acdl/.ciagent/AUDIT.md

# ACDL v1.1 Milestone — Audit

**Auditor:** ci-audit-verifier (model: glm-5.2)
**Scope:** v1.1 milestone — Phases 06–10 (tags v1.1.1..v1.1.5), milestone ship tag `v1.2.0`, diff `v1.1.0..HEAD` (48 commits)
**Date:** 2026-07-21
**Verdict:** **CLEAN** — 0 P0 (no critical issues, no feedback loop), 2 P1 post-hoc hygiene items, 0 P2.

---

## 1. Reconstruction test

**PASS.** The project state can be reconstructed from the git log `---ci---` blocks alone, and it matches the `.ciagent/` file contents.

### HEAD ci block (d6b1923)

The latest `---ci---` block on `main` HEAD (== `v1.2.0` tag target) reads:

```
project: acdl
phase: 0
milestone: v1.1
status: complete
requirements:
  covered: [REQ-16..REQ-28]
```

This matches the prompt's expected block exactly: `status: complete`, `milestone: v1.1`, `requirements covered: [REQ-16..28]`. ✅

### Phase progression (walk-back through ci blocks)

Each phase (06–10) shows the documented plan → plan-as-execute → shipped → verify progression with the correct phase number. The complete sequence reconstructed from `git log`:

| Phase | plan commit | plan-as-execute commits | ship commit (release.tag) | verify commit (verdict) |
|-------|--------------|--------------------------|----------------------------|--------------------------|
| 06 | b927f90 (`status: plan`) | e044a2d | ecb2c78 (`release.tag: v1.1.1`) + 4ab15cb (docs) | 0779a92 (`verdict: VERIFIED`) |
| 07 | b40aadd | 92d4535, f8e99ed, 6ed93f0, 68d90c0, 412e1ef | 8723206 (`release.tag: v1.1.2`) | 167a92f (`verdict: VERIFIED`) |
| 08 | a003168 | f8ddd8b, 1d5c4d2, d28630d, 727c873 (prep) | 067fef1 (`release.tag: v1.1.3`) + 96ab42f (docs) | 6d27dad (`verdict: VERIFIED`) |
| 09 | 327ba1d | e054a95, 3070a68, 3936bf46 | 5555796 (`release.tag: v1.1.4`) + 4c93147 (docs) | e71539d (`verdict: VERIFIED`) |
| 10 | cc4c27c (prep 798f430) | 8437a51, 622abe0, 7afaa34, e29319a | 35a336a (`release.tag: v1.1.5`) + d3aa960 (docs) | 4b87584 (`verdict: VERIFIED`) |

Then the milestone tail: 2ed2ca6 (`status: review`, `verdict: READY TO SHIP`) → d6b1923 (`status: complete`, `v1.2.0` tag). ✅

### Tags

`git tag --list` returns the expected set:

- `v1.0.1..v1.0.5` (v1.0 demo phase tags, preserved per D-rule)
- `v1.1.0` (pre-v1.1 demo — points at 58adf9e, the v1.0 Phase 05 traceability commit)
- `v1.1.1..v1.1.5` (phase patches 06–10)
- `v1.2.0` (milestone ship tag — points at HEAD d6b1923, the complete commit)

All 12 tags present; no missing tags; no extra tags. ✅

### ROADMAP.md ↔ tags

The ROADMAP.md phase statuses match the tags exactly:

- Phase 06 → `complete (v1.1.1)` ✅
- Phase 07 → `complete (v1.1.2)` ✅
- Phase 08 → `complete (v1.1.3)` ✅
- Phase 09 → `complete (v1.1.4)` ✅
- Phase 10 → `complete (v1.1.5)` ✅

The v1.1 milestone header (line 74) reads `## v1.1 (Complete — architecture finalization + v1 spike, 2026-07-21)` and line 80 says `Status: COMPLETE — all 5 phases shipped (v1.1.1..v1.1.5) + verified; review READY TO SHIP (0 P0); audit pending`. The "audit pending" clause is now stale (this audit closes it) — see P1-A below.

### REQUIREMENTS.md ↔ tags

The v1.1 traceability table (lines 117–129) matches the phase tags:

| REQ | Phase | Status (file) | Tag (git) | Match |
|-----|-------|---------------|-----------|-------|
| REQ-16..22 | 07 | complete (v1.1.2) | v1.1.2 | ✅ |
| REQ-23 | 08 | complete (v1.1.3) | v1.1.3 | ✅ |
| REQ-24, 26 | 09 | complete (v1.1.4) | v1.1.4 | ✅ |
| REQ-25, 27, 28 | 10 | complete (v1.1.5) | v1.1.5 | ✅ |

The HEAD complete-commit ci block's `requirements.covered: [REQ-16..REQ-28]` matches REQUIREMENTS.md's 13 complete entries. ✅

### Reconstruction conclusion

Reconstructing the project state from git log `---ci---` blocks alone reproduces the `.ciagent/` file contents (PROJECT.md phase table, ROADMAP.md statuses, REQUIREMENTS.md traceability, REVIEW.md verdict). **No drift detected.** ✅

---

## 2. .ciagent/ file discipline

**PASS with one P1 hygiene item.** All required files exist; the latest phase's PLAN/VERIFY are in place; no orphans; no stale v1.0 framing. One stale-path issue in PERSONAS.md.

