v1.3.1 431341a0ab

Compare
ACDL v1.3.1 — remove thin-composition + module READMEs Stable

grimacing released this 2026-07-22 13:59:07 +00:00 | 540 commits to main since this release
Phase 17 — remove-thin-composition-and-module-readmes

What changed
- Removed the L2 thin-composition layer completely (composition.json, contract_resolver.py, contract schema, sample contracts)
- Patched run_platform.sh to load a pre-existing IR instance instead of resolving a contract
- Created README-TEMPLATE.md for L1/L2 modules (plain language, no jargon)
- Rewrote all 7 L1 module READMEs with Resources/Inputs/Outputs/Usage/Compliance-extension-points/Versioning
- Wrote 2 L2 placeholder READMEs (composition under redesign)
- Created modules-ir/README.md catalog index
- Pruned L2 entries from registry.json
Requirements
- REQ-36: Thin-composition layer removed (complete)
- REQ-37: README template created (complete)
- REQ-38: Per-module READMEs + catalog (complete)
Verification
- VERIFY PASS (structural + behavioral + security + quality)
- AUDIT CLEAN
- P1 deferred: AWS account ID in l1-ecs-service README usage example
Stats
- 19 files changed, +611 / -813
- 6 files deleted, 2 new files, 11 modified
Downloads
- Source Code (ZIP)
- Source Code (TAR.GZ)
v1.2.0 d6b192307a

Compare
ACDL v1.2.0 - architecture finalization + v1 spike Stable

cloudinit-bot released this 2026-07-21 19:45:50 +00:00 | 570 commits to main since this release
ACDL v1.2.0 — architecture finalization + v1 spike

The v1.1 milestone: finalize the architecture to v1.0 (resolve all 11 open design decisions in docs/architecture.md §13) and prove the locked commitments with one end-to-end v1 implementation spike against real AWS.

The v1.0 stub-driven executive demo (tag v1.1.0) is preserved under demo/ as the intent reference; it is not the platform. v1.1 replaces the stubs with the real platform substrate.

What the spike proved (REQ-28 — the binding claim)

The end-to-end pipeline runs against real AWS:

contracts/spike.yaml → contract→IR resolution → terraform plan (1 to add, 0 to change, 0 to destroy) → Checkov (12 PolicyCheckResult records) → confidence signal (score 0.8, band pass for dev) → evidence event to the DynamoDB outbox.

The adapter is the only substrate-specific code. modules-ir/, schemas/, contracts/, acdl_platform/confidence_signal.py, acdl_platform/contract_resolver.py, acdl_platform/outbox_writer.py are all substrate-agnostic (no aws_s3_bucket / aws_ Terraform terms). The IR commitments hold; no polyglot mess.

Phase summary (5 phases, all shipped + verified)

Phase 06 — archive-demo-and-reorient (v1.1.1)

Archived the v1.0 demo under demo/ (history preserved via git mv); established the new v1.1 repo layout (acdl_platform/, schemas/, adapters/, terraform/, modules-ir/); rewrote README for the real platform. scripts/verify_phase06.sh green — the archived demo still runs end-to-end from demo/.

Phase 07 — architecture-v1-finalization (v1.1.2)

Resolved all 11 open decisions (W1.A/B, W2.A, W3.D/E, BA.A–F, OpenTofu — recorded in PROJECT.md + snapshotted in docs/architecture-v1.0.md). Authored 9 deliverable files: schemas/ir.schema.json (Target Stack IR), schemas/policy_check_result.schema.json + adapters/terraform/policy/checkov_adapter.py (Checkov→PCR), acdl_platform/confidence_signal.py (6-input weighted signal, critical-override), acdl_platform/audit_ledger_design.md (tiered ledger, spike scope D-041), acdl_platform/hitl_matrix_design.md + acdl_platform/separation_of_duties.py (full 8-concern matrix, gitea.actor D-042), schemas/contract.schema.json (per-env mandatory W3.E). scripts/verify_phase07.sh green.

Phase 08 — aws-bootstrap (v1.1.3)

Bootstrapped the AWS substrate using the root key once (waiver D-034): S3 state bucket acdl-tfstate-581513795199-us-east-1 (versioning enabled) + DynamoDB outbox table acdl-outbox (PAY_PER_REQUEST, PK contractId, SK eventType#eventTs) + IAM user acdl-spike-runner with a least-privilege scoped policy (DenyEverythingElse). Real OIDC deferred to v1.2 (D-039, blocked on go-gitea/gitea#36988 — Gitea Actions does not support id-token: write); the spike uses a per-run-rotated key. scripts/verify_phase08.sh green — caller identity is acdl-spike-runner (not root).

