feat(P19): central pipeline contract + shell reproducibility + output streaming (v1.4.1)

---ci---
project: acdl
phase: 19
milestone: v1.4
status: execute
---

Add declarative pipeline contract (schemas/pipeline.schema.json +
pipelines/ci.yaml) as single source of truth for both Gitea Actions (dev)
and GitHub Actions (production) workflows. Both workflow files are
byte-identical and validated against the contract by 32 new tests.

Add scripts/run_ci.sh for shell reproducibility — mirrors the CI pipeline
locally (lint → test → check-only), exits 0 with 'CI PIPELINE OK'.

Update scripts/run_platform.sh to stream output by default: terraform
init/validate/plan via tee, Checkov compliance results with per-record
severity/rule/pass-fail, and emitted Terraform in --check-only. New
--quiet flag for log-only mode.

Requirements: REQ-43 (central pipeline contract), REQ-44 (shell
reproducibility), REQ-45 (output streaming). 122 tests pass (90 + 32).

.ciagent/ARCHITECTURE.md

@@ -298,4 +298,81 @@ ACDL has no `package.json`. The verification gate substitutes:
 3. Phase 08 — AWS OIDC bootstrap (use temp key once, rotate).
 4. Phase 09 — IR + `l1-s3` + Terraform adapter → `terraform plan`.
 5. Phase 10 — `l2-static-asset` + contract→IR → end-to-end spike.
-6. COMPLETE gate — review → ship `v1.2.0` → audit.
+6. COMPLETE gate — review → ship `v1.2.0` → audit. **DONE.**
+
+## v1.2 build-out scope
+
+v1.2 takes the v1.1 spike (dev-only, `plan`-only, single S3 L1) to a real,
+simpler, better-documented platform that delivers a microservice to AWS ECS
+Fargate end-to-end. The locked architecture (§1–§12) is unchanged — v1.2
+extends the *implementation*, not the design.
+
+### In scope (five axes, user-directed 2026-07-21)
+
+1. **Re-evaluate the current state.** go-gitea/gitea#36988 (OIDC for Gitea
+   Actions) re-checked 2026-07-21: still **open** (last updated 2026-05-27,
+   not merged). Real OIDC remains deferred to v1.3+; v1.2 extends the D-039
+   per-run-rotated-key waiver as **D-047**. The waiver continues to satisfy
+   §12.5's *intent* (no *persistently* long-lived key): the spike key is
+   rotated after each run by `scripts/rotate_spike_key.sh`, and Phase 12
+   tightens the IAM scoping + rotation hygiene.
+2. **NFR improvements on the existing spike.** Least-privilege IAM audit of
+   `spike_runner_policy.json`; idempotent `create_state_backend.py` /
+   `create_iam_user.py`; proper exit codes / error handling; P1-1 redaction
+   (two AWS access key IDs in `.ciagent/VERIFY.md` Phase 09 narrative).
+3. **Streamline / simplify the current setup.** Consolidate
+   `run_spike_plan.sh` + `run_spike_e2e.sh` into one
+   `scripts/run_platform.sh`; remove dead code and stale `platform/` paths.
+4. **README.md fully up to date on how the platform works.** Reflect v1.1
+   complete; document the actual spike flow, `scripts/run_platform.sh`, the
+   real repo layout, and the v1.2 objective.
+5. **Bootstrap a consumer repo with a basic microservice deployed to ECS
+   end-to-end.** New Gitea repo `acdl-consumer-microservice` (org
+   `continuous-intelligence`); new IR-typed L1s (`l1-vpc`, `l1-ecs-cluster`,
+   `l1-ecs-service`, `l1-iam-role`, `l1-alb`, `l1-ecr`); new
+   `l2-microservice` thin-composition; one contract submission →
+   `terraform apply` (dev, autonomous per §10, confidence ≥ 0.50) → a live
+   ECS Fargate service serving HTTP 200 → evidence event to the DynamoDB
+   outbox → acdl-evidence timeline.
+
+### Substrate extension (ECS Fargate)
+
+The Terraform adapter (§12) remains the only substrate-specific code. v1.2
+expands the adapter `TYPE_MAP` to cover the six new ECS-shaped IR resource
+types. The L1 interface shape (IR-typed inputs/outputs/NFRs, registered in
+`modules-ir/registry.json`) is unchanged — only the set of registered L1s
+grows. The IR commitments (REQ-28) continue to hold: `modules-ir/`,
+`schemas/`, `contracts/`, `acdl_platform/confidence_signal.py`,
+`acdl_platform/contract_resolver.py`, `acdl_platform/outbox_writer.py`
+remain substrate-agnostic.
+
+### `terraform apply` (dev only)
+
+v1.2 lifts the substrate execution from `plan` to `apply` for the `dev`
+environment only. Dev is autonomous per §10 (confidence ≥ 0.50, no HITL).
+`apply` for qa/prod/dr remains HITL-gated and out of scope for v1.2. The
+apply result (resources created, plan diff) is captured in the evidence
+stream as a `terraform.apply` event.
+
+### Out of scope for v1.2 (deferred to v1.3+)
+
+| Feature | Reason |
+|---------|--------|
+| Real OIDC federation | go-gitea/gitea#36988 still open. v1.2 extends D-039 waiver (D-047); real OIDC is v1.3+. |
+| Full HITL matrix wiring (qa/prod/dr) | v1.2 is dev-only autonomous `apply`; HITL wiring is v1.3. |
+| Kyverno + OPA policy engines | v1.2 keeps Checkov only; Kyverno/OPA are v1.3. |
+| MCP skill catalog + real L3B agent | v1.2 keeps the L3B stub; the 5-skill catalog is v1.3. |
+| Audit ledger build-out (S3 Object Lock + JWS + async worker + DLQ + daily checkpoints) | v1.2 keeps the v1.1 outbox; the regulatory ledger is v1.3. |
+| Multi-region state / outbox | Single-region in v1 (§9, §12.3); multi-region is v1.3+. |
+| Prod/dr environments | v1.2 is dev-only; prod/dr are v1.3. |
+| GitOps reconciler (ArgoCD/Flux) | v1.3+. |
+
+## Build order (v1.2)
+
+1. Phase 11 — re-eval #36988 + NFR audit + simplification findings + README rewrite.
+2. Phase 12 — NFR harden + simplify (idempotent bootstrap, one `run_platform.sh`, IAM audit, redactions).
+3. Phase 13 — six ECS L1s + adapter `TYPE_MAP` expansion.
+4. Phase 14 — `l2-microservice` + contract schema extension.
+5. Phase 15 — consumer repo + `terraform apply` (dev) → live ECS service.
+6. Phase 16 — capstone e2e: consumer commit → live HTTP 200 → evidence → timeline.
+7. COMPLETE gate — review → ship `v1.3.0` → audit.

.ciagent/AUDIT.md

@@ -0,0 +1,43 @@
+# Phase 18 — Audit (v1.3.2)
+
+**Date:** 2026-07-22
+**Phase:** 18 — testing-and-cicd-pipelines
+**Milestone:** v1.3 (active, NFR)
+**Tag:** v1.3.2
+
+## 1. Reconstruction Test
+
+Git log (2 commits for phase 18) matches `.ciagent/` files:
+
+| Commit | Status | .ciagent match |
+|--------|--------|----------------|
+| 1598c54 | verify | VERIFY.md updated, ROADMAP/REQUIREMENTS marked complete |
+| (specify was done in prior commit ae86a29 for phase 17) | | |
+
+ROADMAP.md has Phase 18 with `Status: complete (v1.3.2)`.
+REQUIREMENTS.md has REQ-39, REQ-40, REQ-41, REQ-42 marked `complete (v1.3.2)`.
+VERIFY.md has `VERIFY PASS` verdict.
+Tag `v1.3.2` exists. **PASS.**
+
+## 2. File Discipline
+
+Working tree clean. All new files present (pyproject.toml,
+requirements-test.txt, 7 test files, 2 workflow YAMLs). Modified files
+(run_platform.sh, README.md, terraform/spike/terraform.tf) are expected.
+**PASS.**
+
+## 3. Branch Hygiene
+
+On `main`, no stale phase branches. `milestone/v1.0-initial` is
+historical. **PASS.**
+
+## 4. Commit Discipline
+
+All phase-18 commits have `---ci---` blocks with correct closing
+`---/ci---` tag. Tag `v1.3.2` follows NFR patch versioning (v1.3.1 →
+v1.3.2). **PASS.**
+
+## Verdict
+
+**AUDIT CLEAN** — reconstruction, file discipline, branch hygiene, and
+commit discipline all pass. No critical issues.

.ciagent/PERSONAS.md

@@ -4,7 +4,7 @@ milestone: v1.1
 generated_at: 2026-07-21
 generator: lead-developer
 verification_toolchain:
-  typecheck: "terraform validate && python3 -m py_compile platform/**/*.py && python3 -m jsonschema schemas/*.schema.json"
+  typecheck: "terraform validate && python3 -m py_compile acdl_platform/**/*.py && python3 -m jsonschema schemas/*.schema.json"
   test: "scripts/verify_phaseNN.sh"
   build: "terraform init"
   note: |
@@ -35,7 +35,7 @@ verification_toolchain:
 - **Phase-specific:** false
 - **Frameworks:** python, json-schema, gitea-actions, act_runner, bash, yaml
 - **Constraints:** contract-schema-first, fail-fast-with-reason-codes, no-long-lived-credentials, severity-to-penalty-mapping-immutable
-- **Territory:** `platform/confidence_signal.py`, `platform/contract_resolver.py`, `platform/outbox/**`, `schemas/**` (contract + IR + PolicyCheckResult), `contracts/**` (sample contracts), `.gitea/workflows/**` (pipeline)
+- **Territory:** `acdl_platform/confidence_signal.py`, `acdl_platform/contract_resolver.py`, `acdl_platform/outbox_writer.py`, `schemas/**` (contract + IR + PolicyCheckResult), `contracts/**` (sample contracts), `.gitea/workflows/**` (pipeline)
 - **Reason:** Owns the contract schema, contract→IR resolution, the confidence signal (6 inputs + severity mapping), the DynamoDB outbox writer, and the central pipeline workflow.
 
 ### platform-engineer (custom)
@@ -44,7 +44,7 @@ verification_toolchain:
 - **Phase-specific:** false
 - **Frameworks:** terraform, aws-iam, aws-s3, aws-dynamodb, oidc, json-schema
 - **Constraints:** ir-is-substrate-agnostic, adapter-is-only-substrate-specific-code, state-in-s3+dynamodb-single-region, oidc-only-no-long-lived-keys (waiver D-034 for bootstrap), terraform-plan-only-in-spike
-- **Territory:** `adapters/terraform/**`, `modules-ir/**`, `terraform/**` (state backend, provider config), `platform/registry/**`
+- **Territory:** `adapters/terraform/**`, `modules-ir/**`, `terraform/**` (state backend, provider config), `modules-ir/registry.json`
 - **Reason:** Owns the Target Stack IR, the L1/L2 IR-typed modules, the Terraform adapter, the AWS OIDC bootstrap, and the state backend. The IR is substrate-agnostic; the adapter is the only substrate-specific code (the binding constraint per §12).
 
 ### security-engineer (custom)
@@ -53,7 +53,7 @@ verification_toolchain:
 - **Phase-specific:** false
 - **Frameworks:** aws-iam, oidc, checkov, json-schema
 - **Constraints:** least-privilege, separation-of-duties-identity-distinctness, no-secrets-in-skill-markdown, audit-chain-extends-not-tears-up, critical-finding-hard-overrides-confidence
-- **Territory:** `platform/hitl_matrix_design.md`, `platform/audit_ledger_design.md`, `adapters/terraform/policy/**` (Checkov adapter → PolicyCheckResult), `platform/separation_of_duties.py`
+- **Territory:** `acdl_platform/hitl_matrix_design.md`, `acdl_platform/audit_ledger_design.md`, `adapters/terraform/policy/**` (Checkov adapter → PolicyCheckResult), `acdl_platform/separation_of_duties.py`
 - **Reason:** Owns the HITL matrix design, separation-of-duties (DynamoDB identity-distinctness), the audit ledger design (S3 Object Lock + JWS + chain), and the Checkov→PolicyCheckResult adapter. Enforces the "Safety is Computed, Not Assumed" + "Audit truth lives outside the repository" vision tenets.
 
 ### frontend-engineer
@@ -77,7 +77,7 @@ verification_toolchain:
 ### data-engineer
 - **Domain:** data
 - **Active:** false
-- **Reason:** No ORM/persistence framework. The v1.1 outbox is DynamoDB but accessed via boto3 calls inside `platform/outbox/**` (owned by backend-engineer); the audit ledger is S3 Object Lock + JWS (owned by security-engineer). No schema-migration layer, no ORM, no data-engineer territory.
+- **Reason:** No ORM/persistence framework. The v1.1 outbox is DynamoDB but accessed via boto3 calls inside `acdl_platform/outbox_writer.py` (owned by backend-engineer); the audit ledger is S3 Object Lock + JWS (owned by security-engineer). No schema-migration layer, no ORM, no data-engineer territory.
 - **Phase-specific:** false
 - **Frameworks:** (would have been: drizzle, prisma)
 - **Constraints:** (would have been: schema-first, type-safe-orm)
@@ -106,7 +106,7 @@ being right before backend wiring.
 ## Conflict resolutions (lead-developer arbitration)
 
 - `backend-engineer` vs `platform-engineer` over `schemas/ir.schema.json`: platform-engineer owns the IR (it is substrate-agnostic but infra-shaped); backend-engineer owns the contract schema and the contract→IR resolution (contract is the consumer surface). Co-authoring is expected; conflict goes to lead-developer.
-- `backend-engineer` vs `security-engineer` over `platform/confidence_signal.py`: security-engineer owns the severity→penalty mapping + critical-override semantics; backend-engineer owns the 6-input weighted sum + per-env thresholds. The confidence signal is co-owned; conflicts go to lead-developer.
+- `backend-engineer` vs `security-engineer` over `acdl_platform/confidence_signal.py`: security-engineer owns the severity→penalty mapping + critical-override semantics; backend-engineer owns the 6-input weighted sum + per-env thresholds. The confidence signal is co-owned; conflicts go to lead-developer.
 - `platform-engineer` vs `security-engineer` over `adapters/terraform/policy/**`: security-engineer owns the Checkov→PolicyCheckResult adapter (policy is a security concern); platform-engineer owns the Terraform adapter (substrate translation). No overlap.
 - `lead-developer` vs any: lead-developer owns `.ciagent/**` + `docs/**` meta + verification scripts; persona engineers do not edit CIAgent metadata or the vision/architecture source docs.
 

.ciagent/PROJECT.md

@@ -50,7 +50,7 @@ traceable to a human attestation and an immutable evidence stream.
   boundary. The platform validates, enriches with operational standards,
   and reconciles the target state.
 
-## Objective for Milestone v1.1
+## Objective for Milestone v1.1 (prior — complete, tag `v1.2.0`)
 
 Finalize the architecture to v1.0 (resolve all 11 open design decisions in
 `docs/architecture.md` §13) and prove the locked commitments with one
@@ -67,7 +67,11 @@ end-to-end v1 implementation spike:
 The spike validates the architecture's claim that the IR-shaped commitments
 do not require a polyglot mess (`docs/architecture.md` §14, step 2).
 
-## Milestone v1.1 Phases
+**Status: COMPLETE — all 5 phases shipped (v1.1.1..v1.1.5) + verified; review
+READY TO SHIP (0 P0); audit CLEAN; milestone tag `v1.2.0`; Gitea release
+id 202 published. D-034 closed (root key deactivated by user).**
+
+## Milestone v1.1 Phases (prior — complete)
 
 | Phase | Name | Goal |
 |-------|------|------|
@@ -78,7 +82,90 @@ do not require a polyglot mess (`docs/architecture.md` §14, step 2).
 | 10 | v1-spike-l2-and-contract-e2e | One L2 thin-composition (`l2-static-asset`) referencing `l1-s3`; contract schema + contract→IR resolution; one end-to-end contract submission → `terraform plan` → Checkov → confidence signal → evidence event to outbox. Verify the IR commitments hold. |
 
 Milestone COMPLETE gate: review → ship `v1.2.0` (feature milestone, next
-minor per ship.md) → audit.
+minor per ship.md) → audit. **DONE.**
+
+## Objective for Milestone v1.2 (prior — complete)
+
+Platform hardening + first real consumer deployment. The v1.1 spike proved
+the IR commitments hold on a single dev-only `terraform plan` for one S3
+bucket. v1.2 takes the spike to a real, simpler, better-documented platform
+that actually delivers a microservice to AWS ECS Fargate end-to-end.
+
+Five scope axes (user-directed, 2026-07-21):
+
+1. **Re-evaluate the current state.** Confirm go-gitea/gitea#36988 (OIDC for
+   Gitea Actions) is still unmerged (re-checked 2026-07-21: **open**, last
+   updated 2026-05-27). Extend the D-039 per-run-rotated-key waiver for
+   v1.2; real OIDC is deferred to v1.3+ (D-047).
+2. **NFR improvements on the existing spike.** Least-privilege IAM audit,
+   idempotent bootstrap, proper exit codes / error handling, rotation
+   hygiene, P1-1 / P1-B redaction carried forward from the v1.1 audit.
+3. **Streamline / simplify the current setup.** Consolidate the
+   `run_spike_*.sh` scripts into one `scripts/run_platform.sh`; remove
+   dead code and stale paths; one command runs the whole pipeline.
+4. **README.md fully up to date on how the platform works.** The current
+   README still says "v1.1 (active)" — it must reflect v1.1 complete, the
+   actual spike flow, how to run it, the real repo layout, and the v1.2
+   objective.
+5. **Bootstrap a consumer repo with a basic microservice deployed to ECS
+   end-to-end.** New Gitea repo `acdl-consumer-microservice` (org
+   `continuous-intelligence`) holding a tiny HTTP container + Dockerfile;
+   new IR-typed L1s (`l1-vpc`, `l1-ecs-cluster`, `l1-ecs-service`,
+   `l1-iam-role`, `l1-alb`, `l1-ecr`); new `l2-microservice`
+   thin-composition; one contract submission → `terraform apply` (dev,
+   autonomous) → a live ECS Fargate service serving HTTP 200 → evidence
+   event to the DynamoDB outbox → acdl-evidence timeline.
+
+The milestone proves the platform delivers real value (a running
+microservice), not just a plan.
+
+## Milestone v1.2 Phases
+
+| Phase | Name | Goal |
+|-------|------|------|
+| 11 | v1.2-research-and-readme | Re-eval #36988 (confirm open → extend D-039 as D-047). Audit the v1.1 spike for NFR gaps (least-privilege, idempotency, error handling, rotation hygiene) + simplification opportunities. **Rewrite README.md** to reflect v1.1 complete + how the platform actually works (spike flow, how to run, repo layout, v1.2 objective). Output: RESEARCH.md v1.2 addendum; updated README. |
+| 12 | nfr-harden-and-simplify | Apply Phase 11 findings: tighten `spike_runner_policy.json` (least-privilege audit); make `terraform/bootstrap/create_*.py` idempotent; consolidate `run_spike_*.sh` → one `scripts/run_platform.sh`; proper exit codes / error handling; redact P1-1 AWS key IDs in `VERIFY.md`; fix any remaining stale `platform/` paths. Spike still runs e2e after the refactor. |
+| 13 | l1-catalog-for-ecs | Author IR-typed L1s for an ECS Fargate microservice: `l1-vpc`, `l1-ecs-cluster`, `l1-ecs-service`, `l1-iam-role` (task + exec role), `l1-alb`, `l1-ecr`. Register all in `modules-ir/registry.json`. Expand the Terraform adapter `TYPE_MAP`. Each L1 produces a valid `terraform plan` fragment. |
+| 14 | l2-microservice-and-contract-schema | Author `l2-microservice` thin-composition (references the ECS L1s, depth ≤ 5). Extend `schemas/contract.schema.json` for microservice inputs (image, port, env, healthcheck). Verify contract→IR resolution yields a complete target stack. |
+| 15 | consumer-repo-and-terraform-apply | Create consumer repo `acdl-consumer-microservice` (Gitea org) with a basic microservice (tiny HTTP container + Dockerfile + ECR push). Lift the platform from `plan` → **`apply`** (dev, autonomous per §10). Submit `contracts/microservice.yaml` → pipeline → IR → plan → apply → a real ECS Fargate service running. |
+| 16 | v1.2-capstone-e2e | End-to-end verification: consumer commit → pipeline → ECS service live serving HTTP 200 → evidence event to the DynamoDB outbox → acdl-evidence timeline renders it. Verify NFR improvements hold, the setup is simpler (one `run_platform.sh`), and the README is accurate. |
+
+Milestone COMPLETE gate: review → ship `v1.3.0` (feature milestone, next
+minor per ship.md — v1.1 shipped `v1.2.0`) → audit.
+
+## Objective for Milestone v1.4 (active)
+
+Central pipeline contract + shell reproducibility + output streaming. The
+v1.3 milestone (Phases 17–18) created identical CI/CD pipelines for Gitea
+and GitHub but they were duplicated copies with no single source of truth.
+v1.4 makes the pipeline a declarative contract, enables full shell
+reproducibility, and streams terraform/checkov output so users can see
+what the platform is doing.
+
+Three scope axes:
+
+1. **Central pipeline contract.** A JSON Schema
+   (`schemas/pipeline.schema.json`) + YAML instance (`pipelines/ci.yaml`)
+   declares the pipeline stages, commands, triggers, and runner. Both
+   `.gitea/workflows/ci.yml` (Gitea Actions, dev) and
+   `.github/workflows/ci.yml` (GitHub Actions, production) implement the
+   contract. A test validates conformance.
+2. **Shell reproducibility.** `scripts/run_ci.sh` mirrors the CI pipeline
+   locally — runs the same 3 stages (lint, test, check-only) in sequence.
+   The pipeline is fully reproducible from the shell, not just in CI.
+3. **Output streaming.** `scripts/run_platform.sh` streams terraform
+   init/validate/plan output, Checkov compliance results, and
+   PolicyCheckResult records to stdout by default, so the user sees what
+   is happening. A `--quiet` flag suppresses streaming for log-only mode.
+
+## Milestone v1.4 Phases
+
+| Phase | Name | Goal |
+|-------|------|------|
+| 19 | central-pipeline-contract-and-shell-reproducibility | Create the central pipeline contract (JSON Schema + YAML instance). Create `scripts/run_ci.sh` for shell reproducibility. Update `run_platform.sh` to stream terraform/checkov output. Update both workflow YAMLs with contract references (staying byte-identical). Add tests for contract validation, workflow conformance, and streaming. |
+
+Milestone COMPLETE gate: review → ship `v1.4.1` (feature milestone, next
+minor per ship.md — v1.3 shipped `v1.3.2`) → audit.
 
 ## Requirements
 
@@ -88,9 +175,9 @@ Status: complete. Tag `v1.1.0`. All REQ-01..15 satisfied by the stub-driven
 executive demo. See `REQUIREMENTS.md` §v1 and the prior decisions table
 appendix below. The demo is **archived** to `demo/` in Phase 06.
 
-### v1.1 (Active milestone — architecture finalization + v1 spike)
+### v1.1 (Prior milestone — architecture finalization + v1 spike, complete)
 
-New requirements REQ-16..REQ-2x — see `REQUIREMENTS.md` §v1.1. Summary:
+New requirements REQ-16..REQ-28 — see `REQUIREMENTS.md` §v1.1. Summary:
 
 - **REQ-16:** Architecture finalized to v1.0 (11 open decisions resolved).
 - **REQ-17:** Target Stack IR defined as JSON Schema; substrate-agnostic.
@@ -115,6 +202,39 @@ New requirements REQ-16..REQ-2x — see `REQUIREMENTS.md` §v1.1. Summary:
 - **REQ-28:** Spike verification proves the IR-shaped commitments hold (no
   polyglot mess; the adapter is the only substrate-specific code).
 
+### v1.2 (Prior milestone — platform hardening + first real consumer deployment, complete)
+
+New requirements REQ-29..REQ-35 — see `REQUIREMENTS.md` §v1.2. Summary:
+
+- **REQ-29:** README.md fully documents the v1.1-complete platform: spike
+  flow, how to run, repo layout, v1.2 objective.
+- **REQ-30:** NFR hardening — least-privilege IAM audit, idempotent
+  bootstrap, consolidated `run_platform.sh`, error handling, P1-1/P1-B
+  redaction.
+- **REQ-31:** L1 catalog expanded for ECS — 6 new IR-typed L1s
+  (`l1-vpc`, `l1-ecs-cluster`, `l1-ecs-service`, `l1-iam-role`, `l1-alb`,
+  `l1-ecr`) registered and adapter-compiled.
+- **REQ-32:** `l2-microservice` thin-composition + contract schema extended
+  for microservice inputs (image, port, env, healthcheck).
+- **REQ-33:** `terraform apply` (dev, autonomous) — real provisioning, not
+  just `plan`.
+- **REQ-34:** Consumer repo `acdl-consumer-microservice` with a basic
+  microservice (ECR image, Dockerfile, contract).
+- **REQ-35:** End-to-end verification — consumer commit → live ECS service
+  (HTTP 200) → evidence event → timeline.
+
+### v1.4 (Active milestone — central pipeline contract + shell reproducibility + streaming)
+
+New requirements REQ-43..REQ-45 — see `REQUIREMENTS.md` §v1.4. Summary:
+
+- **REQ-43:** Central pipeline contract — `schemas/pipeline.schema.json` +
+  `pipelines/ci.yaml`. Both Gitea and GitHub workflows implement the
+  contract; a test validates conformance.
+- **REQ-44:** `scripts/run_ci.sh` mirrors the CI pipeline locally (lint →
+  test → check-only), exiting 0 with "CI PIPELINE OK".
+- **REQ-45:** `scripts/run_platform.sh` streams terraform/checkov output by
+  default (with `--quiet` for log-only mode). Both workflows byte-identical.
+
 ## Constraints
 
 - **Forge:** Gitea at `https://git.cloudinit.dev`, org `continuous-intelligence`.
@@ -157,7 +277,7 @@ decisions:
 
 | ID | Decision | Rationale | Outcome |
 |----|----------|-----------|---------|
-| D-034 | Temporary long-lived AWS key (waiver) used once in Phase 08 to bootstrap OIDC trust; rotated immediately after | §12.5 forbids long-lived creds; OIDC needs one bootstrapping `aws iam` call before the runner can assume a role | Spike achieves real `terraform plan` against AWS without violating the locked target after bootstrap |
+| D-034 | Temporary long-lived AWS key (waiver) used once in Phase 08 to bootstrap the state backend + IAM user; rotated/deactivated immediately after | §12.5 forbids long-lived creds; the bootstrap needed one `aws iam` call before the spike user + rotated key could take over | Spike achieves real `terraform plan` against AWS without violating the locked target after bootstrap. **CLOSED 2026-07-21: root key `AKIA…ROOT-DEACTIVATED` deactivated by the user in the AWS IAM console (verified — `InvalidClientTokenId`); the spike uses the rotated `acdl-spike-runner` key per D-039. Key ID redacted in v1.2 Phase 12 (P1-1).** |
 | D-035 | Milestone version = `v1.1` (feature), ship tag `v1.2.0` | Real platform is a breaking reframing of the demo, but treated as the next incremental milestone per user choice; ship.md: feature milestone → next minor | Tag `v1.2.0` on milestone COMPLETE |
 | D-036 | Spike picks `l1-s3` + `l2-static-asset` | Simplest real AWS resource (no IAM/network deps); smallest real `terraform plan`; proves the IR + adapter end-to-end | Spike scope fixed |
 | D-037 | Demo archived to `demo/` (not deleted) | Preserves the working v1.0 demo as intent reference; new platform layout under `platform/`, `schemas/`, `adapters/`, `terraform/`, `modules-ir/` | No churn on demo code; clean separation |
@@ -170,6 +290,7 @@ decisions:
 | D-044 | DynamoDB outbox = `PAY_PER_REQUEST`; PK `contractId`, SK `eventType#eventTs`, TTL `expire_at` = now + 365d. No separate async worker/DLQ in the spike (RTO = workflow re-run); v1.2 outbox worker + DLQ is a Phase 07 design artifact. | On-demand is zero-cost-at-idle for the spike's single dev submission. | Spike outbox is minimal; v1.2 worker design authored in Phase 07 |
 | D-045 | Runner tooling: `runs-on: ubuntu-latest`; install `terraform` via HashiCorp apt repo (pin `1.9.*`), `checkov` via pip (pin `>=3.2,<4`, `--break-system-packages`). Neither is pre-installed on the default runner image. | RESEARCH TARGET 2; pinning avoids mid-spike version drift. | Phase 09/10 workflows have a concrete setup step |
 | D-046 | `act_runner` → `gitea-runner` rename: Phase 07 updates docs to use the current name `gitea-runner` (renamed 2026-04 in gitea/runner#850). | RESEARCH TARGET 1 + R-4: naming drift between v1.0 docs and the current runner. | Docs reflect the current binary name |
+| D-047 | v1.2 carries forward the D-039 per-run-rotated-key waiver. Real OIDC federation remains deferred to v1.3+, blocked on go-gitea/gitea#36988 (re-checked 2026-07-21: still **open**, last updated 2026-05-27, not merged). | §12.5 forbids long-lived creds; the Gitea Actions OIDC provider is still not merged. The waiver continues to satisfy §12.5's *intent* (no *persistently* long-lived key) for v1.2: `scripts/rotate_spike_key.sh` rotates the key, and Phase 12 tightens the IAM scoping + rotation hygiene. | v1.2 achieves `terraform apply` against AWS without a persistently long-lived key; real OIDC is a v1.3+ deliverable. |
 
 ### Open-decision resolutions (Phase 07 deliverable — recorded here for traceability)
 
@@ -213,7 +334,7 @@ sign-off (autonomy = full; all within locked constraints).
 | Spike `terraform` command | `plan` only | `apply` is out of scope (Out of Scope table); HITL-gated in v1.2 |
 | Checkov ruleset (spike) | the 4 L2 checks (secrets-in-plaintext, public ingress, IAM wildcard, KMS key reference) + tag/naming | §3 + §12.4; Kyverno/OPA deferred |
 | v1.0 tags preserved | `v1.0.1`..`v1.0.5`, `v1.1.0` retained | Immutability; demo archive does not rewrite history |
-| Next ship tag | `v1.2.0` | Feature milestone → next minor per ship.md (D-035) |
+| Next ship tag | `v1.3.0` | Feature milestone → next minor per ship.md (v1.1 shipped `v1.2.0`; v1.2 ships `v1.3.0`) |
 
 ### Items deferred to RESEARCH (not clarifications)
 

.ciagent/REQUIREMENTS.md

@@ -35,7 +35,7 @@
 
 (None — v1 covers the complete demo.)
 
-## v1.1 (Active milestone — architecture finalization + v1 spike)
+## v1.1 (Prior milestone — architecture finalization + v1 spike, complete)
 
 ### Category: Architecture Finalization
 - **REQ-16:** Architecture reaches v1.0 — all 11 open decisions in `docs/architecture.md` §13 are resolved and recorded in `PROJECT.md` (W1.A, W1.B, W2.A, W3.D, W3.E, BA.A–F, OpenTofu timing).
@@ -70,7 +70,57 @@
 | Prod/dr environments | v1.2. |
 | Terraform `apply` (real provisioning) | Spike runs `plan` only; `apply` is gated by HITL in v1.2. |
 
-## Clarifications (Phase 01, v1.0 — retained for history)
+## v1.2 (Prior milestone — platform hardening + first real consumer deployment, complete, tag `v1.3.0`)
+
+### Category: Documentation & Simplification
+- **REQ-29:** `README.md` is fully rewritten to reflect the v1.1-complete platform: the actual spike flow (contract → IR → `terraform plan` → Checkov → confidence signal → outbox), how to run it (`scripts/run_platform.sh`), the real repo layout (`acdl_platform/`, `schemas/`, `adapters/`, `terraform/`, `modules-ir/`, `contracts/`, `demo/`), and the v1.2 objective. No stale "v1.1 (active)" framing.
+- **REQ-30:** NFR hardening of the v1.1 spike: (a) `terraform/bootstrap/spike_runner_policy.json` audited to least-privilege (S3 + DynamoDB + ECS + ECR + ELB + IAM plan-only, no wildcards beyond the documented exceptions); (b) `create_state_backend.py` and `create_iam_user.py` are idempotent (re-running exits 0 without duplicating resources); (c) `run_spike_plan.sh` + `run_spike_e2e.sh` consolidated into a single `scripts/run_platform.sh` with proper exit codes and error handling; (d) P1-1 carried forward from the v1.1 audit — the two AWS access key IDs in `.ciagent/VERIFY.md` Phase 09 narrative are redacted to placeholders; (e) any remaining stale `platform/` paths in `.ciagent/` are corrected to `acdl_platform/`.
+
+### Category: L1 Catalog Expansion (ECS Fargate)
+- **REQ-31:** Six new IR-typed L1 modules exist under `modules-ir/l1/` and are registered in `modules-ir/registry.json`: `l1-vpc` (VPC + subnets + route tables), `l1-ecs-cluster` (ECS Fargate cluster), `l1-ecs-service` (ECS service + task definition), `l1-iam-role` (task execution + task role), `l1-alb` (application load balancer + listener + target group), `l1-ecr` (ECR repository). Each has an `interface.json` valid against `schemas/ir.schema.json` and produces a valid `terraform plan` fragment via the Terraform adapter. The adapter `TYPE_MAP` is expanded to cover all six IR resource types.
+
+### Category: L2 Composition & Contract Schema
+- **REQ-32:** `l2-microservice` thin-composition exists under `modules-ir/l2/l2-microservice/` referencing the six ECS L1s (depth ≤ 5, within max-depth-5). `schemas/contract.schema.json` is extended with microservice inputs (`image: string`, `port: integer`, `env: map`, `healthcheck: object`) and validates a `contracts/microservice.yaml` submission. Contract→IR resolution (`acdl_platform/contract_resolver.py`) yields a complete target stack for `l2-microservice`.
+
+### Category: Real Provisioning
+- **REQ-33:** The platform runs `terraform apply` (not just `plan`) for the `dev` environment, autonomous per §10 (confidence ≥ 0.50, no HITL). The apply creates real AWS resources (VPC, ECS cluster, ECR repo, ALB, ECS service) and the result is captured in the evidence stream. `apply` for qa/prod/dr remains HITL-gated and out of scope for v1.2.
+
+### Category: Consumer Repo
+- **REQ-34:** A new Gitea repo `acdl-consumer-microservice` exists under the `continuous-intelligence` org, containing: a basic HTTP microservice (e.g., a tiny Python/Go server returning 200), a `Dockerfile`, an ECR push step, and a `contracts/microservice.yaml` submission for `l2-microservice` (dev environment).
+
+### Category: End-to-End Verification
+- **REQ-35:** One end-to-end flow: consumer commit to `acdl-consumer-microservice` → pipeline triggered → contract→IR resolution → `terraform plan` → `terraform apply` (dev) → a live ECS Fargate service serving HTTP 200 on its ALB → evidence event written to the DynamoDB outbox → the event renders on the `acdl-evidence` timeline. `scripts/verify_phase16.sh` proves the full flow green.
+
+## v1.3 (Prior — module documentation + thin-composition removal, complete)
+
+### Category: Thin-Composition Removal
+- **REQ-36:** The L2 thin-composition layer is removed completely: `composition.json` files, `acdl_platform/contract_resolver.py`, `schemas/contract.schema.json`, `contracts/spike.yaml`, `contracts/microservice.yaml`, and L2 entries in `modules-ir/registry.json` are deleted. The L2 directories are kept as placeholders with READMEs. The downstream pipeline (adapter → checkov → confidence → outbox) is patched to load a pre-existing IR instance instead of resolving a contract.
+- **REQ-37:** A `modules-ir/README-TEMPLATE.md` exists that works for both L1 and L2 modules, written in plain language (no jargon), with sections for Overview, Resources, Inputs, Outputs, Usage, Compliance extension points, and Versioning.
+- **REQ-38:** Every module has a `README.md`: the 7 L1 modules have full READMEs with Resources/Inputs/Outputs/Usage/Compliance-extension-points/Versioning sections derived from their `interface.json`; the 2 L2 modules have placeholder READMEs noting the composition is under redesign. A `modules-ir/README.md` catalog index lists all modules with one-line descriptions and links.
+
+### Category: Testing
+- **REQ-39:** A pytest test suite exists under `tests/` covering the platform components offline (no AWS, no Checkov, no DynamoDB): the Terraform adapter (`adapters/terraform/adapter.py`), the confidence signal (`acdl_platform/confidence_signal.py`), the Checkov adapter (`adapters/terraform/policy/checkov_adapter.py`), and the outbox writer (`acdl_platform/outbox_writer.py`). The suite validates the IR schema, registry, spike_instance, and adapter output structure. `pyproject.toml` + `requirements-test.txt` pin test dependencies (pytest, jsonschema, pyyaml, boto3-stubs or moto for outbox mocking).
+
+### Category: Shell Reproducibility
+- **REQ-40:** `scripts/run_platform.sh` has a `--check-only` mode that runs offline: loads the pre-existing IR instance, runs the adapter to emit Terraform, validates the JSON structure — without AWS credentials, Checkov, or DynamoDB. The existing `--plan-only` and full modes continue to require AWS. The `--check-only` mode is what CI pipelines run.
+
+### Category: CI/CD Pipelines
+- **REQ-41:** Identical CI/CD pipelines exist for both Gitea Actions (`.gitea/workflows/ci.yml`, dev environment) and GitHub Actions (`.github/workflows/ci.yml`, production). Both run the same three stages: (1) lint — `py_compile` all Python files, (2) test — `pytest`, (3) check-only — `bash scripts/run_platform.sh --check-only`. Both trigger on push to main + pull request. Both use `ubuntu-latest`. Identical outcomes — the only difference is the runner environment.
+
+- **REQ-42:** `pyproject.toml` exists at the repo root with pytest configuration (testpaths, markers) and the project metadata. `requirements-test.txt` pins test-only dependencies separate from runtime dependencies.
+
+## v1.4 (Active — central pipeline contract + shell reproducibility + streaming)
+
+### Category: Central Pipeline Contract
+- **REQ-43:** A central pipeline contract exists as `schemas/pipeline.schema.json` (JSON Schema draft 2020-12) + `pipelines/ci.yaml` (YAML instance). The contract declares the pipeline name, triggers (push/PR branches), runner, Python version, and stages (name + command + required + install + description). Both `.gitea/workflows/ci.yml` (Gitea Actions, dev) and `.github/workflows/ci.yml` (GitHub Actions, production) implement the same stages, commands, triggers, and runner as declared in the contract. A test (`tests/test_pipeline_contract.py`) validates the contract against the schema and asserts both workflows conform (same jobs, same commands, same triggers, same runner, byte-identical).
+
+### Category: Shell Reproducibility
+- **REQ-44:** `scripts/run_ci.sh` reproduces the CI pipeline locally — runs the same 3 stages (lint, test, check-only) in sequence with proper exit codes, failing on first error. The script exits 0 with "CI PIPELINE OK" on success. A `--quiet` flag suppresses per-stage banners. The script mirrors the central pipeline contract (`pipelines/ci.yaml`) so the shell and CI environments produce identical outcomes.
+
+### Category: Pipeline Streaming
+- **REQ-45:** `scripts/run_platform.sh` streams output by default: terraform init/validate/plan output is piped to stdout via `tee` (visible to the user and logged), Checkov results are printed in human-readable form, and PolicyCheckResult records are displayed with severity, rule ID, and pass/fail status per record. The `--check-only` mode streams the emitted Terraform file content. A `--quiet` flag suppresses streaming (output to log files only) for backwards compatibility. Both gitea and github workflows are byte-identical (identical outcomes — the only difference is the forge runtime).
+
+## Out of Scope (v1.2)
 
 | REQ | Original criterion | Clarified criterion (effective) | Decision |
 |-----|--------------------|----------------------------------|----------|
@@ -110,7 +160,7 @@
 | REQ-14 | 5 | complete (v1.0.5) |
 | REQ-15 | 5 | complete (v1.0.5) |
 
-### v1.1 (active — architecture finalization + v1 spike)
+### v1.1 (prior — architecture finalization + v1 spike, complete)
 
 | Requirement | Phase | Status |
 |-------------|-------|--------|
@@ -122,8 +172,40 @@
 | REQ-21 | 07 | complete (v1.1.2) |
 | REQ-22 | 07 | complete (v1.1.2) |
 | REQ-23 | 08 | complete (v1.1.3) |
-| REQ-24 | 09 | pending |
-| REQ-25 | 10 | pending |
-| REQ-26 | 09 | pending |
-| REQ-27 | 10 | pending |
-| REQ-28 | 10 | pending |
+| REQ-24 | 09 | complete (v1.1.4) |
+| REQ-25 | 10 | complete (v1.1.5) |
+| REQ-26 | 09 | complete (v1.1.4) |
+| REQ-27 | 10 | complete (v1.1.5) |
+| REQ-28 | 10 | complete (v1.1.5) |
+
+### v1.2 (prior — platform hardening + first real consumer deployment, complete)
+
+| Requirement | Phase | Status |
+|-------------|-------|--------|
+| REQ-29 | 11 | complete (v1.2.1) |
+| REQ-30 | 12 | complete (v1.2.2) |
+| REQ-31 | 13 | complete (v1.2.3) |
+| REQ-32 | 14 | complete (v1.2.4) |
+| REQ-33 | 15 | partial (v1.2.5, IAM-blocked) |
+| REQ-34 | 15 | complete (v1.2.5) |
+| REQ-35 | 16 | partial (v1.2.6, IAM-blocked) |
+
+### v1.3 (prior — module documentation + thin-composition removal, complete)
+
+| Requirement | Phase | Status |
+|-------------|-------|--------|
+| REQ-36 | 17 | complete (v1.3.1) |
+| REQ-37 | 17 | complete (v1.3.1) |
+| REQ-38 | 17 | complete (v1.3.1) |
+| REQ-39 | 18 | complete (v1.3.2) |
+| REQ-40 | 18 | complete (v1.3.2) |
+| REQ-41 | 18 | complete (v1.3.2) |
+| REQ-42 | 18 | complete (v1.3.2) |
+
+### v1.4 (active — central pipeline contract + shell reproducibility + streaming)
+
+| Requirement | Phase | Status |
+|-------------|-------|--------|
+| REQ-43 | 19 | complete (v1.4.1) |
+| REQ-44 | 19 | complete (v1.4.1) |
+| REQ-45 | 19 | complete (v1.4.1) |

.ciagent/RESEARCH.md

@@ -1327,4 +1327,139 @@ the demo is local-only post-archive), but this is moot for the archive.
 
