# Phase 28-36 — Verify (v1.8)

## Structural
All 14 new files present (kms-key primitive, uptime primitive, STANDARDS.md,
3 READMEs, seed script, 4 test files). terraform/spike removed. Registry
has 14 entries. **PASS.**

## Behavioral
- `pytest`: 350 tests, all passing (was 275 at v1.7 → 350 at v1.8, +75 new).
- `run_ci.sh`: exits 0 with "CI PIPELINE OK".
- `run_platform.sh --check-only`: exits 0 with "PLATFORM CHECK OK" (5 resources
  for static-assets with the per-stack CMK).
**PASS.**

## Security
- No placeholder account ID in consumer_invoke_policy.json.
- No hardcoded GitHub API URLs in contract_ingestor.py (uses GITHUB_API_BASE).
- Deploy workflows byte-identical.
- SSM fails loud without ACDL_KMS_KEY_ID (RuntimeError).
- Deletion protection on by default for all primitives.
- Encryption enabled by default for all primitives.
**PASS.**

## Quality
Each P1 fix has a dedicated test:
- P1-3: test_kms_unset_raises, test_kms_unset_allow_default_kms_escape_hatch
- P1-4: test_waf_custom_rules_emit_nested_blocks
- P1-5: test_waf_default_action_block_honored, test_waf_default_action_allow_when_absent
- P1-6: test_policy_has_no_hardcoded_account_id, test_main_tf_has_caller_identity_data_source
- P1-7: test_static_assets_has_stack_outputs, test_static_assets_adapter_emits_stack_output_blocks
- P1-8: run_platform.sh writes to $WORK/tf (verified by check-only)
- P1-9: test_gitea_search_url_uses_repos_endpoint, test_github_search_url_uses_search_endpoint
- S1: test_deploy_workflow_static_key_override_wired

Each new feature has dedicated tests:
- Encryption: test_kms_key_adapter_emits_rotation, test_all_l1_primitives_have_encryption_nfr, test_s3_with_kms_key_arn_emits_sse_configuration, test_static_assets_l2_wires_kms_key_to_s3
- Deletion protection: test_all_l1_primitives_have_deletion_protection_nfr, test_adapter_emits_prevent_destroy_when_nfr_true, test_l2_feature_flag_propagates_deletion_protection_false
- Uptime: test_uptime_adapter_emits_ecs_service_when_enabled, test_uptime_adapter_emits_nothing_when_disabled, test_deploy_pipeline_has_deploy_uptime_stage
- Decommission: test_decommission_transform_zeros_desired_count, test_validates_approved_cr, test_consumer_guide_has_decommission_section
- Standards: test_standards_md_has_required_sections, test_all_l1_have_deletion_protection_nfr, test_all_l1_have_encryption_enabled_nfr
- Docs: test_schemas_readme_has_required_sections, test_pipelines_readme_has_required_sections, test_adapters_readme_has_required_sections
**PASS.**

## Verdict

**VERIFY PASS** — all four layers pass. 350 offline tests, no AWS required for CI.