continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity

docs(P22-38): research findings + 6 phase plans

Browse Source 
---ci---
project: acdl
phase: 22-38
milestone: v1.8
status: research
---/ci---

v1.8 research: 6 targets investigated + 5 decisions surfaced (D-073..D-077).

TARGET 1: uptime-kuma on ECS Fargate (image louislam/uptime-kuma:1,
port 3001, EFS volume, ALB, monitor seeding via post-deploy API script).
TARGET 2: Terraform prevent_destroy lifecycle (2-step decommission pattern).
TARGET 3: AWS KMS rotation (enable_key_rotation=true, annual AWS-managed;
90-day is roadmap item D-075).
TARGET 4: Forge-agnostic API URLs (GITHUB_API_BASE + _forge_type helper).
TARGET 5: DynamoDB as CMDB (acdl-change-requests table + validate_change_request).
TARGET 6: Module engineering standards scan (codified patterns from 12 modules).

PERSONAS.md updated for v1.8: lambda-engineer reactivated (D-068 CMDB +
D-065 API portability). 11 phase-specific overrides added.
This commit is contained in:
Jon Chery
2026-07-22 22:01:13 +00:00
parent 60f2b669ea
commit 7f1eff622d
2 changed files with 285 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.ciagent/PERSONAS.md
+26 -15
View File
@@ -1,6 +1,6 @@
---
project: acdl
milestone: v1.7
milestone: v1.8
generated_at: 2026-07-22
generator: lead-developer
verification_toolchain:
@@ -16,7 +16,7 @@ verification_toolchain:
ci-* agents read PERSONAS.md before running verification commands.
---
# ACDL — Persona Roster (project-level, v1.7)
# ACDL — Persona Roster (project-level, v1.8)
## Active personas
@@ -56,14 +56,14 @@ verification_toolchain:
- **Territory:** `core/hitl_matrix_design.md`, `core/audit_ledger_design.md`, `adapters/terraform/policy/**` (Checkov adapter + custom rules), `adapters/wiz/**` (Wiz adapter), `adapters/kyverno/**` (Kyverno adapter + sample policies), `core/separation_of_duties.py`, `schemas/tagging-standard.json`, `schemas/policy_check_result.schema.json` (engine enum)
- **Reason:** Owns the HITL matrix design, separation-of-duties, the audit ledger design, the Checkov→PolicyCheckResult adapter + the custom tagging rule (D-054, D-043 closure), the Wiz adapter (D-052), the Kyverno adapter (D-053), and the tagging standard. Enforces the "Safety is Computed, Not Assumed" + "Audit truth lives outside the repository" vision tenets.
### lambda-engineer (custom, v1.7)
### lambda-engineer (custom, v1.8)
- **Domain:** serverless
- **Active:** true
- **Phase-specific:** true (created for v1.7; removed after milestone COMPLETE)
- **Frameworks:** python, aws-lambda, boto3, dynamodb, aws-secretsmanager, github-api
- **Constraints:** lambda-is-stateless, dynamodb-is-the-state-store, secrets-from-secrets-manager-never-logged, idempotent-actions, cross-account-iam-via-abac
- **Territory:** `core/lambda/**` (contract_ingestor.py + handler), `terraform/platform/main.tf` (Lambda + Function URL + DynamoDB + KMS + Secrets Manager + IAM), `terraform/platform/consumer_invoke_policy.json`
- **Reason:** Owns the platform Lambda for contract ingestion (D-051) + error reporting (D-055). The Lambda is stateless; all state is in DynamoDB. The Lambda holds a GitHub token (Secrets Manager) scoped to the platform repo. Cross-account invocation is scoped via ABAC. Created for v1.7; the role is removed from the roster after milestone COMPLETE (the code persists, but the persona is no longer active).
- **Phase-specific:** true (reactivated for v1.8; removed after milestone COMPLETE)
- **Frameworks:** python, aws-lambda, boto3, dynamodb, aws-secretsmanager, github-api, gitea-api
- **Constraints:** lambda-is-stateless, dynamodb-is-the-state-store, secrets-from-secrets-manager-never-logged, idempotent-actions, cross-account-iam-via-abac, forge-agnostic-api-urls
- **Territory:** `core/lambda/**` (contract_ingestor.py + handler), `terraform/platform/main.tf` (Lambda + Function URL + DynamoDB + KMS + Secrets Manager + IAM + acdl-change-requests table), `terraform/platform/consumer_invoke_policy.json`, `terraform/platform/variables.tf`
- **Reason:** Reactivated for v1.8 Phase 29 (Terraform-rendered invoke policy), Phase 30 (forge-agnostic API URLs in contract_ingestor.py), Phase 34 (validate_change_request Lambda action + acdl-change-requests DynamoDB table). The Lambda is stateless; all state is in DynamoDB. Forge-agnostic API URLs (GitHub + Gitea) via GITHUB_API_BASE env var. Removed from the roster after milestone COMPLETE (the code persists, but the persona is no longer active).
### frontend-engineer
- **Domain:** frontend
