---ci---
project: acdl
phase: 31
milestone: v1.8
status: execute
---/ci---
- New kms-key L1 primitive (aws:kms:key) with enable_key_rotation=true
(AWS-managed annual rotation, D-075). Registered in registry.json.
- Adapter TYPE_MAP expanded for aws:kms:key + aws:kms:alias.
- Adapter emits enable_key_rotation from NFR.
- S3 adapter emits server_side_encryption_configuration with KMS when
kms_key_arn provided; managed KMS fallback with stderr warning when not.
- All 10 existing L1 primitives now have encryption_enabled NFR (default true).
- s3, rds, ecr, ecs-service, ecs-cluster have kms_key_arn input.
- Both L2 compositions (static-assets, microservice) now include a kms-key
child + wires connecting kms_key_arn to children.
- L2 stack outputs include kms_key_arn.
Tests: +7 (300 -> 307). All pass. run_platform.sh --check-only green
(static-assets now resolves to 5 resources with the CMK).
---ci---
project: acdl
phase: 26
milestone: v1.7
status: execute
---/ci---
The microservice pattern (and any L2 referencing multi-resource L1s like
vpc) failed at the adapter stage because the resolver emitted refs using
the child id (e.g. 'vpc') instead of the expanded sub-resource id (e.g.
'vpc-subnet'). The adapter's type_by_id table only knows the sub-resource
ids, so ref:vpc.subnet_ids was an unknown resource id.
Fix:
- contract_resolver.py: child_outputs now maps {outputName -> resourceId}
instead of just the interface outputs dict. For multi-resource L1s, the
ref uses the sub-resource id that produces the output. For single-resource
L1s, the resourceId == childId (unchanged behavior).
- vpc interface.json: the subnet sub-resource output is 'subnet_ids'
(matching the interface-level output name) instead of 'subnet_id'.
- adapter.py OUTPUT_MAP: aws:ec2:subnet now maps both 'subnet_ids' and
'subnet_id' to 'id'.
Verification:
- microservice pattern check-only: PASS (11 resources)
- static-assets pattern check-only: PASS (4 resources)
- platform check-only: PASS
- full test suite: 266 passed
---ci---
project: acdl
phase: 20
milestone: v1.5
status: review
verdict: READY TO SHIP
p0: 1 (fixed — contract path resolution in deploy workflow)
p1: 6 (flagged post-hoc)
---/ci---
Multi-persona review of v1.5 phase 20 (docs + reusable deploy workflow).
P0 (blocking) — AUTO-FIXED:
- C1: scripts/run_platform.sh contract path resolution broken in deploy
workflow. The reusable workflow invokes run_platform.sh from the consumer
workspace root with a relative contract path (.acdl/contract.yaml), but
run_platform.sh does `cd "$ROOT"` (platform repo) early, so the relative
path resolved against the platform repo and the pipeline could never run.
Fix (commit 75c2274): capture CALLER_CWD before cd "$ROOT"; resolve
caller-supplied relative paths against CALLER_CWD; default no-arg contract
stays relative to ROOT (preserves platform-local CI). Reproduced pre-fix;
verified post-fix.
P1 (important) — FLAGGED FOR POST-HOC REVIEW (do not block ship):
- C2: ref: v1.4 in the deploy workflow platform checkout — no v1.4 tag exists
(only v1.4.0 / v1.4.1). Operator must create a floating v1.4 tag or change
the ref to v1.4.1.
- C3: modules/l2/{static-asset,microservice}/README.md still use @v1 in their
Usage examples; missed by the v1.4 bump.
- S1: static-key override is not wired. ACDL_AWS_* env vars on the OIDC step
are not read by aws-actions/configure-aws-credentials@v4 (it reads AWS_*
or its own access-key/secret-key inputs). The README/CONSUMER_GUIDE claim
a working override that doesn't function as written. Needs a conditional
step or renamed env vars + input wiring.
- S2: README overstates ABAC repo:org/repo:ref:... scoping. The workflow
constructs a numeric role name (github.repository_id); the actual claim
enforcement lives in the IAM trust policy, not in this workflow.
- T1: no deploy-workflow triggers conformance test (CI workflow has one;
deploy doesn't). Minor — reusable workflows use workflow_call, not push
triggers, but the contract's triggers field is then unenforced.
- A1: terraform/spike/terraform.tf uploaded as artifact leaks the AWS account
ID via the state-backend bucket name. Recommend excluding terraform.tf or
gating artifact upload to non-public repos.
