continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity

docs(P00): incorporate grill binding mitigations G-104/G-106/G-108

Browse Source 
GRILL (ci-griller): 9 axes, 8 findings G-103..G-110, verdict
proceed-with-conditions (conf 0.82). 3 binding mitigations incorporated:
- G-104 (scope/technical, conf 0.90): re-tag Major milestone on its OWN
  minor line (v1.15.x), not the v1.14.x patch line (NFR convention).
  Precedent: v1.10.2→v1.11.0, v1.9.x→v1.10.0. Updated PLAN/ROADMAP/
  PROJECT/REQUIREMENTS/ARCHITECTURE tag refs: v1.15.0(P0)→v1.15.4(P5).
- G-106 (risk/technical, conf 0.88): .env.secrets direct-read paths
  (run_platform.sh:288-289 + regression_verify.py:309-312) bypass the
  core/env.py helper — P2 MUST dual-read these (NOVA_* first, ACDL_*
  fallback) or AWS creds vanish mid-rename. Bound in PLAN.md P2 task 2.
- G-108 (security, conf 0.80): CI workflow secrets: refs (deploy.yml +
  modules-lifecycle.yml, .gitea + .github) reference secrets.ACDL_* —
  P2 MUST update to secrets.NOVA_* in lockstep with Gitea secret
  creation. Bound in PLAN.md P2 task 3 (hard gate). 5 accepted-as-is
  findings (G-103/105/107/109/110), 0 open escalations.

