44d1d19cfd
fix(P54): capability re-verification sweep — 16/16 Verified, 7 adapter defects fixed
...
The v1.1-v1.8 capability re-verification sweep (D-093) found and fixed
7 adapter defects in adapters/terraform/adapter.py that had prevented
the headline E2E from running against live AWS since the v1.7/v1.8
platform simplification. All 16 auto-verifiable capabilities are now
Verified.
Defects fixed in-sweep (D-090: no cap):
1. Duplicate output definitions (per-resource + stack-level both emitted).
2. Duplicate desired_count/launch_type on ECS service.
3. Duplicate target_type/family/load_balancer_type.
4. Missing assume_role_policy/role_name on IAM role (L2 composition gap).
5. Missing cidr_block/vpc_id/name defaults on VPC/subnet/route_table/
ECS cluster/ECR repository.
6. ECR kms_key_arn unsupported arg -> encryption_configuration block.
7. CloudFront OAC + WAF deprecated arg names (AWS provider v5):
signing_behavior, signing_protocol, origin_access_control_id,
s3_origin_config.origin_access_identity, origin_id, rule (singular),
scope=CLOUDFRONT (uppercase).
New live-AWS capability checks (CAP-013..CAP-016):
- terraform init+validate+plan live AWS (microservice): 14 resources, OK
- terraform init+validate+plan live AWS (static-assets): CloudFront+WAF+S3, OK
- DynamoDB outbox table: exists, 9 items
- S3 state bucket: exists, keys=[spike/l2-microservice/terraform.tfstate]
6 IAM-gated cloud resources (CAP-017..CAP-022: contracts table, Lambda,
ECS service, CloudFront stack, uptime-kuma, OIDC role) are documented
as escalated: the spike-runner lacks the IAM permissions to verify
them (chicken-and-egg). The terraform plan path proves the code would
deploy them; the local emulators prove the runtime behavior.
Verified: 513 fast tests pass. run_regression.sh reports 16/16
Verified (was 12; +4 live-AWS). terraform init+validate+plan succeeds
against live AWS for both contracts. No regressions.
---ci---
project: acdl
phase: 54
milestone: v1.10
status: verify
requirements:
covered: [REQ-114]
partial: []
decisions: [D-090, D-093]
regression:
- { capability: CAP-013, status: Verified }
- { capability: CAP-014, status: Verified }
- { capability: CAP-015, status: Verified }
- { capability: CAP-016, status: Verified }
---/ci---
2026-07-27 18:21:45 +00:00
217653d6f4
feat(P53): local emulating adapters (D-092) — full local E2E, no AWS
...
The platform is now fully locally testable without cloud credentials.
The headline E2E (contract -> resolver -> adapter -> S3 state -> ECS
service -> DynamoDB outbox -> contract-ingestor Lambda) runs end-to-end
against the local emulating tier (D-092, REQ-113).
Four local emulating adapters in core/local_emulators.py:
- FlatFileOutbox: flat-file DynamoDB outbox emulator (hash-chained JSONL;
resumable across instances; chain verification).
- LocalEcsEmulator: local ECS Fargate HTTP 200 emulator (free-port
binding on 127.0.0.1; health check; clean destroy).
- LocalS3StateBackend: rewrites the terraform S3 backend to a local
backend (per-stack tfstate in a temp folder).
- LocalLambdaStub: invokes the contract_ingestor handler in-process
(patches _get_dynamodb / _get_secrets_client / urllib.urlopen;
DynamoDB writes redirected to the FlatFileOutbox).
run_platform.sh gains a --local flag that short-circuits to the local
emulating tier (no AWS, no Checkov, no DynamoDB).
Regression gate (D-091) now covers 12 capabilities (was 10): +CAP-011
(local E2E microservice) + CAP-012 (local E2E static-assets).
Verified: 513 fast tests pass (was 502; +11 new). 2 slow local E2E
tests pass. run_regression.sh reports 12/12 Verified. run_platform.sh
--local exits 0 with LOCAL E2E OK. No AWS credentials required.
---ci---
project: acdl
phase: 53
milestone: v1.10
status: verify
requirements:
covered: [REQ-113]
partial: []
decisions: [D-092]
regression:
- { capability: CAP-011, status: Verified }
- { capability: CAP-012, status: Verified }
---/ci---
2026-07-27 17:39:33 +00:00
9897df04b2
fix(P52): add regression-class VERIFY (D-091) — catches capability decay
...
The prior VERIFY stage was diff-scoped: it checked the phase diff only
and never re-ran underlying platform capability. This structural defect
(D-091) let 8 NFR-patch phases (v1.9.1-v1.9.8, deck rework) pass VERIFY
while the platform they described decayed underneath.
Phase 52 remediation:
- core/regression_verify.py: regression-class VERIFY with 10 seeded
local-tier capability checks (CAP-001..CAP-010). Tags each
Verified/Decayed/Broken; fails closed on any non-Verified.
- scripts/run_regression.sh: shell wrapper; writes
.ciagent/REGRESSION_REPORT.{md,json}; exits non-zero on decay.
- tests/test_verify_regression_mode.py: 11 tests (8 fast + 3 slow).
Confirms the gate catches decay (fails closed) and that regression
mode is additive (diff-scoped VERIFY behavior preserved).
- pyproject.toml: slow marker registered; run_ci.sh excludes slow
tests to avoid recursion.
Verified: 502 fast tests pass (was 493 at v1.9; +9 new). 3 slow
integration tests pass. run_regression.sh reports all 10 seeded
local-tier capabilities Verified against current code. The
decay-surfacing test injects a broken cloud-backed check and confirms
the run tags it Broken and fails closed.
Cloud-backed capability re-verification (live ECS, DynamoDB writes,
Lambda invocation) lands in Phase 54 (D-093).
---ci---
project: acdl
phase: 52
milestone: v1.10
status: verify
requirements:
covered: [REQ-112]
partial: []
decisions: [D-091]
regression:
- { capability: CAP-001, status: Verified }
- { capability: CAP-002, status: Verified }
- { capability: CAP-003, status: Verified }
- { capability: CAP-004, status: Verified }
- { capability: CAP-005, status: Verified }
- { capability: CAP-006, status: Verified }
- { capability: CAP-007, status: Verified }
- { capability: CAP-008, status: Verified }
- { capability: CAP-009, status: Verified }
- { capability: CAP-010, status: Verified }
---/ci---
2026-07-27 17:29:52 +00:00
772ac721b0
docs(P52): create v1.10 milestone plan — pipeline regression fix + capability re-verification
...
---ci---
project: acdl
phase: 52
milestone: v1.10
status: plan
decisions: [D-090, D-091, D-092, D-093, D-094]
requirements: [REQ-112, REQ-113, REQ-114, REQ-115]
---/ci---
2026-07-27 17:10:09 +00:00
5f69bdea10
docs(P51): update ROADMAP + PROJECT for v1.9.8 patch release
...
acdl-ci / Lint (push) Successful in 8s
acdl-ci / Test (push) Successful in 29s
acdl-ci / Platform check-only (offline) (push) Successful in 9s
---ci---
phase: 51
milestone: v1.9
status: complete
requirements:
covered: []
partial: []
---/ci---
2026-07-27 14:48:45 +00:00
a4481e20de
docs(P51): full presentation rework — scope, story arc, visuals, appendix
...
acdl-ci / Lint (push) Successful in 9s
acdl-ci / Test (push) Successful in 29s
acdl-ci / Platform check-only (offline) (push) Successful in 10s
Major rework of both presentation decks based on leadership feedback.
