26 Commits

Author	SHA1	Message	Date
Jon Chery	ad3cc5f129	fix(ci): separate short-lived CI VPC + fix 8 module lifecycle failures ... Two architectural changes: 1. Created terraform/ci-vpc/ — a short-lived VPC for L1 module lifecycle testing, separate from the long-lived platform VPC. Created before VPC-dependent modules (alb, ecs-service, rds, uptime) are tested, destroyed after. Outputs (vpc_id, subnet_ids, sg_id, cluster_arn) are passed to those modules via scripts/run_lifecycle_test.sh + run_lifecycle_destroy.sh wrappers that inject the CI VPC outputs into the example contracts. 2. Updated the workflow to use ci-vpc-apply → lifecycle (with artifact passing) → ci-vpc-destroy (always runs). 8 module-specific fixes: - s3: unique bucket names (acdl-ci-s3a-simple/complex) instead of globally-taken 'my-simple-bucket' - kms-key: alias name with no spaces (locals.tf → alias/acdl-ci-kms) - iam-role: example contract uses role_name (not name, which the interface doesn't declare) - ecs-service: example contract uses family (not name); VPC inputs (cluster_arn, subnets, security_group) injected by CI VPC wrapper - uptime: added subnets, security_group, cluster_arn to interface + module; network_configuration is dynamic (only when subnets provided) - rds: added subnet_ids input + db_subnet_group resource (conditional on subnet_ids being non-empty) - alb: removed hardcoded placeholder sg/subnet values from examples; vpc_id + subnets + security_group injected by CI VPC wrapper - cloudfront: removed invalid placeholder WAF ARN from complex example Regression: 479 passed, 0 skipped, 5 deselected. All 24 example contracts pass --check-only. ---ci--- project: acdl phase: P59 milestone: v1.11 status: execute ---/ci---	2026-07-28 17:52:58 +00:00
Jon Chery	fda4564a7f	feat(P58): single platform VPC + deterministic env-aware state keys ... EXECUTE stage. Fixes the 4-VPC bug: adds a single shared VPC to terraform/platform, drops the vpc child from the microservice composition (references the platform VPC via data source), and makes state keys env-aware (spike/{id}/{env}/terraform.tfstate — stable across lifecycle). Platform VPC (terraform/platform/main.tf): - aws_vpc.acdl_shared (10.0.0.0/16) + 2 subnets + IGW + route table + SG - Outputs: vpc_id, subnet_ids, ecs_security_group_id Microservice composition (modules/l2/microservice/composition.json): - Dropped the vpc child (no per-contract VPC ever again). - Added data_sources block: platform_vpc → terraform_remote_state (platform). - Wires: vpc.outputs.subnet_ids → platform_vpc.outputs.subnet_ids. - Wires: platform_vpc.outputs.vpc_id → alb.inputs.vpc_id. - Wires: platform_vpc.outputs.ecs_security_group_id → service.inputs.security_group. Contract resolver (core/contract_resolver.py): - Added environment to the stack instance (stack.environment). - Added data_sources handling: pseudo-children with outputs but no resources. - data_sources propagated through fragment merge to the final stack instance. Adapter (adapters/terraform/adapter.py): - State key: spike/{stack_name}/{environment}/terraform.tfstate (env-aware). - Emits data "terraform_remote_state" "platform" block when data_sources present. - ref:platform_vpc.<output> → data.terraform_remote_state.platform.outputs.<output>. Tests (tests/test_adapter.py): - test_adapt_env_aware_state_key: spike/msvc/prod/terraform.tfstate. - test_adapt_emits_data_source_block: data.terraform_remote_state.platform. - test_adapt_no_vpc_for_microservice: no resource "aws_vpc" in microservice output. - Updated existing state key assertion (spike/s3/dev/terraform.tfstate). Regression: 467 passed, 0 skipped, 5 deselected. run_platform.sh --check-only passes for both microservice (9 resources, no VPC) and static-assets (5 resources). ---ci--- project: acdl phase: P58 milestone: v1.11 status: execute ---/ci---	2026-07-28 16:07:57 +00:00
Jon Chery	c80060878a	feat(P56b): author 11 L1 module terraform subdirs + fix adapter output format ... EXECUTE stage. Authors the remaining 11 L1 module terraform subdirs with the full versions/variables/locals/main/outputs split. Defaults previously hardcoded in the adapter move into locals.tf. Simple single-resource modules (7): - kms-key: aws_kms_key + alias (enable_key_rotation, deletion_window defaults) - ecr: aws_ecr_repository (encryption_configuration from kms_key_arn, image_scanning) - ecs-cluster: aws_ecs_cluster (name default) - iam-role: aws_iam_role + inline_policy (assume_role_policy fallback, ECR/logs policy in locals.tf) - rds: aws_db_instance (storage_encrypted, multi_az, kms_key_arn defaults) - waf: aws_wafv2_web_acl (default_action, visibility_config, dynamic rules) - uptime: aws_ecs_task_definition + aws_ecs_service (Fargate