continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity
267 Commits 1 Branch 190 Tags
3e11b0fafd35d276cfb89a722391e2147e4bdd05
Commit Graph

19 Commits

Author SHA1 Message Date
Jon Chery a6e306a904 docs(init): validate v1.11 RESTART specification 
SPECIFY stage. v1.11 — RESTART: stateless adapter + pipeline-driven
module lifecycle testing. Branches off v1.10.2 (clean); abandons the
failed first attempt (phase/56-iam-re-bootstrap + phase/57-live-deploy-
microservice, which produced 4 drifted VPCs, ran terraform apply from
Python, and had no module lifecycle tests).

Three corrections:
1. Stateless adapter — adapter.py (918 lines, 3 constant tables, 39
   type-specific branches) → ~80-line assembler; each L1 ships a real
   terraform/ module dir (variables/locals/main/outputs) owning its
   resource shape, nested blocks, defaults.
2. Terraform owns lifecycle — run_platform.sh gains --apply/--destroy;
   Python never runs terraform; verify_deploy_microservice.py deleted.
3. Pipeline-driven testing — modules-lifecycle pipeline (Gitea + GitHub,
   byte-identical) matrix-runs each L1 examples/{simple,complex}.yml
   through apply→modify→destroy; no per-module Python.

Single platform VPC (terraform/platform owns ONE VPC; microservice
references it via data source). Deterministic env-aware state keys
(spike/{id}/{env}/terraform.tfstate, stable across lifecycle).

13 phases (P56a–P65). 6 new requirements (REQ-123..128) + 6 carried
(REQ-116,118,119,120,121,122). Feature milestone → v1.11.0.

---ci---
project: acdl
phase: 0
milestone: v1.11
status: specify
---/ci---
 2026-07-28 16:07:57 +00:00
Jon Chery 2697775470 docs(milestone): complete v1.10 — pipeline regression fix + capability re-verification 
v1.10 milestone COMPLETE. 4 phases (52-55) shipped + verified:
- P52: regression-class VERIFY (D-091) — catches capability decay
- P53: local emulating adapters (D-092) — full local E2E, no AWS
- P54: capability re-verification sweep (D-093) — 16/16 Verified, 7 adapter defects fixed
- P55: rewrite PROJECT/ROADMAP/decks to verified reality (D-094)

Review: READY TO SHIP (0 P0, 0 P1, 1 P2 post-hoc).
Audit: PASS (reconstruction, file discipline, branch hygiene, commit discipline).
Regression gate: 16/16 capabilities Verified (12 local + 4 live-AWS).
Tests: 513 fast + 5 slow, all pass.

Tag v1.10.0 (next minor; fix/test/docs, not a breaking schema change).

---ci---
project: acdl
phase: 0
milestone: v1.10
status: complete
requirements:
  covered: [REQ-112, REQ-113, REQ-114, REQ-115]
  partial: []
---/ci---
 2026-07-27 18:29:33 +00:00
Jon Chery 772ac721b0 docs(P52): create v1.10 milestone plan — pipeline regression fix + capability re-verification 
---ci---
project: acdl
phase: 52
milestone: v1.10
status: plan
decisions: [D-090, D-091, D-092, D-093, D-094]
requirements: [REQ-112, REQ-113, REQ-114, REQ-115]
---/ci---
 2026-07-27 17:10:09 +00:00
Jon Chery 5365bb4e0a docs(milestone): complete v1.9 — verify + review + audit + tag v1.9.0 
---ci---
project: acdl
phase: 0
milestone: v1.9
status: complete
requirements:
  covered: [REQ-100, REQ-101, REQ-102, REQ-103, REQ-104, REQ-105, REQ-106, REQ-107, REQ-108, REQ-109, REQ-110, REQ-111]
  partial: []
---/ci---

v1.9 milestone COMPLETE. All 12 requirements satisfied.

