docs(P04): complete l2-patterns-bootstrap-platform phase

---ci--- project: nova-platform phase: 4 milestone: v1.0 status: complete ---/ci--- P4 complete: L2 patterns (D-038), bootstrap (D-022/026), platform (D-023), ci-vpc (D-024), onboarding (D-025), microservice root. 68 tests pass. REQ-12,14,15,16,17,18,19,22 covered.
docs(P03): complete l1-primitives-registry phase
2026-08-24 17:47:24 +00:00 · 2026-08-24 17:41:43 +00:00
115 changed files with 3474 additions and 9 deletions
@@ -1,19 +1,21 @@
 {
-  "phase": 2,
+  "phase": 4,
  "stage": "verify",
  "milestone": "v1.0",
  "phase_role": "execution",
  "attempts": 0,
-  "updated_at": "2026-08-20T19:15:00Z",
+  "updated_at": "2026-08-20T20:15:00Z",
  "project": "nova-platform",
  "milestone_branch": "milestone/v1.0-nova-platform",
-  "phase_branch": "phase/02-terraform-adapter-engine-boundary",
-  "phase_0_ship": {"tag": "v0.1.0", "merged_to_milestone": true, "merge_commit": "7835c2a", "phase_branch_deleted": true, "local_only": true},
-  "phase_1_ship": {"tag": "v0.1.1", "merged_to_milestone": true, "phase_branch_deleted": true, "local_only": true},
-  "phase_2_verify": {
+  "phase_branch": "phase/04-l2-patterns-bootstrap-platform",
+  "phase_0_ship": {"tag": "v0.1.0", "local_only": true},
+  "phase_1_ship": {"tag": "v0.1.1", "local_only": true},
+  "phase_2_ship": {"tag": "v0.1.2", "local_only": true},
+  "phase_3_ship": {"tag": "v0.1.3", "local_only": true},
+  "phase_4_verify": {
    "tests_pass": true,
-    "tests_count": 58,
-    "reqs_covered": ["REQ-07", "REQ-08", "REQ-09", "REQ-25", "REQ-26", "REQ-10"]
+    "tests_count": 68,
+    "reqs_covered": ["REQ-12", "REQ-14", "REQ-15", "REQ-16", "REQ-17", "REQ-18", "REQ-19", "REQ-22"]
  },
-  "next_phase": "phase/03-l1-primitives-registry"
+  "next_phase": "phase/05-shell-reproducibility-tests-docs"
 }
@@ -0,0 +1,36 @@
+# Module Catalog
+
+Every module's full documentation lives next to its code under
+`modules/l1/<name>/README.md` or `modules/l2/<name>/README.md` (per
+D-028). This page is the index: it lists the available modules and
+links to their per-module docs.
+
+## L1 primitives (13)
+
+| Module          | Stack type                    | Multi-resource? | Docs                                          |
+|-----------------|-------------------------------|-----------------|-----------------------------------------------|
+| `s3`            | `aws:s3:bucket`               | no              | [modules/l1/s3/README.md](../../modules/l1/s3/README.md)                 |
+| `vpc`           | `aws:ec2:vpc`                 | yes             | [modules/l1/vpc/README.md](../../modules/l1/vpc/README.md)               |
+| `ecs-cluster`   | `aws:ecs:cluster`             | no              | [modules/l1/ecs-cluster/README.md](../../modules/l1/ecs-cluster/README.md) |
+| `ecs-service`   | `aws:ecs:service`             | yes             | [modules/l1/ecs-service/README.md](../../modules/l1/ecs-service/README.md) |
+| `iam-role`      | `aws:iam:role`                | no              | [modules/l1/iam-role/README.md](../../modules/l1/iam-role/README.md)     |
+| `alb`           | `aws:alb`                     | yes             | [modules/l1/alb/README.md](../../modules/l1/alb/README.md)               |
+| `ecr`           | `aws:ecr:repository`          | no              | [modules/l1/ecr/README.md](../../modules/l1/ecr/README.md)               |
+| `cloudfront`    | `aws:cloudfront:distribution` | no              | [modules/l1/cloudfront/README.md](../../modules/l1/cloudfront/README.md) |
+| `waf`           | `aws:waf:web_acl`             | no              | [modules/l1/waf/README.md](../../modules/l1/waf/README.md)               |
+| `rds`           | `aws:rds:instance`            | no              | [modules/l1/rds/README.md](../../modules/l1/rds/README.md)               |
+| `kms-key`       | `aws:kms:key`                 | no              | [modules/l1/kms-key/README.md](../../modules/l1/kms-key/README.md)       |
+| `dynamodb`      | `aws:dynamodb:table`          | no              | [modules/l1/dynamodb/README.md](../../modules/l1/dynamodb/README.md)     |
+| `uptime`        | `aws:uptime:monitor`          | no              | [modules/l1/uptime/README.md](../../modules/l1/uptime/README.md)         |
+
+## L2 compositions (2)
+
+| Module           | Composes                                    | Docs                                              |
+|------------------|---------------------------------------------|---------------------------------------------------|
+| `microservice`   | vpc + ecs-cluster + ecs-service + alb + ecr | [modules/l2/microservice/README.md](../../modules/l2/microservice/README.md) |
+| `static-assets`  | s3 + cloudfront                             | [modules/l2/static-assets/README.md](../../modules/l2/static-assets/README.md) |
+
+## See also
+
+- [modules/README.md](../../modules/README.md) — L1/L2 distinction, registry format, how to add a module.
+- [modules/README-TEMPLATE.md](../../modules/README-TEMPLATE.md) — per-module doc template.
@@ -0,0 +1,96 @@
+# Module: `<name>`
+
+> Copy this template into `modules/l1/<name>/README.md` or
+> `modules/l2/<name>/README.md` and fill in the placeholders. Sections
+> marked **DROP** are intentionally omitted from nova modules
+> (D-029): do **not** add `NFRs` or `Compliance` sections.
+
+## Overview
+
+One-paragraph description of what this module provisions, the stack
+type(s) it exposes, and when to reach for it. Mention whether it is L1
+(single primitive) or L2 (composition of L1s), and whether it is
+multi-resource.
+
+- **Stack type:** `aws:<service>:<resource>`
+- **Kind:** `l1` (or `l2`)
+- **Version:** `1.0.0`
+
+## Resources
+
+List the concrete cloud resources the Terraform adapter creates. For L1
+single-resource modules this is one row; for multi-resource L1s mirror
+the `resources[]` array in `interface.json`.
+
+| Stack type              | Terraform resource                 | Notes                            |
+|-------------------------|------------------------------------|----------------------------------|
+| `aws:s3:bucket`         | `aws_s3_bucket`                    | The bucket itself                |
+| `aws:s3:bucket`         | `aws_s3_bucket_versioning`         | Versioning sibling               |
+| `aws:s3:bucket`         | `aws_s3_bucket_server_side_encryption_configuration` | SSE config sibling |
+
+For L2 modules, list the L1 modules composed via `module` blocks in
+`terraform/main.tf` instead.
+
+## Inputs
+
+Mirror `interface.json` → `inputs`. Mark required inputs with **yes**.
+
+| Name           | Type    | Required | Default       | Description                       |
+|----------------|---------|----------|---------------|-----------------------------------|
+| `bucket_name`  | string  | yes      | —             | Globally-unique S3 bucket name    |
+| `region`       | string  | yes      | —             | AWS region                        |
+| `kms_key_arn`  | string  | no       | `null`        | CMK ARN for SSE-KMS               |
+| `enabled`      | boolean | no       | `true`        | Feature flag                      |
+| `tags`         | map     | no       | `{}`          | Tags merged with module defaults  |
+
+## Outputs
+
+Mirror `interface.json` → `outputs`.
+
+| Name                            | Type   | Description                                  |
+|---------------------------------|--------|----------------------------------------------|
+| `bucket_arn`                    | arn    | The S3 bucket ARN                            |
+| `bucket_name`                   | string | The bucket name                              |
+| `bucket_regional_domain_name`   | string | The bucket regional domain name              |
+
+## Usage
+
+```hcl
+module "bucket" {
+  source = "modules/l1/s3/terraform"
+
+  bucket_name = "nova-prod-assets"
+  region      = "us-east-1"
+
+  tags = {
+    "nova:owner"       = "team-platform"
+    "nova:environment" = "prod"
+  }
+}
+```
+
+Or as a flat-stack contract entry:
+
+```json
+{
+  "module": "s3",
+  "version": "1.0.0",
+  "inputs": {
+    "bucket_name": "nova-prod-assets",
+    "region": "us-east-1"
+  }
+}
+```
+
+## Versioning
+
+This module follows the registry semver contract: bump the patch/minor
+version in `interface.json` and `modules/registry.json` for any
+input/output/behavior change. Breaking changes (renamed inputs,
+removed outputs, changed defaults) require a major bump and a new
+registry entry; the previous version is marked `deprecated: true` and
+remains selectable by pinned contracts. See `modules/README.md` for
+the registry format and the resolver's version-selection rules.
