88 Commits

Author	SHA1	Message	Date
Jon Chery	9bac2685cb	feat(P03 W7): secret rotation scheduled workflow (SPEC §5.9) ... workflows-src/rotate-aws-key.yml — daily cron (0 0 * * *) + workflow_dispatch, wraps scripts/rotate_spike_key.sh (uses NOVA_AWS_* static-key auth to IAM- rotate the nova-spike-runner key; uploads the new key to the consumer's Actions secret store; idempotent — deactivates the old key only after the new propagates, verified by a post-PUT GET). Synced to .github + .gitea. v0.2 scope: the mechanism exists (SPEC §5.9 — exists-not-ran); the v0.2 deploy uses the currently-active key. Documented in ARCHITECTURE.md §12.9. The synced workflow file is forge-agnostic (REQ-230): forge base URL / owner / consumer repo come from repository secrets (NOVA_FORGE_*, NOVA_CONSUMER_REPO), not literals. rotate_spike_key.sh reads NOVA_FORGE_* with NOVA_GITEA_* backward-compat fallback. sync_workflows.py PAIRS extended to include rotate-aws-key.yml (was hardcoded to 3 pairs). ---ci--- project: acdl phase: 3 milestone: v1.26 status: execute wave: W7 ---	2026-08-18 23:39:34 +00:00
Jon Chery	b237b3e85b	fix(P03 W6): deploy.yml drift fixes — AWS_DEFAULT_REGION from secret, ref v1.25, no raw NOVA_AWS_* in shell env (SPEC §5.1/§5.2) ... workflows-src/deploy.yml: aws-region now ${{ secrets.AWS_DEFAULT_REGION || 'use-east-1' }} (was hardcoded us-east-1); platform checkout ref v1.25 (was v1.9, matching the consumer's @v1.25 pin). scripts/run_platform.sh local fallback: unset raw NOVA_AWS_* + NOVA_GITEA_TOKEN after sourcing .env.secrets (only canonical AWS_* names remain in shell env — the v1.8 blocked_env_vars guard). Re-synced to .github + .gitea. ---ci--- project: acdl phase: 3 milestone: v1.26 status: execute wave: W6 ---	2026-08-18 23:30:31 +00:00
Jon Chery	023cc47025	feat(P03 W5): CAP-025 live-pilot-apply regression check (REQ-316) ... CAP-025 (local tier) asserts the pilot-apply pipeline is structurally ready: run_platform.sh steps present, core pipeline modules importable, dev env bound to 581513795199 (D-203), dynamodb L1 registered (REQ-322), pilot policies authored (REQ-315/320), outcome backfill present (REQ-317). Returns Verified on the current branch (all W2/W3/W4 dependencies in place). Added to CAPABILITY_REGISTRY. The live apply (P4) exercises this end-to-end against AWS. ---ci--- project: acdl phase: 3 milestone: v1.26 status: execute wave: W5 ---	2026-08-18 23:10:39 +00:00
Jon Chery	3300ed2557	feat(P03 W3): env-JSON state_backend wiring (REQ-319) ... The adapter reads env.state_backend.bucket from the env JSON when present (fallback to the computed nova-tfstate-{account_id}-{region} pattern for backwards compat). dev.json bound to the real account 581513795199 + bucket nova-tfstate-581513795199-us-east-1 (D-203). qa/prod/dr stay placeholder (account_id 000000000000 — the pilot-readiness policy blocks apply on placeholder, D-208). dynamodb added to the adapter test EXPECTED_L1_KEYS + a resolution/emission test. ---ci--- project: acdl phase: 3 milestone: v1.26 status: execute wave: W3 ---	2026-08-18 22:56:39 +00:00
Jon Chery	e22661ab54	feat(P03 W4): pilot-readiness + settlement-finality kyverno-json policies (REQ-315, REQ-320) ... REQ-320: policies/pilot-readiness/no-placeholder-account.json asserts account_id != "000000000000" over the env JSON (critical severity — a placeholder account drives a block band). Passes on dev (581513795199), fails on placeholder. REQ-315: policies/settlement-finality/all-matches- committed.json asserts all_committed == true over the settlement status JSON (critical severity). Authored + tested in v1.26; enforcement gates qa/prod/dr promotions, not dev (G-Q6 — dev all_committed is vacuously true). Both policy tests run against real kj (not skipped). ---ci--- project: acdl phase: 3 milestone: v1.26 status: execute wave: W4 ---	2026-08-18 22:36:57 +00:00
Jon Chery	51b886f3f6	feat(P03 W2): outcome backfill (REQ-317) + escalation_reason (REQ-318) ... REQ-317: core/metrics/outcome_backfill.py backfills fact_decision.outcome pending -> succeeded/failed after run.completed/run.failed; idempotent + terminal (does not overwrite a non-pending outcome); wired into the collector. The Post-Pilot AI Decision Accuracy denominator is now grounded (fact_decision.outcome is not stuck pending). REQ-318: ai.decision.made on a block band carries escalation_reason: 'confidence' (the only value in v1.26 — a block is always confidence- driven; future milestones may add 'policy'). Persisted into fact_run by the collector. The Post-Pilot Human Escalation Frequency denominator is now grounded. ---ci--- project: acdl phase: 3 milestone: v1.26 status: execute wave: W2 ---	2026-08-18 22:14:03 +00:00
Jon Chery	373533094b	fix(P03 W0.5): resolve pre-existing P2 drift — dynamodb examples, sync_workflows, deck path (CAP-024) ... Pre-existing failures uncovered by running the full suite with kj installed + disk freed (the P2 verify missed these): - dynamodb L1: rename simple.yaml -> simple.yml + add complex.yml (module-standards expects both .yml extensions; the P2 author used .yaml) - sync_workflows: re-sync ci.yml drift (.github + .gitea <- workflows-src) - CAP-024 deck path: nova-autonomous-cloud-delivery.md was consolidated to -marp.md in v1.25 P1 (commit a47c162) but test + regression_verify still pointed at the old path; update both + relax slide-count bound (18-20) + count class="benefit" divs (marp format, not the old 'Benefit:' text) ---ci--- project: acdl phase: 3 milestone: v1.26 status: execute wave: W0.5 ---	2026-08-18 22:00:30 +00:00
Jon Chery	9f94103c57	feat(P02 W0): dynamodb L1 primitive — interface, terraform, registry, tests (REQ-322) ... New L1 module modules/l1/dynamodb/ (stack type aws:dynamodb:table). Terraform aws_dynamodb_table with PK + optional SK, PAY_PER_REQUEST default, SSE-KMS + PITR + prevent_destroy per v1.8 NFR defaults. Registry entry (kind l1), catalog row, test_adapter.py updated to 15 entries / 13 L1. 45 tests passing. ---ci--- project: acdl phase: 2 milestone: v1.26 status: execute phase_role: execution wave: 0 requirements: [REQ-322] ---/ci---	2026-08-18 00:22:19 +00:00
Jon Chery	8c68d683c6	test(metrics): fix attestation-event test freshness time-bomb (use now vs hardcoded date)	2026-08-12 21:07:50 +00:00
