Jon Chery
bee9d02f01
---ci---
project: acdl
phase: 40
milestone: v1.9
status: execute
---/ci---
Phase 40 — contract-interpolation (REQ-103, REQ-104, D-081):
Interpolation:
- core/contract_resolver.py: _expand_vars(value, context) recursively
expands ${env.<field>} + ${contract.<field>} tokens (dotted paths
supported, e.g. ${env.state_backend.bucket}). Unknown tokens raise
ValueError (fail loud). Expansion is post-schema-validation,
pre-IR-resolution.
- resolve() accepts environment_override (D-088) — overrides the
contract's environment field BEFORE schema validation so interpolation
context is consistent.
- env context loaded via _load_env (self-contained, works as script +
package import); 'environment' alias for env 'name' so
${env.environment} resolves.
Environment schema + bindings:
- schemas/environment.schema.json (draft 2020-12): name, account_id,
region, state_backend, network, runner_role_arn, autonomy, confidence_threshold.
- core/environments/qa.json, prod.json, dr.json placeholder bindings
(attested, thresholds 0.75/0.90/0.95, placeholder account_id with
stderr warning at load).
- core/environment_check.py: load(env_name) helper + placeholder warning.
Sample contracts:
- contracts/static-assets.yaml + microservice.yaml use
acdl-${env.environment}-${contract.module}-${env.account_id}-${env.region}
naming pattern (region + account id + environment).
Tests: +35 (test_environment_schema.py, test_interpolation.py,
test_sample_contracts_interpolate.py). 406 passed; run_ci.sh green;
run_platform.sh --check-only green. Existing fixture-based tests
preserved (instance.json static fixtures unaffected).
37 lines
1.6 KiB
Markdown
37 lines
1.6 KiB
Markdown
# Platform-managed environments
|
|
|
|
This directory holds environment definitions used by the onboarding scaffold.
|
|
Each file is a named environment the platform owns (an AWS account or
|
|
scoped partition, a network, a state backend, and an IAM role surfaced to
|
|
the consumer via ABAC).
|
|
|
|
A consumer never provides an AWS account, VPC, subnet, S3 state bucket, or
|
|
runner key — the platform manages all of that here.
|
|
|
|
## Files
|
|
|
|
- `dev.json` — the default dev environment (autonomous, confidence >= 0.50).
|
|
- `qa.json` — QA environment (attested, QA HITL gate, confidence >= 0.75).
|
|
Placeholder binding (replace account_id with the real QA account).
|
|
- `prod.json` — Production environment (attested, SRE HITL gate, confidence >= 0.90).
|
|
Placeholder binding.
|
|
- `dr.json` — DR environment (attested, SRE HITL gate, confidence >= 0.95).
|
|
Placeholder binding.
|
|
|
|
All files validate against `schemas/environment.schema.json`. The qa/prod/dr
|
|
placeholders use `account_id: 000000000000` with a stderr warning at load
|
|
time (prompts real binding before deploying).
|
|
|
|
## How it is used
|
|
|
|
`core/environment_check.py` reads a contract's `environment` field and
|
|
looks up the matching `<name>.json` in this directory. If no matching file
|
|
exists, the check prints a friendly onboarding prompt and exits non-zero,
|
|
halting the pipeline before any work is done.
|
|
|
|
## Adding an environment
|
|
|
|
A new environment is a platform-team action: provision the AWS account /
|
|
network / state backend / IAM role, then add a `<name>.json` here and bind
|
|
it to the consumer repo. Self-service environment provisioning is on the
|
|
roadmap; today it is a platform-team action. |