docs(P08): create Phase 08 plan (aws-bootstrap)

---ci---
project: acdl
phase: 8
milestone: v1.1
status: plan
plan:
  waves: 5
  tasks: 8
  requirements: [REQ-23]
---/ci---

Phase 08 plan authored by ci-planner. 5 waves:
- Wave 1 (security): T-8.1 spike_runner_policy.json (least-privilege)
- Wave 2 (platform): T-8.2/T-8.3 create_state_backend.py, T-8.4 create_iam_user.py
- Wave 3 (platform): T-8.5 rotate_spike_key.sh
- Wave 4 (lead): T-8.6 verify_phase08.sh, T-8.7 README + .gitignore
- Wave 5 (lead, EXECUTE-only): T-8.8 run bootstrap against AWS + D-034 closure

7 authored files. Key decisions: D-P08-1 (one DynamoDB table acdl-outbox
for both lock + outbox), D-P08-2 (IAM user acdl-spike-runner not OIDC
role; OIDC deferred to v1.2 per D-039), D-P08-3 (Wave 5 EXECUTE-only),
D-P08-4 (optional Gitea secret upload), D-P08-5 (initial key is
throwaway).

Security: root key via env vars only (never committed); .env.secrets
gitignored; IAM policy explicit Deny-everything-else; D-034 closure =
user manually rotates root key post-phase.

This commit is contained in:

Jon Chery

2026-07-21 18:57:31 +00:00

parent 727c87339b

commit a003168b3a

1 changed files with 1018 additions and 1206 deletions

.ciagent/PLAN.md

+1018 -1206

View File

File diff suppressed because it is too large Load Diff