continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity
368 Commits 1 Branch 190 Tags
e3f4ce17d4f87890fb0bb4f72efa8571f287fe82
Commit Graph

31 Commits

Author SHA1 Message Date
Jon Chery a4c5f332f6 feat(P1): sync_to_nova.sh — manual-only 2nd-release pipeline into ~/nova (REQ-229) 
Replaces scripts/sync_to_gl.sh (kitchen-sink mirror sync into ~/gl/acdl) with
scripts/sync_to_nova.sh — a manual-only, consumer-subset, domain-committed
2nd-release pipeline into ~/nova (GitLab jonathanchery/nova, separate repo +
history, consumer/platform-team audience).

- Manual-only gate: refuses without --release / RELEASE_CONFIRMED=1 (exit 2).
  Never triggerable by CI.
- Consumer subset: excludes .ciagent/, .gitea/, .env*, terraform/, demo/,
  runtime metrics artifacts, and 18 internal-only scripts (EXCLUDE_SCRIPTS).
  Keeps consumer runbooks + metrics export views (README, powerbi,
  TRUST_SNAPSHOT). Protects ~/nova/.git via rsync --filter=P .git.
- Domain-based commits: 13 fixed-order domains (config, core, adapters,
  modules, contracts, schemas, pipelines, mcp, skills, scripts, tests, docs,
  workflows). Each changed domain gets its own conventional commit supplied
  positionally via repeated -m flags. No kitchen-sink commit.
- Conventional-commit validation: regex-enforced (feat|fix|docs|chore|...);
  bypass via --no-verify-format.
- Modes: --list-domains, --dry-run, --no-push, -v, -h.
- Tests: TestSyncToNovaScript (8 tests) covers gate, domain order, exclude
  list, consumer-script inclusion, .git protection filter, conventional
  regex.

Decisions: D-143 (target ~/nova), D-144 (conventional commits per domain,
not ---ci--- audit blocks), D-145 (manual-only trigger), D-146 (13 fixed
domains, positional-over-changed mapping), D-147 (coreci/Atelier review
gate deferred).

---ci---
project: acdl
phase: 1
milestone: v1.19
status: execute
requirements:
  covered: [REQ-229]
  partial: []
---/ci---
 2026-08-06 15:40:11 +00:00
Jon Chery d048460abf docs(init): validate specification — v1.18 Citizen Developer & Production-Grade Guidance 
Establish v1.18 active milestone (was v1.17 complete). Author 15 new
requirements (REQ-214..228) across 5 user-directed inputs: S&P Global
theme restoration, PDLC-upstream scope, RACI matrix, Nova input contract
(submission-readiness schema + validator), Atelier integration (skills +
MCP server). Add v1.18 objective to PROJECT.md + ROADMAP.md. Feature
milestone; tags run on v1.17.x patch line.

---ci---
project: acdl
phase: 0
milestone: v1.18
status: specify
---/ci---
 2026-08-06 14:54:22 +00:00
Jon Chery b054849a99 docs(P4): metrics catalog + NORTH_STAR integration + trust snapshot + no-humans thesis (REQ-186,191..195,204,210..213) 
P4 (Wave 3, docs) — REQ-186, 191, 192, 193, 194, 195, 204, 210, 211, 212, 213

New docs:
- docs/METRICS.md — canonical KPI catalog (grounded/derived/deferred)
- docs/metrics/*.md — 13 per-KPI definition-of-success docs (D-127)
- docs/METRICS_DEFERRED_ROADMAP.md — 8 deferred metrics + hot-path plan + re-eval triggers (REQ-210)
- docs/NO_HUMANS_THESIS.md — thesis defensibility brief (REQ-213)

New tools:
- core/metrics/trust_snapshot.py — 5 trust metrics + chain-integrity verdict + snapshot hash (REQ-211)
- scripts/check_north_star_diff.sh — CI check for NORTH_STAR strategic section changes (REQ-204)

Modified:
- .ciagent/config.json — strategic_direction_file: .ciagent/NORTH_STAR.md (REQ-186)

---ci---
project: acdl
phase: 4
milestone: v1.17
status: execute
---/ci---
 2026-08-04 20:05:06 +00:00
Jon Chery 7fc646d773 docs(init): validate specification — v1.17 Strategic Direction, Leadership Metrics & Unified Story 
---ci---
project: acdl
phase: 0
milestone: v1.17
status: specify
---/ci---
 2026-08-04 19:08:31 +00:00
Jon Chery f83b974c0e Merge milestone/v1.16-nova-simplification — v1.16 complete (Nova Simplification: 20-phase NFR sweep + final; tag v1.15.26)
acdl-ci / Lint (push) Successful in 11s
Details
acdl-ci / Platform check-only (offline) (push) Successful in 29s
Details
acdl-ci / Test (push) Failing after 7m25s
Details
2026-08-01 13:37:18 +00:00
Jon Chery 787a6490a5 docs(audit): v1.15 post-milestone audit — PASS (rebrand header fixes + 6 checks)
acdl-ci / Lint (push) Successful in 10s
Details
acdl-ci / Platform check-only (offline) (push) Successful in 23s
Details
acdl-ci / Test (push) Successful in 5m53s
Details 
Audit of v1.15-Nova milestone: reconstruction PASS (27 commits, 20 with
ci blocks, 7 merges per convention, state matches checkpoint). File
discipline: 10 auto-fixed rebrand-completeness gaps — 9 .ciagent/*.md
headers still said ACDL (PROJECT/REQUIREMENTS/ROADMAP/RESEARCH/AUDIT/
REVIEW/COST/IAM_POLICY/CAPABILITY_INVENTORY → Nova) + config.json
projects[].name → Nova. Active v1.15 sections already Nova; historical
v1.1-v1.14 narratives left as-is. Branch hygiene PASS (6 phases + 1
milestone all merged, 0 orphans). Commit discipline PASS (0 non-merge
commits without ci blocks, 0 unresolved escalations). 6 audit checks
all PASS. Verdict: PASS.