+
+<!-- DROP: NFRs — out of scope for nova v1 (D-029) -->
+<!-- DROP: Compliance / attestation — out of scope for nova v1 (D-029) -->
@@ -0,0 +1,127 @@
+# Nova Modules
+
+Nova ships a two-tier module library. Modules are **engine-agnostic**:
+their contract is declared in `interface.json` (stack types like
+`aws:s3:bucket`), and an adapter translates the contract to a concrete
+IaC engine (Terraform today; Pulumi/CDK possible later). All L1 modules
+in this repo ship a Terraform adapter under `terraform/`.
+
+## L1 vs L2
+
+| Tier | What it is                                                                 | Composes            | Examples                          |
+|------|----------------------------------------------------------------------------|---------------------|-----------------------------------|
+| L1   | A single primitive resource (or tightly-coupled resource group) on a cloud | One stack resource  | `s3`, `vpc`, `ecs-cluster`, `alb` |
+| L2   | A composition of L1s expressing an architectural pattern                   | Multiple L1 modules | `microservice`, `static-assets`   |
+
+- **L1** = one entry in the flat stack. Even multi-resource L1s (e.g.
+  `vpc`, `ecs-service`, `alb`) emit a single stack entry; their
+  `interface.json` lists the child resources in a `resources[]` array
+  for documentation, but the resolver does **not** expand them
+  (D-012).
+- **L2** = also one opaque entry in the flat stack. The L2's
+  `terraform/main.tf` composes L1 modules internally via `module` blocks
+  (D-012). The L2 exposes its own L2-level `inputs`/`outputs`; children
+  and wiring live in terraform, not in the interface.
+
+## Registry format
+
+`modules/registry.json` maps `module_name -> version -> entry`:
+
+```json
+{
+  "s3": {
+    "1.0.0": {
+      "interface": "modules/l1/s3/interface.json",
+      "terraform_dir": "modules/l1/s3/terraform",
+      "published_at": "2026-08-20T00:00:00Z",
+      "deprecated": false,
+      "kind": "l1"
+    }
+  }
+}
+```
+
+- `interface` — path to the `interface.json` declaring the contract.
+- `terraform_dir` — path to the adapter's Terraform module directory
+  (the flat stack's `source` field).
+- `kind` — `"l1"` or `"l2"`.
+- `deprecated` — when `true`, the resolver warns and selects the latest
+  non-deprecated version unless the caller pins a version.
+
+## interface.json shape (D-014)
+
+```json
+{
+  "name": "s3",
+  "version": "1.0.0",
+  "kind": "l1",
+  "type": "aws:s3:bucket",
+  "description": "...",
+  "inputs":  { "<name>": { "type": "...", "required": true, "description": "..." } },
+  "outputs": { "<name>": { "type": "...", "description": "..." } },
+  "resources": [ { "type": "aws:ec2:vpc", "inputs": [...], "outputs": [...] } ]
+}
+```
+
+- `type` is **stack-typed** — `aws:<service>:<resource>` (e.g.
+  `aws:s3:bucket`), **not** the Terraform resource name
+  (`aws_s3_bucket`). The adapter performs the translation.
+- `resources[]` is present only on multi-resource L1s (`vpc`,
+  `ecs-service`, `alb`); it documents the child stack types but does not
+  drive resolution.
+- **Dropped** per D-014: `nfrs` (confidence signal, out of scope) and
+  `intra_refs` (wire engine, eliminated by D-012). Do not re-add them.
+
+## Conventions shared by all L1 Terraform adapters
+
+- `terraform/versions.tf` pins `required_version = ">= 1.9, < 1.10"` and
+  `aws ~> 5.0`.
+- Every resource is guarded by `count = var.enabled ? 1 : 0`; the
+  `enabled` input defaults to `true`.
+- `locals.tf` merges module-default tags with caller-supplied `var.tags`:
+  ```hcl
+  tags = merge({ "nova:owner" = "nova", "nova:environment" = "dev" }, var.tags)
+  ```
+- Every `interface.json` input has a matching `variable` block; every
+  output has a matching `output` block. Outputs return `null` (or `[]`)
+  when `enabled = false`.
+
+## How to add a module
+
+1. Pick the tier. New primitive → L1. New pattern composing existing
+   L1s → L2.
+2. Create `modules/l1/<name>/` (or `modules/l2/<name>/`).
+3. Author `interface.json` (L1) or `interface.json` + L2 terraform that
+   composes L1s via `module` blocks. Use `modules/README-TEMPLATE.md`
+   as the per-module doc template.
+4. Author `terraform/{main,variables,outputs,versions,locals}.tf`
+   following the conventions above.
+5. Add an entry to `modules/registry.json` and a row to the catalog at
+   `docs/modules/index.md`.
+6. Verify: `python3 -c "import json; json.load(open('modules/l1/<name>/interface.json'))"`
+   and `terraform validate` inside `terraform/`.
+
+## L1 primitives (13)
+
+| Module          | Stack type                    | Multi-resource? | Description                                              |
+|-----------------|-------------------------------|-----------------|----------------------------------------------------------|
+| `s3`            | `aws:s3:bucket`               | no              | S3 bucket with versioning + SSE-KMS                      |
+| `vpc`           | `aws:ec2:vpc`                 | yes             | VPC + subnets + route table + IGW                        |
+| `ecs-cluster`   | `aws:ecs:cluster`             | no              | ECS cluster                                              |
+| `ecs-service`   | `aws:ecs:service`             | yes             | ECS task definition + service                            |
+| `iam-role`      | `aws:iam:role`                | no              | IAM role with assume-role policy                         |
+| `alb`           | `aws:alb`                     | yes             | ALB + target group + listener                            |
+| `ecr`           | `aws:ecr:repository`          | no              | ECR repository with scan-on-push                         |
+| `cloudfront`    | `aws:cloudfront:distribution` | no              | CloudFront distribution with a single origin             |
+| `waf`           | `aws:waf:web_acl`             | no              | WAFv2 web ACL (regional, default allow)                  |
+| `rds`           | `aws:rds:instance`            | no              | RDS Postgres DB instance                                 |
+| `kms-key`       | `aws:kms:key`                 | no              | KMS CMK with alias                                       |
+| `dynamodb`      | `aws:dynamodb:table`          | no              | DynamoDB table (PAY_PER_REQUEST default)                 |
+| `uptime`        | `aws:uptime:monitor`          | no              | Uptime monitor (CloudWatch alarm stand-in)               |
+
+## L2 compositions (2)
+
+| Module           | Composes                                  | Description                                  |
+|------------------|-------------------------------------------|----------------------------------------------|
+| `microservice`   | vpc + ecs-cluster + ecs-service + alb + ecr | Container microservice with public ALB     |
+| `static-assets`  | s3 + cloudfront                            | Static site fronted by CloudFront            |
@@ -0,0 +1,3 @@
+# L1: alb
+
+Application Load Balancer primitive (multi-resource: LB + target group + listener; stack type `aws:alb`). See `interface.json` for the full contract and `README-TEMPLATE.md` for the canonical section layout.
@@ -0,0 +1,68 @@
+{
+  "name": "alb",
+  "version": "1.0.0",
+  "kind": "l1",
+  "type": "aws:alb",
+  "description": "Application Load Balancer primitive (multi-resource: LB + target group + listener). Engine-agnostic stack types aws:alb + aws:alb:targetgroup + aws:alb:listener; the Terraform adapter translates to aws_lb/aws_lb_target_group/aws_lb_listener.",
+  "inputs": {
+    "lb_name": {
+      "type": "string",
+      "description": "Name of the load balancer.",
+      "required": true
+    },
+    "subnet_ids": {
+      "type": "list",
+      "description": "List of subnet ids the LB is deployed into.",
+      "required": true
+    },
+    "target_group_port": {
+      "type": "integer",
+      "default": 80,
+      "description": "Port the target group forwards to."
+    },
+    "enabled": {
+      "type": "boolean",
+      "default": true,
+      "description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
+    },
+    "tags": {
+      "type": "map",
+      "default": {},
+      "description": "Additional tags to merge with the module defaults."
+    }
+  },
+  "outputs": {
+    "lb_arn": {
+      "type": "arn",
+      "description": "The load balancer ARN."
+    },
+    "dns_name": {
+      "type": "string",
+      "description": "The load balancer DNS name."
+    },
+    "target_group_arn": {
+      "type": "arn",
+      "description": "The target group ARN."
