50 Commits

Author	SHA1	Message	Date
Jon Chery	51c3edf458	feat(P3): Nova rebrand — SSM path + tag keys (REQ-161/162) ... SSM path /acdl/{env}/{contractId}/{output} → /nova/... across core/output_publisher + contract resolver + consumer docs. New scripts/migrate_ssm_paths.py (copy/verify/delete, dry-run default). AWS tag keys acdl:owner|environment|contract|cost-center|ref → nova:* across terraform tagging + ABAC session policies (iam:ResourceTag/acdl:* → iam:ResourceTag/nova:*). nova_tagging.py hard mode (D-109 warn→hard). tagging-standard.json tag-key values → nova:*. New scripts/untag_acdl_keys.py (remove old acdl:* tags, dry-run default). Test fixtures updated; pytest + run_ci.sh PASS. ---ci--- project: acdl phase: 3 milestone: v1.15 status: execute ---/ci---	2026-07-30 01:38:30 +00:00
Jon Chery	d5bae868a4	feat(P2): Nova rebrand — code/env-vars/consumer-path (REQ-158/159/160) ... core/env.py dual-read helper (D-108); 21 ACDL_*→NOVA_* env vars migrated across core/scripts/adapters/tests/workflows + .env/.env.secrets (key rename, values stay). G-106 binding: run_platform.sh:288-289 + regression_verify.py:309-312 dual-read (NOVA first, ACDL fallback). G-108 binding: Gitea NOVA_* secrets created via API + workflow secrets: refs updated (deploy.yml + modules-lifecycle.yml, .gitea + .github). acdl_tagging.py→nova_tagging.py (D-109 warn mode, nova:* enforced). .acdl/→.nova/ consumer path (resolver + deploy workflow + schema + tests + docs). Test fixtures updated; pytest + run_ci.sh PASS. ---ci--- project: acdl phase: 2 milestone: v1.15 status: execute ---/ci---	2026-07-30 01:25:24 +00:00
Jon Chery	3b1181f39b	Merge milestone/v1.14-refinement — v1.14 complete (NFR Refinement: bug fixes, security, stubs, tests, docs; 20 phases + final; tag v1.13.24) ... v1.14 NFR Refinement milestone complete. 20 execution phases (P1-P20) + 1 final (P21). All P1/P2 backlog from v1.11 review resolved. Security posture hardened (swallowed errors, account ID externalized, IAM scoped, schema validation, credential hygiene). Stubs resolved (kyverno --kube- version removed). 7 untested scripts gained coverage. Documentation synced (ARCHITECTURE v1.11-v1.14 addenda, stale @v1.6-1.9 -> @v1.13, GRILL G-005/G-008 resolved, COST.md window extended, D-083 deferral recorded). Platform VPC parameterized. 561 tests pass (was 528 at v1.13.2; +33). 22/22 capabilities Verified. 6 grill binding decisions (G-101..G-106) applied. 1 escalation (E-001) auto-resolved at full autonomy (D-101). ---ci--- project: acdl phase: 21 milestone: v1.14 status: complete ---/ci---	2026-07-29 21:36:37 +00:00
Jon Chery	6d8c098205	test(P70): add CAP-013 regression tests — terraform validate + dedup unit assertions (P1 remediation) ... --- ci--- project: acdl phase: 70 milestone: v1.12 status: verify --- /ci--- Code review (P70) flagged 2 P1 testing gaps: 1. No end-to-end terraform validate test for the microservice (the real CAP-013 surface). A future refactor could re-break the dedup and the suite would stay green. 2. No unit test for the _child_id helper / id_remap / dedup merge. Added 6 tests (38 adapter tests total, 522 suite total): - test_microservice_dedup_names_modules_by_child_id: asserts module 'alb' + 'service' appear, expanded sub-ids do NOT. - test_microservice_dedup_rewrites_stack_outputs: service_arn -> module.service, lb_arn -> module.alb. - test_microservice_dedup_rewrites_cross_module_refs: lb_target_group_arn -> module.alb.target_group_arn (not module.alb-targetgroup). - test_microservice_emits_valid_terraform: end-to-end terraform init + validate on the microservice main.tf (locks in CAP-013). - test_single_resource_returns_id_verbatim / test_multi_resource_returns_common_prefix: unit tests for _child_id. P2 nits (noted, not fixed): the ci-vpc-apply/destroy 'if' uses != 'plan' rather than == 'full' (stricter but not exploitable); _child_id docstring could note commonprefix is character-wise. Both are post-hoc.	2026-07-29 13:44:52 +00:00
Jon Chery	41c3377b96	feat(P67b): lifecycle tests default to plan-only; ACDL_LIFECYCLE_MODE flag overrides to full (REQ-134) ... --- ci--- project: acdl phase: 67b milestone: v1.12 status: execute --- /ci--- The modules-lifecycle pipeline now defaults to plan-only (fast, no AWS mutation, no credentials, no cost) so it runs on every PR. A CI variable ACDL_LIFECYCLE_MODE (workflow_dispatch input 'lifecycle_mode', default 'plan') overrides to 'full' for the real apply->modify->destroy against live AWS. Scripts: run_lifecycle_test.sh / run_lifecycle_destroy.sh / run_l2_lifecycle_test.sh / run_l2_lifecycle_destroy.sh read the flag and dispatch to --plan-only (plan mode) or --apply/--destroy (full mode). Destroy is a no-op exit 0 in plan mode (nothing was applied). VPC-output injection is gated on full mode. Workflows: both .github + .gitea (byte-identical) expose lifecycle_mode as a workflow_dispatch input (choice: plan/full), pass it via env: ACDL_LIFECYCLE_MODE to every lifecycle step, skip ci-vpc-apply + ci-vpc-destroy + Read-CI-VPC-outputs in plan mode, and run the lifecycle + l2-lifecycle jobs with if: always() so they execute (plan-only) even when ci-vpc-apply is skipped. Contract + schema: pipelines/modules-lifecycle.yml gains default_mode: plan; the schema accepts default_mode (enum plan|full) and a richer workflow_dispatch inputs shape. Tests: 14 new tests in test_lifecycle_mode_flag.py (script dispatch) + 10 new tests in TestModulesLifecyclePipeline (workflow flag wiring, byte-identity, plan-mode skips). Updated test_platform_vpc_destroy to reflect the plan-mode skip. 516 tests pass; smoke-tested plan mode on the s3 module (--plan-only green, no AWS apply).	2026-07-29 13:16:03 +00:00
Jon Chery	3e11b0fafd	Merge milestone/v1.11-restart — v1.11 complete (stateless adapter + pipeline-driven module lifecycle testing, P56a-P65) ... v1.11 closes G-005 (CAP-017..022 deploy-unverified → Verified via lifecycle pipeline) and G-008 (no cost docs → COST.md). Phases: - P56a: stateless adapter rewrite (918-line monolith → 196-line assembler) - P56b: 12 L1 module terraform subdirs authored - P57: shell orchestrator --apply/--destroy lifecycle modes - P58: single platform VPC + deterministic env-aware state keys - P59: L1 module lifecycle pipeline authored - P60: L1 lifecycle live run (retrofit — module fixes for live AWS) - P61: L2 lifecycle pipeline authored - P62: L2 lifecycle live run - P63: CAP-017..022 regression registry + COST.md - P64: pre-mortem + teardown (zero live resources) - P65: rewrite caps + decks 485 offline tests pass. All 12 requirements complete. Zero live ACDL resources remain (D-096 enforced). # Conflicts: # .ciagent/PERSONAS.md # .ciagent/REQUIREMENTS.md # .ciagent/ROADMAP.md # .ciagent/config.json	2026-07-29 12:32:50 +00:00
Jon Chery	361fe600a9	feat(P61): L2 lifecycle pipeline — extend matrix + workflows + tests ... Extend the modules-lifecycle pipeline with L2 composition modules (static-assets, microservice) per REQ-128: - pipelines/modules-lifecycle.yml: added l2-lifecycle-apply/modify/destroy stages + l2_modules matrix entry - .gitea/workflows/modules-lifecycle.yml + .github/workflows/modules-lifecycle.yml: added l2-lifecycle job (byte-identical), matrix over [static-assets, microservice], needs ci-vpc-apply, has apply/modify/destroy steps. ci-vpc-destroy now needs both [lifecycle, l2-lifecycle]. - schemas/modules-lifecycle-pipeline.schema.json: added l2_modules to matrix - scripts/run_l2_lifecycle_test.sh + run_l2_lifecycle_destroy.sh: L2 wrappers that set ACDL_REMOTE_STATE_KEY=spike/ci-vpc/terraform.tfstate so the microservice composition's terraform_remote_state reads from the CI VPC - adapters/terraform/adapter.py: parameterized remote_state key via ACDL_REMOTE_STATE_KEY env var (default: platform/terraform.tfstate) - modules/l2/static-assets/examples/complex.yml: fixed bucket_name to match simple (my-static-site) so terraform modifies in-place (adds CDN + WAF) - modules/l2/microservice/examples/complex.yml: fixed bucket_name to match simple (my-microservice-demo), added desired_count:2 (modify variant) - tests/test_pipeline_contract.py: 7 new L2 tests (l2 job exists, matrix lists both modules, apply/modify/destroy steps, needs ci-vpc-apply, ci-vpc-destroy needs both, contract matrix lists l2_modules) - pipelines/README.md: updated stages for L2 Regression: 485 passed, 5 deselected. Gitea + GitHub workflows byte-identical. ---ci--- project: acdl phase: P61 milestone: v1.11 status: execute ---/ci---	2026-07-28 20:17:27 +00:00
Jon Chery	ad3cc5f129	fix(ci): separate short-lived CI VPC + fix 8 module lifecycle failures ... Two architectural changes: 1. Created terraform/ci-vpc/ — a short-lived VPC for L1 module lifecycle testing, separate from the long-lived platform VPC. Created before VPC-dependent modules (alb, ecs-service, rds, uptime) are tested, destroyed after. Outputs (vpc_id, subnet_ids, sg_id, cluster_arn) are passed to those modules via scripts/run_lifecycle_test.sh + run_lifecycle_destroy.sh wrappers that inject the CI VPC outputs into the example contracts. 2. Updated the workflow to use ci-vpc-apply → lifecycle (with artifact passing) → ci-vpc-destroy (always runs). 8 module-specific fixes: - s3: unique bucket names (acdl-ci-s3a-simple/complex) instead of globally-taken 'my-simple-bucket' - kms-key: alias name with no spaces (locals.tf → alias/acdl-ci-kms) - iam-role: example contract uses role_name (not name, which the interface doesn't declare) - ecs-service: example contract uses family (not name); VPC inputs (cluster_arn, subnets, security_group) injected by CI VPC wrapper - uptime: added subnets, security_group, cluster_arn to interface + module; network_configuration is dynamic (only when subnets provided) - rds: added subnet_ids input + db_subnet_group resource (conditional on subnet_ids being non-empty) - alb: removed hardcoded placeholder sg/subnet values from examples; vpc_id + subnets + security_group injected by CI VPC wrapper - cloudfront: removed invalid placeholder WAF ARN from complex example Regression: 479 passed, 0 skipped, 5 deselected. All 24 example contracts pass --check-only. ---ci--- project: acdl phase: P59 milestone: v1.11 status: execute ---/ci---	2026-07-28 17:52:58 +00:00
