diff --git a/.ciagent/PERSONAS.md b/.ciagent/PERSONAS.md index 1b2887a..784fad3 100644 --- a/.ciagent/PERSONAS.md +++ b/.ciagent/PERSONAS.md @@ -4,7 +4,7 @@ milestone: v1.1 generated_at: 2026-07-21 generator: lead-developer verification_toolchain: - typecheck: "terraform validate && python3 -m py_compile platform/**/*.py && python3 -m jsonschema schemas/*.schema.json" + typecheck: "terraform validate && python3 -m py_compile acdl_platform/**/*.py && python3 -m jsonschema schemas/*.schema.json" test: "scripts/verify_phaseNN.sh" build: "terraform init" note: | @@ -35,7 +35,7 @@ verification_toolchain: - **Phase-specific:** false - **Frameworks:** python, json-schema, gitea-actions, act_runner, bash, yaml - **Constraints:** contract-schema-first, fail-fast-with-reason-codes, no-long-lived-credentials, severity-to-penalty-mapping-immutable -- **Territory:** `platform/confidence_signal.py`, `platform/contract_resolver.py`, `platform/outbox/**`, `schemas/**` (contract + IR + PolicyCheckResult), `contracts/**` (sample contracts), `.gitea/workflows/**` (pipeline) +- **Territory:** `acdl_platform/confidence_signal.py`, `acdl_platform/contract_resolver.py`, `acdl_platform/outbox_writer.py`, `schemas/**` (contract + IR + PolicyCheckResult), `contracts/**` (sample contracts), `.gitea/workflows/**` (pipeline) - **Reason:** Owns the contract schema, contract→IR resolution, the confidence signal (6 inputs + severity mapping), the DynamoDB outbox writer, and the central pipeline workflow. ### platform-engineer (custom) @@ -53,7 +53,7 @@ verification_toolchain: - **Phase-specific:** false - **Frameworks:** aws-iam, oidc, checkov, json-schema - **Constraints:** least-privilege, separation-of-duties-identity-distinctness, no-secrets-in-skill-markdown, audit-chain-extends-not-tears-up, critical-finding-hard-overrides-confidence -- **Territory:** `platform/hitl_matrix_design.md`, `platform/audit_ledger_design.md`, `adapters/terraform/policy/**` (Checkov adapter → PolicyCheckResult), `platform/separation_of_duties.py` +- **Territory:** `acdl_platform/hitl_matrix_design.md`, `acdl_platform/audit_ledger_design.md`, `adapters/terraform/policy/**` (Checkov adapter → PolicyCheckResult), `acdl_platform/separation_of_duties.py` - **Reason:** Owns the HITL matrix design, separation-of-duties (DynamoDB identity-distinctness), the audit ledger design (S3 Object Lock + JWS + chain), and the Checkov→PolicyCheckResult adapter. Enforces the "Safety is Computed, Not Assumed" + "Audit truth lives outside the repository" vision tenets. ### frontend-engineer @@ -77,7 +77,7 @@ verification_toolchain: ### data-engineer - **Domain:** data - **Active:** false -- **Reason:** No ORM/persistence framework. The v1.1 outbox is DynamoDB but accessed via boto3 calls inside `platform/outbox/**` (owned by backend-engineer); the audit ledger is S3 Object Lock + JWS (owned by security-engineer). No schema-migration layer, no ORM, no data-engineer territory. +- **Reason:** No ORM/persistence framework. The v1.1 outbox is DynamoDB but accessed via boto3 calls inside `acdl_platform/outbox_writer.py` (owned by backend-engineer); the audit ledger is S3 Object Lock + JWS (owned by security-engineer). No schema-migration layer, no ORM, no data-engineer territory. - **Phase-specific:** false - **Frameworks:** (would have been: drizzle, prisma) - **Constraints:** (would have been: schema-first, type-safe-orm) @@ -106,7 +106,7 @@ being right before backend wiring. ## Conflict resolutions (lead-developer arbitration) - `backend-engineer` vs `platform-engineer` over `schemas/ir.schema.json`: platform-engineer owns the IR (it is substrate-agnostic but infra-shaped); backend-engineer owns the contract schema and the contract→IR resolution (contract is the consumer surface). Co-authoring is expected; conflict goes to lead-developer. -- `backend-engineer` vs `security-engineer` over `platform/confidence_signal.py`: security-engineer owns the severity→penalty mapping + critical-override semantics; backend-engineer owns the 6-input weighted sum + per-env thresholds. The confidence signal is co-owned; conflicts go to lead-developer. +- `backend-engineer` vs `security-engineer` over `acdl_platform/confidence_signal.py`: security-engineer owns the severity→penalty mapping + critical-override semantics; backend-engineer owns the 6-input weighted sum + per-env thresholds. The confidence signal is co-owned; conflicts go to lead-developer. - `platform-engineer` vs `security-engineer` over `adapters/terraform/policy/**`: security-engineer owns the Checkov→PolicyCheckResult adapter (policy is a security concern); platform-engineer owns the Terraform adapter (substrate translation). No overlap. - `lead-developer` vs any: lead-developer owns `.ciagent/**` + `docs/**` meta + verification scripts; persona engineers do not edit CIAgent metadata or the vision/architecture source docs. diff --git a/.ciagent/ROADMAP.md b/.ciagent/ROADMAP.md index d3a3e11..7ee6535 100644 --- a/.ciagent/ROADMAP.md +++ b/.ciagent/ROADMAP.md @@ -78,7 +78,7 @@ locked commitments with one end-to-end implementation spike. Milestone `v1.1-spike` covers the real platform's first materialization. Ship tag at milestone COMPLETE: **`v1.2.0`** (feature milestone, next minor per ship.md). **Status: COMPLETE — all 5 phases shipped (v1.1.1..v1.1.5) + -verified; review READY TO SHIP (0 P0); audit pending.** +verified; review READY TO SHIP (0 P0); audit CLEAN.** ### Phase 06 — archive-demo-and-reorient - **Description:** Move the v1.0 demo (`modules/`, `scripts/`, `evidence-ui/`, `contracts/`, demo `.gitea/workflows/`) to `demo/`. Establish the new repo layout (`platform/`, `schemas/`, `adapters/`, `terraform/`, `modules-ir/`). Rewrite README to reflect the real platform. Verify the demo still runs from `demo/` (regression check). diff --git a/.ciagent/config.json b/.ciagent/config.json index 5cb38d4..78e1a7d 100644 --- a/.ciagent/config.json +++ b/.ciagent/config.json @@ -5,7 +5,7 @@ "slug": "acdl", "name": "Agentic Cloud Delivery Platform", "milestone": "v1.1", - "status": "specify" + "status": "complete" } ], "active_project": "acdl",