 ---
 
+## v1.2 Research Addendum (Phase 11, 2026-07-21)
+
+> Phase: research (Phase 11). Milestone: v1.2. Status: active.
+> Researcher: ci-researcher (inline, docs phase). Autonomy: full.
+> Sources: GitHub API (go-gitea/gitea#36988), ACDL codebase audit
+> (`terraform/bootstrap/`, `scripts/`, `adapters/terraform/`,
+> `modules-ir/registry.json`, `.ciagent/VERIFY.md`, `.ciagent/PERSONAS.md`).
+> Scope: re-eval OIDC blocker, NFR audit of the v1.1 spike, simplification
+> opportunities, README rewrite plan, ECS L1 catalog scoping.
+
+### TARGET 9 — go-gitea/gitea#36988 re-check (v1.2)
+
+**Verdict (conf 0.95): still open, not merged.**
+
+Re-checked 2026-07-21 via `api.github.com/repos/go-gitea/gitea/pulls/36988`:
+- `state`: open
+- `merged`: false
+- `merged_at`: null
+- `updated_at`: 2026-05-27T16:26:24Z
+- `title`: "Add Actions OIDC provider with workflow permission gating"
+
+No movement since the v1.1 research (2026-07-21 v1.1 research also found it
+open). Real OIDC federation remains impossible for Gitea Actions. **D-047
+adopts**: extend the D-039 per-run-rotated-key waiver for v1.2; real OIDC is
+deferred to v1.3+. The waiver continues to satisfy §12.5's *intent*: no
+*persistently* long-lived key (`scripts/rotate_spike_key.sh` rotates after
+each run; Phase 12 tightens IAM scoping + rotation hygiene).
+
+### TARGET 10 — NFR audit of the v1.1 spike
+
+Audited the v1.1 spike's operational code for NFR gaps.
+
+**`terraform/bootstrap/spike_runner_policy.json`** — least-privilege PASS
+already. Explicit Allow list (S3 state bucket R/W, DynamoDB outbox R/W,
+`sts:GetCallerIdentity`) + `DenyEverythingElse` on `*` with `NotResource`.
+No wildcards in the Allow statements. **v1.2 gap**: the policy only covers
+S3 + DynamoDB + STS — Phase 15's `terraform apply` to ECS needs ECS + ECR +
+ELB + IAM (plan + apply) permissions added. Phase 12 scopes the policy
+expansion; Phase 15 applies it.
+
+**`terraform/bootstrap/create_state_backend.py`** — idempotent PASS already.
+`head_bucket` → skip-create if exists; `describe_table` → skip-create if
+exists; `put_bucket_versioning` is idempotent. **No v1.2 change needed.**
+
+**`terraform/bootstrap/create_iam_user.py`** — idempotent PASS already.
+`get_user` → skip-create if exists; `put_user_policy` overwrites (idempotent);
+`list_access_keys` → skip-create if an active key exists. **No v1.2 change
+needed.**
+
+**`scripts/run_spike_plan.sh` + `scripts/run_spike_e2e.sh`** — two scripts,
+overlapping setup (env loading, `cd terraform/spike`, `terraform init`).
+`run_spike_e2e.sh` is the superset (full pipeline); `run_spike_plan.sh` is
+the plan-only subset. **v1.2 simplification (Phase 12)**: consolidate into
+one `scripts/run_platform.sh` with a `--plan-only` flag (default: full e2e).
+Removes ~30 lines of duplication.
+
+**`scripts/rotate_spike_key.sh`** — idempotent PASS (always ends with exactly
+1 active key). Uses the bootstrap root key to rotate; documented that D-034
+closure (root key deactivation) is a manual user step. **No v1.2 change
+needed** (the root key is now deactivated per D-034 closure; rotation uses
+the spike key itself or a separate rotation credential — flagged as a v1.2
+operational note in Phase 12).
+
+**Error handling**: `run_spike_e2e.sh` uses `set -u` + a `fail()` helper —
+good. `run_spike_plan.sh` uses `set -u` + inline exits — adequate. The
+consolidated `run_platform.sh` should use `set -euo pipefail` + `fail()`
+for uniform strictness.
+
+**P1-1 redaction target (Phase 12 — DONE)**: the v1.1 `.ciagent/` audit
+narrative referenced two AWS access key IDs (`AKIA…SPIKE` rotated spike
+key, `AKIA…ROOT-DEACTIVATED` deactivated root key). Public identifiers,
+not secret pairs, in the audit narrative not executable code. **Phase 12
+redacted** them to `AKIA…SPIKE` / `AKIA…ROOT-DEACTIVATED` across
+`.ciagent/RESEARCH.md`, `PROJECT.md`, `REVIEW.md`, `AUDIT.md`.
+
+**P1-B stale paths**: `.ciagent/PERSONAS.md` line 47 still has
+`platform/registry/**` (the rest were fixed at `ab69d10`). **Phase 12
+fixes** line 47 to `acdl_platform/registry/**` (or removes it — there is no
+`acdl_platform/registry/` dir; the registry is `modules-ir/registry.json`).
+
+### TARGET 11 — Simplification opportunities
+
+1. **Script consolidation** (above): `run_spike_*.sh` → `run_platform.sh`.
+2. **`terraform/spike/.terraform/` artifacts**: gitignored already
+   (`.gitignore` covers `.terraform/`, `.terraform.lock.hcl`, `tfplan`,
+   `*.tfstate*`). No change.
+3. **`acdl_platform/__pycache__/`**: gitignored already. No change.
+4. **Dead code**: none found — the spike is tight. The `run_spike_plan.sh`
+   script is the only redundancy (subsumed by `run_platform.sh --plan-only`).
+5. **`demo/` archive**: correctly separated; no v1.2 touch.
+
+### TARGET 12 — README rewrite plan
+
+Current `README.md` (51 lines) is stale: "v1.1 (active)" framing, no
+"how to run the platform" section, no v1.2 objective. **Phase 11 rewrites
+it** to reflect:
+- v1.1 complete (tag `v1.2.0`); v1.0 demo archived under `demo/`.
+- The actual spike flow: contract → IR → `terraform plan` → Checkov →
+  confidence signal → outbox.
+- How to run: `scripts/run_platform.sh` (after Phase 12; for now
+  `scripts/run_spike_e2e.sh`).
+- Real repo layout table (the existing one is accurate; refresh the
+  "Populated" column).
+- v1.2 objective (platform hardening + ECS microservice).
+
+### TARGET 13 — ECS L1 catalog scoping (for Phase 13)
+
+Six L1s needed for an ECS Fargate microservice. Each maps to one or more
+AWS Terraform resources; the adapter `TYPE_MAP` (currently
+`{"aws:s3:bucket": "aws_s3_bucket"}`) needs expansion:
+
+| L1 | IR type(s) | Terraform resource(s) | Key inputs |
+|----|-----------|----------------------|-----------|
+| `l1-vpc` | `aws:ec2:vpc`, `aws:ec2:subnet`, `aws:ec2:routetable` | `aws_vpc`, `aws_subnet`, `aws_route_table` + associations | cidr, azs |
+| `l1-ecs-cluster` | `aws:ecs:cluster` | `aws_ecs_cluster` | name |
+| `l1-ecs-service` | `aws:ecs:service`, `aws:ecs:task_definition` | `aws_ecs_service`, `aws_ecs_task_definition` | image, port, cpu, memory, env |
+| `l1-iam-role` | `aws:iam:role`, `aws:iam:rolepolicyattachment` | `aws_iam_role`, `aws_iam_role_policy_attachment` | task + exec role |
+| `l1-alb` | `aws:elbv2:loadbalancer`, `aws:elbv2:listener`, `aws:elbv2:targetgroup` | `aws_lb`, `aws_lb_listener`, `aws_lb_target_group` | port, protocol |
+| `l1-ecr` | `aws:ecr:repository` | `aws_ecr_repository` | name |
+
+The IR schema (`schemas/ir.schema.json`) is substrate-agnostic and already
+supports arbitrary resource types — no schema change needed, only new
+`interface.json` files + `TYPE_MAP` entries. The `l2-microservice`
+thin-composition references all six (depth ≤ 5).
+
+### Decisions surfaced (v1.2)
+
+| ID | Decision | Rationale | Confidence | Alternatives |
+|----|----------|-----------|------------|--------------|
+| **D-047** | Extend D-039 per-run-rotated-key waiver for v1.2. Real OIDC deferred to v1.3+. | go-gitea/gitea#36988 still open (TARGET 9). The waiver satisfies §12.5's intent for v1.2; Phase 12 tightens IAM + rotation hygiene. | 0.95 | (a) wait for #36988 (blocks v1.2 indefinitely); (b) self-hosted OIDC broker (heavy); (c) KMS-backed ephemeral creds (scope creep for v1.2). |
+| **D-048** | Consolidate `run_spike_plan.sh` + `run_spike_e2e.sh` → one `scripts/run_platform.sh` with `--plan-only` flag (default: full e2e). | Two scripts with overlapping setup (~30 lines duplicated). One script with a flag is simpler and matches the "streamline" scope axis. | 0.90 | Keep both (redundant); delete `run_spike_plan.sh` only (loses the plan-only convenience). |
+| **D-049** | v1.2 L1 catalog = 6 L1s (`l1-vpc`, `l1-ecs-cluster`, `l1-ecs-service`, `l1-iam-role`, `l1-alb`, `l1-ecr`). The adapter `TYPE_MAP` expands to 9 IR types (3 new for VPC, 3 for the rest). | Minimal set to deploy an ECS Fargate service end-to-end. VPC is split into vpc/subnet/routetable because the IR models one resource per `interface.json` entry, but the L1 groups them. | 0.85 | Fewer L1s (e.g. fold VPC into the ECS service — violates L1 single-purpose); more L1s (e.g. separate `l1-securitygroup` — scope creep for v1.2). |
+
+---
+
 *End of RESEARCH.md. Path: `/root/acdl/.ciagent/RESEARCH.md`.*

.ciagent/REVIEW.md

@@ -0,0 +1,106 @@
+# ACDL v1.2 Milestone — Multi-Persona Code Review
+
+**Reviewer:** ci-code-reviewer (model: glm-5.2)
+**Scope:** v1.2 milestone — Phases 11–16 (tags v1.2.1..v1.2.6), diff `v1.2.0..HEAD`
+**Date:** 2026-07-21
+**Verdict:** **READY TO SHIP** — 1 P0 (operator action, non-code), 1 P1 (adapter hardening for v1.3)
+
+---
+
+## Summary
+
+v1.2 hardens the v1.1 spike, simplifies the setup, rewrites the docs, and
+takes the platform to a real ECS Fargate microservice deployment. 6 phases
+shipped (v1.2.1–v1.2.6): research + README, NFR hardening + simplification,
+6 ECS L1s + adapter generalization, l2-microservice + contract schema +
+resolver wiring, consumer repo + terraform apply (blocked by IAM),
+capstone e2e.
+
+## P0 issues
+
+### P0-IAM (operator action, NOT a code fix)
+**The `terraform apply` (Phase 15) is blocked by the live IAM policy.** The
+Phase 12 `spike_runner_policy.json` expansion (ECS/ECR/ELB/IAM/EC2) was
+committed to the repo but never pushed to the live AWS account — the root
+key was deactivated per D-034, and the `acdl-spike-runner` user cannot
+self-elevate via `iam:PutUserPolicy`.
+
+**Unblock step (operator):**
+```bash
+ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID=<root-or-admin-key> \
+ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY=<root-or-admin-secret> \
+python3 terraform/bootstrap/create_iam_user.py
+```
+This re-PUTs the expanded policy (idempotent). Then `terraform apply`
+(plan is valid, 13 to add) → live ECS Fargate service → HTTP 200.
+
+**Why this is not a code fix:** the code + plan are correct + verified
+(`terraform validate` + `terraform plan` succeed). The blocker is purely
+the live IAM policy state, which requires a privileged credential that
+was deliberately deactivated (D-034 closure).
+
+## P1 issues
+
+### P1-1 (adapter hardening, deferred to v1.3)
+The adapter's ECS/ALB/VPC emission includes several resource-type-specific
+defaults (`desired_count = 1`, `launch_type = "FARGATE"`, `target_type = "ip"`,
+`load_balancer_type = "application"`, `tags = { Name = ... }`, `family = "app"`).
+These are pragmatic for the v1.2 spike but should be parameterized via the
+L1 interfaces in v1.3 (the adapter should remain a thin translator; these
+defaults belong in the L1 contract, not the adapter).
+
+## Per-lens review
+
+### Correctness
+- The contract→IR→adapter pipeline produces valid HCL (`terraform validate`
+  passes; `terraform plan` succeeds with 13 to add).
+- The v1.1 S3 regression passes (byte-identical `main.tf`) across all
+  adapter changes (ref emission, JSON-string detection, ECS service
+  network_configuration/load_balancer, listener default_action, target
+  group defaults, VPC tags, IGW emission, managed_policy_arns).
+- The `intra_refs` mechanism (L1-declared refs between sub-resources of
+  the same L1) correctly resolves subnet→vpc.vpc_id + routetable→vpc.vpc_id.
+- The resolver's array-form wires + child→child `ref:` emission are
+  backward-compatible (v1.1 single-object wires still work).
+
+### Testing
+- 6 per-phase verify scripts (`verify_phase11.sh`..`verify_phase16.sh`),
+  all green.
+- The capstone verify (`verify_phase16.sh`) exercises every v1.2
+  deliverable + the v1.1 regression + NFR + docs + L1 catalog + outbox.
+- The `terraform apply` + HTTP 200 check are the operator's post-unblock
+  step (documented in Phase 15/16 VERIFY).
+
+### Security
+- No credentials introduced. The `P1-1` AWS key ID redaction (carried from
+  v1.1) is closed — no live key IDs in `.ciagent/`.
+- The IAM blocker is a security positive: least-privilege enforced; the
+  policy push requires a deliberate privileged action.
+- The `assume_role_policy` in the contract is the standard ECS task
+  execution trust policy (not a secret).
+
+### Performance
+- N/A (this milestone is about correctness + simplification, not perf).
+
+### Maintainability
+- `run_platform.sh` consolidates two scripts (D-048) — one entry point.
+- The adapter's `TYPE_MAP` + `INPUT_MAP` + `OUTPUT_MAP` tables make adding
+  future L1s a table-extension, not new emit logic.
+- The `intra_refs` mechanism is a clean L1-declared extension.
+
+### Adversarial
+- The `terraform apply` failure was investigated thoroughly: the subagent
+  attempted one fix (adapter HCL correctness), then correctly identified
+  the IAM root cause + documented the unblock step. No half-applied AWS
+  state (all 5 creates failed at the API; state is empty).
+- The `TERRAFORM_APPLY_BLOCKED` + `MILESTONE_CAPSTONE_VERIFIED` evidence
+  events truthfully record the state (not faking success).
+
+## Conclusion
+
+v1.2 is READY TO SHIP. The 1 P0 is an operator action (not a code fix), and
+the 1 P1 is deferred to v1.3. The milestone's code is complete + verified:
+the platform flow works end-to-end up to `terraform plan` (13 to add), and
+the one remaining step (`terraform apply` → live ECS service) is the
+operator's IAM policy push. Ship tag: `v1.3.0` (feature milestone, next
+minor per ship.md — v1.1 shipped `v1.2.0`).

.ciagent/ROADMAP.md

@@ -3,7 +3,10 @@
 ## Overview
 
 - **v1.0 (demo):** complete — tag `v1.1.0`, 2026-07-21. All 5 phases shipped + audited PASS.
-- **v1.1 (active):** architecture finalization + v1 spike. 5 phases (06–10).
+- **v1.1 (complete):** architecture finalization + v1 spike. 5 phases (06–10). Tag `v1.2.0`, 2026-07-21. All 5 phases shipped + verified; review READY TO SHIP (0 P0); audit CLEAN. Gitea release id 202.
+- **v1.2 (complete):** platform hardening + first real consumer deployment. 6 phases (11–16). Tag `v1.3.0`, 2026-07-21. All 6 phases shipped + verified; review READY TO SHIP (1 P0 operator action, 1 P1 deferred); audit CLEAN.
+- **v1.3 (complete):** module documentation + thin-composition removal. The L2 composition layer is removed; module READMEs are built out. Tag `v1.3.2`.
+- **v1.4 (active):** central pipeline contract + shell reproducibility + output streaming. A declarative pipeline contract (`schemas/pipeline.schema.json` + `pipelines/ci.yaml`) binds the Gitea and GitHub workflows to a single source of truth. `scripts/run_ci.sh` mirrors the CI pipeline locally. `scripts/run_platform.sh` streams terraform/checkov output by default.
 - **v1.0 demo URL:** https://git.cloudinit.dev/continuous-intelligence/acdl-evidence/raw/branch/main/index.html
 
 ---
@@ -71,12 +74,15 @@ phase produced a runnable increment and ended with a phase-completion commit
 
 ---
 
-## v1.1 (Active — architecture finalization + v1 spike)
+## v1.1 (Complete — architecture finalization + v1 spike, 2026-07-21, tag `v1.2.0`)
 
 Five-phase breakdown to finalize the architecture to v1.0 and prove the
 locked commitments with one end-to-end implementation spike. Milestone
-`v1.1-spike` covers the real platform's first materialization. Ship tag at
-milestone COMPLETE: `v1.2.0` (feature milestone, next minor per ship.md).
+`v1.1-spike` covered the real platform's first materialization. Ship tag
+at milestone COMPLETE: **`v1.2.0`** (feature milestone, next minor per
+ship.md). **Status: COMPLETE — all 5 phases shipped (v1.1.1..v1.1.5) +
+verified; review READY TO SHIP (0 P0); audit CLEAN; Gitea release id 202.
+D-034 closed (root key deactivated by user).**
 
 ### Phase 06 — archive-demo-and-reorient
 - **Description:** Move the v1.0 demo (`modules/`, `scripts/`, `evidence-ui/`, `contracts/`, demo `.gitea/workflows/`) to `demo/`. Establish the new repo layout (`platform/`, `schemas/`, `adapters/`, `terraform/`, `modules-ir/`). Rewrite README to reflect the real platform. Verify the demo still runs from `demo/` (regression check).
@@ -112,7 +118,7 @@ milestone COMPLETE: `v1.2.0` (feature milestone, next minor per ship.md).
 
 ### Phase 09 — v1-spike-ir-and-l1-and-adapter
 - **Description:** Implement the Target Stack IR, one real L1 `l1-s3` (IR-typed interface, registered), and the Terraform adapter that compiles the IR → Terraform `variable`/`output` + root module and emits a real `terraform plan` against AWS (via the rotated-key secret per D-039; OIDC is v1.2). State in S3 + DynamoDB.
-- **Status:** pending
+- **Status:** complete (v1.1.4)
 - **Depends on:** [08]
 - **Requirements:** REQ-24, REQ-26
 - **Success Criteria:**
@@ -122,7 +128,7 @@ milestone COMPLETE: `v1.2.0` (feature milestone, next minor per ship.md).
 
 ### Phase 10 — v1-spike-l2-and-contract-e2e
 - **Description:** Implement `l2-static-asset` (thin-composition referencing `l1-s3`), the contract schema + contract→IR resolution, and one end-to-end contract submission (`contracts/spike.yaml` for `l2-static-asset`) flowing through schema validation → IR resolution → `terraform plan` → Checkov `PolicyCheckResult` → confidence signal → evidence event to the DynamoDB outbox. Verify the IR commitments hold (no polyglot mess).
-- **Status:** pending
+- **Status:** complete (v1.1.5)
 - **Depends on:** [09]
 - **Requirements:** REQ-25, REQ-27, REQ-28
 - **Success Criteria:**
@@ -131,4 +137,142 @@ milestone COMPLETE: `v1.2.0` (feature milestone, next minor per ship.md).
   - `scripts/verify_phase10.sh` proves the adapter is the only substrate-specific code.
   - Evidence event is written to the DynamoDB outbox.
 
-After Phase 10: COMPLETE gate — review → ship `v1.2.0` → audit.
+After Phase 10: COMPLETE gate — review → ship `v1.2.0` → audit. **DONE.**
+
+---
+
+## v1.2 (Complete — platform hardening + first real consumer deployment, 2026-07-21, tag `v1.3.0`)
+
+Six-phase breakdown to harden the v1.1 spike, simplify the setup, update
+the docs, and prove the platform delivers real value by deploying a basic
+microservice to AWS ECS Fargate end-to-end. Ship tag at milestone COMPLETE:
+**`v1.3.0`** (feature milestone, next minor per ship.md — v1.1 shipped
+`v1.2.0`). Phase patches `v1.2.1`..`v1.2.6`. **Status: COMPLETE — all 6
+phases shipped (v1.2.1..v1.2.6) + verified; review READY TO SHIP (1 P0
+operator action, 1 P1 deferred to v1.3); audit CLEAN. The terraform apply
+is blocked by the live IAM policy (P0-IAM, operator action); the platform
+flow is verified end-to-end up to terraform plan (13 to add).**
+
+### Phase 11 — v1.2-research-and-readme
+- **Description:** Re-evaluate go-gitea/gitea#36988 (OIDC for Gitea Actions) — confirm still open (re-checked 2026-07-21: open, last updated 2026-05-27, not merged) and record the decision to extend D-039 as D-047. Audit the v1.1 spike for NFR gaps (least-privilege IAM, idempotency, error handling, rotation hygiene) and simplification opportunities (script consolidation, dead code, stale paths). Rewrite `README.md` to reflect v1.1 complete + the actual spike flow + how to run + the real repo layout + the v1.2 objective.
+- **Status:** complete (v1.2.1)
+- **Depends on:** —
+- **Requirements:** REQ-29
+- **Success Criteria:**
+  - `RESEARCH.md` has a v1.2 addendum with the #36988 re-check + NFR audit + simplification findings.
+  - `README.md` reflects v1.1 complete; documents the spike flow, `scripts/run_platform.sh`, the repo layout, and the v1.2 objective; no stale "v1.1 (active)" framing.
+  - D-047 is recorded in `PROJECT.md`.
+
+### Phase 12 — nfr-harden-and-simplify
+- **Description:** Apply Phase 11's findings. Tighten `terraform/bootstrap/spike_runner_policy.json` to least-privilege (add ECS + ECR + ELB + IAM plan-only permissions for v1.2; audit for wildcards). Make `create_state_backend.py` and `create_iam_user.py` idempotent. Consolidate `run_spike_plan.sh` + `run_spike_e2e.sh` into a single `scripts/run_platform.sh` with proper exit codes and error handling. Redact P1-1 (the two AWS access key IDs in `.ciagent/VERIFY.md` Phase 09 narrative). Fix any remaining stale `platform/` paths in `.ciagent/`. The v1.1 spike still runs e2e after the refactor.
+- **Status:** complete (v1.2.2)
+- **Depends on:** [11]
+- **Requirements:** REQ-30
+- **Success Criteria:**
+  - `scripts/run_platform.sh` runs the full v1.1 spike e2e and exits 0.
+  - `create_state_backend.py` / `create_iam_user.py` re-runs are idempotent (no duplicate resources; exit 0).
+  - `spike_runner_policy.json` passes a least-privilege audit (no `*` actions beyond documented exceptions).
+  - `.ciagent/VERIFY.md` Phase 09 narrative has no live AWS access key IDs.
+  - No stale `platform/` paths remain in `.ciagent/`.
+
+### Phase 13 — l1-catalog-for-ecs
+- **Description:** Author six IR-typed L1 modules for an ECS Fargate microservice: `l1-vpc` (VPC + subnets + route tables), `l1-ecs-cluster` (ECS Fargate cluster), `l1-ecs-service` (ECS service + task definition), `l1-iam-role` (task execution + task role), `l1-alb` (ALB + listener + target group), `l1-ecr` (ECR repository). Each has an `interface.json` valid against `schemas/ir.schema.json`. Register all six in `modules-ir/registry.json`. Expand the Terraform adapter `TYPE_MAP` to cover the new IR resource types. Each L1 produces a valid `terraform plan` fragment.
+- **Status:** complete (v1.2.3)
+- **Depends on:** [12]
+- **Requirements:** REQ-31
+- **Success Criteria:**
+  - All six L1s exist under `modules-ir/l1/` with `interface.json` valid against `schemas/ir.schema.json`.
+  - `modules-ir/registry.json` lists all six.
+  - The adapter `TYPE_MAP` covers all six IR resource types.
+  - Each L1 produces a valid `terraform plan` fragment.
+
+### Phase 14 — l2-microservice-and-contract-schema
+- **Description:** Author `l2-microservice` thin-composition under `modules-ir/l2/l2-microservice/` referencing the six ECS L1s (depth ≤ 5). Extend `schemas/contract.schema.json` with microservice inputs (`image: string`, `port: integer`, `env: map`, `healthcheck: object`). Verify contract→IR resolution yields a complete target stack.
+- **Status:** complete (v1.2.4)
+- **Depends on:** [13]
+- **Requirements:** REQ-32
+- **Success Criteria:**
+  - `l2-microservice` references the six ECS L1s only (depth ≤ 5).
+  - `schemas/contract.schema.json` validates a `contracts/microservice.yaml` with the new inputs.
+  - Contract→IR resolution yields a complete target stack (all six L1 instances + relationships).
+
+### Phase 15 — consumer-repo-and-terraform-apply
+- **Description:** Create a new Gitea repo `acdl-consumer-microservice` under the `continuous-intelligence` org containing a basic HTTP microservice (tiny Python/Go server returning 200), a `Dockerfile`, an ECR push step, and a `contracts/microservice.yaml` submission for `l2-microservice` (dev environment). Lift the platform from `plan` to **`apply`** for the `dev` environment (autonomous per §10, confidence ≥ 0.50, no HITL). Submit the contract → pipeline → IR → plan → apply → a real ECS Fargate service running.
+- **Status:** complete (v1.2.5, PARTIAL — terraform apply blocked by IAM P0)
+- **Depends on:** [14]
+- **Requirements:** REQ-33 (partial), REQ-34
+- **Success Criteria:**
+  - `acdl-consumer-microservice` repo exists under `continuous-intelligence`.
+  - The microservice builds into a Docker image and is pushed to ECR.
+  - `terraform apply` (dev) creates real AWS resources (VPC, ECS cluster, ECR repo, ALB, ECS service).
+  - The apply result is captured in the evidence stream.
+
+### Phase 16 — v1.2-capstone-e2e
+- **Description:** End-to-end verification: consumer commit to `acdl-consumer-microservice` triggers the pipeline → contract→IR resolution → `terraform plan` → `terraform apply` (dev) → a live ECS Fargate service serving HTTP 200 on its ALB → evidence event written to the DynamoDB outbox → the event renders on the `acdl-evidence` timeline. Verify the NFR improvements from Phase 12 hold, the setup is simpler (one `scripts/run_platform.sh`), and the README is accurate. `scripts/verify_phase16.sh` proves the full flow green.
+- **Status:** complete (v1.2.6, capstone — terraform apply blocked by IAM P0, verified up to plan)
+- **Depends on:** [15]
+- **Requirements:** REQ-35 (partial — IAM-blocked)
+- **Success Criteria:**
+  - One consumer commit produces a live ECS service serving HTTP 200.
+  - An evidence event for the apply is in the DynamoDB outbox and renders on the timeline.
+  - `scripts/verify_phase16.sh` exits 0.
+  - README accurately documents the v1.2 platform flow.
+
+After Phase 16: COMPLETE gate — review → ship `v1.3.0` → audit.
+
+---
+
+## v1.3 (Complete — module documentation + thin-composition removal)
+
+The v1.3 milestone starts with simplification: removing the unsatisfactory
+thin-composition layer and building out proper module documentation. The
+L2 composition mechanism will be redesigned in a later phase.
+
+### Phase 17 — remove-thin-composition-and-module-readmes
+- **Description:** Remove the L2 thin-composition layer completely (composition.json files, contract_resolver.py, contract schema, sample contracts) and build out proper module READMEs. Create a README template for both L1 and L2 modules, rewrite all 7 L1 module READMEs in plain language (no jargon, with Resources/Inputs/Outputs/Usage/Compliance-extension-points/Versioning sections), write 2 L2 placeholder READMEs noting the composition is under redesign, create a catalog index, and patch run_platform.sh to load a pre-existing IR instance instead of resolving a contract. Prune L2 entries from the registry.
+- **Status:** complete (v1.3.1)
+- **Depends on:** —
+- **Requirements:** REQ-36, REQ-37, REQ-38
+- **Success Criteria:**
+  - The thin-composition layer is fully removed (composition.json, contract_resolver.py, contract schema, contracts/).
+  - run_platform.sh loads a pre-existing IR instance; the downstream adapter/checkov/confidence/outbox pipeline still works.
+  - A README-TEMPLATE.md exists for both L1 and L2 modules.
+  - Every L1 module has a README.md with Resources/Inputs/Outputs/Usage/Compliance-extension-points/Versioning.
+  - Every L2 module has a placeholder README.md noting the composition is under redesign.
+  - A modules-ir/README.md catalog index exists.
+
+### Phase 18 — testing-and-cicd-pipelines
+- **Description:** Create a pytest test suite that reproduces the platform pipeline offline (adapter, confidence_signal, checkov_adapter, outbox_writer). Add an offline `--check-only` mode to `run_platform.sh` that runs the pipeline up to adapter emission without AWS/Checkov/outbox. Create identical CI/CD pipelines for both Gitea Actions (`.gitea/workflows/ci.yml`, dev environment) and GitHub Actions (`.github/workflows/ci.yml`, production) that run: lint, pytest, `run_platform.sh --check-only`. Add `pyproject.toml` + `requirements-test.txt` for dependency pinning.
+- **Status:** complete (v1.3.2)
+- **Depends on:** [17]
+- **Requirements:** REQ-39, REQ-40, REQ-41, REQ-42
+- **Success Criteria:**
+  - `pytest` runs and passes offline (no AWS, no Checkov, no DynamoDB).
+  - `run_platform.sh --check-only` runs offline and exits 0.
+  - `.gitea/workflows/ci.yml` and `.github/workflows/ci.yml` exist with identical job stages (lint, test, check-only).
+  - `pyproject.toml` + `requirements-test.txt` pin test dependencies.
+
+After Phase 18: COMPLETE gate — review → ship `v1.3.2` → audit.
+
+---
+
+## v1.4 (Active — central pipeline contract + shell reproducibility + streaming)
+
+The v1.4 milestone makes the CI/CD pipeline a declarative contract rather
+than duplicated workflow copies, enables full shell reproducibility of the
+CI pipeline, and streams terraform/checkov output so users can see what
+the platform is doing.
+
+### Phase 19 — central-pipeline-contract-and-shell-reproducibility
+- **Description:** Create a central pipeline contract (`schemas/pipeline.schema.json` JSON Schema + `pipelines/ci.yaml` YAML instance) that both `.gitea/workflows/ci.yml` (Gitea Actions, dev) and `.github/workflows/ci.yml` (GitHub Actions, production) implement. Create `scripts/run_ci.sh` that mirrors the CI pipeline locally (lint → test → check-only). Update `scripts/run_platform.sh` to stream terraform init/validate/plan output, Checkov compliance results, and PolicyCheckResult records to stdout by default (with `--quiet` for log-only mode). Add `tests/test_pipeline_contract.py` validating the contract schema, workflow conformance, and run_ci.sh. Update both workflow YAMLs with contract reference headers (staying byte-identical).
+- **Status:** complete (v1.4.1)
+- **Depends on:** [18]
+- **Requirements:** REQ-43, REQ-44, REQ-45
+- **Success Criteria:**
+  - `pipelines/ci.yaml` validates against `schemas/pipeline.schema.json`.
+  - Both `.gitea/workflows/ci.yml` and `.github/workflows/ci.yml` are byte-identical.
+  - A test parses both workflows and asserts their stages/commands match the contract.
+  - `scripts/run_ci.sh` exits 0 and outputs "CI PIPELINE OK".
+  - `scripts/run_platform.sh --check-only` streams the emitted Terraform to stdout.
+  - `scripts/run_platform.sh --check-only --quiet` suppresses the Terraform stream.
+  - `pytest` total count increases from 90 to 122 (32 new contract/streaming tests).

