# ACDL — Pre-mortem (v1.11, REQ-120)

> Authored: 2026-07-28, Phase 64 (previously drafted at P60, finalized here).
> Mandated by: GRILL Axis 7 Q4 (no pre-mortem on file — flagged, no
> binding decision; user accepted autonomous governance in G-009).
> Structure: (1) v1.10 decay incident post-mortem, (2) forward pre-mortem
> for the OSS reference + leadership pitch.

---

## Part 1 — Post-mortem: v1.10 capability decay incident

### Summary

Capabilities marked complete in v1.1–v1.8 ran successfully at the time
of tagging. As of 2026-07-27 they were **not reproducible** — the v1.7/
v1.8 platform simplification introduced 7 adapter defects in
`adapters/terraform/adapter.py` that prevented `terraform init/
validate/plan` from succeeding against live AWS. The decks (v1.9.1–
v1.9.8) presented the capability as current across 8 NFR-patch phases
**without disclosing the decay**. v1.10 (Phases 52–55) re-verified every
advertised capability, fixed all 7 defects in-sweep (D-090: no cap), and
rewrote PROJECT/ROADMAP/decks to match verified reality.

### Timeline

| Date | Event |
|------|-------|
| 2026-07-21 | v1.7 Phases 22–27 ship. The adapter simplification lands (the 7 defects are introduced here). |
| 2026-07-21 | v1.8 Phases 28–38 ship. The defects persist undetected; VERIFY is diff-scoped so the decay is invisible. |
| 2026-07-21 → 2026-07-27 | v1.9.0 + v1.9.1–v1.9.8 (8 NFR-patch phases) ship. Each passes VERIFY (diff-scoped — checks the phase diff only, never re-runs underlying capability). Decks present capability as current. |
| 2026-07-27 | CLARIFY/RESEARCH for v1.10 surfaces the structural defect: VERIFY is diff-scoped; advertised capability is not reproducible; deck work was sequenced backwards. |
| 2026-07-27 | User decisions D-090 (no cap on sweep), D-091 (regression-class VERIFY), D-092 (local emulating adapters), D-093 (re-verify v1.1→v1.8), D-094 (rewrite to verified reality). |
| 2026-07-27 | Phase 52 adds the regression-class VERIFY. Phase 53 builds local emulating adapters. Phase 54 enumerates + re-verifies every capability — finds 7 adapter defects, fixes all in-sweep. Phase 55 rewrites PROJECT/ROADMAP/decks to verified reality. |
| 2026-07-27 | v1.10.0 tagged; all 16 auto-verifiable capabilities Verified. 6 IAM-gated capabilities (CAP-017..022) escalated (G-005). |

### Root cause

**VERIFY was diff-scoped.** The standard VERIFY stage checked the phase
diff only — the files changed in that phase — and never re-ran the
underlying platform capability. 8 NFR-patch phases (v1.9.1→v1.9.8)
passed VERIFY while the platform decayed underneath, because each
phase's diff was docs-only (decks) and the decay was in code the diff
didn't touch. The VERIFY gate was structurally incapable of catching
decay in code outside the phase diff.

### Contributing factors

1. **Deck work was sequenced backwards.** The honest order is
   re-verify → rewrite → polish. v1.9.x did it backwards: polish the
   decks first, then discover (in v1.10) that the capability they
   advertised had decayed.
2. **No regression-class gate existed.** Each milestone's VERIFY
   re-checked the phase diff, not the cumulative capability. There was
   no mechanism to ask "does everything we previously claimed still
   work?"
3. **Local emulating adapters did not exist.** Without a local tier,
   re-verification required live AWS access on every phase — costly and
   not run. The decay was therefore never re-probed between v1.7 and
   v1.10.
4. **Decks were frozen before re-verification.** The v1.9.x decks
   presented capability as current without a re-verification step
   gating the claim.

### Impact

- **8 phases of inaccurate status reporting.** v1.9.1–v1.9.8 decks
  advertised capability as current that was not reproducible.
- **7 adapter defects shipped undetected.** Duplicate output
  definitions, duplicate args, missing required args, deprecated AWS
  provider v5 arg names — all in `adapters/terraform/adapter.py`.
- **Credibility gap.** The OSS reference's headline E2E did not run
  against live AWS between v1.7 and v1.10. The grill (G-005) flagged
  this as the project-killing risk.