---ci---
project: acdl
phase: 5
milestone: v1.15
status: complete
phase_role: final
audit: pass
---/ci---
 2026-07-30 14:37:58 +00:00
Jon Chery 59a71d332a docs(init): validate specification — v1.15-Nova rebrand milestone 
Establish milestone v1.15 (Nova Rebrand) — Major/breaking milestone.
Ideation output (--ideate): 10 requirements REQ-155..REQ-164 mapping
the full ACDL→Nova rebrand across docs, decks, code, configs, CI, env
var prefixes, consumer contract path, SSM paths, AWS tag keys, and
AWS resource names. Staged 4-phase migration + final review/ship.
Tags run on the v1.14.x patch line: v1.14.0 (P0) → v1.14.5 (P5 final).

---ci---
project: acdl
phase: 0
milestone: v1.15
status: specify
---/ci---
 2026-07-30 00:00:52 +00:00
Jon Chery 3b1181f39b Merge milestone/v1.14-refinement — v1.14 complete (NFR Refinement: bug fixes, security, stubs, tests, docs; 20 phases + final; tag v1.13.24)
acdl-ci / Lint (push) Successful in 10s
Details
acdl-ci / Platform check-only (offline) (push) Successful in 25s
Details
acdl-ci / Test (push) Successful in 6m34s
Details 
v1.14 NFR Refinement milestone complete. 20 execution phases (P1-P20) +
1 final (P21). All P1/P2 backlog from v1.11 review resolved. Security
posture hardened (swallowed errors, account ID externalized, IAM scoped,
schema validation, credential hygiene). Stubs resolved (kyverno --kube-
version removed). 7 untested scripts gained coverage. Documentation
synced (ARCHITECTURE v1.11-v1.14 addenda, stale @v1.6-1.9 -> @v1.13,
GRILL G-005/G-008 resolved, COST.md window extended, D-083 deferral
recorded). Platform VPC parameterized.

561 tests pass (was 528 at v1.13.2; +33). 22/22 capabilities Verified.
6 grill binding decisions (G-101..G-106) applied. 1 escalation (E-001)
auto-resolved at full autonomy (D-101).

---ci---
project: acdl
phase: 21
milestone: v1.14
status: complete
---/ci---
 2026-07-29 21:36:37 +00:00
Jon Chery 0e2d213c39 verify(P##): code review — config.json schema migration (0 P0, 2 P1/P2 auto-fixed)
acdl-ci / Lint (push) Successful in 8s
Details
acdl-ci / Test (push) Successful in 5m54s
Details
acdl-ci / Platform check-only (offline) (push) Successful in 21s
Details 
Regenerate .ciagent/config.json to the updated CIAgent schema:
- Drop removed fields (mode, projects[].milestone/status/branch/tag)
- Migrate top-level gitea -> release.gitea (forge: gitea)
- Add new sections: secrets, release, ship, backend, ideation,
  personas, logging, telemetry, active_projects, security.bash_allowlist
- Preserve autonomy/parallelization/verification/git/sessions values
- Preserve custom gitea token env var (ACDL_GITEA_TOKEN) via secrets.scopes

Review findings auto-fixed:
- P1: add .ciagent/logs/ to .gitignore (runtime log artifact hygiene)
- P2: restore trailing newline in config.json

---ci---
project: acdl
phase: 0
milestone: v1.13
status: verify
lessons:
  - P1: .ciagent/logs/ default logging.file target was untracked — gitignore it
  - P2: config.json lost trailing newline during regeneration — restored
---/ci---
 2026-07-29 15:06:00 +00:00
Jon Chery de1657394e docs(milestone): complete v1.13 — Presentation Polish (tag v1.13.0)
acdl-ci / Lint (push) Successful in 9s
Details
acdl-ci / Test (push) Successful in 6m15s
Details
acdl-ci / Platform check-only (offline) (push) Successful in 22s
Details 
Update config.json (active milestone v1.12 -> v1.13, ship_tag v1.13.0)
and ROADMAP.md (add v1.13 summary line + full v1.13 section documenting
P71, the 6 new diagrams, the story-arc restructure, and the review outcome).

