feat(P3): Nova rebrand — SSM path + tag keys (REQ-161/162)

SSM path /acdl/{env}/{contractId}/{output} → /nova/... across
core/output_publisher + contract resolver + consumer docs. New
scripts/migrate_ssm_paths.py (copy/verify/delete, dry-run default).
AWS tag keys acdl:owner|environment|contract|cost-center|ref → nova:*
across terraform tagging + ABAC session policies (iam:ResourceTag/acdl:*
→ iam:ResourceTag/nova:*). nova_tagging.py hard mode (D-109 warn→hard).
tagging-standard.json tag-key values → nova:*. New
scripts/untag_acdl_keys.py (remove old acdl:* tags, dry-run default).
Test fixtures updated; pytest + run_ci.sh PASS.

---ci---
project: acdl
phase: 3
milestone: v1.15
status: execute
---/ci---

adapters/terraform/policy/checkov_adapter.py

@@ -6,13 +6,13 @@ schemas/policy_check_result.schema.json. Run Checkov with --soft-fail so
 Checkov never exits non-zero; the confidence signal decides the gate, not
 Checkov's exit code.
 
-The Nova tagging standard (D-054, D-043 closure, D-109 warn mode in P2)
+The Nova tagging standard (D-054, D-043 closure, D-109 hard mode in P3)
 is enforced by a custom Checkov rule at
 adapters/terraform/policy/custom_rules/nova_tagging.py, loaded via
 --external-checks-dir. The adapter therefore maps NOVA_TAG_NAMING as a
 real rule (no synthetic SKIPPED record is emitted). Renamed from
-ACDL_TAG_NAMING in P2 (REQ-158); the rule is in warn mode for P2
-(legacy acdl:* tag-key values stay until P3).
+ACDL_TAG_NAMING in P2 (REQ-158); the rule is in hard mode as of P3
+(REQ-162: hard-fail on missing nova:* or acdl:*-only tags).
 """
 
 import datetime
@@ -32,11 +32,11 @@ RULE_MAP = {
     "CKV_AWS_40": ("iam-wildcard", "medium"),
     "CKV_AWS_7": ("kms-key-reference", "medium"),
     "CKV_AWS_33": ("kms-key-reference", "medium"),
-    # D-054 / D-043 closure, D-109 warn mode (P2): NOVA_TAG_NAMING is a real
+    # D-054 / D-043 closure, D-109 hard mode (P3): NOVA_TAG_NAMING is a real
     # custom Checkov rule (adapters/terraform/policy/custom_rules/nova_tagging.py),
     # loaded via --external-checks-dir. No synthetic SKIPPED record is emitted.
-    # Renamed from ACDL_TAG_NAMING in P2 (REQ-158). Warn mode treats legacy
-    # acdl:*-only tags as a warning (P3 flips to hard-fail).
+    # Renamed from ACDL_TAG_NAMING in P2 (REQ-158). Hard mode as of P3
+    # (REQ-162: hard-fail on missing nova:* or acdl:*-only tags).
     "NOVA_TAG_NAMING": ("tagging-standard", "medium"),
 }
 

adapters/terraform/policy/custom_rules/nova_tagging.py

@@ -1,15 +1,16 @@
-"""Nova tagging standard custom Checkov rule (D-054, D-109 warn mode).
+"""Nova tagging standard custom Checkov rule (D-054, D-109 hard mode).
 
 Checks that all taggable AWS resources have the required Nova tags:
   nova:owner, nova:contract, nova:environment, nova:cost-center
 
-In **warn mode** (P2, REQ-158): existing resources still carry `acdl:*`
-tags (the legacy tag-key VALUES stay until P3). When a resource has
-only `acdl:*`-style tags and no `nova:*` tags, the rule logs a WARNING
-instead of failing, so the regression gate stays green during the
-parallel-tag transition window. P3 flips this to hard-fail (D-109 hard
-mode) once `nova:*` tags are emitted in parallel and the ABAC policy is
-swapped.
+In **hard mode** (P3, REQ-162): the rule hard-fails when a taggable resource
+is missing any required `nova:*` tag, OR when a resource carries only the
+legacy `acdl:*` tag keys (and no `nova:*` keys). P2 shipped warn mode
+(`_WARN_MODE = True`) so the regression gate stayed green during the
+parallel-tag transition window; P3 flips to hard-fail (`_WARN_MODE = False`)
+once `nova:*` tags are emitted in terraform and the ABAC policy is swapped
+to match `nova:*`. P5 keeps hard mode and additionally hard-fails on any
+`acdl:*` tag key present at all (no legacy tolerated post-cutoff).
 
 Closes the D-043 deferral (the SKIPPED NOVA_TAG_NAMING placeholder
 becomes a real check). Renamed from acdl_tagging.py in P2 (REQ-158);
@@ -38,11 +39,13 @@ NON_TAGGABLE_TYPES = (
     "aws_internet_gateway",
 )
 
-# P2 warn mode (D-109): emit a warning (not a hard FAIL) when a resource
-# carries only legacy acdl:* tags and no nova:* tags. P3 flips this to
-# False (hard-fail). Set NOVA_TAGGING_HARD=1 to opt into hard mode early
-# (used by P3 tests before the P3 flip lands).
-_WARN_MODE = True
+# P3 hard mode (D-109): hard-fail when a taggable resource is missing any
+# required nova:* tag, or when a resource carries only legacy acdl:* tag
+# keys and no nova:* tags. P2 shipped warn mode (`_WARN_MODE = True`); P3
+# flips to `False` (hard-fail) once terraform emits nova:* and the ABAC
+# policy is swapped to nova:*. P5 keeps hard mode and additionally fails
+# on any acdl:* tag key present at all.
+_WARN_MODE = False
 
 
 class NovaTaggingStandard(BaseResourceCheck):