continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity

fix(P54): capability re-verification sweep — 16/16 Verified, 7 adapter defects fixed

Browse Source 
The v1.1-v1.8 capability re-verification sweep (D-093) found and fixed
7 adapter defects in adapters/terraform/adapter.py that had prevented
the headline E2E from running against live AWS since the v1.7/v1.8
platform simplification. All 16 auto-verifiable capabilities are now
Verified.

Defects fixed in-sweep (D-090: no cap):
1. Duplicate output definitions (per-resource + stack-level both emitted).
2. Duplicate desired_count/launch_type on ECS service.
3. Duplicate target_type/family/load_balancer_type.
4. Missing assume_role_policy/role_name on IAM role (L2 composition gap).
5. Missing cidr_block/vpc_id/name defaults on VPC/subnet/route_table/
   ECS cluster/ECR repository.
6. ECR kms_key_arn unsupported arg -> encryption_configuration block.
7. CloudFront OAC + WAF deprecated arg names (AWS provider v5):
   signing_behavior, signing_protocol, origin_access_control_id,
   s3_origin_config.origin_access_identity, origin_id, rule (singular),
   scope=CLOUDFRONT (uppercase).

New live-AWS capability checks (CAP-013..CAP-016):
- terraform init+validate+plan live AWS (microservice): 14 resources, OK
- terraform init+validate+plan live AWS (static-assets): CloudFront+WAF+S3, OK
- DynamoDB outbox table: exists, 9 items
- S3 state bucket: exists, keys=[spike/l2-microservice/terraform.tfstate]

6 IAM-gated cloud resources (CAP-017..CAP-022: contracts table, Lambda,
ECS service, CloudFront stack, uptime-kuma, OIDC role) are documented
as escalated: the spike-runner lacks the IAM permissions to verify
them (chicken-and-egg). The terraform plan path proves the code would
deploy them; the local emulators prove the runtime behavior.

Verified: 513 fast tests pass. run_regression.sh reports 16/16
Verified (was 12; +4 live-AWS). terraform init+validate+plan succeeds
against live AWS for both contracts. No regressions.

