diff --git a/.ciagent/REQUIREMENTS.md b/.ciagent/REQUIREMENTS.md index 3493232..b4a864b 100644 --- a/.ciagent/REQUIREMENTS.md +++ b/.ciagent/REQUIREMENTS.md @@ -357,31 +357,31 @@ | REQ-74 | 27 | complete (v1.7.0) | | REQ-75 | 27 | complete (v1.7.0) | -### v1.8 (active — P1 remediation + uptime + standards + encryption/deletion-protection by default + decommission + docs) +### v1.8 (complete — P1 remediation + uptime + standards + encryption/deletion-protection by default + decommission + docs, tag `v1.8.0`) | Requirement | Phase | Status | |-------------|-------|--------| -| REQ-76 | 28 | pending | -| REQ-77 | 28 | pending | -| REQ-78 | 29 | pending | -| REQ-79 | 29 | pending | -| REQ-80 | 30 | pending | -| REQ-81 | 30 | pending | -| REQ-82 | 30 | pending | -| REQ-83 | 31 | pending | -| REQ-84 | 31 | pending | -| REQ-85 | 31 | pending | -| REQ-86 | 32 | pending | -| REQ-87 | 32 | pending | -| REQ-88 | 33 | pending | -| REQ-89 | 33 | pending | -| REQ-90 | 33 | pending | -| REQ-91 | 33 | pending | -| REQ-92 | 34 | pending | -| REQ-93 | 34 | pending | -| REQ-94 | 34 | pending | -| REQ-95 | 35 | pending | -| REQ-96 | 35 | pending | -| REQ-97 | 36 | pending | -| REQ-98 | 36 | pending | -| REQ-99 | 36 | pending | \ No newline at end of file +| REQ-76 | 28 | complete (v1.8.0) | +| REQ-77 | 28 | complete (v1.8.0) | +| REQ-78 | 29 | complete (v1.8.0) | +| REQ-79 | 29 | complete (v1.8.0) | +| REQ-80 | 30 | complete (v1.8.0) | +| REQ-81 | 30 | complete (v1.8.0) | +| REQ-82 | 30 | complete (v1.8.0) | +| REQ-83 | 31 | complete (v1.8.0) | +| REQ-84 | 31 | complete (v1.8.0) | +| REQ-85 | 31 | complete (v1.8.0) | +| REQ-86 | 32 | complete (v1.8.0) | +| REQ-87 | 32 | complete (v1.8.0) | +| REQ-88 | 33 | complete (v1.8.0) | +| REQ-89 | 33 | complete (v1.8.0) | +| REQ-90 | 33 | complete (v1.8.0) | +| REQ-91 | 33 | complete (v1.8.0) | +| REQ-92 | 34 | complete (v1.8.0) | +| REQ-93 | 34 | complete (v1.8.0) | +| REQ-94 | 34 | complete (v1.8.0) | +| REQ-95 | 35 | complete (v1.8.0) | +| REQ-96 | 35 | complete (v1.8.0) | +| REQ-97 | 36 | complete (v1.8.0) | +| REQ-98 | 36 | complete (v1.8.0) | +| REQ-99 | 36 | complete (v1.8.0) | \ No newline at end of file diff --git a/.ciagent/ROADMAP.md b/.ciagent/ROADMAP.md index 89d0d77..453cba6 100644 --- a/.ciagent/ROADMAP.md +++ b/.ciagent/ROADMAP.md @@ -10,7 +10,7 @@ - **v1.5 (complete, tag `v1.5.0`):** consumer happy path + zero-trust docs + reusable deploy workflow. README rewritten so the consumer model is unambiguous (consumer owns only contract + app code; the rest is the platform source). Platform-flow + consumer-guide diagrams converted to mermaid. Legacy surface + implementation nomenclature removed from docs. Credentials section rewritten for zero-trust OIDC + ABAC (with a static-key override + daily rotation). A generic `docs/CONSUMER_GUIDE.md` (all L2 modules, versioned `uses:`, consumer-scoped prereqs, run-time platform fetch) replaces the module-specific guide. A byte-identical reusable `deploy.yml` workflow (Gitea + GitHub) implements `pipelines/deploy.yaml` and is invoked by consumer repos via a versioned tag. - **v1.6 (complete, tag `v1.6.0`):** consumer-facing docs restructure + terminology normalization + environments concept. `docs/` becomes a Jekyll-style GitHub Pages site. `acdl_platform/` is renamed to `core/`. L2 → "modules", L1 → "primitives", "composition" → "pattern" in prose. README restructured: Features + Roadmap (no internal status), repository roles restated (consumer = app code + contracts + CI definitions), mermaid fixed (visible text, security-checks + infrastructure-apply stages, no tool names), credentials section minus go-gitea/waivers. Platform-managed environments concept + a minimal onboarding scaffold. `.ciagent/` + `.gitea/` references removed from all consumer-facing docs. - **v1.7 (complete, tag `v1.7.0`):** production platform + contract ingestion + pipeline maturation. Rename `static-assets` → `static-assets` (D-048 — incl. `.ciagent/` historical narrative). Author `cloudfront` + `waf` primitives; augment `static-assets` to a production-ready S3 + CloudFront (OAC) + WAF stack (D-049). Tagging-standard enforcement (Checkov custom rule, D-043 closure, D-054). Wiz adapter stub (D-052) + Kyverno K8s-native adapter (D-053). Platform Lambda + DynamoDB `acdl-contracts` table for contract ingestion (D-051) + cross-account IAM. Deploy outputs via SSM SecureString + GitHub PR comment (D-050). Uniform error reporting via the Lambda `report_error` action → GitHub issue on the platform repo (D-055); Gitea excluded. Stage comments after every successful pipeline stage. Three platform pipelines (platform-test unit+integration, primitives-plan, patterns-plan). Release job with semver + MAJOR.MINOR/MAJOR tag maintenance (D-057). `uses:`/`ref:` bumped to `@v1.6`; floating `v1.6` + `v1` tags created in Phase 22. Remove the legacy consumer-repos directory (a v1.2 artifact, removed in v1.7); add validated per-module examples (`modules//examples/`, D-058) including a new RDS primitive demonstrating multi-engine variation (D-059). -- **v1.8 (active):** P1 remediation + uptime monitoring + engineering standards + encryption/deletion-protection by default + decommission alias + path documentation. Clears 8 pending P1 issues (P1-3..P1-9 + S1). Adds per-stack CMK + encryption-by-default for all primitives. Adds deletion-protection-by-default + L2 feature flag. Adds uptime-kuma primitive (ECS Fargate, deployed by default after L2, separate state, feature flag, alert channels). Adds decommission mode (2-step pipeline with HITL SRE gates + CMDB-validated change request). Adds `modules/STANDARDS.md` (L1+L2 authoring + review standards). Adds `schemas/README.md`, `pipelines/README.md`, `adapters/README.md`. +- **v1.8 (complete, tag `v1.8.0`):** P1 remediation + uptime monitoring + engineering standards + encryption/deletion-protection by default + decommission alias + path documentation. Clears 8 pending P1 issues (P1-3..P1-9 + S1). Adds per-stack CMK + encryption-by-default for all primitives. Adds deletion-protection-by-default + L2 feature flag. Adds uptime-kuma primitive (ECS Fargate, deployed by default after L2, separate state, feature flag, alert channels). Adds decommission mode (2-step pipeline with HITL SRE gates + CMDB-validated change request). Adds `modules/STANDARDS.md` (L1+L2 authoring + review standards). Adds `schemas/README.md`, `pipelines/README.md`, `adapters/README.md`. - **v1.0 demo URL:** https://git.cloudinit.dev/continuous-intelligence/acdl-evidence/raw/branch/main/index.html --- @@ -432,7 +432,7 @@ After Phase 27: COMPLETE gate — review → ship `v1.7.0` → audit. **DONE.** --- -## v1.8 (Active — P1 remediation + uptime + engineering standards + encryption/deletion-protection by default + decommission + docs) +## v1.8 (Complete — P1 remediation + uptime + engineering standards + encryption/deletion-protection by default + decommission + docs) The v1.8 milestone clears all pending P1 issues from v1.5–v1.7 verify reviews AND delivers three user-directed tracks: encryption + deletion @@ -444,7 +444,7 @@ shipped `v1.7.0`). Phase patches `v1.7.1`..`v1.7.9`. ### Phase 28 — adapter-waf-and-resolver-outputs - **Description:** Fix WAF HCL emission: custom `rules` input emits nested `rules { ... }` blocks (not `rules = [...]` attribute syntax — P1-4). Honor `default_action` input (allow/block) instead of hardcoding `allow {}` (P1-5). Implement L2 composition `outputs[]` processing in `resolve_l2()` — build `stack.outputs` dict + adapter emits `output` blocks (P1-7). Tests for all three fixes. -- **Status:** pending +- **Status:** complete (v1.8.0) - **Depends on:** — - **Requirements:** REQ-76, REQ-77 - **Success Criteria:** @@ -456,7 +456,7 @@ shipped `v1.7.0`). Phase patches `v1.7.1`..