Phase 09 — v1-spike-ir-and-l1-and-adapter (v1.1.4)

Materialized the Target Stack IR + one real L1 l1-s3 (IR-typed interface + spike_instance.json IR-schema-valid + registry entry) + the Terraform adapter (adapters/terraform/adapter.py, IR→root module, TYPE_MAP {aws:s3:bucket → aws_s3_bucket}). Real terraform plan against AWS succeeded: "Plan: 1 to add". scripts/verify_phase09.sh green.

Phase 10 — v1-spike-l2-and-contract-e2e (v1.1.5, capstone)

Implemented l2-static-asset (thin-composition referencing l1-s3, depth 1), the contract→IR resolution (acdl_platform/contract_resolver.py), and one end-to-end contract submission flowing through schema validation → IR resolution → terraform plan → Checkov → confidence signal → evidence event to the DynamoDB outbox. scripts/verify_phase10.sh green — REQ-28 verified: the adapter is the only substrate-specific code.

Requirements covered (13)

REQ-16 architecture finalized · REQ-17 IR JSON Schema · REQ-18 PolicyCheckResult schema + Checkov adapter · REQ-19 6-input confidence signal · REQ-20 tiered audit ledger design · REQ-21 HITL matrix + SoD · REQ-22 contract schema · REQ-23 AWS bootstrap + state backend · REQ-24 l1-s3 IR-typed interface · REQ-25 l2-static-asset thin-composition · REQ-26 Terraform adapter · REQ-27 end-to-end contract submission · REQ-28 IR commitments hold.

COMPLETE gate
- Review: READY TO SHIP (0 P0, 1 P1 carried-forward non-blocking)
- Ship: v1.2.0 (feature milestone → next minor per ship.md)
- Audit: CLEAN (0 P0; 3 audit-hygiene P1s fixed in-place — config.json status, PERSONAS.md paths, ROADMAP.md audit-pending → CLEAN; 2 remaining P1s deferred to v1.2 cleanup)
What's next (v1.2, not this milestone)
- Real OIDC federation (blocked on go-gitea/gitea#36988)
- S3 Object Lock + JWS + async worker + DLQ + daily checkpoints (the v1.2 audit ledger build-out)
- Full HITL matrix wiring (qa/prod/dr gates)
- 5-skill L3B catalog + real agent
- Kyverno + OPA + custom Checkov YAML rule for tag/naming
- terraform apply (HITL-gated)
- Multi-region state
Manual actions
- Rotate the root AWS key (D-034 closure) — the bootstrap root key served its one-shot purpose in Phase 08; deactivate/delete it in the AWS IAM console.
- The spike key (acdl-spike-runner) is per-run-rotated by scripts/rotate_spike_key.sh (D-039); delete the spike user + key in v1.2 cleanup when real OIDC lands.
Downloads
- Source Code (ZIP)
- Source Code (TAR.GZ)

v1.1.0 58adf9e231

v1.1.0: ACDL milestone v1.0 complete Stable

grimacing released this 2026-07-21 13:56:39 +00:00 | 618 commits to main since this release

v1.1.0 — ACDL milestone v1.0 complete

Summary

All 5 phases of the ACDL milestone v1.0 are complete. The 30-minute executive demo of the Agentic Cloud Delivery Platform is live, proving automatic, safe, and audited infrastructure delivery via local stubs on Gitea Actions (no cloud, no AI APIs).

Phases

Phase	Version	Requirements
01 repo-scaffolding	v1.0.1	REQ-01, REQ-09
02 l1-modules	v1.0.2	REQ-02, REQ-03
03 l2-modules-and-core-scripts	v1.0.3	REQ-04, REQ-05, REQ-06, REQ-07, REQ-08, REQ-11
04 pipeline-and-approval-gates	v1.0.4	REQ-10, REQ-12
05 evidence-ui-and-demo-dry-run	v1.0.5	REQ-13, REQ-14, REQ-15

Requirements coverage (15/15 complete)