Jon Chery	3597cf0e8f	fix(ci): install Terraform 1.9.* in test + check-only jobs ... The ci.yml workflow's test job runs test_adapter.py which includes test_s3_instance_emits_valid_terraform — this test runs terraform init+validate as a subprocess. Previously Terraform was not installed in the CI job, causing FileNotFoundError. Now both the test and check-only jobs install Terraform 1.9.* via the HashiCorp apt repo. Reverted the skip-when-terraform-missing logic in the test — Terraform is now always available in CI. ---ci--- project: acdl phase: P59 milestone: v1.11 status: execute ---/ci---	2026-07-28 16:12:44 +00:00
Jon Chery	3ef3a82f9c	fix(P59): skip terraform validate test when terraform binary not installed ... The test_s3_instance_emits_valid_terraform test runs terraform init+validate as a subprocess. In CI, the ci.yml workflow doesn't install Terraform (only the modules-lifecycle workflow does). The test now skips gracefully when terraform is not on PATH, using shutil.which('terraform'). ---ci--- project: acdl phase: P59 milestone: v1.11 status: execute ---/ci---	2026-07-28 16:10:45 +00:00
Jon Chery	7ba72bf656	feat(P59): L1 module lifecycle pipeline — author workflows + schema + tests ... EXECUTE stage. Authors the modules-lifecycle pipeline that matrix-tests every L1 module's examples/{simple,complex}.yml contracts through apply→modify→destroy against live AWS. No per-module Python. New files: - pipelines/modules-lifecycle.yml: declarative contract (5 stages: platform-vpc-apply, lifecycle-apply, lifecycle-modify, lifecycle-destroy, platform-vpc-destroy). Matrix over 12 L1 modules. - .gitea/workflows/modules-lifecycle.yml + .github/workflows/modules-lifecycle.yml: byte-identical workflows. 3 jobs: platform-vpc-apply (prerequisite), lifecycle (matrix of 12 modules × apply/modify/destroy), platform-vpc-destroy (always runs, cleanup). Triggers: pull_request to main + workflow_dispatch. - schemas/modules-lifecycle-pipeline.schema.json: schema for the new pipeline shape (extends pipeline.schema.json with workflow_dispatch + matrix). Tests (tests/test_pipeline_contract.py): - TestModulesLifecyclePipeline: 12 tests (schema valid, contract validates, byte-identical, workflow name, 3 jobs, triggers, matrix lists all 12 L1 modules, apply/modify/destroy steps present, platform-vpc-destroy always runs). pipelines/README.md: added modules-lifecycle to the pipeline table. Regression: 479 passed, 0 skipped, 5 deselected (slow). ---ci--- project: acdl phase: P59 milestone: v1.11 status: execute ---/ci---	2026-07-28 16:07:57 +00:00
Jon Chery	fda4564a7f	feat(P58): single platform VPC + deterministic env-aware state keys ... EXECUTE stage. Fixes the 4-VPC bug: adds a single shared VPC to terraform/platform, drops the vpc child from the microservice composition (references the platform VPC via data source), and makes state keys env-aware (spike/{id}/{env}/terraform.tfstate — stable across lifecycle). Platform VPC (terraform/platform/main.tf): - aws_vpc.acdl_shared (10.0.0.0/16) + 2 subnets + IGW + route table + SG - Outputs: vpc_id, subnet_ids, ecs_security_group_id Microservice composition (modules/l2/microservice/composition.json): - Dropped the vpc child (no per-contract VPC ever again). - Added data_sources block: platform_vpc → terraform_remote_state (platform). - Wires: vpc.outputs.subnet_ids → platform_vpc.outputs.subnet_ids. - Wires: platform_vpc.outputs.vpc_id → alb.inputs.vpc_id. - Wires: platform_vpc.outputs.ecs_security_group_id → service.inputs.security_group. Contract resolver (core/contract_resolver.py): - Added environment to the stack instance (stack.environment). - Added data_sources handling: pseudo-children with outputs but no resources. - data_sources propagated through fragment merge to the final stack instance. Adapter (adapters/terraform/adapter.py): - State key: spike/{stack_name}/{environment}/terraform.tfstate (env-aware). - Emits data "terraform_remote_state" "platform" block when data_sources present. - ref:platform_vpc.<output> → data.terraform_remote_state.platform.outputs.<output>. Tests (tests/test_adapter.py): - test_adapt_env_aware_state_key: spike/msvc/prod/terraform.tfstate. - test_adapt_emits_data_source_block: data.terraform_remote_state.platform. - test_adapt_no_vpc_for_microservice: no resource "aws_vpc" in microservice output. - Updated existing state key assertion (spike/s3/dev/terraform.tfstate). Regression: 467 passed, 0 skipped, 5 deselected. run_platform.sh --check-only passes for both microservice (9 resources, no VPC) and static-assets (5 resources). ---ci--- project: acdl phase: P58 milestone: v1.11 status: execute ---/ci---	2026-07-28 16:07:57 +00:00
Jon Chery	4491d0fa72	feat(P57): shell orchestrator lifecycle modes --apply/--destroy ... EXECUTE stage. Adds --apply and --destroy modes to run_platform.sh. The shell owns all terraform lifecycle; Python never runs terraform. Changes to scripts/run_platform.sh: - Added APPLY_ONLY and DESTROY_ONLY flags to arg parsing. - --apply <contract>: resolve -> adapter -> terraform init/validate/plan/ apply -auto-approve. HITL attestation gate runs before apply for qa/prod/dr (REQ-108). Prints terraform outputs after apply. Exits with PLATFORM APPLY OK. - --destroy <contract>: resolve -> adapter -> terraform init/validate/ destroy -auto-approve. Use --decommission <CR> for gated production teardown (D-070 two-step CR validation). Exits with PLATFORM DESTROY OK. - Updated usage header to document all 5 modes (check-only, plan-only, apply, destroy, default full e2e). - Existing --check-only and --plan-only modes preserved unchanged. Tests (tests/test_pipeline.py): - test_run_platform_apply_mode_parses: --apply parses without unknown flag. - test_run_platform_destroy_mode_parses: --destroy parses without unknown flag. - test_no_python_runs_terraform_apply_or_destroy: D-101 grep assertion — no .py file in scripts/ contains 'terraform apply' or 'terraform destroy'. Regression: 464 passed, 0 skipped, 5 deselected (slow). --check-only still works (no regression in existing modes). ---ci--- project: acdl phase: P57 milestone: v1.11 status: execute ---/ci---	2026-07-28 16:07:57 +00:00
Jon Chery	c80060878a	feat(P56b): author 11 L1 module terraform subdirs + fix adapter output format ... EXECUTE stage. Authors the remaining 11 L1 module terraform subdirs with the full versions/variables/locals/main/outputs split. Defaults previously hardcoded in the adapter move into locals.tf. Simple single-resource modules (7): - kms-key: aws_kms_key + alias (enable_key_rotation, deletion_window defaults) - ecr: aws_ecr_repository (encryption_configuration from kms_key_arn, image_scanning) - ecs-cluster: aws_ecs_cluster (name default) - iam-role: aws_iam_role + inline_policy (assume_role_policy fallback, ECR/logs policy in locals.tf) - rds: aws_db_instance (storage_encrypted, multi_az, kms_key_arn defaults) - waf: aws_wafv2_web_acl (default_action, visibility_config, dynamic rules) - uptime: aws_ecs_task_definition + aws_ecs_service (Fargate compat, container_definitions in locals.tf) Multi-resource modules with intra-refs (4): - vpc: aws_vpc + aws_subnet + aws_internet_gateway + aws_route_table (CIDR derivation in locals.tf) - ecs-service: aws_ecs_task_definition + aws_ecs_service (Fargate compat, container_definitions, network_config in locals.tf) - alb: aws_lb + aws_lb_target_group + aws_lb_listener (subnet/security_group list derivation in locals.tf) - cloudfront: aws_cloudfront_distribution + aws_cloudfront_origin_access_control (OAC defaults in locals.tf) Registry: terraform_dir added to all 11 remaining entries. Adapter fix: stack output format uses separate 'from' + 'output' fields (not 'from': 'rid.output'). Fixed _emit_root_output to read both fields. 6 previously-skipped tests unblocked (run_platform.sh --check-only now resolves static-assets.yml through the new module-assembled adapter). Removed skip markers. Fixed test assertion (aws_s3_bucket → module). Regression: 461 passed, 0 skipped, 5 deselected (slow). All 12 modules pass run_primitive_plan.sh --check-only. All 12 terraform/ subdirs pass terraform init + validate standalone. ---ci--- project: acdl phase: P56b milestone: v1.11 status: execute ---/ci---	2026-07-28 16:07:57 +00:00
