diff --git a/.ciagent/ARCHITECTURE.md b/.ciagent/ARCHITECTURE.md
index 0820216..a990c6d 100644
--- a/.ciagent/ARCHITECTURE.md
+++ b/.ciagent/ARCHITECTURE.md
@@ -668,8 +668,10 @@ deferral is documented here explicitly per the v1.14 grill (E-001).
 Delivery Platform" → **Nova** / "The New Dawn of DevSecOps — security
 as a seamless enabler of fast deployments." This is a **Major
 milestone** (breaking): consumer-facing path, env var prefixes, SSM
-path, AWS tag keys, and AWS resource names all change. Tags run on the
-v1.14.x patch line: `v1.14.0` (P0) → `v1.14.5` (P5 final = release).
+path, AWS tag keys, and AWS resource names all change. Per the
+branch-strategy precedent (breaking/feature milestones tag on their
+OWN minor line), v1.15 tags run on the **v1.15.x minor line**:
+`v1.15.0` (P0) → `v1.15.4` (P5 final = release). (G-104 binding.)
 
 ### Naming conventions (rebranded)
 
diff --git a/.ciagent/CHECKPOINT.json b/.ciagent/CHECKPOINT.json
index dc0ec19..5a3dfbd 100644
--- a/.ciagent/CHECKPOINT.json
+++ b/.ciagent/CHECKPOINT.json
@@ -1,9 +1,9 @@
 {
   "phase": 0,
-  "stage": "grill",
+  "stage": "ship",
   "milestone": "v1.15",
   "phase_role": "pre_execution",
   "attempts": 0,
-  "updated_at": "2026-07-30T00:04:00Z",
+  "updated_at": "2026-07-30T00:05:00Z",
   "milestone_complete": false
 }
\ No newline at end of file
diff --git a/.ciagent/PLAN.md b/.ciagent/PLAN.md
index d5abe62..6156963 100644
--- a/.ciagent/PLAN.md
+++ b/.ciagent/PLAN.md
@@ -11,9 +11,13 @@ depends_on: []
 
 **Milestone:** v1.15 (Nova Rebrand — Major/breaking)
 **Type:** Major (breaking — consumer path, env vars, SSM path, tag keys,
-AWS resource names all change). Final patch IS the milestone release.
-Tags: `v1.14.0` (P0) → `v1.14.1..v1.14.4` (P1–P4) → `v1.14.5` (P5 =
-milestone release).
+AWS resource names all change). Per the branch-strategy precedent
+(v1.10.2 → v1.11.0, v1.9.x → v1.10.0 — breaking/feature milestones tag
+on their OWN minor line, not the previous minor's patch line), v1.15
+tags run on the **v1.15.x minor line**: `v1.15.0` (P0) →
+`v1.15.1..v1.15.4` (P1–P4) → `v1.15.4` (P5 = milestone release). (G-104
+binding: the v1.14.x patch line is the NFR convention; a Major
+milestone ships on its own minor.)
 **Branch:** `milestone/v1.15-nova` → `phase/NN-<slug>`
 
 ## Wave ordering (D-098 v1.15 analogue)
@@ -136,13 +140,27 @@ behavior.
    dual-read inline. Rename keys in `.env` + `.env.secrets` (KEY names
    only — VALUES/secret material stay). Leave a comment in `.env.secrets`
    noting the legacy `ACDL_*` keys are the dual-read fallback source
-   until P5.
-3. **Gitea secrets rotation (REQ-159).** Use the Gitea API
-   (`scripts/rotate_spike_key.sh` pattern or a new
+   until P5. **G-106 binding:** the `.env.secrets` direct-read paths
+   (`scripts/run_platform.sh:288-289` `export AWS_ACCESS_KEY_ID="$ACDL_AWS_ACCESS_KEY_ID"`
+   + `core/regression_verify.py:309-312` `if k == "ACDL_AWS_ACCESS_KEY_ID"`)
+   bypass the helper and MUST be updated to dual-read `NOVA_*` first,
+   `ACDL_*` fallback (shell: `${NOVA_AWS_ACCESS_KEY_ID:-$ACDL_AWS_ACCESS_KEY_ID}`;
+   Python: match `k == "NOVA_AWS_ACCESS_KEY_ID" or k == "ACDL_AWS_ACCESS_KEY_ID"`)
+   — otherwise AWS creds vanish mid-rename and CAP-013/014/015 fail.
+3. **Gitea secrets rotation + workflow refs (G-108 binding, REQ-159).**
+   Use the Gitea API (`scripts/rotate_spike_key.sh` pattern or a new
    `scripts/rename_gitea_secrets.py`) to create `NOVA_*` secrets
-   mirroring the `ACDL_*` values, then (after P5) delete the old
-   `ACDL_*` secrets. For P2, just create the `NOVA_*` aliases; deletion
-   is P5.
+   mirroring the `ACDL_*` values (idempotent + retry-on-failure), then
+   (after P5) delete the old `ACDL_*` secrets. For P2, just create the
+   `NOVA_*` aliases; deletion is P5. **G-108 binding:** when `NOVA_*`
+   secrets are created, the CI workflow `secrets:` references
+   (`.gitea/workflows/deploy.yml:105,107,108,148`,
+   `.gitea/workflows/modules-lifecycle.yml:63,64,103,104,111,112,117,118,123,124,161,162,169,170`,
+   `.github/workflows/*` mirrored) MUST be updated from `secrets.ACDL_*`
+   → `secrets.NOVA_*` in the SAME phase, with graceful degrade + the
+   `acdl-deploy-` role name in deploy.yml:105 → `nova-deploy-` (P4
+   renames the IAM role). Until both secrets + refs are updated, CI
+   breaks — this is a hard gate, not a silent skip.
 4. **Checkov rule rename (D-109 warn mode, REQ-158).** Rename
    `adapters/terraform/policy/custom_rules/acdl_tagging.py` →
    `nova_tagging.py`. Update the Checkov registration in
@@ -327,4 +345,5 @@ ABAC session-policy terraform
 7. `grep -rn "acdl-" terraform/` returns 0 hits.
 8. `pytest` passes; `run_ci.sh` exits 0; `terraform validate` passes
    for platform/microservice/ci-vpc.
-9. Tag `v1.14.5` created; milestone merged to main.
\ No newline at end of file
+9. Tag `v1.15.4` created (IS the milestone release, G-104); milestone
+   merged to main.
\ No newline at end of file
diff --git a/.ciagent/PROJECT.md b/.ciagent/PROJECT.md
index 834b78a..be626d3 100644
--- a/.ciagent/PROJECT.md
+++ b/.ciagent/PROJECT.md
@@ -933,8 +933,9 @@ staged infrastructure migration to avoid breakage.
 
