diff --git a/.ciagent/ARCHITECTURE.md b/.ciagent/ARCHITECTURE.md index a990c6d..7bf0aef 100644 --- a/.ciagent/ARCHITECTURE.md +++ b/.ciagent/ARCHITECTURE.md @@ -1,8 +1,8 @@ -# ACDL — Architecture (v1.1 target) +# Nova — Architecture (v1.1 target) -> Target architecture for the real Agentic Cloud Delivery Platform. -> Source of truth for **how**: `docs/architecture.md` (v0.2) is the upstream -> draft; this file is the ACDL-repo operating copy, refined at phase +> Target architecture for the real Agentic Cloud Delivery Platform (rebranded +> Nova in v1.15). Source of truth for **how**: `docs/architecture.md` (v0.2) is the upstream +> draft; this file is the Nova-repo operating copy, refined at phase > boundaries. Where this file and `docs/vision.md` conflict, the vision wins. ## Status @@ -598,10 +598,11 @@ VPC; the microservice composition references it via `terraform_remote_state` (data source). State keys are deterministic and env-aware (`spike/{contract.id}/{contract.environment}/terraform.tfstate`). -**ACDL_LIFECYCLE_MODE (v1.12, REQ-134).** The lifecycle pipeline defaults +**NOVA_LIFECYCLE_MODE (v1.12, REQ-134; renamed ACDL→NOVA in v1.15 P2).** The lifecycle pipeline defaults to plan-only (fast, no AWS mutation, no cost). A CI variable -`ACDL_LIFECYCLE_MODE` (default `plan`) overrides to `full` for the real -apply→modify→destroy. +`NOVA_LIFECYCLE_MODE` (default `plan`) overrides to `full` for the real +apply→modify→destroy. (P2–P4 dual-read fallback to `ACDL_LIFECYCLE_MODE`; +fallback removed in P5 per the v1.15 addendum.) ## v1.12 Addendum — Presentation Refinement + CAP-013 Fix diff --git a/.ciagent/ROADMAP.md b/.ciagent/ROADMAP.md index b285fae..010363e 100644 --- a/.ciagent/ROADMAP.md +++ b/.ciagent/ROADMAP.md @@ -1504,7 +1504,7 @@ milestone release). (G-104 binding.) announcing the `.acdl/`→`.nova/` path, `ACDL_*`→`NOVA_*` env vars, `/acdl/`→`/nova/` SSM path, `acdl:*`→`nova:*` tag keys, and `acdl-*`→`nova-*` AWS resource names changes coming in P2–P4. -- **Status:** pending +- **Status:** complete (v1.15.1) - **Depends on:** — - **Requirements:** REQ-155, REQ-156, REQ-157 - **Success Criteria:** @@ -1536,7 +1536,7 @@ milestone release). (G-104 binding.) contract resolver, deploy workflow checkout path, consumer docs, and the contract schema description. Rotate Gitea repo secrets via API (rename keys `ACDL_*` → `NOVA_*`, values stay). -- **Status:** pending +- **Status:** complete (v1.15.2) - **Depends on:** [P1] - **Requirements:** REQ-158, REQ-159, REQ-160 - **Success Criteria:** @@ -1564,7 +1564,7 @@ milestone release). (G-104 binding.) to match `nova:*`, update `nova_tagging.py` to enforce `nova:*` (hard, no warn), then remove `acdl:*` tags once consumers are verified. Terraform tagging updated to emit `nova:*`. -- **Status:** pending +- **Status:** complete (v1.15.3) - **Depends on:** [P2] - **Requirements:** REQ-161, REQ-162 - **Success Criteria:** @@ -1596,7 +1596,7 @@ milestone release). (G-104 binding.) passes; live apply/modify/destroy is exercised by the modules-lifecycle workflow when `ACDL_LIFECYCLE_MODE` (now `NOVA_LIFECYCLE_MODE`) is set to full. -- **Status:** pending +- **Status:** complete (v1.15.4) - **Depends on:** [P3] - **Requirements:** REQ-163 - **Success Criteria:** @@ -1620,7 +1620,7 @@ milestone release). (G-104 binding.) update REQUIREMENTS.md (REQ-155..164 marked complete), ROADMAP.md (v1.15 complete), PROJECT.md. Tag final patch `v1.14.5` (IS the milestone release). Merge `milestone/v1.15-nova` → `main`. -- **Status:** pending +- **Status:** in progress (branch `phase/05-final-review-ship`) - **Depends on:** [P1-P4] - **Requirements:** REQ-164 - **Success Criteria:** diff --git a/README.md b/README.md index 8fe0bf4..2990cd4 100644 --- a/README.md +++ b/README.md @@ -28,7 +28,7 @@ There are two kinds of repository in the Nova model: A **consumer never clones it.** - **Consumer repo (yours).** A consumer repo contains only: 1. **Its application code** — the service or site being deployed. - 2. **One or more contracts** — small YAML files at `.acdl/contract.yml` + 2. **One or more contracts** — small YAML files at `.nova/contract.yml` that declare infrastructure (one or more modules by name + version), select an environment, and supply module-specific inputs. 3. **One or more CI definitions** — thin `.github/workflows/*.yml` files @@ -144,7 +144,7 @@ engine-specific code. `modules/`, `schemas/`, `contracts/`, ```bash # 1. Bootstrap the AWS state backend + runner IAM user (one-time, idempotent) # (requires the bootstrap root key in env — skip if the state bucket + -# acdl-spike-runner already exist) +# nova-spike-runner already exist) ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID=... ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY=... \ python3 terraform/bootstrap/create_state_backend.py ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID=... ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY=... \ @@ -285,8 +285,8 @@ no static credentials in repo secrets. `repo:org/consumer-repo:ref:refs/heads/main`) binds the role's trust policy to the exact consumer repo + branch that invoked the workflow. - **Resource-creation attributes** — every resource the pipeline creates - is tagged with `acdl:owner=` and - `acdl:contract=`. The session policy grants + is tagged with `nova:owner=` and + `nova:contract=`. The session policy grants view/update/delete **only on resources whose tags match the calling repo**. diff --git a/docs/NOVA_MIGRATION.md b/docs/NOVA_MIGRATION.md index ef9c586..5995f4a 100644 --- a/docs/NOVA_MIGRATION.md +++ b/docs/NOVA_MIGRATION.md @@ -1,16 +1,17 @@ # Nova Migration Guide — What Consumers Must Know -> **Nova** is the new product brand for the platform formerly known as -> **ACDL** (Agentic Cloud Delivery Platform). This guide announces the -> scheduled breaking changes coming in the rebrand rollout (Phases P2–P4) -> and tells you exactly what to do, when, and how long you have. +> **STATUS: COMPLETE (milestone v1.15.4, 2026-07-30).** The Nova rebrand +> is fully rolled out. The dual-read / parallel-write grace period has +> ended (P5 cutoff passed). All `ACDL_*` env var fallbacks, `.acdl/` +> consumer-path fallbacks, `/acdl/` SSM-path fallbacks, `acdl:*` tag-key +> fallbacks, and `acdl-*` AWS resource names are removed. Consumers must +> use the `NOVA_*` / `.nova/` / `/nova/` / `nova:*` / `nova-*` names +> exclusively. If you have not yet migrated, follow the steps below. -The product is being rebranded **A C D L → Nova**. The rebrand is staged -across phases so that **no consumer deployment breaks during the -transition**. Phases P2–P4 ship the breaking changes behind a **dual-read -/ parallel-write grace period**; Phase P5 removes the fallback and the old -names stop working. This document is the consumer-facing contract for that -rollout. +> **Nova** is the new product brand for the platform formerly known as +> **ACDL** (Agentic Cloud Delivery Platform). This guide documents the +> breaking changes from the rebrand rollout (Phases P2–P4, cutoff P5) +> and tells you exactly what to do. ## What is NOT changing diff --git a/docs/consumer-guide.md b/docs/consumer-guide.md index 5665cbe..d52ce36 100644 --- a/docs/consumer-guide.md +++ b/docs/consumer-guide.md @@ -345,7 +345,7 @@ process is a 2-step pipeline with **HITL SRE gates** to prevent accidental destruction: 1. **Request a change request (CR):** Contact the platform team to create a - change request in the platform CMDB (DynamoDB `acdl-change-requests` + change request in the platform CMDB (DynamoDB `nova-change-requests` table). The CR must be approved before decommission can proceed. The CR includes the consumer repo, contract ID, and the reason for decommission. @@ -467,7 +467,7 @@ duties check blocks a prod promotion when `approver_qa == approver_prod` | `${env.environment}` | the environment name (dev/qa/prod/dr) | `qa` | | `${env.region}` | the environment's AWS region | `us-east-1` | | `${env.account_id}` | the environment's AWS account id | `123456789012` | -| `${env.state_backend.bucket}` | the environment's state bucket | `acdl-qa-state` | +| `${env.state_backend.bucket}` | the environment's state bucket | `nova-qa-state` | | `${env.network.vpc_cidr}` | the environment's VPC CIDR | `10.1.0.0/16` | | `${contract.id}` | the contract's operational acronym | `assets` | | `${contract.environment}` | the contract's environment field | `qa` | diff --git a/docs/environments/index.md b/docs/environments/index.md index adc131d..0cb9a0f 100644 --- a/docs/environments/index.md +++ b/docs/environments/index.md @@ -56,13 +56,13 @@ threshold. Staging does not exist. ## Cross-account contract ingestion grant (D-051) Onboarding now also grants the consumer repo's deploy role permission to -invoke the **platform Lambda** — `acdl-contract-ingestor` — across +invoke the **platform Lambda** — `nova-contract-ingestor` — across accounts. The Lambda is invoked via a Function URL with IAM auth, so the grant is an inline IAM policy applied to the consumer's deploy role. The policy template lives at [`terraform/platform/consumer_invoke_policy.json`](https://github.com/nova/nova/blob/main/terraform/platform/consumer_invoke_policy.json) and is scoped via **ABAC**: the condition -`aws:PrincipalTag/acdl:owner == ${consumerRepo}` ensures a repo can only +`aws:PrincipalTag/nova:owner == ${consumerRepo}` ensures a repo can only invoke the Lambda when its principal tag matches its claimed identity. The consumer's deploy workflow signs the Function URL request with @@ -75,7 +75,7 @@ is used for two purposes: 1. **Contract ingestion** — the consumer submits its resolved deployment contract (`action: "submit_contract"`) so the platform has a durable - record in the `acdl-contracts` DynamoDB table (PK `consumerRepo`, SK + record in the `nova-contracts` DynamoDB table (PK `consumerRepo`, SK `contractId#submittedAt`). 2. **Error reporting** (D-055) — the consumer reports a deployment error (`action: "report_error"`) which the platform turns into a GitHub diff --git a/docs/presentations/how-the-platform-works-marp.md b/docs/presentations/how-the-platform-works-marp.md index f6b3dfc..5c0d2a0 100644 --- a/docs/presentations/how-the-platform-works-marp.md +++ b/docs/presentations/how-the-platform-works-marp.md @@ -310,7 +310,7 @@ Nova runs at **zero cloud cost** for day-to-day development. AWS spend was measu - **S3 dominates** (98.8%, terraform state bucket) — no compute ran because v1.0→v1.10 was plan-only for IAM-gated capabilities - **Local emulators are the primary tier** — the full pipeline runs in-process, no AWS credentials -- **Live-AWS verification is milestone-scoped, then torn down.