diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 97b5f82..1827a86 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -1,4 +1,4 @@ -# ACDL Release Pipeline — GitHub Actions (production) +# Nova Release Pipeline — GitHub Actions (production) # # Runs on push to main. Computes the next semver tag from the latest tag + # commit history, creates the tag, updates floating MAJOR.MINOR and MAJOR tags, @@ -8,7 +8,7 @@ # - Regular phase commit -> bump PATCH (v1.6.0 -> v1.6.1) # - Milestone completion ("docs(milestone): complete") -> bump MINOR (v1.6.1 -> v1.7.0) # - Major bumps are manual (not implemented here). -name: acdl-release +name: nova-release on: push: @@ -87,6 +87,6 @@ jobs: BODY=$(git log --format='- %s' HEAD) fi gh release create ${{ steps.version.outputs.new_tag }} \ - --title "ACDL ${{ steps.version.outputs.new_tag }}" \ + --title "Nova ${{ steps.version.outputs.new_tag }}" \ --notes "$BODY" \ --generate-notes || true \ No newline at end of file diff --git a/README.md b/README.md index 8e77dfe..8fe0bf4 100644 --- a/README.md +++ b/README.md @@ -1,4 +1,6 @@ -# ACDL — Agentic Cloud Delivery Platform +# Nova + +> **Nova — The New Dawn of DevSecOps.** Security as a seamless enabler of fast deployments — not a bottleneck, not a "no" department. Consumers declare intent; the platform delivers safe production deployment through an agentic stack — automatically, safely, and with a complete audit @@ -18,7 +20,7 @@ a configuration file, or an infrastructure module. ## Repository roles -There are two kinds of repository in the ACDL model: +There are two kinds of repository in the Nova model: - **Platform repo (this one).** This is the **source code of the platform**. It owns `modules/`, `adapters/`, `core/`, `schemas/`, `pipelines/`, @@ -93,7 +95,7 @@ intent via a contract; the platform delivers the deployment through the same contract schema, the same policy envelope, and the same evidence stream. -Consumers have their own repos and consume ACDL by writing a contract that +Consumers have their own repos and consume Nova by writing a contract that declares infrastructure. A consumer declares a contract (id + name + environment + infrastructure); the platform resolves it to a stack instance, compiles it, runs security + policy checks, computes a confidence signal, @@ -223,7 +225,7 @@ The workflow implements the same stages as `pipelines/contract.yml` → policy checks → confidence → evidence event → apply). A consumer repo invokes the reusable workflow via a **versioned tag** (floating MAJOR + MINOR, e.g. `acdl/.github/workflows/deploy.yml@v1.13`). The workflow checks -out the consumer repo, then checks out the ACDL platform repo into the +out the consumer repo, then checks out the Nova platform repo into the runner workspace, and runs `scripts/run_platform.sh` against the consumer's contract — the consumer never clones the platform repo or invokes its scripts locally. See the [Consumer guide](docs/consumer-guide.md) for the @@ -247,7 +249,7 @@ backwards-compatible log-only mode. ## Consumer guide A step-by-step guide for a consumer to create their pipeline and define a -contract that deploys any ACDL module to AWS is at +contract that deploys any Nova module to AWS is at [`docs/consumer-guide.md`](docs/consumer-guide.md). The guide is generic across all modules; `static-assets` is the worked example. diff --git a/contracts/microservice.dev.yml b/contracts/microservice.dev.yml index 2dc514a..433542a 100644 --- a/contracts/microservice.dev.yml +++ b/contracts/microservice.dev.yml @@ -1,4 +1,4 @@ -# ACDL sample consumer contract — microservice module (dev) +# Nova sample consumer contract — microservice module (dev) # Per-environment contract (REQ-105). Promotion = running the dev job; # no environment field editing. Interpolation resolves against dev.json. id: msvc diff --git a/contracts/microservice.dr.yml b/contracts/microservice.dr.yml index d44da88..3220d43 100644 --- a/contracts/microservice.dr.yml +++ b/contracts/microservice.dr.yml @@ -1,4 +1,4 @@ -# ACDL sample consumer contract — microservice module (dr) +# Nova sample consumer contract — microservice module (dr) # Per-environment contract (REQ-105). Promotion = running the dr job; # no environment field editing. Interpolation resolves against dr.json. id: msvc diff --git a/contracts/microservice.prod.yml b/contracts/microservice.prod.yml index 8c6638b..11c5dfc 100644 --- a/contracts/microservice.prod.yml +++ b/contracts/microservice.prod.yml @@ -1,4 +1,4 @@ -# ACDL sample consumer contract — microservice module (prod) +# Nova sample consumer contract — microservice module (prod) # Per-environment contract (REQ-105). Promotion = running the prod job; # no environment field editing. Interpolation resolves against prod.json. id: msvc diff --git a/contracts/microservice.qa.yml b/contracts/microservice.qa.yml index 3de3f6c..b9a9fe7 100644 --- a/contracts/microservice.qa.yml +++ b/contracts/microservice.qa.yml @@ -1,4 +1,4 @@ -# ACDL sample consumer contract — microservice module (qa) +# Nova sample consumer contract — microservice module (qa) # Per-environment contract (REQ-105). Promotion = running the qa job; # no environment field editing. Interpolation resolves against qa.json. id: msvc diff --git a/contracts/microservice.yml b/contracts/microservice.yml index cdb6877..41efc4e 100644 --- a/contracts/microservice.yml +++ b/contracts/microservice.yml @@ -1,4 +1,4 @@ -# ACDL sample consumer contract — microservice module (dev) +# Nova sample consumer contract — microservice module (dev) # # Reference example for an ECS Fargate microservice deployment. # Interpolation (D-081): bucket_name uses the naming pattern that includes diff --git a/contracts/static-assets.dev.yml b/contracts/static-assets.dev.yml index 350e340..018715d 100644 --- a/contracts/static-assets.dev.yml +++ b/contracts/static-assets.dev.yml @@ -1,4 +1,4 @@ -# ACDL sample consumer contract — static-assets module (dev) +# Nova sample consumer contract — static-assets module (dev) # Per-environment contract (REQ-105). The dev default # (contracts/static-assets.yml) remains for backwards compat; this file # is the explicit per-env dev contract. Interpolation resolves against dev.json. diff --git a/contracts/static-assets.dr.yml b/contracts/static-assets.dr.yml index c22c32c..99e1eb5 100644 --- a/contracts/static-assets.dr.yml +++ b/contracts/static-assets.dr.yml @@ -1,4 +1,4 @@ -# ACDL sample consumer contract — static-assets module (dr) +# Nova sample consumer contract — static-assets module (dr) # Per-environment contract (REQ-105). Promotion = running the dr job; # no environment field editing. Interpolation resolves against dr.json. id: assets diff --git a/contracts/static-assets.prod.yml b/contracts/static-assets.prod.yml index 21587c0..4bff0b3 100644 --- a/contracts/static-assets.prod.yml +++ b/contracts/static-assets.prod.yml @@ -1,4 +1,4 @@ -# ACDL sample consumer contract — static-assets module (prod) +# Nova sample consumer contract — static-assets module (prod) # Per-environment contract (REQ-105). Promotion = running the prod job; # no environment field editing. Interpolation resolves against prod.json. id: assets diff --git a/contracts/static-assets.qa.yml b/contracts/static-assets.qa.yml index 5289dec..f22e1cd 100644 --- a/contracts/static-assets.qa.yml +++ b/contracts/static-assets.qa.yml @@ -1,4 +1,4 @@ -# ACDL sample consumer contract — static-assets module (qa) +# Nova sample consumer contract — static-assets module (qa) # Per-environment contract (REQ-105). Promotion = running the qa job; # no environment field editing. Interpolation resolves against qa.json. id: assets diff --git a/contracts/static-assets.yml b/contracts/static-assets.yml index a0d9011..8b42b3f 100644 --- a/contracts/static-assets.yml +++ b/contracts/static-assets.yml @@ -1,4 +1,4 @@ -# ACDL sample consumer contract — static-assets module (dev) +# Nova sample consumer contract — static-assets module (dev) # # This is the reference example for a consumer contract. It declares: # id: short operational acronym (becomes stack.name for state, tags, evidence) diff --git a/docs/NOVA_MIGRATION.md b/docs/NOVA_MIGRATION.md new file mode 100644 index 0000000..9f8dd4f --- /dev/null +++ b/docs/NOVA_MIGRATION.md @@ -0,0 +1,170 @@ +# Nova Migration Guide — What Consumers Must Know + +> **Nova** is the new product brand for the platform formerly known as +> **ACDL** (Agentic Cloud Delivery Platform). This guide announces the +> scheduled breaking changes coming in the rebrand rollout (Phases P2–P4) +> and tells you exactly what to do, when, and how long you have. + +The product is being rebranded **A C D L → Nova**. The rebrand is staged +across phases so that **no consumer deployment breaks during the +transition**. Phases P2–P4 ship the breaking changes behind a **dual-read +/ parallel-write grace period**; Phase P5 removes the fallback and the old +names stop working. This document is the consumer-facing contract for that +rollout. + +## What is NOT changing + +- **The Gitea repository name** (`continuous-intelligence/acdl`) is **not** + changing. Only the product brand is changing. The `uses:` reference + (`acdl/.github/workflows/deploy.yml@vX.Y`) and the GitHub `acdl/acdl` repo + path are unchanged for the duration of the rebrand; the workflow + `uses:` reference will be migrated in a later, separately-announced step. +- **The platform behavior** is unchanged. Same pipeline stages, same + contract schema, same confidence model, same evidence stream, same + modules. Only the brand, the on-disk path, the env var names, the SSM + path, the AWS tag keys, and the AWS resource names are changing. + +## The 5 breaking changes + +Five things that consumers may reference are being renamed. Each is +scheduled into a phase, ships with a grace period, and has a cutoff. + +### 1. Consumer contract path — Phase P2 + +- **Old:** `.acdl/contract.yml` +- **New:** `.nova/contract.yml` +- **Phase:** P2 (env vars + consumer path) +- **Grace period:** during P2–P4 the deploy workflow reads **both** paths + (`.nova/contract.yml` first, falling back to `.acdl/contract.yml` if the + new path is absent). Your existing contracts keep working until P5. +- **Cutoff:** P5 removes the `.acdl/` fallback. Move your contract file + before P5. +- **What you must do:** rename the directory in your consumer repo from + `.acdl/` to `.nova/` and update any `contract:` workflow input that + points at the old path. Nothing else changes in the contract content. + +### 2. Environment variables — Phase P2 + +- **Old:** `ACDL_*` (e.g. `ACDL_LIFECYCLE_MODE`, `ACDL_AWS_ACCOUNT_ID`, + `ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID`, …) +- **New:** `NOVA_*` (e.g. `NOVA_LIFECYCLE_MODE`, `NOVA_AWS_ACCOUNT_ID`, + `NOVA_BOOTSTRAP_AWS_ACCESS_KEY_ID`, …) +- **Phase:** P2 (env vars + consumer path) +- **Grace period — dual-read fallback:** during P2–P4 the platform reads + **`NOVA_*` first, then falls back to `ACDL_*`** if the Nova variable is + unset. This means your CI secrets, workflow env blocks, and local + `.env.secrets` keep working unchanged through P4. You do not need to + rename everything in one shot — rename a variable and the dual-read picks + it up; leave one old and it still resolves. +- **Cutoff:** P5 removes the `ACDL_*` fallback. After P5, only `NOVA_*` + is read. +- **What you must do:** rename your `ACDL_*` CI secrets, workflow `env:` + blocks, and any local `.env.secrets` entries to `NOVA_*`. Because of the + dual-read, you can do this incrementally across P2–P4 — but it must be + complete before P5. + +### 3. SSM parameter path — Phase P3 + +- **Old:** `/acdl/{env}/{contractId}/{output}` +- **New:** `/nova/{env}/{contractId}/{output}` +- **Phase:** P3 (SSM paths + tag keys) +- **Grace period — parallel-write:** during P3–P4 the platform **writes + every output to both** the `/acdl/…` and `/nova/…` SSM paths, and reads + from `/nova/…` first (falling back to `/acdl/…`). Any hardcoded SSM path + reads in your application code keep resolving through P4. +- **Cutoff:** P5 stops writing to `/acdl/…` and removes the read fallback. + After P5 only `/nova/…` exists. +- **What you must do:** if your application code or runbooks read deploy + outputs from SSM by hardcoded path, update the path prefix from `/acdl/` + to `/nova/`. If you consume outputs only via the PR-comment / GitHub + issue surface, you do nothing — the platform republishes under the new + path automatically. + +### 4. AWS tag keys — Phase P3 + +- **Old:** `acdl:owner`, `acdl:environment`, `acdl:contract`, + `acdl:cost-center`, `acdl:ref` +- **New:** `nova:owner`, `nova:environment`, `nova:contract`, + `nova:cost-center`, `nova:ref` +- **Phase:** P3 (SSM paths + tag keys) +- **Grace period — parallel-tag period:** during P3–P4 the platform + **tags every resource with both** the `acdl:*` and `nova:*` keys (same + values). The ABAC session policy matches on **either** key set, so your + existing scoped permissions keep working. The default cost-center value + moves from `acdl-default` to `nova-default` (both written during the + parallel-tag period). +- **Cutoff:** P5 stops writing the `acdl:*` keys and the ABAC policy matches + only on `nova:*`. After P5, resources created before P5 still carry the + old `acdl:*` tags (tags are not retroactively rewritten) but **new** + resources are tagged `nova:*` only, and the policy no longer grants + access via `acdl:*`. +- **What you must do:** if you have IAM policies, Cost Explorer filters, + or billing groupings that key off `acdl:*` tag keys, add a parallel + `nova:*` condition (or migrate to `nova:*`) before P5. The platform + handles the dual-tagging; you only need to update your own tag-key + references. + +### 5. AWS resource names — Phase P4 + +- **Old:** `acdl-*` (DynamoDB tables `acdl-contracts`, + `acdl-change-requests`; Lambda `acdl-contract-ingestor`; SNS + `acdl-sod-halt`; security group `acdl-ecs-sg`; KMS alias + `alias/acdl-platform`; ECS services, ECR repos, IAM user + `acdl-spike-runner`, state bucket `acdl-tfstate-*`, ALB `acdl-alb`, + `acdl-deploy-*`) +- **New:** `nova-*` (the same resources, prefixed `nova-`) +- **Phase:** P4 (resource names) — **maintenance window** +- **Grace period:** P4 is a **planned maintenance window**. AWS resources + cannot be renamed in place, so P4 provisions the `nova-*` resources, + migrates data (DynamoDB tables, S3 state), repoints the platform, and + tears down the `acdl-*` resources. The platform team schedules and + announces the window; consumers do not provision or rename anything + themselves. +- **Cutoff:** the `acdl-*` resources are decommissioned at the end of the + P4 maintenance window. After P4, only `nova-*` resources exist. +- **What you must do:** nothing for the resource names themselves — the + platform owns the rename. If your application code or runbooks reference + a specific `acdl-*` resource by name (e.g. a hardcoded DynamoDB table + name or ECR URI), update it to the `nova-*` name during P4. The platform + publishes the exact old → new name mapping with the P4 announcement. + +## Timeline at a glance + +| Phase | What ships | Grace period | Cutoff | +|-------|------------|--------------|--------| +| **P1** (this phase) | Brand prose, docs, decks, schema `$id`, release titles | n/a (prose only) | n/a | +| **P2** | `.nova/` contract path + `NOVA_*` env vars | dual-read: `.nova/`→`.acdl/`, `NOVA_*`→`ACDL_*` | **P5** removes fallback | +| **P3** | `/nova/` SSM path + `nova:*` tag keys | parallel-write (SSM) + parallel-tag (ABAC matches either) | **P5** removes old path/tags | +| **P4** | `nova-*` AWS resource names | maintenance window (platform-owned migration) | end of P4 window | +| **P5** | Fallback removal | — | `ACDL_*` env vars, `.acdl/` path, `/acdl/` SSM, `acdl:*` tags stop working | + +## What consumers must do (checklist) + +1. **Before P5 — contract path:** move `.acdl/contract.yml` → + `.nova/contract.yml` in your consumer repo; update the `contract:` + workflow input. *(Can be done any time in P2–P4.)* +2. **Before P5 — env vars:** rename `ACDL_*` CI secrets / workflow `env:` + blocks / local `.env.secrets` to `NOVA_*`. *(Incremental during P2–P4; + dual-read keeps you green.)* +3. **Before P5 — SSM reads:** if you read deploy outputs from SSM by + hardcoded `/acdl/…` path, update to `/nova/…`. *(Skip if you consume + outputs via PR comments only.)* +4. **Before P5 — tag-key references:** if you have IAM policies, Cost + Explorer filters, or billing groupings keyed off `acdl:*`, add or + migrate to `nova:*`. *(Platform handles dual-tagging.)* +5. **During P4 — resource-name references:** if your code or runbooks + reference a specific `acdl-*` AWS resource by name, update to the + `nova-*` name per the P4 mapping announcement. *(Platform owns the + rename itself.)