# Phase 15 — consumer-repo-and-terraform-apply (v1.2) VERIFY

**Verdict: Phase 15: PARTIALLY VERIFIED** (terraform apply blocked by IAM)
**Tag: v1.2.5**
**Date: 2026-07-21**

---

## Scope

Phase 15 creates the consumer repo `acdl-consumer-microservice` with a basic
HTTP microservice + Dockerfile, builds the Docker image, and runs the full
pipeline through to `terraform apply`. Requirements: **REQ-33** (terraform
apply), **REQ-34** (consumer repo).

## Verification layers

### 1. Structural
- `consumer-repos/acdl-consumer-microservice/{app.py,Dockerfile,README.md}` — tiny HTTP server (stdlib, port 8080, returns 200 on `/` + `/health`).
- `scripts/push_consumer_image.py` — ECR repo create + docker login helper.
- `adapters/terraform/adapter.py` — fixed: ref emission (bare, not `${...}`), JSON-string detection (`jsonencode`), ECS service `network_configuration`/`load_balancer`/`desired_count`/`launch_type`/`task_definition`/`name`, listener `default_action`/`load_balancer_arn`, target group `target_type`/`vpc_id`/`protocol`, VPC `tags` (not `name`), IGW + route table association emission, managed_policy_arns as list.
- `modules-ir/l1/l1-ecs-service/interface.json` — removed `port` from `aws:ecs:service` sub-resource.
- `modules-ir/l1/l1-vpc/interface.json` — added `intra_refs`; removed `igw_id` output.
- `acdl_platform/contract_resolver.py` — `intra_refs` resolution.
- `scripts/verify_phase15.sh` exists (+x).
- **PASS.**

### 2. Behavioral (`scripts/verify_phase15.sh`)
- Consumer microservice content: **PASS.**
- Docker image `acdl-microservice:latest` built: **PASS.**
- Contract → IR → adapter pipeline: **PASS** (11 resources).
- `terraform validate`: **PASS** (warnings only).
- `terraform plan`: **PASS** (13 to add — 11 IR + IGW + RTA).
- Evidence event `TERRAFORM_APPLY_BLOCKED` in DynamoDB outbox: **PASS.**
- v1.1 S3 regression: **PASS** (byte-identical).
- `terraform apply`: **BLOCKED** (AccessDenied on ECS/ECR/IAM/EC2 — live IAM policy not updated).

### 3. Security
- No credentials introduced. The IAM blocker is a security positive: the spike-runner has least-privilege; the policy expansion requires a deliberate privileged action.
- **PASS (with documented IAM blocker).**

### 4. Quality
- The adapter fixes address real HCL correctness issues that only surface on the first multi-resource ECS apply.
- The `intra_refs` mechanism is a clean extension keeping the resolver generic.
- v1.1 S3 regression passes (byte-identical).
- **PASS.**

## P0 / P1
- **P0: 1 (BLOCKING — operator action required).** `terraform apply` fails with AccessDenied on all ECS/ECR/IAM/EC2 operations. Root cause: Phase 12's `spike_runner_policy.json` expansion was committed to the repo but never pushed to the live AWS account (root key deactivated per D-034; spike-runner cannot self-elevate). **Unblock:** operator with root/admin creds runs `ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID=… ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY=… python3 terraform/bootstrap/create_iam_user.py` (idempotent). Then `terraform apply` succeeds (plan is valid, 13 to add). Phase 16 completes the e2e after this unblock.
- **P1: 1 (adapter hardening).** The adapter's ECS/ALB/VPC emission now includes resource-type-specific defaults (`desired_count = 1`, `launch_type = "FARGATE"`, `target_type = "ip"`, `load_balancer_type = "application"`, `tags = { Name = ... }`). Pragmatic for the v1.2 spike; should be parameterized via the L1 interfaces in v1.3.

## Requirements covered
- **REQ-33:** `terraform apply` (dev, autonomous) — **PARTIAL.** Pipeline reaches `terraform plan` successfully (13 to add). The `apply` is blocked by the IAM policy (P0). Adapter + resolver + L1 fixes complete; only the operator's IAM policy push remains.
- **REQ-34:** Consumer repo `acdl-consumer-microservice` with a basic microservice — **VERIFIED** (content authored under `consumer-repos/`; Gitea repo creation blocked by missing `ACDL_GITEA_TOKEN` — documented manual step; content is ready).

## Conclusion

Phase 15 is PARTIALLY VERIFIED. Everything up to `terraform apply` is
complete: consumer microservice content, Docker image, adapter fixes,
contract→IR→TF pipeline, `terraform validate` + `plan` (13 to add). The
`terraform apply` is blocked by the live IAM policy (P0, operator action).
The evidence stream captured the `TERRAFORM_APPLY_BLOCKED` event. Phase 16
will complete the e2e after the operator pushes the policy.