Files

T

Jon Chery 699aa542df docs(P15): plan-as-execute + verify (v1.2.5, PARTIAL — terraform apply blocked by IAM)

---ci---
project: acdl
phase: 15
milestone: v1.2
status: verify
verdict: PARTIAL
requirements:
  covered: [REQ-34]
  partial: [REQ-33]
blocker:
  - id: P0-IAM
    description: terraform apply fails with AccessDenied on ECS/ECR/IAM/EC2 — live spike_runner_policy.json not pushed (root key deactivated per D-034)
    unblock: operator runs create_iam_user.py with root/admin creds to push the expanded policy, then terraform apply succeeds (plan valid, 13 to add)
---/ci---

Phase 15 plan-as-execute + verify. PARTIAL: terraform apply blocked by IAM.
- Consumer microservice content authored (app.py + Dockerfile + README.md).
- Docker image acdl-microservice:latest built.
- Adapter fixed: ref emission (bare), JSON-string jsonencode, ECS service
  network_configuration/load_balancer/desired_count/launch_type/task_definition,
  listener default_action/load_balancer_arn, target group target_type/vpc_id/protocol,
  VPC tags (not name), IGW + route table association, managed_policy_arns list.
- L1 fixes: l1-ecs-service (removed port from service sub-resource),
  l1-vpc (added intra_refs, removed igw_id output).
- Resolver: intra_refs resolution (refs between sub-resources of same L1).
- terraform validate + plan succeed (13 to add).
- terraform apply BLOCKED (AccessDenied — live IAM policy not updated).
- Evidence event TERRAFORM_APPLY_BLOCKED written to DynamoDB outbox.
- v1.1 S3 regression: byte-identical.
Ready to ship v1.2.5 (partial).

2026-07-21 22:21:36 +00:00

3.2 KiB

Raw Permalink Blame History

phase, name, milestone, requirements, type, branch

phase

name

milestone

requirements

type

branch

consumer-repo-and-terraform-apply

v1.2

REQ-33

REQ-34

feat/deploy

phase/15-consumer-repo-and-terraform-apply

Phase 15 — consumer-repo-and-terraform-apply (v1.2) PLAN

Goal

Create the consumer repo acdl-consumer-microservice with a basic HTTP microservice (Dockerfile + ECR push) and lift the platform from plan to apply (dev, autonomous). Submit contracts/microservice.yaml → pipeline → IR → plan → apply → a real ECS Fargate service running.

Escalation note

ACDL_GITEA_TOKEN is not set in this environment — the Gitea API cannot create the consumer repo. Per full-autonomy + the deploy escalation hook: the consumer repo content is authored locally under consumer-repos/acdl-consumer-microservice/ (a new top-level dir in the acdl repo as a staging area). The Gitea repo creation + push is a documented manual step (the content is ready; only the remote creation is blocked). The terraform apply (the substantive deliverable for REQ-33) proceeds — AWS creds are available (acdl-spike-runner verified).

Tasks

T-15.1 — Consumer microservice content (REQ-34)

Create consumer-repos/acdl-consumer-microservice/ with:

app.py — a tiny Python HTTP server (stdlib http.server) returning 200 on / with a JSON body {"status":"ok","service":"acdl-microservice"}.
Dockerfile — FROM python:3.12-slim, COPY app.py, CMD ["python","/app.py"], EXPOSE 8080.
requirements.txt — empty (stdlib only).
README.md — how to build + push to ECR + the contract reference.
contracts/microservice.yaml — symlink or copy of the platform's contracts/microservice.yaml (the consumer's contract submission).

T-15.2 — ECR push (REQ-34)

Build the Docker image + push to ECR (581513795199.dkr.ecr.us-east-1.amazonaws.com/acdl-microservice). Requires docker — if unavailable, document the build+push as a manual step and use a placeholder image URL in the contract. The l1-ecr L1 creates the ECR repo on apply.

T-15.3 — terraform apply (REQ-33)

Run the full pipeline: contracts/microservice.yaml → resolver → adapter → terraform init + terraform plan + terraform apply (dev, autonomous, confidence ≥ 0.50) against real AWS. The apply creates: VPC + subnets + route table + IGW, ECS cluster, ECR repo, IAM role, ALB + target group + listener, ECS task definition + service. Capture the apply output. Write an evidence event to the DynamoDB outbox.

T-15.4 — Verify the service is live

After apply, verify the ECS service is running + the ALB returns HTTP 200 on /. (Requires the ALB DNS — extract from the terraform output.) If docker/ECR push wasn't possible, the task definition references a placeholder image and the ECS service may fail to start — document this as a partial completion (the infra is provisioned; the image is the manual step).

Verification

consumer-repos/acdl-consumer-microservice/ has app.py + Dockerfile + README.md + contracts/microservice.yaml.
terraform apply ran against real AWS (apply output captured).
Evidence event written to DynamoDB outbox.
scripts/verify_phase15.sh.

Ship

Merge → main (--no-ff). Tag v1.2.5.

3.2 KiB Raw Permalink Blame History