REQ-01: All code under continuous-intelligence Gitea org
REQ-02: 8 L1 module folders
REQ-03: Each L1 has manifest.yaml + uniform mock_apply.sh
REQ-04: 4 L2 modules
REQ-05: L2s compose L1s, max depth 5
REQ-06: mock_executor.sh reads L2 + writes state.json
REQ-07: policy_checker.py fails on public-ingress:true
REQ-08: confidence_signal.py 0.90/0.40, gate ≥ 0.50
REQ-09: 3 repos (acdl, acdl-contracts, acdl-evidence)
REQ-10: pipeline Dev→QA→Prod→Finalize with approval gates
REQ-11: evidence_writer.py SHA-256 hash chain
REQ-12: Issue-triggered L3B agent
REQ-13: acdl-evidence serves audit.json + index.html (raw URL substitute for Gitea's missing Pages)
REQ-14: index.html vanilla-JS timeline
REQ-15: All 4 demo acts reproduce deterministically

Live demo

Key decisions (33 total, D-001 to D-033)

Notable: D-012 (Gitea has no Pages → raw URLs), D-013 (no environments API → workflow_dispatch approval inputs), D-014 (no repository_dispatch → workflow_dispatch API), D-027/D-028 (3-dispatch pipeline topology with evidence persisted between dispatches), D-031 (Phase 05 dry-run = local bash simulation).

Verification

4 layers passed per phase (65 total checks across 5 verify_phaseNN.sh scripts). 2 P0s found and fixed inline during Phase 04 verify (P0-001 URLError, P0-002 shell injection). 1 P1 deferred to audit (P1-001 token in .git/config remote URL — non-blocking for the demo).

Migration notes

The acdl repo default branch is now main (was milestone/v1.0-initial). Reusable-workflow uses: references that previously pinned to @milestone/v1.0-initial should be updated to @main or pinned to @v1.1.0 for stability.
GITEA_TOKEN secret must be created on the acdl and acdl-contracts repos via the Gitea UI for the real pipeline to run (Phase 04). The dry-run (Phase 05 scripts/run_demo.sh) works without a runner.

Downloads

v1.0.5 0672edfc3f

Compare
v1.0.5: phase-05 evidence-ui-and-demo-dry-run (milestone capstone) Stable

grimacing released this 2026-07-21 13:53:55 +00:00 | 619 commits to main since this release
Phase 05 — evidence-ui-and-demo-dry-run (v1.0.5, milestone capstone)

Summary

Builds the vanilla-JS evidence timeline UI and runs the 4 demo acts end-to-end as a local dry run.

Requirements
- Covered: REQ-13 (raw URL 200 on audit.json + index.html), REQ-14 (vanilla-JS timeline UI), REQ-15 (4 acts reproduce deterministically)
Artifacts
- evidence-ui/index.html — single self-contained HTML file (inline CSS+JS, no external resources). Fetches ./audit.json and renders a vertical timeline with stage color-coding + 12-char hash preview + refresh button.
- scripts/run_demo.sh — simulates the 4 acts locally: Act 1 Friction (1 event), Act 2 Developer Self-Service (4 events, l2-commodity-price-feed, full pipeline), Act 3 Citizen Developer (4 events, l3b_agent_stub generates the contract from an Issue body, identical pipeline), Act 4 Safety Net (1 event, public-ingress:true → dev rejects with score 0.40 < 0.50). 11 events total with a valid SHA-256 hash chain. Uploads audit.json + index.html to acdl-evidence main (skippable with --no-upload).
- scripts/verify_phase05.sh — 13/13 checks pass (UI structure, dry-run, hash chain, real upload, raw URL 200 on both files).
Live demo
- UI: https://git.cloudinit.dev/continuous-intelligence/acdl-evidence/raw/branch/main/index.html
- Audit JSON: https://git.cloudinit.dev/continuous-intelligence/acdl-evidence/raw/branch/main/audit.json
Verification

4 layers passed, 0 P0, 0 P1.

Milestone status

This is the milestone capstone phase. All 5 phases of milestone v1.0 are now complete. The COMPLETE gate will tag v1.1.0 (next minor per the feature-milestone rule) after the milestone review + audit pass.
Downloads
- Source Code (ZIP)
- Source Code (TAR.GZ)
v1.0.4 72b359c9a9

Compare
v1.0.4: phase-04 pipeline-and-approval-gates Stable

grimacing released this 2026-07-21 13:42:25 +00:00 | 621 commits to main since this release
Phase 04 — pipeline-and-approval-gates (v1.0.4)

Summary

Replaces the workflow skeletons with real implementations: the 3-dispatch approval-gate pipeline and the issue-to-contract L3B trigger.

