Files

T

Jon Chery 6b410d9ab4 docs(P02): fix stale phase-status + wire STATE.md into ship discipline

P2 W1: PROJECT.md v1.26 phase-status block (lines 428-438):
- P3/P4/P5 'pending' → 'complete' with shipped tags (v1.25.3/4/5)
- v1.26 Overview marked shipped (merged to main 2026-08-19)
- Added STATE.md pointer to Capability Status section header
- Updated CAPABILITY_INVENTORY.md refs → archive/CAPABILITY_INVENTORY-v1.10.md

P2 W2: ROADMAP.md v1.26 section:
- P3/P4/P5 'planned' → 'complete' with shipped tags
- v1.26 Overview '(active, ...)' → '(complete, tag v1.25.5, merged to main)'
- Added STATE.md to v1.25 + v1.26 P5 'Updated at ship' lists

P2 W3: Wired STATE.md into ship discipline:
- PLAN.md: added 'Durable convention (v1.27 establishes)' section —
  every future P-final Wave 3 file-update list includes STATE.md
  (append new capability rows, mark deprecations, bump 'Last
  milestone ship' header).
- NORTH_STAR.md: added 'Relationship to engineering files (v1.27
  update)' section — STATE.md is the *what exists* catalog (PO-owned,
  additive); NORTH_STAR is the *why*; ARCHITECTURE the *how*;
  CHECKPOINT the *now*.

P2 W4: archive README + consumer PROJECT pointer:
- archive/README.md: added 'v1.27 compression — archived files (8
  files, lossless git mv)' section with 3 tables (3 superseded refs +
  4 v1.26 verifications/review/evidence + 1 consumer) + a note on the
  v1.26 pre-execution artifacts (in git history, not on disk).
  Updated 'Why archive' to record both compressions (v1.26 P2 +
  v1.27 P1).
- nova-blockchain-exchange/PROJECT.md: added phase-by-phase history
  pointer to platform ROADMAP §v1.26 (consumer ROADMAP archived).

P2 W5: Fixed remaining dangling references to archived files:
- ARCHITECTURE.md §12.8 line 566: P4-PILOT-RUN-EVIDENCE.md → archive/
- nova-blockchain-exchange/README.md (3 refs): P4-PILOT-RUN-EVIDENCE.md
  → archive/P4-PILOT-RUN-EVIDENCE-v1.26.md
- IAM_POLICY.md (2 refs): CAPABILITY_INVENTORY.md → archive/

Verified: 0 active dangling references remaining (grep confirms all
matches are in archive/ or v1.27 P0 records describing the archive).

---ci---
project: acdl
phase: 2
milestone: v1.27
status: execute
wave: W6
---ci---

2026-08-19 19:16:43 +00:00

8.9 KiB

Raw Blame History

Nova — IAM Policy Baseline (v1.11, REQ-116)

Source of truth: terraform/bootstrap/spike_runner_policy.json. Applied as: customer-managed policy acdl-spike-runner-policy (ARN arn:aws:iam::581513795199:policy/acdl-spike-runner-policy), v1. Regression-tested by: tests/test_iam_policy_baseline.py (Phase 56). Applied: 2026-07-28, Phase 56 live step (D-095 resolved — fresh root key provided by the user).

The acdl-spike-runner IAM user is the principal that runs the ACDL platform pipeline (plan + apply) against account 581513795199. This document is the baseline of the permissions it holds, scoped to the minimum required for the v1.11 milestone (Operating Model + Deploy Verification, REQ-116..122). Any future grant must be documented here and covered by the baseline test.

Managed-policy note (v1.11 Phase 56). The original v1.1 bootstrap applied this policy as an inline user policy (iam:put_user_policy). The v1.11 extension grew the policy document beyond the 2048-byte inline limit (5917 bytes), so Phase 56 converted it to a customer-managed policy (iam:create_policy + attach_user_policy) with the same name acdl-spike-runner-policy. The managed-policy path supports 6144 bytes per version + up to 5 versions, leaving room for future growth. The inline policy was deleted after the managed policy was attached. The same managed policy is also attached to the acdl-act-runner-role (CAP-022) so the OIDC runner inherits the spike-runner-equivalent permissions once act_runner adoption lands.

Original grants (v1.1–v1.10)

Capability	Actions	Resource scope
Terraform state (S3)	`s3:PutObject`, `s3:GetObject`, `s3:DeleteObject`, `s3:ListBucket`, `s3:GetBucketLocation`, `s3:GetBucketVersioning`	`acdl-tfstate-581513795199-us-east-1` + `/*`
DynamoDB outbox	`dynamodb:GetItem`, `PutItem`, `DeleteItem`, `UpdateItem`, `Query`, `Scan`, `DescribeTable`	`table/acdl-outbox`
STS identity	`sts:GetCallerIdentity`	`*`
ECS	`ecs:Create`, `Describe`, `Delete`, `Update`, `Register`, `Deregister`, `List*`	`ecs:us-east-1:581513795199:*`
ECR	`ecr:Create`, `Describe`, `Delete`, `Get`, `Batch`, `Put`, `Upload`, `Initiate`, `Complete*`	`ecr:us-east-1:581513795199:*`
ELB	`elasticloadbalancing:Create`, `Describe`, `Delete`, `Modify`, `Register`, `Deregister`	`elasticloadbalancing:us-east-1:581513795199:*`
IAM (role + policy mgmt)	`iam:Create`, `Get`, `Delete`, `PassRole`, `Attach`, `Detach`, `List`, `Put*`	`iam::581513795199:*`
EC2 (VPC + SG)	`ec2:Create`, `Describe`, `Delete`, `Associate`, `Disassociate`, `Attach`, `Detach`, `Authorize`	`ec2:us-east-1:581513795199:*`

v1.11 grants (Phase 56, REQ-116)

Capability	Actions	Resource scope	REQ
CloudFront (CAP-020)	`cloudfront:Create`, `Describe`, `Get`, `List`, `Update`, `Delete`, `TagResource`, `UntagResource`	`*` (CloudFront ARNs are regional-global)	REQ-118
WAFv2 (CAP-020)	`wafv2:Create`, `Describe`, `Get`, `List`, `Update`, `Delete`	`*` (WAFv2 global + regional)	REQ-118
Lambda (CAP-018)	`lambda:Create`, `Get`, `List`, `Update`, `Delete*`, `InvokeFunction`, `InvokeFunctionUrl`, `TagResource`, `UntagResource`, `PublishLayerVersion`	`lambda:us-east-1:581513795199:function:acdl-*`	REQ-117
DynamoDB contracts (CAP-017)	`dynamodb:Create`, `Describe`, `Get`, `Put`, `Update`, `Delete`, `Query`, `Scan`, `Batch*`	`table/acdl-contracts` + `/` + `table/acdl-change-requests` + `/`	REQ-117
Secrets Manager (CAP-018)	`secretsmanager:GetSecretValue`, `DescribeSecret`, `CreateSecret`, `PutSecretValue`, `DeleteSecret`, `ListSecrets`	`secret:acdl/*`	REQ-117
SNS (CAP-017)	`sns:CreateTopic`, `Publish`, `GetTopicAttributes`, `SetTopicAttributes`, `DeleteTopic`, `ListTopics`	`sns:us-east-1:581513795199:acdl-*`	REQ-117
Cost Explorer (REQ-119)	`ce:GetCostAndUsage`, `GetCostForecast`, `GetCostAndUsageWithResources`, `GetDimensionValues`, `GetTags`	`*` (CE is account-scoped)	REQ-119
KMS (CAP-017)	`kms:CreateKey`, `CreateAlias`, `Describe`, `Get`, `List`, `Update`, `Delete*`, `EnableKey`, `DisableKey`, `ScheduleKeyDeletion`, `TagResource`, `UntagResource`	`*` (KMS ARNs are account-wide)	REQ-117/118
IAM OIDC (CAP-022)	`iam:CreateOpenIDConnectProvider`, `GetOpenIDConnectProvider`, `DeleteOpenIDConnectProvider`, `ListOpenIDConnectProviders`, `UpdateOpenIDConnectProviderThumbprint`, `iam:CreateRole`, `GetRole`, `ListRoles`, `DeleteRole`, `UpdateRole`, `TagRole`, `UntagRole`	`*` (OIDC providers + roles are account-wide)	REQ-116

OIDC act_runner role (CAP-022, Phase 56)

The OIDC role for the Gitea act_runner was created in Phase 08 and gone since (archive/CAPABILITY_INVENTORY-v1.10.md CAP-022, archived v1.27). Phase 56 re-creates it with a trust policy for the Gitea runner ARN. The role grants the spike-runner-equivalent permissions to the runner via sts:AssumeRole, so the runner does not need a long-lived access key. This closes the chicken-and-egg: the spike-runner creates the OIDC role using the bootstrap root key; the runner then assumes the role.