Jon Chery	a16e6f1bff	feat(P56a): stateless adapter rewrite + s3 reference terraform module ... EXECUTE stage. Rewrites the 749-line adapter monolith to a 154-line stateless assembler and proves the design with the s3 reference module. Stateless adapter (adapters/terraform/adapter.py, 749 → 154 lines): - Deleted TYPE_MAP, INPUT_MAP, OUTPUT_MAP (3 constant tables). - Deleted all 39 type-specific branches + _emit_igw, _container_definitions, _resource_block, _emit_output. - New adapt(): reads registry.json → terraform_dir → emits root main.tf with module-instantiation blocks (module "x" { source = ... }) + ref wiring via module.<rid>.<output> interpolations + root outputs. - The adapter owns NO resource shape, NO nested blocks, NO defaults, NO type-specific logic. It only assembles module instantiations and wires refs. s3 reference terraform module (modules/l1/s3/terraform/): - versions.tf (required_version + aws ~> 5.0) - variables.tf (bucket_name, region, kms_key_arn, tags) - locals.tf (sse_algorithm + tags default interpolation — the defaults the adapter previously hardcoded) - main.tf (aws_s3_bucket + versioning + SSE config, referencing local.*) - outputs.tf (bucket_arn, bucket_name, bucket_regional_domain_name) - Passes terraform init + validate standalone. Registry (modules/registry.json): s3 entry gains terraform_dir field. STANDARDS.md §8 rewritten: from 'three tables + specialized branches' to 'stateless assembler + per-module terraform dir'. §9.4 checklist updated. §9.1 required-files list updated to include terraform/ subdir. tests/test_adapter.py rewritten (667 → 190 lines): asserts module- instantiation assembly (module block, inputs, ref wiring, root outputs, providers/terraform.tf), statelessness (no TYPE_MAP/INPUT_MAP/OUTPUT_MAP/ rtype ==, < 200 lines), and terraform validate on the emitted output. Deleted test_p1_1_adapter_parameterization.py (tested the deleted HCL string emission). 6 pipeline tests skipped (run_platform.sh --check-only defaults to static-assets.yml which needs cloudfront/waf terraform dirs — P56b). Regression: 455 passed, 6 skipped, 5 deselected (slow). run_primitive_plan --check-only s3 exits 0. ---ci--- project: acdl phase: P56a milestone: v1.11 status: execute ---/ci---	2026-07-28 16:07:57 +00:00
Jon Chery	7eec07fc15	feat(P56): IAM re-bootstrap — policy extension + IAM_POLICY.md + baseline test ... Vertical slice 1 of Phase 56 (REQ-116). Offline-testable deliverables landed; the live IAM apply step is escalated (D-095) below. terraform/bootstrap/spike_runner_policy.json — extended with the minimum permissions to terraform apply + probe CAP-017..022: - cloudfront:* (CAP-020 static-assets stack) - wafv2:* (CAP-020 WAF ACL) - lambda:* on function:acdl-* (CAP-018 contract-ingestor) - dynamodb:* on acdl-contracts + acdl-change-requests (CAP-017) - secretsmanager:GetSecretValue on secret:acdl/* (CAP-018 github-token) - sns:* on acdl-* (CAP-017 acdl-sod-halt) - ce:Get* (REQ-119 Cost Explorer read-only) - kms:* (CAP-017 platform + per-stack CMKs) - iam:CreateOpenIDConnectProvider + iam:CreateRole (CAP-022 OIDC re-create) .ciagent/IAM_POLICY.md — new baseline document. Original grants (v1.1–v1.10) + v1.11 grants table + least-privilege scoping notes + OIDC act_runner role plan + D-095 escalation note. tests/test_iam_policy_baseline.py — 15 tests. Asserts the required actions are present per service group, Lambda scoped to acdl-*, CE read-only, no iam:PassRole to Resource:*, DynamoDB acdl-contracts in resource. Regression-testable: any future permission drift surfaces as a test failure at milestone COMPLETE (D-091 gate). Test results: 15/15 pass. Full offline suite 509/509 pass (pre-existing test_seeded_registry_runs_and_reports_honest_status in test_verify_regression_mode.py hangs without AWS creds — environmental, not introduced here). ---ci--- project: acdl phase: 56 milestone: v1.11 status: execute escalation: type: deploy id: D-095 reason: ACDL_BOOTSTRAP_AWS_* not set in the execution environment blocking: live IAM policy apply (aws iam put-user-policy) + OIDC role re-creation (CAP-022) — requires an admin AWS principal action_required: provide fresh ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID + ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY to the run environment, then re-invoke ciagent-run to resume Phase 56 live step fallback: none (D-095 confirmed: escalate to human, no silent fallback to the deck-marking path) ---/ci---	2026-07-28 12:44:31 +00:00
Jon Chery	2397336cbb	verify(P57): code review — 3 P0 auto-fixed, 2 P1+ flagged ... Multi-persona review of the contract surface redesign (031887e + 10b87a6). P0-1 (auto-fixed): scripts/run_platform.sh:437 read the uptime_enabled feature flag from the OLD top-level contract.inputs.uptime_enabled path, which P57 removed. With the new contract shape c.get('inputs',{}) returns {} so the flag silently always defaulted to True — a consumer setting uptime_enabled:false under infrastructure.<module>.inputs could NOT disable uptime monitoring. Fixed to scan infrastructure.<module>.inputs.uptime_enabled (any module false wins). P0-2 (auto-fixed): docs/consumer-guide.md:417,472 documented the ${contract.module} interpolation token, but P57 dropped the `module` field. _expand_vars fails loud (D-081) on unknown tokens, so a consumer following the documented bucket_name example (acdl-${env.environment}-${contract.module}-...) hit a hard ValueError at resolve time. Replaced with ${contract.id} (the surviving short acronym field) in both the example and the interpolation reference table. P0-3 (auto-fixed): core/regression_verify.py CAP-006 and tests/test_consumer_guide_per_env_section.py both asserted the dropped ${contract.module} token. Updated CAP-006 to use ${contract.id} and the doc test to assert ${contract.id} present / ${contract.module} absent. P1+ flags (post-hoc): - P1: _namespace_resources does not rewrite ref: targets in stack.outputs[].from for cross-module refs (within-module is handled; multi-module refs across fragments are not wired today, but no contract uses them yet). - P1: _latest_version raises ValueError (not a clear message) on a malformed semver string in the registry; the schema pins version to ^\d+\.\d+\.\d+$ so this is unreachable from a contract, but registry authors have no guardrail. - P2: docs/consumer-guide.md:407 example path uses .yaml extension while the repo-wide rename standardized on .yml (consumer-repo paths, not platform, so non-blocking). ---ci--- project: acdl phase: 57 milestone: v1.10.2 status: verify lessons: - P0 fix applied: uptime_enabled read path migrated to infrastructure.<module>.inputs (was stale top-level contract.inputs) - P0 fix applied: docs + tests migrated off dropped ${contract.module} interpolation token to ${contract.id} ---/ci---	2026-07-28 12:04:34 +00:00
Jon Chery	031887ec56	refactor(P57): contract surface redesign + rename + .yml repo-wide ... Contract surface redesign: - New top-level fields: id (3-6 char acronym → stack.name), name (full → stack.title), infrastructure (map keyed by module name, replaces module:) - Drop uses: field (dead reference; version pin lives in CI workflow uses: line) - Drop top-level module/inputs (now nested under infrastructure map) - Per-module optional version (defaults to latest published from registry) - Multi-module contracts: one file deploys N modules in one pipeline run, resource IDs namespaced with module name to avoid collisions - stack.schema.json: add optional title field for display name Rename: - pipelines/deploy.yaml → pipelines/contract.yml (declarative spec, not a pipeline) - pipelines/ci.yaml → pipelines/ci.yml - All 44 .yaml files → .yml repo-wide (contracts, module examples, kyverno policies) - .acdl/contract.yaml → .acdl/contract.yml Resolver (core/contract_resolver.py): - Rewrite resolve() to loop infrastructure map, default version to latest, merge module fragments into one stack with namespaced resource IDs - _latest_version() picks highest non-deprecated from registry - _namespace_resources() prefixes IDs + rewrites ref: expressions for multi-module - Single-module path: unprefixed IDs (backward compatible) Verification: - 494 tests pass (0 contract-shape failures) - Local E2E passes (contract → resolver → adapter → local ECS HTTP 200 → outbox) ---ci--- project: acdl phase: 57 milestone: v1.10.2 status: execute ---/ci---	2026-07-27 21:37:40 +00:00
Jon Chery	44d1d19cfd	fix(P54): capability re-verification sweep — 16/16 Verified, 7 adapter defects fixed ... The v1.1-v1.8 capability re-verification sweep (D-093) found and fixed 7 adapter defects in adapters/terraform/adapter.py that had prevented the headline E2E from running against live AWS since the v1.7/v1.8 platform simplification. All 16 auto-verifiable capabilities are now Verified. Defects fixed in-sweep (D-090: no cap): 1. Duplicate output definitions (per-resource + stack-level both emitted). 2. Duplicate desired_count/launch_type on ECS service. 3. Duplicate target_type/family/load_balancer_type. 4. Missing assume_role_policy/role_name on IAM role (L2 composition gap). 5. Missing cidr_block/vpc_id/name defaults on VPC/subnet/route_table/ ECS cluster/ECR repository. 6. ECR kms_key_arn unsupported arg -> encryption_configuration block. 7. CloudFront OAC + WAF deprecated arg names (AWS provider v5): signing_behavior, signing_protocol, origin_access_control_id, s3_origin_config.origin_access_identity, origin_id, rule (singular), scope=CLOUDFRONT (uppercase). New live-AWS capability checks (CAP-013..CAP-016): - terraform init+validate+plan live AWS (microservice): 14 resources, OK - terraform init+validate+plan live AWS (static-assets): CloudFront+WAF+S3, OK - DynamoDB outbox table: exists, 9 items - S3 state bucket: exists, keys=[spike/l2-microservice/terraform.tfstate] 6 IAM-gated cloud resources (CAP-017..CAP-022: contracts table, Lambda, ECS service, CloudFront stack, uptime-kuma, OIDC role) are documented as escalated: the spike-runner lacks the IAM permissions to verify them (chicken-and-egg). The terraform plan path proves the code would deploy them; the local emulators prove the runtime behavior. Verified: 513 fast tests pass. run_regression.sh reports 16/16 Verified (was 12; +4 live-AWS). terraform init+validate+plan succeeds against live AWS for both contracts. No regressions. ---ci--- project: acdl phase: 54 milestone: v1.10 status: verify requirements: covered: [REQ-114] partial: [] decisions: [D-090, D-093] regression: - { capability: CAP-013, status: Verified } - { capability: CAP-014, status: Verified } - { capability: CAP-015, status: Verified } - { capability: CAP-016, status: Verified } ---/ci---	2026-07-27 18:21:45 +00:00
