continuous-intelligence/acdl

Fork 0

Commit Graph

Author	SHA1	Message	Date
Jon Chery	1ad9c35fb6	docs(P11): v1.2 research addendum + README rewrite ---ci--- project: acdl phase: 11 milestone: v1.2 status: research requirements: covered: [REQ-29] ---/ci--- Phase 11 deliverables: - RESEARCH.md: v1.2 addendum (Targets 9-13). #36988 re-checked (still open, 2026-05-27) -> D-047 extends D-039 waiver. NFR audit: spike IAM policy already least-privilege (needs ECS/ECR/ELB/IAM expansion for Phase 15); bootstrap scripts already idempotent; run_spike_*.sh to consolidate into run_platform.sh (D-048); P1-1 redaction targets identified in VERIFY.md; PERSONAS.md line 47 stale path. ECS L1 catalog scoped (D-049): 6 L1s, 9 IR types for the adapter TYPE_MAP. - README.md: rewritten. v1.1 complete (tag v1.2.0); v1.2 active. Documents the actual spike flow (contract -> IR -> plan -> Checkov -> confidence -> outbox), how to run (bootstrap, rotate, run_spike_e2e.sh), the real repo layout, environments table, credentials/D-039/D-047 waiver. No stale 'v1.1 (active)' framing.	2026-07-21 20:56:54 +00:00
Jon Chery	930c24be6d	docs(research): OIDC blocker found; adopt D-039..D-046; re-scope Phase 08 ---ci--- project: acdl phase: 0 milestone: v1.1 status: research research_targets: 10 top_finding: - TARGET 1 (conf 0.95): Gitea Actions does NOT support id-token: write / OIDC. Real OIDC deferred to v1.2 (blocked on go-gitea/gitea#36988). Spike adopts D-039: per-run-rotated long-lived key waiver. decisions_adopted: [D-039, D-040, D-041, D-042, D-043, D-044, D-045, D-046] risks: - R-1 (highest): OIDC gap -> key-rotation waiver (mitigated by D-039) - R-2: Checkov terraform_plan edge cases (mitigated by ACDL_TAG_NAMING skipped record) - R-3: 6 confidence inputs are a recommendation (D-040 adopted in PROJECT.md) ---/ci--- RESEARCH.md (1330 lines) authored by ci-researcher. Key findings: - TARGET 1: Gitea Actions does NOT support emitting an OIDC id-token (Gitea docs list id-token as unsupported; go-gitea/gitea#33681 open; draft PR #36988 unmerged; Gitea's own CI still uses long-lived keys per #37980). Real-AWS OIDC is unachievable in this environment for v1.1. - TARGETS 2-10: Terraform/Checkov install steps, IR prior art, Checkov adapter, DynamoDB outbox, 6-input confidence signal, tiered ledger (Object Lock deferred), HITL/SoD, contract schema, archive strategy — all resolved with concrete sketches in RESEARCH.md. Adopted D-039..D-046 in PROJECT.md. Re-scoped Phase 08 (ROADMAP) and REQ-23 (REQUIREMENTS) to reflect the OIDC blocker: the spike uses a per-run-rotated long-lived key (D-039) instead of OIDC; real OIDC is a v1.2 deliverable. ARCHITECTURE.md Gitea API surface table updated with the OIDC verdict.	2026-07-21 18:03:41 +00:00

Author

SHA1

Message

Date

Jon Chery

1ad9c35fb6

docs(P11): v1.2 research addendum + README rewrite

---ci---
project: acdl
phase: 11
milestone: v1.2
status: research
requirements:
  covered: [REQ-29]
---/ci---

Phase 11 deliverables:
- RESEARCH.md: v1.2 addendum (Targets 9-13). #36988 re-checked (still
  open, 2026-05-27) -> D-047 extends D-039 waiver. NFR audit: spike IAM
  policy already least-privilege (needs ECS/ECR/ELB/IAM expansion for
  Phase 15); bootstrap scripts already idempotent; run_spike_*.sh to
  consolidate into run_platform.sh (D-048); P1-1 redaction targets
  identified in VERIFY.md; PERSONAS.md line 47 stale path. ECS L1
  catalog scoped (D-049): 6 L1s, 9 IR types for the adapter TYPE_MAP.
- README.md: rewritten. v1.1 complete (tag v1.2.0); v1.2 active. Documents
  the actual spike flow (contract -> IR -> plan -> Checkov -> confidence
  -> outbox), how to run (bootstrap, rotate, run_spike_e2e.sh), the real
  repo layout, environments table, credentials/D-039/D-047 waiver. No
  stale 'v1.1 (active)' framing.

2026-07-21 20:56:54 +00:00

Jon Chery

930c24be6d

docs(research): OIDC blocker found; adopt D-039..D-046; re-scope Phase 08

---ci---
project: acdl
phase: 0
milestone: v1.1
status: research
research_targets: 10
top_finding:
  - TARGET 1 (conf 0.95): Gitea Actions does NOT support id-token: write / OIDC.
    Real OIDC deferred to v1.2 (blocked on go-gitea/gitea#36988).
    Spike adopts D-039: per-run-rotated long-lived key waiver.
decisions_adopted: [D-039, D-040, D-041, D-042, D-043, D-044, D-045, D-046]
risks:
  - R-1 (highest): OIDC gap -> key-rotation waiver (mitigated by D-039)
  - R-2: Checkov terraform_plan edge cases (mitigated by ACDL_TAG_NAMING skipped record)
  - R-3: 6 confidence inputs are a recommendation (D-040 adopted in PROJECT.md)
---/ci---

RESEARCH.md (1330 lines) authored by ci-researcher. Key findings:

- TARGET 1: Gitea Actions does NOT support emitting an OIDC id-token
  (Gitea docs list id-token as unsupported; go-gitea/gitea#33681 open;
  draft PR #36988 unmerged; Gitea's own CI still uses long-lived keys
  per #37980). Real-AWS OIDC is unachievable in this environment for v1.1.
- TARGETS 2-10: Terraform/Checkov install steps, IR prior art, Checkov
  adapter, DynamoDB outbox, 6-input confidence signal, tiered ledger
  (Object Lock deferred), HITL/SoD, contract schema, archive strategy
  — all resolved with concrete sketches in RESEARCH.md.

Adopted D-039..D-046 in PROJECT.md. Re-scoped Phase 08 (ROADMAP) and
REQ-23 (REQUIREMENTS) to reflect the OIDC blocker: the spike uses a
per-run-rotated long-lived key (D-039) instead of OIDC; real OIDC is a
v1.2 deliverable. ARCHITECTURE.md Gitea API surface table updated with
the OIDC verdict.

2026-07-21 18:03:41 +00:00

2 Commits