continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity

docs(D-034): close the bootstrap root-key waiver (user deactivated it)

Browse Source 
---ci---
project: acdl
phase: 0
milestone: v1.1
status: complete
decision_closure:
  - D-034: root key AKIAYOZHMKZ772SINHFX deactivated by the user in the
    AWS IAM console. Verified: sts.get_caller_identity with the root key
    returns InvalidClientTokenId; the spike key acdl-spike-runner still
    works. D-034 is closed.
---/ci---

User confirmed the bootstrap root key (AKIAYOZHMKZ772SINHFX) was
deactivated in the AWS IAM console. Verified:
- Root key: InvalidClientTokenId (deactivated, as expected).
- Spike key (acdl-spike-runner): still live
  (arn:aws:iam::581513795199:user/acdl-spike-runner).

D-034 is closed. The v1.1 milestone is fully shipped + released (v1.2.0)
with no outstanding manual actions.
This commit is contained in:
Jon Chery
2026-07-21 20:32:07 +00:00
parent ab69d1069f
commit 6f865a6b3d
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.ciagent/PROJECT.md
+1 -1
View File
@@ -157,7 +157,7 @@ decisions:
| ID | Decision | Rationale | Outcome |
|----|----------|-----------|---------|
| D-034 | Temporary long-lived AWS key (waiver) used once in Phase 08 to bootstrap OIDC trust; rotated immediately after | §12.5 forbids long-lived creds; OIDC needs one bootstrapping `aws iam` call before the runner can assume a role | Spike achieves real `terraform plan` against AWS without violating the locked target after bootstrap |
| D-034 | Temporary long-lived AWS key (waiver) used once in Phase 08 to bootstrap the state backend + IAM user; rotated/deactivated immediately after | §12.5 forbids long-lived creds; the bootstrap needed one `aws iam` call before the spike user + rotated key could take over | Spike achieves real `terraform plan` against AWS without violating the locked target after bootstrap. **CLOSED 2026-07-21: root key `AKIAYOZHMKZ772SINHFX` deactivated by the user in the AWS IAM console (verified — `InvalidClientTokenId`); the spike uses the rotated `acdl-spike-runner` key per D-039.** |
| D-035 | Milestone version = `v1.1` (feature), ship tag `v1.2.0` | Real platform is a breaking reframing of the demo, but treated as the next incremental milestone per user choice; ship.md: feature milestone → next minor | Tag `v1.2.0` on milestone COMPLETE |
| D-036 | Spike picks `l1-s3` + `l2-static-asset` | Simplest real AWS resource (no IAM/network deps); smallest real `terraform plan`; proves the IR + adapter end-to-end | Spike scope fixed |
| D-037 | Demo archived to `demo/` (not deleted) | Preserves the working v1.0 demo as intent reference; new platform layout under `platform/`, `schemas/`, `adapters/`, `terraform/`, `modules-ir/` | No churn on demo code; clean separation |