Verify: 4 layers PASS (structural 26/26 files, behavioral 493 tests +
run_ci.sh + run_platform.sh --check-only green, security, quality).
Review: 0 P0, 0 P1 (READY TO SHIP). REVIEW.md reconstructed (D-086).
Audit: PASS (reconstruction, file discipline, branch hygiene, commit
discipline — 12/12 commits with ---ci--- blocks).

Updated:
- .ciagent/REQUIREMENTS.md: v1.9 section marked complete; traceability
  table REQ-100..111 added.
- .ciagent/ROADMAP.md: v1.9 marked complete; Phase 43 added.
- .ciagent/PROJECT.md: v1.9 objective marked complete.
- .ciagent/config.json: milestone v1.9 status -> complete.
- .ciagent/REVIEW.md: reconstructed with v1.9 content (D-086).
- .ciagent/VERIFY.md: v1.9 4-layer verify.
- .ciagent/AUDIT.md: v1.9 audit (PASS).
- uses:/ref: bumped @v1.6 -> @v1.9 in contracts/, deploy workflows,
  docs/consumer-guide.md (D-071 successor).

Tag v1.9.0 created next; floating v1.9 + v1 tags updated.
 2026-07-23 04:46:04 +00:00
Jon Chery 136ec6abf3 docs(init): validate v1.9 specification 
---ci---
project: acdl
phase: 0
milestone: v1.9
status: specify
---/ci---

v1.9 scope (user-directed, 2026-07-23):
- Design doc refresh (hitl_matrix_design.md + audit_ledger_design.md)
- Contract interpolation (${env.<field>} + ${contract.<field>})
- Per-environment CI jobs (no environment field editing for promotion)
- Stub implementation (SoD, HITL gates, attestation matrix, Wiz, Kyverno)
- P1-1 adapter parameterization remediation

Requirements REQ-100..REQ-111 added to REQUIREMENTS.md.
PROJECT.md v1.9 objective + phase table (39-43) appended.
config.json milestone bumped to v1.9 (active).
 2026-07-23 04:15:41 +00:00
Jon Chery c99da9a58c docs(milestone): complete v1.8 — P1 remediation + uptime + standards + encryption + decommission + docs 
---ci---
project: acdl
phase: 0
milestone: v1.8
status: complete
requirements:
  covered: [REQ-76, REQ-77, REQ-78, REQ-79, REQ-80, REQ-81, REQ-82, REQ-83, REQ-84, REQ-85, REQ-86, REQ-87, REQ-88, REQ-89, REQ-90, REQ-91, REQ-92, REQ-93, REQ-94, REQ-95, REQ-96, REQ-97, REQ-98, REQ-99]
  partial: []
---/ci---

v1.8 milestone complete. 11 phases (28-38), 24 requirements (REQ-76..99).

Track 1 — P1 Remediation (8 issues, all resolved):
- P1-3: SSM fail-loud without CMK + escape hatch
- P1-4: WAF custom rules emit nested HCL blocks
- P1-5: WAF default_action input honored
- P1-6: Terraform-rendered invoke policy (no placeholder account ID)
- P1-7: L2 composition outputs resolved + adapter output blocks
- P1-8: Per-run temp dir (terraform/spike removed)
- P1-9: Forge-agnostic API URLs (GITHUB_API_BASE)
- S1: Static-key override wired to configure-aws-credentials inputs

Track 2 — Encryption + Deletion Protection by Default:
- Per-stack CMK (kms-key primitive, 90-day rotation, no shared keys)
- All 12 primitives have encryption_enabled NFR + kms_key_arn input
- L2 modules wire per-stack CMK to all children
- All 12 primitives have deletion_protection NFR (default true)
- Adapter emits lifecycle { prevent_destroy = true }
- L2 feature flag propagation (inputs.deletion_protection)

