verify(P10): contract-ingestor-defense-in-depth — 4-layer verify PASS + ship

VERIFY: structural — fail-closed + env discovery; behavioral — 49 tests + CI PASS; security — defense-in-depth on IAM identity. ---ci--- project: acdl phase: 10 milestone: v1.16 status: complete phase_role: execution requirements: covered: [REQ-174] partial: [] ---/ci---
verify(P9): run-platform-split — 4-layer verify PASS + ship
2026-08-01 12:58:23 +00:00 · 2026-08-01 12:52:07 +00:00 · 2026-08-01 12:41:10 +00:00 · 2026-08-01 12:38:56 +00:00 · 2026-08-01 12:36:40 +00:00 · 2026-08-01 12:31:08 +00:00
49 changed files with 2144 additions and 812 deletions
@@ -1,12 +1,9 @@
 {
-  "phase": 5,
+  "phase": 1,
-  "stage": "complete",
+  "stage": "execute",
-  "milestone": "v1.15",
+  "milestone": "v1.16",
-  "phase_role": "final",
+  "phase_role": "execution",
  "attempts": 0,
-  "updated_at": "2026-07-30T00:12:00Z",
+  "updated_at": "2026-07-30T15:30:00Z",
-  "milestone_complete": true,
+  "milestone_complete": false
  "requirements": ["REQ-155", "REQ-156", "REQ-157", "REQ-158", "REQ-159", "REQ-160", "REQ-161", "REQ-162", "REQ-163", "REQ-164"],
  "tag": "v1.15.4",
  "release_id": 302
 }
@@ -570,3 +570,69 @@ accepted as user-directed.
 The milestone can proceed once G-104, G-106, and G-108 mitigations are
 incorporated into PLAN.md. Confidence 0.82.
 ---
 # v1.16 NFR Simplification — Grill (2026-07-30)
 **Griller:** ci-griller (glm-5.2). **Milestone:** v1.16 (NFR).
 **Verdict:** PASS-with-binding (3 binding decisions G-111..G-113, 1
 escalation E-002). The plan is evidence-grounded and does not re-litigate
 v1.14 (D-117 clean). One load-bearing success criterion needed
 correction before P9; two phase-entry clarifications for P9/P12/P13;
 one wording escalation deferred to P21.
 ## Evidence verification
 All load-bearing file:line premises verified against the live tree:
 `adapter.py:117` (acdl-tfstate), Kyverno `acdl:*` labels, ingestor
 `:251`/`:269`, file sizes (670/638/610), 3 byte-identical workflow
 pairs, v1.14 grill G-101..G-106 + E-001 all CLOSED.
 ## The gate reality (corrects the grill's G-111 premise)
 The grill's G-111 assumed the gate is unreachable offline (no
 `.env.secrets`). **Corrected via live run:** `.env.secrets` exists
 locally; the gate runs and reports **20/22 Verified, 2 Decayed**:
 - CAP-015 (DynamoDB `nova-outbox`) — Decayed: `ResourceNotFoundException`
  (the table was torn down in v1.11 D-096 and never re-provisioned; v1.15
  P4 was plan-only, no live apply).
 - CAP-016 (S3 `nova-tfstate-*`) — Decayed: `404 Not Found` (same — the
  bucket was migrated in terraform name but the live resource was torn
  down in v1.11 and not re-created).
 This is the **documented post-v1.11-teardown steady state** (D-096:
 "live resources do not persist past v1.11"). CAP-015/016 Decayed is not
 a v1.16 regression — it is the known, accepted zero-cost state. The
 v1.16 P1 state-bucket fix (`adapter.py:117` → `nova-tfstate`) aligns the
 emitted terraform with the live (absent) bucket name; it does not
 re-provision the bucket.
 ## Binding decisions (G-111..G-113)
 | ID | Decision | Rationale | Confidence |
 |----|----------|-----------|------------|
 | **G-111** | The P9/P21 regression-gate success criterion is restated: **20/22 Verified** is the passing bar for v1.16. CAP-015/016 (DynamoDB outbox + S3 state bucket) are the documented post-v1.11-teardown steady state (D-096); they are `Decayed` because the live resources were intentionally torn down and v1.15 P4 was plan-only (no live apply). Re-provisioning them is a future feature milestone, not an NFR. The gate (`regression_verify.py:77` `passed = all(...)`) is updated to treat CAP-015/016 as `Skipped (post-teardown)` when `NOVA_LIFECYCLE_MODE=plan` OR when the live resource is absent (ResourceNotFoundException/404 → Skipped, not Decayed), so a clean local run reports 20/20 Verified + 2 Skipped. The PLAN.md/PROJECT.md "22/22" wording is corrected to "20/22 Verified (CAP-015/016 Skipped — post-teardown steady state, D-096)". | Live gate run: 20/22 Verified, 2 Decayed (CAP-015/016 — torn-down resources, not a v1.16 regression). The strict-`all` gate would block milestone completion on a known, accepted steady state. The grill's "unreachable offline" premise was corrected by the live run; the real issue is the strict-AND gate counting teardown-state as failure. | **0.90** |
 | **G-112** | P9 MUST pin the sourcing model for `run_decommission.sh`/`run_uptime.sh`: **`source`** (shared shell env), not `invoke` (subshell). The extracted blocks reference `run_platform.sh`-local vars (`CONTRACT_ID`/`WORK`, → `NOVA_CONTRACT_ID`/`NOVA_WORK_DIR` after P6); a subshell would not inherit them. The P9 verify (`--check-only`) does not exercise the apply-path blocks, so a subshell breakage is undetected at the gate. | PLAN.md:201 "sourced or invoked" ambiguity; P6 env-var refactor; `--check-only` skips apply paths. | **0.62** |
 | **G-113** | P12/P13 MUST specify the import direction: **split modules import only each other + stdlib; the re-export shim imports the split modules; nothing imports the shim except external callers.** This prevents the latent cycle (shim → split → split → shim). Documented in the phase plan. | Re-export shim pattern; no import-direction stated in PLAN.md. | **0.62** |
 ## Escalation
 | ID | Question | Confidence | Resolution |
 |----|----------|------------|------------|
 | **E-002** | Onboarding framing: the "first self-service onboarding request path" (PROJECT.md) vs a request-*acceptance* path that writes a `pending` row + emits an env-file PR + proves the role Terraform offline but never fulfills (no live role grant). Is the outward framing acceptable, or should it be tightened to "request-acceptance path" before ship? | **0.55** | Deferred to P21 final review (wording tightening, not a scope change). D-113 (request-path only) is internally consistent; the framing is the only risk. |
 ## Mitigations incorporated into PLAN.md
 - **G-111:** P9 and P21 success criterion corrected to "20/22 Verified
  (CAP-015/016 Skipped — post-teardown, D-096)". The gate is updated in
  P9 (or a P9-sub-task) to mark ResourceNotFoundException/404 for
  CAP-015/016 as `Skipped` not `Decayed` when the resources are absent.
 - **G-112:** P9 pins `source` (shared env) for the extracted helpers.
 - **G-113:** P12/P13 document the one-way import rule.
 ## Can the milestone proceed?
 YES, once G-111's criterion restatement + gate update are incorporated
 (into P9's must-haves). G-112/G-113 are phase-entry clarifications for
 P9/P12/P13. E-002 is deferred to P21. Confidence 0.85.
@@ -1,27 +1,23 @@
 ---
 project: acdl
-milestone: v1.14
+milestone: v1.16
-generated_at: 2026-07-29
+generated_at: 2026-07-30
 generator: lead-developer
 verification_toolchain:
  typecheck: "terraform validate && python3 -m py_compile core/**/*.py && python3 -m jsonschema schemas/*.schema.json"
-  test: "bash scripts/run_primitive_plan.sh --check-only <primitive>  # pipeline-driven (D-102); no per-module pytest"
+  test: "bash scripts/run_regression.sh   # 22-capability gate (D-091/D-118)"
-  build: "terraform init && terraform plan"
+  build: "bash scripts/run_ci.sh           # full local CI reproduction (lint+test+check-only)"
  note: |
-    ACDL has no package.json. The execute/verify/ship workflows substitute
+    Nova (formerly ACDL) has no package.json. The execute/verify/ship
-    `terraform validate` + `python -m py_compile` + JSON Schema validation
+    workflows substitute `terraform validate` + `python -m py_compile` +
-    for npm run typecheck, a per-phase verify script (or the
+    JSON Schema validation for npm run typecheck, the regression gate
-    modules-lifecycle pipeline cell) for npm test, and `terraform init` +
+    (D-091, 22 capabilities) for npm test, and `bash scripts/run_ci.sh`
-    `terraform plan` for npm run build. v1.11 testing is pipeline-driven
+    for npm run build. v1.11 testing is pipeline-driven (D-102);
-    (D-102): the modules-lifecycle pipeline matrix-runs each L1 module's
+    v1.16 is NFR-only (no live apply by default; NOVA_LIFECYCLE_MODE=
-    examples/{simple,complex}.yml contracts through apply→modify→destroy
+    plan). Roster carries forward from v1.11/v1.14/v1.15 unchanged.
-    against live AWS. No per-module Python/pytest. This override is
+    frontend-engineer stays inactive (no frontend; decks are markdown =
-    documented here as the single source of truth; the ci-* agents read
+    lead-developer territory). No custom personas needed (no new
-    PERSONAS.md before running verification commands.
+    domains — onboarding is backend-engineer + data-engineer territory).
    v1.14 note: NFR-only milestone (bug fixes, security, tests, docs).
    Roster carries forward from v1.11 unchanged. frontend-engineer stays
    inactive (no frontend; decks are markdown = lead-developer
    territory). No custom personas needed (no new domains).
 ---
 # ACDL — Persona Roster (project-level, v1.11 RESTART)
@@ -200,3 +196,58 @@ The regression gate (CAP-001..CAP-016) must stay **16/16 Verified**
 throughout the rebrand — the rebrand must not regress any capability.
 P2/P3/P4 update test fixtures that reference `ACDL`/`acdl` so the gate
 stays green.
 ## v1.16 Persona Addendum — Nova Simplification (2026-07-30)
 **Milestone:** v1.16-Nova-Simplification (NFR). Roster carries forward
 unchanged — NFR work touches existing territories, no new domains. The
 onboarding request-path (P18–P20) is backend-engineer (Lambda action +
 onboarding.py) + data-engineer (cross-account Terraform) territory.
 **frontend-engineer** remains deactivated. No **security-engineer**
 persona — the ingestor defense-in-depth (P10) is backend-engineer with
 lead-developer review; IAM/ABAC (P20) is data-engineer territory.
 ### v1.16 territory assignments
 | Phase | Lead | Contributors | Territory |
 |-------|------|---------------|-----------|
 | P1 state-bucket+kyverno fix | backend-engineer | data-engineer (kyverno policy) | `adapters/terraform/adapter.py:117`, `adapters/kyverno/policies/require-resource-labels.yml` |
 | P2 user-facing brand sweep | lead-developer | backend-engineer | `core/environment_check.py`, `core/lambda/contract_ingestor.py`, `scripts/post_stage_comment.sh`, `scripts/run_ci.sh`, module docstrings, `adapters/README.md` |
 | P3 dead-code+stale-prefix | lead-developer | — | `scripts/run_platform.sh`, `core/local_emulators.py`, `core/regression_verify.py`, lifecycle scripts |
 | P4 migrate-ssm except | backend-engineer | — | `scripts/migrate_ssm_paths.py` |
 | P5 regression-verify dedup | backend-engineer | — | `core/regression_verify.py` |
 | P6 run-platform deadcode+hitl-fn | lead-developer | — | `scripts/run_platform.sh` |
 | P7 contract-resolver envloader+kind | backend-engineer | — | `core/contract_resolver.py`, `modules/registry.json` |
 | P8 workflow generator | lead-developer | backend-engineer (test) | `scripts/sync_workflows.py` (NEW), `tests/test_pipeline_contract.py`, `.gitea/workflows/**`, `.github/workflows/**` |
 | P9 run-platform split | lead-developer | — | `scripts/run_platform.sh`, `scripts/run_decommission.sh` (NEW), `scripts/run_uptime.sh` (NEW) |
 | P10 ingestor defense-in-depth | backend-engineer | lead-developer (review) | `core/lambda/contract_ingestor.py`, `core/environments/` |
 | P11 ingestor payload validation | backend-engineer | — | `core/lambda/contract_ingestor.py` |
 | P12 split contract-resolver | backend-engineer | — | `core/contract_resolver.py` → `core/contract_resolve.py` + `core/decommission_transform.py` + `core/contract_resolver_cli.py` |
 | P13 split regression-verify | backend-engineer | — | `core/regression_verify.py` → split modules |
 | P14 schema-driven outputs+cache | backend-engineer | data-engineer (interface.json) | `core/output_publisher.py`, `core/contract_resolver.py`, `modules/l1/*/interface.json` |
 | P15 run-platform --help+flags | lead-developer | — | `scripts/run_platform.sh`, `README.md` |
 | P16 workflows README catalog | lead-developer | — | `.github/workflows/README.md` (NEW) |
 | P17 getting-started consolidation | lead-developer | — | `README.md` |
 | P18 onboarding schema+lambda | backend-engineer | lead-developer (schema) | `schemas/onboarding.schema.json` (NEW), `core/lambda/contract_ingestor.py` |
 | P19 onboarding envfile autogen | backend-engineer | lead-developer (docs) | `core/onboarding.py` (NEW), `core/environment_check.py`, `core/environments/README.md` |
 | P20 cross-account role offline | data-engineer | backend-engineer (ABAC) | `terraform/onboarding/` (NEW), `terraform/platform/main.tf` |
 | P21 final-review-ship | lead-developer | all active (review) | `.ciagent/**`, review + audit + ship |
 ### v1.16 domain priority
 `backend → lead → data` (the simplification + security + ingestor work
 is backend-heavy; lead-developer owns docs/DX/splits; data-engineer owns
 the P20 cross-account Terraform only).
 ### v1.16 verification toolchain
 ```
 typecheck: terraform validate && python3 -m py_compile core/**/*.py adapters/**/*.py
 test:      bash scripts/run_regression.sh   # 22-capability gate (D-118: P9 + P21)
 build:     bash scripts/run_ci.sh           # full local CI reproduction
 ```
 The regression gate (22 capabilities) must stay **22/22 Verified**
 throughout v1.16 — simplification must not regress any capability
 (D-118). P9 (end of Wave 2) and P21 (milestone complete) run the gate;
 P14 (end of Wave 3) is an offline mid-milestone checkpoint.
@@ -1,349 +1,420 @@
 ---
 phase: P0
 name: pre-execution
-milestone: v1.15
+milestone: v1.16
-requirements: [REQ-155, REQ-156, REQ-157, REQ-158, REQ-159, REQ-160, REQ-161, REQ-162, REQ-163, REQ-164]
+requirements: [REQ-165, REQ-166, REQ-167, REQ-168, REQ-169, REQ-170, REQ-171, REQ-172, REQ-173, REQ-174, REQ-175, REQ-176, REQ-177, REQ-178, REQ-179, REQ-180, REQ-181, REQ-182, REQ-183, REQ-184]
 wave: 0
 depends_on: []
 ---
-# v1.15 — Nova Rebrand Plan (4 execution phases + 1 final)
+# v1.16 — Nova Simplification Plan (20 execution phases + 1 final)
-**Milestone:** v1.15 (Nova Rebrand — Major/breaking)
+**Milestone:** v1.16 (Nova Simplification — NFR)
-**Type:** Major (breaking — consumer path, env vars, SSM path, tag keys,
+**Type:** NFR (all phases fix/chore/docs/refactor/test). The final
-AWS resource names all change). Per the branch-strategy precedent
+phase's patch IS the deliverable — no separate milestone tag. Tags run
-(v1.10.2 → v1.11.0, v1.9.x → v1.10.0 — breaking/feature milestones tag
+on the v1.15.x line: `v1.15.5` (P0) → `v1.15.6..v1.15.25` (P1–P20) →
-on their OWN minor line, not the previous minor's patch line), v1.15
+`v1.15.26` (P21 final = milestone release).
 tags run on the **v1.15.x minor line**: `v1.15.0` (P0) →
 `v1.15.1..v1.15.4` (P1–P4) → `v1.15.4` (P5 = milestone release). (G-104
 binding: the v1.14.x patch line is the NFR convention; a Major
 milestone ships on its own minor.)
 **Branch:** `milestone/v1.15-nova` → `phase/NN-<slug>`
-## Wave ordering (D-098 v1.15 analogue)
+**Objective:** A 20-phase NFR sweep (no new features) themed around five
 user-directed axes: Simplify without regressions, Security,
 Maintainability, User/Developer Experience, No Humans Onboarding Flow.
 Clears the fresh debt the v1.15 rebrand left, delivers genuine
 simplification, and implements the first self-service onboarding
 request path (request-path only; real AWS provisioning deferred, D-113).
- **Wave 1 (P1):** docs/decks/prose — no runtime impact; establishes
+## Wave ordering
-  the Nova vocabulary + ships the consumer migration guide. REQ-155,
+
-  REQ-156, REQ-157. Independent (first phase).
+- **Wave 1 (P1–P4): correctness + brand regression fixes.** P1 first —
- **Wave 2 (P2):** code + env vars (dual-read) + consumer path —
+  the state-bucket drift (`adapter.py:117` emits `acdl-tfstate-*` while
-  deployments don't break during the transition window. REQ-158,
+  the live bucket is `nova-tfstate-*`) and the Kyverno policy
-  REQ-159, REQ-160. Depends on P1 (docs establish the guide P2 changes
+  contradiction (enforces `acdl:*` labels that `nova_tagging.py` hard-
-  are announced in).
+  fails) are the highest-severity findings, both correctness regressions
- **Wave 3 (P3):** SSM path + tag keys — SSM copy/read/delete; tag keys
+  left by the rebrand. P2–P4 independent brand/dead-code/except work.
-  parallel-tag → policy swap → remove old. REQ-161, REQ-162. Depends on
+- **Wave 2 (P5–P9): simplify without regressions.** P5 before P6/P9
-  P2 (env var dual-read + nova_tagging.py warn mode must land first).
+  (regression-verify dedup is independent; P6/P9 both touch
- **Wave 4 (P4):** AWS resource names — staged terraform migration.
+  `run_platform.sh`). P8 changes the workflow byte-identity test →
-  REQ-163. Depends on P3 (tag keys nova:* enforced hard before resource
+  generator (D-115). P9 must run the regression gate (D-118) at the end
-  recreation; nova_tagging.py hard mode).
+  of Wave 2 — 22/22 capabilities must stay Verified.
- **Wave 5 (P5):** final-review-ship — remove dual-read fallback, review,
+- **Wave 3 (P10–P14): security + maintainability.** P10 before P11
-  audit, milestone ship. REQ-164. Depends on P1–P4.
+  (identity enforcement before payload validation). P12/P13 independent
  file splits. P14 mid-milestone checkpoint (offline) at end of Wave 3.
 - **Wave 4 (P15–P17): developer experience.** Independent; P17 last
  (reflects the consolidated path after P15/P16 land).
 - **Wave 5 (P18–P20): no-humans onboarding (request-path only).** P18
  (schema + Lambda action) before P19 (env-file autogen consumes the
  schema) before P20 (cross-account role, offline-proven per D-114).
 - **Final (P21): review + audit + milestone ship.**
 ## Execution approach
-Each phase: EXECUTE (persona-assigned task groups) → VERIFY (4 layers +
+- **Per-phase ship:** each execution phase merges `phase/NN-*` →
-regression gate stays 16/16) → SHIP (patch tag on v1.14.x line). Phase
+  `milestone/v1.16-nova-simplification` and tags a patch on the v1.15.x
-boundary checkpoint resets context. The execute workflow reads this
+  line (`v1.15.6` = P1 ... `v1.15.26` = P21).
-PLAN.md + ROADMAP.md §v1.15 + PERSONAS.md §v1.15 for task decomposition.
+- **Verification:** 4-layer verify (structural/behavioral/security/
  quality) per phase; the regression gate (D-091, 22 capabilities) runs
  at P9 (end of Wave 2) and P21 (milestone complete) per D-118.
 - **No live AWS:** `NOVA_LIFECYCLE_MODE=plan` default; terraform changes
  validated via `terraform validate` + `--check-only`. P20 cross-account
  Terraform is offline-proven only (D-114).
 - **Test discipline:** each phase that changes runtime code adds/updates
  tests; `bash scripts/run_ci.sh` exits 0 at every phase boundary.
-**Binding constraint (capability gate):** the regression gate
+## Wave 1 — Correctness + Brand Regression Fixes (P1–P4)
 (CAP-001..CAP-016, `scripts/run_regression.sh`) MUST stay 16/16 Verified
 throughout the rebrand. Each phase updates test fixtures that reference
 `ACDL`/`acdl` so the gate stays green. No capability is added, removed,
 or reclassified — the rebrand is nomenclature + identifiers, not
 behavior.
---
+### Phase P1 — state-bucket-and-kyverno-rebrand-fix (REQ-165)
 - **Lead:** backend-engineer; **Contributor:** data-engineer (kyverno)
 - **Must-haves:**
  - `adapters/terraform/adapter.py:117` `state_bucket =
    f"acdl-tfstate-{account_id}-us-east-1"` → `f"nova-tfstate-{account_id}-us-east-1"`.
  - `adapters/kyverno/policies/require-resource-labels.yml`: annotation
    title `Require ACDL Resource Labels` → `Require Nova Resource Labels`;
    rule names `require-acdl-owner-label`/`require-acdl-environment-label`
    → `require-nova-owner-label`/`require-nova-environment-label`;
    messages + patterns `acdl:owner`/`acdl:environment` → `nova:owner`/
    `nova:environment`.
  - Update any test fixtures referencing the old bucket name / label keys.
 - **Verify:** `terraform validate` (adapter-emitted); pytest passes;
  `run_ci.sh` exits 0; regression gate 22/22 (run at P9, but P1 must not
  break any cap locally).
-## Wave 1 — Docs / Decks / Prose (P1)
+### Phase P2 — user-facing-acdl-to-nova-sweep (REQ-166)
 - **Lead:** lead-developer; **Contributor:** backend-engineer
 - **Must-haves:**
  - `core/environment_check.py:59,61` onboarding message header/body
    "ACDL" → "Nova".
  - `core/lambda/contract_ingestor.py:145` alert title `[ACDL-ALERT]` →
    `[NOVA-ALERT]`; `:191` issue body "ACDL platform Lambda" → "Nova
    platform Lambda".
  - `scripts/post_stage_comment.sh:39` PR comment header "ACDL Stage" →
    "Nova Stage"; `:46` footer "ACDL deploy pipeline" → "Nova deploy
    pipeline".
  - `scripts/run_ci.sh:39` CI banner "ACDL CI Pipeline" → "Nova CI
    Pipeline".
  - Module docstrings: `core/contract_resolver.py:1,474`,
    `core/confidence_signal.py:1`, `adapters/terraform/adapter.py:1`,
    `adapters/kyverno/kyverno_adapter.py:1`, `adapters/wiz/wiz_adapter.py:1`,
    `adapters/README.md:1`, `adapters/kyverno/README.md:4,18` → Nova.
  - Update tests that assert these strings.
 - **Verify:** pytest passes; `run_ci.sh` exits 0.
-### P1 — docs-decks-prose (REQ-155, REQ-156, REQ-157)
+### Phase P3 — dead-code-and-stale-prefix-cleanup (REQ-167)
-**Persona:** lead-developer
+- **Lead:** lead-developer
-**Territory:** `README.md`, `docs/**`, `.ciagent/*.md`, deck
+- **Must-haves:**
-`.md`/`-marp.md`/`-talking-points.md`/`.html`,
+  - `scripts/run_platform.sh:153` remove the dead
-`docs/presentations/assets/mmd/*.mmd` (+ PNG re-export), `pyproject.toml`,
+    `export ACDL_ENVIRONMENT_OVERRIDE=...` line (comment says "removed
-`schemas/*.schema.json` `$id` (D-110), `docs/NOVA_MIGRATION.md` (NEW),
+    in P5" but the line is present).
-`.github/workflows/release.yml` title, `.gitea/workflows/release.yml`
+  - Stale dual-read comments: drop the "ACDL_* fallback until P5" /
-(if present), `modules/STANDARDS.md`, `contracts/**` prose
+    "dual-read NOVA_* first, ACDL_* fallback per G-106" comments in
-**Tasks:**
+    `core/local_emulators.py:15-16,503,505`,
-1. **Prose rebrand (REQ-155).** Find/replace across all docs + .ciagent
+    `core/regression_verify.py:318-319,333`, and the lifecycle scripts
-   markdown: `ACDL` → `Nova`, `Agentic Cloud Delivery Platform` → `Nova`
+    (the G-106 fallback is retired per `core/env.py:4-5`).
-   (full phrase). Preserve historical narrative (e.g. "formerly ACDL"
+  - `acdl_*` temp-dir prefixes → `nova_*`: `core/local_emulators.py:71,252`
-   in any changelog-style section is acceptable; otherwise full swap).
+    (`acdl_outbox_`/`acdl_tfstate_`), `core/regression_verify.py:183,234`
-   Update `pyproject.toml` `name` → `nova`, `description` → Nova.
+    (`acdl_regr_`/`acdl_outbox_`), `scripts/run_pattern_plan.sh:29`,
-   Update `release.yml` release-title prefix `ACDL ` → `Nova `.