+    }
+  },
+  "resources": [
+    {
+      "type": "aws:alb",
+      "description": "The Application Load Balancer.",
+      "inputs": ["lb_name", "subnet_ids"],
+      "outputs": ["lb_arn", "dns_name"]
+    },
+    {
+      "type": "aws:alb:targetgroup",
+      "description": "Target group on the LB port.",
+      "inputs": ["lb_name", "target_group_port"],
+      "outputs": ["target_group_arn"]
+    },
+    {
+      "type": "aws:alb:listener",
+      "description": "Listener forwarding to the target group.",
+      "inputs": ["target_group_port", "target_group_arn"],
+      "outputs": []
+    }
+  ]
+}
@@ -0,0 +1,16 @@
+locals {
+  tags = merge(
+    {
+      "nova:owner"       = "nova"
+      "nova:environment" = "dev"
+    },
+    var.tags,
+  )
+
+  # Target group requires a vpc_id. The L1 interface does not expose it as
+  # an input by design (kept minimal per D-014); the caller is expected to
+  # supply subnets in a single VPC. When a vpc_id input is added later, this
+  # local can be removed. For now, null forces the caller to set it via a
+  # provider-level default or an extension.
+  vpc_id = null
+}
@@ -0,0 +1,36 @@
+resource "aws_lb" "this" {
+  count               = var.enabled ? 1 : 0
+  name                = var.lb_name
+  load_balancer_type  = "application"
+  subnets             = var.subnet_ids
+  tags                = local.tags
+}
+
+resource "aws_lb_target_group" "this" {
+  count       = var.enabled ? 1 : 0
+  name_prefix = "${var.lb_name}-"
+  port        = var.target_group_port
+  protocol    = "HTTP"
+  target_type = "ip"
+  vpc_id      = local.vpc_id
+
+  lifecycle {
+    create_before_destroy = true
+  }
+
+  tags = local.tags
+}
+
+resource "aws_lb_listener" "this" {
+  count             = var.enabled ? 1 : 0
+  load_balancer_arn = aws_lb.this[0].id
+  port              = var.target_group_port
+  protocol          = "HTTP"
+
+  default_action {
+    type             = "forward"
+    target_group_arn = aws_lb_target_group.this[0].arn
+  }
+
+  depends_on = [aws_lb_target_group.this]
+}
@@ -0,0 +1,14 @@
+output "lb_arn" {
+  value       = var.enabled ? aws_lb.this[0].arn : null
+  description = "The load balancer ARN."
+}
+
+output "dns_name" {
+  value       = var.enabled ? aws_lb.this[0].dns_name : null
+  description = "The load balancer DNS name."
+}
+
+output "target_group_arn" {
+  value       = var.enabled ? aws_lb_target_group.this[0].arn : null
+  description = "The target group ARN."
+}
@@ -0,0 +1,27 @@
+variable "lb_name" {
+  type        = string
+  description = "Name of the load balancer."
+}
+
+variable "subnet_ids" {
+  type        = list(string)
+  description = "List of subnet ids the LB is deployed into."
+}
+
+variable "target_group_port" {
+  type        = number
+  description = "Port the target group forwards to."
+  default     = 80
+}
+
+variable "tags" {
+  type        = map(string)
+  description = "Additional tags to merge with the module defaults."
+  default     = {}
+}
+
+variable "enabled" {
+  type        = bool
+  description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
+  default     = true
+}
@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.9, < 1.10"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}
@@ -0,0 +1,3 @@
+# L1: cloudfront
+
+CloudFront distribution primitive (stack type `aws:cloudfront:distribution`). See `interface.json` for the full contract and `README-TEMPLATE.md` for the canonical section layout.
@@ -0,0 +1,39 @@
+{
+  "name": "cloudfront",
+  "version": "1.0.0",
+  "kind": "l1",
+  "type": "aws:cloudfront:distribution",
+  "description": "CloudFront distribution primitive (engine-agnostic stack type aws:cloudfront:distribution; the Terraform adapter translates to aws_cloudfront_distribution).",
+  "inputs": {
+    "distribution_name": {
+      "type": "string",
+      "description": "Name (comment) of the CloudFront distribution.",
+      "required": true
+    },
+    "origin_domain": {
+      "type": "string",
+      "description": "Domain name of the origin (e.g. an S3 bucket regional domain or ALB DNS).",
+      "required": true
+    },
+    "enabled": {
+      "type": "boolean",
+      "default": true,
+      "description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
+    },
+    "tags": {
+      "type": "map",
+      "default": {},
+      "description": "Additional tags to merge with the module defaults."
+    }
+  },
+  "outputs": {
+    "distribution_arn": {
+      "type": "arn",
+      "description": "The CloudFront distribution ARN."
+    },
+    "domain_name": {
+      "type": "string",
+      "description": "The CloudFront distribution domain name."
+    }
+  }
+}
@@ -0,0 +1,11 @@
+locals {
+  tags = merge(
+    {
+      "nova:owner"       = "nova"
+      "nova:environment" = "dev"
+    },
+    var.tags,
+  )
+
+  origin_id = "${var.distribution_name}-origin"
+}
@@ -0,0 +1,41 @@
+resource "aws_cloudfront_distribution" "this" {
+  count       = var.enabled ? 1 : 0
+  comment     = var.distribution_name
+  enabled     = true
+  price_class = "PriceClass_100"
+  tags        = local.tags
+
+  origin {
+    domain_name = var.origin_domain
+    origin_id   = local.origin_id
+  }
+
+  default_cache_behavior {
+    allowed_methods  = ["GET", "HEAD", "OPTIONS"]
+    cached_methods   = ["GET", "HEAD"]
+    target_origin_id = local.origin_id
+
+    forwarded_values {
+      query_string = false
+
+      cookies {
+        forward = "none"
+      }
+    }
+
+    viewer_protocol_policy = "redirect-to-https"
+    min_ttl                = 0
+    default_ttl            = 3600
+    max_ttl                = 86400
+  }
+
+  restrictions {
+    geo_restriction {
+      restriction_type = "none"
+    }
+  }
+
+  viewer_certificate {
+    cloudfront_default_certificate = true
+  }
+}
@@ -0,0 +1,9 @@
+output "distribution_arn" {
+  value       = var.enabled ? aws_cloudfront_distribution.this[0].arn : null
+  description = "The CloudFront distribution ARN."
+}
+
+output "domain_name" {
+  value       = var.enabled ? aws_cloudfront_distribution.this[0].domain_name : null
+  description = "The CloudFront distribution domain name."
+}
@@ -0,0 +1,21 @@
+variable "distribution_name" {
+  type        = string
+  description = "Name (comment) of the CloudFront distribution."
+}
+
+variable "origin_domain" {
+  type        = string
+  description = "Domain name of the origin (e.g. an S3 bucket regional domain or ALB DNS)."
+}
+
+variable "tags" {
+  type        = map(string)
+  description = "Additional tags to merge with the module defaults."
+  default     = {}
+}
+
+variable "enabled" {
+  type        = bool
+  description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
+  default     = true
+}
@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.9, < 1.10"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}
@@ -0,0 +1,3 @@
+# L1: dynamodb
+
+DynamoDB table primitive (stack type `aws:dynamodb:table`). See `interface.json` for the full contract and `README-TEMPLATE.md` for the canonical section layout.
@@ -0,0 +1,44 @@
+{
+  "name": "dynamodb",
+  "version": "1.0.0",
+  "kind": "l1",
+  "type": "aws:dynamodb:table",
+  "description": "DynamoDB table primitive (engine-agnostic stack type aws:dynamodb:table; the Terraform adapter translates to aws_dynamodb_table).",
+  "inputs": {
+    "table_name": {
+      "type": "string",
+      "description": "Name of the DynamoDB table.",
+      "required": true
+    },
+    "hash_key": {
+      "type": "string",
+      "description": "Name of the partition (hash) key.",
+      "required": true
+    },
+    "billing_mode": {
+      "type": "string",
+      "default": "PAY_PER_REQUEST",
+      "description": "Billing mode: PAY_PER_REQUEST or PROVISIONED."
+    },
+    "enabled": {
+      "type": "boolean",
+      "default": true,
+      "description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
+    },
+    "tags": {
+      "type": "map",
+      "default": {},
+      "description": "Additional tags to merge with the module defaults."
+    }
+  },
+  "outputs": {
+    "table_arn": {
+      "type": "arn",
+      "description": "The DynamoDB table ARN."
+    },
+    "table_name": {
+      "type": "string",
+      "description": "The DynamoDB table name (echoes the input)."
+    }
+  }
+}
@@ -0,0 +1,9 @@
+locals {
+  tags = merge(
+    {
+      "nova:owner"       = "nova"
+      "nova:environment" = "dev"
+    },
+    var.tags,
+  )
+}
@@ -0,0 +1,12 @@
+resource "aws_dynamodb_table" "this" {
+  count        = var.enabled ? 1 : 0
+  name         = var.table_name
+  billing_mode = var.billing_mode
+  hash_key     = var.hash_key
+  tags         = local.tags
+
+  attribute {
+    name = var.hash_key
+    type = "S"
+  }
+}
@@ -0,0 +1,9 @@
+output "table_arn" {
+  value       = var.enabled ? aws_dynamodb_table.this[0].arn : null
+  description = "The DynamoDB table ARN."
