docs(P17): complete config-and-persona-hygiene phase (v1.13.20)

---ci---
project: acdl
phase: 17
milestone: v1.14
status: complete
requirements:
  covered: [REQ-151]
  partial: []
---/ci---

.ciagent/ARCHITECTURE.md

@@ -570,93 +570,4 @@ emulator + live-AWS terraform init/validate/plan.
 7. CloudFront OAC + WAF deprecated arg names (AWS provider v5):
    `signing_behavior`, `signing_protocol`, `origin_access_control_id`,
    `s3_origin_config.origin_access_identity`, `origin_id`, `rule`
-   (singular), `scope=CLOUDFRONT` (uppercase).
-
-## v1.11 Addendum — Stateless Adapter + Pipeline-Driven Lifecycle Testing
-
-**Stateless adapter (D-098).** `adapters/terraform/adapter.py` rewritten
-from a 918-line monolith (3 constant tables `TYPE_MAP`/`INPUT_MAP`/
-`OUTPUT_MAP`, 39 type-specific branches) to a ~80-line stateless assembler.
-Each L1 module ships a real `terraform/` module dir
-(`versions.tf`/`variables.tf`/`locals.tf`/`main.tf`/`outputs.tf`) owning
-its resource shape, nested blocks, and defaults. The adapter reads the
-registry, emits a root `main.tf` instantiating each L1 as
-`module "x" { source = "..." }` with resolved inputs and wired refs.
-
-**Terraform owns lifecycle (D-101).** `scripts/run_platform.sh` gains
-`--apply` and `--destroy` modes. Python never runs terraform.
-`scripts/verify_deploy_microservice.py` is deleted.
-
-**Pipeline-driven testing (D-102).** A `modules-lifecycle` pipeline
-(Gitea + GitHub, byte-identical) matrix-runs each L1 module's
-`examples/{simple,complex}.yml` contracts through apply→modify→destroy
-against live AWS. No per-module Python/pytest. The "test" = the pipeline
-cell going green.
-
-**Single platform VPC (D-105).** `terraform/platform/main.tf` owns ONE
-VPC; the microservice composition references it via
-`terraform_remote_state` (data source). State keys are deterministic and
-env-aware (`spike/{contract.id}/{contract.environment}/terraform.tfstate`).
-
-**ACDL_LIFECYCLE_MODE (v1.12, REQ-134).** The lifecycle pipeline defaults
-to plan-only (fast, no AWS mutation, no cost). A CI variable
-`ACDL_LIFECYCLE_MODE` (default `plan`) overrides to `full` for the real
-apply→modify→destroy.
-
-## v1.12 Addendum — Presentation Refinement + CAP-013 Fix
-
-**CAP-013 adapter dedup fix (REQ-129).** Multi-resource L1s (ecs-service,
-alb) with stack outputs + cross-module refs now dedup to ONE module block
-named by the composition child id, with expanded sub-ids rewritten via
-`id_remap`. `terraform validate` succeeds for the microservice stack.
-
-**CAP-017/018 probe fixes (REQ-130).** CAP-017's probe no longer requires
-`locals.tf` for modules that legitimately omit it. CAP-018's probe
-instantiates `LocalLambdaStub` with the required `outbox` arg.
-
-## v1.13 Addendum — Presentation Polish + Config Schema Migration
-
-**Config.json schema migration (v1.13.1).** Regenerated
-`.ciagent/config.json` to the updated CIAgent v2 config structure (drop
-removed fields, migrate `gitea`→`release.gitea`, add
-`secrets`/`ship`/`backend`/`ideation`/`personas`/`logging`/`telemetry`
-sections).
-
-**Presentation polish (v1.13.0, v1.13.2).** Action headlines, story-arc
-restructure, larger fonts, 6 new mermaid diagrams, badge cleanup,
-platform-architecture diagram. Docs-only NFR patches.
-
-## v1.14 Addendum — NFR Refinement (bug fixes, security, stubs, tests, docs)
-
-**Bug fixes (Wave 1, P1-P6).** Adapter dedup rejects unregistered modules
-with ValueError (P1). Static-assets composition wires cloudfront inputs
-(P2). L2 lifecycle scripts document remote-state design (P3). Regression
-gate adds `terraform fmt -check` syntax probe (P4). Adapter dedup-merge +
-remote-state-key unit tests (P5). ALB target group name_prefix derives
-from var.name (P6).
-
-**Security (Wave 2, P7-P12).** 6 swallowed-error sites narrowed to
-specific exceptions (P7). Account ID externalized to
-`ACDL_AWS_ACCOUNT_ID` env (P8). IAM policy scoped to `acdl-*` ARNs (P9).
-Contract ingestor validates contractId/environment/error (P10). Environment
-schema adds `additionalProperties: false` + format validation (P11).
-`.gitignore` credential-pattern catch-all (P12).
-
-**Stub/test/CI/hygiene (Wave 3, P13-P17).** Kyverno `--kube-version` flag
-removed (P13, G-103). Orphan artifacts + dead config cleaned (P14). 7
-untested scripts gain test coverage (P15). Gitea workflow parity
-documented + script `set` flags fixed (P16). Config.json persona +
-branching strategy + ollama-cloud aligned (P17).
-
-**Standards/docs/VPC (Wave 4, P18-P20).** STANDARDS.md reconciled (P18).
-Documentation synced: ARCHITECTURE.md addenda, stale `@v1.6-1.9` → `@v1.13`,
-GRILL G-005/G-008 resolved, COST.md window extended, D-083 deferral
-recorded (P19). Platform VPC CIDR parameterized + data-driven subnet
-count (P20).
-
-**D-083 deferral (explicit).** The audit ledger build-out (S3 Object Lock
-+ JWS detached signatures + SQS DLQ + async worker + daily checkpoints)
-remains deferred (D-096, v1.14). The hash-chain + DynamoDB outbox is the
-v1.14 audit record. JWS per-event authenticity is not implemented; a
-forged event is only detectable by re-reading the whole chain. The
-deferral is documented here explicitly per the v1.14 grill (E-001).
+   (singular), `scope=CLOUDFRONT` (uppercase).

.ciagent/COST.md

@@ -1,8 +1,8 @@
-# ACDL AWS Cost Report (v1.0 → v1.14)
+# ACDL AWS Cost Report (v1.0 → v1.10)
 
-> **Query date:** 2026-07-29 (updated v1.14 P19)
+> **Query date:** 2026-07-28
 > **Source:** AWS Cost Explorer (`ce:GetCostAndUsage`)
-> **Window:** 2026-07-21 → 2026-07-29 (v1.0 ship → v1.14 active)
+> **Window:** 2026-07-21 → 2026-07-28 (v1.0 ship → v1.10 complete)
 > **Account:** 581513795199 (us-east-1)
 > **Closes:** G-008 (no cost documentation despite live AWS resources)
 

.ciagent/GRILL.md

@@ -6,13 +6,7 @@
 
 Two escalations must be resolved before the leadership pitch:
 - **G-005 (risks):** 6 cloud capabilities (CAP-017..022) are deploy-unverified.
-  **RESOLVED (v1.11):** CAP-017..022 are now Verified live-aws via the
-  modules-lifecycle pipeline (apply/modify/destroy exit 0). The IAM-drift
-  framing is removed. See CAPABILITY_INVENTORY.md.
 - **G-008 (budget):** No cost documentation exists despite live AWS resources.
-  **RESOLVED (v1.11):** COST.md now exists, documenting the v1.0→v1.10 spend
-  window + the v1.11 cost projection. The v1.14 P19 phase extends the
-  window to v1.11–v1.14.
 
 The project is reclassified as an **OSS reference implementation** (G-003),
 not a sponsored product. The grill's sponsor/ROI/budget/timeline axes apply

.ciagent/REQUIREMENTS.md

@@ -684,26 +684,26 @@ in a 20-phase sweep.
 
 | Requirement | Phase | Status |
 |-------------|-------|--------|
-| REQ-135 | P1 | complete |
-| REQ-136 | P2 | complete |
-| REQ-137 | P3 | complete |
-| REQ-138 | P4 | complete |
-| REQ-139 | P5 | complete |
-| REQ-140 | P6 | complete |
-| REQ-141 | P7 | complete |
-| REQ-142 | P8 | complete |
-| REQ-143 | P9 | complete |
-| REQ-144 | P10 | complete |
-| REQ-145 | P11 | complete |
-| REQ-146 | P12 | complete |
-| REQ-147 | P13 | complete |
-| REQ-148 | P14 | complete |
-| REQ-149 | P15 | complete |
-| REQ-150 | P16 | complete |
-| REQ-151 | P17 | complete |
-| REQ-152 | P18 | complete |
-| REQ-153 | P19 | complete |
-| REQ-154 | P20 | complete |
+| REQ-135 | P1 | pending |
+| REQ-136 | P2 | pending |
+| REQ-137 | P3 | pending |
+| REQ-138 | P4 | pending |
+| REQ-139 | P5 | pending |
+| REQ-140 | P6 | pending |
+| REQ-141 | P7 | pending |
+| REQ-142 | P8 | pending |
+| REQ-143 | P9 | pending |
+| REQ-144 | P10 | pending |
+| REQ-145 | P11 | pending |
+| REQ-146 | P12 | pending |
+| REQ-147 | P13 | pending |
+| REQ-148 | P14 | pending |
+| REQ-149 | P15 | pending |
+| REQ-150 | P16 | pending |
+| REQ-151 | P17 | pending |
+| REQ-152 | P18 | pending |
+| REQ-153 | P19 | pending |
+| REQ-154 | P20 | pending |
 
