acdl/.ciagent/PROJECT.md

# Nova — The New Dawn of DevSecOps

> **Rebrand complete (milestone v1.15 — Nova, tag v1.15.4).** The
> project was rebranded from **ACDL** / "Agentic Cloud Delivery
> Platform" → **Nova** / "The New Dawn of DevSecOps — security as a
> seamless enabler of fast deployments." The new tagline is added
> alongside the existing "North Star" / "consumers declare intent"
> framing. See `.ciagent/REQUIREMENTS.md` §v1.15 and
> `.ciagent/ROADMAP.md` §v1.15.

## Vision / Core Value

Consumers declare intent; the platform delivers safe production
deployment through an agentic stack. The platform absorbs two frictions:
the cognitive load of getting the infrastructure right, and the
operational work of getting the change to production safely.

Source of truth for **why**: `docs/vision.md`.
Source of truth for **how**: `docs/architecture.md` + `.ciagent/ARCHITECTURE.md`.
Where the two conflict, the vision wins.

## North Star

A merged change progresses through lower environments end-to-end without a
platform engineer joining a thread, approving a ticket, or manually
triggering a stage gate. A non-technical consumer ships a production
deployment by declaring intent — without authoring a workflow, a
configuration file, or a Terraform module. Every production change is
traceable to a human attestation and an immutable evidence stream.

## Core Tenets (from `docs/vision.md`)

1. **Operations are Declared, Not Executed.** Consumers define what they
   need; the platform reconciles, provisions, and progresses.
2. **The Delivery Lifecycle is a Sovereign Boundary.** The platform
   governs infra and delivery; it does not penetrate upstream product/SDLC.
   Integration is only through validated, published contracts.
3. **Lower Environments are Autonomous; Higher Environments are Attested.**
   Dev = zero-touch agentic. QA/prod/dr = deliberate human attestation, not
   rubber stamps.
4. **Safety is Computed, Not Assumed.** Every action produces a measurable,
   explainable confidence signal. The signal is the platform's certified
   answer to "is this safe to proceed?"
5. **Infrastructure is Consumed, Not Maintained.** Compute is abstract,
   containerized, or serverless. No node/OS/bare-metal lifecycle.
6. **Two Consumer Surfaces, One Platform.** Technical developers (L3A) and
   non-technical consumers (L3B) converge on the same contract schema, the
   same policy envelope, and the same evidence stream.

## Domain Boundaries

- **In scope:** environment progression; cloud resource lifecycle; operational
  security and observability NFRs; policy enforcement; immutable audit
  lineage; confidence frameworks; two consumer surfaces (developer + agentic).
- **Out of scope:** application business logic; IDE workflows; product
  backlog / sprint planning; compute requiring node-level or OS-level management.
- **Interface:** upstream systems integrate through a strict contract
  boundary. The platform validates, enriches with operational standards,
  and reconciles the target state.

## Capability Status (Re-Verified 2026-07-27)

> Source of truth: `.ciagent/CAPABILITY_INVENTORY.md` (Phase 54, D-093).
> Tier: **local** = runs via emulating adapters (no AWS); **live-aws** =
> runs against the live AWS account (581513795199).

**Decay disclosure.** Capabilities marked complete in v1.1–v1.8 ran
successfully at the time of tagging. As of 2026-07-27 they were **not
reproducible** — the v1.7/v1.8 platform simplification introduced 7
adapter defects that prevented `terraform init/validate/plan` from
succeeding against live AWS, and the decks (v1.9.1–v1.9.8) presented
the capability as current without disclosing the decay. The v1.10
milestone (Phases 52–55) re-verified every advertised capability and
fixed all 7 defects in-sweep (D-090: no cap). The headline E2E now
passes at both tiers.

**Auto-verified capabilities (16/16 Verified):**

| ID | Capability | Tier | Status |
|----|-----------|------|--------|
| CAP-001..CAP-012 | contract schema, resolver, adapter, interpolation, confidence, outbox, pytest, run_ci, local E2E (microservice + static-assets) | local | Verified |
| CAP-013 | terraform init+validate+plan live AWS (microservice) | live-aws | Verified |
| CAP-014 | terraform init+validate+plan live AWS (static-assets: CloudFront+WAF+S3) | live-aws | Verified |
| CAP-015 | DynamoDB outbox table exists + describable | live-aws | Verified |
| CAP-016 | S3 state bucket exists + readable | live-aws | Verified |

**IAM-gated cloud resources (6, escalated — not auto-verifiable):**
CAP-017..CAP-022 (DynamoDB contracts table, Lambda contract-ingestor,
ECS service live, CloudFront production stack, uptime-kuma, OIDC
role). The `acdl-spike-runner` IAM user lacks the permissions to
verify these (chicken-and-egg: it cannot fix its own IAM). The
terraform plan path (CAP-013, CAP-014) proves the code would deploy
them; the local emulators (Phase 53) prove the runtime behavior.
Re-bootstrap of the OIDC role + IAM re-grant requires an admin
principal — escalated, not silently skipped. See
`CAPABILITY_INVENTORY.md` §"Cloud capabilities NOT re-verified".

**Regression gate.** `bash scripts/run_regression.sh` re-runs all 16
auto-verifiable capabilities and fails closed on any non-Verified
result. The gate runs at milestone completion (D-091).

## Objective for Milestone v1.1 (prior — complete, tag `v1.2.0`)

Finalize the architecture to v1.0 (resolve all 11 open design decisions in
`docs/architecture.md` §13) and prove the locked commitments with one
end-to-end v1 implementation spike:

- **One L1 module** (`l1-s3`) — engine-agnostic, IR-typed interface.
- **One L2 thin-composition** (`l2-static-assets`) — references the L1.
- **Terraform adapter** — compiles the IR to a real `terraform plan`
  against AWS via OIDC (no long-lived credentials, per §12.5).
- **One contract submission** → contract→IR resolution →
  `terraform plan` → PolicyCheckResult (Checkov) → confidence signal →
  evidence event to the DynamoDB outbox.

The spike validates the architecture's claim that the IR-shaped commitments
do not require a polyglot mess (`docs/architecture.md` §14, step 2).

**Status: COMPLETE — all 5 phases shipped (v1.1.1..v1.1.5) + verified; review
READY TO SHIP (0 P0); audit CLEAN; milestone tag `v1.2.0`; Gitea release
id 202 published. D-034 closed (root key deactivated by user).**

## Milestone v1.1 Phases (prior — complete)

| Phase | Name | Goal |
|-------|------|------|
| 06 | archive-demo-and-reorient | Move the v1.0 demo (`modules/`, `scripts/`, `evidence-ui/`, `contracts/`, demo workflows) to `demo/`; establish the new repo layout (`platform/`, `schemas/`, `adapters/`, `terraform/`, `modules-ir/`); rewrite README. |
| 07 | architecture-v1-finalization | Resolve the 11 open decisions → architecture v1.0. Author IR JSON Schema, PolicyCheckResult schema, contract schema, confidence-signal spec, HITL matrix, outbox/ledger design under `schemas/` + `platform/`. |
| 08 | aws-oidc-bootstrap | One-shot use of a temporary long-lived key (waiver D-034) to create an IAM role + OIDC trust policy for the act_runner, an S3 state bucket, and a DynamoDB lock table. Rotate the key. Verify the runner assumes the role via OIDC with no long-lived secret. |
| 09 | v1-spike-ir-and-l1-and-adapter | Target Stack IR; one real L1 (`l1-s3`) with IR-typed interface; L1 registry; Terraform adapter (IR → Terraform var/output + `terraform plan`) running against AWS via OIDC. |
| 10 | v1-spike-l2-and-contract-e2e | One L2 thin-composition (`l2-static-assets`) referencing `l1-s3`; contract schema + contract→IR resolution; one end-to-end contract submission → `terraform plan` → Checkov → confidence signal → evidence event to outbox. Verify the IR commitments hold. |

Milestone COMPLETE gate: review → ship `v1.2.0` (feature milestone, next
minor per ship.md) → audit. **DONE.**

## Objective for Milestone v1.2 (prior — complete)

Platform hardening + first real consumer deployment. The v1.1 spike proved
the IR commitments hold on a single dev-only `terraform plan` for one S3
bucket. v1.2 takes the spike to a real, simpler, better-documented platform
that actually delivers a microservice to AWS ECS Fargate end-to-end.

Five scope axes (user-directed, 2026-07-21):

1. **Re-evaluate the current state.** Confirm go-gitea/gitea#36988 (OIDC for
   Gitea Actions) is still unmerged (re-checked 2026-07-21: **open**, last
   updated 2026-05-27). Extend the D-039 per-run-rotated-key waiver for
   v1.2; real OIDC is deferred to v1.3+ (D-047).
2. **NFR improvements on the existing spike.** Least-privilege IAM audit,
   idempotent bootstrap, proper exit codes / error handling, rotation
   hygiene, P1-1 / P1-B redaction carried forward from the v1.1 audit.
3. **Streamline / simplify the current setup.** Consolidate the
   `run_spike_*.sh` scripts into one `scripts/run_platform.sh`; remove
   dead code and stale paths; one command runs the whole pipeline.
4. **README.md fully up to date on how the platform works.** The current
   README still says "v1.1 (active)" — it must reflect v1.1 complete, the
   actual spike flow, how to run it, the real repo layout, and the v1.2
   objective.
5. **Bootstrap a consumer repo with a basic microservice deployed to ECS
   end-to-end.** New Gitea repo `acdl-consumer-microservice` (org
   `continuous-intelligence`) holding a tiny HTTP container + Dockerfile;
   new IR-typed L1s (`l1-vpc`, `l1-ecs-cluster`, `l1-ecs-service`,
   `l1-iam-role`, `l1-alb`, `l1-ecr`); new `l2-microservice`
   thin-composition; one contract submission → `terraform apply` (dev,
   autonomous) → a live ECS Fargate service serving HTTP 200 → evidence
   event to the DynamoDB outbox → acdl-evidence timeline.

The milestone proves the platform delivers real value (a running
microservice), not just a plan.

## Milestone v1.2 Phases

| Phase | Name | Goal |
|-------|------|------|
| 11 | v1.2-research-and-readme | Re-eval #36988 (confirm open → extend D-039 as D-047). Audit the v1.1 spike for NFR gaps (least-privilege, idempotency, error handling, rotation hygiene) + simplification opportunities. **Rewrite README.md** to reflect v1.1 complete + how the platform actually works (spike flow, how to run, repo layout, v1.2 objective). Output: RESEARCH.md v1.2 addendum; updated README. |
| 12 | nfr-harden-and-simplify | Apply Phase 11 findings: tighten `spike_runner_policy.json` (least-privilege audit); make `terraform/bootstrap/create_*.py` idempotent; consolidate `run_spike_*.sh` → one `scripts/run_platform.sh`; proper exit codes / error handling; redact P1-1 AWS key IDs in `VERIFY.md`; fix any remaining stale `platform/` paths. Spike still runs e2e after the refactor. |
| 13 | l1-catalog-for-ecs | Author IR-typed L1s for an ECS Fargate microservice: `l1-vpc`, `l1-ecs-cluster`, `l1-ecs-service`, `l1-iam-role` (task + exec role), `l1-alb`, `l1-ecr`. Register all in `modules-ir/registry.json`. Expand the Terraform adapter `TYPE_MAP`. Each L1 produces a valid `terraform plan` fragment. |
| 14 | l2-microservice-and-contract-schema | Author `l2-microservice` thin-composition (references the ECS L1s, depth ≤ 5). Extend `schemas/contract.schema.json` for microservice inputs (image, port, env, healthcheck). Verify contract→IR resolution yields a complete target stack. |
| 15 | consumer-repo-and-terraform-apply | Create consumer repo `acdl-consumer-microservice` (Gitea org) with a basic microservice (tiny HTTP container + Dockerfile + ECR push). Lift the platform from `plan` → **`apply`** (dev, autonomous per §10). Submit `contracts/microservice.yaml` → pipeline → IR → plan → apply → a real ECS Fargate service running. |
| 16 | v1.2-capstone-e2e | End-to-end verification: consumer commit → pipeline → ECS service live serving HTTP 200 → evidence event to the DynamoDB outbox → acdl-evidence timeline renders it. Verify NFR improvements hold, the setup is simpler (one `run_platform.sh`), and the README is accurate. |

Milestone COMPLETE gate: review → ship `v1.3.0` (feature milestone, next
minor per ship.md — v1.1 shipped `v1.2.0`) → audit.

