acdl/.ciagent/PLAN.md

phase, name, milestone, milestone_type, status, requirements, must_haves, verification

phase	name	milestone	milestone_type	status	requirements	must_haves	verification
6	archive-demo-and-reorient	v1.1	feature	planned		demo/ contains the full v1.0 demo (modules/, scripts/, evidence-ui/, contracts/, contracts-repo/, .gitea/workflows/, ACDL_DEMO.md) demo/scripts/run_demo.sh --no-upload exits 0 (regression: the archived demo still runs from demo/) New top-level dirs exist and are empty-but-scaffolded with a .gitkeep: platform/, schemas/, adapters/, terraform/, modules-ir/ A new top-level scripts/ dir exists with scripts/verify_phase06.sh (v1.1 verify scripts live at top-level scripts/, NOT demo/scripts/) README.md reflects the real platform (vision + architecture links, new layout); the v1.0 demo README content moves to demo/ACDL_DEMO.md (already there) .gitignore updated to ignore runner-data/ (untracked demo runner artifact) if not already No stray empty dirs left at repo root from the moves (contracts-repo/ etc.)	typecheck test build bash -n demo/scripts/*.sh && python3 -m py_compile demo/scripts/*.py scripts/verify_phase06.sh # lives at TOP-LEVEL scripts/, not demo/scripts/ no-op # Phase 06 is repo hygiene; terraform init is Phase 09+

Phase 06 — archive-demo-and-reorient PLAN

Goal

Archive the complete v1.0 demo under demo/ (preserve it as the intent reference per D-037), establish the new v1.1 repo layout (platform/, schemas/, adapters/, terraform/, modules-ir/), and rewrite README.md to reflect the real Agentic Cloud Delivery Platform. Verify the archived demo still runs end-to-end from demo/ via demo/scripts/run_demo.sh --no-upload (regression gate).

This is repo hygiene only — no new code, no new REQ. It reorients the repo from "the v1.0 demo is the repo" to "the v1.0 demo is an archived artifact under demo/; the repo root is now the real platform's home."

Requirements covered

None new. Phase 06 carries no REQ-NN entry (ROADMAP §Phase 06: "Requirements: (no new REQ; repo hygiene)"). It is a structural prerequisite for Phase 07 (architecture-v1-finalization), which owns REQ-16..REQ-22.

Dependency: the v1.0 demo must be complete and tagged. It is — tag v1.1.0 exists (verified: git tag lists v1.0.1..v1.0.5, v1.1.0). All v1.0 phases shipped and audited PASS (ROADMAP §v1.0). The archive preserves the demo immutably; v1.0 tags are not rewritten (PROJECT.md operational parameter: "v1.0 tags preserved").

No upstream phase dependency within v1.1 — Phase 06 is the first v1.1 phase. RESEARCH TARGET 10 (conf 0.90) provides the authoritative move list and confirms via static analysis that no path fixups are needed: all demo scripts resolve paths via SCRIPT_DIR/REPO_ROOT relative-to-script, which auto-adjust when the tree moves to demo/.

Waves

Domain priority order from PERSONAS.md: coordination → security → platform → backend → frontend.

Phase 06 active personas (PERSONAS.md "Phase-specific overrides"): lead-developer (coordination — owns the moves, the new layout, the README, and the verify script) + frontend-engineer (demo UI move confirmation only). Backend/platform/security are idle this phase.

Three waves, strictly ordered (each wave's tasks depend on the prior wave completing):

---

Wave 1 — lead-developer: file moves + new layout + README + verify script

The structural reorientation. All moves use git mv to preserve history. The v1.0 verify scripts move with scripts/ into demo/scripts/ (they are demo artifacts); the new v1.1 verify script lives at a new top-level scripts/ dir (created fresh in this wave).

T-6.1 — Move the v1.0 demo tree into demo/

• Owner: lead-developer (territory: .ciagent/**, README.md, .gitignore, top-level layout).

