3a43205c48
chore(P02 W3): create v1.25 floating tag → v1.25.0 (cross-cutting deploy.yml ref)
...
The consumer's deploy.yml uses acdl/.github/workflows/deploy.yml@v1.25
(a versioned floating tag, not @main). The v1.25 tag was missing — only
v1.25.0 (P0 ship) and v1.25.1 (P1 ship) existed. Per PLAN.md Task 3.1
fallback, created v1.25 → v1.25.0 and pushed to origin. Unblocks P2 W2
deploy workflow invocation (REQ-314).
---ci---
project: acdl
phase: 2
milestone: v1.26
status: execute
phase_role: execution
wave: 3
decision: floating_tag_created
ref: v1.25
points_at: v1.25.0
requirements: [REQ-314]
---/ci---
2026-08-18 00:23:21 +00:00
9f94103c57
feat(P02 W0): dynamodb L1 primitive — interface, terraform, registry, tests (REQ-322)
...
New L1 module modules/l1/dynamodb/ (stack type aws:dynamodb:table).
Terraform aws_dynamodb_table with PK + optional SK, PAY_PER_REQUEST
default, SSE-KMS + PITR + prevent_destroy per v1.8 NFR defaults.
Registry entry (kind l1), catalog row, test_adapter.py updated to
15 entries / 13 L1. 45 tests passing.
---ci---
project: acdl
phase: 2
milestone: v1.26
status: execute
phase_role: execution
wave: 0
requirements: [REQ-322]
---/ci---
2026-08-18 00:22:19 +00:00
d022ddcea6
docs(P02): reconcile checkpoint — P1 complete (v1.25.1), advance to P2 execute
...
---ci---
project: nova-blockchain-exchange
phase: 2
milestone: v1.26
status: execute
phase_role: execution
checkpoint: reconciled
---/ci---
2026-08-18 00:21:10 +00:00
78da051b60
merge(phase/01): v1.26 P1 blockchain-core complete (REQ-310,311,312)
...
Nova Slides Render / render (push) Failing after 33s
---ci---
project: nova-blockchain-exchange
phase: 1
milestone: v1.26
status: complete
phase_role: execution
tag: v1.25.1
requirements: [REQ-310, REQ-311, REQ-312]
---/ci---
2026-08-14 19:25:12 +00:00
ddf88202fc
docs(P01): execute — v1.26 blockchain-core (REQ-310,311,312)
...
---ci---
project: nova-blockchain-exchange
phase: 1
milestone: v1.26
status: execute
phase_role: execution
requirements: [REQ-310, REQ-311, REQ-312]
---/ci---
2026-08-13 18:34:22 +00:00
2ee541f40e
docs(ship): P0 complete — v1.25.0 released (id 690)
...
---ci---
project: acdl
phase: 0
milestone: v1.26
status: complete
phase_role: pre_execution
tag: v1.25.0
release_id: 690
---/ci---
2026-08-12 21:21:23 +00:00
d391cdf0f7
merge(phase/00): v1.26 P0 specify→clarify→research→ideate→plan→grill complete
...
Nova Slides Render / render (push) Failing after 19s
---ci---
project: acdl
phase: 0
milestone: v1.26
status: complete
phase_role: pre_execution
tag: v1.25.0
requirements: [REQ-310..REQ-322]
---/ci---
2026-08-12 21:20:33 +00:00
cf8aa53c8d
docs(P00): grill — v1.26 adversarial review (9 challenges, PROCEED 0.84, 2 revisions)
...
---ci---
project: acdl
phase: 0
milestone: v1.26
status: grill
verdict: PROCEED
confidence: 0.84
revisions: [G-Q4 REQ-322 to P2 W0, G-Q6 enforcement-deferred note, G-Q9 key-split future item]
---/ci---
2026-08-12 21:20:11 +00:00
270b1f11a3
docs(P00): create phase plans — v1.26 (5 phases, 13 reqs, wave-ordered, persona-assigned)
...