compat, container_definitions in locals.tf) Multi-resource modules with intra-refs (4): - vpc: aws_vpc + aws_subnet + aws_internet_gateway + aws_route_table (CIDR derivation in locals.tf) - ecs-service: aws_ecs_task_definition + aws_ecs_service (Fargate compat, container_definitions, network_config in locals.tf) - alb: aws_lb + aws_lb_target_group + aws_lb_listener (subnet/security_group list derivation in locals.tf) - cloudfront: aws_cloudfront_distribution + aws_cloudfront_origin_access_control (OAC defaults in locals.tf) Registry: terraform_dir added to all 11 remaining entries. Adapter fix: stack output format uses separate 'from' + 'output' fields (not 'from': 'rid.output'). Fixed _emit_root_output to read both fields. 6 previously-skipped tests unblocked (run_platform.sh --check-only now resolves static-assets.yml through the new module-assembled adapter). Removed skip markers. Fixed test assertion (aws_s3_bucket → module). Regression: 461 passed, 0 skipped, 5 deselected (slow). All 12 modules pass run_primitive_plan.sh --check-only. All 12 terraform/ subdirs pass terraform init + validate standalone. ---ci--- project: acdl phase: P56b milestone: v1.11 status: execute ---/ci---	2026-07-28 16:07:57 +00:00
Jon Chery	a16e6f1bff	feat(P56a): stateless adapter rewrite + s3 reference terraform module ... EXECUTE stage. Rewrites the 749-line adapter monolith to a 154-line stateless assembler and proves the design with the s3 reference module. Stateless adapter (adapters/terraform/adapter.py, 749 → 154 lines): - Deleted TYPE_MAP, INPUT_MAP, OUTPUT_MAP (3 constant tables). - Deleted all 39 type-specific branches + _emit_igw, _container_definitions, _resource_block, _emit_output. - New adapt(): reads registry.json → terraform_dir → emits root main.tf with module-instantiation blocks (module "x" { source = ... }) + ref wiring via module.<rid>.<output> interpolations + root outputs. - The adapter owns NO resource shape, NO nested blocks, NO defaults, NO type-specific logic. It only assembles module instantiations and wires refs. s3 reference terraform module (modules/l1/s3/terraform/): - versions.tf (required_version + aws ~> 5.0) - variables.tf (bucket_name, region, kms_key_arn, tags) - locals.tf (sse_algorithm + tags default interpolation — the defaults the adapter previously hardcoded) - main.tf (aws_s3_bucket + versioning + SSE config, referencing local.*) - outputs.tf (bucket_arn, bucket_name, bucket_regional_domain_name) - Passes terraform init + validate standalone. Registry (modules/registry.json): s3 entry gains terraform_dir field. STANDARDS.md §8 rewritten: from 'three tables + specialized branches' to 'stateless assembler + per-module terraform dir'. §9.4 checklist updated. §9.1 required-files list updated to include terraform/ subdir. tests/test_adapter.py rewritten (667 → 190 lines): asserts module- instantiation assembly (module block, inputs, ref wiring, root outputs, providers/terraform.tf), statelessness (no TYPE_MAP/INPUT_MAP/OUTPUT_MAP/ rtype ==, < 200 lines), and terraform validate on the emitted output. Deleted test_p1_1_adapter_parameterization.py (tested the deleted HCL string emission). 6 pipeline tests skipped (run_platform.sh --check-only defaults to static-assets.yml which needs cloudfront/waf terraform dirs — P56b). Regression: 455 passed, 6 skipped, 5 deselected (slow). run_primitive_plan --check-only s3 exits 0. ---ci--- project: acdl phase: P56a milestone: v1.11 status: execute ---/ci---	2026-07-28 16:07:57 +00:00
Jon Chery	031887ec56	refactor(P57): contract surface redesign + rename + .yml repo-wide ... Contract surface redesign: - New top-level fields: id (3-6 char acronym → stack.name), name (full → stack.title), infrastructure (map keyed by module name, replaces module:) - Drop uses: field (dead reference; version pin lives in CI workflow uses: line) - Drop top-level module/inputs (now nested under infrastructure map) - Per-module optional version (defaults to latest published from registry) - Multi-module contracts: one file deploys N modules in one pipeline run, resource IDs namespaced with module name to avoid collisions - stack.schema.json: add optional title field for display name Rename: - pipelines/deploy.yaml → pipelines/contract.yml (declarative spec, not a pipeline) - pipelines/ci.yaml → pipelines/ci.yml - All 44 .yaml files → .yml repo-wide (contracts, module examples, kyverno policies) - .acdl/contract.yaml → .acdl/contract.yml Resolver (core/contract_resolver.py): - Rewrite resolve() to loop infrastructure map, default version to latest, merge module fragments into one stack with namespaced resource IDs - _latest_version() picks highest non-deprecated from registry - _namespace_resources() prefixes IDs + rewrites ref: expressions for multi-module - Single-module path: unprefixed IDs (backward compatible) Verification: - 494 tests pass (0 contract-shape failures) - Local E2E passes (contract → resolver → adapter → local ECS HTTP 200 → outbox) ---ci--- project: acdl phase: 57 milestone: v1.10.2 status: execute ---/ci---	2026-07-27 21:37:40 +00:00
