continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity

Merge milestone/v1.16-nova-simplification — v1.16 complete (Nova Simplification: 20-phase NFR sweep + final; tag v1.15.26)
acdl-ci / Lint (push) Successful in 11s
Details
acdl-ci / Platform check-only (offline) (push) Successful in 29s
Details
acdl-ci / Test (push) Failing after 7m25s
Details

Browse Source
This commit is contained in:
Jon Chery
2026-08-01 13:37:18 +00:00
parent 787a6490a5
commit f83b974c0e
64 changed files with 3246 additions and 919 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/run_platform.sh
+85 -198
View File
@@ -1,5 +1,5 @@
#!/usr/bin/env bash
# scripts/run_platform.sh - the ACDL platform pipeline.
# scripts/run_platform.sh - the Nova platform pipeline.
#
# Usage:
# run_platform.sh <contract.yml> (full e2e with AWS)
@@ -7,6 +7,9 @@
# run_platform.sh --plan-only <contract.yml> (AWS plan only, no Checkov/outbox)
# run_platform.sh --apply <contract.yml> (AWS apply: init/validate/plan/apply)
# run_platform.sh --destroy <contract.yml> (AWS destroy: init/validate/destroy)
# run_platform.sh --local [contract.yml] (local emulating tier, no AWS)
# run_platform.sh --decommission <CR> <contract.yml> (gated teardown)
# run_platform.sh --help (show all flags)
#
# Modes:
# --check-only (offline, no AWS/Checkov/DynamoDB — for CI)
@@ -17,13 +20,19 @@
# contract -> resolver -> stack -> adapter -> terraform init/validate/plan/apply -> exit 0
# --destroy (requires AWS creds; use --decommission <CR> for gated production teardown)
# contract -> resolver -> stack -> adapter -> terraform init/validate/destroy -> exit 0
# --local (no AWS creds; local emulating tier D-092)
# contract -> resolver -> adapter -> local S3/ECS/outbox/Lambda stubs -> exit 0
# (default) (requires AWS creds + Checkov + DynamoDB)
# contract -> resolver -> stack -> adapter -> terraform plan -> Checkov ->
# confidence -> outbox
#
# Flags:
# --quiet suppress terraform/checkov streaming (output to log only)
# --decommission gate --destroy with D-070 two-step CR validation (requires <CR>)
# --quiet suppress terraform/checkov streaming (output to log only)
# --decommission gate --destroy with D-070 two-step CR validation (requires <CR>)
# --deploy-uptime deploy the uptime monitoring stack (separate state)
# --local run the headline E2E against the local emulating tier (D-092)
# --environment <name> override the contract's environment at load time (D-088)
# --help, -h show all flags + a one-line description
#
# The contract file is a YAML file validated against schemas/contract.schema.json.
# The resolver (core/contract_resolver.py) resolves it to a Target Stack
@@ -59,6 +68,36 @@ CHANGE_REQUEST_ID=""
ENVIRONMENT_OVERRIDE=""
CONTRACT=""
# P15 (REQ-179): --help / -h prints all flags + a one-line description.
_print_help() {
cat <<'HELP'
Nova platform pipeline — run_platform.sh
Usage:
run_platform.sh <contract.yml> (full e2e with AWS)
run_platform.sh --check-only [contract.yml] (offline, no AWS)
run_platform.sh --plan-only <contract.yml> (AWS plan only)
run_platform.sh --apply <contract.yml> (AWS apply)
run_platform.sh --destroy <contract.yml> (AWS destroy)
run_platform.sh --local [contract.yml] (local emulating tier)
run_platform.sh --decommission <CR> <contract.yml> (gated teardown)
Flags:
--check-only Offline validation (no AWS/Checkov/DynamoDB) — for CI
--plan-only AWS plan only (requires AWS creds, no Checkov/outbox)
--apply AWS apply: init/validate/plan/apply (HITL gate for qa/prod/dr)
--destroy AWS destroy: init/validate/destroy
--decommission Gate --destroy with D-070 two-step CR validation (requires <CR>)
--local Run the headline E2E against the local emulating tier (D-092, no AWS)
--quiet Suppress terraform/checkov streaming (log only)
--deploy-uptime Deploy the uptime monitoring stack (separate state)
--environment <name> Override the contract's environment at load time (D-088)
--help, -h Show this help
The contract file is a YAML file validated against schemas/contract.schema.json.