Addresses: story arc, concept clarity, scope clarification, more visuals,
appendix for detail-heavy slides, and a complete Road to the North Star.
6 new mermaid diagrams:
- platform-works-03-scope-boundary (Upstream → Contract → ACDL → AWS)
- developer-experience-01b-scope-boundary (both consumer paths + scope)
- platform-works-04-confidence-signal (6 inputs → score → gate → decision)
- platform-works-05-attestation-flow (deploy → gate → approver → evidence)
- developer-experience-04-promotion-journey (dev → qa → prod → dr)
- road-to-north-star (v1.0 demo → v1.9 → v1.10 → v2.0 → North Star)
Both Marp decks restructured to 10 main + 6 appendix slides:
PW deck (17 slides):
1. Title
2. The Problem & The North Star (anti-goals moved to slide 3)
3. Where ACDL Sits in Your World (NEW — scope boundary, infra only)
4. The Contract-Driven Model (image: removed, infra inputs instead)
5. The End-to-End Flow
6. Zero-Trust by Default
7. Safety is Computed (NEW confidence signal diagram)
8. Security by Construction
9. Accountability & Audit (NEW attestation flow diagram, QA clarification,
badge reclassification: dev=Testing, qa/prod/dr=Planned)
10. Testing vs. Planned (summary, full inventory in appendix)
11. The Vision Realized
+ Appendix: TOC, Platform-Managed Environments, Observability, Road to
North Star, Full Inventory, Glossary
DX deck (16 slides):
1. Title
2. Where ACDL Sits in Your World (REPLACES Two Consumer Surfaces — scope
boundary with both consumer paths)
3. The Contract — The Entire Consumer Surface (image: removed)
4. The Developer Feedback Loop
5. Versioned, Predictable Releases
6. Friendly Onboarding
7. Safe Promotion Path (NEW promotion journey diagram, rising bar
annotated: dev=Testing, qa/prod/dr=Planned)
8. Safe Decommission
9. Self-Service Module Catalog
10. The Desired Outcomes
+ Appendix: TOC, Citizen Developer Experience, No Platform Code, Local
Reproducibility, Road to North Star, Glossary
Story arc: every slide has an italic 'Story beat' line connecting it to
the narrative progression.
Scope clarification: ACDL is infrastructure only. Upstream is anything
(IDE, agentic SDLC, citizen dev vibe coding). ACDL provisions and governs
AWS resources; application deployment is upstream. Contract examples now
show infrastructure inputs (cpu, memory, desired_count, port) not image:.
QA attestation reclassification: 'Design tested' → 'Planned'. QA attests
to infrastructure readiness (contract + Terraform plan + evidence), not
application code. Dev is autonomous (Testing); qa/prod/dr are Planned.
Road to the North Star: phased timeline (v1.0 → v1.9 → v1.10 → v2.0 →
North Star), annotated 'proposed phasing, not formally planned.'
Also: scripts/sync_to_gl.sh added (GitLab mirror sync utility).
---ci---
phase: 51
milestone: v1.9
status: complete
requirements:
covered: []
partial: []
---/ci---
2026-07-27 14:46:05 +00:00
00762c1256
verify(P51): code review — 1 P0 auto-fixed, 2 P1+ flagged
...
---ci---
project: acdl
phase: 51
milestone: v1.9.8
status: verify
lessons:
- P0 fix: removed duplicate reclassification bullets in slide 9 (Dev autonomous / qa-prod-dr attestation were listed twice); consolidated badges inline to match Marp deck
---/ci---
2026-07-27 14:44:12 +00:00
116f49ecb8
docs(P50): update ROADMAP + PROJECT for v1.9.7 patch release
...
acdl-ci / Lint (push) Successful in 8s
acdl-ci / Test (push) Successful in 28s
acdl-ci / Platform check-only (offline) (push) Successful in 9s
---ci---
phase: 50
milestone: v1.9
status: complete
requirements:
covered: []
partial: []
---/ci---
2026-07-23 15:59:20 +00:00
016068fd46
docs(P50): add talking points files + update README to 4-step process
...
acdl-ci / Lint (push) Successful in 7s
acdl-ci / Test (push) Successful in 28s
acdl-ci / Platform check-only (offline) (push) Successful in 9s
Create two talking points markdown files — one per deck — distilling the
source of truth (speaker notes + content) into presenter-ready cues indexed
by the Marp deck's 10-slide structure.
Each file has:
- One section per Marp slide (## Slide N — Title), matching the Marp deck
- 3-6 talking point bullets per slide — punchy, actionable cues distilled
from the source markdown's speaker notes
- A key takeaway per slide — the one memorable thing the audience should
walk away with
The talking points are the middle layer between the source of truth (full
detail + speaker notes) and the Marp deck (what the audience sees). They
give the presenter a cue sheet for delivery without repeating either layer.
README updated:
- 3-step → 4-step process (added Step 4: talking points)
- Process diagram updated with the 4th step
- Directory layout updated with the two new files
- 'Adding a new presentation' checklist updated with step 6 (distill talking
points)
- Current decks table updated with a talking points column
---ci---
phase: 50
milestone: v1.9
status: complete
requirements:
covered: []
partial: []
---/ci---
2026-07-23 15:58:35 +00:00
1eeee323c0
docs(P49): update ROADMAP + PROJECT for v1.9.6 patch release
...
acdl-ci / Lint (push) Successful in 7s
acdl-ci / Test (push) Successful in 27s
acdl-ci / Platform check-only (offline) (push) Successful in 9s
---ci---
phase: 49
milestone: v1.9
status: complete
requirements:
covered: []
partial: []
---/ci---
2026-07-23 15:44:36 +00:00
807b17d04b
docs(P49): consolidate both Marp decks to 10 high-impact slides
...
acdl-ci / Lint (push) Successful in 8s
acdl-ci / Test (push) Successful in 29s
acdl-ci / Platform check-only (offline) (push) Successful in 9s
How The Platform Works: 16 → 10 slides
- Merged Problem + North Star + What It Is/Isn't → 1 slide (4 frictions
→ North Star → 3 success criteria → 2 anti-goals)
- Merged Policy & Security + Secure by Default → 'Security by Construction'
- Merged Immutable Audit + Human-in-the-Loop → 'Accountability & Audit'
- Folded Observability, Platform-Managed Environments, Portability into
existing slides as bullets (Roadmap, Contract-Driven)
- Added 'The Vision Realized' closing slide
- Removed '5-line YAML' claim (credibility — complex stacks are more)
The Developer Experience: 15 → 10 slides
- Merged What Dev Does + Contract + No Platform Code → 'The Contract —
The Entire Consumer Surface'
- Merged Instant Feedback + Deploy Outputs → 'The Developer Feedback Loop'
- Merged Safe Promotion Path + Rising Bar → 1 slide with side-by-side
approaches + threshold table
- Cut Citizen Developer Experience as standalone (mentioned on slide 2
and slide 10 Outcomes)
- Kept Versioned Releases, Friendly Onboarding, Safe Decommission as
standalone (per user request)
- Removed '5-line YAML' claim
Source markdown files unchanged (remain complete reference with speaker
notes for all original slides).
