From 7cccf989b1ad45aec01e278556566fbda54fa602 Mon Sep 17 00:00:00 2001 From: Jon Chery Date: Thu, 23 Jul 2026 12:04:08 +0000 Subject: [PATCH] =?UTF-8?q?audit(v1.9):=20PASS=20=E2=80=94=20ARCHITECTURE.?= =?UTF-8?q?md=20v1.9=20addendum=20+=20audit=20report?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ---ci--- phase: 43 milestone: v1.9 status: complete ---/ci--- Audit of the shipped v1.9 milestone: Reconstruction: PASS — 16 v1.9 commits, all with ---ci--- blocks; state reconstructs to milestone v1.9, phase 43, status complete. Decisions D-080..D-089 all present in git log + .ciagent/ files. File discipline: PASS — config.json, PROJECT.md, ROADMAP.md, REQUIREMENTS.md, REVIEW.md, PERSONAS.md, VERIFY.md all consistent. Fixed: ARCHITECTURE.md had no v1.9 coverage — added a v1.9 addendum covering all 9 new code components (contract_resolver interpolation, environment_check.load, hitl_gates, attestation_matrix, separation_of_duties.route_halt_artifact, WizClient, kyverno_adapter, per-env promotion, adapter parameterization) + the deferred D-083 items. Branch hygiene: PASS — only main (local + remote); all 5 v1.9 phase branches merged + pruned. Commit discipline: PASS — 16/16 commits with ---ci--- blocks; no stale implementation decisions; no unresolved v1.9 escalations. Audit result: PASS. --- .ciagent/ARCHITECTURE.md | 69 +++++++++++++++++++++++++++++++++++++++- .ciagent/AUDIT.md | 63 ++++++++++++++++++++++-------------- 2 files changed, 107 insertions(+), 25 deletions(-) diff --git a/.ciagent/ARCHITECTURE.md b/.ciagent/ARCHITECTURE.md index b51c261..587c716 100644 --- a/.ciagent/ARCHITECTURE.md +++ b/.ciagent/ARCHITECTURE.md @@ -443,4 +443,71 @@ terraform state directory, and publishes the uptime URL via PR comment. The platform Lambda (`contract_ingestor.py`) reads `GITHUB_API_BASE` env for forge-agnostic API URLs. GitHub uses `/search/issues`; Gitea uses -`/repos/{owner}/{repo}/issues`. Detection via `/api/v1` in the base URL. \ No newline at end of file +`/repos/{owner}/{repo}/issues`. Detection via `/api/v1` in the base URL. + +## v1.9 Addendum (2026-07-23) + +### New Components + +- **`core/contract_resolver.py` interpolation** (D-081): the resolver + now expands `${env.}` + `${contract.}` tokens + post-schema-validation, pre-IR-resolution. The env context is the + loaded environment onboarding JSON (`core/environments/.json`, + schema `schemas/environment.schema.json`). The resolver's + `child_input_map` routes L2 wires to the sub-resource that declares the + input (P1-1 — `desired_count` → `aws:ecs:service`, `family` → + `aws:ecs:task_definition`). +- **`core/environment_check.py` `load()`** (REQ-104): loads + returns the + parsed environment JSON; emits a stderr warning for placeholder + `account_id` when env != dev. +- **`core/hitl_gates.py`** (REQ-108, D-084): the HITL pre-execution + attestation gate. Records the approver identity to the DynamoDB outbox + (`approver_qa`/`approver_prod`/`approver_dr`), runs the separation-of- + duties check on prod, invokes the attestation matrix, returns + `(ok, reason)`. Dev skips (autonomous). `run_platform.sh` calls + `attest` before apply for qa/prod/dr. +- **`core/attestation_matrix.py`** (REQ-109, D-084): the 8-concern + attestation matrix from `hitl_matrix_design.md` §10.4. Offline-testable + concerns (contract NFRs, schema validity, policy pass) run for real; + operator-supplied concerns accept signed evidence artifacts validated + for freshness + schema. Signature verification skips when + `ACDL_ATTESTATION_SIGNING_KEY_ID` is unset (D-089). +- **`core/separation_of_duties.py` `route_halt_artifact`** (REQ-107): + real SNS publish (`acdl-sod-halt` topic, ARN from + `ACDL_SOD_HALT_TOPIC_ARN`) + outbox fallback + (`SEPARATION_OF_DUTIES_VIOLATION` event). The SNS topic is defined in + `terraform/platform/main.tf`. +- **`adapters/wiz/wiz_adapter.py` `WizClient`** (REQ-110): real GraphQL + API client (`/graphql`, Bearer auth, pagination via + `pageInfo.hasNextPage`). `fetch_and_adapt` translates issues → + `PolicyCheckResult`. Graceful degrade when unconfigured. +- **`adapters/kyverno/kyverno_adapter.py`** (REQ-111): fleshed-out + `PolicyReport` → `PolicyCheckResult` mapping (pass/fail/skip/warn + + severity + skip-with-reason + resource construction). Inactive-for-TF + guard preserved. + +### Per-Environment Promotion (D-082) + +The deploy workflow (`.github/workflows/deploy.yml` + +`.gitea/workflows/deploy.yml`, byte-identical) declares an `environment` +`workflow_call` input. When non-empty, `run_platform.sh --environment +` overrides the contract's `environment` field before schema +validation (D-088). One CI job per environment; promotion = running the +matching job, no `environment:` field editing. Per-env contract files +(`contracts/..yaml`) use interpolation for env-specific +values. + +### Adapter Parameterization (P1-1, D-085) + +The adapter (`adapters/terraform/adapter.py`) reads ECS/ALB/VPC defaults +from L1 `interface.json` inputs (`desired_count`, `launch_type`, +`family`, `target_type`, `load_balancer_type`, `name`). The adapter is a +thin translator; the `child_input_map` routes wires to the declaring +sub-resource. + +### Deferred (D-083) + +S3 Object Lock + JWS detached signatures + async worker + DLQ + daily +checkpoints (audit ledger build-out) — deferred to a future milestone. +The hash-chain + DynamoDB-outbox path remains the v1.9 production audit +record. \ No newline at end of file diff --git a/.ciagent/AUDIT.md b/.ciagent/AUDIT.md index a191ac2..9c2b30a 100644 --- a/.ciagent/AUDIT.md +++ b/.ciagent/AUDIT.md @@ -4,45 +4,60 @@ ## Step 1: Reconstruction Test -- 12 v1.9 commits with `---ci---` blocks (specify → clarify → research → - plan → execute ×4 phases → merge ×4 → verify/review/audit/complete). -- State matches config.json (milestone v1.9, status complete). -- PROJECT.md v1.9 objective + decisions D-080..D-086 + auto-resolved - parameters present. REQUIREMENTS.md REQ-100..111 + traceability table - present. ROADMAP.md v1.9 section + phases 39–43 present. +- 16 v1.9 commits with `---ci---` blocks (specify → clarify → research → + plan → execute ×4 phases → verify/complete → review-fix). +- Reconstructed state: milestone v1.9, phase 43, status complete. +- Pipeline stages traversed: specify → clarify → research → plan → execute → verify → complete. +- Decisions D-080..D-089 all present in git log + `.ciagent/` files. +- config.json (v1.9 complete), PROJECT.md (v1.9 complete), REQUIREMENTS.md + (v1.9 complete, 12 reqs), ROADMAP.md (v1.9 complete, phases 39–43), + REVIEW.md (READY TO SHIP), PERSONAS.md (v1.9), VERIFY.md, AUDIT.md. **PASS.** ## Step 2: File Discipline -- All 10 `.ciagent/` files valid (config.json, PROJECT.md, REQUIREMENTS.md, - ROADMAP.md, PLAN.md, RESEARCH.md, PERSONAS.md, REVIEW.md, VERIFY.md, - AUDIT.md). -- PERSONAS.md updated for v1.9 (milestone field, lambda-engineer - reactivated, phase-specific overrides for 39–43). -- REVIEW.md reconstructed with v1.9 content (D-086); note records v1.3–v1.8 - reviews were not persisted (no git-history rewrite). -**PASS.** +- `.ciagent/config.json`: valid JSON; mode, projects[] present. **PASS.** +- `.ciagent/PROJECT.md`: Vision/Core Value (≡ "What This Is"), Key + Decisions (v1.9 D-080..D-086), Requirements, Constraints, per-milestone + Objective sections (≡ "Milestones") present. Section names follow the + v1.0 established conventions (not the generic audit template). **PASS.** +- `.ciagent/ROADMAP.md`: phases 39–43 present; all marked complete. + **PASS.** +- `.ciagent/REQUIREMENTS.md`: v1.9 traceability table complete (12/12 + REQ-100..111 marked `complete (v1.9.0)`). **PASS.** +- `.ciagent/ARCHITECTURE.md`: **fixed during audit** — v1.9 addendum + added covering all new components (contract_resolver interpolation, + environment_check.load, hitl_gates, attestation_matrix, + separation_of_duties.route_halt_artifact, WizClient, kyverno_adapter, + per-environment promotion, adapter parameterization, deferred D-083). + All 9 v1.9 code components now referenced. **PASS (after fix).** ## Step 3: Branch Hygiene -- 5 v1.9 phase branches (phase/39..43) merged to main. They can be pruned - after the milestone tag. No milestone branch was used (single-project - mode, main is the integration branch per the v1.8 precedent). -- Only main + origin/main + the 5 phase branches remain. +- Local: `main` only. Remote: `origin/main` only. +- No phase or milestone branches remain (all 5 v1.9 phase branches merged + + pruned during the run/ship workflow). +- No orphan branches. **PASS.** ## Step 4: Commit Discipline -- 12/12 v1.9 commits have `---ci---` blocks with project, phase, milestone, +- 16/16 v1.9 commits have `---ci---` blocks with project/phase/milestone/ status fields. -- No stale decisions; D-080..D-086 recorded in PROJECT.md; D-087..D-089 - recorded in RESEARCH.md. -- No secrets in commits (SNS topic ARN is a Terraform output, not a - literal; Wiz/KMS/SNS env-var-based). +- No stale implementation decisions (D-081..D-085, D-087..D-089 all have + code refs; D-080 + D-086 are process/meta decisions correctly living in + `.ciagent/` files). +- No unresolved v1.9 escalations (the 3 `audit(...)` commits in history + are from prior milestones v1.0/v1.6/v1.7). **PASS.** ## Issues fixed during audit -None — the milestone is clean as shipped. +1. **ARCHITECTURE.md missing v1.9 addendum** — the architecture doc had + no coverage of the v1.9 new components (hitl_gates, attestation_matrix, + interpolation, per-env promotion, adapter parameterization, Wiz/Kyverno + flesh-outs). Fixed: added a v1.9 addendum section covering all 9 new + code components + the per-env promotion model + the deferred D-083 + items. Verified all 9 components now referenced. ## Audit result: PASS \ No newline at end of file