CAP-025 (local tier) asserts the pilot-apply pipeline is structurally
ready: run_platform.sh steps present, core pipeline modules importable,
dev env bound to 581513795199 (D-203), dynamodb L1 registered (REQ-322),
pilot policies authored (REQ-315/320), outcome backfill present (REQ-317).
Returns Verified on the current branch (all W2/W3/W4 dependencies in
place). Added to CAPABILITY_REGISTRY. The live apply (P4) exercises this
end-to-end against AWS.
---ci---
project: acdl
phase: 3
milestone: v1.26
status: execute
wave: W5
---
The adapter reads env.state_backend.bucket from the env JSON when present
(fallback to the computed nova-tfstate-{account_id}-{region} pattern for
backwards compat). dev.json bound to the real account 581513795199 +
bucket nova-tfstate-581513795199-us-east-1 (D-203). qa/prod/dr stay
placeholder (account_id 000000000000 — the pilot-readiness policy blocks
apply on placeholder, D-208). dynamodb added to the adapter test
EXPECTED_L1_KEYS + a resolution/emission test.
---ci---
project: acdl
phase: 3
milestone: v1.26
status: execute
wave: W3
---
REQ-317: core/metrics/outcome_backfill.py backfills fact_decision.outcome
pending -> succeeded/failed after run.completed/run.failed; idempotent +
terminal (does not overwrite a non-pending outcome); wired into the
collector. The Post-Pilot AI Decision Accuracy denominator is now grounded
(fact_decision.outcome is not stuck pending).
REQ-318: ai.decision.made on a block band carries escalation_reason:
'confidence' (the only value in v1.26 — a block is always confidence-
driven; future milestones may add 'policy'). Persisted into fact_run by
the collector. The Post-Pilot Human Escalation Frequency denominator is
now grounded.
---ci---
project: acdl
phase: 3
milestone: v1.26
status: execute
wave: W2
---
Pre-existing failures uncovered by running the full suite with kj installed
+ disk freed (the P2 verify missed these):
- dynamodb L1: rename simple.yaml -> simple.yml + add complex.yml (module-standards
expects both .yml extensions; the P2 author used .yaml)
- sync_workflows: re-sync ci.yml drift (.github + .gitea <- workflows-src)
- CAP-024 deck path: nova-autonomous-cloud-delivery.md was consolidated to
-marp.md in v1.25 P1 (commit a47c162) but test + regression_verify still
pointed at the old path; update both + relax slide-count bound (18-20) +
count class="benefit" divs (marp format, not the old 'Benefit:' text)
---ci---
project: acdl
phase: 3
milestone: v1.26
status: execute
wave: W0.5
---
---
ci---
project: acdl
phase: 67
milestone: v1.12
status: execute
---
/ci---
CAP-013 (REQ-129): adapter dedup logic collapsed multi-resource L1s
(ecs-service, alb) to one module block named after the first sub-resource
id, but stack outputs + cross-module refs used the expanded sub-ids
(e.g. service-service, alb-targetgroup). terraform validate failed:
'No module call name'. Fix: name merged module by the composition child
id (common-prefix heuristic), build id_remap, rewrite stack-output 'from'
ids + ref: input targets through id_remap before emitting. terraform
validate now succeeds for the microservice stack. Adapter 236->192 lines
(still < 200 line gate).
CAP-017 (REQ-130): regression probe required locals.tf for every L1 module,
but the rds module legitimately omits it (no local.* refs). Fix: make
locals.tf conditional on the module referencing local.* values.
CAP-018 (REQ-130): regression probe called LocalLambdaStub() with no args,
but the dataclass requires an outbox field (since P53). Fix: construct a
FlatFileOutbox and pass it.
Regression gate (D-091) re-run: 22/22 Verified, 0 Broken. The decks can
now honestly claim 22/22 Verified (PRE_MORTEM.md FM-3 mitigation).
