chore(P02): compress .ciagent/ files — archive completed milestones + slim active context
Relocate completed-milestone history to .ciagent/archive/ (byte-identical
snapshots of PROJECT/REQUIREMENTS/ROADMAP/ARCHITECTURE pre-compression +
verbatim moves of REVIEW/AUDIT/VERIFY/PRE_MORTEM). Slim the in-place files
to retain only active-milestone (v1.26) + immediate-predecessor (v1.25)
context + durable vision/tenets/scope/RACI/capability-status/load-bearing
decisions. REGRESSION_REPORT.{json,md} stay in place (live read/write
targets of core/metrics/collector.py + core/regression_verify.py).
Working context: 11,164 → 4,152 lines (~63% reduction). Archive preserves
8,615 lines. Lossless via relocation + git history. No test regressions
(761 passed; same 3 pre-existing failures as baseline).
---ci---
project: acdl
phase: 2
milestone: v1.26
status: execute
lessons:
- REGRESSION_REPORT.{json,md} are live operational files (read by
core/metrics/collector.py + core/regression_verify.py) — must NOT be
archived. Pre-flight grep for code references to candidate archive
paths before any move.
- test_no_purged_loaded_term scans .ciagent/PROJECT.md + CLARIFY.md +
docs/ for 'penetrat' — slimmed files must not reintroduce it. Historical
description of the purge ('removed the term ...') is safe in ROADMAP.
- Git rename detection (R) works for pure file moves; snapshot-then-slim
shows as A + M. Both preserve history.
---/ci---
This commit is contained in:
Jon Chery
@@ -0,0 +1,945 @@
|
||||
# Nova — Architecture (v1.1 target)
|
||||
|
||||
> Target architecture for the real Agentic Cloud Delivery Platform (rebranded
|
||||
> Nova in v1.15). Source of truth for **how**: `docs/architecture.md` (v0.2) is the upstream
|
||||
> draft; this file is the Nova-repo operating copy, refined at phase
|
||||
> boundaries. Where this file and `docs/vision.md` conflict, the vision wins.
|
||||
|
||||
## Status
|
||||
|
||||
Architecture is at **v0.2** upstream (`docs/architecture.md`). Milestone v1.1
|
||||
**finalizes it to v1.0** in Phase 07 by resolving the 11 open decisions
|
||||
(see `PROJECT.md` open-decision resolutions table). This file records the
|
||||
locked commitments and the v1.1 spike scope.
|
||||
|
||||
## Overview
|
||||
|
||||
The platform is **four layers + six cross-cutting concerns**. The sixth
|
||||
concern — the engine abstraction (§12) — is first-class, not an
|
||||
implementation detail. The vision's "Two Consumer Surfaces, One Platform"
|
||||
tenet binds everything: L3A and L3B converge on the same contract schema,
|
||||
the same policy envelope, and the same evidence stream.
|
||||
|
||||
```
|
||||
┌──────────── acdl-contracts ────────────┐
|
||||
Developer ───▶ │ commit contract.yaml │ (L3A)
|
||||
Citizen dev ──▶ │ Issue → agent → contract.yaml │ (L3B)
|
||||
└────────────────┬───────────────────────┘
|
||||
│ (push)
|
||||
▼
|
||||
┌──────────────────────┐
|
||||
│ central pipeline │
|
||||
│ (acdl repo, Gitea │
|
||||
│ Actions / act_runner) │
|
||||
└────────┬─────────────┘
|
||||
│
|
||||
┌─────────────────────────┼─────────────────────────┐
|
||||
▼ ▼ ▼
|
||||
contract→IR resolution policy (Checkov/Kyverno) confidence signal
|
||||
│ │ │
|
||||
▼ ▼ ▼
|
||||
Terraform adapter ──▶ terraform plan ──▶ PolicyCheckResult ──▶ {score,band}
|
||||
│ │
|
||||
▼ ▼
|
||||
dev (autonomous, ≥0.50) qa (HITL, ≥0.75) prod (HITL, ≥0.90) dr (HITL, ≥0.95)
|
||||
│
|
||||
▼
|
||||
DynamoDB outbox ──▶ S3 Object Lock (7-yr, source of truth) ──▶ GitHub audit repo (hot index)
|
||||
│
|
||||
▼
|
||||
acdl-evidence (timeline UI)
|
||||
```
|
||||
|
||||
## Layers
|
||||
|
||||
### Layer 1 — Foundational Primitives
|
||||
Single-purpose, **engine-agnostic** primitive modules. L1 modules do
|
||||
not compose with other L1s; L1 takes its environment as input. The L1
|
||||
interface is defined against the **Target Stack IR**, not against Terraform
|
||||
directly (the IR is shaped to round-trip to Terraform in v1, per §12.1).
|
||||
|
||||
- No inter-L1 references. L1 may call Terraform data sources.
|
||||
- Semver: interface → MAJOR, behavior → MINOR, lifecycle → PATCH (W3.D).
|
||||
- Immutability on publication. 12-month deprecation window.
|
||||
- AI refinement is a flag; the trigger is the W1.A joint condition.
|
||||
|
||||
### Layer 2 — Composed Stacks
|
||||
Combine L1 primitives into deployable shapes. Each codebase maps to one
|
||||
canonical L2 stack (`multiStack: true` only per W1.B). Shape X
|
||||
(parameterized module) or Shape Y (thin-composition layer). Hierarchical
|
||||
composition, max depth 5, only registered L1s. The thin-composition tree's
|
||||
`wires` field is defined against the IR's relationship type, not a Terraform
|
||||
module block.
|
||||
|
||||
Pipeline quality checks: secrets-in-plaintext, public ingress, IAM
|
||||
wildcard, KMS key reference, tag compliance, naming convention. Restricted
|
||||
from thin-composition: IAM principal creation, network boundary creation,
|
||||
key/secret creation, external data transfer. Auto-promote after 3 observed
|
||||
usages.
|
||||
|
||||
### Layer 3A — Developer Consumer Surface
|
||||
Tag-based reference to the central pipeline template. Developer-owned
|
||||
workflow file, no platform auto-sync. L3A and L3B are parallel paths, not a
|
||||
progression. **W2.A (Path B):** tag for dev/qa, SHA for prod; platform CLI
|
||||
resolves tag→SHA for prod-bound workflows.
|
||||
|
||||
### Layer 3B — Agentic Consumer Surface
|
||||
Hybrid runtime, skill as markdown, agent as executor. Trust model: trust
|
||||
and always verify on the platform side. Skill envelope (4 dimensions).
|
||||
Stateless agents, all state in the platform. `profile: agentic` marker
|
||||
unlocks `naturalLanguageIntent`, `confidenceAtSubmission`, `agentTrace`.
|
||||
Initial skill catalog (BA.A): web API, worker, scheduled job, static asset,
|
||||
basic observability bootstrap.
|
||||
|
||||
Environment progression:
|
||||
|
||||
| Environment | Autonomy | Attester | Gate |
|
||||
|---|---|---|---|
|
||||
| dev | Full autonomy (no HITL) | — | Confidence ≥ 0.50, all six inputs present |
|
||||
| qa | Held for attestation | QA | GitHub Deployment approval + full QA matrix (§10) |
|
||||
| prod | Held for attestation | SRE | GitHub Deployment approval + full SRE matrix (§10) |
|
||||
| dr | Held for attestation | SRE | GitHub Deployment approval + dr-drill evidence |
|
||||
|
||||
**Staging is removed.** Dev is the only autonomous environment.
|
||||
|
||||
## Cross-cutting concerns
|
||||
|
||||
### Central pipeline template (§6)
|
||||
JSON Schema (draft 2020-12) with a thin domain wrapper. Central repo +
|
||||
generated client libraries. Multi-stage validation: schema → policy → NFR →
|
||||
confidence. Distributed enrichment. GitOps reconciler (K8s API; cdlc-gitops
|
||||
state → CRDs) + Terraform execution layer (§12.5). The pipeline emits one
|
||||
`PolicyCheckResult` per policy rule; the confidence signal consumes them as
|
||||
one normalized input.
|
||||
|
||||
### Contract schema (§7)
|
||||
Central repo + generated client libraries. Strict fail-fast at schema
|
||||
stage, multi-stage validation with reason codes from a published
|
||||
vocabulary. **W3.E:** per-env mandatory inputs —
|
||||
- dev: `stack`, `environment`
|
||||
- qa adds: `validation.e2eSuite`, `validation.loadTest`
|
||||
- prod adds: `runbook`, `dashboard`, `oncall`
|
||||
- dr adds: `drDrillRef`
|
||||
- `inputs` always optional; `profile: agentic` fields optional everywhere.
|
||||
|
||||
### Confidence signal (§8)
|
||||
Six canonical inputs, weighted sum with per-input breakdown. Per-env
|
||||
thresholds: dev ≥ 0.50, qa ≥ 0.75, prod ≥ 0.90, dr ≥ 0.95. Structured output
|
||||
`{ score, band, perInput, reasonCodes }`. 1-year storage, no retraining in
|
||||
v1. Halt with explicit reason on missing input.
|
||||
|
||||
Policy input = list of `PolicyCheckResult` records (engine-agnostic).
|
||||
Severity → penalty: critical → hard override to mandatory block; high →
|
||||
-0.2; medium → -0.05; low → -0.01; info → 0.0. One critical finding
|
||||
hard-overrides the score regardless of all other inputs.
|
||||
|
||||
**BA.B:** thresholds frozen for v1; tuning begins v1.2 (quarterly FP/FN
|
||||
tracking; override = Infra & Ops + SRE joint sign-off, itself a
|
||||
confidence-event).
|
||||
|
||||
### Audit and evidence stream (§9)
|
||||
Tiered ledger: **S3 with Object Lock in compliance mode** (cold, source of
|
||||
truth, 7-year retention) + **GitHub audit repo** (`acdl-evidence`, hot
|
||||
query index, not part of the chain). Daily checkpoints. Event schema: JWS
|
||||
detached signature, `prev_event_hash` chain, controlled-vocabulary
|
||||
`event_type`. Outbox pattern: local durable outbox + async worker.
|
||||
|
||||
Outbox database = **DynamoDB**. RPO = 0 (synchronous write to local outbox
|
||||
before contract submission ack); RTO = async worker's dead-letter recovery.
|
||||
Single-region in v1. The outbox also stores per-contract QA and prod
|
||||
approver identities (the only durable record outside GitHub's audit log).
|
||||
|
||||
### Human-in-the-Loop mechanics (§10)
|
||||
Pre-execution gates. qa, prod, dr are PR-based attestation gates backed by
|
||||
GitHub Environments with required reviewers. No partial deployment to roll
|
||||
back on rejection (qa, prod); dr is a separate GitHub Deployment against a
|
||||
separate cluster/region.
|
||||
|
||||
Reviewer routing: GitHub CODEOWNERS + Environment required reviewers
|
||||
(qa → QA; prod → SRE; dr → SRE). CODEOWNERS routes, does not enforce
|
||||
identity distinctness.
|
||||
|
||||
**Separation of duties** (platform-internal, not GitHub-native, not Kyverno
|
||||
in v1): on dev→qa promotion the platform writes the QA approver's GitHub
|
||||
identity to the DynamoDB outbox keyed by `contractId`; on qa→prod it reads
|
||||
the stored QA approver and the new SRE approver; if equal, it blocks, emits
|
||||
`SEPARATION_OF_DUTIES_VIOLATION`, and routes a halt artifact to SRE on-call.
|
||||
|
||||
Full 8-concern attestation matrix (functional, performance, security
|
||||
posture, contract NFRs, operational readiness, incident response,
|
||||
capacity/cost, resilience) — see `docs/architecture.md` §10.4.
|
||||
|
||||
Timeout: 1 business day = warn + escalate; 2 business days = auto-freeze +
|
||||
re-submit (linked via `supersedes`). Rejection returns the contract to HELD;
|
||||
the audit chain is extended, not torn up.
|
||||
|
||||
### Agentic stack (§11)
|
||||
Hybrid runtime: platform-managed control plane + consumer-owned agent.
|
||||
Versioned, signed skill catalog over MCP. Skill envelope enforced on
|
||||
invocation and result submission. Consumer-owned skill execution; the
|
||||
platform does not run the skill. Stateless agents, all state in the
|
||||
platform. Skills are reviewed for sensitive data before release (Infra &
|
||||
Ops owns the review; it is the mandatory release gate).
|
||||
|
||||
### Angine execution (§12) — the binding constraint
|
||||
**Target Stack IR** (locked): a engine-neutral description of resources
|
||||
(typed inputs/outputs/NFRs), relationships (single parent per child),
|
||||
composition (tree, max depth 5), and policy hooks. The L1 registry, L2
|
||||
thin-composition tree, contract YML, and PolicyCheckResult schema are all
|
||||
defined against the IR — none against any specific engine.
|
||||
|
||||
**Angine adapters** are the only engine-specific code. An adapter
|
||||
compiles the IR into a engine execution plan. **v1 ships exactly one
|
||||
adapter: the Terraform adapter.** v2+ may add OpenTofu, Pulumi, K8s CRDs
|
||||
without architectural change.
|
||||
|
||||
v1 reality: the IR is shaped to round-trip cleanly to Terraform (nearly
|
||||
isomorphic). As more adapters appear, the IR gets more expressive and the
|
||||
adapters gain translation logic; the L1 content, the YML standard, and the
|
||||
thin-composition tree do not change.
|
||||
|
||||
**Terraform adapter (v1):** translates IR-typed L1 interface → Terraform
|
||||
`variable`/`output` blocks; IR-typed L2 thin-composition tree → Terraform
|
||||
root module; IR-typed relationships → module references; emits a
|
||||
`terraform plan` from the IR. The adapter is a thin layer; it does not own
|
||||
L1/L2 content.
|
||||
|
||||
State storage: S3 (state) + DynamoDB (locking), cloud-managed,
|
||||
single-region in v1.
|
||||
|
||||
Policy toolchain: **Checkov** for Terraform plan policy (the L2 checks +
|
||||
tag/naming); **Kyverno** for K8s-native/platform-internal policy; **OPA**
|
||||
reserved for cross-resource cases, explicitly last resort.
|
||||
|
||||
**Policy result normalization (§12.6):** the confidence signal consumes a
|
||||
normalized `PolicyCheckResult` schema, not raw engine output.
|
||||
|
||||
```json
|
||||
{
|
||||
"contractId": "uuid",
|
||||
"evaluatedAt": "ISO-8601",
|
||||
"engine": "checkov | kyverno | opa",
|
||||
"ruleId": "CKV_AWS_24 | KYVERNO_NO_PRIVILEGED | ...",
|
||||
"severity": "critical | high | medium | low | info",
|
||||
"result": "pass | fail | skipped | error",
|
||||
"message": "human-readable",
|
||||
"evidence": { "...engine-specific, opaque to the signal..." },
|
||||
"resourceRef": "IR-typed resource identifier"
|
||||
}
|
||||
```
|
||||
|
||||
Execution layer: GitHub/Gitea Actions in the central pipeline repo. State
|
||||
locking via DynamoDB. **AWS credentials via OIDC federation — long-lived
|
||||
credentials are forbidden** (§12.5). The platform does not run
|
||||
`terraform apply` against a developer's workstation; all execution is in
|
||||
the central pipeline.
|
||||
|
||||
Registry maintenance: L1 publication updates the L1 registry in the same
|
||||
PR. The registry is the IR-typed contract, not a Terraform-specific
|
||||
variable schema.
|
||||
|
||||
Contract→IR resolution: the contract declares intent in IR-typed terms;
|
||||
the pipeline resolves it to a target stack (list of L1 instances + inputs +
|
||||
relationships); the Terraform adapter compiles the target stack to a plan.
|
||||
|
||||
## v1.1 spike scope
|
||||
|
||||
The spike (Phases 08–10) materializes the **minimum** that proves the IR
|
||||
commitments hold (no polyglot mess):
|
||||
|
||||
- One L1: `l1-s3` (IR-typed interface; the only AWS resource in the spike).
|
||||
- One L2 thin-composition: `l2-static-assets` (references `l1-s3` only).
|
||||
- Terraform adapter: IR → `terraform plan` against AWS via OIDC.
|
||||
- One contract submission → contract→IR → `terraform plan` → Checkov
|
||||
`PolicyCheckResult` → confidence signal → evidence event to the DynamoDB
|
||||
outbox.
|
||||
- State: S3 + DynamoDB (real AWS, single-region).
|
||||
|
||||
Out of spike scope: full HITL matrix wiring, Kyverno, OPA, MCP skill
|
||||
catalog, GitOps reconciler, multi-region, prod/dr environments, the 5-skill
|
||||
L3B catalog. Those are post-spike (v1.2+) platform build-out.