---ci---
project: acdl
phase: 54
milestone: v1.10
status: verify
requirements:
  covered: [REQ-114]
  partial: []
decisions: [D-090, D-093]
regression:
  - { capability: CAP-013, status: Verified }
  - { capability: CAP-014, status: Verified }
  - { capability: CAP-015, status: Verified }
  - { capability: CAP-016, status: Verified }
---/ci---
This commit is contained in:
Jon Chery
2026-07-27 18:21:45 +00:00
parent 217653d6f4
commit 44d1d19cfd
9 changed files with 491 additions and 102 deletions
Download Patch File Download Diff File Expand all files Collapse all files
adapters/terraform/adapter.py
+100 -10
View File
@@ -201,8 +201,30 @@ def _emit_resource(resource, type_by_id=None):
body.append(" container_port = 8080")
body.append("}")
continue
if rtype == "aws:ecs:service" and in_name in ("subnets", "security_group"):
# Collected into network_configuration block (emitted after all inputs).
if rtype in ("aws:ecs:service", "aws:ecs:uptime-service") and in_name in ("subnets", "security_group", "desired_count", "launch_type"):
# Collected into network_configuration block (emitted after all
# inputs); desired_count + launch_type emitted in the
# ECS-specific block below (D-085 defaults).
continue
if rtype == "aws:elbv2:targetgroup" and in_name == "target_type":
# Emitted in the targetgroup-specific block below (D-085 default).
continue
if rtype == "aws:ecs:task_definition" and in_name == "family":
# Emitted in the task_definition-specific block below (D-085 default).
continue
if rtype == "aws:elbv2:loadbalancer" and in_name == "load_balancer_type":
# Emitted in the loadbalancer-specific block below (D-085 default).
continue
if rtype == "aws:ecr:repository" and in_name == "kms_key_arn":
# Emitted as encryption_configuration block below (not a bare arg).
continue
if rtype == "aws:ec2:subnet" and in_name == "cidr":
# The L2 supplies a name string, not a real CIDR; the default
# block below emits a valid cidr_block (10.0.1.0/24).
continue
if rtype == "aws:s3:bucket" and in_name == "kms_key_arn":
# Emitted in the server_side_encryption_configuration block
# below (not a bare arg on aws_s3_bucket).
continue
if rtype == "aws:cloudfront:distribution" and in_name in (
"bucket_regional_domain_name", "price_class", "viewer_protocol_policy",
@@ -239,7 +261,7 @@ def _emit_resource(resource, type_by_id=None):
launch = inputs.get("launch_type", "FARGATE")
body.append(f"desired_count = {desired}")
body.append(f'launch_type = "{launch}"')
body.append("task_definition = aws_ecs_task_definition.service-taskdefinition.arn")
body.append("task_definition = aws_ecs_task_definition.service-task-definition.arn")
body.append("name = \"acdl-microservice\"")
nfrs = resource.get("nfrs", {})
if isinstance(nfrs, dict) and "versioning" in nfrs and rtype == "aws:s3:bucket":
@@ -261,9 +283,54 @@ def _emit_resource(resource, type_by_id=None):
body.append("tags = {")
body.append(f' Name = "{tag_name}"')
body.append("}")
if rtype == "aws:ec2:vpc" and "cidr_block" not in inputs:
# L2 compositions don't supply a CIDR; emit the default.
body.append('cidr_block = "10.0.0.0/16"')
if rtype == "aws:ec2:subnet":
if "vpc_id" not in inputs:
body.append("vpc_id = aws_vpc.vpc-vpc.id")
if "cidr_block" not in inputs:
# The L2 supplies a `cidr` name string (e.g.
# "acdl-dev-microservice-...-us-east-1"), not a real CIDR.
# Emit a default subnet CIDR within the VPC's /16.
body.append('cidr_block = "10.0.1.0/24"')
if rtype == "aws:ec2:routetable" and "vpc_id" not in inputs:
body.append("vpc_id = aws_vpc.vpc-vpc.id")
if rtype == "aws:ecs:cluster" and "name" not in inputs:
body.append('name = "acdl-microservice"')
if rtype == "aws:ecr:repository":
if "name" not in inputs:
body.append('name = "acdl-microservice"')
if "kms_key_arn" in inputs:
# `kms_key_arn` is not a valid aws_ecr_repository arg; emit
# the encryption_configuration block instead.
kms_val = inputs["kms_key_arn"]
if isinstance(kms_val, str) and kms_val.startswith("ref:"):
kms_expr = _ref_expr(kms_val, type_by_id)
else:
kms_expr = _tf_value(kms_val)
body.append("encryption_configuration {")
body.append(" encryption_type = \"KMS\"")
body.append(f" kms_key = {kms_expr}")
body.append("}")
if rtype == "aws:iam:role" and "managed_policies" in inputs:
arns = [a.strip() for a in str(inputs["managed_policies"]).split(",") if a.strip()]
body.append("managed_policy_arns = [" + ", ".join(f'"{a}"' for a in arns) + "]")
if rtype == "aws:iam:role" and "assume_role_policy" not in inputs:
# The L2 microservice composition references iam-role@1.0.0 without
# supplying an assume_role_policy (the L1 interface marks it
# required, but the composition does not wire it). Emit a sensible
# ECS task execution trust policy so terraform validate/plan can
# proceed. This is the pragmatic in-sweep fix (Phase 54); the L2
# composition should ideally wire this explicitly.
ecs_task_trust = (
'{"Version":"2012-10-17","Statement":['
'{"Effect":"Allow","Principal":{"Service":"ecs-tasks.amazonaws.com"},'
'"Action":"sts:AssumeRole"}]}'
)
body.append(f"assume_role_policy = {json.dumps(ecs_task_trust)}")
