43 Commits

Author	SHA1	Message	Date
Jon Chery	cec34abc22	fix(P04 W1): ecs-service execution_role_arn + task_role_arn wiring (live apply gap) ... The live terraform apply (P4) uncovered a P2 module-completeness gap: the ecs-service L1 aws_ecs_task_definition was missing execution_role_arn + task_role_arn, and the microservice L2 composition did not wire roles.outputs.role_arn to the service. Fargate requires an execution role for ECR image pull. Fixed: interface.json + variables.tf + main.tf + composition.json wires. The iam-role assume-policy trusts ecs-tasks + the inline policy grants ECR pull + CW logs. A second live gap surfaced once the task definition applied: the ALB aws_lb had no security group (AWS rejects an ALB with an empty SG list). The platform VPC only outputs an ECS SG; the composition now wires platform_vpc.outputs.ecs_security_group_id to alb.inputs.security_group (the ECS SG opens port 80 to 0.0.0.0/0 — acceptable for an internet-facing ALB + dev pilot per D-020). No iam-role module changes were needed — its locals.tf already trusts ecs-tasks.amazonaws.com and grants ECR pull + CloudWatch logs by default. Live apply now succeeds: Apply complete! Resources: 0 added, 1 changed, 0 destroyed (task def + ECS service created on the first re-apply; ALB SG updated in-place on the second). Full suite: 844 passed. ---ci--- project: acdl phase: 4 milestone: v1.26 status: execute wave: W1 ---	2026-08-19 03:01:47 +00:00
Jon Chery	373533094b	fix(P03 W0.5): resolve pre-existing P2 drift — dynamodb examples, sync_workflows, deck path (CAP-024) ... Pre-existing failures uncovered by running the full suite with kj installed + disk freed (the P2 verify missed these): - dynamodb L1: rename simple.yaml -> simple.yml + add complex.yml (module-standards expects both .yml extensions; the P2 author used .yaml) - sync_workflows: re-sync ci.yml drift (.github + .gitea <- workflows-src) - CAP-024 deck path: nova-autonomous-cloud-delivery.md was consolidated to -marp.md in v1.25 P1 (commit a47c162) but test + regression_verify still pointed at the old path; update both + relax slide-count bound (18-20) + count class="benefit" divs (marp format, not the old 'Benefit:' text) ---ci--- project: acdl phase: 3 milestone: v1.26 status: execute wave: W0.5 ---	2026-08-18 22:00:30 +00:00
Jon Chery	9f94103c57	feat(P02 W0): dynamodb L1 primitive — interface, terraform, registry, tests (REQ-322) ... New L1 module modules/l1/dynamodb/ (stack type aws:dynamodb:table). Terraform aws_dynamodb_table with PK + optional SK, PAY_PER_REQUEST default, SSE-KMS + PITR + prevent_destroy per v1.8 NFR defaults. Registry entry (kind l1), catalog row, test_adapter.py updated to 15 entries / 13 L1. 45 tests passing. ---ci--- project: acdl phase: 2 milestone: v1.26 status: execute phase_role: execution wave: 0 requirements: [REQ-322] ---/ci---	2026-08-18 00:22:19 +00:00
Jon Chery	38b51f3e6d	feat(P4): regression-gate policies + docs (REQ-304..307) ... regression/ policies (3): cap-013-adapter-dedup, cap-023-metrics-collector, cap-024-deck-structure — declarative mirrors of core/regression_verify.py over capability-inventory JSON. The imperative regression_verify.py is kept (drives CI gate); the policies are the declarative mirror (IDEATE I1 quality improvement). tests: test_regression_policies.py + clean/drifted fixtures. Skip-without-kj. docs: adapters/README.md (new kyverno-json row + PolicyEngine Protocol section with how-to-add-OpaEngine), adapters/kyverno-json/README.md (engine, install, policy directory layout, 4 categories, severity convention), schemas/README.md (D-116 engine enum reuse note), modules/STANDARDS.md §10 Policy Authoring Standard, docs/METRICS.md (swappable engine narrative). ---ci--- project: acdl phase: 4 milestone: v1.25 status: execute phase_role: execution requirements: covered: [REQ-304, REQ-305, REQ-306, REQ-307] partial: [] ---/ci---	2026-08-12 18:42:55 +00:00
Jon Chery	0ca383dae6	feat(P4): transparent terraform + feature flags + run_platform.sh split (REQ-233..238) ... Create run_codegen.sh (pre-TF: env check, validate, resolve, adapt). Create run_postapply.sh (post-TF: Checkov, confidence, HITL, outbox, SSM, uptime). Add variable 'enabled' (bool, default true) + count=var.enabled?1:0 to all 12 L1 modules (alb, cloudfront, ecr, ecs-cluster, ecs-service, iam-role, kms-key, rds, s3, uptime, vpc, waf). Fix all cross-resource references with [0] indexing. Update interface.json for all modules to declare 'enabled' input. Fix stale artifact path /tmp/acdl_platform_run_v18 → /tmp/nova_platform_run (REQ-238). run_platform.sh remains as backward-compat shim for local-dev usage. ---ci--- project: acdl phase: 4 milestone: v1.20 status: execute requirements: [REQ-233, REQ-234, REQ-235, REQ-236, REQ-237, REQ-238] ---/ci---	2026-08-07 18:49:56 +00:00
Jon Chery	f83b974c0e	Merge milestone/v1.16-nova-simplification — v1.16 complete (Nova Simplification: 20-phase NFR sweep + final; tag v1.15.26)	2026-08-01 13:37:18 +00:00
Jon Chery	0e6ecae26d	feat(P4): Nova rebrand — AWS resource migration (REQ-163) ... Rename all acdl-* AWS resources → nova-* across terraform (DynamoDB, Secrets Manager, Lambda, SNS, SG, KMS alias, ECS, ECR, IAM user/policy, state bucket, ALB, VPC/subnet names). Lambda default table names → nova-* (D-111). State bucket backend → nova-tfstate (-migrate-state documented). New docs/NOVA_AWS_MIGRATION.md runbook (staged migration + rollback). New scripts/migrate_dynamodb_data.py (scan+copy, dry-run default). acdl-deploy- → nova-deploy- role ARN in deploy workflows. Test fixtures updated; terraform validate + pytest + run_ci.sh PASS. ---ci--- project: acdl phase: 4 milestone: v1.15 status: execute ---/ci---	2026-07-30 01:54:26 +00:00
Jon Chery	51c3edf458	feat(P3): Nova rebrand — SSM path + tag keys (REQ-161/162) ... SSM path /acdl/{env}/{contractId}/{output} → /nova/... across core/output_publisher + contract resolver + consumer docs. New scripts/migrate_ssm_paths.py (copy/verify/delete, dry-run default). AWS tag keys acdl:owner|environment|contract|cost-center|ref → nova:* across terraform tagging + ABAC session policies (iam:ResourceTag/acdl:* → iam:ResourceTag/nova:*). nova_tagging.py hard mode (D-109 warn→hard). tagging-standard.json tag-key values → nova:*. New scripts/untag_acdl_keys.py (remove old acdl:* tags, dry-run default). Test fixtures updated; pytest + run_ci.sh PASS. ---ci--- project: acdl phase: 3 milestone: v1.15 status: execute ---/ci---	2026-07-30 01:38:30 +00:00