Jon Chery	217653d6f4	feat(P53): local emulating adapters (D-092) — full local E2E, no AWS ... The platform is now fully locally testable without cloud credentials. The headline E2E (contract -> resolver -> adapter -> S3 state -> ECS service -> DynamoDB outbox -> contract-ingestor Lambda) runs end-to-end against the local emulating tier (D-092, REQ-113). Four local emulating adapters in core/local_emulators.py: - FlatFileOutbox: flat-file DynamoDB outbox emulator (hash-chained JSONL; resumable across instances; chain verification). - LocalEcsEmulator: local ECS Fargate HTTP 200 emulator (free-port binding on 127.0.0.1; health check; clean destroy). - LocalS3StateBackend: rewrites the terraform S3 backend to a local backend (per-stack tfstate in a temp folder). - LocalLambdaStub: invokes the contract_ingestor handler in-process (patches _get_dynamodb / _get_secrets_client / urllib.urlopen; DynamoDB writes redirected to the FlatFileOutbox). run_platform.sh gains a --local flag that short-circuits to the local emulating tier (no AWS, no Checkov, no DynamoDB). Regression gate (D-091) now covers 12 capabilities (was 10): +CAP-011 (local E2E microservice) + CAP-012 (local E2E static-assets). Verified: 513 fast tests pass (was 502; +11 new). 2 slow local E2E tests pass. run_regression.sh reports 12/12 Verified. run_platform.sh --local exits 0 with LOCAL E2E OK. No AWS credentials required. ---ci--- project: acdl phase: 53 milestone: v1.10 status: verify requirements: covered: [REQ-113] partial: [] decisions: [D-092] regression: - { capability: CAP-011, status: Verified } - { capability: CAP-012, status: Verified } ---/ci---	2026-07-27 17:39:33 +00:00
Jon Chery	9897df04b2	fix(P52): add regression-class VERIFY (D-091) — catches capability decay ... The prior VERIFY stage was diff-scoped: it checked the phase diff only and never re-ran underlying platform capability. This structural defect (D-091) let 8 NFR-patch phases (v1.9.1-v1.9.8, deck rework) pass VERIFY while the platform they described decayed underneath. Phase 52 remediation: - core/regression_verify.py: regression-class VERIFY with 10 seeded local-tier capability checks (CAP-001..CAP-010). Tags each Verified/Decayed/Broken; fails closed on any non-Verified. - scripts/run_regression.sh: shell wrapper; writes .ciagent/REGRESSION_REPORT.{md,json}; exits non-zero on decay. - tests/test_verify_regression_mode.py: 11 tests (8 fast + 3 slow). Confirms the gate catches decay (fails closed) and that regression mode is additive (diff-scoped VERIFY behavior preserved). - pyproject.toml: slow marker registered; run_ci.sh excludes slow tests to avoid recursion. Verified: 502 fast tests pass (was 493 at v1.9; +9 new). 3 slow integration tests pass. run_regression.sh reports all 10 seeded local-tier capabilities Verified against current code. The decay-surfacing test injects a broken cloud-backed check and confirms the run tags it Broken and fails closed. Cloud-backed capability re-verification (live ECS, DynamoDB writes, Lambda invocation) lands in Phase 54 (D-093). ---ci--- project: acdl phase: 52 milestone: v1.10 status: verify requirements: covered: [REQ-112] partial: [] decisions: [D-091] regression: - { capability: CAP-001, status: Verified } - { capability: CAP-002, status: Verified } - { capability: CAP-003, status: Verified } - { capability: CAP-004, status: Verified } - { capability: CAP-005, status: Verified } - { capability: CAP-006, status: Verified } - { capability: CAP-007, status: Verified } - { capability: CAP-008, status: Verified } - { capability: CAP-009, status: Verified } - { capability: CAP-010, status: Verified } ---/ci---	2026-07-27 17:29:52 +00:00
Jon Chery	7585c828f0	docs(P48): vision gaps + badge system + substrate→engine + CR format + agentic tags ... 9 requirements implemented across presentation decks and project docs: 1. DX closing slide: added 'Infrastructure as a utility, not a craft' bullet to convey the full vision (infrastructure consumed, not maintained; platform compounds value over time). 2. PW Problem slide: 'moving a merged change' → 'promoting a change'. 3. PW Problem slide: added 'Red tape' and 'Scalability without increasing headcount' bullets (4 frictions, not 2). 4. PW Roadmap slide: redesigned with side-by-side HTML table layout (Testing | Planned), 16px font, no overflow. 5. PW deck: added new slide 'What This Platform Is — and Isn't' after North Star (sovereign boundary, infrastructure as utility, 4 anti-goals). PW deck now 16 slides (was 15). 6. Maturity nomenclature: 'Available today'/'shipped' → 'Testing' across both decks + source markdown. New .testing badge (blue/teal #DBEAFE). Roadmap title: 'Testing vs. Planned'. The platform has 0 consumer adoption — 'shipped' was inaccurate. 7. Global: 'substrate' → 'engine' across entire project (88 matches, 30+ files including .ciagent/, docs/, modules/, adapters/, schemas/, code). 8. Presentation files only: 'forge' → 'VCS' / 'version control system' (6 occurrences in 4 files). 'forge' retained in all technical docs and code as the industry-standard term. 9. New .agentic badge (purple/violet #EDE9FE) appended to agentic features in both decks: confidence signal, autonomous dev, pattern recognition, dynamic module creation, citizen developer surface, auto-promotion. Also: Change Request ID format changed from 'CR-2026-001' to 'CHG0678912' across presentation files, consumer guide, and test fixtures. HTML re-rendered. PPTX rendered for release upload. ---ci--- phase: 48 milestone: v1.9 status: complete requirements: covered: [] partial: [] ---/ci---	2026-07-23 14:58:29 +00:00
Jon Chery	6e41f09c6e	verify(P43): code review — 1 P0 auto-fixed, 1 P1 auto-fixed, 3 P1 flagged ... ---ci--- phase: 43 milestone: v1.9 status: verify lessons: - P0 fix: run_platform.sh HITL gate passed approver via string interpolation into Python (GITHUB_ACTOR injection vector) — fixed by passing env vars (ACDL_HITL_*) read via os.environ - P1 fix: attestation_matrix._is_fresh accepted future-dated artifacts (negative age bypassed freshness) — fixed with negative-age guard + test - P1 flagged: WizClient._post does not check GraphQL errors (silent empty-list mask) - P1 flagged: WizClient._post no SSRF validation on WIZ_API_URL - P1 flagged: contract_resolver._load_env duplicates environment_check.load (can drift) ---/ci--- Multi-persona review of the v1.9 diff (v1.8.0..HEAD). Review pass 2 (post-complete) caught issues the initial self-review missed: P0-INJECT (auto-fixed): scripts/run_platform.sh Step 7b interpolated $APPROVER (GITHUB_ACTOR/GITEA_ACTOR) directly into a Python string literal — an attacker-controllable username containing shell/python metacharacters would execute arbitrary Python. Fixed: approver, contract id, and env are now passed as environment variables to the subprocess and read via os.environ[...] (no string interpolation). P1-FRESHNESS (auto-fixed): core/attestation_matrix.py _is_fresh accepted future-dated artifacts (negative age.days <= window_days). Fixed: added age.total_seconds() < 0 guard rejecting future timestamps. Test added: test_freshness_rejects_future_dated_artifact. 3 P1 flagged for post-hoc: - WizClient._post does not surface GraphQL errors (silent empty mask) - WizClient._post no SSRF validation on WIZ_API_URL (operator-supplied, low risk) - contract_resolver._load_env duplicates environment_check.load (drift risk) REVIEW.md updated with the findings. 494 tests pass; run_ci.sh + run_platform.sh --check-only green.	2026-07-23 11:54:58 +00:00
Jon Chery	5365bb4e0a	docs(milestone): complete v1.9 — verify + review + audit + tag v1.9.0 ... ---ci--- project: acdl phase: 0 milestone: v1.9 status: complete requirements: covered: [REQ-100, REQ-101, REQ-102, REQ-103, REQ-104, REQ-105, REQ-106, REQ-107, REQ-108, REQ-109, REQ-110, REQ-111] partial: [] ---/ci--- v1.9 milestone COMPLETE. All 12 requirements satisfied. Verify: 4 layers PASS (structural 26/26 files, behavioral 493 tests + run_ci.sh + run_platform.sh --check-only green, security, quality). Review: 0 P0, 0 P1 (READY TO SHIP). REVIEW.md reconstructed (D-086). Audit: PASS (reconstruction, file discipline, branch hygiene, commit discipline — 12/12 commits with ---ci--- blocks). Updated: - .ciagent/REQUIREMENTS.md: v1.9 section marked complete; traceability table REQ-100..111 added. - .ciagent/ROADMAP.md: v1.9 marked complete; Phase 43 added. - .ciagent/PROJECT.md: v1.9 objective marked complete. - .ciagent/config.json: milestone v1.9 status -> complete. - .ciagent/REVIEW.md: reconstructed with v1.9 content (D-086). - .ciagent/VERIFY.md: v1.9 4-layer verify. - .ciagent/AUDIT.md: v1.9 audit (PASS). - uses:/ref: bumped @v1.6 -> @v1.9 in contracts/, deploy workflows, docs/consumer-guide.md (D-071 successor). Tag v1.9.0 created next; floating v1.9 + v1 tags updated.	2026-07-23 04:46:04 +00:00
