From 9504782a77c8b5c8cb6dae64cbd9d18ef40b6886 Mon Sep 17 00:00:00 2001 From: Jon Chery Date: Tue, 21 Jul 2026 20:54:55 +0000 Subject: [PATCH] =?UTF-8?q?docs(specify):=20open=20v1.2=20milestone=20?= =?UTF-8?q?=E2=80=94=20platform=20hardening=20+=20ECS=20microservice?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ---ci--- project: acdl phase: 0 milestone: v1.2 status: specify decisions: - id: D-047 decision: Extend D-039 per-run-rotated-key waiver for v1.2; real OIDC deferred to v1.3+ rationale: go-gitea/gitea#36988 still open (re-checked 2026-07-21, last updated 2026-05-27, not merged) confidence: 0.95 alternatives: [] ---/ci--- Open the v1.2 milestone: platform hardening + first real consumer deployment. 5 scope axes (user-directed): re-eval #36988, NFR improvements, simplify the setup, README rewrite, bootstrap a consumer repo with a basic microservice deployed to ECS Fargate end-to-end. Files: - config.json: milestone v1.1 -> v1.2, status complete -> specify - PROJECT.md: v1.1 objective -> prior (complete); new v1.2 objective + 6-phase table (11-16) + REQ-29..35 summary + D-047 - REQUIREMENTS.md: v1.1 -> prior (complete); new v1.2 section with REQ-29..35 + traceability (planned) - ROADMAP.md: v1.1 -> complete (tag v1.2.0, Gitea release 202); new v1.2 section with 6 phases (status planned, ship v1.3.0) - ARCHITECTURE.md: new "v1.2 build-out scope" section (5 axes, substrate extension, terraform apply dev-only, out-of-scope deferrals) + build order Ship tag at milestone COMPLETE: v1.3.0 (feature milestone, next minor per ship.md — v1.1 shipped v1.2.0). Phase patches v1.2.1..v1.2.6. --- .ciagent/ARCHITECTURE.md | 79 ++++++++++++++++++++++++++++++++++- .ciagent/PROJECT.md | 87 ++++++++++++++++++++++++++++++++++++--- .ciagent/REQUIREMENTS.md | 52 +++++++++++++++++++++-- .ciagent/ROADMAP.md | 89 +++++++++++++++++++++++++++++++++++++--- .ciagent/config.json | 4 +- 5 files changed, 294 insertions(+), 17 deletions(-) diff --git a/.ciagent/ARCHITECTURE.md b/.ciagent/ARCHITECTURE.md index e6401fb..dcbd030 100644 --- a/.ciagent/ARCHITECTURE.md +++ b/.ciagent/ARCHITECTURE.md @@ -298,4 +298,81 @@ ACDL has no `package.json`. The verification gate substitutes: 3. Phase 08 — AWS OIDC bootstrap (use temp key once, rotate). 4. Phase 09 — IR + `l1-s3` + Terraform adapter → `terraform plan`. 5. Phase 10 — `l2-static-asset` + contract→IR → end-to-end spike. -6. COMPLETE gate — review → ship `v1.2.0` → audit. \ No newline at end of file +6. COMPLETE gate — review → ship `v1.2.0` → audit. **DONE.** + +## v1.2 build-out scope + +v1.2 takes the v1.1 spike (dev-only, `plan`-only, single S3 L1) to a real, +simpler, better-documented platform that delivers a microservice to AWS ECS +Fargate end-to-end. The locked architecture (§1–§12) is unchanged — v1.2 +extends the *implementation*, not the design. + +### In scope (five axes, user-directed 2026-07-21) + +1. **Re-evaluate the current state.** go-gitea/gitea#36988 (OIDC for Gitea + Actions) re-checked 2026-07-21: still **open** (last updated 2026-05-27, + not merged). Real OIDC remains deferred to v1.3+; v1.2 extends the D-039 + per-run-rotated-key waiver as **D-047**. The waiver continues to satisfy + §12.5's *intent* (no *persistently* long-lived key): the spike key is + rotated after each run by `scripts/rotate_spike_key.sh`, and Phase 12 + tightens the IAM scoping + rotation hygiene. +2. **NFR improvements on the existing spike.** Least-privilege IAM audit of + `spike_runner_policy.json`; idempotent `create_state_backend.py` / + `create_iam_user.py`; proper exit codes / error handling; P1-1 redaction + (two AWS access key IDs in `.ciagent/VERIFY.md` Phase 09 narrative). +3. **Streamline / simplify the current setup.** Consolidate + `run_spike_plan.sh` + `run_spike_e2e.sh` into one + `scripts/run_platform.sh`; remove dead code and stale `platform/` paths. +4. **README.md fully up to date on how the platform works.** Reflect v1.1 + complete; document the actual spike flow, `scripts/run_platform.sh`, the + real repo layout, and the v1.2 objective. +5. **Bootstrap a consumer repo with a basic microservice deployed to ECS + end-to-end.