** The pipeline now **defaults to plan-only** on every PR; `ACDL_LIFECYCLE_MODE=full` overrides to apply→destroy for milestone verification (REQ-134, v1.12). +- **Live-AWS verification is milestone-scoped, then torn down.** The pipeline now **defaults to plan-only** on every PR; `NOVA_LIFECYCLE_MODE=full` overrides to apply→destroy for milestone verification (REQ-134, v1.12). - **Cost drivers** are spike-scoped: Terraform plan reads (free), S3 state storage (cents), DynamoDB outbox (cents). Any spike > $1/day is an anomaly. **Pre-mortem (`PRE_MORTEM.md`):** the v1.10 decay incident (diff-scoped VERIFY missed 7 adapter defects) is the root pattern: *a claim outruns the verification that backs it.* Four forward failure modes + structural mitigations (regression-tested IAM baseline, mandatory teardown, verified-only deck claims, honest scope). @@ -329,6 +329,6 @@ section { font-size: 20px; } Two architectural pillars make "Verified" a structural property, not a claim: - **The stateless adapter (918 → ~80 lines).** The Terraform adapter was a 918-line monolith with 3 constant tables and 39 type-specific branches. It is now a ~80-line **stateless assembler**: it owns no module content — no resource shape, no nested HCL blocks, no defaults. Each L1 module ships a real `terraform/` module dir owning its shape, nested blocks, and defaults. The adapter reads the registry and emits `module "x" { source = ... }` blocks. A new module is a new terraform dir, not a code change. *(The v1.12 P67 fix closed a dedup defect for multi-resource L1s — ecs-service, alb; CAP-013 now Verified.)* -- **Pipeline-driven lifecycle testing.** A `modules-lifecycle` pipeline matrix-runs each L1 and L2 module's `examples/{simple,complex}.yml` contracts through apply→modify→destroy against live AWS. **The "test" = the pipeline cell going green.** Defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); `ACDL_LIFECYCLE_MODE=full` overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — **22/22 Verified** as of v1.12. +- **Pipeline-driven lifecycle testing.** A `modules-lifecycle` pipeline matrix-runs each L1 and L2 module's `examples/{simple,complex}.yml` contracts through apply→modify→destroy against live AWS. **The "test" = the pipeline cell going green.** Defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); `NOVA_LIFECYCLE_MODE=full` overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — **22/22 Verified** as of v1.12. The v1.10 lesson is the negative space: a 918-line adapter with type-specific branches decayed silently. The ~80-line stateless adapter + the milestone regression gate are the structural fix. \ No newline at end of file diff --git a/docs/presentations/how-the-platform-works-talking-points.md b/docs/presentations/how-the-platform-works-talking-points.md index e7b85b9..d66060b 100644 --- a/docs/presentations/how-the-platform-works-talking-points.md +++ b/docs/presentations/how-the-platform-works-talking-points.md @@ -182,7 +182,7 @@ **Talking points:** - The phrase to land is "secure by default, not secure by effort" - The selling point is *normalization* — we can add a new security tool without changing the confidence model or the evidence stream -- For the Head of Security: tagging standards are enforced, not advisory — a missing `acdl:owner` tag fails the check, not a warning +- For the Head of Security: tagging standards are enforced, not advisory — a missing `nova:owner` tag fails the check, not a warning - The decommission flow is the counter-argument to "deletion protection makes cleanup impossible" — it's a deliberate, gated, two-approval path **Key takeaway:** Secure by default, not secure by effort. Checks run before infra is created. @@ -207,7 +207,7 @@ - Close on honesty — the platform delivers real, verifiable value today: 22/22 auto-verifiable capabilities Verified via the v1.11 lifecycle pipeline - The roadmap is concrete, not aspirational hand-waving — 9 planned items, each with a defined milestone and a clear reason it isn't shipped yet (usually an upstream dependency, not an engineering gap) - Emphasize: 0 consumer adoption today — "Testing" means it works internally and is dev pilot-ready, not that it's released -- The lifecycle pipeline defaults to plan-only on every PR; `ACDL_LIFECYCLE_MODE=full` overrides for milestone verification +- The lifecycle pipeline defaults to plan-only on every PR; `NOVA_LIFECYCLE_MODE=full` overrides for milestone verification **Key takeaway:** 22/22 Verified today. 9 planned, each with a clear milestone and reason. diff --git a/docs/presentations/how-the-platform-works.html b/docs/presentations/how-the-platform-works.html index 4535009..3a8a8f4 100644 --- a/docs/presentations/how-the-platform-works.html +++ b/docs/presentations/how-the-platform-works.html @@ -1035,7 +1035,7 @@ img { display: block; margin: 0 auto; max-height: 300px; }
  • S3 dominates (98.8%, terraform state bucket) — no compute ran because v1.0→v1.10 was plan-only for IAM-gated capabilities
  • Local emulators are the primary tier — the full pipeline runs in-process, no AWS credentials
    • -
  • Live-AWS verification is milestone-scoped, then torn down. The pipeline now defaults to plan-only on every PR; ACDL_LIFECYCLE_MODE=full overrides to apply→destroy for milestone verification (REQ-134, v1.12).