+}
+
+output "table_name" {
+  value       = var.enabled ? aws_dynamodb_table.this[0].name : null
+  description = "The DynamoDB table name (echoes the input)."
+}
@@ -0,0 +1,27 @@
+variable "table_name" {
+  type        = string
+  description = "Name of the DynamoDB table."
+}
+
+variable "hash_key" {
+  type        = string
+  description = "Name of the partition (hash) key."
+}
+
+variable "billing_mode" {
+  type        = string
+  description = "Billing mode: PAY_PER_REQUEST or PROVISIONED."
+  default     = "PAY_PER_REQUEST"
+}
+
+variable "tags" {
+  type        = map(string)
+  description = "Additional tags to merge with the module defaults."
+  default     = {}
+}
+
+variable "enabled" {
+  type        = bool
+  description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
+  default     = true
+}
@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.9, < 1.10"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}
@@ -0,0 +1,3 @@
+# L1: ecr
+
+ECR repository primitive (stack type `aws:ecr:repository`). See `interface.json` for the full contract and `README-TEMPLATE.md` for the canonical section layout.
@@ -0,0 +1,34 @@
+{
+  "name": "ecr",
+  "version": "1.0.0",
+  "kind": "l1",
+  "type": "aws:ecr:repository",
+  "description": "ECR repository primitive (engine-agnostic stack type aws:ecr:repository; the Terraform adapter translates to aws_ecr_repository).",
+  "inputs": {
+    "repository_name": {
+      "type": "string",
+      "description": "Name of the ECR repository.",
+      "required": true
+    },
+    "enabled": {
+      "type": "boolean",
+      "default": true,
+      "description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
+    },
+    "tags": {
+      "type": "map",
+      "default": {},
+      "description": "Additional tags to merge with the module defaults."
+    }
+  },
+  "outputs": {
+    "repository_url": {
+      "type": "string",
+      "description": "The ECR repository URL."
+    },
+    "repository_arn": {
+      "type": "arn",
+      "description": "The ECR repository ARN."
+    }
+  }
+}
@@ -0,0 +1,9 @@
+locals {
+  tags = merge(
+    {
+      "nova:owner"       = "nova"
+      "nova:environment" = "dev"
+    },
+    var.tags,
+  )
+}
@@ -0,0 +1,10 @@
+resource "aws_ecr_repository" "this" {
+  count                = var.enabled ? 1 : 0
+  name                 = var.repository_name
+  image_tag_mutability = "MUTABLE"
+  tags                 = local.tags
+
+  image_scanning_configuration {
+    scan_on_push = true
+  }
+}
@@ -0,0 +1,9 @@
+output "repository_url" {
+  value       = var.enabled ? aws_ecr_repository.this[0].repository_url : null
+  description = "The ECR repository URL."
+}
+
+output "repository_arn" {
+  value       = var.enabled ? aws_ecr_repository.this[0].arn : null
+  description = "The ECR repository ARN."
+}
@@ -0,0 +1,16 @@
+variable "repository_name" {
+  type        = string
+  description = "Name of the ECR repository."
+}
+
+variable "tags" {
+  type        = map(string)
+  description = "Additional tags to merge with the module defaults."
+  default     = {}
+}
+
+variable "enabled" {
+  type        = bool
+  description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
+  default     = true
+}
@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.9, < 1.10"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}
@@ -0,0 +1,3 @@
+# L1: ecs-cluster
+
+ECS cluster primitive (stack type `aws:ecs:cluster`). See `interface.json` for the full contract and `README-TEMPLATE.md` for the canonical section layout.
@@ -0,0 +1,34 @@
+{
+  "name": "ecs-cluster",
+  "version": "1.0.0",
+  "kind": "l1",
+  "type": "aws:ecs:cluster",
+  "description": "ECS cluster primitive (engine-agnostic stack type aws:ecs:cluster; the Terraform adapter translates to aws_ecs_cluster).",
+  "inputs": {
+    "cluster_name": {
+      "type": "string",
+      "description": "Name of the ECS cluster.",
+      "required": true
+    },
+    "enabled": {
+      "type": "boolean",
+      "default": true,
+      "description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
+    },
+    "tags": {
+      "type": "map",
+      "default": {},
+      "description": "Additional tags to merge with the module defaults."
+    }
+  },
+  "outputs": {
+    "cluster_arn": {
+      "type": "arn",
+      "description": "The ECS cluster ARN."
+    },
+    "cluster_name": {
+      "type": "string",
+      "description": "The ECS cluster name (echoes the input)."
+    }
+  }
+}
@@ -0,0 +1,9 @@
+locals {
+  tags = merge(
+    {
+      "nova:owner"       = "nova"
+      "nova:environment" = "dev"
+    },
+    var.tags,
+  )
+}
@@ -0,0 +1,5 @@
+resource "aws_ecs_cluster" "this" {
+  count = var.enabled ? 1 : 0
+  name  = var.cluster_name
+  tags  = local.tags
+}
@@ -0,0 +1,9 @@
+output "cluster_arn" {
+  value       = var.enabled ? aws_ecs_cluster.this[0].arn : null
+  description = "The ECS cluster ARN."
+}
+
+output "cluster_name" {
+  value       = var.enabled ? aws_ecs_cluster.this[0].name : null
+  description = "The ECS cluster name (echoes the input)."
+}
@@ -0,0 +1,16 @@
+variable "cluster_name" {
+  type        = string
+  description = "Name of the ECS cluster."
+}
+
+variable "tags" {
+  type        = map(string)
+  description = "Additional tags to merge with the module defaults."
+  default     = {}
+}
+
+variable "enabled" {
+  type        = bool
+  description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
+  default     = true
+}
@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.9, < 1.10"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}
@@ -0,0 +1,3 @@
+# L1: ecs-service
+
+ECS service primitive (multi-resource: task definition + service; stack type `aws:ecs:service`). See `interface.json` for the full contract and `README-TEMPLATE.md` for the canonical section layout.
@@ -0,0 +1,63 @@
+{
+  "name": "ecs-service",
+  "version": "1.0.0",
+  "kind": "l1",
+  "type": "aws:ecs:service",
+  "description": "ECS service primitive (multi-resource: task definition + service). Engine-agnostic stack types aws:ecs:taskdef + aws:ecs:service; the Terraform adapter translates to aws_ecs_task_definition/aws_ecs_service.",
+  "inputs": {
+    "service_name": {
+      "type": "string",
+      "description": "Name of the ECS service (also used as the task definition family).",
+      "required": true
+    },
+    "cluster_arn": {
+      "type": "arn",
+      "description": "ARN of the ECS cluster the service runs in.",
+      "required": true
+    },
+    "task_definition": {
+      "type": "string",
+      "description": "Task definition ARN or family:revision to run. If supplied as a path/string JSON, the module creates an aws_ecs_task_definition.",
+      "required": true
+    },
+    "desired_count": {
+      "type": "integer",
+      "default": 1,
+      "description": "Number of tasks to run."
+    },
+    "enabled": {
+      "type": "boolean",
+      "default": true,
+      "description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
+    },
+    "tags": {
+      "type": "map",
+      "default": {},
+      "description": "Additional tags to merge with the module defaults."
+    }
+  },
+  "outputs": {
+    "service_arn": {
+      "type": "arn",
+      "description": "The ECS service ARN."
+    },
+    "service_name": {
+      "type": "string",
+      "description": "The ECS service name (echoes the input)."
+    }
+  },
+  "resources": [
+    {
+      "type": "aws:ecs:taskdef",
+      "description": "The ECS task definition (registered from task_definition input).",
+      "inputs": ["service_name", "task_definition"],
+      "outputs": []
+    },
+    {
+      "type": "aws:ecs:service",
+      "description": "The ECS service running the task definition on the cluster.",
+      "inputs": ["service_name", "cluster_arn", "desired_count"],
+      "outputs": ["service_arn", "service_name"]
+    }
+  ]
+}
@@ -0,0 +1,9 @@
+locals {
+  tags = merge(
+    {
+      "nova:owner"       = "nova"
+      "nova:environment" = "dev"
+    },
+    var.tags,
+  )
+}
@@ -0,0 +1,15 @@
+resource "aws_ecs_task_definition" "this" {
+  count             = var.enabled ? 1 : 0
+  family            = var.service_name
+  container_definitions = var.task_definition
+  tags              = local.tags
+}
+
+resource "aws_ecs_service" "this" {
+  count           = var.enabled ? 1 : 0
+  name            = var.service_name
+  cluster         = var.cluster_arn
+  task_definition = aws_ecs_task_definition.this[0].arn
+  desired_count   = var.desired_count
+  tags            = local.tags
+}
@@ -0,0 +1,9 @@
+output "service_arn" {
+  value       = var.enabled ? aws_ecs_service.this[0].id : null
+  description = "The ECS service ARN."
