9 Commits

Author	SHA1	Message	Date
Jon Chery	0e2d213c39	verify(P##): code review — config.json schema migration (0 P0, 2 P1/P2 auto-fixed) ... Regenerate .ciagent/config.json to the updated CIAgent schema: - Drop removed fields (mode, projects[].milestone/status/branch/tag) - Migrate top-level gitea -> release.gitea (forge: gitea) - Add new sections: secrets, release, ship, backend, ideation, personas, logging, telemetry, active_projects, security.bash_allowlist - Preserve autonomy/parallelization/verification/git/sessions values - Preserve custom gitea token env var (ACDL_GITEA_TOKEN) via secrets.scopes Review findings auto-fixed: - P1: add .ciagent/logs/ to .gitignore (runtime log artifact hygiene) - P2: restore trailing newline in config.json ---ci--- project: acdl phase: 0 milestone: v1.13 status: verify lessons: - P1: .ciagent/logs/ default logging.file target was untracked — gitignore it - P2: config.json lost trailing newline during regeneration — restored ---/ci---	2026-07-29 15:06:00 +00:00
Jon Chery	75b56f5245	chore: recursive .terraform gitignore — covers all module + platform dirs ... Replaced specific path entries (terraform/spike/, terraform/microservice/, modules/l1/*/terraform/) with recursive patterns: **/.terraform/ **/.terraform.lock.hcl **/tfplan **/*.tfstate* This catches .terraform dirs and lock files anywhere in the tree — including terraform/platform/, future L2 module terraform dirs, and any adapter-emitted working directory. No .terraform dirs were tracked (verified). ---ci--- project: acdl phase: P59 milestone: v1.11 status: execute ---/ci---	2026-07-28 16:20:54 +00:00
Jon Chery	a16e6f1bff	feat(P56a): stateless adapter rewrite + s3 reference terraform module ... EXECUTE stage. Rewrites the 749-line adapter monolith to a 154-line stateless assembler and proves the design with the s3 reference module. Stateless adapter (adapters/terraform/adapter.py, 749 → 154 lines): - Deleted TYPE_MAP, INPUT_MAP, OUTPUT_MAP (3 constant tables). - Deleted all 39 type-specific branches + _emit_igw, _container_definitions, _resource_block, _emit_output. - New adapt(): reads registry.json → terraform_dir → emits root main.tf with module-instantiation blocks (module "x" { source = ... }) + ref wiring via module.<rid>.<output> interpolations + root outputs. - The adapter owns NO resource shape, NO nested blocks, NO defaults, NO type-specific logic. It only assembles module instantiations and wires refs. s3 reference terraform module (modules/l1/s3/terraform/): - versions.tf (required_version + aws ~> 5.0) - variables.tf (bucket_name, region, kms_key_arn, tags) - locals.tf (sse_algorithm + tags default interpolation — the defaults the adapter previously hardcoded) - main.tf (aws_s3_bucket + versioning + SSE config, referencing local.*) - outputs.tf (bucket_arn, bucket_name, bucket_regional_domain_name) - Passes terraform init + validate standalone. Registry (modules/registry.json): s3 entry gains terraform_dir field. STANDARDS.md §8 rewritten: from 'three tables + specialized branches' to 'stateless assembler + per-module terraform dir'. §9.4 checklist updated. §9.1 required-files list updated to include terraform/ subdir. tests/test_adapter.py rewritten (667 → 190 lines): asserts module- instantiation assembly (module block, inputs, ref wiring, root outputs, providers/terraform.tf), statelessness (no TYPE_MAP/INPUT_MAP/OUTPUT_MAP/ rtype ==, < 200 lines), and terraform validate on the emitted output. Deleted test_p1_1_adapter_parameterization.py (tested the deleted HCL string emission). 6 pipeline tests skipped (run_platform.sh --check-only defaults to static-assets.yml which needs cloudfront/waf terraform dirs — P56b). Regression: 455 passed, 6 skipped, 5 deselected (slow). run_primitive_plan --check-only s3 exits 0. ---ci--- project: acdl phase: P56a milestone: v1.11 status: execute ---/ci---	2026-07-28 16:07:57 +00:00
