continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity

ship: phase-05 evidence-ui-and-demo-dry-run #5

Merged
grimacing merged 7 commits from phase/05-evidence-ui-and-demo-dry-run into milestone/v1.0-initial 2026-07-21 13:53:54 +00:00
Conversation 0 Commits 7 Files Changed 9
+910 -62
grimacing commented 2026-07-21 13:53:53 +00:00
Owner
Copy Link
Copy Source

Phase 05 ship (milestone capstone)

Builds the vanilla-JS evidence timeline UI and runs the 4 demo acts end-to-end as a local dry run.

Artifacts:

  • evidence-ui/index.html — single self-contained HTML file (inline CSS+JS, no external resources). Fetches ./audit.json and renders a vertical timeline with stage color-coding + 12-char hash preview + refresh button.
  • scripts/run_demo.sh — simulates the 4 acts locally (no act_runner): Act 1 Friction, Act 2 Developer Self-Service, Act 3 Citizen Developer, Act 4 Safety Net. Writes 11 evidence events with a valid SHA-256 hash chain. Uploads audit.json + index.html to acdl-evidence main via finalize_evidence.py (skippable with --no-upload).
  • scripts/verify_phase05.sh — 13/13 checks pass (UI structure, dry-run, hash chain, real upload, raw URL 200 on both files).

Requirements covered: REQ-13, REQ-14, REQ-15
Verification: 4 layers passed, 0 P0, 0 P1.

Live demo: https://git.cloudinit.dev/continuous-intelligence/acdl-evidence/raw/branch/main/index.html

Version target: v1.0.5 (feature milestone, phase 5 patch). After this ship, the milestone v1.0 is complete; the COMPLETE gate will tag v1.1.0 (next minor per feature-milestone rule).

## Phase 05 ship (milestone capstone) Builds the vanilla-JS evidence timeline UI and runs the 4 demo acts end-to-end as a local dry run. **Artifacts:** - `evidence-ui/index.html` — single self-contained HTML file (inline CSS+JS, no external resources). Fetches `./audit.json` and renders a vertical timeline with stage color-coding + 12-char hash preview + refresh button. - `scripts/run_demo.sh` — simulates the 4 acts locally (no act_runner): Act 1 Friction, Act 2 Developer Self-Service, Act 3 Citizen Developer, Act 4 Safety Net. Writes 11 evidence events with a valid SHA-256 hash chain. Uploads `audit.json` + `index.html` to `acdl-evidence` main via `finalize_evidence.py` (skippable with `--no-upload`). - `scripts/verify_phase05.sh` — 13/13 checks pass (UI structure, dry-run, hash chain, real upload, raw URL 200 on both files). **Requirements covered:** REQ-13, REQ-14, REQ-15 **Verification:** 4 layers passed, 0 P0, 0 P1. **Live demo:** https://git.cloudinit.dev/continuous-intelligence/acdl-evidence/raw/branch/main/index.html **Version target:** v1.0.5 (feature milestone, phase 5 patch). After this ship, the milestone v1.0 is complete; the COMPLETE gate will tag v1.1.0 (next minor per feature-milestone rule).
grimacing added 7 commits 2026-07-21 13:53:53 +00:00
decision(P05): clarification — dry-run = local bash sim, index.html vanilla JS 3c93851224 
---ci---
phase: 5
milestone: v1.0
status: clarify
decisions:
  - id: D-031
    decision: Phase 05 'dry run' = local bash script (scripts/run_demo.sh) simulating the full pipeline by calling core scripts + writing evidence + uploading audit.json to acdl-evidence. No act_runner (none registered). Exercises all 4 acts.
    rationale: spec says '4 scripted acts reproduce deterministically'; without a runner, the bash simulation IS the deterministic reproduction
    confidence: 0.85
    alternatives: [register an act_runner (out-of-band Gitea UI; not available in this env), skip the dry run and only build the UI]
  - id: D-032
    decision: index.html committed to acdl repo at evidence-ui/index.html; pushed to acdl-evidence main by run_demo.sh alongside audit.json. Single file, inline CSS+JS, vanilla JS per REQ-14. Fetches ./audit.json (relative).
    rationale: D-012 raw-URL approach; vanilla JS per REQ-14; single file for simplicity; relative URL avoids hardcoding host
    confidence: 0.90
    alternatives: [separate JS/CSS files, hardcoded absolute URL]
  - id: D-033
    decision: audit.json raw URL on acdl-evidence main is the single source of truth. run_demo.sh writes final audit.json + final index.html in two API calls. Idempotent. UI fetch URL is relative ./audit.json.
    rationale: D-012 + D-029; relative URL avoids hardcoding
    confidence: 0.90
    alternatives: [per-act audit files, absolute URL]
---/ci---

