docs(P02): complete static-assets-wiring-fix phase (v1.13.5)

---ci---
project: acdl
phase: 2
milestone: v1.14
status: complete
requirements:
  covered: [REQ-136]
  partial: []
---/ci---

.ciagent/CHECKPOINT.json

@@ -1,8 +1,8 @@
 {
   "phase": 0,
-  "stage": "grill",
+  "stage": "complete",
   "milestone": "v1.14",
   "phase_role": "pre_execution",
   "attempts": 0,
-  "updated_at": "2026-07-29T20:25:00Z"
+  "updated_at": "2026-07-29T20:30:00Z"
 }

modules/l2/static-assets/composition.json

@@ -18,7 +18,11 @@
     {"from": "s3.outputs.bucket_regional_domain_name", "to": "cloudfront.inputs.bucket_regional_domain_name"},
     {"from": "waf.outputs.web_acl_arn", "to": "cloudfront.inputs.waf_web_acl_arn"},
     {"from": "contract.inputs.region", "to": "kms.inputs.region"},
-    {"from": "kms.outputs.kms_key_arn", "to": "s3.inputs.kms_key_arn"}
+    {"from": "kms.outputs.kms_key_arn", "to": "s3.inputs.kms_key_arn"},
+    {"from": "contract.inputs.default_ttl", "to": "cloudfront.inputs.default_ttl"},
+    {"from": "contract.inputs.max_ttl", "to": "cloudfront.inputs.max_ttl"},
+    {"from": "contract.inputs.price_class", "to": "cloudfront.inputs.price_class"},
+    {"from": "contract.inputs.viewer_protocol_policy", "to": "cloudfront.inputs.viewer_protocol_policy"}
   ],
   "outputs": [
     {"from": "cloudfront.outputs.distribution_domain_name", "to": "stack.outputs.distribution_domain_name"},

modules/l2/static-assets/examples/complex.yml

@@ -1,16 +1,21 @@
 # Complex static-assets deployment (S3 + CloudFront + WAF)
-# Modify variant: same bucket_name as simple (in-place modify, adds CDN + WAF)
+# Modify variant: same bucket_name as simple (in-place modify, tunes CDN
+# TTLs + price class + viewer protocol policy). The simple example uses
+# the cloudfront interface defaults (default_ttl=3600, max_ttl=86400,
+# PriceClass_100, redirect-to-https); this complex example sets explicit
+# non-default values so the lifecycle "modify" step exercises a real
+# terraform diff on the cloudfront distribution, not an idempotent
+# re-apply.
 environment: dev
 id: assets
 infrastructure:
   static-assets:
     inputs:
       bucket_name: my-static-site
-      default_ttl: 3600
-      max_ttl: 86400
-      price_class: PriceClass_100
+      default_ttl: 7200
+      max_ttl: 172800
+      price_class: PriceClass_200
       region: us-east-1
-      viewer_protocol_policy: redirect-to-https
-      waf_enabled: true
+      viewer_protocol_policy: https-only
     version: 1.0.0
-name: static assets
+name: static assets

tests/test_adapter.py

@@ -330,4 +330,35 @@ class TestChildIdHelper:
         # ecs-service expands to service-task-definition + service-service
         assert _child_id(["service-task-definition", "service-service"]) == "service"
         # alb expands to alb-loadbalancer + alb-targetgroup + alb-listener
-        assert _child_id(["alb-loadbalancer", "alb-targetgroup", "alb-listener"]) == "alb"
+        assert _child_id(["alb-loadbalancer", "alb-targetgroup", "alb-listener"]) == "alb"
+
+
+class TestAdapterDedupRejectsUnregisteredModule:
+    """P1-1 (v1.14, REQ-135): a resource whose module is not in the
+    registry must raise ValueError, not be silently dropped from the
+    dedup merge. A typo'd module field (e.g. 'iam-role' vs 'iam_roles')
+    must surface as a diagnostic, not vanish."""
+
+    def test_unregistered_module_raises_valueerror(self, tmp_path):
+        stack = {
+            "resources": [
+                {"id": "bad", "type": "aws:bogus:thing", "module": "nonexistent@1.0.0", "inputs": {}}
+            ],
+            "outputs": {},
+            "data_sources": [],
+        }
+        with pytest.raises(ValueError, match="no terraform_dir for module 'nonexistent'"):
+            adapt(stack, str(tmp_path))
+
+    def test_registered_module_still_works(self, tmp_path):
+        """A registered module (s3) must still emit valid terraform — the
+        ValueError guard must not break the happy path."""
+        stack = {
+            "resources": [
+                {"id": "s3", "type": "aws:s3:bucket", "module": "s3@1.0.0", "inputs": {"bucket_name": "test"}}
+            ],
+            "outputs": {},
+            "data_sources": [],
+        }
+        adapt(stack, str(tmp_path))
+        assert (tmp_path / "main.tf").exists()