* + +## Questions + +If anything in this guide is unclear, or you are unsure whether your +consumer repo references a renamed value, open an issue on the platform +repo. The platform team will confirm what you need to change and when. + +> **Note:** the real Gitea repository name (`continuous-intelligence/acdl`) +> is **not** changing — only the product brand. The `uses:` workflow +> reference and repo path are migrated in a separately-announced later step; +> until then, keep your `uses: acdl/.github/workflows/deploy.yml@vX.Y` +> reference as-is. \ No newline at end of file diff --git a/docs/_config.yml b/docs/_config.yml index 065f2af..10afa8d 100644 --- a/docs/_config.yml +++ b/docs/_config.yml @@ -1,5 +1,5 @@ -title: ACDL — Agentic Cloud Delivery Platform -description: Consumer + platform-engineer documentation for the ACDL platform. +title: Nova +description: Consumer + platform-engineer documentation for the Nova platform (formerly ACDL — Agentic Cloud Delivery Platform). remote_theme: mmistakes/minimal-mistakes@9.0.4 exclude: diff --git a/docs/consumer-guide.md b/docs/consumer-guide.md index 33d15f2..b912999 100644 --- a/docs/consumer-guide.md +++ b/docs/consumer-guide.md @@ -1,15 +1,15 @@ # Consumer Guide — Declare intent, deploy to AWS This guide walks a consumer through creating their pipeline and defining a -contract that deploys any ACDL module to AWS. It is **generic** across all +contract that deploys any Nova module to AWS. It is **generic** across all modules in the registry; `static-assets` is the worked example, but every step applies to `microservice` and any future module. ## The model -Consumers have their own repos and consume ACDL by writing a contract +Consumers have their own repos and consume Nova by writing a contract that declares infrastructure (one or more modules), an environment, and inputs. The consumer declares a **contract** (which infrastructure, which -environment, which inputs); the ACDL platform owns the pipelines, modules, +environment, which inputs); the Nova platform owns the pipelines, modules, engine adapter, and evidence stream. You do not write infrastructure modules, workflow YAML, or adapter code. @@ -89,7 +89,7 @@ definition lives at `.github/workflows/deploy.yml`. ## Step 2 — Reference the central pipeline In your CI workflow (`.github/workflows/deploy.yml`), reference the central -ACDL deployment workflow with a **versioned tag** (floating MAJOR + MINOR): +Nova deployment workflow with a **versioned tag** (floating MAJOR + MINOR): ```yaml jobs: @@ -167,7 +167,7 @@ and execute for you. ### The consumer CI definition -Add a thin workflow file to **your** repo that invokes the reusable ACDL +Add a thin workflow file to **your** repo that invokes the reusable Nova deploy workflow with a **versioned tag** (`.github/workflows/deploy.yml`): ```yaml @@ -187,7 +187,7 @@ That is the entire consumer-side workflow. When you push to `main`: 1. The platform runner resolves `uses: acdl/.github/workflows/deploy.yml@v1.13` to the reusable workflow **at the pinned tag**. 2. A **platform-provided runner** checks out **your** repo. -3. The runner checks out the **ACDL platform repo** into the workspace — +3. The runner checks out the **Nova platform repo** into the workspace — this is how the pipeline fetches the platform code at run time. You never clone the platform repo yourself. 4. The runner installs the runtime dependencies the platform requires. @@ -203,7 +203,7 @@ hold for attestation). ### Local validation (optional) -A consumer *may* clone the ACDL platform repo to run `--check-only` against +A consumer *may* clone the Nova platform repo to run `--check-only` against their contract before pushing — this is optional and not required for the happy path. If you do this, the runtime dependencies must be installed locally, and any AWS credentials follow the @@ -395,7 +395,7 @@ separately (or left running to monitor the decommissioned stack's endpoints going dark). ## Per-environment deployment -ACDL supports a **promotion-without-editing** model: you do not edit the +Nova supports a **promotion-without-editing** model: you do not edit the `environment:` field in a contract to promote dev → qa → prod → dr. Instead, there is **one CI job per environment**, each pointing at its respective contract (or the same contract + the `environment` workflow diff --git a/docs/contracts/index.md b/docs/contracts/index.md index b1e1070..c84eb4b 100644 --- a/docs/contracts/index.md +++ b/docs/contracts/index.md @@ -57,7 +57,7 @@ infrastructure: ## Validation The contract is validated against -[`schemas/contract.schema.json`](https://github.com/acdl/acdl/blob/main/schemas/contract.schema.json). +[`schemas/contract.schema.json`](https://github.com/nova/nova/blob/main/schemas/contract.schema.json). An invalid contract (missing field, unknown module, wrong type) fails at the validate-contract stage with a clear error. @@ -65,9 +65,9 @@ validate-contract stage with a clear error. Two reference examples exist in `contracts/`: -- [`contracts/static-assets.yml`](https://github.com/acdl/acdl/blob/main/contracts/static-assets.yml) +- [`contracts/static-assets.yml`](https://github.com/nova/nova/blob/main/contracts/static-assets.yml) — the `static-assets` module. -- [`contracts/microservice.yml`](https://github.com/acdl/acdl/blob/main/contracts/microservice.yml) +- [`contracts/microservice.yml`](https://github.com/nova/nova/blob/main/contracts/microservice.yml) — the `microservice` module. Additionally, every module has a `modules//examples/` directory with diff --git a/docs/environments/index.md b/docs/environments/index.md index af0636d..adc131d 100644 --- a/docs/environments/index.md +++ b/docs/environments/index.md @@ -60,7 +60,7 @@ invoke the **platform Lambda** — `acdl-contract-ingestor` — across accounts. The Lambda is invoked via a Function URL with IAM auth, so the grant is an inline IAM policy applied to the consumer's deploy role. The policy template lives at -[`terraform/platform/consumer_invoke_policy.json`](https://github.com/acdl/acdl/blob/main/terraform/platform/consumer_invoke_policy.json) +[`terraform/platform/consumer_invoke_policy.json`](https://github.com/nova/nova/blob/main/terraform/platform/consumer_invoke_policy.json) and is scoped via **ABAC**: the condition `aws:PrincipalTag/acdl:owner == ${consumerRepo}` ensures a repo can only invoke the Lambda when its principal tag matches its claimed identity. @@ -83,16 +83,16 @@ is used for two purposes: prepared-status stub until then). The Lambda handler and the Terraform that deploys it live in -[`core/lambda/contract_ingestor.py`](https://github.com/acdl/acdl/blob/main/core/lambda/contract_ingestor.py) +[`core/lambda/contract_ingestor.py`](https://github.com/nova/nova/blob/main/core/lambda/contract_ingestor.py) and -[`terraform/platform/main.tf`](https://github.com/acdl/acdl/blob/main/terraform/platform/main.tf) +[`terraform/platform/main.tf`](https://github.com/nova/nova/blob/main/terraform/platform/main.tf) respectively. ## Onboarding scaffold (current state) The platform repo ships a minimal onboarding scaffold: -- [`core/environments/`](https://github.com/acdl/acdl/blob/main/core/environments/) +- [`core/environments/`](https://github.com/nova/nova/blob/main/core/environments/) — environment definitions (a sample `dev.json`). - `core/environment_check.py` — checks whether an environment is defined for a given contract's repo + environment name; prints the friendly onboarding diff --git a/docs/index.md b/docs/index.md index 966cdb1..af57b3a 100644 --- a/docs/index.md +++ b/docs/index.md @@ -1,4 +1,6 @@ -# ACDL — Agentic Cloud Delivery Platform +# Nova + +> **Nova — The New Dawn of DevSecOps.** Security as a seamless enabler of fast deployments — not a bottleneck, not a "no" department. Consumers declare intent; the platform delivers safe production deployment through an agentic stack — automatically, safely, and with a complete audit @@ -9,7 +11,7 @@ a configuration file, or an infrastructure module. ## Two repositories -There are two kinds of repository in the ACDL model: +There are two kinds of repository in the Nova model: - **Platform repo (this one).