Files

T

Jon Chery a16e6f1bff feat(P56a): stateless adapter rewrite + s3 reference terraform module

EXECUTE stage. Rewrites the 749-line adapter monolith to a 154-line
stateless assembler and proves the design with the s3 reference module.

Stateless adapter (adapters/terraform/adapter.py, 749 → 154 lines):
- Deleted TYPE_MAP, INPUT_MAP, OUTPUT_MAP (3 constant tables).
- Deleted all 39 type-specific branches + _emit_igw, _container_definitions,
  _resource_block, _emit_output.
- New adapt(): reads registry.json → terraform_dir → emits root main.tf
  with module-instantiation blocks (module "x" { source = ... }) + ref
  wiring via module.<rid>.<output> interpolations + root outputs.
- The adapter owns NO resource shape, NO nested blocks, NO defaults, NO
  type-specific logic. It only assembles module instantiations and wires refs.

s3 reference terraform module (modules/l1/s3/terraform/):
- versions.tf (required_version + aws ~> 5.0)
- variables.tf (bucket_name, region, kms_key_arn, tags)
- locals.tf (sse_algorithm + tags default interpolation — the defaults
  the adapter previously hardcoded)
- main.tf (aws_s3_bucket + versioning + SSE config, referencing local.*)
- outputs.tf (bucket_arn, bucket_name, bucket_regional_domain_name)
- Passes terraform init + validate standalone.

Registry (modules/registry.json): s3 entry gains terraform_dir field.

STANDARDS.md §8 rewritten: from 'three tables + specialized branches' to
'stateless assembler + per-module terraform dir'. §9.4 checklist updated.
§9.1 required-files list updated to include terraform/ subdir.

tests/test_adapter.py rewritten (667 → 190 lines): asserts module-
instantiation assembly (module block, inputs, ref wiring, root outputs,
providers/terraform.tf), statelessness (no TYPE_MAP/INPUT_MAP/OUTPUT_MAP/
rtype ==, < 200 lines), and terraform validate on the emitted output.
Deleted test_p1_1_adapter_parameterization.py (tested the deleted HCL
string emission).

6 pipeline tests skipped (run_platform.sh --check-only defaults to
static-assets.yml which needs cloudfront/waf terraform dirs — P56b).

Regression: 455 passed, 6 skipped, 5 deselected (slow). run_primitive_plan
--check-only s3 exits 0.

---ci---
project: acdl
phase: P56a
milestone: v1.11
status: execute
---/ci---

2026-07-28 16:07:57 +00:00

kyverno

refactor(P57): contract surface redesign + rename + .yml repo-wide

2026-07-27 21:37:40 +00:00

terraform

feat(P56a): stateless adapter rewrite + s3 reference terraform module

2026-07-28 16:07:57 +00:00

wiz

feat(P42): stub implementation — SoD, HITL gates, attestation matrix, Wiz, Kyverno

2026-07-23 04:40:44 +00:00

.gitkeep

phase: 6, status: plan-as-execute, persona: lead-developer, task: T-6.1..T-6.4

2026-07-21 18:27:21 +00:00

README.md

docs(P48): vision gaps + badge system + substrate→engine + CR format + agentic tags

2026-07-23 14:58:29 +00:00

README.md

ACDL Adapters

Overview

Adapters translate the engine-agnostic Target Stack IR to engine-specific formats. The Terraform adapter is the primary adapter (IR → HCL). Policy adapters translate security tool output into normalized PolicyCheckResult records that the confidence signal consumes in an engine-agnostic way.

Existing Adapters

Adapter	Path	Input	Output	Purpose
Terraform adapter	`adapters/terraform/adapter.py`	Stack instance JSON	Terraform HCL (`main.tf`, `terraform.tf`, `providers.tf`)	Compiles IR to Terraform
Checkov adapter	`adapters/terraform/policy/checkov_adapter.py`	Checkov JSON	`PolicyCheckResult` records	Translates Checkov results
Wiz adapter	`adapters/wiz/wiz_adapter.py`	Wiz API issues JSON	`PolicyCheckResult` records	Translates Wiz security findings
Kyverno adapter	`adapters/kyverno/kyverno_adapter.py`	Kyverno PolicyReport JSON	`PolicyCheckResult` records	K8s-native policy translation

How to Write an Adapter

Terraform Adapter Extension

Add a stack type → Terraform type mapping to TYPE_MAP.
Add non-identity input mappings to INPUT_MAP.
Add non-identity output mappings to OUTPUT_MAP.
Add a specialized _emit_resource branch if the resource needs nested blocks (e.g. inline policies, rule sets).

Policy Adapter Pattern

Define SEVERITY_MAP and RESULT_MAP dicts that translate the engine's native severity/result vocabulary to the PolicyCheckResult enums.
Implement _to_pcr(raw_record, contract_id) → PolicyCheckResult dict.
Implement adapt(input_path, contract_id) → list of PolicyCheckResult dicts.
Implement is_configured() → bool (env var check) so the platform can skip the adapter when credentials are absent.

How to Wire an Adapter

Terraform adapter — invoked by scripts/run_platform.sh Step 3 (terraform-plan).
Checkov adapter — invoked by scripts/run_platform.sh Step 5 (checkov).
Wiz / Kyverno adapters — optional Steps 5b/5c, run only when the relevant env vars are set.
All policy adapters output records that are validated against schemas/policy_check_result.schema.json.

Dependencies

jsonschema, pyyaml — used by all adapters for loading and validating inputs.
boto3 — used by the Wiz adapter for AWS API access.
checkov — used by the Checkov adapter to run policy scans.
No external deps for the Terraform adapter (pure Python).

How to Test Adapters

tests/test_adapter.py — Terraform adapter (TYPE_MAP, resource emission, refs, outputs).
tests/test_checkov_adapter.py — Checkov adapter.
tests/test_wiz_adapter.py — Wiz adapter.
tests/test_kyverno_adapter.py — Kyverno adapter.
All adapter tests load fixtures from tests/fixtures/ and use moto for AWS mocking.

Where to Write Tests

tests/test_<adapter_name>.py paired with tests/fixtures/<adapter>_fixture.json.

Adding a New Adapter

Create adapters/<name>/<name>_adapter.py.
Implement adapt() and (for policy adapters) is_configured().
Add the adapter's engine name to the engine enum in schemas/policy_check_result.schema.json if it is a policy adapter.
Write a test (tests/test_<name>_adapter.py) plus a fixture (tests/fixtures/<name>_fixture.json).
Add it to scripts/run_platform.sh if it is invoked at runtime.
Update this README.