3 fixes found during the pipeline-readiness audit (all 24 example contracts
now resolve + adapt + pass --check-only):
1. core/contract_resolver.py: L1 resolver resource id now replaces underscores
with hyphens (task_definition → task-definition), matching the L2 resolver
pattern. The stack schema requires ^[a-z][a-z0-9-]*$ (no underscores).
2. schemas/stack.schema.json: relaxed input type constraint to allow array +
object (was string/number/boolean only). Real-world inputs include lists
(monitored_endpoints, static_checks, rules) and dicts (alert_channels).
3. scripts/run_platform.sh: AWS creds loading is now conditional — if
AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY are already set (by the CI
configure-aws-credentials action), skip loading .env.secrets. This makes
the --apply/--destroy modes work in CI without the gitignored secrets file.
Regression: 479 passed, 0 skipped, 5 deselected.
---ci---
project: acdl
phase: P59
milestone: v1.11
status: execute
---/ci---
Multi-persona review of the contract surface redesign (031887e + 10b87a6).
P0-1 (auto-fixed): scripts/run_platform.sh:437 read the uptime_enabled
feature flag from the OLD top-level contract.inputs.uptime_enabled path,
which P57 removed. With the new contract shape c.get('inputs',{}) returns
{} so the flag silently always defaulted to True — a consumer setting
uptime_enabled:false under infrastructure.<module>.inputs could NOT
disable uptime monitoring. Fixed to scan
infrastructure.<module>.inputs.uptime_enabled (any module false wins).
P0-2 (auto-fixed): docs/consumer-guide.md:417,472 documented the
${contract.module} interpolation token, but P57 dropped the `module`
field. _expand_vars fails loud (D-081) on unknown tokens, so a consumer
following the documented bucket_name example
(acdl-${env.environment}-${contract.module}-...) hit a hard ValueError
at resolve time. Replaced with ${contract.id} (the surviving short
acronym field) in both the example and the interpolation reference table.
P0-3 (auto-fixed): core/regression_verify.py CAP-006 and
tests/test_consumer_guide_per_env_section.py both asserted the dropped
${contract.module} token. Updated CAP-006 to use ${contract.id} and the
doc test to assert ${contract.id} present / ${contract.module} absent.
P1+ flags (post-hoc):
- P1: _namespace_resources does not rewrite ref: targets in
stack.outputs[].from for cross-module refs (within-module is handled;
multi-module refs across fragments are not wired today, but no
contract uses them yet).
- P1: _latest_version raises ValueError (not a clear message) on a
malformed semver string in the registry; the schema pins version to
^\d+\.\d+\.\d+$ so this is unreachable from a contract, but registry
authors have no guardrail.
- P2: docs/consumer-guide.md:407 example path uses .yaml extension while
the repo-wide rename standardized on .yml (consumer-repo paths, not
platform, so non-blocking).
---ci---
project: acdl
phase: 57
milestone: v1.10.2
status: verify
lessons:
- P0 fix applied: uptime_enabled read path migrated to infrastructure.<module>.inputs (was stale top-level contract.inputs)
- P0 fix applied: docs + tests migrated off dropped ${contract.module} interpolation token to ${contract.id}
---/ci---
Multi-persona review of the v1.10 milestone (6 commits, 23 files).
P0-1 (auto-fixed): TOCTOU race in LocalEcsEmulator.deploy() — opened a
socket to find a free port, closed it, then bound TCPServer to that
port. Between close and bind, another process could grab the port,
causing serve_forever to fail with OSError: Address already in use.
Fix: bind TCPServer directly to port 0 (OS assigns a free port
atomically); read the assigned port back from server_address[1].
P1-1 (auto-fixed, upgraded): run_local_e2e() called os.chdir() as a
side-effect without restoring the prior CWD. Fix: wrapped the body in
try/finally that restores prior_cwd on exit.
P2-1 (flagged): regression registry covers microservice + static-assets
but not uptime-kuma or RDS stacks. Recommend adding in a future patch.
P2-2 (flagged): _check_outbox_writer uses an f-string to embed a temp
path into a python3 -c command. Safe in practice but fragile by design.
Verified after fixes: 513 fast tests + 5 slow local E2E tests pass.