** The source code of the platform. It owns `modules/`, `adapters/`, `core/`, `schemas/`, `pipelines/`, `scripts/`, @@ -75,4 +77,11 @@ Planned future features (no dates; tracked in the internal roadmap): - [Consumer Guide](consumer-guide) — start here if you are a consumer. - [Architecture](architecture) — start here if you are a platform engineer. -- The [README](https://github.com/acdl/acdl) describes the platform repo. \ No newline at end of file +- The [README](https://github.com/nova/nova) describes the platform repo. + +> **Note:** The product brand is **Nova** (formerly ACDL — Agentic Cloud +> Delivery Platform). The Gitea repository name (`continuous-intelligence/acdl`) +> and the GitHub `uses:` reference (`acdl/.github/workflows/deploy.yml@…`) +> are unchanged during the rebrand transition; only the product name is +> changing. See the [Nova migration guide](NOVA_MIGRATION) for the +> scheduled breaking changes. \ No newline at end of file diff --git a/docs/modules/index.md b/docs/modules/index.md index 5cae942..a3a6d64 100644 --- a/docs/modules/index.md +++ b/docs/modules/index.md @@ -16,28 +16,28 @@ module's README documents which resources it creates. | Module | What it creates | Source | |--------|----------------|--------| -| `s3` | `aws_s3_bucket` — a single S3 bucket | [modules/l1/s3/README.md](https://github.com/acdl/acdl/blob/main/modules/l1/s3/README.md) | -| `vpc` | `aws_vpc` + `aws_subnet` + `aws_route_table` + `aws_internet_gateway` — VPC with subnets and routing | [modules/l1/vpc/README.md](https://github.com/acdl/acdl/blob/main/modules/l1/vpc/README.md) | -| `ecs-cluster` | `aws_ecs_cluster` — ECS Fargate cluster | [modules/l1/ecs-cluster/README.md](https://github.com/acdl/acdl/blob/main/modules/l1/ecs-cluster/README.md) | -| `ecs-service` | `aws_ecs_task_definition` + `aws_ecs_service` — Fargate service with task definition | [modules/l1/ecs-service/README.md](https://github.com/acdl/acdl/blob/main/modules/l1/ecs-service/README.md) | -| `iam-role` | `aws_iam_role` — IAM role with assume-role policy | [modules/l1/iam-role/README.md](https://github.com/acdl/acdl/blob/main/modules/l1/iam-role/README.md) | -| `alb` | `aws_lb` + `aws_lb_target_group` + `aws_lb_listener` — Application Load Balancer | [modules/l1/alb/README.md](https://github.com/acdl/acdl/blob/main/modules/l1/alb/README.md) | -| `ecr` | `aws_ecr_repository` — ECR container image repository | [modules/l1/ecr/README.md](https://github.com/acdl/acdl/blob/main/modules/l1/ecr/README.md) | -| `cloudfront` | `aws_cloudfront_distribution` + `aws_cloudfront_origin_access_control` — CloudFront distribution with S3 origin via OAC | [modules/l1/cloudfront/README.md](https://github.com/acdl/acdl/blob/main/modules/l1/cloudfront/README.md) | -| `waf` | `aws_wafv2_web_acl` — WAFv2 Web ACL (CloudFront-scoped) | [modules/l1/waf/README.md](https://github.com/acdl/acdl/blob/main/modules/l1/waf/README.md) | -| `rds` | `aws_db_instance` — RDS database instance (multi-engine: postgres, mysql, etc.) | [modules/l1/rds/README.md](https://github.com/acdl/acdl/blob/main/modules/l1/rds/README.md) | +| `s3` | `aws_s3_bucket` — a single S3 bucket | [modules/l1/s3/README.md](https://github.com/nova/nova/blob/main/modules/l1/s3/README.md) | +| `vpc` | `aws_vpc` + `aws_subnet` + `aws_route_table` + `aws_internet_gateway` — VPC with subnets and routing | [modules/l1/vpc/README.md](https://github.com/nova/nova/blob/main/modules/l1/vpc/README.md) | +| `ecs-cluster` | `aws_ecs_cluster` — ECS Fargate cluster | [modules/l1/ecs-cluster/README.md](https://github.com/nova/nova/blob/main/modules/l1/ecs-cluster/README.md) | +| `ecs-service` | `aws_ecs_task_definition` + `aws_ecs_service` — Fargate service with task definition | [modules/l1/ecs-service/README.md](https://github.com/nova/nova/blob/main/modules/l1/ecs-service/README.md) | +| `iam-role` | `aws_iam_role` — IAM role with assume-role policy | [modules/l1/iam-role/README.md](https://github.com/nova/nova/blob/main/modules/l1/iam-role/README.md) | +| `alb` | `aws_lb` + `aws_lb_target_group` + `aws_lb_listener` — Application Load Balancer | [modules/l1/alb/README.md](https://github.com/nova/nova/blob/main/modules/l1/alb/README.md) | +| `ecr` | `aws_ecr_repository` — ECR container image repository | [modules/l1/ecr/README.md](https://github.com/nova/nova/blob/main/modules/l1/ecr/README.md) | +| `cloudfront` | `aws_cloudfront_distribution` + `aws_cloudfront_origin_access_control` — CloudFront distribution with S3 origin via OAC | [modules/l1/cloudfront/README.md](https://github.com/nova/nova/blob/main/modules/l1/cloudfront/README.md) | +| `waf` | `aws_wafv2_web_acl` — WAFv2 Web ACL (CloudFront-scoped) | [modules/l1/waf/README.md](https://github.com/nova/nova/blob/main/modules/l1/waf/README.md) | +| `rds` | `aws_db_instance` — RDS database instance (multi-engine: postgres, mysql, etc.) | [modules/l1/rds/README.md](https://github.com/nova/nova/blob/main/modules/l1/rds/README.md) | ## Modules | Module | What it references | Source | |--------|--------------------|--------| -| `static-assets` | 3 primitives (s3, cloudfront, waf) — a production static asset stack | [modules/l2/static-assets/README.md](https://github.com/acdl/acdl/blob/main/modules/l2/static-assets/README.md) | -| `microservice` | 6 primitives (vpc, cluster, ecr, iam-role, alb, ecs-service) — an ECS Fargate microservice | [modules/l2/microservice/README.md](https://github.com/acdl/acdl/blob/main/modules/l2/microservice/README.md) | +| `static-assets` | 3 primitives (s3, cloudfront, waf) — a production static asset stack | [modules/l2/static-assets/README.md](https://github.com/nova/nova/blob/main/modules/l2/static-assets/README.md) | +| `microservice` | 6 primitives (vpc, cluster, ecr, iam-role, alb, ecs-service) — an ECS Fargate microservice | [modules/l2/microservice/README.md](https://github.com/nova/nova/blob/main/modules/l2/microservice/README.md) | ## Registry Module versions are tracked in -[`registry.json`](https://github.com/acdl/acdl/blob/main/modules/registry.json). +[`registry.json`](https://github.com/nova/nova/blob/main/modules/registry.json). Both primitives and modules are registered. ## Examples @@ -45,7 +45,7 @@ Both primitives and modules are registered. Each module has a `examples/` directory containing validated consumer contract examples (`simple.yaml` + `complex.yaml` + variation files). The platform-test pipeline validates them against -[`schemas/contract.schema.json`](https://github.com/acdl/acdl/blob/main/schemas/contract.schema.json). +[`schemas/contract.schema.json`](https://github.com/nova/nova/blob/main/schemas/contract.schema.json). See each module's `## Examples` section for the excerpts. ## Versioning diff --git a/docs/pipeline/index.md b/docs/pipeline/index.md index d5a738e..e1b4fa6 100644 --- a/docs/pipeline/index.md +++ b/docs/pipeline/index.md @@ -6,9 +6,9 @@ are the single source of truth for the workflow files. ## CI pipeline The CI pipeline runs on every push and pull request to `main`. It is defined -by [`pipelines/ci.yml`](https://github.com/acdl/acdl/blob/main/pipelines/ci.yml), +by [`pipelines/ci.yml`](https://github.com/nova/nova/blob/main/pipelines/ci.yml), validated against -[`schemas/pipeline.schema.json`](https://github.com/acdl/acdl/blob/main/schemas/pipeline.schema.json). +[`schemas/pipeline.schema.json`](https://github.com/nova/nova/blob/main/schemas/pipeline.schema.json). Both platform-runner workflow files implement the same contract and are byte-identical: @@ -31,16 +31,16 @@ bash scripts/run_ci.sh --quiet # suppress per-stage banners ## Deployment pipeline The deployment pipeline runs when a consumer submits a contract. It is -defined by [`pipelines/contract.yml`](https://github.com/acdl/acdl/blob/main/pipelines/contract.yml), +defined by [`pipelines/contract.yml`](https://github.com/nova/nova/blob/main/pipelines/contract.yml), validated against -[`schemas/deploy-pipeline.schema.json`](https://github.com/acdl/acdl/blob/main/schemas/deploy-pipeline.schema.json). +[`schemas/deploy-pipeline.schema.json`](https://github.com/nova/nova/blob/main/schemas/deploy-pipeline.schema.json). It is exposed to consumer repos as a **reusable workflow**: - `.github/workflows/deploy.yml` — GitHub Actions (production) A consumer repo invokes the reusable workflow via a **versioned tag** (floating MAJOR + MINOR, e.g. `acdl/.github/workflows/deploy.yml@v1.13`). -The workflow checks out the consumer repo, then checks out the ACDL platform +The workflow checks out the consumer repo, then checks out the Nova platform repo into the runner workspace, and runs `scripts/run_platform.sh` against the consumer's contract. The consumer never clones the platform repo or invokes its scripts locally. See the [Consumer Guide](../consumer-guide/) diff --git a/docs/pipeline/versioning.md b/docs/pipeline/versioning.md index ac354e8..268291f 100644 --- a/docs/pipeline/versioning.md +++ b/docs/pipeline/versioning.md @@ -1,6 +1,6 @@ # Versioning -ACDL uses two versioning schemes: one for modules, one for the deploy +Nova uses two versioning schemes: one for modules, one for the deploy pipeline. Both matter to a consumer. ## Module versioning @@ -16,7 +16,7 @@ old entry enters a **12-month deprecation window**. A module pins its primitives by `name@semver`; the resolver picks the highest compatible. Module versions are tracked in -[`registry.json`](https://github.com/acdl/acdl/blob/main/modules/registry.json). +[`registry.json`](https://github.com/nova/nova/blob/main/modules/registry.json). ## Deploy-pipeline versioning (the CI workflow `uses:` tag) diff --git