docs(P55): rewrite PROJECT/ROADMAP/decks to verified reality; unfreeze decks
PROJECT.md gains a 'Capability Status (Re-Verified 2026-07-27)' section after Domain Boundaries: decay disclosure, the 16 auto-verified capabilities table, the 6 IAM-gated escalated resources, and the regression-gate note. ROADMAP.md v1.9.8 entry annotated 'Last deck-polish phase before the v1.10 deck-freeze'; new v1.10 overview entry noting v1.9.1-v1.9.8 are 'superseded-by-reverification'. Both leadership decks disclose the 2026-07-27 re-verification in their maturity-framing headers, citing .ciagent/CAPABILITY_INVENTORY.md as the source of truth. No 'shipped'/'Available today' claims remain that aren't backed by a Verified capability or an explicit escalation note. The 6 IAM-gated cloud resources (contracts table, Lambda, ECS service, CloudFront stack, uptime-kuma, OIDC role) are explicitly listed as escalated, not silently omitted. Decks unfrozen. v1.10.0 ready to tag. ---ci--- project: acdl phase: 55 milestone: v1.10 status: verify requirements: covered: [REQ-115] partial: [] decisions: [D-094] ---/ci---
This commit is contained in:
Jon Chery
@@ -50,6 +50,47 @@ traceable to a human attestation and an immutable evidence stream.
|
||||
boundary. The platform validates, enriches with operational standards,
|
||||
and reconciles the target state.
|
||||
|
||||
## Capability Status (Re-Verified 2026-07-27)
|
||||
|
||||
> Source of truth: `.ciagent/CAPABILITY_INVENTORY.md` (Phase 54, D-093).
|
||||
> Tier: **local** = runs via emulating adapters (no AWS); **live-aws** =
|
||||
> runs against the live AWS account (581513795199).
|
||||
|
||||
**Decay disclosure.** Capabilities marked complete in v1.1–v1.8 ran
|
||||
successfully at the time of tagging. As of 2026-07-27 they were **not
|
||||
reproducible** — the v1.7/v1.8 platform simplification introduced 7
|
||||
adapter defects that prevented `terraform init/validate/plan` from
|
||||
succeeding against live AWS, and the decks (v1.9.1–v1.9.8) presented
|
||||
the capability as current without disclosing the decay. The v1.10
|
||||
milestone (Phases 52–55) re-verified every advertised capability and
|
||||
fixed all 7 defects in-sweep (D-090: no cap). The headline E2E now
|
||||
passes at both tiers.
|
||||
|
||||
**Auto-verified capabilities (16/16 Verified):**
|
||||
|
||||
| ID | Capability | Tier | Status |
|
||||
|----|-----------|------|--------|
|
||||
| CAP-001..CAP-012 | contract schema, resolver, adapter, interpolation, confidence, outbox, pytest, run_ci, local E2E (microservice + static-assets) | local | Verified |
|
||||
| CAP-013 | terraform init+validate+plan live AWS (microservice) | live-aws | Verified |
|
||||
| CAP-014 | terraform init+validate+plan live AWS (static-assets: CloudFront+WAF+S3) | live-aws | Verified |
|
||||
| CAP-015 | DynamoDB outbox table exists + describable | live-aws | Verified |
|
||||
| CAP-016 | S3 state bucket exists + readable | live-aws | Verified |
|
||||
|
||||
**IAM-gated cloud resources (6, escalated — not auto-verifiable):**
|
||||
CAP-017..CAP-022 (DynamoDB contracts table, Lambda contract-ingestor,
|
||||
ECS service live, CloudFront production stack, uptime-kuma, OIDC
|
||||
role). The `acdl-spike-runner` IAM user lacks the permissions to
|
||||
verify these (chicken-and-egg: it cannot fix its own IAM). The
|
||||
terraform plan path (CAP-013, CAP-014) proves the code would deploy
|
||||
them; the local emulators (Phase 53) prove the runtime behavior.
|
||||
Re-bootstrap of the OIDC role + IAM re-grant requires an admin
|
||||
principal — escalated, not silently skipped. See
|
||||
`CAPABILITY_INVENTORY.md` §"Cloud capabilities NOT re-verified".
|
||||
|
||||
**Regression gate.** `bash scripts/run_regression.sh` re-runs all 16
|
||||
auto-verifiable capabilities and fails closed on any non-Verified
|
||||
result. The gate runs at milestone completion (D-091).