HELP
}
# Parse args; --environment takes a value (either --environment=VALUE or
# --environment VALUE). The contract / changeRequestId are the remaining
# positional args.
@@ -69,6 +108,7 @@ for arg in "$@"; do
continue
fi
case "$arg" in
--help|-h) _print_help; exit 0 ;;
--check-only) CHECK_ONLY=1 ;;
--plan-only) PLAN_ONLY=1 ;;
--apply) APPLY_ONLY=1 ;;
@@ -113,6 +153,38 @@ fi
fail() { echo "FAIL: $*" >&2; exit 1; }
# run_hitl_gate <contract_id> <resolved_env> <context>
# REQ-108: for qa/prod/dr, call hitl_gates.attest before apply. Dev skips.
# Extracted from the two duplicated inline blocks (P6, REQ-170).
run_hitl_gate() {
local _cid="$1" _env="$2" _ctx="$3"
if [ "$_env" = "dev" ]; then
echo "Environment is $_env — autonomous (no HITL gate)."
return 0
fi
echo "Environment is $_env — HITL attestation gate required$_ctx."
local _approver="${GITHUB_ACTOR:-${GITEA_ACTOR:-}}"
if [ -z "$_approver" ]; then
echo "WARNING: no approver identity (GITHUB_ACTOR/GITEA_ACTOR unset)" >&2
echo " the gate would block in a real CI run. Passing for local." >&2
fi
python3 -c "
import os, sys
sys.path.insert(0, '.')
from core.hitl_gates import attest
from core import env as _envhelper
contract_id = _envhelper.get_env('HITL_CONTRACT_ID') or os.environ['NOVA_HITL_CONTRACT_ID']
env = _envhelper.get_env('HITL_ENV') or os.environ['NOVA_HITL_ENV']
approver = _envhelper.get_env('HITL_APPROVER', '') or 'local-test'
ok, reason = attest(contract_id, env, approver)
if ok:
print(f'HITL PASS: {reason}')
else:
print(f'HITL BLOCK: {reason}', file=sys.stderr)
sys.exit(1)
" NOVA_HITL_CONTRACT_ID="$_cid" NOVA_HITL_ENV="$_env" NOVA_HITL_APPROVER="$_approver"
}
# --local: run the headline E2E against the local emulating tier (D-092).
# No AWS credentials, no Checkov, no DynamoDB. Emulates ECS, outbox, S3
# state, and the contract-ingestor Lambda in-process. Exits 0 on success.
@@ -142,15 +214,14 @@ stream() {
fi
}
CONTRACT_ID="11111111-1111-1111-1111-111111111111" # spike fixed UUID
WORK="/tmp/acdl_platform_run_v18"
CONTRACT_ID="${NOVA_CONTRACT_ID:-11111111-1111-1111-1111-111111111111}" # spike UUID (override via NOVA_CONTRACT_ID)
WORK="${NOVA_WORK_DIR:-/tmp/nova_platform_run}"
TF_DIR="$WORK/tf"
rm -rf "$WORK"; mkdir -p "$TF_DIR"
echo "=== Step 0: environment onboarding check ==="
if [ -n "$ENVIRONMENT_OVERRIDE" ]; then
export NOVA_ENVIRONMENT_OVERRIDE="$ENVIRONMENT_OVERRIDE"
export ACDL_ENVIRONMENT_OVERRIDE="$ENVIRONMENT_OVERRIDE" # legacy fallback, removed in P5
python3 core/environment_check.py --env="$ENVIRONMENT_OVERRIDE" || {
echo "FAIL: environment not bound — see the onboarding prompt above" >&2
exit 1
@@ -177,63 +248,10 @@ jsonschema.validate(contract, schema)
print(f'contract: id={contract[\"id\"]} env={contract[\"environment\"]} modules={list(contract.get(\"infrastructure\",{}).keys())}')
"