 ### Out of Scope (v1.14)
 - New features (feat phases). v1.14 is NFR-only.

.ciagent/ROADMAP.md

@@ -1063,7 +1063,7 @@ Docs-only NFR patch (no code changes).
 
 ---
 
-## v1.14 (complete — NFR Refinement: bug fixes, security, stubs, tests, docs, tag `v1.13.24`)
+## v1.14 (active — NFR Refinement: bug fixes, security, stubs, tests, docs)
 
 The v1.14 milestone is a 20-phase NFR sweep — no new features. It clears
 the open P1/P2 backlog from the v1.11 review, hardens the security

README.md

@@ -222,7 +222,7 @@ The workflow implements the same stages as `pipelines/contract.yml`
 (validate-contract → resolve-stack → security checks → infrastructure plan
 → policy checks → confidence → evidence event → apply). A consumer repo
 invokes the reusable workflow via a **versioned tag** (floating MAJOR +
-MINOR, e.g. `acdl/.github/workflows/deploy.yml@v1.13`). The workflow checks
+MINOR, e.g. `acdl/.github/workflows/deploy.yml@v1.6`). The workflow checks
 out the consumer repo, then checks out the ACDL platform repo into the
 runner workspace, and runs `scripts/run_platform.sh` against the consumer's
 contract — the consumer never clones the platform repo or invokes its

docs/architecture.md

@@ -230,7 +230,7 @@ change to the modules/stack/confidence/audit.
 - A MAJOR bump requires a new registry entry (immutable publication); the
   old entry enters a 12-month deprecation window.
 - The central deploy pipeline is referenced by a floating MAJOR + MINOR tag
-  (e.g. `@v1.13`); patch fixes flow within the tag, breaking changes land
+  (e.g. `@v1.6`); patch fixes flow within the tag, breaking changes land
   under the next MINOR tag.
 
 See [Versioning](pipeline/versioning) for the consumer-facing details.

docs/consumer-guide.md

@@ -19,7 +19,7 @@ definitions.
 
 ```mermaid
 flowchart LR
-    A["your repo<br/>(app code + contracts + CI definitions)"] -->|uses: acdl/.github/workflows/deploy.yml@v1.13| B
+    A["your repo<br/>(app code + contracts + CI definitions)"] -->|uses: acdl/.github/workflows/deploy.yml@v1.9| B
     B["platform runners<br/>(modules + pipelines + adapters + schemas)"] -->|contract -&gt; resolver -&gt; stack -&gt; adapter<br/>-&gt; security checks -&gt; infrastructure plan -&gt; policy checks<br/>-&gt; confidence -&gt; apply -&gt; evidence event| C
     C["your resources in AWS"]
 ```
@@ -27,7 +27,7 @@ flowchart LR
 ## Versioning the `uses:` reference
 
 The central deployment pipeline is **always versioned with floating MAJOR
-and MINOR tags** (e.g. `acdl/pipelines/contract.yml@v1.13`). Version
+and MINOR tags** (e.g. `acdl/pipelines/contract.yml@v1.9`). Version
 constraints cannot be expressed inside the contract, so the tag in
 `uses:` is the only immutability lever a consumer has. See
 [Versioning](pipeline/versioning) for the full rationale.
@@ -47,7 +47,7 @@ platform-managed. See [Environments](environments/).
   environment is bound, your first pipeline run emits a friendly onboarding
   prompt. See [Environments](environments/).
 - **Authorization to reference the central pipeline.** Onboarding grants
-  your repo the right to `uses: acdl/.github/workflows/deploy.yml@v1.13`.
+  your repo the right to `uses: acdl/.github/workflows/deploy.yml@v1.9`.
   Contact the platform team if you have not been onboarded.
 