## Objective for Milestone v1.4 (active)

Central pipeline contract + shell reproducibility + output streaming. The
v1.3 milestone (Phases 17–18) created identical CI/CD pipelines for Gitea
and GitHub but they were duplicated copies with no single source of truth.
v1.4 makes the pipeline a declarative contract, enables full shell
reproducibility, and streams terraform/checkov output so users can see
what the platform is doing.

Three scope axes:

1. **Central pipeline contract.** A JSON Schema
   (`schemas/pipeline.schema.json`) + YAML instance (`pipelines/ci.yaml`)
   declares the pipeline stages, commands, triggers, and runner. Both
   `.gitea/workflows/ci.yml` (Gitea Actions, dev) and
   `.github/workflows/ci.yml` (GitHub Actions, production) implement the
   contract. A test validates conformance.
2. **Shell reproducibility.** `scripts/run_ci.sh` mirrors the CI pipeline
   locally — runs the same 3 stages (lint, test, check-only) in sequence.
   The pipeline is fully reproducible from the shell, not just in CI.
3. **Output streaming.** `scripts/run_platform.sh` streams terraform
   init/validate/plan output, Checkov compliance results, and
   PolicyCheckResult records to stdout by default, so the user sees what
   is happening. A `--quiet` flag suppresses streaming for log-only mode.

## Milestone v1.4 Phases

| Phase | Name | Goal |
|-------|------|------|
| 19 | central-pipeline-contract-and-shell-reproducibility | Create the central pipeline contract (JSON Schema + YAML instance). Create `scripts/run_ci.sh` for shell reproducibility. Update `run_platform.sh` to stream terraform/checkov output. Update both workflow YAMLs with contract references (staying byte-identical). Add tests for contract validation, workflow conformance, and streaming. |

Milestone COMPLETE gate: review → ship `v1.4.1` (feature milestone, next
minor per ship.md — v1.3 shipped `v1.3.2`) → audit.

## Objective for Milestone v1.7 (complete)

Production platform + contract ingestion + pipeline maturation. The v1.6
milestone left the platform documented and environments-aware; v1.7 took it
to a production-grade platform. 12 user-directed scope axes (2026-07-22):

1. **Rename `static-assets` → `static-assets`** (D-048 — including
   `.ciagent/` historical narrative, overriding the v1.6 preservation
   precedent). The reconstruction test is updated to expect `static-assets`.
2. **Augment `static-assets` to a production-ready stack** by authoring a
   new `cloudfront` primitive + a `waf` primitive (D-049: S3 + CloudFront
   OAC + WAF; Route53/ACM are domain-dependent and deferred to documented
   extension points).
3. **DX-friendly deploy outputs** (D-050): SSM Parameter Store (KMS-encrypted
   `SecureString`) for runtime-injectable values + GitHub PR comment / job
   summary for human-readable connection strings. No raw secrets in logs.
4. **Central deploy pipeline error reporting** via the platform Lambda
   `report_error` action (D-055): the Lambda creates a GitHub issue on the
   platform repo. The consumer's onboarding-granted Lambda-invoke permission
   is the only grant needed — uniform pathway, no separate GitHub
   `issues: write` on the consumer side. Gitea is excluded (only the CIAgent
   uses it).
5. **PR comments after every successful stage** so developers always know
   where they stand.
6. **Three platform pipelines**: (1) platform-test (PR, unit + integration +
   schema-validation); (2) primitives-plan (PR, plan-only for all L1
   primitives); (3) patterns-plan (PR, plan-only for all L2 modules).
7. **Release job** on merge to `main`: computes MAJOR.MINOR.PATCH semver,
   creates the tag, then updates (force-moves) or creates the MAJOR.MINOR +
   MAJOR floating tags (D-057). Consumers on `@v1` or `@v1.6` receive updates
   depending on their pinned version.
8. **Platform Lambda** for one-way consumer→platform communication
   (contracts). Onboarding grants the consumer repo's environment the right
   to trigger the Lambda (cross-account IAM). The Lambda ingests contracts
   and stores them in a DynamoDB table `acdl-contracts` (D-051) for
   historical reference, impact analysis, CMDB-style application-state
   queries, and pattern detection. The IAM policy reflects cross-account
   invocation.
9. **Tagging standards** in policy/compliance checks (D-054): a required-tag
   set (`acdl:owner`, `acdl:contract`, `acdl:environment`, `acdl:cost-center`)
   enforced by a Checkov custom YAML rule. Closes the D-043 deferral (the
   SKIPPED `ACDL_TAG_NAMING` placeholder becomes a real check).
10. **Wiz adapter** for security checks (D-052): a stub + schema path that
    translates Wiz API issues → `PolicyCheckResult` records, degrading
    gracefully when unconfigured. Matches the Checkov adapter pattern.
11. **Kyverno adapter** for compliance/security checks (D-053): a
    K8s-native policy adapter that translates Kyverno `PolicyReport` results
    → `PolicyCheckResult` records. Ready but inactive for Terraform-only
    stacks (the platform emits Terraform, not K8s manifests); it activates
    when the GitOps reconciler (roadmap) emits K8s manifests.
12. **Remove the legacy consumer-repos directory** and add validated per-module examples
    (D-058: `modules/<name>/examples/` with `simple.yaml` + `complex.yaml`
    validated in CI) + a new RDS primitive demonstrating multi-engine
    variation (D-059).

## Milestone v1.7 Phases

| Phase | Name | Goal |
|-------|------|------|
| 22 | rename-and-production-static-assets-stack | Rename `static-assets` → `static-assets` everywhere (D-048). Author `cloudfront` + `waf` primitives. Augment `static-assets` to S3 + CloudFront (OAC) + WAF (D-049). Expand adapter. Bump `uses:` to `@v1.6`; create floating `v1.6` + `v1` tags (D-057). |
| 23 | tagging-standards-and-security-adapters | Required-tag set + Checkov custom rule (D-054, D-043 closure). Wiz adapter stub (D-052). Kyverno K8s-native adapter (D-053). Schema engine enum updated. |
| 24 | platform-lambda-and-contract-ingestion | Platform Lambda + DynamoDB `acdl-contracts` table (D-051) + cross-account IAM + onboarding grant. |
| 25 | deploy-pipeline-dx-outputs-and-error-reporting | SSM SecureString + PR comment outputs (D-050). Lambda `report_error` → GitHub issue (D-055). Stage comments after each successful stage. |
| 26 | platform-pipelines-and-release-automation | 3 platform pipelines (platform-test, primitives-plan, patterns-plan). Release job with semver + MAJOR.MINOR/MAJOR tag updates (D-057). |
| 27 | remove-legacy-consumer-repos-and-module-documentation-examples | Delete the legacy consumer-repos directory. RDS primitive (D-059). Validated per-module examples (D-058). Docs updates. |

Milestone COMPLETE gate: review → ship `v1.7.0` (feature milestone, next
minor per ship.md — v1.6 shipped `v1.6.0`) → audit.

## Objective for Milestone v1.8 (active)

P1 remediation + uptime monitoring + engineering standards + encryption
and deletion-protection by default + decommission alias + documentation.
The v1.7 milestone shipped production platform + contract ingestion but
left 8 P1 issues flagged for post-hoc review. v1.8 clears all of them
AND delivers three user-directed feature/NFR tracks (2026-07-22):

**Track 1 — P1 Remediation (Phases 28–30):**
Clear all 8 pending P1 issues from v1.5/v1.6/v1.7 verify reviews:
- P1-3: SSM uses AWS-managed key silently → fail loud without CMK config
- P1-4: WAF custom rules emit invalid HCL (attribute vs block syntax)
- P1-5: WAF default_action input silently ignored
- P1-6: consumer_invoke_policy.json has placeholder account ID
- P1-7: L2 composition outputs section not implemented in resolver
- P1-8: terraform/spike/*.tf overwritten by run_platform.sh (state
  contamination)
- P1-9: GitHub API URLs hardcoded in contract_ingestor.py (Gitea fails
  silently)
- S1: Deploy workflow static-key override not wired (passes ACDL_AWS_*
  env vars to configure-aws-credentials which reads AWS_*/its own inputs)

**Track 2 — Encryption + Deletion Protection by Default (Phases 31–32):**
All primitives encrypted by default (CMK priority + SSE, managed KMS
fallback). Per-stack CMK (one key per L2 deployment, 90-day rotation,
no shared keys). Deletion protection on by default for every primitive.
L2 modules expose a feature flag to turn off deletion protection. A
decommission alias uses a 2-step pipeline (disable deletion protection
→ zero counts → destroy) with HITL SRE gates and CMDB-validated change
request ID.

**Track 3 — Uptime + Standards + Docs (Phases 33–36):**
A new uptime-kuma primitive (ECS Fargate) deployed by default after any
L2 module deploy (separate terraform state), with a feature flag to
disable. Monitored endpoints passed from L2 outputs. Alert channels
(Teams/email/SMS/GitHub issues). The uptime URL published to consumers
via PR comments. Engineering standards for L1 + L2 module authoring
(scanned from current modules, stored in modules/). READMEs for
schemas/, adapters/, pipelines/ paths documenting how to write, wire,
and test each.

## Milestone v1.8 Phases

| Phase | Name | Goal |
|-------|------|------|
| 28 | adapter-waf-and-resolver-outputs | Fix WAF HCL emission (nested rules blocks + default_action input) + implement L2 composition outputs in resolver + adapter output blocks. P1-4, P1-5, P1-7. |
| 29 | ssm-kms-and-invoke-policy | SSM publisher fails loud without CMK (escape hatch for local) + Terraform-rendered consumer_invoke_policy (no placeholder account ID). P1-3, P1-6. |
| 30 | run-platform-isolation-and-api-portability | Adapter output to per-run temp dir (remove committed spike .tf) + forge-agnostic API URLs + deploy.yml static-key override wired. P1-8, P1-9, S1. |
| 31 | encryption-by-default-and-per-stack-cmk | KMS-key primitive + per-stack CMK wired in L2 modules + encryption NFRs on all primitives + managed KMS fallback. |
| 32 | deletion-protection-by-default-and-l2-feature-flag | Deletion protection NFR on all primitives (default true) + L2 feature flag + contract schema update. |
| 33 | uptime-kuma-primitive | Uptime L1 primitive (ECS Fargate, feature flag, monitored endpoints, alert channels) + deploy-uptime pipeline stage (separate state) + URL published via PR comment. |
| 34 | decommission-alias-and-cmdb-validation | Decommission mode on deploy pipeline (2-step: disable deletion protection → zero counts, HITL SRE gates) + DynamoDB CMDB validation + consumer guide docs. |
| 35 | module-engineering-standards | modules/STANDARDS.md (L1+L2 authoring + review standards scanned from current modules) + catalog index fix + template update + automated standards test. |
| 36 | schemas-adapters-pipelines-readmes | schemas/README.md + pipelines/README.md + adapters/README.md (how to write, wire, test, dependencies). |
| 37 | verify | 4-layer verification of all v1.8 phases. |
| 38 | review-audit-complete | Multi-persona review + audit + milestone completion (tag v1.8.0). |

Milestone COMPLETE gate: review → ship `v1.8.0` (feature milestone, next
minor per run.md — v1.7 shipped `v1.7.0`) → audit.