a/docs/presentations/README.md b/docs/presentations/README.md index 358f5f5..8744c34 100644 --- a/docs/presentations/README.md +++ b/docs/presentations/README.md @@ -1,6 +1,6 @@ # Presentations -Leadership-facing presentation decks for the ACDL platform. +Leadership-facing presentation decks for the Nova platform. ## The 4-step slide creation process diff --git a/docs/presentations/assets/mmd/developer-experience-01b-scope-boundary.mmd b/docs/presentations/assets/mmd/developer-experience-01b-scope-boundary.mmd index aadbc56..82581e5 100644 --- a/docs/presentations/assets/mmd/developer-experience-01b-scope-boundary.mmd +++ b/docs/presentations/assets/mmd/developer-experience-01b-scope-boundary.mmd @@ -6,7 +6,7 @@ flowchart LR A["Technical dev\n(app code + contract)"] B["Citizen dev\n(intent → AI agent\n→ contract)"] end - subgraph ACDL ["ACDL — infrastructure only"] + subgraph ACDL ["Nova — infrastructure only"] C["Same contract\nSame pipeline\nSame safety"] D["Provision\nAWS resources"] E["Evidence\nhash-chained"] diff --git a/docs/presentations/assets/mmd/developer-experience-03-no-cloning.mmd b/docs/presentations/assets/mmd/developer-experience-03-no-cloning.mmd index ed65a63..b8cd564 100644 --- a/docs/presentations/assets/mmd/developer-experience-03-no-cloning.mmd +++ b/docs/presentations/assets/mmd/developer-experience-03-no-cloning.mmd @@ -3,7 +3,7 @@ flowchart LR A["Consumer repo
app + contract + 'uses:'"] -->|triggers on push to main| B["Platform runner"] B -->|checks out the consumer repo| A - B -->|checks out the ACDL platform repo
into the workspace| C["Platform code
(modules, adapters, schemas)"] + B -->|checks out the Nova platform repo
into the workspace| C["Platform code
(modules, adapters, schemas)"] C --> B B -->|runs the pipeline against
the consumer's contract| D["Consumer's resources in AWS"] classDef accent fill:#1B1B1B,color:#fff,stroke:#D6002A,stroke-width:2px diff --git a/docs/presentations/assets/mmd/platform-architecture.mmd b/docs/presentations/assets/mmd/platform-architecture.mmd index 6046517..b740fe3 100644 --- a/docs/presentations/assets/mmd/platform-architecture.mmd +++ b/docs/presentations/assets/mmd/platform-architecture.mmd @@ -7,7 +7,7 @@ flowchart TD U2["Citizen dev\nintent → AI agent → contract"] end - subgraph ACDL ["ACDL — infrastructure only"] + subgraph ACDL ["Nova — infrastructure only"] direction TB CS["Contract schema\n(validate + fail-fast)"] subgraph PIPE ["Central pipeline — fixed stages, every deployment"] diff --git a/docs/presentations/assets/mmd/platform-works-03-north-star.mmd b/docs/presentations/assets/mmd/platform-works-03-north-star.mmd index 1d060f7..d797c0e 100644 --- a/docs/presentations/assets/mmd/platform-works-03-north-star.mmd +++ b/docs/presentations/assets/mmd/platform-works-03-north-star.mmd @@ -9,7 +9,7 @@ flowchart LR D["Manual promotion"] A --> B --> C --> D end - subgraph ACDL ["With ACDL"] + subgraph ACDL ["With Nova"] direction TB E["Declare intent\n(one YAML contract)"] F["Platform delivers\nsafely, autonomously"] diff --git a/docs/presentations/assets/mmd/platform-works-03-scope-boundary.mmd b/docs/presentations/assets/mmd/platform-works-03-scope-boundary.mmd index 0551c04..5215bfc 100644 --- a/docs/presentations/assets/mmd/platform-works-03-scope-boundary.mmd +++ b/docs/presentations/assets/mmd/platform-works-03-scope-boundary.mmd @@ -7,7 +7,7 @@ flowchart LR B["Agentic SDLC\n(agent writes contract)"] C["Citizen dev\n(vibe codes → AI agent\n→ contract)"] end - subgraph ACDL ["ACDL — infrastructure only"] + subgraph ACDL ["Nova — infrastructure only"] D["Contract\nvalidated"] E["Resolve → Plan\nSecurity + Policy checks\nConfidence signal"] F["Provision\nAWS resources"] diff --git a/docs/presentations/assets/png/developer-experience-01b-scope-boundary.png b/docs/presentations/assets/png/developer-experience-01b-scope-boundary.png index 32eb3aa..d14a0ea 100644 Binary files a/docs/presentations/assets/png/developer-experience-01b-scope-boundary.png and b/docs/presentations/assets/png/developer-experience-01b-scope-boundary.png differ diff --git a/docs/presentations/assets/png/platform-architecture.png b/docs/presentations/assets/png/platform-architecture.png index 0f385b3..73165ee 100644 Binary files a/docs/presentations/assets/png/platform-architecture.png and b/docs/presentations/assets/png/platform-architecture.png differ diff --git a/docs/presentations/assets/png/platform-works-03-north-star.png b/docs/presentations/assets/png/platform-works-03-north-star.png index f44e416..713db6d 100644 Binary files a/docs/presentations/assets/png/platform-works-03-north-star.png and b/docs/presentations/assets/png/platform-works-03-north-star.png differ diff --git a/docs/presentations/assets/png/platform-works-03-scope-boundary.png b/docs/presentations/assets/png/platform-works-03-scope-boundary.png index 0940889..bbc3bbb 100644 Binary files a/docs/presentations/assets/png/platform-works-03-scope-boundary.png and b/docs/presentations/assets/png/platform-works-03-scope-boundary.png differ diff --git a/docs/presentations/how-the-platform-works-marp.md b/docs/presentations/how-the-platform-works-marp.md index 949633d..f6b3dfc 100644 --- a/docs/presentations/how-the-platform-works-marp.md +++ b/docs/presentations/how-the-platform-works-marp.md @@ -31,7 +31,7 @@ style: | # How The Platform Works -### Agentic Cloud Delivery Platform +### Nova — The New Dawn of DevSecOps -ACDL runs at **zero cloud cost** for day-to-day development. AWS spend was measured via Cost Explorer (`COST.md`, 2026-07-28): +Nova runs at **zero cloud cost** for day-to-day development. AWS spend was measured via Cost Explorer (`COST.md`, 2026-07-28): | Metric | Value | |--------|-------| diff --git a/docs/presentations/how-the-platform-works-talking-points.md b/docs/presentations/how-the-platform-works-talking-points.md index 3e316dc..e7b85b9 100644 --- a/docs/presentations/how-the-platform-works-talking-points.md +++ b/docs/presentations/how-the-platform-works-talking-points.md @@ -36,7 +36,7 @@ - One-slide map of the whole platform — use it to orient the audience before diving into any single component - The leadership-relevant beats: (1) two surfaces, one pipeline, one evidence stream — the convergence is the design; (2) the pipeline stages are fixed and identical for every consumer; (3) the engine adapter is the only engine-specific code, which makes the catalog and confidence model portable - Don't walk every node — point to the boundaries and say "the rest of this deck zooms into each of these" -- The contract schema is the boundary between upstream and ACDL; everything left of it is the consumer's, everything right of it is the platform's +- The contract schema is the boundary between upstream and Nova; everything left of it is the consumer's, everything right of it is the platform's **Key takeaway:** Two surfaces, one pipeline, one evidence stream. The rest of the deck zooms in. @@ -45,7 +45,7 @@ ## Slide 4 — Declare intent; the platform delivers safe production **Talking points:** -- Land the before/after contrast: today's queue vs. ACDL's autonomous flow +- Land the before/after contrast: today's queue vs. Nova's autonomous flow - The litmus test: if a platform engineer still has to touch a ticket for a dev→qa promotion, we haven't delivered the vision - The North Star is one sentence: "declare intent → safe production deployment" - A non-technical consumer ships by declaring intent — no workflow, no config file, no module @@ -54,15 +54,15 @@ --- -## Slide 5 — ACDL owns infrastructure, not your app +## Slide 5 — Nova owns infrastructure, not your app **Talking points:** - The platform is deliberately scoped — it is not trying to be everything - The sovereign boundary: the platform team owns delivery and infrastructure, not the upstream development process - The anti-goals are as important as the goals — they tell leadership what not to expect -- Upstream is anything: IDE, agentic SDLC, or vibe coding — ACDL doesn't care how the contract was produced +- Upstream is anything: IDE, agentic SDLC, or vibe coding — Nova doesn't care how the contract was produced -**Key takeaway:** ACDL is infrastructure only. App build/test/deploy is upstream. +**Key takeaway:** Nova is infrastructure only. App build/test/deploy is upstream. --- diff --git a/docs/presentations/how-the-platform-works.html b/docs/presentations/how-the-platform-works.html index 18c6a06..4535009 100644 --- a/docs/presentations/how-the-platform-works.html +++ b/docs/presentations/how-the-platform-works.html @@ -48,7 +48,7 @@ img { display: block; margin: 0 auto; max-height: 300px; }
How The Platform Works

