continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity
168 Commits 1 Branch 190 Tags
v1.9
Commit Graph

92 Commits

Author SHA1 Message Date
Jon Chery 6e41f09c6e verify(P43): code review — 1 P0 auto-fixed, 1 P1 auto-fixed, 3 P1 flagged
acdl-ci / Lint (push) Successful in 6s
Details
acdl-ci / Test (push) Successful in 26s
Details
acdl-ci / Platform check-only (offline) (push) Successful in 9s
Details 
---ci---
phase: 43
milestone: v1.9
status: verify
lessons:
  - P0 fix: run_platform.sh HITL gate passed approver via string interpolation into Python (GITHUB_ACTOR injection vector) — fixed by passing env vars (ACDL_HITL_*) read via os.environ
  - P1 fix: attestation_matrix._is_fresh accepted future-dated artifacts (negative age bypassed freshness) — fixed with negative-age guard + test
  - P1 flagged: WizClient._post does not check GraphQL errors (silent empty-list mask)
  - P1 flagged: WizClient._post no SSRF validation on WIZ_API_URL
  - P1 flagged: contract_resolver._load_env duplicates environment_check.load (can drift)
---/ci---

Multi-persona review of the v1.9 diff (v1.8.0..HEAD). Review pass 2
(post-complete) caught issues the initial self-review missed:

P0-INJECT (auto-fixed): scripts/run_platform.sh Step 7b interpolated
$APPROVER (GITHUB_ACTOR/GITEA_ACTOR) directly into a Python string
literal — an attacker-controllable username containing shell/python
metacharacters would execute arbitrary Python. Fixed: approver, contract
id, and env are now passed as environment variables to the subprocess
and read via os.environ[...] (no string interpolation).

P1-FRESHNESS (auto-fixed): core/attestation_matrix.py _is_fresh
accepted future-dated artifacts (negative age.days <= window_days).
Fixed: added age.total_seconds() < 0 guard rejecting future timestamps.
Test added: test_freshness_rejects_future_dated_artifact.

3 P1 flagged for post-hoc:
- WizClient._post does not surface GraphQL errors (silent empty mask)
- WizClient._post no SSRF validation on WIZ_API_URL (operator-supplied, low risk)
- contract_resolver._load_env duplicates environment_check.load (drift risk)

REVIEW.md updated with the findings. 494 tests pass; run_ci.sh + run_platform.sh --check-only green.
 2026-07-23 11:54:58 +00:00
Jon Chery 5365bb4e0a docs(milestone): complete v1.9 — verify + review + audit + tag v1.9.0 
---ci---
project: acdl
phase: 0
milestone: v1.9
status: complete
requirements:
  covered: [REQ-100, REQ-101, REQ-102, REQ-103, REQ-104, REQ-105, REQ-106, REQ-107, REQ-108, REQ-109, REQ-110, REQ-111]
  partial: []
---/ci---

v1.9 milestone COMPLETE. All 12 requirements satisfied.

Verify: 4 layers PASS (structural 26/26 files, behavioral 493 tests +
run_ci.sh + run_platform.sh --check-only green, security, quality).
Review: 0 P0, 0 P1 (READY TO SHIP). REVIEW.md reconstructed (D-086).
Audit: PASS (reconstruction, file discipline, branch hygiene, commit
discipline — 12/12 commits with ---ci--- blocks).

Updated:
- .ciagent/REQUIREMENTS.md: v1.9 section marked complete; traceability
  table REQ-100..111 added.
- .ciagent/ROADMAP.md: v1.9 marked complete; Phase 43 added.
- .ciagent/PROJECT.md: v1.9 objective marked complete.
- .ciagent/config.json: milestone v1.9 status -> complete.
- .ciagent/REVIEW.md: reconstructed with v1.9 content (D-086).
- .ciagent/VERIFY.md: v1.9 4-layer verify.
- .ciagent/AUDIT.md: v1.9 audit (PASS).
- uses:/ref: bumped @v1.6 -> @v1.9 in contracts/, deploy workflows,
  docs/consumer-guide.md (D-071 successor).

Tag v1.9.0 created next; floating v1.9 + v1 tags updated.
 2026-07-23 04:46:04 +00:00
Jon Chery e74a8c2f5d feat(P42): stub implementation — SoD, HITL gates, attestation matrix, Wiz, Kyverno 
---ci---
project: acdl
phase: 42
milestone: v1.9
status: execute
---/ci---

Phase 42 — stub-implementation (REQ-107..111, D-084):

route_halt_artifact (REQ-107):
- core/separation_of_duties.py: real SNS publish (ACDL_SOD_HALT_TOPIC_ARN)
  + outbox fallback (SEPARATION_OF_DUTIES_VIOLATION event via
  outbox_writer) + stderr emission. No silent print-only stub.
- terraform/platform/main.tf: aws_sns_topic.acdl-sod-halt + output.

HITL attestation gates (REQ-108):
- core/hitl_gates.py: attest(contract_id, env, approver, evidence,
  outbox_client) records approver_qa/approver_prod/approver_dr to
  outbox, runs SoD check on prod, invokes attestation matrix, returns
  (ok, reason). Dev skips (autonomous). approver_from_env() reads
  GITHUB_ACTOR/GITEA_ACTOR.
- scripts/run_platform.sh: Step 7b HITL gate before apply for qa/prod/dr.

8-concern attestation matrix (REQ-109, D-084):
- core/attestation_matrix.py: check(env, evidence) runs the 8 concerns
  from hitl_matrix_design.md §10.4. Offline-testable (contract_nfrs,
  schema_validity, policy_pass) run for real. Operator-supplied accept
  signed artifacts validated for freshness (FRESHNESS_DAYS table) +
  schema. Signature skip when ACDL_ATTESTATION_SIGNING_KEY_ID unset
  (D-089). Fail loud if missing/expired for prod/dr.

Wiz real client (REQ-110):
- adapters/wiz/wiz_adapter.py: WizClient (GraphQL API, Bearer auth,
  pagination via pageInfo.hasNextPage + endCursor). fetch_and_adapt
  translates issues → PolicyCheckResult; graceful degrade when
  WIZ_API_TOKEN/WIZ_API_URL unset.

Kyverno fleshed out (REQ-111):
- adapters/kyverno/kyverno_adapter.py: full PolicyReport →
  PolicyCheckResult mapping (pass/fail/skip/warn + severity + skip-with-
  reason + resource ref construction from kind/name/namespace).
  adapt_inactive() emits KYVERNO_INACTIVE_TF_STACK guard. --kube-version
  stub parsed for future GitOps.

