ship: phase-14 l2-microservice-and-contract-schema (v1.2.4)
---ci--- project: acdl phase: 14 milestone: v1.2 status: shipped release: tag: v1.2.4 requirements: covered: [REQ-32] ---/ci--- Phase 14 shipped: l2-microservice + contract schema + resolver wiring. REQ-32 verified. - l2-microservice composition (6 ECS L1s, depth 1, 2 wire kinds). - Contract schema extended (inputs allow objects + healthcheck field). - Resolver: array-form wires, child->child ref: emission, multi-resource L1 expansion. - Adapter: ref:<id>.<output> -> Terraform interpolation translation. - v1.2 IR: 11 resources (6 L1s expand: vpc->3, ecs-service->2, alb->3, + 3 single). - v1.1 S3 regression: byte-identical. Phase 15 (consumer-repo-and-terraform-apply) next.
This commit is contained in:
Jon Chery
+15
-46
@@ -1,63 +1,32 @@
|
||||
---
|
||||
phase: 13
|
||||
name: l1-catalog-for-ecs
|
||||
phase: 14
|
||||
name: l2-microservice-and-contract-schema
|
||||
milestone: v1.2
|
||||
requirements: [REQ-31]
|
||||
requirements: [REQ-32]
|
||||
type: feat
|
||||
branch: phase/13-l1-catalog-for-ecs
|
||||
branch: phase/14-l2-microservice-and-contract-schema
|
||||
---
|
||||
|
||||
# Phase 13 — l1-catalog-for-ecs (v1.2) PLAN
|
||||
# Phase 14 — l2-microservice-and-contract-schema (v1.2) PLAN
|
||||
|
||||
## Goal
|
||||
|
||||
Author six IR-typed L1 modules for an ECS Fargate microservice and expand
|
||||
the Terraform adapter's `TYPE_MAP` to compile them. Each L1 has an
|
||||
`interface.json` valid against `schemas/ir.schema.json`, is registered in
|
||||
`modules-ir/registry.json`, and produces a valid `terraform plan`
|
||||
fragment via the adapter. The adapter must be generalized from
|
||||
S3-specific to handle arbitrary IR types via the TYPE_MAP + per-type
|
||||
input/output maps.
|
||||
Author `l2-microservice` thin-composition (6 ECS L1s, depth ≤ 5), extend the contract schema for microservice inputs, extend the resolver for child→child wiring, and verify contract→IR resolution yields a complete target stack.
|
||||
|
||||
## Tasks
|
||||
|
||||
### Wave 1 — Generalize the adapter (T-13.1, backend-engineer)
|
||||
### T-14.1 — l2-microservice composition
|
||||
Create `modules-ir/l2/l2-microservice/composition.json` + `README.md`. Register in `modules-ir/registry.json` at 1.0.0. 6 children: vpc, cluster, ecr, roles, alb, service. Wires: contract→child passthrough (name, cidr, azs, image, port, cpu, memory, env, protocol) + child→child refs (cluster.cluster_arn→service.cluster_arn, vpc.subnet_ids→service.subnets + alb.subnets, alb.target_group_arn→service.lb_target_group_arn, roles.role_arn→service.security_group). Wire format: `"source": "child:<id>.<output>"` for child→child.
|
||||
|
||||
Expand `adapters/terraform/adapter.py`:
|
||||
- `TYPE_MAP`: add all 9 new IR types (aws:ec2:vpc, aws:ec2:subnet, aws:ec2:routetable, aws:ecs:cluster, aws:ecs:service, aws:ecs:task_definition, aws:iam:role, aws:elbv2:loadbalancer, aws:elbv2:listener, aws:elbv2:targetgroup, aws:ecr:repository).
|
||||
- Replace S3-specific `_emit_resource` with a generic emitter using `TYPE_MAP` + `INPUT_MAP` (IR input → TF arg, default identity) + `OUTPUT_MAP` (IR output → TF attr).
|
||||
- String inputs quoted; numbers/booleans bare.
|
||||
- Keep S3 behavior identical (v1.1 spike regression check).
|
||||
- Keep `providers.tf` + `terraform.tf` as-is.
|
||||
### T-14.2 — Contract schema extension
|
||||
Extend `schemas/contract.schema.json`: `inputs.additionalProperties` allows objects too (for env map + healthcheck). Add optional `healthcheck` top-level field (object). Create `contracts/microservice.yaml` (dev, l2-microservice, inputs: name/cidr/azs/image/port/cpu/memory).
|
||||
|
||||
### Wave 2 — 6 L1 modules + registry (T-13.2, backend-engineer, D-049)
|
||||
### T-14.3 — Resolver child→child wiring
|
||||
Extend `acdl_platform/contract_resolver.py`: second pass for wires with `"source": "child:<id>.<output>"` → emit `"ref:<id>.<output>"` string in the child's inputs. Handle multi-resource L1s: iterate the L1's `resources` array, emit one IR resource per entry (prefix id with child id). Adapter translates `ref:X.Y` → `${<tf_type>.<X>.<attr>}`.
|
||||
|
||||
Create under `modules-ir/l1/`: `l1-vpc`, `l1-ecs-cluster`, `l1-ecs-service`, `l1-iam-role`, `l1-alb`, `l1-ecr`. Each with `interface.json` + `README.md`. Register all 6 in `modules-ir/registry.json` at 1.0.0.
|
||||
|
||||
| L1 | IR type(s) | Terraform resource | Key inputs | Key outputs |
|
||||
|----|-----------|-------------------|-----------|------------|
|
||||
| l1-vpc | aws:ec2:vpc, aws:ec2:subnet, aws:ec2:routetable | aws_vpc, aws_subnet, aws_route_table, aws_internet_gateway, aws_route | cidr, azs | vpc_id, subnet_ids, igw_id |
|
||||
| l1-ecs-cluster | aws:ecs:cluster | aws_ecs_cluster | name | cluster_arn, cluster_id |
|
||||
| l1-ecs-service | aws:ecs:service, aws:ecs:task_definition | aws_ecs_service, aws_ecs_task_definition | image, port, cpu, memory, env, cluster_arn, subnets, sg, lb_target_group | service_arn, task_def_arn |
|
||||
| l1-iam-role | aws:iam:role | aws_iam_role, aws_iam_role_policy_attachment | role_name, assume_role_policy, managed_policies | role_arn, role_id |
|
||||
| l1-alb | aws:elbv2:loadbalancer, aws:elbv2:listener, aws:elbv2:targetgroup | aws_lb, aws_lb_listener, aws_lb_target_group | name, subnets, sg, port, protocol | lb_arn, listener_arn, target_group_arn |
|
||||
| l1-ecr | aws:ecr:repository | aws_ecr_repository | name | repository_url, repository_arn |
|
||||
|
||||
Multi-resource L1s (vpc, ecs-service, alb): `interface.json` declares the group's inputs/outputs + a `resources` array listing the IR types it emits.