How The Platform Works

-

Agentic Cloud Delivery Platform

+

Nova — The New Dawn of DevSecOps

How The Platform Works
-

ACDL owns infrastructure, not your app

+

Nova owns infrastructure, not your app

  • Upstream is anything — IDE, agentic SDLC, or vibe coding
    • -
  • ACDL is infrastructure only — provisions and governs AWS resources
    • +
  • Nova is infrastructure only — provisions and governs AWS resources
  • Not a general-purpose AI — autonomy is narrow, policy-bounded
  • Not a permissive highway — no escape hatches
@@ -1005,7 +1005,7 @@ img { display: block; margin: 0 auto; max-height: 300px; }
How The Platform Works

A7 — Operating Model & Cost

-

ACDL runs at zero cloud cost for day-to-day development. AWS spend was measured via Cost Explorer (COST.md, 2026-07-28):

+

Nova runs at zero cloud cost for day-to-day development. AWS spend was measured via Cost Explorer (COST.md, 2026-07-28):

diff --git a/docs/presentations/how-the-platform-works.md b/docs/presentations/how-the-platform-works.md index 4017d55..48caab0 100644 --- a/docs/presentations/how-the-platform-works.md +++ b/docs/presentations/how-the-platform-works.md @@ -1,6 +1,6 @@ # How The Platform Works -> **Subtitle:** Agentic Cloud Delivery Platform +> **Subtitle:** Nova — The New Dawn of DevSecOps > **Audience:** Senior Leadership, CTO, Head of Cloud, Head of Infrastructure, Head of DevOps > **Length:** ~16 minutes · 11 main + Appendix TOC + 8 appendix = 20 slides > **Purpose:** Sell the platform's value to tech leadership — zero-trust, security, observability, auditability, and the shift from "operators guess" to "the platform computes safety." @@ -13,7 +13,9 @@ # How The Platform Works -### Agentic Cloud Delivery Platform +### Nova — The New Dawn of DevSecOps + +**Security as a seamless enabler of fast deployments — not a bottleneck, not a "no" department.** > **Speaker notes:** Brief introduction — this deck explains *how* the platform works internally, not what the developer experience is (that's the companion deck). Set the frame: the platform is not a CI/CD tool — it's the organizational lever for shipping safely at the pace the business demands. @@ -62,7 +64,7 @@ flowchart TD U2["Citizen dev\nintent → AI agent → contract"] end - subgraph ACDL ["ACDL — infrastructure only"] + subgraph ACDL ["Nova — infrastructure only"] direction TB CS["Contract schema\n(validate + fail-fast)"] subgraph PIPE ["Central pipeline — fixed stages, every deployment"] @@ -97,7 +99,7 @@ flowchart TD ``` - **Consumer surfaces** — technical dev or citizen dev; both produce a contract. Upstream is anything. -- **Contract schema** — the boundary between upstream and ACDL; validated fail-fast. +- **Contract schema** — the boundary between upstream and Nova; validated fail-fast. - **Central pipeline** — fixed stages, identical for every deployment: validate → resolve → security → plan → policy → confidence → evidence → apply. - **Module catalog** — security-reviewed primitives + modules the resolver expands against. - **Engine adapter** — stateless; the only engine-specific code (Terraform today). @@ -123,7 +125,7 @@ flowchart LR D["Manual promotion"] A --> B --> C --> D end - subgraph ACDL ["With ACDL"] + subgraph ACDL ["With Nova"] direction TB E["Declare intent\n(one YAML contract)"] F["Platform delivers\nsafely, autonomously"] @@ -137,11 +139,11 @@ flowchart LR - A **non-technical consumer** ships by declaring intent — no workflow, no config file, no module. - Every production change is **traceable to a human attestation** and an immutable evidence stream. -> **Speaker notes:** Land the before/after contrast: today's queue vs. ACDL's autonomous flow. The litmus test: if a platform engineer still has to touch a ticket for a dev→qa promotion, we haven't delivered the vision. The North Star is "declare intent → safe production deployment." +> **Speaker notes:** Land the before/after contrast: today's queue vs. Nova's autonomous flow. The litmus test: if a platform engineer still has to touch a ticket for a dev→qa promotion, we haven't delivered the vision. The North Star is "declare intent → safe production deployment." --- -## Slide 5 — ACDL owns infrastructure, not your app +## Slide 5 — Nova owns infrastructure, not your app The platform is deliberately scoped — it is not trying to be everything. @@ -153,7 +155,7 @@ flowchart LR B["Agentic SDLC\n(agent writes contract)"] C["Citizen dev\n(vibe codes → AI agent\n→ contract)"] end - subgraph ACDL ["ACDL — infrastructure only"] + subgraph ACDL ["Nova — infrastructure only"] D["Contract\nvalidated"] E["Resolve → Plan\nSecurity + Policy checks\nConfidence signal"] F["Provision\nAWS resources"] @@ -173,8 +175,8 @@ flowchart LR H --> I ``` -- **Upstream is anything** — IDE, agentic SDLC, or vibe coding. ACDL doesn't care how the contract was produced. -- **ACDL is infrastructure only** — it provisions and governs AWS resources. App build/test/deploy is upstream. +- **Upstream is anything** — IDE, agentic SDLC, or vibe coding. Nova doesn't care how the contract was produced. +- **Nova is infrastructure only** — it provisions and governs AWS resources. App build/test/deploy is upstream. - **Not a general-purpose AI** — autonomy is narrow, scoped to delivery, bounded by strict policy. - **Not a permissive highway** — no escape hatches to bypass the confidence framework. @@ -184,7 +186,7 @@ flowchart LR ## Slide 6 — One YAML file. The platform owns everything else. -The contract is the boundary between upstream and ACDL. It's all a consumer writes. +The contract is the boundary between upstream and Nova. It's all a consumer writes. ```mermaid flowchart LR @@ -456,7 +458,7 @@ A phased roadmap from the current Testing baseline to the full North Star: ## A7 — Operating Model & Cost (real AWS spend + pre-mortem) -ACDL runs at **zero cloud cost** for day-to-day development. The v1.0→v1.10 AWS spend was measured directly via Cost Explorer (`COST.md`, 2026-07-28): +Nova runs at **zero cloud cost** for day-to-day development. The v1.0→v1.10 AWS spend was measured directly via Cost Explorer (`COST.md`, 2026-07-28): | Metric | Value | |--------|-------| diff --git a/docs/presentations/the-developer-experience-marp.md b/docs/presentations/the-developer-experience-marp.md index a47322e..9a5d8af 100644 --- a/docs/presentations/the-developer-experience-marp.md +++ b/docs/presentations/the-developer-experience-marp.md @@ -33,7 +33,7 @@ style: | # The Developer Experience -### Agentic Cloud Delivery Platform +### Nova — The New Dawn of DevSecOps -ACDL runs at **zero cloud cost** for day-to-day development. AWS spend was measured via Cost Explorer (`COST.md`, 2026-07-28): +Nova runs at **zero cloud cost** for day-to-day development. AWS spend was measured via Cost Explorer (`COST.md`, 2026-07-28): | Metric | Value | |--------|-------| diff --git a/docs/presentations/the-developer-experience-talking-points.md b/docs/presentations/the-developer-experience-talking-points.md index 0326ddd..d39cdce 100644 --- a/docs/presentations/the-developer-experience-talking-points.md +++ b/docs/presentations/the-developer-experience-talking-points.md @@ -21,13 +21,13 @@ ## Slide 2 — Two consumer paths, one safety envelope **Talking points:** -- This is the scope-boundary slide — here's who uses the platform, and here's where ACDL's responsibility starts and stops +- This is the scope-boundary slide — here's who uses the platform, and here's where Nova's responsibility starts and stops - Two consumer paths converge on the same contract: **technical** developer writes the contract directly; **citizen** developer declares intent and an AI agent produces a contract that passes the same safety envelope -- Upstream is anything — your IDE, an agentic SDLC, or vibe coding on a laptop. ACDL doesn't care how the contract was produced -- ACDL is infrastructure only — it provisions and governs AWS resources. Application deployment is upstream of the contract +- Upstream is anything — your IDE, an agentic SDLC, or vibe coding on a laptop. Nova doesn't care how the contract was produced +- Nova is infrastructure only — it provisions and governs AWS resources. Application deployment is upstream of the contract - The two surfaces are *parallel*, not a progression. A citizen developer doesn't "graduate" to the developer surface. There is no "citizen developer mode" with weaker checks -**Key takeaway:** Two consumer paths, one safety envelope. ACDL is infra only — anything upstream is fair game. +**Key takeaway:** Two consumer paths, one safety envelope. Nova is infra only — anything upstream is fair game. --- diff --git a/docs/presentations/the-developer-experience.html b/docs/presentations/the-developer-experience.html index 08fce8d..05d9559 100644 --- a/docs/presentations/the-developer-experience.html +++ b/docs/presentations/the-developer-experience.html @@ -52,7 +52,7 @@ img { display: block; margin: 0 auto; max-height: 280px; }
The Developer Experience

The Developer Experience

-

Agentic Cloud Delivery Platform

+

Nova — The New Dawn of DevSecOps

Internal
A6 — Operating Model & Cost -

ACDL runs at zero cloud cost for day-to-day development. AWS spend was measured via Cost Explorer (COST.md, 2026-07-28):

+

Nova runs at zero cloud cost for day-to-day development. AWS spend was measured via Cost Explorer (COST.md, 2026-07-28):