 ## Step 1 — Create a consumer repo
@@ -94,7 +94,7 @@ ACDL deployment workflow with a **versioned tag** (floating MAJOR + MINOR):
 ```yaml
 jobs:
   deploy:
-    uses: acdl/.github/workflows/deploy.yml@v1.13
+    uses: acdl/.github/workflows/deploy.yml@v1.9
     with:
       contract: .acdl/contract.yml
       environment: dev
@@ -140,7 +140,7 @@ name: microservice
 
 | Field | Type | Required | Description |
 |-------|------|----------|-------------|
-| `uses` | string | yes | Reference to the central deployment pipeline, **versioned** with a floating MAJOR+MINOR tag (e.g. `acdl/pipelines/contract.yml@v1.13`). Bare or `@main` references are discouraged. See [Versioning](pipeline/versioning). |
+| `uses` | string | yes | Reference to the central deployment pipeline, **versioned** with a floating MAJOR+MINOR tag (e.g. `acdl/pipelines/contract.yml@v1.9`). Bare or `@main` references are discouraged. See [Versioning](pipeline/versioning). |
 | `module` | string | yes | Module name from the registry — any primitive or module (e.g. `static-assets`, `microservice`, `s3`). See the [module catalog](modules/). |
 | `environment` | string | yes | The platform-managed environment to deploy to (e.g. `dev`). See [Environments](environments/). |
 | `inputs` | object | yes | Module-specific inputs (see the module's README). |
@@ -177,14 +177,14 @@ on:
     branches: [main]
 jobs:
   deploy:
-    uses: acdl/.github/workflows/deploy.yml@v1.13
+    uses: acdl/.github/workflows/deploy.yml@v1.9
     with:
       contract: .acdl/contract.yml
 ```
 
 That is the entire consumer-side workflow. When you push to `main`:
 
-1. The platform runner resolves `uses: acdl/.github/workflows/deploy.yml@v1.13`
+1. The platform runner resolves `uses: acdl/.github/workflows/deploy.yml@v1.9`
    to the reusable workflow **at the pinned tag**.
 2. A **platform-provided runner** checks out **your** repo.
 3. The runner checks out the **ACDL platform repo** into the workspace —
@@ -326,8 +326,8 @@ per-module extension points. Common examples:
 | Contract schema | `schemas/contract.schema.json` | JSON Schema for consumer contracts. |
 | Stack schema | `schemas/stack.schema.json` | JSON Schema for the resolved stack instance. |
 | Module catalog | [modules/](modules/) | All primitives and modules. |
-| Sample contract | `contracts/static-assets.yaml` | The reference example contract (uses `@v1.13`). |
-| Sample contract | `contracts/microservice.yaml` | The microservice example contract (uses `@v1.13`). |
+| Sample contract | `contracts/static-assets.yaml` | The reference example contract (uses `@v1.9`). |
+| Sample contract | `contracts/microservice.yaml` | The microservice example contract (uses `@v1.9`). |
 | Module examples | `modules/<name>/examples/` | Validated per-module example contracts (`simple.yaml` + `complex.yaml`). |
 | Contract resolver | `core/contract_resolver.py` | Resolves contracts to stack instances. |
 | Angine adapter | `adapters/terraform/adapter.py` | Compiles stack instances to infrastructure. |
@@ -353,7 +353,7 @@ destruction:
    use `mode: decommission` with the `changeRequestId` input:
 