Tests: +47 (test_route_halt_artifact.py, test_hitl_gates.py,
test_attestation_matrix.py, test_wiz_adapter_real_client.py, expanded
test_kyverno_adapter.py). Existing wiz_adapter tests updated for the
real client's control.name ruleId. 493 passed; run_ci.sh green;
run_platform.sh --check-only green.
 2026-07-23 04:40:44 +00:00
Jon Chery cd637808f5 feat(P41): per-environment CI jobs + environment workflow input 
---ci---
project: acdl
phase: 41
milestone: v1.9
status: execute
---/ci---

Phase 41 — per-environment-ci-jobs (REQ-105, REQ-106, D-082):

Per-env contracts (REQ-105):
- contracts/static-assets.{dev,qa,prod,dr}.yaml + microservice.{dev,qa,prod,dr}.yaml
  (8 files, each sets environment: to its own name, uses interpolation).
- Default contracts/static-assets.yaml + microservice.yaml preserved (backwards compat).

Deploy workflow environment input (REQ-106):
- .github/workflows/deploy.yml + .gitea/workflows/deploy.yml (byte-identical):
  new 'environment' workflow_call input (default empty, override).
- scripts/run_platform.sh: --environment <name> flag; exports
  ACDL_ENVIRONMENT_OVERRIDE; re-runs env check against the override.
- core/contract_resolver.py: resolve(environment_override=...) (D-088);
  CLI honors --environment flag + ACDL_ENVIRONMENT_OVERRIDE env var.

Consumer guide (REQ-106):
- docs/consumer-guide.md: 'Per-environment deployment' section with 4
  caller-workflow examples (dev/qa/prod/dr), HITL gate structure
  (approve_qa/approve_prod/approve_dr, D-042), interpolation reference table.
- Documents promotion-without-editing + hybrid model (per-env contracts
  OR single contract + env input).

Tests: +40 (test_per_env_contracts.py, test_deploy_workflow_env_input.py,
test_consumer_guide_per_env_section.py). 446 passed; run_ci.sh green;
deploy workflows byte-identical.
 2026-07-23 04:34:10 +00:00
Jon Chery bee9d02f01 feat(P40): contract interpolation + environment JSON schema 
---ci---
project: acdl
phase: 40
milestone: v1.9
status: execute
---/ci---

Phase 40 — contract-interpolation (REQ-103, REQ-104, D-081):

Interpolation:
- core/contract_resolver.py: _expand_vars(value, context) recursively
  expands ${env.<field>} + ${contract.<field>} tokens (dotted paths
  supported, e.g. ${env.state_backend.bucket}). Unknown tokens raise
  ValueError (fail loud). Expansion is post-schema-validation,
  pre-IR-resolution.
- resolve() accepts environment_override (D-088) — overrides the
  contract's environment field BEFORE schema validation so interpolation
  context is consistent.
- env context loaded via _load_env (self-contained, works as script +
  package import); 'environment' alias for env 'name' so
  ${env.environment} resolves.

Environment schema + bindings:
- schemas/environment.schema.json (draft 2020-12): name, account_id,
  region, state_backend, network, runner_role_arn, autonomy, confidence_threshold.
- core/environments/qa.json, prod.json, dr.json placeholder bindings
  (attested, thresholds 0.75/0.90/0.95, placeholder account_id with
  stderr warning at load).
- core/environment_check.py: load(env_name) helper + placeholder warning.

Sample contracts:
- contracts/static-assets.yaml + microservice.yaml use
  acdl-${env.environment}-${contract.module}-${env.account_id}-${env.region}
  naming pattern (region + account id + environment).

Tests: +35 (test_environment_schema.py, test_interpolation.py,
test_sample_contracts_interpolate.py). 406 passed; run_ci.sh green;
run_platform.sh --check-only green. Existing fixture-based tests
preserved (instance.json static fixtures unaffected).
 2026-07-23 04:30:30 +00:00
Jon Chery e1be05287b feat(P39): refresh design docs + parameterize adapter (P1-1) 
---ci---
project: acdl
phase: 39
milestone: v1.9
status: execute
---/ci---

Phase 39 — design-doc-refresh-and-p1-1-parameterization:

Design docs (REQ-100, REQ-101):
- hitl_matrix_design.md: 'dev-only spike'/'v1.2 wires the gates' framing
  replaced with v1.9 wired-gates reality; 8-concern matrix marked
  implemented (offline-testable subset + signed evidence artifacts,
  D-084); v1.9 wiring section cross-references hitl_gates.py +
  attestation_matrix.py; approver_dr noted.
- audit_ledger_design.md: outbox marked shipped+production since v1.8;
  S3 Object Lock + JWS + async worker + DLQ + daily checkpoints clearly
  labeled 'Deferred to a future milestone (D-083)'; RPO/RTO table updated;
  approver fields note v1.9 hitl_gates.attest.

P1-1 adapter parameterization (REQ-102, D-085):
- ecs-service interface.json: desired_count (default 1), launch_type
  (FARGATE), family (app) inputs added.
- alb interface.json: load_balancer_type (application), target_type (ip).
- adapter.py: hardcoded defaults replaced with inputs.get(<name>, <default>);
  hardcoded 'acdl-microservice-rt'/'acdl-microservice-igw' Name tags
  derive from the VPC name input.
- contract_resolver.py: child_input_map routes wires to the sub-resource
  that declares the input (desired_count → aws:ecs:service, family →
  aws:ecs:task_definition, target_type → targetgroup, etc.).
- microservice composition.json: wires added for the new inputs.

Tests: +21 (test_p1_1_adapter_parameterization.py, test_design_docs_current.py).
371 passed; run_ci.sh green; run_platform.sh --check-only green; v1.1 S3
regression preserved.
 2026-07-23 04:24:25 +00:00
Jon Chery 58100c485e docs(P00): create 5 phase plans for v1.9 (phases 39-43) 
---ci---
project: acdl
phase: 0
milestone: v1.9
status: plan
---/ci---

5 vertical-slice phases, wave-ordered:
- Wave 1 (parallel): Phase 39 (design docs + P1-1, disjoint file sets)
- Wave 2: Phase 40 (contract interpolation + env schema)
- Wave 3: Phase 41 (per-env CI jobs + env workflow input)
- Wave 4: Phase 42 (stubs: SoD, HITL gates, attestation matrix, Wiz, Kyverno)
- Wave 5: Phase 43 (verify + review + audit + complete)

Plans reference REQ-100..REQ-111. Decisions D-080..D-089 applied.
Versioning: feature milestone, patches v1.8.1..v1.8.5, tag v1.9.0 at COMPLETE.
 2026-07-23 04:19:17 +00:00
Jon Chery 2bea048bb6 docs(P00): research v1.9 — interpolation, per-env jobs, Wiz, attestation matrix 
---ci---
project: acdl
phase: 0
milestone: v1.9
status: research
---/ci---

RESEARCH.md v1.9 addendum:
- RA-1: interpolation prior art + ${env.<field>} syntax choice (D-081)
- RA-2: GitHub/Gitea Actions workflow_call environment input + per-env jobs (D-082)
- RA-3: Wiz GraphQL API shape + PolicyCheckResult mapping (REQ-110)
- RA-4: attestation matrix freshness validation + signed artifacts (D-084)
- RA-5: design doc drift audit (hitl_matrix + audit_ledger)
- RA-6: P1-1 adapter hardcoded defaults audit (D-085)

New decisions surfaced: D-087 (recursive expansion), D-088 (env override
pre-validation), D-089 (signature skip when signing key unset).