|
||||
|
||||
### Wave 3 — Verify (T-13.3)
|
||||
|
||||
For each L1: adapter + `terraform validate` on the generated TF (syntax check; full AWS plan is Phase 15). v1.1 spike regression: `l1-s3` still adapts correctly.
|
||||
|
||||
## Verification
|
||||
|
||||
- All 6 `interface.json` validate against `schemas/ir.schema.json`.
|
||||
- `modules-ir/registry.json` lists all 6 at 1.0.0.
|
||||
- `adapter.py` `TYPE_MAP` has all new IR types.
|
||||
- v1.1 spike `l1-s3` regression: adapter output unchanged.
|
||||
- Each L1's adapter output passes `terraform validate`.
|
||||
- `scripts/verify_phase13.sh`.
|
||||
### T-14.4 — Verify
|
||||
`contracts/microservice.yaml` → resolver → IR (all 6 L1s' resources) → adapter → `terraform validate`. v1.1 spike regression. `scripts/verify_phase14.sh`.
|
||||
|
||||
## Ship
|
||||
|
||||
Merge `phase/13-l1-catalog-for-ecs` → `main` (--no-ff). Tag `v1.2.3`.
|
||||
Merge → `main` (--no-ff). Tag `v1.2.4`.
|
||||
+52
-48
@@ -1,87 +1,91 @@
|
||||
# Phase 13 — l1-catalog-for-ecs (v1.2) VERIFY
|
||||
# Phase 14 — l2-microservice-and-contract-schema (v1.2) VERIFY
|
||||
|
||||
**Verdict: Phase 13: VERIFIED**
|
||||
**Tag: v1.2.3**
|
||||
**Verdict: Phase 14: VERIFIED**
|
||||
**Tag: v1.2.4**
|
||||
**Date: 2026-07-21**
|
||||
|
||||
---
|
||||
|
||||
## Scope
|
||||
|
||||
Phase 13 authors six IR-typed L1 modules for an ECS Fargate microservice
|
||||
(`l1-vpc`, `l1-ecs-cluster`, `l1-ecs-service`, `l1-iam-role`, `l1-alb`,
|
||||
`l1-ecr`), registers them in `modules-ir/registry.json`, and generalizes
|
||||
the Terraform adapter from S3-specific to a table-driven emitter handling
|
||||
all 12 IR types via `TYPE_MAP` + `INPUT_MAP` + `OUTPUT_MAP`. Requirement
|
||||
covered: **REQ-31**.
|
||||
Phase 14 authors the `l2-microservice` thin-composition (references 6 ECS
|
||||
L1s, depth 1), extends the contract schema for microservice inputs, extends
|
||||
the resolver for child→child wiring + multi-resource L1 expansion, extends
|
||||
the adapter for `ref:` interpolation translation, and verifies the full
|
||||
resolution path. Requirement covered: **REQ-32**.
|
||||
|
||||
## Verification layers
|
||||
|
||||
### 1. Structural
|
||||
|
||||
- 6 new L1 directories under `modules-ir/l1/`, each with `interface.json` + `README.md`.
|
||||
- `modules-ir/registry.json` updated: 8 entries (7 L1s + l2-static-asset), all 6 new at 1.0.0, deprecated=false.
|
||||
- `adapters/terraform/adapter.py` generalized: `TYPE_MAP` has 12 IR types; `INPUT_MAP` + `OUTPUT_MAP` for non-identity mappings; generic `_emit_resource`; S3 versioning NFR preserved.
|
||||
- `scripts/verify_phase13.sh` exists (+x).
|
||||
- `.ciagent/PLAN.md` updated to Phase 13.
|
||||
- `modules-ir/l2/l2-microservice/composition.json` + `README.md` created (6 children, two wire kinds).
|
||||
- `modules-ir/registry.json` lists `l2-microservice@1.0.0`.
|
||||
- `schemas/contract.schema.json` extended: `inputs.additionalProperties` allows `object`; `healthcheck` field added.
|
||||
- `contracts/microservice.yaml` created (dev, l2-microservice, 9 inputs).
|
||||
- `acdl_platform/contract_resolver.py` extended: array-form wires, child→child `ref:` emission, multi-resource L1 expansion.
|
||||
- `adapters/terraform/adapter.py` extended: `ref:<ir_resource_id>.<output>` → `${<tf_type>.<id>.<attr>}` translation.
|
||||
- `scripts/verify_phase14.sh` exists (+x).
|
||||
- `.ciagent/PLAN.md` updated to Phase 14.
|
||||
- **PASS.**
|
||||
|
||||
### 2. Behavioral (`scripts/verify_phase13.sh`)
|
||||
### 2. Behavioral (`scripts/verify_phase14.sh`)
|
||||
|
||||
```
|
||||
=== Phase 13 verification ===
|
||||
L1 directories: OK (6 new + l1-s3)
|
||||
l1-vpc: aws:ec2:vpc (4 inputs, 3 outputs)
|
||||
l1-ecs-cluster: aws:ecs:cluster (2 inputs, 2 outputs)
|
||||
l1-ecs-service: aws:ecs:task_definition (10 inputs, 2 outputs)
|
||||
l1-iam-role: aws:iam:role (4 inputs, 2 outputs)
|
||||
l1-alb: aws:elbv2:loadbalancer (6 inputs, 3 outputs)
|
||||
l1-ecr: aws:ecr:repository (2 inputs, 2 outputs)
|
||||
interface.json validation: OK
|
||||
registry: OK (8 entries: 7 L1s + 1 L2)
|
||||
TYPE_MAP: OK (12 IR types)
|
||||
adapter.py: py_compile OK
|
||||
S3 regression: OK (v1.1 spike l1-s3 adapts identically)
|
||||
IR schema availability: OK (interface contracts have valid L1 shape)
|
||||
=== Phase 14 verification ===
|
||||
composition: OK (6 children)
|
||||
registry: l2-microservice@1.0.0 OK
|
||||
contract schema: OK (inputs allow objects + healthcheck field)
|
||||
microservice.yaml: OK (validates against contract schema)
|
||||
py_compile: OK
|
||||
v1.1 regression: OK (spike.yaml -> l1-s3 -> aws_s3_bucket)
|
||||
v1.2 IR: 11 resources
|
||||
types: ['aws:ec2:routetable', 'aws:ec2:subnet', 'aws:ec2:vpc', 'aws:ecr:repository',
|
||||
'aws:ecs:cluster', 'aws:ecs:service', 'aws:ecs:task_definition',
|
||||
'aws:elbv2:listener', 'aws:elbv2:loadbalancer', 'aws:elbv2:targetgroup',
|
||||
'aws:iam:role']
|
||||
child->child refs: present
|
||||
v1.2 adaptation: OK (11 resources + interpolations in main.tf)
|
||||
.ciagent/ consistency: OK
|
||||
|
||||
=== Phase 13: VERIFIED ===
|
||||
=== Phase 14: VERIFIED ===
|
||||
```
|
||||
|
||||
All assertions pass. The S3 regression check confirms the generalized
|
||||
adapter produces byte-identical `main.tf` for the v1.1 spike's
|
||||
`l1-s3/spike_instance.json` (resource block with `bucket`, `versioning`,
|
||||
`bucket_arn`/`bucket_name` outputs).