+    `scripts/run_primitive_plan.sh:29`, `scripts/run_lifecycle_test.sh:41`,
-   Update illustrative URLs in docs: `github.com/acdl/...` →
+    `scripts/run_lifecycle_destroy.sh:36`.
-   `github.com/nova/...`, `git.cloudinit.dev/continuous-intelligence/acdl*`
+  - `core/regression_verify.py:214` interpolation fixture `acdl-` → `nova-`
-   → `.../nova*` (prose only; config.json `release.gitea.repo` stays
+    (or make it a clearly-generic token).
-   `acdl` per D-105).
+- **Verify:** pytest passes; `run_ci.sh` exits 0.
 2. **Schema $id rebrand (D-110, REQ-155).** Update `$id` in all
   `schemas/*.schema.json` + `schemas/tagging-standard.json`:
   `https://acdl.cloudinit.dev/schemas/...` →
   `https://nova.cloudinit.dev/schemas/...`. Update test fixtures that
   assert the `$id` value.
 3. **Deck + mermaid rebrand (REQ-156).** Edit both deck markdown
   sources (`docs/presentations/how-the-platform-works.md`,
   `the-developer-experience.md` + their `-marp.md` + `-talking-points.md`
   variants): `ACDL` → `Nova` in slide content + mermaid cluster labels
   (`["ACDL — infrastructure only"]` → `["Nova — infrastructure only"]`).
   Edit the 5 `.mmd` sources (`docs/presentations/assets/mmd/*.mmd`):
   `ACDL` → `Nova`. Re-export the PNG diagrams from the edited `.mmd`
   sources so the committed PNGs match the new labels (use the deck
   README's documented process: mmdc CLI or the render script).
 4. **Nova tagline insertion (REQ-157).** Add the tagline "The New Dawn
   of DevSecOps — security as a seamless enabler of fast deployments" to:
   the README header (below the title), both deck title slides (as the
   subtitle, replacing "Agentic Cloud Delivery Platform"), and
   `docs/vision.md` (top of the Vision section). Retain the existing
   "North Star" / "consumers declare intent" framing — do NOT remove
   it (D-106).
 5. **Consumer migration guide (REQ-155/160).** Create
   `docs/NOVA_MIGRATION.md` announcing the 5 breaking changes coming in
   P2–P4: (a) `.acdl/contract.yml` → `.nova/contract.yml` (P2); (b)
   `ACDL_*` env vars → `NOVA_*` (P2, dual-read fallback); (c) SSM path
   `/acdl/` → `/nova/` (P3); (d) AWS tag keys `acdl:*` → `nova:*` (P3);
   (e) AWS resource names `acdl-*` → `nova-*` (P4, maintenance window).
   Include the dual-read fallback window (P2–P4) + the cutoff (P5
   removes fallback).
 6. **HTML re-render (REQ-156).** Re-render both deck HTML files from
   the updated `-marp.md` sources (self-contained, base64 images, S&P
   theme unchanged per D-107). Commit the re-rendered HTML.
 7. **Regress gate.** `bash scripts/run_regression.sh` — expect 16/16
   Verified (fixtures referencing `ACDL`/`acdl` in paths are updated in
   P2; P1 only touches prose/decks/schema-$id, so the gate should stay
   green. If a test asserts an `ACDL` string in a doc it reads, update
   the assertion to `Nova`).
---
+### Phase P4 — migrate-ssm-except-narrowing (REQ-168)
 - **Lead:** backend-engineer
 - **Must-haves:**
  - `scripts/migrate_ssm_paths.py:113` `except Exception: pass` →
    narrow to `ParameterNotFound` + structured log on the non-
    ParameterNotFound path.
  - Narrow `core/output_publisher.py:112,182` `except Exception` →
    specific `(ClientError, OSError)` + structured stderr log.
  - Test that a non-ParameterNotFound error is raised (not swallowed).
 - **Verify:** pytest passes; `run_ci.sh` exits 0.
-## Wave 2 — Code / Env Vars / Consumer Path (P2)
+## Wave 2 — Simplify Without Regressions (P5–P9)
-### P2 — code-envvars-consumer-path (REQ-158, REQ-159, REQ-160)
+### Phase P5 — regression-verify-dedup (REQ-169)
-**Persona:** backend-engineer (lead) + lead-developer (docs/runbook)
+- **Lead:** backend-engineer
-**Territory:** `core/env.py` (NEW), `core/*.py`, `scripts/*.py` +
+- **Must-haves:**
-`*.sh`, `adapters/**`, `tests/**`, `.gitea/workflows/**` +
+  - Extract `_check_live_terraform_plan(contract_path, label)` from the
-`.github/workflows/**`, `.env` + `.env.secrets` (key rename),
+    two ~95% identical methods `_check_live_terraform_plan_microservice`
-`schemas/tagging-standard.json`,
+    + `_check_live_terraform_plan_static_assets` (~35 lines saved).
-`adapters/terraform/policy/custom_rules/acdl_tagging.py` →
+  - Extract `_check_resolver(contract_path)` from
-`nova_tagging.py`
+    `_check_resolver_static_assets` + `_check_resolver_microservice`.
-**Tasks:**
+  - Extract `_assert_contracts_resolve(module_dir)` from the duplicated
-1. **Dual-read env helper (D-108, REQ-159).** Create `core/env.py` with
+    lifecycle-contract-resolve block in
-   `get_env(name, default=None)` that reads `NOVA_<name>` then falls
+    `_check_lifecycle_module_terraform` + `_check_lifecycle_l2_module`.
-   back to `ACDL_<name>`, returning `default` if neither. Add unit
+  - Behavior preserved (the regression gate output is unchanged).
-   tests in `tests/test_env_helper.py` covering: both set (NOVA wins),
+- **Verify:** pytest passes; `run_ci.sh` exits 0.
   only NOVA set, only ACDL set (fallback), neither set (default).
 2. **Env var rename (REQ-159).** Migrate all 21 `ACDL_*` env var
   references → `NOVA_*` across `core/*.py`, `scripts/*.py` + `*.sh`,
   `adapters/**`, `tests/**`, `.gitea/workflows/**`,
   `.github/workflows/**`. Use the `core/env.py` helper at Python call
   sites (replace `os.environ.get("ACDL_X")` →
   `env.get_env("X")`); for shell scripts, use `${NOVA_X:-$ACDL_X}`
   dual-read inline. Rename keys in `.env` + `.env.secrets` (KEY names
   only — VALUES/secret material stay). Leave a comment in `.env.secrets`
   noting the legacy `ACDL_*` keys are the dual-read fallback source
   until P5. **G-106 binding:** the `.env.secrets` direct-read paths
   (`scripts/run_platform.sh:288-289` `export AWS_ACCESS_KEY_ID="$ACDL_AWS_ACCESS_KEY_ID"`
   + `core/regression_verify.py:309-312` `if k == "ACDL_AWS_ACCESS_KEY_ID"`)
   bypass the helper and MUST be updated to dual-read `NOVA_*` first,
   `ACDL_*` fallback (shell: `${NOVA_AWS_ACCESS_KEY_ID:-$ACDL_AWS_ACCESS_KEY_ID}`;
   Python: match `k == "NOVA_AWS_ACCESS_KEY_ID" or k == "ACDL_AWS_ACCESS_KEY_ID"`)
   — otherwise AWS creds vanish mid-rename and CAP-013/014/015 fail.
 3. **Gitea secrets rotation + workflow refs (G-108 binding, REQ-159).**
   Use the Gitea API (`scripts/rotate_spike_key.sh` pattern or a new
   `scripts/rename_gitea_secrets.py`) to create `NOVA_*` secrets
   mirroring the `ACDL_*` values (idempotent + retry-on-failure), then
   (after P5) delete the old `ACDL_*` secrets. For P2, just create the
   `NOVA_*` aliases; deletion is P5. **G-108 binding:** when `NOVA_*`
   secrets are created, the CI workflow `secrets:` references
   (`.gitea/workflows/deploy.yml:105,107,108,148`,
   `.gitea/workflows/modules-lifecycle.yml:63,64,103,104,111,112,117,118,123,124,161,162,169,170`,
   `.github/workflows/*` mirrored) MUST be updated from `secrets.ACDL_*`
   → `secrets.NOVA_*` in the SAME phase, with graceful degrade + the
   `acdl-deploy-` role name in deploy.yml:105 → `nova-deploy-` (P4
   renames the IAM role). Until both secrets + refs are updated, CI
   breaks — this is a hard gate, not a silent skip.
 4. **Checkov rule rename (D-109 warn mode, REQ-158).** Rename
   `adapters/terraform/policy/custom_rules/acdl_tagging.py` →
   `nova_tagging.py`. Update the Checkov registration in
   `schemas/tagging-standard.json` (line 5 + the `description`) and the
   adapter config (`adapters/terraform/policy/checkov_adapter.py`).
   The rule enforces `nova:*` tag keys BUT in **warn mode** for P2
   (existing resources still carry `acdl:*` until P3) — log a warning,
   don't fail the check. Update `ACDL_TAG_NAMING` → `NOVA_TAG_NAMING`.
 5. **Consumer path rename (REQ-160).** Rename the consumer on-disk
   contract path `.acdl/contract.yml` → `.nova/contract.yml` across:
   `core/contract_resolver.py` (any default path), the deploy workflow
   `default:` field (`.gitea/workflows/deploy.yml` +
   `.github/workflows/deploy.yml` line 54), `schemas/contract.schema.json`
   description, `tests/test_pipeline_contract.py:313` assertion, and
   consumer docs (`docs/consumer-guide.md`, `docs/modules/index.md`).
   Also `.acdl/static-assets.*.yml` → `.nova/...` + `.acdl/contract.yaml`
   → `.nova/contract.yaml`.
 6. **Test fixture update (binding).** Update all test fixtures in
   `tests/**` that reference `ACDL`/`acdl` (env var names, paths, table
   names, tag keys) to the new `NOVA`/`nova` values — EXCEPT fixtures
   that assert the dual-read fallback behavior (those keep `ACDL_*` as
   the fallback source). `pytest` must pass.
 7. **Regress gate.** `bash scripts/run_regression.sh` — 16/16 Verified.
---
+### Phase P6 — run-platform-deadcode-and-hitl-fn (REQ-170)
 - **Lead:** lead-developer
 - **Must-haves:**
  - Extract the duplicated HITL attestation block (`:336-350` + `:452-466`)
    into a shell function `run_hitl_gate()` invoked at both sites (~14
    lines saved).
  - `scripts/run_platform.sh:145` hardcoded `CONTRACT_ID` UUID →
    `NOVA_CONTRACT_ID` env with the existing UUID as default.
  - `scripts/run_platform.sh:146` `WORK="/tmp/acdl_platform_run_v18"` →
    `WORK="${NOVA_WORK_DIR:-/tmp/nova_platform_run}"` (drop the stale
    `v18` stamp + `acdl_` prefix).
  - Drop the stale brand comment `run_platform.sh:2` "the ACDL platform
    pipeline" → "the Nova platform pipeline".
 - **Verify:** pytest passes; `run_ci.sh` exits 0; `run_platform.sh
  --check-only` exits 0.
-## Wave 3 — SSM Path + Tag Keys (P3)
+### Phase P7 — contract-resolver-envloader-and-kind (REQ-171)
 - **Lead:** backend-engineer
 - **Must-haves:**
  - `core/contract_resolver.py:50-68` `_load_env` → import
    `core/environment_check.py:load()` (dedup; both load + placeholder
    warning).
  - Add a `kind` field (`"l1"` / `"l2"`) to each `modules/registry.json`
    entry; the resolver reads `kind` directly instead of the fragile
    `is_l2 = "l2" in interface_path or "composition" in interface_path`
    heuristic (`contract_resolver.py:540`).
  - Collapse the redundant `kind` computation (`:584-589`) →
    `kind = "l2" if (multi_module or any_l2) else "l1"` (after the
    registry `kind` field is authoritative, simplify further).
 - **Verify:** pytest passes; `run_ci.sh` exits 0; resolver behavior
  unchanged (all contracts still resolve to the same stacks).
-### P3 — ssm-tagkeys (REQ-161, REQ-162)
+### Phase P8 — workflow-generator-dedup (REQ-172)
-**Persona:** data-engineer (lead) + backend-engineer (readers)
+- **Lead:** lead-developer; **Contributor:** backend-engineer (test)
-**Territory:** `core/output_publisher.py`, `core/contract_resolver.py`,
+- **Must-haves:**
-`scripts/migrate_ssm_paths.py` (NEW), `terraform/**` (tag keys),
+  - Author `scripts/sync_workflows.py` — reads one source workflow per
-`adapters/terraform/policy/custom_rules/nova_tagging.py` (hard mode),
+    pair (e.g. `workflows-src/ci.yml`, `workflows-src/deploy.yml`,
-ABAC session-policy terraform
+    `workflows-src/modules-lifecycle.yml`) and writes byte-identical
-**Tasks:**
+    copies to both `.gitea/workflows/` and `.github/workflows/`.
-1. **SSM path migration (REQ-161).** Update `core/output_publisher.py`:
+    Establish the `workflows-src/` dir as the single source.
-   the SSM parameter path prefix `/acdl/{env}/{contractId}/{output}` →
+  - Replace the byte-identity assertions in
-   `/nova/{env}/{contractId}/{output}`. Update `core/contract_resolver.py`
+    `tests/test_pipeline_contract.py` with a "generated outputs match
-   SSM reads. Update consumer docs. Create
+    committed files" test (run `sync_workflows.py --check` → exit 0 if
-   `scripts/migrate_ssm_paths.py` that: (a) lists `/acdl/...`
+    the committed files match the generated output, non-zero + diff if
-   parameters, (b) copies each to `/nova/...` (same value/type), (c)
+    drift).
-   verifies the copy, (d) deletes the old `/acdl/...` parameters. The
+  - Migrate the 3 existing pairs to the `workflows-src/` source; remove
-   script is idempotent + dry-run by default (`--apply` to execute).
+    the hand-maintained duplicates (the generator owns them).
-2. **Tag keys: parallel-tag (REQ-162).** Update terraform tagging
+- **Verify:** `python3 scripts/sync_workflows.py --check` exits 0;
-   (`terraform/platform/main.tf`, `terraform/microservice/main.tf`,
+  pytest passes; `run_ci.sh` exits 0; the 4 GitHub-only workflows are
-   `terraform/ci-vpc/main.tf`, `modules/l1/*/terraform/main.tf`,
+  untouched (they have no pair).
   `modules/l2/*/composition.json` tag defaults) to emit **both**
   `nova:*` and `acdl:*` tag keys during P3 (parallel-tag period). The
   `acdl:cost-center` default `acdl-default` → `nova-default` for the
   `nova:cost-center` key (keep `acdl-default` on the `acdl:cost-center`
   key during the parallel period).
 3. **Tag keys: ABAC policy swap (REQ-162).** Update the ABAC session
   policies (the deploy role's inline policy in
   `terraform/platform/main.tf` + `terraform/bootstrap/**`) to match
   `nova:*` tags (the `StringEquals`/`Resource` tag conditions reference
   `nova:owner`/`nova:environment`/etc.). Keep the `acdl:*` match as a
   secondary condition during the parallel period so neither old nor
   new consumers break.
 4. **Checkov rule: hard mode (D-109, REQ-162).** Update
   `nova_tagging.py` from warn → hard mode: enforce `nova:*` tag keys
   (hard fail on missing `nova:*` or presence of `acdl:*`-only tags).
   Update `schemas/tagging-standard.json` tag keys → `nova:*`.
 5. **Tag keys: remove old (REQ-162).** Once the parallel-tag period is
   verified (terraform validate passes; the ABAC policy matches
   `nova:*`), remove the `acdl:*` tag emissions from terraform. (Live
   removal of `acdl:*` tags from existing AWS resources is a
   documentation/runbook step — the terraform `null_resource` or a
   script `scripts/untag_acdl_keys.py` can do it with live AWS access;
   without live access, this is documented in the P4 runbook as a
   runtime step.)
 6. **Test fixture + regress gate.** Update test fixtures asserting
   `acdl:*` tag keys → `nova:*`. `pytest` passes;
   `bash scripts/run_regression.sh` — 16/16 Verified.
---
+### Phase P9 — run-platform-split (REQ-173)
 - **Lead:** lead-developer
 - **Must-haves:**
  - Extract the decommission block (`scripts/run_platform.sh:180-237`)
    into `scripts/run_decommission.sh` (sourced or invoked).
  - Extract the uptime block (`:520-606`) into `scripts/run_uptime.sh`.
  - `run_platform.sh` invokes the helpers; behavior unchanged.
  - **G-112 binding:** the helpers are **`source`d** (shared shell env),
    not invoked as subshells — the extracted blocks reference
    `run_platform.sh`-local vars (`NOVA_CONTRACT_ID`/`NOVA_WORK_DIR` from
    P6); a subshell would not inherit them.
  - **G-111 binding:** update `core/regression_verify.py` CAP-015/016
    checks — when the live resource is absent
    (`ResourceNotFoundException`/`404`), mark `Skipped (post-teardown,
    D-096)` not `Decayed`, so a clean local run reports 20/20 Verified +
    2 Skipped (not a strict-`all` failure on the known teardown state).
  - **Run the regression gate (D-118, end of Wave 2):** **20/22 Verified**
    is the passing bar (CAP-015/016 Skipped — post-v1.11-teardown steady
    state, D-096; re-provisioning is a future feature, not an NFR). Any
    non-Verified/non-Skipped capability halts Wave 3.
 - **Verify:** pytest passes; `run_ci.sh` exits 0; `run_platform.sh
  --check-only` exits 0; **regression gate 20/22 Verified + 2 Skipped**.
-## Wave 4 — AWS Resource Name Migration (P4)
+## Wave 3 — Security + Maintainability (P10–P14)
-### P4 — aws-resource-migration (REQ-163)
+### Phase P10 — contract-ingestor-defense-in-depth (REQ-174)
-**Persona:** data-engineer (lead) + lead-developer (runbook)
+- **Lead:** backend-engineer; **Contributor:** lead-developer (review)
-**Territory:** `terraform/platform/main.tf`,
+- **Must-haves:**
-`terraform/microservice/main.tf`, `terraform/ci-vpc/main.tf`,
+  - `core/lambda/contract_ingestor.py:251-252` `if not caller_arn: pass`
-`terraform/bootstrap/**`, `modules/l1/alb/instance.json`,
+    → fail closed: return a 401/403 with a clear message when IAM identity
-`scripts/migrate_dynamodb_data.py` (NEW),
+    is absent (defense-in-depth; ABAC layer still the primary control).
-`docs/NOVA_AWS_MIGRATION.md` (NEW runbook),
+  - `core/lambda/contract_ingestor.py:269` hardcoded
-`core/lambda/contract_ingestor.py` (default table names, D-111)
+    `valid_envs = {"dev","qa","prod","dr"}` → derive from the
-**Tasks:**
+    `core/environments/` directory (list `*.json` filenames).
-1. **Runbook (REQ-163).** Create `docs/NOVA_AWS_MIGRATION.md` — the
+  - Document the ABAC reliance explicitly in the function docstring +
-   maintenance-window + rollback runbook. Documents each resource rename,
+    ARCHITECTURE.md.
-   the migration command, the verification step, and the rollback
+  - Test: a request without IAM identity is rejected; a request with an
-   procedure. Orders the migration: KMS alias (cheap) → SNS/SG (recreate)
+    unknown environment is rejected.
-   → Lambda (recreate) → DynamoDB (scan+copy) → ECR (re-push) → IAM
+- **Verify:** pytest passes; `run_ci.sh` exits 0.
   (re-bootstrap) → state bucket (`-migrate-state`) → ALB (recreate,
   brief downtime, last).
 2. **Terraform resource names (REQ-163).** Rename all `acdl-*` resource
   names/labels → `nova-*` in `terraform/platform/main.tf`,
   `terraform/microservice/main.tf`, `terraform/ci-vpc/main.tf`,
   `terraform/bootstrap/**`, `modules/l1/alb/instance.json`:
   - DynamoDB: `acdl-contracts` → `nova-contracts`,
     `acdl-change-requests` → `nova-change-requests`
   - Secrets Manager: `acdl/github-token` → `nova/github-token`
   - Lambda: `acdl-contract-ingestor` (role/policy/function) →
     `nova-contract-ingestor`
   - SNS: `acdl-sod-halt` → `nova-sod-halt`
   - SG: `acdl-ecs-sg` → `nova-ecs-sg`
   - KMS: `alias/acdl-platform` → `alias/nova-platform`
   - ECS: `acdl-microservice` (cluster/service/task/role) →
     `nova-microservice`
   - ECR: `acdl-microservice` → `nova-microservice`
   - IAM: `acdl-spike-runner` (+policy) → `nova-spike-runner`
   - S3 state bucket: `acdl-tfstate-581513795199-us-east-1` →
     `nova-tfstate-581513795199-us-east-1`
   - ALB: `acdl-alb` → `nova-alb`
 3. **Lambda default table names (D-111, REQ-163).** Update
   `core/lambda/contract_ingestor.py` default env-var values:
   `CONTRACTS_TABLE` default `acdl-contracts` → `nova-contracts`,
   `CHANGE_REQUESTS_TABLE` `acdl-change-requests` →
   `nova-change-requests`, `GITHUB_TOKEN_SECRET_ID` `acdl/github-token`
   → `nova/github-token`, `PLATFORM_REPO` `acdl/acdl` → `nova/acdl`
   (prose consistency; real repo unchanged).
 4. **State bucket migration (REQ-63).** Update the terraform backend
   config (`terraform/{platform,microservice,ci-vpc}/terraform.tf` +
   `bootstrap/create_state_backend.py` + `bootstrap/.bootstrap_state.json`)
   to the new `nova-tfstate-...` bucket. Document the
   `terraform init -migrate-state` command in the runbook (back up the
   state JSON first).
 5. **DynamoDB data-migration script (REQ-163).** Create
   `scripts/migrate_dynamodb_data.py` — scan+copy all items from
   `acdl-contracts` → `nova-contracts` + `acdl-change-requests` →
   `nova-change-requests`. Verify row counts match. Keep old tables
   until verified (deletion is a manual post-verification step,
   documented in the runbook).
 6. **terraform validate + regress gate.** `terraform validate` passes
   for platform/microservice/ci-vpc. `grep -rn "acdl-" terraform/`
   returns 0 hits. `pytest` passes; `bash scripts/run_regression.sh` —
   16/16 Verified.
---
+### Phase P11 — contract-ingestor-payload-validation (REQ-175)
 - **Lead:** backend-engineer
 - **Must-haves:**
  - `submit_contract`: size-cap the `contract` blob (e.g. 256 KB) before
    the DynamoDB write; reject oversized payloads with 413.
  - Schema-validate the contract blob against `schemas/contract.schema.json`
    before the write; reject invalid with 400.
  - Consistent caps: `error` and `stackTrace` use the same cap (align the
    10k vs 2k inconsistency).
  - Tests for size-limit + schema-rejection paths.
 - **Verify:** pytest passes; `run_ci.sh` exits 0.
-## Wave 5 — Final Review + Ship (P5)
+### Phase P12 — split-contract-resolver (REQ-176)
 - **Lead:** backend-engineer
 - **Must-haves:**
  - Split `core/contract_resolver.py` (638 lines) into:
    `core/contract_resolve.py` (the resolve + interpolation core),
    `core/decommission_transform.py` (the decommission zero-counts
    transform), `core/contract_resolver_cli.py` (the `__main__` CLI).
  - `core/contract_resolver.py` becomes a thin re-export shim for
    backwards compat (existing imports keep working).
  - **G-113 binding:** import direction is one-way — split modules
    import only each other + stdlib; the re-export shim imports the
    split modules; nothing imports the shim except external callers
    (prevents the latent cycle shim → split → split → shim).
  - Behavior unchanged; all tests pass without modification.
 - **Verify:** pytest passes; `run_ci.sh` exits 0.
-### P5 — final-review-ship (REQ-164)
+### Phase P13 — split-regression-verify (REQ-177)
-**Persona:** lead-developer (lead) + all active (review)
+- **Lead:** backend-engineer
-**Territory:** `.ciagent/**`, `core/env.py` (remove fallback),
+- **Must-haves:**
-`nova_tagging.py` (hard-fail `acdl:*`), review + audit
+  - Split `core/regression_verify.py` (670 lines) into:
-**Tasks:**
+    `core/regression_capabilities.py` (the CAP-001..022 checks),
-1. **Remove dual-read fallback (REQ-164).** Update `core/env.py`
+    `core/regression_live_plan.py` (the shared live-plan helpers from
-   `get_env()` to read `NOVA_*` only (remove the `ACDL_*` fallback).
+    P5), `core/regression_verify_cli.py` (the `__main__` CLI +
-   Update shell scripts to `${NOVA_X}` only (remove `:-$ACDL_X`).
+    `run_regression` orchestration).
-   Update `nova_tagging.py` to hard-fail on any `acdl:*` tag key (no
+  - `core/regression_verify.py` becomes a thin re-export shim.
-   warn). Delete the `ACDL_*` secrets from Gitea (the `NOVA_*` aliases
+  - Behavior unchanged; the regression gate output is identical.
-   created in P2 are now the only source). Remove the legacy comment
+- **Verify:** pytest passes; `run_ci.sh` exits 0.
   from `.env.secrets`.
 2. **Multi-persona review.** Run `ciagent-review` across all v1.15
   phases (P1–P4 changes). Auto-apply P0 fixes; flag P1+ for post-hoc.