Jon Chery	255cde5002	verify(P5): review fixes — wire Step 5c meta-policies + fix smoke policy (P1-1, P1-2, P1-3) ... P1-1 (correctness): run_platform.sh Step 5c now invokes the meta-policies (block-on-any-critical, tagging-rules-agree) over the merged PCR list after Step 5b, appending the meta-PCRs to pcr.json before the confidence signal runs. Closes the D-118/D-119 declarative-critical-block gap (the confidence_signal.py hard-override stays as defense-in-depth). P1-2 (testing): test_meta_policies.py behavioral assertions strengthened — test_no_critical_passes asserts no fails, test_critical_fail_present asserts a non-pass result, test_pcrs_validate_against_schema validates output. P1-3 (correctness): _smoke.json assertion rewritten from malformed '{{ to_string(@) }}' to valid JMESPath '(regex_match(...))'. ---ci--- project: acdl phase: 5 milestone: v1.25 status: execute phase_role: final ---/ci---	2026-08-12 18:49:06 +00:00
Jon Chery	38b51f3e6d	feat(P4): regression-gate policies + docs (REQ-304..307) ... regression/ policies (3): cap-013-adapter-dedup, cap-023-metrics-collector, cap-024-deck-structure — declarative mirrors of core/regression_verify.py over capability-inventory JSON. The imperative regression_verify.py is kept (drives CI gate); the policies are the declarative mirror (IDEATE I1 quality improvement). tests: test_regression_policies.py + clean/drifted fixtures. Skip-without-kj. docs: adapters/README.md (new kyverno-json row + PolicyEngine Protocol section with how-to-add-OpaEngine), adapters/kyverno-json/README.md (engine, install, policy directory layout, 4 categories, severity convention), schemas/README.md (D-116 engine enum reuse note), modules/STANDARDS.md §10 Policy Authoring Standard, docs/METRICS.md (swappable engine narrative). ---ci--- project: acdl phase: 4 milestone: v1.25 status: execute phase_role: execution requirements: covered: [REQ-304, REQ-305, REQ-306, REQ-307] partial: [] ---/ci---	2026-08-12 18:42:55 +00:00
Jon Chery	7f4b79593a	feat(P3): plan-JSON policies + meta-orchestration + pipeline wiring (REQ-300..303) ... plan-json/ policies (3): forbid-plaintext-secrets (ports CKV_AWS_41/45/46), forbid-iam-wildcard (ports CKV_AWS_1/40), require-kms-reference (ports CKV_AWS_7/33) over terraform show -json output. meta/ policies (2): block-on-any-critical (declarative source of truth for critical-block; confidence_signal hard-override stays as defense-in-depth, D-119) + tagging-rules-agree (cross-checks Checkov NOVA_TAG_NAMING vs kj KJ_REQUIRE_TAGGING_STANDARD, D-118). scripts/run_platform.sh Step 5b: parallel kyverno-json plan-JSON pass; merges Checkov/Wiz + kj PCR lists into the confidence signal policy input; skips gracefully when kj absent (D-120). tests: test_plan_json_policies.py, test_meta_policies.py (skip-without-kj), test_run_platform_plan_json_policies.py (script-substring assertion, no skip). ---ci--- project: acdl phase: 3 milestone: v1.25 status: execute phase_role: execution requirements: covered: [REQ-300, REQ-301, REQ-302, REQ-303] partial: [] ---/ci---	2026-08-12 18:29:34 +00:00
Jon Chery	e6ee79402b	feat(P2): contract + stack-IR kyverno-json policies + resolver wiring (REQ-295..299) ... contract/ policies (4): require-id-pattern, require-env-in-enum, require-infrastructure-min-1, forbid-unknown-fields — declarative mirrors of contract.schema.json constraints. stack-ir/ policies (3): require-tagging-standard (nova:owner/contract/ environment/cost-center tags — ports nova_tagging.py), forbid-public-ingress (v1.0 demo rule, now declarative), require-encryption-by-default (v1.8 D-encryption-default — S3 + EBS encryption config). core/contract_resolver.py: pre-resolve contract-policy evaluation (REQ-296) + post-resolve stack-IR-policy evaluation (REQ-298). Additive — the resolver's return shape + exceptions unchanged; PCRs attach to stack_instance.policyResults. Policy evaluation never breaks the resolver (confidence signal decides gate). tests: test_stack_ir_policies.py + passing/failing fixtures. Skip-without-kj. 16 existing resolver tests unchanged. ---ci--- project: acdl phase: 2 milestone: v1.25 status: execute phase_role: execution requirements: covered: [REQ-295, REQ-296, REQ-297, REQ-298, REQ-299] partial: [] ---/ci---	2026-08-12 18:25:18 +00:00
Jon Chery	ac18c98385	feat(P1): kyverno-json engine core + PolicyEngine protocol (REQ-291..294, 308, 309) ... core/policy_engine.py: PolicyEngine Protocol (PEP 544, runtime_checkable) + PolicyEngineRegistry (selects from config.json.policy.engine) + NullEngine fallback (NULL_ENGINE_INACTIVE when policy key absent). adapters/kyverno-json/: KyvernoJsonEngine — shells to , translates native output → list[dict] PCR records (engine: "kyverno", ruleId KJ_ prefix, severity via nova.cloudinit.dev/severity annotation, default info). is_configured() guards on → KJ_ENGINE_NOT_CONFIGURED SKIPPED PCR (distinct from NullEngine). Defensive parsing (malformed → error PCR). config.json: new object {engine: kyverno-json, policy_root}. scripts/install-kyverno-json.sh: go install kj@latest (D-115). CI (.gitea + .github): install Go + kj for policy-engine tests (best-effort; tests skip when kj absent). tests: 24 pass, 2 skip (kj not installed). 132 existing tests unchanged. NullEngine satisfies PolicyEngine Protocol (G-Q8a — proves swap boundary). ---ci--- project: acdl phase: 1 milestone: v1.25 status: execute phase_role: execution requirements: covered: [REQ-291, REQ-292, REQ-293, REQ-294, REQ-308, REQ-309] partial: [] ---/ci---	2026-08-12 18:19:16 +00:00
Jon Chery	fe635c17d5	test(P3): env-transition tests — REQ-288,289 ... - tests/test_env_transition.py: detect_prior_env (5 tests) + record_applied_env (3 tests) + CLI (2 tests) via moto DynamoDB (REQ-288) - tests/test_run_platform_env_transition.py: Step 0b block assertions (10 tests) + record-applied-env assertions (3 tests) + consumer-repo assertions (2 tests) (REQ-289) 25 new tests pass. 117 total tests pass (no regressions). ---ci--- project: acdl phase: 3 milestone: v1.24 status: execute requirements: [REQ-288,REQ-289] ---/ci---	2026-08-12 14:33:10 +00:00
Jon Chery	25427250ad	docs(P1): consumer guide accuracy fixes — REQ-276..281,290 ... - Step 3 contract fields table: stale uses/module → real id/name/environment/infrastructure (REQ-276) - Step 4 caller: add environment: dev to match Step 2 (REQ-277) - Step 5 stage 8: (dev only) → (autonomous in dev; higher envs apply after HITL) (REQ-278) - Step 8: rewrite with Shape A destroy-then-rebuild + Shape B cross-ref (REQ-279) - Per-env section: add Shape B lead sentence (REQ-280) - Reference table: @v1.19 wording + .yaml→.yml extension fix (REQ-281) - Tests: rename no-field-editing → both-promotion-shapes + new destroy-on-env-change test (REQ-290) ---ci--- project: acdl phase: 1 milestone: v1.24 status: execute requirements: [REQ-276,REQ-277,REQ-278,REQ-279,REQ-280,REQ-281,REQ-290] ---/ci---	2026-08-12 14:26:22 +00:00