## Objective for Milestone v1.9 (complete, tag `v1.9.0`)

Production-grade progression: contract interpolation, per-environment
promotion without field editing, stub implementation, and P1-1
remediation. The v1.8 milestone shipped encryption/deletion-protection by
default, uptime, decommission, and engineering standards but left four
gaps that v1.9 closes (user-directed, 2026-07-23):

1. **Design doc refresh.** `core/hitl_matrix_design.md` and
   `core/audit_ledger_design.md` are stale — both still describe the
   v1.1 spike scope ("dev-only; HITL not exercised"; "spike scope =
   hash chain + outbox write; Object Lock + JWS are v1.2"). v1.9 brings
   them up to date with the shipped v1.8 platform and the v1.9 wiring.
2. **Contract interpolation (variable expansion).** Contracts cannot
   reference environment onboarding values today — bucket names, account
   IDs, regions are hardcoded literals. v1.9 adds `${env.<field>}` and
   `${contract.<field>}` expansion in the resolver, sourced from the
   environment onboarding JSON. Naming patterns like
   `acdl-${env.environment}-${contract.module}-${env.account_id}-${env.region}`
   become expressible. The S3 bucket naming-pattern requirement is the
   binding example.
3. **Per-environment CI jobs (no field editing for promotion).** Today a
   promotion dev → qa requires editing the `environment:` field in the
   contract YAML. v1.9 ships a hybrid model: (a) per-environment contract
   files (`.acdl/static-assets.dev.yaml`, `...qa.yaml`, etc.) and (b) an
   `environment` `workflow_call` input on the reusable deploy workflow
   that overrides the contract's environment at load time. There is one
   CI job per environment, each pointing at its respective contract (or
   the same contract + the env input). Promotion = running the matching
   job; no field editing.
4. **Stub implementation.** Identify and implement the stubbed
   functionality: `separation_of_duties.route_halt_artifact` (logs only →
   real SNS + outbox event); HITL qa/prod/dr pre-execution attestation
   gates (only decommission SRE gates are wired today); the full
   8-concern attestation matrix (offline-testable subset implemented;
   operator-supplied concerns accept signed evidence artifacts); the Wiz
   adapter (stub → real API client with graceful degrade); the Kyverno
   adapter (fleshed out translator, still inactive for Terraform-only
   stacks). The audit-ledger S3 Object Lock + JWS + async worker + DLQ +
   daily checkpoints build-out is **deferred** to a future milestone
   (D-083) — it requires non-offline-testable AWS infra (Object Lock
   bucket, KMS signing key, SQS DLQ, Lambda worker).
5. **Post-hoc requirement from previous milestones.** P1-1 from the v1.2
   review (adapter ECS/ALB/VPC hardcoded defaults — `desired_count = 1`,
   `launch_type = "FARGATE"`, `target_type = "ip"`,
   `load_balancer_type = "application"`, `family = "app"`, `Name = ...`
   — should be parameterized via the L1 interfaces, deferred to v1.3,
   never implemented) is closed. The adapter becomes a thin translator;
   the defaults move into `interface.json` inputs.

The milestone also reconstructs `.ciagent/REVIEW.md`, which still holds
v1.2 review content (v1.3–v1.8 reviews were not persisted). The v1.9
review overwrites it with current milestone content; a note records the
historical gap (no git-history rewrite).

## Milestone v1.9 Phases

| Phase | Name | Goal |
|-------|------|------|
| 39 | design-doc-refresh-and-p1-1-parameterization | Refresh `hitl_matrix_design.md` + `audit_ledger_design.md` to current. Move adapter ECS/ALB/VPC hardcoded defaults into L1 `interface.json` inputs (P1-1 closure). |
| 40 | contract-interpolation | `${env.<field>}` + `${contract.<field>}` resolver expansion from environment onboarding JSON. Environment JSON schema. Sample contracts use naming patterns (region + account id + environment). |
| 41 | per-environment-ci-jobs | Per-env contract files + `environment` workflow_call input on the deploy workflow. 1 CI job per environment (dev/qa/prod/dr), each pointing at its respective contract. HITL attestation gate structure wired (qa/prod/dr). |
| 42 | stub-implementation | `route_halt_artifact` real (SNS + outbox). HITL qa/prod/dr attestation gates. 8-concern attestation matrix (offline-testable subset). Wiz real client. Kyverno translator fleshed out. |
| 43 | verify-review-audit-complete | 4-layer verify. Multi-persona review. Audit. Complete v1.9 (tag `v1.9.0`, floating tags, `uses:` bump `@v1.6` → `@v1.9`). |

Milestone COMPLETE gate: review → ship `v1.9.0` (feature milestone, next
minor per run.md — v1.8 shipped `v1.8.0`) → audit.

## Patch v1.9.1 (complete, tag `v1.9.1`)

Docs-only NFR patch on the v1.9 line. Two leadership-facing presentation
decks (How the Platform Works + The Developer Experience) for senior
leadership (CTO, Head of Cloud, Head of Infrastructure, Head of DevOps).
Each deck has a full markdown source of truth (with speaker notes + mermaid
diagrams) and a lean Marp deck (no speaker notes, embedded PNG diagrams). A
README documents the 3-step slide creation process (full markdown → Marp
synthesis → PPTX export) with conventions, build commands, and maturity
framing rules. No code changes; 494 tests pass; `run_ci.sh` +
`run_platform.sh --check-only` green.

## Patch v1.9.2 (complete, tag `v1.9.2`)

Docs-only NFR patch on the v1.9 line. Applies the S&P Global Energy brand
visual identity to both Marp presentation decks. Brand colors extracted
from the live spglobal.com compiled Tailwind CSS and SVG logo: red-core
`#D6002A`, grey-90 `#1B1B1B`, grey-80 `#2E2E2E`, grey-5 `#F0F0F0`, Akkurat
Pro corporate typeface. Title headers changed to full platform name.
Footer changed from 'Confidential · For Senior Leadership' to 'Internal'.
Title slide subtitle removed. Last DX slide renamed from 'The Outcome for
Leadership' to 'The Desired Outcomes'. Marp `theme: default` kept as base.
No code changes; 494 tests pass; `run_ci.sh` + `run_platform.sh --check-only`
green.

## Patch v1.9.3 (complete, tag `v1.9.3`)

Docs-only NFR patch on the v1.9 line. Renders both Marp presentation decks
to self-contained HTML (committed to `docs/presentations/`, base64-embedded
images, full S&P Global Energy brand theme) and PPTX (uploaded to the Gitea
release as downloadable attachments). The HTML files are viewable in any
browser and on the git forge — they render the red accent bar, dark
title-slide background, red H1 headings, and Akkurat Pro font stack. README
updated to document HTML as committed artifacts (re-render when Marp source
changes) and PPTX as release attachments (binary, not committed to git).
No code changes; 494 tests pass; `run_ci.sh` + `run_platform.sh --check-only`
green.

## Patch v1.9.4 (complete, tag `v1.9.4`)

Docs-only NFR patch on the v1.9 line. Two categories of changes:

1. **Presentation slide updates** — title slide redesigned (deck title as H1
   slightly bigger, 'Agentic Cloud Delivery Platform' as H3 subtitle on dark
   background). DX deck: removed Local Reproducibility slide (not beneficial
   for DX narrative), redesigned Safe Promotion Path with side-by-side
   HTML table layout for Approaches A and B, 'an agent' → 'an AI agent' on
   slides 2 and 3, What a Developer Does diagram floated to the right side.
   Running header simplified to just the deck name.

2. **Complete removal of a compliance framework** — all references to a
   specific healthcare compliance framework removed from 25 files
   across the codebase: presentation source files (Marp + full markdown),
   all module READMEs (S3, RDS, ECR, ECS, VPC, IAM, KMS, CloudFront, ALB,
   uptime), top-level README, consumer guide, docs index, module standards.
   Compliance milestone lists now read: GDPR, SOX, SOC2, DORA. All section
   references from that framework removed from compliance annotations.
   Rendered HTML decks re-generated from updated Marp source.

No code changes; 494 tests pass; `run_ci.sh` + `run_platform.sh --check-only`
green. PPTX files uploaded to Gitea release.

## Patch v1.9.5 (complete, tag `v1.9.5`)

Docs-only NFR patch on the v1.9 line. 9 requirements implemented:

1. DX closing slide strengthened with 'Infrastructure as a utility, not a
   craft' bullet — conveys the full vision (infrastructure consumed, not
   maintained; platform compounds value over time).
2. PW Problem slide: 'moving a merged change' → 'promoting a change'.
3. PW Problem slide: added 'Red tape' and 'Scalability without increasing
   headcount' bullets (4 frictions, not 2).
4. PW Roadmap slide: redesigned with side-by-side HTML table layout
   (Testing | Planned), 16px font, no overflow.
5. PW deck: new slide 'What This Platform Is — and Isn't' after North Star
   (sovereign boundary, infrastructure as utility, 4 anti-goals). PW deck
   now 16 slides.
6. Maturity nomenclature: 'Available today'/'shipped' → 'Testing' across
   both decks + source markdown. New .testing badge (blue/teal). The
   platform has 0 consumer adoption — 'shipped' was inaccurate.
7. Global: 'substrate' → 'engine' across entire project (88 matches, 30+
   files including .ciagent/, docs/, modules/, adapters/, schemas/, code).
8. Presentation files only: 'forge' → 'VCS' (6 occurrences in 4 files).
   'forge' retained in all technical docs and code.
9. New .agentic badge (purple/violet) appended to agentic features in both
   decks: confidence signal, autonomous dev, pattern recognition, dynamic
   module creation, citizen developer surface, auto-promotion.

Also: Change Request ID format changed from 'CR-2026-001' to 'CHG0678912'
across presentation files, consumer guide, and test fixtures.

No code changes (test fixture strings only); 494 tests pass; `run_ci.sh` +
`run_platform.sh --check-only` green. PPTX files uploaded to Gitea release.

## Patch v1.9.6 (complete, tag `v1.9.6`)

Docs-only NFR patch on the v1.9 line. Both Marp presentation decks
consolidated to 10 high-impact slides each — every slide high-impact, fluff
eliminated.

**How The Platform Works (16 → 10):**
- Merged Problem + North Star + What It Is/Isn't → 1 slide (4 frictions →
  North Star → 3 success criteria → 2 anti-goals)
- Merged Policy & Security + Secure by Default → 'Security by Construction'
- Merged Immutable Audit + Human-in-the-Loop → 'Accountability & Audit'
- Folded Observability, Platform-Managed Environments, Portability into
  existing slides as bullets
- Added 'The Vision Realized' closing slide

**The Developer Experience (15 → 10):**
- Merged What Dev Does + Contract + No Platform Code → 'The Contract — The
  Entire Consumer Surface'
- Merged Instant Feedback + Deploy Outputs → 'The Developer Feedback Loop'
- Merged Safe Promotion Path + Rising Bar → 1 slide
- Cut Citizen Developer Experience standalone (mentioned on slides 2 + 10)
- Kept Versioned Releases, Friendly Onboarding, Safe Decommission

**Also:** Removed '5-line YAML' claim from both decks (credibility — complex
stacks require more lines). Source markdown files unchanged (remain complete
reference with speaker notes for all original slides).

No code changes; 494 tests pass; `run_ci.sh` + `run_platform.sh --check-only`
green. PPTX files uploaded to Gitea release.

## Patch v1.9.7 (complete, tag `v1.9.7`)

Docs-only NFR patch on the v1.9 line. Created two talking points markdown
files — one per deck — distilling the source of truth (speaker notes +
content) into presenter-ready cues indexed by the Marp deck's 10-slide
structure. Each file has one section per Marp slide with 3-6 talking point
bullets (punchy, actionable cues) + a key takeaway per slide. The talking
points are the middle layer between the source of truth (full detail) and
the Marp deck (what the audience sees). README updated from 3-step to 4-step
process (added Step 4: talking points), with updated diagram, directory
layout, checklist, and decks table.

