audit(v1.10): post-ship audit — PASS (1 issue fixed: ARCHITECTURE.md addendum)

Reconstruction: PASS — state fully reconstructable from 9 ---ci--- blocks. File discipline: PASS (after fix) — ARCHITECTURE.md had 0 references to v1.10 components; added a v1.10 addendum covering regression-class VERIFY, local emulating adapters, capability re-verification sweep, and the 7 adapter defect fixes. Branch hygiene: PASS — main only, no orphan branches. Commit discipline: PASS — 9/9 commits have ---ci--- blocks; no stale decisions; no unresolved escalations. ---ci--- project: acdl phase: 0 milestone: v1.10 status: audit lessons: - ARCHITECTURE.md must be updated when new subsystems are added; the v1.10 addendum was missing and caught by the audit. ---/ci---
2026-07-27 18:58:12 +00:00
parent 28d4645a0c
commit c50011c700
2 changed files with 134 additions and 2 deletions
@@ -510,4 +510,64 @@ sub-resource.
 S3 Object Lock + JWS detached signatures + async worker + DLQ + daily
 checkpoints (audit ledger build-out) — deferred to a future milestone.
 The hash-chain + DynamoDB-outbox path remains the v1.9 production audit
-record.
+record.
+
+## v1.10 Addendum — Regression VERIFY + Local Emulators + Capability Re-Verification
+
+### Regression-Class VERIFY (D-091, `core/regression_verify.py`)
+
+The standard VERIFY stage was diff-scoped (it checked the phase diff
+only, never re-ran underlying capability). This let 8 NFR-patch phases
+(v1.9.1–v1.9.8) pass while the platform decayed. The regression-class
+VERIFY (`core/regression_verify.py`) re-runs capability checks against
+the current codebase and tags each Verified/Decayed/Broken. It fails
+closed on any non-Verified capability, blocking milestone completion.
+
+The registry (`CAPABILITY_REGISTRY`) holds 16 capability checks
+(CAP-001..CAP-016): 12 local-tier + 4 live-AWS. Adding a capability is
+a single function + one registry entry. The gate runs via
+`scripts/run_regression.sh` and writes `.ciagent/REGRESSION_REPORT.md`
+ `.json`.
+
+### Local Emulating Adapters (D-092, `core/local_emulators.py`)
+
+Four local adapters let the platform run the full headline E2E without
+cloud credentials:
+
+- `FlatFileOutbox` — flat-file DynamoDB outbox emulator (hash-chained
+  JSONL; resumable across instances; chain verification).
+- `LocalEcsEmulator` — local ECS Fargate HTTP 200 emulator (binds port
+  0 on 127.0.0.1; daemon thread; clean destroy).
+- `LocalS3StateBackend` — rewrites the terraform S3 backend to a local
+  backend (per-stack tfstate in a temp folder).
+- `LocalLambdaStub` — invokes the contract_ingestor handler in-process
+  (patches `_get_dynamodb`/`_get_secrets_client`/`urllib.urlopen`;
+  DynamoDB writes redirected to the FlatFileOutbox).
+
+`run_local_e2e()` runs the full pipeline: contract → resolver → adapter
+→ local S3 backend → local ECS (HTTP 200) → flat-file outbox (chain
+verified) → local Lambda (200). Gated on `ACDL_LOCAL_TIER=1`.
+
+### Capability Re-Verification Sweep (D-093)
+
+`.ciagent/CAPABILITY_INVENTORY.md` enumerates 16 auto-verified
+capabilities + 6 IAM-gated escalated resources. The sweep found and
+fixed 7 adapter defects in `adapters/terraform/adapter.py` (duplicate
+outputs, duplicate args, missing required args, deprecated AWS provider
+v5 arg names). The headline E2E now passes at both tiers: local
+emulator + live-AWS terraform init/validate/plan.
+
+### Adapter Defect Fixes (P54)
+
+7 defects fixed in `adapters/terraform/adapter.py`:
+1. Duplicate output definitions (per-resource + stack-level both emitted).
+2. Duplicate `desired_count`/`launch_type` on ECS service.
+3. Duplicate `target_type`/`family`/`load_balancer_type`.
+4. Missing `assume_role_policy`/`role_name` on IAM role (L2 composition gap).
+5. Missing `cidr_block`/`vpc_id`/`name` defaults on VPC/subnet/route_table/
+   ECS cluster/ECR repository.
+6. ECR `kms_key_arn` unsupported arg → `encryption_configuration` block.
