Jon Chery
5365bb4e0a
---ci--- project: acdl phase: 0 milestone: v1.9 status: complete requirements: covered: [REQ-100, REQ-101, REQ-102, REQ-103, REQ-104, REQ-105, REQ-106, REQ-107, REQ-108, REQ-109, REQ-110, REQ-111] partial: [] ---/ci--- v1.9 milestone COMPLETE. All 12 requirements satisfied. Verify: 4 layers PASS (structural 26/26 files, behavioral 493 tests + run_ci.sh + run_platform.sh --check-only green, security, quality). Review: 0 P0, 0 P1 (READY TO SHIP). REVIEW.md reconstructed (D-086). Audit: PASS (reconstruction, file discipline, branch hygiene, commit discipline — 12/12 commits with ---ci--- blocks). Updated: - .ciagent/REQUIREMENTS.md: v1.9 section marked complete; traceability table REQ-100..111 added. - .ciagent/ROADMAP.md: v1.9 marked complete; Phase 43 added. - .ciagent/PROJECT.md: v1.9 objective marked complete. - .ciagent/config.json: milestone v1.9 status -> complete. - .ciagent/REVIEW.md: reconstructed with v1.9 content (D-086). - .ciagent/VERIFY.md: v1.9 4-layer verify. - .ciagent/AUDIT.md: v1.9 audit (PASS). - uses:/ref: bumped @v1.6 -> @v1.9 in contracts/, deploy workflows, docs/consumer-guide.md (D-071 successor). Tag v1.9.0 created next; floating v1.9 + v1 tags updated.
40 lines
2.1 KiB
Markdown
40 lines
2.1 KiB
Markdown
# Phase 39-43 — Verify (v1.9)
|
|
|
|
## Structural
|
|
All 26 new files present (environment.schema.json, 4 env files, 8 per-env
|
|
contracts, hitl_gates.py, attestation_matrix.py, 10 new test files,
|
|
refreshed design docs). SNS topic in terraform/platform/main.tf. **PASS.**
|
|
|
|
## Behavioral
|
|
- `pytest`: 493 tests, all passing (was 350 at v1.8 → 493 at v1.9, +143 new).
|
|
- `run_ci.sh`: exits 0 with "CI PIPELINE OK".
|
|
- `run_platform.sh --check-only`: exits 0 with "PLATFORM CHECK OK".
|
|
- `run_platform.sh --check-only --environment qa`: exits 0; bucket name reflects qa env.
|
|
**PASS.**
|
|
|
|
## Security
|
|
- No hardcoded adapter ECS/ALB/VPC defaults (P1-1 closed; defaults in interface.json).
|
|
- HITL gates block on SoD violation (approver_qa == approver_prod).
|
|
- Attestation matrix fails loud on missing/expired evidence for prod/dr.
|
|
- Signature verification required when ACDL_ATTESTATION_SIGNING_KEY_ID set; skipped + logged when unset (D-089).
|
|
- Wiz degrades gracefully when unconfigured (WIZ_NOT_CONFIGURED SKIPPED record).
|
|
- SNS topic KMS-encrypted; outbox fallback for the halt artifact.
|
|
- Deploy workflows byte-identical (Gitea + GitHub).
|
|
**PASS.**
|
|
|
|
## Quality
|
|
Each new feature has dedicated tests:
|
|
- Design docs: test_design_docs_current.py (no stale framing; deferred D-083 labeled).
|
|
- P1-1: test_p1_1_adapter_parameterization.py (override + default + v1.1 S3 regression).
|
|
- Interpolation: test_interpolation.py + test_sample_contracts_interpolate.py + test_environment_schema.py.
|
|
- Per-env jobs: test_per_env_contracts.py + test_deploy_workflow_env_input.py + test_consumer_guide_per_env_section.py.
|
|
- SoD: test_route_halt_artifact.py (SNS + outbox fallback + SNS failure fallback).
|
|
- HITL gates: test_hitl_gates.py (dev skips; qa/prod/dr record approver; SoD blocks; matrix invoked).
|
|
- Attestation matrix: test_attestation_matrix.py (offline concerns; operator-supplied; freshness; signature skip).
|
|
- Wiz: test_wiz_adapter_real_client.py (real client + pagination + graceful degrade).
|
|
- Kyverno: expanded test_kyverno_adapter.py (pass/fail/skip/warn + severity + inactive guard + kube-version).
|
|
**PASS.**
|
|
|
|
## Verdict
|
|
|
|
**VERIFY PASS** — all four layers pass. 493 offline tests, no AWS required for CI. |