From a6510e7afcee6ba494a19ec537e5b8a6bbb4c4fd Mon Sep 17 00:00:00 2001 From: Jon Chery Date: Wed, 19 Aug 2026 23:53:19 +0000 Subject: [PATCH] =?UTF-8?q?docs(pdlc):=20STATE.md=20Phase=200=20intake=20?= =?UTF-8?q?=E2=80=94=20post-v1.28=20ground=20truth=20snapshot?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Populates the PDLC Phase 0 intake format with the absolute ground truth of the system after v1.28 ship (CLI Canonicalization + Identity Layer). Header bumped to v1.28 last-ship. 7 sections: header, architecture state, technical stack, active constraints (D-001..D-231, INV-1..17, CAP-001..038), recent history + quality gates (coverage 73.8% YELLOW — below 80% floor), agent context + assumptions, canonical state references. Unknowns explicit (no new initiative; CodeArtifact/KMS/kj-in-Lambda unverified in-account). ---ci--- project: acdl phase: 0 milestone: v1.28 status: pdlc-intake ---/ci--- --- .ciagent/STATE.md | 174 ++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 169 insertions(+), 5 deletions(-) diff --git a/.ciagent/STATE.md b/.ciagent/STATE.md index 26be8ba..be61aa4 100644 --- a/.ciagent/STATE.md +++ b/.ciagent/STATE.md @@ -11,10 +11,17 @@ > *why*, read `NORTH_STAR.md`. For *how*, read `ARCHITECTURE.md`. For > *what was decided*, read `PROJECT.md` load-bearing decisions. > -> **Last milestone ship:** v1.27 (`v1.26.3`, 2026-08-19) — PO State Catalog -> & Ciagent Compression NFR milestone. No new capabilities this -> milestone (NFR); v1.27 authored this file + compressed `.ciagent/`. -> **Next update:** at v1.28 ship. +> **Last milestone ship:** v1.28 (`v1.27.6`, 2026-08-19) — CLI +> Canonicalization + Identity Layer. Feature milestone: Nova CLI +> installable from CodeArtifact; 15 `nova ` subcommands; +> `nova init` scaffolding; `nova cli-action` composite action; +> `core/mode_resolver.py` (D-226); Nova-idp identity layer +> (`nova-idp-auth` + `nova-idp-token-vend` + `nova-idp-jwks` Lambdas; +> Argon2id; KMS-signed OIDC ES256; kyverno-json ABAC fail-closed; PAT +> lifecycle; `nova idp setup`; `nova auth login/revoke/status`). No +> AWS-managed identity (INV-15). 6 new capabilities (CAP-033..038), +> 6 new invariants (INV-12..17), 6 decisions (D-226..231). +> **Next update:** at v1.29 ship. ## How to use this file (PO) @@ -331,4 +338,161 @@ wave** (Wave 3 "milestone ship" in `PLAN.md`), alongside Enforcement: convention (the P-final ship step names this file). A drift-check gate (assert every REQ marked `complete` in `REQUIREMENTS.md` traceability appears in STATE.md) is a future option -if the convention drifts. \ No newline at end of file +if the convention drifts. + +--- + +## PDLC Phase 0 Intake (current ground truth — 2026-08-19) + +> Single-pass discovery for the next PDLC cycle. Populated from the +> live repo state after v1.28 ship. No aspirational items — state is +> what is, not what should be. Unknowns are explicit. + +--- + +### 1. Header (mandatory) + +Project: Nova — The New Dawn of DevSecOps + +Initiative: UNKNOWN — needs investigation (no new initiative specified; v1.28 just shipped, next milestone not yet scoped) + +Initiator: Product Owner / Manager (PDLC Phase 0 trigger) + +Date (UTC): 2026-08-19 + +Current Version: v1.28 complete (tag `v1.27.6`, merged to main 2026-08-19); all 7 phases shipped; no phase in progress + +System Health: YELLOW — coverage 73.8% is below the 80% release-gate floor (NFR/quality debt); CodeArtifact not provisioned (P1 Wave 0 gate unresolved — fallback documented); KMS asymmetric key unverified in-account (C-1.1 documented as CI gate, not verified locally) + +Raw Idea (≤ 3 sentences): + + UNKNOWN — needs investigation (no raw idea provided; the PDLC trigger is the post-v1.28 state intake, not a new initiative). + + Trigger: v1.28 milestone completion (CLI Canonicalization + Identity Layer shipped 2026-08-19). + + Desired outcome: UNKNOWN — the PO defines the next initiative from this intake. + +--- + +### 2. Architecture State + +Active Layers (which exist and are stable): + + [x] Core Primitives — `core/` (27 modules): `abac_evaluator`, `attestation_matrix`, `auth_store`, `confidence_signal`, `contract_resolver`, `decommission_transform`, `env`, `env_transition`, `environment_check`, `hitl_gates`, `init_scaffold`, `jws_attestation`, `kms_signing`, `local_emulators`, `mode_resolver`, `onboarding`, `outbox_writer`, `output_publisher`, `pat_lifecycle`, `policy_engine`, `regression_verify`, `separation_of_duties`, `submission_readiness` + `core/lambda/` (6 modules) + `core/metrics/` (decision ledger) + + [x] Domain Modules — `adapters/terraform/` (stateless adapter), `adapters/kyverno-json/` (unified policy engine, INV-4 swappable), `adapters/wiz/`, `adapters/kyverno/` (K8s, inactive for Terraform — D-053) + + [x] API/Dev Surface — `nova/` CLI package (15 subcommands, argparse-only, `[project.scripts] nova = "nova.cli:main"`); `nova auth {login,revoke,status}`; `nova idp setup`; `nova init`; `nova apply --local`; `nova cli-action` composite action (GitHub + Gitea) + + [x] UI/Agent Surface — N/A (no UI; CLI + JSON endpoints only; JWKS serves `application/json`) + +Compute Topology (per environment): + + local: abstract (local emulators via `core/local_emulators.py:LocalLambdaStub`; `nova apply --local` synthesizes env via `core/env.synthesize_local_env()`; no cloud provisioning) + + dev: abstract (env JSON `core/environments/dev.json`; pilot ran `mode: full` against live AWS `581513795199` at v1.26; Nova-idp Lambdas deploy via `nova idp setup` but not yet live-verified in dev) + + staging: N/A (no `staging` environment JSON; environments are dev/qa/prod/dr) + + prod: UNKNOWN — needs investigation (env JSON `core/environments/prod.json` exists; live-apply not run against prod; pilot was dev-only per D-209) + + dr: placeholder (env JSON `core/environments/dr.json` exists; blocked by pilot-readiness policy D-208; not activated) + +Identity Stack in Force: + + auth: Custom IDP — Nova-idp (`nova-idp-auth` Lambda, v1.28): sign-up/sign-in/session; Argon2id (t=3, m=65536, p=1); DynamoDB `nova-users`/`nova-sessions`/`nova-password-resets`. NOT live-deployed (code + tests complete; `nova idp setup` ready; deployment pending operator action + AWS creds). + + token-vend: Nova-idp (`nova-idp-token-vend` Lambda, v1.28): accepts PAT/session → KMS-signed OIDC token (ECDSA P-256 / ES256); kyverno-json ABAC fail-closed (INV-17, C-6.1); `nova-pats` DynamoDB (strong-read revocation, D-229, 60s SLO). NOT live-deployed. + + signing: KMS asymmetric — `alias/nova-oidc-signing` (ECC_NIST_P256, SIGN_VERIFY). Code complete; key NOT yet created in-account (C-1.1 documented as CI gate — `aws kms create-key --key-spec ECC_NIST_P256 --key-usage SIGN_VERIFY` unverified). + + session: DynamoDB — `nova-sessions` table (PK `session_id`, TTL `expires_at`, 24h). Cookie/local-file: `~/.nova/credentials.json` (0600, OIDC token + PAT metadata, NOT raw PAT — C-7.3). + +Audit Stream: + + source of truth: DynamoDB outbox → S3 Object Lock (7-yr) → GitHub/Gitea audit repo (hot index). The Decision Ledger (SQLite hash-chain, D-121, `core/metrics/decision_ledger.py`) is the cold store for `ai.decision.made` + `attestation.recorded` events. + + in-repo fallback: yes (SQLite hash-chain outbox_writer, `core/outbox_writer.py`, INV-6 tamper-evident; tamper-*resistant* deferred — D-083 S3 Object Lock/JWS not yet enabled) + + retention policy: 7 years (S3 Object Lock target; not yet enabled — D-083 deferred) + +--- + +### 3. Technical Stack (concrete, not aspirational) + +Language(s) and runtime(s): Python 3.12 (requires-python `>=3.12`; Lambda Python 3.12 runtime on Amazon Linux 2023) + +Build / packaging: setuptools (`pyproject.toml`, build-backend `setuptools.build_meta`); wheel via `python -m build --wheel`; Lambda layer via `pip install --target layer/python/` + `zip`; publish to CodeArtifact (NOT yet provisioned — fallback: Gitea wheel index / private PyPI via `NOVA_WHEEL_INDEX`) + +CI / CD: Gitea