continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity

Merge milestone/v1.15-nova — v1.15 complete (Nova Rebrand: full ACDL→Nova rebrand across docs, decks, code, configs, CI, env vars, consumer path, SSM path, tag keys, AWS resource names; 4 execution phases + final; tag v1.15.4)

Browse Source
This commit is contained in:
Jon Chery
2026-07-30 02:24:50 +00:00
parent 66a3c6958e 3c765c3211
commit 9ddd0ae6f9
147 changed files with 3956 additions and 1246 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.ciagent/ARCHITECTURE.md
+82 -8
View File
@@ -1,8 +1,8 @@
# ACDL — Architecture (v1.1 target)
# Nova — Architecture (v1.1 target)
> Target architecture for the real Agentic Cloud Delivery Platform.
> Source of truth for **how**: `docs/architecture.md` (v0.2) is the upstream
> draft; this file is the ACDL-repo operating copy, refined at phase
> Target architecture for the real Agentic Cloud Delivery Platform (rebranded
> Nova in v1.15). Source of truth for **how**: `docs/architecture.md` (v0.2) is the upstream
> draft; this file is the Nova-repo operating copy, refined at phase
> boundaries. Where this file and `docs/vision.md` conflict, the vision wins.
## Status
@@ -598,10 +598,11 @@ VPC; the microservice composition references it via
`terraform_remote_state` (data source). State keys are deterministic and
env-aware (`spike/{contract.id}/{contract.environment}/terraform.tfstate`).
**ACDL_LIFECYCLE_MODE (v1.12, REQ-134).** The lifecycle pipeline defaults
**NOVA_LIFECYCLE_MODE (v1.12, REQ-134; renamed ACDL→NOVA in v1.15 P2).** The lifecycle pipeline defaults
to plan-only (fast, no AWS mutation, no cost). A CI variable
`ACDL_LIFECYCLE_MODE` (default `plan`) overrides to `full` for the real
apply→modify→destroy.
`NOVA_LIFECYCLE_MODE` (default `plan`) overrides to `full` for the real
apply→modify→destroy. (P2–P4 dual-read fallback to `ACDL_LIFECYCLE_MODE`;
fallback removed in P5 per the v1.15 addendum.)
## v1.12 Addendum — Presentation Refinement + CAP-013 Fix
@@ -659,4 +660,77 @@ count (P20).
remains deferred (D-096, v1.14). The hash-chain + DynamoDB outbox is the
v1.14 audit record. JWS per-event authenticity is not implemented; a
forged event is only detectable by re-reading the whole chain. The
deferral is documented here explicitly per the v1.14 grill (E-001).
deferral is documented here explicitly per the v1.14 grill (E-001).
---
## v1.15 Addendum — Nova Rebrand (Major/breaking, 2026-07-30)
**Milestone:** v1.15-Nova. A full rebrand from **ACDL** / "Agentic Cloud
Delivery Platform" → **Nova** / "The New Dawn of DevSecOps — security
as a seamless enabler of fast deployments." This is a **Major
milestone** (breaking): consumer-facing path, env var prefixes, SSM
path, AWS tag keys, and AWS resource names all change. Per the
branch-strategy precedent (breaking/feature milestones tag on their
OWN minor line), v1.15 tags run on the **v1.15.x minor line**:
`v1.15.0` (P0) → `v1.15.4` (P5 final = release). (G-104 binding.)
### Naming conventions (rebranded)
| Convention | Before (v1.0–v1.14) | After (v1.15+) | Phase |
|------------|---------------------|-----------------|-------|
| Project name | `ACDL` / "Agentic Cloud Delivery Platform" | `Nova` / "The New Dawn of DevSecOps" | P1 |
| Tagline | "Consumers declare intent; the platform delivers safe production deployment through an agentic stack" | (retained) **+** "The New Dawn of DevSecOps — security as a seamless enabler of fast deployments" | P1 |
| Schema `$id` URL | `https://acdl.cloudinit.dev/schemas/...` | `https://nova.cloudinit.dev/schemas/...` | P1 |
| Gitea release title | `ACDL vX.Y.Z` | `Nova vX.Y.Z` | P1 (forward only) |
| Env var prefix | `ACDL_*` (21 vars) | `NOVA_*` (dual-read fallback in P2–P4; removed P5) | P2 |
| Env loader | scattered `os.environ.get("ACDL_*")` | centralized `core/env.py` `get_env()` (D-108) | P2 |
| Consumer contract path | `.acdl/contract.yml` | `.nova/contract.yml` | P2 |
| Checkov custom rule file | `acdl_tagging.py` | `nova_tagging.py` | P2 |
| Checkov tag-key enforcement | `acdl:*` (hard) | `nova:*` (warn P2, hard P3) | P2/P3 |
| SSM parameter path | `/acdl/{env}/{contractId}/{output}` | `/nova/{env}/{contractId}/{output}` | P3 |
| AWS tag keys | `acdl:owner|environment|contract|cost-center|ref` | `nova:owner|environment|contract|cost-center|ref` | P3 |
| ABAC session policy match | `acdl:*` tags | `nova:*` tags (parallel-tag period) | P3 |
| DynamoDB tables | `acdl-contracts`, `acdl-change-requests` | `nova-contracts`, `nova-change-requests` (scan+copy) | P4 |
| Lambda (ingestor) | `acdl-contract-ingestor` (role/policy/function) | `nova-contract-ingestor` | P4 |
| Secrets Manager secret | `acdl/github-token` | `nova/github-token` | P4 |
| SNS topic | `acdl-sod-halt` | `nova-sod-halt` | P4 |
| Security group | `acdl-ecs-sg` | `nova-ecs-sg` | P4 |
| KMS alias | `alias/acdl-platform` | `alias/nova-platform` | P4 |
| ECS cluster/service/task | `acdl-microservice` | `nova-microservice` | P4 |
| ECR repo | `acdl-microservice` | `nova-microservice` (re-push) | P4 |
| IAM user/policy | `acdl-spike-runner` (+policy) | `nova-spike-runner` (re-bootstrap) | P4 |
| S3 state bucket | `acdl-tfstate-581513795199-us-east-1` | `nova-tfstate-581513795199-us-east-1` (`-migrate-state`) | P4 |
| ALB name prefix | `acdl-alb` | `nova-alb` | P4 |
| Lambda default table names | `CONTRACTS_TABLE` default `acdl-contracts` | default `nova-contracts` (D-111) | P4 |
### Unchanged conventions (out of scope)
- **S&P Global Energy visual theme** (`sp-theme.json`, deck CSS: #D6002A
red, Akkurat Pro) — client branding, not the Nova product brand (D-107).
- **config.json `release.gitea.repo`** = `acdl` — real Gitea repo name
unchanged (D-105). Doc URLs updated to `nova` for prose only.
- **Git branch/tag naming** — `milestone/v*`, `phase/*`, `v*` semver; no
brand name present (D-112: flat-branch convention preserved).
- **Past Gitea release titles** — existing releases keep `ACDL vX.Y.Z`.
### Migration ordering (binding)
1. **P1** docs/decks/prose — no runtime impact; ships consumer migration
guide announcing the 5 breaking changes.
2. **P2** code + env vars (dual-read) + consumer path — deployments don't
break during the transition window (dual-read fallback).
3. **P3** SSM path (copy → read → delete) + tag keys (parallel-tag →
policy swap → remove old).
4. **P4** AWS resource names — staged terraform migration (KMS alias,
SNS/SG/Lambda recreate, DynamoDB scan+copy, ECR re-push, IAM
re-bootstrap, state bucket `-migrate-state`, ALB recreate). Maintenance
window + rollback runbook (`docs/NOVA_AWS_MIGRATION.md`).
5. **P5** final review + audit + remove dual-read fallback + milestone ship.
### Capability gate (binding)
The regression gate (CAP-001..CAP-016, `scripts/run_regression.sh`) must
stay **16/16 Verified** throughout the rebrand. P2/P3/P4 update test
fixtures that reference `ACDL`/`acdl` so the gate stays green. No
capability is added, removed, or reclassified in v1.15 — the rebrand is
nomenclature + identifiers, not behavior.
.ciagent/CHECKPOINT.json
+6 -4
View File
@@ -1,9 +1,11 @@
{
"phase": 21,
"phase": 5,
"stage": "complete",
"milestone": "v1.14",
"milestone": "v1.15",
"phase_role": "final",
"attempts": 0,
"updated_at": "2026-07-29T21:00:00Z",
"milestone_complete": true
"updated_at": "2026-07-30T00:11:00Z",
"milestone_complete": true,
"requirements": ["REQ-155", "REQ-156", "REQ-157", "REQ-158", "REQ-159", "REQ-160", "REQ-161", "REQ-162", "REQ-163", "REQ-164"],
"tag": "v1.15.4"
}
.ciagent/GRILL.md
+260
View File
@@ -310,3 +310,263 @@ autonomy with assumption logging.
P8 exclude the state-bucket name from externalization entirely
(externalize only resource ARNs, leave the backend `bucket` literal).
Confidence 0.55; auto-resolved per `config.autonomy.level=full`.
---
## Run: 2026-07-30 (mode: interactive, focus: v1.15-Nova rebrand, all 9 axes)
### Verdict: Proceed with conditions (confidence: 0.82)
A Major/breaking rebrand (ACDL → Nova) across prose, decks, code, env vars,
consumer path, SSM path, AWS tag keys, and AWS resource names — 4 execution
phases + 1 final. The plan is technically sound and the scope is user-directed
(D-102..D-112). Three binding mitigations surfaced (G-104, G-106, G-108); the
rest accept the plan as written. Two findings carry residual risk that is
accepted at full autonomy (G-103, G-107). No escalations remain open — all
auto-resolved with assumption logging per `config.autonomy.level=full`.
The single most material correction: **the versioning scheme was wrong**.
The plan tagged a Major/breaking milestone on the v1.14.x PATCH line
(`v1.14.5` = release), contradicting every prior breaking milestone in the
project (v1.1→v1.2.0, v1.5→v1.5.0, v1.11→v1.11.0 — all minor bumps). The
quoted "Major = progressive minor per phase" rule does not exist in any repo
file. **G-104 binds: re-tag as v1.15.x minor-bumped phases** (P1→v1.15.0 …
P5→v1.15.4, with v1.15.4 IS the milestone release).
### Per-axis findings
#### Axis 1 — Feasibility
**Challenge:** Can the full rebrand (1,465 `ACDL`/`acdl` occurrences across 205
files, 21 env vars, 11 AWS resources, 5 tag keys, 67 SSM refs, 23 consumer-path
refs) actually be done in 4 execution phases? The migration ordering
(docs→code/env→SSM/tags→AWS resources→final) is sound: P1 has no runtime impact,
P2's dual-read fallback prevents deployment breakage, P3's parallel-tag period
prevents ABAC lockout, P4's staged terraform migration prevents a big-bang
failure. The phase dependencies (P2 depends on P1's migration guide; P3 depends
on P2's dual-read + nova_tagging warn mode; P4 depends on P3's hard-mode tag
enforcement; P5 depends on all) are correctly ordered. **Confidence 0.85** that
the 4-phase structure is feasible. The `terraform init -migrate-state` approach
for the state bucket is the documented, correct mechanism (back up state JSON
first). No hidden dependencies found: the `.env.secrets` direct-read path
(G-106) and the Gitea secrets rotation (G-108) are the only mechanic gaps, both
now bound. **Verdict: ACCEPT-AS-IS.** **G-103.**
#### Axis 2 — Scope
**Challenge:** Is the full AWS resource rename WITH migration (downtime
accepted) over-scoped for a rebrand? D-102 locked this as user-directed. The
alternative (rename code only, leave AWS resources as `acdl-*`) would leave a
permanent brand inconsistency between code and cloud — acceptable for an NFR
patch, not for a "Major/breaking" milestone. The S&P visual theme is correctly
out of scope (D-107). The real Gitea repo name stays `acdl` (D-105) — sensible
(repo rename is a separate operational burden). Past Gitea release titles stay
`ACDL vX.Y.Z` (forward-only) — sensible (no history rewrite). Git branch/tag
naming has no brand name (D-112) — sensible. **Missing from scope:** the CI
workflow secret-references (`.gitea/workflows/*` `secrets.ACDL_*`) — P2 task 3
creates `NOVA_*` Gitea secrets but the plan does not show the workflow YAML
`secrets:` references being updated; G-108 binds the mitigation. **Confidence
0.80.** **Verdict: ACCEPT-AS-IS.** **G-104** (versioning — see Axis 5).
#### Axis 3 — Cost
**Challenge:** What's the real cost (downtime, person-hours, risk) and is it
justified for a *rebrand*? Per A1 (conf 0.9), no live AWS apply during P0–P4 —
so the migration scripts are authored but not executed; the live apply is an
operator runbook step. Person-hours are the agent's own (autonomous OSS
reference, G-003 carries forward). Downtime is accepted (D-102) but deferred to
the operator runbook. Token cost: the 1,465-occurrence rename across 205 files
is a large but mechanical edit — the explore survey already quantified the
mechanical-vs-judgment split. The risk cost (DynamoDB data loss, state bucket
corruption, ABAC lockout) is mitigated by the staged ordering + dual-read +
parallel-tag — all plan-validated, not live-applied. For an OSS reference with
0 consumer adoption (PROJECT.md:487), the cost is bounded. **Confidence 0.80.**
**Verdict: ACCEPT-AS-IS.** **G-105.**
#### Axis 4 — Schedule / risk
**Challenge:** DynamoDB data loss, state bucket migration, ABAC breakage,
consumer disruption. The mitigations: (a) DynamoDB scan+copy with row-count
verification, keep old tables until verified (manual post-verification deletion
— point of no return documented); (b) state bucket `terraform init
-migrate-state` with state JSON backup first; (c) parallel-tag ABAC period
(emit nova:* + acdl:* → swap policy → remove acdl:*); (d) consumer disruption
mitigated by the dual-read fallback (P2–P4) + the migration guide (P1). The top
3 assumptions: A1 (no live apply — conf 0.9, verified by the established
v1.11–v1.14 pattern), A2 (.env.secrets keys renamed, values stay — conf 0.85,
now bound by G-106), A3 (Gitea release API reachable — conf 0.8, verified HTTP
200). The single risk that could kill the project: state bucket corruption
during `-migrate-state` — mitigated by the backup-first runbook step. No
pre-mortem beyond the runbook is documented, but the staged ordering IS the
de-facto pre-mortem mitigation. **Confidence 0.78.** **Verdict: ACCEPT-AS-IS.**
**G-106.**
#### Axis 5 — Technical soundness
**Challenge:** Is the dual-read fallback design sound? Is the parallel-tag ABAC
migration safe? Is `terraform init -migrate-state` correct? **Dual-read:**
sound in principle (NOVA_X preferred, ACDL_X fallback), BUT the `.env.secrets`
load path bypasses the `core/env.py` helper — `run_platform.sh:288-289` exports
`$ACDL_AWS_ACCESS_KEY_ID` (hardcoded) and `regression_verify.py:309-312`
parses the file matching `k == "ACDL_AWS_ACCESS_KEY_ID"` (hardcoded). If P2
renames the `.env.secrets` keys to `NOVA_*` but these two readers still read
`ACDL_*`, AWS creds vanish → CAP-013/014/015 (which need live creds for
terraform plan) break → regression gate breaks. **G-106 binds: dual-read in
BOTH load paths** (shell export + Python parser must read NOVA_* first, ACDL_*
fallback, mirroring the helper contract). **Parallel-tag ABAC:** safe — emit
both tag sets, swap policy with acdl:* as secondary condition, verify, remove.
Plan-validated only per A1 (live ABAC stays acdl:* until operator runbook).
**`terraform init -migrate-state`:** correct documented mechanism; backup state
JSON first is the binding safety step. **Versioning contradiction:** the plan
tags a Major milestone on the v1.14.x PATCH line — G-104 binds re-tag as
v1.15.x minor-bumped. **Confidence 0.85.** **Verdict: MITIGATE-BINDING (G-106).**
**G-104, G-106.**
#### Axis 6 — Testability / verifiability
**Challenge:** Can the success criteria actually be verified? Will the
regression gate stay 16/16 across a 1,465-occurrence rename? Is `grep -rni ACDL`
returning 0 realistic? The gate-stays-16/16 binding constraint (PLAN.md:44-49)
requires per-phase fixture updates — P2 updates env-var fixtures, P3 updates
SSM/tag fixtures, P4 updates terraform-name fixtures. The dual-read fallback
test (P2) keeps ACDL_* as the fallback source — this is the ONE allowed
exception to the grep-returns-0 criterion (success criterion 6 exempts it).
`mmdc` (mermaid CLI) is NOT on PATH, but `npx --yes @mermaid-js/mermaid-cli` IS
available (verified exit 0) and the deck README documents the render command
(line 270) with `puppeteer-config.json` for no-sandbox — so the 5 `.mmd` PNG
re-exports in P1 task 3 are feasible. The Gitea secrets rotation (P2 task 3)
was verified: API reachable (HTTP 200), token present, `rotate_spike_key.sh`
pattern exists. **Confidence 0.82.** **Verdict: ACCEPT-AS-IS.** **G-107.**
#### Axis 7 — Security
**Challenge:** Does the rebrand introduce a security regression? (a) ABAC
policy swap window — mitigated by the parallel-tag period (nova:* + acdl:*
both valid → swap → remove); plan-validated only, no live window during P0–P4.
(b) Secret rotation — `.env.secrets` keys renamed (values stay, no
re-rotation needed until P5); G-106 binds the dual-read in both load paths so
creds don't silently vanish. (c) `.env.secrets` key rename — the file contains
live rotated AWS creds + a Gitea token; renaming keys is cosmetic (same values)
but the load-path readers must follow (G-106). (d) IAM policy scope (v1.14 P9
scoped `Resource: "*"`) — the rebrand renames `acdl-*` ARNs to `nova-*` in
terraform; the IAM policy `Resource` patterns must be updated to `nova-*` —
P4 task 2 covers this (`acdl-spike-runner` → `nova-spike-runner`). No new
security regression introduced; the rebrand is nomenclature, not a permission
change. **Confidence 0.80.** **Verdict: ACCEPT-AS-IS.** **G-108.**
#### Axis 8 — Maintainability
**Challenge:** Will the dual-read fallback + parallel-tag period create
technical debt that's hard to clean up? Is P5 (remove fallback) realistic? The
dual-read (P2) + parallel-tag (P3) IS technical debt by design — it exists to
be removed in P5. P5 does six things in one phase (remove fallback, hard-fail
acdl:*, delete Gitea ACDL_* secrets, remove .env.secrets legacy comment,
multi-persona review + audit, milestone ship). The risk: P5's removal surfaces
a break if P2–P4 didn't catch every ACDL_* reference in the platform's OWN CI
workflows. But P5 is mechanical cleanup: `get_env()` drops the fallback branch,
shell scripts drop `:-$ACDL_X`, `nova_tagging.py` flips warn→hard-fail. The
grep-returns-0 success criteria are verifiable. The 0-consumer-adoption state
(PROJECT.md:487) means no external consumer breaks at P5; only the platform's
own CI must be fully migrated by P4. **Confidence 0.78.** **Verdict:
ACCEPT-AS-IS.** **G-109.**
#### Axis 9 — Adversarial
**Challenge:** Worst-case scenario? What breaks first? Rollback plan if P4
goes wrong mid-flight? **Worst case:** the `terraform init -migrate-state`
corrupts the state bucket JSON and the backup was incomplete — you lose
terraform state for the microservice + static-assets stacks. **Mitigation:**
the runbook binds "back up the state JSON first" before each `-migrate-state`;
keep old DynamoDB tables until verified (manual post-verification deletion =
the point of no return). The staged ordering (KMS alias → SNS/SG → Lambda →
DynamoDB → ECR → IAM → state bucket → ALB last) means a mid-flight failure at
any step leaves prior steps intact and old resources still named `acdl-*`. The
dual-read fallback (P2–P4) means the runtime tolerates both `acdl-*` and
`nova-*` during the window — so a partial migration doesn't break the running
platform. **What breaks first:** the `.env.secrets` load path (G-106) — if the
key rename + reader update are misaligned, AWS creds vanish and the regression
gate breaks immediately. G-106 binds the mitigation. **Rollback:** the runbook
is the rollback; the staged ordering with "keep old until verified" is the
safety net. ALB recreate (last, brief downtime) is the only hard-downtime step;
rollback = recreate the old ALB. **Confidence 0.75.** **Verdict: ACCEPT-AS-IS.**
**G-110.**
### Binding decisions (G-103..G-110)
| ID | Axis | Decision | Confidence | Rationale |
|----|------|----------|-----------|-----------|
| G-103 | 1 (Feasibility) | ACCEPT-AS-IS | 0.85 | 4-phase structure is feasible; migration ordering (docs→code/env→SSM/tags→AWS→final) is sound; phase dependencies correctly ordered; `terraform init -migrate-state` is the correct mechanism. |
| G-104 | 2/5 (Scope/Technical) | MITIGATE-BINDING | 0.90 | **Re-tag as v1.15.x minor-bumped phases** (P1→v1.15.0 … P5→v1.15.4, v1.15.4 IS the milestone release). The v1.14.x PATCH-line scheme contradicts every prior breaking milestone (v1.1→v1.2.0, v1.5→v1.5.0, v1.11→v1.11.0). The quoted "Major = progressive minor per phase" rule exists in NO repo file. A Major/breaking milestone shipping as v1.14.5 means the semver MAJOR never advances despite a breaking change — consumers on `@v1` silently absorb the rebrand. Update PLAN.md, ROADMAP.md §v1.15, PROJECT.md §v1.15, and ARCHITECTURE.md §v1.15 Addendum tag references. |
| G-105 | 3 (Cost) | ACCEPT-AS-IS | 0.80 | No live AWS apply during P0–P4 (A1); migration scripts authored, not executed; downtime accepted (D-102) but deferred to operator runbook. For an OSS reference with 0 consumer adoption, cost is bounded. |
| G-106 | 4/5 (Risk/Technical) | MITIGATE-BINDING | 0.88 | **Dual-read in BOTH `.env.secrets` load paths.** `run_platform.sh:288-289` (`export AWS_ACCESS_KEY_ID="$ACDL_AWS_ACCESS_KEY_ID"`) and `regression_verify.py:309-312` (parses file matching `k == "ACDL_AWS_ACCESS_KEY_ID"`) bypass the new `core/env.py get_env()` helper. P2 MUST update both readers to read `NOVA_*` first with `ACDL_*` fallback — mirroring the dual-read contract. Without this, renaming `.env.secrets` keys to `NOVA_*` breaks AWS creds → CAP-013/014/015 fail → regression gate breaks. Old `ACDL_*` keys removed in P5. |
| G-107 | 6 (Testability) | ACCEPT-AS-IS | 0.82 | Per-phase fixture updates keep the gate 16/16 (PLAN.md:44-49 binding constraint). `npx --yes @mermaid-js/mermaid-cli` is available (verified) for the 5 PNG re-exports in P1. Gitea API reachable (HTTP 200) + token present for P2 task 3. |
| G-108 | 7 (Security) | MITIGATE-BINDING | 0.80 | **P2 task 3 must update the CI workflow `secrets:` references** (`.gitea/workflows/*`, `.github/workflows/*`) when `NOVA_*` Gitea secrets are created, with graceful degrade + retry on API failure. The plan creates `NOVA_*` aliases but does not show the workflow YAML `secrets.ACDL_*` references being updated. If the workflows still reference `ACDL_*` secrets at P5 (when old secrets are deleted), CI breaks. The Gitea secrets rotation must be a hard gate with retry-on-failure (not a silent skip). |
| G-109 | 8 (Maintainability) | ACCEPT-AS-IS | 0.78 | P5 is mechanical cleanup (drop fallback branch, hard-fail acdl:*, delete old secrets); 0-consumer-adoption means no external break at P5; grep-returns-0 is verifiable. |
| G-110 | 9 (Adversarial) | ACCEPT-AS-IS | 0.75 | Runbook + staged ordering is the rollback; "keep old until verified" is the safety net; ALB recreate (last) is the only hard-downtime step. The `.env.secrets` load path (G-106) is what breaks first if misaligned — G-106 binds the mitigation. |
### Escalations
None remain open. All material questions resolved with confidence ≥ 0.60.
Two findings carry accepted residual risk (auto-resolved at full autonomy
with assumption logging):
- **G-103 (Axis 1):** residual risk that the 4-phase structure underestimates
the 1,465-occurrence rename effort — accepted; per-phase fixture updates
(G-107) + the explore survey's mechanical-vs-judgment split bound the effort.
- **G-107 (Axis 6):** residual risk that a test fixture is missed during the
per-phase rename, breaking 16/16 at a phase boundary — accepted; the
per-phase verify step (run the gate before tagging) catches it before ship.
### Forcing questions asked (7)
1. **Versioning contradiction** — Major milestone on v1.14.x PATCH line vs.
prior breaking milestones all minor-bumped. → **G-104 MITIGATE-BINDING**
(re-tag as v1.15.x).
2. **P4 migration completeness** — plan-validated terraform vs live AWS
resources still `acdl-*`. → **G-103/105 ACCEPT-AS-IS** (runbook for live).
3. **`.env.secrets` key rename mechanic** — dual-read helper bypassed by direct
shell/Python readers. → **G-106 MITIGATE-BINDING** (dual-read in both load
paths).
4. **Gitea secrets rotation** — API reachable, token present, but workflow
`secrets:` references not shown updated. → **G-108 MITIGATE-BINDING** (update
workflow refs, hard gate + retry).
5. **ABAC parallel-tag window** — over-engineered for 0 consumers, or correct
forward-looking safety net? → **G-108/Axis-4 ACCEPT-AS-IS** (parallel-tag is
the mitigation, plan-validated).
6. **Regression gate during rebrand** — 16/16 across 1,465-occurrence rename?
→ **G-107 ACCEPT-AS-IS** (per-phase fixture updates).
7. **P5 fallback removal realism** — cleanup + review + audit + ship in one
phase? → **G-109 ACCEPT-AS-IS** (mechanical cleanup).
8. **P4 rollback plan** — runbook + staged ordering sufficient? → **G-110
ACCEPT-AS-IS** (staged ordering is the rollback).
### What the project is NOT doing that it should (adversarial close)
- **Documenting the versioning rule it now follows.** G-104 binds the
v1.15.x minor-bumped scheme, but no `.ciagent/` file records the
versioning convention. The plan should add a one-line versioning note to
PROJECT.md §v1.15 or a `VERSIONING.md` so the next milestone doesn't
re-litigate this.
- **Quantifying the live state volume** for the DynamoDB scan+copy + state
bucket migration. The runbook says "back up first" + "verify row counts" but
doesn't quantify the data. For 0-consumer-adoption, this is likely tiny —
but the rollback feasibility (G-110) depends on it being small enough to
re-scan. Accepted residual risk.
### Simplest 80%-value version
The simplest version that delivers 80% of the rebrand value: **P1 (docs/decks)
+ P2 (code/env dual-read) + P5 (ship)** — skip the live AWS resource migration
(P3 SSM/tags + P4 AWS resources) entirely. The code + docs would say Nova; the
cloud would still say `acdl-*`. This is the "rename code only, leave cloud"
option D-102 rejected. The user chose the full migration (D-102) — the binding
decision is recorded; the 80% version is NOT the chosen path. The full scope is
accepted as user-directed.
### What must be true for success in the next 90 days, and is it true today?
1. **The dual-read helper + both `.env.secrets` load paths are updated in
lockstep (G-106).** — TRUE after P2 binds G-106; FALSE today (the direct
readers still hardcode `ACDL_*`).
2. **The regression gate stays 16/16 at every phase boundary (G-107).** —
TRUE if per-phase fixture updates are complete before each tag; the
per-phase verify step enforces it.
3. **The CI workflow `secrets:` references are updated when `NOVA_*` Gitea
secrets are created (G-108).** — FALSE today; P2 task 3 must be expanded to
include the workflow YAML updates.
4. **The versioning scheme is corrected to v1.15.x (G-104).** — FALSE today;
the plan says v1.14.x. Must be corrected before P0 ship.
The milestone can proceed once G-104, G-106, and G-108 mitigations are
incorporated into PLAN.md. Confidence 0.82.
.ciagent/PERSONAS.md
+52 -1
View File
@@ -148,4 +148,55 @@ default per execute.md is `warn`. Cross-territory edits are logged in the
commit message but do not fail the task. v1.11's scope means co-authoring
across territories is likely (e.g. backend + general on the adapter +
`run_platform.sh` boundary; data + general on the examples + pipeline
boundary); `warn` keeps it frictionless.
boundary); `warn` keeps it frictionless.
---
## v1.15 Persona Addendum — Nova Rebrand (2026-07-30)
**Milestone:** v1.15-Nova. The roster carries forward from v1.11/v1.14
unchanged — the rebrand touches existing territories, no new domains.
**frontend-engineer** remains deactivated (no UI; decks are markdown =
lead-developer territory). No **security-engineer** persona is activated
— the ABAC session-policy + tag-key migration (REQ-162) is data-engineer
territory (terraform IAM) with lead-developer review.
### v1.15 territory assignments
| Phase | Lead | Contributors | Territory |
|-------|------|---------------|-----------|
| P1 docs-decks-prose | lead-developer | — | `README.md`, `docs/**`, `.ciagent/*.md`, deck `.md`/`-marp.md`/`-talking-points.md`/`.html`, `docs/presentations/assets/mmd/*.mmd` (+ PNG re-export), `pyproject.toml`, `schemas/*.schema.json` `$id` (D-110), `docs/NOVA_MIGRATION.md`, `.github/workflows/release.yml` title, `modules/STANDARDS.md` |
| P2 code-envvars-consumer-path | backend-engineer | lead-developer (docs/runbook) | `core/env.py` (NEW dual-read helper, D-108), `core/*.py` (call-site migration), `scripts/*.py` + `*.sh`, `adapters/**`, `tests/**`, `.gitea/workflows/**` + `.github/workflows/**`, `.env` + `.env.secrets` (key rename), `schemas/tagging-standard.json`, `adapters/terraform/policy/custom_rules/acdl_tagging.py` → `nova_tagging.py` (D-109: warn mode) |
| P3 ssm-tagkeys | data-engineer | backend-engineer (readers) | `core/output_publisher.py` (SSM path `/nova/`), `core/contract_resolver.py` (SSM reads), `scripts/migrate_ssm_paths.py` (NEW), `terraform/**` (tag keys `nova:*`), `adapters/terraform/policy/custom_rules/nova_tagging.py` (D-109: hard mode), ABAC session-policy terraform |
| P4 aws-resource-migration | data-engineer | lead-developer (runbook) | `terraform/platform/main.tf`, `terraform/microservice/main.tf`, `terraform/ci-vpc/main.tf`, `terraform/bootstrap/**`, `modules/l1/alb/instance.json`, `scripts/migrate_dynamodb_data.py` (NEW), `docs/NOVA_AWS_MIGRATION.md` (NEW runbook), `core/lambda/contract_ingestor.py` (default table names → `nova-*`, D-111) |
| P5 final-review-ship | lead-developer | all active (review) | `.ciagent/**` (REQUIREMENTS/ROADMAP/PROJECT complete), `core/env.py` (remove dual-read fallback), `nova_tagging.py` (hard-fail `acdl:*`), review + audit |
### v1.15 domain priority
`lead → backend → data` (inverted from v1.11)
Rationale: the rebrand is docs/prose-first (P1 establishes the
vocabulary, no runtime impact), then code/env-vars/consumer-path (P2),
then SSM/tag-keys (P3), then the heavy terraform/AWS migration (P4).
Lead-developer owns the docs + runbooks + verification + final ship;
backend-engineer owns the dual-read helper + call-site migration +
contract resolver; data-engineer owns the terraform resource/tag/SSM
migration (the heaviest terraform territory). Co-authoring expected at:
`core/env.py` + `core/*.py` boundary (backend + lead on the helper
design), `nova_tagging.py` + `schemas/tagging-standard.json` boundary
(backend authors the rule, data-engineer owns the tag-key schema),
`core/output_publisher.py` SSM path + `terraform` outputs boundary
(backend writes the reader, data-engineer owns the terraform that
produces the outputs).
### v1.15 verification toolchain (unchanged from v1.14)
```
typecheck: terraform validate && python3 -m py_compile core/**/*.py adapters/**/*.py
test: bash scripts/run_regression.sh # 16-capability gate
build: bash scripts/run_ci.sh # full local CI reproduction
```
The regression gate (CAP-001..CAP-016) must stay **16/16 Verified**
throughout the rebrand — the rebrand must not regress any capability.
P2/P3/P4 update test fixtures that reference `ACDL`/`acdl` so the gate
stays green.
.ciagent/PLAN.md
+309 -353
View File
@@ -1,393 +1,349 @@
---
phase: P0
name: pre-execution
milestone: v1.14
requirements: [REQ-135, REQ-136, REQ-137, REQ-138, REQ-139, REQ-140, REQ-141, REQ-142, REQ-143, REQ-144, REQ-145, REQ-146, REQ-147, REQ-148, REQ-149, REQ-150, REQ-151, REQ-152, REQ-153, REQ-154]
milestone: v1.15
requirements: [REQ-155, REQ-156, REQ-157, REQ-158, REQ-159, REQ-160, REQ-161, REQ-162, REQ-163, REQ-164]
wave: 0
depends_on: []
---
# v1.14 — NFR Refinement Plan (20 execution phases + 1 final)
# v1.15 — Nova Rebrand Plan (4 execution phases + 1 final)
**Milestone:** v1.14 (NFR — bug fixes, security, stubs, tests, docs)
**Type:** NFR (all phases fix/test/docs/chore/refactor). Final patch IS
the release. Tags: `v1.13.3` (P0) → `v1.13.4..v1.13.23` (P1–P20) →
`v1.13.24` (P21 = milestone release).
**Branch:** `milestone/v1.14-refinement` → `phase/NN-<slug>`
**Milestone:** v1.15 (Nova Rebrand — Major/breaking)
**Type:** Major (breaking — consumer path, env vars, SSM path, tag keys,
AWS resource names all change). Per the branch-strategy precedent
(v1.10.2 → v1.11.0, v1.9.x → v1.10.0 — breaking/feature milestones tag
on their OWN minor line, not the previous minor's patch line), v1.15
tags run on the **v1.15.x minor line**: `v1.15.0` (P0) →
`v1.15.1..v1.15.4` (P1–P4) → `v1.15.4` (P5 = milestone release). (G-104
binding: the v1.14.x patch line is the NFR convention; a Major
milestone ships on its own minor.)
**Branch:** `milestone/v1.15-nova` → `phase/NN-<slug>`
## Wave ordering (D-098)
## Wave ordering (D-098 v1.15 analogue)
- **Wave 1 (P1–P6):** bug fixes. P1→P2 sequential (composition depends
on dedup correctness); P3–P6 independent. **G-105: full regression
gate run after P4** (validates the hardened gate before W2).
- **Wave 2 (P7–P12):** security. P8→P9 sequential (IAM ARNs reference
externalized account ID); rest independent. **G-106: mid-milestone
regression-gate checkpoint after P12** (offline gate run; non-Verified
halts W3 until fixed).
- **Wave 3 (P13–P17):** stub/test/CI/hygiene. P15 depends on P7
(hardened errors before script tests); P17 depends on P14 (both touch
config.json); P13 independent.
- **Wave 4 (P18–P20):** standards/docs/VPC. P19 depends on P1–P18
(reflects all prior phases); P18 + P20 independent.
- **Wave 1 (P1):** docs/decks/prose — no runtime impact; establishes
the Nova vocabulary + ships the consumer migration guide. REQ-155,
REQ-156, REQ-157. Independent (first phase).
- **Wave 2 (P2):** code + env vars (dual-read) + consumer path —
deployments don't break during the transition window. REQ-158,
REQ-159, REQ-160. Depends on P1 (docs establish the guide P2 changes
are announced in).
- **Wave 3 (P3):** SSM path + tag keys — SSM copy/read/delete; tag keys
parallel-tag → policy swap → remove old. REQ-161, REQ-162. Depends on
P2 (env var dual-read + nova_tagging.py warn mode must land first).
- **Wave 4 (P4):** AWS resource names — staged terraform migration.
REQ-163. Depends on P3 (tag keys nova:* enforced hard before resource
recreation; nova_tagging.py hard mode).
- **Wave 5 (P5):** final-review-ship — remove dual-read fallback, review,
audit, milestone ship. REQ-164. Depends on P1–P4.
## Execution approach
Each phase: EXECUTE (persona-assigned task groups) → VERIFY (4 layers +
regression gate at milestone complete) → SHIP (patch tag). Phase
regression gate stays 16/16) → SHIP (patch tag on v1.14.x line). Phase
boundary checkpoint resets context. The execute workflow reads this
PLAN.md + ROADMAP.md §v1.14 + PERSONAS.md for task decomposition.
PLAN.md + ROADMAP.md §v1.15 + PERSONAS.md §v1.15 for task decomposition.
**Binding constraint (capability gate):** the regression gate
(CAP-001..CAP-016, `scripts/run_regression.sh`) MUST stay 16/16 Verified
throughout the rebrand. Each phase updates test fixtures that reference
`ACDL`/`acdl` so the gate stays green. No capability is added, removed,
or reclassified — the rebrand is nomenclature + identifiers, not
behavior.
---
## Wave 1 — Bug Fixes (P1–P6)
## Wave 1 — Docs / Decks / Prose (P1)
### P1 — adapter-dedup-diagnostic (REQ-135)
**Persona:** backend-engineer
**Territory:** `adapters/terraform/adapter.py`
**Tasks:**
1. In the dedup loop (`adapter.py:159-170`), when `tf_dir` is `None`,
raise `ValueError(f"no terraform_dir in registry for module
{module}")` instead of silently skipping.
2. Verify registered-module dedup behavior preserved (multi-resource L1s
still merge into one `module "x" { ... }` block).
3. Run `pytest tests/test_adapter.py` + `run_ci.sh`.
### P2 — static-assets-wiring-fix (REQ-136)
**Persona:** data-engineer
**Territory:** `modules/l2/static-assets/`
**Tasks:**
1. Wire `default_ttl`/`max_ttl`/`price_class`/`viewer_protocol_policy`
in `composition.json` to the cloudfront child's inputs.
2. Add a `waf_enabled` feature flag (default true) to the
static-assets composition; make the WAF child conditional on it.
3. Update `examples/complex.yml` to set `waf_enabled: true` + non-default
TTLs so it resolves to a different resource set than `simple.yml`.
4. Run `pytest` + `run_ci.sh`.
### P3 — lifecycle-script-arg-cleanup (REQ-137)
**Persona:** backend-engineer
**Territory:** `scripts/run_l2_lifecycle_*.sh`
**Tasks:**
1. Remove the `[ci-vpc-outputs.json]` token from the usage strings of
`run_l2_lifecycle_test.sh` + `run_l2_lifecycle_destroy.sh`, OR add a
comment documenting the L2-uses-remote-state design + parity reason.
2. Run `pytest` + `run_ci.sh`.
### P4 — regression-gate-evidence-hardening (REQ-138)
**Persona:** backend-engineer
**Territory:** `core/regression_verify.py`, `.ciagent/CAPABILITY_INVENTORY.md`
**Binding decisions:** G-105 (gate must pass clean post-P4 before W2)
**Tasks:**
1. Add a `terraform validate` step to
`_check_lifecycle_module_terraform` (or document why it's too slow +
fall back to a `terraform fmt -check` syntax probe).
