0f250d2bbd
docs(P48): update ROADMAP + PROJECT for v1.9.5 patch release
...
acdl-ci / Lint (push) Successful in 6s
acdl-ci / Test (push) Successful in 24s
acdl-ci / Platform check-only (offline) (push) Successful in 8s
---ci---
phase: 48
milestone: v1.9
status: complete
requirements:
covered: []
partial: []
---/ci---
2026-07-23 14:59:19 +00:00
7585c828f0
docs(P48): vision gaps + badge system + substrate→engine + CR format + agentic tags
...
acdl-ci / Lint (push) Successful in 7s
acdl-ci / Test (push) Successful in 23s
acdl-ci / Platform check-only (offline) (push) Successful in 8s
9 requirements implemented across presentation decks and project docs:
1. DX closing slide: added 'Infrastructure as a utility, not a craft' bullet
to convey the full vision (infrastructure consumed, not maintained;
platform compounds value over time).
2. PW Problem slide: 'moving a merged change' → 'promoting a change'.
3. PW Problem slide: added 'Red tape' and 'Scalability without increasing
headcount' bullets (4 frictions, not 2).
4. PW Roadmap slide: redesigned with side-by-side HTML table layout
(Testing | Planned), 16px font, no overflow.
5. PW deck: added new slide 'What This Platform Is — and Isn't' after North
Star (sovereign boundary, infrastructure as utility, 4 anti-goals).
PW deck now 16 slides (was 15).
6. Maturity nomenclature: 'Available today'/'shipped' → 'Testing' across
both decks + source markdown. New .testing badge (blue/teal #DBEAFE).
Roadmap title: 'Testing vs. Planned'. The platform has 0 consumer
adoption — 'shipped' was inaccurate.
7. Global: 'substrate' → 'engine' across entire project (88 matches, 30+
files including .ciagent/, docs/, modules/, adapters/, schemas/, code).
8. Presentation files only: 'forge' → 'VCS' / 'version control system'
(6 occurrences in 4 files). 'forge' retained in all technical docs and
code as the industry-standard term.
9. New .agentic badge (purple/violet #EDE9FE) appended to agentic features
in both decks: confidence signal, autonomous dev, pattern recognition,
dynamic module creation, citizen developer surface, auto-promotion.
Also: Change Request ID format changed from 'CR-2026-001' to 'CHG0678912'
across presentation files, consumer guide, and test fixtures.
HTML re-rendered. PPTX rendered for release upload.
---ci---
phase: 48
milestone: v1.9
status: complete
requirements:
covered: []
partial: []
---/ci---
2026-07-23 14:58:29 +00:00
fc070ccb15
docs(P47): remove HIPAA from ciagent tracking files
...
acdl-ci / Lint (push) Successful in 7s
acdl-ci / Test (push) Successful in 25s
acdl-ci / Platform check-only (offline) (push) Successful in 8s
---ci---
phase: 47
milestone: v1.9
status: complete
requirements:
covered: []
partial: []
---/ci---
2026-07-23 14:10:16 +00:00
be6dc7cff6
docs(P47): update ROADMAP + PROJECT for v1.9.4 patch release
...
acdl-ci / Lint (push) Successful in 7s
acdl-ci / Test (push) Successful in 26s
acdl-ci / Platform check-only (offline) (push) Successful in 9s
---ci---
phase: 47
milestone: v1.9
status: complete
requirements:
covered: []
partial: []
---/ci---
2026-07-23 14:09:31 +00:00
2682719f24
docs(P47): presentation slide updates + HIPAA removal from all docs
...
acdl-ci / Lint (push) Successful in 7s
acdl-ci / Test (push) Successful in 26s
acdl-ci / Platform check-only (offline) (push) Successful in 8s
Presentation changes (both Marp decks + source markdown):
1. Title slide: deck title as H1 (slightly bigger), 'Agentic Cloud Delivery
Platform' as H3 subtitle — cleaner title hierarchy
2. DX deck: removed Local Reproducibility slide (not beneficial for DX)
3. DX deck: Safe Promotion Path slide redesigned with side-by-side layout
for Approaches A and B (HTML table, two columns)
4. DX deck: 'an agent' → 'an AI agent' (slide 2 + Citizen Developer slide)
5. DX deck: What a Developer Does — diagram floated to the right side
6. Header simplified to just the deck name (subtitle now on title slide)
HIPAA removal (25 files):
- Completely removed all HIPAA references from all markdown documentation,
presentation source files, module READMEs, and rendered HTML
- Removed HIPAA from compliance milestone lists (GDPR, SOX, SOC2, DORA remain)
- Removed HIPAA section references (§164.xxx) from compliance annotations
- Cleaned up empty parentheses and broken commas left by removal
- Re-rendered both HTML decks from updated Marp source
---ci---
phase: 47
milestone: v1.9
status: complete
requirements:
covered: []
partial: []
---/ci---
2026-07-23 14:08:40 +00:00
5079d07e64
docs(P46): update ROADMAP + PROJECT for v1.9.3 patch release
...
acdl-ci / Lint (push) Successful in 7s
acdl-ci / Test (push) Successful in 26s
acdl-ci / Platform check-only (offline) (push) Successful in 9s
---ci---
phase: 46
milestone: v1.9
status: complete
requirements:
covered: []
partial: []
---/ci---
2026-07-23 13:44:51 +00:00
ec30f4ae56
docs(P46): render Marp decks to HTML + PPTX, update README for rendered artifacts
...
acdl-ci / Lint (push) Successful in 7s
acdl-ci / Test (push) Successful in 27s
acdl-ci / Platform check-only (offline) (push) Successful in 9s
Commit self-contained HTML renderings of both Marp presentation decks to
docs/presentations/ so they are viewable in any browser and on the git
forge. The HTML files embed all images as base64 data URIs and render
the full S&P Global Energy brand theme (#D6002A red-core, #1B1B1B grey-90,
Akkurat Pro font).
Updated the README to document the 3-step process with HTML as a
committed artifact (re-render when Marp source changes) and PPTX as a
Gitea release attachment (binary, not committed to git).
PPTX files are rendered and uploaded to the Gitea release as downloadable
attachments for stakeholders.