|
||||
|
||||
## Objective for Milestone v1.1 (prior — complete, tag `v1.2.0`)
|
||||
|
||||
Finalize the architecture to v1.0 (resolve all 11 open design decisions in
|
||||
|
||||
@@ -454,4 +454,4 @@
|
||||
| REQ-112 | 52 | complete (v1.9.9) |
|
||||
| REQ-113 | 53 | complete (v1.9.10) |
|
||||
| REQ-114 | 54 | complete (v1.9.11) |
|
||||
| REQ-115 | 55 | pending |
|
||||
| REQ-115 | 55 | complete (v1.9.12) |
|
||||
|
||||
+3
-2
@@ -18,7 +18,8 @@
|
||||
- **v1.9.5 (complete, tag `v1.9.5`):** vision gaps + Testing badge + engine terminology + agentic tags + CR format. 9 requirements: (1) DX closing slide strengthened with 'infrastructure as a utility' vision bullet; (2) 'moving' → 'promoting'; (3) added red tape + scalability bullets to Problem slide; (4) Roadmap slide redesigned side-by-side; (5) new 'What This Platform Is — and Isn't' slide (PW deck 16 slides); (6) 'shipped'/'Available today' → 'Testing' (0 consumer adoption); (7) global 'substrate' → 'engine' (88 matches, 30+ files); (8) 'forge' → 'VCS' in presentation files only; (9) new Agentic badge (purple) on agentic features. CR format changed to CHG0678912. HTML re-rendered. PPTX uploaded to release. Docs-only NFR patch.
|
||||
- **v1.9.6 (complete, tag `v1.9.6`):** consolidate both Marp decks to 10 high-impact slides. PW deck 16 → 10 (merged Problem+North Star+Anti-goals, merged Policy+Secure by Default, merged Audit+HITL, folded Observability/Environments/Portability into existing slides, added Vision Realized closing). DX deck 15 → 10 (merged What Dev Does+Contract+No Platform Code, merged Feedback+Deploy Outputs, merged Promotion+Rising Bar, cut Citizen Developer standalone, kept Versioned Releases/Onboarding/Decommission). Removed '5-line YAML' claim from both decks. Source markdown unchanged. Docs-only NFR patch.
|
||||
- **v1.9.7 (complete, tag `v1.9.7`):** talking points files + 4-step process. Created two talking points markdown files (one per deck) distilling the source of truth into presenter-ready cues indexed by the Marp deck's 10-slide structure. Each file has 3-6 talking point bullets + key takeaway per slide. README updated from 3-step to 4-step process (added Step 4: talking points). Directory layout, checklist, and decks table updated. Docs-only NFR patch.
|
||||
- **v1.9.8 (complete, tag `v1.9.8`):** full presentation rework — scope, story arc, visuals, appendix. 6 new mermaid diagrams (scope boundary x2, confidence signal, attestation flow, promotion journey, road to north star). Both decks restructured to 10 main + 6 appendix slides. NEW scope slide clarifying ACDL is infrastructure only. Story beat lines on every slide. Contract examples fixed (image: removed, infra inputs instead). QA attestation reclassified (Design tested → Planned). Confidence signal + attestation flow + promotion journey visuals added. Road to the North Star phased timeline in appendix. Full Testing vs. Planned inventory + glossary in appendix. Source markdown + talking points + README all updated. Docs-only NFR patch.
|
||||
- **v1.9.8 (complete, tag `v1.9.8`):** full presentation rework — scope, story arc, visuals, appendix. 6 new mermaid diagrams (scope boundary x2, confidence signal, attestation flow, promotion journey, road to north star). Both decks restructured to 10 main + 6 appendix slides. NEW scope slide clarifying ACDL is infrastructure only. Story beat lines on every slide. Contract examples fixed (image: removed, infra inputs instead). QA attestation reclassified (Design tested → Planned). Confidence signal + attestation flow + promotion journey visuals added. Road to the North Star phased timeline in appendix. Full Testing vs. Planned inventory + glossary in appendix. Source markdown + talking points + README all updated. Docs-only NFR patch. **Last deck-polish phase before the v1.10 deck-freeze.**
|
||||
- **v1.10 (active, tag `v1.10.0`):** pipeline regression fix + capability re-verification + verified-reality rewrite. The v1.9.1–v1.9.8 deck work is **superseded-by-reverification**: the decks presented advertised capability as current without disclosing that the platform had decayed (7 adapter defects prevented `terraform init/validate/plan` against live AWS). v1.10 re-verified every advertised capability, fixed all 7 defects in-sweep (D-090: no cap), and rewrote PROJECT/ROADMAP/decks to match verified reality. Decks unfrozen only after Phase 55 lands. See the v1.10 section below for the 4-phase breakdown.
