Jon Chery
da60f0e82f
---ci--- project: acdl phase: 28-36 milestone: v1.8 status: verify ---/ci--- Structural: 14 new files present, terraform/spike removed, 14 registry entries. PASS. Behavioral: 350 tests pass (275 -> 350, +75 new). run_ci.sh + check-only green. PASS. Security: no placeholder account IDs, no hardcoded API URLs, byte-identical workflows, SSM fail-loud, deletion protection + encryption by default. PASS. Quality: each P1 fix + each new feature has dedicated tests. PASS. VERIFY PASS.
46 lines
2.6 KiB
Markdown
46 lines
2.6 KiB
Markdown
# Phase 28-36 — Verify (v1.8)
|
|
|
|
## Structural
|
|
All 14 new files present (kms-key primitive, uptime primitive, STANDARDS.md,
|
|
3 READMEs, seed script, 4 test files). terraform/spike removed. Registry
|
|
has 14 entries. **PASS.**
|
|
|
|
## Behavioral
|
|
- `pytest`: 350 tests, all passing (was 275 at v1.7 → 350 at v1.8, +75 new).
|
|
- `run_ci.sh`: exits 0 with "CI PIPELINE OK".
|
|
- `run_platform.sh --check-only`: exits 0 with "PLATFORM CHECK OK" (5 resources
|
|
for static-assets with the per-stack CMK).
|
|
**PASS.**
|
|
|
|
## Security
|
|
- No placeholder account ID in consumer_invoke_policy.json.
|
|
- No hardcoded GitHub API URLs in contract_ingestor.py (uses GITHUB_API_BASE).
|
|
- Deploy workflows byte-identical.
|
|
- SSM fails loud without ACDL_KMS_KEY_ID (RuntimeError).
|
|
- Deletion protection on by default for all primitives.
|
|
- Encryption enabled by default for all primitives.
|
|
**PASS.**
|
|
|
|
## Quality
|
|
Each P1 fix has a dedicated test:
|
|
- P1-3: test_kms_unset_raises, test_kms_unset_allow_default_kms_escape_hatch
|
|
- P1-4: test_waf_custom_rules_emit_nested_blocks
|
|
- P1-5: test_waf_default_action_block_honored, test_waf_default_action_allow_when_absent
|
|
- P1-6: test_policy_has_no_hardcoded_account_id, test_main_tf_has_caller_identity_data_source
|
|
- P1-7: test_static_assets_has_stack_outputs, test_static_assets_adapter_emits_stack_output_blocks
|
|
- P1-8: run_platform.sh writes to $WORK/tf (verified by check-only)
|
|
- P1-9: test_gitea_search_url_uses_repos_endpoint, test_github_search_url_uses_search_endpoint
|
|
- S1: test_deploy_workflow_static_key_override_wired
|
|
|
|
Each new feature has dedicated tests:
|
|
- Encryption: test_kms_key_adapter_emits_rotation, test_all_l1_primitives_have_encryption_nfr, test_s3_with_kms_key_arn_emits_sse_configuration, test_static_assets_l2_wires_kms_key_to_s3
|
|
- Deletion protection: test_all_l1_primitives_have_deletion_protection_nfr, test_adapter_emits_prevent_destroy_when_nfr_true, test_l2_feature_flag_propagates_deletion_protection_false
|
|
- Uptime: test_uptime_adapter_emits_ecs_service_when_enabled, test_uptime_adapter_emits_nothing_when_disabled, test_deploy_pipeline_has_deploy_uptime_stage
|
|
- Decommission: test_decommission_transform_zeros_desired_count, test_validates_approved_cr, test_consumer_guide_has_decommission_section
|
|
- Standards: test_standards_md_has_required_sections, test_all_l1_have_deletion_protection_nfr, test_all_l1_have_encryption_enabled_nfr
|
|
- Docs: test_schemas_readme_has_required_sections, test_pipelines_readme_has_required_sections, test_adapters_readme_has_required_sections
|
|
**PASS.**
|
|
|
|
## Verdict
|
|
|
|
**VERIFY PASS** — all four layers pass. 350 offline tests, no AWS required for CI. |