+7. CloudFront OAC + WAF deprecated arg names (AWS provider v5):
+   `signing_behavior`, `signing_protocol`, `origin_access_control_id`,
+   `s3_origin_config.origin_access_identity`, `origin_id`, `rule`
+   (singular), `scope=CLOUDFRONT` (uppercase).
@@ -171,4 +171,76 @@ advertised v1.1–v1.8 capability is re-verified (D-093, 16/16 Verified);
 the docs/decks match verified reality (D-094). 0 P0, 0 P1 from review;
 1 P2 (post-hoc: expand regression registry to uptime-kuma + RDS stacks).
 513 offline tests pass; the regression gate covers 16 capabilities
-including 4 live-AWS checks. Ready to tag `v1.10.0`.
+including 4 live-AWS checks. Ready to tag `v1.10.0`.
+
+---
+
+# ACDL v1.10 — Post-Ship Audit (ciagent-audit workflow)
+
+> Audit date: 2026-07-27. Auditor: ci-debugger. Milestone: v1.10
+> (shipped, tag `v1.10.0`). Result: PASS (1 issue fixed during audit).
+
+## Step 1: Reconstruction Test — PASS
+
+Parsed all `---ci---` blocks from `v1.9.8..HEAD` (9 commits).
+Reconstructed state:
+- Phases: 52, 53, 54, 55 (+ boundary commits 0, 51)
+- Milestone: v1.10
+- Final status: complete
+- Decisions: D-090..D-094
+- Requirements: REQ-112..REQ-115
+- Regression caps: CAP-001..CAP-016
+
+Compared with `.ciagent/` files:
+- config.json: milestone v1.10, status complete. **MATCH.**
+- ROADMAP.md: phases 52–55 present, all complete. **MATCH.**
+- REQUIREMENTS.md: REQ-112..115 all complete. **MATCH.**
+- PROJECT.md: D-090..D-094 decision rows present. **MATCH.**
+- CAPABILITY_INVENTORY.md: CAP-001..CAP-016 all Verified. **MATCH.**
+
+**Reconstruction: PASS** — state fully reconstructable from git log.
+
+## Step 2: .ciagent/ File Discipline — PASS (1 issue fixed)
+
+- `config.json`: valid JSON, required fields present. **PASS.**
+- `PROJECT.md`: all required sections present (Vision, North Star,
+  Capability Status, Requirements, Key Decisions, Constraints,
+  Anti-Goals). **PASS.**
+- `ROADMAP.md`: phases 52–55 present, v1.10 marked complete. **PASS.**
+- `REQUIREMENTS.md`: REQ-112..115 all complete in traceability table.
+  **PASS.**
+- `ARCHITECTURE.md`: **FIXED DURING AUDIT** — had 0 references to
+  v1.10 components (regression_verify, local_emulators,
+  REGRESSION_REPORT, CAPABILITY_INVENTORY). Added a v1.10 addendum
+  section covering the regression-class VERIFY, local emulating
+  adapters, capability re-verification sweep, and the 7 adapter defect
+  fixes. Now references all v1.10 components. **PASS (after fix).**
+
+## Step 3: Branch Hygiene — PASS
+
+- Local: `main` only. Remote: `origin/main` only.
+- No phase or milestone branches (flat workflow per project convention).
+- No orphan branches.
+**PASS.**
+
+## Step 4: Commit Discipline — PASS
+
+- 9/9 v1.10 commits have `---ci---` blocks with project/phase/milestone/
+  status fields.
+- Decisions D-090..D-094: D-091/D-092/D-093 have code refs
+  (`core/regression_verify.py`); D-090/D-094 are process/meta decisions
+  with extensive `.ciagent/` doc refs (PLAN, ROADMAP, PROJECT,
+  CAPABILITY_INVENTORY, AUDIT, VERIFY). No stale decisions.
+- No unresolved v1.10 escalations (the 6 IAM-gated resources are
+  documented in CAPABILITY_INVENTORY.md, not unresolved escalations).
+**PASS.**
+
+## Issues fixed during audit
+
+1. **ARCHITECTURE.md missing v1.10 addendum** — the architecture doc
+   had no coverage of the v1.10 new components (regression_verify,
+   local_emulators, capability inventory, adapter defect fixes). Fixed:
+   added a v1.10 addendum section covering all 4 new subsystems + the
+   7 adapter defect fixes. Verified all v1.10 components now referenced.
+
+## Audit result: PASS