    • +
  • Live-AWS verification is milestone-scoped, then torn down. The pipeline now defaults to plan-only on every PR; NOVA_LIFECYCLE_MODE=full overrides to apply→destroy for milestone verification (REQ-134, v1.12).
  • Cost drivers are spike-scoped: Terraform plan reads (free), S3 state storage (cents), DynamoDB outbox (cents). Any spike > $1/day is an anomaly.

Pre-mortem (PRE_MORTEM.md): the v1.10 decay incident (diff-scoped VERIFY missed 7 adapter defects) is the root pattern: a claim outruns the verification that backs it. Four forward failure modes + structural mitigations (regression-tested IAM baseline, mandatory teardown, verified-only deck claims, honest scope).

@@ -1085,7 +1085,7 @@ img { display: block; margin: 0 auto; max-height: 300px; }

Two architectural pillars make "Verified" a structural property, not a claim:

  • The stateless adapter (918 → ~80 lines). The Terraform adapter was a 918-line monolith with 3 constant tables and 39 type-specific branches. It is now a ~80-line stateless assembler: it owns no module content — no resource shape, no nested HCL blocks, no defaults. Each L1 module ships a real terraform/ module dir owning its shape, nested blocks, and defaults. The adapter reads the registry and emits module "x" { source = ... } blocks. A new module is a new terraform dir, not a code change. (The v1.12 P67 fix closed a dedup defect for multi-resource L1s — ecs-service, alb; CAP-013 now Verified.)
    • -
  • Pipeline-driven lifecycle testing. A modules-lifecycle pipeline matrix-runs each L1 and L2 module's examples/{simple,complex}.yml contracts through apply→modify→destroy against live AWS. The "test" = the pipeline cell going green. Defaults to plan-only on every PR (fast, no AWS mutation, no cost); ACDL_LIFECYCLE_MODE=full overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — 22/22 Verified as of v1.12.
    • +
  • Pipeline-driven lifecycle testing. A modules-lifecycle pipeline matrix-runs each L1 and L2 module's examples/{simple,complex}.yml contracts through apply→modify→destroy against live AWS. The "test" = the pipeline cell going green. Defaults to plan-only on every PR (fast, no AWS mutation, no cost); NOVA_LIFECYCLE_MODE=full overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — 22/22 Verified as of v1.12.

The v1.10 lesson is the negative space: a 918-line adapter with type-specific branches decayed silently. The ~80-line stateless adapter + the milestone regression gate are the structural fix.

Internal
diff --git a/docs/presentations/how-the-platform-works.md b/docs/presentations/how-the-platform-works.md index 48caab0..895695e 100644 --- a/docs/presentations/how-the-platform-works.md +++ b/docs/presentations/how-the-platform-works.md @@ -242,7 +242,7 @@ flowchart LR - **Authentication — OIDC federation.** Each job mints a short-lived token; no credential stored in the consumer repo or runner secret. Planned: all runners - **Authorization — attribute-based (ABAC), not role-based.** Two attribute classes scope every action: - **Repository identity** — trust policy binds to the exact consumer repo + branch. - - **Resource tags** — every resource tagged `acdl:owner` + `acdl:contract`; session policy grants access **only to matching tags.** + - **Resource tags** — every resource tagged `nova:owner` + `nova:contract`; session policy grants access **only to matching tags.** - **The effect:** a consumer can only touch the resources it created. One consumer can never affect another. > **Speaker notes:** This is the slide for the Head of Cloud/Security. The key phrase is "blast radius contained to the consumer's own stack." Contrast with the common failure mode of shared CI roles that can touch any account resource. The static-key override exists for edge cases but is rotated daily on platform runners; it is never the default. @@ -376,7 +376,7 @@ Monitoring is **a platform default, not a per-team project.** *(Testing.)* Security defaults that **do not require a team to opt in.** Checks run on **every** deployment, normalized to a single schema regardless of which engine produced them. *(Testing.)* -- **Infrastructure-as-code policy** (Checkov) — secrets in plaintext, public ingress, IAM wildcards, KMS key references, **required tagging standards** (`acdl:owner`, `acdl:contract`, `acdl:environment`, `acdl:cost-center`). All run *before* infra is created. +- **Infrastructure-as-code policy** (Checkov) — secrets in plaintext, public ingress, IAM wildcards, KMS key references, **required tagging standards** (`nova:owner`, `nova:contract`, `nova:environment`, `nova:cost-center`). All run *before* infra is created. - **Cloud security posture** (Wiz adapter) — translates cloud security findings into the same normalized record. *(Adapter testing; activates when a Wiz tenant is configured.)* - **Kubernetes-native policy** (Kyverno adapter) — ready for the GitOps reconciler roadmap item. *(Adapter testing; inactive for Terraform-only stacks.)* - **Encryption on every resource** — at-rest encryption is on by default for every primitive (S3, RDS, ECR, ECS, and more). *(Testing.)* @@ -385,7 +385,7 @@ Security defaults that **do not require a team to opt in.