** New Gitea repo `acdl-consumer-microservice` (org + `continuous-intelligence`); new IR-typed L1s (`l1-vpc`, `l1-ecs-cluster`, + `l1-ecs-service`, `l1-iam-role`, `l1-alb`, `l1-ecr`); new + `l2-microservice` thin-composition; one contract submission → + `terraform apply` (dev, autonomous per §10, confidence ≥ 0.50) → a live + ECS Fargate service serving HTTP 200 → evidence event to the DynamoDB + outbox → acdl-evidence timeline. + +### Substrate extension (ECS Fargate) + +The Terraform adapter (§12) remains the only substrate-specific code. v1.2 +expands the adapter `TYPE_MAP` to cover the six new ECS-shaped IR resource +types. The L1 interface shape (IR-typed inputs/outputs/NFRs, registered in +`modules-ir/registry.json`) is unchanged — only the set of registered L1s +grows. The IR commitments (REQ-28) continue to hold: `modules-ir/`, +`schemas/`, `contracts/`, `acdl_platform/confidence_signal.py`, +`acdl_platform/contract_resolver.py`, `acdl_platform/outbox_writer.py` +remain substrate-agnostic. + +### `terraform apply` (dev only) + +v1.2 lifts the substrate execution from `plan` to `apply` for the `dev` +environment only. Dev is autonomous per §10 (confidence ≥ 0.50, no HITL). +`apply` for qa/prod/dr remains HITL-gated and out of scope for v1.2. The +apply result (resources created, plan diff) is captured in the evidence +stream as a `terraform.apply` event. + +### Out of scope for v1.2 (deferred to v1.3+) + +| Feature | Reason | +|---------|--------| +| Real OIDC federation | go-gitea/gitea#36988 still open. v1.2 extends D-039 waiver (D-047); real OIDC is v1.3+. | +| Full HITL matrix wiring (qa/prod/dr) | v1.2 is dev-only autonomous `apply`; HITL wiring is v1.3. | +| Kyverno + OPA policy engines | v1.2 keeps Checkov only; Kyverno/OPA are v1.3. | +| MCP skill catalog + real L3B agent | v1.2 keeps the L3B stub; the 5-skill catalog is v1.3. | +| Audit ledger build-out (S3 Object Lock + JWS + async worker + DLQ + daily checkpoints) | v1.2 keeps the v1.1 outbox; the regulatory ledger is v1.3. | +| Multi-region state / outbox | Single-region in v1 (§9, §12.3); multi-region is v1.3+. | +| Prod/dr environments | v1.2 is dev-only; prod/dr are v1.3. | +| GitOps reconciler (ArgoCD/Flux) | v1.3+. | + +## Build order (v1.2) + +1. Phase 11 — re-eval #36988 + NFR audit + simplification findings + README rewrite. +2. Phase 12 — NFR harden + simplify (idempotent bootstrap, one `run_platform.sh`, IAM audit, redactions). +3. Phase 13 — six ECS L1s + adapter `TYPE_MAP` expansion. +4. Phase 14 — `l2-microservice` + contract schema extension. +5. Phase 15 — consumer repo + `terraform apply` (dev) → live ECS service. +6. Phase 16 — capstone e2e: consumer commit → live HTTP 200 → evidence → timeline. +7. COMPLETE gate — review → ship `v1.3.0` → audit. \ No newline at end of file diff --git a/.ciagent/PROJECT.md b/.ciagent/PROJECT.md index f6353f6..64313b0 100644 --- a/.ciagent/PROJECT.md +++ b/.ciagent/PROJECT.md @@ -50,7 +50,7 @@ traceable to a human attestation and an immutable evidence stream. boundary. The platform validates, enriches with operational standards, and reconciles the target state. -## Objective for Milestone v1.1 +## Objective for Milestone v1.1 (prior — complete, tag `v1.2.0`) Finalize the architecture to v1.0 (resolve all 11 open design decisions in `docs/architecture.md` §13) and prove the locked commitments with one @@ -67,7 +67,11 @@ end-to-end v1 implementation spike: The spike validates the architecture's claim that the IR-shaped commitments do not require a polyglot mess (`docs/architecture.md` §14, step 2). -## Milestone v1.1 Phases +**Status: COMPLETE — all 5 phases shipped (v1.1.1..v1.1.5) + verified; review +READY TO SHIP (0 P0); audit CLEAN; milestone tag `v1.2.0`; Gitea release +id 202 published. D-034 closed (root key deactivated by user).