---ci---
project: acdl
phase: 30
milestone: v1.8
status: execute
---/ci---
P1-8: run_platform.sh now emits adapter output to $WORK/tf (per-run temp
dir), not the committed terraform/spike/ directory. The committed
terraform/spike/*.tf files are removed — they were scratch artifacts.
Deploy workflow artifact upload path updated to /tmp/acdl_platform_run_v18/tf/.
P1-9: contract_ingestor.py now reads GITHUB_API_BASE env for forge-agnostic
API URLs. _forge_type() detects GitHub vs Gitea. Search URL is branched
(GitHub uses /search/issues, Gitea uses /repos/{owner}/{repo}/issues).
S1: Deploy workflow configure-aws-credentials step restructured as a single
conditional step. OIDC when no static key (role-to-assume), static-key
when ACDL_AWS_ACCESS_KEY_ID present (access-key-id/secret-access-key inputs).
Both deploy workflows remain byte-identical.
Tests: +8 (292 -> 300). All pass. run_platform.sh --check-only green.
---ci---
project: acdl
phase: 0
milestone: v1.7
status: audit
---/ci---
v1.7 audit: all checks pass.
Reconstruction: PASS — 122 ---ci--- blocks parsed; v1.7 state
(specify → clarify D-048..D-059 → research → execute P22-27 → complete
REQ-62..75 → verify) matches .ciagent/ files exactly.
.ciagent/ File Discipline: PASS — config.json valid, PROJECT.md has
all required sections + D-048..D-060, ROADMAP.md has 6 phases marked
complete, REQUIREMENTS.md traceability complete (14/14 v1.7 reqs),
ARCHITECTURE.md components match code, PERSONAS.md has lambda-engineer.
Branch Hygiene: 2 stale branches (phase/21-docs-restructure from v1.6,
milestone/v1.0-initial from v1.0) — non-blocking prior-milestone
artifacts. All v1.7 work committed directly to main (v1.1-v1.6 precedent).
Commit Discipline: PASS — 18/18 v1.7 commits have ---ci--- blocks.
0 unresolved escalations (2 prior audit commits have 'escalation' in
subject but are resolved audit actions).
Stale References: 0 stale references outside .ciagent/ (historical
narrative in .ciagent/ records pre-v1.6 dir structure acdl_platform/
modules-ir/ — these are verbatim historical records, not stale in v1.7
scope). Fixed 1 cosmetic temp dir name (acdl_platform_run →
acdl_platform_run_v17 in run_platform.sh).
Tests: 275 passed. CI pipeline green.
The --check-only mode hardcoded static-assets-specific assertions
(stack name == 'static-assets', 'aws_s3_bucket' in main.tf, 'acdl-spike-bucket'
in main.tf). The platform-test.yml integration-test stage runs check-only for
every contracts/*.yaml, so contracts/microservice.yaml would fail the
AssertionError. Replace with generic structural checks valid for any contract.
verify(P0): code review — correctness
---ci---
phase: 26
milestone: v1.7
status: verify
lessons:
- P0 fix applied: run_platform.sh check-only hardcoded static-assets assertions broke for non-static-assets contracts (microservice); generalized to structural checks
---/ci---
---ci---
project: acdl
phase: 21
milestone: v1.6
status: execute
---/ci---
Introduce platform-managed environments: a consumer does not provide an
AWS account, VPC, subnet, S3 state bucket, or runner key. A named
environment is a platform-owned bundle of account + network + state
backend + IAM role (surfaced via ABAC), selected by name in the contract.
Scaffold:
- core/environments/dev.json (sample dev env definition)
- core/environments/README.md (how envs are used + how to add one)
- core/environment_check.py (reads a contract's environment field,
looks up core/environments/<name>.json, prints a friendly onboarding
prompt when none exists, exits non-zero)
- scripts/run_platform.sh: Step 0 calls environment_check.py before
contract validation; a missing env halts the pipeline with the
onboarding prompt
- tests/test_environment_check.py: 12 tests (dev bound, missing env ->
onboarding prompt, onboarding message lists provisions, contract
paths, wire-in, check-only still passes)
Tests: 166 pass (154 + 12 new).