** Checks run on **ever - **Deletion protection on by default** — every resource has `prevent_destroy` on unless a consumer explicitly disables it via a documented feature flag. *(Testing.)* - **Safe decommission** — a 2-step pipeline (disable protection → zero counts → destroy) with **two SRE human-attestation gates** and a **change-request validated against the platform CMDB** before any destructive action. *(Testing.)* Encryption keys enter a grace window (default 30 days) so encrypted data remains recoverable during decommission. -> **Speaker notes:** The phrase to land is "secure by default, not secure by effort." The selling point is *normalization* — we can add a new security tool without changing the confidence model or the evidence stream. For the Head of Security: tagging standards are enforced, not advisory — a missing `acdl:owner` tag fails the check, not a warning. The decommission flow is the counter-argument to "deletion protection makes cleanup impossible" — it's a deliberate, gated, two-approval path, not a lock with no key. +> **Speaker notes:** The phrase to land is "secure by default, not secure by effort." The selling point is *normalization* — we can add a new security tool without changing the confidence model or the evidence stream. For the Head of Security: tagging standards are enforced, not advisory — a missing `nova:owner` tag fails the check, not a warning. The decommission flow is the counter-argument to "deletion protection makes cleanup impossible" — it's a deliberate, gated, two-approval path, not a lock with no key. --- @@ -434,7 +434,7 @@ A phased roadmap from the current Testing baseline to the full North Star: - Additional engine adapters (OpenTofu, Pulumi, Kubernetes CRDs). - Deeper observability bootstrap (dashboards, runbooks, on-call bindings). -> **Speaker notes:** Close on honesty. The platform delivers real, verifiable value today — 22/22 auto-verifiable capabilities are Verified via the v1.11 lifecycle pipeline (apply→modify→destroy against live AWS) + the D-091 regression gate. The roadmap is concrete, not aspirational hand-waving — 9 planned items, each with a defined milestone and a clear reason it isn't shipped yet (usually an upstream dependency, not an engineering gap). Emphasize: 0 consumer adoption today — "Testing" means it works internally and is dev pilot-ready, not that it's released. The lifecycle pipeline defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); a CI variable (`ACDL_LIFECYCLE_MODE=full`) overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). +> **Speaker notes:** Close on honesty. The platform delivers real, verifiable value today — 22/22 auto-verifiable capabilities are Verified via the v1.11 lifecycle pipeline (apply→modify→destroy against live AWS) + the D-091 regression gate. The roadmap is concrete, not aspirational hand-waving — 9 planned items, each with a defined milestone and a clear reason it isn't shipped yet (usually an upstream dependency, not an engineering gap). Emphasize: 0 consumer adoption today — "Testing" means it works internally and is dev pilot-ready, not that it's released. The lifecycle pipeline defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); a CI variable (`NOVA_LIFECYCLE_MODE=full`) overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). --- @@ -469,7 +469,7 @@ Nova runs at **zero cloud cost** for day-to-day development. The v1.0→v1.10 AW - **S3 dominates** (98.8%, terraform state bucket) — no compute (ECS/Lambda) ran because v1.0→v1.10 was plan-only for IAM-gated capabilities. - **Local emulators are the primary tier** — the full pipeline runs in-process, no AWS credentials, no Checkov, no DynamoDB. *(Testing.)* -- **Live-AWS verification is milestone-scoped, then torn down.** The v1.11 lifecycle pipeline ran apply→modify→destroy for every module, then tore down to zero-cost steady state (D-096 — teardown mandatory before milestone COMPLETE; no merge to main until `terraform show` confirms no resources). The lifecycle pipeline now **defaults to plan-only** on every PR (fast, no AWS mutation, no cost); a CI variable (`ACDL_LIFECYCLE_MODE=full`) overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). +- **Live-AWS verification is milestone-scoped, then torn down.** The v1.11 lifecycle pipeline ran apply→modify→destroy for every module, then tore down to zero-cost steady state (D-096 — teardown mandatory before milestone COMPLETE; no merge to main until `terraform show` confirms no resources). The lifecycle pipeline now **defaults to plan-only** on every PR (fast, no AWS mutation, no cost); a CI variable (`NOVA_LIFECYCLE_MODE=full`) overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). - **Cost drivers** are spike-scoped: Terraform plan reads (free), S3 state storage (cents), DynamoDB outbox (cents). Any cost spike > $1/day is an anomaly. **Pre-mortem (`PRE_MORTEM.md`):** the project's failure modes were pre-mortemed before the leadership pitch. The v1.10 decay incident (diff-scoped VERIFY missed 7 adapter defects across 8 NFR-patch phases — decks advertised capability that wasn't reproducible) is the root pattern: *a claim outruns the verification that backs it.