chore(P02): compress .ciagent/ files — archive completed milestones + slim active context
Relocate completed-milestone history to .ciagent/archive/ (byte-identical
snapshots of PROJECT/REQUIREMENTS/ROADMAP/ARCHITECTURE pre-compression +
verbatim moves of REVIEW/AUDIT/VERIFY/PRE_MORTEM). Slim the in-place files
to retain only active-milestone (v1.26) + immediate-predecessor (v1.25)
context + durable vision/tenets/scope/RACI/capability-status/load-bearing
decisions. REGRESSION_REPORT.{json,md} stay in place (live read/write
targets of core/metrics/collector.py + core/regression_verify.py).
Working context: 11,164 → 4,152 lines (~63% reduction). Archive preserves
8,615 lines. Lossless via relocation + git history. No test regressions
(761 passed; same 3 pre-existing failures as baseline).
---ci---
project: acdl
phase: 2
milestone: v1.26
status: execute
lessons:
- REGRESSION_REPORT.{json,md} are live operational files (read by
core/metrics/collector.py + core/regression_verify.py) — must NOT be
archived. Pre-flight grep for code references to candidate archive
paths before any move.
- test_no_purged_loaded_term scans .ciagent/PROJECT.md + CLARIFY.md +
docs/ for 'penetrat' — slimmed files must not reintroduce it. Historical
description of the purge ('removed the term ...') is safe in ROADMAP.
- Git rename detection (R) works for pure file moves; snapshot-then-slim
shows as A + M. Both preserve history.
---/ci---
This commit is contained in:
Jon Chery
+87
-526
@@ -1,16 +1,28 @@
|
||||
# Nova — Architecture (v1.1 target)
|
||||
# Nova — Architecture
|
||||
|
||||
> Target architecture for the real Agentic Cloud Delivery Platform (rebranded
|
||||
> Nova in v1.15). Source of truth for **how**: `docs/architecture.md` (v0.2) is the upstream
|
||||
> draft; this file is the Nova-repo operating copy, refined at phase
|
||||
> boundaries. Where this file and `docs/vision.md` conflict, the vision wins.
|
||||
> **Compressed.** The full v1.0–v1.24 architecture history (v1.1 spike
|
||||
> scope, v1.2 build-out, v1.8–v1.16 addenda) is preserved verbatim at
|
||||
> `.ciagent/archive/ARCHITECTURE-v1.0-v1.24.md`. This file retains the
|
||||
> durable target architecture (§1–§12, the four layers + six cross-cutting
|
||||
> concerns) + the three addenda that describe the **current state**:
|
||||
> v1.11 (stateless adapter), v1.15 (Nova rebrand — current naming), and
|
||||
> v1.17 (telemetry/observability layer + §12.7 Policy Engine Registry).
|
||||
> Intermediate addenda (v1.1 spike scope, v1.2 build-out, v1.8/1.9/1.10/
|
||||
> 1.12/1.13/1.14/1.16) describe evolved or superseded states and are
|
||||
> preserved in the archive snapshot.
|
||||
>
|
||||
> Source of truth for **how**: `docs/architecture.md` (v0.2) is the
|
||||
> upstream draft; this file is the Nova-repo operating copy, refined at
|
||||
> phase boundaries. Where this file and `docs/vision.md` conflict, the
|
||||
> vision wins.
|
||||
|
||||
## Status
|
||||
|
||||
Architecture is at **v0.2** upstream (`docs/architecture.md`). Milestone v1.1
|
||||
**finalizes it to v1.0** in Phase 07 by resolving the 11 open decisions
|
||||
(see `PROJECT.md` open-decision resolutions table). This file records the
|
||||
locked commitments and the v1.1 spike scope.
|
||||
Architecture is at **v0.2** upstream (`docs/architecture.md`). Milestone
|
||||
v1.1 **finalized it to v1.0** in Phase 07 by resolving the 11 open
|
||||
decisions (see `PROJECT.md` open-decision resolutions table). The v1.11
|
||||
addendum (stateless adapter) and the v1.17 addendum (telemetry layer +
|
||||
§12.7 Policy Engine Registry) record the current-state refinements.
|
||||
|
||||
## Overview
|
||||
|
||||
@@ -55,8 +67,9 @@ the same policy envelope, and the same evidence stream.
|
||||
### Layer 1 — Foundational Primitives
|
||||
Single-purpose, **engine-agnostic** primitive modules. L1 modules do
|
||||
not compose with other L1s; L1 takes its environment as input. The L1
|
||||
interface is defined against the **Target Stack IR**, not against Terraform
|
||||
directly (the IR is shaped to round-trip to Terraform in v1, per §12.1).
|
||||
interface is defined against the **Target Stack IR**, not against
|
||||
Terraform directly (the IR is shaped to round-trip to Terraform in v1,
|
||||
per §12.1).
|
||||
|
||||
- No inter-L1 references. L1 may call Terraform data sources.
|
||||
- Semver: interface → MAJOR, behavior → MINOR, lifecycle → PATCH (W3.D).
|
||||
@@ -68,8 +81,8 @@ Combine L1 primitives into deployable shapes. Each codebase maps to one
|
||||
canonical L2 stack (`multiStack: true` only per W1.B). Shape X
|
||||
(parameterized module) or Shape Y (thin-composition layer). Hierarchical
|
||||
composition, max depth 5, only registered L1s. The thin-composition tree's
|
||||
`wires` field is defined against the IR's relationship type, not a Terraform
|
||||
module block.
|
||||
`wires` field is defined against the IR's relationship type, not a
|
||||
Terraform module block.
|
||||
|
||||
Pipeline quality checks: secrets-in-plaintext, public ingress, IAM
|
||||
wildcard, KMS key reference, tag compliance, naming convention. Restricted
|
||||
@@ -149,6 +162,10 @@ before contract submission ack); RTO = async worker's dead-letter recovery.
|
||||
Single-region in v1. The outbox also stores per-contract QA and prod
|
||||
approver identities (the only durable record outside GitHub's audit log).
|
||||
|
||||
> **v1.17 update:** the Decision Ledger (SQLite hash-chain, D-121) is the
|
||||
> pilot's audit record. S3 Object Lock / JWS (D-083) is deferred — see
|
||||
> the v1.17 addendum below.
|
||||
|
||||
### Human-in-the-Loop mechanics (§10)
|
||||
Pre-execution gates. qa, prod, dr are PR-based attestation gates backed by
|
||||
GitHub Environments with required reviewers. No partial deployment to roll
|
||||
@@ -181,28 +198,28 @@ platform does not run the skill. Stateless agents, all state in the
|
||||
platform. Skills are reviewed for sensitive data before release (Infra &
|
||||
Ops owns the review; it is the mandatory release gate).