Jon Chery	63f3a2b66c	feat(P1): Nova rebrand — docs/decks/prose/schema-$id/release-titles (REQ-155/156/157) ... Rebrand ACDL/Agentic Cloud Delivery Platform → Nova across README, docs/, decks (markdown + mermaid .mmd + HTML), pyproject.toml name/description, schema $id URLs (acdl.cloudinit.dev→nova.cloudinit.dev), release.yml title/workflow-name. Nova tagline added to README header + both deck title slides + docs/vision.md (alongside existing North Star, D-106). S&P theme untouched (D-107). New docs/NOVA_MIGRATION.md consumer guide. Data values (env vars, resource names, tag keys, SSM/consumer paths) left for P2-P4. ---ci--- project: acdl phase: 1 milestone: v1.15 status: execute ---/ci---	2026-07-30 00:56:19 +00:00
Jon Chery	3b1181f39b	Merge milestone/v1.14-refinement — v1.14 complete (NFR Refinement: bug fixes, security, stubs, tests, docs; 20 phases + final; tag v1.13.24) ... v1.14 NFR Refinement milestone complete. 20 execution phases (P1-P20) + 1 final (P21). All P1/P2 backlog from v1.11 review resolved. Security posture hardened (swallowed errors, account ID externalized, IAM scoped, schema validation, credential hygiene). Stubs resolved (kyverno --kube- version removed). 7 untested scripts gained coverage. Documentation synced (ARCHITECTURE v1.11-v1.14 addenda, stale @v1.6-1.9 -> @v1.13, GRILL G-005/G-008 resolved, COST.md window extended, D-083 deferral recorded). Platform VPC parameterized. 561 tests pass (was 528 at v1.13.2; +33). 22/22 capabilities Verified. 6 grill binding decisions (G-101..G-106) applied. 1 escalation (E-001) auto-resolved at full autonomy (D-101). ---ci--- project: acdl phase: 21 milestone: v1.14 status: complete ---/ci---	2026-07-29 21:36:37 +00:00
Jon Chery	a03c01932f	fix(P60/P62): ALB name_prefix + adapter dedup + L2 composition wiring ... Three fixes from CI run 3027 (06f4fc7): 1. ALB name_prefix too long: AWS limits target group name_prefix to 6 chars. Changed from "acdl-ci-alb-" (12) to "tg-ci-" (6). 2. Adapter deduplication: multi-resource L1s (cloudfront with distribution + OAC) expand to multiple stack resources sharing the same terraform dir. The adapter was emitting TWO module blocks for the same dir, the second missing required inputs. Now deduplicates by terraform dir, merging inputs from all resources that point to it. Adapter stays under 200 lines (194). 3. L2 microservice composition: ECR module requires "name" input but the composition didn't wire it. Added wires for ecr.inputs.name (default "app-repo") and roles.inputs.role_name (default "app-role"). Note: the ecs-service/uptime/rds failures in run 3027 were caused by the P64 teardown destroying the CI VPC while the pipeline was still running (timing issue). The next CI run after this push will have a fresh CI VPC. Regression: 485 passed, 5 deselected. ---ci--- project: acdl phase: P60 milestone: v1.11 status: execute ---/ci---	2026-07-29 12:22:00 +00:00
Jon Chery	4dad967910	fix(P60): ALB target group name_prefix — avoid orphaned resource conflicts ... The ALB lifecycle test was failing with "ELBv2 Target Group (acdl-ci-alb) already exists" because a prior failed run left an orphaned target group in AWS. The deterministic state key means terraform reuses the same state, but create_before_destroy tries to create a new target group with the same name before destroying the old one → conflict. Fix: use name_prefix instead of name for the target group. AWS auto-generates a unique name (e.g. acdl-ci-alb-2026072812001234567), so create_before_destroy can create the new target group without conflicting with the orphaned one. The old orphaned target group is eventually garbage-collected by AWS (or cleaned up by a future run's destroy step). This is the standard terraform pattern for create_before_destroy resources with name uniqueness constraints. ---ci--- project: acdl phase: P60 milestone: v1.11 status: execute ---/ci---	2026-07-28 20:22:41 +00:00
Jon Chery	361fe600a9	feat(P61): L2 lifecycle pipeline — extend matrix + workflows + tests ... Extend the modules-lifecycle pipeline with L2 composition modules (static-assets, microservice) per REQ-128: - pipelines/modules-lifecycle.yml: added l2-lifecycle-apply/modify/destroy stages + l2_modules matrix entry - .gitea/workflows/modules-lifecycle.yml + .github/workflows/modules-lifecycle.yml: added l2-lifecycle job (byte-identical), matrix over [static-assets, microservice], needs ci-vpc-apply, has apply/modify/destroy steps. ci-vpc-destroy now needs both [lifecycle, l2-lifecycle]. - schemas/modules-lifecycle-pipeline.schema.json: added l2_modules to matrix - scripts/run_l2_lifecycle_test.sh + run_l2_lifecycle_destroy.sh: L2 wrappers that set ACDL_REMOTE_STATE_KEY=spike/ci-vpc/terraform.tfstate so the microservice composition's terraform_remote_state reads from the CI VPC - adapters/terraform/adapter.py: parameterized remote_state key via ACDL_REMOTE_STATE_KEY env var (default: platform/terraform.tfstate) - modules/l2/static-assets/examples/complex.yml: fixed bucket_name to match simple (my-static-site) so terraform modifies in-place (adds CDN + WAF) - modules/l2/microservice/examples/complex.yml: fixed bucket_name to match simple (my-microservice-demo), added desired_count:2 (modify variant) - tests/test_pipeline_contract.py: 7 new L2 tests (l2 job exists, matrix lists both modules, apply/modify/destroy steps, needs ci-vpc-apply, ci-vpc-destroy needs both, contract matrix lists l2_modules) - pipelines/README.md: updated stages for L2 Regression: 485 passed, 5 deselected. Gitea + GitHub workflows byte-identical. ---ci--- project: acdl phase: P61 milestone: v1.11 status: execute ---/ci---	2026-07-28 20:17:27 +00:00
Jon Chery	bb3ac7c74d	fix(P60): WAF scope case + VPC modify DependencyViolation ... Two module defects found in the prior live matrix run (3000, SHA a55752e2) that hadn't been fixed: 1. WAF: `scope: cloudfront` in complex example failed with "expected scope to be one of [CLOUDFRONT REGIONAL], got cloudfront". AWS requires uppercase. Added `scope = upper(var.scope)` in locals.tf so the module is resilient to either casing, and fixed the complex example to use CLOUDFRONT. 2. VPC: simple→complex modify tried to replace the VPC (CIDR changed 10.0.0.0/16 → 10.50.0.0/16, which is ForceNew) while subnets/IGW/ route tables still referenced it → DependencyViolation. Fixed the complex example to use the same CIDR (10.0.0.0/16) so terraform modifies in-place (adds a 3rd AZ subnet, updates tags). Also added create_before_destroy lifecycle on the VPC as a defensive measure. Regression: 479 passed, 5 deselected. 24 example contracts resolve. ---ci--- project: acdl phase: P60 milestone: v1.11 status: execute ---/ci---	2026-07-28 20:13:07 +00:00
