acdl/.ciagent/AUDIT.md

ACDL v1.1 Milestone — Audit

Auditor: ci-audit-verifier (model: glm-5.2) Scope: v1.1 milestone — Phases 06–10 (tags v1.1.1..v1.1.5), milestone ship tag v1.2.0, diff v1.1.0..HEAD (48 commits) Date: 2026-07-21 Verdict: CLEAN — 0 P0 (no critical issues, no feedback loop), 2 P1 post-hoc hygiene items, 0 P2.

---

1. Reconstruction test

PASS. The project state can be reconstructed from the git log ---ci--- blocks alone, and it matches the .ciagent/ file contents.

HEAD ci block (d6b1923)

The latest ---ci--- block on main HEAD (== v1.2.0 tag target) reads:

project: acdl
phase: 0
milestone: v1.1
status: complete
requirements:
  covered: [REQ-16..REQ-28]

This matches the prompt's expected block exactly: status: complete, milestone: v1.1, requirements covered: [REQ-16..28]. ✅

Phase progression (walk-back through ci blocks)

Each phase (06–10) shows the documented plan → plan-as-execute → shipped → verify progression with the correct phase number. The complete sequence reconstructed from git log:

Phase	plan commit	plan-as-execute commits	ship commit (release.tag)	verify commit (verdict)
06	b927f90 (status: plan)	e044a2d	ecb2c78 (release.tag: v1.1.1) + 4ab15cb (docs)	0779a92 (verdict: VERIFIED)
07	b40aadd	92d4535, f8e99ed, 6ed93f0, 68d90c0, 412e1ef	8723206 (release.tag: v1.1.2)	167a92f (verdict: VERIFIED)
08	a003168	f8ddd8b, 1d5c4d2, d28630d, 727c873 (prep)	067fef1 (release.tag: v1.1.3) + 96ab42f (docs)	6d27dad (verdict: VERIFIED)
09	327ba1d	e054a95, 3070a68, 3936bf46	5555796 (release.tag: v1.1.4) + 4c93147 (docs)	e71539d (verdict: VERIFIED)
10	cc4c27c (prep 798f430)	8437a51, 622abe0, 7afaa34, e29319a	35a336a (release.tag: v1.1.5) + d3aa960 (docs)	4b87584 (verdict: VERIFIED)

Then the milestone tail: 2ed2ca6 (status: review, verdict: READY TO SHIP) → d6b1923 (status: complete, v1.2.0 tag). ✅

Tags

git tag --list returns the expected set:

• v1.0.1..v1.0.5 (v1.0 demo phase tags, preserved per D-rule)
• v1.1.0 (pre-v1.1 demo — points at 58adf9e, the v1.0 Phase 05 traceability commit)
• v1.1.1..v1.1.5 (phase patches 06–10)
• v1.2.0 (milestone ship tag — points at HEAD d6b1923, the complete commit)

All 12 tags present; no missing tags; no extra tags. ✅

ROADMAP.md ↔ tags

The ROADMAP.md phase statuses match the tags exactly:

• Phase 06 → complete (v1.1.1) ✅
• Phase 07 → complete (v1.1.2) ✅
• Phase 08 → complete (v1.1.3) ✅
• Phase 09 → complete (v1.1.4) ✅
• Phase 10 → complete (v1.1.5) ✅

The v1.1 milestone header (line 74) reads ## v1.1 (Complete — architecture finalization + v1 spike, 2026-07-21) and line 80 says Status: COMPLETE — all 5 phases shipped (v1.1.1..v1.1.5) + verified; review READY TO SHIP (0 P0); audit pending. The "audit pending" clause is now stale (this audit closes it) — see P1-A below.

REQUIREMENTS.md ↔ tags

The v1.1 traceability table (lines 117–129) matches the phase tags:

REQ	Phase	Status (file)	Tag (git)	Match
REQ-16..22	07	complete (v1.1.2)	v1.1.2	✅
REQ-23	08	complete (v1.1.3)	v1.1.3	✅
REQ-24, 26	09	complete (v1.1.4)	v1.1.4	✅
REQ-25, 27, 28	10	complete (v1.1.5)	v1.1.5	✅

The HEAD complete-commit ci block's requirements.covered: [REQ-16..REQ-28] matches REQUIREMENTS.md's 13 complete entries. ✅

Reconstruction conclusion

Reconstructing the project state from git log ---ci--- blocks alone reproduces the .ciagent/ file contents (PROJECT.md phase table, ROADMAP.md statuses, REQUIREMENTS.md traceability, REVIEW.md verdict). No drift detected. ✅

---

2. .ciagent/ file discipline

PASS with one P1 hygiene item. All required files exist; the latest phase's PLAN/VERIFY are in place; no orphans; no stale v1.0 framing. One stale-path issue in PERSONAS.md.

