255cde5002
verify(P5): review fixes — wire Step 5c meta-policies + fix smoke policy (P1-1, P1-2, P1-3)
...
P1-1 (correctness): run_platform.sh Step 5c now invokes the meta-policies
(block-on-any-critical, tagging-rules-agree) over the merged PCR list after
Step 5b, appending the meta-PCRs to pcr.json before the confidence signal
runs. Closes the D-118/D-119 declarative-critical-block gap (the
confidence_signal.py hard-override stays as defense-in-depth).
P1-2 (testing): test_meta_policies.py behavioral assertions strengthened —
test_no_critical_passes asserts no fails, test_critical_fail_present asserts
a non-pass result, test_pcrs_validate_against_schema validates output.
P1-3 (correctness): _smoke.json assertion rewritten from malformed
'{{ to_string(@) }}' to valid JMESPath '(regex_match(...))'.
---ci---
project: acdl
phase: 5
milestone: v1.25
status: execute
phase_role: final
---/ci---
2026-08-12 18:49:06 +00:00
38b51f3e6d
feat(P4): regression-gate policies + docs (REQ-304..307)
...
regression/ policies (3): cap-013-adapter-dedup, cap-023-metrics-collector,
cap-024-deck-structure — declarative mirrors of core/regression_verify.py
over capability-inventory JSON. The imperative regression_verify.py is kept
(drives CI gate); the policies are the declarative mirror (IDEATE I1 quality
improvement).
tests: test_regression_policies.py + clean/drifted fixtures. Skip-without-kj.
docs: adapters/README.md (new kyverno-json row + PolicyEngine Protocol
section with how-to-add-OpaEngine), adapters/kyverno-json/README.md (engine,
install, policy directory layout, 4 categories, severity convention),
schemas/README.md (D-116 engine enum reuse note), modules/STANDARDS.md §10
Policy Authoring Standard, docs/METRICS.md (swappable engine narrative).
---ci---
project: acdl
phase: 4
milestone: v1.25
status: execute
phase_role: execution
requirements:
covered: [REQ-304, REQ-305, REQ-306, REQ-307]
partial: []
---/ci---
2026-08-12 18:42:55 +00:00
7f4b79593a
feat(P3): plan-JSON policies + meta-orchestration + pipeline wiring (REQ-300..303)
...
plan-json/ policies (3): forbid-plaintext-secrets (ports CKV_AWS_41/45/46),
forbid-iam-wildcard (ports CKV_AWS_1/40), require-kms-reference (ports
CKV_AWS_7/33) over terraform show -json output.
meta/ policies (2): block-on-any-critical (declarative source of truth for
critical-block; confidence_signal hard-override stays as defense-in-depth,
D-119) + tagging-rules-agree (cross-checks Checkov NOVA_TAG_NAMING vs kj
KJ_REQUIRE_TAGGING_STANDARD, D-118).
scripts/run_platform.sh Step 5b: parallel kyverno-json plan-JSON pass; merges
Checkov/Wiz + kj PCR lists into the confidence signal policy input; skips
gracefully when kj absent (D-120).
tests: test_plan_json_policies.py, test_meta_policies.py (skip-without-kj),
test_run_platform_plan_json_policies.py (script-substring assertion, no skip).
---ci---
project: acdl
phase: 3
milestone: v1.25
status: execute
phase_role: execution
requirements:
covered: [REQ-300, REQ-301, REQ-302, REQ-303]
partial: []
---/ci---
2026-08-12 18:29:34 +00:00
e6ee79402b
feat(P2): contract + stack-IR kyverno-json policies + resolver wiring (REQ-295..299)
...
contract/ policies (4): require-id-pattern, require-env-in-enum,
require-infrastructure-min-1, forbid-unknown-fields — declarative
mirrors of contract.schema.json constraints.
stack-ir/ policies (3): require-tagging-standard (nova:owner/contract/
environment/cost-center tags — ports nova_tagging.py), forbid-public-ingress
(v1.0 demo rule, now declarative), require-encryption-by-default (v1.8
D-encryption-default — S3 + EBS encryption config).
core/contract_resolver.py: pre-resolve contract-policy evaluation (REQ-296)
+ post-resolve stack-IR-policy evaluation (REQ-298). Additive — the resolver's
return shape + exceptions unchanged; PCRs attach to stack_instance.policyResults.
Policy evaluation never breaks the resolver (confidence signal decides gate).
tests: test_stack_ir_policies.py + passing/failing fixtures. Skip-without-kj.
16 existing resolver tests unchanged.
---ci---
project: acdl
phase: 2
milestone: v1.25
status: execute
phase_role: execution
requirements:
covered: [REQ-295, REQ-296, REQ-297, REQ-298, REQ-299]
partial: []
---/ci---
2026-08-12 18:25:18 +00:00
ac18c98385
feat(P1): kyverno-json engine core + PolicyEngine protocol (REQ-291..294, 308, 309)
...
core/policy_engine.py: PolicyEngine Protocol (PEP 544, runtime_checkable)
+ PolicyEngineRegistry (selects from config.json.policy.engine) + NullEngine
fallback (NULL_ENGINE_INACTIVE when policy key absent).
adapters/kyverno-json/: KyvernoJsonEngine — shells to , translates
native output → list[dict] PCR records (engine: "kyverno", ruleId KJ_ prefix,
severity via nova.cloudinit.dev/severity annotation, default info).
is_configured() guards on → KJ_ENGINE_NOT_CONFIGURED SKIPPED PCR
(distinct from NullEngine). Defensive parsing (malformed → error PCR).
config.json: new object {engine: kyverno-json, policy_root}.
scripts/install-kyverno-json.sh: go install kj@latest (D-115).
CI (.gitea + .github): install Go + kj for policy-engine tests (best-effort;
tests skip when kj absent).
tests: 24 pass, 2 skip (kj not installed). 132 existing tests unchanged.
NullEngine satisfies PolicyEngine Protocol (G-Q8a — proves swap boundary).
---ci---
project: acdl
phase: 1
milestone: v1.25
status: execute
phase_role: execution
requirements:
covered: [REQ-291, REQ-292, REQ-293, REQ-294, REQ-308, REQ-309]
partial: []
---/ci---
2026-08-12 18:19:16 +00:00
Jon Chery