Track 3 — Uptime + Standards + Docs:
- uptime-kuma primitive (ECS Fargate, feature flag, alert channels)
- deploy-uptime pipeline stage (separate state)
- Decommission mode (2-step HITL SRE gates + CMDB validation)
- modules/STANDARDS.md (L1+L2 authoring + review standards)
- schemas/README.md, pipelines/README.md, adapters/README.md

Tests: 275 -> 350 (+75 new). All pass. run_ci.sh + check-only green.
Zero pending P1 issues remaining.
 2026-07-22 22:24:15 +00:00
Jon Chery bab2cf363b docs(init): validate v1.8 specification 
---ci---
project: acdl
phase: 0
milestone: v1.8
status: specify
---/ci---

v1.8 specification validated. 11 phases (28-38), 24 new requirements
(REQ-76..99). Three tracks: P1 remediation (P1-3..P1-9 + S1), encryption
+ deletion protection by default + decommission alias, uptime monitoring
+ engineering standards + path documentation. Feature milestone, ship
tag v1.8.0.
 2026-07-22 21:59:29 +00:00
Jon Chery fee59944fd docs(init): validate v1.7 specification 
---ci---
project: acdl
phase: 0
milestone: v1.7
status: specify
---/ci---

v1.7 milestone: production platform + contract ingestion + pipeline
maturation. 12 user-directed scope axes (2026-07-22):
  1. rename static-asset -> static-assets (D-048)
  2. production-ready static-assets stack (cloudfront + waf, D-049)
  3. DX-friendly deploy outputs (SSM + PR comment, D-050)
  4. central pipeline error reporting via Lambda (D-055)
  5. PR comments after every successful stage
  6. three platform pipelines (platform-test, primitives-plan, patterns-plan)
  7. release job with semver + MAJOR.MINOR/MAJOR tag updates (D-057)
  8. platform Lambda + DynamoDB contract ingestion (D-051)
  9. tagging standards (Checkov custom rule, D-054, D-043 closure)
  10. Wiz adapter (D-052)
  11. Kyverno adapter (D-053)
  12. remove consumer-repos + validated per-module examples (D-058) + RDS
      primitive (D-059)

6 phases (22-27), 14 requirements (REQ-62..REQ-75).
Ship tag: v1.7.0 (feature milestone, next minor; v1.6 shipped v1.6.0).
 2026-07-22 19:47:08 +00:00
Jon Chery c5745de37c docs(P21): specify phase 21 — consumer-facing docs restructure (v1.6) 
---ci---
project: acdl
phase: 21
milestone: v1.6
status: specify
---/ci---

Add v1.6 milestone to ROADMAP.md + REQUIREMENTS.md. Phase 21 covers
REQ-52 (scrub .ciagent/.gitea from consumer docs), REQ-53 (rename
acdl_platform -> platform), REQ-54 (docs/ Jekyll Pages restructure),
REQ-55 (L2->modules, L1->primitives, composition->pattern prose),
REQ-56 (forge->platform runners), REQ-57 (README repository roles
restated), REQ-58 (Features + Roadmap), REQ-59 (mermaid fix +
security-checks + infrastructure-apply), REQ-60 (credentials minus
go-gitea/waivers), REQ-61 (environments concept + onboarding scaffold).
Update config.json milestone to v1.6.
 2026-07-22 18:17:28 +00:00
Jon Chery 895a2f3806 docs(P20): specify phase 20 — consumer happy path + reusable deploy workflow (v1.5) 
---ci---
project: acdl
phase: 20
milestone: v1.5
status: specify
---/ci---