Jon Chery	7585c828f0	docs(P48): vision gaps + badge system + substrate→engine + CR format + agentic tags ... 9 requirements implemented across presentation decks and project docs: 1. DX closing slide: added 'Infrastructure as a utility, not a craft' bullet to convey the full vision (infrastructure consumed, not maintained; platform compounds value over time). 2. PW Problem slide: 'moving a merged change' → 'promoting a change'. 3. PW Problem slide: added 'Red tape' and 'Scalability without increasing headcount' bullets (4 frictions, not 2). 4. PW Roadmap slide: redesigned with side-by-side HTML table layout (Testing | Planned), 16px font, no overflow. 5. PW deck: added new slide 'What This Platform Is — and Isn't' after North Star (sovereign boundary, infrastructure as utility, 4 anti-goals). PW deck now 16 slides (was 15). 6. Maturity nomenclature: 'Available today'/'shipped' → 'Testing' across both decks + source markdown. New .testing badge (blue/teal #DBEAFE). Roadmap title: 'Testing vs. Planned'. The platform has 0 consumer adoption — 'shipped' was inaccurate. 7. Global: 'substrate' → 'engine' across entire project (88 matches, 30+ files including .ciagent/, docs/, modules/, adapters/, schemas/, code). 8. Presentation files only: 'forge' → 'VCS' / 'version control system' (6 occurrences in 4 files). 'forge' retained in all technical docs and code as the industry-standard term. 9. New .agentic badge (purple/violet #EDE9FE) appended to agentic features in both decks: confidence signal, autonomous dev, pattern recognition, dynamic module creation, citizen developer surface, auto-promotion. Also: Change Request ID format changed from 'CR-2026-001' to 'CHG0678912' across presentation files, consumer guide, and test fixtures. HTML re-rendered. PPTX rendered for release upload. ---ci--- phase: 48 milestone: v1.9 status: complete requirements: covered: [] partial: [] ---/ci---	2026-07-23 14:58:29 +00:00
Jon Chery	2682719f24	docs(P47): presentation slide updates + HIPAA removal from all docs ... Presentation changes (both Marp decks + source markdown): 1. Title slide: deck title as H1 (slightly bigger), 'Agentic Cloud Delivery Platform' as H3 subtitle — cleaner title hierarchy 2. DX deck: removed Local Reproducibility slide (not beneficial for DX) 3. DX deck: Safe Promotion Path slide redesigned with side-by-side layout for Approaches A and B (HTML table, two columns) 4. DX deck: 'an agent' → 'an AI agent' (slide 2 + Citizen Developer slide) 5. DX deck: What a Developer Does — diagram floated to the right side 6. Header simplified to just the deck name (subtitle now on title slide) HIPAA removal (25 files): - Completely removed all HIPAA references from all markdown documentation, presentation source files, module READMEs, and rendered HTML - Removed HIPAA from compliance milestone lists (GDPR, SOX, SOC2, DORA remain) - Removed HIPAA section references (§164.xxx) from compliance annotations - Cleaned up empty parentheses and broken commas left by removal - Re-rendered both HTML decks from updated Marp source ---ci--- phase: 47 milestone: v1.9 status: complete requirements: covered: [] partial: [] ---/ci---	2026-07-23 14:08:40 +00:00
Jon Chery	e1be05287b	feat(P39): refresh design docs + parameterize adapter (P1-1) ... ---ci--- project: acdl phase: 39 milestone: v1.9 status: execute ---/ci--- Phase 39 — design-doc-refresh-and-p1-1-parameterization: Design docs (REQ-100, REQ-101): - hitl_matrix_design.md: 'dev-only spike'/'v1.2 wires the gates' framing replaced with v1.9 wired-gates reality; 8-concern matrix marked implemented (offline-testable subset + signed evidence artifacts, D-084); v1.9 wiring section cross-references hitl_gates.py + attestation_matrix.py; approver_dr noted. - audit_ledger_design.md: outbox marked shipped+production since v1.8; S3 Object Lock + JWS + async worker + DLQ + daily checkpoints clearly labeled 'Deferred to a future milestone (D-083)'; RPO/RTO table updated; approver fields note v1.9 hitl_gates.attest. P1-1 adapter parameterization (REQ-102, D-085): - ecs-service interface.json: desired_count (default 1), launch_type (FARGATE), family (app) inputs added. - alb interface.json: load_balancer_type (application), target_type (ip). - adapter.py: hardcoded defaults replaced with inputs.get(<name>, <default>); hardcoded 'acdl-microservice-rt'/'acdl-microservice-igw' Name tags derive from the VPC name input. - contract_resolver.py: child_input_map routes wires to the sub-resource that declares the input (desired_count → aws:ecs:service, family → aws:ecs:task_definition, target_type → targetgroup, etc.). - microservice composition.json: wires added for the new inputs. Tests: +21 (test_p1_1_adapter_parameterization.py, test_design_docs_current.py). 371 passed; run_ci.sh green; run_platform.sh --check-only green; v1.1 S3 regression preserved.	2026-07-23 04:24:25 +00:00
