verify(P1): state-bucket + Kyverno rebrand — 4-layer verify PASS + ship

VERIFY: structural — adapter.py:117 nova-tfstate-*; kyverno policy nova:*
labels; behavioral — 80 tests PASS + run_ci.sh 3-stage PASS; security —
emitted backend no longer points at a non-existent bucket; quality —
new test_adapt_emits_nova_state_bucket regression guard. REQ-165 complete.

---ci---
project: acdl
phase: 1
milestone: v1.16
status: complete
phase_role: execution
requirements:
  covered: [REQ-165]
  partial: []
---/ci---

.ciagent/CHECKPOINT.json

@@ -1,9 +1,9 @@
 {
-  "phase": 0,
+  "phase": 1,
-  "stage": "plan",
+  "stage": "execute",
   "milestone": "v1.16",
-  "phase_role": "pre_execution",
+  "phase_role": "execution",
   "attempts": 0,
-  "updated_at": "2026-07-30T15:15:00Z",
+  "updated_at": "2026-07-30T15:30:00Z",
   "milestone_complete": false
 }

adapters/kyverno/README.md

@@ -55,8 +55,8 @@ manifests (documentation-only today — the platform does not run them):
 
 - `disallow-privileged-containers.yml` — fail pods with
   `securityContext.privileged: true`.
-- `require-resource-labels.yml` — require `acdl:owner` and
+- `require-resource-labels.yml` — require `nova:owner` and
-  `acdl:environment` labels on all pods (mirrors the ACDL tagging standard
+  `nova:environment` labels on all pods (mirrors the Nova tagging standard
   in [`schemas/tagging-standard.json`](../../schemas/tagging-standard.json)).
 - `require-image-digests.yml` — require container images to reference a
   digest (`image@sha256:...`), not a mutable tag.

adapters/kyverno/policies/require-resource-labels.yml

@@ -3,7 +3,7 @@ kind: ClusterPolicy
 metadata:
   name: require-resource-labels
   annotations:
-    policies.kyverno.io/title: Require ACDL Resource Labels
+    policies.kyverno.io/title: Require Nova Resource Labels
     policies.kyverno.io/category: Governance
     policies.kyverno.io/severity: medium
     policies.kyverno.io/subject: Pod
@@ -11,27 +11,27 @@ spec:
   validationFailureAction: audit
   background: true
   rules:
-    - name: require-acdl-owner-label
+    - name: require-nova-owner-label
       match:
         any:
           - resources:
               kinds:
                 - Pod
       validate:
-        message: "Pods must carry the acdl:owner label (ACDL tagging standard)."
+        message: "Pods must carry the nova:owner label (Nova tagging standard)."
         pattern:
           metadata:
             labels:
-              acdl:owner: "?*"
+              nova:owner: "?*"
-    - name: require-acdl-environment-label
+    - name: require-nova-environment-label
       match:
         any:
           - resources:
               kinds:
                 - Pod
       validate:
-        message: "Pods must carry the acdl:environment label (ACDL tagging standard)."
+        message: "Pods must carry the nova:environment label (Nova tagging standard)."
         pattern:
           metadata:
             labels:
-              acdl:environment: "?*"
+              nova:environment: "?*"

adapters/terraform/adapter.py

@@ -114,7 +114,7 @@ def adapt(stack_instance, out_dir):
     stack_name = stack.get("name", "spike")
     environment = stack.get("environment", "dev")
     account_id = env.get_env("AWS_ACCOUNT_ID", "581513795199")
-    state_bucket = f"acdl-tfstate-{account_id}-us-east-1"
+    state_bucket = f"nova-tfstate-{account_id}-us-east-1"
     terraform_tf = (
         'terraform {\n'
         '  required_version = ">= 1.9, < 1.10"\n'

tests/test_adapter.py

@@ -90,6 +90,15 @@ class TestModuleAssembly:
         assert 'backend "s3"' in terraform_tf
         assert 'spike/s3/dev/terraform.tfstate' in terraform_tf
 
+    def test_adapt_emits_nova_state_bucket(self, tmp_path):
+        """P1 (REQ-165): the emitted backend references nova-tfstate-*
+        (not acdl-tfstate-*); the live bucket was renamed in v1.15 P4."""
+        instance = json.load(open(ROOT / "modules/l1/s3/instance.json"))
+        adapt(instance, str(tmp_path))
+        terraform_tf = (tmp_path / "terraform.tf").read_text()
+        assert "nova-tfstate-" in terraform_tf
+        assert "acdl-tfstate-" not in terraform_tf
+
     def test_adapt_emits_root_outputs(self, tmp_path):
         instance = json.load(open(ROOT / "modules/l1/s3/instance.json"))
         instance["outputs"] = {