155c02fe90
docs(P01): verify — 38/38 checks passed (structural+behavioral+security+quality)
...
Nova Slides Render / render (push) Failing after 22s
nova-publish / Build + push kj ECR image (KJ-STATIC, D-239) (push) Failing after 13m15s
nova-publish / Publish wheel + Lambda layer + Lambda zip + Release (push) Has been skipped
---ci---
project: acdl
phase: 1
milestone: v1.30
status: verify
reqs: [REQ-372.1,REQ-372.2,REQ-372.3,REQ-372.4,REQ-372.5,REQ-372.6,REQ-372.7,REQ-372.8,REQ-372.9,REQ-372.10,REQ-372.11,REQ-372.12]
---/ci---
2026-08-20 13:24:22 +00:00
e3a13e4768
feat(P01): render PPTX + CAP-042 + D-241 record + frontmatter-comment fix
...
- render_pptx.py: skip leading HTML comments before frontmatter (split_slides + parse_frontmatter)
- docs/presentations/nova-leadership-deck.pptx: 7 slides, footer on every slide
- STATE.md: CAP-042 row appended (leadership deck, single-shot, Aug 2026)
- PROJECT.md: D-241 formal entry (single-shot, discrete, no compression)
- smoke test exits 0 (all 6 assertions a-f pass)
---ci---
project: acdl
phase: 1
milestone: v1.30
status: execute
wave: 4
persona: backend-engineer + lead-developer
---/ci---
2026-08-20 13:23:28 +00:00
dc784d576d
feat(P01): check_leadership_deck.sh smoke test (REQ-372.8 a-f, on-demand)
...
---ci---
project: acdl
phase: 1
milestone: v1.30
status: execute
wave: 3
persona: ci-cli-engineer
---/ci---
2026-08-20 13:22:27 +00:00
d66b7b0e73
docs(P01): author nova-leadership-deck-marp.md (7 slides, REQ-372.1/.3/.4/.6/.7/.9/.12)
...
---ci---
project: acdl
phase: 1
milestone: v1.30
status: execute
wave: 2
persona: ci-doc-writer
---/ci---
2026-08-20 13:21:56 +00:00
929d0d94c2
feat(P01): extend render_pptx.py — path arg + --output + footer textbox (D-242)
...
---ci---
project: acdl
phase: 1
milestone: v1.30
status: execute
wave: 1
persona: backend-engineer
---/ci---
2026-08-20 13:20:23 +00:00
fff2bcc606
docs(ship): P0 complete → v1.29.1 (v1.30 pre-execution)
...
---ci---
project: acdl
phase: 0
milestone: v1.30
status: complete
tag: v1.29.1
release_id: 811
---/ci---
2026-08-20 13:19:06 +00:00
adcd012a2f
merge(phase/00): v1.30 P0 pre-execution complete (specify→clarify→research→plan→grill→mvp/ux)
...
---ci---
project: acdl
phase: 0
milestone: v1.30
status: complete
tag: v1.29.1
---/ci---
2026-08-20 13:18:11 +00:00
8ba9981743
decision(P00): mvp/ux gate — auto-generated (3 sections present)
...
Nova Slides Render / render (push) Failing after 24s
nova-publish / Build + push kj ECR image (KJ-STATIC, D-239) (push) Failing after 2m43s
nova-publish / Publish wheel + Lambda layer + Lambda zip + Release (push) Has been skipped
---ci---
project: acdl
phase: 0
milestone: v1.30
status: mvp_ux_check
---/ci---
2026-08-20 13:18:04 +00:00
48657eb816
docs(P00): grill — PROCEED (0.88), G-1..G-4 binding decisions
...
---ci---
project: acdl
phase: 0
milestone: v1.30
status: grill
---/ci---
2026-08-20 13:17:55 +00:00
e560adacb6
docs(P00): create phase plans — P1 leadership-deck (4 waves)
...
---ci---
project: acdl
phase: 0
milestone: v1.30
status: plan
---/ci---
2026-08-20 13:17:16 +00:00
18b403fcd8
docs(P00): research findings + persona assessment
...
