 Jon Chery
|
0d2cbdb423
|
feat(P1): remove gitea/gitlab from synced files + simplify docs (REQ-230,231,232)
Genericize forge-detection code: gitea→forge/generic_forge, GITEA_ACTOR→FORGE_ACTOR.
Drop .gitea byte-identity test assertions (keep GitHub-side + contract conformance).
Add test_no_forge_mentions.py guard test (REQ-230).
Delete completed migration docs (NOVA_MIGRATION.md, NOVA_AWS_MIGRATION.md).
Move NO_HUMANS_THESIS.md to .ciagent/ (internal artifact).
Strip ciagent-internal provenance from synced docs (REQ-/D-/P-/CAP- IDs,
milestone headers, .ciagent/PROJECT.md citations).
Trim README.md (reusable deploy section, local key rotation paragraph).
Fix version-tag drift (@v1.13→@v1.19, acdl/→nova/).
---ci---
project: acdl
phase: 1
milestone: v1.20
status: execute
requirements: [REQ-230, REQ-231, REQ-232]
---/ci---
|
2026-08-07 18:20:29 +00:00 |
|
|
Jon Chery
|
f8616b806e
|
feat(P1): event emitters — CloudEvents envelope, Decision Ledger, Infracost adapter, attestation/confidence/policy event emission
P1 (Wave 1, feat) — REQ-187, REQ-188, REQ-205 (emitter), REQ-206 (emitter)
New components:
- core/metrics/event_envelope.py — CloudEvents 1.0 envelope + platform.* conventions
- core/metrics/run_manifest.py — per-run manifest writer (nova.run.started/completed/failed)
- core/metrics/decision_ledger.py — SQLite append-only hash-chain (ai.decision.made + attestation.recorded)
- core/metrics/infracost_adapter.py — Infracost post-processor (degraded mode when CLI absent, A6)
- schemas/metrics_event.schema.json — CloudEvents envelope schema
- schemas/metrics_run_manifest.schema.json — per-run manifest schema
- metrics/README.md — backup/restore doc (REQ-201)
- tests/test_metrics_emitters.py — 16 tests (all pass)
Modified components:
- core/confidence_signal.py — emits nova.confidence.computed + nova.ai.decision.made (D-122)
- core/hitl_gates.py — emits nova.attestation.recorded on qa/prod/dr gates (D-132)
- adapters/terraform/policy/checkov_adapter.py — emits nova.policy.evaluated
- pyproject.toml — addopts gains --junitxml + --json-report + --cov (REQ-206)
- .gitignore — metrics runtime artifacts ignored
D-120: Nova-native (JSONL + SQLite, no Kafka/OTel)
D-121: Decision Ledger = outbox_writer extension → SQLite hash-chain
D-122: AI decision = confidence_signal + HITL gate (not LLM)
D-128: metrics/ at repo root
D-132: Attestation instrumentation
---ci---
project: acdl
phase: 1
milestone: v1.17
status: execute
---/ci---
|
2026-08-04 19:58:54 +00:00 |
|
|
Jon Chery
|
e74a8c2f5d
|
feat(P42): stub implementation — SoD, HITL gates, attestation matrix, Wiz, Kyverno
---ci---
project: acdl
phase: 42
milestone: v1.9
status: execute
---/ci---
Phase 42 — stub-implementation (REQ-107..111, D-084):
route_halt_artifact (REQ-107):
- core/separation_of_duties.py: real SNS publish (ACDL_SOD_HALT_TOPIC_ARN)
+ outbox fallback (SEPARATION_OF_DUTIES_VIOLATION event via
outbox_writer) + stderr emission. No silent print-only stub.
- terraform/platform/main.tf: aws_sns_topic.acdl-sod-halt + output.
HITL attestation gates (REQ-108):
- core/hitl_gates.py: attest(contract_id, env, approver, evidence,
outbox_client) records approver_qa/approver_prod/approver_dr to
outbox, runs SoD check on prod, invokes attestation matrix, returns
(ok, reason). Dev skips (autonomous). approver_from_env() reads
GITHUB_ACTOR/GITEA_ACTOR.
- scripts/run_platform.sh: Step 7b HITL gate before apply for qa/prod/dr.
8-concern attestation matrix (REQ-109, D-084):
- core/attestation_matrix.py: check(env, evidence) runs the 8 concerns
from hitl_matrix_design.md §10.4. Offline-testable (contract_nfrs,
schema_validity, policy_pass) run for real. Operator-supplied accept
signed artifacts validated for freshness (FRESHNESS_DAYS table) +
schema. Signature skip when ACDL_ATTESTATION_SIGNING_KEY_ID unset
(D-089). Fail loud if missing/expired for prod/dr.
Wiz real client (REQ-110):
- adapters/wiz/wiz_adapter.py: WizClient (GraphQL API, Bearer auth,
pagination via pageInfo.hasNextPage + endCursor). fetch_and_adapt
translates issues → PolicyCheckResult; graceful degrade when
WIZ_API_TOKEN/WIZ_API_URL unset.
Kyverno fleshed out (REQ-111):
- adapters/kyverno/kyverno_adapter.py: full PolicyReport →
PolicyCheckResult mapping (pass/fail/skip/warn + severity + skip-with-
reason + resource ref construction from kind/name/namespace).
adapt_inactive() emits KYVERNO_INACTIVE_TF_STACK guard. --kube-version
stub parsed for future GitOps.
Tests: +47 (test_route_halt_artifact.py, test_hitl_gates.py,
test_attestation_matrix.py, test_wiz_adapter_real_client.py, expanded
test_kyverno_adapter.py). Existing wiz_adapter tests updated for the
real client's control.name ruleId. 493 passed; run_ci.sh green;
run_platform.sh --check-only green.
|
2026-07-23 04:40:44 +00:00 |
|