Required files (all present)

File	Exists	Notes
config.json	✅	mode=single, active_project=acdl, milestone=v1.1
PROJECT.md	✅	v1.1 objective (architecture finalization + v1 spike); D-034..D-046 + D-P08/P09/P10 present
ARCHITECTURE.md	✅	v1.1 target architecture; v1.1 spike scope; Gitea API surface with D-039 OIDC waiver
REQUIREMENTS.md	✅	REQ-16..28 complete; traceability table matches tags
ROADMAP.md	✅	v1.1 header marked Complete; phases 06–10 statuses match tags
PERSONAS.md	✅	v1.1 roster; deactivated v1.0 stub-engineer; phase-specific overrides
PLAN.md	✅	Phase 10 (the last phase) — phase: 10, name: v1-spike-l2-and-contract-e2e
RESEARCH.md	✅	8 research targets (OIDC blocker, runner tooling, IR prior art, Checkov adapter, outbox, confidence signal, audit ledger, HITL matrix)
VERIFY.md	✅	Phase 10 verification (the last one) — Verdict: Phase 10: VERIFIED, tag v1.1.5
REVIEW.md	✅	new for the milestone review — Verdict: READY TO SHIP, 0 P0, 1 P1 carried-forward

No stale v1.0 framing in v1.1 files

• PROJECT.md correctly states the v1.1 objective (line 53: "Finalize the architecture to v1.0 ... and prove the locked commitments with one end-to-end v1 implementation spike"). No occurrence of "30-min stub demo" / "30 min" / "stub demo" as the current objective. The v1.0 demo is correctly archived under demo/ (line 89). ✅
• The v1.0 demo is referenced as the prior milestone (status complete, tag v1.1.0) with a pointer to its archived location. ✅

PLAN.md = Phase 10 (the last phase)

PLAN.md frontmatter: phase: 10, name: v1-spike-l2-and-contract-e2e, requirements: [REQ-25, REQ-27, REQ-28]. Not a stale Phase 06–09 plan. ✅

VERIFY.md = Phase 10 (the last verification)

VERIFY.md header: # Phase 10 — v1-spike-l2-and-contract-e2e (v1.1) VERIFY, Verdict: Phase 10: VERIFIED, Tag: v1.1.5. Not a stale Phase 06–09 verification. ✅

No orphan .ciagent/ files

ls .ciagent/ shows exactly the 10 standard files (config.json + the 9 markdown files). No leftover/extra files. ✅

P1-A (post-hoc hygiene, non-blocking)

Two stale-path drift items inside .ciagent/:

1. config.json line 8: "status": "specify" — the milestone is complete (shipped v1.2.0), but the project-status field still reads specify. Should be "complete" (or shipped). Cosmetic — the milestone field reads v1.1 correctly, and ROADMAP.md carries the authoritative status.

2. PERSONAS.md territory paths: 6 references use the stale platform/... path prefix (lines 7, 38, 47, 56, 80, 109) instead of the renamed acdl_platform/.... The rename happened in Phase 08 prep commit 727c873 (fix(P08 prep): rename platform/ -> acdl_platform/ (stdlib shadow fix)). All executable code + the other .ciagent/ files use acdl_platform/; PERSONAS.md was not updated. The territories listed (platform/confidence_signal.py, platform/contract_resolver.py, platform/outbox/**, platform/registry/**, platform/hitl_matrix_design.md, platform/audit_ledger_design.md, platform/separation_of_duties.py) should all read acdl_platform/.... Non-blocking — the verification toolchain (PERSONAS.md verification_toolchain.typecheck line 7 also has the stale platform/**/*.py) is overridden per-phase by each PLAN.md's explicit verification.typecheck, so the stale path does not break any verify script. Recommended redaction for v1.2 cleanup.

---

3. Branch hygiene

PASS. Clean branch topology, clean working tree.