---ci---
phase: 46
milestone: v1.9
status: complete
requirements:
covered: []
partial: []
---/ci---
2026-07-23 13:44:19 +00:00
2cd9ae150d
docs(P45): update ROADMAP + PROJECT for v1.9.2 patch release
...
acdl-ci / Lint (push) Successful in 7s
acdl-ci / Test (push) Successful in 26s
acdl-ci / Platform check-only (offline) (push) Successful in 9s
---ci---
phase: 45
milestone: v1.9
status: complete
requirements:
covered: []
partial: []
---/ci---
2026-07-23 13:28:54 +00:00
ae0cb589ab
docs(P45): S&P Global Energy theme + title/footer/subtitle updates for Marp decks
...
acdl-ci / Lint (push) Successful in 7s
acdl-ci / Test (push) Successful in 27s
acdl-ci / Platform check-only (offline) (push) Successful in 9s
Apply S&P Global Energy brand theme to both Marp presentation decks:
1. Title headers: 'Agentic Cloud Delivery Platform — How The Platform Works'
and 'Agentic Cloud Delivery Platform — The Developer Experience'
2. Footer: 'Confidential · For Senior Leadership' → 'Internal'
3. Title slide subtitle: removed 'Senior Leadership Briefing' (clean title)
4. S&P Global brand theme (colors extracted from live spglobal.com CSS):
- H1/H2: #D6002A (S&P red-core, confirmed from logo SVG + compiled CSS)
- Title slide bg: #1B1B1B (S&P grey-90) with 8px #D6002A top accent bar
- Body text: #1B1B1B (grey-90)
- Blockquote border: #D6002A, text: #2E2E2E (grey-80)
- Table headers: #F0F0F0 (grey-5)
- Font: 'Akkurat Pro' (S&P corporate typeface) with web-safe fallbacks
- theme: default kept as Marp base (simple)
5. Last DX slide: 'The Outcome for Leadership' → 'The Desired Outcomes'
---ci---
phase: 45
milestone: v1.9
status: complete
requirements:
covered: []
partial: []
---/ci---
2026-07-23 13:28:16 +00:00
b0a2728f59
docs(P44): update ROADMAP + PROJECT for v1.9.1 patch release
...
acdl-ci / Lint (push) Successful in 7s
acdl-ci / Test (push) Successful in 26s
acdl-ci / Platform check-only (offline) (push) Successful in 8s
---ci---
phase: 44
milestone: v1.9
status: complete
requirements:
covered: []
partial: []
---/ci---
2026-07-23 12:51:59 +00:00
fca618916c
docs(P44): leadership presentation decks + Marp synthesis + README
...
acdl-ci / Lint (push) Successful in 7s
acdl-ci / Test (push) Successful in 26s
acdl-ci / Platform check-only (offline) (push) Successful in 9s
Add two leadership-facing presentation decks for senior leadership
(CTO, Head of Cloud, Head of Infrastructure, Head of DevOps):
1. How the Platform Works — 14 slides covering the contract-driven model,
zero-trust, computed safety, policy enforcement, secure-by-default,
immutable audit, HITL, observability, platform-managed environments,
portability, and an honest shipped-vs-planned roadmap.
2. The Developer Experience — 14 slides covering two consumer surfaces,
the 5-line contract, no platform code, versioned releases, instant
feedback, deploy outputs, local reproducibility, friendly onboarding,
safe promotion (one contract + per-env CI jobs), safe decommission,
self-service module catalog, and the leadership outcome.
Each deck has two forms:
- Full markdown (source of truth) with speaker notes + mermaid code blocks
- Marp deck (lean, no speaker notes, embedded PNG diagrams) for presentation
Includes a README documenting the 3-step slide creation process:
(full markdown → Marp synthesis → PPTX export) with conventions, build
commands, and maturity framing rules.
---ci---
phase: 44
milestone: v1.9
status: complete
requirements:
covered: []
partial: []
---/ci---
2026-07-23 12:50:29 +00:00
7cccf989b1
audit(v1.9): PASS — ARCHITECTURE.md v1.9 addendum + audit report
...
acdl-ci / Lint (push) Successful in 7s
acdl-ci / Test (push) Successful in 26s
acdl-ci / Platform check-only (offline) (push) Successful in 8s
---ci---
phase: 43
milestone: v1.9
status: complete
---/ci---
Audit of the shipped v1.9 milestone:
Reconstruction: PASS — 16 v1.9 commits, all with ---ci--- blocks;
state reconstructs to milestone v1.9, phase 43, status complete.
Decisions D-080..D-089 all present in git log + .ciagent/ files.
File discipline: PASS — config.json, PROJECT.md, ROADMAP.md,
REQUIREMENTS.md, REVIEW.md, PERSONAS.md, VERIFY.md all consistent.
Fixed: ARCHITECTURE.md had no v1.9 coverage — added a v1.9 addendum
covering all 9 new code components (contract_resolver interpolation,
environment_check.load, hitl_gates, attestation_matrix,
separation_of_duties.route_halt_artifact, WizClient, kyverno_adapter,
per-env promotion, adapter parameterization) + the deferred D-083 items.
Branch hygiene: PASS — only main (local + remote); all 5 v1.9 phase
branches merged + pruned.
Commit discipline: PASS — 16/16 commits with ---ci--- blocks; no stale
implementation decisions; no unresolved v1.9 escalations.
Audit result: PASS.
2026-07-23 12:04:08 +00:00
6e41f09c6e
verify(P43): code review — 1 P0 auto-fixed, 1 P1 auto-fixed, 3 P1 flagged
...
acdl-ci / Lint (push) Successful in 6s
acdl-ci / Test (push) Successful in 26s
acdl-ci / Platform check-only (offline) (push) Successful in 9s
---ci---
phase: 43
milestone: v1.9
status: verify
lessons:
- P0 fix: run_platform.sh HITL gate passed approver via string interpolation into Python (GITHUB_ACTOR injection vector) — fixed by passing env vars (ACDL_HITL_*) read via os.environ
- P1 fix: attestation_matrix._is_fresh accepted future-dated artifacts (negative age bypassed freshness) — fixed with negative-age guard + test
- P1 flagged: WizClient._post does not check GraphQL errors (silent empty-list mask)
- P1 flagged: WizClient._post no SSRF validation on WIZ_API_URL
- P1 flagged: contract_resolver._load_env duplicates environment_check.load (can drift)
---/ci---
Multi-persona review of the v1.9 diff (v1.8.0..HEAD). Review pass 2
(post-complete) caught issues the initial self-review missed:
P0-INJECT (auto-fixed): scripts/run_platform.sh Step 7b interpolated
$APPROVER (GITHUB_ACTOR/GITEA_ACTOR) directly into a Python string
literal — an attacker-controllable username containing shell/python
metacharacters would execute arbitrary Python. Fixed: approver, contract
id, and env are now passed as environment variables to the subprocess
and read via os.environ[...] (no string interpolation).
P1-FRESHNESS (auto-fixed): core/attestation_matrix.py _is_fresh
accepted future-dated artifacts (negative age.days <= window_days).
Fixed: added age.total_seconds() < 0 guard rejecting future timestamps.
Test added: test_freshness_rejects_future_dated_artifact.
