acdl/.ciagent/PLAN.md

phase, name, milestone, requirements, wave, depends_on

phase	name	milestone	requirements	wave	depends_on
P61	l2-lifecycle-pipeline-author	v1.11	REQ-128	3	P60

P61 — L2 Lifecycle Pipeline (Author)

Phase: P61 Milestone: v1.11 (RESTART) Requirement: REQ-128 Wave: 3 (author the L2 lifecycle pipeline, P62 runs it live) Branch: milestone/v1.11-restart

Goal

Extend the modules-lifecycle pipeline + both forge workflows with an L2 matrix: static-assets × contracts/static-assets.yml (apply → modify: add WAF rule → destroy) and microservice × contracts/microservice.yml (apply → modify: desired_count 1→2 → destroy, references platform VPC). L2 = composition only (no L2 terraform files); the composition must be deterministic (same contract → same resolved stack → same state key).

Tasks (single wave)

Task 1 — Extend pipelines/modules-lifecycle.yml

Add L2 stages to the declarative pipeline contract:

• l2-lifecycle-apply: run_platform.sh --apply modules/l2/${MODULE}/examples/simple.yml
• l2-lifecycle-modify: run_platform.sh --apply modules/l2/${MODULE}/examples/complex.yml
• l2-lifecycle-destroy: run_platform.sh --destroy modules/l2/${MODULE}/examples/complex.yml

Add L2 matrix entries: l2_modules: [static-assets, microservice]

Task 2 — Extend .gitea/workflows/modules-lifecycle.yml + .github/workflows/modules-lifecycle.yml

Add an l2-lifecycle job (byte-identical in both forges) that matrix-runs over [static-assets, microservice]. Each cell:

• Checkout + Python 3.12 + Terraform 1.9.* + AWS creds (from secrets).
• run_platform.sh --apply modules/l2/<module>/examples/simple.yml
• run_platform.sh --apply modules/l2/<module>/examples/complex.yml (same state key → modify)
• run_platform.sh --destroy modules/l2/<module>/examples/complex.yml

The l2-lifecycle job needs the CI VPC (for microservice which references the platform VPC via terraform_remote_state). It runs after ci-vpc-apply and before ci-vpc-destroy.

Task 3 — Author modules/l2/static-assets/examples/complex.yml (modify variant)

The complex example already exists and adds CloudFront + WAF. Verify it's a valid modify variant (same state key, adds resources without forcing replacement of the simple S3 bucket). If the bucket_name changes between simple and complex, that forces replacement — fix to keep the same bucket_name so terraform modifies in-place.

Task 4 — Author modules/l2/microservice/examples/complex.yml (modify variant)

The complex example already exists and adds ALB + env vars. The modify variant should change desired_count (1→2) to demonstrate in-place modify. Fix the complex example to keep the same family and image as simple (so terraform modifies rather than replaces the ECS task definition).

Task 5 — Extend schemas/modules-lifecycle-pipeline.schema.json

Add l2_modules to the matrix properties. Add L2 stages to the stages array.

Task 6 — Extend tests/test_pipeline_contract.py

Add a TestL2LifecyclePipeline class:

• L2 matrix lists both modules.
• L2 lifecycle job has apply/modify/destroy steps.
• L2 job depends on ci-vpc-apply.
• Pipeline contract validates against the extended schema.
• Gitea + GitHub workflows remain byte-identical.

Task 7 — Extend pipelines/README.md

Add L2 lifecycle stages to the pipeline description.

Success Criteria (phase gate)

1. pipelines/modules-lifecycle.yml validates against its schema.
2. .gitea/workflows/modules-lifecycle.yml and .github/workflows/modules-lifecycle.yml are byte-identical.
3. L2 matrix lists both static-assets and microservice.
4. L2 lifecycle job has apply→modify→destroy steps.
5. test_pipeline_contract.py passes (offline).
6. Composition resolution is deterministic (same contract → same stack).
7. Full offline pytest suite green.