|
||||
All assertions pass. The v1.2 resolution emits 11 IR resources (the 6 L1s
|
||||
expand to 11 due to multi-resource L1s: vpc→3, ecs-service→2, alb→3, +
|
||||
3 single-resource L1s). Child→child refs translate to Terraform
|
||||
interpolations (`${aws_ecs_cluster.cluster.arn}`, `${aws_subnet.vpc-subnet.id}`,
|
||||
`${aws_lb_target_group.alb-targetgroup.arn}`). The v1.1 spike regression
|
||||
is byte-identical.
|
||||
- **PASS.**
|
||||
|
||||
### 3. Security
|
||||
|
||||
- No credentials introduced. The L1 interfaces declare inputs/outputs only; no AWS key material.
|
||||
- The adapter remains a thin translator — no hardcoded secrets, no IAM role assumptions.
|
||||
- The `spike_runner_policy.json` (Phase 12) already grants the ECS/ECR/ELB/IAM/EC2 permissions these L1s will need for Phase 15's `terraform apply`.
|
||||
- No credentials introduced. The `contracts/microservice.yaml` references an ECR image by URL (no secrets).
|
||||
- The `assume_role_policy` in the contract is a standard ECS task execution trust policy (not a secret).
|
||||
- The resolver + adapter handle `ref:` strings as interpolation references — no secret leakage.
|
||||
- **PASS.**
|
||||
|
||||
### 4. Quality
|
||||
|
||||
- The adapter generalization preserves the v1.1 contract: S3 is the regression baseline, and its `main.tf` output is byte-identical (confirmed by the subagent's `diff` against the pre-edit baseline + the verify script's grep assertions).
|
||||
- The 6 L1 interfaces follow the exact `l1-s3` pattern (same JSON structure, same README sections with IR→Terraform mapping tables).
|
||||
- Multi-resource L1s (`l1-vpc`, `l1-ecs-service`, `l1-alb`) use a `resources` array in `interface.json` to declare the grouped IR types — a clean extension of the single-resource pattern.
|
||||
- The `TYPE_MAP` + `INPUT_MAP` + `OUTPUT_MAP` tables are the only substrate-specific code (per §12.2); the L1 content is substrate-agnostic.
|
||||
- The composition's two-wire-kind design (passthrough + child→child) cleanly separates contract-level parameters from infra-internal wiring.
|
||||
- The multi-resource L1 id scheme (`<child_id>-<type_suffix>`) keeps ids valid against the IR schema's `^[a-z][a-z0-9-]*$` pattern.
|
||||
- The `ref:<ir_resource_id>.<output>` form means the adapter needs no child→resource lookup table — just a `type_by_id` map built once.
|
||||
- The v1.1 regression (byte-identical S3 main.tf) confirms the extensions are backward-compatible.
|
||||
- **PASS.**
|
||||
|
||||
## P0 / P1
|
||||
|
||||
- **P0: none.**
|
||||
- **P1: none.** The adapter handles the ECS task definition's `container_definitions` (a JSON string built from image/port/env) via a targeted transformation — not a hardcoded shape, but the one pragmatic mapping the plan called for.
|
||||
- **P1: none.**
|
||||
|
||||
## Requirements covered
|
||||
|
||||
- **REQ-31:** Six new IR-typed L1 modules exist under `modules-ir/l1/` and are registered in `modules-ir/registry.json`: `l1-vpc` (4 inputs, 3 outputs, IR types aws:ec2:vpc/subnet/routetable), `l1-ecs-cluster` (2/2, aws:ecs:cluster), `l1-ecs-service` (10/2, aws:ecs:task_definition + aws:ecs:service), `l1-iam-role` (4/2, aws:iam:role), `l1-alb` (6/3, aws:elbv2:loadbalancer/listener/targetgroup), `l1-ecr` (2/2, aws:ecr:repository). The adapter `TYPE_MAP` is expanded to 12 IR types. The v1.1 `l1-s3` regression passes (byte-identical output). **VERIFIED.**
|
||||
- **REQ-32:** `l2-microservice` thin-composition exists under `modules-ir/l2/l2-microservice/` referencing the six ECS L1s (depth 1, within max-depth-5). `schemas/contract.schema.json` is extended with microservice inputs (`image: string`, `port: number`, `env: object`, `healthcheck: object`) and validates `contracts/microservice.yaml`. Contract→IR resolution yields a complete target stack (11 resources across all 6 L1s with child→child refs). **VERIFIED.**
|
||||
|
||||
## Conclusion
|
||||
|
||||
Phase 13 is VERIFIED. The L1 catalog is ready for Phase 14's
|
||||
`l2-microservice` thin-composition (which will reference these 6 L1s)
|
||||
and Phase 15's `terraform apply` (which will provision them). The adapter
|
||||
is now a clean table-driven translator — adding future L1s (v1.3+) is a
|
||||
matter of extending the three maps, not writing new emit logic.
|
||||
Phase 14 is VERIFIED. The `l2-microservice` composition + extended
|
||||
resolver + extended adapter are ready for Phase 15's `terraform apply`
|
||||
against real AWS. The resolution path is complete: contract → IR (11
|
||||
resources) → Terraform (11 resource blocks + interpolations). The v1.1
|
||||
spike regression passes.
|
||||
@@ -11,9 +11,21 @@ Steps:
|
||||
3. Look up the L2 in modules-ir/registry.json.
|
||||
4. Load the L2's composition.json (the thin-composition tree).
|
||||
5. Map the contract's inputs through the composition's wires to the
|
||||
child L1's inputs.
|
||||
child L1s' inputs. Two wire kinds:
|
||||
- passthrough: {target, input} (or an array of the same) -> the
|
||||
concrete contract value.
|
||||
- child->child: {target, input, source:"child:<id>.<output>"} ->
|
||||
a "ref:<ir_resource_id>.<output>" string (value known at apply
|
||||
time only).
|
||||
A wire value may be a single object or an array of objects (for
|
||||
contract inputs that fan out to multiple children); both forms are
|
||||
iterated.
