Comparing 4f76647489..60f767d125 - acdl

Author	SHA1	Message	Date
Jon Chery	60f767d125	fix(P59): 3 pipeline-readiness fixes — resolver id, schema inputs, CI creds acdl-ci / Lint (pull_request) Successful in 8s Details acdl-ci / Test (pull_request) Failing after 1m59s Details acdl-ci / Platform check-only (offline) (pull_request) Successful in 10s Details acdl-modules-lifecycle / Platform VPC apply (pull_request) Failing after 23s Details acdl-modules-lifecycle / L1 lifecycle (alb) (pull_request) Has been skipped Details acdl-modules-lifecycle / L1 lifecycle (cloudfront) (pull_request) Has been skipped Details acdl-modules-lifecycle / L1 lifecycle (ecr) (pull_request) Has been skipped Details acdl-modules-lifecycle / L1 lifecycle (ecs-cluster) (pull_request) Has been skipped Details acdl-modules-lifecycle / L1 lifecycle (ecs-service) (pull_request) Has been skipped Details acdl-modules-lifecycle / L1 lifecycle (iam-role) (pull_request) Has been skipped Details acdl-modules-lifecycle / L1 lifecycle (kms-key) (pull_request) Has been skipped Details acdl-modules-lifecycle / L1 lifecycle (rds) (pull_request) Has been skipped Details acdl-modules-lifecycle / L1 lifecycle (s3) (pull_request) Has been skipped Details acdl-modules-lifecycle / L1 lifecycle (uptime) (pull_request) Has been skipped Details acdl-modules-lifecycle / L1 lifecycle (vpc) (pull_request) Has been skipped Details acdl-modules-lifecycle / L1 lifecycle (waf) (pull_request) Has been skipped Details acdl-modules-lifecycle / Platform VPC destroy (pull_request) Failing after 22s Details 3 fixes found during the pipeline-readiness audit (all 24 example contracts now resolve + adapt + pass --check-only): 1. core/contract_resolver.py: L1 resolver resource id now replaces underscores with hyphens (task_definition → task-definition), matching the L2 resolver pattern. The stack schema requires ^[a-z][a-z0-9-]*$ (no underscores). 2. schemas/stack.schema.json: relaxed input type constraint to allow array + object (was string/number/boolean only). Real-world inputs include lists (monitored_endpoints, static_checks, rules) and dicts (alert_channels). 3. scripts/run_platform.sh: AWS creds loading is now conditional — if AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY are already set (by the CI configure-aws-credentials action), skip loading .env.secrets. This makes the --apply/--destroy modes work in CI without the gitignored secrets file. Regression: 479 passed, 0 skipped, 5 deselected. ---ci--- project: acdl phase: P59 milestone: v1.11 status: execute ---/ci---	2026-07-28 16:07:57 +00:00
Jon Chery	3739037965	verify(P59): 4-layer gate — PASS Layer 1 (Structural): pipeline contract, schema, and both byte-identical workflows exist. No TODO/stub. PASS. Layer 2 (Behavioral): 12/12 TestModulesLifecyclePipeline tests pass (schema valid, contract validates, byte-identical, workflow name, 3 jobs, triggers, matrix lists all 12 L1 modules, apply/modify/destroy steps present, platform-vpc-destroy always runs). Full offline suite 479 passed, 0 skipped, 5 deselected. PASS. Layer 3 (Security/STRIDE): no hardcoded credentials in workflows (uses secrets.ACDL_AWS_* references, 6 occurrences). No secrets committed. PASS. Layer 4 (Quality): 0 P0 (byte-identical, matrix has all 12 modules). 0 P1 (platform-vpc-destroy always runs for cleanup, no per-module Python in lifecycle steps). PASS. Verdict: VERIFY PASS. P59 ready to merge to milestone/v1.11-restart. ---ci--- project: acdl phase: P59 milestone: v1.11 status: verify requirements: covered: [REQ-127] partial: [] ---/ci---	2026-07-28 16:07:57 +00:00