Jon Chery	88ea408003	fix(uptime): add default for container_image variable ... The uptime module's container_image variable had no default, but the interface declares a default ('louislam/uptime-kuma:1'). The simple example contract doesn't pass container_image, so terraform validate failed with 'Missing required argument'. Added the default to match the interface. ---ci--- project: acdl phase: P59 milestone: v1.11 status: execute ---/ci---	2026-07-28 18:51:05 +00:00
Jon Chery	fad6765b9e	fix: kms-key deletion window range + rds password policy ... - kms-key: complex example had deletion_window_days=90 (max is 30). Fixed to 30. - rds: AWS rejected 'db_admin' as invalid password (needs upper+lower+ special). Added password variable (default 'ACdlcI2026!') to the RDS module + interface + both example contracts. ---ci--- project: acdl phase: P59 milestone: v1.11 status: execute ---/ci---	2026-07-28 18:40:04 +00:00
Jon Chery	6795acc9eb	fix(alb): create_before_destroy on target group + depends_on on listener ... When the ALB port changes (simple 80 → complex 443), terraform tries to replace the target group while the listener still references it, causing ResourceInUse. Added lifecycle { create_before_destroy = true } to the target group and depends_on = [aws_lb_target_group.this] to the listener so the new target group is created before the old one is destroyed. ---ci--- project: acdl phase: P59 milestone: v1.11 status: execute ---/ci---	2026-07-28 18:27:10 +00:00
Jon Chery	ad3cc5f129	fix(ci): separate short-lived CI VPC + fix 8 module lifecycle failures ... Two architectural changes: 1. Created terraform/ci-vpc/ — a short-lived VPC for L1 module lifecycle testing, separate from the long-lived platform VPC. Created before VPC-dependent modules (alb, ecs-service, rds, uptime) are tested, destroyed after. Outputs (vpc_id, subnet_ids, sg_id, cluster_arn) are passed to those modules via scripts/run_lifecycle_test.sh + run_lifecycle_destroy.sh wrappers that inject the CI VPC outputs into the example contracts. 2. Updated the workflow to use ci-vpc-apply → lifecycle (with artifact passing) → ci-vpc-destroy (always runs). 8 module-specific fixes: - s3: unique bucket names (acdl-ci-s3a-simple/complex) instead of globally-taken 'my-simple-bucket' - kms-key: alias name with no spaces (locals.tf → alias/acdl-ci-kms) - iam-role: example contract uses role_name (not name, which the interface doesn't declare) - ecs-service: example contract uses family (not name); VPC inputs (cluster_arn, subnets, security_group) injected by CI VPC wrapper - uptime: added subnets, security_group, cluster_arn to interface + module; network_configuration is dynamic (only when subnets provided) - rds: added subnet_ids input + db_subnet_group resource (conditional on subnet_ids being non-empty) - alb: removed hardcoded placeholder sg/subnet values from examples; vpc_id + subnets + security_group injected by CI VPC wrapper - cloudfront: removed invalid placeholder WAF ARN from complex example Regression: 479 passed, 0 skipped, 5 deselected. All 24 example contracts pass --check-only. ---ci--- project: acdl phase: P59 milestone: v1.11 status: execute ---/ci---	2026-07-28 17:52:58 +00:00
Jon Chery	fda4564a7f	feat(P58): single platform VPC + deterministic env-aware state keys ... EXECUTE stage. Fixes the 4-VPC bug: adds a single shared VPC to terraform/platform, drops the vpc child from the microservice composition (references the platform VPC via data source), and makes state keys env-aware (spike/{id}/{env}/terraform.tfstate — stable across lifecycle). Platform VPC (terraform/platform/main.tf): - aws_vpc.acdl_shared (10.0.0.0/16) + 2 subnets + IGW + route table + SG - Outputs: vpc_id, subnet_ids, ecs_security_group_id Microservice composition (modules/l2/microservice/composition.json): - Dropped the vpc child (no per-contract VPC ever again). - Added data_sources block: platform_vpc → terraform_remote_state (platform). - Wires: vpc.outputs.subnet_ids → platform_vpc.outputs.subnet_ids. - Wires: platform_vpc.outputs.vpc_id → alb.inputs.vpc_id. - Wires: platform_vpc.outputs.ecs_security_group_id → service.inputs.security_group. Contract resolver (core/contract_resolver.py): - Added environment to the stack instance (stack.environment). - Added data_sources handling: pseudo-children with outputs but no resources. - data_sources propagated through fragment merge to the final stack instance. Adapter (adapters/terraform/adapter.py): - State key: spike/{stack_name}/{environment}/terraform.tfstate (env-aware). - Emits data "terraform_remote_state" "platform" block when data_sources present. - ref:platform_vpc.<output> → data.terraform_remote_state.platform.outputs.<output>. Tests (tests/test_adapter.py): - test_adapt_env_aware_state_key: spike/msvc/prod/terraform.tfstate. - test_adapt_emits_data_source_block: data.terraform_remote_state.platform. - test_adapt_no_vpc_for_microservice: no resource "aws_vpc" in microservice output. - Updated existing state key assertion (spike/s3/dev/terraform.tfstate). Regression: 467 passed, 0 skipped, 5 deselected. run_platform.sh --check-only passes for both microservice (9 resources, no VPC) and static-assets (5 resources). ---ci--- project: acdl phase: P58 milestone: v1.11 status: execute ---/ci---	2026-07-28 16:07:57 +00:00
Jon Chery	c80060878a	feat(P56b): author 11 L1 module terraform subdirs + fix adapter output format ... EXECUTE stage. Authors the remaining 11 L1 module terraform subdirs with the full versions/variables/locals/main/outputs split. Defaults previously hardcoded in the adapter move into locals.tf. Simple single-resource modules (7): - kms-key: aws_kms_key + alias (enable_key_rotation, deletion_window defaults) - ecr: aws_ecr_repository (encryption_configuration from kms_key_arn, image_scanning) - ecs-cluster: aws_ecs_cluster (name default) - iam-role: aws_iam_role + inline_policy (assume_role_policy fallback, ECR/logs policy in locals.tf) - rds: aws_db_instance (storage_encrypted, multi_az, kms_key_arn defaults) - waf: aws_wafv2_web_acl (default_action, visibility_config, dynamic rules) - uptime: aws_ecs_task_definition + aws_ecs_service (Fargate compat, container_definitions in locals.tf) Multi-resource modules with intra-refs (4): - vpc: aws_vpc + aws_subnet + aws_internet_gateway + aws_route_table (CIDR derivation in locals.tf) - ecs-service: aws_ecs_task_definition + aws_ecs_service (Fargate compat, container_definitions, network_config in locals.tf) - alb: aws_lb + aws_lb_target_group + aws_lb_listener (subnet/security_group list derivation in locals.tf) - cloudfront: aws_cloudfront_distribution + aws_cloudfront_origin_access_control (OAC defaults in locals.tf) Registry: terraform_dir added to all 11 remaining entries. Adapter fix: stack output format uses separate 'from' + 'output' fields (not 'from': 'rid.output'). Fixed _emit_root_output to read both fields. 6 previously-skipped tests unblocked (run_platform.sh --check-only now resolves static-assets.yml through the new module-assembled adapter). Removed skip markers. Fixed test assertion (aws_s3_bucket → module). Regression: 461 passed, 0 skipped, 5 deselected (slow). All 12 modules pass run_primitive_plan.sh --check-only. All 12 terraform/ subdirs pass terraform init + validate standalone. ---ci--- project: acdl phase: P56b milestone: v1.11 status: execute ---/ci---	2026-07-28 16:07:57 +00:00