---ci---
project: acdl
phase: 0
milestone: v1.26
status: plan
phases: 5
requirements: [REQ-310..REQ-322]
revision: REQ-322 moved to P2 W0 (before contract, for registry resolution)
---/ci---
2026-08-12 21:19:06 +00:00
2a4d7b7625
docs(P00): ideate — v1.26 (7 ideas accepted, 3 deferred, 0 rejected)
...
---ci---
project: acdl
phase: 0
milestone: v1.26
status: ideate
ideas_accepted: [I1..I7]
ideas_deferred: [I8, I9, I10]
---/ci---
2026-08-12 21:17:39 +00:00
707d8a1e39
docs(P00): research findings — v1.26 (PoA blockchain, deploy model, DynamoDB gap, personas)
...
---ci---
project: acdl
phase: 0
milestone: v1.26
status: research
requirements: [REQ-310..REQ-322]
personas: [lead-developer, backend-engineer, data-engineer, policy-engineer, blockchain-engineer]
---/ci---
2026-08-12 21:16:42 +00:00
50e77e6314
docs(P00): clarify — v1.26 ambiguities resolved (10 Qs, 8 new decisions)
...
---ci---
project: acdl
phase: 0
milestone: v1.26
status: clarify
decisions: [D-206..D-213]
---/ci---
2026-08-12 21:12:43 +00:00
a0a658bc9a
docs(init): validate specification — v1.26 Live Pilot Estate Activation
...
---ci---
project: acdl
phase: 0
milestone: v1.26
status: specify
projects: [acdl, nova-blockchain-exchange]
requirements: [REQ-310..REQ-321]
---/ci---
2026-08-12 21:11:51 +00:00
f844feab7f
chore(bootstrap): migrate ACDL_* env vars to NOVA_* (complete the v1.15 P5 rename)
acdl-ci / Lint (push) Successful in 11s
acdl-ci / Platform check-only (offline) (push) Successful in 25s
acdl-ci / Test (push) Failing after 44s
Nova Slides Render / render (push) Failing after 16s
2026-08-12 21:09:11 +00:00
8c68d683c6
test(metrics): fix attestation-event test freshness time-bomb (use now vs hardcoded date)
acdl-ci / Lint (push) Successful in 12s
acdl-ci / Platform check-only (offline) (push) Successful in 31s
acdl-ci / Test (push) Failing after 47s
2026-08-12 21:07:50 +00:00
be967783b4
docs(milestone): complete v1.25 — kyverno-json Unified Policy Engine
...
acdl-ci / Lint (push) Successful in 11s
acdl-ci / Platform check-only (offline) (push) Successful in 26s
acdl-ci / Test (push) Failing after 43s
19 requirements (REQ-291..309) complete. 6 phases (P0 + P1..P4 + P5).
Tag v1.24.5 (gitea release id 645, the v1.25 milestone release).
Merged milestone/v1.25-kyverno-json to main. All milestone branches deleted.
NORTH_STAR.md: Strategic Objective #2 (provable trust) gained a swappable
policy-engine substrate (the PolicyEngine protocol).
---ci---
project: acdl
milestone: v1.25
status: complete
requirements:
covered: [REQ-291, REQ-292, REQ-293, REQ-294, REQ-295, REQ-296, REQ-297, REQ-298, REQ-299, REQ-300, REQ-301, REQ-302, REQ-303, REQ-304, REQ-305, REQ-306, REQ-307, REQ-308, REQ-309]
partial: []
---/ci---
2026-08-12 18:50:45 +00:00
730109dd0c
merge(milestone): v1.25 kyverno-json Unified Policy Engine to main
...
acdl-ci / Lint (push) Successful in 10s
acdl-ci / Platform check-only (offline) (push) Successful in 27s
acdl-ci / Test (push) Failing after 48s
Milestone v1.25 complete. Tag v1.24.5 (the v1.25 release per the prev-minor
tagging rule). 19 requirements (REQ-291..309). 6 phases. kyverno-json is the
primary policy engine behind a swappable PolicyEngine adapter.