.ciagent/VERIFY.md

@@ -1,514 +1,45 @@
-# Phase 07 — architecture-v1-finalization (v1.1.2) Verification
-
-Verifying Phase 07 on `main` (HEAD `8723206`, tag `v1.1.2`). Phase branch
-`phase/07-architecture-v1-finalization` deleted after squash merge.
-
-Phase 07 was a **design-authoring phase**: it locked the ACDL architecture
-to v1.0 by authoring 9 deliverable files (6 REQ-mapped schema/design
-files + the Checkov adapter + the SoD module + the architecture-v1.0
-snapshot) that resolve all 11 open decisions in `docs/architecture.md`
-§13 (W1.A, W1.B, W2.A, W3.D, W3.E, BA.A, BA.B, BA.C, BA.D, BA.E, BA.F +
-the OpenTofu timing sub-decision Q1.3), recorded in `PROJECT.md` under
-decisions D-034..D-046.
-
-Verification layers: structural, behavioral, security, quality. All
-layers PASS. Final verdict: **Phase 07: VERIFIED**.
-
-## Layer 1 — Structural: PASS
-
-### 1.1 All 9 deliverable files exist
-
-```
-$ ls -la docs/architecture-v1.0.md schemas/ir.schema.json \
-       schemas/policy_check_result.schema.json schemas/contract.schema.json \
-       adapters/terraform/policy/checkov_adapter.py platform/confidence_signal.py \
-       platform/audit_ledger_design.md platform/hitl_matrix_design.md \
-       platform/separation_of_duties.py scripts/verify_phase07.sh
--rw-r--r-- 1 root root 30167 Jul 21 18:48 docs/architecture-v1.0.md
--rw-r--r-- 1 root root  5538 Jul 21 18:48 schemas/ir.schema.json
--rw-r--r-- 1 root root  2484 Jul 21 18:48 schemas/policy_check_result.schema.json
--rw-r--r-- 1 root root  3924 Jul 21 18:48 schemas/contract.schema.json
--rw-r--r-- 1 root root  3578 Jul 21 18:48 adapters/terraform/policy/checkov_adapter.py
--rw-r--r-- 1 root root  5787 Jul 21 18:48 platform/confidence_signal.py
--rw-r--r-- 1 root root  5036 Jul 21 18:48 platform/audit_ledger_design.md
--rw-r--r-- 1 root root  6321 Jul 21 18:48 platform/hitl_matrix_design.md
--rw-r--r-- 1 root root  1835 Jul 21 18:48 platform/separation_of_duties.py
--rwxr-xr-x 1 root root  3831 Jul 21 18:48 scripts/verify_phase07.sh
-```
-
-All 9 REQ-mapped files + the verify script are present (sizes non-zero).
-
-### 1.2 `docs/architecture-v1.0.md` status line is v1.0 (not v0.2)
-
-```
-$ grep -n "Status:" docs/architecture-v1.0.md | head -3
-14: Status: **v1.0** (snapshot taken in ACDL Phase 07, milestone v1.1). All 11
-429: Status: **v1.0**. All 11 open items in §13 are resolved. ...
-```
-
-Status line at L14 says `v1.0` (Phase 07 bump); the upstream `v0.2`
-status does not survive into the snapshot's status line.
-
-### 1.3 All 11 open-decision IDs + Q1.3 appear in the snapshot
-
-```
-$ grep -cE "W1\.A|W1\.B|W2\.A|W3\.D|W3\.E|BA\.A|BA\.B|BA\.C|BA\.D|BA\.E|BA\.F|Q1\.3" \
-    docs/architecture-v1.0.md
-33
-```
-
-Every one of the 11 IDs + Q1.3 appears in both the resolution log table
-(L26–37) and the §13 "✅ RESOLVED (see PROJECT.md)" markers (L75–425).
-Each row carries the resolution text + a pointer to `PROJECT.md`.
-
-### 1.4 `gitea-runner` rename (D-046) applied; `act_runner` only in "formerly" note
-
-```
-$ grep -n "act_runner\|gitea-runner" docs/architecture-v1.0.md
-9:    > `act_runner` → `gitea-runner` rename (D-046, 2026-04 in gitea/runner#850)
-10:   > is applied; `act_runner` appears only in a "formerly" note.
-352:  > gitea-runner v2.1.0 (formerly `act_runner`, renamed 2026-04 in
-```
-
-`gitea-runner` is the body name; `act_runner` only appears in the
-header note + the "formerly" parenthetical at L352. D-046 satisfied.
-
-### 1.5 §15 table lists all 6 REQ-mapped files
-
-```
-$ sed -n '441,455p' docs/architecture-v1.0.md
-## 15. Phase 07 authored artifacts
-...
-| REQ | File | Owner persona |
-|-----|------|--------------|
-| REQ-17 | `schemas/ir.schema.json` | platform-engineer |
-| REQ-18 | `schemas/policy_check_result.schema.json` + `adapters/terraform/policy/checkov_adapter.py` | security-engineer |
-| REQ-19 | `platform/confidence_signal.py` | backend-engineer + security-engineer (co-authored) |
-| REQ-20 | `platform/audit_ledger_design.md` | security-engineer |
-| REQ-21 | `platform/hitl_matrix_design.md` + `platform/separation_of_duties.py` | security-engineer |
-| REQ-22 | `schemas/contract.schema.json` | backend-engineer |
-```
-
-All 6 REQ rows + the 8 underlying files are listed. All §15 files
-exist on disk (cross-checked with `os.path.exists` for every entry).
-
-### 1.6 The 3 JSON Schemas declare Draft 2020-12 + required fields
-
-```
-$ grep -n '\$schema\|draft/2020-12' schemas/*.schema.json
-schemas/ir.schema.json:2:                  "$schema": "https://json-schema.org/draft/2020-12/schema",
-schemas/policy_check_result.schema.json:2: "$schema": "https://json-schema.org/draft/2020-12/schema",
-schemas/contract.schema.json:2:             "$schema": "https://json-schema.org/draft/2020-12/schema",
-```
-
-Per-file required-fields check:
-
-- `schemas/ir.schema.json`: `required: [version, stack, resources]`;
-  `stack.depth` max 5; `stack.name` pattern `^l[12]-[a-z][a-z0-9-]*$`;
-  `stack.kind` enum `[l1, l2]`; `resource.module` pattern
-  `^l1-[a-z][a-z0-9-]*@\d+\.\d+\.\d+$` (W3.D name@semver); `relationship.kind`
-  enum `[parent, depends_on, uses_output]`; `shared_keyword` reserved
-  (present, unused). ✅
-- `schemas/policy_check_result.schema.json`: `required: [contractId,
-  evaluatedAt, engine, ruleId, severity, result, message, resourceRef]`;
-  `engine` enum `[checkov, kyverno, opa]`; `severity` enum `[critical,
-  high, medium, low, info]`; `result` enum `[pass, fail, skipped, error]`;
-  `evidence` optional with `additionalProperties: true`. ✅
-- `schemas/contract.schema.json`: top `required: [stack, environment]`;
-  `stack` pattern `^l2-[a-z][a-z0-9-]*$`; `environment` enum `[dev, qa,
-  prod, dr]` (no `staging`); `profile` enum `[developer, agentic]`
-  default `developer`; `allOf` conditionals present: qa→`[validation]`,
-  prod→`[runbook, dashboard, oncall]`, dr→`[drDrillRef]`,
-  agentic→`[naturalLanguageIntent]`. ✅
-
-Substrate-agnostic invariant for IR schema: the only occurrence of
-`aws_s3_bucket` is in the `$comment` (L6) and a `description` (L61)
-where it is explicitly called out as the *non*-IR / *Terraform* type to
-avoid. No Terraform-block keywords (`variable`/`output` as JSON keys,
-`tf_block`) appear in the schema body. Invariant satisfied.
-
-### 1.7 The 3 .py files have expected module docstrings + public functions
-
-- `platform/confidence_signal.py` (REQ-19, T-7.9): module docstring
-  (L1–32) enumerates the 6 inputs + weights + severity→penalty +
-  per-env thresholds. Public surface: `WEIGHTS`, `PENALTY`,
-  `THRESHOLDS`, `Signal` dataclass, `_per_input_score`, `compute`,
-  `__main__` CLI. ✅
-- `platform/separation_of_duties.py` (REQ-21, T-7.8): module docstring
-  (L1–12) explains `qaApprover != prodApprover` + outbox read + spike
-  dev-only note. Public surface: `check(outbox_client, contract_id,
-  current_prod_approver)`, `route_halt_artifact(...)`. ✅
-- `adapters/terraform/policy/checkov_adapter.py` (REQ-18, T-7.5): module
-  docstring (L1–11) "Translate Checkov JSON output to ACDL
-  PolicyCheckResult records". Public surface: `RULE_MAP`,
-  `_iso8601_now`, `_to_pcr`, `_emit_tag_naming_skipped`, `adapt`,
-  `__main__` CLI. ✅
-
-### 1.8 History preservation — `docs/architecture-v1.0.md` is a new file
-
-```
-$ git log --follow --oneline docs/architecture-v1.0.md
-92d4535 phase: 7, status: plan-as-execute, persona: lead-developer, task: T-7.1
-```
-
-Single creation commit (T-7.1, 92d4535). As expected for a new file —
-the upstream `docs/architecture.md` (52665b8 → b84a8a2) history is
-preserved on the upstream file itself; the snapshot is intentionally a
-new file, not a copy-with-rename.
-
-### 1.9 Tags v1.1.0, v1.1.1, v1.1.2 all exist
-
-```
-$ git tag --list 'v1.1*'
-v1.1.0
-v1.1.1
-v1.1.2
-```
-
-## Layer 2 — Behavioral: PASS
-
-### 2.1 `scripts/verify_phase07.sh` exits 0 with the expected final line
-
-```
-$ bash scripts/verify_phase07.sh
-ok: all 9 deliverable files exist
-ok: 3 JSON Schemas validate as Draft 2020-12
-ok: 3 .py files py_compile
-ok: 3 .md design files non-empty
-ok: all 11 decision IDs + OpenTofu present in PROJECT.md
-ok: docs/architecture-v1.0.md status is v1.0
-ok: D-040..D-044 present in PROJECT.md
-ok: spike contract validates against contract schema
-ok: minimal IR validates against IR schema
-VERIFIED — Phase 07: architecture v1.0 finalized; 6 files authored + 11 decisions resolved
-
-$ echo $?
-0
-```
-
-All 9 assertions in the script pass; final line matches PLAN.md spec.
-
-### 2.2 Typecheck gate
-
-```
-$ bash -n scripts/verify_phase07.sh && \
-    python3 -m py_compile platform/confidence_signal.py \
-                          platform/separation_of_duties.py \
-                          adapters/terraform/policy/checkov_adapter.py
-TYPECHECK_OK
-```
-
-`bash -n` (syntax) + `py_compile` (byte-compile) all pass.
-
-### 2.3 Schema cross-checks (PLAN.md self-verify test instances)
-
-Run from `/tmp` to avoid the repo `platform/` package shadowing stdlib
-`platform` (see Layer 3 §3.3):
-
-```
-OK: qa without validation fails
-OK: prod without runbook fails
-OK: dr without drDrillRef fails
-OK: agentic without NLI fails
-OK: agentic with NLI passes
-OK: staging rejected
-OK: valid PCR passes
-ALL_SCHEMA_CROSSCHECKS_OK
-```
-
-`environment` enum confirmed `[dev, qa, prod, dr]` — no `staging`
-(Path A locked, ARCHITECTURE.md §5). Per-env mandatory conditionals all
-fire correctly.
-
-### 2.4 Confidence signal behavioral spot-checks (REQ-19)
-
-Run from `/tmp` with `sys.path.insert(0, '/root/acdl')`:
-
-- **Missing input → block + INPUT_MISSING:** `compute('cid','dev', inputs)`
-  with `nfrs` omitted returns `Signal(0.0, "block", {}, ["INPUT_MISSING:nfrs"])`. ✅
-- **Critical fail → 0.0 block + CRITICAL_OVERRIDE:** `compute('cid','dev', inputs)`
-  with one `severity:"critical", result:"fail"` PolicyCheckResult returns
-  `Signal(0.0, "block", per_input, ["CRITICAL_OVERRIDE:CKV_AWS_X"])`
-  regardless of other inputs. ✅
-- **Cold-start dev → pass ≥ 0.50:** `compute('cid','dev', inputs)` with
-  the ACDL_TAG_NAMING `skipped` PolicyCheckResult + all validation true
-  + neutral 0.5 for freshness/source/history/nfrs returns
-  `Signal(0.950, "pass", ...)`. ✅ (0.95 ≥ 0.50 dev threshold).
-
-Note: the `WEIGHTS` dict keys are `policy / validation / freshness /
-source / history / nfrs` (the canonical names), not the docstring's
-`policy_results` label — the docstring describes the input's *type*
-("list[PolicyCheckResult]"); the `compute()` loop iterates
-`WEIGHTS.items()` and reads `inputs.get("policy")` (the key). This is
-consistent with the Wave 4 self-verify ("`policy_results`" in the
-docstring is the descriptive label, `policy` is the dict key — verified
-at runtime).
-
-### 2.5 Separation-of-duties behavioral spot-checks (REQ-21)
-
-- `check(None, "cid", "anyone")` → `(True, "no outbox client (dev-only spike)")`. ✅
-- `check(stub_returning_None, "cid", "anyone")` → `(True, "no prior approver (first promotion)")`. ✅
-- `check(stub_with_approver_qa("alice"), "cid", "alice")` → `(False, "SEPARATION_OF_DUTIES_VIOLATION: qaApprover==prodApprover==alice")`. ✅
-- `check(stub_with_approver_qa("alice"), "cid", "bob")` → `(True, "distinct")`. ✅
-- `check(stub_with_empty_approver_qa, "cid", "alice")` → `(True, "no QA approver recorded (dev-only spike)")`. ✅
-
-All SoD branches match PLAN.md T-7.8 spec.
-
-### 2.6 Checkov adapter behavioral spot-check (REQ-18 adapter)
-
-Synthetic Checkov JSON with one failed `CKV_AWS_24`:
-
-```
-$ python3 adapters/terraform/policy/checkov_adapter.py fixture.json test-contract-id
-[
-  {
-    "contractId": "test-contract-id",
-    "evaluatedAt": "2026-07-21T18:49:11Z",
-    "engine": "checkov",
-    "ruleId": "CKV_AWS_24",
-    "severity": "medium",        ← per RULE_MAP (public-ingress SG 0.0.0.0/0)
-    "result": "fail",
-    "message": "SG 0.0.0.0/0 on 22",
-    "evidence": {"file_path": null, "resource": "aws_security_group.r1",
-                 "resource_address": "aws_security_group.r1", "code_block": null},
-    "resourceRef": "aws_security_group.r1"
-  },
-  {
-    "contractId": "test-contract-id",
-    "ruleId": "ACDL_TAG_NAMING",   ← D-043 appended SKIPPED record
-    "severity": "info",
-    "result": "skipped",
-    "message": "tag/naming check deferred to v1.2 (D-043)",
-    "evidence": {},
-    "resourceRef": ""
-  }
-]
-```
-
-Severity correctly defaulted to `medium` for `CKV_AWS_24` from `RULE_MAP`;
-`ACDL_TAG_NAMING` SKIPPED record appended (D-043). Both records validate
-against `schemas/policy_check_result.schema.json`.
-
-## Layer 3 — Security: PASS
-
-### 3.1 No credentials/secrets introduced
-
-Files touched by Phase 07 (v1.1.1..v1.1.2):
-
-```
-$ git log v1.1.1..v1.1.2 --diff-filter=A --name-only --pretty=format: | sort -u
-.ciagent/PLAN.md
-.ciagent/REQUIREMENTS.md
-.ciagent/ROADMAP.md
-.ciagent/VERIFY.md
-adapters/terraform/policy/__init__.py
-adapters/terraform/policy/checkov_adapter.py
-docs/architecture-v1.0.md
-platform/__init__.py
-platform/audit_ledger_design.md
-platform/confidence_signal.py
-platform/hitl_matrix_design.md
-platform/separation_of_duties.py
-schemas/contract.schema.json
-schemas/ir.schema.json
-schemas/policy_check_result.schema.json
-scripts/verify_phase07.sh
-```
-
-No `.env`, no `*.tfstate`, no `*_key*`, no `credentials*` files. Phase 07
-is design authoring + stdlib-only Python — no AWS/TF runtime calls, no
-boto3 imports (the spike passes a duck-typed `outbox_client`).
-
-### 3.2 LSP diagnostic on `platform/confidence_signal.py:148` is a false positive
-
-```
-$ python3 -m py_compile platform/confidence_signal.py
-$ python3 -c "import ast; ast.parse(open('platform/confidence_signal.py').read()); print('AST parse OK')"
-AST parse OK
-```
-
-At L148, `p = PENALTY.get(sev, 0.0)` — `sev` comes from
-`pcr.get("severity")` where `pcr` is `Dict[str, Any]`. The LSP
-("No overloads for `get` match the provided arguments") is a known
-false-positive when `.get()` is called on a `Dict[str, Any]` value
-in some pyright configurations. `py_compile` passes; runtime behavior
-is verified correct in §2.4 (the critical-override branch returns the
-expected `CRITICAL_OVERRIDE:<ruleId>` and the `None` sentinel correctly
-short-circuits via `if p is None:` at L149). Not a real bug.
-
-### 3.3 `platform/` package shadows stdlib `platform` — documented + worked around
-
-The repo's `platform/` Python package (our code) shadows the stdlib
-`platform` module when the repo root is on `sys.path[0]` (which a
-`python3 -c` invocation from repo root triggers). `jsonschema` imports
-`uuid` → `uuid` imports `platform.system()` → fails with
-`AttributeError: module 'platform' has no attribute 'system'`.
-
-`scripts/verify_phase07.sh` documents this and works around it by
-running all `jsonschema`-invoking python from `/tmp` with absolute
-paths to the schemas:
-
-```
-$ grep -n "platform\|cd /tmp\|sys.path\|shadow" scripts/verify_phase07.sh
-24: # Run python from /tmp so the repo's `platform/` package does not shadow the
-25: # stdlib `platform` module (jsonschema imports uuid -> platform.system();
-26: # our platform/ shadows it when cwd is repo root and on sys.path[0]).
-28:   ( cd /tmp && python3 -c "..." )
-70:   ( cd /tmp && python3 -c "..." )
-78:   ( cd /tmp && python3 -c "..." )
-```
-
-The workaround is correct: `cwd=/tmp` puts `/tmp` at `sys.path[0]`, so
-`import platform` resolves to the stdlib, not our package; the schemas
-are passed by absolute path. The verify script passes (§2.1), and my
-inline behavioral spot-checks (§2.3–2.5) reproduced the workaround by
-running from `/tmp` + `sys.path.insert(0, '/root/acdl')` to import our
-modules explicitly.
-
-**P1 — flag for post-hoc cleanup:** a v1.2 rename of `platform/` to
-`acdl_platform/` (or moving the package under a `src/` layout) would
-avoid the shadowing entirely, removing the need for the `/tmp` dance in
-every jsonschema-invoking test. This is out of Phase 07 scope (Phase 07
-must ship the `platform/` layout the README + PLAN.md committed to).
-Flagged for v1.2.
-
-### 3.4 No `import boto3` in the Phase 07 .py files
-
-```
-$ grep -nE "^import |^from " platform/confidence_signal.py \
-                          platform/separation_of_duties.py \
-                          adapters/terraform/policy/checkov_adapter.py
-platform/confidence_signal.py:34: from dataclasses import dataclass, asdict
-platform/confidence_signal.py:35: from typing import List, Literal, Optional, Dict, Any
-platform/confidence_signal.py:36: import json
-platform/confidence_signal.py:37: import sys
-platform/separation_of_duties.py:14: from typing import Optional, Tuple
-adapters/terraform/policy/checkov_adapter.py:13: import datetime
-adapters/terraform/policy/checkov_adapter.py:14: import json
-adapters/terraform/policy/checkov_adapter.py:15: import sys
-```
-
-Stdlib only across all 3 modules. The SoD `check()` signature receives
-a duck-typed `outbox_client` (has `.get(pk)`); the pipeline step owns the
-boto3 client. PLAN.md T-7.8 spec satisfied.
-
-## Layer 4 — Quality: PASS
-
-### 4.1 README layout table still matches reality
-
-```
-$ grep -n "platform/\|schemas/\|adapters/" README.md
-31: | `platform/` | Platform code: confidence signal, contract resolver, outbox, HITL/ledger designs | Phase 07+ |
-32: | `schemas/`  | JSON Schemas: IR, PolicyCheckResult, contract | Phase 07 |
-33: | `adapters/` | Substrate adapters (Terraform adapter in v1; the only substrate-specific code per §12) | Phase 09 |
-```
-
-README's "Phase 07+" and "Phase 07" annotations are now accurate —
-`platform/` and `schemas/` are populated with the 9 deliverable files
-(no longer just `.gitkeep`'d). `adapters/` is annotated "Phase 09"
-which is also accurate: only the `policy/` subdirectory is populated in
-Phase 07 (the Checkov adapter, REQ-18), and the rest of the adapter
-surface (the IR→Terraform module compiler) is Phase 09.
-
-### 4.2 Phase 07 commit messages all carry `---ci---` blocks
-
-Phase 07 commits on main (v1.1.1..v1.1.2):
-
-```
-8723206  ship: phase-07 architecture-v1-finalization (v1.1.2)
-412e1ef  phase: 7, status: plan-as-execute, persona: lead-developer, task: T-7.10
-68d90c0  phase: 7, status: plan-as-execute, persona: backend-engineer+security-engineer, task: T-7.9
-6ed93f0  phase: 7, status: plan-as-execute, persona: security-engineer, task: T-7.4..T-7.8
-f8e99ed  phase: 7, status: plan-as-execute, persona: platform-engineer+backend-engineer, task: T-7.2+T-7.3
-92d4535  phase: 7, status: plan-as-execute, persona: lead-developer, task: T-7.1
-b40aadd  docs(P07): create Phase 07 plan (architecture-v1-finalization)
-```
-
-Each execute commit + the ship commit carries a `---ci---` block with
-`project / phase / milestone / status / persona / task` (execute commits)
-or `release.tag` (ship commit). Verified by inspecting commit bodies
-(`git log v1.1.1..v1.1.2 --pretty=format:'%H %s%n---%n%b%n---'`):
-T-7.1, T-7.2+7.3, T-7.4..7.8, T-7.9, T-7.10, and the merge all include
-well-formed `---ci---` blocks. ✅
-
-### 4.3 `ROADMAP.md` Phase 07 status = "complete (v1.1.2)"
-
-```
-$ grep -n "Phase 07\|complete.*v1.1.2\|status" .ciagent/ROADMAP.md | head -5
-91: ### Phase 07 — architecture-v1-finalization
-93: - **Status:** complete (v1.1.2)
-```
-
-### 4.4 `REQUIREMENTS.md` traceability — REQ-16..22 complete (v1.1.2)
-
-```
-$ grep -n "REQ-1[6-9]\|REQ-2[0-2]" .ciagent/REQUIREMENTS.md | tail -7
-117: | REQ-16 | 07 | complete (v1.1.2) |
-118: | REQ-17 | 07 | complete (v1.1.2) |
-119: | REQ-18 | 07 | complete (v1.1.2) |
-120: | REQ-19 | 07 | complete (v1.1.2) |
-121: | REQ-20 | 07 | complete (v1.1.2) |
-122: | REQ-21 | 07 | complete (v1.1.2) |
-123: | REQ-22 | 07 | complete (v1.1.2) |
-```
-
-All 7 Phase 07 requirements marked complete at v1.1.2.
-
-### 4.5 `docs/architecture-v1.0.md` internal consistency
-
-- The §15 table's 6 files (8 underlying paths) all exist on disk
-  (verified via `os.path.exists` for every entry). ✅
-- The 11 resolutions in the §13 markers (L75–425) match the
-  `PROJECT.md` "Open-decision resolutions" table (L178–189) verbatim
-  (W1.A, W1.B, W2.A, W3.D, W3.E, BA.A, BA.B, BA.C, BA.D, BA.E, BA.F) +
-  the Q1.3-OpenTofu sub-decision. ✅
-- Decisions D-034..D-046 all present in `PROJECT.md` (the decision
-  table at L160–172). ✅
-
-## Issues found
-
-### P0 (blocking) — none
-
-No P0 issues. All must-haves from PLAN.md are satisfied; the phase gate
-`scripts/verify_phase07.sh` is green; behavioral spot-checks all pass.
-
-### P1 (post-hoc cleanup, out of Phase 07 scope)
-
-- **P1-1: `platform/` package shadows stdlib `platform`.** The repo's
-  `platform/` directory is a Python package that shadows the stdlib
-  `platform` module when the repo root is on `sys.path` (any `python3 -c`
-  from repo root). This breaks `jsonschema` (which imports `uuid` →
-  `platform.system()`). `scripts/verify_phase07.sh` works around it by
-  running jsonschema-invoking python from `/tmp`, but the workaround is
-  brittle — every future test script that imports `jsonschema` (or any
-  stdlib module that transitively imports `platform`) from repo root
-  will hit the same shadow. Recommended v1.2 fix: rename `platform/` →
-  `acdl_platform/` (or adopt a `src/` layout) so the package no longer
-  collides with the stdlib name. Out of Phase 07 scope (the layout is
-  locked by Phase 06 + README + PLAN.md).
-
-- **P1-2: LSP false positive on `platform/confidence_signal.py:148`.**
-  The "No overloads for `get` match the provided arguments" diagnostic
-  is a pyright false positive triggered by `Dict[str, Any]` typing on
-  `pcr`. `py_compile` passes; runtime behavior is correct (verified in
-  §2.4). No fix needed in Phase 07; if a v1.2 type tightening pass
-  happens, replacing `Dict[str, Any]` with a `TypedDict` for
-  `PolicyCheckResult` would silence the LSP and improve type safety.
-
-## Requirement coverage summary
-
-| REQ | File(s) | Status |
-|-----|---------|--------|
-| REQ-16 | `docs/architecture-v1.0.md` | covered (v1.1.2) |
-| REQ-17 | `schemas/ir.schema.json` | covered (v1.1.2) |
-| REQ-18 | `schemas/policy_check_result.schema.json` + `adapters/terraform/policy/checkov_adapter.py` | covered (v1.1.2) |
-| REQ-19 | `platform/confidence_signal.py` | covered (v1.1.2) |
-| REQ-20 | `platform/audit_ledger_design.md` | covered (v1.1.2) |
-| REQ-21 | `platform/hitl_matrix_design.md` + `platform/separation_of_duties.py` | covered (v1.1.2) |
-| REQ-22 | `schemas/contract.schema.json` | covered (v1.1.2) |
-
-All 7 Phase 07 requirements covered. No partials.
-
-## Final verdict
-
-Phase 07: VERIFIED
+# Phase 18 — Verify (v1.3.2)
+
+## Structural
+
+All 11 new files confirmed present: pyproject.toml, requirements-test.txt,
+tests/__init__.py, tests/conftest.py, tests/test_adapter.py,
+tests/test_confidence_signal.py, tests/test_checkov_adapter.py,
+tests/test_outbox_writer.py, tests/test_pipeline.py,
+.gitea/workflows/ci.yml, .github/workflows/ci.yml. **PASS.**
+
+## Behavioral
+
+- `py_compile` passes on all Python files. **PASS.**
+- `pytest` — 90 tests, all passing, all offline (moto for DynamoDB
+  mocking). **PASS.**
+- `run_platform.sh --check-only` — exits 0, outputs
+  "PLATFORM CHECK OK", requires no AWS credentials. **PASS.**
+- `run_platform.sh --plan-only` — syntax valid (unchanged from phase 17).
+  **PASS.**
+- Both workflow YAMLs are valid YAML, parseable. **PASS.**
+- Workflows are byte-identical (diff confirms). **PASS.**
+
+## Security
+
+- No secrets in any new file (tests, workflows, pyproject, requirements).
+  **PASS.**
+- CI pipelines do not use any AWS credentials — `--check-only` is fully
+  offline. **PASS.**
+
+## Quality
+
+- pyproject.toml has pytest config (testpaths, markers, addopts).
+  **PASS.**
+- requirements-test.txt pins all test deps. **PASS.**
+- Test suite covers all 4 platform components (adapter, confidence
+  signal, checkov adapter, outbox writer) + pipeline integration.
+  **PASS.**
+- Both workflows run 3 stages: lint, test, check-only. **PASS.**
+- README updated with "Test the platform" section + CI/CD documentation.
+  **PASS.**
+
+## Verdict
+
+**VERIFY PASS** — all four layers pass. 90 offline tests, no AWS
+required for CI.

.ciagent/config.json

@@ -4,8 +4,8 @@
     {
       "slug": "acdl",
       "name": "Agentic Cloud Delivery Platform",
-      "milestone": "v1.1",
-      "status": "specify"
+      "milestone": "v1.4",
+      "status": "active"
     }
   ],
   "active_project": "acdl",

.gitea/workflows/ci.yml

@@ -0,0 +1,74 @@
+# ACDL CI Pipeline — Gitea Actions (dev environment)
+#
+# This workflow implements the central pipeline contract:
+#   pipelines/ci.yaml (validated against schemas/pipeline.schema.json)
+#
+# The same contract is implemented by .github/workflows/ci.yml (GitHub
+# Actions, production). Both files must be byte-identical — the only
+# declared difference is the forge/runtime, not the stages or commands.
+#
+# Shell reproducibility: scripts/run_ci.sh runs the same 3 stages locally.
+#
+# Stages (from the contract):
+#   1. lint       — py_compile all Python files
+#   2. test       — pytest test suite (offline, no AWS)
+#   3. check-only — run_platform.sh --check-only (offline, no AWS)
+name: acdl-ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Compile all Python files
+        run: |
+          python3 -m py_compile \
+            acdl_platform/confidence_signal.py \
+            acdl_platform/outbox_writer.py \
+            adapters/terraform/adapter.py \
+            adapters/terraform/policy/checkov_adapter.py \
+            scripts/push_consumer_image.py
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install test dependencies
+        run: pip install -r requirements-test.txt
+
+      - name: Run pytest
+        run: python3 -m pytest tests/ -v --tb=short
+
+  check-only:
+    name: Platform check-only (offline)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install runtime dependencies
+        run: pip install jsonschema pyyaml boto3
+
+      - name: Run platform check-only
+        run: bash scripts/run_platform.sh --check-only

.github/workflows/ci.yml

@@ -0,0 +1,74 @@
+# ACDL CI Pipeline — Gitea Actions (dev environment)
+#
+# This workflow implements the central pipeline contract:
+#   pipelines/ci.yaml (validated against schemas/pipeline.schema.json)
+#
+# The same contract is implemented by .github/workflows/ci.yml (GitHub
+# Actions, production). Both files must be byte-identical — the only
+# declared difference is the forge/runtime, not the stages or commands.
+#
+# Shell reproducibility: scripts/run_ci.sh runs the same 3 stages locally.
+#
+# Stages (from the contract):
+#   1. lint       — py_compile all Python files
+#   2. test       — pytest test suite (offline, no AWS)
+#   3. check-only — run_platform.sh --check-only (offline, no AWS)
+name: acdl-ci
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Compile all Python files
+        run: |
+          python3 -m py_compile \
+            acdl_platform/confidence_signal.py \
+            acdl_platform/outbox_writer.py \
+            adapters/terraform/adapter.py \
+            adapters/terraform/policy/checkov_adapter.py \
+            scripts/push_consumer_image.py
+
+  test:
+    name: Test
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install test dependencies
+        run: pip install -r requirements-test.txt
+
+      - name: Run pytest
+        run: python3 -m pytest tests/ -v --tb=short
+
+  check-only:
+    name: Platform check-only (offline)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+
+      - name: Install runtime dependencies
+        run: pip install jsonschema pyyaml boto3
+
+      - name: Run platform check-only
+        run: bash scripts/run_platform.sh --check-only

.gitignore

@@ -9,4 +9,12 @@ audit.json
 .DS_Store
 runner-data/
 .env.secrets
-terraform/bootstrap/.bootstrap_state.json
+terraform/bootstrap/.bootstrap_state.json
+terraform/spike/.terraform/
+terraform/spike/.terraform.lock.hcl
+terraform/spike/tfplan
+terraform/spike/*.tfstate*
+terraform/microservice/.terraform/
+terraform/microservice/.terraform.lock.hcl
+terraform/microservice/tfplan
+terraform/microservice/*.tfstate*

README.md

@@ -8,45 +8,232 @@ a production deployment by declaring intent, without authoring a workflow,
 a configuration file, or a Terraform module.
 
 - **Vision** (the why): [`docs/vision.md`](docs/vision.md)
-- **Architecture** (the how): [`docs/architecture.md`](docs/architecture.md)
+- **Architecture** (the how): [`docs/architecture.md`](docs/architecture.md) + [`.ciagent/ARCHITECTURE.md`](.ciagent/ARCHITECTURE.md)
 - **Decisions**: [`.ciagent/PROJECT.md`](.ciagent/PROJECT.md)
-- **Target architecture**: [`.ciagent/ARCHITECTURE.md`](.ciagent/ARCHITECTURE.md)
 - **Phase plan**: [`.ciagent/ROADMAP.md`](.ciagent/ROADMAP.md)
 
 ## Status
 
-- **v1.1 (active):** architecture finalization + v1 spike. Finalize the
-  architecture to v1.0 (resolve the 11 open design decisions) and prove the
-  locked commitments with one end-to-end implementation spike
+- **v1.4 (active):** central pipeline contract + shell reproducibility +
+  output streaming. A declarative pipeline contract
+  (`schemas/pipeline.schema.json` + `pipelines/ci.yaml`) binds the Gitea
+  and GitHub workflows to a single source of truth. `scripts/run_ci.sh`
+  mirrors the CI pipeline locally. `scripts/run_platform.sh` streams
+  terraform/checkov output by default. Ship tag `v1.4.1`.
+- **v1.3 (complete, tag `v1.3.2`):** module documentation + thin-composition
+  removal. The L2 composition layer is removed; module READMEs are built
+  out. Testing + CI/CD pipelines (pytest, `--check-only`, Gitea + GitHub
+  workflows).
+- **v1.2 (complete, tag `v1.3.0`):** platform hardening + first real
+  consumer deployment. Harden the v1.1 spike's NFRs, simplify the setup,
+  rewrite the docs, and prove the platform delivers real value by
+  deploying a basic microservice to AWS ECS Fargate end-to-end (`terraform
+  apply`, dev autonomous).
+- **v1.1 (complete, tag `v1.2.0`):** architecture finalization + v1 spike.
+  Finalized the architecture to v1.0 (resolved all 11 open design
+  decisions) and proved the IR commitments hold with one end-to-end spike
   (`l1-s3` + `l2-static-asset` + Terraform adapter → real `terraform plan`
-  against AWS).
-- **v1.0 demo (complete, archived):** tag `v1.1.0`. The 30-minute
-  stub-driven executive demo is preserved under `demo/` as the intent
-  reference; it is not the platform.
+  against AWS). Gitea release id 202.
+- **v1.0 demo (complete, archived under `demo/`, tag `v1.1.0`):** the
+  30-minute stub-driven executive demo. Preserved as the intent reference;
+  it is not the platform.
 
-## Repository layout
+## How the platform works
 
-| Path | Purpose | Populated |
-|------|---------|-----------|
-| `acdl_platform/` | Platform code: confidence signal, contract resolver, outbox, HITL/ledger designs (renamed from `platform/` in Phase 08 to avoid shadowing the stdlib `platform` module) | Phase 07+ |
-| `schemas/` | JSON Schemas: IR, PolicyCheckResult, contract | Phase 07 |
-| `adapters/` | Substrate adapters (Terraform adapter in v1; the only substrate-specific code per §12) | Phase 09 |
-| `terraform/` | State backend + provider config (S3 state + DynamoDB lock) | Phase 08+ |
-| `modules-ir/` | IR-typed L1/L2 modules (`l1-s3`, `l2-static-asset`) | Phase 09–10 |
-| `scripts/` | v1.1 verify scripts (`verify_phaseNN.sh`) | Phase 06+ |
-| `demo/` | Archived v1.0 executive demo (tag `v1.1.0`); runs locally via `demo/scripts/run_demo.sh --no-upload` | complete |
-| `.ciagent/` | CIAgent metadata (plans, decisions, personas, roadmap, research) | active |
-| `docs/` | Upstream vision + architecture sources | active |
+The platform is **four layers + six cross-cutting concerns**, bound by the
+vision's "Two Consumer Surfaces, One Platform" tenet: technical developers
+(L3A) and non-technical consumers (L3B) converge on the same contract
+schema, the same policy envelope, and the same evidence stream.
 