Add v1.5 milestone to ROADMAP.md + REQUIREMENTS.md. Phase 20 covers
REQ-46 (README consumer model + mermaid + L3B/spike scrub), REQ-47
(generic CONSUMER_GUIDE.md + versioned uses: + consumer-scoped prereqs
+ run-time platform fetch), REQ-48 (zero-trust OIDC/ABAC credentials +
static-key override + daily rotation), REQ-49 (reusable byte-identical
deploy.yml Gitea+GitHub implementing pipelines/deploy.yaml), REQ-50
(contracts/static-asset.yaml @v1.4), REQ-51 (deploy-workflow conformance
tests). Update config.json milestone to v1.5.
 2026-07-22 17:09:23 +00:00
Jon Chery e050e65158 feat(P19): central pipeline contract + shell reproducibility + output streaming (v1.4.1)
acdl-ci / Lint (push) Successful in 8s
Details
acdl-ci / Test (push) Successful in 14s
Details
acdl-ci / Platform check-only (offline) (push) Successful in 9s
Details 
---ci---
project: acdl
phase: 19
milestone: v1.4
status: execute
---

Add declarative pipeline contract (schemas/pipeline.schema.json +
pipelines/ci.yaml) as single source of truth for both Gitea Actions (dev)
and GitHub Actions (production) workflows. Both workflow files are
byte-identical and validated against the contract by 32 new tests.

Add scripts/run_ci.sh for shell reproducibility — mirrors the CI pipeline
locally (lint → test → check-only), exits 0 with 'CI PIPELINE OK'.

Update scripts/run_platform.sh to stream output by default: terraform
init/validate/plan via tee, Checkov compliance results with per-record
severity/rule/pass-fail, and emitted Terraform in --check-only. New
--quiet flag for log-only mode.

Requirements: REQ-43 (central pipeline contract), REQ-44 (shell
reproducibility), REQ-45 (output streaming). 122 tests pass (90 + 32).
 2026-07-22 15:10:54 +00:00
Jon Chery ae86a29a5e docs(P17): specify phase 17 — remove thin-composition + module READMEs (v1.3.1) 
Add v1.3 milestone to ROADMAP.md and REQUIREMENTS.md. Phase 17 covers
REQ-36 (thin-composition removal), REQ-37 (README template), REQ-38
(per-module READMEs + catalog). Update config.json milestone to v1.3.

---ci---
project: acdl
phase: 17
milestone: v1.3
status: specify
---/ci---
 2026-07-22 13:57:25 +00:00
Jon Chery 0fc69b4d0c docs(milestone): complete v1.2 — platform hardening + ECS microservice 
---ci---
project: acdl
phase: 0
milestone: v1.2
status: complete
requirements:
  covered: [REQ-29, REQ-30, REQ-31, REQ-32, REQ-34]
  partial: [REQ-33, REQ-35]
---/ci---

v1.2 milestone COMPLETE. All 6 phases shipped (v1.2.1..v1.2.6) + verified.
- v1.2.1 research + README (REQ-29)
- v1.2.2 NFR harden + simplify (REQ-30)
- v1.2.3 6 ECS L1s + adapter (REQ-31)
- v1.2.4 l2-microservice + contract schema + resolver (REQ-32)
- v1.2.5 consumer repo + terraform apply PARTIAL (REQ-34 complete, REQ-33 partial IAM-blocked)
- v1.2.6 capstone e2e (REQ-35 partial IAM-blocked)

Review: READY TO SHIP (1 P0 operator action, 1 P1 deferred to v1.3).
Ship: v1.3.0 (feature milestone, next minor — v1.1 shipped v1.2.0).
Audit: CLEAN (0 P0 code issues, 1 P1 post-hoc).

Operator action (P0-IAM): push spike_runner_policy.json to live AWS via
create_iam_user.py, then terraform apply (13 to add) -> live ECS service.
Gitea release v1.3.0: tag pushed; release creation blocked by missing
ACDL_GITEA_TOKEN (documented manual step).
 2026-07-21 22:27:27 +00:00
Jon Chery 9504782a77 docs(specify): open v1.2 milestone — platform hardening + ECS microservice 
---ci---
project: acdl
phase: 0
milestone: v1.2
status: specify
decisions:
  - id: D-047
    decision: Extend D-039 per-run-rotated-key waiver for v1.2; real OIDC deferred to v1.3+
    rationale: go-gitea/gitea#36988 still open (re-checked 2026-07-21, last updated 2026-05-27, not merged)
    confidence: 0.95
    alternatives: []
---/ci---

Open the v1.2 milestone: platform hardening + first real consumer deployment.
5 scope axes (user-directed): re-eval #36988, NFR improvements, simplify
the setup, README rewrite, bootstrap a consumer repo with a basic
microservice deployed to ECS Fargate end-to-end.

