continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity

feat(P4): Nova rebrand — AWS resource migration (REQ-163)

Browse Source 
Rename all acdl-* AWS resources → nova-* across terraform (DynamoDB,
Secrets Manager, Lambda, SNS, SG, KMS alias, ECS, ECR, IAM user/policy,
state bucket, ALB, VPC/subnet names). Lambda default table names → nova-*
(D-111). State bucket backend → nova-tfstate (-migrate-state documented).
New docs/NOVA_AWS_MIGRATION.md runbook (staged migration + rollback).
New scripts/migrate_dynamodb_data.py (scan+copy, dry-run default).
acdl-deploy- → nova-deploy- role ARN in deploy workflows. Test fixtures
updated; terraform validate + pytest + run_ci.sh PASS.

---ci---
project: acdl
phase: 4
milestone: v1.15
status: execute
---/ci---
This commit is contained in:
Jon Chery
2026-07-30 01:54:26 +00:00
parent 267df4ad0d
commit 0e6ecae26d
46 changed files with 932 additions and 258 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/lambda/contract_ingestor.py
+7 -7
View File
@@ -2,7 +2,7 @@
Invoked via a Function URL (IAM auth) by consumer pipelines (one-way
communication, D-051). Accepts { consumerRepo, contractId, contract,
environment, action } and writes contracts to DynamoDB table acdl-contracts
environment, action } and writes contracts to DynamoDB table nova-contracts
(PK consumerRepo, SK contractId#submittedAt).
The report_error action (D-055) creates a GitHub issue on the platform repo
@@ -22,10 +22,10 @@ import urllib.parse
import boto3
TABLE_NAME = os.environ.get("CONTRACTS_TABLE", "acdl-contracts")
CHANGE_REQUESTS_TABLE = os.environ.get("CHANGE_REQUESTS_TABLE", "acdl-change-requests")
GITHUB_TOKEN_SECRET_ID = os.environ.get("GITHUB_TOKEN_SECRET_ID", "acdl/github-token")
PLATFORM_REPO = os.environ.get("PLATFORM_REPO", "acdl/acdl")
TABLE_NAME = os.environ.get("CONTRACTS_TABLE", "nova-contracts")
CHANGE_REQUESTS_TABLE = os.environ.get("CHANGE_REQUESTS_TABLE", "nova-change-requests")
GITHUB_TOKEN_SECRET_ID = os.environ.get("GITHUB_TOKEN_SECRET_ID", "nova/github-token")
PLATFORM_REPO = os.environ.get("PLATFORM_REPO", "nova/acdl")
# P1-9: Forge-agnostic API base URL. Defaults to GitHub; set GITHUB_API_BASE
# to a Gitea API root (e.g. https://git.cloudinit.dev/api/v1) for Gitea.
GITHUB_API_BASE = os.environ.get("GITHUB_API_BASE", "https://api.github.com")
@@ -243,7 +243,7 @@ def _validate_caller_identity(event, payload):
error length. The ABAC reliance is documented here: the Function URL IAM
identity does not expose principal tags in the event, so full enforcement
of consumerRepo ownership is at the IAM layer (ABAC via
aws:PrincipalTag/acdl:owner). This function validates format only, not
aws:PrincipalTag/nova:owner). This function validates format only, not
ownership.
"""
identity = event.get("requestContext", {}).get("identity", {})
@@ -279,7 +279,7 @@ def _validate_caller_identity(event, payload):
def _validate_change_request(payload):
"""REQ-93: Validate a change request ID against the CMDB (DynamoDB).
Queries the acdl-change-requests table for the given changeRequestId.
Queries the nova-change-requests table for the given changeRequestId.
Returns the CR details if status is 'approved' and the consumerRepo matches.
Raises ValueError if the CR is not found, not approved, or the repo doesn't match.
"""
core/local_emulators.py
+2 -2
View File
@@ -87,7 +87,7 @@ class FlatFileOutbox:
return hashlib.sha256(canonical.encode("utf-8")).hexdigest()
def write_event(self, event: Dict[str, Any],
outbox_table: str = "acdl-outbox-local",
outbox_table: str = "nova-outbox-local",
region: str = "local") -> Dict[str, Any]:
"""Write an evidence event to the flat-file outbox.
@@ -428,7 +428,7 @@ def run_local_e2e(contract_path: str, repo_root: Optional[Path] = None) -> Dict[
stack = resolve(contract_path, str(root))
stack_name = stack["stack"]["name"]
work = Path(tempfile.mkdtemp(prefix="acdl_local_e2e_"))
work = Path(tempfile.mkdtemp(prefix="nova_local_e2e_"))
tf_dir = work / "tf"
tf_dir.mkdir(exist_ok=True)
adapter.adapt(stack, str(tf_dir))
core/outbox_writer.py
+3 -3
View File
@@ -1,11 +1,11 @@
"""ACDL Outbox Writer — write an evidence event to the DynamoDB outbox.