---ci---
project: acdl
phase: 0
milestone: v1.30
status: research
---/ci---
2026-08-20 13:16:33 +00:00
6aac523da7
docs(P00): clarify — D-241/D-242/D-243 + STATE.md intake override
...
---ci---
project: acdl
phase: 0
milestone: v1.30
status: clarify
decisions: [D-241, D-242, D-243]
---/ci---
2026-08-20 13:14:59 +00:00
65bf3d84e9
docs(init): validate specification — REQ-372 leadership deck (v1.30)
...
---ci---
project: acdl
phase: 0
milestone: v1.30
status: specify
---/ci---
2026-08-20 13:14:14 +00:00
adf3b1c02f
docs(audit): fix core module count in STATE.md (27 → 26 top-level + 8 lambda + 10 metrics)
...
acdl-ci / Lint (push) Successful in 12s
acdl-ci / Test (push) Failing after 22s
acdl-ci / Platform check-only (offline) (push) Successful in 18s
nova-release / Compute semver + update tags (push) Failing after 19s
acdl-ci / forge_parity_disabled (push) Failing after 10m46s
---ci---
project: acdl
phase: 0
milestone: v1.30
status: specify
audit: adversarial-fix
---/ci---
2026-08-20 12:52:15 +00:00
f8677fa002
docs(audit): fix stale milestone labels + checkpoint + config — v1.29 complete, v1.30 scoped
...
acdl-ci / forge_parity_disabled (push) Successful in 8s
acdl-ci / Lint (push) Successful in 13s
acdl-ci / Test (push) Failing after 24s
acdl-ci / Platform check-only (offline) (push) Successful in 20s
nova-release / Compute semver + update tags (push) Failing after 12m44s
Audit fixes:
- PROJECT.md: v1.28 + v1.29 subheaders 'Feature milestone — active' → 'complete'
- REQUIREMENTS.md: same fix (v1.28 + v1.29)
- PROJECT.md: v1.29 header '(active, milestone branch...)' → '(complete, tag v1.28.6, merged to main 2026-08-20)'
- REQUIREMENTS.md: same header fix
- config.json: active_milestone v1.29 → v1.30 (v1.29 complete, next milestone scoped)
- CHECKPOINT.json: cleared v1.29 complete state, set v1.30 phase 0 specify (per run.md clear-checkpoint)
---ci---
project: acdl
phase: 0
milestone: v1.30
status: specify
audit: fixes-applied
---/ci---
2026-08-20 10:54:34 +00:00
713ad2eff2
docs(pdlc): STATE.md Phase 0 intake — post-v1.29 ground truth snapshot
...
acdl-ci / forge_parity_disabled (push) Successful in 7s
acdl-ci / Lint (push) Successful in 13s
acdl-ci / Test (push) Failing after 20s
acdl-ci / Platform check-only (offline) (push) Successful in 23s
nova-release / Compute semver + update tags (push) Failing after 22s
Initiative: Leadership Presentation Deck (≤7 slides, S&P theme, 18-month CDLC→SDLC→PDLC roadmap).
v1.29 complete (v1.28.6, merged to main 9dc56699dc5669
2026-08-20 10:51:25 +00:00
9dc56698fb
docs(milestone): complete v1.29 Reposplit + Identity Layer Bring-Live (release v1.28.6)
...
acdl-ci / Lint (push) Successful in 9s
acdl-ci / forge_parity_disabled (push) Successful in 9s
acdl-ci / Test (push) Failing after 22s
acdl-ci / Platform check-only (offline) (push) Successful in 24s
Nova Slides Render / render (push) Failing after 14m26s
nova-release / Compute semver + update tags (push) Failing after 14m35s
---ci---
project: acdl
phase: 6
milestone: v1.29
status: complete
requirements:
covered: [REQ-354, REQ-367, REQ-368, REQ-369, REQ-OPS-GUIDE, REQ-CONSUMER-BUMP]
covered_reference: [REQ-355, REQ-356, REQ-357, REQ-358, REQ-359, REQ-360, REQ-361, REQ-362, REQ-363, REQ-363b, REQ-364, REQ-365, REQ-366, REQ-371]
partial: []
---/ci---
2026-08-20 05:29:59 +00:00
932923ee99
merge(milestone): v1.29 Reposplit + Identity Layer Bring-Live to main (release v1.28.6)
...
