932923ee99
merge(milestone): v1.29 Reposplit + Identity Layer Bring-Live to main (release v1.28.6)
...
Nova Slides Render / render (push) Failing after 22s
---ci---
project: acdl
phase: 6
milestone: v1.29
status: complete
---/ci---
2026-08-20 05:29:46 +00:00
9bac2685cb
feat(P03 W7): secret rotation scheduled workflow (SPEC §5.9)
...
workflows-src/rotate-aws-key.yml — daily cron (0 0 * * *) + workflow_dispatch,
wraps scripts/rotate_spike_key.sh (uses NOVA_AWS_* static-key auth to IAM-
rotate the nova-spike-runner key; uploads the new key to the consumer's
Actions secret store; idempotent — deactivates the old key only after the
new propagates, verified by a post-PUT GET). Synced to .github + .gitea.
v0.2 scope: the mechanism exists (SPEC §5.9 — exists-not-ran); the v0.2
deploy uses the currently-active key. Documented in ARCHITECTURE.md §12.9.
The synced workflow file is forge-agnostic (REQ-230): forge base URL /
owner / consumer repo come from repository secrets (NOVA_FORGE_*,
NOVA_CONSUMER_REPO), not literals. rotate_spike_key.sh reads NOVA_FORGE_*
with NOVA_GITEA_* backward-compat fallback. sync_workflows.py PAIRS
extended to include rotate-aws-key.yml (was hardcoded to 3 pairs).
---ci---
project: acdl
phase: 3
milestone: v1.26
status: execute
wave: W7
---
2026-08-18 23:39:34 +00:00
e15eea067b
docs(milestone): complete v1.15 — Nova Rebrand (tag v1.15.4)
...
P5 final-review-ship complete: dual-read fallback removed (REQ-164) —
core/env.py NOVA-only, .env.secrets load paths NOVA-only (G-106 retired),
nova_tagging.py hard-fails any acdl:* tag, legacy ACDL_* Gitea secrets
deleted, ACDL_LIFECYCLE_MODE/ACDL_LOCAL_TIER/ACDL_HITL_* exports removed
from scripts, SNS subject → Nova SoD halt (P1-2), bootstrap scripts
NOVA-only. Review: 2 P0 auto-fixed (duplicate delenv), P1-1/P1-2 resolved,
doc-drift fixed. Audit: tags v1.15.0-4 exist; traceability REQ-155..164
all complete; ARCHITECTURE naming table matches codebase. 615 pytest PASS;
run_ci.sh 3-stage PASS. NOVA_MIGRATION.md marked COMPLETE.
---ci---
project: acdl
phase: 5
milestone: v1.15
status: complete
phase_role: final
requirements:
covered: [REQ-155, REQ-156, REQ-157, REQ-158, REQ-159, REQ-160, REQ-161, REQ-162, REQ-163, REQ-164]
partial: []
---/ci---
2026-07-30 02:23:55 +00:00
0e6ecae26d
feat(P4): Nova rebrand — AWS resource migration (REQ-163)
...
Rename all acdl-* AWS resources → nova-* across terraform (DynamoDB,
Secrets Manager, Lambda, SNS, SG, KMS alias, ECS, ECR, IAM user/policy,
state bucket, ALB, VPC/subnet names). Lambda default table names → nova-*
(D-111). State bucket backend → nova-tfstate (-migrate-state documented).
New docs/NOVA_AWS_MIGRATION.md runbook (staged migration + rollback).
New scripts/migrate_dynamodb_data.py (scan+copy, dry-run default).
acdl-deploy- → nova-deploy- role ARN in deploy workflows. Test fixtures
updated; terraform validate + pytest + run_ci.sh PASS.
