 Jon Chery
|
e6ee79402b
|
feat(P2): contract + stack-IR kyverno-json policies + resolver wiring (REQ-295..299)
contract/ policies (4): require-id-pattern, require-env-in-enum,
require-infrastructure-min-1, forbid-unknown-fields — declarative
mirrors of contract.schema.json constraints.
stack-ir/ policies (3): require-tagging-standard (nova:owner/contract/
environment/cost-center tags — ports nova_tagging.py), forbid-public-ingress
(v1.0 demo rule, now declarative), require-encryption-by-default (v1.8
D-encryption-default — S3 + EBS encryption config).
core/contract_resolver.py: pre-resolve contract-policy evaluation (REQ-296)
+ post-resolve stack-IR-policy evaluation (REQ-298). Additive — the resolver's
return shape + exceptions unchanged; PCRs attach to stack_instance.policyResults.
Policy evaluation never breaks the resolver (confidence signal decides gate).
tests: test_stack_ir_policies.py + passing/failing fixtures. Skip-without-kj.
16 existing resolver tests unchanged.
---ci---
project: acdl
phase: 2
milestone: v1.25
status: execute
phase_role: execution
requirements:
covered: [REQ-295, REQ-296, REQ-297, REQ-298, REQ-299]
partial: []
---/ci---
|
2026-08-12 18:25:18 +00:00 |
|
|
Jon Chery
|
51c3edf458
|
feat(P3): Nova rebrand — SSM path + tag keys (REQ-161/162)
SSM path /acdl/{env}/{contractId}/{output} → /nova/... across
core/output_publisher + contract resolver + consumer docs. New
scripts/migrate_ssm_paths.py (copy/verify/delete, dry-run default).
AWS tag keys acdl:owner|environment|contract|cost-center|ref → nova:*
across terraform tagging + ABAC session policies (iam:ResourceTag/acdl:*
→ iam:ResourceTag/nova:*). nova_tagging.py hard mode (D-109 warn→hard).
tagging-standard.json tag-key values → nova:*. New
scripts/untag_acdl_keys.py (remove old acdl:* tags, dry-run default).
Test fixtures updated; pytest + run_ci.sh PASS.
---ci---
project: acdl
phase: 3
milestone: v1.15
status: execute
---/ci---
|
2026-07-30 01:38:30 +00:00 |
|
|
Jon Chery
|
1fd37a2843
|
feat(P23): tagging standard + Wiz adapter + Kyverno adapter
Phase 23 (v1.7) — tagging standards and security adapters.
* schemas/tagging-standard.json (D-054): canonical required-tags schema
(acdl:owner, acdl:contract, acdl:environment, acdl:cost-center).
* adapters/terraform/policy/custom_rules/acdl_tagging.py: Checkov custom
rule (ACDL_TAG_NAMING) loaded via --external-checks-dir; closes D-043
(synthetic SKIPPED record replaced by real PASS/FAIL records).
* checkov_adapter.py: removed _emit_tag_naming_skipped(), added
ACDL_TAG_NAMING to RULE_MAP, updated docstring.
* scripts/run_platform.sh: both Checkov invocations pass
--external-checks-dir adapters/terraform/policy/custom_rules/.
* adapters/wiz/ (D-052): Wiz adapter translating issue records to
PolicyCheckResult (engine: "wiz"); graceful degradation emits
WIZ_NOT_CONFIGURED SKIPPED when unconfigured; is_configured() gate.
* adapters/kyverno/ (D-053): Kyverno adapter translating PolicyReport
results to PolicyCheckResult (engine: "kyverno"); ready but inactive
for Terraform-only stacks; 3 sample ClusterPolicies in policies/.
* schemas/policy_check_result.schema.json: engine enum += "wiz".
* tests: fixtures + test_wiz_adapter.py (8 tests) + test_kyverno_adapter.py
(13 tests); updated test_checkov_adapter.py to not expect the removed
synthetic ACDL_TAG_NAMING SKIPPED record.
* scripts/run_ci.sh: lint stage compiles the new adapter modules.
202 tests pass; CI pipeline OK (lint + test + check-only).
Deviations:
- Wiz adapt() had an AttributeError on bare-list top-level input
(data.get() on a list); fixed to dispatch on isinstance(data, list)
before calling .get(). No spec change — bare-list handling is implied
by the original docstring's "data if isinstance(data, list)" branch.
- Kyverno _to_pcr({}) defaults result to "skipped" (entry.get("result",
"skip") -> "skip"), not "error"; test expectation corrected. Added an
explicit unknown-result-string test to cover the "error" fallback.
---ci---
project: acdl
phase: 23
milestone: v1.7
status: execute
---/ci---
|
2026-07-22 20:00:46 +00:00 |
|