0f0d9b914567dcad539a9fd04518da138b064b38
76 Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Jon Chery
|
e6ee79402b |
feat(P2): contract + stack-IR kyverno-json policies + resolver wiring (REQ-295..299)
contract/ policies (4): require-id-pattern, require-env-in-enum, require-infrastructure-min-1, forbid-unknown-fields — declarative mirrors of contract.schema.json constraints. stack-ir/ policies (3): require-tagging-standard (nova:owner/contract/ environment/cost-center tags — ports nova_tagging.py), forbid-public-ingress (v1.0 demo rule, now declarative), require-encryption-by-default (v1.8 D-encryption-default — S3 + EBS encryption config). core/contract_resolver.py: pre-resolve contract-policy evaluation (REQ-296) + post-resolve stack-IR-policy evaluation (REQ-298). Additive — the resolver's return shape + exceptions unchanged; PCRs attach to stack_instance.policyResults. Policy evaluation never breaks the resolver (confidence signal decides gate). tests: test_stack_ir_policies.py + passing/failing fixtures. Skip-without-kj. 16 existing resolver tests unchanged. ---ci--- project: acdl phase: 2 milestone: v1.25 status: execute phase_role: execution requirements: covered: [REQ-295, REQ-296, REQ-297, REQ-298, REQ-299] partial: [] ---/ci--- |
||
|
Jon Chery
|
ac18c98385 |
feat(P1): kyverno-json engine core + PolicyEngine protocol (REQ-291..294, 308, 309)
core/policy_engine.py: PolicyEngine Protocol (PEP 544, runtime_checkable)
+ PolicyEngineRegistry (selects from config.json.policy.engine) + NullEngine
fallback (NULL_ENGINE_INACTIVE when policy key absent).
adapters/kyverno-json/: KyvernoJsonEngine — shells to , translates
native output → list[dict] PCR records (engine: "kyverno", ruleId KJ_ prefix,
severity via nova.cloudinit.dev/severity annotation, default info).
is_configured() guards on → KJ_ENGINE_NOT_CONFIGURED SKIPPED PCR
(distinct from NullEngine). Defensive parsing (malformed → error PCR).
config.json: new object {engine: kyverno-json, policy_root}.
scripts/install-kyverno-json.sh: go install kj@latest (D-115).
CI (.gitea + .github): install Go + kj for policy-engine tests (best-effort;
tests skip when kj absent).
tests: 24 pass, 2 skip (kj not installed). 132 existing tests unchanged.
NullEngine satisfies PolicyEngine Protocol (G-Q8a — proves swap boundary).
---ci---
project: acdl
phase: 1
milestone: v1.25
status: execute
phase_role: execution
requirements:
covered: [REQ-291, REQ-292, REQ-293, REQ-294, REQ-308, REQ-309]
partial: []
---/ci---
|
||
|
Jon Chery
|
fe635c17d5 |
test(P3): env-transition tests — REQ-288,289
- tests/test_env_transition.py: detect_prior_env (5 tests) + record_applied_env (3 tests) + CLI (2 tests) via moto DynamoDB (REQ-288) - tests/test_run_platform_env_transition.py: Step 0b block assertions (10 tests) + record-applied-env assertions (3 tests) + consumer-repo assertions (2 tests) (REQ-289) 25 new tests pass. 117 total tests pass (no regressions). ---ci--- project: acdl phase: 3 milestone: v1.24 status: execute requirements: [REQ-288,REQ-289] ---/ci--- |
||
|
Jon Chery
|
25427250ad |
docs(P1): consumer guide accuracy fixes — REQ-276..281,290
- Step 3 contract fields table: stale uses/module → real id/name/environment/infrastructure (REQ-276) - Step 4 caller: add environment: dev to match Step 2 (REQ-277) - Step 5 stage 8: (dev only) → (autonomous in dev; higher envs apply after HITL) (REQ-278) - Step 8: rewrite with Shape A destroy-then-rebuild + Shape B cross-ref (REQ-279) - Per-env section: add Shape B lead sentence (REQ-280) - Reference table: @v1.19 wording + .yaml→.yml extension fix (REQ-281) - Tests: rename no-field-editing → both-promotion-shapes + new destroy-on-env-change test (REQ-290) ---ci--- project: acdl phase: 1 milestone: v1.24 status: execute requirements: [REQ-276,REQ-277,REQ-278,REQ-279,REQ-280,REQ-281,REQ-290] ---/ci--- |
||
|
Jon Chery
|
e07a210c70 |
test(P5): ci + tests + readme for single-doc dual-pptx pipeline (REQ-273,274,275)
CI workflows: install python-pptx, pin CLI versions, stage both PPTX + inlined HTML. test_slides_pipeline.py: inverted theme assertion (now default+inline), deleted source-md tests, added 8 new tests (penetrate absence, image inlining, python-pptx, benefit class, single source, speaker-notes comments, default theme, css retained). New test_pptx_generator.py: slide count, title colors, slide titles, table rendering, image embedding, benefit callout. README rewritten for 3-step single-document + dual-PPTX + image-inlining pipeline. ---ci--- project: acdl phase: 5 milestone: v1.23 status: execute phase_role: execution ---/ci--- |
||
|
Jon Chery
|
25ddc894c2 |
docs(milestone): complete v1.22 — Nova Deck Layout Fix
9 requirements complete (REQ-254..262): - P1: theme-css — section padding + overflow + image rules + title chrome + spacing tightening (REQ-254,255,256) - P2: render-scripts — delete render_deck.sh, pin CLI versions, 2x scale + transparent bg (REQ-257,258) - P3: mermaid-relayout — telemetry TB + platform-pipeline 4-node TB, re-rendered 2x transparent (REQ-259,260) - P4: deck-content — split slides 3+8 (18->20 main), trim 8 overflowing slides, remove redundant header (REQ-261) - P5: render-and-test — re-render HTML+PPTX, add 9 layout/aspect- ratio/theme-structural tests (REQ-262) - P6: final review + audit + ship (this commit) Final review fixes: source .md + talking-points re-synced to 20-slide structure; ![h:480 class:tall] directives applied; README stale references updated; CSS trailing newline added. Root cause: nova-sp-theme.css had zero section padding (declared /* @theme nova-sp */ as a comment, not the @theme directive; did not @import Marp default theme). Combined with overflow:hidden, blunt img max-height:320px, header+footer chrome on every slide, and two P5 diagrams with extreme aspect ratios (13.52x and 0.63x), 8 of 19 slides overflowed. NOT a P5 regression — theme CSS byte-identical P3->P5; P5 denser content made pre-existing flaws visible. Tags on v1.21.x line (v1.21.0 P0 -> v1.21.6 P6 final = milestone release). 32 slide tests pass (23 original + 9 new). 94 key-file tests pass. Pipeline check exit 0. ---ci--- project: acdl phase: 6 milestone: v1.22 status: complete phase_role: final requirements: covered: [REQ-254,REQ-255,REQ-256,REQ-257,REQ-258,REQ-259,REQ-260,REQ-261,REQ-262] partial: [] ---/ci--- |
||
|
Jon Chery
|
631244458f |
test(P5): re-render deck + add layout/aspect-ratio/theme-structural tests (REQ-262)
Re-rendered HTML + PPTX via render_slides.sh (pinned marp-cli@4.5.0, mermaid-cli@11.16.0, 2x transparent PNGs). 22 slides (title + 20 main + 1 appendix), 23 media files embedded. Theme embedded in HTML (--sp-red + padding confirmed). Added 9 tests to test_slides_pipeline.py (the gap that let the layout regression through): - test_theme_css_has_section_padding (REQ-254) - test_theme_css_suppresses_title_chrome (REQ-256) - test_theme_css_has_aspect_ratio_aware_images (REQ-255) - test_png_aspect_ratios_sane (REQ-259/260, scoped to deck-referenced PNGs only per GRILL revision 1, bounds [0.4, 4.0]) - test_render_slides_has_2x_scale (REQ-258) - test_render_slides_pins_cli_versions (REQ-257) - test_render_deck_removed (REQ-257) - test_html_embeds_theme (REQ-262) - test_html_slide_count_matches_marp (REQ-262) 32 slide tests pass (23 original + 9 new). 94 tests pass across key files. run_platform.sh --check-only exit 0. ---ci--- project: acdl phase: 5 milestone: v1.22 status: execute phase_role: execution ---/ci--- |
||
|
Jon Chery
|
cc6071ee53 |
fix(P4): trim/split 8 overflowing slides + remove header (REQ-261)
Split slide 3 (Objectives + Anti-Goals) into Slide 3 (Objectives) + Slide 4 (Anti-Goals). Split slide 8 (Attestation Matrix) into Slide 9 (QA concerns, 3 rows) + Slide 10 (Prod/DR concerns, 7 rows). Main slide count 18 -> 20. Trimmed: slide 7 (Pipeline) reduced to 3 bullets (4th covered by diagram). slide 11 (Telemetry) reduced to 3 bullets. slide 14 (Deferred) merged 3 Live-AWS rows into 1 (8 -> 6 rows). slide 17 (Quarter-by-Quarter) dropped Grounding column (5 -> 4 cols). Global table cell padding reduced (6px 10px -> 4px 8px) so 8-13 row tables fit. Removed header: from frontmatter (keep footer: + paginate only). The full 51-char deck title in BOTH header and footer was redundant chrome eating ~35px on every slide. Updated test_marp_deck_slide_count (18 -> 20 main + 1 appendix). Updated README slide-count convention (18 -> 20). ---ci--- project: acdl phase: 4 milestone: v1.22 status: execute phase_role: execution ---/ci--- |