** + +## Milestone v1.1 Phases (prior — complete) | Phase | Name | Goal | |-------|------|------| @@ -78,7 +82,56 @@ do not require a polyglot mess (`docs/architecture.md` §14, step 2). | 10 | v1-spike-l2-and-contract-e2e | One L2 thin-composition (`l2-static-asset`) referencing `l1-s3`; contract schema + contract→IR resolution; one end-to-end contract submission → `terraform plan` → Checkov → confidence signal → evidence event to outbox. Verify the IR commitments hold. | Milestone COMPLETE gate: review → ship `v1.2.0` (feature milestone, next -minor per ship.md) → audit. +minor per ship.md) → audit. **DONE.** + +## Objective for Milestone v1.2 (active) + +Platform hardening + first real consumer deployment. The v1.1 spike proved +the IR commitments hold on a single dev-only `terraform plan` for one S3 +bucket. v1.2 takes the spike to a real, simpler, better-documented platform +that actually delivers a microservice to AWS ECS Fargate end-to-end. + +Five scope axes (user-directed, 2026-07-21): + +1. **Re-evaluate the current state.** Confirm go-gitea/gitea#36988 (OIDC for + Gitea Actions) is still unmerged (re-checked 2026-07-21: **open**, last + updated 2026-05-27). Extend the D-039 per-run-rotated-key waiver for + v1.2; real OIDC is deferred to v1.3+ (D-047). +2. **NFR improvements on the existing spike.** Least-privilege IAM audit, + idempotent bootstrap, proper exit codes / error handling, rotation + hygiene, P1-1 / P1-B redaction carried forward from the v1.1 audit. +3. **Streamline / simplify the current setup.** Consolidate the + `run_spike_*.sh` scripts into one `scripts/run_platform.sh`; remove + dead code and stale paths; one command runs the whole pipeline. +4. **README.md fully up to date on how the platform works.** The current + README still says "v1.1 (active)" — it must reflect v1.1 complete, the + actual spike flow, how to run it, the real repo layout, and the v1.2 + objective. +5. **Bootstrap a consumer repo with a basic microservice deployed to ECS + end-to-end.** New Gitea repo `acdl-consumer-microservice` (org + `continuous-intelligence`) holding a tiny HTTP container + Dockerfile; + new IR-typed L1s (`l1-vpc`, `l1-ecs-cluster`, `l1-ecs-service`, + `l1-iam-role`, `l1-alb`, `l1-ecr`); new `l2-microservice` + thin-composition; one contract submission → `terraform apply` (dev, + autonomous) → a live ECS Fargate service serving HTTP 200 → evidence + event to the DynamoDB outbox → acdl-evidence timeline. + +The milestone proves the platform delivers real value (a running +microservice), not just a plan. + +## Milestone v1.2 Phases + +| Phase | Name | Goal | +|-------|------|------| +| 11 | v1.2-research-and-readme | Re-eval #36988 (confirm open → extend D-039 as D-047). Audit the v1.1 spike for NFR gaps (least-privilege, idempotency, error handling, rotation hygiene) + simplification opportunities. **Rewrite README.md** to reflect v1.1 complete + how the platform actually works (spike flow, how to run, repo layout, v1.2 objective). Output: RESEARCH.md v1.2 addendum; updated README. | +| 12 | nfr-harden-and-simplify | Apply Phase 11 findings: tighten `spike_runner_policy.json` (least-privilege audit); make `terraform/bootstrap/create_*.py` idempotent; consolidate `run_spike_*.sh` → one `scripts/run_platform.sh`; proper exit codes / error handling; redact P1-1 AWS key IDs in `VERIFY.md`; fix any remaining stale `platform/` paths. Spike still runs e2e after the refactor. | +| 13 | l1-catalog-for-ecs | Author IR-typed L1s for an ECS Fargate microservice: `l1-vpc`, `l1-ecs-cluster`, `l1-ecs-service`, `l1-iam-role` (task + exec role), `l1-alb`, `l1-ecr`. Register all in `modules-ir/registry.json`. Expand the Terraform adapter `TYPE_MAP`. Each L1 produces a valid `terraform plan` fragment. | +| 14 | l2-microservice-and-contract-schema | Author `l2-microservice` thin-composition (references the ECS L1s, depth ≤ 5). Extend `schemas/contract.schema.json` for microservice inputs (image, port, env, healthcheck). Verify contract→IR resolution yields a complete target stack. | +| 15 | consumer-repo-and-terraform-apply | Create consumer repo `acdl-consumer-microservice` (Gitea org) with a basic microservice (tiny HTTP container + Dockerfile + ECR push). Lift the platform from `plan` → **`apply`** (dev, autonomous