 **Milestone type:** Major (breaking — consumer-facing path, env var
 prefixes, SSM path, AWS tag keys, and AWS resource names all change).
-Tags run on the v1.14.x patch line: `v1.14.0` (P0) → `v1.14.5` (P5
-final = milestone release).
+Tags run on the v1.15.x minor line: `v1.15.0` (P0) → `v1.15.4` (P5
+final = milestone release). (G-104 binding: Major milestones tag on
+their own minor line, not the previous minor's patch line.)
 
 **In scope (v1.15):**
 - Prose/decks/mermaid/pyproject/release-title rebrand (P1).
@@ -954,7 +955,7 @@ final = milestone release).
 - Git branch/tag naming — no brand name present.
 
 **Milestone type:** Major (breaking). **Ship tag:** final phase patch
-on the v1.14.x line IS the release.
+on the v1.15.x minor line IS the release (`v1.15.4`).
 
 ## Milestone v1.15 Phases
 
diff --git a/.ciagent/REQUIREMENTS.md b/.ciagent/REQUIREMENTS.md
index 124e18e..92c99df 100644
--- a/.ciagent/REQUIREMENTS.md
+++ b/.ciagent/REQUIREMENTS.md
@@ -720,8 +720,11 @@ in a 20-phase sweep.
 
 **Milestone type:** Major (breaking — consumer-facing path, env var
 prefixes, SSM path, AWS tag keys, and AWS resource names all change).
-Tags run on the v1.14.x patch line: `v1.14.0` (P0) →
-`v1.14.1..v1.14.4` (P1–P4) → `v1.14.5` (P5 final = milestone release).
+Per the branch-strategy precedent (breaking/feature milestones tag on
+their OWN minor line), v1.15 tags run on the **v1.15.x minor line**:
+`v1.15.0` (P0) → `v1.15.1..v1.15.4` (P1–P4) → `v1.15.4` (P5 final =
+milestone release). (G-104 binding: the v1.14.x patch line is the NFR
+convention; a Major milestone ships on its own minor.)
 
 A full rebrand from **ACDL** / "Agentic Cloud Delivery Platform" →
 **Nova** / "The New Dawn of DevSecOps — security as a seamless enabler
diff --git a/.ciagent/ROADMAP.md b/.ciagent/ROADMAP.md
index de8fc1b..b285fae 100644
--- a/.ciagent/ROADMAP.md
+++ b/.ciagent/ROADMAP.md
@@ -1435,7 +1435,7 @@ After Phase P21: milestone COMPLETE — `v1.13.24` IS the v1.14 release.
 
 ---
 
-## v1.15 (active — Nova Rebrand, tag `v1.14.5`)
+## v1.15 (active — Nova Rebrand, tag `v1.15.4`)
 
 A full rebrand from **ACDL** / "Agentic Cloud Delivery Platform" →
 **Nova** / "The New Dawn of DevSecOps — security as a seamless enabler
@@ -1449,8 +1449,10 @@ declare intent" framing; the S&P Global Energy visual theme
 
 **Milestone type:** Major (breaking — consumer-facing path, env var
 prefixes, SSM path, AWS tag keys, and AWS resource names all change).
-Tags run on the v1.14.x patch line: `v1.14.0` (P0) →
-`v1.14.1..v1.14.4` (P1–P4) → `v1.14.5` (P5 final = milestone release).
+Per the branch-strategy precedent (breaking/feature milestones tag on
+their OWN minor line), v1.15 tags run on the **v1.15.x minor line**:
+`v1.15.0` (P0) → `v1.15.1..v1.15.4` (P1–P4) → `v1.15.4` (P5 final =
+milestone release). (G-104 binding.)
 
 **Brand mapping:**
 - Name: `ACDL` / `Agentic Cloud Delivery Platform` → `Nova`
@@ -1625,6 +1627,6 @@ Tags run on the v1.14.x patch line: `v1.14.0` (P0) →
   - Review: 0 new P0; all P1+ flagged or auto-fixed.
   - Audit: clean; reconstruction test passes.
   - Dual-read fallback removed; `nova_tagging.py` hard-fails `acdl:*`.
-  - Tag `v1.14.5` created; milestone merged to main.
+  - Tag `v1.15.4` created; milestone merged to main.
 
-After Phase P5: milestone COMPLETE — `v1.14.5` IS the v1.15 release.
+After Phase P5: milestone COMPLETE — `v1.15.4` IS the v1.15 release.