---ci---
project: acdl
phase: 4
milestone: v1.15
status: execute
---/ci---
2026-07-30 01:54:26 +00:00
d5bae868a4
feat(P2): Nova rebrand — code/env-vars/consumer-path (REQ-158/159/160)
...
core/env.py dual-read helper (D-108); 21 ACDL_*→NOVA_* env vars migrated
across core/scripts/adapters/tests/workflows + .env/.env.secrets (key
rename, values stay). G-106 binding: run_platform.sh:288-289 +
regression_verify.py:309-312 dual-read (NOVA first, ACDL fallback).
G-108 binding: Gitea NOVA_* secrets created via API + workflow secrets:
refs updated (deploy.yml + modules-lifecycle.yml, .gitea + .github).
acdl_tagging.py→nova_tagging.py (D-109 warn mode, nova:* enforced).
.acdl/→.nova/ consumer path (resolver + deploy workflow + schema +
tests + docs). Test fixtures updated; pytest + run_ci.sh PASS.
---ci---
project: acdl
phase: 2
milestone: v1.15
status: execute
---/ci---
2026-07-30 01:25:24 +00:00
3b1181f39b
Merge milestone/v1.14-refinement — v1.14 complete (NFR Refinement: bug fixes, security, stubs, tests, docs; 20 phases + final; tag v1.13.24)
...
acdl-ci / Lint (push) Successful in 10s
acdl-ci / Platform check-only (offline) (push) Successful in 25s
acdl-ci / Test (push) Successful in 6m34s
v1.14 NFR Refinement milestone complete. 20 execution phases (P1-P20) +
1 final (P21). All P1/P2 backlog from v1.11 review resolved. Security
posture hardened (swallowed errors, account ID externalized, IAM scoped,
schema validation, credential hygiene). Stubs resolved (kyverno --kube-
version removed). 7 untested scripts gained coverage. Documentation
synced (ARCHITECTURE v1.11-v1.14 addenda, stale @v1.6-1.9 -> @v1.13,
GRILL G-005/G-008 resolved, COST.md window extended, D-083 deferral
recorded). Platform VPC parameterized.
561 tests pass (was 528 at v1.13.2; +33). 22/22 capabilities Verified.
6 grill binding decisions (G-101..G-106) applied. 1 escalation (E-001)
auto-resolved at full autonomy (D-101).
---ci---
project: acdl
phase: 21
milestone: v1.14
status: complete
---/ci---
2026-07-29 21:36:37 +00:00
1d5c4d2ae7
phase: 8, status: plan-as-execute, persona: platform-engineer+lead-developer, task: T-8.5..T-8.7
...
---ci---
project: acdl
phase: 8
milestone: v1.1
status: plan-as-execute
persona: platform-engineer+lead-developer
task: [T-8.5, T-8.6, T-8.7]
requirements.covered: [REQ-23]
---/ci---
Waves 3+4: rotation script + verify script + README + .gitignore.
- T-8.5 (platform): scripts/rotate_spike_key.sh - boto3 with bootstrap
root key from env (ACDL_BOOTSTRAP_AWS_*); creates new key for
acdl-spike-runner, deactivates+deletes old, writes new to gitignored
.env.secrets (chmod 600); idempotent (re-run ends with exactly 1
active key); optional Gitea secret upload if ACDL_GITEA_TOKEN set;
does NOT rotate the root key (D-034 closure = manual user step).
- T-8.6 (lead): scripts/verify_phase08.sh - loads rotated key from
.env.secrets, asserts caller identity is acdl-spike-runner (not root),
S3 bucket + DynamoDB table + IAM user + scoped policy with
DenyEverythingElse all present, .env.secrets + .bootstrap_state.json
gitignored. Uses heredoc python to avoid bash quoting issues.
- T-8.7 (lead): terraform/bootstrap/README.md runbook (6 steps incl.
manual D-034 root-key rotation) + .gitignore (.env.secrets +
.bootstrap_state.json). Spike vs v1.2 boundary table.
bash -n + gitignore checks pass.
2026-07-21 19:00:08 +00:00
CIAgent Orchestrator