No regressions.
---ci---
project: acdl
phase: 0
milestone: v1.10
status: verify
lessons:
- P0 fix: TOCTOU race in LocalEcsEmulator.deploy() — bind to port 0
directly instead of open/close/rebind.
- P1 fix: os.chdir side-effect in run_local_e2e() — restore prior
CWD in a finally block.
- The regression registry should be expanded to cover all L2 stacks
(uptime-kuma, RDS) to prevent untested-stack regressions.
---/ci---
The platform is now fully locally testable without cloud credentials.
The headline E2E (contract -> resolver -> adapter -> S3 state -> ECS
service -> DynamoDB outbox -> contract-ingestor Lambda) runs end-to-end
against the local emulating tier (D-092, REQ-113).
Four local emulating adapters in core/local_emulators.py:
- FlatFileOutbox: flat-file DynamoDB outbox emulator (hash-chained JSONL;
resumable across instances; chain verification).
- LocalEcsEmulator: local ECS Fargate HTTP 200 emulator (free-port
binding on 127.0.0.1; health check; clean destroy).
- LocalS3StateBackend: rewrites the terraform S3 backend to a local
backend (per-stack tfstate in a temp folder).
- LocalLambdaStub: invokes the contract_ingestor handler in-process
(patches _get_dynamodb / _get_secrets_client / urllib.urlopen;
DynamoDB writes redirected to the FlatFileOutbox).
run_platform.sh gains a --local flag that short-circuits to the local
emulating tier (no AWS, no Checkov, no DynamoDB).
Regression gate (D-091) now covers 12 capabilities (was 10): +CAP-011
(local E2E microservice) + CAP-012 (local E2E static-assets).
Verified: 513 fast tests pass (was 502; +11 new). 2 slow local E2E
tests pass. run_regression.sh reports 12/12 Verified. run_platform.sh
--local exits 0 with LOCAL E2E OK. No AWS credentials required.
---ci---
project: acdl
phase: 53
milestone: v1.10
status: verify
requirements:
covered: [REQ-113]
partial: []
decisions: [D-092]
regression:
- { capability: CAP-011, status: Verified }
- { capability: CAP-012, status: Verified }
---/ci---
---ci---
project: acdl
phase: 32
milestone: v1.8
status: execute
---/ci---
- All 11 L1 primitives now have deletion_protection NFR (boolean, default true).
- Adapter emits `lifecycle { prevent_destroy = true }` when NFR is true;
omits it when false. Default is true when NFR is absent.
- L2 composition resolver propagates inputs.deletion_protection to all
children NFRs. When false, all resources get deletion_protection=false.
- Stack schema updated with optional features object (deletion_protection,
uptime_enabled).
- Contract schema description updated to document deletion_protection
and uptime_enabled inputs.
Tests: +5 (307 -> 312). All pass.
---ci---
project: acdl
phase: 30
milestone: v1.8
status: execute
---/ci---
P1-8: run_platform.sh now emits adapter output to $WORK/tf (per-run temp
dir), not the committed terraform/spike/ directory. The committed
terraform/spike/*.tf files are removed — they were scratch artifacts.
Deploy workflow artifact upload path updated to /tmp/acdl_platform_run_v18/tf/.
P1-9: contract_ingestor.py now reads GITHUB_API_BASE env for forge-agnostic
API URLs. _forge_type() detects GitHub vs Gitea. Search URL is branched
(GitHub uses /search/issues, Gitea uses /repos/{owner}/{repo}/issues).
S1: Deploy workflow configure-aws-credentials step restructured as a single
conditional step. OIDC when no static key (role-to-assume), static-key
when ACDL_AWS_ACCESS_KEY_ID present (access-key-id/secret-access-key inputs).
Both deploy workflows remain byte-identical.
Tests: +8 (292 -> 300). All pass. run_platform.sh --check-only green.
---ci---
project: acdl
phase: 29
milestone: v1.8
status: execute
---/ci---
P1-3: SSM publisher now raises RuntimeError when ACDL_KMS_KEY_ID is
unset. ACDL_ALLOW_DEFAULT_KMS=1 escape hatch for local testing.