Jon Chery	699aa542df	docs(P15): plan-as-execute + verify (v1.2.5, PARTIAL — terraform apply blocked by IAM) ... ---ci--- project: acdl phase: 15 milestone: v1.2 status: verify verdict: PARTIAL requirements: covered: [REQ-34] partial: [REQ-33] blocker: - id: P0-IAM description: terraform apply fails with AccessDenied on ECS/ECR/IAM/EC2 — live spike_runner_policy.json not pushed (root key deactivated per D-034) unblock: operator runs create_iam_user.py with root/admin creds to push the expanded policy, then terraform apply succeeds (plan valid, 13 to add) ---/ci--- Phase 15 plan-as-execute + verify. PARTIAL: terraform apply blocked by IAM. - Consumer microservice content authored (app.py + Dockerfile + README.md). - Docker image acdl-microservice:latest built. - Adapter fixed: ref emission (bare), JSON-string jsonencode, ECS service network_configuration/load_balancer/desired_count/launch_type/task_definition, listener default_action/load_balancer_arn, target group target_type/vpc_id/protocol, VPC tags (not name), IGW + route table association, managed_policy_arns list. - L1 fixes: l1-ecs-service (removed port from service sub-resource), l1-vpc (added intra_refs, removed igw_id output). - Resolver: intra_refs resolution (refs between sub-resources of same L1). - terraform validate + plan succeed (13 to add). - terraform apply BLOCKED (AccessDenied — live IAM policy not updated). - Evidence event TERRAFORM_APPLY_BLOCKED written to DynamoDB outbox. - v1.1 S3 regression: byte-identical. Ready to ship v1.2.5 (partial).	2026-07-21 22:21:36 +00:00
Jon Chery	798f430218	fix(P10 prep): gitignore terraform/spike/.terraform.lock.hcl (P1-2) ... ---ci--- project: acdl phase: 10 milestone: v1.1 status: plan-as-execute persona: lead-developer task: T-10.0 type: prerequisite-fix ---/ci--- Phase 09 verify flagged P1-2: terraform/spike/.terraform.lock.hcl was untracked + not gitignored (the Phase 09 gitignore list covered .terraform/, tfplan, *.tfstate* but missed the lock file at the spike root). Added terraform/spike/.terraform.lock.hcl to .gitignore. Also installed checkov 3.3.8 (D-045: pip install checkov>=3.2,<4) for Phase 10's Checkov PolicyCheckResult step.	2026-07-21 19:23:36 +00:00
Jon Chery	3070a68e1d	phase: 9, status: plan-as-execute, persona: platform-engineer, task: T-9.5..T-9.7+T-9.9 ... ---ci--- project: acdl phase: 9 milestone: v1.1 status: plan-as-execute persona: platform-engineer task: [T-9.5, T-9.6, T-9.7, T-9.9] requirements.covered: [REQ-26] ---/ci--- Waves 2+3: Terraform adapter + generated spike TF + run script. - T-9.5: adapters/terraform/adapter.py - compiles an IR instance to a Terraform root module. TYPE_MAP {aws:s3:bucket -> aws_s3_bucket}. Thin layer; does not own L1 content. Emits main.tf (resource + outputs) + terraform.tf (required_version/providers + S3 backend, NO dynamodb_table per D-P09-1) + providers.tf (aws provider region from the IR). CLI: adapter.py <ir_instance.json> <out_dir>. - T-9.6: terraform/spike/{main.tf,terraform.tf,providers.tf} - generated by running the adapter against modules-ir/l1/l1-s3/spike_instance.json. Committed so verify_phase09.sh can validate/plan without regenerating (D-P09-4); the verify script will regenerate + diff to prove reproducibility. - T-9.7: scripts/run_spike_plan.sh - loads rotated spike key from gitignored .env.secrets, exports AWS env vars, cd terraform/spike, terraform init -lock=false, terraform validate, terraform plan -lock=false -out=tfplan. Plan-only; no apply. - T-9.9: .gitignore - add terraform/spike/.terraform/ + tfplan + *.tfstate*. EXECUTE: ran scripts/run_spike_plan.sh against real AWS via the rotated spike key (D-039). terraform plan succeeded: 1 to add (the S3 bucket), outputs computed. One non-blocking deprecation warning (aws_s3_bucket versioning block -> use aws_s3_bucket_versioning in v1.2). No long-lived credential in the workflow (key loaded from .env.secrets at runtime).	2026-07-21 19:15:10 +00:00
