diff --git a/.ciagent/CHECKPOINT.json b/.ciagent/CHECKPOINT.json index 1faebbe..48b01e6 100644 --- a/.ciagent/CHECKPOINT.json +++ b/.ciagent/CHECKPOINT.json @@ -1,17 +1,22 @@ { "phase": 0, - "stage": "research", + "stage": "ideate", "milestone": "v1.25", "phase_role": "pre_execution", "attempts": 0, - "updated_at": "2026-08-12T16:35:00Z", + "updated_at": "2026-08-12T16:40:00Z", "project": "acdl", "milestone_complete": false, "tag_line": "v1.24.x", "next_tag": "v1.24.0", - "personas_active": ["lead-developer", "backend-engineer", "policy-engineer", "data-engineer"], - "personas_deactivated": ["frontend-engineer"], - "new_personas": ["policy-engineer"], - "assumptions": ["A1", "A2", "A3", "A4", "A5"], - "notes": "v1.25 RESEARCH complete — kyverno-json CLI/policy/assertion-tree surface documented; 4 policy targets analyzed; PolicyEngine protocol + OPA-equivalent swap surface; new policy-engineer persona; ARCHITECTURE.md §12.7 added. Latency impact <1s (parallel with checkov)." + "ideation": { + "tiers_run": ["mechanical", "backend-enriched"], + "cross_project": "deferred (single-project, config disabled)", + "ideas_accepted": 5, + "ideas_deferred": 3, + "ideas_rejected": 0, + "accepted_into_reqs": ["REQ-295", "REQ-297", "REQ-300", "REQ-303", "REQ-304", "REQ-305"], + "deferred": ["I6-env-transition-as-policy", "I7-drift-as-policy", "I8-cross-project-sharing"] + }, + "notes": "IDEATE complete — 5 accepted (already in REQ-291..309), 3 deferred with documented blockers. No new reqs added; the pass validated the requirement set." } \ No newline at end of file diff --git a/.ciagent/IDEATE.md b/.ciagent/IDEATE.md new file mode 100644 index 0000000..0e74f0a --- /dev/null +++ b/.ciagent/IDEATE.md @@ -0,0 +1,157 @@ +# IDEATE — v1.25 kyverno-json Unified Policy Engine + +> **Autonomy:** full. 3-tier ideation per `config.json ideation.enabled: +> true`. `cross_project.enabled: false` → cross-project tier scoped to +> single-project (deferred ideas only, no cross-project candidates +> accepted). `confidence_threshold: 0.6`, `max_ideas: 20`. +> Categories: security, quality, architecture, coverage, improvement. + +## Tier 1 — Mechanical (pattern-driven, codebase-grounded) + +### I1 — Regression-gate-as-policy ✅ ACCEPTED (REQ-304, REQ-305) + +**Category:** quality, coverage +**Confidence:** 0.90 +**Pattern:** imperative check → declarative policy (the milestone's +core thesis applied to Nova's own regression gate). +**Source:** `core/regression_verify.py` (CAP-013, CAP-023, CAP-024) +are imperative Python checks. The milestone makes compliance +declarative; Nova's own capability regression should follow. +**Idea:** Port the three capability checks into +`adapters/kyverno-json/policies/regression/` as declarative policies +over the capability-inventory JSON frontmatter. The imperative +`regression_verify.py` stays (it drives the CI gate); the policies are +the declarative mirror that makes capability regression auditable as a +policy artifact. +**Accepted into:** REQ-304 (policies), REQ-305 (tests). Phase P4. + +### I2 — Contract-shape validation as policy ✅ ACCEPTED (REQ-295) + +**Category:** security, architecture +**Confidence:** 0.92 +**Pattern:** jsonschema constraint → declarative policy (same constraint, +different language, Nova posture on top). +**Source:** `schemas/contract.schema.json` required/pattern/enum. +**Idea:** The 4 contract policies (`require-id-pattern`, +`require-env-in-enum`, `require-infrastructure-min-1`, `forbid-unknown- +fields`) are the declarative equivalent of the jsonschema constraints — +they let Nova apply its own compliance posture (e.g. forbid a specific +env for a specific consumer) on top of schema validity without editing +the jsonschema. +**Accepted into:** REQ-295. Phase P2. + +### I3 — Stack-IR imperative rules → declarative policies ✅ ACCEPTED (REQ-297) + +**Category:** security, architecture +**Confidence:** 0.88 +**Pattern:** imperative Python rule → declarative kyverno-json policy. +**Source:** `adapters/terraform/policy/custom_rules/nova_tagging.py` +(tagging), the v1.0 demo `public-ingress: true` rule, the v1.8 +D-encryption-default rule. +**Idea:** Port the three highest-impact imperative rules into +declarative kyverno-json policies over the resolved Stack IR. The +tagging rule is a cross-check (D-118 — both engines, agree meta-policy); +public-ingress and encryption-by-default are kyverno-json only (the IR +is the earliest point these can be caught). +**Accepted into:** REQ-297. Phase P2. + +## Tier 2 — Backend-enriched (signal-driven) + +### I4 — Plan-JSON Checkov RULE_MAP → kyverno-json mirrors ✅ ACCEPTED (REQ-300) + +**Category:** security, coverage +**Confidence:** 0.85 +**Pattern:** existing engine rule → declarative mirror in the new engine +(defense-in-depth against engine