Files

T

Jon Chery 699aa542df docs(P15): plan-as-execute + verify (v1.2.5, PARTIAL — terraform apply blocked by IAM)

---ci---
project: acdl
phase: 15
milestone: v1.2
status: verify
verdict: PARTIAL
requirements:
  covered: [REQ-34]
  partial: [REQ-33]
blocker:
  - id: P0-IAM
    description: terraform apply fails with AccessDenied on ECS/ECR/IAM/EC2 — live spike_runner_policy.json not pushed (root key deactivated per D-034)
    unblock: operator runs create_iam_user.py with root/admin creds to push the expanded policy, then terraform apply succeeds (plan valid, 13 to add)
---/ci---

Phase 15 plan-as-execute + verify. PARTIAL: terraform apply blocked by IAM.
- Consumer microservice content authored (app.py + Dockerfile + README.md).
- Docker image acdl-microservice:latest built.
- Adapter fixed: ref emission (bare), JSON-string jsonencode, ECS service
  network_configuration/load_balancer/desired_count/launch_type/task_definition,
  listener default_action/load_balancer_arn, target group target_type/vpc_id/protocol,
  VPC tags (not name), IGW + route table association, managed_policy_arns list.
- L1 fixes: l1-ecs-service (removed port from service sub-resource),
  l1-vpc (added intra_refs, removed igw_id output).
- Resolver: intra_refs resolution (refs between sub-resources of same L1).
- terraform validate + plan succeed (13 to add).
- terraform apply BLOCKED (AccessDenied — live IAM policy not updated).
- Evidence event TERRAFORM_APPLY_BLOCKED written to DynamoDB outbox.
- v1.1 S3 regression: byte-identical.
Ready to ship v1.2.5 (partial).

2026-07-21 22:21:36 +00:00

interface.json

docs(P15): plan-as-execute + verify (v1.2.5, PARTIAL — terraform apply blocked by IAM)

2026-07-21 22:21:36 +00:00

README.md

docs(P13): plan-as-execute + verify (v1.2.3)

2026-07-21 21:05:48 +00:00

README.md

l1-ecs-service — ECS Fargate service primitive (multi-resource L1)

An L1 module for an ECS Fargate service (task definition + service). Substrate-agnostic (the IR types are aws:ecs:task_definition and aws:ecs:service, not Terraform resource types). This is a multi-resource L1: the interface declares the group's inputs/outputs plus a resources array listing the IR types it emits. The IR instance (Phase 14/15) will have multiple resources entries all with module: "l1-ecs-service@1.0.0".

Interface (the IR-typed contract)

See interface.json: inputs image (string, ECR image URL), port (number), cpu (number, default 256), memory (number, default 512), env (optional JSON map string), cluster_arn (arn, ref to l1-ecs-cluster), subnets (string, ref to l1-vpc), security_group (string), lb_target_group_arn (arn, optional, ref to l1-alb), region (string); outputs service_arn (arn) + task_def_arn (arn); no NFRs.

The resources array lists the emitted IR types:

aws:ecs:task_definition — Fargate task definition. The adapter jsonencodes image/port/env into container_definitions.
aws:ecs:service — Fargate service running the task definition in the cluster + subnets (+ optional ALB target group wiring).

IR → Terraform mapping (performed by the adapter)

The Terraform adapter (adapters/terraform/adapter.py) translates each emitted IR resource to Terraform:

IR	Terraform
`resource.type = aws:ecs:task_definition`	`resource "aws_ecs_task_definition" "<id>" { ... }`
`resource.inputs.image` + `port` + `env`	`container_definitions = jsonencode(...)` (adapter-built)
`resource.inputs.cpu`	`cpu = <value>` arg
`resource.inputs.memory`	`memory = <value>` arg
`resource.outputs.task_def_arn`	`output "task_def_arn" { value = aws_ecs_task_definition.<id>.arn }`
`resource.type = aws:ecs:service`	`resource "aws_ecs_service" "<id>" { ... }`
`resource.inputs.cluster_arn`	`cluster = <value>` arg (identity)
`resource.inputs.subnets`	`network_configuration { subnets = [...] }` (emit as-is)
`resource.inputs.security_group`	`network_configuration { security_groups = [...] }` (emit as-is)
`resource.inputs.lb_target_group_arn`	`load_balancer { target_group_arn = <value> }` (emit as-is)
`resource.outputs.service_arn`	`output "service_arn" { value = aws_ecs_service.<id>.id }`

The adapter is a thin layer (ARCHITECTURE.md §12.2); it does not own L1 content — it only translates. The container_definitions JSON is built by the adapter from the IR image/port/env inputs (the one transformation the adapter owns for ECS task definitions).

Versioning (W3.D)

1.0.0 — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps require a new registry entry (immutable publication); old entries enter a 12-month deprecation window.