---ci---
phase: 5
milestone: v1.0
status: verify
requirements:
covered: [REQ-13, REQ-14, REQ-15]
partial: []
lessons:
- Phase 05 dry-run = local bash simulation (scripts/run_demo.sh) because
no act_runner is registered. The simulation produces the same audit.json
shape a real pipeline run would, so the UI renders identically. A real
end-to-end run requires registering an act_runner (out-of-band Gitea UI).
- mock_executor.sh resolves modules/l2/<stack>/ relative to its cwd. The
dry-run script must cd to the repo root (or pass an absolute modules path)
before invoking it. Documented in ARCHITECTURE.md and verified by the
'no stray state.json in repo root' check.
- finalize_evidence.py --path flag lets the same helper upload both
audit.json (default --path=audit.json) and index.html (--path index.html)
to acdl-evidence. The --audit flag is the LOCAL file path; --path is the
REMOTE path. Confusing naming, kept for backward compatibility with Phase 04.
- innerHTML on escaped event data is XSS-safe because esc() escapes
& < > " — sufficient for body + attribute context. A static-analysis
'innerHTML' warning is a false positive when the input is escaped.
review:
p0: 0
p1: 0
---/ci---
Layer 1 STRUCTURAL: PASS (3/3 files; bash -n + py_compile + yaml load clean; no TODO/FIXME).
Layer 2 BEHAVIORAL: PASS (verify_phase05.sh 13/13 checks; 4 acts reproduce deterministically; 11 events; Act 4 rejection visible).
Layer 3 SECURITY: PASS (no secrets; UI uses esc() before innerHTML; hash chain is tamper-evident; no external resources).
Layer 4 QUALITY: PASS.
Requirements covered this phase: REQ-13 (raw URL 200 on audit.json + index.html), REQ-14 (vanilla-JS timeline UI), REQ-15 (4 acts reproduce deterministically). No partials.
The demo is live at:
https://git.cloudinit.dev/continuous-intelligence/acdl-evidence/raw/branch/main/index.html
---ci---
phase: 5
milestone: v1.0
status: clarify
decisions:
- id: D-031
decision: Phase 05 'dry run' = local bash script (scripts/run_demo.sh) simulating the full pipeline by calling core scripts + writing evidence + uploading audit.json to acdl-evidence. No act_runner (none registered). Exercises all 4 acts.
rationale: spec says '4 scripted acts reproduce deterministically'; without a runner, the bash simulation IS the deterministic reproduction
confidence: 0.85
alternatives: [register an act_runner (out-of-band Gitea UI; not available in this env), skip the dry run and only build the UI]
- id: D-032
decision: index.html committed to acdl repo at evidence-ui/index.html; pushed to acdl-evidence main by run_demo.sh alongside audit.json. Single file, inline CSS+JS, vanilla JS per REQ-14. Fetches ./audit.json (relative).
rationale: D-012 raw-URL approach; vanilla JS per REQ-14; single file for simplicity; relative URL avoids hardcoding host
confidence: 0.90
alternatives: [separate JS/CSS files, hardcoded absolute URL]
- id: D-033
decision: audit.json raw URL on acdl-evidence main is the single source of truth. run_demo.sh writes final audit.json + final index.html in two API calls. Idempotent. UI fetch URL is relative ./audit.json.
rationale: D-012 + D-029; relative URL avoids hardcoding
confidence: 0.90
alternatives: [per-act audit files, absolute URL]
---/ci---
Phase 05 main ambiguity: no act_runner available, so 'dry run' cannot
mean a real Gitea Actions run. Three decisions logged: D-031 dry-run =
local bash simulation covering all 4 acts; D-032 index.html is single-file
vanilla JS at evidence-ui/, pushed to acdl-evidence alongside audit.json;
D-033 audit.json is the single source of truth, idempotent re-run, UI
fetches ./audit.json relatively.
---ci---
phase: 1
milestone: v1.0
status: research
research:
gitea_capabilities:
pages: not_supported
environments_api: not_supported
repository_dispatch: not_supported
workflow_call: supported
workflow_dispatch: supported
issues_opened: supported
workarounds:
- D-012 raw file URLs in place of Pages
- D-013 workflow_dispatch approval inputs in place of environments
- D-014 workflow_dispatch API in place of repository_dispatch
verification_toolchain:
typecheck: bash -n + python -m py_compile (no package.json)
test: per-phase scripts/verify_phaseNN.sh
build: no-op
---/ci---
ARCHITECTURE.md gains a Gitea API surface table and a branch-pinning rule.
PERSONAS.md is the canonical project-level persona roster: lead-developer
and backend-engineer always active; infra-stub-engineer custom persona owns
L1 stubs; data-engineer deactivated (no DB); frontend-engineer deactivated
until Phase 05.
---ci---
phase: 1
milestone: v1.0
status: clarify
decisions:
- id: D-011
decision: Single-project mode explicitly enforced via config.json mode=single
rationale: run.md Step 0 reads projects[] length as multi-project trigger; explicit flag disambiguates from D-010
confidence: 0.95
alternatives: [move acdl into .ciagent/acdl/ subdirectory and adopt multi-project paths]
- id: D-012
decision: Gitea has no native Pages; serve acdl-evidence via raw file URLs + CORS note
rationale: Research confirms Gitea has no [pages] section; raw URLs work without server config
confidence: 0.85
alternatives: [sidecar static server, external Pages host]
- id: D-013
decision: QA/Prod gates modeled as workflow_dispatch approval inputs (D-004 fallback) instead of Gitea environments
rationale: Research confirms Gitea ignores environment: blocks and exposes no environments API
confidence: 0.90
alternatives: [external approval bot, drop approval gates entirely]
- id: D-014
decision: Cross-repo triggering uses workflow_dispatch API from inside a step (no repository_dispatch)
rationale: Gitea Actions does not support repository_dispatch
confidence: 0.85
alternatives: [push-based trigger with a sentinel file, polling]
- id: D-015
decision: New repos acdl-contracts and acdl-evidence use default_branch=main with auto_init=true
rationale: Matches Gitea DEFAULT_BRANCH=main; required for the default branch to exist before any push
confidence: 0.95
alternatives: [use milestone/v1.0-initial as default_branch]
- id: D-016
decision: Pages placeholder for Phase 01 is a minimal HTML stub; full timeline UI deferred to Phase 05
rationale: Phase 01 success criterion is the URL returns 200 with placeholder; full UI is Phase 05
confidence: 0.90
alternatives: [build a minimal timeline now]
---/ci---
Clarifications accepted at full autonomy per clarify.md Step 4. Three requirements
re-stated: REQ-09 (new repos default_branch=main), REQ-10 Pages (raw-URL 200
substitute), REQ-10 environments (workflow_dispatch inputs + qa/prod branches).
See .ciagent/REQUIREMENTS.md Clarifications table.
---ci---
phase: 0
milestone: v1.0
status: specify
security:
- id: SEC-001
type: info_disclosure
disposition: mitigated
summary: Literal API token was committed in config.json gitea.api_token_env field
fix: Replaced literal with env var name 'ACDL_GITEA_TOKEN'; token supplied via shell env at runtime
severity: high
stride: Information Disclosure
---/ci---
The 40-char value previously stored in .ciagent/config.json was a live Gitea
API token. Per the spec constraint 'no secrets in repo', the field now holds
an env var name. The token itself is exported in the shell session at runtime
and is never written to disk. Treat the prior value as already-leaked and
rotate it via the Gitea UI before any external disclosure.
Jon Chery
grimacing