3 P1 flagged for post-hoc:
- WizClient._post does not surface GraphQL errors (silent empty mask)
- WizClient._post no SSRF validation on WIZ_API_URL (operator-supplied, low risk)
- contract_resolver._load_env duplicates environment_check.load (drift risk)
REVIEW.md updated with the findings. 494 tests pass; run_ci.sh + run_platform.sh --check-only green.
2026-07-23 11:54:58 +00:00
c4d966359f
docs(P43): merge phase 43 — verify + review + audit + complete v1.9
...
---ci---
project: acdl
phase: 43
milestone: v1.9
status: complete
---/ci---
Merged phase/43-verify-review-audit-complete into main. v1.9 milestone
COMPLETE. 493 tests pass; run_ci.sh + run_platform.sh green; audit PASS.
2026-07-23 04:46:09 +00:00
5365bb4e0a
docs(milestone): complete v1.9 — verify + review + audit + tag v1.9.0
...
---ci---
project: acdl
phase: 0
milestone: v1.9
status: complete
requirements:
covered: [REQ-100, REQ-101, REQ-102, REQ-103, REQ-104, REQ-105, REQ-106, REQ-107, REQ-108, REQ-109, REQ-110, REQ-111]
partial: []
---/ci---
v1.9 milestone COMPLETE. All 12 requirements satisfied.
Verify: 4 layers PASS (structural 26/26 files, behavioral 493 tests +
run_ci.sh + run_platform.sh --check-only green, security, quality).
Review: 0 P0, 0 P1 (READY TO SHIP). REVIEW.md reconstructed (D-086).
Audit: PASS (reconstruction, file discipline, branch hygiene, commit
discipline — 12/12 commits with ---ci--- blocks).
Updated:
- .ciagent/REQUIREMENTS.md: v1.9 section marked complete; traceability
table REQ-100..111 added.
- .ciagent/ROADMAP.md: v1.9 marked complete; Phase 43 added.
- .ciagent/PROJECT.md: v1.9 objective marked complete.
- .ciagent/config.json: milestone v1.9 status -> complete.
- .ciagent/REVIEW.md: reconstructed with v1.9 content (D-086).
- .ciagent/VERIFY.md: v1.9 4-layer verify.
- .ciagent/AUDIT.md: v1.9 audit (PASS).
- uses:/ref: bumped @v1.6 -> @v1.9 in contracts/, deploy workflows,
docs/consumer-guide.md (D-071 successor).
Tag v1.9.0 created next; floating v1.9 + v1 tags updated.
2026-07-23 04:46:04 +00:00
80d2a6cc6c
docs(P42): merge phase 42 — stub implementation
...
---ci---
project: acdl
phase: 42
milestone: v1.9
status: execute
---/ci---
Merged phase/42-stub-implementation into main. REQ-107..111 satisfied.
493 tests pass; run_ci.sh + run_platform.sh green.
2026-07-23 04:40:49 +00:00
e74a8c2f5d
feat(P42): stub implementation — SoD, HITL gates, attestation matrix, Wiz, Kyverno
...
---ci---
project: acdl
phase: 42
milestone: v1.9
status: execute
---/ci---
Phase 42 — stub-implementation (REQ-107..111, D-084):
route_halt_artifact (REQ-107):
- core/separation_of_duties.py: real SNS publish (ACDL_SOD_HALT_TOPIC_ARN)
+ outbox fallback (SEPARATION_OF_DUTIES_VIOLATION event via
outbox_writer) + stderr emission. No silent print-only stub.
- terraform/platform/main.tf: aws_sns_topic.acdl-sod-halt + output.
HITL attestation gates (REQ-108):
- core/hitl_gates.py: attest(contract_id, env, approver, evidence,
outbox_client) records approver_qa/approver_prod/approver_dr to
outbox, runs SoD check on prod, invokes attestation matrix, returns
(ok, reason). Dev skips (autonomous). approver_from_env() reads
GITHUB_ACTOR/GITEA_ACTOR.
- scripts/run_platform.sh: Step 7b HITL gate before apply for qa/prod/dr.
8-concern attestation matrix (REQ-109, D-084):
- core/attestation_matrix.py: check(env, evidence) runs the 8 concerns
from hitl_matrix_design.md §10.4. Offline-testable (contract_nfrs,
schema_validity, policy_pass) run for real. Operator-supplied accept
signed artifacts validated for freshness (FRESHNESS_DAYS table) +
schema. Signature skip when ACDL_ATTESTATION_SIGNING_KEY_ID unset
(D-089). Fail loud if missing/expired for prod/dr.
Wiz real client (REQ-110):
- adapters/wiz/wiz_adapter.py: WizClient (GraphQL API, Bearer auth,
pagination via pageInfo.hasNextPage + endCursor). fetch_and_adapt
translates issues → PolicyCheckResult; graceful degrade when
WIZ_API_TOKEN/WIZ_API_URL unset.
Kyverno fleshed out (REQ-111):
- adapters/kyverno/kyverno_adapter.py: full PolicyReport →
PolicyCheckResult mapping (pass/fail/skip/warn + severity + skip-with-
reason + resource ref construction from kind/name/namespace).
adapt_inactive() emits KYVERNO_INACTIVE_TF_STACK guard. --kube-version
stub parsed for future GitOps.
Tests: +47 (test_route_halt_artifact.py, test_hitl_gates.py,
test_attestation_matrix.py, test_wiz_adapter_real_client.py, expanded
test_kyverno_adapter.py). Existing wiz_adapter tests updated for the
real client's control.name ruleId. 493 passed; run_ci.sh green;
run_platform.sh --check-only green.
2026-07-23 04:40:44 +00:00
5ebf7a62c8
docs(P41): merge phase 41 — per-environment CI jobs
...
---ci---
project: acdl
phase: 41
milestone: v1.9
status: execute
---/ci---
Merged phase/41-per-environment-ci-jobs into main. REQ-105, REQ-106
satisfied. 446 tests pass; run_ci.sh + run_platform.sh green; deploy
workflows byte-identical.
2026-07-23 04:34:14 +00:00
cd637808f5
feat(P41): per-environment CI jobs + environment workflow input
...
---ci---
project: acdl
phase: 41
milestone: v1.9
status: execute
---/ci---
Phase 41 — per-environment-ci-jobs (REQ-105, REQ-106, D-082):
Per-env contracts (REQ-105):
- contracts/static-assets.{dev,qa,prod,dr}.yaml + microservice.{dev,qa,prod,dr}.yaml
(8 files, each sets environment: to its own name, uses interpolation).
- Default contracts/static-assets.yaml + microservice.yaml preserved (backwards compat).
Deploy workflow environment input (REQ-106):
- .github/workflows/deploy.yml + .gitea/workflows/deploy.yml (byte-identical):
new 'environment' workflow_call input (default empty, override).
- scripts/run_platform.sh: --environment <name> flag; exports
ACDL_ENVIRONMENT_OVERRIDE; re-runs env check against the override.