Jon Chery	7ba72bf656	feat(P59): L1 module lifecycle pipeline — author workflows + schema + tests EXECUTE stage. Authors the modules-lifecycle pipeline that matrix-tests every L1 module's examples/{simple,complex}.yml contracts through apply→modify→destroy against live AWS. No per-module Python. New files: - pipelines/modules-lifecycle.yml: declarative contract (5 stages: platform-vpc-apply, lifecycle-apply, lifecycle-modify, lifecycle-destroy, platform-vpc-destroy). Matrix over 12 L1 modules. - .gitea/workflows/modules-lifecycle.yml + .github/workflows/modules-lifecycle.yml: byte-identical workflows. 3 jobs: platform-vpc-apply (prerequisite), lifecycle (matrix of 12 modules × apply/modify/destroy), platform-vpc-destroy (always runs, cleanup). Triggers: pull_request to main + workflow_dispatch. - schemas/modules-lifecycle-pipeline.schema.json: schema for the new pipeline shape (extends pipeline.schema.json with workflow_dispatch + matrix). Tests (tests/test_pipeline_contract.py): - TestModulesLifecyclePipeline: 12 tests (schema valid, contract validates, byte-identical, workflow name, 3 jobs, triggers, matrix lists all 12 L1 modules, apply/modify/destroy steps present, platform-vpc-destroy always runs). pipelines/README.md: added modules-lifecycle to the pipeline table. Regression: 479 passed, 0 skipped, 5 deselected (slow). ---ci--- project: acdl phase: P59 milestone: v1.11 status: execute ---/ci---	2026-07-28 16:07:57 +00:00
Jon Chery	52df314dd8	docs(P59): create phase plan — L1 module lifecycle pipeline (author) PLAN stage. P59 authors the modules-lifecycle pipeline that matrix-tests every L1 module's examples/{simple,complex}.yml contracts through apply→modify→destroy against live AWS. No per-module Python. 5 tasks: declarative contract, byte-identical Gitea+GitHub workflows, schema, tests, README update. ---ci--- project: acdl phase: P59 milestone: v1.11 status: plan ---/ci---	2026-07-28 16:07:57 +00:00
Jon Chery	b404e6b6b8	verify(P58): 4-layer gate — PASS Layer 1 (Structural): platform VPC has 17 resource/output references (VPC + 2 subnets + IGW + route table + associations + SG + 3 outputs). Microservice composition has no vpc child (6 children: cluster, ecr, roles, alb, service, kms); data_sources has platform_vpc. Adapter state key is env-aware (spike/{name}/{env}/terraform.tfstate). Adapter emits terraform_remote_state data block (4 references). No TODO/stub. PASS. Layer 2 (Behavioral): 32/32 test_adapter.py pass (3 new P58 tests). Full offline suite 467 passed, 0 skipped, 5 deselected. run_platform.sh --check-only passes for both microservice (9 resources, no VPC) and static-assets (5 resources). Microservice resolves with no VPC resources and data_sources=['platform_vpc']. PASS. Layer 3 (Security/STRIDE): no credentials in adapter or resolver. Account ID only in S3 backend config (expected — 2 references for state + data source). No hardcoded secrets. PASS. Layer 4 (Quality): 0 P0 (no per-contract VPC, env-aware state key). 0 P1 (adapter 177 lines < 200, data source refs resolve correctly to data.terraform_remote_state.platform.outputs.*). PASS. Verdict: VERIFY PASS. P58 ready to merge to milestone/v1.11-restart. ---ci--- project: acdl phase: P58 milestone: v1.11 status: verify requirements: covered: [REQ-126] partial: [] ---/ci---	2026-07-28 16:07:57 +00:00
Jon Chery	fda4564a7f	feat(P58): single platform VPC + deterministic env-aware state keys EXECUTE stage. Fixes the 4-VPC bug: adds a single shared VPC to terraform/platform, drops the vpc child from the microservice composition (references the platform VPC via data source), and makes state keys env-aware (spike/{id}/{env}/terraform.tfstate — stable across lifecycle). Platform VPC (terraform/platform/main.tf): - aws_vpc.acdl_shared (10.0.0.0/16) + 2 subnets + IGW + route table + SG - Outputs: vpc_id, subnet_ids, ecs_security_group_id Microservice composition (modules/l2/microservice/composition.json): - Dropped the vpc child (no per-contract VPC ever again). - Added data_sources block: platform_vpc → terraform_remote_state (platform). - Wires: vpc.outputs.subnet_ids → platform_vpc.outputs.subnet_ids. - Wires: platform_vpc.outputs.vpc_id → alb.inputs.vpc_id. - Wires: platform_vpc.outputs.ecs_security_group_id → service.inputs.security_group. Contract resolver (core/contract_resolver.py): - Added environment to the stack instance (stack.environment). - Added data_sources handling: pseudo-children with outputs but no resources. - data_sources propagated through fragment merge to the final stack instance. Adapter (adapters/terraform/adapter.py): - State key: spike/{stack_name}/{environment}/terraform.tfstate (env-aware). - Emits data "terraform_remote_state" "platform" block when data_sources present. - ref:platform_vpc.<output> → data.terraform_remote_state.platform.outputs.<output>. Tests (tests/test_adapter.py): - test_adapt_env_aware_state_key: spike/msvc/prod/terraform.tfstate. - test_adapt_emits_data_source_block: data.terraform_remote_state.platform. - test_adapt_no_vpc_for_microservice: no resource "aws_vpc" in microservice output. - Updated existing state key assertion (spike/s3/dev/terraform.tfstate). Regression: 467 passed, 0 skipped, 5 deselected. run_platform.sh --check-only passes for both microservice (9 resources, no VPC) and static-assets (5 resources). ---ci--- project: acdl phase: P58 milestone: v1.11 status: execute ---/ci---	2026-07-28 16:07:57 +00:00
Jon Chery	962ba24379	docs(P58): create phase plan — single platform VPC + deterministic state keys PLAN stage. P58 fixes the 4-VPC bug: adds a single shared VPC to terraform/platform, drops the vpc child from the microservice composition (references the platform VPC via data source), and makes state keys env-aware (spike/{id}/{env}/terraform.tfstate — stable across lifecycle). 5 tasks: platform VPC, composition update, resolver environment passthrough, adapter state key + data block emission, tests + regression. ---ci--- project: acdl phase: P58 milestone: v1.11 status: plan ---/ci---	2026-07-28 16:07:57 +00:00
Jon Chery	338a351bb2	verify(P57): 4-layer gate — PASS Layer 1 (Structural): --apply and --destroy flags in arg parsing (11 matches); APPLY_ONLY/DESTROY_ONLY lifecycle branches present (6 matches); usage header documents all 5 modes; no TODO/stub. PASS. Layer 2 (Behavioral): 7/7 test_pipeline.py pass (3 new lifecycle tests + 4 existing). Full offline suite 464 passed, 0 skipped, 5 deselected. --check-only still works (no regression). PASS. Layer 3 (Security/STRIDE): D-101 enforced — grep confirms no Python script runs 'terraform apply' or 'terraform destroy' (0 matches). The shell owns all lifecycle. No hardcoded credentials (loads from gitignored .env.secrets). PASS. Layer 4 (Quality): 0 P0 (lifecycle modes exist + parse correctly, no Python terraform lifecycle). 0 P1 (existing --check-only/--plan-only preserved, HITL gate for qa/prod/dr apply). PASS. Verdict: VERIFY PASS. P57 ready to merge to milestone/v1.11-restart. ---ci--- project: acdl phase: P57 milestone: v1.11 status: verify requirements: covered: [REQ-125] partial: [] ---/ci---	2026-07-28 16:07:57 +00:00
Jon Chery	4491d0fa72	feat(P57): shell orchestrator lifecycle modes --apply/--destroy EXECUTE stage. Adds --apply and --destroy modes to run_platform.sh. The shell owns all terraform lifecycle; Python never runs terraform. Changes to scripts/run_platform.sh: - Added APPLY_ONLY and DESTROY_ONLY flags to arg parsing. - --apply <contract>: resolve -> adapter -> terraform init/validate/plan/ apply -auto-approve. HITL attestation gate runs before apply for qa/prod/dr (REQ-108). Prints terraform outputs after apply. Exits with PLATFORM APPLY OK. - --destroy <contract>: resolve -> adapter -> terraform init/validate/ destroy -auto-approve. Use --decommission <CR> for gated production teardown (D-070 two-step CR validation). Exits with PLATFORM DESTROY OK. - Updated usage header