Nova Slides Render / render (push) Failing after 22s
---ci---
project: acdl
phase: 6
milestone: v1.29
status: complete
---/ci---
2026-08-20 05:29:46 +00:00
184f33c60a
merge(chore): PDLC Phase 0 state intake — post-v1.28 ground truth snapshot
acdl-ci / Test (push) Failing after 23s
acdl-ci / Platform check-only (offline) (push) Successful in 24s
acdl-ci / Lint (push) Failing after 14m35s
2026-08-19 23:53:30 +00:00
a6510e7afc
docs(pdlc): STATE.md Phase 0 intake — post-v1.28 ground truth snapshot
...
Populates the PDLC Phase 0 intake format with the absolute ground truth
of the system after v1.28 ship (CLI Canonicalization + Identity Layer).
Header bumped to v1.28 last-ship. 7 sections: header, architecture state,
technical stack, active constraints (D-001..D-231, INV-1..17, CAP-001..038),
recent history + quality gates (coverage 73.8% YELLOW — below 80% floor),
agent context + assumptions, canonical state references. Unknowns explicit
(no new initiative; CodeArtifact/KMS/kj-in-Lambda unverified in-account).
---ci---
project: acdl
phase: 0
milestone: v1.28
status: pdlc-intake
---/ci---
2026-08-19 23:53:19 +00:00
c0cb1887ed
merge(milestone): v1.28 CLI Canonicalization + Identity Layer to main (release v1.27.6)
acdl-ci / Lint (push) Successful in 11s
acdl-ci / Test (push) Failing after 25s
nova-publish / Publish wheel + Lambda layer (push) Failing after 22s
Nova Slides Render / render (push) Failing after 13m46s
acdl-ci / Platform check-only (offline) (push) Failing after 14m25s
2026-08-19 23:48:04 +00:00
139cb5077a
merge(phase/06): v1.28 P6 final review + audit + milestone complete
2026-08-19 23:48:04 +00:00
adc55a17ab
docs(milestone): complete v1.28 CLI Canonicalization + Identity Layer (release v1.27.6)
...
Nova Slides Render / render (push) Failing after 29s
---ci---
project: acdl
phase: 6
milestone: v1.28
status: complete
requirements:
covered: [REQ-323..353]
partial: []
---/ci---
2026-08-19 23:47:44 +00:00
0d8913a299
merge(phase/05): v1.28 P5 docs-integration complete (REQ-345..351, E2E + threat model)
2026-08-19 23:34:11 +00:00
4697692ce7
docs(ship): P5 complete → v1.27.5 (v1.28 docs-integration)
...
Nova Slides Render / render (push) Failing after 26s
---ci---
project: acdl
phase: 5
milestone: v1.28
status: complete
---/ci---
2026-08-19 23:34:11 +00:00
23b8ff81d3
docs(P05): verify REQ-349/350/351 pass in combined suite (security-engineer)
...
---ci---
project: acdl
phase: 5
milestone: v1.28
status: execute
persona: security-engineer
---
Verification results (combined suite, .venv/bin/python -m pytest):
REQ-349 (mode_resolver property tests, tests/test_mode_resolver.py):
12 passed — all four priority levels + edge cases (TTY/piped stdout,
missing credential, conflicting flag/env, invalid env value).
REQ-350 (KMS round-trip, tests/test_kms_roundtrip.py): 1 passed —
sign JWT via mock KMS → JWKS Lambda → pyjwt verify (CAP-037, DER→raw
byte-correct).
REQ-351 (PAT revocation SLO, tests/test_pat_revocation.py): 2 passed
— issue → vend → revoke → 403 pat_revoked in <1s (D-229 strong-read).