2. Tighten CAPABILITY_INVENTORY + docstrings to "offline proxy; live
apply/modify/destroy verified by the modules-lifecycle workflow run,
not by this gate."
3. **Run the full regression gate immediately after P4 lands** (G-105).
Gate must pass clean before W2 begins.
4. Run `pytest` + `run_ci.sh`.
### P5 — adapter-behavior-tests (REQ-139)
**Persona:** backend-engineer
**Territory:** `tests/test_adapter.py`
**Tasks:**
1. Add `test_adapter_dedup_merges_same_module` — two resources with the
same `module` collapse to one `module "<first_id>" { ... }` block with
merged inputs.
2. Add `test_adapter_remote_state_key_override` — `ACDL_REMOTE_STATE_KEY`
overrides the default `platform/terraform.tfstate` key in the emitted
`data terraform_remote_state` block.
3. Run `pytest` + `run_ci.sh`.
### P6 — alb-name-prefix-fix (REQ-140)
**Persona:** data-engineer
**Territory:** `modules/l1/alb/terraform/main.tf`
**Tasks:**
1. Change `name_prefix = "tg-ci-"` to `name_prefix = "${var.name}-"` so
the consumer's name prefixes the target group.
2. Run `terraform validate` in the alb module dir standalone.
3. Run `pytest` + `run_ci.sh`.
---
## Wave 2 — Security (P7–P12)
### P7 — swallowed-error-hardening (REQ-141)
**Persona:** backend-engineer
**Territory:** `core/local_emulators.py`, `core/lambda/contract_ingestor.py`,
`terraform/bootstrap/create_state_backend.py`, `core/output_publisher.py`,
`terraform/bootstrap/apply_iam_baseline.py`
**Tasks:**
1. `local_emulators.py:374` — narrow `except Exception: pass` to catch
`AttributeError`/`TypeError` (monkeypatch setup); log + re-raise if
patching fails (prevents network egress).
2. `contract_ingestor.py:157` — catch `urllib.error.URLError`/
`HTTPError` specifically; log the search failure; keep `existing = []`
only on `404`/network, re-raise on auth errors.
3. `create_state_backend.py:51` — catch `ClientError` with
`NoSuchBucket`/`404` error code; re-raise on permissions/network.
4. `output_publisher.py:100,168` — catch `ClientError`/`HTTPError`
specifically; log with context.
5. `apply_iam_baseline.py:78` — catch `NoSuchEntityException` on
old-version delete; re-raise on other errors.
6. Run `pytest` + `run_ci.sh`.
### P8 — account-id-externalization (REQ-142)
**Persona:** backend-engineer + data-engineer
**Territory:** `adapters/terraform/adapter.py`, `terraform/bootstrap/`,
`scripts/push_consumer_image.py`, terraform resource ARNs
**Binding decisions:** G-101 (grep excludes backend blocks), G-102
(fallback bound to live account ID + workflow env wiring)
**Tasks:**
1. `adapter.py:125,140` — read `ACDL_AWS_ACCOUNT_ID` env; build the
state-bucket name dynamically. **Fallback constant = `581513795199`**
(the live account ID, NOT a placeholder — G-102). Documented for
offline tests.
2. `apply_iam_baseline.py:33`, `create_state_backend.py:33,35` — read
from env (same fallback).
3. `push_consumer_image.py:32` — read from env.
4. Terraform: use `data.aws_caller_identity.current.account_id` for
**resource ARNs** in `spike_runner_policy.json` + resource names.
**Exclude terraform `backend "s3"` blocks** (`terraform/*/terraform.tf`,
`terraform/ci-vpc/main.tf`, `terraform/platform/main.tf`,
`terraform/microservice/terraform.tf`) — backend `bucket` args are
static-config-only, evaluated pre-init (G-101). Leave backend blocks
literal or move to `terraform init -backend-config` (separate change,
not in P8 scope).
5. **Lifecycle workflow env wiring (G-102):** the `modules-lifecycle.yml`
full-mode jobs must set `ACDL_AWS_ACCOUNT_ID` from
`aws sts get-caller-identity --query Account --output text` before
any `run_platform.sh`/lifecycle invocation. No full-mode run proceeds
with the env unset.
6. Run `pytest` + `run_ci.sh`; verify
`grep -rn "581513795199" adapters/ scripts/ terraform/bootstrap/ core/`
returns 0 hits (excluding tests + docs + terraform backend blocks).
### P9 — iam-policy-least-privilege (REQ-143)
**Persona:** data-engineer
**Territory:** `terraform/bootstrap/spike_runner_policy.json`,
`tests/test_iam_policy_baseline.py`, `modules/l1/*/terraform/main.tf`,
`modules/l2/*/composition.json`
**Binding decisions:** G-104 (verify acdl-* naming before merge)
**Tasks:**
1. Scope `iam:CreateRole` etc. (line 236) to
`arn:aws:iam::*:role/acdl-*`.
2. Scope KMS (line 218) to `arn:aws:kms::*:key/acdl-*` (or
`alias/acdl-*`).
3. CloudFront (line 117) + WAFv2 (line 129) remain `Resource: "*"` with
a documented global-ARN constraint (CloudFront ARNs are global;
cannot be account-scoped — G-104).
4. **Verify acdl-* naming (G-104):** grep/audit
`modules/l1/*/terraform/main.tf` + `modules/l2/*/composition.json`
for every IAM role + KMS key name created by the lifecycle pipeline.
If any non-`acdl-*` name is found, rename the resource or widen that
one statement (documented).
5. Add a regression test in `test_iam_policy_baseline.py` asserting no
new `Resource: "*"` on non-global actions.
6. Run `pytest` + `run_ci.sh`.
### P10 — contract-ingestor-identity-validation (REQ-144)
**Persona:** backend-engineer
**Territory:** `core/lambda/contract_ingestor.py`, `tests/test_contract_ingestor.py`
**Tasks:**
1. Add `contractId` format validation (regex, ≤64 chars).
2. Add `environment` enum validation (dev/qa/prod/dr).
3. Add `error` length cap (truncate `stackTrace` at a reasonable limit).
4. Document the ABAC reliance in the `_validate_caller_identity`
docstring + add a note to ARCHITECTURE.md (P19 will land it).
5. Add a spoofing-resistance test (caller submits a `consumerRepo` they
don't own → rejected if ABAC misconfigured; documented best-effort).
6. Run `pytest` + `run_ci.sh`.
### P11 — schema-input-validation-hardening (REQ-145)
**Persona:** backend-engineer
**Territory:** `schemas/contract.schema.json`, `schemas/environment.schema.json`,
`tests/test_environment_schema.py`, `tests/test_contract_schema.py`
**Tasks:**
1. Add `"additionalProperties": false` to both schemas' top-level
objects.
2. Add `maxItems`/`maxProperties` bounds to `infrastructure` map +
`monitored_endpoints` array.
3. Add `pattern` validation for `state_backend.bucket` (S3 naming
rules: lowercase, 3-63 chars, no underscores).
4. Add `pattern` validation for `runner_role_arn` (ARN format).
5. Add `pattern` validation for `vpc_cidr` (CIDR format).
6. Add tests asserting rejection of undocumented fields + malformed
values.
7. Run `pytest` + `run_ci.sh`.
### P12 — gitignore-credential-hygiene (REQ-146)
### P1 — docs-decks-prose (REQ-155, REQ-156, REQ-157)
**Persona:** lead-developer
**Territory:** `.gitignore`, `tests/test_no_secrets_tracked.py`
**Territory:** `README.md`, `docs/**`, `.ciagent/*.md`, deck
`.md`/`-marp.md`/`-talking-points.md`/`.html`,
`docs/presentations/assets/mmd/*.mmd` (+ PNG re-export), `pyproject.toml`,
`schemas/*.schema.json` `$id` (D-110), `docs/NOVA_MIGRATION.md` (NEW),
`.github/workflows/release.yml` title, `.gitea/workflows/release.yml`
(if present), `modules/STANDARDS.md`, `contracts/**` prose
**Tasks:**
1. Add credential-pattern catch-all to `.gitignore`:
`*.pem`, `*.key`, `*.p12`, `*.pfx`, `*.cer`, `*.crt`, `*.jks`.
2. Create `tests/test_no_secrets_tracked.py` — runs
`git ls-files | grep -E '\.(pem|key|p12|pfx|cer|crt|jks)$'` and
asserts 0 hits.
3. Run `pytest` + `run_ci.sh`.
1. **Prose rebrand (REQ-155).** Find/replace across all docs + .ciagent
markdown: `ACDL` → `Nova`, `Agentic Cloud Delivery Platform` → `Nova`
(full phrase). Preserve historical narrative (e.g. "formerly ACDL"
in any changelog-style section is acceptable; otherwise full swap).
Update `pyproject.toml` `name` → `nova`, `description` → Nova.
Update `release.yml` release-title prefix `ACDL ` → `Nova `.
Update illustrative URLs in docs: `github.com/acdl/...` →
`github.com/nova/...`, `git.cloudinit.dev/continuous-intelligence/acdl*`
→ `.../nova*` (prose only; config.json `release.gitea.repo` stays
`acdl` per D-105).
2. **Schema $id rebrand (D-110, REQ-155).** Update `$id` in all
`schemas/*.schema.json` + `schemas/tagging-standard.json`:
`https://acdl.cloudinit.dev/schemas/...` →
`https://nova.cloudinit.dev/schemas/...`. Update test fixtures that
assert the `$id` value.
3. **Deck + mermaid rebrand (REQ-156).** Edit both deck markdown
sources (`docs/presentations/how-the-platform-works.md`,
`the-developer-experience.md` + their `-marp.md` + `-talking-points.md`
variants): `ACDL` → `Nova` in slide content + mermaid cluster labels
(`["ACDL — infrastructure only"]` → `["Nova — infrastructure only"]`).
Edit the 5 `.mmd` sources (`docs/presentations/assets/mmd/*.mmd`):
`ACDL` → `Nova`. Re-export the PNG diagrams from the edited `.mmd`
sources so the committed PNGs match the new labels (use the deck
README's documented process: mmdc CLI or the render script).
4. **Nova tagline insertion (REQ-157).** Add the tagline "The New Dawn
of DevSecOps — security as a seamless enabler of fast deployments" to:
the README header (below the title), both deck title slides (as the
subtitle, replacing "Agentic Cloud Delivery Platform"), and
`docs/vision.md` (top of the Vision section). Retain the existing
"North Star" / "consumers declare intent" framing — do NOT remove
it (D-106).
5. **Consumer migration guide (REQ-155/160).** Create
`docs/NOVA_MIGRATION.md` announcing the 5 breaking changes coming in
P2–P4: (a) `.acdl/contract.yml` → `.nova/contract.yml` (P2); (b)
`ACDL_*` env vars → `NOVA_*` (P2, dual-read fallback); (c) SSM path
`/acdl/` → `/nova/` (P3); (d) AWS tag keys `acdl:*` → `nova:*` (P3);
(e) AWS resource names `acdl-*` → `nova-*` (P4, maintenance window).
Include the dual-read fallback window (P2–P4) + the cutoff (P5
removes fallback).
6. **HTML re-render (REQ-156).** Re-render both deck HTML files from
the updated `-marp.md` sources (self-contained, base64 images, S&P
theme unchanged per D-107). Commit the re-rendered HTML.
7. **Regress gate.** `bash scripts/run_regression.sh` — expect 16/16
Verified (fixtures referencing `ACDL`/`acdl` in paths are updated in
P2; P1 only touches prose/decks/schema-$id, so the gate should stay
green. If a test asserts an `ACDL` string in a doc it reads, update
the assertion to `Nova`).
---
## Wave 3 — Stub / Test / CI / Hygiene (P13–P17)
## Wave 2 — Code / Env Vars / Consumer Path (P2)
### P13 — kyverno-kube-version-resolution (REQ-147)
**Persona:** backend-engineer
**Territory:** `adapters/kyverno/kyverno_adapter.py`, `tests/test_kyverno_adapter.py`
**Binding decisions:** G-103 (removal+documentation path, NOT implementation)
### P2 — code-envvars-consumer-path (REQ-158, REQ-159, REQ-160)
**Persona:** backend-engineer (lead) + lead-developer (docs/runbook)
**Territory:** `core/env.py` (NEW), `core/*.py`, `scripts/*.py` +
`*.sh`, `adapters/**`, `tests/**`, `.gitea/workflows/**` +
`.github/workflows/**`, `.env` + `.env.secrets` (key rename),
`schemas/tagging-standard.json`,
`adapters/terraform/policy/custom_rules/acdl_tagging.py` →
`nova_tagging.py`
**Tasks:**
1. **Remove the `--kube-version` flag** from
`kyverno_adapter.py:11,115-116` (G-103 — implementing version-aware
policy selection would be a new feature, violating D-095).
2. Add a docstring documenting the deferral to the GitOps reconciler
roadmap (D-053): the Kyverno adapter is inactive for Terraform-only
stacks; `--kube-version` will be relevant when the GitOps reconciler
emits K8s manifests.
3. Update `test_kyverno_adapter.py` to remove the `--kube-version` test
cases + assert the flag is absent.
4. Run `pytest` + `run_ci.sh`.
### P14 — orphan-artifact-and-dead-config-cleanup (REQ-148)
**Persona:** lead-developer
**Territory:** `scripts/__pycache__/`, `pyproject.toml`, `.ciagent/config.json`
**Tasks:**
1. Delete the orphan
`scripts/__pycache__/verify_deploy_microservice.cpython-312.pyc`.
2. Fix `pyproject.toml` coverage source: `acdl_platform` → `core`.
3. Bump `pyproject.toml` version `1.3.0` → current (v1.14).
4. Remove dead JS allowlist entries from `config.json`
`bash_allowlist.allowed_commands` (npm/node/npx/pnpm/yarn/jest/eslint/
tsc/prettier — no package.json).
5. Run `pytest` + `run_ci.sh`.
### P15 — untested-scripts-coverage (REQ-149)
**Persona:** backend-engineer
**Territory:** `tests/` (new test files for 7 scripts)
**Tasks:**
1. `tests/test_seed_uptime_monitors.py` — mock the uptime-kuma API;
assert monitor creation from a JSON file.
2. `tests/test_push_consumer_image.py` — mock `subprocess.run` (docker
login/build/push) + boto3 ECR; assert the flow.
3. `tests/test_sync_to_gl.sh` (shell test) — dry-run mode; assert the
copy + push commands are constructed correctly.
4. `tests/test_post_stage_comment.sh` (shell test) — no-op when not in
a PR context; assert the `gh api` call structure when in PR.
5. `tests/test_rotate_spike_key.sh` (shell test) — mock `aws iam`;
assert deactivate/create/update-secret flow.
6. `tests/test_create_state_backend.py` — mock boto3 S3/DynamoDB;
assert idempotent creation.
7. `tests/test_create_iam_user.py` — mock boto3 IAM; assert idempotent
user/policy/key creation.
8. Run `pytest` + `run_ci.sh`.
### P16 — workflow-parity-and-script-flags (REQ-150)
**Persona:** backend-engineer
**Territory:** `.gitea/workflows/`, `scripts/rotate_spike_key.sh`,
`scripts/sync_to_gl.sh`
**Tasks:**
1. Either mirror the 4 GitHub-only workflows (patterns-plan,
platform-test, primitives-plan, release) to `.gitea/workflows/`, or
add a README documenting the Gitea limitation (Gitea runners don't
use release/primitives-plan/patterns-plan; release is GitHub-only by
design).
2. Add `set -euo pipefail` to `rotate_spike_key.sh` (currently only
`set -u`).
3. Add `set -euo pipefail` to `sync_to_gl.sh` (currently no `set`
flags).
4. Run `pytest` + `run_ci.sh`.
### P17 — config-and-persona-hygiene (REQ-151)
**Persona:** lead-developer
**Territory:** `.ciagent/config.json`, `.ciagent/PERSONAS.md`
**Tasks:**
1. Mark `frontend-engineer` persona `active: false` in `config.json`
`personas.personas[]` (PERSONAS.md:80 already says inactive).
2. Fix `branching_strategy: "phase"` — either change to `"flat"` or
document that the field is advisory + the project uses flat workflow
(committed directly to main per established convention).
3. Configure `ollama-cloud` backend: set `base_url` to the actual
endpoint OR add a comment documenting why it's intentionally unset
(the runtime uses the `glm-5.2` model via the opencode backend, not
the `llm_backends` config).
4. Run `pytest` + `run_ci.sh`.
1. **Dual-read env helper (D-108, REQ-159).** Create `core/env.py` with
`get_env(name, default=None)` that reads `NOVA_<name>` then falls
back to `ACDL_<name>`, returning `default` if neither. Add unit
tests in `tests/test_env_helper.py` covering: both set (NOVA wins),
only NOVA set, only ACDL set (fallback), neither set (default).
2. **Env var rename (REQ-159).** Migrate all 21 `ACDL_*` env var
references → `NOVA_*` across `core/*.py`, `scripts/*.py` + `*.sh`,
`adapters/**`, `tests/**`, `.gitea/workflows/**`,
`.github/workflows/**`. Use the `core/env.py` helper at Python call
sites (replace `os.environ.get("ACDL_X")` →
`env.get_env("X")`); for shell scripts, use `${NOVA_X:-$ACDL_X}`
dual-read inline. Rename keys in `.env` + `.env.secrets` (KEY names
only — VALUES/secret material stay). Leave a comment in `.env.secrets`
noting the legacy `ACDL_*` keys are the dual-read fallback source
until P5. **G-106 binding:** the `.env.secrets` direct-read paths
(`scripts/run_platform.sh:288-289` `export AWS_ACCESS_KEY_ID="$ACDL_AWS_ACCESS_KEY_ID"`
+ `core/regression_verify.py:309-312` `if k == "ACDL_AWS_ACCESS_KEY_ID"`)
bypass the helper and MUST be updated to dual-read `NOVA_*` first,
`ACDL_*` fallback (shell: `${NOVA_AWS_ACCESS_KEY_ID:-$ACDL_AWS_ACCESS_KEY_ID}`;
Python: match `k == "NOVA_AWS_ACCESS_KEY_ID" or k == "ACDL_AWS_ACCESS_KEY_ID"`)
— otherwise AWS creds vanish mid-rename and CAP-013/014/015 fail.
3. **Gitea secrets rotation + workflow refs (G-108 binding, REQ-159).**
Use the Gitea API (`scripts/rotate_spike_key.sh` pattern or a new
`scripts/rename_gitea_secrets.py`) to create `NOVA_*` secrets
mirroring the `ACDL_*` values (idempotent + retry-on-failure), then
(after P5) delete the old `ACDL_*` secrets. For P2, just create the
`NOVA_*` aliases; deletion is P5. **G-108 binding:** when `NOVA_*`
secrets are created, the CI workflow `secrets:` references
(`.gitea/workflows/deploy.yml:105,107,108,148`,
`.gitea/workflows/modules-lifecycle.yml:63,64,103,104,111,112,117,118,123,124,161,162,169,170`,
`.github/workflows/*` mirrored) MUST be updated from `secrets.ACDL_*`
→ `secrets.NOVA_*` in the SAME phase, with graceful degrade + the
`acdl-deploy-` role name in deploy.yml:105 → `nova-deploy-` (P4
renames the IAM role). Until both secrets + refs are updated, CI
breaks — this is a hard gate, not a silent skip.
4. **Checkov rule rename (D-109 warn mode, REQ-158).** Rename
`adapters/terraform/policy/custom_rules/acdl_tagging.py` →
`nova_tagging.py`. Update the Checkov registration in
`schemas/tagging-standard.json` (line 5 + the `description`) and the
adapter config (`adapters/terraform/policy/checkov_adapter.py`).
The rule enforces `nova:*` tag keys BUT in **warn mode** for P2
(existing resources still carry `acdl:*` until P3) — log a warning,
don't fail the check. Update `ACDL_TAG_NAMING` → `NOVA_TAG_NAMING`.
5. **Consumer path rename (REQ-160).** Rename the consumer on-disk
contract path `.acdl/contract.yml` → `.nova/contract.yml` across:
`core/contract_resolver.py` (any default path), the deploy workflow
`default:` field (`.gitea/workflows/deploy.yml` +
`.github/workflows/deploy.yml` line 54), `schemas/contract.schema.json`
description, `tests/test_pipeline_contract.py:313` assertion, and
consumer docs (`docs/consumer-guide.md`, `docs/modules/index.md`).
Also `.acdl/static-assets.*.yml` → `.nova/...` + `.acdl/contract.yaml`
→ `.nova/contract.yaml`.
6. **Test fixture update (binding).** Update all test fixtures in
`tests/**` that reference `ACDL`/`acdl` (env var names, paths, table
names, tag keys) to the new `NOVA`/`nova` values — EXCEPT fixtures
that assert the dual-read fallback behavior (those keep `ACDL_*` as
the fallback source). `pytest` must pass.
7. **Regress gate.** `bash scripts/run_regression.sh` — 16/16 Verified.
---
## Wave 4 — Standards / Docs / VPC (P18–P20)
## Wave 3 — SSM Path + Tag Keys (P3)
### P18 — module-standards-consistency (REQ-152)
**Persona:** data-engineer
**Territory:** `modules/STANDARDS.md`, `modules/l1/{ecr,ecs-cluster,rds}/terraform/`
### P3 — ssm-tagkeys (REQ-161, REQ-162)
**Persona:** data-engineer (lead) + backend-engineer (readers)
**Territory:** `core/output_publisher.py`, `core/contract_resolver.py`,
`scripts/migrate_ssm_paths.py` (NEW), `terraform/**` (tag keys),
`adapters/terraform/policy/custom_rules/nova_tagging.py` (hard mode),
ABAC session-policy terraform
**Tasks:**
1. Either add `locals.tf` to `ecr`, `ecs-cluster`, `rds` (extract
inlined locals from `main.tf`), OR reconcile STANDARDS §9.4 to
explicitly allow inlining for trivial single-resource modules.
2. Remove the stale `TYPE_MAP` reference in STANDARDS §8 (deleted in
the v1.11 stateless rewrite).
3. Run `pytest` + `run_ci.sh`.
### P19 — documentation-sync-v1.14 (REQ-153)
**Persona:** lead-developer
**Territory:** `.ciagent/ARCHITECTURE.md`, `docs/`, `README.md`,
`.ciagent/COST.md`, `.ciagent/GRILL.md`, `.ciagent/IAM_POLICY.md`,
`docs/presentations/`
**Tasks:**
1. ARCHITECTURE.md: add v1.11 addendum (stateless adapter, platform VPC,
ACDL_LIFECYCLE_MODE), v1.12 addendum (CAP-013 fix, plan-only
default), v1.13 addendum (config.json schema migration, badge
cleanup, platform-architecture diagram), v1.14 addendum (all 20
phases). Record D-083 deferral explicitly.
2. Bump stale `@v1.6`–`@v1.9` → `@v1.13` across `README.md:225`,
`docs/consumer-guide.md` (12 sites), `docs/architecture.md:233`,
`docs/pipeline/versioning.md:29`, `docs/pipeline/index.md:42`.
3. Sync decks to v1.13.2 reality (version refs, capability claims).
4. Update COST.md window to v1.11–v1.14 (lifecycle pipeline live-runs +
teardown).
5. Resolve G-005/G-008 in GRILL.md (CAP-017..022 now Verified via
lifecycle pipeline; COST.md now exists + covers v1.11+).
6. Update IAM_POLICY.md for v1.12/v1.13/v1.14 (plan-only default,
config.json schema, v1.14 IAM scoping from P9).
7. Run `pytest` + `run_ci.sh`; verify
`grep -rn "@v1\.[6-9]" docs/ README.md` returns 0 hits.
### P20 — platform-vpc-parameterization (REQ-154)
**Persona:** data-engineer
**Territory:** `terraform/platform/main.tf`
**Tasks:**
1. Add a `vpc_cidr` variable (default `10.0.0.0/16`); replace the
hardcoded `cidr_block`.
2. Replace `count = 2` subnets with
`count = length(data.aws_availability_zones.available.names)`.
3. Add a `data "aws_availability_zones" "available" {}` block.
4. Document the `0.0.0.0/0` ingress on port 80 (ALB-fronted, acceptable
for a public-facing service; add a comment).
5. Run `terraform validate` + `pytest` + `run_ci.sh`.
1. **SSM path migration (REQ-161).** Update `core/output_publisher.py`:
the SSM parameter path prefix `/acdl/{env}/{contractId}/{output}` →
`/nova/{env}/{contractId}/{output}`. Update `core/contract_resolver.py`
SSM reads. Update consumer docs. Create
`scripts/migrate_ssm_paths.py` that: (a) lists `/acdl/...`
parameters, (b) copies each to `/nova/...` (same value/type), (c)
verifies the copy, (d) deletes the old `/acdl/...` parameters. The
script is idempotent + dry-run by default (`--apply` to execute).
2. **Tag keys: parallel-tag (REQ-162).** Update terraform tagging
(`terraform/platform/main.tf`, `terraform/microservice/main.tf`,
`terraform/ci-vpc/main.tf`, `modules/l1/*/terraform/main.tf`,
`modules/l2/*/composition.json` tag defaults) to emit **both**
`nova:*` and `acdl:*` tag keys during P3 (parallel-tag period). The
`acdl:cost-center` default `acdl-default` → `nova-default` for the
`nova:cost-center` key (keep `acdl-default` on the `acdl:cost-center`
key during the parallel period).
3. **Tag keys: ABAC policy swap (REQ-162).** Update the ABAC session
policies (the deploy role's inline policy in
`terraform/platform/main.tf` + `terraform/bootstrap/**`) to match
`nova:*` tags (the `StringEquals`/`Resource` tag conditions reference
`nova:owner`/`nova:environment`/etc.). Keep the `acdl:*` match as a
secondary condition during the parallel period so neither old nor
new consumers break.
4. **Checkov rule: hard mode (D-109, REQ-162).** Update
`nova_tagging.py` from warn → hard mode: enforce `nova:*` tag keys
(hard fail on missing `nova:*` or presence of `acdl:*`-only tags).
Update `schemas/tagging-standard.json` tag keys → `nova:*`.
5. **Tag keys: remove old (REQ-162).** Once the parallel-tag period is
verified (terraform validate passes; the ABAC policy matches
`nova:*`), remove the `acdl:*` tag emissions from terraform. (Live
removal of `acdl:*` tags from existing AWS resources is a
documentation/runbook step — the terraform `null_resource` or a
script `scripts/untag_acdl_keys.py` can do it with live AWS access;
without live access, this is documented in the P4 runbook as a
runtime step.)
6. **Test fixture + regress gate.** Update test fixtures asserting
`acdl:*` tag keys → `nova:*`. `pytest` passes;
`bash scripts/run_regression.sh` — 16/16 Verified.
---
## Final Phase — P21 (review + audit + ship)
## Wave 4 — AWS Resource Name Migration (P4)
**Persona:** lead-developer (review coordination) + ci-code-reviewer +
ci-debugger (audit)
### P4 — aws-resource-migration (REQ-163)
**Persona:** data-engineer (lead) + lead-developer (runbook)
**Territory:** `terraform/platform/main.tf`,
`terraform/microservice/main.tf`, `terraform/ci-vpc/main.tf`,
`terraform/bootstrap/**`, `modules/l1/alb/instance.json`,
`scripts/migrate_dynamodb_data.py` (NEW),
`docs/NOVA_AWS_MIGRATION.md` (NEW runbook),
`core/lambda/contract_ingestor.py` (default table names, D-111)
**Tasks:**
1. Multi-persona code review across all v1.14 phases (P1–P20). Auto-apply
P0 fixes; flag P1+ for post-hoc review. If P1+ found, fix in-phase.
2. Audit: reconstruction test (git log vs `.ciagent/` files), file
discipline, branch hygiene, commit discipline. Fix critical issues
in-phase.
3. Complete: update REQUIREMENTS.md (REQ-135..154 → complete),
ROADMAP.md (v1.14 complete), PROJECT.md.
4. Tag `v1.13.24` (IS the milestone release). Merge
`milestone/v1.14-refinement` → `main`. Create Gitea release with full
milestone summary.
1. **Runbook (REQ-163).** Create `docs/NOVA_AWS_MIGRATION.md` — the
maintenance-window + rollback runbook. Documents each resource rename,
the migration command, the verification step, and the rollback
procedure. Orders the migration: KMS alias (cheap) → SNS/SG (recreate)
→ Lambda (recreate) → DynamoDB (scan+copy) → ECR (re-push) → IAM
(re-bootstrap) → state bucket (`-migrate-state`) → ALB (recreate,
brief downtime, last).
2. **Terraform resource names (REQ-163).** Rename all `acdl-*` resource
names/labels → `nova-*` in `terraform/platform/main.tf`,
`terraform/microservice/main.tf`, `terraform/ci-vpc/main.tf`,
`terraform/bootstrap/**`, `modules/l1/alb/instance.json`:
- DynamoDB: `acdl-contracts` → `nova-contracts`,
`acdl-change-requests` → `nova-change-requests`
- Secrets Manager: `acdl/github-token` → `nova/github-token`
- Lambda: `acdl-contract-ingestor` (role/policy/function) →
`nova-contract-ingestor`
- SNS: `acdl-sod-halt` → `nova-sod-halt`
- SG: `acdl-ecs-sg` → `nova-ecs-sg`
- KMS: `alias/acdl-platform` → `alias/nova-platform`
- ECS: `acdl-microservice` (cluster/service/task/role) →
`nova-microservice`
- ECR: `acdl-microservice` → `nova-microservice`
- IAM: `acdl-spike-runner` (+policy) → `nova-spike-runner`
- S3 state bucket: `acdl-tfstate-581513795199-us-east-1` →
`nova-tfstate-581513795199-us-east-1`
- ALB: `acdl-alb` → `nova-alb`
3. **Lambda default table names (D-111, REQ-163).** Update
`core/lambda/contract_ingestor.py` default env-var values:
`CONTRACTS_TABLE` default `acdl-contracts` → `nova-contracts`,
`CHANGE_REQUESTS_TABLE` `acdl-change-requests` →
`nova-change-requests`, `GITHUB_TOKEN_SECRET_ID` `acdl/github-token`
→ `nova/github-token`, `PLATFORM_REPO` `acdl/acdl` → `nova/acdl`
(prose consistency; real repo unchanged).
4. **State bucket migration (REQ-63).** Update the terraform backend
config (`terraform/{platform,microservice,ci-vpc}/terraform.tf` +
`bootstrap/create_state_backend.py` + `bootstrap/.bootstrap_state.json`)
to the new `nova-tfstate-...` bucket. Document the
`terraform init -migrate-state` command in the runbook (back up the
state JSON first).
5. **DynamoDB data-migration script (REQ-163).** Create
`scripts/migrate_dynamodb_data.py` — scan+copy all items from
`acdl-contracts` → `nova-contracts` + `acdl-change-requests` →
`nova-change-requests`. Verify row counts match. Keep old tables
until verified (deletion is a manual post-verification step,
documented in the runbook).
6. **terraform validate + regress gate.** `terraform validate` passes
for platform/microservice/ci-vpc. `grep -rn "acdl-" terraform/`
returns 0 hits. `pytest` passes; `bash scripts/run_regression.sh` —
16/16 Verified.
---
## Wave 5 — Final Review + Ship (P5)
### P5 — final-review-ship (REQ-164)
**Persona:** lead-developer (lead) + all active (review)
**Territory:** `.ciagent/**`, `core/env.py` (remove fallback),
`nova_tagging.py` (hard-fail `acdl:*`), review + audit
**Tasks:**
1. **Remove dual-read fallback (REQ-164).** Update `core/env.py`
`get_env()` to read `NOVA_*` only (remove the `ACDL_*` fallback).
Update shell scripts to `${NOVA_X}` only (remove `:-$ACDL_X`).
Update `nova_tagging.py` to hard-fail on any `acdl:*` tag key (no
warn). Delete the `ACDL_*` secrets from Gitea (the `NOVA_*` aliases
created in P2 are now the only source). Remove the legacy comment
from `.env.secrets`.
2. **Multi-persona review.** Run `ciagent-review` across all v1.15
phases (P1–P4 changes). Auto-apply P0 fixes; flag P1+ for post-hoc.
If P1+ found, fix in this phase.
3. **Audit.** Run `ciagent-audit` — reconstruction test (git log matches
`.ciagent/` files), file discipline, branch hygiene, commit
discipline. If critical issues, fix in this phase.
4. **Finalize consumer migration guide (REQ-164).** Update
`docs/NOVA_MIGRATION.md` to mark the migration complete (cutoff
passed; `ACDL_*` fallback removed).
5. **Complete milestone.** Update `REQUIREMENTS.md` (REQ-155..164 →
complete), `ROADMAP.md` (v1.15 complete), `PROJECT.md`. Tag
`v1.14.5` (IS the milestone release). Merge `milestone/v1.15-nova`
→ `main`. Create Gitea release with full milestone summary.
---
## Success Criteria (milestone gate)
1. All 20 REQ-135..REQ-154 marked complete in REQUIREMENTS.md.
2. Review: 0 new P0; all P1-1..P1-5 + P2-1..P2-4 resolved.
1. All 10 REQ-155..REQ-164 marked complete in REQUIREMENTS.md.
2. Review: 0 new P0; all P1+ flagged or auto-fixed.
3. Audit: clean; reconstruction test passes.
4. Regression gate (D-091) clean against the v1.14 state.
5. `pytest` passes; `run_ci.sh` exits 0; `run_platform.sh --check-only`
exits 0.
6. Tag `v1.13.24` created; milestone merged to main.
4. Regression gate (D-091) 16/16 Verified throughout + at milestone
complete.
5. `grep -rni "ACDL\|Agentic Cloud Delivery" README.md docs/ .ciagent/*.md`
returns 0 hits (except explicit "formerly ACDL" historical notes).
6. `grep -rn "ACDL_" core/ scripts/ adapters/ tests/ .gitea/ .github/`
returns 0 hits (except the removed-fallback test in P5 that asserts
the fallback is gone).
7. `grep -rn "acdl-" terraform/` returns 0 hits.
8. `pytest` passes; `run_ci.sh` exits 0; `terraform validate` passes
for platform/microservice/ci-vpc.
9. Tag `v1.15.4` created (IS the milestone release, G-104); milestone
merged to main.
.ciagent/PROJECT.md
+78 -1
View File
@@ -1,5 +1,14 @@
# ACDL — Agentic Cloud Delivery Platform
> **Rebrand in progress (milestone v1.15 — Nova).** The project is
> rebranding from **ACDL** / "Agentic Cloud Delivery Platform" →
> **Nova** / "The New Dawn of DevSecOps — security as a seamless enabler
> of fast deployments." The new tagline is added alongside the existing
> "North Star" / "consumers declare intent" framing. See
> `.ciagent/REQUIREMENTS.md` §v1.15 and `.ciagent/ROADMAP.md` §v1.15.
> The full prose/code/infra rebrand lands in execution phases P1–P4;
> this header is updated in P1.
## Vision / Core Value
Consumers declare intent; the platform delivers safe production
@@ -911,4 +920,72 @@ D-095+ to continue from v1.10's D-094):
| D-098 | Wave ordering: W1 (P1–P6 bug fixes), W2 (P7–P12 security), W3 (P13–P17 stub/test/CI/hygiene), W4 (P18–P20 standards/docs/VPC). | Prerequisite chains: P2 depends on P1 (composition needs correct dedup); P9 depends on P8 (IAM ARNs reference externalized account ID); P15 depends on P7 (script tests benefit from hardened errors); P17 depends on P14 (both touch config.json); P19 lands last (reflects all prior phases). | 4 sequential waves; phases within a wave are independent (parallelizable when parallelization.enabled=true). |
| D-099 | `--ideate` flag: run the IDEATE stage between RESEARCH and PLAN (per ideate.md:218). The ideation tiers mine the 50 `partial:` + 16 `lessons:` + 3 `escalation:` + 16 `decisions:` git-native signals to validate/enrich the 20-phase scope. | User invoked with `--ideate`. The v1.14 scope is already user-directed (20 phases defined), so IDEATE acts as validation + enrichment, not scope discovery. Accepted ideas become IDEATE-NN IDs appended to REQUIREMENTS.md. | IDEATE stage runs; interactive validation gate (accept/skip/modify). |
| D-100 | Accept all 20 ideation findings as the v1.14 requirement set (REQ-135..REQ-154). | User accepted all 20 at the interactive validation gate. Mechanical + backend-enriched tiers confirmed the user-directed scope. | 20 REQs locked; PLAN.md formalizes the task decomposition. |
| D-101 | E-001 (P8 state-bucket continuity residual risk) auto-resolved at full autonomy: accept the residual risk. G-102's binding mitigation (fallback bound to live account ID + workflow env wiring) is the control. The lifecycle pipeline defaults to plan-only (REQ-134) — full-mode runs are workflow_dispatch only, reducing the accident surface. | Grill escalation E-001 (confidence 0.55) re-exposes the v1.11 4-VPC root cause. At full autonomy, auto-decide with assumption logging. The residual risk (misconfigured env at live-run time) is runtime-dependent, not plan-resolvable. If the user prefers zero residual risk, direct that P8 exclude the state-bucket name from externalization entirely. | E-001 resolved; G-102 binding decision enforced in PLAN.md P8. |
| D-101 | E-001 (P8 state-bucket continuity residual risk) auto-resolved at full autonomy: accept the residual risk. G-102's binding mitigation (fallback bound to live account ID + workflow env wiring) is the control. The lifecycle pipeline defaults to plan-only (REQ-134) — full-mode runs are workflow_dispatch only, reducing the accident surface. | Grill escalation E-001 (confidence 0.55) re-exposes the v1.11 4-VPC root cause. At full autonomy, auto-decide with assumption logging. The residual risk (misconfigured env at live-run time) is runtime-dependent, not plan-resolvable. If the user prefers zero residual risk, direct that P8 exclude the state-bucket name from externalization entirely. | E-001 resolved; G-102 binding decision enforced in PLAN.md P8. |
---
## Milestone v1.15 — Nova (Rebrand)
**Active milestone.** A full rebrand from ACDL → Nova across docs,
decks, code, configs, CI, env var prefixes, the consumer contract path,
SSM parameter paths, AWS tag keys, and AWS resource names — with a
staged infrastructure migration to avoid breakage.
**Milestone type:** Major (breaking — consumer-facing path, env var
prefixes, SSM path, AWS tag keys, and AWS resource names all change).
Tags run on the v1.15.x minor line: `v1.15.0` (P0) → `v1.15.4` (P5
final = milestone release). (G-104 binding: Major milestones tag on
their own minor line, not the previous minor's patch line.)
**In scope (v1.15):**
- Prose/decks/mermaid/pyproject/release-title rebrand (P1).
- Code identifiers, env var prefixes (`ACDL_*`→`NOVA_*` dual-read),
consumer path (`.acdl/`→`.nova/`) (P2).
- SSM path (`/acdl/`→`/nova/`) + AWS tag keys (`acdl:*`→`nova:*` ABAC)
(P3).
- AWS resource names (`acdl-*`→`nova-*`) with migration (P4).
- Final review + audit + remove dual-read fallback + milestone ship (P5).
**Out of scope (v1.15):**
- Renaming the real Gitea org/repo or GitHub org `acdl` (config stays
`acdl`; doc URLs updated to `nova` for prose only).
- Renaming the S&P Global Energy visual theme (`sp-theme.json`) —
client branding.
- Past Gitea release titles — only future releases use `Nova vX.Y.Z`.
- Git branch/tag naming — no brand name present.
