Commit Graph

37 Commits

Author SHA1 Message Date
Jon Chery 97560e3c88 docs(grill): v1.17 binding decisions applied — 12 fixes (NORTH_STAR reclassification + deck plan rewrites)
NORTH_STAR-CHANGE: reclassify 3 targets to Post-Pilot section (E-003);
move AI-Agent Intent Share to Future Horizons (E-004).

GRILL binding decisions applied:
- G-Q4: D-122 honesty sentence on slide 7 (Nova's AI = confidence-gated policy engine, not LLM)
- G-Q5/G-Q15: derived metrics annotated with N=0 caveat; ROI formula shown inline on slide 13
- G-Q6: NORTH_STAR targets reclassified (3 to Post-Pilot, honesty note added)
- G-Q8: stake line (18V+0 consumers) added to slide 1
- G-Q9: 4 filler benefit closes rewritten (slides 1, 4, 13, 16)
- G-Q10: slide 12 split into Zero-Touch Efficiency + Cost & ROI (deck now 18 slides)
- G-Q11: preempt added to slide 14 (deferrals are measurement infra, not autonomy)
- G-Q13: Act 3->4 transition rewritten ('how it works' is not 'proof it works')
- G-Q14: slide 9 benefit reframed from data plumbing to trust substrate
- G-Q16: slide 16 ask reframed as business decision (approve pilot + ledger build-out)

---ci---
project: acdl
phase: 0
milestone: v1.17
status: grill
---/ci---
2026-08-04 19:44:28 +00:00
Jon Chery abbf8b69fb docs(P00): create phase plans — v1.17 8 phases, 4 waves, deck rebuild plan (15+2 slides)
---ci---
project: acdl
phase: 0
milestone: v1.17
status: plan
---/ci---
2026-08-04 19:16:35 +00:00
Jon Chery f83b974c0e Merge milestone/v1.16-nova-simplification — v1.16 complete (Nova Simplification: 20-phase NFR sweep + final; tag v1.15.26)
acdl-ci / Lint (push) Successful in 11s
acdl-ci / Platform check-only (offline) (push) Successful in 29s
acdl-ci / Test (push) Failing after 7m25s
2026-08-01 13:37:18 +00:00
Jon Chery d14b55b774 docs(P00): incorporate grill binding mitigations G-104/G-106/G-108
GRILL (ci-griller): 9 axes, 8 findings G-103..G-110, verdict
proceed-with-conditions (conf 0.82). 3 binding mitigations incorporated:
- G-104 (scope/technical, conf 0.90): re-tag Major milestone on its OWN
  minor line (v1.15.x), not the v1.14.x patch line (NFR convention).
  Precedent: v1.10.2→v1.11.0, v1.9.x→v1.10.0. Updated PLAN/ROADMAP/
  PROJECT/REQUIREMENTS/ARCHITECTURE tag refs: v1.15.0(P0)→v1.15.4(P5).
- G-106 (risk/technical, conf 0.88): .env.secrets direct-read paths
  (run_platform.sh:288-289 + regression_verify.py:309-312) bypass the
  core/env.py helper — P2 MUST dual-read these (NOVA_* first, ACDL_*
  fallback) or AWS creds vanish mid-rename. Bound in PLAN.md P2 task 2.
- G-108 (security, conf 0.80): CI workflow secrets: refs (deploy.yml +
  modules-lifecycle.yml, .gitea + .github) reference secrets.ACDL_* —
  P2 MUST update to secrets.NOVA_* in lockstep with Gitea secret
  creation. Bound in PLAN.md P2 task 3 (hard gate). 5 accepted-as-is
  findings (G-103/105/107/109/110), 0 open escalations.