- core/contract_resolver.py: resolve(environment_override=...) (D-088);
CLI honors --environment flag + ACDL_ENVIRONMENT_OVERRIDE env var.
Consumer guide (REQ-106):
- docs/consumer-guide.md: 'Per-environment deployment' section with 4
caller-workflow examples (dev/qa/prod/dr), HITL gate structure
(approve_qa/approve_prod/approve_dr, D-042), interpolation reference table.
- Documents promotion-without-editing + hybrid model (per-env contracts
OR single contract + env input).
Tests: +40 (test_per_env_contracts.py, test_deploy_workflow_env_input.py,
test_consumer_guide_per_env_section.py). 446 passed; run_ci.sh green;
deploy workflows byte-identical.
2026-07-23 04:34:10 +00:00
481cfe760c
docs(P40): merge phase 40 — contract interpolation
...
---ci---
project: acdl
phase: 40
milestone: v1.9
status: execute
---/ci---
Merged phase/40-contract-interpolation into main. REQ-103, REQ-104
satisfied. 406 tests pass; run_ci.sh + run_platform.sh green.
2026-07-23 04:30:34 +00:00
bee9d02f01
feat(P40): contract interpolation + environment JSON schema
...
---ci---
project: acdl
phase: 40
milestone: v1.9
status: execute
---/ci---
Phase 40 — contract-interpolation (REQ-103, REQ-104, D-081):
Interpolation:
- core/contract_resolver.py: _expand_vars(value, context) recursively
expands ${env.<field>} + ${contract.<field>} tokens (dotted paths
supported, e.g. ${env.state_backend.bucket}). Unknown tokens raise
ValueError (fail loud). Expansion is post-schema-validation,
pre-IR-resolution.
- resolve() accepts environment_override (D-088) — overrides the
contract's environment field BEFORE schema validation so interpolation
context is consistent.
- env context loaded via _load_env (self-contained, works as script +
package import); 'environment' alias for env 'name' so
${env.environment} resolves.
Environment schema + bindings:
- schemas/environment.schema.json (draft 2020-12): name, account_id,
region, state_backend, network, runner_role_arn, autonomy, confidence_threshold.
- core/environments/qa.json, prod.json, dr.json placeholder bindings
(attested, thresholds 0.75/0.90/0.95, placeholder account_id with
stderr warning at load).
- core/environment_check.py: load(env_name) helper + placeholder warning.
Sample contracts:
- contracts/static-assets.yaml + microservice.yaml use
acdl-${env.environment}-${contract.module}-${env.account_id}-${env.region}
naming pattern (region + account id + environment).
Tests: +35 (test_environment_schema.py, test_interpolation.py,
test_sample_contracts_interpolate.py). 406 passed; run_ci.sh green;
run_platform.sh --check-only green. Existing fixture-based tests
preserved (instance.json static fixtures unaffected).
2026-07-23 04:30:30 +00:00
8118d6ee27
docs(P39): merge phase 39 — design doc refresh + P1-1 parameterization
...
---ci---
project: acdl
phase: 39
milestone: v1.9
status: execute
---/ci---
Merged phase/39-design-doc-refresh-and-p1-1 into main. REQ-100, REQ-101,
REQ-102 satisfied. 371 tests pass; run_ci.sh + run_platform.sh green.
2026-07-23 04:24:29 +00:00
e1be05287b
feat(P39): refresh design docs + parameterize adapter (P1-1)
...
---ci---
project: acdl
phase: 39
milestone: v1.9
status: execute
---/ci---
Phase 39 — design-doc-refresh-and-p1-1-parameterization:
Design docs (REQ-100, REQ-101):
- hitl_matrix_design.md: 'dev-only spike'/'v1.2 wires the gates' framing
replaced with v1.9 wired-gates reality; 8-concern matrix marked
implemented (offline-testable subset + signed evidence artifacts,
D-084); v1.9 wiring section cross-references hitl_gates.py +
attestation_matrix.py; approver_dr noted.
- audit_ledger_design.md: outbox marked shipped+production since v1.8;
S3 Object Lock + JWS + async worker + DLQ + daily checkpoints clearly
labeled 'Deferred to a future milestone (D-083)'; RPO/RTO table updated;
approver fields note v1.9 hitl_gates.attest.
P1-1 adapter parameterization (REQ-102, D-085):
- ecs-service interface.json: desired_count (default 1), launch_type
(FARGATE), family (app) inputs added.
- alb interface.json: load_balancer_type (application), target_type (ip).
- adapter.py: hardcoded defaults replaced with inputs.get(<name>, <default>);
hardcoded 'acdl-microservice-rt'/'acdl-microservice-igw' Name tags
derive from the VPC name input.
- contract_resolver.py: child_input_map routes wires to the sub-resource
that declares the input (desired_count → aws:ecs:service, family →
aws:ecs:task_definition, target_type → targetgroup, etc.).
- microservice composition.json: wires added for the new inputs.
Tests: +21 (test_p1_1_adapter_parameterization.py, test_design_docs_current.py).
371 passed; run_ci.sh green; run_platform.sh --check-only green; v1.1 S3
regression preserved.
2026-07-23 04:24:25 +00:00
58100c485e
docs(P00): create 5 phase plans for v1.9 (phases 39-43)
...
---ci---
project: acdl
phase: 0
milestone: v1.9
status: plan
---/ci---
5 vertical-slice phases, wave-ordered:
- Wave 1 (parallel): Phase 39 (design docs + P1-1, disjoint file sets)
- Wave 2: Phase 40 (contract interpolation + env schema)
- Wave 3: Phase 41 (per-env CI jobs + env workflow input)
- Wave 4: Phase 42 (stubs: SoD, HITL gates, attestation matrix, Wiz, Kyverno)
- Wave 5: Phase 43 (verify + review + audit + complete)
Plans reference REQ-100..REQ-111. Decisions D-080..D-089 applied.
Versioning: feature milestone, patches v1.8.1..v1.8.5, tag v1.9.0 at COMPLETE.
2026-07-23 04:19:17 +00:00
2bea048bb6
docs(P00): research v1.9 — interpolation, per-env jobs, Wiz, attestation matrix
...
---ci---
project: acdl
phase: 0
milestone: v1.9
status: research
---/ci---
RESEARCH.md v1.9 addendum:
- RA-1: interpolation prior art + ${env.<field>} syntax choice (D-081)
- RA-2: GitHub/Gitea Actions workflow_call environment input + per-env jobs (D-082)
- RA-3: Wiz GraphQL API shape + PolicyCheckResult mapping (REQ-110)
- RA-4: attestation matrix freshness validation + signed artifacts (D-084)
- RA-5: design doc drift audit (hitl_matrix + audit_ledger)
- RA-6: P1-1 adapter hardcoded defaults audit (D-085)
New decisions surfaced: D-087 (recursive expansion), D-088 (env override
pre-validation), D-089 (signature skip when signing key unset).
