Phase 24 — platform-lambda-and-contract-ingestion.
- core/lambda/contract_ingestor.py: AWS Lambda handler invoked via Function
URL (IAM auth). Parses JSON body, validates required fields, writes the
contract to DynamoDB table acdl-contracts (PK consumerRepo, SK
contractId#submittedAt, status submitted, ISO-8601 submittedAt). report_error
action is a stub returning "error_report_prepared"; GitHub issue creation is
wired in Phase 25. Returns 400 on missing fields / unknown action, 500 on
error. Table name + GitHub-token secret ID come from env (set by Terraform).
- core/lambda/__init__.py: empty package marker.
- terraform/platform/main.tf: DynamoDB acdl-contracts (PITR, SSE via CMK),
KMS customer-managed key with alias/acdl-platform, Secrets Manager secret
acdl/github-token, IAM execution role (DynamoDB write + Secrets Manager read +
KMS decrypt + CloudWatch logs), Lambda acdl-contract-ingestor (Python 3.12,
handler contract_ingestor.lambda_handler), Function URL with AWS_IAM auth.
State key platform/terraform.tfstate (distinct from spike/microservice).
- terraform/platform/README.md: documents what it deploys, the state key, how
to apply, and the cross-account invocation model.
- terraform/platform/consumer_invoke_policy.json: ABAC-scoped policy template
applied to consumer deploy roles during onboarding; grants
lambda:InvokeFunctionUrl conditioned on aws:PrincipalTag/acdl:owner ==
consumerRepo.
- tests/test_contract_ingestor.py: 11 tests (moto-backed DynamoDB mock) covering
submit_contract put_item shape, report_error stub, missing-field 400, unknown
action 400, the lambda_handler wrapper with a Function-URL-style event, dict
body, default action, and internal-error 500.
- docs/environments/index.md: new section documenting the cross-account
contract-ingestion grant (one-way consumer→platform, D-051) and that
onboarding now also grants the consumer deploy role InvokeFunctionUrl.
- scripts/run_ci.sh, pipelines/ci.yaml, .gitea/workflows/ci.yml,
.github/workflows/ci.yml: add core/lambda/contract_ingestor.py to the lint
py_compile list. The two workflow YAMLs remain byte-identical.
Verification: scripts/run_ci.sh passes all 3 stages (lint/test/check-only);
python3 -m pytest tests/ -v passes all 213 tests (11 new + 202 existing).
---ci---
project: acdl
phase: 24
milestone: v1.7
status: execute
---/ci---
---ci---
phase: 21
milestone: v1.6
status: verify
lessons:
- P0 fix: docs/_config.yml had conflicting theme + remote_theme (would
break the GitHub Pages build). Removed the conflicting theme: key,
kept remote_theme: minimal-mistakes.
- P2 fix: removed unused json + os imports from core/environment_check.py.
---/ci---
Multi-persona review of v1.6 phase 21 (docs restructure + core rename +
environments scaffold).
P0 (blocking) — AUTO-FIXED:
- M1: docs/_config.yml declared both and
. Jekyll rejects using
both; the Pages build would fail. Fixed: removed the line,
kept (minimal-mistakes, which provides the
layout the defaults reference).
P2 (nits) — AUTO-FIXED:
- M2: core/environment_check.py imported + but never used
them. Removed.
P1 (important) — FLAGGED FOR POST-HOC REVIEW (do not block ship):
- C1 (pre-existing, from v1.5 review C2): .github/workflows/deploy.yml
checks out the platform repo at , but no floating tag
exists (only v1.4.0 / v1.4.1). Operator must create a floating v1.4
tag or change the ref to v1.4.1 (or v1.6.0 now that it exists). The
consumer guide + sample contract also reference @v1.4.
- C2: docs/_config.yml key is not a standard minimal-mistakes
navigation config (that theme reads _data/navigation.yml). The
key is harmless metadata but won't render a real nav. Recommend adding
docs/_data/navigation.yml for the theme, or switching to a theme that
reads from _config.yml. Non-blocking for the docs content.