PERSONAS.md updated for v1.9: milestone field, lambda-engineer
reactivated (SNS topic), phase-specific overrides for phases 39-43,
domain priority updated.
 2026-07-23 04:17:41 +00:00
Jon Chery c05ed7a26f docs(P00): clarify v1.9 — record decisions D-080..D-086 
---ci---
project: acdl
phase: 0
milestone: v1.9
status: clarify
---/ci---

Full autonomy: all clarifications resolved interactively pre-run + 2
auto-resolved parameters. Decisions recorded (renumbered D-080+ to
avoid collision with v1.8 research decisions D-073..D-077):
- D-080: new milestone v1.9 (feature), ship tag v1.9.0
- D-081: ${env.<field>} + ${contract.<field>} interpolation syntax
- D-082: hybrid per-env promotion (per-env contracts + env workflow input)
- D-083: audit ledger Object Lock/JWS/worker/DLQ deferred (future milestone)
- D-084: attestation matrix offline-testable subset + signed evidence artifacts
- D-085: P1-1 adapter defaults move to L1 interface.json inputs
- D-086: REVIEW.md reconstructed at v1.9 complete; v1.3-v1.8 noted as not-persisted

Auto-resolved: per-env account_id placeholder + stderr warning; SNS topic
defined in Terraform + code reads ACDL_SOD_HALT_TOPIC_ARN.
 2026-07-23 04:16:42 +00:00
Jon Chery 136ec6abf3 docs(init): validate v1.9 specification 
---ci---
project: acdl
phase: 0
milestone: v1.9
status: specify
---/ci---

v1.9 scope (user-directed, 2026-07-23):
- Design doc refresh (hitl_matrix_design.md + audit_ledger_design.md)
- Contract interpolation (${env.<field>} + ${contract.<field>})
- Per-environment CI jobs (no environment field editing for promotion)
- Stub implementation (SoD, HITL gates, attestation matrix, Wiz, Kyverno)
- P1-1 adapter parameterization remediation

Requirements REQ-100..REQ-111 added to REQUIREMENTS.md.
PROJECT.md v1.9 objective + phase table (39-43) appended.
config.json milestone bumped to v1.9 (active).
 2026-07-23 04:15:41 +00:00
Jon Chery 2f0e69272a audit(v1.8): PASS — audit report committed
acdl-ci / Lint (push) Successful in 7s
Details
acdl-ci / Test (push) Successful in 26s
Details
acdl-ci / Platform check-only (offline) (push) Successful in 9s
Details 
---ci---
project: acdl
phase: 0
milestone: v1.8
status: complete
---/ci---

Audit report: PASS. All checks passed:
- Reconstruction: 17/17 commits with ---ci--- blocks, state matches config
- File discipline: 10 .ciagent/ files valid, 0 issues
- Branch hygiene: stale branches cleaned, only main remains
- Commit discipline: 17/17 with ---ci--- blocks, 0 stale decisions

Issues fixed during audit:
- ARCHITECTURE.md: added v1.8 addendum
- Stale branches: deleted phase/21 + milestone/v1.0-initial
 2026-07-22 22:43:07 +00:00
Jon Chery 2861319447 audit(v1.8): ARCHITECTURE.md v1.8 addendum + stale branch cleanup
acdl-ci / Lint (push) Successful in 7s
Details
acdl-ci / Test (push) Successful in 26s
Details
acdl-ci / Platform check-only (offline) (push) Successful in 9s
Details 
---ci---
project: acdl
phase: 0
milestone: v1.8
status: complete
---/ci---

Audit fixes:
- ARCHITECTURE.md: added v1.8 addendum covering new primitives (kms-key,
  uptime), encryption-by-default, deletion-protection-by-default,
  decommission alias, adapter expansion (19 TYPE_MAP entries), pipeline
  stages (9), forge-agnostic API URLs.
- Stale branches cleaned: phase/21-docs-restructure (v1.6) and
  milestone/v1.0-initial (v1.0) deleted. Pruned remote refs.
- Only main + origin/main remain.

Audit result: PASS
 2026-07-22 22:42:46 +00:00
Jon Chery f9a93d56cc docs(milestone): ship v1.8.0 — fix REQUIREMENTS.md header
acdl-ci / Lint (push) Successful in 8s
Details
acdl-ci / Test (push) Successful in 26s
Details
acdl-ci / Platform check-only (offline) (push) Successful in 9s
Details 
---ci---
project: acdl
phase: 0
milestone: v1.8
status: complete
---/ci---

Ship finalization: REQUIREMENTS.md v1.8 section header corrected
from Active to Complete. All other .ciagent/ files already updated.
 2026-07-22 22:36:54 +00:00
Jon Chery c99da9a58c docs(milestone): complete v1.8 — P1 remediation + uptime + standards + encryption + decommission + docs 
---ci---
project: acdl
phase: 0
milestone: v1.8
status: complete
requirements:
  covered: [REQ-76, REQ-77, REQ-78, REQ-79, REQ-80, REQ-81, REQ-82, REQ-83, REQ-84, REQ-85, REQ-86, REQ-87, REQ-88, REQ-89, REQ-90, REQ-91, REQ-92, REQ-93, REQ-94, REQ-95, REQ-96, REQ-97, REQ-98, REQ-99]
  partial: []
---/ci---

v1.8 milestone complete. 11 phases (28-38), 24 requirements (REQ-76..99).

Track 1 — P1 Remediation (8 issues, all resolved):
- P1-3: SSM fail-loud without CMK + escape hatch
- P1-4: WAF custom rules emit nested HCL blocks
- P1-5: WAF default_action input honored
- P1-6: Terraform-rendered invoke policy (no placeholder account ID)
- P1-7: L2 composition outputs resolved + adapter output blocks
- P1-8: Per-run temp dir (terraform/spike removed)
- P1-9: Forge-agnostic API URLs (GITHUB_API_BASE)
- S1: Static-key override wired to configure-aws-credentials inputs

Track 2 — Encryption + Deletion Protection by Default:
- Per-stack CMK (kms-key primitive, 90-day rotation, no shared keys)
- All 12 primitives have encryption_enabled NFR + kms_key_arn input
- L2 modules wire per-stack CMK to all children
- All 12 primitives have deletion_protection NFR (default true)
- Adapter emits lifecycle { prevent_destroy = true }
- L2 feature flag propagation (inputs.deletion_protection)

Track 3 — Uptime + Standards + Docs:
- uptime-kuma primitive (ECS Fargate, feature flag, alert channels)
- deploy-uptime pipeline stage (separate state)
- Decommission mode (2-step HITL SRE gates + CMDB validation)
- modules/STANDARDS.md (L1+L2 authoring + review standards)
- schemas/README.md, pipelines/README.md, adapters/README.md

Tests: 275 -> 350 (+75 new). All pass. run_ci.sh + check-only green.
Zero pending P1 issues remaining.
 2026-07-22 22:24:15 +00:00
Jon Chery da60f0e82f verify(P28-36): 4-layer verification — 350 tests, all pass 
---ci---
project: acdl
phase: 28-36
milestone: v1.8
status: verify
---/ci---

Structural: 14 new files present, terraform/spike removed, 14 registry entries. PASS.
Behavioral: 350 tests pass (275 -> 350, +75 new). run_ci.sh + check-only green. PASS.
Security: no placeholder account IDs, no hardcoded API URLs, byte-identical
workflows, SSM fail-loud, deletion protection + encryption by default. PASS.
Quality: each P1 fix + each new feature has dedicated tests. PASS.

