---
phase: 12
name: nfr-harden-and-simplify
milestone: v1.2
requirements: [REQ-30]
type: refactor/nfr
branch: phase/12-nfr-harden-and-simplify
---

# Phase 12 — nfr-harden-and-simplify (v1.2) PLAN

## Goal

Apply Phase 11's NFR + simplification findings: tighten the spike IAM
policy for the v1.2 ECS scope, consolidate the two `run_spike_*.sh`
scripts into one `scripts/run_platform.sh` (D-048), redact the two AWS
access key IDs from `.ciagent/` (P1-1), and fix the one stale `platform/`
path in PERSONAS.md (P1-B). The v1.1 spike still runs e2e after the
refactor.

## Tasks

### Wave 1 (backend-engineer — scripts + IAM)

#### T-12.1 — Consolidate run_spike_*.sh → run_platform.sh (D-048, REQ-30)
- Create `scripts/run_platform.sh` with a `--plan-only` flag (default: full e2e).
- Subsumes `run_spike_e2e.sh` (full pipeline) + `run_spike_plan.sh` (plan-only subset).
- Use `set -euo pipefail` + `fail()` helper for uniform strictness.
- Delete `run_spike_plan.sh` + `run_spike_e2e.sh`; update README.md to reference `run_platform.sh` only.
- Territory: `scripts/run_platform.sh`, `scripts/run_spike_*.sh`, `README.md`

#### T-12.2 — IAM policy expansion for ECS (REQ-30)
- Update `terraform/bootstrap/spike_runner_policy.json` to add ECS + ECR + ELB + IAM plan/apply permissions (scoped to the spike resources, least-privilege).
- Keep the `DenyEverythingElse` statement; expand the `NotResource` list.
- Territory: `terraform/bootstrap/spike_runner_policy.json`

#### T-12.3 — Idempotency documentation (REQ-30)
- Add a comment block to `create_state_backend.py` + `create_iam_user.py` documenting the idempotency contract (already idempotent per Phase 11 audit — no code change).
- Territory: `terraform/bootstrap/create_state_backend.py`, `terraform/bootstrap/create_iam_user.py`

### Wave 2 (docs — redactions + stale paths)

#### T-12.4 — Redact P1-1 AWS key IDs (REQ-30)
- Replace the two v1.1 AWS access key IDs (rotated spike key + deactivated root key) → `AKIA…SPIKE` / `AKIA…ROOT-DEACTIVATED` in `.ciagent/RESEARCH.md`, `.ciagent/PROJECT.md`, `.ciagent/REVIEW.md`, `.ciagent/AUDIT.md`.
- Territory: `.ciagent/`

#### T-12.5 — Fix stale platform/ path in PERSONAS.md (P1-B, REQ-30)
- Line 47: `platform/registry/**` → `modules-ir/registry.json`.
- Territory: `.ciagent/PERSONAS.md`

## Verification

- `scripts/run_platform.sh` runs the full v1.1 spike e2e and exits 0.
- `scripts/run_platform.sh --plan-only` runs plan-only and exits 0.
- `run_spike_plan.sh` + `run_spike_e2e.sh` no longer exist.
- No live v1.1 AWS access key IDs remain anywhere in `.ciagent/` (fully redacted to placeholders).
- `grep -rn "platform/registry" .ciagent/PERSONAS.md` returns nothing.
- `spike_runner_policy.json` has ECS + ECR + ELB + IAM permissions.
- `scripts/verify_phase12.sh` (authored in verify).

## Ship

Merge `phase/12-nfr-harden-and-simplify` → `main` (--no-ff). Tag `v1.2.2`.