NFR milestone — final patch (v1.13.0) IS the deliverable. No separate
milestone tag.

---ci---
project: acdl
phase: 0
milestone: v1.13
status: complete
---/ci---
 2026-07-29 14:54:53 +00:00
Jon Chery 0f6d10a2b6 docs(milestone): complete v1.12 — Presentation Refinement (tag v1.12.0) 
---
ci---
project: acdl
phase: 0
milestone: v1.12
status: complete
requirements:
  covered: [REQ-129, REQ-130, REQ-134, REQ-131, REQ-132, REQ-133]
  partial: []
---
/ci---

Milestone v1.12 complete. All 6 requirements satisfied:
- REQ-129: adapter dedup defect fixed (CAP-013 Verified).
- REQ-130: 2 regression-probe bugs fixed (CAP-017/018).
- REQ-134: lifecycle tests plan-only default + ACDL_LIFECYCLE_MODE flag.
- REQ-131: decks match CAPABILITY_INVENTORY.md (22/22 Verified, zero
  stale claims except the honest 'v1.10 status is closed' disclosure).
- REQ-132: decks reflect v1.11 architecture + roadmap (v1.10 no longer
  NEXT); version refs bumped to @v1.12.
- REQ-133: A6 (real cost figures + pre-mortem) + A7 (stateless adapter +
  lifecycle pipeline); HTML re-rendered; PPTX exported for the release.

Verification: 522 tests pass; 22/22 capabilities Verified (D-091);
run_platform.sh --check-only green; run_ci.sh green; ci-doc-verifier
grep clean; multi-persona review clean (P1 remediated).

ROADMAP.md v1.12 section added; v1.11 marked complete; config.json
status -> complete, ship_tag v1.12.0. Version refs @v1.11 -> @v1.12
(decks re-rendered). PPTX in /tmp/v1.12-release/ for the Gitea upload.
 2026-07-29 13:48:06 +00:00
Jon Chery aebc63127d docs(P66): v1.12 init + research — presentation refinement drift audit 
---
ci---
project: acdl
phase: 66
milestone: v1.12
status: specify
---
/ci---

---
ci---
project: acdl
phase: 66
milestone: v1.12
status: research
---
/ci---

Spec: validate v1.12 specification (presentation refinement, decks-only
surface + one adapter fix + two probe fixes). REQUIREMENTS.md gains
REQ-129..REQ-133. config.json milestone v1.11 -> v1.12, branch
milestone/v1.12-presentation.

Research: drift audit (9 items) comparing docs/presentations/* against
v1.11-verified reality. Regression gate (D-091) re-run surfaced 3 Broken
capabilities: CAP-013 (real adapter dedup defect, Class A), CAP-017
(probe over-strict re locals.tf, Class B/C), CAP-018 (probe stale
LocalLambdaStub signature, Class B/C). PRE_MORTEM.md FM-3 requires decks
to match verified reality; the inventory's 22/22 claim is overstated
until CAP-013 is fixed. Decisions D-108 (fix defect inside v1.12),
D-109 (deck version refs @v1.11 -> @v1.12 at Phase 70).
 2026-07-29 12:51:13 +00:00
Jon Chery a6e306a904 docs(init): validate v1.11 RESTART specification 
SPECIFY stage. v1.11 — RESTART: stateless adapter + pipeline-driven
module lifecycle testing. Branches off v1.10.2 (clean); abandons the
failed first attempt (phase/56-iam-re-bootstrap + phase/57-live-deploy-
microservice, which produced 4 drifted VPCs, ran terraform apply from
Python, and had no module lifecycle tests).

Three corrections:
1. Stateless adapter — adapter.py (918 lines, 3 constant tables, 39
   type-specific branches) → ~80-line assembler; each L1 ships a real
   terraform/ module dir (variables/locals/main/outputs) owning its
   resource shape, nested blocks, defaults.
2. Terraform owns lifecycle — run_platform.sh gains --apply/--destroy;
   Python never runs terraform; verify_deploy_microservice.py deleted.
3. Pipeline-driven testing — modules-lifecycle pipeline (Gitea + GitHub,
   byte-identical) matrix-runs each L1 examples/{simple,complex}.yml
   through apply→modify→destroy; no per-module Python.

Single platform VPC (terraform/platform owns ONE VPC; microservice
references it via data source). Deterministic env-aware state keys
(spike/{id}/{env}/terraform.tfstate, stable across lifecycle).

13 phases (P56a–P65). 6 new requirements (REQ-123..128) + 6 carried
(REQ-116,118,119,120,121,122). Feature milestone → v1.11.0.