---ci---
project: acdl
milestone: v1.25
status: complete
---/ci---
2026-08-12 18:49:32 +00:00
78688b968c
merge(phase/05): v1.25 final review+audit+ship complete
...
Nova Slides Render / render (push) Failing after 27s
v1.25 kyverno-json Unified Policy Engine — milestone complete.
19 requirements (REQ-291..309), 6 phases (P0 + P1..P4 + P5).
Tags v1.24.0..v1.24.5 on the v1.24.x line.
Review: 1 P0 fixed (heredoc), 3 P1 fixed (meta-policy wiring, tests, smoke).
Audit: reconstruction PASS, branch hygiene clean.
---ci---
project: acdl
phase: 5
milestone: v1.25
status: complete
phase_role: final
---/ci---
2026-08-12 18:49:20 +00:00
7e98debd70
verify(P5): audit PASS — reconstruction test (git log ↔ .ciagent), branch hygiene, commit discipline
...
---ci---
project: acdl
phase: 5
milestone: v1.25
status: verify
phase_role: final
---/ci---
2026-08-12 18:49:20 +00:00
255cde5002
verify(P5): review fixes — wire Step 5c meta-policies + fix smoke policy (P1-1, P1-2, P1-3)
...
P1-1 (correctness): run_platform.sh Step 5c now invokes the meta-policies
(block-on-any-critical, tagging-rules-agree) over the merged PCR list after
Step 5b, appending the meta-PCRs to pcr.json before the confidence signal
runs. Closes the D-118/D-119 declarative-critical-block gap (the
confidence_signal.py hard-override stays as defense-in-depth).
P1-2 (testing): test_meta_policies.py behavioral assertions strengthened —
test_no_critical_passes asserts no fails, test_critical_fail_present asserts
a non-pass result, test_pcrs_validate_against_schema validates output.
P1-3 (correctness): _smoke.json assertion rewritten from malformed
'{{ to_string(@) }}' to valid JMESPath '(regex_match(...))'.
---ci---
project: acdl
phase: 5
milestone: v1.25
status: execute
phase_role: final
---/ci---
2026-08-12 18:49:06 +00:00
2cc76f4f94
verify(P0): code review — security+correctness — fix Step 5b heredoc shell-var injection
...
The Step 5b kyverno-json block used a single-quoted heredoc (<<'PY') but
referenced $WORK and $CONTRACT_ID inside the Python body as literal
strings — neither variable expanded, so kj scan ran against the literal
filename "$WORK/tfshow.json" (FileNotFoundError) and recorded contractId
"$CONTRACT_ID" verbatim. The entire Step 5b plan-JSON policy pass was
silently broken whenever kj was installed (it only "worked" in the
kj-absent skip path, which the tests exercise).
Fix: pass the two values as argv (python3 - "$WORK/tfshow.json"
"$CONTRACT_ID" <<'PY') and read them via sys.argv. This preserves the
single-quoted heredoc (no shell expansion into Python source — avoids a
payload-injection vector if $CONTRACT_ID ever contained a quote) while
correctly threading the values into the engine.
---ci---
project: acdl
phase: 5
milestone: v1.25-kyverno-json
status: verify
lessons:
- P0 fix applied: Step 5b heredoc <<'PY' prevented $WORK/$CONTRACT_ID
expansion → kj scan read literal filename, Step 5b silently broken
whenever kj installed. Re-threaded via sys.argv (also closes a
payload-injection vector vs naively unquoting the heredoc).
---/ci---
2026-08-12 18:46:45 +00:00
9acf23926d
docs(ship): P4 complete — v1.24.4 released (id 644)
...
---ci---
project: acdl
phase: 4
milestone: v1.25
status: complete
ship: v1.24.4 (gitea release id 644)
---/ci---
2026-08-12 18:43:39 +00:00
b41e24e068
merge(phase/04): v1.25 P4 regression-gate+docs complete
...