---ci---
project: acdl
phase: 0
milestone: v1.15
status: grill
---/ci---
2026-07-30 00:40:35 +00:00
Jon Chery 533a9d7bcb docs(P00): create phase plans — v1.15-Nova (4 exec + 1 final)
PLAN.md: vertical-slice task decomposition for P1-P5. Wave ordering:
W1 docs/decks/prose (P1, lead-developer) → W2 code/env-vars/consumer-path
(P2, backend+lead, dual-read core/env.py helper D-108) → W3 ssm/tagkeys
(P3, data+backend, parallel-tag ABAC + nova_tagging hard mode) → W4
aws-resource-migration (P4, data+lead, staged terraform migration +
runbook) → W5 final-review-ship (P5, lead, remove dual-read fallback).
Binding constraint: regression gate stays 16/16 Verified throughout.
9 success criteria incl. grep-zero checks on ACDL_/acdl- remnants.

---ci---
project: acdl
phase: 0
milestone: v1.15
status: plan
---/ci---
2026-07-30 00:03:03 +00:00
Jon Chery 3b1181f39b Merge milestone/v1.14-refinement — v1.14 complete (NFR Refinement: bug fixes, security, stubs, tests, docs; 20 phases + final; tag v1.13.24)
acdl-ci / Lint (push) Successful in 10s
acdl-ci / Platform check-only (offline) (push) Successful in 25s
acdl-ci / Test (push) Successful in 6m34s
v1.14 NFR Refinement milestone complete. 20 execution phases (P1-P20) +
1 final (P21). All P1/P2 backlog from v1.11 review resolved. Security
posture hardened (swallowed errors, account ID externalized, IAM scoped,
schema validation, credential hygiene). Stubs resolved (kyverno --kube-
version removed). 7 untested scripts gained coverage. Documentation
synced (ARCHITECTURE v1.11-v1.14 addenda, stale @v1.6-1.9 -> @v1.13,
GRILL G-005/G-008 resolved, COST.md window extended, D-083 deferral
recorded). Platform VPC parameterized.

561 tests pass (was 528 at v1.13.2; +33). 22/22 capabilities Verified.
6 grill binding decisions (G-101..G-106) applied. 1 escalation (E-001)
auto-resolved at full autonomy (D-101).

---ci---
project: acdl
phase: 21
milestone: v1.14
status: complete
---/ci---
2026-07-29 21:36:37 +00:00
Jon Chery 93a659827e docs(P65): create phase plan — rewrite caps + decks
---ci---
project: acdl
phase: P65
milestone: v1.11
status: plan
---/ci---
2026-07-29 12:22:15 +00:00
Jon Chery 92bb03e808 docs(P64): create phase plan — pre-mortem + teardown
---ci---
project: acdl
phase: P64
milestone: v1.11
status: plan
---/ci---
2026-07-28 20:39:09 +00:00
Jon Chery adfcf86732 docs(P63): create phase plan — regression registry + cost docs
---ci---
project: acdl
phase: P63
milestone: v1.11
status: plan
---/ci---
2026-07-28 20:25:25 +00:00
Jon Chery 6441633568 docs(P62): create phase plan — L2 lifecycle pipeline live run
acdl-ci / Lint (pull_request) Successful in 7s
acdl-ci / Platform check-only (offline) (pull_request) Successful in 21s
acdl-modules-lifecycle / CI VPC apply (pull_request) Successful in 41s
acdl-ci / Test (pull_request) Successful in 4m15s
acdl-modules-lifecycle / L1 lifecycle (alb) (pull_request) Failing after 1m54s
acdl-modules-lifecycle / L1 lifecycle (cloudfront) (pull_request) Successful in 8m55s
acdl-modules-lifecycle / L1 lifecycle (ecr) (pull_request) Successful in 2m42s
acdl-modules-lifecycle / L1 lifecycle (ecs-cluster) (pull_request) Successful in 3m3s
acdl-modules-lifecycle / L1 lifecycle (iam-role) (pull_request) Successful in 2m41s
acdl-modules-lifecycle / L1 lifecycle (ecs-service) (pull_request) Successful in 4m3s
acdl-modules-lifecycle / L1 lifecycle (kms-key) (pull_request) Successful in 2m52s
acdl-modules-lifecycle / L1 lifecycle (s3) (pull_request) Successful in 2m50s
acdl-modules-lifecycle / L1 lifecycle (uptime) (pull_request) Successful in 4m18s
acdl-modules-lifecycle / L1 lifecycle (vpc) (pull_request) Successful in 2m48s
acdl-modules-lifecycle / L1 lifecycle (waf) (pull_request) Successful in 3m10s
acdl-modules-lifecycle / L2 lifecycle (microservice) (pull_request) Failing after 56s
acdl-modules-lifecycle / L2 lifecycle (static-assets) (pull_request) Failing after 54s
acdl-modules-lifecycle / L1 lifecycle (rds) (pull_request) Successful in 32m34s
acdl-modules-lifecycle / CI VPC destroy (pull_request) Failing after 20m32s
---ci---
project: acdl
phase: P62
milestone: v1.11
status: plan
---/ci---
2026-07-28 20:20:09 +00:00
Jon Chery 0c5c4d1c40 docs(P61): create phase plan — L2 lifecycle pipeline author
---ci---
project: acdl
phase: P61
milestone: v1.11
status: plan
---/ci---
2026-07-28 20:14:20 +00:00
Jon Chery e1bb214322 docs(P60): retrofit plan — L1 lifecycle pipeline live-run
P60's execute deliverable was produced out-of-band (13 fix commits on
milestone/v1.11-restart between P59 verify 3739037 and HEAD 88ea408,
committed under phase:P59/status:execute). This retrofit PLAN formalizes
that work as P60's EXECUTE output. No commits reverted — the fixes are
correct (terraform validate + 24 example contracts --check-only pass).