|
||||
|
||||
## Gitea API surface (carried from v1.0, refined)
|
||||
|
||||
| Capability | Gitea support | ACDL approach (v1.1) |
|
||||
|------------|---------------|----------------------|
|
||||
| Org-scoped repo create | `POST /api/v1/orgs/{org}/repos` | Used for any new repos |
|
||||
| Native Pages | **None** | Serve `acdl-evidence` via raw file URLs (unchanged from v1.0) |
|
||||
| Environments API | **None**; act_runner ignores `environment:` | Model HITL gates via `workflow_dispatch` approval inputs (v1.0 D-013 pattern) — **refined in Phase 07** for the real pre-execution gate model |
|
||||
| `repository_dispatch` | Not supported | Cross-repo trigger via `workflow_dispatch` API (unchanged) |
|
||||
| Reusable workflows | Supported | `acdl/.gitea/workflows/pipeline.yml` via `uses: ...@<ref>` |
|
||||
| `id-token: write` / OIDC | **Not supported** (RESEARCH TARGET 1, conf 0.95). Gitea docs list `id-token` as an unsupported GitHub-only scope; open proposal go-gitea/gitea#33681; draft PR go-gitea/gitea#36988 unmerged. Even Gitea's own CI uses long-lived AWS keys (issue #37980). | **Spike waiver D-039:** per-run-rotated long-lived key (rotated after each run by `scripts/rotate_spike_key.sh`). Real OIDC deferred to v1.2, blocked on PR #36988. |
|
||||
| `actions/configure-aws-credentials` | Unusable without OIDC | Spike uses static AWS creds from a (rotated) Gitea Actions secret via the `aws-actions/configure-aws-credentials@v4` `access-key-id`/`secret-access-key` inputs, or plain `AWS_ACCESS_KEY_ID`/`AWS_SECRET_ACCESS_KEY` env vars. v1.2 switches to `role-to-assume` when OIDC lands. |
|
||||
|
||||
### Branch pinning rule (refined for W2.A)
|
||||
|
||||
- Dev/qa contracts reference the reusable workflow by **tag**
|
||||
(`@v1.1-spike`).
|
||||
- Prod-bound workflows reference by **SHA**; the platform CLI
|
||||
(`platform/cli/resolve-tag.ts`, Phase 07) resolves the current tag to its
|
||||
SHA. (Spike scope: the CLI is a stub; the real CLI lands in v1.2.)
|
||||
|
||||
### Verification toolchain
|
||||
|
||||
ACDL has no `package.json`. The verification gate substitutes:
|
||||
- **typecheck:** `terraform validate`, `python3 -m py_compile`, JSON Schema
|
||||
validation (`ajv` or `python -m jsonschema`) against `schemas/`.
|
||||
- **test:** per-phase `scripts/verify_phaseNN.sh` (Phase 06: archive integrity;
|
||||
Phase 07: schema validation + decision-resolution completeness; Phase 08:
|
||||
OIDC assume-role + state backend; Phase 09: IR + L1 + adapter `terraform
|
||||
plan`; Phase 10: end-to-end contract submission).
|
||||
- **build:** `terraform init` (real build for the spike).
|
||||
- See `PERSONAS.md` verification_toolchain.
|
||||
|
||||
## Build order (v1.1)
|
||||
|
||||
1. Phase 06 — archive demo, reorient repo.
|
||||
2. Phase 07 — finalize architecture v1.0; author schemas + designs.
|
||||
3. Phase 08 — AWS OIDC bootstrap (use temp key once, rotate).
|
||||
4. Phase 09 — IR + `l1-s3` + Terraform adapter → `terraform plan`.
|
||||
5. Phase 10 — `l2-static-assets` + contract→IR → end-to-end spike.
|
||||
6. COMPLETE gate — review → ship `v1.2.0` → audit. **DONE.**
|
||||
|
||||
## v1.2 build-out scope
|
||||
|
||||
v1.2 takes the v1.1 spike (dev-only, `plan`-only, single S3 L1) to a real,
|
||||
simpler, better-documented platform that delivers a microservice to AWS ECS
|
||||
Fargate end-to-end. The locked architecture (§1–§12) is unchanged — v1.2
|
||||
extends the *implementation*, not the design.
|
||||
|
||||
### In scope (five axes, user-directed 2026-07-21)
|
||||
|
||||
1. **Re-evaluate the current state.** go-gitea/gitea#36988 (OIDC for Gitea
|
||||
Actions) re-checked 2026-07-21: still **open** (last updated 2026-05-27,
|
||||
not merged). Real OIDC remains deferred to v1.3+; v1.2 extends the D-039
|
||||
per-run-rotated-key waiver as **D-047**. The waiver continues to satisfy
|
||||
§12.5's *intent* (no *persistently* long-lived key): the spike key is
|
||||
rotated after each run by `scripts/rotate_spike_key.sh`, and Phase 12
|
||||
tightens the IAM scoping + rotation hygiene.
|
||||
2. **NFR improvements on the existing spike.** Least-privilege IAM audit of
|
||||
`spike_runner_policy.json`; idempotent `create_state_backend.py` /
|
||||
`create_iam_user.py`; proper exit codes / error handling; P1-1 redaction
|
||||
(two AWS access key IDs in `.ciagent/VERIFY.md` Phase 09 narrative).
|
||||
3. **Streamline / simplify the current setup.** Consolidate
|
||||
`run_spike_plan.sh` + `run_spike_e2e.sh` into one
|
||||
`scripts/run_platform.sh`; remove dead code and stale `platform/` paths.
|
||||
4. **README.md fully up to date on how the platform works.** Reflect v1.1
|
||||
complete; document the actual spike flow, `scripts/run_platform.sh`, the
|
||||
real repo layout, and the v1.2 objective.
|
||||
5. **Bootstrap a consumer repo with a basic microservice deployed to ECS
|
||||
end-to-end.** New Gitea repo `acdl-consumer-microservice` (org
|
||||
`continuous-intelligence`); new IR-typed L1s (`l1-vpc`, `l1-ecs-cluster`,
|
||||
`l1-ecs-service`, `l1-iam-role`, `l1-alb`, `l1-ecr`); new
|
||||
`l2-microservice` thin-composition; one contract submission →
|
||||
`terraform apply` (dev, autonomous per §10, confidence ≥ 0.50) → a live
|
||||
ECS Fargate service serving HTTP 200 → evidence event to the DynamoDB
|
||||
outbox → acdl-evidence timeline.
|
||||
|
||||
### Angine extension (ECS Fargate)
|
||||
|
||||
The Terraform adapter (§12) remains the only engine-specific code. v1.2
|
||||
expands the adapter `TYPE_MAP` to cover the six new ECS-shaped IR resource
|
||||
types. The L1 interface shape (IR-typed inputs/outputs/NFRs, registered in
|
||||
`modules-ir/registry.json`) is unchanged — only the set of registered L1s
|
||||
grows. The IR commitments (REQ-28) continue to hold: `modules-ir/`,
|
||||
`schemas/`, `contracts/`, `core/confidence_signal.py`,
|
||||
`core/contract_resolver.py`, `core/outbox_writer.py`
|
||||
remain engine-agnostic.
|
||||
|
||||
### `terraform apply` (dev only)
|
||||
|
||||
v1.2 lifts the engine execution from `plan` to `apply` for the `dev`
|
||||
environment only. Dev is autonomous per §10 (confidence ≥ 0.50, no HITL).
|
||||
`apply` for qa/prod/dr remains HITL-gated and out of scope for v1.2. The
|
||||
apply result (resources created, plan diff) is captured in the evidence
|
||||
stream as a `terraform.apply` event.
|
||||
|
||||
### Out of scope for v1.2 (deferred to v1.3+)
|
||||
|
||||
| Feature | Reason |
|
||||
|---------|--------|
|
||||
| Real OIDC federation | go-gitea/gitea#36988 still open. v1.2 extends D-039 waiver (D-047); real OIDC is v1.3+. |
|
||||
| Full HITL matrix wiring (qa/prod/dr) | v1.2 is dev-only autonomous `apply`; HITL wiring is v1.3. |
|
||||
| Kyverno + OPA policy engines | v1.2 keeps Checkov only; Kyverno/OPA are v1.3. |
|
||||
| MCP skill catalog + real L3B agent | v1.2 keeps the L3B stub; the 5-skill catalog is v1.3. |
|
||||
| Audit ledger build-out (S3 Object Lock + JWS + async worker + DLQ + daily checkpoints) | v1.2 keeps the v1.1 outbox; the regulatory ledger is v1.3. |
|
||||
| Multi-region state / outbox | Single-region in v1 (§9, §12.3); multi-region is v1.3+. |
|
||||
| Prod/dr environments | v1.2 is dev-only; prod/dr are v1.3. |
|
||||
| GitOps reconciler (ArgoCD/Flux) | v1.3+. |
|
||||
|
||||
## Build order (v1.2)
|
||||
|
||||
1. Phase 11 — re-eval #36988 + NFR audit + simplification findings + README rewrite.
|
||||
2. Phase 12 — NFR harden + simplify (idempotent bootstrap, one `run_platform.sh`, IAM audit, redactions).
|
||||
3. Phase 13 — six ECS L1s + adapter `TYPE_MAP` expansion.
|
||||
4. Phase 14 — `l2-microservice` + contract schema extension.
|
||||
5. Phase 15 — consumer repo + `terraform apply` (dev) → live ECS service.
|
||||
6. Phase 16 — capstone e2e: consumer commit → live HTTP 200 → evidence → timeline.
|
||||
7. COMPLETE gate — review → ship `v1.3.0` → audit.
|
||||
|
||||
## v1.8 Architecture Addendum
|
||||
|
||||
> Milestone v1.8 (complete, tag `v1.8.0`). Adds encryption-by-default,
|
||||
> deletion-protection-by-default, uptime monitoring, decommission alias,
|
||||
> engineering standards, and path documentation.
|
||||
|
||||
### New Primitives
|
||||
|
||||
- **`kms-key`** (`aws:kms:key`) — Per-stack customer-managed KMS key with
|
||||
`enable_key_rotation = true`. One key per L2 deployment (no shared keys).
|
||||
Wired into both L2 compositions as a child, with its `kms_key_arn` output
|
||||
connected to all children's `kms_key_arn` input. Adapter emits
|
||||
`aws_kms_key` + `enable_key_rotation`.
|
||||
- **`uptime`** (`aws:ecs:uptime-service`) — Uptime-kuma on ECS Fargate with
|
||||
a feature flag (`feature_flag_enabled`), monitored endpoints (HTTP/DNS/TCP),
|
||||
alert channels (Teams/email/SMS/GitHub issues). Deployed by default after
|
||||
any L2 module with a separate terraform state. When the feature flag is
|
||||
false, the adapter emits no resources.
|
||||
|
||||
### Encryption by Default
|
||||
|
||||
All 12 L1 primitives have `encryption_enabled` NFR (default true). Primitives
|
||||
with at-rest data (s3, rds, ecr, ecs-service, ecs-cluster) have an optional
|
||||
`kms_key_arn` input. The adapter emits encryption blocks (SSE-KMS for S3,
|
||||
storage_encrypted for RDS, encryption_configuration for ECR) referencing the
|
||||
per-stack CMK when provided. Managed KMS fallback with stderr warning for
|
||||
standalone L1 deployments.
|
||||
|
||||
### Deletion Protection by Default
|
||||
|
||||
All 12 L1 primitives have `deletion_protection` NFR (default true). The
|
||||
adapter emits `lifecycle { prevent_destroy = true }` when true. L2 modules
|
||||
expose a `features.deletion_protection` flag (default true) propagated to
|
||||
all children via the resolver. Setting `inputs.deletion_protection: false`
|
||||
in the contract disables it for the whole stack.
|
||||
|
||||
### Decommission Alias
|
||||
|
||||
A `mode: decommission` on the deploy pipeline implements a 2-step destroy:
|
||||
1. Disable deletion protection (resolve with `deletion_protection: false`,
|
||||
terraform plan/apply, HITL SRE gate via GitHub environment).
|
||||
2. Zero counts + destroy (`decommission_transform` zeroes all scalable counts,
|
||||
terraform plan/apply, second HITL SRE gate).
|
||||
|
||||
CMDB validation via DynamoDB `acdl-change-requests` table. The Lambda
|
||||
`validate_change_request` action queries the table and asserts
|
||||
`status == "approved"` + `consumerRepo` match.
|
||||
|
||||
### Adapter Expansion
|
||||
|
||||
TYPE_MAP grew from 16 to 19 entries (+ `aws:kms:key`, `aws:kms:alias`,
|
||||
`aws:ecs:uptime-service`). Specialized emission branches added for KMS key
|
||||
rotation, S3 SSE-KMS configuration, uptime ECS Fargate task, and
|
||||
`prevent_destroy` lifecycle on all resources.
|
||||
|
||||
### Pipeline Stages
|
||||
|
||||
The deploy pipeline grew from 8 to 9 stages (+ `deploy-uptime` after
|
||||
`publish-outputs`). The `deploy-uptime` stage constructs a synthetic uptime
|
||||
contract from the L2 stack outputs, resolves + adapts it to a separate
|
||||
terraform state directory, and publishes the uptime URL via PR comment.
|
||||
|
||||
### Forge-Agnostic API URLs
|
||||
|
||||
The platform Lambda (`contract_ingestor.py`) reads `GITHUB_API_BASE` env
|
||||
for forge-agnostic API URLs. GitHub uses `/search/issues`; Gitea uses
|
||||
`/repos/{owner}/{repo}/issues`. Detection via `/api/v1` in the base URL.
|
||||
|
||||
## v1.9 Addendum (2026-07-23)
|
||||
|
||||
### New Components
|
||||
|
||||
- **`core/contract_resolver.py` interpolation** (D-081): the resolver
|
||||
now expands `${env.<field>}` + `${contract.<field>}` tokens
|
||||
post-schema-validation, pre-IR-resolution. The env context is the
|
||||
loaded environment onboarding JSON (`core/environments/<name>.json`,
|
||||
schema `schemas/environment.schema.json`). The resolver's
|
||||
`child_input_map` routes L2 wires to the sub-resource that declares the
|
||||
input (P1-1 — `desired_count` → `aws:ecs:service`, `family` →
|
||||
`aws:ecs:task_definition`).
|
||||
- **`core/environment_check.py` `load()`** (REQ-104): loads + returns the
|
||||
parsed environment JSON; emits a stderr warning for placeholder
|
||||
`account_id` when env != dev.
|
||||
- **`core/hitl_gates.py`** (REQ-108, D-084): the HITL pre-execution
|
||||
attestation gate. Records the approver identity to the DynamoDB outbox
|
||||
(`approver_qa`/`approver_prod`/`approver_dr`), runs the separation-of-
|
||||
duties check on prod, invokes the attestation matrix, returns
|
||||
`(ok, reason)`. Dev skips (autonomous). `run_platform.sh` calls
|
||||
`attest` before apply for qa/prod/dr.
|
||||
- **`core/attestation_matrix.py`** (REQ-109, D-084): the 8-concern
|
||||
attestation matrix from `hitl_matrix_design.md` §10.4. Offline-testable
|
||||
concerns (contract NFRs, schema validity, policy pass) run for real;
|
||||
operator-supplied concerns accept signed evidence artifacts validated
|
||||
for freshness + schema. Signature verification skips when
|
||||
`ACDL_ATTESTATION_SIGNING_KEY_ID` is unset (D-089).
|
||||
- **`core/separation_of_duties.py` `route_halt_artifact`** (REQ-107):
|
||||
real SNS publish (`acdl-sod-halt` topic, ARN from
|
||||
`ACDL_SOD_HALT_TOPIC_ARN`) + outbox fallback
|
||||
(`SEPARATION_OF_DUTIES_VIOLATION` event). The SNS topic is defined in
|
||||
`terraform/platform/main.tf`.
|
||||
- **`adapters/wiz/wiz_adapter.py` `WizClient`** (REQ-110): real GraphQL
|
||||
API client (`<WIZ_API_URL>/graphql`, Bearer auth, pagination via
|
||||
`pageInfo.hasNextPage`). `fetch_and_adapt` translates issues →
|
||||
`PolicyCheckResult`. Graceful degrade when unconfigured.
|
||||
- **`adapters/kyverno/kyverno_adapter.py`** (REQ-111): fleshed-out
|
||||
`PolicyReport` → `PolicyCheckResult` mapping (pass/fail/skip/warn +
|
||||
severity + skip-with-reason + resource construction). Inactive-for-TF
|
||||
guard preserved.