Files:
- config.json: milestone v1.1 -> v1.2, status complete -> specify
- PROJECT.md: v1.1 objective -> prior (complete); new v1.2 objective +
  6-phase table (11-16) + REQ-29..35 summary + D-047
- REQUIREMENTS.md: v1.1 -> prior (complete); new v1.2 section with
  REQ-29..35 + traceability (planned)
- ROADMAP.md: v1.1 -> complete (tag v1.2.0, Gitea release 202); new v1.2
  section with 6 phases (status planned, ship v1.3.0)
- ARCHITECTURE.md: new "v1.2 build-out scope" section (5 axes, substrate
  extension, terraform apply dev-only, out-of-scope deferrals) + build
  order

Ship tag at milestone COMPLETE: v1.3.0 (feature milestone, next minor
per ship.md — v1.1 shipped v1.2.0). Phase patches v1.2.1..v1.2.6.
 2026-07-21 20:54:55 +00:00
Jon Chery ab69d1069f docs(milestone): v1.1 complete - audit hygiene fixes (P1-A/B/D) 
---ci---
project: acdl
phase: 0
milestone: v1.1
status: complete
audit_hygiene:
  - P1-A: config.json status specify -> complete
  - P1-B: PERSONAS.md 6 stale platform/ territory paths -> acdl_platform/
  - P1-D: ROADMAP.md audit pending -> audit CLEAN
---/ci---

v1.1 milestone COMPLETE + audit CLEAN. Applied 3 audit-hygiene fixes
(P1-A/B/D from AUDIT.md):
- config.json: status specify -> complete (milestone shipped).
- PERSONAS.md: 6 territory paths + 1 verification toolchain command
  updated platform/ -> acdl_platform/ (the Phase 08 prep rename).
- ROADMAP.md: audit pending -> audit CLEAN.

Remaining post-hoc P1s (non-blocking, v1.2 cleanup):
- P1-1: redact two AWS access key IDs in .ciagent/VERIFY.md Phase 09
  narrative (public identifiers, not secret pairs).
- P1-C: document v1.1.0 tag-placement guidance in run.md (the tag is on
  the v1.0 Phase 05 traceability commit, causing 3 pre-specify no-ci
  commits to fall in the v1.1.0..HEAD range).
 2026-07-21 19:49:39 +00:00
Jon Chery 288607b3fa docs(specify): ingest docs/vision+architecture; reframe .ciagent for v1.1 
---ci---
project: acdl
phase: 0
milestone: v1.1
status: specify
decisions:
  - D-034 temporary long-lived AWS key waiver (used once in Phase 08, rotated)
  - D-035 milestone v1.1 (feature), ship tag v1.2.0
  - D-036 spike picks l1-s3 + l2-static-asset
  - D-037 demo archived to demo/
  - D-038 open decisions resolved (accept recommendations + decide rest)
---/ci---

Ingest docs/vision.md (6 tenets, anti-goals, signals of success) and
docs/architecture.md v0.2 (4 layers + 6 cross-cutting concerns incl. the
substrate abstraction) as the source of truth for why/how. Reframe the
project from the v1.0 stub demo (tag v1.1.0, archived to demo/ in Phase 06)
to the real Agentic Cloud Delivery Platform.

