6 Commits

Author SHA1 Message Date
Jon Chery 699aa542df docs(P15): plan-as-execute + verify (v1.2.5, PARTIAL — terraform apply blocked by IAM)
---ci---
project: acdl
phase: 15
milestone: v1.2
status: verify
verdict: PARTIAL
requirements:
  covered: [REQ-34]
  partial: [REQ-33]
blocker:
  - id: P0-IAM
    description: terraform apply fails with AccessDenied on ECS/ECR/IAM/EC2 — live spike_runner_policy.json not pushed (root key deactivated per D-034)
    unblock: operator runs create_iam_user.py with root/admin creds to push the expanded policy, then terraform apply succeeds (plan valid, 13 to add)
---/ci---

Phase 15 plan-as-execute + verify. PARTIAL: terraform apply blocked by IAM.
- Consumer microservice content authored (app.py + Dockerfile + README.md).
- Docker image acdl-microservice:latest built.
- Adapter fixed: ref emission (bare), JSON-string jsonencode, ECS service
  network_configuration/load_balancer/desired_count/launch_type/task_definition,
  listener default_action/load_balancer_arn, target group target_type/vpc_id/protocol,
  VPC tags (not name), IGW + route table association, managed_policy_arns list.
- L1 fixes: l1-ecs-service (removed port from service sub-resource),
  l1-vpc (added intra_refs, removed igw_id output).
- Resolver: intra_refs resolution (refs between sub-resources of same L1).
- terraform validate + plan succeed (13 to add).
- terraform apply BLOCKED (AccessDenied — live IAM policy not updated).
- Evidence event TERRAFORM_APPLY_BLOCKED written to DynamoDB outbox.
- v1.1 S3 regression: byte-identical.
Ready to ship v1.2.5 (partial).
2026-07-21 22:21:36 +00:00
Jon Chery 798f430218 fix(P10 prep): gitignore terraform/spike/.terraform.lock.hcl (P1-2)
---ci---
project: acdl
phase: 10
milestone: v1.1
status: plan-as-execute
persona: lead-developer
task: T-10.0
type: prerequisite-fix
---/ci---

Phase 09 verify flagged P1-2: terraform/spike/.terraform.lock.hcl was
untracked + not gitignored (the Phase 09 gitignore list covered .terraform/,
tfplan, *.tfstate* but missed the lock file at the spike root). Added
terraform/spike/.terraform.lock.hcl to .gitignore.

Also installed checkov 3.3.8 (D-045: pip install checkov>=3.2,<4) for
Phase 10's Checkov PolicyCheckResult step.
2026-07-21 19:23:36 +00:00
Jon Chery 3070a68e1d phase: 9, status: plan-as-execute, persona: platform-engineer, task: T-9.5..T-9.7+T-9.9
---ci---
project: acdl
phase: 9
milestone: v1.1
status: plan-as-execute
persona: platform-engineer
task: [T-9.5, T-9.6, T-9.7, T-9.9]
requirements.covered: [REQ-26]
---/ci---

Waves 2+3: Terraform adapter + generated spike TF + run script.

- T-9.5: adapters/terraform/adapter.py - compiles an IR instance to a
  Terraform root module. TYPE_MAP {aws:s3:bucket -> aws_s3_bucket}. Thin
  layer; does not own L1 content. Emits main.tf (resource + outputs) +
  terraform.tf (required_version/providers + S3 backend, NO
  dynamodb_table per D-P09-1) + providers.tf (aws provider region from
  the IR). CLI: adapter.py <ir_instance.json> <out_dir>.

- T-9.6: terraform/spike/{main.tf,terraform.tf,providers.tf} - generated
  by running the adapter against modules-ir/l1/l1-s3/spike_instance.json.
  Committed so verify_phase09.sh can validate/plan without regenerating
  (D-P09-4); the verify script will regenerate + diff to prove
  reproducibility.

- T-9.7: scripts/run_spike_plan.sh - loads rotated spike key from
  gitignored .env.secrets, exports AWS env vars, cd terraform/spike,
  terraform init -lock=false, terraform validate, terraform plan
  -lock=false -out=tfplan. Plan-only; no apply.

- T-9.9: .gitignore - add terraform/spike/.terraform/ + tfplan +
  *.tfstate*.