|
||||
|
||||
### Per-Environment Promotion (D-082)
|
||||
|
||||
The deploy workflow (`.github/workflows/deploy.yml` +
|
||||
`.gitea/workflows/deploy.yml`, byte-identical) declares an `environment`
|
||||
`workflow_call` input. When non-empty, `run_platform.sh --environment
|
||||
<name>` overrides the contract's `environment` field before schema
|
||||
validation (D-088). One CI job per environment; promotion = running the
|
||||
matching job, no `environment:` field editing. Per-env contract files
|
||||
(`contracts/<module>.<env>.yaml`) use interpolation for env-specific
|
||||
values.
|
||||
|
||||
### Adapter Parameterization (P1-1, D-085)
|
||||
|
||||
The adapter (`adapters/terraform/adapter.py`) reads ECS/ALB/VPC defaults
|
||||
from L1 `interface.json` inputs (`desired_count`, `launch_type`,
|
||||
`family`, `target_type`, `load_balancer_type`, `name`). The adapter is a
|
||||
thin translator; the `child_input_map` routes wires to the declaring
|
||||
sub-resource.
|
||||
|
||||
### Deferred (D-083)
|
||||
|
||||
S3 Object Lock + JWS detached signatures + async worker + DLQ + daily
|
||||
checkpoints (audit ledger build-out) — deferred to a future milestone.
|
||||
The hash-chain + DynamoDB-outbox path remains the v1.9 production audit
|
||||
record.
|
||||
|
||||
## v1.10 Addendum — Regression VERIFY + Local Emulators + Capability Re-Verification
|
||||
|
||||
### Regression-Class VERIFY (D-091, `core/regression_verify.py`)
|
||||
|
||||
The standard VERIFY stage was diff-scoped (it checked the phase diff
|
||||
only, never re-ran underlying capability). This let 8 NFR-patch phases
|
||||
(v1.9.1–v1.9.8) pass while the platform decayed. The regression-class
|
||||
VERIFY (`core/regression_verify.py`) re-runs capability checks against
|
||||
the current codebase and tags each Verified/Decayed/Broken. It fails
|
||||
closed on any non-Verified capability, blocking milestone completion.
|
||||
|
||||
The registry (`CAPABILITY_REGISTRY`) holds 16 capability checks
|
||||
(CAP-001..CAP-016): 12 local-tier + 4 live-AWS. Adding a capability is
|
||||
a single function + one registry entry. The gate runs via
|
||||
`scripts/run_regression.sh` and writes `.ciagent/REGRESSION_REPORT.md`
|
||||
+ `.json`.
|
||||
|
||||
### Local Emulating Adapters (D-092, `core/local_emulators.py`)
|
||||
|
||||
Four local adapters let the platform run the full headline E2E without
|
||||
cloud credentials:
|
||||
|
||||
- `FlatFileOutbox` — flat-file DynamoDB outbox emulator (hash-chained
|
||||
JSONL; resumable across instances; chain verification).
|
||||
- `LocalEcsEmulator` — local ECS Fargate HTTP 200 emulator (binds port
|
||||
0 on 127.0.0.1; daemon thread; clean destroy).
|
||||
- `LocalS3StateBackend` — rewrites the terraform S3 backend to a local
|
||||
backend (per-stack tfstate in a temp folder).
|
||||
- `LocalLambdaStub` — invokes the contract_ingestor handler in-process
|
||||
(patches `_get_dynamodb`/`_get_secrets_client`/`urllib.urlopen`;
|
||||
DynamoDB writes redirected to the FlatFileOutbox).
|
||||
|
||||
`run_local_e2e()` runs the full pipeline: contract → resolver → adapter
|
||||
→ local S3 backend → local ECS (HTTP 200) → flat-file outbox (chain
|
||||
verified) → local Lambda (200). Gated on `ACDL_LOCAL_TIER=1`.
|
||||
|
||||
### Capability Re-Verification Sweep (D-093)
|
||||
|
||||
`.ciagent/CAPABILITY_INVENTORY.md` enumerates 16 auto-verified
|
||||
capabilities + 6 IAM-gated escalated resources. The sweep found and
|
||||
fixed 7 adapter defects in `adapters/terraform/adapter.py` (duplicate
|
||||
outputs, duplicate args, missing required args, deprecated AWS provider
|
||||
v5 arg names). The headline E2E now passes at both tiers: local
|
||||
emulator + live-AWS terraform init/validate/plan.
|
||||
|
||||
### Adapter Defect Fixes (P54)
|
||||
|
||||
7 defects fixed in `adapters/terraform/adapter.py`:
|
||||
1. Duplicate output definitions (per-resource + stack-level both emitted).
|
||||
2. Duplicate `desired_count`/`launch_type` on ECS service.
|
||||
3. Duplicate `target_type`/`family`/`load_balancer_type`.
|
||||
4. Missing `assume_role_policy`/`role_name` on IAM role (L2 composition gap).
|
||||
5. Missing `cidr_block`/`vpc_id`/`name` defaults on VPC/subnet/route_table/
|
||||
ECS cluster/ECR repository.
|
||||
6. ECR `kms_key_arn` unsupported arg → `encryption_configuration` block.
|
||||
7. CloudFront OAC + WAF deprecated arg names (AWS provider v5):
|
||||
`signing_behavior`, `signing_protocol`, `origin_access_control_id`,
|
||||
`s3_origin_config.origin_access_identity`, `origin_id`, `rule`
|
||||
(singular), `scope=CLOUDFRONT` (uppercase).
|
||||
|
||||
## v1.11 Addendum — Stateless Adapter + Pipeline-Driven Lifecycle Testing
|
||||
|
||||
**Stateless adapter (D-098).** `adapters/terraform/adapter.py` rewritten
|
||||
from a 918-line monolith (3 constant tables `TYPE_MAP`/`INPUT_MAP`/
|
||||
`OUTPUT_MAP`, 39 type-specific branches) to a ~80-line stateless assembler.
|
||||
Each L1 module ships a real `terraform/` module dir
|
||||
(`versions.tf`/`variables.tf`/`locals.tf`/`main.tf`/`outputs.tf`) owning
|
||||
its resource shape, nested blocks, and defaults. The adapter reads the
|
||||
registry, emits a root `main.tf` instantiating each L1 as
|
||||
`module "x" { source = "..." }` with resolved inputs and wired refs.
|
||||
|
||||
**Terraform owns lifecycle (D-101).** `scripts/run_platform.sh` gains
|
||||
`--apply` and `--destroy` modes. Python never runs terraform.
|
||||
`scripts/verify_deploy_microservice.py` is deleted.
|
||||
|
||||
**Pipeline-driven testing (D-102).** A `modules-lifecycle` pipeline
|
||||
(Gitea + GitHub, byte-identical) matrix-runs each L1 module's
|
||||
`examples/{simple,complex}.yml` contracts through apply→modify→destroy
|
||||
against live AWS. No per-module Python/pytest. The "test" = the pipeline
|
||||
cell going green.
|
||||
|
||||
**Single platform VPC (D-105).** `terraform/platform/main.tf` owns ONE
|
||||
VPC; the microservice composition references it via
|
||||
`terraform_remote_state` (data source). State keys are deterministic and
|
||||
env-aware (`spike/{contract.id}/{contract.environment}/terraform.tfstate`).
|
||||
|
||||
**NOVA_LIFECYCLE_MODE (v1.12, REQ-134; renamed ACDL→NOVA in v1.15 P2).** The lifecycle pipeline defaults
|
||||
to plan-only (fast, no AWS mutation, no cost). A CI variable
|
||||
`NOVA_LIFECYCLE_MODE` (default `plan`) overrides to `full` for the real
|
||||
apply→modify→destroy. (P2–P4 dual-read fallback to `ACDL_LIFECYCLE_MODE`;
|
||||
fallback removed in P5 per the v1.15 addendum.)
|
||||
|
||||
## v1.12 Addendum — Presentation Refinement + CAP-013 Fix
|
||||
|
||||
**CAP-013 adapter dedup fix (REQ-129).** Multi-resource L1s (ecs-service,
|
||||
alb) with stack outputs + cross-module refs now dedup to ONE module block
|
||||
named by the composition child id, with expanded sub-ids rewritten via
|
||||
`id_remap`. `terraform validate` succeeds for the microservice stack.
|
||||
|
||||
**CAP-017/018 probe fixes (REQ-130).** CAP-017's probe no longer requires
|
||||
`locals.tf` for modules that legitimately omit it. CAP-018's probe
|
||||
instantiates `LocalLambdaStub` with the required `outbox` arg.
|
||||
|
||||
## v1.13 Addendum — Presentation Polish + Config Schema Migration
|
||||
|
||||
**Config.json schema migration (v1.13.1).** Regenerated
|
||||
`.ciagent/config.json` to the updated CIAgent v2 config structure (drop
|
||||
removed fields, migrate `gitea`→`release.gitea`, add
|
||||
`secrets`/`ship`/`backend`/`ideation`/`personas`/`logging`/`telemetry`
|
||||
sections).
|
||||
|
||||
**Presentation polish (v1.13.0, v1.13.2).** Action headlines, story-arc
|
||||
restructure, larger fonts, 6 new mermaid diagrams, badge cleanup,
|
||||
platform-architecture diagram. Docs-only NFR patches.
|
||||
|
||||
## v1.14 Addendum — NFR Refinement (bug fixes, security, stubs, tests, docs)
|
||||
|
||||
**Bug fixes (Wave 1, P1-P6).** Adapter dedup rejects unregistered modules
|
||||
with ValueError (P1). Static-assets composition wires cloudfront inputs
|
||||
(P2). L2 lifecycle scripts document remote-state design (P3). Regression
|
||||
gate adds `terraform fmt -check` syntax probe (P4). Adapter dedup-merge +
|
||||
remote-state-key unit tests (P5). ALB target group name_prefix derives
|
||||
from var.name (P6).
|
||||
|
||||
**Security (Wave 2, P7-P12).** 6 swallowed-error sites narrowed to
|
||||
specific exceptions (P7). Account ID externalized to
|
||||
`ACDL_AWS_ACCOUNT_ID` env (P8). IAM policy scoped to `acdl-*` ARNs (P9).
|
||||
Contract ingestor validates contractId/environment/error (P10). Environment
|
||||
schema adds `additionalProperties: false` + format validation (P11).
|
||||
`.gitignore` credential-pattern catch-all (P12).
|
||||
|
||||
**Stub/test/CI/hygiene (Wave 3, P13-P17).** Kyverno `--kube-version` flag
|
||||
removed (P13, G-103). Orphan artifacts + dead config cleaned (P14). 7
|
||||
untested scripts gain test coverage (P15). Gitea workflow parity
|
||||
documented + script `set` flags fixed (P16). Config.json persona +
|
||||
branching strategy + ollama-cloud aligned (P17).
|
||||
|
||||
**Standards/docs/VPC (Wave 4, P18-P20).** STANDARDS.md reconciled (P18).
|
||||
Documentation synced: ARCHITECTURE.md addenda, stale `@v1.6-1.9` → `@v1.13`,
|
||||
GRILL G-005/G-008 resolved, COST.md window extended, D-083 deferral
|
||||
recorded (P19). Platform VPC CIDR parameterized + data-driven subnet
|
||||
count (P20).
|
||||
|
||||
**D-083 deferral (explicit).** The audit ledger build-out (S3 Object Lock
|
||||
+ JWS detached signatures + SQS DLQ + async worker + daily checkpoints)
|
||||
remains deferred (D-096, v1.14). The hash-chain + DynamoDB outbox is the
|
||||
v1.14 audit record. JWS per-event authenticity is not implemented; a
|
||||
forged event is only detectable by re-reading the whole chain. The
|
||||
deferral is documented here explicitly per the v1.14 grill (E-001).
|
||||
---
|
||||
|
||||
## v1.15 Addendum — Nova Rebrand (Major/breaking, 2026-07-30)
|
||||
|
||||
**Milestone:** v1.15-Nova. A full rebrand from **ACDL** / "Agentic Cloud
|
||||
Delivery Platform" → **Nova** / "The New Dawn of DevSecOps — security
|
||||
as a seamless enabler of fast deployments." This is a **Major
|
||||
milestone** (breaking): consumer-facing path, env var prefixes, SSM
|
||||
path, AWS tag keys, and AWS resource names all change. Per the
|
||||
branch-strategy precedent (breaking/feature milestones tag on their
|
||||
OWN minor line), v1.15 tags run on the **v1.15.x minor line**:
|
||||
`v1.15.0` (P0) → `v1.15.4` (P5 final = release). (G-104 binding.)
|
||||
|
||||
### Naming conventions (rebranded)
|
||||
|
||||
| Convention | Before (v1.0–v1.14) | After (v1.15+) | Phase |
|
||||
|------------|---------------------|-----------------|-------|
|
||||
| Project name | `ACDL` / "Agentic Cloud Delivery Platform" | `Nova` / "The New Dawn of DevSecOps" | P1 |
|
||||
| Tagline | "Consumers declare intent; the platform delivers safe production deployment through an agentic stack" | (retained) **+** "The New Dawn of DevSecOps — security as a seamless enabler of fast deployments" | P1 |
|
||||
| Schema `$id` URL | `https://acdl.cloudinit.dev/schemas/...` | `https://nova.cloudinit.dev/schemas/...` | P1 |
|
||||
| Gitea release title | `ACDL vX.Y.Z` | `Nova vX.Y.Z` | P1 (forward only) |
|
||||
| Env var prefix | `ACDL_*` (21 vars) | `NOVA_*` (dual-read fallback in P2–P4; removed P5) | P2 |
|
||||
| Env loader | scattered `os.environ.get("ACDL_*")` | centralized `core/env.py` `get_env()` (D-108) | P2 |
|
||||
| Consumer contract path | `.acdl/contract.yml` | `.nova/contract.yml` | P2 |
|
||||
| Checkov custom rule file | `acdl_tagging.py` | `nova_tagging.py` | P2 |
|
||||
| Checkov tag-key enforcement | `acdl:*` (hard) | `nova:*` (warn P2, hard P3) | P2/P3 |
|
||||
| SSM parameter path | `/acdl/{env}/{contractId}/{output}` | `/nova/{env}/{contractId}/{output}` | P3 |
|
||||
| AWS tag keys | `acdl:owner|environment|contract|cost-center|ref` | `nova:owner|environment|contract|cost-center|ref` | P3 |
|
||||
| ABAC session policy match | `acdl:*` tags | `nova:*` tags (parallel-tag period) | P3 |
|
||||
| DynamoDB tables | `acdl-contracts`, `acdl-change-requests` | `nova-contracts`, `nova-change-requests` (scan+copy) | P4 |
|
||||
| Lambda (ingestor) | `acdl-contract-ingestor` (role/policy/function) | `nova-contract-ingestor` | P4 |
|
||||
| Secrets Manager secret | `acdl/github-token` | `nova/github-token` | P4 |
|
||||
| SNS topic | `acdl-sod-halt` | `nova-sod-halt` | P4 |
|
||||
| Security group | `acdl-ecs-sg` | `nova-ecs-sg` | P4 |
|
||||
| KMS alias | `alias/acdl-platform` | `alias/nova-platform` | P4 |
|
||||
| ECS cluster/service/task | `acdl-microservice` | `nova-microservice` | P4 |
|
||||
| ECR repo | `acdl-microservice` | `nova-microservice` (re-push) | P4 |
|
||||
| IAM user/policy | `acdl-spike-runner` (+policy) | `nova-spike-runner` (re-bootstrap) | P4 |
|
||||
| S3 state bucket | `acdl-tfstate-581513795199-us-east-1` | `nova-tfstate-581513795199-us-east-1` (`-migrate-state`) | P4 |
|
||||
| ALB name prefix | `acdl-alb` | `nova-alb` | P4 |
|
||||
| Lambda default table names | `CONTRACTS_TABLE` default `acdl-contracts` | default `nova-contracts` (D-111) | P4 |
|
||||
|
||||
### Unchanged conventions (out of scope)
|
||||
|
||||
- **S&P Global Energy visual theme** (`sp-theme.json`, deck CSS: #D6002A
|
||||
red, Akkurat Pro) — client branding, not the Nova product brand (D-107).
|
||||
- **config.json `release.gitea.repo`** = `acdl` — real Gitea repo name
|
||||
unchanged (D-105). Doc URLs updated to `nova` for prose only.
|
||||
- **Git branch/tag naming** — `milestone/v*`, `phase/*`, `v*` semver; no
|
||||
brand name present (D-112: flat-branch convention preserved).
|
||||
- **Past Gitea release titles** — existing releases keep `ACDL vX.Y.Z`.
|
||||
|
||||
### Migration ordering (binding)
|
||||
|
||||
1. **P1** docs/decks/prose — no runtime impact; ships consumer migration
|
||||
guide announcing the 5 breaking changes.
|
||||
2. **P2** code + env vars (dual-read) + consumer path — deployments don't
|
||||
break during the transition window (dual-read fallback).