PERSONAS.md updated for v1.9: milestone field, lambda-engineer
reactivated (SNS topic), phase-specific overrides for phases 39-43,
domain priority updated.
2026-07-23 04:17:41 +00:00
c05ed7a26f
docs(P00): clarify v1.9 — record decisions D-080..D-086
...
---ci---
project: acdl
phase: 0
milestone: v1.9
status: clarify
---/ci---
Full autonomy: all clarifications resolved interactively pre-run + 2
auto-resolved parameters. Decisions recorded (renumbered D-080+ to
avoid collision with v1.8 research decisions D-073..D-077):
- D-080: new milestone v1.9 (feature), ship tag v1.9.0
- D-081: ${env.<field>} + ${contract.<field>} interpolation syntax
- D-082: hybrid per-env promotion (per-env contracts + env workflow input)
- D-083: audit ledger Object Lock/JWS/worker/DLQ deferred (future milestone)
- D-084: attestation matrix offline-testable subset + signed evidence artifacts
- D-085: P1-1 adapter defaults move to L1 interface.json inputs
- D-086: REVIEW.md reconstructed at v1.9 complete; v1.3-v1.8 noted as not-persisted
Auto-resolved: per-env account_id placeholder + stderr warning; SNS topic
defined in Terraform + code reads ACDL_SOD_HALT_TOPIC_ARN.
2026-07-23 04:16:42 +00:00
136ec6abf3
docs(init): validate v1.9 specification
...
---ci---
project: acdl
phase: 0
milestone: v1.9
status: specify
---/ci---
v1.9 scope (user-directed, 2026-07-23):
- Design doc refresh (hitl_matrix_design.md + audit_ledger_design.md)
- Contract interpolation (${env.<field>} + ${contract.<field>})
- Per-environment CI jobs (no environment field editing for promotion)
- Stub implementation (SoD, HITL gates, attestation matrix, Wiz, Kyverno)
- P1-1 adapter parameterization remediation
Requirements REQ-100..REQ-111 added to REQUIREMENTS.md.
PROJECT.md v1.9 objective + phase table (39-43) appended.
config.json milestone bumped to v1.9 (active).
2026-07-23 04:15:41 +00:00
2f0e69272a
audit(v1.8): PASS — audit report committed
...
acdl-ci / Lint (push) Successful in 7s
acdl-ci / Test (push) Successful in 26s
acdl-ci / Platform check-only (offline) (push) Successful in 9s
---ci---
project: acdl
phase: 0
milestone: v1.8
status: complete
---/ci---
Audit report: PASS. All checks passed:
- Reconstruction: 17/17 commits with ---ci--- blocks, state matches config
- File discipline: 10 .ciagent/ files valid, 0 issues
- Branch hygiene: stale branches cleaned, only main remains
- Commit discipline: 17/17 with ---ci--- blocks, 0 stale decisions
Issues fixed during audit:
- ARCHITECTURE.md: added v1.8 addendum
- Stale branches: deleted phase/21 + milestone/v1.0-initial
2026-07-22 22:43:07 +00:00
2861319447
audit(v1.8): ARCHITECTURE.md v1.8 addendum + stale branch cleanup
...
acdl-ci / Lint (push) Successful in 7s
acdl-ci / Test (push) Successful in 26s
acdl-ci / Platform check-only (offline) (push) Successful in 9s
---ci---
project: acdl
phase: 0
milestone: v1.8
status: complete
---/ci---
Audit fixes:
- ARCHITECTURE.md: added v1.8 addendum covering new primitives (kms-key,
uptime), encryption-by-default, deletion-protection-by-default,
decommission alias, adapter expansion (19 TYPE_MAP entries), pipeline
stages (9), forge-agnostic API URLs.
- Stale branches cleaned: phase/21-docs-restructure (v1.6) and
milestone/v1.0-initial (v1.0) deleted. Pruned remote refs.
- Only main + origin/main remain.
Audit result: PASS
2026-07-22 22:42:46 +00:00
f9a93d56cc
docs(milestone): ship v1.8.0 — fix REQUIREMENTS.md header
...
acdl-ci / Lint (push) Successful in 8s
acdl-ci / Test (push) Successful in 26s
acdl-ci / Platform check-only (offline) (push) Successful in 9s
---ci---
project: acdl
phase: 0
milestone: v1.8
status: complete
---/ci---
Ship finalization: REQUIREMENTS.md v1.8 section header corrected
from Active to Complete. All other .ciagent/ files already updated.
2026-07-22 22:36:54 +00:00
ca99241843
verify(P28-38): code review — 1 P0 auto-fixed, 3 P1 fixes, 2 P1 flagged
...
acdl-ci / Lint (push) Successful in 7s
acdl-ci / Test (push) Successful in 27s
acdl-ci / Platform check-only (offline) (push) Successful in 9s
---ci---
project: acdl
phase: 28-38
milestone: v1.8
status: verify
lessons:
- P0 fix: pipelines/deploy.yaml stale terraform/spike paths updated to run_platform.sh
- P1 fix: removed import sys from inside _emit_resource function body
- P1 fix: removed unused cpu/memory vars in uptime emission
- P1 fix: decommission consumerRepo now uses GITHUB_REPOSITORY env
---/ci---
P0: deploy.yaml 3 stage commands referenced removed terraform/spike dir.
P1 fixes: import sys, unused vars, consumerRepo env.
P1 flagged: uptime hardcoded subnet/sg, uses ref not bumped to v1.8.
P2 flagged: deploy-uptime flag standalone, pre-v1.8 READMEs missing NFRs.
Tests: 350 passed.
2026-07-22 22:30:49 +00:00
c99da9a58c
docs(milestone): complete v1.8 — P1 remediation + uptime + standards + encryption + decommission + docs
...
---ci---
project: acdl
phase: 0
milestone: v1.8
status: complete
requirements:
covered: [REQ-76, REQ-77, REQ-78, REQ-79, REQ-80, REQ-81, REQ-82, REQ-83, REQ-84, REQ-85, REQ-86, REQ-87, REQ-88, REQ-89, REQ-90, REQ-91, REQ-92, REQ-93, REQ-94, REQ-95, REQ-96, REQ-97, REQ-98, REQ-99]
partial: []
---/ci---
v1.8 milestone complete. 11 phases (28-38), 24 requirements (REQ-76..99).