---ci---
project: acdl
phase: 0
milestone: v1.15
status: grill
---/ci---
This commit is contained in:
Jon Chery
2026-07-30 00:40:35 +00:00
parent 69ba3d728f
commit 562ab2b26a
6 changed files with 51 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.ciagent/ARCHITECTURE.md
+4 -2
View File
@@ -668,8 +668,10 @@ deferral is documented here explicitly per the v1.14 grill (E-001).
Delivery Platform" → **Nova** / "The New Dawn of DevSecOps — security
as a seamless enabler of fast deployments." This is a **Major
milestone** (breaking): consumer-facing path, env var prefixes, SSM
path, AWS tag keys, and AWS resource names all change. Tags run on the
v1.14.x patch line: `v1.14.0` (P0) → `v1.14.5` (P5 final = release).
path, AWS tag keys, and AWS resource names all change. Per the
branch-strategy precedent (breaking/feature milestones tag on their
OWN minor line), v1.15 tags run on the **v1.15.x minor line**:
`v1.15.0` (P0) → `v1.15.4` (P5 final = release). (G-104 binding.)
### Naming conventions (rebranded)
.ciagent/CHECKPOINT.json
+2 -2
View File
@@ -1,9 +1,9 @@
{
"phase": 0,
"stage": "grill",
"stage": "ship",
"milestone": "v1.15",
"phase_role": "pre_execution",
"attempts": 0,
"updated_at": "2026-07-30T00:04:00Z",
"updated_at": "2026-07-30T00:05:00Z",
"milestone_complete": false
}
.ciagent/PLAN.md
+29 -10
View File
@@ -11,9 +11,13 @@ depends_on: []
**Milestone:** v1.15 (Nova Rebrand — Major/breaking)
**Type:** Major (breaking — consumer path, env vars, SSM path, tag keys,
AWS resource names all change). Final patch IS the milestone release.
Tags: `v1.14.0` (P0) → `v1.14.1..v1.14.4` (P1–P4) → `v1.14.5` (P5 =
milestone release).
AWS resource names all change). Per the branch-strategy precedent
(v1.10.2 → v1.11.0, v1.9.x → v1.10.0 — breaking/feature milestones tag
on their OWN minor line, not the previous minor's patch line), v1.15
tags run on the **v1.15.x minor line**: `v1.15.0` (P0) →
`v1.15.1..v1.15.4` (P1–P4) → `v1.15.4` (P5 = milestone release). (G-104
binding: the v1.14.x patch line is the NFR convention; a Major
milestone ships on its own minor.)
**Branch:** `milestone/v1.15-nova` → `phase/NN-<slug>`
## Wave ordering (D-098 v1.15 analogue)
@@ -136,13 +140,27 @@ behavior.
dual-read inline. Rename keys in `.env` + `.env.secrets` (KEY names
only — VALUES/secret material stay). Leave a comment in `.env.secrets`
noting the legacy `ACDL_*` keys are the dual-read fallback source
until P5.
3. **Gitea secrets rotation (REQ-159).** Use the Gitea API
(`scripts/rotate_spike_key.sh` pattern or a new
until P5. **G-106 binding:** the `.env.secrets` direct-read paths
(`scripts/run_platform.sh:288-289` `export AWS_ACCESS_KEY_ID="$ACDL_AWS_ACCESS_KEY_ID"`
+ `core/regression_verify.py:309-312` `if k == "ACDL_AWS_ACCESS_KEY_ID"`)
bypass the helper and MUST be updated to dual-read `NOVA_*` first,
`ACDL_*` fallback (shell: `${NOVA_AWS_ACCESS_KEY_ID:-$ACDL_AWS_ACCESS_KEY_ID}`;
Python: match `k == "NOVA_AWS_ACCESS_KEY_ID" or k == "ACDL_AWS_ACCESS_KEY_ID"`)
— otherwise AWS creds vanish mid-rename and CAP-013/014/015 fail.
3. **Gitea secrets rotation + workflow refs (G-108 binding, REQ-159).**
Use the Gitea API (`scripts/rotate_spike_key.sh` pattern or a new
`scripts/rename_gitea_secrets.py`) to create `NOVA_*` secrets
mirroring the `ACDL_*` values, then (after P5) delete the old
`ACDL_*` secrets. For P2, just create the `NOVA_*` aliases; deletion
is P5.
mirroring the `ACDL_*` values (idempotent + retry-on-failure), then
(after P5) delete the old `ACDL_*` secrets. For P2, just create the
`NOVA_*` aliases; deletion is P5. **G-108 binding:** when `NOVA_*`
secrets are created, the CI workflow `secrets:` references
(`.gitea/workflows/deploy.yml:105,107,108,148`,
`.gitea/workflows/modules-lifecycle.yml:63,64,103,104,111,112,117,118,123,124,161,162,169,170`,
`.github/workflows/*` mirrored) MUST be updated from `secrets.ACDL_*`
→ `secrets.NOVA_*` in the SAME phase, with graceful degrade + the
`acdl-deploy-` role name in deploy.yml:105 → `nova-deploy-` (P4
renames the IAM role). Until both secrets + refs are updated, CI
breaks — this is a hard gate, not a silent skip.
4. **Checkov rule rename (D-109 warn mode, REQ-158).** Rename
`adapters/terraform/policy/custom_rules/acdl_tagging.py` →
`nova_tagging.py`. Update the Checkov registration in
@@ -327,4 +345,5 @@ ABAC session-policy terraform
7. `grep -rn "acdl-" terraform/` returns 0 hits.
8. `pytest` passes; `run_ci.sh` exits 0; `terraform validate` passes
for platform/microservice/ci-vpc.
9. Tag `v1.14.5` created; milestone merged to main.
9. Tag `v1.15.4` created (IS the milestone release, G-104); milestone
merged to main.
.ciagent/PROJECT.md
+4 -3
View File
@@ -933,8 +933,9 @@ staged infrastructure migration to avoid breakage.
**Milestone type:** Major (breaking — consumer-facing path, env var
prefixes, SSM path, AWS tag keys, and AWS resource names all change).
Tags run on the v1.14.x patch line: `v1.14.0` (P0) → `v1.14.5` (P5
final = milestone release).
Tags run on the v1.15.x minor line: `v1.15.0` (P0) → `v1.15.4` (P5
final = milestone release). (G-104 binding: Major milestones tag on
their own minor line, not the previous minor's patch line.)
**In scope (v1.15):**
- Prose/decks/mermaid/pyproject/release-title rebrand (P1).
@@ -954,7 +955,7 @@ final = milestone release).
- Git branch/tag naming — no brand name present.
**Milestone type:** Major (breaking). **Ship tag:** final phase patch
on the v1.14.x line IS the release.
on the v1.15.x minor line IS the release (`v1.15.4`).
## Milestone v1.15 Phases
.ciagent/REQUIREMENTS.md
+5 -2
View File
@@ -720,8 +720,11 @@ in a 20-phase sweep.
**Milestone type:** Major (breaking — consumer-facing path, env var
prefixes, SSM path, AWS tag keys, and AWS resource names all change).
Tags run on the v1.14.x patch line: `v1.14.0` (P0) →
`v1.14.1..v1.14.4` (P1–P4) → `v1.14.5` (P5 final = milestone release).
Per the branch-strategy precedent (breaking/feature milestones tag on
their OWN minor line), v1.15 tags run on the **v1.15.x minor line**:
`v1.15.0` (P0) → `v1.15.1..v1.15.4` (P1–P4) → `v1.15.4` (P5 final =
milestone release). (G-104 binding: the v1.14.x patch line is the NFR
convention; a Major milestone ships on its own minor.)
A full rebrand from **ACDL** / "Agentic Cloud Delivery Platform" →
**Nova** / "The New Dawn of DevSecOps — security as a seamless enabler
.ciagent/ROADMAP.md
+7 -5
View File
@@ -1435,7 +1435,7 @@ After Phase P21: milestone COMPLETE — `v1.13.24` IS the v1.14 release.
---
## v1.15 (active — Nova Rebrand, tag `v1.14.5`)
## v1.15 (active — Nova Rebrand, tag `v1.15.4`)
A full rebrand from **ACDL** / "Agentic Cloud Delivery Platform" →
**Nova** / "The New Dawn of DevSecOps — security as a seamless enabler
@@ -1449,8 +1449,10 @@ declare intent" framing; the S&P Global Energy visual theme
**Milestone type:** Major (breaking — consumer-facing path, env var
prefixes, SSM path, AWS tag keys, and AWS resource names all change).
Tags run on the v1.14.x patch line: `v1.14.0` (P0) →
`v1.14.1..v1.14.4` (P1–P4) → `v1.14.5` (P5 final = milestone release).
Per the branch-strategy precedent (breaking/feature milestones tag on
their OWN minor line), v1.15 tags run on the **v1.15.x minor line**:
`v1.15.0` (P0) → `v1.15.1..v1.15.4` (P1–P4) → `v1.15.4` (P5 final =
milestone release). (G-104 binding.)
**Brand mapping:**
- Name: `ACDL` / `Agentic Cloud Delivery Platform` → `Nova`
@@ -1625,6 +1627,6 @@ Tags run on the v1.14.x patch line: `v1.14.0` (P0) →
- Review: 0 new P0; all P1+ flagged or auto-fixed.
- Audit: clean; reconstruction test passes.
- Dual-read fallback removed; `nova_tagging.py` hard-fails `acdl:*`.
- Tag `v1.14.5` created; milestone merged to main.
- Tag `v1.15.4` created; milestone merged to main.
After Phase P5: milestone COMPLETE — `v1.14.5` IS the v1.15 release.
After Phase P5: milestone COMPLETE — `v1.15.4` IS the v1.15 release.