Note: Real OIDC federation (D-039) is blocked on go-gitea/gitea#36988. Phase 56 re-creates the IAM role + trust policy; act_runner adoption is out of scope for v1.11 (see REQUIREMENTS.md §Out of Scope v1.11). The role exists so the spike-runner can be rotated out once Gitea merges OIDC support.

OIDC act_runner role (CAP-022, Phase 56 — re-created 2026-07-28)

The OIDC role for the Gitea act_runner was planned in Phase 08 but never created (the spike used a long-lived key per D-039 waiver). archive/CAPABILITY_INVENTORY-v1.10.md CAP-022 recorded "iam:ListRoles shows no acdl* roles." Phase 56 re-created the role:

Role name: acdl-act-runner-role
ARN: arn:aws:iam::581513795199:role/acdl-act-runner-role
Trust policy (v1): permits arn:aws:iam::581513795199:root to assume the role (sts:AssumeRole). This is the bootstrap trust — once go-gitea/gitea#36988 merges real OIDC federation, the trust policy is updated to the Gitea OIDC provider ARN + the runner's subject claim.
Attached policy: acdl-spike-runner-policy (the same managed policy the spike-runner user uses) — so the runner inherits the spike-runner-equivalent permissions, no long-lived key needed.
Tags: Project=acdl, Capability=CAP-022, Milestone=v1.11, ManagedBy=ciagent.

Note: Real OIDC federation (D-039) is blocked on go-gitea/gitea#36988. Phase 56 re-creates the IAM role + trust policy; act_runner adoption is out of scope for v1.11 (see REQUIREMENTS.md §Out of Scope v1.11). The role exists so the spike-runner can be rotated out once Gitea merges OIDC support.

Grant verification (Phase 56 live step, 2026-07-28)

All new grants verified effective against account 581513795199:

Service	Verification	Result
CloudFront	`list_distributions`	OK (0 items — stacks not yet deployed)
WAFv2	`list_web_acls(CLOUDFRONT)`	OK (0 items)
Lambda	`list_functions`	OK (0 items)
DynamoDB `acdl-contracts`	`describe_table`	ResourceNotFound (table not yet created — Phase 57 applies it; grant works, no AccessDenied)
Cost Explorer	`get_cost_and_usage` (7-day window)	OK (7 results — Phase 59 queries the full window)
Secrets Manager	`list_secrets`	OK (0 items)
SNS	`list_topics`	OK (0 items)
IAM OIDC role	`get_role(acdl-act-runner-role)`	OK (ARN confirmed)

Least-privilege scoping notes

CloudFront/WAF/KMS/CE/OIDC use Resource: "*" because these services use account-scoped or global ARNs that cannot be resource- restricted at the statement level. Scope is bounded by the action list (e.g. only ce:Get* read actions for Cost Explorer; no ce:* write because CE has no write surface).
Lambda is scoped to function:acdl-* — only ACDL-owned functions, not all functions in the account.
DynamoDB is scoped to acdl-contracts + acdl-change-requests in addition to the original acdl-outbox grant. The spike-runner cannot touch other tables in the account.
Secrets Manager is scoped to secret:acdl/* — only ACDL-owned secrets.
SNS is scoped to acdl-* topic names.
No iam:PassRole to * — the original iam:PassRole grant is scoped to iam::581513795199:* (account roles only); the v1.11 grant does not extend it.

Escalation (D-095 — resolved 2026-07-28)

Applying this policy required the bootstrap root key (ACDL_BOOTSTRAP_AWS_*). The original root key was closed (D-034). Per D-095 (user-confirmed: escalate to human for fresh access keys, no silent fallback), the run paused at Phase 56 live step. The user provided fresh root credentials in .env.secrets; the run resumed and applied the managed policy + re-created the OIDC role. D-095 is resolved.

8.9 KiB Raw Blame History Unescape Escape