 Jon Chery
|
23b8ff81d3
|
docs(P05): verify REQ-349/350/351 pass in combined suite (security-engineer)
---ci---
project: acdl
phase: 5
milestone: v1.28
status: execute
persona: security-engineer
---
Verification results (combined suite, .venv/bin/python -m pytest):
REQ-349 (mode_resolver property tests, tests/test_mode_resolver.py):
12 passed — all four priority levels + edge cases (TTY/piped stdout,
missing credential, conflicting flag/env, invalid env value).
REQ-350 (KMS round-trip, tests/test_kms_roundtrip.py): 1 passed —
sign JWT via mock KMS → JWKS Lambda → pyjwt verify (CAP-037, DER→raw
byte-correct).
REQ-351 (PAT revocation SLO, tests/test_pat_revocation.py): 2 passed
— issue → vend → revoke → 403 pat_revoked in <1s (D-229 strong-read).
Combined suite regression run
(pytest tests/ --ignore=tests/test_pptx_generator.py -k 'not live_aws
and not slow'): 1000 passed, 5 deselected, 0 failed.
Fix: the first regression run flagged 1 failure —
test_no_forge_mentions_in_synced_files (REQ-230 v1.20 guard) caught two
forbidden forge-name mentions in the new docs (operator-guide §7,
developer-guide §9). Rephrased both to 'internal forge' / 'internal
forge runner' to keep the docs sync-safe. No code changes. Re-ran the
full suite: 1000 passed, 0 failed.
|
2026-08-19 23:30:41 +00:00 |
|
|
Jon Chery
|
1f4f7f0f81
|
docs(P05): operator guide for nova idp setup (REQ-345, C-6.3, lead-developer)
---ci---
project: acdl
phase: 5
milestone: v1.28
status: execute
persona: lead-developer
---
Add docs/operator-guide-idp.md covering nova idp setup --check/--apply/
--verify, the prerequisite IAM policy delta, the CloudFormation review
flow ($PAGER + y/N), --dry-run, --public-jwks-domain, and the C-6.3
grill additions: KMS key rotation (90 days, alias re-point + overlap
window), Lambda layer update procedure, DDB PITR restore procedure
(35-day window), emergency PAT revocation (DDB-level update-item on
nova-pats, bypasses CLI, satisfies D-229 strong-read SLO).
|
2026-08-19 23:20:21 +00:00 |
|