No code changes; 494 tests pass; `run_ci.sh` + `run_platform.sh --check-only`
green.

## Patch v1.9.8 (complete, tag `v1.9.8`)

Docs-only NFR patch on the v1.9 line. Major presentation rework based on
leadership feedback. 6 new mermaid diagrams created and rendered to PNG:
scope boundary (x2 — one per deck, showing upstream → contract → ACDL →
AWS), confidence signal (6 inputs → weighted sum → threshold gate →
proceed/halt), attestation flow (deploy → gate → approver → evidence),
promotion journey (dev → qa → prod → dr with rising thresholds), and road
to the North Star (phased timeline v1.0 → v1.9 → v1.10 → v2.0 → North Star).

Both Marp decks restructured to 10 main + 6 appendix slides (PW: 17 total,
DX: 16 total). Key changes:

1. NEW scope slide ("Where ACDL Sits in Your World") clarifying ACDL is
   infrastructure only. Upstream is anything (IDE, agentic SDLC, citizen
   dev vibe coding). ACDL provisions and governs AWS resources; application
   deployment is upstream.
2. Contract examples fixed: `image:` field removed, replaced with
   infrastructure inputs (cpu, memory, desired_count, port).
3. Story arc: every slide has an italic story beat line connecting the
   narrative progression.
4. Confidence signal diagram added (slide 7) showing 6 inputs → score →
   gate. Clarified: manually tuned weights, observable inputs, auditable
   breakdown.
5. Attestation flow diagram added (slide 9) showing deploy → gate →
   approver reviews → attestation recorded → evidence. QA clarification
   added: QA attests to infrastructure readiness (contract + Terraform plan
   + evidence), not application code.
6. QA attestation reclassified: "Design tested" → "Planned". Dev autonomous
   = Testing. qa/prod/dr attestation = Planned.
7. DX deck: Two Consumer Surfaces slide replaced by scope boundary slide
   showing both consumer paths. Promotion journey diagram added.
8. Rising bar table annotated: dev=Testing, qa/prod/dr=Planned.
9. Appendix (6 slides per deck): TOC, detail-heavy slides moved from main
   deck, Road to the North Star phased timeline (annotated "proposed
   phasing, not formally planned"), full Testing vs. Planned inventory,
   glossary.
10. Old two-surfaces diagram replaced by scope boundary diagram.

Source markdown, talking points, and README all updated to mirror the new
structure. Also includes scripts/sync_to_gl.sh (GitLab mirror sync
utility, unrelated to presentations).

No code changes; 494 tests pass; `run_ci.sh` + `run_platform.sh --check-only`
green. PPTX files uploaded to Gitea release.

## Requirements

### v1.0 (Prior milestone — the demo)

Status: complete. Tag `v1.1.0`. All REQ-01..15 satisfied by the stub-driven
executive demo. See `REQUIREMENTS.md` §v1 and the prior decisions table
appendix below. The demo is **archived** to `demo/` in Phase 06.

### v1.1 (Prior milestone — architecture finalization + v1 spike, complete)

New requirements REQ-16..REQ-28 — see `REQUIREMENTS.md` §v1.1. Summary:

- **REQ-16:** Architecture finalized to v1.0 (11 open decisions resolved).
- **REQ-17:** Target Stack IR defined as JSON Schema; engine-agnostic.
- **REQ-18:** PolicyCheckResult normalized schema defined; Checkov adapter.
- **REQ-19:** Six-input confidence signal specified with per-env thresholds
  (dev 0.50 / qa 0.75 / prod 0.90 / dr 0.95) and severity→penalty mapping.
- **REQ-20:** Tiered audit ledger design (S3 Object Lock 7-yr + DynamoDB
  outbox, RPO=0, JWS detached signatures, `prev_event_hash` chain).
- **REQ-21:** Full 8-concern HITL matrix + separation-of-duties design
  (CODEOWNERS + DynamoDB identity-distinctness).
- **REQ-22:** Contract schema (JSON Schema draft 2020-12) with per-env
  mandatory/optional inputs and `profile: agentic` marker for L3B.
- **REQ-23:** AWS OIDC bootstrap (IAM role + trust policy for act_runner);
  the long-lived key is used once then rotated (waiver D-034).
- **REQ-24:** One real L1 module (`l1-s3`) with an IR-typed interface.
- **REQ-25:** One real L2 thin-composition (`l2-static-assets`) referencing
  `l1-s3`.
- **REQ-26:** Terraform adapter compiles the IR to a real `terraform plan`
  against AWS via OIDC; state in S3 + DynamoDB.
- **REQ-27:** One end-to-end contract submission → contract→IR resolution →
  `terraform plan` → Checkov → confidence signal → evidence event to outbox.
- **REQ-28:** Spike verification proves the IR-shaped commitments hold (no
  polyglot mess; the adapter is the only engine-specific code).

### v1.2 (Prior milestone — platform hardening + first real consumer deployment, complete)

New requirements REQ-29..REQ-35 — see `REQUIREMENTS.md` §v1.2. Summary:

- **REQ-29:** README.md fully documents the v1.1-complete platform: spike
  flow, how to run, repo layout, v1.2 objective.
- **REQ-30:** NFR hardening — least-privilege IAM audit, idempotent
  bootstrap, consolidated `run_platform.sh`, error handling, P1-1/P1-B
  redaction.
- **REQ-31:** L1 catalog expanded for ECS — 6 new IR-typed L1s
  (`l1-vpc`, `l1-ecs-cluster`, `l1-ecs-service`, `l1-iam-role`, `l1-alb`,
  `l1-ecr`) registered and adapter-compiled.
- **REQ-32:** `l2-microservice` thin-composition + contract schema extended
  for microservice inputs (image, port, env, healthcheck).
- **REQ-33:** `terraform apply` (dev, autonomous) — real provisioning, not
  just `plan`.
- **REQ-34:** Consumer repo `acdl-consumer-microservice` with a basic
  microservice (ECR image, Dockerfile, contract).
- **REQ-35:** End-to-end verification — consumer commit → live ECS service
  (HTTP 200) → evidence event → timeline.

### v1.4 (Prior milestone — central pipeline contract + shell reproducibility + streaming)

New requirements REQ-43..REQ-45 — see `REQUIREMENTS.md` §v1.4. Summary:

- **REQ-43:** Central pipeline contract — `schemas/pipeline.schema.json` +
  `pipelines/ci.yaml`. Both Gitea and GitHub workflows implement the
  contract; a test validates conformance.
- **REQ-44:** `scripts/run_ci.sh` mirrors the CI pipeline locally (lint →
  test → check-only), exiting 0 with "CI PIPELINE OK".
- **REQ-45:** `scripts/run_platform.sh` streams terraform/checkov output by
  default (with `--quiet` for log-only mode). Both workflows byte-identical.

## Key Decisions (v1.9)

Resolved at the CLARIFY stage (full autonomy — all within locked
constraints or user-directed scope). New v1.9 decisions (numbered
D-080+ to avoid collision with v1.8 research decisions D-073..D-077):

| ID | Decision | Rationale | Outcome |
|----|----------|-----------|---------|
| D-080 | New milestone v1.9 (feature); ship tag `v1.9.0`. | v1.8 is complete (audit PASS, tag v1.8.0). The work (design doc updates + interpolation + per-env CI + stubs + P1-1) is a new feature milestone, not v1.8 post-hoc patching. | 5 phases (39–43) in one milestone. |
| D-081 | Interpolation syntax: `${env.<field>}` + `${contract.<field>}` (dotted paths supported, e.g. `${env.state_backend.bucket}`). Expanded by the resolver post-schema-validation, pre-IR-resolution. Fail loud on unresolved tokens (`ValueError`). | Shell-style syntax is familiar, unambiguous, and has no conflict with YAML or the contract schema. The `env` context is the loaded environment onboarding JSON; `contract` is the contract dict. | Phase 40 implements the expansion + environment JSON schema. |
| D-082 | Hybrid per-environment promotion model: (a) per-env contract files AND (b) an `environment` `workflow_call` input on the reusable deploy workflow that overrides the contract's environment at load time. One CI job per environment. | User chose to support both shapes. Per-env contracts let env-specific values differ via interpolation; the env input lets a single contract be promoted without editing. Promotion = running the matching job; no `environment:` field editing. | Phase 41 ships per-env contracts + the env input + caller-workflow docs. |
| D-083 | Audit ledger S3 Object Lock + JWS detached signatures + async worker + DLQ + daily checkpoints **deferred** to a future milestone. | Requires non-offline-testable AWS infra (Object Lock bucket, KMS signing key, SQS DLQ, Lambda worker). The hash-chain + DynamoDB-outbox path remains the v1.9 production audit record. `audit_ledger_design.md` marks this clearly. | Phase 39 updates the design doc; no build-out in v1.9. |
| D-084 | 8-concern attestation matrix: offline-testable concerns (contract NFRs, schema validity, policy pass) run for real; operator-supplied concerns (k6 load test, DR drill, FinOps forecast) accept signed evidence artifacts validated for freshness + schema, failing loud if missing/expired for prod/dr. | The platform cannot run live load tests / DR drills / FinOps forecasts inline. Accepting signed evidence artifacts with freshness + schema validation is the regulatorily-defensible middle ground. | Phase 42 implements `core/attestation_matrix.py`. |
| D-085 | P1-1 closure: adapter ECS/ALB/VPC hardcoded defaults (`desired_count = 1`, `launch_type = "FARGATE"`, `target_type = "ip"`, `load_balancer_type = "application"`, `family = "app"`, `Name = ...`) move into L1 `interface.json` inputs with defaults. The adapter reads inputs (falling back to interface defaults) and is a thin translator. | P1-1 was flagged in the v1.2 review (deferred to v1.3, never implemented). Defaults belong in the L1 interface, not the adapter. | Phase 39 closes P1-1. |
| D-086 | `.ciagent/REVIEW.md` reconstructed at v1.9 complete; v1.3–v1.8 reviews noted as not-persisted (no git-history rewrite). | REVIEW.md still holds v1.2 content — later milestone reviews were not persisted or were overwritten. The v1.9 review overwrites it with current content; a note records the historical gap. | Phase 43 reconstructs REVIEW.md. |
| D-090 | No cap on the v1.1→v1.8 capability re-verification sweep. Fix every advertised capability in-sweep; all must end Verified. | The user rejected a phase cap. Unbounded-risk trade-off accepted for full integrity: decks stay frozen until every advertised capability is Verified. Recorded as a traceable decision, not silent scope creep. | Phase 54 executes the sweep under D-090. |
| D-091 | Add a regression-class VERIFY that re-runs capability checks (not just diff checks), at minimum on milestone completion. | VERIFY is currently diff-scoped (structural defect); 8 NFR-patch phases passed while the platform decayed. Without regression memory the pipeline cannot keep the sweep honest. | Phase 52 implements the regression-class VERIFY. |
| D-092 | Build local emulating adapters (flat-file outbox, local ECS emulator, local S3 state, local Lambda stub) so the platform is fully locally testable without cloud credentials. | Required for the sweep's local tier and for durable regression testing without AWS access. Cloud interactions are emulated with flat files in temp folders + local shell. | Phase 53 builds the local emulating adapters. |
| D-093 | Re-verify every v1.1→v1.8 advertised capability. v1.0 demo excluded as archived/superseded. Headline E2E runs both live-AWS and local-emulator tiers (both must pass); all other capabilities run locally via emulating adapters. | Tiered verification: live for cloud-backed headline, local for the rest. The bar is what an exec could see demonstrated. | Phase 54 executes the re-verification sweep. |
| D-094 | Rewrite PROJECT/ROADMAP/decks to match verified reality; decks unfrozen only after this lands. | Decks were sequenced backwards for 8 phases (polish before re-verify). The honest order is re-verify → rewrite → unfreeze. | Phase 55 rewrites docs/decks to verified reality. |