- S1 (pre-existing, from v1.5 review S1): the static-key override in
deploy.yml sets ACDL_AWS_ACCESS_KEY_ID/ACDL_AWS_SECRET_ACCESS_KEY as env
vars on the configure-aws-credentials step, but that action reads AWS_*
or its own access-key/secret-key inputs, not ACDL_AWS_*. The override
is not actually wired. Phase 21 did not touch this step.
Verified: byte-identical workflows (CI + deploy); dev.json valid JSON;
all core Python compiles; path-traversal on --env is safe (no file match
-> onboarding prompt, exit 1); all docs internal links resolve; 166
tests pass; run_ci.sh green. The run_platform.sh env-check ordering is
correct (default contract is assigned before the env check runs).
---ci---
project: acdl
phase: 20
milestone: v1.5
status: review
verdict: READY TO SHIP
p0: 1 (fixed — contract path resolution in deploy workflow)
p1: 6 (flagged post-hoc)
---/ci---
Multi-persona review of v1.5 phase 20 (docs + reusable deploy workflow).
P0 (blocking) — AUTO-FIXED:
- C1: scripts/run_platform.sh contract path resolution broken in deploy
workflow. The reusable workflow invokes run_platform.sh from the consumer
workspace root with a relative contract path (.acdl/contract.yaml), but
run_platform.sh does `cd "$ROOT"` (platform repo) early, so the relative
path resolved against the platform repo and the pipeline could never run.
Fix (commit 75c2274): capture CALLER_CWD before cd "$ROOT"; resolve
caller-supplied relative paths against CALLER_CWD; default no-arg contract
stays relative to ROOT (preserves platform-local CI). Reproduced pre-fix;
verified post-fix.
P1 (important) — FLAGGED FOR POST-HOC REVIEW (do not block ship):
- C2: ref: v1.4 in the deploy workflow platform checkout — no v1.4 tag exists
(only v1.4.0 / v1.4.1). Operator must create a floating v1.4 tag or change
the ref to v1.4.1.
- C3: modules/l2/{static-asset,microservice}/README.md still use @v1 in their
Usage examples; missed by the v1.4 bump.
- S1: static-key override is not wired. ACDL_AWS_* env vars on the OIDC step
are not read by aws-actions/configure-aws-credentials@v4 (it reads AWS_*
or its own access-key/secret-key inputs). The README/CONSUMER_GUIDE claim
a working override that doesn't function as written. Needs a conditional
step or renamed env vars + input wiring.
- S2: README overstates ABAC repo:org/repo:ref:... scoping. The workflow
constructs a numeric role name (github.repository_id); the actual claim
enforcement lives in the IAM trust policy, not in this workflow.
- T1: no deploy-workflow triggers conformance test (CI workflow has one;
deploy doesn't). Minor — reusable workflows use workflow_call, not push
triggers, but the contract's triggers field is then unenforced.
- A1: terraform/spike/terraform.tf uploaded as artifact leaks the AWS account
ID via the state-backend bucket name. Recommend excluding terraform.tf or
gating artifact upload to non-public repos.
P2 (nits) — listed for awareness: floating-tag terminology imprecision (M1),
header comment "Gitea Actions" in the GitHub copy (M2, intentional byte-
identical), pip install split (P1-perf), comment drift in pipelines/deploy.yaml
header (C4), module README internal inconsistency (C5).
Verdict: READY TO SHIP. The one P0 is fixed. The 6 P1s are post-hoc items —
the deploy workflow is a scaffold whose first real consumer run requires
operator setup (tag, IAM role, secrets) that gates go-live. The P1s should
be addressed before any consumer invokes uses: acdl/.gitea/workflows/
deploy.yml@v1.4 in earnest.
Tests: 154 pass (19 new). run_ci.sh green.
Jon Chery
grimacing