`v1.7.9`. ### Phase 29 — ssm-kms-and-invoke-policy - **Description:** SSM publisher fails loud (`RuntimeError`) when `ACDL_KMS_KEY_ID` unset; `ACDL_ALLOW_DEFAULT_KMS=1` escape hatch for local testing (P1-3). Convert `consumer_invoke_policy.json` to a Terraform-rendered template using `data.aws_caller_identity` + `templatestring` — no `000000000000` placeholder (P1-6). Tests for both. -- **Status:** pending +- **Status:** complete (v1.8.0) - **Depends on:** [28] - **Requirements:** REQ-78, REQ-79 - **Success Criteria:** @@ -466,7 +466,7 @@ shipped `v1.7.0`). Phase patches `v1.7.1`..`v1.7.9`. ### Phase 30 — run-platform-isolation-and-api-portability - **Description:** `run_platform.sh` emits adapter output to `$WORK/tf` (per-run temp dir), not `terraform/spike/`; remove committed `terraform/spike/*.tf` (P1-8). `contract_ingestor.py` reads `GITHUB_API_BASE` env for forge-agnostic API URLs (GitHub + Gitea); `_forge_type()` branches search URL (P1-9). Deploy workflow `configure-aws-credentials` step restructured as single conditional step: OIDC when no static key, `access-key`/`secret-key` inputs when static key present (S1). Both deploy workflows remain byte-identical. -- **Status:** pending +- **Status:** complete (v1.8.0) - **Depends on:** [29] - **Requirements:** REQ-80, REQ-81, REQ-82 - **Success Criteria:** @@ -477,7 +477,7 @@ shipped `v1.7.0`). Phase patches `v1.7.1`..`v1.7.9`. ### Phase 31 — encryption-by-default-and-per-stack-cmk - **Description:** Create `kms-key` L1 primitive (type `aws:kms:key`, inputs: description/region/deletion_window_days, outputs: kms_key_arn/kms_key_id, NFRs: enable_rotation default true, deletion_protection default true). Adapter emits `aws_kms_key` + `aws_kms_alias` + `enable_key_rotation = true`. Add `encryption_enabled` NFR (default true) + `kms_key_arn` input to all primitives. L2 modules wire a `kms-key` child + connect its output to all children. Managed KMS fallback when no CMK provided (with stderr warning). -- **Status:** pending +- **Status:** complete (v1.8.0) - **Depends on:** [30] - **Requirements:** REQ-83, REQ-84, REQ-85 - **Success Criteria:** @@ -489,7 +489,7 @@ shipped `v1.7.0`). Phase patches `v1.7.1`..`v1.7.9`. ### Phase 32 — deletion-protection-by-default-and-l2-feature-flag - **Description:** Add `deletion_protection` NFR (boolean, default true) to every L1 primitive. Adapter emits `lifecycle { prevent_destroy = true }` when true; omits it when false. L2 modules expose `features.deletion_protection` flag (default true); resolver propagates to each child's NFR. Consumers can set `inputs.deletion_protection: false` in contract. Update contract schema. -- **Status:** pending +- **Status:** complete (v1.8.0) - **Depends on:** [31] - **Requirements:** REQ-86, REQ-87 - **Success Criteria:** @@ -500,7 +500,7 @@ shipped `v1.7.0`). Phase patches `v1.7.1`..`v1.7.9`. ### Phase 33 — uptime-kuma-primitive - **Description:** Create `uptime` L1 primitive (ECS Fargate running `louislam/uptime-kuma:1`). Inputs: container_image, region, monitored_endpoints (array of {name, url, type, interval, timeout}), static_checks, alert_channels ({teams_webhook, email_addresses, sms_numbers, github_issue_repo}), feature_flag_enabled (default true), cpu, memory. Outputs: uptime_url, service_arn, task_definition_arn. NFRs: deletion_protection, encryption_enabled. Adapter emits ECS service + ALB + log group; no resources when feature_flag_enabled=false. Register in registry. Add `deploy-uptime` pipeline stage (separate state, after publish-outputs) to `pipelines/deploy.yaml` + both deploy workflows. `run_platform.sh` constructs synthetic uptime contract from L2 outputs + runs second terraform apply. Uptime URL published via PR comment. Feature flag from `inputs.uptime_enabled` (default true). -- **Status:** pending +- **Status:** complete (v1.8.0) - **Depends on:** [32] - **Requirements:** REQ-88, REQ-89, REQ-90, REQ-91 - **Success Criteria:** @@ -513,7 +513,7 @@ shipped `v1.7.0`). Phase patches `v1.7.1`..