docs(P04): complete operator-guide-reference-tracking phase (REQ-OPS-GUIDE, v1.28.4)

---ci--- project: acdl phase: 4 milestone: v1.29 status: complete ---/ci---
2026-08-20 05:24:26 +00:00
parent 8c0c2dd268
commit fa789d703a
5 changed files with 892 additions and 26 deletions
@@ -21,7 +21,20 @@
 > lifecycle; `nova idp setup`; `nova auth login/revoke/status`). No
 > AWS-managed identity (INV-15). 6 new capabilities (CAP-033..038),
 > 6 new invariants (INV-12..17), 6 decisions (D-226..231).
-> **Next update:** at v1.29 ship.
+> **v1.29 (pending — tag `v1.28.6`):** Reposplit + Identity Layer
+> Bring-Live. Platform operations extracted to a Gitea-private
+> Terraform repo (`nova-platform-ops`, OPER-PRIV); `acdl/acdl`
+> standardized on GitHub (D-232); Nova-idp brought live in
+> `581513795199` via Terraform (CFN archived, REQ-369); `kj` substrate
+> has one ECR image digest shared by the Lambda runtime + its Fargate
+> fallback (KJ-LOCKSTEP, REQ-371, D-238); JWKS edge-only via CloudFront
+> + OAC (INV-18, D-233). 3 new capabilities (CAP-039..041), 1 new
+> invariant (INV-18), 10 NFR constraints (KJ-STATIC, KJ-LOCKSTEP,
+> KJ-WARMUP-HEALTH, OPER-PRIV, IAM-NARROW, DRIFT-DETECT,
+> IMPORT-IDEMPOTENT, TFM-HITL, JWKS-SLO, JWKS-ROTATION), 9 decisions
+> (D-232..D-240). Covered-reference REQs (355-366, 371) verified via
+> M1/M1.5/M2 cutover gates in `docs/operator-guide-platform-ops.md`.
+> **Next update:** at v1.30 ship.

 ## How to use this file (PO)

@@ -110,6 +123,30 @@
  absence or evaluation error (C-6.1 — never fail open). Allow/deny +
  policy inputs emitted to the audit stream. `policy_version` (git SHA,
  D-231) recorded in every event.
+- **INV-18 (JWKS-EDGE-ONLY, v1.29):** the JWKS endpoint is the only
+  public read surface of the live platform. All other platform
+  endpoints MUST gate with `AuthType: AWS_IAM` (D-233). CloudFront +
+  OAC pinning replaces direct Lambda Function URL exposure. Direct
+  Function URL → 403; via-CloudFront → 200.
+
+> **v1.29 NFR constraints (10 — load-bearing, not full invariants):**
+> KJ-STATIC (`kj` compiled `CGO_ENABLED=0`, `file(1)` reports
+> `statically linked`, SHA-256 in Terraform state); KJ-LOCKSTEP
+> (Fargate standby digest == Lambda `image_uri` digest at every
+> `terraform plan`, enforced by `lifecycle.precondition` + CI + PR
+> comment + operator review, D-238); KJ-WARMUP-HEALTH (Fargate
+> `GET /health → 200` every 10s, READY before M1 cutover);
+> OPER-PRIV (`nova-platform-ops` `private: true`, not mirrored,
+> REQ-359); IAM-NARROW (Gitea OIDC role bounded, no `Action: "*"` or
+> `Resource: "*"`, REQ-360); DRIFT-DETECT (`terraform plan` exit 2
+> fails the apply workflow, REQ-356); IMPORT-IDEMPOTENT (re-import
+> exits `resource_already_imported`, REQ-361); TFM-HITL (`terraform
+> apply` against `main` requires Gitea Actions approval from a user
+> distinct from the PR author, REQ-357, INV-3); JWKS-SLO
+> (`GET /.well-known/jwks.json` P95 < 200ms same-region,
+> `Cache-Control: max-age=3600`); JWKS-ROTATION (on key rotation,
+> both old + new public keys published during 24-hour overlap
+> window).

 ## Domains (capability groups)

@@ -123,6 +160,8 @@
 8. Consumer surfaces (developer + agentic)
 9. Pilot estate (v1.26)
 10. Forge / CI runtime
+11. CLI + Identity Layer (v1.28)
+12. Platform Ops Reposplit (v1.29)

 ## Capabilities (additive — one row per shipped capability)

@@ -303,6 +342,21 @@
 | — | Operator guide | v1.28 / `v1.27.5` | `docs/operator-guide-idp.md` | REQ-345 | local | `nova idp setup` + KMS rotation + layer update + PITR restore + emergency PAT revocation |
 | — | Developer guide | v1.28 / `v1.27.5` | `docs/developer-guide-auth.md` | REQ-346 | local | quickstart + mode resolution + JWS KDF + service-account PATs |

+### Domain 12 — Platform Ops Reposplit (v1.29)
+
+> **Pending — tag v1.28.6 (milestone release).** Rows below are the
+> v1.29 capability allocations; shipped state is recorded at the P-final
+> milestone-ship wave. Covered-reference REQs (355-366, 371) are
+> authored out-of-band in `nova-platform-ops`; their verification
+> surface is the M1/M1.5/M2 cutover gates in the operator guide (grill
+> CF-2/G-5).
+
+| ID | Capability | Shipped | Files | Controlling | Tier | Notes |
+|----|-----------|---------|-------|-------------|------|-------|
+| CAP-039 | Platform ops reposplit | v1.29 / `v1.28.6` (pending) | `nova-platform-ops` (out-of-band), `docs/operator-guide-platform-ops.md`, `docs/archive/nova-idp-cfn-v1.28.md` | REQ-369, REQ-OPS-GUIDE, D-232, D-235 | covered-reference | engineering (`acdl/acdl`, GitHub) ends at the artifact; operations (`nova-platform-ops`, Gitea-private, OPER-PRIV) begins at the live platform; tag-pin handoff; CFN archived; covered-reference REQs tracked via cutover gates |
+| CAP-040 | KJ substrate lockstep | v1.29 / `v1.28.6` (pending) | `nova-platform-ops` (out-of-band), `platform/abac/kj-version.txt`, `.github/workflows/publish.yml` | REQ-371, REQ-363, REQ-363b, D-238, D-239 | covered-reference | one ECR image digest shared by Lambda `image_uri` + Fargate task `image`; `lifecycle.precondition` on both resources at `terraform plan`; KJ-STATIC (`CGO_ENABLED=0`, `file(1)` asserts `statically linked`); no second pipeline, no second SHA pin |
+| CAP-041 | JWKS edge-only | v1.29 / `v1.28.6` (pending) | `nova-platform-ops` (out-of-band), `docs/operator-guide-platform-ops.md` | REQ-364, REQ-365, REQ-366, INV-18, D-233 | covered-reference | JWKS is the only public read surface; CloudFront + OAC (`AuthType: AWS_IAM`, NOT `NONE`, `OriginAccessControlOriginType: lambda`, `SigningBehavior: always`); direct Function URL → 403, via-CloudFront → 200; WAF rate-limit 3000/5min + AWSManagedRulesCommonRuleSet; ACM DNS-validated in us-east-1; Route53 A-alias |
+
 ## Archive pointers

 - **v1.0–v1.24 capability narrative + the 2026-07-27 re-verification sweep:**