---ci---
project: acdl
phase: 21
milestone: v1.6
status: execute
---/ci---
Rename the acdl_platform/ package to core/ across the directory, all
imports in tests/scripts/pipelines/workflows, and doc references. The
package is imported as core.confidence_signal / core.contract_resolver /
core.outbox_writer. The deploy workflow's platform-repo checkout dir is
renamed acdl-platform/ -> platform/ (workspace path, not the python
package). Both .gitea + .github workflows stay byte-identical.
Note: the original target name 'platform/' shadows Python's stdlib
platform module (pytest's import uuid -> platform.system() fails when
the repo root is on sys.path, which every test does). 'core/' avoids
the clash while honoring the intent (drop the verbose acdl_platform).
Tests: 154 pass. run_ci.sh green.
The reusable deploy workflow invokes run_platform.sh from the CONSUMER
repo's workspace root with a relative contract path (e.g.
.acdl/contract.yaml). run_platform.sh does `cd "$ROOT"` (the platform
repo) early in its lifecycle, which caused the relative contract path to
resolve against the platform repo (acdl-platform/) instead of the
consumer repo — the `[ -f "$CONTRACT" ]` check then failed with
"contract file missing" and the pipeline could never run.
Fix: capture CALLER_CWD before `cd "$ROOT"` and resolve a caller-supplied
relative contract path against CALLER_CWD. The default contract
(contracts/static-asset.yaml, used only when no contract is supplied)
remains relative to ROOT, preserving platform-local CI behavior.
Reproduced pre-fix: bash acdl-platform/scripts/run_platform.sh --check-only
.acdl/contract.yaml (from a consumer workspace) -> "contract file missing".
Verified post-fix: same invocation reads the consumer contract correctly.
verify(P0): code review — correctness
---ci---
phase: 20
milestone: v1.5
status: verify
lessons:
- P0 fix applied: run_platform.sh now resolves relative contract path
against caller CWD (deploy workflow contract path was broken)
---/ci---
---ci---
project: acdl
phase: 19
milestone: v1.4
status: execute
---
Add declarative pipeline contract (schemas/pipeline.schema.json +
pipelines/ci.yaml) as single source of truth for both Gitea Actions (dev)
and GitHub Actions (production) workflows. Both workflow files are
byte-identical and validated against the contract by 32 new tests.
Add scripts/run_ci.sh for shell reproducibility — mirrors the CI pipeline
locally (lint → test → check-only), exits 0 with 'CI PIPELINE OK'.
Update scripts/run_platform.sh to stream output by default: terraform
init/validate/plan via tee, Checkov compliance results with per-record
severity/rule/pass-fail, and emitted Terraform in --check-only. New
--quiet flag for log-only mode.
Requirements: REQ-43 (central pipeline contract), REQ-44 (shell
reproducibility), REQ-45 (output streaming). 122 tests pass (90 + 32).
The L2 thin-composition layer (composition.json + contract_resolver.py +
contract schema + sample contracts) has been removed completely. The
implementation was unsatisfactory and is deferred for a later redesign.
- Delete: composition.json x2, contract_resolver.py, contracts/ x2,
contract.schema.json
- Patch: run_platform.sh now loads a pre-existing IR instance instead of
resolving a contract (the downstream adapter/checkov/confidence/outbox
pipeline is unchanged)
- Prune: L2 entries removed from registry.json (L1 entries unchanged)
- Rewrite: all 7 L1 module READMEs in plain language (no jargon), each
with Resources/Inputs/Outputs/Usage/Compliance-extension-points/Versioning
sections derived from interface.json
- Add: 2 L2 placeholder READMEs noting the composition is under redesign
- Add: modules-ir/README.md catalog index + README-TEMPLATE.md
---ci---
project: acdl
phase: 17
milestone: v1.3
status: execute
---/ci---
Jon Chery