+}
+
+output "service_name" {
+  value       = var.enabled ? aws_ecs_service.this[0].name : null
+  description = "The ECS service name (echoes the input)."
+}
@@ -0,0 +1,32 @@
+variable "service_name" {
+  type        = string
+  description = "Name of the ECS service (also used as the task definition family)."
+}
+
+variable "cluster_arn" {
+  type        = string
+  description = "ARN of the ECS cluster the service runs in."
+}
+
+variable "task_definition" {
+  type        = string
+  description = "Task definition JSON string (container definitions). The module registers an aws_ecs_task_definition with family = service_name."
+}
+
+variable "desired_count" {
+  type        = number
+  description = "Number of tasks to run."
+  default     = 1
+}
+
+variable "tags" {
+  type        = map(string)
+  description = "Additional tags to merge with the module defaults."
+  default     = {}
+}
+
+variable "enabled" {
+  type        = bool
+  description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
+  default     = true
+}
@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.9, < 1.10"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}
@@ -0,0 +1,3 @@
+# L1: iam-role
+
+IAM role primitive (stack type `aws:iam:role`). See `interface.json` for the full contract and `README-TEMPLATE.md` for the canonical section layout.
@@ -0,0 +1,39 @@
+{
+  "name": "iam-role",
+  "version": "1.0.0",
+  "kind": "l1",
+  "type": "aws:iam:role",
+  "description": "IAM role primitive (engine-agnostic stack type aws:iam:role; the Terraform adapter translates to aws_iam_role).",
+  "inputs": {
+    "role_name": {
+      "type": "string",
+      "description": "Name of the IAM role.",
+      "required": true
+    },
+    "policy_document": {
+      "type": "string",
+      "description": "Assume-role policy document JSON string.",
+      "required": true
+    },
+    "enabled": {
+      "type": "boolean",
+      "default": true,
+      "description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
+    },
+    "tags": {
+      "type": "map",
+      "default": {},
+      "description": "Additional tags to merge with the module defaults."
+    }
+  },
+  "outputs": {
+    "role_arn": {
+      "type": "arn",
+      "description": "The IAM role ARN."
+    },
+    "role_name": {
+      "type": "string",
+      "description": "The IAM role name (echoes the input)."
+    }
+  }
+}
@@ -0,0 +1,9 @@
+locals {
+  tags = merge(
+    {
+      "nova:owner"       = "nova"
+      "nova:environment" = "dev"
+    },
+    var.tags,
+  )
+}
@@ -0,0 +1,6 @@
+resource "aws_iam_role" "this" {
+  count            = var.enabled ? 1 : 0
+  name             = var.role_name
+  assume_role_policy = var.policy_document
+  tags             = local.tags
+}
@@ -0,0 +1,9 @@
+output "role_arn" {
+  value       = var.enabled ? aws_iam_role.this[0].arn : null
+  description = "The IAM role ARN."
+}
+
+output "role_name" {
+  value       = var.enabled ? aws_iam_role.this[0].name : null
+  description = "The IAM role name (echoes the input)."
+}
@@ -0,0 +1,21 @@
+variable "role_name" {
+  type        = string
+  description = "Name of the IAM role."
+}
+
+variable "policy_document" {
+  type        = string
+  description = "Assume-role policy document JSON string."
+}
+
+variable "tags" {
+  type        = map(string)
+  description = "Additional tags to merge with the module defaults."
+  default     = {}
+}
+
+variable "enabled" {
+  type        = bool
+  description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
+  default     = true
+}
@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.9, < 1.10"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}
@@ -0,0 +1,3 @@
+# L1: kms-key
+
+KMS customer master key primitive (stack type `aws:kms:key`). See `interface.json` for the full contract and `README-TEMPLATE.md` for the canonical section layout.
@@ -0,0 +1,34 @@
+{
+  "name": "kms-key",
+  "version": "1.0.0",
+  "kind": "l1",
+  "type": "aws:kms:key",
+  "description": "KMS customer master key primitive (engine-agnostic stack type aws:kms:key; the Terraform adapter translates to aws_kms_key).",
+  "inputs": {
+    "key_name": {
+      "type": "string",
+      "description": "Name (alias) of the KMS key.",
+      "required": true
+    },
+    "enabled": {
+      "type": "boolean",
+      "default": true,
+      "description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
+    },
+    "tags": {
+      "type": "map",
+      "default": {},
+      "description": "Additional tags to merge with the module defaults."
+    }
+  },
+  "outputs": {
+    "key_arn": {
+      "type": "arn",
+      "description": "The KMS key ARN."
+    },
+    "key_id": {
+      "type": "string",
+      "description": "The KMS key id."
+    }
+  }
+}
@@ -0,0 +1,9 @@
+locals {
+  tags = merge(
+    {
+      "nova:owner"       = "nova"
+      "nova:environment" = "dev"
+    },
+    var.tags,
+  )
+}
@@ -0,0 +1,12 @@
+resource "aws_kms_key" "this" {
+  count           = var.enabled ? 1 : 0
+  description     = "KMS key managed by nova L1 kms-key primitive."
+  deletion_window_in_days = 30
+  tags            = local.tags
+}
+
+resource "aws_kms_alias" "this" {
+  count         = var.enabled ? 1 : 0
+  name          = "alias/${var.key_name}"
+  target_key_id = aws_kms_key.this[0].key_id
+}
@@ -0,0 +1,9 @@
+output "key_arn" {
+  value       = var.enabled ? aws_kms_key.this[0].arn : null
+  description = "The KMS key ARN."
+}
+
+output "key_id" {
+  value       = var.enabled ? aws_kms_key.this[0].key_id : null
+  description = "The KMS key id."
+}
@@ -0,0 +1,16 @@
+variable "key_name" {
+  type        = string
+  description = "Name (alias) of the KMS key."
+}
+
+variable "tags" {
+  type        = map(string)
+  description = "Additional tags to merge with the module defaults."
+  default     = {}
+}
+
+variable "enabled" {
+  type        = bool
+  description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
+  default     = true
+}
@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.9, < 1.10"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}
@@ -0,0 +1,3 @@
+# L1: rds
+
+RDS DB instance primitive (stack type `aws:rds:instance`). See `interface.json` for the full contract and `README-TEMPLATE.md` for the canonical section layout.
@@ -0,0 +1,44 @@
+{
+  "name": "rds",
+  "version": "1.0.0",
+  "kind": "l1",
+  "type": "aws:rds:instance",
+  "description": "RDS DB instance primitive (engine-agnostic stack type aws:rds:instance; the Terraform adapter translates to aws_db_instance).",
+  "inputs": {
+    "instance_name": {
+      "type": "string",
+      "description": "Name (identifier) of the RDS DB instance.",
+      "required": true
+    },
+    "instance_class": {
+      "type": "string",
+      "default": "db.t3.micro",
+      "description": "DB instance class."
+    },
+    "allocated_storage": {
+      "type": "integer",
+      "default": 20,
+      "description": "Allocated storage in GiB."
+    },
+    "enabled": {
+      "type": "boolean",
+      "default": true,
+      "description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
+    },
+    "tags": {
+      "type": "map",
+      "default": {},
+      "description": "Additional tags to merge with the module defaults."
+    }
+  },
+  "outputs": {
+    "instance_endpoint": {
+      "type": "string",
+      "description": "The RDS DB instance endpoint (host:port)."
+    },
+    "instance_arn": {
+      "type": "arn",
+      "description": "The RDS DB instance ARN."
+    }
+  }
+}
@@ -0,0 +1,9 @@
+locals {
+  tags = merge(
+    {
+      "nova:owner"       = "nova"
+      "nova:environment" = "dev"
+    },
+    var.tags,
+  )
+}
@@ -0,0 +1,12 @@
+resource "aws_db_instance" "this" {
+  count             = var.enabled ? 1 : 0
+  identifier        = var.instance_name
+  instance_class    = var.instance_class
+  allocated_storage = var.allocated_storage
+  engine            = "postgres"
+  engine_version    = "14"
+  username          = "nova"
+  password          = "changeme-rotate-me"
+  skip_final_snapshot = true
+  tags              = local.tags
+}
@@ -0,0 +1,9 @@
+output "instance_endpoint" {
+  value       = var.enabled ? aws_db_instance.this[0].endpoint : null
+  description = "The RDS DB instance endpoint (host:port)."
+}
+
+output "instance_arn" {
+  value       = var.enabled ? aws_db_instance.this[0].arn : null
+  description = "The RDS DB instance ARN."
+}
@@ -0,0 +1,28 @@
+variable "instance_name" {
+  type        = string
+  description = "Name (identifier) of the RDS DB instance."
