Jon Chery
e6ee79402b
contract/ policies (4): require-id-pattern, require-env-in-enum, require-infrastructure-min-1, forbid-unknown-fields — declarative mirrors of contract.schema.json constraints. stack-ir/ policies (3): require-tagging-standard (nova:owner/contract/ environment/cost-center tags — ports nova_tagging.py), forbid-public-ingress (v1.0 demo rule, now declarative), require-encryption-by-default (v1.8 D-encryption-default — S3 + EBS encryption config). core/contract_resolver.py: pre-resolve contract-policy evaluation (REQ-296) + post-resolve stack-IR-policy evaluation (REQ-298). Additive — the resolver's return shape + exceptions unchanged; PCRs attach to stack_instance.policyResults. Policy evaluation never breaks the resolver (confidence signal decides gate). tests: test_stack_ir_policies.py + passing/failing fixtures. Skip-without-kj. 16 existing resolver tests unchanged. ---ci--- project: acdl phase: 2 milestone: v1.25 status: execute phase_role: execution requirements: covered: [REQ-295, REQ-296, REQ-297, REQ-298, REQ-299] partial: [] ---/ci---
34 lines
646 B
JSON
34 lines
646 B
JSON
{
|
|
"version": "1.0.0",
|
|
"stack": {
|
|
"name": "bad",
|
|
"title": "failing stack",
|
|
"kind": "l1",
|
|
"depth": 1,
|
|
"environment": "dev"
|
|
},
|
|
"resources": [
|
|
{
|
|
"id": "bucket",
|
|
"type": "aws:s3:bucket",
|
|
"module": "s3@1.0.0",
|
|
"inputs": {
|
|
"bucket_name": "acdl-dev-bad-bucket",
|
|
"region": "us-east-1",
|
|
"tags": {
|
|
"nova:owner": "team-a"
|
|
}
|
|
}
|
|
},
|
|
{
|
|
"id": "service",
|
|
"type": "aws:ecs:service",
|
|
"module": "microservice@1.0.0",
|
|
"inputs": {
|
|
"image": "nginx:latest",
|
|
"port": 80,
|
|
"public_ingress": true
|
|
}
|
|
}
|
|
]
|
|
} |