feat(P39): refresh design docs + parameterize adapter (P1-1)

---ci--- project: acdl phase: 39 milestone: v1.9 status: execute ---/ci--- Phase 39 — design-doc-refresh-and-p1-1-parameterization: Design docs (REQ-100, REQ-101): - hitl_matrix_design.md: 'dev-only spike'/'v1.2 wires the gates' framing replaced with v1.9 wired-gates reality; 8-concern matrix marked implemented (offline-testable subset + signed evidence artifacts, D-084); v1.9 wiring section cross-references hitl_gates.py + attestation_matrix.py; approver_dr noted. - audit_ledger_design.md: outbox marked shipped+production since v1.8; S3 Object Lock + JWS + async worker + DLQ + daily checkpoints clearly labeled 'Deferred to a future milestone (D-083)'; RPO/RTO table updated; approver fields note v1.9 hitl_gates.attest. P1-1 adapter parameterization (REQ-102, D-085): - ecs-service interface.json: desired_count (default 1), launch_type (FARGATE), family (app) inputs added. - alb interface.json: load_balancer_type (application), target_type (ip). - adapter.py: hardcoded defaults replaced with inputs.get(<name>, <default>); hardcoded 'acdl-microservice-rt'/'acdl-microservice-igw' Name tags derive from the VPC name input. - contract_resolver.py: child_input_map routes wires to the sub-resource that declares the input (desired_count → aws:ecs:service, family → aws:ecs:task_definition, target_type → targetgroup, etc.). - microservice composition.json: wires added for the new inputs. Tests: +21 (test_p1_1_adapter_parameterization.py, test_design_docs_current.py). 371 passed; run_ci.sh green; run_platform.sh --check-only green; v1.1 S3 regression preserved.
2026-07-23 04:24:25 +00:00
parent 58100c485e
commit e1be05287b
12 changed files with 1045 additions and 67 deletions
@@ -0,0 +1,73 @@
+"""REQ-100/101: design docs are up to date with the shipped platform.
+Asserts no stale 'dev-only spike' / 'v1.2 wires the gates' / 'Phases 08-10
+implement' framing, and that the audit ledger deferral is clearly labeled.
+"""
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent
+HITL = ROOT / "core" / "hitl_matrix_design.md"
+AUDIT = ROOT / "core" / "audit_ledger_design.md"
+
+
+def _read(path):
+    return Path(path).read_text()
+
+
+def test_hitl_matrix_design_no_stale_dev_only_spike_framing():
+    text = _read(HITL)
+    low = text.lower()
+    assert "the spike is dev-only" not in low, "stale 'spike is dev-only' framing"
+    assert "hitl is not exercised" not in low, "stale 'HITL is not exercised' framing"
+
+
+def test_hitl_matrix_design_no_stale_v1_2_wires_language():
+    text = _read(HITL)
+    assert "v1.2 wires the gates" not in text.lower(), "stale 'v1.2 wires the gates' framing"
+
+
+def test_hitl_matrix_design_references_v1_9_implementation():
+    text = _read(HITL)
+    assert "attestation_matrix.py" in text, "must reference the v1.9 attestation_matrix.py"
+    assert "hitl_gates.py" in text, "must reference the v1.9 hitl_gates.py"
+    assert "v1.9" in text, "must reference v1.9 wiring"
+
+
+def test_hitl_matrix_design_marks_offline_testable_subset_implemented():
+    text = _read(HITL)
+    low = text.lower()
+    assert "offline-testable" in low, "must distinguish offline-testable concerns"
+    assert "operator-supplied" in low, "must distinguish operator-supplied concerns"
+
+
+def test_audit_ledger_design_no_stale_phases_08_10_implement():
+    text = _read(AUDIT)
+    low = text.lower()
+    assert "phases 08-10 implement" not in low, "stale 'Phases 08-10 implement' framing"
+
+
+def test_audit_ledger_design_marks_outbox_shipped():
+    text = _read(AUDIT)
+    low = text.lower()
+    assert "shipped + production since v1.8" in low, "must mark the outbox as shipped + production"
+
+
+def test_audit_ledger_design_deferred_section_exists():
+    text = _read(AUDIT)
+    assert "Deferred to a future milestone" in text, "must have a clearly-labeled deferred section"
+    assert "D-083" in text, "deferred section must reference decision D-083"
+
+
+def test_audit_ledger_design_approver_fields_note_v1_9():
+    text = _read(AUDIT)
+    assert "approver_dr" in text, "must note approver_dr (v1.9 hitl_gates.attest)"
+    assert "hitl_gates.attest" in text, "must reference v1.9 hitl_gates.attest"
+
+
+def test_hitl_matrix_decision_trail_includes_d084():
+    text = _read(HITL)
+    assert "D-084" in text, "decision trail must include D-084 (attestation matrix)"
+
+
+def test_audit_ledger_decision_trail_includes_d083():
+    text = _read(AUDIT)
+    assert "D-083" in text, "decision trail must include D-083 (deferral)"
@@ -0,0 +1,208 @@
+"""P1-1: adapter ECS/ALB/VPC defaults are parameterized via L1 interface.json
+inputs (REQ-102, D-085). The adapter is a thin translator — defaults live in
+the interface, not the adapter.
