docs(init): validate specification — v1.28 CLI Canonicalization + Identity Layer

---ci---
project: acdl
phase: 0
milestone: v1.28
status: specify
---/ci---

.ciagent/PROJECT.md

@@ -344,7 +344,7 @@ plan-JSON policies + pipeline wiring (REQ-300,301,302), meta-policies
 (REQ-303), regression-gate policies (REQ-304,305), docs + adapter README
 (REQ-306,307), tests (REQ-308,309).
 
-## v1.26 — Live Pilot Estate Activation (active)
+## v1.26 — Live Pilot Estate Activation (complete, tag `v1.25.5`, merged to main 2026-08-19)
 
 > **Active milestone.** Feature milestone — the first real consumer estate
 > (a stock exchange on a homegrown PoA blockchain, equities only) is
@@ -438,4 +438,104 @@ already exist).
 > live in `.ciagent/PLAN.md` (the active phase plan, retained in full).
 > v1.26 pre-execution artifacts (CLARIFY/GRILL/IDEATE/RESEARCH) are in
 > git history (pre-v1.27-P0 commits); the v1.26 phase verifications +
-> review are archived at `.ciagent/archive/{VERIFY-P03,VERIFY-P04,REVIEW-AUDIT-P05}.md`.
+> review are archived at `.ciagent/archive/{VERIFY-P03,VERIFY-P04,REVIEW-AUDIT-P05}.md`.
+
+## v1.27 — PO State Catalog & Ciagent Compression (complete, tag `v1.26.3`, merged to main 2026-08-19)
+
+> **NFR milestone — complete.** STATE.md authored (32 CAPs, 11 invariants,
+> 10 domains). 8 outdated `.ciagent/` files archived (7 platform + 1
+> consumer). PROJECT.md + ROADMAP.md v1.26 phase-status corrected.
+> STATE.md wired into P-final ship discipline. Tags: `v1.26.0` (P0) →
+> `v1.26.1..v1.26.2` (P1..P2) → `v1.26.3` (P3 final = milestone release).
+> Review: 0 P0. Audit: reconstruction PASS, file/branch/commit discipline CLEAN.
+> Full phase detail: `.ciagent/archive/` (v1.27 artifacts) + git history.
+
+## v1.28 — CLI Canonicalization + Identity Layer (active)
+
+> **Feature milestone — active.** The Nova CLI becomes installable from
+> internal PyPI (CodeArtifact), every `core/` module is reachable as a
+> `nova <subcommand>`, the CLI and Lambda functions share a single
+> `core/` source tree, and Nova owns its identity layer end-to-end
+> (sign-up through token vending) with no AWS-managed identity services
+> in the path. Nova-idp is introduced: two Lambda functions (`nova-idp-auth`,
+> `nova-idp-token-vend`), KMS-signed OIDC tokens, ABAC-gated token vending
+> via the existing kyverno-json engine (INV-4 swappable), and PAT
+> lifecycle (issuance, revocation, status).
+>
+> Tags run on the **v1.27.x** line: `v1.27.0` (P0) → `v1.27.1..v1.27.N`
+> (execution phases) → `v1.27.(N+1)` (final phase = milestone release).
+> Milestone branch: `milestone/v1.28-cli-identity`.
+
+### v1.28 ID allocations (re-mapped — no collisions with shipped history)
+
+- **Decisions:** `D-226..D-231` (authored in CLARIFY). Repo decision
+  namespace is `D-NNN` (max D-225); no `D-NEW-*` namespace exists.
+- **Requirements:** `REQ-323..REQ-353` (31 REQs, mapping the spec's
+  REQ-001..REQ-031 1:1). Max existing REQ = REQ-322.
+- **Capabilities:** `CAP-033..CAP-038` (mapping the spec's CAP-025..CAP-030).
+  Existing CAP-025..032 are blockchain/pilot — collision avoided.
+- **Invariants:** `INV-12..INV-17` (mapping the spec's INV-63,64,65,18..21,34).
+  Max existing INV = INV-11.
+- **`kj` engine → kyverno-json.** The spec references a `kj` engine; the
