Resource cleanup

Canada and Multi-Cloud Networking have separate infrastructure and Terraform states. Canada owns its application namespace, registration token, Canadian Azure resources, CE sites, application objects, and allocation selector binding. The reserved public-IP allocation remains platform-owned in its existing namespace.

Boundary	Lifecycle treatment
Owned Canadian application/infrastructure	Included in an ownership-scoped saved destroy plan
Reserved public-IP allocation	Retained; only the demonstration’s binding is released
Protected local state and backups	Kept outside repository and infrastructure teardown
MCN infrastructure and state	Independently owned; outside Canada teardown
Shared Marketplace acceptance	Subscription prerequisite retained independently

The lifecycle validates the saved plan against owned scope, applies it with the exclusive deployment and state locks, then checks direct Azure/XC absence and allocation retention. A rebuild uses the exact clean merged source and independent inputs. A fresh zero-change plan and the verification observations describe the rebuilt candidate; deletion alone does not prove recovery.

Implementation modes

Destroy mode changes owned demonstration infrastructure and collects absence/retention receipts:

python3 scripts/lifecycle.py --mode destroy \
  --tfvars "$CANADA_PRIVATE/canada.tfvars" \
  --backend-config="$CANADA_PRIVATE/backend.hcl" \
  --private-root "$CANADA_PRIVATE/destroy-receipts"

--mode full combines build, destroy, direct absence and a second verified build. These modes use reviewed inputs in the authorized lab window. Documentation work does not invoke them or remove protected state/backups. Deploy the demo explains the independent backend and source identity.