Track 1 — P1 Remediation (8 issues, all resolved):
- P1-3: SSM fail-loud without CMK + escape hatch
- P1-4: WAF custom rules emit nested HCL blocks
- P1-5: WAF default_action input honored
- P1-6: Terraform-rendered invoke policy (no placeholder account ID)
- P1-7: L2 composition outputs resolved + adapter output blocks
- P1-8: Per-run temp dir (terraform/spike removed)
- P1-9: Forge-agnostic API URLs (GITHUB_API_BASE)
- S1: Static-key override wired to configure-aws-credentials inputs
Track 2 — Encryption + Deletion Protection by Default:
- Per-stack CMK (kms-key primitive, 90-day rotation, no shared keys)
- All 12 primitives have encryption_enabled NFR + kms_key_arn input
- L2 modules wire per-stack CMK to all children
- All 12 primitives have deletion_protection NFR (default true)
- Adapter emits lifecycle { prevent_destroy = true }
- L2 feature flag propagation (inputs.deletion_protection)
Track 3 — Uptime + Standards + Docs:
- uptime-kuma primitive (ECS Fargate, feature flag, alert channels)
- deploy-uptime pipeline stage (separate state)
- Decommission mode (2-step HITL SRE gates + CMDB validation)
- modules/STANDARDS.md (L1+L2 authoring + review standards)
- schemas/README.md, pipelines/README.md, adapters/README.md
Tests: 275 -> 350 (+75 new). All pass. run_ci.sh + check-only green.
Zero pending P1 issues remaining.
2026-07-22 22:24:15 +00:00
da60f0e82f
verify(P28-36): 4-layer verification — 350 tests, all pass
...
---ci---
project: acdl
phase: 28-36
milestone: v1.8
status: verify
---/ci---
Structural: 14 new files present, terraform/spike removed, 14 registry entries. PASS.
Behavioral: 350 tests pass (275 -> 350, +75 new). run_ci.sh + check-only green. PASS.
Security: no placeholder account IDs, no hardcoded API URLs, byte-identical
workflows, SSM fail-loud, deletion protection + encryption by default. PASS.
Quality: each P1 fix + each new feature has dedicated tests. PASS.
VERIFY PASS.
2026-07-22 22:23:24 +00:00
3562f6f771
docs(P36): schemas/adapters/pipelines READMEs (REQ-97, REQ-98, REQ-99)
...
---ci---
project: acdl
phase: 36
milestone: v1.8
status: execute
---/ci---
- schemas/README.md: how to write schemas, wire into platform, test in
CI, dependencies, existing catalog, adding a new schema.
- pipelines/README.md: how to write pipeline contracts, wire into
workflows, test, dependencies, existing catalog, adding a new pipeline.
- adapters/README.md: how to write adapters (Terraform + policy patterns),
wire into platform, test, dependencies, existing catalog, adding a new
adapter.
- tests/test_docs_coverage.py: 6 tests validating all 3 READMEs exist
with required sections.
Tests: +6 (344 -> 350). All pass.
2026-07-22 22:22:18 +00:00
cb02c69e0c
docs(P35): module engineering standards + catalog fix + template update (REQ-95, REQ-96)
...
---ci---
project: acdl
phase: 35
milestone: v1.8
status: execute
---/ci---
- modules/STANDARDS.md: comprehensive L1+L2 authoring + code review
standards (9 sections: L1 standards, L2 standards, encryption by default,
deletion protection by default, registry, README standards, adapter
extension pattern, code review checklist).
- modules/README.md: catalog index fixed — rds, kms-key, uptime added
to the Primitives table.
- modules/README-TEMPLATE.md: NFRs section added between Outputs and Usage.
- tests/test_module_standards.py: automated enforcement test (12 tests)
validating required files, NFRs, registration, README sections.
Tests: +12 (332 -> 344). All pass.
2026-07-22 22:20:50 +00:00
134f85d2df
feat(P34): decommission alias + CMDB validation (REQ-92, REQ-93, REQ-94)
...
---ci---
project: acdl
phase: 34
milestone: v1.8
status: execute
---/ci---
- DynamoDB acdl-change-requests table added to terraform/platform/main.tf
(PK changeRequestId, SK submittedAt, SSE via CMK, PITR).
- validate_change_request Lambda action added to contract_ingestor.py:
queries CMDB, asserts status=approved + consumerRepo match.
- decommission_transform() added to contract_resolver.py: zeroes all
counts (desired_count, min/max_capacity) + sets deletion_protection=false.
- Decommission mode added to deploy pipeline + both deploy workflows
(mode: decommission + changeRequestId input). Byte-identical.
- run_platform.sh --decommission flag: validates CR, resolves with
deletion_protection=false (step 1), then decommission_transform
(step 2). HITL SRE gates documented.
- docs/consumer-guide.md: new "Decommissioning a stack" section with
CR request, trigger, 2-step HITL SRE gates, CMK deletion window, uptime.
Tests: +14 (318 -> 332). All pass.
2026-07-22 22:18:28 +00:00
491ba78768
feat(P33): uptime-kuma primitive + deploy-uptime pipeline stage (REQ-88..91)
...
---ci---
project: acdl
phase: 33
milestone: v1.8
status: execute
---/ci---
- New uptime L1 primitive (aws:ecs:uptime-service) deploying uptime-kuma
on ECS Fargate with feature_flag_enabled, monitored_endpoints,
static_checks, alert_channels (Teams/email/SMS/GitHub issues).
- Adapter emits ECS Fargate task + service when feature_flag_enabled=true;
emits nothing when false. Container image louislam/uptime-kuma:1.
- New deploy-uptime pipeline stage in pipelines/deploy.yaml (after
publish-outputs, before comment-outputs). Now 9 stages.
- run_platform.sh --deploy-uptime flag + automatic uptime deployment
after L2 module (separate state $WORK/uptime-tf). Endpoints from L2
outputs passed as monitored_endpoints. Feature flag from
inputs.uptime_enabled (default true).
- scripts/seed_uptime_monitors.py for post-deploy monitor seeding via
uptime-kuma API.
- Registered in registry.json (14 modules total).
Tests: +6 (312 -> 318). All pass.
2026-07-22 22:15:35 +00:00
8145eee8fc
feat(P32): deletion-protection-by-default + L2 feature flag (REQ-86, REQ-87)
...
---ci---
project: acdl
phase: 32
milestone: v1.8
status: execute
---/ci---
- All 11 L1 primitives now have deletion_protection NFR (boolean, default true).
- Adapter emits `lifecycle { prevent_destroy = true }` when NFR is true;
omits it when false. Default is true when NFR is absent.
- L2 composition resolver propagates inputs.deletion_protection to all
children NFRs. When false, all resources get deletion_protection=false.
- Stack schema updated with optional features object (deletion_protection,
uptime_enabled).
- Contract schema description updated to document deletion_protection
and uptime_enabled inputs.
Tests: +5 (307 -> 312). All pass.
2026-07-22 22:12:42 +00:00
de91a4bb76
feat(P31): encryption-by-default + per-stack CMK (REQ-83, REQ-84, REQ-85)
...