**Milestone type:** Major (breaking). **Ship tag:** final phase patch
on the v1.15.x minor line IS the release (`v1.15.4`).
## Milestone v1.15 Phases
| Phase | Name | Goal |
|-------|------|------|
| 0 | pre-execution | SPECIFY → CLARIFY → RESEARCH → IDEATE → PLAN → GRILL. Establish v1.15-Nova milestone shell; ideation finds the 10 Nova requirements (REQ-155..164); plan decomposes into 4 execution phases. |
| 1 | docs-decks-prose | Rebrand all prose/decks/mermaid/pyproject/release-titles ACDL→Nova; add Nova tagline; ship consumer migration guide. |
| 2 | code-envvars-consumer-path | Rename acdl_tagging.py→nova_tagging.py; ACDL_*→NOVA_* dual-read; .acdl/→.nova/ contract path. |
| 3 | ssm-tagkeys | SSM /acdl/→/nova/ + AWS tag keys acdl:*→nova:* with parallel-tag ABAC migration. |
| 4 | aws-resource-migration | Rename all acdl-* AWS resources → nova-* with staged migration + runbook. |
| 5 | final-review-ship | Multi-persona review + audit + remove dual-read fallback + milestone ship (merge to main, tag final patch = release). |
## Key Decisions (v1.15)
Resolved at the CLARIFY stage (full autonomy — all within locked
constraints or user-directed scope). New v1.15 decisions (numbered
D-102+ to continue from v1.14's D-101). The high-judgment scope
decisions (D-102..D-107) were locked in by the user during the planning
conversation before execution; D-108..D-112 resolved at CLARIFY.
| ID | Decision | Rationale | Outcome |
|----|----------|-----------|---------|
| D-102 | AWS resource names: full rename with migration. | User chose "Full rename with migration." All `acdl-*` AWS resources → `nova-*` including state bucket migration, DynamoDB data migration, IAM re-bootstrap, ECR re-push. Accepts downtime + multi-phase migration. | P4 implements the staged migration + rollback runbook. |
| D-103 | Env var prefixes: full rename to `NOVA_*`. | User chose "Full rename to `NOVA_*`." All 21 `ACDL_*` prefixes → `NOVA_*` including `.env.secrets` (key names only, values stay) + Gitea secrets. | P2 renames + implements dual-read fallback; P5 removes fallback. |
| D-104 | Tag keys + SSM path + consumer path: full rename all three. | User chose "Full rename all three." AWS tag keys `acdl:*`→`nova:*` (ABAC re-scope), SSM path `/acdl/`→`/nova/` (param migration), consumer path `.acdl/`→`.nova/`. | P2 (consumer path) + P3 (SSM + tag keys) implement. |
| D-105 | External URLs: illustrative — update them. | User chose "URLs are illustrative — update them." Doc URLs (`github.com/acdl/...`, `git.cloudinit.dev/.../acdl*`) → `nova` for prose consistency. Real Gitea repo name (`release.gitea.repo`) stays `acdl`. | P1 updates doc URLs; config.json unchanged. |
| D-106 | Nova tagline: add alongside existing North Star. | User chose "Add Nova tagline alongside existing North Star." Tagline "The New Dawn of DevSecOps — security as a seamless enabler of fast deployments" added to README header, deck title slides, `docs/vision.md`. Existing "consumers declare intent" framing retained. | P1 adds tagline; no prose removed. |
| D-107 | S&P visual theme: leave untouched. | User chose "Leave S&P theme untouched." `sp-theme.json` (#D6002A red, Akkurat Pro) is client branding, not the Nova product brand. Only product-brand text (ACDL→Nova) changes in decks. | P1 edits deck text only; theme/CSS unchanged. |
| D-108 | Dual-read fallback centralized in a new `core/env.py` helper. | No centralized env loader exists today (env vars read via scattered `os.environ.get("ACDL_*")`). A new `core/env.py` `get_env(name)` helper reads `NOVA_X` then falls back to `ACDL_X`, returning `None` if neither. All call sites migrate to the helper in P2; P5 removes the fallback. | P2 creates `core/env.py` + migrates call sites; P5 removes fallback. |
| D-109 | Checkov custom rule `nova_tagging.py` warns during P2, hard-fails from P3. | During P2 (before tag-key migration), existing resources still carry `acdl:*` tags — a hard fail would break the regression gate. P2 rule warns on `acdl:*`; P3 (after parallel-tag + ABAC swap) hard-fails on `acdl:*` and enforces `nova:*`. | P2: warn mode; P3: hard mode. |
| D-110 | Schema `$id` URLs (`https://acdl.cloudinit.dev/schemas/...`) → `https://nova.cloudinit.dev/schemas/...`. | These are illustrative schema identifiers (no real DNS resolution required for JSON-schema validation). Renamed for brand consistency in P1. Existing `$id` values in test fixtures updated. | P1 renames schema `$id` + fixture references. |
| D-111 | Lambda env-var defaults (`CONTRACTS_TABLE` default `"acdl-contracts"`, etc.) → `nova-contracts`. | `core/lambda/contract_ingestor.py` has hardcoded `acdl-*` default table names. These become `nova-*` in P4 (resource migration). P2 changes the env-var name (`ACDL_*`→`NOVA_*`); P4 changes the default values to `nova-*`. | P4 updates Lambda defaults. |
| D-112 | `nova` slug: no `project:` prefix on branches (single-project mode). | `config.json` has `projects[]` with one entry (slug `acdl`) but `git.branching_strategy` is `flat` and the established convention since v1.0 is flat branches (no `<slug>/` prefix). Nova rebrand does NOT change the branch prefix convention. Commit `---ci---` blocks use `project: acdl` (the config slug, unchanged). | Branches stay `milestone/v1.15-nova`, `phase/NN-*`; no `acdl/` or `nova/` prefix. |
.ciagent/REGRESSION_REPORT.json
+33 -33
View File
@@ -1,6 +1,6 @@
{
"run_id": "regr-1785329757",
"run_at_utc": "2026-07-29T12:55:57Z",
"run_id": "regr-1785375318",
"run_at_utc": "2026-07-30T01:35:18Z",
"milestone": "v1.10",
"phase": 52,
"summary": {
@@ -16,7 +16,7 @@
"status": "Verified",
"detail": "exit 0; 2 sample contracts validate",
"tier": "local",
"duration_ms": 252
"duration_ms": 230
},
{
"capability_id": "CAP-002",
@@ -24,7 +24,7 @@
"status": "Verified",
"detail": "exit 0; env schema validates",
"tier": "local",
"duration_ms": 196
"duration_ms": 204
},
{
"capability_id": "CAP-003",
@@ -32,7 +32,7 @@
"status": "Verified",
"detail": "exit 0; ",
"tier": "local",
"duration_ms": 258
"duration_ms": 247
},
{
"capability_id": "CAP-004",
@@ -40,7 +40,7 @@
"status": "Verified",
"detail": "exit 0; ",
"tier": "local",
"duration_ms": 264
"duration_ms": 241
},
{
"capability_id": "CAP-005",
@@ -48,7 +48,7 @@
"status": "Verified",
"detail": "exit 0; ",
"tier": "local",
"duration_ms": 314
"duration_ms": 326
},
{
"capability_id": "CAP-006",
@@ -56,7 +56,7 @@
"status": "Verified",
"detail": "exit 0; interpolation ok",
"tier": "local",
"duration_ms": 223
"duration_ms": 216
},
{
"capability_id": "CAP-007",
@@ -64,7 +64,7 @@
"status": "Verified",
"detail": "exit 0; confidence band=pass",
"tier": "local",
"duration_ms": 80
"duration_ms": 79
},
{
"capability_id": "CAP-008",
@@ -72,15 +72,15 @@
"status": "Verified",
"detail": "exit 0; outbox hash chain ok",
"tier": "local",
"duration_ms": 358
"duration_ms": 333
},
{
"capability_id": "CAP-009",
"name": "offline pytest suite passes",
"status": "Verified",
"detail": "exit 0; [ 98%]\ntests/test_wiz_adapter_real_client.py ......... [100%]\n\n====================== 462 passed, 2 deselected in 34.63s ======================",
"detail": "exit 0; [ 98%]\ntests/test_wiz_adapter_real_client.py ......... [100%]\n\n====================== 555 passed, 2 deselected in 51.11s ======================",
"tier": "local",
"duration_ms": 36065
"duration_ms": 52574
},
{
"capability_id": "CAP-010",
@@ -88,23 +88,23 @@
"status": "Verified",
"detail": "exit 0; resource(s))\n\n=== PLATFORM CHECK OK ===\ncontract -> resolver -> stack -> adapter -> structure validated (offline, no AWS)\ncheck-only: OK\n\n=== CI PIPELINE OK ===\n3 stages passed: lint, test, check-only",
"tier": "local",
"duration_ms": 40668
"duration_ms": 59608
},
{
"capability_id": "CAP-011",
"name": "headline E2E runs against the local emulating tier (microservice)",
"status": "Verified",
"detail": "exit 0; al-emulator\",\n \"desired_count\": 1,\n \"running_count\": 1\n },\n \"outbox_dir\": \"/tmp/acdl_local_e2e_416d0fmr/outbox\",\n \"outbox_events\": 2,\n \"outbox_chain_verified\": true,\n \"lambda_status\": 200\n}",
"detail": "exit 0; al-emulator\",\n \"desired_count\": 1,\n \"running_count\": 1\n },\n \"outbox_dir\": \"/tmp/acdl_local_e2e_0v1bpi48/outbox\",\n \"outbox_events\": 2,\n \"outbox_chain_verified\": true,\n \"lambda_status\": 200\n}",
"tier": "local",
"duration_ms": 583
"duration_ms": 1072
},
{
"capability_id": "CAP-012",
"name": "local E2E on the static-assets stack (no ECS)",
"status": "Verified",
"detail": "exit 0; acdl_local_e2e_ijhcj1z8/tf\",\n \"backend\": \"local\",\n \"ecs\": null,\n \"outbox_dir\": \"/tmp/acdl_local_e2e_ijhcj1z8/outbox\",\n \"outbox_events\": 2,\n \"outbox_chain_verified\": true,\n \"lambda_status\": 200\n}",
"detail": "exit 0; acdl_local_e2e_0cjcizgd/tf\",\n \"backend\": \"local\",\n \"ecs\": null,\n \"outbox_dir\": \"/tmp/acdl_local_e2e_0cjcizgd/outbox\",\n \"outbox_events\": 2,\n \"outbox_chain_verified\": true,\n \"lambda_status\": 200\n}",
"tier": "local",
"duration_ms": 489
"duration_ms": 490
},
{
"capability_id": "CAP-013",
@@ -112,7 +112,7 @@
"status": "Verified",
"detail": "terraform init+validate+plan OK (live AWS, microservice)",
"tier": "live-aws",
"duration_ms": 28811
"duration_ms": 28176
},
{
"capability_id": "CAP-014",
@@ -120,7 +120,7 @@
"status": "Verified",
"detail": "terraform init+validate+plan OK (live AWS, static-assets)",
"tier": "live-aws",
"duration_ms": 31772
"duration_ms": 31892
},
{
"capability_id": "CAP-015",
@@ -128,23 +128,23 @@
"status": "Verified",
"detail": "acdl-outbox exists, item_count=9",
"tier": "live-aws",
"duration_ms": 477
"duration_ms": 507
},
{
"capability_id": "CAP-016",
"name": "S3 state bucket exists + readable (live AWS)",
"status": "Verified",
"detail": "state bucket exists, keys=['platform/terraform.tfstate', 'spike/alb/dev/terraform.tfstate', 'spike/cdn/dev/terraform.tfstate', 'spike/ci-vpc/terraform.tfstate', 'spike/clus/dev/terraform.tfstate']",
"detail": "state bucket exists, keys=['platform/terraform.tfstate', 'spike/alb/dev/terraform.tfstate', 'spike/assets/dev/terraform.tfstate', 'spike/cdn/dev/terraform.tfstate', 'spike/ci-vpc/terraform.tfstate']",
"tier": "live-aws",
"duration_ms": 324
"duration_ms": 329
},
{
"capability_id": "CAP-017",
"name": "DynamoDB acdl-contracts table (lifecycle pipeline evidence)",
"status": "Verified",
"detail": "terraform files present + simple/complex contracts resolve",
"detail": "terraform files present + fmt -check passes + simple/complex contracts resolve",
"tier": "lifecycle-pipeline",
"duration_ms": 520
"duration_ms": 588
},
{
"capability_id": "CAP-018",
@@ -152,39 +152,39 @@
"status": "Verified",
"detail": "LocalLambdaStub instantiates (local tier evidence)",
"tier": "lifecycle-pipeline",
"duration_ms": 137
"duration_ms": 135
},
{
"capability_id": "CAP-019",
"name": "ECS cluster + service (L2 microservice lifecycle evidence)",
"status": "Verified",
"detail": "L2 composition resolves (simple + complex contracts)",
"detail": "L2 composition resolves (simple + complex contracts; offline proxy)",
"tier": "lifecycle-pipeline",
"duration_ms": 534
"duration_ms": 498
},
{
"capability_id": "CAP-020",
"name": "CloudFront + WAF (L2 static-assets lifecycle evidence)",
"status": "Verified",
"detail": "L2 composition resolves (simple + complex contracts)",
"detail": "L2 composition resolves (simple + complex contracts; offline proxy)",
"tier": "lifecycle-pipeline",
"duration_ms": 567
"duration_ms": 510
},
{
"capability_id": "CAP-021",
"name": "uptime-kuma (L1 uptime lifecycle evidence)",
"status": "Verified",
"detail": "terraform files present + simple/complex contracts resolve",
"detail": "terraform files present + fmt -check passes + simple/complex contracts resolve",
"tier": "lifecycle-pipeline",
"duration_ms": 606
"duration_ms": 562
},
{
"capability_id": "CAP-022",
"name": "OIDC role (L1 iam-role lifecycle evidence)",
"status": "Verified",
"detail": "terraform files present + simple/complex contracts resolve",
"detail": "terraform files present + fmt -check passes + simple/complex contracts resolve",
"tier": "lifecycle-pipeline",
"duration_ms": 529
"duration_ms": 554
}
]
}
.ciagent/REGRESSION_REPORT.md
+27 -27
View File
@@ -1,51 +1,51 @@
# Regression Report — v1.10 Phase 52
- **Run ID:** `regr-1785329757`
- **Run at (UTC):** 2026-07-29T12:55:57Z
- **Run ID:** `regr-1785375318`
- **Run at (UTC):** 2026-07-30T01:35:18Z
- **Summary:** {'Verified': 22, 'Decayed': 0, 'Broken': 0}
- **Passed (milestone gate):** True
| Capability | Name | Tier | Status | Duration (ms) | Detail |
|-----------|------|------|--------|--------------|--------|
| CAP-001 | contract.schema.json validates sample contracts | local | **Verified** | 252 | exit 0; 2 sample contracts validate |
| CAP-002 | environment.schema.json validates env files | local | **Verified** | 196 | exit 0; env schema validates |
| CAP-003 | contract_resolver resolves static-assets | local | **Verified** | 258 | exit 0; |
| CAP-004 | contract_resolver resolves microservice | local | **Verified** | 264 | exit 0; |
| CAP-005 | terraform adapter emits .tf files | local | **Verified** | 314 | exit 0; |
| CAP-006 | contract interpolation expands env/contract tokens | local | **Verified** | 223 | exit 0; interpolation ok |
| CAP-007 | confidence_signal.compute returns a band | local | **Verified** | 80 | exit 0; confidence band=pass |
| CAP-008 | outbox_writer builds a hash-chained item | local | **Verified** | 358 | exit 0; outbox hash chain ok |
| CAP-009 | offline pytest suite passes | local | **Verified** | 36065 | exit 0; [ 98%]
| CAP-001 | contract.schema.json validates sample contracts | local | **Verified** | 230 | exit 0; 2 sample contracts validate |
| CAP-002 | environment.schema.json validates env files | local | **Verified** | 204 | exit 0; env schema validates |
| CAP-003 | contract_resolver resolves static-assets | local | **Verified** | 247 | exit 0; |
| CAP-004 | contract_resolver resolves microservice | local | **Verified** | 241 | exit 0; |
| CAP-005 | terraform adapter emits .tf files | local | **Verified** | 326 | exit 0; |
| CAP-006 | contract interpolation expands env/contract tokens | local | **Verified** | 216 | exit 0; interpolation ok |
| CAP-007 | confidence_signal.compute returns a band | local | **Verified** | 79 | exit 0; confidence band=pass |
| CAP-008 | outbox_writer builds a hash-chained item | local | **Verified** | 333 | exit 0; outbox hash chain ok |
| CAP-009 | offline pytest suite passes | local | **Verified** | 52574 | exit 0; [ 98%]
tests/test_wiz_adapter_real_client.py ......... [100%]
====================== 462 passe |
| CAP-010 | run_ci.sh reproduces CI pipeline locally | local | **Verified** | 40668 | exit 0; resource(s))
====================== 555 passe |
| CAP-010 | run_ci.sh reproduces CI pipeline locally | local | **Verified** | 59608 | exit 0; resource(s))
=== PLATFORM CHECK OK ===
contract -> resolver -> stack -> adapter -> structure validated (offline, no AWS)
check-only: OK
=== CI PIPELIN |
| CAP-011 | headline E2E runs against the local emulating tier (microservice) | local | **Verified** | 583 | exit 0; al-emulator",
| CAP-011 | headline E2E runs against the local emulating tier (microservice) | local | **Verified** | 1072 | exit 0; al-emulator",
"desired_count": 1,
"running_count": 1
},
"outbox_dir": "/tmp/acdl_local_e2e_416d0fmr/outbox",
"outbox_dir": "/tmp/acdl_local_e2e_0v1bpi48/outbox",
"outbox_events": 2,
"outbox |
| CAP-012 | local E2E on the static-assets stack (no ECS) | local | **Verified** | 489 | exit 0; acdl_local_e2e_ijhcj1z8/tf",
| CAP-012 | local E2E on the static-assets stack (no ECS) | local | **Verified** | 490 | exit 0; acdl_local_e2e_0cjcizgd/tf",
"backend": "local",
"ecs": null,
"outbox_dir": "/tmp/acdl_local_e2e_ijhcj1z8/outbox",
"outbox_dir": "/tmp/acdl_local_e2e_0cjcizgd/outbox",
"outbox_events": 2,
"outbox |
| CAP-013 | terraform init+validate+plan live AWS (microservice) | live-aws | **Verified** | 28811 | terraform init+validate+plan OK (live AWS, microservice) |
| CAP-014 | terraform init+validate+plan live AWS (static-assets) | live-aws | **Verified** | 31772 | terraform init+validate+plan OK (live AWS, static-assets) |
| CAP-015 | DynamoDB outbox table exists (live AWS) | live-aws | **Verified** | 477 | acdl-outbox exists, item_count=9 |
| CAP-016 | S3 state bucket exists + readable (live AWS) | live-aws | **Verified** | 324 | state bucket exists, keys=['platform/terraform.tfstate', 'spike/alb/dev/terraform.tfstate', 'spike/cdn/dev/terraform.tfstate', 'spike/ci-vpc/terraform.tfstate', |
| CAP-017 | DynamoDB acdl-contracts table (lifecycle pipeline evidence) | lifecycle-pipeline | **Verified** | 520 | terraform files present + simple/complex contracts resolve |
| CAP-018 | Lambda contract-ingestor (local stub + lifecycle evidence) | lifecycle-pipeline | **Verified** | 137 | LocalLambdaStub instantiates (local tier evidence) |
| CAP-019 | ECS cluster + service (L2 microservice lifecycle evidence) | lifecycle-pipeline | **Verified** | 534 | L2 composition resolves (simple + complex contracts) |
| CAP-020 | CloudFront + WAF (L2 static-assets lifecycle evidence) | lifecycle-pipeline | **Verified** | 567 | L2 composition resolves (simple + complex contracts) |
| CAP-021 | uptime-kuma (L1 uptime lifecycle evidence) | lifecycle-pipeline | **Verified** | 606 | terraform files present + simple/complex contracts resolve |
| CAP-022 | OIDC role (L1 iam-role lifecycle evidence) | lifecycle-pipeline | **Verified** | 529 | terraform files present + simple/complex contracts resolve |
| CAP-013 | terraform init+validate+plan live AWS (microservice) | live-aws | **Verified** | 28176 | terraform init+validate+plan OK (live AWS, microservice) |
| CAP-014 | terraform init+validate+plan live AWS (static-assets) | live-aws | **Verified** | 31892 | terraform init+validate+plan OK (live AWS, static-assets) |
| CAP-015 | DynamoDB outbox table exists (live AWS) | live-aws | **Verified** | 507 | acdl-outbox exists, item_count=9 |
| CAP-016 | S3 state bucket exists + readable (live AWS) | live-aws | **Verified** | 329 | state bucket exists, keys=['platform/terraform.tfstate', 'spike/alb/dev/terraform.tfstate', 'spike/assets/dev/terraform.tfstate', 'spike/cdn/dev/terraform.tfsta |
| CAP-017 | DynamoDB acdl-contracts table (lifecycle pipeline evidence) | lifecycle-pipeline | **Verified** | 588 | terraform files present + fmt -check passes + simple/complex contracts resolve |
| CAP-018 | Lambda contract-ingestor (local stub + lifecycle evidence) | lifecycle-pipeline | **Verified** | 135 | LocalLambdaStub instantiates (local tier evidence) |
| CAP-019 | ECS cluster + service (L2 microservice lifecycle evidence) | lifecycle-pipeline | **Verified** | 498 | L2 composition resolves (simple + complex contracts; offline proxy) |
| CAP-020 | CloudFront + WAF (L2 static-assets lifecycle evidence) | lifecycle-pipeline | **Verified** | 510 | L2 composition resolves (simple + complex contracts; offline proxy) |
| CAP-021 | uptime-kuma (L1 uptime lifecycle evidence) | lifecycle-pipeline | **Verified** | 562 | terraform files present + fmt -check passes + simple/complex contracts resolve |
| CAP-022 | OIDC role (L1 iam-role lifecycle evidence) | lifecycle-pipeline | **Verified** | 554 | terraform files present + fmt -check passes + simple/complex contracts resolve |
.ciagent/REQUIREMENTS.md
+127
View File
@@ -713,3 +713,130 @@ in a 20-phase sweep.
- Per-phase regression hardening (G-007, unchanged).
- Boto3 post-deploy verification probes (deferred to a future QA
milestone).
---
## v1.15 — Nova (Rebrand)
**Milestone type:** Major (breaking — consumer-facing path, env var
prefixes, SSM path, AWS tag keys, and AWS resource names all change).
Per the branch-strategy precedent (breaking/feature milestones tag on
their OWN minor line), v1.15 tags run on the **v1.15.x minor line**:
`v1.15.0` (P0) → `v1.15.1..v1.15.4` (P1–P4) → `v1.15.4` (P5 final =
milestone release). (G-104 binding: the v1.14.x patch line is the NFR
convention; a Major milestone ships on its own minor.)
A full rebrand from **ACDL** / "Agentic Cloud Delivery Platform" →
**Nova** / "The New Dawn of DevSecOps — security as a seamless enabler
of fast deployments." The new tagline is added alongside the existing
"North Star" / "consumers declare intent" framing; the S&P Global Energy
visual theme (`sp-theme.json`) is a client brand and is **not** touched.
The rebrand applies across docs, decks, code, configs, CI, env vars,
consumer conventions, SSM paths, AWS tag keys, and AWS resource names —
with a staged infrastructure migration to avoid breakage.
Ideation source: `--ideate` flag (user-directed scope; the survey found
1,465 occurrences of `ACDL`/`acdl` across 205 files and zero existing
`nova` references — no collision risk). Accepted ideas become
IDEATE-01..IDEATE-10, mapped to REQ-155..REQ-164.
### Requirements
- **REQ-155** — (IDEATE-01) All prose, titles, headers, and comments
across `README.md`, `docs/**`, `.ciagent/*.md`, deck markdown sources,
`pyproject.toml` name/description, and `release.yml` release-title
prefix are rebranded `ACDL`/`Agentic Cloud Delivery Platform` → `Nova`.
Illustrative URLs in docs (`github.com/acdl/...`,
`git.cloudinit.dev/continuous-intelligence/acdl*`) are updated to
`nova` for prose consistency. Gitea release titles going forward read
`Nova vX.Y.Z` (past releases keep their names). (Phase P1)
- **REQ-156** — (IDEATE-02) All Marp deck markdown sources
(`docs/presentations/*-marp.md`, `*.md`, `*-talking-points.md`) and
mermaid source `.mmd` files are rebranded `ACDL` → `Nova`; the deck
title-slide subtitle becomes `Nova — The New Dawn of DevSecOps`. The
`.mmd` sources are edited and the rendered PNG diagrams are
re-exported so the committed PNGs match the new labels. The S&P visual
theme (`sp-theme.json`) is unchanged. HTML decks are re-rendered.
(Phase P1)
- **REQ-157** — (IDEATE-03) The Nova tagline ("The New Dawn of DevSecOps
— security as a seamless enabler of fast deployments") is added to the
README header, both deck title slides, and `docs/vision.md` —
alongside (not replacing) the existing "North Star" / "consumers
declare intent" framing. (Phase P1)
- **REQ-158** — (IDEATE-04) `adapters/terraform/policy/custom_rules/acdl_tagging.py`
is renamed `nova_tagging.py` with its Checkov custom-rule registration
updated (`schemas/tagging-standard.json` line 5 + adapter config). The
Checkov rule enforces `nova:*` tag keys. (Phase P2)
- **REQ-159** — (IDEATE-05) All 21 `ACDL_*` env var prefixes are renamed
to `NOVA_*` across `scripts/`, `core/`, `adapters/`, `tests/`,
workflows (`.gitea/`, `.github/`), `.env`, `.env.secrets` (key names
only — values/secret material stay), and consumer docs. A **dual-read
fallback** (`NOVA_X` preferred, fall back to `ACDL_X`) is implemented
in the config/env loader so deployments do not break during the
transition window; the fallback is removed in the final phase once all
consumers are migrated. Gitea repo secrets are rotated via API.
(Phase P2)
- **REQ-160** — (IDEATE-06) The consumer on-disk contract path
`.acdl/contract.yml` (and `.acdl/static-assets.*.yml`,
`.acdl/contract.yaml`) becomes `.nova/contract.yml` across the
contract resolver, deploy workflow checkout path, consumer docs, and
the contract schema description. A consumer migration guide is shipped
with P1 docs. (Phase P2)
- **REQ-161** — (IDEATE-07) The SSM parameter path prefix
`/acdl/{env}/{contractId}/{output}` becomes
`/nova/{env}/{contractId}/{output}` across `core/output_publisher`,
the contract resolver, and consumer docs. A migration script copies
existing `/acdl/...` parameters → `/nova/...`, readers are updated,
then old parameters are deleted. (Phase P3)
- **REQ-162** — (IDEATE-08) AWS tag keys `acdl:owner`,
`acdl:environment`, `acdl:contract`, `acdl:cost-center`, `acdl:ref`
become `nova:owner`, `nova:environment`, `nova:contract`,
`nova:cost-center`, `nova:ref` across terraform tagging, the Checkov
custom rule (`nova_tagging.py`), and ABAC session policies. A
**parallel-tag period** adds `nova:*` tags to all resources first,
updates the ABAC session policies to match `nova:*`, then removes the
`acdl:*` tags once consumers are verified. (Phase P3)
- **REQ-163** — (IDEATE-09) All `acdl-*` AWS resource names are renamed
to `nova-*` via terraform: KMS alias `alias/acdl-platform` →
`alias/nova-platform`, SNS `acdl-sod-halt` → `nova-sod-halt`, SG
`acdl-ecs-sg` → `nova-ecs-sg`, Lambda `acdl-contract-ingestor` →
`nova-contract-ingestor`, DynamoDB `acdl-contracts`/`acdl-change-requests`
→ `nova-contracts`/`nova-change-requests` (scan+copy data migration,
verify row counts, keep old tables until verified), ECR
`acdl-microservice` → `nova-microservice` (re-push images), IAM
user/policy `acdl-spike-runner` → `nova-spike-runner` (re-bootstrap
with new key), state bucket `acdl-tfstate-...` → `nova-tfstate-...`
(`terraform init -migrate-state` to new backend, state JSON backed up
first), ALB name prefix `acdl-alb` → `nova-alb` (recreate, brief
downtime). A maintenance window + rollback runbook is published with
the migration. (Phase P4)
- **REQ-164** — (IDEATE-10) The dual-read env var fallback
(`ACDL_*`→`NOVA_*`) and any `ACDL_*`-only references are removed once
all consumers are migrated; the consumer migration guide is finalized;
`nova_tagging.py` no longer accepts `acdl:*` tag keys. (Phase P5)
### v1.15 Traceability
| Requirement | Phase | Status |
|-------------|-------|--------|
| REQ-155 | P1 | complete |
| REQ-156 | P1 | complete |
| REQ-157 | P1 | complete |
| REQ-158 | P2 | complete |
| REQ-159 | P2 | complete |
| REQ-160 | P2 | complete |
| REQ-161 | P3 | complete |
| REQ-162 | P3 | complete |
| REQ-163 | P4 | complete |
| REQ-164 | P5 | complete |
### Out of Scope (v1.15)
- Renaming the real Gitea org/repo (`continuous-intelligence/acdl`) or
GitHub org `acdl` — config.json `release.gitea.repo` stays `acdl`;
URLs in docs are illustrative and updated to `nova` for prose only.
- Renaming the S&P Global Energy visual theme (`sp-theme.json`,
deck CSS) — that is client branding, not the Nova product brand.
- Past Gitea release titles — existing releases keep their `ACDL vX.Y.Z`
names; only future releases use `Nova vX.Y.Z`.
- Git branch/tag naming — branches use `milestone/v*` / `phase/*` and
tags use `v*` semver; no brand name present, no change needed.
.ciagent/RESEARCH.md
+153
View File
@@ -869,3 +869,156 @@ No custom personas needed for v1.14 (no new domains). Territory
enforcement = `warn` (config.json:167). The v1.14 work is concentrated
in `adapters/`, `core/`, `terraform/`, `scripts/`, `tests/`, `docs/`,
`.ciagent/` — all within existing persona territories.
---
## v1.15 Research Addendum — Nova Rebrand scope audit (2026-07-30)
### Survey method
A thorough, exhaustive codebase survey (via the explore subagent) plus
targeted `grep -rni` counts. The survey covered 346 tracked files,
reporting occurrence counts and the mechanical-vs-judgment split per
category. The full survey is recorded in the planning conversation
transcript; the binding conclusions are summarized here.
### Finding 1 — Brand string surface area
- **1,465** total `ACDL`/`acdl` occurrences across **205** files.
- **17** occurrences of the full "Agentic Cloud Delivery Platform"
phrase (all prominent titles/headers: README, docs/index, vision,
pyproject, decks, .ciagent/*.md).
- **0** existing references to "nova" (case-insensitive) — **no
collision risk**.
- User-facing (docs/, README, decks, contracts, schemas, module
READMEs): high-priority for rebrand.
- Internal (.ciagent/*.md, tests/, terraform/, scripts/, workflows):
mechanical but voluminous.
### Finding 2 — Code identifiers (judgment category)
- **Python package name**: `pyproject.toml` `name = "acdl"` (no `acdl/`
package dir exists — source lives in `core/`, `adapters/`; the name is
a metadata label). Mechanical rename.
- **Python file**: `adapters/terraform/policy/custom_rules/acdl_tagging.py`
(+ Checkov registration in `schemas/tagging-standard.json` line 5 +
adapter config). Rename file + update registration.
- **Env var prefixes**: 21 distinct `ACDL_*` prefixes (`ACDL_LIFECYCLE_MODE`
66×, `ACDL_AWS_ACCESS_KEY_ID` 40×, `ACDL_AWS_SECRET_ACCESS_KEY` 37×,
`ACDL_REMOTE_STATE_KEY` 22×, `ACDL_AWS_ACCOUNT_ID` 21×, `ACDL_TAG_NAMING`
20×, `ACDL_KMS_KEY_ID` 16×, `ACDL_BOOTSTRAP_AWS_*` 15× each,
`ACDL_SOD_HALT_TOPIC_ARN` 14×, `ACDL_LOCAL_TIER` 13×, etc.). No
centralized env loader exists today (scattered `os.environ.get`).
D-108: a new `core/env.py` `get_env()` helper centralizes the
dual-read fallback.
- **Workflow `name:`**: `.github/workflows/release.yml` line 11
`name: acdl-release` — mechanical.
### Finding 3 — AWS resource names (high-risk migration)
Terraform creates real AWS resources with `acdl-` prefixes. Renaming
forces destroy+recreate (downtime, data loss for DynamoDB/state bucket).
D-102: full rename with migration (user-directed).
| Resource | Type | Migration |
|----------|------|-----------|
| `acdl-contracts` / `acdl-change-requests` | DynamoDB | scan+copy data, verify row counts |
| `acdl/github-token` | Secrets Manager | recreate secret, repoint Lambda |
| `acdl-contract-ingestor` (role/policy/Lambda) | IAM+Lambda | recreate role/Lambda, update trigger |
| `acdl-sod-halt` | SNS | recreate topic, repoint publisher |
| `acdl-ecs-sg` | SG | recreate (brief ECS disruption) |
| `alias/acdl-platform` | KMS alias | repoint alias (cheap) |
| `acdl-microservice` (cluster/ECR/service/task/role) | ECS+ECR | re-push images, recreate service |
| `acdl-spike-runner` (user/policy) | IAM | re-bootstrap with new key |
| `acdl-tfstate-581513795199-us-east-1` | S3 state bucket | `terraform init -migrate-state`, back up state JSON |
| `acdl-alb` (name prefix) | ALB | recreate (brief downtime) |
### Finding 4 — Consumer/infra conventions (judgment category, D-104)
- **AWS tag keys** `acdl:owner|environment|contract|cost-center|ref`
(5 keys, ~109 tag assignments) — matched by ABAC session policies.
Parallel-tag period (add `nova:*`, swap policy, remove `acdl:*`).
- **SSM path** `/acdl/{env}/{contractId}/{output}` (67 refs) — deploy
outputs stored here. Migration script copies params, readers updated,
old deleted.
- **Consumer path** `.acdl/contract.yml` (23 refs) — consumer repos
depend on this. Renamed `.nova/contract.yml` + migration guide.
### Finding 5 — Docs & decks (mechanical)
- README.md (16), docs/index.md, docs/vision.md, docs/architecture.md,
docs/consumer-guide.md (35), docs/modules/index.md (28), all
.ciagent/*.md, modules/STANDARDS.md, schemas/README.md,
pipelines/README.md, adapters/README.md, terraform/*/README.md.
- Deck markdown + mermaid `.mmd` sources (5 files) + rendered HTML.
PNGs re-exported from edited `.mmd` sources.
- S&P visual theme (`sp-theme.json`, deck CSS) is **client branding**
— D-107: untouched. Only product-brand text (ACDL→Nova) changes.
- Schema `$id` URLs (`https://acdl.cloudinit.dev/schemas/...`) →
`https://nova.cloudinit.dev/schemas/...` (D-110: illustrative, no
DNS resolution needed for validation).
### Finding 6 — CI / pipeline / release
- Workflow files mirrored in `.gitea/workflows/` + `.github/workflows/`
(modules-lifecycle 31×, deploy 22×, ci 2×, release 3×).
- `release.yml` release title `ACDL vX.Y.Z` → `Nova vX.Y.Z` (forward
only; past releases keep names).
- Git branches/tags use `milestone/v*` / `phase/*` / `v*` — **no brand
name present**, no change needed (D-112: flat-branch convention
preserved).
- config.json `release.gitea.repo` stays `acdl` (D-105: real repo name
unchanged; doc URLs illustrative only).
### Finding 7 — External / URLs
- `github.com/acdl/...` (~20 refs in docs + module READMEs +
reusable-workflow `uses:` refs) — D-105: illustrative, updated to
`nova` for prose. Real GitHub org/repo rename is out of scope.
- `git.cloudinit.dev/continuous-intelligence/acdl*` (incl. sister
repos `acdl-contracts`, `acdl-evidence`) — updated in prose to `nova*`.
- README has **no badges** (no shields.io, no img src).
### Finding 8 — Nomenclature / tagline
- "DevSecOps", "New Dawn", "enabler" appear **nowhere** in the repo
today — clean insertion, no collisions to reconcile (D-106).
- Current tagline ("North Star" / "consumers declare intent") is
retained; Nova tagline added alongside.
- "bottleneck" (6 occurrences in deck talking points) — compatible
with the Nova "no bottleneck" messaging; left in place.
### Persona assessment (v1.15)
No new personas needed for v1.15 — the rebrand touches existing
territories (docs, code, terraform, CI, tests). The active roster:
**lead-developer** (docs/decks/.ciagent meta + verification + migration
runbooks), **backend-engineer** (core/env.py dual-read helper, contract
resolver path, Lambda, output_publisher, regression_verify),
**data-engineer** (terraform resource names/tagging, state bucket
migration, DynamoDB data migration, ECR re-push, schemas/tagging-standard).
The **frontend-engineer** remains deactivated (no UI; decks are
markdown = lead-developer territory). A **security-engineer** persona is
not activated — the ABAC session-policy + tag-key migration (REQ-162) is
data-engineer territory (terraform IAM) with lead-developer review.
Territory enforcement = `warn` (co-authoring expected at the
core/env.py + terraform boundary, and the contract-resolver +
deploy-workflow boundary).
### Assumptions logged
- A1 (confidence 0.9): No live AWS access is available during P0–P4
execution (the `acdl-spike-runner` IAM user's creds are in
`.env.secrets` but live apply/modify/destroy is gated by
`NOVA_LIFECYCLE_MODE` defaulting to plan-only). The terraform changes
are validated via `terraform validate`; live apply is exercised by the
modules-lifecycle workflow when explicitly set to full. This matches
the v1.11–v1.14 established pattern.
- A2 (confidence 0.85): `.env.secrets` contains live rotated AWS
credentials keyed by `ACDL_AWS_*`. P2 renames the KEYS only (values
stay). The runtime reads via the new `core/env.py` dual-read helper
(`NOVA_AWS_ACCESS_KEY_ID` preferred, `ACDL_AWS_ACCESS_KEY_ID`
fallback), so no re-rotation is needed until P5 removes the fallback.
- A3 (confidence 0.8): The Gitea release API (`POST .../releases`) is
reachable for `v1.14.x` tags (the v1.14 milestone shipped releases
through `v1.13.24` / release id 285). P0 ship targets `v1.14.0`.
.ciagent/ROADMAP.md
+198
View File
@@ -1432,3 +1432,201 @@ on the v1.13.x line: `v1.13.3` (P0) → `v1.13.4..v1.13.23` (P1–P20) →
- Tag `v1.13.24` created; milestone merged to main.
After Phase P21: milestone COMPLETE — `v1.13.24` IS the v1.14 release.
---
## v1.15 (complete — Nova Rebrand, tag `v1.15.4`)
A full rebrand from **ACDL** / "Agentic Cloud Delivery Platform" →
**Nova** / "The New Dawn of DevSecOps — security as a seamless enabler
of fast deployments." The rebrand applies across docs, decks, code,
configs, CI, env var prefixes, the consumer contract path, SSM
parameter paths, AWS tag keys, and AWS resource names — with a staged
infrastructure migration to avoid breakage. The Nova tagline is added
alongside (not replacing) the existing "North Star" / "consumers
declare intent" framing; the S&P Global Energy visual theme
(`sp-theme.json`) is a client brand and is **not** touched.