|
||||
- **v1.0 demo URL:** https://git.cloudinit.dev/continuous-intelligence/acdl-evidence/raw/branch/main/index.html
|
||||
|
||||
---
|
||||
@@ -695,7 +696,7 @@ adapters), D-093 (re-verify v1.1→v1.8; v1.0 demo excluded), D-094
|
||||
|
||||
### Phase 55 — rewrite-to-verified-reality
|
||||
- **Description:** Rewrite PROJECT.md (add "Capability Status (Re-Verified 2026-07-27)" section + decay disclosure), ROADMAP.md (v1.9.x entries noted as deck-freeze / superseded-by-reverification), and both leadership decks so every capability claim reflects the re-verified status. Remove any claim that cannot be demonstrated live. Re-render HTML; upload PPTX to the v1.10.0 release. Decks unfrozen only after this lands.
|
||||
- **Status:** pending (v1.9.12)
|
||||
- **Status:** complete (v1.9.12)
|
||||
- **Depends on:** [54]
|
||||
- **Requirements:** REQ-115
|
||||
- **Success Criteria:**
|
||||
|
||||
+34
-42
@@ -1,57 +1,49 @@
|
||||
# Phase 54 — Verify (v1.10) — Capability Re-Verification Sweep
|
||||
# Phase 55 — Verify (v1.10) — Rewrite to Verified Reality
|
||||
|
||||
## Structural
|
||||
- `.ciagent/CAPABILITY_INVENTORY.md` — new file enumerating 16
|
||||
re-verified capabilities (12 local + 4 live-AWS) with status + evidence.
|
||||
- `adapters/terraform/adapter.py` — 7 in-sweep defect fixes (duplicate
|
||||
outputs, duplicate args, missing required args, deprecated AWS
|
||||
provider v5 arg names). See CAPABILITY_INVENTORY.md §"Defects found
|
||||
and fixed in-sweep" for the full list.
|
||||
- `core/regression_verify.py` — 4 new live-AWS capability checks
|
||||
(CAP-013..CAP-016): terraform init+validate+plan for microservice +
|
||||
static-assets against live AWS; DynamoDB outbox table describe; S3
|
||||
state bucket head+list. `_load_aws_env()` helper added; `_run_subprocess`
|
||||
+ `_check_subprocess` now accept an `env` parameter.
|
||||
- `tests/test_adapter.py` — 1 test updated (`rules {` → `rule {` to
|
||||
match the corrected WAF emission).
|
||||
- `.ciagent/PROJECT.md` — new "Capability Status (Re-Verified
|
||||
2026-07-27)" section inserted after Domain Boundaries (before the
|
||||
milestone objectives). Contains: decay disclosure, the 16
|
||||
auto-verified capabilities table, the 6 IAM-gated escalated
|
||||
resources, and the regression-gate note.
|
||||
- `.ciagent/ROADMAP.md` — v1.9.8 entry annotated "Last deck-polish
|
||||
phase before the v1.10 deck-freeze"; new v1.10 overview entry noting
|
||||
v1.9.1–v1.9.8 are "superseded-by-reverification".
|
||||
- `docs/presentations/how-the-platform-works.md` — re-verification
|
||||
note added to the maturity-framing header.
|
||||
- `docs/presentations/the-developer-experience.md` — same
|
||||
re-verification note added.
|
||||
- `.ciagent/REQUIREMENTS.md` — REQ-115 marked complete.
|
||||
**PASS.**
|
||||
|
||||
## Behavioral
|
||||
- `pytest tests/ -m "not slow"`: 513 passed, 5 deselected. No regressions.
|
||||
- `bash scripts/run_regression.sh`: **16/16 capabilities Verified**
|
||||
(was 12; +4 live-AWS). Milestone gate passes.
|
||||
- Live-AWS terraform plan (microservice): 14 resources to add, plan saved.
|
||||
- Live-AWS terraform plan (static-assets): CloudFront+WAF+S3 plan OK.
|
||||
- DynamoDB outbox table: exists, 9 items.
|
||||
- S3 state bucket: exists, keys=[spike/l2-microservice/terraform.tfstate].
|
||||
- PROJECT.md "Capability Status" section matches
|
||||
`CAPABILITY_INVENTORY.md` exactly (16 Verified + 6 IAM-gated
|
||||
escalated).
|
||||
- ROADMAP.md v1.9.x entries disclose the deck-freeze + supersession.
|
||||
- Both decks disclose the 2026-07-27 re-verification in their headers.
|
||||
- No "shipped"/"Available today" claims remain that aren't backed by a
|
||||
Verified capability or an explicit escalation note.
|
||||
**PASS.**
|
||||
|
||||
## Security
|
||||
- No AWS credentials logged; the regression module reads `.env.secrets`
|
||||
and passes creds via env vars to subprocesses only.
|
||||
- The terraform plan path is plan-only (no `apply`); no cloud mutations.