Nova Slides Render / render (push) Failing after 27s
---ci---
project: acdl
phase: 4
milestone: v1.25
status: complete
phase_role: execution
---/ci---
2026-08-12 18:43:04 +00:00
ad522e6bf7
verify(P4): 4-layer verify PASS — regression-gate policies + docs, 0 regressions
...
---ci---
project: acdl
phase: 4
milestone: v1.25
status: verify
phase_role: execution
requirements:
covered: [REQ-304, REQ-305, REQ-306, REQ-307]
partial: []
---/ci---
2026-08-12 18:43:04 +00:00
38b51f3e6d
feat(P4): regression-gate policies + docs (REQ-304..307)
...
regression/ policies (3): cap-013-adapter-dedup, cap-023-metrics-collector,
cap-024-deck-structure — declarative mirrors of core/regression_verify.py
over capability-inventory JSON. The imperative regression_verify.py is kept
(drives CI gate); the policies are the declarative mirror (IDEATE I1 quality
improvement).
tests: test_regression_policies.py + clean/drifted fixtures. Skip-without-kj.
docs: adapters/README.md (new kyverno-json row + PolicyEngine Protocol
section with how-to-add-OpaEngine), adapters/kyverno-json/README.md (engine,
install, policy directory layout, 4 categories, severity convention),
schemas/README.md (D-116 engine enum reuse note), modules/STANDARDS.md §10
Policy Authoring Standard, docs/METRICS.md (swappable engine narrative).
---ci---
project: acdl
phase: 4
milestone: v1.25
status: execute
phase_role: execution
requirements:
covered: [REQ-304, REQ-305, REQ-306, REQ-307]
partial: []
---/ci---
2026-08-12 18:42:55 +00:00
89f62c85ab
docs(ship): P3 complete — v1.24.3 released (id 643)
...
---ci---
project: acdl
phase: 3
milestone: v1.25
status: complete
ship: v1.24.3 (gitea release id 643)
---/ci---
2026-08-12 18:31:02 +00:00
96d4677fac
merge(phase/03): v1.25 P3 plan-JSON+meta+pipeline complete
...
Nova Slides Render / render (push) Failing after 22s
---ci---
project: acdl
phase: 3
milestone: v1.25
status: complete
phase_role: execution
---/ci---
2026-08-12 18:30:45 +00:00
863484e681
verify(P3): 4-layer verify PASS — plan-JSON + meta + pipeline, 0 regressions
...
---ci---
project: acdl
phase: 3
milestone: v1.25
status: verify
phase_role: execution
requirements:
covered: [REQ-300, REQ-301, REQ-302, REQ-303]
partial: []
---/ci---
2026-08-12 18:30:45 +00:00
7f4b79593a
feat(P3): plan-JSON policies + meta-orchestration + pipeline wiring (REQ-300..303)
...
plan-json/ policies (3): forbid-plaintext-secrets (ports CKV_AWS_41/45/46),
forbid-iam-wildcard (ports CKV_AWS_1/40), require-kms-reference (ports
CKV_AWS_7/33) over terraform show -json output.
meta/ policies (2): block-on-any-critical (declarative source of truth for
critical-block; confidence_signal hard-override stays as defense-in-depth,
D-119) + tagging-rules-agree (cross-checks Checkov NOVA_TAG_NAMING vs kj
KJ_REQUIRE_TAGGING_STANDARD, D-118).
scripts/run_platform.sh Step 5b: parallel kyverno-json plan-JSON pass; merges
Checkov/Wiz + kj PCR lists into the confidence signal policy input; skips
gracefully when kj absent (D-120).
tests: test_plan_json_policies.py, test_meta_policies.py (skip-without-kj),
test_run_platform_plan_json_policies.py (script-substring assertion, no skip).
---ci---
project: acdl
phase: 3
milestone: v1.25
status: execute
phase_role: execution
requirements:
covered: [REQ-300, REQ-301, REQ-302, REQ-303]
partial: []
---/ci---
2026-08-12 18:29:34 +00:00
35e3de401e
docs(ship): P2 complete — v1.24.2 released (id 642)
...
---ci---
project: acdl
phase: 2
milestone: v1.25
status: complete
ship: v1.24.2 (gitea release id 642)
---/ci---
2026-08-12 18:27:17 +00:00
814d45b211
merge(phase/02): v1.25 P2 contract+stack-IR policies complete
...
Nova Slides Render / render (push) Failing after 22s
---ci---
project: acdl
phase: 2
milestone: v1.25
status: complete
phase_role: execution
---/ci---
2026-08-12 18:26:40 +00:00
0f0d9b9145
verify(P2): 4-layer verify PASS — contract+stack-IR policies, resolver wiring, 0 regressions
...
---ci---
project: acdl
phase: 2
milestone: v1.25
status: verify
phase_role: execution
requirements:
covered: [REQ-295, REQ-296, REQ-297, REQ-298, REQ-299]
partial: []
---/ci---
2026-08-12 18:26:36 +00:00
e6ee79402b
feat(P2): contract + stack-IR kyverno-json policies + resolver wiring (REQ-295..299)
...
contract/ policies (4): require-id-pattern, require-env-in-enum,
require-infrastructure-min-1, forbid-unknown-fields — declarative
mirrors of contract.schema.json constraints.
stack-ir/ policies (3): require-tagging-standard (nova:owner/contract/
environment/cost-center tags — ports nova_tagging.py), forbid-public-ingress
(v1.0 demo rule, now declarative), require-encryption-by-default (v1.8
D-encryption-default — S3 + EBS encryption config).
core/contract_resolver.py: pre-resolve contract-policy evaluation (REQ-296)
+ post-resolve stack-IR-policy evaluation (REQ-298). Additive — the resolver's
return shape + exceptions unchanged; PCRs attach to stack_instance.policyResults.
Policy evaluation never breaks the resolver (confidence signal decides gate).
tests: test_stack_ir_policies.py + passing/failing fixtures. Skip-without-kj.
16 existing resolver tests unchanged.
---ci---
project: acdl
phase: 2
milestone: v1.25
status: execute
phase_role: execution
requirements:
covered: [REQ-295, REQ-296, REQ-297, REQ-298, REQ-299]
partial: []
---/ci---
2026-08-12 18:25:18 +00:00
4b6c3a12d8
docs(ship): P1 complete — v1.24.1 released (id 641)
...
---ci---
project: acdl
phase: 1
milestone: v1.25
status: complete
ship: v1.24.1 (gitea release id 641)
---/ci---
2026-08-12 18:22:04 +00:00
56dab4fdfb
merge(phase/01): v1.25 P1 engine-core complete
...
Nova Slides Render / render (push) Failing after 23s
P1 ships: PolicyEngine Protocol + KyvernoJsonEngine adapter + config +
install + tests. 24 new tests pass (2 skip-without-kj), 132 existing
tests unchanged. Tag v1.24.1.
---ci---
project: acdl
phase: 1
milestone: v1.25
status: complete
phase_role: execution
---/ci---
2026-08-12 18:21:06 +00:00
ed387a4f54
verify(P1): 4-layer verify PASS — engine core, 24 new tests, 0 regressions
...
---ci---
project: acdl
phase: 1
milestone: v1.25
status: verify
phase_role: execution
requirements:
covered: [REQ-291, REQ-292, REQ-293, REQ-294, REQ-308, REQ-309]
partial: []
---/ci---
2026-08-12 18:21:03 +00:00
ac18c98385
feat(P1): kyverno-json engine core + PolicyEngine protocol (REQ-291..294, 308, 309)
...
core/policy_engine.py: PolicyEngine Protocol (PEP 544, runtime_checkable)
+ PolicyEngineRegistry (selects from config.json.policy.engine) + NullEngine
fallback (NULL_ENGINE_INACTIVE when policy key absent).
adapters/kyverno-json/: KyvernoJsonEngine — shells to , translates
native output → list[dict] PCR records (engine: "kyverno", ruleId KJ_ prefix,
severity via nova.cloudinit.dev/severity annotation, default info).
is_configured() guards on → KJ_ENGINE_NOT_CONFIGURED SKIPPED PCR
(distinct from NullEngine). Defensive parsing (malformed → error PCR).
config.json: new object {engine: kyverno-json, policy_root}.
scripts/install-kyverno-json.sh: go install kj@latest (D-115).
CI (.gitea + .github): install Go + kj for policy-engine tests (best-effort;
tests skip when kj absent).
tests: 24 pass, 2 skip (kj not installed). 132 existing tests unchanged.
NullEngine satisfies PolicyEngine Protocol (G-Q8a — proves swap boundary).
---ci---
project: acdl
phase: 1
milestone: v1.25
status: execute
phase_role: execution
requirements:
covered: [REQ-291, REQ-292, REQ-293, REQ-294, REQ-308, REQ-309]
partial: []
---/ci---
2026-08-12 18:19:16 +00:00
ba816f69ae
docs(ship): P0 complete — v1.25 pre-execution (specify, clarify, research, ideate, plan, grill)
...
Tag v1.24.0 (gitea release id 640). Phase 00 branch deleted.
Next: P1 engine-core → v1.24.1.
---ci---
project: acdl
phase: 0
milestone: v1.25
status: complete
ship: v1.24.0 (gitea release id 640)
---/ci---
2026-08-12 18:14:11 +00:00
2e519743b5
merge(phase/00): v1.25 pre-execution complete — specify, clarify, research, ideate, plan, grill
...
Nova Slides Render / render (push) Failing after 27s
Phase 0 complete for v1.25 kyverno-json Unified Policy Engine.
19 requirements (REQ-291..309), 4 execution phases + P5 final.
Tags on v1.24.x line: v1.24.0 (this patch) → v1.24.5 (milestone release).
---ci---
project: acdl
phase: 0
milestone: v1.25
status: complete
ship: v1.24.0
---/ci---
2026-08-12 18:12:16 +00:00
36c8ae9a80
docs(P00): grill — PROCEED (0.86), 0 escalations, 2 revisions
...
10 challenges red-teamed across feasibility, scope, budget, swap boundary.
8 PROCEED (deterministic-not-AI, swap boundary is the moat, MTTR <1s,
policy count manageable, tagging cross-check worth it, PCR list is valid
payload, phase count matches cadence, severity annotation K8s-standard).
2 REVISE (NullEngine vs kj-not-configured distinct ruleIds; protocol
conformance test via NullEngine). All revisions are PLAN/REQ clarifications
— no requirement changes.
---ci---
project: acdl
phase: 0
milestone: v1.25
status: grill
---/ci---
2026-08-12 18:12:05 +00:00
ec53302014
docs(P00): create phase plans — v1.25 (4 phases, 4 waves)
...
PLAN.md: 4 execution phases (P1 engine-core, P2 contract+stack-IR policies,
P3 plan-JSON+meta+pipeline wiring, P4 regression-gate+docs) + P5 final
review/ship. Wave ordering with parallelization (3-2-2-3 concurrent personas).
Each phase is a vertical slice (end-to-end: policies + Python wiring + tests +
docs). Tags v1.24.0..v1.24.5. 19 requirements (REQ-291..309) mapped to phases
and personas.
---ci---
project: acdl
phase: 0
milestone: v1.25
status: plan
---/ci---
2026-08-12 18:11:00 +00:00
7e6ed25ea9
docs(P00): ideate — 5 accepted (into REQ-295..305), 3 deferred, 0 rejected
...
Tier 1 mechanical: I1 regression-gate-as-policy (REQ-304/305), I2 contract-shape
(REQ-295), I3 stack-IR rules (REQ-297).
Tier 2 backend-enriched: I4 plan-JSON RULE_MAP mirrors (REQ-300), I5 meta-policies
(REQ-303). Deferred: I6 env-transition (stateful, not policy-shaped), I7 drift
(D-096 blocker), I8 cross-project (single-project).
Quality improvement headline: I1 — capability regression becomes a declarative
policy artifact, not imperative Python.
---ci---
project: acdl
phase: 0
milestone: v1.25
status: ideate
---/ci---
2026-08-12 18:10:02 +00:00
f753353ad4
docs(P00): research findings — v1.25 kyverno-json engine surface, 4 policy targets, PolicyEngine swap boundary
...
RESEARCH.md: kyverno-json CLI (kj scan), ValidatingPolicy structure,
assertion trees + ~ modifier + JMESPath, output shape, severity-via-
annotation convention, 4 policy targets (contract/stack-IR/plan-JSON/
meta), PolicyEngine protocol + OPA-equivalent swap surface, latency
<1s (parallel with checkov), deterministic-not-AI tenet, ECS catalog
prior art, 5 logged assumptions (A1..A5).
PERSONAS.md: 4 active personas (lead-developer, backend-engineer,
new policy-engineer, data-engineer); frontend-engineer deactivated.
policy-engineer owns kyverno-json policies + engine translation +
STANDARDS.md policy-authoring section.
ARCHITECTURE.md §12.7: Policy Engine Registry — protocol, registry,
NullEngine fallback, engine enum reuse (D-116), defense-in-depth
critical-override (D-119), graceful degradation (D-120).
---ci---
project: acdl
phase: 0
milestone: v1.25
status: research
---/ci---
2026-08-12 18:09:12 +00:00
f020178c15
docs(P00): clarify — 6 ambiguities auto-resolved (full autonomy, D-115..D-120)
...
A1 install path → go install (D-115)
A2 engine enum → reuse kyverno, distinguish by ruleId KJ_ prefix (D-116)
A3 checkov/wiz signatures unchanged; meta-policies consume merged PCR list (D-117)
A4 NOVA_TAG_NAMING kept + kyverno-json mirror + tagging-rules-agree meta-policy (D-118)
A5 critical-override kept as defense-in-depth behind declarative meta-policy (D-119)
A6 kyverno-json is deterministic not AI; is_configured guard ensures platform functions without it (D-120)
---ci---
project: acdl
phase: 0
milestone: v1.25
status: clarify
---/ci---
2026-08-12 18:06:05 +00:00
5a75075616
docs(init): validate specification — v1.25 kyverno-json unified policy engine
...
Establishes the v1.25 milestone: kyverno-json becomes Nova's primary
compliance/policy tool, implemented behind a swappable PolicyEngine
adapter (so OPA can replace it one day). Unified-orchestrator model —
checkov/wiz remain as raw-finding adapters feeding into kyverno-json
meta-policies. Policies cover all 4 Nova artifacts: contract JSON,
resolved Stack IR, terraform plan JSON, and the merged PCR list itself.
Quality improvement from IDEATE: capability regression checks become
declarative kyverno-json policies. New policy-engineer persona.
19 requirements (REQ-291..309), 6 phases (P0 + P1..P4 + P5 final).
Tags on v1.24.x line: v1.24.0 (P0) → v1.24.5 (P5 = milestone release).
---ci---
project: acdl
phase: 0
milestone: v1.25
status: specify
---/ci---
2026-08-12 18:05:04 +00:00
42c579f7b8
docs(ship): v1.24 milestone checkpoint complete — v1.23.4 released (id 639)
...
acdl-ci / Lint (push) Successful in 10s
acdl-ci / Test (push) Failing after 22s
acdl-ci / Platform check-only (offline) (push) Successful in 22s
---ci---
project: acdl
phase: 4
milestone: v1.24
status: complete
ship: v1.23.4 (gitea release id 639)
---/ci---
2026-08-12 14:36:38 +00:00
ab7171236a
docs(milestone): complete v1.24 — Consumer Guide Accuracy & Env-Promotion Lifecycle Enforcement
...
