 Jon Chery
|
2e2064559a
|
verify(P22-27): code review — 1 P0 auto-fixed, 2 P1 security fixes, 2 P2 nits
acdl-ci / Lint (push) Successful in 8s
acdl-ci / Test (push) Successful in 25s
acdl-ci / Platform check-only (offline) (push) Successful in 10s
---ci---
project: acdl
phase: 22-27
milestone: v1.7
status: verify
lessons:
- P0 fix: run_platform.sh check-only assertions were hardcoded to static-assets; generalized for all contracts
- P1 fix: URL-encode contractId in GitHub issue search to prevent query injection
- P1 fix: validate consumerRepo format against invoking principal identity (P1-2)
- P2 fix: tagging-standard.json description referenced .yaml instead of .py
- P2 fix: removed unused graph_resource_name_utils import in acdl_tagging.py
---/ci---
Multi-persona code review of the v1.7 milestone (130 files, +5568/-353).
P0 (1, auto-fixed):
- run_platform.sh --check-only hardcoded static-assets assertions broke
for other contracts (microservice). Generalized to structural checks.
P1 security fixes applied (2 of 9):
- P1-1: URL-encode contractId in GitHub search query (injection prevention)
- P1-2: Validate consumerRepo format (org/repo) when caller identity present
P1 flagged for post-hoc (7):
- P1-3: SSM uses AWS-managed key, not platform CMK (ACDL_KMS_KEY_ID not set)
- P1-4: WAF custom rules emit invalid HCL (attribute vs block syntax)
- P1-5: WAF default_action input silently ignored (always emits allow {})
- P1-6: consumer_invoke_policy.json has placeholder account ID (needs substitution)
- P1-7: L2 composition outputs section not implemented in resolver
- P1-8: terraform/spike/*.tf overwritten by run_platform.sh (state contamination)
- P1-9: GitHub API URLs hardcoded (Gitea deployments silently fail)
P2 nits fixed (2 of 8):
- P2-2: tagging-standard.json description referenced .yaml instead of .py
- P2-3: unused graph_resource_name_utils import removed
Tests: 275 passed (was 272; +3 caller identity validation tests).
|
2026-07-22 21:09:52 +00:00 |
|
|
Jon Chery
|
1fd37a2843
|
feat(P23): tagging standard + Wiz adapter + Kyverno adapter
Phase 23 (v1.7) — tagging standards and security adapters.
* schemas/tagging-standard.json (D-054): canonical required-tags schema
(acdl:owner, acdl:contract, acdl:environment, acdl:cost-center).
* adapters/terraform/policy/custom_rules/acdl_tagging.py: Checkov custom
rule (ACDL_TAG_NAMING) loaded via --external-checks-dir; closes D-043
(synthetic SKIPPED record replaced by real PASS/FAIL records).
* checkov_adapter.py: removed _emit_tag_naming_skipped(), added
ACDL_TAG_NAMING to RULE_MAP, updated docstring.
* scripts/run_platform.sh: both Checkov invocations pass
--external-checks-dir adapters/terraform/policy/custom_rules/.
* adapters/wiz/ (D-052): Wiz adapter translating issue records to
PolicyCheckResult (engine: "wiz"); graceful degradation emits
WIZ_NOT_CONFIGURED SKIPPED when unconfigured; is_configured() gate.
* adapters/kyverno/ (D-053): Kyverno adapter translating PolicyReport
results to PolicyCheckResult (engine: "kyverno"); ready but inactive
for Terraform-only stacks; 3 sample ClusterPolicies in policies/.
* schemas/policy_check_result.schema.json: engine enum += "wiz".
* tests: fixtures + test_wiz_adapter.py (8 tests) + test_kyverno_adapter.py
(13 tests); updated test_checkov_adapter.py to not expect the removed
synthetic ACDL_TAG_NAMING SKIPPED record.
* scripts/run_ci.sh: lint stage compiles the new adapter modules.
202 tests pass; CI pipeline OK (lint + test + check-only).
Deviations:
- Wiz adapt() had an AttributeError on bare-list top-level input
(data.get() on a list); fixed to dispatch on isinstance(data, list)
before calling .get(). No spec change — bare-list handling is implied
by the original docstring's "data if isinstance(data, list)" branch.
- Kyverno _to_pcr({}) defaults result to "skipped" (entry.get("result",
"skip") -> "skip"), not "error"; test expectation corrected. Added an
explicit unknown-result-string test to cover the "error" fallback.
---ci---
project: acdl
phase: 23
milestone: v1.7
status: execute
---/ci---
|
2026-07-22 20:00:46 +00:00 |
|
|
Jon Chery
|
6ed93f0311
|
phase: 7, status: plan-as-execute, persona: security-engineer, task: T-7.4..T-7.8
---ci---
project: acdl
phase: 7
milestone: v1.1
status: plan-as-execute
persona: security-engineer
task: [T-7.4, T-7.5, T-7.6, T-7.7, T-7.8]
requirements.covered: [REQ-18, REQ-20, REQ-21]
---/ci---
Wave 3 (security-engineer, 5 files sequential):
- T-7.4: schemas/policy_check_result.schema.json (REQ-18 schema half) —
canonical shape from ARCHITECTURE.md §12.6; engine enum
[checkov,kyverno,opa]; severity enum [critical,high,medium,low,info];
result enum [pass,fail,skipped,error]. Validates as Draft 2020-12;
valid instance validates.
- T-7.5: adapters/terraform/policy/checkov_adapter.py (REQ-18 adapter
half) — Checkov JSON -> PolicyCheckResult; RULE_MAP has all 11 Checkov
rule IDs (CKV_AWS_41/45/46/20/57/24/25/1/40/7/33) mapped to the 4 L2
checks + tag/naming; emits ACDL_TAG_NAMING SKIPPED per D-043; stdlib
only; tolerates both Checkov JSON shapes. Synthetic fixture produces 3
records all valid against the schema.
- T-7.6: platform/audit_ledger_design.md (REQ-20) — three tiers (S3
Object Lock compliance 7yr, acdl-evidence hot index, DynamoDB outbox
RPO=0); spike scope (D-041) = hash chain + outbox write; v1.2 build-out
= Object Lock + JWS (KMS key, quarterly rotation) + async worker + DLQ
+ daily checkpoints. Outbox item shape, RPO/RTO table, decision trail.
- T-7.7: platform/hitl_matrix_design.md (REQ-21 design half) —
pre-execution gate model; Gitea-specific mechanics (workflow_dispatch +
gitea.actor per D-042, no Environments API); full 8-concern matrix
verbatim from §10.4; timeout 1d warn / 2d freeze; rejection -> HELD +
supersedes; CODEOWNERS routing; SoD pointer to the .py.
- T-7.8: platform/separation_of_duties.py (REQ-21 impl half) —
check(outbox_client, contract_id, current_prod_approver) -> (ok,
reason); None outbox -> no-op; equal -> SEPARATION_OF_DUTIES_VIOLATION;
distinct -> ok; route_halt_artifact stub; stdlib only (duck-typed
outbox_client). All 5 SoD cases verified.
|
2026-07-21 18:45:28 +00:00 |
|