||
|
Jon Chery
|
358aa62c3a |
fix(P2): render scripts — delete render_deck.sh, pin versions, 2x scale (REQ-257,258)
REQ-257: deleted scripts/render_deck.sh (omitted --theme, produced unthemed output; README already documents render_slides.sh as canonical). Pinned marp-cli@4.5.0 + mermaid-cli@11.16.0 in render_slides.sh to prevent boilerplate-CSS drift. Removed render_deck.sh references from README, sync_to_nova.sh, and test_no_forge_mentions.py. REQ-258: added -s 2 -b transparent to mermaid-cli invocation (matches README spec line 193). Produces crisp 2x PNGs with transparent backgrounds instead of 1x renders. ---ci--- project: acdl phase: 2 milestone: v1.22 status: execute phase_role: execution ---/ci--- |
||
|
Jon Chery
|
85c500e45a |
feat(P4): pipeline hardening — Checkov before plan, Wiz-or-Checkov on plan (REQ-250)
Nova Slides Render / render (push) Failing after 1m1s
Two-stage policy scan per item 20: 1. Checkov on static code BEFORE terraform plan (fail-fast, quick dev feedback). Added to run_platform.sh Step 3c + run_codegen.sh Step 3c (runs on the authored TF dir before plan, using --framework terraform). 2. Runtime policy scan on the plan AFTER terraform plan: Wiz when configured (WIZ_API_TOKEN + WIZ_API_URL), else Checkov against the plan as a drop-in replacement (--framework terraform_plan). Wiz and Checkov are NEVER both run on the plan. Replaces the old single Checkov-on-main.tf step in run_platform.sh Step 5 + run_postapply.sh Step 5. pipelines/contract.yml: stage list updated — 'checkov' stage replaced by 'checkov-static' (before terraform-plan) + 'runtime-policy-scan' (after terraform-plan). 9 stages → 10 stages. Header comment updated. adapters/wiz/wiz_adapter.py: add --plan mode CLI (fetch_and_adapt_plan) for scanning a terraform plan; backward-compat with the positional <wiz_issues.json> <contract-id> mode. is_configured() gates the Wiz path. Tests: test_pipeline_contract.py (9 → 10 stages, new stage names); test_contract_resolver.py (rename test, assert checkov-static + runtime-policy-scan present, old 'checkov' gone). Full suite: 685 pass + 1 pre-existing attestation failure (NOVA_ATTESTATION_SIGNING_KEY_ID unset, unrelated to v1.21, fails on main without these changes too). ---ci--- project: acdl phase: 4 milestone: v1.21 status: execute phase_role: execution ---/ci--- |
||
|
Jon Chery
|
301aa2c8d8 |
docs(P3): marp deck + talking points + README + theme CSS + tests (REQ-245,251,252)
Nova Slides Render / render (push) Failing after 58s
Marp deck (nova-autonomous-cloud-delivery-marp.md): synthesize from updated
source-of-truth; 18 main + 1 appendix slides; frontmatter — title 'Nova —
The Autonomous Cloud Delivery Platform', footer without version + without
'Act %{page}/5', title-slide subtitle 'Product Development & Citizen
Developer Overview'; no badges; embedded PNGs.
Talking points (nova-autonomous-cloud-delivery-talking-points.md):
re-distilled to 18-slide + A1 structure.
README.md: update deck title, audience, slide count (18 main + 1 appendix),
directory layout, remove badge docs, update deck table + render commands +
filenames. Document the v1.21 rename + restructure.
Theme CSS (nova-sp-theme.css): fix Appendix A1 table readability — tables
now have explicit white body + black text on any slide background
(including dark/title slides). Item 32.
Tests (test_slides_pipeline.py): add v1.21 assertions — no badges; no
version in footer/title slide; 18 main + 1 appendix slides; no D-###/REQ-
###/.py paths in audience-facing Marp deck or source slide body; old deck
files removed; render script default renamed; README references new deck
name. Update deck path in test_regression_cap023_024.py +
core/regression_verify.py CAP-024 (filename + 18-19 slide range, drop 'Arc
Preview' check per item 3).
attach_release_asset.py: usage example filename updated.
---ci---
project: acdl
phase: 3
milestone: v1.21
status: execute
phase_role: execution
---/ci---
|
||
|
Jon Chery
|
2273009b95 |
feat(P2): dedicated S&P theme + render pipeline + CI workflow (REQ-239..243)
Create nova-sp-theme.css — S&P Global Energy Marp theme (Red/Black/White palette applied to all slide chrome: backgrounds, headers/footers, pagination, tables, blockquotes, code blocks). Create render_slides.sh — end-to-end pipeline: mermaid PNGs + Marp HTML/PPTX. Create slides.yml CI workflow — auto-renders on docs/presentations/ changes. Create test_slides_pipeline.py — 12 tests (theme CSS, Marp frontmatter, script, workflow, .mmd/.png parity, README retired-deck cleanup). Update Marp frontmatter: theme: nova-sp + footer v1.20. Fix presentations/README.md directory layout (remove retired decks). Re-render HTML + PPTX with S&P theme. ---ci--- project: acdl phase: 2 milestone: v1.20 status: execute requirements: [REQ-239, REQ-240, REQ-241, REQ-242, REQ-243] ---/ci--- |
||
|
Jon Chery
|
0d2cbdb423 |
feat(P1): remove gitea/gitlab from synced files + simplify docs (REQ-230,231,232)
Genericize forge-detection code: gitea→forge/generic_forge, GITEA_ACTOR→FORGE_ACTOR. Drop .gitea byte-identity test assertions (keep GitHub-side + contract conformance). Add test_no_forge_mentions.py guard test (REQ-230). Delete completed migration docs (NOVA_MIGRATION.md, NOVA_AWS_MIGRATION.md). Move NO_HUMANS_THESIS.md to .ciagent/ (internal artifact). Strip ciagent-internal provenance from synced docs (REQ-/D-/P-/CAP- IDs, milestone headers, .ciagent/PROJECT.md citations). Trim README.md (reusable deploy section, local key rotation paragraph). Fix version-tag drift (@v1.13→@v1.19, acdl/→nova/). ---ci--- project: acdl phase: 1 milestone: v1.20 status: execute requirements: [REQ-230, REQ-231, REQ-232] ---/ci--- |
||
|
Jon Chery
|
0b79b16715 |
fix(P2): add metrics domain to sync_to_nova.sh — consumer export views (REQ-229)
The metrics/ export views (README.md, TRUST_SNAPSHOT.md, powerbi/) are consumer-facing but fell outside the original 13 domains, so the first nova release left them untracked. Adds a 14th domain 'metrics' between docs and workflows. Updates TestSyncToNovaScript domain-order assertion to 14. ---ci--- project: acdl phase: 2 milestone: v1.19 status: complete phase_role: final ---/ci--- |
||
|
Jon Chery
|
a4c5f332f6 |
feat(P1): sync_to_nova.sh — manual-only 2nd-release pipeline into ~/nova (REQ-229)
Replaces scripts/sync_to_gl.sh (kitchen-sink mirror sync into ~/gl/acdl) with scripts/sync_to_nova.sh — a manual-only, consumer-subset, domain-committed 2nd-release pipeline into ~/nova (GitLab jonathanchery/nova, separate repo + history, consumer/platform-team audience). - Manual-only gate: refuses without --release / RELEASE_CONFIRMED=1 (exit 2). Never triggerable by CI. - Consumer subset: excludes .ciagent/, .gitea/, .env*, terraform/, demo/, runtime metrics artifacts, and 18 internal-only scripts (EXCLUDE_SCRIPTS). Keeps consumer runbooks + metrics export views (README, powerbi, TRUST_SNAPSHOT). Protects ~/nova/.git via rsync --filter=P .git. - Domain-based commits: 13 fixed-order domains (config, core, adapters, modules, contracts, schemas, pipelines, mcp, skills, scripts, tests, docs, workflows). Each changed domain gets its own conventional commit supplied positionally via repeated -m flags. No kitchen-sink commit. - Conventional-commit validation: regex-enforced (feat|fix|docs|chore|...); bypass via --no-verify-format. - Modes: --list-domains, --dry-run, --no-push, -v, -h. - Tests: TestSyncToNovaScript (8 tests) covers gate, domain order, exclude list, consumer-script inclusion, .git protection filter, conventional regex. Decisions: D-143 (target ~/nova), D-144 (conventional commits per domain, not ---ci--- audit blocks), D-145 (manual-only trigger), D-146 (13 fixed domains, positional-over-changed mapping), D-147 (coreci/Atelier review gate deferred). ---ci--- project: acdl phase: 1 milestone: v1.19 status: execute requirements: covered: [REQ-229] partial: [] ---/ci--- |
||
|
Jon Chery
|
8bcf7296d5 |
feat(P5): Atelier MCP server + vendored Atelier + plugin-registry (REQ-223, REQ-224, REQ-225)