|
||||
6. Emit an IR instance {version, stack:{name, kind:l2, depth},
|
||||
resources:[<L1 instances with concrete inputs>], relationships:[...]}.
|
||||
Multi-resource L1s (interface.json has a `resources` array) expand
|
||||
into one IR resource per entry, id `<child_id>-<type_suffix>` where
|
||||
type_suffix is the last IR-type segment with underscores stripped;
|
||||
single-resource L1s keep the child id verbatim.
|
||||
7. Validate the IR instance against schemas/ir.schema.json.
|
||||
|
||||
CLI: contract_resolver.py <contract.yaml> <out_ir.json>
|
||||
@@ -35,6 +47,66 @@ def _load_json(path):
|
||||
return json.load(fh)
|
||||
|
||||
|
||||
def _iter_wire_targets(wire_value):
|
||||
"""Yield each target-spec from a wire value (single object or array)."""
|
||||
if isinstance(wire_value, list):
|
||||
for spec in wire_value:
|
||||
yield spec
|
||||
elif isinstance(wire_value, dict):
|
||||
yield wire_value
|
||||
|
||||
|
||||
def _type_suffix(ir_type):
|
||||
"""Last segment of an IR type, underscores stripped (e.g. aws:ec2:vpc -> vpc,
|
||||
aws:elbv2:targetgroup -> targetgroup, aws:ecs:task_definition -> taskdefinition)."""
|
||||
return ir_type.rsplit(":", 1)[-1].replace("_", "")
|
||||
|
||||
|
||||
def _resolve_child_ref(source, child_id, l1_iface, child_ir_ids):
|
||||
"""Resolve a "child:<id>.<output>" source to "ref:<ir_resource_id>.<output>".
|
||||
|
||||
The ir_resource_id is the producing child's sub-resource that
|
||||
declares the output. For single-resource L1s that is the child id;
|
||||
for multi-resource L1s the L1's `resources` array is scanned for
|
||||
which sub-resource declares the output (exact match, then a
|
||||
singular->plural fallback so e.g. `subnet_ids` matches a per-resource
|
||||
`subnet_id`). The ref's output name is the per-resource output name
|
||||
when matched that way, else the source output name verbatim.
|
||||
"""
|
||||
prefix = "child:"
|
||||
if not source.startswith(prefix):
|
||||
raise ValueError(f"unsupported wire source {source!r}")
|
||||
body = source[len(prefix):]
|
||||
src_child_id, src_output = body.split(".", 1)
|
||||
if src_child_id != child_id:
|
||||
# Cross-child reference: look up the producing child's first IR
|
||||
# resource id (the child->child wiring table is keyed by child id
|
||||
# by the caller; this branch is unused for v1.2's wires but kept
|
||||
# for completeness).
|
||||
ir_resource_id = child_ir_ids.get(src_child_id, src_child_id)
|
||||
return f"ref:{ir_resource_id}.{src_output}"
|
||||
# Same-child reference: find the producing sub-resource.
|
||||
resources = l1_iface.get("resources")
|
||||
if not resources:
|
||||
return f"ref:{child_id}.{src_output}"
|
||||
for idx, sub in enumerate(resources):
|
||||
sub_outputs = sub.get("outputs", [])
|
||||
if src_output in sub_outputs:
|
||||
ir_id = child_ir_ids[child_id][idx]
|
||||
return f"ref:{ir_id}.{src_output}"
|
||||
# Singular->plural fallback (subnet_ids -> subnet_id).
|
||||
singular = src_output[:-1] if src_output.endswith("s") else src_output
|
||||
for idx, sub in enumerate(resources):
|
||||
sub_outputs = sub.get("outputs", [])
|
||||
if singular in sub_outputs:
|
||||
ir_id = child_ir_ids[child_id][idx]
|
||||
return f"ref:{ir_id}.{singular}"
|
||||
# No per-resource match: point at the first sub-resource, keep the
|
||||
# source output name verbatim.
|
||||
ir_id = child_ir_ids[child_id][0]
|
||||
return f"ref:{ir_id}.{src_output}"
|
||||
|
||||
|
||||
def resolve(contract_path, repo_root=None):
|
||||
"""Resolve a contract YAML to an IR instance dict."""
|
||||
rr = repo_root or REPO_ROOT
|
||||
@@ -60,37 +132,91 @@ def resolve(contract_path, repo_root=None):
|
||||
composition_key = entry.get("composition") or entry.get("interface")
|
||||
composition = _load_json(os.path.join(rr, composition_key))
|
||||
|
||||
# 5. Map the contract's inputs through the wires to the child L1's inputs.
|
||||
# 5. Map the contract's inputs through the wires to the child L1s' inputs.
|
||||
wires = composition.get("wires", {})
|
||||
contract_inputs = contract.get("inputs", {})
|
||||
children = composition.get("children", [])
|
||||
|
||||
resources = []
|
||||
relationships = []
|
||||
# Pre-load every child's L1 interface + compute IR resource ids.
|
||||
child_ifaces = {}
|
||||
child_ir_ids = {}
|
||||
for child in children:
|
||||
child_id = child["id"]
|
||||
child_module = child["module"] # e.g. l1-s3@1.0.0
|
||||
# Map inputs via wires whose target is this child.
|
||||
child_inputs = {}
|
||||
for wire_name, wire in wires.items():
|
||||
if wire.get("target") == child_id and wire_name in contract_inputs:
|
||||
child_inputs[wire["input"]] = contract_inputs[wire_name]
|
||||
# Load the L1 interface to get the IR type + outputs.
|
||||
child_module = child["module"]
|
||||
l1_name, l1_version = child_module.split("@", 1)
|
||||
l1_entry = registry.get(l1_name, {}).get(l1_version)
|
||||
if not l1_entry:
|
||||
raise ValueError(f"L1 {child_module!r} not in registry")
|
||||
l1_iface = _load_json(os.path.join(rr, l1_entry["interface"]))
|
||||
resources.append({
|
||||
"id": child_id,
|
||||
"type": l1_iface["type"],
|
||||
"module": child_module,
|
||||
"inputs": child_inputs,
|
||||
"outputs": l1_iface.get("outputs", {}),
|
||||
})
|
||||
relationships.append({"from": "root", "to": child_id, "kind": "parent"})
|
||||
child_ifaces[child_id] = l1_iface
|
||||
sub_resources = l1_iface.get("resources")
|
||||
if sub_resources:
|
||||
child_ir_ids[child_id] = [
|
||||
f"{child_id}-{_type_suffix(sub['type'])}" for sub in sub_resources
|
||||
]
|
||||
else:
|
||||
child_ir_ids[child_id] = [child_id]