   If P1+ found, fix in this phase.
 3. **Audit.** Run `ciagent-audit` — reconstruction test (git log matches
   `.ciagent/` files), file discipline, branch hygiene, commit
   discipline. If critical issues, fix in this phase.
 4. **Finalize consumer migration guide (REQ-164).** Update
   `docs/NOVA_MIGRATION.md` to mark the migration complete (cutoff
   passed; `ACDL_*` fallback removed).
 5. **Complete milestone.** Update `REQUIREMENTS.md` (REQ-155..164 →
   complete), `ROADMAP.md` (v1.15 complete), `PROJECT.md`. Tag
   `v1.14.5` (IS the milestone release). Merge `milestone/v1.15-nova`
   → `main`. Create Gitea release with full milestone summary.
---
+### Phase P14 — schema-driven-outputs-and-cache (REQ-178)
 - **Lead:** backend-engineer; **Contributor:** data-engineer (interface.json)
 - **Must-haves:**
  - `core/output_publisher.py:38-55` `SAFE_OUTPUT_NAMES` hardcoded set →
    derived from `modules/l1/*/interface.json` `outputs[].sensitive`
    annotations (non-sensitive outputs are safe to publish).
  - `core/contract_resolver.py:498,617` (now in the split module) —
    cache loaded JSON schemas in a module-level dict (avoid re-reading
    from disk each resolve call).
  - **Mid-milestone checkpoint (offline):** regression gate spot-check
    (not the full P9/P21 gate); confirm Wave 3 introduced no regressions.
 - **Verify:** pytest passes; `run_ci.sh` exits 0.
 ## Wave 4 — Developer Experience (P15–P17)
 ### Phase P15 — run-platform-help-and-flags-doc (REQ-179)
 - **Lead:** lead-developer
 - **Must-haves:**
  - `scripts/run_platform.sh` add a real `--help` / `-h` flag that
    prints all flags + a one-line description each (`--check-only`,
    `--plan-only`, `--apply`, `--destroy`, `--quiet`, `--deploy-uptime`,
    `--decommission`, `--local`, `--environment`). The current `:82`
    reject-unknown-flags path must allow `--help` to print + exit 0.
  - Document `--deploy-uptime` in the header comment block (currently
    used at `:532` but absent from the header).
  - Surface `--local` (D-092 local emulating tier) in the README "How to
    run" section.
 - **Verify:** `run_platform.sh --help` exits 0 and lists all flags;
  pytest passes; `run_ci.sh` exits 0.
 ### Phase P16 — workflows-readme-catalog (REQ-180)
 - **Lead:** lead-developer
 - **Must-haves:**
  - Author `.github/workflows/README.md` cataloging all 7 workflows:
    `ci.yml`, `deploy.yml`, `platform-test.yml`, `primitives-plan.yml`,
    `patterns-plan.yml`, `release.yml`, `modules-lifecycle.yml`. For
    each: trigger (`on:`), inputs (reusable-workflow `workflow_call`
    inputs), required secrets, and one-line purpose.
  - Note which 3 are byte-identical Gitea mirrors (post-P8, generated by
    `sync_workflows.py`) and which 4 are GitHub-only (Gitea act_runner
    feature gaps).
  - Add a `tests/test_docs_coverage.py` assertion that the README exists
    + lists all 7 workflow filenames.
 - **Verify:** pytest passes; `run_ci.sh` exits 0.
 ### Phase P17 — getting-started-consolidation (REQ-181)
 - **Lead:** lead-developer
 - **Must-haves:**
  - Consolidate the README "How to run" into a single getting-started
    section: **offline happy path first** (`bash scripts/run_ci.sh` +
    `bash scripts/run_platform.sh --check-only` / `--local` — no AWS
    needed), then the **AWS path** (bootstrap + `--apply`).
  - Remove the fragmented 3-step bootstrap as the lead; demote it to
    the AWS-path subsection.
  - Cross-link `docs/CONSUMER_GUIDE.md` for the consumer contract model.
 - **Verify:** pytest passes; `run_ci.sh` exits 0.
 ## Wave 5 — No Humans Onboarding Flow (P18–P20)
 ### Phase P18 — onboarding-schema-and-lambda-action (REQ-182)
 - **Lead:** backend-engineer; **Contributor:** lead-developer (schema)
 - **Must-haves:**
  - Author `schemas/onboarding.schema.json` (JSON Schema draft 2020-12):
    required fields `consumerRepo` (string, format), `requestedEnvironment`
    (string, enum from environments dir), `ownerId` (string), `billingTag`
    (string); optional `notes`.
  - `core/lambda/contract_ingestor.py` add an `onboard_consumer` action
    (D-119): validates the payload against the onboarding schema, writes
    a `pending` row to `nova-contracts` (PK `consumerRepo`, SK
    `onboarding#<requestedEnvironment>#<timestamp>`, status `pending`).
    No AWS resources created (D-113).
  - Tests: valid onboarding request writes a pending row; invalid request
    rejected with 400; offline-testable via moto/local Lambda stub.
 - **Verify:** pytest passes; `run_ci.sh` exits 0.
 ### Phase P19 — onboarding-envfile-autogen (REQ-183)
 - **Lead:** backend-engineer; **Contributor:** lead-developer (docs)
 - **Must-haves:**
  - Author `core/onboarding.py` with `generate_env_file(request,
    template_env="dev")` — produces a `<env>.json` from a consumer
    onboarding request (fills `account_id` placeholder, `ownerId`,
    `billingTag` into the env template). Emits the file + a git patch /
    PR-branch instruction.
  - Rebrand `core/environment_check.py:57-77` onboarding message to
    Nova; replace the "1. Contact the platform team" handoff with the
    self-service request path: "Run `nova onboard` (or POST to the
    Lambda `onboard_consumer` action) to request an environment; the
    platform generates a binding + opens a PR."
  - Update `core/environments/README.md:34-37` — self-service request
    path is now implemented (real provisioning still a future feature).
  - Tests: `generate_env_file` produces a valid env JSON; the rebranded
    message no longer says "contact the platform team".
 - **Verify:** pytest passes; `run_ci.sh` exits 0.
 ### Phase P20 — cross-account-role-automation-offline (REQ-184)
 - **Lead:** data-engineer; **Contributor:** backend-engineer (ABAC)
 - **Must-haves:**
  - Author `terraform/onboarding/` (new dir): `main.tf` defining the
    consumer deploy-role + `nova:owner` ABAC tag grant (cross-account
    IAM role + trust policy + tag-based permission boundary). Variables
    for `consumer_repo`, `owner_id`, `account_id`.
  - `terraform validate` passes; `terraform plan` (offline / no live
    apply per D-114) produces the expected role + policy.
  - Document the onboarding Terraform in `docs/ONBOARDING.md` — the
    request path (P18) → env-file autogen (P19) → role grant (P20, this
    phase, offline-proven; live apply deferred).
  - Tests: `terraform validate` for the onboarding module; a
    `test_onboarding_terraform.py` asserting the module validates.
 - **Verify:** `terraform validate` (onboarding module) passes; pytest
  passes; `run_ci.sh` exits 0.
 ## Final Phase — P21 — final-review-ship
 - **Lead:** lead-developer; **Contributors:** all active (review)
 - **Must-haves:**
  - Multi-persona code review across all v1.16 phases (ci-code-reviewer).
    Auto-apply P0 fixes; flag P1+ for post-hoc review. If P1+ found, fix
    in this phase (not loop back to EXECUTE).
  - Audit (ciagent-audit): reconstruction test (git log matches
    `.ciagent/` files), file discipline, branch hygiene, commit
    discipline. Fix critical issues in this phase.
  - **Run the regression gate (D-118, milestone complete):** **20/22
    Verified** (CAP-015/016 Skipped — post-teardown steady state, D-096).
  - Update `.ciagent/REQUIREMENTS.md` — mark REQ-165..184 complete.
  - Update `.ciagent/ROADMAP.md` — mark v1.16 complete.
  - Update `.ciagent/PROJECT.md` — v1.16 complete summary.
  - Ship: merge `phase/21-final-review-ship` →
    `milestone/v1.16-nova-simplification`; merge milestone → `main`;
    tag `v1.15.26` (= milestone release); create Gitea release with full
    milestone summary.
  - Clear CHECKPOINT.json (milestone complete).
 ## Success Criteria (milestone gate)
-1. All 10 REQ-155..REQ-164 marked complete in REQUIREMENTS.md.
+- All 20 requirements (REQ-165..184) satisfied; 0 partial.
-2. Review: 0 new P0; all P1+ flagged or auto-fixed.
+- Regression gate **20/22 Verified + 2 Skipped** at P9 + P21 (D-118,
-3. Audit: clean; reconstruction test passes.
+  G-111; CAP-015/016 are the post-v1.11-teardown steady state, D-096).
-4. Regression gate (D-091) 16/16 Verified throughout + at milestone
+- `bash scripts/run_ci.sh` exits 0 at every phase boundary.
-   complete.
+- Review: 0 new P0; P1+ flagged or auto-fixed.
-5. `grep -rni "ACDL\|Agentic Cloud Delivery" README.md docs/ .ciagent/*.md`
+- Audit: clean; reconstruction test passes.
-   returns 0 hits (except explicit "formerly ACDL" historical notes).
+- Tag `v1.15.26` created; milestone merged to main.
-6. `grep -rn "ACDL_" core/ scripts/ adapters/ tests/ .gitea/ .github/`
+- Onboarding request path implemented (P18–P20); real AWS provisioning
-   returns 0 hits (except the removed-fallback test in P5 that asserts
+  explicitly deferred (D-113, D-114).
   the fallback is gone).
 7. `grep -rn "acdl-" terraform/` returns 0 hits.
 8. `pytest` passes; `run_ci.sh` exits 0; `terraform validate` passes
   for platform/microservice/ci-vpc.
 9. Tag `v1.15.4` created (IS the milestone release, G-104); milestone
   merged to main.
@@ -988,3 +988,88 @@ conversation before execution; D-108..D-112 resolved at CLARIFY.
 | D-110 | Schema `$id` URLs (`https://acdl.cloudinit.dev/schemas/...`) → `https://nova.cloudinit.dev/schemas/...`. | These are illustrative schema identifiers (no real DNS resolution required for JSON-schema validation). Renamed for brand consistency in P1. Existing `$id` values in test fixtures updated. | P1 renames schema `$id` + fixture references. |
 | D-111 | Lambda env-var defaults (`CONTRACTS_TABLE` default `"acdl-contracts"`, etc.) → `nova-contracts`. | `core/lambda/contract_ingestor.py` has hardcoded `acdl-*` default table names. These become `nova-*` in P4 (resource migration). P2 changes the env-var name (`ACDL_*`→`NOVA_*`); P4 changes the default values to `nova-*`. | P4 updates Lambda defaults. |
 | D-112 | `nova` slug: no `project:` prefix on branches (single-project mode). | `config.json` has `projects[]` with one entry (slug `acdl`) but `git.branching_strategy` is `flat` and the established convention since v1.0 is flat branches (no `<slug>/` prefix). Nova rebrand does NOT change the branch prefix convention. Commit `---ci---` blocks use `project: acdl` (the config slug, unchanged). | Branches stay `milestone/v1.15-nova`, `phase/NN-*`; no `acdl/` or `nova/` prefix. |
 ## Objective for Milestone v1.16 (active — NFR Simplification)
 A 20-phase NFR sweep (no new features) themed around five axes the user
 directed during ideation: **Simplify without regressions**, **Security**,
 **Maintainability**, **User/Developer Experience**, and **No Humans
 Onboarding Flow**. The v1.15 rebrand left a fresh layer of residual debt
 (stale brand strings, a state-bucket drift, a Kyverno policy that
 contradicts the Nova tagging standard, dead code) that this milestone
 clears, alongside genuine simplification (dedup helpers, a workflow
 generator, file splits) and the first self-service onboarding request
 path (request-path only; real AWS account provisioning stays a future
 feature).
 **Milestone type:** NFR (all phases fix/chore/docs/refactor/test). The
 final phase's patch IS the deliverable — no separate milestone tag. Tags
 run on the v1.15.x line: `v1.15.5` (P0) → `v1.15.6..v1.15.25` (P1–P20) →
 `v1.15.26` (P21 final = milestone release).
 **Wave ordering:**
 - Wave 1 (P1–P4): correctness + brand regression fixes — P1 first
  (state-bucket drift + Kyverno label contradiction are the highest-
  severity findings, both correctness regressions left by the rebrand).
 - Wave 2 (P5–P9): simplify without regressions — P5 before P6/P9
  (regression-verify dedup is independent); P8 changes the workflow test.
 - Wave 3 (P10–P14): security + maintainability — P10 before P11
  (identity enforcement before payload validation); P12/P13 independent
  splits.
 - Wave 4 (P15–P17): developer experience — independent; P17 last
  (reflects the consolidated path).
 - Wave 5 (P18–P20): no-humans onboarding — P18 (schema+Lambda action)
  before P19 (env-file autogen consumes the schema) before P20 (cross-
  account role, offline-proven).
 **Verification gates:** the regression gate (D-091) runs after Wave 2
 (P9) and at P21 — all 22 capabilities must stay Verified (no
 regressions from simplification). A mid-milestone checkpoint runs after
 Wave 3 (P14), offline.
 ## Milestone v1.16 Phases
 | Phase | Name | Goal |
 |-------|------|------|
 | 01 | state-bucket-and-kyverno-rebrand-fix | `adapter.py:117` `acdl-tfstate`→`nova-tfstate`; Kyverno `require-resource-labels.yml` `acdl:*`→`nova:*` labels. Regression-risk fix. |
 | 02 | user-facing-acdl-to-nova-sweep | Onboarding msg, alert title/body, PR comments, CI banner, module docstrings → Nova. |
 | 03 | dead-code-and-stale-prefix-cleanup | Dead `ACDL_ENVIRONMENT_OVERRIDE` export; stale dual-read comments; `acdl_*` temp prefixes → `nova_*`. |
 | 04 | migrate-ssm-except-narrowing | `migrate_ssm_paths.py` `except Exception`→`ParameterNotFound`. |
 | 05 | regression-verify-dedup | Extract shared live-plan/resolver/lifecycle-resolve helpers (~70 lines saved). |
 | 06 | run-platform-deadcode-and-hitl-fn | Remove dead export; extract `run_hitl_gate()` shell fn; drop hardcoded UUID/`v18` stamp. |
 | 07 | contract-resolver-envloader-and-kind | Import env loader from environment_check; add `kind` field to registry; replace `is_l2` heuristic. |
 | 08 | workflow-generator-dedup | `scripts/sync_workflows.py` (one source → both dirs); replace byte-identity test with generator-output test. |
 | 09 | run-platform-split | Extract decommission + uptime blocks into `scripts/run_decommission.sh` + `scripts/run_uptime.sh`. |
 | 10 | contract-ingestor-defense-in-depth | Fail closed on missing IAM identity; derive env enum from `core/environments/` dir. |
 | 11 | contract-ingestor-payload-validation | Contract blob size cap + schema validation; consistent error/stackTrace caps. |
 | 12 | split-contract-resolver | 638 lines → resolve / decommission-transform / cli modules. |
 | 13 | split-regression-verify | 670 lines → capability checks / live-plan helpers / cli modules. |
 | 14 | schema-driven-outputs-and-cache | `SAFE_OUTPUT_NAMES` from interface.json; cache loaded schemas in resolver. |
 | 15 | run-platform-help-and-flags-doc | Real `--help`; document `--deploy-uptime`; surface `--local` in README. |
 | 16 | workflows-readme-catalog | `.github/workflows/README.md` — triggers, inputs, secrets, reusable-workflow contracts. |
 | 17 | getting-started-consolidation | Single getting-started section: offline happy path first, AWS path second. |
 | 18 | onboarding-schema-and-lambda-action | `schemas/onboarding.schema.json` + `onboard_consumer` action → CMDB row pending grant. |
 | 19 | onboarding-envfile-autogen | `core/onboarding.py` generates `<env>.json` from a request + emits a PR; rebrand onboarding message. |
 | 20 | cross-account-role-automation-offline | Terraform for consumer deploy-role + `nova:owner` ABAC tag (offline-proven only). |
 | 21 | final-review-ship | Review + audit + milestone ship `v1.15.26` + merge to main. |
 Milestone COMPLETE gate: review → ship `v1.15.26` (NFR milestone; final
 patch IS the release) → audit.
 ## Key Decisions (v1.16)
 Resolved at the CLARIFY stage (full autonomy — all within locked
 constraints or user-directed scope). New v1.16 decisions numbered D-113+
 to continue from v1.15's D-112. The four high-judgment scope decisions
 (D-113..D-116) were locked in by the user during the ideation planning
 conversation; D-117..D-119 resolved at CLARIFY.
 | ID | Decision | Rationale | Outcome |
 |----|----------|-----------|---------|
 | D-113 | Onboarding scope = request-path only (NFR-shaped). | User chose "Request-path only." Full self-service AWS account/network/state provisioning is a feature (creates real cloud resources), not an NFR. v1.16 removes the human handoff from the *request* step (schema + Lambda action + env-file autogen + ABAC grant hook); real AWS account creation stays a future feature milestone. | P18–P20 implement the request path; real provisioning deferred. |
 | D-114 | Cross-account Terraform = offline-proven only. | User chose "Offline-proven only." P20 Terraform for the consumer deploy-role + ABAC tag is authored + `terraform validate` + `--check-only` only; no live apply (consistent with `NOVA_LIFECYCLE_MODE=plan` default). No new AWS resources created in this NFR milestone. | P20 validates offline; live apply deferred. |
 | D-115 | Workflow dedup = generator (not status quo). | User chose "Generator." `scripts/sync_workflows.py` writes one source → both `.gitea/`+`.github/` dirs; the byte-identity test in `test_pipeline_contract.py` is replaced with a "generated outputs match committed files" test. Removes ~20 KB manual-sync risk. | P8 implements the generator + test swap. |
 | D-116 | Drift fixes = P1 of v1.16 (not a hotfix to main). | User chose "P1 of v1.16." The state-bucket drift (`adapter.py:117`) and Kyverno label contradiction are correctness regressions but latent in plan-only mode (no live apply in the default path), so they are not an active outage. Fixing them as P1 keeps the milestone self-contained. | P1 fixes both; no hotfix to main. |
 | D-117 | v1.14 NFR categories are NOT re-proposed. | v1.14 already swept over-broad excepts (REQ-141), hardcoded account-ID (REQ-142), IAM `Resource:"*"` scoping (REQ-143), contractId/env validation (REQ-144), `.gitignore` catch-all (REQ-146), `--kube-version` removal (REQ-147), orphan cleanup (REQ-148), `set -euo pipefail` parity (REQ-150). v1.16 finds NEW residual signals (the v1.15 rebrand left a fresh debt layer) and does not duplicate completed work. | Wave 1–5 target only fresh debt. |
 | D-118 | Regression gate (D-091) gates Wave 2 completion and P21. | "Simplify without regressions" is only credible if the regression gate runs after the simplification wave. The gate runs after P9 (Wave 2 done) and at P21 (milestone complete); any non-Verified capability halts W3. Mid-milestone checkpoint after P14 (offline). | P9 + P21 run the gate; P14 checkpoint. |
 | D-119 | `onboard_consumer` action stores a CMDB row pending grant (not auto-provisions). | The request-path-only scope (D-113) means the Lambda accepts an onboarding request and writes a `pending` row to `nova-contracts` (or a new `nova-onboarding` partition key); the platform automation that grants the ABAC role is the P20 Terraform (offline-proven). No AWS resources are created by the Lambda action itself. | P18 writes the pending row; P20 proves the grant Terraform offline. |
@@ -1,12 +1,13 @@
 {
-  "run_id": "regr-1785375318",
+  "run_id": "regr-1785588523",
-  "run_at_utc": "2026-07-30T01:35:18Z",
+  "run_at_utc": "2026-08-01T12:48:43Z",
  "milestone": "v1.10",
  "phase": 52,
  "summary": {
-    "Verified": 22,
+    "Verified": 18,
    "Decayed": 0,
-    "Broken": 0
+    "Broken": 0,
    "Skipped": 4
  },
  "passed": true,
  "results": [
@@ -16,7 +17,7 @@
      "status": "Verified",
      "detail": "exit 0; 2 sample contracts validate",
      "tier": "local",
-      "duration_ms": 230
+      "duration_ms": 260
    },
    {
      "capability_id": "CAP-002",
@@ -24,7 +25,7 @@
      "status": "Verified",
      "detail": "exit 0; env schema validates",
      "tier": "local",
-      "duration_ms": 204
+      "duration_ms": 202
    },
    {
      "capability_id": "CAP-003",
@@ -32,7 +33,7 @@
      "status": "Verified",
      "detail": "exit 0; ",
      "tier": "local",
-      "duration_ms": 247
+      "duration_ms": 266
    },
    {
      "capability_id": "CAP-004",
@@ -40,7 +41,7 @@
      "status": "Verified",
      "detail": "exit 0; ",
      "tier": "local",
-      "duration_ms": 241
+      "duration_ms": 248
    },
    {
      "capability_id": "CAP-005",
@@ -48,7 +49,7 @@
      "status": "Verified",
      "detail": "exit 0; ",
      "tier": "local",
-      "duration_ms": 326
+      "duration_ms": 337
    },
    {
      "capability_id": "CAP-006",
@@ -56,7 +57,7 @@
      "status": "Verified",
      "detail": "exit 0; interpolation ok",
      "tier": "local",
-      "duration_ms": 216
+      "duration_ms": 209
    },
    {
      "capability_id": "CAP-007",
@@ -64,7 +65,7 @@
      "status": "Verified",
      "detail": "exit 0; confidence band=pass",
      "tier": "local",
-      "duration_ms": 79
+      "duration_ms": 80
    },
    {
      "capability_id": "CAP-008",
@@ -72,15 +73,15 @@
      "status": "Verified",
      "detail": "exit 0; outbox hash chain ok",
      "tier": "local",
-      "duration_ms": 333
+      "duration_ms": 319
    },
    {
      "capability_id": "CAP-009",
      "name": "offline pytest suite passes",
      "status": "Verified",
-      "detail": "exit 0;                                 [ 98%]\ntests/test_wiz_adapter_real_client.py .........                          [100%]\n\n====================== 555 passed, 2 deselected in 51.11s ======================",
+      "detail": "exit 0;                                 [ 98%]\ntests/test_wiz_adapter_real_client.py .........                          [100%]\n\n====================== 577 passed, 2 deselected in 53.53s ======================",
      "tier": "local",
-      "duration_ms": 52574
+      "duration_ms": 55005
    },
    {
      "capability_id": "CAP-010",
@@ -88,63 +89,63 @@
      "status": "Verified",
      "detail": "exit 0; resource(s))\n\n=== PLATFORM CHECK OK ===\ncontract -> resolver -> stack -> adapter -> structure validated (offline, no AWS)\ncheck-only: OK\n\n=== CI PIPELINE OK ===\n3 stages passed: lint, test, check-only",
      "tier": "local",
-      "duration_ms": 59608
+      "duration_ms": 59882
    },
    {
      "capability_id": "CAP-011",
      "name": "headline E2E runs against the local emulating tier (microservice)",
      "status": "Verified",
-      "detail": "exit 0; al-emulator\",\n    \"desired_count\": 1,\n    \"running_count\": 1\n  },\n  \"outbox_dir\": \"/tmp/acdl_local_e2e_0v1bpi48/outbox\",\n  \"outbox_events\": 2,\n  \"outbox_chain_verified\": true,\n  \"lambda_status\": 200\n}",
+      "detail": "exit 0; al-emulator\",\n    \"desired_count\": 1,\n    \"running_count\": 1\n  },\n  \"outbox_dir\": \"/tmp/nova_local_e2e_cuwlkzrj/outbox\",\n  \"outbox_events\": 2,\n  \"outbox_chain_verified\": true,\n  \"lambda_status\": 200\n}",
      "tier": "local",
-      "duration_ms": 1072
+      "duration_ms": 561
    },
    {
      "capability_id": "CAP-012",
      "name": "local E2E on the static-assets stack (no ECS)",
      "status": "Verified",
-      "detail": "exit 0; acdl_local_e2e_0cjcizgd/tf\",\n  \"backend\": \"local\",\n  \"ecs\": null,\n  \"outbox_dir\": \"/tmp/acdl_local_e2e_0cjcizgd/outbox\",\n  \"outbox_events\": 2,\n  \"outbox_chain_verified\": true,\n  \"lambda_status\": 200\n}",
+      "detail": "exit 0; nova_local_e2e_mfeuiylw/tf\",\n  \"backend\": \"local\",\n  \"ecs\": null,\n  \"outbox_dir\": \"/tmp/nova_local_e2e_mfeuiylw/outbox\",\n  \"outbox_events\": 2,\n  \"outbox_chain_verified\": true,\n  \"lambda_status\": 200\n}",
      "tier": "local",
