2 Commits

Author	SHA1	Message	Date
Jon Chery	de91a4bb76	feat(P31): encryption-by-default + per-stack CMK (REQ-83, REQ-84, REQ-85) ... ---ci--- project: acdl phase: 31 milestone: v1.8 status: execute ---/ci--- - New kms-key L1 primitive (aws:kms:key) with enable_key_rotation=true (AWS-managed annual rotation, D-075). Registered in registry.json. - Adapter TYPE_MAP expanded for aws:kms:key + aws:kms:alias. - Adapter emits enable_key_rotation from NFR. - S3 adapter emits server_side_encryption_configuration with KMS when kms_key_arn provided; managed KMS fallback with stderr warning when not. - All 10 existing L1 primitives now have encryption_enabled NFR (default true). - s3, rds, ecr, ecs-service, ecs-cluster have kms_key_arn input. - Both L2 compositions (static-assets, microservice) now include a kms-key child + wires connecting kms_key_arn to children. - L2 stack outputs include kms_key_arn. Tests: +7 (300 -> 307). All pass. run_platform.sh --check-only green (static-assets now resolves to 5 resources with the CMK).	2026-07-22 22:11:03 +00:00
Jon Chery	a9d8b31595	feat(P27): RDS primitive + adapter expansion (D-059) ... Add modules/l1/rds/ with interface.json (engine enum for postgres, mysql, mariadb, sqlserver, oracle), instance.json, README.md (full template with compliance extension points). Register in registry.json. Expand the adapter TYPE_MAP/INPUT_MAP/OUTPUT_MAP for aws:rds:instance -> aws_db_instance; emit backup_retention_period, deletion_protection, storage_encrypted, and skip_final_snapshot from NFRs/inputs. Add RDS to the primitives-plan matrix. Update tests for the new registry entry count (12) + RDS adapter emission. ---ci--- project: acdl phase: 27 milestone: v1.7 status: execute ---/ci---	2026-07-22 20:21:45 +00:00