---ci---
project: acdl
phase: 0
milestone: v1.11
status: specify
---/ci---
 2026-07-28 16:07:57 +00:00
Jon Chery 2697775470 docs(milestone): complete v1.10 — pipeline regression fix + capability re-verification 
v1.10 milestone COMPLETE. 4 phases (52-55) shipped + verified:
- P52: regression-class VERIFY (D-091) — catches capability decay
- P53: local emulating adapters (D-092) — full local E2E, no AWS
- P54: capability re-verification sweep (D-093) — 16/16 Verified, 7 adapter defects fixed
- P55: rewrite PROJECT/ROADMAP/decks to verified reality (D-094)

Review: READY TO SHIP (0 P0, 0 P1, 1 P2 post-hoc).
Audit: PASS (reconstruction, file discipline, branch hygiene, commit discipline).
Regression gate: 16/16 capabilities Verified (12 local + 4 live-AWS).
Tests: 513 fast + 5 slow, all pass.

Tag v1.10.0 (next minor; fix/test/docs, not a breaking schema change).

---ci---
project: acdl
phase: 0
milestone: v1.10
status: complete
requirements:
  covered: [REQ-112, REQ-113, REQ-114, REQ-115]
  partial: []
---/ci---
 2026-07-27 18:29:33 +00:00
Jon Chery 772ac721b0 docs(P52): create v1.10 milestone plan — pipeline regression fix + capability re-verification 
---ci---
project: acdl
phase: 52
milestone: v1.10
status: plan
decisions: [D-090, D-091, D-092, D-093, D-094]
requirements: [REQ-112, REQ-113, REQ-114, REQ-115]
---/ci---
 2026-07-27 17:10:09 +00:00
Jon Chery 5365bb4e0a docs(milestone): complete v1.9 — verify + review + audit + tag v1.9.0 
---ci---
project: acdl
phase: 0
milestone: v1.9
status: complete
requirements:
  covered: [REQ-100, REQ-101, REQ-102, REQ-103, REQ-104, REQ-105, REQ-106, REQ-107, REQ-108, REQ-109, REQ-110, REQ-111]
  partial: []
---/ci---

v1.9 milestone COMPLETE. All 12 requirements satisfied.

Verify: 4 layers PASS (structural 26/26 files, behavioral 493 tests +
run_ci.sh + run_platform.sh --check-only green, security, quality).
Review: 0 P0, 0 P1 (READY TO SHIP). REVIEW.md reconstructed (D-086).
Audit: PASS (reconstruction, file discipline, branch hygiene, commit
discipline — 12/12 commits with ---ci--- blocks).

Updated:
- .ciagent/REQUIREMENTS.md: v1.9 section marked complete; traceability
  table REQ-100..111 added.
- .ciagent/ROADMAP.md: v1.9 marked complete; Phase 43 added.
- .ciagent/PROJECT.md: v1.9 objective marked complete.
- .ciagent/config.json: milestone v1.9 status -> complete.
- .ciagent/REVIEW.md: reconstructed with v1.9 content (D-086).
- .ciagent/VERIFY.md: v1.9 4-layer verify.
- .ciagent/AUDIT.md: v1.9 audit (PASS).
- uses:/ref: bumped @v1.6 -> @v1.9 in contracts/, deploy workflows,
  docs/consumer-guide.md (D-071 successor).

Tag v1.9.0 created next; floating v1.9 + v1 tags updated.
 2026-07-23 04:46:04 +00:00
Jon Chery 136ec6abf3 docs(init): validate v1.9 specification 
---ci---
project: acdl
phase: 0
milestone: v1.9
status: specify
---/ci---

v1.9 scope (user-directed, 2026-07-23):
- Design doc refresh (hitl_matrix_design.md + audit_ledger_design.md)
- Contract interpolation (${env.<field>} + ${contract.<field>})
- Per-environment CI jobs (no environment field editing for promotion)
- Stub implementation (SoD, HITL gates, attestation matrix, Wiz, Kyverno)
- P1-1 adapter parameterization remediation

Requirements REQ-100..REQ-111 added to REQUIREMENTS.md.
PROJECT.md v1.9 objective + phase table (39-43) appended.
config.json milestone bumped to v1.9 (active).
 2026-07-23 04:15:41 +00:00
Jon Chery c99da9a58c docs(milestone): complete v1.8 — P1 remediation + uptime + standards + encryption + decommission + docs 
---ci---
project: acdl
phase: 0
milestone: v1.8
status: complete
requirements:
  covered: [REQ-76, REQ-77, REQ-78, REQ-79, REQ-80, REQ-81, REQ-82, REQ-83, REQ-84, REQ-85, REQ-86, REQ-87, REQ-88, REQ-89, REQ-90, REQ-91, REQ-92, REQ-93, REQ-94, REQ-95, REQ-96, REQ-97, REQ-98, REQ-99]
  partial: []
---/ci---

v1.8 milestone complete. 11 phases (28-38), 24 requirements (REQ-76..99).