Requirements
- Covered: REQ-10 (reusable pipeline Dev → QA → Prod → Finalize), REQ-12 (issue-triggered L3B)
Artifacts
- .gitea/workflows/pipeline.yml — 3-dispatch topology: dev (initial), qa-gate (approve_qa=true), prod-gate (approve_prod=true), finalize (needs: prod-gate). Evidence persisted to acdl-evidence between dispatches.
- contracts-repo/.gitea/workflows/issue-to-contract.yml — on: issues [opened] → checkout acdl → run l3b_agent_stub.py → commit contract.yaml to contract/<n> branch → comment + close Issue → dispatch pipeline via API.
- scripts/finalize_evidence.py — GET→sha + PUT/POST upload of audit.json to acdl-evidence, with clean URLError handling.
- scripts/verify_phase04.sh — 12/12 structural + syntax + clean-failure checks pass.
Verification

4 layers passed. 1 P0 fixed inline during verify:
- P0-002 (shell injection in gitea.event.issue.body interpolation) — fixed by passing via env: ISSUE_BODY.
Known limitations
- Full end-to-end pipeline run requires an act_runner registered to the acdl repo (out-of-band Gitea UI step). verify_phase04 validates structure + syntax + clean failure modes; the full Act 2/3/4 dry run is Phase 05.
- GITEA_TOKEN secret must be created on the acdl and acdl-contracts repos via the Gitea UI for cross-repo checkout + dispatch + commit to acdl-evidence.
Downloads
- Source Code (ZIP)
- Source Code (TAR.GZ)
v1.0.3 3ea36ef3ab

Compare
v1.0.3: phase-03 l2-modules-and-core-scripts Stable

grimacing released this 2026-07-21 13:32:29 +00:00 | 623 commits to main since this release
Phase 03 — l2-modules-and-core-scripts (v1.0.3)

Summary

Creates the 4 L2 composition modules and the 5 core scripts.

Requirements
- Covered: REQ-04 (4 L2 modules), REQ-05 (max depth 5), REQ-06 (mock_executor), REQ-07 (policy_checker), REQ-08 (confidence_signal), REQ-11 (evidence_writer hash chain)
- Partial: REQ-12 (l3b_agent_stub created; full issue-trigger wiring in Phase 04)
Artifacts
- 4 L2 manifests: l2-invoice-service, l2-commodity-price-feed, l2-energy-analytics-api, l2-regulatory-reporting (each references 5 L1s by name)
- scripts/policy_checker.py — POLICY_PASS / POLICY_VIOLATION:PUBLIC_INGRESS (D-025)
- scripts/confidence_signal.py — {score: 0.90|0.40, reason} JSON (D-024)
- scripts/evidence_writer.py — canonical-JSON SHA-256 hash chain (D-023/D-005)
- scripts/mock_executor.sh — invokes L1s, writes state.json (D-022)
- scripts/l3b_agent_stub.py — D-008 keyword map → contract.yaml (D-026)
- scripts/verify_phase03.sh — 18/18 checks pass
Verification

4 layers passed, 0 P1 findings.
Downloads
- Source Code (ZIP)
- Source Code (TAR.GZ)
v1.0.2 00d0043866

Compare
v1.0.2: phase-02 l1-modules Stable

grimacing released this 2026-07-21 13:18:20 +00:00 | 625 commits to main since this release
Phase 02 — l1-modules (v1.0.2)

Summary

Creates the 8 L1 stub modules under modules/l1/.

Requirements
- Covered: REQ-02 (8 L1 module folders with exact names), REQ-03 (each L1 has manifest.yaml + uniform mock_apply.sh)
Artifacts
- 8 L1 modules: l1-eks-fargate, l1-iam-role, l1-lambda, l1-api-gateway, l1-eventbridge, l1-sqs, l1-s3, l1-cloudwatch
- Each module: manifest.yaml (flat string inputs map per D-017) + mock_apply.sh (uniform echo + 1s sleep + exit 0 per D-007/D-018)
- scripts/verify_phase02.sh — confirms all 8 L1s structurally + behaviorally
Verification

4 layers passed, 0 P1 findings.
Downloads
- Source Code (ZIP)
- Source Code (TAR.GZ)
v1.0.1 b953fd4a8e

Compare
v1.0.1: phase-01 repo-scaffolding Stable

grimacing released this 2026-07-21 13:11:00 +00:00 | 628 commits to main since this release
Phase 01 — repo-scaffolding (v1.0.1)

Summary

Ships the three-repo ACDL scaffold under the continuous-intelligence Gitea org.