Jon Chery	e07a210c70	test(P5): ci + tests + readme for single-doc dual-pptx pipeline (REQ-273,274,275) ... CI workflows: install python-pptx, pin CLI versions, stage both PPTX + inlined HTML. test_slides_pipeline.py: inverted theme assertion (now default+inline), deleted source-md tests, added 8 new tests (penetrate absence, image inlining, python-pptx, benefit class, single source, speaker-notes comments, default theme, css retained). New test_pptx_generator.py: slide count, title colors, slide titles, table rendering, image embedding, benefit callout. README rewritten for 3-step single-document + dual-PPTX + image-inlining pipeline. ---ci--- project: acdl phase: 5 milestone: v1.23 status: execute phase_role: execution ---/ci---	2026-08-12 00:34:23 +00:00
Jon Chery	25ddc894c2	docs(milestone): complete v1.22 — Nova Deck Layout Fix ... 9 requirements complete (REQ-254..262): - P1: theme-css — section padding + overflow + image rules + title chrome + spacing tightening (REQ-254,255,256) - P2: render-scripts — delete render_deck.sh, pin CLI versions, 2x scale + transparent bg (REQ-257,258) - P3: mermaid-relayout — telemetry TB + platform-pipeline 4-node TB, re-rendered 2x transparent (REQ-259,260) - P4: deck-content — split slides 3+8 (18->20 main), trim 8 overflowing slides, remove redundant header (REQ-261) - P5: render-and-test — re-render HTML+PPTX, add 9 layout/aspect- ratio/theme-structural tests (REQ-262) - P6: final review + audit + ship (this commit) Final review fixes: source .md + talking-points re-synced to 20-slide structure; ![h:480 class:tall] directives applied; README stale references updated; CSS trailing newline added. Root cause: nova-sp-theme.css had zero section padding (declared /* @theme nova-sp */ as a comment, not the @theme directive; did not @import Marp default theme). Combined with overflow:hidden, blunt img max-height:320px, header+footer chrome on every slide, and two P5 diagrams with extreme aspect ratios (13.52x and 0.63x), 8 of 19 slides overflowed. NOT a P5 regression — theme CSS byte-identical P3->P5; P5 denser content made pre-existing flaws visible. Tags on v1.21.x line (v1.21.0 P0 -> v1.21.6 P6 final = milestone release). 32 slide tests pass (23 original + 9 new). 94 key-file tests pass. Pipeline check exit 0. ---ci--- project: acdl phase: 6 milestone: v1.22 status: complete phase_role: final requirements: covered: [REQ-254,REQ-255,REQ-256,REQ-257,REQ-258,REQ-259,REQ-260,REQ-261,REQ-262] partial: [] ---/ci---	2026-08-11 20:11:43 +00:00
Jon Chery	631244458f	test(P5): re-render deck + add layout/aspect-ratio/theme-structural tests (REQ-262) ... Re-rendered HTML + PPTX via render_slides.sh (pinned marp-cli@4.5.0, mermaid-cli@11.16.0, 2x transparent PNGs). 22 slides (title + 20 main + 1 appendix), 23 media files embedded. Theme embedded in HTML (--sp-red + padding confirmed). Added 9 tests to test_slides_pipeline.py (the gap that let the layout regression through): - test_theme_css_has_section_padding (REQ-254) - test_theme_css_suppresses_title_chrome (REQ-256) - test_theme_css_has_aspect_ratio_aware_images (REQ-255) - test_png_aspect_ratios_sane (REQ-259/260, scoped to deck-referenced PNGs only per GRILL revision 1, bounds [0.4, 4.0]) - test_render_slides_has_2x_scale (REQ-258) - test_render_slides_pins_cli_versions (REQ-257) - test_render_deck_removed (REQ-257) - test_html_embeds_theme (REQ-262) - test_html_slide_count_matches_marp (REQ-262) 32 slide tests pass (23 original + 9 new). 94 tests pass across key files. run_platform.sh --check-only exit 0. ---ci--- project: acdl phase: 5 milestone: v1.22 status: execute phase_role: execution ---/ci---	2026-08-11 19:56:31 +00:00
Jon Chery	cc6071ee53	fix(P4): trim/split 8 overflowing slides + remove header (REQ-261) ... Split slide 3 (Objectives + Anti-Goals) into Slide 3 (Objectives) + Slide 4 (Anti-Goals). Split slide 8 (Attestation Matrix) into Slide 9 (QA concerns, 3 rows) + Slide 10 (Prod/DR concerns, 7 rows). Main slide count 18 -> 20. Trimmed: slide 7 (Pipeline) reduced to 3 bullets (4th covered by diagram). slide 11 (Telemetry) reduced to 3 bullets. slide 14 (Deferred) merged 3 Live-AWS rows into 1 (8 -> 6 rows). slide 17 (Quarter-by-Quarter) dropped Grounding column (5 -> 4 cols). Global table cell padding reduced (6px 10px -> 4px 8px) so 8-13 row tables fit. Removed header: from frontmatter (keep footer: + paginate only). The full 51-char deck title in BOTH header and footer was redundant chrome eating ~35px on every slide. Updated test_marp_deck_slide_count (18 -> 20 main + 1 appendix). Updated README slide-count convention (18 -> 20). ---ci--- project: acdl phase: 4 milestone: v1.22 status: execute phase_role: execution ---/ci---	2026-08-11 19:49:46 +00:00
Jon Chery	358aa62c3a	fix(P2): render scripts — delete render_deck.sh, pin versions, 2x scale (REQ-257,258) ... REQ-257: deleted scripts/render_deck.sh (omitted --theme, produced unthemed output; README already documents render_slides.sh as canonical). Pinned marp-cli@4.5.0 + mermaid-cli@11.16.0 in render_slides.sh to prevent boilerplate-CSS drift. Removed render_deck.sh references from README, sync_to_nova.sh, and test_no_forge_mentions.py. REQ-258: added -s 2 -b transparent to mermaid-cli invocation (matches README spec line 193). Produces crisp 2x PNGs with transparent backgrounds instead of 1x renders. ---ci--- project: acdl phase: 2 milestone: v1.22 status: execute phase_role: execution ---/ci---	2026-08-11 19:38:27 +00:00
Jon Chery	85c500e45a	feat(P4): pipeline hardening — Checkov before plan, Wiz-or-Checkov on plan (REQ-250) ... Two-stage policy scan per item 20: 1. Checkov on static code BEFORE terraform plan (fail-fast, quick dev feedback). Added to run_platform.sh Step 3c + run_codegen.sh Step 3c (runs on the authored TF dir before plan, using --framework terraform). 2. Runtime policy scan on the plan AFTER terraform plan: Wiz when configured (WIZ_API_TOKEN + WIZ_API_URL), else Checkov against the plan as a drop-in replacement (--framework terraform_plan). Wiz and Checkov are NEVER both run on the plan. Replaces the old single Checkov-on-main.tf step in run_platform.sh Step 5 + run_postapply.sh Step 5. pipelines/contract.yml: stage list updated — 'checkov' stage replaced by 'checkov-static' (before terraform-plan) + 'runtime-policy-scan' (after terraform-plan). 9 stages → 10 stages. Header comment updated. adapters/wiz/wiz_adapter.py: add --plan mode CLI (fetch_and_adapt_plan) for scanning a terraform plan; backward-compat with the positional <wiz_issues.json> <contract-id> mode. is_configured() gates the Wiz path. Tests: test_pipeline_contract.py (9 → 10 stages, new stage names); test_contract_resolver.py (rename test, assert checkov-static + runtime-policy-scan present, old 'checkov' gone). Full suite: 685 pass + 1 pre-existing attestation failure (NOVA_ATTESTATION_SIGNING_KEY_ID unset, unrelated to v1.21, fails on main without these changes too). ---ci--- project: acdl phase: 4 milestone: v1.21 status: execute phase_role: execution ---/ci---	2026-08-11 14:10:42 +00:00