VERIFY PASS.
 2026-07-22 22:23:24 +00:00
Jon Chery 045c7279aa docs(P28-38): create 11 phase plans for v1.8 
---ci---
project: acdl
phase: 28-38
milestone: v1.8
status: plan
---/ci---

11 phase plans created covering 24 requirements (REQ-76..99):
P28: adapter WAF + resolver outputs (P1-4,5,7)
P29: SSM KMS + invoke policy (P1-3,6)
P30: run-platform isolation + API portability + S1 (P1-8,9,S1)
P31: encryption-by-default + per-stack CMK
P32: deletion-protection-by-default + L2 feature flag
P33: uptime-kuma primitive + pipeline stage
P34: decommission alias + CMDB validation
P35: module engineering standards
P36: schemas/adapters/pipelines READMEs
P37: verify (4-layer)
P38: review-audit-complete
 2026-07-22 22:02:09 +00:00
Jon Chery 7f1eff622d docs(P22-38): research findings + 6 phase plans 
---ci---
project: acdl
phase: 22-38
milestone: v1.8
status: research
---/ci---

v1.8 research: 6 targets investigated + 5 decisions surfaced (D-073..D-077).

TARGET 1: uptime-kuma on ECS Fargate (image louislam/uptime-kuma:1,
port 3001, EFS volume, ALB, monitor seeding via post-deploy API script).
TARGET 2: Terraform prevent_destroy lifecycle (2-step decommission pattern).
TARGET 3: AWS KMS rotation (enable_key_rotation=true, annual AWS-managed;
90-day is roadmap item D-075).
TARGET 4: Forge-agnostic API URLs (GITHUB_API_BASE + _forge_type helper).
TARGET 5: DynamoDB as CMDB (acdl-change-requests table + validate_change_request).
TARGET 6: Module engineering standards scan (codified patterns from 12 modules).

PERSONAS.md updated for v1.8: lambda-engineer reactivated (D-068 CMDB +
D-065 API portability). 11 phase-specific overrides added.
 2026-07-22 22:01:13 +00:00
Jon Chery 60f2b669ea docs(P0): clarify v1.8 — 12 decisions resolved 
---ci---
project: acdl
phase: 0
milestone: v1.8
status: clarify
---/ci---

12 decisions resolved (D-061..D-072) at full autonomy:
- D-061: Fold all 3 new requirements into v1.8 (feature milestone)
- D-062: P1-3 SSM fail loud + escape hatch
- D-063: P1-6 Terraform-rendered invoke policy
- D-064: P1-8 Remove committed spike .tf files
- D-065: S1 Single conditional AWS credentials step
- D-066: Uptime on ECS Fargate
- D-067: Uptime as deploy-uptime pipeline stage, separate state
- D-068: CMDB = DynamoDB acdl-change-requests table
- D-069: Per-stack CMK (one key per L2 deployment)
- D-070: Decommission as mode on existing deploy pipeline, HITL SRE gates
- D-071: uses: ref bump @v1.6 -> @v1.8 at COMPLETE
- D-072: Managed KMS fallback for standalone L1s with warning
 2026-07-22 21:59:45 +00:00
Jon Chery bab2cf363b docs(init): validate v1.8 specification 
---ci---
project: acdl
phase: 0
milestone: v1.8
status: specify
---/ci---

v1.8 specification validated. 11 phases (28-38), 24 new requirements
(REQ-76..99). Three tracks: P1 remediation (P1-3..P1-9 + S1), encryption
+ deletion protection by default + decommission alias, uptime monitoring
+ engineering standards + path documentation. Feature milestone, ship
tag v1.8.0.
 2026-07-22 21:59:29 +00:00
Jon Chery 0bee8f9bc2 docs(milestone): complete v1.7 — production platform + contract ingestion 
---ci---
project: acdl
phase: 0
milestone: v1.7
status: complete
requirements:
  covered: [REQ-62, REQ-63, REQ-64, REQ-65, REQ-66, REQ-67, REQ-68, REQ-69, REQ-70, REQ-71, REQ-72, REQ-73, REQ-74, REQ-75]
  partial: []
---/ci---

v1.7 milestone COMPLETE. 6 phases (22-27), 14 requirements (REQ-62..REQ-75),
all shipped + verified. 272 tests pass. CI pipeline green.

Phase summary:
  P22: rename static-asset -> static-assets (D-048) + cloudfront/waf
       primitives + production stack (D-049) + @v1.6 bump (D-057).
  P23: tagging standard (D-054, D-043 closure) + Wiz adapter (D-052) +
       Kyverno adapter (D-053).
  P24: platform Lambda + DynamoDB acdl-contracts (D-051) + cross-account IAM.
  P25: deploy outputs SSM+PR comment (D-050) + error reporting via Lambda
       (D-055) + stage comments.
  P26: 3 platform pipelines (platform-test, primitives-plan, patterns-plan) +
       release job (D-057) + multi-resource L1 ref fix.
  P27: remove consumer-repos + validated per-module examples (D-058) +
       RDS primitive (D-059).

Ship tag: v1.7.0 (feature milestone, next minor per ship.md;
v1.6 shipped v1.6.0).
 2026-07-22 20:28:18 +00:00
Jon Chery 49462d5e38 feat(P27): remove consumer-repos + rewrite .ciagent historical refs per D-048 
Delete the consumer-repos/ directory (v1.2 artifact removed in v1.7).
Rewrite all .ciagent/ historical narrative references per D-048 to
describe the removal rather than referencing the directory as existing.

---ci---
project: acdl
phase: 27
milestone: v1.7
status: execute
---/ci---
 2026-07-22 20:20:12 +00:00
Jon Chery dca35c78ec feat(P22): rename static-asset→static-assets + cloudfront/waf primitives + production stack + @v1.6 bump 
---ci---
phase: 22
title: rename-and-production-static-assets-stack
status: complete
verification:
  - scripts/run_ci.sh: PASS (CI PIPELINE OK)
  - python3 -m pytest tests/ -v: 175 passed
  - scripts/run_platform.sh --check-only: PASS (PLATFORM CHECK OK)
  - grep -R "static-asset[^s]" . (excl .git/): 0 hits
  - grep -R "static-asset$" . (excl .git/): 0 hits
  - floating git tags v1.6 + v1 point at v1.6.0 (a90a756)
changed_files:
  - Task 1 (rename): contracts/static-asset.yaml→static-assets.yaml (git mv); modules/l2/static-asset→static-assets (git mv); sed replaceAll static-asset→static-assets in 22 files (README, docs, scripts/run_platform.sh, pipelines/deploy.yaml, modules/registry.json, tests/*, .ciagent/* historical narrative)
  - Task 2 (cloudfront primitive): modules/l1/cloudfront/interface.json + README.md
  - Task 3 (waf primitive): modules/l1/waf/interface.json + README.md
  - Task 4 (registry): modules/registry.json (+cloudfront, +waf, static-assets renamed)
  - Task 5 (augment static-assets): modules/l2/static-assets/composition.json (s3+cloudfront+waf, depth 1); modules/l1/s3/interface.json +instance.json (+bucket_regional_domain_name output); modules/l2/static-assets/README.md (production stack docs)
  - Task 6 (adapter): adapters/terraform/adapter.py (+TYPE_MAP/INPUT_MAP/OUTPUT_MAP for cloudfront distribution+OAC+wafv2 webacl; special handling in _emit_resource for OAC defaults, distribution origin/cache_behavior/restrictions/viewer_certificate/web_acl_id, waf scope/default_action/visibility_config/managed rules)
  - Task 7 (contract schema): no change needed (generic inputs object; new module names match ^[a-z][a-z0-9-]*$)
  - Task 8 (@v1.6 bump): contracts/static-assets.yaml, .gitea/.github/workflows/deploy.yml (ref: v1.6 + header comments), docs/consumer-guide.md, docs/contracts/index.md, docs/pipeline/versioning.md, docs/pipeline/index.md, docs/architecture.md, README.md, modules/l2/microservice/README.md, tests/test_environment_check.py, tests/test_pipeline_contract.py
  - Task 9 (floating tags): git tag -f v1.6 v1.6.0; git tag -f v1 v1.6.0
  - Task 10 (tests): tests/test_adapter.py (registry 11 entries/9 L1/2 L2; cloudfront+waf type map tests; TestS3Output bucket_regional_domain_name; TestStaticAssetsStack 4 tests); tests/test_contract_resolver.py (+s3/cloudfront/waf resource assertions)
generated:
  - terraform/spike/main.tf + terraform.tf (regenerated by run_platform.sh --check-only; reflect static-assets production stack + backend key spike/static-assets/)
notes:
  - D-048 full rewrite of .ciagent/ historical narrative (verbatim phase descriptions, REQ-25/27/50, D-036) — produces intentional tautologies (e.g. "Rename static-assets → static-assets") per the decision to override the v1.6 preservation precedent.
  - cloudfront interface.json resources array ordered distribution-first so the resolver (first-match wire resolution) routes bucket_regional_domain_name/waf_web_acl_arn/region to the distribution; the OAC gets adapter-provided defaults (name=acdl-oac, origin_type=s3, signing_behavior=always).
  - .ciagent/ @v1.4 references left as historical record (D-048 scope was static-asset rename only; @v1.4 is historical narrative of Phase 20).
  - s3 OUTPUT_MAP bucket_regional_domain_name not added (identity fallback in adapt() already handles it; OUTPUT_MAP documents non-identity mappings only).
---ci---
 2026-07-22 19:56:52 +00:00
Jon Chery fee59944fd docs(init): validate v1.7 specification 
---ci---
project: acdl
phase: 0
milestone: v1.7
status: specify
---/ci---

v1.7 milestone: production platform + contract ingestion + pipeline
maturation. 12 user-directed scope axes (2026-07-22):
  1. rename static-asset -> static-assets (D-048)
  2. production-ready static-assets stack (cloudfront + waf, D-049)
  3. DX-friendly deploy outputs (SSM + PR comment, D-050)
  4. central pipeline error reporting via Lambda (D-055)
  5. PR comments after every successful stage
  6. three platform pipelines (platform-test, primitives-plan, patterns-plan)
  7. release job with semver + MAJOR.MINOR/MAJOR tag updates (D-057)
  8. platform Lambda + DynamoDB contract ingestion (D-051)
  9. tagging standards (Checkov custom rule, D-054, D-043 closure)
  10. Wiz adapter (D-052)
  11. Kyverno adapter (D-053)
  12. remove consumer-repos + validated per-module examples (D-058) + RDS
      primitive (D-059)

6 phases (22-27), 14 requirements (REQ-62..REQ-75).
Ship tag: v1.7.0 (feature milestone, next minor; v1.6 shipped v1.6.0).
 2026-07-22 19:47:08 +00:00
Jon Chery 05372abdfc audit(v1.6): fix stale acdl_platform refs in ciagent files
acdl-ci / Lint (push) Successful in 8s
Details
acdl-ci / Test (push) Successful in 18s
Details
acdl-ci / Platform check-only (offline) (push) Successful in 9s
Details 
---ci---
project: acdl
phase: 0
milestone: v1.6
status: audit
verdict: CLEAN (after fixes)
---/ci---

Audit found stale acdl_platform/ references in .ciagent/ files that
described the package by its pre-rename name. Fixed:
- REQUIREMENTS.md REQ-53: updated to reflect the actual core/ rename
  (was 'platform/', the original target that shadows stdlib).
- ROADMAP.md overview line 315: acdl_platform/ -> core/ (platform/
  shadows stdlib).
- ROADMAP.md phase 21 description + success criteria: platform/ -> core/
  (already partially fixed during run; this completes it).
- ARCHITECTURE.md line 345-346: acdl_platform/*.py -> core/*.py.
- PERSONAS.md: all territory globs + typecheck command + co-ownership
  references updated from acdl_platform/ to core/.

Historical references preserved (REQUIREMENTS REQ-29/30/32/36/39,
RESEARCH.md) — they record what existed at the time and must not be
rewritten.

