68d90c08a7
phase: 7, status: plan-as-execute, persona: backend-engineer+security-engineer, task: T-7.9
...
---ci---
project: acdl
phase: 7
milestone: v1.1
status: plan-as-execute
persona: backend-engineer+security-engineer
task: T-7.9
requirements.covered: [REQ-19]
---/ci---
Wave 4 (co-authored): platform/confidence_signal.py (REQ-19).
backend-engineer: 6-input weighted sum (WEIGHTS = policy 0.30,
validation 0.25, freshness 0.10, source 0.15, history 0.10, nfrs 0.10 per
D-040; sums to 1.0), per-env thresholds (dev 0.50, qa 0.75, prod 0.90,
dr 0.95), _per_input_score rules, compute() orchestration, Signal
dataclass, dev-warn->block flip (autonomous, no reviewer).
security-engineer: PENALTY dict (critical=None hard-override sentinel,
high 0.20, medium 0.05, low 0.01, info 0.0), critical-override
short-circuit return in compute(), severity penalty loop over the
policy input's failing PolicyCheckResult records.
Verified: missing input -> block + INPUT_MISSING:<name>; critical fail
-> 0.0 block + CRITICAL_OVERRIDE:<ruleId>; cold-start spike dev (ACDL
_TAG_NAMING skipped, all validation true, nfrs neutral 0.5) -> 0.95 pass.
stdlib only.
2026-07-21 18:46:13 +00:00
6ed93f0311
phase: 7, status: plan-as-execute, persona: security-engineer, task: T-7.4..T-7.8
...
---ci---
project: acdl
phase: 7
milestone: v1.1
status: plan-as-execute
persona: security-engineer
task: [T-7.4, T-7.5, T-7.6, T-7.7, T-7.8]
requirements.covered: [REQ-18, REQ-20, REQ-21]
---/ci---
Wave 3 (security-engineer, 5 files sequential):
- T-7.4: schemas/policy_check_result.schema.json (REQ-18 schema half) —
canonical shape from ARCHITECTURE.md §12.6; engine enum
[checkov,kyverno,opa]; severity enum [critical,high,medium,low,info];
result enum [pass,fail,skipped,error]. Validates as Draft 2020-12;
valid instance validates.
- T-7.5: adapters/terraform/policy/checkov_adapter.py (REQ-18 adapter
half) — Checkov JSON -> PolicyCheckResult; RULE_MAP has all 11 Checkov
rule IDs (CKV_AWS_41/45/46/20/57/24/25/1/40/7/33) mapped to the 4 L2
checks + tag/naming; emits ACDL_TAG_NAMING SKIPPED per D-043; stdlib
only; tolerates both Checkov JSON shapes. Synthetic fixture produces 3
records all valid against the schema.
- T-7.6: platform/audit_ledger_design.md (REQ-20) — three tiers (S3
Object Lock compliance 7yr, acdl-evidence hot index, DynamoDB outbox
RPO=0); spike scope (D-041) = hash chain + outbox write; v1.2 build-out
= Object Lock + JWS (KMS key, quarterly rotation) + async worker + DLQ
+ daily checkpoints. Outbox item shape, RPO/RTO table, decision trail.
- T-7.7: platform/hitl_matrix_design.md (REQ-21 design half) —
pre-execution gate model; Gitea-specific mechanics (workflow_dispatch +
gitea.actor per D-042, no Environments API); full 8-concern matrix
verbatim from §10.4; timeout 1d warn / 2d freeze; rejection -> HELD +
supersedes; CODEOWNERS routing; SoD pointer to the .py.
- T-7.8: platform/separation_of_duties.py (REQ-21 impl half) —
check(outbox_client, contract_id, current_prod_approver) -> (ok,
reason); None outbox -> no-op; equal -> SEPARATION_OF_DUTIES_VIOLATION;
distinct -> ok; route_halt_artifact stub; stdlib only (duck-typed
outbox_client). All 5 SoD cases verified.
2026-07-21 18:45:28 +00:00
e044a2de0d
phase: 6, status: plan-as-execute, persona: lead-developer, task: T-6.1..T-6.4
...
---ci---
project: acdl
phase: 6
milestone: v1.1
status: plan-as-execute
persona: lead-developer
tasks: [T-6.1, T-6.2, T-6.3, T-6.4]
---/ci---
Archive the v1.0 demo under demo/ (D-037) and reorient the repo to the
real platform. Wave 1 of the Phase 06 plan.
- T-6.1: git mv modules/, scripts/, evidence-ui/, contracts/,
contracts-repo/, .gitea/ -> demo/; mv ACDL_DEMO.md + runner-data/ -> demo/
- T-6.2: scaffold new v1.1 top-level dirs (platform/, schemas/, adapters/,
terraform/, modules-ir/) with .gitkeep
- T-6.3: create top-level scripts/verify_phase06.sh (v1.1 verify scripts
live at top-level, NOT demo/scripts/ which holds the v1.0 demo verify
scripts)
- T-6.4: rewrite README.md to reflect the real platform (vision +
architecture links, new layout, status v1.1 active); add runner-data/
to .gitignore
All moves via git mv (history preserved). Repo root now contains only
README.md, demo/, docs/, .ciagent/, and the new empty v1.1 dirs.
2026-07-21 18:27:21 +00:00
Jon Chery