    ```yaml
-   uses: acdl/.github/workflows/deploy.yml@v1.13
+   uses: acdl/.github/workflows/deploy.yml@v1.8
    with:
      contract: .acdl/contract.yml
      mode: decommission
@@ -421,7 +421,7 @@ name: static-assets
 ```
 
 **Shape 2 — single contract + `environment` workflow input:** the
-reusable deploy workflow (`acdl/.github/workflows/deploy.yml@v1.13`)
+reusable deploy workflow (`acdl/.github/workflows/deploy.yml@v1.9`)
 declares an `environment` input. When non-empty, it overrides the
 contract's `environment` field at load time (before interpolation), so
 the same contract can be promoted by passing a different environment:
@@ -436,7 +436,7 @@ on: workflow_dispatch:
       required: true
 jobs:
   deploy-qa:
-    uses: acdl/.github/workflows/deploy.yml@v1.13
+    uses: acdl/.github/workflows/deploy.yml@v1.9
     with:
       environment: qa
       contract: .acdl/contract.yml

docs/pipeline/index.md

@@ -39,7 +39,7 @@ It is exposed to consumer repos as a **reusable workflow**:
 - `.github/workflows/deploy.yml` — GitHub Actions (production)
 
 A consumer repo invokes the reusable workflow via a **versioned tag**
-(floating MAJOR + MINOR, e.g. `acdl/.github/workflows/deploy.yml@v1.13`).
+(floating MAJOR + MINOR, e.g. `acdl/.github/workflows/deploy.yml@v1.6`).
 The workflow checks out the consumer repo, then checks out the ACDL platform
 repo into the runner workspace, and runs `scripts/run_platform.sh` against
 the consumer's contract. The consumer never clones the platform repo or

docs/pipeline/versioning.md

@@ -26,7 +26,7 @@ tag** in a consumer's CI workflow definition:
 ```yaml
 jobs:
   deploy:
-    uses: acdl/.github/workflows/deploy.yml@v1.13
+    uses: acdl/.github/workflows/deploy.yml@v1.6
     with:
       contract: .acdl/contract.yml
 ```

modules/STANDARDS.md

@@ -207,12 +207,9 @@ declares intra-refs from the subnet and route table to the VPC's
   - `aws:wafv2:webacl`
   - `aws:rds:instance`
   - `aws:kms:key`, `aws:kms:alias`
-- The engine adapter is a **stateless assembler** (v1.11, D-098): it reads
-  the registry, emits a root `main.tf` instantiating each L1 as
-  `module "x" { source = "..." }` with resolved inputs and wired refs. There
-  is no `TYPE_MAP` (deleted in the v1.11 stateless rewrite). A new stack
-  type requires a `terraform/` dir in the L1 module + a registry entry with
-  a `terraform_dir` field.
+- The engine adapter's `TYPE_MAP` is the registry of stack types the
+  adapter can compile (see §8). A new stack type requires a `TYPE_MAP`
+  entry before the primitive can be deployed.
 
 ## 3. L2 Module Standards
 
@@ -583,10 +580,8 @@ must be checked before the module is registered and published.
 ### 9.4 Adapter (stateless assembler)
 
 - [ ] The new primitive's `terraform/` subdir exists with
-  `versions.tf`/`variables.tf`/`main.tf`/`outputs.tf` and
-  passes `terraform init + validate` standalone. `locals.tf` is required
-  for multi-resource modules; trivial single-resource modules (e.g.
-  `kms-key`, `ecr`, `ecs-cluster`) may inline locals in `main.tf`.
+  `versions.tf`/`variables.tf`/`locals.tf`/`main.tf`/`outputs.tf` and
+  passes `terraform init + validate` standalone.
 - [ ] `registry.json` has a `terraform_dir` field for the new primitive.
 - [ ] No adapter code changes are needed (the adapter is generic; it
   assembles any module with a `terraform_dir` in the registry).

terraform/platform/main.tf

@@ -29,13 +29,6 @@ provider "aws" {
   region = "us-east-1"
 }
 
-# v1.14 (REQ-154): VPC CIDR is parameterized (default 10.0.0.0/16).
-variable "vpc_cidr" {
-  description = "CIDR block for the shared platform VPC (default 10.0.0.0/16)."
-  type        = string
-  default     = "10.0.0.0/16"
-}
-
 # KMS customer-managed key for DynamoDB SSE + SSM Parameter Store encryption
 resource "aws_kms_key" "acdl_platform" {
   description             = "ACDL platform KMS key (DynamoDB SSE + SSM + Secrets Manager)"
@@ -259,7 +252,7 @@ output "acdl_sod_halt_topic_arn" {
 # ---------------------------------------------------------------------------
 
 resource "aws_vpc" "acdl_shared" {
-  cidr_block = var.vpc_cidr
+  cidr_block = "10.0.0.0/16"
   tags = {
     Name               = "acdl-shared"
     "acdl:owner"       = "acdl"
@@ -270,7 +263,7 @@ resource "aws_vpc" "acdl_shared" {
 }
 
 resource "aws_subnet" "acdl_shared" {
-  count             = length(data.aws_availability_zones.available.names)
+  count             = 2
   vpc_id            = aws_vpc.acdl_shared.id
   cidr_block        = cidrsubnet(aws_vpc.acdl_shared.cidr_block, 8, count.index + 1)
   availability_zone = data.aws_availability_zones.available.names[count.index]
@@ -324,10 +317,6 @@ resource "aws_security_group" "ecs" {
   description = "Security group for ECS Fargate services (platform VPC)"
   vpc_id      = aws_vpc.acdl_shared.id
 
-  # Ingress on port 80 is open to 0.0.0.0/0 — this is acceptable because
-  # the ECS service is fronted by a public-facing ALB (the ALB terminates
-  # TLS + routes to the target group). The ECS SG should not be attached
-  # directly to resources without an ALB in front. v1.14 (REQ-154).
   ingress {
     from_port   = 80
     to_port     = 80