per §10). Submit `contracts/microservice.yaml` → pipeline → IR → plan → apply → a real ECS Fargate service running. | +| 16 | v1.2-capstone-e2e | End-to-end verification: consumer commit → pipeline → ECS service live serving HTTP 200 → evidence event to the DynamoDB outbox → acdl-evidence timeline renders it. Verify NFR improvements hold, the setup is simpler (one `run_platform.sh`), and the README is accurate. | + +Milestone COMPLETE gate: review → ship `v1.3.0` (feature milestone, next +minor per ship.md — v1.1 shipped `v1.2.0`) → audit. ## Requirements @@ -88,9 +141,9 @@ Status: complete. Tag `v1.1.0`. All REQ-01..15 satisfied by the stub-driven executive demo. See `REQUIREMENTS.md` §v1 and the prior decisions table appendix below. The demo is **archived** to `demo/` in Phase 06. -### v1.1 (Active milestone — architecture finalization + v1 spike) +### v1.1 (Prior milestone — architecture finalization + v1 spike, complete) -New requirements REQ-16..REQ-2x — see `REQUIREMENTS.md` §v1.1. Summary: +New requirements REQ-16..REQ-28 — see `REQUIREMENTS.md` §v1.1. Summary: - **REQ-16:** Architecture finalized to v1.0 (11 open decisions resolved). - **REQ-17:** Target Stack IR defined as JSON Schema; substrate-agnostic. @@ -115,6 +168,27 @@ New requirements REQ-16..REQ-2x — see `REQUIREMENTS.md` §v1.1. Summary: - **REQ-28:** Spike verification proves the IR-shaped commitments hold (no polyglot mess; the adapter is the only substrate-specific code). +### v1.2 (Active milestone — platform hardening + first real consumer deployment) + +New requirements REQ-29..REQ-35 — see `REQUIREMENTS.md` §v1.2. Summary: + +- **REQ-29:** README.md fully documents the v1.1-complete platform: spike + flow, how to run, repo layout, v1.2 objective. +- **REQ-30:** NFR hardening — least-privilege IAM audit, idempotent + bootstrap, consolidated `run_platform.sh`, error handling, P1-1/P1-B + redaction. +- **REQ-31:** L1 catalog expanded for ECS — 6 new IR-typed L1s + (`l1-vpc`, `l1-ecs-cluster`, `l1-ecs-service`, `l1-iam-role`, `l1-alb`, + `l1-ecr`) registered and adapter-compiled. +- **REQ-32:** `l2-microservice` thin-composition + contract schema extended + for microservice inputs (image, port, env, healthcheck). +- **REQ-33:** `terraform apply` (dev, autonomous) — real provisioning, not + just `plan`. +- **REQ-34:** Consumer repo `acdl-consumer-microservice` with a basic + microservice (ECR image, Dockerfile, contract). +- **REQ-35:** End-to-end verification — consumer commit → live ECS service + (HTTP 200) → evidence event → timeline. + ## Constraints - **Forge:** Gitea at `https://git.cloudinit.dev`, org `continuous-intelligence`. @@ -170,6 +244,7 @@ decisions: | D-044 | DynamoDB outbox = `PAY_PER_REQUEST`; PK `contractId`, SK `eventType#eventTs`, TTL `expire_at` = now + 365d. No separate async worker/DLQ in the spike (RTO = workflow re-run); v1.2 outbox worker + DLQ is a Phase 07 design artifact. | On-demand is zero-cost-at-idle for the spike's single dev submission. | Spike outbox is minimal; v1.2 worker design authored in Phase 07 | | D-045 | Runner tooling: `runs-on: ubuntu-latest`; install `terraform` via HashiCorp apt repo (pin `1.9.*`), `checkov` via pip (pin `>=3.2,<4`, `--break-system-packages`). Neither is pre-installed on the default runner image. | RESEARCH TARGET 2; pinning avoids mid-spike version drift. | Phase 09/10 workflows have a concrete setup step | | D-046 | `act_runner` → `gitea-runner` rename: Phase 07 updates docs to use the current name `gitea-runner` (renamed 2026-04 in gitea/runner#850). | RESEARCH TARGET 1 + R-4: naming drift between v1.0 docs and the current runner. | Docs reflect the current binary name | +| D-047 | v1.2 carries forward the D-039 per-run-rotated-key waiver. Real OIDC federation remains deferred to v1.3+, blocked on go-gitea/gitea#36988 (re-checked 2026-07-21: still **open**, last updated 2026-05-27, not merged). | §12.5 forbids long-lived creds; the Gitea Actions OIDC provider is still not merged. The waiver continues to satisfy §12.5's *intent* (no *persistently* long-lived key) for