Live-AWS evidence: PR milestone/v1.11-restart -> main triggers the
acdl-modules-lifecycle workflow; green = P60 verify gate.

---ci---
project: acdl
phase: P60
milestone: v1.11
status: plan
---/ci---
2026-07-28 20:00:54 +00:00
Jon Chery 52df314dd8 docs(P59): create phase plan — L1 module lifecycle pipeline (author)
PLAN stage. P59 authors the modules-lifecycle pipeline that matrix-tests
every L1 module's examples/{simple,complex}.yml contracts through
apply→modify→destroy against live AWS. No per-module Python.

5 tasks: declarative contract, byte-identical Gitea+GitHub workflows,
schema, tests, README update.

---ci---
project: acdl
phase: P59
milestone: v1.11
status: plan
---/ci---
2026-07-28 16:07:57 +00:00
Jon Chery 962ba24379 docs(P58): create phase plan — single platform VPC + deterministic state keys
PLAN stage. P58 fixes the 4-VPC bug: adds a single shared VPC to
terraform/platform, drops the vpc child from the microservice composition
(references the platform VPC via data source), and makes state keys
env-aware (spike/{id}/{env}/terraform.tfstate — stable across lifecycle).

5 tasks: platform VPC, composition update, resolver environment passthrough,
adapter state key + data block emission, tests + regression.

---ci---
project: acdl
phase: P58
milestone: v1.11
status: plan
---/ci---
2026-07-28 16:07:57 +00:00
Jon Chery 5c1d5aaab5 docs(P57): create phase plan — shell orchestrator lifecycle modes
PLAN stage. P57 adds --apply and --destroy modes to run_platform.sh.
The shell owns all terraform lifecycle; Python never runs terraform.

4 tasks: add flags + lifecycle branches, update usage header, add tests,
offline regression.

---ci---
project: acdl
phase: P57
milestone: v1.11
status: plan
---/ci---
2026-07-28 16:07:57 +00:00
Jon Chery 8218734957 docs(P56b): create phase plan — author 11 L1 module terraform subdirs
PLAN stage. P56b authors the remaining 11 L1 module terraform subdirs
(vpc, ecs-cluster, ecs-service, iam-role, alb, ecr, cloudfront, waf, rds,
kms-key, uptime) with the full versions/variables/locals/main/outputs
split. Defaults move from the adapter into locals.tf.

7 single-resource modules (simpler): kms-key, ecr, ecs-cluster, iam-role,
rds, waf, uptime.
4 multi-resource modules (full split with intra-refs): vpc, ecs-service,
alb, cloudfront.