# Decommission mode: validate change request, disable deletion protection, zero counts
# Decommission mode: extracted to scripts/run_decommission.sh (P9, REQ-173).
# G-112: sourced (shared env) — the block references CONTRACT/WORK/ROOT.
if [ "$DECOMMISSION" = "1" ]; then
echo ""
echo "=== Decommission Step 1: validate change request against CMDB ==="
[ -n "$CHANGE_REQUEST_ID" ] || fail "change request ID required for decommission mode"
CONSUMER_REPO="${GITHUB_REPOSITORY:-$(python3 -c "import yaml; c=yaml.safe_load(open('$CONTRACT')); print(c.get('id','unknown'))" 2>/dev/null || echo 'unknown')}"
python3 -c "
import json, sys
sys.path.insert(0, '$ROOT')
# In a real deployment, this invokes the Lambda. For local/CI, we simulate.
cr_id = '$CHANGE_REQUEST_ID'
repo = '$CONSUMER_REPO'
print(f'validate_change_request: crId={cr_id} repo={repo}')
# The Lambda action would be:
# payload = {'action': 'validate_change_request', 'changeRequestId': cr_id, 'consumerRepo': repo}
# result = invoke_lambda(payload)
# For now, just print the intent (the actual validation happens via the Lambda in CI/prod)
print('change request validation: PASS (simulated for local mode)')
"
echo ""
echo "=== Decommission Step 2: disable deletion protection (HITL SRE gate) ==="
echo "This step requires SRE approval via GitHub environment 'decommission-gate-sre'."
echo "The contract is resolved with deletion_protection=false injected."
python3 core/contract_resolver.py "$CONTRACT" "$WORK/stack.json" 2>/dev/null || fail "resolver failed"
python3 -c "
import json, sys
sys.path.insert(0, '$ROOT')
from core.contract_resolver import resolve, decommission_transform
stack = resolve('$CONTRACT', '$ROOT')
# Step 2: disable deletion protection only (counts still as-is)
for res in stack['resources']:
if 'nfrs' not in res:
res['nfrs'] = {}
res['nfrs']['deletion_protection'] = False
with open('$WORK/stack-decommission-step1.json', 'w') as f:
json.dump(stack, f, indent=2)
print(f'decommission step 1: {len(stack[\"resources\"])} resources with deletion_protection=false')
"
echo ""
echo "=== Decommission Step 3: zero counts (HITL SRE gate) ==="
echo "This step requires a second SRE approval via GitHub environment 'decommission-destroy-sre'."
python3 -c "
import json, sys
sys.path.insert(0, '$ROOT')
from core.contract_resolver import resolve, decommission_transform
stack = resolve('$CONTRACT', '$ROOT')
stack = decommission_transform(stack)
with open('$WORK/stack-decommission-step2.json', 'w') as f:
json.dump(stack, f, indent=2)
zeroed = sum(1 for r in stack['resources'] if r.get('nfrs',{}).get('deletion_protection') is False)
print(f'decommission step 2: {zeroed} resources with deletion_protection=false + counts=0')
"
echo ""
echo "=== Decommission Step 4: confirm ==="
echo "The terraform apply for step 2 + step 3 would now destroy all resources."
echo "=== DECOMMISSION READY ==="
exit 0
source "$ROOT/scripts/run_decommission.sh"
fi
echo ""
@@ -326,31 +344,7 @@ if [ "$APPLY_ONLY" = "1" ]; then
if [ -n "$ENVIRONMENT_OVERRIDE" ]; then
RESOLVED_ENV="$ENVIRONMENT_OVERRIDE"
fi
if [ "$RESOLVED_ENV" != "dev" ]; then
echo "Environment is $RESOLVED_ENV — HITL attestation gate required before apply."
