chore: pre-migration snapshot

Layer0, MCP servers, Terraform consolidation

.gitlab-ci.yml

@@ -41,6 +41,38 @@ infra_invariants:
         - "terraform/**/*"
         - "scripts/infra-invariants.sh"
 
+# ============================================================================
+# WAF + PLAN INVARIANTS
+# ============================================================================
+# Enforces WAF Intel regression + deterministic Terraform plan gating.
+
+waf_plan_invariants:
+  stage: validate
+  image: hashicorp/terraform:latest
+  before_script:
+    - |
+      set -euo pipefail
+      if command -v apk >/dev/null 2>&1; then
+        apk add --no-cache python3 py3-pip
+      elif command -v apt-get >/dev/null 2>&1; then
+        apt-get update
+        apt-get install -y python3 python3-pip
+        rm -rf /var/lib/apt/lists/*
+      else
+        echo "No supported package manager found to install python3/pip." >&2
+        exit 1
+      fi
+    - python3 -m pip install --no-cache-dir -r requirements-dev.txt
+  script:
+    - bash scripts/waf-and-plan-invariants.sh
+  rules:
+    - changes:
+        - "mcp/waf_intelligence/**/*"
+        - "scripts/waf-and-plan-invariants.sh"
+        - "tests/test_waf_intelligence_analyzer.py"
+        - "requirements-dev.txt"
+        - "terraform/**/*"
+
 # ============================================================================
 # PYTHON SYNTAX CHECK
 # ============================================================================