Branch list

git branch -a returns:

• main
• milestone/v1.0-initial (the v1.0 milestone branch, intentionally retained)
• remotes/origin/main
• remotes/origin/milestone/v1.0-initial

No leftover phase/NN-* branches (all 5 phase branches — phase/06-archive-demo-and-reorient, phase/07-architecture-v1-finalization, phase/08-aws-bootstrap, phase/09-v1-spike-ir-and-l1-and-adapter, phase/10-v1-spike-l2-and-contract-e2e — were deleted post-merge, confirmed by the ship commit messages referencing the squash-merge of the phase branch). ✅

Working tree

git status on main: "nothing to commit, working tree clean". The branch is ahead of origin/main by 43 commits (the v1.1 milestone work has not been pushed to the remote yet — this is expected for an audit pass before the milestone is declared shipped; the push is the final ship step). No uncommitted changes; no stray artifacts (.env.secrets, terraform/spike/.terraform/, terraform/spike/.terraform.lock.hcl, terraform/spike/tfplan, terraform/spike/*.tfstate* are all gitignored per REVIEW.md Lens 3). ✅

Branch hygiene conclusion

Clean. ✅

---

4. Commit discipline

PASS with one P1 hygiene item. Every v1.1-stage commit carries a ---ci--- block with the documented fields; the field-usage rules hold; the merges are the documented --no-ff squash-merge pattern.

---ci--- block presence

48 commits in v1.1.0..HEAD. Audit of ci-block presence:

• 3 commits with no ---ci--- block: 52665b8 Add docs/architecture.md, 7614c41 Add docs/vision.md, b84a8a2 Update docs/architecture.md. All three are pre-specify upstream-doc ingestion commits: each is an ancestor of the specify commit 288607b (docs(specify): ingest docs/vision+architecture). They are the raw upstream docs/ files being added to the repo before the v1.1 CIAgent protocol was applied (the specify commit 288607b is the first v1.1-stage commit and the first to carry a v1.1 ---ci--- block). These three commits belong to the v1.0→v1.1 transition, not the v1.1 milestone proper. They are inside the v1.1.0..HEAD audit range only because v1.1.0 is tagged at the v1.0 Phase 05 traceability commit (58adf9e) — a tag-placement choice that puts the v1.0-complete + audit-v1.0 + docs-ingestion commits inside the v1.1 range. P1-B (post-hoc, non-blocking): if the audit protocol requires every commit in the v1.1.0..HEAD range to carry a v1.1 ci block, these three pre-specify ingestion commits technically fail it. However: (a) they predate the v1.1 specify stage, (b) the v1.0 milestone-complete commit 80ac975 and the v1.0 audit d700148 carry v1.0 ci blocks (correct for their milestone), and (c) the v1.0 contracts commit 30e63d6 carries a v1.0 ci block. Only the 3 raw docs/ ingestion commits lack any ci block at all. Recommended for a future note in the run.md about tag placement (a v1.1.0 tag on the v1.0 complete commit rather than the v1.0 Phase 05 traceability commit would have excluded these from the v1.1 range). Non-blocking.

• 45 commits with ---ci--- blocks: all carry project: acdl, phase: (0 for milestone-stage, 6–10 for phase-stage), milestone: v1.1, and status: from the documented set {specify, clarify, research, plan, plan-as-execute, shipped, verify, review, complete}. ✅

Field usage rules

• release.tag appears only on the 5 ship commits (ecb2c78 v1.1.1, 8723206 v1.1.2, 067fef1 v1.1.3, 5555796 v1.1.4, 35a336a v1.1.5) — never on plan/plan-as-execute/verify/review/complete commits. ✅
• verdict appears only on the 5 verify commits (0779a92, 167a92f, 6d27dad, e71539d, 4b87584) and the 1 review commit (2ed2ca6) — never elsewhere. ✅
• requirements.covered appears on plan-as-execute commits (where a task covers a specific REQ) and on the complete commit (REQ-16..28). The complete commit uses the documented nested form (requirements:\n covered: [...]). ✅
• No ad-hoc fields. All fields used (project, phase, milestone, status, release.tag, verdict, requirements.covered, persona, tasks) are from the documented set. ✅

Merge commits

git log --merges v1.1.0..HEAD returns exactly the 5 ship commits:

35a336a ship: phase-10 ... (v1.1.5)   [parents: e71539d d3aa960]
5555796 ship: phase-09 ... (v1.1.4)   [parents: 327ba1d 4c93147]
067fef1 ship: phase-08 ... (v1.1.3)   [parents: 167a92f 96ab42f]
8723206 ship: phase-07 ... (v1.1.2)   [parents: b40aadd 412e1ef]
ecb2c78 ship: phase-06 ... (v1.1.1)   [parents: b927f90 4ab15cb]

Each ship commit has two parents: (1) the prior verify commit on main, and (2) the phase branch's final docs(PNN): post-ship traceability commit. This is the documented --no-ff squash-merge pattern (the phase branch is merged into main as a merge commit, not a fast-forward). No other merge commits exist in the range — no surprise merges, no --ff-only regressions. ✅

Closing-tag note

All 45 ci-block commits close the block with ---/ci--- (the documented closing tag). No commit uses the malformed ---ci--- close. ✅

---

Critical issues

No critical issues (0 P0). The audit found no blocking problems:

• Reconstruction test passes — git log reproduces the .ciagent/ state with no drift.
• File discipline passes — all 10 files present, latest-phase PLAN/VERIFY in place, no orphans, no stale v1.0 framing.
• Branch hygiene passes — clean topology, no leftover phase branches, clean working tree.
• Commit discipline passes — every v1.1-stage commit carries a well-formed ---ci--- block; field rules hold; merges are the documented pattern.

No feedback loop is triggered. The milestone does not need to return to EXECUTE.

---

Post-hoc hygiene (P1s for v1.2 cleanup)

ID	Item	Severity	File / location	Fix
P1-1 (carried-forward from REVIEW.md)	Two AWS access key IDs (AKIAYOZHMKZ7RK26N66W rotated spike key, AKIAYOZHMKZ772SINHFX deactivated root key) appear in .ciagent/VERIFY.md Phase 09 narrative. Public identifiers, not secret pairs. They live in the .ciagent/ audit narrative, not in any executable code path.	P1 (non-blocking)	.ciagent/VERIFY.md Phase 09 narrative	Replace with placeholders AKIA…SPIKE / AKIA…ROOT-DEACTIVATED in a v1.2 redaction pass.
P1-A (audit-new)	config.json line 8 "status": "specify" is stale — the milestone is complete (v1.2.0 shipped).	P1 (non-blocking)	.ciagent/config.json:8	Update to "status": "complete" (or "shipped") in v1.2 cleanup.
P1-B (audit-new)	PERSONAS.md territory paths (lines 7, 38, 47, 56, 80, 109) reference the stale platform/... prefix instead of the renamed acdl_platform/.... The rename happened in Phase 08 prep (commit 727c873). The verification toolchain line 7 also has the stale platform/**/*.py glob. Non-blocking: each PLAN.md overrides the toolchain per-phase, and territories are descriptive (enforcement mode = warn).	P1 (non-blocking)	.ciagent/PERSONAS.md lines 7, 38, 47, 56, 80, 109	Replace platform/ with acdl_platform/ in v1.2 cleanup.
P1-C (audit-new, observation)	3 pre-specify upstream-doc ingestion commits (52665b8 Add docs/architecture.md, 7614c41 Add docs/vision.md, b84a8a2 Update docs/architecture.md) carry no ---ci--- block. They predate the v1.1 specify stage (each is an ancestor of the specify commit 288607b). They fall inside the v1.1.0..HEAD audit range only because the v1.1.0 tag is placed at the v1.0 Phase 05 traceability commit (58adf9e) rather than the v1.0 complete commit (80ac975).	P1 (non-blocking, process note)	tag placement + run.md	Document in run.md that the milestone-complete tag should be placed on the milestone-complete commit to exclude the transition-window commits from the next milestone's audit range. No file change needed for v1.1; v1.2 should pick the tag placement deliberately.
P1-D (audit-new, cosmetic)	ROADMAP.md line 81 says audit pending — now stale (this audit closes it).	P1 (non-blocking, cosmetic)	.ciagent/ROADMAP.md:81	Update to audit CLEAN (or remove the clause) in v1.2 cleanup.

---

Final verdict

v1.1 milestone audit: CLEAN

• 0 P0 (no critical issues, no feedback loop).
• 5 P1 post-hoc hygiene items (1 carried-forward from REVIEW.md + 4 audit-new), all non-blocking, all flagged for v1.2 cleanup.
• The milestone is shippable as-is. The v1.2.0 tag on main HEAD is valid.