Jon Chery	301aa2c8d8	docs(P3): marp deck + talking points + README + theme CSS + tests (REQ-245,251,252) ... Marp deck (nova-autonomous-cloud-delivery-marp.md): synthesize from updated source-of-truth; 18 main + 1 appendix slides; frontmatter — title 'Nova — The Autonomous Cloud Delivery Platform', footer without version + without 'Act %{page}/5', title-slide subtitle 'Product Development & Citizen Developer Overview'; no badges; embedded PNGs. Talking points (nova-autonomous-cloud-delivery-talking-points.md): re-distilled to 18-slide + A1 structure. README.md: update deck title, audience, slide count (18 main + 1 appendix), directory layout, remove badge docs, update deck table + render commands + filenames. Document the v1.21 rename + restructure. Theme CSS (nova-sp-theme.css): fix Appendix A1 table readability — tables now have explicit white body + black text on any slide background (including dark/title slides). Item 32. Tests (test_slides_pipeline.py): add v1.21 assertions — no badges; no version in footer/title slide; 18 main + 1 appendix slides; no D-###/REQ- ###/.py paths in audience-facing Marp deck or source slide body; old deck files removed; render script default renamed; README references new deck name. Update deck path in test_regression_cap023_024.py + core/regression_verify.py CAP-024 (filename + 18-19 slide range, drop 'Arc Preview' check per item 3). attach_release_asset.py: usage example filename updated. ---ci--- project: acdl phase: 3 milestone: v1.21 status: execute phase_role: execution ---/ci---	2026-08-11 14:03:06 +00:00
Jon Chery	2273009b95	feat(P2): dedicated S&P theme + render pipeline + CI workflow (REQ-239..243) ... Create nova-sp-theme.css — S&P Global Energy Marp theme (Red/Black/White palette applied to all slide chrome: backgrounds, headers/footers, pagination, tables, blockquotes, code blocks). Create render_slides.sh — end-to-end pipeline: mermaid PNGs + Marp HTML/PPTX. Create slides.yml CI workflow — auto-renders on docs/presentations/ changes. Create test_slides_pipeline.py — 12 tests (theme CSS, Marp frontmatter, script, workflow, .mmd/.png parity, README retired-deck cleanup). Update Marp frontmatter: theme: nova-sp + footer v1.20. Fix presentations/README.md directory layout (remove retired decks). Re-render HTML + PPTX with S&P theme. ---ci--- project: acdl phase: 2 milestone: v1.20 status: execute requirements: [REQ-239, REQ-240, REQ-241, REQ-242, REQ-243] ---/ci---	2026-08-07 18:26:51 +00:00
Jon Chery	0d2cbdb423	feat(P1): remove gitea/gitlab from synced files + simplify docs (REQ-230,231,232) ... Genericize forge-detection code: gitea→forge/generic_forge, GITEA_ACTOR→FORGE_ACTOR. Drop .gitea byte-identity test assertions (keep GitHub-side + contract conformance). Add test_no_forge_mentions.py guard test (REQ-230). Delete completed migration docs (NOVA_MIGRATION.md, NOVA_AWS_MIGRATION.md). Move NO_HUMANS_THESIS.md to .ciagent/ (internal artifact). Strip ciagent-internal provenance from synced docs (REQ-/D-/P-/CAP- IDs, milestone headers, .ciagent/PROJECT.md citations). Trim README.md (reusable deploy section, local key rotation paragraph). Fix version-tag drift (@v1.13→@v1.19, acdl/→nova/). ---ci--- project: acdl phase: 1 milestone: v1.20 status: execute requirements: [REQ-230, REQ-231, REQ-232] ---/ci---	2026-08-07 18:20:29 +00:00
Jon Chery	0b79b16715	fix(P2): add metrics domain to sync_to_nova.sh — consumer export views (REQ-229) ... The metrics/ export views (README.md, TRUST_SNAPSHOT.md, powerbi/) are consumer-facing but fell outside the original 13 domains, so the first nova release left them untracked. Adds a 14th domain 'metrics' between docs and workflows. Updates TestSyncToNovaScript domain-order assertion to 14. ---ci--- project: acdl phase: 2 milestone: v1.19 status: complete phase_role: final ---/ci---	2026-08-06 15:47:25 +00:00
Jon Chery	a4c5f332f6	feat(P1): sync_to_nova.sh — manual-only 2nd-release pipeline into ~/nova (REQ-229) ... Replaces scripts/sync_to_gl.sh (kitchen-sink mirror sync into ~/gl/acdl) with scripts/sync_to_nova.sh — a manual-only, consumer-subset, domain-committed 2nd-release pipeline into ~/nova (GitLab jonathanchery/nova, separate repo + history, consumer/platform-team audience). - Manual-only gate: refuses without --release / RELEASE_CONFIRMED=1 (exit 2). Never triggerable by CI. - Consumer subset: excludes .ciagent/, .gitea/, .env*, terraform/, demo/, runtime metrics artifacts, and 18 internal-only scripts (EXCLUDE_SCRIPTS). Keeps consumer runbooks + metrics export views (README, powerbi, TRUST_SNAPSHOT). Protects ~/nova/.git via rsync --filter=P .git. - Domain-based commits: 13 fixed-order domains (config, core, adapters, modules, contracts, schemas, pipelines, mcp, skills, scripts, tests, docs, workflows). Each changed domain gets its own conventional commit supplied positionally via repeated -m flags. No kitchen-sink commit. - Conventional-commit validation: regex-enforced (feat|fix|docs|chore|...); bypass via --no-verify-format. - Modes: --list-domains, --dry-run, --no-push, -v, -h. - Tests: TestSyncToNovaScript (8 tests) covers gate, domain order, exclude list, consumer-script inclusion, .git protection filter, conventional regex. Decisions: D-143 (target ~/nova), D-144 (conventional commits per domain, not ---ci--- audit blocks), D-145 (manual-only trigger), D-146 (13 fixed domains, positional-over-changed mapping), D-147 (coreci/Atelier review gate deferred). ---ci--- project: acdl phase: 1 milestone: v1.19 status: execute requirements: covered: [REQ-229] partial: [] ---/ci---	2026-08-06 15:40:11 +00:00