**Milestone type:** Major (breaking — consumer-facing path, env var
prefixes, SSM path, AWS tag keys, and AWS resource names all change).
Per the branch-strategy precedent (breaking/feature milestones tag on
their OWN minor line), v1.15 tags run on the **v1.15.x minor line**:
`v1.15.0` (P0) → `v1.15.1..v1.15.4` (P1–P4) → `v1.15.4` (P5 final =
milestone release). (G-104 binding.)
**Brand mapping:**
- Name: `ACDL` / `Agentic Cloud Delivery Platform` → `Nova`
- Tagline (added): "The New Dawn of DevSecOps — security as a seamless
enabler of fast deployments"
- Env var prefix: `ACDL_*` → `NOVA_*` (dual-read fallback in P2;
removed in P5)
- Consumer path: `.acdl/contract.yml` → `.nova/contract.yml`
- SSM path: `/acdl/{env}/{contractId}/{output}` →
`/nova/{env}/{contractId}/{output}`
- AWS tag keys: `acdl:owner|environment|contract|cost-center|ref` →
`nova:*`
- AWS resource names: `acdl-*` → `nova-*` (with migration, P4)
- Illustrative URLs in docs: `github.com/acdl/...` →
`github.com/nova/...` (prose only; real repo name unchanged)
- Gitea release titles going forward: `ACDL vX.Y.Z` → `Nova vX.Y.Z`
- S&P visual theme: unchanged (client branding)
**Wave ordering:**
- Wave 1 (P1): docs/decks/prose — no runtime impact; establishes new
vocabulary. REQ-155, REQ-156, REQ-157.
- Wave 2 (P2): code + env vars + consumer path — rename in code with a
dual-read env fallback so deployments don't break during the
transition window. REQ-158, REQ-159, REQ-160.
- Wave 3 (P3): SSM path + tag keys — SSM: copy `/acdl/...` →
`/nova/...`, update readers, delete old. Tag keys: parallel-tag
period (`nova:*` added, ABAC policy swapped, `acdl:*` removed).
REQ-161, REQ-162.
- Wave 4 (P4): AWS resource names — the big migration (KMS alias, SNS,
SG, Lambda, DynamoDB data migration, ECR re-push, IAM re-bootstrap,
state bucket migration, ALB recreate). Maintenance window + rollback
runbook. REQ-163.
- Wave 5 (P5): final-review-ship — remove dual-read fallback, consumer
migration guide finalized, review + audit + milestone ship. REQ-164.
### Phase P1 — docs-decks-prose (Wave 1)
- **Description:** Rebrand all prose, titles, headers, comments,
deck markdown sources, mermaid `.mmd` sources, `pyproject.toml`
name/description, and `release.yml` release-title prefix from
`ACDL`/`Agentic Cloud Delivery Platform` → `Nova`. Add the Nova
tagline ("The New Dawn of DevSecOps — security as a seamless enabler
of fast deployments") to the README header, both deck title slides,
and `docs/vision.md` — alongside the existing "North Star" framing.
Re-export the mermaid PNG diagrams so committed PNGs match new
labels. Re-render the deck HTML. Update illustrative URLs in docs
(`github.com/acdl/...` → `github.com/nova/...`,
`git.cloudinit.dev/continuous-intelligence/acdl*` → `.../nova*` for
prose). Ship a consumer migration guide (`docs/NOVA_MIGRATION.md`)
announcing the `.acdl/`→`.nova/` path, `ACDL_*`→`NOVA_*` env vars,
`/acdl/`→`/nova/` SSM path, `acdl:*`→`nova:*` tag keys, and
`acdl-*`→`nova-*` AWS resource names changes coming in P2–P4.
- **Status:** complete (v1.15.1)
- **Depends on:** —
- **Requirements:** REQ-155, REQ-156, REQ-157
- **Success Criteria:**
- `grep -rni "ACDL\|Agentic Cloud Delivery" README.md docs/ .ciagent/*.md`
returns 0 hits (except historical narrative marked as historical).
- `pyproject.toml` `name` = `nova`; `description` mentions Nova.
- `release.yml` release title prefix is `Nova `.
- Both decks' title-slide subtitle is
`Nova — The New Dawn of DevSecOps`; mermaid `.mmd` sources use
`Nova`; PNGs re-exported; HTML re-rendered.
- `docs/vision.md` and README header carry the Nova tagline
alongside the North Star.
- `docs/NOVA_MIGRATION.md` exists and lists the 5 breaking changes.
- `pytest` passes; `run_ci.sh` exits 0.
### Phase P2 — code-envvars-consumer-path (Wave 2)
- **Description:** Rename
`adapters/terraform/policy/custom_rules/acdl_tagging.py` →
`nova_tagging.py` (+ Checkov custom-rule registration in
`schemas/tagging-standard.json` + adapter config). Rename all 21
`ACDL_*` env var prefixes → `NOVA_*` across `scripts/`, `core/`,
`adapters/`, `tests/`, workflows (`.gitea/`, `.github/`), `.env`,
`.env.secrets` (key names only — values stay), and consumer docs.
Implement a **dual-read fallback** (`NOVA_X` preferred, fall back to
`ACDL_X`) in the env/config loader so deployments don't break during
the transition window. Rename the consumer on-disk contract path
`.acdl/contract.yml` → `.nova/contract.yml` (and
`.acdl/static-assets.*.yml`, `.acdl/contract.yaml`) across the
contract resolver, deploy workflow checkout path, consumer docs, and
the contract schema description. Rotate Gitea repo secrets via API
(rename keys `ACDL_*` → `NOVA_*`, values stay).
- **Status:** complete (v1.15.2)
- **Depends on:** [P1]
- **Requirements:** REQ-158, REQ-159, REQ-160
- **Success Criteria:**
- `nova_tagging.py` exists; `acdl_tagging.py` removed; Checkov
registration updated; rule enforces `nova:*` tag keys (tag-key
enforcement of `nova:*` lands here; existing resources still carry
`acdl:*` until P3 parallel-tag — rule warns during P2).
- No `ACDL_` env var references remain in code/scripts/workflows/tests
except the dual-read fallback in the loader + `.env.secrets` legacy
comment.
- Dual-read fallback implemented and unit-tested.
- Contract resolver reads `.nova/contract.yml`; deploy workflow
checks out `.nova/`; docs updated.
- `pytest` passes; `run_ci.sh` exits 0.
### Phase P3 — ssm-tagkeys (Wave 3)
- **Description:** SSM path migration: rename the parameter path prefix
`/acdl/{env}/{contractId}/{output}` →
`/nova/{env}/{contractId}/{output}` across `core/output_publisher`,
the contract resolver, and consumer docs. Add a migration script
(`scripts/migrate_ssm_paths.py`) that copies existing `/acdl/...`
parameters → `/nova/...`, then readers are updated, then old
parameters are deleted. Tag key migration: add `nova:*` tags to all
AWS resources (parallel-tag period), update the ABAC session policies
to match `nova:*`, update `nova_tagging.py` to enforce `nova:*`
(hard, no warn), then remove `acdl:*` tags once consumers are
verified. Terraform tagging updated to emit `nova:*`.
- **Status:** complete (v1.15.3)
- **Depends on:** [P2]
- **Requirements:** REQ-161, REQ-162
- **Success Criteria:**
- SSM readers use `/nova/...`; migration script copies + deletes;
test asserts new path.
- `nova_tagging.py` enforces `nova:*` (hard fail on `acdl:*`).
- ABAC session policies match `nova:*`; terraform emits `nova:*` tags.
- `acdl:*` tags removed from all resources (verified via `aws` CLI or
documented deferred if no live AWS access).
- `pytest` passes; `run_ci.sh` exits 0.
### Phase P4 — aws-resource-migration (Wave 4)
- **Description:** Rename all `acdl-*` AWS resources → `nova-*` via
terraform with a staged migration: KMS alias `alias/acdl-platform` →
`alias/nova-platform` (repoint), SNS `acdl-sod-halt` →
`nova-sod-halt` (recreate), SG `acdl-ecs-sg` → `nova-ecs-sg`
(recreate), Lambda `acdl-contract-ingestor` →
`nova-contract-ingestor` (recreate), DynamoDB `acdl-contracts`/
`acdl-change-requests` → `nova-contracts`/`nova-change-requests`
(scan+copy data migration, verify row counts, keep old tables until
verified), ECR `acdl-microservice` → `nova-microservice` (re-push
images), IAM user/policy `acdl-spike-runner` → `nova-spike-runner`
(re-bootstrap with new key), state bucket `acdl-tfstate-...` →
`nova-tfstate-...` (`terraform init -migrate-state` to new backend,
state JSON backed up first), ALB name prefix `acdl-alb` → `nova-alb`
(recreate, brief downtime). Publish a maintenance window + rollback
runbook (`docs/NOVA_AWS_MIGRATION.md`). For the offline/local tier,
the terraform `name`/`resource` labels change so `terraform validate`
passes; live apply/modify/destroy is exercised by the
modules-lifecycle workflow when `ACDL_LIFECYCLE_MODE` (now
`NOVA_LIFECYCLE_MODE`) is set to full.
- **Status:** complete (v1.15.4)
- **Depends on:** [P3]
- **Requirements:** REQ-163
- **Success Criteria:**
- All terraform resource names/labels use `nova-*`; `terraform
validate` passes for platform/microservice/ci-vpc.
- State bucket name → `nova-tfstate-...`; `terraform init
-migrate-state` documented + tested offline.
- DynamoDB data-migration script exists (scan+copy, row-count
verify).
- `docs/NOVA_AWS_MIGRATION.md` runbook exists (maintenance window,
rollback steps).
- `grep -rn "acdl-" terraform/` returns 0 hits.
- `pytest` passes; `run_ci.sh` exits 0.
### Phase P5 — final-review-ship (Final Phase)
- **Description:** Multi-persona code review across all v1.15 phases.
Audit (reconstruction test, file discipline, branch hygiene, commit
discipline). Remove the dual-read env var fallback (`ACDL_*`→`NOVA_*`)
once all consumers are migrated; finalize the consumer migration
guide; `nova_tagging.py` no longer accepts `acdl:*` tag keys. Complete:
update REQUIREMENTS.md (REQ-155..164 marked complete), ROADMAP.md
(v1.15 complete), PROJECT.md. Tag final patch `v1.14.5` (IS the
milestone release). Merge `milestone/v1.15-nova` → `main`.
- **Status:** complete (v1.15.4, milestone release)
- **Depends on:** [P1-P4]
- **Requirements:** REQ-164
- **Success Criteria:**
- Review: 0 new P0; all P1+ flagged or auto-fixed.
- Audit: clean; reconstruction test passes.
- Dual-read fallback removed; `nova_tagging.py` hard-fails `acdl:*`.
- Tag `v1.15.4` created; milestone merged to main.
After Phase P5: milestone COMPLETE — `v1.15.4` IS the v1.15 release.
.ciagent/config.json
+1 -1
View File
@@ -8,7 +8,7 @@
],
"active_project": "acdl",
"active_projects": ["acdl"],
"active_milestone": "v1.14",
"active_milestone": "v1.15",
"autonomy": {
"level": "full",
"escalation_hooks": ["deploy", "delete_data", "merge_to_main"],
.gitea/workflows/deploy.yml
+11 -10
View File
@@ -26,7 +26,7 @@
# platform log) for auditability.
#
# Inputs:
# contract — path to the consumer's contract YAML (default .acdl/contract.yml)
# contract — path to the consumer's contract YAML (default .nova/contract.yml)
# mode — full | plan-only | check-only (default full; dev = full apply,
# higher environments hold for HITL — the calling repo or the
# forge environment gate enforces that)
@@ -39,11 +39,11 @@
# policy restricts view/update to resources tagged acdl:owner=<consumer-repo>.
#
# Override (where OIDC is unavailable, e.g. Gitea pending
# go-gitea/gitea#36988): set ACDL_AWS_ACCESS_KEY_ID + ACDL_AWS_SECRET_ACCESS_KEY
# go-gitea/gitea#36988): set NOVA_AWS_ACCESS_KEY_ID + NOVA_AWS_SECRET_ACCESS_KEY
# as repository secrets. The platform-managed scheduled pipeline rotates
# the key on a daily cadence. When .env.secrets is used locally instead,
# rotating the key out of band is the consumer's responsibility.
name: acdl-deploy
name: nova-deploy
on:
workflow_call:
@@ -51,7 +51,7 @@ on:
contract:
description: Path to the consumer contract YAML (in the consumer repo)
type: string
default: .acdl/contract.yml
default: .nova/contract.yml
mode:
description: Pipeline mode — full (apply), plan-only, check-only, or decommission
type: string
@@ -102,10 +102,11 @@ jobs:
- name: Configure AWS credentials (OIDC default + static-key override)
uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID == '' && format('arn:aws:iam::{0}:role/acdl-deploy-{1}', secrets.ACDL_AWS_ACCOUNT_ID, github.repository_id) || '' }}
# P4 (REQ-163): IAM role renamed acdl-deploy- → nova-deploy-.
role-to-assume: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID == '' && format('arn:aws:iam::{0}:role/nova-deploy-{1}', secrets.NOVA_AWS_ACCOUNT_ID, github.repository_id) || '' }}
aws-region: us-east-1
access-key-id: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
secret-access-key: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
access-key-id: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
secret-access-key: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
- name: Run the platform pipeline
working-directory: ${{ github.workspace }}
@@ -145,7 +146,7 @@ jobs:
AWS_DEFAULT_REGION: us-east-1
run: |
aws lambda invoke-function-url \
--function-url "${{ secrets.ACDL_LAMBDA_URL }}" \
--function-url "${{ secrets.NOVA_LAMBDA_URL }}" \
--cli-binary-format raw-in-base64-out \
--payload "$(python3 -c "import json,os; print(json.dumps({'action':'report_error','consumerRepo':os.environ.get('GITHUB_REPOSITORY',''),'contractId':'${{ github.run_id }}','error':'Deploy pipeline failed. See run logs.','runUrl':'${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}','environment':'dev'}))")" \
/dev/null || true
@@ -153,13 +154,13 @@ jobs:
- name: Upload emitted Terraform
uses: actions/upload-artifact@v4
with:
name: acdl-terraform
name: nova-terraform
path: /tmp/acdl_platform_run_v18/tf/*.tf
if-no-files-found: warn
- name: Upload platform log
uses: actions/upload-artifact@v4
with:
name: acdl-platform-log
name: nova-platform-log
path: platform/logs/
if-no-files-found: warn
.gitea/workflows/modules-lifecycle.yml
+27 -27
View File
@@ -15,7 +15,7 @@
# "plan" — the lifecycle scripts run `run_platform.sh --plan-only` (fast,
# no AWS mutation, validates the contract->resolver->adapter->plan chain
# for every module on every PR, with no AWS credentials or cost). Set to
# "full" via workflow_dispatch (or the ACDL_LIFECYCLE_MODE repo variable)
# "full" via workflow_dispatch (or the NOVA_LIFECYCLE_MODE repo variable)
# to run the real apply→modify→destroy against live AWS. In plan mode the
# short-lived CI VPC apply/destroy jobs are skipped (nothing is applied).
#
@@ -49,7 +49,7 @@ jobs:
ci-vpc-apply:
name: CI VPC apply
runs-on: ubuntu-latest
if: ${{ github.event.inputs.lifecycle_mode != 'plan' && vars.ACDL_LIFECYCLE_MODE != 'plan' }}
if: ${{ github.event.inputs.lifecycle_mode != 'plan' && vars.NOVA_LIFECYCLE_MODE != 'plan' }}
steps:
- uses: actions/checkout@v4
- name: Install Terraform 1.9.*
@@ -60,8 +60,8 @@ jobs:
- name: Apply CI VPC
working-directory: terraform/ci-vpc
env:
AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: us-east-1
run: |
terraform init -input=false -lock=false
@@ -78,7 +78,7 @@ jobs:
matrix:
module: [s3, kms-key, ecr, ecs-cluster, iam-role, cloudfront, waf, vpc, alb, ecs-service, rds, uptime]
env:
ACDL_LIFECYCLE_MODE: ${{ github.event.inputs.lifecycle_mode || vars.ACDL_LIFECYCLE_MODE || 'plan' }}
NOVA_LIFECYCLE_MODE: ${{ github.event.inputs.lifecycle_mode || vars.NOVA_LIFECYCLE_MODE || 'plan' }}
steps:
- uses: actions/checkout@v4
- name: Free disk space
@@ -97,31 +97,31 @@ jobs:
echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
sudo apt-get update && sudo apt-get install -y terraform=1.9.*
- name: Read CI VPC outputs
if: ${{ env.ACDL_LIFECYCLE_MODE == 'full' }}
if: ${{ env.NOVA_LIFECYCLE_MODE == 'full' }}
working-directory: terraform/ci-vpc
env:
AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: us-east-1
run: |
terraform init -input=false -lock=false
terraform output -json > /tmp/ci-vpc-outputs.json
- name: Apply (simple)
env:
AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: us-east-1
run: bash scripts/run_lifecycle_test.sh ${{ matrix.module }} simple /tmp/ci-vpc-outputs.json
- name: Modify (complex)
env:
AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: us-east-1
run: bash scripts/run_lifecycle_test.sh ${{ matrix.module }} complex /tmp/ci-vpc-outputs.json
- name: Destroy
env:
AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: us-east-1
run: bash scripts/run_lifecycle_destroy.sh ${{ matrix.module }} /tmp/ci-vpc-outputs.json
@@ -136,7 +136,7 @@ jobs:
matrix:
module: [static-assets, microservice]
env:
ACDL_LIFECYCLE_MODE: ${{ github.event.inputs.lifecycle_mode || vars.ACDL_LIFECYCLE_MODE || 'plan' }}
NOVA_LIFECYCLE_MODE: ${{ github.event.inputs.lifecycle_mode || vars.NOVA_LIFECYCLE_MODE || 'plan' }}
steps:
- uses: actions/checkout@v4
- name: Free disk space
@@ -155,31 +155,31 @@ jobs:
echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
sudo apt-get update && sudo apt-get install -y terraform=1.9.*
- name: Read CI VPC outputs
if: ${{ env.ACDL_LIFECYCLE_MODE == 'full' }}
if: ${{ env.NOVA_LIFECYCLE_MODE == 'full' }}
working-directory: terraform/ci-vpc
env:
AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: us-east-1
run: |
terraform init -input=false -lock=false
terraform output -json > /tmp/ci-vpc-outputs.json
- name: Apply (simple)
env:
AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: us-east-1
run: bash scripts/run_l2_lifecycle_test.sh ${{ matrix.module }} simple /tmp/ci-vpc-outputs.json
- name: Modify (complex)
env:
AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: us-east-1
run: bash scripts/run_l2_lifecycle_test.sh ${{ matrix.module }} complex /tmp/ci-vpc-outputs.json
- name: Destroy
env:
AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: us-east-1
run: bash scripts/run_l2_lifecycle_destroy.sh ${{ matrix.module }} /tmp/ci-vpc-outputs.json
@@ -188,7 +188,7 @@ jobs:
name: CI VPC destroy
needs: [lifecycle, l2-lifecycle]
runs-on: ubuntu-latest
if: ${{ always() && github.event.inputs.lifecycle_mode != 'plan' && vars.ACDL_LIFECYCLE_MODE != 'plan' }}
if: ${{ always() && github.event.inputs.lifecycle_mode != 'plan' && vars.NOVA_LIFECYCLE_MODE != 'plan' }}
steps:
- uses: actions/checkout@v4
- name: Install Terraform 1.9.*
@@ -199,8 +199,8 @@ jobs:
- name: Destroy CI VPC
working-directory: terraform/ci-vpc
env:
AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: us-east-1
run: |
terraform init -input=false -lock=false
.github/workflows/deploy.yml
+11 -10
View File
@@ -26,7 +26,7 @@
# platform log) for auditability.
#
# Inputs:
# contract — path to the consumer's contract YAML (default .acdl/contract.yml)
# contract — path to the consumer's contract YAML (default .nova/contract.yml)
# mode — full | plan-only | check-only (default full; dev = full apply,
# higher environments hold for HITL — the calling repo or the
# forge environment gate enforces that)
@@ -39,11 +39,11 @@
# policy restricts view/update to resources tagged acdl:owner=<consumer-repo>.
#
# Override (where OIDC is unavailable, e.g. Gitea pending
# go-gitea/gitea#36988): set ACDL_AWS_ACCESS_KEY_ID + ACDL_AWS_SECRET_ACCESS_KEY
# go-gitea/gitea#36988): set NOVA_AWS_ACCESS_KEY_ID + NOVA_AWS_SECRET_ACCESS_KEY
# as repository secrets. The platform-managed scheduled pipeline rotates
# the key on a daily cadence. When .env.secrets is used locally instead,
# rotating the key out of band is the consumer's responsibility.
name: acdl-deploy
name: nova-deploy
on:
workflow_call:
@@ -51,7 +51,7 @@ on:
contract:
description: Path to the consumer contract YAML (in the consumer repo)
type: string
default: .acdl/contract.yml
default: .nova/contract.yml
mode:
description: Pipeline mode — full (apply), plan-only, check-only, or decommission
type: string
@@ -102,10 +102,11 @@ jobs:
- name: Configure AWS credentials (OIDC default + static-key override)
uses: aws-actions/configure-aws-credentials@v4
with:
role-to-assume: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID == '' && format('arn:aws:iam::{0}:role/acdl-deploy-{1}', secrets.ACDL_AWS_ACCOUNT_ID, github.repository_id) || '' }}
# P4 (REQ-163): IAM role renamed acdl-deploy- → nova-deploy-.
role-to-assume: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID == '' && format('arn:aws:iam::{0}:role/nova-deploy-{1}', secrets.NOVA_AWS_ACCOUNT_ID, github.repository_id) || '' }}
aws-region: us-east-1
access-key-id: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
secret-access-key: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
access-key-id: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
secret-access-key: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
- name: Run the platform pipeline
working-directory: ${{ github.workspace }}
@@ -145,7 +146,7 @@ jobs:
AWS_DEFAULT_REGION: us-east-1
run: |
aws lambda invoke-function-url \
--function-url "${{ secrets.ACDL_LAMBDA_URL }}" \
--function-url "${{ secrets.NOVA_LAMBDA_URL }}" \
--cli-binary-format raw-in-base64-out \
--payload "$(python3 -c "import json,os; print(json.dumps({'action':'report_error','consumerRepo':os.environ.get('GITHUB_REPOSITORY',''),'contractId':'${{ github.run_id }}','error':'Deploy pipeline failed. See run logs.','runUrl':'${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}','environment':'dev'}))")" \
/dev/null || true
@@ -153,13 +154,13 @@ jobs:
- name: Upload emitted Terraform
uses: actions/upload-artifact@v4
with:
name: acdl-terraform
name: nova-terraform
path: /tmp/acdl_platform_run_v18/tf/*.tf
if-no-files-found: warn
- name: Upload platform log
uses: actions/upload-artifact@v4
with:
name: acdl-platform-log
name: nova-platform-log
path: platform/logs/
if-no-files-found: warn
.github/workflows/modules-lifecycle.yml
+27 -27
View File
@@ -15,7 +15,7 @@
# "plan" — the lifecycle scripts run `run_platform.sh --plan-only` (fast,
# no AWS mutation, validates the contract->resolver->adapter->plan chain
# for every module on every PR, with no AWS credentials or cost). Set to
# "full" via workflow_dispatch (or the ACDL_LIFECYCLE_MODE repo variable)
# "full" via workflow_dispatch (or the NOVA_LIFECYCLE_MODE repo variable)
# to run the real apply→modify→destroy against live AWS. In plan mode the
# short-lived CI VPC apply/destroy jobs are skipped (nothing is applied).
#
@@ -49,7 +49,7 @@ jobs:
ci-vpc-apply:
name: CI VPC apply
runs-on: ubuntu-latest
if: ${{ github.event.inputs.lifecycle_mode != 'plan' && vars.ACDL_LIFECYCLE_MODE != 'plan' }}
if: ${{ github.event.inputs.lifecycle_mode != 'plan' && vars.NOVA_LIFECYCLE_MODE != 'plan' }}
steps:
- uses: actions/checkout@v4
- name: Install Terraform 1.9.*
@@ -60,8 +60,8 @@ jobs:
- name: Apply CI VPC
working-directory: terraform/ci-vpc
env:
AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: us-east-1
run: |
terraform init -input=false -lock=false
@@ -78,7 +78,7 @@ jobs:
matrix:
module: [s3, kms-key, ecr, ecs-cluster, iam-role, cloudfront, waf, vpc, alb, ecs-service, rds, uptime]
env:
ACDL_LIFECYCLE_MODE: ${{ github.event.inputs.lifecycle_mode || vars.ACDL_LIFECYCLE_MODE || 'plan' }}
NOVA_LIFECYCLE_MODE: ${{ github.event.inputs.lifecycle_mode || vars.NOVA_LIFECYCLE_MODE || 'plan' }}
steps:
- uses: actions/checkout@v4
- name: Free disk space
@@ -97,31 +97,31 @@ jobs:
echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
sudo apt-get update && sudo apt-get install -y terraform=1.9.*
- name: Read CI VPC outputs
if: ${{ env.ACDL_LIFECYCLE_MODE == 'full' }}
if: ${{ env.NOVA_LIFECYCLE_MODE == 'full' }}
working-directory: terraform/ci-vpc
env:
AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: us-east-1
run: |
terraform init -input=false -lock=false
terraform output -json > /tmp/ci-vpc-outputs.json
- name: Apply (simple)
env:
AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: us-east-1
run: bash scripts/run_lifecycle_test.sh ${{ matrix.module }} simple /tmp/ci-vpc-outputs.json
- name: Modify (complex)
env:
AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: us-east-1
run: bash scripts/run_lifecycle_test.sh ${{ matrix.module }} complex /tmp/ci-vpc-outputs.json
- name: Destroy
env:
AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: us-east-1
run: bash scripts/run_lifecycle_destroy.sh ${{ matrix.module }} /tmp/ci-vpc-outputs.json
@@ -136,7 +136,7 @@ jobs:
matrix:
module: [static-assets, microservice]
env:
ACDL_LIFECYCLE_MODE: ${{ github.event.inputs.lifecycle_mode || vars.ACDL_LIFECYCLE_MODE || 'plan' }}
NOVA_LIFECYCLE_MODE: ${{ github.event.inputs.lifecycle_mode || vars.NOVA_LIFECYCLE_MODE || 'plan' }}
steps:
- uses: actions/checkout@v4
- name: Free disk space
@@ -155,31 +155,31 @@ jobs:
echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
sudo apt-get update && sudo apt-get install -y terraform=1.9.*
- name: Read CI VPC outputs
if: ${{ env.ACDL_LIFECYCLE_MODE == 'full' }}
if: ${{ env.NOVA_LIFECYCLE_MODE == 'full' }}
working-directory: terraform/ci-vpc
env:
AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: us-east-1
run: |
terraform init -input=false -lock=false
terraform output -json > /tmp/ci-vpc-outputs.json
- name: Apply (simple)
env:
AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: us-east-1
run: bash scripts/run_l2_lifecycle_test.sh ${{ matrix.module }} simple /tmp/ci-vpc-outputs.json
- name: Modify (complex)
env:
AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: us-east-1
run: bash scripts/run_l2_lifecycle_test.sh ${{ matrix.module }} complex /tmp/ci-vpc-outputs.json
- name: Destroy
env:
AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: us-east-1
run: bash scripts/run_l2_lifecycle_destroy.sh ${{ matrix.module }} /tmp/ci-vpc-outputs.json
@@ -188,7 +188,7 @@ jobs:
name: CI VPC destroy
needs: [lifecycle, l2-lifecycle]
runs-on: ubuntu-latest
if: ${{ always() && github.event.inputs.lifecycle_mode != 'plan' && vars.ACDL_LIFECYCLE_MODE != 'plan' }}
if: ${{ always() && github.event.inputs.lifecycle_mode != 'plan' && vars.NOVA_LIFECYCLE_MODE != 'plan' }}
steps:
- uses: actions/checkout@v4
- name: Install Terraform 1.9.*
@@ -199,8 +199,8 @@ jobs:
- name: Destroy CI VPC
working-directory: terraform/ci-vpc
env:
AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
AWS_DEFAULT_REGION: us-east-1
run: |
terraform init -input=false -lock=false
.github/workflows/release.yml
+3 -3
View File
@@ -1,4 +1,4 @@
# ACDL Release Pipeline — GitHub Actions (production)
# Nova Release Pipeline — GitHub Actions (production)
#
# Runs on push to main. Computes the next semver tag from the latest tag +
# commit history, creates the tag, updates floating MAJOR.MINOR and MAJOR tags,
@@ -8,7 +8,7 @@
# - Regular phase commit -> bump PATCH (v1.6.0 -> v1.6.1)
# - Milestone completion ("docs(milestone): complete") -> bump MINOR (v1.6.1 -> v1.7.0)
# - Major bumps are manual (not implemented here).
name: acdl-release
name: nova-release
on:
push:
@@ -87,6 +87,6 @@ jobs:
BODY=$(git log --format='- %s' HEAD)
fi
gh release create ${{ steps.version.outputs.new_tag }} \
--title "ACDL ${{ steps.version.outputs.new_tag }}" \
--title "Nova ${{ steps.version.outputs.new_tag }}" \
--notes "$BODY" \
--generate-notes || true
README.md
+11 -9
View File
@@ -1,4 +1,6 @@
# ACDL — Agentic Cloud Delivery Platform
# Nova
> **Nova — The New Dawn of DevSecOps.** Security as a seamless enabler of fast deployments — not a bottleneck, not a "no" department.
Consumers declare intent; the platform delivers safe production deployment
through an agentic stack — automatically, safely, and with a complete audit
@@ -18,7 +20,7 @@ a configuration file, or an infrastructure module.
## Repository roles
There are two kinds of repository in the ACDL model:
There are two kinds of repository in the Nova model:
- **Platform repo (this one).** This is the **source code of the platform**.
It owns `modules/`, `adapters/`, `core/`, `schemas/`, `pipelines/`,
@@ -26,7 +28,7 @@ There are two kinds of repository in the ACDL model:
A **consumer never clones it.**
- **Consumer repo (yours).** A consumer repo contains only:
1. **Its application code** — the service or site being deployed.
2. **One or more contracts** — small YAML files at `.acdl/contract.yml`
2. **One or more contracts** — small YAML files at `.nova/contract.yml`
that declare infrastructure (one or more modules by name + version),
select an environment, and supply module-specific inputs.
3. **One or more CI definitions** — thin `.github/workflows/*.yml` files
@@ -93,7 +95,7 @@ intent via a contract; the platform delivers the deployment through the
same contract schema, the same policy envelope, and the same evidence
stream.
Consumers have their own repos and consume ACDL by writing a contract that
Consumers have their own repos and consume Nova by writing a contract that
declares infrastructure. A consumer declares a contract (id + name +
environment + infrastructure); the platform resolves it to a stack instance,
compiles it, runs security + policy checks, computes a confidence signal,
@@ -142,7 +144,7 @@ engine-specific code. `modules/`, `schemas/`, `contracts/`,
```bash
# 1. Bootstrap the AWS state backend + runner IAM user (one-time, idempotent)
# (requires the bootstrap root key in env — skip if the state bucket +
# acdl-spike-runner already exist)
# nova-spike-runner already exist)
ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID=... ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY=... \
python3 terraform/bootstrap/create_state_backend.py
ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID=... ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY=... \
@@ -223,7 +225,7 @@ The workflow implements the same stages as `pipelines/contract.yml`
→ policy checks → confidence → evidence event → apply). A consumer repo
invokes the reusable workflow via a **versioned tag** (floating MAJOR +
MINOR, e.g. `acdl/.github/workflows/deploy.yml@v1.13`). The workflow checks
out the consumer repo, then checks out the ACDL platform repo into the
out the consumer repo, then checks out the Nova platform repo into the
runner workspace, and runs `scripts/run_platform.sh` against the consumer's
contract — the consumer never clones the platform repo or invokes its
scripts locally. See the [Consumer guide](docs/consumer-guide.md) for the
@@ -247,7 +249,7 @@ backwards-compatible log-only mode.
## Consumer guide
A step-by-step guide for a consumer to create their pipeline and define a
contract that deploys any ACDL module to AWS is at
contract that deploys any Nova module to AWS is at
[`docs/consumer-guide.md`](docs/consumer-guide.md). The guide is generic
across all modules; `static-assets` is the worked example.
@@ -283,8 +285,8 @@ no static credentials in repo secrets.
`repo:org/consumer-repo:ref:refs/heads/main`) binds the role's trust
policy to the exact consumer repo + branch that invoked the workflow.
- **Resource-creation attributes** — every resource the pipeline creates
is tagged with `acdl:owner=<consumer-repo>` and
`acdl:contract=<contract-id>`. The session policy grants
is tagged with `nova:owner=<consumer-repo>` and
`nova:contract=<contract-id>`. The session policy grants
view/update/delete **only on resources whose tags match the calling
repo**.
adapters/terraform/adapter.py
+6 -5
View File
@@ -10,9 +10,10 @@ lives in the per-module terraform/ subdir, NOT in this file.
CLI: adapter.py <instance.json> <out_dir>
"""
import json
import os
import sys
import json, os, sys
_R = os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
sys.path.insert(0, _R) if _R not in sys.path else None
from core import env
def _load_registry(repo_root):
@@ -112,7 +113,7 @@ def adapt(stack_instance, out_dir):
stack_name = stack.get("name", "spike")
environment = stack.get("environment", "dev")
account_id = os.environ.get("ACDL_AWS_ACCOUNT_ID", "581513795199")
account_id = env.get_env("AWS_ACCOUNT_ID", "581513795199")
state_bucket = f"acdl-tfstate-{account_id}-us-east-1"
terraform_tf = (
'terraform {\n'
@@ -134,7 +135,7 @@ def adapt(stack_instance, out_dir):
data_source_names = stack_instance.get("data_sources", [])
parts = []
if data_source_names:
remote_state_key = os.environ.get("ACDL_REMOTE_STATE_KEY", "platform/terraform.tfstate")
remote_state_key = env.get_env("REMOTE_STATE_KEY", "platform/terraform.tfstate")
parts.append(
'data "terraform_remote_state" "platform" {\n'
' backend = "s3"\n'
adapters/terraform/policy/checkov_adapter.py
+14 -9
View File
@@ -1,4 +1,4 @@
"""Translate Checkov JSON output to ACDL PolicyCheckResult records.
"""Translate Checkov JSON output to Nova PolicyCheckResult records.
Reads Checkov's JSON output (one framework key, e.g. terraform_plan),
emits a list of PolicyCheckResult dicts conforming to
@@ -6,10 +6,13 @@ schemas/policy_check_result.schema.json. Run Checkov with --soft-fail so
Checkov never exits non-zero; the confidence signal decides the gate, not
Checkov's exit code.
The ACDL tagging standard (D-054, D-043 closure) is enforced by a custom
Checkov rule at adapters/terraform/policy/custom_rules/acdl_tagging.py,
loaded via --external-checks-dir. The adapter therefore maps
ACDL_TAG_NAMING as a real rule (no synthetic SKIPPED record is emitted).
The Nova tagging standard (D-054, D-043 closure, D-109 hard mode in P3)
is enforced by a custom Checkov rule at
adapters/terraform/policy/custom_rules/nova_tagging.py, loaded via
--external-checks-dir. The adapter therefore maps NOVA_TAG_NAMING as a
real rule (no synthetic SKIPPED record is emitted). Renamed from
ACDL_TAG_NAMING in P2 (REQ-158); the rule is in hard mode as of P3
(REQ-162: hard-fail on missing nova:* or acdl:*-only tags).
"""
import datetime
@@ -29,10 +32,12 @@ RULE_MAP = {
"CKV_AWS_40": ("iam-wildcard", "medium"),
"CKV_AWS_7": ("kms-key-reference", "medium"),
"CKV_AWS_33": ("kms-key-reference", "medium"),
# D-054 / D-043 closure: ACDL_TAG_NAMING is now a real custom Checkov
# rule (adapters/terraform/policy/custom_rules/acdl_tagging.py), loaded
# via --external-checks-dir. No synthetic SKIPPED record is emitted.
"ACDL_TAG_NAMING": ("tagging-standard", "medium"),
# D-054 / D-043 closure, D-109 hard mode (P3): NOVA_TAG_NAMING is a real
# custom Checkov rule (adapters/terraform/policy/custom_rules/nova_tagging.py),
# loaded via --external-checks-dir. No synthetic SKIPPED record is emitted.
# Renamed from ACDL_TAG_NAMING in P2 (REQ-158). Hard mode as of P3
# (REQ-162: hard-fail on missing nova:* or acdl:*-only tags).
"NOVA_TAG_NAMING": ("tagging-standard", "medium"),
}
_RESULT_MAP = {"PASSED": "pass", "FAILED": "fail", "SKIPPED": "skipped"}
adapters/terraform/policy/custom_rules/README.md
+19 -11
View File
@@ -1,16 +1,24 @@
# ACDL Custom Checkov Rules
# Nova Custom Checkov Rules
This directory holds ACDL-authored Checkov custom rules, written in the
This directory holds Nova-authored Checkov custom rules, written in the
[Checkov Python custom-rule framework](https://www.checkov.io/4.Contributing/Custom%20Policies.html).
## Files
- `acdl_tagging.py` — `ACDL_TAG_NAMING` (D-054): ensures every taggable AWS
resource carries the four required ACDL tags
(`acdl:owner`, `acdl:contract`, `acdl:environment`, `acdl:cost-center`).
This rule replaces the synthetic SKIPPED `ACDL_TAG_NAMING` record that the
Checkov adapter previously emitted (D-043 closure). The canonical tag set
is declared in [`schemas/tagging-standard.json`](../../../schemas/tagging-standard.json).
- `nova_tagging.py` — `NOVA_TAG_NAMING` (D-054, D-109 warn mode in P2):
ensures every taggable AWS resource carries the four required Nova tags
(`nova:owner`, `nova:contract`, `nova:environment`, `nova:cost-center`).
This rule replaces the synthetic SKIPPED `NOVA_TAG_NAMING` record that the
Checkov adapter previously emitted (D-043 closure). Renamed from
`acdl_tagging.py` / `ACDL_TAG_NAMING` in P2 (REQ-158). The canonical tag
set is declared in [`schemas/tagging-standard.json`](../../../schemas/tagging-standard.json).
**P2 warn mode (D-109):** existing resources still carry `acdl:*` tag-key
values (left for P3). When a resource has only `acdl:*`-style tags and no
`nova:*` tags, the rule logs a WARNING instead of failing, so the
regression gate stays green during the parallel-tag transition window.
P3 flips to hard-fail once `nova:*` tags are emitted in parallel and the
ABAC policy is swapped.
## How Checkov loads them
@@ -23,12 +31,12 @@ checkov -f terraform/spike/main.tf --framework terraform -o json --soft-fail \
```
Checkov imports each `*.py` file in the directory and instantiates the
module-level `check` object (see the `check = AcdlTaggingStandard()` line at
the bottom of `acdl_tagging.py`).
module-level `check` object (see the `check = NovaTaggingStandard()` line at
the bottom of `nova_tagging.py`).