Jon Chery	a16e6f1bff	feat(P56a): stateless adapter rewrite + s3 reference terraform module ... EXECUTE stage. Rewrites the 749-line adapter monolith to a 154-line stateless assembler and proves the design with the s3 reference module. Stateless adapter (adapters/terraform/adapter.py, 749 → 154 lines): - Deleted TYPE_MAP, INPUT_MAP, OUTPUT_MAP (3 constant tables). - Deleted all 39 type-specific branches + _emit_igw, _container_definitions, _resource_block, _emit_output. - New adapt(): reads registry.json → terraform_dir → emits root main.tf with module-instantiation blocks (module "x" { source = ... }) + ref wiring via module.<rid>.<output> interpolations + root outputs. - The adapter owns NO resource shape, NO nested blocks, NO defaults, NO type-specific logic. It only assembles module instantiations and wires refs. s3 reference terraform module (modules/l1/s3/terraform/): - versions.tf (required_version + aws ~> 5.0) - variables.tf (bucket_name, region, kms_key_arn, tags) - locals.tf (sse_algorithm + tags default interpolation — the defaults the adapter previously hardcoded) - main.tf (aws_s3_bucket + versioning + SSE config, referencing local.*) - outputs.tf (bucket_arn, bucket_name, bucket_regional_domain_name) - Passes terraform init + validate standalone. Registry (modules/registry.json): s3 entry gains terraform_dir field. STANDARDS.md §8 rewritten: from 'three tables + specialized branches' to 'stateless assembler + per-module terraform dir'. §9.4 checklist updated. §9.1 required-files list updated to include terraform/ subdir. tests/test_adapter.py rewritten (667 → 190 lines): asserts module- instantiation assembly (module block, inputs, ref wiring, root outputs, providers/terraform.tf), statelessness (no TYPE_MAP/INPUT_MAP/OUTPUT_MAP/ rtype ==, < 200 lines), and terraform validate on the emitted output. Deleted test_p1_1_adapter_parameterization.py (tested the deleted HCL string emission). 6 pipeline tests skipped (run_platform.sh --check-only defaults to static-assets.yml which needs cloudfront/waf terraform dirs — P56b). Regression: 455 passed, 6 skipped, 5 deselected (slow). run_primitive_plan --check-only s3 exits 0. ---ci--- project: acdl phase: P56a milestone: v1.11 status: execute ---/ci---	2026-07-28 16:07:57 +00:00
Jon Chery	031887ec56	refactor(P57): contract surface redesign + rename + .yml repo-wide ... Contract surface redesign: - New top-level fields: id (3-6 char acronym → stack.name), name (full → stack.title), infrastructure (map keyed by module name, replaces module:) - Drop uses: field (dead reference; version pin lives in CI workflow uses: line) - Drop top-level module/inputs (now nested under infrastructure map) - Per-module optional version (defaults to latest published from registry) - Multi-module contracts: one file deploys N modules in one pipeline run, resource IDs namespaced with module name to avoid collisions - stack.schema.json: add optional title field for display name Rename: - pipelines/deploy.yaml → pipelines/contract.yml (declarative spec, not a pipeline) - pipelines/ci.yaml → pipelines/ci.yml - All 44 .yaml files → .yml repo-wide (contracts, module examples, kyverno policies) - .acdl/contract.yaml → .acdl/contract.yml Resolver (core/contract_resolver.py): - Rewrite resolve() to loop infrastructure map, default version to latest, merge module fragments into one stack with namespaced resource IDs - _latest_version() picks highest non-deprecated from registry - _namespace_resources() prefixes IDs + rewrites ref: expressions for multi-module - Single-module path: unprefixed IDs (backward compatible) Verification: - 494 tests pass (0 contract-shape failures) - Local E2E passes (contract → resolver → adapter → local ECS HTTP 200 → outbox) ---ci--- project: acdl phase: 57 milestone: v1.10.2 status: execute ---/ci---	2026-07-27 21:37:40 +00:00
Jon Chery	7585c828f0	docs(P48): vision gaps + badge system + substrate→engine + CR format + agentic tags ... 9 requirements implemented across presentation decks and project docs: 1. DX closing slide: added 'Infrastructure as a utility, not a craft' bullet to convey the full vision (infrastructure consumed, not maintained; platform compounds value over time). 2. PW Problem slide: 'moving a merged change' → 'promoting a change'. 3. PW Problem slide: added 'Red tape' and 'Scalability without increasing headcount' bullets (4 frictions, not 2). 4. PW Roadmap slide: redesigned with side-by-side HTML table layout (Testing | Planned), 16px font, no overflow. 5. PW deck: added new slide 'What This Platform Is — and Isn't' after North Star (sovereign boundary, infrastructure as utility, 4 anti-goals). PW deck now 16 slides (was 15). 6. Maturity nomenclature: 'Available today'/'shipped' → 'Testing' across both decks + source markdown. New .testing badge (blue/teal #DBEAFE). Roadmap title: 'Testing vs. Planned'. The platform has 0 consumer adoption — 'shipped' was inaccurate. 7. Global: 'substrate' → 'engine' across entire project (88 matches, 30+ files including .ciagent/, docs/, modules/, adapters/, schemas/, code). 8. Presentation files only: 'forge' → 'VCS' / 'version control system' (6 occurrences in 4 files). 'forge' retained in all technical docs and code as the industry-standard term. 9. New .agentic badge (purple/violet #EDE9FE) appended to agentic features in both decks: confidence signal, autonomous dev, pattern recognition, dynamic module creation, citizen developer surface, auto-promotion. Also: Change Request ID format changed from 'CR-2026-001' to 'CHG0678912' across presentation files, consumer guide, and test fixtures. HTML re-rendered. PPTX rendered for release upload. ---ci--- phase: 48 milestone: v1.9 status: complete requirements: covered: [] partial: [] ---/ci---	2026-07-23 14:58:29 +00:00