---ci---
project: acdl
phase: 31
milestone: v1.8
status: execute
---/ci---
- New kms-key L1 primitive (aws:kms:key) with enable_key_rotation=true
(AWS-managed annual rotation, D-075). Registered in registry.json.
- Adapter TYPE_MAP expanded for aws:kms:key + aws:kms:alias.
- Adapter emits enable_key_rotation from NFR.
- S3 adapter emits server_side_encryption_configuration with KMS when
kms_key_arn provided; managed KMS fallback with stderr warning when not.
- All 10 existing L1 primitives now have encryption_enabled NFR (default true).
- s3, rds, ecr, ecs-service, ecs-cluster have kms_key_arn input.
- Both L2 compositions (static-assets, microservice) now include a kms-key
child + wires connecting kms_key_arn to children.
- L2 stack outputs include kms_key_arn.
Tests: +7 (300 -> 307). All pass. run_platform.sh --check-only green
(static-assets now resolves to 5 resources with the CMK).
2026-07-22 22:11:03 +00:00
1e4133e11a
fix(P30): temp dir isolation + forge-agnostic APIs + static-key override (P1-8, P1-9, S1)
...
---ci---
project: acdl
phase: 30
milestone: v1.8
status: execute
---/ci---
P1-8: run_platform.sh now emits adapter output to $WORK/tf (per-run temp
dir), not the committed terraform/spike/ directory. The committed
terraform/spike/*.tf files are removed — they were scratch artifacts.
Deploy workflow artifact upload path updated to /tmp/acdl_platform_run_v18/tf/.
P1-9: contract_ingestor.py now reads GITHUB_API_BASE env for forge-agnostic
API URLs. _forge_type() detects GitHub vs Gitea. Search URL is branched
(GitHub uses /search/issues, Gitea uses /repos/{owner}/{repo}/issues).
S1: Deploy workflow configure-aws-credentials step restructured as a single
conditional step. OIDC when no static key (role-to-assume), static-key
when ACDL_AWS_ACCESS_KEY_ID present (access-key-id/secret-access-key inputs).
Both deploy workflows remain byte-identical.
Tests: +8 (292 -> 300). All pass. run_platform.sh --check-only green.
2026-07-22 22:08:23 +00:00
843cd17b97
fix(P29): SSM fail-loud without CMK + Terraform-rendered invoke policy (P1-3, P1-6)
...
---ci---
project: acdl
phase: 29
milestone: v1.8
status: execute
---/ci---
P1-3: SSM publisher now raises RuntimeError when ACDL_KMS_KEY_ID is
unset. ACDL_ALLOW_DEFAULT_KMS=1 escape hatch for local testing.
P1-6: consumer_invoke_policy.json now uses ${account_id} and ${region}
placeholders. Terraform renders them via data.aws_caller_identity +
data.aws_region + replace() at apply time. No more hardcoded 000000000000.
Tests: +7 (285 -> 292). All pass.
2026-07-22 22:05:40 +00:00
0eb578c606
fix(P28): WAF nested rules + default_action + resolver outputs (P1-4, P1-5, P1-7)
...
---ci---
project: acdl
phase: 28
milestone: v1.8
status: execute
---/ci---
P1-4: WAF custom rules now emit nested `rules { ... }` blocks per rule
instead of `rules = [...]` attribute syntax (invalid HCL).
P1-5: WAF default_action input is honored (allow/block) instead of
hardcoding `allow {}`. Default is `allow` when absent (backward compat).
P1-7: L2 composition outputs[] array is now processed by resolve_l2().
The resolver builds stack.outputs from the composition outputs wires.
The adapter emits `output` blocks from stack.outputs.
Tests: +10 (275 -> 285). All pass. run_platform.sh --check-only green.
2026-07-22 22:03:54 +00:00
045c7279aa
docs(P28-38): create 11 phase plans for v1.8
...
---ci---
project: acdl
phase: 28-38
milestone: v1.8
status: plan
---/ci---
11 phase plans created covering 24 requirements (REQ-76..99):
P28: adapter WAF + resolver outputs (P1-4,5,7)
P29: SSM KMS + invoke policy (P1-3,6)
P30: run-platform isolation + API portability + S1 (P1-8,9,S1)
P31: encryption-by-default + per-stack CMK
P32: deletion-protection-by-default + L2 feature flag
P33: uptime-kuma primitive + pipeline stage
P34: decommission alias + CMDB validation
P35: module engineering standards
P36: schemas/adapters/pipelines READMEs
P37: verify (4-layer)
P38: review-audit-complete
2026-07-22 22:02:09 +00:00
7f1eff622d
docs(P22-38): research findings + 6 phase plans
...
---ci---
project: acdl
phase: 22-38
milestone: v1.8
status: research
---/ci---
v1.8 research: 6 targets investigated + 5 decisions surfaced (D-073..D-077).
TARGET 1: uptime-kuma on ECS Fargate (image louislam/uptime-kuma:1,
port 3001, EFS volume, ALB, monitor seeding via post-deploy API script).
TARGET 2: Terraform prevent_destroy lifecycle (2-step decommission pattern).
TARGET 3: AWS KMS rotation (enable_key_rotation=true, annual AWS-managed;
90-day is roadmap item D-075).
TARGET 4: Forge-agnostic API URLs (GITHUB_API_BASE + _forge_type helper).
TARGET 5: DynamoDB as CMDB (acdl-change-requests table + validate_change_request).
TARGET 6: Module engineering standards scan (codified patterns from 12 modules).
PERSONAS.md updated for v1.8: lambda-engineer reactivated (D-068 CMDB +
D-065 API portability). 11 phase-specific overrides added.
2026-07-22 22:01:13 +00:00
60f2b669ea
docs(P0): clarify v1.8 — 12 decisions resolved
...
---ci---
project: acdl
phase: 0
milestone: v1.8
status: clarify
---/ci---
12 decisions resolved (D-061..D-072) at full autonomy:
- D-061: Fold all 3 new requirements into v1.8 (feature milestone)
- D-062: P1-3 SSM fail loud + escape hatch
- D-063: P1-6 Terraform-rendered invoke policy
- D-064: P1-8 Remove committed spike .tf files
- D-065: S1 Single conditional AWS credentials step
- D-066: Uptime on ECS Fargate
- D-067: Uptime as deploy-uptime pipeline stage, separate state
- D-068: CMDB = DynamoDB acdl-change-requests table
- D-069: Per-stack CMK (one key per L2 deployment)
- D-070: Decommission as mode on existing deploy pipeline, HITL SRE gates
- D-071: uses: ref bump @v1.6 -> @v1.8 at COMPLETE
- D-072: Managed KMS fallback for standalone L1s with warning
2026-07-22 21:59:45 +00:00
bab2cf363b
docs(init): validate v1.8 specification
...