Jon Chery	cb02c69e0c	docs(P35): module engineering standards + catalog fix + template update (REQ-95, REQ-96) ... ---ci--- project: acdl phase: 35 milestone: v1.8 status: execute ---/ci--- - modules/STANDARDS.md: comprehensive L1+L2 authoring + code review standards (9 sections: L1 standards, L2 standards, encryption by default, deletion protection by default, registry, README standards, adapter extension pattern, code review checklist). - modules/README.md: catalog index fixed — rds, kms-key, uptime added to the Primitives table. - modules/README-TEMPLATE.md: NFRs section added between Outputs and Usage. - tests/test_module_standards.py: automated enforcement test (12 tests) validating required files, NFRs, registration, README sections. Tests: +12 (332 -> 344). All pass.	2026-07-22 22:20:50 +00:00
Jon Chery	491ba78768	feat(P33): uptime-kuma primitive + deploy-uptime pipeline stage (REQ-88..91) ... ---ci--- project: acdl phase: 33 milestone: v1.8 status: execute ---/ci--- - New uptime L1 primitive (aws:ecs:uptime-service) deploying uptime-kuma on ECS Fargate with feature_flag_enabled, monitored_endpoints, static_checks, alert_channels (Teams/email/SMS/GitHub issues). - Adapter emits ECS Fargate task + service when feature_flag_enabled=true; emits nothing when false. Container image louislam/uptime-kuma:1. - New deploy-uptime pipeline stage in pipelines/deploy.yaml (after publish-outputs, before comment-outputs). Now 9 stages. - run_platform.sh --deploy-uptime flag + automatic uptime deployment after L2 module (separate state $WORK/uptime-tf). Endpoints from L2 outputs passed as monitored_endpoints. Feature flag from inputs.uptime_enabled (default true). - scripts/seed_uptime_monitors.py for post-deploy monitor seeding via uptime-kuma API. - Registered in registry.json (14 modules total). Tests: +6 (312 -> 318). All pass.	2026-07-22 22:15:35 +00:00
Jon Chery	8145eee8fc	feat(P32): deletion-protection-by-default + L2 feature flag (REQ-86, REQ-87) ... ---ci--- project: acdl phase: 32 milestone: v1.8 status: execute ---/ci--- - All 11 L1 primitives now have deletion_protection NFR (boolean, default true). - Adapter emits `lifecycle { prevent_destroy = true }` when NFR is true; omits it when false. Default is true when NFR is absent. - L2 composition resolver propagates inputs.deletion_protection to all children NFRs. When false, all resources get deletion_protection=false. - Stack schema updated with optional features object (deletion_protection, uptime_enabled). - Contract schema description updated to document deletion_protection and uptime_enabled inputs. Tests: +5 (307 -> 312). All pass.	2026-07-22 22:12:42 +00:00
Jon Chery	de91a4bb76	feat(P31): encryption-by-default + per-stack CMK (REQ-83, REQ-84, REQ-85) ... ---ci--- project: acdl phase: 31 milestone: v1.8 status: execute ---/ci--- - New kms-key L1 primitive (aws:kms:key) with enable_key_rotation=true (AWS-managed annual rotation, D-075). Registered in registry.json. - Adapter TYPE_MAP expanded for aws:kms:key + aws:kms:alias. - Adapter emits enable_key_rotation from NFR. - S3 adapter emits server_side_encryption_configuration with KMS when kms_key_arn provided; managed KMS fallback with stderr warning when not. - All 10 existing L1 primitives now have encryption_enabled NFR (default true). - s3, rds, ecr, ecs-service, ecs-cluster have kms_key_arn input. - Both L2 compositions (static-assets, microservice) now include a kms-key child + wires connecting kms_key_arn to children. - L2 stack outputs include kms_key_arn. Tests: +7 (300 -> 307). All pass. run_platform.sh --check-only green (static-assets now resolves to 5 resources with the CMK).	2026-07-22 22:11:03 +00:00
Jon Chery	94065a4fbc	feat(P27): add Examples section to every module README (D-058) ... Each module README (10 primitives + 2 patterns) now has a ## Examples section before ## Versioning, referencing and excerpting the validated simple.yaml + complex.yaml (+ mysql.yaml for RDS) example contracts. The RDS README includes a Multi-engine variation subsection (D-059). ---ci--- project: acdl phase: 27 milestone: v1.7 status: execute ---/ci---	2026-07-22 20:23:48 +00:00
