The L2 thin-composition layer (composition.json + contract_resolver.py +
contract schema + sample contracts) has been removed completely. The
implementation was unsatisfactory and is deferred for a later redesign.
- Delete: composition.json x2, contract_resolver.py, contracts/ x2,
contract.schema.json
- Patch: run_platform.sh now loads a pre-existing IR instance instead of
resolving a contract (the downstream adapter/checkov/confidence/outbox
pipeline is unchanged)
- Prune: L2 entries removed from registry.json (L1 entries unchanged)
- Rewrite: all 7 L1 module READMEs in plain language (no jargon), each
with Resources/Inputs/Outputs/Usage/Compliance-extension-points/Versioning
sections derived from interface.json
- Add: 2 L2 placeholder READMEs noting the composition is under redesign
- Add: modules-ir/README.md catalog index + README-TEMPLATE.md
---ci---
project: acdl
phase: 17
milestone: v1.3
status: execute
---/ci---
---ci---
project: acdl
phase: 0
milestone: v1.2
status: fix
---/ci---
The expanded policy (4727 chars pretty / 3464 compact) exceeded the AWS
2048-char inline policy limit (total across all inline policies on a user).
Compressed to 1667 chars by: (1) removing DenyEverythingElse (redundant —
IAM is default-deny; the user has no other inline policies), (2) using
action-prefix wildcards (ecs:Create*, ecr:Get*, etc.) instead of listing
every action, (3) removing SIDs.
The compressed policy grants the same effective permissions. The repo
file now matches what should be applied in the AWS Console.
---ci---
project: acdl
phase: 0
milestone: v1.2
status: review
verdict: READY TO SHIP
p0: 1 (operator action, non-code)
p1: 1 (adapter hardening, v1.3)
---/ci---
v1.2 milestone review: READY TO SHIP. 1 P0 (IAM operator action, not a
code fix), 1 P1 (adapter hardening deferred to v1.3). The milestone's code
is complete + verified up to terraform plan (13 to add); the one remaining
step is the operator's IAM policy push. Ship tag v1.3.0.
---ci---
project: acdl
phase: 0
milestone: v1.1
status: complete
decision_closure:
- D-034: root key AKIAYOZHMKZ772SINHFX deactivated by the user in the
AWS IAM console. Verified: sts.get_caller_identity with the root key
returns InvalidClientTokenId; the spike key acdl-spike-runner still
works. D-034 is closed.
---/ci---
User confirmed the bootstrap root key (AKIAYOZHMKZ772SINHFX) was
deactivated in the AWS IAM console. Verified:
- Root key: InvalidClientTokenId (deactivated, as expected).
- Spike key (acdl-spike-runner): still live
(arn:aws:iam::581513795199:user/acdl-spike-runner).
D-034 is closed. The v1.1 milestone is fully shipped + released (v1.2.0)
with no outstanding manual actions.
---ci---
project: acdl
phase: 0
milestone: v1.1
status: audit
verdict: CLEAN
---/ci---
v1.1 milestone audit. Verdict: CLEAN — 0 P0 (no critical issues, no
feedback loop to EXECUTE), 5 P1 post-hoc hygiene items flagged for v1.2
cleanup.
Reconstruction test: PASS. HEAD ci block (d6b1923, == v1.2.0 tag) reads
status: complete, milestone: v1.1, requirements.covered: [REQ-16..28] —
matches the prompt's expected block. Walking back through the ci blocks
reproduces plan -> plan-as-execute -> shipped -> verify for every phase
(06-10) with the correct phase numbers + status progression. Tags
v1.1.0..v1.1.5 + v1.2.0 all present; ROADMAP.md phase statuses match the
tags; REQUIREMENTS.md traceability matches (REQ-16..22 -> v1.1.2,
REQ-23 -> v1.1.3, REQ-24/26 -> v1.1.4, REQ-25/27/28 -> v1.1.5).