P1-6: consumer_invoke_policy.json now uses ${account_id} and ${region}
placeholders. Terraform renders them via data.aws_caller_identity +
data.aws_region + replace() at apply time. No more hardcoded 000000000000.
Tests: +7 (285 -> 292). All pass.
---ci---
project: acdl
phase: 26
milestone: v1.7
status: execute
---/ci---
The microservice pattern (and any L2 referencing multi-resource L1s like
vpc) failed at the adapter stage because the resolver emitted refs using
the child id (e.g. 'vpc') instead of the expanded sub-resource id (e.g.
'vpc-subnet'). The adapter's type_by_id table only knows the sub-resource
ids, so ref:vpc.subnet_ids was an unknown resource id.
Fix:
- contract_resolver.py: child_outputs now maps {outputName -> resourceId}
instead of just the interface outputs dict. For multi-resource L1s, the
ref uses the sub-resource id that produces the output. For single-resource
L1s, the resourceId == childId (unchanged behavior).
- vpc interface.json: the subnet sub-resource output is 'subnet_ids'
(matching the interface-level output name) instead of 'subnet_id'.
- adapter.py OUTPUT_MAP: aws:ec2:subnet now maps both 'subnet_ids' and
'subnet_id' to 'id'.
Verification:
- microservice pattern check-only: PASS (11 resources)
- static-assets pattern check-only: PASS (4 resources)
- platform check-only: PASS
- full test suite: 266 passed
Phase 24 — platform-lambda-and-contract-ingestion.
- core/lambda/contract_ingestor.py: AWS Lambda handler invoked via Function
URL (IAM auth). Parses JSON body, validates required fields, writes the
contract to DynamoDB table acdl-contracts (PK consumerRepo, SK
contractId#submittedAt, status submitted, ISO-8601 submittedAt). report_error
action is a stub returning "error_report_prepared"; GitHub issue creation is
wired in Phase 25. Returns 400 on missing fields / unknown action, 500 on
error. Table name + GitHub-token secret ID come from env (set by Terraform).
- core/lambda/__init__.py: empty package marker.
- terraform/platform/main.tf: DynamoDB acdl-contracts (PITR, SSE via CMK),
KMS customer-managed key with alias/acdl-platform, Secrets Manager secret
acdl/github-token, IAM execution role (DynamoDB write + Secrets Manager read +
KMS decrypt + CloudWatch logs), Lambda acdl-contract-ingestor (Python 3.12,
handler contract_ingestor.lambda_handler), Function URL with AWS_IAM auth.
State key platform/terraform.tfstate (distinct from spike/microservice).
- terraform/platform/README.md: documents what it deploys, the state key, how
to apply, and the cross-account invocation model.
- terraform/platform/consumer_invoke_policy.json: ABAC-scoped policy template
applied to consumer deploy roles during onboarding; grants
lambda:InvokeFunctionUrl conditioned on aws:PrincipalTag/acdl:owner ==
consumerRepo.
- tests/test_contract_ingestor.py: 11 tests (moto-backed DynamoDB mock) covering
submit_contract put_item shape, report_error stub, missing-field 400, unknown
action 400, the lambda_handler wrapper with a Function-URL-style event, dict
body, default action, and internal-error 500.
- docs/environments/index.md: new section documenting the cross-account
contract-ingestion grant (one-way consumer→platform, D-051) and that
onboarding now also grants the consumer deploy role InvokeFunctionUrl.
- scripts/run_ci.sh, pipelines/ci.yaml, .gitea/workflows/ci.yml,
.github/workflows/ci.yml: add core/lambda/contract_ingestor.py to the lint
py_compile list. The two workflow YAMLs remain byte-identical.
Verification: scripts/run_ci.sh passes all 3 stages (lint/test/check-only);
python3 -m pytest tests/ -v passes all 213 tests (11 new + 202 existing).