REQ-223: mcp/atelier/server.py plugin-registry MCP server (stdio, D-135). NovaAtelierServer wraps MCPServer (SDK v2, D-137) if installed; degrades to _ToolRegistry fallback if SDK absent (testable in CI without SDK). plugins/principles.py (lookup_principle, list_domains, matrix_lookup) + plugins/validation.py (validate_against_principles — agentic validation beyond Wiz/Checkmarx/Mend). 4 tools, 2 plugins. REQ-224: mcp/atelier/vendor/ pinned Atelier v0.3.6 (D-136) — core/ first-principles, domains/security/first-principles, review/agent-checklist, matrix/principles-matrix. vendor/VERSION.md + scripts/update_atelier_vendor.sh for intentional upgrades. mcp/atelier/README.md (tools, architecture, running, vendoring, extensibility, transport). REQ-225: tests/test_atelier_mcp.py — 16 tests, all pass. Covers: plugin discovery (both loaded), 4 tools registered, lookup_security_P4 (+P1, unknown domain/principle), list_domains (19, security-relevant, ui-ux-not), matrix_lookup (security 10 P-rules, unknown), validation (good-passes, bad-secret-fails, bad-swallowed-error-fails, bad-obfuscated-names-fails, result-structure). ---ci--- project: acdl phase: 5 milestone: v1.18 status: execute requirements: covered: [REQ-223, REQ-224, REQ-225] partial: [] ---/ci--- |
||
|
Jon Chery
|
5775a97388 |
feat(P3): submission-readiness input contract — schema + validator + docs + tests (REQ-217..220)
REQ-217: schemas/submission-readiness.schema.json (JSON Schema draft 2020-12) defines acceptable-to-start as a superset gate above contract.schema.json: contractId, environment, tags (5 Nova tags D-054), policyPreconditions, profile (developer|agentic), appSource (repo+ref), per-env mandatory (W3.E: qa→e2eSuite+loadTest, prod→runbook+dashboard+oncall, dr→drDrillRef), agentic markers (naturalLanguageIntent+confidenceAtSubmission+agentTrace). REQ-218: core/submission_readiness.py validator with check_readiness() + ReadinessResult (structured pass/fail + reason codes). Wired as contract_ingestor.py --check-readiness (D-133). Reason codes: MISSING_TAGS, ENV_MISSING_MANDATORY, AGENTIC_MISSING_INTENT, MISSING_APP_SOURCE, POLICY_PRECONDITION_MISSING. Never raises — all failures are reason codes. REQ-219: docs/submission-readiness.md (good + rejected examples + reason-code catalog + compliance-standard equivalence). REQ-220: tests/test_submission_readiness.py — 16 tests, all pass. Covers: good-pass, good-agentic-pass, missing-tags, empty-tag, qa-missing-e2e, prod-missing-runbook, dr-missing-drdrill, prod-all-pass, agentic-missing-all, agentic-missing-one, missing-appsource, appsource-missing-ref, empty-policy, result-structure. ---ci--- project: acdl phase: 3 milestone: v1.18 status: execute requirements: covered: [REQ-217, REQ-218, REQ-219, REQ-220] partial: [] ---/ci--- |
||
|
Jon Chery
|
d9b402c283 |
test(P6): regression capability — CAP-023 (metrics collector) + CAP-024 (deck structure) (REQ-198)
P6 (Wave 4, test) — REQ-198 New capabilities: - CAP-023: metrics collector runs + emits expected schema (fact/dim tables present) - CAP-024: unified deck structure (12-20 slides, x3 arc, per-slide benefit callouts) - tests/test_regression_cap023_024.py — 4 tests (all pass) Modified: - core/regression_verify.py — CAPABILITY_REGISTRY gains CAP-023 + CAP-024 ---ci--- project: acdl phase: 6 milestone: v1.17 status: execute ---/ci--- |
||
|
Jon Chery
|
3a7604dec0 |
feat(P3): powerbi export — CSV/JSON views + 8 placeholder views + data dictionary (REQ-190,199,208,209)
P3 (Wave 2, feat) — REQ-190, REQ-199, REQ-208, REQ-209 New components: - core/metrics/powerbi_export.py — exports fact/dim tables + 8 placeholder views to CSV/JSON - tests/test_powerbi_export.py — 6 tests (all pass) - docs/METRICS_VIEWS.md — column-level data dictionary (REQ-209) - metrics/powerbi/NOVA_DASHBOARD_README.md — folder-connector import guide + starter visual model (REQ-208) 8 placeholder views (deferred metrics, headers only): - placeholder_live_infra_health (D-096) - placeholder_live_outbox_rate (D-096) - placeholder_tamper_evident_checkpoints (D-083) - placeholder_onboarding_funnel (D-113/D-114/D-119) - placeholder_drift_detection (D-096 + no scheduler) - placeholder_live_cur_reconciliation (D-096) - placeholder_sla_downtime (D-096) - placeholder_predictive_reactive (future emitter) D-120: Nova-native (CSV/JSON files, no live connector) D-129: PowerBI ingests via folder connector ---ci--- project: acdl phase: 3 milestone: v1.17 status: execute ---/ci--- |
||
|
Jon Chery
|
18b03db272 |
feat(P2): metrics collector — SQLite cold store + Decision Ledger CLI (REQ-189,200,201,207)
P2 (Wave 2, feat) — REQ-189, REQ-200, REQ-201, REQ-207 New components: - core/metrics/collector.py — reads all grounded signals (REGRESSION_REPORT.json, per-run manifests, junit XML, coverage.json, decision ledger, lifecycle reports) → SQLite cold store (metrics/nova_metrics.db) with fact_run, fact_capability, fact_policy_check, fact_confidence, fact_test, fact_decision, fact_cost_estimate, fact_lifecycle, dim_capability, dim_milestone tables - core/metrics/decision_ledger_cli.py — CLI with query/verify-chain/stats/export/replay - tests/test_metrics_collector.py — 7 tests (all pass, incl. idempotent re-run REQ-200) D-120: Nova-native (SQLite, no ClickHouse) D-125: hybrid (reads files + events → SQLite) D-126: cold-only (no hot path) ---ci--- project: acdl phase: 2 milestone: v1.17 status: execute ---/ci--- |
||
|
Jon Chery
|
f8616b806e |
feat(P1): event emitters — CloudEvents envelope, Decision Ledger, Infracost adapter, attestation/confidence/policy event emission
P1 (Wave 1, feat) — REQ-187, REQ-188, REQ-205 (emitter), REQ-206 (emitter) New components: - core/metrics/event_envelope.py — CloudEvents 1.0 envelope + platform.* conventions - core/metrics/run_manifest.py — per-run manifest writer (nova.run.started/completed/failed) - core/metrics/decision_ledger.py — SQLite append-only hash-chain (ai.decision.made + attestation.recorded) - core/metrics/infracost_adapter.py — Infracost post-processor (degraded mode when CLI absent, A6) - schemas/metrics_event.schema.json — CloudEvents envelope schema - schemas/metrics_run_manifest.schema.json — per-run manifest schema - metrics/README.md — backup/restore doc (REQ-201) - tests/test_metrics_emitters.py — 16 tests (all pass) Modified components: - core/confidence_signal.py — emits nova.confidence.computed + nova.ai.decision.made (D-122) - core/hitl_gates.py — emits nova.attestation.recorded on qa/prod/dr gates (D-132) - adapters/terraform/policy/checkov_adapter.py — emits nova.policy.evaluated - pyproject.toml — addopts gains --junitxml + --json-report + --cov (REQ-206) - .gitignore — metrics runtime artifacts ignored D-120: Nova-native (JSONL + SQLite, no Kafka/OTel) D-121: Decision Ledger = outbox_writer extension → SQLite hash-chain D-122: AI decision = confidence_signal + HITL gate (not LLM) D-128: metrics/ at repo root D-132: Attestation instrumentation ---ci--- project: acdl phase: 1 milestone: v1.17 status: execute ---/ci--- |
||
|
Jon Chery
|
f83b974c0e | Merge milestone/v1.16-nova-simplification — v1.16 complete (Nova Simplification: 20-phase NFR sweep + final; tag v1.15.26) | ||
|
Jon Chery
|
e15eea067b |
docs(milestone): complete v1.15 — Nova Rebrand (tag v1.15.4)
P5 final-review-ship complete: dual-read fallback removed (REQ-164) — core/env.py NOVA-only, .env.secrets load paths NOVA-only (G-106 retired), nova_tagging.py hard-fails any acdl:* tag, legacy ACDL_* Gitea secrets deleted, ACDL_LIFECYCLE_MODE/ACDL_LOCAL_TIER/ACDL_HITL_* exports removed from scripts, SNS subject → Nova SoD halt (P1-2), bootstrap scripts NOVA-only. Review: 2 P0 auto-fixed (duplicate delenv), P1-1/P1-2 resolved, doc-drift fixed. Audit: tags v1.15.0-4 exist; traceability REQ-155..164 all complete; ARCHITECTURE naming table matches codebase. 615 pytest PASS; run_ci.sh 3-stage PASS. NOVA_MIGRATION.md marked COMPLETE. ---ci--- project: acdl phase: 5 milestone: v1.15 status: complete phase_role: final requirements: covered: [REQ-155, REQ-156, REQ-157, REQ-158, REQ-159, REQ-160, REQ-161, REQ-162, REQ-163, REQ-164] partial: [] ---/ci--- |
||
|
Jon Chery
|
13846d553a |
fix(P5): review P0 — collapse duplicate NOVA_* delenv in route-halt + adapter tests
Code review (correctness lens) found the same P5 mechanical-edit defect
in two more test files: the ACDL_* fallback delenv was replaced with a
duplicate NOVA_* delenv (leaving a dead duplicate line, a stale 'ACDL_*
fallback until P5' comment, and the ACDL_* var no longer cleaned).