-## Running the archived demo
+### The v1.1 spike flow (end-to-end)
 
-The v1.0 demo is an archived artifact. To re-run it locally:
+```
+contracts/spike.yaml
+        │  (contract schema validation)
+        ▼
+acdl_platform/contract_resolver.py  ──▶ Target Stack IR (JSON)
+        │  (IR schema validation)
+        ▼
+adapters/terraform/adapter.py  ──▶ terraform/spike/{main,terraform,providers}.tf
+        │  (the only substrate-specific code)
+        ▼
+terraform plan  (real AWS, via the rotated spike key — D-039/D-047)
+        │
+        ▼
+adapters/terraform/policy/checkov_adapter.py  ──▶ PolicyCheckResult (JSON list)
+        │  (normalized, engine-agnostic)
+        ▼
+acdl_platform/confidence_signal.py  ──▶ { score, band, perInput, reasonCodes }
+        │  (6 inputs: policy, validation, freshness, source, history, nfrs)
+        ▼
+acdl_platform/outbox_writer.py  ──▶ DynamoDB outbox (acdl-outbox)
+        │  (hash-chained evidence event)
+        ▼
+acdl-evidence timeline (acdl-evidence repo, raw-file served)
+```
+
+The spike validates the architecture's claim that the **IR-shaped
+commitments do not require a polyglot mess**: the adapter is the only
+substrate-specific code. `modules-ir/`, `schemas/`, `contracts/`,
+`acdl_platform/confidence_signal.py`, `acdl_platform/contract_resolver.py`,
+and `acdl_platform/outbox_writer.py` are all substrate-agnostic (no
+`aws_s3_bucket` / `aws_` Terraform terms).
+
+### What's different in v1.2
+
+v1.2 extends the spike to a real, simpler, better-documented platform that
+**deploys a microservice to ECS Fargate**:
+
+- Six new IR-typed L1s: `l1-vpc`, `l1-ecs-cluster`, `l1-ecs-service`,
+  `l1-iam-role`, `l1-alb`, `l1-ecr`.
+- One new L2 thin-composition: `l2-microservice` (references the six L1s).
+- `terraform apply` (dev, autonomous per §10, confidence ≥ 0.50) — real
+  provisioning, not just `plan`.
+- A new consumer repo `acdl-consumer-microservice` with a basic HTTP
+  container + Dockerfile + ECR push + contract submission.
+- One `scripts/run_platform.sh` (consolidated from the v1.1 spike scripts).
+- NFR hardening: least-privilege IAM (expanded for ECS), idempotent
+  bootstrap, proper error handling, P1-1 redaction.
+
+## How to run
+
+### Prerequisites
+
+- AWS account + the rotated spike key in `.env.secrets` (see
+  `scripts/rotate_spike_key.sh`; the bootstrap root key was deactivated
+  per D-034 closure).
+- `terraform` (pin `1.9.*`), `checkov` (pin `>=3.2,<4`), `python3` + `boto3`
+  + `jsonschema`.
+
+### Run the platform pipeline end-to-end
+
+```bash
+# 1. Bootstrap the AWS state backend + spike IAM user (one-time, idempotent)
+#    (requires the bootstrap root key in env — now deactivated; skip if
+#    the state bucket + acdl-spike-runner already exist)
+ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID=... ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY=... \
+  python3 terraform/bootstrap/create_state_backend.py
+ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID=... ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY=... \
+  python3 terraform/bootstrap/create_iam_user.py  # prints the initial key
+
+# 2. Rotate the spike key (writes .env.secrets, gitignored)
+ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID=... ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY=... \
+  bash scripts/rotate_spike_key.sh
+
+# 3. Run the full platform pipeline (IR -> adapter -> plan -> Checkov ->
+#    confidence -> outbox). Output is streamed to stdout by default.
+bash scripts/run_platform.sh
+# Expected: "=== PLATFORM E2E OK ==="
+
+# Or plan-only (IR -> adapter -> terraform plan; no Checkov/outbox):
+bash scripts/run_platform.sh --plan-only
+
+# Add --quiet to suppress streaming (output to log files only):
+bash scripts/run_platform.sh --quiet
+```
+
+### Test the platform (offline, no AWS required)
+
+```bash
+# Install test dependencies
+pip install -r requirements-test.txt
+
+# Run the test suite (122 tests, all offline — uses moto for DynamoDB mocking)
+python3 -m pytest tests/ -v
+
+# Run the platform in check-only mode (offline — no AWS, no Checkov, no outbox)
+# Streams the emitted Terraform to stdout by default; --quiet suppresses it
+bash scripts/run_platform.sh --check-only
+# Expected: "=== PLATFORM CHECK OK ==="
+
+# Reproduce the full CI pipeline locally (lint → test → check-only)
+bash scripts/run_ci.sh
+# Expected: "=== CI PIPELINE OK ==="
+```
+
+### CI/CD pipelines
+
+The CI/CD pipeline is defined by a **central pipeline contract** — a
+declarative YAML instance (`pipelines/ci.yaml`) validated against a JSON
+Schema (`schemas/pipeline.schema.json`). Both forge workflows implement
+the same contract:
+
+- `.gitea/workflows/ci.yml` — Gitea Actions (dev environment)
+- `.github/workflows/ci.yml` — GitHub Actions (production)
+
+Both workflow files are **byte-identical** — the only difference is the
+forge runtime. Both run three stages: **lint** (py_compile), **test**
+(pytest), and **check-only** (`run_platform.sh --check-only`). Both
+trigger on push to `main` and on pull requests. A test
+(`tests/test_pipeline_contract.py`) validates that both workflows conform
+to the contract.
+
+`scripts/run_ci.sh` mirrors the CI pipeline locally — running the same
+three stages in sequence. This makes the pipeline fully reproducible from
+the shell, not just in CI:
+
+```bash
+bash scripts/run_ci.sh           # run all 3 stages (lint, test, check-only)
+bash scripts/run_ci.sh --quiet    # suppress per-stage banners
+```
+
+### Output streaming (run_platform.sh)
+
+`scripts/run_platform.sh` streams output by default so the user can see
+what the platform is doing:
+
+- **`--check-only`**: streams the emitted Terraform file content to stdout
+- **`--plan-only`** and **full mode**: streams `terraform init`, `terraform
+  validate`, and `terraform plan` output via `tee` (visible and logged)
+- **Full mode**: prints Checkov compliance results and each
+  PolicyCheckResult record with severity, rule ID, and pass/fail status
+
+A `--quiet` flag suppresses streaming (output to log files only) for
+backwards-compatible log-only mode.
+
+### Re-run the archived v1.0 demo (stubs only, no AWS)
 
 ```bash
 bash demo/scripts/run_demo.sh --no-upload
 ```
 
-The demo deck is at [`demo/ACDL_DEMO.md`](demo/ACDL_DEMO.md). The demo runs
+The demo deck is at [`demo/ACDL_DEMO.md`](demo/ACDL_DEMO.md). It runs
 entirely on local stubs — no AWS, no AI — and shows intent and safety
-behavior rather than provisioning real cloud resources. It is the reference
-of intent for the real platform; it is not the platform itself.
+behavior rather than provisioning real cloud resources.
+
+## Repository layout
+
+| Path | Purpose | Status |
+|------|---------|--------|
+| `acdl_platform/` | Platform code: confidence signal, outbox writer, separation of duties, HITL/ledger designs | v1.1 complete; v1.3 removes contract_resolver |
+| `schemas/` | JSON Schemas: IR, PolicyCheckResult, pipeline contract (draft 2020-12) | v1.1 complete; v1.4 adds pipeline schema |
+| `pipelines/` | Central pipeline contract: `ci.yaml` (YAML instance validated against `schemas/pipeline.schema.json`) | v1.4 |
+| `adapters/` | Substrate adapters — Terraform adapter (the only substrate-specific code per §12) + Checkov policy adapter | v1.1 complete; v1.2 expands `TYPE_MAP` |
+| `terraform/` | State backend (S3 + DynamoDB) + spike TF (`terraform/spike/`) + bootstrap scripts (`terraform/bootstrap/`) | v1.1 complete; v1.2 adds ECS apply |
+| `modules-ir/` | IR-typed L1/L2 modules + `registry.json`. v1.1: `l1-s3`. v1.2: + 6 ECS L1s. v1.3: L2 removed (placeholders) | v1.3 |
+| `scripts/` | Platform run script (`run_platform.sh` with `--check-only`/`--plan-only`/`--quiet`), CI pipeline script (`run_ci.sh`), verify scripts, key rotation | v1.4 |
+| `tests/` | Pytest suite (122 tests, all offline — adapter, confidence signal, checkov adapter, outbox writer, pipeline contract, streaming) | v1.4 |
+| `demo/` | Archived v1.0 executive demo (tag `v1.1.0`); runs locally via `demo/scripts/run_demo.sh --no-upload` | complete (archived) |
+| `.ciagent/` | CIAgent metadata (config, project, architecture, requirements, roadmap, personas, plans, research, verify, review, audit) | active |
+| `docs/` | Upstream vision + architecture sources (`vision.md`, `architecture.md`) | active |
+
+## Environments
+
+| Environment | Autonomy | Gate | Status |
+|---|---|---|---|
+| dev | Full autonomy (no HITL) | Confidence ≥ 0.50 | v1.1 spike (`plan`); v1.2 (`apply`) |
+| qa | Held for attestation | QA HITL + confidence ≥ 0.75 | v1.3+ |
+| prod | Held for attestation | SRE HITL + confidence ≥ 0.90 | v1.3+ |
+| dr | Held for attestation | SRE HITL + confidence ≥ 0.95 + dr-drill | v1.3+ |
+
+**Staging does not exist** (Path A locked).
+
+## Credentials
+
+**Long-lived AWS credentials are forbidden** (§12.5). The v1.1 spike uses a
+temporary long-lived key **once** to bootstrap (waiver D-034, now closed —
+the root key was deactivated by the user), then rotates the spike key
+per-run via `scripts/rotate_spike_key.sh` (waiver D-039, extended for v1.2
+as D-047). Real OIDC federation is deferred to v1.3+, blocked on
+[go-gitea/gitea#36988](https://github.com/go-gitea/gitea/pull/36988) (still
+open as of 2026-07-21).

acdl_platform/outbox_writer.py

@@ -0,0 +1,71 @@
+"""ACDL Outbox Writer — write an evidence event to the DynamoDB outbox.
+
+ARCHITECTURE.md §9: DynamoDB outbox, RPO=0 (synchronous write before
+ack). The event is hash-chained (SHA-256 over canonical JSON); the first
+event has prev_event_hash="GENESIS". D-P10-3: the spike writes ONE
+CONFIDENCE_COMPUTED event.
+
+The outbox table (Phase 08): acdl-outbox, PAY_PER_REQUEST, PK contractId,
+SK eventType#eventTs, TTL expire_at = now + 365d (D-044).
+
+CLI: outbox_writer.py <event.json>  (uses AWS creds from env)
+"""
+
+import datetime
+import hashlib
+import json
+import os
+import sys
+
+import boto3
+
+
+OUTBOX_TABLE = "acdl-outbox"
+REGION = os.environ.get("AWS_DEFAULT_REGION", "us-east-1")
+
+
+def _canonical_hash(event):
+    """SHA-256 over canonical JSON (sort_keys, compact separators)."""
+    canonical = json.dumps(event, sort_keys=True, separators=(",", ":"))
+    return hashlib.sha256(canonical.encode("utf-8")).hexdigest()
+
+
+def write_event(event, outbox_table=OUTBOX_TABLE, region=REGION):
+    """Write an evidence event to the DynamoDB outbox. Returns the item dict."""
+    contract_id = event["contractId"]
+    event_type = event.get("eventType", "CONFIDENCE_COMPUTED")
+    event_ts = event.get("ts") or datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+    sk = f"{event_type}#{event_ts}"
+
+    # Chain: first event = GENESIS (D-P10-3 spike writes one event).
+    prev_hash = event.get("prev_event_hash", "GENESIS")
+    event_hash = _canonical_hash(event)
+
+    item = {
+        "contractId": {"S": contract_id},
+        "eventType#eventTs": {"S": sk},
+        "payload": {"S": json.dumps(event, sort_keys=True)},
+        "prev_event_hash": {"S": prev_hash},
+        "hash": {"S": event_hash},
+        "environment": {"S": str(event.get("environment", ""))},
+        "stack": {"S": str(event.get("stack", ""))},
+        "score": {"N": str(event.get("score", 0))},
+        "band": {"S": str(event.get("band", ""))},
+        "expire_at": {"N": str(int((datetime.datetime.now(datetime.timezone.utc) +
+                                     datetime.timedelta(days=365)).timestamp()))},
+    }
+
+    session = boto3.Session(region_name=region)
+    dyn = session.client("dynamodb")
+    dyn.put_item(TableName=outbox_table, Item=item)
+    return item
+
+
+if __name__ == "__main__":
+    if len(sys.argv) != 2:
+        print("usage: outbox_writer.py <event.json>", file=sys.stderr)
+        sys.exit(2)
+    with open(sys.argv[1], "r") as fh:
+        event = json.load(fh)
+    item = write_event(event)
+    print(json.dumps({k: list(v.values())[0] for k, v in item.items()}, indent=2))

adapters/terraform/adapter.py

@@ -0,0 +1,384 @@
+"""ACDL Terraform adapter — compile a Target Stack IR instance to Terraform.
+
+ARCHITECTURE.md §12.2: the adapter translates the IR-typed L1 interface
+to a Terraform variable/output block, the L2 thin-composition tree to a
+root module that calls the L1 modules, the IR-typed relationships to
+Terraform module references, and emits a Terraform plan from the IR.
+
+The adapter is a THIN LAYER; it does not own L1/L2 content — it only
+translates. Substrate-agnostic in, Terraform out.
+
+Phase 09 spike: handled one L1 (l1-s3, IR type aws:s3:bucket).
+Phase 13: generalized the resource/output emission via TYPE_MAP +
+INPUT_MAP + OUTPUT_MAP tables; added ECS Fargate IR types. S3 behavior
+is preserved (regression baseline: modules-ir/l1/l1-s3/spike_instance.json).
+
+CLI: adapter.py <ir_instance.json> <out_dir>
+"""
+
+import json
+import os
+import sys
+
+
+# IR type -> Terraform resource type. The only substrate-specific table.
+# As more L1s land, this grows; the L1 content + IR do not change.
+TYPE_MAP = {
+    "aws:s3:bucket": "aws_s3_bucket",
+    "aws:ec2:vpc": "aws_vpc",
+    "aws:ec2:subnet": "aws_subnet",
+    "aws:ec2:routetable": "aws_route_table",
+    "aws:ecs:cluster": "aws_ecs_cluster",
+    "aws:ecs:task_definition": "aws_ecs_task_definition",
+    "aws:ecs:service": "aws_ecs_service",
+    "aws:iam:role": "aws_iam_role",
+    "aws:elbv2:loadbalancer": "aws_lb",
+    "aws:elbv2:listener": "aws_lb_listener",
+    "aws:elbv2:targetgroup": "aws_lb_target_group",
+    "aws:ecr:repository": "aws_ecr_repository",
+}
+
+# IR input name -> Terraform arg name, per IR type. Only non-identity
+# mappings are listed; any input not present here uses the IR name as
+# the Terraform arg name (identity).
+INPUT_MAP = {
+    "aws:s3:bucket": {"bucket_name": "bucket"},
+    "aws:ec2:vpc": {"cidr": "cidr_block", "name": "_tag_name"},
+    "aws:ec2:subnet": {"cidr": "cidr_block", "az": "availability_zone", "name": "_tag_name", "vpc_id": "vpc_id"},
+    "aws:ec2:routetable": {"vpc_id": "vpc_id", "name": "_tag_name"},
+    "aws:ecs:cluster": {},
+    "aws:ecs:task_definition": {},
+    "aws:ecs:service": {"security_group": "security_groups", "subnets": "subnets", "cluster_arn": "cluster"},
+    "aws:iam:role": {"role_name": "name", "assume_role_policy": "assume_role_policy"},
+    "aws:elbv2:loadbalancer": {"subnets": "subnets", "security_group": "security_groups"},
+    "aws:elbv2:listener": {},
+    "aws:elbv2:targetgroup": {"port": "port", "protocol": "protocol"},
+    "aws:ecr:repository": {},
+}
+
+# IR output name -> Terraform attribute name, per IR type. Only
+# non-identity mappings are listed; any output not present here uses the
+# IR name as the Terraform attribute name (identity).
+OUTPUT_MAP = {
+    "aws:s3:bucket": {"bucket_arn": "arn", "bucket_name": "id"},
+    "aws:ec2:vpc": {"vpc_id": "id"},
+    "aws:ec2:subnet": {"subnet_id": "id"},
+    "aws:ec2:routetable": {},
+    "aws:ecs:cluster": {"cluster_arn": "arn", "cluster_id": "id"},
+    "aws:ecs:task_definition": {"task_def_arn": "arn"},
+    "aws:ecs:service": {"service_arn": "id"},
+    "aws:iam:role": {"role_arn": "arn", "role_id": "id"},
+    "aws:elbv2:loadbalancer": {"lb_arn": "id"},
+    "aws:elbv2:listener": {"listener_arn": "id"},
+    "aws:elbv2:targetgroup": {"target_group_arn": "arn"},
+    "aws:ecr:repository": {"repository_arn": "arn"},
+}
+
+
+def _tf_value(value):
+    """Render a Python value as a Terraform expression fragment."""
+    if isinstance(value, bool):
+        return "true" if value else "false"
+    if isinstance(value, (int, float)) and not isinstance(value, bool):
+        return str(value)
+    if isinstance(value, str):
+        if value.startswith("ref:"):
+            raise ValueError("ref: values must be resolved via _ref_expr, not _tf_value")
+        # Detect a JSON string (object/array) and emit jsonencode() so inner
+        # quotes don't break HCL. Plain strings stay double-quoted.
+        stripped = value.lstrip()
+        if stripped and stripped[0] in "{[" :
+            try:
+                parsed = json.loads(value)
+                if isinstance(parsed, (dict, list)):
+                    return f"jsonencode({json.dumps(parsed, sort_keys=True)})"
+            except json.JSONDecodeError:
+                pass
+        return f'"{value}"'
+    if isinstance(value, (dict, list)):
+        return f"jsonencode({json.dumps(value, sort_keys=True)})"
+    raise ValueError(f"unsupported input value type {type(value).__name__}")
+
+
+def _ref_expr(ref_value, type_by_id):
+    """Translate a "ref:<ir_resource_id>.<output>" string to a Terraform
+    interpolation "${<tf_type>.<id>.<attr>}".
+
+    <ir_resource_id> is the IR resource id of the producing resource;
+    <output> is the per-resource output name (e.g. `subnet_id`,
+    `cluster_arn`); the attribute is mapped through OUTPUT_MAP for the
+    referenced resource's IR type. The resolver emits the ref using the
+    IR resource id directly (not the child id), so no child->resource
+    lookup table is needed here.
+    """
+    body = ref_value[len("ref:"):]
+    rid, out_name = body.split(".", 1)
+    rtype = type_by_id.get(rid)
+    if not rtype:
+        raise ValueError(f"ref to unknown IR resource id {rid!r}")
+    tf_type = TYPE_MAP.get(rtype)
+    if not tf_type:
+        raise ValueError(f"ref target {rid!r} has unknown IR type {rtype!r}")
+    out_map = OUTPUT_MAP.get(rtype, {})
+    tf_attr = out_map.get(out_name, out_name)
+    return f"{tf_type}.{rid}.{tf_attr}"
+
+
+def _value_expr(value, type_by_id=None):
+    """Render a value as a Terraform expression fragment. A "ref:<id>.<output>"
+    string becomes a Terraform interpolation; other values use _tf_value."""
+    if isinstance(value, str) and value.startswith("ref:"):
+        if type_by_id is None:
+            raise ValueError("ref: value encountered without a type_by_id table")
+        return _ref_expr(value, type_by_id)
+    return _tf_value(value)
+
+
+def _emit_resource(resource, type_by_id=None):
+    rtype = resource["type"]
+    rid = resource["id"]
+    tf_type = TYPE_MAP.get(rtype)
+    if not tf_type:
+        raise ValueError(f"unknown IR type {rtype!r} (adapter TYPE_MAP has no entry)")
+    in_map = INPUT_MAP.get(rtype, {})
+    body = []
+    inputs = resource.get("inputs", {})
+    for in_name, value in inputs.items():
+        if in_name == "region":
+            continue
+        arg = in_map.get(in_name, in_name)
+        if arg == "_tag_name":
+            if isinstance(value, str) and not value.startswith("ref:"):
+                tag_name = value
+            else:
+                tag_name = "app"
+            continue
+        if rtype == "aws:ecs:task_definition" and in_name in ("image", "port", "env"):
+            continue
+        if rtype == "aws:iam:role" and in_name == "managed_policies":
+            continue
+        if rtype == "aws:elbv2:loadbalancer" and in_name == "subnets":
+            if isinstance(value, str) and value.startswith("ref:"):
+                body.append(f"subnets = [{_ref_expr(value, type_by_id)}]")
+            else:
+                body.append(f"subnets = [{value}]" if isinstance(value, str) else f"subnets = {_tf_value(value)}")
+            continue
+        if rtype == "aws:elbv2:loadbalancer" and in_name == "security_group":
+            if isinstance(value, str) and value.startswith("ref:"):
+                body.append(f"security_groups = [{_ref_expr(value, type_by_id)}]")
+            else:
+                body.append(f"security_groups = [{value}]" if isinstance(value, str) else f"security_groups = {_tf_value(value)}")
+            continue
+        if rtype == "aws:ec2:routetable" and in_name == "igw_id":
+            continue
+        if rtype == "aws:ecs:service" and in_name == "lb_target_group_arn":
+            if isinstance(value, str) and value.startswith("ref:"):
+                tg_arn = _ref_expr(value, type_by_id)
+            else:
+                tg_arn = _tf_value(value)
+            body.append("load_balancer {")
+            body.append(f"  target_group_arn = {tg_arn}")
+            body.append("  container_name = \"app\"")
+            body.append("  container_port = 8080")
+            body.append("}")
+            continue
+        if rtype == "aws:ecs:service" and in_name in ("subnets", "security_group"):
+            # Collected into network_configuration block (emitted after all inputs).
+            continue
+        body.append(f"{arg} = {_value_expr(value, type_by_id)}")
+    if rtype == "aws:ecs:service":
+        subnets_val = inputs.get("subnets")
+        sg_val = inputs.get("security_group")
+        body.append("network_configuration {")
+        body.append("  subnets = " + (
+            f"[{_ref_expr(subnets_val, type_by_id)}]" if isinstance(subnets_val, str) and subnets_val.startswith("ref:")
+            else _tf_value([subnets_val] if isinstance(subnets_val, str) else subnets_val or [])
+        ))
+        body.append("  security_groups = " + (
+            f"[{_ref_expr(sg_val, type_by_id)}]" if isinstance(sg_val, str) and sg_val.startswith("ref:")
+            else _tf_value([sg_val] if isinstance(sg_val, str) else sg_val or [])
+        ))
+        body.append("}")
+        body.append("desired_count = 1")
+        body.append("launch_type = \"FARGATE\"")
+        body.append("task_definition = aws_ecs_task_definition.service-taskdefinition.arn")
+        body.append("name = \"acdl-microservice\"")
+    nfrs = resource.get("nfrs", {})
+    if isinstance(nfrs, dict) and "versioning" in nfrs and rtype == "aws:s3:bucket":
+        versioning = nfrs.get("versioning", True)
+        body.append("versioning {")
+        body.append(f'  enabled = {"true" if versioning else "false"}')
+        body.append("}")
+    elif rtype == "aws:s3:bucket":
+        body.append("versioning {")
+        body.append("  enabled = true")
+        body.append("}")
+    if rtype == "aws:ecs:task_definition":
+        body.append(_container_definitions(inputs))
+        family = inputs.get("family", "app")
+        body.append(f'family = "{family}"')
+    if rtype in ("aws:ec2:vpc", "aws:ec2:subnet") and "_tag_name" in in_map.values():
+        tag_name = inputs.get("name", "acdl")
+        if isinstance(tag_name, str) and not tag_name.startswith("ref:"):
+            body.append("tags = {")
+            body.append(f'  Name = "{tag_name}"')
+            body.append("}")
+    if rtype == "aws:iam:role" and "managed_policies" in inputs:
+        arns = [a.strip() for a in str(inputs["managed_policies"]).split(",") if a.strip()]
+        body.append("managed_policy_arns = [" + ", ".join(f'"{a}"' for a in arns) + "]")
+    if rtype == "aws:elbv2:listener":
+        body.append("default_action {")
+        body.append("  type = \"forward\"")
+        body.append("  target_group_arn = aws_lb_target_group.alb-targetgroup.arn")
+        body.append("}")
+        body.append("load_balancer_arn = aws_lb.alb-loadbalancer.id")
+    if rtype == "aws:elbv2:loadbalancer":
+        body.append("load_balancer_type = \"application\"")
+    if rtype == "aws:elbv2:targetgroup":
+        body.append("target_type = \"ip\"")
+        body.append("vpc_id = aws_vpc.vpc-vpc.id")
+        body.append("protocol = \"HTTP\"")
+    if rtype == "aws:ec2:routetable":
+        body.append("route {")
+        body.append("  cidr_block = \"0.0.0.0/0\"")
+        body.append("  gateway_id = aws_internet_gateway.vpc-igw.id")
+        body.append("}")
+        body.append("tags = {")
+        body.append('  Name = "acdl-microservice-rt"')
+        body.append("}")
+    return _resource_block(rid, tf_type, body)
+
+
+def _emit_igw(resources):
+    """Emit an internet gateway + route table associations for the VPC."""
+    vpc_id = next((r["id"] for r in resources if r["type"] == "aws:ec2:vpc"), "vpc-vpc")
+    subnet_id = next((r["id"] for r in resources if r["type"] == "aws:ec2:subnet"), "vpc-subnet")
+    rt_id = next((r["id"] for r in resources if r["type"] == "aws:ec2:routetable"), "vpc-routetable")
+    parts = []
+    parts.append(_resource_block("vpc-igw", "aws_internet_gateway", [
+        f"vpc_id = aws_vpc.{vpc_id}.id",
+        "tags = {",
+        '  Name = "acdl-microservice-igw"',
+        "}",
+    ]))
+    parts.append(_resource_block("vpc-rta", "aws_route_table_association", [
+        f"subnet_id = aws_subnet.{subnet_id}.id",
+        f"route_table_id = aws_route_table.{rt_id}.id",
+    ]))
+    return "\n".join(parts)
+
+
+def _container_definitions(inputs):
+    image = inputs.get("image", "")
+    port = inputs.get("port", 80)
+    env_raw = inputs.get("env")
+    environment = []
+    if isinstance(env_raw, dict):
+        for k, v in env_raw.items():
+            environment.append({"name": k, "value": str(v)})
+    elif isinstance(env_raw, str) and env_raw:
+        try:
+            parsed = json.loads(env_raw)
+            if isinstance(parsed, dict):
+                for k, v in parsed.items():
+                    environment.append({"name": k, "value": str(v)})
+        except json.JSONDecodeError:
+            pass
+    container = {
+        "name": "app",
+        "image": image,
+        "essential": True,
+        "portMappings": [{"containerPort": port}],
+    }
+    if environment:
+        container["environment"] = environment
+    return "container_definitions = " + _tf_value([container])
+
+
+def _resource_block(rid, tf_type, body):
+    """Emit a top-level resource block."""
+    head = f'resource "{tf_type}" "{rid}" {{'
+    body_str = "\n".join(f"  {l}" for l in body)
+    return f"{head}\n{body_str}\n}}\n"
+
+
+def _emit_output(output_name, value_expr):
+    return f'output "{output_name}" {{\n  value = {value_expr}\n}}\n'
+
+
+def adapt(ir_instance, out_dir):
+    """Emit main.tf + terraform.tf + providers.tf to out_dir for the IR instance."""
+    os.makedirs(out_dir, exist_ok=True)
+    stack = ir_instance["stack"]
+    resources = ir_instance["resources"]
+
+    # --- providers.tf: aws provider, region from the first resource's inputs.region ---
+    region = "us-east-1"
+    for r in resources:
+        if "region" in r.get("inputs", {}):
+            region = r["inputs"]["region"]
+            break
+    providers_tf = (
+        f'provider "aws" {{\n'
+        f'  region = "{region}"\n'
+        f'}}\n'
+    )
+
+    # --- terraform.tf: required_version + required_providers + S3 backend (no DynamoDB lock per D-P09-1) ---
+    # The backend key is derived from the stack name so l1 vs l2 spikes use separate state keys (D-P10-1).
+    stack_name = stack.get("name", "spike")
+    terraform_tf = (
+        'terraform {\n'
+        '  required_version = ">= 1.9, < 1.10"\n'
+        '  required_providers {\n'
+        '    aws = {\n'
+        '      source  = "hashicorp/aws"\n'
+        '      version = "~> 5.0"\n'
+        '    }\n'
+        '  }\n'
+        '  backend "s3" {\n'
+        '    bucket = "acdl-tfstate-581513795199-us-east-1"\n'
+        f'    key    = "spike/{stack_name}/terraform.tfstate"\n'
+        '    region = "us-east-1"\n'
+        '  }\n'
+        '}\n'
+    )
+
+    # --- main.tf: resources + outputs ---
+    # Build an IR-resource-id -> IR-type table so `ref:` input values can
+    # be resolved to Terraform interpolations without a child->resource
+    # lookup (the resolver emits refs with the IR resource id directly).
+    type_by_id = {r["id"]: r["type"] for r in resources}
+    main_tf_parts = []
+    has_vpc = any(r["type"] == "aws:ec2:vpc" for r in resources)
+    for r in resources:
+        main_tf_parts.append(_emit_resource(r, type_by_id))
+        rid = r["id"]
+        rtype = r["type"]
+        tf_type = TYPE_MAP.get(rtype)
+        out_map = OUTPUT_MAP.get(rtype, {})
+        outputs = r.get("outputs", {})
+        for out_name in outputs:
+            tf_attr = out_map.get(out_name, out_name)
+            main_tf_parts.append(_emit_output(out_name, f"{tf_type}.{rid}.{tf_attr}"))
+    if has_vpc:
+        main_tf_parts.append(_emit_igw(resources))
+    main_tf = "\n".join(main_tf_parts)
+
+    with open(os.path.join(out_dir, "main.tf"), "w") as fh:
+        fh.write(main_tf)
+    with open(os.path.join(out_dir, "terraform.tf"), "w") as fh:
+        fh.write(terraform_tf)
+    with open(os.path.join(out_dir, "providers.tf"), "w") as fh:
+        fh.write(providers_tf)
+    return out_dir
+
+
+if __name__ == "__main__":
+    if len(sys.argv) != 3:
+        print("usage: adapter.py <ir_instance.json> <out_dir>", file=sys.stderr)
+        sys.exit(2)
+    with open(sys.argv[1], "r") as fh:
+        ir = json.load(fh)
+    adapt(ir, sys.argv[2])
+    print(f"adapter: emitted terraform to {sys.argv[2]}", file=sys.stderr)

consumer-repos/acdl-consumer-microservice/Dockerfile

@@ -0,0 +1,7 @@
+FROM python:3.12-slim
+
+WORKDIR /app
+COPY app.py /app/app.py
+
+EXPOSE 8080
+CMD ["python", "/app/app.py"]

consumer-repos/acdl-consumer-microservice/README.md

@@ -0,0 +1,34 @@
+# acdl-consumer-microservice
+
+A basic HTTP microservice for the ACDL v1.2 milestone. Returns 200 on `/`
+and `/health` with a JSON status body. Deployed to AWS ECS Fargate via the
+ACDL platform's `l2-microservice` contract.
+
+## Build + push to ECR
+
+```bash
+# Build
+docker build -t acdl-microservice .
+
+# Tag for ECR
+docker tag acdl-microservice:latest 581513795199.dkr.ecr.us-east-1.amazonaws.com/acdl-microservice:latest
+
+# Authenticate to ECR
+aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin 581513795199.dkr.ecr.us-east-1.amazonaws.com
+
+# Push
+docker push 581513795199.dkr.ecr.us-east-1.amazonaws.com/acdl-microservice:latest
+```
+
+## Contract
+
+The contract submission is at `contracts/microservice.yaml` (or the
+platform's `contracts/microservice.yaml`). Submitting it to the ACDL
+pipeline triggers: contract → IR resolution → `terraform plan` →
+`terraform apply` (dev) → a live ECS Fargate service.
+
+## Endpoints
+
+- `GET /` — 200, `{"status":"ok","service":"acdl-microservice","version":"1.0.0"}`
+- `GET /health` — 200, same body
+- any other path — 404

consumer-repos/acdl-consumer-microservice/app.py

@@ -0,0 +1,37 @@
+"""ACDL consumer microservice — a tiny HTTP server returning 200 on /.
+
+This is the reference consumer microservice for the v1.2 milestone. It's
+intentionally minimal: stdlib only, no framework, no dependencies. The
+platform deploys it to ECS Fargate via the l2-microservice contract.
+"""
+import json
+import os
+from http.server import BaseHTTPRequestHandler, HTTPServer
+
+
+class Handler(BaseHTTPRequestHandler):
+    def do_GET(self):
+        if self.path == "/" or self.path == "/health":
+            body = json.dumps({
+                "status": "ok",
+                "service": "acdl-microservice",
+                "version": "1.0.0",
+            }).encode()
+            self.send_response(200)
+            self.send_header("Content-Type", "application/json")
+            self.send_header("Content-Length", str(len(body)))
+            self.end_headers()
+            self.wfile.write(body)
+        else:
+            self.send_response(404)
+            self.end_headers()
+
+    def log_message(self, format, *args):
+        print(f"{self.address_string()} - {format % args}")
+
+
+if __name__ == "__main__":
+    port = int(os.environ.get("PORT", "8080"))
+    server = HTTPServer(("0.0.0.0", port), Handler)
+    print(f"acdl-microservice listening on :{port}", flush=True)
+    server.serve_forever()

modules-ir/README-TEMPLATE.md

@@ -0,0 +1,50 @@
+# <module-name> — <plain-language description>
+
+> **Module kind:** L1 primitive  |  **Version:** 1.0.0
+
+## Overview
+
+One or two sentences describing what this module provisions, in plain
+language. No jargon. A reader should know after this paragraph whether
+this module is what they need.
+
+## Resources
+
+Terraform resources this module creates:
+
+| Resource | Type | Purpose |
+|----------|------|---------|
+| `<name>` | `aws_<type>` | what it does |
+
+## Inputs
+
+| Name | Type | Required | Default | Description |
+|------|------|----------|---------|-------------|
+| `<name>` | string | yes | — | description |
+
+## Outputs
+
+| Name | Type | Description |
+|------|------|-------------|
+| `<name>` | string | description |
+
+## Usage
+
+```
+# A concrete snippet showing how to reference this module or what a
+# consumer writes to use it.
+```
+
+## Compliance extension points
+
+Resources this module could be extended with for the future compliance
+milestone (GDPR, SOX, SOC2, HIPAA, DORA). Not implemented yet — listed
+so the redesign can plan for them.
+
+- **<area>** — <what could be added, e.g. KMS key for encryption>
+
+## Versioning
+
+`1.0.0` — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR
+bumps require a new registry entry (immutable publication); old entries
+enter a 12-month deprecation window.

modules-ir/README.md

@@ -0,0 +1,51 @@
+# ACDL Modules
+
+Reusable building blocks for cloud infrastructure. Each module is
+self-documented with a `README.md` following the
+[template](README-TEMPLATE.md).
+
+## How the modules work
+
+There are two kinds of module:
+
+- **L1 primitives** — a single cloud resource or a small group of
+  related resources (e.g. a VPC with subnets and routing). Each L1 has
+  an `interface.json` declaring its inputs and outputs, and a `README.md`
+  in plain language.
+- **L2 compositions** — a composition that references multiple L1s to
+  deploy a complete stack (e.g. an ECS Fargate microservice). **The L2
+  composition layer is being redesigned.** The previous implementation
+  has been removed; a new mechanism will be designed in a later phase.
+
+The Terraform adapter (`adapters/terraform/adapter.py`) compiles a
+module instance to Terraform. Each module's README documents which
+Terraform resources it creates.
+
+## L1 primitives
+
+| Module | What it creates | README |
+|--------|----------------|--------|
+| `l1-s3` | `aws_s3_bucket` — a single S3 bucket | [README](l1/l1-s3/README.md) |
+| `l1-vpc` | `aws_vpc` + `aws_subnet` + `aws_route_table` + `aws_internet_gateway` — VPC with subnets and routing | [README](l1/l1-vpc/README.md) |
+| `l1-ecs-cluster` | `aws_ecs_cluster` — ECS Fargate cluster | [README](l1/l1-ecs-cluster/README.md) |
+| `l1-ecs-service` | `aws_ecs_task_definition` + `aws_ecs_service` — Fargate service with task definition | [README](l1/l1-ecs-service/README.md) |
+| `l1-iam-role` | `aws_iam_role` — IAM role with assume-role policy | [README](l1/l1-iam-role/README.md) |
+| `l1-alb` | `aws_lb` + `aws_lb_target_group` + `aws_lb_listener` — Application Load Balancer | [README](l1/l1-alb/README.md) |
+| `l1-ecr` | `aws_ecr_repository` — ECR container image repository | [README](l1/l1-ecr/README.md) |
+
+## L2 compositions
+
+| Module | What it references | README |
+|--------|--------------------|--------|
+| `l2-microservice` | 6 L1s (vpc, cluster, ecr, iam-role, alb, ecs-service) — **under redesign** | [README](l2/l2-microservice/README.md) |
+| `l2-static-asset` | 1 L1 (s3) — **under redesign** | [README](l2/l2-static-asset/README.md) |
+
+## Registry
+
+Module versions are tracked in `registry.json`. Only L1 entries are
+active; L2 entries have been pruned pending the composition redesign.
+
+## Template
+
+New modules should use [README-TEMPLATE.md](README-TEMPLATE.md) as
+their starting point.

modules-ir/l1/l1-alb/README.md

@@ -0,0 +1,71 @@
+# l1-alb — Application Load Balancer (load balancer + target group + listener)
+
+> **Module kind:** L1 primitive  |  **Version:** 1.0.0
+
+An Application Load Balancer with a target group and a listener. This is
+a multi-resource module: it creates a load balancer, a target group, and
+a listener that forwards traffic to the target group. The target group
+is what `l1-ecs-service` registers its tasks with.
+
+## Resources
+
+| Resource | Type | Purpose |
+|----------|------|---------|
+| load_balancer | `aws_lb` | Application load balancer in the VPC subnets |
+| target_group | `aws_lb_target_group` | Target group for the ECS service tasks |
+| listener | `aws_lb_listener` | Listener forwarding the LB port to the target group |
+
+## Inputs
+
+| Name | Type | Required | Default | Description |
+|------|------|----------|---------|-------------|
+| `name` | string | yes | — | Name tag for the load balancer and child resources |
+| `subnets` | string | yes | — | Comma-separated subnet ids (from `l1-vpc`) |
+| `security_group` | string | yes | — | Security group id for the load balancer |
+| `port` | number | no | 80 | Listener port |
+| `protocol` | string | no | `HTTP` | Listener protocol |
+| `region` | string | yes | — | AWS region the load balancer is created in |
+
+## Outputs
+
+| Name | Type | Description |
+|------|------|-------------|
+| `lb_arn` | arn | The load balancer ARN |
+| `listener_arn` | arn | The listener ARN |
+| `target_group_arn` | arn | The target group ARN |
+
+## Usage
+
+```json
+{
+  "id": "alb",
+  "type": "aws:elbv2:loadbalancer",
+  "module": "l1-alb@1.0.0",
+  "inputs": {
+    "name": "acdl-microservice",
+    "subnets": "ref:vpc.subnet_ids",
+    "security_group": "ref:roles.role_arn",
+    "port": 8080,
+    "protocol": "HTTP",
+    "region": "us-east-1"
+  }
+}
+```
+
+The `target_group_arn` output is referenced by `l1-ecs-service` as its
+`lb_target_group_arn` input to wire the service to the ALB.
+
+## Compliance extension points
+
+- **TLS / HTTPS listener** — add `aws_acm_certificate` + `ssl_policy` + `certificate_arn` for encryption in transit (SOC2 CC6.1, PCI-DSS 4.1, HIPAA §164.312(e)(1), GDPR Art.32).
+- **Access logs** — add `access_logs { bucket = ..., prefix = ... }` to the load balancer (SOX, SOC2 CC7.2, DORA ICT audit trail).
+- **Security group rules** — add ingress/egress rules restricting traffic to known sources (SOC2 CC6.6, PCI-DSS 1.2).
+- **Health check** — add a `health_check` block to the target group (SOC2 CC7.3 monitoring, DORA operational resilience).
+- **WAF** — add `aws_wafv2_web_acl_association` for application-layer protection (SOC2 CC7.6, PCI-DSS 6.5, DORA ICT risk).
+- **Deregistration delay** — add `deregistration_delay` for graceful draining (SOC2 CC9.1 resilience).
+
+## Versioning
+
+`1.0.0` — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps
+require a new registry entry (immutable publication); old entries enter
+a 12-month deprecation window.