@@ -96,18 +96,29 @@ verification_toolchain:
| Phase | Personas active | Notes |
|-------|------------------|-------|
| 22 rename-and-production-static-assets-stack | lead-developer, platform-engineer (lead: rename + cloudfront/waf primitives + adapter), backend-engineer (contract schema + pipelines), security-engineer (review new primitives) | lambda/frontend idle |
| 23 tagging-standards-and-security-adapters | security-engineer (lead: tagging rule + Wiz + Kyverno), platform-engineer (custom rule loading), backend-engineer (schema enum) | lambda/frontend idle |
| 24 platform-lambda-and-contract-ingestion | lambda-engineer (lead: Lambda + DynamoDB + Terraform), platform-engineer (Terraform infra review), security-engineer (cross-account IAM review), backend-engineer (onboarding docs) | frontend idle |
| 25 deploy-pipeline-dx-outputs-and-error-reporting | backend-engineer (lead: outputs + stage comments + error-report step), lambda-engineer (report_error action), security-engineer (no-secrets-in-logs review) | platform/frontend idle |
| 26 platform-pipelines-and-release-automation | backend-engineer (lead: 3 pipelines + release job), lead-developer (verification scripts) | platform/security/lambda/frontend idle |
| 27 remove-legacy-consumer-repos-and-module-documentation-examples | lead-developer (lead: examples + docs), platform-engineer (RDS primitive + adapter), backend-engineer (schema-validation) | security/lambda/frontend idle |
| 28 adapter-waf-and-resolver-outputs | platform-engineer (lead: WAF HCL fix + adapter output blocks), backend-engineer (resolver outputs processing) | security/lambda/frontend idle |
| 29 ssm-kms-and-invoke-policy | backend-engineer (lead: SSM fail-loud), lambda-engineer (Terraform-rendered invoke policy), security-engineer (CMK enforcement review) | platform/frontend idle |
| 30 run-platform-isolation-and-api-portability | backend-engineer (lead: run_platform.sh temp dir + deploy.yml static-key), lambda-engineer (forge-agnostic API URLs) | platform/security/frontend idle |
| 31 encryption-by-default-and-per-stack-cmk | platform-engineer (lead: kms-key primitive + adapter expansion + L2 wiring), security-engineer (encryption NFR enforcement review) | backend/lambda/frontend idle |
| 32 deletion-protection-by-default-and-l2-feature-flag | platform-engineer (lead: prevent_destroy emission + L2 feature flag), backend-engineer (contract schema update) | security/lambda/frontend idle |
| 33 uptime-kuma-primitive | platform-engineer (lead: uptime primitive + adapter + separate state), backend-engineer (deploy-uptime pipeline stage + run_platform.sh + PR comment) | security/lambda/frontend idle |
| 34 decommission-alias-and-cmdb-validation | backend-engineer (lead: decommission pipeline mode + run_platform.sh + consumer docs), lambda-engineer (validate_change_request + acdl-change-requests table), security-engineer (HITL SRE gates review) | platform/frontend idle |
| 35 module-engineering-standards | lead-developer (lead: STANDARDS.md + catalog fix + template), platform-engineer (standards content review), backend-engineer (automated standards test) | security/lambda/frontend idle |
| 36 schemas-adapters-pipelines-readmes | lead-developer (lead: 3 READMEs), backend-engineer (pipelines + schemas README content), platform-engineer (adapters README content) | security/lambda/frontend idle |
| 37 verify | lead-developer (lead: 4-layer verification), all personas (review their territory) | — |
| 38 review-audit-complete | lead-developer (lead: review + audit + milestone completion), all personas (review participation) | — |
## Domain priority (used by TaskDecomposer)
`coordination → security → platform → backend → lambda → frontend`
Rationale: in v1.7, the security commitments (tagging, Wiz, Kyverno, cross-account IAM) and the platform commitments (CloudFront, WAF, RDS, Lambda, DynamoDB) are the binding constraints; backend wires the pipeline + outputs; lambda owns the ingestion + error reporting; frontend surfaces the evidence (unchanged from v1.0).
Rationale: in v1.8, the security commitments (encryption by default,
KMS rotation, deletion protection, CMDB validation, HITL SRE gates)
and the platform commitments (kms-key primitive, uptime primitive,
adapter expansion, prevent_destroy emission) are the binding
constraints; backend wires the pipeline + decommission mode + API
portability; lambda owns the CMDB validation + forge-agnostic APIs;
frontend is unchanged from v1.0 (evidence timeline).
## Conflict resolutions (lead-developer arbitration)