• Files owned: demo/ (new), everything moved into it.

• Commit message: phase: 6, status: plan-as-execute, persona: lead-developer, task: T-6.1

• Commands to run verbatim (cross-checked against RESEARCH.md TARGET 10's move list; verified the dirs exist and are tracked via git ls-files):

  # From the repo root (/root/acdl). All moves via `git mv` to preserve history.
  # 1. Create the demo/ container.
  mkdir -p demo
  
  # 2. Move the five demo dirs + the demo deck + the demo contracts-repo.
  git mv modules            demo/modules
  git mv scripts            demo/scripts          # carries verify_phase01..05.sh (v1.0 demo verify scripts)
  git mv evidence-ui        demo/evidence-ui
  git mv contracts          demo/contracts        # only holds examples/ (v1.0 sample contracts)
  git mv contracts-repo     demo/contracts-repo  # tracked: .gitea/workflows/{.gitkeep,issue-to-contract.yml}
  git mv .gitea             demo/.gitea           # carries workflows/{.gitkeep,pipeline.yml}
  git mv ACDL_DEMO.md       demo/ACDL_DEMO.md     # the v1.0 presentation deck (was untracked — `git add` it first)
  
  # 3. Handle the untracked demo runner artifact: do NOT git mv (it's untracked).
  #    Move it out of the repo root so it doesn't linger as a stray dir.
  mv runner-data demo/runner-data   # plain mv — not tracked; runner-data/.runner
  #    (runner-data/ is added to .gitignore in T-6.4 so it stays a local artifact.)
  
  # 4. Sanity: no empty stray dirs remain at repo root.
  #    (git mv removes the source dir when it becomes empty; verify with `ls`.)
  

  Cross-check vs RESEARCH.md TARGET 10 move list:

  • modules/ → demo/modules/ ✓
  • scripts/ → demo/scripts/ ✓ (carries v1.0 verify_phase01..05.sh — those are demo verify scripts; the v1.1 verify script is created in T-6.3 at a new top-level scripts/ dir)
  • evidence-ui/ → demo/evidence-ui/ ✓
  • contracts/ → demo/contracts/ ✓
  • .gitea/workflows/{.gitkeep,pipeline.yml} → demo/.gitea/workflows/ ✓ (achieved by moving the whole .gitea/ dir)
  • ACDL_DEMO.md → demo/ACDL_DEMO.md ✓
  • contracts-repo/ → demo/contracts-repo/ ✓ (tracked; confirmed via git ls-files contracts-repo/ → .gitea/workflows/.gitkeep + .gitea/workflows/issue-to-contract.yml)
  • runner-data/ → demo/runner-data/ ✓ (untracked; plain mv)

  Subtlety (per task instructions): the v1.1 verify scripts live at a new top-level scripts/ dir (created in T-6.3), NOT inside demo/scripts/ (which holds the v1.0 demo verify scripts verify_phase01..05.sh). This avoids colliding the v1.1 verification toolchain with the archived demo's.

  Risk note (R-5 from RESEARCH.md): static analysis found only /tmp/... temp-file writes in the demo scripts (e.g. scripts/gitea_setup.sh, scripts/verify_phase01.sh) — no source-root absolute paths. All demo scripts use SCRIPT_DIR/REPO_ROOT relative-to-script, which auto-resolve to demo/ after the move. The regression check in T-6.3 / Wave 3 confirms this empirically.

T-6.2 — Scaffold the new v1.1 top-level dirs (empty, .gitkeep'd)

• Owner: lead-developer (territory: top-level layout).

• Files owned: platform/.gitkeep, schemas/.gitkeep, adapters/.gitkeep, terraform/.gitkeep, modules-ir/.gitkeep.