* Four forward failure modes + structural mitigations: (FM-1) IAM-drift recurrence → IAM policy baseline is regression-tested; (FM-2) cost spike from un-torn-down stacks → D-096 mandatory teardown; (FM-3) deck overstates capability → verified-only claims + decks unfrozen only after re-verification; (FM-4) pilot contract gap → honest scope (microservice + static-assets today; the L2 pattern is extensible). All mitigations are structural, not procedural. @@ -483,6 +483,6 @@ Nova runs at **zero cloud cost** for day-to-day development. The v1.0→v1.10 AW v1.11 rebuilt the platform on two architectural pillars that make "Verified" a structural property, not a claim: - **The stateless adapter (REQ-123, 918 → ~80 lines).** The Terraform adapter was a 918-line monolith with 3 constant tables and 39 type-specific branches. It is now a ~80-line **stateless assembler**: it owns no module content — no resource shape, no nested HCL blocks, no defaults, no type-specific logic. Each L1 module ships a real `terraform/` module dir owning its resource shape, nested blocks, and defaults (centralized in `locals.tf`). The adapter reads the registry and emits `module "x" { source = ... }` blocks. No type-specific logic in the adapter means a new module is a new terraform dir, not a code change. *(The v1.12 P67 fix closed a dedup defect where multi-resource L1s — ecs-service, alb — produced invalid Terraform; CAP-013 now Verified.)* -- **Pipeline-driven lifecycle testing (REQ-127/128).** A `modules-lifecycle` pipeline matrix-runs each L1 and L2 module's `examples/{simple,complex}.yml` contracts through apply→modify→destroy against live AWS. No per-module Python. **The "test" = the pipeline cell going green.** Defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); `ACDL_LIFECYCLE_MODE=full` runs the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — 22/22 Verified as of v1.12. +- **Pipeline-driven lifecycle testing (REQ-127/128).** A `modules-lifecycle` pipeline matrix-runs each L1 and L2 module's `examples/{simple,complex}.yml` contracts through apply→modify→destroy against live AWS. No per-module Python. **The "test" = the pipeline cell going green.** Defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); `NOVA_LIFECYCLE_MODE=full` runs the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — 22/22 Verified as of v1.12. > **Speaker notes:** This is the deep-dive slide for the Head of Engineering / Architecture. The two pillars are the answer to "how do you keep the decks honest?" The adapter is simple enough to reason about (a stateless assembler), and the lifecycle pipeline is the automated verification that backs every "Testing" claim. The v1.10 lesson is the negative space: a 918-line adapter with type-specific branches decayed silently because the VERIFY gate was diff-scoped. The ~80-line stateless adapter + the milestone regression gate are the structural fix. The plan-only default (v1.12) means this verification runs on every PR at zero cost, with the full apply→destroy gated behind a CI variable override. \ No newline at end of file diff --git a/docs/presentations/the-developer-experience-marp.md b/docs/presentations/the-developer-experience-marp.md index 773293b..e02d550 100644 --- a/docs/presentations/the-developer-experience-marp.md +++ b/docs/presentations/the-developer-experience-marp.md @@ -297,7 +297,7 @@ Nova runs at **zero cloud cost** for day-to-day development. AWS spend was measu | Peak day | 2026-07-27 ($0.000867) | - **Local emulators are the primary tier** — the full pipeline runs in-process, no AWS credentials -- **Live-AWS verification is milestone-scoped, then torn down.** The pipeline now **defaults to plan-only** on every PR; `ACDL_LIFECYCLE_MODE=full` overrides to apply→destroy for milestone verification (REQ-134, v1.12). +- **Live-AWS verification is milestone-scoped, then torn down.** The pipeline now **defaults to plan-only** on every PR; `NOVA_LIFECYCLE_MODE=full` overrides to apply→destroy for milestone verification (REQ-134, v1.12). - **Cost drivers** are spike-scoped: Terraform plan reads (free), S3 state storage (cents), DynamoDB outbox (cents). No running infrastructure between milestones. **Pre-mortem (`PRE_MORTEM.md`):** the v1.10 decay incident (diff-scoped VERIFY missed 7 adapter defects) is the root pattern: *a claim outruns the verification that backs it.* Four forward failure modes + structural mitigations (regression-tested IAM baseline, mandatory teardown, verified-only deck claims, honest scope). @@ -316,6 +316,6 @@ section { font-size: 20px; } Two architectural pillars make "Verified" a structural property, not a claim: - **The stateless adapter (918 → ~80 lines).** The Terraform adapter was a 918-line monolith with 3 constant tables and 39 type-specific branches. It is now a ~80-line **stateless assembler**: it owns no module content — no resource shape, no nested HCL blocks, no defaults. Each L1 module ships a real `terraform/` module dir owning its shape, nested blocks, and defaults. The adapter reads the registry and emits `module "x" { source = ... }` blocks. A new module is a new terraform dir, not a code change. *(The v1.12 P67 fix closed a dedup defect for multi-resource L1s — ecs-service, alb; CAP-013 now Verified.)