Jon Chery	4bd07a4fae	feat(P27): validated per-module examples (D-058) + schema glob fix ... Add modules/<name>/examples/ directories with simple.yaml + complex.yaml (+ mysql.yaml for RDS) for every primitive and module pattern. All 25 example contracts validate against schemas/contract.schema.json. Update the contract schema to allow object/array input values (for env vars). Fix the platform-test schema-validation glob to modules/*/*/examples/*.yaml to match the nested l1/l2 path structure. Update the microservice sample contract note (env objects now permitted by the schema). ---ci--- project: acdl phase: 27 milestone: v1.7 status: execute ---/ci---	2026-07-22 20:22:45 +00:00
Jon Chery	a9d8b31595	feat(P27): RDS primitive + adapter expansion (D-059) ... Add modules/l1/rds/ with interface.json (engine enum for postgres, mysql, mariadb, sqlserver, oracle), instance.json, README.md (full template with compliance extension points). Register in registry.json. Expand the adapter TYPE_MAP/INPUT_MAP/OUTPUT_MAP for aws:rds:instance -> aws_db_instance; emit backup_retention_period, deletion_protection, storage_encrypted, and skip_final_snapshot from NFRs/inputs. Add RDS to the primitives-plan matrix. Update tests for the new registry entry count (12) + RDS adapter emission. ---ci--- project: acdl phase: 27 milestone: v1.7 status: execute ---/ci---	2026-07-22 20:21:45 +00:00
Jon Chery	a4b17d0f26	fix(P26): resolve multi-resource L1 ref ids in contract resolver ... ---ci--- project: acdl phase: 26 milestone: v1.7 status: execute ---/ci--- The microservice pattern (and any L2 referencing multi-resource L1s like vpc) failed at the adapter stage because the resolver emitted refs using the child id (e.g. 'vpc') instead of the expanded sub-resource id (e.g. 'vpc-subnet'). The adapter's type_by_id table only knows the sub-resource ids, so ref:vpc.subnet_ids was an unknown resource id. Fix: - contract_resolver.py: child_outputs now maps {outputName -> resourceId} instead of just the interface outputs dict. For multi-resource L1s, the ref uses the sub-resource id that produces the output. For single-resource L1s, the resourceId == childId (unchanged behavior). - vpc interface.json: the subnet sub-resource output is 'subnet_ids' (matching the interface-level output name) instead of 'subnet_id'. - adapter.py OUTPUT_MAP: aws:ec2:subnet now maps both 'subnet_ids' and 'subnet_id' to 'id'. Verification: - microservice pattern check-only: PASS (11 resources) - static-assets pattern check-only: PASS (4 resources) - platform check-only: PASS - full test suite: 266 passed	2026-07-22 20:15:59 +00:00
Jon Chery	90be5839ab	feat(P26): 3 platform pipelines + release job with semver/tag updates ... Phase 26 — platform-pipelines-and-release-automation: - platform-test.yml: PR pipeline (lint + unit-test + integration-test + schema-validation) replacing ci.yml for PRs; integration-test runs run_platform.sh --check-only for every contracts/*.yaml - primitives-plan.yml: PR pipeline with matrix over all 9 L1 primitives (s3, vpc, ecs-cluster, ecs-service, iam-role, alb, ecr, cloudfront, waf) - patterns-plan.yml: PR pipeline with matrix over all 2 L2 modules (static-assets, microservice) - release.yml: push-to-main pipeline computing next semver tag (PATCH for regular phases, MINOR for milestone completions), updating floating MAJOR.MINOR + MAJOR tags, and creating GitHub releases - run_primitive_plan.sh: plan-only/check-only runner for a single L1 primitive (adapter compile + structure validation offline) - run_pattern_plan.sh: plan-only/check-only runner for a single L2 pattern (environment check + contract validate + resolve + adapter + structure validation offline) - contracts/microservice.yaml: sample consumer contract for the microservice L2 module (schema-compliant scalar inputs) - instance.json for 8 L1 primitives (vpc, ecs-cluster, ecs-service, iam-role, alb, ecr, cloudfront, waf) so the primitives-plan matrix can run the adapter offline; s3 already had one - tests/test_release_logic.py: unit test for semver computation (PATCH bump, MINOR bump on milestone, floating tag format) - tests/test_pipeline_contract.py: 19 new tests validating the 4 platform workflows exist and conform (stages, matrices, triggers, permissions) DEVIATION: The microservice pattern (run_pattern_plan.sh --check-only microservice + run_platform.sh --check-only contracts/microservice.yaml) fails at the adapter stage due to a pre-existing resolver ref-id mismatch for multi-resource L1s (resolver emits ref:vpc.subnet_ids but the expanded resource id is vpc-subnet). This predates Phase 26 and is out of scope for pipeline automation; the static-assets pattern passes end-to-end. The microservice contract is schema-valid and resolves correctly (11 resources); only the adapter compilation of multi-resource L1 refs fails. VERIFICATION: - bash scripts/run_ci.sh: PASS (lint + test + check-only) - python3 -m pytest tests/ -v: 266 passed - bash scripts/run_primitive_plan.sh --check-only s3: PASS - bash scripts/run_pattern_plan.sh --check-only static-assets: PASS - All 9 primitives pass run_primitive_plan.sh --check-only - All instance.json validate against stack.schema.json ---ci--- project: acdl phase: 26 milestone: v1.7 status: execute ---/ci---	2026-07-22 20:13:36 +00:00