## Severity / result mapping
The Checkov adapter (`adapters/terraform/policy/checkov_adapter.py`)
maps `ACDL_TAG_NAMING` to `(tagging-standard, medium)` in `RULE_MAP`. The
maps `NOVA_TAG_NAMING` to `(tagging-standard, medium)` in `RULE_MAP`. The
custom rule therefore produces real `PASS`/`FAIL` PolicyCheckResult records,
feeding the confidence signal instead of the old SKIPPED placeholder.
adapters/terraform/policy/custom_rules/acdl_tagging.py
-54
View File
@@ -1,54 +0,0 @@
"""ACDL tagging standard custom Checkov rule (D-054).
Checks that all taggable AWS resources have the required ACDL tags:
acdl:owner, acdl:contract, acdl:environment, acdl:cost-center
Fails (severity medium) when any required tag is missing.
Closes the D-043 deferral (the SKIPPED ACDL_TAG_NAMING placeholder
becomes a real check).
"""
from __future__ import annotations
from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
from checkov.common.models.enums import CheckResult, CheckCategories
REQUIRED_TAGS = ("acdl:owner", "acdl:contract", "acdl:environment", "acdl:cost-center")
# Resources that support tags (exclude resources that have no tags attribute)
NON_TAGGABLE_TYPES = (
"aws_cloudfront_origin_access_control",
"aws_lambda_function_url",
"aws_route_table_association",
"aws_internet_gateway",
)
class AcdlTaggingStandard(BaseResourceCheck):
def __init__(self):
name = "Ensure all taggable AWS resources have required ACDL tags"
check_id = "ACDL_TAG_NAMING"
supported_resources = ["*"] # all resources
categories = [CheckCategories.GENERAL_SECURITY]
super().__init__(name=name, check_id=check_id, categories=categories, supported_resources=supported_resources)
def scan_resource_conf(self, conf, entity_type):
# Skip non-taggable resources
if entity_type in NON_TAGGABLE_TYPES:
return CheckResult.PASSED
# Check for a tags block
tags = conf.get("tags")
if not tags:
return CheckResult.FAILED
tag_keys = set()
if isinstance(tags, list) and tags:
tag_block = tags[0]
if isinstance(tag_block, dict):
tag_keys = set(tag_block.keys())
elif isinstance(tags, dict):
tag_keys = set(tags.keys())
missing = [t for t in REQUIRED_TAGS if t not in tag_keys]
if missing:
return CheckResult.FAILED
return CheckResult.PASSED
check = AcdlTaggingStandard()
adapters/terraform/policy/custom_rules/nova_tagging.py
+82
View File
@@ -0,0 +1,82 @@
"""Nova tagging standard custom Checkov rule (D-054, D-109 hard mode).
Checks that all taggable AWS resources have the required Nova tags:
nova:owner, nova:contract, nova:environment, nova:cost-center
In **hard mode** (P3, REQ-162): the rule hard-fails when a taggable resource
is missing any required `nova:*` tag, OR when a resource carries only the
legacy `acdl:*` tag keys (and no `nova:*` keys). P2 shipped warn mode
(`_WARN_MODE = True`) so the regression gate stayed green during the
parallel-tag transition window; P3 flips to hard-fail (`_WARN_MODE = False`)
once `nova:*` tags are emitted in terraform and the ABAC policy is swapped
to match `nova:*`. P5 keeps hard mode and additionally hard-fails on any
`acdl:*` tag key present at all (no legacy tolerated post-cutoff).
Closes the D-043 deferral (the SKIPPED NOVA_TAG_NAMING placeholder
becomes a real check). Renamed from acdl_tagging.py in P2 (REQ-158);
the Checkov rule ID ACDL_TAG_NAMING → NOVA_TAG_NAMING.
"""
from __future__ import annotations
import sys
from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
from checkov.common.models.enums import CheckResult, CheckCategories
REQUIRED_TAGS = ("nova:owner", "nova:contract", "nova:environment", "nova:cost-center")
# Legacy acdl:* tag keys — the parallel-tag period (P3) emits both nova:*
# and acdl:*; P2 warn mode treats acdl:*-only tags as a warning, not a
# failure. The acdl:* VALUES in tagging-standard.json are left for P3.
LEGACY_TAGS = ("acdl:owner", "acdl:contract", "acdl:environment", "acdl:cost-center")
# Resources that support tags (exclude resources that have no tags attribute)
NON_TAGGABLE_TYPES = (
"aws_cloudfront_origin_access_control",
"aws_lambda_function_url",
"aws_route_table_association",
"aws_internet_gateway",
)
# P5 hard mode (D-109, REQ-164): `_WARN_MODE = False` (set in P3) AND
# any `acdl:*` tag key present at all is a hard FAIL (P5 tightens from
# P3's "acdl:*-only fails" to "any acdl:* key fails"). The legacy tag
# keys are fully removed from terraform (P3); any remaining `acdl:*` key
# is a rebrand regression.
_WARN_MODE = False
class NovaTaggingStandard(BaseResourceCheck):
def __init__(self):
name = "Ensure all taggable AWS resources have required Nova tags"
check_id = "NOVA_TAG_NAMING"
supported_resources = ["*"] # all resources
categories = [CheckCategories.GENERAL_SECURITY]
super().__init__(name=name, check_id=check_id, categories=categories, supported_resources=supported_resources)
def scan_resource_conf(self, conf, entity_type):
# Skip non-taggable resources
if entity_type in NON_TAGGABLE_TYPES:
return CheckResult.PASSED
# Check for a tags block
tags = conf.get("tags")
if not tags:
return CheckResult.FAILED
tag_keys = set()
if isinstance(tags, list) and tags:
tag_block = tags[0]
if isinstance(tag_block, dict):
tag_keys = set(tag_block.keys())
elif isinstance(tags, dict):
tag_keys = set(tags.keys())
# P5 (REQ-164): any legacy acdl:* tag key present = hard FAIL.
legacy_present = tag_keys & set(LEGACY_TAGS)
if legacy_present:
return CheckResult.FAILED
missing = [t for t in REQUIRED_TAGS if t not in tag_keys]
if not missing:
return CheckResult.PASSED
return CheckResult.FAILED
check = NovaTaggingStandard()
contracts/microservice.dev.yml
+1 -1
View File
@@ -1,4 +1,4 @@
# ACDL sample consumer contract — microservice module (dev)
# Nova sample consumer contract — microservice module (dev)
# Per-environment contract (REQ-105). Promotion = running the dev job;
# no environment field editing. Interpolation resolves against dev.json.
id: msvc
contracts/microservice.dr.yml
+1 -1
View File
@@ -1,4 +1,4 @@
# ACDL sample consumer contract — microservice module (dr)
# Nova sample consumer contract — microservice module (dr)
# Per-environment contract (REQ-105). Promotion = running the dr job;
# no environment field editing. Interpolation resolves against dr.json.
id: msvc
contracts/microservice.prod.yml
+1 -1
View File
@@ -1,4 +1,4 @@
# ACDL sample consumer contract — microservice module (prod)
# Nova sample consumer contract — microservice module (prod)
# Per-environment contract (REQ-105). Promotion = running the prod job;
# no environment field editing. Interpolation resolves against prod.json.
id: msvc
contracts/microservice.qa.yml
+1 -1
View File
@@ -1,4 +1,4 @@
# ACDL sample consumer contract — microservice module (qa)
# Nova sample consumer contract — microservice module (qa)
# Per-environment contract (REQ-105). Promotion = running the qa job;
# no environment field editing. Interpolation resolves against qa.json.
id: msvc
contracts/microservice.yml
+1 -1
View File
@@ -1,4 +1,4 @@
# ACDL sample consumer contract — microservice module (dev)
# Nova sample consumer contract — microservice module (dev)
#
# Reference example for an ECS Fargate microservice deployment.
# Interpolation (D-081): bucket_name uses the naming pattern that includes
contracts/static-assets.dev.yml
+1 -1
View File
@@ -1,4 +1,4 @@
# ACDL sample consumer contract — static-assets module (dev)
# Nova sample consumer contract — static-assets module (dev)
# Per-environment contract (REQ-105). The dev default
# (contracts/static-assets.yml) remains for backwards compat; this file
# is the explicit per-env dev contract. Interpolation resolves against dev.json.
contracts/static-assets.dr.yml
+1 -1
View File
@@ -1,4 +1,4 @@
# ACDL sample consumer contract — static-assets module (dr)
# Nova sample consumer contract — static-assets module (dr)
# Per-environment contract (REQ-105). Promotion = running the dr job;
# no environment field editing. Interpolation resolves against dr.json.
id: assets
contracts/static-assets.prod.yml
+1 -1
View File
@@ -1,4 +1,4 @@
# ACDL sample consumer contract — static-assets module (prod)
# Nova sample consumer contract — static-assets module (prod)
# Per-environment contract (REQ-105). Promotion = running the prod job;
# no environment field editing. Interpolation resolves against prod.json.
id: assets
contracts/static-assets.qa.yml
+1 -1
View File
@@ -1,4 +1,4 @@
# ACDL sample consumer contract — static-assets module (qa)
# Nova sample consumer contract — static-assets module (qa)
# Per-environment contract (REQ-105). Promotion = running the qa job;
# no environment field editing. Interpolation resolves against qa.json.
id: assets
contracts/static-assets.yml
+1 -1
View File
@@ -1,4 +1,4 @@
# ACDL sample consumer contract — static-assets module (dev)
# Nova sample consumer contract — static-assets module (dev)
#
# This is the reference example for a consumer contract. It declares:
# id: short operational acronym (becomes stack.name for state, tags, evidence)
core/attestation_matrix.py
+14 -4
View File
@@ -14,7 +14,8 @@ concerns split into two tiers:
The operator-supplied evidence artifact is a JSON blob with `timestamp`,
`type`, `payload`, and an optional `signature` (JWS detached). Freshness
is validated against the window from §10.4. Signature verification runs
when `ACDL_ATTESTATION_SIGNING_KEY_ID` is set; it is skipped + logged
when `NOVA_ATTESTATION_SIGNING_KEY_ID` is set (dual-read via core/env.py:
NOVA_* preferred, ACDL_* fallback until P5); it is skipped + logged
when unset (dev/CI — D-089). The matrix fails loud if an operator-supplied
concern is missing or expired for prod/dr.
"""
@@ -24,6 +25,14 @@ import os
import sys
from typing import Optional, Tuple
# Repo root on sys.path so `from core import env` resolves to THIS package
# when run as a script (avoids editable-installed third-party `core` shadow).
_REPO_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
if _REPO_ROOT not in sys.path:
sys.path.insert(0, _REPO_ROOT)
from core import env
# Freshness windows (days) from hitl_matrix_design.md §10.4.
FRESHNESS_DAYS = {
@@ -81,14 +90,15 @@ def _is_fresh(artifact: dict, concern: str) -> bool:
def _verify_signature(artifact: dict) -> bool:
"""Verify the JWS detached signature when ACDL_ATTESTATION_SIGNING_KEY_ID is set.
"""Verify the JWS detached signature when NOVA_ATTESTATION_SIGNING_KEY_ID is set.
When unset (dev/CI — D-089), signature verification is skipped + logged.
Dual-read via core/env.py: NOVA_* preferred, ACDL_* fallback until P5.
"""
key_id = os.environ.get("ACDL_ATTESTATION_SIGNING_KEY_ID", "")
key_id = env.get_env("ATTESTATION_SIGNING_KEY_ID", "") or ""
if not key_id:
sys.stderr.write(
"[attestation] ACDL_ATTESTATION_SIGNING_KEY_ID unset — "
"[attestation] NOVA_ATTESTATION_SIGNING_KEY_ID unset — "
"signature verification skipped (dev/CI, D-089)\n"
)
return True
core/contract_resolver.py
+14 -3
View File
@@ -36,6 +36,16 @@ import sys
import yaml
import jsonschema
# Ensure the repo root (parent of core/) is on sys.path so `from core
# import env` resolves to THIS package when contract_resolver.py is run
# as a script (python3 core/contract_resolver.py) — otherwise an
# editable-installed third-party `core` package can shadow it.
_REPO_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
if _REPO_ROOT not in sys.path:
sys.path.insert(0, _REPO_ROOT)
from core import env
def _load_env(env_name, repo_root):
"""Load the environment onboarding JSON for env_name.
@@ -620,9 +630,10 @@ if __name__ == "__main__":
idx = sys.argv.index("--environment")
if idx + 1 < len(sys.argv):
env_override = sys.argv[idx + 1]
# Also honor the ACDL_ENVIRONMENT_OVERRIDE env var (used by run_platform.sh).
if env_override is None and os.environ.get("ACDL_ENVIRONMENT_OVERRIDE"):
env_override = os.environ["ACDL_ENVIRONMENT_OVERRIDE"]
# Also honor the NOVA_ENVIRONMENT_OVERRIDE env var (used by run_platform.sh).
# Dual-read via core/env.py: NOVA_* preferred, ACDL_* fallback until P5.
if env_override is None and env.get_env("ENVIRONMENT_OVERRIDE"):
env_override = env.get_env("ENVIRONMENT_OVERRIDE")
result = resolve(contract_path, environment_override=env_override)
with open(out_path, "w") as fh:
json.dump(result, fh, indent=2)
core/env.py
+31
View File
@@ -0,0 +1,31 @@
"""Environment helper (D-108, REQ-159, REQ-164).
During the Nova rebrand transition window (P2–P4), `get_env` read
`NOVA_*` preferred with the legacy `ACDL_*` name as the fallback. **P5
(REQ-164) removed the fallback** — `get_env` now reads `NOVA_*` only.
`get_env(name, default=None)` resolves `NOVA_<name>`, then returns
`default` if unset. Direct-read paths that bypass this helper (the
`.env.secrets` shell export in `scripts/run_platform.sh` and the Python
parser in `core/regression_verify.py`) were updated to NOVA-only in P5
(the G-106 dual-read contract was retired with the fallback).
"""
from __future__ import annotations
import os
from typing import Optional
__all__ = ["get_env"]
def get_env(name: str, default: Optional[str] = None) -> Optional[str]:
"""Resolve a config value from the `NOVA_*` environment.
`name` is the bare key WITHOUT the prefix (e.g. ``"AWS_ACCOUNT_ID"``).
Returns ``NOVA_<name>`` if set and non-empty, else ``default``.
"""
val = os.environ.get(f"NOVA_{name}")
if val:
return val
return default
core/hitl_matrix_design.md
+3 -3
View File
@@ -93,7 +93,7 @@ The full table (lifted verbatim from §10.4):
The operator-supplied evidence artifact is a JSON blob with `timestamp`,
`type`, `payload`, and an optional `signature` (JWS detached). Freshness
is validated against the window above. Signature verification runs when
`ACDL_ATTESTATION_SIGNING_KEY_ID` is set; it is skipped + logged when
`NOVA_ATTESTATION_SIGNING_KEY_ID` is set; it is skipped + logged when
unset (dev/CI — D-089). The matrix fails loud if an operator-supplied
concern is missing or expired for prod/dr.
@@ -140,7 +140,7 @@ not Kyverno (in v1). Sequence:
in the same process that has authority to block the promotion.
v1.9 implements `route_halt_artifact` as a real SNS publish (topic
`acdl-sod-halt`, ARN from `ACDL_SOD_HALT_TOPIC_ARN`) with an outbox-event
`acdl-sod-halt`, ARN from `NOVA_SOD_HALT_TOPIC_ARN`) with an outbox-event
fallback when the topic ARN is unset (REQ-107). The attestation gate
itself is `core/hitl_gates.py` (`attest(contract_id, env, approver,
evidence)`), which records the approver to the outbox, runs the SoD
@@ -171,5 +171,5 @@ v1.9 (Phase 41 + Phase 42) wires the gates end-to-end:
concerns run for real; operator-supplied concerns accept signed
evidence artifacts validated for freshness + schema.
- **D-089** (v1.9) — attestation artifact signature verification is
skipped when `ACDL_ATTESTATION_SIGNING_KEY_ID` is unset (dev/CI);
skipped when `NOVA_ATTESTATION_SIGNING_KEY_ID` is unset (dev/CI);
required for prod/dr.
core/lambda/contract_ingestor.py
+7 -7
View File
@@ -2,7 +2,7 @@
Invoked via a Function URL (IAM auth) by consumer pipelines (one-way
communication, D-051). Accepts { consumerRepo, contractId, contract,
environment, action } and writes contracts to DynamoDB table acdl-contracts
environment, action } and writes contracts to DynamoDB table nova-contracts
(PK consumerRepo, SK contractId#submittedAt).
The report_error action (D-055) creates a GitHub issue on the platform repo
@@ -22,10 +22,10 @@ import urllib.parse
import boto3
TABLE_NAME = os.environ.get("CONTRACTS_TABLE", "acdl-contracts")
CHANGE_REQUESTS_TABLE = os.environ.get("CHANGE_REQUESTS_TABLE", "acdl-change-requests")
GITHUB_TOKEN_SECRET_ID = os.environ.get("GITHUB_TOKEN_SECRET_ID", "acdl/github-token")
PLATFORM_REPO = os.environ.get("PLATFORM_REPO", "acdl/acdl")
TABLE_NAME = os.environ.get("CONTRACTS_TABLE", "nova-contracts")
CHANGE_REQUESTS_TABLE = os.environ.get("CHANGE_REQUESTS_TABLE", "nova-change-requests")
GITHUB_TOKEN_SECRET_ID = os.environ.get("GITHUB_TOKEN_SECRET_ID", "nova/github-token")
PLATFORM_REPO = os.environ.get("PLATFORM_REPO", "nova/acdl")
# P1-9: Forge-agnostic API base URL. Defaults to GitHub; set GITHUB_API_BASE
# to a Gitea API root (e.g. https://git.cloudinit.dev/api/v1) for Gitea.
GITHUB_API_BASE = os.environ.get("GITHUB_API_BASE", "https://api.github.com")
@@ -243,7 +243,7 @@ def _validate_caller_identity(event, payload):
error length. The ABAC reliance is documented here: the Function URL IAM
identity does not expose principal tags in the event, so full enforcement
of consumerRepo ownership is at the IAM layer (ABAC via
aws:PrincipalTag/acdl:owner). This function validates format only, not
aws:PrincipalTag/nova:owner). This function validates format only, not
ownership.
"""
identity = event.get("requestContext", {}).get("identity", {})
@@ -279,7 +279,7 @@ def _validate_caller_identity(event, payload):
def _validate_change_request(payload):
"""REQ-93: Validate a change request ID against the CMDB (DynamoDB).
Queries the acdl-change-requests table for the given changeRequestId.
Queries the nova-change-requests table for the given changeRequestId.
Returns the CR details if status is 'approved' and the consumerRepo matches.
Raises ValueError if the CR is not found, not approved, or the repo doesn't match.
"""
core/local_emulators.py
+18 -6
View File
@@ -12,7 +12,8 @@ evidence event) runs end-to-end against the local tier with no AWS:
Each adapter exposes the same interface as the live counterpart so the
caller code path is unchanged; only the I/O target swaps. Selection is
gated on the ACDL_LOCAL_TIER env var (set by run_platform.sh --local).
gated on the NOVA_LOCAL_TIER env var (set by run_platform.sh --local).
Dual-read via core/env.py: NOVA_* preferred, ACDL_* fallback until P5.
"""
from __future__ import annotations
@@ -32,12 +33,20 @@ from dataclasses import dataclass, field
from pathlib import Path
from typing import Any, Dict, List, Optional, Tuple
# Repo root on sys.path so `from core import env` resolves to THIS package
# when run as a script (avoids editable-installed third-party `core` shadow).
_REPO_ROOT = str(Path(__file__).resolve().parent.parent)
if _REPO_ROOT not in sys.path:
sys.path.insert(0, _REPO_ROOT)
from core import env
ROOT = Path(__file__).resolve().parent.parent
def is_local_tier() -> bool:
"""True when the local emulating tier is active."""
return os.environ.get("ACDL_LOCAL_TIER", "") == "1"
return env.get_env("LOCAL_TIER", "") == "1"
# ---------------------------------------------------------------------------
@@ -78,7 +87,7 @@ class FlatFileOutbox:
return hashlib.sha256(canonical.encode("utf-8")).hexdigest()
def write_event(self, event: Dict[str, Any],
outbox_table: str = "acdl-outbox-local",
outbox_table: str = "nova-outbox-local",
region: str = "local") -> Dict[str, Any]:
"""Write an evidence event to the flat-file outbox.
@@ -286,7 +295,7 @@ class LocalLambdaStub:
Returns the handler's response dict
({statusCode, body}). The handler's DynamoDB calls are
intercepted via the ACDL_LOCAL_TIER env var (the handler checks
intercepted via the NOVA_LOCAL_TIER env var (the handler checks
_get_dynamodb(); under local tier it would need patching - we
patch the module's _get_dynamodb to return a local stub)."""
# Import the handler module (the dir is named `lambda`, a Python
@@ -419,7 +428,7 @@ def run_local_e2e(contract_path: str, repo_root: Optional[Path] = None) -> Dict[
stack = resolve(contract_path, str(root))
stack_name = stack["stack"]["name"]
work = Path(tempfile.mkdtemp(prefix="acdl_local_e2e_"))
work = Path(tempfile.mkdtemp(prefix="nova_local_e2e_"))
tf_dir = work / "tf"
tf_dir.mkdir(exist_ok=True)
adapter.adapt(stack, str(tf_dir))
@@ -490,6 +499,9 @@ def run_local_e2e(contract_path: str, repo_root: Optional[Path] = None) -> Dict[
if __name__ == "__main__":
contract = sys.argv[1] if len(sys.argv) > 1 else "contracts/microservice.yml"
os.environ["ACDL_LOCAL_TIER"] = "1"
# Set both so the dual-read in is_local_tier() finds NOVA_* (preferred);
# the ACDL_* alias stays for any unmigrated reader until P5.
os.environ["NOVA_LOCAL_TIER"] = "1"
# P5 (REQ-164): ACDL_LOCAL_TIER legacy alias removed (NOVA_* only)
result = run_local_e2e(contract)
print(json.dumps(result, indent=2))
core/outbox_writer.py
+3 -3
View File
@@ -1,11 +1,11 @@
"""ACDL Outbox Writer — write an evidence event to the DynamoDB outbox.
"""Nova Outbox Writer — write an evidence event to the DynamoDB outbox.
ARCHITECTURE.md §9: DynamoDB outbox, RPO=0 (synchronous write before
ack). The event is hash-chained (SHA-256 over canonical JSON); the first
event has prev_event_hash="GENESIS". D-P10-3: the spike writes ONE
CONFIDENCE_COMPUTED event.
The outbox table (Phase 08): acdl-outbox, PAY_PER_REQUEST, PK contractId,
The outbox table (Phase 08): nova-outbox, PAY_PER_REQUEST, PK contractId,
SK eventType#eventTs, TTL expire_at = now + 365d (D-044).
CLI: outbox_writer.py <event.json> (uses AWS creds from env)
@@ -20,7 +20,7 @@ import sys
import boto3
OUTBOX_TABLE = "acdl-outbox"
OUTBOX_TABLE = "nova-outbox"
REGION = os.environ.get("AWS_DEFAULT_REGION", "us-east-1")
core/output_publisher.py
+24 -12
View File
@@ -8,8 +8,10 @@ Two canonical mechanisms:
strings, ALB DNS, S3 bucket URL, CloudFront domain). No raw secrets in
the comment — only non-sensitive outputs (DNS names, ARNs, bucket names).
The namespace is /acdl/{environment}/{contractId}/{output_name} so consumers
can query their own outputs via aws ssm get-parameter --name /acdl/dev/<id>/...
The namespace is /nova/{environment}/{contractId}/{output_name} so consumers
can query their own outputs via aws ssm get-parameter --name /nova/dev/<id>/...
(REQ-161, P3: migrated from /acdl/... ; scripts/migrate_ssm_paths.py copies
existing /acdl/... parameters to /nova/... and deletes the old ones.)
"""
import json
@@ -21,8 +23,16 @@ try:
except ImportError:
boto3 = None
SSM_PREFIX = "/acdl"
KMS_KEY_ID_ENV = "ACDL_KMS_KEY_ID"
# Repo root on sys.path so `from core import env` resolves to THIS package
# when run as a script (avoids editable-installed third-party `core` shadow).
_REPO_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
if _REPO_ROOT not in sys.path:
sys.path.insert(0, _REPO_ROOT)
from core import env as _envhelper
SSM_PREFIX = "/nova"
KMS_KEY_ID_ENV = "NOVA_KMS_KEY_ID"
# Outputs that are safe to display in a PR comment (no secrets).
SAFE_OUTPUT_NAMES = {
@@ -54,20 +64,22 @@ def _ssm_client():
def _kms_key_id():
"""Return the KMS key ID for SSM SecureString encryption.
P1-3: Fail loud when ACDL_KMS_KEY_ID is not set — silently falling back
P1-3: Fail loud when NOVA_KMS_KEY_ID is not set — silently falling back
to the AWS-managed key (`alias/aws/ssm`) was a security gap. The platform
CMK must be explicitly configured. Set ACDL_ALLOW_DEFAULT_KMS=1 to use
the AWS-managed key as an escape hatch for local testing.
CMK must be explicitly configured. Set NOVA_ALLOW_DEFAULT_KMS=1 to use
the AWS-managed key as an escape hatch for local testing. (Dual-read
via core/env.py: NOVA_* preferred, ACDL_* fallback until P5.)
"""
key_id = os.environ.get(KMS_KEY_ID_ENV)
key_id = _envhelper.get_env("KMS_KEY_ID")
if key_id:
return key_id
if os.environ.get("ACDL_ALLOW_DEFAULT_KMS") == "1":
if _envhelper.get_env("ALLOW_DEFAULT_KMS") == "1":
return "alias/aws/ssm"
raise RuntimeError(
f"{KMS_KEY_ID_ENV} is not set — refusing to use the AWS-managed SSM key "
f"silently. Set {KMS_KEY_ID_ENV} to your platform CMK ARN, or set "
f"ACDL_ALLOW_DEFAULT_KMS=1 to use alias/aws/ssm (escape hatch for local testing)."
f"NOVA_ALLOW_DEFAULT_KMS=1 (ACDL_ALLOW_DEFAULT_KMS=1 fallback) to use "
f"alias/aws/ssm (escape hatch for local testing)."
)
@@ -112,7 +124,7 @@ def format_comment(outputs, environment, contract_id, ssm_results=None):
outputs are noted as 'published to SSM' without their values.
"""
lines = [
f"### ACDL Deploy Outputs ({environment})",
f"### Nova Deploy Outputs ({environment})",
"",
f"**Contract:** `{contract_id}`",
f"**Environment:** `{environment}`",
@@ -134,7 +146,7 @@ def format_comment(outputs, environment, contract_id, ssm_results=None):
ssm_path = "—"
lines.append(f"| `{name}` | {display} | {ssm_path} |")
lines.append("")
lines.append("> Sensitive outputs are available via `aws ssm get-parameter --name /acdl/" + environment + "/" + contract_id + "/<output_name>` (KMS-encrypted SecureString).")
lines.append("> Sensitive outputs are available via `aws ssm get-parameter --name /nova/" + environment + "/" + contract_id + "/<output_name>` (KMS-encrypted SecureString).")
return "\n".join(lines)
core/regression_verify.py
+25 -14
View File
@@ -32,6 +32,15 @@ from dataclasses import dataclass, field, asdict
from pathlib import Path
from typing import Callable, Dict, List, Optional, Tuple
# Repo root on sys.path so `from core import env` resolves to THIS package
# when regression_verify.py is run as a script (avoids editable-installed
# third-party `core` shadow).
_REPO_ROOT = str(Path(__file__).resolve().parent.parent)
if _REPO_ROOT not in sys.path:
sys.path.insert(0, _REPO_ROOT)
from core import env as _envhelper
ROOT = Path(__file__).resolve().parent.parent
CIAgent = ROOT / ".ciagent"
@@ -306,9 +315,10 @@ def _load_aws_env() -> Dict[str, str]:
continue
if "=" in line:
k, v = line.split("=", 1)
if k == "ACDL_AWS_ACCESS_KEY_ID":
# P5 (REQ-164): dual-read fallback removed — NOVA_* only.
if k == "NOVA_AWS_ACCESS_KEY_ID":
env["AWS_ACCESS_KEY_ID"] = v
elif k == "ACDL_AWS_SECRET_ACCESS_KEY":
elif k == "NOVA_AWS_SECRET_ACCESS_KEY":
env["AWS_SECRET_ACCESS_KEY"] = v
elif k == "AWS_DEFAULT_REGION":
env["AWS_DEFAULT_REGION"] = v
@@ -319,10 +329,11 @@ def _check_live_terraform_plan_microservice() -> Tuple[Status, str]:
"""CAP-013: terraform init+validate+plan against live AWS for the
microservice stack (D-093 live-AWS tier of the headline E2E).
Requires AWS credentials (ACDL_AWS_ACCESS_KEY_ID etc. in .env.secrets).
Requires AWS credentials (NOVA_AWS_ACCESS_KEY_ID etc. in .env.secrets;
dual-read NOVA_* first, ACDL_* fallback per G-106).
Runs in a temp dir; does NOT apply (plan only)."""
import tempfile, os
work = tempfile.mkdtemp(prefix="acdl_regr_live_")
work = tempfile.mkdtemp(prefix="nova_regr_live_")
stack_path = os.path.join(work, "stack.json")
tf_dir = os.path.join(work, "tf")
os.makedirs(tf_dir, exist_ok=True)
@@ -362,7 +373,7 @@ def _check_live_terraform_plan_static_assets() -> Tuple[Status, str]:
"""CAP-014: terraform init+validate+plan against live AWS for the
static-assets stack (CloudFront + WAF + S3)."""
import tempfile, os
work = tempfile.mkdtemp(prefix="acdl_regr_live_sa_")
work = tempfile.mkdtemp(prefix="nova_regr_live_sa_")
stack_path = os.path.join(work, "stack.json")
tf_dir = os.path.join(work, "tf")
os.makedirs(tf_dir, exist_ok=True)
@@ -406,9 +417,9 @@ def _check_dynamodb_outbox_table() -> Tuple[Status, str]:
dyn = boto3.client("dynamodb", region_name=env.get("AWS_DEFAULT_REGION", "us-east-1"),
aws_access_key_id=env.get("AWS_ACCESS_KEY_ID"),
aws_secret_access_key=env.get("AWS_SECRET_ACCESS_KEY"))
r = dyn.describe_table(TableName="acdl-outbox")
r = dyn.describe_table(TableName="nova-outbox")
count = r["Table"].get("ItemCount", "unknown")
return "Verified", f"acdl-outbox exists, item_count={count}"
return "Verified", f"nova-outbox exists, item_count={count}"
except Exception as e:
return "Decayed", f"describe_table failed: {type(e).__name__}: {str(e)[:150]}"
@@ -421,8 +432,8 @@ def _check_s3_state_bucket() -> Tuple[Status, str]:
s3 = boto3.client("s3", region_name=env.get("AWS_DEFAULT_REGION", "us-east-1"),
aws_access_key_id=env.get("AWS_ACCESS_KEY_ID"),
aws_secret_access_key=env.get("AWS_SECRET_ACCESS_KEY"))
account_id = os.environ.get("ACDL_AWS_ACCOUNT_ID", "581513795199")
state_bucket = f"acdl-tfstate-{account_id}-us-east-1"
account_id = _envhelper.get_env("AWS_ACCOUNT_ID", "581513795199")
state_bucket = f"nova-tfstate-{account_id}-us-east-1"
s3.head_bucket(Bucket=state_bucket)
r = s3.list_objects_v2(Bucket=state_bucket, MaxKeys=5)
keys = [o["Key"] for o in r.get("Contents", [])]
@@ -494,7 +505,7 @@ def _check_lifecycle_l2_module(module: str) -> Tuple[Status, str]:
def _check_cap_017_dynamodb() -> Tuple[Status, str]:
"""CAP-017: DynamoDB acdl-contracts table. Evidence = L1 rds module
"""CAP-017: DynamoDB nova-contracts table. Evidence = L1 rds module
lifecycle pipeline green (terraform validate + contracts resolve).
The DynamoDB table is created via the microservice stack (L2 lifecycle).
"""
@@ -509,7 +520,7 @@ def _check_cap_018_lambda() -> Tuple[Status, str]:
"python3", "-c",
"from core.local_emulators import LocalLambdaStub, FlatFileOutbox; "
"import tempfile; "
"stub = LocalLambdaStub(outbox=FlatFileOutbox(tempfile.mkdtemp(prefix='acdl_stub_'))); "
"stub = LocalLambdaStub(outbox=FlatFileOutbox(tempfile.mkdtemp(prefix='nova_stub_'))); "
"print('LocalLambdaStub instantiates OK')",
])
if rc != 0:
@@ -578,7 +589,7 @@ CAPABILITY_REGISTRY: List[Tuple[str, str, str, Callable[[], Tuple[Status, str]]]
_check_dynamodb_outbox_table),
("CAP-016", "S3 state bucket exists + readable (live AWS)", "live-aws",
_check_s3_state_bucket),
("CAP-017", "DynamoDB acdl-contracts table (lifecycle pipeline evidence)", "lifecycle-pipeline",
("CAP-017", "DynamoDB nova-contracts table (lifecycle pipeline evidence)", "lifecycle-pipeline",
_check_cap_017_dynamodb),
("CAP-018", "Lambda contract-ingestor (local stub + lifecycle evidence)", "lifecycle-pipeline",
_check_cap_018_lambda),
@@ -643,8 +654,8 @@ def write_report(report: RegressionReport,
def main() -> int:
milestone = os.environ.get("ACDL_REGRESSION_MILESTONE", "v1.10")
phase = int(os.environ.get("ACDL_REGRESSION_PHASE", "52"))
milestone = _envhelper.get_env("REGRESSION_MILESTONE", "v1.10") or "v1.10"
phase = int(_envhelper.get_env("REGRESSION_PHASE", "52") or "52")
report = run_regression(milestone=milestone, phase=phase)
md, js = write_report(report)
print(f"regression: {report.summary} -> {md}")
core/separation_of_duties.py
+16 -5
View File
@@ -5,16 +5,27 @@ Blocks on equality, emits `SEPARATION_OF_DUTIES_VIOLATION`, routes a halt
artifact to SRE on-call.
v1.9 (REQ-107, D-085): route_halt_artifact is a real implementation —
publishes to SNS topic `acdl-sod-halt` (ARN from ACDL_SOD_HALT_TOPIC_ARN)
publishes to SNS topic `acdl-sod-halt` (ARN from NOVA_SOD_HALT_TOPIC_ARN)
when set; falls back to a structured stderr emission + a
SEPARATION_OF_DUTIES_VIOLATION event write to the DynamoDB outbox when
unset. No silent print-only stub.
unset. No silent print-only stub. (Dual-read via core/env.py: NOVA_*
preferred, ACDL_* fallback until P5; the SNS topic ARN is the AWS
resource `acdl-sod-halt` → renamed `nova-sod-halt` in P4.)
"""
import os
import sys
from typing import Optional, Tuple
# Repo root on sys.path so `from core import env` resolves to THIS package
# when imported/run in a context where an editable-installed third-party
# `core` package would otherwise shadow it.
_REPO_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
if _REPO_ROOT not in sys.path:
sys.path.insert(0, _REPO_ROOT)
from core import env
def check(outbox_client, contract_id: str,
current_prod_approver: Optional[str]) -> Tuple[bool, str]:
@@ -40,13 +51,13 @@ def route_halt_artifact(contract_id: str, violation_reason: str,
oncall_client=None) -> None:
"""Route a halt artifact to SRE on-call (REQ-107, D-085).
When ACDL_SOD_HALT_TOPIC_ARN is set, publish to the SNS topic via
When NOVA_SOD_HALT_TOPIC_ARN is set, publish to the SNS topic via
boto3. When unset (dev/CI), fall back to a structured stderr emission
+ a SEPARATION_OF_DUTIES_VIOLATION event write to the DynamoDB outbox
via outbox_writer.write_event (so the halt is in the audit chain).
The oncall_client, when provided, is the SNS client (test injection).
"""
topic_arn = os.environ.get("ACDL_SOD_HALT_TOPIC_ARN", "")
topic_arn = env.get_env("SOD_HALT_TOPIC_ARN", "") or ""
halt_payload = {
"contractId": contract_id,
"reason": violation_reason,
@@ -63,7 +74,7 @@ def route_halt_artifact(contract_id: str, violation_reason: str,
sns.publish(
TopicArn=topic_arn,
Message=json.dumps(halt_payload),
Subject="ACDL SoD halt",
Subject="Nova SoD halt",
)
print(f"[halt-artifact] SNS published contract={contract_id} "
f"topic={topic_arn}", flush=True)
docs/NOVA_AWS_MIGRATION.md
+270
View File
@@ -0,0 +1,270 @@
# Nova AWS Resource Migration Runbook (REQ-163, P4)
> **Milestone:** v1.15-Nova (Wave 4, P4). Renames every `acdl-*` AWS
> resource name → `nova-*` via Terraform. This is the heaviest Terraform
> phase of the rebrand and requires a **maintenance window**.
>
> **Plan-validated only.** Per A1, `NOVA_LIFECYCLE_MODE` defaults to
> `plan` (no live AWS mutation from CI). `terraform validate` passes; the
> live apply steps below are executed by a platform operator during the
> scheduled maintenance window. Each step has a verification + rollback.
## Scope (renamed resources)
| AWS resource | Before | After | Strategy |
|---|---|---|---|
| KMS alias | `alias/acdl-platform` | `alias/nova-platform` | cheap rename |
| SNS topic | `acdl-sod-halt` | `nova-sod-halt` | recreate |
| Security group | `acdl-ecs-sg` | `nova-ecs-sg` | recreate |
| Lambda (role/policy/function) | `acdl-contract-ingestor` | `nova-contract-ingestor` | recreate |
| DynamoDB contracts | `acdl-contracts` | `nova-contracts` | scan + copy |
| DynamoDB change-requests | `acdl-change-requests` | `nova-change-requests` | scan + copy |
| Secrets Manager secret | `acdl/github-token` | `nova/github-token` | recreate + re-store |
| ECR repo | `acdl-microservice` | `nova-microservice` | re-push |
| ECS cluster/service/task/role | `acdl-microservice` | `nova-microservice` | recreate |
| IAM user + policy | `acdl-spike-runner` (+ `-policy`) | `nova-spike-runner` (+ `-policy`) | re-bootstrap |
| IAM act-runner role | `acdl-act-runner-role` | `nova-act-runner-role` | re-bootstrap |
| IAM deploy role | `acdl-deploy-<repo>` | `nova-deploy-<repo>` | re-bootstrap |
| S3 state bucket | `acdl-tfstate-581513795199-us-east-1` | `nova-tfstate-581513795199-us-east-1` | `-migrate-state` |
| DynamoDB outbox | `acdl-outbox` | `nova-outbox` | scan + copy |
| Platform VPC/subnet/IGW/RT | `acdl-shared*` | `nova-shared*` | recreate (brief downtime) |
| CI VPC/subnet/SG/cluster | `acdl-ci-*` | `nova-ci-*` | recreate (CI-only) |
| ALB name prefix | `acdl-alb` | `nova-alb` | recreate (brief downtime, LAST) |
## Migration ordering (binding)
Order: **KMS alias → SNS/SG → Lambda → DynamoDB → ECR → IAM → state bucket → ALB**.
Each step is independently rollback-able. The ALB is last because it
requires the briefest downtime window.
---
## Pre-flight
1. **Announce the maintenance window** (consumers are notified via the
P1 migration guide `docs/NOVA_MIGRATION.md`).
2. **Back up state** for every stack (see §State bucket — back up the
state JSON *before* `-migrate-state`).