* -- **Pipeline-driven lifecycle testing.** A `modules-lifecycle` pipeline matrix-runs each L1 and L2 module's contracts through apply→modify→destroy against live AWS. **The "test" = the pipeline cell going green.** Defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); `ACDL_LIFECYCLE_MODE=full` overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — **22/22 Verified** as of v1.12. +- **Pipeline-driven lifecycle testing.** A `modules-lifecycle` pipeline matrix-runs each L1 and L2 module's contracts through apply→modify→destroy against live AWS. **The "test" = the pipeline cell going green.** Defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); `NOVA_LIFECYCLE_MODE=full` overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — **22/22 Verified** as of v1.12. The v1.10 lesson is the negative space: a 918-line adapter with type-specific branches decayed silently. The ~80-line stateless adapter + the milestone regression gate are the structural fix. \ No newline at end of file diff --git a/docs/presentations/the-developer-experience-talking-points.md b/docs/presentations/the-developer-experience-talking-points.md index d39cdce..b2f6079 100644 --- a/docs/presentations/the-developer-experience-talking-points.md +++ b/docs/presentations/the-developer-experience-talking-points.md @@ -232,7 +232,7 @@ **Talking points:** - The headline for the Head of Cloud / Finance: less than one cent over 8 days of active development; zero BAU cloud spend -- The lifecycle pipeline defaults to plan-only so the PR-time cost is zero; `ACDL_LIFECYCLE_MODE=full` overrides for milestone verification +- The lifecycle pipeline defaults to plan-only so the PR-time cost is zero; `NOVA_LIFECYCLE_MODE=full` overrides for milestone verification - The pre-mortem is the credibility slide — we already asked "how does this fail?" and the mitigations are structural - The v1.10 decay incident is disclosed honestly, not hidden — that disclosure IS the mitigation - Cost drivers are spike-scoped: Terraform plan reads (free), S3 state storage (cents), DynamoDB outbox (cents). No running infrastructure between milestones diff --git a/docs/presentations/the-developer-experience.html b/docs/presentations/the-developer-experience.html index f52dc9d..1d6de8d 100644 --- a/docs/presentations/the-developer-experience.html +++ b/docs/presentations/the-developer-experience.html @@ -1057,7 +1057,7 @@ img { display: block; margin: 0 auto; max-height: 280px; }
  • Local emulators are the primary tier — the full pipeline runs in-process, no AWS credentials
    • -
  • Live-AWS verification is milestone-scoped, then torn down. The pipeline now defaults to plan-only on every PR; ACDL_LIFECYCLE_MODE=full overrides to apply→destroy for milestone verification (REQ-134, v1.12).
    • +
  • Live-AWS verification is milestone-scoped, then torn down. The pipeline now defaults to plan-only on every PR; NOVA_LIFECYCLE_MODE=full overrides to apply→destroy for milestone verification (REQ-134, v1.12).
  • Cost drivers are spike-scoped: Terraform plan reads (free), S3 state storage (cents), DynamoDB outbox (cents). No running infrastructure between milestones.

Pre-mortem (PRE_MORTEM.md): the v1.10 decay incident (diff-scoped VERIFY missed 7 adapter defects) is the root pattern: a claim outruns the verification that backs it. Four forward failure modes + structural mitigations (regression-tested IAM baseline, mandatory teardown, verified-only deck claims, honest scope).

@@ -1111,7 +1111,7 @@ img { display: block; margin: 0 auto; max-height: 280px; }

Two architectural pillars make "Verified" a structural property, not a claim:

  • The stateless adapter (918 → ~80 lines). The Terraform adapter was a 918-line monolith with 3 constant tables and 39 type-specific branches. It is now a ~80-line stateless assembler: it owns no module content — no resource shape, no nested HCL blocks, no defaults. Each L1 module ships a real terraform/ module dir owning its shape, nested blocks, and defaults. The adapter reads the registry and emits module "x" { source = ... } blocks. A new module is a new terraform dir, not a code change. (The v1.12 P67 fix closed a dedup defect for multi-resource L1s — ecs-service, alb; CAP-013 now Verified.)
    • -
  • Pipeline-driven lifecycle testing. A modules-lifecycle pipeline matrix-runs each L1 and L2 module's contracts through apply→modify→destroy against live AWS. The "test" = the pipeline cell going green. Defaults to plan-only on every PR (fast, no AWS mutation, no cost); ACDL_LIFECYCLE_MODE=full overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — 22/22 Verified as of v1.12.
    • +
  • Pipeline-driven lifecycle testing. A modules-lifecycle pipeline matrix-runs each L1 and L2 module's contracts through apply→modify→destroy against live AWS. The "test" = the pipeline cell going green. Defaults to plan-only on every PR (fast, no AWS mutation, no cost); NOVA_LIFECYCLE_MODE=full overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — 22/22 Verified as of v1.12.

The v1.10 lesson is the negative space: a 918-line adapter with type-specific branches decayed silently. The ~80-line stateless adapter + the milestone regression gate are the structural fix.

