Jon Chery
a16e6f1bff
EXECUTE stage. Rewrites the 749-line adapter monolith to a 154-line
stateless assembler and proves the design with the s3 reference module.
Stateless adapter (adapters/terraform/adapter.py, 749 → 154 lines):
- Deleted TYPE_MAP, INPUT_MAP, OUTPUT_MAP (3 constant tables).
- Deleted all 39 type-specific branches + _emit_igw, _container_definitions,
_resource_block, _emit_output.
- New adapt(): reads registry.json → terraform_dir → emits root main.tf
with module-instantiation blocks (module "x" { source = ... }) + ref
wiring via module.<rid>.<output> interpolations + root outputs.
- The adapter owns NO resource shape, NO nested blocks, NO defaults, NO
type-specific logic. It only assembles module instantiations and wires refs.
s3 reference terraform module (modules/l1/s3/terraform/):
- versions.tf (required_version + aws ~> 5.0)
- variables.tf (bucket_name, region, kms_key_arn, tags)
- locals.tf (sse_algorithm + tags default interpolation — the defaults
the adapter previously hardcoded)
- main.tf (aws_s3_bucket + versioning + SSE config, referencing local.*)
- outputs.tf (bucket_arn, bucket_name, bucket_regional_domain_name)
- Passes terraform init + validate standalone.
Registry (modules/registry.json): s3 entry gains terraform_dir field.
STANDARDS.md §8 rewritten: from 'three tables + specialized branches' to
'stateless assembler + per-module terraform dir'. §9.4 checklist updated.
§9.1 required-files list updated to include terraform/ subdir.
tests/test_adapter.py rewritten (667 → 190 lines): asserts module-
instantiation assembly (module block, inputs, ref wiring, root outputs,
providers/terraform.tf), statelessness (no TYPE_MAP/INPUT_MAP/OUTPUT_MAP/
rtype ==, < 200 lines), and terraform validate on the emitted output.
Deleted test_p1_1_adapter_parameterization.py (tested the deleted HCL
string emission).
6 pipeline tests skipped (run_platform.sh --check-only defaults to
static-assets.yml which needs cloudfront/waf terraform dirs — P56b).
Regression: 455 passed, 6 skipped, 5 deselected (slow). run_primitive_plan
--check-only s3 exits 0.
---ci---
project: acdl
phase: P56a
milestone: v1.11
status: execute
---/ci---
s3 — S3 bucket
Module kind: primitive | Version: 1.0.0
A single S3 bucket for object storage. The simplest module — one resource, two inputs, two outputs. Versioning is enabled by default.
Resources
| Resource | Type | Purpose |
|---|---|---|
| bucket | aws_s3_bucket |
The S3 bucket itself |
Inputs
| Name | Type | Required | Default | Description |
|---|---|---|---|---|
bucket_name |
string | yes | — | Globally-unique S3 bucket name |
region |
string | yes | — | AWS region the bucket is created in |
Outputs
| Name | Type | Description |
|---|---|---|
bucket_arn |
arn | The S3 bucket ARN |
bucket_name |
string | The bucket name (echoes the input) |
NFRs
| Name | Type | Default | Description |
|---|---|---|---|
versioning |
boolean | true | Enable S3 versioning |
Usage
{
"id": "s3",
"type": "aws:s3:bucket",
"module": "s3@1.0.0",
"inputs": {
"bucket_name": "acdl-spike-bucket",
"region": "us-east-1"
}
}
A concrete instance is at instance.json (used by the platform
pipeline as the regression baseline).
Compliance extension points
- Encryption at rest — add
aws_s3_bucket_server_side_encryption_configurationwith a customer-managed KMS key (SOC2 CC6.1, GDPR Art.32). - Object Lock — add
aws_s3_bucket_object_lock_configurationin compliance mode with 7-year retention for immutable evidence (SOX §802, DORA audit trail). - Access logging — add
aws_s3_bucket_loggingto a target logging bucket (SOC2 CC7.2). - Public access block — add
aws_s3_bucket_public_access_blockto prevent data exfiltration (SOC2 CC6.1, GDPR Art.32). - Lifecycle policy — add
aws_s3_bucket_lifecycle_configurationfor retention enforcement (GDPR Art.5(2).
Examples
Validated example contracts are in examples/. The platform-test
pipeline validates them against schemas/contract.schema.json.
Simple
A minimal deployment:
environment: dev
id: s3a
infrastructure:
s3:
inputs:
bucket_name: my-simple-bucket
region: us-east-1
version: 1.0.0
name: s3-bucket
Complex
A production deployment with optional inputs:
environment: dev
id: s3a
infrastructure:
s3:
inputs:
bucket_name: my-production-bucket
region: us-east-1
version: 1.0.0
name: s3-bucket
Note: the s3 primitive's compliance extensions (Object Lock, access logging, public access block, lifecycle policy) are documented in the Compliance extension points section above but not yet wired as inputs. The complex example uses the same inputs as the simple example; compliance extensions are roadmap.
Versioning
1.0.0 — interface MAJOR, behavior MINOR, lifecycle PATCH. MAJOR bumps
require a new registry entry (immutable publication); old entries enter
a 12-month deprecation window.