Combined suite regression run
(pytest tests/ --ignore=tests/test_pptx_generator.py -k 'not live_aws
and not slow'): 1000 passed, 5 deselected, 0 failed.
Fix: the first regression run flagged 1 failure —
test_no_forge_mentions_in_synced_files (REQ-230 v1.20 guard) caught two
forbidden forge-name mentions in the new docs (operator-guide §7,
developer-guide §9). Rephrased both to 'internal forge' / 'internal
forge runner' to keep the docs sync-safe. No code changes. Re-ran the
full suite: 1000 passed, 0 failed.
2026-08-19 23:30:41 +00:00
d0a8c363b2
test(P05): E2E integration test — sign-up→sign-in→token-vend→apply→audit (REQ-348, security-engineer)
...
---ci---
project: acdl
phase: 5
milestone: v1.28
status: execute
persona: security-engineer
---
Add tests/test_e2e_idp.py — the J1+J2 happy-path E2E flow. Uses moto
for DynamoDB (4 IdP tables) + mock KMS (test ECC keypair). Asserts:
(a) sign_up succeeds, (b) sign_in returns a session, (c) token-vend
returns a KMS-signed OIDC token, (d) the OIDC token verifies with the
JWKS key (pyjwt), (e) nova apply --local produces a JWS attestation
(HS256), (f) the JWS verifies with the PAT-derived key (+ tamper
detection), (g) the audit chain is complete + linked (auth.sign_up,
auth.sign_in, auth.session_created, pat.issued, token.vend.allowed —
all present, linked by user_id/jti, no raw password/PAT leaked
INV-16). Also: the credentials file stores the OIDC token not the raw
PAT (C-7.3), the DDB user item has a password_hash not the raw
password, the DDB PAT row has a pat_hash not the raw PAT. Negative
path: revocation breaks the chain (403 pat_revoked, D-229 strong-read
SLO, token.vend.denied audit event).
2026-08-19 23:22:53 +00:00
04053df16e
docs(P05): identity-layer threat model (REQ-347, C-6.2, C-9.2, security-engineer)
...
---ci---
project: acdl
phase: 5
milestone: v1.28
status: execute
persona: security-engineer
---
Add docs/threat-model.md covering 8 threats + mitigations: (T-1) password
compromise → Argon2id + fail-closed (D-228) + no raw passwords (INV-16);
(T-2) PAT theft → credentials.json stores OIDC token not raw PAT (C-7.3)
+ max TTL ≤24h dev/≤1h service-account (C-6.2) + strong-read revocation
(D-229); (T-3) JWKS DDoS → reserved concurrency 10 + 1h client cache +
optional CloudFront/WAF (C-6.2); (T-4) ABAC bypass → fail-closed
(C-6.1/C-7.1, INV-17, 7 tests); (T-5) KMS key compromise → key policy
restricts kms:Sign + 90-day rotation; (T-6) DER→raw ECDSA gotcha →
cryptography decode_dss_signature + CAP-037 round-trip test; (T-7) no
AWS-managed identity (INV-15); (T-8) audit trail integrity (INV-12 +
policy_sha D-231). Includes the C-9.2 INV-18..21 compression audit:
the spec's 4 attestation concerns (immutability, signature
verifiability, key derivation, no-managed-identity) are fully captured
by INV-6 + INV-15 + INV-16 + INV-17 + REQ-332 — no semantic gap.
2026-08-19 23:22:00 +00:00
bcbeb7badb
docs(P05): developer guide for nova auth login (REQ-346, C-7.3, lead-developer)
...
---ci---
project: acdl
phase: 5
milestone: v1.28
status: execute
persona: lead-developer
---
Add docs/developer-guide-auth.md covering the 5-step quickstart (signup
→ signin → login → init → apply), nova auth signup/signin/login/status/
revoke, the credentials.json file (C-7.3: OIDC token + metadata only,
NOT raw PAT, 0600), D-226 mode resolution (flag → env → credential →
TTY) with the Edge 3 TTY-vs-piped-stdout case, the JWS-from-PAT KDF
(HKDF-SHA256, HS256 symmetric, REQ-332/C-5.2), and service-account PAT
usage in CI (max TTL ≤1h, C-6.2).