File discipline: PASS with one P1 hygiene item. All 10 required .ciagent/
files present (config.json, PROJECT, ARCHITECTURE, REQUIREMENTS, ROADMAP,
PERSONAS, PLAN, RESEARCH, VERIFY, REVIEW). PLAN.md = Phase 10 (last
phase, not stale). VERIFY.md = Phase 10 (last verification). REVIEW.md
present (milestone review). No orphan files. PROJECT.md correctly frames
v1.1 as architecture finalization + v1 spike (no "30-min stub demo" as
current objective; v1.0 demo archived under demo/). P1-A: config.json
status field still reads "specify" (milestone is complete); PERSONAS.md
territory paths use stale platform/ prefix (renamed to acdl_platform/ in
Phase 08 prep commit 727c873) on lines 7, 38, 47, 56, 80, 109.
Branch hygiene: PASS. git branch -a shows only main + milestone/v1.0-initial
+ remotes/origin/*. No leftover phase/NN-* branches (all 5 deleted
post-merge). Working tree clean (gitignored artifacts excluded).
Commit discipline: PASS with one P1 hygiene item. 45 of 48 commits in
v1.1.0..HEAD carry a well-formed ---ci--- block with project/phase/
milestone/status from the documented set. The 3 no-ci commits
(52665b8 Add docs/architecture.md, 7614c41 Add docs/vision.md, b84a8a2
Update docs/architecture.md) are pre-specify upstream-doc ingestion
commits — each is an ancestor of the v1.1 specify commit (288607b); they
predate the v1.1 CIAgent protocol and fall inside the audit range only
because v1.1.0 is tagged at the v1.0 Phase 05 traceability commit. P1-C:
document tag-placement guidance in run.md for v1.2. Field usage rules
hold: release.tag only on the 5 ship commits; verdict only on the 5
verify + 1 review commit; requirements.covered on plan-as-execute +
complete. Merges: exactly the 5 documented --no-ff squash-merge ship
commits (each with 2 parents: prior verify + phase branch tip); no other
merges. All ci blocks close with ---/ci--- (no malformed closes).
P1-1 (carried-forward from REVIEW.md): two AWS access key IDs in
.ciagent/VERIFY.md Phase 09 narrative — public identifiers, not secret
pairs, in the audit narrative not in executable code. Non-blocking;
recommended redaction for v1.2.
P1-D: ROADMAP.md line 81 says "audit pending" — now stale (this audit
closes it).
No critical issues. The milestone is shippable as-is. The v1.2.0 tag on
main HEAD is valid.
---ci---
project: acdl
phase: 10
milestone: v1.1
status: verify
verdict: VERIFIED
---ci---
Phase 10 milestone capstone verified. All four layers PASS:
- Structural: 9 deliverable files + regenerated TF present; composition.json
shape correct (kind=l2, depth=1, one child l1-s3@1.0.0); registry has both
l1-s3@1.0.0 + l2-static-asset@1.0.0; spike.yaml valid; resolver/outbox/adapter
all export the required functions + CLIs; backend key derived from stack name
per D-P10-1 (spike/l2-static-asset/terraform.tfstate). Tags v1.1.0..v1.1.5
present; .gitignore has the P1-2 lock-file fix.
- Behavioral: verify_phase10.sh exits 0 with all 8 checks green against real
AWS. Typecheck OK. Resolver cross-check emits an IR-schema-valid instance.
Adapter cross-check emits main.tf with aws_s3_bucket + the D-P10-1 backend
key. E2E runner prints 'SPIKE E2E OK'; confidence score=0.8 band=pass for
dev; outbox put_item succeeded (Count>=1 in DynamoDB).
- Security: no .env*/tfstate/key/tfplan/.terraform.lock.hcl committed in
v1.1.4..v1.1.5. No AKIA leak in any Phase 10 deliverable (matches only in
.ciagent/VERIFY.md P09 narrative — public key IDs, not secret pairs; P1-1
carried forward, not introduced here). .env.secrets gitignored + holds only
the spike user key (root key id absent). No long-lived credential in the
generated TF. Outbox writer is append-only (0 delete/update_item calls).
E2E runner is plan-only (0 terraform apply calls).
- Quality: README layout table still matches reality. All 8 Phase 10 commits
carry ---ci--- blocks. ROADMAP Phase 10 = complete (v1.1.5); REQUIREMENTS
REQ-25/27/28 = complete (v1.1.5). L2 README internally consistent.
D-P10-1/2/3 spike scope respected. REQ-28 (the binding spike claim) holds:
the adapter is the only substrate-specific code; acdl_platform/ Python +
modules-ir/ JSON are substrate-agnostic.