-      "duration_ms": 490
+      "duration_ms": 492
    },
    {
      "capability_id": "CAP-013",
      "name": "terraform init+validate+plan live AWS (microservice)",
-      "status": "Verified",
+      "status": "Skipped",
-      "detail": "terraform init+validate+plan OK (live AWS, microservice)",
+      "detail": "terraform init: state bucket absent (post-v1.11-teardown, D-096) [microservice]",
      "tier": "live-aws",
-      "duration_ms": 28176
+      "duration_ms": 851
    },
    {
      "capability_id": "CAP-014",
      "name": "terraform init+validate+plan live AWS (static-assets)",
-      "status": "Verified",
+      "status": "Skipped",
-      "detail": "terraform init+validate+plan OK (live AWS, static-assets)",
+      "detail": "terraform init: state bucket absent (post-v1.11-teardown, D-096) [static-assets]",
      "tier": "live-aws",
-      "duration_ms": 31892
+      "duration_ms": 724
    },
    {
      "capability_id": "CAP-015",
      "name": "DynamoDB outbox table exists (live AWS)",
-      "status": "Verified",
+      "status": "Skipped",
-      "detail": "acdl-outbox exists, item_count=9",
+      "detail": "nova-outbox absent (post-v1.11-teardown steady state, D-096)",
      "tier": "live-aws",
-      "duration_ms": 507
+      "duration_ms": 487
    },
    {
      "capability_id": "CAP-016",
      "name": "S3 state bucket exists + readable (live AWS)",
-      "status": "Verified",
+      "status": "Skipped",
-      "detail": "state bucket exists, keys=['platform/terraform.tfstate', 'spike/alb/dev/terraform.tfstate', 'spike/assets/dev/terraform.tfstate', 'spike/cdn/dev/terraform.tfstate', 'spike/ci-vpc/terraform.tfstate']",
+      "detail": "state bucket nova-tfstate-581513795199-us-east-1 absent (post-v1.11-teardown, D-096)",
      "tier": "live-aws",
-      "duration_ms": 329
+      "duration_ms": 300
    },
    {
      "capability_id": "CAP-017",
-      "name": "DynamoDB acdl-contracts table (lifecycle pipeline evidence)",
+      "name": "DynamoDB nova-contracts table (lifecycle pipeline evidence)",
      "status": "Verified",
      "detail": "terraform files present + fmt -check passes + simple/complex contracts resolve",
      "tier": "lifecycle-pipeline",
-      "duration_ms": 588
+      "duration_ms": 579
    },
    {
      "capability_id": "CAP-018",
@@ -152,7 +153,7 @@
      "status": "Verified",
      "detail": "LocalLambdaStub instantiates (local tier evidence)",
      "tier": "lifecycle-pipeline",
-      "duration_ms": 135
+      "duration_ms": 139
    },
    {
      "capability_id": "CAP-019",
@@ -160,7 +161,7 @@
      "status": "Verified",
      "detail": "L2 composition resolves (simple + complex contracts; offline proxy)",
      "tier": "lifecycle-pipeline",
-      "duration_ms": 498
+      "duration_ms": 553
    },
    {
      "capability_id": "CAP-020",
@@ -168,7 +169,7 @@
      "status": "Verified",
      "detail": "L2 composition resolves (simple + complex contracts; offline proxy)",
      "tier": "lifecycle-pipeline",
-      "duration_ms": 510
+      "duration_ms": 561
    },
    {
      "capability_id": "CAP-021",
@@ -176,7 +177,7 @@
      "status": "Verified",
      "detail": "terraform files present + fmt -check passes + simple/complex contracts resolve",
      "tier": "lifecycle-pipeline",
-      "duration_ms": 562
+      "duration_ms": 598
    },
    {
      "capability_id": "CAP-022",
@@ -184,7 +185,7 @@
      "status": "Verified",
      "detail": "terraform files present + fmt -check passes + simple/complex contracts resolve",
      "tier": "lifecycle-pipeline",
-      "duration_ms": 554
+      "duration_ms": 570
    }
  ]
 }
@@ -1,51 +1,51 @@
 # Regression Report — v1.10 Phase 52
- **Run ID:** `regr-1785375318`
+- **Run ID:** `regr-1785588523`
- **Run at (UTC):** 2026-07-30T01:35:18Z
+- **Run at (UTC):** 2026-08-01T12:48:43Z
- **Summary:** {'Verified': 22, 'Decayed': 0, 'Broken': 0}
+- **Summary:** {'Verified': 18, 'Decayed': 0, 'Broken': 0, 'Skipped': 4}
 - **Passed (milestone gate):** True
 | Capability | Name | Tier | Status | Duration (ms) | Detail |
 |-----------|------|------|--------|--------------|--------|
-| CAP-001 | contract.schema.json validates sample contracts | local | **Verified** | 230 | exit 0; 2 sample contracts validate |
+| CAP-001 | contract.schema.json validates sample contracts | local | **Verified** | 260 | exit 0; 2 sample contracts validate |
-| CAP-002 | environment.schema.json validates env files | local | **Verified** | 204 | exit 0; env schema validates |
+| CAP-002 | environment.schema.json validates env files | local | **Verified** | 202 | exit 0; env schema validates |
-| CAP-003 | contract_resolver resolves static-assets | local | **Verified** | 247 | exit 0;  |
+| CAP-003 | contract_resolver resolves static-assets | local | **Verified** | 266 | exit 0;  |
-| CAP-004 | contract_resolver resolves microservice | local | **Verified** | 241 | exit 0;  |
+| CAP-004 | contract_resolver resolves microservice | local | **Verified** | 248 | exit 0;  |
-| CAP-005 | terraform adapter emits .tf files | local | **Verified** | 326 | exit 0;  |
+| CAP-005 | terraform adapter emits .tf files | local | **Verified** | 337 | exit 0;  |
-| CAP-006 | contract interpolation expands env/contract tokens | local | **Verified** | 216 | exit 0; interpolation ok |
+| CAP-006 | contract interpolation expands env/contract tokens | local | **Verified** | 209 | exit 0; interpolation ok |
-| CAP-007 | confidence_signal.compute returns a band | local | **Verified** | 79 | exit 0; confidence band=pass |
+| CAP-007 | confidence_signal.compute returns a band | local | **Verified** | 80 | exit 0; confidence band=pass |
-| CAP-008 | outbox_writer builds a hash-chained item | local | **Verified** | 333 | exit 0; outbox hash chain ok |
+| CAP-008 | outbox_writer builds a hash-chained item | local | **Verified** | 319 | exit 0; outbox hash chain ok |
-| CAP-009 | offline pytest suite passes | local | **Verified** | 52574 | exit 0;                                 [ 98%]
+| CAP-009 | offline pytest suite passes | local | **Verified** | 55005 | exit 0;                                 [ 98%]
 tests/test_wiz_adapter_real_client.py .........                          [100%]
-====================== 555 passe |
+====================== 577 passe |
-| CAP-010 | run_ci.sh reproduces CI pipeline locally | local | **Verified** | 59608 | exit 0; resource(s))
+| CAP-010 | run_ci.sh reproduces CI pipeline locally | local | **Verified** | 59882 | exit 0; resource(s))
 === PLATFORM CHECK OK ===
 contract -> resolver -> stack -> adapter -> structure validated (offline, no AWS)
 check-only: OK
 === CI PIPELIN |
-| CAP-011 | headline E2E runs against the local emulating tier (microservice) | local | **Verified** | 1072 | exit 0; al-emulator",
+| CAP-011 | headline E2E runs against the local emulating tier (microservice) | local | **Verified** | 561 | exit 0; al-emulator",
    "desired_count": 1,
    "running_count": 1
  },
-  "outbox_dir": "/tmp/acdl_local_e2e_0v1bpi48/outbox",
+  "outbox_dir": "/tmp/nova_local_e2e_cuwlkzrj/outbox",
  "outbox_events": 2,
  "outbox |
-| CAP-012 | local E2E on the static-assets stack (no ECS) | local | **Verified** | 490 | exit 0; acdl_local_e2e_0cjcizgd/tf",
+| CAP-012 | local E2E on the static-assets stack (no ECS) | local | **Verified** | 492 | exit 0; nova_local_e2e_mfeuiylw/tf",
  "backend": "local",
  "ecs": null,
-  "outbox_dir": "/tmp/acdl_local_e2e_0cjcizgd/outbox",
+  "outbox_dir": "/tmp/nova_local_e2e_mfeuiylw/outbox",
  "outbox_events": 2,
  "outbox |
-| CAP-013 | terraform init+validate+plan live AWS (microservice) | live-aws | **Verified** | 28176 | terraform init+validate+plan OK (live AWS, microservice) |
+| CAP-013 | terraform init+validate+plan live AWS (microservice) | live-aws | **Skipped** | 851 | terraform init: state bucket absent (post-v1.11-teardown, D-096) [microservice] |
-| CAP-014 | terraform init+validate+plan live AWS (static-assets) | live-aws | **Verified** | 31892 | terraform init+validate+plan OK (live AWS, static-assets) |
+| CAP-014 | terraform init+validate+plan live AWS (static-assets) | live-aws | **Skipped** | 724 | terraform init: state bucket absent (post-v1.11-teardown, D-096) [static-assets] |
-| CAP-015 | DynamoDB outbox table exists (live AWS) | live-aws | **Verified** | 507 | acdl-outbox exists, item_count=9 |
+| CAP-015 | DynamoDB outbox table exists (live AWS) | live-aws | **Skipped** | 487 | nova-outbox absent (post-v1.11-teardown steady state, D-096) |
-| CAP-016 | S3 state bucket exists + readable (live AWS) | live-aws | **Verified** | 329 | state bucket exists, keys=['platform/terraform.tfstate', 'spike/alb/dev/terraform.tfstate', 'spike/assets/dev/terraform.tfstate', 'spike/cdn/dev/terraform.tfsta |
+| CAP-016 | S3 state bucket exists + readable (live AWS) | live-aws | **Skipped** | 300 | state bucket nova-tfstate-581513795199-us-east-1 absent (post-v1.11-teardown, D-096) |
-| CAP-017 | DynamoDB acdl-contracts table (lifecycle pipeline evidence) | lifecycle-pipeline | **Verified** | 588 | terraform files present + fmt -check passes + simple/complex contracts resolve |
+| CAP-017 | DynamoDB nova-contracts table (lifecycle pipeline evidence) | lifecycle-pipeline | **Verified** | 579 | terraform files present + fmt -check passes + simple/complex contracts resolve |
-| CAP-018 | Lambda contract-ingestor (local stub + lifecycle evidence) | lifecycle-pipeline | **Verified** | 135 | LocalLambdaStub instantiates (local tier evidence) |
+| CAP-018 | Lambda contract-ingestor (local stub + lifecycle evidence) | lifecycle-pipeline | **Verified** | 139 | LocalLambdaStub instantiates (local tier evidence) |
-| CAP-019 | ECS cluster + service (L2 microservice lifecycle evidence) | lifecycle-pipeline | **Verified** | 498 | L2 composition resolves (simple + complex contracts; offline proxy) |
+| CAP-019 | ECS cluster + service (L2 microservice lifecycle evidence) | lifecycle-pipeline | **Verified** | 553 | L2 composition resolves (simple + complex contracts; offline proxy) |
-| CAP-020 | CloudFront + WAF (L2 static-assets lifecycle evidence) | lifecycle-pipeline | **Verified** | 510 | L2 composition resolves (simple + complex contracts; offline proxy) |
+| CAP-020 | CloudFront + WAF (L2 static-assets lifecycle evidence) | lifecycle-pipeline | **Verified** | 561 | L2 composition resolves (simple + complex contracts; offline proxy) |
-| CAP-021 | uptime-kuma (L1 uptime lifecycle evidence) | lifecycle-pipeline | **Verified** | 562 | terraform files present + fmt -check passes + simple/complex contracts resolve |
+| CAP-021 | uptime-kuma (L1 uptime lifecycle evidence) | lifecycle-pipeline | **Verified** | 598 | terraform files present + fmt -check passes + simple/complex contracts resolve |
-| CAP-022 | OIDC role (L1 iam-role lifecycle evidence) | lifecycle-pipeline | **Verified** | 554 | terraform files present + fmt -check passes + simple/complex contracts resolve |
+| CAP-022 | OIDC role (L1 iam-role lifecycle evidence) | lifecycle-pipeline | **Verified** | 570 | terraform files present + fmt -check passes + simple/complex contracts resolve |
@@ -840,3 +840,119 @@ IDEATE-01..IDEATE-10, mapped to REQ-155..REQ-164.
  names; only future releases use `Nova vX.Y.Z`.
 - Git branch/tag naming — branches use `milestone/v*` / `phase/*` and
  tags use `v*` semver; no brand name present, no change needed.
 ---
 ## v1.16 — Nova Simplification (NFR)
 **Milestone type:** NFR (all phases fix/chore/docs/refactor/test). The
 final phase's patch IS the deliverable — no separate milestone tag. Tags
 run on the v1.15.x line: `v1.15.5` (P0) → `v1.15.6..v1.15.25` (P1–P20) →
 `v1.15.26` (P21 final = milestone release).
 **Objective:** A 20-phase NFR sweep (no new features) themed around five
 user-directed axes: Simplify without regressions, Security,
 Maintainability, User/Developer Experience, and No Humans Onboarding
 Flow. The v1.15 rebrand left a fresh debt layer (stale brand strings, a
 state-bucket drift, a Kyverno policy contradicting the Nova tagging
 standard, dead code) that this milestone clears, alongside genuine
 simplification and the first self-service onboarding request path.
 ### Requirements
 - **REQ-165** — The adapter-emitted terraform backend references
  `nova-tfstate-*` (not `acdl-tfstate-*`); the Kyverno
  `require-resource-labels.yml` policy enforces `nova:*` labels (not
  `acdl:*`). Correctness regression fix from the v1.15 rebrand. (Phase P1)
 - **REQ-166** — All user-facing "ACDL" strings rebranded to Nova:
  onboarding message, Lambda alert title/body, PR-stage comments, CI
  banner, module docstrings (contract_resolver/confidence_signal/adapter/
  kyverno/wiz + adapters README). (Phase P2)
 - **REQ-167** — Dead `ACDL_ENVIRONMENT_OVERRIDE` export removed; stale
  dual-read comments dropped; `acdl_*` temp-dir prefixes → `nova_*`. (Phase P3)
 - **REQ-168** — `migrate_ssm_paths.py` `except Exception: pass` narrowed
  to `ParameterNotFound` + structured log. (Phase P4)
 - **REQ-169** — `regression_verify.py` duplicated live-plan/resolver/
  lifecycle-resolve blocks extracted into shared helpers (~70 lines
  saved). (Phase P5)
 - **REQ-170** — `run_platform.sh` dead export removed; HITL attestation
  block extracted to a shell function; hardcoded UUID/`v18` work-dir
  stamp replaced with config. (Phase P6)
 - **REQ-171** — `contract_resolver.py` imports the env loader from
  `environment_check` (dedup); registry entries carry a `kind` field;
  fragile `is_l2` path-string heuristic replaced. (Phase P7)
 - **REQ-172** — `scripts/sync_workflows.py` generates the 3
  byte-identical workflow pairs from one source; the byte-identity test
  is replaced with a generator-output test. (Phase P8)
 - **REQ-173** — `run_platform.sh` decommission + uptime blocks extracted
  into `scripts/run_decommission.sh` + `scripts/run_uptime.sh`. (Phase P9)
 - **REQ-174** — `contract_ingestor.py` fails closed (not silent `pass`)
  when IAM identity is absent; the env enum is derived from
  `core/environments/` (not hardcoded). (Phase P10)
 - **REQ-175** — The contract blob payload is size-capped + schema-
  validated before the DynamoDB write; error/stackTrace caps are
  consistent. (Phase P11)
 - **REQ-176** — `contract_resolver.py` (638 lines) split into resolve /
  decommission-transform / cli modules. (Phase P12)
 - **REQ-177** — `regression_verify.py` (670 lines) split into capability
  checks / live-plan helpers / cli modules. (Phase P13)
 - **REQ-178** — `SAFE_OUTPUT_NAMES` is schema-driven (from
  interface.json `sensitive` annotations); loaded schemas are cached in
  the resolver. (Phase P14)
 - **REQ-179** — `run_platform.sh` has a real `--help`; `--deploy-uptime`
  is documented; `--local` is surfaced in the README. (Phase P15)
 - **REQ-180** — `.github/workflows/README.md` catalogs all 7 workflows'
  triggers, inputs, required secrets, and reusable-workflow contracts. (Phase P16)
 - **REQ-181** — A single getting-started section in the README:
  offline happy path (`run_ci.sh` + `run_platform.sh --check-only`/
  `--local`) first, AWS path second. (Phase P17)
 - **REQ-182** — `schemas/onboarding.schema.json` defines the onboarding
  request; `contract_ingestor.py` gains an `onboard_consumer` action that
  writes a `pending` CMDB row. (Phase P18)
 - **REQ-183** — `core/onboarding.py` generates a `<env>.json` from a
  consumer request + emits a PR; the onboarding message is rebranded to
  Nova and no longer routes to "contact the platform team" for the
  request step. (Phase P19)
 - **REQ-184** — Terraform for the consumer deploy-role + `nova:owner`
  ABAC tag grant, offline-proven (`terraform validate` + `--check-only`
  only; no live apply). (Phase P20)
 ### v1.16 Traceability
 | Requirement | Phase | Status |
 |-------------|-------|--------|
 | REQ-165 | P1 | pending |
 | REQ-166 | P2 | pending |
 | REQ-167 | P3 | pending |
 | REQ-168 | P4 | pending |
 | REQ-169 | P5 | pending |
 | REQ-170 | P6 | pending |
 | REQ-171 | P7 | pending |
 | REQ-172 | P8 | pending |
 | REQ-173 | P9 | pending |
 | REQ-174 | P10 | pending |
 | REQ-175 | P11 | pending |
 | REQ-176 | P12 | pending |
 | REQ-177 | P13 | pending |
 | REQ-178 | P14 | pending |
 | REQ-179 | P15 | pending |
 | REQ-180 | P16 | pending |
 | REQ-181 | P17 | pending |
 | REQ-182 | P18 | pending |
 | REQ-183 | P19 | pending |
 | REQ-184 | P20 | pending |
 ### Out of Scope (v1.16)
 - New features (feat phases). v1.16 is NFR-only.
 - Real AWS account/network/state provisioning (self-service) — the
  onboarding request path is implemented (D-113); actual cloud resource
  creation stays a future feature milestone.
 - Live apply of the cross-account role Terraform (D-114) — offline-proven
  only; live apply deferred.
 - D-083 audit ledger build-out (carries forward; unchanged).
 - Real OIDC federation (carries forward; blocked on go-gitea/gitea#36988).
 - Re-proposing v1.14 NFR categories already closed (D-117): over-broad
  excepts (REQ-141), hardcoded account-ID (REQ-142), IAM `Resource:"*"`
  scoping (REQ-143), contractId/env validation (REQ-144), `.gitignore`
  catch-all (REQ-146), `--kube-version` removal (REQ-147), orphan
  cleanup (REQ-148), `set -euo pipefail` parity (REQ-150).
@@ -1022,3 +1022,169 @@ deploy-workflow boundary).
 - A3 (confidence 0.8): The Gitea release API (`POST .../releases`) is
  reachable for `v1.14.x` tags (the v1.14 milestone shipped releases
  through `v1.13.24` / release id 285). P0 ship targets `v1.14.0`.
 ---
 ## v1.16 NFR Simplification — Research Addendum (2026-07-30)
 **Milestone:** v1.16-Nova-Simplification (NFR). Research is codebase-
 grounded (not domain/ecosystem) — the two explore passes identified
 concrete, file:line-verified residual debt the v1.15 rebrand left, plus
 genuine simplification and the onboarding request-path scaffolding.
 ### R1. v1.14 NFR categories already closed (do NOT re-propose)
 v1.14 (REQ-135..154) swept: over-broad excepts (REQ-141), hardcoded
 account-ID externalization (REQ-142, `ACDL_AWS_ACCOUNT_ID` env + live
 fallback G-102), IAM `Resource:"*"` scoping to `nova-*` ARNs (REQ-143,
 G-104), contractId/env/error validation (REQ-144),
 `additionalProperties:false` schemas (REQ-145), `.gitignore` credential
 catch-all (REQ-146), Kyverno `--kube-version` removal + deferral doc
 (REQ-147, G-103), orphan bytecode/dead-config cleanup (REQ-148), 7
 untested-script test coverage (REQ-149), `set -euo pipefail` parity +
 Gitea workflow parity (REQ-150), config/persona/backend hygiene (REQ-151),
 STANDARDS.md TYPE_MAP consistency (REQ-152), ARCHITECTURE/COST/GRILL doc
 sync (REQ-153), platform-VPC CIDR/subnet parameterization (REQ-154).
 The v1.16 grill (G-101..G-106) and escalation E-001 are all CLOSED.
 v1.16 finds NEW residual signals (D-117).
 ### R2. Fresh debt the v1.15 rebrand left (verified file:line)
 **High-severity correctness regressions (P1):**
 - `adapters/terraform/adapter.py:117` — emits `state_bucket =
  f"acdl-tfstate-{account_id}-us-east-1"`. The live state bucket was
  renamed to `nova-tfstate-*` in v1.15 P4 (REQ-163), but the adapter's
  emitted terraform backend still references `acdl-tfstate-*`. In
  plan-only mode this is latent (no real init against the bucket), but a
  full-mode lifecycle run would point at a non-existent bucket.
 - `adapters/kyverno/policies/require-resource-labels.yml:6,21,25,33,37`
  — enforces `acdl:owner`/`acdl:environment` labels. `nova_tagging.py`
  hard-fails on any `acdl:*` key post-P5 (REQ-164). The Kyverno policy
  contradicts the Nova tagging standard.
 **User-facing brand misses (P2):**
 - `core/environment_check.py:59,61` — onboarding message header/body say
  "ACDL Environment Onboarding" / "ACDL environments are platform-
  managed" (user-facing).
 - `core/lambda/contract_ingestor.py:145,191` — GitHub issue alert title
  `[ACDL-ALERT]` + body "auto-created by the ACDL platform Lambda"
  (user-facing artifact).
 - `scripts/post_stage_comment.sh:39,46` — PR comment header "ACDL Stage"
  + footer "ACDL deploy pipeline" (user-facing).
 - `scripts/run_ci.sh:39` — CI banner "ACL CI Pipeline".
 - Module docstrings: `core/contract_resolver.py:1,474`,
  `core/confidence_signal.py:1`, `adapters/terraform/adapter.py:1`,
  `adapters/kyverno/kyverno_adapter.py:1`, `adapters/wiz/wiz_adapter.py:1`,
  `adapters/README.md:1`, `adapters/kyverno/README.md:4,18`.
 **Dead code + stale comments (P3):**
 - `scripts/run_platform.sh:153` — `export
  ACDL_ENVIRONMENT_OVERRIDE="$ENVIRONMENT_OVERRIDE"  # legacy fallback,
  removed in P5` — comment says "removed in P5" but the line is STILL
  present (dead code, P5 already shipped).
 - Stale dual-read comments across `core/local_emulators.py:15-16,503,505`,
  `core/regression_verify.py:318-319,333`, `scripts/run_regression.sh`,
  `scripts/run_lifecycle_*.sh` (reference the retired G-106 fallback).
 - `acdl_*` temp-dir prefixes: `core/local_emulators.py:71,252`,
  `core/regression_verify.py:183,234`, `scripts/run_pattern_plan.sh:29`,
  `scripts/run_primitive_plan.sh:29`, `scripts/run_lifecycle_*.sh:36,41`.
 ### R3. Simplification opportunities (verified)
 - `core/regression_verify.py:328-409` — `_check_live_terraform_plan_
  microservice` + `_check_live_terraform_plan_static_assets` are ~95%
  identical (resolve → adapt → init → validate → plan). Extract
  `_check_live_terraform_plan(contract, label)` (~35 lines saved).
 - `core/regression_verify.py:149-178` — `_check_resolver_static_assets` +
  `_check_resolver_microservice` identical except contract path. Extract
  `_check_resolver(contract)`.
 - `core/regression_verify.py:477-503` — duplicated lifecycle-contract-
  resolve block. Extract `_assert_contracts_resolve(module_dir)`.
 - `scripts/run_platform.sh:336-350` + `:452-466` — duplicated HITL
  attestation block. Extract `run_hitl_gate()` shell fn (~14 lines).
 - `core/contract_resolver.py:50-68` duplicates `core/environment_check.py:
  36-54` env loader verbatim. Import instead.
 - `scripts/run_platform.sh:145-146` — hardcoded `CONTRACT_ID` UUID +
  `WORK="/tmp/acdl_platform_run_v18"` (`v18` stale). Make config/env-
  derived.
 - `.gitea/workflows/` ↔ `.github/workflows/` — 3 byte-identical pairs
  (`ci.yml`, `deploy.yml`, `modules-lifecycle.yml`, ~20 KB) maintained
  by hand + a test asserting identity. Generator (D-115) eliminates
  manual-sync risk.
 - `core/contract_resolver.py:540` — `is_l2 = "l2" in interface_path or
  "composition" in interface_path` fragile string heuristic. Add `kind`
  to registry entries (P7).
 - `scripts/run_platform.sh` (610 lines) — decommission block (`:180-237`)
  + uptime block (`:520-606`) are self-contained. Extract to
  `scripts/run_decommission.sh` + `scripts/run_uptime.sh` (P9).
 ### R4. Security gaps (verified, NEW — not v1.14 duplicates)
 - `core/lambda/contract_ingestor.py:251-252` — `if not caller_arn: pass`
  silently skips identity validation when IAM identity absent; relies on
  ABAC layer only (no defense-in-depth). Fail closed instead (P10).