### Required files (all present)

| File | Exists | Notes |
|------|--------|-------|
| `config.json` | ✅ | mode=single, active_project=acdl, milestone=v1.1 |
| `PROJECT.md` | ✅ | v1.1 objective (architecture finalization + v1 spike); D-034..D-046 + D-P08/P09/P10 present |
| `ARCHITECTURE.md` | ✅ | v1.1 target architecture; v1.1 spike scope; Gitea API surface with D-039 OIDC waiver |
| `REQUIREMENTS.md` | ✅ | REQ-16..28 complete; traceability table matches tags |
| `ROADMAP.md` | ✅ | v1.1 header marked Complete; phases 06–10 statuses match tags |
| `PERSONAS.md` | ✅ | v1.1 roster; deactivated v1.0 stub-engineer; phase-specific overrides |
| `PLAN.md` | ✅ | Phase 10 (the last phase) — `phase: 10, name: v1-spike-l2-and-contract-e2e` |
| `RESEARCH.md` | ✅ | 8 research targets (OIDC blocker, runner tooling, IR prior art, Checkov adapter, outbox, confidence signal, audit ledger, HITL matrix) |
| `VERIFY.md` | ✅ | Phase 10 verification (the last one) — `Verdict: Phase 10: VERIFIED`, tag v1.1.5 |
| `REVIEW.md` | ✅ | new for the milestone review — `Verdict: READY TO SHIP`, 0 P0, 1 P1 carried-forward |

### No stale v1.0 framing in v1.1 files

- `PROJECT.md` correctly states the v1.1 objective (line 53: "Finalize the architecture to v1.0 ... and prove the locked commitments with one end-to-end v1 implementation spike"). **No** occurrence of "30-min stub demo" / "30 min" / "stub demo" as the current objective. The v1.0 demo is correctly archived under `demo/` (line 89). ✅
- The v1.0 demo is referenced as the *prior* milestone (status complete, tag v1.1.0) with a pointer to its archived location. ✅

### PLAN.md = Phase 10 (the last phase)

PLAN.md frontmatter: `phase: 10`, `name: v1-spike-l2-and-contract-e2e`, `requirements: [REQ-25, REQ-27, REQ-28]`. Not a stale Phase 06–09 plan. ✅

### VERIFY.md = Phase 10 (the last verification)

VERIFY.md header: `# Phase 10 — v1-spike-l2-and-contract-e2e (v1.1) VERIFY`, `Verdict: Phase 10: VERIFIED`, `Tag: v1.1.5`. Not a stale Phase 06–09 verification. ✅

### No orphan .ciagent/ files

`ls .ciagent/` shows exactly the 10 standard files (config.json + the 9 markdown files). No leftover/extra files. ✅

### P1-A (post-hoc hygiene, non-blocking)

**Two stale-path drift items inside `.ciagent/`:**

1. **`config.json` line 8:** `"status": "specify"` — the milestone is `complete` (shipped v1.2.0), but the project-status field still reads `specify`. Should be `"complete"` (or `shipped`). Cosmetic — the milestone field reads `v1.1` correctly, and ROADMAP.md carries the authoritative status.

2. **`PERSONAS.md` territory paths:** 6 references use the stale `platform/...` path prefix (lines 7, 38, 47, 56, 80, 109) instead of the renamed `acdl_platform/...`. The rename happened in Phase 08 prep commit 727c873 (`fix(P08 prep): rename platform/ -> acdl_platform/ (stdlib shadow fix)`). All executable code + the other `.ciagent/` files use `acdl_platform/`; PERSONAS.md was not updated. The territories listed (`platform/confidence_signal.py`, `platform/contract_resolver.py`, `platform/outbox/**`, `platform/registry/**`, `platform/hitl_matrix_design.md`, `platform/audit_ledger_design.md`, `platform/separation_of_duties.py`) should all read `acdl_platform/...`. Non-blocking — the verification toolchain (`PERSONAS.md` `verification_toolchain.typecheck` line 7 also has the stale `platform/**/*.py`) is overridden per-phase by each PLAN.md's explicit `verification.typecheck`, so the stale path does not break any verify script. **Recommended redaction for v1.2 cleanup.**