|
||||
|
||||
# Build each child's mapped inputs (concrete values + ref strings).
|
||||
child_inputs_map = {child["id"]: {} for child in children}
|
||||
for wire_name, wire_value in wires.items():
|
||||
for spec in _iter_wire_targets(wire_value):
|
||||
target = spec.get("target")
|
||||
if target not in child_inputs_map:
|
||||
continue
|
||||
input_name = spec["input"]
|
||||
source = spec.get("source")
|
||||
if source:
|
||||
# Child->child reference: emit a ref string.
|
||||
src_child_id = source[len("child:"):].split(".", 1)[0]
|
||||
child_inputs_map[target][input_name] = _resolve_child_ref(
|
||||
source, src_child_id, child_ifaces[src_child_id], child_ir_ids
|
||||
)
|
||||
else:
|
||||
# Contract->child passthrough.
|
||||
if wire_name in contract_inputs:
|
||||
child_inputs_map[target][input_name] = contract_inputs[wire_name]
|
||||
|
||||
# 6. Emit the IR instance.
|
||||
resources = []
|
||||
relationships = []
|
||||
for child in children:
|
||||
child_id = child["id"]
|
||||
child_module = child["module"]
|
||||
l1_iface = child_ifaces[child_id]
|
||||
l1_outputs = l1_iface.get("outputs", {})
|
||||
child_inputs = child_inputs_map[child_id]
|
||||
sub_resources = l1_iface.get("resources")
|
||||
ir_ids = child_ir_ids[child_id]
|
||||
if sub_resources:
|
||||
for idx, sub in enumerate(sub_resources):
|
||||
ir_id = ir_ids[idx]
|
||||
sub_in_names = sub.get("inputs", [])
|
||||
sub_out_names = sub.get("outputs", [])
|
||||
sub_inputs = {
|
||||
n: child_inputs[n] for n in sub_in_names if n in child_inputs
|
||||
}
|
||||
sub_outputs = {
|
||||
n: l1_outputs[n] for n in sub_out_names if n in l1_outputs
|
||||
}
|
||||
resources.append({
|
||||
"id": ir_id,
|
||||
"type": sub["type"],
|
||||
"module": child_module,
|
||||
"inputs": sub_inputs,
|
||||
"outputs": sub_outputs,
|
||||
})
|
||||
relationships.append({"from": "root", "to": ir_id, "kind": "parent"})
|
||||
else:
|
||||
resources.append({
|
||||
"id": child_id,
|
||||
"type": l1_iface["type"],
|
||||
"module": child_module,
|
||||
"inputs": child_inputs,
|
||||
"outputs": l1_outputs,
|
||||
})
|
||||
relationships.append({"from": "root", "to": child_id, "kind": "parent"})
|
||||
|
||||
ir_instance = {
|
||||
"version": "1.0.0",
|
||||
"stack": {
|
||||
|
||||
@@ -82,13 +82,49 @@ def _tf_value(value):
|
||||
if isinstance(value, (int, float)) and not isinstance(value, bool):
|
||||
return str(value)
|
||||
if isinstance(value, str):
|
||||
if value.startswith("ref:"):
|
||||
raise ValueError("ref: values must be resolved via _ref_expr, not _tf_value")
|
||||
return f'"{value}"'
|
||||
if isinstance(value, (dict, list)):
|
||||
return f"jsonencode({json.dumps(value, sort_keys=True)})"
|
||||
raise ValueError(f"unsupported input value type {type(value).__name__}")
|
||||
|
||||
|
||||
def _emit_resource(resource):
|
||||
def _ref_expr(ref_value, type_by_id):
|
||||
"""Translate a "ref:<ir_resource_id>.<output>" string to a Terraform
|
||||
interpolation "${<tf_type>.<id>.<attr>}".
|
||||
|
||||
<ir_resource_id> is the IR resource id of the producing resource;
|
||||
<output> is the per-resource output name (e.g. `subnet_id`,
|
||||
`cluster_arn`); the attribute is mapped through OUTPUT_MAP for the
|
||||
referenced resource's IR type. The resolver emits the ref using the
|
||||
IR resource id directly (not the child id), so no child->resource
|
||||
lookup table is needed here.
|
||||
"""
|
||||
body = ref_value[len("ref:"):]
|
||||
rid, out_name = body.split(".", 1)
|
||||
rtype = type_by_id.get(rid)
|
||||
if not rtype:
|
||||
raise ValueError(f"ref to unknown IR resource id {rid!r}")
|
||||
tf_type = TYPE_MAP.get(rtype)
|
||||
if not tf_type:
|
||||
raise ValueError(f"ref target {rid!r} has unknown IR type {rtype!r}")
|
||||
out_map = OUTPUT_MAP.get(rtype, {})
|
||||
tf_attr = out_map.get(out_name, out_name)
|
||||
return f"${{{tf_type}.{rid}.{tf_attr}}}"
|
||||
|
||||
|
||||
def _value_expr(value, type_by_id=None):
|
||||
"""Render a value as a Terraform expression fragment. A "ref:<id>.<output>"
|
||||
string becomes a Terraform interpolation; other values use _tf_value."""
|
||||
if isinstance(value, str) and value.startswith("ref:"):
|
||||
if type_by_id is None:
|
||||
raise ValueError("ref: value encountered without a type_by_id table")
|
||||
return _ref_expr(value, type_by_id)
|
||||
return _tf_value(value)
|
||||
|
||||
|
||||
def _emit_resource(resource, type_by_id=None):
|
||||
rtype = resource["type"]
|
||||
rid = resource["id"]
|
||||
tf_type = TYPE_MAP.get(rtype)
|
||||
@@ -106,14 +142,20 @@ def _emit_resource(resource):
|
||||
if rtype == "aws:iam:role" and in_name == "managed_policies":
|
||||
continue
|
||||
if rtype == "aws:elbv2:loadbalancer" and in_name == "subnets":
|
||||
body.append(f"subnets = [{value}]" if isinstance(value, str) else f"subnets = {_tf_value(value)}")
|
||||
if isinstance(value, str) and value.startswith("ref:"):
|
||||
body.append(f"subnets = [{_ref_expr(value, type_by_id)}]")
|
||||
else:
|
||||
body.append(f"subnets = [{value}]" if isinstance(value, str) else f"subnets = {_tf_value(value)}")
|
||||
continue
|
||||
if rtype == "aws:elbv2:loadbalancer" and in_name == "security_group":
|
||||
body.append(f"security_groups = [{value}]" if isinstance(value, str) else f"security_groups = {_tf_value(value)}")
|
||||
if isinstance(value, str) and value.startswith("ref:"):
|
||||
body.append(f"security_groups = [{_ref_expr(value, type_by_id)}]")
|
||||
else:
|
||||
body.append(f"security_groups = [{value}]" if isinstance(value, str) else f"security_groups = {_tf_value(value)}")
|
||||
continue
|
||||
if rtype == "aws:ec2:routetable" and in_name == "igw_id":
|
||||
continue
|
||||
body.append(f"{arg} = {_tf_value(value)}")
|
||||
body.append(f"{arg} = {_value_expr(value, type_by_id)}")
|
||||
nfrs = resource.get("nfrs", {})
|
||||
if isinstance(nfrs, dict) and "versioning" in nfrs and rtype == "aws:s3:bucket":
|
||||
versioning = nfrs.get("versioning", True)
|
||||
@@ -209,9 +251,13 @@ def adapt(ir_instance, out_dir):
|
||||
)