• Commit message: phase: 6, status: plan-as-execute, persona: lead-developer, task: T-6.2

• Commands:

  # From the repo root. Five new empty-but-scaffolded dirs per ROADMAP §Phase 06.
  # These are populated in Phases 07–10; here they only need to exist + be tracked.
  for d in platform schemas adapters terraform modules-ir; do
    mkdir -p "$d"
    : > "$d/.gitkeep"   # empty placeholder so git tracks the dir
  done
  git add platform/.gitkeep schemas/.gitkeep adapters/.gitkeep terraform/.gitkeep modules-ir/.gitkeep
  

  Territory note (PERSONAS.md): these dirs are owned in later phases by backend-engineer (platform/confidence_signal.py, schemas/**, platform/outbox/**), platform-engineer (adapters/terraform/**, modules-ir/**, terraform/**, platform/registry/**), and security-engineer (platform/hitl_matrix_design.md, platform/audit_ledger_design.md, adapters/terraform/policy/**). In Phase 06 they are empty — no territory conflict.

T-6.3 — Create the new top-level scripts/ + write scripts/verify_phase06.sh

• Owner: lead-developer (territory: scripts/verify_phase*.sh).

• Files owned: scripts/.gitkeep (or the verify script itself acts as the dir anchor), scripts/verify_phase06.sh.

• Commit message: phase: 6, status: plan-as-execute, persona: lead-developer, task: T-6.3

• What scripts/verify_phase06.sh must assert (the Phase 06 success criteria from ROADMAP, made executable):

  #!/usr/bin/env bash
  # scripts/verify_phase06.sh — Phase 06 archive regression + layout check.
  # Lives at TOP-LEVEL scripts/ (v1.1 verify scripts), NOT demo/scripts/.
  set -u
  ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
  cd "$ROOT"
  fail() { echo "FAIL: $*" >&2; exit 1; }
  ok()   { echo "ok: $*"; }
  
  # --- Check 1: demo/ contains the full v1.0 demo tree ---
  for d in demo/modules demo/scripts demo/evidence-ui demo/contracts \
           demo/contracts-repo demo/.gitea/workflows; do
    [ -d "$d" ] || fail "missing $d"
  done
  [ -f demo/ACDL_DEMO.md ] || fail "missing demo/ACDL_DEMO.md"
  [ -f demo/scripts/run_demo.sh ] || fail "missing demo/scripts/run_demo.sh"
  ok "demo/ contains the full v1.0 demo"
  
  # --- Check 2: regression — the archived demo still runs from demo/ ---
  #    run_demo.sh uses WORKDIR=/tmp/acdl_demo_run (absolute temp), so it
  #    does not pollute the repo. --no-upload skips Gitea API calls.
  out=$(ACDL_GITEA_TOKEN= bash demo/scripts/run_demo.sh --no-upload 2>&1); rc=$?
  [ "$rc" -eq 0 ] || { echo "$out" >&2; fail "demo/scripts/run_demo.sh --no-upload exited $rc"; }
  ok "demo/scripts/run_demo.sh --no-upload exits 0"
  
  # --- Check 3: new top-level dirs exist and are scaffolded ---
  for d in platform schemas adapters terraform modules-ir; do
    [ -d "$d" ] || fail "missing new top-level dir $d"
    [ -f "$d/.gitkeep" ] || fail "missing $d/.gitkeep"
  done
  ok "new top-level dirs exist: platform/ schemas/ adapters/ terraform/ modules-ir/"
  
  # --- Check 4: no stray v1.0 dirs left at repo root ---
  for stray in modules evidence-ui contracts contracts-repo ACDL_DEMO.md; do
    [ -e "$stray" ] && fail "stray $stray left at repo root (should be under demo/)"
  done
  # .gitea/ at repo root is OK *only if* it's a new v1.1 workflow dir; in Phase 06
  # we moved the demo's .gitea/ to demo/.gitea/, so repo-root .gitea/ should NOT
  # exist yet (Phase 07+ may re-create it for the real pipeline).
  [ -e ".gitea" ] && fail "stray .gitea/ left at repo root (moved to demo/.gitea/)"
  ok "no stray v1.0 dirs at repo root"
  