to document all 5 modes (check-only, plan-only, apply, destroy, default full e2e). - Existing --check-only and --plan-only modes preserved unchanged. Tests (tests/test_pipeline.py): - test_run_platform_apply_mode_parses: --apply parses without unknown flag. - test_run_platform_destroy_mode_parses: --destroy parses without unknown flag. - test_no_python_runs_terraform_apply_or_destroy: D-101 grep assertion — no .py file in scripts/ contains 'terraform apply' or 'terraform destroy'. Regression: 464 passed, 0 skipped, 5 deselected (slow). --check-only still works (no regression in existing modes). ---ci--- project: acdl phase: P57 milestone: v1.11 status: execute ---/ci---	2026-07-28 16:07:57 +00:00
Jon Chery	5c1d5aaab5	docs(P57): create phase plan — shell orchestrator lifecycle modes PLAN stage. P57 adds --apply and --destroy modes to run_platform.sh. The shell owns all terraform lifecycle; Python never runs terraform. 4 tasks: add flags + lifecycle branches, update usage header, add tests, offline regression. ---ci--- project: acdl phase: P57 milestone: v1.11 status: plan ---/ci---	2026-07-28 16:07:57 +00:00
Jon Chery	42354989bb	verify(P56b): 4-layer gate — PASS Layer 1 (Structural): all 12 L1 modules have terraform/ subdirs with required files (versions/variables/locals/main/outputs.tf). 7 single-resource modules have 4-5 files; 4 multi-resource modules have 5 files with locals.tf. All 12 registry entries have terraform_dir. No TODO/stub. PASS. Layer 2 (Behavioral): all 12 terraform/ subdirs pass terraform validate standalone. Full offline suite 461 passed, 0 skipped, 5 deselected (slow). All 12 modules pass run_primitive_plan.sh --check-only. The 6 previously- skipped P56b tests are unblocked and passing. PASS. Layer 3 (Security/STRIDE): no credentials in any module; no hardcoded account IDs in modules (account ID only in adapter S3 backend). Auto- accepted. PASS. Layer 4 (Quality): 0 P0, 0 P1. Multi-resource modules reference local.* heavily in main.tf (vpc: 9, ecs-service: 5, cloudfront: 4, iam-role: 4) — defaults centralized in locals.tf per the stateless adapter standard. Adapter remains stateless (155 lines, no TYPE_MAP/INPUT_MAP/OUTPUT_MAP). PASS. Verdict: VERIFY PASS. P56b ready to merge to milestone/v1.11-restart. ---ci--- project: acdl phase: P56b milestone: v1.11 status: verify requirements: covered: [REQ-124] partial: [] ---/ci---	2026-07-28 16:07:57 +00:00
Jon Chery	c80060878a	feat(P56b): author 11 L1 module terraform subdirs + fix adapter output format EXECUTE stage. Authors the remaining 11 L1 module terraform subdirs with the full versions/variables/locals/main/outputs split. Defaults previously hardcoded in the adapter move into locals.tf. Simple single-resource modules (7): - kms-key: aws_kms_key + alias (enable_key_rotation, deletion_window defaults) - ecr: aws_ecr_repository (encryption_configuration from kms_key_arn, image_scanning) - ecs-cluster: aws_ecs_cluster (name default) - iam-role: aws_iam_role + inline_policy (assume_role_policy fallback, ECR/logs policy in locals.tf) - rds: aws_db_instance (storage_encrypted, multi_az, kms_key_arn defaults) - waf: aws_wafv2_web_acl (default_action, visibility_config, dynamic rules) - uptime: aws_ecs_task_definition + aws_ecs_service (Fargate compat, container_definitions in locals.tf) Multi-resource modules with intra-refs (4): - vpc: aws_vpc + aws_subnet + aws_internet_gateway + aws_route_table (CIDR derivation in locals.tf) - ecs-service: aws_ecs_task_definition + aws_ecs_service (Fargate compat, container_definitions, network_config in locals.tf) - alb: aws_lb + aws_lb_target_group + aws_lb_listener (subnet/security_group list derivation in locals.tf) - cloudfront: aws_cloudfront_distribution + aws_cloudfront_origin_access_control (OAC defaults in locals.tf) Registry: terraform_dir added to all 11 remaining entries. Adapter fix: stack output format uses separate 'from' + 'output' fields (not 'from': 'rid.output'). Fixed _emit_root_output to read both fields. 