continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity

docs(P00): grill — v1.28 adversarial review (PROCEED 0.76, 3 critical + 16 tracked conditions applied)

Browse Source 
---ci---
project: acdl
phase: 0
milestone: v1.28
status: grill
---/ci---
This commit is contained in:
Jon Chery
2026-08-19 22:10:15 +00:00
parent e1dc59ba79
commit bbfcbcc4d3
4 changed files with 269 additions and 208 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.ciagent/REQUIREMENTS.md
+26 -23
View File
@@ -408,8 +408,11 @@ provisioning cloud resources.
#### REQ-332 — JWS signing key from PAT
**Journeys:** J2. **Priority:** High.
**AC:** Given a PAT, when Dev runs `nova apply --local --sign-local-review`,
then a JWS attestation is produced; the public key is derivable from the
PAT and the JWS verifies. INV-14..17 (attestation invariants) enforced.
then a JWS attestation is produced; the JWS is HMAC-SHA256 with a key
derived from the PAT via `HKDF-SHA256(PAT_bytes, salt='nova-local-attestation',
info='jws-signing-key')` → 32-byte symmetric key (C-5.2 grill fix). The
verification key is derived from the PAT via the same KDF (the PAT is
the shared secret). INV-14..17 (attestation invariants) enforced.
#### REQ-333 — `nova-idp-auth` Lambda
**Journeys:** J1, J2. **Priority:** High.
@@ -578,24 +581,24 @@ All v1.28 release-gate criteria in PLAN.md §6 met.
| REQ-330 | P2 | planned |
| REQ-331 | P2 | planned |
| REQ-332 | P2 | planned |
| REQ-333 | P2 | planned |
| REQ-334 | P2 | planned |
| REQ-335 | P2 | planned |
| REQ-336 | P2 | planned |
| REQ-337 | P2 | planned |
| REQ-338 | P2 | planned |
| REQ-339 | P2 | planned |
| REQ-340 | P2 | planned |
| REQ-341 | P2 | planned |
| REQ-342 | P2 | planned |
| REQ-343 | P2 | planned |
| REQ-344 | P2 | planned |
| REQ-345 | P3 | planned |
| REQ-346 | P3 | planned |
| REQ-347 | P3 | planned |
| REQ-348 | P4 | planned |
| REQ-349 | P4 | planned |
| REQ-350 | P4 | planned |
| REQ-351 | P4 | planned |
| REQ-352 | P5 | planned |
| REQ-353 | P5 | planned |
| REQ-333 | P3 | planned |
| REQ-334 | P3 | planned |
| REQ-335 | P3 | planned |
| REQ-336 | P4 | planned |
| REQ-337 | P4 | planned |
| REQ-338 | P4 | planned |
| REQ-339 | P4 | planned |
| REQ-340 | P4 | planned |
| REQ-341 | P4 | planned |
| REQ-342 | P4 | planned |
| REQ-343 | P4 | planned |
| REQ-344 | P4 | planned |
| REQ-345 | P5 | planned |
| REQ-346 | P5 | planned |
| REQ-347 | P5 | planned |
| REQ-348 | P5 | planned |
| REQ-349 | P5 | planned |
| REQ-350 | P5 | planned |
| REQ-351 | P5 | planned |
| REQ-352 | P6 | planned |
| REQ-353 | P6 | planned |