- tests/test_route_halt_artifact.py: two sites (stderr-fallback +
outbox-fallback) each deleted NOVA_SOD_HALT_TOPIC_ARN twice.
- tests/test_adapter.py::test_default_remote_state_key: deleted
NOVA_REMOTE_STATE_KEY twice.
With core/env.py NOVA-only as of P5, a single NOVA_* delenv is the
correct precondition. Collapsed to one delenv per var + updated comments.
---ci---
project: acdl
phase: 5
milestone: v1.15
status: verify
lessons:
- P0 fix applied: duplicate monkeypatch.delenv('NOVA_*') in test_route_halt_artifact.py (2 sites) + test_adapter.py collapsed to a single delenv consistent with the P5 NOVA-only core/env.py.
---/ci---
|
||
|
Jon Chery
|
d14f9289da |
fix(P5): review P0 — remove duplicate delenv in attestation signature-skip test
Code review (correctness lens) found a P0 in tests/test_attestation_matrix.py
introduced by the P5 fallback-removal pass: the dual-read delenv of
ACDL_ATTESTATION_SIGNING_KEY_ID was replaced with a second (duplicate)
delenv of NOVA_ATTESTATION_SIGNING_KEY_ID, leaving the test misleading
(comment claimed 'both NOVA_* and ACDL_* must be unset' while only NOVA_*
was deleted twice) and the ACDL_* var no longer cleaned. With P5 having
removed the ACDL_* fallback from core/env.py, deleting NOVA_* alone is the
correct and sufficient precondition for the skip; this commit drops the
duplicate line and updates the comment to match the NOVA-only contract.
---ci---
project: acdl
phase: 5
milestone: v1.15
status: verify
lessons:
- P0 fix applied: duplicate monkeypatch.delenv('NOVA_ATTESTATION_SIGNING_KEY_ID') in test_signature_skip_when_key_unset left the test misleading and the ACDL_* var uncleaned; collapsed to a single NOVA_* delenv consistent with the P5 NOVA-only core/env.py.
---/ci---
|
||
|
Jon Chery
|
0e6ecae26d |
feat(P4): Nova rebrand — AWS resource migration (REQ-163)
Rename all acdl-* AWS resources → nova-* across terraform (DynamoDB, Secrets Manager, Lambda, SNS, SG, KMS alias, ECS, ECR, IAM user/policy, state bucket, ALB, VPC/subnet names). Lambda default table names → nova-* (D-111). State bucket backend → nova-tfstate (-migrate-state documented). New docs/NOVA_AWS_MIGRATION.md runbook (staged migration + rollback). New scripts/migrate_dynamodb_data.py (scan+copy, dry-run default). acdl-deploy- → nova-deploy- role ARN in deploy workflows. Test fixtures updated; terraform validate + pytest + run_ci.sh PASS. ---ci--- project: acdl phase: 4 milestone: v1.15 status: execute ---/ci--- |
||
|
Jon Chery
|
51c3edf458 |
feat(P3): Nova rebrand — SSM path + tag keys (REQ-161/162)
SSM path /acdl/{env}/{contractId}/{output} → /nova/... across
core/output_publisher + contract resolver + consumer docs. New
scripts/migrate_ssm_paths.py (copy/verify/delete, dry-run default).
AWS tag keys acdl:owner|environment|contract|cost-center|ref → nova:*
across terraform tagging + ABAC session policies (iam:ResourceTag/acdl:*
→ iam:ResourceTag/nova:*). nova_tagging.py hard mode (D-109 warn→hard).
tagging-standard.json tag-key values → nova:*. New
scripts/untag_acdl_keys.py (remove old acdl:* tags, dry-run default).
Test fixtures updated; pytest + run_ci.sh PASS.
---ci---
project: acdl
phase: 3
milestone: v1.15
status: execute
---/ci---
|
||
|
Jon Chery
|
d5bae868a4 |
feat(P2): Nova rebrand — code/env-vars/consumer-path (REQ-158/159/160)
core/env.py dual-read helper (D-108); 21 ACDL_*→NOVA_* env vars migrated across core/scripts/adapters/tests/workflows + .env/.env.secrets (key rename, values stay). G-106 binding: run_platform.sh:288-289 + regression_verify.py:309-312 dual-read (NOVA first, ACDL fallback). G-108 binding: Gitea NOVA_* secrets created via API + workflow secrets: refs updated (deploy.yml + modules-lifecycle.yml, .gitea + .github). acdl_tagging.py→nova_tagging.py (D-109 warn mode, nova:* enforced). .acdl/→.nova/ consumer path (resolver + deploy workflow + schema + tests + docs). Test fixtures updated; pytest + run_ci.sh PASS. ---ci--- project: acdl phase: 2 milestone: v1.15 status: execute ---/ci--- |
||
|
Jon Chery
|
3b1181f39b |
Merge milestone/v1.14-refinement — v1.14 complete (NFR Refinement: bug fixes, security, stubs, tests, docs; 20 phases + final; tag v1.13.24)
v1.14 NFR Refinement milestone complete. 20 execution phases (P1-P20) + 1 final (P21). All P1/P2 backlog from v1.11 review resolved. Security posture hardened (swallowed errors, account ID externalized, IAM scoped, schema validation, credential hygiene). Stubs resolved (kyverno --kube- version removed). 7 untested scripts gained coverage. Documentation synced (ARCHITECTURE v1.11-v1.14 addenda, stale @v1.6-1.9 -> @v1.13, GRILL G-005/G-008 resolved, COST.md window extended, D-083 deferral recorded). Platform VPC parameterized. 561 tests pass (was 528 at v1.13.2; +33). 22/22 capabilities Verified. 6 grill binding decisions (G-101..G-106) applied. 1 escalation (E-001) auto-resolved at full autonomy (D-101). ---ci--- project: acdl phase: 21 milestone: v1.14 status: complete ---/ci--- |
||
|
Jon Chery
|
6d8c098205 |
test(P70): add CAP-013 regression tests — terraform validate + dedup unit assertions (P1 remediation)
--- ci--- project: acdl phase: 70 milestone: v1.12 status: verify --- /ci--- Code review (P70) flagged 2 P1 testing gaps: 1. No end-to-end terraform validate test for the microservice (the real CAP-013 surface). A future refactor could re-break the dedup and the suite would stay green. 2. No unit test for the _child_id helper / id_remap / dedup merge. Added 6 tests (38 adapter tests total, 522 suite total): - test_microservice_dedup_names_modules_by_child_id: asserts module 'alb' + 'service' appear, expanded sub-ids do NOT. - test_microservice_dedup_rewrites_stack_outputs: service_arn -> module.service, lb_arn -> module.alb. - test_microservice_dedup_rewrites_cross_module_refs: lb_target_group_arn -> module.alb.target_group_arn (not module.alb-targetgroup). - test_microservice_emits_valid_terraform: end-to-end terraform init + validate on the microservice main.tf (locks in CAP-013). - test_single_resource_returns_id_verbatim / test_multi_resource_returns_common_prefix: unit tests for _child_id. P2 nits (noted, not fixed): the ci-vpc-apply/destroy 'if' uses != 'plan' rather than == 'full' (stricter but not exploitable); _child_id docstring could note commonprefix is character-wise. Both are post-hoc. |
||
|
Jon Chery
|
41c3377b96 |
feat(P67b): lifecycle tests default to plan-only; ACDL_LIFECYCLE_MODE flag overrides to full (REQ-134)
--- ci--- project: acdl phase: 67b milestone: v1.12 status: execute --- /ci--- The modules-lifecycle pipeline now defaults to plan-only (fast, no AWS mutation, no credentials, no cost) so it runs on every PR. A CI variable ACDL_LIFECYCLE_MODE (workflow_dispatch input 'lifecycle_mode', default 'plan') overrides to 'full' for the real apply->modify->destroy against live AWS. Scripts: run_lifecycle_test.sh / run_lifecycle_destroy.sh / run_l2_lifecycle_test.sh / run_l2_lifecycle_destroy.sh read the flag and dispatch to --plan-only (plan mode) or --apply/--destroy (full mode). Destroy is a no-op exit 0 in plan mode (nothing was applied). VPC-output injection is gated on full mode. Workflows: both .github + .gitea (byte-identical) expose lifecycle_mode as a workflow_dispatch input (choice: plan/full), pass it via env: ACDL_LIFECYCLE_MODE to every lifecycle step, skip ci-vpc-apply + ci-vpc-destroy + Read-CI-VPC-outputs in plan mode, and run the lifecycle + l2-lifecycle jobs with if: always() so they execute (plan-only) even when ci-vpc-apply is skipped. Contract + schema: pipelines/modules-lifecycle.yml gains default_mode: plan; the schema accepts default_mode (enum plan|full) and a richer workflow_dispatch inputs shape. Tests: 14 new tests in test_lifecycle_mode_flag.py (script dispatch) + 10 new tests in TestModulesLifecyclePipeline (workflow flag wiring, byte-identity, plan-mode skips). Updated test_platform_vpc_destroy to reflect the plan-mode skip. 516 tests pass; smoke-tested plan mode on the s3 module (--plan-only green, no AWS apply). |
||
|
Jon Chery
|
3e11b0fafd |
Merge milestone/v1.11-restart — v1.11 complete (stateless adapter + pipeline-driven module lifecycle testing, P56a-P65)
v1.11 closes G-005 (CAP-017..022 deploy-unverified → Verified via lifecycle pipeline) and G-008 (no cost docs → COST.md). Phases: - P56a: stateless adapter rewrite (918-line monolith → 196-line assembler) - P56b: 12 L1 module terraform subdirs authored - P57: shell orchestrator --apply/--destroy lifecycle modes - P58: single platform VPC + deterministic env-aware state keys - P59: L1 module lifecycle pipeline authored - P60: L1 lifecycle live run (retrofit — module fixes for live AWS) - P61: L2 lifecycle pipeline authored - P62: L2 lifecycle live run - P63: CAP-017..022 regression registry + COST.md - P64: pre-mortem + teardown (zero live resources) - P65: rewrite caps + decks 485 offline tests pass. All 12 requirements complete. Zero live ACDL resources remain (D-096 enforced). # Conflicts: # .ciagent/PERSONAS.md # .ciagent/REQUIREMENTS.md # .ciagent/ROADMAP.md # .ciagent/config.json |