6 previously-skipped tests unblocked (run_platform.sh --check-only now resolves static-assets.yml through the new module-assembled adapter). Removed skip markers. Fixed test assertion (aws_s3_bucket → module). Regression: 461 passed, 0 skipped, 5 deselected (slow). All 12 modules pass run_primitive_plan.sh --check-only. All 12 terraform/ subdirs pass terraform init + validate standalone. ---ci--- project: acdl phase: P56b milestone: v1.11 status: execute ---/ci---	2026-07-28 16:07:57 +00:00
Jon Chery	8218734957	docs(P56b): create phase plan — author 11 L1 module terraform subdirs PLAN stage. P56b authors the remaining 11 L1 module terraform subdirs (vpc, ecs-cluster, ecs-service, iam-role, alb, ecr, cloudfront, waf, rds, kms-key, uptime) with the full versions/variables/locals/main/outputs split. Defaults move from the adapter into locals.tf. 7 single-resource modules (simpler): kms-key, ecr, ecs-cluster, iam-role, rds, waf, uptime. 4 multi-resource modules (full split with intra-refs): vpc, ecs-service, alb, cloudfront. Success gate: all 12 terraform/ subdirs validate standalone, all 12 registry entries have terraform_dir, the 6 P56b-skipped tests unblock. ---ci--- project: acdl phase: P56b milestone: v1.11 status: plan ---/ci---	2026-07-28 16:07:57 +00:00
Jon Chery	027a845b4d	verify(P56a): 4-layer gate — PASS Layer 1 (Structural): adapter 154 lines (< 200), no TYPE_MAP/INPUT_MAP/ OUTPUT_MAP, no rtype == branches, s3 terraform/ has all 5 files (versions/variables/locals/main/outputs.tf), registry has terraform_dir, STANDARDS.md §8 rewritten to Stateless Assembler Pattern, no TODO/stub. PASS. Layer 2 (Behavioral): 29/29 test_adapter.py pass (assembly assertions + statelessness + terraform validate on emitted output). Full offline suite 455 passed, 6 skipped (P56b-dependent: run_platform.sh --check-only defaults to static-assets.yml needing cloudfront/waf terraform dirs), 5 deselected (slow). s3 module validates standalone. Adapter-emitted root main.tf validates. run_primitive_plan --check-only s3 exits 0. PASS. Layer 3 (Security/STRIDE): no credentials in adapter or module; account ID only in adapter S3 backend (expected — not in module); no hardcoded secrets. Auto-accepted (low severity). PASS. Layer 4 (Quality): 0 P0 (adapter stateless, defaults in locals.tf), 0 P1 (adapter 154 lines, 29 assembly tests), 0 P2. main.tf references var.* for passthrough inputs (bucket_name, kms_key_arn) and local.* for interpolated defaults (sse_algorithm, tags) — correct pattern. 6 skipped tests have clear P56b reason. PASS. Verdict: VERIFY PASS. P56a ready to merge to milestone/v1.11-restart. ---ci--- project: acdl phase: P56a milestone: v1.11 status: verify requirements: covered: [REQ-123] partial: [] ---/ci---	2026-07-28 16:07:57 +00:00
Jon Chery	a16e6f1bff	feat(P56a): stateless adapter rewrite + s3 reference terraform module EXECUTE stage. Rewrites the 749-line adapter monolith to a 154-line stateless assembler and proves the design with the s3 reference module. Stateless adapter (adapters/terraform/adapter.py, 749 → 154 lines): - Deleted TYPE_MAP, INPUT_MAP, OUTPUT_MAP (3 constant tables). - Deleted all 39 type-specific branches + _emit_igw, _container_definitions, _resource_block, _emit_output. - New adapt(): reads registry.json → terraform_dir → emits root main.tf with module-instantiation blocks (module "x" { source = ... }) + ref wiring via module.<rid>.<output> interpolations + root outputs. - The adapter owns NO resource shape, NO nested blocks, NO defaults, NO type-specific logic. It only assembles module instantiations and wires refs. s3 reference terraform module (modules/l1/s3/terraform/): - versions.tf (required_version + aws ~> 5.0) - variables.tf (bucket_name, region, kms_key_arn, tags) - locals.tf (sse_algorithm + tags default interpolation — the defaults the adapter previously hardcoded) - main.tf (aws_s3_bucket + versioning + SSE config, referencing local.