Jon Chery	8bcf7296d5	feat(P5): Atelier MCP server + vendored Atelier + plugin-registry (REQ-223, REQ-224, REQ-225) ... REQ-223: mcp/atelier/server.py plugin-registry MCP server (stdio, D-135). NovaAtelierServer wraps MCPServer (SDK v2, D-137) if installed; degrades to _ToolRegistry fallback if SDK absent (testable in CI without SDK). plugins/principles.py (lookup_principle, list_domains, matrix_lookup) + plugins/validation.py (validate_against_principles — agentic validation beyond Wiz/Checkmarx/Mend). 4 tools, 2 plugins. REQ-224: mcp/atelier/vendor/ pinned Atelier v0.3.6 (D-136) — core/ first-principles, domains/security/first-principles, review/agent-checklist, matrix/principles-matrix. vendor/VERSION.md + scripts/update_atelier_vendor.sh for intentional upgrades. mcp/atelier/README.md (tools, architecture, running, vendoring, extensibility, transport). REQ-225: tests/test_atelier_mcp.py — 16 tests, all pass. Covers: plugin discovery (both loaded), 4 tools registered, lookup_security_P4 (+P1, unknown domain/principle), list_domains (19, security-relevant, ui-ux-not), matrix_lookup (security 10 P-rules, unknown), validation (good-passes, bad-secret-fails, bad-swallowed-error-fails, bad-obfuscated-names-fails, result-structure). ---ci--- project: acdl phase: 5 milestone: v1.18 status: execute requirements: covered: [REQ-223, REQ-224, REQ-225] partial: [] ---/ci---	2026-08-06 15:13:40 +00:00
Jon Chery	5775a97388	feat(P3): submission-readiness input contract — schema + validator + docs + tests (REQ-217..220) ... REQ-217: schemas/submission-readiness.schema.json (JSON Schema draft 2020-12) defines acceptable-to-start as a superset gate above contract.schema.json: contractId, environment, tags (5 Nova tags D-054), policyPreconditions, profile (developer|agentic), appSource (repo+ref), per-env mandatory (W3.E: qa→e2eSuite+loadTest, prod→runbook+dashboard+oncall, dr→drDrillRef), agentic markers (naturalLanguageIntent+confidenceAtSubmission+agentTrace). REQ-218: core/submission_readiness.py validator with check_readiness() + ReadinessResult (structured pass/fail + reason codes). Wired as contract_ingestor.py --check-readiness (D-133). Reason codes: MISSING_TAGS, ENV_MISSING_MANDATORY, AGENTIC_MISSING_INTENT, MISSING_APP_SOURCE, POLICY_PRECONDITION_MISSING. Never raises — all failures are reason codes. REQ-219: docs/submission-readiness.md (good + rejected examples + reason-code catalog + compliance-standard equivalence). REQ-220: tests/test_submission_readiness.py — 16 tests, all pass. Covers: good-pass, good-agentic-pass, missing-tags, empty-tag, qa-missing-e2e, prod-missing-runbook, dr-missing-drdrill, prod-all-pass, agentic-missing-all, agentic-missing-one, missing-appsource, appsource-missing-ref, empty-policy, result-structure. ---ci--- project: acdl phase: 3 milestone: v1.18 status: execute requirements: covered: [REQ-217, REQ-218, REQ-219, REQ-220] partial: [] ---/ci---	2026-08-06 15:09:29 +00:00
Jon Chery	d9b402c283	test(P6): regression capability — CAP-023 (metrics collector) + CAP-024 (deck structure) (REQ-198) ... P6 (Wave 4, test) — REQ-198 New capabilities: - CAP-023: metrics collector runs + emits expected schema (fact/dim tables present) - CAP-024: unified deck structure (12-20 slides, x3 arc, per-slide benefit callouts) - tests/test_regression_cap023_024.py — 4 tests (all pass) Modified: - core/regression_verify.py — CAPABILITY_REGISTRY gains CAP-023 + CAP-024 ---ci--- project: acdl phase: 6 milestone: v1.17 status: execute ---/ci---	2026-08-04 20:08:03 +00:00
Jon Chery	3a7604dec0	feat(P3): powerbi export — CSV/JSON views + 8 placeholder views + data dictionary (REQ-190,199,208,209) ... P3 (Wave 2, feat) — REQ-190, REQ-199, REQ-208, REQ-209 New components: - core/metrics/powerbi_export.py — exports fact/dim tables + 8 placeholder views to CSV/JSON - tests/test_powerbi_export.py — 6 tests (all pass) - docs/METRICS_VIEWS.md — column-level data dictionary (REQ-209) - metrics/powerbi/NOVA_DASHBOARD_README.md — folder-connector import guide + starter visual model (REQ-208) 8 placeholder views (deferred metrics, headers only): - placeholder_live_infra_health (D-096) - placeholder_live_outbox_rate (D-096) - placeholder_tamper_evident_checkpoints (D-083) - placeholder_onboarding_funnel (D-113/D-114/D-119) - placeholder_drift_detection (D-096 + no scheduler) - placeholder_live_cur_reconciliation (D-096) - placeholder_sla_downtime (D-096) - placeholder_predictive_reactive (future emitter) D-120: Nova-native (CSV/JSON files, no live connector) D-129: PowerBI ingests via folder connector ---ci--- project: acdl phase: 3 milestone: v1.17 status: execute ---/ci---	2026-08-04 20:03:12 +00:00
Jon Chery	18b03db272	feat(P2): metrics collector — SQLite cold store + Decision Ledger CLI (REQ-189,200,201,207) ... P2 (Wave 2, feat) — REQ-189, REQ-200, REQ-201, REQ-207 New components: - core/metrics/collector.py — reads all grounded signals (REGRESSION_REPORT.json, per-run manifests, junit XML, coverage.json, decision ledger, lifecycle reports) → SQLite cold store (metrics/nova_metrics.db) with fact_run, fact_capability, fact_policy_check, fact_confidence, fact_test, fact_decision, fact_cost_estimate, fact_lifecycle, dim_capability, dim_milestone tables - core/metrics/decision_ledger_cli.py — CLI with query/verify-chain/stats/export/replay - tests/test_metrics_collector.py — 7 tests (all pass, incl. idempotent re-run REQ-200) D-120: Nova-native (SQLite, no ClickHouse) D-125: hybrid (reads files + events → SQLite) D-126: cold-only (no hot path) ---ci--- project: acdl phase: 2 milestone: v1.17 status: execute ---/ci---	2026-08-04 20:01:50 +00:00
Jon Chery	f8616b806e	feat(P1): event emitters — CloudEvents envelope, Decision Ledger, Infracost adapter, attestation/confidence/policy event emission ... P1 (Wave 1, feat) — REQ-187, REQ-188, REQ-205 (emitter), REQ-206 (emitter) New components: - core/metrics/event_envelope.py — CloudEvents 1.0 envelope + platform.* conventions - core/metrics/run_manifest.py — per-run manifest writer (nova.run.started/completed/failed) - core/metrics/decision_ledger.py — SQLite append-only hash-chain (ai.decision.made + attestation.recorded) - core/metrics/infracost_adapter.py — Infracost post-processor (degraded mode when CLI absent, A6) - schemas/metrics_event.schema.json — CloudEvents envelope schema - schemas/metrics_run_manifest.schema.json — per-run manifest schema - metrics/README.md — backup/restore doc (REQ-201) - tests/test_metrics_emitters.py — 16 tests (all pass) Modified components: - core/confidence_signal.py — emits nova.confidence.computed + nova.ai.decision.made (D-122) - core/hitl_gates.py — emits nova.attestation.recorded on qa/prod/dr gates (D-132) - adapters/terraform/policy/checkov_adapter.py — emits nova.policy.evaluated - pyproject.toml — addopts gains --junitxml + --json-report + --cov (REQ-206) - .gitignore — metrics runtime artifacts ignored D-120: Nova-native (JSONL + SQLite, no Kafka/OTel) D-121: Decision Ledger = outbox_writer extension → SQLite hash-chain D-122: AI decision = confidence_signal + HITL gate (not LLM) D-128: metrics/ at repo root D-132: Attestation instrumentation ---ci--- project: acdl phase: 1 milestone: v1.17 status: execute ---/ci---	2026-08-04 19:58:54 +00:00
