Commit Graph

7 Commits

Author SHA1 Message Date
Jon Chery 7585c828f0 docs(P48): vision gaps + badge system + substrate→engine + CR format + agentic tags
acdl-ci / Lint (push) Successful in 7s
acdl-ci / Test (push) Successful in 23s
acdl-ci / Platform check-only (offline) (push) Successful in 8s
9 requirements implemented across presentation decks and project docs:

1. DX closing slide: added 'Infrastructure as a utility, not a craft' bullet
   to convey the full vision (infrastructure consumed, not maintained;
   platform compounds value over time).
2. PW Problem slide: 'moving a merged change' → 'promoting a change'.
3. PW Problem slide: added 'Red tape' and 'Scalability without increasing
   headcount' bullets (4 frictions, not 2).
4. PW Roadmap slide: redesigned with side-by-side HTML table layout
   (Testing | Planned), 16px font, no overflow.
5. PW deck: added new slide 'What This Platform Is — and Isn't' after North
   Star (sovereign boundary, infrastructure as utility, 4 anti-goals).
   PW deck now 16 slides (was 15).
6. Maturity nomenclature: 'Available today'/'shipped' → 'Testing' across
   both decks + source markdown. New .testing badge (blue/teal #DBEAFE).
   Roadmap title: 'Testing vs. Planned'. The platform has 0 consumer
   adoption — 'shipped' was inaccurate.
7. Global: 'substrate' → 'engine' across entire project (88 matches, 30+
   files including .ciagent/, docs/, modules/, adapters/, schemas/, code).
8. Presentation files only: 'forge' → 'VCS' / 'version control system'
   (6 occurrences in 4 files). 'forge' retained in all technical docs and
   code as the industry-standard term.
9. New .agentic badge (purple/violet #EDE9FE) appended to agentic features
   in both decks: confidence signal, autonomous dev, pattern recognition,
   dynamic module creation, citizen developer surface, auto-promotion.

Also: Change Request ID format changed from 'CR-2026-001' to 'CHG0678912'
across presentation files, consumer guide, and test fixtures.

HTML re-rendered. PPTX rendered for release upload.

---ci---
phase: 48
milestone: v1.9
status: complete
requirements:
  covered: []
  partial: []
---/ci---
2026-07-23 14:58:29 +00:00
Jon Chery 2bea048bb6 docs(P00): research v1.9 — interpolation, per-env jobs, Wiz, attestation matrix
---ci---
project: acdl
phase: 0
milestone: v1.9
status: research
---/ci---

RESEARCH.md v1.9 addendum:
- RA-1: interpolation prior art + ${env.<field>} syntax choice (D-081)
- RA-2: GitHub/Gitea Actions workflow_call environment input + per-env jobs (D-082)
- RA-3: Wiz GraphQL API shape + PolicyCheckResult mapping (REQ-110)
- RA-4: attestation matrix freshness validation + signed artifacts (D-084)
- RA-5: design doc drift audit (hitl_matrix + audit_ledger)
- RA-6: P1-1 adapter hardcoded defaults audit (D-085)

New decisions surfaced: D-087 (recursive expansion), D-088 (env override
pre-validation), D-089 (signature skip when signing key unset).

PERSONAS.md updated for v1.9: milestone field, lambda-engineer
reactivated (SNS topic), phase-specific overrides for phases 39-43,
domain priority updated.
2026-07-23 04:17:41 +00:00
Jon Chery 7f1eff622d docs(P22-38): research findings + 6 phase plans
---ci---
project: acdl
phase: 22-38
milestone: v1.8
status: research
---/ci---

v1.8 research: 6 targets investigated + 5 decisions surfaced (D-073..D-077).

TARGET 1: uptime-kuma on ECS Fargate (image louislam/uptime-kuma:1,
port 3001, EFS volume, ALB, monitor seeding via post-deploy API script).
TARGET 2: Terraform prevent_destroy lifecycle (2-step decommission pattern).
TARGET 3: AWS KMS rotation (enable_key_rotation=true, annual AWS-managed;
90-day is roadmap item D-075).
TARGET 4: Forge-agnostic API URLs (GITHUB_API_BASE + _forge_type helper).
TARGET 5: DynamoDB as CMDB (acdl-change-requests table + validate_change_request).
TARGET 6: Module engineering standards scan (codified patterns from 12 modules).