Reconstruction: PASS (config.json v1.6, ROADMAP phase 21 complete
v1.6.0, REQUIREMENTS REQ-52..61 complete v1.6.0 — all match git log).
File discipline: PASS (config.json valid, PROJECT.md sections present,
ROADMAP phases match branches, ARCHITECTURE.md matches code structure).
Branch hygiene: PASS (phase/21 merged to main; no orphans).
Commit discipline: PASS (10/10 v1.6 commits have ---ci--- blocks; 0
escalations).
 2026-07-22 19:22:12 +00:00
Jon Chery edc695592a docs(milestone): complete v1.6 — consumer-facing docs restructure 
---ci---
project: acdl
phase: 0
milestone: v1.6
status: complete
requirements:
  covered: [REQ-52, REQ-53, REQ-54, REQ-55, REQ-56, REQ-57, REQ-58, REQ-59, REQ-60, REQ-61]
  partial: []
---/ci---

v1.6 milestone COMPLETE. Single phase (21) shipped + verified (v1.6.0).
All 10 requirements covered:
- REQ-52: scrub .ciagent/.gitea from consumer docs
- REQ-53: rename acdl_platform -> core (platform/ shadows stdlib)
- REQ-54: docs/ Jekyll Pages restructure
- REQ-55: L2->modules, L1->primitives, composition->pattern prose
- REQ-56: forge->platform runners
- REQ-57: README repository roles restated
- REQ-58: Features + Roadmap
- REQ-59: mermaid fix + security-checks + infrastructure-apply
- REQ-60: credentials minus go-gitea/waivers
- REQ-61: environments concept + onboarding scaffold

Verification: 166 tests pass (154 + 12 new environment-check). run_ci.sh
green. Grep sweeps: 0 .ciagent/.gitea/forge/go-gitea/waiver/D-039/D-047/
acdl_platform in consumer surfaces. Feature milestone -> tag v1.6.0.
 2026-07-22 18:27:30 +00:00
Jon Chery c5745de37c docs(P21): specify phase 21 — consumer-facing docs restructure (v1.6) 
---ci---
project: acdl
phase: 21
milestone: v1.6
status: specify
---/ci---

Add v1.6 milestone to ROADMAP.md + REQUIREMENTS.md. Phase 21 covers
REQ-52 (scrub .ciagent/.gitea from consumer docs), REQ-53 (rename
acdl_platform -> platform), REQ-54 (docs/ Jekyll Pages restructure),
REQ-55 (L2->modules, L1->primitives, composition->pattern prose),
REQ-56 (forge->platform runners), REQ-57 (README repository roles
restated), REQ-58 (Features + Roadmap), REQ-59 (mermaid fix +
security-checks + infrastructure-apply), REQ-60 (credentials minus
go-gitea/waivers), REQ-61 (environments concept + onboarding scaffold).
Update config.json milestone to v1.6.
 2026-07-22 18:17:28 +00:00
Jon Chery 8d5c56b88e ship(v1.5.0): milestone released — consumer happy path + reusable deploy workflow
acdl-ci / Lint (push) Successful in 7s
Details
acdl-ci / Test (push) Successful in 16s
Details
acdl-ci / Platform check-only (offline) (push) Successful in 9s
Details 
---ci---
project: acdl
phase: 0
milestone: v1.5
status: shipped
release:
  tag: v1.5.0
  gitea_release_id: 214
  url: https://git.cloudinit.dev/continuous-intelligence/acdl/releases/tag/v1.5.0
requirements:
  covered: [REQ-46, REQ-47, REQ-48, REQ-49, REQ-50, REQ-51]
  partial: []
---/ci---

Milestone v1.5 shipped: tag v1.5.0 (re-tagged at HEAD f68f85c to capture
P0 review fix + review verdict). Gitea release id 214 created. main pushed
to origin (e050e65..f68f85c). ROADMAP section header corrected to Complete.

Tests: 154 pass. CI pipeline: green. Review: READY TO SHIP (1 P0 fixed,
6 P1 flagged post-hoc).
 2026-07-22 17:27:20 +00:00
Jon Chery 04bf6bc31a docs(milestone): complete v1.5 — consumer happy path + reusable deploy workflow 
---ci---
project: acdl
phase: 0
milestone: v1.5
status: complete
requirements:
  covered: [REQ-46, REQ-47, REQ-48, REQ-49, REQ-50, REQ-51]
  partial: []
---/ci---

v1.5 milestone COMPLETE. Single phase (20) shipped + verified (v1.5.0).
All 6 requirements covered:
- REQ-46: README consumer model + mermaid + L3B/spike scrub
- REQ-47: generic CONSUMER_GUIDE.md + versioned uses: + consumer prereqs
- REQ-48: zero-trust OIDC/ABAC credentials + static-key override + rotation
- REQ-49: reusable byte-identical deploy.yml (Gitea+GitHub)
- REQ-50: contracts/static-asset.yaml @v1.4
- REQ-51: deploy-workflow conformance tests (19 new, 154 total pass)

Audit: CLEAN (reconstruction PASS, file discipline PASS, branch hygiene
PASS, commit discipline PASS). Tag v1.5.0 present.

Operator action: push a v1.4 git tag if not already present, so the
reusable-workflow reference acdl/.gitea/workflows/deploy.yml@v1.4 resolves
at run time for consumer repos.
 2026-07-22 17:15:04 +00:00
Jon Chery 9a1ea04f93 docs(P20): post-ship traceability — phase 20 complete (v1.5.0) 
---ci---
project: acdl
phase: 20
milestone: v1.5
status: shipped
release:
  tag: v1.5.0
requirements:
  covered: [REQ-46, REQ-47, REQ-48, REQ-49, REQ-50, REQ-51]
---/ci---

Post-ship: ROADMAP.md Phase 20 -> complete (v1.5.0); REQUIREMENTS.md
REQ-46..51 -> complete (v1.5.0). v1.5 milestone: all 6 requirements
covered. Feature milestone → tag v1.5.0.

Ship-time note: the git tag v1.4 (referenced by the reusable workflow
checkout `ref: v1.4` and the consumer `uses:` tag) must be pushed for
the reusable-workflow reference `acdl/.gitea/workflows/deploy.yml@v1.4`
to resolve at run time. Tagging v1.5.0 here; a v1.4 tag is a separate
operator action if not already present.
 2026-07-22 17:14:53 +00:00
Jon Chery 895a2f3806 docs(P20): specify phase 20 — consumer happy path + reusable deploy workflow (v1.5) 
---ci---
project: acdl
phase: 20
milestone: v1.5
status: specify
---/ci---

Add v1.5 milestone to ROADMAP.md + REQUIREMENTS.md. Phase 20 covers
REQ-46 (README consumer model + mermaid + L3B/spike scrub), REQ-47
(generic CONSUMER_GUIDE.md + versioned uses: + consumer-scoped prereqs
+ run-time platform fetch), REQ-48 (zero-trust OIDC/ABAC credentials +
static-key override + daily rotation), REQ-49 (reusable byte-identical
deploy.yml Gitea+GitHub implementing pipelines/deploy.yaml), REQ-50
(contracts/static-asset.yaml @v1.4), REQ-51 (deploy-workflow conformance
tests). Update config.json milestone to v1.5.
 2026-07-22 17:09:23 +00:00
Jon Chery e050e65158 feat(P19): central pipeline contract + shell reproducibility + output streaming (v1.4.1)
acdl-ci / Lint (push) Successful in 8s
Details
acdl-ci / Test (push) Successful in 14s
Details
acdl-ci / Platform check-only (offline) (push) Successful in 9s
Details 
---ci---
project: acdl
phase: 19
milestone: v1.4
status: execute
---

Add declarative pipeline contract (schemas/pipeline.schema.json +
pipelines/ci.yaml) as single source of truth for both Gitea Actions (dev)
and GitHub Actions (production) workflows. Both workflow files are
byte-identical and validated against the contract by 32 new tests.