---ci---
project: acdl
phase: 24
milestone: v1.7
status: execute
---/ci---
---ci---
phase: 21
milestone: v1.6
status: verify
lessons:
- P0 fix: docs/_config.yml had conflicting theme + remote_theme (would
break the GitHub Pages build). Removed the conflicting theme: key,
kept remote_theme: minimal-mistakes.
- P2 fix: removed unused json + os imports from core/environment_check.py.
---/ci---
Multi-persona review of v1.6 phase 21 (docs restructure + core rename +
environments scaffold).
P0 (blocking) — AUTO-FIXED:
- M1: docs/_config.yml declared both and
. Jekyll rejects using
both; the Pages build would fail. Fixed: removed the line,
kept (minimal-mistakes, which provides the
layout the defaults reference).
P2 (nits) — AUTO-FIXED:
- M2: core/environment_check.py imported + but never used
them. Removed.
P1 (important) — FLAGGED FOR POST-HOC REVIEW (do not block ship):
- C1 (pre-existing, from v1.5 review C2): .github/workflows/deploy.yml
checks out the platform repo at , but no floating tag
exists (only v1.4.0 / v1.4.1). Operator must create a floating v1.4
tag or change the ref to v1.4.1 (or v1.6.0 now that it exists). The
consumer guide + sample contract also reference @v1.4.
- C2: docs/_config.yml key is not a standard minimal-mistakes
navigation config (that theme reads _data/navigation.yml). The
key is harmless metadata but won't render a real nav. Recommend adding
docs/_data/navigation.yml for the theme, or switching to a theme that
reads from _config.yml. Non-blocking for the docs content.
- S1 (pre-existing, from v1.5 review S1): the static-key override in
deploy.yml sets ACDL_AWS_ACCESS_KEY_ID/ACDL_AWS_SECRET_ACCESS_KEY as env
vars on the configure-aws-credentials step, but that action reads AWS_*
or its own access-key/secret-key inputs, not ACDL_AWS_*. The override
is not actually wired. Phase 21 did not touch this step.
Verified: byte-identical workflows (CI + deploy); dev.json valid JSON;
all core Python compiles; path-traversal on --env is safe (no file match
-> onboarding prompt, exit 1); all docs internal links resolve; 166
tests pass; run_ci.sh green. The run_platform.sh env-check ordering is
correct (default contract is assigned before the env check runs).
---ci---
project: acdl
phase: 21
milestone: v1.6
status: execute
---/ci---
Introduce platform-managed environments: a consumer does not provide an
AWS account, VPC, subnet, S3 state bucket, or runner key. A named
environment is a platform-owned bundle of account + network + state
backend + IAM role (surfaced via ABAC), selected by name in the contract.
Scaffold:
- core/environments/dev.json (sample dev env definition)
- core/environments/README.md (how envs are used + how to add one)
- core/environment_check.py (reads a contract's environment field,
looks up core/environments/<name>.json, prints a friendly onboarding
prompt when none exists, exits non-zero)
- scripts/run_platform.sh: Step 0 calls environment_check.py before
contract validation; a missing env halts the pipeline with the
onboarding prompt
- tests/test_environment_check.py: 12 tests (dev bound, missing env ->
onboarding prompt, onboarding message lists provisions, contract
paths, wire-in, check-only still passes)
Tests: 166 pass (154 + 12 new).
---ci---
project: acdl
phase: 21
milestone: v1.6
status: execute
---/ci---
Rename the acdl_platform/ package to core/ across the directory, all
imports in tests/scripts/pipelines/workflows, and doc references. The
package is imported as core.confidence_signal / core.contract_resolver /
core.outbox_writer. The deploy workflow's platform-repo checkout dir is
renamed acdl-platform/ -> platform/ (workspace path, not the python
package). Both .gitea + .github workflows stay byte-identical.
Note: the original target name 'platform/' shadows Python's stdlib
platform module (pytest's import uuid -> platform.system() fails when
the repo root is on sys.path, which every test does). 'core/' avoids
the clash while honoring the intent (drop the verbose acdl_platform).
Tests: 154 pass. run_ci.sh green.
Jon Chery