Jon Chery	2682719f24	docs(P47): presentation slide updates + HIPAA removal from all docs ... Presentation changes (both Marp decks + source markdown): 1. Title slide: deck title as H1 (slightly bigger), 'Agentic Cloud Delivery Platform' as H3 subtitle — cleaner title hierarchy 2. DX deck: removed Local Reproducibility slide (not beneficial for DX) 3. DX deck: Safe Promotion Path slide redesigned with side-by-side layout for Approaches A and B (HTML table, two columns) 4. DX deck: 'an agent' → 'an AI agent' (slide 2 + Citizen Developer slide) 5. DX deck: What a Developer Does — diagram floated to the right side 6. Header simplified to just the deck name (subtitle now on title slide) HIPAA removal (25 files): - Completely removed all HIPAA references from all markdown documentation, presentation source files, module READMEs, and rendered HTML - Removed HIPAA from compliance milestone lists (GDPR, SOX, SOC2, DORA remain) - Removed HIPAA section references (§164.xxx) from compliance annotations - Cleaned up empty parentheses and broken commas left by removal - Re-rendered both HTML decks from updated Marp source ---ci--- phase: 47 milestone: v1.9 status: complete requirements: covered: [] partial: [] ---/ci---	2026-07-23 14:08:40 +00:00
Jon Chery	e1be05287b	feat(P39): refresh design docs + parameterize adapter (P1-1) ... ---ci--- project: acdl phase: 39 milestone: v1.9 status: execute ---/ci--- Phase 39 — design-doc-refresh-and-p1-1-parameterization: Design docs (REQ-100, REQ-101): - hitl_matrix_design.md: 'dev-only spike'/'v1.2 wires the gates' framing replaced with v1.9 wired-gates reality; 8-concern matrix marked implemented (offline-testable subset + signed evidence artifacts, D-084); v1.9 wiring section cross-references hitl_gates.py + attestation_matrix.py; approver_dr noted. - audit_ledger_design.md: outbox marked shipped+production since v1.8; S3 Object Lock + JWS + async worker + DLQ + daily checkpoints clearly labeled 'Deferred to a future milestone (D-083)'; RPO/RTO table updated; approver fields note v1.9 hitl_gates.attest. P1-1 adapter parameterization (REQ-102, D-085): - ecs-service interface.json: desired_count (default 1), launch_type (FARGATE), family (app) inputs added. - alb interface.json: load_balancer_type (application), target_type (ip). - adapter.py: hardcoded defaults replaced with inputs.get(<name>, <default>); hardcoded 'acdl-microservice-rt'/'acdl-microservice-igw' Name tags derive from the VPC name input. - contract_resolver.py: child_input_map routes wires to the sub-resource that declares the input (desired_count → aws:ecs:service, family → aws:ecs:task_definition, target_type → targetgroup, etc.). - microservice composition.json: wires added for the new inputs. Tests: +21 (test_p1_1_adapter_parameterization.py, test_design_docs_current.py). 371 passed; run_ci.sh green; run_platform.sh --check-only green; v1.1 S3 regression preserved.	2026-07-23 04:24:25 +00:00
Jon Chery	cb02c69e0c	docs(P35): module engineering standards + catalog fix + template update (REQ-95, REQ-96) ... ---ci--- project: acdl phase: 35 milestone: v1.8 status: execute ---/ci--- - modules/STANDARDS.md: comprehensive L1+L2 authoring + code review standards (9 sections: L1 standards, L2 standards, encryption by default, deletion protection by default, registry, README standards, adapter extension pattern, code review checklist). - modules/README.md: catalog index fixed — rds, kms-key, uptime added to the Primitives table. - modules/README-TEMPLATE.md: NFRs section added between Outputs and Usage. - tests/test_module_standards.py: automated enforcement test (12 tests) validating required files, NFRs, registration, README sections. Tests: +12 (332 -> 344). All pass.	2026-07-22 22:20:50 +00:00
Jon Chery	491ba78768	feat(P33): uptime-kuma primitive + deploy-uptime pipeline stage (REQ-88..91) ... ---ci--- project: acdl phase: 33 milestone: v1.8 status: execute ---/ci--- - New uptime L1 primitive (aws:ecs:uptime-service) deploying uptime-kuma on ECS Fargate with feature_flag_enabled, monitored_endpoints, static_checks, alert_channels (Teams/email/SMS/GitHub issues). - Adapter emits ECS Fargate task + service when feature_flag_enabled=true; emits nothing when false. Container image louislam/uptime-kuma:1. - New deploy-uptime pipeline stage in pipelines/deploy.yaml (after publish-outputs, before comment-outputs). Now 9 stages. - run_platform.sh --deploy-uptime flag + automatic uptime deployment after L2 module (separate state $WORK/uptime-tf). Endpoints from L2 outputs passed as monitored_endpoints. Feature flag from inputs.uptime_enabled (default true). - scripts/seed_uptime_monitors.py for post-deploy monitor seeding via uptime-kuma API. - Registered in registry.json (14 modules total). Tests: +6 (312 -> 318). All pass.	2026-07-22 22:15:35 +00:00
Jon Chery	8145eee8fc	feat(P32): deletion-protection-by-default + L2 feature flag (REQ-86, REQ-87) ... ---ci--- project: acdl phase: 32 milestone: v1.8 status: execute ---/ci--- - All 11 L1 primitives now have deletion_protection NFR (boolean, default true). - Adapter emits `lifecycle { prevent_destroy = true }` when NFR is true; omits it when false. Default is true when NFR is absent. - L2 composition resolver propagates inputs.deletion_protection to all children NFRs. When false, all resources get deletion_protection=false. - Stack schema updated with optional features object (deletion_protection, uptime_enabled). - Contract schema description updated to document deletion_protection and uptime_enabled inputs. Tests: +5 (307 -> 312). All pass.	2026-07-22 22:12:42 +00:00
Jon Chery	de91a4bb76	feat(P31): encryption-by-default + per-stack CMK (REQ-83, REQ-84, REQ-85) ... ---ci--- project: acdl phase: 31 milestone: v1.8 status: execute ---/ci--- - New kms-key L1 primitive (aws:kms:key) with enable_key_rotation=true (AWS-managed annual rotation, D-075). Registered in registry.json. - Adapter TYPE_MAP expanded for aws:kms:key + aws:kms:alias. - Adapter emits enable_key_rotation from NFR. - S3 adapter emits server_side_encryption_configuration with KMS when kms_key_arn provided; managed KMS fallback with stderr warning when not. - All 10 existing L1 primitives now have encryption_enabled NFR (default true). - s3, rds, ecr, ecs-service, ecs-cluster have kms_key_arn input. - Both L2 compositions (static-assets, microservice) now include a kms-key child + wires connecting kms_key_arn to children. - L2 stack outputs include kms_key_arn. Tests: +7 (300 -> 307). All pass. run_platform.sh --check-only green (static-assets now resolves to 5 resources with the CMK).	2026-07-22 22:11:03 +00:00