 - `core/lambda/contract_ingestor.py:269` — `valid_envs = {"dev","qa",
  "prod","dr"}` hardcoded; the `core/environments/` dir is the source of
  truth. Derive from the directory (P10).
 - `core/lambda/contract_ingestor.py` — `submit_contract` checks the
  `contract` key exists but never validates the blob's size or schema.
  Unbounded payload → DynamoDB write amplification. Size cap + schema
  validation (P11).
 - `scripts/migrate_ssm_paths.py:113` — `except Exception: pass` (claims
  `ParameterNotFound` but catches all). Last true broad-swallow.
  Narrow to `ParameterNotFound` (P4).
 - `core/output_publisher.py:112,182` — `except Exception` in
  `publish_to_ssm` + `post_github_comment` swallow all (not narrowed by
  REQ-141 which targeted 6 other sites). Narrow to specific exceptions.
 ### R5. Onboarding request-path scaffolding (already present)
 The infrastructure for a zero-human *request* path already exists:
 - `terraform/platform/main.tf:153-183` deploys `contract_ingestor` Lambda
  + Function URL (IAM auth).
 - `core/lambda/contract_ingestor.py:325-362` dispatches
  `submit_contract | report_error | validate_change_request`. Adding
  `onboard_consumer` is a small extension (P18, D-119: writes a
  `pending` CMDB row, no provisioning).
 - `terraform/platform/consumer_invoke_policy.json` is the ABAC policy
  template (`aws:PrincipalTag/nova:owner == ${consumerRepo}` scoped
  `lambda:InvokeFunctionUrl`).
 - `core/environments/*.json` are static JSON templates with placeholder
  `account_id: "000000000000"` — auto-generation from a request is
  straightforward (P19).
 Missing for "no humans": (a) `onboard_consumer` action + onboarding
 schema (P18), (b) `core/onboarding.py` to auto-generate `<env>.json` +
 emit a PR (P19), (c) cross-account deploy-role + ABAC tag Terraform,
 offline-proven (P20, D-114). Real AWS account/network/state creation
 stays a future feature (D-113).
 ### R6. Developer experience gaps
 - `scripts/run_platform.sh` has no `--help` (`:82` rejects `--*` flags).
  `--deploy-uptime` (`:532`) is undocumented in the header. `--local`
  is absent from the README (P15).
 - No `.github/workflows/README.md` cataloging the 7 workflows' inputs/
  secrets/triggers (P16).
 - No single getting-started path; README "How to run" lists 3 manual
  bootstrap steps. The offline happy path (`run_ci.sh` +
  `run_platform.sh --check-only`/`--local`) is not surfaced first (P17).
 ### Assumptions logged (v1.16)
 - A1 (0.9): No live AWS access during execution (consistent with
  v1.11–v1.15). `NOVA_LIFECYCLE_MODE` defaults to plan-only; terraform
  changes validated via `terraform validate`. The state-bucket drift
  (P1) is latent in plan-only mode but must still be fixed for
  correctness.
 - A2 (0.85): The `onboard_consumer` Lambda action (P18) is offline-
  testable via `moto` / the local Lambda stub (D-092), consistent with
  the existing `submit_contract`/`report_error` test pattern.
 - A3 (0.8): The workflow generator (P8, D-115) must preserve the
  byte-identity property *as a test assertion* (generated outputs match
  committed files), not lose it — the dedup is mechanical, not a
  semantic change to the workflows.
 - A4 (0.85): The regression gate (D-091, D-118) at P9 and P21 confirms
  "simplify without regressions" — 22/22 capabilities must stay Verified.
  The gate is the credible control for the simplification wave.
@@ -8,7 +8,7 @@
  ],
  "active_project": "acdl",
  "active_projects": ["acdl"],
-  "active_milestone": "v1.15",
+  "active_milestone": "v1.16",
  "autonomy": {
    "level": "full",
    "escalation_hooks": ["deploy", "delete_data", "merge_to_main"],
@@ -1,4 +1,4 @@
-# ACDL Adapters
+# Nova Adapters
 ## Overview
@@ -1,7 +1,7 @@
 # Kyverno Adapter
 The Kyverno adapter translates Kyverno `PolicyReport` results to the
-normalized ACDL
+normalized Nova
 [`PolicyCheckResult`](../../schemas/policy_check_result.schema.json) schema
 (engine: `"kyverno"`), mirroring the Checkov/Wiz adapter pattern.
@@ -15,7 +15,7 @@ publishes results to `PolicyReport` resources.
 ## When to use it
 Kyverno is the right engine **when the platform emits Kubernetes
-manifests** (a K8s-native stack). The ACDL platform today emits Terraform
+manifests** (a K8s-native stack). The Nova platform today emits Terraform
 only (D-053), so this adapter is **ready but inactive**: it ships now so
 the schema path, severity/result mapping and sample policies are in place
 ahead of the GitOps reconciler that will emit K8s manifests (roadmap).
@@ -55,8 +55,8 @@ manifests (documentation-only today — the platform does not run them):
 - `disallow-privileged-containers.yml` — fail pods with
  `securityContext.privileged: true`.
- `require-resource-labels.yml` — require `acdl:owner` and
+- `require-resource-labels.yml` — require `nova:owner` and
-  `acdl:environment` labels on all pods (mirrors the ACDL tagging standard
+  `nova:environment` labels on all pods (mirrors the Nova tagging standard
  in [`schemas/tagging-standard.json`](../../schemas/tagging-standard.json)).
 - `require-image-digests.yml` — require container images to reference a
  digest (`image@sha256:...`), not a mutable tag.
@@ -1,4 +1,4 @@
-"""Kyverno adapter — translate Kyverno PolicyReport results to ACDL PolicyCheckResult records.
+"""Kyverno adapter — translate Kyverno PolicyReport results to Nova PolicyCheckResult records.
 Kyverno is a Kubernetes-native policy engine. It evaluates K8s manifests
 and produces PolicyReport resources. This adapter translates those results
@@ -3,7 +3,7 @@ kind: ClusterPolicy
 metadata:
  name: require-resource-labels
  annotations:
-    policies.kyverno.io/title: Require ACDL Resource Labels
+    policies.kyverno.io/title: Require Nova Resource Labels
    policies.kyverno.io/category: Governance
    policies.kyverno.io/severity: medium
    policies.kyverno.io/subject: Pod
@@ -11,27 +11,27 @@ spec:
  validationFailureAction: audit
  background: true
  rules:
-    - name: require-acdl-owner-label
+    - name: require-nova-owner-label
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
-        message: "Pods must carry the acdl:owner label (ACDL tagging standard)."
+        message: "Pods must carry the nova:owner label (Nova tagging standard)."
        pattern:
          metadata:
            labels:
-              acdl:owner: "?*"
+              nova:owner: "?*"
-    - name: require-acdl-environment-label
+    - name: require-nova-environment-label
      match:
        any:
          - resources:
              kinds:
                - Pod
      validate:
-        message: "Pods must carry the acdl:environment label (ACDL tagging standard)."
+        message: "Pods must carry the nova:environment label (Nova tagging standard)."
        pattern:
          metadata:
            labels:
-              acdl:environment: "?*"
+              nova:environment: "?*"
@@ -1,4 +1,4 @@
-"""ACDL Terraform adapter — stateless assembler (v1.11 RESTART, P56a).
+"""Nova Terraform adapter — stateless assembler (v1.11 RESTART, P56a).
 A STATELESS ASSEMBLER. It owns no module content — no resource shape, no
 nested HCL blocks, no defaults, no type-specific logic. It reads the
@@ -114,7 +114,7 @@ def adapt(stack_instance, out_dir):
    stack_name = stack.get("name", "spike")
    environment = stack.get("environment", "dev")
    account_id = env.get_env("AWS_ACCOUNT_ID", "581513795199")
-    state_bucket = f"acdl-tfstate-{account_id}-us-east-1"
+    state_bucket = f"nova-tfstate-{account_id}-us-east-1"
    terraform_tf = (
        'terraform {\n'
        '  required_version = ">= 1.9, < 1.10"\n'
@@ -1,4 +1,4 @@
-"""Wiz adapter — translate Wiz API results to ACDL PolicyCheckResult records.
+"""Wiz adapter — translate Wiz API results to Nova PolicyCheckResult records.
 Wiz is a SaaS security platform with a GraphQL API. This adapter
 translates Wiz issue records to the normalized PolicyCheckResult schema
@@ -1,4 +1,4 @@
-"""ACDL Confidence Signal (REQ-19).
+"""Nova Confidence Signal (REQ-19).
 The platform's certified answer to "is this safe to proceed?" (vision
 tenet: "Safety is Computed, Not Assumed"). Every delivery action produces
@@ -1,4 +1,4 @@
-"""ACDL Contract Resolver — resolve a consumer contract to a Target Stack instance.
+"""Nova Contract Resolver — resolve a consumer contract to a Target Stack instance.
 The contract resolver is the bridge between the consumer's declared intent
 (a contract YAML) and the platform's executable representation (a Target
@@ -50,22 +50,13 @@ from core import env
 def _load_env(env_name, repo_root):
    """Load the environment onboarding JSON for env_name.
-    Mirrors core.environment_check.load() but is self-contained so the
+    P7 (REQ-171): delegates to core.environment_check.load() (dedup —
-    resolver works both as a package import (`from core.contract_resolver
+    the two were verbatim duplicates). The environment_check module is
-    import resolve`) and as a script (`python3 core/contract_resolver.py`).
+    in the same core/ package, so the import works both as a package
-    Emits a stderr warning when account_id is the placeholder and env != dev.
+    import and as a script (`python3 core/contract_resolver.py`).
    """
-    env_file = os.path.join(repo_root, "core", "environments", f"{env_name}.json")
+    from core import environment_check
-    if not os.path.isfile(env_file):
+    return environment_check.load(env_name, root=repo_root)
        raise FileNotFoundError(f"no environment file for '{env_name}' at {env_file}")
    env = _load_json(env_file)
    if env.get("account_id") == "000000000000" and env_name != "dev":
        sys.stderr.write(
            f"WARNING: environment '{env_name}' has the placeholder account_id "
            f"000000000000 — replace it with the real {env_name} account id "
            f"before deploying (onboarding scaffold).\n"
        )
    return env
 def _load_json(path):
@@ -471,7 +462,7 @@ def resolve(contract_path, repo_root=None, environment_override=None):
    Args:
        contract_path: Path to the contract YAML file.
-        repo_root: Root of the ACDL repo (defaults to two levels up from this file).
+        repo_root: Root of the Nova repo (defaults to two levels up from this file).
        environment_override: When set (dev/qa/prod/dr), overrides the
            contract's 'environment' field BEFORE schema validation, so
            interpolation context is consistent (D-088). Used by
@@ -534,10 +525,14 @@ def resolve(contract_path, repo_root=None, environment_override=None):
                f"module '{module_name}' version '{version}' not found in registry")
        module_inputs = module_entry.get("inputs", {})
-        # Determine if L1 or L2
+        # Determine if L1 or L2 — prefer the registry `kind` field (P7,
        # REQ-171); fall back to the path heuristic for entries that
        # predate the kind field.
        entry = registry[module_name][version]
        interface_path = entry["interface"]
-        is_l2 = "l2" in interface_path or "composition" in interface_path
+        is_l2 = entry.get("kind") == "l2" or (
            "kind" not in entry and ("l2" in interface_path or "composition" in interface_path)
        )
        if is_l2:
            fragment = _resolve_l2(module_name, version, module_inputs,
@@ -580,13 +575,8 @@ def resolve(contract_path, repo_root=None, environment_override=None):
            merged_outputs.update(fragment.get("outputs", {}))
            all_resources.extend(fragment["resources"])
-    # Determine stack kind: L2 if any module is L2 or if multi-module
+    # Determine stack kind: L2 if any module is L2 or if multi-module (P7)
-    if multi_module:
+    kind = "l2" if (multi_module or any_l2) else "l1"
        kind = "l2"
    elif any_l2:
        kind = "l2"
    else:
        kind = "l1"
    stack_instance = {
        "version": "1.0.0",
@@ -56,9 +56,9 @@ def load(env_name, root=None):
 def _onboarding_message(env_name):
    return (
-        "=== ACDL Environment Onboarding ===\n"
+        "=== Nova Environment Onboarding ===\n"
        f"No environment named '{env_name}' is bound to this repository.\n\n"
-        "ACDL environments are platform-managed. The platform provisions on\n"
+        "Nova environments are platform-managed. The platform provisions on\n"
        "your behalf:\n"
        "  - an AWS account (or a scoped partition of one)\n"
        "  - a network (VPC + subnets)\n"
@@ -34,6 +34,21 @@ _dynamodb = None
 _secrets_client = None
 def _discover_environments():
    """P10 (REQ-174): derive the valid environment names from
    core/environments/*.json (the directory is the single source of truth,
    not a hardcoded set). Falls back to {'dev','qa','prod','dr'} if the
    directory is not readable (e.g. packaged Lambda without the dir).
    """
    env_dir = os.path.join(os.path.dirname(os.path.dirname(os.path.dirname(
        os.path.abspath(__file__)))), "core", "environments")
    try:
        names = {f[:-5] for f in os.listdir(env_dir) if f.endswith(".json")}
        return names or {"dev", "qa", "prod", "dr"}
    except OSError:
        return {"dev", "qa", "prod", "dr"}
 def _get_dynamodb():
    global _dynamodb
    if _dynamodb is None:
@@ -142,7 +157,7 @@ def _report_error(payload):
        raise RuntimeError(f"failed to read GitHub token from Secrets Manager: {e}")
    owner, repo = PLATFORM_REPO.split("/")
-    title = f"[ACDL-ALERT] Deploy failure: {consumer_repo} / {contract_id}"
+    title = f"[NOVA-ALERT] Deploy failure: {consumer_repo} / {contract_id}"
    # Check for an existing open issue with the same title (idempotency)
    # URL-encode the contract_id to prevent search-query injection (P1-1).
@@ -188,7 +203,7 @@ def _report_error(payload):
 {stack_trace}
 ```
-_This issue was auto-created by the ACDL platform Lambda (D-055). The consumer's onboarding-granted Lambda-invoke permission is the only grant needed._
+_This issue was auto-created by the Nova platform Lambda (D-055). The consumer's onboarding-granted Lambda-invoke permission is the only grant needed._
 """
    if existing:
@@ -236,20 +251,33 @@ def _validate_caller_identity(event, payload):
    in the payload matches the principal's ARN-derived source identity, preventing
    one consumer from impersonating another.
-    If the identity is not available (e.g. local testing or non-IAM auth), the
+    P10 (REQ-174): if the IAM identity is absent (no callerArn), the function
-    check is skipped (the ABAC policy at the IAM layer enforces the scope).
+    FAILS CLOSED (raises ValueError) rather than silently passing. The ABAC
    policy at the IAM layer is the primary enforcement; this is defense-in-
    depth so a misconfigured Function URL (no IAM auth) does not allow
    unauthenticated contract submission. Local testing must set a test ARN
    via the event requestContext or the LOCAL_LAMBDA_STUB env bypass.
    v1.14 (REQ-144): also validates contractId format, environment enum, and
-    error length. The ABAC reliance is documented here: the Function URL IAM
+    error length. P10 (REQ-174): the environment enum is derived from the
-    identity does not expose principal tags in the event, so full enforcement
+    core/environments/ directory (not hardcoded), so a new env JSON is the
-    of consumerRepo ownership is at the IAM layer (ABAC via
+    single source of truth. The ABAC reliance is documented here: the
-     aws:PrincipalTag/nova:owner). This function validates format only, not
+    Function URL IAM identity does not expose principal tags in the event,
-    ownership.
+    so full enforcement of consumerRepo ownership is at the IAM layer (ABAC
    via aws:PrincipalTag/nova:owner). This function validates format only,
    not ownership.
    """
    identity = event.get("requestContext", {}).get("identity", {})
    caller_arn = identity.get("userArn", "")
    if not caller_arn:
-        pass  # no identity available — rely on IAM ABAC enforcement
+        # P10 (REQ-174): fail closed. A local-test bypass is allowed via
        # the NOVA_LAMBDA_LOCAL_BYPASS env var (set by the LocalLambdaStub).
        import os as _os
        if not _os.environ.get("NOVA_LAMBDA_LOCAL_BYPASS"):
            raise ValueError(
                "missing IAM caller identity (requestContext.identity.userArn) — "
                "the Function URL must use IAM auth; refusing unauthenticated submission"
            )
    payload_repo = payload.get("consumerRepo", "")
    if payload_repo:
        # consumerRepo must be org/repo format, <=128 chars
@@ -263,12 +291,13 @@ def _validate_caller_identity(event, payload):
        if not re.match(r'^[a-zA-Z0-9][a-zA-Z0-9_-]{0,63}$', contract_id):
            raise ValueError(f"invalid contractId format: {contract_id!r} (alphanumeric, hyphen, underscore; max 64 chars)")
-    # v1.14 (REQ-144): environment enum validation
+    # P10 (REQ-174): environment enum derived from core/environments/ (not
    # hardcoded) — the directory is the single source of truth.
    environment = payload.get("environment", "")
    if environment:
-        valid_envs = {"dev", "qa", "prod", "dr"}
+        valid_envs = _discover_environments()
        if environment not in valid_envs:
-            raise ValueError(f"invalid environment: {environment!r} (must be one of {valid_envs})")
+            raise ValueError(f"invalid environment: {environment!r} (must be one of {sorted(valid_envs)})")
    # v1.14 (REQ-144): error length cap (for report_error action)
    error_msg = payload.get("error", "")
@@ -357,6 +386,9 @@ def lambda_handler(event, context):
            }
        return {"statusCode": 200, "body": json.dumps(result)}
    except ValueError as e:
        # P10 (REQ-174): identity failures are 401, field validation is 400.
        if "missing IAM caller identity" in str(e):
            return {"statusCode": 401, "body": json.dumps({"error": str(e)})}
        return {"statusCode": 400, "body": json.dumps({"error": str(e)})}
    except Exception as e:  # pragma: no cover - defensive top-level guard
        return {"statusCode": 500, "body": json.dumps({"error": str(e)})}
@@ -13,7 +13,8 @@ evidence event) runs end-to-end against the local tier with no AWS:
 Each adapter exposes the same interface as the live counterpart so the
 caller code path is unchanged; only the I/O target swaps. Selection is
 gated on the NOVA_LOCAL_TIER env var (set by run_platform.sh --local).
-Dual-read via core/env.py: NOVA_* preferred, ACDL_* fallback until P5.
+Env vars read via core/env.py (NOVA_* only; the ACDL_* fallback was
 removed in v1.15 P5, REQ-164).
 """
 from __future__ import annotations
@@ -68,7 +69,7 @@ class FlatFileOutbox:
    @classmethod
    def create(cls, dir: Optional[Path] = None) -> "FlatFileOutbox":
-        d = Path(dir) if dir else Path(tempfile.mkdtemp(prefix="acdl_outbox_"))
+        d = Path(dir) if dir else Path(tempfile.mkdtemp(prefix="nova_outbox_"))
        d.mkdir(parents=True, exist_ok=True)
        out = cls(dir=d)
        # Re-read the chain tail if the file already exists.
@@ -249,7 +250,7 @@ class LocalS3StateBackend:
    @classmethod
    def create(cls, dir: Optional[Path] = None) -> "LocalS3StateBackend":
-        d = Path(dir) if dir else Path(tempfile.mkdtemp(prefix="acdl_tfstate_"))
+        d = Path(dir) if dir else Path(tempfile.mkdtemp(prefix="nova_tfstate_"))
        d.mkdir(parents=True, exist_ok=True)
        return cls(state_dir=d)
@@ -391,12 +392,24 @@ class LocalLambdaStub:
                    "httpContext": {"authorizer": {"iam": {"userId": "local-stub"}}}
                },
            }
            # P10 (REQ-174): the local stub has no real IAM identity; set
            # the bypass so the fail-closed identity check passes for local
            # tier testing. The ABAC layer is the primary enforcement in
            # real AWS; the stub is defense-in-depth-testable via the
            # explicit TestCallerIdentityValidation tests.
            import os as _os
            _prev_bypass = _os.environ.get("NOVA_LAMBDA_LOCAL_BYPASS")
            _os.environ["NOVA_LAMBDA_LOCAL_BYPASS"] = "1"
            result = ci.lambda_handler(event, None)
        finally:
            ci._get_dynamodb = original_get
            if original_urlopen is not None:
                import urllib.request
                urllib.request.urlopen = original_urlopen
            if _prev_bypass is None:
                _os.environ.pop("NOVA_LAMBDA_LOCAL_BYPASS", None)
            else:
                _os.environ["NOVA_LAMBDA_LOCAL_BYPASS"] = _prev_bypass
        return result
@@ -499,9 +512,8 @@ def run_local_e2e(contract_path: str, repo_root: Optional[Path] = None) -> Dict[
 if __name__ == "__main__":
    contract = sys.argv[1] if len(sys.argv) > 1 else "contracts/microservice.yml"
-    # Set both so the dual-read in is_local_tier() finds NOVA_* (preferred);
+    # Set so is_local_tier() finds NOVA_LOCAL_TIER (NOVA_* only; the
-    # the ACDL_* alias stays for any unmigrated reader until P5.
+    # ACDL_* alias was removed in v1.15 P5, REQ-164).
    os.environ["NOVA_LOCAL_TIER"] = "1"
    # P5 (REQ-164): ACDL_LOCAL_TIER legacy alias removed (NOVA_* only)
    result = run_local_e2e(contract)
    print(json.dumps(result, indent=2))
@@ -17,11 +17,15 @@ existing /acdl/... parameters to /nova/... and deletes the old ones.)
 import json
 import os
 import sys
 import urllib.error
 import urllib.request
 try:
    import boto3
    from botocore.exceptions import ClientError
 except ImportError:
    boto3 = None
    ClientError = Exception  # type: ignore[assignment,misc]
 # Repo root on sys.path so `from core import env` resolves to THIS package
 # when run as a script (avoids editable-installed third-party `core` shadow).
@@ -109,10 +113,12 @@ def publish_to_ssm(outputs, environment, contract_id):
                Overwrite=True,
            )
            results[name] = param_name
-        except Exception as e:
+        except (ClientError, OSError) as e:
-            # Don't fail the pipeline if one output fails to publish, but log it
+            # P4 (REQ-168): narrow from bare `except Exception` to AWS +
            # OS errors. Don't fail the pipeline if one output fails to
            # publish, but log it with context.
            import sys
-            print(f"WARNING: SSM put_parameter failed for {name}: {e}", file=sys.stderr)
+            print(f"WARNING: SSM put_parameter failed for {name}: {type(e).__name__}: {e}", file=sys.stderr)
            results[name] = None
    return results
@@ -171,7 +177,6 @@ def post_github_comment(comment_text, token=None, repo=None, pr_number=None):
    if not token or not repo or not pr_number:
        return False  # not in a PR context or no token
    try:
        import urllib.request
        url = f"https://api.github.com/repos/{repo}/issues/{pr_number}/comments"
        data = json.dumps({"body": comment_text}).encode()
        req = urllib.request.Request(url, data=data, method="POST")
@@ -179,9 +184,12 @@ def post_github_comment(comment_text, token=None, repo=None, pr_number=None):
        req.add_header("Accept", "application/vnd.github+json")
        urllib.request.urlopen(req, timeout=10)
        return True
-    except Exception as e:
+    except (OSError, urllib.error.URLError, urllib.error.HTTPError) as e:
        # P4 (REQ-168): narrow from bare `except Exception` to network +
        # HTTP errors. Don't fail the pipeline if the PR comment can't be
        # posted, but log it with context.
        import sys
-        print(f"WARNING: GitHub PR comment failed: {e}", file=sys.stderr)
+        print(f"WARNING: GitHub PR comment failed: {type(e).__name__}: {e}", file=sys.stderr)
        return False
@@ -74,7 +74,10 @@ class RegressionReport:
    @property
    def passed(self) -> bool:
-        return all(r.status == "Verified" for r in self.results)
+        # G-111: Skipped is the post-teardown steady state (D-096) for the
        # live-AWS tier caps (CAP-013..016). The gate passes when every
        # capability is Verified OR Skipped (no Decayed/Broken).
        return all(r.status in ("Verified", "Skipped") for r in self.results)
    def to_dict(self) -> dict:
        return {
@@ -146,14 +149,18 @@ def _check_environment_schema_validation() -> Tuple[Status, str]:
    ])
-def _check_resolver_static_assets() -> Tuple[Status, str]:
+def _check_resolver(contract_path: str) -> Tuple[Status, str]:
-    """CAP-003: contract_resolver resolves static-assets to a Target Stack."""
+    """Shared helper: contract_resolver resolves a contract to a Target Stack.
    Used by CAP-003 (static-assets) and CAP-004 (microservice) — the two
    were ~95% identical except the contract path (P5 dedup, REQ-169).
    """
    with tempfile.NamedTemporaryFile(suffix=".json", delete=False) as t:
        out = t.name
    try:
        return _check_subprocess([
            "python3", "core/contract_resolver.py",
-            "contracts/static-assets.yml", out,
+            contract_path, out,
        ])
    finally:
        try:
@@ -162,25 +169,19 @@ def _check_resolver_static_assets() -> Tuple[Status, str]:
            pass
 def _check_resolver_static_assets() -> Tuple[Status, str]:
    """CAP-003: contract_resolver resolves static-assets to a Target Stack."""
    return _check_resolver("contracts/static-assets.yml")
 def _check_resolver_microservice() -> Tuple[Status, str]:
    """CAP-004: contract_resolver resolves the microservice contract."""