v1.2: `scripts/rotate_spike_key.sh` rotates the key, and Phase 12 tightens the IAM scoping + rotation hygiene. | v1.2 achieves `terraform apply` against AWS without a persistently long-lived key; real OIDC is a v1.3+ deliverable. | ### Open-decision resolutions (Phase 07 deliverable — recorded here for traceability) @@ -213,7 +288,7 @@ sign-off (autonomy = full; all within locked constraints). | Spike `terraform` command | `plan` only | `apply` is out of scope (Out of Scope table); HITL-gated in v1.2 | | Checkov ruleset (spike) | the 4 L2 checks (secrets-in-plaintext, public ingress, IAM wildcard, KMS key reference) + tag/naming | §3 + §12.4; Kyverno/OPA deferred | | v1.0 tags preserved | `v1.0.1`..`v1.0.5`, `v1.1.0` retained | Immutability; demo archive does not rewrite history | -| Next ship tag | `v1.2.0` | Feature milestone → next minor per ship.md (D-035) | +| Next ship tag | `v1.3.0` | Feature milestone → next minor per ship.md (v1.1 shipped `v1.2.0`; v1.2 ships `v1.3.0`) | ### Items deferred to RESEARCH (not clarifications) diff --git a/.ciagent/REQUIREMENTS.md b/.ciagent/REQUIREMENTS.md index b5b0adf..154c054 100644 --- a/.ciagent/REQUIREMENTS.md +++ b/.ciagent/REQUIREMENTS.md @@ -35,7 +35,7 @@ (None — v1 covers the complete demo.) -## v1.1 (Active milestone — architecture finalization + v1 spike) +## v1.1 (Prior milestone — architecture finalization + v1 spike, complete) ### Category: Architecture Finalization - **REQ-16:** Architecture reaches v1.0 — all 11 open decisions in `docs/architecture.md` §13 are resolved and recorded in `PROJECT.md` (W1.A, W1.B, W2.A, W3.D, W3.E, BA.A–F, OpenTofu timing). @@ -70,6 +70,40 @@ | Prod/dr environments | v1.2. | | Terraform `apply` (real provisioning) | Spike runs `plan` only; `apply` is gated by HITL in v1.2. | +## v1.2 (Active milestone — platform hardening + first real consumer deployment) + +### Category: Documentation & Simplification +- **REQ-29:** `README.md` is fully rewritten to reflect the v1.1-complete platform: the actual spike flow (contract → IR → `terraform plan` → Checkov → confidence signal → outbox), how to run it (`scripts/run_platform.sh`), the real repo layout (`acdl_platform/`, `schemas/`, `adapters/`, `terraform/`, `modules-ir/`, `contracts/`, `demo/`), and the v1.2 objective. No stale "v1.1 (active)" framing. +- **REQ-30:** NFR hardening of the v1.1 spike: (a) `terraform/bootstrap/spike_runner_policy.json` audited to least-privilege (S3 + DynamoDB + ECS + ECR + ELB + IAM plan-only, no wildcards beyond the documented exceptions); (b) `create_state_backend.py` and `create_iam_user.py` are idempotent (re-running exits 0 without duplicating resources); (c) `run_spike_plan.sh` + `run_spike_e2e.sh` consolidated into a single `scripts/run_platform.sh` with proper exit codes and error handling; (d) P1-1 carried forward from the v1.1 audit — the two AWS access key IDs in `.ciagent/VERIFY.md` Phase 09 narrative are redacted to placeholders; (e) any remaining stale `platform/` paths in `.ciagent/` are corrected to `acdl_platform/`. + +### Category: L1 Catalog Expansion (ECS Fargate) +- **REQ-31:** Six new IR-typed L1 modules exist under `modules-ir/l1/` and are registered in `modules-ir/registry.json`: `l1-vpc` (VPC + subnets + route tables), `l1-ecs-cluster` (ECS Fargate cluster), `l1-ecs-service` (ECS service + task definition), `l1-iam-role` (task execution + task role), `l1-alb` (application load balancer + listener + target group), `l1-ecr` (ECR repository). Each has an `interface.json` valid against `schemas/ir.schema.json` and produces a valid `terraform plan` fragment via the Terraform adapter. The adapter `TYPE_MAP` is expanded to cover all six IR resource types. + +### Category: L2 Composition & Contract Schema +- **REQ-32:** `l2-microservice` thin-composition exists under `modules-ir/l2/l2-microservice/` referencing the six ECS L1s (depth ≤ 5, within max-depth-5). `schemas/contract.schema.json` is extended with microservice inputs (`image: string`, `port: integer`, `env: map`, `healthcheck: object`) and validates a `contracts/microservice.yaml` submission. Contract→IR resolution (`acdl_platform/contract_resolver.py`) yields a complete target stack for `l2-microservice`. + +### Category: Real Provisioning +- **REQ-33:** The platform runs `terraform apply` (not just `plan`) for the `dev` environment, autonomous per §10 (confidence ≥ 0.50, no HITL). The apply creates real AWS resources (VPC, ECS cluster, ECR repo, ALB, ECS service) and the result is captured in the evidence stream. `apply` for qa/prod/dr remains HITL-gated and out of scope for v1.2. + +### Category: Consumer Repo +- **REQ-34:** A new Gitea repo `acdl-consumer-microservice` exists under the `continuous-intelligence` org, containing: a basic HTTP microservice (e.g., a tiny Python/Go server returning 200), a `Dockerfile`, an ECR push step, and a `contracts/microservice.yaml` submission for `l2-microservice` (dev environment). + +### Category: End-to-End Verification +- **REQ-35:** One end-to-end flow: consumer commit to `acdl-consumer-microservice` → pipeline triggered → contract→IR resolution → `terraform plan` → `terraform apply` (dev) → a live ECS Fargate service serving HTTP 200 on its ALB → evidence event written to the DynamoDB outbox → the event renders on the `acdl-evidence` timeline. `scripts/verify_phase16.sh` proves the full flow green. + +## Out of Scope (v1.2) + +| Feature | Reason | +|---------|--------| +| Real OIDC federation | go-gitea/gitea#36988 still open (re-checked 2026-07-21). v1.2 extends D-039 waiver (D-047); real OIDC is v1.3+. | +| Full HITL matrix wiring (qa/prod/dr) | v1.2 is dev-only autonomous `apply`; HITL wiring is v1.3. | +| Kyverno + OPA policy engines | v1.2 keeps Checkov only; Kyverno/OPA are v1.3. | +| MCP skill catalog + real L3B agent | v1.2 keeps the L3B stub; the 5-skill catalog is v1.3. | +| Audit ledger build-out (S3 Object Lock + JWS + async worker + DLQ + daily checkpoints) | v1.2 keeps the v1.1 outbox; the regulatory ledger is v1.3. | +| Multi-region state / outbox | Single-region in v1 (§9, §12.3); multi-region is v1.3+. | +| Prod/dr environments | v1.2 is dev-only; prod/dr are v1.3. | +| GitOps reconciler (ArgoCD/Flux) | v1.3+. | + ## Clarifications (Phase 01, v1.0 — retained for history) | REQ | Original criterion | Clarified criterion (effective) | Decision | @@ -110,7 +144,7 @@ | REQ-14 | 5 | complete (v1.0.5) | | REQ-15 | 5 | complete (v1.0.5) | -### v1.1 (active — architecture finalization + v1 spike) +### v1.1 (prior — architecture finalization + v1 spike, complete) | Requirement | Phase | Status | |-------------|-------|--------| @@ -126,4 +160,16 @@ | REQ-25 | 10 | complete (v1.1.5) | | REQ-26 | 09 | complete (v1.1.4) | | REQ-27 | 10 | complete (v1.1.5) | -| REQ-28 | 10 | complete (v1.1.5) | \ No newline at end of file +| REQ-28 | 10 | complete (v1.1.5) | + +### v1.2 (active — platform hardening + first real consumer deployment) + +| Requirement | Phase | Status | +|-------------|-------|--------| +| REQ-29 | 11 | planned | +| REQ-30 | 12 | planned | +| REQ-31 | 13 | planned | +| REQ-32 | 14 | planned | +| REQ-33 | 15 | planned | +| REQ-34 | 15 | planned | +| REQ-35 | 16 | planned | \ No newline at end of file diff --git a/.ciagent/ROADMAP.md b/.ciagent/ROADMAP.md index 7ee6535..6da5fcc 100644 --- a/.ciagent/ROADMAP.md +++ b/.ciagent/ROADMAP.md @@ -3,7 +3,8 @@ ## Overview - **v1.0 (demo):** complete — tag `v1.1.0`, 2026-07-21. All 5 phases shipped + audited PASS. -- **v1.1 (active):** architecture finalization + v1 spike. 5 phases (06–10). +- **v1.1 (complete):** architecture finalization + v1 spike. 5 phases (06–10). Tag `v1.2.0`, 2026-07-21. All 5 phases shipped + verified; review READY TO SHIP (0 P0); audit CLEAN. Gitea release id 202. +- **v1.2 (active):** platform hardening + first real consumer deployment. 