Add scripts/run_ci.sh for shell reproducibility — mirrors the CI pipeline
locally (lint → test → check-only), exits 0 with 'CI PIPELINE OK'.

Update scripts/run_platform.sh to stream output by default: terraform
init/validate/plan via tee, Checkov compliance results with per-record
severity/rule/pass-fail, and emitted Terraform in --check-only. New
--quiet flag for log-only mode.

Requirements: REQ-43 (central pipeline contract), REQ-44 (shell
reproducibility), REQ-45 (output streaming). 122 tests pass (90 + 32).
 2026-07-22 15:10:54 +00:00
Jon Chery c816493e7e audit(v1.3.2): CLEAN - reconstruction, file discipline, branch hygiene, commit discipline
acdl-ci / Lint (push) Successful in 1m19s
Details
acdl-ci / Test (push) Successful in 30s
Details
acdl-ci / Platform check-only (offline) (push) Successful in 9s
Details 
---ci---
project: acdl
phase: 18
milestone: v1.3
status: complete
requirements:
  covered: [REQ-39, REQ-40, REQ-41, REQ-42]
  partial: []
---/ci---
 2026-07-22 14:26:34 +00:00
Jon Chery 1598c54a8b feat(P18): testing + CI/CD pipelines - pytest suite, check-only mode, Gitea + GitHub workflows (v1.3.2) 
90 offline tests covering adapter, confidence_signal, checkov_adapter,
outbox_writer, and pipeline integration. Identical CI/CD workflows for
Gitea Actions (dev) and GitHub Actions (production). New --check-only
mode for run_platform.sh (offline, no AWS).

---ci---
project: acdl
phase: 18
milestone: v1.3
status: verify
---/ci---
 2026-07-22 14:26:11 +00:00
Jon Chery 2c6464afd4 audit(v1.3.1): CLEAN — reconstruction, file discipline, branch hygiene, commit discipline 
Phase 17 audit PASS on all four layers. No critical issues. P1 (AWS
account ID in l1-ecs-service README usage example) deferred to
post-hoc review.

---ci---
project: acdl
phase: 17
milestone: v1.3
status: complete
requirements:
  covered: [REQ-36, REQ-37, REQ-38]
  partial: []
---/ci---
 2026-07-22 13:59:52 +00:00
Jon Chery 431341a0ab docs(P17): verify phase 17 — VERIFY PASS (v1.3.1) 
Four-layer verification: structural, behavioral, security, quality all
pass. One P1 (AWS account ID in l1-ecs-service README usage example)
deferred to post-hoc review — same account ID already in
terraform/microservice/main.tf. Fixed: README template missing ## Overview
header.

---ci---
project: acdl
phase: 17
milestone: v1.3
status: verify
---/ci---
 2026-07-22 13:58:53 +00:00
Jon Chery ae86a29a5e docs(P17): specify phase 17 — remove thin-composition + module READMEs (v1.3.1) 
Add v1.3 milestone to ROADMAP.md and REQUIREMENTS.md. Phase 17 covers
REQ-36 (thin-composition removal), REQ-37 (README template), REQ-38
(per-module READMEs + catalog). Update config.json milestone to v1.3.

---ci---
project: acdl
phase: 17
milestone: v1.3
status: specify
---/ci---
 2026-07-22 13:57:25 +00:00
Jon Chery 0fc69b4d0c docs(milestone): complete v1.2 — platform hardening + ECS microservice 
---ci---
project: acdl
phase: 0
milestone: v1.2
status: complete
requirements:
  covered: [REQ-29, REQ-30, REQ-31, REQ-32, REQ-34]
  partial: [REQ-33, REQ-35]
---/ci---

v1.2 milestone COMPLETE. All 6 phases shipped (v1.2.1..v1.2.6) + verified.
- v1.2.1 research + README (REQ-29)
- v1.2.2 NFR harden + simplify (REQ-30)
- v1.2.3 6 ECS L1s + adapter (REQ-31)
- v1.2.4 l2-microservice + contract schema + resolver (REQ-32)
- v1.2.5 consumer repo + terraform apply PARTIAL (REQ-34 complete, REQ-33 partial IAM-blocked)
- v1.2.6 capstone e2e (REQ-35 partial IAM-blocked)

Review: READY TO SHIP (1 P0 operator action, 1 P1 deferred to v1.3).
Ship: v1.3.0 (feature milestone, next minor — v1.1 shipped v1.2.0).
Audit: CLEAN (0 P0 code issues, 1 P1 post-hoc).

Operator action (P0-IAM): push spike_runner_policy.json to live AWS via
create_iam_user.py, then terraform apply (13 to add) -> live ECS service.
Gitea release v1.3.0: tag pushed; release creation blocked by missing
ACDL_GITEA_TOKEN (documented manual step).
 2026-07-21 22:27:27 +00:00
Jon Chery 2ec2a87a4e audit(v1.2): CLEAN — reconstruction, file discipline, branch hygiene, commit discipline 
---ci---
project: acdl
phase: 0
milestone: v1.2
status: audit
verdict: CLEAN
---/ci---

v1.2 milestone audit. Verdict: CLEAN — 0 P0 code issues (the 1 P0 is an
operator action, not a code defect), 1 P1 post-hoc (adapter hardening,
deferred to v1.3). Reconstruction test PASS; file discipline PASS; branch
hygiene PASS; commit discipline PASS. The v1.3.0 tag is valid; the Gitea
release is not yet created (missing ACDL_GITEA_TOKEN — documented manual
step).
 2026-07-21 22:26:52 +00:00
Jon Chery 18875cd7c8 review(v1.2): READY TO SHIP — multi-persona code review 
---ci---
project: acdl
phase: 0
milestone: v1.2
status: review
verdict: READY TO SHIP
p0: 1 (operator action, non-code)
p1: 1 (adapter hardening, v1.3)
---/ci---

v1.2 milestone review: READY TO SHIP. 1 P0 (IAM operator action, not a
code fix), 1 P1 (adapter hardening deferred to v1.3). The milestone's code
is complete + verified up to terraform plan (13 to add); the one remaining
step is the operator's IAM policy push. Ship tag v1.3.0.
 2026-07-21 22:25:29 +00:00
Jon Chery faea213a4c docs(P16): post-ship traceability + roadmap update (v1.2.6) 
---ci---
project: acdl
phase: 16
milestone: v1.2
status: shipped
---/ci---

Post-ship: ROADMAP.md Phase 16 -> complete (v1.2.6); REQUIREMENTS.md
REQ-35 -> partial (v1.2.6, IAM-blocked). All 6 v1.2 phases shipped.
 2026-07-21 22:24:48 +00:00
Jon Chery 64d35c78e6 docs(P16): plan-as-execute + verify (v1.2.6, capstone) 
---ci---
project: acdl
phase: 16
milestone: v1.2
status: verify
verdict: VERIFIED
requirements:
  covered: [REQ-35]
  partial: []
blocker:
  - P0-IAM: terraform apply blocked; operator must push spike_runner_policy.json (carried from Phase 15)
---/ci---