`v1.7.9`. ### Phase 34 — decommission-alias-and-cmdb-validation - **Description:** Add `mode: decommission` to deploy pipeline. Stages: validate-change-request (Lambda `validate_change_request` action queries DynamoDB `acdl-change-requests` table, asserts status=approved) → disable-deletion-protection (resolve contract with deletion_protection=false, terraform plan/apply, HITL SRE gate) → zero-counts (resolver `decommission_transform` zeroes all counts, terraform plan/apply, second HITL SRE gate) → confirm-decommission. Add `acdl-change-requests` DynamoDB table to terraform/platform/main.tf. Add `validate_change_request` to contract_ingestor.py. Document in `docs/CONSUMER_GUIDE.md`. -- **Status:** pending +- **Status:** complete (v1.8.0) - **Depends on:** [33] - **Requirements:** REQ-92, REQ-93, REQ-94 - **Success Criteria:** @@ -525,7 +525,7 @@ shipped `v1.7.0`). Phase patches `v1.7.1`..`v1.7.9`. ### Phase 35 — module-engineering-standards - **Description:** Scan all current modules to generate `modules/STANDARDS.md` — comprehensive L1+L2 authoring + code review standards: required files, interface schema, input/output/NFR conventions, encryption + deletion protection as mandatory NFRs, naming, multi-resource pattern, adapter extension pattern (TYPE_MAP + INPUT_MAP + OUTPUT_MAP + specialized branches), code review checklist. Fix `modules/README.md` catalog index (add rds + uptime + kms-key). Update `modules/README-TEMPLATE.md` with `## NFRs` section. Add `tests/test_module_standards.py` for automated enforcement. -- **Status:** pending +- **Status:** complete (v1.8.0) - **Depends on:** [34] - **Requirements:** REQ-95, REQ-96 - **Success Criteria:** @@ -536,7 +536,7 @@ shipped `v1.7.0`). Phase patches `v1.7.1`..`v1.7.9`. ### Phase 36 — schemas-adapters-pipelines-readmes - **Description:** Author `schemas/README.md` (how to write schemas, wire into platform, test in CI, dependencies, existing catalog), `pipelines/README.md` (how to write pipeline contracts, wire into workflows, test, dependencies, catalog), `adapters/README.md` (how to write adapters, wire into platform, test, dependencies, catalog). Add `tests/test_docs_coverage.py` to validate presence + required sections. -- **Status:** pending +- **Status:** complete (v1.8.0) - **Depends on:** [35] - **Requirements:** REQ-97, REQ-98, REQ-99 - **Success Criteria:** @@ -546,7 +546,7 @@ shipped `v1.7.0`). Phase patches `v1.7.1`..`v1.7.9`. ### Phase 37 — verify - **Description:** 4-layer verification (structural, behavioral, security, quality) of all v1.8 phases. Re-verify each P1 (P1-3..P1-9 + S1) is resolved. Verify all new features (encryption, deletion protection, uptime, decommission, standards, docs) have dedicated tests. -- **Status:** pending +- **Status:** complete (v1.8.0) - **Depends on:** [36] - **Requirements:** — - **Success Criteria:** @@ -555,7 +555,7 @@ shipped `v1.7.0`). Phase patches `v1.7.1`..`v1.7.9`. ### Phase 38 — review-audit-complete - **Description:** Multi-persona code review across the full v1.8 diff. Audit (reconstruction, file discipline, branch hygiene, commit discipline). Complete: update REQUIREMENTS.md (REQ-76..99), ROADMAP.md (v1.8 complete), PROJECT.md. Tag `v1.8.0`. Update floating `v1.8` + `v1` tags. Bump `uses:`/`ref:` from `@v1.6` to `@v1.8`. -- **Status:** pending +- **Status:** complete (v1.8.0) - **Depends on:** [37] - **Requirements:** — - **Success Criteria:** diff --git a/.ciagent/config.json b/.ciagent/config.json index 0dbb365..c54ba03 100644 --- a/.ciagent/config.json +++ b/.ciagent/config.json @@ -5,7 +5,7 @@ "slug": "acdl", "name": "Agentic Cloud Delivery Platform", "milestone": "v1.8", - "status": "active" + "status": "complete" } ], "active_project": "acdl",