3. Confirm `NOVA_LIFECYCLE_MODE=plan` (default) so CI does not mutate
AWS during the window.
4. Confirm the new `nova-*` destination tables/repos will be created by
the same Terraform apply (no manual pre-creation needed).
## Step 1 — KMS alias (`alias/acdl-platform` → `alias/nova-platform`)
- **Command (in `terraform/platform/`):**
```bash
terraform init -upgrade
terraform apply -replace=aws_kms_alias.nova_platform
```
(Terraform destroys the old alias + creates the new one — aliases are
cheap; the underlying key ID is unchanged.)
- **Verify:** `aws kms list-aliases --query 'Aliases[?AliasName==`alias/nova-platform`]'` returns the new alias; `alias/acdl-platform` is gone.
- **Rollback:** `terraform apply -replace=aws_kms_alias.nova_platform` against the prior revision (re-creates `alias/acdl-platform`). Resources encrypted by the key are unaffected (key ID unchanged).
## Step 2 — SNS topic + Security group (recreate)
- **Command:** `terraform apply` in `terraform/platform/`.
- SNS `acdl-sod-halt` → `nova-sod-halt` (the topic ARN changes; update `NOVA_SOD_HALT_TOPIC_ARN` wherever it is set).
- SG `acdl-ecs-sg` → `nova-ecs-sg` (the security group is re-attached to running ECS tasks; brief task restart).
- **Verify:** `aws sns list-topics` shows `nova-sod-halt`; `aws ec2 describe-security-groups` shows `nova-ecs-sg`.
- **Rollback:** `terraform apply` the prior revision re-creates the `acdl-*` names. The SNS topic has no message backlog (halt artifacts are fire-and-forget); the SG drift resolves on next task deploy.
## Step 3 — Lambda (recreate)
- **Command:** `terraform apply` in `terraform/platform/`.
- Lambda function `acdl-contract-ingestor` → `nova-contract-ingestor`.
- Execution role `acdl-contract-ingestor-role` → `nova-contract-ingestor-role`.
- Inline policy `acdl-contract-ingestor-policy` → `nova-contract-ingestor-policy`.
- The Lambda env vars (`CONTRACTS_TABLE`, `GITHUB_TOKEN_SECRET_ID`) now resolve to `nova-*` defaults.
- **Verify:** `aws lambda list-functions` shows `nova-contract-ingestor`; the Function URL returns 200 on a SigV4-signed invoke. The `consumer_invoke_policy.json` rendered output (Terraform `consumer_invoke_policy_rendered`) now references `function:nova-contract-ingestor` — re-distribute to consumer deploy roles.
- **Rollback:** `terraform apply` the prior revision re-creates `acdl-contract-ingestor`. Consumer deploy roles must point back at the old Function ARN (re-distribute the prior `consumer_invoke_policy.json`).
## Step 4 — DynamoDB (scan + copy)
DynamoDB table names are immutable post-creation, so the migration is a
**scan + copy** (not a rename). The new `nova-*` tables are created by
the same Terraform apply (Step 3). The data-migration script copies
every item and verifies row counts.
- **Command (from repo root):**
```bash
# Dry-run first (no writes):
python3 scripts/migrate_dynamodb_data.py
# Execute the copy:
python3 scripts/migrate_dynamodb_data.py --apply
# A single table:
python3 scripts/migrate_dynamodb_data.py --table contracts --apply
```
The script scans `acdl-contracts` → copies to `nova-contracts`, and
`acdl-change-requests` → `nova-change-requests`, then verifies the
destination row count == source row count (re-scan, not
`DescribeTable.ItemCount` which lags ~6h).
- **Verify:**
```bash
# Row counts must match (printed by the script). Manual cross-check:
aws dynamodb scan --table-name nova-contracts --select COUNT
aws dynamodb scan --table-name acdl-contracts --select COUNT
```
Then **point consumers at the new tables** (the Lambda already reads
`nova-*` defaults; any direct DynamoDB consumers update their env).
- **Keep the old tables** (`acdl-contracts`, `acdl-change-requests`)
until consumers are verified reading from `nova-*`. **Deletion is a
manual post-verification step:**
```bash
aws dynamodb delete-table --table-name acdl-contracts
aws dynamodb delete-table --table-name acdl-change-requests
```
Only delete after a full soak period confirms `nova-*` reads succeed.
- **Rollback:** Re-point consumers at `acdl-*` (the old tables are
retained). The copy is additive (no data loss). To roll back a partial
copy, re-run `--apply` (idempotent — `PutItem` overwrites).
### Outbox table (`acdl-outbox` → `nova-outbox`)
The evidence outbox table follows the same scan+copy pattern (it is
created by `terraform/bootstrap/create_state_backend.py`).
- **Command:** `python3 scripts/migrate_dynamodb_data.py --source acdl-outbox --dest nova-outbox --apply`
- The `core/outbox_writer.py` default + `core/regression_verify.py`
CAP-015 probe now reference `nova-outbox` (P4 updated both). The
regression gate's live-AWS CAP-015 will return `Verified` once the
`nova-outbox` table exists live; until then it is `Decayed` (the gate
is re-run at milestone complete after the live migration).
## Step 5 — ECR (re-push)
- **Command:** `terraform apply` in `terraform/microservice/` creates
the new `nova-microservice` ECR repo. Re-push the image:
```bash
python3 scripts/push_consumer_image.py # creates nova-microservice + prints docker tag/push
```
(The script's `ECR_REPO_NAME` is now `nova-microservice`.)
- **Verify:** `aws ecr describe-repositories` shows `nova-microservice`; `docker pull <acct>.dkr.ecr.us-east-1.amazonaws.com/nova-microservice:latest` succeeds.
- **Rollback:** The old `acdl-microservice` repo is retained until the
soak passes. Re-push to it if a rollback is needed. Delete it manually:
`aws ecr delete-repository --repository-name acdl-microservice --force`.
## Step 6 — IAM (re-bootstrap)
- **Command:**
```bash
export NOVA_BOOTSTRAP_AWS_ACCESS_KEY_ID="<root key>"
export NOVA_BOOTSTRAP_AWS_SECRET_ACCESS_KEY="<root secret>"
python3 terraform/bootstrap/create_state_backend.py # creates nova-outbox (idempotent)
python3 terraform/bootstrap/create_iam_user.py # creates nova-spike-runner
python3 terraform/bootstrap/apply_iam_baseline.py # creates nova-spike-runner-policy + nova-act-runner-role
bash scripts/rotate_spike_key.sh # rotates the nova-spike-runner key
```
The deploy role `acdl-deploy-<repo>` → `nova-deploy-<repo>` is
created by the bootstrap (the deploy workflow
`.gitea/.github/workflows/deploy.yml` now references
`role/nova-deploy-{1}`).
- **Verify:** `aws iam get-user --user-name nova-spike-runner`;
`aws iam list-attached-user-policies --user-name nova-spike-runner`
shows `nova-spike-runner-policy`;
`aws iam get-role --role-name nova-act-runner-role`.
- **Rollback:** Re-run the prior bootstrap scripts (they create
`acdl-spike-runner` + `acdl-act-runner-role`). The deploy workflow's
`role-to-assume` must be reverted to `acdl-deploy-` (prior revision).
## Step 7 — State bucket (`acdl-tfstate-*` → `nova-tfstate-*`, `-migrate-state`)
The S3 state backend is renamed. Terraform's `-migrate-state` copies the
state objects to the new bucket. **Back up the state JSON first.**
- **Back up state (per stack):**
```bash
for stack in platform microservice ci-vpc; do
aws s3 cp s3://acdl-tfstate-581513795199-us-east-1/$stack/terraform.tfstate \
./backup-$stack.tfstate
done
```
- **Command (per stack):** the backend config in each
`terraform/*/terraform.tf` now points at `nova-tfstate-...`.
```bash
cd terraform/platform
terraform init -migrate-state # copies state acdl-tfstate → nova-tfstate
cd ../microservice
terraform init -migrate-state
cd ../ci-vpc
terraform init -migrate-state
```
- **Verify:** `aws s3 ls s3://nova-tfstate-581513795199-us-east-1/`
shows the state keys; `terraform state list` in each dir lists the
expected resources.
- **Rollback:** Point the backend back at `acdl-tfstate-*` and re-run
`terraform init -migrate-state` (restores from the backup bucket). The
old `acdl-tfstate-*` bucket is retained until the soak passes. Delete
it manually:
`aws s3 rb s3://acdl-tfstate-581513795199-us-east-1 --force`.
## Step 8 — ALB (recreate, brief downtime, LAST)
The ALB is last because its recreation requires the briefest downtime
window (the ECS service is re-attached to the new target group).
- **Command:** `terraform apply` in `terraform/microservice/`. The ALB
`acdl-microservice` / `acdl-alb` → `nova-microservice` / `nova-alb`.
- **Verify:** `aws elbv2 describe-load-balancers` shows the new ALB;
`curl http://<new-alb-dns>/` returns 200.
- **Rollback:** `terraform apply` the prior revision re-creates the
`acdl-*` ALB (brief downtime again). The old ALB DNS is retained until
consumers are re-pointed.
---
## Post-migration
1. **Soak:** run consumers against `nova-*` for a full verification
window (deploy a test contract end-to-end).
2. **Delete old resources** (manual, only after soak):
- DynamoDB: `acdl-contracts`, `acdl-change-requests`, `acdl-outbox`
- ECR: `acdl-microservice`
- IAM: `acdl-spike-runner` (+ policy), `acdl-act-runner-role`,
`acdl-deploy-<repo>`
- S3: `acdl-tfstate-581513795199-us-east-1`
- SNS: `acdl-sod-halt`
- SG: `acdl-ecs-sg`
- Secrets Manager: `acdl/github-token`
- KMS alias: `alias/acdl-platform`
- ALB: `acdl-alb` / `acdl-microservice`
3. **Regression gate:** re-run `bash scripts/run_regression.sh`. The
live-AWS CAP-013..016 probes should return `Verified` (the `nova-*`
tables + state bucket exist). CAP-015 (outbox) flips from `Decayed`
→ `Verified` once `nova-outbox` is live.
## What P5 owns (not P4)
- **Remove dual-read fallback:** `core/env.py` `get_env()` drops the
`ACDL_*` fallback; shell scripts drop `:-$ACDL_X`. P4 keeps the
dual-read (deployments don't break mid-window).
- **`nova_tagging.py` hard-fail on `acdl:*`:** P3 set hard mode (no
`acdl:*`-only tags); P5 tightens to fail on any `acdl:*` presence. P4
leaves P3's behavior.
- **Delete `ACDL_*` Gitea secrets:** the `NOVA_*` aliases created in P2
are now the only source.
- **Finalize `docs/NOVA_MIGRATION.md`:** mark the migration complete
(cutoff passed).
- **Milestone ship:** tag `v1.15.4`, merge to `main`, Gitea release.
## Files touched in P4
- `terraform/platform/main.tf`, `terraform/microservice/main.tf`,
`terraform/ci-vpc/main.tf` — resource renames + backend bucket.
- `terraform/{platform,microservice,ci-vpc}/terraform.tf` — state bucket.
- `terraform/platform/consumer_invoke_policy.json` — Lambda ARN.
- `terraform/bootstrap/{create_state_backend,create_iam_user,apply_iam_baseline}.py`,
`spike_runner_policy.json`, `.bootstrap_state.json`, `README.md` —
IAM/outbox/state-bucket renames.
- `modules/l1/*/terraform/**` + `modules/l1/alb/instance.json` — L1
resource-name defaults.
- `modules/l2/microservice/composition.json` — `nova-app-role` default.
- `core/lambda/contract_ingestor.py` — default table names (D-111).
- `core/outbox_writer.py`, `core/regression_verify.py`,
`core/local_emulators.py` — outbox table consistency (cross-territory,
minimal).
- `.gitea/workflows/deploy.yml` + `.github/workflows/deploy.yml` —
`nova-deploy-` role ARN + artifact names.
- `scripts/migrate_dynamodb_data.py` (NEW), `scripts/rotate_spike_key.sh`,
`scripts/push_consumer_image.py`.
- `tests/**` — fixtures updated to assert `nova-*`.
docs/NOVA_MIGRATION.md
+177
View File
@@ -0,0 +1,177 @@
# Nova Migration Guide — What Consumers Must Know
> **STATUS: COMPLETE (milestone v1.15.4, 2026-07-30).** The Nova rebrand
> is fully rolled out. The dual-read / parallel-write grace period has
> ended (P5 cutoff passed). All `ACDL_*` env var fallbacks, `.acdl/`
> consumer-path fallbacks, `/acdl/` SSM-path fallbacks, `acdl:*` tag-key
> fallbacks, and `acdl-*` AWS resource names are removed. Consumers must
> use the `NOVA_*` / `.nova/` / `/nova/` / `nova:*` / `nova-*` names
> exclusively. If you have not yet migrated, follow the steps below.
> **Nova** is the new product brand for the platform formerly known as
> **ACDL** (Agentic Cloud Delivery Platform). This guide documents the
> breaking changes from the rebrand rollout (Phases P2–P4, cutoff P5)
> and tells you exactly what to do.
## What is NOT changing
- **The Gitea repository name** (`continuous-intelligence/acdl`) is **not**
changing. Only the product brand is changing. The `uses:` reference
(`acdl/.github/workflows/deploy.yml@vX.Y`) and the GitHub `acdl/acdl` repo
path are unchanged for the duration of the rebrand; the workflow
`uses:` reference will be migrated in a later, separately-announced step.
- **The platform behavior** is unchanged. Same pipeline stages, same
contract schema, same confidence model, same evidence stream, same
modules. Only the brand, the on-disk path, the env var names, the SSM
path, the AWS tag keys, and the AWS resource names are changing.
## The 5 breaking changes
Five things that consumers may reference are being renamed. Each is
scheduled into a phase, ships with a grace period, and has a cutoff.
### 1. Consumer contract path — Phase P2
- **Old:** `.acdl/contract.yml`
- **New:** `.nova/contract.yml`
- **Phase:** P2 (env vars + consumer path)
- **Grace period:** during P2–P4 the deploy workflow reads **both** paths
(`.nova/contract.yml` first, falling back to `.acdl/contract.yml` if the
new path is absent). Your existing contracts keep working until P5.
- **Cutoff:** P5 removes the `.acdl/` fallback. Move your contract file
before P5.
- **What you must do:** rename the directory in your consumer repo from
`.acdl/` to `.nova/` and update any `contract:` workflow input that
points at the old path. Nothing else changes in the contract content.
### 2. Environment variables — Phase P2
- **Old:** `ACDL_*` (e.g. `ACDL_LIFECYCLE_MODE`, `ACDL_AWS_ACCOUNT_ID`,
`ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID`, …)
- **New:** `NOVA_*` (e.g. `NOVA_LIFECYCLE_MODE`, `NOVA_AWS_ACCOUNT_ID`,
`NOVA_BOOTSTRAP_AWS_ACCESS_KEY_ID`, …)
- **Phase:** P2 (env vars + consumer path)
- **Grace period — dual-read fallback:** during P2–P4 the platform reads
**`NOVA_*` first, then falls back to `ACDL_*`** if the Nova variable is
unset. This means your CI secrets, workflow env blocks, and local
`.env.secrets` keep working unchanged through P4. You do not need to
rename everything in one shot — rename a variable and the dual-read picks
it up; leave one old and it still resolves.
- **Cutoff:** P5 removes the `ACDL_*` fallback. After P5, only `NOVA_*`
is read.
- **What you must do:** rename your `ACDL_*` CI secrets, workflow `env:`
blocks, and any local `.env.secrets` entries to `NOVA_*`. Because of the
dual-read, you can do this incrementally across P2–P4 — but it must be
complete before P5.
### 3. SSM parameter path — Phase P3 (DONE)
- **Old:** `/acdl/{env}/{contractId}/{output}`
- **New:** `/nova/{env}/{contractId}/{output}`
- **Phase:** P3 (SSM paths + tag keys) — **shipped in P3**
- **Grace period — parallel-write:** during P3–P4 the platform **writes
every output to both** the `/acdl/…` and `/nova/…` SSM paths, and reads
from `/nova/…` first (falling back to `/acdl/…`). Any hardcoded SSM path
reads in your application code keep resolving through P4. The P3
migration script (`scripts/migrate_ssm_paths.py`) copies existing
`/acdl/…` parameters to `/nova/…`, verifies the copy, and deletes the
old ones.
- **Cutoff:** P5 stops writing to `/acdl/…` and removes the read fallback.
After P5 only `/nova/…` exists.
- **What you must do:** if your application code or runbooks read deploy
outputs from SSM by hardcoded path, update the path prefix from `/acdl/`
to `/nova/`. If you consume outputs only via the PR-comment / GitHub
issue surface, you do nothing — the platform republishes under the new
path automatically.
### 4. AWS tag keys — Phase P3 (DONE)
- **Old:** `acdl:owner`, `acdl:environment`, `acdl:contract`,
`acdl:cost-center`, `acdl:ref`
- **New:** `nova:owner`, `nova:environment`, `nova:contract`,
`nova:cost-center`, `nova:ref`
- **Phase:** P3 (SSM paths + tag keys) — **shipped in P3**
- **Grace period — parallel-tag period:** during P3–P4 the platform
**tags every resource with both** the `acdl:*` and `nova:*` keys (same
values). The ABAC session policy matches on **either** key set, so your
existing scoped permissions keep working. The default cost-center value
moves from `acdl-default` to `nova-default` (both written during the
parallel-tag period). Terraform now emits `nova:*` keys; old `acdl:*`
tags on pre-P3 live resources are removed by the P4 runbook's
`scripts/untag_acdl_keys.py` step after the `nova:*` tags are applied
live.
- **Cutoff:** P5 stops writing the `acdl:*` keys and the ABAC policy matches
only on `nova:*`. After P5, resources created before P5 still carry the
old `acdl:*` tags (tags are not retroactively rewritten) but **new**
resources are tagged `nova:*` only, and the policy no longer grants
access via `acdl:*`.
- **What you must do:** if you have IAM policies, Cost Explorer filters,
or billing groupings that key off `acdl:*` tag keys, add a parallel
`nova:*` condition (or migrate to `nova:*`) before P5. The platform
handles the dual-tagging; you only need to update your own tag-key
references.
### 5. AWS resource names — Phase P4
- **Old:** `acdl-*` (DynamoDB tables `acdl-contracts`,
`acdl-change-requests`; Lambda `acdl-contract-ingestor`; SNS
`acdl-sod-halt`; security group `acdl-ecs-sg`; KMS alias
`alias/acdl-platform`; ECS services, ECR repos, IAM user
`acdl-spike-runner`, state bucket `acdl-tfstate-*`, ALB `acdl-alb`,
`acdl-deploy-*`)
- **New:** `nova-*` (the same resources, prefixed `nova-`)
- **Phase:** P4 (resource names) — **maintenance window**
- **Grace period:** P4 is a **planned maintenance window**. AWS resources
cannot be renamed in place, so P4 provisions the `nova-*` resources,
migrates data (DynamoDB tables, S3 state), repoints the platform, and
tears down the `acdl-*` resources. The platform team schedules and
announces the window; consumers do not provision or rename anything
themselves.
- **Cutoff:** the `acdl-*` resources are decommissioned at the end of the
P4 maintenance window. After P4, only `nova-*` resources exist.
- **What you must do:** nothing for the resource names themselves — the
platform owns the rename. If your application code or runbooks reference
a specific `acdl-*` resource by name (e.g. a hardcoded DynamoDB table
name or ECR URI), update it to the `nova-*` name during P4. The platform
publishes the exact old → new name mapping with the P4 announcement.
## Timeline at a glance
| Phase | What ships | Grace period | Cutoff |
|-------|------------|--------------|--------|
| **P1** (this phase) | Brand prose, docs, decks, schema `$id`, release titles | n/a (prose only) | n/a |
| **P2** | `.nova/` contract path + `NOVA_*` env vars | dual-read: `.nova/`→`.acdl/`, `NOVA_*`→`ACDL_*` | **P5** removes fallback |
| **P3** | `/nova/` SSM path + `nova:*` tag keys | parallel-write (SSM) + parallel-tag (ABAC matches either) | **P5** removes old path/tags |
| **P4** | `nova-*` AWS resource names | maintenance window (platform-owned migration) | end of P4 window |
| **P5** | Fallback removal | — | `ACDL_*` env vars, `.acdl/` path, `/acdl/` SSM, `acdl:*` tags stop working |
## What consumers must do (checklist)
1. **Before P5 — contract path:** move `.acdl/contract.yml` →
`.nova/contract.yml` in your consumer repo; update the `contract:`
workflow input. *(Can be done any time in P2–P4.)*
2. **Before P5 — env vars:** rename `ACDL_*` CI secrets / workflow `env:`
blocks / local `.env.secrets` to `NOVA_*`. *(Incremental during P2–P4;
dual-read keeps you green.)*
3. **Before P5 — SSM reads:** if you read deploy outputs from SSM by
hardcoded `/acdl/…` path, update to `/nova/…`. *(Skip if you consume
outputs via PR comments only.)*
4. **Before P5 — tag-key references:** if you have IAM policies, Cost
Explorer filters, or billing groupings keyed off `acdl:*`, add or
migrate to `nova:*`. *(Platform handles dual-tagging.)*
5. **During P4 — resource-name references:** if your code or runbooks
reference a specific `acdl-*` AWS resource by name, update to the
`nova-*` name per the P4 mapping announcement. *(Platform owns the
rename itself.)*
## Questions
If anything in this guide is unclear, or you are unsure whether your
consumer repo references a renamed value, open an issue on the platform
repo. The platform team will confirm what you need to change and when.
> **Note:** the real Gitea repository name (`continuous-intelligence/acdl`)
> is **not** changing — only the product brand. The `uses:` workflow
> reference and repo path are migrated in a separately-announced later step;
> until then, keep your `uses: acdl/.github/workflows/deploy.yml@vX.Y`
> reference as-is.
docs/_config.yml
+2 -2
View File
@@ -1,5 +1,5 @@
title: ACDL — Agentic Cloud Delivery Platform
description: Consumer + platform-engineer documentation for the ACDL platform.
title: Nova
description: Consumer + platform-engineer documentation for the Nova platform (formerly ACDL — Agentic Cloud Delivery Platform).
remote_theme: mmistakes/minimal-mistakes@9.0.4
exclude:
docs/consumer-guide.md
+23 -23
View File
@@ -1,15 +1,15 @@
# Consumer Guide — Declare intent, deploy to AWS
This guide walks a consumer through creating their pipeline and defining a
contract that deploys any ACDL module to AWS. It is **generic** across all
contract that deploys any Nova module to AWS. It is **generic** across all
modules in the registry; `static-assets` is the worked example, but every
step applies to `microservice` and any future module.
## The model
Consumers have their own repos and consume ACDL by writing a contract
Consumers have their own repos and consume Nova by writing a contract
that declares infrastructure (one or more modules), an environment, and inputs. The consumer declares a **contract** (which infrastructure, which
environment, which inputs); the ACDL platform owns the pipelines, modules,
environment, which inputs); the Nova platform owns the pipelines, modules,
engine adapter, and evidence stream.
You do not write infrastructure modules, workflow YAML, or adapter code.
@@ -53,7 +53,7 @@ platform-managed. See [Environments](environments/).
## Step 1 — Create a consumer repo
Create a repository for your application. The top level holds your app
code; your contract lives at `.acdl/contract.yml`. Example for a static
code; your contract lives at `.nova/contract.yml`. Example for a static
site:
```
@@ -62,7 +62,7 @@ my-static-site/
assets/
style.css
logo.png
.acdl/
.nova/
contract.yaml
.github/
workflows/
@@ -75,7 +75,7 @@ Example for a microservice:
my-microservice/
app.py
Dockerfile
.acdl/
.nova/
contract.yaml
.github/
workflows/
@@ -83,20 +83,20 @@ my-microservice/
```
Your app code lives at the top level. Your contract lives at
`.acdl/contract.yml` regardless of the module you deploy. Your CI
`.nova/contract.yml` regardless of the module you deploy. Your CI
definition lives at `.github/workflows/deploy.yml`.
## Step 2 — Reference the central pipeline
In your CI workflow (`.github/workflows/deploy.yml`), reference the central
ACDL deployment workflow with a **versioned tag** (floating MAJOR + MINOR):
Nova deployment workflow with a **versioned tag** (floating MAJOR + MINOR):
```yaml
jobs:
deploy:
uses: acdl/.github/workflows/deploy.yml@v1.13
with:
contract: .acdl/contract.yml
contract: .nova/contract.yml
environment: dev
```
@@ -106,7 +106,7 @@ field; the version pin lives in the CI workflow reference.
## Step 3 — Define the contract
Write `.acdl/contract.yml`. The `static-assets` example:
Write `.nova/contract.yml`. The `static-assets` example:
```yaml
environment: dev
@@ -167,7 +167,7 @@ and execute for you.
### The consumer CI definition
Add a thin workflow file to **your** repo that invokes the reusable ACDL
Add a thin workflow file to **your** repo that invokes the reusable Nova
deploy workflow with a **versioned tag** (`.github/workflows/deploy.yml`):
```yaml
@@ -179,7 +179,7 @@ jobs:
deploy:
uses: acdl/.github/workflows/deploy.yml@v1.13
with:
contract: .acdl/contract.yml
contract: .nova/contract.yml
```
That is the entire consumer-side workflow. When you push to `main`:
@@ -187,12 +187,12 @@ That is the entire consumer-side workflow. When you push to `main`:
1. The platform runner resolves `uses: acdl/.github/workflows/deploy.yml@v1.13`
to the reusable workflow **at the pinned tag**.
2. A **platform-provided runner** checks out **your** repo.
3. The runner checks out the **ACDL platform repo** into the workspace —
3. The runner checks out the **Nova platform repo** into the workspace —
this is how the pipeline fetches the platform code at run time. You
never clone the platform repo yourself.
4. The runner installs the runtime dependencies the platform requires.
5. The runner invokes `scripts/run_platform.sh` against your
`.acdl/contract.yml`.
`.nova/contract.yml`.
You see the streamed output (infrastructure plan, policy-check results,
confidence signal) in your run logs. The `--check-only` and `--plan-only`
@@ -203,7 +203,7 @@ hold for attestation).
### Local validation (optional)
A consumer *may* clone the ACDL platform repo to run `--check-only` against
A consumer *may* clone the Nova platform repo to run `--check-only` against
their contract before pushing — this is optional and not required for the
happy path. If you do this, the runtime dependencies must be installed
locally, and any AWS credentials follow the
@@ -213,7 +213,7 @@ static key in `.env.secrets` (gitignored) is rotated **out of band by you**
locally-held copies.
```bash
bash scripts/run_platform.sh --check-only path/to/your/.acdl/contract.yml
bash scripts/run_platform.sh --check-only path/to/your/.nova/contract.yml
```
## Step 5 — What the pipeline does
@@ -345,7 +345,7 @@ process is a 2-step pipeline with **HITL SRE gates** to prevent accidental
destruction:
1. **Request a change request (CR):** Contact the platform team to create a
change request in the platform CMDB (DynamoDB `acdl-change-requests`
change request in the platform CMDB (DynamoDB `nova-change-requests`
table). The CR must be approved before decommission can proceed. The CR
includes the consumer repo, contract ID, and the reason for decommission.
@@ -355,7 +355,7 @@ destruction:
```yaml
uses: acdl/.github/workflows/deploy.yml@v1.13
with:
contract: .acdl/contract.yml
contract: .nova/contract.yml
mode: decommission
changeRequestId: "CHG0678912"
```
@@ -395,7 +395,7 @@ separately (or left running to monitor the decommissioned stack's
endpoints going dark).
## Per-environment deployment
ACDL supports a **promotion-without-editing** model: you do not edit the
Nova supports a **promotion-without-editing** model: you do not edit the
`environment:` field in a contract to promote dev → qa → prod → dr.
Instead, there is **one CI job per environment**, each pointing at its
respective contract (or the same contract + the `environment` workflow
@@ -404,8 +404,8 @@ input). Promotion = running the matching job.
### Two shapes (both supported)
**Shape 1 — per-environment contract files:** a consumer repo has one
contract per environment (e.g. `.acdl/static-assets.dev.yml`,
`.acdl/static-assets.qa.yml`, …). Each sets `environment:` to its own
contract per environment (e.g. `.nova/static-assets.dev.yml`,
`.nova/static-assets.qa.yml`, …). Each sets `environment:` to its own
name and uses interpolation so env-specific values differ automatically:
```yaml
@@ -439,7 +439,7 @@ jobs:
uses: acdl/.github/workflows/deploy.yml@v1.13
with:
environment: qa
contract: .acdl/contract.yml
contract: .nova/contract.yml
```
### One job per environment
@@ -467,7 +467,7 @@ duties check blocks a prod promotion when `approver_qa == approver_prod`
| `${env.environment}` | the environment name (dev/qa/prod/dr) | `qa` |
| `${env.region}` | the environment's AWS region | `us-east-1` |
| `${env.account_id}` | the environment's AWS account id | `123456789012` |
| `${env.state_backend.bucket}` | the environment's state bucket | `acdl-qa-state` |
| `${env.state_backend.bucket}` | the environment's state bucket | `nova-qa-state` |
| `${env.network.vpc_cidr}` | the environment's VPC CIDR | `10.1.0.0/16` |
| `${contract.id}` | the contract's operational acronym | `assets` |
| `${contract.environment}` | the contract's environment field | `qa` |
docs/contracts/index.md
+4 -4
View File
@@ -7,7 +7,7 @@ deploys it.
## The contract file
A consumer repo keeps its contract at `.acdl/contract.yml`. A minimal
A consumer repo keeps its contract at `.nova/contract.yml`. A minimal
example (the `static-assets` module):
```yaml
@@ -57,7 +57,7 @@ infrastructure:
## Validation
The contract is validated against
[`schemas/contract.schema.json`](https://github.com/acdl/acdl/blob/main/schemas/contract.schema.json).
[`schemas/contract.schema.json`](https://github.com/nova/nova/blob/main/schemas/contract.schema.json).
An invalid contract (missing field, unknown module, wrong type) fails at the
validate-contract stage with a clear error.
@@ -65,9 +65,9 @@ validate-contract stage with a clear error.
Two reference examples exist in `contracts/`:
- [`contracts/static-assets.yml`](https://github.com/acdl/acdl/blob/main/contracts/static-assets.yml)
- [`contracts/static-assets.yml`](https://github.com/nova/nova/blob/main/contracts/static-assets.yml)
— the `static-assets` module.
- [`contracts/microservice.yml`](https://github.com/acdl/acdl/blob/main/contracts/microservice.yml)
- [`contracts/microservice.yml`](https://github.com/nova/nova/blob/main/contracts/microservice.yml)
— the `microservice` module.
Additionally, every module has a `modules/<name>/examples/` directory with
docs/environments/index.md
+7 -7
View File
@@ -56,13 +56,13 @@ threshold. Staging does not exist.
## Cross-account contract ingestion grant (D-051)
Onboarding now also grants the consumer repo's deploy role permission to
invoke the **platform Lambda** — `acdl-contract-ingestor` — across
invoke the **platform Lambda** — `nova-contract-ingestor` — across
accounts. The Lambda is invoked via a Function URL with IAM auth, so the
grant is an inline IAM policy applied to the consumer's deploy role. The
policy template lives at
[`terraform/platform/consumer_invoke_policy.json`](https://github.com/acdl/acdl/blob/main/terraform/platform/consumer_invoke_policy.json)
[`terraform/platform/consumer_invoke_policy.json`](https://github.com/nova/nova/blob/main/terraform/platform/consumer_invoke_policy.json)
and is scoped via **ABAC**: the condition
`aws:PrincipalTag/acdl:owner == ${consumerRepo}` ensures a repo can only
`aws:PrincipalTag/nova:owner == ${consumerRepo}` ensures a repo can only
invoke the Lambda when its principal tag matches its claimed identity.
The consumer's deploy workflow signs the Function URL request with
@@ -75,7 +75,7 @@ is used for two purposes:
1. **Contract ingestion** — the consumer submits its resolved deployment
contract (`action: "submit_contract"`) so the platform has a durable
record in the `acdl-contracts` DynamoDB table (PK `consumerRepo`, SK
record in the `nova-contracts` DynamoDB table (PK `consumerRepo`, SK
`contractId#submittedAt`).
2. **Error reporting** (D-055) — the consumer reports a deployment error
(`action: "report_error"`) which the platform turns into a GitHub
@@ -83,16 +83,16 @@ is used for two purposes:
prepared-status stub until then).
The Lambda handler and the Terraform that deploys it live in
[`core/lambda/contract_ingestor.py`](https://github.com/acdl/acdl/blob/main/core/lambda/contract_ingestor.py)
[`core/lambda/contract_ingestor.py`](https://github.com/nova/nova/blob/main/core/lambda/contract_ingestor.py)
and
[`terraform/platform/main.tf`](https://github.com/acdl/acdl/blob/main/terraform/platform/main.tf)
[`terraform/platform/main.tf`](https://github.com/nova/nova/blob/main/terraform/platform/main.tf)
respectively.
## Onboarding scaffold (current state)
The platform repo ships a minimal onboarding scaffold:
- [`core/environments/`](https://github.com/acdl/acdl/blob/main/core/environments/)
- [`core/environments/`](https://github.com/nova/nova/blob/main/core/environments/)
— environment definitions (a sample `dev.json`).
- `core/environment_check.py` — checks whether an environment is defined for
a given contract's repo + environment name; prints the friendly onboarding
docs/index.md
+13 -4
View File
@@ -1,4 +1,6 @@
# ACDL — Agentic Cloud Delivery Platform
# Nova
> **Nova — The New Dawn of DevSecOps.** Security as a seamless enabler of fast deployments — not a bottleneck, not a "no" department.
Consumers declare intent; the platform delivers safe production deployment
through an agentic stack — automatically, safely, and with a complete audit
@@ -9,14 +11,14 @@ a configuration file, or an infrastructure module.
## Two repositories
There are two kinds of repository in the ACDL model:
There are two kinds of repository in the Nova model:
- **Platform repo (this one).** The source code of the platform. It owns
`modules/`, `adapters/`, `core/`, `schemas/`, `pipelines/`, `scripts/`,
and the reusable workflow files. Platform engineers work here. A consumer
never clones it.
- **Consumer repo (yours).** A consumer repo contains only its application
code, one or more contracts (`.acdl/contract.yml`), and one or more CI
code, one or more contracts (`.nova/contract.yml`), and one or more CI
definitions (a thin `.github/workflows/deploy.yml` that `uses:` the central
reusable workflow, pointing at the appropriate environment + contract).
The consumer does not write infrastructure modules, workflow YAML, or
@@ -75,4 +77,11 @@ Planned future features (no dates; tracked in the internal roadmap):
- [Consumer Guide](consumer-guide) — start here if you are a consumer.
- [Architecture](architecture) — start here if you are a platform engineer.
- The [README](https://github.com/acdl/acdl) describes the platform repo.
- The [README](https://github.com/nova/nova) describes the platform repo.
> **Note:** The product brand is **Nova** (formerly ACDL — Agentic Cloud
> Delivery Platform). The Gitea repository name (`continuous-intelligence/acdl`)
> and the GitHub `uses:` reference (`acdl/.github/workflows/deploy.yml@…`)
> are unchanged during the rebrand transition; only the product name is
> changing. See the [Nova migration guide](NOVA_MIGRATION) for the
> scheduled breaking changes.
docs/modules/index.md
+14 -14
View File
@@ -16,28 +16,28 @@ module's README documents which resources it creates.
| Module | What it creates | Source |
|--------|----------------|--------|
| `s3` | `aws_s3_bucket` — a single S3 bucket | [modules/l1/s3/README.md](https://github.com/acdl/acdl/blob/main/modules/l1/s3/README.md) |
| `vpc` | `aws_vpc` + `aws_subnet` + `aws_route_table` + `aws_internet_gateway` — VPC with subnets and routing | [modules/l1/vpc/README.md](https://github.com/acdl/acdl/blob/main/modules/l1/vpc/README.md) |
| `ecs-cluster` | `aws_ecs_cluster` — ECS Fargate cluster | [modules/l1/ecs-cluster/README.md](https://github.com/acdl/acdl/blob/main/modules/l1/ecs-cluster/README.md) |
| `ecs-service` | `aws_ecs_task_definition` + `aws_ecs_service` — Fargate service with task definition | [modules/l1/ecs-service/README.md](https://github.com/acdl/acdl/blob/main/modules/l1/ecs-service/README.md) |
| `iam-role` | `aws_iam_role` — IAM role with assume-role policy | [modules/l1/iam-role/README.md](https://github.com/acdl/acdl/blob/main/modules/l1/iam-role/README.md) |
| `alb` | `aws_lb` + `aws_lb_target_group` + `aws_lb_listener` — Application Load Balancer | [modules/l1/alb/README.md](https://github.com/acdl/acdl/blob/main/modules/l1/alb/README.md) |
| `ecr` | `aws_ecr_repository` — ECR container image repository | [modules/l1/ecr/README.md](https://github.com/acdl/acdl/blob/main/modules/l1/ecr/README.md) |
| `cloudfront` | `aws_cloudfront_distribution` + `aws_cloudfront_origin_access_control` — CloudFront distribution with S3 origin via OAC | [modules/l1/cloudfront/README.md](https://github.com/acdl/acdl/blob/main/modules/l1/cloudfront/README.md) |
| `waf` | `aws_wafv2_web_acl` — WAFv2 Web ACL (CloudFront-scoped) | [modules/l1/waf/README.md](https://github.com/acdl/acdl/blob/main/modules/l1/waf/README.md) |
| `rds` | `aws_db_instance` — RDS database instance (multi-engine: postgres, mysql, etc.) | [modules/l1/rds/README.md](https://github.com/acdl/acdl/blob/main/modules/l1/rds/README.md) |
| `s3` | `aws_s3_bucket` — a single S3 bucket | [modules/l1/s3/README.md](https://github.com/nova/nova/blob/main/modules/l1/s3/README.md) |
| `vpc` | `aws_vpc` + `aws_subnet` + `aws_route_table` + `aws_internet_gateway` — VPC with subnets and routing | [modules/l1/vpc/README.md](https://github.com/nova/nova/blob/main/modules/l1/vpc/README.md) |
| `ecs-cluster` | `aws_ecs_cluster` — ECS Fargate cluster | [modules/l1/ecs-cluster/README.md](https://github.com/nova/nova/blob/main/modules/l1/ecs-cluster/README.md) |
| `ecs-service` | `aws_ecs_task_definition` + `aws_ecs_service` — Fargate service with task definition | [modules/l1/ecs-service/README.md](https://github.com/nova/nova/blob/main/modules/l1/ecs-service/README.md) |
| `iam-role` | `aws_iam_role` — IAM role with assume-role policy | [modules/l1/iam-role/README.md](https://github.com/nova/nova/blob/main/modules/l1/iam-role/README.md) |
| `alb` | `aws_lb` + `aws_lb_target_group` + `aws_lb_listener` — Application Load Balancer | [modules/l1/alb/README.md](https://github.com/nova/nova/blob/main/modules/l1/alb/README.md) |
| `ecr` | `aws_ecr_repository` — ECR container image repository | [modules/l1/ecr/README.md](https://github.com/nova/nova/blob/main/modules/l1/ecr/README.md) |
| `cloudfront` | `aws_cloudfront_distribution` + `aws_cloudfront_origin_access_control` — CloudFront distribution with S3 origin via OAC | [modules/l1/cloudfront/README.md](https://github.com/nova/nova/blob/main/modules/l1/cloudfront/README.md) |
| `waf` | `aws_wafv2_web_acl` — WAFv2 Web ACL (CloudFront-scoped) | [modules/l1/waf/README.md](https://github.com/nova/nova/blob/main/modules/l1/waf/README.md) |
| `rds` | `aws_db_instance` — RDS database instance (multi-engine: postgres, mysql, etc.) | [modules/l1/rds/README.md](https://github.com/nova/nova/blob/main/modules/l1/rds/README.md) |
## Modules
| Module | What it references | Source |
|--------|--------------------|--------|
| `static-assets` | 3 primitives (s3, cloudfront, waf) — a production static asset stack | [modules/l2/static-assets/README.md](https://github.com/acdl/acdl/blob/main/modules/l2/static-assets/README.md) |
| `microservice` | 6 primitives (vpc, cluster, ecr, iam-role, alb, ecs-service) — an ECS Fargate microservice | [modules/l2/microservice/README.md](https://github.com/acdl/acdl/blob/main/modules/l2/microservice/README.md) |
| `static-assets` | 3 primitives (s3, cloudfront, waf) — a production static asset stack | [modules/l2/static-assets/README.md](https://github.com/nova/nova/blob/main/modules/l2/static-assets/README.md) |
| `microservice` | 6 primitives (vpc, cluster, ecr, iam-role, alb, ecs-service) — an ECS Fargate microservice | [modules/l2/microservice/README.md](https://github.com/nova/nova/blob/main/modules/l2/microservice/README.md) |
## Registry
Module versions are tracked in
[`registry.json`](https://github.com/acdl/acdl/blob/main/modules/registry.json).