P0: none. P1: none new (P1-1 from P09 carried forward — recommended redaction
of two public access key IDs in the .ciagent/VERIFY.md P09 narrative; non-
blocking for v1.2 ship).
---ci---
project: acdl
phase: 10
milestone: v1.1
status: shipped
release:
tag: v1.1.5
---/ci---
Squash merge of phase/10-v1-spike-l2-and-contract-e2e (the milestone capstone).
The end-to-end spike pipeline succeeds against real AWS:
- contracts/spike.yaml (l2-static-asset, dev) validates against the
contract schema
- contract_resolver.py resolves it to an IR instance (validates against
ir.schema.json)
- adapter.py compiles the IR to terraform/spike/*.tf (aws_s3_bucket)
- terraform plan -lock=false succeeds (real AWS, 1 to add)
- checkov on the TF -> 12 PolicyCheckResult records (checkov_adapter.py)
- confidence_signal.py -> score 0.8, band pass (dev >= 0.50)
- outbox_writer.py -> DynamoDB put_item (hash chain GENESIS, RPO=0)
REQ-28 verified: the adapter (adapters/terraform/) is the only
substrate-specific code; modules-ir/ + schemas/ + contracts/ +
acdl_platform/ are substrate-agnostic (the IR commitments hold, no
polyglot mess). verify_phase10.sh green.
---ci---
project: acdl
phase: 10
milestone: v1.1
status: plan-as-execute
persona: lead-developer
task: T-10.9
requirements.covered: [REQ-28]
---/ci---
Wave 4: scripts/verify_phase10.sh - the capstone gate (8 checks).
(a) composition.json shape (l2 depth=1 one child l1-s3@1.0.0)
(b) spike.yaml validates against contract schema
(c) resolver py_compiles + emits IR validating against ir.schema.json
(d) adapter py_compiles + emits main.tf with aws_s3_bucket
(e) run_spike_e2e.sh exits 0 (full pipeline end-to-end)
(f) confidence band is pass for dev
(g) outbox item present (query DynamoDB by PK)
(h) REQ-28: the adapter is the only substrate-specific code. acdl_platform/
Python has no aws_s3_bucket; modules-ir/ JSON has no aws_s3_bucket as a
resource-type value (docs/descriptions excluded — they reference the
mapping, which is allowed); adapters/terraform/ has aws_s3_bucket (it
should — it is the substrate-specific code). The IR commitments hold.
VERIFIED - Phase 10: L2 + contract-e2e; IR commitments hold (REQ-28).
---ci---
project: acdl
phase: 10
milestone: v1.1
status: plan-as-execute
persona: backend-engineer
task: [T-10.4, T-10.5, T-10.7]
requirements.covered: [REQ-27]
---/ci---
Wave 2: contract + resolver + outbox writer.
- T-10.4: contracts/spike.yaml - the spike contract (stack:
l2-static-asset, environment: dev, inputs bucket_name + region). D-P10-2:
YAML consumer surface; the resolver parses YAML -> validates against the
JSON contract schema.
- T-10.5: acdl_platform/contract_resolver.py - resolve(contract_path) ->
IR instance. 7 steps: load YAML, validate contract schema, look up L2 in
registry, load composition.json, map inputs through wires, emit IR
instance, validate IR against ir.schema.json. Verified end-to-end:
spike.yaml -> IR instance with kind=l2, one l1-s3 resource, validates
against ir.schema.json.
- T-10.7: acdl_platform/outbox_writer.py - write_event(event) ->
DynamoDB put_item. SHA-256 over canonical JSON, prev_event_hash=GENESIS
for the first event (D-P10-3), PK contractId, SK eventType#eventTs, TTL
expire_at = now + 365d (D-044). stdlib + boto3.
Also regenerated terraform/spike/{main.tf,terraform.tf} by running the
adapter against the resolved L2 IR (the backend key is now
spike/l2-static-asset/terraform.tfstate, derived from the stack name per
D-P10-1).
---ci---
project: acdl
phase: 10
milestone: v1.1
status: plan-as-execute
persona: platform-engineer
task: [T-10.1, T-10.2, T-10.3, T-10.6]
requirements.covered: [REQ-25]
---/ci---
Wave 1: L2 thin-composition + registry extension + adapter L2 handling.