EXECUTE: ran scripts/run_spike_plan.sh against real AWS via the rotated
spike key (D-039). terraform plan succeeded: 1 to add (the S3 bucket),
outputs computed. One non-blocking deprecation warning (aws_s3_bucket
versioning block -> use aws_s3_bucket_versioning in v1.2). No long-lived
credential in the workflow (key loaded from .env.secrets at runtime).
2026-07-21 19:15:10 +00:00
Jon Chery 1d5c4d2ae7 phase: 8, status: plan-as-execute, persona: platform-engineer+lead-developer, task: T-8.5..T-8.7
---ci---
project: acdl
phase: 8
milestone: v1.1
status: plan-as-execute
persona: platform-engineer+lead-developer
task: [T-8.5, T-8.6, T-8.7]
requirements.covered: [REQ-23]
---/ci---

Waves 3+4: rotation script + verify script + README + .gitignore.

- T-8.5 (platform): scripts/rotate_spike_key.sh - boto3 with bootstrap
  root key from env (ACDL_BOOTSTRAP_AWS_*); creates new key for
  acdl-spike-runner, deactivates+deletes old, writes new to gitignored
  .env.secrets (chmod 600); idempotent (re-run ends with exactly 1
  active key); optional Gitea secret upload if ACDL_GITEA_TOKEN set;
  does NOT rotate the root key (D-034 closure = manual user step).

- T-8.6 (lead): scripts/verify_phase08.sh - loads rotated key from
  .env.secrets, asserts caller identity is acdl-spike-runner (not root),
  S3 bucket + DynamoDB table + IAM user + scoped policy with
  DenyEverythingElse all present, .env.secrets + .bootstrap_state.json
  gitignored. Uses heredoc python to avoid bash quoting issues.

- T-8.7 (lead): terraform/bootstrap/README.md runbook (6 steps incl.
  manual D-034 root-key rotation) + .gitignore (.env.secrets +
  .bootstrap_state.json). Spike vs v1.2 boundary table.

bash -n + gitignore checks pass.
2026-07-21 19:00:08 +00:00
Jon Chery e044a2de0d phase: 6, status: plan-as-execute, persona: lead-developer, task: T-6.1..T-6.4
---ci---
project: acdl
phase: 6
milestone: v1.1
status: plan-as-execute
persona: lead-developer
tasks: [T-6.1, T-6.2, T-6.3, T-6.4]
---/ci---

Archive the v1.0 demo under demo/ (D-037) and reorient the repo to the
real platform. Wave 1 of the Phase 06 plan.

- T-6.1: git mv modules/, scripts/, evidence-ui/, contracts/,
  contracts-repo/, .gitea/ -> demo/; mv ACDL_DEMO.md + runner-data/ -> demo/
- T-6.2: scaffold new v1.1 top-level dirs (platform/, schemas/, adapters/,
  terraform/, modules-ir/) with .gitkeep
- T-6.3: create top-level scripts/verify_phase06.sh (v1.1 verify scripts
  live at top-level, NOT demo/scripts/ which holds the v1.0 demo verify
  scripts)
- T-6.4: rewrite README.md to reflect the real platform (vision +
  architecture links, new layout, status v1.1 active); add runner-data/
  to .gitignore

All moves via git mv (history preserved). Repo root now contains only
README.md, demo/, docs/, .ciagent/, and the new empty v1.1 dirs.
2026-07-21 18:27:21 +00:00
Jon Chery b953fd4a8e docs(P01): complete repo-scaffolding phase
---ci---
phase: 1
milestone: v1.0
status: complete
requirements:
  covered: [REQ-01, REQ-09]
  partial: [REQ-10, REQ-12]
---/ci---

Squash merge of phase/01-repo-scaffolding into milestone/v1.0-initial.
Phase 01 ships the three-repo scaffold (acdl, acdl-contracts, acdl-evidence),
the placeholder index.html on acdl-evidence (D-012/D-016 raw-URL substitute
for unsupported Gitea Pages), the qa + prod branches on acdl-contracts
(D-013 stand-in for unsupported Gitea environments), the workflow skeletons
(pipeline.yml + issue-to-contract.yml), and the idempotent setup + verify
scripts. REQ-10/12 remain partial pending Phase 04 full implementation.
2026-07-21 13:10:50 +00:00