Jon Chery	dca35c78ec	feat(P22): rename static-asset→static-assets + cloudfront/waf primitives + production stack + @v1.6 bump ... ---ci--- phase: 22 title: rename-and-production-static-assets-stack status: complete verification: - scripts/run_ci.sh: PASS (CI PIPELINE OK) - python3 -m pytest tests/ -v: 175 passed - scripts/run_platform.sh --check-only: PASS (PLATFORM CHECK OK) - grep -R "static-asset[^s]" . (excl .git/): 0 hits - grep -R "static-asset$" . (excl .git/): 0 hits - floating git tags v1.6 + v1 point at v1.6.0 (a90a756) changed_files: - Task 1 (rename): contracts/static-asset.yaml→static-assets.yaml (git mv); modules/l2/static-asset→static-assets (git mv); sed replaceAll static-asset→static-assets in 22 files (README, docs, scripts/run_platform.sh, pipelines/deploy.yaml, modules/registry.json, tests/*, .ciagent/* historical narrative) - Task 2 (cloudfront primitive): modules/l1/cloudfront/interface.json + README.md - Task 3 (waf primitive): modules/l1/waf/interface.json + README.md - Task 4 (registry): modules/registry.json (+cloudfront, +waf, static-assets renamed) - Task 5 (augment static-assets): modules/l2/static-assets/composition.json (s3+cloudfront+waf, depth 1); modules/l1/s3/interface.json +instance.json (+bucket_regional_domain_name output); modules/l2/static-assets/README.md (production stack docs) - Task 6 (adapter): adapters/terraform/adapter.py (+TYPE_MAP/INPUT_MAP/OUTPUT_MAP for cloudfront distribution+OAC+wafv2 webacl; special handling in _emit_resource for OAC defaults, distribution origin/cache_behavior/restrictions/viewer_certificate/web_acl_id, waf scope/default_action/visibility_config/managed rules) - Task 7 (contract schema): no change needed (generic inputs object; new module names match ^[a-z][a-z0-9-]*$) - Task 8 (@v1.6 bump): contracts/static-assets.yaml, .gitea/.github/workflows/deploy.yml (ref: v1.6 + header comments), docs/consumer-guide.md, docs/contracts/index.md, docs/pipeline/versioning.md, docs/pipeline/index.md, docs/architecture.md, README.md, modules/l2/microservice/README.md, tests/test_environment_check.py, tests/test_pipeline_contract.py - Task 9 (floating tags): git tag -f v1.6 v1.6.0; git tag -f v1 v1.6.0 - Task 10 (tests): tests/test_adapter.py (registry 11 entries/9 L1/2 L2; cloudfront+waf type map tests; TestS3Output bucket_regional_domain_name; TestStaticAssetsStack 4 tests); tests/test_contract_resolver.py (+s3/cloudfront/waf resource assertions) generated: - terraform/spike/main.tf + terraform.tf (regenerated by run_platform.sh --check-only; reflect static-assets production stack + backend key spike/static-assets/) notes: - D-048 full rewrite of .ciagent/ historical narrative (verbatim phase descriptions, REQ-25/27/50, D-036) — produces intentional tautologies (e.g. "Rename static-assets → static-assets") per the decision to override the v1.6 preservation precedent. - cloudfront interface.json resources array ordered distribution-first so the resolver (first-match wire resolution) routes bucket_regional_domain_name/waf_web_acl_arn/region to the distribution; the OAC gets adapter-provided defaults (name=acdl-oac, origin_type=s3, signing_behavior=always). - .ciagent/ @v1.4 references left as historical record (D-048 scope was static-asset rename only; @v1.4 is historical narrative of Phase 20). - s3 OUTPUT_MAP bucket_regional_domain_name not added (identity fallback in adapt() already handles it; OUTPUT_MAP documents non-identity mappings only). ---ci---	2026-07-22 19:56:52 +00:00
Jon Chery	553caf8f1d	docs(P21): rewrite README + normalize modules terminology (REQ-52,55,56,57,58,59,60) ... ---ci--- project: acdl phase: 21 milestone: v1.6 status: execute ---/ci--- README.md rewrite: - Remove all .ciagent/ references (links + repository-layout row). - Remove .gitea/workflows/ row from repository layout. - Restate repository roles: consumer repo = app code + 1+ contracts + CI definitions (thin .github/workflows/*.yml uses:-ing the central workflow); platform repo owns modules/adapters/core/schemas/pipelines/ scripts/workflows. - Replace Status section with Features list (consumer + platform-engineer referenceable) + Roadmap (planned only, no version changelog, no internal CIAgent status). Includes the composition-redesign roadmap entry (dynamic