Requirements
- Covered: REQ-01 (all code under continuous-intelligence org), REQ-09 (three repos: acdl, acdl-contracts, acdl-evidence)
- Partial: REQ-10 (pipeline + approval gates skeleton; full impl in Phase 04), REQ-12 (issue-to-contract skeleton; full impl in Phase 04)
Artifacts
- scripts/gitea_setup.sh — idempotent: creates acdl-contracts + acdl-evidence, pushes placeholder index.html to acdl-evidence main, creates qa + prod branches on acdl-contracts, makes acdl-evidence public.
- scripts/verify_phase01.sh — confirms all 4 Phase 01 success criteria via the Gitea API + raw-URL check.
- .gitea/workflows/pipeline.yml — reusable pipeline skeleton (Dev → QA-gate → Prod-gate → Finalize).
- contracts-repo/.gitea/workflows/issue-to-contract.yml — issue-trigger skeleton (reference copy; pushed to acdl-contracts in Phase 04).
- README.md + .gitignore + directory layout (scripts/, modules/l1/, modules/l2/, .gitea/workflows/, contracts-repo/.gitea/workflows/).
Key decisions (Phase 01)
- D-012: Gitea has no Pages → serve acdl-evidence via raw file URLs
- D-013: Gitea has no environments API → qa/prod gates via workflow_dispatch approval inputs (Phase 04)
- D-015: new repos use default_branch=main + auto_init=true
- D-016: Phase 01 placeholder index.html is a minimal HTML stub
Verification

4 layers passed (1 P1 deferred to audit: token in .git/config remote URL — non-blocking for this phase).

Known issues
- P1-001: Gitea API token embedded in .git/config remote URL. Deferred to the COMPLETE audit gate.
Downloads
- Source Code (ZIP)
- Source Code (TAR.GZ)

... 9 10 11 12 13

128 Releases 190 Tags

ACDL v1.3.1 — remove thin-composition + module READMEs Stable

Phase 17 — remove-thin-composition-and-module-readmes

What changed

Requirements

Verification

Stats

ACDL v1.2.0 - architecture finalization + v1 spike Stable

ACDL v1.2.0 — architecture finalization + v1 spike

What the spike proved (REQ-28 — the binding claim)

Phase summary (5 phases, all shipped + verified)

Phase 06 — archive-demo-and-reorient (v1.1.1)

Phase 07 — architecture-v1-finalization (v1.1.2)

Phase 08 — aws-bootstrap (v1.1.3)

Phase 09 — v1-spike-ir-and-l1-and-adapter (v1.1.4)

Phase 10 — v1-spike-l2-and-contract-e2e (v1.1.5, capstone)

Requirements covered (13)

COMPLETE gate

What's next (v1.2, not this milestone)

Manual actions

v1.1.0: ACDL milestone v1.0 complete Stable

v1.1.0 — ACDL milestone v1.0 complete

Summary

Phases

Requirements coverage (15/15 complete)

Live demo

Key decisions (33 total, D-001 to D-033)

Verification

Migration notes

v1.0.5: phase-05 evidence-ui-and-demo-dry-run (milestone capstone) Stable

Phase 05 — evidence-ui-and-demo-dry-run (v1.0.5, milestone capstone)

Summary

Requirements

Artifacts

Live demo

Verification

Milestone status

v1.0.4: phase-04 pipeline-and-approval-gates Stable

Phase 04 — pipeline-and-approval-gates (v1.0.4)

Summary

Requirements

Artifacts

Verification

Known limitations

v1.0.3: phase-03 l2-modules-and-core-scripts Stable

Phase 03 — l2-modules-and-core-scripts (v1.0.3)

Summary

Requirements

Artifacts

Verification

v1.0.2: phase-02 l1-modules Stable

Phase 02 — l1-modules (v1.0.2)

Summary

Requirements

Artifacts

Verification

v1.0.1: phase-01 repo-scaffolding Stable

Phase 01 — repo-scaffolding (v1.0.1)

Summary

Requirements

Artifacts

Key decisions (Phase 01)

Verification

Known issues