### Mitigations (landed in v1.10)

| Mitigation | Decision | Status |
|-----------|----------|--------|
| Regression-class VERIFY that re-runs capability checks at milestone completion | D-091 (REQ-112) | Landed — `scripts/run_regression.sh` + `core/regression_verify.py`. 16/16 Verified at v1.10.0. |
| Local emulating adapters so the platform is fully locally testable without cloud credentials | D-092 (REQ-113) | Landed — flat-file DynamoDB outbox, local ECS Fargate emulator, local S3 state, local Lambda stub. Headline E2E runs locally. |
| Capability inventory with per-capability Verified/Decayed/Broken tags | D-093 (REQ-114) | Landed — `.ciagent/CAPABILITY_INVENTORY.md`. 16/16 Verified; 6 IAM-gated escalated (G-005). |
| Rewrite docs/decks to verified reality; decks unfrozen only after re-verification | D-094 (REQ-115) | Landed — PROJECT.md §Capability Status (Re-Verified 2026-07-27), ROADMAP v1.9.x noted as superseded-by-reverification, both decks rewritten. |

### Follow-up (accepted debt)

- **G-007 (per-phase regression):** the regression gate runs at
  milestone completion, not per-phase. Inter-milestone decay between
  phase N and milestone COMPLETE is an accepted trade-off (grill Axis 3
  Q4, confidence 0.70). Per-phase regression hardening is a separate
  future milestone.
- **G-005 (IAM-gated capabilities):** 6 capabilities (CAP-017..022)
  remain deploy-unverified as of v1.10 — the spike-runner cannot fix
  its own IAM. v1.11 (this milestone) closes G-005 by re-bootstrapping
  IAM and live-deploying the stacks.

---

## Part 2 — Forward pre-mortem: OSS reference + leadership pitch

### Scenario

It is 90 days after the v1.11 ship. The leadership pitch has been
delivered. The grill's 90-day conditions (G-001 pitch yields a pilot
platform team; G-005 deploy path verifiable; G-008 cost operating model
documented) were the success criteria. **Assume the project has failed.**
What killed it?

### Top failure modes + mitigations

#### FM-1 — IAM drift recurs (the spike-runner loses permissions again)

**How it kills the project:** the v1.11 IAM re-bootstrap grants are
revoked or drift (admin action, account re-organization, SCP change).
The next regression run (D-091) fails closed on CAP-017..022. The
verified-reality claim in the decks becomes false again — a repeat of
the v1.10 incident in a different shape. Leadership loses trust.

**Mitigation (user-owned):**
- The IAM policy baseline is now regression-tested
  (`tests/test_iam_policy_baseline.py`, REQ-116). Any permission removal
  surfaces as a test failure at the next milestone COMPLETE — the gate
  fails closed, the false claim never ships.
- `.ciagent/IAM_POLICY.md` documents the required grants. An admin who
  re-organizes the account can read the baseline and re-grant.
- The user reviews the baseline test at each milestone COMPLETE. If the
  grants have drifted, the user re-bootstraps (D-095 path) before
  re-attempting COMPLETE.

#### FM-2 — Cost spike from un-torn-down stacks

**How it kills the project:** the v1.11 deploy-verification leaves the
microservice + static-assets + uptime stacks running. Live ECS Fargate +
CloudFront + WAF accrue spend. The COST.md (REQ-119) documents the
v1.0–v1.10 window, not the ongoing burn. A pilot platform team clones
the reference, runs the same apply, and leaves it running — multiply
the spend by the number of clones. AWS budget alerts fire at leadership
level. The reference is perceived as expensive.