Success gate: all 12 terraform/ subdirs validate standalone, all 12
registry entries have terraform_dir, the 6 P56b-skipped tests unblock.

---ci---
project: acdl
phase: P56b
milestone: v1.11
status: plan
---/ci---
2026-07-28 16:07:57 +00:00
Jon Chery 1efb44444a docs(P56a): create v1.11 RESTART phase plan — stateless adapter + s3 reference
PLAN stage. P56a is the first phase of the v1.11 restart: rewrite the
918-line adapter monolith to a ~80-line stateless assembler, prove the
design with the s3 reference module.

6 tasks, single wave (no parallelization — one cohesive change):
1. s3 reference terraform module (versions/variables/locals/main/outputs)
2. Registry extension (terraform_dir field)
3. Stateless adapter rewrite (delete TYPE_MAP/INPUT_MAP/OUTPUT_MAP + 39 branches)
4. STANDARDS.md §8 rewrite (stateless assembler pattern)
5. test_adapter.py rewrite (assert assembly, not HCL strings)
6. Offline regression (pytest + run_primitive_plan.sh --check-only s3)

Success gate: adapter < 100 lines, no type-specific logic, s3 module
validates standalone, adapter-emitted root main.tf validates, offline
suite green.

---ci---
project: acdl
phase: P56a
milestone: v1.11
status: plan
---/ci---
2026-07-28 16:07:57 +00:00
Jon Chery 772ac721b0 docs(P52): create v1.10 milestone plan — pipeline regression fix + capability re-verification
---ci---
project: acdl
phase: 52
milestone: v1.10
status: plan
decisions: [D-090, D-091, D-092, D-093, D-094]
requirements: [REQ-112, REQ-113, REQ-114, REQ-115]
---/ci---
2026-07-27 17:10:09 +00:00
Jon Chery 58100c485e docs(P00): create 5 phase plans for v1.9 (phases 39-43)
---ci---
project: acdl
phase: 0
milestone: v1.9
status: plan
---/ci---

5 vertical-slice phases, wave-ordered:
- Wave 1 (parallel): Phase 39 (design docs + P1-1, disjoint file sets)
- Wave 2: Phase 40 (contract interpolation + env schema)
- Wave 3: Phase 41 (per-env CI jobs + env workflow input)
- Wave 4: Phase 42 (stubs: SoD, HITL gates, attestation matrix, Wiz, Kyverno)
- Wave 5: Phase 43 (verify + review + audit + complete)

Plans reference REQ-100..REQ-111. Decisions D-080..D-089 applied.
Versioning: feature milestone, patches v1.8.1..v1.8.5, tag v1.9.0 at COMPLETE.
2026-07-23 04:19:17 +00:00
Jon Chery 045c7279aa docs(P28-38): create 11 phase plans for v1.8
---ci---
project: acdl
phase: 28-38
milestone: v1.8
status: plan
---/ci---

11 phase plans created covering 24 requirements (REQ-76..99):
P28: adapter WAF + resolver outputs (P1-4,5,7)
P29: SSM KMS + invoke policy (P1-3,6)
P30: run-platform isolation + API portability + S1 (P1-8,9,S1)
P31: encryption-by-default + per-stack CMK
P32: deletion-protection-by-default + L2 feature flag
P33: uptime-kuma primitive + pipeline stage
P34: decommission alias + CMDB validation
P35: module engineering standards
P36: schemas/adapters/pipelines READMEs
P37: verify (4-layer)
P38: review-audit-complete
2026-07-22 22:02:09 +00:00
Jon Chery 64d35c78e6 docs(P16): plan-as-execute + verify (v1.2.6, capstone)
---ci---
project: acdl
phase: 16
milestone: v1.2
status: verify
verdict: VERIFIED
requirements:
  covered: [REQ-35]
  partial: []
blocker:
  - P0-IAM: terraform apply blocked; operator must push spike_runner_policy.json (carried from Phase 15)
---/ci---