*) - outputs.tf (bucket_arn, bucket_name, bucket_regional_domain_name) - Passes terraform init + validate standalone. Registry (modules/registry.json): s3 entry gains terraform_dir field. STANDARDS.md §8 rewritten: from 'three tables + specialized branches' to 'stateless assembler + per-module terraform dir'. §9.4 checklist updated. §9.1 required-files list updated to include terraform/ subdir. tests/test_adapter.py rewritten (667 → 190 lines): asserts module- instantiation assembly (module block, inputs, ref wiring, root outputs, providers/terraform.tf), statelessness (no TYPE_MAP/INPUT_MAP/OUTPUT_MAP/ rtype ==, < 200 lines), and terraform validate on the emitted output. Deleted test_p1_1_adapter_parameterization.py (tested the deleted HCL string emission). 6 pipeline tests skipped (run_platform.sh --check-only defaults to static-assets.yml which needs cloudfront/waf terraform dirs — P56b). Regression: 455 passed, 6 skipped, 5 deselected (slow). run_primitive_plan --check-only s3 exits 0. ---ci--- project: acdl phase: P56a milestone: v1.11 status: execute ---/ci---	2026-07-28 16:07:57 +00:00
Jon Chery	1efb44444a	docs(P56a): create v1.11 RESTART phase plan — stateless adapter + s3 reference PLAN stage. P56a is the first phase of the v1.11 restart: rewrite the 918-line adapter monolith to a ~80-line stateless assembler, prove the design with the s3 reference module. 6 tasks, single wave (no parallelization — one cohesive change): 1. s3 reference terraform module (versions/variables/locals/main/outputs) 2. Registry extension (terraform_dir field) 3. Stateless adapter rewrite (delete TYPE_MAP/INPUT_MAP/OUTPUT_MAP + 39 branches) 4. STANDARDS.md §8 rewrite (stateless assembler pattern) 5. test_adapter.py rewrite (assert assembly, not HCL strings) 6. Offline regression (pytest + run_primitive_plan.sh --check-only s3) Success gate: adapter < 100 lines, no type-specific logic, s3 module validates standalone, adapter-emitted root main.tf validates, offline suite green. ---ci--- project: acdl phase: P56a milestone: v1.11 status: plan ---/ci---	2026-07-28 16:07:57 +00:00
Jon Chery	ad0e0378da	docs(P56a): research findings for v1.11 RESTART RESEARCH stage. Verified the technical assumptions behind the 13-phase v1.11 restart plan against the live codebase (branched off v1.10.2). Findings: - Adapter monolith audit: adapters/terraform/adapter.py is 918 lines with 3 constant tables (TYPE_MAP/INPUT_MAP/OUTPUT_MAP) that duplicate what interface.json already declares, plus 39 type-specific branches across 18 stack types carrying nested HCL blocks + hardcoded defaults (CIDR, assume_role_policy JSON, ECR/logs inline policy, Fargate requires_compatibilities, assign_public_ip, listener/target ports, security group emission). STANDARDS.md §8 blessed this drift as the intended design — the standards doc itself must be rewritten (P56a). - State-key root cause of the 4-VPC bug: adapter.py:664,676 emits spike/{stack_name}/terraform.tfstate where stack_name = contract.id; all 5 microservice contracts share id 'msvc' but differ in environment (dev/qa/prod/dr); the state key does NOT include the environment, so all 4 env contracts collide on spike/msvc/terraform.tfstate. Combined with verify_deploy_microservice.py running terraform init -reconfigure in a fresh temp dir each time, each run created a fresh VPC. Two root causes: (1) per-contract state keys with no VPC sharing, (2) non-deterministic state keys across environments. D-105 + D-106 + D-101 correct all three. - Per-module terraform module design: documented the versions/variables/locals/main/outputs.tf