"""Nova Outbox Writer — write an evidence event to the DynamoDB outbox.
ARCHITECTURE.md §9: DynamoDB outbox, RPO=0 (synchronous write before
ack). The event is hash-chained (SHA-256 over canonical JSON); the first
event has prev_event_hash="GENESIS". D-P10-3: the spike writes ONE
CONFIDENCE_COMPUTED event.
The outbox table (Phase 08): acdl-outbox, PAY_PER_REQUEST, PK contractId,
The outbox table (Phase 08): nova-outbox, PAY_PER_REQUEST, PK contractId,
SK eventType#eventTs, TTL expire_at = now + 365d (D-044).
CLI: outbox_writer.py <event.json> (uses AWS creds from env)
@@ -20,7 +20,7 @@ import sys
import boto3
OUTBOX_TABLE = "acdl-outbox"
OUTBOX_TABLE = "nova-outbox"
REGION = os.environ.get("AWS_DEFAULT_REGION", "us-east-1")
core/regression_verify.py
+8 -8
View File
@@ -336,7 +336,7 @@ def _check_live_terraform_plan_microservice() -> Tuple[Status, str]:
dual-read NOVA_* first, ACDL_* fallback per G-106).
Runs in a temp dir; does NOT apply (plan only)."""
import tempfile, os
work = tempfile.mkdtemp(prefix="acdl_regr_live_")
work = tempfile.mkdtemp(prefix="nova_regr_live_")
stack_path = os.path.join(work, "stack.json")
tf_dir = os.path.join(work, "tf")
os.makedirs(tf_dir, exist_ok=True)
@@ -376,7 +376,7 @@ def _check_live_terraform_plan_static_assets() -> Tuple[Status, str]:
"""CAP-014: terraform init+validate+plan against live AWS for the
static-assets stack (CloudFront + WAF + S3)."""
import tempfile, os
work = tempfile.mkdtemp(prefix="acdl_regr_live_sa_")
work = tempfile.mkdtemp(prefix="nova_regr_live_sa_")
stack_path = os.path.join(work, "stack.json")
tf_dir = os.path.join(work, "tf")
os.makedirs(tf_dir, exist_ok=True)
@@ -420,9 +420,9 @@ def _check_dynamodb_outbox_table() -> Tuple[Status, str]:
dyn = boto3.client("dynamodb", region_name=env.get("AWS_DEFAULT_REGION", "us-east-1"),
aws_access_key_id=env.get("AWS_ACCESS_KEY_ID"),
aws_secret_access_key=env.get("AWS_SECRET_ACCESS_KEY"))
r = dyn.describe_table(TableName="acdl-outbox")
r = dyn.describe_table(TableName="nova-outbox")
count = r["Table"].get("ItemCount", "unknown")
return "Verified", f"acdl-outbox exists, item_count={count}"
return "Verified", f"nova-outbox exists, item_count={count}"
except Exception as e:
return "Decayed", f"describe_table failed: {type(e).__name__}: {str(e)[:150]}"
@@ -436,7 +436,7 @@ def _check_s3_state_bucket() -> Tuple[Status, str]:
aws_access_key_id=env.get("AWS_ACCESS_KEY_ID"),
aws_secret_access_key=env.get("AWS_SECRET_ACCESS_KEY"))
account_id = _envhelper.get_env("AWS_ACCOUNT_ID", "581513795199")
state_bucket = f"acdl-tfstate-{account_id}-us-east-1"
state_bucket = f"nova-tfstate-{account_id}-us-east-1"
s3.head_bucket(Bucket=state_bucket)
r = s3.list_objects_v2(Bucket=state_bucket, MaxKeys=5)
keys = [o["Key"] for o in r.get("Contents", [])]
@@ -508,7 +508,7 @@ def _check_lifecycle_l2_module(module: str) -> Tuple[Status, str]:
def _check_cap_017_dynamodb() -> Tuple[Status, str]:
"""CAP-017: DynamoDB acdl-contracts table. Evidence = L1 rds module
"""CAP-017: DynamoDB nova-contracts table. Evidence = L1 rds module
lifecycle pipeline green (terraform validate + contracts resolve).
The DynamoDB table is created via the microservice stack (L2 lifecycle).
"""
@@ -523,7 +523,7 @@ def _check_cap_018_lambda() -> Tuple[Status, str]:
"python3", "-c",
"from core.local_emulators import LocalLambdaStub, FlatFileOutbox; "
"import tempfile; "
"stub = LocalLambdaStub(outbox=FlatFileOutbox(tempfile.mkdtemp(prefix='acdl_stub_'))); "
"stub = LocalLambdaStub(outbox=FlatFileOutbox(tempfile.mkdtemp(prefix='nova_stub_'))); "
"print('LocalLambdaStub instantiates OK')",
])
if rc != 0:
@@ -592,7 +592,7 @@ CAPABILITY_REGISTRY: List[Tuple[str, str, str, Callable[[], Tuple[Status, str]]]
_check_dynamodb_outbox_table),
("CAP-016", "S3 state bucket exists + readable (live AWS)", "live-aws",
_check_s3_state_bucket),
("CAP-017", "DynamoDB acdl-contracts table (lifecycle pipeline evidence)", "lifecycle-pipeline",
("CAP-017", "DynamoDB nova-contracts table (lifecycle pipeline evidence)", "lifecycle-pipeline",
_check_cap_017_dynamodb),
("CAP-018", "Lambda contract-ingestor (local stub + lifecycle evidence)", "lifecycle-pipeline",
_check_cap_018_lambda),