Jon Chery	94065a4fbc	feat(P27): add Examples section to every module README (D-058) ... Each module README (10 primitives + 2 patterns) now has a ## Examples section before ## Versioning, referencing and excerpting the validated simple.yaml + complex.yaml (+ mysql.yaml for RDS) example contracts. The RDS README includes a Multi-engine variation subsection (D-059). ---ci--- project: acdl phase: 27 milestone: v1.7 status: execute ---/ci---	2026-07-22 20:23:48 +00:00
Jon Chery	4bd07a4fae	feat(P27): validated per-module examples (D-058) + schema glob fix ... Add modules/<name>/examples/ directories with simple.yaml + complex.yaml (+ mysql.yaml for RDS) for every primitive and module pattern. All 25 example contracts validate against schemas/contract.schema.json. Update the contract schema to allow object/array input values (for env vars). Fix the platform-test schema-validation glob to modules/*/*/examples/*.yaml to match the nested l1/l2 path structure. Update the microservice sample contract note (env objects now permitted by the schema). ---ci--- project: acdl phase: 27 milestone: v1.7 status: execute ---/ci---	2026-07-22 20:22:45 +00:00
Jon Chery	a9d8b31595	feat(P27): RDS primitive + adapter expansion (D-059) ... Add modules/l1/rds/ with interface.json (engine enum for postgres, mysql, mariadb, sqlserver, oracle), instance.json, README.md (full template with compliance extension points). Register in registry.json. Expand the adapter TYPE_MAP/INPUT_MAP/OUTPUT_MAP for aws:rds:instance -> aws_db_instance; emit backup_retention_period, deletion_protection, storage_encrypted, and skip_final_snapshot from NFRs/inputs. Add RDS to the primitives-plan matrix. Update tests for the new registry entry count (12) + RDS adapter emission. ---ci--- project: acdl phase: 27 milestone: v1.7 status: execute ---/ci---	2026-07-22 20:21:45 +00:00
Jon Chery	a4b17d0f26	fix(P26): resolve multi-resource L1 ref ids in contract resolver ... ---ci--- project: acdl phase: 26 milestone: v1.7 status: execute ---/ci--- The microservice pattern (and any L2 referencing multi-resource L1s like vpc) failed at the adapter stage because the resolver emitted refs using the child id (e.g. 'vpc') instead of the expanded sub-resource id (e.g. 'vpc-subnet'). The adapter's type_by_id table only knows the sub-resource ids, so ref:vpc.subnet_ids was an unknown resource id. Fix: - contract_resolver.py: child_outputs now maps {outputName -> resourceId} instead of just the interface outputs dict. For multi-resource L1s, the ref uses the sub-resource id that produces the output. For single-resource L1s, the resourceId == childId (unchanged behavior). - vpc interface.json: the subnet sub-resource output is 'subnet_ids' (matching the interface-level output name) instead of 'subnet_id'. - adapter.py OUTPUT_MAP: aws:ec2:subnet now maps both 'subnet_ids' and 'subnet_id' to 'id'. Verification: - microservice pattern check-only: PASS (11 resources) - static-assets pattern check-only: PASS (4 resources) - platform check-only: PASS - full test suite: 266 passed	2026-07-22 20:15:59 +00:00
Jon Chery	90be5839ab	feat(P26): 3 platform pipelines + release job with semver/tag updates ... Phase 26 — platform-pipelines-and-release-automation: - platform-test.yml: PR pipeline (lint + unit-test + integration-test + schema-validation) replacing ci.yml for PRs; integration-test runs run_platform.sh --check-only for every contracts/*.yaml - primitives-plan.yml: PR pipeline with matrix over all 9 L1 primitives (s3, vpc, ecs-cluster, ecs-service, iam-role, alb, ecr, cloudfront, waf) - patterns-plan.yml: PR pipeline with matrix over all 2 L2 modules (static-assets, microservice) - release.yml: push-to-main pipeline computing next semver tag (PATCH for regular phases, MINOR for milestone completions), updating floating MAJOR.MINOR + MAJOR tags, and creating GitHub releases - run_primitive_plan.sh: plan-only/check-only runner for a single L1 primitive (adapter compile + structure validation offline) - run_pattern_plan.sh: plan-only/check-only runner for a single L2 pattern (environment check + contract validate + resolve + adapter + structure validation offline) - contracts/microservice.yaml: sample consumer contract for the microservice L2 module (schema-compliant scalar inputs) - instance.json for 8 L1 primitives (vpc, ecs-cluster, ecs-service, iam-role, alb, ecr, cloudfront, waf) so the primitives-plan matrix can run the adapter offline; s3 already had one - tests/test_release_logic.py: unit test for semver computation (PATCH bump, MINOR bump on milestone, floating tag format) - tests/test_pipeline_contract.py: 19 new tests validating the 4 platform workflows exist and conform (stages, matrices, triggers, permissions) DEVIATION: The microservice pattern (run_pattern_plan.sh --check-only microservice + run_platform.sh --check-only contracts/microservice.yaml) fails at the adapter stage due to a pre-existing resolver ref-id mismatch for multi-resource L1s (resolver emits ref:vpc.subnet_ids but the expanded resource id is vpc-subnet). This predates Phase 26 and is out of scope for pipeline automation; the static-assets pattern passes end-to-end. The microservice contract is schema-valid and resolves correctly (11 resources); only the adapter compilation of multi-resource L1 refs fails. VERIFICATION: - bash scripts/run_ci.sh: PASS (lint + test + check-only) - python3 -m pytest tests/ -v: 266 passed - bash scripts/run_primitive_plan.sh --check-only s3: PASS - bash scripts/run_pattern_plan.sh --check-only static-assets: PASS - All 9 primitives pass run_primitive_plan.sh --check-only - All instance.json validate against stack.schema.json ---ci--- project: acdl phase: 26 milestone: v1.7 status: execute ---/ci---	2026-07-22 20:13:36 +00:00