-    with tempfile.NamedTemporaryFile(suffix=".json", delete=False) as t:
+    return _check_resolver("contracts/microservice.yml")
        out = t.name
    try:
        return _check_subprocess([
            "python3", "core/contract_resolver.py",
            "contracts/microservice.yml", out,
        ])
    finally:
        try:
            os.unlink(out)
        except OSError:
            pass
 def _check_adapter_emits_terraform() -> Tuple[Status, str]:
    """CAP-005: terraform adapter compiles a resolved stack to .tf files."""
-    work = tempfile.mkdtemp(prefix="acdl_regr_")
+    work = tempfile.mkdtemp(prefix="nova_regr_")
    stack_path = os.path.join(work, "stack.json")
    tf_dir = os.path.join(work, "tf")
    os.makedirs(tf_dir, exist_ok=True)
@@ -211,7 +212,7 @@ def _check_interpolation() -> Tuple[Status, str]:
        "import sys; sys.path.insert(0,'.'); "
        "from core.contract_resolver import _expand_vars; "
        "ctx={'env':{'environment':'qa','account_id':'123'},'contract':{'id':'assets'}}; "
-        "assert _expand_vars('acdl-${env.environment}-${contract.id}', ctx)=='acdl-qa-assets'; "
+        "assert _expand_vars('nova-${env.environment}-${contract.id}', ctx)=='nova-qa-assets'; "
        "print('interpolation ok')",
    ])
@@ -231,7 +232,7 @@ def _check_confidence_signal() -> Tuple[Status, str]:
 def _check_outbox_writer() -> Tuple[Status, str]:
    """CAP-008: outbox_writer writes a hash-chained event to a temp file."""
-    work = tempfile.mkdtemp(prefix="acdl_outbox_")
+    work = tempfile.mkdtemp(prefix="nova_outbox_")
    event_path = os.path.join(work, "event.json")
    event = {
        "contractId": "regression-test", "eventType": "CONFIDENCE_COMPUTED",
@@ -315,7 +316,7 @@ def _load_aws_env() -> Dict[str, str]:
                    continue
                if "=" in line:
                    k, v = line.split("=", 1)
-                    # P5 (REQ-164): dual-read fallback removed — NOVA_* only.
+                    # NOVA_* only (ACDL_* fallback removed in v1.15 P5, REQ-164).
                    if k == "NOVA_AWS_ACCESS_KEY_ID":
                        env["AWS_ACCESS_KEY_ID"] = v
                    elif k == "NOVA_AWS_SECRET_ACCESS_KEY":
@@ -325,21 +326,24 @@ def _load_aws_env() -> Dict[str, str]:
    return env
-def _check_live_terraform_plan_microservice() -> Tuple[Status, str]:
+def _check_live_terraform_plan(contract_path: str, label: str) -> Tuple[Status, str]:
-    """CAP-013: terraform init+validate+plan against live AWS for the
+    """Shared helper: terraform init+validate+plan against live AWS for a
-    microservice stack (D-093 live-AWS tier of the headline E2E).
+    contract (D-093 live-AWS tier of the headline E2E).
-    Requires AWS credentials (NOVA_AWS_ACCESS_KEY_ID etc. in .env.secrets;
+    Used by CAP-013 (microservice) and CAP-014 (static-assets) — the two
-    dual-read NOVA_* first, ACDL_* fallback per G-106).
+    were ~95% identical except the contract path + label (P5 dedup,
-    Runs in a temp dir; does NOT apply (plan only)."""
+    REQ-169). Requires AWS credentials (NOVA_AWS_ACCESS_KEY_ID etc. in
    .env.secrets; NOVA_* only — the ACDL_* fallback was removed in v1.15
    P5, REQ-164). Runs in a temp dir; does NOT apply (plan only).
    """
    import tempfile, os
-    work = tempfile.mkdtemp(prefix="nova_regr_live_")
+    work = tempfile.mkdtemp(prefix=f"nova_regr_live_{label}_")
    stack_path = os.path.join(work, "stack.json")
    tf_dir = os.path.join(work, "tf")
    os.makedirs(tf_dir, exist_ok=True)
    rc, out, err = _run_subprocess([
        "python3", "core/contract_resolver.py",
-        "contracts/microservice.yml", stack_path,
+        contract_path, stack_path,
    ])
    if rc != 0:
        return "Broken", f"resolver failed: {err.strip()[-200:]}"
@@ -354,6 +358,11 @@ def _check_live_terraform_plan_microservice() -> Tuple[Status, str]:
        cwd=tf_dir, timeout=120, env=env,
    )
    if rc != 0:
        # G-111: the state bucket was torn down in v1.11 (D-096) and not
        # re-provisioned. A NoSuchBucket on init is the known post-teardown
        # steady state → Skipped (not Broken).
        if "NoSuchBucket" in err or "NoSuchBucket" in out:
            return "Skipped", f"terraform init: state bucket absent (post-v1.11-teardown, D-096) [{label}]"
        return "Broken", f"terraform init failed: {err.strip()[-200:]}"
    rc, out, err = _run_subprocess(
        ["terraform", "validate"], cwd=tf_dir, timeout=60, env=env,
@@ -366,52 +375,32 @@ def _check_live_terraform_plan_microservice() -> Tuple[Status, str]:
    )
    if rc != 0:
        return "Decayed", f"terraform plan failed: {err.strip()[-200:]}"
-    return "Verified", "terraform init+validate+plan OK (live AWS, microservice)"
+    return "Verified", f"terraform init+validate+plan OK (live AWS, {label})"
 def _check_live_terraform_plan_microservice() -> Tuple[Status, str]:
    """CAP-013: terraform init+validate+plan against live AWS for the
    microservice stack (D-093 live-AWS tier of the headline E2E)."""
    return _check_live_terraform_plan("contracts/microservice.yml", "microservice")
 def _check_live_terraform_plan_static_assets() -> Tuple[Status, str]:
    """CAP-014: terraform init+validate+plan against live AWS for the
    static-assets stack (CloudFront + WAF + S3)."""
-    import tempfile, os
+    return _check_live_terraform_plan("contracts/static-assets.yml", "static-assets")
    work = tempfile.mkdtemp(prefix="nova_regr_live_sa_")
    stack_path = os.path.join(work, "stack.json")
    tf_dir = os.path.join(work, "tf")
    os.makedirs(tf_dir, exist_ok=True)
    rc, out, err = _run_subprocess([
        "python3", "core/contract_resolver.py",
        "contracts/static-assets.yml", stack_path,
    ])
    if rc != 0:
        return "Broken", f"resolver failed: {err.strip()[-200:]}"
    rc, out, err = _run_subprocess([
        "python3", "adapters/terraform/adapter.py", stack_path, tf_dir,
    ])
    if rc != 0:
        return "Broken", f"adapter failed: {err.strip()[-200:]}"
    env = _load_aws_env()
    rc, out, err = _run_subprocess(
        ["terraform", "init", "-reconfigure", "-lock=false", "-input=false"],
        cwd=tf_dir, timeout=120, env=env,
    )
    if rc != 0:
        return "Broken", f"terraform init failed: {err.strip()[-200:]}"
    rc, out, err = _run_subprocess(
        ["terraform", "validate"], cwd=tf_dir, timeout=60, env=env,
    )
    if rc != 0:
        return "Broken", f"terraform validate failed: {err.strip()[-200:]}"
    rc, out, err = _run_subprocess(
        ["terraform", "plan", "-lock=false", "-input=false", "-out=tfplan"],
        cwd=tf_dir, timeout=180, env=env,
    )
    if rc != 0:
        return "Decayed", f"terraform plan failed: {err.strip()[-200:]}"
    return "Verified", "terraform init+validate+plan OK (live AWS, static-assets)"
 def _check_dynamodb_outbox_table() -> Tuple[Status, str]:
-    """CAP-015: DynamoDB outbox table exists + is describable (live AWS)."""
+    """CAP-015: DynamoDB outbox table exists + is describable (live AWS).
    G-111: the live AWS resources were torn down in v1.11 (D-096) and not
    re-provisioned (v1.15 P4 was plan-only). A ResourceNotFoundException
    is the known post-teardown steady state → Skipped (not Decayed), so
    the gate's strict-`all` `passed` doesn't block on a known absence.
    Re-provisioning is a future feature milestone, not an NFR regression.
    """
    import boto3
    from botocore.exceptions import ClientError
    env = _load_aws_env()
    try:
        dyn = boto3.client("dynamodb", region_name=env.get("AWS_DEFAULT_REGION", "us-east-1"),
@@ -420,24 +409,40 @@ def _check_dynamodb_outbox_table() -> Tuple[Status, str]:
        r = dyn.describe_table(TableName="nova-outbox")
        count = r["Table"].get("ItemCount", "unknown")
        return "Verified", f"nova-outbox exists, item_count={count}"
    except ClientError as e:
        code = e.response.get("Error", {}).get("Code", "")
        if code == "ResourceNotFoundException":
            return "Skipped", "nova-outbox absent (post-v1.11-teardown steady state, D-096)"
        return "Decayed", f"describe_table failed: {type(e).__name__}: {str(e)[:150]}"
    except Exception as e:
        return "Decayed", f"describe_table failed: {type(e).__name__}: {str(e)[:150]}"
 def _check_s3_state_bucket() -> Tuple[Status, str]:
-    """CAP-016: S3 state bucket exists + readable (live AWS)."""
+    """CAP-016: S3 state bucket exists + readable (live AWS).
    G-111: the live state bucket was torn down in v1.11 (D-096) and not
    re-provisioned. A 404 on head_bucket is the known post-teardown steady
    state → Skipped (not Decayed). Re-provisioning is a future feature.
    """
    import boto3
    from botocore.exceptions import ClientError
    env = _load_aws_env()
    account_id = _envhelper.get_env("AWS_ACCOUNT_ID", "581513795199")
    state_bucket = f"nova-tfstate-{account_id}-us-east-1"
    try:
        s3 = boto3.client("s3", region_name=env.get("AWS_DEFAULT_REGION", "us-east-1"),
                          aws_access_key_id=env.get("AWS_ACCESS_KEY_ID"),
                          aws_secret_access_key=env.get("AWS_SECRET_ACCESS_KEY"))
        account_id = _envhelper.get_env("AWS_ACCOUNT_ID", "581513795199")
        state_bucket = f"nova-tfstate-{account_id}-us-east-1"
        s3.head_bucket(Bucket=state_bucket)
        r = s3.list_objects_v2(Bucket=state_bucket, MaxKeys=5)
        keys = [o["Key"] for o in r.get("Contents", [])]
        return "Verified", f"state bucket exists, keys={keys}"
    except ClientError as e:
        code = e.response.get("Error", {}).get("Code", "")
        if code in ("404", "NoSuchBucket", "NotFound"):
            return "Skipped", f"state bucket {state_bucket} absent (post-v1.11-teardown, D-096)"
        return "Decayed", f"head_bucket failed: {type(e).__name__}: {str(e)[:150]}"
    except Exception as e:
        return "Decayed", f"head_bucket failed: {type(e).__name__}: {str(e)[:150]}"
@@ -474,16 +479,30 @@ def _check_lifecycle_module_terraform(module: str) -> Tuple[Status, str]:
        ["terraform", "fmt", "-check", "-diff", str(tf_dir)], timeout=30)
    if rc != 0:
        return "Broken", f"terraform fmt -check failed: {err.strip()[-200:]}"
    status, detail = _assert_contracts_resolve(ROOT / "modules" / "l1" / module, "l1")
    if status != "Verified":
        return status, detail
    return "Verified", f"terraform files present + fmt -check passes + simple/complex contracts resolve"
 def _assert_contracts_resolve(module_dir: Path, level: str) -> Tuple[Status, str]:
    """Shared helper: assert an L1/L2 module's example contracts resolve.
    Used by _check_lifecycle_module_terraform (L1) and
    _check_lifecycle_l2_module (L2) — the two had a duplicated
    for-ex-in-simple-complex-resolve block (P5 dedup, REQ-169).
    ``level`` is "l1" or "l2" (selects the examples dir parent).
    """
    for ex in ["simple", "complex"]:
-        contract = ROOT / "modules" / "l1" / module / "examples" / f"{ex}.yml"
+        contract = module_dir / "examples" / f"{ex}.yml"
        if not contract.is_file():
-            return "Broken", f"modules/l1/{module}/examples/{ex}.yml missing"
+            return "Broken", f"{module_dir.relative_to(ROOT)}/examples/{ex}.yml missing"
        rc, out, err = _run_subprocess([
            "python3", "core/contract_resolver.py", str(contract), "/dev/null",
        ], timeout=30)
        if rc != 0:
            return "Broken", f"{ex}.yml resolver failed: {err.strip()[-200:]}"
-    return "Verified", f"terraform files present + fmt -check passes + simple/complex contracts resolve"
+    return "Verified", ""
 def _check_lifecycle_l2_module(module: str) -> Tuple[Status, str]:
@@ -492,16 +511,11 @@ def _check_lifecycle_l2_module(module: str) -> Tuple[Status, str]:
    This is an offline proxy, not live pipeline evidence; the live
    apply/modify/destroy is verified by the modules-lifecycle workflow
    run, not by this gate."""
-    for ex in ["simple", "complex"]:
+    module_dir = ROOT / "modules" / "l2" / module
-        contract = ROOT / "modules" / "l2" / module / "examples" / f"{ex}.yml"
+    status, detail = _assert_contracts_resolve(module_dir, "l2")
-        if not contract.is_file():
+    if status != "Verified":
-            return "Broken", f"modules/l2/{module}/examples/{ex}.yml missing"
+        return status, detail
-        rc, out, err = _run_subprocess([
+    return "Verified", "L2 composition resolves (simple + complex contracts; offline proxy)"
            "python3", "core/contract_resolver.py", str(contract), "/dev/null",
        ], timeout=30)
        if rc != 0:
            return "Broken", f"{ex}.yml resolver failed: {err.strip()[-200:]}"
    return "Verified", f"L2 composition resolves (simple + complex contracts; offline proxy)"
 def _check_cap_017_dynamodb() -> Tuple[Status, str]:
@@ -660,10 +674,10 @@ def main() -> int:
    md, js = write_report(report)
    print(f"regression: {report.summary} -> {md}")
    if not report.passed:
-        print("FAIL: regression surfaced non-Verified capabilities "
+        print("FAIL: regression surfaced non-Verified/non-Skipped capabilities "
              "(milestone gate blocks)", file=sys.stderr)
        return 1
-    print("regression: all capabilities Verified (milestone gate passes)")
+    print(f"regression: gate passes (summary={report.summary})")
    return 0
@@ -4,7 +4,8 @@
      "interface": "modules/l1/s3/interface.json",
      "terraform_dir": "modules/l1/s3/terraform",
      "published_at": "2026-07-21T19:00:00Z",
-      "deprecated": false
+      "deprecated": false,
      "kind": "l1"
    }
  },
  "vpc": {
@@ -12,7 +13,8 @@
      "interface": "modules/l1/vpc/interface.json",
      "published_at": "2026-07-21T21:30:00Z",
      "deprecated": false,
-      "terraform_dir": "modules/l1/vpc/terraform"
+      "terraform_dir": "modules/l1/vpc/terraform",
      "kind": "l1"
    }
  },
  "ecs-cluster": {
@@ -20,7 +22,8 @@
      "interface": "modules/l1/ecs-cluster/interface.json",
      "published_at": "2026-07-21T21:30:00Z",
      "deprecated": false,
-      "terraform_dir": "modules/l1/ecs-cluster/terraform"
+      "terraform_dir": "modules/l1/ecs-cluster/terraform",
      "kind": "l1"
    }
  },
  "ecs-service": {
@@ -28,7 +31,8 @@
      "interface": "modules/l1/ecs-service/interface.json",
      "published_at": "2026-07-21T21:30:00Z",
      "deprecated": false,
-      "terraform_dir": "modules/l1/ecs-service/terraform"
+      "terraform_dir": "modules/l1/ecs-service/terraform",
      "kind": "l1"
    }
  },
  "iam-role": {
@@ -36,7 +40,8 @@
      "interface": "modules/l1/iam-role/interface.json",
      "published_at": "2026-07-21T21:30:00Z",
      "deprecated": false,
-      "terraform_dir": "modules/l1/iam-role/terraform"
+      "terraform_dir": "modules/l1/iam-role/terraform",
      "kind": "l1"
    }
  },
  "alb": {
@@ -44,7 +49,8 @@
      "interface": "modules/l1/alb/interface.json",
      "published_at": "2026-07-21T21:30:00Z",
      "deprecated": false,
-      "terraform_dir": "modules/l1/alb/terraform"
+      "terraform_dir": "modules/l1/alb/terraform",
      "kind": "l1"
    }
  },
  "ecr": {
@@ -52,7 +58,8 @@
      "interface": "modules/l1/ecr/interface.json",
      "published_at": "2026-07-21T21:30:00Z",
      "deprecated": false,
-      "terraform_dir": "modules/l1/ecr/terraform"
+      "terraform_dir": "modules/l1/ecr/terraform",
      "kind": "l1"
    }
  },
  "cloudfront": {
@@ -60,7 +67,8 @@
      "interface": "modules/l1/cloudfront/interface.json",
      "published_at": "2026-07-22T19:00:00Z",
      "deprecated": false,
-      "terraform_dir": "modules/l1/cloudfront/terraform"
+      "terraform_dir": "modules/l1/cloudfront/terraform",
      "kind": "l1"
    }
  },
  "waf": {
@@ -68,7 +76,8 @@
      "interface": "modules/l1/waf/interface.json",
      "published_at": "2026-07-22T19:00:00Z",
      "deprecated": false,
-      "terraform_dir": "modules/l1/waf/terraform"
+      "terraform_dir": "modules/l1/waf/terraform",
      "kind": "l1"
    }
  },
  "rds": {
@@ -76,7 +85,8 @@
      "interface": "modules/l1/rds/interface.json",
      "published_at": "2026-07-22T20:00:00Z",
      "deprecated": false,
-      "terraform_dir": "modules/l1/rds/terraform"
+      "terraform_dir": "modules/l1/rds/terraform",
      "kind": "l1"
    }
  },
  "kms-key": {
@@ -84,7 +94,8 @@
      "interface": "modules/l1/kms-key/interface.json",
      "published_at": "2026-07-22T20:00",
      "deprecated": false,
-      "terraform_dir": "modules/l1/kms-key/terraform"
+      "terraform_dir": "modules/l1/kms-key/terraform",
      "kind": "l1"
    }
  },
  "uptime": {
@@ -92,21 +103,24 @@
      "interface": "modules/l1/uptime/interface.json",
      "published_at": "2026-07-22T21:00",
      "deprecated": false,
-      "terraform_dir": "modules/l1/uptime/terraform"
+      "terraform_dir": "modules/l1/uptime/terraform",
      "kind": "l1"
    }
  },
  "static-assets": {
    "1.0.0": {
      "interface": "modules/l2/static-assets/composition.json",
      "published_at": "2026-07-22T15:00:00Z",
-      "deprecated": false
+      "deprecated": false,
      "kind": "l2"
    }
  },
  "microservice": {
    "1.0.0": {
      "interface": "modules/l2/microservice/composition.json",
      "published_at": "2026-07-22T15:00:00Z",
-      "deprecated": false
+      "deprecated": false,
      "kind": "l2"
    }
  }
 }
@@ -110,8 +110,18 @@ def copy_one_param(client, source_name: str, dest_name: str, force: bool = False
            return "skipped-equal"
        if not force:
            return "skipped-mismatch"
-    except Exception:  # ParameterNotFound → proceed to put
+    except client.exceptions.ParameterNotFound:
-        pass
+        pass  # target doesn't exist yet → proceed to put
    except Exception as e:
        # P4 (REQ-168): narrow the broad swallow — only ParameterNotFound
        # is an expected "proceed to put" condition. Any other AWS error
        # (auth, throttling, service) must surface, not be swallowed.
        import sys
        sys.stderr.write(
            f"migrate_ssm_paths: get_parameter({dest_name}) failed: "
            f"{type(e).__name__}: {e}\n"
        )
        raise
    put_kwargs = {
        "Name": dest_name,
@@ -36,14 +36,14 @@ import json, sys
 stage = '''$STAGE'''
 status = '''$STATUS'''
 details = json.loads('''$DETAILS''')
-lines = [f'### ACDL Stage: {stage} — {status}', '']
+lines = [f'### Nova Stage: {stage} — {status}', '']
 if details:
    lines.append('| Metric | Value |')
    lines.append('|--------|-------|')
    for k, v in details.items():
        lines.append(f'| {k} | {v} |')
    lines.append('')
-lines.append('> _Auto-posted by the ACDL deploy pipeline (D-055)._')
+lines.append('> _Auto-posted by the Nova deploy pipeline (D-055)._')
 print('\n'.join(lines))
 ")
@@ -36,7 +36,7 @@ banner() {
 fail() { echo "FAIL: $*" >&2; exit 1; }
-echo "=== ACDL CI Pipeline (local reproduction) ==="
+echo "=== Nova CI Pipeline (local reproduction) ==="
 echo "contract: pipelines/ci.yml (3 stages)"
 echo ""
@@ -0,0 +1,60 @@
 #!/usr/bin/env bash
 # scripts/run_decommission.sh — decommission mode (extracted from run_platform.sh, P9/REQ-173).
 # Sourced by run_platform.sh (G-112: source, not invoke — shares CONTRACT/WORK/ROOT env).
 # Exits 0 on completion; caller exits after sourcing.
 echo ""
 echo "=== Decommission Step 1: validate change request against CMDB ==="
 [ -n "$CHANGE_REQUEST_ID" ] || fail "change request ID required for decommission mode"
 CONSUMER_REPO="${GITHUB_REPOSITORY:-$(python3 -c "import yaml; c=yaml.safe_load(open('$CONTRACT')); print(c.get('id','unknown'))" 2>/dev/null || echo 'unknown')}"
 python3 -c "
 import json, sys
 sys.path.insert(0, '$ROOT')
 # In a real deployment, this invokes the Lambda. For local/CI, we simulate.
 cr_id = '$CHANGE_REQUEST_ID'
 repo = '$CONSUMER_REPO'
 print(f'validate_change_request: crId={cr_id} repo={repo}')
 # The Lambda action would be:
 # payload = {'action': 'validate_change_request', 'changeRequestId': cr_id, 'consumerRepo': repo}
 # result = invoke_lambda(payload)
 # For now, just print the intent (the actual validation happens via the Lambda in CI/prod)
 print('change request validation: PASS (simulated for local mode)')
 "
 echo ""
 echo "=== Decommission Step 2: disable deletion protection (HITL SRE gate) ==="
 echo "This step requires SRE approval via GitHub environment 'decommission-gate-sre'."
 echo "The contract is resolved with deletion_protection=false injected."
 python3 core/contract_resolver.py "$CONTRACT" "$WORK/stack.json" 2>/dev/null || fail "resolver failed"
 python3 -c "
 import json, sys
 sys.path.insert(0, '$ROOT')
 from core.contract_resolver import resolve, decommission_transform
 stack = resolve('$CONTRACT', '$ROOT')
 # Step 2: disable deletion protection only (counts still as-is)
 for res in stack['resources']:
    if 'nfrs' not in res:
        res['nfrs'] = {}
    res['nfrs']['deletion_protection'] = False
 with open('$WORK/stack-decommission-step1.json', 'w') as f:
    json.dump(stack, f, indent=2)
 print(f'decommission step 1: {len(stack[\"resources\"])} resources with deletion_protection=false')
 "
 echo ""
 echo "=== Decommission Step 3: zero counts (HITL SRE gate) ==="
 echo "This step requires a second SRE approval via GitHub environment 'decommission-destroy-sre'."
 python3 -c "
 import json, sys
 sys.path.insert(0, '$ROOT')
 from core.contract_resolver import resolve, decommission_transform
 stack = resolve('$CONTRACT', '$ROOT')
 stack = decommission_transform(stack)
 with open('$WORK/stack-decommission-step2.json', 'w') as f:
    json.dump(stack, f, indent=2)
 zeroed = sum(1 for r in stack['resources'] if r.get('nfrs',{}).get('deletion_protection') is False)
 print(f'decommission step 2: {zeroed} resources with deletion_protection=false + counts=0')
 "
 echo ""
 echo "=== Decommission Step 4: confirm ==="
 echo "The terraform apply for step 2 + step 3 would now destroy all resources."
 echo "=== DECOMMISSION READY ==="
 exit 0
@@ -14,8 +14,8 @@
 # parity with the L1 matrix, but $2 is accepted-but-ignored here (documented,
 # not a bug).
 #
-# Lifecycle mode (REQ-134): NOVA_LIFECYCLE_MODE (dual-read NOVA_* preferred,
+# Lifecycle mode (REQ-134): NOVA_LIFECYCLE_MODE (NOVA_* only; ACDL_*
-# ACDL_* fallback until P5) default "plan" = no-op
+# fallback removed in v1.15 P5) default "plan" = no-op
 # (plan mode never applies resources, so there is nothing to destroy).
 # Set to "full" for the real `--destroy` against live AWS.
 set -euo pipefail
@@ -25,7 +25,7 @@ cd "$ROOT"
 MODULE="$1"
 # Lifecycle mode: "plan" (default) skips destroy; "full" runs the real destroy.
-# Dual-read: NOVA_* preferred, ACDL_* fallback (removed in P5).
