Multi-persona review of the v1.10 milestone (6 commits, 23 files).
P0-1 (auto-fixed): TOCTOU race in LocalEcsEmulator.deploy() — opened a
socket to find a free port, closed it, then bound TCPServer to that
port. Between close and bind, another process could grab the port,
causing serve_forever to fail with OSError: Address already in use.
Fix: bind TCPServer directly to port 0 (OS assigns a free port
atomically); read the assigned port back from server_address[1].
P1-1 (auto-fixed, upgraded): run_local_e2e() called os.chdir() as a
side-effect without restoring the prior CWD. Fix: wrapped the body in
try/finally that restores prior_cwd on exit.
P2-1 (flagged): regression registry covers microservice + static-assets
but not uptime-kuma or RDS stacks. Recommend adding in a future patch.
P2-2 (flagged): _check_outbox_writer uses an f-string to embed a temp
path into a python3 -c command. Safe in practice but fragile by design.
Verified after fixes: 513 fast tests + 5 slow local E2E tests pass.
No regressions.
---ci---
project: acdl
phase: 0
milestone: v1.10
status: verify
lessons:
- P0 fix: TOCTOU race in LocalEcsEmulator.deploy() — bind to port 0
directly instead of open/close/rebind.
- P1 fix: os.chdir side-effect in run_local_e2e() — restore prior
CWD in a finally block.
- The regression registry should be expanded to cover all L2 stacks
(uptime-kuma, RDS) to prevent untested-stack regressions.
---/ci---
The platform is now fully locally testable without cloud credentials.
The headline E2E (contract -> resolver -> adapter -> S3 state -> ECS
service -> DynamoDB outbox -> contract-ingestor Lambda) runs end-to-end
against the local emulating tier (D-092, REQ-113).
Four local emulating adapters in core/local_emulators.py:
- FlatFileOutbox: flat-file DynamoDB outbox emulator (hash-chained JSONL;
resumable across instances; chain verification).
- LocalEcsEmulator: local ECS Fargate HTTP 200 emulator (free-port
binding on 127.0.0.1; health check; clean destroy).
- LocalS3StateBackend: rewrites the terraform S3 backend to a local
backend (per-stack tfstate in a temp folder).
- LocalLambdaStub: invokes the contract_ingestor handler in-process
(patches _get_dynamodb / _get_secrets_client / urllib.urlopen;
DynamoDB writes redirected to the FlatFileOutbox).
run_platform.sh gains a --local flag that short-circuits to the local
emulating tier (no AWS, no Checkov, no DynamoDB).
Regression gate (D-091) now covers 12 capabilities (was 10): +CAP-011
(local E2E microservice) + CAP-012 (local E2E static-assets).
Verified: 513 fast tests pass (was 502; +11 new). 2 slow local E2E
tests pass. run_regression.sh reports 12/12 Verified. run_platform.sh
--local exits 0 with LOCAL E2E OK. No AWS credentials required.
---ci---
project: acdl
phase: 53
milestone: v1.10
status: verify
requirements:
covered: [REQ-113]
partial: []
decisions: [D-092]
regression:
- { capability: CAP-011, status: Verified }
- { capability: CAP-012, status: Verified }
---/ci---
Jon Chery