APPROVER="${GITHUB_ACTOR:-${GITEA_ACTOR:-}}"
if [ -z "$APPROVER" ]; then
echo "WARNING: no approver identity (GITHUB_ACTOR/GITEA_ACTOR unset)" >&2
echo " the gate would block in a real CI run. Passing for local." >&2
fi
python3 -c "
import os, sys
sys.path.insert(0, '.')
from core.hitl_gates import attest
from core import env as _envhelper
contract_id = _envhelper.get_env('HITL_CONTRACT_ID') or os.environ['NOVA_HITL_CONTRACT_ID']
env = _envhelper.get_env('HITL_ENV') or os.environ['NOVA_HITL_ENV']
approver = _envhelper.get_env('HITL_APPROVER', '') or 'local-test'
ok, reason = attest(contract_id, env, approver)
if ok:
print(f'HITL PASS: {reason}')
else:
print(f'HITL BLOCK: {reason}', file=sys.stderr)
sys.exit(1)
" NOVA_HITL_CONTRACT_ID="$CONTRACT_ID" NOVA_HITL_ENV="$RESOLVED_ENV" NOVA_HITL_APPROVER="$APPROVER" || { echo "FAIL: HITL attestation gate blocked the apply" >&2; exit 1; }
else
echo "Environment is dev — autonomous (no HITL gate)."
fi
run_hitl_gate "$CONTRACT_ID" "$RESOLVED_ENV" " before apply" || { echo "FAIL: HITL attestation gate blocked the apply" >&2; exit 1; }
echo ""
echo "=== Step 5: terraform apply -auto-approve ==="
@@ -442,31 +436,7 @@ RESOLVED_ENV=$(python3 -c "import yaml; print(yaml.safe_load(open('$CONTRACT')).
if [ -n "$ENVIRONMENT_OVERRIDE" ]; then
RESOLVED_ENV="$ENVIRONMENT_OVERRIDE"
fi
if [ "$RESOLVED_ENV" != "dev" ]; then
echo "Environment is $RESOLVED_ENV — HITL attestation gate required."
APPROVER="${GITHUB_ACTOR:-${GITEA_ACTOR:-}}"
if [ -z "$APPROVER" ]; then
echo "WARNING: no approver identity (GITHUB_ACTOR/GITEA_ACTOR unset); " >&2
echo " the gate would block in a real CI run. Passing for local." >&2
fi
python3 -c "
import os, sys
sys.path.insert(0, '.')
from core.hitl_gates import attest
from core import env as _envhelper
contract_id = _envhelper.get_env('HITL_CONTRACT_ID') or os.environ['NOVA_HITL_CONTRACT_ID']
env = _envhelper.get_env('HITL_ENV') or os.environ['NOVA_HITL_ENV']
approver = _envhelper.get_env('HITL_APPROVER', '') or 'local-test'
ok, reason = attest(contract_id, env, approver)
if ok:
print(f'HITL PASS: {reason}')
else:
print(f'HITL BLOCK: {reason}', file=sys.stderr)
sys.exit(1)
" NOVA_HITL_CONTRACT_ID="$CONTRACT_ID" NOVA_HITL_ENV="$RESOLVED_ENV" NOVA_HITL_APPROVER="$APPROVER" || { echo "FAIL: HITL attestation gate blocked the promotion" >&2; exit 1; }
else
echo "Environment is dev — autonomous (no HITL gate)."
fi
run_hitl_gate "$CONTRACT_ID" "$RESOLVED_ENV" "" || { echo "FAIL: HITL attestation gate blocked the promotion" >&2; exit 1; }
echo ""
echo "=== Step 8: write evidence event to DynamoDB outbox ==="
@@ -518,92 +488,9 @@ PY
fi
echo ""
echo "=== Step 9b: deploy uptime monitoring (separate state) ==="
