Commit Graph

3 Commits

Author SHA1 Message Date
Jon Chery 44d1d19cfd fix(P54): capability re-verification sweep — 16/16 Verified, 7 adapter defects fixed
The v1.1-v1.8 capability re-verification sweep (D-093) found and fixed
7 adapter defects in adapters/terraform/adapter.py that had prevented
the headline E2E from running against live AWS since the v1.7/v1.8
platform simplification. All 16 auto-verifiable capabilities are now
Verified.

Defects fixed in-sweep (D-090: no cap):
1. Duplicate output definitions (per-resource + stack-level both emitted).
2. Duplicate desired_count/launch_type on ECS service.
3. Duplicate target_type/family/load_balancer_type.
4. Missing assume_role_policy/role_name on IAM role (L2 composition gap).
5. Missing cidr_block/vpc_id/name defaults on VPC/subnet/route_table/
   ECS cluster/ECR repository.
6. ECR kms_key_arn unsupported arg -> encryption_configuration block.
7. CloudFront OAC + WAF deprecated arg names (AWS provider v5):
   signing_behavior, signing_protocol, origin_access_control_id,
   s3_origin_config.origin_access_identity, origin_id, rule (singular),
   scope=CLOUDFRONT (uppercase).

New live-AWS capability checks (CAP-013..CAP-016):
- terraform init+validate+plan live AWS (microservice): 14 resources, OK
- terraform init+validate+plan live AWS (static-assets): CloudFront+WAF+S3, OK
- DynamoDB outbox table: exists, 9 items
- S3 state bucket: exists, keys=[spike/l2-microservice/terraform.tfstate]

6 IAM-gated cloud resources (CAP-017..CAP-022: contracts table, Lambda,
ECS service, CloudFront stack, uptime-kuma, OIDC role) are documented
as escalated: the spike-runner lacks the IAM permissions to verify
them (chicken-and-egg). The terraform plan path proves the code would
deploy them; the local emulators prove the runtime behavior.

Verified: 513 fast tests pass. run_regression.sh reports 16/16
Verified (was 12; +4 live-AWS). terraform init+validate+plan succeeds
against live AWS for both contracts. No regressions.

---ci---
project: acdl
phase: 54
milestone: v1.10
status: verify
requirements:
  covered: [REQ-114]
  partial: []
decisions: [D-090, D-093]
regression:
  - { capability: CAP-013, status: Verified }
  - { capability: CAP-014, status: Verified }
  - { capability: CAP-015, status: Verified }
  - { capability: CAP-016, status: Verified }
---/ci---
2026-07-27 18:21:45 +00:00
Jon Chery 217653d6f4 feat(P53): local emulating adapters (D-092) — full local E2E, no AWS
The platform is now fully locally testable without cloud credentials.
The headline E2E (contract -> resolver -> adapter -> S3 state -> ECS
service -> DynamoDB outbox -> contract-ingestor Lambda) runs end-to-end
against the local emulating tier (D-092, REQ-113).

Four local emulating adapters in core/local_emulators.py:
- FlatFileOutbox: flat-file DynamoDB outbox emulator (hash-chained JSONL;
  resumable across instances; chain verification).
- LocalEcsEmulator: local ECS Fargate HTTP 200 emulator (free-port
  binding on 127.0.0.1; health check; clean destroy).
- LocalS3StateBackend: rewrites the terraform S3 backend to a local
  backend (per-stack tfstate in a temp folder).
- LocalLambdaStub: invokes the contract_ingestor handler in-process
  (patches _get_dynamodb / _get_secrets_client / urllib.urlopen;
  DynamoDB writes redirected to the FlatFileOutbox).

run_platform.sh gains a --local flag that short-circuits to the local
emulating tier (no AWS, no Checkov, no DynamoDB).

Regression gate (D-091) now covers 12 capabilities (was 10): +CAP-011
(local E2E microservice) + CAP-012 (local E2E static-assets).

Verified: 513 fast tests pass (was 502; +11 new). 2 slow local E2E
tests pass. run_regression.sh reports 12/12 Verified. run_platform.sh
--local exits 0 with LOCAL E2E OK. No AWS credentials required.

---ci---
project: acdl
phase: 53
milestone: v1.10
status: verify
requirements:
  covered: [REQ-113]
  partial: []
decisions: [D-092]
regression:
  - { capability: CAP-011, status: Verified }
  - { capability: CAP-012, status: Verified }
---/ci---
2026-07-27 17:39:33 +00:00
Jon Chery 9897df04b2 fix(P52): add regression-class VERIFY (D-091) — catches capability decay
The prior VERIFY stage was diff-scoped: it checked the phase diff only
and never re-ran underlying platform capability. This structural defect
(D-091) let 8 NFR-patch phases (v1.9.1-v1.9.8, deck rework) pass VERIFY
while the platform they described decayed underneath.

Phase 52 remediation:
- core/regression_verify.py: regression-class VERIFY with 10 seeded
  local-tier capability checks (CAP-001..CAP-010). Tags each
  Verified/Decayed/Broken; fails closed on any non-Verified.
- scripts/run_regression.sh: shell wrapper; writes
  .ciagent/REGRESSION_REPORT.{md,json}; exits non-zero on decay.
- tests/test_verify_regression_mode.py: 11 tests (8 fast + 3 slow).
  Confirms the gate catches decay (fails closed) and that regression
  mode is additive (diff-scoped VERIFY behavior preserved).
- pyproject.toml: slow marker registered; run_ci.sh excludes slow
  tests to avoid recursion.

Verified: 502 fast tests pass (was 493 at v1.9; +9 new). 3 slow
integration tests pass. run_regression.sh reports all 10 seeded
local-tier capabilities Verified against current code. The
decay-surfacing test injects a broken cloud-backed check and confirms
the run tags it Broken and fails closed.

Cloud-backed capability re-verification (live ECS, DynamoDB writes,
Lambda invocation) lands in Phase 54 (D-093).

---ci---
project: acdl
phase: 52
milestone: v1.10
status: verify
requirements:
  covered: [REQ-112]
  partial: []
decisions: [D-091]
regression:
  - { capability: CAP-001, status: Verified }
  - { capability: CAP-002, status: Verified }
  - { capability: CAP-003, status: Verified }
  - { capability: CAP-004, status: Verified }
  - { capability: CAP-005, status: Verified }
  - { capability: CAP-006, status: Verified }
  - { capability: CAP-007, status: Verified }
  - { capability: CAP-008, status: Verified }
  - { capability: CAP-009, status: Verified }
  - { capability: CAP-010, status: Verified }
---/ci---
2026-07-27 17:29:52 +00:00