+}
+
+variable "instance_class" {
+  type        = string
+  description = "DB instance class."
+  default     = "db.t3.micro"
+}
+
+variable "allocated_storage" {
+  type        = number
+  description = "Allocated storage in GiB."
+  default     = 20
+}
+
+variable "tags" {
+  type        = map(string)
+  description = "Additional tags to merge with the module defaults."
+  default     = {}
+}
+
+variable "enabled" {
+  type        = bool
+  description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
+  default     = true
+}
@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.9, < 1.10"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}
@@ -0,0 +1,3 @@
+# L1: s3
+
+S3 bucket primitive (stack type `aws:s3:bucket`). See `interface.json` for the full contract and `README-TEMPLATE.md` for the canonical section layout.
@@ -0,0 +1,48 @@
+{
+  "name": "s3",
+  "version": "1.0.0",
+  "kind": "l1",
+  "type": "aws:s3:bucket",
+  "description": "S3 bucket primitive (engine-agnostic stack type aws:s3:bucket; the Terraform adapter translates to aws_s3_bucket).",
+  "inputs": {
+    "bucket_name": {
+      "type": "string",
+      "description": "Globally-unique S3 bucket name.",
+      "required": true
+    },
+    "region": {
+      "type": "string",
+      "description": "AWS region the bucket is created in (provider-level; not a resource arg).",
+      "required": true
+    },
+    "kms_key_arn": {
+      "type": "string",
+      "description": "ARN of the CMK for SSE-KMS; if absent, uses managed key (SSE-S3).",
+      "required": false
+    },
+    "enabled": {
+      "type": "boolean",
+      "default": true,
+      "description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
+    },
+    "tags": {
+      "type": "map",
+      "default": {},
+      "description": "Additional tags to merge with the module defaults."
+    }
+  },
+  "outputs": {
+    "bucket_arn": {
+      "type": "arn",
+      "description": "The S3 bucket ARN."
+    },
+    "bucket_name": {
+      "type": "string",
+      "description": "The bucket name (echoes the input)."
+    },
+    "bucket_regional_domain_name": {
+      "type": "string",
+      "description": "The bucket regional domain name (e.g. nova-bucket.s3.us-east-1.amazonaws.com)."
+    }
+  }
+}
@@ -0,0 +1,13 @@
+locals {
+  # SSE algorithm: KMS when a CMK ARN is supplied, else AES256 (SSE-S3).
+  sse_algorithm = var.kms_key_arn != null ? "aws:kms" : "AES256"
+
+  # Tags: merge caller-supplied tags with the module defaults.
+  tags = merge(
+    {
+      "nova:owner"       = "nova"
+      "nova:environment" = "dev"
+    },
+    var.tags,
+  )
+}
@@ -0,0 +1,26 @@
+resource "aws_s3_bucket" "this" {
+  count  = var.enabled ? 1 : 0
+  bucket = var.bucket_name
+  tags   = local.tags
+}
+
+resource "aws_s3_bucket_versioning" "this" {
+  count  = var.enabled ? 1 : 0
+  bucket = aws_s3_bucket.this[0].id
+
+  versioning_configuration {
+    status = "Enabled"
+  }
+}
+
+resource "aws_s3_bucket_server_side_encryption_configuration" "this" {
+  count  = var.enabled ? 1 : 0
+  bucket = aws_s3_bucket.this[0].id
+
+  rule {
+    apply_server_side_encryption_by_default {
+      sse_algorithm     = local.sse_algorithm
+      kms_master_key_id = var.kms_key_arn
+    }
+  }
+}
@@ -0,0 +1,14 @@
+output "bucket_arn" {
+  value       = var.enabled ? aws_s3_bucket.this[0].arn : null
+  description = "The S3 bucket ARN."
+}
+
+output "bucket_name" {
+  value       = var.enabled ? aws_s3_bucket.this[0].id : null
+  description = "The bucket name (echoes the input)."
+}
+
+output "bucket_regional_domain_name" {
+  value       = var.enabled ? aws_s3_bucket.this[0].bucket_regional_domain_name : null
+  description = "The bucket regional domain name (e.g. nova-bucket.s3.us-east-1.amazonaws.com)."
+}
@@ -0,0 +1,28 @@
+variable "bucket_name" {
+  type        = string
+  description = "Globally-unique S3 bucket name."
+}
+
+variable "region" {
+  type        = string
+  description = "AWS region the bucket is created in (provider-level; not a resource arg)."
+  default     = null
+}
+
+variable "kms_key_arn" {
+  type        = string
+  description = "ARN of the CMK for SSE-KMS; if absent, uses managed key (SSE-S3)."
+  default     = null
+}
+
+variable "tags" {
+  type        = map(string)
+  description = "Additional tags to merge with the module defaults."
+  default     = {}
+}
+
+variable "enabled" {
+  type        = bool
+  description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
+  default     = true
+}
@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.9, < 1.10"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}
@@ -0,0 +1,3 @@
+# L1: uptime
+
+Uptime monitor primitive (simplified stand-in: a CloudWatch alarm; stack type `aws:uptime:monitor`). See `interface.json` for the full contract and `README-TEMPLATE.md` for the canonical section layout.
@@ -0,0 +1,35 @@
+{
+  "name": "uptime",
+  "version": "1.0.0",
+  "kind": "l1",
+  "type": "aws:uptime:monitor",
+  "description": "Uptime monitor primitive (simplified stand-in: a CloudWatch alarm watching the target resource). Engine-agnostic stack type aws:uptime:monitor; the Terraform adapter translates to aws_cloudwatch_metric_alarm.",
+  "inputs": {
+    "monitor_name": {
+      "type": "string",
+      "description": "Name of the uptime monitor (CloudWatch alarm).",
+      "required": true
+    },
+    "target_arn": {
+      "type": "arn",
+      "description": "ARN of the target resource being monitored.",
+      "required": true
+    },
+    "enabled": {
+      "type": "boolean",
+      "default": true,
+      "description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
+    },
+    "tags": {
+      "type": "map",
+      "default": {},
+      "description": "Additional tags to merge with the module defaults."
+    }
+  },
+  "outputs": {
+    "monitor_arn": {
+      "type": "arn",
+      "description": "The CloudWatch alarm ARN (stand-in for the monitor ARN)."
+    }
+  }
+}
@@ -0,0 +1,9 @@
+locals {
+  tags = merge(
+    {
+      "nova:owner"       = "nova"
+      "nova:environment" = "dev"
+    },
+    var.tags,
+  )
+}
@@ -0,0 +1,21 @@
+# Uptime monitor stand-in: a CloudWatch metric alarm referencing the
+# target resource ARN via dimensions. A future revision may swap this
+# for a Route 53 health check or CloudWatch composite alarm.
+resource "aws_cloudwatch_metric_alarm" "this" {
+  count           = var.enabled ? 1 : 0
+  alarm_name      = var.monitor_name
+  comparison_operator = "LessThanThreshold"
+  evaluation_periods  = 2
+  metric_name    = "RequestCount"
+  namespace      = "AWS/ApplicationELB"
+  period         = 60
+  statistic      = "Sum"
+  threshold      = 1
+  alarm_description = "Uptime monitor (CloudWatch alarm stand-in) for target ${var.target_arn}."
+
+  dimensions = {
+    LoadBalancer = var.target_arn
+  }
+
+  tags = local.tags
+}
@@ -0,0 +1,4 @@
+output "monitor_arn" {
+  value       = var.enabled ? aws_cloudwatch_metric_alarm.this[0].arn : null
+  description = "The CloudWatch alarm ARN (stand-in for the monitor ARN)."
+}
@@ -0,0 +1,21 @@
+variable "monitor_name" {
+  type        = string
+  description = "Name of the uptime monitor (CloudWatch alarm)."
+}
+
+variable "target_arn" {
+  type        = string
+  description = "ARN of the target resource being monitored."
+}
+
+variable "tags" {
+  type        = map(string)
+  description = "Additional tags to merge with the module defaults."
+  default     = {}
+}
+
+variable "enabled" {
+  type        = bool
+  description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
+  default     = true
+}
@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.9, < 1.10"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}
@@ -0,0 +1,3 @@
+# L1: vpc
+
+VPC primitive (multi-resource: VPC + subnets + route table + IGW; stack type `aws:ec2:vpc`). See `interface.json` for the full contract and `README-TEMPLATE.md` for the canonical section layout.