- config.json: milestone v1.1, status specify
- PROJECT.md: vision + 4-layer/6-concern model + 11 open-decision
  resolutions (W1.A/B, W2.A, BA.A accepted; W3.D/E, BA.B-F, OpenTofu
  decided) + D-034..D-038
- ARCHITECTURE.md: target architecture (IR, confidence, ledger, HITL, SoD,
  substrate abstraction) + v1.1 spike scope (l1-s3 + l2-static-asset)
- REQUIREMENTS.md: add REQ-16..REQ-28 + traceability
- ROADMAP.md: add v1.1 Phases 06-10 (archive, arch-finalize, OIDC, IR+L1,
  L2+contract-e2e)
- PERSONAS.md: add platform-engineer + security-engineer (custom),
  retire infra-stub-engineer, update territories + verification toolchain
  (terraform validate + jsonschema)
- PLAN.md: v1.1 specify plan
 2026-07-21 17:55:09 +00:00
Jon Chery e5f5604319 decision(P01): clarification — project mode, pages fallback, env gates 
---ci---
phase: 1
milestone: v1.0
status: clarify
decisions:
  - id: D-011
    decision: Single-project mode explicitly enforced via config.json mode=single
    rationale: run.md Step 0 reads projects[] length as multi-project trigger; explicit flag disambiguates from D-010
    confidence: 0.95
    alternatives: [move acdl into .ciagent/acdl/ subdirectory and adopt multi-project paths]
  - id: D-012
    decision: Gitea has no native Pages; serve acdl-evidence via raw file URLs + CORS note
    rationale: Research confirms Gitea has no [pages] section; raw URLs work without server config
    confidence: 0.85
    alternatives: [sidecar static server, external Pages host]
  - id: D-013
    decision: QA/Prod gates modeled as workflow_dispatch approval inputs (D-004 fallback) instead of Gitea environments
    rationale: Research confirms Gitea ignores environment: blocks and exposes no environments API
    confidence: 0.90
    alternatives: [external approval bot, drop approval gates entirely]
  - id: D-014
    decision: Cross-repo triggering uses workflow_dispatch API from inside a step (no repository_dispatch)
    rationale: Gitea Actions does not support repository_dispatch
    confidence: 0.85
    alternatives: [push-based trigger with a sentinel file, polling]
  - id: D-015
    decision: New repos acdl-contracts and acdl-evidence use default_branch=main with auto_init=true
    rationale: Matches Gitea DEFAULT_BRANCH=main; required for the default branch to exist before any push
    confidence: 0.95
    alternatives: [use milestone/v1.0-initial as default_branch]
  - id: D-016
    decision: Pages placeholder for Phase 01 is a minimal HTML stub; full timeline UI deferred to Phase 05
    rationale: Phase 01 success criterion is the URL returns 200 with placeholder; full UI is Phase 05
    confidence: 0.90
    alternatives: [build a minimal timeline now]
---/ci---

Clarifications accepted at full autonomy per clarify.md Step 4. Three requirements
re-stated: REQ-09 (new repos default_branch=main), REQ-10 Pages (raw-URL 200
substitute), REQ-10 environments (workflow_dispatch inputs + qa/prod branches).
See .ciagent/REQUIREMENTS.md Clarifications table.
 2026-07-21 12:57:50 +00:00
Jon Chery 5222a460e5 chore(config): rotate Gitea token to env-var reference (security) 
---ci---
phase: 0
milestone: v1.0
status: specify
security:
  - id: SEC-001
    type: info_disclosure
    disposition: mitigated
    summary: Literal API token was committed in config.json gitea.api_token_env field
    fix: Replaced literal with env var name 'ACDL_GITEA_TOKEN'; token supplied via shell env at runtime
    severity: high
    stride: Information Disclosure
---/ci---