  # --- Check 5: README reflects the real platform ---
  grep -q "Agentic Cloud Delivery Platform" README.md || fail "README missing platform name"
  grep -q "demo/" README.md || fail "README does not reference the archived demo/"
  grep -qi "vision\|architecture" README.md || fail "README missing vision/architecture links"
  ok "README reflects the real platform (name + demo/ ref + vision/arch links)"
  
  echo "Phase 06: ALL CHECKS PASS"
  

  Note on bash -n / py_compile (typecheck gate): the verify script itself is covered by bash -n scripts/verify_phase06.sh; the moved demo scripts are covered by bash -n demo/scripts/*.sh + python3 -m py_compile demo/scripts/*.py (the typecheck gate in the frontmatter). These run in Wave 3 before the full verify.

T-6.4 — Rewrite README.md + update .gitignore

• Owner: lead-developer (territory: README.md, .gitignore).

• Files owned: README.md, .gitignore.

• Commit message: phase: 6, status: plan-as-execute, persona: lead-developer, task: T-6.4

• README.md must contain:

  • Project name: "ACDL — Agentic Cloud Delivery Platform".
  • One-line vision lift from PROJECT.md (consumers declare intent; the platform delivers safe production deployment through an agentic stack).
  • Links: docs/vision.md (the why), docs/architecture.md (the how), .ciagent/PROJECT.md (decisions), .ciagent/ARCHITECTURE.md (target architecture), .ciagent/ROADMAP.md (phase plan).
  • New layout section listing the top-level dirs and what each is for:
    • platform/ — platform code (confidence signal, contract resolver, outbox, HITL/ledger designs) [populated Phase 07+].
    • schemas/ — JSON Schemas (IR, PolicyCheckResult, contract) [Phase 07].
    • adapters/ — substrate adapters (Terraform adapter in v1) [Phase 09].
    • terraform/ — state backend + provider config [Phase 08+].
    • modules-ir/ — IR-typed L1/L2 modules (l1-s3, l2-static-asset) [Phase 09–10].
    • scripts/ — v1.1 verify scripts (verify_phaseNN.sh).
    • demo/ — the archived v1.0 executive demo (tag v1.1.0); runs locally via demo/scripts/run_demo.sh --no-upload. Intent reference; not the platform.
    • .ciagent/ — CIAgent metadata (plans, decisions, personas, roadmap).
    • docs/ — upstream vision + architecture sources.
  • A "Status" line: v1.1 active — architecture finalization + v1 spike. v1.0 demo complete (tag v1.1.0), archived under demo/.
  • No v1.0 demo run instructions in the root README — point at demo/ACDL_DEMO.md for the demo deck and demo/scripts/run_demo.sh.

• .gitignore update:

  • Add runner-data/ (the untracked demo runner artifact; moved to demo/runner-data/ in T-6.1, but any future local runner registration should be ignored at the repo root too).
  • Keep existing entries (__pycache__/, *.pyc, *.pyo, .env*, state.json, audit.json, *.tmp, .DS_Store).
  • The existing .gitignore (read) is:

    __pycache__/
    *.pyc
    *.pyo
    .env
    .env.*
    state.json
    audit.json
    *.tmp
    .DS_Store
    

    Append runner-data/ (and optionally demo/runner-data/ for completeness).

---

Wave 2 — frontend-engineer: confirm demo/evidence-ui/ moved cleanly

The UI is frozen as a demo artifact (D-033: relative fetch URL). No code changes unless the move broke the fetch path — which static analysis says it cannot (the UI is a single static index.html with a relative URL to audit.json on the acdl-evidence raw URL). This wave is a confirmation, not a build.