[`registry.json`](https://github.com/nova/nova/blob/main/modules/registry.json).
Both primitives and modules are registered.
## Examples
@@ -45,7 +45,7 @@ Both primitives and modules are registered.
Each module has a `examples/` directory containing validated consumer
contract examples (`simple.yaml` + `complex.yaml` + variation files). The
platform-test pipeline validates them against
[`schemas/contract.schema.json`](https://github.com/acdl/acdl/blob/main/schemas/contract.schema.json).
[`schemas/contract.schema.json`](https://github.com/nova/nova/blob/main/schemas/contract.schema.json).
See each module's `## Examples` section for the excerpts.
## Versioning
docs/pipeline/index.md
+5 -5
View File
@@ -6,9 +6,9 @@ are the single source of truth for the workflow files.
## CI pipeline
The CI pipeline runs on every push and pull request to `main`. It is defined
by [`pipelines/ci.yml`](https://github.com/acdl/acdl/blob/main/pipelines/ci.yml),
by [`pipelines/ci.yml`](https://github.com/nova/nova/blob/main/pipelines/ci.yml),
validated against
[`schemas/pipeline.schema.json`](https://github.com/acdl/acdl/blob/main/schemas/pipeline.schema.json).
[`schemas/pipeline.schema.json`](https://github.com/nova/nova/blob/main/schemas/pipeline.schema.json).
Both platform-runner workflow files implement the same contract and are
byte-identical:
@@ -31,16 +31,16 @@ bash scripts/run_ci.sh --quiet # suppress per-stage banners
## Deployment pipeline
The deployment pipeline runs when a consumer submits a contract. It is
defined by [`pipelines/contract.yml`](https://github.com/acdl/acdl/blob/main/pipelines/contract.yml),
defined by [`pipelines/contract.yml`](https://github.com/nova/nova/blob/main/pipelines/contract.yml),
validated against
[`schemas/deploy-pipeline.schema.json`](https://github.com/acdl/acdl/blob/main/schemas/deploy-pipeline.schema.json).
[`schemas/deploy-pipeline.schema.json`](https://github.com/nova/nova/blob/main/schemas/deploy-pipeline.schema.json).
It is exposed to consumer repos as a **reusable workflow**:
- `.github/workflows/deploy.yml` — GitHub Actions (production)
A consumer repo invokes the reusable workflow via a **versioned tag**
(floating MAJOR + MINOR, e.g. `acdl/.github/workflows/deploy.yml@v1.13`).
The workflow checks out the consumer repo, then checks out the ACDL platform
The workflow checks out the consumer repo, then checks out the Nova platform
repo into the runner workspace, and runs `scripts/run_platform.sh` against
the consumer's contract. The consumer never clones the platform repo or
invokes its scripts locally. See the [Consumer Guide](../consumer-guide/)
docs/pipeline/versioning.md
+3 -3
View File
@@ -1,6 +1,6 @@
# Versioning
ACDL uses two versioning schemes: one for modules, one for the deploy
Nova uses two versioning schemes: one for modules, one for the deploy
pipeline. Both matter to a consumer.
## Module versioning
@@ -16,7 +16,7 @@ old entry enters a **12-month deprecation window**. A module pins its
primitives by `name@semver`; the resolver picks the highest compatible.
Module versions are tracked in
[`registry.json`](https://github.com/acdl/acdl/blob/main/modules/registry.json).
[`registry.json`](https://github.com/nova/nova/blob/main/modules/registry.json).
## Deploy-pipeline versioning (the CI workflow `uses:` tag)
@@ -28,7 +28,7 @@ jobs:
deploy:
uses: acdl/.github/workflows/deploy.yml@v1.13
with:
contract: .acdl/contract.yml
contract: .nova/contract.yml
```
The version pin lives in the CI workflow reference (not in the contract
docs/presentations/README.md
+1 -1
View File
@@ -1,6 +1,6 @@
# Presentations
Leadership-facing presentation decks for the ACDL platform.
Leadership-facing presentation decks for the Nova platform.
## The 4-step slide creation process
docs/presentations/assets/mmd/developer-experience-01b-scope-boundary.mmd
+1 -1
View File
@@ -6,7 +6,7 @@ flowchart LR
A["Technical dev\n(app code + contract)"]
B["Citizen dev\n(intent → AI agent\n→ contract)"]
end
subgraph ACDL ["ACDL — infrastructure only"]
subgraph ACDL ["Nova — infrastructure only"]
C["Same contract\nSame pipeline\nSame safety"]
D["Provision\nAWS resources"]
E["Evidence\nhash-chained"]
docs/presentations/assets/mmd/developer-experience-02-what-dev-does.mmd
+1 -1
View File
@@ -2,7 +2,7 @@
flowchart LR
A["1. App code<br/>(top level of the repo)"] --> D["Push to main"]
B["2. Contract<br/>(.acdl/contract.yml)"] --> D
B["2. Contract<br/>(.nova/contract.yml)"] --> D
C["3. CI definition<br/>(.github/workflows/deploy.yml<br/>— one 'uses:' line)"] --> D
D --> E["Platform does the rest"]
classDef accent fill:#1B1B1B,color:#fff,stroke:#D6002A,stroke-width:2px
docs/presentations/assets/mmd/developer-experience-03-no-cloning.mmd
+1 -1
View File
@@ -3,7 +3,7 @@
flowchart LR
A["Consumer repo<br/>app + contract + 'uses:'"] -->|triggers on push to main| B["Platform runner"]
B -->|checks out the consumer repo| A
B -->|checks out the ACDL platform repo<br/>into the workspace| C["Platform code<br/>(modules, adapters, schemas)"]
B -->|checks out the Nova platform repo<br/>into the workspace| C["Platform code<br/>(modules, adapters, schemas)"]
C --> B
B -->|runs the pipeline against<br/>the consumer's contract| D["Consumer's resources in AWS"]
classDef accent fill:#1B1B1B,color:#fff,stroke:#D6002A,stroke-width:2px
docs/presentations/assets/mmd/platform-architecture.mmd
+1 -1
View File
@@ -7,7 +7,7 @@ flowchart TD
U2["Citizen dev\nintent → AI agent → contract"]
end
subgraph ACDL ["ACDL — infrastructure only"]
subgraph ACDL ["Nova — infrastructure only"]
direction TB
CS["Contract schema\n(validate + fail-fast)"]
subgraph PIPE ["Central pipeline — fixed stages, every deployment"]
docs/presentations/assets/mmd/platform-works-03-north-star.mmd
+1 -1
View File
@@ -9,7 +9,7 @@ flowchart LR
D["Manual promotion"]
A --> B --> C --> D
end
subgraph ACDL ["With ACDL"]
subgraph ACDL ["With Nova"]
direction TB
E["Declare intent\n(one YAML contract)"]
F["Platform delivers\nsafely, autonomously"]
docs/presentations/assets/mmd/platform-works-03-scope-boundary.mmd
+1 -1
View File
@@ -7,7 +7,7 @@ flowchart LR
B["Agentic SDLC\n(agent writes contract)"]
C["Citizen dev\n(vibe codes → AI agent\n→ contract)"]
end
subgraph ACDL ["ACDL — infrastructure only"]
subgraph ACDL ["Nova — infrastructure only"]
D["Contract\nvalidated"]
E["Resolve → Plan\nSecurity + Policy checks\nConfidence signal"]
F["Provision\nAWS resources"]
docs/presentations/assets/png/developer-experience-01b-scope-boundary.png
BIN
View File
Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 37 KiB

After

Width:  |  Height:  |  Size: 37 KiB

docs/presentations/assets/png/platform-architecture.png
BIN
View File
Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 76 KiB

After

Width:  |  Height:  |  Size: 76 KiB

docs/presentations/assets/png/platform-works-03-north-star.png
BIN
View File
Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 56 KiB

After

Width:  |  Height:  |  Size: 56 KiB

docs/presentations/assets/png/platform-works-03-scope-boundary.png
BIN
View File
Binary file not shown.
Side by Side Swipe Overlay

Before

Width:  |  Height:  |  Size: 30 KiB

After

Width:  |  Height:  |  Size: 30 KiB

docs/presentations/how-the-platform-works-marp.md
+6 -6
View File
@@ -31,7 +31,7 @@ style: |
# How The Platform Works
### Agentic Cloud Delivery Platform
### Nova — The New Dawn of DevSecOps
<style>
section.title h1 { font-size: 44px; margin-bottom: 0.1em; }
@@ -72,12 +72,12 @@ section.title h3 { color: #F0F0F0; font-weight: 400; font-size: 22px; margin-top
---
# ACDL owns infrastructure, not your app
# Nova owns infrastructure, not your app
![w:1100](assets/png/platform-works-03-scope-boundary.png)
- **Upstream is anything** — IDE, agentic SDLC, or vibe coding
- **ACDL is infrastructure only** — provisions and governs AWS resources
- **Nova is infrastructure only** — provisions and governs AWS resources
- **Not a general-purpose AI** — autonomy is narrow, policy-bounded
- **Not a permissive highway** — no escape hatches
@@ -299,7 +299,7 @@ section { font-size: 20px; }
table { font-size: 18px; }
</style>
ACDL runs at **zero cloud cost** for day-to-day development. AWS spend was measured via Cost Explorer (`COST.md`, 2026-07-28):
Nova runs at **zero cloud cost** for day-to-day development. AWS spend was measured via Cost Explorer (`COST.md`, 2026-07-28):
| Metric | Value |
|--------|-------|
@@ -310,7 +310,7 @@ ACDL runs at **zero cloud cost** for day-to-day development. AWS spend was measu
- **S3 dominates** (98.8%, terraform state bucket) — no compute ran because v1.0→v1.10 was plan-only for IAM-gated capabilities
- **Local emulators are the primary tier** — the full pipeline runs in-process, no AWS credentials
- **Live-AWS verification is milestone-scoped, then torn down.** The pipeline now **defaults to plan-only** on every PR; `ACDL_LIFECYCLE_MODE=full` overrides to apply→destroy for milestone verification (REQ-134, v1.12).
- **Live-AWS verification is milestone-scoped, then torn down.** The pipeline now **defaults to plan-only** on every PR; `NOVA_LIFECYCLE_MODE=full` overrides to apply→destroy for milestone verification (REQ-134, v1.12).
- **Cost drivers** are spike-scoped: Terraform plan reads (free), S3 state storage (cents), DynamoDB outbox (cents). Any spike > $1/day is an anomaly.
**Pre-mortem (`PRE_MORTEM.md`):** the v1.10 decay incident (diff-scoped VERIFY missed 7 adapter defects) is the root pattern: *a claim outruns the verification that backs it.* Four forward failure modes + structural mitigations (regression-tested IAM baseline, mandatory teardown, verified-only deck claims, honest scope).
@@ -329,6 +329,6 @@ section { font-size: 20px; }
Two architectural pillars make "Verified" a structural property, not a claim:
- **The stateless adapter (918 → ~80 lines).** The Terraform adapter was a 918-line monolith with 3 constant tables and 39 type-specific branches. It is now a ~80-line **stateless assembler**: it owns no module content — no resource shape, no nested HCL blocks, no defaults. Each L1 module ships a real `terraform/` module dir owning its shape, nested blocks, and defaults. The adapter reads the registry and emits `module "x" { source = ... }` blocks. A new module is a new terraform dir, not a code change. *(The v1.12 P67 fix closed a dedup defect for multi-resource L1s — ecs-service, alb; CAP-013 now Verified.)*
- **Pipeline-driven lifecycle testing.** A `modules-lifecycle` pipeline matrix-runs each L1 and L2 module's `examples/{simple,complex}.yml` contracts through apply→modify→destroy against live AWS. **The "test" = the pipeline cell going green.** Defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); `ACDL_LIFECYCLE_MODE=full` overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — **22/22 Verified** as of v1.12.
- **Pipeline-driven lifecycle testing.** A `modules-lifecycle` pipeline matrix-runs each L1 and L2 module's `examples/{simple,complex}.yml` contracts through apply→modify→destroy against live AWS. **The "test" = the pipeline cell going green.** Defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); `NOVA_LIFECYCLE_MODE=full` overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — **22/22 Verified** as of v1.12.
The v1.10 lesson is the negative space: a 918-line adapter with type-specific branches decayed silently. The ~80-line stateless adapter + the milestone regression gate are the structural fix.
docs/presentations/how-the-platform-works-talking-points.md
+7 -7
View File
@@ -36,7 +36,7 @@
- One-slide map of the whole platform — use it to orient the audience before diving into any single component
- The leadership-relevant beats: (1) two surfaces, one pipeline, one evidence stream — the convergence is the design; (2) the pipeline stages are fixed and identical for every consumer; (3) the engine adapter is the only engine-specific code, which makes the catalog and confidence model portable
- Don't walk every node — point to the boundaries and say "the rest of this deck zooms into each of these"
- The contract schema is the boundary between upstream and ACDL; everything left of it is the consumer's, everything right of it is the platform's
- The contract schema is the boundary between upstream and Nova; everything left of it is the consumer's, everything right of it is the platform's
**Key takeaway:** Two surfaces, one pipeline, one evidence stream. The rest of the deck zooms in.
@@ -45,7 +45,7 @@
## Slide 4 — Declare intent; the platform delivers safe production
**Talking points:**
- Land the before/after contrast: today's queue vs. ACDL's autonomous flow
- Land the before/after contrast: today's queue vs. Nova's autonomous flow
- The litmus test: if a platform engineer still has to touch a ticket for a dev→qa promotion, we haven't delivered the vision
- The North Star is one sentence: "declare intent → safe production deployment"
- A non-technical consumer ships by declaring intent — no workflow, no config file, no module
@@ -54,15 +54,15 @@
---
## Slide 5 — ACDL owns infrastructure, not your app
## Slide 5 — Nova owns infrastructure, not your app
**Talking points:**
- The platform is deliberately scoped — it is not trying to be everything
- The sovereign boundary: the platform team owns delivery and infrastructure, not the upstream development process
- The anti-goals are as important as the goals — they tell leadership what not to expect
- Upstream is anything: IDE, agentic SDLC, or vibe coding — ACDL doesn't care how the contract was produced
- Upstream is anything: IDE, agentic SDLC, or vibe coding — Nova doesn't care how the contract was produced
**Key takeaway:** ACDL is infrastructure only. App build/test/deploy is upstream.
**Key takeaway:** Nova is infrastructure only. App build/test/deploy is upstream.
---
@@ -182,7 +182,7 @@
**Talking points:**
- The phrase to land is "secure by default, not secure by effort"
- The selling point is *normalization* — we can add a new security tool without changing the confidence model or the evidence stream
- For the Head of Security: tagging standards are enforced, not advisory — a missing `acdl:owner` tag fails the check, not a warning
- For the Head of Security: tagging standards are enforced, not advisory — a missing `nova:owner` tag fails the check, not a warning
- The decommission flow is the counter-argument to "deletion protection makes cleanup impossible" — it's a deliberate, gated, two-approval path
**Key takeaway:** Secure by default, not secure by effort. Checks run before infra is created.
@@ -207,7 +207,7 @@
- Close on honesty — the platform delivers real, verifiable value today: 22/22 auto-verifiable capabilities Verified via the v1.11 lifecycle pipeline
- The roadmap is concrete, not aspirational hand-waving — 9 planned items, each with a defined milestone and a clear reason it isn't shipped yet (usually an upstream dependency, not an engineering gap)
- Emphasize: 0 consumer adoption today — "Testing" means it works internally and is dev pilot-ready, not that it's released
- The lifecycle pipeline defaults to plan-only on every PR; `ACDL_LIFECYCLE_MODE=full` overrides for milestone verification
- The lifecycle pipeline defaults to plan-only on every PR; `NOVA_LIFECYCLE_MODE=full` overrides for milestone verification
**Key takeaway:** 22/22 Verified today. 9 planned, each with a clear milestone and reason.
docs/presentations/how-the-platform-works.html
+6 -6
View File
@@ -48,7 +48,7 @@ img { display: block; margin: 0 auto; max-height: 300px; }
<header>How The Platform Works</header>
<h1 id="how-the-platform-works">How The Platform Works</h1>
<h3 id="agentic-cloud-delivery-platform">Agentic Cloud Delivery Platform</h3>
<h3 id="nova-the-new-dawn-of-devsecops">Nova — The New Dawn of DevSecOps</h3>
<footer>Internal</footer>
</section>
</foreignObject></svg><svg data-marpit-svg="" viewBox="0 0 1280 720"><foreignObject width="1280" height="720"><section id="2" data-paginate="true" data-header="How The Platform Works" data-footer="Internal" data-theme="default" data-style="section {
@@ -232,11 +232,11 @@ img { display: block; margin: 0 auto; max-height: 300px; }
.planned { background: #fef3c7; color: #78350f; }
;" data-marpit-pagination-total="20">
<header>How The Platform Works</header>
<h1 id="acdl-owns-infrastructure-not-your-app">ACDL owns infrastructure, not your app</h1>
<h1 id="nova-owns-infrastructure-not-your-app">Nova owns infrastructure, not your app</h1>
<p><img src="assets/png/platform-works-03-scope-boundary.png" alt="" style="width:1100px;" /></p>
<ul>
<li><strong>Upstream is anything</strong> — IDE, agentic SDLC, or vibe coding</li>
<li><strong>ACDL is infrastructure only</strong> — provisions and governs AWS resources</li>
<li><strong>Nova is infrastructure only</strong> — provisions and governs AWS resources</li>
<li><strong>Not a general-purpose AI</strong> — autonomy is narrow, policy-bounded</li>
<li><strong>Not a permissive highway</strong> — no escape hatches</li>
</ul>
@@ -1005,7 +1005,7 @@ img { display: block; margin: 0 auto; max-height: 300px; }
<header>How The Platform Works</header>
<h1 id="a7--operating-model--cost">A7 — Operating Model &amp; Cost</h1>
<p>ACDL runs at <strong>zero cloud cost</strong> for day-to-day development. AWS spend was measured via Cost Explorer (<code>COST.md</code>, 2026-07-28):</p>
<p>Nova runs at <strong>zero cloud cost</strong> for day-to-day development. AWS spend was measured via Cost Explorer (<code>COST.md</code>, 2026-07-28):</p>
<table>
<thead>
<tr>
@@ -1035,7 +1035,7 @@ img { display: block; margin: 0 auto; max-height: 300px; }
<ul>
<li><strong>S3 dominates</strong> (98.8%, terraform state bucket) — no compute ran because v1.0→v1.10 was plan-only for IAM-gated capabilities</li>
<li><strong>Local emulators are the primary tier</strong> — the full pipeline runs in-process, no AWS credentials</li>
<li><strong>Live-AWS verification is milestone-scoped, then torn down.</strong> The pipeline now <strong>defaults to plan-only</strong> on every PR; <code>ACDL_LIFECYCLE_MODE=full</code> overrides to apply→destroy for milestone verification (REQ-134, v1.12).</li>
<li><strong>Live-AWS verification is milestone-scoped, then torn down.</strong> The pipeline now <strong>defaults to plan-only</strong> on every PR; <code>NOVA_LIFECYCLE_MODE=full</code> overrides to apply→destroy for milestone verification (REQ-134, v1.12).</li>
<li><strong>Cost drivers</strong> are spike-scoped: Terraform plan reads (free), S3 state storage (cents), DynamoDB outbox (cents). Any spike &gt; $1/day is an anomaly.</li>
</ul>
<p><strong>Pre-mortem (<code>PRE_MORTEM.md</code>):</strong> the v1.10 decay incident (diff-scoped VERIFY missed 7 adapter defects) is the root pattern: <em>a claim outruns the verification that backs it.</em> Four forward failure modes + structural mitigations (regression-tested IAM baseline, mandatory teardown, verified-only deck claims, honest scope).</p>
@@ -1085,7 +1085,7 @@ img { display: block; margin: 0 auto; max-height: 300px; }
<p>Two architectural pillars make &quot;Verified&quot; a structural property, not a claim:</p>
<ul>
<li><strong>The stateless adapter (918 → ~80 lines).</strong> The Terraform adapter was a 918-line monolith with 3 constant tables and 39 type-specific branches. It is now a ~80-line <strong>stateless assembler</strong>: it owns no module content — no resource shape, no nested HCL blocks, no defaults. Each L1 module ships a real <code>terraform/</code> module dir owning its shape, nested blocks, and defaults. The adapter reads the registry and emits <code>module &quot;x&quot; { source = ... }</code> blocks. A new module is a new terraform dir, not a code change. <em>(The v1.12 P67 fix closed a dedup defect for multi-resource L1s — ecs-service, alb; CAP-013 now Verified.)</em></li>
<li><strong>Pipeline-driven lifecycle testing.</strong> A <code>modules-lifecycle</code> pipeline matrix-runs each L1 and L2 module's <code>examples/{simple,complex}.yml</code> contracts through apply→modify→destroy against live AWS. <strong>The &quot;test&quot; = the pipeline cell going green.</strong> Defaults to <strong>plan-only</strong> on every PR (fast, no AWS mutation, no cost); <code>ACDL_LIFECYCLE_MODE=full</code> overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — <strong>22/22 Verified</strong> as of v1.12.</li>
<li><strong>Pipeline-driven lifecycle testing.</strong> A <code>modules-lifecycle</code> pipeline matrix-runs each L1 and L2 module's <code>examples/{simple,complex}.yml</code> contracts through apply→modify→destroy against live AWS. <strong>The &quot;test&quot; = the pipeline cell going green.</strong> Defaults to <strong>plan-only</strong> on every PR (fast, no AWS mutation, no cost); <code>NOVA_LIFECYCLE_MODE=full</code> overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — <strong>22/22 Verified</strong> as of v1.12.</li>
</ul>
<p>The v1.10 lesson is the negative space: a 918-line adapter with type-specific branches decayed silently. The ~80-line stateless adapter + the milestone regression gate are the structural fix.</p>
<footer>Internal</footer>
docs/presentations/how-the-platform-works.md
+20 -18
View File
@@ -1,6 +1,6 @@
# How The Platform Works
> **Subtitle:** Agentic Cloud Delivery Platform
> **Subtitle:** Nova — The New Dawn of DevSecOps
> **Audience:** Senior Leadership, CTO, Head of Cloud, Head of Infrastructure, Head of DevOps
> **Length:** ~16 minutes · 11 main + Appendix TOC + 8 appendix = 20 slides
> **Purpose:** Sell the platform's value to tech leadership — zero-trust, security, observability, auditability, and the shift from "operators guess" to "the platform computes safety."
@@ -13,7 +13,9 @@
# How The Platform Works
### Agentic Cloud Delivery Platform
### Nova — The New Dawn of DevSecOps
**Security as a seamless enabler of fast deployments — not a bottleneck, not a "no" department.**
> **Speaker notes:** Brief introduction — this deck explains *how* the platform works internally, not what the developer experience is (that's the companion deck). Set the frame: the platform is not a CI/CD tool — it's the organizational lever for shipping safely at the pace the business demands.
@@ -62,7 +64,7 @@ flowchart TD
U2["Citizen dev\nintent → AI agent → contract"]
end
subgraph ACDL ["ACDL — infrastructure only"]
subgraph ACDL ["Nova — infrastructure only"]
direction TB
CS["Contract schema\n(validate + fail-fast)"]
subgraph PIPE ["Central pipeline — fixed stages, every deployment"]
@@ -97,7 +99,7 @@ flowchart TD
```
- **Consumer surfaces** — technical dev or citizen dev; both produce a contract. Upstream is anything.
- **Contract schema** — the boundary between upstream and ACDL; validated fail-fast.
- **Contract schema** — the boundary between upstream and Nova; validated fail-fast.
- **Central pipeline** — fixed stages, identical for every deployment: validate → resolve → security → plan → policy → confidence → evidence → apply.
- **Module catalog** — security-reviewed primitives + modules the resolver expands against.
- **Engine adapter** — stateless; the only engine-specific code (Terraform today).
@@ -123,7 +125,7 @@ flowchart LR
D["Manual promotion"]
A --> B --> C --> D
end
subgraph ACDL ["With ACDL"]
subgraph ACDL ["With Nova"]
direction TB
E["Declare intent\n(one YAML contract)"]
F["Platform delivers\nsafely, autonomously"]
@@ -137,11 +139,11 @@ flowchart LR
- A **non-technical consumer** ships by declaring intent — no workflow, no config file, no module.
- Every production change is **traceable to a human attestation** and an immutable evidence stream.
> **Speaker notes:** Land the before/after contrast: today's queue vs. ACDL's autonomous flow. The litmus test: if a platform engineer still has to touch a ticket for a dev→qa promotion, we haven't delivered the vision. The North Star is "declare intent → safe production deployment."
> **Speaker notes:** Land the before/after contrast: today's queue vs. Nova's autonomous flow. The litmus test: if a platform engineer still has to touch a ticket for a dev→qa promotion, we haven't delivered the vision. The North Star is "declare intent → safe production deployment."
---
## Slide 5 — ACDL owns infrastructure, not your app
## Slide 5 — Nova owns infrastructure, not your app
The platform is deliberately scoped — it is not trying to be everything.
@@ -153,7 +155,7 @@ flowchart LR
B["Agentic SDLC\n(agent writes contract)"]
C["Citizen dev\n(vibe codes → AI agent\n→ contract)"]
end
subgraph ACDL ["ACDL — infrastructure only"]
subgraph ACDL ["Nova — infrastructure only"]
D["Contract\nvalidated"]
E["Resolve → Plan\nSecurity + Policy checks\nConfidence signal"]
F["Provision\nAWS resources"]
@@ -173,8 +175,8 @@ flowchart LR
H --> I
```
- **Upstream is anything** — IDE, agentic SDLC, or vibe coding. ACDL doesn't care how the contract was produced.
- **ACDL is infrastructure only** — it provisions and governs AWS resources. App build/test/deploy is upstream.
- **Upstream is anything** — IDE, agentic SDLC, or vibe coding. Nova doesn't care how the contract was produced.
- **Nova is infrastructure only** — it provisions and governs AWS resources. App build/test/deploy is upstream.
- **Not a general-purpose AI** — autonomy is narrow, scoped to delivery, bounded by strict policy.
- **Not a permissive highway** — no escape hatches to bypass the confidence framework.
@@ -184,7 +186,7 @@ flowchart LR
## Slide 6 — One YAML file. The platform owns everything else.
The contract is the boundary between upstream and ACDL. It's all a consumer writes.
The contract is the boundary between upstream and Nova. It's all a consumer writes.
```mermaid
flowchart LR
@@ -240,7 +242,7 @@ flowchart LR
- **Authentication — OIDC federation.** Each job mints a short-lived token; no credential stored in the consumer repo or runner secret. <span class="badge planned">Planned: all runners</span>
- **Authorization — attribute-based (ABAC), not role-based.** Two attribute classes scope every action:
- **Repository identity** — trust policy binds to the exact consumer repo + branch.
- **Resource tags** — every resource tagged `acdl:owner` + `acdl:contract`; session policy grants access **only to matching tags.**
- **Resource tags** — every resource tagged `nova:owner` + `nova:contract`; session policy grants access **only to matching tags.**
- **The effect:** a consumer can only touch the resources it created. One consumer can never affect another.
> **Speaker notes:** This is the slide for the Head of Cloud/Security. The key phrase is "blast radius contained to the consumer's own stack." Contrast with the common failure mode of shared CI roles that can touch any account resource. The static-key override exists for edge cases but is rotated daily on platform runners; it is never the default.
@@ -374,7 +376,7 @@ Monitoring is **a platform default, not a per-team project.** *(Testing.)*
Security defaults that **do not require a team to opt in.** Checks run on **every** deployment, normalized to a single schema regardless of which engine produced them. *(Testing.)*
- **Infrastructure-as-code policy** (Checkov) — secrets in plaintext, public ingress, IAM wildcards, KMS key references, **required tagging standards** (`acdl:owner`, `acdl:contract`, `acdl:environment`, `acdl:cost-center`). All run *before* infra is created.
- **Infrastructure-as-code policy** (Checkov) — secrets in plaintext, public ingress, IAM wildcards, KMS key references, **required tagging standards** (`nova:owner`, `nova:contract`, `nova:environment`, `nova:cost-center`). All run *before* infra is created.
- **Cloud security posture** (Wiz adapter) — translates cloud security findings into the same normalized record. *(Adapter testing; activates when a Wiz tenant is configured.)*
- **Kubernetes-native policy** (Kyverno adapter) — ready for the GitOps reconciler roadmap item. *(Adapter testing; inactive for Terraform-only stacks.)*
- **Encryption on every resource** — at-rest encryption is on by default for every primitive (S3, RDS, ECR, ECS, and more). *(Testing.)*
@@ -383,7 +385,7 @@ Security defaults that **do not require a team to opt in.** Checks run on **ever
- **Deletion protection on by default** — every resource has `prevent_destroy` on unless a consumer explicitly disables it via a documented feature flag. *(Testing.)*
- **Safe decommission** — a 2-step pipeline (disable protection → zero counts → destroy) with **two SRE human-attestation gates** and a **change-request validated against the platform CMDB** before any destructive action. *(Testing.)* Encryption keys enter a grace window (default 30 days) so encrypted data remains recoverable during decommission.
> **Speaker notes:** The phrase to land is "secure by default, not secure by effort." The selling point is *normalization* — we can add a new security tool without changing the confidence model or the evidence stream. For the Head of Security: tagging standards are enforced, not advisory — a missing `acdl:owner` tag fails the check, not a warning. The decommission flow is the counter-argument to "deletion protection makes cleanup impossible" — it's a deliberate, gated, two-approval path, not a lock with no key.
> **Speaker notes:** The phrase to land is "secure by default, not secure by effort." The selling point is *normalization* — we can add a new security tool without changing the confidence model or the evidence stream. For the Head of Security: tagging standards are enforced, not advisory — a missing `nova:owner` tag fails the check, not a warning. The decommission flow is the counter-argument to "deletion protection makes cleanup impossible" — it's a deliberate, gated, two-approval path, not a lock with no key.
---
@@ -432,7 +434,7 @@ A phased roadmap from the current Testing baseline to the full North Star:
- Additional engine adapters (OpenTofu, Pulumi, Kubernetes CRDs).
- Deeper observability bootstrap (dashboards, runbooks, on-call bindings).
> **Speaker notes:** Close on honesty. The platform delivers real, verifiable value today — 22/22 auto-verifiable capabilities are Verified via the v1.11 lifecycle pipeline (apply→modify→destroy against live AWS) + the D-091 regression gate. The roadmap is concrete, not aspirational hand-waving — 9 planned items, each with a defined milestone and a clear reason it isn't shipped yet (usually an upstream dependency, not an engineering gap). Emphasize: 0 consumer adoption today — "Testing" means it works internally and is dev pilot-ready, not that it's released. The lifecycle pipeline defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); a CI variable (`ACDL_LIFECYCLE_MODE=full`) overrides to the real apply→destroy for milestone verification (REQ-134, v1.12).
> **Speaker notes:** Close on honesty. The platform delivers real, verifiable value today — 22/22 auto-verifiable capabilities are Verified via the v1.11 lifecycle pipeline (apply→modify→destroy against live AWS) + the D-091 regression gate. The roadmap is concrete, not aspirational hand-waving — 9 planned items, each with a defined milestone and a clear reason it isn't shipped yet (usually an upstream dependency, not an engineering gap). Emphasize: 0 consumer adoption today — "Testing" means it works internally and is dev pilot-ready, not that it's released. The lifecycle pipeline defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); a CI variable (`NOVA_LIFECYCLE_MODE=full`) overrides to the real apply→destroy for milestone verification (REQ-134, v1.12).
---
@@ -456,7 +458,7 @@ A phased roadmap from the current Testing baseline to the full North Star:
## A7 — Operating Model & Cost (real AWS spend + pre-mortem)
ACDL runs at **zero cloud cost** for day-to-day development. The v1.0→v1.10 AWS spend was measured directly via Cost Explorer (`COST.md`, 2026-07-28):
Nova runs at **zero cloud cost** for day-to-day development. The v1.0→v1.10 AWS spend was measured directly via Cost Explorer (`COST.md`, 2026-07-28):
| Metric | Value |
|--------|-------|
@@ -467,7 +469,7 @@ ACDL runs at **zero cloud cost** for day-to-day development. The v1.0→v1.10 AW
- **S3 dominates** (98.8%, terraform state bucket) — no compute (ECS/Lambda) ran because v1.0→v1.10 was plan-only for IAM-gated capabilities.
- **Local emulators are the primary tier** — the full pipeline runs in-process, no AWS credentials, no Checkov, no DynamoDB. *(Testing.)*
- **Live-AWS verification is milestone-scoped, then torn down.** The v1.11 lifecycle pipeline ran apply→modify→destroy for every module, then tore down to zero-cost steady state (D-096 — teardown mandatory before milestone COMPLETE; no merge to main until `terraform show` confirms no resources). The lifecycle pipeline now **defaults to plan-only** on every PR (fast, no AWS mutation, no cost); a CI variable (`ACDL_LIFECYCLE_MODE=full`) overrides to the real apply→destroy for milestone verification (REQ-134, v1.12).
- **Live-AWS verification is milestone-scoped, then torn down.** The v1.11 lifecycle pipeline ran apply→modify→destroy for every module, then tore down to zero-cost steady state (D-096 — teardown mandatory before milestone COMPLETE; no merge to main until `terraform show` confirms no resources). The lifecycle pipeline now **defaults to plan-only** on every PR (fast, no AWS mutation, no cost); a CI variable (`NOVA_LIFECYCLE_MODE=full`) overrides to the real apply→destroy for milestone verification (REQ-134, v1.12).
- **Cost drivers** are spike-scoped: Terraform plan reads (free), S3 state storage (cents), DynamoDB outbox (cents). Any cost spike > $1/day is an anomaly.
**Pre-mortem (`PRE_MORTEM.md`):** the project's failure modes were pre-mortemed before the leadership pitch. The v1.10 decay incident (diff-scoped VERIFY missed 7 adapter defects across 8 NFR-patch phases — decks advertised capability that wasn't reproducible) is the root pattern: *a claim outruns the verification that backs it.* Four forward failure modes + structural mitigations: (FM-1) IAM-drift recurrence → IAM policy baseline is regression-tested; (FM-2) cost spike from un-torn-down stacks → D-096 mandatory teardown; (FM-3) deck overstates capability → verified-only claims + decks unfrozen only after re-verification; (FM-4) pilot contract gap → honest scope (microservice + static-assets today; the L2 pattern is extensible). All mitigations are structural, not procedural.
@@ -481,6 +483,6 @@ ACDL runs at **zero cloud cost** for day-to-day development. The v1.0→v1.10 AW
v1.11 rebuilt the platform on two architectural pillars that make "Verified" a structural property, not a claim:
- **The stateless adapter (REQ-123, 918 → ~80 lines).** The Terraform adapter was a 918-line monolith with 3 constant tables and 39 type-specific branches. It is now a ~80-line **stateless assembler**: it owns no module content — no resource shape, no nested HCL blocks, no defaults, no type-specific logic. Each L1 module ships a real `terraform/` module dir owning its resource shape, nested blocks, and defaults (centralized in `locals.tf`). The adapter reads the registry and emits `module "x" { source = ... }` blocks. No type-specific logic in the adapter means a new module is a new terraform dir, not a code change. *(The v1.12 P67 fix closed a dedup defect where multi-resource L1s — ecs-service, alb — produced invalid Terraform; CAP-013 now Verified.)*
- **Pipeline-driven lifecycle testing (REQ-127/128).** A `modules-lifecycle` pipeline matrix-runs each L1 and L2 module's `examples/{simple,complex}.yml` contracts through apply→modify→destroy against live AWS. No per-module Python. **The "test" = the pipeline cell going green.** Defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); `ACDL_LIFECYCLE_MODE=full` runs the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — 22/22 Verified as of v1.12.
- **Pipeline-driven lifecycle testing (REQ-127/128).** A `modules-lifecycle` pipeline matrix-runs each L1 and L2 module's `examples/{simple,complex}.yml` contracts through apply→modify→destroy against live AWS. No per-module Python. **The "test" = the pipeline cell going green.** Defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); `NOVA_LIFECYCLE_MODE=full` runs the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — 22/22 Verified as of v1.12.
> **Speaker notes:** This is the deep-dive slide for the Head of Engineering / Architecture. The two pillars are the answer to "how do you keep the decks honest?" The adapter is simple enough to reason about (a stateless assembler), and the lifecycle pipeline is the automated verification that backs every "Testing" claim. The v1.10 lesson is the negative space: a 918-line adapter with type-specific branches decayed silently because the VERIFY gate was diff-scoped. The ~80-line stateless adapter + the milestone regression gate are the structural fix. The plan-only default (v1.12) means this verification runs on every PR at zero cost, with the full apply→destroy gated behind a CI variable override.
docs/presentations/the-developer-experience-marp.md
+7 -7
View File
@@ -33,7 +33,7 @@ style: |
# The Developer Experience
### Agentic Cloud Delivery Platform
### Nova — The New Dawn of DevSecOps
<style>
section.title h1 { font-size: 44px; margin-bottom: 0.1em; }
@@ -48,8 +48,8 @@ section.title h3 { color: #F0F0F0; font-weight: 400; font-size: 22px; margin-top
- **Technical developer** — owns app code + a contract + a thin CI definition
- **Citizen developer** — declares intent; an AI agent produces a contract that passes the **same** safety envelope
- **Upstream is anything** — IDE, agentic SDLC, or vibe coding. ACDL doesn't care how the contract was produced
- **ACDL is infrastructure only** — provisions and governs AWS resources. Application deployment is upstream
- **Upstream is anything** — IDE, agentic SDLC, or vibe coding. Nova doesn't care how the contract was produced
- **Nova is infrastructure only** — provisions and governs AWS resources. Application deployment is upstream
---
@@ -140,7 +140,7 @@ code { font-size: 13px; }
```yaml
uses: acdl/.github/workflows/deploy.yml@v1.12
with:
contract: .acdl/contract.yml
contract: .nova/contract.yml
mode: decommission
changeRequestId: "CHG0678912"
```
@@ -287,7 +287,7 @@ section { font-size: 20px; }
table { font-size: 18px; }
</style>
ACDL runs at **zero cloud cost** for day-to-day development. AWS spend was measured via Cost Explorer (`COST.md`, 2026-07-28):
Nova runs at **zero cloud cost** for day-to-day development. AWS spend was measured via Cost Explorer (`COST.md`, 2026-07-28):
| Metric | Value |
|--------|-------|
@@ -297,7 +297,7 @@ ACDL runs at **zero cloud cost** for day-to-day development. AWS spend was measu
| Peak day | 2026-07-27 ($0.000867) |
- **Local emulators are the primary tier** — the full pipeline runs in-process, no AWS credentials
- **Live-AWS verification is milestone-scoped, then torn down.** The pipeline now **defaults to plan-only** on every PR; `ACDL_LIFECYCLE_MODE=full` overrides to apply→destroy for milestone verification (REQ-134, v1.12).