||
|
Jon Chery
|
361fe600a9 |
feat(P61): L2 lifecycle pipeline — extend matrix + workflows + tests
Extend the modules-lifecycle pipeline with L2 composition modules (static-assets, microservice) per REQ-128: - pipelines/modules-lifecycle.yml: added l2-lifecycle-apply/modify/destroy stages + l2_modules matrix entry - .gitea/workflows/modules-lifecycle.yml + .github/workflows/modules-lifecycle.yml: added l2-lifecycle job (byte-identical), matrix over [static-assets, microservice], needs ci-vpc-apply, has apply/modify/destroy steps. ci-vpc-destroy now needs both [lifecycle, l2-lifecycle]. - schemas/modules-lifecycle-pipeline.schema.json: added l2_modules to matrix - scripts/run_l2_lifecycle_test.sh + run_l2_lifecycle_destroy.sh: L2 wrappers that set ACDL_REMOTE_STATE_KEY=spike/ci-vpc/terraform.tfstate so the microservice composition's terraform_remote_state reads from the CI VPC - adapters/terraform/adapter.py: parameterized remote_state key via ACDL_REMOTE_STATE_KEY env var (default: platform/terraform.tfstate) - modules/l2/static-assets/examples/complex.yml: fixed bucket_name to match simple (my-static-site) so terraform modifies in-place (adds CDN + WAF) - modules/l2/microservice/examples/complex.yml: fixed bucket_name to match simple (my-microservice-demo), added desired_count:2 (modify variant) - tests/test_pipeline_contract.py: 7 new L2 tests (l2 job exists, matrix lists both modules, apply/modify/destroy steps, needs ci-vpc-apply, ci-vpc-destroy needs both, contract matrix lists l2_modules) - pipelines/README.md: updated stages for L2 Regression: 485 passed, 5 deselected. Gitea + GitHub workflows byte-identical. ---ci--- project: acdl phase: P61 milestone: v1.11 status: execute ---/ci--- |
||
|
Jon Chery
|
ad3cc5f129 |
fix(ci): separate short-lived CI VPC + fix 8 module lifecycle failures
acdl-ci / Lint (pull_request) Successful in 7s
acdl-ci / Test (pull_request) Successful in 4m3s
acdl-ci / Platform check-only (offline) (pull_request) Successful in 21s
acdl-modules-lifecycle / CI VPC apply (pull_request) Failing after 1m25s
acdl-modules-lifecycle / L1 lifecycle (alb) (pull_request) Has been skipped
acdl-modules-lifecycle / L1 lifecycle (cloudfront) (pull_request) Has been skipped
acdl-modules-lifecycle / L1 lifecycle (ecr) (pull_request) Has been skipped
acdl-modules-lifecycle / L1 lifecycle (ecs-cluster) (pull_request) Has been skipped
acdl-modules-lifecycle / L1 lifecycle (ecs-service) (pull_request) Has been skipped
acdl-modules-lifecycle / L1 lifecycle (iam-role) (pull_request) Has been skipped
acdl-modules-lifecycle / L1 lifecycle (kms-key) (pull_request) Has been skipped
acdl-modules-lifecycle / L1 lifecycle (rds) (pull_request) Has been skipped
acdl-modules-lifecycle / L1 lifecycle (s3) (pull_request) Has been skipped
acdl-modules-lifecycle / L1 lifecycle (uptime) (pull_request) Has been skipped
acdl-modules-lifecycle / L1 lifecycle (vpc) (pull_request) Has been skipped
acdl-modules-lifecycle / L1 lifecycle (waf) (pull_request) Has been skipped
acdl-modules-lifecycle / CI VPC destroy (pull_request) Successful in 44s
Two architectural changes: 1. Created terraform/ci-vpc/ — a short-lived VPC for L1 module lifecycle testing, separate from the long-lived platform VPC. Created before VPC-dependent modules (alb, ecs-service, rds, uptime) are tested, destroyed after. Outputs (vpc_id, subnet_ids, sg_id, cluster_arn) are passed to those modules via scripts/run_lifecycle_test.sh + run_lifecycle_destroy.sh wrappers that inject the CI VPC outputs into the example contracts. 2. Updated the workflow to use ci-vpc-apply → lifecycle (with artifact passing) → ci-vpc-destroy (always runs). 8 module-specific fixes: - s3: unique bucket names (acdl-ci-s3a-simple/complex) instead of globally-taken 'my-simple-bucket' - kms-key: alias name with no spaces (locals.tf → alias/acdl-ci-kms) - iam-role: example contract uses role_name (not name, which the interface doesn't declare) - ecs-service: example contract uses family (not name); VPC inputs (cluster_arn, subnets, security_group) injected by CI VPC wrapper - uptime: added subnets, security_group, cluster_arn to interface + module; network_configuration is dynamic (only when subnets provided) - rds: added subnet_ids input + db_subnet_group resource (conditional on subnet_ids being non-empty) - alb: removed hardcoded placeholder sg/subnet values from examples; vpc_id + subnets + security_group injected by CI VPC wrapper - cloudfront: removed invalid placeholder WAF ARN from complex example Regression: 479 passed, 0 skipped, 5 deselected. All 24 example contracts pass --check-only. ---ci--- project: acdl phase: P59 milestone: v1.11 status: execute ---/ci--- |
||
|
Jon Chery
|
3597cf0e8f |
fix(ci): install Terraform 1.9.* in test + check-only jobs
acdl-ci / Lint (pull_request) Successful in 8s
acdl-ci / Test (pull_request) Successful in 4m8s
acdl-ci / Platform check-only (offline) (pull_request) Successful in 21s
acdl-modules-lifecycle / Platform VPC apply (pull_request) Failing after 22s
acdl-modules-lifecycle / L1 lifecycle (alb) (pull_request) Has been skipped
acdl-modules-lifecycle / L1 lifecycle (cloudfront) (pull_request) Has been skipped
acdl-modules-lifecycle / L1 lifecycle (ecr) (pull_request) Has been skipped
acdl-modules-lifecycle / L1 lifecycle (ecs-cluster) (pull_request) Has been skipped
acdl-modules-lifecycle / L1 lifecycle (ecs-service) (pull_request) Has been skipped
acdl-modules-lifecycle / L1 lifecycle (iam-role) (pull_request) Has been skipped
acdl-modules-lifecycle / L1 lifecycle (kms-key) (pull_request) Has been skipped
acdl-modules-lifecycle / L1 lifecycle (rds) (pull_request) Has been skipped
acdl-modules-lifecycle / L1 lifecycle (s3) (pull_request) Has been skipped
acdl-modules-lifecycle / L1 lifecycle (uptime) (pull_request) Has been skipped
acdl-modules-lifecycle / L1 lifecycle (vpc) (pull_request) Has been skipped
acdl-modules-lifecycle / L1 lifecycle (waf) (pull_request) Has been skipped
acdl-modules-lifecycle / Platform VPC destroy (pull_request) Failing after 22s
The ci.yml workflow's test job runs test_adapter.py which includes test_s3_instance_emits_valid_terraform — this test runs terraform init+validate as a subprocess. Previously Terraform was not installed in the CI job, causing FileNotFoundError. Now both the test and check-only jobs install Terraform 1.9.* via the HashiCorp apt repo. Reverted the skip-when-terraform-missing logic in the test — Terraform is now always available in CI. ---ci--- project: acdl phase: P59 milestone: v1.11 status: execute ---/ci--- |
||
|
Jon Chery
|
3ef3a82f9c |
fix(P59): skip terraform validate test when terraform binary not installed
acdl-ci / Lint (pull_request) Successful in 7s
acdl-ci / Test (pull_request) Successful in 1m59s
acdl-ci / Platform check-only (offline) (pull_request) Successful in 10s
acdl-modules-lifecycle / Platform VPC apply (pull_request) Failing after 23s
acdl-modules-lifecycle / L1 lifecycle (alb) (pull_request) Has been skipped
acdl-modules-lifecycle / L1 lifecycle (cloudfront) (pull_request) Has been skipped
acdl-modules-lifecycle / L1 lifecycle (ecr) (pull_request) Has been skipped
acdl-modules-lifecycle / L1 lifecycle (ecs-cluster) (pull_request) Has been skipped
acdl-modules-lifecycle / L1 lifecycle (ecs-service) (pull_request) Has been skipped
acdl-modules-lifecycle / L1 lifecycle (iam-role) (pull_request) Has been skipped
acdl-modules-lifecycle / L1 lifecycle (kms-key) (pull_request) Has been skipped
acdl-modules-lifecycle / L1 lifecycle (rds) (pull_request) Has been skipped
acdl-modules-lifecycle / L1 lifecycle (s3) (pull_request) Has been skipped
acdl-modules-lifecycle / L1 lifecycle (uptime) (pull_request) Has been skipped
acdl-modules-lifecycle / L1 lifecycle (vpc) (pull_request) Has been skipped
acdl-modules-lifecycle / L1 lifecycle (waf) (pull_request) Has been skipped
acdl-modules-lifecycle / Platform VPC destroy (pull_request) Failing after 22s
The test_s3_instance_emits_valid_terraform test runs terraform init+validate
as a subprocess. In CI, the ci.yml workflow doesn't install Terraform (only
the modules-lifecycle workflow does). The test now skips gracefully when
terraform is not on PATH, using shutil.which('terraform').
