acdl/.ciagent/PLAN.md

phase, name, milestone, requirements, wave, depends_on

phase	name	milestone	requirements	wave	depends_on
P56b	l1-module-terraform-authoring	v1.11	REQ-124	1	P56a

P56b — Author 11 L1 Module Terraform Subdirs

Phase: P56b Milestone: v1.11 (RESTART) Requirement: REQ-124 Wave: 1 (foundation — sequential prerequisite for P57–P58) Branch: milestone/v1.11-restart → phase/p56b-l1-terraform

Goal

Author the remaining 11 L1 module terraform subdirs (vpc, ecs-cluster, ecs-service, iam-role, alb, ecr, cloudfront, waf, rds, kms-key, uptime) with the full versions/variables/locals/main/outputs split. Defaults currently hardcoded in the adapter move into locals.tf. Each module's interface.json stays engine-agnostic. Add terraform_dir to each registry entry.

Module Classification

Single-resource modules (simpler; may inline locals in main.tf):

• kms-key — aws_kms_key + alias
• ecr — aws_ecr_repository
• ecs-cluster — aws_ecs_cluster
• iam-role — aws_iam_role (+ inline policy defaults)
• rds — aws_db_instance
• waf — aws_wafv2_web_acl
• uptime — aws_ecs_service (uptime-kuma)

Multi-resource modules (full 5-file split with locals.tf):

• vpc — aws_vpc + aws_subnet + aws_route_table + igw (intra-refs)
• ecs-service — aws_ecs_task_definition + aws_ecs_service (intra-refs)
• alb — aws_lb + aws_lb_target_group + aws_lb_listener (intra-refs)
• cloudfront — aws_cloudfront_distribution + aws_cloudfront_origin_access_control (intra-refs)

Tasks (single wave — all modules are independent once the adapter is proven)

Task 1 — Simple single-resource modules (data-engineer)

Author terraform/ for: kms-key, ecr, ecs-cluster, rds, waf, uptime. Each gets versions.tf + variables.tf + main.tf (with inlined locals or a locals.tf) + outputs.tf. Defaults from the adapter move here.

Key defaults to move:

• kms-key: enable_key_rotation=true, deletion_window_in_days=30 default
• ecr: encryption_configuration from kms_key_arn, image_scanning=true
• ecs-cluster: name default
• rds: storage_encrypted=true default, multi_az default, kms_key_arn
• waf: scope=cloudfront, default_action=allow, visibility_config, rules rendering
• uptime: Fargate compat, container_definitions from inputs

Task 2 — iam-role module (data-engineer)

Author terraform/ for iam-role. The adapter previously hardcoded:

• assume_role_policy fallback (ECS task trust) — move to locals.tf
• inline ECR/logs policy when no managed_policies — move to locals.tf
• role_name default

Task 3 — Multi-resource modules with intra-refs (data-engineer)

Author terraform/ for: vpc, ecs-service, alb, cloudfront. Each has multiple resources with intra-refs (one resource references another's output within the same module). The locals.tf centralizes:

• vpc: cidr_block default, subnet cidr derivation, route table defaults, IGW
• ecs-service: container_definitions jsonencode, Fargate compat, execution_role, network_config
• alb: listener default_action, target group vpc_id, port defaults
• cloudfront: origin block, default_cache_behavior, OAC defaults

Task 4 — Registry extension (backend-engineer)

Add terraform_dir to all 11 remaining registry entries.

Task 5 — Validate all modules standalone (data-engineer)

Run terraform init + validate in each of the 12 terraform/ subdirs. Fix any validation errors.

Task 6 — Offline regression (backend-engineer)

• pytest tests/ -m "not slow" — all offline tests pass; the 6 P56b-skipped tests should now unblock (static-assets contract resolves cloudfront/waf/s3).
• bash scripts/run_primitive_plan.sh --check-only <module> for each of the 12 modules — each exits 0.

Success Criteria (phase gate)

1. All 12 L1 modules have a terraform/ subdir with the required files.
2. All 12 terraform/ subdirs pass terraform init + validate standalone.
3. All 12 registry entries have a terraform_dir field.
4. No defaults remain in the adapter (grep for hardcoded CIDR, assume_role_policy, etc.).
5. pytest tests/ -m "not slow" — 455+ passed, 0 skipped (the 6 P56b-skipped tests unblock).
6. run_primitive_plan.sh --check-only <module> exits 0 for all 12 modules.