diff --git a/docs/presentations/the-developer-experience.md b/docs/presentations/the-developer-experience.md index 37e0e23..14b81ad 100644 --- a/docs/presentations/the-developer-experience.md +++ b/docs/presentations/the-developer-experience.md @@ -1,6 +1,6 @@ # The Developer Experience -> **Subtitle:** Agentic Cloud Delivery Platform +> **Subtitle:** Nova — The New Dawn of DevSecOps > **Audience:** Senior Leadership, CTO, Head of Cloud, Head of Infrastructure, Head of DevOps > **Length:** ~16 minutes · 11 main + Appendix TOC + 7 appendix = 19 slides > **Purpose:** Sell the developer experience and the citizen developer experience to tech leadership — velocity without sacrificing safety, and security/observability/compliance as platform defaults rather than per-team effort. @@ -11,6 +11,8 @@ ## Slide 1 — Title +**Nova — The New Dawn of DevSecOps.** Security as a seamless enabler of fast deployments — not a bottleneck, not a "no" department. + The consumer surface is intentionally tiny. The platform's surface is large and opinionated. > **Speaker notes:** Brief introduction — this deck covers *who uses the platform and how fast/safe they ship*, not the internal mechanics (that's the companion deck). Set the frame: velocity without sacrificing safety, and security/observability/compliance as platform defaults rather than per-team effort. @@ -28,7 +30,7 @@ flowchart LR A["Technical dev\n(app code + contract)"] B["Citizen dev\n(intent → AI agent\n→ contract)"] end - subgraph ACDL ["ACDL — infrastructure only"] + subgraph ACDL ["Nova — infrastructure only"] C["Same contract\nSame pipeline\nSame safety"] D["Provision\nAWS resources"] E["Evidence\nhash-chained"] @@ -47,10 +49,10 @@ flowchart LR - **Technical developer** — owns app code + a contract + a thin CI definition. - **Citizen developer** — declares intent in plain language; an AI agent produces a contract that passes the **same** safety envelope. -- **Upstream is anything** — IDE, agentic SDLC, or vibe coding. ACDL doesn't care how the contract was produced. -- **ACDL is infrastructure only** — it provisions and governs AWS resources. Application deployment is upstream. +- **Upstream is anything** — IDE, agentic SDLC, or vibe coding. Nova doesn't care how the contract was produced. +- **Nova is infrastructure only** — it provisions and governs AWS resources. Application deployment is upstream. -> **Speaker notes:** This is the thesis of the deck. The two surfaces are *parallel*, not a progression — a citizen developer doesn't "graduate" to the developer surface. Both produce a contract; both get the same treatment. The scope boundary matters: anything upstream of the contract is out of ACDL's concern. The leadership takeaway: we expand who can ship safely without lowering the bar. +> **Speaker notes:** This is the thesis of the deck. The two surfaces are *parallel*, not a progression — a citizen developer doesn't "graduate" to the developer surface. Both produce a contract; both get the same treatment. The scope boundary matters: anything upstream of the contract is out of Nova's concern. The leadership takeaway: we expand who can ship safely without lowering the bar. --- @@ -66,7 +68,7 @@ flowchart TD U2["Citizen dev\nintent → AI agent → contract"] end - subgraph ACDL ["ACDL — infrastructure only"] + subgraph ACDL ["Nova — infrastructure only"] direction TB CS["Contract schema\n(validate + fail-fast)"] subgraph PIPE ["Central pipeline — fixed stages, every deployment"] @@ -364,7 +366,7 @@ Consumers `uses:` a **versioned** central workflow. The platform fetches itself flowchart LR A["Consumer repo
app + contract + 'uses:'"] -->|triggers on push to main| B["Platform runner"] B -->|checks out the consumer repo| A - B -->|checks out the ACDL platform repo
into the workspace| C["Platform code
(modules, adapters, schemas)"] + B -->|checks out the Nova platform repo
into the workspace| C["Platform code
(modules, adapters, schemas)"] C --> B B -->|runs the pipeline against
the consumer's contract| D["Consumer's resources in AWS"] ``` @@ -426,7 +428,7 @@ flowchart LR ## A6 — Operating Model & Cost -ACDL runs at **zero cloud cost** for day-to-day development. The v1.0→v1.10 AWS spend was measured directly via Cost Explorer (`COST.md`, 2026-07-28): +Nova runs at **zero cloud cost** for day-to-day development. The v1.0→v1.10 AWS spend was measured directly via Cost Explorer (`COST.md`, 2026-07-28): | Metric | Value | |--------|-------| diff --git a/docs/vision.md b/docs/vision.md index 4aed45b..ef8281d 100644 --- a/docs/vision.md +++ b/docs/vision.md @@ -1,4 +1,6 @@ -# Agentic Cloud Delivery Vision +# Nova Vision + +> **Nova — The New Dawn of DevSecOps.** Security as a seamless enabler of fast deployments — not a bottleneck, not a "no" department. ## 1. The Friction diff --git a/modules/README.md b/modules/README.md index 7139c36..dbd9efe 100644 --- a/modules/README.md +++ b/modules/README.md @@ -1,4 +1,4 @@ -# ACDL Modules +# Nova Modules Reusable building blocks for cloud infrastructure. Each module is self-documented with a `README.md` following the diff --git a/modules/STANDARDS.md b/modules/STANDARDS.md index 3eda875..3b38437 100644 --- a/modules/STANDARDS.md +++ b/modules/STANDARDS.md @@ -1,6 +1,6 @@ -# ACDL Module Engineering Standards +# Nova Module Engineering Standards -Standards for authoring and reviewing ACDL modules. These standards +Standards for authoring and reviewing Nova modules. These standards govern the two module tiers — **L1 primitives** (single cloud resource or small group of related resources) and **L2 modules** (compositions that reference L1 primitives to deploy a complete stack) — and the diff --git a/modules/l1/kms-key/README.md b/modules/l1/kms-key/README.md index 6fc1197..2c7c0c8 100644 --- a/modules/l1/kms-key/README.md +++ b/modules/l1/kms-key/README.md @@ -42,7 +42,7 @@ rotation enabled. One key per L2 deployment (no shared keys). "type": "aws:kms:key", "module": "kms-key@1.0.0", "inputs": { - "description": "ACDL per-stack CMK", + "description": "Nova per-stack CMK", "region": "us-east-1" } } diff --git a/pipelines/README.md b/pipelines/README.md index f94e038..03082e7 100644 --- a/pipelines/README.md +++ b/pipelines/README.md @@ -1,16 +1,16 @@ -# ACDL Pipelines +# Nova Pipelines ## Overview -ACDL uses declarative pipeline contracts (YAML) as the single source of truth. Both Gitea and GitHub workflows implement the same contract (byte-identical). The shell runner (`scripts/run_ci.sh`) mirrors the CI pipeline locally so that every stage that runs in CI can be reproduced on a developer machine without a forge. +Nova uses declarative pipeline contracts (YAML) as the single source of truth. Both Gitea and GitHub workflows implement the same contract (byte-identical). The shell runner (`scripts/run_ci.sh`) mirrors the CI pipeline locally so that every stage that runs in CI can be reproduced on a developer machine without a forge. ## Existing Pipelines | Pipeline | File | Stages | Triggers | | --- | --- | --- | --- | -| ACDL CI | `ci.yml` | `lint`, `test`, `check-only` | push/PR to `main` | -| ACDL Deploy | `contract.yml` | `validate-contract`, `resolve-stack`, `terraform-plan`, `checkov`, `confidence`, `apply`, `publish-outputs`, `deploy-uptime`, `comment-outputs` | push/PR to `main` (consumer repos via `workflow_call`) | -| ACDL Modules Lifecycle | `modules-lifecycle.yml` | `platform-vpc-apply`, `lifecycle-apply`, `lifecycle-modify`, `lifecycle-destroy`, `l2-lifecycle-apply`, `l2-lifecycle-modify`, `l2-lifecycle-destroy`, `platform-vpc-destroy` | PR to `main` + `workflow_dispatch` | +| Nova CI | `ci.yml` | `lint`, `test`, `check-only` | push/PR to `main` | +| Nova Deploy | `contract.yml` | `validate-contract`, `resolve-stack`, `terraform-plan`, `checkov`, `confidence`, `apply`, `publish-outputs`, `deploy-uptime`, `comment-outputs` | push/PR to `main` (consumer repos via `workflow_call`) | +| Nova Modules Lifecycle | `modules-lifecycle.yml` | `platform-vpc-apply`, `lifecycle-apply`, `lifecycle-modify`, `lifecycle-destroy`, `l2-lifecycle-apply`, `l2-lifecycle-modify`, `l2-lifecycle-destroy`, `platform-vpc-destroy` | PR to `main` + `workflow_dispatch` | ## How to Write a Pipeline diff --git a/pipelines/ci.yml b/pipelines/ci.yml index 9d4cdbb..0ea7db0 100644 --- a/pipelines/ci.yml +++ b/pipelines/ci.yml @@ -1,4 +1,4 @@ -# ACDL Central CI Pipeline Contract (v1.5) +# Nova Central CI Pipeline Contract (v1.5) # # This is the single source of truth for the CI/CD pipeline. Both # .gitea/workflows/ci.yml (Gitea Actions, dev) and diff --git a/pipelines/contract.yml b/pipelines/contract.yml index cb2f949..d3494ed 100644 --- a/pipelines/contract.yml +++ b/pipelines/contract.yml @@ -1,4 +1,4 @@ -# ACDL Central Deployment Pipeline Contract (v1.8) +# Nova Central Deployment Pipeline Contract (v1.8) # # This is the single source of truth for the deployment pipeline. It # declares the stages that run when a consumer submits a contract: diff --git a/pipelines/modules-lifecycle.yml b/pipelines/modules-lifecycle.yml index d6b5591..aece786 100644 --- a/pipelines/modules-lifecycle.yml +++ b/pipelines/modules-lifecycle.yml @@ -1,6 +1,6 @@ name: acdl-modules-lifecycle -# ACDL Modules Lifecycle Pipeline — apply→modify→destroy against live AWS. +# Nova Modules Lifecycle Pipeline — apply→modify→destroy against live AWS. # # Matrix-runs each L1 module's examples/{simple,complex}.yml contracts: # 1. --apply simple.yml (terraform apply — creates resources) diff --git a/pyproject.toml b/pyproject.toml index 3129ce6..95c949e 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -1,7 +1,7 @@ [project] -name = "acdl" +name = "nova" version = "1.14.0" -description = "Agentic Cloud Delivery Platform — consumers declare intent; the platform delivers safe production deployment." +description = "Nova — consumers declare intent; the platform delivers safe production deployment." requires-python = ">=3.10" dependencies = [ "boto3>=1.34", diff --git a/schemas/README.md b/schemas/README.md index dcf154d..8827762 100644 --- a/schemas/README.md +++ b/schemas/README.md @@ -1,24 +1,24 @@ -# ACDL Schemas +# Nova Schemas ## Overview -ACDL uses JSON Schema draft 2020-12 for all declarative contracts. Schemas are the single source of truth for validation. Every contract, stack instance, pipeline, and policy result in the platform is validated against a schema in this directory before it is consumed by any downstream code path. The resolver, the pipeline runner, the CI workflows, and the test suite all load these schemas directly. +Nova uses JSON Schema draft 2020-12 for all declarative contracts. Schemas are the single source of truth for validation. Every contract, stack instance, pipeline, and policy result in the platform is validated against a schema in this directory before it is consumed by any downstream code path. The resolver, the pipeline runner, the CI workflows, and the test suite all load these schemas directly. ## Existing Schemas | Schema | File | Purpose | Where Validated | | --- | --- | --- | --- | -| ACDL Consumer Contract | `contract.schema.json` | Consumer contract validation (id, name, environment, infrastructure map with module versions + inputs) | `core/contract_resolver.py`, `scripts/run_platform.sh` Step 1, CI `schema-validation` job | -| ACDL Target Stack | `stack.schema.json` | Target Stack instance validation (resources, relationships, composition tree, NFRs) | `core/contract_resolver.py` (post-resolution), `tests/conftest.py` | -| ACDL Central Pipeline Contract | `pipeline.schema.json` | Central CI pipeline contract (stages, commands, triggers, runner) | `tests/test_pipeline_contract.py` | -| ACDL Central Deployment Pipeline Contract | `deploy-pipeline.schema.json` | Central