9f94103c57
feat(P02 W0): dynamodb L1 primitive — interface, terraform, registry, tests (REQ-322)
...
New L1 module modules/l1/dynamodb/ (stack type aws:dynamodb:table).
Terraform aws_dynamodb_table with PK + optional SK, PAY_PER_REQUEST
default, SSE-KMS + PITR + prevent_destroy per v1.8 NFR defaults.
Registry entry (kind l1), catalog row, test_adapter.py updated to
15 entries / 13 L1. 45 tests passing.
---ci---
project: acdl
phase: 2
milestone: v1.26
status: execute
phase_role: execution
wave: 0
requirements: [REQ-322]
---/ci---
2026-08-18 00:22:19 +00:00
f83b974c0e
Merge milestone/v1.16-nova-simplification — v1.16 complete (Nova Simplification: 20-phase NFR sweep + final; tag v1.15.26)
acdl-ci / Lint (push) Successful in 11s
acdl-ci / Platform check-only (offline) (push) Successful in 29s
acdl-ci / Test (push) Failing after 7m25s
2026-08-01 13:37:18 +00:00
c80060878a
feat(P56b): author 11 L1 module terraform subdirs + fix adapter output format
...
EXECUTE stage. Authors the remaining 11 L1 module terraform subdirs with
the full versions/variables/locals/main/outputs split. Defaults previously
hardcoded in the adapter move into locals.tf.
Simple single-resource modules (7):
- kms-key: aws_kms_key + alias (enable_key_rotation, deletion_window defaults)
- ecr: aws_ecr_repository (encryption_configuration from kms_key_arn, image_scanning)
- ecs-cluster: aws_ecs_cluster (name default)
- iam-role: aws_iam_role + inline_policy (assume_role_policy fallback, ECR/logs policy in locals.tf)
- rds: aws_db_instance (storage_encrypted, multi_az, kms_key_arn defaults)
- waf: aws_wafv2_web_acl (default_action, visibility_config, dynamic rules)
- uptime: aws_ecs_task_definition + aws_ecs_service (Fargate compat, container_definitions in locals.tf)
Multi-resource modules with intra-refs (4):
- vpc: aws_vpc + aws_subnet + aws_internet_gateway + aws_route_table (CIDR derivation in locals.tf)
- ecs-service: aws_ecs_task_definition + aws_ecs_service (Fargate compat, container_definitions, network_config in locals.tf)
- alb: aws_lb + aws_lb_target_group + aws_lb_listener (subnet/security_group list derivation in locals.tf)
- cloudfront: aws_cloudfront_distribution + aws_cloudfront_origin_access_control (OAC defaults in locals.tf)
Registry: terraform_dir added to all 11 remaining entries.
Adapter fix: stack output format uses separate 'from' + 'output' fields
(not 'from': 'rid.output'). Fixed _emit_root_output to read both fields.
6 previously-skipped tests unblocked (run_platform.sh --check-only now
resolves static-assets.yml through the new module-assembled adapter).
Removed skip markers. Fixed test assertion (aws_s3_bucket → module).
Regression: 461 passed, 0 skipped, 5 deselected (slow). All 12 modules
pass run_primitive_plan.sh --check-only. All 12 terraform/ subdirs pass
terraform init + validate standalone.
---ci---
project: acdl
phase: P56b
milestone: v1.11
status: execute
---/ci---
2026-07-28 16:07:57 +00:00
a16e6f1bff
feat(P56a): stateless adapter rewrite + s3 reference terraform module
...
EXECUTE stage. Rewrites the 749-line adapter monolith to a 154-line
stateless assembler and proves the design with the s3 reference module.
Stateless adapter (adapters/terraform/adapter.py, 749 → 154 lines):
- Deleted TYPE_MAP, INPUT_MAP, OUTPUT_MAP (3 constant tables).
- Deleted all 39 type-specific branches + _emit_igw, _container_definitions,
_resource_block, _emit_output.