drift). +**Source:** `checkov_adapter.py:RULE_MAP` (CKV_AWS_41/45/46, CKV_AWS_1/40, +CKV_AWS_7/33). +**Idea:** Port the 6 Checkov rules over `terraform_plan` into declarative +kyverno-json policies over `terraform show -json` output. The Checkov +rules stay the source of truth for HCL scanning; the kyverno-json +policies are mirrors (different rule language, same plan JSON). Defense- +in-depth: if Checkov and kyverno-json disagree on the same plan, the +divergence is visible (two PCRs with different results for the same +resource). +**Accepted into:** REQ-300. Phase P3. + +### I5 — Meta-policy over the merged PCR list ✅ ACCEPTED (REQ-303) + +**Category:** architecture, quality +**Confidence:** 0.90 +**Pattern:** the policy result list is itself a policy target (the most +novel use of kyverno-json in v1.25). +**Source:** `core/confidence_signal.py` PENALTY hardcode (critical +override), the D-118 tagging cross-check. +**Idea:** `block-on-any-critical` (declarative "critical = block") + +`tagging-rules-agree` (Checkov vs kj agree). The meta-policies consume +the merged PCR list as their payload. The critical-block meta-policy is +the declarative source of truth; the `confidence_signal.py` hard-override +stays as defense-in-depth (D-119). +**Accepted into:** REQ-303. Phase P3. + +### I6 — Env-transition destroy as a declarative policy ❌ DEFERRED + +**Category:** improvement +**Confidence:** 0.55 (below threshold — deferred, not rejected) +**Pattern:** imperative lifecycle Python → declarative policy. +**Source:** `core/env_transition.py` (v1.24 detect-and-destroy). +**Idea:** The v1.24 env-transition destroy logic (detect env change via +DynamoDB, destroy prior env, fail-closed) is imperative Python. A +declarative kyverno-json policy could assert "if `environment` changed +on a stable `contract.id`, a destroy event MUST precede the apply" — +turning the lifecycle enforcement into an auditable policy artifact. +**Reason deferred:** The env-transition logic is *stateful* (DynamoDB +queries, terraform state inspection) — kyverno-json policies are +*stateless* (payload in, PCRs out). A policy can assert the *contract* +shape (the env value is valid) but not the *lifecycle* (the prior env +was destroyed). The stateful check stays in `core/env_transition.py`; +a future milestone could emit a `nova.env.destroyed` event that a +kyverno-json policy then asserts is present in the evidence stream +(event-as-policy). Recorded as a future-idea, not a v1.25 requirement. + +### I7 — Drift detection as policy ❌ DEFERRED + +**Category:** security, coverage +**Confidence:** 0.40 (below threshold — deferred) +**Pattern:** scheduled job → policy over the drift report. +**Source:** NORTH_STAR.md Non-Goal #4 (drift detection scheduled job, +deferred — D-096 + no scheduler). +**Idea:** A kyverno-json policy over a terraform drift report could +assert "no drifted resources" declaratively. But drift detection itself +requires a scheduled `terraform plan -detailed-exitcode` job, which is +deferred (no scheduler). The policy is the easy part; the emitter is the +blocking dependency. +**Reason deferred:** Blocked by D-096 + no scheduler (same as NORTH_STAR +Non-Goal #4). The policy shape is documented for when the emitter ships. + +## Tier 3 — Cross-project (deferred — single project) + +### I8 — Cross-project policy sharing ❌ DEFERRED (config) + +**Category:** improvement +**Confidence:** N/A +**Pattern:** policies shared across projects in a multi-project org. +**Source:** `config.json ideation.cross_project.enabled: false`. +**Idea:** In a multi-project org, kyverno-json policies could be shared +across projects (a tagging standard policy applies to all projects). +**Reason deferred:** ACDL is single-project (`active_projects: ["acdl"]`). +Cross-project ideation is disabled in config. Recorded for when the +org grows. + +## Summary + +- 5 ideas accepted (I1..I5) → already captured as REQ-295, REQ-297, + REQ-300, REQ-303, REQ-304, REQ-305. +- 3 ideas deferred (I6, I7, I8) with documented blocking reasons. +- 0 ideas rejected (below-threshold ideas are deferred, not rejected — + they may activate when their blockers lift). +- The accepted ideas are the **quality improvement** the user asked for + ("ideate and explore how it can be used within the Nova platform to + improve quality of the platform checks"): I1 (regression-gate-as- + policy) is the headline quality improvement; I4 + I5 are the defense- + in-depth coverage improvements; I2 + I3 are the architecture + improvements (imperative → declarative). +- No new requirements added beyond REQ-291..309 (the accepted ideas are + already scoped into the existing requirements). The IDEATE pass + validated the requirement set rather than expanding it — the ideas + were anticipated in the SPECIFY stage and explicitly captured. \ No newline at end of file