@@ -0,0 +1,69 @@
+{
+  "name": "vpc",
+  "version": "1.0.0",
+  "kind": "l1",
+  "type": "aws:ec2:vpc",
+  "description": "VPC primitive (multi-resource: VPC + subnets + route table + internet gateway). Engine-agnostic stack types aws:ec2:vpc + aws:ec2:subnet + aws:ec2:routetable + aws:ec2:igw; the Terraform adapter translates to aws_vpc/aws_subnet/aws_route_table/aws_internet_gateway.",
+  "inputs": {
+    "cidr": {
+      "type": "string",
+      "description": "VPC CIDR block, e.g. 10.0.0.0/16.",
+      "required": true
+    },
+    "azs": {
+      "type": "list",
+      "description": "List of availability zones, e.g. [\"us-east-1a\", \"us-east-1b\"]. One subnet is created per AZ.",
+      "required": true
+    },
+    "enabled": {
+      "type": "boolean",
+      "default": true,
+      "description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
+    },
+    "tags": {
+      "type": "map",
+      "default": {},
+      "description": "Additional tags to merge with the module defaults."
+    }
+  },
+  "outputs": {
+    "vpc_id": {
+      "type": "string",
+      "description": "The VPC id."
+    },
+    "subnet_ids": {
+      "type": "list",
+      "description": "List of subnet ids (one per AZ)."
+    },
+    "igw_id": {
+      "type": "string",
+      "description": "The internet gateway id."
+    }
+  },
+  "resources": [
+    {
+      "type": "aws:ec2:vpc",
+      "description": "The VPC itself.",
+      "inputs": ["cidr"],
+      "outputs": ["vpc_id"]
+    },
+    {
+      "type": "aws:ec2:subnet",
+      "description": "One subnet per availability zone (azs).",
+      "inputs": ["cidr", "az", "vpc_id"],
+      "outputs": ["subnet_ids"]
+    },
+    {
+      "type": "aws:ec2:routetable",
+      "description": "Route table bound to the VPC with a default route via the IGW.",
+      "inputs": ["vpc_id"],
+      "outputs": []
+    },
+    {
+      "type": "aws:ec2:igw",
+      "description": "Internet gateway attached to the VPC.",
+      "inputs": ["vpc_id"],
+      "outputs": ["igw_id"]
+    }
+  ]
+}
@@ -0,0 +1,16 @@
+locals {
+  # Tags: merge caller-supplied tags with the module defaults.
+  tags = merge(
+    {
+      "nova:owner"       = "nova"
+      "nova:environment" = "dev"
+    },
+    var.tags,
+  )
+
+  # Derive /24 subnet CIDRs from the VPC /16 by slicing the 3rd octet.
+  # Works for /16 VPC CIDRs; for other sizes the caller should pass
+  # pre-computed subnet CIDRs (future input).
+  vpc_octets   = split(".", cidrhost(var.cidr, 0))
+  subnet_cidrs = [for i in range(length(var.azs)) : "${local.vpc_octets[0]}.${local.vpc_octets[1]}.${i}.0/24"]
+}
@@ -0,0 +1,57 @@
+resource "aws_vpc" "this" {
+  count      = var.enabled ? 1 : 0
+  cidr_block = var.cidr
+  tags = merge(
+    {
+      Name = "nova-vpc"
+    },
+    local.tags,
+  )
+}
+
+resource "aws_subnet" "this" {
+  count             = var.enabled ? length(var.azs) : 0
+  vpc_id            = aws_vpc.this[0].id
+  cidr_block        = local.subnet_cidrs[count.index]
+  availability_zone = var.azs[count.index]
+  tags = merge(
+    {
+      Name = "nova-subnet-${count.index}"
+    },
+    local.tags,
+  )
+}
+
+resource "aws_internet_gateway" "this" {
+  count  = var.enabled ? 1 : 0
+  vpc_id = aws_vpc.this[0].id
+  tags = merge(
+    {
+      Name = "nova-igw"
+    },
+    local.tags,
+  )
+}
+
+resource "aws_route_table" "this" {
+  count  = var.enabled ? 1 : 0
+  vpc_id = aws_vpc.this[0].id
+
+  route {
+    cidr_block = "0.0.0.0/0"
+    gateway_id = aws_internet_gateway.this[0].id
+  }
+
+  tags = merge(
+    {
+      Name = "nova-rt"
+    },
+    local.tags,
+  )
+}
+
+resource "aws_route_table_association" "this" {
+  count          = var.enabled ? length(var.azs) : 0
+  subnet_id      = aws_subnet.this[count.index].id
+  route_table_id = aws_route_table.this[0].id
+}
@@ -0,0 +1,14 @@
+output "vpc_id" {
+  value       = var.enabled ? aws_vpc.this[0].id : null
+  description = "The VPC id."
+}
+
+output "subnet_ids" {
+  value       = var.enabled ? aws_subnet.this[*].id : []
+  description = "List of subnet ids (one per AZ)."
+}
+
+output "igw_id" {
+  value       = var.enabled ? aws_internet_gateway.this[0].id : null
+  description = "The internet gateway id."
+}
@@ -0,0 +1,21 @@
+variable "cidr" {
+  type        = string
+  description = "VPC CIDR block, e.g. 10.0.0.0/16."
+}
+
+variable "azs" {
+  type        = list(string)
+  description = "List of availability zones, e.g. [\"us-east-1a\", \"us-east-1b\"]. One subnet is created per AZ."
+}
+
+variable "tags" {
+  type        = map(string)
+  description = "Additional tags to merge with the module defaults."
+  default     = {}
+}
+
+variable "enabled" {
+  type        = bool
+  description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
+  default     = true
+}
@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.9, < 1.10"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}
@@ -0,0 +1,3 @@
+# L1: waf
+
+WAFv2 web ACL primitive (stack type `aws:waf:web_acl`). See `interface.json` for the full contract and `README-TEMPLATE.md` for the canonical section layout.
@@ -0,0 +1,34 @@
+{
+  "name": "waf",
+  "version": "1.0.0",
+  "kind": "l1",
+  "type": "aws:waf:web_acl",
+  "description": "WAFv2 web ACL primitive (engine-agnostic stack type aws:waf:web_acl; the Terraform adapter translates to aws_wafv2_web_acl).",
+  "inputs": {
+    "acl_name": {
+      "type": "string",
+      "description": "Name of the WAF web ACL.",
+      "required": true
+    },
+    "enabled": {
+      "type": "boolean",
+      "default": true,
+      "description": "Feature flag: enable/disable this module. Set to false to skip resource creation."
+    },
+    "tags": {
+      "type": "map",
+      "default": {},
+      "description": "Additional tags to merge with the module defaults."
+    }
+  },
+  "outputs": {
+    "acl_arn": {
+      "type": "arn",
+      "description": "The WAF web ACL ARN."
+    },
+    "acl_id": {
+      "type": "string",
+      "description": "The WAF web ACL id."
+    }
+  }
+}
@@ -0,0 +1,9 @@
+locals {
+  tags = merge(
+    {
+      "nova:owner"       = "nova"
+      "nova:environment" = "dev"
+    },
+    var.tags,
+  )
+}
@@ -0,0 +1,17 @@
+resource "aws_wafv2_web_acl" "this" {
+  count        = var.enabled ? 1 : 0
+  name         = var.acl_name
+  description  = "WAF web ACL managed by nova L1 waf primitive."
+  scope        = "REGIONAL"
+  default_action {
+    allow {}
+  }
+
+  visibility_config {
+    cloudwatch_metrics_enabled = true
+    metric_name                = var.acl_name
+    sampled_requests_enabled   = true
+  }
+
+  tags = local.tags
+}
@@ -0,0 +1,9 @@
+output "acl_arn" {
+  value       = var.enabled ? aws_wafv2_web_acl.this[0].arn : null
+  description = "The WAF web ACL ARN."
+}
+
+output "acl_id" {
+  value       = var.enabled ? aws_wafv2_web_acl.this[0].id : null
+  description = "The WAF web ACL id."
+}
@@ -0,0 +1,16 @@
+variable "acl_name" {
+  type        = string
+  description = "Name of the WAF web ACL."
+}
+
+variable "tags" {
+  type        = map(string)
+  description = "Additional tags to merge with the module defaults."
+  default     = {}
+}
+
+variable "enabled" {
+  type        = bool
+  description = "Feature flag: enable/disable this module. Set to false to skip resource creation."
+  default     = true
+}
@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.9, < 1.10"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}
@@ -0,0 +1,38 @@
+{
+  "name": "microservice",
+  "version": "1.0.0",
+  "kind": "l2",
+  "description": "ECS Fargate microservice pattern (opaque L2 per D-012). Composes six L1 primitives internally via terraform/main.tf module blocks: vpc + ecs-cluster + ecs-service + iam-role + ecr + alb (D-038). The L2 interface exposes a simplified, engine-agnostic input/output surface; the children/wires are NOT present in the interface (they live in the Terraform). The stack has a single resource entry for this module — the resolver does NOT expand children.",
+  "inputs": {
+    "service_name": {
+      "type": "string",
+      "description": "Name of the ECS service (also used for the cluster, ECR repo, IAM role, ALB, and task definition family).",
+      "required": true
+    },
+    "desired_count": {
+      "type": "integer",
+      "default": 1,
+      "description": "Number of ECS Fargate tasks to run."