Jon Chery	dca35c78ec	feat(P22): rename static-asset→static-assets + cloudfront/waf primitives + production stack + @v1.6 bump ... ---ci--- phase: 22 title: rename-and-production-static-assets-stack status: complete verification: - scripts/run_ci.sh: PASS (CI PIPELINE OK) - python3 -m pytest tests/ -v: 175 passed - scripts/run_platform.sh --check-only: PASS (PLATFORM CHECK OK) - grep -R "static-asset[^s]" . (excl .git/): 0 hits - grep -R "static-asset$" . (excl .git/): 0 hits - floating git tags v1.6 + v1 point at v1.6.0 (a90a756) changed_files: - Task 1 (rename): contracts/static-asset.yaml→static-assets.yaml (git mv); modules/l2/static-asset→static-assets (git mv); sed replaceAll static-asset→static-assets in 22 files (README, docs, scripts/run_platform.sh, pipelines/deploy.yaml, modules/registry.json, tests/*, .ciagent/* historical narrative) - Task 2 (cloudfront primitive): modules/l1/cloudfront/interface.json + README.md - Task 3 (waf primitive): modules/l1/waf/interface.json + README.md - Task 4 (registry): modules/registry.json (+cloudfront, +waf, static-assets renamed) - Task 5 (augment static-assets): modules/l2/static-assets/composition.json (s3+cloudfront+waf, depth 1); modules/l1/s3/interface.json +instance.json (+bucket_regional_domain_name output); modules/l2/static-assets/README.md (production stack docs) - Task 6 (adapter): adapters/terraform/adapter.py (+TYPE_MAP/INPUT_MAP/OUTPUT_MAP for cloudfront distribution+OAC+wafv2 webacl; special handling in _emit_resource for OAC defaults, distribution origin/cache_behavior/restrictions/viewer_certificate/web_acl_id, waf scope/default_action/visibility_config/managed rules) - Task 7 (contract schema): no change needed (generic inputs object; new module names match ^[a-z][a-z0-9-]*$) - Task 8 (@v1.6 bump): contracts/static-assets.yaml, .gitea/.github/workflows/deploy.yml (ref: v1.6 + header comments), docs/consumer-guide.md, docs/contracts/index.md, docs/pipeline/versioning.md, docs/pipeline/index.md, docs/architecture.md, README.md, modules/l2/microservice/README.md, tests/test_environment_check.py, tests/test_pipeline_contract.py - Task 9 (floating tags): git tag -f v1.6 v1.6.0; git tag -f v1 v1.6.0 - Task 10 (tests): tests/test_adapter.py (registry 11 entries/9 L1/2 L2; cloudfront+waf type map tests; TestS3Output bucket_regional_domain_name; TestStaticAssetsStack 4 tests); tests/test_contract_resolver.py (+s3/cloudfront/waf resource assertions) generated: - terraform/spike/main.tf + terraform.tf (regenerated by run_platform.sh --check-only; reflect static-assets production stack + backend key spike/static-assets/) notes: - D-048 full rewrite of .ciagent/ historical narrative (verbatim phase descriptions, REQ-25/27/50, D-036) — produces intentional tautologies (e.g. "Rename static-assets → static-assets") per the decision to override the v1.6 preservation precedent. - cloudfront interface.json resources array ordered distribution-first so the resolver (first-match wire resolution) routes bucket_regional_domain_name/waf_web_acl_arn/region to the distribution; the OAC gets adapter-provided defaults (name=acdl-oac, origin_type=s3, signing_behavior=always). - .ciagent/ @v1.4 references left as historical record (D-048 scope was static-asset rename only; @v1.4 is historical narrative of Phase 20). - s3 OUTPUT_MAP bucket_regional_domain_name not added (identity fallback in adapt() already handles it; OUTPUT_MAP documents non-identity mappings only). ---ci---	2026-07-22 19:56:52 +00:00
Jon Chery	553caf8f1d	docs(P21): rewrite README + normalize modules terminology (REQ-52,55,56,57,58,59,60) ... ---ci--- project: acdl phase: 21 milestone: v1.6 status: execute ---/ci--- README.md rewrite: - Remove all .ciagent/ references (links + repository-layout row). - Remove .gitea/workflows/ row from repository layout. - Restate repository roles: consumer repo = app code + 1+ contracts + CI definitions (thin .github/workflows/*.yml uses:-ing the central workflow); platform repo owns modules/adapters/core/schemas/pipelines/ scripts/workflows. - Replace Status section with Features list (consumer + platform-engineer referenceable) + Roadmap (planned only, no version changelog, no internal CIAgent status). Includes the composition-redesign roadmap entry (dynamic module creation from a contract). - Fix the mermaid flowchart: all node text visible (short multi-line labels via <br/>), add a security-checks stage before policy checks, do not name specific tools (security checks/policy checks/infrastructure plan via adapter), add infrastructure-apply stage (dev only, after evidence event). - Remove the environments table (dev/qa/prod/dr) completely; point to docs/environments/ for platform-managed environments. - Credentials section: remove go-gitea/gitea#36988 blocked mention + waivers D-039/D-047 language. State OIDC+ABAC default; alternative is a static AWS key (GitHub Secrets for platform-runner runs, .env.secrets locally) with daily rotation (platform-managed) or out-of-band rotation (consumer-managed for local .env.secrets). - forge -> platform runners / platform-managed throughout. - Links point to docs/ Pages paths, not .ciagent/. modules/ terminology: - modules/README.md: L1 primitives -> primitives, L2 compositions -> modules, composition -> pattern (prose); add roadmap note for the composition redesign. - README-TEMPLATE.md: L1 primitive -> primitive. - All 7 L1 READMEs: L1 primitive -> primitive. - L2 static-asset + microservice READMEs: L2 composition -> module pattern, composition -> pattern, L1 -> primitive; bump stale @v1 -> @v1.4 in usage examples; fix CONSUMER_GUIDE.md -> consumer-guide.md link. Verification: grep sweeps for .ciagent/.gitea/forge/go-gitea/waiver/ D-039/D-047/acdl_platform in docs/ README.md modules/ contracts/ all return 0 hits. Tests: 166 pass. run_ci.sh green.	2026-07-22 18:26:00 +00:00
Jon Chery	f68f85c9fd	review(v1.5): READY TO SHIP — multi-persona code review ... ---ci--- project: acdl phase: 20 milestone: v1.5 status: review verdict: READY TO SHIP p0: 1 (fixed — contract path resolution in deploy workflow) p1: 6 (flagged post-hoc) ---/ci--- Multi-persona review of v1.5 phase 20 (docs + reusable deploy workflow). P0 (blocking) — AUTO-FIXED: - C1: scripts/run_platform.sh contract path resolution broken in deploy workflow. The reusable workflow invokes run_platform.sh from the consumer workspace root with a relative contract path (.acdl/contract.yaml), but run_platform.sh does `cd "$ROOT"` (platform repo) early, so the relative path resolved against the platform repo and the pipeline could never run. Fix (commit 75c2274): capture CALLER_CWD before cd "$ROOT"; resolve caller-supplied relative paths against CALLER_CWD; default no-arg contract stays relative to ROOT (preserves platform-local CI). Reproduced pre-fix; verified post-fix. P1 (important) — FLAGGED FOR POST-HOC REVIEW (do not block ship): - C2: ref: v1.4 in the deploy workflow platform checkout — no v1.4 tag exists (only v1.4.0 / v1.4.1). Operator must create a floating v1.4 tag or change the ref to v1.4.1. - C3: modules/l2/{static-asset,microservice}/README.md still use @v1 in their Usage examples; missed by the v1.4 