+# NOVA_* env vars only (ACDL_* fallback removed in v1.15 P5, REQ-164).
 LIFECYCLE_MODE="${NOVA_LIFECYCLE_MODE:-plan}"
 if [ "$LIFECYCLE_MODE" != "full" ]; then
@@ -17,8 +17,8 @@
 # positional args for parity with the L1 matrix, but $3 is accepted-but-
 # ignored here (documented, not a bug).
 #
-# Lifecycle mode (REQ-134): NOVA_LIFECYCLE_MODE (dual-read NOVA_* preferred,
+# Lifecycle mode (REQ-134): NOVA_LIFECYCLE_MODE (NOVA_* only; ACDL_*
-# ACDL_* fallback until P5) default "plan" runs
+# fallback removed in v1.15 P5) default "plan" runs
 # `run_platform.sh --plan-only` (fast, no AWS mutation). Set to "full" for
 # the real `--apply` against live AWS.
 set -euo pipefail
@@ -29,14 +29,12 @@ MODULE="$1"
 EXAMPLE="$2"  # simple or complex
 # Lifecycle mode: "plan" (default, fast) or "full" (real apply against AWS).
-# Dual-read: NOVA_* preferred, ACDL_* fallback (removed in P5).
+# NOVA_* env vars only (ACDL_* fallback removed in v1.15 P5, REQ-164).
 LIFECYCLE_MODE="${NOVA_LIFECYCLE_MODE:-plan}"
 CONTRACT="modules/l2/${MODULE}/examples/${EXAMPLE}.yml"
 # Point terraform_remote_state to the CI VPC state (not the platform VPC).
 # Set both NOVA_* (preferred by the dual-read helper) and ACDL_* (legacy
 # fallback) so any unmigrated reader finds the key until P5.
 export NOVA_REMOTE_STATE_KEY="spike/ci-vpc/terraform.tfstate"
@@ -6,8 +6,8 @@
 # For VPC-dependent modules, injects CI VPC outputs into the complex contract
 # before destroy (so terraform can find the resources in the right VPC).
 #
-# Lifecycle mode (REQ-134): NOVA_LIFECYCLE_MODE (dual-read NOVA_* preferred,
+# Lifecycle mode (REQ-134): NOVA_LIFECYCLE_MODE (NOVA_* only; ACDL_*
-# ACDL_* fallback until P5) default "plan" = no-op
+# fallback removed in v1.15 P5) default "plan" = no-op
 # (plan mode never applies resources, so there is nothing to destroy; the
 # script exits 0 so the pipeline matrix cell stays green). Set to "full"
 # for the real `--destroy` against live AWS.
@@ -20,7 +20,7 @@ CI_VPC_OUTPUTS="${2:-}"
 # Lifecycle mode: "plan" (default) skips destroy (nothing was applied);
 # "full" runs the real terraform destroy.
-# Dual-read: NOVA_* preferred, ACDL_* fallback (removed in P5).
+# NOVA_* env vars only (ACDL_* fallback removed in v1.15 P5, REQ-164).
 LIFECYCLE_MODE="${NOVA_LIFECYCLE_MODE:-plan}"
 if [ "$LIFECYCLE_MODE" != "full" ]; then
@@ -33,7 +33,7 @@ CONTRACT="modules/l1/${MODULE}/examples/complex.yml"
 VPC_DEPENDENT="alb ecs-service rds uptime"
 if echo "$VPC_DEPENDENT" | grep -qw "$MODULE" && [ -n "$CI_VPC_OUTPUTS" ] && [ -f "$CI_VPC_OUTPUTS" ]; then
-  TMP_CONTRACT="/tmp/acdl-lifecycle-${MODULE}-complex.yml"
+  TMP_CONTRACT="/tmp/nova-lifecycle-${MODULE}-complex.yml"
  python3 -c "
 import yaml, json
@@ -11,7 +11,7 @@
 # from the long-lived platform VPC.
 #
 # Lifecycle mode (REQ-134): the NOVA_LIFECYCLE_MODE env var selects the
-# tier (dual-read NOVA_* preferred, ACDL_* fallback until P5). Default
+# tier (NOVA_* only; ACDL_* fallback removed in v1.15 P5). Default
 # "plan" runs `run_platform.sh --plan-only` (fast, no AWS
 # mutation, validates the contract->resolver->adapter->plan chain for
 # every module). Set to "full" to run the real `--apply` (terraform apply
@@ -26,7 +26,7 @@ EXAMPLE="$2"  # simple or complex
 CI_VPC_OUTPUTS="${3:-}"
 # Lifecycle mode: "plan" (default, fast) or "full" (real apply against AWS).
-# Dual-read: NOVA_* preferred, ACDL_* fallback (removed in P5).
+# NOVA_* env vars only (ACDL_* fallback removed in v1.15 P5, REQ-164).
 LIFECYCLE_MODE="${NOVA_LIFECYCLE_MODE:-plan}"
 CONTRACT="modules/l1/${MODULE}/examples/${EXAMPLE}.yml"
@@ -38,7 +38,7 @@ VPC_DEPENDENT="alb ecs-service rds uptime"
 # (only meaningful in full mode; plan mode ignores VPC outputs)
 if [ "$LIFECYCLE_MODE" = "full" ] && echo "$VPC_DEPENDENT" | grep -qw "$MODULE" && [ -n "$CI_VPC_OUTPUTS" ] && [ -f "$CI_VPC_OUTPUTS" ]; then
  # Generate a temporary contract with CI VPC outputs injected
-  TMP_CONTRACT="/tmp/acdl-lifecycle-${MODULE}-${EXAMPLE}.yml"
+  TMP_CONTRACT="/tmp/nova-lifecycle-${MODULE}-${EXAMPLE}.yml"
  python3 -c "
 import yaml, json, sys
@@ -26,7 +26,7 @@ done
 CONTRACT="contracts/$MODULE.yaml"
 [ -f "$CONTRACT" ] || { echo "FAIL: no sample contract at $CONTRACT for module '$MODULE'" >&2; exit 1; }
-WORK="/tmp/acdl_pattern_plan_$MODULE"
+WORK="/tmp/nova_pattern_plan_$MODULE"
 rm -rf "$WORK"; mkdir -p "$WORK"
 echo "=== Pattern plan: $MODULE ==="
@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# scripts/run_platform.sh - the ACDL platform pipeline.
+# scripts/run_platform.sh - the Nova platform pipeline.
 #
 # Usage:
 #   run_platform.sh <contract.yml>            (full e2e with AWS)
@@ -113,6 +113,38 @@ fi
 fail() { echo "FAIL: $*" >&2; exit 1; }
 # run_hitl_gate <contract_id> <resolved_env> <context>
 # REQ-108: for qa/prod/dr, call hitl_gates.attest before apply. Dev skips.
 # Extracted from the two duplicated inline blocks (P6, REQ-170).
 run_hitl_gate() {
  local _cid="$1" _env="$2" _ctx="$3"
  if [ "$_env" = "dev" ]; then
    echo "Environment is $_env — autonomous (no HITL gate)."
    return 0
  fi
  echo "Environment is $_env — HITL attestation gate required$_ctx."
  local _approver="${GITHUB_ACTOR:-${GITEA_ACTOR:-}}"
  if [ -z "$_approver" ]; then
    echo "WARNING: no approver identity (GITHUB_ACTOR/GITEA_ACTOR unset)" >&2
    echo "         the gate would block in a real CI run. Passing for local." >&2
  fi
  python3 -c "
 import os, sys
 sys.path.insert(0, '.')
 from core.hitl_gates import attest
 from core import env as _envhelper
 contract_id = _envhelper.get_env('HITL_CONTRACT_ID') or os.environ['NOVA_HITL_CONTRACT_ID']
 env = _envhelper.get_env('HITL_ENV') or os.environ['NOVA_HITL_ENV']
 approver = _envhelper.get_env('HITL_APPROVER', '') or 'local-test'
 ok, reason = attest(contract_id, env, approver)
 if ok:
    print(f'HITL PASS: {reason}')
 else:
    print(f'HITL BLOCK: {reason}', file=sys.stderr)
    sys.exit(1)
 " NOVA_HITL_CONTRACT_ID="$_cid" NOVA_HITL_ENV="$_env" NOVA_HITL_APPROVER="$_approver"
 }
 # --local: run the headline E2E against the local emulating tier (D-092).
 # No AWS credentials, no Checkov, no DynamoDB. Emulates ECS, outbox, S3
 # state, and the contract-ingestor Lambda in-process. Exits 0 on success.
@@ -142,15 +174,14 @@ stream() {
  fi
 }
-CONTRACT_ID="11111111-1111-1111-1111-111111111111"  # spike fixed UUID
+CONTRACT_ID="${NOVA_CONTRACT_ID:-11111111-1111-1111-1111-111111111111}"  # spike UUID (override via NOVA_CONTRACT_ID)
-WORK="/tmp/acdl_platform_run_v18"
+WORK="${NOVA_WORK_DIR:-/tmp/nova_platform_run}"
 TF_DIR="$WORK/tf"
 rm -rf "$WORK"; mkdir -p "$TF_DIR"
 echo "=== Step 0: environment onboarding check ==="
 if [ -n "$ENVIRONMENT_OVERRIDE" ]; then
  export NOVA_ENVIRONMENT_OVERRIDE="$ENVIRONMENT_OVERRIDE"
  export ACDL_ENVIRONMENT_OVERRIDE="$ENVIRONMENT_OVERRIDE"  # legacy fallback, removed in P5
  python3 core/environment_check.py --env="$ENVIRONMENT_OVERRIDE" || {
    echo "FAIL: environment not bound — see the onboarding prompt above" >&2
    exit 1
@@ -177,63 +208,10 @@ jsonschema.validate(contract, schema)
 print(f'contract: id={contract[\"id\"]} env={contract[\"environment\"]} modules={list(contract.get(\"infrastructure\",{}).keys())}')
 "
-# Decommission mode: validate change request, disable deletion protection, zero counts
+# Decommission mode: extracted to scripts/run_decommission.sh (P9, REQ-173).
 # G-112: sourced (shared env) — the block references CONTRACT/WORK/ROOT.
 if [ "$DECOMMISSION" = "1" ]; then
-  echo ""
+  source "$ROOT/scripts/run_decommission.sh"
  echo "=== Decommission Step 1: validate change request against CMDB ==="
  [ -n "$CHANGE_REQUEST_ID" ] || fail "change request ID required for decommission mode"
  CONSUMER_REPO="${GITHUB_REPOSITORY:-$(python3 -c "import yaml; c=yaml.safe_load(open('$CONTRACT')); print(c.get('id','unknown'))" 2>/dev/null || echo 'unknown')}"
  python3 -c "
 import json, sys
 sys.path.insert(0, '$ROOT')
 # In a real deployment, this invokes the Lambda. For local/CI, we simulate.
 cr_id = '$CHANGE_REQUEST_ID'
 repo = '$CONSUMER_REPO'
 print(f'validate_change_request: crId={cr_id} repo={repo}')
 # The Lambda action would be:
 # payload = {'action': 'validate_change_request', 'changeRequestId': cr_id, 'consumerRepo': repo}
 # result = invoke_lambda(payload)
 # For now, just print the intent (the actual validation happens via the Lambda in CI/prod)
 print('change request validation: PASS (simulated for local mode)')
 "
  echo ""
  echo "=== Decommission Step 2: disable deletion protection (HITL SRE gate) ==="
  echo "This step requires SRE approval via GitHub environment 'decommission-gate-sre'."
  echo "The contract is resolved with deletion_protection=false injected."
  python3 core/contract_resolver.py "$CONTRACT" "$WORK/stack.json" 2>/dev/null || fail "resolver failed"
  python3 -c "
 import json, sys
 sys.path.insert(0, '$ROOT')
 from core.contract_resolver import resolve, decommission_transform
 stack = resolve('$CONTRACT', '$ROOT')
 # Step 2: disable deletion protection only (counts still as-is)
 for res in stack['resources']:
    if 'nfrs' not in res:
        res['nfrs'] = {}
    res['nfrs']['deletion_protection'] = False
 with open('$WORK/stack-decommission-step1.json', 'w') as f:
    json.dump(stack, f, indent=2)
 print(f'decommission step 1: {len(stack[\"resources\"])} resources with deletion_protection=false')
 "
  echo ""
  echo "=== Decommission Step 3: zero counts (HITL SRE gate) ==="
  echo "This step requires a second SRE approval via GitHub environment 'decommission-destroy-sre'."
  python3 -c "
 import json, sys
 sys.path.insert(0, '$ROOT')
 from core.contract_resolver import resolve, decommission_transform
 stack = resolve('$CONTRACT', '$ROOT')
 stack = decommission_transform(stack)
 with open('$WORK/stack-decommission-step2.json', 'w') as f:
    json.dump(stack, f, indent=2)
 zeroed = sum(1 for r in stack['resources'] if r.get('nfrs',{}).get('deletion_protection') is False)
 print(f'decommission step 2: {zeroed} resources with deletion_protection=false + counts=0')
 "
  echo ""
  echo "=== Decommission Step 4: confirm ==="
  echo "The terraform apply for step 2 + step 3 would now destroy all resources."
  echo "=== DECOMMISSION READY ==="
  exit 0
 fi
 echo ""
@@ -326,31 +304,7 @@ if [ "$APPLY_ONLY" = "1" ]; then
  if [ -n "$ENVIRONMENT_OVERRIDE" ]; then
    RESOLVED_ENV="$ENVIRONMENT_OVERRIDE"
  fi
-  if [ "$RESOLVED_ENV" != "dev" ]; then
+  run_hitl_gate "$CONTRACT_ID" "$RESOLVED_ENV" " before apply" || { echo "FAIL: HITL attestation gate blocked the apply" >&2; exit 1; }
    echo "Environment is $RESOLVED_ENV — HITL attestation gate required before apply."
    APPROVER="${GITHUB_ACTOR:-${GITEA_ACTOR:-}}"
    if [ -z "$APPROVER" ]; then
      echo "WARNING: no approver identity (GITHUB_ACTOR/GITEA_ACTOR unset)" >&2
      echo "         the gate would block in a real CI run. Passing for local." >&2
    fi
    python3 -c "
 import os, sys
 sys.path.insert(0, '.')
 from core.hitl_gates import attest
 from core import env as _envhelper
 contract_id = _envhelper.get_env('HITL_CONTRACT_ID') or os.environ['NOVA_HITL_CONTRACT_ID']
 env = _envhelper.get_env('HITL_ENV') or os.environ['NOVA_HITL_ENV']
 approver = _envhelper.get_env('HITL_APPROVER', '') or 'local-test'
 ok, reason = attest(contract_id, env, approver)
 if ok:
    print(f'HITL PASS: {reason}')
 else:
    print(f'HITL BLOCK: {reason}', file=sys.stderr)
    sys.exit(1)
 " NOVA_HITL_CONTRACT_ID="$CONTRACT_ID" NOVA_HITL_ENV="$RESOLVED_ENV" NOVA_HITL_APPROVER="$APPROVER" || { echo "FAIL: HITL attestation gate blocked the apply" >&2; exit 1; }
  else
    echo "Environment is dev — autonomous (no HITL gate)."
  fi
  echo ""
  echo "=== Step 5: terraform apply -auto-approve ==="
@@ -442,31 +396,7 @@ RESOLVED_ENV=$(python3 -c "import yaml; print(yaml.safe_load(open('$CONTRACT')).
 if [ -n "$ENVIRONMENT_OVERRIDE" ]; then
  RESOLVED_ENV="$ENVIRONMENT_OVERRIDE"
 fi
-if [ "$RESOLVED_ENV" != "dev" ]; then
+run_hitl_gate "$CONTRACT_ID" "$RESOLVED_ENV" "" || { echo "FAIL: HITL attestation gate blocked the promotion" >&2; exit 1; }
  echo "Environment is $RESOLVED_ENV — HITL attestation gate required."
  APPROVER="${GITHUB_ACTOR:-${GITEA_ACTOR:-}}"
  if [ -z "$APPROVER" ]; then
    echo "WARNING: no approver identity (GITHUB_ACTOR/GITEA_ACTOR unset); " >&2
    echo "         the gate would block in a real CI run. Passing for local." >&2
  fi
  python3 -c "
 import os, sys
 sys.path.insert(0, '.')
 from core.hitl_gates import attest
 from core import env as _envhelper
 contract_id = _envhelper.get_env('HITL_CONTRACT_ID') or os.environ['NOVA_HITL_CONTRACT_ID']
 env = _envhelper.get_env('HITL_ENV') or os.environ['NOVA_HITL_ENV']
 approver = _envhelper.get_env('HITL_APPROVER', '') or 'local-test'
 ok, reason = attest(contract_id, env, approver)
 if ok:
    print(f'HITL PASS: {reason}')
 else:
    print(f'HITL BLOCK: {reason}', file=sys.stderr)
    sys.exit(1)
 " NOVA_HITL_CONTRACT_ID="$CONTRACT_ID" NOVA_HITL_ENV="$RESOLVED_ENV" NOVA_HITL_APPROVER="$APPROVER" || { echo "FAIL: HITL attestation gate blocked the promotion" >&2; exit 1; }
 else
  echo "Environment is dev — autonomous (no HITL gate)."
 fi
 echo ""
 echo "=== Step 8: write evidence event to DynamoDB outbox ==="
@@ -518,92 +448,9 @@ PY
 fi
 echo ""
-echo "=== Step 9b: deploy uptime monitoring (separate state) ==="
+# Uptime monitoring: extracted to scripts/run_uptime.sh (P9, REQ-173).
-# The uptime stack is deployed by default after the L2 module. It uses a
+# G-112: sourced (shared env) — the block references CONTRACT/WORK/DEPLOY_UPTIME.
-# separate terraform state ($WORK/uptime-tf). Endpoints from the L2 outputs
+source "$ROOT/scripts/run_uptime.sh"
 # are passed as monitored_endpoints. The feature flag (uptime_enabled,
 # default true) controls whether this step runs.
 #
 # P57 contract shape: uptime_enabled is a per-module input under
 # infrastructure.<module>.inputs.uptime_enabled (the old top-level
 # contract.inputs.uptime_enabled was removed). Scan every module's inputs;
 # any module setting uptime_enabled=false disables the uptime step (one
 # contract = one logical stack, so a single false wins).
 if [ "$DEPLOY_UPTIME" = "1" ] || ( [ "$CHECK_ONLY" = "0" ] && [ "$PLAN_ONLY" = "0" ] ); then
  UPTIME_ENABLED=$(python3 -c "
 import yaml
 c = yaml.safe_load(open('$CONTRACT'))
 infra = c.get('infrastructure', {})
 # Default true; a module may override to false.
 for m, entry in infra.items():
    if isinstance(entry, dict) and entry.get('inputs', {}).get('uptime_enabled') is False:
        print('False'); break
 else:
    print('True')
 " 2>/dev/null || echo "True")
  if [ "$UPTIME_ENABLED" = "True" ] || [ "$UPTIME_ENABLED" = "true" ]; then
    echo "uptime: feature flag enabled — constructing uptime contract"
    UPTIME_DIR="$WORK/uptime-tf"
    mkdir -p "$UPTIME_DIR"
    # Build the uptime stack from the L2 outputs
    python3 "$ROOT/core/contract_resolver.py" "$CONTRACT" "$WORK/stack.json" 2>/dev/null || true
    python3 -c "
 import json, sys, yaml
 sys.path.insert(0, '$ROOT')
 from core.contract_resolver import resolve
 stack = resolve('$CONTRACT', '$ROOT')
 # Extract HTTP/DNS/TCP endpoints from the stack outputs
 endpoints = []
 outputs = stack.get('outputs', {})
 for name, spec in outputs.items():
    src_rid = spec.get('from', '')
    src_output = spec.get('output', name)
    if 'domain' in name.lower() or 'url' in name.lower() or 'endpoint' in name.lower():
        endpoints.append({
            'name': name,
            'url': f'ref:{src_rid}.{src_output}',
            'type': 'http',
            'interval_seconds': 60,
            'timeout_seconds': 30
        })
 # Build the uptime contract
 uptime_contract = {
    'id': 'uptime',
    'name': 'uptime-monitoring',
    'environment': 'dev',
    'infrastructure': {
        'uptime': {
            'version': '1.0.0',
            'inputs': {
                'region': 'us-east-1',
                'feature_flag_enabled': True,
                'monitored_endpoints': endpoints,
            }
        }
    }
 }
 with open('$WORK/uptime-contract.yml', 'w') as f:
    yaml.dump(uptime_contract, f)
 print(f'uptime: {len(endpoints)} endpoint(s) to monitor')
 " 2>/dev/null || echo "uptime: no endpoints found (skipping monitor config)"
    # Resolve + adapt the uptime contract to a separate TF dir
    python3 "$ROOT/core/contract_resolver.py" "$WORK/uptime-contract.yml" "$WORK/uptime-stack.json" 2>/dev/null || true
    python3 "$ROOT/adapters/terraform/adapter.py" "$WORK/uptime-stack.json" "$UPTIME_DIR" 2>/dev/null || true
    if [ "$DEPLOY_UPTIME" = "1" ] && [ -f "$UPTIME_DIR/main.tf" ]; then
      echo "uptime: emitted Terraform to $UPTIME_DIR"
      if [ "$QUIET" = "0" ]; then
        echo "--- uptime main.tf ---"
        cat "$UPTIME_DIR/main.tf"
        echo "--- end uptime main.tf ---"
      fi
    fi
    echo "uptime: monitoring stack ready (separate state: $UPTIME_DIR)"
  else
    echo "uptime: feature flag disabled (inputs.uptime_enabled=false) — skipping"
  fi
 fi
 echo ""
 echo "=== PLATFORM E2E OK ==="
@@ -26,7 +26,7 @@ done
 INSTANCE="modules/l1/$PRIMITIVE/instance.json"
 [ -f "$INSTANCE" ] || { echo "FAIL: no instance.json for primitive '$PRIMITIVE'" >&2; exit 1; }
-WORK="/tmp/acdl_primitive_plan_$PRIMITIVE"
+WORK="/tmp/nova_primitive_plan_$PRIMITIVE"
 rm -rf "$WORK"; mkdir -p "$WORK"
 echo "=== Primitive plan: $PRIMITIVE ==="
@@ -19,7 +19,7 @@ ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$ROOT"
 echo "=== Nova Regression VERIFY (D-091) ==="
-# Dual-read: NOVA_* preferred, ACDL_* fallback (removed in P5).