Phase 05 main ambiguity: no act_runner available, so 'dry run' cannot
mean a real Gitea Actions run. Three decisions logged: D-031 dry-run =
local bash simulation covering all 4 acts; D-032 index.html is single-file
vanilla JS at evidence-ui/, pushed to acdl-evidence alongside audit.json;
D-033 audit.json is the single source of truth, idempotent re-run, UI
fetches ./audit.json relatively.
docs(P05): research findings — UI reactivation + dry-run simulation design d95c4015e3 
---ci---
phase: 5
milestone: v1.0
status: research
research:
  personas: frontend-engineer REACTIVATED for Phase 05 (territory evidence-ui/**)
  dry_run_design:
    approach: scripts/run_demo.sh local bash simulation (no act_runner)
    acts: 4 (Friction, Dev Self-Service, Citizen Developer, Safety Net)
    audit_events: ~14 (genesis + 1 + 4 + 4 + 1 + finalize markers)
    output: audit.json + index.html pushed to acdl-evidence via file-contents API
  ui_contract:
    file: evidence-ui/index.html (single file, inline CSS+JS, no frameworks)
    fetch: ./audit.json (relative URL)
    render: vertical timeline, stage color-coded, 12-char hash preview
---/ci---

PERSONAS.md: frontend-engineer -> Active: true (REACTIVATED for Phase 05),
territory evidence-ui/**. ARCHITECTURE.md gains 'Phase 05 dry-run + UI
(research)' section: the bash simulation design, the 4-act breakdown,
the audit.json shape, and the UI rendering contract.
docs(P05): create 3-wave phase plan (REQ-13/14/15) 0a1ed28c50 
---ci---
phase: 5
milestone: v1.0
status: plan
plan:
  waves: 3
  wave_1_frontend: [T-5.1 evidence-ui/index.html]
  wave_2_backend: [T-5.2 scripts/run_demo.sh 4-act simulation]
  wave_3_coordination: [T-5.3 verify_phase05.sh, T-5.4 traceability]
  requirements_covered: [REQ-13, REQ-14, REQ-15]
  must_haves: 6
  verification:
    typecheck: bash -n + py_compile
    test: scripts/verify_phase05.sh (with + without Gitea token)
---/ci---

PLAN.md replaced with Phase 05 plan. Wave 1 (frontend-engineer
REACTIVATED) builds evidence-ui/index.html. Wave 2 (backend-engineer)
builds scripts/run_demo.sh (4-act local simulation + upload). Wave 3
(lead-developer) verifies + traceability. Phase 05 is the milestone
capstone; COMPLETE gate follows.
feat(P05): evidence-ui/index.html vanilla-JS timeline (T-5.1) 77376d8a46 
---ci---
phase: 5
milestone: v1.0
status: execute
persona: frontend-engineer
task: T-5.1
requirements:
  covered: [REQ-14]
---/ci---

Wave 1, task T-5.1. Single self-contained HTML file (inline <style> +
<script>, no external resources). Fetches ./audit.json (relative URL),
renders a vertical timeline with stage color-coding (dev=blue, qa=yellow,
prod=orange, finalize=green, genesis=gray, rejected=red), 12-char hash
preview, refresh button, and fetch-failure handling.
feat(P05): run_demo.sh 4-act dry-run + upload (T-5.2) 3ab7574b8d 
---ci---
phase: 5
milestone: v1.0
status: execute
persona: backend-engineer
task: T-5.2
requirements:
  covered: [REQ-13, REQ-15]
---/ci---

