Provision AWS infrastructure with Terraform

.github/workflows/quality.yml

@@ -1,6 +1,7 @@
 name: Quality
 
 on:
+  workflow_dispatch:
   pull_request:
   push:
     branches:
@@ -18,6 +19,34 @@ env:
   OPENAI_API_KEY: ""
 
 jobs:
+  terraform:
+    name: terraform
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@v6
+
+      - name: Set up Terraform
+        uses: hashicorp/setup-terraform@v4
+        with:
+          terraform_version: 1.15.8
+
+      - name: Check Terraform formatting
+        run: terraform fmt -check -recursive infra/terraform
+
+      - name: Initialize and validate bootstrap root
+        run: |
+          terraform -chdir=infra/terraform/bootstrap init -backend=false
+          terraform -chdir=infra/terraform/bootstrap validate
+
+      - name: Initialize and validate demo environment
+        run: |
+          terraform -chdir=infra/terraform/environments/demo init -backend=false
+          terraform -chdir=infra/terraform/environments/demo validate
+
+      - name: Test ADR-0022 invariants and failure guards
+        run: terraform -chdir=infra/terraform/environments/demo test
+
   quality:
     name: quality
     runs-on: ubuntu-latest

.gitignore

@@ -37,3 +37,16 @@ web/tsconfig.tsbuildinfo
 # Local runtime data
 *.log
 *.pid
+
+# Terraform local state, provider cache, and uncommitted variable values
+**/.terraform/*
+*.tfstate
+*.tfstate.*
+*.tfplan
+*.tfvars
+!*.tfvars.example
+crash.log
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json

docs/architecture.md

@@ -9,6 +9,21 @@ enterprise impact assessments, plus the read-only Enterprise Knowledge Catalog E
 narrow persisted Confluence Cloud document-identity boundary, and trusted origin metadata for
 deterministic policy dependencies.
 
+## AWS infrastructure definition
+
+ADR-0022's approved AWS topology is implemented as Terraform under
+[`infra/terraform`](../infra/terraform/README.md). It preserves the modular-monolith boundary: one
+ECS Fargate service runs standalone Next.js and FastAPI containers in one task, only Next.js is an
+ALB target, PostgreSQL remains private RDS, and a separate one-off task definition owns the Alembic
+execution boundary.
+
+Terraform defaults to the declared off state: ECS desired count zero with no ALB or application
+alias. Enabling a demo creates Cognito-authenticated TLS ingress and exactly one task. Applying
+the infrastructure remains prohibited until ADR-0022's authentication, trusted-header,
+database-configuration, logging, health, and sizing prerequisites are implemented and tested.
+Deployment, migrations, database-role bootstrap, seed, and operational lifecycle workflows remain
+separate follow-up work.
+
 ## High-level architecture
 
 ```mermaid