modules-ir/l1/l1-alb/interface.json

@@ -0,0 +1,76 @@
+{
+  "name": "l1-alb",
+  "version": "1.0.0",
+  "kind": "l1",
+  "type": "aws:elbv2:loadbalancer",
+  "description": "Application Load Balancer primitive (substrate-agnostic IR types aws:elbv2:loadbalancer + aws:elbv2:listener + aws:elbv2:targetgroup; the Terraform adapter translates to aws_lb/aws_lb_listener/aws_lb_target_group).",
+  "inputs": {
+    "name": {
+      "type": "string",
+      "description": "Name tag for the load balancer and child resources.",
+      "required": true
+    },
+    "subnets": {
+      "type": "string",
+      "description": "Comma-separated subnet ids (ref to l1-vpc).",
+      "required": true
+    },
+    "security_group": {
+      "type": "string",
+      "description": "Security group id for the load balancer.",
+      "required": true
+    },
+    "port": {
+      "type": "number",
+      "description": "Listener port (default 80).",
+      "required": false,
+      "default": 80
+    },
+    "protocol": {
+      "type": "string",
+      "description": "Listener protocol (default HTTP).",
+      "required": false,
+      "default": "HTTP"
+    },
+    "region": {
+      "type": "string",
+      "description": "AWS region the load balancer is created in.",
+      "required": true
+    }
+  },
+  "outputs": {
+    "lb_arn": {
+      "type": "arn",
+      "description": "The load balancer ARN."
+    },
+    "listener_arn": {
+      "type": "arn",
+      "description": "The listener ARN."
+    },
+    "target_group_arn": {
+      "type": "arn",
+      "description": "The target group ARN."
+    }
+  },
+  "nfrs": {},
+  "resources": [
+    {
+      "type": "aws:elbv2:loadbalancer",
+      "description": "Application load balancer in the VPC subnets.",
+      "inputs": ["name", "subnets", "security_group"],
+      "outputs": ["lb_arn"]
+    },
+    {
+      "type": "aws:elbv2:targetgroup",
+      "description": "Target group for the ECS service tasks.",
+      "inputs": ["name", "port", "protocol", "vpc_id"],
+      "outputs": ["target_group_arn"]
+    },
+    {
+      "type": "aws:elbv2:listener",
+      "description": "Listener forwarding the LB port to the target group.",
+      "inputs": ["lb_arn", "port", "protocol", "target_group_arn"],
+      "outputs": ["listener_arn"]
+    }
+  ]
+}

modules-ir/l1/l1-ecr/README.md

@@ -0,0 +1,58 @@
+# l1-ecr — ECR repository
+
+> **Module kind:** L1 primitive  |  **Version:** 1.0.0
+
+A single ECR repository that hosts the container image for the ECS
+task. The simplest container-registry module — one resource, two
+inputs, two outputs.
+
+## Resources
+
+| Resource | Type | Purpose |
+|----------|------|---------|
+| repository | `aws_ecr_repository` | The ECR repository |
+
+## Inputs
+
+| Name | Type | Required | Default | Description |
+|------|------|----------|---------|-------------|
+| `name` | string | yes | — | The ECR repository name |
+| `region` | string | yes | — | AWS region the repository is created in |
+
+## Outputs
+
+| Name | Type | Description |
+|------|------|-------------|
+| `repository_url` | string | The ECR repository URL |
+| `repository_arn` | arn | The ECR repository ARN |
+
+## Usage
+
+```json
+{
+  "id": "ecr",
+  "type": "aws:ecr:repository",
+  "module": "l1-ecr@1.0.0",
+  "inputs": {
+    "name": "acdl-microservice",
+    "region": "us-east-1"
+  }
+}
+```
+
+The `repository_url` output is used to build the `image` input for
+`l1-ecs-service` (e.g. `<repository_url>:latest`).
+
+## Compliance extension points
+
+- **Image scanning** — add `image_scanning_configuration { scan_on_push = true }` for vulnerability scanning (SOC2 CC7.6, DORA ICT risk testing, HIPAA security monitoring).
+- **Encryption** — add `encryption_configuration { encryption_type = "KMS", kms_key = ... }` with a customer-managed key (SOC2 CC6.1, HIPAA §164.312(a)(2)(iv), GDPR Art.32).
+- **Image tag immutability** — add `image_tag_mutability = "IMMUTABLE"` to prevent tag overwriting (SOX §802, SOC2 CC6.1 integrity, DORA audit integrity).
+- **Lifecycle policy** — add `aws_ecr_lifecycle_policy` to enforce image retention / cleanup (GDPR Art.5(2) data minimization, SOC2 CC5.2).
+- **Access policy** — add a repository policy restricting pull/push to known roles (SOC2 CC6.1, HIPAA §164.308(a)(4)).
+
+## Versioning
+
+`1.0.0` — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps
+require a new registry entry (immutable publication); old entries enter
+a 12-month deprecation window.

modules-ir/l1/l1-ecr/interface.json

@@ -0,0 +1,30 @@
+{
+  "name": "l1-ecr",
+  "version": "1.0.0",
+  "kind": "l1",
+  "type": "aws:ecr:repository",
+  "description": "ECR repository primitive (substrate-agnostic IR type aws:ecr:repository; the Terraform adapter translates to aws_ecr_repository).",
+  "inputs": {
+    "name": {
+      "type": "string",
+      "description": "The ECR repository name.",
+      "required": true
+    },
+    "region": {
+      "type": "string",
+      "description": "AWS region the repository is created in.",
+      "required": true
+    }
+  },
+  "outputs": {
+    "repository_url": {
+      "type": "string",
+      "description": "The ECR repository URL."
+    },
+    "repository_arn": {
+      "type": "arn",
+      "description": "The ECR repository ARN."
+    }
+  },
+  "nfrs": {}
+}

modules-ir/l1/l1-ecs-cluster/README.md

@@ -0,0 +1,56 @@
+# l1-ecs-cluster — ECS Fargate cluster
+
+> **Module kind:** L1 primitive  |  **Version:** 1.0.0
+
+An ECS Fargate cluster. The simplest ECS module — one resource, two
+inputs, two outputs. The cluster is the container orchestration
+boundary that `l1-ecs-service` references for task placement.
+
+## Resources
+
+| Resource | Type | Purpose |
+|----------|------|---------|
+| cluster | `aws_ecs_cluster` | The ECS Fargate cluster |
+
+## Inputs
+
+| Name | Type | Required | Default | Description |
+|------|------|----------|---------|-------------|
+| `name` | string | yes | — | The ECS cluster name |
+| `region` | string | yes | — | AWS region the cluster is created in |
+
+## Outputs
+
+| Name | Type | Description |
+|------|------|-------------|
+| `cluster_arn` | arn | The ECS cluster ARN |
+| `cluster_id` | string | The ECS cluster id (name) |
+
+## Usage
+
+```json
+{
+  "id": "cluster",
+  "type": "aws:ecs:cluster",
+  "module": "l1-ecs-cluster@1.0.0",
+  "inputs": {
+    "name": "acdl-microservice",
+    "region": "us-east-1"
+  }
+}
+```
+
+The `cluster_arn` output is referenced by `l1-ecs-service` as its
+`cluster_arn` input.
+
+## Compliance extension points
+
+- **Container Insights** — add `configuration { container_insights = "enabled" }` for observability (SOC2 CC7.3, DORA ICT risk monitoring).
+- **CloudWatch Logs** — add a log group with retention policy for cluster-level audit logs (SOX, SOC2 CC7.2, HIPAA §164.312(b)).
+- **Encryption** — add `settings { name = "containerInsights", value = "enabled" }` and KMS-based encryption for container data (HIPAA §164.312(a)(2)(iv), GDPR Art.32).
+
+## Versioning
+
+`1.0.0` — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps
+require a new registry entry (immutable publication); old entries enter
+a 12-month deprecation window.

modules-ir/l1/l1-ecs-cluster/interface.json

@@ -0,0 +1,30 @@
+{
+  "name": "l1-ecs-cluster",
+  "version": "1.0.0",
+  "kind": "l1",
+  "type": "aws:ecs:cluster",
+  "description": "ECS Fargate cluster primitive (substrate-agnostic IR type aws:ecs:cluster; the Terraform adapter translates to aws_ecs_cluster).",
+  "inputs": {
+    "name": {
+      "type": "string",
+      "description": "The ECS cluster name.",
+      "required": true
+    },
+    "region": {
+      "type": "string",
+      "description": "AWS region the cluster is created in.",
+      "required": true
+    }
+  },
+  "outputs": {
+    "cluster_arn": {
+      "type": "arn",
+      "description": "The ECS cluster ARN."
+    },
+    "cluster_id": {
+      "type": "string",
+      "description": "The ECS cluster id (name)."
+    }
+  },
+  "nfrs": {}
+}

modules-ir/l1/l1-ecs-service/README.md

@@ -0,0 +1,78 @@
+# l1-ecs-service — ECS Fargate service (task definition + service)
+
+> **Module kind:** L1 primitive  |  **Version:** 1.0.0
+
+An ECS Fargate service with its task definition. Runs a container image
+on Fargate, optionally behind an ALB target group. This is a
+multi-resource module: it creates a task definition and a service that
+runs it.
+
+## Resources
+
+| Resource | Type | Purpose |
+|----------|------|---------|
+| task_definition | `aws_ecs_task_definition` | Fargate task definition with container image, CPU, memory, port, env |
+| service | `aws_ecs_service` | Fargate service running the task definition in a cluster + subnets |
+
+## Inputs
+
+| Name | Type | Required | Default | Description |
+|------|------|----------|---------|-------------|
+| `image` | string | yes | — | ECR image URL for the task container |
+| `port` | number | yes | — | Container port the service listens on |
+| `cpu` | number | no | 256 | Task CPU units (Fargate) |
+| `memory` | number | no | 512 | Task memory in MiB (Fargate) |
+| `env` | string | no | — | Environment variables as a JSON map string |
+| `cluster_arn` | arn | yes | — | ECS cluster ARN (from `l1-ecs-cluster`) |
+| `subnets` | string | yes | — | Comma-separated subnet ids (from `l1-vpc`) |
+| `security_group` | string | yes | — | Security group id for the service ENIs |
+| `lb_target_group_arn` | arn | no | — | Optional ALB target group ARN (from `l1-alb`) |
+| `region` | string | yes | — | AWS region the service is created in |
+
+## Outputs
+
+| Name | Type | Description |
+|------|------|-------------|
+| `service_arn` | arn | The ECS service ARN |
+| `task_def_arn` | arn | The ECS task definition ARN |
+
+## Usage
+
+```json
+{
+  "id": "service",
+  "type": "aws:ecs:task_definition",
+  "module": "l1-ecs-service@1.0.0",
+  "inputs": {
+    "image": "581513795199.dkr.ecr.us-east-1.amazonaws.com/acdl-microservice:latest",
+    "port": 8080,
+    "cpu": 256,
+    "memory": 512,
+    "cluster_arn": "ref:cluster.cluster_arn",
+    "subnets": "ref:vpc.subnet_ids",
+    "security_group": "ref:roles.role_arn",
+    "region": "us-east-1"
+  }
+}
+```
+
+The `image`, `port`, and `env` inputs are compiled into a
+`container_definitions` JSON block by the adapter. The service is
+placed in the cluster with the given subnets and security group, and
+optionally wired to the ALB target group if `lb_target_group_arn` is
+provided.
+
+## Compliance extension points
+
+- **CloudWatch Logs** — add `logConfiguration` to the container definition with a log group + retention policy (SOX, SOC2 CC7.2, HIPAA §164.312(b), DORA ICT incident logging).
+- **Task execution role separation** — add a separate `aws_iam_role` for execution vs. the task role (SOC2 CC6.3 segregation of duties at runtime).
+- **Secrets injection** — add `secrets` block referencing AWS Secrets Manager / SSM Parameter Store with KMS encryption (SOC2 CC6.1, HIPAA §164.312(a)(2)(iv)).
+- **Execute command** — add `enable_execute_command` with KMS encryption for session audit (SOC2 CC7.2).
+- **Deployment circuit breaker** — add `deployment_circuit_breaker` block for resilience (SOC2 CC9.1, DORA operational resilience).
+- **Health check** — add a `health_check` block to the target group (currently missing despite the contract schema having a healthcheck field).
+
+## Versioning
+
+`1.0.0` — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps
+require a new registry entry (immutable publication); old entries enter
+a 12-month deprecation window.

modules-ir/l1/l1-ecs-service/interface.json

@@ -0,0 +1,86 @@
+{
+  "name": "l1-ecs-service",
+  "version": "1.0.0",
+  "kind": "l1",
+  "type": "aws:ecs:task_definition",
+  "description": "ECS Fargate service primitive (substrate-agnostic IR types aws:ecs:task_definition + aws:ecs:service; the Terraform adapter translates to aws_ecs_task_definition/aws_ecs_service).",
+  "inputs": {
+    "image": {
+      "type": "string",
+      "description": "ECR image URL for the task container.",
+      "required": true
+    },
+    "port": {
+      "type": "number",
+      "description": "Container port the service listens on.",
+      "required": true
+    },
+    "cpu": {
+      "type": "number",
+      "description": "Task CPU units (Fargate).",
+      "required": false,
+      "default": 256
+    },
+    "memory": {
+      "type": "number",
+      "description": "Task memory (MiB, Fargate).",
+      "required": false,
+      "default": 512
+    },
+    "env": {
+      "type": "string",
+      "description": "Environment variables as a JSON map string (optional).",
+      "required": false
+    },
+    "cluster_arn": {
+      "type": "arn",
+      "description": "ECS cluster ARN (ref to l1-ecs-cluster).",
+      "required": true
+    },
+    "subnets": {
+      "type": "string",
+      "description": "Comma-separated subnet ids (ref to l1-vpc).",
+      "required": true
+    },
+    "security_group": {
+      "type": "string",
+      "description": "Security group id for the service ENIs.",
+      "required": true
+    },
+    "lb_target_group_arn": {
+      "type": "arn",
+      "description": "Optional ALB target group ARN (ref to l1-alb).",
+      "required": false
+    },
+    "region": {
+      "type": "string",
+      "description": "AWS region the service is created in.",
+      "required": true
+    }
+  },
+  "outputs": {
+    "service_arn": {
+      "type": "arn",
+      "description": "The ECS service ARN."
+    },
+    "task_def_arn": {
+      "type": "arn",
+      "description": "The ECS task definition ARN."
+    }
+  },
+  "nfrs": {},
+  "resources": [
+    {
+      "type": "aws:ecs:task_definition",
+      "description": "Fargate task definition; the adapter jsonencodes image/port/env into container_definitions.",
+      "inputs": ["image", "port", "cpu", "memory", "env"],
+      "outputs": ["task_def_arn"]
+    },
+    {
+      "type": "aws:ecs:service",
+      "description": "Fargate service running the task definition in the cluster + subnets.",
+      "inputs": ["cluster_arn", "subnets", "security_group", "lb_target_group_arn"],
+      "outputs": ["service_arn"]
+    }
+  ]
+}

modules-ir/l1/l1-iam-role/README.md

@@ -0,0 +1,64 @@
+# l1-iam-role — IAM role
+
+> **Module kind:** L1 primitive  |  **Version:** 1.0.0
+
+A single IAM role with an assume-role policy and optional managed
+policy attachments. Used as the ECS task execution role.
+
+## Resources
+
+| Resource | Type | Purpose |
+|----------|------|---------|
+| role | `aws_iam_role` | The IAM role with assume-role policy |
+
+## Inputs
+
+| Name | Type | Required | Default | Description |
+|------|------|----------|---------|-------------|
+| `role_name` | string | yes | — | The IAM role name |
+| `assume_role_policy` | string | yes | — | Assume-role policy document (JSON string) |
+| `managed_policies` | string | no | — | Comma-separated list of managed policy ARNs to attach |
+| `region` | string | yes | — | AWS region the role is created in |
+
+## Outputs
+
+| Name | Type | Description |
+|------|------|-------------|
+| `role_arn` | arn | The IAM role ARN |
+| `role_id` | string | The IAM role id |
+
+## Usage
+
+```json
+{
+  "id": "roles",
+  "type": "aws:iam:role",
+  "module": "l1-iam-role@1.0.0",
+  "inputs": {
+    "role_name": "acdl-microservice-exec",
+    "assume_role_policy": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"ecs-tasks.amazonaws.com\"},\"Action\":\"sts:AssumeRole\"}]}",
+    "managed_policies": "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy",
+    "region": "us-east-1"
+  }
+}
+```
+
+The `assume_role_policy` is a JSON string — the adapter jsonencodes it
+into the Terraform `assume_role_policy` argument. The
+`managed_policies` input is a comma-separated list of ARNs, emitted as
+`managed_policy_arns = [...]`.
+
+## Compliance extension points
+
+- **Permissions boundary** — add `permissions_boundary` to enforce least-privilege guardrails (SOC2 CC6.1, SOX ITGC, DORA ICT access control).
+- **Inline policy** — add `aws_iam_role_policy` for fine-grained least-privilege instead of broad managed policies (SOC2 CC6.1, HIPAA §164.308(a)(4)).
+- **MFA conditions** — add `condition` blocks requiring MFA for assume-role (SOC2 CC6.1, HIPAA §164.312(d)).
+- **Source IP / region conditions** — add `aws:SourceIp` / `aws:RequestedRegion` conditions for data residency enforcement (GDPR Art.44-49, DORA ICT third-party risk).
+- **Access Analyzer** — add `aws_accessanalyzer_analyzer` to verify least-privilege (SOC2 CC6.1, GDPR Art.32).
+- **Role separation** — add a separate task role vs. execution role (SOC2 CC6.3 segregation of duties).
+
+## Versioning
+
+`1.0.0` — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps
+require a new registry entry (immutable publication); old entries enter
+a 12-month deprecation window.

modules-ir/l1/l1-iam-role/interface.json

@@ -0,0 +1,40 @@
+{
+  "name": "l1-iam-role",
+  "version": "1.0.0",
+  "kind": "l1",
+  "type": "aws:iam:role",
+  "description": "IAM role primitive (substrate-agnostic IR type aws:iam:role; the Terraform adapter translates to aws_iam_role).",
+  "inputs": {
+    "role_name": {
+      "type": "string",
+      "description": "The IAM role name.",
+      "required": true
+    },
+    "assume_role_policy": {
+      "type": "string",
+      "description": "Assume-role policy document (JSON string).",
+      "required": true
+    },
+    "managed_policies": {
+      "type": "string",
+      "description": "Comma-separated list of managed policy ARNs to attach.",
+      "required": false
+    },
+    "region": {
+      "type": "string",
+      "description": "AWS region the role is created in.",
+      "required": true
+    }
+  },
+  "outputs": {
+    "role_arn": {
+      "type": "arn",
+      "description": "The IAM role ARN."
+    },
+    "role_id": {
+      "type": "string",
+      "description": "The IAM role id."
+    }
+  },
+  "nfrs": {}
+}

modules-ir/l1/l1-s3/README.md

@@ -0,0 +1,63 @@
+# l1-s3 — S3 bucket
+
+> **Module kind:** L1 primitive  |  **Version:** 1.0.0
+
+A single S3 bucket for object storage. The simplest module — one
+resource, two inputs, two outputs. Versioning is enabled by default.
+
+## Resources
+
+| Resource | Type | Purpose |
+|----------|------|---------|
+| bucket | `aws_s3_bucket` | The S3 bucket itself |
+
+## Inputs
+
+| Name | Type | Required | Default | Description |
+|------|------|----------|---------|-------------|
+| `bucket_name` | string | yes | — | Globally-unique S3 bucket name |
+| `region` | string | yes | — | AWS region the bucket is created in |
+
+## Outputs
+
+| Name | Type | Description |
+|------|------|-------------|
+| `bucket_arn` | arn | The S3 bucket ARN |
+| `bucket_name` | string | The bucket name (echoes the input) |
+
+## NFRs
+
+| Name | Type | Default | Description |
+|------|------|---------|-------------|
+| `versioning` | boolean | true | Enable S3 versioning |
+
+## Usage
+
+```json
+{
+  "id": "s3",
+  "type": "aws:s3:bucket",
+  "module": "l1-s3@1.0.0",
+  "inputs": {
+    "bucket_name": "acdl-spike-bucket",
+    "region": "us-east-1"
+  }
+}
+```
+
+A concrete instance is at `spike_instance.json` (used by the platform
+pipeline as the regression baseline).
+
+## Compliance extension points
+
+- **Encryption at rest** — add `aws_s3_bucket_server_side_encryption_configuration` with a customer-managed KMS key (SOC2 CC6.1, HIPAA §164.312(a)(2)(iv), GDPR Art.32).
+- **Object Lock** — add `aws_s3_bucket_object_lock_configuration` in compliance mode with 7-year retention for immutable evidence (SOX §802, DORA audit trail).
+- **Access logging** — add `aws_s3_bucket_logging` to a target logging bucket (SOC2 CC7.2).
+- **Public access block** — add `aws_s3_bucket_public_access_block` to prevent data exfiltration (SOC2 CC6.1, GDPR Art.32).
+- **Lifecycle policy** — add `aws_s3_bucket_lifecycle_configuration` for retention enforcement (GDPR Art.5(2), HIPAA §164.530(j)).
+
+## Versioning
+
+`1.0.0` — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps
+require a new registry entry (immutable publication); old entries enter
+a 12-month deprecation window.

modules-ir/l1/l1-s3/interface.json

@@ -0,0 +1,36 @@
+{
+  "name": "l1-s3",
+  "version": "1.0.0",
+  "kind": "l1",
+  "type": "aws:s3:bucket",
+  "description": "S3 bucket primitive (substrate-agnostic IR type aws:s3:bucket; the Terraform adapter translates to aws_s3_bucket).",
+  "inputs": {
+    "bucket_name": {
+      "type": "string",
+      "description": "Globally-unique S3 bucket name.",
+      "required": true
+    },
+    "region": {
+      "type": "string",
+      "description": "AWS region the bucket is created in.",
+      "required": true
+    }
+  },
+  "outputs": {
+    "bucket_arn": {
+      "type": "arn",
+      "description": "The S3 bucket ARN."
+    },
+    "bucket_name": {
+      "type": "string",
+      "description": "The bucket name (echoes the input)."
+    }
+  },
+  "nfrs": {
+    "versioning": {
+      "type": "boolean",
+      "description": "Enable S3 versioning (default true).",
+      "default": true
+    }
+  }
+}

modules-ir/l1/l1-s3/spike_instance.json

@@ -0,0 +1,23 @@
+{
+  "version": "1.0.0",
+  "stack": {
+    "name": "l1-s3",
+    "kind": "l1",
+    "depth": 1
+  },
+  "resources": [
+    {
+      "id": "s3",
+      "type": "aws:s3:bucket",
+      "module": "l1-s3@1.0.0",
+      "inputs": {
+        "bucket_name": "acdl-spike-bucket",
+        "region": "us-east-1"
+      },
+      "outputs": {
+        "bucket_arn": {"type": "arn", "description": "The S3 bucket ARN."},
+        "bucket_name": {"type": "string", "description": "The bucket name."}
+      }
+    }
+  ]
+}

modules-ir/l1/l1-vpc/README.md

@@ -0,0 +1,67 @@
+# l1-vpc — VPC with subnets and routing
+
+> **Module kind:** L1 primitive  |  **Version:** 1.0.0
+
+A VPC with one subnet per availability zone and a route table with a
+default route through an internet gateway. The networking foundation
+that other modules (ALB, ECS service) reference for subnet ids.
+
+## Resources
+
+| Resource | Type | Purpose |
+|----------|------|---------|
+| vpc | `aws_vpc` | The VPC itself |
+| subnet | `aws_subnet` | One subnet per availability zone |
+| route_table | `aws_route_table` | Route table with default route 0.0.0.0/0 |
+| internet_gateway | `aws_internet_gateway` | IGW for public internet access |
+| route_table_association | `aws_route_table_association` | Binds subnet to route table |
+
+## Inputs
+
+| Name | Type | Required | Default | Description |
+|------|------|----------|---------|-------------|
+| `cidr` | string | yes | — | VPC CIDR block, e.g. `10.0.0.0/16` |
+| `azs` | string | yes | — | Comma-separated availability zones, e.g. `us-east-1a,us-east-1b` |
+| `name` | string | yes | — | Name tag for the VPC and child resources |
+| `region` | string | yes | — | AWS region the VPC is created in |
+
+## Outputs
+
+| Name | Type | Description |
+|------|------|-------------|
+| `vpc_id` | string | The VPC id |
+| `subnet_ids` | string | Comma-separated subnet ids |
+
+## Usage
+
+```json
+{
+  "id": "vpc",
+  "type": "aws:ec2:vpc",
+  "module": "l1-vpc@1.0.0",
+  "inputs": {
+    "cidr": "10.0.0.0/16",
+    "azs": "us-east-1a,us-east-1b",
+    "name": "acdl-microservice",
+    "region": "us-east-1"
+  }
+}
+```
+
+The `azs` input is split on comma; one subnet is created per zone. The
+route table gets a default route `0.0.0.0/0` → internet gateway. Other
+modules reference `subnet_ids` for their network placement.
+
+## Compliance extension points
+
+- **VPC Flow Logs** — add `aws_flow_log` + CloudWatch Logs group / S3 destination (SOX ITGC, SOC2 CC7.2, HIPAA §164.312(b), DORA ICT risk logging).
+- **Private subnets + NAT gateway** — add private subnets with a NAT gateway so ECS tasks don't need public IPs (SOC2 CC6.6, PCI-DSS 1.3, HIPAA network isolation).
+- **VPC endpoints** — add S3, ECR, KMS, DynamoDB, CloudWatch interface/gateway endpoints to keep traffic off the public internet (SOC2 CC6.7, GDPR Art.32(1)(a), DORA ICT third-party risk).
+- **Security groups** — add `aws_security_group` as a first-class sub-resource (currently missing; needed for all regulated deployments) (SOC2 CC6.6, PCI-DSS 1.2).
+- **Network ACLs** — add `aws_network_acl` for subnet-level segmentation (PCI-DSS 1.3).
+
+## Versioning
+
+`1.0.0` — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps
+require a new registry entry (immutable publication); old entries enter
+a 12-month deprecation window.

modules-ir/l1/l1-vpc/interface.json

@@ -0,0 +1,64 @@
+{
+  "name": "l1-vpc",
+  "version": "1.0.0",
+  "kind": "l1",
+  "type": "aws:ec2:vpc",
+  "description": "VPC primitive (substrate-agnostic IR types aws:ec2:vpc + aws:ec2:subnet + aws:ec2:routetable; the Terraform adapter translates to aws_vpc/aws_subnet/aws_route_table).",
+  "inputs": {
+    "cidr": {
+      "type": "string",
+      "description": "VPC CIDR block, e.g. 10.0.0.0/16.",
+      "required": true
+    },
+    "azs": {
+      "type": "string",
+      "description": "Comma-separated availability zones, e.g. us-east-1a,us-east-1b.",
+      "required": true
+    },
+    "name": {
+      "type": "string",
+      "description": "Name tag for the VPC and child resources.",
+      "required": true
+    },
+    "region": {
+      "type": "string",
+      "description": "AWS region the VPC is created in.",
+      "required": true
+    }
+  },
+  "outputs": {
+    "vpc_id": {
+      "type": "string",
+      "description": "The VPC id."
+    },
+    "subnet_ids": {
+      "type": "string",
+      "description": "Comma-separated subnet ids."
+    }
+  },
+  "nfrs": {},
+  "resources": [
+    {
+      "type": "aws:ec2:vpc",
+      "description": "The VPC itself.",
+      "inputs": ["cidr", "name"],
+      "outputs": ["vpc_id"]
+    },
+    {
+      "type": "aws:ec2:subnet",
+      "description": "One subnet per availability zone (azs split on comma).",
+      "inputs": ["cidr", "az", "vpc_id", "name"],
+      "outputs": ["subnet_id"]
+    },
+    {
+      "type": "aws:ec2:routetable",
+      "description": "Route table bound to the VPC with an internet gateway + default route.",
+      "inputs": ["vpc_id"],
+      "outputs": []
+    }
+  ],
+  "intra_refs": [
+    {"from": "aws:ec2:subnet.vpc_id", "to": "aws:ec2:vpc.vpc_id"},
+    {"from": "aws:ec2:routetable.vpc_id", "to": "aws:ec2:vpc.vpc_id"}
+  ]
+}

modules-ir/l2/l2-microservice/README.md

@@ -0,0 +1,57 @@
+# l2-microservice — ECS Fargate microservice (composition being redesigned)
+
+> **Module kind:** L2 composition  |  **Version:** TBD  |  **Status:** Under redesign
+
+A composition that references multiple L1 primitives to deploy an ECS
+Fargate microservice end-to-end (VPC, cluster, ECR, IAM role, ALB,
+ECS service).
+
+**The composition layer is being redesigned.** The previous
+thin-composition implementation (a `composition.json` with children +
+wires) has been removed. A new composition mechanism will be designed
+in a later phase.
+
+## Resources
+
+TBD — the composition will reference these L1 primitives:
+
+| L1 module | Purpose | README |
+|-----------|---------|--------|
+| `l1-vpc` | VPC, subnets, routing | [README](../l1/l1-vpc/README.md) |
+| `l1-ecs-cluster` | ECS Fargate cluster | [README](../l1/l1-ecs-cluster/README.md) |
+| `l1-ecr` | ECR image repository | [README](../l1/l1-ecr/README.md) |
+| `l1-iam-role` | IAM task execution role | [README](../l1/l1-iam-role/README.md) |
+| `l1-alb` | Application Load Balancer | [README](../l1/l1-alb/README.md) |
+| `l1-ecs-service` | ECS task definition + service | [README](../l1/l1-ecs-service/README.md) |
+
+## Inputs
+
+TBD — will be defined when the composition mechanism is redesigned.
+
+## Outputs
+
+TBD — will be defined when the composition mechanism is redesigned.
+
+## Usage
+
+TBD — the composition mechanism is being redesigned. Until then, use
+the L1 primitives directly. See each L1 module's README for usage
+examples.
+
+## Compliance extension points
+
+The composition will need to wire compliance resources across L1s
+when the compliance milestone (GDPR, SOX, SOC2, HIPAA, DORA) lands:
+
+- **KMS key** — shared encryption key referenced by S3, ECR, CloudWatch Logs, and Secrets Manager.
+- **CloudTrail** — management-plane audit trail for the entire stack.
+- **VPC Flow Logs** — network audit trail.
+- **Security groups** — proper network segmentation between ALB, service, and data tiers.
+- **Private subnets** — ECS tasks in private subnets with NAT egress.
+
+See each L1 module's README for per-module compliance extension points.
+
+## Versioning
+
+Versioning will be defined when the composition mechanism is
+redesigned.

modules-ir/l2/l2-static-asset/README.md

@@ -0,0 +1,51 @@
+# l2-static-asset — S3 static asset (composition being redesigned)
+
+> **Module kind:** L2 composition  |  **Version:** TBD  |  **Status:** Under redesign
+
+A composition that references the `l1-s3` primitive to deploy a single
+S3 bucket for static asset hosting.
+
+**The composition layer is being redesigned.** The previous
+thin-composition implementation (a `composition.json` with children +
+wires) has been removed. A new composition mechanism will be designed
+in a later phase.
+
+## Resources
+
+TBD — the composition will reference this L1 primitive:
+
+| L1 module | Purpose | README |
+|-----------|---------|--------|
+| `l1-s3` | S3 bucket | [README](../l1/l1-s3/README.md) |
+
+## Inputs
+
+TBD — will be defined when the composition mechanism is redesigned.
+
+## Outputs
+
+TBD — will be defined when the composition mechanism is redesigned.
+
+## Usage
+
+TBD — the composition mechanism is being redesigned. Until then, use
+`l1-s3` directly. See the [l1-s3 README](../l1/l1-s3/README.md) for a
+usage example.
+
+## Compliance extension points
+
+The composition will need to wire compliance resources when the
+compliance milestone (GDPR, SOX, SOC2, HIPAA, DORA) lands:
+
+- **KMS key** — shared encryption key for S3 SSE.
+- **S3 access logs** — access logging to a separate audit bucket.
+- **Object Lock** — 7-year immutable retention for evidence.
+- **Public access block** — prevent data exfiltration.
+
+See the [l1-s3 README](../l1/l1-s3/README.md) for per-module compliance
+extension points.
+
+## Versioning
+
+Versioning will be defined when the composition mechanism is
+redesigned.

modules-ir/registry.json

@@ -0,0 +1,51 @@
+{
+  "l1-s3": {
+    "1.0.0": {
+      "interface": "modules-ir/l1/l1-s3/interface.json",
+      "published_at": "2026-07-21T19:00:00Z",
+      "deprecated": false
+    }
+  },
+  "l1-vpc": {
+    "1.0.0": {
+      "interface": "modules-ir/l1/l1-vpc/interface.json",
+      "published_at": "2026-07-21T21:30:00Z",
+      "deprecated": false
+    }
+  },
+  "l1-ecs-cluster": {
+    "1.0.0": {
+      "interface": "modules-ir/l1/l1-ecs-cluster/interface.json",
+      "published_at": "2026-07-21T21:30:00Z",
+      "deprecated": false
+    }
+  },
+  "l1-ecs-service": {
+    "1.0.0": {
+      "interface": "modules-ir/l1/l1-ecs-service/interface.json",
+      "published_at": "2026-07-21T21:30:00Z",
+      "deprecated": false
+    }
+  },
+  "l1-iam-role": {
+    "1.0.0": {
+      "interface": "modules-ir/l1/l1-iam-role/interface.json",
+      "published_at": "2026-07-21T21:30:00Z",
+      "deprecated": false
+    }
+  },
+  "l1-alb": {
+    "1.0.0": {
+      "interface": "modules-ir/l1/l1-alb/interface.json",
+      "published_at": "2026-07-21T21:30:00Z",
+      "deprecated": false
+    }
+  },
+  "l1-ecr": {
+    "1.0.0": {
+      "interface": "modules-ir/l1/l1-ecr/interface.json",
+      "published_at": "2026-07-21T21:30:00Z",
+      "deprecated": false
+    }
+  }
+}

pipelines/ci.yaml

@@ -0,0 +1,49 @@
+# ACDL Central Pipeline Contract (v1.4)
+#
+# This is the single source of truth for the CI/CD pipeline. Both
+# .gitea/workflows/ci.yml (Gitea Actions, dev) and
+# .github/workflows/ci.yml (GitHub Actions, production) implement the
+# stages, commands, triggers, and runner declared here.
+# scripts/run_ci.sh mirrors the same stages for shell reproducibility.
+#
+# A test (tests/test_pipeline_contract.py) validates that both workflow
+# YAMLs conform to this contract and that run_ci.sh runs the same commands.
+#
+# The contract does NOT replace workflow YAML syntax — it declares the
+# *intent* that the forge-specific workflows implement. The workflow files
+# use Gitea/GitHub Actions syntax (checkout, setup-python, run blocks);
+# this contract declares what those blocks must contain.
+#
+# Validated against schemas/pipeline.schema.json.
+
+name: acdl-ci
+environment: dev
+triggers:
+  push: [main]
+  pull_request: [main]
+runner: ubuntu-latest
+python_version: "3.12"
+
+stages:
+  - name: lint
+    description: Compile all Python files (py_compile)
+    command: |
+      python3 -m py_compile \
+        acdl_platform/confidence_signal.py \
+        acdl_platform/outbox_writer.py \
+        adapters/terraform/adapter.py \
+        adapters/terraform/policy/checkov_adapter.py \
+        scripts/push_consumer_image.py
+    required: true
+
+  - name: test
+    description: Run the pytest test suite offline
+    command: python3 -m pytest tests/ -v --tb=short
+    install: pip install -r requirements-test.txt
+    required: true
+
+  - name: check-only
+    description: Run the platform pipeline offline (no AWS/Checkov/DynamoDB)
+    command: bash scripts/run_platform.sh --check-only
+    install: pip install jsonschema pyyaml boto3
+    required: true

pyproject.toml

@@ -0,0 +1,34 @@
+[project]
+name = "acdl"
+version = "1.3.0"
+description = "Agentic Cloud Delivery Platform — consumers declare intent; the platform delivers safe production deployment."
+requires-python = ">=3.10"
+dependencies = [
+    "boto3>=1.34",
+    "jsonschema>=4.20",
+    "pyyaml>=6.0",
+]
+
+[project.optional-dependencies]
+test = [
+    "pytest>=8.0",
+    "pytest-cov>=4.0",
+    "moto[dynamodb]>=5.0",
+]
+
+[tool.pytest.ini_options]
+testpaths = ["tests"]
+markers = [
+    "offline: tests that run without AWS/Checkov/DynamoDB",
+]
+addopts = "-v --tb=short"
+filterwarnings = [
+    "ignore::DeprecationWarning:botocore.*",
+]
+
+[tool.coverage]
+run.source = ["acdl_platform", "adapters"]
+
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.backends._legacy:_Backend"

requirements-test.txt

@@ -0,0 +1,6 @@
+pytest>=8.0
+pytest-cov>=4.0
+moto[dynamodb]>=5.0
+jsonschema>=4.20
+pyyaml>=6.0
+boto3>=1.34

schemas/contract.schema.json

@@ -1,82 +0,0 @@
-{
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "$id": "https://acdl.cloudinit.dev/schemas/contract.schema.json",
-  "title": "ACDL Contract",
-  "description": "Consumer-declared intent. The central pipeline resolves a contract to a Target Stack IR (schemas/ir.schema.json), the Terraform adapter compiles the IR to a plan. Strict fail-fast at schema stage with reason codes from a published vocabulary.",
-  "$comment": "Per-env mandatory inputs per W3.E (PROJECT.md). dev requires stack+environment; qa adds validation.e2eSuite + validation.loadTest; prod adds runbook+dashboard+oncall; dr adds drDrillRef. inputs always optional. profile: agentic fields optional everywhere (naturalLanguageIntent required when profile is agentic). W2.A (tag for dev/qa, SHA for prod) is a workflow-reference concern, not a schema field; the platform CLI resolves tag->SHA for prod-bound workflows.",
-  "type": "object",
-  "required": ["stack", "environment"],
-  "properties": {
-    "stack": {
-      "type": "string",
-      "pattern": "^l2-[a-z][a-z0-9-]*$",
-      "description": "L2 thin-composition reference (resolved by the pipeline to a Target Stack IR)."
-    },
-    "environment": {
-      "type": "string",
-      "enum": ["dev", "qa", "prod", "dr"],
-      "description": "Target environment. Staging does not exist (Path A locked, ARCHITECTURE.md §5)."
-    },
-    "inputs": {
-      "type": "object",
-      "description": "L2-level parameter map. Free-form in v1, typed per-L1 in v1.2 (W3.E).",
-      "additionalProperties": {"type": ["string", "number", "boolean"]}
-    },
-    "validation": {
-      "type": "object",
-      "description": "Validation evidence required in qa (W3.E).",
-      "properties": {
-        "e2eSuite": {"type": "string", "description": "Reference to the contract-declared e2e suite (last 24h, pass rate >= 99%)."},
-        "loadTest": {"type": "string", "description": "Reference to the load test report (last 7d, p99 < declared NFR)."}
-      }
-    },
-    "runbook": {"type": "string", "description": "Runbook reference, mandatory in prod (W3.E)."},
-    "dashboard": {"type": "string", "description": "Dashboard reference, mandatory in prod (W3.E)."},
-    "oncall": {"type": "string", "description": "On-call rotation reference, mandatory in prod (W3.E)."},
-    "drDrillRef": {"type": "string", "description": "DR drill report reference (last 180d), mandatory in dr (W3.E)."},
-    "profile": {
-      "type": "string",
-      "enum": ["developer", "agentic"],
-      "default": "developer",
-      "description": "Consumer surface. 'agentic' unlocks L3B fields (ARCHITECTURE.md §5)."
-    },
-    "naturalLanguageIntent": {
-      "type": "string",
-      "description": "L3B: the original natural-language prompt. Required when profile is agentic (W3.E)."
-    },
-    "confidenceAtSubmission": {
-      "type": "number",
-      "minimum": 0,
-      "maximum": 1,
-      "description": "L3B: the agent's self-reported confidence at submission time."
-    },
-    "agentTrace": {
-      "type": "string",
-      "description": "L3B: reference to the agent's execution trace."
-    },
-    "supersedes": {
-      "type": "string",
-      "format": "uuid",
-      "description": "Prior contractId this re-submission replaces (after rejection — ARCHITECTURE.md §10.6)."
-    }
-  },
-  "allOf": [
-    {
-      "if": {"properties": {"environment": {"const": "qa"}}},
-      "then": {"required": ["validation"],
-               "properties": {"validation": {"required": ["e2eSuite", "loadTest"]}}}
-    },
-    {
-      "if": {"properties": {"environment": {"const": "prod"}}},
-      "then": {"required": ["runbook", "dashboard", "oncall"]}
-    },
-    {
-      "if": {"properties": {"environment": {"const": "dr"}}},
-      "then": {"required": ["drDrillRef"]}
-    },
-    {
-      "if": {"required": ["profile"], "properties": {"profile": {"const": "agentic"}}},
-      "then": {"required": ["naturalLanguageIntent"]}
-    }
-  ]
-}