Phase 16 plan-as-execute + verify. scripts/verify_phase16.sh green (11
assertions). Capstone: full v1.2 platform verified end-to-end up to the
IAM-blocked terraform apply. MILESTONE_CAPSTONE_VERIFIED evidence event
written to outbox. v1.1 S3 regression passes. Ready to ship v1.2.6 +
enter the COMPLETE gate.
2026-07-21 22:24:20 +00:00
Jon Chery 699aa542df docs(P15): plan-as-execute + verify (v1.2.5, PARTIAL — terraform apply blocked by IAM)
---ci---
project: acdl
phase: 15
milestone: v1.2
status: verify
verdict: PARTIAL
requirements:
  covered: [REQ-34]
  partial: [REQ-33]
blocker:
  - id: P0-IAM
    description: terraform apply fails with AccessDenied on ECS/ECR/IAM/EC2 — live spike_runner_policy.json not pushed (root key deactivated per D-034)
    unblock: operator runs create_iam_user.py with root/admin creds to push the expanded policy, then terraform apply succeeds (plan valid, 13 to add)
---/ci---

Phase 15 plan-as-execute + verify. PARTIAL: terraform apply blocked by IAM.
- Consumer microservice content authored (app.py + Dockerfile + README.md).
- Docker image acdl-microservice:latest built.
- Adapter fixed: ref emission (bare), JSON-string jsonencode, ECS service
  network_configuration/load_balancer/desired_count/launch_type/task_definition,
  listener default_action/load_balancer_arn, target group target_type/vpc_id/protocol,
  VPC tags (not name), IGW + route table association, managed_policy_arns list.
- L1 fixes: l1-ecs-service (removed port from service sub-resource),
  l1-vpc (added intra_refs, removed igw_id output).
- Resolver: intra_refs resolution (refs between sub-resources of same L1).
- terraform validate + plan succeed (13 to add).
- terraform apply BLOCKED (AccessDenied — live IAM policy not updated).
- Evidence event TERRAFORM_APPLY_BLOCKED written to DynamoDB outbox.
- v1.1 S3 regression: byte-identical.
Ready to ship v1.2.5 (partial).
2026-07-21 22:21:36 +00:00
Jon Chery d103a37419 docs(P14): plan-as-execute + verify (v1.2.4)
---ci---
project: acdl
phase: 14
milestone: v1.2
status: verify
verdict: VERIFIED
requirements:
  covered: [REQ-32]
---/ci---

Phase 14 plan-as-execute + verify. scripts/verify_phase14.sh green.
l2-microservice composition (6 L1s, 2 wire kinds); contract schema
extended (inputs allow objects + healthcheck); resolver extended
(array-form wires, child->child refs, multi-resource L1 expansion);
adapter extended (ref: interpolation translation). v1.2 IR: 11 resources.
v1.1 S3 regression byte-identical. Ready to ship v1.2.4.
2026-07-21 21:12:17 +00:00
Jon Chery 4ed2542ecf docs(P13): plan-as-execute + verify (v1.2.3)
---ci---
project: acdl
phase: 13
milestone: v1.2
status: verify
verdict: VERIFIED
requirements:
  covered: [REQ-31]
---/ci---

Phase 13 plan-as-execute + verify. scripts/verify_phase13.sh green.
6 ECS L1s authored + registered (l1-vpc, l1-ecs-cluster, l1-ecs-service,
l1-iam-role, l1-alb, l1-ecr). Adapter generalized to table-driven
TYPE_MAP (12 IR types) + INPUT_MAP + OUTPUT_MAP. S3 regression: the v1.1
spike l1-s3 produces byte-identical main.tf. Ready to ship v1.2.3.
2026-07-21 21:05:48 +00:00
Jon Chery 0fea29cdbb docs(P12): plan-as-execute + verify (v1.2.2)
---ci---
project: acdl
phase: 12
milestone: v1.2
status: verify
verdict: VERIFIED
requirements:
  covered: [REQ-30]
---/ci---