|
||||
|
||||
### Angine execution (§12) — the binding constraint
|
||||
**Target Stack IR** (locked): a engine-neutral description of resources
|
||||
### Engine execution (§12) — the binding constraint
|
||||
**Target Stack IR** (locked): an engine-neutral description of resources
|
||||
(typed inputs/outputs/NFRs), relationships (single parent per child),
|
||||
composition (tree, max depth 5), and policy hooks. The L1 registry, L2
|
||||
thin-composition tree, contract YML, and PolicyCheckResult schema are all
|
||||
defined against the IR — none against any specific engine.
|
||||
|
||||
**Angine adapters** are the only engine-specific code. An adapter
|
||||
compiles the IR into a engine execution plan. **v1 ships exactly one
|
||||
**Engine adapters** are the only engine-specific code. An adapter
|
||||
compiles the IR into an engine execution plan. **v1 ships exactly one
|
||||
adapter: the Terraform adapter.** v2+ may add OpenTofu, Pulumi, K8s CRDs
|
||||
without architectural change.
|
||||
|
||||
v1 reality: the IR is shaped to round-trip cleanly to Terraform (nearly
|
||||
isomorphic). As more adapters appear, the IR gets more expressive and the
|
||||
adapters gain translation logic; the L1 content, the YML standard, and the
|
||||
thin-composition tree do not change.
|
||||
adapters gain translation logic; the L1 content, the YML standard, and
|
||||
the thin-composition tree do not change.
|
||||
|
||||
**Terraform adapter (v1):** translates IR-typed L1 interface → Terraform
|
||||
`variable`/`output` blocks; IR-typed L2 thin-composition tree → Terraform
|
||||
root module; IR-typed relationships → module references; emits a
|
||||
`terraform plan` from the IR. The adapter is a thin layer; it does not own
|
||||
L1/L2 content.
|
||||
> **v1.11 update:** the Terraform adapter is now a **stateless assembler**
|
||||
> (~80 lines, emits `module "x" { source }` blocks) — see the v1.11
|
||||
> addendum below. The §12 "thin layer that translates IR → Terraform
|
||||
> variable/output blocks" framing is superseded by the stateless-assembler
|
||||
> model; the L1-owns-its-shape invariant is the new contract.
|
||||
|
||||
State storage: S3 (state) + DynamoDB (locking), cloud-managed,
|
||||
single-region in v1.
|
||||
@@ -211,6 +228,10 @@ Policy toolchain: **Checkov** for Terraform plan policy (the L2 checks +
|
||||
tag/naming); **Kyverno** for K8s-native/platform-internal policy; **OPA**
|
||||
reserved for cross-resource cases, explicitly last resort.
|
||||
|
||||
> **v1.25 update:** the policy toolchain is now unified under the
|
||||
> swappable `PolicyEngine` protocol — see §12.7 below. Checkov and Wiz
|
||||
> remain as raw-finding adapters feeding into kyverno-json meta-policies.
|
||||
|
||||
**Policy result normalization (§12.6):** the confidence signal consumes a
|
||||
normalized `PolicyCheckResult` schema, not raw engine output.
|
||||
|
||||
@@ -242,337 +263,9 @@ Contract→IR resolution: the contract declares intent in IR-typed terms;
|
||||
the pipeline resolves it to a target stack (list of L1 instances + inputs +
|
||||
relationships); the Terraform adapter compiles the target stack to a plan.
|
||||
|
||||
## v1.1 spike scope
|
||||
---
|
||||
|
||||
The spike (Phases 08–10) materializes the **minimum** that proves the IR
|
||||
commitments hold (no polyglot mess):
|
||||
|
||||
- One L1: `l1-s3` (IR-typed interface; the only AWS resource in the spike).
|
||||
- One L2 thin-composition: `l2-static-assets` (references `l1-s3` only).
|
||||
- Terraform adapter: IR → `terraform plan` against AWS via OIDC.
|
||||
- One contract submission → contract→IR → `terraform plan` → Checkov
|
||||
`PolicyCheckResult` → confidence signal → evidence event to the DynamoDB
|
||||
outbox.
|
||||
- State: S3 + DynamoDB (real AWS, single-region).
|
||||
|
||||
Out of spike scope: full HITL matrix wiring, Kyverno, OPA, MCP skill
|
||||
catalog, GitOps reconciler, multi-region, prod/dr environments, the 5-skill
|
||||
L3B catalog. Those are post-spike (v1.2+) platform build-out.
|
||||
|
||||
## Gitea API surface (carried from v1.0, refined)
|
||||
|
||||
| Capability | Gitea support | ACDL approach (v1.1) |
|
||||
|------------|---------------|----------------------|
|
||||
| Org-scoped repo create | `POST /api/v1/orgs/{org}/repos` | Used for any new repos |
|
||||
| Native Pages | **None** | Serve `acdl-evidence` via raw file URLs (unchanged from v1.0) |
|
||||
| Environments API | **None**; act_runner ignores `environment:` | Model HITL gates via `workflow_dispatch` approval inputs (v1.0 D-013 pattern) — **refined in Phase 07** for the real pre-execution gate model |
|
||||
| `repository_dispatch` | Not supported | Cross-repo trigger via `workflow_dispatch` API (unchanged) |
|
||||
| Reusable workflows | Supported | `acdl/.gitea/workflows/pipeline.yml` via `uses: ...@<ref>` |
|
||||
| `id-token: write` / OIDC | **Not supported** (RESEARCH TARGET 1, conf 0.95). Gitea docs list `id-token` as an unsupported GitHub-only scope; open proposal go-gitea/gitea#33681; draft PR go-gitea/gitea#36988 unmerged. Even Gitea's own CI uses long-lived AWS keys (issue #37980). | **Spike waiver D-039:** per-run-rotated long-lived key (rotated after each run by `scripts/rotate_spike_key.sh`). Real OIDC deferred to v1.2, blocked on PR #36988. |
|
||||
| `actions/configure-aws-credentials` | Unusable without OIDC | Spike uses static AWS creds from a (rotated) Gitea Actions secret via the `aws-actions/configure-aws-credentials@v4` `access-key-id`/`secret-access-key` inputs, or plain `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY` env vars. v1.2 switches to `role-to-assume` when OIDC lands. |
|
||||
|
||||
### Branch pinning rule (refined for W2.A)
|
||||
|
||||
- Dev/qa contracts reference the reusable workflow by **tag**
|
||||
(`@v1.1-spike`).
|
||||
- Prod-bound workflows reference by **SHA**; the platform CLI
|
||||
(`platform/cli/resolve-tag.ts`, Phase 07) resolves the current tag to its
|
||||
SHA. (Spike scope: the CLI is a stub; the real CLI lands in v1.2.)