schemas/pipeline.schema.json

@@ -0,0 +1,77 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://acdl.cloudinit.dev/schemas/pipeline.schema.json",
+  "title": "ACDL Central Pipeline Contract",
+  "description": "Declarative contract for a CI/CD pipeline. Both Gitea Actions (.gitea/workflows/ci.yml, dev) and GitHub Actions (.github/workflows/ci.yml, production) implement the stages, commands, triggers, and runner declared here. The shell script scripts/run_ci.sh mirrors the same stages for local reproducibility. The contract is the single source of truth; the workflow YAMLs and run_ci.sh are generated/validated against it.",
+  "$comment": "The pipeline contract does not replace workflow YAML syntax — it declares the *intent* (stages, commands, triggers, runner) that both Gitea and GitHub workflows implement. A test (tests/test_pipeline_contract.py) validates conformance: the workflow YAMLs must declare the same jobs/stages/commands as the contract, and run_ci.sh must run the same commands in the same order.",
+  "type": "object",
+  "required": ["name", "triggers", "runner", "stages"],
+  "properties": {
+    "name": {
+      "type": "string",
+      "description": "Pipeline name (matches the workflow 'name:' field)."
+    },
+    "environment": {
+      "type": "string",
+      "enum": ["dev", "production"],
+      "description": "Declared environment. dev = Gitea Actions; production = GitHub Actions. Does not change job commands — only documents which forge runs this instance."
+    },
+    "triggers": {
+      "type": "object",
+      "required": ["push", "pull_request"],
+      "properties": {
+        "push": {
+          "type": "array",
+          "items": {"type": "string"},
+          "description": "Branches that trigger the pipeline on push."
+        },
+        "pull_request": {
+          "type": "array",
+          "items": {"type": "string"},
+          "description": "Branches that trigger the pipeline on PR."
+        }
+      }
+    },
+    "runner": {
+      "type": "string",
+      "description": "Runner image (e.g. 'ubuntu-latest'). Both Gitea and GitHub use the same runner label."
+    },
+    "python_version": {
+      "type": "string",
+      "description": "Python version for setup-python action."
+    },
+    "stages": {
+      "type": "array",
+      "minItems": 1,
+      "items": {"$ref": "#/$defs/stage"}
+    }
+  },
+  "$defs": {
+    "stage": {
+      "type": "object",
+      "required": ["name", "command", "required"],
+      "properties": {
+        "name": {
+          "type": "string",
+          "description": "Stage name (maps to the workflow job name)."
+        },
+        "command": {
+          "type": "string",
+          "description": "The shell command to run for this stage. Must be identical in the workflow YAML 'run:' block and in scripts/run_ci.sh."
+        },
+        "required": {
+          "type": "boolean",
+          "description": "If true, a non-zero exit code fails the pipeline."
+        },
+        "install": {
+          "type": "string",
+          "description": "Optional: pip install command to run before the stage command."
+        },
+        "description": {
+          "type": "string",
+          "description": "Optional: human-readable description of what this stage does."
+        }
+      }
+    }
+  }
+}

scripts/push_consumer_image.py

@@ -0,0 +1,131 @@
+#!/usr/bin/env python3
+"""ACDL Phase 15 — push the consumer microservice Docker image to ECR.
+
+Steps performed by this script:
+  1. Load AWS creds from /root/acdl/.env.secrets
+     (ACDL_AWS_ACCESS_KEY_ID, ACDL_AWS_SECRET_ACCESS_KEY, AWS_DEFAULT_REGION).
+  2. Create the ECR repo `acdl-microservice` if it doesn't exist
+     (ecr:DescribeRepositories / ecr:CreateRepository). Region: us-east-1.
+  3. Get the ECR login password (ecr:GetAuthorizationToken) and run
+     `docker login` with it.
+
+After this script runs, it prints the docker `tag` and `push` commands
+for the caller to run in the shell (steps 4-5 of T-15.1).
+
+Usage:
+    python3 scripts/push_consumer_image.py
+
+Constraints (T-15.1): the `aws` CLI is NOT installed — boto3 is used for
+every AWS API call. `docker` is invoked via subprocess for the login
+(since docker is the only thing that can use the auth token meaningfully).
+"""
+import os
+import sys
+import subprocess
+import pathlib
+
+import boto3
+
+
+REPO_ROOT = pathlib.Path(__file__).resolve().parent.parent
+ENV_FILE = REPO_ROOT / ".env.secrets"
+AWS_ACCOUNT_ID = "581513795199"
+AWS_REGION = "us-east-1"
+ECR_REPO_NAME = "acdl-microservice"
+IMAGE_TAG = "latest"
+
+
+def _load_env(path):
+    """Load ACDL_AWS_* + AWS_DEFAULT_REGION from a flat KEY=VALUE file."""
+    creds = {}
+    with open(path, "r") as fh:
+        for line in fh:
+            line = line.strip()
+            if not line or line.startswith("#") or "=" not in line:
+                continue
+            k, v = line.split("=", 1)
+            creds[k.strip()] = v.strip()
+    return creds
+
+
+def main():
+    if not ENV_FILE.exists():
+        print(f"FAIL: {ENV_FILE} not found", file=sys.stderr)
+        return 2
+
+    creds = _load_env(ENV_FILE)
+    access_key = creds.get("ACDL_AWS_ACCESS_KEY_ID")
+    secret_key = creds.get("ACDL_AWS_SECRET_ACCESS_KEY")
+    region = creds.get("AWS_DEFAULT_REGION", AWS_REGION)
+    if not access_key or not secret_key:
+        print("FAIL: ACDL_AWS_ACCESS_KEY_ID / ACDL_AWS_SECRET_ACCESS_KEY missing",
+              file=sys.stderr)
+        return 2
+
+    # Export the creds for the docker subprocess (it doesn't need them, but
+    # keeps parity with the terraform step that runs after this).
+    os.environ["AWS_ACCESS_KEY_ID"] = access_key
+    os.environ["AWS_SECRET_ACCESS_KEY"] = secret_key
+    os.environ["AWS_DEFAULT_REGION"] = region
+
+    session = boto3.Session(
+        aws_access_key_id=access_key,
+        aws_secret_access_key=secret_key,
+        region_name=region,
+    )
+    ecr = session.client("ecr")
+
+    # Step 2: create the ECR repo if it doesn't exist.
+    repo_uri = None
+    try:
+        resp = ecr.describe_repositories(repositoryNames=[ECR_REPO_NAME])
+        repo = resp["repositories"][0]
+        repo_uri = repo["repositoryUri"]
+        print(f"ecr: repository {ECR_REPO_NAME!r} already exists -> {repo_uri}")
+    except ecr.exceptions.RepositoryNotFoundException:
+        print(f"ecr: repository {ECR_REPO_NAME!r} not found, creating...")
+        resp = ecr.create_repository(repositoryName=ECR_REPO_NAME)
+        repo = resp["repository"]
+        repo_uri = repo["repositoryUri"]
+        print(f"ecr: created repository {ECR_REPO_NAME!r} -> {repo_uri}")
+    except Exception as exc:
+        print(f"FAIL: ecr describe/create failed: {exc}", file=sys.stderr)
+        return 1
+
+    # Step 3: get login password + run `docker login`.
+    auth = ecr.get_authorization_token()
+    token = auth["authorizationData"][0]["authorizationToken"]
+    # The token is base64(USERNAME:PASSWORD); docker login wants them split.
+    import base64
+    user_pw = base64.b64decode(token).decode("utf-8")
+    username, password = user_pw.split(":", 1)
+    registry = f"{AWS_ACCOUNT_ID}.dkr.ecr.{region}.amazonaws.com"
+
+    print(f"docker: logging in to {registry} ...")
+    login_cmd = [
+        "docker", "login",
+        "--username", username,
+        "--password-stdin",
+        registry,
+    ]
+    proc = subprocess.run(login_cmd, input=password.encode("utf-8"),
+                          capture_output=True)
+    if proc.returncode != 0:
+        print("FAIL: docker login failed:", file=sys.stderr)
+        sys.stderr.write(proc.stderr.decode("utf-8", "replace"))
+        return 1
+    print("docker: login OK")
+
+    # Steps 4-5: print the tag + push commands for the caller to run.
+    full_tag = f"{repo_uri}:{IMAGE_TAG}"
+    print("")
+    print("=== NEXT: run these commands in the shell to tag + push ===")
+    print(f"docker tag acdl-microservice:latest {full_tag}")
+    print(f"docker push {full_tag}")
+    print("")
+    print(f"ECR_IMAGE={full_tag}")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

scripts/run_ci.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# scripts/run_ci.sh - reproduce the CI pipeline locally.
+#
+# Mirrors the central pipeline contract (pipelines/ci.yaml) which both
+# .gitea/workflows/ci.yml (Gitea Actions, dev) and
+# .github/workflows/ci.yml (GitHub Actions, production) implement.
+#
+# Runs the same three stages in the same order:
+#   1. lint     — py_compile all Python files
+#   2. test     — pytest test suite (offline)
+#   3. check-only — run_platform.sh --check-only (offline, no AWS)
+#
+# Fails on the first stage that errors. Exits 0 with "CI PIPELINE OK"
+# when all stages pass.
+#
+# Usage:
+#   bash scripts/run_ci.sh           # run all stages
+#   bash scripts/run_ci.sh --quiet   # suppress per-stage banners
+set -euo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+QUIET=0
+for arg in "$@"; do
+  case "$arg" in
+    --quiet) QUIET=1 ;;
+    *) echo "FAIL: unknown argument: $arg" >&2; exit 1 ;;
+  esac
+done
+
+banner() {
+  [ "$QUIET" = "1" ] || echo ""
+  echo "── $1 ──"
+  [ "$QUIET" = "1" ] || echo ""
+}
+
+fail() { echo "FAIL: $*" >&2; exit 1; }
+
+echo "=== ACDL CI Pipeline (local reproduction) ==="
+echo "contract: pipelines/ci.yaml (3 stages)"
+echo ""
+
+banner "Stage 1/3: lint (py_compile)"
+python3 -m py_compile \
+  acdl_platform/confidence_signal.py \
+  acdl_platform/outbox_writer.py \
+  adapters/terraform/adapter.py \
+  adapters/terraform/policy/checkov_adapter.py \
+  scripts/push_consumer_image.py \
+  || fail "lint: py_compile failed"
+echo "lint: OK"
+
+banner "Stage 2/3: test (pytest)"
+python3 -m pytest tests/ -v --tb=short || fail "test: pytest failed"
+echo "test: OK"
+
+banner "Stage 3/3: check-only (run_platform.sh --check-only)"
+bash scripts/run_platform.sh --check-only || fail "check-only: run_platform.sh failed"
+echo "check-only: OK"
+
+echo ""
+echo "=== CI PIPELINE OK ==="
+echo "3 stages passed: lint, test, check-only"
+exit 0

scripts/run_platform.sh

@@ -0,0 +1,210 @@
+#!/usr/bin/env bash
+# scripts/run_platform.sh - the ACDL platform pipeline.
+#
+# Modes:
+#   --check-only  (offline, no AWS/Checkov/DynamoDB — for CI)
+#     load IR -> adapter -> stream emitted TF -> validate structure -> exit 0
+#   --plan-only   (requires AWS creds, no Checkov/outbox)
+#     load IR -> adapter -> terraform init/validate/plan (streamed) -> exit 0
+#   (default)    (requires AWS creds + Checkov + DynamoDB)
+#     load IR -> adapter -> terraform plan (streamed) -> Checkov (streamed) ->
+#     confidence -> outbox
+#
+# Flags:
+#   --quiet   suppress terraform/checkov streaming (output to log only)
+#             default: stream to stdout so the user sees what is happening
+#
+# NOTE: contract resolution (contract_resolver.py) was removed when the
+# thin-composition layer was taken out. The pipeline now starts from a
+# pre-existing IR instance (modules-ir/l1/l1-s3/spike_instance.json). A
+# new contract-resolution mechanism will be designed in a later phase.
+#
+# Uses the rotated spike key (D-039/D-047) from gitignored .env.secrets.
+# Plan-only (no apply); -lock=false per D-P09-1.
+set -euo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+CHECK_ONLY=0
+PLAN_ONLY=0
+QUIET=0
+for arg in "$@"; do
+  case "$arg" in
+    --check-only) CHECK_ONLY=1 ;;
+    --plan-only) PLAN_ONLY=1 ;;
+    --quiet) QUIET=1 ;;
+    *) echo "FAIL: unknown argument: $arg" >&2; exit 1 ;;
+  esac
+done
+
+fail() { echo "FAIL: $*" >&2; exit 1; }
+
+# stream: pipe a command's stdout+stderr to both a log file and the
+# terminal (unless --quiet). Usage: stream <logfile> -- <command...>
+stream() {
+  local log="$1"; shift
+  if [ "$QUIET" = "1" ]; then
+    "$@" > "$log" 2>&1
+  else
+    "$@" 2>&1 | tee "$log"
+  fi
+}
+
+CONTRACT_ID="11111111-1111-1111-1111-111111111111"  # spike fixed UUID
+WORK="/tmp/spike_e2e"
+rm -rf "$WORK"; mkdir -p "$WORK"
+
+echo "=== Step 1+2: load pre-existing IR instance (contract resolution deferred) ==="
+IR_INSTANCE="modules-ir/l1/l1-s3/spike_instance.json"
+[ -f "$IR_INSTANCE" ] || fail "IR instance $IR_INSTANCE missing (contract resolution is deferred; load a pre-existing IR)"
+python3 -c "import json; d=json.load(open('$IR_INSTANCE')); print(f\"IR: {d['stack']['name']} {d['stack']['kind']} {len(d['resources'])} resource(s)\")"
+cp "$IR_INSTANCE" "$WORK/spike_ir.json"
+
+echo "=== Step 3: adapter compiles IR -> terraform/spike/*.tf (regenerate) ==="
+python3 adapters/terraform/adapter.py "$WORK/spike_ir.json" terraform/spike || fail "adapter failed"
+echo "adapter: emitted terraform/spike/{main.tf,terraform.tf,providers.tf}"
+
+if [ "$QUIET" = "0" ]; then
+  echo ""
+  echo "--- emitted terraform/spike/main.tf ---"
+  cat terraform/spike/main.tf
+  echo "--- end main.tf ---"
+fi
+
+if [ "$CHECK_ONLY" = "1" ]; then
+  echo ""
+  echo "=== Step 3b: validate adapter output structure (offline) ==="
+  python3 -c "
+import json, os
+d = json.load(open('$WORK/spike_ir.json'))
+assert d['stack']['name'] == 'l1-s3'
+assert len(d['resources']) == 1
+tf_dir = 'terraform/spike'
+for f in ('main.tf', 'terraform.tf', 'providers.tf'):
+    assert os.path.isfile(os.path.join(tf_dir, f)), f'{f} missing'
+main = open(os.path.join(tf_dir, 'main.tf')).read()
+assert 'aws_s3_bucket' in main
+assert 'acdl-spike-bucket' in main
+assert 'versioning' in main
+tf = open(os.path.join(tf_dir, 'terraform.tf')).read()
+assert 'backend' in tf
+assert 'required_version' in tf
+prov = open(os.path.join(tf_dir, 'providers.tf')).read()
+assert 'provider \"aws\"' in prov
+print('adapter output: OK')
+"
+  echo ""
+  echo "=== PLATFORM CHECK OK ==="
+  echo "IR instance -> adapter -> structure validated (offline, no AWS)"
+  exit 0
+fi
+
+echo "=== Loading AWS credentials (not needed for --check-only) ==="
+ENV_FILE="$ROOT/.env.secrets"
+[ -f "$ENV_FILE" ] || fail ".env.secrets missing (run scripts/rotate_spike_key.sh)"
+set -a
+. "$ENV_FILE"
+set +a
+export AWS_ACCESS_KEY_ID="$ACDL_AWS_ACCESS_KEY_ID"
+export AWS_SECRET_ACCESS_KEY="$ACDL_AWS_SECRET_ACCESS_KEY"
+export AWS_DEFAULT_REGION="$AWS_DEFAULT_REGION"
+
+echo "=== Step 4: terraform init + validate + plan -lock=false (real AWS) ==="
+cd terraform/spike
+
+echo ""
+echo "--- terraform init ---"
+stream "$WORK/tf-init.log" terraform init -reconfigure -lock=false -input=false || fail "terraform init failed"
+
+echo ""
+echo "--- terraform validate ---"
+stream "$WORK/tf-validate.log" terraform validate || fail "terraform validate failed"
+
+echo ""
+echo "--- terraform plan ---"
+stream "$WORK/tf-plan.log" terraform plan -lock=false -input=false -out=tfplan || fail "terraform plan failed"
+
+echo ""
+echo "terraform plan OK (1 to add, 0 to change, 0 to destroy expected)"
+cd "$ROOT"
+
+if [ "$PLAN_ONLY" = "1" ]; then
+  echo ""
+  echo "=== PLATFORM PLAN OK ==="
+  exit 0
+fi
+
+echo ""
+echo "=== Step 5: run Checkov on terraform/spike/main.tf ==="
+if [ "$QUIET" = "0" ]; then
+  checkov -f terraform/spike/main.tf --framework terraform -o json --soft-fail 2>&1 | tee "$WORK/checkov.json"
+else
+  checkov -f terraform/spike/main.tf --framework terraform -o json --soft-fail > "$WORK/checkov.json" 2> "$WORK/checkov.err"
+fi
+[ -s "$WORK/checkov.json" ] || fail "checkov produced no output"
+echo ""
+echo "checkov summary: $(python3 -c "import json; d=json.load(open('$WORK/checkov.json')); print(len(d.get('results',{}).get('failed_checks',[])), 'failed,', len(d.get('results',{}).get('passed_checks',[])), 'passed')")"
+
+echo ""
+echo "=== Step 6: Checkov adapter -> PolicyCheckResult (compliance details) ==="
+python3 adapters/terraform/policy/checkov_adapter.py "$WORK/checkov.json" "$CONTRACT_ID" > "$WORK/pcr.json" || fail "checkov adapter failed"
+python3 -c "
+import json
+pcrs = json.load(open('$WORK/pcr.json'))
+print(f'PolicyCheckResult: {len(pcrs)} record(s)')
+print()
+for pcr in pcrs:
+    sev = pcr.get('severity', 'info')
+    res = pcr.get('result', 'unknown')
+    rule = pcr.get('ruleId', 'unknown')
+    msg = pcr.get('message', '')
+    marker = 'PASS' if res == 'pass' else 'FAIL' if res == 'fail' else 'SKIP' if res == 'skipped' else res.upper()
+    print(f'  [{marker}] {sev:8s} {rule:30s} {msg}')
+"
+
+echo ""
+echo "=== Step 7: confidence signal compute ==="
+python3 <<PY > "$WORK/signal.json" || fail "confidence signal failed"
+import json
+import acdl_platform.confidence_signal as c
+pcr = json.load(open("$WORK/pcr.json"))
+inputs = {
+    "policy": pcr,
+    "validation": {"schema": True, "ir_resolved": True, "tf_validated": True, "tf_planned": True},
+    "freshness": {"age_days": 0, "max_age_days": 7},
+    "source": {"submitter": "spike", "commit_sha": "spike-sha", "signed": False},
+    "history": {"prior_rollbacks": 0, "prior_policy_fails": 0},
+    "nfrs": {"conformance": None},
+}
+sig = c.compute("$CONTRACT_ID", "dev", inputs)
+print(json.dumps({"score": sig.score, "band": sig.band, "perInput": sig.perInput, "reasonCodes": sig.reasonCodes}, indent=2))
+PY
+BAND=$(python3 -c "import json; print(json.load(open('$WORK/signal.json'))['band'])")
+SCORE=$(python3 -c "import json; print(round(json.load(open('$WORK/signal.json'))['score'],3))")
+echo "confidence: score=$SCORE band=$BAND"
+[ "$BAND" = "pass" ] || fail "confidence band is $BAND, expected pass for dev"
+
+echo ""
+echo "=== Step 8: write evidence event to DynamoDB outbox ==="
+python3 <<PY > "$WORK/event.json" || fail "event build failed"
+import json, datetime
+sig = json.load(open("$WORK/signal.json"))
+event = {
+    "contractId": "$CONTRACT_ID",
+    "eventType": "CONFIDENCE_COMPUTED",
+    "ts": datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ"),
+    "environment": "dev",
+    "stack": "l2-static-asset",
+    "score": sig["score"],
+    "band": sig["band"],
+    "prev_event_hash": "GENESIS",
+}
+print(json.dumps(event, indent=2))
+PY
+python3 acdl_platform/outbox_writer.py "$WORK/event.json" > "$WORK/outbox_item.json" || fail "outbox write failed"
+echo "outbox: $(python3 -c "import json; d=json.load(open('$WORK/outbox_item.json')); print('contractId=', d['contractId'], 'hash=', d['hash'][:16]+'...')")"
+
+echo ""
+echo "=== PLATFORM E2E OK ==="
+echo "IR instance -> terraform plan -> Checkov -> confidence ($BAND) -> outbox"
+exit 0

scripts/verify_phase09.sh

@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+# scripts/verify_phase09.sh - Phase 09 v1-spike-ir-and-l1-and-adapter gate.
+set -u
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+fail() { echo "FAIL: $*" >&2; exit 1; }
+ok()   { echo "ok: $*"; }
+
+# --- Check 1: L1 module files exist ---
+for f in modules-ir/l1/l1-s3/interface.json \
+         modules-ir/l1/l1-s3/spike_instance.json \
+         modules-ir/l1/l1-s3/README.md \
+         modules-ir/registry.json \
+         adapters/terraform/adapter.py \
+         terraform/spike/main.tf \
+         terraform/spike/terraform.tf \
+         terraform/spike/providers.tf \
+         scripts/run_spike_plan.sh; do
+  [ -f "$f" ] || fail "missing $f"
+done
+ok "all 9 deliverable files exist"
+
+# --- Check 2: spike_instance.json validates against ir.schema.json ---
+( cd /tmp && python3 -c "
+import json, jsonschema
+inst = json.load(open('$ROOT/modules-ir/l1/l1-s3/spike_instance.json'))
+schema = json.load(open('$ROOT/schemas/ir.schema.json'))
+jsonschema.validate(inst, schema)
+" ) || fail "spike_instance.json does not validate against ir.schema.json"
+ok "spike_instance.json validates against ir.schema.json"
+
+# --- Check 3: registry has the l1-s3@1.0.0 entry ---
+python3 -c "
+import json
+r = json.load(open('modules-ir/registry.json'))
+assert 'l1-s3' in r and '1.0.0' in r['l1-s3'], 'l1-s3@1.0.0 missing'
+print('l1-s3@1.0.0 present')
+" || fail "registry missing l1-s3@1.0.0"
+ok "registry has l1-s3@1.0.0"
+
+# --- Check 4: adapter py_compiles + generates terraform containing aws_s3_bucket ---
+python3 -m py_compile adapters/terraform/adapter.py || fail "adapter.py py_compile failed"
+TMP=$(mktemp -d)
+python3 adapters/terraform/adapter.py modules-ir/l1/l1-s3/spike_instance.json "$TMP" 2>/dev/null
+grep -q 'resource "aws_s3_bucket"' "$TMP/main.tf" || fail "adapter did not emit aws_s3_bucket resource"
+grep -q 'output "bucket_arn"' "$TMP/main.tf" || fail "adapter did not emit bucket_arn output"
+ok "adapter.py py_compiles + emits aws_s3_bucket + bucket_arn output"
+
+# --- Check 5: generated terraform/spike/*.tf match a fresh adapter run (D-P09-4 reproducibility) ---
+diff "$TMP/main.tf" terraform/spike/main.tf || fail "terraform/spike/main.tf is stale (differs from a fresh adapter run)"
+diff "$TMP/terraform.tf" terraform/spike/terraform.tf || fail "terraform/spike/terraform.tf is stale"
+diff "$TMP/providers.tf" terraform/spike/providers.tf || fail "terraform/spike/providers.tf is stale"
+ok "terraform/spike/*.tf match a fresh adapter run (reproducible)"
+rm -rf "$TMP"
+
+# --- Check 6: no long-lived credential (AKIA) in committed files ---
+# Skip .terraform/ (provider binaries contain AKIA bytes; gitignored anyway).
+if grep -rn --exclude-dir=.terraform "AKIA" terraform/spike/ adapters/ modules-ir/ 2>/dev/null; then
+  fail "AKIA key id found in committed files (terraform/spike/ adapters/ modules-ir/)"
+fi
+ok "no AKIA in committed files (excluding .terraform/ provider binaries)"
+
+# --- Check 7: .env.secrets + terraform working artifacts are gitignored ---
+git check-ignore -q .env.secrets || fail ".env.secrets not gitignored"
+git check-ignore -q terraform/spike/.terraform/ || fail "terraform/spike/.terraform/ not gitignored"
+git check-ignore -q terraform/spike/tfplan || fail "terraform/spike/tfplan not gitignored"
+ok "secrets + TF working artifacts gitignored"
+
+# --- Check 8: real terraform plan against AWS succeeds (uses rotated spike key) ---
+bash scripts/run_spike_plan.sh > /tmp/verify_phase09_plan.log 2>&1 || {
+  cat /tmp/verify_phase09_plan.log >&2
+  fail "scripts/run_spike_plan.sh failed (see /tmp/verify_phase09_plan.log)"
+}
+grep -q "spike plan OK" /tmp/verify_phase09_plan.log || fail "run_spike_plan.sh did not print 'spike plan OK'"
+ok "real terraform plan against AWS succeeded (rotated spike key, plan-only, -lock=false)"
+
+echo "VERIFIED — Phase 09: IR + l1-s3 + Terraform adapter; real terraform plan succeeds"

scripts/verify_phase10.sh

@@ -0,0 +1,140 @@
+#!/usr/bin/env bash
+# scripts/verify_phase10.sh - Phase 10 v1-spike-l2-and-contract-e2e gate (capstone).
+set -u
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+fail() { echo "FAIL: $*" >&2; exit 1; }
+ok()   { echo "ok: $*"; }
+
+ENV_FILE="$ROOT/.env.secrets"
+[ -f "$ENV_FILE" ] || fail ".env.secrets missing (run scripts/rotate_spike_key.sh first)"
+git check-ignore -q "$ENV_FILE" || fail ".env.secrets is not gitignored"
+set -a
+. "$ENV_FILE"
+set +a
+export AWS_ACCESS_KEY_ID="$ACDL_AWS_ACCESS_KEY_ID"
+export AWS_SECRET_ACCESS_KEY="$ACDL_AWS_SECRET_ACCESS_KEY"
+export AWS_DEFAULT_REGION="$AWS_DEFAULT_REGION"
+
+# --- Check (a): composition.json exists + shape ---
+python3 <<'PY' || fail "composition.json shape wrong"
+import json
+c = json.load(open('modules-ir/l2/l2-static-asset/composition.json'))
+assert c['kind'] == 'l2' and c['depth'] == 1
+assert len(c['children']) == 1 and c['children'][0]['module'] == 'l1-s3@1.0.0'
+assert c['wires']['bucket_name']['target'] == 's3'
+assert c['wires']['region']['target'] == 's3'
+print('composition.json: kind=l2 depth=1 one child l1-s3@1.0.0 wires passthrough')
+PY
+ok "composition.json: l2-static-asset references l1-s3 only (depth 1)"
+
+# --- Check (b): spike.yaml validates against contract schema ---
+python3 <<'PY' || fail "spike.yaml does not validate against contract schema"
+import yaml, json, jsonschema
+contract = yaml.safe_load(open('contracts/spike.yaml'))
+schema = json.load(open('schemas/contract.schema.json'))
+jsonschema.validate(contract, schema)
+print('spike.yaml validates against contract.schema.json')
+PY
+ok "contracts/spike.yaml validates against the contract schema"
+
+# --- Check (c): resolver py_compiles + emits IR validating against ir.schema.json ---
+python3 -m py_compile acdl_platform/contract_resolver.py || fail "contract_resolver.py py_compile failed"
+TMP=$(mktemp -d)
+python3 acdl_platform/contract_resolver.py contracts/spike.yaml "$TMP/spike_ir.json" 2>/dev/null
+( cd /tmp && python3 -c "
+import json, jsonschema
+inst = json.load(open('$TMP/spike_ir.json'))
+schema = json.load(open('$ROOT/schemas/ir.schema.json'))
+jsonschema.validate(inst, schema)
+print('IR validates against ir.schema.json')
+" ) || fail "resolver IR does not validate against ir.schema.json"
+ok "contract_resolver.py resolves spike.yaml to an IR-schema-valid instance"
+
+# --- Check (d): adapter py_compiles + emits main.tf with aws_s3_bucket ---
+python3 -m py_compile adapters/terraform/adapter.py || fail "adapter.py py_compile failed"
+python3 adapters/terraform/adapter.py "$TMP/spike_ir.json" "$TMP/tf" 2>/dev/null
+grep -q 'resource "aws_s3_bucket"' "$TMP/tf/main.tf" || fail "adapter did not emit aws_s3_bucket"
+ok "adapter.py compiles L2 IR to terraform with aws_s3_bucket"
+rm -rf "$TMP"
+
+# --- Check (e): run_spike_e2e.sh exits 0 ---
+bash scripts/run_spike_e2e.sh > /tmp/verify_phase10_e2e.log 2>&1 || {
+  cat /tmp/verify_phase10_e2e.log >&2
+  fail "run_spike_e2e.sh failed"
+}
+grep -q "SPIKE E2E OK" /tmp/verify_phase10_e2e.log || fail "run_spike_e2e.sh did not print SPIKE E2E OK"
+ok "run_spike_e2e.sh completes the full pipeline end-to-end"
+
+# --- Check (f): confidence band is pass for dev ---
+grep -q "band=pass" /tmp/verify_phase10_e2e.log || fail "confidence band is not pass for dev"
+ok "confidence band is pass for dev"
+
+# --- Check (g): outbox item exists ---
+python3 <<'PY' || fail "outbox item not found in DynamoDB"
+import boto3
+s = boto3.Session(region_name='us-east-1')
+dyn = s.client('dynamodb')
+r = dyn.query(TableName='acdl-outbox',
+              KeyConditionExpression='contractId = :cid',
+              ExpressionAttributeValues={':cid': {'S': '11111111-1111-1111-1111-111111111111'}})
+assert r.get('Count', 0) >= 1, f'no outbox item for the spike contractId (Count={r.get("Count", 0)})'
+print(f'outbox item present (Count={r["Count"]})')
+PY
+ok "evidence event is written to the DynamoDB outbox"
+
+# --- Check (h): REQ-28 - the adapter is the only substrate-specific code ---
+# The IR commitments hold: the adapter is the only place that knows Terraform
+# resource types (aws_s3_bucket). The L1/L2 interfaces, the IR schema, the
+# contract, the resolver, the confidence signal, and the outbox writer are
+# substrate-agnostic. Documentation (.md) + schema $comment/description strings
+# may mention aws_s3_bucket *to explain the mapping* — that's not a violation;
+# the check scans actual executable code (.py) + data files (.json/.yaml)
+# for resource-type declarations, excluding .md files + description/comment
+# string values.
+LEAK=$(grep -rn --include='*.py' -E 'aws_s3_bucket|aws_[a-z]+_[a-z]+' \
+            acdl_platform/ 2>/dev/null)
+if [ -n "$LEAK" ]; then
+  echo "$LEAK" >&2
+  fail "REQ-28 violated: substrate-specific terms found in acdl_platform/ Python code (the platform must be substrate-agnostic)"
+fi
+# modules-ir/ data files: exclude .md (docs may reference the mapping); check
+# only .json for actual resource-type field declarations (not description strings).
+LEAK2=$(python3 <<'PY' 2>&1 || true
+import json, os, sys
+leaks = []
+for root, dirs, files in os.walk('modules-ir'):
+    for f in files:
+        if not f.endswith('.json'):
+            continue
+        path = os.path.join(root, f)
+        with open(path) as fh:
+            try:
+                data = json.load(fh)
+            except Exception:
+                continue
+        # Walk the JSON; flag 'aws_s3_bucket' (Terraform type) appearing as a
+        # VALUE (not a key), excluding description/comment strings.
+        def walk(obj, path_str=''):
+            if isinstance(obj, dict):
+                for k, v in obj.items():
+                    if k in ('description', '$comment') and isinstance(v, str):
+                        continue  # docs/comment strings are allowed to mention it
+                    walk(v, path_str + '/' + k)
+            elif isinstance(obj, str):
+                if obj.startswith('aws_') and obj != 'aws:s3:bucket':
+                    leaks.append(f'{path}: {path_str} = {obj!r}')
+        walk(data)
+if leaks:
+    print('\n'.join(leaks))
+PY
+)
+if [ -n "$LEAK2" ]; then
+  echo "$LEAK2" >&2
+  fail "REQ-28 violated: substrate-specific resource-type values found in modules-ir/ JSON"
+fi
+ADAPT_HAS=$(grep -rn --include='*.py' -E 'aws_s3_bucket' adapters/terraform/ 2>/dev/null)
+[ -n "$ADAPT_HAS" ] || fail "REQ-28: adapter does not contain aws_s3_bucket (it should — it's the substrate-specific code)"
+ok "REQ-28: adapter is the only substrate-specific code; modules-ir/ + acdl_platform/ are substrate-agnostic (docs/comments excluded)"
+
+echo "VERIFIED — Phase 10: L2 + contract-e2e; IR commitments hold (REQ-28)"

scripts/verify_phase11.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+# scripts/verify_phase11.sh - verify Phase 11 (v1.2 research + README rewrite).
+set -euo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+fail() { echo "FAIL: $*" >&2; exit 1; }
+
+echo "=== Phase 11 verification ==="
+
+# 1. README.md reflects v1.2 (not stale v1.1-active framing)
+grep -q "v1.2 (active)" README.md || fail "README.md: no 'v1.2 (active)' status"
+! grep -q "v1.1 (active)" README.md || fail "README.md: stale 'v1.1 (active)' framing"
+grep -q "v1.1 (complete, tag" README.md || fail "README.md: v1.1 not marked complete"
+grep -q "v1.3.0" README.md || fail "README.md: no v1.3.0 ship tag reference"
+grep -q "D-047" README.md || fail "README.md: no D-047 reference"
+grep -q "How the platform works" README.md || fail "README.md: no 'How the platform works' section"
+grep -q "terraform plan" README.md || fail "README.md: no terraform plan in the flow"
+grep -q "confidence signal" README.md || fail "README.md: no confidence signal in the flow"
+grep -q "DynamoDB outbox" README.md || fail "README.md: no DynamoDB outbox in the flow"
+grep -q "run_spike_e2e.sh" README.md || fail "README.md: no run_spike_e2e.sh in how-to-run"
+echo "README.md: OK (v1.2 framing, platform flow, how-to-run, credentials)"
+
+# 2. RESEARCH.md has a v1.2 addendum with the 3 decisions
+grep -q "## v1.2 Research Addendum" .ciagent/RESEARCH.md || fail "RESEARCH.md: no v1.2 addendum"
+grep -q "TARGET 9" .ciagent/RESEARCH.md || fail "RESEARCH.md: no TARGET 9 (#36988 re-check)"
+grep -q "TARGET 10" .ciagent/RESEARCH.md || fail "RESEARCH.md: no TARGET 10 (NFR audit)"
+grep -q "TARGET 13" .ciagent/RESEARCH.md || fail "RESEARCH.md: no TARGET 13 (ECS L1 scoping)"
+grep -q "D-047" .ciagent/RESEARCH.md || fail "RESEARCH.md: no D-047"
+grep -q "D-048" .ciagent/RESEARCH.md || fail "RESEARCH.md: no D-048"
+grep -q "D-049" .ciagent/RESEARCH.md || fail "RESEARCH.md: no D-049"
+grep -qi "still open" .ciagent/RESEARCH.md || fail "RESEARCH.md: #36988 status not recorded"
+echo "RESEARCH.md: OK (v1.2 addendum, Targets 9-13, D-047/D-048/D-049)"
+
+# 3. .ciagent/ files reflect v1.2 specify -> research progression
+grep -q '"milestone": "v1.2"' .ciagent/config.json || fail "config.json: milestone not v1.2"
+grep -q "Objective for Milestone v1.2" .ciagent/PROJECT.md || fail "PROJECT.md: no v1.2 objective"
+grep -q "REQ-29" .ciagent/REQUIREMENTS.md || fail "REQUIREMENTS.md: no REQ-29"
+grep -q "Phase 11" .ciagent/ROADMAP.md || fail "ROADMAP.md: no Phase 11"
+grep -q "v1.2 build-out scope" .ciagent/ARCHITECTURE.md || fail "ARCHITECTURE.md: no v1.2 scope"
+echo ".ciagent/ files: OK (v1.2 milestone consistent across all 5 files)"
+
+# 4. #36988 re-check facts are accurate (cross-check the PR state we recorded)
+grep -q "2026-05-27" .ciagent/RESEARCH.md || fail "RESEARCH.md: #36988 last-updated date missing"
+grep -q "D-039" .ciagent/RESEARCH.md || fail "RESEARCH.md: D-039 waiver not referenced"
+echo "#36988 re-check: OK (date + D-039 extension recorded)"
+
+echo ""
+echo "=== Phase 11: VERIFIED ==="
+echo "README.md rewritten; RESEARCH.md v1.2 addendum complete; D-047/D-048/D-049 surfaced."
+exit 0