module creation from a contract). - Fix the mermaid flowchart: all node text visible (short multi-line labels via <br/>), add a security-checks stage before policy checks, do not name specific tools (security checks/policy checks/infrastructure plan via adapter), add infrastructure-apply stage (dev only, after evidence event). - Remove the environments table (dev/qa/prod/dr) completely; point to docs/environments/ for platform-managed environments. - Credentials section: remove go-gitea/gitea#36988 blocked mention + waivers D-039/D-047 language. State OIDC+ABAC default; alternative is a static AWS key (GitHub Secrets for platform-runner runs, .env.secrets locally) with daily rotation (platform-managed) or out-of-band rotation (consumer-managed for local .env.secrets). - forge -> platform runners / platform-managed throughout. - Links point to docs/ Pages paths, not .ciagent/. modules/ terminology: - modules/README.md: L1 primitives -> primitives, L2 compositions -> modules, composition -> pattern (prose); add roadmap note for the composition redesign. - README-TEMPLATE.md: L1 primitive -> primitive. - All 7 L1 READMEs: L1 primitive -> primitive. - L2 static-asset + microservice READMEs: L2 composition -> module pattern, composition -> pattern, L1 -> primitive; bump stale @v1 -> @v1.4 in usage examples; fix CONSUMER_GUIDE.md -> consumer-guide.md link. Verification: grep sweeps for .ciagent/.gitea/forge/go-gitea/waiver/ D-039/D-047/acdl_platform in docs/ README.md modules/ contracts/ all return 0 hits. Tests: 166 pass. run_ci.sh green.	2026-07-22 18:26:00 +00:00
Jon Chery	f68f85c9fd	review(v1.5): READY TO SHIP — multi-persona code review ... ---ci--- project: acdl phase: 20 milestone: v1.5 status: review verdict: READY TO SHIP p0: 1 (fixed — contract path resolution in deploy workflow) p1: 6 (flagged post-hoc) ---/ci--- Multi-persona review of v1.5 phase 20 (docs + reusable deploy workflow). P0 (blocking) — AUTO-FIXED: - C1: scripts/run_platform.sh contract path resolution broken in deploy workflow. The reusable workflow invokes run_platform.sh from the consumer workspace root with a relative contract path (.acdl/contract.yaml), but run_platform.sh does `cd "$ROOT"` (platform repo) early, so the relative path resolved against the platform repo and the pipeline could never run. Fix (commit 75c2274): capture CALLER_CWD before cd "$ROOT"; resolve caller-supplied relative paths against CALLER_CWD; default no-arg contract stays relative to ROOT (preserves platform-local CI). Reproduced pre-fix; verified post-fix. P1 (important) — FLAGGED FOR POST-HOC REVIEW (do not block ship): - C2: ref: v1.4 in the deploy workflow platform checkout — no v1.4 tag exists (only v1.4.0 / v1.4.1). Operator must create a floating v1.4 tag or change the ref to v1.4.1. - C3: modules/l2/{static-asset,microservice}/README.md still use @v1 in their Usage examples; missed by the v1.4 bump. - S1: static-key override is not wired. ACDL_AWS_* env vars on the OIDC step are not read by aws-actions/configure-aws-credentials@v4 (it reads AWS_* or its own access-key/secret-key inputs). The README/CONSUMER_GUIDE claim a working override that doesn't function as written. Needs a conditional step or renamed env vars + input wiring. - S2: README overstates ABAC repo:org/repo:ref:... scoping. The workflow constructs a numeric role name (github.repository_id); the actual claim enforcement lives in the IAM trust policy, not in this workflow. - T1: no deploy-workflow triggers conformance test (CI workflow has one; deploy doesn't). Minor — reusable workflows use workflow_call, not push triggers, but the contract's triggers field is then unenforced. - A1: terraform/spike/terraform.tf uploaded as artifact leaks the AWS account ID via the state-backend bucket name. Recommend excluding terraform.tf or gating artifact upload to non-public repos. P2 (nits) — listed for awareness: floating-tag terminology imprecision (M1), header comment "Gitea Actions" in the GitHub copy (M2, intentional byte- identical), pip install split (P1-perf), comment drift in pipelines/deploy.yaml header (C4), module README internal inconsistency (C5). Verdict: READY TO SHIP. The one P0 is fixed. The 6 P1s are post-hoc items — the deploy workflow is a scaffold whose first real consumer run requires operator setup (tag, IAM role, secrets) that gates go-live. The P1s should be addressed before any consumer invokes uses: acdl/.gitea/workflows/ deploy.yml@v1.4 in earnest. Tests: 154 pass (19 new). run_ci.sh green.	2026-07-22 17:24:28 +00:00