---ci---
phase: 49
milestone: v1.9
status: complete
requirements:
covered: []
partial: []
---/ci---
2026-07-23 15:43:49 +00:00
0f250d2bbd
docs(P48): update ROADMAP + PROJECT for v1.9.5 patch release
...
acdl-ci / Lint (push) Successful in 6s
acdl-ci / Test (push) Successful in 24s
acdl-ci / Platform check-only (offline) (push) Successful in 8s
---ci---
phase: 48
milestone: v1.9
status: complete
requirements:
covered: []
partial: []
---/ci---
2026-07-23 14:59:19 +00:00
7585c828f0
docs(P48): vision gaps + badge system + substrate→engine + CR format + agentic tags
...
acdl-ci / Lint (push) Successful in 7s
acdl-ci / Test (push) Successful in 23s
acdl-ci / Platform check-only (offline) (push) Successful in 8s
9 requirements implemented across presentation decks and project docs:
1. DX closing slide: added 'Infrastructure as a utility, not a craft' bullet
to convey the full vision (infrastructure consumed, not maintained;
platform compounds value over time).
2. PW Problem slide: 'moving a merged change' → 'promoting a change'.
3. PW Problem slide: added 'Red tape' and 'Scalability without increasing
headcount' bullets (4 frictions, not 2).
4. PW Roadmap slide: redesigned with side-by-side HTML table layout
(Testing | Planned), 16px font, no overflow.
5. PW deck: added new slide 'What This Platform Is — and Isn't' after North
Star (sovereign boundary, infrastructure as utility, 4 anti-goals).
PW deck now 16 slides (was 15).
6. Maturity nomenclature: 'Available today'/'shipped' → 'Testing' across
both decks + source markdown. New .testing badge (blue/teal #DBEAFE).
Roadmap title: 'Testing vs. Planned'. The platform has 0 consumer
adoption — 'shipped' was inaccurate.
7. Global: 'substrate' → 'engine' across entire project (88 matches, 30+
files including .ciagent/, docs/, modules/, adapters/, schemas/, code).
8. Presentation files only: 'forge' → 'VCS' / 'version control system'
(6 occurrences in 4 files). 'forge' retained in all technical docs and
code as the industry-standard term.
9. New .agentic badge (purple/violet #EDE9FE) appended to agentic features
in both decks: confidence signal, autonomous dev, pattern recognition,
dynamic module creation, citizen developer surface, auto-promotion.
Also: Change Request ID format changed from 'CR-2026-001' to 'CHG0678912'
across presentation files, consumer guide, and test fixtures.
HTML re-rendered. PPTX rendered for release upload.
---ci---
phase: 48
milestone: v1.9
status: complete
requirements:
covered: []
partial: []
---/ci---
2026-07-23 14:58:29 +00:00
fc070ccb15
docs(P47): remove HIPAA from ciagent tracking files
...
acdl-ci / Lint (push) Successful in 7s
acdl-ci / Test (push) Successful in 25s
acdl-ci / Platform check-only (offline) (push) Successful in 8s
---ci---
phase: 47
milestone: v1.9
status: complete
requirements:
covered: []
partial: []
---/ci---
2026-07-23 14:10:16 +00:00
be6dc7cff6
docs(P47): update ROADMAP + PROJECT for v1.9.4 patch release
...
acdl-ci / Lint (push) Successful in 7s
acdl-ci / Test (push) Successful in 26s
acdl-ci / Platform check-only (offline) (push) Successful in 9s
---ci---
phase: 47
milestone: v1.9
status: complete
requirements:
covered: []
partial: []
---/ci---
2026-07-23 14:09:31 +00:00
2682719f24
docs(P47): presentation slide updates + HIPAA removal from all docs
...
acdl-ci / Lint (push) Successful in 7s
acdl-ci / Test (push) Successful in 26s
acdl-ci / Platform check-only (offline) (push) Successful in 8s
Presentation changes (both Marp decks + source markdown):
1. Title slide: deck title as H1 (slightly bigger), 'Agentic Cloud Delivery
Platform' as H3 subtitle — cleaner title hierarchy
2. DX deck: removed Local Reproducibility slide (not beneficial for DX)
3. DX deck: Safe Promotion Path slide redesigned with side-by-side layout
for Approaches A and B (HTML table, two columns)
4. DX deck: 'an agent' → 'an AI agent' (slide 2 + Citizen Developer slide)
5. DX deck: What a Developer Does — diagram floated to the right side
6. Header simplified to just the deck name (subtitle now on title slide)
HIPAA removal (25 files):
- Completely removed all HIPAA references from all markdown documentation,
presentation source files, module READMEs, and rendered HTML
- Removed HIPAA from compliance milestone lists (GDPR, SOX, SOC2, DORA remain)
- Removed HIPAA section references (§164.xxx) from compliance annotations
- Cleaned up empty parentheses and broken commas left by removal
- Re-rendered both HTML decks from updated Marp source
---ci---
phase: 47
milestone: v1.9
status: complete
requirements:
covered: []
partial: []
---/ci---
2026-07-23 14:08:40 +00:00
5079d07e64
docs(P46): update ROADMAP + PROJECT for v1.9.3 patch release
...
acdl-ci / Lint (push) Successful in 7s
acdl-ci / Test (push) Successful in 26s
acdl-ci / Platform check-only (offline) (push) Successful in 9s
---ci---
phase: 46
milestone: v1.9
status: complete
requirements:
covered: []
partial: []
---/ci---
2026-07-23 13:44:51 +00:00
ec30f4ae56
docs(P46): render Marp decks to HTML + PPTX, update README for rendered artifacts
...
acdl-ci / Lint (push) Successful in 7s
acdl-ci / Test (push) Successful in 27s
acdl-ci / Platform check-only (offline) (push) Successful in 9s
Commit self-contained HTML renderings of both Marp presentation decks to
docs/presentations/ so they are viewable in any browser and on the git
forge. The HTML files embed all images as base64 data URIs and render
the full S&P Global Energy brand theme (#D6002A red-core, #1B1B1B grey-90,
Akkurat Pro font).
Updated the README to document the 3-step process with HTML as a
committed artifact (re-render when Marp source changes) and PPTX as a
Gitea release attachment (binary, not committed to git).
PPTX files are rendered and uploaded to the Gitea release as downloadable
attachments for stakeholders.