Wave 2, task T-5.2. scripts/run_demo.sh simulates the 4 demo acts locally
(no act_runner): Act 1 Friction (1 event), Act 2 Developer Self-Service
(valid contract, full pipeline, 4 events), Act 3 Citizen Developer
(l3b_agent_stub generates the contract, same pipeline, 4 events), Act 4
Safety Net (public-ingress:true, dev rejects with score 0.40 < 0.50, 1
event). Uploads audit.json + evidence-ui/index.html to acdl-evidence main
via finalize_evidence.py (skippable with --no-upload). Idempotent.
feat(P05): Phase 05 verification + traceability (T-5.3, T-5.4) 41e5aaef59 
---ci---
phase: 5
milestone: v1.0
status: execute
persona: lead-developer
task: T-5.3
requirements:
  covered: [REQ-13, REQ-14, REQ-15]
---/ci---

Wave 3, task T-5.3 + T-5.4. scripts/verify_phase05.sh checks: (1)
evidence-ui/index.html structure (inline CSS/JS, fetch ./audit.json,
no external refs, refresh button, 8134 bytes); (2) run_demo.sh syntax
+ --no-upload flag; (3) run_demo.sh --no-upload (4 acts, exit 0,
audit.json written); (4) audit.json content (11 events + Act 1/2/3/4 +
Act 4 POLICY_VIOLATION rejection); (5) hash chain integrity; (6) no
stray state.json/contracts in repo root; (7) REAL upload + raw URL
fetch (audit.json 200 with 11 events, index.html 200 with ACDL Evidence
markers). All 13 checks PASS.

The demo is live at:
  https://git.cloudinit.dev/continuous-intelligence/acdl-evidence/raw/branch/main/index.html

Traceability: REQ-13/14/15 -> covered (pending VERIFY). ROADMAP Phase 05
-> executing.
verify(P05): passed (4 layers, 0 P0, 0 P1) 24cd81b6aa 
---ci---
phase: 5
milestone: v1.0
status: verify
requirements:
  covered: [REQ-13, REQ-14, REQ-15]
  partial: []
lessons:
  - Phase 05 dry-run = local bash simulation (scripts/run_demo.sh) because
    no act_runner is registered. The simulation produces the same audit.json
    shape a real pipeline run would, so the UI renders identically. A real
    end-to-end run requires registering an act_runner (out-of-band Gitea UI).
  - mock_executor.sh resolves modules/l2/<stack>/ relative to its cwd. The
    dry-run script must cd to the repo root (or pass an absolute modules path)
    before invoking it. Documented in ARCHITECTURE.md and verified by the
    'no stray state.json in repo root' check.
  - finalize_evidence.py --path flag lets the same helper upload both
    audit.json (default --path=audit.json) and index.html (--path index.html)
    to acdl-evidence. The --audit flag is the LOCAL file path; --path is the
    REMOTE path. Confusing naming, kept for backward compatibility with Phase 04.
  - innerHTML on escaped event data is XSS-safe because esc() escapes
    & < > " — sufficient for body + attribute context. A static-analysis
    'innerHTML' warning is a false positive when the input is escaped.
review:
  p0: 0
  p1: 0
---/ci---

Layer 1 STRUCTURAL: PASS (3/3 files; bash -n + py_compile + yaml load clean; no TODO/FIXME).
Layer 2 BEHAVIORAL: PASS (verify_phase05.sh 13/13 checks; 4 acts reproduce deterministically; 11 events; Act 4 rejection visible).
Layer 3 SECURITY: PASS (no secrets; UI uses esc() before innerHTML; hash chain is tamper-evident; no external resources).
Layer 4 QUALITY: PASS.

Requirements covered this phase: REQ-13 (raw URL 200 on audit.json + index.html), REQ-14 (vanilla-JS timeline UI), REQ-15 (4 acts reproduce deterministically). No partials.

The demo is live at:
  https://git.cloudinit.dev/continuous-intelligence/acdl-evidence/raw/branch/main/index.html
grimacing merged commit 0672edfc3f into milestone/v1.0-initial 2026-07-21 13:53:54 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
cloudinit-bot coreci-bot grimacing
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: continuous-intelligence/acdl#5
Delete Branch "phase/05-evidence-ui-and-demo-dry-run"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?