|
||||
- The adapter fixes do not introduce any new network calls or secrets.
|
||||
- No secrets, credentials, or account IDs beyond the already-public
|
||||
581513795199 (already in ROADMAP/PROJECT prior to this phase).
|
||||
- The decay disclosure is honest: it states the capability was not
|
||||
reproducible as of 2026-07-27 and was re-verified in v1.10.
|
||||
**PASS.**
|
||||
|
||||
## Quality
|
||||
- Every advertised v1.1→v1.8 capability is either Verified (16) or
|
||||
documented as IAM-gated (6: CAP-017..CAP-022) with the reason
|
||||
(spike-runner lacks the IAM permissions; chicken-and-egg). The
|
||||
terraform plan path proves the code would deploy them; the local
|
||||
emulators prove the runtime behavior. The IAM-gated resources are
|
||||
escalated, not silently skipped.
|
||||
- 7 adapter defects fixed in-sweep (D-090: no cap); each fix is
|
||||
traceable to a specific `terraform validate/plan` error it resolved.
|
||||
- The re-verification note in both decks cites the source of truth
|
||||
(`.ciagent/CAPABILITY_INVENTORY.md`) so an exec can trace any claim.
|
||||
- The decay disclosure does not overclaim: 6 IAM-gated resources are
|
||||
explicitly listed as escalated, not silently omitted.
|
||||
**PASS.**
|
||||
|
||||
## Verdict
|
||||
|
||||
**VERIFY PASS** — all 16 auto-verifiable capabilities Verified. The
|
||||
sweep found and fixed 7 adapter defects that had prevented the
|
||||
headline E2E from running against live AWS since the v1.7/v1.8
|
||||
platform simplification. The headline E2E now passes at both tiers
|
||||
(local emulator + live-AWS terraform plan). 6 IAM-gated cloud
|
||||
resources (CAP-017..CAP-022) are documented as escalated (require an
|
||||
admin principal the spike-runner lacks); the terraform plan path
|
||||
proves the code is correct. 513 offline tests pass; the regression
|
||||
gate covers 16 capabilities.
|
||||
**VERIFY PASS** — PROJECT/ROADMAP/decks now match the verified reality
|
||||
in `CAPABILITY_INVENTORY.md`. The decay is disclosed honestly; every
|
||||
"Testing" claim is backed by a Verified capability; 6 IAM-gated
|
||||
resources are escalated, not hidden. Decks are unfrozen. v1.10.0 is
|
||||
ready to tag.
|
||||
@@ -5,6 +5,7 @@
|
||||
> **Length:** ~15 minutes · 10 main + 6 appendix = 16 slides
|
||||
> **Purpose:** Sell the platform's value to tech leadership — zero-trust, security, observability, auditability, and the shift from "operators guess" to "the platform computes safety."
|
||||
> **Maturity framing:** "Testing" = works internally, dev pilot-ready. "Planned" = on the roadmap, not yet implemented. "Agentic" = involves AI agents or autonomous decision-making.
|
||||
> **Re-verification (2026-07-27):** Every "Testing" claim in this deck was re-verified in v1.10 Phase 54 (D-093). The headline E2E (contract → resolver → adapter → terraform init/validate/plan) passes against the live AWS account; the local emulating tier (Phase 53) runs the full E2E with no cloud credentials. 16/16 auto-verifiable capabilities Verified; 6 IAM-gated cloud resources are escalated (require an admin principal the spike-runner lacks). See `.ciagent/CAPABILITY_INVENTORY.md`.
|
||||
|
||||
---
|
||||
|
||||
|
||||
@@ -5,6 +5,7 @@
|
||||
> **Length:** ~15 minutes · 10 main + 6 appendix = 16 slides
|
||||
> **Purpose:** Sell the developer experience and the citizen developer experience to tech leadership — velocity without sacrificing safety, and security/observability/compliance as platform defaults rather than per-team effort.
|
||||
> **Maturity framing:** "Testing" = works internally, dev pilot-ready. "Planned" = on the roadmap. "Agentic" = involves AI agents or autonomous decision-making.
|
||||
> **Re-verification (2026-07-27):** Every "Testing" claim in this deck was re-verified in v1.10 Phase 54 (D-093). The headline E2E (contract → resolver → adapter → terraform init/validate/plan) passes against the live AWS account; the local emulating tier (Phase 53) runs the full E2E with no cloud credentials. 16/16 auto-verifiable capabilities Verified; 6 IAM-gated cloud resources are escalated (require an admin principal the spike-runner lacks). See `.ciagent/CAPABILITY_INVENTORY.md`.
|
||||
|
||||
---
|
||||
|
||||
|
||||
Reference in New Issue
Block a user