Jon Chery	1d5c4d2ae7	phase: 8, status: plan-as-execute, persona: platform-engineer+lead-developer, task: T-8.5..T-8.7 ... ---ci--- project: acdl phase: 8 milestone: v1.1 status: plan-as-execute persona: platform-engineer+lead-developer task: [T-8.5, T-8.6, T-8.7] requirements.covered: [REQ-23] ---/ci--- Waves 3+4: rotation script + verify script + README + .gitignore. - T-8.5 (platform): scripts/rotate_spike_key.sh - boto3 with bootstrap root key from env (ACDL_BOOTSTRAP_AWS_*); creates new key for acdl-spike-runner, deactivates+deletes old, writes new to gitignored .env.secrets (chmod 600); idempotent (re-run ends with exactly 1 active key); optional Gitea secret upload if ACDL_GITEA_TOKEN set; does NOT rotate the root key (D-034 closure = manual user step). - T-8.6 (lead): scripts/verify_phase08.sh - loads rotated key from .env.secrets, asserts caller identity is acdl-spike-runner (not root), S3 bucket + DynamoDB table + IAM user + scoped policy with DenyEverythingElse all present, .env.secrets + .bootstrap_state.json gitignored. Uses heredoc python to avoid bash quoting issues. - T-8.7 (lead): terraform/bootstrap/README.md runbook (6 steps incl. manual D-034 root-key rotation) + .gitignore (.env.secrets + .bootstrap_state.json). Spike vs v1.2 boundary table. bash -n + gitignore checks pass.	2026-07-21 19:00:08 +00:00
Jon Chery	e044a2de0d	phase: 6, status: plan-as-execute, persona: lead-developer, task: T-6.1..T-6.4 ... ---ci--- project: acdl phase: 6 milestone: v1.1 status: plan-as-execute persona: lead-developer tasks: [T-6.1, T-6.2, T-6.3, T-6.4] ---/ci--- Archive the v1.0 demo under demo/ (D-037) and reorient the repo to the real platform. Wave 1 of the Phase 06 plan. - T-6.1: git mv modules/, scripts/, evidence-ui/, contracts/, contracts-repo/, .gitea/ -> demo/; mv ACDL_DEMO.md + runner-data/ -> demo/ - T-6.2: scaffold new v1.1 top-level dirs (platform/, schemas/, adapters/, terraform/, modules-ir/) with .gitkeep - T-6.3: create top-level scripts/verify_phase06.sh (v1.1 verify scripts live at top-level, NOT demo/scripts/ which holds the v1.0 demo verify scripts) - T-6.4: rewrite README.md to reflect the real platform (vision + architecture links, new layout, status v1.1 active); add runner-data/ to .gitignore All moves via git mv (history preserved). Repo root now contains only README.md, demo/, docs/, .ciagent/, and the new empty v1.1 dirs.	2026-07-21 18:27:21 +00:00
Jon Chery	b953fd4a8e	docs(P01): complete repo-scaffolding phase ... ---ci--- phase: 1 milestone: v1.0 status: complete requirements: covered: [REQ-01, REQ-09] partial: [REQ-10, REQ-12] ---/ci--- Squash merge of phase/01-repo-scaffolding into milestone/v1.0-initial. Phase 01 ships the three-repo scaffold (acdl, acdl-contracts, acdl-evidence), the placeholder index.html on acdl-evidence (D-012/D-016 raw-URL substitute for unsupported Gitea Pages), the qa + prod branches on acdl-contracts (D-013 stand-in for unsupported Gitea environments), the workflow skeletons (pipeline.yml + issue-to-contract.yml), and the idempotent setup + verify scripts. REQ-10/12 remain partial pending Phase 04 full implementation.	2026-07-21 13:10:50 +00:00