0 +1,6 @@
+pytest>=8.0
+pytest-cov>=4.0
+moto[dynamodb]>=5.0
+jsonschema>=4.20
+pyyaml>=6.0
+boto3>=1.34

schemas/ir.schema.json

@@ -0,0 +1,118 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://acdl.cloudinit.dev/schemas/ir.schema.json",
+  "title": "ACDL Target Stack IR",
+  "description": "Substrate-neutral description of a target stack: resources with typed inputs/outputs/NFRs, relationships (single parent per child), composition tree (max depth 5), and policy hooks. The L1 registry, L2 thin-composition tree, contract YML, and PolicyCheckResult schema are all defined against this IR. Substrate adapters (the Terraform adapter in v1) are the only substrate-specific code.",
+  "$comment": "v1 ships one adapter (Terraform). The IR is nearly isomorphic to Terraform in v1 (ARCHITECTURE.md §12.1); the adapter compiles resource.module -> module block, resource.inputs -> variable + arg, resource.outputs -> output, relationship.kind=uses_output -> interpolation, relationship.kind=parent -> composition ordering hint. As more adapters appear (v2+), the IR gains expressiveness; the L1 content + contract YML + thin-composition tree do not change. The schema body is substrate-agnostic: no Terraform block keywords (variable/output/resource as blocks) and no aws_ provider prefixes in the schema keywords; type values are IR types (aws:s3:bucket), not Terraform resource types (aws_s3_bucket).",
+  "type": "object",
+  "required": ["version", "stack", "resources"],
+  "properties": {
+    "version": {
+      "type": "string",
+      "description": "IR schema version (semver).",
+      "pattern": "^\\d+\\.\\d+\\.\\d+$"
+    },
+    "stack": {
+      "type": "object",
+      "description": "The L1/L2 stack identity this IR represents.",
+      "required": ["name", "kind", "depth"],
+      "properties": {
+        "name": {
+          "type": "string",
+          "pattern": "^l[12]-[a-z][a-z0-9-]*$",
+          "description": "Stack name matching the L1/L2 folder name."
+        },
+        "kind": {
+          "type": "string",
+          "enum": ["l1", "l2"],
+          "description": "l1 = primitive; l2 = thin-composition."
+        },
+        "depth": {
+          "type": "integer",
+          "minimum": 1,
+          "maximum": 5,
+          "description": "Composition depth (ARCHITECTURE.md §3: max depth 5). L2->L1 is depth 1."
+        }
+      }
+    },
+    "resources": {
+      "type": "array",
+      "minItems": 1,
+      "items": {"$ref": "#/$defs/resource"}
+    },
+    "relationships": {
+      "type": "array",
+      "description": "Optional in v1; present when the adapter needs explicit ordering/output wiring hints beyond parent composition.",
+      "items": {"$ref": "#/$defs/relationship"}
+    }
+  },
+  "$defs": {
+    "resource": {
+      "type": "object",
+      "required": ["id", "type", "module", "inputs"],
+      "properties": {
+        "id": {
+          "type": "string",
+          "pattern": "^[a-z][a-z0-9-]*$",
+          "description": "Local IR resource id (unique within the stack)."
+        },
+        "type": {
+          "type": "string",
+          "description": "IR-typed resource identifier (substrate-agnostic), e.g. 'aws:s3:bucket'. NOT a Terraform resource type ('aws_s3_bucket'); the adapter translates IR type -> substrate type."
+        },
+        "module": {
+          "type": "string",
+          "pattern": "^l1-[a-z][a-z0-9-]*@\\d+\\.\\d+\\.\\d+$",
+          "description": "L1 registry reference: name@semver (W3.D). MAJOR bumps require a new registry entry (immutable publication); old entry enters a 12-month deprecation window."
+        },
+        "parent": {
+          "type": "string",
+          "description": "Parent resource id. Absent for the root. Single parent per child (ARCHITECTURE.md §12.1)."
+        },
+        "inputs": {
+          "type": "object",
+          "description": "Input values keyed by the L1 module's declared inputs. Free-form in v1 (validated at contract->IR resolution against the L1 registry); typed per-L1 in v1.2.",
+          "additionalProperties": {"type": ["string", "number", "boolean"]}
+        },
+        "outputs": {
+          "type": "object",
+          "description": "Typed output contract. The adapter translates this to a substrate output block (e.g. Terraform output).",
+          "additionalProperties": {"$ref": "#/$defs/outputSpec"}
+        },
+        "nfrs": {
+          "type": "object",
+          "description": "Declared non-functional requirements (latency, throughput, error rate). Opaque to the adapter; consumed by the confidence signal's NFR input.",
+          "additionalProperties": true
+        }
+      }
+    },
+    "outputSpec": {
+      "type": "object",
+      "required": ["type"],
+      "properties": {
+        "type": {
+          "type": "string",
+          "description": "IR-typed output type: a primitive ('string', 'arn') or a reference ('ref:<resourceId>.<outputName>')."
+        },
+        "description": {"type": "string"}
+      }
+    },
+    "relationship": {
+      "type": "object",
+      "required": ["from", "to", "kind"],
+      "properties": {
+        "from": {"type": "string", "description": "Source resource id."},
+        "to": {"type": "string", "description": "Target resource id."},
+        "kind": {
+          "type": "string",
+          "enum": ["parent", "depends_on", "uses_output"],
+          "description": "v1 uses 'parent' (composition ordering) + 'uses_output' (interpolation). 'depends_on' is reserved for v2 explicit-dependency cases."
+        },
+        "shared_keyword": {
+          "type": "string",
+          "description": "Reserved for v2 multi-relationship dependencies. Unused in v1."
+        }
+      }
+    }
+  }
+}