2026-08-19 23:20:54 +00:00
1f4f7f0f81
docs(P05): operator guide for nova idp setup (REQ-345, C-6.3, lead-developer)
...
---ci---
project: acdl
phase: 5
milestone: v1.28
status: execute
persona: lead-developer
---
Add docs/operator-guide-idp.md covering nova idp setup --check/--apply/
--verify, the prerequisite IAM policy delta, the CloudFormation review
flow ($PAGER + y/N), --dry-run, --public-jwks-domain, and the C-6.3
grill additions: KMS key rotation (90 days, alias re-point + overlap
window), Lambda layer update procedure, DDB PITR restore procedure
(35-day window), emergency PAT revocation (DDB-level update-item on
nova-pats, bypasses CLI, satisfies D-229 strong-read SLO).
2026-08-19 23:20:21 +00:00
df2b83c86b
merge(phase/04): v1.28 P4 token-vend-pat complete (REQ-336..344+340/341, CAP-037/038, ABAC fail-closed)
2026-08-19 23:17:31 +00:00
f68349d94d
docs(ship): P4 complete → v1.27.4 (v1.28 token-vend-pat, highest-risk phase)
...
Nova Slides Render / render (push) Failing after 28s
---ci---
project: acdl
phase: 4
milestone: v1.28
status: complete
---/ci---
2026-08-19 23:17:31 +00:00
1863a85144
feat(P04): nova idp setup --check/--apply/--verify (REQ-340/341, C-2.1, backend+cli)
...
---ci---
project: acdl
phase: 4
milestone: v1.28
status: execute
persona: backend-engineer
---
2026-08-19 23:13:21 +00:00
7dab9d5756
test(P04): CAP-037 KMS round-trip + CAP-038 PAT revocation SLO (REQ-350/351, security-engineer)
...
---ci---
project: acdl
phase: 4
milestone: v1.28
status: execute
persona: security-engineer
---
2026-08-19 23:11:43 +00:00
14809327fb
feat(P04): PAT lifecycle + nova auth login/revoke/status (REQ-342..344, C-7.3, security+cli)
...
---ci---
project: acdl
phase: 4
milestone: v1.28
status: execute
persona: cli-engineer
---
2026-08-19 23:11:16 +00:00
0662ed26a3
feat(P04): nova-idp-jwks Lambda — JWKS endpoint (REQ-338, D-230, backend-engineer)
...
---ci---
project: acdl
phase: 4
milestone: v1.28
status: execute
persona: backend-engineer
---
2026-08-19 23:08:32 +00:00
cd3418a75e
feat(P04): nova-idp-token-vend Lambda — ABAC fail-closed + KMS sign (REQ-336, C-6.1, backend+security)
...
---ci---
project: acdl
phase: 4
milestone: v1.28
status: execute
persona: backend-engineer
---
2026-08-19 23:08:06 +00:00
dee6d88d87
feat(P04): KMS ECDSA P-256 signing + DER->raw conversion (REQ-337, C-1.1, security-engineer)
...
---ci---
project: acdl
phase: 4
milestone: v1.28
status: execute
persona: security-engineer
---
2026-08-19 23:05:25 +00:00
fe0ee6aa45
feat(P04): kyverno-json ABAC policy + evaluator (REQ-339, D-227, C-5.1, security-engineer)
...
---ci---
project: acdl
phase: 4
milestone: v1.28
status: execute
persona: security-engineer
---
2026-08-19 23:04:27 +00:00
701cc572ce
chore(P04): kj-binary pin + platform/abac scaffold (C-8.2, D-227, backend-engineer)
...
---ci---
project: acdl
phase: 4
milestone: v1.28
status: execute
persona: backend-engineer
---
2026-08-19 23:03:07 +00:00
0736924de2
merge(phase/03): v1.28 P3 idp-auth complete (REQ-333..335, CAP-036)
2026-08-19 23:00:37 +00:00
05bf8bf221
docs(ship): P3 complete → v1.27.3 (v1.28 idp-auth)
...