|
||||
|
||||
### Verification toolchain
|
||||
|
||||
ACDL has no `package.json`. The verification gate substitutes:
|
||||
- **typecheck:** `terraform validate`, `python3 -m py_compile`, JSON Schema
|
||||
validation (`ajv` or `python -m jsonschema`) against `schemas/`.
|
||||
- **test:** per-phase `scripts/verify_phaseNN.sh` (Phase 06: archive integrity;
|
||||
Phase 07: schema validation + decision-resolution completeness; Phase 08:
|
||||
OIDC assume-role + state backend; Phase 09: IR + L1 + adapter `terraform
|
||||
plan`; Phase 10: end-to-end contract submission).
|
||||
- **build:** `terraform init` (real build for the spike).
|
||||
- See `PERSONAS.md` verification_toolchain.
|
||||
|
||||
## Build order (v1.1)
|
||||
|
||||
1. Phase 06 — archive demo, reorient repo.
|
||||
2. Phase 07 — finalize architecture v1.0; author schemas + designs.
|
||||
3. Phase 08 — AWS OIDC bootstrap (use temp key once, rotate).
|
||||
4. Phase 09 — IR + `l1-s3` + Terraform adapter → `terraform plan`.
|
||||
5. Phase 10 — `l2-static-assets` + contract→IR → end-to-end spike.
|
||||
6. COMPLETE gate — review → ship `v1.2.0` → audit. **DONE.**
|
||||
|
||||
## v1.2 build-out scope
|
||||
|
||||
v1.2 takes the v1.1 spike (dev-only, `plan`-only, single S3 L1) to a real,
|
||||
simpler, better-documented platform that delivers a microservice to AWS ECS
|
||||
Fargate end-to-end. The locked architecture (§1–§12) is unchanged — v1.2
|
||||
extends the *implementation*, not the design.
|
||||
|
||||
### In scope (five axes, user-directed 2026-07-21)
|
||||
|
||||
1. **Re-evaluate the current state.** go-gitea/gitea#36988 (OIDC for Gitea
|
||||
Actions) re-checked 2026-07-21: still **open** (last updated 2026-05-27,
|
||||
not merged). Real OIDC remains deferred to v1.3+; v1.2 extends the D-039
|
||||
per-run-rotated-key waiver as **D-047**. The waiver continues to satisfy
|
||||
§12.5's *intent* (no *persistently* long-lived key): the spike key is
|
||||
rotated after each run by `scripts/rotate_spike_key.sh`, and Phase 12
|
||||
tightens the IAM scoping + rotation hygiene.
|
||||
2. **NFR improvements on the existing spike.** Least-privilege IAM audit of
|
||||
`spike_runner_policy.json`; idempotent `create_state_backend.py` /
|
||||
`create_iam_user.py`; proper exit codes / error handling; P1-1 redaction
|
||||
(two AWS access key IDs in `.ciagent/VERIFY.md` Phase 09 narrative).
|
||||
3. **Streamline / simplify the current setup.** Consolidate
|
||||
`run_spike_plan.sh` + `run_spike_e2e.sh` into one
|
||||
`scripts/run_platform.sh`; remove dead code and stale `platform/` paths.
|
||||
4. **README.md fully up to date on how the platform works.** Reflect v1.1
|
||||
complete; document the actual spike flow, `scripts/run_platform.sh`, the
|
||||
real repo layout, and the v1.2 objective.
|
||||
5. **Bootstrap a consumer repo with a basic microservice deployed to ECS
|
||||
end-to-end.** New Gitea repo `acdl-consumer-microservice` (org
|
||||
`continuous-intelligence`); new IR-typed L1s (`l1-vpc`, `l1-ecs-cluster`,
|
||||
`l1-ecs-service`, `l1-iam-role`, `l1-alb`, `l1-ecr`); new
|
||||
`l2-microservice` thin-composition; one contract submission →
|
||||
`terraform apply` (dev, autonomous per §10, confidence ≥ 0.50) → a live
|
||||
ECS Fargate service serving HTTP 200 → evidence event to the DynamoDB
|
||||
outbox → acdl-evidence timeline.
|
||||
|
||||
### Angine extension (ECS Fargate)
|
||||
|
||||
The Terraform adapter (§12) remains the only engine-specific code. v1.2
|
||||
expands the adapter `TYPE_MAP` to cover the six new ECS-shaped IR resource
|
||||
types. The L1 interface shape (IR-typed inputs/outputs/NFRs, registered in
|
||||
`modules-ir/registry.json`) is unchanged — only the set of registered L1s
|
||||
grows. The IR commitments (REQ-28) continue to hold: `modules-ir/`,
|
||||
`schemas/`, `contracts/`, `core/confidence_signal.py`,
|
||||
`core/contract_resolver.py`, `core/outbox_writer.py`
|
||||
remain engine-agnostic.
|
||||
|
||||
### `terraform apply` (dev only)
|
||||
|
||||
v1.2 lifts the engine execution from `plan` to `apply` for the `dev`
|
||||
environment only. Dev is autonomous per §10 (confidence ≥ 0.50, no HITL).
|
||||
`apply` for qa/prod/dr remains HITL-gated and out of scope for v1.2. The
|
||||
apply result (resources created, plan diff) is captured in the evidence
|
||||
stream as a `terraform.apply` event.
|
||||
|
||||
### Out of scope for v1.2 (deferred to v1.3+)
|
||||
|
||||
| Feature | Reason |
|
||||
|---------|--------|
|
||||
| Real OIDC federation | go-gitea/gitea#36988 still open. v1.2 extends D-039 waiver (D-047); real OIDC is v1.3+. |
|
||||
| Full HITL matrix wiring (qa/prod/dr) | v1.2 is dev-only autonomous `apply`; HITL wiring is v1.3. |
|
||||
| Kyverno + OPA policy engines | v1.2 keeps Checkov only; Kyverno/OPA are v1.3. |
|
||||
| MCP skill catalog + real L3B agent | v1.2 keeps the L3B stub; the 5-skill catalog is v1.3. |
|
||||
| Audit ledger build-out (S3 Object Lock + JWS + async worker + DLQ + daily checkpoints) | v1.2 keeps the v1.1 outbox; the regulatory ledger is v1.3. |
|
||||
| Multi-region state / outbox | Single-region in v1 (§9, §12.3); multi-region is v1.3+. |
|
||||
| Prod/dr environments | v1.2 is dev-only; prod/dr are v1.3. |
|
||||
| GitOps reconciler (ArgoCD/Flux) | v1.3+. |
|
||||
|
||||
## Build order (v1.2)
|
||||
|
||||
1. Phase 11 — re-eval #36988 + NFR audit + simplification findings + README rewrite.
|
||||
2. Phase 12 — NFR harden + simplify (idempotent bootstrap, one `run_platform.sh`, IAM audit, redactions).
|
||||
3. Phase 13 — six ECS L1s + adapter `TYPE_MAP` expansion.
|
||||
4. Phase 14 — `l2-microservice` + contract schema extension.
|
||||
5. Phase 15 — consumer repo + `terraform apply` (dev) → live ECS service.
|
||||
6. Phase 16 — capstone e2e: consumer commit → live HTTP 200 → evidence → timeline.
|
||||
7. COMPLETE gate — review → ship `v1.3.0` → audit.
|
||||
|
||||
## v1.8 Architecture Addendum
|
||||
|
||||
> Milestone v1.8 (complete, tag `v1.8.0`). Adds encryption-by-default,
|
||||
> deletion-protection-by-default, uptime monitoring, decommission alias,
|
||||
> engineering standards, and path documentation.