6 phases (11–16). Ship tag `v1.3.0`. - **v1.0 demo URL:** https://git.cloudinit.dev/continuous-intelligence/acdl-evidence/raw/branch/main/index.html --- @@ -71,14 +72,15 @@ phase produced a runnable increment and ended with a phase-completion commit --- -## v1.1 (Complete — architecture finalization + v1 spike, 2026-07-21) +## v1.1 (Complete — architecture finalization + v1 spike, 2026-07-21, tag `v1.2.0`) Five-phase breakdown to finalize the architecture to v1.0 and prove the locked commitments with one end-to-end implementation spike. Milestone -`v1.1-spike` covers the real platform's first materialization. Ship tag +`v1.1-spike` covered the real platform's first materialization. Ship tag at milestone COMPLETE: **`v1.2.0`** (feature milestone, next minor per ship.md). **Status: COMPLETE — all 5 phases shipped (v1.1.1..v1.1.5) + -verified; review READY TO SHIP (0 P0); audit CLEAN.** +verified; review READY TO SHIP (0 P0); audit CLEAN; Gitea release id 202. +D-034 closed (root key deactivated by user).** ### Phase 06 — archive-demo-and-reorient - **Description:** Move the v1.0 demo (`modules/`, `scripts/`, `evidence-ui/`, `contracts/`, demo `.gitea/workflows/`) to `demo/`. Establish the new repo layout (`platform/`, `schemas/`, `adapters/`, `terraform/`, `modules-ir/`). Rewrite README to reflect the real platform. Verify the demo still runs from `demo/` (regression check). @@ -133,4 +135,81 @@ verified; review READY TO SHIP (0 P0); audit CLEAN.** - `scripts/verify_phase10.sh` proves the adapter is the only substrate-specific code. - Evidence event is written to the DynamoDB outbox. -After Phase 10: COMPLETE gate — review → ship `v1.2.0` → audit. \ No newline at end of file +After Phase 10: COMPLETE gate — review → ship `v1.2.0` → audit. **DONE.** + +--- + +## v1.2 (Active — platform hardening + first real consumer deployment) + +Six-phase breakdown to harden the v1.1 spike, simplify the setup, update +the docs, and prove the platform delivers real value by deploying a basic +microservice to AWS ECS Fargate end-to-end. Ship tag at milestone COMPLETE: +**`v1.3.0`** (feature milestone, next minor per ship.md — v1.1 shipped +`v1.2.0`). Phase patches `v1.2.1`..`v1.2.6`. + +### Phase 11 — v1.2-research-and-readme +- **Description:** Re-evaluate go-gitea/gitea#36988 (OIDC for Gitea Actions) — confirm still open (re-checked 2026-07-21: open, last updated 2026-05-27, not merged) and record the decision to extend D-039 as D-047. Audit the v1.1 spike for NFR gaps (least-privilege IAM, idempotency, error handling, rotation hygiene) and simplification opportunities (script consolidation, dead code, stale paths). Rewrite `README.md` to reflect v1.1 complete + the actual spike flow + how to run + the real repo layout + the v1.2 objective. +- **Status:** planned +- **Depends on:** — +- **Requirements:** REQ-29 +- **Success Criteria:** + - `RESEARCH.md` has a v1.2 addendum with the #36988 re-check + NFR audit + simplification findings. + - `README.md` reflects v1.1 complete; documents the spike flow, `scripts/run_platform.sh`, the repo layout, and the v1.2 objective; no stale "v1.1 (active)" framing. + - D-047 is recorded in `PROJECT.md`. + +### Phase 12 — nfr-harden-and-simplify +- **Description:** Apply Phase 11's findings. Tighten `terraform/bootstrap/spike_runner_policy.json` to least-privilege (add ECS + ECR + ELB + IAM plan-only permissions for v1.2; audit for wildcards). Make `create_state_backend.py` and `create_iam_user.py` idempotent. Consolidate `run_spike_plan.sh` + `run_spike_e2e.sh` into a single `scripts/run_platform.sh` with proper exit codes and error handling. Redact P1-1 (the two AWS access key IDs in `.ciagent/VERIFY.md` Phase 09 narrative). Fix any remaining stale `platform/` paths in `.ciagent/`. The v1.1 spike still runs e2e after the refactor. +- **Status:** planned +- **Depends on:** [11] +- **Requirements:** REQ-30 +- **Success Criteria:** + - `scripts/run_platform.sh` runs the full v1.1 spike e2e and exits 0. + - `create_state_backend.py` / `create_iam_user.py` re-runs are idempotent (no duplicate resources; exit 0). + - `spike_runner_policy.json` passes a least-privilege audit (no `*` actions beyond documented exceptions). + - `.ciagent/VERIFY.md` Phase 09 narrative has no live AWS access key IDs. + - No stale `platform/` paths remain in `.ciagent/`. + +### Phase 13 — l1-catalog-for-ecs +- **Description:** Author