Files

T

Jon Chery da60f0e82f verify(P28-36): 4-layer verification — 350 tests, all pass

---ci---
project: acdl
phase: 28-36
milestone: v1.8
status: verify
---/ci---

Structural: 14 new files present, terraform/spike removed, 14 registry entries. PASS.
Behavioral: 350 tests pass (275 -> 350, +75 new). run_ci.sh + check-only green. PASS.
Security: no placeholder account IDs, no hardcoded API URLs, byte-identical
workflows, SSM fail-loud, deletion protection + encryption by default. PASS.
Quality: each P1 fix + each new feature has dedicated tests. PASS.

VERIFY PASS.

2026-07-22 22:23:24 +00:00

2.6 KiB

Raw Permalink Blame History

Phase 28-36 — Verify (v1.8)

Structural

All 14 new files present (kms-key primitive, uptime primitive, STANDARDS.md, 3 READMEs, seed script, 4 test files). terraform/spike removed. Registry has 14 entries. PASS.

Behavioral

pytest: 350 tests, all passing (was 275 at v1.7 → 350 at v1.8, +75 new).
run_ci.sh: exits 0 with "CI PIPELINE OK".
run_platform.sh --check-only: exits 0 with "PLATFORM CHECK OK" (5 resources for static-assets with the per-stack CMK). PASS.

Security

No placeholder account ID in consumer_invoke_policy.json.
No hardcoded GitHub API URLs in contract_ingestor.py (uses GITHUB_API_BASE).
Deploy workflows byte-identical.
SSM fails loud without ACDL_KMS_KEY_ID (RuntimeError).
Deletion protection on by default for all primitives.
Encryption enabled by default for all primitives. PASS.

Quality

Each P1 fix has a dedicated test:

P1-3: test_kms_unset_raises, test_kms_unset_allow_default_kms_escape_hatch
P1-4: test_waf_custom_rules_emit_nested_blocks
P1-5: test_waf_default_action_block_honored, test_waf_default_action_allow_when_absent
P1-6: test_policy_has_no_hardcoded_account_id, test_main_tf_has_caller_identity_data_source
P1-7: test_static_assets_has_stack_outputs, test_static_assets_adapter_emits_stack_output_blocks
P1-8: run_platform.sh writes to $WORK/tf (verified by check-only)
P1-9: test_gitea_search_url_uses_repos_endpoint, test_github_search_url_uses_search_endpoint
S1: test_deploy_workflow_static_key_override_wired

Each new feature has dedicated tests:

Encryption: test_kms_key_adapter_emits_rotation, test_all_l1_primitives_have_encryption_nfr, test_s3_with_kms_key_arn_emits_sse_configuration, test_static_assets_l2_wires_kms_key_to_s3
Deletion protection: test_all_l1_primitives_have_deletion_protection_nfr, test_adapter_emits_prevent_destroy_when_nfr_true, test_l2_feature_flag_propagates_deletion_protection_false
Uptime: test_uptime_adapter_emits_ecs_service_when_enabled, test_uptime_adapter_emits_nothing_when_disabled, test_deploy_pipeline_has_deploy_uptime_stage
Decommission: test_decommission_transform_zeros_desired_count, test_validates_approved_cr, test_consumer_guide_has_decommission_section
Standards: test_standards_md_has_required_sections, test_all_l1_have_deletion_protection_nfr, test_all_l1_have_encryption_enabled_nfr
Docs: test_schemas_readme_has_required_sections, test_pipelines_readme_has_required_sections, test_adapters_readme_has_required_sections PASS.

Verdict

VERIFY PASS — all four layers pass. 350 offline tests, no AWS required for CI.

2.6 KiB Raw Permalink Blame History