phase: 8, status: plan-as-execute, persona: platform-engineer+lead-developer, task: T-8.5..T-8.7
---ci---
project: acdl
phase: 8
milestone: v1.1
status: plan-as-execute
persona: platform-engineer+lead-developer
task: [T-8.5, T-8.6, T-8.7]
requirements.covered: [REQ-23]
---/ci---
Waves 3+4: rotation script + verify script + README + .gitignore.
- T-8.5 (platform): scripts/rotate_spike_key.sh - boto3 with bootstrap
root key from env (ACDL_BOOTSTRAP_AWS_*); creates new key for
acdl-spike-runner, deactivates+deletes old, writes new to gitignored
.env.secrets (chmod 600); idempotent (re-run ends with exactly 1
active key); optional Gitea secret upload if ACDL_GITEA_TOKEN set;
does NOT rotate the root key (D-034 closure = manual user step).
- T-8.6 (lead): scripts/verify_phase08.sh - loads rotated key from
.env.secrets, asserts caller identity is acdl-spike-runner (not root),
S3 bucket + DynamoDB table + IAM user + scoped policy with
DenyEverythingElse all present, .env.secrets + .bootstrap_state.json
gitignored. Uses heredoc python to avoid bash quoting issues.
- T-8.7 (lead): terraform/bootstrap/README.md runbook (6 steps incl.
manual D-034 root-key rotation) + .gitignore (.env.secrets +
.bootstrap_state.json). Spike vs v1.2 boundary table.
bash -n + gitignore checks pass.
Jon Chery
1d5c4d2ae7