|
||||
|
||||
# --- main.tf: resources + outputs ---
|
||||
# Build an IR-resource-id -> IR-type table so `ref:` input values can
|
||||
# be resolved to Terraform interpolations without a child->resource
|
||||
# lookup (the resolver emits refs with the IR resource id directly).
|
||||
type_by_id = {r["id"]: r["type"] for r in resources}
|
||||
main_tf_parts = []
|
||||
for r in resources:
|
||||
main_tf_parts.append(_emit_resource(r))
|
||||
main_tf_parts.append(_emit_resource(r, type_by_id))
|
||||
rid = r["id"]
|
||||
rtype = r["type"]
|
||||
tf_type = TYPE_MAP.get(rtype)
|
||||
|
||||
@@ -0,0 +1,13 @@
|
||||
stack: l2-microservice
|
||||
environment: dev
|
||||
inputs:
|
||||
name: acdl-microservice
|
||||
cidr: "10.0.0.0/16"
|
||||
azs: "us-east-1a,us-east-1b"
|
||||
image: "581513795199.dkr.ecr.us-east-1.amazonaws.com/acdl-microservice:latest"
|
||||
port: 8080
|
||||
cpu: 256
|
||||
memory: 512
|
||||
role_name: acdl-microservice-exec
|
||||
assume_role_policy: '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"ecs-tasks.amazonaws.com"},"Action":"sts:AssumeRole"}]}'
|
||||
managed_policies: "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"
|
||||
@@ -0,0 +1,85 @@
|
||||
# l2-microservice — thin-composition (ECS Fargate microservice)
|
||||
|
||||
The v1.2 L2. A thin-composition that references 6 L1s (depth 1):
|
||||
`l1-vpc`, `l1-ecs-cluster`, `l1-ecr`, `l1-iam-role`, `l1-alb`,
|
||||
`l1-ecs-service`. The contract's inputs (`name`, `cidr`, `azs`,
|
||||
`image`, `port`, `cpu`, `memory`, `env`, `protocol`, `region`,
|
||||
`role_name`, `assume_role_policy`, `managed_policies`) map to the
|
||||
children's inputs through two wire kinds.
|
||||
|
||||
## Composition (the IR-typed thin-composition tree)
|
||||
|
||||
See `composition.json`: `kind=l2`, `depth=1`, six children.
|
||||
|
||||
### Children
|
||||
|
||||
| child id | L1 module | IR type(s) |
|
||||
|----------|-----------|------------|
|
||||
| `vpc` | `l1-vpc@1.0.0` | `aws:ec2:vpc`, `aws:ec2:subnet`, `aws:ec2:routetable` |
|
||||
| `cluster` | `l1-ecs-cluster@1.0.0` | `aws:ecs:cluster` |
|
||||
| `ecr` | `l1-ecr@1.0.0` | `aws:ecr:repository` |
|
||||
| `roles` | `l1-iam-role@1.0.0` | `aws:iam:role` |
|
||||
| `alb` | `l1-alb@1.0.0` | `aws:elbv2:loadbalancer`, `aws:elbv2:listener`, `aws:elbv2:targetgroup` |
|
||||
| `service` | `l1-ecs-service@1.0.0` | `aws:ecs:task_definition`, `aws:ecs:service` |
|
||||
|
||||
Multi-resource L1s (`vpc`, `alb`, `service`) declare a `resources`
|
||||
array in their `interface.json`; the resolver expands each child into
|
||||
one IR resource per `resources` entry (id scheme `<child_id>-<type_suffix>`
|
||||
where `type_suffix` is the last segment of the IR type with underscores
|
||||
stripped — e.g. `vpc-vpc`, `vpc-subnet`, `vpc-routetable`,
|
||||
`alb-loadbalancer`, `alb-targetgroup`, `alb-listener`,
|
||||
`service-taskdefinition`, `service-service`. The hyphen separator keeps
|
||||
the id valid against `schemas/ir.schema.json`'s
|
||||
`^[a-z][a-z0-9-]*$` resource id pattern). Single-resource L1s keep the
|
||||
child id verbatim (`cluster`, `ecr`, `roles`).
|
||||
|
||||
### Wire kinds
|
||||
|
||||
1. **Contract→child passthrough** — wire name = contract input name;
|
||||
target = child id, input = child's input name. For contract inputs
|
||||
that fan out to multiple children (`name`, `port`, `region`), the
|
||||
wire value is an array of `{target, input}` objects; otherwise a
|
||||
single object. Resolves to the concrete contract value.
|
||||
|
||||
2. **Child→child references** — wire with `source: "child:<id>.<output>"`.
|
||||
The value is only known at apply time, so the resolver emits the IR
|
||||
input as the string `ref:<ir_resource_id>.<output>` (the IR resource
|
||||
id of the *producing* child's first resource — for single-resource
|
||||
L1s that is the child id, for multi-resource L1s it is
|
||||
`<child_id>-<type_suffix>` of the first resource in the `resources`
|
||||
array that declares the output). The adapter translates `ref:` to a
|
||||
Terraform interpolation.
|
||||
|
||||
Wires used by this composition:
|
||||
|
||||
- Passthrough: `name` (→vpc/cluster/ecr/alb), `cidr` (→vpc), `azs`
|
||||
(→vpc), `image` (→service), `port` (→service/alb), `cpu` (→service),
|
||||
`memory` (→service), `env` (→service), `protocol` (→alb), `region`
|
||||
(→all 6), `role_name` (→roles), `assume_role_policy` (→roles),
|
||||
`managed_policies` (→roles).
|
||||
- Child→child: `cluster_arn` (cluster→service), `subnet_ids`
|
||||
(vpc→service/alb `subnets`), `target_group_arn` (alb→service
|
||||
`lb_target_group_arn`), `role_arn` (roles→service/alb
|
||||
`security_group`).