Phase 12 plan-as-execute + verify. scripts/verify_phase12.sh green (22
assertions). All Wave 1 + Wave 2 tasks complete:
- T-12.1: run_spike_*.sh -> run_platform.sh (D-048, --plan-only flag)
- T-12.2: spike_runner_policy.json expanded (ECS + ECR + ELB + IAM + EC2)
- T-12.3: idempotency documented in bootstrap scripts
- T-12.4: P1-1 redacted (no live AWS key IDs in .ciagent/)
- T-12.5: P1-B fixed (PERSONAS.md platform/registry -> modules-ir/registry.json)
Subagent confirmed run_platform.sh --plan-only runs against real AWS, exit 0.
Ready to ship v1.2.2.
2026-07-21 21:01:51 +00:00
Jon Chery 81c6e3995e docs(P11): plan + verify + verify_phase11.sh (v1.2.1)
---ci---
project: acdl
phase: 11
milestone: v1.2
status: verify
verdict: VERIFIED
requirements:
  covered: [REQ-29]
---/ci---

Phase 11 plan-as-execute + verify. scripts/verify_phase11.sh green (24
assertions). Plan + VERIFY committed. Ready to ship v1.2.1.
2026-07-21 20:57:45 +00:00
Jon Chery cc4c27c8ab docs(P10): create Phase 10 plan (v1-spike-l2-and-contract-e2e)
---ci---
project: acdl
phase: 10
milestone: v1.1
status: plan
plan:
  waves: 5
  tasks: 9
  requirements: [REQ-25, REQ-27, REQ-28]
---/ci---

Phase 10 plan (milestone capstone). 5 waves, 9 files:
- Wave 1 (platform): L2 composition + registry + adapter L2 extension (D-P10-1)
- Wave 2 (backend): contract spike.yaml + contract_resolver.py + outbox_writer.py
- Wave 3 (backend+security+platform): run_spike_e2e.sh (10-step pipeline)
- Wave 4 (lead): verify_phase10.sh (incl. REQ-28 substrate-agnostic grep)
- Wave 5 (EXECUTE-only): run e2e against real AWS + verify + ship

Key decisions: D-P10-1 (adapter consumes resolved IR instance; L2 root
module = L1 resource for depth-1), D-P10-2 (YAML contract + JSON Schema
validation), D-P10-3 (single CONFIDENCE_COMPUTED event; GENESIS chain).

REQ-28 binding claim: only adapters/ files contain aws_s3_bucket / aws_
Terraform-specific terms; modules-ir/ schemas/ contracts/ acdl_platform/
are substrate-agnostic.
2026-07-21 19:31:42 +00:00
Jon Chery 327ba1de75 docs(P09): create Phase 09 plan (v1-spike-ir-and-l1-and-adapter)
---ci---
project: acdl
phase: 9
milestone: v1.1
status: plan
plan:
  waves: 5
  tasks: 9
  requirements: [REQ-24, REQ-26]
---/ci---

Phase 09 plan authored by ci-planner. 5 waves, 9 files:
- Wave 1 (platform): T-9.1 interface.json, T-9.2 spike_instance.json,
  T-9.3 registry.json, T-9.4 README.md (parallel)
- Wave 2 (platform): T-9.5 adapters/terraform/adapter.py
- Wave 3 (platform): T-9.6 generated terraform/spike/*.tf, T-9.7
  run_spike_plan.sh, T-9.9 .gitignore (parallel)
- Wave 4 (lead): T-9.8 verify_phase09.sh
- Wave 5 (lead, EXECUTE-only): run real terraform plan + verify + tag

Key decisions:
- D-P09-1: spike runs terraform plan -lock=false (outbox table PK is
  contractId not LockID; plan-only doesn't write state; v1.2 creates
  proper acdl-tflock table)
- D-P09-2: interface.json (typed contract) vs spike_instance.json (IR-
  schema-valid instance) - cleanly separates declaration from
  materialization (resolved the IR schema's inputs-are-values friction)
- D-P09-3: registry at modules-ir/registry.json (co-located with L1s)
- D-P09-4: generated TF committed + verify regenerates into temp + diffs
2026-07-21 19:11:37 +00:00
Jon Chery a003168b3a docs(P08): create Phase 08 plan (aws-bootstrap)
---ci---
project: acdl
phase: 8
milestone: v1.1
status: plan
plan:
  waves: 5
  tasks: 8
  requirements: [REQ-23]
---/ci---

