docs(P0): clarify v1.7 — 12 decisions resolved
---ci---
project: acdl
phase: 0
milestone: v1.7
status: clarify
decisions:
- id: D-048
decision: rename static-asset -> static-assets everywhere including .ciagent/ historical narrative (overrides v1.6 preservation precedent)
rationale: user chose full rewrite; maximally consistent; reconstruction test updated to expect static-assets
confidence: 0.95
alternatives: [rewrite references only, preserve verbatim phase descriptions]
- id: D-049
decision: production stack = S3 + CloudFront (OAC) + WAF (domain-free)
rationale: self-contained production edge; Route53/ACM are domain-dependent and deferred to documented extension points
confidence: 0.90
alternatives: [S3 + CloudFront only, full edge incl. Route53 + ACM]
- id: D-050
decision: outputs via SSM SecureString (KMS-encrypted) + GitHub PR comment / job summary
rationale: two canonical mechanisms; SSM for runtime-injectable values; PR comment for developers; no raw secrets in logs
confidence: 0.90
alternatives: [SSM only, PR comment only]
- id: D-051
decision: contract ingestion storage = DynamoDB table acdl-contracts (PK consumerRepo, SK contractId#submittedAt, SSE via CMK, PITR)
rationale: enables historical queries, impact analysis, CMDB-style queries, pattern detection; S3 flat-file mirror deferred
confidence: 0.85
alternatives: [S3 flat files only, both S3 source + DynamoDB index]
- id: D-052
decision: Wiz adapter = stub + schema path (no live Wiz tenant in CI)
rationale: matches Checkov adapter pattern; typed interface, offline-testable, degrades gracefully when unconfigured
confidence: 0.90
alternatives: [full live integration]
- id: D-053
decision: Kyverno adapter = K8s-native policy adapter translating PolicyReport -> PolicyCheckResult; inactive for Terraform-only stacks
rationale: platform emits Terraform not K8s manifests; adapter ready for GitOps reconciler roadmap item; sample policies included
confidence: 0.85
alternatives: [Kyverno-as-Terraform-policy]
- id: D-054
decision: tagging standard = required-tag set (acdl:owner, acdl:contract, acdl:environment, acdl:cost-center) enforced by Checkov custom YAML rule
rationale: closes D-043 deferral (SKIPPED placeholder -> real check); naming-convention regex deferred (brittle across AWS resource types)
confidence: 0.90
alternatives: [required + naming convention]
- id: D-055
decision: error reporting = platform Lambda report_error action creates GitHub issue on platform repo; Gitea excluded
rationale: uniform pathway via Lambda; consumer onboarding-granted Lambda-invoke permission is the only grant needed; no separate GitHub issues:write on consumer side; Gitea is CIAgent-only
confidence: 0.85
alternatives: [auto-create issue on platform repo directly, Slack/Teams webhook, email via SES]
- id: D-056
decision: ship v1.7.0; bump uses: from @v1.4 to @v1.6
rationale: consumer-facing version tracks last released MAJOR.MINOR; consumers on @v1.4 stay on v1.4 behavior until they bump
confidence: 0.90
alternatives: [ship v1.7.0 keep uses: at @v1.4]
- id: D-057
decision: uses:/ref: bump + floating v1.6/v1 tag creation in Phase 22 (pointing at v1.6.0); release job (Phase 26) owns ongoing updates
rationale: reference never points at a non-existent tag; sequencing avoids a temporarily broken reference
confidence: 0.90
alternatives: [bump in Phase 26, keep @v1.4 until milestone ship]
- id: D-058
decision: module examples = separate validated files in modules/<name>/examples/ validated against contract schema in platform-test pipeline
rationale: examples cannot drift from schema silently; README references + excerpts them
confidence: 0.85
alternatives: [inline YAML in README only]
- id: D-059
decision: add RDS primitive (modules/l1/rds/) with engine input (enum: postgres, mysql, etc.) + multi-engine example
rationale: concrete demonstration of multi-engine variation the requirement calls out; adds one primitive + examples
confidence: 0.80
alternatives: [illustrative only - document variations on existing modules]
---/ci---
12 ambiguities resolved at the CLARIFY stage (full autonomy — all within
locked constraints or user-directed scope). Decisions D-048..D-059
recorded in PROJECT.md Key Decisions (v1.7) table.
This commit is contained in:
Jon Chery