if rtype == "aws:iam:role" and "role_name" not in inputs:
body.append('name = "acdl-microservice-role"')
if rtype == "aws:elbv2:listener":
body.append("default_action {")
body.append(" type = \"forward\"")
@@ -278,6 +345,7 @@ def _emit_resource(resource, type_by_id=None):
body.append(f'target_type = "{tgt_type}"')
body.append("vpc_id = aws_vpc.vpc-vpc.id")
body.append("protocol = \"HTTP\"")
body.append("port = 8080")
if rtype == "aws:ec2:routetable":
body.append("route {")
body.append(" cidr_block = \"0.0.0.0/0\"")
@@ -295,7 +363,8 @@ def _emit_resource(resource, type_by_id=None):
name = _tf_value(name)
body.append(f"name = {name}")
body.append("origin_access_control_origin_type = \"s3\"")
body.append("origin_access_control_signing_behavior = \"always\"")
body.append("signing_behavior = \"always\"")
body.append("signing_protocol = \"sigv4\"")
if rtype == "aws:cloudfront:distribution":
origin_domain = inputs.get("bucket_regional_domain_name")
if isinstance(origin_domain, str) and origin_domain.startswith("ref:"):
@@ -309,9 +378,12 @@ def _emit_resource(resource, type_by_id=None):
else:
oac_rid = "cloudfront-originaccesscontrol"
body.append("origin {")
body.append(f" origin_id = {_tf_value(rid)}")
body.append(f" domain_name = {origin_domain}")
body.append(f" origin_access_control = aws_cloudfront_origin_access_control.{oac_rid}.id")
body.append(" s3_origin_config {}")
body.append(f" origin_access_control_id = aws_cloudfront_origin_access_control.{oac_rid}.id")
body.append(" s3_origin_config {")
body.append(" origin_access_identity = \"\"")
body.append(" }")
body.append("}")
body.append("enabled = true")
price_class = inputs.get("price_class", "PriceClass_100")
@@ -346,7 +418,7 @@ def _emit_resource(resource, type_by_id=None):
if rtype == "aws:wafv2:webacl":
name = inputs.get("name", "acdl-waf")
body.append(f"name = {_tf_value(name) if not isinstance(name, str) or not name.startswith('ref:') else _ref_expr(name, type_by_id)}")
body.append("scope = \"cloudfront\"")
body.append("scope = \"CLOUDFRONT\"")
# P1-5: Honor default_action input instead of hardcoding allow {}.
default_action_input = inputs.get("default_action", "allow")
if isinstance(default_action_input, str) and default_action_input.startswith("ref:"):
@@ -368,7 +440,7 @@ def _emit_resource(resource, type_by_id=None):
continue
rule_name = rule.get("name", f"custom-rule-{idx}")
rule_priority = rule.get("priority", idx)
body.append("rules {")
body.append("rule {")
body.append(f" name = {_tf_value(rule_name)}")
body.append(f" priority = {_tf_value(rule_priority)}")
override = rule.get("override_action", "none")
@@ -398,7 +470,7 @@ def _emit_resource(resource, type_by_id=None):
body.append(f"rules = {_ref_expr(rules_input, type_by_id)}")
else:
# Default: emit the AWS-managed-rules block when no custom rules.
body.append("rules {")
body.append("rule {")
body.append(" name = \"aws-managed-rules\"")
body.append(" priority = 0")
body.append(" override_action {")
@@ -614,6 +686,15 @@ def adapt(stack_instance, out_dir):
type_by_id = {r["id"]: r["type"] for r in resources}
main_tf_parts = []
has_vpc = any(r["type"] == "aws:ec2:vpc" for r in resources)
# Track emitted output names so per-resource outputs and stack-level
# outputs never collide (duplicate output definitions break `terraform
# init`). Stack-level outputs (below) are canonical; per-resource
# outputs are only emitted when no stack output shares the name.
emitted_outputs = set()
# Pre-collect stack-level output names so per-resource emission can
# skip them (the stack output is the authoritative one).
stack_outputs = stack_instance.get("outputs", {})
stack_output_names = set(stack_outputs.keys())
for r in resources:
main_tf_parts.append(_emit_resource(r, type_by_id))
rid = r["id"]
@@ -622,6 +703,13 @@ def adapt(stack_instance, out_dir):
out_map = OUTPUT_MAP.get(rtype, {})
outputs = r.get("outputs", {})
for out_name in outputs:
if out_name in stack_output_names:
# The stack-level output (below) emits this name; skip
# the per-resource emission to avoid a duplicate.
continue
if out_name in emitted_outputs:
continue
emitted_outputs.add(out_name)
tf_attr = out_map.get(out_name, out_name)
main_tf_parts.append(_emit_output(out_name, f"{tf_type}.{rid}.{tf_attr}"))
if has_vpc:
@@ -629,8 +717,9 @@ def adapt(stack_instance, out_dir):
# P1-7: Emit stack-level outputs from the resolved composition outputs[].
# Each stack output has {"from": <resourceId>, "output": <outputName>}.
# We look up the resource type + OUTPUT_MAP to build the interpolation.
stack_outputs = stack_instance.get("outputs", {})
for out_name, out_spec in stack_outputs.items():
if out_name in emitted_outputs:
continue
src_rid = out_spec.get("from", "")
src_output = out_spec.get("output", out_name)
if src_rid in type_by_id:
@@ -639,6 +728,7 @@ def adapt(stack_instance, out_dir):
out_map = OUTPUT_MAP.get(src_rtype, {})
tf_attr = out_map.get(src_output, src_output)
main_tf_parts.append(_emit_output(out_name, f"{src_tf_type}.{src_rid}.{tf_attr}"))
emitted_outputs.add(out_name)
main_tf = "\n".join(main_tf_parts)
with open(os.path.join(out_dir, "main.tf"), "w") as fh: