---ci---
project: acdl
phase: 10
milestone: v1.1
status: plan-as-execute
persona: platform-engineer
task: [T-10.1, T-10.2, T-10.3, T-10.6]
requirements.covered: [REQ-25]
---/ci---
Wave 1: L2 thin-composition + registry extension + adapter L2 handling.
- T-10.1: modules-ir/l2/l2-static-asset/composition.json (kind=l2, depth=1,
one child l1-s3@1.0.0, wires passthrough).
- T-10.2: modules-ir/registry.json extended with l2-static-asset@1.0.0.
- T-10.3: modules-ir/l2/l2-static-asset/README.md (D-P10-1 doc).
- T-10.6: adapters/terraform/adapter.py - backend key now derived from
the stack name (spike/<stack_name>/terraform.tfstate). The resources
array handling is unchanged; a resolved L2 IR instance has the L1
resource as resources[0], so the existing TYPE_MAP + resource emission
handle it (the adapter is shape-driven, not kind-driven).
---ci---
project: acdl
phase: 9
milestone: v1.1
status: plan-as-execute
persona: platform-engineer
task: [T-9.5, T-9.6, T-9.7, T-9.9]
requirements.covered: [REQ-26]
---/ci---
Waves 2+3: Terraform adapter + generated spike TF + run script.
- T-9.5: adapters/terraform/adapter.py - compiles an IR instance to a
Terraform root module. TYPE_MAP {aws:s3:bucket -> aws_s3_bucket}. Thin
layer; does not own L1 content. Emits main.tf (resource + outputs) +
terraform.tf (required_version/providers + S3 backend, NO
dynamodb_table per D-P09-1) + providers.tf (aws provider region from
the IR). CLI: adapter.py <ir_instance.json> <out_dir>.
- T-9.6: terraform/spike/{main.tf,terraform.tf,providers.tf} - generated
by running the adapter against modules-ir/l1/l1-s3/spike_instance.json.
Committed so verify_phase09.sh can validate/plan without regenerating
(D-P09-4); the verify script will regenerate + diff to prove
reproducibility.
- T-9.7: scripts/run_spike_plan.sh - loads rotated spike key from
gitignored .env.secrets, exports AWS env vars, cd terraform/spike,
terraform init -lock=false, terraform validate, terraform plan
-lock=false -out=tfplan. Plan-only; no apply.
- T-9.9: .gitignore - add terraform/spike/.terraform/ + tfplan +
*.tfstate*.
EXECUTE: ran scripts/run_spike_plan.sh against real AWS via the rotated
spike key (D-039). terraform plan succeeded: 1 to add (the S3 bucket),
outputs computed. One non-blocking deprecation warning (aws_s3_bucket
versioning block -> use aws_s3_bucket_versioning in v1.2). No long-lived
credential in the workflow (key loaded from .env.secrets at runtime).
Jon Chery