From b026d5f041c2c1bd553fa579c1c973eefc8be95a Mon Sep 17 00:00:00 2001
From: Jon Chery <jchery@jccapital.xyz>
Date: Wed, 22 Jul 2026 19:47:16 +0000
Subject: [PATCH] =?UTF-8?q?docs(P0):=20clarify=20v1.7=20=E2=80=94=2012=20d?=
 =?UTF-8?q?ecisions=20resolved?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---ci---
project: acdl
phase: 0
milestone: v1.7
status: clarify
decisions:
  - id: D-048
    decision: rename static-asset -> static-assets everywhere including .ciagent/ historical narrative (overrides v1.6 preservation precedent)
    rationale: user chose full rewrite; maximally consistent; reconstruction test updated to expect static-assets
    confidence: 0.95
    alternatives: [rewrite references only, preserve verbatim phase descriptions]
  - id: D-049
    decision: production stack = S3 + CloudFront (OAC) + WAF (domain-free)
    rationale: self-contained production edge; Route53/ACM are domain-dependent and deferred to documented extension points
    confidence: 0.90
    alternatives: [S3 + CloudFront only, full edge incl. Route53 + ACM]
  - id: D-050
    decision: outputs via SSM SecureString (KMS-encrypted) + GitHub PR comment / job summary
    rationale: two canonical mechanisms; SSM for runtime-injectable values; PR comment for developers; no raw secrets in logs
    confidence: 0.90
    alternatives: [SSM only, PR comment only]
  - id: D-051
    decision: contract ingestion storage = DynamoDB table acdl-contracts (PK consumerRepo, SK contractId#submittedAt, SSE via CMK, PITR)
    rationale: enables historical queries, impact analysis, CMDB-style queries, pattern detection; S3 flat-file mirror deferred
    confidence: 0.85
    alternatives: [S3 flat files only, both S3 source + DynamoDB index]
  - id: D-052
    decision: Wiz adapter = stub + schema path (no live Wiz tenant in CI)
    rationale: matches Checkov adapter pattern; typed interface, offline-testable, degrades gracefully when unconfigured
    confidence: 0.90
    alternatives: [full live integration]
  - id: D-053
    decision: Kyverno adapter = K8s-native policy adapter translating PolicyReport -> PolicyCheckResult; inactive for Terraform-only stacks
    rationale: platform emits Terraform not K8s manifests; adapter ready for GitOps reconciler roadmap item; sample policies included
    confidence: 0.85
    alternatives: [Kyverno-as-Terraform-policy]
  - id: D-054
    decision: tagging standard = required-tag set (acdl:owner, acdl:contract, acdl:environment, acdl:cost-center) enforced by Checkov custom YAML rule
    rationale: closes D-043 deferral (SKIPPED placeholder -> real check); naming-convention regex deferred (brittle across AWS resource types)
    confidence: 0.90
    alternatives: [required + naming convention]
  - id: D-055
    decision: error reporting = platform Lambda report_error action creates GitHub issue on platform repo; Gitea excluded
    rationale: uniform pathway via Lambda; consumer onboarding-granted Lambda-invoke permission is the only grant needed; no separate GitHub issues:write on consumer side; Gitea is CIAgent-only
    confidence: 0.85
    alternatives: [auto-create issue on platform repo directly, Slack/Teams webhook, email via SES]
  - id: D-056
    decision: ship v1.7.0; bump uses: from @v1.4 to @v1.6
    rationale: consumer-facing version tracks last released MAJOR.MINOR; consumers on @v1.4 stay on v1.4 behavior until they bump
    confidence: 0.90
    alternatives: [ship v1.7.0 keep uses: at @v1.4]
  - id: D-057
    decision: uses:/ref: bump + floating v1.6/v1 tag creation in Phase 22 (pointing at v1.6.0); release job (Phase 26) owns ongoing updates
    rationale: reference never points at a non-existent tag; sequencing avoids a temporarily broken reference
    confidence: 0.90
    alternatives: [bump in Phase 26, keep @v1.4 until milestone ship]
  - id: D-058
    decision: module examples = separate validated files in modules/<name>/examples/ validated against contract schema in platform-test pipeline
    rationale: examples cannot drift from schema silently; README references + excerpts them
    confidence: 0.85
    alternatives: [inline YAML in README only]
  - id: D-059
    decision: add RDS primitive (modules/l1/rds/) with engine input (enum: postgres, mysql, etc.) + multi-engine example
    rationale: concrete demonstration of multi-engine variation the requirement calls out; adds one primitive + examples
    confidence: 0.80
    alternatives: [illustrative only - document variations on existing modules]
---/ci---

12 ambiguities resolved at the CLARIFY stage (full autonomy — all within
locked constraints or user-directed scope). Decisions D-048..D-059
recorded in PROJECT.md Key Decisions (v1.7) table.