PERSONAS.md updated for v1.8: lambda-engineer reactivated (D-068 CMDB +
D-065 API portability). 11 phase-specific overrides added.
2026-07-22 22:01:13 +00:00
Jon Chery dca35c78ec feat(P22): rename static-asset→static-assets + cloudfront/waf primitives + production stack + @v1.6 bump
---ci---
phase: 22
title: rename-and-production-static-assets-stack
status: complete
verification:
  - scripts/run_ci.sh: PASS (CI PIPELINE OK)
  - python3 -m pytest tests/ -v: 175 passed
  - scripts/run_platform.sh --check-only: PASS (PLATFORM CHECK OK)
  - grep -R "static-asset[^s]" . (excl .git/): 0 hits
  - grep -R "static-asset$" . (excl .git/): 0 hits
  - floating git tags v1.6 + v1 point at v1.6.0 (a90a756)
changed_files:
  - Task 1 (rename): contracts/static-asset.yaml→static-assets.yaml (git mv); modules/l2/static-asset→static-assets (git mv); sed replaceAll static-asset→static-assets in 22 files (README, docs, scripts/run_platform.sh, pipelines/deploy.yaml, modules/registry.json, tests/*, .ciagent/* historical narrative)
  - Task 2 (cloudfront primitive): modules/l1/cloudfront/interface.json + README.md
  - Task 3 (waf primitive): modules/l1/waf/interface.json + README.md
  - Task 4 (registry): modules/registry.json (+cloudfront, +waf, static-assets renamed)
  - Task 5 (augment static-assets): modules/l2/static-assets/composition.json (s3+cloudfront+waf, depth 1); modules/l1/s3/interface.json +instance.json (+bucket_regional_domain_name output); modules/l2/static-assets/README.md (production stack docs)
  - Task 6 (adapter): adapters/terraform/adapter.py (+TYPE_MAP/INPUT_MAP/OUTPUT_MAP for cloudfront distribution+OAC+wafv2 webacl; special handling in _emit_resource for OAC defaults, distribution origin/cache_behavior/restrictions/viewer_certificate/web_acl_id, waf scope/default_action/visibility_config/managed rules)
  - Task 7 (contract schema): no change needed (generic inputs object; new module names match ^[a-z][a-z0-9-]*$)
  - Task 8 (@v1.6 bump): contracts/static-assets.yaml, .gitea/.github/workflows/deploy.yml (ref: v1.6 + header comments), docs/consumer-guide.md, docs/contracts/index.md, docs/pipeline/versioning.md, docs/pipeline/index.md, docs/architecture.md, README.md, modules/l2/microservice/README.md, tests/test_environment_check.py, tests/test_pipeline_contract.py
  - Task 9 (floating tags): git tag -f v1.6 v1.6.0; git tag -f v1 v1.6.0
  - Task 10 (tests): tests/test_adapter.py (registry 11 entries/9 L1/2 L2; cloudfront+waf type map tests; TestS3Output bucket_regional_domain_name; TestStaticAssetsStack 4 tests); tests/test_contract_resolver.py (+s3/cloudfront/waf resource assertions)
generated:
  - terraform/spike/main.tf + terraform.tf (regenerated by run_platform.sh --check-only; reflect static-assets production stack + backend key spike/static-assets/)
notes:
  - D-048 full rewrite of .ciagent/ historical narrative (verbatim phase descriptions, REQ-25/27/50, D-036) — produces intentional tautologies (e.g. "Rename static-assets → static-assets") per the decision to override the v1.6 preservation precedent.
  - cloudfront interface.json resources array ordered distribution-first so the resolver (first-match wire resolution) routes bucket_regional_domain_name/waf_web_acl_arn/region to the distribution; the OAC gets adapter-provided defaults (name=acdl-oac, origin_type=s3, signing_behavior=always).
  - .ciagent/ @v1.4 references left as historical record (D-048 scope was static-asset rename only; @v1.4 is historical narrative of Phase 20).
  - s3 OUTPUT_MAP bucket_regional_domain_name not added (identity fallback in adapt() already handles it; OUTPUT_MAP documents non-identity mappings only).
---ci---
2026-07-22 19:56:52 +00:00
Jon Chery 0fea29cdbb docs(P12): plan-as-execute + verify (v1.2.2)
---ci---
project: acdl
phase: 12
milestone: v1.2
status: verify
verdict: VERIFIED
requirements:
  covered: [REQ-30]
---/ci---