P2 (nits) — listed for awareness: floating-tag terminology imprecision (M1),
header comment "Gitea Actions" in the GitHub copy (M2, intentional byte-
identical), pip install split (P1-perf), comment drift in pipelines/deploy.yaml
header (C4), module README internal inconsistency (C5).
Verdict: READY TO SHIP. The one P0 is fixed. The 6 P1s are post-hoc items —
the deploy workflow is a scaffold whose first real consumer run requires
operator setup (tag, IAM role, secrets) that gates go-live. The P1s should
be addressed before any consumer invokes uses: acdl/.gitea/workflows/
deploy.yml@v1.4 in earnest.
Tests: 154 pass (19 new). run_ci.sh green.
---ci---
project: acdl
phase: 10
milestone: v1.1
status: plan-as-execute
persona: platform-engineer
task: [T-10.1, T-10.2, T-10.3, T-10.6]
requirements.covered: [REQ-25]
---/ci---
Wave 1: L2 thin-composition + registry extension + adapter L2 handling.
- T-10.1: modules-ir/l2/l2-static-asset/composition.json (kind=l2, depth=1,
one child l1-s3@1.0.0, wires passthrough).
- T-10.2: modules-ir/registry.json extended with l2-static-asset@1.0.0.
- T-10.3: modules-ir/l2/l2-static-asset/README.md (D-P10-1 doc).
- T-10.6: adapters/terraform/adapter.py - backend key now derived from
the stack name (spike/<stack_name>/terraform.tfstate). The resources
array handling is unchanged; a resolved L2 IR instance has the L1
resource as resources[0], so the existing TYPE_MAP + resource emission
handle it (the adapter is shape-driven, not kind-driven).
---ci---
project: acdl
phase: 9
milestone: v1.1
status: plan-as-execute
persona: platform-engineer
task: [T-9.5, T-9.6, T-9.7, T-9.9]
requirements.covered: [REQ-26]
---/ci---
Waves 2+3: Terraform adapter + generated spike TF + run script.
- T-9.5: adapters/terraform/adapter.py - compiles an IR instance to a
Terraform root module. TYPE_MAP {aws:s3:bucket -> aws_s3_bucket}. Thin
layer; does not own L1 content. Emits main.tf (resource + outputs) +
terraform.tf (required_version/providers + S3 backend, NO
dynamodb_table per D-P09-1) + providers.tf (aws provider region from
the IR). CLI: adapter.py <ir_instance.json> <out_dir>.
- T-9.6: terraform/spike/{main.tf,terraform.tf,providers.tf} - generated
by running the adapter against modules-ir/l1/l1-s3/spike_instance.json.
Committed so verify_phase09.sh can validate/plan without regenerating
(D-P09-4); the verify script will regenerate + diff to prove
reproducibility.
- T-9.7: scripts/run_spike_plan.sh - loads rotated spike key from
gitignored .env.secrets, exports AWS env vars, cd terraform/spike,
terraform init -lock=false, terraform validate, terraform plan
-lock=false -out=tfplan. Plan-only; no apply.
- T-9.9: .gitignore - add terraform/spike/.terraform/ + tfplan +
*.tfstate*.
EXECUTE: ran scripts/run_spike_plan.sh against real AWS via the rotated
spike key (D-039). terraform plan succeeded: 1 to add (the S3 bucket),
outputs computed. One non-blocking deprecation warning (aws_s3_bucket
versioning block -> use aws_s3_bucket_versioning in v1.2). No long-lived
credential in the workflow (key loaded from .env.secrets at runtime).
---ci---
project: acdl
phase: 6
milestone: v1.1
status: plan-as-execute
persona: lead-developer
tasks: [T-6.1, T-6.2, T-6.3, T-6.4]
---/ci---
Archive the v1.0 demo under demo/ (D-037) and reorient the repo to the
real platform. Wave 1 of the Phase 06 plan.
- T-6.1: git mv modules/, scripts/, evidence-ui/, contracts/,
contracts-repo/, .gitea/ -> demo/; mv ACDL_DEMO.md + runner-data/ -> demo/
- T-6.2: scaffold new v1.1 top-level dirs (platform/, schemas/, adapters/,
terraform/, modules-ir/) with .gitkeep
- T-6.3: create top-level scripts/verify_phase06.sh (v1.1 verify scripts
live at top-level, NOT demo/scripts/ which holds the v1.0 demo verify
scripts)
- T-6.4: rewrite README.md to reflect the real platform (vision +
architecture links, new layout, status v1.1 active); add runner-data/
to .gitignore
All moves via git mv (history preserved). Repo root now contains only
README.md, demo/, docs/, .ciagent/, and the new empty v1.1 dirs.
Jon Chery