Phase 16 plan-as-execute + verify. scripts/verify_phase16.sh green (11
assertions). Capstone: full v1.2 platform verified end-to-end up to the
IAM-blocked terraform apply. MILESTONE_CAPSTONE_VERIFIED evidence event
written to outbox. v1.1 S3 regression passes. Ready to ship v1.2.6 +
enter the COMPLETE gate.
 2026-07-21 22:24:20 +00:00
Jon Chery 3cca5bb43f docs(P15): post-ship traceability + roadmap update (v1.2.5, PARTIAL) 
---ci---
project: acdl
phase: 15
milestone: v1.2
status: shipped
---/ci---

Post-ship: ROADMAP.md Phase 15 -> complete (v1.2.5, PARTIAL); REQUIREMENTS.md
REQ-33 -> partial (IAM-blocked), REQ-34 -> complete (v1.2.5).
 2026-07-21 22:22:03 +00:00
Jon Chery 699aa542df docs(P15): plan-as-execute + verify (v1.2.5, PARTIAL — terraform apply blocked by IAM) 
---ci---
project: acdl
phase: 15
milestone: v1.2
status: verify
verdict: PARTIAL
requirements:
  covered: [REQ-34]
  partial: [REQ-33]
blocker:
  - id: P0-IAM
    description: terraform apply fails with AccessDenied on ECS/ECR/IAM/EC2 — live spike_runner_policy.json not pushed (root key deactivated per D-034)
    unblock: operator runs create_iam_user.py with root/admin creds to push the expanded policy, then terraform apply succeeds (plan valid, 13 to add)
---/ci---

Phase 15 plan-as-execute + verify. PARTIAL: terraform apply blocked by IAM.
- Consumer microservice content authored (app.py + Dockerfile + README.md).
- Docker image acdl-microservice:latest built.
- Adapter fixed: ref emission (bare), JSON-string jsonencode, ECS service
  network_configuration/load_balancer/desired_count/launch_type/task_definition,
  listener default_action/load_balancer_arn, target group target_type/vpc_id/protocol,
  VPC tags (not name), IGW + route table association, managed_policy_arns list.
- L1 fixes: l1-ecs-service (removed port from service sub-resource),
  l1-vpc (added intra_refs, removed igw_id output).
- Resolver: intra_refs resolution (refs between sub-resources of same L1).
- terraform validate + plan succeed (13 to add).
- terraform apply BLOCKED (AccessDenied — live IAM policy not updated).
- Evidence event TERRAFORM_APPLY_BLOCKED written to DynamoDB outbox.
- v1.1 S3 regression: byte-identical.
Ready to ship v1.2.5 (partial).
 2026-07-21 22:21:36 +00:00
Jon Chery d5cc01edbd docs(P14): post-ship traceability + roadmap update (v1.2.4) 
---ci---
project: acdl
phase: 14
milestone: v1.2
status: shipped
---/ci---

Post-ship: ROADMAP.md Phase 14 -> complete (v1.2.4); REQUIREMENTS.md
REQ-32 -> complete (v1.2.4).
 2026-07-21 21:12:33 +00:00
Jon Chery d103a37419 docs(P14): plan-as-execute + verify (v1.2.4) 
---ci---
project: acdl
phase: 14
milestone: v1.2
status: verify
verdict: VERIFIED
requirements:
  covered: [REQ-32]
---/ci---

Phase 14 plan-as-execute + verify. scripts/verify_phase14.sh green.
l2-microservice composition (6 L1s, 2 wire kinds); contract schema
extended (inputs allow objects + healthcheck); resolver extended
(array-form wires, child->child refs, multi-resource L1 expansion);
adapter extended (ref: interpolation translation). v1.2 IR: 11 resources.
v1.1 S3 regression byte-identical. Ready to ship v1.2.4.
 2026-07-21 21:12:17 +00:00
Jon Chery 7c6b8c8c84 docs(P13): post-ship traceability + roadmap update (v1.2.3) 
---ci---
project: acdl
phase: 13
milestone: v1.2
status: shipped
---/ci---

Post-ship: ROADMAP.md Phase 13 -> complete (v1.2.3); REQUIREMENTS.md
REQ-31 -> complete (v1.2.3).
 2026-07-21 21:06:08 +00:00
Jon Chery 4ed2542ecf docs(P13): plan-as-execute + verify (v1.2.3) 
---ci---
project: acdl
phase: 13
milestone: v1.2
status: verify
verdict: VERIFIED
requirements:
  covered: [REQ-31]
---/ci---

Phase 13 plan-as-execute + verify. scripts/verify_phase13.sh green.
6 ECS L1s authored + registered (l1-vpc, l1-ecs-cluster, l1-ecs-service,
l1-iam-role, l1-alb, l1-ecr). Adapter generalized to table-driven
TYPE_MAP (12 IR types) + INPUT_MAP + OUTPUT_MAP. S3 regression: the v1.1
spike l1-s3 produces byte-identical main.tf. Ready to ship v1.2.3.
 2026-07-21 21:05:48 +00:00
Jon Chery 4c8de8e962 docs(P12): post-ship traceability + roadmap update (v1.2.2) 
---ci---
project: acdl
phase: 12
milestone: v1.2
status: shipped
---/ci---

Post-ship: ROADMAP.md Phase 12 -> complete (v1.2.2); REQUIREMENTS.md
REQ-30 -> complete (v1.2.2).
 2026-07-21 21:02:08 +00:00
Jon Chery 0fea29cdbb docs(P12): plan-as-execute + verify (v1.2.2) 
---ci---
project: acdl
phase: 12
milestone: v1.2
status: verify
verdict: VERIFIED
requirements:
  covered: [REQ-30]
---/ci---

Phase 12 plan-as-execute + verify. scripts/verify_phase12.sh green (22
assertions). All Wave 1 + Wave 2 tasks complete:
- T-12.1: run_spike_*.sh -> run_platform.sh (D-048, --plan-only flag)
- T-12.2: spike_runner_policy.json expanded (ECS + ECR + ELB + IAM + EC2)
- T-12.3: idempotency documented in bootstrap scripts
- T-12.4: P1-1 redacted (no live AWS key IDs in .ciagent/)
- T-12.5: P1-B fixed (PERSONAS.md platform/registry -> modules-ir/registry.json)
Subagent confirmed run_platform.sh --plan-only runs against real AWS, exit 0.
Ready to ship v1.2.2.
 2026-07-21 21:01:51 +00:00
Jon Chery 7ee57aa6c7 docs(P11): post-ship traceability + roadmap update (v1.2.1) 
---ci---
project: acdl
phase: 11
milestone: v1.2
status: shipped
---/ci---

Post-ship: ROADMAP.md Phase 11 -> complete (v1.2.1); REQUIREMENTS.md
REQ-29 -> complete (v1.2.1).
 2026-07-21 20:58:01 +00:00