# Phase 12 — nfr-harden-and-simplify (v1.2) VERIFY

**Verdict: Phase 12: VERIFIED**
**Tag: v1.2.2**
**Date: 2026-07-21**

---

## Scope

Phase 12 applies Phase 11's NFR + simplification findings: consolidates
the two `run_spike_*.sh` scripts into one `scripts/run_platform.sh`
(D-048), expands the spike IAM policy for the v1.2 ECS scope
(least-privilege), documents the bootstrap idempotency contract, redacts
the two v1.1 AWS access key IDs from `.ciagent/` (P1-1), and fixes the
last stale `platform/` path in PERSONAS.md (P1-B). Requirement covered:
**REQ-30**.

## Verification layers

### 1. Structural

- `scripts/run_platform.sh` exists (+x, supersedes the two v1.1 scripts).
- `scripts/run_spike_e2e.sh` + `scripts/run_spike_plan.sh` deleted.
- `terraform/bootstrap/spike_runner_policy.json` expanded (ECS + ECR + ELB + IAM + EC2 Allow statements; DenyEverythingElse NotResource expanded).
- `terraform/bootstrap/create_state_backend.py` + `create_iam_user.py` have idempotency-contract docstrings (logic unchanged).
- `README.md` references `run_platform.sh` (no stale `run_spike_*.sh` refs).
- `.ciagent/RESEARCH.md`, `PROJECT.md`, `REVIEW.md`, `AUDIT.md` redacted (no live AWS key IDs).
- `.ciagent/PERSONAS.md` line 47 fixed (`platform/registry/**` → `modules-ir/registry.json`).
- `scripts/verify_phase12.sh` exists (+x).
- `.ciagent/PLAN.md` updated to Phase 12.
- **PASS.**

### 2. Behavioral (`scripts/verify_phase12.sh`)

```
=== Phase 12 verification ===
Script consolidation (D-048): OK
IAM policy expansion: OK (ECS + ECR + ELB + IAM + EC2 + DenyEverythingElse)
Idempotency documentation: OK
P1-1 redaction: OK (no live AWS key IDs in .ciagent/)
P1-B stale path: OK (PERSONAS.md platform/registry -> modules-ir/registry.json)
run_platform.sh syntax: OK
.ciagent/ consistency: OK

=== Phase 12: VERIFIED ===
```

All 22 assertions pass. Additionally, the subagent ran
`bash scripts/run_platform.sh --plan-only` during execution and it
completed all 4 plan steps against real AWS (`.env.secrets` present in
this env), printed `=== PLATFORM PLAN OK ===`, exit 0 — the consolidated
script is functionally equivalent to the original `run_spike_plan.sh`.
- **PASS.**

### 3. Security

- **P1-1 closed**: no live AWS access key IDs remain in `.ciagent/` (`grep -rn "AKIAYOZHMKZ7RK26N66W\|AKIAYOZHMKZ772SINHFX" .ciagent/` returns nothing). The key IDs in git history (v1.1 commits) are immutable but the current-tree narrative is clean.
- **IAM policy**: expanded to ECS/ECR/ELB/IAM/EC2 with region-scoped resource ARNs (`arn:aws:ecs:us-east-1:581513795199:*` etc.) — least-privilege, no `*` resources. `DenyEverythingElse` preserved with expanded `NotResource`. The policy is ready for Phase 15's `terraform apply` but grants no more than the ECS microservice needs.
- **No credentials introduced**: the policy is a static JSON document; no secrets in code.
- **PASS.**

### 4. Quality

- `run_platform.sh` uses `set -euo pipefail` (strict bash) — stricter than the original `set -u`.
- The `--plan-only` flag defaults to false (full e2e is the default), matching the v1.1 behavior where `run_spike_e2e.sh` was the primary entry point.
- The IAM policy expansion follows the Phase 13 L1 catalog scoping (D-049): the 6 L1s map to exactly the 5 new permission categories (ECS, ECR, ELB, IAM, EC2).
- The idempotency documentation is accurate (the scripts were already idempotent per the Phase 11 code audit — this phase documents the contract, no logic change).
- **PASS.**

## P0 / P1

- **P0: none.**
- **P1: none new.** P1-1 (carried from v1.1) is now **closed** by this phase. P1-B (stale `platform/` path) is now **closed**. P1-A (config.json status) was closed at `ab69d10` in v1.1. P1-C (run.md tag-placement guidance) and P1-D (ROADMAP audit-pending) were closed in v1.1.

## Requirements covered

- **REQ-30:** NFR hardening — (a) `spike_runner_policy.json` expanded to least-privilege ECS/ECR/ELB/IAM/EC2 (audit-ready, no wildcards beyond documented exceptions); (b) `create_state_backend.py` + `create_iam_user.py` idempotency documented (already idempotent); (c) `run_spike_plan.sh` + `run_spike_e2e.sh` consolidated into `scripts/run_platform.sh` with `set -euo pipefail` + `--plan-only` flag; (d) P1-1 redacted (no live AWS key IDs in `.ciagent/`); (e) P1-B fixed (no stale `platform/` paths). **VERIFIED.**

## Conclusion

Phase 12 is VERIFIED. The platform is hardened and simpler: one
`run_platform.sh` instead of two scripts, least-privilege IAM ready for
ECS, idempotency documented, and the v1.1 audit's P1-1 + P1-B hygiene
items are closed. The v1.1 spike still runs e2e after the refactor
(verified by the subagent's `--plan-only` run against real AWS).