---ci---
project: acdl
phase: P59
milestone: v1.11
status: execute
---/ci---
|
||
|
Jon Chery
|
7ba72bf656 |
feat(P59): L1 module lifecycle pipeline — author workflows + schema + tests
EXECUTE stage. Authors the modules-lifecycle pipeline that matrix-tests
every L1 module's examples/{simple,complex}.yml contracts through
apply→modify→destroy against live AWS. No per-module Python.
New files:
- pipelines/modules-lifecycle.yml: declarative contract (5 stages:
platform-vpc-apply, lifecycle-apply, lifecycle-modify, lifecycle-destroy,
platform-vpc-destroy). Matrix over 12 L1 modules.
- .gitea/workflows/modules-lifecycle.yml + .github/workflows/modules-lifecycle.yml:
byte-identical workflows. 3 jobs: platform-vpc-apply (prerequisite),
lifecycle (matrix of 12 modules × apply/modify/destroy), platform-vpc-destroy
(always runs, cleanup). Triggers: pull_request to main + workflow_dispatch.
- schemas/modules-lifecycle-pipeline.schema.json: schema for the new pipeline
shape (extends pipeline.schema.json with workflow_dispatch + matrix).
Tests (tests/test_pipeline_contract.py):
- TestModulesLifecyclePipeline: 12 tests (schema valid, contract validates,
byte-identical, workflow name, 3 jobs, triggers, matrix lists all 12 L1
modules, apply/modify/destroy steps present, platform-vpc-destroy always runs).
pipelines/README.md: added modules-lifecycle to the pipeline table.
Regression: 479 passed, 0 skipped, 5 deselected (slow).
---ci---
project: acdl
phase: P59
milestone: v1.11
status: execute
---/ci---
|
||
|
Jon Chery
|
fda4564a7f |
feat(P58): single platform VPC + deterministic env-aware state keys
EXECUTE stage. Fixes the 4-VPC bug: adds a single shared VPC to
terraform/platform, drops the vpc child from the microservice composition
(references the platform VPC via data source), and makes state keys
env-aware (spike/{id}/{env}/terraform.tfstate — stable across lifecycle).
Platform VPC (terraform/platform/main.tf):
- aws_vpc.acdl_shared (10.0.0.0/16) + 2 subnets + IGW + route table + SG
- Outputs: vpc_id, subnet_ids, ecs_security_group_id
Microservice composition (modules/l2/microservice/composition.json):
- Dropped the vpc child (no per-contract VPC ever again).
- Added data_sources block: platform_vpc → terraform_remote_state (platform).
- Wires: vpc.outputs.subnet_ids → platform_vpc.outputs.subnet_ids.
- Wires: platform_vpc.outputs.vpc_id → alb.inputs.vpc_id.
- Wires: platform_vpc.outputs.ecs_security_group_id → service.inputs.security_group.
Contract resolver (core/contract_resolver.py):
- Added environment to the stack instance (stack.environment).
- Added data_sources handling: pseudo-children with outputs but no resources.
- data_sources propagated through fragment merge to the final stack instance.
Adapter (adapters/terraform/adapter.py):
- State key: spike/{stack_name}/{environment}/terraform.tfstate (env-aware).
- Emits data "terraform_remote_state" "platform" block when data_sources present.
- ref:platform_vpc.<output> → data.terraform_remote_state.platform.outputs.<output>.
Tests (tests/test_adapter.py):
- test_adapt_env_aware_state_key: spike/msvc/prod/terraform.tfstate.
- test_adapt_emits_data_source_block: data.terraform_remote_state.platform.
- test_adapt_no_vpc_for_microservice: no resource "aws_vpc" in microservice output.
- Updated existing state key assertion (spike/s3/dev/terraform.tfstate).
Regression: 467 passed, 0 skipped, 5 deselected. run_platform.sh --check-only
passes for both microservice (9 resources, no VPC) and static-assets (5 resources).
---ci---
project: acdl
phase: P58
milestone: v1.11
status: execute
---/ci---
|
||
|
Jon Chery
|
4491d0fa72 |
feat(P57): shell orchestrator lifecycle modes --apply/--destroy
EXECUTE stage. Adds --apply and --destroy modes to run_platform.sh. The shell owns all terraform lifecycle; Python never runs terraform. Changes to scripts/run_platform.sh: - Added APPLY_ONLY and DESTROY_ONLY flags to arg parsing. - --apply <contract>: resolve -> adapter -> terraform init/validate/plan/ apply -auto-approve. HITL attestation gate runs before apply for qa/prod/dr (REQ-108). Prints terraform outputs after apply. Exits with PLATFORM APPLY OK. - --destroy <contract>: resolve -> adapter -> terraform init/validate/ destroy -auto-approve. Use --decommission <CR> for gated production teardown (D-070 two-step CR validation). Exits with PLATFORM DESTROY OK. - Updated usage header to document all 5 modes (check-only, plan-only, apply, destroy, default full e2e). - Existing --check-only and --plan-only modes preserved unchanged. Tests (tests/test_pipeline.py): - test_run_platform_apply_mode_parses: --apply parses without unknown flag. - test_run_platform_destroy_mode_parses: --destroy parses without unknown flag. - test_no_python_runs_terraform_apply_or_destroy: D-101 grep assertion — no .py file in scripts/ contains 'terraform apply' or 'terraform destroy'. Regression: 464 passed, 0 skipped, 5 deselected (slow). --check-only still works (no regression in existing modes). ---ci--- project: acdl phase: P57 milestone: v1.11 status: execute ---/ci--- |
||
|
Jon Chery
|
c80060878a |
feat(P56b): author 11 L1 module terraform subdirs + fix adapter output format
EXECUTE stage. Authors the remaining 11 L1 module terraform subdirs with the full versions/variables/locals/main/outputs split. Defaults previously hardcoded in the adapter move into locals.tf. Simple single-resource modules (7): - kms-key: aws_kms_key + alias (enable_key_rotation, deletion_window defaults) - ecr: aws_ecr_repository (encryption_configuration from kms_key_arn, image_scanning) - ecs-cluster: aws_ecs_cluster (name default) - iam-role: aws_iam_role + inline_policy (assume_role_policy fallback, ECR/logs policy in locals.tf) - rds: aws_db_instance (storage_encrypted, multi_az, kms_key_arn defaults) - waf: aws_wafv2_web_acl (default_action, visibility_config, dynamic rules) - uptime: aws_ecs_task_definition + aws_ecs_service (Fargate compat, container_definitions in locals.tf) Multi-resource modules with intra-refs (4): - vpc: aws_vpc + aws_subnet + aws_internet_gateway + aws_route_table (CIDR derivation in locals.tf) - ecs-service: aws_ecs_task_definition + aws_ecs_service (Fargate compat, container_definitions, network_config in locals.tf) - alb: aws_lb + aws_lb_target_group + aws_lb_listener (subnet/security_group list derivation in locals.tf) - cloudfront: aws_cloudfront_distribution + aws_cloudfront_origin_access_control (OAC defaults in locals.tf) Registry: terraform_dir added to all 11 remaining entries. Adapter fix: stack output format uses separate 'from' + 'output' fields (not 'from': 'rid.output'). Fixed _emit_root_output to read both fields. 6 previously-skipped tests unblocked (run_platform.sh --check-only now resolves static-assets.yml through the new module-assembled adapter). Removed skip markers. Fixed test assertion (aws_s3_bucket → module). Regression: 461 passed, 0 skipped, 5 deselected (slow). All 12 modules pass run_primitive_plan.sh --check-only. All 12 terraform/ subdirs pass terraform init + validate standalone. ---ci--- project: acdl phase: P56b milestone: v1.11 status: execute ---/ci--- |
||
|
Jon Chery
|
a16e6f1bff |
feat(P56a): stateless adapter rewrite + s3 reference terraform module
EXECUTE stage. Rewrites the 749-line adapter monolith to a 154-line
stateless assembler and proves the design with the s3 reference module.