Nova Slides Render / render (push) Failing after 24s
---ci---
project: acdl
phase: 3
milestone: v1.28
status: complete
---/ci---
2026-08-19 23:00:37 +00:00
7a7fbfed82
feat(P03): nova-idp-auth Lambda — sign-up/sign-in/session (REQ-333, backend-engineer) + CAP-036 E2E
...
Commits the full nova-idp-auth Lambda handler (sign_up/sign_in/create_session/
request_password_reset/reset_password) along with the CAP-036 E2E test
(test_idp_auth.py) covering the sign-up → sign-in → session flow, negatives
(401/409), password reset, and fail-closed 503.
---ci---
project: acdl
phase: 3
milestone: v1.28
status: execute
persona: backend-engineer
---
2026-08-19 22:58:59 +00:00
d06535032c
test(P03): Argon2 fail-closed — ImportError → 503, no weak hash (C-1.2, security-engineer)
...
---ci---
project: acdl
phase: 3
milestone: v1.28
status: execute
persona: security-engineer
---
2026-08-19 22:58:57 +00:00
8550ede810
feat(P03): Argon2id hashing — fail-closed, t=3 m=65536 p=1 (REQ-334, D-228, C-7.2, security-engineer)
...
The full nova-idp-auth Lambda handler is included in this commit (sign_up,
sign_in, create_session, request_password_reset, reset_password) since the
hashing module and handler share one file. The Argon2id hashing + fail-closed
logic is the security-engineer territory; the Lambda plumbing is backend-engineer.
---ci---
project: acdl
phase: 3
milestone: v1.28
status: execute
persona: security-engineer
---
2026-08-19 22:56:00 +00:00
71562d9db2
feat(P03): DynamoDB identity schema + CFN snippet (REQ-335, backend-engineer)
...
---ci---
project: acdl
phase: 3
milestone: v1.28
status: execute
persona: backend-engineer
---
2026-08-19 22:55:10 +00:00
91cb931bab
merge(phase/02): v1.28 P2 lambda-packaging complete (REQ-329..332)
2026-08-19 22:52:36 +00:00
a8ef1e8864
docs(ship): P2 complete → v1.27.2 (v1.28 lambda-packaging)
...
Nova Slides Render / render (push) Failing after 26s
---ci---
project: acdl
phase: 2
milestone: v1.28
status: complete
---/ci---
2026-08-19 22:52:36 +00:00
291921a04e
test(P02): attestations dir scaffolded + empty (REQ-331, backend-engineer)
...
---ci---
project: acdl
phase: 2
milestone: v1.28
status: execute
persona: backend-engineer
---
tests/test_init_attestations.py: nova init in a tmp_path creates
.nova/contract.yml.attestations/ as an empty directory (listdir == []).
The existing test_cli_subcommands.py asserts is_dir() but not emptiness;
this is the explicit REQ-331 assertion (freshly scaffolded repo has no
attestations yet — they are produced later by nova apply --sign-local-review
/ the JWS attestation flow, REQ-332).
2026-08-19 22:49:20 +00:00
c9bfc98713
feat(P02): nova apply --local --sign-local-review (REQ-330, REQ-332, backend-engineer)
...
---ci---
project: acdl
phase: 2
milestone: v1.28
status: execute
persona: backend-engineer
---
nova apply subcommand (44 lines, CAP-034: <=50 lines, <=3 functions, no if
except __main__ guard). --local calls core.env.synthesize_local_env() +
core.contract_resolver.resolve(). --sign-local-review calls
core.jws_attestation.sign_attestation() (REQ-332) and appends the JWS to the
output. Delegates to core/ — no business logic in the subcommand (NFR-7).
Auto-registered via nova/cli.py pkgutil discovery; CAP-033/034 tests pass.
2026-08-19 22:49:04 +00:00
CIAgent