layout for s3, vpc, ecs-service and how the stateless adapter assembles them via registry.json → terraform_dir → module-instantiation blocks + ref wiring. - Existing pipeline architecture: run_platform.sh line 287 runs terraform plan only (never apply/destroy); the --apply/--destroy lifecycle modes must be ADDED (P57). Byte-identical Gitea+GitHub convention documented. PERSONAS.md updated for v1.11: - Deactivated lambda-engineer, platform-engineer, security-engineer, frontend-engineer (no per-module Python this milestone). - Reactivated data-engineer (owns terraform/ + per-module terraform subdirs — the heaviest v1.11 work). - Kept backend-engineer (adapter/resolver), general (pipelines/workflows). - Territory enforcement: warn (co-authoring expected on adapter + run_platform.sh boundary). - Domain priority: data → backend → general. 6 assumptions logged (A-1.1..A-5.1), all >= 0.6 confidence, none escalated. ---ci--- project: acdl phase: 0 milestone: v1.11 status: research ---/ci---	2026-07-28 16:07:57 +00:00
Jon Chery	6d3bcec73a	docs(clarify): v1.11 RESTART — 10 binding decisions, 0 escalations (full autonomy) CLARIFY stage. Autonomy=full, budget=10, threshold=0.6. All decisions were user-confirmed during the planning conversation (no ambiguities escalated beyond budget). Binding decisions (all user-confirmed, confidence >= 0.8): D-097 (0.95): v1.11 restart branches off v1.10.2 (clean), not main. The failed first attempt (phase/56 + phase/57) is abandoned; the restart preserves the audit trail of what went wrong. Branch: milestone/v1.11-restart. D-098 (0.90): The terraform adapter becomes a stateless assembler. Each L1 module ships a real terraform/ module dir (versions/ variables/locals/main/outputs.tf) owning its resource shape, nested blocks, and defaults. The adapter deletes TYPE_MAP/INPUT_MAP/ OUTPUT_MAP and all 39 type-specific branches, becoming a ~80-line assembler that emits module-instantiation blocks. interface.json stays engine-agnostic; the terraform dir is the engine binding. D-099 (0.90): Per-module terraform is a proper module, not crammed into main.tf. locals.tf is used heavily to centralize interpolation of variables against their sensible defaults. Multi-resource modules get the full split; trivial single-resource modules may inline locals in main.tf. D-100 (0.85): Defaults (CIDR blocks, assume_role_policy JSON, ECR/ logs inline policy, Fargate requires_compatibilities, assign_public_ip) move into the module terraform (locals.tf variable defaults or hardcoded in the resource block). The adapter passes only resolved contract inputs. If a default is wrong, fix the module, not the adapter. D-101 (0.90): Terraform owns lifecycle. run_platform.sh gains --apply and --destroy modes. Python never runs terraform. verify_deploy_ microservice.py is deleted. Python only orchestrates the shell; boto3 read-only verify probes are deferred to a future QA milestone. D-102 (0.85): Testing is pipeline-driven. A modules-lifecycle pipeline (Gitea + GitHub, byte-identical) matrix-runs each L1 module's examples/{simple,complex}.yml contracts through apply→modify→destroy against live AWS. No per-module Python/pytest. The 'test' = the pipeline cell going green. D-103 (0.85): Modify lifecycle = apply simple → apply complex (same state key, terraform modifies) → destroy. Uses the module's own existing example contracts as the modify variants. No extra contract files needed. D-104 (0.80): Lifecycle pipeline triggers on pull_request to main + workflow_dispatch. AWS creds via CI secrets. Cost ~$1/PR (28 apply→ destroy cells). Pipeline enforces destroy as the last step. Fall back to manual-dispatch-only if cost is too high. D-105 (0.90): Single platform VPC. terraform/platform owns ONE VPC; the microservice composition drops its vpc child and references the platform VPC