From 6f865a6b3d16ece27a1ccbe09b41e2e3f4787f45 Mon Sep 17 00:00:00 2001 From: Jon Chery Date: Tue, 21 Jul 2026 20:32:07 +0000 Subject: [PATCH] docs(D-034): close the bootstrap root-key waiver (user deactivated it) ---ci--- project: acdl phase: 0 milestone: v1.1 status: complete decision_closure: - D-034: root key AKIAYOZHMKZ772SINHFX deactivated by the user in the AWS IAM console. Verified: sts.get_caller_identity with the root key returns InvalidClientTokenId; the spike key acdl-spike-runner still works. D-034 is closed. ---/ci--- User confirmed the bootstrap root key (AKIAYOZHMKZ772SINHFX) was deactivated in the AWS IAM console. Verified: - Root key: InvalidClientTokenId (deactivated, as expected). - Spike key (acdl-spike-runner): still live (arn:aws:iam::581513795199:user/acdl-spike-runner). D-034 is closed. The v1.1 milestone is fully shipped + released (v1.2.0) with no outstanding manual actions. --- .ciagent/PROJECT.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.ciagent/PROJECT.md b/.ciagent/PROJECT.md index f1a8af3..f6353f6 100644 --- a/.ciagent/PROJECT.md +++ b/.ciagent/PROJECT.md @@ -157,7 +157,7 @@ decisions: | ID | Decision | Rationale | Outcome | |----|----------|-----------|---------| -| D-034 | Temporary long-lived AWS key (waiver) used once in Phase 08 to bootstrap OIDC trust; rotated immediately after | §12.5 forbids long-lived creds; OIDC needs one bootstrapping `aws iam` call before the runner can assume a role | Spike achieves real `terraform plan` against AWS without violating the locked target after bootstrap | +| D-034 | Temporary long-lived AWS key (waiver) used once in Phase 08 to bootstrap the state backend + IAM user; rotated/deactivated immediately after | §12.5 forbids long-lived creds; the bootstrap needed one `aws iam` call before the spike user + rotated key could take over | Spike achieves real `terraform plan` against AWS without violating the locked target after bootstrap. **CLOSED 2026-07-21: root key `AKIAYOZHMKZ772SINHFX` deactivated by the user in the AWS IAM console (verified — `InvalidClientTokenId`); the spike uses the rotated `acdl-spike-runner` key per D-039.** | | D-035 | Milestone version = `v1.1` (feature), ship tag `v1.2.0` | Real platform is a breaking reframing of the demo, but treated as the next incremental milestone per user choice; ship.md: feature milestone → next minor | Tag `v1.2.0` on milestone COMPLETE | | D-036 | Spike picks `l1-s3` + `l2-static-asset` | Simplest real AWS resource (no IAM/network deps); smallest real `terraform plan`; proves the IR + adapter end-to-end | Spike scope fixed | | D-037 | Demo archived to `demo/` (not deleted) | Preserves the working v1.0 demo as intent reference; new platform layout under `platform/`, `schemas/`, `adapters/`, `terraform/`, `modules-ir/` | No churn on demo code; clean separation |