acdl-ci / Lint (push) Successful in 10s
acdl-ci / Test (push) Failing after 24s
acdl-ci / Platform check-only (offline) (push) Successful in 23s
Nova Slides Render / render (push) Failing after 23s
---ci---
project: acdl
phase: 4
milestone: v1.24
status: complete
requirements:
covered: [REQ-276,REQ-277,REQ-278,REQ-279,REQ-280,REQ-281,REQ-282,REQ-283,REQ-284,REQ-285,REQ-286,REQ-287,REQ-288,REQ-289,REQ-290]
partial: []
---/ci---
2026-08-12 14:36:15 +00:00
fe635c17d5
test(P3): env-transition tests — REQ-288,289
...
acdl-ci / Lint (push) Successful in 9s
acdl-ci / Test (push) Failing after 26s
acdl-ci / Platform check-only (offline) (push) Successful in 26s
Nova Slides Render / render (push) Failing after 25s
- tests/test_env_transition.py: detect_prior_env (5 tests) + record_applied_env (3 tests) + CLI (2 tests) via moto DynamoDB (REQ-288)
- tests/test_run_platform_env_transition.py: Step 0b block assertions (10 tests) + record-applied-env assertions (3 tests) + consumer-repo assertions (2 tests) (REQ-289)
25 new tests pass. 117 total tests pass (no regressions).
---ci---
project: acdl
phase: 3
milestone: v1.24
status: execute
requirements: [REQ-288,REQ-289]
---/ci---
2026-08-12 14:33:10 +00:00
d069654367
feat(P2): env-transition detect-and-destroy — REQ-282..287
...
acdl-ci / Lint (push) Successful in 10s
acdl-ci / Test (push) Failing after 24s
acdl-ci / Platform check-only (offline) (push) Successful in 24s
Nova Slides Render / render (push) Failing after 24s
- core/env_transition.py: detect_prior_env() + record_applied_env() via DynamoDB nova-contracts table (REQ-282,283)
- scripts/run_platform.sh Step 0b: detect env change, destroy prior env (deletion_protection=false, terraform init -reconfigure + destroy), emit ENV_DESTROYED evidence event, fail closed on destroy failure (REQ-284)
- scripts/run_platform.sh: record applied env after successful apply (REQ-285)
- .github/workflows/deploy.yml: pass NOVA_CONSUMER_REPO to run_platform.sh (REQ-286)
- adapters/terraform/adapter.py: doc comment on env-scoped state key (REQ-287)
No orphan path: if destroy fails, pipeline exits non-zero (no apply runs).
---ci---
project: acdl
phase: 2
milestone: v1.24
status: execute
requirements: [REQ-282,REQ-283,REQ-284,REQ-285,REQ-286,REQ-287]
---/ci---
2026-08-12 14:30:24 +00:00
25427250ad
docs(P1): consumer guide accuracy fixes — REQ-276..281,290
...
acdl-ci / Lint (push) Successful in 9s
acdl-ci / Test (push) Failing after 22s
acdl-ci / Platform check-only (offline) (push) Successful in 24s
Nova Slides Render / render (push) Failing after 24s
- Step 3 contract fields table: stale uses/module → real id/name/environment/infrastructure (REQ-276)
- Step 4 caller: add environment: dev to match Step 2 (REQ-277)
- Step 5 stage 8: (dev only) → (autonomous in dev; higher envs apply after HITL) (REQ-278)
- Step 8: rewrite with Shape A destroy-then-rebuild + Shape B cross-ref (REQ-279)
- Per-env section: add Shape B lead sentence (REQ-280)
- Reference table: @v1.19 wording + .yaml→.yml extension fix (REQ-281)
- Tests: rename no-field-editing → both-promotion-shapes + new destroy-on-env-change test (REQ-290)
---ci---
project: acdl
phase: 1
milestone: v1.24
status: execute
requirements: [REQ-276,REQ-277,REQ-278,REQ-279,REQ-280,REQ-281,REQ-290]
---/ci---
2026-08-12 14:26:22 +00:00
Jon Chery