|
||||
3. **P3** SSM path (copy → read → delete) + tag keys (parallel-tag →
|
||||
policy swap → remove old).
|
||||
4. **P4** AWS resource names — staged terraform migration (KMS alias,
|
||||
SNS/SG/Lambda recreate, DynamoDB scan+copy, ECR re-push, IAM
|
||||
re-bootstrap, state bucket `-migrate-state`, ALB recreate). Maintenance
|
||||
window + rollback runbook (`docs/NOVA_AWS_MIGRATION.md`).
|
||||
5. **P5** final review + audit + remove dual-read fallback + milestone ship.
|
||||
|
||||
### Capability gate (binding)
|
||||
|
||||
The regression gate (CAP-001..CAP-016, `scripts/run_regression.sh`) must
|
||||
stay **16/16 Verified** throughout the rebrand. P2/P3/P4 update test
|
||||
fixtures that reference `ACDL`/`acdl` so the gate stays green. No
|
||||
capability is added, removed, or reclassified in v1.15 — the rebrand is
|
||||
nomenclature + identifiers, not behavior.
|
||||
|
||||
---
|
||||
|
||||
## v1.16 Addendum — Nova Simplification (NFR, 2026-07-30)
|
||||
|
||||
The v1.16 NFR milestone added 6 new code components + 1 new Terraform
|
||||
module + 1 new schema, all documented here for the architecture record.
|
||||
|
||||
### New components
|
||||
|
||||
| Component | Path | Purpose |
|
||||
|-----------|------|---------|
|
||||
| Onboarding request handler | `core/onboarding.py` | `generate_env_file(request, template_env)` — produces a `<env>.json` from a consumer onboarding request (P19, REQ-183). CLI entry point for self-service env-file generation. |
|
||||
| Decommission transform | `core/decommission_transform.py` | `decommission_transform(stack)` — zero counts + disable deletion protection (REQ-92). Extracted from contract_resolver (P12, REQ-176). |
|
||||
| Contract resolver CLI | `core/contract_resolver_cli.py` | `main()` CLI entry point — resolves a contract YAML to a Target Stack JSON. Extracted from contract_resolver (P12, REQ-176). |
|
||||
| Regression verify CLI | `core/regression_verify_cli.py` | `main()` CLI entry point — runs the regression gate + writes the report. Extracted from regression_verify (P13, REQ-177). |
|
||||
| Workflow sync generator | `scripts/sync_workflows.py` | `--check`/`--write` — generates the 3 byte-identical Gitea+GitHub workflow pairs from `workflows-src/` (P8, REQ-172). |
|
||||
| Onboarding Terraform | `terraform/onboarding/` | `aws_iam_role.consumer_deploy` + `aws_iam_role_policy.consumer_invoke` (ABAC `nova:owner` tag). Offline-proven only (P20, REQ-184, D-114). |
|
||||
|
||||
### Modified components
|
||||
|
||||
| Component | Change | Phase |
|
||||
|-----------|--------|-------|
|
||||
| `core/contract_resolver.py` | `_load_env` delegates to `environment_check.load()` (dedup); `is_l2` uses registry `kind` field; `_load_schema` caches schemas; `decommission_transform` + CLI re-export shim (P12). | P7, P12, P14 |
|
||||
| `core/regression_verify.py` | Dedup helpers (`_check_resolver`, `_check_live_terraform_plan`, `_assert_contracts_resolve`); CAP-013..016 `Skipped` on post-teardown (G-111); `passed` accepts Skipped; CLI re-export shim (P13). | P5, P9, P13 |
|
||||
| `core/lambda/contract_ingestor.py` | Fail closed on missing IAM identity (P10); env enum from `core/environments/` (P10); payload size cap + schema validation (P11); `onboard_consumer` action (P18); `[NOVA-ALERT]` rebrand (P2). | P2, P10, P11, P18 |
|
||||
| `core/output_publisher.py` | `SAFE_OUTPUT_NAMES` schema-driven from `interface.json`; narrowed excepts; `urllib.error` import (P4, P14). | P4, P14 |
|
||||
| `core/environment_check.py` | Onboarding message rebranded Nova + self-service request path (P2, P19). | P2, P19 |
|
||||
| `core/local_emulators.py` | `LocalLambdaStub` sets `NOVA_LAMBDA_LOCAL_BYPASS`; stale dual-read comments + `acdl_*` prefixes removed (P3, P10). | P3, P10 |
|
||||
| `scripts/run_platform.sh` | `--help` flag; `run_hitl_gate()` fn; `NOVA_CONTRACT_ID`/`NOVA_WORK_DIR` config; decommission + uptime blocks extracted to sourced helpers (P6, P9, P15). | P6, P9, P15 |
|
||||
| `adapters/terraform/adapter.py` | State bucket `nova-tfstate-*` (P1); module docstring Nova (P2). | P1, P2 |
|
||||
| `adapters/kyverno/policies/require-resource-labels.yml` | `nova:*` labels (not `acdl:*`) (P1). | P1 |
|
||||
| `modules/registry.json` | `kind` field (`l1`/`l2`) on all 14 entries (P7). | P7 |
|
||||
|
||||
### New schema
|
||||
|
||||
- `schemas/onboarding.schema.json` — the self-service onboarding request
|
||||
(consumerRepo, requestedEnvironment, ownerId, billingTag). P18, REQ-182.
|
||||
|
||||
### Onboarding request-path architecture (D-113)
|
||||
|
||||
The no-humans onboarding flow is a 3-step request path (real AWS
|
||||
provisioning deferred):
|
||||
|
||||
```
|
||||
Consumer → POST Lambda (onboard_consumer) → pending CMDB row (P18)
|
||||
→ core/onboarding.py → <env>.json binding file (P19)
|
||||
→ terraform/onboarding/ → cross-account role + ABAC tag (P20, offline)
|
||||
```
|
||||
|
||||
The Lambda Function URL (IAM auth) + `consumer_invoke_policy.json` (ABAC
|
||||
`nova:owner`) are the transport; the request is accepted + a binding
|
||||
generated + the role Terraform proven offline. No AWS resources are
|
||||
created by the request path (D-113/D-114).
|
||||
|
||||
### Regression gate (G-111 binding)
|
||||
|
||||
The regression gate (D-091) now treats `Skipped` as acceptable for the
|
||||
post-v1.11-teardown steady state (D-096): CAP-013..016 (live-AWS tier)
|
||||
return `Skipped` when the resources are absent (`NoSuchBucket`/
|
||||
`ResourceNotFoundException`). `RegressionReport.passed` is
|
||||
`all(r.status in ("Verified", "Skipped"))`. The gate passes at 18
|
||||
Verified + 4 Skipped (0 Decayed/Broken).
|
||||
|
||||
## v1.17 Addendum — Strategic Direction, Leadership Metrics & Unified Story (2026-08-04)
|
||||
|
||||
The v1.17 milestone adds a telemetry/observability layer, a Decision
|
||||
Ledger, a metrics export pipeline, a unified narrative deck, and a
|
||||
durable strategic-direction artifact. This addendum documents the
|
||||
architecture; the full research findings are in RESEARCH.md §v1.17.
|
||||
|
||||
### New components
|
||||
|
||||
| Component | Path | Purpose |
|
||||
|-----------|------|---------|
|
||||
| Event envelope | `core/metrics/event_envelope.py` | CloudEvents 1.0 envelope + `platform.*` semantic conventions (P1, REQ-187) |
|
||||
| Per-run manifest writer | `core/metrics/run_manifest.py` | Emits `nova.run.started/completed/failed` events + writes `metrics/runs/<run_id>.json` (P1, REQ-187) |
|
||||
| Decision Ledger (SQLite) | `core/metrics/decision_ledger.py` | Extends `outbox_writer.py` → SQLite append-only hash-chain table; `ai.decision.made` + `attestation.recorded` events + outcome backfill (P1, REQ-188, D-121) |
|
||||
| Infracost post-processor | `core/metrics/infracost_adapter.py` | Runs Infracost on plan JSON; emits `nova.cost.estimated{delta_usd}` (P1, REQ-187, D-120) |
|
||||
| Metrics collector | `core/metrics/collector.py` | Reads all grounded signals (files + events) → SQLite cold store at `metrics/nova_metrics.db` (P2, REQ-189) |
|
||||
| PowerBI export | `core/metrics/powerbi_export.py` | Emits CSV/JSON views to `metrics/powerbi/` (fact + dim + 8 deferred placeholder views) (P3, REQ-190) |
|
||||
| Metrics schemas | `schemas/metrics_*.schema.json` | Schemas for all event types + fact/dim tables (P1–P2, REQ-187/189) |
|
||||
| Metrics catalog | `docs/METRICS.md` + `docs/metrics/<kpi>.md` | Canonical catalog + per-KPI definition-of-success docs (P4, REQ-195, D-127) |
|
||||
| Unified narrative deck | `docs/presentations/nova-no-humans-platform.md` | Merged deck: Problem→Vision→How→Proof→Roadmap; x3 arc at deck+slide level (P5, REQ-196/197, D-130) |
|
||||
| Strategic direction | `.ciagent/NORTH_STAR.md` | PO-authored durable vision/objectives/anti-goals/targets; read by CIAgent in every future `/ci-run` (P0, REQ-185/186) |
|
||||
|
||||
### Modified components
|
||||
|
||||
| Component | Change | Phase |
|
||||
|-----------|--------|-------|
|
||||
| `core/outbox_writer.py` | Extended to emit to SQLite append-only hash-chain table (Decision Ledger); `ai.decision.made` + `attestation.recorded` events added (P1, D-121) | P1 |
|
||||
| `scripts/run_platform.sh` | Per-run manifest writer invoked; `$WORK/*.json` persisted to `metrics/runs/`; Infracost post-processor invoked after plan (P1) | P1 |
|
||||
| `core/hitl_gates.py` | Emits `attestation.recorded` event to Decision Ledger on qa/prod/dr gate (P1, D-132) | P1 |
|
||||
| `core/confidence_signal.py` | Emits `nova.confidence.computed` + `nova.ai.decision.made` events (P1, D-122) | P1 |
|
||||
| `adapters/terraform/policy/checkov_adapter.py` | Emits `nova.policy.evaluated` event (P1) | P1 |
|
||||
| `core/regression_verify.py` | Emits `nova.capability.verified` event; CAP-023 (metrics collector) + CAP-024 (deck structure) added (P1, P6) | P1, P6 |
|
||||
| `pyproject.toml` | `addopts` gains `--junitxml=metrics/test-results.xml` + `--json-report` (P1, D-120) | P1 |
|
||||
| `docs/presentations/` | Two old decks retired (deleted); unified deck added (P5, D-130) | P5 |
|
||||
|
||||
### Telemetry/observability layer architecture (D-120)
|
||||
|
||||
```
|
||||
┌─────────────────────────────────────────────────────────────────────┐
|
||||
│ Nova platform components (existing) │
|
||||
│ run_platform.sh · confidence_signal · checkov_adapter · │
|
||||
│ hitl_gates · regression_verify · outbox_writer · contract_ingestor │
|
||||
└──────────────────────┬──────────────────────────────────────────────┘
|
||||
│ CloudEvents 1.0 envelope (new emitters, P1)
|
||||
▼
|
||||
┌─────────────────────────────────────────────────────────────────────┐
|
||||
│ metrics/events.jsonl (append-only CloudEvents log) │
|
||||
│ metrics/runs/<run_id>.json (per-run manifests) │
|
||||
│ metrics/decision_ledger.db (SQLite hash-chain, D-121) │
|
||||
│ metrics/test-results.xml (junit, P1) │
|
||||
└──────────────────────┬──────────────────────────────────────────────┘
|
||||
│ collector reads (P2)
|
||||
▼
|
||||
┌─────────────────────────────────────────────────────────────────────┐
|
||||
│ metrics/nova_metrics.db (SQLite cold store, D-126) │
|
||||
│ fact_run · fact_capability · fact_policy_check · fact_confidence │
|
||||
│ fact_test · fact_decision · fact_cost_estimate │
|
||||
│ dim_capability · dim_milestone │
|
||||
│ + 8 empty placeholder views (deferred metrics) │
|
||||
└──────────────────────┬──────────────────────────────────────────────┘
|
||||
│ powerbi_export (P3)
|
||||
▼
|
||||
┌─────────────────────────────────────────────────────────────────────┐
|
||||
│ metrics/powerbi/ (CSV/JSON views, folder connector, D-129) │
|
||||
│ → PowerBI dashboards (external) │
|
||||
└─────────────────────────────────────────────────────────────────────┘
|
||||
```
|
||||
|
||||
**Hot path: deferred (D-126).** No live ops dashboard; SQLite is
|
||||
cold-only (batch/historical). The hot path activates when live AWS is
|
||||
re-provisioned (D-096 lift).
|
||||
|
||||
### NORTH_STAR integration point (REQ-186)
|
||||
|
||||
`.ciagent/NORTH_STAR.md` is read by CIAgent in context-loading for all
|
||||
future milestones. The integration mechanism (to be finalized in P4):
|
||||
a reference from `PROJECT.md` + `ARCHITECTURE.md` (this section) + a
|
||||
config entry in `config.json` (`strategic_direction_file:
|
||||
".ciagent/NORTH_STAR.md"`) that the run workflow reads at SPECIFY. This
|
||||
ensures the strategic direction survives across milestones without
|
||||
being overwritten by status updates.
|
||||
|
||||
### §12.7 — Policy Engine Registry (v1.25, REQ-291)
|
||||
|
||||
The policy-engine abstraction is first-class: a swappable `PolicyEngine`
|
||||
protocol so the engine may change without touching the confidence
|
||||
signal, the pipeline, or the `PolicyCheckResult` schema. This is the
|
||||
**swap boundary** that keeps the platform's compliance posture
|
||||
replaceable (Strategic Objective #2 — provable trust via a replaceable
|
||||
substrate, not a vendor lock-in).
|
||||
|
||||
```
|
||||
contract.yml ─┐ ┌─→ list[PolicyCheckResult] ─┐
|
||||
stack IR ─────┼─→ PolicyEngine.evaluate ├─→ list[PolicyCheckResult] ─┼─→ confidence_signal
|
||||
plan JSON ────┤ (protocol) └─→ list[PolicyCheckResult] ─┘ (engine-agnostic,
|
||||
PCR list ─────┘ unchanged)
|
||||
│
|
||||
▼
|
||||
┌─ KyvernoJsonEngine (shells to `kj scan`; engine: "kyverno")
|
||||
└─ OpaEngine (future — same protocol; engine: "opa")
|
||||
|
||||
checkov/wiz ──→ raw findings ──→ (merged PCR list is the meta-policy payload)
|
||||
```
|
||||
|
||||
**The protocol (`core/policy_engine.py`):**
|
||||
```python
|
||||
class PolicyEngine(Protocol):
|
||||
@property
|
||||
def name(self) -> str: ...
|
||||
def is_configured(self) -> bool: ...
|
||||
def evaluate(self, payload, policy_dir: Path, contract_id: str) -> list[dict]: ...
|
||||
```
|
||||
|
||||
**The registry** reads `config.json.policy.engine` (default
|
||||
`"kyverno-json"`) and returns the active engine. A `NullEngine` is the
|
||||
fallback when the `policy` key is absent (emits `SKIPPED` PCRs —
|
||||
backward compatibility for tests that don't set the key). The
|
||||
confidence signal is **untouched** — it already consumes
|
||||
`list[PolicyCheckResult]` engine-agnostically (§12.6). v1.25 only
|
||||
changes *who produces* the PCR list, not *what* the list is.
|
||||
|
||||
**Engine enum reuse (D-116):** kyverno-json PCR records carry
|
||||
`engine: "kyverno"` (no new enum value). The `engine` field records the
|
||||
policy-engine *family*, not the specific binary. The K8s Kyverno adapter
|
||||
and the kyverno-json engine are distinguished by `ruleId` prefix
|
||||
(`KYVERNO_` vs `KJ_`) and `evidence` payload shape (`namespace`/`kind`
|
||||
vs `assertion`/`jmespath`).
|
||||
|
||||
**Defense-in-depth (D-119):** the declarative meta-policy
|
||||
`block-on-any-critical` (asserts no PCR has `severity: critical` +
|
||||
`result: fail`) is the *source of truth* for "critical = block". The
|
||||
`confidence_signal.py` `PENALTY["critical"]: None` hard-override stays
|
||||
as the *imperative* safety net — the meta-policy runs *before* the
|
||||
confidence signal (produces PCRs that flow in), the hard-override runs
|
||||
*inside* it (the last gate). Removing the hard-override would make the
|
||||
"critical = block" guarantee depend on a single policy file — a
|
||||
regression in provable trust.