Jon Chery	e74a8c2f5d	feat(P42): stub implementation — SoD, HITL gates, attestation matrix, Wiz, Kyverno ... ---ci--- project: acdl phase: 42 milestone: v1.9 status: execute ---/ci--- Phase 42 — stub-implementation (REQ-107..111, D-084): route_halt_artifact (REQ-107): - core/separation_of_duties.py: real SNS publish (ACDL_SOD_HALT_TOPIC_ARN) + outbox fallback (SEPARATION_OF_DUTIES_VIOLATION event via outbox_writer) + stderr emission. No silent print-only stub. - terraform/platform/main.tf: aws_sns_topic.acdl-sod-halt + output. HITL attestation gates (REQ-108): - core/hitl_gates.py: attest(contract_id, env, approver, evidence, outbox_client) records approver_qa/approver_prod/approver_dr to outbox, runs SoD check on prod, invokes attestation matrix, returns (ok, reason). Dev skips (autonomous). approver_from_env() reads GITHUB_ACTOR/GITEA_ACTOR. - scripts/run_platform.sh: Step 7b HITL gate before apply for qa/prod/dr. 8-concern attestation matrix (REQ-109, D-084): - core/attestation_matrix.py: check(env, evidence) runs the 8 concerns from hitl_matrix_design.md §10.4. Offline-testable (contract_nfrs, schema_validity, policy_pass) run for real. Operator-supplied accept signed artifacts validated for freshness (FRESHNESS_DAYS table) + schema. Signature skip when ACDL_ATTESTATION_SIGNING_KEY_ID unset (D-089). Fail loud if missing/expired for prod/dr. Wiz real client (REQ-110): - adapters/wiz/wiz_adapter.py: WizClient (GraphQL API, Bearer auth, pagination via pageInfo.hasNextPage + endCursor). fetch_and_adapt translates issues → PolicyCheckResult; graceful degrade when WIZ_API_TOKEN/WIZ_API_URL unset. Kyverno fleshed out (REQ-111): - adapters/kyverno/kyverno_adapter.py: full PolicyReport → PolicyCheckResult mapping (pass/fail/skip/warn + severity + skip-with- reason + resource ref construction from kind/name/namespace). adapt_inactive() emits KYVERNO_INACTIVE_TF_STACK guard. --kube-version stub parsed for future GitOps. Tests: +47 (test_route_halt_artifact.py, test_hitl_gates.py, test_attestation_matrix.py, test_wiz_adapter_real_client.py, expanded test_kyverno_adapter.py). Existing wiz_adapter tests updated for the real client's control.name ruleId. 493 passed; run_ci.sh green; run_platform.sh --check-only green.	2026-07-23 04:40:44 +00:00
Jon Chery	cd637808f5	feat(P41): per-environment CI jobs + environment workflow input ... ---ci--- project: acdl phase: 41 milestone: v1.9 status: execute ---/ci--- Phase 41 — per-environment-ci-jobs (REQ-105, REQ-106, D-082): Per-env contracts (REQ-105): - contracts/static-assets.{dev,qa,prod,dr}.yaml + microservice.{dev,qa,prod,dr}.yaml (8 files, each sets environment: to its own name, uses interpolation). - Default contracts/static-assets.yaml + microservice.yaml preserved (backwards compat). Deploy workflow environment input (REQ-106): - .github/workflows/deploy.yml + .gitea/workflows/deploy.yml (byte-identical): new 'environment' workflow_call input (default empty, override). - scripts/run_platform.sh: --environment <name> flag; exports ACDL_ENVIRONMENT_OVERRIDE; re-runs env check against the override. - core/contract_resolver.py: resolve(environment_override=...) (D-088); CLI honors --environment flag + ACDL_ENVIRONMENT_OVERRIDE env var. Consumer guide (REQ-106): - docs/consumer-guide.md: 'Per-environment deployment' section with 4 caller-workflow examples (dev/qa/prod/dr), HITL gate structure (approve_qa/approve_prod/approve_dr, D-042), interpolation reference table. - Documents promotion-without-editing + hybrid model (per-env contracts OR single contract + env input). Tests: +40 (test_per_env_contracts.py, test_deploy_workflow_env_input.py, test_consumer_guide_per_env_section.py). 446 passed; run_ci.sh green; deploy workflows byte-identical.	2026-07-23 04:34:10 +00:00
Jon Chery	bee9d02f01	feat(P40): contract interpolation + environment JSON schema ... ---ci--- project: acdl phase: 40 milestone: v1.9 status: execute ---/ci--- Phase 40 — contract-interpolation (REQ-103, REQ-104, D-081): Interpolation: - core/contract_resolver.py: _expand_vars(value, context) recursively expands ${env.<field>} + ${contract.<field>} tokens (dotted paths supported, e.g. ${env.state_backend.bucket}). Unknown tokens raise ValueError (fail loud). Expansion is post-schema-validation, pre-IR-resolution. - resolve() accepts environment_override (D-088) — overrides the contract's environment field BEFORE schema validation so interpolation context is consistent. - env context loaded via _load_env (self-contained, works as script + package import); 'environment' alias for env 'name' so ${env.environment} resolves. Environment schema + bindings: - schemas/environment.schema.json (draft 2020-12): name, account_id, region, state_backend, network, runner_role_arn, autonomy, confidence_threshold. - core/environments/qa.json, prod.json, dr.json placeholder bindings (attested, thresholds 0.75/0.90/0.95, placeholder account_id with stderr warning at load). - core/environment_check.py: load(env_name) helper + placeholder warning. Sample contracts: - contracts/static-assets.yaml + microservice.yaml use acdl-${env.environment}-${contract.module}-${env.account_id}-${env.region} naming pattern (region + account id + environment). Tests: +35 (test_environment_schema.py, test_interpolation.py, test_sample_contracts_interpolate.py). 406 passed; run_ci.sh green; run_platform.sh --check-only green. Existing fixture-based tests preserved (instance.json static fixtures unaffected).	2026-07-23 04:30:30 +00:00
Jon Chery	e1be05287b	feat(P39): refresh design docs + parameterize adapter (P1-1) ... ---ci--- project: acdl phase: 39 milestone: v1.9 status: execute ---/ci--- Phase 39 — design-doc-refresh-and-p1-1-parameterization: Design docs (REQ-100, REQ-101): - hitl_matrix_design.md: 'dev-only spike'/'v1.2 wires the gates' framing replaced with v1.9 wired-gates reality; 8-concern matrix marked implemented (offline-testable subset + signed evidence artifacts, D-084); v1.9 wiring section cross-references hitl_gates.py + attestation_matrix.py; approver_dr noted. - audit_ledger_design.md: outbox marked shipped+production since v1.8; S3 Object Lock + JWS + async worker + DLQ + daily checkpoints clearly labeled 'Deferred to a future milestone (D-083)'; RPO/RTO table updated; approver fields note v1.9 hitl_gates.attest. P1-1 adapter parameterization (REQ-102, D-085): - ecs-service interface.json: desired_count (default 1), launch_type (FARGATE), family (app) inputs added. - alb interface.json: load_balancer_type (application), target_type (ip). - adapter.py: hardcoded defaults replaced with inputs.get(<name>, <default>); hardcoded 'acdl-microservice-rt'/'acdl-microservice-igw' Name tags derive from the VPC name input. - contract_resolver.py: child_input_map routes wires to the sub-resource that declares the input (desired_count → aws:ecs:service, family → aws:ecs:task_definition, target_type → targetgroup, etc.). - microservice composition.json: wires added for the new inputs. Tests: +21 (test_p1_1_adapter_parameterization.py, test_design_docs_current.py). 371 passed; run_ci.sh green; run_platform.sh --check-only green; v1.1 S3 regression preserved.	2026-07-23 04:24:25 +00:00
Jon Chery	3562f6f771	docs(P36): schemas/adapters/pipelines READMEs (REQ-97, REQ-98, REQ-99) ... ---ci--- project: acdl phase: 36 milestone: v1.8 status: execute ---/ci--- - schemas/README.md: how to write schemas, wire into platform, test in CI, dependencies, existing catalog, adding a new schema. - pipelines/README.md: how to write pipeline contracts, wire into workflows, test, dependencies, existing catalog, adding a new pipeline. - adapters/README.md: how to write adapters (Terraform + policy patterns), wire into platform, test, dependencies, existing catalog, adding a new adapter. - tests/test_docs_coverage.py: 6 tests validating all 3 READMEs exist with required sections. Tests: +6 (344 -> 350). All pass.	2026-07-22 22:22:18 +00:00
Jon Chery	cb02c69e0c	docs(P35): module engineering standards + catalog fix + template update (REQ-95, REQ-96) ... ---ci--- project: acdl phase: 35 milestone: v1.8 status: execute ---/ci--- - modules/STANDARDS.md: comprehensive L1+L2 authoring + code review standards (9 sections: L1 standards, L2 standards, encryption by default, deletion protection by default, registry, README standards, adapter extension pattern, code review checklist). - modules/README.md: catalog index fixed — rds, kms-key, uptime added to the Primitives table. - modules/README-TEMPLATE.md: NFRs section added between Outputs and Usage. - tests/test_module_standards.py: automated enforcement test (12 tests) validating required files, NFRs, registration, README sections. Tests: +12 (332 -> 344). All pass.	2026-07-22 22:20:50 +00:00