Actions (`.gitea/workflows/`) + GitHub Actions (`.github/workflows/`, byte-identical); `publish.yml` (wheel + layer co-publish, REQ-323, CAP-035); `ci.yml` (test/lint); `deploy.yml@v1.25` (consumer deploy); `nova cli-action` composite action (`.github/actions/nova-cli/action.yml`); OIDC to AWS (`id-token: write`) + +Infrastructure: AWS account `581513795199` (single-region `us-east-1`); S3 (state files); DynamoDB (locking + outbox + identity tables); Lambda (contract ingestor + Nova-idp 3 Lambdas); KMS (per-stack CMK + `alias/nova-oidc-signing`); CloudFront/WAF/ACM (optional, `--public-jwks-domain`); no VMs/bare metal/OS (Anti-Goal) + +Data stores: DynamoDB — `nova-contracts`, `nova-change-requests` (v1.7); `nova-users`, `nova-sessions`, `nova-password-resets`, `nova-pats` (v1.28); SQLite — Decision Ledger (`core/metrics/decision_ledger.py`, local cold store); S3 — Terraform state + audit Object Lock (target, D-083 deferred) + +Secrets / KMS: KMS per-stack CMK (D-069, 90-day rotation); `alias/nova-oidc-signing` (ECC_NIST_P256, 90-day rotation target — code complete, key not yet created); `nova-spike-runner` IAM user (static key, daily rotation via `workflows-src/rotate-aws-key.yml`, REQ-230 forge-agnostic); Secrets Manager (`nova/github-token`); `NOVA_GITEA_TOKEN` in `.env` (not shell-env, per bash_allowlist) + +External integrations in scope: CodeArtifact (internal PyPI — NOT yet provisioned); Gitea (`git.cloudinit.dev/continuous-intelligence/acdl` — primary forge); GitHub (mirror, byte-identical workflows); AWS (account `581513795199` — pilot + identity stack); `kj` / kyverno-json v0.0.3 (Go binary, pinned SHA256, bundled in Lambda layer — `platform/abac/kj-version.txt`) + +--- + +### 4. Active Constraints (the load-bearing ones) + +Locked Decisions: D-001..D-231 (full ledger in PROJECT.md + CLARIFY history). Load-bearing for new work: D-022 (contract schema), D-039/D-047 (per-run creds), D-051 (Lambda Function URL), D-069 (per-stack CMK), D-083 (S3 Object Lock — deferred), D-092 (local emulators), D-096 (live pilot — lifted v1.26), D-121 (Decision Ledger), D-133 (submission-readiness gate), D-200..D-213 (v1.26 pilot), D-214..D-225 (v1.27), D-226..D-231 (v1.28 — mode resolution, kyverno-json ABAC, Argon2id fail-closed, PAT revocation strong-read, JWKS function URL, ABAC policy git-SHA versioning) + +Active Invariants: INV-1..INV-17 (full text above). New in v1.28: INV-12 (mode observability), INV-13 (mode determinism), INV-14 (credential type encodes role), INV-15 (no AWS-managed identity), INV-16 (Argon2id password storage), INV-17 (ABAC discipline fail-closed) + +Standing Capability Gate: CAP-001..CAP-038 — all Verified (32 from v1.0..v1.27 + 6 from v1.28). Gate enforced by `core/regression_verify.py` + CI merge gates. CAP-033..038 added v1.28 (CLI surface, delegation AST, layer/wheel match, auth flow, KMS sign, PAT revocation). + +Anti-Goals Touched: `docs/vision.md` §7 / `NORTH_STAR.md` §Anti-Goals — (1) not an upstream dev platform; (2) not a general-purpose AI; (3) not a legacy infra bridge; (4) not a permissive delivery highway; (5) not a mutable audit log. v1.28 honored all 5 (no PDLC reach, narrow CLI autonomy, no VMs, ABAC fail-closed + HITL gates intact, immutable outbox). + +Out-of-Scope (hard): MFA/TOTP enforcement (v1.21+); WebAuthn/FIDO2 (v1.23+); upstream IdP federation (v1.23+); Lambda layer auto-update on `core/` changes (v1.19); password breach detection (v1.23+); session refresh token rotation (v1.22); S3 Object Lock / JWS tamper-resistance (D-083, deferred); multi-cloud (Azure/GCP); ML forecasting; bonds/derivatives/options (D-200 equities-only); multi-validator BFT (D-201 single-validator PoA) + +--- + +### 5. Recent History & Quality Gates (last 1-2 milestones) + +Last Shipped: v1.28 (tag `v1.27.6`, 2026-08-19) — CLI Canonicalization + Identity Layer. 31 REQs (REQ-323..353), 6 CAPs (CAP-033..038), 6 INV (INV-12..17), 6 decisions (D-226..231). 7 phases (P0 + P1..P5 + P6 final). 