|
||||
|
||||
**Graceful degradation (D-120):** `KyvernoJsonEngine.is_configured()`
|
||||
returns false when `which kj` is absent → `evaluate()` returns a single
|
||||
`SKIPPED` PCR (`ruleId: "KJ_ENGINE_NOT_CONFIGURED"`). The platform
|
||||
functions without the binary (the "platform functions without AI /
|
||||
deterministic scripts" tenet holds — kyverno-json is deterministic, not
|
||||
AI; the `is_configured()` guard ensures the platform runs even when the
|
||||
binary is not installed).
|
||||
@@ -0,0 +1,553 @@
|
||||
# Nova v1.9 — Audit Report
|
||||
|
||||
> Audit date: 2026-07-23. Auditor: ci-debugger. Milestone: v1.9. Result: PASS.
|
||||
|
||||
## Step 1: Reconstruction Test
|
||||
|
||||
- 16 v1.9 commits with `---ci---` blocks (specify → clarify → research →
|
||||
plan → execute ×4 phases → verify/complete → review-fix).
|
||||
- Reconstructed state: milestone v1.9, phase 43, status complete.
|
||||
- Pipeline stages traversed: specify → clarify → research → plan → execute → verify → complete.
|
||||
- Decisions D-080..D-089 all present in git log + `.ciagent/` files.
|
||||
- config.json (v1.9 complete), PROJECT.md (v1.9 complete), REQUIREMENTS.md
|
||||
(v1.9 complete, 12 reqs), ROADMAP.md (v1.9 complete, phases 39–43),
|
||||
REVIEW.md (READY TO SHIP), PERSONAS.md (v1.9), VERIFY.md, AUDIT.md.
|
||||
**PASS.**
|
||||
|
||||
## Step 2: File Discipline
|
||||
|
||||
- `.ciagent/config.json`: valid JSON; mode, projects[] present. **PASS.**
|
||||
- `.ciagent/PROJECT.md`: Vision/Core Value (≡ "What This Is"), Key
|
||||
Decisions (v1.9 D-080..D-086), Requirements, Constraints, per-milestone
|
||||
Objective sections (≡ "Milestones") present. Section names follow the
|
||||
v1.0 established conventions (not the generic audit template). **PASS.**
|
||||
- `.ciagent/ROADMAP.md`: phases 39–43 present; all marked complete.
|
||||
**PASS.**
|
||||
- `.ciagent/REQUIREMENTS.md`: v1.9 traceability table complete (12/12
|
||||
REQ-100..111 marked `complete (v1.9.0)`). **PASS.**
|
||||
- `.ciagent/ARCHITECTURE.md`: **fixed during audit** — v1.9 addendum
|
||||
added covering all new components (contract_resolver interpolation,
|
||||
environment_check.load, hitl_gates, attestation_matrix,
|
||||
separation_of_duties.route_halt_artifact, WizClient, kyverno_adapter,
|
||||
per-environment promotion, adapter parameterization, deferred D-083).
|
||||
All 9 v1.9 code components now referenced. **PASS (after fix).**
|
||||
|
||||
## Step 3: Branch Hygiene
|
||||
|
||||
- Local: `main` only. Remote: `origin/main` only.
|
||||
- No phase or milestone branches remain (all 5 v1.9 phase branches merged
|
||||
+ pruned during the run/ship workflow).
|
||||
- No orphan branches.
|
||||
**PASS.**
|
||||
|
||||
## Step 4: Commit Discipline
|
||||
|
||||
- 16/16 v1.9 commits have `---ci---` blocks with project/phase/milestone/
|
||||
status fields.
|
||||
- No stale implementation decisions (D-081..D-085, D-087..D-089 all have
|
||||
code refs; D-080 + D-086 are process/meta decisions correctly living in
|
||||
`.ciagent/` files).
|
||||
- No unresolved v1.9 escalations (the 3 `audit(...)` commits in history
|
||||
are from prior milestones v1.0/v1.6/v1.7).
|
||||
**PASS.**
|
||||
|
||||
## Issues fixed during audit
|
||||
|
||||
1. **ARCHITECTURE.md missing v1.9 addendum** — the architecture doc had
|
||||
no coverage of the v1.9 new components (hitl_gates, attestation_matrix,
|
||||
interpolation, per-env promotion, adapter parameterization, Wiz/Kyverno
|
||||
flesh-outs). Fixed: added a v1.9 addendum section covering all 9 new
|
||||
code components + the per-env promotion model + the deferred D-083
|
||||
items. Verified all 9 components now referenced.
|
||||
|
||||
## Audit result: PASS
|
||||
|
||||
---
|
||||
|
||||
# ACDL v1.10 Phase 52 — Audit Addendum
|
||||
|
||||
> Audit date: 2026-07-27. Auditor: ci-debugger. Phase: 52 (pipeline
|
||||
> regression-VERIFY fix). Result: PASS.
|
||||
|
||||
## Process defect recorded (D-091)
|
||||
|
||||
The prior VERIFY stage was diff-scoped: it checked the phase diff only
|
||||
and never re-ran underlying platform capability. This structural defect
|
||||
let 8 NFR-patch phases (v1.9.1→v1.9.8, deck rework) pass VERIFY while the
|
||||
platform they described decayed underneath. The defect is recorded as
|
||||
D-091 and remediated in Phase 52 by `core/regression_verify.py` +
|
||||
`scripts/run_regression.sh`.
|
||||
|
||||
## Phase 52 audit
|
||||
|
||||
- **Reconstruction:** Phase 52 commits present with `---ci---` blocks
|
||||
(plan + execute + verify). Decisions D-090..D-094 recorded in
|
||||
PROJECT.md. Requirements REQ-112..REQ-115 recorded in REQUIREMENTS.md.
|
||||
**PASS.**
|
||||
- **File discipline:** `core/regression_verify.py`,
|
||||
`scripts/run_regression.sh`, `tests/test_verify_regression_mode.py`
|
||||
present. `.ciagent/PLAN.md`, `ROADMAP.md`, `PROJECT.md`,
|
||||
`REQUIREMENTS.md`, `VERIFY.md` updated for v1.10. **PASS.**
|
||||
- **Behavioral:** 502 fast tests pass (was 493; +9 new). 3 slow
|
||||
integration tests pass. `run_regression.sh` runs and reports honestly.
|
||||
**PASS.**
|
||||
- **Commit discipline:** Phase 52 commits carry `---ci---` blocks with
|
||||
project/phase/milestone/status. **PASS.**
|
||||
|
||||
## Note on prior "audit CLEAN" claims
|
||||
|
||||
The v1.1–v1.9 "audit CLEAN" claims were point-in-time true (the
|
||||
capabilities ran at the time of tagging). They do not assert current
|
||||
reproducibility. The capability decay surfaced in the 2026-07-27
|
||||
CLARIFY/RESEARCH stages is being re-verified in Phase 54 (D-093). The
|
||||
v1.10 audit will re-assert current reproducibility after the sweep.
|
||||
|
||||
## Phase 52 audit result: PASS
|
||||
|
||||
---
|
||||
|
||||
# ACDL v1.10 — Milestone Audit
|
||||
|
||||
> Audit date: 2026-07-27. Auditor: ci-debugger. Milestone: v1.10.
|
||||
> Result: PASS.
|
||||
|
||||
## Step 1: Reconstruction Test
|
||||
|
||||
- 5 v1.10 commits with `---ci---` blocks (plan → P52 verify → P53 verify
|
||||
→ P54 verify → P55 verify).
|
||||
- Reconstructed state: milestone v1.10, phase 55, status verify.
|
||||
- Pipeline stages traversed: plan → execute → verify (×4 phases).
|
||||
- Decisions D-090..D-094 all present in git log + `.ciagent/` files.
|
||||
- config.json (v1.10 complete), PROJECT.md (Capability Status section
|
||||
+ decay disclosure), REQUIREMENTS.md (REQ-112..115 complete),
|
||||
ROADMAP.md (v1.10 section, phases 52–55 complete), REVIEW.md (READY
|
||||
TO SHIP), VERIFY.md (Phase 55 PASS), AUDIT.md (this file),
|
||||
CAPABILITY_INVENTORY.md (16 Verified + 6 escalated), REGRESSION_REPORT
|
||||
(16/16 Verified).
|
||||
**PASS.**
|
||||
|
||||
## Step 2: File Discipline
|
||||
|
||||
- `.ciagent/config.json`: valid JSON; mode, projects[] present; milestone
|
||||
v1.10 complete. **PASS.**
|
||||
- `.ciagent/PROJECT.md`: Capability Status section + decay disclosure +
|
||||
D-090..D-094 decision rows present. **PASS.**
|
||||
- `.ciagent/ROADMAP.md`: v1.10 section with phases 52–55 all marked
|
||||
complete; v1.9.8 annotated as last deck-polish before freeze. **PASS.**
|
||||
- `.ciagent/REQUIREMENTS.md`: v1.10 traceability table complete (4/4
|
||||
REQ-112..115 marked `complete (v1.9.9..v1.9.12)`). **PASS.**
|
||||
- `.ciagent/CAPABILITY_INVENTORY.md`: 16 Verified + 6 IAM-gated
|
||||
escalated, with evidence per capability. **PASS.**
|
||||
- `.ciagent/REGRESSION_REPORT.md` + `.json`: 16/16 Verified, gate passes.
|
||||
**PASS.**
|
||||
- `.ciagent/REVIEW.md`: READY TO SHIP (0 P0, 0 P1, 1 P2 post-hoc).
|
||||
**PASS.**
|
||||
|
||||
## Step 3: Branch Hygiene
|
||||
|
||||
- Local: `main` only. Remote: `origin/main` only.
|
||||
- No phase or milestone branches remain (single-project mode, flat
|
||||
`.ciagent/` paths, no phase branches per config.json
|
||||
branching_strategy=phase but committed directly to main per the
|
||||
project's established convention).
|
||||
**PASS.**
|
||||
|
||||
## Step 4: Commit Discipline
|
||||
|
||||
- 5/5 v1.10 commits have `---ci---` blocks with project/phase/milestone/
|
||||
status fields.
|
||||
- Decisions D-090..D-094 all have code/doc refs.
|
||||
- The regression `---ci---` blocks include `regression:` arrays with
|
||||
per-capability status (Phases 52, 53, 54).
|
||||
- No unresolved v1.10 escalations (the 6 IAM-gated resources are
|
||||
documented in CAPABILITY_INVENTORY.md, not unresolved escalations).
|
||||
**PASS.**
|
||||
|
||||
## Audit result: PASS
|
||||
|
||||
The v1.10 milestone is complete. The pipeline regression gap (D-091)
|
||||
is fixed; the platform is fully locally testable (D-092); every
|
||||
advertised v1.1–v1.8 capability is re-verified (D-093, 16/16 Verified);
|
||||
the docs/decks match verified reality (D-094). 0 P0, 0 P1 from review;
|
||||
1 P2 (post-hoc: expand regression registry to uptime-kuma + RDS stacks).
|
||||
513 offline tests pass; the regression gate covers 16 capabilities
|
||||
including 4 live-AWS checks. Ready to tag `v1.10.0`.
|
||||
|
||||
---
|
||||
|
||||
# ACDL v1.10 — Post-Ship Audit (ciagent-audit workflow)
|
||||
|
||||
> Audit date: 2026-07-27. Auditor: ci-debugger. Milestone: v1.10
|
||||
> (shipped, tag `v1.10.0`). Result: PASS (1 issue fixed during audit).
|
||||
|
||||
## Step 1: Reconstruction Test — PASS
|
||||
|
||||
Parsed all `---ci---` blocks from `v1.9.8..HEAD` (9 commits).
|
||||
Reconstructed state:
|
||||
- Phases: 52, 53, 54, 55 (+ boundary commits 0, 51)
|
||||
- Milestone: v1.10
|
||||
- Final status: complete
|
||||
- Decisions: D-090..D-094
|
||||
- Requirements: REQ-112..REQ-115
|
||||
- Regression caps: CAP-001..CAP-016
|
||||
|
||||
Compared with `.ciagent/` files:
|
||||
- config.json: milestone v1.10, status complete. **MATCH.**
|
||||
- ROADMAP.md: phases 52–55 present, all complete. **MATCH.**
|
||||
- REQUIREMENTS.md: REQ-112..115 all complete. **MATCH.**
|
||||
- PROJECT.md: D-090..D-094 decision rows present. **MATCH.**
|
||||
- CAPABILITY_INVENTORY.md: CAP-001..CAP-016 all Verified. **MATCH.**
|
||||
|
||||
**Reconstruction: PASS** — state fully reconstructable from git log.
|
||||
|
||||
## Step 2: .ciagent/ File Discipline — PASS (1 issue fixed)
|
||||
|
||||
- `config.json`: valid JSON, required fields present. **PASS.**
|
||||
- `PROJECT.md`: all required sections present (Vision, North Star,
|
||||
Capability Status, Requirements, Key Decisions, Constraints,
|
||||
Anti-Goals). **PASS.**
|
||||
- `ROADMAP.md`: phases 52–55 present, v1.10 marked complete. **PASS.**
|
||||
- `REQUIREMENTS.md`: REQ-112..115 all complete in traceability table.
|
||||
**PASS.**
|
||||
- `ARCHITECTURE.md`: **FIXED DURING AUDIT** — had 0 references to
|
||||
v1.10 components (regression_verify, local_emulators,
|
||||
REGRESSION_REPORT, CAPABILITY_INVENTORY). Added a v1.10 addendum
|
||||
section covering the regression-class VERIFY, local emulating
|
||||
adapters, capability re-verification sweep, and the 7 adapter defect
|
||||
fixes. Now references all v1.10 components. **PASS (after fix).**
|
||||
|
||||
## Step 3: Branch Hygiene — PASS
|
||||
|
||||
- Local: `main` only. Remote: `origin/main` only.
|
||||
- No phase or milestone branches (flat workflow per project convention).
|
||||
- No orphan branches.
|
||||
**PASS.**
|
||||
|
||||
## Step 4: Commit Discipline — PASS
|
||||
|
||||
- 9/9 v1.10 commits have `---ci---` blocks with project/phase/milestone/
|
||||
status fields.
|
||||
- Decisions D-090..D-094: D-091/D-092/D-093 have code refs
|
||||
(`core/regression_verify.py`); D-090/D-094 are process/meta decisions
|
||||
with extensive `.ciagent/` doc refs (PLAN, ROADMAP, PROJECT,
|
||||
CAPABILITY_INVENTORY, AUDIT, VERIFY). No stale decisions.
|
||||
- No unresolved v1.10 escalations (the 6 IAM-gated resources are
|
||||
documented in CAPABILITY_INVENTORY.md, not unresolved escalations).
|
||||
**PASS.**
|
||||
|
||||
## Issues fixed during audit
|
||||
|
||||
1. **ARCHITECTURE.md missing v1.10 addendum** — the architecture doc
|
||||
had no coverage of the v1.10 new components (regression_verify,
|
||||
local_emulators, capability inventory, adapter defect fixes). Fixed:
|
||||
added a v1.10 addendum section covering all 4 new subsystems + the
|
||||
7 adapter defect fixes. Verified all v1.10 components now referenced.
|
||||
|
||||
## Audit result: PASS
|
||||
|
||||
---
|
||||
|
||||
# ACDL v1.14 — Post-Milestone Audit (ciagent-audit workflow)
|
||||
|
||||
> Audit date: 2026-07-29. Auditor: ci-debugger. Milestone: v1.14 (shipped,
|
||||
> tag `v1.13.24`, Gitea release id 285). Result: PASS.
|
||||
|
||||
## Step 1: Reconstruction Test — PASS
|
||||
|
||||
Parsed all `---ci---` blocks from the v1.14 commit history (phase/00 +
|
||||
milestone/v1.14-refinement branches). Reconstructed state:
|
||||
- **Phase 0 stages:** specify → clarify → research → ideate → plan →
|
||||
grill → complete (6 stage commits + 1 ship commit).
|
||||
- **Phases 1–20:** each has an execute commit (on phase/NN branch) + a
|
||||
complete commit (squash-merged into milestone/v1.14-refinement). All
|
||||
20 `---ci---` blocks present with `project: acdl`, `phase: N`,
|
||||
`milestone: v1.14`, `status: complete`.
|
||||
- **Phase 21:** complete commit with `status: complete` + requirements
|
||||
covered array.
|
||||
- **Decisions:** D-095..D-101 all present in git log + `.ciagent/` files.
|
||||
- **Grill binding decisions:** G-101..G-106 in GRILL.md + PLAN.md.
|
||||
- **Escalation:** E-001 auto-resolved (D-101, full autonomy).
|
||||
|
||||
Compared with `.ciagent/` files:
|
||||
- `config.json`: `active_milestone: v1.14`. **MATCH.**
|
||||
- `ROADMAP.md`: v1.14 section with phases P0–P21, all complete. **MATCH.**
|
||||
- `REQUIREMENTS.md`: REQ-135..154 all complete in traceability table.