T-6.5 — Confirm demo/evidence-ui/index.html integrity + fetch path

• Owner: frontend-engineer (territory: evidence-ui/**, now demo/evidence-ui/**).
• Files owned: demo/evidence-ui/index.html (read-only confirmation; edit only if the fetch URL is broken, which it is not per D-033).
• Commit message (if no edit needed — confirmation only, may be a no-op commit or folded into Wave 3's verify): phase: 6, status: plan-as-execute, persona: frontend-engineer, task: T-6.5
• Checks the frontend-engineer performs:
  1. demo/evidence-ui/index.html exists and is byte-identical to the pre-move file (git history preserved via git mv).
  2. The fetch URL inside index.html is relative (per D-033) — e.g. fetch('audit.json') or a raw-URL reference to acdl-evidence. It must NOT reference a repo-root-relative path that broke when moved under demo/.
  3. If (and only if) scripts/verify_phase06.sh (run in Wave 3) reports the UI fetch path broken, the frontend-engineer patches demo/evidence-ui/index.html's fetch URL to be relative. Per D-033 and RESEARCH TARGET 10 finding #5, no patch is expected — this is a confirm-only task.
• No code changes expected. If a patch is needed, it is a one-line fetch-URL fix and the commit message above applies.

---

Wave 3 — lead-developer: run the full Phase 06 verification

The regression gate. Runs only after Wave 1 (moves done) and Wave 2 (frontend confirmation done).

T-6.6 — Run scripts/verify_phase06.sh + typecheck gate

• Owner: lead-developer (territory: scripts/verify_phase*.sh).

• Files owned: none (execution-only).

• Commit message (if any fixup is needed; otherwise this is a verify run, not a commit): phase: 6, status: plan-as-execute, persona: lead-developer, task: T-6.6

• Commands:

  # Typecheck gate (from frontmatter):
  bash -n demo/scripts/*.sh && echo "demo shell scripts: syntax ok"
  python3 -m py_compile demo/scripts/*.py && echo "demo python scripts: compile ok"
  bash -n scripts/verify_phase06.sh && echo "verify_phase06.sh: syntax ok"
  
  # Test gate (the Phase 06 regression):
  bash scripts/verify_phase06.sh
  # Expected output: "Phase 06: ALL CHECKS PASS"
  # This runs demo/scripts/run_demo.sh --no-upload internally (Check 2).
  

  On failure: if demo/scripts/run_demo.sh --no-upload fails, the cause is an undetected absolute path in a demo script (R-5 residual 0.10). Fix the offending path in demo/scripts/*.sh (make it SCRIPT_DIR/REPO_ROOT-relative) and re-run. If the UI fetch path is broken, Wave 2's frontend-engineer patches demo/evidence-ui/index.html.

  On pass: Phase 06 is complete. The phase-completion commit + v1.1.0-style phase tag (or the v1.1 phase-tagging convention) is created by the execute workflow, not this plan.

---

Wave ordering (dependency graph)

Wave 1 (T-6.1, T-6.2, T-6.3, T-6.4)   lead-developer
   │  moves + scaffold + verify script + README
   ▼
Wave 2 (T-6.5)                         frontend-engineer
   │  confirm demo/evidence-ui/ moved cleanly (no code change expected)
   ▼
Wave 3 (T-6.6)                         lead-developer
      run scripts/verify_phase06.sh (regression + layout + README checks)

• Wave 1 → Wave 2: the UI must be moved before it can be confirmed.

• Wave 2 → Wave 3: the frontend confirmation must precede the full verify (so any UI fetch-path patch is in place before verify_phase06.sh runs the demo end-to-end).

• Within Wave 1: T-6.1 (moves) must precede T-6.2 (new dirs — they would collide if scripts/ still held the v1.0 verify scripts when T-6.3 creates the new top-level scripts/). T-6.3 (verify script) can be authored in parallel with T-6.2 but cannot run until T-6.1 + T-6.2 are committed. T-6.4 (README) is independent of T-6.1..T-6.3 in content but should land in the same wave so the repo is coherent after Wave 1.