1000 tests passing. Grill PROCEED 0.76 (3 critical + 16 tracked conditions resolved). Merged to main `c0cb188`. + +In Progress: N/A (no phase in progress; v1.28 complete; next milestone not yet scoped) + +Coverage Floor: 73.8% (3119/4227 lines covered) — BELOW the 80% release-gate floor. v1.28 new modules (`nova/`, `core/mode_resolver.py`, `core/lambda/nova_idp_*.py`, `core/kms_signing.py`, `core/abac_evaluator.py`, `core/jws_attestation.py`, `core/pat_lifecycle.py`) have high unit-test coverage but the overall floor is dragged by older uncovered code paths. Quality debt to address in a future NFR milestone. + +Recent Incidents: none (no incidents in v1.27 or v1.28; no hotfix/rollback/outage commits in recent history) + +Known Tensions: (1) CodeArtifact not provisioned — the publish pipeline (REQ-323) has a documented Gitea wheel-index fallback (`NOVA_WHEEL_INDEX`) but the primary path is unverified. (2) KMS asymmetric key unverified in-account (C-1.1) — the token-vend Lambda code + tests are complete but `aws kms create-key --key-spec ECC_NIST_P256` has not been run against `581513795199`. (3) `kj` Go binary in Lambda layer — pinned + locally verified, but AL2023 Lambda-runtime compatibility is a P2 spike that was not live-verified (D-227 risk; Fargate fallback documented). (4) Coverage 73.8% < 80% floor — the release gate was satisfied by phase-level coverage on new modules, but the overall floor is in debt. (5) `pyproject.toml` version is `1.14.0` (stale — not bumped through v1.15..v1.28; the milestone tags are authoritative, not the pyproject version). + +--- + +### 6. Agent Context & Assumptions (Agent Initiators Only) + +Missing Context: (1) The next initiative / raw idea — no new PDLC work was specified; this intake is the post-v1.28 state snapshot. (2) Live AWS verification of Nova-idp — CodeArtifact, KMS asymmetric key, and `kj`-in-Lambda-layer were not live-verified (no AWS creds in the build environment); all have documented fallbacks + CI gates. (3) Prod/dr environment activation status — env JSONs exist but live-apply was dev-only (D-209). + +Agent Assumptions: (1) The PDLC trigger is the post-v1.28 state intake (not a new initiative) — the PO will define the next initiative from this snapshot. (2) Coverage 73.8% is reported as YELLOW system health (below 80% floor) but is not a blocker for the intake — it's quality debt for a future NFR milestone. (3) The 3 unverified-in-account items (CodeArtifact, KMS, kj-in-Lambda) are reported as tensions, not blockers — they have fallbacks + CI gates documented. (4) `pyproject.toml` version `1.14.0` is stale but not load-bearing (milestone tags are authoritative); flagged for a future chore. + +--- + +### 7. Canonical State References (Version/Hash) + +Vision/Strategy doc: `docs/vision.md` v0.2 (referenced in PROJECT.md; not version-tagged separately) + +Architecture document: `.ciagent/ARCHITECTURE.md` §12.1..§12.10 (v1.28-appended §12.10 Nova-idp); commit `c0cb188` (main HEAD) + +Last approved SPEC: v1.28 (REQ-323..353, REQUIREMENTS.md §v1.28); commit `c0cb188` + +Decision log: D-001..D-231 (PROJECT.md load-bearing + CLARIFY.md history); last synced commit `c0cb188` + +Invariants catalog: INV-1..INV-17 (STATE.md §Invariants); commit `c0cb188` + +Capability catalog: CAP-001..CAP-038 (STATE.md §Domains 1..11); commit `c0cb188` + +--- + +### Ground rules compliance + +1. No prose paragraphs inside sections — field structure used throughout. ✓ +2. No aspirational items — state is what is (CodeArtifact "NOT yet provisioned", KMS "NOT yet created", prod "UNKNOWN"). ✓ +3. No restated decisions — referenced D-*/INV-*/CAP-* IDs only. ✓ +4. Unknowns explicit — "UNKNOWN — needs investigation" used for initiative, prod state, raw idea. ✓ +5. One file, one format — appended to STATE.md as §PDLC Phase 0 Intake. ✓ +6. Full shipping workflow + merge to forge upstream, NO release — branch + merge + push only (release skipped per instruction). ✓ \ No newline at end of file