Track 1 — P1 Remediation (8 issues, all resolved):
- P1-3: SSM fail-loud without CMK + escape hatch
- P1-4: WAF custom rules emit nested HCL blocks
- P1-5: WAF default_action input honored
- P1-6: Terraform-rendered invoke policy (no placeholder account ID)
- P1-7: L2 composition outputs resolved + adapter output blocks
- P1-8: Per-run temp dir (terraform/spike removed)
- P1-9: Forge-agnostic API URLs (GITHUB_API_BASE)
- S1: Static-key override wired to configure-aws-credentials inputs

Track 2 — Encryption + Deletion Protection by Default:
- Per-stack CMK (kms-key primitive, 90-day rotation, no shared keys)
- All 12 primitives have encryption_enabled NFR + kms_key_arn input
- L2 modules wire per-stack CMK to all children
- All 12 primitives have deletion_protection NFR (default true)
- Adapter emits lifecycle { prevent_destroy = true }
- L2 feature flag propagation (inputs.deletion_protection)

Track 3 — Uptime + Standards + Docs:
- uptime-kuma primitive (ECS Fargate, feature flag, alert channels)
- deploy-uptime pipeline stage (separate state)
- Decommission mode (2-step HITL SRE gates + CMDB validation)
- modules/STANDARDS.md (L1+L2 authoring + review standards)
- schemas/README.md, pipelines/README.md, adapters/README.md

Tests: 275 -> 350 (+75 new). All pass. run_ci.sh + check-only green.
Zero pending P1 issues remaining.
 2026-07-22 22:24:15 +00:00
Jon Chery bab2cf363b docs(init): validate v1.8 specification 
---ci---
project: acdl
phase: 0
milestone: v1.8
status: specify
---/ci---

v1.8 specification validated. 11 phases (28-38), 24 new requirements
(REQ-76..99). Three tracks: P1 remediation (P1-3..P1-9 + S1), encryption
+ deletion protection by default + decommission alias, uptime monitoring
+ engineering standards + path documentation. Feature milestone, ship
tag v1.8.0.
 2026-07-22 21:59:29 +00:00
Jon Chery fee59944fd docs(init): validate v1.7 specification 
---ci---
project: acdl
phase: 0
milestone: v1.7
status: specify
---/ci---

v1.7 milestone: production platform + contract ingestion + pipeline
maturation. 12 user-directed scope axes (2026-07-22):
  1. rename static-asset -> static-assets (D-048)
  2. production-ready static-assets stack (cloudfront + waf, D-049)
  3. DX-friendly deploy outputs (SSM + PR comment, D-050)
  4. central pipeline error reporting via Lambda (D-055)
  5. PR comments after every successful stage
  6. three platform pipelines (platform-test, primitives-plan, patterns-plan)
  7. release job with semver + MAJOR.MINOR/MAJOR tag updates (D-057)
  8. platform Lambda + DynamoDB contract ingestion (D-051)
  9. tagging standards (Checkov custom rule, D-054, D-043 closure)
  10. Wiz adapter (D-052)
  11. Kyverno adapter (D-053)
  12. remove consumer-repos + validated per-module examples (D-058) + RDS
      primitive (D-059)

6 phases (22-27), 14 requirements (REQ-62..REQ-75).
Ship tag: v1.7.0 (feature milestone, next minor; v1.6 shipped v1.6.0).
 2026-07-22 19:47:08 +00:00
Jon Chery c5745de37c docs(P21): specify phase 21 — consumer-facing docs restructure (v1.6) 
---ci---
project: acdl
phase: 21
milestone: v1.6
status: specify
---/ci---

Add v1.6 milestone to ROADMAP.md + REQUIREMENTS.md. Phase 21 covers
REQ-52 (scrub .ciagent/.gitea from consumer docs), REQ-53 (rename
acdl_platform -> platform), REQ-54 (docs/ Jekyll Pages restructure),
REQ-55 (L2->modules, L1->primitives, composition->pattern prose),
REQ-56 (forge->platform runners), REQ-57 (README repository roles
restated), REQ-58 (Features + Roadmap), REQ-59 (mermaid fix +
security-checks + infrastructure-apply), REQ-60 (credentials minus
go-gitea/waivers), REQ-61 (environments concept + onboarding scaffold).
Update config.json milestone to v1.6.
 2026-07-22 18:17:28 +00:00
Jon Chery 895a2f3806 docs(P20): specify phase 20 — consumer happy path + reusable deploy workflow (v1.5) 
---ci---
project: acdl
phase: 20
milestone: v1.5
status: specify
---/ci---

Add v1.5 milestone to ROADMAP.md + REQUIREMENTS.md. Phase 20 covers
REQ-46 (README consumer model + mermaid + L3B/spike scrub), REQ-47
(generic CONSUMER_GUIDE.md + versioned uses: + consumer-scoped prereqs
+ run-time platform fetch), REQ-48 (zero-trust OIDC/ABAC credentials +
static-key override + daily rotation), REQ-49 (reusable byte-identical
deploy.yml Gitea+GitHub implementing pipelines/deploy.yaml), REQ-50
(contracts/static-asset.yaml @v1.4), REQ-51 (deploy-workflow conformance
tests). Update config.json milestone to v1.5.
 2026-07-22 17:09:23 +00:00
Jon Chery e050e65158 feat(P19): central pipeline contract + shell reproducibility + output streaming (v1.4.1)
acdl-ci / Lint (push) Successful in 8s
Details
acdl-ci / Test (push) Successful in 14s
Details
acdl-ci / Platform check-only (offline) (push) Successful in 9s
Details 
---ci---
project: acdl
phase: 19
milestone: v1.4
status: execute
---

Add declarative pipeline contract (schemas/pipeline.schema.json +
pipelines/ci.yaml) as single source of truth for both Gitea Actions (dev)
and GitHub Actions (production) workflows. Both workflow files are
byte-identical and validated against the contract by 32 new tests.