six IR-typed L1 modules for an ECS Fargate microservice: `l1-vpc` (VPC + subnets + route tables), `l1-ecs-cluster` (ECS Fargate cluster), `l1-ecs-service` (ECS service + task definition), `l1-iam-role` (task execution + task role), `l1-alb` (ALB + listener + target group), `l1-ecr` (ECR repository). Each has an `interface.json` valid against `schemas/ir.schema.json`. Register all six in `modules-ir/registry.json`. Expand the Terraform adapter `TYPE_MAP` to cover the new IR resource types. Each L1 produces a valid `terraform plan` fragment. +- **Status:** planned +- **Depends on:** [12] +- **Requirements:** REQ-31 +- **Success Criteria:** + - All six L1s exist under `modules-ir/l1/` with `interface.json` valid against `schemas/ir.schema.json`. + - `modules-ir/registry.json` lists all six. + - The adapter `TYPE_MAP` covers all six IR resource types. + - Each L1 produces a valid `terraform plan` fragment. + +### Phase 14 — l2-microservice-and-contract-schema +- **Description:** Author `l2-microservice` thin-composition under `modules-ir/l2/l2-microservice/` referencing the six ECS L1s (depth ≤ 5). Extend `schemas/contract.schema.json` with microservice inputs (`image: string`, `port: integer`, `env: map`, `healthcheck: object`). Verify contract→IR resolution (`acdl_platform/contract_resolver.py`) yields a complete target stack for `l2-microservice`. +- **Status:** planned +- **Depends on:** [13] +- **Requirements:** REQ-32 +- **Success Criteria:** + - `l2-microservice` references the six ECS L1s only (depth ≤ 5). + - `schemas/contract.schema.json` validates a `contracts/microservice.yaml` with the new inputs. + - Contract→IR resolution yields a complete target stack (all six L1 instances + relationships). + +### Phase 15 — consumer-repo-and-terraform-apply +- **Description:** Create a new Gitea repo `acdl-consumer-microservice` under the `continuous-intelligence` org containing a basic HTTP microservice (tiny Python/Go server returning 200), a `Dockerfile`, an ECR push step, and a `contracts/microservice.yaml` submission for `l2-microservice` (dev environment). Lift the platform from `plan` to **`apply`** for the `dev` environment (autonomous per §10, confidence ≥ 0.50, no HITL). Submit the contract → pipeline → IR → plan → apply → a real ECS Fargate service running. +- **Status:** planned +- **Depends on:** [14] +- **Requirements:** REQ-33, REQ-34 +- **Success Criteria:** + - `acdl-consumer-microservice` repo exists under `continuous-intelligence`. + - The microservice builds into a Docker image and is pushed to ECR. + - `terraform apply` (dev) creates real AWS resources (VPC, ECS cluster, ECR repo, ALB, ECS service). + - The apply result is captured in the evidence stream. + +### Phase 16 — v1.2-capstone-e2e +- **Description:** End-to-end verification: a consumer commit to `acdl-consumer-microservice` triggers the pipeline → contract→IR resolution → `terraform plan` → `terraform apply` (dev) → a live ECS Fargate service serving HTTP 200 on its ALB → evidence event written to the DynamoDB outbox → the event renders on the `acdl-evidence` timeline. Verify the NFR improvements from Phase 12 hold, the setup is simpler (one `scripts/run_platform.sh`), and the README is accurate. `scripts/verify_phase16.sh` proves the full flow green. +- **Status:** planned +- **Depends on:** [15] +- **Requirements:** REQ-35 +- **Success Criteria:** + - One consumer commit produces a live ECS service serving HTTP 200. + - An evidence event for the apply is in the DynamoDB outbox and renders on the timeline. + - `scripts/verify_phase16.sh` exits 0. + - README accurately documents the v1.2 platform flow. + +After Phase 16: COMPLETE gate — review → ship `v1.3.0` → audit. \ No newline at end of file diff --git a/.ciagent/config.json b/.ciagent/config.json index 78e1a7d..1e04739 100644 --- a/.ciagent/config.json +++ b/.ciagent/config.json @@ -4,8 +4,8 @@ { "slug": "acdl", "name": "Agentic Cloud Delivery Platform", - "milestone": "v1.1", - "status": "complete" + "milestone": "v1.2", + "status": "specify" } ], "active_project": "acdl",