chore(bootstrap): migrate ACDL_* env vars to NOVA_* (complete the v1.15 P5 rename)

terraform/bootstrap/apply_iam_baseline.py

@@ -5,15 +5,15 @@ policy if absent (or creates a new version if the policy document
 differs), attaches it to the spike-runner user, deletes any leftover
 inline policy, and re-creates the OIDC act_runner role if absent.
 
-Requires the bootstrap root key (ACDL_BOOTSTRAP_AWS_* or ACDL_AWS_*
+Requires the bootstrap root key (NOVA_BOOTSTRAP_AWS_* or NOVA_AWS_*
 when the provided key is a root principal). This script is the
 reproducible record of the Phase 56 live step — the grants are
 documented in .ciagent/IAM_POLICY.md and regression-tested by
 tests/test_iam_policy_baseline.py.
 
 Usage:
-    export ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID=<root key id>
-    export ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY=<root key secret>
+    export NOVA_BOOTSTRAP_AWS_ACCESS_KEY_ID=<root key id>
+    export NOVA_BOOTSTRAP_AWS_SECRET_ACCESS_KEY=<root key secret>
     export AWS_DEFAULT_REGION=us-east-1
     python3 terraform/bootstrap/apply_iam_baseline.py
 """
@@ -30,7 +30,7 @@ import boto3
 
 ROOT = Path(__file__).resolve().parent.parent.parent
 POLICY_PATH = ROOT / "terraform" / "bootstrap" / "spike_runner_policy.json"
-ACCOUNT = os.environ.get("ACDL_AWS_ACCOUNT_ID", "581513795199")
+ACCOUNT = os.environ.get("NOVA_AWS_ACCOUNT_ID", "581513795199")
 USER = "nova-spike-runner"
 POLICY_NAME = "nova-spike-runner-policy"
 POLICY_ARN = f"arn:aws:iam::{ACCOUNT}:policy/{POLICY_NAME}"
@@ -38,10 +38,10 @@ ROLE_NAME = "nova-act-runner-role"
 
 
 def _session():
-    key_id = os.environ.get("ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID") or os.environ.get("ACDL_AWS_ACCESS_KEY_ID")
-    secret = os.environ.get("ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY") or os.environ.get("ACDL_AWS_SECRET_ACCESS_KEY")
+    key_id = os.environ.get("NOVA_BOOTSTRAP_AWS_ACCESS_KEY_ID") or os.environ.get("NOVA_AWS_ACCESS_KEY_ID")
+    secret = os.environ.get("NOVA_BOOTSTRAP_AWS_SECRET_ACCESS_KEY") or os.environ.get("NOVA_AWS_SECRET_ACCESS_KEY")
     if not key_id or not secret:
-        sys.exit("FAIL: set ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID + ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY (root key)")
+        sys.exit("FAIL: set NOVA_BOOTSTRAP_AWS_ACCESS_KEY_ID + NOVA_BOOTSTRAP_AWS_SECRET_ACCESS_KEY (root key)")
     region = os.environ.get("AWS_DEFAULT_REGION", "us-east-1")
     return boto3.Session(aws_access_key_id=key_id, aws_secret_access_key=secret, region_name=region)
 

terraform/bootstrap/create_iam_user.py

@@ -3,12 +3,14 @@
 Idempotent: skips user creation if the user exists; creates an initial
 access key if none active exists. Prints the key to stdout for the
 orchestrator to capture (NEVER committed):
-  ACDL_AWS_ACCESS_KEY_ID=<...>
-  ACDL_AWS_SECRET_ACCESS_KEY=<...>
+  NOVA_AWS_ACCESS_KEY_ID=<...>
+  NOVA_AWS_SECRET_ACCESS_KEY=<...>
 
 Run with the bootstrap root key in env:
-  ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID / ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY
-  AWS_DEFAULT_REGION (defaults to us-east-1)
+  NOVA_BOOTSTRAP_AWS_ACCESS_KEY_ID / NOVA_BOOTSTRAP_AWS_SECRET_ACCESS_KEY
+  (falls back to NOVA_AWS_ACCESS_KEY_ID / NOVA_AWS_SECRET_ACCESS_KEY when
+  the provided key is a root principal). AWS_DEFAULT_REGION (defaults
+  to us-east-1).
 