---

## 3. Branch hygiene

**PASS.** Clean branch topology, clean working tree.

### Branch list

`git branch -a` returns:
- `main`
- `milestone/v1.0-initial` (the v1.0 milestone branch, intentionally retained)
- `remotes/origin/main`
- `remotes/origin/milestone/v1.0-initial`

**No leftover `phase/NN-*` branches** (all 5 phase branches — `phase/06-archive-demo-and-reorient`, `phase/07-architecture-v1-finalization`, `phase/08-aws-bootstrap`, `phase/09-v1-spike-ir-and-l1-and-adapter`, `phase/10-v1-spike-l2-and-contract-e2e` — were deleted post-merge, confirmed by the ship commit messages referencing the squash-merge of the phase branch). ✅

### Working tree

`git status` on `main`: "nothing to commit, working tree clean". The branch is ahead of `origin/main` by 43 commits (the v1.1 milestone work has not been pushed to the remote yet — this is expected for an audit pass before the milestone is declared shipped; the push is the final ship step). No uncommitted changes; no stray artifacts (`.env.secrets`, `terraform/spike/.terraform/`, `terraform/spike/.terraform.lock.hcl`, `terraform/spike/tfplan`, `terraform/spike/*.tfstate*` are all gitignored per REVIEW.md Lens 3). ✅

### Branch hygiene conclusion

Clean. ✅

---

## 4. Commit discipline

**PASS with one P1 hygiene item.** Every v1.1-stage commit carries a `---ci---` block with the documented fields; the field-usage rules hold; the merges are the documented `--no-ff` squash-merge pattern.

### `---ci---` block presence

48 commits in `v1.1.0..HEAD`. Audit of ci-block presence:

- **3 commits with no `---ci---` block:** `52665b8 Add docs/architecture.md`, `7614c41 Add docs/vision.md`, `b84a8a2 Update docs/architecture.md`. All three are **pre-specify upstream-doc ingestion** commits: each is an ancestor of the specify commit `288607b` (`docs(specify): ingest docs/vision+architecture`). They are the raw upstream `docs/` files being added to the repo *before* the v1.1 CIAgent protocol was applied (the specify commit 288607b is the first v1.1-stage commit and the first to carry a v1.1 `---ci---` block). These three commits belong to the v1.0→v1.1 transition, not the v1.1 milestone proper. They are inside the `v1.1.0..HEAD` audit range only because `v1.1.0` is tagged at the v1.0 Phase 05 traceability commit (58adf9e) — a tag-placement choice that puts the v1.0-complete + audit-v1.0 + docs-ingestion commits inside the v1.1 range. **P1-B (post-hoc, non-blocking):** if the audit protocol requires every commit in the `v1.1.0..HEAD` range to carry a v1.1 ci block, these three pre-specify ingestion commits technically fail it. However: (a) they predate the v1.1 specify stage, (b) the v1.0 milestone-complete commit `80ac975` and the v1.0 audit `d700148` carry v1.0 ci blocks (correct for their milestone), and (c) the v1.0 contracts commit `30e63d6` carries a v1.0 ci block. Only the 3 raw `docs/` ingestion commits lack any ci block at all. Recommended for a future note in the run.md about tag placement (a v1.1.0 tag on the v1.0 *complete* commit rather than the v1.0 Phase 05 traceability commit would have excluded these from the v1.1 range). Non-blocking.

- **45 commits with `---ci---` blocks:** all carry `project: acdl`, `phase:` (0 for milestone-stage, 6–10 for phase-stage), `milestone: v1.1`, and `status:` from the documented set {specify, clarify, research, plan, plan-as-execute, shipped, verify, review, complete}. ✅

### Field usage rules

- **`release.tag`** appears only on the 5 ship commits (ecb2c78 v1.1.1, 8723206 v1.1.2, 067fef1 v1.1.3, 5555796 v1.1.4, 35a336a v1.1.5) — never on plan/plan-as-execute/verify/review/complete commits. ✅
- **`verdict`** appears only on the 5 verify commits (0779a92, 167a92f, 6d27dad, e71539d, 4b87584) and the 1 review commit (2ed2ca6) — never elsewhere. ✅
- **`requirements.covered`** appears on plan-as-execute commits (where a task covers a specific REQ) and on the complete commit (REQ-16..28). The complete commit uses the documented nested form (`requirements:\n  covered: [...]`). ✅
- **No ad-hoc fields.** All fields used (`project`, `phase`, `milestone`, `status`, `release.tag`, `verdict`, `requirements.covered`, `persona`, `tasks`) are from the documented set. ✅