The 40-char value previously stored in .ciagent/config.json was a live Gitea
API token. Per the spec constraint 'no secrets in repo', the field now holds
an env var name. The token itself is exported in the shell session at runtime
and is never written to disk. Treat the prior value as already-leaked and
rotate it via the Gitea UI before any external disclosure.
 2026-07-21 12:55:29 +00:00
Jon Chery e3416f8e77 docs(init): initialize Agentic Cloud Delivery Platform (5 phases) 
---ci---
phase: 0
milestone: v1.0
status: specify
decisions:
  - id: D-001
    decision: Use Gitea org continuous-intelligence for all ACDL repos
    rationale: User-specified target org; already exists at git.cloudinit.dev
    confidence: 0.95
    alternatives: [new dedicated demo org]
  - id: D-002
    decision: Map "GitHub Actions" to Gitea Actions (act_runner) using same workflow YAML
    rationale: Environment is Gitea; syntax-compatible with act_runner
    confidence: 0.85
    alternatives: [migrate to GitHub.com, raw shell scripts]
  - id: D-003
    decision: Collapse acdl-platform into the existing empty acdl repo
    rationale: acdl already exists at org root; avoids a 4th repo
    confidence: 0.90
    alternatives: [create separate acdl-platform repo]
  - id: D-004
    decision: Use Gitea environment blocks + required reviewers for QA/Prod; fallback to manual workflow_dispatch with approval input
    rationale: Spec mandates approval gates; forge supports environment protection
    confidence: 0.80
    alternatives: [external approval bot, no approval gates]
  - id: D-005
    decision: Hash-chained ledger (prev_hash + own hash via SHA-256 of canonical JSON) for evidence; declared demonstrative not adversarially secure
    rationale: Spec asks for simple JSON; chain gives visible tamper-evidence
    confidence: 0.85
    alternatives: [signed commits only, full Merkle tree]
  - id: D-006
    decision: Confidence gate threshold = 0.50 exactly (base 0.90, fail drops to 0.40)
    rationale: Explicit in spec
    confidence: 0.99
    alternatives: []
  - id: D-007
    decision: Each mock_apply.sh echoes "[L1: <name>] applying..." + "OK", sleeps 1s, exits 0
    rationale: Spec literal; uniformity aids timeline parsing
    confidence: 0.95
    alternatives: [randomized sleep durations]
  - id: D-008
    decision: L3B keyword->stack mapping: gas/price/ingest/data-lake->commodity-price-feed; invoice/billing->invoice-service; analytics/historical/query->energy-analytics-api; regulatory/compliance/reporting/trading->regulatory-reporting; fallback->invoice-service
    rationale: Mirrors the 4 L2 modules + Act 3 example issue text
    confidence: 0.85
    alternatives: [single default stack, ML classifier (forbidden by no-AI constraint)]
  - id: D-009
    decision: Init milestone = v1.0, branch milestone/v1.0-initial
    rationale: init.md Step 5 mandates milestone/v1.0-initial
    confidence: 0.99
    alternatives: []
  - id: D-010
    decision: Single-project mode for the acdl checkout; ---ci--- blocks omit project field
    rationale: User chose standalone single-project; no other projects in this checkout
    confidence: 0.90
    alternatives: [register acdl in /root multi-project config]
---/ci---

Specification: 30-minute executive demo of the Agentic Cloud Delivery Platform proving automatic, safe, audited infra delivery via local stubs on Gitea Actions (no cloud, no AI APIs).
Requirements: [3 repos under continuous-intelligence org, 8 L1 stub modules, 4 L2 composed modules mirroring S&P Global Energy use cases, 5 core scripts (mock_executor.sh, policy_checker.py, confidence_signal.py, evidence_writer.py, l3b_agent_stub.py), reusable Dev->QA->Prod pipeline with approval gates, issue-triggered L3B agent, Pages evidence timeline UI, 4 scripted demo acts]
Constraints: [local Linux OS, Gitea Actions + Environments, no AWS/GCP/Azure, no external LLM APIs, state in flat JSON/artifacts, EKS Fargate + serverless primitives (no VPC module), L1 single-purpose substrate-agnostic max-depth-1, L2 max-depth-5]
Out of scope: [real cloud provisioning, real LLM inference, production-grade infrastructure, adversarial tamper-proofing of evidence]
 2026-07-21 12:46:33 +00:00