### CLARIFY auto-resolved parameters (full autonomy)

| Parameter | Value | Rationale |
|---|---|---|
| Per-env `qa.json/prod.json/dr.json` account_id | `000000000000` placeholder + stderr warning at load if account_id is `000000000000` and env ≠ dev | Consistent with `dev.json`; prompts real binding without breaking offline tests. |
| SNS topic for `route_halt_artifact` | Defined in `terraform/platform/main.tf` AND code reads `ACDL_SOD_HALT_TOPIC_ARN` | Consistent with the existing Lambda/KMS/Secrets pattern (Terraform defines, code reads env). |

## Constraints

- **Forge:** Gitea at `https://git.cloudinit.dev`, org `continuous-intelligence`.
- **CI runtime:** act_runner / Gitea Actions (reuses GitHub Actions workflow YAML).
- **Cloud:** AWS via OIDC federation. **Long-lived credentials are forbidden**
  (§12.5). The v1.1 spike uses a temporary long-lived key **once** to bootstrap
  OIDC (waiver D-034), then rotates it.
- **Angine:** Terraform adapter in v1 (the only adapter). L1/L2 are
  engine-agnostic in shape; the adapter is the only engine-specific code.
- **State:** S3 (state files) + DynamoDB (locking), single-region in v1.
- **Environments:** dev (autonomous) → qa (QA HITL) → prod (SRE HITL) → dr
  (SRE HITL). **Staging does not exist** (Path A locked).
- **Compute:** abstract / containerized / serverless. No VMs, bare metal, OS
  lifecycle.
- **Autonomy:** Full. Escalation hooks: deploy, delete_data, merge_to_main.

## Anti-Goals (from `docs/vision.md` §7)

- Not an upstream development platform (no product backlogs, IDE, code authorship).
- Not a general-purpose AI (autonomy is narrow, bounded by policy envelopes).
- Not a legacy infrastructure bridge (no VMs/bare metal/OS).
- Not a permissive delivery highway (no escape hatches past confidence or HITL).
- Not a mutable audit log (VCS history ≠ regulatory evidence).

## Context

- The `acdl` repo exists at the org root. `acdl-contracts` and
  `acdl-evidence` exist from the v1.0 demo and continue as the developer
  surface and the audit-timeline host respectively.
- `docs/vision.md` and `docs/architecture.md` (v0.2) are the upstream
  vision/architecture sources, pulled from `origin/main` at the start of v1.1.
- The v1.0 demo (tag `v1.1.0`) is the reference of intent — it proved the
  shape (L1/L2/contract/confidence/evidence/HITL) on stubs. v1.1 replaces the
  stubs with the real platform engine.

## Key Decisions (v1.1)

Carries forward the still-valid v1.0 decisions (see appendix). New v1.1
decisions:

| ID | Decision | Rationale | Outcome |
|----|----------|-----------|---------|
| D-034 | Temporary long-lived AWS key (waiver) used once in Phase 08 to bootstrap the state backend + IAM user; rotated/deactivated immediately after | §12.5 forbids long-lived creds; the bootstrap needed one `aws iam` call before the spike user + rotated key could take over | Spike achieves real `terraform plan` against AWS without violating the locked target after bootstrap. **CLOSED 2026-07-21: root key `AKIA…ROOT-DEACTIVATED` deactivated by the user in the AWS IAM console (verified — `InvalidClientTokenId`); the spike uses the rotated `acdl-spike-runner` key per D-039. Key ID redacted in v1.2 Phase 12 (P1-1).** |
| D-035 | Milestone version = `v1.1` (feature), ship tag `v1.2.0` | Real platform is a breaking reframing of the demo, but treated as the next incremental milestone per user choice; ship.md: feature milestone → next minor | Tag `v1.2.0` on milestone COMPLETE |
| D-036 | Spike picks `l1-s3` + `l2-static-assets` | Simplest real AWS resource (no IAM/network deps); smallest real `terraform plan`; proves the IR + adapter end-to-end | Spike scope fixed |
| D-037 | Demo archived to `demo/` (not deleted) | Preserves the working v1.0 demo as intent reference; new platform layout under `platform/`, `schemas/`, `adapters/`, `terraform/`, `modules-ir/` | No churn on demo code; clean separation |
| D-038 | Open decisions resolved in "accept recommendations + decide rest" mode | User-locked mode: accept architecture's stated recommendations (W1.A, W1.B, W2.A, BA.A); lead-developer decides the remaining 8 (W3.D, W3.E, BA.B, BA.C, BA.D, BA.E, BA.F, OpenTofu timing) with rationale | Architecture reaches v1.0 in Phase 07 |
| D-039 | Spike-only waiver: per-run-rotated long-lived AWS key. OIDC federation deferred to v1.2, blocked on go-gitea/gitea#36988. | **RESEARCH TARGET 1 verdict (conf 0.95):** Gitea Actions does NOT support `id-token: write` / OIDC token issuance as of Gitea 1.27.x / gitea-runner v2.1.0. GitHub's OIDC pattern is not portable. The waiver satisfies §12.5's *intent* (no persistent long-lived key) for the spike: the key is rotated after each run by `scripts/rotate_spike_key.sh`. v1.2 implements real OIDC when the Gitea PR merges. | Spike achieves real `terraform plan` against AWS without a *persistently* long-lived key; real OIDC is a v1.2 deliverable |
| D-040 | The 6 confidence-signal inputs are: policy (0.30), validation (0.25), freshness (0.10), source (0.15), history (0.10), nfrs (0.10). Weights frozen for v1, tuned in v1.2 alongside thresholds (BA.B). | Architecture §8 locks "six canonical inputs" but does not enumerate them; RESEARCH TARGET 6 chose the platform-computable subset present in every environment (incl. dev). | Confidence signal (Phase 10) has a concrete input enumeration |
| D-041 | Spike audit ledger = v1.0 hash chain + DynamoDB outbox + `acdl-evidence` mirror. S3 Object Lock (compliance mode, 7-yr) + JWS (platform KMS key, quarterly rotation) + daily checkpoints are v1.2 build-out, authored as design in Phase 07. | REQ-20 is "design authored," not "implemented." The spike proves the outbox write path; the regulatory ledger is v1.2. | Spike scope stays bounded; REQ-20 satisfied by the Phase 07 design doc |
| D-042 | HITL approver identity in Gitea = `gitea.actor` of the `workflow_dispatch` run that sets `approve_qa=true`/`approve_prod=true`/`approve_dr=true`. Separation-of-duties reads `approver_qa` from the DynamoDB outbox and compares to the prod-dispatch `gitea.actor`. | Gitea has no Environments API (re-confirmed in RESEARCH); `gitea.actor` is the only approval-identity signal. | SoD design (Phase 07) is concrete for the Gitea forge |
| D-043 | Tag/naming compliance deferred for the spike: the Checkov adapter emits a single `SKIPPED` PolicyCheckResult (`ruleId: ACDL_TAG_NAMING`, `severity: info`) so the confidence policy input is non-empty. Custom Checkov YAML rule lands in v1.2. | Checkov has no built-in tag-presence check; a custom rule in the spike is scope creep. | Spike's policy input is non-empty without a custom-rule dependency |
| D-044 | DynamoDB outbox = `PAY_PER_REQUEST`; PK `contractId`, SK `eventType#eventTs`, TTL `expire_at` = now + 365d. No separate async worker/DLQ in the spike (RTO = workflow re-run); v1.2 outbox worker + DLQ is a Phase 07 design artifact. | On-demand is zero-cost-at-idle for the spike's single dev submission. | Spike outbox is minimal; v1.2 worker design authored in Phase 07 |
| D-045 | Runner tooling: `runs-on: ubuntu-latest`; install `terraform` via HashiCorp apt repo (pin `1.9.*`), `checkov` via pip (pin `>=3.2,<4`, `--break-system-packages`). Neither is pre-installed on the default runner image. | RESEARCH TARGET 2; pinning avoids mid-spike version drift. | Phase 09/10 workflows have a concrete setup step |
| D-046 | `act_runner` → `gitea-runner` rename: Phase 07 updates docs to use the current name `gitea-runner` (renamed 2026-04 in gitea/runner#850). | RESEARCH TARGET 1 + R-4: naming drift between v1.0 docs and the current runner. | Docs reflect the current binary name |
| D-047 | v1.2 carries forward the D-039 per-run-rotated-key waiver. Real OIDC federation remains deferred to v1.3+, blocked on go-gitea/gitea#36988 (re-checked 2026-07-21: still **open**, last updated 2026-05-27, not merged). | §12.5 forbids long-lived creds; the Gitea Actions OIDC provider is still not merged. The waiver continues to satisfy §12.5's *intent* (no *persistently* long-lived key) for v1.2: `scripts/rotate_spike_key.sh` rotates the key, and Phase 12 tightens the IAM scoping + rotation hygiene. | v1.2 achieves `terraform apply` against AWS without a persistently long-lived key; real OIDC is a v1.3+ deliverable. |

## Key Decisions (v1.8)

Resolved at the CLARIFY stage (full autonomy — all within locked
constraints or user-directed scope). New v1.8 decisions:

| ID | Decision | Rationale | Outcome |
|----|----------|-----------|---------|
| D-061 | Fold all 3 new requirements into v1.8 alongside P1 fixes. | User chose single milestone. v1.8 becomes a feature milestone (ship tag v1.8.0, minor bump). | 11 phases (28–38) in one milestone. |
| D-062 | P1-3: SSM publisher fails loud (`RuntimeError`) when `ACDL_KMS_KEY_ID` unset. `ACDL_ALLOW_DEFAULT_KMS=1` escape hatch for local testing. | User chose fail loud. Silent AWS-managed-key use is the security gap; callers must set the env. | Phase 29 implements fail-loud + escape hatch. |
| D-063 | P1-6: `consumer_invoke_policy.json` rendered via Terraform `data.aws_caller_identity` + `templatestring` at apply time. | User chose Terraform-rendered. No committed account ID; no stale placeholder. | Phase 29 converts JSON to TF-rendered template. |
| D-064 | P1-8: Remove committed `terraform/spike/*.tf` entirely; adapter emits to per-run temp dir. | User chose remove. Cleaner; no stale fixtures. | Phase 30 removes files + changes run_platform.sh target. |
| D-065 | S1: Single conditional `configure-aws-credentials` step (OIDC when no static key, access-key/secret-key inputs when static key present). | User chose single conditional step. Cleaner workflow YAML. | Phase 30 restructures the deploy workflow step. |
| D-066 | Uptime deployment target: ECS Fargate (reuse existing ecs-cluster + ecs-service + alb primitives). | User chose ECS Fargate. Most consistent with current platform; ALB gives a stable URL. | Phase 33 authors uptime primitive on ECS Fargate. |
| D-067 | Uptime trigger: new `deploy-uptime` pipeline stage after `publish-outputs`. Separate terraform state (S3 key prefix `uptime/`). | User chose pipeline stage. Most integrated with existing flow. | Phase 33 adds the pipeline stage + separate state. |
| D-068 | CMDB = DynamoDB `acdl-change-requests` table (PK changeRequestId, SK submittedAt). | User chose DynamoDB. Consistent with existing platform Lambda + DynamoDB pattern. | Phase 34 adds the table + `validate_change_request` Lambda action. |
| D-069 | Encryption key granularity: per-stack CMK (one key per L2 deployment, tagged with acdl:owner + acdl:environment). | User chose per-stack. No shared keys across stacks; 90-day rotation at creation. | Phase 31 authors kms-key primitive + L2 wiring. |
| D-070 | Decommission: new mode on the existing deploy pipeline (`mode: decommission`). 2-step with HITL SRE gates. | User chose existing pipeline with different behavior. Plan/apply to disable deletion protection (HITL SRE gate) → plan/apply with counts=0 (second HITL SRE gate). Documented in consumer guide. | Phase 34 adds decommission mode + HITL gates. |
| D-071 | `uses:`/`ref:` bump from `@v1.6` to `@v1.8` at milestone COMPLETE. | Consumer-facing version tracks the last released MAJOR.MINOR. | Phase 38 bumps references + creates floating `v1.8` + `v1` tags. |
| D-072 | Managed KMS fallback for standalone L1 deployments (no L2 CMK): adapter uses `alias/aws/<service>` with a stderr warning. `kms_key_arn` input is optional everywhere; `encryption_enabled` NFR defaults to true. | Requirement says "prioritize CMKs, fallback to managed KMS". Standalone L1s don't have a per-stack CMK. | Phase 31 implements fallback + warning. |