Jon Chery	f83b974c0e	Merge milestone/v1.16-nova-simplification — v1.16 complete (Nova Simplification: 20-phase NFR sweep + final; tag v1.15.26)	2026-08-01 13:37:18 +00:00
Jon Chery	e15eea067b	docs(milestone): complete v1.15 — Nova Rebrand (tag v1.15.4) ... P5 final-review-ship complete: dual-read fallback removed (REQ-164) — core/env.py NOVA-only, .env.secrets load paths NOVA-only (G-106 retired), nova_tagging.py hard-fails any acdl:* tag, legacy ACDL_* Gitea secrets deleted, ACDL_LIFECYCLE_MODE/ACDL_LOCAL_TIER/ACDL_HITL_* exports removed from scripts, SNS subject → Nova SoD halt (P1-2), bootstrap scripts NOVA-only. Review: 2 P0 auto-fixed (duplicate delenv), P1-1/P1-2 resolved, doc-drift fixed. Audit: tags v1.15.0-4 exist; traceability REQ-155..164 all complete; ARCHITECTURE naming table matches codebase. 615 pytest PASS; run_ci.sh 3-stage PASS. NOVA_MIGRATION.md marked COMPLETE. ---ci--- project: acdl phase: 5 milestone: v1.15 status: complete phase_role: final requirements: covered: [REQ-155, REQ-156, REQ-157, REQ-158, REQ-159, REQ-160, REQ-161, REQ-162, REQ-163, REQ-164] partial: [] ---/ci---	2026-07-30 02:23:55 +00:00
Jon Chery	13846d553a	fix(P5): review P0 — collapse duplicate NOVA_* delenv in route-halt + adapter tests ... Code review (correctness lens) found the same P5 mechanical-edit defect in two more test files: the ACDL_* fallback delenv was replaced with a duplicate NOVA_* delenv (leaving a dead duplicate line, a stale 'ACDL_* fallback until P5' comment, and the ACDL_* var no longer cleaned). - tests/test_route_halt_artifact.py: two sites (stderr-fallback + outbox-fallback) each deleted NOVA_SOD_HALT_TOPIC_ARN twice. - tests/test_adapter.py::test_default_remote_state_key: deleted NOVA_REMOTE_STATE_KEY twice. With core/env.py NOVA-only as of P5, a single NOVA_* delenv is the correct precondition. Collapsed to one delenv per var + updated comments. ---ci--- project: acdl phase: 5 milestone: v1.15 status: verify lessons: - P0 fix applied: duplicate monkeypatch.delenv('NOVA_*') in test_route_halt_artifact.py (2 sites) + test_adapter.py collapsed to a single delenv consistent with the P5 NOVA-only core/env.py. ---/ci---	2026-07-30 02:05:57 +00:00
Jon Chery	d14f9289da	fix(P5): review P0 — remove duplicate delenv in attestation signature-skip test ... Code review (correctness lens) found a P0 in tests/test_attestation_matrix.py introduced by the P5 fallback-removal pass: the dual-read delenv of ACDL_ATTESTATION_SIGNING_KEY_ID was replaced with a second (duplicate) delenv of NOVA_ATTESTATION_SIGNING_KEY_ID, leaving the test misleading (comment claimed 'both NOVA_* and ACDL_* must be unset' while only NOVA_* was deleted twice) and the ACDL_* var no longer cleaned. With P5 having removed the ACDL_* fallback from core/env.py, deleting NOVA_* alone is the correct and sufficient precondition for the skip; this commit drops the duplicate line and updates the comment to match the NOVA-only contract. ---ci--- project: acdl phase: 5 milestone: v1.15 status: verify lessons: - P0 fix applied: duplicate monkeypatch.delenv('NOVA_ATTESTATION_SIGNING_KEY_ID') in test_signature_skip_when_key_unset left the test misleading and the ACDL_* var uncleaned; collapsed to a single NOVA_* delenv consistent with the P5 NOVA-only core/env.py. ---/ci---	2026-07-30 02:03:16 +00:00
Jon Chery	0e6ecae26d	feat(P4): Nova rebrand — AWS resource migration (REQ-163) ... Rename all acdl-* AWS resources → nova-* across terraform (DynamoDB, Secrets Manager, Lambda, SNS, SG, KMS alias, ECS, ECR, IAM user/policy, state bucket, ALB, VPC/subnet names). Lambda default table names → nova-* (D-111). State bucket backend → nova-tfstate (-migrate-state documented). New docs/NOVA_AWS_MIGRATION.md runbook (staged migration + rollback). New scripts/migrate_dynamodb_data.py (scan+copy, dry-run default). acdl-deploy- → nova-deploy- role ARN in deploy workflows. Test fixtures updated; terraform validate + pytest + run_ci.sh PASS. ---ci--- project: acdl phase: 4 milestone: v1.15 status: execute ---/ci---	2026-07-30 01:54:26 +00:00
Jon Chery	51c3edf458	feat(P3): Nova rebrand — SSM path + tag keys (REQ-161/162) ... SSM path /acdl/{env}/{contractId}/{output} → /nova/... across core/output_publisher + contract resolver + consumer docs. New scripts/migrate_ssm_paths.py (copy/verify/delete, dry-run default). AWS tag keys acdl:owner|environment|contract|cost-center|ref → nova:* across terraform tagging + ABAC session policies (iam:ResourceTag/acdl:* → iam:ResourceTag/nova:*). nova_tagging.py hard mode (D-109 warn→hard). tagging-standard.json tag-key values → nova:*. New scripts/untag_acdl_keys.py (remove old acdl:* tags, dry-run default). Test fixtures updated; pytest + run_ci.sh PASS. ---ci--- project: acdl phase: 3 milestone: v1.15 status: execute ---/ci---	2026-07-30 01:38:30 +00:00
Jon Chery	d5bae868a4	feat(P2): Nova rebrand — code/env-vars/consumer-path (REQ-158/159/160) ... core/env.py dual-read helper (D-108); 21 ACDL_*→NOVA_* env vars migrated across core/scripts/adapters/tests/workflows + .env/.env.secrets (key rename, values stay). G-106 binding: run_platform.sh:288-289 + regression_verify.py:309-312 dual-read (NOVA first, ACDL fallback). G-108 binding: Gitea NOVA_* secrets created via API + workflow secrets: refs updated (deploy.yml + modules-lifecycle.yml, .gitea + .github). acdl_tagging.py→nova_tagging.py (D-109 warn mode, nova:* enforced). .acdl/→.nova/ consumer path (resolver + deploy workflow + schema + tests + docs). Test fixtures updated; pytest + run_ci.sh PASS. ---ci--- project: acdl phase: 2 milestone: v1.15 status: execute ---/ci---	2026-07-30 01:25:24 +00:00
