Files

T

Jon Chery 0fea29cdbb docs(P12): plan-as-execute + verify (v1.2.2)

---ci---
project: acdl
phase: 12
milestone: v1.2
status: verify
verdict: VERIFIED
requirements:
  covered: [REQ-30]
---/ci---

Phase 12 plan-as-execute + verify. scripts/verify_phase12.sh green (22
assertions). All Wave 1 + Wave 2 tasks complete:
- T-12.1: run_spike_*.sh -> run_platform.sh (D-048, --plan-only flag)
- T-12.2: spike_runner_policy.json expanded (ECS + ECR + ELB + IAM + EC2)
- T-12.3: idempotency documented in bootstrap scripts
- T-12.4: P1-1 redacted (no live AWS key IDs in .ciagent/)
- T-12.5: P1-B fixed (PERSONAS.md platform/registry -> modules-ir/registry.json)
Subagent confirmed run_platform.sh --plan-only runs against real AWS, exit 0.
Ready to ship v1.2.2.

2026-07-21 21:01:51 +00:00

2.8 KiB

Raw Permalink Blame History

phase, name, milestone, requirements, type, branch

phase

name

milestone

requirements

type

branch

nfr-harden-and-simplify

v1.2

REQ-30

refactor/nfr

phase/12-nfr-harden-and-simplify

Phase 12 — nfr-harden-and-simplify (v1.2) PLAN

Goal

Apply Phase 11's NFR + simplification findings: tighten the spike IAM policy for the v1.2 ECS scope, consolidate the two run_spike_*.sh scripts into one scripts/run_platform.sh (D-048), redact the two AWS access key IDs from .ciagent/ (P1-1), and fix the one stale platform/ path in PERSONAS.md (P1-B). The v1.1 spike still runs e2e after the refactor.

Tasks

Wave 1 (backend-engineer — scripts + IAM)

T-12.1 — Consolidate run_spike_*.sh → run_platform.sh (D-048, REQ-30)

Create scripts/run_platform.sh with a --plan-only flag (default: full e2e).
Subsumes run_spike_e2e.sh (full pipeline) + run_spike_plan.sh (plan-only subset).
Use set -euo pipefail + fail() helper for uniform strictness.
Delete run_spike_plan.sh + run_spike_e2e.sh; update README.md to reference run_platform.sh only.
Territory: scripts/run_platform.sh, scripts/run_spike_*.sh, README.md

T-12.2 — IAM policy expansion for ECS (REQ-30)

Update terraform/bootstrap/spike_runner_policy.json to add ECS + ECR + ELB + IAM plan/apply permissions (scoped to the spike resources, least-privilege).
Keep the DenyEverythingElse statement; expand the NotResource list.
Territory: terraform/bootstrap/spike_runner_policy.json

T-12.3 — Idempotency documentation (REQ-30)

Add a comment block to create_state_backend.py + create_iam_user.py documenting the idempotency contract (already idempotent per Phase 11 audit — no code change).
Territory: terraform/bootstrap/create_state_backend.py, terraform/bootstrap/create_iam_user.py

Wave 2 (docs — redactions + stale paths)

T-12.4 — Redact P1-1 AWS key IDs (REQ-30)

Replace the two v1.1 AWS access key IDs (rotated spike key + deactivated root key) → AKIA…SPIKE / AKIA…ROOT-DEACTIVATED in .ciagent/RESEARCH.md, .ciagent/PROJECT.md, .ciagent/REVIEW.md, .ciagent/AUDIT.md.
Territory: .ciagent/

T-12.5 — Fix stale platform/ path in PERSONAS.md (P1-B, REQ-30)

Line 47: platform/registry/** → modules-ir/registry.json.
Territory: .ciagent/PERSONAS.md

Verification

scripts/run_platform.sh runs the full v1.1 spike e2e and exits 0.
scripts/run_platform.sh --plan-only runs plan-only and exits 0.
run_spike_plan.sh + run_spike_e2e.sh no longer exist.
No live v1.1 AWS access key IDs remain anywhere in .ciagent/ (fully redacted to placeholders).
grep -rn "platform/registry" .ciagent/PERSONAS.md returns nothing.
spike_runner_policy.json has ECS + ECR + ELB + IAM permissions.
scripts/verify_phase12.sh (authored in verify).

Ship

Merge phase/12-nfr-harden-and-simplify → main (--no-ff). Tag v1.2.2.

2.8 KiB Raw Permalink Blame History