bump. - S1: static-key override is not wired. ACDL_AWS_* env vars on the OIDC step are not read by aws-actions/configure-aws-credentials@v4 (it reads AWS_* or its own access-key/secret-key inputs). The README/CONSUMER_GUIDE claim a working override that doesn't function as written. Needs a conditional step or renamed env vars + input wiring. - S2: README overstates ABAC repo:org/repo:ref:... scoping. The workflow constructs a numeric role name (github.repository_id); the actual claim enforcement lives in the IAM trust policy, not in this workflow. - T1: no deploy-workflow triggers conformance test (CI workflow has one; deploy doesn't). Minor — reusable workflows use workflow_call, not push triggers, but the contract's triggers field is then unenforced. - A1: terraform/spike/terraform.tf uploaded as artifact leaks the AWS account ID via the state-backend bucket name. Recommend excluding terraform.tf or gating artifact upload to non-public repos. P2 (nits) — listed for awareness: floating-tag terminology imprecision (M1), header comment "Gitea Actions" in the GitHub copy (M2, intentional byte- identical), pip install split (P1-perf), comment drift in pipelines/deploy.yaml header (C4), module README internal inconsistency (C5). Verdict: READY TO SHIP. The one P0 is fixed. The 6 P1s are post-hoc items — the deploy workflow is a scaffold whose first real consumer run requires operator setup (tag, IAM role, secrets) that gates go-live. The P1s should be addressed before any consumer invokes uses: acdl/.gitea/workflows/ deploy.yml@v1.4 in earnest. Tests: 154 pass (19 new). run_ci.sh green.	2026-07-22 17:24:28 +00:00
Jon Chery	2a84c0047b	feat(P20): consumer happy path + reusable deploy workflow (v1.5.0) ... ---ci--- project: acdl phase: 20 milestone: v1.5 status: verify ---/ci--- REQ-46: README rewritten — platform-source vs consumer-repo distinction up front; platform flow converted to mermaid flowchart TD; L3A/L3B + spike nomenclature scrubbed from prose (code paths kept verbatim); prereqs pointer to consumer guide added. REQ-47: docs/CONSUMER_GUIDE.md (generic, all L2 modules) replaces docs/consumer-guide-static-asset.md — mermaid diagrams (model LR + pipeline TD), versioned uses: (@v1.4 floating MAJOR+MINOR, bare/@main discouraged), consumer-scoped prerequisites (no Terraform/Checkov/boto3/runner-key), run- time platform fetch via reusable workflow (consumers never invoke scripts/run_platform.sh locally for the happy path), optional local validation note. REQ-48: Credentials section rewritten — zero-trust OIDC + ABAC default (repo-identity + resource-tag scoping, blast-radius containment); static-key override in GitHub Secrets or .env.secrets with platform-managed daily rotation; consumer rotates out of band when using .env.secrets locally. REQ-49: byte-identical .gitea/workflows/deploy.yml + .github/workflows/ deploy.yml — reusable (on: workflow_call), checks out consumer repo + ACDL platform repo, installs deps, runs run_platform.sh, uploads artifacts; OIDC default (permissions: id-token: write) + static-key override via secrets. REQ-50: contracts/static-asset.yaml uses: @v1.4 (MAJOR+MINOR). REQ-51: tests/test_pipeline_contract.py extended — TestDeployPipelineSchema, TestDeployPipelineContract, TestDeployWorkflowConformance (byte-identical, reusable, contract/mode inputs, run_platform invocation, platform-repo checkout, OIDC permissions), TestSampleContractVersioning. 154 tests pass (19 new); run_ci.sh green. Fixes: modules/l2/static-asset/README.md dangling link retargeted to docs/CONSUMER_GUIDE.md.	2026-07-22 17:14:12 +00:00
Jon Chery	895a2f3806	docs(P20): specify phase 20 — consumer happy path + reusable deploy workflow (v1.5) ... ---ci--- project: acdl phase: 20 milestone: v1.5 status: specify ---/ci--- Add v1.5 milestone to ROADMAP.md + REQUIREMENTS.md. Phase 20 covers REQ-46 (README consumer model + mermaid + L3B/spike scrub), REQ-47 (generic CONSUMER_GUIDE.md + versioned uses: + consumer-scoped prereqs + run-time platform fetch), REQ-48 (zero-trust OIDC/ABAC credentials + static-key override + daily rotation), REQ-49 (reusable byte-identical deploy.yml Gitea+GitHub implementing pipelines/deploy.yaml), REQ-50 (contracts/static-asset.yaml @v1.4), REQ-51 (deploy-workflow conformance tests). Update config.json milestone to v1.5.	2026-07-22 17:09:23 +00:00
Jon Chery	e044a2de0d	phase: 6, status: plan-as-execute, persona: lead-developer, task: T-6.1..T-6.4 ... ---ci--- project: acdl phase: 6 milestone: v1.1 status: plan-as-execute persona: lead-developer tasks: [T-6.1, T-6.2, T-6.3, T-6.4] ---/ci--- Archive the v1.0 demo under demo/ (D-037) and reorient the repo to the real platform. Wave 1 of the Phase 06 plan. - T-6.1: git mv modules/, scripts/, evidence-ui/, contracts/, contracts-repo/, .gitea/ -> demo/; mv ACDL_DEMO.md + runner-data/ -> demo/ - T-6.2: scaffold new v1.1 top-level dirs (platform/, schemas/, adapters/, terraform/, modules-ir/) with .gitkeep - T-6.3: create top-level scripts/verify_phase06.sh (v1.1 verify scripts live at top-level, NOT demo/scripts/ which holds the v1.0 demo verify scripts) - T-6.4: rewrite README.md to reflect the real platform (vision + architecture links, new layout, status v1.1 active); add runner-data/ to .gitignore All moves via git mv (history preserved). Repo root now contains only README.md, demo/, docs/, .ciagent/, and the new empty v1.1 dirs.	2026-07-21 18:27:21 +00:00
grimacing	3ea36ef3ab	ship: phase-03 l2-modules-and-core-scripts (v1.0.3) ... Squash merge of phase/03-l2-modules-and-core-scripts; 4 L2s + 5 core scripts; verify_phase03.sh green.	2026-07-21 13:32:21 +00:00
grimacing	00d0043866	ship: phase-02 l1-modules (v1.0.2) ... Squash merge of phase/02-l1-modules into milestone/v1.0-initial; 8 L1 stub modules created; verify_phase02.sh green.	2026-07-21 13:18:12 +00:00
Jon Chery	b953fd4a8e	docs(P01): complete repo-scaffolding phase ... ---ci--- phase: 1 milestone: v1.0 status: complete requirements: covered: [REQ-01, REQ-09] partial: [REQ-10, REQ-12] ---/ci--- Squash merge of phase/01-repo-scaffolding into milestone/v1.0-initial. Phase 01 ships the three-repo scaffold (acdl, acdl-contracts, acdl-evidence), the placeholder index.html on acdl-evidence (D-012/D-016 raw-URL substitute for unsupported Gitea Pages), the qa + prod branches on acdl-contracts (D-013 stand-in for unsupported Gitea environments), the workflow skeletons (pipeline.yml + issue-to-contract.yml), and the idempotent setup + verify scripts. REQ-10/12 remain partial pending Phase 04 full implementation.	2026-07-21 13:10:50 +00:00