Jon Chery	3b1181f39b	Merge milestone/v1.14-refinement — v1.14 complete (NFR Refinement: bug fixes, security, stubs, tests, docs; 20 phases + final; tag v1.13.24) ... v1.14 NFR Refinement milestone complete. 20 execution phases (P1-P20) + 1 final (P21). All P1/P2 backlog from v1.11 review resolved. Security posture hardened (swallowed errors, account ID externalized, IAM scoped, schema validation, credential hygiene). Stubs resolved (kyverno --kube- version removed). 7 untested scripts gained coverage. Documentation synced (ARCHITECTURE v1.11-v1.14 addenda, stale @v1.6-1.9 -> @v1.13, GRILL G-005/G-008 resolved, COST.md window extended, D-083 deferral recorded). Platform VPC parameterized. 561 tests pass (was 528 at v1.13.2; +33). 22/22 capabilities Verified. 6 grill binding decisions (G-101..G-106) applied. 1 escalation (E-001) auto-resolved at full autonomy (D-101). ---ci--- project: acdl phase: 21 milestone: v1.14 status: complete ---/ci---	2026-07-29 21:36:37 +00:00
Jon Chery	6d8c098205	test(P70): add CAP-013 regression tests — terraform validate + dedup unit assertions (P1 remediation) ... --- ci--- project: acdl phase: 70 milestone: v1.12 status: verify --- /ci--- Code review (P70) flagged 2 P1 testing gaps: 1. No end-to-end terraform validate test for the microservice (the real CAP-013 surface). A future refactor could re-break the dedup and the suite would stay green. 2. No unit test for the _child_id helper / id_remap / dedup merge. Added 6 tests (38 adapter tests total, 522 suite total): - test_microservice_dedup_names_modules_by_child_id: asserts module 'alb' + 'service' appear, expanded sub-ids do NOT. - test_microservice_dedup_rewrites_stack_outputs: service_arn -> module.service, lb_arn -> module.alb. - test_microservice_dedup_rewrites_cross_module_refs: lb_target_group_arn -> module.alb.target_group_arn (not module.alb-targetgroup). - test_microservice_emits_valid_terraform: end-to-end terraform init + validate on the microservice main.tf (locks in CAP-013). - test_single_resource_returns_id_verbatim / test_multi_resource_returns_common_prefix: unit tests for _child_id. P2 nits (noted, not fixed): the ci-vpc-apply/destroy 'if' uses != 'plan' rather than == 'full' (stricter but not exploitable); _child_id docstring could note commonprefix is character-wise. Both are post-hoc.	2026-07-29 13:44:52 +00:00
Jon Chery	41c3377b96	feat(P67b): lifecycle tests default to plan-only; ACDL_LIFECYCLE_MODE flag overrides to full (REQ-134) ... --- ci--- project: acdl phase: 67b milestone: v1.12 status: execute --- /ci--- The modules-lifecycle pipeline now defaults to plan-only (fast, no AWS mutation, no credentials, no cost) so it runs on every PR. A CI variable ACDL_LIFECYCLE_MODE (workflow_dispatch input 'lifecycle_mode', default 'plan') overrides to 'full' for the real apply->modify->destroy against live AWS. Scripts: run_lifecycle_test.sh / run_lifecycle_destroy.sh / run_l2_lifecycle_test.sh / run_l2_lifecycle_destroy.sh read the flag and dispatch to --plan-only (plan mode) or --apply/--destroy (full mode). Destroy is a no-op exit 0 in plan mode (nothing was applied). VPC-output injection is gated on full mode. Workflows: both .github + .gitea (byte-identical) expose lifecycle_mode as a workflow_dispatch input (choice: plan/full), pass it via env: ACDL_LIFECYCLE_MODE to every lifecycle step, skip ci-vpc-apply + ci-vpc-destroy + Read-CI-VPC-outputs in plan mode, and run the lifecycle + l2-lifecycle jobs with if: always() so they execute (plan-only) even when ci-vpc-apply is skipped. Contract + schema: pipelines/modules-lifecycle.yml gains default_mode: plan; the schema accepts default_mode (enum plan|full) and a richer workflow_dispatch inputs shape. Tests: 14 new tests in test_lifecycle_mode_flag.py (script dispatch) + 10 new tests in TestModulesLifecyclePipeline (workflow flag wiring, byte-identity, plan-mode skips). Updated test_platform_vpc_destroy to reflect the plan-mode skip. 516 tests pass; smoke-tested plan mode on the s3 module (--plan-only green, no AWS apply).	2026-07-29 13:16:03 +00:00
Jon Chery	3e11b0fafd	Merge milestone/v1.11-restart — v1.11 complete (stateless adapter + pipeline-driven module lifecycle testing, P56a-P65) ... v1.11 closes G-005 (CAP-017..022 deploy-unverified → Verified via lifecycle pipeline) and G-008 (no cost docs → COST.md). Phases: - P56a: stateless adapter rewrite (918-line monolith → 196-line assembler) - P56b: 12 L1 module terraform subdirs authored - P57: shell orchestrator --apply/--destroy lifecycle modes - P58: single platform VPC + deterministic env-aware state keys - P59: L1 module lifecycle pipeline authored - P60: L1 lifecycle live run (retrofit — module fixes for live AWS) - P61: L2 lifecycle pipeline authored - P62: L2 lifecycle live run - P63: CAP-017..022 regression registry + COST.md - P64: pre-mortem + teardown (zero live resources) - P65: rewrite caps + decks 485 offline tests pass. All 12 requirements complete. Zero live ACDL resources remain (D-096 enforced). # Conflicts: # .ciagent/PERSONAS.md # .ciagent/REQUIREMENTS.md # .ciagent/ROADMAP.md # .ciagent/config.json	2026-07-29 12:32:50 +00:00
Jon Chery	361fe600a9	feat(P61): L2 lifecycle pipeline — extend matrix + workflows + tests ... Extend the modules-lifecycle pipeline with L2 composition modules (static-assets, microservice) per REQ-128: - pipelines/modules-lifecycle.yml: added l2-lifecycle-apply/modify/destroy stages + l2_modules matrix entry - .gitea/workflows/modules-lifecycle.yml + .github/workflows/modules-lifecycle.yml: added l2-lifecycle job (byte-identical), matrix over [static-assets, microservice], needs ci-vpc-apply, has apply/modify/destroy steps. ci-vpc-destroy now needs both [lifecycle, l2-lifecycle]. - schemas/modules-lifecycle-pipeline.schema.json: added l2_modules to matrix - scripts/run_l2_lifecycle_test.sh + run_l2_lifecycle_destroy.sh: L2 wrappers that set ACDL_REMOTE_STATE_KEY=spike/ci-vpc/terraform.tfstate so the microservice composition's terraform_remote_state reads from the CI VPC - adapters/terraform/adapter.py: parameterized remote_state key via ACDL_REMOTE_STATE_KEY env var (default: platform/terraform.tfstate) - modules/l2/static-assets/examples/complex.yml: fixed bucket_name to match simple (my-static-site) so terraform modifies in-place (adds CDN + WAF) - modules/l2/microservice/examples/complex.yml: fixed bucket_name to match simple (my-microservice-demo), added desired_count:2 (modify variant) - tests/test_pipeline_contract.py: 7 new L2 tests (l2 job exists, matrix lists both modules, apply/modify/destroy steps, needs ci-vpc-apply, ci-vpc-destroy needs both, contract matrix lists l2_modules) - pipelines/README.md: updated stages for L2 Regression: 485 passed, 5 deselected. Gitea + GitHub workflows byte-identical. ---ci--- project: acdl phase: P61 milestone: v1.11 status: execute ---/ci---	2026-07-28 20:17:27 +00:00