Phase 08 plan authored by ci-planner. 5 waves:
- Wave 1 (security): T-8.1 spike_runner_policy.json (least-privilege)
- Wave 2 (platform): T-8.2/T-8.3 create_state_backend.py, T-8.4 create_iam_user.py
- Wave 3 (platform): T-8.5 rotate_spike_key.sh
- Wave 4 (lead): T-8.6 verify_phase08.sh, T-8.7 README + .gitignore
- Wave 5 (lead, EXECUTE-only): T-8.8 run bootstrap against AWS + D-034 closure

7 authored files. Key decisions: D-P08-1 (one DynamoDB table acdl-outbox
for both lock + outbox), D-P08-2 (IAM user acdl-spike-runner not OIDC
role; OIDC deferred to v1.2 per D-039), D-P08-3 (Wave 5 EXECUTE-only),
D-P08-4 (optional Gitea secret upload), D-P08-5 (initial key is
throwaway).

Security: root key via env vars only (never committed); .env.secrets
gitignored; IAM policy explicit Deny-everything-else; D-034 closure =
user manually rotates root key post-phase.
2026-07-21 18:57:31 +00:00
Jon Chery b40aadd195 docs(P07): create Phase 07 plan (architecture-v1-finalization)
---ci---
project: acdl
phase: 7
milestone: v1.1
status: plan
plan:
  waves: 5
  tasks: 10
  requirements: [REQ-16, REQ-17, REQ-18, REQ-19, REQ-20, REQ-21, REQ-22]
---/ci---

Phase 07 plan authored by ci-planner. 5 waves (strictly ordered):
- Wave 1 (lead-developer): REQ-16 architecture-v1.0.md snapshot (umbrella)
- Wave 2 (platform + backend parallel): REQ-17 ir.schema.json || REQ-22 contract.schema.json
- Wave 3 (security-engineer, 5 files): REQ-18 PolicyCheckResult schema + checkov_adapter.py, REQ-20 audit_ledger_design.md, REQ-21 hitl_matrix_design.md + separation_of_duties.py
- Wave 4 (backend + security co-authored): REQ-19 confidence_signal.py (depends on Wave 3)
- Wave 5 (lead-developer): verify_phase07.sh + traceability

9 deliverable files + 1 verify script. Cross-persona co-authorship on
confidence_signal.py (backend weighted-sum + security penalty mapping)
mitigated by the PLAN content checklist fixing the critical-override
sentinel + short-circuit location.
2026-07-21 18:40:20 +00:00
Jon Chery b927f9026a docs(P06): create Phase 06 plan (archive-demo-and-reorient)
---ci---
project: acdl
phase: 6
milestone: v1.1
status: plan
plan:
  waves: 3
  tasks: 6
  requirements: []  # repo hygiene; no new REQ
---/ci---

Phase 06 plan authored by ci-planner. 3 waves (strictly ordered):
- Wave 1 (lead-developer): T-6.1 git mv demo dirs, T-6.2 scaffold new
  dirs, T-6.3 write scripts/verify_phase06.sh at top-level, T-6.4 rewrite
  README + .gitignore
- Wave 2 (frontend-engineer): T-6.5 confirm demo/evidence-ui/ moved
  cleanly (confirm-only)
- Wave 3 (lead-developer): T-6.6 run verify_phase06.sh + typecheck gate

Key design: v1.1 verify scripts live at a new top-level scripts/ (not
demo/scripts/ which holds the archived v1.0 verify scripts). All git mv
commands enumerated verbatim in T-6.1, cross-checked against RESEARCH.md
TARGET 10.
2026-07-21 18:26:24 +00:00
Jon Chery 288607b3fa docs(specify): ingest docs/vision+architecture; reframe .ciagent for v1.1
---ci---
project: acdl
phase: 0
milestone: v1.1
status: specify
decisions:
  - D-034 temporary long-lived AWS key waiver (used once in Phase 08, rotated)
  - D-035 milestone v1.1 (feature), ship tag v1.2.0
  - D-036 spike picks l1-s3 + l2-static-asset
  - D-037 demo archived to demo/
  - D-038 open decisions resolved (accept recommendations + decide rest)
---/ci---