|
||||
**MATCH.**
|
||||
- `PROJECT.md`: v1.14 Objective + Key Decisions D-095..D-101 present.
|
||||
**MATCH.**
|
||||
- `CHECKPOINT.json`: phase=21, stage=complete, milestone=v1.14,
|
||||
milestone_complete=true. **MATCH.**
|
||||
- `ARCHITECTURE.md`: v1.11–v1.14 addenda present. **MATCH.**
|
||||
- `PLAN.md`: v1.14 20-phase plan with wave ordering. **MATCH.**
|
||||
- `GRILL.md`: v1.14 grill run with G-101..G-106 + E-001. **MATCH.**
|
||||
- `PERSONAS.md`: v1.14 frontmatter + roster. **MATCH.**
|
||||
- `RESEARCH.md`: v1.14 addendum with 8-category scope audit. **MATCH.**
|
||||
|
||||
**Reconstruction: PASS** — state fully reconstructable from git log.
|
||||
|
||||
## Step 2: .ciagent/ File Discipline — PASS
|
||||
|
||||
- `config.json`: valid JSON; `active_milestone: v1.14`, `active_project:
|
||||
acdl`, `projects[]` length 1. **PASS.**
|
||||
- `PROJECT.md`: all required sections present (Objective v1.14, Key
|
||||
Decisions D-095..D-101, Core Tenets, Domain Boundaries, Constraints,
|
||||
Anti-Goals, Capability Status). 17 section headers. **PASS.**
|
||||
- `ROADMAP.md`: v1.14 section with P0–P21, all marked complete. **PASS.**
|
||||
- `REQUIREMENTS.md`: v1.14 traceability table complete (20/20 REQ-135..154
|
||||
marked complete). 172 `complete` references total. **PASS.**
|
||||
- `ARCHITECTURE.md`: v1.11/v1.12/v1.13/v1.14 addenda present, covering
|
||||
the stateless adapter, pipeline-driven lifecycle, ACDL_LIFECYCLE_MODE,
|
||||
CAP-013 fix, config schema migration, presentation polish, and all v1.14
|
||||
NFR changes. D-083 deferral recorded explicitly. **PASS.**
|
||||
- `CHECKPOINT.json`: valid JSON; phase=21, stage=complete,
|
||||
milestone_complete=true. **PASS.**
|
||||
|
||||
## Step 3: Branch Hygiene — PASS (with note)
|
||||
|
||||
- **v1.14 phase branches:** phase/00–phase/21 all present locally. All
|
||||
squash-merged into milestone/v1.14-refinement (the squash strategy
|
||||
does not preserve ancestry for `--is-ancestor` checks, but the content
|
||||
is verified present on main via the milestone merge commit `3b1181f`).
|
||||
- **Milestone branch:** milestone/v1.14-refinement present, squash-merged
|
||||
into main.
|
||||
- **Prior milestone branches:** milestone/v1.11-restart,
|
||||
milestone/v1.12-presentation, milestone/v1.13-deck-polish remain
|
||||
locally (not pruned). These are historical and harmless.
|
||||
- **Prior abandoned phase branches:** phase/56-iam-re-bootstrap,
|
||||
phase/57-live-deploy-microservice (v1.11 first attempt, abandoned per
|
||||
D-097). These have `---ci---` commits (not orphans) but are superseded.
|
||||
Not a defect — documented in ROADMAP.md v1.11 RESTART section.
|
||||
- **Remote:** origin/main + origin/milestone/v1.14-refinement present.
|
||||
No orphan remote branches.
|
||||
|
||||
**Branch hygiene: PASS** — all v1.14 branches served their purpose; the
|
||||
content is on main.
|
||||
|
||||
## Step 4: Commit Discipline — PASS
|
||||
|
||||
- **v1.14 commits with `---ci---` blocks:** 22/22 phase commits (phase 0
|
||||
ship + phases 1–20 complete + phase 21 complete) have `---ci---` blocks
|
||||
with `project: acdl`, `phase: N`, `milestone: v1.14`, `status:`. The
|
||||
1 milestone merge commit (`91338f7`) lacks a `---ci---` block — it is
|
||||
a squash-merge summary commit, not a phase commit. Acceptable.
|
||||
- **Stale decisions:** D-095..D-101 all have code/doc refs (D-095/D-096/
|
||||
D-097/D-099 are process/meta decisions in PROJECT.md; D-098 is the
|
||||
wave ordering in PLAN.md; D-100/D-101 are ideation/escalation decisions
|
||||
in PROJECT.md). No stale decisions.
|
||||
- **Unresolved escalations:** E-001 auto-resolved (D-101,
|
||||
`resolution: auto`, `type: risk_accepted`). No unresolved v1.14
|
||||
escalations. The pre-v1.14 `resolution: user provided` match is from
|
||||
the v1.1 bootstrap, not v1.14.
|
||||
|
||||
**Commit discipline: PASS.**
|
||||
|
||||
## Step 5: Audit Checks — PASS
|
||||
|
||||
1. **HEAD not on main when branches exist:** HEAD is on main (milestone
|
||||
complete; no active phase work). OK — post-milestone state.
|
||||
2. **CHECKPOINT.json exists:** EXISTS.
|
||||
3. **CHECKPOINT.json consistent with git status:** checkpoint phase=21,
|
||||
stage=complete, milestone=v1.14, milestone_complete=true. Matches
|
||||
latest `---ci---` block (da533a8: phase=21, status=complete). **MATCH.**
|
||||
4. **Report template exists:** EXISTS.
|
||||
5. **No pending escalations:** E-001 auto-resolved. 0 unresolved v1.14
|
||||
escalations.
|
||||
6. **Milestone version in config:** `active_milestone: v1.14`. Consistent
|
||||
with the milestone branch + checkpoint + git log. **MATCH.**
|
||||
|
||||
**Additional checks:**
|
||||
- **Stale version refs:** `grep -rn "@v1\.[6-9]" docs/ README.md` → 0
|
||||
hits (bumped to @v1.13 in P19). **PASS.**
|
||||
- **Test suite:** 561 passed, 5 deselected. **PASS.**
|
||||
- **Regression gate:** 22/22 capabilities Verified (run at P21). **PASS.**
|
||||
- **CI pipeline:** `run_ci.sh` exits 0 (3 stages pass). **PASS.**
|
||||
- **D-083 deferral:** explicitly recorded in ARCHITECTURE.md v1.14
|
||||
addendum. **PASS.**
|
||||
|
||||
## Audit result: PASS
|
||||
|
||||
The v1.14 milestone is complete. All 20 requirements (REQ-135..154)
|
||||
satisfied; 561 tests pass (was 528 at v1.13.2; +33); 22/22 capabilities
|
||||
Verified; 6 grill binding decisions (G-101..G-106) applied; 1 escalation
|
||||
(E-001) auto-resolved. State fully reconstructable from git log. 0 P0,
|
||||
0 P1, 0 P2 outstanding. Ready for the next milestone.
|
||||
---
|
||||
|
||||
## v1.15 Post-Milestone Audit (2026-07-30)
|
||||
|
||||
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
||||
CIAgent ► AUDIT REPORT
|
||||
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
||||
|
||||
Reconstruction: PASS — 27 commits since v1.14 base (66a3c69), 20 with
|
||||
`---ci---` blocks (7 merge commits without blocks, per convention).
|
||||
Reconstructed state: phase 5, milestone v1.15, complete, tag v1.15.4,
|
||||
release 302, REQ-155..164 covered. Matches CHECKPOINT.json + REQUIREMENTS.md
|
||||
+ ROADMAP.md.
|
||||
|
||||
.ciagent/ Files: 12 checked.
|
||||
- config.json: valid JSON; active_milestone v1.15 consistent.
|
||||
FIX applied: projects[0].name "Agentic Cloud Delivery Platform" →
|
||||
"Nova — The New Dawn of DevSecOps" (rebrand completeness).
|
||||
- PROJECT.md: FIX applied — header "# ACDL — Agentic Cloud Delivery
|
||||
Platform" → "# Nova — The New Dawn of DevSecOps" + rebrand-in-progress
|
||||
banner → rebrand-complete banner.
|
||||
- REQUIREMENTS.md: FIX applied — header "# ACDL — Requirements" →
|
||||
"# Nova — Requirements"; traceability 10/10 REQ-155..164 complete.
|
||||
- ROADMAP.md: FIX applied — header "# ACDL — Roadmap" → "# Nova —
|
||||
Roadmap"; v1.15 phases P1-P5 all complete with tags.
|
||||
- ARCHITECTURE.md: PASS (header already Nova per P5 doc-verifier);
|
||||
v1.15 addendum present; naming table matches codebase.
|
||||
- PERSONAS.md: PASS (v1.15 addendum present).
|
||||
- GRILL.md: PASS (v1.15 section present; 0 open escalations).
|
||||
- RESEARCH.md: FIX applied — header "# ACDL — v1.11 RESTART Research
|
||||
Findings" → "# Nova — ...".
|
||||
- PLAN.md: PASS (v1.15 plan present, frontmatter milestone v1.15).
|
||||
- AUDIT.md: FIX applied — header "# ACDL v1.9 — Audit Report" →
|
||||
"# Nova v1.9 — Audit Report".
|
||||
- REVIEW.md: FIX applied — header "# ACDL v1.11 — Multi-Persona Code
|
||||
Review" → "# Nova v1.11 — ...".
|
||||
- COST.md: FIX applied — header "# ACDL AWS Cost Report" →
|
||||
"# Nova AWS Cost Report".
|
||||
- IAM_POLICY.md: FIX applied — header "# ACDL — IAM Policy Baseline"
|
||||
→ "# Nova — IAM Policy Baseline".
|
||||
- CAPABILITY_INVENTORY.md: FIX applied — header "# ACDL Capability
|
||||
Inventory" → "# Nova Capability Inventory".
|
||||
|
||||
Branches: 6 v1.15 phase branches (all merged to main), 1 milestone branch
|
||||
(merged to main). No orphans. PASS.
|
||||
|
||||
Commits: 27 total, 39 `---ci---` blocks, 7 merge commits (no blocks, per
|
||||
convention), 0 non-merge commits without `---ci---`, 0 unresolved
|
||||
escalations. PASS.
|
||||
|
||||
Audit Checks (runAuditChecks):
|
||||
1. HEAD on main (milestone complete) — PASS
|
||||
2. CHECKPOINT.json exists — PASS
|
||||
3. CHECKPOINT consistent with latest `---ci---` (phase 5, v1.15,
|
||||
complete, v1.15.4) — PASS
|
||||
4. Report template exists — PASS
|
||||
5. No pending escalations (grill: 0 open; log: none) — PASS
|
||||
6. Milestone version in config (v1.15) consistent with checkpoint — PASS
|
||||
|
||||
Issues fixed (audit auto-fix):
|
||||
- 9 `.ciagent/*.md` file headers still said "ACDL" after the v1.15
|
||||
rebrand (P1 lead-developer left `.ciagent/` to P0; P0 added the
|
||||
rebrand-in-progress banner to PROJECT.md only; the other file
|
||||
headers were never rebranded). All 9 headers now say "Nova".
|
||||
- config.json `projects[0].name` still said "Agentic Cloud Delivery
|
||||
Platform" (display label, not the repo slug). Now "Nova — The New
|
||||
Dawn of DevSecOps". The `slug` ("acdl") + `release.gitea.repo`
|
||||
("acdl") stay unchanged per D-105 (real repo name).
|
||||
|
||||
Notes:
|
||||
- Historical narrative sections in ARCHITECTURE.md/COST.md/GRILL.md/
|
||||
AUDIT.md/REVIEW.md (v1.1–v1.14 addenda) still mention `acdl-*`
|
||||
resource names + `ACDL_*` env vars — these describe each milestone
|
||||
as-shipped and are acceptable as historical record per project
|
||||
convention. The active v1.15 sections use Nova.
|
||||
- The 7 merge commits without `---ci---` blocks is the established
|
||||
convention (merge summary IS the record; the merged phase commits
|
||||
carry the blocks). Matches v1.14 precedent.
|
||||
|
||||
Verdict: PASS — Project state is fully reconstructable from git log.
|
||||
All 6 audit checks pass. 10 auto-fixed issues (9 stale headers + 1 config
|
||||
name) were rebrand-completeness gaps, not structural defects.
|
||||
|
||||
---ci---
|
||||
project: acdl
|
||||
phase: 5
|
||||
milestone: v1.15
|
||||
status: complete
|
||||
phase_role: final
|
||||
audit: pass
|
||||
---/ci---
|
||||
|
||||
---
|
||||
|
||||
## v1.16 Post-Milestone Audit (2026-07-30)
|
||||
|
||||
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
||||
CIAgent ► AUDIT REPORT
|
||||
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
|
||||
|
||||
**Reconstruction: PASS** — 4 commits since v1.15.4 base (787a649), 3 with
|
||||
`---ci---` blocks (1 merge commit without blocks, per convention — the
|
||||
squash-merge summary IS the record). Reconstructed state: phase 21,
|
||||
milestone v1.16, complete, tag v1.15.26, release 370, REQ-165..184
|
||||
covered. Matches CHECKPOINT.json + REQUIREMENTS.md + ROADMAP.md.
|
||||
|
||||
**.ciagent/ Files: 15 checked.**
|
||||
- config.json: valid JSON; active_milestone v1.16, active_project acdl,
|
||||
projects[] length 1. **PASS.**
|
||||
- PROJECT.md: v1.16 Objective (complete) + Key Decisions D-113..D-119
|
||||
present. 44 section headers. **PASS.**
|
||||
- ROADMAP.md: v1.16 section with P0–P21, all complete; tags v1.15.5..26.
|
||||
**PASS.**
|
||||
- REQUIREMENTS.md: v1.16 traceability 20/20 REQ-165..184 complete.
|
||||
**PASS.**
|
||||
- ARCHITECTURE.md: **FIXED DURING AUDIT** — 0 v1.16 references → v1.16
|
||||
addendum added (6 new components, 10 modified components, new schema,
|
||||
onboarding request-path architecture, regression gate G-111). **PASS
|
||||
(after fix).**
|
||||
- CHECKPOINT.json: valid JSON; phase=21, stage=complete,
|
||||
milestone_complete=true, tag=v1.15.26, release_id=370. **PASS.**
|
||||
- PERSONAS.md: v1.16 addendum present (8 references). **PASS.**
|
||||
- GRILL.md: v1.16 grill present (G-111..G-113, E-002). **PASS.**
|
||||
- RESEARCH.md: v1.16 addendum present (R1..R6). **PASS.**
|
||||
- PLAN.md: v1.16 20-phase + final plan present. **PASS.**
|
||||
- REVIEW.md: **FIXED DURING AUDIT** — 0 v1.16 references → reconstructed
|
||||
with v1.16 P21 final review content (0 P0, 0 P1, 2 P2 post-hoc). **PASS
|
||||
(after fix).**
|
||||
- AUDIT.md: this file (v1.16 audit recorded). **PASS.**
|
||||
- CAPABILITY_INVENTORY.md: not modified in v1.16 (no capability changes).
|
||||
**PASS.**
|
||||
- COST.md: not modified in v1.16 (no cost changes — offline-only). **PASS.**
|
||||
- IAM_POLICY.md: not modified in v1.16 (no IAM policy changes —
|
||||
onboarding Terraform is offline-proven, not applied). **PASS.**
|
||||
|
||||
**Branches: 0 v1.16 phase branches, 0 v1.16 milestone branches** (all
|
||||
cleaned up post-merge). Prior-milestone branches (v1.14 P1-P20, v1.11
|
||||
P56-P59) remain locally — historical, harmless, documented in ROADMAP.
|
||||
No v1.16 orphans. **PASS.**
|
||||
|
||||
**Commits: 4 total in v1.16 range, 3 with `---ci---` blocks, 1 merge
|
||||
commit without (per convention), 0 unresolved escalations.** The
|
||||
squash-merge strategy collapsed 20 phase branches + the milestone into
|
||||
the merge commit `f83b974`; the phase-level `---ci---` blocks lived in
|
||||
the (now-deleted) phase-branch commits. The milestone-level `---ci---`
|
||||
block (commit `58fa7a6`) records the final state. **PASS.**
|
||||
|
||||
**Audit Checks (runAuditChecks):**
|
||||
1. HEAD on main (milestone complete) — **PASS**
|
||||
2. CHECKPOINT.json exists — **PASS**
|
||||
3. CHECKPOINT consistent with latest `---ci---` (phase 21, v1.16,
|
||||
complete, v1.15.26, release 370) — **PASS**
|
||||
4. Report template exists (`opencode/ci/references/report-template.md`)
|
||||
— **PASS**
|
||||
5. No pending escalations (grill E-002 auto-resolved at P21; 0
|
||||
unresolved) — **PASS**
|
||||
6. Milestone version in config (v1.16) consistent with checkpoint —
|
||||
**PASS**
|
||||
|
||||
**Issues fixed during audit:**
|
||||
- ARCHITECTURE.md missing v1.16 addendum (0 references → added: 6 new
|
||||
components, 10 modified, new schema, onboarding architecture, G-111
|
||||
gate).
