 Jon Chery
|
f83b974c0e
|
Merge milestone/v1.16-nova-simplification — v1.16 complete (Nova Simplification: 20-phase NFR sweep + final; tag v1.15.26)
acdl-ci / Lint (push) Successful in 11s
acdl-ci / Platform check-only (offline) (push) Successful in 29s
acdl-ci / Test (push) Failing after 7m25s
|
2026-08-01 13:37:18 +00:00 |
|
|
Jon Chery
|
3b1181f39b
|
Merge milestone/v1.14-refinement — v1.14 complete (NFR Refinement: bug fixes, security, stubs, tests, docs; 20 phases + final; tag v1.13.24)
acdl-ci / Lint (push) Successful in 10s
acdl-ci / Platform check-only (offline) (push) Successful in 25s
acdl-ci / Test (push) Successful in 6m34s
v1.14 NFR Refinement milestone complete. 20 execution phases (P1-P20) +
1 final (P21). All P1/P2 backlog from v1.11 review resolved. Security
posture hardened (swallowed errors, account ID externalized, IAM scoped,
schema validation, credential hygiene). Stubs resolved (kyverno --kube-
version removed). 7 untested scripts gained coverage. Documentation
synced (ARCHITECTURE v1.11-v1.14 addenda, stale @v1.6-1.9 -> @v1.13,
GRILL G-005/G-008 resolved, COST.md window extended, D-083 deferral
recorded). Platform VPC parameterized.
561 tests pass (was 528 at v1.13.2; +33). 22/22 capabilities Verified.
6 grill binding decisions (G-101..G-106) applied. 1 escalation (E-001)
auto-resolved at full autonomy (D-101).
---ci---
project: acdl
phase: 21
milestone: v1.14
status: complete
---/ci---
|
2026-07-29 21:36:37 +00:00 |
|
|
Jon Chery
|
031887ec56
|
refactor(P57): contract surface redesign + rename + .yml repo-wide
Contract surface redesign:
- New top-level fields: id (3-6 char acronym → stack.name), name (full → stack.title),
infrastructure (map keyed by module name, replaces module:)
- Drop uses: field (dead reference; version pin lives in CI workflow uses: line)
- Drop top-level module/inputs (now nested under infrastructure map)
- Per-module optional version (defaults to latest published from registry)
- Multi-module contracts: one file deploys N modules in one pipeline run,
resource IDs namespaced with module name to avoid collisions
- stack.schema.json: add optional title field for display name
Rename:
- pipelines/deploy.yaml → pipelines/contract.yml (declarative spec, not a pipeline)
- pipelines/ci.yaml → pipelines/ci.yml
- All 44 .yaml files → .yml repo-wide (contracts, module examples, kyverno policies)
- .acdl/contract.yaml → .acdl/contract.yml
Resolver (core/contract_resolver.py):
- Rewrite resolve() to loop infrastructure map, default version to latest,
merge module fragments into one stack with namespaced resource IDs
- _latest_version() picks highest non-deprecated from registry
- _namespace_resources() prefixes IDs + rewrites ref: expressions for multi-module
- Single-module path: unprefixed IDs (backward compatible)
Verification:
- 494 tests pass (0 contract-shape failures)
- Local E2E passes (contract → resolver → adapter → local ECS HTTP 200 → outbox)
---ci---
project: acdl
phase: 57
milestone: v1.10.2
status: execute
---/ci---
|
2026-07-27 21:37:40 +00:00 |
|
|
Jon Chery
|
e74a8c2f5d
|
feat(P42): stub implementation — SoD, HITL gates, attestation matrix, Wiz, Kyverno
---ci---
project: acdl
phase: 42
milestone: v1.9
status: execute
---/ci---
Phase 42 — stub-implementation (REQ-107..111, D-084):
route_halt_artifact (REQ-107):
- core/separation_of_duties.py: real SNS publish (ACDL_SOD_HALT_TOPIC_ARN)
+ outbox fallback (SEPARATION_OF_DUTIES_VIOLATION event via
outbox_writer) + stderr emission. No silent print-only stub.
- terraform/platform/main.tf: aws_sns_topic.acdl-sod-halt + output.
