Jon Chery
4e495e5648
---ci--- project: acdl phase: 21 milestone: v1.6 status: execute ---/ci--- Introduce platform-managed environments: a consumer does not provide an AWS account, VPC, subnet, S3 state bucket, or runner key. A named environment is a platform-owned bundle of account + network + state backend + IAM role (surfaced via ABAC), selected by name in the contract. Scaffold: - core/environments/dev.json (sample dev env definition) - core/environments/README.md (how envs are used + how to add one) - core/environment_check.py (reads a contract's environment field, looks up core/environments/<name>.json, prints a friendly onboarding prompt when none exists, exits non-zero) - scripts/run_platform.sh: Step 0 calls environment_check.py before contract validation; a missing env halts the pipeline with the onboarding prompt - tests/test_environment_check.py: 12 tests (dev bound, missing env -> onboarding prompt, onboarding message lists provisions, contract paths, wire-in, check-only still passes) Tests: 166 pass (154 + 12 new).
27 lines
1.1 KiB
Markdown
27 lines
1.1 KiB
Markdown
# Platform-managed environments
|
|
|
|
This directory holds environment definitions used by the onboarding scaffold.
|
|
Each file is a named environment the platform owns (an AWS account or
|
|
scoped partition, a network, a state backend, and an IAM role surfaced to
|
|
the consumer via ABAC).
|
|
|
|
A consumer never provides an AWS account, VPC, subnet, S3 state bucket, or
|
|
runner key — the platform manages all of that here.
|
|
|
|
## Files
|
|
|
|
- `dev.json` — the default dev environment (autonomous, confidence ≥ 0.50).
|
|
|
|
## How it is used
|
|
|
|
`core/environment_check.py` reads a contract's `environment` field and
|
|
looks up the matching `<name>.json` in this directory. If no matching file
|
|
exists, the check prints a friendly onboarding prompt and exits non-zero,
|
|
halting the pipeline before any work is done.
|
|
|
|
## Adding an environment
|
|
|
|
A new environment is a platform-team action: provision the AWS account /
|
|
network / state backend / IAM role, then add a `<name>.json` here and bind
|
|
it to the consumer repo. Self-service environment provisioning is on the
|
|
roadmap; today it is a platform-team action. |