diff --git a/.agents/rules/iac/MTS-IAC-103-account-and-region-parameters.md b/.agents/rules/iac/MTS-IAC-103-account-and-region-parameters.md
index c7d1f0c..540e53c 100644
--- a/.agents/rules/iac/MTS-IAC-103-account-and-region-parameters.md
+++ b/.agents/rules/iac/MTS-IAC-103-account-and-region-parameters.md
@@ -18,8 +18,9 @@
   the exact account it permits and its reason.
 - Roots MUST bind the provider to it with `allowed_account_ids`
   (PC-IAC-005) and derive ARNs from it rather than typing them.
-- The region is an **environment** parameter: each environment's `.tfvars`
-  declares `region`, and nothing else in the root types a region.
+- The region and its Availability Zones are **environment** parameters: each
+  environment's `.tfvars` declares them, and nothing else in the root types a
+  region or a zone.
 - Moving to another account is `scripts/set-aws-account.sh <id>` in each
   repository plus one update of the organization variable. Retired accounts stay
   listed and cannot be reused silently.
@@ -27,4 +28,6 @@
 ## Automated check
 
 The two account contracts in each repository and the CI account contract in each
-service repository.
+service repository. In every live Terraform root, `scripts/iac/contracts.py` in
+`MicroTodoSuite/.github` rejects a provider without `allowed_account_ids` and a
+literal account ID, region, or Availability Zone.
diff --git a/.agents/rules/iac/PC-IAC-024-configuration-traceability.md b/.agents/rules/iac/PC-IAC-024-configuration-traceability.md
index e6408e4..3ec7e26 100644
--- a/.agents/rules/iac/PC-IAC-024-configuration-traceability.md
+++ b/.agents/rules/iac/PC-IAC-024-configuration-traceability.md
@@ -14,7 +14,16 @@ Configuration that varies by environment MUST originate in that environment's
 
 Pure computations and constants intrinsic to a module MAY live in `locals.tf`.
 
+Environment configuration includes the region and zones (MTS-IAC-103), CIDR
+blocks, instance types and other sizes, domains, and the GitHub organization in
+OIDC subjects. `0.0.0.0/0` is not environment configuration.
+
 ## Automated check
 
-Reviewed through the iac-review skill; a `locals` map literal with more than one
-environment-sized value is flagged.
+In every live root, `scripts/iac/contracts.py` in `MicroTodoSuite/.github`
+rejects a literal CIDR block other than `0.0.0.0/0`, an instance type, a GitHub
+organization in an OIDC subject (`repo:<organization>/`), and a domain held by a
+`domain`, `domain_name`, `zone_name`, `hostname`, or `fqdn` attribute. PC-IAC-002
+already refuses a default on a variable that identifies or sizes
+infrastructure. Other sizes, counts, and structured environment values are
+reviewed through the iac-review skill.
diff --git a/.specify/agent-assets.json b/.specify/agent-assets.json
index a82dacf..d238449 100644
--- a/.specify/agent-assets.json
+++ b/.specify/agent-assets.json
@@ -1,6 +1,6 @@
 {
   "source_repository": "MicroTodoSuite/microservice-app-ai-agents",
-  "source_commit": "2f6a716be231e017496084561a216893d5074829",
+  "source_commit": "da9f2c76695202c14a801c3a13cf8d4b14712eee",
   "docs_repository": "MicroTodoSuite/microservice-app-docs",
-  "docs_commit": "6e265036947ec34a6db9cdcfbb6660d1e34364e7"
+  "docs_commit": "305389a7e108e8ddf992ba8b08eb7cc2f6c10d43"
 }