acdl/.ciagent/VERIFY.md

Phase 12 — nfr-harden-and-simplify (v1.2) VERIFY

Verdict: Phase 12: VERIFIED Tag: v1.2.2 Date: 2026-07-21

---

Scope

Phase 12 applies Phase 11's NFR + simplification findings: consolidates the two run_spike_*.sh scripts into one scripts/run_platform.sh (D-048), expands the spike IAM policy for the v1.2 ECS scope (least-privilege), documents the bootstrap idempotency contract, redacts the two v1.1 AWS access key IDs from .ciagent/ (P1-1), and fixes the last stale platform/ path in PERSONAS.md (P1-B). Requirement covered: REQ-30.

Verification layers

1. Structural

• scripts/run_platform.sh exists (+x, supersedes the two v1.1 scripts).
• scripts/run_spike_e2e.sh + scripts/run_spike_plan.sh deleted.
• terraform/bootstrap/spike_runner_policy.json expanded (ECS + ECR + ELB + IAM + EC2 Allow statements; DenyEverythingElse NotResource expanded).
• terraform/bootstrap/create_state_backend.py + create_iam_user.py have idempotency-contract docstrings (logic unchanged).
• README.md references run_platform.sh (no stale run_spike_*.sh refs).
• .ciagent/RESEARCH.md, PROJECT.md, REVIEW.md, AUDIT.md redacted (no live AWS key IDs).
• .ciagent/PERSONAS.md line 47 fixed (platform/registry/** → modules-ir/registry.json).
• scripts/verify_phase12.sh exists (+x).
• .ciagent/PLAN.md updated to Phase 12.
• PASS.

2. Behavioral (scripts/verify_phase12.sh)

=== Phase 12 verification ===
Script consolidation (D-048): OK
IAM policy expansion: OK (ECS + ECR + ELB + IAM + EC2 + DenyEverythingElse)
Idempotency documentation: OK
P1-1 redaction: OK (no live AWS key IDs in .ciagent/)
P1-B stale path: OK (PERSONAS.md platform/registry -> modules-ir/registry.json)
run_platform.sh syntax: OK
.ciagent/ consistency: OK

=== Phase 12: VERIFIED ===

All 22 assertions pass. Additionally, the subagent ran bash scripts/run_platform.sh --plan-only during execution and it completed all 4 plan steps against real AWS (.env.secrets present in this env), printed === PLATFORM PLAN OK ===, exit 0 — the consolidated script is functionally equivalent to the original run_spike_plan.sh.

• PASS.

3. Security

• P1-1 closed: no live AWS access key IDs remain in .ciagent/ (grep -rn "AKIAYOZHMKZ7RK26N66W\|AKIAYOZHMKZ772SINHFX" .ciagent/ returns nothing). The key IDs in git history (v1.1 commits) are immutable but the current-tree narrative is clean.
• IAM policy: expanded to ECS/ECR/ELB/IAM/EC2 with region-scoped resource ARNs (arn:aws:ecs:us-east-1:581513795199:* etc.) — least-privilege, no * resources. DenyEverythingElse preserved with expanded NotResource. The policy is ready for Phase 15's terraform apply but grants no more than the ECS microservice needs.
• No credentials introduced: the policy is a static JSON document; no secrets in code.
• PASS.

4. Quality

• run_platform.sh uses set -euo pipefail (strict bash) — stricter than the original set -u.
• The --plan-only flag defaults to false (full e2e is the default), matching the v1.1 behavior where run_spike_e2e.sh was the primary entry point.
• The IAM policy expansion follows the Phase 13 L1 catalog scoping (D-049): the 6 L1s map to exactly the 5 new permission categories (ECS, ECR, ELB, IAM, EC2).
• The idempotency documentation is accurate (the scripts were already idempotent per the Phase 11 code audit — this phase documents the contract, no logic change).
• PASS.

P0 / P1

• P0: none.
• P1: none new. P1-1 (carried from v1.1) is now closed by this phase. P1-B (stale platform/ path) is now closed. P1-A (config.json status) was closed at ab69d10 in v1.1. P1-C (run.md tag-placement guidance) and P1-D (ROADMAP audit-pending) were closed in v1.1.

Requirements covered

• REQ-30: NFR hardening — (a) spike_runner_policy.json expanded to least-privilege ECS/ECR/ELB/IAM/EC2 (audit-ready, no wildcards beyond documented exceptions); (b) create_state_backend.py + create_iam_user.py idempotency documented (already idempotent); (c) run_spike_plan.sh + run_spike_e2e.sh consolidated into scripts/run_platform.sh with set -euo pipefail + --plan-only flag; (d) P1-1 redacted (no live AWS key IDs in .ciagent/); (e) P1-B fixed (no stale platform/ paths). VERIFIED.

Conclusion

Phase 12 is VERIFIED. The platform is hardened and simpler: one run_platform.sh instead of two scripts, least-privilege IAM ready for ECS, idempotency documented, and the v1.1 audit's P1-1 + P1-B hygiene items are closed. The v1.1 spike still runs e2e after the refactor (verified by the subagent's --plan-only run against real AWS).