Add scripts/run_ci.sh for shell reproducibility — mirrors the CI pipeline
locally (lint → test → check-only), exits 0 with 'CI PIPELINE OK'.

Update scripts/run_platform.sh to stream output by default: terraform
init/validate/plan via tee, Checkov compliance results with per-record
severity/rule/pass-fail, and emitted Terraform in --check-only. New
--quiet flag for log-only mode.

Requirements: REQ-43 (central pipeline contract), REQ-44 (shell
reproducibility), REQ-45 (output streaming). 122 tests pass (90 + 32).
 2026-07-22 15:10:54 +00:00
Jon Chery ae86a29a5e docs(P17): specify phase 17 — remove thin-composition + module READMEs (v1.3.1) 
Add v1.3 milestone to ROADMAP.md and REQUIREMENTS.md. Phase 17 covers
REQ-36 (thin-composition removal), REQ-37 (README template), REQ-38
(per-module READMEs + catalog). Update config.json milestone to v1.3.

---ci---
project: acdl
phase: 17
milestone: v1.3
status: specify
---/ci---
 2026-07-22 13:57:25 +00:00
Jon Chery 0fc69b4d0c docs(milestone): complete v1.2 — platform hardening + ECS microservice 
---ci---
project: acdl
phase: 0
milestone: v1.2
status: complete
requirements:
  covered: [REQ-29, REQ-30, REQ-31, REQ-32, REQ-34]
  partial: [REQ-33, REQ-35]
---/ci---

v1.2 milestone COMPLETE. All 6 phases shipped (v1.2.1..v1.2.6) + verified.
- v1.2.1 research + README (REQ-29)
- v1.2.2 NFR harden + simplify (REQ-30)
- v1.2.3 6 ECS L1s + adapter (REQ-31)
- v1.2.4 l2-microservice + contract schema + resolver (REQ-32)
- v1.2.5 consumer repo + terraform apply PARTIAL (REQ-34 complete, REQ-33 partial IAM-blocked)
- v1.2.6 capstone e2e (REQ-35 partial IAM-blocked)

Review: READY TO SHIP (1 P0 operator action, 1 P1 deferred to v1.3).
Ship: v1.3.0 (feature milestone, next minor — v1.1 shipped v1.2.0).
Audit: CLEAN (0 P0 code issues, 1 P1 post-hoc).

Operator action (P0-IAM): push spike_runner_policy.json to live AWS via
create_iam_user.py, then terraform apply (13 to add) -> live ECS service.
Gitea release v1.3.0: tag pushed; release creation blocked by missing
ACDL_GITEA_TOKEN (documented manual step).
 2026-07-21 22:27:27 +00:00
Jon Chery 9504782a77 docs(specify): open v1.2 milestone — platform hardening + ECS microservice 
---ci---
project: acdl
phase: 0
milestone: v1.2
status: specify
decisions:
  - id: D-047
    decision: Extend D-039 per-run-rotated-key waiver for v1.2; real OIDC deferred to v1.3+
    rationale: go-gitea/gitea#36988 still open (re-checked 2026-07-21, last updated 2026-05-27, not merged)
    confidence: 0.95
    alternatives: []
---/ci---

Open the v1.2 milestone: platform hardening + first real consumer deployment.
5 scope axes (user-directed): re-eval #36988, NFR improvements, simplify
the setup, README rewrite, bootstrap a consumer repo with a basic
microservice deployed to ECS Fargate end-to-end.

Files:
- config.json: milestone v1.1 -> v1.2, status complete -> specify
- PROJECT.md: v1.1 objective -> prior (complete); new v1.2 objective +
  6-phase table (11-16) + REQ-29..35 summary + D-047
- REQUIREMENTS.md: v1.1 -> prior (complete); new v1.2 section with
  REQ-29..35 + traceability (planned)
- ROADMAP.md: v1.1 -> complete (tag v1.2.0, Gitea release 202); new v1.2
  section with 6 phases (status planned, ship v1.3.0)
- ARCHITECTURE.md: new "v1.2 build-out scope" section (5 axes, substrate
  extension, terraform apply dev-only, out-of-scope deferrals) + build
  order

Ship tag at milestone COMPLETE: v1.3.0 (feature milestone, next minor
per ship.md — v1.1 shipped v1.2.0). Phase patches v1.2.1..v1.2.6.
 2026-07-21 20:54:55 +00:00
Jon Chery ab69d1069f docs(milestone): v1.1 complete - audit hygiene fixes (P1-A/B/D) 
---ci---
project: acdl
phase: 0
milestone: v1.1
status: complete
audit_hygiene:
  - P1-A: config.json status specify -> complete
  - P1-B: PERSONAS.md 6 stale platform/ territory paths -> acdl_platform/
  - P1-D: ROADMAP.md audit pending -> audit CLEAN
---/ci---

v1.1 milestone COMPLETE + audit CLEAN. Applied 3 audit-hygiene fixes
(P1-A/B/D from AUDIT.md):
- config.json: status specify -> complete (milestone shipped).
- PERSONAS.md: 6 territory paths + 1 verification toolchain command
  updated platform/ -> acdl_platform/ (the Phase 08 prep rename).
- ROADMAP.md: audit pending -> audit CLEAN.