|
||||
|
||||
## IR → Terraform mapping (D-P10-1)
|
||||
|
||||
The Terraform adapter consumes the *resolved IR instance* (which has
|
||||
`kind=l2` + all 6 L1s expanded into one IR resource per entry in each
|
||||
L1's `resources` array, with `ref:` strings on the consumer inputs).
|
||||
For a depth-1 thin-composition, the L2 root module **IS** the union of
|
||||
the L1 resources — no separate `module "l1_x" { source = "..." }`
|
||||
blocks. The existing adapter `TYPE_MAP` + `INPUT_MAP` + `OUTPUT_MAP`
|
||||
tables handle every IR type. `ref:<id>.<output>` inputs are translated
|
||||
to `${<tf_type>.<id>.<attr>}` (attribute mapped through `OUTPUT_MAP`
|
||||
for the referenced resource's type). The `relationships` array records
|
||||
the parent composition tree; ordering is implicit in the resource list.
|
||||
|
||||
v1.3+ may emit real `module "l1_x" { source = "..." }` blocks once L1s
|
||||
are published Terraform modules rather than inline resources.
|
||||
|
||||
## Versioning (W3.D)
|
||||
|
||||
`1.0.0` — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps
|
||||
require a new registry entry (immutable publication); old entries enter
|
||||
a 12-month deprecation window.
|
||||
@@ -0,0 +1,55 @@
|
||||
{
|
||||
"name": "l2-microservice",
|
||||
"version": "1.0.0",
|
||||
"kind": "l2",
|
||||
"depth": 1,
|
||||
"description": "Thin-composition: an ECS Fargate microservice. References 6 L1s (vpc, cluster, ecr, roles, alb, service).",
|
||||
"children": [
|
||||
{"id": "vpc", "module": "l1-vpc@1.0.0"},
|
||||
{"id": "cluster", "module": "l1-ecs-cluster@1.0.0"},
|
||||
{"id": "ecr", "module": "l1-ecr@1.0.0"},
|
||||
{"id": "roles", "module": "l1-iam-role@1.0.0"},
|
||||
{"id": "alb", "module": "l1-alb@1.0.0"},
|
||||
{"id": "service", "module": "l1-ecs-service@1.0.0"}
|
||||
],
|
||||
"wires": {
|
||||
"name": [
|
||||
{"target": "vpc", "input": "name"},
|
||||
{"target": "cluster", "input": "name"},
|
||||
{"target": "ecr", "input": "name"},
|
||||
{"target": "alb", "input": "name"}
|
||||
],
|
||||
"cidr": {"target": "vpc", "input": "cidr"},
|
||||
"azs": {"target": "vpc", "input": "azs"},
|
||||
"image": {"target": "service", "input": "image"},
|
||||
"port": [
|
||||
{"target": "service", "input": "port"},
|
||||
{"target": "alb", "input": "port"}
|
||||
],
|
||||
"cpu": {"target": "service", "input": "cpu"},
|
||||
"memory": {"target": "service", "input": "memory"},
|
||||
"env": {"target": "service", "input": "env"},
|
||||
"protocol": {"target": "alb", "input": "protocol"},
|
||||
"region": [
|
||||
{"target": "vpc", "input": "region"},
|
||||
{"target": "cluster", "input": "region"},
|
||||
{"target": "ecr", "input": "region"},
|
||||
{"target": "roles", "input": "region"},
|
||||
{"target": "alb", "input": "region"},
|
||||
{"target": "service", "input": "region"}
|
||||
],
|
||||
"role_name": {"target": "roles", "input": "role_name"},
|
||||
"assume_role_policy": {"target": "roles", "input": "assume_role_policy"},
|
||||
"managed_policies": {"target": "roles", "input": "managed_policies"},
|
||||
"cluster_arn": {"target": "service", "input": "cluster_arn", "source": "child:cluster.cluster_arn"},
|
||||
"subnet_ids": [
|
||||
{"target": "service", "input": "subnets", "source": "child:vpc.subnet_ids"},
|
||||
{"target": "alb", "input": "subnets", "source": "child:vpc.subnet_ids"}
|
||||
],
|
||||
"target_group_arn": {"target": "service", "input": "lb_target_group_arn", "source": "child:alb.target_group_arn"},
|
||||
"role_arn": [
|
||||
{"target": "service", "input": "security_group", "source": "child:roles.role_arn"},
|
||||
{"target": "alb", "input": "security_group", "source": "child:roles.role_arn"}
|
||||
]
|
||||
}
|
||||
}
|
||||
@@ -54,5 +54,12 @@
|
||||
"published_at": "2026-07-21T19:30:00Z",
|
||||
"deprecated": false
|
||||
}
|
||||
},
|
||||
"l2-microservice": {
|
||||
"1.0.0": {
|
||||
"composition": "modules-ir/l2/l2-microservice/composition.json",
|
||||
"published_at": "2026-07-21T22:00:00Z",
|
||||
"deprecated": false
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -20,7 +20,17 @@
|
||||
"inputs": {
|
||||
"type": "object",
|
||||
"description": "L2-level parameter map. Free-form in v1, typed per-L1 in v1.2 (W3.E).",