+"""
+import json
+import os
+import sys
+from pathlib import Path
+
+import yaml
+
+ROOT = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(ROOT))
+
+from adapters.terraform.adapter import adapt
+from core.contract_resolver import resolve
+
+
+def _load_ir(path):
+    with open(path) as f:
+        return json.load(f)
+
+
+def _tf_for_contract(contract_dict, tmp_path):
+    """Resolve a contract dict to a stack, emit TF, return the main.tf text."""
+    contract_path = tmp_path / "contract.yaml"
+    contract_path.write_text(yaml.safe_dump(contract_dict))
+    stack = resolve(str(contract_path))
+    out_dir = tmp_path / "tf"
+    adapt(stack, str(out_dir))
+    return (out_dir / "main.tf").read_text()
+
+
+def test_desired_count_override_emits_overridden_value(tmp_path):
+    """An L1 with desired_count: 3 in contract inputs emits desired_count = 3."""
+    contract = {
+        "uses": "acdl/pipelines/deploy.yaml@v1.9",
+        "module": "microservice",
+        "environment": "dev",
+        "inputs": {
+            "bucket_name": "acdl-test",
+            "region": "us-east-1",
+            "image": "public.ecr.aws/docker/library/nginx:latest",
+            "port": 80,
+            "desired_count": 3,
+        },
+    }
+    tf = _tf_for_contract(contract, tmp_path)
+    assert "desired_count = 3" in tf
+    assert "desired_count = 1" not in tf
+
+
+def test_desired_count_default_emits_one_via_interface(tmp_path):
+    """Absent desired_count emits desired_count = 1 via interface default."""
+    contract = {
+        "uses": "acdl/pipelines/deploy.yaml@v1.9",
+        "module": "microservice",
+        "environment": "dev",
+        "inputs": {
+            "bucket_name": "acdl-test",
+            "region": "us-east-1",
+            "image": "public.ecr.aws/docker/library/nginx:latest",
+            "port": 80,
+        },
+    }
+    tf = _tf_for_contract(contract, tmp_path)
+    assert "desired_count = 1" in tf
+
+
+def test_launch_type_override_emits_overridden_value(tmp_path):
+    contract = {
+        "uses": "acdl/pipelines/deploy.yaml@v1.9",
+        "module": "microservice",
+        "environment": "dev",
+        "inputs": {
+            "bucket_name": "acdl-test",
+            "region": "us-east-1",
+            "image": "public.ecr.aws/docker/library/nginx:latest",
+            "port": 80,
+            "launch_type": "EC2",
+        },
+    }
+    tf = _tf_for_contract(contract, tmp_path)
+    assert 'launch_type = "EC2"' in tf
+    assert 'launch_type = "FARGATE"' not in tf
+
+
+def test_target_type_override_emits_overridden_value(tmp_path):
+    contract = {
+        "uses": "acdl/pipelines/deploy.yaml@v1.9",
+        "module": "microservice",
+        "environment": "dev",
+        "inputs": {
+            "bucket_name": "acdl-test",
+            "region": "us-east-1",
+            "image": "public.ecr.aws/docker/library/nginx:latest",
+            "port": 80,
+            "target_type": "instance",
+        },
+    }
+    tf = _tf_for_contract(contract, tmp_path)
+    assert 'target_type = "instance"' in tf
+    assert 'target_type = "ip"' not in tf
+
+
+def test_load_balancer_type_override_emits_overridden_value(tmp_path):
+    contract = {
+        "uses": "acdl/pipelines/deploy.yaml@v1.9",
+        "module": "microservice",
+        "environment": "dev",
+        "inputs": {
+            "bucket_name": "acdl-test",
+            "region": "us-east-1",