Remaining post-hoc P1s (non-blocking, v1.2 cleanup):
- P1-1: redact two AWS access key IDs in .ciagent/VERIFY.md Phase 09
  narrative (public identifiers, not secret pairs).
- P1-C: document v1.1.0 tag-placement guidance in run.md (the tag is on
  the v1.0 Phase 05 traceability commit, causing 3 pre-specify no-ci
  commits to fall in the v1.1.0..HEAD range).
 2026-07-21 19:49:39 +00:00
Jon Chery 288607b3fa docs(specify): ingest docs/vision+architecture; reframe .ciagent for v1.1 
---ci---
project: acdl
phase: 0
milestone: v1.1
status: specify
decisions:
  - D-034 temporary long-lived AWS key waiver (used once in Phase 08, rotated)
  - D-035 milestone v1.1 (feature), ship tag v1.2.0
  - D-036 spike picks l1-s3 + l2-static-asset
  - D-037 demo archived to demo/
  - D-038 open decisions resolved (accept recommendations + decide rest)
---/ci---

Ingest docs/vision.md (6 tenets, anti-goals, signals of success) and
docs/architecture.md v0.2 (4 layers + 6 cross-cutting concerns incl. the
substrate abstraction) as the source of truth for why/how. Reframe the
project from the v1.0 stub demo (tag v1.1.0, archived to demo/ in Phase 06)
to the real Agentic Cloud Delivery Platform.

- config.json: milestone v1.1, status specify
- PROJECT.md: vision + 4-layer/6-concern model + 11 open-decision
  resolutions (W1.A/B, W2.A, BA.A accepted; W3.D/E, BA.B-F, OpenTofu
  decided) + D-034..D-038
- ARCHITECTURE.md: target architecture (IR, confidence, ledger, HITL, SoD,
  substrate abstraction) + v1.1 spike scope (l1-s3 + l2-static-asset)
- REQUIREMENTS.md: add REQ-16..REQ-28 + traceability
- ROADMAP.md: add v1.1 Phases 06-10 (archive, arch-finalize, OIDC, IR+L1,
  L2+contract-e2e)
- PERSONAS.md: add platform-engineer + security-engineer (custom),
  retire infra-stub-engineer, update territories + verification toolchain
  (terraform validate + jsonschema)
- PLAN.md: v1.1 specify plan
 2026-07-21 17:55:09 +00:00
Jon Chery e5f5604319 decision(P01): clarification — project mode, pages fallback, env gates 
---ci---
phase: 1
milestone: v1.0
status: clarify
decisions:
  - id: D-011
    decision: Single-project mode explicitly enforced via config.json mode=single
    rationale: run.md Step 0 reads projects[] length as multi-project trigger; explicit flag disambiguates from D-010
    confidence: 0.95
    alternatives: [move acdl into .ciagent/acdl/ subdirectory and adopt multi-project paths]
  - id: D-012
    decision: Gitea has no native Pages; serve acdl-evidence via raw file URLs + CORS note
    rationale: Research confirms Gitea has no [pages] section; raw URLs work without server config
    confidence: 0.85
    alternatives: [sidecar static server, external Pages host]
  - id: D-013
    decision: QA/Prod gates modeled as workflow_dispatch approval inputs (D-004 fallback) instead of Gitea environments
    rationale: Research confirms Gitea ignores environment: blocks and exposes no environments API
    confidence: 0.90
    alternatives: [external approval bot, drop approval gates entirely]
  - id: D-014
    decision: Cross-repo triggering uses workflow_dispatch API from inside a step (no repository_dispatch)
    rationale: Gitea Actions does not support repository_dispatch
    confidence: 0.85
    alternatives: [push-based trigger with a sentinel file, polling]
  - id: D-015
    decision: New repos acdl-contracts and acdl-evidence use default_branch=main with auto_init=true
    rationale: Matches Gitea DEFAULT_BRANCH=main; required for the default branch to exist before any push
    confidence: 0.95
    alternatives: [use milestone/v1.0-initial as default_branch]
  - id: D-016
    decision: Pages placeholder for Phase 01 is a minimal HTML stub; full timeline UI deferred to Phase 05
    rationale: Phase 01 success criterion is the URL returns 200 with placeholder; full UI is Phase 05
    confidence: 0.90
    alternatives: [build a minimal timeline now]
---/ci---