|
||||
|
||||
### New Primitives
|
||||
|
||||
- **`kms-key`** (`aws:kms:key`) — Per-stack customer-managed KMS key with
|
||||
`enable_key_rotation = true`. One key per L2 deployment (no shared keys).
|
||||
Wired into both L2 compositions as a child, with its `kms_key_arn` output
|
||||
connected to all children's `kms_key_arn` input. Adapter emits
|
||||
`aws_kms_key` + `enable_key_rotation`.
|
||||
- **`uptime`** (`aws:ecs:uptime-service`) — Uptime-kuma on ECS Fargate with
|
||||
a feature flag (`feature_flag_enabled`), monitored endpoints (HTTP/DNS/TCP),
|
||||
alert channels (Teams/email/SMS/GitHub issues). Deployed by default after
|
||||
any L2 module with a separate terraform state. When the feature flag is
|
||||
false, the adapter emits no resources.
|
||||
|
||||
### Encryption by Default
|
||||
|
||||
All 12 L1 primitives have `encryption_enabled` NFR (default true). Primitives
|
||||
with at-rest data (s3, rds, ecr, ecs-service, ecs-cluster) have an optional
|
||||
`kms_key_arn` input. The adapter emits encryption blocks (SSE-KMS for S3,
|
||||
storage_encrypted for RDS, encryption_configuration for ECR) referencing the
|
||||
per-stack CMK when provided. Managed KMS fallback with stderr warning for
|
||||
standalone L1 deployments.
|
||||
|
||||
### Deletion Protection by Default
|
||||
|
||||
All 12 L1 primitives have `deletion_protection` NFR (default true). The
|
||||
adapter emits `lifecycle { prevent_destroy = true }` when true. L2 modules
|
||||
expose a `features.deletion_protection` flag (default true) propagated to
|
||||
all children via the resolver. Setting `inputs.deletion_protection: false`
|
||||
in the contract disables it for the whole stack.
|
||||
|
||||
### Decommission Alias
|
||||
|
||||
A `mode: decommission` on the deploy pipeline implements a 2-step destroy:
|
||||
1. Disable deletion protection (resolve with `deletion_protection: false`,
|
||||
terraform plan/apply, HITL SRE gate via GitHub environment).
|
||||
2. Zero counts + destroy (`decommission_transform` zeroes all scalable counts,
|
||||
terraform plan/apply, second HITL SRE gate).
|
||||
|
||||
CMDB validation via DynamoDB `acdl-change-requests` table. The Lambda
|
||||
`validate_change_request` action queries the table and asserts
|
||||
`status == "approved"` + `consumerRepo` match.
|
||||
|
||||
### Adapter Expansion
|
||||
|
||||
TYPE_MAP grew from 16 to 19 entries (+ `aws:kms:key`, `aws:kms:alias`,
|
||||
`aws:ecs:uptime-service`). Specialized emission branches added for KMS key
|
||||
rotation, S3 SSE-KMS configuration, uptime ECS Fargate task, and
|
||||
`prevent_destroy` lifecycle on all resources.
|
||||
|
||||
### Pipeline Stages
|
||||
|
||||
The deploy pipeline grew from 8 to 9 stages (+ `deploy-uptime` after
|
||||
`publish-outputs`). The `deploy-uptime` stage constructs a synthetic uptime
|
||||
contract from the L2 stack outputs, resolves + adapts it to a separate
|
||||
terraform state directory, and publishes the uptime URL via PR comment.
|
||||
|
||||
### Forge-Agnostic API URLs
|
||||
|
||||
The platform Lambda (`contract_ingestor.py`) reads `GITHUB_API_BASE` env
|
||||
for forge-agnostic API URLs. GitHub uses `/search/issues`; Gitea uses
|
||||
`/repos/{owner}/{repo}/issues`. Detection via `/api/v1` in the base URL.
|
||||
|
||||
## v1.9 Addendum (2026-07-23)
|
||||
|
||||
### New Components
|
||||
|
||||
- **`core/contract_resolver.py` interpolation** (D-081): the resolver
|
||||
now expands `${env.<field>}` + `${contract.<field>}` tokens
|
||||
post-schema-validation, pre-IR-resolution. The env context is the
|
||||
loaded environment onboarding JSON (`core/environments/<name>.json`,
|
||||
schema `schemas/environment.schema.json`). The resolver's
|
||||
`child_input_map` routes L2 wires to the sub-resource that declares the
|
||||
input (P1-1 — `desired_count` → `aws:ecs:service`, `family` →
|
||||
`aws:ecs:task_definition`).
|
||||
- **`core/environment_check.py` `load()`** (REQ-104): loads + returns the
|
||||
parsed environment JSON; emits a stderr warning for placeholder
|
||||
`account_id` when env != dev.
|
||||
- **`core/hitl_gates.py`** (REQ-108, D-084): the HITL pre-execution
|
||||
attestation gate. Records the approver identity to the DynamoDB outbox
|
||||
(`approver_qa`/`approver_prod`/`approver_dr`), runs the separation-of-
|
||||
duties check on prod, invokes the attestation matrix, returns
|
||||
`(ok, reason)`. Dev skips (autonomous). `run_platform.sh` calls
|
||||
`attest` before apply for qa/prod/dr.
|
||||
- **`core/attestation_matrix.py`** (REQ-109, D-084): the 8-concern
|
||||
attestation matrix from `hitl_matrix_design.md` §10.4. Offline-testable
|
||||
concerns (contract NFRs, schema validity, policy pass) run for real;
|
||||
operator-supplied concerns accept signed evidence artifacts validated
|
||||
for freshness + schema. Signature verification skips when
|
||||
`ACDL_ATTESTATION_SIGNING_KEY_ID` is unset (D-089).