+  repo's actual policy engine is `kyverno-json` (INV-4 swappable). v1.28
+  uses kyverno-json as the ABAC evaluator for token-vend; no new `kj`
+  engine is built. This is a CLARIFY-grounded re-mapping, not a silent
+  assumption (D-229).
+
+### v1.28 Requirements
+
+New requirements REQ-323..REQ-353 — full text in
+`.ciagent/REQUIREMENTS.md` §v1.28. Summary by priority:
+
+- **P1 — CLI Substrate (REQ-323..REQ-328):** CodeArtifact wheel + Lambda
+  layer pipeline; CLI subcommand per `core/` module; `nova init`
+  scaffolding; `nova cli-action` published to GitHub + Gitea;
+  `mode_resolver.py` (flag → env → credential type → TTY); audit
+  emission with `mode` + `selection_reason`.
+- **P2 — Lambda Packaging + Identity Layer (REQ-329..REQ-344):** dual-use
+  `core/lambda/contract_ingestor.py`; local env synthesizer; JWS signing
+  key from PAT; `nova-idp-auth` Lambda (Argon2id, DynamoDB); DynamoDB
+  tables (`nova-users`, `nova-sessions`, `nova-password-resets`);
+  `nova-idp-token-vend` Lambda (KMS-signed OIDC, JWKS endpoint); kyverno-json
+  ABAC policy at `platform/abac/token-vend.policy`; `nova idp setup`
+  (`--check/--apply/--verify`); CloudFormation review; PAT issuance +
+  hashes in DynamoDB; `nova auth login/revoke/status`.
+- **P3 — Documentation (REQ-345..REQ-347):** operator guide for
+  `nova idp setup`; developer guide for `nova auth login`; identity-layer
+  threat model.
+- **P4 — Integration Testing (REQ-348..REQ-351):** E2E sign-up → sign-in →
+  token-vend → apply → audit; property tests for `mode_resolver`; KMS
+  round-trip test; PAT revocation SLO test (≤60s P95).
+- **P5 — Capability Gate (REQ-352..REQ-353):** CAP-033..038 verification
+  gates wired into CI.
+
+### v1.28 Hard constraints
+
+- DO NOT depend on Cognito, IAM Identity Center, or any AWS-managed
+  identity service for sign-up/sign-in/token-vending (NFR-5). Nova-idp
+  signs OIDC tokens directly via KMS. (Note: no Cognito exists in the
+  repo today — this is a greenfield build, not a "Cognito drop".)
+- DO NOT build a new `kj` engine — use kyverno-json (INV-4).
+- DO NOT enforce MFA/TOTP for prod/dr this milestone — ship the code path,
+  enforce in v1.21+ (deferred, INV scope).
+- DO NOT add WebAuthn/FIDO2, upstream IdP federation, or password breach
+  detection — deferred to v1.23+.
+- DO NOT add Lambda layer auto-update on `core/` changes — v1.18 ships
+  manual `nova layer update`; v1.19 adds CI-triggered auto-update.
+- The token-vend Lambda MUST evaluate the kyverno-json ABAC policy before
+  signing; allow/deny decisions MUST be emitted to the audit stream
+  (NFR-9, D-227).
+- `nova idp setup --apply` MUST present the CloudFormation template for
+  review before any resource is created (NFR-10).
+
+### v1.28 phase status (active — phase 0 in progress)
+
+- **P0** pre-execution (SPECIFY→CLARIFY→RESEARCH→PLAN→GRILL→MVP/UX) — in
+  progress, target tag `v1.27.0`.
+- **P1..PN** execution phases — planned in PLAN.md.
+- **P(N+1)** final review + audit + milestone ship — target tag
+  `v1.27.(N+1)` = the v1.28 release.
+
+> Phase-by-phase task breakdown, wave ordering, and persona assignments
+> will live in `.ciagent/PLAN.md`. Authoritative resume state:
+> `.ciagent/CHECKPOINT.json`.