ADR 0018 — Declare the cloud environment as a contract a session can measure itself against

ga · floor-software-engineer

Decision

Declare the cloud environment as a contract a session can measure itself against

Why

A setup script and variables in two textareas cannot be diffed, so a script calling itself the source of truth is a claim with no gate behind it. A script says what to run and cannot say what should be true afterwards. The contract declares the afterwards; env:check measures a container and gen:setup derives the paste target from the same declaration, so they cannot disagree about what provisioned means.

Measured

The old script resolved ROOT=${CLAUDE_PROJECT_DIR:-/workspace/akw-mirrors} and exited 0 when $ROOT/infra was absent; CLAUDE_PROJECT_DIR is unset in a cloud session and one of four repos has infra/, so three of four sessions were provisioned nothing and told setup succeeded. Four credentials readable from the plain variable box, reported MISPLACED -- a third verdict, because a secret in the wrong place is a finding that looks like a pass. gh was the one missing required tool; the generated script installed 2.45.0. The generated script's first version lost two parallel steps' results to a subshell -- the exact failure it was written to end.

Inputs and outputs

This decision declares none. Every name in this section, when present, resolves against the capability vocabulary or the floor registry -- a typo fails the generator rather than rendering.

Where it is