---ci---
project: acdl
phase: 0
milestone: v1.8
status: specify
---/ci---
v1.8 specification validated. 11 phases (28-38), 24 new requirements
(REQ-76..99). Three tracks: P1 remediation (P1-3..P1-9 + S1), encryption
+ deletion protection by default + decommission alias, uptime monitoring
+ engineering standards + path documentation. Feature milestone, ship
tag v1.8.0.
2026-07-22 21:59:29 +00:00
e597c0b089
audit(v1.7): PASS — reconstruction + hygiene + discipline; temp dir name fixed
...
acdl-ci / Lint (push) Successful in 8s
acdl-ci / Test (push) Successful in 24s
acdl-ci / Platform check-only (offline) (push) Successful in 9s
---ci---
project: acdl
phase: 0
milestone: v1.7
status: audit
---/ci---
v1.7 audit: all checks pass.
Reconstruction: PASS — 122 ---ci--- blocks parsed; v1.7 state
(specify → clarify D-048..D-059 → research → execute P22-27 → complete
REQ-62..75 → verify) matches .ciagent/ files exactly.
.ciagent/ File Discipline: PASS — config.json valid, PROJECT.md has
all required sections + D-048..D-060, ROADMAP.md has 6 phases marked
complete, REQUIREMENTS.md traceability complete (14/14 v1.7 reqs),
ARCHITECTURE.md components match code, PERSONAS.md has lambda-engineer.
Branch Hygiene: 2 stale branches (phase/21-docs-restructure from v1.6,
milestone/v1.0-initial from v1.0) — non-blocking prior-milestone
artifacts. All v1.7 work committed directly to main (v1.1-v1.6 precedent).
Commit Discipline: PASS — 18/18 v1.7 commits have ---ci--- blocks.
0 unresolved escalations (2 prior audit commits have 'escalation' in
subject but are resolved audit actions).
Stale References: 0 stale references outside .ciagent/ (historical
narrative in .ciagent/ records pre-v1.6 dir structure acdl_platform/
modules-ir/ — these are verbatim historical records, not stale in v1.7
scope). Fixed 1 cosmetic temp dir name (acdl_platform_run →
acdl_platform_run_v17 in run_platform.sh).
Tests: 275 passed. CI pipeline green.
2026-07-22 21:26:40 +00:00
2e2064559a
verify(P22-27): code review — 1 P0 auto-fixed, 2 P1 security fixes, 2 P2 nits
...
acdl-ci / Lint (push) Successful in 8s
acdl-ci / Test (push) Successful in 25s
acdl-ci / Platform check-only (offline) (push) Successful in 10s
---ci---
project: acdl
phase: 22-27
milestone: v1.7
status: verify
lessons:
- P0 fix: run_platform.sh check-only assertions were hardcoded to static-assets; generalized for all contracts
- P1 fix: URL-encode contractId in GitHub issue search to prevent query injection
- P1 fix: validate consumerRepo format against invoking principal identity (P1-2)
- P2 fix: tagging-standard.json description referenced .yaml instead of .py
- P2 fix: removed unused graph_resource_name_utils import in acdl_tagging.py
---/ci---
Multi-persona code review of the v1.7 milestone (130 files, +5568/-353).
P0 (1, auto-fixed):
- run_platform.sh --check-only hardcoded static-assets assertions broke
for other contracts (microservice). Generalized to structural checks.
P1 security fixes applied (2 of 9):
- P1-1: URL-encode contractId in GitHub search query (injection prevention)
- P1-2: Validate consumerRepo format (org/repo) when caller identity present
P1 flagged for post-hoc (7):
- P1-3: SSM uses AWS-managed key, not platform CMK (ACDL_KMS_KEY_ID not set)
- P1-4: WAF custom rules emit invalid HCL (attribute vs block syntax)
- P1-5: WAF default_action input silently ignored (always emits allow {})
- P1-6: consumer_invoke_policy.json has placeholder account ID (needs substitution)
- P1-7: L2 composition outputs section not implemented in resolver
- P1-8: terraform/spike/*.tf overwritten by run_platform.sh (state contamination)
- P1-9: GitHub API URLs hardcoded (Gitea deployments silently fail)
P2 nits fixed (2 of 8):
- P2-2: tagging-standard.json description referenced .yaml instead of .py
- P2-3: unused graph_resource_name_utils import removed
Tests: 275 passed (was 272; +3 caller identity validation tests).
2026-07-22 21:09:52 +00:00
f2230edae0
fix(P26): generalize run_platform.sh check-only assertions for all contracts
...
The --check-only mode hardcoded static-assets-specific assertions
(stack name == 'static-assets', 'aws_s3_bucket' in main.tf, 'acdl-spike-bucket'
in main.tf). The platform-test.yml integration-test stage runs check-only for
every contracts/*.yaml, so contracts/microservice.yaml would fail the
AssertionError. Replace with generic structural checks valid for any contract.
verify(P0): code review — correctness
---ci---
phase: 26
milestone: v1.7
status: verify
lessons:
- P0 fix applied: run_platform.sh check-only hardcoded static-assets assertions broke for non-static-assets contracts (microservice); generalized to structural checks
---/ci---
2026-07-22 21:05:12 +00:00
0bee8f9bc2
docs(milestone): complete v1.7 — production platform + contract ingestion
...
---ci---
project: acdl
phase: 0
milestone: v1.7
status: complete
requirements:
covered: [REQ-62, REQ-63, REQ-64, REQ-65, REQ-66, REQ-67, REQ-68, REQ-69, REQ-70, REQ-71, REQ-72, REQ-73, REQ-74, REQ-75]
partial: []
---/ci---
v1.7 milestone COMPLETE. 6 phases (22-27), 14 requirements (REQ-62..REQ-75),
all shipped + verified. 272 tests pass. CI pipeline green.
Phase summary:
P22: rename static-asset -> static-assets (D-048) + cloudfront/waf
primitives + production stack (D-049) + @v1.6 bump (D-057).
P23: tagging standard (D-054, D-043 closure) + Wiz adapter (D-052) +
Kyverno adapter (D-053).
P24: platform Lambda + DynamoDB acdl-contracts (D-051) + cross-account IAM.
P25: deploy outputs SSM+PR comment (D-050) + error reporting via Lambda
(D-055) + stage comments.
P26: 3 platform pipelines (platform-test, primitives-plan, patterns-plan) +
release job (D-057) + multi-resource L1 ref fix.
P27: remove consumer-repos + validated per-module examples (D-058) +
RDS primitive (D-059).
Ship tag: v1.7.0 (feature milestone, next minor per ship.md;
v1.6 shipped v1.6.0).
2026-07-22 20:28:18 +00:00
Jon Chery