HITL attestation gates (REQ-108):
- core/hitl_gates.py: attest(contract_id, env, approver, evidence,
outbox_client) records approver_qa/approver_prod/approver_dr to
outbox, runs SoD check on prod, invokes attestation matrix, returns
(ok, reason). Dev skips (autonomous). approver_from_env() reads
GITHUB_ACTOR/GITEA_ACTOR.
- scripts/run_platform.sh: Step 7b HITL gate before apply for qa/prod/dr.
8-concern attestation matrix (REQ-109, D-084):
- core/attestation_matrix.py: check(env, evidence) runs the 8 concerns
from hitl_matrix_design.md §10.4. Offline-testable (contract_nfrs,
schema_validity, policy_pass) run for real. Operator-supplied accept
signed artifacts validated for freshness (FRESHNESS_DAYS table) +
schema. Signature skip when ACDL_ATTESTATION_SIGNING_KEY_ID unset
(D-089). Fail loud if missing/expired for prod/dr.
Wiz real client (REQ-110):
- adapters/wiz/wiz_adapter.py: WizClient (GraphQL API, Bearer auth,
pagination via pageInfo.hasNextPage + endCursor). fetch_and_adapt
translates issues → PolicyCheckResult; graceful degrade when
WIZ_API_TOKEN/WIZ_API_URL unset.
Kyverno fleshed out (REQ-111):
- adapters/kyverno/kyverno_adapter.py: full PolicyReport →
PolicyCheckResult mapping (pass/fail/skip/warn + severity + skip-with-
reason + resource ref construction from kind/name/namespace).
adapt_inactive() emits KYVERNO_INACTIVE_TF_STACK guard. --kube-version
stub parsed for future GitOps.
Tests: +47 (test_route_halt_artifact.py, test_hitl_gates.py,
test_attestation_matrix.py, test_wiz_adapter_real_client.py, expanded
test_kyverno_adapter.py). Existing wiz_adapter tests updated for the
real client's control.name ruleId. 493 passed; run_ci.sh green;
run_platform.sh --check-only green.
|
2026-07-23 04:40:44 +00:00 |
|
|
Jon Chery
|
1fd37a2843
|
feat(P23): tagging standard + Wiz adapter + Kyverno adapter
Phase 23 (v1.7) — tagging standards and security adapters.
* schemas/tagging-standard.json (D-054): canonical required-tags schema
(acdl:owner, acdl:contract, acdl:environment, acdl:cost-center).
* adapters/terraform/policy/custom_rules/acdl_tagging.py: Checkov custom
rule (ACDL_TAG_NAMING) loaded via --external-checks-dir; closes D-043
(synthetic SKIPPED record replaced by real PASS/FAIL records).
* checkov_adapter.py: removed _emit_tag_naming_skipped(), added
ACDL_TAG_NAMING to RULE_MAP, updated docstring.
* scripts/run_platform.sh: both Checkov invocations pass
--external-checks-dir adapters/terraform/policy/custom_rules/.
* adapters/wiz/ (D-052): Wiz adapter translating issue records to
PolicyCheckResult (engine: "wiz"); graceful degradation emits
WIZ_NOT_CONFIGURED SKIPPED when unconfigured; is_configured() gate.
* adapters/kyverno/ (D-053): Kyverno adapter translating PolicyReport
results to PolicyCheckResult (engine: "kyverno"); ready but inactive
for Terraform-only stacks; 3 sample ClusterPolicies in policies/.
* schemas/policy_check_result.schema.json: engine enum += "wiz".
* tests: fixtures + test_wiz_adapter.py (8 tests) + test_kyverno_adapter.py
(13 tests); updated test_checkov_adapter.py to not expect the removed
synthetic ACDL_TAG_NAMING SKIPPED record.
* scripts/run_ci.sh: lint stage compiles the new adapter modules.
202 tests pass; CI pipeline OK (lint + test + check-only).
Deviations:
- Wiz adapt() had an AttributeError on bare-list top-level input
(data.get() on a list); fixed to dispatch on isinstance(data, list)
before calling .get(). No spec change — bare-list handling is implied
by the original docstring's "data if isinstance(data, list)" branch.
- Kyverno _to_pcr({}) defaults result to "skipped" (entry.get("result",
"skip") -> "skip"), not "error"; test expectation corrected. Added an
explicit unknown-result-string test to cover the "error" fallback.
---ci---
project: acdl
phase: 23
milestone: v1.7
status: execute
---/ci---
|
2026-07-22 20:00:46 +00:00 |
|