Stateless adapter (adapters/terraform/adapter.py, 749 → 154 lines):
- Deleted TYPE_MAP, INPUT_MAP, OUTPUT_MAP (3 constant tables).
- Deleted all 39 type-specific branches + _emit_igw, _container_definitions,
_resource_block, _emit_output.
- New adapt(): reads registry.json → terraform_dir → emits root main.tf
with module-instantiation blocks (module "x" { source = ... }) + ref
wiring via module.<rid>.<output> interpolations + root outputs.
- The adapter owns NO resource shape, NO nested blocks, NO defaults, NO
type-specific logic. It only assembles module instantiations and wires refs.
s3 reference terraform module (modules/l1/s3/terraform/):
- versions.tf (required_version + aws ~> 5.0)
- variables.tf (bucket_name, region, kms_key_arn, tags)
- locals.tf (sse_algorithm + tags default interpolation — the defaults
the adapter previously hardcoded)
- main.tf (aws_s3_bucket + versioning + SSE config, referencing local.*)
- outputs.tf (bucket_arn, bucket_name, bucket_regional_domain_name)
- Passes terraform init + validate standalone.
Registry (modules/registry.json): s3 entry gains terraform_dir field.
STANDARDS.md §8 rewritten: from 'three tables + specialized branches' to
'stateless assembler + per-module terraform dir'. §9.4 checklist updated.
§9.1 required-files list updated to include terraform/ subdir.
tests/test_adapter.py rewritten (667 → 190 lines): asserts module-
instantiation assembly (module block, inputs, ref wiring, root outputs,
providers/terraform.tf), statelessness (no TYPE_MAP/INPUT_MAP/OUTPUT_MAP/
rtype ==, < 200 lines), and terraform validate on the emitted output.
Deleted test_p1_1_adapter_parameterization.py (tested the deleted HCL
string emission).
6 pipeline tests skipped (run_platform.sh --check-only defaults to
static-assets.yml which needs cloudfront/waf terraform dirs — P56b).
Regression: 455 passed, 6 skipped, 5 deselected (slow). run_primitive_plan
--check-only s3 exits 0.
---ci---
project: acdl
phase: P56a
milestone: v1.11
status: execute
---/ci---
|
||
|
Jon Chery
|
7eec07fc15 |
feat(P56): IAM re-bootstrap — policy extension + IAM_POLICY.md + baseline test
Vertical slice 1 of Phase 56 (REQ-116). Offline-testable deliverables
landed; the live IAM apply step is escalated (D-095) below.
terraform/bootstrap/spike_runner_policy.json — extended with the minimum
permissions to terraform apply + probe CAP-017..022:
- cloudfront:* (CAP-020 static-assets stack)
- wafv2:* (CAP-020 WAF ACL)
- lambda:* on function:acdl-* (CAP-018 contract-ingestor)
- dynamodb:* on acdl-contracts + acdl-change-requests (CAP-017)
- secretsmanager:GetSecretValue on secret:acdl/* (CAP-018 github-token)
- sns:* on acdl-* (CAP-017 acdl-sod-halt)
- ce:Get* (REQ-119 Cost Explorer read-only)
- kms:* (CAP-017 platform + per-stack CMKs)
- iam:CreateOpenIDConnectProvider + iam:CreateRole (CAP-022 OIDC re-create)
.ciagent/IAM_POLICY.md — new baseline document. Original grants
(v1.1–v1.10) + v1.11 grants table + least-privilege scoping notes +
OIDC act_runner role plan + D-095 escalation note.
tests/test_iam_policy_baseline.py — 15 tests. Asserts the required
actions are present per service group, Lambda scoped to acdl-*, CE
read-only, no iam:PassRole to Resource:*, DynamoDB acdl-contracts in
resource. Regression-testable: any future permission drift surfaces as
a test failure at milestone COMPLETE (D-091 gate).
Test results: 15/15 pass. Full offline suite 509/509 pass (pre-existing
test_seeded_registry_runs_and_reports_honest_status in
test_verify_regression_mode.py hangs without AWS creds — environmental,
not introduced here).
---ci---
project: acdl
phase: 56
milestone: v1.11
status: execute
escalation:
type: deploy
id: D-095
reason: ACDL_BOOTSTRAP_AWS_* not set in the execution environment
blocking: live IAM policy apply (aws iam put-user-policy) + OIDC role
re-creation (CAP-022) — requires an admin AWS principal
action_required: provide fresh ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID +
ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY to the run environment, then
re-invoke ciagent-run to resume Phase 56 live step
fallback: none (D-095 confirmed: escalate to human, no silent fallback
to the deck-marking path)
---/ci---
|
||
|
Jon Chery
|
2397336cbb |
verify(P57): code review — 3 P0 auto-fixed, 2 P1+ flagged
Multi-persona review of the contract surface redesign ( |
||
|
Jon Chery
|
031887ec56 |
refactor(P57): contract surface redesign + rename + .yml repo-wide
Contract surface redesign: - New top-level fields: id (3-6 char acronym → stack.name), name (full → stack.title), infrastructure (map keyed by module name, replaces module:) - Drop uses: field (dead reference; version pin lives in CI workflow uses: line) - Drop top-level module/inputs (now nested under infrastructure map) - Per-module optional version (defaults to latest published from registry) - Multi-module contracts: one file deploys N modules in one pipeline run, resource IDs namespaced with module name to avoid collisions - stack.schema.json: add optional title field for display name Rename: - pipelines/deploy.yaml → pipelines/contract.yml (declarative spec, not a pipeline) - pipelines/ci.yaml → pipelines/ci.yml - All 44 .yaml files → .yml repo-wide (contracts, module examples, kyverno policies) - .acdl/contract.yaml → .acdl/contract.yml Resolver (core/contract_resolver.py): - Rewrite resolve() to loop infrastructure map, default version to latest, merge module fragments into one stack with namespaced resource IDs - _latest_version() picks highest non-deprecated from registry - _namespace_resources() prefixes IDs + rewrites ref: expressions for multi-module - Single-module path: unprefixed IDs (backward compatible) Verification: - 494 tests pass (0 contract-shape failures) - Local E2E passes (contract → resolver → adapter → local ECS HTTP 200 → outbox) ---ci--- project: acdl phase: 57 milestone: v1.10.2 status: execute ---/ci--- |
||
|
Jon Chery
|
44d1d19cfd |
fix(P54): capability re-verification sweep — 16/16 Verified, 7 adapter defects fixed
The v1.1-v1.8 capability re-verification sweep (D-093) found and fixed
7 adapter defects in adapters/terraform/adapter.py that had prevented
the headline E2E from running against live AWS since the v1.7/v1.8
platform simplification. All 16 auto-verifiable capabilities are now
Verified.
Defects fixed in-sweep (D-090: no cap):
1. Duplicate output definitions (per-resource + stack-level both emitted).
2. Duplicate desired_count/launch_type on ECS service.
3. Duplicate target_type/family/load_balancer_type.
4. Missing assume_role_policy/role_name on IAM role (L2 composition gap).
5. Missing cidr_block/vpc_id/name defaults on VPC/subnet/route_table/
ECS cluster/ECR repository.
6. ECR kms_key_arn unsupported arg -> encryption_configuration block.
7. CloudFront OAC + WAF deprecated arg names (AWS provider v5):
signing_behavior, signing_protocol, origin_access_control_id,
s3_origin_config.origin_access_identity, origin_id, rule (singular),
scope=CLOUDFRONT (uppercase).
New live-AWS capability checks (CAP-013..CAP-016):
- terraform init+validate+plan live AWS (microservice): 14 resources, OK
- terraform init+validate+plan live AWS (static-assets): CloudFront+WAF+S3, OK
- DynamoDB outbox table: exists, 9 items
- S3 state bucket: exists, keys=[spike/l2-microservice/terraform.tfstate]
6 IAM-gated cloud resources (CAP-017..CAP-022: contracts table, Lambda,
ECS service, CloudFront stack, uptime-kuma, OIDC role) are documented
as escalated: the spike-runner lacks the IAM permissions to verify
them (chicken-and-egg). The terraform plan path proves the code would
deploy them; the local emulators prove the runtime behavior.
Verified: 513 fast tests pass. run_regression.sh reports 16/16
Verified (was 12; +4 live-AWS). terraform init+validate+plan succeeds
against live AWS for both contracts. No regressions.
---ci---
project: acdl
phase: 54
milestone: v1.10
status: verify
requirements:
covered: [REQ-114]
partial: []
decisions: [D-090, D-093]
regression:
- { capability: CAP-013, status: Verified }
- { capability: CAP-014, status: Verified }
- { capability: CAP-015, status: Verified }
- { capability: CAP-016, status: Verified }
---/ci---
|
||
|
Jon Chery
|
217653d6f4 |
feat(P53): local emulating adapters (D-092) — full local E2E, no AWS
The platform is now fully locally testable without cloud credentials.