 The inline policy is read from spike_runner_policy.json (next to this
 file). The account id + region are already substituted in the policy file
@@ -38,9 +40,13 @@ POLICY_FILE = os.path.join(os.path.dirname(__file__), "spike_runner_policy.json"
 
 
 def main():
+    key_id = os.environ.get("NOVA_BOOTSTRAP_AWS_ACCESS_KEY_ID") or os.environ.get("NOVA_AWS_ACCESS_KEY_ID")
+    secret = os.environ.get("NOVA_BOOTSTRAP_AWS_SECRET_ACCESS_KEY") or os.environ.get("NOVA_AWS_SECRET_ACCESS_KEY")
+    if not key_id or not secret:
+        sys.exit("FAIL: set NOVA_BOOTSTRAP_AWS_ACCESS_KEY_ID + NOVA_BOOTSTRAP_AWS_SECRET_ACCESS_KEY (root key)")
     session = boto3.Session(
-        aws_access_key_id=os.environ["ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID"],
-        aws_secret_access_key=os.environ["ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY"],
+        aws_access_key_id=key_id,
+        aws_secret_access_key=secret,
         region_name=REGION,
     )
     iam = session.client("iam")
@@ -71,8 +77,8 @@ def main():
         print("  (use scripts/rotate_spike_key.sh to rotate)")
         return
     new_key = iam.create_access_key(UserName=USER_NAME)["AccessKey"]
-    print("ACDL_AWS_ACCESS_KEY_ID=" + new_key["AccessKeyId"])
-    print("ACDL_AWS_SECRET_ACCESS_KEY=" + new_key["SecretAccessKey"])
+    print("NOVA_AWS_ACCESS_KEY_ID=" + new_key["AccessKeyId"])
+    print("NOVA_AWS_SECRET_ACCESS_KEY=" + new_key["SecretAccessKey"])
     print(f"iam: created initial access key {new_key['AccessKeyId']} for {USER_NAME}", file=sys.stderr)
 
 

terraform/bootstrap/create_state_backend.py

@@ -6,8 +6,10 @@
   evidence outbox (D-P08-1).
 
 Run with the bootstrap root key in env:
-  ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID / ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY
-  AWS_DEFAULT_REGION (defaults to us-east-1)
+  NOVA_BOOTSTRAP_AWS_ACCESS_KEY_ID / NOVA_BOOTSTRAP_AWS_SECRET_ACCESS_KEY
+  (falls back to NOVA_AWS_ACCESS_KEY_ID / NOVA_AWS_SECRET_ACCESS_KEY when
+  the provided key is a root principal). AWS_DEFAULT_REGION (defaults
+  to us-east-1).
 
 Writes terraform/bootstrap/.bootstrap_state.json (gitignored bookkeeping).
 
@@ -30,15 +32,19 @@ import boto3
 
 
 REGION = os.environ.get("AWS_DEFAULT_REGION", "us-east-1")
-ACCOUNT_ID = os.environ.get("ACDL_AWS_ACCOUNT_ID", "581513795199")
+ACCOUNT_ID = os.environ.get("NOVA_AWS_ACCOUNT_ID", "581513795199")
 STATE_BUCKET = f"nova-tfstate-{ACCOUNT_ID}-us-east-1"
 OUTBOX_TABLE = "nova-outbox"
 
 
 def main():
+    key_id = os.environ.get("NOVA_BOOTSTRAP_AWS_ACCESS_KEY_ID") or os.environ.get("NOVA_AWS_ACCESS_KEY_ID")
+    secret = os.environ.get("NOVA_BOOTSTRAP_AWS_SECRET_ACCESS_KEY") or os.environ.get("NOVA_AWS_SECRET_ACCESS_KEY")
+    if not key_id or not secret:
+        sys.exit("FAIL: set NOVA_BOOTSTRAP_AWS_ACCESS_KEY_ID + NOVA_BOOTSTRAP_AWS_SECRET_ACCESS_KEY (root key)")
     session = boto3.Session(
-        aws_access_key_id=os.environ["ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID"],
-        aws_secret_access_key=os.environ["ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY"],
+        aws_access_key_id=key_id,
+        aws_secret_access_key=secret,
         region_name=REGION,
     )
     s3 = session.client("s3", region_name=REGION)