 Jon Chery
|
3b1181f39b
|
Merge milestone/v1.14-refinement — v1.14 complete (NFR Refinement: bug fixes, security, stubs, tests, docs; 20 phases + final; tag v1.13.24)
acdl-ci / Lint (push) Successful in 10s
acdl-ci / Platform check-only (offline) (push) Successful in 25s
acdl-ci / Test (push) Successful in 6m34s
v1.14 NFR Refinement milestone complete. 20 execution phases (P1-P20) +
1 final (P21). All P1/P2 backlog from v1.11 review resolved. Security
posture hardened (swallowed errors, account ID externalized, IAM scoped,
schema validation, credential hygiene). Stubs resolved (kyverno --kube-
version removed). 7 untested scripts gained coverage. Documentation
synced (ARCHITECTURE v1.11-v1.14 addenda, stale @v1.6-1.9 -> @v1.13,
GRILL G-005/G-008 resolved, COST.md window extended, D-083 deferral
recorded). Platform VPC parameterized.
561 tests pass (was 528 at v1.13.2; +33). 22/22 capabilities Verified.
6 grill binding decisions (G-101..G-106) applied. 1 escalation (E-001)
auto-resolved at full autonomy (D-101).
---ci---
project: acdl
phase: 21
milestone: v1.14
status: complete
---/ci---
|
2026-07-29 21:36:37 +00:00 |
|
|
Jon Chery
|
1d5c4d2ae7
|
phase: 8, status: plan-as-execute, persona: platform-engineer+lead-developer, task: T-8.5..T-8.7
---ci---
project: acdl
phase: 8
milestone: v1.1
status: plan-as-execute
persona: platform-engineer+lead-developer
task: [T-8.5, T-8.6, T-8.7]
requirements.covered: [REQ-23]
---/ci---
Waves 3+4: rotation script + verify script + README + .gitignore.
- T-8.5 (platform): scripts/rotate_spike_key.sh - boto3 with bootstrap
root key from env (ACDL_BOOTSTRAP_AWS_*); creates new key for
acdl-spike-runner, deactivates+deletes old, writes new to gitignored
.env.secrets (chmod 600); idempotent (re-run ends with exactly 1
active key); optional Gitea secret upload if ACDL_GITEA_TOKEN set;
does NOT rotate the root key (D-034 closure = manual user step).
- T-8.6 (lead): scripts/verify_phase08.sh - loads rotated key from
.env.secrets, asserts caller identity is acdl-spike-runner (not root),
S3 bucket + DynamoDB table + IAM user + scoped policy with
DenyEverythingElse all present, .env.secrets + .bootstrap_state.json
gitignored. Uses heredoc python to avoid bash quoting issues.
- T-8.7 (lead): terraform/bootstrap/README.md runbook (6 steps incl.
manual D-034 root-key rotation) + .gitignore (.env.secrets +
.bootstrap_state.json). Spike vs v1.2 boundary table.
bash -n + gitignore checks pass.
|
2026-07-21 19:00:08 +00:00 |
|