acdl/.ciagent/PLAN.md

phase, name, milestone, requirements, wave, depends_on

phase	name	milestone	requirements	wave	depends_on
P57	shell-orchestrator-lifecycle-modes	v1.11	REQ-125	1	P56b

P57 — Shell Orchestrator Lifecycle Modes

Phase: P57 Milestone: v1.11 (RESTART) Requirement: REQ-125 Wave: 1 (foundation) Branch: milestone/v1.11-restart → phase/p57-shell-lifecycle

Goal

Add --apply and --destroy modes to scripts/run_platform.sh. The shell owns all terraform lifecycle; Python never runs terraform. The existing --plan-only and --check-only modes are preserved unchanged.

Tasks (single wave)

Task 1 — Add --apply / --destroy flags + lifecycle modes

Add APPLY_ONLY=0 and DESTROY_ONLY=0 to the arg parsing (lines 39-47). Add --apply and --destroy cases to the arg loop (lines 58-76).

After the terraform init+validate+plan section (line 274-291), add two new branches:

--apply mode:

• After terraform plan succeeds, run terraform apply -auto-approve -lock=false against the emitted TF.
• For qa/prod/dr, the existing HITL gate (line 350-379) runs BEFORE apply.
• After apply, read terraform outputs and print them.
• Exit 0 with "PLATFORM APPLY OK".

--destroy mode:

• After terraform init+validate, run terraform destroy -auto-approve -lock=false.
• The --decommission flag + CR validation (D-070 two-step) gates destroy when used with --destroy --decommission <CR>. Without --decommission, --destroy is a direct destroy (for lifecycle testing, not production teardown).
• Exit 0 with "PLATFORM DESTROY OK".

Task 2 — Update usage header + mode docs

Update the script header (lines 1-26) to document the new modes:

• --apply <contract.yml> — resolve → adapter → terraform init/validate/plan/apply
• --destroy <contract.yml> — resolve → adapter → terraform init/validate/destroy

Task 3 — Add lifecycle mode tests

Add tests to tests/test_pipeline.py:

• test_run_platform_apply_mode_exists — run_platform.sh --apply parses without "unknown flag" error (offline smoke; doesn't actually apply).
• test_run_platform_destroy_mode_exists — run_platform.sh --destroy parses without "unknown flag" error.
• test_no_python_runs_terraform_apply — grep assertion: no .py file in scripts/ contains terraform apply or terraform destroy.

Task 4 — Offline regression

• pytest tests/ -m "not slow" — all offline tests pass.
• run_platform.sh --check-only still works (no regression in existing modes).

Success Criteria (phase gate)

1. run_platform.sh --apply <contract> and --destroy <contract> modes exist and parse without "unknown flag" error.
2. grep -rn "terraform apply\|terraform destroy" scripts/*.py returns nothing (Python never runs terraform lifecycle).
3. The existing --check-only and --plan-only modes still work (no regression).
4. pytest tests/ -m "not slow" — all pass.