Jon Chery	2a84c0047b	feat(P20): consumer happy path + reusable deploy workflow (v1.5.0) ... ---ci--- project: acdl phase: 20 milestone: v1.5 status: verify ---/ci--- REQ-46: README rewritten — platform-source vs consumer-repo distinction up front; platform flow converted to mermaid flowchart TD; L3A/L3B + spike nomenclature scrubbed from prose (code paths kept verbatim); prereqs pointer to consumer guide added. REQ-47: docs/CONSUMER_GUIDE.md (generic, all L2 modules) replaces docs/consumer-guide-static-asset.md — mermaid diagrams (model LR + pipeline TD), versioned uses: (@v1.4 floating MAJOR+MINOR, bare/@main discouraged), consumer-scoped prerequisites (no Terraform/Checkov/boto3/runner-key), run- time platform fetch via reusable workflow (consumers never invoke scripts/run_platform.sh locally for the happy path), optional local validation note. REQ-48: Credentials section rewritten — zero-trust OIDC + ABAC default (repo-identity + resource-tag scoping, blast-radius containment); static-key override in GitHub Secrets or .env.secrets with platform-managed daily rotation; consumer rotates out of band when using .env.secrets locally. REQ-49: byte-identical .gitea/workflows/deploy.yml + .github/workflows/ deploy.yml — reusable (on: workflow_call), checks out consumer repo + ACDL platform repo, installs deps, runs run_platform.sh, uploads artifacts; OIDC default (permissions: id-token: write) + static-key override via secrets. REQ-50: contracts/static-asset.yaml uses: @v1.4 (MAJOR+MINOR). REQ-51: tests/test_pipeline_contract.py extended — TestDeployPipelineSchema, TestDeployPipelineContract, TestDeployWorkflowConformance (byte-identical, reusable, contract/mode inputs, run_platform invocation, platform-repo checkout, OIDC permissions), TestSampleContractVersioning. 154 tests pass (19 new); run_ci.sh green. Fixes: modules/l2/static-asset/README.md dangling link retargeted to docs/CONSUMER_GUIDE.md.	2026-07-22 17:14:12 +00:00
Jon Chery	895a2f3806	docs(P20): specify phase 20 — consumer happy path + reusable deploy workflow (v1.5) ... ---ci--- project: acdl phase: 20 milestone: v1.5 status: specify ---/ci--- Add v1.5 milestone to ROADMAP.md + REQUIREMENTS.md. Phase 20 covers REQ-46 (README consumer model + mermaid + L3B/spike scrub), REQ-47 (generic CONSUMER_GUIDE.md + versioned uses: + consumer-scoped prereqs + run-time platform fetch), REQ-48 (zero-trust OIDC/ABAC credentials + static-key override + daily rotation), REQ-49 (reusable byte-identical deploy.yml Gitea+GitHub implementing pipelines/deploy.yaml), REQ-50 (contracts/static-asset.yaml @v1.4), REQ-51 (deploy-workflow conformance tests). Update config.json milestone to v1.5.	2026-07-22 17:09:23 +00:00
Jon Chery	e044a2de0d	phase: 6, status: plan-as-execute, persona: lead-developer, task: T-6.1..T-6.4 ... ---ci--- project: acdl phase: 6 milestone: v1.1 status: plan-as-execute persona: lead-developer tasks: [T-6.1, T-6.2, T-6.3, T-6.4] ---/ci--- Archive the v1.0 demo under demo/ (D-037) and reorient the repo to the real platform. Wave 1 of the Phase 06 plan. - T-6.1: git mv modules/, scripts/, evidence-ui/, contracts/, contracts-repo/, .gitea/ -> demo/; mv ACDL_DEMO.md + runner-data/ -> demo/ - T-6.2: scaffold new v1.1 top-level dirs (platform/, schemas/, adapters/, terraform/, modules-ir/) with .gitkeep - T-6.3: create top-level scripts/verify_phase06.sh (v1.1 verify scripts live at top-level, NOT demo/scripts/ which holds the v1.0 demo verify scripts) - T-6.4: rewrite README.md to reflect the real platform (vision + architecture links, new layout, status v1.1 active); add runner-data/ to .gitignore All moves via git mv (history preserved). Repo root now contains only README.md, demo/, docs/, .ciagent/, and the new empty v1.1 dirs.	2026-07-21 18:27:21 +00:00
grimacing	3ea36ef3ab	ship: phase-03 l2-modules-and-core-scripts (v1.0.3) ... Squash merge of phase/03-l2-modules-and-core-scripts; 4 L2s + 5 core scripts; verify_phase03.sh green.	2026-07-21 13:32:21 +00:00
grimacing	00d0043866	ship: phase-02 l1-modules (v1.0.2) ... Squash merge of phase/02-l1-modules into milestone/v1.0-initial; 8 L1 stub modules created; verify_phase02.sh green.	2026-07-21 13:18:12 +00:00
Jon Chery	b953fd4a8e	docs(P01): complete repo-scaffolding phase ... ---ci--- phase: 1 milestone: v1.0 status: complete requirements: covered: [REQ-01, REQ-09] partial: [REQ-10, REQ-12] ---/ci--- Squash merge of phase/01-repo-scaffolding into milestone/v1.0-initial. Phase 01 ships the three-repo scaffold (acdl, acdl-contracts, acdl-evidence), the placeholder index.html on acdl-evidence (D-012/D-016 raw-URL substitute for unsupported Gitea Pages), the qa + prod branches on acdl-contracts (D-013 stand-in for unsupported Gitea environments), the workflow skeletons (pipeline.yml + issue-to-contract.yml), and the idempotent setup + verify scripts. REQ-10/12 remain partial pending Phase 04 full implementation.	2026-07-21 13:10:50 +00:00