|
||||
- **`core/separation_of_duties.py` `route_halt_artifact`** (REQ-107):
|
||||
real SNS publish (`acdl-sod-halt` topic, ARN from
|
||||
`ACDL_SOD_HALT_TOPIC_ARN`) + outbox fallback
|
||||
(`SEPARATION_OF_DUTIES_VIOLATION` event). The SNS topic is defined in
|
||||
`terraform/platform/main.tf`.
|
||||
- **`adapters/wiz/wiz_adapter.py` `WizClient`** (REQ-110): real GraphQL
|
||||
API client (`<WIZ_API_URL>/graphql`, Bearer auth, pagination via
|
||||
`pageInfo.hasNextPage`). `fetch_and_adapt` translates issues →
|
||||
`PolicyCheckResult`. Graceful degrade when unconfigured.
|
||||
- **`adapters/kyverno/kyverno_adapter.py`** (REQ-111): fleshed-out
|
||||
`PolicyReport` → `PolicyCheckResult` mapping (pass/fail/skip/warn +
|
||||
severity + skip-with-reason + resource construction). Inactive-for-TF
|
||||
guard preserved.
|
||||
|
||||
### Per-Environment Promotion (D-082)
|
||||
|
||||
The deploy workflow (`.github/workflows/deploy.yml` +
|
||||
`.gitea/workflows/deploy.yml`, byte-identical) declares an `environment`
|
||||
`workflow_call` input. When non-empty, `run_platform.sh --environment
|
||||
<name>` overrides the contract's `environment` field before schema
|
||||
validation (D-088). One CI job per environment; promotion = running the
|
||||
matching job, no `environment:` field editing. Per-env contract files
|
||||
(`contracts/<module>.<env>.yaml`) use interpolation for env-specific
|
||||
values.
|
||||
|
||||
### Adapter Parameterization (P1-1, D-085)
|
||||
|
||||
The adapter (`adapters/terraform/adapter.py`) reads ECS/ALB/VPC defaults
|
||||
from L1 `interface.json` inputs (`desired_count`, `launch_type`,
|
||||
`family`, `target_type`, `load_balancer_type`, `name`). The adapter is a
|
||||
thin translator; the `child_input_map` routes wires to the declaring
|
||||
sub-resource.
|
||||
|
||||
### Deferred (D-083)
|
||||
|
||||
S3 Object Lock + JWS detached signatures + async worker + DLQ + daily
|
||||
checkpoints (audit ledger build-out) — deferred to a future milestone.
|
||||
The hash-chain + DynamoDB-outbox path remains the v1.9 production audit
|
||||
record.
|
||||
|
||||
## v1.10 Addendum — Regression VERIFY + Local Emulators + Capability Re-Verification
|
||||
|
||||
### Regression-Class VERIFY (D-091, `core/regression_verify.py`)
|
||||
|
||||
The standard VERIFY stage was diff-scoped (it checked the phase diff
|
||||
only, never re-ran underlying capability). This let 8 NFR-patch phases
|
||||
(v1.9.1–v1.9.8) pass while the platform decayed. The regression-class
|
||||
VERIFY (`core/regression_verify.py`) re-runs capability checks against
|
||||
the current codebase and tags each Verified/Decayed/Broken. It fails
|
||||
closed on any non-Verified capability, blocking milestone completion.
|
||||
|
||||
The registry (`CAPABILITY_REGISTRY`) holds 16 capability checks
|
||||
(CAP-001..CAP-016): 12 local-tier + 4 live-AWS. Adding a capability is
|
||||
a single function + one registry entry. The gate runs via
|
||||
`scripts/run_regression.sh` and writes `.ciagent/REGRESSION_REPORT.md`
|
||||
+ `.json`.
|
||||
|
||||
### Local Emulating Adapters (D-092, `core/local_emulators.py`)
|
||||
|
||||
Four local adapters let the platform run the full headline E2E without
|
||||
cloud credentials:
|
||||
|
||||
- `FlatFileOutbox` — flat-file DynamoDB outbox emulator (hash-chained
|
||||
JSONL; resumable across instances; chain verification).
|
||||
- `LocalEcsEmulator` — local ECS Fargate HTTP 200 emulator (binds port
|
||||
0 on 127.0.0.1; daemon thread; clean destroy).
|
||||
- `LocalS3StateBackend` — rewrites the terraform S3 backend to a local
|
||||
backend (per-stack tfstate in a temp folder).
|
||||
- `LocalLambdaStub` — invokes the contract_ingestor handler in-process
|
||||
(patches `_get_dynamodb`/`_get_secrets_client`/`urllib.urlopen`;
|
||||
DynamoDB writes redirected to the FlatFileOutbox).
|
||||
|
||||
`run_local_e2e()` runs the full pipeline: contract → resolver → adapter
|
||||
→ local S3 backend → local ECS (HTTP 200) → flat-file outbox (chain
|
||||
verified) → local Lambda (200). Gated on `ACDL_LOCAL_TIER=1`.
|
||||
|
||||
### Capability Re-Verification Sweep (D-093)
|
||||
|
||||
`.ciagent/CAPABILITY_INVENTORY.md` enumerates 16 auto-verified
|
||||
capabilities + 6 IAM-gated escalated resources. The sweep found and
|
||||
fixed 7 adapter defects in `adapters/terraform/adapter.py` (duplicate
|
||||
outputs, duplicate args, missing required args, deprecated AWS provider
|
||||
v5 arg names). The headline E2E now passes at both tiers: local
|
||||
emulator + live-AWS terraform init/validate/plan.
|
||||
|
||||
### Adapter Defect Fixes (P54)
|
||||
|
||||
7 defects fixed in `adapters/terraform/adapter.py`:
|
||||
1. Duplicate output definitions (per-resource + stack-level both emitted).
|
||||
2. Duplicate `desired_count`/`launch_type` on ECS service.
|
||||
3. Duplicate `target_type`/`family`/`load_balancer_type`.
|
||||
4. Missing `assume_role_policy`/`role_name` on IAM role (L2 composition gap).
|
||||
5. Missing `cidr_block`/`vpc_id`/`name` defaults on VPC/subnet/route_table/
|
||||
ECS cluster/ECR repository.
|
||||
6. ECR `kms_key_arn` unsupported arg → `encryption_configuration` block.
|
||||
7. CloudFront OAC + WAF deprecated arg names (AWS provider v5):
|
||||
`signing_behavior`, `signing_protocol`, `origin_access_control_id`,
|
||||
`s3_origin_config.origin_access_identity`, `origin_id`, `rule`
|
||||
(singular), `scope=CLOUDFRONT` (uppercase).