- T-10.1: modules-ir/l2/l2-static-asset/composition.json (kind=l2, depth=1,
one child l1-s3@1.0.0, wires passthrough).
- T-10.2: modules-ir/registry.json extended with l2-static-asset@1.0.0.
- T-10.3: modules-ir/l2/l2-static-asset/README.md (D-P10-1 doc).
- T-10.6: adapters/terraform/adapter.py - backend key now derived from
the stack name (spike/<stack_name>/terraform.tfstate). The resources
array handling is unchanged; a resolved L2 IR instance has the L1
resource as resources[0], so the existing TYPE_MAP + resource emission
handle it (the adapter is shape-driven, not kind-driven).
---ci---
project: acdl
phase: 9
milestone: v1.1
status: verify
verdict: VERIFIED
---/ci---
Four-layer verification of Phase 09 (v1-spike-ir-and-l1-and-adapter):
- Layer 1 Structural: PASS (9/9 deliverables; interface/instance/registry/adapter/TF/gitignore/tags/history all correct)
- Layer 2 Behavioral: PASS (verify_phase09.sh exit 0; typecheck; adapter reproducible; IR schema validates; unsupported IR type -> ValueError; terraform validate)
- Layer 3 Security: PASS (no secret pairs leaked; spike key gitignored + holds spike user key not root; no creds in TF/adapter; plan-only no apply)
- Layer 4 Quality: PASS (README layout accurate; all P09 commits carry ---ci--- blocks; ROADMAP/REQUIREMENTS traceability updated; D-P09-1..4 respected; versioning warning non-blocking)
P0: none. P1: (P1-1) two AWS access key IDs (public identifiers, not secret pairs) appear in the Phase 08 verify narrative at .ciagent/VERIFY.md commit 6d27dad which falls in the v1.1.3..v1.1.4 range — recommend redacting to placeholders in a future hygiene pass (the Phase 09 gate's AKIA scan correctly excludes .ciagent/). P1-2: terraform/spike/.terraform.lock.hcl is untracked and NOT covered by .gitignore (the PLAN's gitignore list missed it) — recommend adding it to .gitignore in a future hygiene pass.
Real terraform plan against AWS succeeded (rotated spike key, plan-only, -lock=false per D-P09-1).
---ci---
project: acdl
phase: 9
milestone: v1.1
status: plan-as-execute
persona: platform-engineer
task: [T-9.5, T-9.6, T-9.7, T-9.9]
requirements.covered: [REQ-26]
---/ci---
Waves 2+3: Terraform adapter + generated spike TF + run script.
- T-9.5: adapters/terraform/adapter.py - compiles an IR instance to a
Terraform root module. TYPE_MAP {aws:s3:bucket -> aws_s3_bucket}. Thin
layer; does not own L1 content. Emits main.tf (resource + outputs) +
terraform.tf (required_version/providers + S3 backend, NO
dynamodb_table per D-P09-1) + providers.tf (aws provider region from
the IR). CLI: adapter.py <ir_instance.json> <out_dir>.
- T-9.6: terraform/spike/{main.tf,terraform.tf,providers.tf} - generated
by running the adapter against modules-ir/l1/l1-s3/spike_instance.json.
Committed so verify_phase09.sh can validate/plan without regenerating
(D-P09-4); the verify script will regenerate + diff to prove
reproducibility.
- T-9.7: scripts/run_spike_plan.sh - loads rotated spike key from
gitignored .env.secrets, exports AWS env vars, cd terraform/spike,
terraform init -lock=false, terraform validate, terraform plan
-lock=false -out=tfplan. Plan-only; no apply.
- T-9.9: .gitignore - add terraform/spike/.terraform/ + tfplan +
*.tfstate*.
EXECUTE: ran scripts/run_spike_plan.sh against real AWS via the rotated
spike key (D-039). terraform plan succeeded: 1 to add (the S3 bucket),
outputs computed. One non-blocking deprecation warning (aws_s3_bucket
versioning block -> use aws_s3_bucket_versioning in v1.2). No long-lived
credential in the workflow (key loaded from .env.secrets at runtime).
Jon Chery