Jon Chery	134f85d2df	feat(P34): decommission alias + CMDB validation (REQ-92, REQ-93, REQ-94) ... ---ci--- project: acdl phase: 34 milestone: v1.8 status: execute ---/ci--- - DynamoDB acdl-change-requests table added to terraform/platform/main.tf (PK changeRequestId, SK submittedAt, SSE via CMK, PITR). - validate_change_request Lambda action added to contract_ingestor.py: queries CMDB, asserts status=approved + consumerRepo match. - decommission_transform() added to contract_resolver.py: zeroes all counts (desired_count, min/max_capacity) + sets deletion_protection=false. - Decommission mode added to deploy pipeline + both deploy workflows (mode: decommission + changeRequestId input). Byte-identical. - run_platform.sh --decommission flag: validates CR, resolves with deletion_protection=false (step 1), then decommission_transform (step 2). HITL SRE gates documented. - docs/consumer-guide.md: new "Decommissioning a stack" section with CR request, trigger, 2-step HITL SRE gates, CMK deletion window, uptime. Tests: +14 (318 -> 332). All pass.	2026-07-22 22:18:28 +00:00
Jon Chery	491ba78768	feat(P33): uptime-kuma primitive + deploy-uptime pipeline stage (REQ-88..91) ... ---ci--- project: acdl phase: 33 milestone: v1.8 status: execute ---/ci--- - New uptime L1 primitive (aws:ecs:uptime-service) deploying uptime-kuma on ECS Fargate with feature_flag_enabled, monitored_endpoints, static_checks, alert_channels (Teams/email/SMS/GitHub issues). - Adapter emits ECS Fargate task + service when feature_flag_enabled=true; emits nothing when false. Container image louislam/uptime-kuma:1. - New deploy-uptime pipeline stage in pipelines/deploy.yaml (after publish-outputs, before comment-outputs). Now 9 stages. - run_platform.sh --deploy-uptime flag + automatic uptime deployment after L2 module (separate state $WORK/uptime-tf). Endpoints from L2 outputs passed as monitored_endpoints. Feature flag from inputs.uptime_enabled (default true). - scripts/seed_uptime_monitors.py for post-deploy monitor seeding via uptime-kuma API. - Registered in registry.json (14 modules total). Tests: +6 (312 -> 318). All pass.	2026-07-22 22:15:35 +00:00
Jon Chery	8145eee8fc	feat(P32): deletion-protection-by-default + L2 feature flag (REQ-86, REQ-87) ... ---ci--- project: acdl phase: 32 milestone: v1.8 status: execute ---/ci--- - All 11 L1 primitives now have deletion_protection NFR (boolean, default true). - Adapter emits `lifecycle { prevent_destroy = true }` when NFR is true; omits it when false. Default is true when NFR is absent. - L2 composition resolver propagates inputs.deletion_protection to all children NFRs. When false, all resources get deletion_protection=false. - Stack schema updated with optional features object (deletion_protection, uptime_enabled). - Contract schema description updated to document deletion_protection and uptime_enabled inputs. Tests: +5 (307 -> 312). All pass.	2026-07-22 22:12:42 +00:00
Jon Chery	de91a4bb76	feat(P31): encryption-by-default + per-stack CMK (REQ-83, REQ-84, REQ-85) ... ---ci--- project: acdl phase: 31 milestone: v1.8 status: execute ---/ci--- - New kms-key L1 primitive (aws:kms:key) with enable_key_rotation=true (AWS-managed annual rotation, D-075). Registered in registry.json. - Adapter TYPE_MAP expanded for aws:kms:key + aws:kms:alias. - Adapter emits enable_key_rotation from NFR. - S3 adapter emits server_side_encryption_configuration with KMS when kms_key_arn provided; managed KMS fallback with stderr warning when not. - All 10 existing L1 primitives now have encryption_enabled NFR (default true). - s3, rds, ecr, ecs-service, ecs-cluster have kms_key_arn input. - Both L2 compositions (static-assets, microservice) now include a kms-key child + wires connecting kms_key_arn to children. - L2 stack outputs include kms_key_arn. Tests: +7 (300 -> 307). All pass. run_platform.sh --check-only green (static-assets now resolves to 5 resources with the CMK).	2026-07-22 22:11:03 +00:00
Jon Chery	1e4133e11a	fix(P30): temp dir isolation + forge-agnostic APIs + static-key override (P1-8, P1-9, S1) ... ---ci--- project: acdl phase: 30 milestone: v1.8 status: execute ---/ci--- P1-8: run_platform.sh now emits adapter output to $WORK/tf (per-run temp dir), not the committed terraform/spike/ directory. The committed terraform/spike/*.tf files are removed — they were scratch artifacts. Deploy workflow artifact upload path updated to /tmp/acdl_platform_run_v18/tf/. P1-9: contract_ingestor.py now reads GITHUB_API_BASE env for forge-agnostic API URLs. _forge_type() detects GitHub vs Gitea. Search URL is branched (GitHub uses /search/issues, Gitea uses /repos/{owner}/{repo}/issues). S1: Deploy workflow configure-aws-credentials step restructured as a single conditional step. OIDC when no static key (role-to-assume), static-key when ACDL_AWS_ACCESS_KEY_ID present (access-key-id/secret-access-key inputs). Both deploy workflows remain byte-identical. Tests: +8 (292 -> 300). All pass. run_platform.sh --check-only green.	2026-07-22 22:08:23 +00:00
Jon Chery	843cd17b97	fix(P29): SSM fail-loud without CMK + Terraform-rendered invoke policy (P1-3, P1-6) ... ---ci--- project: acdl phase: 29 milestone: v1.8 status: execute ---/ci--- P1-3: SSM publisher now raises RuntimeError when ACDL_KMS_KEY_ID is unset. ACDL_ALLOW_DEFAULT_KMS=1 escape hatch for local testing. P1-6: consumer_invoke_policy.json now uses ${account_id} and ${region} placeholders. Terraform renders them via data.aws_caller_identity + data.aws_region + replace() at apply time. No more hardcoded 000000000000. Tests: +7 (285 -> 292). All pass.	2026-07-22 22:05:40 +00:00
Jon Chery	0eb578c606	fix(P28): WAF nested rules + default_action + resolver outputs (P1-4, P1-5, P1-7) ... ---ci--- project: acdl phase: 28 milestone: v1.8 status: execute ---/ci--- P1-4: WAF custom rules now emit nested `rules { ... }` blocks per rule instead of `rules = [...]` attribute syntax (invalid HCL). P1-5: WAF default_action input is honored (allow/block) instead of hardcoding `allow {}`. Default is `allow` when absent (backward compat). P1-7: L2 composition outputs[] array is now processed by resolve_l2(). The resolver builds stack.outputs from the composition outputs wires. The adapter emits `output` blocks from stack.outputs. Tests: +10 (275 -> 285). All pass. run_platform.sh --check-only green.	2026-07-22 22:03:54 +00:00
Jon Chery	2e2064559a	verify(P22-27): code review — 1 P0 auto-fixed, 2 P1 security fixes, 2 P2 nits ... ---ci--- project: acdl phase: 22-27 milestone: v1.7 status: verify lessons: - P0 fix: run_platform.sh check-only assertions were hardcoded to static-assets; generalized for all contracts - P1 fix: URL-encode contractId in GitHub issue search to prevent query injection - P1 fix: validate consumerRepo format against invoking principal identity (P1-2) - P2 fix: tagging-standard.json description referenced .yaml instead of .py - P2 fix: removed unused graph_resource_name_utils import in acdl_tagging.py ---/ci--- Multi-persona code review of the v1.7 milestone (130 files, +5568/-353). P0 (1, auto-fixed): - run_platform.sh --check-only hardcoded static-assets assertions broke for other contracts (microservice). Generalized to structural checks. P1 security fixes applied (2 of 9): - P1-1: URL-encode contractId in GitHub search query (injection prevention) - P1-2: Validate consumerRepo format (org/repo) when caller identity present P1 flagged for post-hoc (7): - P1-3: SSM uses AWS-managed key, not platform CMK (ACDL_KMS_KEY_ID not set) - P1-4: WAF custom rules emit invalid HCL (attribute vs block syntax) - P1-5: WAF default_action input silently ignored (always emits allow {}) - P1-6: consumer_invoke_policy.json has placeholder account ID (needs substitution) - P1-7: L2 composition outputs section not implemented in resolver - P1-8: terraform/spike/*.tf overwritten by run_platform.sh (state contamination) - P1-9: GitHub API URLs hardcoded (Gitea deployments silently fail) P2 nits fixed (2 of 8): - P2-2: tagging-standard.json description referenced .yaml instead of .py - P2-3: unused graph_resource_name_utils import removed Tests: 275 passed (was 272; +3 caller identity validation tests).	2026-07-22 21:09:52 +00:00
Jon Chery	a9d8b31595	feat(P27): RDS primitive + adapter expansion (D-059) ... Add modules/l1/rds/ with interface.json (engine enum for postgres, mysql, mariadb, sqlserver, oracle), instance.json, README.md (full template with compliance extension points). Register in registry.json. Expand the adapter TYPE_MAP/INPUT_MAP/OUTPUT_MAP for aws:rds:instance -> aws_db_instance; emit backup_retention_period, deletion_protection, storage_encrypted, and skip_final_snapshot from NFRs/inputs. Add RDS to the primitives-plan matrix. Update tests for the new registry entry count (12) + RDS adapter emission. ---ci--- project: acdl phase: 27 milestone: v1.7 status: execute ---/ci---	2026-07-22 20:21:45 +00:00