## Key Decisions (v1.7)

Resolved at the CLARIFY stage (full autonomy — all within locked constraints
or user-directed scope). New v1.7 decisions:

| ID | Decision | Rationale | Outcome |
|----|----------|-----------|---------|
| D-048 | Rename `static-assets` → `static-assets`: **rewrite all occurrences** including verbatim historical phase descriptions in `.ciagent/` (ROADMAP, REQUIREMENTS, RESEARCH, decision tables), overriding the v1.6 audit precedent that preserved some historical references. | User chose full rewrite. Maximally consistent; the reconstruction test is updated to expect `static-assets` throughout. | Phase 22 rewrites every `static-assets` string to `static-assets`; no preserved historical tokens remain. |
| D-049 | Production static-assets stack = S3 + CloudFront (OAC) + WAF. | Self-contained, domain-free production edge. Route53/ACM are domain-dependent (consumer-supplied) and deferred to documented extension points / a complex example. | Phase 22 authors `cloudfront` + `waf` primitives and augments the module. |
| D-050 | Deploy outputs: SSM Parameter Store (`SecureString`, KMS-encrypted, namespaced `/acdl/{env}/{contractId}/{output_name}`) for runtime-injectable values + GitHub PR comment / job summary for human-readable connection strings. | Two canonical mechanisms: SSM for resources that read at runtime; PR comment for developers. No raw secrets in logs. | Phase 25 implements `core/output_publisher.py` + two new pipeline stages. |
| D-051 | Contract ingestion storage = DynamoDB table `acdl-contracts` (PK `consumerRepo`, SK `contractId#submittedAt`, SSE via customer-managed CMK, point-in-time recovery). | Enables historical queries, impact analysis, CMDB-style application-state queries, and pattern detection via DynamoDB queries. S3 flat-file mirror deferred (DynamoDB is sufficient for v1.7). | Phase 24 defines the table + Lambda. |
| D-052 | Wiz adapter = stub + schema path (no live Wiz tenant in CI). | Matches the Checkov adapter pattern; typed interface, offline-testable, degrades gracefully when unconfigured (emits `WIZ_NOT_CONFIGURED` SKIPPED record). | Phase 23 authors `adapters/wiz/wiz_adapter.py`. |
| D-053 | Kyverno adapter = K8s-native policy adapter translating `PolicyReport` results → `PolicyCheckResult`. Ready but inactive for Terraform-only stacks. | The platform emits Terraform, not K8s manifests. The adapter activates when the GitOps reconciler (roadmap) emits K8s manifests. Sample policies included as documentation. | Phase 23 authors `adapters/kyverno/kyverno_adapter.py` + sample policies. |
| D-054 | Tagging standard = required-tag set (`acdl:owner`, `acdl:contract`, `acdl:environment`, `acdl:cost-center`) enforced by a Checkov custom YAML rule. | Closes the D-043 deferral (the SKIPPED `ACDL_TAG_NAMING` placeholder becomes a real check). Naming-convention regex deferred (brittle across AWS resource types). | Phase 23 authors `schemas/tagging-standard.json` + `adapters/terraform/policy/custom_rules/acdl_tagging.yaml`. |
| D-055 | Error reporting = the platform Lambda `report_error` action creates a GitHub issue on the platform repo (`acdl/acdl`). Uniform communication pathway via the Lambda; the consumer's onboarding-granted Lambda-invoke permission is the only grant needed. No separate GitHub `issues: write` on the consumer side. Gitea is excluded (only the CIAgent uses it; platform engineers and consumers use GitHub). | Unifies requirements 4 + 8 around one mechanism. The Lambda holds a GitHub token (Secrets Manager) scoped to the platform repo. Idempotent (comments on existing open issue rather than duplicating). | Phase 24 prepares the action; Phase 25 implements it + wires the `if: failure()` workflow step. |
| D-056 | Ship `v1.7.0`; bump `uses:`/`ref:` from `@v1.4` to `@v1.6`. | Consumer-facing version tracks the last released MAJOR.MINOR. Consumers on `@v1.4` stay on v1.4 behavior until they bump. | Phase 22 bumps the references. |
| D-057 | The `uses:`/`ref:` bump + floating `v1.6`/`v1` tag creation happen in Phase 22 (pointing at `v1.6.0`), so the reference never points at a non-existent tag. The release job (Phase 26) owns ongoing tag updates. | Sequencing: if Phase 22 bumps `uses:` to `@v1.6` but the tag doesn't exist, the reference is temporarily broken. Creating the tag early (pointing at the last release) fixes this. | Phase 22 creates the floating tags; Phase 26's release job maintains them. |
| D-058 | Module examples = separate validated files in `modules/<name>/examples/` (`simple.yaml` + `complex.yaml` + variation files), validated against `schemas/contract.schema.json` in the platform-test pipeline schema-validation stage. Each module's README `## Examples` section references + excerpts them. | Examples cannot drift from the schema silently. | Phase 27 authors the example files; Phase 26's platform-test pipeline validates them. |
| D-059 | Add an RDS primitive (`modules/l1/rds/`) with an `engine` input (enum: postgres, mysql, etc.) + a multi-engine example demonstrating the variation pattern. | Concrete demonstration of the multi-engine variation the requirement calls out. Adds one primitive + examples. | Phase 27 authors the primitive + adapter expansion + examples. |
| D-060 | (Consolidated into D-058.) | — | — |

### Open-decision resolutions (Phase 07 deliverable — recorded here for traceability)

| ID | Question | Resolution |
|---|---|---|
| W1.A | AI-refinement trigger | **Accept recommendation.** Joint condition: N ≥ 50 consecutive changes with zero rollbacks AND no L1/L2 incident in last 6 months AND Infra & Ops unilateral override. |
| W1.B | Multi-stack edge case rule | **Accept recommendation.** Permitted only for (a) DR-region mirror, (b) time-boxed experimental stack with TTL ≤ 30d, (c) explicit Infra & Ops approval with `multiStack.justification`. |
| W2.A | Tag mutability for prod | **Accept recommendation (Path B).** Tag for dev/qa, SHA for prod. Platform CLI resolves tag→SHA for prod-bound workflows. Justified by the "Audit truth lives outside the repository" bet. |
| BA.A | Initial L3B skill catalog | **Accept recommendation.** 5 skills: web API, worker, scheduled job, static asset, basic observability bootstrap. Addition criteria: (a) reviewable for sensitive data, (b) expressible as a single contract submission, (c) documented use case. |
| W3.D | L1/L2 standard versioning | **Decided.** Semver: interface → MAJOR, behavior → MINOR, lifecycle → PATCH (same as the v1.0 demo D-rule, lifted to the real platform). Pin model: L2 contracts pin L1 by `name@semver`; the resolver picks the highest compatible. Evolution: MAJOR bumps require a new registry entry (immutable publication); old entry enters a 12-month deprecation window. |
| W3.E | Schema mandatory vs optional inputs | **Decided.** Per-env mandatory table: dev requires `stack` + `environment`; qa adds `validation.e2eSuite` + `validation.loadTest`; prod adds `runbook` + `dashboard` + `oncall`; dr adds `drDrillRef`. `inputs` map is always optional. `profile: agentic` fields (`naturalLanguageIntent`, `confidenceAtSubmission`, `agentTrace`) optional everywhere. |
| BA.B | Confidence threshold tuning | **Decided.** Starting thresholds frozen for v1. Tuning begins in v1.2: track FP/FN per environment quarterly; override authority = Infra & Ops + SRE joint sign-off; any override is itself a confidence-event in the audit stream. |
| BA.C | On-call / operational ownership | **Decided.** Platform on-call = Infra & Ops rotation. Escalation: L3A/L3B halt → platform on-call pager (Sev2); consumer-visible outage → consumer on-call (Sev1) with platform on-call support. Consumer on-call relationship is contractual, defined at onboarding (BA.E). |
| BA.D | Cost / capacity governance | **Decided.** Cloud cost owner = Infra & Ops FinOps. Per-contract consumption reported monthly. Runaway spend: hard halt at 120% of contract-declared budget envelope via the confidence signal (cost is one of the 6 inputs); override = FinOps + SRE joint sign-off. |
| BA.E | Consumer onboarding | **Decided.** Two paths: developer (L3A) — `getting-started` walks through contract schema + central pipeline template; citizen developer (L3B) — onboarding grants a scoped agent + skill catalog, no workflow authoring. Both end in a sandbox dev submission that must pass the confidence gate before the consumer is promoted. |
| BA.F | Cross-platform evolution | **Decided.** The contract schema, IR, PolicyCheckResult, confidence signal, and audit stream are portable (engine- and forge-agnostic). Forge-specific code: workflow YAML, OIDC trust, CODEOWNERS, Environments. A second forge (e.g., GitLab) requires a forge adapter + a workflow-template translator; no change to L1/L2/IR/confidence/audit. |
| Q1.3 | OpenTofu timing | **Decided (deferred).** Not in v1 or v1.1. The engine abstraction (§12) makes OpenTofu a future adapter, not an architecture change. Revisit when an OpenTofu adapter is requested; no version committed. |

## Appendix — Prior milestone (v1.0 demo) decisions

The v1.0 demo (tag `v1.1.0`) carried decisions D-001..D-033. They governed
the stub-driven executive demo and remain valid **for the archived demo
under `demo/`**. They are **superseded** by the v1.1 decisions above for the
real platform. Full text preserved in git history at tag `v1.1.0`.

## Operational parameters (CLARIFY auto-resolution, full autonomy)

Resolved at the CLARIFY stage to unblock planning. None require user
sign-off (autonomy = full; all within locked constraints).

| Parameter | Value | Rationale |
|---|---|---|
| AWS region | `us-east-1` | Default; matches v1.0 demo references; single-region in v1 (§12.3) |
| Terraform state bucket | `acdl-tfstate-<account-id>-us-east-1` | Namespaced by account id to avoid collision; region-suffixed |
| Terraform lock table | `acdl-tflock` | DynamoDB; single-region v1 |
| OIDC IAM role | `acdl-act-runner-role` | Assumed by the act_runner via web-identity |
| OIDC trust subject | `repo:continuous-intelligence/acdl:ref:refs/heads/main` (+ phase branches) | Least-privilege; refined in Phase 08 |
| Spike L1 (`l1-s3`) inputs | `bucket_name: string`, `region: string` | Minimal S3 interface per §2 |
| Spike L2 (`l2-static-assets`) | thin-composition referencing `l1-s3` only; depth 1 | Smallest real plan per D-036 |
| Spike contract | `contracts/spike.yaml`: `stack: l2-static-assets`, `environment: dev`, `inputs: { bucket_name: acdl-spike-bucket, region: us-east-1 }` | One end-to-end submission (REQ-27) |
| Spike `terraform` command | `plan` only | `apply` is out of scope (Out of Scope table); HITL-gated in v1.2 |
| Checkov ruleset (spike) | the 4 L2 checks (secrets-in-plaintext, public ingress, IAM wildcard, KMS key reference) + tag/naming | §3 + §12.4; Kyverno/OPA deferred |
| v1.0 tags preserved | `v1.0.1`..`v1.0.5`, `v1.1.0` retained | Immutability; demo archive does not rewrite history |
| Next ship tag | `v1.3.0` | Feature milestone → next minor per ship.md (v1.1 shipped `v1.2.0`; v1.2 ships `v1.3.0`) |

### Items deferred to RESEARCH (not clarifications)

- **Gitea/act_runner OIDC support** — does act_runner emit an OIDC
  `id-token`? Determines whether real-AWS plan is achievable in this
  environment or whether a spike-only waiver is needed. Highest-priority
  research target.
- **Terraform + Checkov availability on the runner image** — install in the
  workflow if missing.
- **`actions/configure-aws-credentials` action on act_runner** — if
  unavailable, fall back to `aws sts assume-role-with-web-identity` from a
  step.