+            "image": "public.ecr.aws/docker/library/nginx:latest",
+            "port": 80,
+            "load_balancer_type": "network",
+        },
+    }
+    tf = _tf_for_contract(contract, tmp_path)
+    assert 'load_balancer_type = "network"' in tf
+    assert 'load_balancer_type = "application"' not in tf
+
+
+def test_family_override_emits_overridden_value(tmp_path):
+    contract = {
+        "uses": "acdl/pipelines/deploy.yaml@v1.9",
+        "module": "microservice",
+        "environment": "dev",
+        "inputs": {
+            "bucket_name": "acdl-test",
+            "region": "us-east-1",
+            "image": "public.ecr.aws/docker/library/nginx:latest",
+            "port": 80,
+            "family": "myservice",
+        },
+    }
+    tf = _tf_for_contract(contract, tmp_path)
+    assert 'family = "myservice"' in tf
+
+
+def test_family_default_emits_app(tmp_path):
+    contract = {
+        "uses": "acdl/pipelines/deploy.yaml@v1.9",
+        "module": "microservice",
+        "environment": "dev",
+        "inputs": {
+            "bucket_name": "acdl-test",
+            "region": "us-east-1",
+            "image": "public.ecr.aws/docker/library/nginx:latest",
+            "port": 80,
+        },
+    }
+    tf = _tf_for_contract(contract, tmp_path)
+    assert 'family = "app"' in tf
+
+
+def test_v1_1_s3_regression_still_passes(tmp_path):
+    """The v1.1 S3 regression: the static-assets L1 (s3-only) must still
+    produce valid Terraform with no ECS/ALB/VPC defaults leaking in."""
+    contract_path = ROOT / "contracts" / "static-assets.yaml"
+    stack = resolve(str(contract_path))
+    out_dir = tmp_path / "tf"
+    adapt(stack, str(out_dir))
+    tf = (out_dir / "main.tf").read_text()
+    assert "aws_s3_bucket" in tf
+    assert "desired_count" not in tf
+    assert "launch_type" not in tf
+    assert "target_type" not in tf
+
+
+def test_no_hardcoded_microservice_name_in_route_table(tmp_path):
+    """The hardcoded 'acdl-microservice-rt' / 'acdl-microservice-igw' Name
+    tags are removed (D-085); the name derives from the VPC name input."""
+    contract = {
+        "uses": "acdl/pipelines/deploy.yaml@v1.9",
+        "module": "microservice",
+        "environment": "dev",
+        "inputs": {
+            "bucket_name": "acdl-test",
+            "region": "us-east-1",
+            "image": "public.ecr.aws/docker/library/nginx:latest",
+            "port": 80,
+        },
+    }
+    tf = _tf_for_contract(contract, tmp_path)
+    assert "acdl-microservice-rt" not in tf
+    assert "acdl-microservice-igw" not in tf
+
+
+def test_ecs_service_interface_has_parameterized_inputs():
+    """The L1 interface declares the inputs (the adapter reads them)."""
+    iface = _load_ir(ROOT / "modules" / "l1" / "ecs-service" / "interface.json")
+    inputs = iface["inputs"]
+    assert "desired_count" in inputs
+    assert inputs["desired_count"]["default"] == 1
+    assert "launch_type" in inputs
+    assert inputs["launch_type"]["default"] == "FARGATE"
+    assert "family" in inputs
+    assert inputs["family"]["default"] == "app"
+
+
+def test_alb_interface_has_parameterized_inputs():
+    iface = _load_ir(ROOT / "modules" / "l1" / "alb" / "interface.json")
+    inputs = iface["inputs"]
+    assert "load_balancer_type" in inputs
+    assert inputs["load_balancer_type"]["default"] == "application"
+    assert "target_type" in inputs
+    assert inputs["target_type"]["default"] == "ip"