verify(P28-38): code review — 1 P0 auto-fixed, 3 P1 fixes, 2 P1 flagged

---ci---
project: acdl
phase: 28-38
milestone: v1.8
status: verify
lessons:
  - P0 fix: pipelines/deploy.yaml stale terraform/spike paths updated to run_platform.sh
  - P1 fix: removed import sys from inside _emit_resource function body
  - P1 fix: removed unused cpu/memory vars in uptime emission
  - P1 fix: decommission consumerRepo now uses GITHUB_REPOSITORY env
---/ci---

P0: deploy.yaml 3 stage commands referenced removed terraform/spike dir.
P1 fixes: import sys, unused vars, consumerRepo env.
P1 flagged: uptime hardcoded subnet/sg, uses ref not bumped to v1.8.
P2 flagged: deploy-uptime flag standalone, pre-v1.8 READMEs missing NFRs.

Tests: 350 passed.

adapters/terraform/adapter.py

@@ -456,7 +456,6 @@ def _emit_resource(resource, type_by_id=None):
                 body.append("  }")
                 body.append("}")
             else:
-                import sys
                 print(f"WARNING: s3 bucket {rid} has no kms_key_arn — falling back to AWS-managed key (alias/aws/s3)", file=sys.stderr)
                 body.append("server_side_encryption_configuration {")
                 body.append("  rule {")
@@ -470,8 +469,6 @@ def _emit_resource(resource, type_by_id=None):
         if not feature_flag:
             return ""
         container_image = inputs.get("container_image", "louislam/uptime-kuma:1")
-        cpu = inputs.get("cpu", 256)
-        memory = inputs.get("memory", 512)
         monitored = inputs.get("monitored_endpoints", [])
         static_checks = inputs.get("static_checks", [])
         alert_channels = inputs.get("alert_channels", {})

pipelines/deploy.yaml

@@ -42,7 +42,7 @@ stages:
 
   - name: checkov
     description: Run Checkov policy checks on the emitted Terraform
-    command: checkov -f terraform/spike/main.tf --framework terraform -o json --soft-fail
+    command: bash scripts/run_platform.sh --check-only
     required: false
 
   - name: confidence
@@ -52,12 +52,12 @@ stages:
 
   - name: apply
     description: Apply the Terraform plan (dev environment only, autonomous per §10)
-    command: terraform -chdir=terraform/spike apply -auto-approve -lock=false
+    command: bash scripts/run_platform.sh --plan-only
     required: false
 
   - name: publish-outputs
     description: Publish deploy outputs to SSM Parameter Store (SecureString) + GitHub PR comment
-    command: python3 -c "from core.output_publisher import publish_to_ssm, format_comment, post_github_comment; import json,subprocess; tf=json.loads(subprocess.check_output(['terraform','-chdir=terraform/spike','output','-json']) or '{}'); outputs={k:v.get('value') if isinstance(v,dict) else v for k,v in tf.items()}; ssm=publish_to_ssm(outputs,'dev','spike'); comment=format_comment(outputs,'dev','spike',ssm); post_github_comment(comment)"
+    command: bash scripts/run_platform.sh
     required: false
 
   - name: deploy-uptime

scripts/run_platform.sh

@@ -129,7 +129,7 @@ if [ "$DECOMMISSION" = "1" ]; then
   echo ""
   echo "=== Decommission Step 1: validate change request against CMDB ==="
   [ -n "$CHANGE_REQUEST_ID" ] || fail "change request ID required for decommission mode"
-  CONSUMER_REPO=$(python3 -c "import yaml; c=yaml.safe_load(open('$CONTRACT')); print(c.get('module','unknown'))" 2>/dev/null || echo "unknown")
+  CONSUMER_REPO="${GITHUB_REPOSITORY:-$(python3 -c "import yaml; c=yaml.safe_load(open('$CONTRACT')); print(c.get('module','unknown'))" 2>/dev/null || echo 'unknown')}"
   python3 -c "
 import json, sys
 sys.path.insert(0, '$ROOT')