Jon Chery
3b1181f39b
v1.14 NFR Refinement milestone complete. 20 execution phases (P1-P20) + 1 final (P21). All P1/P2 backlog from v1.11 review resolved. Security posture hardened (swallowed errors, account ID externalized, IAM scoped, schema validation, credential hygiene). Stubs resolved (kyverno --kube- version removed). 7 untested scripts gained coverage. Documentation synced (ARCHITECTURE v1.11-v1.14 addenda, stale @v1.6-1.9 -> @v1.13, GRILL G-005/G-008 resolved, COST.md window extended, D-083 deferral recorded). Platform VPC parameterized. 561 tests pass (was 528 at v1.13.2; +33). 22/22 capabilities Verified. 6 grill binding decisions (G-101..G-106) applied. 1 escalation (E-001) auto-resolved at full autonomy (D-101). ---ci--- project: acdl phase: 21 milestone: v1.14 status: complete ---/ci---
62 lines
2.8 KiB
JSON
62 lines
2.8 KiB
JSON
{
|
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
"$id": "https://acdl.cloudinit.dev/schemas/environment.schema.json",
|
|
"title": "ACDL Platform-Managed Environment",
|
|
"description": "A named environment the platform owns (an AWS account or scoped partition, a network, a state backend, an IAM role surfaced to the consumer via ABAC). Selected by name in the contract's 'environment' field. The environment onboarding check (core/environment_check.py) loads the matching <name>.json; the contract resolver (core/contract_resolver.py) uses it as the 'env' context for ${env.<field>} interpolation.",
|
|
"type": "object",
|
|
"required": ["name", "account_id", "region", "state_backend", "network", "runner_role_arn", "autonomy", "confidence_threshold"],
|
|
"properties": {
|
|
"name": {
|
|
"type": "string",
|
|
"description": "The environment name (matches the filename without .json)."
|
|
},
|
|
"description": {
|
|
"type": "string",
|
|
"description": "Human-readable description."
|
|
},
|
|
"account_id": {
|
|
"type": "string",
|
|
"pattern": "^[0-9]{12}$",
|
|
"description": "The AWS account id (12 digits). The placeholder 000000000000 is allowed for unbound environments; environment_check emits a stderr warning when it appears for env != dev."
|
|
},
|
|
"region": {
|
|
"type": "string",
|
|
"description": "The AWS region (e.g. us-east-1)."
|
|
},
|
|
"state_backend": {
|
|
"type": "object",
|
|
"required": ["bucket", "lock_table"],
|
|
"properties": {
|
|
"bucket": {"type": "string", "pattern": "^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$", "description": "S3 state bucket name (lowercase, 3-63 chars, dots/hyphens)."},
|
|
"lock_table": {"type": "string", "description": "DynamoDB lock table name."}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"network": {
|
|
"type": "object",
|
|
"required": ["vpc_cidr", "azs"],
|
|
"properties": {
|
|
"vpc_cidr": {"type": "string", "pattern": "^[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}\\.[0-9]{1,3}/[0-9]{1,2}$", "description": "VPC CIDR block (e.g. 10.0.0.0/16)."},
|
|
"azs": {"type": "array", "items": {"type": "string"}, "maxItems": 6, "description": "Availability zones (max 6)."}
|
|
},
|
|
"additionalProperties": false
|
|
},
|
|
"runner_role_arn": {
|
|
"type": "string",
|
|
"pattern": "^arn:aws:iam::[0-9]{12}:role/.+$",
|
|
"description": "The IAM role ARN surfaced to the consumer's repo via ABAC."
|
|
},
|
|
"autonomy": {
|
|
"type": "string",
|
|
"enum": ["full", "attested"],
|
|
"description": "full = autonomous (dev); attested = HITL gates (qa/prod/dr)."
|
|
},
|
|
"confidence_threshold": {
|
|
"type": "number",
|
|
"minimum": 0,
|
|
"maximum": 1,
|
|
"description": "The confidence gate threshold for this environment (dev 0.50, qa 0.75, prod 0.90, dr 0.95)."
|
|
}
|
|
},
|
|
"additionalProperties": false
|
|
} |