diff --git a/docs/presentations/the-developer-experience.md b/docs/presentations/the-developer-experience.md index 4f2094a..19bc40e 100644 --- a/docs/presentations/the-developer-experience.md +++ b/docs/presentations/the-developer-experience.md @@ -438,7 +438,7 @@ Nova runs at **zero cloud cost** for day-to-day development. The v1.0→v1.10 AW | Peak day | 2026-07-27 ($0.000867 — v1.10 regression + verify run) | - **Local emulators are the primary tier** — the full pipeline runs in-process, no AWS credentials, no Checkov, no DynamoDB. -- **Live-AWS verification is milestone-scoped, then torn down.** The v1.11 lifecycle pipeline ran apply→modify→destroy for every module, then tore down to zero-cost steady state (D-096 — teardown mandatory before milestone COMPLETE). The lifecycle pipeline now **defaults to plan-only** on every PR (fast, no AWS mutation, no cost); a CI variable (`ACDL_LIFECYCLE_MODE=full`) overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). +- **Live-AWS verification is milestone-scoped, then torn down.** The v1.11 lifecycle pipeline ran apply→modify→destroy for every module, then tore down to zero-cost steady state (D-096 — teardown mandatory before milestone COMPLETE). The lifecycle pipeline now **defaults to plan-only** on every PR (fast, no AWS mutation, no cost); a CI variable (`NOVA_LIFECYCLE_MODE=full`) overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). - **Cost drivers** are spike-scoped: Terraform plan reads (free), S3 state storage (cents), DynamoDB outbox (cents). No running infrastructure between milestones. **Pre-mortem (`PRE_MORTEM.md`):** the project's failure modes were pre-mortemed before the leadership pitch. The v1.10 decay incident (diff-scoped VERIFY missed 7 adapter defects — decks advertised capability that wasn't reproducible) is the root pattern: *a claim outruns the verification that backs it.* Four forward failure modes + structural mitigations (regression-tested IAM baseline, mandatory teardown, verified-only deck claims, honest scope). @@ -452,6 +452,6 @@ Nova runs at **zero cloud cost** for day-to-day development. The v1.0→v1.10 AW v1.11 rebuilt the platform on two architectural pillars that make "Verified" a structural property, not a claim: - **The stateless adapter (918 → ~80 lines).** The Terraform adapter was a 918-line monolith with 3 constant tables and 39 type-specific branches. It is now a ~80-line **stateless assembler**: it owns no module content. Each L1 module ships a real `terraform/` module dir owning its resource shape, nested blocks, and defaults. A new module is a new terraform dir, not a code change. *(The v1.12 P67 fix closed a dedup defect for multi-resource L1s — ecs-service, alb; CAP-013 now Verified.)* -- **Pipeline-driven lifecycle testing.** A `modules-lifecycle` pipeline matrix-runs each L1 and L2 module's contracts through apply→modify→destroy against live AWS. **The "test" = the pipeline cell going green.** Defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); `ACDL_LIFECYCLE_MODE=full` runs the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — 22/22 Verified as of v1.12. +- **Pipeline-driven lifecycle testing.** A `modules-lifecycle` pipeline matrix-runs each L1 and L2 module's contracts through apply→modify→destroy against live AWS. **The "test" = the pipeline cell going green.** Defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); `NOVA_LIFECYCLE_MODE=full` runs the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — 22/22 Verified as of v1.12. > **Speaker notes:** This is the deep-dive slide for the Head of Engineering / Architecture. The two pillars answer "how do you keep the decks honest?" The adapter is simple enough to reason about (a stateless assembler); the lifecycle pipeline is the automated verification that backs every "Testing" claim. The v1.10 lesson is the negative space: a 918-line adapter with type-specific branches decayed silently. The ~80-line stateless adapter + the milestone regression gate are the structural fix. The plan-only default (v1.12) means verification runs on every PR at zero cost, with the full apply→destroy gated behind a CI variable override. \ No newline at end of file diff --git a/pipelines/modules-lifecycle.yml b/pipelines/modules-lifecycle.yml index aece786..51fd1d1 100644 --- a/pipelines/modules-lifecycle.yml +++ b/pipelines/modules-lifecycle.yml @@ -13,7 +13,7 @@ name: acdl-modules-lifecycle # # Lifecycle mode (REQ-134, v1.12): `default_mode: plan` — the lifecycle # scripts run `run_platform.sh --plan-only` (fast, no AWS mutation, no -# AWS credentials, no cost) on every PR. Set the ACDL_LIFECYCLE_MODE CI +# AWS credentials, no cost) on every PR. Set the NOVA_LIFECYCLE_MODE CI # variable (workflow_dispatch input `lifecycle_mode`) to `full` for the # real apply→modify→destroy against live AWS. The CI VPC apply/destroy # jobs are skipped in plan mode (nothing is applied). @@ -36,7 +36,7 @@ terraform_version: "1.9.*" # Default lifecycle mode: "plan" (plan-only, fast, no AWS mutation) or "full" # (real apply→modify→destroy against live AWS). Overridable via the -# ACDL_LIFECYCLE_MODE CI variable / workflow_dispatch input. +# NOVA_LIFECYCLE_MODE CI variable / workflow_dispatch input. default_mode: plan stages: