From 087c89edbf37cb7aebe6250208d52c98c06e9727 Mon Sep 17 00:00:00 2001
From: Jon Chery <jchery@jccapital.xyz>
Date: Tue, 21 Jul 2026 17:55:49 +0000
Subject: [PATCH] docs(clarify): auto-resolve operational parameters; defer
 OIDC to RESEARCH
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---ci---
project: acdl
phase: 0
milestone: v1.1
status: clarify
clarifications:
  resolved: 12 operational parameters (AWS region, state bucket/lock names, OIDC role + trust subject, spike L1/L2/contract inputs, terraform command scope, Checkov ruleset, tag preservation, next ship tag)
  mode: accept-recommendations + decide-rest (D-038)
  deferred_to_research: [gitea/act_runner OIDC support, terraform/checkov runner availability, configure-aws-credentials action availability]
  user_blocking_questions: 0
---/ci---

At full autonomy, the 11 architecture open decisions were already
recorded in PROJECT.md during SPECIFY (D-038). CLARIFY resolves the 12
operational parameters needed to unblock planning (AWS region, state
backend names, OIDC role, spike L1/L2/contract inputs, terraform command
scope, Checkov ruleset). The one genuinely unknown item — Gitea/act_runner
OIDC support — is not a clarification (no user preference can resolve it);
it is the highest-priority RESEARCH target.
---
 .ciagent/PROJECT.md | 34 +++++++++++++++++++++++++++++++++-
 1 file changed, 33 insertions(+), 1 deletion(-)

diff --git a/.ciagent/PROJECT.md b/.ciagent/PROJECT.md
index 8ead959..cbb33a3 100644
--- a/.ciagent/PROJECT.md
+++ b/.ciagent/PROJECT.md
@@ -185,4 +185,36 @@ decisions:
 The v1.0 demo (tag `v1.1.0`) carried decisions D-001..D-033. They governed
 the stub-driven executive demo and remain valid **for the archived demo
 under `demo/`**. They are **superseded** by the v1.1 decisions above for the
-real platform. Full text preserved in git history at tag `v1.1.0`.
\ No newline at end of file
+real platform. Full text preserved in git history at tag `v1.1.0`.
+
+## Operational parameters (CLARIFY auto-resolution, full autonomy)
+
+Resolved at the CLARIFY stage to unblock planning. None require user
+sign-off (autonomy = full; all within locked constraints).
+
+| Parameter | Value | Rationale |
+|---|---|---|
+| AWS region | `us-east-1` | Default; matches v1.0 demo references; single-region in v1 (§12.3) |
+| Terraform state bucket | `acdl-tfstate-<account-id>-us-east-1` | Namespaced by account id to avoid collision; region-suffixed |
+| Terraform lock table | `acdl-tflock` | DynamoDB; single-region v1 |
+| OIDC IAM role | `acdl-act-runner-role` | Assumed by the act_runner via web-identity |
+| OIDC trust subject | `repo:continuous-intelligence/acdl:ref:refs/heads/main` (+ phase branches) | Least-privilege; refined in Phase 08 |
+| Spike L1 (`l1-s3`) inputs | `bucket_name: string`, `region: string` | Minimal S3 interface per §2 |
+| Spike L2 (`l2-static-asset`) | thin-composition referencing `l1-s3` only; depth 1 | Smallest real plan per D-036 |
+| Spike contract | `contracts/spike.yaml`: `stack: l2-static-asset`, `environment: dev`, `inputs: { bucket_name: acdl-spike-bucket, region: us-east-1 }` | One end-to-end submission (REQ-27) |
+| Spike `terraform` command | `plan` only | `apply` is out of scope (Out of Scope table); HITL-gated in v1.2 |
+| Checkov ruleset (spike) | the 4 L2 checks (secrets-in-plaintext, public ingress, IAM wildcard, KMS key reference) + tag/naming | §3 + §12.4; Kyverno/OPA deferred |
+| v1.0 tags preserved | `v1.0.1`..`v1.0.5`, `v1.1.0` retained | Immutability; demo archive does not rewrite history |
+| Next ship tag | `v1.2.0` | Feature milestone → next minor per ship.md (D-035) |
+
+### Items deferred to RESEARCH (not clarifications)
+
+- **Gitea/act_runner OIDC support** — does act_runner emit an OIDC
+  `id-token`? Determines whether real-AWS plan is achievable in this
+  environment or whether a spike-only waiver is needed. Highest-priority
+  research target.
+- **Terraform + Checkov availability on the runner image** — install in the
+  workflow if missing.
+- **`actions/configure-aws-credentials` action on act_runner** — if
+  unavailable, fall back to `aws sts assume-role-with-web-identity` from a
+  step.
\ No newline at end of file