---
phase: P59
name: l1-lifecycle-pipeline-author
milestone: v1.11
requirements: [REQ-127]
wave: 2
depends_on: [P58]
---

# P59 — L1 Module Lifecycle Pipeline (Author)

**Phase:** P59
**Milestone:** v1.11 (RESTART)
**Requirement:** REQ-127
**Wave:** 2 (the testing milestone — author the pipeline, P60 runs it live)
**Branch:** `milestone/v1.11-restart` → `phase/p59-l1-lifecycle-pipeline`

## Goal

Author the `modules-lifecycle` pipeline that matrix-tests every L1 module's
lifecycle via its own `examples/{simple,complex}.yml` contracts through
apply→modify→destroy against live AWS. No per-module Python. The "test" =
the pipeline cell going green.

## Tasks (single wave)

### Task 1 — pipelines/modules-lifecycle.yml (declarative contract)

Author the declarative pipeline contract:
```yaml
name: acdl-modules-lifecycle
triggers:
  pull_request: [main]
  workflow_dispatch: []
runner: ubuntu-latest
python_version: "3.12"
stages:
  - name: validate-contract
    command: python3 -c "import yaml,json; c=yaml.safe_load(open('$CONTRACT')); assert c['id']"
    required: true
  - name: resolve-stack
    command: python3 core/contract_resolver.py "$CONTRACT" /tmp/lifecycle-stack.json
    required: true
  - name: terraform-apply
    command: bash scripts/run_platform.sh --apply "$CONTRACT"
    required: true
  - name: terraform-modify
    command: bash scripts/run_platform.sh --apply "$CONTRACT_COMPLEX"
    required: true
  - name: terraform-destroy
    command: bash scripts/run_platform.sh --destroy "$CONTRACT_COMPLEX"
    required: true
```

### Task 2 — .gitea/workflows/modules-lifecycle.yml + .github/workflows/modules-lifecycle.yml

Byte-identical workflows. Matrix over 12 L1 modules × {simple, complex}.
Each cell:
- Checkout + Python 3.12 + Terraform 1.9.* + AWS creds (from secrets).
- `run_platform.sh --apply modules/l1/<module>/examples/simple.yml`
- `run_platform.sh --apply modules/l1/<module>/examples/complex.yml` (same state key → terraform modifies)
- `run_platform.sh --destroy modules/l1/<module>/examples/complex.yml`

VPC-dependent L1s (alb, ecs-service, rds, uptime) reference the platform VPC
applied by a prerequisite job; standalone vpc L1 applies its own. Non-VPC
L1s (s3, kms-key, ecr, iam-role, ecs-cluster, cloudfront, waf) run independent.

### Task 3 — schemas/modules-lifecycle-pipeline.schema.json

Schema for the new pipeline shape (extends pipeline.schema.json with
workflow_dispatch trigger + matrix stages).

### Task 4 — Extend tests/test_pipeline_contract.py

Add a TestModulesLifecyclePipeline class:
- Schema validates.
- Gitea + GitHub workflows are byte-identical.
- Matrix lists all 12 L1 modules.
- Pipeline contract validates against the new schema.

### Task 5 — Extend pipelines/README.md

Add the modules-lifecycle pipeline to the table.

## Success Criteria (phase gate)

1. `pipelines/modules-lifecycle.yml` validates against its schema.
2. `.gitea/workflows/modules-lifecycle.yml` and `.github/workflows/modules-lifecycle.yml` are byte-identical.
3. Matrix lists all 12 L1 modules.
4. `test_pipeline_contract.py` passes (offline).
5. Full offline pytest suite green.