6 Commits

Author	SHA1	Message	Date
Jon Chery	cc97a9308d	docs(P09): complete iam-policy-least-privilege phase (v1.13.12) ... ---ci--- project: acdl phase: 9 milestone: v1.14 status: complete requirements: covered: [REQ-143] partial: [] ---/ci---	2026-07-29 20:49:36 +00:00
Jon Chery	a03c01932f	fix(P60/P62): ALB name_prefix + adapter dedup + L2 composition wiring ... Three fixes from CI run 3027 (06f4fc7): 1. ALB name_prefix too long: AWS limits target group name_prefix to 6 chars. Changed from "acdl-ci-alb-" (12) to "tg-ci-" (6). 2. Adapter deduplication: multi-resource L1s (cloudfront with distribution + OAC) expand to multiple stack resources sharing the same terraform dir. The adapter was emitting TWO module blocks for the same dir, the second missing required inputs. Now deduplicates by terraform dir, merging inputs from all resources that point to it. Adapter stays under 200 lines (194). 3. L2 microservice composition: ECR module requires "name" input but the composition didn't wire it. Added wires for ecr.inputs.name (default "app-repo") and roles.inputs.role_name (default "app-role"). Note: the ecs-service/uptime/rds failures in run 3027 were caused by the P64 teardown destroying the CI VPC while the pipeline was still running (timing issue). The next CI run after this push will have a fresh CI VPC. Regression: 485 passed, 5 deselected. ---ci--- project: acdl phase: P60 milestone: v1.11 status: execute ---/ci---	2026-07-29 12:22:00 +00:00
Jon Chery	fda4564a7f	feat(P58): single platform VPC + deterministic env-aware state keys ... EXECUTE stage. Fixes the 4-VPC bug: adds a single shared VPC to terraform/platform, drops the vpc child from the microservice composition (references the platform VPC via data source), and makes state keys env-aware (spike/{id}/{env}/terraform.tfstate — stable across lifecycle). Platform VPC (terraform/platform/main.tf): - aws_vpc.acdl_shared (10.0.0.0/16) + 2 subnets + IGW + route table + SG - Outputs: vpc_id, subnet_ids, ecs_security_group_id Microservice composition (modules/l2/microservice/composition.json): - Dropped the vpc child (no per-contract VPC ever again). - Added data_sources block: platform_vpc → terraform_remote_state (platform). - Wires: vpc.outputs.subnet_ids → platform_vpc.outputs.subnet_ids. - Wires: platform_vpc.outputs.vpc_id → alb.inputs.vpc_id. - Wires: platform_vpc.outputs.ecs_security_group_id → service.inputs.security_group. Contract resolver (core/contract_resolver.py): - Added environment to the stack instance (stack.environment). - Added data_sources handling: pseudo-children with outputs but no resources. - data_sources propagated through fragment merge to the final stack instance. Adapter (adapters/terraform/adapter.py): - State key: spike/{stack_name}/{environment}/terraform.tfstate (env-aware). - Emits data "terraform_remote_state" "platform" block when data_sources present. - ref:platform_vpc.<output> → data.terraform_remote_state.platform.outputs.<output>. Tests (tests/test_adapter.py): - test_adapt_env_aware_state_key: spike/msvc/prod/terraform.tfstate. - test_adapt_emits_data_source_block: data.terraform_remote_state.platform. - test_adapt_no_vpc_for_microservice: no resource "aws_vpc" in microservice output. - Updated existing state key assertion (spike/s3/dev/terraform.tfstate). Regression: 467 passed, 0 skipped, 5 deselected. run_platform.sh --check-only passes for both microservice (9 resources, no VPC) and static-assets (5 resources). ---ci--- project: acdl phase: P58 milestone: v1.11 status: execute ---/ci---	2026-07-28 16:07:57 +00:00
Jon Chery	e1be05287b	feat(P39): refresh design docs + parameterize adapter (P1-1) ... ---ci--- project: acdl phase: 39 milestone: v1.9 status: execute ---/ci--- Phase 39 — design-doc-refresh-and-p1-1-parameterization: Design docs (REQ-100, REQ-101): - hitl_matrix_design.md: 'dev-only spike'/'v1.2 wires the gates' framing replaced with v1.9 wired-gates reality; 8-concern matrix marked implemented (offline-testable subset + signed evidence artifacts, D-084); v1.9 wiring section cross-references hitl_gates.py + attestation_matrix.py; approver_dr noted. - audit_ledger_design.md: outbox marked shipped+production since v1.8; S3 Object Lock + JWS + async worker + DLQ + daily checkpoints clearly labeled 'Deferred to a future milestone (D-083)'; RPO/RTO table updated; approver fields note v1.9 hitl_gates.attest. P1-1 adapter parameterization (REQ-102, D-085): - ecs-service interface.json: desired_count (default 1), launch_type (FARGATE), family (app) inputs added. - alb interface.json: load_balancer_type (application), target_type (ip). - adapter.py: hardcoded defaults replaced with inputs.get(<name>, <default>); hardcoded 'acdl-microservice-rt'/'acdl-microservice-igw' Name tags derive from the VPC name input. - contract_resolver.py: child_input_map routes wires to the sub-resource that declares the input (desired_count → aws:ecs:service, family → aws:ecs:task_definition, target_type → targetgroup, etc.). - microservice composition.json: wires added for the new inputs. Tests: +21 (test_p1_1_adapter_parameterization.py, test_design_docs_current.py). 371 passed; run_ci.sh green; run_platform.sh --check-only green; v1.1 S3 regression preserved.	2026-07-23 04:24:25 +00:00