The headline E2E (contract -> resolver -> adapter -> S3 state -> ECS
service -> DynamoDB outbox -> contract-ingestor Lambda) runs end-to-end
against the local emulating tier (D-092, REQ-113).
Four local emulating adapters in core/local_emulators.py:
- FlatFileOutbox: flat-file DynamoDB outbox emulator (hash-chained JSONL;
resumable across instances; chain verification).
- LocalEcsEmulator: local ECS Fargate HTTP 200 emulator (free-port
binding on 127.0.0.1; health check; clean destroy).
- LocalS3StateBackend: rewrites the terraform S3 backend to a local
backend (per-stack tfstate in a temp folder).
- LocalLambdaStub: invokes the contract_ingestor handler in-process
(patches _get_dynamodb / _get_secrets_client / urllib.urlopen;
DynamoDB writes redirected to the FlatFileOutbox).
run_platform.sh gains a --local flag that short-circuits to the local
emulating tier (no AWS, no Checkov, no DynamoDB).
Regression gate (D-091) now covers 12 capabilities (was 10): +CAP-011
(local E2E microservice) + CAP-012 (local E2E static-assets).
Verified: 513 fast tests pass (was 502; +11 new). 2 slow local E2E
tests pass. run_regression.sh reports 12/12 Verified. run_platform.sh
--local exits 0 with LOCAL E2E OK. No AWS credentials required.
---ci---
project: acdl
phase: 53
milestone: v1.10
status: verify
requirements:
covered: [REQ-113]
partial: []
decisions: [D-092]
regression:
- { capability: CAP-011, status: Verified }
- { capability: CAP-012, status: Verified }
---/ci---
|
||
|
Jon Chery
|
9897df04b2 |
fix(P52): add regression-class VERIFY (D-091) — catches capability decay
The prior VERIFY stage was diff-scoped: it checked the phase diff only
and never re-ran underlying platform capability. This structural defect
(D-091) let 8 NFR-patch phases (v1.9.1-v1.9.8, deck rework) pass VERIFY
while the platform they described decayed underneath.
Phase 52 remediation:
- core/regression_verify.py: regression-class VERIFY with 10 seeded
local-tier capability checks (CAP-001..CAP-010). Tags each
Verified/Decayed/Broken; fails closed on any non-Verified.
- scripts/run_regression.sh: shell wrapper; writes
.ciagent/REGRESSION_REPORT.{md,json}; exits non-zero on decay.
- tests/test_verify_regression_mode.py: 11 tests (8 fast + 3 slow).
Confirms the gate catches decay (fails closed) and that regression
mode is additive (diff-scoped VERIFY behavior preserved).
- pyproject.toml: slow marker registered; run_ci.sh excludes slow
tests to avoid recursion.
Verified: 502 fast tests pass (was 493 at v1.9; +9 new). 3 slow
integration tests pass. run_regression.sh reports all 10 seeded
local-tier capabilities Verified against current code. The
decay-surfacing test injects a broken cloud-backed check and confirms
the run tags it Broken and fails closed.
Cloud-backed capability re-verification (live ECS, DynamoDB writes,
Lambda invocation) lands in Phase 54 (D-093).
---ci---
project: acdl
phase: 52
milestone: v1.10
status: verify
requirements:
covered: [REQ-112]
partial: []
decisions: [D-091]
regression:
- { capability: CAP-001, status: Verified }
- { capability: CAP-002, status: Verified }
- { capability: CAP-003, status: Verified }
- { capability: CAP-004, status: Verified }
- { capability: CAP-005, status: Verified }
- { capability: CAP-006, status: Verified }
- { capability: CAP-007, status: Verified }
- { capability: CAP-008, status: Verified }
- { capability: CAP-009, status: Verified }
- { capability: CAP-010, status: Verified }
---/ci---
|
||
|
Jon Chery
|
7585c828f0 |
docs(P48): vision gaps + badge system + substrate→engine + CR format + agentic tags
9 requirements implemented across presentation decks and project docs: 1. DX closing slide: added 'Infrastructure as a utility, not a craft' bullet to convey the full vision (infrastructure consumed, not maintained; platform compounds value over time). 2. PW Problem slide: 'moving a merged change' → 'promoting a change'. 3. PW Problem slide: added 'Red tape' and 'Scalability without increasing headcount' bullets (4 frictions, not 2). 4. PW Roadmap slide: redesigned with side-by-side HTML table layout (Testing | Planned), 16px font, no overflow. 5. PW deck: added new slide 'What This Platform Is — and Isn't' after North Star (sovereign boundary, infrastructure as utility, 4 anti-goals). PW deck now 16 slides (was 15). 6. Maturity nomenclature: 'Available today'/'shipped' → 'Testing' across both decks + source markdown. New .testing badge (blue/teal #DBEAFE). Roadmap title: 'Testing vs. Planned'. The platform has 0 consumer adoption — 'shipped' was inaccurate. 7. Global: 'substrate' → 'engine' across entire project (88 matches, 30+ files including .ciagent/, docs/, modules/, adapters/, schemas/, code). 8. Presentation files only: 'forge' → 'VCS' / 'version control system' (6 occurrences in 4 files). 'forge' retained in all technical docs and code as the industry-standard term. 9. New .agentic badge (purple/violet #EDE9FE) appended to agentic features in both decks: confidence signal, autonomous dev, pattern recognition, dynamic module creation, citizen developer surface, auto-promotion. Also: Change Request ID format changed from 'CR-2026-001' to 'CHG0678912' across presentation files, consumer guide, and test fixtures. HTML re-rendered. PPTX rendered for release upload. ---ci--- phase: 48 milestone: v1.9 status: complete requirements: covered: [] partial: [] ---/ci--- |
||
|
Jon Chery
|
6e41f09c6e |
verify(P43): code review — 1 P0 auto-fixed, 1 P1 auto-fixed, 3 P1 flagged
---ci--- phase: 43 milestone: v1.9 status: verify lessons: - P0 fix: run_platform.sh HITL gate passed approver via string interpolation into Python (GITHUB_ACTOR injection vector) — fixed by passing env vars (ACDL_HITL_*) read via os.environ - P1 fix: attestation_matrix._is_fresh accepted future-dated artifacts (negative age bypassed freshness) — fixed with negative-age guard + test - P1 flagged: WizClient._post does not check GraphQL errors (silent empty-list mask) - P1 flagged: WizClient._post no SSRF validation on WIZ_API_URL - P1 flagged: contract_resolver._load_env duplicates environment_check.load (can drift) ---/ci--- Multi-persona review of the v1.9 diff (v1.8.0..HEAD). Review pass 2 (post-complete) caught issues the initial self-review missed: P0-INJECT (auto-fixed): scripts/run_platform.sh Step 7b interpolated $APPROVER (GITHUB_ACTOR/GITEA_ACTOR) directly into a Python string literal — an attacker-controllable username containing shell/python metacharacters would execute arbitrary Python. Fixed: approver, contract id, and env are now passed as environment variables to the subprocess and read via os.environ[...] (no string interpolation). P1-FRESHNESS (auto-fixed): core/attestation_matrix.py _is_fresh accepted future-dated artifacts (negative age.days <= window_days). Fixed: added age.total_seconds() < 0 guard rejecting future timestamps. Test added: test_freshness_rejects_future_dated_artifact. 3 P1 flagged for post-hoc: - WizClient._post does not surface GraphQL errors (silent empty mask) - WizClient._post no SSRF validation on WIZ_API_URL (operator-supplied, low risk) - contract_resolver._load_env duplicates environment_check.load (drift risk) REVIEW.md updated with the findings. 494 tests pass; run_ci.sh + run_platform.sh --check-only green. |
||
|
Jon Chery
|
5365bb4e0a |
docs(milestone): complete v1.9 — verify + review + audit + tag v1.9.0
---ci--- project: acdl phase: 0 milestone: v1.9 status: complete requirements: covered: [REQ-100, REQ-101, REQ-102, REQ-103, REQ-104, REQ-105, REQ-106, REQ-107, REQ-108, REQ-109, REQ-110, REQ-111] partial: [] ---/ci--- v1.9 milestone COMPLETE. All 12 requirements satisfied. Verify: 4 layers PASS (structural 26/26 files, behavioral 493 tests + run_ci.sh + run_platform.sh --check-only green, security, quality). Review: 0 P0, 0 P1 (READY TO SHIP). REVIEW.md reconstructed (D-086). Audit: PASS (reconstruction, file discipline, branch hygiene, commit discipline — 12/12 commits with ---ci--- blocks). Updated: - .ciagent/REQUIREMENTS.md: v1.9 section marked complete; traceability table REQ-100..111 added. - .ciagent/ROADMAP.md: v1.9 marked complete; Phase 43 added. - .ciagent/PROJECT.md: v1.9 objective marked complete. - .ciagent/config.json: milestone v1.9 status -> complete. - .ciagent/REVIEW.md: reconstructed with v1.9 content (D-086). - .ciagent/VERIFY.md: v1.9 4-layer verify. - .ciagent/AUDIT.md: v1.9 audit (PASS). - uses:/ref: bumped @v1.6 -> @v1.9 in contracts/, deploy workflows, docs/consumer-guide.md (D-071 successor). Tag v1.9.0 created next; floating v1.9 + v1 tags updated. |