docs(milestone): complete v1.15 — Nova Rebrand (tag v1.15.4)

P5 final-review-ship complete: dual-read fallback removed (REQ-164) —
core/env.py NOVA-only, .env.secrets load paths NOVA-only (G-106 retired),
nova_tagging.py hard-fails any acdl:* tag, legacy ACDL_* Gitea secrets
deleted, ACDL_LIFECYCLE_MODE/ACDL_LOCAL_TIER/ACDL_HITL_* exports removed
from scripts, SNS subject → Nova SoD halt (P1-2), bootstrap scripts
NOVA-only. Review: 2 P0 auto-fixed (duplicate delenv), P1-1/P1-2 resolved,
doc-drift fixed. Audit: tags v1.15.0-4 exist; traceability REQ-155..164
all complete; ARCHITECTURE naming table matches codebase. 615 pytest PASS;
run_ci.sh 3-stage PASS. NOVA_MIGRATION.md marked COMPLETE.

---ci---
project: acdl
phase: 5
milestone: v1.15
status: complete
phase_role: final
requirements:
  covered: [REQ-155, REQ-156, REQ-157, REQ-158, REQ-159, REQ-160, REQ-161, REQ-162, REQ-163, REQ-164]
  partial: []
---/ci---

adapters/terraform/policy/custom_rules/nova_tagging.py

@@ -39,12 +39,11 @@ NON_TAGGABLE_TYPES = (
     "aws_internet_gateway",
 )
 
-# P3 hard mode (D-109): hard-fail when a taggable resource is missing any
-# required nova:* tag, or when a resource carries only legacy acdl:* tag
-# keys and no nova:* tags. P2 shipped warn mode (`_WARN_MODE = True`); P3
-# flips to `False` (hard-fail) once terraform emits nova:* and the ABAC
-# policy is swapped to nova:*. P5 keeps hard mode and additionally fails
-# on any acdl:* tag key present at all.
+# P5 hard mode (D-109, REQ-164): `_WARN_MODE = False` (set in P3) AND
+# any `acdl:*` tag key present at all is a hard FAIL (P5 tightens from
+# P3's "acdl:*-only fails" to "any acdl:* key fails"). The legacy tag
+# keys are fully removed from terraform (P3); any remaining `acdl:*` key
+# is a rebrand regression.
 _WARN_MODE = False
 
 
@@ -71,21 +70,13 @@ class NovaTaggingStandard(BaseResourceCheck):
                 tag_keys = set(tag_block.keys())
         elif isinstance(tags, dict):
             tag_keys = set(tags.keys())
+        # P5 (REQ-164): any legacy acdl:* tag key present = hard FAIL.
+        legacy_present = tag_keys & set(LEGACY_TAGS)
+        if legacy_present:
+            return CheckResult.FAILED
         missing = [t for t in REQUIRED_TAGS if t not in tag_keys]
         if not missing:
             return CheckResult.PASSED
-        # Warn mode (D-109, P2): if the resource carries the legacy acdl:*
-        # tag keys for every required tag, emit a warning rather than a
-        # hard fail — existing resources still carry acdl:* until P3.
-        if _WARN_MODE:
-            has_all_legacy = all(t in tag_keys for t in LEGACY_TAGS)
-            if has_all_legacy:
-                sys.stderr.write(
-                    f"[nova_tagging] WARN: {entity_type} has legacy acdl:* tags "
-                    f"but no nova:* tags (P2 warn mode, D-109). Migrate to "
-                    f"nova:* tags before P5.\n"
-                )
-                return CheckResult.PASSED
         return CheckResult.FAILED
 
 check = NovaTaggingStandard()