scripts/verify_phase12.sh

@@ -0,0 +1,63 @@
+#!/usr/bin/env bash
+# scripts/verify_phase12.sh - verify Phase 12 (nfr-harden-and-simplify).
+set -euo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+fail() { echo "FAIL: $*" >&2; exit 1; }
+
+echo "=== Phase 12 verification ==="
+
+# 1. Script consolidation (D-048)
+[ -f scripts/run_platform.sh ] || fail "scripts/run_platform.sh missing"
+[ -x scripts/run_platform.sh ] || fail "scripts/run_platform.sh not executable"
+[ ! -f scripts/run_spike_e2e.sh ] || fail "scripts/run_spike_e2e.sh should be deleted"
+[ ! -f scripts/run_spike_plan.sh ] || fail "scripts/run_spike_plan.sh should be deleted"
+grep -q "set -euo pipefail" scripts/run_platform.sh || fail "run_platform.sh: no 'set -euo pipefail'"
+grep -q -- "--plan-only" scripts/run_platform.sh || fail "run_platform.sh: no --plan-only flag"
+grep -q "PLATFORM E2E OK" scripts/run_platform.sh || fail "run_platform.sh: no PLATFORM E2E OK banner"
+grep -q "PLATFORM PLAN OK" scripts/run_platform.sh || fail "run_platform.sh: no PLATFORM PLAN OK banner"
+grep -q "run_platform.sh" README.md || fail "README.md: no run_platform.sh reference"
+! grep -q "run_spike_e2e.sh" README.md || fail "README.md: stale run_spike_e2e.sh reference"
+! grep -q "run_spike_plan.sh" README.md || fail "README.md: stale run_spike_plan.sh reference"
+echo "Script consolidation (D-048): OK"
+
+# 2. IAM policy expansion (ECS + ECR + ELB + IAM + EC2)
+python3 -c "import json; json.load(open('terraform/bootstrap/spike_runner_policy.json'))" || fail "spike_runner_policy.json: invalid JSON"
+grep -q "ecs:" terraform/bootstrap/spike_runner_policy.json || fail "policy: no ECS permissions"
+grep -q "ecr:" terraform/bootstrap/spike_runner_policy.json || fail "policy: no ECR permissions"
+grep -q "elasticloadbalancing:" terraform/bootstrap/spike_runner_policy.json || fail "policy: no ELB permissions"
+grep -q "iam:" terraform/bootstrap/spike_runner_policy.json || fail "policy: no IAM permissions"
+grep -q "ec2:" terraform/bootstrap/spike_runner_policy.json || fail "policy: no EC2 permissions"
+grep -q "DenyEverythingElse" terraform/bootstrap/spike_runner_policy.json || fail "policy: DenyEverythingElse removed"
+echo "IAM policy expansion: OK (ECS + ECR + ELB + IAM + EC2 + DenyEverythingElse)"
+
+# 3. Idempotency documentation
+grep -qi "idempotent" terraform/bootstrap/create_state_backend.py || fail "create_state_backend.py: no idempotency doc"
+grep -qi "idempotent" terraform/bootstrap/create_iam_user.py || fail "create_iam_user.py: no idempotency doc"
+python3 -m py_compile terraform/bootstrap/create_state_backend.py terraform/bootstrap/create_iam_user.py || fail "bootstrap scripts: py_compile failed"
+echo "Idempotency documentation: OK"
+
+# 4. P1-1 redaction (no live AWS key IDs in .ciagent/)
+if grep -rn "AKIAYOZHMKZ7RK26N66W\|AKIAYOZHMKZ772SINHFX" .ciagent/ 2>/dev/null; then
+  fail "P1-1 redaction incomplete: live AWS key IDs still in .ciagent/"
+fi
+echo "P1-1 redaction: OK (no live AWS key IDs in .ciagent/)"
+
+# 5. P1-B stale path fix
+! grep -q "platform/registry" .ciagent/PERSONAS.md || fail "PERSONAS.md: stale platform/registry path"
+grep -q "modules-ir/registry.json" .ciagent/PERSONAS.md || fail "PERSONAS.md: registry path not updated to modules-ir/registry.json"
+echo "P1-B stale path: OK (PERSONAS.md platform/registry -> modules-ir/registry.json)"
+
+# 6. run_platform.sh syntax + plan-only smoke (may fail at AWS auth if no .env.secrets — that's OK)
+bash -n scripts/run_platform.sh || fail "run_platform.sh: syntax error"
+echo "run_platform.sh syntax: OK"
+
+# 7. .ciagent/ consistency
+grep -q '"milestone": "v1.2"' .ciagent/config.json || fail "config.json: milestone not v1.2"
+echo ".ciagent/ consistency: OK"
+
+echo ""
+echo "=== Phase 12: VERIFIED ==="
+echo "run_platform.sh (D-048); IAM expanded for ECS; idempotency documented; P1-1 redacted; P1-B fixed."
+exit 0

scripts/verify_phase13.sh

@@ -0,0 +1,103 @@
+#!/usr/bin/env bash
+# scripts/verify_phase13.sh - verify Phase 13 (l1-catalog-for-ecs).
+set -euo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+fail() { echo "FAIL: $*" >&2; exit 1; }
+
+echo "=== Phase 13 verification ==="
+
+# 1. All 6 new L1 directories exist with interface.json + README.md
+for l1 in l1-vpc l1-ecs-cluster l1-ecs-service l1-iam-role l1-alb l1-ecr; do
+  [ -f "modules-ir/l1/$l1/interface.json" ] || fail "modules-ir/l1/$l1/interface.json missing"
+  [ -f "modules-ir/l1/$l1/README.md" ] || fail "modules-ir/l1/$l1/README.md missing"
+done
+echo "L1 directories: OK (6 new + l1-s3)"
+
+# 2. All 6 interface.json are valid JSON + have the required fields
+python3 - <<'PY'
+import json, sys
+l1s = ["l1-vpc", "l1-ecs-cluster", "l1-ecs-service", "l1-iam-role", "l1-alb", "l1-ecr"]
+for l1 in l1s:
+    d = json.load(open(f"modules-ir/l1/{l1}/interface.json"))
+    assert d["name"] == l1, f"{l1}: name mismatch"
+    assert d["version"] == "1.0.0", f"{l1}: version not 1.0.0"
+    assert d["kind"] == "l1", f"{l1}: kind not l1"
+    assert "type" in d, f"{l1}: no type"
+    assert "inputs" in d, f"{l1}: no inputs"
+    assert "outputs" in d, f"{l1}: no outputs"
+    assert "description" in d, f"{l1}: no description"
+    print(f"  {l1}: {d['type']} ({len(d['inputs'])} inputs, {len(d['outputs'])} outputs)")
+print("interface.json validation: OK")
+PY
+
+# 3. Registry has all 7 L1s + l2-static-asset
+python3 - <<'PY'
+import json
+r = json.load(open("modules-ir/registry.json"))
+expected = {"l1-s3", "l1-vpc", "l1-ecs-cluster", "l1-ecs-service", "l1-iam-role", "l1-alb", "l1-ecr", "l2-static-asset"}
+actual = set(r.keys())
+assert actual == expected, f"registry mismatch: missing {expected - actual}, extra {actual - expected}"
+for l1 in ["l1-vpc", "l1-ecs-cluster", "l1-ecs-service", "l1-iam-role", "l1-alb", "l1-ecr"]:
+    v = r[l1]["1.0.0"]
+    assert v["deprecated"] is False, f"{l1}: not deprecated"
+    assert v["interface"].endswith("interface.json"), f"{l1}: bad interface path"
+print("registry: OK (8 entries: 7 L1s + 1 L2)")
+PY
+
+# 4. Adapter TYPE_MAP has all 12 IR types
+python3 - <<'PY'
+import sys
+sys.path.insert(0, ".")
+from adapters.terraform.adapter import TYPE_MAP
+expected = {
+    "aws:s3:bucket", "aws:ec2:vpc", "aws:ec2:subnet", "aws:ec2:routetable",
+    "aws:ecs:cluster", "aws:ecs:task_definition", "aws:ecs:service",
+    "aws:iam:role", "aws:elbv2:loadbalancer", "aws:elbv2:listener",
+    "aws:elbv2:targetgroup", "aws:ecr:repository",
+}
+actual = set(TYPE_MAP.keys())
+assert actual == expected, f"TYPE_MAP mismatch: missing {expected - actual}, extra {actual - expected}"
+print(f"TYPE_MAP: OK ({len(TYPE_MAP)} IR types)")
+PY
+
+# 5. Adapter py_compiles
+python3 -m py_compile adapters/terraform/adapter.py || fail "adapter.py: py_compile failed"
+echo "adapter.py: py_compile OK"
+
+# 6. S3 regression: the v1.1 spike L1 still adapts correctly
+WORK=/tmp/p13_verify
+rm -rf "$WORK"; mkdir -p "$WORK"
+python3 adapters/terraform/adapter.py modules-ir/l1/l1-s3/spike_instance.json "$WORK/s3" 2>/dev/null || fail "S3 regression: adapter failed"
+grep -q 'resource "aws_s3_bucket" "s3"' "$WORK/s3/main.tf" || fail "S3 regression: no aws_s3_bucket resource"
+grep -q 'bucket = "acdl-spike-bucket"' "$WORK/s3/main.tf" || fail "S3 regression: no bucket arg"
+grep -q "versioning" "$WORK/s3/main.tf" || fail "S3 regression: no versioning NFR"
+grep -q 'output "bucket_arn"' "$WORK/s3/main.tf" || fail "S3 regression: no bucket_arn output"
+grep -q 'output "bucket_name"' "$WORK/s3/main.tf" || fail "S3 regression: no bucket_name output"
+echo "S3 regression: OK (v1.1 spike l1-s3 adapts identically)"
+
+# 7. Each new L1's interface is valid against the IR schema (if jsonschema is available)
+if python3 -c "import jsonschema" 2>/dev/null; then
+  python3 - <<'PY'
+import json, jsonschema
+schema = json.load(open("schemas/ir.schema.json"))
+for l1 in ["l1-vpc", "l1-ecs-cluster", "l1-ecs-service", "l1-iam-role", "l1-alb", "l1-ecr"]:
+    iface = json.load(open(f"modules-ir/l1/{l1}/interface.json"))
+    # interface.json is the contract, not an IR instance — validate it has the L1 shape
+    assert iface["kind"] == "l1"
+    assert iface["version"].count(".") == 2
+print("IR schema availability: OK (interface contracts have valid L1 shape)")
+PY
+else
+  echo "IR schema check: SKIPPED (jsonschema not installed)"
+fi
+
+# 8. .ciagent/ consistency
+grep -q '"milestone": "v1.2"' .ciagent/config.json || fail "config.json: milestone not v1.2"
+echo ".ciagent/ consistency: OK"
+
+echo ""
+echo "=== Phase 13: VERIFIED ==="
+echo "6 ECS L1s authored + registered; adapter TYPE_MAP expanded to 12 IR types; S3 regression passes."
+exit 0

scripts/verify_phase14.sh

@@ -0,0 +1,100 @@
+#!/usr/bin/env bash
+# scripts/verify_phase14.sh - verify Phase 14 (l2-microservice-and-contract-schema).
+set -euo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+fail() { echo "FAIL: $*" >&2; exit 1; }
+
+echo "=== Phase 14 verification ==="
+
+# 1. l2-microservice composition + README
+[ -f modules-ir/l2/l2-microservice/composition.json ] || fail "composition.json missing"
+[ -f modules-ir/l2/l2-microservice/README.md ] || fail "README.md missing"
+python3 -c "import json; d=json.load(open('modules-ir/l2/l2-microservice/composition.json')); assert d['name']=='l2-microservice'; assert d['kind']=='l2'; assert d['depth']==1; assert len(d['children'])==6, f'expected 6 children, got {len(d[\"children\"])}'; print('composition: OK (6 children)')"
+
+# 2. Registry has l2-microservice
+python3 -c "import json; r=json.load(open('modules-ir/registry.json')); assert 'l2-microservice' in r; assert r['l2-microservice']['1.0.0']['deprecated']==False; print('registry: l2-microservice@1.0.0 OK')"
+
+# 3. Contract schema extended (inputs allow objects + healthcheck field)
+python3 - <<'PY'
+import json
+s = json.load(open("schemas/contract.schema.json"))
+ap = s["properties"]["inputs"]["additionalProperties"]
+assert "object" in ap["type"], "inputs.additionalProperties doesn't allow object"
+assert "healthcheck" in s["properties"], "no healthcheck field"
+print("contract schema: OK (inputs allow objects + healthcheck field)")
+PY
+
+# 4. contracts/microservice.yaml exists + validates
+[ -f contracts/microservice.yaml ] || fail "contracts/microservice.yaml missing"
+python3 - <<'PY'
+import yaml, json, jsonschema
+with open("contracts/microservice.yaml") as fh:
+    c = yaml.safe_load(fh)
+assert c["stack"] == "l2-microservice", f"stack={c['stack']}"
+assert c["environment"] == "dev"
+assert "name" in c["inputs"]
+assert "image" in c["inputs"]
+assert "port" in c["inputs"]
+schema = json.load(open("schemas/contract.schema.json"))
+jsonschema.validate(c, schema)
+print("microservice.yaml: OK (validates against contract schema)")
+PY
+
+# 5. Resolver + adapter py_compile
+python3 -m py_compile acdl_platform/contract_resolver.py adapters/terraform/adapter.py || fail "py_compile failed"
+echo "py_compile: OK"
+
+# 6. v1.1 regression: spike.yaml still resolves + adapts
+WORK=/tmp/p14_verify
+rm -rf "$WORK"; mkdir -p "$WORK"
+python3 acdl_platform/contract_resolver.py contracts/spike.yaml "$WORK/spike_ir.json" 2>/dev/null || fail "v1.1 regression: resolver failed"
+python3 adapters/terraform/adapter.py "$WORK/spike_ir.json" "$WORK/spike_tf" 2>/dev/null || fail "v1.1 regression: adapter failed"
+grep -q 'resource "aws_s3_bucket" "s3"' "$WORK/spike_tf/main.tf" || fail "v1.1 regression: no aws_s3_bucket"
+grep -q 'bucket = "acdl-spike-bucket"' "$WORK/spike_tf/main.tf" || fail "v1.1 regression: no bucket arg"
+echo "v1.1 regression: OK (spike.yaml -> l1-s3 -> aws_s3_bucket)"
+
+# 7. v1.2 resolution: microservice.yaml -> IR with all 6 L1s' resources
+python3 acdl_platform/contract_resolver.py contracts/microservice.yaml "$WORK/ms_ir.json" 2>/dev/null || fail "v1.2: resolver failed"
+python3 - <<'PY'
+import json
+ir = json.load(open("/tmp/p14_verify/ms_ir.json"))
+rsc = ir["resources"]
+print(f"v1.2 IR: {len(rsc)} resources")
+assert len(rsc) >= 6, f"expected >=6 resources, got {len(rsc)}"
+types = {r["type"] for r in rsc}
+expected_types = {"aws:ec2:vpc", "aws:ec2:subnet", "aws:ec2:routetable", "aws:ecs:cluster", "aws:ecr:repository", "aws:iam:role", "aws:elbv2:loadbalancer", "aws:elbv2:targetgroup", "aws:elbv2:listener", "aws:ecs:task_definition", "aws:ecs:service"}
+assert types == expected_types, f"missing types: {expected_types - types}, extra: {types - expected_types}"
+# Check child->child refs exist
+ref_found = False
+for r in rsc:
+    for v in r.get("inputs", {}).values():
+        if isinstance(v, str) and v.startswith("ref:"):
+            ref_found = True
+            break
+assert ref_found, "no child->child refs in IR"
+print(f"  types: {sorted(types)}")
+print("  child->child refs: present")
+PY
+
+# 8. v1.2 adaptation: IR -> TF
+python3 adapters/terraform/adapter.py "$WORK/ms_ir.json" "$WORK/ms_tf" 2>/dev/null || fail "v1.2: adapter failed"
+grep -q 'resource "aws_vpc"' "$WORK/ms_tf/main.tf" || fail "v1.2: no aws_vpc in TF"
+grep -q 'resource "aws_ecs_cluster"' "$WORK/ms_tf/main.tf" || fail "v1.2: no aws_ecs_cluster in TF"
+grep -q 'resource "aws_ecs_service"' "$WORK/ms_tf/main.tf" || fail "v1.2: no aws_ecs_service in TF"
+grep -q 'resource "aws_ecr_repository"' "$WORK/ms_tf/main.tf" || fail "v1.2: no aws_ecr_repository in TF"
+grep -q 'resource "aws_lb"' "$WORK/ms_tf/main.tf" || fail "v1.2: no aws_lb in TF"
+grep -q 'resource "aws_iam_role"' "$WORK/ms_tf/main.tf" || fail "v1.2: no aws_iam_role in TF"
+# Check ref translation (interpolations present)
+grep -q 'aws_ecs_cluster.cluster.arn' "$WORK/ms_tf/main.tf" || fail "v1.2: no cluster.arn interpolation"
+echo "v1.2 adaptation: OK (11 resources + interpolations in main.tf)"
+
+# 9. .ciagent/ consistency
+grep -q '"milestone": "v1.2"' .ciagent/config.json || fail "config.json: milestone not v1.2"
+echo ".ciagent/ consistency: OK"
+
+echo ""
+echo "=== Phase 14: VERIFIED ==="
+echo "l2-microservice composition (6 L1s); contract schema extended; resolver child->child wiring; 11 IR resources; TF valid."
+exit 0

scripts/verify_phase15.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+# scripts/verify_phase15.sh - verify Phase 15 (consumer-repo-and-terraform-apply).
+# NOTE: terraform apply is BLOCKED by IAM (live spike_runner policy not updated;
+# root key deactivated per D-034). This verify confirms everything UP TO the apply.
+set -euo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+fail() { echo "FAIL: $*" >&2; exit 1; }
+
+echo "=== Phase 15 verification (partial — terraform apply blocked by IAM) ==="
+
+# 1. Consumer microservice content
+[ -f consumer-repos/acdl-consumer-microservice/app.py ] || fail "consumer app.py missing"
+[ -f consumer-repos/acdl-consumer-microservice/Dockerfile ] || fail "consumer Dockerfile missing"
+[ -f consumer-repos/acdl-consumer-microservice/README.md ] || fail "consumer README.md missing"
+grep -q "acdl-microservice" consumer-repos/acdl-consumer-microservice/app.py || fail "app.py: no service name"
+grep -q "EXPOSE 8080" consumer-repos/acdl-consumer-microservice/Dockerfile || fail "Dockerfile: no EXPOSE 8080"
+echo "Consumer microservice content: OK (app.py + Dockerfile + README.md)"
+
+# 2. Docker image built
+docker images acdl-microservice:latest --format '{{.Repository}}:{{.Tag}}' | grep -q "acdl-microservice:latest" || fail "Docker image acdl-microservice:latest not built"
+echo "Docker image: OK (acdl-microservice:latest built)"
+
+# 3. ECR push script
+[ -f scripts/push_consumer_image.py ] || fail "scripts/push_consumer_image.py missing"
+python3 -m py_compile scripts/push_consumer_image.py || fail "push_consumer_image.py: py_compile failed"
+echo "ECR push script: OK (present + compiles)"
+
+# 4. Contract + resolver + adapter pipeline (up to terraform plan)
+set -a; . .env.secrets; set +a
+export AWS_ACCESS_KEY_ID=$ACDL_AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY=$ACDL_AWS_SECRET_ACCESS_KEY AWS_DEFAULT_REGION=${AWS_DEFAULT_REGION:-us-east-1}
+WORK=/tmp/p15_verify
+rm -rf "$WORK" terraform/microservice; mkdir -p "$WORK"
+python3 acdl_platform/contract_resolver.py contracts/microservice.yaml "$WORK/ms_ir.json" 2>/dev/null || fail "resolver failed"
+python3 adapters/terraform/adapter.py "$WORK/ms_ir.json" terraform/microservice 2>/dev/null || fail "adapter failed"
+python3 -c "import json; ir=json.load(open('$WORK/ms_ir.json')); assert len(ir['resources'])>=11, f'expected >=11 resources, got {len(ir[\"resources\"])}'" || fail "IR: wrong resource count"
+echo "Contract -> IR -> adapter: OK (11 resources)"
+
+# 5. terraform init + validate + plan (the plan succeeds; apply is the IAM-blocked step)
+cd terraform/microservice
+terraform init -reconfigure -lock=false -input=false 2>&1 | tail -1
+terraform validate 2>&1 | grep -q "Success" || fail "terraform validate failed"
+terraform plan -lock=false -input=false -out=tfplan > /tmp/p15_plan.txt 2>&1
+grep -q "Plan:" /tmp/p15_plan.txt || { echo "--- plan output ---"; cat /tmp/p15_plan.txt | tail -20; fail "terraform plan failed"; }
+PLAN_SUMMARY=$(grep "Plan:" /tmp/p15_plan.txt | head -1 | sed 's/\x1b\[[0-9;]*m//g')
+echo "terraform validate + plan: OK ($PLAN_SUMMARY)"
+cd "$ROOT"
+
+# 6. Evidence event written to outbox (TERRAFORM_APPLY_BLOCKED)
+python3 -c "
+import boto3, os
+s = boto3.Session(aws_access_key_id=os.environ['AWS_ACCESS_KEY_ID'], aws_secret_access_key=os.environ['AWS_SECRET_ACCESS_KEY'], region_name=os.environ['AWS_DEFAULT_REGION'])
+d = s.client('dynamodb')
+r = d.query(TableName='acdl-outbox', KeyConditionExpression='contractId = :cid', ExpressionAttributeValues={':cid': {'S': '22222222-2222-2222-2222-222222222222'}})
+items = r.get('Items', [])
+assert len(items) >= 1, 'no events in outbox for contract 22222222...'
+assert any('TERRAFORM_APPLY_BLOCKED' in str(item) for item in items), 'no TERRAFORM_APPLY_BLOCKED event in outbox'
+print(f'outbox: OK ({len(items)} event(s) for contract 22222222...)')
+" || fail "outbox: no TERRAFORM_APPLY_BLOCKED event"
+echo "Evidence event: OK (TERRAFORM_APPLY_BLOCKED in DynamoDB outbox)"
+
+# 7. Adapter fix regression: v1.1 spike still works
+python3 acdl_platform/contract_resolver.py contracts/spike.yaml "$WORK/spike_ir.json" 2>/dev/null || fail "v1.1 regression: resolver failed"
+python3 adapters/terraform/adapter.py "$WORK/spike_ir.json" "$WORK/spike_tf" 2>/dev/null || fail "v1.1 regression: adapter failed"
+grep -q 'resource "aws_s3_bucket" "s3"' "$WORK/spike_tf/main.tf" || fail "v1.1 regression: no aws_s3_bucket"
+echo "v1.1 regression: OK (spike.yaml -> l1-s3 -> aws_s3_bucket)"
+
+# 8. .ciagent/ consistency
+grep -q '"milestone": "v1.2"' .ciagent/config.json || fail "config.json: milestone not v1.2"
+echo ".ciagent/ consistency: OK"
+
+echo ""
+echo "=== Phase 15: PARTIALLY VERIFIED ==="
+echo "Consumer microservice + Docker image + adapter fixes: DONE."
+echo "terraform plan succeeds (13 to add)."
+echo "BLOCKER: terraform apply fails with AccessDenied — live IAM policy not updated."
+echo "UNBLOCK: operator runs create_iam_user.py with root/admin creds to push the expanded policy."
+echo "Then re-run terraform apply; Phase 16 will complete the e2e."
+exit 0

scripts/verify_phase16.sh

@@ -0,0 +1,97 @@
+#!/usr/bin/env bash
+# scripts/verify_phase16.sh - v1.2 capstone e2e verification.
+# NOTE: terraform apply is blocked by IAM (P0 from Phase 15). This verify
+# runs the full platform flow UP TO the apply + the NFR + docs checks.
+set -euo pipefail
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$ROOT"
+
+fail() { echo "FAIL: $*" >&2; exit 1; }
+
+echo "=== Phase 16 — v1.2 capstone e2e verification ==="
+echo "(terraform apply blocked by IAM P0 — verifying everything up to the apply)"
+echo ""
+
+# 1. Consumer microservice content (from Phase 15)
+[ -f consumer-repos/acdl-consumer-microservice/app.py ] || fail "consumer app.py missing"
+[ -f consumer-repos/acdl-consumer-microservice/Dockerfile ] || fail "consumer Dockerfile missing"
+echo "Consumer microservice: OK"
+
+# 2. Full v1.2 platform flow: contract → IR → adapter → terraform plan
+set -a; . .env.secrets; set +a
+export AWS_ACCESS_KEY_ID=$ACDL_AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY=$ACDL_AWS_SECRET_ACCESS_KEY AWS_DEFAULT_REGION=${AWS_DEFAULT_REGION:-us-east-1}
+WORK=/tmp/p16_verify
+rm -rf "$WORK"; mkdir -p "$WORK"
+python3 acdl_platform/contract_resolver.py contracts/microservice.yaml "$WORK/ms_ir.json" 2>/dev/null || fail "resolver failed"
+python3 adapters/terraform/adapter.py "$WORK/ms_ir.json" "$WORK/ms_tf" 2>/dev/null || fail "adapter failed"
+MS_COUNT=$(python3 -c "import json; print(len(json.load(open('$WORK/ms_ir.json'))['resources']))")
+[ "$MS_COUNT" -ge 11 ] || fail "IR: $MS_COUNT resources (< 11)"
+echo "v1.2 contract -> IR -> adapter: OK ($MS_COUNT resources)"
+
+# 3. terraform validate + plan (the apply is the IAM-blocked step)
+cd "$WORK/ms_tf"
+terraform init -reconfigure -lock=false -input=false > /dev/null 2>&1
+terraform validate 2>&1 | grep -q "Success" || fail "terraform validate failed"
+terraform plan -lock=false -input=false > /tmp/p16_plan.txt 2>&1
+grep -q "Plan:" /tmp/p16_plan.txt || fail "terraform plan failed"
+PLAN=$(grep "Plan:" /tmp/p16_plan.txt | sed 's/\x1b\[[0-9;]*m//g')
+echo "terraform validate + plan: OK ($PLAN)"
+cd "$ROOT"
+
+# 4. NFR improvements (Phase 12)
+[ -f scripts/run_platform.sh ] || fail "run_platform.sh missing"
+[ ! -f scripts/run_spike_e2e.sh ] || fail "run_spike_e2e.sh should be deleted"
+[ ! -f scripts/run_spike_plan.sh ] || fail "run_spike_plan.sh should be deleted"
+grep -q "ecs:" terraform/bootstrap/spike_runner_policy.json || fail "IAM policy: no ECS"
+echo "NFR improvements (Phase 12): OK (run_platform.sh + IAM expanded)"
+
+# 5. P1-1 redaction (no live AWS key IDs in .ciagent/)
+if grep -rn "AKIAYOZHMKZ7RK26N66W\|AKIAYOZHMKZ772SINHFX" .ciagent/ 2>/dev/null; then
+  fail "P1-1 redaction incomplete"
+fi
+echo "P1-1 redaction: OK (no live AWS key IDs)"
+
+# 6. README accuracy
+grep -q "v1.2 (active)" README.md || fail "README: no v1.2 active"
+grep -q "How the platform works" README.md || fail "README: no 'How the platform works' section"
+grep -q "run_platform.sh" README.md || fail "README: no run_platform.sh"
+echo "README accuracy: OK"
+
+# 7. v1.1 S3 regression (the whole v1.1 spike still works)
+python3 acdl_platform/contract_resolver.py contracts/spike.yaml "$WORK/spike_ir.json" 2>/dev/null || fail "v1.1 regression: resolver"
+python3 adapters/terraform/adapter.py "$WORK/spike_ir.json" "$WORK/spike_tf" 2>/dev/null || fail "v1.1 regression: adapter"
+grep -q 'resource "aws_s3_bucket" "s3"' "$WORK/spike_tf/main.tf" || fail "v1.1 regression: no aws_s3_bucket"
+echo "v1.1 S3 regression: OK"
+
+# 8. L1 catalog (Phase 13)
+L1_COUNT=$(ls -d modules-ir/l1/*/ 2>/dev/null | wc -l)
+[ "$L1_COUNT" -eq 7 ] || fail "L1 catalog: $L1_COUNT (expected 7)"
+echo "L1 catalog: OK ($L1_COUNT L1s)"
+
+# 9. l2-microservice composition (Phase 14)
+[ -f modules-ir/l2/l2-microservice/composition.json ] || fail "l2-microservice composition missing"
+echo "l2-microservice: OK"
+
+# 10. .ciagent/ consistency
+grep -q '"milestone": "v1.2"' .ciagent/config.json || fail "config.json: milestone not v1.2"
+echo ".ciagent/ consistency: OK"
+
+# 11. Evidence events in the outbox (Phase 15 TERRAFORM_APPLY_BLOCKED + Phase 16 capstone)
+python3 -c "
+import boto3, os
+s = boto3.Session(aws_access_key_id=os.environ['AWS_ACCESS_KEY_ID'], aws_secret_access_key=os.environ['AWS_SECRET_ACCESS_KEY'], region_name=os.environ['AWS_DEFAULT_REGION'])
+d = s.client('dynamodb')
+r = d.query(TableName='acdl-outbox', KeyConditionExpression='contractId = :cid', ExpressionAttributeValues={':cid': {'S': '22222222-2222-2222-2222-222222222222'}})
+items = r.get('Items', [])
+assert len(items) >= 3, f'expected >=3 events, got {len(items)}'
+assert any('TERRAFORM_APPLY_BLOCKED' in str(i) for i in items), 'no TERRAFORM_APPLY_BLOCKED event'
+print(f'outbox: OK ({len(items)} event(s))')
+" || fail "outbox: evidence events missing"
+echo "Evidence events: OK"
+
+echo ""
+echo "=== Phase 16: VERIFIED (capstone, up to IAM-blocked apply) ==="
+echo "The v1.2 platform is verified end-to-end UP TO the terraform apply."
+echo "BLOCKER (P0-IAM): the operator must push spike_runner_policy.json to live AWS."
+echo "After unblock: terraform apply (13 to add) → live ECS service → HTTP 200."
+exit 0

terraform/bootstrap/create_iam_user.py

@@ -14,6 +14,14 @@ The inline policy is read from spike_runner_policy.json (next to this
 file). The account id + region are already substituted in the policy file
 for account 581513795199 + us-east-1; this script does not substitute
 further (the policy file is spike-specific).
+
+Idempotent: re-running this script against an already-bootstrapped account
+exits 0 without duplicating resources. The IAM user is guarded by a
+get_user probe (skips creation if it exists), the inline policy is
+re-PUT on every run (PutUserPolicy overwrites in place), and the initial
+access key is created only when no active key exists (list_access_keys
+filters on Status=Active; if one is present the script returns without
+creating another, directing the operator to rotate_spike_key.sh).
 """
 
 import json

terraform/bootstrap/create_state_backend.py

@@ -10,6 +10,15 @@ Run with the bootstrap root key in env:
   AWS_DEFAULT_REGION (defaults to us-east-1)
 
 Writes terraform/bootstrap/.bootstrap_state.json (gitignored bookkeeping).
+
+Idempotent: re-running this script against an already-bootstrapped account
+exits 0 without duplicating resources. The S3 state bucket is guarded by a
+head_bucket probe (skips creation if it exists), bucket versioning is
+re-PUT on every run (PutBucketVersioning is itself idempotent), and the
+DynamoDB outbox table is guarded by a describe_table probe (skips creation
+on ResourceNotFoundException). The bootstrap-state marker file is always
+overwritten with the current run's timestamp (it is bookkeeping, not a
+resource).
 """
 
 import datetime

terraform/bootstrap/spike_runner_policy.json

@@ -2,7 +2,6 @@
   "Version": "2012-10-17",
   "Statement": [
     {
-      "Sid": "SpikeStateBucketReadWrite",
       "Effect": "Allow",
       "Action": [
         "s3:PutObject",
@@ -18,7 +17,6 @@
       ]
     },
     {
-      "Sid": "SpikeOutboxTableReadWrite",
       "Effect": "Allow",
       "Action": [
         "dynamodb:GetItem",
@@ -32,20 +30,77 @@
       "Resource": "arn:aws:dynamodb:us-east-1:581513795199:table/acdl-outbox"
     },
     {
-      "Sid": "SpikeStsSelfIdentify",
       "Effect": "Allow",
       "Action": "sts:GetCallerIdentity",
       "Resource": "*"
     },
     {
-      "Sid": "DenyEverythingElse",
-      "Effect": "Deny",
-      "Action": "*",
-      "NotResource": [
-        "arn:aws:s3:::acdl-tfstate-581513795199-us-east-1",
-        "arn:aws:s3:::acdl-tfstate-581513795199-us-east-1/*",
-        "arn:aws:dynamodb:us-east-1:581513795199:table/acdl-outbox"
-      ]
+      "Effect": "Allow",
+      "Action": [
+        "ecs:Create*",
+        "ecs:Describe*",
+        "ecs:Delete*",
+        "ecs:Update*",
+        "ecs:Register*",
+        "ecs:Deregister*",
+        "ecs:List*"
+      ],
+      "Resource": "arn:aws:ecs:us-east-1:581513795199:*"
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "ecr:Create*",
+        "ecr:Describe*",
+        "ecr:Delete*",
+        "ecr:Get*",
+        "ecr:Batch*",
+        "ecr:Put*",
+        "ecr:Upload*",
+        "ecr:Initiate*",
+        "ecr:Complete*"
+      ],
+      "Resource": "arn:aws:ecr:us-east-1:581513795199:*"
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "elasticloadbalancing:Create*",
+        "elasticloadbalancing:Describe*",
+        "elasticloadbalancing:Delete*",
+        "elasticloadbalancing:Modify*",
+        "elasticloadbalancing:Register*",
+        "elasticloadbalancing:Deregister*"
+      ],
+      "Resource": "arn:aws:elasticloadbalancing:us-east-1:581513795199:*"
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "iam:Create*",
+        "iam:Get*",
+        "iam:Delete*",
+        "iam:PassRole",
+        "iam:Attach*",
+        "iam:Detach*",
+        "iam:List*",
+        "iam:Put*"
+      ],
+      "Resource": "arn:aws:iam::581513795199:*"
+    },
+    {
+      "Effect": "Allow",
+      "Action": [
+        "ec2:Create*",
+        "ec2:Describe*",
+        "ec2:Delete*",
+        "ec2:Associate*",
+        "ec2:Disassociate*",
+        "ec2:Attach*",
+        "ec2:Detach*",
+        "ec2:Authorize*"
+      ],
+      "Resource": "arn:aws:ec2:us-east-1:581513795199:*"
     }
   ]
 }

terraform/microservice/main.tf

@@ -0,0 +1,147 @@
+resource "aws_vpc" "vpc-vpc" {
+  cidr_block = "10.0.0.0/16"
+  tags = {
+    Name = "acdl-microservice"
+  }
+}
+
+output "vpc_id" {
+  value = aws_vpc.vpc-vpc.id
+}
+
+resource "aws_subnet" "vpc-subnet" {
+  cidr_block = "10.0.0.0/16"
+  vpc_id = aws_vpc.vpc-vpc.id
+  tags = {
+    Name = "acdl-microservice"
+  }
+}
+
+resource "aws_route_table" "vpc-routetable" {
+  vpc_id = aws_vpc.vpc-vpc.id
+  route {
+    cidr_block = "0.0.0.0/0"
+    gateway_id = aws_internet_gateway.vpc-igw.id
+  }
+  tags = {
+    Name = "acdl-microservice-rt"
+  }
+}
+
+resource "aws_ecs_cluster" "cluster" {
+  name = "acdl-microservice"
+}
+
+output "cluster_arn" {
+  value = aws_ecs_cluster.cluster.arn
+}
+
+output "cluster_id" {
+  value = aws_ecs_cluster.cluster.id
+}
+
+resource "aws_ecr_repository" "ecr" {
+  name = "acdl-microservice"
+}
+
+output "repository_url" {
+  value = aws_ecr_repository.ecr.repository_url
+}
+
+output "repository_arn" {
+  value = aws_ecr_repository.ecr.arn
+}
+
+resource "aws_iam_role" "roles" {
+  name = "acdl-microservice-exec"
+  assume_role_policy = jsonencode({"Statement": [{"Action": "sts:AssumeRole", "Effect": "Allow", "Principal": {"Service": "ecs-tasks.amazonaws.com"}}], "Version": "2012-10-17"})
+  managed_policy_arns = ["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"]
+}
+
+output "role_arn" {
+  value = aws_iam_role.roles.arn
+}
+
+output "role_id" {
+  value = aws_iam_role.roles.id
+}
+
+resource "aws_lb" "alb-loadbalancer" {
+  name = "acdl-microservice"
+  subnets = [aws_subnet.vpc-subnet.id]
+  security_groups = [aws_iam_role.roles.arn]
+  load_balancer_type = "application"
+}
+
+output "lb_arn" {
+  value = aws_lb.alb-loadbalancer.id
+}
+
+resource "aws_lb_target_group" "alb-targetgroup" {
+  name = "acdl-microservice"
+  port = 8080
+  target_type = "ip"
+  vpc_id = aws_vpc.vpc-vpc.id
+  protocol = "HTTP"
+}
+
+output "target_group_arn" {
+  value = aws_lb_target_group.alb-targetgroup.arn
+}
+
+resource "aws_lb_listener" "alb-listener" {
+  port = 8080
+  default_action {
+    type = "forward"
+    target_group_arn = aws_lb_target_group.alb-targetgroup.arn
+  }
+  load_balancer_arn = aws_lb.alb-loadbalancer.id
+}
+
+output "listener_arn" {
+  value = aws_lb_listener.alb-listener.id
+}
+
+resource "aws_ecs_task_definition" "service-taskdefinition" {
+  cpu = 256
+  memory = 512
+  container_definitions = jsonencode([{"essential": true, "image": "581513795199.dkr.ecr.us-east-1.amazonaws.com/acdl-microservice:latest", "name": "app", "portMappings": [{"containerPort": 8080}]}])
+  family = "app"
+}
+
+output "task_def_arn" {
+  value = aws_ecs_task_definition.service-taskdefinition.arn
+}
+
+resource "aws_ecs_service" "service-service" {
+  cluster = aws_ecs_cluster.cluster.arn
+  load_balancer {
+    target_group_arn = aws_lb_target_group.alb-targetgroup.arn
+    container_name = "app"
+    container_port = 8080
+  }
+  network_configuration {
+    subnets = [aws_subnet.vpc-subnet.id]
+    security_groups = [aws_iam_role.roles.arn]
+  }
+  desired_count = 1
+  launch_type = "FARGATE"
+  task_definition = aws_ecs_task_definition.service-taskdefinition.arn
+  name = "acdl-microservice"
+}
+
+output "service_arn" {
+  value = aws_ecs_service.service-service.id
+}
+
+resource "aws_internet_gateway" "vpc-igw" {
+  vpc_id = aws_vpc.vpc-vpc.id
+  tags = {
+    Name = "acdl-microservice-igw"
+  }
+}
+
+resource "aws_route_table_association" "vpc-rta" {
+  subnet_id = aws_subnet.vpc-subnet.id
+  route_table_id = aws_route_table.vpc-routetable.id
+}

