acdl/.ciagent/PLAN.md

phase, name, milestone, requirements, wave, depends_on

phase	name	milestone	requirements	wave	depends_on
P59	l1-lifecycle-pipeline-author	v1.11	REQ-127	2	P58

P59 — L1 Module Lifecycle Pipeline (Author)

Phase: P59 Milestone: v1.11 (RESTART) Requirement: REQ-127 Wave: 2 (the testing milestone — author the pipeline, P60 runs it live) Branch: milestone/v1.11-restart → phase/p59-l1-lifecycle-pipeline

Goal

Author the modules-lifecycle pipeline that matrix-tests every L1 module's lifecycle via its own examples/{simple,complex}.yml contracts through apply→modify→destroy against live AWS. No per-module Python. The "test" = the pipeline cell going green.

Tasks (single wave)

Task 1 — pipelines/modules-lifecycle.yml (declarative contract)

Author the declarative pipeline contract:

name: acdl-modules-lifecycle
triggers:
  pull_request: [main]
  workflow_dispatch: []
runner: ubuntu-latest
python_version: "3.12"
stages:
  - name: validate-contract
    command: python3 -c "import yaml,json; c=yaml.safe_load(open('$CONTRACT')); assert c['id']"
    required: true
  - name: resolve-stack
    command: python3 core/contract_resolver.py "$CONTRACT" /tmp/lifecycle-stack.json
    required: true
  - name: terraform-apply
    command: bash scripts/run_platform.sh --apply "$CONTRACT"
    required: true
  - name: terraform-modify
    command: bash scripts/run_platform.sh --apply "$CONTRACT_COMPLEX"
    required: true
  - name: terraform-destroy
    command: bash scripts/run_platform.sh --destroy "$CONTRACT_COMPLEX"
    required: true

Task 2 — .gitea/workflows/modules-lifecycle.yml + .github/workflows/modules-lifecycle.yml

Byte-identical workflows. Matrix over 12 L1 modules × {simple, complex}. Each cell:

• Checkout + Python 3.12 + Terraform 1.9.* + AWS creds (from secrets).
• run_platform.sh --apply modules/l1/<module>/examples/simple.yml
• run_platform.sh --apply modules/l1/<module>/examples/complex.yml (same state key → terraform modifies)
• run_platform.sh --destroy modules/l1/<module>/examples/complex.yml

VPC-dependent L1s (alb, ecs-service, rds, uptime) reference the platform VPC applied by a prerequisite job; standalone vpc L1 applies its own. Non-VPC L1s (s3, kms-key, ecr, iam-role, ecs-cluster, cloudfront, waf) run independent.

Task 3 — schemas/modules-lifecycle-pipeline.schema.json

Schema for the new pipeline shape (extends pipeline.schema.json with workflow_dispatch trigger + matrix stages).

Task 4 — Extend tests/test_pipeline_contract.py

Add a TestModulesLifecyclePipeline class:

• Schema validates.
• Gitea + GitHub workflows are byte-identical.
• Matrix lists all 12 L1 modules.
• Pipeline contract validates against the new schema.

Task 5 — Extend pipelines/README.md

Add the modules-lifecycle pipeline to the table.

Success Criteria (phase gate)

1. pipelines/modules-lifecycle.yml validates against its schema.
2. .gitea/workflows/modules-lifecycle.yml and .github/workflows/modules-lifecycle.yml are byte-identical.
3. Matrix lists all 12 L1 modules.
4. test_pipeline_contract.py passes (offline).
5. Full offline pytest suite green.