Ingest docs/vision.md (6 tenets, anti-goals, signals of success) and
docs/architecture.md v0.2 (4 layers + 6 cross-cutting concerns incl. the
substrate abstraction) as the source of truth for why/how. Reframe the
project from the v1.0 stub demo (tag v1.1.0, archived to demo/ in Phase 06)
to the real Agentic Cloud Delivery Platform.

- config.json: milestone v1.1, status specify
- PROJECT.md: vision + 4-layer/6-concern model + 11 open-decision
  resolutions (W1.A/B, W2.A, BA.A accepted; W3.D/E, BA.B-F, OpenTofu
  decided) + D-034..D-038
- ARCHITECTURE.md: target architecture (IR, confidence, ledger, HITL, SoD,
  substrate abstraction) + v1.1 spike scope (l1-s3 + l2-static-asset)
- REQUIREMENTS.md: add REQ-16..REQ-28 + traceability
- ROADMAP.md: add v1.1 Phases 06-10 (archive, arch-finalize, OIDC, IR+L1,
  L2+contract-e2e)
- PERSONAS.md: add platform-engineer + security-engineer (custom),
  retire infra-stub-engineer, update territories + verification toolchain
  (terraform validate + jsonschema)
- PLAN.md: v1.1 specify plan
2026-07-21 17:55:09 +00:00
grimacing 0672edfc3f ship: phase-05 evidence-ui-and-demo-dry-run (v1.0.5)
Squash merge of phase/05-evidence-ui-and-demo-dry-run; evidence-ui/index.html + run_demo.sh 4-act simulation + verify_phase05.sh; demo live at acdl-evidence raw URL.
2026-07-21 13:53:54 +00:00
grimacing 72b359c9a9 ship: phase-04 pipeline-and-approval-gates (v1.0.4)
Squash merge of phase/04-pipeline-and-approval-gates; pipeline.yml + issue-to-contract.yml + finalize_evidence.py; verify_phase04.sh green; 1 P0 fixed (shell injection).
2026-07-21 13:42:25 +00:00
grimacing 3ea36ef3ab ship: phase-03 l2-modules-and-core-scripts (v1.0.3)
Squash merge of phase/03-l2-modules-and-core-scripts; 4 L2s + 5 core scripts; verify_phase03.sh green.
2026-07-21 13:32:21 +00:00
grimacing 00d0043866 ship: phase-02 l1-modules (v1.0.2)
Squash merge of phase/02-l1-modules into milestone/v1.0-initial; 8 L1 stub modules created; verify_phase02.sh green.
2026-07-21 13:18:12 +00:00
Jon Chery 38eaec9337 docs(P01): create 3-wave phase plan (REQ-01/09/10)
---ci---
phase: 1
milestone: v1.0
status: plan
plan:
  waves: 3
  wave_1_coordination: [T-1.1 gitignore+layout+README, T-1.2 verify_phase01.sh]
  wave_2_backend: [T-2.1 gitea_setup.sh, T-2.2 pipeline.yml skeleton, T-2.3 issue-to-contract.yml skeleton]
  wave_3_coordination: [T-3.1 wire verify + traceability update]
  requirements_covered: [REQ-01, REQ-09, REQ-10]
  must_haves: 6
  verification:
    typecheck: bash -n scripts/*.sh
    test: scripts/verify_phase01.sh
    build: no-op
---/ci---

PLAN.md defines 3 vertical-slice waves: coordination (skeleton + verify
script), backend (Gitea setup + workflow skeletons), coordination (wiring +
traceability). infra-stub-engineer and frontend-engineer have 0 tasks this
phase. Branch for EXECUTE will be phase/01-repo-scaffolding.
2026-07-21 12:59:27 +00:00