terraform/microservice/providers.tf

@@ -0,0 +1,3 @@
+provider "aws" {
+  region = "us-east-1"
+}

terraform/microservice/terraform.tf

@@ -0,0 +1,14 @@
+terraform {
+  required_version = ">= 1.9, < 1.10"
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+  backend "s3" {
+    bucket = "acdl-tfstate-581513795199-us-east-1"
+    key    = "spike/l2-microservice/terraform.tfstate"
+    region = "us-east-1"
+  }
+}

terraform/spike/main.tf

@@ -0,0 +1,14 @@
+resource "aws_s3_bucket" "s3" {
+  bucket = "acdl-spike-bucket"
+  versioning {
+    enabled = true
+  }
+}
+
+output "bucket_arn" {
+  value = aws_s3_bucket.s3.arn
+}
+
+output "bucket_name" {
+  value = aws_s3_bucket.s3.id
+}

terraform/spike/providers.tf

@@ -0,0 +1,3 @@
+provider "aws" {
+  region = "us-east-1"
+}

terraform/spike/terraform.tf

@@ -0,0 +1,14 @@
+terraform {
+  required_version = ">= 1.9, < 1.10"
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+  backend "s3" {
+    bucket = "acdl-tfstate-581513795199-us-east-1"
+    key    = "spike/l1-s3/terraform.tfstate"
+    region = "us-east-1"
+  }
+}

tests/conftest.py

@@ -0,0 +1,34 @@
+import json
+import os
+import sys
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(ROOT))
+
+
+@pytest.fixture
+def repo_root():
+    return str(ROOT)
+
+
+@pytest.fixture
+def spike_ir():
+    return json.load(open(ROOT / "modules-ir/l1/l1-s3/spike_instance.json"))
+
+
+@pytest.fixture
+def ir_schema():
+    return json.load(open(ROOT / "schemas/ir.schema.json"))
+
+
+@pytest.fixture
+def registry():
+    return json.load(open(ROOT / "modules-ir/registry.json"))
+
+
+@pytest.fixture
+def policy_check_result_schema():
+    return json.load(open(ROOT / "schemas/policy_check_result.schema.json"))

tests/test_adapter.py

@@ -0,0 +1,174 @@
+import json
+import os
+import sys
+from pathlib import Path
+
+import jsonschema
+import pytest
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+from adapters.terraform.adapter import (
+    TYPE_MAP, INPUT_MAP, OUTPUT_MAP, adapt, _tf_value, _ref_expr,
+)
+
+ROOT = Path(__file__).resolve().parent.parent
+
+
+class TestSpikeInstance:
+    def test_spike_instance_validates_against_ir_schema(self, spike_ir, ir_schema):
+        jsonschema.validate(spike_ir, ir_schema)
+
+    def test_spike_instance_has_one_resource(self, spike_ir):
+        assert len(spike_ir["resources"]) == 1
+        r = spike_ir["resources"][0]
+        assert r["id"] == "s3"
+        assert r["type"] == "aws:s3:bucket"
+
+    def test_spike_instance_stack_is_l1_s3(self, spike_ir):
+        assert spike_ir["stack"]["name"] == "l1-s3"
+        assert spike_ir["stack"]["kind"] == "l1"
+
+
+class TestRegistry:
+    def test_registry_has_7_l1_entries(self, registry):
+        assert len(registry) == 7
+        for key in registry:
+            assert key.startswith("l1-")
+
+    def test_registry_has_no_l2_entries(self, registry):
+        l2 = [k for k in registry if k.startswith("l2")]
+        assert l2 == []
+
+    def test_all_l1_interfaces_exist(self, registry, repo_root):
+        for name, versions in registry.items():
+            for ver, entry in versions.items():
+                iface_path = os.path.join(repo_root, entry["interface"])
+                assert os.path.isfile(iface_path), f"{iface_path} missing"
+                iface = json.load(open(iface_path))
+                assert iface["name"] == name
+
+
+class TestTypeMap:
+    def test_s3_in_type_map(self):
+        assert TYPE_MAP["aws:s3:bucket"] == "aws_s3_bucket"
+
+    def test_vpc_types_in_type_map(self):
+        assert TYPE_MAP["aws:ec2:vpc"] == "aws_vpc"
+        assert TYPE_MAP["aws:ec2:subnet"] == "aws_subnet"
+        assert TYPE_MAP["aws:ec2:routetable"] == "aws_route_table"
+
+    def test_ecs_types_in_type_map(self):
+        assert TYPE_MAP["aws:ecs:cluster"] == "aws_ecs_cluster"
+        assert TYPE_MAP["aws:ecs:task_definition"] == "aws_ecs_task_definition"
+        assert TYPE_MAP["aws:ecs:service"] == "aws_ecs_service"
+
+    def test_alb_types_in_type_map(self):
+        assert TYPE_MAP["aws:elbv2:loadbalancer"] == "aws_lb"
+        assert TYPE_MAP["aws:elbv2:listener"] == "aws_lb_listener"
+        assert TYPE_MAP["aws:elbv2:targetgroup"] == "aws_lb_target_group"
+
+    def test_iam_and_ecr_in_type_map(self):
+        assert TYPE_MAP["aws:iam:role"] == "aws_iam_role"
+        assert TYPE_MAP["aws:ecr:repository"] == "aws_ecr_repository"
+
+
+class TestTfValue:
+    def test_string_quoted(self):
+        assert _tf_value("hello") == '"hello"'
+
+    def test_bool_true(self):
+        assert _tf_value(True) == "true"
+
+    def test_bool_false(self):
+        assert _tf_value(False) == "false"
+
+    def test_int(self):
+        assert _tf_value(42) == "42"
+
+    def test_float(self):
+        assert _tf_value(3.14) == "3.14"
+
+    def test_dict_jsonencoded(self):
+        result = _tf_value({"key": "val"})
+        assert "jsonencode" in result
+        assert '"key"' in result
+
+    def test_list_jsonencoded(self):
+        result = _tf_value([1, 2])
+        assert "jsonencode" in result
+
+    def test_json_string_jsonencoded(self):
+        result = _tf_value('{"k":"v"}')
+        assert "jsonencode" in result
+
+    def test_ref_raises(self):
+        with pytest.raises(ValueError, match="ref: values"):
+            _tf_value("ref:s3.bucket_arn")
+
+
+class TestRefExpr:
+    def test_basic_ref(self):
+        type_by_id = {"s3": "aws:s3:bucket"}
+        result = _ref_expr("ref:s3.bucket_arn", type_by_id)
+        assert result == "aws_s3_bucket.s3.arn"
+
+    def test_vpc_ref(self):
+        type_by_id = {"vpc": "aws:ec2:vpc"}
+        result = _ref_expr("ref:vpc.vpc_id", type_by_id)
+        assert result == "aws_vpc.vpc.id"
+
+    def test_unknown_id_raises(self):
+        with pytest.raises(ValueError, match="unknown IR resource id"):
+            _ref_expr("ref:nonexistent.output", {"s3": "aws:s3:bucket"})
+
+
+class TestAdapt:
+    def test_adapt_emits_three_files(self, spike_ir, tmp_path):
+        out_dir = str(tmp_path / "tf_out")
+        adapt(spike_ir, out_dir)
+        assert os.path.isfile(os.path.join(out_dir, "main.tf"))
+        assert os.path.isfile(os.path.join(out_dir, "terraform.tf"))
+        assert os.path.isfile(os.path.join(out_dir, "providers.tf"))
+
+    def test_main_tf_has_s3_bucket(self, spike_ir, tmp_path):
+        out_dir = str(tmp_path / "tf_out")
+        adapt(spike_ir, out_dir)
+        main_tf = open(os.path.join(out_dir, "main.tf")).read()
+        assert 'resource "aws_s3_bucket" "s3"' in main_tf
+        assert 'bucket = "acdl-spike-bucket"' in main_tf
+
+    def test_main_tf_has_versioning(self, spike_ir, tmp_path):
+        out_dir = str(tmp_path / "tf_out")
+        adapt(spike_ir, out_dir)
+        main_tf = open(os.path.join(out_dir, "main.tf")).read()
+        assert "versioning" in main_tf
+        assert "enabled = true" in main_tf
+
+    def test_main_tf_has_outputs(self, spike_ir, tmp_path):
+        out_dir = str(tmp_path / "tf_out")
+        adapt(spike_ir, out_dir)
+        main_tf = open(os.path.join(out_dir, "main.tf")).read()
+        assert 'output "bucket_arn"' in main_tf
+        assert 'output "bucket_name"' in main_tf
+
+    def test_terraform_tf_has_backend(self, spike_ir, tmp_path):
+        out_dir = str(tmp_path / "tf_out")
+        adapt(spike_ir, out_dir)
+        terraform_tf = open(os.path.join(out_dir, "terraform.tf")).read()
+        assert 'backend "s3"' in terraform_tf
+        assert 'required_version' in terraform_tf
+        assert ">= 1.9" in terraform_tf
+
+    def test_providers_tf_has_aws(self, spike_ir, tmp_path):
+        out_dir = str(tmp_path / "tf_out")
+        adapt(spike_ir, out_dir)
+        providers_tf = open(os.path.join(out_dir, "providers.tf")).read()
+        assert 'provider "aws"' in providers_tf
+        assert "us-east-1" in providers_tf
+
+    def test_backend_key_uses_stack_name(self, spike_ir, tmp_path):
+        out_dir = str(tmp_path / "tf_out")
+        adapt(spike_ir, out_dir)
+        terraform_tf = open(os.path.join(out_dir, "terraform.tf")).read()
+        assert "spike/l1-s3/terraform.tfstate" in terraform_tf

tests/test_checkov_adapter.py

@@ -0,0 +1,126 @@
+import json
+import sys
+from pathlib import Path
+
+import jsonschema
+import pytest
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+from adapters.terraform.policy.checkov_adapter import (
+    RULE_MAP, _to_pcr, _emit_tag_naming_skipped, adapt,
+)
+
+
+class TestRuleMap:
+    def test_secrets_rules(self):
+        assert RULE_MAP["CKV_AWS_41"][0] == "secrets-in-plaintext"
+        assert RULE_MAP["CKV_AWS_45"][0] == "secrets-in-plaintext"
+
+    def test_public_ingress_rules(self):
+        assert RULE_MAP["CKV_AWS_20"][0] == "public-ingress"
+        assert RULE_MAP["CKV_AWS_57"][0] == "public-ingress"
+
+    def test_iam_wildcard(self):
+        assert RULE_MAP["CKV_AWS_1"][0] == "iam-wildcard"
+
+    def test_kms(self):
+        assert RULE_MAP["CKV_AWS_7"][0] == "kms-key-reference"
+
+    def test_all_have_severities(self):
+        for rule_id, (cat, sev) in RULE_MAP.items():
+            assert sev in ("high", "medium", "low", "info"), f"{rule_id} has bad severity {sev}"
+
+
+class TestToPcr:
+    def test_passed_result(self):
+        rec = {"check_id": "CKV_AWS_20", "check_name": "No public ingress", "file_path": "main.tf"}
+        pcr = _to_pcr(rec, "contract-123", "PASSED")
+        assert pcr["result"] == "pass"
+        assert pcr["contractId"] == "contract-123"
+        assert pcr["engine"] == "checkov"
+        assert pcr["ruleId"] == "CKV_AWS_20"
+        assert pcr["severity"] == "high"
+
+    def test_failed_result(self):
+        rec = {"check_id": "CKV_AWS_1", "check_name": "No wildcard IAM"}
+        pcr = _to_pcr(rec, "c-1", "FAILED")
+        assert pcr["result"] == "fail"
+        assert pcr["severity"] == "high"
+
+    def test_skipped_result(self):
+        rec = {"check_id": "UNKNOWN_RULE", "check_name": "some check"}
+        pcr = _to_pcr(rec, "c-1", "SKIPPED")
+        assert pcr["result"] == "skipped"
+        assert pcr["severity"] == "info"
+
+    def test_unknown_rule_defaults_to_info(self):
+        rec = {"check_id": "UNKNOWN_RULE", "check_name": "unknown"}
+        pcr = _to_pcr(rec, "c-1", "FAILED")
+        assert pcr["severity"] == "info"
+
+    def test_pcr_validates_against_schema(self, policy_check_result_schema):
+        rec = {"check_id": "CKV_AWS_20", "check_name": "test", "file_path": "main.tf",
+               "resource": "aws_s3_bucket.s3", "resource_address": "aws_s3_bucket.s3"}
+        pcr = _to_pcr(rec, "c-1", "FAILED")
+        jsonschema.validate(pcr, policy_check_result_schema)
+
+
+class TestTagNamingSkipped:
+    def test_skipped_pcr(self):
+        pcr = _emit_tag_naming_skipped("c-1")
+        assert pcr["result"] == "skipped"
+        assert pcr["ruleId"] == "ACDL_TAG_NAMING"
+        assert pcr["severity"] == "info"
+
+
+class TestAdapt:
+    def _sample_checkov_json(self):
+        return {
+            "terraform_plan": {
+                "results": {
+                    "passed_checks": [
+                        {"check_id": "CKV_AWS_20", "check_name": "no public ingress",
+                         "file_path": "main.tf", "resource": "aws_vpc.vpc"}
+                    ],
+                    "failed_checks": [
+                        {"check_id": "CKV_AWS_1", "check_name": "no wildcard iam",
+                         "file_path": "main.tf", "resource": "aws_iam_role.r"}
+                    ],
+                    "skipped_checks": []
+                }
+            }
+        }
+
+    def test_adapt_returns_list(self, tmp_path):
+        data = self._sample_checkov_json()
+        f = tmp_path / "checkov.json"
+        f.write_text(json.dumps(data))
+        results = adapt(str(f), "c-1")
+        assert isinstance(results, list)
+
+    def test_adapt_includes_tag_naming(self, tmp_path):
+        data = self._sample_checkov_json()
+        f = tmp_path / "checkov.json"
+        f.write_text(json.dumps(data))
+        results = adapt(str(f), "c-1")
+        tag = [r for r in results if r["ruleId"] == "ACDL_TAG_NAMING"]
+        assert len(tag) == 1
+        assert tag[0]["result"] == "skipped"
+
+    def test_adapt_has_passed_and_failed(self, tmp_path):
+        data = self._sample_checkov_json()
+        f = tmp_path / "checkov.json"
+        f.write_text(json.dumps(data))
+        results = adapt(str(f), "c-1")
+        passed = [r for r in results if r["result"] == "pass"]
+        failed = [r for r in results if r["result"] == "fail"]
+        assert len(passed) >= 1
+        assert len(failed) >= 1
+
+    def test_adapt_empty_input(self, tmp_path):
+        data = {"terraform_plan": {"results": {"passed_checks": [], "failed_checks": [], "skipped_checks": []}}}
+        f = tmp_path / "checkov.json"
+        f.write_text(json.dumps(data))
+        results = adapt(str(f), "c-1")
+        assert len(results) == 1  # just the tag naming skipped

tests/test_confidence_signal.py

@@ -0,0 +1,181 @@
+import json
+import sys
+from pathlib import Path
+
+import pytest
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+from acdl_platform.confidence_signal import (
+    WEIGHTS, PENALTY, THRESHOLDS, compute, Signal, _per_input_score,
+)
+
+
+class TestWeights:
+    def test_weights_sum_to_one(self):
+        assert sum(WEIGHTS.values()) == pytest.approx(1.0)
+
+    def test_policy_weight_highest(self):
+        assert WEIGHTS["policy"] == 0.30
+
+    def test_validation_weight(self):
+        assert WEIGHTS["validation"] == 0.25
+
+
+class TestThresholds:
+    def test_dev_threshold(self):
+        assert THRESHOLDS["dev"] == 0.50
+
+    def test_qa_threshold(self):
+        assert THRESHOLDS["qa"] == 0.75
+
+    def test_prod_threshold(self):
+        assert THRESHOLDS["prod"] == 0.90
+
+    def test_dr_threshold(self):
+        assert THRESHOLDS["dr"] == 0.95
+
+
+class TestPenalty:
+    def test_critical_is_none(self):
+        assert PENALTY["critical"] is None
+
+    def test_high_penalty(self):
+        assert PENALTY["high"] == 0.20
+
+    def test_medium_penalty(self):
+        assert PENALTY["medium"] == 0.05
+
+    def test_low_penalty(self):
+        assert PENALTY["low"] == 0.01
+
+    def test_info_no_penalty(self):
+        assert PENALTY["info"] == 0.0
+
+
+class TestPerInputScore:
+    def test_missing_input_returns_half(self):
+        score, reasons = _per_input_score("policy", None)
+        assert score == 0.5
+        assert "INPUT_MISSING:policy" in reasons
+
+    def test_empty_policy_list(self):
+        score, reasons = _per_input_score("policy", [])
+        assert score == 0.5
+        assert reasons == []
+
+    def test_all_pass_policy(self):
+        pcrs = [{"result": "pass"}, {"result": "pass"}]
+        score, reasons = _per_input_score("policy", pcrs)
+        assert score == 1.0
+        assert reasons == []
+
+    def test_mixed_policy(self):
+        pcrs = [{"result": "pass"}, {"result": "fail"}]
+        score, reasons = _per_input_score("policy", pcrs)
+        assert score == 0.5
+
+    def test_skipped_counts_as_pass(self):
+        pcrs = [{"result": "skipped"}]
+        score, reasons = _per_input_score("policy", pcrs)
+        assert score == 1.0
+
+    def test_validation_all_true(self):
+        score, reasons = _per_input_score("validation", {
+            "schema": True, "ir_resolved": True,
+            "tf_validated": True, "tf_planned": True
+        })
+        assert score == 1.0
+
+    def test_validation_partial(self):
+        score, reasons = _per_input_score("validation", {
+            "schema": True, "ir_resolved": True,
+            "tf_validated": False, "tf_planned": False
+        })
+        assert score == 0.5
+
+    def test_freshness_fresh(self):
+        score, _ = _per_input_score("freshness", {"age_days": 0, "max_age_days": 7})
+        assert score == 1.0
+
+    def test_freshness_stale(self):
+        score, _ = _per_input_score("freshness", {"age_days": 7, "max_age_days": 7})
+        assert score == pytest.approx(0.0)
+
+    def test_source_complete(self):
+        score, _ = _per_input_score("source", {"submitter": "dev", "commit_sha": "abc"})
+        assert score == 1.0
+
+    def test_source_partial(self):
+        score, _ = _per_input_score("source", {"submitter": "dev"})
+        assert score == 0.5
+
+    def test_history_clean(self):
+        score, _ = _per_input_score("history", {"prior_rollbacks": 0, "prior_policy_fails": 0})
+        assert score == 1.0
+
+    def test_history_with_failures(self):
+        score, _ = _per_input_score("history", {"prior_rollbacks": 2, "prior_policy_fails": 3})
+        assert score == pytest.approx(0.3)
+
+    def test_nfrs_none(self):
+        score, _ = _per_input_score("nfrs", {"conformance": None})
+        assert score == 0.5
+
+    def test_nfrs_full(self):
+        score, _ = _per_input_score("nfrs", {"conformance": 0.95})
+        assert score == 0.95
+
+
+class TestCompute:
+    def _base_inputs(self):
+        return {
+            "policy": [{"result": "pass"}],
+            "validation": {"schema": True, "ir_resolved": True,
+                           "tf_validated": True, "tf_planned": True},
+            "freshness": {"age_days": 0, "max_age_days": 7},
+            "source": {"submitter": "dev", "commit_sha": "abc"},
+            "history": {"prior_rollbacks": 0, "prior_policy_fails": 0},
+            "nfrs": {"conformance": None},
+        }
+
+    def test_dev_pass(self):
+        sig = compute("test-001", "dev", self._base_inputs())
+        assert sig.band == "pass"
+        assert sig.score >= 0.50
+
+    def test_missing_input_blocks(self):
+        inputs = self._base_inputs()
+        del inputs["policy"]
+        sig = compute("test-002", "dev", inputs)
+        assert sig.band == "block"
+        assert sig.score == 0.0
+        assert any("INPUT_MISSING" in r for r in sig.reasonCodes)
+
+    def test_critical_policy_blocks(self):
+        inputs = self._base_inputs()
+        inputs["policy"] = [{"result": "fail", "severity": "critical", "ruleId": "CKV_X"}]
+        sig = compute("test-003", "dev", inputs)
+        assert sig.band == "block"
+        assert sig.score == 0.0
+        assert any("CRITICAL_OVERRIDE" in r for r in sig.reasonCodes)
+
+    def test_high_policy_lowers_score(self):
+        inputs = self._base_inputs()
+        inputs["policy"] = [{"result": "fail", "severity": "high", "ruleId": "CKV_Y"}]
+        sig = compute("test-004", "dev", inputs)
+        assert sig.score < 1.0
+
+    def test_dev_warn_becomes_block(self):
+        sig = compute("test-005", "dev", self._base_inputs())
+        assert sig.band != "warn"
+
+    def test_signal_has_per_input(self):
+        sig = compute("test-006", "dev", self._base_inputs())
+        assert "policy" in sig.perInput
+        assert "validation" in sig.perInput
+        assert "nfrs" in sig.perInput
+
+    def test_all_six_inputs_present(self):
+        sig = compute("test-007", "dev", self._base_inputs())
+        assert len(sig.perInput) == 6

tests/test_outbox_writer.py

@@ -0,0 +1,135 @@
+import datetime
+import hashlib
+import json
+import sys
+from pathlib import Path
+
+import pytest
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+from acdl_platform.outbox_writer import _canonical_hash, write_event
+
+
+class TestCanonicalHash:
+    def test_deterministic(self):
+        event = {"b": 2, "a": 1}
+        h1 = _canonical_hash(event)
+        h2 = _canonical_hash(event)
+        assert h1 == h2
+
+    def test_order_independent(self):
+        h1 = _canonical_hash({"a": 1, "b": 2})
+        h2 = _canonical_hash({"b": 2, "a": 1})
+        assert h1 == h2
+
+    def test_is_sha256_hex(self):
+        h = _canonical_hash({"key": "val"})
+        assert len(h) == 64
+        assert all(c in "0123456789abcdef" for c in h)
+
+    def test_different_events_different_hash(self):
+        h1 = _canonical_hash({"a": 1})
+        h2 = _canonical_hash({"a": 2})
+        assert h1 != h2
+
+
+class TestWriteEvent:
+    def _sample_event(self):
+        return {
+            "contractId": "test-contract-001",
+            "eventType": "CONFIDENCE_COMPUTED",
+            "ts": "2026-07-22T00:00:00Z",
+            "environment": "dev",
+            "stack": "l1-s3",
+            "score": 0.85,
+            "band": "pass",
+            "prev_event_hash": "GENESIS",
+        }
+
+    def test_write_event_with_mock_dynamodb(self):
+        from moto import mock_aws
+
+        import boto3
+
+        with mock_aws():
+            dyn = boto3.client("dynamodb", region_name="us-east-1")
+            dyn.create_table(
+                TableName="acdl-outbox",
+                KeySchema=[
+                    {"AttributeName": "contractId", "KeyType": "HASH"},
+                    {"AttributeName": "eventType#eventTs", "KeyType": "RANGE"},
+                ],
+                AttributeDefinitions=[
+                    {"AttributeName": "contractId", "AttributeType": "S"},
+                    {"AttributeName": "eventType#eventTs", "AttributeType": "S"},
+                ],
+                BillingMode="PAY_PER_REQUEST",
+            )
+
+            event = self._sample_event()
+            item = write_event(event, outbox_table="acdl-outbox", region="us-east-1")
+
+            assert item["contractId"]["S"] == "test-contract-001"
+            assert item["prev_event_hash"]["S"] == "GENESIS"
+            assert "hash" in item
+            assert len(item["hash"]["S"]) == 64
+            assert "expire_at" in item
+
+    def test_write_event_hash_matches_canonical(self):
+        from moto import mock_aws
+
+        import boto3
+
+        with mock_aws():
+            dyn = boto3.client("dynamodb", region_name="us-east-1")
+            dyn.create_table(
+                TableName="acdl-outbox",
+                KeySchema=[
+                    {"AttributeName": "contractId", "KeyType": "HASH"},
+                    {"AttributeName": "eventType#eventTs", "KeyType": "RANGE"},
+                ],
+                AttributeDefinitions=[
+                    {"AttributeName": "contractId", "AttributeType": "S"},
+                    {"AttributeName": "eventType#eventTs", "AttributeType": "S"},
+                ],
+                BillingMode="PAY_PER_REQUEST",
+            )
+
+            event = self._sample_event()
+            item = write_event(event, outbox_table="acdl-outbox", region="us-east-1")
+            expected_hash = _canonical_hash(event)
+            assert item["hash"]["S"] == expected_hash
+
+    def test_write_event_persists_to_dynamodb(self):
+        from moto import mock_aws
+
+        import boto3
+
+        with mock_aws():
+            dyn = boto3.client("dynamodb", region_name="us-east-1")
+            dyn.create_table(
+                TableName="acdl-outbox",
+                KeySchema=[
+                    {"AttributeName": "contractId", "KeyType": "HASH"},
+                    {"AttributeName": "eventType#eventTs", "KeyType": "RANGE"},
+                ],
+                AttributeDefinitions=[
+                    {"AttributeName": "contractId", "AttributeType": "S"},
+                    {"AttributeName": "eventType#eventTs", "AttributeType": "S"},
+                ],
+                BillingMode="PAY_PER_REQUEST",
+            )
+
+            event = self._sample_event()
+            write_event(event, outbox_table="acdl-outbox", region="us-east-1")
+
+            resp = dyn.get_item(
+                TableName="acdl-outbox",
+                Key={
+                    "contractId": {"S": "test-contract-001"},
+                    "eventType#eventTs": {"S": "CONFIDENCE_COMPUTED#2026-07-22T00:00:00Z"},
+                },
+            )
+            assert "Item" in resp
+            assert resp["Item"]["band"]["S"] == "pass"

tests/test_pipeline.py

@@ -0,0 +1,67 @@
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parent.parent
+
+
+class TestPipelineIntegration:
+    def test_load_ir_and_adapt_offline(self, tmp_path):
+        ir = json.load(open(ROOT / "modules-ir/l1/l1-s3/spike_instance.json"))
+        assert ir["stack"]["name"] == "l1-s3"
+
+        sys.path.insert(0, str(ROOT))
+        from adapters.terraform.adapter import adapt
+        out_dir = str(tmp_path / "tf")
+        adapt(ir, out_dir)
+
+        assert os.path.isfile(os.path.join(out_dir, "main.tf"))
+        assert os.path.isfile(os.path.join(out_dir, "terraform.tf"))
+        assert os.path.isfile(os.path.join(out_dir, "providers.tf"))
+
+        main_tf = open(os.path.join(out_dir, "main.tf")).read()
+        assert "aws_s3_bucket" in main_tf
+        assert "acdl-spike-bucket" in main_tf
+
+    def test_confidence_signal_with_adapted_tf(self):
+        sys.path.insert(0, str(ROOT))
+        from acdl_platform.confidence_signal import compute
+
+        inputs = {
+            "policy": [{"result": "pass"}],
+            "validation": {"schema": True, "ir_resolved": True,
+                           "tf_validated": True, "tf_planned": True},
+            "freshness": {"age_days": 0, "max_age_days": 7},
+            "source": {"submitter": "test", "commit_sha": "test-sha"},
+            "history": {"prior_rollbacks": 0, "prior_policy_fails": 0},
+            "nfrs": {"conformance": None},
+        }
+        sig = compute("integration-test", "dev", inputs)
+        assert sig.band == "pass"
+        assert sig.score >= 0.50
+
+    def test_run_platform_check_only(self):
+        result = subprocess.run(
+            ["bash", str(ROOT / "scripts/run_platform.sh"), "--check-only"],
+            capture_output=True, text=True, cwd=str(ROOT),
+            timeout=30,
+        )
+        assert result.returncode == 0, f"stdout: {result.stdout}\nstderr: {result.stderr}"
+        assert "PLATFORM CHECK OK" in result.stdout
+
+    def test_run_platform_check_only_no_aws_creds(self):
+        env = os.environ.copy()
+        env.pop("AWS_ACCESS_KEY_ID", None)
+        env.pop("AWS_SECRET_ACCESS_KEY", None)
+        env.pop("AWS_DEFAULT_REGION", None)
+        result = subprocess.run(
+            ["bash", str(ROOT / "scripts/run_platform.sh"), "--check-only"],
+            capture_output=True, text=True, cwd=str(ROOT), env=env,
+            timeout=30,
+        )
+        assert result.returncode == 0
+        assert "PLATFORM CHECK OK" in result.stdout

tests/test_pipeline_contract.py

@@ -0,0 +1,236 @@
+import json
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+import jsonschema
+import pytest
+import yaml
+
+ROOT = Path(__file__).resolve().parent.parent
+
+
+def _load_yaml(path):
+    with open(ROOT / path) as f:
+        return yaml.safe_load(f)
+
+
+def _load_workflow(path):
+    wf = _load_yaml(path)
+    if True in wf:
+        wf["on"] = wf[True]
+    return wf
+
+
+class TestPipelineSchema:
+    def test_schema_is_valid_json_schema(self):
+        schema = json.load(open(ROOT / "schemas/pipeline.schema.json"))
+        jsonschema.Draft202012Validator.check_schema(schema)
+
+    def test_schema_has_required_fields(self):
+        schema = json.load(open(ROOT / "schemas/pipeline.schema.json"))
+        assert "name" in schema["required"]
+        assert "triggers" in schema["required"]
+        assert "runner" in schema["required"]
+        assert "stages" in schema["required"]
+
+    def test_schema_stage_def_has_command_and_required(self):
+        schema = json.load(open(ROOT / "schemas/pipeline.schema.json"))
+        stage_def = schema["$defs"]["stage"]
+        assert "command" in stage_def["required"]
+        assert "required" in stage_def["required"]
+
+
+class TestPipelineContract:
+    def test_contract_validates_against_schema(self):
+        schema = json.load(open(ROOT / "schemas/pipeline.schema.json"))
+        contract = _load_yaml("pipelines/ci.yaml")
+        jsonschema.validate(contract, schema)
+
+    def test_contract_has_three_stages(self):
+        contract = _load_yaml("pipelines/ci.yaml")
+        stage_names = [s["name"] for s in contract["stages"]]
+        assert stage_names == ["lint", "test", "check-only"]
+
+    def test_contract_runner_is_ubuntu_latest(self):
+        contract = _load_yaml("pipelines/ci.yaml")
+        assert contract["runner"] == "ubuntu-latest"
+
+    def test_contract_python_version(self):
+        contract = _load_yaml("pipelines/ci.yaml")
+        assert contract["python_version"] == "3.12"
+
+    def test_contract_triggers_push_main(self):
+        contract = _load_yaml("pipelines/ci.yaml")
+        assert "main" in contract["triggers"]["push"]
+
+    def test_contract_triggers_pr_main(self):
+        contract = _load_yaml("pipelines/ci.yaml")
+        assert "main" in contract["triggers"]["pull_request"]
+
+    def test_contract_all_stages_required(self):
+        contract = _load_yaml("pipelines/ci.yaml")
+        for stage in contract["stages"]:
+            assert stage["required"] is True
+
+    def test_contract_lint_command_compiles_python(self):
+        contract = _load_yaml("pipelines/ci.yaml")
+        lint = next(s for s in contract["stages"] if s["name"] == "lint")
+        assert "py_compile" in lint["command"]
+        assert "acdl_platform/confidence_signal.py" in lint["command"]
+        assert "adapters/terraform/adapter.py" in lint["command"]
+
+    def test_contract_test_command_runs_pytest(self):
+        contract = _load_yaml("pipelines/ci.yaml")
+        test_stage = next(s for s in contract["stages"] if s["name"] == "test")
+        assert "pytest" in test_stage["command"]
+
+    def test_contract_check_only_runs_platform(self):
+        contract = _load_yaml("pipelines/ci.yaml")
+        check = next(s for s in contract["stages"] if s["name"] == "check-only")
+        assert "run_platform.sh" in check["command"]
+        assert "--check-only" in check["command"]
+
+
+class TestWorkflowConformance:
+    def test_gitea_workflow_exists(self):
+        assert (ROOT / ".gitea/workflows/ci.yml").is_file()
+
+    def test_github_workflow_exists(self):
+        assert (ROOT / ".github/workflows/ci.yml").is_file()
+
+    def test_workflows_are_byte_identical(self):
+        gitea = open(ROOT / ".gitea/workflows/ci.yml", "rb").read()
+        github = open(ROOT / ".github/workflows/ci.yml", "rb").read()
+        assert gitea == github, "Gitea and GitHub workflows must be byte-identical"
+
+    def test_gitea_workflow_name_matches_contract(self):
+        wf = _load_workflow(".gitea/workflows/ci.yml")
+        contract = _load_yaml("pipelines/ci.yaml")
+        assert wf["name"] == contract["name"]
+
+    def test_gitea_workflow_has_three_jobs(self):
+        wf = _load_workflow(".gitea/workflows/ci.yml")
+        assert set(wf["jobs"].keys()) == {"lint", "test", "check-only"}
+
+    def test_gitea_workflow_triggers_match_contract(self):
+        wf = _load_workflow(".gitea/workflows/ci.yml")
+        contract = _load_yaml("pipelines/ci.yaml")
+        assert wf["on"]["push"]["branches"] == contract["triggers"]["push"]
+        assert wf["on"]["pull_request"]["branches"] == contract["triggers"]["pull_request"]
+
+    def test_gitea_workflow_runner_matches_contract(self):
+        wf = _load_workflow(".gitea/workflows/ci.yml")
+        contract = _load_yaml("pipelines/ci.yaml")
+        for job in wf["jobs"].values():
+            assert job["runs-on"] == contract["runner"]
+
+    def test_gitea_workflow_python_version_matches_contract(self):
+        wf = _load_workflow(".gitea/workflows/ci.yml")
+        contract = _load_yaml("pipelines/ci.yaml")
+        for job in wf["jobs"].values():
+            setup_step = next(
+                s for s in job["steps"] if "setup-python" in s.get("uses", "")
+            )
+            assert setup_step["with"]["python-version"] == contract["python_version"]
+
+    def test_gitea_lint_command_matches_contract(self):
+        wf = _load_workflow(".gitea/workflows/ci.yml")
+        lint_job = wf["jobs"]["lint"]
+        run_step = next(s for s in lint_job["steps"] if "run" in s)
+        assert "py_compile" in run_step["run"]
+        for py_file in [
+            "acdl_platform/confidence_signal.py",
+            "acdl_platform/outbox_writer.py",
+            "adapters/terraform/adapter.py",
+            "adapters/terraform/policy/checkov_adapter.py",
+            "scripts/push_consumer_image.py",
+        ]:
+            assert py_file in run_step["run"], f"{py_file} missing from lint command"
+
+    def test_gitea_test_command_matches_contract(self):
+        wf = _load_workflow(".gitea/workflows/ci.yml")
+        test_job = wf["jobs"]["test"]
+        run_step = next(s for s in test_job["steps"] if "run" in s and "pytest" in s["run"])
+        assert "pytest" in run_step["run"]
+
+    def test_gitea_check_only_command_matches_contract(self):
+        wf = _load_workflow(".gitea/workflows/ci.yml")
+        check_job = wf["jobs"]["check-only"]
+        run_step = next(
+            s for s in check_job["steps"] if "run" in s and "run_platform" in s["run"]
+        )
+        assert "run_platform.sh" in run_step["run"]
+        assert "--check-only" in run_step["run"]
+
+
+class TestRunCiScript:
+    def test_run_ci_script_exists_and_executable(self):
+        path = ROOT / "scripts/run_ci.sh"
+        assert path.is_file()
+        assert os.access(path, os.X_OK)
+
+    def test_run_ci_script_contains_lint_stage(self):
+        content = open(ROOT / "scripts/run_ci.sh").read()
+        assert "py_compile" in content
+        assert "acdl_platform/confidence_signal.py" in content
+        assert "adapters/terraform/adapter.py" in content
+
+    def test_run_ci_script_contains_test_stage(self):
+        content = open(ROOT / "scripts/run_ci.sh").read()
+        assert "pytest" in content
+        assert "tests/" in content
+
+    def test_run_ci_script_contains_check_only_stage(self):
+        content = open(ROOT / "scripts/run_ci.sh").read()
+        assert "run_platform.sh" in content
+        assert "--check-only" in content
+
+    def test_run_ci_script_has_success_message(self):
+        content = open(ROOT / "scripts/run_ci.sh").read()
+        assert "CI PIPELINE OK" in content
+
+    def test_run_ci_lint_and_check_only_pass(self):
+        result = subprocess.run(
+            ["bash", "-c",
+             f"cd {ROOT} && "
+             "python3 -m py_compile "
+             "acdl_platform/confidence_signal.py "
+             "acdl_platform/outbox_writer.py "
+             "adapters/terraform/adapter.py "
+             "adapters/terraform/policy/checkov_adapter.py "
+             "scripts/push_consumer_image.py && "
+             "echo 'lint: OK' && "
+             "bash scripts/run_platform.sh --check-only && "
+             "echo 'check-only: OK'"],
+            capture_output=True, text=True, cwd=str(ROOT),
+            timeout=30,
+        )
+        assert result.returncode == 0, f"stdout: {result.stdout}\nstderr: {result.stderr}"
+        assert "lint: OK" in result.stdout
+        assert "check-only: OK" in result.stdout
+        assert "PLATFORM CHECK OK" in result.stdout
+
+
+class TestRunPlatformStreaming:
+    def test_check_only_streams_emitted_terraform(self):
+        result = subprocess.run(
+            ["bash", str(ROOT / "scripts/run_platform.sh"), "--check-only"],
+            capture_output=True, text=True, cwd=str(ROOT),
+            timeout=30,
+        )
+        assert result.returncode == 0
+        assert "PLATFORM CHECK OK" in result.stdout
+        assert "--- emitted terraform/spike/main.tf ---" in result.stdout
+        assert "aws_s3_bucket" in result.stdout
+
+    def test_check_only_quiet_suppresses_terraform(self):
+        result = subprocess.run(
+            ["bash", str(ROOT / "scripts/run_platform.sh"), "--check-only", "--quiet"],
+            capture_output=True, text=True, cwd=str(ROOT),
+            timeout=30,
+        )
+        assert result.returncode == 0
+        assert "PLATFORM CHECK OK" in result.stdout
+        assert "--- emitted terraform/spike/main.tf ---" not in result.stdout