Jon Chery	de91a4bb76	feat(P31): encryption-by-default + per-stack CMK (REQ-83, REQ-84, REQ-85) ... ---ci--- project: acdl phase: 31 milestone: v1.8 status: execute ---/ci--- - New kms-key L1 primitive (aws:kms:key) with enable_key_rotation=true (AWS-managed annual rotation, D-075). Registered in registry.json. - Adapter TYPE_MAP expanded for aws:kms:key + aws:kms:alias. - Adapter emits enable_key_rotation from NFR. - S3 adapter emits server_side_encryption_configuration with KMS when kms_key_arn provided; managed KMS fallback with stderr warning when not. - All 10 existing L1 primitives now have encryption_enabled NFR (default true). - s3, rds, ecr, ecs-service, ecs-cluster have kms_key_arn input. - Both L2 compositions (static-assets, microservice) now include a kms-key child + wires connecting kms_key_arn to children. - L2 stack outputs include kms_key_arn. Tests: +7 (300 -> 307). All pass. run_platform.sh --check-only green (static-assets now resolves to 5 resources with the CMK).	2026-07-22 22:11:03 +00:00
Jon Chery	f68f85c9fd	review(v1.5): READY TO SHIP — multi-persona code review ... ---ci--- project: acdl phase: 20 milestone: v1.5 status: review verdict: READY TO SHIP p0: 1 (fixed — contract path resolution in deploy workflow) p1: 6 (flagged post-hoc) ---/ci--- Multi-persona review of v1.5 phase 20 (docs + reusable deploy workflow). P0 (blocking) — AUTO-FIXED: - C1: scripts/run_platform.sh contract path resolution broken in deploy workflow. The reusable workflow invokes run_platform.sh from the consumer workspace root with a relative contract path (.acdl/contract.yaml), but run_platform.sh does `cd "$ROOT"` (platform repo) early, so the relative path resolved against the platform repo and the pipeline could never run. Fix (commit 75c2274): capture CALLER_CWD before cd "$ROOT"; resolve caller-supplied relative paths against CALLER_CWD; default no-arg contract stays relative to ROOT (preserves platform-local CI). Reproduced pre-fix; verified post-fix. P1 (important) — FLAGGED FOR POST-HOC REVIEW (do not block ship): - C2: ref: v1.4 in the deploy workflow platform checkout — no v1.4 tag exists (only v1.4.0 / v1.4.1). Operator must create a floating v1.4 tag or change the ref to v1.4.1. - C3: modules/l2/{static-asset,microservice}/README.md still use @v1 in their Usage examples; missed by the v1.4 bump. - S1: static-key override is not wired. ACDL_AWS_* env vars on the OIDC step are not read by aws-actions/configure-aws-credentials@v4 (it reads AWS_* or its own access-key/secret-key inputs). The README/CONSUMER_GUIDE claim a working override that doesn't function as written. Needs a conditional step or renamed env vars + input wiring. - S2: README overstates ABAC repo:org/repo:ref:... scoping. The workflow constructs a numeric role name (github.repository_id); the actual claim enforcement lives in the IAM trust policy, not in this workflow. - T1: no deploy-workflow triggers conformance test (CI workflow has one; deploy doesn't). Minor — reusable workflows use workflow_call, not push triggers, but the contract's triggers field is then unenforced. - A1: terraform/spike/terraform.tf uploaded as artifact leaks the AWS account ID via the state-backend bucket name. Recommend excluding terraform.tf or gating artifact upload to non-public repos. P2 (nits) — listed for awareness: floating-tag terminology imprecision (M1), header comment "Gitea Actions" in the GitHub copy (M2, intentional byte- identical), pip install split (P1-perf), comment drift in pipelines/deploy.yaml header (C4), module README internal inconsistency (C5). Verdict: READY TO SHIP. The one P0 is fixed. The 6 P1s are post-hoc items — the deploy workflow is a scaffold whose first real consumer run requires operator setup (tag, IAM role, secrets) that gates go-live. The P1s should be addressed before any consumer invokes uses: acdl/.gitea/workflows/ deploy.yml@v1.4 in earnest. Tests: 154 pass (19 new). run_ci.sh green.	2026-07-22 17:24:28 +00:00