continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity

docs(clarify): auto-resolve operational parameters; defer OIDC to RESEARCH

Browse Source 
---ci---
project: acdl
phase: 0
milestone: v1.1
status: clarify
clarifications:
  resolved: 12 operational parameters (AWS region, state bucket/lock names, OIDC role + trust subject, spike L1/L2/contract inputs, terraform command scope, Checkov ruleset, tag preservation, next ship tag)
  mode: accept-recommendations + decide-rest (D-038)
  deferred_to_research: [gitea/act_runner OIDC support, terraform/checkov runner availability, configure-aws-credentials action availability]
  user_blocking_questions: 0
---/ci---

At full autonomy, the 11 architecture open decisions were already
recorded in PROJECT.md during SPECIFY (D-038). CLARIFY resolves the 12
operational parameters needed to unblock planning (AWS region, state
backend names, OIDC role, spike L1/L2/contract inputs, terraform command
scope, Checkov ruleset). The one genuinely unknown item — Gitea/act_runner
OIDC support — is not a clarification (no user preference can resolve it);
it is the highest-priority RESEARCH target.
This commit is contained in:
Jon Chery
2026-07-21 17:55:49 +00:00
parent 288607b3fa
commit 087c89edbf
1 changed files with 33 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.ciagent/PROJECT.md
+33 -1
View File
@@ -185,4 +185,36 @@ decisions:
The v1.0 demo (tag `v1.1.0`) carried decisions D-001..D-033. They governed
the stub-driven executive demo and remain valid **for the archived demo
under `demo/`**. They are **superseded** by the v1.1 decisions above for the
real platform. Full text preserved in git history at tag `v1.1.0`.
real platform. Full text preserved in git history at tag `v1.1.0`.
## Operational parameters (CLARIFY auto-resolution, full autonomy)
Resolved at the CLARIFY stage to unblock planning. None require user
sign-off (autonomy = full; all within locked constraints).
| Parameter | Value | Rationale |
|---|---|---|
| AWS region | `us-east-1` | Default; matches v1.0 demo references; single-region in v1 (§12.3) |
| Terraform state bucket | `acdl-tfstate-<account-id>-us-east-1` | Namespaced by account id to avoid collision; region-suffixed |
| Terraform lock table | `acdl-tflock` | DynamoDB; single-region v1 |
| OIDC IAM role | `acdl-act-runner-role` | Assumed by the act_runner via web-identity |
| OIDC trust subject | `repo:continuous-intelligence/acdl:ref:refs/heads/main` (+ phase branches) | Least-privilege; refined in Phase 08 |
| Spike L1 (`l1-s3`) inputs | `bucket_name: string`, `region: string` | Minimal S3 interface per §2 |
| Spike L2 (`l2-static-asset`) | thin-composition referencing `l1-s3` only; depth 1 | Smallest real plan per D-036 |
| Spike contract | `contracts/spike.yaml`: `stack: l2-static-asset`, `environment: dev`, `inputs: { bucket_name: acdl-spike-bucket, region: us-east-1 }` | One end-to-end submission (REQ-27) |
| Spike `terraform` command | `plan` only | `apply` is out of scope (Out of Scope table); HITL-gated in v1.2 |
| Checkov ruleset (spike) | the 4 L2 checks (secrets-in-plaintext, public ingress, IAM wildcard, KMS key reference) + tag/naming | §3 + §12.4; Kyverno/OPA deferred |
| v1.0 tags preserved | `v1.0.1`..`v1.0.5`, `v1.1.0` retained | Immutability; demo archive does not rewrite history |
| Next ship tag | `v1.2.0` | Feature milestone → next minor per ship.md (D-035) |
### Items deferred to RESEARCH (not clarifications)
- **Gitea/act_runner OIDC support** — does act_runner emit an OIDC
`id-token`? Determines whether real-AWS plan is achievable in this
environment or whether a spike-only waiver is needed. Highest-priority
research target.
- **Terraform + Checkov availability on the runner image** — install in the
workflow if missing.
- **`actions/configure-aws-credentials` action on act_runner** — if
unavailable, fall back to `aws sts assume-role-with-web-identity` from a
step.