|
||||
|
||||
## v1.11 Addendum — Stateless Adapter + Pipeline-Driven Lifecycle Testing
|
||||
## v1.11 Addendum — Stateless Adapter + Pipeline-Driven Lifecycle Testing (current state)
|
||||
|
||||
**Stateless adapter (D-098).** `adapters/terraform/adapter.py` rewritten
|
||||
from a 918-line monolith (3 constant tables `TYPE_MAP`/`INPUT_MAP`/
|
||||
@@ -598,83 +291,25 @@ VPC; the microservice composition references it via
|
||||
`terraform_remote_state` (data source). State keys are deterministic and
|
||||
env-aware (`spike/{contract.id}/{contract.environment}/terraform.tfstate`).
|
||||
|
||||
**NOVA_LIFECYCLE_MODE (v1.12, REQ-134; renamed ACDL→NOVA in v1.15 P2).** The lifecycle pipeline defaults
|
||||
to plan-only (fast, no AWS mutation, no cost). A CI variable
|
||||
`NOVA_LIFECYCLE_MODE` (default `plan`) overrides to `full` for the real
|
||||
apply→modify→destroy. (P2–P4 dual-read fallback to `ACDL_LIFECYCLE_MODE`;
|
||||
fallback removed in P5 per the v1.15 addendum.)
|
||||
**NOVA_LIFECYCLE_MODE (v1.12, REQ-134; renamed ACDL→NOVA in v1.15 P2).**
|
||||
The lifecycle pipeline defaults to plan-only (fast, no AWS mutation, no
|
||||
cost). A CI variable `NOVA_LIFECYCLE_MODE` (default `plan`) overrides to
|
||||
`full` for the real apply→modify→destroy. (P2–P4 dual-read fallback to
|
||||
`ACDL_LIFECYCLE_MODE`; fallback removed in P5 per the v1.15 addendum.)
|
||||
|
||||
## v1.12 Addendum — Presentation Refinement + CAP-013 Fix
|
||||
|
||||
**CAP-013 adapter dedup fix (REQ-129).** Multi-resource L1s (ecs-service,
|
||||
alb) with stack outputs + cross-module refs now dedup to ONE module block
|
||||
named by the composition child id, with expanded sub-ids rewritten via
|
||||
`id_remap`. `terraform validate` succeeds for the microservice stack.
|
||||
|
||||
**CAP-017/018 probe fixes (REQ-130).** CAP-017's probe no longer requires
|
||||
`locals.tf` for modules that legitimately omit it. CAP-018's probe
|
||||
instantiates `LocalLambdaStub` with the required `outbox` arg.
|
||||
|
||||
## v1.13 Addendum — Presentation Polish + Config Schema Migration
|
||||
|
||||
**Config.json schema migration (v1.13.1).** Regenerated
|
||||
`.ciagent/config.json` to the updated CIAgent v2 config structure (drop
|
||||
removed fields, migrate `gitea`→`release.gitea`, add
|
||||
`secrets`/`ship`/`backend`/`ideation`/`personas`/`logging`/`telemetry`
|
||||
sections).
|
||||
|
||||
**Presentation polish (v1.13.0, v1.13.2).** Action headlines, story-arc
|
||||
restructure, larger fonts, 6 new mermaid diagrams, badge cleanup,
|
||||
platform-architecture diagram. Docs-only NFR patches.
|
||||
|
||||
## v1.14 Addendum — NFR Refinement (bug fixes, security, stubs, tests, docs)
|
||||
|
||||
**Bug fixes (Wave 1, P1-P6).** Adapter dedup rejects unregistered modules
|
||||
with ValueError (P1). Static-assets composition wires cloudfront inputs
|
||||
(P2). L2 lifecycle scripts document remote-state design (P3). Regression
|
||||
gate adds `terraform fmt -check` syntax probe (P4). Adapter dedup-merge +
|
||||
remote-state-key unit tests (P5). ALB target group name_prefix derives
|
||||
from var.name (P6).
|
||||
|
||||
**Security (Wave 2, P7-P12).** 6 swallowed-error sites narrowed to
|
||||
specific exceptions (P7). Account ID externalized to
|
||||
`ACDL_AWS_ACCOUNT_ID` env (P8). IAM policy scoped to `acdl-*` ARNs (P9).
|
||||
Contract ingestor validates contractId/environment/error (P10). Environment
|
||||
schema adds `additionalProperties: false` + format validation (P11).
|
||||
`.gitignore` credential-pattern catch-all (P12).
|
||||
|
||||
**Stub/test/CI/hygiene (Wave 3, P13-P17).** Kyverno `--kube-version` flag
|
||||
removed (P13, G-103). Orphan artifacts + dead config cleaned (P14). 7
|
||||
untested scripts gain test coverage (P15). Gitea workflow parity
|
||||
documented + script `set` flags fixed (P16). Config.json persona +
|
||||
branching strategy + ollama-cloud aligned (P17).
|
||||
|
||||
**Standards/docs/VPC (Wave 4, P18-P20).** STANDARDS.md reconciled (P18).
|
||||
Documentation synced: ARCHITECTURE.md addenda, stale `@v1.6-1.9` → `@v1.13`,
|
||||
GRILL G-005/G-008 resolved, COST.md window extended, D-083 deferral
|
||||
recorded (P19). Platform VPC CIDR parameterized + data-driven subnet
|
||||
count (P20).
|
||||
|
||||
**D-083 deferral (explicit).** The audit ledger build-out (S3 Object Lock
|
||||
+ JWS detached signatures + SQS DLQ + async worker + daily checkpoints)
|
||||
remains deferred (D-096, v1.14). The hash-chain + DynamoDB outbox is the
|
||||
v1.14 audit record. JWS per-event authenticity is not implemented; a
|
||||
forged event is only detectable by re-reading the whole chain. The
|
||||
deferral is documented here explicitly per the v1.14 grill (E-001).
|
||||
---
|
||||
|
||||
## v1.15 Addendum — Nova Rebrand (Major/breaking, 2026-07-30)
|
||||
## v1.15 Addendum — Nova Rebrand (current naming)
|
||||
|
||||
**Milestone:** v1.15-Nova. A full rebrand from **ACDL** / "Agentic Cloud
|
||||
Delivery Platform" → **Nova** / "The New Dawn of DevSecOps — security
|
||||
as a seamless enabler of fast deployments." This is a **Major
|
||||
milestone** (breaking): consumer-facing path, env var prefixes, SSM
|
||||
path, AWS tag keys, and AWS resource names all change. Per the
|
||||
branch-strategy precedent (breaking/feature milestones tag on their
|
||||
OWN minor line), v1.15 tags run on the **v1.15.x minor line**:
|
||||
`v1.15.0` (P0) → `v1.15.4` (P5 final = release). (G-104 binding.)