---ci---
phase: 46
milestone: v1.9
status: complete
requirements:
covered: []
partial: []
---/ci---
2026-07-23 13:44:19 +00:00
2cd9ae150d
docs(P45): update ROADMAP + PROJECT for v1.9.2 patch release
...
acdl-ci / Lint (push) Successful in 7s
acdl-ci / Test (push) Successful in 26s
acdl-ci / Platform check-only (offline) (push) Successful in 9s
---ci---
phase: 45
milestone: v1.9
status: complete
requirements:
covered: []
partial: []
---/ci---
2026-07-23 13:28:54 +00:00
ae0cb589ab
docs(P45): S&P Global Energy theme + title/footer/subtitle updates for Marp decks
...
acdl-ci / Lint (push) Successful in 7s
acdl-ci / Test (push) Successful in 27s
acdl-ci / Platform check-only (offline) (push) Successful in 9s
Apply S&P Global Energy brand theme to both Marp presentation decks:
1. Title headers: 'Agentic Cloud Delivery Platform — How The Platform Works'
and 'Agentic Cloud Delivery Platform — The Developer Experience'
2. Footer: 'Confidential · For Senior Leadership' → 'Internal'
3. Title slide subtitle: removed 'Senior Leadership Briefing' (clean title)
4. S&P Global brand theme (colors extracted from live spglobal.com CSS):
- H1/H2: #D6002A (S&P red-core, confirmed from logo SVG + compiled CSS)
- Title slide bg: #1B1B1B (S&P grey-90) with 8px #D6002A top accent bar
- Body text: #1B1B1B (grey-90)
- Blockquote border: #D6002A, text: #2E2E2E (grey-80)
- Table headers: #F0F0F0 (grey-5)
- Font: 'Akkurat Pro' (S&P corporate typeface) with web-safe fallbacks
- theme: default kept as Marp base (simple)
5. Last DX slide: 'The Outcome for Leadership' → 'The Desired Outcomes'
---ci---
phase: 45
milestone: v1.9
status: complete
requirements:
covered: []
partial: []
---/ci---
2026-07-23 13:28:16 +00:00
b0a2728f59
docs(P44): update ROADMAP + PROJECT for v1.9.1 patch release
...
acdl-ci / Lint (push) Successful in 7s
acdl-ci / Test (push) Successful in 26s
acdl-ci / Platform check-only (offline) (push) Successful in 8s
---ci---
phase: 44
milestone: v1.9
status: complete
requirements:
covered: []
partial: []
---/ci---
2026-07-23 12:51:59 +00:00
fca618916c
docs(P44): leadership presentation decks + Marp synthesis + README
...
acdl-ci / Lint (push) Successful in 7s
acdl-ci / Test (push) Successful in 26s
acdl-ci / Platform check-only (offline) (push) Successful in 9s
Add two leadership-facing presentation decks for senior leadership
(CTO, Head of Cloud, Head of Infrastructure, Head of DevOps):
1. How the Platform Works — 14 slides covering the contract-driven model,
zero-trust, computed safety, policy enforcement, secure-by-default,
immutable audit, HITL, observability, platform-managed environments,
portability, and an honest shipped-vs-planned roadmap.
2. The Developer Experience — 14 slides covering two consumer surfaces,
the 5-line contract, no platform code, versioned releases, instant
feedback, deploy outputs, local reproducibility, friendly onboarding,
safe promotion (one contract + per-env CI jobs), safe decommission,
self-service module catalog, and the leadership outcome.
Each deck has two forms:
- Full markdown (source of truth) with speaker notes + mermaid code blocks
- Marp deck (lean, no speaker notes, embedded PNG diagrams) for presentation
Includes a README documenting the 3-step slide creation process:
(full markdown → Marp synthesis → PPTX export) with conventions, build
commands, and maturity framing rules.
---ci---
phase: 44
milestone: v1.9
status: complete
requirements:
covered: []
partial: []
---/ci---
2026-07-23 12:50:29 +00:00
7cccf989b1
audit(v1.9): PASS — ARCHITECTURE.md v1.9 addendum + audit report
...
acdl-ci / Lint (push) Successful in 7s
acdl-ci / Test (push) Successful in 26s
acdl-ci / Platform check-only (offline) (push) Successful in 8s
---ci---
phase: 43
milestone: v1.9
status: complete
---/ci---
Audit of the shipped v1.9 milestone:
Reconstruction: PASS — 16 v1.9 commits, all with ---ci--- blocks;
state reconstructs to milestone v1.9, phase 43, status complete.
Decisions D-080..D-089 all present in git log + .ciagent/ files.
File discipline: PASS — config.json, PROJECT.md, ROADMAP.md,
REQUIREMENTS.md, REVIEW.md, PERSONAS.md, VERIFY.md all consistent.
Fixed: ARCHITECTURE.md had no v1.9 coverage — added a v1.9 addendum
covering all 9 new code components (contract_resolver interpolation,
environment_check.load, hitl_gates, attestation_matrix,
separation_of_duties.route_halt_artifact, WizClient, kyverno_adapter,
per-env promotion, adapter parameterization) + the deferred D-083 items.
Branch hygiene: PASS — only main (local + remote); all 5 v1.9 phase
branches merged + pruned.
Commit discipline: PASS — 16/16 commits with ---ci--- blocks; no stale
implementation decisions; no unresolved v1.9 escalations.
Audit result: PASS.
2026-07-23 12:04:08 +00:00
6e41f09c6e
verify(P43): code review — 1 P0 auto-fixed, 1 P1 auto-fixed, 3 P1 flagged
...
acdl-ci / Lint (push) Successful in 6s
acdl-ci / Test (push) Successful in 26s
acdl-ci / Platform check-only (offline) (push) Successful in 9s
---ci---
phase: 43
milestone: v1.9
status: verify
lessons:
- P0 fix: run_platform.sh HITL gate passed approver via string interpolation into Python (GITHUB_ACTOR injection vector) — fixed by passing env vars (ACDL_HITL_*) read via os.environ
- P1 fix: attestation_matrix._is_fresh accepted future-dated artifacts (negative age bypassed freshness) — fixed with negative-age guard + test
- P1 flagged: WizClient._post does not check GraphQL errors (silent empty-list mask)
- P1 flagged: WizClient._post no SSRF validation on WIZ_API_URL
- P1 flagged: contract_resolver._load_env duplicates environment_check.load (can drift)
---/ci---
Multi-persona review of the v1.9 diff (v1.8.0..HEAD). Review pass 2
(post-complete) caught issues the initial self-review missed:
P0-INJECT (auto-fixed): scripts/run_platform.sh Step 7b interpolated
$APPROVER (GITHUB_ACTOR/GITEA_ACTOR) directly into a Python string
literal — an attacker-controllable username containing shell/python
metacharacters would execute arbitrary Python. Fixed: approver, contract
id, and env are now passed as environment variables to the subprocess
and read via os.environ[...] (no string interpolation).
P1-FRESHNESS (auto-fixed): core/attestation_matrix.py _is_fresh
accepted future-dated artifacts (negative age.days <= window_days).
Fixed: added age.total_seconds() < 0 guard rejecting future timestamps.
Test added: test_freshness_rejects_future_dated_artifact.
3 P1 flagged for post-hoc:
- WizClient._post does not surface GraphQL errors (silent empty mask)
- WizClient._post no SSRF validation on WIZ_API_URL (operator-supplied, low risk)
- contract_resolver._load_env duplicates environment_check.load (drift risk)
REVIEW.md updated with the findings. 494 tests pass; run_ci.sh + run_platform.sh --check-only green.
2026-07-23 11:54:58 +00:00
c4d966359f
docs(P43): merge phase 43 — verify + review + audit + complete v1.9
...
---ci---
project: acdl
phase: 43
milestone: v1.9
status: complete
---/ci---
Merged phase/43-verify-review-audit-complete into main. v1.9 milestone
COMPLETE. 493 tests pass; run_ci.sh + run_platform.sh green; audit PASS.
2026-07-23 04:46:09 +00:00
5365bb4e0a
docs(milestone): complete v1.9 — verify + review + audit + tag v1.9.0
...
---ci---
project: acdl
phase: 0
milestone: v1.9
status: complete
requirements:
covered: [REQ-100, REQ-101, REQ-102, REQ-103, REQ-104, REQ-105, REQ-106, REQ-107, REQ-108, REQ-109, REQ-110, REQ-111]
partial: []
---/ci---
v1.9 milestone COMPLETE. All 12 requirements satisfied.
Verify: 4 layers PASS (structural 26/26 files, behavioral 493 tests +
run_ci.sh + run_platform.sh --check-only green, security, quality).
Review: 0 P0, 0 P1 (READY TO SHIP). REVIEW.md reconstructed (D-086).
Audit: PASS (reconstruction, file discipline, branch hygiene, commit
discipline — 12/12 commits with ---ci--- blocks).
Updated:
- .ciagent/REQUIREMENTS.md: v1.9 section marked complete; traceability
table REQ-100..111 added.
- .ciagent/ROADMAP.md: v1.9 marked complete; Phase 43 added.
- .ciagent/PROJECT.md: v1.9 objective marked complete.
- .ciagent/config.json: milestone v1.9 status -> complete.
- .ciagent/REVIEW.md: reconstructed with v1.9 content (D-086).
- .ciagent/VERIFY.md: v1.9 4-layer verify.
- .ciagent/AUDIT.md: v1.9 audit (PASS).
- uses:/ref: bumped @v1.6 -> @v1.9 in contracts/, deploy workflows,
docs/consumer-guide.md (D-071 successor).
Tag v1.9.0 created next; floating v1.9 + v1 tags updated.
2026-07-23 04:46:04 +00:00
80d2a6cc6c
docs(P42): merge phase 42 — stub implementation
...
---ci---
project: acdl
phase: 42
milestone: v1.9
status: execute
---/ci---
Merged phase/42-stub-implementation into main. REQ-107..111 satisfied.
493 tests pass; run_ci.sh + run_platform.sh green.
2026-07-23 04:40:49 +00:00
e74a8c2f5d
feat(P42): stub implementation — SoD, HITL gates, attestation matrix, Wiz, Kyverno
...
---ci---
project: acdl
phase: 42
milestone: v1.9
status: execute
---/ci---
Phase 42 — stub-implementation (REQ-107..111, D-084):
route_halt_artifact (REQ-107):
- core/separation_of_duties.py: real SNS publish (ACDL_SOD_HALT_TOPIC_ARN)
+ outbox fallback (SEPARATION_OF_DUTIES_VIOLATION event via
outbox_writer) + stderr emission. No silent print-only stub.
- terraform/platform/main.tf: aws_sns_topic.acdl-sod-halt + output.
HITL attestation gates (REQ-108):
- core/hitl_gates.py: attest(contract_id, env, approver, evidence,
outbox_client) records approver_qa/approver_prod/approver_dr to
outbox, runs SoD check on prod, invokes attestation matrix, returns
(ok, reason). Dev skips (autonomous). approver_from_env() reads
GITHUB_ACTOR/GITEA_ACTOR.
- scripts/run_platform.sh: Step 7b HITL gate before apply for qa/prod/dr.
8-concern attestation matrix (REQ-109, D-084):
- core/attestation_matrix.py: check(env, evidence) runs the 8 concerns
from hitl_matrix_design.md §10.4. Offline-testable (contract_nfrs,
schema_validity, policy_pass) run for real. Operator-supplied accept
signed artifacts validated for freshness (FRESHNESS_DAYS table) +
schema. Signature skip when ACDL_ATTESTATION_SIGNING_KEY_ID unset
(D-089). Fail loud if missing/expired for prod/dr.
Wiz real client (REQ-110):
- adapters/wiz/wiz_adapter.py: WizClient (GraphQL API, Bearer auth,
pagination via pageInfo.hasNextPage + endCursor). fetch_and_adapt
translates issues → PolicyCheckResult; graceful degrade when
WIZ_API_TOKEN/WIZ_API_URL unset.
Kyverno fleshed out (REQ-111):
- adapters/kyverno/kyverno_adapter.py: full PolicyReport →
PolicyCheckResult mapping (pass/fail/skip/warn + severity + skip-with-
reason + resource ref construction from kind/name/namespace).
adapt_inactive() emits KYVERNO_INACTIVE_TF_STACK guard. --kube-version
stub parsed for future GitOps.
Tests: +47 (test_route_halt_artifact.py, test_hitl_gates.py,
test_attestation_matrix.py, test_wiz_adapter_real_client.py, expanded
test_kyverno_adapter.py). Existing wiz_adapter tests updated for the
real client's control.name ruleId. 493 passed; run_ci.sh green;
run_platform.sh --check-only green.
2026-07-23 04:40:44 +00:00
5ebf7a62c8
docs(P41): merge phase 41 — per-environment CI jobs
...
---ci---
project: acdl
phase: 41
milestone: v1.9
status: execute
---/ci---
Merged phase/41-per-environment-ci-jobs into main. REQ-105, REQ-106
satisfied. 446 tests pass; run_ci.sh + run_platform.sh green; deploy
workflows byte-identical.
2026-07-23 04:34:14 +00:00
cd637808f5
feat(P41): per-environment CI jobs + environment workflow input
...
---ci---
project: acdl
phase: 41
milestone: v1.9
status: execute
---/ci---
Phase 41 — per-environment-ci-jobs (REQ-105, REQ-106, D-082):
Per-env contracts (REQ-105):
- contracts/static-assets.{dev,qa,prod,dr}.yaml + microservice.{dev,qa,prod,dr}.yaml
(8 files, each sets environment: to its own name, uses interpolation).
- Default contracts/static-assets.yaml + microservice.yaml preserved (backwards compat).
Deploy workflow environment input (REQ-106):
- .github/workflows/deploy.yml + .gitea/workflows/deploy.yml (byte-identical):
new 'environment' workflow_call input (default empty, override).
- scripts/run_platform.sh: --environment <name> flag; exports
ACDL_ENVIRONMENT_OVERRIDE; re-runs env check against the override.
- core/contract_resolver.py: resolve(environment_override=...) (D-088);
CLI honors --environment flag + ACDL_ENVIRONMENT_OVERRIDE env var.
Consumer guide (REQ-106):
- docs/consumer-guide.md: 'Per-environment deployment' section with 4
caller-workflow examples (dev/qa/prod/dr), HITL gate structure
(approve_qa/approve_prod/approve_dr, D-042), interpolation reference table.
- Documents promotion-without-editing + hybrid model (per-env contracts
OR single contract + env input).
Tests: +40 (test_per_env_contracts.py, test_deploy_workflow_env_input.py,
test_consumer_guide_per_env_section.py). 446 passed; run_ci.sh green;
deploy workflows byte-identical.
2026-07-23 04:34:10 +00:00
481cfe760c
docs(P40): merge phase 40 — contract interpolation
...
---ci---
project: acdl
phase: 40
milestone: v1.9
status: execute
---/ci---
Merged phase/40-contract-interpolation into main. REQ-103, REQ-104
satisfied. 406 tests pass; run_ci.sh + run_platform.sh green.
2026-07-23 04:30:34 +00:00
bee9d02f01
feat(P40): contract interpolation + environment JSON schema
...
---ci---
project: acdl
phase: 40
milestone: v1.9
status: execute
---/ci---
Phase 40 — contract-interpolation (REQ-103, REQ-104, D-081):
Interpolation:
- core/contract_resolver.py: _expand_vars(value, context) recursively
expands ${env.<field>} + ${contract.<field>} tokens (dotted paths
supported, e.g. ${env.state_backend.bucket}). Unknown tokens raise
ValueError (fail loud). Expansion is post-schema-validation,
pre-IR-resolution.
- resolve() accepts environment_override (D-088) — overrides the
contract's environment field BEFORE schema validation so interpolation
context is consistent.
- env context loaded via _load_env (self-contained, works as script +
package import); 'environment' alias for env 'name' so
${env.environment} resolves.
Environment schema + bindings:
- schemas/environment.schema.json (draft 2020-12): name, account_id,
region, state_backend, network, runner_role_arn, autonomy, confidence_threshold.
- core/environments/qa.json, prod.json, dr.json placeholder bindings
(attested, thresholds 0.75/0.90/0.95, placeholder account_id with
stderr warning at load).
- core/environment_check.py: load(env_name) helper + placeholder warning.
Sample contracts:
- contracts/static-assets.yaml + microservice.yaml use
acdl-${env.environment}-${contract.module}-${env.account_id}-${env.region}
naming pattern (region + account id + environment).
Tests: +35 (test_environment_schema.py, test_interpolation.py,
test_sample_contracts_interpolate.py). 406 passed; run_ci.sh green;
run_platform.sh --check-only green. Existing fixture-based tests
preserved (instance.json static fixtures unaffected).
2026-07-23 04:30:30 +00:00
8118d6ee27
docs(P39): merge phase 39 — design doc refresh + P1-1 parameterization
...
---ci---
project: acdl
phase: 39
milestone: v1.9
status: execute
---/ci---
Merged phase/39-design-doc-refresh-and-p1-1 into main. REQ-100, REQ-101,
REQ-102 satisfied. 371 tests pass; run_ci.sh + run_platform.sh green.
2026-07-23 04:24:29 +00:00
e1be05287b
feat(P39): refresh design docs + parameterize adapter (P1-1)
...
---ci---
project: acdl
phase: 39
milestone: v1.9
status: execute
---/ci---
Phase 39 — design-doc-refresh-and-p1-1-parameterization:
Design docs (REQ-100, REQ-101):
- hitl_matrix_design.md: 'dev-only spike'/'v1.2 wires the gates' framing
replaced with v1.9 wired-gates reality; 8-concern matrix marked
implemented (offline-testable subset + signed evidence artifacts,
D-084); v1.9 wiring section cross-references hitl_gates.py +
attestation_matrix.py; approver_dr noted.
- audit_ledger_design.md: outbox marked shipped+production since v1.8;
S3 Object Lock + JWS + async worker + DLQ + daily checkpoints clearly
labeled 'Deferred to a future milestone (D-083)'; RPO/RTO table updated;
approver fields note v1.9 hitl_gates.attest.
P1-1 adapter parameterization (REQ-102, D-085):
- ecs-service interface.json: desired_count (default 1), launch_type
(FARGATE), family (app) inputs added.
- alb interface.json: load_balancer_type (application), target_type (ip).
- adapter.py: hardcoded defaults replaced with inputs.get(<name>, <default>);
hardcoded 'acdl-microservice-rt'/'acdl-microservice-igw' Name tags
derive from the VPC name input.
- contract_resolver.py: child_input_map routes wires to the sub-resource
that declares the input (desired_count → aws:ecs:service, family →
aws:ecs:task_definition, target_type → targetgroup, etc.).
- microservice composition.json: wires added for the new inputs.
Tests: +21 (test_p1_1_adapter_parameterization.py, test_design_docs_current.py).
371 passed; run_ci.sh green; run_platform.sh --check-only green; v1.1 S3
regression preserved.
2026-07-23 04:24:25 +00:00
58100c485e
docs(P00): create 5 phase plans for v1.9 (phases 39-43)
...
---ci---
project: acdl
phase: 0
milestone: v1.9
status: plan
---/ci---
5 vertical-slice phases, wave-ordered:
- Wave 1 (parallel): Phase 39 (design docs + P1-1, disjoint file sets)
- Wave 2: Phase 40 (contract interpolation + env schema)
- Wave 3: Phase 41 (per-env CI jobs + env workflow input)
- Wave 4: Phase 42 (stubs: SoD, HITL gates, attestation matrix, Wiz, Kyverno)
- Wave 5: Phase 43 (verify + review + audit + complete)
Plans reference REQ-100..REQ-111. Decisions D-080..D-089 applied.
Versioning: feature milestone, patches v1.8.1..v1.8.5, tag v1.9.0 at COMPLETE.
2026-07-23 04:19:17 +00:00
2bea048bb6
docs(P00): research v1.9 — interpolation, per-env jobs, Wiz, attestation matrix
...
---ci---
project: acdl
phase: 0
milestone: v1.9
status: research
---/ci---
RESEARCH.md v1.9 addendum:
- RA-1: interpolation prior art + ${env.<field>} syntax choice (D-081)
- RA-2: GitHub/Gitea Actions workflow_call environment input + per-env jobs (D-082)
- RA-3: Wiz GraphQL API shape + PolicyCheckResult mapping (REQ-110)
- RA-4: attestation matrix freshness validation + signed artifacts (D-084)
- RA-5: design doc drift audit (hitl_matrix + audit_ledger)
- RA-6: P1-1 adapter hardcoded defaults audit (D-085)
New decisions surfaced: D-087 (recursive expansion), D-088 (env override
pre-validation), D-089 (signature skip when signing key unset).
PERSONAS.md updated for v1.9: milestone field, lambda-engineer
reactivated (SNS topic), phase-specific overrides for phases 39-43,
domain priority updated.
2026-07-23 04:17:41 +00:00
c05ed7a26f
docs(P00): clarify v1.9 — record decisions D-080..D-086
...
