acdl/.ciagent/PLAN.md

phase, name, milestone, requirements, wave, depends_on

phase	name	milestone	requirements	wave	depends_on
P60	l1-lifecycle-pipeline-live-run	v1.11	REQ-127	2	P59

P60 — L1 Module Lifecycle Pipeline (Live Run)

Phase: P60 Milestone: v1.11 (RESTART) Requirement: REQ-127 (shared with P59) Wave: 2 (the testing milestone — P59 authored the pipeline, P60 runs it live) Branch: milestone/v1.11-restart (retrofit — see "Deviation note" below)

Goal

Run the modules-lifecycle pipeline against live AWS; fix every module whose apply/modify/destroy fails. Each failing cell is a module defect: bad terraform/ subdir (resource shape, nested blocks, defaults), bad example contract, or bad adapter assembly. Fixes land in modules/l1/<module>/terraform/*.tf, modules/l1/<module>/examples/*.yml, terraform/ci-vpc/, scripts/run_lifecycle_*.sh, and rarely the adapter assembler. No new Python files.

Deviation note (process audit)

P60's execute deliverable was produced out-of-band: 13 fix(...) commits landed on milestone/v1.11-restart between the P59 verify PASS (3739037) and HEAD (88ea408), committed under phase: P59, status: execute rather than a dedicated phase/p60-* branch. This retrofit PLAN formalizes that work as P60's EXECUTE output. The phase branch deviation is documented for the COMPLETE-stage audit; no commits are reverted (the fixes are correct and were validated by terraform validate + 24 example contracts --check-only).

Tasks (already executed — retrofit)

Task 1 — CI VPC separation (commits 8071d6a, ad3cc5f, a55752e)

Created terraform/ci-vpc/ — a short-lived VPC for L1 module lifecycle testing, separate from the long-lived platform VPC. Created before VPC-dependent modules (alb, ecs-service, rds, uptime), destroyed after. Outputs (vpc_id, subnet_ids, sg_id, cluster_arn) read from S3 state by each lifecycle job (no artifact passing — upload-artifact@v4 unsupported on Gitea/GHES).

• 8071d6a — target only VPC resources in platform-vpc-apply/destroy
• ad3cc5f — separate short-lived CI VPC + fix 8 module lifecycle failures
• a55752e — read CI VPC outputs from S3 state instead of artifacts

Task 2 — Platform terraform fixes (commits 2f8c020, c4e94cf)

• 2f8c020 — quote acdl: tags + fix Lambda + replace interpolation
• c4e94cf — make Lambda conditional on zip existing

Task 3 — CI workflow fixes (commits 315a86d, 3597cf0, 75b56f5, 3ef3a82, 60f767d)

• 315a86d — replace configure-aws-credentials with direct env vars
• 3597cf0 — install Terraform 1.9.* in test + check-only jobs
• 75b56f5 — recursive .terraform gitignore (covers all module + platform dirs)
• 3ef3a82 — skip terraform validate test when terraform binary not installed
• 60f767d — 3 pipeline-readiness fixes (resolver id, schema inputs, CI creds)

Task 4 — Module lifecycle fixes (commits ad3cc5f, 6795acc, fad6765, 88ea408)

8 module-specific fixes in ad3cc5f:

• s3 — unique bucket names (acdl-ci-s3a-simple/complex) instead of globally-taken 'my-simple-bucket'
• kms-key — alias name with no spaces (locals.tf → alias/acdl-ci-kms)
• iam-role — example contract uses role_name (not name, which the interface doesn't declare)
• ecs-service — example contract uses family (not name); VPC inputs (cluster_arn, subnets, security_group) injected by CI VPC wrapper
• uptime — added subnets, security_group, cluster_arn to interface + module; network_configuration is dynamic (only when subnets provided)
• rds — added subnet_ids input + db_subnet_group resource (conditional on subnet_ids being non-empty)
• alb — removed hardcoded placeholder sg/subnet values from examples; vpc_id + subnets + security_group injected by CI VPC wrapper
• cloudfront — removed invalid placeholder WAF ARN from complex example

Follow-up fixes:

• 6795acc — ALB: create_before_destroy on target group + depends_on on listener (fixes ResourceInUse when port changes simple 80 → complex 443)
• fad6765 — kms-key deletion window 90→30 (AWS max); rds password policy (added password var, default 'ACdlcI2026!')
• 88ea408 — uptime: add default for container_image variable (interface declares default 'louislam/uptime-kuma:1' but module had no default)

Success Criteria (phase gate)

1. Full L1 lifecycle matrix green: 12 modules × 2 examples = 24 cells, each apply→modify→destroy exit 0. Evidence = green PR check on modules-lifecycle.yml (PR opened from milestone/v1.11-restart → main to trigger the pull_request event; or workflow_dispatch).
2. No live resources remain after the run (ci-vpc-destroy always runs, lifecycle destroy step per module).
3. primitives-plan.yml (plan-only) still passes.
4. Full offline pytest suite green (479+ tests).

Verification approach

• Offline (this session): pytest + 24 example contracts --check-only.
• Live-AWS (CI): open PR milestone/v1.11-restart → main via tea; wait for acdl-modules-lifecycle workflow green across all 14 jobs (1 ci-vpc-apply + 12 lifecycle + 1 ci-vpc-destroy). Read workflow run status via tea or the Gitea API. Green = P60 verify evidence.