- **Live-AWS verification is milestone-scoped, then torn down.** The pipeline now **defaults to plan-only** on every PR; `NOVA_LIFECYCLE_MODE=full` overrides to apply→destroy for milestone verification (REQ-134, v1.12).
- **Cost drivers** are spike-scoped: Terraform plan reads (free), S3 state storage (cents), DynamoDB outbox (cents). No running infrastructure between milestones.
**Pre-mortem (`PRE_MORTEM.md`):** the v1.10 decay incident (diff-scoped VERIFY missed 7 adapter defects) is the root pattern: *a claim outruns the verification that backs it.* Four forward failure modes + structural mitigations (regression-tested IAM baseline, mandatory teardown, verified-only deck claims, honest scope).
@@ -316,6 +316,6 @@ section { font-size: 20px; }
Two architectural pillars make "Verified" a structural property, not a claim:
- **The stateless adapter (918 → ~80 lines).** The Terraform adapter was a 918-line monolith with 3 constant tables and 39 type-specific branches. It is now a ~80-line **stateless assembler**: it owns no module content — no resource shape, no nested HCL blocks, no defaults. Each L1 module ships a real `terraform/` module dir owning its shape, nested blocks, and defaults. The adapter reads the registry and emits `module "x" { source = ... }` blocks. A new module is a new terraform dir, not a code change. *(The v1.12 P67 fix closed a dedup defect for multi-resource L1s — ecs-service, alb; CAP-013 now Verified.)*
- **Pipeline-driven lifecycle testing.** A `modules-lifecycle` pipeline matrix-runs each L1 and L2 module's contracts through apply→modify→destroy against live AWS. **The "test" = the pipeline cell going green.** Defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); `ACDL_LIFECYCLE_MODE=full` overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — **22/22 Verified** as of v1.12.
- **Pipeline-driven lifecycle testing.** A `modules-lifecycle` pipeline matrix-runs each L1 and L2 module's contracts through apply→modify→destroy against live AWS. **The "test" = the pipeline cell going green.** Defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); `NOVA_LIFECYCLE_MODE=full` overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — **22/22 Verified** as of v1.12.
The v1.10 lesson is the negative space: a 918-line adapter with type-specific branches decayed silently. The ~80-line stateless adapter + the milestone regression gate are the structural fix.
docs/presentations/the-developer-experience-talking-points.md
+5 -5
View File
@@ -21,13 +21,13 @@
## Slide 2 — Two consumer paths, one safety envelope
**Talking points:**
- This is the scope-boundary slide — here's who uses the platform, and here's where ACDL's responsibility starts and stops
- This is the scope-boundary slide — here's who uses the platform, and here's where Nova's responsibility starts and stops
- Two consumer paths converge on the same contract: **technical** developer writes the contract directly; **citizen** developer declares intent and an AI agent produces a contract that passes the same safety envelope
- Upstream is anything — your IDE, an agentic SDLC, or vibe coding on a laptop. ACDL doesn't care how the contract was produced
- ACDL is infrastructure only — it provisions and governs AWS resources. Application deployment is upstream of the contract
- Upstream is anything — your IDE, an agentic SDLC, or vibe coding on a laptop. Nova doesn't care how the contract was produced
- Nova is infrastructure only — it provisions and governs AWS resources. Application deployment is upstream of the contract
- The two surfaces are *parallel*, not a progression. A citizen developer doesn't "graduate" to the developer surface. There is no "citizen developer mode" with weaker checks
**Key takeaway:** Two consumer paths, one safety envelope. ACDL is infra only — anything upstream is fair game.
**Key takeaway:** Two consumer paths, one safety envelope. Nova is infra only — anything upstream is fair game.
---
@@ -232,7 +232,7 @@
**Talking points:**
- The headline for the Head of Cloud / Finance: less than one cent over 8 days of active development; zero BAU cloud spend
- The lifecycle pipeline defaults to plan-only so the PR-time cost is zero; `ACDL_LIFECYCLE_MODE=full` overrides for milestone verification
- The lifecycle pipeline defaults to plan-only so the PR-time cost is zero; `NOVA_LIFECYCLE_MODE=full` overrides for milestone verification
- The pre-mortem is the credibility slide — we already asked "how does this fail?" and the mitigations are structural
- The v1.10 decay incident is disclosed honestly, not hidden — that disclosure IS the mitigation
- Cost drivers are spike-scoped: Terraform plan reads (free), S3 state storage (cents), DynamoDB outbox (cents). No running infrastructure between milestones
docs/presentations/the-developer-experience.html
+7 -7
View File
@@ -52,7 +52,7 @@ img { display: block; margin: 0 auto; max-height: 280px; }
<header>The Developer Experience</header>
<h1 id="the-developer-experience">The Developer Experience</h1>
<h3 id="agentic-cloud-delivery-platform">Agentic Cloud Delivery Platform</h3>
<h3 id="nova-the-new-dawn-of-devsecops">Nova — The New Dawn of DevSecOps</h3>
<footer>Internal</footer>
</section>
</foreignObject></svg><svg data-marpit-svg="" viewBox="0 0 1280 720"><foreignObject width="1280" height="720"><section id="2" data-paginate="true" data-header="The Developer Experience" data-footer="Internal" data-theme="default" data-style="section {
@@ -102,8 +102,8 @@ img { display: block; margin: 0 auto; max-height: 280px; }
<ul>
<li><strong>Technical developer</strong> — owns app code + a contract + a thin CI definition</li>
<li><strong>Citizen developer</strong> — declares intent; an AI agent produces a contract that passes the <strong>same</strong> safety envelope</li>
<li><strong>Upstream is anything</strong> — IDE, agentic SDLC, or vibe coding. ACDL doesn't care how the contract was produced</li>
<li><strong>ACDL is infrastructure only</strong> — provisions and governs AWS resources. Application deployment is upstream</li>
<li><strong>Upstream is anything</strong> — IDE, agentic SDLC, or vibe coding. Nova doesn't care how the contract was produced</li>
<li><strong>Nova is infrastructure only</strong> — provisions and governs AWS resources. Application deployment is upstream</li>
</ul>
<footer>Internal</footer>
</section>
@@ -456,7 +456,7 @@ img { display: block; margin: 0 auto; max-height: 280px; }
<p><img src="assets/png/developer-experience-07-decommission.png" alt="" style="width:1100px;" /></p>
<pre is="marp-pre" data-auto-scaling="downscale-only"><code class="language-yaml"><span class="hljs-attr">uses:</span> <span class="hljs-string">acdl/.github/workflows/deploy.yml@v1.12</span>
<span class="hljs-attr">with:</span>
<span class="hljs-attr">contract:</span> <span class="hljs-string">.acdl/contract.yml</span>
<span class="hljs-attr">contract:</span> <span class="hljs-string">.nova/contract.yml</span>
<span class="hljs-attr">mode:</span> <span class="hljs-string">decommission</span>
<span class="hljs-attr">changeRequestId:</span> <span class="hljs-string">&quot;CHG0678912&quot;</span>
</code></pre>
@@ -1028,7 +1028,7 @@ img { display: block; margin: 0 auto; max-height: 280px; }
<header>The Developer Experience</header>
<h1 id="a6--operating-model--cost">A6 — Operating Model &amp; Cost</h1>
<p>ACDL runs at <strong>zero cloud cost</strong> for day-to-day development. AWS spend was measured via Cost Explorer (<code>COST.md</code>, 2026-07-28):</p>
<p>Nova runs at <strong>zero cloud cost</strong> for day-to-day development. AWS spend was measured via Cost Explorer (<code>COST.md</code>, 2026-07-28):</p>
<table>
<thead>
<tr>
@@ -1057,7 +1057,7 @@ img { display: block; margin: 0 auto; max-height: 280px; }
</table>
<ul>
<li><strong>Local emulators are the primary tier</strong> — the full pipeline runs in-process, no AWS credentials</li>
<li><strong>Live-AWS verification is milestone-scoped, then torn down.</strong> The pipeline now <strong>defaults to plan-only</strong> on every PR; <code>ACDL_LIFECYCLE_MODE=full</code> overrides to apply→destroy for milestone verification (REQ-134, v1.12).</li>
<li><strong>Live-AWS verification is milestone-scoped, then torn down.</strong> The pipeline now <strong>defaults to plan-only</strong> on every PR; <code>NOVA_LIFECYCLE_MODE=full</code> overrides to apply→destroy for milestone verification (REQ-134, v1.12).</li>
<li><strong>Cost drivers</strong> are spike-scoped: Terraform plan reads (free), S3 state storage (cents), DynamoDB outbox (cents). No running infrastructure between milestones.</li>
</ul>
<p><strong>Pre-mortem (<code>PRE_MORTEM.md</code>):</strong> the v1.10 decay incident (diff-scoped VERIFY missed 7 adapter defects) is the root pattern: <em>a claim outruns the verification that backs it.</em> Four forward failure modes + structural mitigations (regression-tested IAM baseline, mandatory teardown, verified-only deck claims, honest scope).</p>
@@ -1111,7 +1111,7 @@ img { display: block; margin: 0 auto; max-height: 280px; }
<p>Two architectural pillars make &quot;Verified&quot; a structural property, not a claim:</p>
<ul>
<li><strong>The stateless adapter (918 → ~80 lines).</strong> The Terraform adapter was a 918-line monolith with 3 constant tables and 39 type-specific branches. It is now a ~80-line <strong>stateless assembler</strong>: it owns no module content — no resource shape, no nested HCL blocks, no defaults. Each L1 module ships a real <code>terraform/</code> module dir owning its shape, nested blocks, and defaults. The adapter reads the registry and emits <code>module &quot;x&quot; { source = ... }</code> blocks. A new module is a new terraform dir, not a code change. <em>(The v1.12 P67 fix closed a dedup defect for multi-resource L1s — ecs-service, alb; CAP-013 now Verified.)</em></li>
<li><strong>Pipeline-driven lifecycle testing.</strong> A <code>modules-lifecycle</code> pipeline matrix-runs each L1 and L2 module's contracts through apply→modify→destroy against live AWS. <strong>The &quot;test&quot; = the pipeline cell going green.</strong> Defaults to <strong>plan-only</strong> on every PR (fast, no AWS mutation, no cost); <code>ACDL_LIFECYCLE_MODE=full</code> overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — <strong>22/22 Verified</strong> as of v1.12.</li>
<li><strong>Pipeline-driven lifecycle testing.</strong> A <code>modules-lifecycle</code> pipeline matrix-runs each L1 and L2 module's contracts through apply→modify→destroy against live AWS. <strong>The &quot;test&quot; = the pipeline cell going green.</strong> Defaults to <strong>plan-only</strong> on every PR (fast, no AWS mutation, no cost); <code>NOVA_LIFECYCLE_MODE=full</code> overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — <strong>22/22 Verified</strong> as of v1.12.</li>
</ul>
<p>The v1.10 lesson is the negative space: a 918-line adapter with type-specific branches decayed silently. The ~80-line stateless adapter + the milestone regression gate are the structural fix.</p>
<footer>Internal</footer>
docs/presentations/the-developer-experience.md
+13 -11
View File
@@ -1,6 +1,6 @@
# The Developer Experience
> **Subtitle:** Agentic Cloud Delivery Platform
> **Subtitle:** Nova — The New Dawn of DevSecOps
> **Audience:** Senior Leadership, CTO, Head of Cloud, Head of Infrastructure, Head of DevOps
> **Length:** ~16 minutes · 11 main + Appendix TOC + 7 appendix = 19 slides
> **Purpose:** Sell the developer experience and the citizen developer experience to tech leadership — velocity without sacrificing safety, and security/observability/compliance as platform defaults rather than per-team effort.
@@ -11,6 +11,8 @@
## Slide 1 — Title
**Nova — The New Dawn of DevSecOps.** Security as a seamless enabler of fast deployments — not a bottleneck, not a "no" department.
The consumer surface is intentionally tiny. The platform's surface is large and opinionated.
> **Speaker notes:** Brief introduction — this deck covers *who uses the platform and how fast/safe they ship*, not the internal mechanics (that's the companion deck). Set the frame: velocity without sacrificing safety, and security/observability/compliance as platform defaults rather than per-team effort.
@@ -28,7 +30,7 @@ flowchart LR
A["Technical dev\n(app code + contract)"]
B["Citizen dev\n(intent → AI agent\n→ contract)"]
end
subgraph ACDL ["ACDL — infrastructure only"]
subgraph ACDL ["Nova — infrastructure only"]
C["Same contract\nSame pipeline\nSame safety"]
D["Provision\nAWS resources"]
E["Evidence\nhash-chained"]
@@ -47,10 +49,10 @@ flowchart LR
- **Technical developer** — owns app code + a contract + a thin CI definition.
- **Citizen developer** — declares intent in plain language; an AI agent produces a contract that passes the **same** safety envelope.
- **Upstream is anything** — IDE, agentic SDLC, or vibe coding. ACDL doesn't care how the contract was produced.
- **ACDL is infrastructure only** — it provisions and governs AWS resources. Application deployment is upstream.
- **Upstream is anything** — IDE, agentic SDLC, or vibe coding. Nova doesn't care how the contract was produced.
- **Nova is infrastructure only** — it provisions and governs AWS resources. Application deployment is upstream.
> **Speaker notes:** This is the thesis of the deck. The two surfaces are *parallel*, not a progression — a citizen developer doesn't "graduate" to the developer surface. Both produce a contract; both get the same treatment. The scope boundary matters: anything upstream of the contract is out of ACDL's concern. The leadership takeaway: we expand who can ship safely without lowering the bar.
> **Speaker notes:** This is the thesis of the deck. The two surfaces are *parallel*, not a progression — a citizen developer doesn't "graduate" to the developer surface. Both produce a contract; both get the same treatment. The scope boundary matters: anything upstream of the contract is out of Nova's concern. The leadership takeaway: we expand who can ship safely without lowering the bar.
---
@@ -66,7 +68,7 @@ flowchart TD
U2["Citizen dev\nintent → AI agent → contract"]
end
subgraph ACDL ["ACDL — infrastructure only"]
subgraph ACDL ["Nova — infrastructure only"]
direction TB
CS["Contract schema\n(validate + fail-fast)"]
subgraph PIPE ["Central pipeline — fixed stages, every deployment"]
@@ -231,7 +233,7 @@ flowchart LR
```yaml
uses: acdl/.github/workflows/deploy.yml@v1.12
with:
contract: .acdl/contract.yml
contract: .nova/contract.yml
mode: decommission
changeRequestId: "CHG0678912"
```
@@ -364,7 +366,7 @@ Consumers `uses:` a **versioned** central workflow. The platform fetches itself
flowchart LR
A["Consumer repo<br/>app + contract + 'uses:'"] -->|triggers on push to main| B["Platform runner"]
B -->|checks out the consumer repo| A
B -->|checks out the ACDL platform repo<br/>into the workspace| C["Platform code<br/>(modules, adapters, schemas)"]
B -->|checks out the Nova platform repo<br/>into the workspace| C["Platform code<br/>(modules, adapters, schemas)"]
C --> B
B -->|runs the pipeline against<br/>the consumer's contract| D["Consumer's resources in AWS"]
```
@@ -426,7 +428,7 @@ flowchart LR
## A6 — Operating Model & Cost
ACDL runs at **zero cloud cost** for day-to-day development. The v1.0→v1.10 AWS spend was measured directly via Cost Explorer (`COST.md`, 2026-07-28):
Nova runs at **zero cloud cost** for day-to-day development. The v1.0→v1.10 AWS spend was measured directly via Cost Explorer (`COST.md`, 2026-07-28):
| Metric | Value |
|--------|-------|
@@ -436,7 +438,7 @@ ACDL runs at **zero cloud cost** for day-to-day development. The v1.0→v1.10 AW
| Peak day | 2026-07-27 ($0.000867 — v1.10 regression + verify run) |
- **Local emulators are the primary tier** — the full pipeline runs in-process, no AWS credentials, no Checkov, no DynamoDB.
- **Live-AWS verification is milestone-scoped, then torn down.** The v1.11 lifecycle pipeline ran apply→modify→destroy for every module, then tore down to zero-cost steady state (D-096 — teardown mandatory before milestone COMPLETE). The lifecycle pipeline now **defaults to plan-only** on every PR (fast, no AWS mutation, no cost); a CI variable (`ACDL_LIFECYCLE_MODE=full`) overrides to the real apply→destroy for milestone verification (REQ-134, v1.12).
- **Live-AWS verification is milestone-scoped, then torn down.** The v1.11 lifecycle pipeline ran apply→modify→destroy for every module, then tore down to zero-cost steady state (D-096 — teardown mandatory before milestone COMPLETE). The lifecycle pipeline now **defaults to plan-only** on every PR (fast, no AWS mutation, no cost); a CI variable (`NOVA_LIFECYCLE_MODE=full`) overrides to the real apply→destroy for milestone verification (REQ-134, v1.12).
- **Cost drivers** are spike-scoped: Terraform plan reads (free), S3 state storage (cents), DynamoDB outbox (cents). No running infrastructure between milestones.
**Pre-mortem (`PRE_MORTEM.md`):** the project's failure modes were pre-mortemed before the leadership pitch. The v1.10 decay incident (diff-scoped VERIFY missed 7 adapter defects — decks advertised capability that wasn't reproducible) is the root pattern: *a claim outruns the verification that backs it.* Four forward failure modes + structural mitigations (regression-tested IAM baseline, mandatory teardown, verified-only deck claims, honest scope).
@@ -450,6 +452,6 @@ ACDL runs at **zero cloud cost** for day-to-day development. The v1.0→v1.10 AW
v1.11 rebuilt the platform on two architectural pillars that make "Verified" a structural property, not a claim:
- **The stateless adapter (918 → ~80 lines).** The Terraform adapter was a 918-line monolith with 3 constant tables and 39 type-specific branches. It is now a ~80-line **stateless assembler**: it owns no module content. Each L1 module ships a real `terraform/` module dir owning its resource shape, nested blocks, and defaults. A new module is a new terraform dir, not a code change. *(The v1.12 P67 fix closed a dedup defect for multi-resource L1s — ecs-service, alb; CAP-013 now Verified.)*
- **Pipeline-driven lifecycle testing.** A `modules-lifecycle` pipeline matrix-runs each L1 and L2 module's contracts through apply→modify→destroy against live AWS. **The "test" = the pipeline cell going green.** Defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); `ACDL_LIFECYCLE_MODE=full` runs the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — 22/22 Verified as of v1.12.
- **Pipeline-driven lifecycle testing.** A `modules-lifecycle` pipeline matrix-runs each L1 and L2 module's contracts through apply→modify→destroy against live AWS. **The "test" = the pipeline cell going green.** Defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); `NOVA_LIFECYCLE_MODE=full` runs the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — 22/22 Verified as of v1.12.
> **Speaker notes:** This is the deep-dive slide for the Head of Engineering / Architecture. The two pillars answer "how do you keep the decks honest?" The adapter is simple enough to reason about (a stateless assembler); the lifecycle pipeline is the automated verification that backs every "Testing" claim. The v1.10 lesson is the negative space: a 918-line adapter with type-specific branches decayed silently. The ~80-line stateless adapter + the milestone regression gate are the structural fix. The plan-only default (v1.12) means verification runs on every PR at zero cost, with the full apply→destroy gated behind a CI variable override.
docs/vision.md
+3 -1
View File
@@ -1,4 +1,6 @@
# Agentic Cloud Delivery Vision
# Nova Vision
> **Nova — The New Dawn of DevSecOps.** Security as a seamless enabler of fast deployments — not a bottleneck, not a "no" department.
## 1. The Friction
modules/README.md
+1 -1
View File
@@ -1,4 +1,4 @@
# ACDL Modules
# Nova Modules
Reusable building blocks for cloud infrastructure. Each module is
self-documented with a `README.md` following the
modules/STANDARDS.md
+2 -2
View File
@@ -1,6 +1,6 @@
# ACDL Module Engineering Standards
# Nova Module Engineering Standards
Standards for authoring and reviewing ACDL modules. These standards
Standards for authoring and reviewing Nova modules. These standards
govern the two module tiers — **L1 primitives** (single cloud resource
or small group of related resources) and **L2 modules** (compositions
that reference L1 primitives to deploy a complete stack) — and the
modules/l1/alb/instance.json
+2 -2
View File
@@ -11,7 +11,7 @@
"type": "aws:elbv2:loadbalancer",
"module": "alb@1.0.0",
"inputs": {
"name": "acdl-alb",
"name": "nova-alb",
"subnets": "subnet-12345",
"security_group": "sg-12345",
"region": "us-east-1"
@@ -27,7 +27,7 @@
"type": "aws:elbv2:targetgroup",
"module": "alb@1.0.0",
"inputs": {
"name": "acdl-alb",
"name": "nova-alb",
"port": 80,
"protocol": "HTTP",
"region": "us-east-1"
modules/l1/cloudfront/terraform/locals.tf
+4 -4
View File
@@ -1,7 +1,7 @@
locals {
# OAC defaults (adapter previously hardcoded these).
oac_name = "acdl-oac"
oac_origin_type = "s3"
oac_signing_behavior = "always"
oac_signing_protocol = "sigv4"
oac_name = "nova-oac"
oac_origin_type = "s3"
oac_signing_behavior = "always"
oac_signing_protocol = "sigv4"
}
modules/l1/ecs-cluster/terraform/variables.tf
+1 -1
View File
@@ -1,7 +1,7 @@
variable "name" {
type = string
description = "ECS cluster name."
default = "acdl-cluster"
default = "nova-cluster"
}
variable "region" {
modules/l1/ecs-service/terraform/main.tf
+3 -3
View File
@@ -8,15 +8,15 @@ resource "aws_ecs_task_definition" "this" {
}
resource "aws_ecs_service" "this" {
name = "acdl-microservice"
name = "nova-microservice"
cluster = var.cluster_arn
task_definition = aws_ecs_task_definition.this.arn
desired_count = var.desired_count
launch_type = var.launch_type
network_configuration {
subnets = local.subnet_list
security_groups = local.security_groups
subnets = local.subnet_list
security_groups = local.security_groups
assign_public_ip = var.launch_type == "FARGATE"
}
modules/l1/iam-role/terraform/variables.tf
+1 -1
View File
@@ -1,7 +1,7 @@
variable "role_name" {
type = string
description = "The IAM role name."
default = "acdl-microservice-role"
default = "nova-microservice-role"
}
variable "assume_role_policy" {
modules/l1/kms-key/README.md
+1 -1
View File
@@ -42,7 +42,7 @@ rotation enabled. One key per L2 deployment (no shared keys).
"type": "aws:kms:key",
"module": "kms-key@1.0.0",
"inputs": {
"description": "ACDL per-stack CMK",
"description": "Nova per-stack CMK",
"region": "us-east-1"
}
}
modules/l1/kms-key/terraform/locals.tf
+1 -1
View File
@@ -1,3 +1,3 @@
locals {
alias_name = "alias/acdl-ci-kms"
alias_name = "alias/nova-ci-kms"
}
modules/l1/rds/terraform/main.tf
+1 -1
View File
@@ -1,6 +1,6 @@
resource "aws_db_subnet_group" "this" {
count = var.subnet_ids != "" ? 1 : 0
name = "acdl-ci-rds-subnet-group"
name = "nova-ci-rds-subnet-group"
subnet_ids = split(",", var.subnet_ids)
}
modules/l1/s3/terraform/locals.tf
+2 -2
View File
@@ -6,8 +6,8 @@ locals {
# Tags: merge caller-supplied tags with the module defaults.
tags = merge(
{
"acdl:owner" = "acdl"
"acdl:environment" = "dev"
"nova:owner" = "acdl"
"nova:environment" = "dev"
},
var.tags
)
modules/l1/s3/terraform/outputs.tf
+1 -1
View File
@@ -10,5 +10,5 @@ output "bucket_name" {
output "bucket_regional_domain_name" {
value = aws_s3_bucket.this.bucket_regional_domain_name
description = "The bucket regional domain name (e.g. acdl-spike-bucket.s3.us-east-1.amazonaws.com)."
description = "The bucket regional domain name (e.g. nova-spike-bucket.s3.us-east-1.amazonaws.com)."
}
modules/l1/uptime/terraform/main.tf
+2 -2
View File
@@ -1,5 +1,5 @@
resource "aws_ecs_task_definition" "uptime" {
family = "acdl-uptime"
family = "nova-uptime"
cpu = tostring(var.cpu)
memory = tostring(var.memory)
requires_compatibilities = ["FARGATE"]
@@ -8,7 +8,7 @@ resource "aws_ecs_task_definition" "uptime" {
}
resource "aws_ecs_service" "uptime" {
name = "acdl-uptime"
name = "nova-uptime"
cluster = local.cluster_ref
task_definition = aws_ecs_task_definition.uptime.arn
desired_count = var.feature_flag_enabled ? 1 : 0
modules/l1/vpc/terraform/locals.tf
+1 -1
View File
@@ -1,7 +1,7 @@
locals {
cidr_block = var.cidr != null ? var.cidr : "10.0.0.0/16"
az_list = split(",", var.azs)
name_tag = var.name != null ? var.name : "acdl-vpc"
name_tag = var.name != null ? var.name : "nova-vpc"
# Derive subnet CIDRs from the VPC CIDR
subnet_cidrs = [
modules/l1/vpc/terraform/variables.tf
+1 -1
View File
@@ -13,7 +13,7 @@ variable "azs" {
variable "name" {
type = string
description = "Name tag for the VPC and child resources."
default = "acdl-vpc"
default = "nova-vpc"
}
variable "region" {
modules/l1/waf/terraform/main.tf
+1 -1
View File
@@ -15,7 +15,7 @@ resource "aws_wafv2_web_acl" "this" {
visibility_config {
cloudwatch_metrics_enabled = true
metric_name = "acdl-waf-metrics"
metric_name = "nova-waf-metrics"
sampled_requests_enabled = true
}
modules/l1/waf/terraform/variables.tf
+1 -1
View File
@@ -1,7 +1,7 @@
variable "name" {
type = string
description = "WAF Web ACL name."
default = "acdl-waf"
default = "nova-waf"
}
variable "scope" {
modules/l2/microservice/composition.json
+1 -1
View File
@@ -18,7 +18,7 @@
"wires": [
{"from": "contract.inputs.name", "to": "alb.inputs.name", "default": "app"},
{"from": "contract.inputs.name", "to": "ecr.inputs.name", "default": "app-repo"},
{"from": "contract.inputs.name", "to": "roles.inputs.role_name", "default": "acdl-app-role"},
{"from": "contract.inputs.name", "to": "roles.inputs.role_name", "default": "nova-app-role"},
{"from": "contract.inputs.region", "to": "cluster.inputs.region"},
{"from": "contract.inputs.region", "to": "ecr.inputs.region"},
{"from": "contract.inputs.region", "to": "roles.inputs.region"},
pipelines/README.md
+5 -5
View File
@@ -1,16 +1,16 @@
# ACDL Pipelines
# Nova Pipelines
## Overview
ACDL uses declarative pipeline contracts (YAML) as the single source of truth. Both Gitea and GitHub workflows implement the same contract (byte-identical). The shell runner (`scripts/run_ci.sh`) mirrors the CI pipeline locally so that every stage that runs in CI can be reproduced on a developer machine without a forge.
Nova uses declarative pipeline contracts (YAML) as the single source of truth. Both Gitea and GitHub workflows implement the same contract (byte-identical). The shell runner (`scripts/run_ci.sh`) mirrors the CI pipeline locally so that every stage that runs in CI can be reproduced on a developer machine without a forge.
## Existing Pipelines
| Pipeline | File | Stages | Triggers |
| --- | --- | --- | --- |
| ACDL CI | `ci.yml` | `lint`, `test`, `check-only` | push/PR to `main` |
| ACDL Deploy | `contract.yml` | `validate-contract`, `resolve-stack`, `terraform-plan`, `checkov`, `confidence`, `apply`, `publish-outputs`, `deploy-uptime`, `comment-outputs` | push/PR to `main` (consumer repos via `workflow_call`) |
| ACDL Modules Lifecycle | `modules-lifecycle.yml` | `platform-vpc-apply`, `lifecycle-apply`, `lifecycle-modify`, `lifecycle-destroy`, `l2-lifecycle-apply`, `l2-lifecycle-modify`, `l2-lifecycle-destroy`, `platform-vpc-destroy` | PR to `main` + `workflow_dispatch` |
| Nova CI | `ci.yml` | `lint`, `test`, `check-only` | push/PR to `main` |
| Nova Deploy | `contract.yml` | `validate-contract`, `resolve-stack`, `terraform-plan`, `checkov`, `confidence`, `apply`, `publish-outputs`, `deploy-uptime`, `comment-outputs` | push/PR to `main` (consumer repos via `workflow_call`) |
| Nova Modules Lifecycle | `modules-lifecycle.yml` | `platform-vpc-apply`, `lifecycle-apply`, `lifecycle-modify`, `lifecycle-destroy`, `l2-lifecycle-apply`, `l2-lifecycle-modify`, `l2-lifecycle-destroy`, `platform-vpc-destroy` | PR to `main` + `workflow_dispatch` |
## How to Write a Pipeline
pipelines/ci.yml
+1 -1
View File
@@ -1,4 +1,4 @@
# ACDL Central CI Pipeline Contract (v1.5)
# Nova Central CI Pipeline Contract (v1.5)
#
# This is the single source of truth for the CI/CD pipeline. Both
# .gitea/workflows/ci.yml (Gitea Actions, dev) and
pipelines/contract.yml
+2 -2
View File
@@ -1,4 +1,4 @@
# ACDL Central Deployment Pipeline Contract (v1.8)
# Nova Central Deployment Pipeline Contract (v1.8)
#
# This is the single source of truth for the deployment pipeline. It
# declares the stages that run when a consumer submits a contract:
@@ -17,7 +17,7 @@
#
# Validated against schemas/deploy-pipeline.schema.json.
name: acdl-deploy
name: nova-deploy
environment: dev
triggers:
push: [main]
pipelines/modules-lifecycle.yml
+3 -3
View File
@@ -1,6 +1,6 @@
name: acdl-modules-lifecycle
# ACDL Modules Lifecycle Pipeline — apply→modify→destroy against live AWS.
# Nova Modules Lifecycle Pipeline — apply→modify→destroy against live AWS.
#
# Matrix-runs each L1 module's examples/{simple,complex}.yml contracts:
# 1. --apply simple.yml (terraform apply — creates resources)
@@ -13,7 +13,7 @@ name: acdl-modules-lifecycle
#
# Lifecycle mode (REQ-134, v1.12): `default_mode: plan` — the lifecycle
# scripts run `run_platform.sh --plan-only` (fast, no AWS mutation, no
# AWS credentials, no cost) on every PR. Set the ACDL_LIFECYCLE_MODE CI
# AWS credentials, no cost) on every PR. Set the NOVA_LIFECYCLE_MODE CI
# variable (workflow_dispatch input `lifecycle_mode`) to `full` for the
# real apply→modify→destroy against live AWS. The CI VPC apply/destroy
# jobs are skipped in plan mode (nothing is applied).
@@ -36,7 +36,7 @@ terraform_version: "1.9.*"
# Default lifecycle mode: "plan" (plan-only, fast, no AWS mutation) or "full"
# (real apply→modify→destroy against live AWS). Overridable via the
# ACDL_LIFECYCLE_MODE CI variable / workflow_dispatch input.
# NOVA_LIFECYCLE_MODE CI variable / workflow_dispatch input.
default_mode: plan
stages:
pyproject.toml
+2 -2
View File
@@ -1,7 +1,7 @@
[project]
name = "acdl"
name = "nova"
version = "1.14.0"
description = "Agentic Cloud Delivery Platform — consumers declare intent; the platform delivers safe production deployment."
description = "Nova — consumers declare intent; the platform delivers safe production deployment."
requires-python = ">=3.10"
dependencies = [
"boto3>=1.34",
schemas/README.md
+9 -9
View File
@@ -1,24 +1,24 @@
# ACDL Schemas
# Nova Schemas
## Overview
ACDL uses JSON Schema draft 2020-12 for all declarative contracts. Schemas are the single source of truth for validation. Every contract, stack instance, pipeline, and policy result in the platform is validated against a schema in this directory before it is consumed by any downstream code path. The resolver, the pipeline runner, the CI workflows, and the test suite all load these schemas directly.
Nova uses JSON Schema draft 2020-12 for all declarative contracts. Schemas are the single source of truth for validation. Every contract, stack instance, pipeline, and policy result in the platform is validated against a schema in this directory before it is consumed by any downstream code path. The resolver, the pipeline runner, the CI workflows, and the test suite all load these schemas directly.
## Existing Schemas
| Schema | File | Purpose | Where Validated |
| --- | --- | --- | --- |
| ACDL Consumer Contract | `contract.schema.json` | Consumer contract validation (id, name, environment, infrastructure map with module versions + inputs) | `core/contract_resolver.py`, `scripts/run_platform.sh` Step 1, CI `schema-validation` job |
| ACDL Target Stack | `stack.schema.json` | Target Stack instance validation (resources, relationships, composition tree, NFRs) | `core/contract_resolver.py` (post-resolution), `tests/conftest.py` |
| ACDL Central Pipeline Contract | `pipeline.schema.json` | Central CI pipeline contract (stages, commands, triggers, runner) | `tests/test_pipeline_contract.py` |
| ACDL Central Deployment Pipeline Contract | `deploy-pipeline.schema.json` | Central deploy pipeline contract (validate → resolve → plan → checkov → confidence → apply → publish → uptime → comment) | `tests/test_pipeline_contract.py` |
| ACDL PolicyCheckResult | `policy_check_result.schema.json` | Normalized policy check result schema (the contract between policy engines and the confidence signal) | `tests/conftest.py`, all adapter tests |
| ACDL Tagging Standard | `tagging-standard.json` | Required tag set for all taggable AWS resources | `adapters/terraform/policy/custom_rules/acdl_tagging.py` |
| Nova Consumer Contract | `contract.schema.json` | Consumer contract validation (id, name, environment, infrastructure map with module versions + inputs) | `core/contract_resolver.py`, `scripts/run_platform.sh` Step 1, CI `schema-validation` job |
| Nova Target Stack | `stack.schema.json` | Target Stack instance validation (resources, relationships, composition tree, NFRs) | `core/contract_resolver.py` (post-resolution), `tests/conftest.py` |
| Nova Central Pipeline Contract | `pipeline.schema.json` | Central CI pipeline contract (stages, commands, triggers, runner) | `tests/test_pipeline_contract.py` |
| Nova Central Deployment Pipeline Contract | `deploy-pipeline.schema.json` | Central deploy pipeline contract (validate → resolve → plan → checkov → confidence → apply → publish → uptime → comment) | `tests/test_pipeline_contract.py` |
| Nova PolicyCheckResult | `policy_check_result.schema.json` | Normalized policy check result schema (the contract between policy engines and the confidence signal) | `tests/conftest.py`, all adapter tests |
| Nova Tagging Standard | `tagging-standard.json` | Required tag set for all taggable AWS resources | `adapters/terraform/policy/custom_rules/nova_tagging.py` |
## How to Write a Schema
1. Use JSON Schema draft 2020-12: `"$schema": "https://json-schema.org/draft/2020-12/schema"`.
2. Set `$id` to `https://acdl.cloudinit.dev/schemas/<name>.schema.json`.
2. Set `$id` to `https://nova.cloudinit.dev/schemas/<name>.schema.json`.
3. Include `title` and `description` at the document root.
4. Set `type: object` at the document root.
5. Declare a `required` array listing the mandatory top-level property names.
schemas/contract.schema.json
+2 -2
View File
@@ -1,7 +1,7 @@
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://acdl.cloudinit.dev/schemas/contract.schema.json",
"title": "ACDL Consumer Contract",
"$id": "https://nova.cloudinit.dev/schemas/contract.schema.json",
"title": "Nova Consumer Contract",
"description": "A consumer contract declares intent: which infrastructure to deploy, in which environment, with which inputs. The contract is keyed by an operational id (3-6 char acronym, becomes the stack name for state keys, tags, and outbox events) and a human-readable name (becomes the stack title for display and evidence). The infrastructure map is keyed by module name; each entry carries an optional version (defaults to the latest published version from the module registry) and per-module inputs. The contract resolver resolves each infrastructure entry against modules/registry.json, then merges them into a single Target Stack instance.",
"type": "object",
"required": ["id", "name", "environment", "infrastructure"],
schemas/deploy-pipeline.schema.json
+3 -3
View File
@@ -1,8 +1,8 @@
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://acdl.cloudinit.dev/schemas/deploy-pipeline.schema.json",
"title": "ACDL Central Deployment Pipeline Contract",
"description": "Declarative contract for the ACDL deployment pipeline. Declares the stages that run when a consumer submits a contract: validate-contract, resolve-stack, terraform-plan, checkov, confidence, apply. The platform (scripts/run_platform.sh) implements these stages. This is the declarative pipeline spec; the executable workflow is .github/workflows/deploy.yml which invokes scripts/run_platform.sh.",
"$id": "https://nova.cloudinit.dev/schemas/deploy-pipeline.schema.json",
"title": "Nova Central Deployment Pipeline Contract",
"description": "Declarative contract for the Nova deployment pipeline. Declares the stages that run when a consumer submits a contract: validate-contract, resolve-stack, terraform-plan, checkov, confidence, apply. The platform (scripts/run_platform.sh) implements these stages. This is the declarative pipeline spec; the executable workflow is .github/workflows/deploy.yml which invokes scripts/run_platform.sh.",
"type": "object",
"required": ["name", "triggers", "runner", "stages"],
"properties": {
schemas/environment.schema.json
+2 -2
View File
@@ -1,7 +1,7 @@
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://acdl.cloudinit.dev/schemas/environment.schema.json",
"title": "ACDL Platform-Managed Environment",
"$id": "https://nova.cloudinit.dev/schemas/environment.schema.json",
"title": "Nova Platform-Managed Environment",
"description": "A named environment the platform owns (an AWS account or scoped partition, a network, a state backend, an IAM role surfaced to the consumer via ABAC). Selected by name in the contract's 'environment' field. The environment onboarding check (core/environment_check.py) loads the matching <name>.json; the contract resolver (core/contract_resolver.py) uses it as the 'env' context for ${env.<field>} interpolation.",
"type": "object",
"required": ["name", "account_id", "region", "state_backend", "network", "runner_role_arn", "autonomy", "confidence_threshold"],

Some files were not shown because too many files have changed in this diff Show More