- New adapt(): reads registry.json → terraform_dir → emits root main.tf
with module-instantiation blocks (module "x" { source = ... }) + ref
wiring via module.<rid>.<output> interpolations + root outputs.
- The adapter owns NO resource shape, NO nested blocks, NO defaults, NO
type-specific logic. It only assembles module instantiations and wires refs.
s3 reference terraform module (modules/l1/s3/terraform/):
- versions.tf (required_version + aws ~> 5.0)
- variables.tf (bucket_name, region, kms_key_arn, tags)
- locals.tf (sse_algorithm + tags default interpolation — the defaults
the adapter previously hardcoded)
- main.tf (aws_s3_bucket + versioning + SSE config, referencing local.*)
- outputs.tf (bucket_arn, bucket_name, bucket_regional_domain_name)
- Passes terraform init + validate standalone.
Registry (modules/registry.json): s3 entry gains terraform_dir field.
STANDARDS.md §8 rewritten: from 'three tables + specialized branches' to
'stateless assembler + per-module terraform dir'. §9.4 checklist updated.
§9.1 required-files list updated to include terraform/ subdir.
tests/test_adapter.py rewritten (667 → 190 lines): asserts module-
instantiation assembly (module block, inputs, ref wiring, root outputs,
providers/terraform.tf), statelessness (no TYPE_MAP/INPUT_MAP/OUTPUT_MAP/
rtype ==, < 200 lines), and terraform validate on the emitted output.
Deleted test_p1_1_adapter_parameterization.py (tested the deleted HCL
string emission).
6 pipeline tests skipped (run_platform.sh --check-only defaults to
static-assets.yml which needs cloudfront/waf terraform dirs — P56b).
Regression: 455 passed, 6 skipped, 5 deselected (slow). run_primitive_plan
--check-only s3 exits 0.
---ci---
project: acdl
phase: P56a
milestone: v1.11
status: execute
---/ci---
2026-07-28 16:07:57 +00:00
491ba78768
feat(P33): uptime-kuma primitive + deploy-uptime pipeline stage (REQ-88..91)
...
---ci---
project: acdl
phase: 33
milestone: v1.8
status: execute
---/ci---
- New uptime L1 primitive (aws:ecs:uptime-service) deploying uptime-kuma
on ECS Fargate with feature_flag_enabled, monitored_endpoints,
static_checks, alert_channels (Teams/email/SMS/GitHub issues).
- Adapter emits ECS Fargate task + service when feature_flag_enabled=true;
emits nothing when false. Container image louislam/uptime-kuma:1.
- New deploy-uptime pipeline stage in pipelines/deploy.yaml (after
publish-outputs, before comment-outputs). Now 9 stages.
- run_platform.sh --deploy-uptime flag + automatic uptime deployment
after L2 module (separate state $WORK/uptime-tf). Endpoints from L2
outputs passed as monitored_endpoints. Feature flag from
inputs.uptime_enabled (default true).
- scripts/seed_uptime_monitors.py for post-deploy monitor seeding via
uptime-kuma API.
- Registered in registry.json (14 modules total).
Tests: +6 (312 -> 318). All pass.
2026-07-22 22:15:35 +00:00
de91a4bb76
feat(P31): encryption-by-default + per-stack CMK (REQ-83, REQ-84, REQ-85)
...
---ci---
project: acdl
phase: 31
milestone: v1.8
status: execute
---/ci---
- New kms-key L1 primitive (aws:kms:key) with enable_key_rotation=true
(AWS-managed annual rotation, D-075). Registered in registry.json.
- Adapter TYPE_MAP expanded for aws:kms:key + aws:kms:alias.
- Adapter emits enable_key_rotation from NFR.
- S3 adapter emits server_side_encryption_configuration with KMS when
kms_key_arn provided; managed KMS fallback with stderr warning when not.
- All 10 existing L1 primitives now have encryption_enabled NFR (default true).