Jon Chery	ad3cc5f129	fix(ci): separate short-lived CI VPC + fix 8 module lifecycle failures ... Two architectural changes: 1. Created terraform/ci-vpc/ — a short-lived VPC for L1 module lifecycle testing, separate from the long-lived platform VPC. Created before VPC-dependent modules (alb, ecs-service, rds, uptime) are tested, destroyed after. Outputs (vpc_id, subnet_ids, sg_id, cluster_arn) are passed to those modules via scripts/run_lifecycle_test.sh + run_lifecycle_destroy.sh wrappers that inject the CI VPC outputs into the example contracts. 2. Updated the workflow to use ci-vpc-apply → lifecycle (with artifact passing) → ci-vpc-destroy (always runs). 8 module-specific fixes: - s3: unique bucket names (acdl-ci-s3a-simple/complex) instead of globally-taken 'my-simple-bucket' - kms-key: alias name with no spaces (locals.tf → alias/acdl-ci-kms) - iam-role: example contract uses role_name (not name, which the interface doesn't declare) - ecs-service: example contract uses family (not name); VPC inputs (cluster_arn, subnets, security_group) injected by CI VPC wrapper - uptime: added subnets, security_group, cluster_arn to interface + module; network_configuration is dynamic (only when subnets provided) - rds: added subnet_ids input + db_subnet_group resource (conditional on subnet_ids being non-empty) - alb: removed hardcoded placeholder sg/subnet values from examples; vpc_id + subnets + security_group injected by CI VPC wrapper - cloudfront: removed invalid placeholder WAF ARN from complex example Regression: 479 passed, 0 skipped, 5 deselected. All 24 example contracts pass --check-only. ---ci--- project: acdl phase: P59 milestone: v1.11 status: execute ---/ci---	2026-07-28 17:52:58 +00:00
Jon Chery	3597cf0e8f	fix(ci): install Terraform 1.9.* in test + check-only jobs ... The ci.yml workflow's test job runs test_adapter.py which includes test_s3_instance_emits_valid_terraform — this test runs terraform init+validate as a subprocess. Previously Terraform was not installed in the CI job, causing FileNotFoundError. Now both the test and check-only jobs install Terraform 1.9.* via the HashiCorp apt repo. Reverted the skip-when-terraform-missing logic in the test — Terraform is now always available in CI. ---ci--- project: acdl phase: P59 milestone: v1.11 status: execute ---/ci---	2026-07-28 16:12:44 +00:00
Jon Chery	3ef3a82f9c	fix(P59): skip terraform validate test when terraform binary not installed ... The test_s3_instance_emits_valid_terraform test runs terraform init+validate as a subprocess. In CI, the ci.yml workflow doesn't install Terraform (only the modules-lifecycle workflow does). The test now skips gracefully when terraform is not on PATH, using shutil.which('terraform'). ---ci--- project: acdl phase: P59 milestone: v1.11 status: execute ---/ci---	2026-07-28 16:10:45 +00:00
Jon Chery	7ba72bf656	feat(P59): L1 module lifecycle pipeline — author workflows + schema + tests ... EXECUTE stage. Authors the modules-lifecycle pipeline that matrix-tests every L1 module's examples/{simple,complex}.yml contracts through apply→modify→destroy against live AWS. No per-module Python. New files: - pipelines/modules-lifecycle.yml: declarative contract (5 stages: platform-vpc-apply, lifecycle-apply, lifecycle-modify, lifecycle-destroy, platform-vpc-destroy). Matrix over 12 L1 modules. - .gitea/workflows/modules-lifecycle.yml + .github/workflows/modules-lifecycle.yml: byte-identical workflows. 3 jobs: platform-vpc-apply (prerequisite), lifecycle (matrix of 12 modules × apply/modify/destroy), platform-vpc-destroy (always runs, cleanup). Triggers: pull_request to main + workflow_dispatch. - schemas/modules-lifecycle-pipeline.schema.json: schema for the new pipeline shape (extends pipeline.schema.json with workflow_dispatch + matrix). Tests (tests/test_pipeline_contract.py): - TestModulesLifecyclePipeline: 12 tests (schema valid, contract validates, byte-identical, workflow name, 3 jobs, triggers, matrix lists all 12 L1 modules, apply/modify/destroy steps present, platform-vpc-destroy always runs). pipelines/README.md: added modules-lifecycle to the pipeline table. Regression: 479 passed, 0 skipped, 5 deselected (slow). ---ci--- project: acdl phase: P59 milestone: v1.11 status: execute ---/ci---	2026-07-28 16:07:57 +00:00
Jon Chery	fda4564a7f	feat(P58): single platform VPC + deterministic env-aware state keys ... EXECUTE stage. Fixes the 4-VPC bug: adds a single shared VPC to terraform/platform, drops the vpc child from the microservice composition (references the platform VPC via data source), and makes state keys env-aware (spike/{id}/{env}/terraform.tfstate — stable across lifecycle). Platform VPC (terraform/platform/main.tf): - aws_vpc.acdl_shared (10.0.0.0/16) + 2 subnets + IGW + route table + SG - Outputs: vpc_id, subnet_ids, ecs_security_group_id Microservice composition (modules/l2/microservice/composition.json): - Dropped the vpc child (no per-contract VPC ever again). - Added data_sources block: platform_vpc → terraform_remote_state (platform). - Wires: vpc.outputs.subnet_ids → platform_vpc.outputs.subnet_ids. - Wires: platform_vpc.outputs.vpc_id → alb.inputs.vpc_id. - Wires: platform_vpc.outputs.ecs_security_group_id → service.inputs.security_group. Contract resolver (core/contract_resolver.py): - Added environment to the stack instance (stack.environment). - Added data_sources handling: pseudo-children with outputs but no resources. - data_sources propagated through fragment merge to the final stack instance. Adapter (adapters/terraform/adapter.py): - State key: spike/{stack_name}/{environment}/terraform.tfstate (env-aware). - Emits data "terraform_remote_state" "platform" block when data_sources present. - ref:platform_vpc.<output> → data.terraform_remote_state.platform.outputs.<output>. Tests (tests/test_adapter.py): - test_adapt_env_aware_state_key: spike/msvc/prod/terraform.tfstate. - test_adapt_emits_data_source_block: data.terraform_remote_state.platform. - test_adapt_no_vpc_for_microservice: no resource "aws_vpc" in microservice output. - Updated existing state key assertion (spike/s3/dev/terraform.tfstate). Regression: 467 passed, 0 skipped, 5 deselected. run_platform.sh --check-only passes for both microservice (9 resources, no VPC) and static-assets (5 resources). ---ci--- project: acdl phase: P58 milestone: v1.11 status: execute ---/ci---	2026-07-28 16:07:57 +00:00