---ci---
project: acdl
phase: 5
milestone: v1.28
status: execute
persona: security-engineer
---
Add tests/test_e2e_idp.py — the J1+J2 happy-path E2E flow. Uses moto
for DynamoDB (4 IdP tables) + mock KMS (test ECC keypair). Asserts:
(a) sign_up succeeds, (b) sign_in returns a session, (c) token-vend
returns a KMS-signed OIDC token, (d) the OIDC token verifies with the
JWKS key (pyjwt), (e) nova apply --local produces a JWS attestation
(HS256), (f) the JWS verifies with the PAT-derived key (+ tamper
detection), (g) the audit chain is complete + linked (auth.sign_up,
auth.sign_in, auth.session_created, pat.issued, token.vend.allowed —
all present, linked by user_id/jti, no raw password/PAT leaked
INV-16). Also: the credentials file stores the OIDC token not the raw
PAT (C-7.3), the DDB user item has a password_hash not the raw
password, the DDB PAT row has a pat_hash not the raw PAT. Negative
path: revocation breaks the chain (403 pat_revoked, D-229 strong-read
SLO, token.vend.denied audit event).
---ci---
project: acdl
phase: 2
milestone: v1.28
status: execute
persona: backend-engineer
---
tests/test_init_attestations.py: nova init in a tmp_path creates
.nova/contract.yml.attestations/ as an empty directory (listdir == []).
The existing test_cli_subcommands.py asserts is_dir() but not emptiness;
this is the explicit REQ-331 assertion (freshly scaffolded repo has no
attestations yet — they are produced later by nova apply --sign-local-review
/ the JWS attestation flow, REQ-332).
---ci---
project: acdl
phase: 2
milestone: v1.28
status: execute
persona: backend-engineer
---
Extract dispatch_action() shared business-logic dispatch + _to_http_response
error mapper. lambda_handler (Lambda) + cli_main (CLI) become thin input
parsers that both delegate to dispatch_action. The action routing, contract
validation, DynamoDB write, error reporting live in shared functions — single
source of truth (NFR-7). tests/test_dual_use.py verifies both paths produce
the same output for the same input, both call dispatch_action, and code
share >=80% (CAP-026). 41 existing ingestor tests still pass.
tests/test_forge_action_byte_identical.py — 15 tests asserting the
structural invariants of the nova cli-action composite action
(.github/actions/nova-cli/action.yml). The action is consumed by both
the production forge + the dev forge via the same file path, so a
single source under test guarantees both platforms consume the same
bytes (the byte-identical requirement, NFR-11).
Structural invariants covered (the unit-testable subset):
(a) action.yml is valid YAML
(b) name present + non-empty
(c) inputs.command required: true
(d) inputs.contract / mode / version exist with documented defaults
(.nova/contract.yml, "", "latest") and are not required
(e) runs.using == "composite"
(f) a setup-python@v5 step pins python-version "3.12" (REQ-326 AC3)
(g) an install step installs `nova` via both CodeArtifact
(codeartifact login --tool pip) + fallback (--index-url) paths,
parameterised by inputs.version
(h) a run step executes `nova ${{ inputs.command }}` with
NOVA_CLIENT_MODE (from inputs.mode) + NOVA_CONTRACT (from
inputs.contract) env forwarded
NFR-11 byte-identical source guard: the action.yml must not embed
forge-specific hostnames / org names / the dev-forge or consumer-mirror
names, and the install path must be selected by env var at runtime
(NOT a forge-identity conditional) — so the file stays byte-identical
across forges. Both asserted.
The full byte-identical cross-platform verification (NFR-11,
REQ-326 AC2) — running the action with identical inputs on a
production-forge ubuntu-latest runner + a dev-forge act_runner and
asserting identical stdout + exit code — is a CI matrix job, not a
unit test. It cannot be reproduced in-process (depends on two external
runner environments). Documented in the module docstring + the
action.yml header; the CI matrix job is defined out-of-band.
All 15 tests pass. No regressions in tests/test_pipeline_contract.py,
tests/test_deploy_workflow_env_input.py, tests/test_rotate_key_workflow.py
(77 passed). tests/test_no_forge_mentions.py passes (the test file +
action.yml + publish.yml are clean of forge-specific strings).
---ci---
project: acdl
phase: 1
milestone: v1.28
status: execute
persona: backend-engineer
---/ci---
CAP-033: `nova --help` exits 0 and lists a subcommand for every
user-facing core/ module (15 expected subcommands parsed from help).
CAP-034 (AST scan, parametrized per nova/<module>.py excl. cli/__init__):
- (a) line count ≤50
- (b) ≤3 FunctionDef/AsyncFunctionDef
- (c) every bare ast.Call target resolves to a core.* import, a builtin,
or a local function def (attribute/method calls allowed)
- (d) no `if` statements except `if __name__ == "__main__"`
nova init: in tmp_path, asserts .nova/, .nova/contract.yml.attestations/,
.gitignore created with all 6 secrets-exclusion lines; refuses existing
dir without --force.
---ci---
project: acdl
phase: 1
milestone: v1.28
status: execute
persona: cli-engineer
---/ci---
The W6 'unset NOVA_GITEA_TOKEN' line in scripts/run_platform.sh tripped
the test_no_forge_mentions guard (REQ-230 forbids forge-specific names in
synced files). Renamed to NOVA_FORGE_TOKEN (forge-agnostic); .env.secrets
adds NOVA_FORGE_TOKEN as an alias; config.json scopes now map forge + gitea
-> NOVA_FORGE_TOKEN. scripts/rotate_spike_key.sh (excluded from the sync
scan) keeps the NOVA_GITEA_TOKEN backward-compat fallback for local runs.
Full suite green (844 passed).
---ci---
project: acdl
phase: 3
milestone: v1.26
status: execute
wave: W6
---
workflows-src/rotate-aws-key.yml — daily cron (0 0 * * *) + workflow_dispatch,
wraps scripts/rotate_spike_key.sh (uses NOVA_AWS_* static-key auth to IAM-
rotate the nova-spike-runner key; uploads the new key to the consumer's
Actions secret store; idempotent — deactivates the old key only after the
new propagates, verified by a post-PUT GET). Synced to .github + .gitea.
v0.2 scope: the mechanism exists (SPEC §5.9 — exists-not-ran); the v0.2
deploy uses the currently-active key. Documented in ARCHITECTURE.md §12.9.
The synced workflow file is forge-agnostic (REQ-230): forge base URL /
owner / consumer repo come from repository secrets (NOVA_FORGE_*,
NOVA_CONSUMER_REPO), not literals. rotate_spike_key.sh reads NOVA_FORGE_*
with NOVA_GITEA_* backward-compat fallback. sync_workflows.py PAIRS
extended to include rotate-aws-key.yml (was hardcoded to 3 pairs).
---ci---
project: acdl
phase: 3
milestone: v1.26
status: execute
wave: W7
---
CAP-025 (local tier) asserts the pilot-apply pipeline is structurally
ready: run_platform.sh steps present, core pipeline modules importable,
dev env bound to 581513795199 (D-203), dynamodb L1 registered (REQ-322),
pilot policies authored (REQ-315/320), outcome backfill present (REQ-317).
Returns Verified on the current branch (all W2/W3/W4 dependencies in
place). Added to CAPABILITY_REGISTRY. The live apply (P4) exercises this
end-to-end against AWS.
---ci---
project: acdl
phase: 3
milestone: v1.26
status: execute
wave: W5
---
The adapter reads env.state_backend.bucket from the env JSON when present
(fallback to the computed nova-tfstate-{account_id}-{region} pattern for
backwards compat). dev.json bound to the real account 581513795199 +
bucket nova-tfstate-581513795199-us-east-1 (D-203). qa/prod/dr stay
placeholder (account_id 000000000000 — the pilot-readiness policy blocks
apply on placeholder, D-208). dynamodb added to the adapter test
EXPECTED_L1_KEYS + a resolution/emission test.
---ci---
project: acdl
phase: 3
milestone: v1.26
status: execute
wave: W3
---
REQ-320: policies/pilot-readiness/no-placeholder-account.json asserts
account_id != "000000000000" over the env JSON (critical severity — a
placeholder account drives a block band). Passes on dev (581513795199),
fails on placeholder. REQ-315: policies/settlement-finality/all-matches-
committed.json asserts all_committed == true over the settlement status
JSON (critical severity). Authored + tested in v1.26; enforcement gates
qa/prod/dr promotions, not dev (G-Q6 — dev all_committed is vacuously
true). Both policy tests run against real kj (not skipped).
---ci---
project: acdl
phase: 3
milestone: v1.26
status: execute
wave: W4
---
REQ-317: core/metrics/outcome_backfill.py backfills fact_decision.outcome
pending -> succeeded/failed after run.completed/run.failed; idempotent +
terminal (does not overwrite a non-pending outcome); wired into the
collector. The Post-Pilot AI Decision Accuracy denominator is now grounded
(fact_decision.outcome is not stuck pending).
REQ-318: ai.decision.made on a block band carries escalation_reason:
'confidence' (the only value in v1.26 — a block is always confidence-
driven; future milestones may add 'policy'). Persisted into fact_run by
the collector. The Post-Pilot Human Escalation Frequency denominator is
now grounded.
---ci---
project: acdl
phase: 3
milestone: v1.26
status: execute
wave: W2
---
Pre-existing failures uncovered by running the full suite with kj installed
+ disk freed (the P2 verify missed these):
- dynamodb L1: rename simple.yaml -> simple.yml + add complex.yml (module-standards
expects both .yml extensions; the P2 author used .yaml)
- sync_workflows: re-sync ci.yml drift (.github + .gitea <- workflows-src)
- CAP-024 deck path: nova-autonomous-cloud-delivery.md was consolidated to
-marp.md in v1.25 P1 (commit a47c162) but test + regression_verify still
pointed at the old path; update both + relax slide-count bound (18-20) +
count class="benefit" divs (marp format, not the old 'Benefit:' text)
---ci---
project: acdl
phase: 3
milestone: v1.26
status: execute
wave: W0.5
---
P1-1 (correctness): run_platform.sh Step 5c now invokes the meta-policies
(block-on-any-critical, tagging-rules-agree) over the merged PCR list after
Step 5b, appending the meta-PCRs to pcr.json before the confidence signal
runs. Closes the D-118/D-119 declarative-critical-block gap (the
confidence_signal.py hard-override stays as defense-in-depth).
P1-2 (testing): test_meta_policies.py behavioral assertions strengthened —
test_no_critical_passes asserts no fails, test_critical_fail_present asserts
a non-pass result, test_pcrs_validate_against_schema validates output.
P1-3 (correctness): _smoke.json assertion rewritten from malformed
'{{ to_string(@) }}' to valid JMESPath '(regex_match(...))'.
---ci---
project: acdl
phase: 5
milestone: v1.25
status: execute
phase_role: final
---/ci---
Two-stage policy scan per item 20:
1. Checkov on static code BEFORE terraform plan (fail-fast, quick dev
feedback). Added to run_platform.sh Step 3c + run_codegen.sh Step 3c
(runs on the authored TF dir before plan, using --framework terraform).
2. Runtime policy scan on the plan AFTER terraform plan: Wiz when
configured (WIZ_API_TOKEN + WIZ_API_URL), else Checkov against the
plan as a drop-in replacement (--framework terraform_plan). Wiz and
Checkov are NEVER both run on the plan. Replaces the old single
Checkov-on-main.tf step in run_platform.sh Step 5 + run_postapply.sh
Step 5.
pipelines/contract.yml: stage list updated — 'checkov' stage replaced by
'checkov-static' (before terraform-plan) + 'runtime-policy-scan' (after
terraform-plan). 9 stages → 10 stages. Header comment updated.
adapters/wiz/wiz_adapter.py: add --plan mode CLI (fetch_and_adapt_plan)
for scanning a terraform plan; backward-compat with the positional
<wiz_issues.json> <contract-id> mode. is_configured() gates the Wiz path.
Tests: test_pipeline_contract.py (9 → 10 stages, new stage names);
test_contract_resolver.py (rename test, assert checkov-static +
runtime-policy-scan present, old 'checkov' gone). Full suite: 685 pass
+ 1 pre-existing attestation failure (NOVA_ATTESTATION_SIGNING_KEY_ID
unset, unrelated to v1.21, fails on main without these changes too).
---ci---
project: acdl
phase: 4
milestone: v1.21
status: execute
phase_role: execution
---/ci---
The metrics/ export views (README.md, TRUST_SNAPSHOT.md, powerbi/) are
consumer-facing but fell outside the original 13 domains, so the first nova
release left them untracked. Adds a 14th domain 'metrics' between docs and
workflows. Updates TestSyncToNovaScript domain-order assertion to 14.
---ci---
project: acdl
phase: 2
milestone: v1.19
status: complete
phase_role: final
---/ci---
Jon Chery