Jon Chery	90be5839ab	feat(P26): 3 platform pipelines + release job with semver/tag updates ... Phase 26 — platform-pipelines-and-release-automation: - platform-test.yml: PR pipeline (lint + unit-test + integration-test + schema-validation) replacing ci.yml for PRs; integration-test runs run_platform.sh --check-only for every contracts/*.yaml - primitives-plan.yml: PR pipeline with matrix over all 9 L1 primitives (s3, vpc, ecs-cluster, ecs-service, iam-role, alb, ecr, cloudfront, waf) - patterns-plan.yml: PR pipeline with matrix over all 2 L2 modules (static-assets, microservice) - release.yml: push-to-main pipeline computing next semver tag (PATCH for regular phases, MINOR for milestone completions), updating floating MAJOR.MINOR + MAJOR tags, and creating GitHub releases - run_primitive_plan.sh: plan-only/check-only runner for a single L1 primitive (adapter compile + structure validation offline) - run_pattern_plan.sh: plan-only/check-only runner for a single L2 pattern (environment check + contract validate + resolve + adapter + structure validation offline) - contracts/microservice.yaml: sample consumer contract for the microservice L2 module (schema-compliant scalar inputs) - instance.json for 8 L1 primitives (vpc, ecs-cluster, ecs-service, iam-role, alb, ecr, cloudfront, waf) so the primitives-plan matrix can run the adapter offline; s3 already had one - tests/test_release_logic.py: unit test for semver computation (PATCH bump, MINOR bump on milestone, floating tag format) - tests/test_pipeline_contract.py: 19 new tests validating the 4 platform workflows exist and conform (stages, matrices, triggers, permissions) DEVIATION: The microservice pattern (run_pattern_plan.sh --check-only microservice + run_platform.sh --check-only contracts/microservice.yaml) fails at the adapter stage due to a pre-existing resolver ref-id mismatch for multi-resource L1s (resolver emits ref:vpc.subnet_ids but the expanded resource id is vpc-subnet). This predates Phase 26 and is out of scope for pipeline automation; the static-assets pattern passes end-to-end. The microservice contract is schema-valid and resolves correctly (11 resources); only the adapter compilation of multi-resource L1 refs fails. VERIFICATION: - bash scripts/run_ci.sh: PASS (lint + test + check-only) - python3 -m pytest tests/ -v: 266 passed - bash scripts/run_primitive_plan.sh --check-only s3: PASS - bash scripts/run_pattern_plan.sh --check-only static-assets: PASS - All 9 primitives pass run_primitive_plan.sh --check-only - All instance.json validate against stack.schema.json ---ci--- project: acdl phase: 26 milestone: v1.7 status: execute ---/ci---	2026-07-22 20:13:36 +00:00
Jon Chery	4fe794c7a4	feat(P25): deploy outputs (SSM + PR comment) + error reporting via Lambda + stage comments ... ---ci--- project: acdl phase: 25 milestone: v1.7 status: execute ---/ci---	2026-07-22 20:08:30 +00:00
Jon Chery	07c0349131	feat(P24): platform Lambda + DynamoDB contract ingestion + cross-account IAM ... Phase 24 — platform-lambda-and-contract-ingestion. - core/lambda/contract_ingestor.py: AWS Lambda handler invoked via Function URL (IAM auth). Parses JSON body, validates required fields, writes the contract to DynamoDB table acdl-contracts (PK consumerRepo, SK contractId#submittedAt, status submitted, ISO-8601 submittedAt). report_error action is a stub returning "error_report_prepared"; GitHub issue creation is wired in Phase 25. Returns 400 on missing fields / unknown action, 500 on error. Table name + GitHub-token secret ID come from env (set by Terraform). - core/lambda/__init__.py: empty package marker. - terraform/platform/main.tf: DynamoDB acdl-contracts (PITR, SSE via CMK), KMS customer-managed key with alias/acdl-platform, Secrets Manager secret acdl/github-token, IAM execution role (DynamoDB write + Secrets Manager read + KMS decrypt + CloudWatch logs), Lambda acdl-contract-ingestor (Python 3.12, handler contract_ingestor.lambda_handler), Function URL with AWS_IAM auth. State key platform/terraform.tfstate (distinct from spike/microservice). - terraform/platform/README.md: documents what it deploys, the state key, how to apply, and the cross-account invocation model. - terraform/platform/consumer_invoke_policy.json: ABAC-scoped policy template applied to consumer deploy roles during onboarding; grants lambda:InvokeFunctionUrl conditioned on aws:PrincipalTag/acdl:owner == consumerRepo. - tests/test_contract_ingestor.py: 11 tests (moto-backed DynamoDB mock) covering submit_contract put_item shape, report_error stub, missing-field 400, unknown action 400, the lambda_handler wrapper with a Function-URL-style event, dict body, default action, and internal-error 500. - docs/environments/index.md: new section documenting the cross-account contract-ingestion grant (one-way consumer→platform, D-051) and that onboarding now also grants the consumer deploy role InvokeFunctionUrl. - scripts/run_ci.sh, pipelines/ci.yaml, .gitea/workflows/ci.yml, .github/workflows/ci.yml: add core/lambda/contract_ingestor.py to the lint py_compile list. The two workflow YAMLs remain byte-identical. Verification: scripts/run_ci.sh passes all 3 stages (lint/test/check-only); python3 -m pytest tests/ -v passes all 213 tests (11 new + 202 existing). ---ci--- project: acdl phase: 24 milestone: v1.7 status: execute ---/ci---	2026-07-22 20:04:10 +00:00
Jon Chery	1fd37a2843	feat(P23): tagging standard + Wiz adapter + Kyverno adapter ... Phase 23 (v1.7) — tagging standards and security adapters. * schemas/tagging-standard.json (D-054): canonical required-tags schema (acdl:owner, acdl:contract, acdl:environment, acdl:cost-center). * adapters/terraform/policy/custom_rules/acdl_tagging.py: Checkov custom rule (ACDL_TAG_NAMING) loaded via --external-checks-dir; closes D-043 (synthetic SKIPPED record replaced by real PASS/FAIL records). * checkov_adapter.py: removed _emit_tag_naming_skipped(), added ACDL_TAG_NAMING to RULE_MAP, updated docstring. * scripts/run_platform.sh: both Checkov invocations pass --external-checks-dir adapters/terraform/policy/custom_rules/. * adapters/wiz/ (D-052): Wiz adapter translating issue records to PolicyCheckResult (engine: "wiz"); graceful degradation emits WIZ_NOT_CONFIGURED SKIPPED when unconfigured; is_configured() gate. * adapters/kyverno/ (D-053): Kyverno adapter translating PolicyReport results to PolicyCheckResult (engine: "kyverno"); ready but inactive for Terraform-only stacks; 3 sample ClusterPolicies in policies/. * schemas/policy_check_result.schema.json: engine enum += "wiz". * tests: fixtures + test_wiz_adapter.py (8 tests) + test_kyverno_adapter.py (13 tests); updated test_checkov_adapter.py to not expect the removed synthetic ACDL_TAG_NAMING SKIPPED record. * scripts/run_ci.sh: lint stage compiles the new adapter modules. 202 tests pass; CI pipeline OK (lint + test + check-only). Deviations: - Wiz adapt() had an AttributeError on bare-list top-level input (data.get() on a list); fixed to dispatch on isinstance(data, list) before calling .get(). No spec change — bare-list handling is implied by the original docstring's "data if isinstance(data, list)" branch. - Kyverno _to_pcr({}) defaults result to "skipped" (entry.get("result", "skip") -> "skip"), not "error"; test expectation corrected. Added an explicit unknown-result-string test to cover the "error" fallback. ---ci--- project: acdl phase: 23 milestone: v1.7 status: execute ---/ci---	2026-07-22 20:00:46 +00:00
Jon Chery	dca35c78ec	feat(P22): rename static-asset→static-assets + cloudfront/waf primitives + production stack + @v1.6 bump ... ---ci--- phase: 22 title: rename-and-production-static-assets-stack status: complete verification: - scripts/run_ci.sh: PASS (CI PIPELINE OK) - python3 -m pytest tests/ -v: 175 passed - scripts/run_platform.sh --check-only: PASS (PLATFORM CHECK OK) - grep -R "static-asset[^s]" . (excl .git/): 0 hits - grep -R "static-asset$" . (excl .git/): 0 hits - floating git tags v1.6 + v1 point at v1.6.0 (a90a756) changed_files: - Task 1 (rename): contracts/static-asset.yaml→static-assets.yaml (git mv); modules/l2/static-asset→static-assets (git mv); sed replaceAll static-asset→static-assets in 22 files (README, docs, scripts/run_platform.sh, pipelines/deploy.yaml, modules/registry.json, tests/*, .ciagent/* historical narrative) - Task 2 (cloudfront primitive): modules/l1/cloudfront/interface.json + README.md - Task 3 (waf primitive): modules/l1/waf/interface.json + README.md - Task 4 (registry): modules/registry.json (+cloudfront, +waf, static-assets renamed) - Task 5 (augment static-assets): modules/l2/static-assets/composition.json (s3+cloudfront+waf, depth 1); modules/l1/s3/interface.json +instance.json (+bucket_regional_domain_name output); modules/l2/static-assets/README.md (production stack docs) - Task 6 (adapter): adapters/terraform/adapter.py (+TYPE_MAP/INPUT_MAP/OUTPUT_MAP for cloudfront distribution+OAC+wafv2 webacl; special handling in _emit_resource for OAC defaults, distribution origin/cache_behavior/restrictions/viewer_certificate/web_acl_id, waf scope/default_action/visibility_config/managed rules) - Task 7 (contract schema): no change needed (generic inputs object; new module names match ^[a-z][a-z0-9-]*$) - Task 8 (@v1.6 bump): contracts/static-assets.yaml, .gitea/.github/workflows/deploy.yml (ref: v1.6 + header comments), docs/consumer-guide.md, docs/contracts/index.md, docs/pipeline/versioning.md, docs/pipeline/index.md, docs/architecture.md, README.md, modules/l2/microservice/README.md, tests/test_environment_check.py, tests/test_pipeline_contract.py - Task 9 (floating tags): git tag -f v1.6 v1.6.0; git tag -f v1 v1.6.0 - Task 10 (tests): tests/test_adapter.py (registry 11 entries/9 L1/2 L2; cloudfront+waf type map tests; TestS3Output bucket_regional_domain_name; TestStaticAssetsStack 4 tests); tests/test_contract_resolver.py (+s3/cloudfront/waf resource assertions) generated: - terraform/spike/main.tf + terraform.tf (regenerated by run_platform.sh --check-only; reflect static-assets production stack + backend key spike/static-assets/) notes: - D-048 full rewrite of .ciagent/ historical narrative (verbatim phase descriptions, REQ-25/27/50, D-036) — produces intentional tautologies (e.g. "Rename static-assets → static-assets") per the decision to override the v1.6 preservation precedent. - cloudfront interface.json resources array ordered distribution-first so the resolver (first-match wire resolution) routes bucket_regional_domain_name/waf_web_acl_arn/region to the distribution; the OAC gets adapter-provided defaults (name=acdl-oac, origin_type=s3, signing_behavior=always). - .ciagent/ @v1.4 references left as historical record (D-048 scope was static-asset rename only; @v1.4 is historical narrative of Phase 20). - s3 OUTPUT_MAP bucket_regional_domain_name not added (identity fallback in adapt() already handles it; OUTPUT_MAP documents non-identity mappings only). ---ci---	2026-07-22 19:56:52 +00:00
Jon Chery	4e495e5648	feat(P21): environments concept + onboarding scaffold (REQ-61) ... ---ci--- project: acdl phase: 21 milestone: v1.6 status: execute ---/ci--- Introduce platform-managed environments: a consumer does not provide an AWS account, VPC, subnet, S3 state bucket, or runner key. A named environment is a platform-owned bundle of account + network + state backend + IAM role (surfaced via ABAC), selected by name in the contract. Scaffold: - core/environments/dev.json (sample dev env definition) - core/environments/README.md (how envs are used + how to add one) - core/environment_check.py (reads a contract's environment field, looks up core/environments/<name>.json, prints a friendly onboarding prompt when none exists, exits non-zero) - scripts/run_platform.sh: Step 0 calls environment_check.py before contract validation; a missing env halts the pipeline with the onboarding prompt - tests/test_environment_check.py: 12 tests (dev bound, missing env -> onboarding prompt, onboarding message lists provisions, contract paths, wire-in, check-only still passes) Tests: 166 pass (154 + 12 new).	2026-07-22 18:24:02 +00:00
Jon Chery	b758a7c242	refactor(P21): rename acdl_platform/ -> core/ (REQ-53) ... ---ci--- project: acdl phase: 21 milestone: v1.6 status: execute ---/ci--- Rename the acdl_platform/ package to core/ across the directory, all imports in tests/scripts/pipelines/workflows, and doc references. The package is imported as core.confidence_signal / core.contract_resolver / core.outbox_writer. The deploy workflow's platform-repo checkout dir is renamed acdl-platform/ -> platform/ (workspace path, not the python package). Both .gitea + .github workflows stay byte-identical. Note: the original target name 'platform/' shadows Python's stdlib platform module (pytest's import uuid -> platform.system() fails when the repo root is on sys.path, which every test does). 'core/' avoids the clash while honoring the intent (drop the verbose acdl_platform). Tests: 154 pass. run_ci.sh green.	2026-07-22 18:21:12 +00:00
Jon Chery	f68f85c9fd	review(v1.5): READY TO SHIP — multi-persona code review ... ---ci--- project: acdl phase: 20 milestone: v1.5 status: review verdict: READY TO SHIP p0: 1 (fixed — contract path resolution in deploy workflow) p1: 6 (flagged post-hoc) ---/ci--- Multi-persona review of v1.5 phase 20 (docs + reusable deploy workflow). P0 (blocking) — AUTO-FIXED: - C1: scripts/run_platform.sh contract path resolution broken in deploy workflow. The reusable workflow invokes run_platform.sh from the consumer workspace root with a relative contract path (.acdl/contract.yaml), but run_platform.sh does `cd "$ROOT"` (platform repo) early, so the relative path resolved against the platform repo and the pipeline could never run. Fix (commit 75c2274): capture CALLER_CWD before cd "$ROOT"; resolve caller-supplied relative paths against CALLER_CWD; default no-arg contract stays relative to ROOT (preserves platform-local CI). Reproduced pre-fix; verified post-fix. P1 (important) — FLAGGED FOR POST-HOC REVIEW (do not block ship): - C2: ref: v1.4 in the deploy workflow platform checkout — no v1.4 tag exists (only v1.4.0 / v1.4.1). Operator must create a floating v1.4 tag or change the ref to v1.4.1. - C3: modules/l2/{static-asset,microservice}/README.md still use @v1 in their Usage examples; missed by the v1.4 bump. - S1: static-key override is not wired. ACDL_AWS_* env vars on the OIDC step are not read by aws-actions/configure-aws-credentials@v4 (it reads AWS_* or its own access-key/secret-key inputs). The README/CONSUMER_GUIDE claim a working override that doesn't function as written. Needs a conditional step or renamed env vars + input wiring. - S2: README overstates ABAC repo:org/repo:ref:... scoping. The workflow constructs a numeric role name (github.repository_id); the actual claim enforcement lives in the IAM trust policy, not in this workflow. - T1: no deploy-workflow triggers conformance test (CI workflow has one; deploy doesn't). Minor — reusable workflows use workflow_call, not push triggers, but the contract's triggers field is then unenforced. - A1: terraform/spike/terraform.tf uploaded as artifact leaks the AWS account ID via the state-backend bucket name. Recommend excluding terraform.tf or gating artifact upload to non-public repos. P2 (nits) — listed for awareness: floating-tag terminology imprecision (M1), header comment "Gitea Actions" in the GitHub copy (M2, intentional byte- identical), pip install split (P1-perf), comment drift in pipelines/deploy.yaml header (C4), module README internal inconsistency (C5). Verdict: READY TO SHIP. The one P0 is fixed. The 6 P1s are post-hoc items — the deploy workflow is a scaffold whose first real consumer run requires operator setup (tag, IAM role, secrets) that gates go-live. The P1s should be addressed before any consumer invokes uses: acdl/.gitea/workflows/ deploy.yml@v1.4 in earnest. Tests: 154 pass (19 new). run_ci.sh green.	2026-07-22 17:24:28 +00:00
Jon Chery	2a84c0047b	feat(P20): consumer happy path + reusable deploy workflow (v1.5.0) ... ---ci--- project: acdl phase: 20 milestone: v1.5 status: verify ---/ci--- REQ-46: README rewritten — platform-source vs consumer-repo distinction up front; platform flow converted to mermaid flowchart TD; L3A/L3B + spike nomenclature scrubbed from prose (code paths kept verbatim); prereqs pointer to consumer guide added. REQ-47: docs/CONSUMER_GUIDE.md (generic, all L2 modules) replaces docs/consumer-guide-static-asset.md — mermaid diagrams (model LR + pipeline TD), versioned uses: (@v1.4 floating MAJOR+MINOR, bare/@main discouraged), consumer-scoped prerequisites (no Terraform/Checkov/boto3/runner-key), run- time platform fetch via reusable workflow (consumers never invoke scripts/run_platform.sh locally for the happy path), optional local validation note. REQ-48: Credentials section rewritten — zero-trust OIDC + ABAC default (repo-identity + resource-tag scoping, blast-radius containment); static-key override in GitHub Secrets or .env.secrets with platform-managed daily rotation; consumer rotates out of band when using .env.secrets locally. REQ-49: byte-identical .gitea/workflows/deploy.yml + .github/workflows/ deploy.yml — reusable (on: workflow_call), checks out consumer repo + ACDL platform repo, installs deps, runs run_platform.sh, uploads artifacts; OIDC default (permissions: id-token: write) + static-key override via secrets. REQ-50: contracts/static-asset.yaml uses: @v1.4 (MAJOR+MINOR). REQ-51: tests/test_pipeline_contract.py extended — TestDeployPipelineSchema, TestDeployPipelineContract, TestDeployWorkflowConformance (byte-identical, reusable, contract/mode inputs, run_platform invocation, platform-repo checkout, OIDC permissions), TestSampleContractVersioning. 154 tests pass (19 new); run_ci.sh green. Fixes: modules/l2/static-asset/README.md dangling link retargeted to docs/CONSUMER_GUIDE.md.	2026-07-22 17:14:12 +00:00
Jon Chery	e050e65158	feat(P19): central pipeline contract + shell reproducibility + output streaming (v1.4.1) ... ---ci--- project: acdl phase: 19 milestone: v1.4 status: execute --- Add declarative pipeline contract (schemas/pipeline.schema.json + pipelines/ci.yaml) as single source of truth for both Gitea Actions (dev) and GitHub Actions (production) workflows. Both workflow files are byte-identical and validated against the contract by 32 new tests. Add scripts/run_ci.sh for shell reproducibility — mirrors the CI pipeline locally (lint → test → check-only), exits 0 with 'CI PIPELINE OK'. Update scripts/run_platform.sh to stream output by default: terraform init/validate/plan via tee, Checkov compliance results with per-record severity/rule/pass-fail, and emitted Terraform in --check-only. New --quiet flag for log-only mode. Requirements: REQ-43 (central pipeline contract), REQ-44 (shell reproducibility), REQ-45 (output streaming). 122 tests pass (90 + 32).	2026-07-22 15:10:54 +00:00
Jon Chery	1598c54a8b	feat(P18): testing + CI/CD pipelines - pytest suite, check-only mode, Gitea + GitHub workflows (v1.3.2) ... 90 offline tests covering adapter, confidence_signal, checkov_adapter, outbox_writer, and pipeline integration. Identical CI/CD workflows for Gitea Actions (dev) and GitHub Actions (production). New --check-only mode for run_platform.sh (offline, no AWS). ---ci--- project: acdl phase: 18 milestone: v1.3 status: verify ---/ci---	2026-07-22 14:26:11 +00:00