Files

T

Jon Chery 44d1d19cfd fix(P54): capability re-verification sweep — 16/16 Verified, 7 adapter defects fixed

The v1.1-v1.8 capability re-verification sweep (D-093) found and fixed
7 adapter defects in adapters/terraform/adapter.py that had prevented
the headline E2E from running against live AWS since the v1.7/v1.8
platform simplification. All 16 auto-verifiable capabilities are now
Verified.

Defects fixed in-sweep (D-090: no cap):
1. Duplicate output definitions (per-resource + stack-level both emitted).
2. Duplicate desired_count/launch_type on ECS service.
3. Duplicate target_type/family/load_balancer_type.
4. Missing assume_role_policy/role_name on IAM role (L2 composition gap).
5. Missing cidr_block/vpc_id/name defaults on VPC/subnet/route_table/
   ECS cluster/ECR repository.
6. ECR kms_key_arn unsupported arg -> encryption_configuration block.
7. CloudFront OAC + WAF deprecated arg names (AWS provider v5):
   signing_behavior, signing_protocol, origin_access_control_id,
   s3_origin_config.origin_access_identity, origin_id, rule (singular),
   scope=CLOUDFRONT (uppercase).

New live-AWS capability checks (CAP-013..CAP-016):
- terraform init+validate+plan live AWS (microservice): 14 resources, OK
- terraform init+validate+plan live AWS (static-assets): CloudFront+WAF+S3, OK
- DynamoDB outbox table: exists, 9 items
- S3 state bucket: exists, keys=[spike/l2-microservice/terraform.tfstate]

6 IAM-gated cloud resources (CAP-017..CAP-022: contracts table, Lambda,
ECS service, CloudFront stack, uptime-kuma, OIDC role) are documented
as escalated: the spike-runner lacks the IAM permissions to verify
them (chicken-and-egg). The terraform plan path proves the code would
deploy them; the local emulators prove the runtime behavior.

Verified: 513 fast tests pass. run_regression.sh reports 16/16
Verified (was 12; +4 live-AWS). terraform init+validate+plan succeeds
against live AWS for both contracts. No regressions.

---ci---
project: acdl
phase: 54
milestone: v1.10
status: verify
requirements:
  covered: [REQ-114]
  partial: []
decisions: [D-090, D-093]
regression:
  - { capability: CAP-013, status: Verified }
  - { capability: CAP-014, status: Verified }
  - { capability: CAP-015, status: Verified }
  - { capability: CAP-016, status: Verified }
---/ci---

2026-07-27 18:21:45 +00:00

kyverno

feat(P42): stub implementation — SoD, HITL gates, attestation matrix, Wiz, Kyverno

2026-07-23 04:40:44 +00:00

terraform

fix(P54): capability re-verification sweep — 16/16 Verified, 7 adapter defects fixed

2026-07-27 18:21:45 +00:00

wiz

feat(P42): stub implementation — SoD, HITL gates, attestation matrix, Wiz, Kyverno

2026-07-23 04:40:44 +00:00

.gitkeep

phase: 6, status: plan-as-execute, persona: lead-developer, task: T-6.1..T-6.4

2026-07-21 18:27:21 +00:00

README.md

docs(P48): vision gaps + badge system + substrate→engine + CR format + agentic tags

2026-07-23 14:58:29 +00:00

README.md

ACDL Adapters

Overview

Adapters translate the engine-agnostic Target Stack IR to engine-specific formats. The Terraform adapter is the primary adapter (IR → HCL). Policy adapters translate security tool output into normalized PolicyCheckResult records that the confidence signal consumes in an engine-agnostic way.

Existing Adapters

Adapter	Path	Input	Output	Purpose
Terraform adapter	`adapters/terraform/adapter.py`	Stack instance JSON	Terraform HCL (`main.tf`, `terraform.tf`, `providers.tf`)	Compiles IR to Terraform
Checkov adapter	`adapters/terraform/policy/checkov_adapter.py`	Checkov JSON	`PolicyCheckResult` records	Translates Checkov results
Wiz adapter	`adapters/wiz/wiz_adapter.py`	Wiz API issues JSON	`PolicyCheckResult` records	Translates Wiz security findings
Kyverno adapter	`adapters/kyverno/kyverno_adapter.py`	Kyverno PolicyReport JSON	`PolicyCheckResult` records	K8s-native policy translation

How to Write an Adapter

Terraform Adapter Extension

Add a stack type → Terraform type mapping to TYPE_MAP.
Add non-identity input mappings to INPUT_MAP.
Add non-identity output mappings to OUTPUT_MAP.
Add a specialized _emit_resource branch if the resource needs nested blocks (e.g. inline policies, rule sets).

Policy Adapter Pattern

Define SEVERITY_MAP and RESULT_MAP dicts that translate the engine's native severity/result vocabulary to the PolicyCheckResult enums.
Implement _to_pcr(raw_record, contract_id) → PolicyCheckResult dict.
Implement adapt(input_path, contract_id) → list of PolicyCheckResult dicts.
Implement is_configured() → bool (env var check) so the platform can skip the adapter when credentials are absent.

How to Wire an Adapter

Terraform adapter — invoked by scripts/run_platform.sh Step 3 (terraform-plan).
Checkov adapter — invoked by scripts/run_platform.sh Step 5 (checkov).
Wiz / Kyverno adapters — optional Steps 5b/5c, run only when the relevant env vars are set.
All policy adapters output records that are validated against schemas/policy_check_result.schema.json.

Dependencies

jsonschema, pyyaml — used by all adapters for loading and validating inputs.
boto3 — used by the Wiz adapter for AWS API access.
checkov — used by the Checkov adapter to run policy scans.
No external deps for the Terraform adapter (pure Python).

How to Test Adapters

tests/test_adapter.py — Terraform adapter (TYPE_MAP, resource emission, refs, outputs).
tests/test_checkov_adapter.py — Checkov adapter.
tests/test_wiz_adapter.py — Wiz adapter.
tests/test_kyverno_adapter.py — Kyverno adapter.
All adapter tests load fixtures from tests/fixtures/ and use moto for AWS mocking.

Where to Write Tests

tests/test_<adapter_name>.py paired with tests/fixtures/<adapter>_fixture.json.

Adding a New Adapter

Create adapters/<name>/<name>_adapter.py.
Implement adapt() and (for policy adapters) is_configured().
Add the adapter's engine name to the engine enum in schemas/policy_check_result.schema.json if it is a policy adapter.
Write a test (tests/test_<name>_adapter.py) plus a fixture (tests/fixtures/<name>_fixture.json).
Add it to scripts/run_platform.sh if it is invoked at runtime.
Update this README.