  Strict sub-ordering within Wave 1: T-6.1 → T-6.2 → T-6.3 (T-6.3 creates the new top-level scripts/ which must not exist during T-6.1's git mv scripts demo/scripts). T-6.4 (README + .gitignore) may be done in parallel with T-6.2/T-6.3.

Dependencies

• v1.0 demo complete + tagged — satisfied (tag v1.1.0 present; ROADMAP §v1.0 "complete").
• No upstream v1.1 phase dep — Phase 06 is the first v1.1 phase.
• RESEARCH.md TARGET 10 — the authoritative move list + the static analysis confirming no path fixups are needed (conf 0.90; R-5 residual is the only open risk, caught by the Wave 3 regression check).
• PERSONAS.md — Phase 06 active roster: lead-developer + frontend- engineer (demo UI move only). backend/platform/security idle.

Tasks summary

Task	Wave	Owner	Territory	Commit message tag
T-6.1	1	lead-developer	demo/ (new), moved dirs	task: T-6.1
T-6.2	1	lead-developer	platform/, schemas/, adapters/, terraform/, modules-ir/ (new empty)	task: T-6.2
T-6.3	1	lead-developer	top-level scripts/verify_phase06.sh (new)	task: T-6.3
T-6.4	1	lead-developer	README.md, .gitignore	task: T-6.4
T-6.5	2	frontend-engineer	demo/evidence-ui/index.html (confirm-only)	task: T-6.5
T-6.6	3	lead-developer	(execution: scripts/verify_phase06.sh)	task: T-6.6

All commit messages follow the format: phase: 6, status: plan-as-execute, persona: <name>, task: T-6.N

Risks (specific to Phase 06)

1. R-5 (RESEARCH, residual 0.10): undetected absolute path in a demo script. Mitigation: Wave 3 runs demo/scripts/run_demo.sh --no-upload and asserts exit 0. A failure is caught there and fixable in-phase by making the offending path SCRIPT_DIR/REPO_ROOT-relative. The typecheck gate (bash -n demo/scripts/*.sh) catches syntax issues but not path issues — only the runtime regression catches those.

2. contracts-repo/ is tracked and moves with git mv. Verified: git ls-files contracts-repo/ returns .gitea/workflows/.gitkeep + .gitea/workflows/issue-to-contract.yml. It is a demo artifact (the v1.0 acdl-contracts mirror used by verify_phase04.sh). Moving it to demo/contracts-repo/ is correct; demo/scripts/verify_phase04.sh references it via the ROOT-relative path contracts-repo/.gitea/workflows/... which auto-resolves to demo/contracts-repo/... after the move (ROOT = parent of demo/scripts/ = demo/).

3. runner-data/ is untracked. It is moved with plain mv (not git mv) and gitignored. If a future runner registration recreates it at the repo root, .gitignore (updated in T-6.4) keeps it untracked.

4. ACDL_DEMO.md was untracked (verified: git status shows ?? ACDL_DEMO.md). git mv on an untracked file will fail; the executor must git add it first (or use mv + git add demo/ACDL_DEMO.md). The command list in T-6.1 uses git mv ACDL_DEMO.md demo/ACDL_DEMO.md — if git rejects it as untracked, fall back to: mv ACDL_DEMO.md demo/ACDL_DEMO.md && git add demo/ACDL_DEMO.md.

5. verify_phase05.sh has an anti-stray check (lines 159-160: if [ -d "$ROOT/contracts" ]; then fail "contracts/ directory left in repo root"). After the move, ROOT for demo/scripts/verify_phase05.sh is demo/, and demo/contracts/ does exist — so this check would fail if the v1.0 verify script is re-run from demo/. This is expected: the v1.0 verify scripts are archived demo artifacts, not re-run after Phase 06. The v1.1 verify script (scripts/verify_phase06.sh) supersedes them. No action needed beyond documenting that v1.0 verify scripts are not re-run post-archive.