Phase 12 plan-as-execute + verify. scripts/verify_phase12.sh green (22
assertions). All Wave 1 + Wave 2 tasks complete:
- T-12.1: run_spike_*.sh -> run_platform.sh (D-048, --plan-only flag)
- T-12.2: spike_runner_policy.json expanded (ECS + ECR + ELB + IAM + EC2)
- T-12.3: idempotency documented in bootstrap scripts
- T-12.4: P1-1 redacted (no live AWS key IDs in .ciagent/)
- T-12.5: P1-B fixed (PERSONAS.md platform/registry -> modules-ir/registry.json)
Subagent confirmed run_platform.sh --plan-only runs against real AWS, exit 0.
Ready to ship v1.2.2.
2026-07-21 21:01:51 +00:00
Jon Chery 1ad9c35fb6 docs(P11): v1.2 research addendum + README rewrite
---ci---
project: acdl
phase: 11
milestone: v1.2
status: research
requirements:
  covered: [REQ-29]
---/ci---

Phase 11 deliverables:
- RESEARCH.md: v1.2 addendum (Targets 9-13). #36988 re-checked (still
  open, 2026-05-27) -> D-047 extends D-039 waiver. NFR audit: spike IAM
  policy already least-privilege (needs ECS/ECR/ELB/IAM expansion for
  Phase 15); bootstrap scripts already idempotent; run_spike_*.sh to
  consolidate into run_platform.sh (D-048); P1-1 redaction targets
  identified in VERIFY.md; PERSONAS.md line 47 stale path. ECS L1
  catalog scoped (D-049): 6 L1s, 9 IR types for the adapter TYPE_MAP.
- README.md: rewritten. v1.1 complete (tag v1.2.0); v1.2 active. Documents
  the actual spike flow (contract -> IR -> plan -> Checkov -> confidence
  -> outbox), how to run (bootstrap, rotate, run_spike_e2e.sh), the real
  repo layout, environments table, credentials/D-039/D-047 waiver. No
  stale 'v1.1 (active)' framing.
2026-07-21 20:56:54 +00:00
Jon Chery 930c24be6d docs(research): OIDC blocker found; adopt D-039..D-046; re-scope Phase 08
---ci---
project: acdl
phase: 0
milestone: v1.1
status: research
research_targets: 10
top_finding:
  - TARGET 1 (conf 0.95): Gitea Actions does NOT support id-token: write / OIDC.
    Real OIDC deferred to v1.2 (blocked on go-gitea/gitea#36988).
    Spike adopts D-039: per-run-rotated long-lived key waiver.
decisions_adopted: [D-039, D-040, D-041, D-042, D-043, D-044, D-045, D-046]
risks:
  - R-1 (highest): OIDC gap -> key-rotation waiver (mitigated by D-039)
  - R-2: Checkov terraform_plan edge cases (mitigated by ACDL_TAG_NAMING skipped record)
  - R-3: 6 confidence inputs are a recommendation (D-040 adopted in PROJECT.md)
---/ci---

RESEARCH.md (1330 lines) authored by ci-researcher. Key findings:

- TARGET 1: Gitea Actions does NOT support emitting an OIDC id-token
  (Gitea docs list id-token as unsupported; go-gitea/gitea#33681 open;
  draft PR #36988 unmerged; Gitea's own CI still uses long-lived keys
  per #37980). Real-AWS OIDC is unachievable in this environment for v1.1.
- TARGETS 2-10: Terraform/Checkov install steps, IR prior art, Checkov
  adapter, DynamoDB outbox, 6-input confidence signal, tiered ledger
  (Object Lock deferred), HITL/SoD, contract schema, archive strategy
  — all resolved with concrete sketches in RESEARCH.md.

Adopted D-039..D-046 in PROJECT.md. Re-scoped Phase 08 (ROADMAP) and
REQ-23 (REQUIREMENTS) to reflect the OIDC blocker: the spike uses a
per-run-rotated long-lived key (D-039) instead of OIDC; real OIDC is a
v1.2 deliverable. ARCHITECTURE.md Gitea API surface table updated with
the OIDC verdict.
2026-07-21 18:03:41 +00:00