### Merge commits

`git log --merges v1.1.0..HEAD` returns exactly the 5 ship commits:

```
35a336a ship: phase-10 ... (v1.1.5)   [parents: e71539d d3aa960]
5555796 ship: phase-09 ... (v1.1.4)   [parents: 327ba1d 4c93147]
067fef1 ship: phase-08 ... (v1.1.3)   [parents: 167a92f 96ab42f]
8723206 ship: phase-07 ... (v1.1.2)   [parents: b40aadd 412e1ef]
ecb2c78 ship: phase-06 ... (v1.1.1)   [parents: b927f90 4ab15cb]
```

Each ship commit has two parents: (1) the prior `verify` commit on `main`, and (2) the phase branch's final `docs(PNN): post-ship traceability` commit. This is the documented `--no-ff` squash-merge pattern (the phase branch is merged into main as a merge commit, not a fast-forward). **No** other merge commits exist in the range — no surprise merges, no `--ff-only` regressions. ✅

### Closing-tag note

All 45 ci-block commits close the block with `---/ci---` (the documented closing tag). **No** commit uses the malformed `---ci---` close. ✅

---

## Critical issues

**No critical issues (0 P0).** The audit found no blocking problems:

- Reconstruction test passes — git log reproduces the `.ciagent/` state with no drift.
- File discipline passes — all 10 files present, latest-phase PLAN/VERIFY in place, no orphans, no stale v1.0 framing.
- Branch hygiene passes — clean topology, no leftover phase branches, clean working tree.
- Commit discipline passes — every v1.1-stage commit carries a well-formed `---ci---` block; field rules hold; merges are the documented pattern.

**No feedback loop is triggered.** The milestone does not need to return to EXECUTE.

---

## Post-hoc hygiene (P1s for v1.2 cleanup)

| ID | Item | Severity | File / location | Fix |
|----|------|----------|-----------------|-----|
| **P1-1** (carried-forward from REVIEW.md) | Two AWS access key IDs (`AKIAYOZHMKZ7RK26N66W` rotated spike key, `AKIAYOZHMKZ772SINHFX` deactivated root key) appear in `.ciagent/VERIFY.md` Phase 09 narrative. **Public identifiers, not secret pairs.** They live in the `.ciagent/` audit narrative, not in any executable code path. | P1 (non-blocking) | `.ciagent/VERIFY.md` Phase 09 narrative | Replace with placeholders `AKIA…SPIKE` / `AKIA…ROOT-DEACTIVATED` in a v1.2 redaction pass. |
| **P1-A** (audit-new) | `config.json` line 8 `"status": "specify"` is stale — the milestone is `complete` (v1.2.0 shipped). | P1 (non-blocking) | `.ciagent/config.json:8` | Update to `"status": "complete"` (or `"shipped"`) in v1.2 cleanup. |
| **P1-B** (audit-new) | `PERSONAS.md` territory paths (lines 7, 38, 47, 56, 80, 109) reference the stale `platform/...` prefix instead of the renamed `acdl_platform/...`. The rename happened in Phase 08 prep (commit 727c873). The verification toolchain line 7 also has the stale `platform/**/*.py` glob. Non-blocking: each PLAN.md overrides the toolchain per-phase, and territories are descriptive (enforcement mode = `warn`). | P1 (non-blocking) | `.ciagent/PERSONAS.md` lines 7, 38, 47, 56, 80, 109 | Replace `platform/` with `acdl_platform/` in v1.2 cleanup. |
| **P1-C** (audit-new, observation) | 3 pre-specify upstream-doc ingestion commits (`52665b8 Add docs/architecture.md`, `7614c41 Add docs/vision.md`, `b84a8a2 Update docs/architecture.md`) carry no `---ci---` block. They predate the v1.1 specify stage (each is an ancestor of the specify commit 288607b). They fall inside the `v1.1.0..HEAD` audit range only because the `v1.1.0` tag is placed at the v1.0 Phase 05 traceability commit (58adf9e) rather than the v1.0 complete commit (80ac975). | P1 (non-blocking, process note) | tag placement + run.md | Document in run.md that the milestone-complete tag should be placed on the milestone-complete commit to exclude the transition-window commits from the next milestone's audit range. No file change needed for v1.1; v1.2 should pick the tag placement deliberately. |
| **P1-D** (audit-new, cosmetic) | `ROADMAP.md` line 81 says `audit pending` — now stale (this audit closes it). | P1 (non-blocking, cosmetic) | `.ciagent/ROADMAP.md:81` | Update to `audit CLEAN` (or remove the clause) in v1.2 cleanup. |

---

## Final verdict

**v1.1 milestone audit: CLEAN**

- 0 P0 (no critical issues, no feedback loop).
- 5 P1 post-hoc hygiene items (1 carried-forward from REVIEW.md + 4 audit-new), all non-blocking, all flagged for v1.2 cleanup.
- The milestone is shippable as-is. The `v1.2.0` tag on `main` HEAD is valid.