---ci---
project: acdl
phase: 0
milestone: v1.9
status: clarify
---/ci---
Full autonomy: all clarifications resolved interactively pre-run + 2
auto-resolved parameters. Decisions recorded (renumbered D-080+ to
avoid collision with v1.8 research decisions D-073..D-077):
- D-080: new milestone v1.9 (feature), ship tag v1.9.0
- D-081: ${env.<field>} + ${contract.<field>} interpolation syntax
- D-082: hybrid per-env promotion (per-env contracts + env workflow input)
- D-083: audit ledger Object Lock/JWS/worker/DLQ deferred (future milestone)
- D-084: attestation matrix offline-testable subset + signed evidence artifacts
- D-085: P1-1 adapter defaults move to L1 interface.json inputs
- D-086: REVIEW.md reconstructed at v1.9 complete; v1.3-v1.8 noted as not-persisted
Auto-resolved: per-env account_id placeholder + stderr warning; SNS topic
defined in Terraform + code reads ACDL_SOD_HALT_TOPIC_ARN.
2026-07-23 04:16:42 +00:00
136ec6abf3
docs(init): validate v1.9 specification
...
---ci---
project: acdl
phase: 0
milestone: v1.9
status: specify
---/ci---
v1.9 scope (user-directed, 2026-07-23):
- Design doc refresh (hitl_matrix_design.md + audit_ledger_design.md)
- Contract interpolation (${env.<field>} + ${contract.<field>})
- Per-environment CI jobs (no environment field editing for promotion)
- Stub implementation (SoD, HITL gates, attestation matrix, Wiz, Kyverno)
- P1-1 adapter parameterization remediation
Requirements REQ-100..REQ-111 added to REQUIREMENTS.md.
PROJECT.md v1.9 objective + phase table (39-43) appended.
config.json milestone bumped to v1.9 (active).
2026-07-23 04:15:41 +00:00
2f0e69272a
audit(v1.8): PASS — audit report committed
...
acdl-ci / Lint (push) Successful in 7s
acdl-ci / Test (push) Successful in 26s
acdl-ci / Platform check-only (offline) (push) Successful in 9s
---ci---
project: acdl
phase: 0
milestone: v1.8
status: complete
---/ci---
Audit report: PASS. All checks passed:
- Reconstruction: 17/17 commits with ---ci--- blocks, state matches config
- File discipline: 10 .ciagent/ files valid, 0 issues
- Branch hygiene: stale branches cleaned, only main remains
- Commit discipline: 17/17 with ---ci--- blocks, 0 stale decisions
Issues fixed during audit:
- ARCHITECTURE.md: added v1.8 addendum
- Stale branches: deleted phase/21 + milestone/v1.0-initial
2026-07-22 22:43:07 +00:00
2861319447
audit(v1.8): ARCHITECTURE.md v1.8 addendum + stale branch cleanup
...
acdl-ci / Lint (push) Successful in 7s
acdl-ci / Test (push) Successful in 26s
acdl-ci / Platform check-only (offline) (push) Successful in 9s
---ci---
project: acdl
phase: 0
milestone: v1.8
status: complete
---/ci---
Audit fixes:
- ARCHITECTURE.md: added v1.8 addendum covering new primitives (kms-key,
uptime), encryption-by-default, deletion-protection-by-default,
decommission alias, adapter expansion (19 TYPE_MAP entries), pipeline
stages (9), forge-agnostic API URLs.
- Stale branches cleaned: phase/21-docs-restructure (v1.6) and
milestone/v1.0-initial (v1.0) deleted. Pruned remote refs.
- Only main + origin/main remain.
Audit result: PASS
2026-07-22 22:42:46 +00:00
f9a93d56cc
docs(milestone): ship v1.8.0 — fix REQUIREMENTS.md header
...
acdl-ci / Lint (push) Successful in 8s
acdl-ci / Test (push) Successful in 26s
acdl-ci / Platform check-only (offline) (push) Successful in 9s
---ci---
project: acdl
phase: 0
milestone: v1.8
status: complete
---/ci---
Ship finalization: REQUIREMENTS.md v1.8 section header corrected
from Active to Complete. All other .ciagent/ files already updated.
2026-07-22 22:36:54 +00:00
ca99241843
verify(P28-38): code review — 1 P0 auto-fixed, 3 P1 fixes, 2 P1 flagged
...
acdl-ci / Lint (push) Successful in 7s
acdl-ci / Test (push) Successful in 27s
acdl-ci / Platform check-only (offline) (push) Successful in 9s
---ci---
project: acdl
phase: 28-38
milestone: v1.8
status: verify
lessons:
- P0 fix: pipelines/deploy.yaml stale terraform/spike paths updated to run_platform.sh
- P1 fix: removed import sys from inside _emit_resource function body
- P1 fix: removed unused cpu/memory vars in uptime emission
- P1 fix: decommission consumerRepo now uses GITHUB_REPOSITORY env
---/ci---
P0: deploy.yaml 3 stage commands referenced removed terraform/spike dir.
P1 fixes: import sys, unused vars, consumerRepo env.
P1 flagged: uptime hardcoded subnet/sg, uses ref not bumped to v1.8.
P2 flagged: deploy-uptime flag standalone, pre-v1.8 READMEs missing NFRs.
Tests: 350 passed.
2026-07-22 22:30:49 +00:00
c99da9a58c
docs(milestone): complete v1.8 — P1 remediation + uptime + standards + encryption + decommission + docs
...
---ci---
project: acdl
phase: 0
milestone: v1.8
status: complete
requirements:
covered: [REQ-76, REQ-77, REQ-78, REQ-79, REQ-80, REQ-81, REQ-82, REQ-83, REQ-84, REQ-85, REQ-86, REQ-87, REQ-88, REQ-89, REQ-90, REQ-91, REQ-92, REQ-93, REQ-94, REQ-95, REQ-96, REQ-97, REQ-98, REQ-99]
partial: []
---/ci---
v1.8 milestone complete. 11 phases (28-38), 24 requirements (REQ-76..99).
Track 1 — P1 Remediation (8 issues, all resolved):
- P1-3: SSM fail-loud without CMK + escape hatch
- P1-4: WAF custom rules emit nested HCL blocks
- P1-5: WAF default_action input honored
- P1-6: Terraform-rendered invoke policy (no placeholder account ID)
- P1-7: L2 composition outputs resolved + adapter output blocks
- P1-8: Per-run temp dir (terraform/spike removed)
- P1-9: Forge-agnostic API URLs (GITHUB_API_BASE)
- S1: Static-key override wired to configure-aws-credentials inputs
Track 2 — Encryption + Deletion Protection by Default:
- Per-stack CMK (kms-key primitive, 90-day rotation, no shared keys)
- All 12 primitives have encryption_enabled NFR + kms_key_arn input
- L2 modules wire per-stack CMK to all children
- All 12 primitives have deletion_protection NFR (default true)
- Adapter emits lifecycle { prevent_destroy = true }
- L2 feature flag propagation (inputs.deletion_protection)
Track 3 — Uptime + Standards + Docs:
- uptime-kuma primitive (ECS Fargate, feature flag, alert channels)
- deploy-uptime pipeline stage (separate state)
- Decommission mode (2-step HITL SRE gates + CMDB validation)
- modules/STANDARDS.md (L1+L2 authoring + review standards)
- schemas/README.md, pipelines/README.md, adapters/README.md
Tests: 275 -> 350 (+75 new). All pass. run_ci.sh + check-only green.
Zero pending P1 issues remaining.
2026-07-22 22:24:15 +00:00
da60f0e82f
verify(P28-36): 4-layer verification — 350 tests, all pass
...
---ci---
project: acdl
phase: 28-36
milestone: v1.8
status: verify
---/ci---
Structural: 14 new files present, terraform/spike removed, 14 registry entries. PASS.
Behavioral: 350 tests pass (275 -> 350, +75 new). run_ci.sh + check-only green. PASS.
Security: no placeholder account IDs, no hardcoded API URLs, byte-identical
workflows, SSM fail-loud, deletion protection + encryption by default. PASS.
Quality: each P1 fix + each new feature has dedicated tests. PASS.
VERIFY PASS.
2026-07-22 22:23:24 +00:00
3562f6f771
docs(P36): schemas/adapters/pipelines READMEs (REQ-97, REQ-98, REQ-99)
...
---ci---
project: acdl
phase: 36
milestone: v1.8
status: execute
---/ci---
- schemas/README.md: how to write schemas, wire into platform, test in
CI, dependencies, existing catalog, adding a new schema.
- pipelines/README.md: how to write pipeline contracts, wire into
workflows, test, dependencies, existing catalog, adding a new pipeline.
- adapters/README.md: how to write adapters (Terraform + policy patterns),
wire into platform, test, dependencies, existing catalog, adding a new
adapter.
- tests/test_docs_coverage.py: 6 tests validating all 3 READMEs exist
with required sections.
Tests: +6 (344 -> 350). All pass.
2026-07-22 22:22:18 +00:00
cb02c69e0c
docs(P35): module engineering standards + catalog fix + template update (REQ-95, REQ-96)
...
---ci---
project: acdl
phase: 35
milestone: v1.8
status: execute
---/ci---
- modules/STANDARDS.md: comprehensive L1+L2 authoring + code review
standards (9 sections: L1 standards, L2 standards, encryption by default,
deletion protection by default, registry, README standards, adapter
extension pattern, code review checklist).
- modules/README.md: catalog index fixed — rds, kms-key, uptime added
to the Primitives table.
- modules/README-TEMPLATE.md: NFRs section added between Outputs and Usage.
- tests/test_module_standards.py: automated enforcement test (12 tests)
validating required files, NFRs, registration, README sections.
Tests: +12 (332 -> 344). All pass.
2026-07-22 22:20:50 +00:00
134f85d2df
feat(P34): decommission alias + CMDB validation (REQ-92, REQ-93, REQ-94)
...
---ci---
project: acdl
phase: 34
milestone: v1.8
status: execute
---/ci---
- DynamoDB acdl-change-requests table added to terraform/platform/main.tf
(PK changeRequestId, SK submittedAt, SSE via CMK, PITR).
- validate_change_request Lambda action added to contract_ingestor.py:
queries CMDB, asserts status=approved + consumerRepo match.
- decommission_transform() added to contract_resolver.py: zeroes all
counts (desired_count, min/max_capacity) + sets deletion_protection=false.
- Decommission mode added to deploy pipeline + both deploy workflows
(mode: decommission + changeRequestId input). Byte-identical.
- run_platform.sh --decommission flag: validates CR, resolves with
deletion_protection=false (step 1), then decommission_transform
(step 2). HITL SRE gates documented.
- docs/consumer-guide.md: new "Decommissioning a stack" section with
CR request, trigger, 2-step HITL SRE gates, CMK deletion window, uptime.
Tests: +14 (318 -> 332). All pass.
2026-07-22 22:18:28 +00:00
491ba78768
feat(P33): uptime-kuma primitive + deploy-uptime pipeline stage (REQ-88..91)
...
---ci---
project: acdl
phase: 33
milestone: v1.8
status: execute
---/ci---
- New uptime L1 primitive (aws:ecs:uptime-service) deploying uptime-kuma
on ECS Fargate with feature_flag_enabled, monitored_endpoints,
static_checks, alert_channels (Teams/email/SMS/GitHub issues).
- Adapter emits ECS Fargate task + service when feature_flag_enabled=true;
emits nothing when false. Container image louislam/uptime-kuma:1.
- New deploy-uptime pipeline stage in pipelines/deploy.yaml (after
publish-outputs, before comment-outputs). Now 9 stages.
- run_platform.sh --deploy-uptime flag + automatic uptime deployment
after L2 module (separate state $WORK/uptime-tf). Endpoints from L2
outputs passed as monitored_endpoints. Feature flag from
inputs.uptime_enabled (default true).
- scripts/seed_uptime_monitors.py for post-deploy monitor seeding via
uptime-kuma API.
- Registered in registry.json (14 modules total).
Tests: +6 (312 -> 318). All pass.
2026-07-22 22:15:35 +00:00
8145eee8fc
feat(P32): deletion-protection-by-default + L2 feature flag (REQ-86, REQ-87)
...
---ci---
project: acdl
phase: 32
milestone: v1.8
status: execute
---/ci---
- All 11 L1 primitives now have deletion_protection NFR (boolean, default true).
- Adapter emits `lifecycle { prevent_destroy = true }` when NFR is true;
omits it when false. Default is true when NFR is absent.
- L2 composition resolver propagates inputs.deletion_protection to all
children NFRs. When false, all resources get deletion_protection=false.
- Stack schema updated with optional features object (deletion_protection,
uptime_enabled).
- Contract schema description updated to document deletion_protection
and uptime_enabled inputs.
Tests: +5 (307 -> 312). All pass.
2026-07-22 22:12:42 +00:00
de91a4bb76
feat(P31): encryption-by-default + per-stack CMK (REQ-83, REQ-84, REQ-85)
...
---ci---
project: acdl
phase: 31
milestone: v1.8
status: execute
---/ci---
- New kms-key L1 primitive (aws:kms:key) with enable_key_rotation=true
(AWS-managed annual rotation, D-075). Registered in registry.json.
- Adapter TYPE_MAP expanded for aws:kms:key + aws:kms:alias.
- Adapter emits enable_key_rotation from NFR.
- S3 adapter emits server_side_encryption_configuration with KMS when
kms_key_arn provided; managed KMS fallback with stderr warning when not.
- All 10 existing L1 primitives now have encryption_enabled NFR (default true).
- s3, rds, ecr, ecs-service, ecs-cluster have kms_key_arn input.
- Both L2 compositions (static-assets, microservice) now include a kms-key
child + wires connecting kms_key_arn to children.
- L2 stack outputs include kms_key_arn.
Tests: +7 (300 -> 307). All pass. run_platform.sh --check-only green
(static-assets now resolves to 5 resources with the CMK).
2026-07-22 22:11:03 +00:00
Jon Chery