|
||||
Delivery Platform" → **Nova** / "The New Dawn of DevSecOps — security as
|
||||
a seamless enabler of fast deployments." This is a **Major milestone**
|
||||
(breaking): consumer-facing path, env var prefixes, SSM path, AWS tag
|
||||
keys, and AWS resource names all change. v1.15 tags run on the **v1.15.x
|
||||
minor line**: `v1.15.0` (P0) → `v1.15.4` (P5 final = release). (G-104
|
||||
binding.)
|
||||
|
||||
### Naming conventions (rebranded)
|
||||
### Naming conventions (rebranded — current)
|
||||
|
||||
| Convention | Before (v1.0–v1.14) | After (v1.15+) | Phase |
|
||||
|------------|---------------------|-----------------|-------|
|
||||
@@ -713,94 +348,15 @@ OWN minor line), v1.15 tags run on the **v1.15.x minor line**:
|
||||
brand name present (D-112: flat-branch convention preserved).
|
||||
- **Past Gitea release titles** — existing releases keep `ACDL vX.Y.Z`.
|
||||
|
||||
### Migration ordering (binding)
|
||||
|
||||
1. **P1** docs/decks/prose — no runtime impact; ships consumer migration
|
||||
guide announcing the 5 breaking changes.
|
||||
2. **P2** code + env vars (dual-read) + consumer path — deployments don't
|
||||
break during the transition window (dual-read fallback).
|
||||
3. **P3** SSM path (copy → read → delete) + tag keys (parallel-tag →
|
||||
policy swap → remove old).
|
||||
4. **P4** AWS resource names — staged terraform migration (KMS alias,
|
||||
SNS/SG/Lambda recreate, DynamoDB scan+copy, ECR re-push, IAM
|
||||
re-bootstrap, state bucket `-migrate-state`, ALB recreate). Maintenance
|
||||
window + rollback runbook (`docs/NOVA_AWS_MIGRATION.md`).
|
||||
5. **P5** final review + audit + remove dual-read fallback + milestone ship.
|
||||
|
||||
### Capability gate (binding)
|
||||
|
||||
The regression gate (CAP-001..CAP-016, `scripts/run_regression.sh`) must
|
||||
stay **16/16 Verified** throughout the rebrand. P2/P3/P4 update test
|
||||
fixtures that reference `ACDL`/`acdl` so the gate stays green. No
|
||||
capability is added, removed, or reclassified in v1.15 — the rebrand is
|
||||
nomenclature + identifiers, not behavior.
|
||||
> The full migration ordering (P1–P5), capability gate, and rollback
|
||||
> runbook are preserved in `.ciagent/archive/ARCHITECTURE-v1.0-v1.24.md`
|
||||
> §v1.15 Addendum.
|
||||
|
||||
---
|
||||
|
||||
## v1.16 Addendum — Nova Simplification (NFR, 2026-07-30)
|
||||
## v1.17 Addendum — Strategic Direction, Leadership Metrics & Unified Story (current telemetry layer)
|
||||
|
||||
The v1.16 NFR milestone added 6 new code components + 1 new Terraform
|
||||
module + 1 new schema, all documented here for the architecture record.
|
||||
|
||||
### New components
|
||||
|
||||
| Component | Path | Purpose |
|
||||
|-----------|------|---------|
|
||||
| Onboarding request handler | `core/onboarding.py` | `generate_env_file(request, template_env)` — produces a `<env>.json` from a consumer onboarding request (P19, REQ-183). CLI entry point for self-service env-file generation. |
|
||||
| Decommission transform | `core/decommission_transform.py` | `decommission_transform(stack)` — zero counts + disable deletion protection (REQ-92). Extracted from contract_resolver (P12, REQ-176). |
|
||||
| Contract resolver CLI | `core/contract_resolver_cli.py` | `main()` CLI entry point — resolves a contract YAML to a Target Stack JSON. Extracted from contract_resolver (P12, REQ-176). |
|
||||
| Regression verify CLI | `core/regression_verify_cli.py` | `main()` CLI entry point — runs the regression gate + writes the report. Extracted from regression_verify (P13, REQ-177). |
|
||||
| Workflow sync generator | `scripts/sync_workflows.py` | `--check`/`--write` — generates the 3 byte-identical Gitea+GitHub workflow pairs from `workflows-src/` (P8, REQ-172). |
|
||||
| Onboarding Terraform | `terraform/onboarding/` | `aws_iam_role.consumer_deploy` + `aws_iam_role_policy.consumer_invoke` (ABAC `nova:owner` tag). Offline-proven only (P20, REQ-184, D-114). |
|
||||
|
||||
### Modified components
|
||||
|
||||
| Component | Change | Phase |
|
||||
|-----------|--------|-------|
|
||||
| `core/contract_resolver.py` | `_load_env` delegates to `environment_check.load()` (dedup); `is_l2` uses registry `kind` field; `_load_schema` caches schemas; `decommission_transform` + CLI re-export shim (P12). | P7, P12, P14 |
|
||||
| `core/regression_verify.py` | Dedup helpers (`_check_resolver`, `_check_live_terraform_plan`, `_assert_contracts_resolve`); CAP-013..016 `Skipped` on post-teardown (G-111); `passed` accepts Skipped; CLI re-export shim (P13). | P5, P9, P13 |
|
||||
| `core/lambda/contract_ingestor.py` | Fail closed on missing IAM identity (P10); env enum from `core/environments/` (P10); payload size cap + schema validation (P11); `onboard_consumer` action (P18); `[NOVA-ALERT]` rebrand (P2). | P2, P10, P11, P18 |
|
||||
| `core/output_publisher.py` | `SAFE_OUTPUT_NAMES` schema-driven from `interface.json`; narrowed excepts; `urllib.error` import (P4, P14). | P4, P14 |
|
||||
| `core/environment_check.py` | Onboarding message rebranded Nova + self-service request path (P2, P19). | P2, P19 |
|
||||
| `core/local_emulators.py` | `LocalLambdaStub` sets `NOVA_LAMBDA_LOCAL_BYPASS`; stale dual-read comments + `acdl_*` prefixes removed (P3, P10). | P3, P10 |
|
||||
| `scripts/run_platform.sh` | `--help` flag; `run_hitl_gate()` fn; `NOVA_CONTRACT_ID`/`NOVA_WORK_DIR` config; decommission + uptime blocks extracted to sourced helpers (P6, P9, P15). | P6, P9, P15 |
|
||||
| `adapters/terraform/adapter.py` | State bucket `nova-tfstate-*` (P1); module docstring Nova (P2). | P1, P2 |
|
||||
| `adapters/kyverno/policies/require-resource-labels.yml` | `nova:*` labels (not `acdl:*`) (P1). | P1 |
|
||||
| `modules/registry.json` | `kind` field (`l1`/`l2`) on all 14 entries (P7). | P7 |
|
||||
|
||||
### New schema
|
||||
|
||||
- `schemas/onboarding.schema.json` — the self-service onboarding request
|
||||
(consumerRepo, requestedEnvironment, ownerId, billingTag). P18, REQ-182.