via data source. The standalone vpc L1 module stays (consumers deploy their own VPCs). No per-contract VPC ever again. D-106 (0.90): L2 = composition only. No L2 terraform files. The composition must be deterministic: same contract → same resolved stack → same state key (spike/{id}/{env}/terraform.tfstate), every time. State keys are env-aware and stable across apply/modify/destroy. D-107 (0.85): P56 split into P56a (adapter rewrite + s3 reference module, proves the design) + P56b (author remaining 11 L1 module terraform subdirs). Keeps phases atomic. No ambiguities escalated beyond budget. ---ci--- project: acdl phase: 0 milestone: v1.11 status: clarify decisions: - id: D-097 decision: v1.11 restart branches off v1.10.2 (clean), not main. confidence: 0.95 - id: D-098 decision: Adapter becomes a stateless assembler; each L1 ships a terraform/ module dir. confidence: 0.90 - id: D-099 decision: Per-module terraform is a proper module with heavy locals.tf for default interpolation. confidence: 0.90 - id: D-100 decision: Defaults move into the module terraform (locals.tf), not the adapter. confidence: 0.85 - id: D-101 decision: Terraform owns lifecycle; Python never runs terraform; verify_deploy_microservice.py deleted. confidence: 0.90 - id: D-102 decision: Testing is pipeline-driven (apply→modify→destroy); no per-module Python. confidence: 0.85 - id: D-103 decision: Modify = apply simple → apply complex (same state) → destroy. confidence: 0.85 - id: D-104 decision: Lifecycle pipeline triggers on PR + workflow_dispatch. confidence: 0.80 - id: D-105 decision: Single platform VPC; standalone vpc L1 stays. confidence: 0.90 - id: D-106 decision: L2 = composition only; deterministic state keys. confidence: 0.90 - id: D-107 decision: P56 split into P56a (adapter + s3 reference) + P56b (11 remaining modules). confidence: 0.85 ---/ci---	2026-07-28 16:07:57 +00:00
Jon Chery	a6e306a904	docs(init): validate v1.11 RESTART specification SPECIFY stage. v1.11 — RESTART: stateless adapter + pipeline-driven module lifecycle testing. Branches off v1.10.2 (clean); abandons the failed first attempt (phase/56-iam-re-bootstrap + phase/57-live-deploy- microservice, which produced 4 drifted VPCs, ran terraform apply from Python, and had no module lifecycle tests). Three corrections: 1. Stateless adapter — adapter.py (918 lines, 3 constant tables, 39 type-specific branches) → ~80-line assembler; each L1 ships a real terraform/ module dir (variables/locals/main/outputs) owning its resource shape, nested blocks, defaults. 2. Terraform owns lifecycle — run_platform.sh gains --apply/--destroy; Python never runs terraform; verify_deploy_microservice.py deleted. 3. Pipeline-driven testing — modules-lifecycle pipeline (Gitea + GitHub, byte-identical) matrix-runs each L1 examples/{simple,complex}.yml through apply→modify→destroy; no per-module Python. Single platform VPC (terraform/platform owns ONE VPC; microservice references it via data source). Deterministic env-aware state keys (spike/{id}/{env}/terraform.tfstate, stable across lifecycle). 13 phases (P56a–P65). 6 new requirements (REQ-123..128) + 6 carried (REQ-116,118,119,120,121,122). Feature milestone → v1.11.0. ---ci--- project: acdl phase: 0 milestone: v1.11 status: specify ---/ci---	2026-07-28 16:07:57 +00:00
Jon Chery	69cb0ca36d	docs(P57): update ROADMAP for v1.10.2 release acdl-ci / Lint (push) Successful in 7s Details acdl-ci / Test (push) Successful in 2m7s Details acdl-ci / Platform check-only (offline) (push) Successful in 18s Details ---ci--- project: acdl phase: 57 milestone: v1.10.2 status: complete ---/ci---	2026-07-28 12:17:35 +00:00

Compare commits

20 Commits

4f76647489 .. 60f767d125

Diff Content Not Available

Compare commits

20 Commits 4f76647489 .. 60f767d125

Diff Content Not Available

20 Commits

4f76647489 .. 60f767d125