deploy pipeline contract (validate → resolve → plan → checkov → confidence → apply → publish → uptime → comment) | `tests/test_pipeline_contract.py` | -| ACDL PolicyCheckResult | `policy_check_result.schema.json` | Normalized policy check result schema (the contract between policy engines and the confidence signal) | `tests/conftest.py`, all adapter tests | -| ACDL Tagging Standard | `tagging-standard.json` | Required tag set for all taggable AWS resources | `adapters/terraform/policy/custom_rules/acdl_tagging.py` | +| Nova Consumer Contract | `contract.schema.json` | Consumer contract validation (id, name, environment, infrastructure map with module versions + inputs) | `core/contract_resolver.py`, `scripts/run_platform.sh` Step 1, CI `schema-validation` job | +| Nova Target Stack | `stack.schema.json` | Target Stack instance validation (resources, relationships, composition tree, NFRs) | `core/contract_resolver.py` (post-resolution), `tests/conftest.py` | +| Nova Central Pipeline Contract | `pipeline.schema.json` | Central CI pipeline contract (stages, commands, triggers, runner) | `tests/test_pipeline_contract.py` | +| Nova Central Deployment Pipeline Contract | `deploy-pipeline.schema.json` | Central deploy pipeline contract (validate → resolve → plan → checkov → confidence → apply → publish → uptime → comment) | `tests/test_pipeline_contract.py` | +| Nova PolicyCheckResult | `policy_check_result.schema.json` | Normalized policy check result schema (the contract between policy engines and the confidence signal) | `tests/conftest.py`, all adapter tests | +| Nova Tagging Standard | `tagging-standard.json` | Required tag set for all taggable AWS resources | `adapters/terraform/policy/custom_rules/acdl_tagging.py` | ## How to Write a Schema 1. Use JSON Schema draft 2020-12: `"$schema": "https://json-schema.org/draft/2020-12/schema"`. -2. Set `$id` to `https://acdl.cloudinit.dev/schemas/.schema.json`. +2. Set `$id` to `https://nova.cloudinit.dev/schemas/.schema.json`. 3. Include `title` and `description` at the document root. 4. Set `type: object` at the document root. 5. Declare a `required` array listing the mandatory top-level property names. diff --git a/schemas/contract.schema.json b/schemas/contract.schema.json index a494301..61a7afd 100644 --- a/schemas/contract.schema.json +++ b/schemas/contract.schema.json @@ -1,7 +1,7 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "https://acdl.cloudinit.dev/schemas/contract.schema.json", - "title": "ACDL Consumer Contract", + "$id": "https://nova.cloudinit.dev/schemas/contract.schema.json", + "title": "Nova Consumer Contract", "description": "A consumer contract declares intent: which infrastructure to deploy, in which environment, with which inputs. The contract is keyed by an operational id (3-6 char acronym, becomes the stack name for state keys, tags, and outbox events) and a human-readable name (becomes the stack title for display and evidence). The infrastructure map is keyed by module name; each entry carries an optional version (defaults to the latest published version from the module registry) and per-module inputs. The contract resolver resolves each infrastructure entry against modules/registry.json, then merges them into a single Target Stack instance.", "type": "object", "required": ["id", "name", "environment", "infrastructure"], diff --git a/schemas/deploy-pipeline.schema.json b/schemas/deploy-pipeline.schema.json index cdcc5ba..fe5dea3 100644 --- a/schemas/deploy-pipeline.schema.json +++ b/schemas/deploy-pipeline.schema.json @@ -1,8 +1,8 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "https://acdl.cloudinit.dev/schemas/deploy-pipeline.schema.json", - "title": "ACDL Central Deployment Pipeline Contract", - "description": "Declarative contract for the ACDL deployment pipeline. Declares the stages that run when a consumer submits a contract: validate-contract, resolve-stack, terraform-plan, checkov, confidence, apply. The platform (scripts/run_platform.sh) implements these stages. This is the declarative pipeline spec; the executable workflow is .github/workflows/deploy.yml which invokes scripts/run_platform.sh.", + "$id": "https://nova.cloudinit.dev/schemas/deploy-pipeline.schema.json", + "title": "Nova Central Deployment Pipeline Contract", + "description": "Declarative contract for the Nova deployment pipeline. Declares the stages that run when a consumer submits a contract: validate-contract, resolve-stack, terraform-plan, checkov, confidence, apply. The platform (scripts/run_platform.sh) implements these stages. This is the declarative pipeline spec; the executable workflow is .github/workflows/deploy.yml which invokes scripts/run_platform.sh.", "type": "object", "required": ["name", "triggers", "runner", "stages"], "properties": { diff --git a/schemas/environment.schema.json b/schemas/environment.schema.json index 567e92b..8d12ffc 100644 --- a/schemas/environment.schema.json +++ b/schemas/environment.schema.json @@ -1,7 +1,7 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "https://acdl.cloudinit.dev/schemas/environment.schema.json", - "title": "ACDL Platform-Managed Environment", + "$id": "https://nova.cloudinit.dev/schemas/environment.schema.json", + "title": "Nova Platform-Managed Environment", "description": "A named environment the platform owns (an AWS account or scoped partition, a network, a state backend, an IAM role surfaced to the consumer via ABAC). Selected by name in the contract's 'environment' field. The environment onboarding check (core/environment_check.py) loads the matching .json; the contract resolver (core/contract_resolver.py) uses it as the 'env' context for ${env.} interpolation.", "type": "object", "required": ["name", "account_id", "region", "state_backend", "network", "runner_role_arn", "autonomy", "confidence_threshold"], diff --git a/schemas/modules-lifecycle-pipeline.schema.json b/schemas/modules-lifecycle-pipeline.schema.json index 2f53e56..57266c7 100644 --- a/schemas/modules-lifecycle-pipeline.schema.json +++ b/schemas/modules-lifecycle-pipeline.schema.json @@ -1,7 +1,7 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "https://acdl.cloudinit.dev/schemas/modules-lifecycle-pipeline.schema.json", - "title": "ACDL Modules Lifecycle Pipeline Contract", + "$id": "https://nova.cloudinit.dev/schemas/modules-lifecycle-pipeline.schema.json", + "title": "Nova Modules Lifecycle Pipeline Contract", "description": "Declarative contract for the modules-lifecycle pipeline. Matrix-runs each L1 module's examples/{simple,complex}.yml contracts through apply→modify→destroy against live AWS. Both Gitea Actions (.gitea/workflows/modules-lifecycle.yml) and GitHub Actions (.github/workflows/modules-lifecycle.yml) implement this contract byte-identically.", "type": "object", "required": ["name", "triggers", "runner", "python_version", "terraform_version", "stages", "matrix"], diff --git a/schemas/pipeline.schema.json b/schemas/pipeline.schema.json index 77c9e0c..c115946 100644 --- a/schemas/pipeline.schema.json +++ b/schemas/pipeline.schema.json @@ -1,7 +1,7 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "https://acdl.cloudinit.dev/schemas/pipeline.schema.json", - "title": "ACDL Central Pipeline Contract", + "$id": "https://nova.cloudinit.dev/schemas/pipeline.schema.json", + "title": "Nova Central Pipeline Contract", "description": "Declarative contract for a CI/CD pipeline. Both Gitea Actions (.gitea/workflows/ci.yml, dev) and GitHub Actions (.github/workflows/ci.yml, production) implement the stages, commands, triggers, and runner declared here. The shell script scripts/run_ci.sh mirrors the same stages for local reproducibility. The contract is the single source of truth; the workflow YAMLs and run_ci.sh are generated/validated against it.", "$comment": "The pipeline contract does not replace workflow YAML syntax — it declares the *intent* (stages, commands, triggers, runner) that both Gitea and GitHub workflows implement. A test (tests/test_pipeline_contract.py) validates conformance: the workflow YAMLs must declare the same jobs/stages/commands as the contract, and run_ci.sh must run the same commands in the same order.", "type": "object", diff --git a/schemas/policy_check_result.schema.json b/schemas/policy_check_result.schema.json index 33269fb..08e933d 100644 --- a/schemas/policy_check_result.schema.json +++ b/schemas/policy_check_result.schema.json @@ -1,7 +1,7 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "https://acdl.cloudinit.dev/schemas/policy_check_result.schema.json", - "title": "ACDL PolicyCheckResult", + "$id": "https://nova.cloudinit.dev/schemas/policy_check_result.schema.json", + "title": "Nova PolicyCheckResult", "description": "Normalized policy check result — the contract between policy engines and the confidence signal. Engine-specific adapters (checkov_adapter.py, future kyverno_adapter) translate native engine output to this shape. The confidence signal consumes a list of these as its policy input; it is engine-agnostic. The severity enum drives the severity->penalty mapping (critical hard-override, high -0.2, medium -0.05, low -0.01, info 0.0).", "$comment": "Canonical PolicyCheckResult (ARCHITECTURE.md §12.6). The confidence signal (platform/confidence_signal.py) consumes a list of these as its policy input; it is engine-agnostic. Adapters translate native output to this shape; the signal never reads engine-specific evidence.", "type": "object", diff --git a/schemas/stack.schema.json b/schemas/stack.schema.json index 971f8d6..8598fa2 100644 --- a/schemas/stack.schema.json +++ b/schemas/stack.schema.json @@ -1,7 +1,7 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "https://acdl.cloudinit.dev/schemas/stack.schema.json", - "title": "ACDL Target Stack", + "$id": "https://nova.cloudinit.dev/schemas/stack.schema.json", + "title": "Nova Target Stack", "description": "Angine-neutral description of a target stack: resources with typed inputs/outputs/NFRs, relationships (single parent per child), composition tree (max depth 5), and policy hooks. The L1 registry, L2 composition tree, contract YML, and PolicyCheckResult schema are all defined against this stack schema. Angine adapters (the Terraform adapter in v1) are the only engine-specific code.", "$comment": "v1 ships one adapter (Terraform). The stack is nearly isomorphic to Terraform in v1 (ARCHITECTURE.md §12.1); the adapter compiles resource.module -> module block, resource.inputs -> variable + arg, resource.outputs -> output, relationship.kind=uses_output -> interpolation, relationship.kind=parent -> composition ordering hint. As more adapters appear (v2+), the stack gains expressiveness; the L1 content + contract YML + composition tree do not change. The schema body is engine-agnostic: no Terraform block keywords (variable/output/resource as blocks) and no aws_ provider prefixes in the schema keywords; type values are stack types (aws:s3:bucket), not Terraform resource types (aws_s3_bucket).", "type": "object", diff --git a/schemas/tagging-standard.json b/schemas/tagging-standard.json index b317627..b3202b1 100644 --- a/schemas/tagging-standard.json +++ b/schemas/tagging-standard.json @@ -1,7 +1,7 @@ { "$schema": "https://json-schema.org/draft/2020-12/schema", - "$id": "https://acdl.dev/schemas/tagging-standard.json", - "title": "ACDL Tagging Standard", + "$id": "https://nova.dev/schemas/tagging-standard.json", + "title": "Nova Tagging Standard", "description": "Required tags for all taggable AWS resources created by the platform. Enforced by a Checkov custom Python rule (adapters/terraform/policy/custom_rules/acdl_tagging.py). The checkov adapter maps ACDL_TAG_NAMING as a real rule (D-054, D-043 closure).", "type": "object", "properties": {