|
||||
- REVIEW.md held v1.11 content → reconstructed with v1.16 P21 final
|
||||
review (0 P0, 0 P1, 2 P2 post-hoc accepted).
|
||||
|
||||
**Verdict: PASS** — Project state is fully reconstructable from git log.
|
||||
All 6 audit checks pass. 2 auto-fixed issues (ARCHITECTURE.md addendum +
|
||||
REVIEW.md reconstruction) were file-discipline gaps, not structural
|
||||
defects. 20/20 requirements complete; regression gate 18V+4S; milestone
|
||||
merged to main; tag v1.15.26; release 370.
|
||||
|
||||
---ci---
|
||||
project: acdl
|
||||
phase: 21
|
||||
milestone: v1.16
|
||||
status: complete
|
||||
phase_role: final
|
||||
audit: pass
|
||||
---/ci---
|
||||
@@ -0,0 +1,229 @@
|
||||
# ACDL — Pre-mortem (v1.11, REQ-120)
|
||||
|
||||
> Authored: 2026-07-28, Phase 64 (previously drafted at P60, finalized here).
|
||||
> Mandated by: GRILL Axis 7 Q4 (no pre-mortem on file — flagged, no
|
||||
> binding decision; user accepted autonomous governance in G-009).
|
||||
> Structure: (1) v1.10 decay incident post-mortem, (2) forward pre-mortem
|
||||
> for the OSS reference + leadership pitch.
|
||||
|
||||
---
|
||||
|
||||
## Part 1 — Post-mortem: v1.10 capability decay incident
|
||||
|
||||
### Summary
|
||||
|
||||
Capabilities marked complete in v1.1–v1.8 ran successfully at the time
|
||||
of tagging. As of 2026-07-27 they were **not reproducible** — the v1.7/
|
||||
v1.8 platform simplification introduced 7 adapter defects in
|
||||
`adapters/terraform/adapter.py` that prevented `terraform init/
|
||||
validate/plan` from succeeding against live AWS. The decks (v1.9.1–
|
||||
v1.9.8) presented the capability as current across 8 NFR-patch phases
|
||||
**without disclosing the decay**. v1.10 (Phases 52–55) re-verified every
|
||||
advertised capability, fixed all 7 defects in-sweep (D-090: no cap), and
|
||||
rewrote PROJECT/ROADMAP/decks to match verified reality.
|
||||
|
||||
### Timeline
|
||||
|
||||
| Date | Event |
|
||||
|------|-------|
|
||||
| 2026-07-21 | v1.7 Phases 22–27 ship. The adapter simplification lands (the 7 defects are introduced here). |
|
||||
| 2026-07-21 | v1.8 Phases 28–38 ship. The defects persist undetected; VERIFY is diff-scoped so the decay is invisible. |
|
||||
| 2026-07-21 → 2026-07-27 | v1.9.0 + v1.9.1–v1.9.8 (8 NFR-patch phases) ship. Each passes VERIFY (diff-scoped — checks the phase diff only, never re-runs underlying capability). Decks present capability as current. |
|
||||
| 2026-07-27 | CLARIFY/RESEARCH for v1.10 surfaces the structural defect: VERIFY is diff-scoped; advertised capability is not reproducible; deck work was sequenced backwards. |
|
||||
| 2026-07-27 | User decisions D-090 (no cap on sweep), D-091 (regression-class VERIFY), D-092 (local emulating adapters), D-093 (re-verify v1.1→v1.8), D-094 (rewrite to verified reality). |
|
||||
| 2026-07-27 | Phase 52 adds the regression-class VERIFY. Phase 53 builds local emulating adapters. Phase 54 enumerates + re-verifies every capability — finds 7 adapter defects, fixes all in-sweep. Phase 55 rewrites PROJECT/ROADMAP/decks to verified reality. |
|
||||
| 2026-07-27 | v1.10.0 tagged; all 16 auto-verifiable capabilities Verified. 6 IAM-gated capabilities (CAP-017..022) escalated (G-005). |
|
||||
|
||||
### Root cause
|
||||
|
||||
**VERIFY was diff-scoped.** The standard VERIFY stage checked the phase
|
||||
diff only — the files changed in that phase — and never re-ran the
|
||||
underlying platform capability. 8 NFR-patch phases (v1.9.1→v1.9.8)
|
||||
passed VERIFY while the platform decayed underneath, because each
|
||||
phase's diff was docs-only (decks) and the decay was in code the diff
|
||||
didn't touch. The VERIFY gate was structurally incapable of catching
|
||||
decay in code outside the phase diff.
|
||||
|
||||
### Contributing factors
|
||||
|
||||
1. **Deck work was sequenced backwards.** The honest order is
|
||||
re-verify → rewrite → polish. v1.9.x did it backwards: polish the
|
||||
decks first, then discover (in v1.10) that the capability they
|
||||
advertised had decayed.
|
||||
2. **No regression-class gate existed.** Each milestone's VERIFY
|
||||
re-checked the phase diff, not the cumulative capability. There was
|
||||
no mechanism to ask "does everything we previously claimed still
|
||||
work?"
|
||||
3. **Local emulating adapters did not exist.** Without a local tier,
|
||||
re-verification required live AWS access on every phase — costly and
|
||||
not run. The decay was therefore never re-probed between v1.7 and
|
||||
v1.10.
|
||||
4. **Decks were frozen before re-verification.** The v1.9.x decks
|
||||
presented capability as current without a re-verification step
|
||||
gating the claim.
|
||||
|
||||
### Impact
|
||||
|
||||
- **8 phases of inaccurate status reporting.** v1.9.1–v1.9.8 decks
|
||||
advertised capability as current that was not reproducible.
|
||||
- **7 adapter defects shipped undetected.** Duplicate output
|
||||
definitions, duplicate args, missing required args, deprecated AWS
|
||||
provider v5 arg names — all in `adapters/terraform/adapter.py`.
|
||||
- **Credibility gap.** The OSS reference's headline E2E did not run
|
||||
against live AWS between v1.7 and v1.10. The grill (G-005) flagged
|
||||
this as the project-killing risk.
|
||||
|
||||
### Mitigations (landed in v1.10)
|
||||
|
||||
| Mitigation | Decision | Status |
|
||||
|-----------|----------|--------|
|
||||
| Regression-class VERIFY that re-runs capability checks at milestone completion | D-091 (REQ-112) | Landed — `scripts/run_regression.sh` + `core/regression_verify.py`. 16/16 Verified at v1.10.0. |
|
||||
| Local emulating adapters so the platform is fully locally testable without cloud credentials | D-092 (REQ-113) | Landed — flat-file DynamoDB outbox, local ECS Fargate emulator, local S3 state, local Lambda stub. Headline E2E runs locally. |
|
||||
| Capability inventory with per-capability Verified/Decayed/Broken tags | D-093 (REQ-114) | Landed — `.ciagent/CAPABILITY_INVENTORY.md`. 16/16 Verified; 6 IAM-gated escalated (G-005). |
|
||||
| Rewrite docs/decks to verified reality; decks unfrozen only after re-verification | D-094 (REQ-115) | Landed — PROJECT.md §Capability Status (Re-Verified 2026-07-27), ROADMAP v1.9.x noted as superseded-by-reverification, both decks rewritten. |
|
||||
|
||||
### Follow-up (accepted debt)
|
||||
|
||||
- **G-007 (per-phase regression):** the regression gate runs at
|
||||
milestone completion, not per-phase. Inter-milestone decay between
|
||||
phase N and milestone COMPLETE is an accepted trade-off (grill Axis 3
|
||||
Q4, confidence 0.70). Per-phase regression hardening is a separate
|
||||
future milestone.
|
||||
- **G-005 (IAM-gated capabilities):** 6 capabilities (CAP-017..022)
|
||||
remain deploy-unverified as of v1.10 — the spike-runner cannot fix
|
||||
its own IAM. v1.11 (this milestone) closes G-005 by re-bootstrapping
|
||||
IAM and live-deploying the stacks.
|
||||
|
||||
---
|
||||
|
||||
## Part 2 — Forward pre-mortem: OSS reference + leadership pitch
|
||||
|
||||
### Scenario
|
||||
|
||||
It is 90 days after the v1.11 ship. The leadership pitch has been
|
||||
delivered. The grill's 90-day conditions (G-001 pitch yields a pilot
|
||||
platform team; G-005 deploy path verifiable; G-008 cost operating model
|
||||
documented) were the success criteria. **Assume the project has failed.**
|
||||
What killed it?
|
||||
|
||||
### Top failure modes + mitigations
|
||||
|
||||
#### FM-1 — IAM drift recurs (the spike-runner loses permissions again)
|
||||
|
||||
**How it kills the project:** the v1.11 IAM re-bootstrap grants are
|
||||
revoked or drift (admin action, account re-organization, SCP change).
|
||||
The next regression run (D-091) fails closed on CAP-017..022. The
|
||||
verified-reality claim in the decks becomes false again — a repeat of
|
||||
the v1.10 incident in a different shape. Leadership loses trust.
|
||||
|
||||
**Mitigation (user-owned):**
|
||||
- The IAM policy baseline is now regression-tested
|
||||
(`tests/test_iam_policy_baseline.py`, REQ-116). Any permission removal
|
||||
surfaces as a test failure at the next milestone COMPLETE — the gate
|
||||
fails closed, the false claim never ships.
|
||||
- `.ciagent/IAM_POLICY.md` documents the required grants. An admin who
|
||||
re-organizes the account can read the baseline and re-grant.
|
||||
- The user reviews the baseline test at each milestone COMPLETE. If the
|
||||
grants have drifted, the user re-bootstraps (D-095 path) before
|
||||
re-attempting COMPLETE.
|
||||
|
||||
#### FM-2 — Cost spike from un-torn-down stacks
|
||||
|
||||
**How it kills the project:** the v1.11 deploy-verification leaves the
|
||||
microservice + static-assets + uptime stacks running. Live ECS Fargate +
|
||||
CloudFront + WAF accrue spend. The COST.md (REQ-119) documents the
|
||||
v1.0–v1.10 window, not the ongoing burn. A pilot platform team clones
|
||||
the reference, runs the same apply, and leaves it running — multiply
|
||||
the spend by the number of clones. AWS budget alerts fire at leadership
|
||||
level. The reference is perceived as expensive.
|
||||
|
||||
**Mitigation (user-owned):**
|
||||
- **D-096 (teardown mandatory before milestone COMPLETE).** Phase 61
|
||||
tears down the stacks via D-070 decommission mode. The live AWS
|
||||
account returns to zero-cost steady state. The milestone does not
|
||||
complete until teardown is verified.
|
||||
- **COST.md teardown guidance.** REQ-119 documents the teardown path +
|
||||
cost-ceiling guidance for downstream clones. A clone that follows
|
||||
the guidance runs the same teardown.
|
||||
- The user enforces D-096 at Phase 61 — no merge to main until
|
||||
`terraform show` confirms no resources. The `decommissioned:
|
||||
{ stack, cr_id, completed_at }` record in the `---ci---` block is
|
||||
the audit trail.
|
||||
|
||||
#### FM-3 — Deck overstates capability (a future v1.9.x-style incident)
|
||||
|
||||
**How it kills the project:** a future NFR-patch milestone adds a deck
|
||||
slide claiming a capability that hasn't been re-verified. The
|
||||
regression gate runs at milestone COMPLETE and catches the underlying
|
||||
decay — but the deck has already been rendered and uploaded to a
|
||||
release. Leadership sees the deck before the regression gate fails.
|
||||
Repeat of the v1.9.x sequencing incident.
|
||||
|
||||
**Mitigation (user-owned):**
|
||||
- **Verified-only claims.** REQ-121 enforces that decks match
|
||||
`CAPABILITY_INVENTORY.md` exactly; `ci-doc-verifier` confirms no
|
||||
stale claims. Any deck claim must trace to a Verified capability.
|
||||
- **Decks unfrozen only after re-verification.** The v1.10 lesson
|
||||
(D-094) is codified: decks are frozen until the regression gate
|
||||
passes. A future milestone that adds a deck slide must land the
|
||||
capability re-verification in the same milestone.
|
||||
- The user reviews the `ci-doc-verifier` output at each milestone
|
||||
COMPLETE. If a stale claim is found, the milestone does not complete
|
||||
until the deck is corrected.
|
||||
|
||||
#### FM-4 — Pilot consumer hits a contract gap
|
||||
|
||||
**How it kills the project:** a pilot platform team (post-pitch) clones
|
||||
the reference and tries to deploy a stack the L2 catalog doesn't cover
|
||||
(e.g. a worker queue, a scheduled job, a database-backed service). The
|
||||
contract schema + L2 compositions support only microservice + static-
|
||||
assets. The pilot team concludes the reference is a demo, not a
|
||||
foundation. The pitch's "feature-complete MVP" claim (G-001) is
|
||||
undermined.
|
||||
|
||||
**Mitigation (user-owned):**
|
||||
- **CONSUMER_GUIDE.md + L2 catalog coverage.** `docs/CONSUMER_GUIDE.md`
|
||||
documents the supported L2 compositions; the L2 catalog
|
||||
(`modules/l2/`) is the supported surface. A pilot team that reads the
|
||||
guide knows the boundary before cloning.
|
||||
- **Honest scope.** The grill (G-010) accepted OSS scope as
|
||||
contributor-bounded. The pitch should not claim "any stack" — it
|
||||
should claim "microservice + static-assets today; the L2 pattern is
|
||||
extensible." The v1.9.5 Anti-goals slide (What This Platform Is —
|
||||
and Isn't) is the honest framing.
|
||||
- The user adds L2 compositions as pilot demand surfaces. The reference
|
||||
value is the *shape* (contract → IR → adapter → terraform →
|
||||
confidence → outbox), not the catalog size. A pilot team that
|
||||
understands the shape can extend it.
|
||||
|
||||
### What the pre-mortem tells us
|
||||
|
||||
The four failure modes all reduce to the same root pattern: **a claim
|
||||
outruns the verification that backs it.** v1.10 was the first instance
|
||||
(decks outran capability). v1.11 closes G-005 + G-008 by making the
|
||||
verification back the claim. The mitigations are all structural —
|
||||
regression-testable baselines, mandatory teardown, Verified-only deck
|
||||
claims, honest scope — not procedural. The user owns enforcement at
|
||||
each milestone COMPLETE.
|
||||
|
||||
### Confidence
|
||||
|
||||
- FM-1 (IAM drift recurs): confidence 0.75 — the baseline test catches
|
||||
it; the user enforces re-bootstrap at COMPLETE.
|
||||
- FM-2 (cost spike): confidence 0.85 — D-096 teardown is mandatory and
|
||||
audited in the `---ci---` block.
|
||||
- FM-3 (deck overstates): confidence 0.70 — `ci-doc-verifier` is
|
||||
automated; the sequencing risk is procedural.
|
||||
- FM-4 (pilot contract gap): confidence 0.65 — the mitigation is
|
||||
honest framing, not catalog completeness; a pilot may still hit the
|
||||
gap.
|
||||
|
||||
### Links to existing controls
|
||||
|
||||
- D-091 regression gate (REQ-112) — `scripts/run_regression.sh`.
|
||||
- D-094 verified-reality rewrite (REQ-115) — decks match
|
||||
`CAPABILITY_INVENTORY.md`.
|
||||
- D-096 teardown mandatory (v1.11) — Phase 61.
|
||||
- G-005 deploy verification (v1.11) — Phases 56–58.
|
||||
- G-008 cost documentation (v1.11) — Phase 59.
|
||||
- G-010 contributor-bounded scope — honest pitch framing.
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,78 @@
|
||||
# `.ciagent/archive/` — Completed-Milestone History
|
||||
|
||||
This directory holds byte-identical snapshots of `.ciagent/` files that
|
||||
were compressed out of the active agent context. Compression is **lossless
|
||||
via relocation**: every original byte is reachable here, and the git
|
||||
history at the commit prior to compression preserves the authoritative
|
||||
state for offline agent loading.
|
||||
|
||||
## Why archive
|
||||
|
||||
The active milestone is v1.26 (Live Pilot Estate Activation). The
|
||||
`.ciagent/` root held ~11,164 lines dominated by completed-milestone
|
||||
narratives (v1.0–v1.24). Per the run.md context-loading model, agents
|
||||
read `.ciagent/` every `/ci-run`; the historical narrative was not
|
||||
load-bearing for v1.26 execution and was relocated to keep the working
|
||||
context lean.
|
||||
|
||||
## Contents
|
||||
|
||||
### Snapshots of slimmed files (full content before compression)
|
||||
|
||||
| File | Original (lines) | Replaces | Status at time of snapshot |
|
||||
|---|---|---|---|
|
||||
| `PROJECT-v1.0-v1.24.md` | 1784 | `.ciagent/PROJECT.md` | v1.0–v1.24 milestone-by-milestone narrative + active milestone v1.26 sections |
|
||||
| `REQUIREMENTS-v1.0-v1.24.md` | 2490 | `.ciagent/REQUIREMENTS.md` | All requirements v1.0 (REQ-01) through v1.26 (REQ-322) |
|
||||
| `ROADMAP-v1.0-v1.24.md` | 2341 | `.ciagent/ROADMAP.md` | All phase breakdowns v1.0 through v1.26 |
|
||||
| `ARCHITECTURE-v1.0-v1.24.md` | 945 | `.ciagent/ARCHITECTURE.md` | Full architecture reference + historical "how we got here" narrative |
|
||||
|
||||
The slimmed in-place files retain: active milestone v1.26 context, the
|
||||
v1.25 milestone (since v1.26 tags ride the v1.25.x line), the durable
|
||||
vision/tenets/RACI/capability-status sections, and the current-state
|
||||
architecture reference.
|
||||
|
||||
### Completed-phase artifacts (relocated verbatim)
|
||||
|
||||
| File | Original (lines) | Phase(s) documented |
|
||||
|---|---|---|
|
||||
| `REVIEW.md` | 111 | Multi-persona code review records from completed phases |
|
||||
| `AUDIT.md` | 553 | Project health audit records (reconstruction tests, branch hygiene) |
|
||||
| `VERIFY.md` | 86 | Per-phase verification records |
|
||||
| `PRE_MORTEM.md` | 228 | Pre-mortem analyses for completed milestones |
|
||||
|
||||
### Live operational files NOT archived
|
||||
|
||||
These files remain at their canonical `.ciagent/` paths because they are
|
||||
read/write targets of live code paths and must not be relocated:
|
||||
|
||||
- `REGRESSION_REPORT.json` — written by `core/regression_verify.py:705`,
|
||||
read by `core/metrics/collector.py:27` + `core/metrics/trust_snapshot.py:21`
|
||||
+ `metrics/` views.
|
||||
- `REGRESSION_REPORT.md` — written by `core/regression_verify.py:704`,
|
||||
referenced by `scripts/run_regression.sh`.
|
||||
- `CHECKPOINT.json` — the authoritative resume point for `/ci-run`.
|
||||
- `config.json` — operational configuration (no historical content).
|
||||
|
||||
## How to load archived content
|
||||
|
||||
Agents that need completed-milestone history can read these files
|
||||
directly (they live inside `.ciagent/`, so the path convention holds):
|
||||
|
||||
```
|
||||
.ciagent/archive/PROJECT-v1.0-v1.24.md
|
||||
.ciagent/archive/REQUIREMENTS-v1.0-v1.24.md
|
||||
.ciagent/archive/ROADMAP-v1.0-v1.24.md
|
||||
.ciagent/archive/ARCHITECTURE-v1.0-v1.24.md
|
||||
.ciagent/archive/{REVIEW,AUDIT,VERIFY,PRE_MORTEM}.md
|
||||
```
|
||||
|
||||
For the authoritative pre-compression state of any `.ciagent/` file,
|
||||
use git history at the commit immediately preceding the compression
|
||||
commit (search the log for `chore(P02): compress .ciagent/ files`).
|
||||
|
||||
## `completed-milestones/`
|
||||
|
||||
Reserved for future per-milestone summary files if a milestone's
|
||||
narrative is too large for the slimmed in-place ROADMAP/PROJECT. Currently
|
||||
empty; v1.0–v1.24 narrative is fully preserved in the four snapshot
|
||||
files above.
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,112 @@
|
||||
# Nova v1.16 — Multi-Persona Code Review (final phase P21)
|
||||
|
||||
**Reviewer:** lead-developer (model: glm-5.2)
|
||||
**Scope:** v1.16 milestone — 22 tags (v1.15.5..v1.15.26), 20 execution
|
||||
phases + final. Squash-merged to main via `milestone/v1.16-nova-simplification`.
|
||||
**Date:** 2026-07-30
|
||||
|
||||
> **Historical note:** REVIEW.md was reconstructed at v1.16 P21 (the
|
||||
> v1.3–v1.15 reviews were not persisted or were overwritten per the
|
||||
> established convention). The v1.16 review overwrites prior content.
|
||||
|
||||
## Review approach
|
||||
|
||||
The v1.16 milestone is an NFR sweep (no new features). Each of the 20
|
||||
execution phases shipped with a 4-layer verify (structural/behavioral/
|
||||
security/quality) + `run_ci.sh` 3-stage PASS at every phase boundary.
|
||||
The final-phase review (P21) is a milestone-level cross-phase check,
|
||||
not a per-phase re-review (the per-phase verify already ran).
|
||||
|
||||
## P0 issues (0)
|
||||
|
||||
No blocking issues found. The 4-layer verify at each phase boundary +
|
||||
the regression gate (D-118, 18V+4S at P9 + P21) are the structural
|
||||
controls. No P0 was auto-applied at P21.
|
||||
|
||||
## P1 issues (0)
|
||||
|
||||
No P1 issues flagged. The grill binding decisions (G-111..G-113) were
|
||||
incorporated into the plan before execution; the regression gate (G-111)
|
||||
passed at both checkpoints (P9 + P21).
|
||||
|
||||
## P2 issues (2 — post-hoc, non-blocking)
|
||||
|
||||
### P2-1: Onboarding framing (E-002, deferred from grill)
|
||||
[scope] `.ciagent/PROJECT.md`, `.ciagent/ROADMAP.md`
|
||||
|
||||
The grill escalation E-002 (confidence 0.55) flagged that the PROJECT.md
|
||||
framing "first self-service onboarding request path" may over-promise
|
||||
relative to a request-*acceptance* path that writes a pending row +
|
||||
generates an env-file + proves the role Terraform offline but never
|
||||
fulfills (no live role grant). The milestone is internally consistent
|
||||
with D-113 (request-path only) — the wording is the only risk. The
|
||||
ROADMAP/PROJECT use "request path" (not "request-fulfillment"), and the
|
||||
Out-of-Scope section explicitly defers real AWS provisioning. **Accepted
|
||||
as-is** — the framing is accurate for what was delivered (a request path,
|
||||
not a fulfillment path).
|
||||
|
||||
### P2-2: REVIEW.md + AUDIT.md not updated during the run
|
||||
[maintainability] `.ciagent/REVIEW.md`, `.ciagent/AUDIT.md`
|
||||
|
||||
REVIEW.md still held v1.11 content during the v1.16 run (the per-phase
|
||||
verify ran but wasn't persisted to REVIEW.md until P21). AUDIT.md held
|
||||
v1.15 content. Both are reconstructed at P21 (this review + the audit
|
||||
running now). This matches the established convention (REVIEW.md is
|
||||
overwritten at milestone complete; the per-phase verify commits are the
|
||||
record). Not a defect.
|
||||
|
||||
## What is correct
|
||||
|
||||
- **State-bucket drift fix (P1):** `adapter.py:117` now emits
|
||||
`nova-tfstate-*` (matching the live bucket renamed in v1.15 P4). The
|
||||
new `test_adapt_emits_nova_state_bucket` regression guard asserts this.
|
||||
- **Kyverno label fix (P1):** `require-resource-labels.yml` enforces
|
||||
`nova:*` labels (consistent with `nova_tagging.py` hard-fail on
|
||||
`acdl:*`). No policy contradiction.
|
||||
- **Ingestor defense-in-depth (P10):** fail-closed on missing IAM
|
||||
identity (401, not silent pass); env enum derived from
|
||||
`core/environments/` (not hardcoded). The `NOVA_LAMBDA_LOCAL_BYPASS`
|
||||
env allows local/stub testing without blocking the fail-closed path.
|
||||
- **Payload validation (P11):** 256 KB size cap + contract.schema.json
|
||||
validation before the DynamoDB write; aligned error/stackTrace caps
|
||||
(both 10000).
|
||||
- **Regression gate (G-111):** CAP-013..016 return `Skipped` (not
|
||||
`Decayed`/`Broken`) for the post-teardown steady state (D-096).
|
||||
`passed` accepts Skipped. Gate passes at 18V+4S.
|
||||
- **Workflow generator (P8):** `sync_workflows.py` + `workflows-src/`
|
||||
single source; the byte-identity test is replaced with a generator-
|
||||
output test (`--check` exits 0). The 3 pairs are no longer hand-synced.
|
||||
- **Onboarding request path (P18-P20):** schema + Lambda action (pending
|
||||
CMDB row, no AWS resources) + env-file autogen + offline-proven
|
||||
cross-account Terraform. Self-service message (no "contact the platform
|
||||
team"). Real AWS provisioning explicitly deferred (D-113/D-114).
|
||||
- **Splits (P12/P13):** `contract_resolver` + `regression_verify` split
|
||||
with re-export shims; G-113 one-way import direction documented. All
|
||||
tests pass without modification (backwards compat preserved).
|
||||
- **DX (P15-P17):** `--help` works + documents all 9 flags; workflows
|
||||
README catalogs all 7 workflows; getting-started is offline-first.
|
||||
- **Regression gate:** 18 Verified + 4 Skipped at P9 + P21 (0 Decayed/
|
||||
Broken). The 4 Skipped are the post-v1.11-teardown live-AWS caps.
|
||||
|
||||
## Test coverage assessment
|
||||
|
||||
~635 tests pass (was ~620 at v1.15.4). New test files:
|
||||
- `tests/test_onboarding.py` (3 tests — env-file generation)
|
||||
- `tests/test_onboarding_terraform.py` (3 tests — terraform validate + tags)
|
||||
- `tests/test_docs_coverage.py` (expanded — workflows README catalog)
|
||||
|
||||
New tests in existing files: `test_adapt_emits_nova_state_bucket`,
|
||||
`test_onboarding_message_says_nova_not_acdl`, `test_no_identity_fails_closed`,
|
||||
`test_no_identity_passes_with_local_bypass`, `test_oversized_contract_rejected`,
|
||||
`test_schema_invalid_contract_rejected`, `TestNarrowedException` (2 tests),
|
||||
`TestOnboardConsumer` (3 tests), `TestOnboardingMessageSelfService` (2 tests),
|
||||
`test_sync_workflows_check_passes`.
|
||||
|
||||
## Verdict
|
||||
|
||||
**PASS — 0 P0, 0 P1, 2 P2 (post-hoc, accepted).** The v1.16 NFR milestone
|
||||
is complete. All 20 requirements (REQ-165..184) satisfied; regression
|
||||
gate 18V+4S; CI 3-stage PASS at every phase boundary. The onboarding
|
||||
request path is self-service; real AWS provisioning deferred. The
|
||||
state-bucket drift + Kyverno label contradiction (the two correctness
|
||||
regressions from the v1.15 rebrand) are fixed with regression guards.
|
||||
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,87 @@
|
||||
# VERIFY — P1 engine-core (v1.25)
|
||||
|
||||
> 4-layer verify gate: structural, behavioral, security, quality.
|
||||
> Phase: P1. Requirements: REQ-291..294, 308, 309. Result: PASS.
|
||||
|
||||
## Structural
|
||||
|
||||
- `core/policy_engine.py` exists, implements `PolicyEngine` Protocol
|
||||
(PEP 544, `@runtime_checkable`), `PolicyEngineRegistry` with
|
||||
`register()` + `get_engine()`, `NullEngine` fallback.
|
||||
- `adapters/kyverno-json/kyverno_json_engine.py` exists, exports
|
||||
`KyvernoJsonEngine` with `name`, `is_configured()`, `evaluate()`.
|
||||
- `adapters/kyverno-json/__init__.py` loads the engine by file path
|
||||
(the dir name has a hyphen — not a valid Python package name).
|
||||
- `adapters/kyverno-json/policies/_smoke.json` exists (trivial policy
|
||||
for round-trip validation).
|
||||
- `scripts/install-kyverno-json.sh` exists (go install kj@latest).
|
||||
- `.ciagent/config.json` has the `policy` object
|
||||
(`engine: kyverno-json`, `policy_root`).
|
||||
- `.gitea/workflows/ci.yml` + `.github/workflows/ci.yml` have the
|
||||
Go + kj install step (best-effort, tests skip when kj absent).
|
||||
- `tests/test_policy_engine.py` (10 tests) +
|
||||
`tests/test_kyverno_json_engine.py` (16 tests) exist.
|
||||
|
||||
## Behavioral
|
||||
|
||||
- `pytest tests/test_policy_engine.py tests/test_kyverno_json_engine.py`:
|
||||
**24 passed, 2 skipped** (kj not installed — expected;
|
||||
`pytest.skip("kj not installed")`).
|
||||
- `NullEngine` satisfies the `PolicyEngine` Protocol (G-Q8a —
|
||||
`isinstance(NullEngine(), PolicyEngine)` is True). Proves the swap
|
||||
boundary is real without implementing OPA.
|
||||
- `KyvernoJsonEngine.is_configured()` returns `False` when
|
||||
`which kj` is absent → `evaluate()` returns a single
|
||||
`KJ_ENGINE_NOT_CONFIGURED` SKIPPED PCR (distinct `ruleId` from
|
||||
NullEngine's `NULL_ENGINE_INACTIVE` — G-Q4).
|
||||
- PCR records validate against `schemas/policy_check_result.schema.json`
|
||||
(via `jsonschema.validate` in tests).
|
||||
- Defensive parsing: malformed kyverno-json output → `error` PCR
|
||||
(`KJ_ENGINE_ERROR`), never an exception.
|
||||
- Severity annotation reading (G-Q10a): policies with
|
||||
`nova.cloudinit.dev/severity: high` produce PCRs with `severity: high`;
|
||||
policies without the annotation default to `info`.
|
||||
- Registry: `get_engine()` returns the configured engine; unknown
|
||||
engine name raises `KeyError`; `policy` key absent → `NullEngine`.
|
||||
- No regression: `pytest tests/test_confidence_signal.py
|
||||
tests/test_adapter.py tests/test_checkov_adapter.py
|
||||
tests/test_kyverno_adapter.py tests/test_contract_resolver.py` —
|
||||
**132 passed** (unchanged).
|
||||
|
||||
## Security
|
||||
|
||||
- No new secrets, no new network calls in the engine core (the engine
|
||||
shells to a local binary; the binary makes no network calls for
|
||||
`scan`).
|
||||
- `is_configured()` guard ensures the platform runs without the binary
|
||||
(no hard dependency that could be exploited as a DoS vector).
|
||||
- The engine writes the payload to a temp file (`tempfile.NamedTemporaryFile`)
|
||||
and unlinks it in a `finally` block (no leftover payload on disk).
|
||||
- No `shell=True` in the `subprocess.run` call (command is a list —
|
||||
no shell injection surface).
|
||||
|
||||
## Quality
|
||||
|
||||
- `python3 -m py_compile` passes on all new Python files.
|
||||
- The `PolicyEngine` Protocol is minimal (3 members) — the swap
|
||||
boundary is the moat (NORTH_STAR Strategic Objective #2).
|
||||
- The `NullEngine` proves a second implementation exists (structural
|
||||
conformance) — the OPA swap is a known quantity (RESEARCH §4.2).
|
||||
- Tests use `pytest.skip` when `which kj` is absent, so the CI matrix
|
||||
passes with or without the binary (the suite is green in both cases).
|
||||
|
||||
## Must-have checklist
|
||||
|
||||
- [x] `PolicyEngine` Protocol + `PolicyEngineRegistry` + `NullEngine`
|
||||
(REQ-291)
|
||||
- [x] `config.json.policy` object (REQ-292)
|
||||
- [x] `KyvernoJsonEngine` adapter (REQ-293)
|
||||
- [x] `__init__.py` + `_smoke.json` + `install-kyverno-json.sh` + CI
|
||||
install (REQ-294)
|
||||
- [x] `test_policy_engine.py` — protocol conformance, registry,
|
||||
NullEngine fallback (REQ-308)
|
||||
- [x] `test_kyverno_json_engine.py` — PCR schema validity, defensive
|
||||
parsing, skip-without-kj (REQ-309)
|
||||
|
||||
**Verdict: PASS** — all P1 must-haves met, no regressions, 24 new
|
||||
tests pass (2 skip-without-kj), 132 existing tests unchanged.
|
||||
Reference in New Issue
Block a user