|
||||
"additionalProperties": {"type": ["string", "number", "boolean"]}
|
||||
"additionalProperties": {"type": ["string", "number", "boolean", "object"]}
|
||||
},
|
||||
"healthcheck": {
|
||||
"type": "object",
|
||||
"description": "Healthcheck config for the service.",
|
||||
"properties": {
|
||||
"path": {"type": "string"},
|
||||
"interval": {"type": "number"},
|
||||
"timeout": {"type": "number"},
|
||||
"healthy_threshold": {"type": "number"}
|
||||
}
|
||||
},
|
||||
"validation": {
|
||||
"type": "object",
|
||||
|
||||
Executable
+100
@@ -0,0 +1,100 @@
|
||||
#!/usr/bin/env bash
|
||||
# scripts/verify_phase14.sh - verify Phase 14 (l2-microservice-and-contract-schema).
|
||||
set -euo pipefail
|
||||
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
||||
cd "$ROOT"
|
||||
|
||||
fail() { echo "FAIL: $*" >&2; exit 1; }
|
||||
|
||||
echo "=== Phase 14 verification ==="
|
||||
|
||||
# 1. l2-microservice composition + README
|
||||
[ -f modules-ir/l2/l2-microservice/composition.json ] || fail "composition.json missing"
|
||||
[ -f modules-ir/l2/l2-microservice/README.md ] || fail "README.md missing"
|
||||
python3 -c "import json; d=json.load(open('modules-ir/l2/l2-microservice/composition.json')); assert d['name']=='l2-microservice'; assert d['kind']=='l2'; assert d['depth']==1; assert len(d['children'])==6, f'expected 6 children, got {len(d[\"children\"])}'; print('composition: OK (6 children)')"
|
||||
|
||||
# 2. Registry has l2-microservice
|
||||
python3 -c "import json; r=json.load(open('modules-ir/registry.json')); assert 'l2-microservice' in r; assert r['l2-microservice']['1.0.0']['deprecated']==False; print('registry: l2-microservice@1.0.0 OK')"
|
||||
|
||||
# 3. Contract schema extended (inputs allow objects + healthcheck field)
|
||||
python3 - <<'PY'
|
||||
import json
|
||||
s = json.load(open("schemas/contract.schema.json"))
|
||||
ap = s["properties"]["inputs"]["additionalProperties"]
|
||||
assert "object" in ap["type"], "inputs.additionalProperties doesn't allow object"
|
||||
assert "healthcheck" in s["properties"], "no healthcheck field"
|
||||
print("contract schema: OK (inputs allow objects + healthcheck field)")
|
||||
PY
|
||||
|
||||
# 4. contracts/microservice.yaml exists + validates
|
||||
[ -f contracts/microservice.yaml ] || fail "contracts/microservice.yaml missing"
|
||||
python3 - <<'PY'
|
||||
import yaml, json, jsonschema
|
||||
with open("contracts/microservice.yaml") as fh:
|
||||
c = yaml.safe_load(fh)
|
||||
assert c["stack"] == "l2-microservice", f"stack={c['stack']}"
|
||||
assert c["environment"] == "dev"
|
||||
assert "name" in c["inputs"]
|
||||
assert "image" in c["inputs"]
|
||||
assert "port" in c["inputs"]
|
||||
schema = json.load(open("schemas/contract.schema.json"))
|
||||
jsonschema.validate(c, schema)
|
||||
print("microservice.yaml: OK (validates against contract schema)")
|
||||
PY
|
||||
|
||||
# 5. Resolver + adapter py_compile
|
||||
python3 -m py_compile acdl_platform/contract_resolver.py adapters/terraform/adapter.py || fail "py_compile failed"
|
||||
echo "py_compile: OK"
|
||||
|
||||
# 6. v1.1 regression: spike.yaml still resolves + adapts
|
||||
WORK=/tmp/p14_verify
|
||||
rm -rf "$WORK"; mkdir -p "$WORK"
|
||||
python3 acdl_platform/contract_resolver.py contracts/spike.yaml "$WORK/spike_ir.json" 2>/dev/null || fail "v1.1 regression: resolver failed"
|
||||
python3 adapters/terraform/adapter.py "$WORK/spike_ir.json" "$WORK/spike_tf" 2>/dev/null || fail "v1.1 regression: adapter failed"
|
||||
grep -q 'resource "aws_s3_bucket" "s3"' "$WORK/spike_tf/main.tf" || fail "v1.1 regression: no aws_s3_bucket"
|
||||
grep -q 'bucket = "acdl-spike-bucket"' "$WORK/spike_tf/main.tf" || fail "v1.1 regression: no bucket arg"
|
||||
echo "v1.1 regression: OK (spike.yaml -> l1-s3 -> aws_s3_bucket)"
|
||||
|
||||
# 7. v1.2 resolution: microservice.yaml -> IR with all 6 L1s' resources
|
||||
python3 acdl_platform/contract_resolver.py contracts/microservice.yaml "$WORK/ms_ir.json" 2>/dev/null || fail "v1.2: resolver failed"
|
||||
python3 - <<'PY'
|
||||
import json
|
||||
ir = json.load(open("/tmp/p14_verify/ms_ir.json"))
|
||||
rsc = ir["resources"]
|
||||
print(f"v1.2 IR: {len(rsc)} resources")
|
||||
assert len(rsc) >= 6, f"expected >=6 resources, got {len(rsc)}"
|
||||
types = {r["type"] for r in rsc}
|
||||
expected_types = {"aws:ec2:vpc", "aws:ec2:subnet", "aws:ec2:routetable", "aws:ecs:cluster", "aws:ecr:repository", "aws:iam:role", "aws:elbv2:loadbalancer", "aws:elbv2:targetgroup", "aws:elbv2:listener", "aws:ecs:task_definition", "aws:ecs:service"}
|
||||
assert types == expected_types, f"missing types: {expected_types - types}, extra: {types - expected_types}"
|
||||
# Check child->child refs exist
|
||||
ref_found = False
|
||||
for r in rsc:
|
||||
for v in r.get("inputs", {}).values():
|
||||
if isinstance(v, str) and v.startswith("ref:"):
|
||||
ref_found = True
|
||||
break
|
||||
assert ref_found, "no child->child refs in IR"
|
||||
print(f" types: {sorted(types)}")
|
||||
print(" child->child refs: present")
|
||||
PY
|
||||
|
||||
# 8. v1.2 adaptation: IR -> TF
|
||||
python3 adapters/terraform/adapter.py "$WORK/ms_ir.json" "$WORK/ms_tf" 2>/dev/null || fail "v1.2: adapter failed"
|
||||
grep -q 'resource "aws_vpc"' "$WORK/ms_tf/main.tf" || fail "v1.2: no aws_vpc in TF"
|
||||
grep -q 'resource "aws_ecs_cluster"' "$WORK/ms_tf/main.tf" || fail "v1.2: no aws_ecs_cluster in TF"
|
||||
grep -q 'resource "aws_ecs_service"' "$WORK/ms_tf/main.tf" || fail "v1.2: no aws_ecs_service in TF"
|
||||
grep -q 'resource "aws_ecr_repository"' "$WORK/ms_tf/main.tf" || fail "v1.2: no aws_ecr_repository in TF"
|
||||
grep -q 'resource "aws_lb"' "$WORK/ms_tf/main.tf" || fail "v1.2: no aws_lb in TF"
|
||||
grep -q 'resource "aws_iam_role"' "$WORK/ms_tf/main.tf" || fail "v1.2: no aws_iam_role in TF"
|
||||
# Check ref translation (interpolations present)
|
||||
grep -q 'aws_ecs_cluster.cluster.arn' "$WORK/ms_tf/main.tf" || fail "v1.2: no cluster.arn interpolation"
|
||||
echo "v1.2 adaptation: OK (11 resources + interpolations in main.tf)"
|
||||
|
||||
# 9. .ciagent/ consistency
|
||||
grep -q '"milestone": "v1.2"' .ciagent/config.json || fail "config.json: milestone not v1.2"
|
||||
echo ".ciagent/ consistency: OK"
|
||||
|
||||
echo ""
|
||||
echo "=== Phase 14: VERIFIED ==="
|
||||
echo "l2-microservice composition (6 L1s); contract schema extended; resolver child->child wiring; 11 IR resources; TF valid."
|
||||
exit 0
|
||||
Reference in New Issue
Block a user