2 Commits

Author	SHA1	Message	Date
Jon Chery	255cde5002	verify(P5): review fixes — wire Step 5c meta-policies + fix smoke policy (P1-1, P1-2, P1-3) ... P1-1 (correctness): run_platform.sh Step 5c now invokes the meta-policies (block-on-any-critical, tagging-rules-agree) over the merged PCR list after Step 5b, appending the meta-PCRs to pcr.json before the confidence signal runs. Closes the D-118/D-119 declarative-critical-block gap (the confidence_signal.py hard-override stays as defense-in-depth). P1-2 (testing): test_meta_policies.py behavioral assertions strengthened — test_no_critical_passes asserts no fails, test_critical_fail_present asserts a non-pass result, test_pcrs_validate_against_schema validates output. P1-3 (correctness): _smoke.json assertion rewritten from malformed '{{ to_string(@) }}' to valid JMESPath '(regex_match(...))'. ---ci--- project: acdl phase: 5 milestone: v1.25 status: execute phase_role: final ---/ci---	2026-08-12 18:49:06 +00:00
Jon Chery	7f4b79593a	feat(P3): plan-JSON policies + meta-orchestration + pipeline wiring (REQ-300..303) ... plan-json/ policies (3): forbid-plaintext-secrets (ports CKV_AWS_41/45/46), forbid-iam-wildcard (ports CKV_AWS_1/40), require-kms-reference (ports CKV_AWS_7/33) over terraform show -json output. meta/ policies (2): block-on-any-critical (declarative source of truth for critical-block; confidence_signal hard-override stays as defense-in-depth, D-119) + tagging-rules-agree (cross-checks Checkov NOVA_TAG_NAMING vs kj KJ_REQUIRE_TAGGING_STANDARD, D-118). scripts/run_platform.sh Step 5b: parallel kyverno-json plan-JSON pass; merges Checkov/Wiz + kj PCR lists into the confidence signal policy input; skips gracefully when kj absent (D-120). tests: test_plan_json_policies.py, test_meta_policies.py (skip-without-kj), test_run_platform_plan_json_policies.py (script-substring assertion, no skip). ---ci--- project: acdl phase: 3 milestone: v1.25 status: execute phase_role: execution requirements: covered: [REQ-300, REQ-301, REQ-302, REQ-303] partial: [] ---/ci---	2026-08-12 18:29:34 +00:00