- s3, rds, ecr, ecs-service, ecs-cluster have kms_key_arn input.
- Both L2 compositions (static-assets, microservice) now include a kms-key
child + wires connecting kms_key_arn to children.
- L2 stack outputs include kms_key_arn.
Tests: +7 (300 -> 307). All pass. run_platform.sh --check-only green
(static-assets now resolves to 5 resources with the CMK).
2026-07-22 22:11:03 +00:00
a9d8b31595
feat(P27): RDS primitive + adapter expansion (D-059)
...
Add modules/l1/rds/ with interface.json (engine enum for postgres, mysql,
mariadb, sqlserver, oracle), instance.json, README.md (full template with
compliance extension points). Register in registry.json. Expand the
adapter TYPE_MAP/INPUT_MAP/OUTPUT_MAP for aws:rds:instance -> aws_db_instance;
emit backup_retention_period, deletion_protection, storage_encrypted, and
skip_final_snapshot from NFRs/inputs. Add RDS to the primitives-plan matrix.
Update tests for the new registry entry count (12) + RDS adapter emission.
---ci---
project: acdl
phase: 27
milestone: v1.7
status: execute
---/ci---
2026-07-22 20:21:45 +00:00
dca35c78ec
feat(P22): rename static-asset→static-assets + cloudfront/waf primitives + production stack + @v1.6 bump
...
---ci---
phase: 22
title: rename-and-production-static-assets-stack
status: complete
verification:
- scripts/run_ci.sh: PASS (CI PIPELINE OK)
- python3 -m pytest tests/ -v: 175 passed
- scripts/run_platform.sh --check-only: PASS (PLATFORM CHECK OK)
- grep -R "static-asset[^s]" . (excl .git/): 0 hits
- grep -R "static-asset$" . (excl .git/): 0 hits
- floating git tags v1.6 + v1 point at v1.6.0 (a90a756
2026-07-22 19:56:52 +00:00
f68f85c9fd
review(v1.5): READY TO SHIP — multi-persona code review
...
acdl-ci / Lint (push) Successful in 7s
acdl-ci / Test (push) Successful in 15s
acdl-ci / Platform check-only (offline) (push) Successful in 9s
---ci---
project: acdl
phase: 20
milestone: v1.5
status: review
verdict: READY TO SHIP
p0: 1 (fixed — contract path resolution in deploy workflow)
p1: 6 (flagged post-hoc)
---/ci---
Multi-persona review of v1.5 phase 20 (docs + reusable deploy workflow).
P0 (blocking) — AUTO-FIXED:
- C1: scripts/run_platform.sh contract path resolution broken in deploy
workflow. The reusable workflow invokes run_platform.sh from the consumer
workspace root with a relative contract path (.acdl/contract.yaml), but
run_platform.sh does `cd "$ROOT"` (platform repo) early, so the relative
path resolved against the platform repo and the pipeline could never run.
Fix (commit 75c2274
2026-07-22 17:24:28 +00:00
895a2f3806
docs(P20): specify phase 20 — consumer happy path + reusable deploy workflow (v1.5)
...
---ci---
project: acdl
phase: 20
milestone: v1.5
status: specify
---/ci---
Add v1.5 milestone to ROADMAP.md + REQUIREMENTS.md. Phase 20 covers
REQ-46 (README consumer model + mermaid + L3B/spike scrub), REQ-47
(generic CONSUMER_GUIDE.md + versioned uses: + consumer-scoped prereqs
+ run-time platform fetch), REQ-48 (zero-trust OIDC/ABAC credentials +
static-key override + daily rotation), REQ-49 (reusable byte-identical
deploy.yml Gitea+GitHub implementing pipelines/deploy.yaml), REQ-50
(contracts/static-asset.yaml @v1.4), REQ-51 (deploy-workflow conformance
tests). Update config.json milestone to v1.5.
2026-07-22 17:09:23 +00:00
Jon Chery