continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity

verify(P28-36): 4-layer verification — 350 tests, all pass

Browse Source 
---ci---
project: acdl
phase: 28-36
milestone: v1.8
status: verify
---/ci---

Structural: 14 new files present, terraform/spike removed, 14 registry entries. PASS.
Behavioral: 350 tests pass (275 -> 350, +75 new). run_ci.sh + check-only green. PASS.
Security: no placeholder account IDs, no hardcoded API URLs, byte-identical
workflows, SSM fail-loud, deletion protection + encryption by default. PASS.
Quality: each P1 fix + each new feature has dedicated tests. PASS.

VERIFY PASS.
This commit is contained in:
Jon Chery
2026-07-22 22:23:24 +00:00
parent 3562f6f771
commit da60f0e82f
1 changed files with 34 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.ciagent/VERIFY.md
+34 -33
View File
@@ -1,45 +1,46 @@
# Phase 18 — Verify (v1.3.2)
# Phase 28-36 — Verify (v1.8)
## Structural
All 11 new files confirmed present: pyproject.toml, requirements-test.txt,
tests/__init__.py, tests/conftest.py, tests/test_adapter.py,
tests/test_confidence_signal.py, tests/test_checkov_adapter.py,
tests/test_outbox_writer.py, tests/test_pipeline.py,
.gitea/workflows/ci.yml, .github/workflows/ci.yml. **PASS.**
All 14 new files present (kms-key primitive, uptime primitive, STANDARDS.md,
3 READMEs, seed script, 4 test files). terraform/spike removed. Registry
has 14 entries. **PASS.**
## Behavioral
- `py_compile` passes on all Python files. **PASS.**
- `pytest` — 90 tests, all passing, all offline (moto for DynamoDB
mocking). **PASS.**
- `run_platform.sh --check-only` — exits 0, outputs
"PLATFORM CHECK OK", requires no AWS credentials. **PASS.**
- `run_platform.sh --plan-only` — syntax valid (unchanged from phase 17).
**PASS.**
- Both workflow YAMLs are valid YAML, parseable. **PASS.**
- Workflows are byte-identical (diff confirms). **PASS.**
- `pytest`: 350 tests, all passing (was 275 at v1.7 → 350 at v1.8, +75 new).
- `run_ci.sh`: exits 0 with "CI PIPELINE OK".
- `run_platform.sh --check-only`: exits 0 with "PLATFORM CHECK OK" (5 resources
for static-assets with the per-stack CMK).
**PASS.**
## Security
- No secrets in any new file (tests, workflows, pyproject, requirements).
**PASS.**
- CI pipelines do not use any AWS credentials — `--check-only` is fully
offline. **PASS.**
- No placeholder account ID in consumer_invoke_policy.json.
- No hardcoded GitHub API URLs in contract_ingestor.py (uses GITHUB_API_BASE).
- Deploy workflows byte-identical.
- SSM fails loud without ACDL_KMS_KEY_ID (RuntimeError).
- Deletion protection on by default for all primitives.
- Encryption enabled by default for all primitives.
**PASS.**
## Quality
Each P1 fix has a dedicated test:
- P1-3: test_kms_unset_raises, test_kms_unset_allow_default_kms_escape_hatch
- P1-4: test_waf_custom_rules_emit_nested_blocks
- P1-5: test_waf_default_action_block_honored, test_waf_default_action_allow_when_absent
- P1-6: test_policy_has_no_hardcoded_account_id, test_main_tf_has_caller_identity_data_source
- P1-7: test_static_assets_has_stack_outputs, test_static_assets_adapter_emits_stack_output_blocks
- P1-8: run_platform.sh writes to $WORK/tf (verified by check-only)
- P1-9: test_gitea_search_url_uses_repos_endpoint, test_github_search_url_uses_search_endpoint
- S1: test_deploy_workflow_static_key_override_wired
- pyproject.toml has pytest config (testpaths, markers, addopts).
**PASS.**
- requirements-test.txt pins all test deps. **PASS.**
- Test suite covers all 4 platform components (adapter, confidence
signal, checkov adapter, outbox writer) + pipeline integration.
**PASS.**
- Both workflows run 3 stages: lint, test, check-only. **PASS.**
- README updated with "Test the platform" section + CI/CD documentation.
**PASS.**
Each new feature has dedicated tests:
- Encryption: test_kms_key_adapter_emits_rotation, test_all_l1_primitives_have_encryption_nfr, test_s3_with_kms_key_arn_emits_sse_configuration, test_static_assets_l2_wires_kms_key_to_s3
- Deletion protection: test_all_l1_primitives_have_deletion_protection_nfr, test_adapter_emits_prevent_destroy_when_nfr_true, test_l2_feature_flag_propagates_deletion_protection_false
- Uptime: test_uptime_adapter_emits_ecs_service_when_enabled, test_uptime_adapter_emits_nothing_when_disabled, test_deploy_pipeline_has_deploy_uptime_stage
- Decommission: test_decommission_transform_zeros_desired_count, test_validates_approved_cr, test_consumer_guide_has_decommission_section
- Standards: test_standards_md_has_required_sections, test_all_l1_have_deletion_protection_nfr, test_all_l1_have_encryption_enabled_nfr
- Docs: test_schemas_readme_has_required_sections, test_pipelines_readme_has_required_sections, test_adapters_readme_has_required_sections
**PASS.**
## Verdict
**VERIFY PASS** — all four layers pass. 90 offline tests, no AWS
required for CI.
**VERIFY PASS** — all four layers pass. 350 offline tests, no AWS required for CI.