+    },
+    "container_image": {
+      "type": "string",
+      "description": "Container image to deploy (e.g. <account>.dkr.ecr.<region>.amazonaws.com/<repo>:latest). Passed into the ECS task definition container definitions.",
+      "required": true
+    },
+    "container_port": {
+      "type": "integer",
+      "default": 80,
+      "description": "Container port the service listens on (used in the task definition port mapping and the ALB target group)."
+    }
+  },
+  "outputs": {
+    "service_arn": {
+      "type": "arn",
+      "description": "The ARN of the deployed ECS service."
+    },
+    "lb_dns_name": {
+      "type": "string",
+      "description": "The DNS name of the fronting Application Load Balancer."
+    }
+  }
+}
@@ -0,0 +1,161 @@
+# Nova L2 pattern: microservice (opaque composition, D-012/D-038).
+#
+# Composes six L1 primitives internally via module blocks:
+#   vpc + ecs-cluster + ecs-service + iam-role + ecr + alb (D-038).
+#
+# The L2 interface (interface.json) exposes a simplified, engine-agnostic
+# input/output surface (service_name, desired_count, container_image,
+# container_port → service_arn, lb_dns_name). The children/wires are NOT
+# in the interface — they live here in terraform/main.tf.
+#
+# The L1 primitives are minimal/atomic (D-014); some glue that the L1s do
+# not expose (the ECS task definition container JSON, the ECS service
+# network + load-balancer wiring, the ALB security group) is added here
+# in the L2 — this is the "L2 composes L1 internally" model (D-012).
+
+terraform {
+  required_version = ">= 1.9, < 1.10"
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}
+
+data "aws_availability_zones" "available" {
+  state = "available"
+}
+
+# ---------------------------------------------------------------------------
+# L1 composition (D-038): vpc + ecs-cluster + ecr + iam-role + alb + ecs-service.
+# ---------------------------------------------------------------------------
+
+# 1. VPC — the network the microservice runs in. (Per D-038 the microservice
+#    includes its own VPC as one of the 6 L1s. When platform_subnet_ids /
+#    platform_security_group_id are supplied by the consumer root, the L1
+#    vpc module is disabled and the platform VPC outputs are used directly
+#    — no per-contract VPC is created.)
+module "vpc" {
+  source = "../../l1/vpc/terraform"
+
+  cidr   = "10.0.0.0/16"
+  azs    = data.aws_availability_zones.available.names
+  enabled = var.platform_subnet_ids == null
+}
+
+# 2. ECS cluster — the scheduling boundary.
+module "cluster" {
+  source = "../../l1/ecs-cluster/terraform"
+
+  cluster_name = "${var.service_name}-cluster"
+}
+
+# 3. ECR repository — holds the container image.
+module "ecr" {
+  source = "../../l1/ecr/terraform"
+
+  repository_name = var.service_name
+}
+
+# 4. IAM role — the ECS task execution + task role. The L1 iam-role primitive
+#    takes a policy_document (assume-role trust); managed policies are
+#    attached by the L2 glue below.
+module "role" {
+  source = "../../l1/iam-role/terraform"
+
+  role_name = "${var.service_name}-task-role"
+  policy_document = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Action    = "sts:AssumeRole"
+      Effect    = "Allow"
+      Principal = { Service = "ecs-tasks.amazonaws.com" }
+    }]
+  })
+}
+
+# 5. ALB — the public-facing load balancer fronting the ECS service. The L1
+#    alb primitive takes subnet_ids + target_group_port; the L2 wires the
+#    platform VPC subnets (or the per-contract VPC subnets) into it.
+module "alb" {
+  source = "../../l1/alb/terraform"
+
+  lb_name            = "${var.service_name}-alb"
+  subnet_ids        = var.platform_subnet_ids == null ? module.vpc.subnet_ids : var.platform_subnet_ids
+  target_group_port = var.container_port
+}
+
+# 6. ECS service — runs the task definition on the cluster. The L1 ecs-service
+#    primitive accepts a task_definition ARN; the L2 registers the full
+#    task definition (container JSON + role + network mode) via the glue
+#    resource aws_ecs_task_definition.this below and passes its ARN here.
+module "service" {
+  source = "../../l1/ecs-service/terraform"
+
+  service_name    = var.service_name
+  cluster_arn     = module.cluster.cluster_arn
+  task_definition = aws_ecs_task_definition.this.arn
+  desired_count   = var.desired_count
+}
+
+# ---------------------------------------------------------------------------
+# L2 glue — resources the L1 primitives do not expose.
+# ---------------------------------------------------------------------------
+
+# ECS task definition with container definitions JSON. The L1 ecs-service
+# accepts a task_definition string; here we register the full definition
+# (CPU/memory + container port mapping + the ECR image + the task role).
+resource "aws_ecs_task_definition" "this" {
+  family             = var.service_name
+  cpu                = "256"
+  memory             = "512"
+  execution_role_arn = module.role.role_arn
+  task_role_arn      = module.role.role_arn
+  network_mode       = "awsvpc"
+  container_definitions = jsonencode([
+    {
+      name      = var.service_name
+      image     = var.container_image
+      essential = true
+      portMappings = [
+        {
+          containerPort = var.container_port
+          protocol      = "tcp"
+        }
+      ]
+    }
+  ])
+}
+
+# Attach the AmazonECSTaskExecutionRolePolicy managed policy to the task
+# role created by the L1 iam-role primitive (the L1 does not attach
+# managed policies — it only creates the role + trust policy).
+resource "aws_iam_role_policy_attachment" "task_exec" {
+  role       = module.role.role_name
+  policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
+}
+
+# Security group for the ALB (ingress on the container port from the
+# internet; egress to the VPC). The L1 alb primitive does not manage its
+# own security group (kept minimal per D-014); the L2 owns it here.
+resource "aws_security_group" "alb" {
+  count       = var.platform_security_group_id == null ? 1 : 0
+  name        = "${var.service_name}-alb-sg"
+  description = "Security group for the ${var.service_name} ALB (L2 glue)."
+  vpc_id      = var.platform_subnet_ids == null ? module.vpc.vpc_id : null
+
+  ingress {
+    from_port   = var.container_port
+    to_port     = var.container_port
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
@@ -0,0 +1,15 @@
+# L2 microservice outputs — match the interface.json outputs (D-013).
+#
+# The L2 interface exposes a simplified, engine-agnostic output surface:
+# service_arn + lb_dns_name. Internal L1 outputs are NOT re-exported (the
+# L2 is opaque per D-012).
+
+output "service_arn" {
+  description = "The ARN of the deployed ECS service."
+  value       = module.service.service_arn
+}
+
+output "lb_dns_name" {
+  description = "The DNS name of the fronting Application Load Balancer."
+  value       = module.alb.dns_name
+}
@@ -0,0 +1,44 @@
+# L2 microservice variables — match the interface.json inputs (D-013).
+#
+# The L2 interface exposes a simplified, engine-agnostic input surface.
+# The platform-wiring variables (platform_subnet_ids,
+# platform_security_group_id) are L2-internal — they let the consumer root
+# (terraform/microservice/main.tf) wire the L2 into the shared platform VPC
+# via terraform_remote_state. They are NOT part of the L2 interface (the
+# interface stays minimal per D-013).
+
+variable "service_name" {
+  description = "Name of the ECS service (also used for the cluster, ECR repo, IAM role, ALB, and task definition family)."
+  type        = string
+}
+
+variable "desired_count" {
+  description = "Number of ECS Fargate tasks to run."
+  type        = number
+  default     = 1
+}
+
+variable "container_image" {
+  description = "Container image to deploy (e.g. <account>.dkr.ecr.<region>.amazonaws.com/<repo>:latest). Passed into the ECS task definition container definitions."
+  type        = string
+}
+
+variable "container_port" {
+  description = "Container port the service listens on (used in the task definition port mapping and the ALB target group)."
+  type        = number
+  default     = 80
+}
+
+# --- L2-internal platform-wiring variables (NOT in interface.json) ---
+
+variable "platform_subnet_ids" {
+  description = "Platform VPC subnet IDs (from terraform_remote_state.platform). When set, the L1 vpc module is disabled and these subnets are used directly (no per-contract VPC). When null, the L2 creates its own VPC."
+  type        = list(string)
+  default     = null
+}
+
+variable "platform_security_group_id" {
+  description = "Platform VPC ECS security group ID (from terraform_remote_state.platform). When set, the L2 reuses it and skips creating its own ALB SG."
+  type        = string
+  default     = null
+}
@@ -0,0 +1,10 @@
+terraform {
+  required_version = ">= 1.9, < 1.10"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+  }
+}
--- a/Show More
+++ b/Show More