## Objective for Milestone v1.14 (active — NFR Refinement)

Bug fixes, security posture improvements, stub/missing-functionality
identification + implementation, and documentation + NFR refinement across
the entire codebase. **No new features.** This is an NFR milestone — the
final phase's patch IS the deliverable (no separate milestone tag).

The v1.13 line shipped the presentation polish + config.json schema
migration + badge cleanup. The v1.11/v1.12 multi-persona reviews left a
backlog of P1/P2 findings (5 P1 + 4 P2 open in `REVIEW.md`), the codebase
has 6+ swallowed-error sites and 15+ hardcoded account-ID references, 7
scripts have no test coverage, the regression gate's CAP-017..022 evidence
is an offline proxy, ARCHITECTURE.md has no v1.11–v1.13 addendum, and
consumer-facing docs reference stale `@v1.6`–`@v1.9` workflow tags. v1.14
clears all of it in a 20-phase sweep.

**Scope axes (user-directed, 2026-07-29):**
1. **Bug fixes** — clear all open P1/P2 findings from the v1.11 review
   (adapter dedup silent drop, static-assets unwired inputs, lifecycle
   script vestigial args, regression-gate offline-proxy evidence, ALB
   name_prefix, missing unit tests).
2. **Security posture** — narrow 6 swallowed-`except` sites; externalize
   the hardcoded account ID; scope 6 `Resource: "*"` IAM statements to
   `acdl-*` ARNs; harden contract-ingestor identity validation; add
   `additionalProperties: false` + format validation to schemas; add
   credential-pattern catch-all to `.gitignore`.
3. **Stub / missing functionality** — resolve the discarded
   `--kube-version` flag in the Kyverno adapter; clean up orphan bytecode
   + dead config.
4. **Documentation + NFR refinement** — ARCHITECTURE.md v1.11–v1.14
   addenda; bump stale `@v1.6–1.9` → `@v1.13` across 12+ sites; sync
   decks/COST.md/GRILL G-005+G-008/IAM_POLICY.md; reconcile
   modules/STANDARDS.md; record the D-083 audit-ledger deferral
   explicitly.
5. **Test coverage** — add unit tests for 7 untested scripts + the
   adapter dedup/remote-state-key behaviors.

**Out of scope (v1.14):**
- New features (feat phases). v1.14 is NFR-only.
- D-083 audit ledger build-out (S3 Object Lock + JWS + SQS DLQ + async
  worker) — remains deferred; documented explicitly in ARCHITECTURE.md.
- Real OIDC federation (blocked on go-gitea/gitea#36988).
- Per-phase regression hardening (G-007, unchanged).
- Boto3 post-deploy verification probes (deferred to a future QA
  milestone).

**Milestone type:** NFR (all phases are fix/test/docs/chore/refactor).
**Ship tag:** final phase patch on the v1.13.x line IS the release.

## Milestone v1.14 Phases

| Phase | Name | Goal |
|-------|------|------|
| 0 | pre-execution | SPECIFY → CLARIFY → RESEARCH → IDEATE → PLAN → GRILL. Establish v1.14 milestone shell; ideate finds the concrete requirements; plan decomposes into 20 execution phases. |
| 1–20 | execution | 20 phases of bug fixes, security hardening, stub resolution, test coverage, docs sync (wave-ordered). See ROADMAP.md §v1.14 for the phase list. |
| 21 | final-review-ship | Multi-persona review + audit + milestone ship (merge to main, tag final patch = release). |

## Key Decisions (v1.14)

Resolved at the CLARIFY stage (full autonomy — all within locked
constraints or user-directed scope). New v1.14 decisions (numbered
D-095+ to continue from v1.10's D-094):

| ID | Decision | Rationale | Outcome |
|----|----------|-----------|---------|
| D-095 | v1.14 is an NFR milestone (no feat phases); final patch IS the release. | User directed: "No new features, only bug fixes, security posture improvements, identifying stub and implement missing/lacking functionality, refine all documentation + NFRs." NFR model per branch-strategy.md:181 — progressive patches, final patch = deliverable, no separate milestone tag. | 20 execution phases (P1–P20) + 1 final (P21). Tags v1.13.3 → v1.13.24. |
| D-096 | D-083 (audit ledger JWS + S3 Object Lock + SQS DLQ + async worker) remains deferred; documented explicitly in ARCHITECTURE.md (P19), not implemented. | User chose "Skip — keep D-083 deferred." Requires non-offline-testable AWS infra (Object Lock bucket, KMS signing key, SQS). The hash-chain + DynamoDB outbox remains the v1.14 audit record. | P14 (originally JWS) replaced with orphan-artifact-and-dead-config-cleanup. D-083 deferral recorded in P19. |
| D-097 | 20 execution phases is the target (not consolidated to ~10). | User chose "20 phases as planned." Finer ship granularity; longer milestone. G-007 (per-phase regression) accepted — regression gate runs at milestone COMPLETE. | 20 phases + 1 final = 21-phase milestone. |
| D-098 | Wave ordering: W1 (P1–P6 bug fixes), W2 (P7–P12 security), W3 (P13–P17 stub/test/CI/hygiene), W4 (P18–P20 standards/docs/VPC). | Prerequisite chains: P2 depends on P1 (composition needs correct dedup); P9 depends on P8 (IAM ARNs reference externalized account ID); P15 depends on P7 (script tests benefit from hardened errors); P17 depends on P14 (both touch config.json); P19 lands last (reflects all prior phases). | 4 sequential waves; phases within a wave are independent (parallelizable when parallelization.enabled=true). |
| D-099 | `--ideate` flag: run the IDEATE stage between RESEARCH and PLAN (per ideate.md:218). The ideation tiers mine the 50 `partial:` + 16 `lessons:` + 3 `escalation:` + 16 `decisions:` git-native signals to validate/enrich the 20-phase scope. | User invoked with `--ideate`. The v1.14 scope is already user-directed (20 phases defined), so IDEATE acts as validation + enrichment, not scope discovery. Accepted ideas become IDEATE-NN IDs appended to REQUIREMENTS.md. | IDEATE stage runs; interactive validation gate (accept/skip/modify). |
| D-100 | Accept all 20 ideation findings as the v1.14 requirement set (REQ-135..REQ-154). | User accepted all 20 at the interactive validation gate. Mechanical + backend-enriched tiers confirmed the user-directed scope. | 20 REQs locked; PLAN.md formalizes the task decomposition. |
| D-101 | E-001 (P8 state-bucket continuity residual risk) auto-resolved at full autonomy: accept the residual risk. G-102's binding mitigation (fallback bound to live account ID + workflow env wiring) is the control. The lifecycle pipeline defaults to plan-only (REQ-134) — full-mode runs are workflow_dispatch only, reducing the accident surface. | Grill escalation E-001 (confidence 0.55) re-exposes the v1.11 4-VPC root cause. At full autonomy, auto-decide with assumption logging. The residual risk (misconfigured env at live-run time) is runtime-dependent, not plan-resolvable. If the user prefers zero residual risk, direct that P8 exclude the state-bucket name from externalization entirely. | E-001 resolved; G-102 binding decision enforced in PLAN.md P8. |

---

## Milestone v1.15 — Nova (Rebrand)

**Active milestone.** A full rebrand from ACDL → Nova across docs,
decks, code, configs, CI, env var prefixes, the consumer contract path,
SSM parameter paths, AWS tag keys, and AWS resource names — with a
staged infrastructure migration to avoid breakage.

**Milestone type:** Major (breaking — consumer-facing path, env var
prefixes, SSM path, AWS tag keys, and AWS resource names all change).
Tags run on the v1.15.x minor line: `v1.15.0` (P0) → `v1.15.4` (P5
final = milestone release). (G-104 binding: Major milestones tag on
their own minor line, not the previous minor's patch line.)

**In scope (v1.15):**
- Prose/decks/mermaid/pyproject/release-title rebrand (P1).
- Code identifiers, env var prefixes (`ACDL_*`→`NOVA_*` dual-read),
  consumer path (`.acdl/`→`.nova/`) (P2).
- SSM path (`/acdl/`→`/nova/`) + AWS tag keys (`acdl:*`→`nova:*` ABAC)
  (P3).
- AWS resource names (`acdl-*`→`nova-*`) with migration (P4).
- Final review + audit + remove dual-read fallback + milestone ship (P5).

**Out of scope (v1.15):**
- Renaming the real Gitea org/repo or GitHub org `acdl` (config stays
  `acdl`; doc URLs updated to `nova` for prose only).
- Renaming the S&P Global Energy visual theme (`sp-theme.json`) —
  client branding.
- Past Gitea release titles — only future releases use `Nova vX.Y.Z`.
- Git branch/tag naming — no brand name present.

**Milestone type:** Major (breaking). **Ship tag:** final phase patch
on the v1.15.x minor line IS the release (`v1.15.4`).

## Milestone v1.15 Phases

| Phase | Name | Goal |
|-------|------|------|
| 0 | pre-execution | SPECIFY → CLARIFY → RESEARCH → IDEATE → PLAN → GRILL. Establish v1.15-Nova milestone shell; ideation finds the 10 Nova requirements (REQ-155..164); plan decomposes into 4 execution phases. |
| 1 | docs-decks-prose | Rebrand all prose/decks/mermaid/pyproject/release-titles ACDL→Nova; add Nova tagline; ship consumer migration guide. |
| 2 | code-envvars-consumer-path | Rename acdl_tagging.py→nova_tagging.py; ACDL_*→NOVA_* dual-read; .acdl/→.nova/ contract path. |
| 3 | ssm-tagkeys | SSM /acdl/→/nova/ + AWS tag keys acdl:*→nova:* with parallel-tag ABAC migration. |
| 4 | aws-resource-migration | Rename all acdl-* AWS resources → nova-* with staged migration + runbook. |
| 5 | final-review-ship | Multi-persona review + audit + remove dual-read fallback + milestone ship (merge to main, tag final patch = release). |

## Key Decisions (v1.15)

Resolved at the CLARIFY stage (full autonomy — all within locked
constraints or user-directed scope). New v1.15 decisions (numbered
D-102+ to continue from v1.14's D-101). The high-judgment scope
decisions (D-102..D-107) were locked in by the user during the planning
conversation before execution; D-108..D-112 resolved at CLARIFY.