|
||||
|
||||
### Onboarding request-path architecture (D-113)
|
||||
|
||||
The no-humans onboarding flow is a 3-step request path (real AWS
|
||||
provisioning deferred):
|
||||
|
||||
```
|
||||
Consumer → POST Lambda (onboard_consumer) → pending CMDB row (P18)
|
||||
→ core/onboarding.py → <env>.json binding file (P19)
|
||||
→ terraform/onboarding/ → cross-account role + ABAC tag (P20, offline)
|
||||
```
|
||||
|
||||
The Lambda Function URL (IAM auth) + `consumer_invoke_policy.json` (ABAC
|
||||
`nova:owner`) are the transport; the request is accepted + a binding
|
||||
generated + the role Terraform proven offline. No AWS resources are
|
||||
created by the request path (D-113/D-114).
|
||||
|
||||
### Regression gate (G-111 binding)
|
||||
|
||||
The regression gate (D-091) now treats `Skipped` as acceptable for the
|
||||
post-v1.11-teardown steady state (D-096): CAP-013..016 (live-AWS tier)
|
||||
return `Skipped` when the resources are absent (`NoSuchBucket`/
|
||||
`ResourceNotFoundException`). `RegressionReport.passed` is
|
||||
`all(r.status in ("Verified", "Skipped"))`. The gate passes at 18
|
||||
Verified + 4 Skipped (0 Decayed/Broken).
|
||||
|
||||
## v1.17 Addendum — Strategic Direction, Leadership Metrics & Unified Story (2026-08-04)
|
||||
|
||||
The v1.17 milestone adds a telemetry/observability layer, a Decision
|
||||
The v1.17 milestone added a telemetry/observability layer, a Decision
|
||||
Ledger, a metrics export pipeline, a unified narrative deck, and a
|
||||
durable strategic-direction artifact. This addendum documents the
|
||||
architecture; the full research findings are in RESEARCH.md §v1.17.
|
||||
@@ -840,26 +396,26 @@ architecture; the full research findings are in RESEARCH.md §v1.17.
|
||||
│ Nova platform components (existing) │
|
||||
│ run_platform.sh · confidence_signal · checkov_adapter · │
|
||||
│ hitl_gates · regression_verify · outbox_writer · contract_ingestor │
|
||||
└──────────────────────┬──────────────────────────────────────────────┘
|
||||
│ CloudEvents 1.0 envelope (new emitters, P1)
|
||||
▼
|
||||
└────────────────────┬──────────────────────────────────────────────┘
|
||||
│ CloudEvents 1.0 envelope (new emitters, P1)
|
||||
▼
|
||||
┌─────────────────────────────────────────────────────────────────────┐
|
||||
│ metrics/events.jsonl (append-only CloudEvents log) │
|
||||
│ metrics/runs/<run_id>.json (per-run manifests) │
|
||||
│ metrics/decision_ledger.db (SQLite hash-chain, D-121) │
|
||||
│ metrics/test-results.xml (junit, P1) │
|
||||
└──────────────────────┬──────────────────────────────────────────────┘
|
||||
│ collector reads (P2)
|
||||
▼
|
||||
└────────────────────┬──────────────────────────────────────────────┘
|
||||
│ collector reads (P2)
|
||||
▼
|
||||
┌─────────────────────────────────────────────────────────────────────┐
|
||||
│ metrics/nova_metrics.db (SQLite cold store, D-126) │
|
||||
│ fact_run · fact_capability · fact_policy_check · fact_confidence │
|
||||
│ fact_test · fact_decision · fact_cost_estimate │
|
||||
│ dim_capability · dim_milestone │
|
||||
│ + 8 empty placeholder views (deferred metrics) │
|
||||
└──────────────────────┬──────────────────────────────────────────────┘
|
||||
│ powerbi_export (P3)
|
||||
▼
|
||||
└────────────────────┬──────────────────────────────────────────────┘
|
||||
│ powerbi_export (P3)
|
||||
▼
|
||||
┌─────────────────────────────────────────────────────────────────────┐
|
||||
│ metrics/powerbi/ (CSV/JSON views, folder connector, D-129) │
|
||||
│ → PowerBI dashboards (external) │
|
||||
@@ -868,19 +424,20 @@ architecture; the full research findings are in RESEARCH.md §v1.17.
|
||||
|
||||
**Hot path: deferred (D-126).** No live ops dashboard; SQLite is
|
||||
cold-only (batch/historical). The hot path activates when live AWS is
|
||||
re-provisioned (D-096 lift).
|
||||
re-provisioned (D-096 lift — the v1.26 milestone lifts this for the pilot
|
||||
estate).
|
||||
|
||||
### NORTH_STAR integration point (REQ-186)
|
||||
|
||||
`.ciagent/NORTH_STAR.md` is read by CIAgent in context-loading for all
|
||||
future milestones. The integration mechanism (to be finalized in P4):
|
||||
a reference from `PROJECT.md` + `ARCHITECTURE.md` (this section) + a
|
||||
config entry in `config.json` (`strategic_direction_file:
|
||||
".ciagent/NORTH_STAR.md"`) that the run workflow reads at SPECIFY. This
|
||||
ensures the strategic direction survives across milestones without
|
||||
being overwritten by status updates.
|
||||
future milestones. The integration mechanism: a reference from
|
||||
`PROJECT.md` + `ARCHITECTURE.md` (this section) + a config entry in
|
||||
`config.json` (`strategic_direction_file: ".ciagent/NORTH_STAR.md"`)
|
||||
that the run workflow reads at SPECIFY. This ensures the strategic
|
||||
direction survives across milestones without being overwritten by status
|
||||
updates.
|
||||
|
||||
### §12.7 — Policy Engine Registry (v1.25, REQ-291)
|
||||
### §12.7 — Policy Engine Registry (v1.25, REQ-291 — current)
|
||||
|
||||
The policy-engine abstraction is first-class: a swappable `PolicyEngine`
|
||||
protocol so the engine may change without touching the confidence
|
||||
@@ -943,3 +500,7 @@ functions without the binary (the "platform functions without AI /
|
||||
deterministic scripts" tenet holds — kyverno-json is deterministic, not
|
||||
AI; the `is_configured()` guard ensures the platform runs even when the
|
||||
binary is not installed).
|
||||
|
||||
> **§12.8 — Pilot Estate** is planned for the v1.26 P4 phase (REQ-321).
|
||||
> It will document the live-pilot architecture (consumer contract →
|
||||
> `deploy.yml@v1.25` → apply → attest → record against `581513795199`).
|
||||
Reference in New Issue
Block a user