**Mitigation (user-owned):**
- **D-096 (teardown mandatory before milestone COMPLETE).** Phase 61
  tears down the stacks via D-070 decommission mode. The live AWS
  account returns to zero-cost steady state. The milestone does not
  complete until teardown is verified.
- **COST.md teardown guidance.** REQ-119 documents the teardown path +
  cost-ceiling guidance for downstream clones. A clone that follows
  the guidance runs the same teardown.
- The user enforces D-096 at Phase 61 — no merge to main until
  `terraform show` confirms no resources. The `decommissioned:
  { stack, cr_id, completed_at }` record in the `---ci---` block is
  the audit trail.

#### FM-3 — Deck overstates capability (a future v1.9.x-style incident)

**How it kills the project:** a future NFR-patch milestone adds a deck
slide claiming a capability that hasn't been re-verified. The
regression gate runs at milestone COMPLETE and catches the underlying
decay — but the deck has already been rendered and uploaded to a
release. Leadership sees the deck before the regression gate fails.
Repeat of the v1.9.x sequencing incident.

**Mitigation (user-owned):**
- **Verified-only claims.** REQ-121 enforces that decks match
  `CAPABILITY_INVENTORY.md` exactly; `ci-doc-verifier` confirms no
  stale claims. Any deck claim must trace to a Verified capability.
- **Decks unfrozen only after re-verification.** The v1.10 lesson
  (D-094) is codified: decks are frozen until the regression gate
  passes. A future milestone that adds a deck slide must land the
  capability re-verification in the same milestone.
- The user reviews the `ci-doc-verifier` output at each milestone
  COMPLETE. If a stale claim is found, the milestone does not complete
  until the deck is corrected.

#### FM-4 — Pilot consumer hits a contract gap

**How it kills the project:** a pilot platform team (post-pitch) clones
the reference and tries to deploy a stack the L2 catalog doesn't cover
(e.g. a worker queue, a scheduled job, a database-backed service). The
contract schema + L2 compositions support only microservice + static-
assets. The pilot team concludes the reference is a demo, not a
foundation. The pitch's "feature-complete MVP" claim (G-001) is
undermined.

**Mitigation (user-owned):**
- **CONSUMER_GUIDE.md + L2 catalog coverage.** `docs/CONSUMER_GUIDE.md`
  documents the supported L2 compositions; the L2 catalog
  (`modules/l2/`) is the supported surface. A pilot team that reads the
  guide knows the boundary before cloning.
- **Honest scope.** The grill (G-010) accepted OSS scope as
  contributor-bounded. The pitch should not claim "any stack" — it
  should claim "microservice + static-assets today; the L2 pattern is
  extensible." The v1.9.5 Anti-goals slide (What This Platform Is —
  and Isn't) is the honest framing.
- The user adds L2 compositions as pilot demand surfaces. The reference
  value is the *shape* (contract → IR → adapter → terraform →
  confidence → outbox), not the catalog size. A pilot team that
  understands the shape can extend it.

### What the pre-mortem tells us

The four failure modes all reduce to the same root pattern: **a claim
outruns the verification that backs it.** v1.10 was the first instance
(decks outran capability). v1.11 closes G-005 + G-008 by making the
verification back the claim. The mitigations are all structural —
regression-testable baselines, mandatory teardown, Verified-only deck
claims, honest scope — not procedural. The user owns enforcement at
each milestone COMPLETE.

### Confidence

- FM-1 (IAM drift recurs): confidence 0.75 — the baseline test catches
  it; the user enforces re-bootstrap at COMPLETE.
- FM-2 (cost spike): confidence 0.85 — D-096 teardown is mandatory and
  audited in the `---ci---` block.
- FM-3 (deck overstates): confidence 0.70 — `ci-doc-verifier` is
  automated; the sequencing risk is procedural.
- FM-4 (pilot contract gap): confidence 0.65 — the mitigation is
  honest framing, not catalog completeness; a pilot may still hit the
  gap.

### Links to existing controls

- D-091 regression gate (REQ-112) — `scripts/run_regression.sh`.
- D-094 verified-reality rewrite (REQ-115) — decks match
  `CAPABILITY_INVENTORY.md`.
- D-096 teardown mandatory (v1.11) — Phase 61.
- G-005 deploy verification (v1.11) — Phases 56–58.
- G-008 cost documentation (v1.11) — Phase 59.
- G-010 contributor-bounded scope — honest pitch framing.