| ID | Decision | Rationale | Outcome |
|----|----------|-----------|---------|
| D-102 | AWS resource names: full rename with migration. | User chose "Full rename with migration." All `acdl-*` AWS resources → `nova-*` including state bucket migration, DynamoDB data migration, IAM re-bootstrap, ECR re-push. Accepts downtime + multi-phase migration. | P4 implements the staged migration + rollback runbook. |
| D-103 | Env var prefixes: full rename to `NOVA_*`. | User chose "Full rename to `NOVA_*`." All 21 `ACDL_*` prefixes → `NOVA_*` including `.env.secrets` (key names only, values stay) + Gitea secrets. | P2 renames + implements dual-read fallback; P5 removes fallback. |
| D-104 | Tag keys + SSM path + consumer path: full rename all three. | User chose "Full rename all three." AWS tag keys `acdl:*`→`nova:*` (ABAC re-scope), SSM path `/acdl/`→`/nova/` (param migration), consumer path `.acdl/`→`.nova/`. | P2 (consumer path) + P3 (SSM + tag keys) implement. |
| D-105 | External URLs: illustrative — update them. | User chose "URLs are illustrative — update them." Doc URLs (`github.com/acdl/...`, `git.cloudinit.dev/.../acdl*`) → `nova` for prose consistency. Real Gitea repo name (`release.gitea.repo`) stays `acdl`. | P1 updates doc URLs; config.json unchanged. |
| D-106 | Nova tagline: add alongside existing North Star. | User chose "Add Nova tagline alongside existing North Star." Tagline "The New Dawn of DevSecOps — security as a seamless enabler of fast deployments" added to README header, deck title slides, `docs/vision.md`. Existing "consumers declare intent" framing retained. | P1 adds tagline; no prose removed. |
| D-107 | S&P visual theme: leave untouched. | User chose "Leave S&P theme untouched." `sp-theme.json` (#D6002A red, Akkurat Pro) is client branding, not the Nova product brand. Only product-brand text (ACDL→Nova) changes in decks. | P1 edits deck text only; theme/CSS unchanged. |
| D-108 | Dual-read fallback centralized in a new `core/env.py` helper. | No centralized env loader exists today (env vars read via scattered `os.environ.get("ACDL_*")`). A new `core/env.py` `get_env(name)` helper reads `NOVA_X` then falls back to `ACDL_X`, returning `None` if neither. All call sites migrate to the helper in P2; P5 removes the fallback. | P2 creates `core/env.py` + migrates call sites; P5 removes fallback. |
| D-109 | Checkov custom rule `nova_tagging.py` warns during P2, hard-fails from P3. | During P2 (before tag-key migration), existing resources still carry `acdl:*` tags — a hard fail would break the regression gate. P2 rule warns on `acdl:*`; P3 (after parallel-tag + ABAC swap) hard-fails on `acdl:*` and enforces `nova:*`. | P2: warn mode; P3: hard mode. |
| D-110 | Schema `$id` URLs (`https://acdl.cloudinit.dev/schemas/...`) → `https://nova.cloudinit.dev/schemas/...`. | These are illustrative schema identifiers (no real DNS resolution required for JSON-schema validation). Renamed for brand consistency in P1. Existing `$id` values in test fixtures updated. | P1 renames schema `$id` + fixture references. |
| D-111 | Lambda env-var defaults (`CONTRACTS_TABLE` default `"acdl-contracts"`, etc.) → `nova-contracts`. | `core/lambda/contract_ingestor.py` has hardcoded `acdl-*` default table names. These become `nova-*` in P4 (resource migration). P2 changes the env-var name (`ACDL_*`→`NOVA_*`); P4 changes the default values to `nova-*`. | P4 updates Lambda defaults. |
| D-112 | `nova` slug: no `project:` prefix on branches (single-project mode). | `config.json` has `projects[]` with one entry (slug `acdl`) but `git.branching_strategy` is `flat` and the established convention since v1.0 is flat branches (no `<slug>/` prefix). Nova rebrand does NOT change the branch prefix convention. Commit `---ci---` blocks use `project: acdl` (the config slug, unchanged). | Branches stay `milestone/v1.15-nova`, `phase/NN-*`; no `acdl/` or `nova/` prefix. |

## Objective for Milestone v1.16 (active — NFR Simplification)

A 20-phase NFR sweep (no new features) themed around five axes the user
directed during ideation: **Simplify without regressions**, **Security**,
**Maintainability**, **User/Developer Experience**, and **No Humans
Onboarding Flow**. The v1.15 rebrand left a fresh layer of residual debt
(stale brand strings, a state-bucket drift, a Kyverno policy that
contradicts the Nova tagging standard, dead code) that this milestone
clears, alongside genuine simplification (dedup helpers, a workflow
generator, file splits) and the first self-service onboarding request
path (request-path only; real AWS account provisioning stays a future
feature).

**Milestone type:** NFR (all phases fix/chore/docs/refactor/test). The
final phase's patch IS the deliverable — no separate milestone tag. Tags
run on the v1.15.x line: `v1.15.5` (P0) → `v1.15.6..v1.15.25` (P1–P20) →
`v1.15.26` (P21 final = milestone release).

**Wave ordering:**
- Wave 1 (P1–P4): correctness + brand regression fixes — P1 first
  (state-bucket drift + Kyverno label contradiction are the highest-
  severity findings, both correctness regressions left by the rebrand).
- Wave 2 (P5–P9): simplify without regressions — P5 before P6/P9
  (regression-verify dedup is independent); P8 changes the workflow test.
- Wave 3 (P10–P14): security + maintainability — P10 before P11
  (identity enforcement before payload validation); P12/P13 independent
  splits.
- Wave 4 (P15–P17): developer experience — independent; P17 last
  (reflects the consolidated path).
- Wave 5 (P18–P20): no-humans onboarding — P18 (schema+Lambda action)
  before P19 (env-file autogen consumes the schema) before P20 (cross-
  account role, offline-proven).

**Verification gates:** the regression gate (D-091) runs after Wave 2
(P9) and at P21 — all 22 capabilities must stay Verified (no
regressions from simplification). A mid-milestone checkpoint runs after
Wave 3 (P14), offline.

## Milestone v1.16 Phases

| Phase | Name | Goal |
|-------|------|------|
| 01 | state-bucket-and-kyverno-rebrand-fix | `adapter.py:117` `acdl-tfstate`→`nova-tfstate`; Kyverno `require-resource-labels.yml` `acdl:*`→`nova:*` labels. Regression-risk fix. |
| 02 | user-facing-acdl-to-nova-sweep | Onboarding msg, alert title/body, PR comments, CI banner, module docstrings → Nova. |
| 03 | dead-code-and-stale-prefix-cleanup | Dead `ACDL_ENVIRONMENT_OVERRIDE` export; stale dual-read comments; `acdl_*` temp prefixes → `nova_*`. |
| 04 | migrate-ssm-except-narrowing | `migrate_ssm_paths.py` `except Exception`→`ParameterNotFound`. |
| 05 | regression-verify-dedup | Extract shared live-plan/resolver/lifecycle-resolve helpers (~70 lines saved). |
| 06 | run-platform-deadcode-and-hitl-fn | Remove dead export; extract `run_hitl_gate()` shell fn; drop hardcoded UUID/`v18` stamp. |
| 07 | contract-resolver-envloader-and-kind | Import env loader from environment_check; add `kind` field to registry; replace `is_l2` heuristic. |
| 08 | workflow-generator-dedup | `scripts/sync_workflows.py` (one source → both dirs); replace byte-identity test with generator-output test. |
| 09 | run-platform-split | Extract decommission + uptime blocks into `scripts/run_decommission.sh` + `scripts/run_uptime.sh`. |
| 10 | contract-ingestor-defense-in-depth | Fail closed on missing IAM identity; derive env enum from `core/environments/` dir. |
| 11 | contract-ingestor-payload-validation | Contract blob size cap + schema validation; consistent error/stackTrace caps. |
| 12 | split-contract-resolver | 638 lines → resolve / decommission-transform / cli modules. |
| 13 | split-regression-verify | 670 lines → capability checks / live-plan helpers / cli modules. |
| 14 | schema-driven-outputs-and-cache | `SAFE_OUTPUT_NAMES` from interface.json; cache loaded schemas in resolver. |
| 15 | run-platform-help-and-flags-doc | Real `--help`; document `--deploy-uptime`; surface `--local` in README. |
| 16 | workflows-readme-catalog | `.github/workflows/README.md` — triggers, inputs, secrets, reusable-workflow contracts. |
| 17 | getting-started-consolidation | Single getting-started section: offline happy path first, AWS path second. |
| 18 | onboarding-schema-and-lambda-action | `schemas/onboarding.schema.json` + `onboard_consumer` action → CMDB row pending grant. |
| 19 | onboarding-envfile-autogen | `core/onboarding.py` generates `<env>.json` from a request + emits a PR; rebrand onboarding message. |
| 20 | cross-account-role-automation-offline | Terraform for consumer deploy-role + `nova:owner` ABAC tag (offline-proven only). |
| 21 | final-review-ship | Review + audit + milestone ship `v1.15.26` + merge to main. |

Milestone COMPLETE gate: review → ship `v1.15.26` (NFR milestone; final
patch IS the release) → audit.

## Key Decisions (v1.16)

Resolved at the CLARIFY stage (full autonomy — all within locked
constraints or user-directed scope). New v1.16 decisions numbered D-113+
to continue from v1.15's D-112. The four high-judgment scope decisions
(D-113..D-116) were locked in by the user during the ideation planning
conversation; D-117..D-119 resolved at CLARIFY.

| ID | Decision | Rationale | Outcome |
|----|----------|-----------|---------|
| D-113 | Onboarding scope = request-path only (NFR-shaped). | User chose "Request-path only." Full self-service AWS account/network/state provisioning is a feature (creates real cloud resources), not an NFR. v1.16 removes the human handoff from the *request* step (schema + Lambda action + env-file autogen + ABAC grant hook); real AWS account creation stays a future feature milestone. | P18–P20 implement the request path; real provisioning deferred. |
| D-114 | Cross-account Terraform = offline-proven only. | User chose "Offline-proven only." P20 Terraform for the consumer deploy-role + ABAC tag is authored + `terraform validate` + `--check-only` only; no live apply (consistent with `NOVA_LIFECYCLE_MODE=plan` default). No new AWS resources created in this NFR milestone. | P20 validates offline; live apply deferred. |
| D-115 | Workflow dedup = generator (not status quo). | User chose "Generator." `scripts/sync_workflows.py` writes one source → both `.gitea/`+`.github/` dirs; the byte-identity test in `test_pipeline_contract.py` is replaced with a "generated outputs match committed files" test. Removes ~20 KB manual-sync risk. | P8 implements the generator + test swap. |
| D-116 | Drift fixes = P1 of v1.16 (not a hotfix to main). | User chose "P1 of v1.16." The state-bucket drift (`adapter.py:117`) and Kyverno label contradiction are correctness regressions but latent in plan-only mode (no live apply in the default path), so they are not an active outage. Fixing them as P1 keeps the milestone self-contained. | P1 fixes both; no hotfix to main. |
| D-117 | v1.14 NFR categories are NOT re-proposed. | v1.14 already swept over-broad excepts (REQ-141), hardcoded account-ID (REQ-142), IAM `Resource:"*"` scoping (REQ-143), contractId/env validation (REQ-144), `.gitignore` catch-all (REQ-146), `--kube-version` removal (REQ-147), orphan cleanup (REQ-148), `set -euo pipefail` parity (REQ-150). v1.16 finds NEW residual signals (the v1.15 rebrand left a fresh debt layer) and does not duplicate completed work. | Wave 1–5 target only fresh debt. |
| D-118 | Regression gate (D-091) gates Wave 2 completion and P21. | "Simplify without regressions" is only credible if the regression gate runs after the simplification wave. The gate runs after P9 (Wave 2 done) and at P21 (milestone complete); any non-Verified capability halts W3. Mid-milestone checkpoint after P14 (offline). | P9 + P21 run the gate; P14 checkpoint. |
| D-119 | `onboard_consumer` action stores a CMDB row pending grant (not auto-provisions). | The request-path-only scope (D-113) means the Lambda accepts an onboarding request and writes a `pending` row to `nova-contracts` (or a new `nova-onboarding` partition key); the platform automation that grants the ABAC role is the P20 Terraform (offline-proven). No AWS resources are created by the Lambda action itself. | P18 writes the pending row; P20 proves the grant Terraform offline. |