# The uptime stack is deployed by default after the L2 module. It uses a
# separate terraform state ($WORK/uptime-tf). Endpoints from the L2 outputs
# are passed as monitored_endpoints. The feature flag (uptime_enabled,
# default true) controls whether this step runs.
#
# P57 contract shape: uptime_enabled is a per-module input under
# infrastructure.<module>.inputs.uptime_enabled (the old top-level
# contract.inputs.uptime_enabled was removed). Scan every module's inputs;
# any module setting uptime_enabled=false disables the uptime step (one
# contract = one logical stack, so a single false wins).
if [ "$DEPLOY_UPTIME" = "1" ] || ( [ "$CHECK_ONLY" = "0" ] && [ "$PLAN_ONLY" = "0" ] ); then
UPTIME_ENABLED=$(python3 -c "
import yaml
c = yaml.safe_load(open('$CONTRACT'))
infra = c.get('infrastructure', {})
# Default true; a module may override to false.
for m, entry in infra.items():
if isinstance(entry, dict) and entry.get('inputs', {}).get('uptime_enabled') is False:
print('False'); break
else:
print('True')
" 2>/dev/null || echo "True")
if [ "$UPTIME_ENABLED" = "True" ] || [ "$UPTIME_ENABLED" = "true" ]; then
echo "uptime: feature flag enabled — constructing uptime contract"
UPTIME_DIR="$WORK/uptime-tf"
mkdir -p "$UPTIME_DIR"
# Build the uptime stack from the L2 outputs
python3 "$ROOT/core/contract_resolver.py" "$CONTRACT" "$WORK/stack.json" 2>/dev/null || true
python3 -c "
import json, sys, yaml
sys.path.insert(0, '$ROOT')
from core.contract_resolver import resolve
stack = resolve('$CONTRACT', '$ROOT')
# Extract HTTP/DNS/TCP endpoints from the stack outputs
endpoints = []
outputs = stack.get('outputs', {})
for name, spec in outputs.items():
src_rid = spec.get('from', '')
src_output = spec.get('output', name)
if 'domain' in name.lower() or 'url' in name.lower() or 'endpoint' in name.lower():
endpoints.append({
'name': name,
'url': f'ref:{src_rid}.{src_output}',
'type': 'http',
'interval_seconds': 60,
'timeout_seconds': 30
})
# Build the uptime contract
uptime_contract = {
'id': 'uptime',
'name': 'uptime-monitoring',
'environment': 'dev',
'infrastructure': {
'uptime': {
'version': '1.0.0',
'inputs': {
'region': 'us-east-1',
'feature_flag_enabled': True,
'monitored_endpoints': endpoints,
}
}
}
}
with open('$WORK/uptime-contract.yml', 'w') as f:
yaml.dump(uptime_contract, f)
print(f'uptime: {len(endpoints)} endpoint(s) to monitor')
" 2>/dev/null || echo "uptime: no endpoints found (skipping monitor config)"
# Resolve + adapt the uptime contract to a separate TF dir
python3 "$ROOT/core/contract_resolver.py" "$WORK/uptime-contract.yml" "$WORK/uptime-stack.json" 2>/dev/null || true
python3 "$ROOT/adapters/terraform/adapter.py" "$WORK/uptime-stack.json" "$UPTIME_DIR" 2>/dev/null || true
if [ "$DEPLOY_UPTIME" = "1" ] && [ -f "$UPTIME_DIR/main.tf" ]; then
echo "uptime: emitted Terraform to $UPTIME_DIR"
if [ "$QUIET" = "0" ]; then
echo "--- uptime main.tf ---"
cat "$UPTIME_DIR/main.tf"
echo "--- end uptime main.tf ---"
fi
fi
echo "uptime: monitoring stack ready (separate state: $UPTIME_DIR)"
else
echo "uptime: feature flag disabled (inputs.uptime_enabled=false) — skipping"
fi
fi
# Uptime monitoring: extracted to scripts/run_uptime.sh (P9, REQ-173).
# G-112: sourced (shared env) — the block references CONTRACT/WORK/DEPLOY_UPTIME.
source "$ROOT/scripts/run_uptime.sh"
echo ""
echo "=== PLATFORM E2E OK ==="