Clarifications accepted at full autonomy per clarify.md Step 4. Three requirements
re-stated: REQ-09 (new repos default_branch=main), REQ-10 Pages (raw-URL 200
substitute), REQ-10 environments (workflow_dispatch inputs + qa/prod branches).
See .ciagent/REQUIREMENTS.md Clarifications table.
 2026-07-21 12:57:50 +00:00
Jon Chery 5222a460e5 chore(config): rotate Gitea token to env-var reference (security) 
---ci---
phase: 0
milestone: v1.0
status: specify
security:
  - id: SEC-001
    type: info_disclosure
    disposition: mitigated
    summary: Literal API token was committed in config.json gitea.api_token_env field
    fix: Replaced literal with env var name 'ACDL_GITEA_TOKEN'; token supplied via shell env at runtime
    severity: high
    stride: Information Disclosure
---/ci---

The 40-char value previously stored in .ciagent/config.json was a live Gitea
API token. Per the spec constraint 'no secrets in repo', the field now holds
an env var name. The token itself is exported in the shell session at runtime
and is never written to disk. Treat the prior value as already-leaked and
rotate it via the Gitea UI before any external disclosure.
 2026-07-21 12:55:29 +00:00
Jon Chery e3416f8e77 docs(init): initialize Agentic Cloud Delivery Platform (5 phases) 
---ci---
phase: 0
milestone: v1.0
status: specify
decisions:
  - id: D-001
    decision: Use Gitea org continuous-intelligence for all ACDL repos
    rationale: User-specified target org; already exists at git.cloudinit.dev
    confidence: 0.95
    alternatives: [new dedicated demo org]
  - id: D-002
    decision: Map "GitHub Actions" to Gitea Actions (act_runner) using same workflow YAML
    rationale: Environment is Gitea; syntax-compatible with act_runner
    confidence: 0.85
    alternatives: [migrate to GitHub.com, raw shell scripts]
  - id: D-003
    decision: Collapse acdl-platform into the existing empty acdl repo
    rationale: acdl already exists at org root; avoids a 4th repo
    confidence: 0.90
    alternatives: [create separate acdl-platform repo]
  - id: D-004
    decision: Use Gitea environment blocks + required reviewers for QA/Prod; fallback to manual workflow_dispatch with approval input
    rationale: Spec mandates approval gates; forge supports environment protection
    confidence: 0.80
    alternatives: [external approval bot, no approval gates]
  - id: D-005
    decision: Hash-chained ledger (prev_hash + own hash via SHA-256 of canonical JSON) for evidence; declared demonstrative not adversarially secure
    rationale: Spec asks for simple JSON; chain gives visible tamper-evidence
    confidence: 0.85
    alternatives: [signed commits only, full Merkle tree]
  - id: D-006
    decision: Confidence gate threshold = 0.50 exactly (base 0.90, fail drops to 0.40)
    rationale: Explicit in spec
    confidence: 0.99
    alternatives: []
  - id: D-007
    decision: Each mock_apply.sh echoes "[L1: <name>] applying..." + "OK", sleeps 1s, exits 0
    rationale: Spec literal; uniformity aids timeline parsing
    confidence: 0.95
    alternatives: [randomized sleep durations]
  - id: D-008
    decision: L3B keyword->stack mapping: gas/price/ingest/data-lake->commodity-price-feed; invoice/billing->invoice-service; analytics/historical/query->energy-analytics-api; regulatory/compliance/reporting/trading->regulatory-reporting; fallback->invoice-service
    rationale: Mirrors the 4 L2 modules + Act 3 example issue text
    confidence: 0.85
    alternatives: [single default stack, ML classifier (forbidden by no-AI constraint)]
  - id: D-009
    decision: Init milestone = v1.0, branch milestone/v1.0-initial
    rationale: init.md Step 5 mandates milestone/v1.0-initial
    confidence: 0.99
    alternatives: []
  - id: D-010
    decision: Single-project mode for the acdl checkout; ---ci--- blocks omit project field
    rationale: User chose standalone single-project; no other projects in this checkout
    confidence: 0.90
    alternatives: [register acdl in /root multi-project config]
---/ci---

Specification: 30-minute executive demo of the Agentic Cloud Delivery Platform proving automatic, safe, audited infra delivery via local stubs on Gitea Actions (no cloud, no AI APIs).
Requirements: [3 repos under continuous-intelligence org, 8 L1 stub modules, 4 L2 composed modules mirroring S&P Global Energy use cases, 5 core scripts (mock_executor.sh, policy_checker.py, confidence_signal.py, evidence_writer.py, l3b_agent_stub.py), reusable Dev->QA->Prod pipeline with approval gates, issue-triggered L3B agent, Pages evidence timeline UI, 4 scripted demo acts]
Constraints: [local Linux OS, Gitea Actions + Environments, no AWS/GCP/Azure, no external LLM APIs, state in flat JSON/artifacts, EKS Fargate + serverless primitives (no VPC module), L1 single-purpose substrate-agnostic max-depth-1, L2 max-depth-5]
Out of scope: [real cloud provisioning, real LLM inference, production-grade infrastructure, adversarial tamper-proofing of evidence]
 2026-07-21 12:46:33 +00:00