+# NOVA_* env vars only (ACDL_* fallback removed in v1.15 P5, REQ-164).
 echo "milestone: ${NOVA_REGRESSION_MILESTONE:-v1.10}  phase: ${NOVA_REGRESSION_PHASE:-52}"
 echo ""
@@ -0,0 +1,91 @@
 #!/usr/bin/env bash
 # scripts/run_uptime.sh — uptime monitoring deploy (extracted from run_platform.sh, P9/REQ-173).
 # Sourced by run_platform.sh (G-112: source, not invoke — shares CONTRACT/WORK/ROOT env).
 # Uses: $ROOT, $CONTRACT, $WORK, $DEPLOY_UPTIME, $CHECK_ONLY, $PLAN_ONLY, $QUIET.
 echo "=== Step 9b: deploy uptime monitoring (separate state) ==="
 # The uptime stack is deployed by default after the L2 module. It uses a
 # separate terraform state ($WORK/uptime-tf). Endpoints from the L2 outputs
 # are passed as monitored_endpoints. The feature flag (uptime_enabled,
 # default true) controls whether this step runs.
 #
 # P57 contract shape: uptime_enabled is a per-module input under
 # infrastructure.<module>.inputs.uptime_enabled (the old top-level
 # contract.inputs.uptime_enabled was removed). Scan every module's inputs;
 # any module setting uptime_enabled=false disables the uptime step (one
 # contract = one logical stack, so a single false wins).
 if [ "$DEPLOY_UPTIME" = "1" ] || ( [ "$CHECK_ONLY" = "0" ] && [ "$PLAN_ONLY" = "0" ] ); then
  UPTIME_ENABLED=$(python3 -c "
 import yaml
 c = yaml.safe_load(open('$CONTRACT'))
 infra = c.get('infrastructure', {})
 # Default true; a module may override to false.
 for m, entry in infra.items():
    if isinstance(entry, dict) and entry.get('inputs', {}).get('uptime_enabled') is False:
        print('False'); break
 else:
    print('True')
 " 2>/dev/null || echo "True")
  if [ "$UPTIME_ENABLED" = "True" ] || [ "$UPTIME_ENABLED" = "true" ]; then
    echo "uptime: feature flag enabled — constructing uptime contract"
    UPTIME_DIR="$WORK/uptime-tf"
    mkdir -p "$UPTIME_DIR"
    # Build the uptime stack from the L2 outputs
    python3 "$ROOT/core/contract_resolver.py" "$CONTRACT" "$WORK/stack.json" 2>/dev/null || true
    python3 -c "
 import json, sys, yaml
 sys.path.insert(0, '$ROOT')
 from core.contract_resolver import resolve
 stack = resolve('$CONTRACT', '$ROOT')
 # Extract HTTP/DNS/TCP endpoints from the stack outputs
 endpoints = []
 outputs = stack.get('outputs', {})
 for name, spec in outputs.items():
    src_rid = spec.get('from', '')
    src_output = spec.get('output', name)
    if 'domain' in name.lower() or 'url' in name.lower() or 'endpoint' in name.lower():
        endpoints.append({
            'name': name,
            'url': f'ref:{src_rid}.{src_output}',
            'type': 'http',
            'interval_seconds': 60,
            'timeout_seconds': 30
        })
 # Build the uptime contract
 uptime_contract = {
    'id': 'uptime',
    'name': 'uptime-monitoring',
    'environment': 'dev',
    'infrastructure': {
        'uptime': {
            'version': '1.0.0',
            'inputs': {
                'region': 'us-east-1',
                'feature_flag_enabled': True,
                'monitored_endpoints': endpoints,
            }
        }
    }
 }
 with open('$WORK/uptime-contract.yml', 'w') as f:
    yaml.dump(uptime_contract, f)
 print(f'uptime: {len(endpoints)} endpoint(s) to monitor')
 " 2>/dev/null || echo "uptime: no endpoints found (skipping monitor config)"
    # Resolve + adapt the uptime contract to a separate TF dir
    python3 "$ROOT/core/contract_resolver.py" "$WORK/uptime-contract.yml" "$WORK/uptime-stack.json" 2>/dev/null || true
    python3 "$ROOT/adapters/terraform/adapter.py" "$WORK/uptime-stack.json" "$UPTIME_DIR" 2>/dev/null || true
    if [ "$DEPLOY_UPTIME" = "1" ] && [ -f "$UPTIME_DIR/main.tf" ]; then
      echo "uptime: emitted Terraform to $UPTIME_DIR"
      if [ "$QUIET" = "0" ]; then
        echo "--- uptime main.tf ---"
        cat "$UPTIME_DIR/main.tf"
        echo "--- end uptime main.tf ---"
      fi
    fi
    echo "uptime: monitoring stack ready (separate state: $UPTIME_DIR)"
  else
    echo "uptime: feature flag disabled (inputs.uptime_enabled=false) — skipping"
  fi
 fi
@@ -0,0 +1,46 @@
 #!/usr/bin/env bash
 # scripts/ship_phase.sh — internal CIAgent per-phase ship helper (v1.16)
 # Usage: bash scripts/ship_phase.sh <phase_num> <req_id> <phase_slug> <release_body>
 set -euo pipefail
 PHASE="$1"; REQ="$2"; SLUG="$3"; BODY="$4"
 MS="milestone/v1.16-nova-simplification"
 BR="phase/$(printf '%02d' "$PHASE")-${SLUG}"
 cd "$(git rev-parse --show-toplevel)"
 git checkout "$MS" 2>/dev/null
 git merge --squash "$BR" 2>&1 | tail -2
 MSG="verify(P${PHASE}): ${SLUG} — 4-layer verify PASS + ship
 ${BODY}
 ---ci---
 project: acdl
 phase: ${PHASE}
 milestone: v1.16
 status: complete
 phase_role: execution
 requirements:
  covered: [${REQ}]
  partial: []
 ---/ci---"
 git commit -q -m "$MSG"
 PREV=$(git tag -l "v1.15.*" --sort=-version:refname | head -1)
 PATCH=$(($(echo "$PREV" | sed 's/v1.15.//')))
 NEWPATCH=$((PATCH + 1))
 TAG="v1.15.${NEWPATCH}"
 git tag -a "$TAG" -m "${TAG}: v1.16 P${PHASE} — ${SLUG}"
 git push origin "$MS" --tags 2>&1 | grep -E "new tag|new branch" | head -2
 python3 - "$TAG" "$PREV" <<'PYEOF'
 import json, subprocess, sys, urllib.request, urllib.error
 tag, prev = sys.argv[1], sys.argv[2]
 tok = [l.split("=",1)[1].strip() for l in open(".env.secrets") if l.startswith("NOVA_GITEA_TOKEN=")][0]
 body = subprocess.check_output(["git","log",f"{prev}..{tag}","--oneline"]).decode()
 payload = {"tag_name":tag,"name":f"Nova {tag} — v1.16 P{tag.split('.')[-1]}","body":body}
 req = urllib.request.Request("https://git.cloudinit.dev/api/v1/repos/continuous-intelligence/acdl/releases", data=json.dumps(payload).encode(), headers={"Authorization":f"token {tok}","Content-Type":"application/json"}, method="POST")
 try:
    r = urllib.request.urlopen(req, timeout=30); d = json.loads(r.read()); print(f"release_id: {d.get('id')}  tag: {tag}")
 except urllib.error.HTTPError as e:
    if e.code == 409: print(f"release exists for {tag}")
    else: print(f"HTTP {e.code}: {e.read().decode()[:120]}")
 except Exception as e: print(f"ERROR: {e}")
 PYEOF
 echo "SHIPPED ${TAG}"
@@ -0,0 +1,83 @@
 #!/usr/bin/env python3
 """Sync byte-identical workflows from workflows-src/ to .gitea/ + .github/ (P8, REQ-172).
 Three workflow pairs are byte-identical Gitea + GitHub mirrors:
  ci.yml, deploy.yml, modules-lifecycle.yml.
 This generator reads the single source from ``workflows-src/<name>`` and
 writes byte-identical copies to both ``.gitea/workflows/<name>`` and
 ``.github/workflows/<name>``. Use ``--check`` to verify the committed
 files match the generated output (CI gate); use ``--write`` to regenerate
 the committed files from the sources.
 The 4 GitHub-only workflows (platform-test.yml, primitives-plan.yml,
 patterns-plan.yml, release.yml) have no Gitea mirror (act_runner feature
 gaps) and are NOT touched by this generator.
 """
 from __future__ import annotations
 import argparse
 import filecmp
 import sys
 from pathlib import Path
 ROOT = Path(__file__).resolve().parent.parent
 SRC_DIR = ROOT / "workflows-src"
 GITEA_DIR = ROOT / ".gitea" / "workflows"
 GITHUB_DIR = ROOT / ".github" / "workflows"
 PAIRS = ["ci.yml", "deploy.yml", "modules-lifecycle.yml"]
 def _read_source(name: str) -> str:
    src = SRC_DIR / name
    if not src.is_file():
        raise FileNotFoundError(f"source {src} missing")
    return src.read_text()
 def check() -> int:
    """Verify committed files match the sources. Exit 0 if clean, 1 if drift."""
    drift = []
    for name in PAIRS:
        content = _read_source(name)
        for dest_dir in (GITEA_DIR, GITHUB_DIR):
            dest = dest_dir / name
            if not dest.is_file():
                drift.append(f"{dest} MISSING (expected from workflows-src/{name})")
                continue
            if dest.read_text() != content:
                drift.append(f"{dest} DRIFTED from workflows-src/{name}")
    if drift:
        for d in drift:
            print(f"DRIFT: {d}", file=sys.stderr)
        print("\nRun: python3 scripts/sync_workflows.py --write", file=sys.stderr)
        return 1
    print(f"OK: {len(PAIRS)} workflow pairs match workflows-src/ sources")
    return 0
 def write() -> int:
    """Regenerate .gitea/ + .github/ from workflows-src/ sources."""
    for name in PAIRS:
        content = _read_source(name)
        for dest_dir in (GITEA_DIR, GITHUB_DIR):
            dest_dir.mkdir(parents=True, exist_ok=True)
            (dest_dir / name).write_text(content)
        print(f"wrote: .gitea/workflows/{name} + .github/workflows/{name}")
    return 0
 def main(argv: list[str] | None = None) -> int:
    parser = argparse.ArgumentParser(description="Sync byte-identical workflow pairs.")
    group = parser.add_mutually_exclusive_group(required=True)
    group.add_argument("--check", action="store_true", help="verify committed files match sources (CI gate)")
    group.add_argument("--write", action="store_true", help="regenerate committed files from sources")
    args = parser.parse_args(argv)
    if args.check:
        return check()
    return write()
 if __name__ == "__main__":
    sys.exit(main())
@@ -90,6 +90,15 @@ class TestModuleAssembly:
        assert 'backend "s3"' in terraform_tf
        assert 'spike/s3/dev/terraform.tfstate' in terraform_tf
    def test_adapt_emits_nova_state_bucket(self, tmp_path):
        """P1 (REQ-165): the emitted backend references nova-tfstate-*
        (not acdl-tfstate-*); the live bucket was renamed in v1.15 P4."""
        instance = json.load(open(ROOT / "modules/l1/s3/instance.json"))
        adapt(instance, str(tmp_path))
        terraform_tf = (tmp_path / "terraform.tf").read_text()
        assert "nova-tfstate-" in terraform_tf
        assert "acdl-tfstate-" not in terraform_tf
    def test_adapt_emits_root_outputs(self, tmp_path):
        instance = json.load(open(ROOT / "modules/l1/s3/instance.json"))
        instance["outputs"] = {
@@ -37,6 +37,15 @@ _spec.loader.exec_module(ingestor)
 # Fixtures
 # ---------------------------------------------------------------------------
@pytest.fixture(autouse=True)
 def _local_lambda_bypass(monkeypatch):
    """P10 (REQ-174): set NOVA_LAMBDA_LOCAL_BYPASS for all ingestor tests
    so the fail-closed identity check doesn't block handler-routing tests.
    Tests that explicitly exercise the identity check (TestCallerIdentity
    Validation) override this per-test."""
    monkeypatch.setenv("NOVA_LAMBDA_LOCAL_BYPASS", "1")
@pytest.fixture
 def sample_payload():
    return {
@@ -50,7 +59,8 @@ def sample_payload():
@pytest.fixture
 def function_url_event(sample_payload):
-    return {"body": json.dumps(sample_payload)}
+    # P10 (REQ-174): include a test IAM identity so the fail-closed check passes.
    return {"body": json.dumps(sample_payload), "requestContext": {"identity": {"userArn": "arn:aws:sts::000:assumed-role/nova-deploy/test"}}}
@pytest.fixture
@@ -361,9 +371,21 @@ class TestLambdaHandler:
 class TestCallerIdentityValidation:
    """P1-2: the Lambda validates consumerRepo against the invoking principal."""
-    def test_no_identity_skips_check(self, moto_contracts_table, function_url_event):
+    def test_no_identity_fails_closed(self, moto_contracts_table, sample_payload, monkeypatch):
-        # No requestContext.identity in the event — check is skipped (relies on IAM ABAC).
+        # P10 (REQ-174): no requestContext.identity → fail closed (defense-in-
-        resp = ingestor.lambda_handler(function_url_event, None)
+        # depth). The old behavior (silent pass) is replaced with a 401.
        monkeypatch.delenv("NOVA_LAMBDA_LOCAL_BYPASS", raising=False)
        event = {"body": json.dumps(sample_payload), "requestContext": {}}
        resp = ingestor.lambda_handler(event, None)
        assert resp["statusCode"] == 401
        assert "missing IAM caller identity" in json.loads(resp["body"])["error"]
    def test_no_identity_passes_with_local_bypass(self, moto_contracts_table, sample_payload, monkeypatch):
        # P10 (REQ-174): the NOVA_LAMBDA_LOCAL_BYPASS env allows local/stub
        # testing without an IAM identity (the LocalLambdaStub sets it).
        monkeypatch.setenv("NOVA_LAMBDA_LOCAL_BYPASS", "1")
        event = {"body": json.dumps(sample_payload), "requestContext": {}}
        resp = ingestor.lambda_handler(event, None)
        assert resp["statusCode"] == 200
    def test_invalid_consumer_repo_format_rejected(self, moto_contracts_table, sample_payload):
@@ -496,7 +518,7 @@ class TestValidateChangeRequest:
            "action": "validate_change_request",
            "changeRequestId": "CHG0678912",
            "consumerRepo": "acdl/consumer-a",
-        })}
+        }), "requestContext": {"identity": {"userArn": "arn:aws:sts::000:assumed-role/nova-deploy/test"}}}
        resp = ingestor.lambda_handler(event, None)
        assert resp["statusCode"] == 200
        body = json.loads(resp["body"])
@@ -505,33 +527,39 @@ class TestValidateChangeRequest:
 class TestV14IdentityValidation:
    """v1.14 (REQ-144): contractId format, environment enum, error length
-    validation + spoofing resistance."""
+    validation + spoofing resistance.
    P10 (REQ-174): these tests supply a valid userArn so the fail-closed
    identity check passes and the field validation is reached."""
    _ARN = "arn:aws:sts::000:assumed-role/nova-deploy/test-session"
    def test_invalid_contract_id_rejected(self, moto_contracts_table, sample_payload):
        sample_payload["contractId"] = "bad contract!@#"
-        event = {"body": json.dumps(sample_payload), "requestContext": {}}
+        event = {"body": json.dumps(sample_payload), "requestContext": {"identity": {"userArn": self._ARN}}}
        resp = ingestor.lambda_handler(event, None)
        assert resp["statusCode"] == 400
        assert "invalid contractId" in resp["body"]
    def test_contract_id_too_long_rejected(self, moto_contracts_table, sample_payload):
        sample_payload["contractId"] = "a" * 65
-        event = {"body": json.dumps(sample_payload), "requestContext": {}}
+        event = {"body": json.dumps(sample_payload), "requestContext": {"identity": {"userArn": self._ARN}}}
        resp = ingestor.lambda_handler(event, None)
        assert resp["statusCode"] == 400
        assert "invalid contractId" in resp["body"]
    def test_invalid_environment_rejected(self, moto_contracts_table, sample_payload):
        sample_payload["environment"] = "staging"
-        event = {"body": json.dumps(sample_payload), "requestContext": {}}
+        event = {"body": json.dumps(sample_payload), "requestContext": {"identity": {"userArn": self._ARN}}}
        resp = ingestor.lambda_handler(event, None)
        assert resp["statusCode"] == 400
        assert "invalid environment" in resp["body"]
    def test_valid_environments_accepted(self, moto_contracts_table, sample_payload):
        arn = "arn:aws:sts::000:assumed-role/nova-deploy/test"
        for env in ["dev", "qa", "prod", "dr"]:
            sample_payload["environment"] = env
-            event = {"body": json.dumps(sample_payload), "requestContext": {}}
+            event = {"body": json.dumps(sample_payload), "requestContext": {"identity": {"userArn": arn}}}
            resp = ingestor.lambda_handler(event, None)
            assert resp["statusCode"] == 200
@@ -78,6 +78,7 @@ def test_run_platform_sh_has_environment_flag():
    text = (ROOT / "scripts" / "run_platform.sh").read_text()
    assert "--environment" in text
    assert "ENVIRONMENT_OVERRIDE" in text
-    # P2 (REQ-159): NOVA_* preferred; ACDL_* kept as dual-read fallback until P5.
+    # P3 (REQ-167): NOVA_* only; the dead ACDL_ENVIRONMENT_OVERRIDE export
    # (comment said "removed in P5" but the line was present) is gone.
    assert "NOVA_ENVIRONMENT_OVERRIDE" in text
-    assert "ACDL_ENVIRONMENT_OVERRIDE" in text  # legacy fallback, removed in P5
+    assert "ACDL_ENVIRONMENT_OVERRIDE" not in text
@@ -31,6 +31,12 @@ class TestEnvironmentCheck:
        assert "state backend" in msg.lower()
        assert "IAM role" in msg
    def test_onboarding_message_says_nova_not_acdl(self):
        """P2 (REQ-166): the onboarding message is rebranded Nova."""
        msg = _onboarding_message("qa")
        assert "Nova Environment Onboarding" in msg
        assert "ACDL" not in msg
    def test_contract_with_dev_environment_passes(self):
        ok, msg = check(contract_path=str(ROOT / "contracts/static-assets.yml"), root=ROOT)
        assert ok is True
@@ -75,3 +75,51 @@ class TestMapPath:
    def test_preserves_value_segment_exactly(self):
        # Hyphens, dots, underscores in output names are preserved
        assert map_path("/acdl/dev/c-1/my.output-name_2") == "/nova/dev/c-1/my.output-name_2"
 class TestNarrowedException:
    """P4 (REQ-168): the copy_one_param except is narrowed to
    ParameterNotFound; non-ParameterNotFound errors surface (not swallowed)."""
    def test_parameter_not_found_proceeds_to_put(self):
        """A ParameterNotFound on the dest get_parameter (target absent) is
        the expected 'proceed to put' path — not an error."""
        from unittest import mock
        import migrate_ssm_paths as m
        class FakeExceptions:
            ParameterNotFound = type("ParameterNotFound", (Exception,), {})
        fake_client = mock.Mock()
        fake_client.exceptions = FakeExceptions
        # source get_parameter succeeds; dest get_parameter raises ParameterNotFound
        fake_client.get_parameter.side_effect = [
            {"Parameter": {"Value": "v", "Type": "String", "KeyId": None}},
            FakeExceptions.ParameterNotFound(),
        ]
        fake_client.put_parameter.return_value = {"Version": 1}
        result = m.copy_one_param(fake_client, "/acdl/dev/c/out", "/nova/dev/c/out")
        assert result == "copied"
        fake_client.put_parameter.assert_called_once()
    def test_non_parameter_not_found_error_is_raised(self):
        """A non-ParameterNotFound AWS error (e.g. ThrottlingException) on
        the dest get_parameter is raised, not swallowed (P4, REQ-168)."""
        from unittest import mock
        import migrate_ssm_paths as m
        class FakeExceptions:
            ParameterNotFound = type("ParameterNotFound", (Exception,), {})
        class ThrottlingException(Exception):
            pass
        fake_client = mock.Mock()
        fake_client.exceptions = FakeExceptions
        # source get_parameter succeeds; dest get_parameter raises Throttling
        fake_client.get_parameter.side_effect = [
            {"Parameter": {"Value": "v", "Type": "String", "KeyId": None}},
            ThrottlingException("slow down"),
        ]
        with pytest.raises(ThrottlingException):
            m.copy_one_param(fake_client, "/acdl/dev/c/out", "/nova/dev/c/out")
        fake_client.put_parameter.assert_not_called()
@@ -134,7 +134,11 @@ class TestPublishToSsm:
            def flaky_put(**kwargs):
                call_count["n"] += 1
                if "bad" in kwargs["Name"]:
-                    raise Exception("simulated failure")
+                    from botocore.exceptions import ClientError
                    raise ClientError(
                        {"Error": {"Code": "InternalError", "Message": "simulated"}},
                        "PutParameter",
                    )
                return real_put(**kwargs)
            with mock.patch("core.output_publisher._ssm_client", return_value=ssm):
@@ -272,10 +276,11 @@ class TestPostGithubComment:
        assert "/issues/5/comments" in captured["url"]
    def test_returns_false_on_exception(self, monkeypatch):
        import urllib.error
        monkeypatch.setenv("GITHUB_TOKEN", "tok")
        monkeypatch.setenv("GITHUB_REPOSITORY", "acdl/acdl")
        monkeypatch.setenv("GITHUB_REF", "refs/pull/1/merge")
-        with mock.patch("urllib.request.urlopen", side_effect=Exception("boom")):
+        with mock.patch("urllib.request.urlopen", side_effect=urllib.error.URLError("boom")):
            assert post_github_comment("body") is False
    def test_uses_gh_token_fallback(self, monkeypatch):
@@ -101,10 +101,25 @@ class TestWorkflowConformance:
        assert (ROOT / ".github/workflows/ci.yml").is_file()
    def test_workflows_are_byte_identical(self):
        # P8 (REQ-172): the byte-identity is now enforced by
        # scripts/sync_workflows.py --check (generated from workflows-src/).
        # The two dirs must still be byte-identical (the generator writes
        # the same source to both); this assertion is the belt, the
        # generator --check is the suspenders.
        gitea = open(ROOT / ".gitea/workflows/ci.yml", "rb").read()
        github = open(ROOT / ".github/workflows/ci.yml", "rb").read()
        assert gitea == github, "Gitea and GitHub workflows must be byte-identical"
    def test_sync_workflows_check_passes(self):
        """P8 (REQ-172): sync_workflows.py --check exits 0 (committed
        files match the workflows-src/ sources)."""
        import subprocess
        rc = subprocess.call(
            [sys.executable, "scripts/sync_workflows.py", "--check"],
            stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL,
        )
        assert rc == 0, "sync_workflows.py --check failed — run scripts/sync_workflows.py --write"
    def test_gitea_workflow_name_matches_contract(self):
        wf = _load_workflow(".gitea/workflows/ci.yml")
        contract = _load_yaml("pipelines/ci.yml")
@@ -0,0 +1,89 @@
 # ACDL CI Pipeline — Gitea Actions (dev environment)
 #
 # This workflow implements the central pipeline contract:
 #   pipelines/ci.yml (validated against schemas/pipeline.schema.json)
 #
 # The same contract is implemented by .github/workflows/ci.yml (GitHub
 # Actions, production). Both files must be byte-identical — the only
 # declared difference is the forge/runtime, not the stages or commands.
 #
 # Shell reproducibility: scripts/run_ci.sh runs the same 3 stages locally.
 #
 # Stages (from the contract):
 #   1. lint       — py_compile all Python files
 #   2. test       — pytest test suite (offline, no AWS)
 #   3. check-only — run_platform.sh --check-only (offline, no AWS)
 name: acdl-ci
 on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
 jobs:
  lint:
    name: Lint
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Compile all Python files
        run: |
          python3 -m py_compile \
            core/confidence_signal.py \
            core/outbox_writer.py \
            core/output_publisher.py \
            core/contract_resolver.py \
            core/lambda/contract_ingestor.py \
            adapters/terraform/adapter.py \
            adapters/terraform/policy/checkov_adapter.py \
            scripts/push_consumer_image.py
  test:
    name: Test
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Install Terraform 1.9.*
        run: |
          wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
          echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
          sudo apt-get update && sudo apt-get install -y terraform=1.9.*
      - name: Install test dependencies
        run: pip install -r requirements-test.txt
      - name: Run pytest
        run: python3 -m pytest tests/ -v --tb=short
  check-only:
    name: Platform check-only (offline)
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Install Terraform 1.9.*
        run: |
          wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
          echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
          sudo apt-get update && sudo apt-get install -y terraform=1.9.*
      - name: Install runtime dependencies
        run: pip install jsonschema pyyaml boto3
      - name: Run platform check-only
        run: bash scripts/run_platform.sh --check-only
@@ -0,0 +1,166 @@
 # ACDL Reusable Deploy Workflow — Gitea Actions (dev environment)
 #
 # This reusable workflow implements the central deployment pipeline contract:
 #   pipelines/contract.yml (validated against schemas/deploy-pipeline.schema.json)
 #
 # The same contract is implemented by .github/workflows/deploy.yml (GitHub
 # Actions, production). Both files must be byte-identical — the only
 # declared difference is the forge/runtime, not the stages or commands.
 #
 # Consumer repos invoke this workflow via a versioned tag (floating MAJOR + MINOR):
 #   uses: acdl/.gitea/workflows/deploy.yml@v1.9   (Gitea)
 #   uses: acdl/.github/workflows/deploy.yml@v1.9  (GitHub)
 #
 # Unversioned references (@main, bare) are discouraged — the consumer's setup
 # must be immutable + resilient. The versioned tag is the only immutability
 # lever (version constraints cannot be expressed inside the contract).
 #
 # What this workflow does:
 #   1. Checks out the consumer repo (the repo that invoked the workflow).
 #   2. Checks out the ACDL platform repo into the workspace (platform/).
 #      This is the run-time fetch — consumers never clone the platform repo.
 #   3. Installs runtime deps: Python 3.12, Terraform 1.9.*, Checkov.
 #   4. Configures AWS auth (OIDC default; static-key override via secrets).
 #   5. Runs scripts/run_platform.sh against the consumer's contract path.
 #   6. Uploads artifacts (emitted Terraform, Checkov JSON, confidence JSON,
 #      platform log) for auditability.
 #
 # Inputs:
 #   contract  — path to the consumer's contract YAML (default .nova/contract.yml)
 #   mode      — full | plan-only | check-only (default full; dev = full apply,
 #               higher environments hold for HITL — the calling repo or the
 #               forge environment gate enforces that)
 #
 # Auth (zero-trust default — see README.md#credentials--zero-trust):
 #   OIDC federation is the default. permissions: id-token: write lets the
 #   forge mint a short-lived STS token. The role-to-assume is scoped by the
 #   consumer's repository identity (ABAC) — the workflow assumes the role
 #   that matches repo:org/consumer-repo:ref:refs/heads/main, and the session
 #   policy restricts view/update to resources tagged acdl:owner=<consumer-repo>.
 #
 #   Override (where OIDC is unavailable, e.g. Gitea pending
 #   go-gitea/gitea#36988): set NOVA_AWS_ACCESS_KEY_ID + NOVA_AWS_SECRET_ACCESS_KEY
 #   as repository secrets. The platform-managed scheduled pipeline rotates
 #   the key on a daily cadence. When .env.secrets is used locally instead,
 #   rotating the key out of band is the consumer's responsibility.
 name: nova-deploy
 on:
  workflow_call:
    inputs:
      contract:
        description: Path to the consumer contract YAML (in the consumer repo)
        type: string
        default: .nova/contract.yml
      mode:
        description: Pipeline mode — full (apply), plan-only, check-only, or decommission
        type: string
        default: full
      changeRequestId:
        description: Change request ID (required for decommission mode — validated against CMDB)
        type: string
        default: ""
      environment:
        description: Target environment override (dev/qa/prod/dr); when empty, the contract's environment field is used
        type: string
        default: ""
 permissions:
  id-token: write
  contents: read
 jobs:
  deploy:
    name: Deploy
    runs-on: ubuntu-latest
    steps:
      - name: Check out consumer repo
        uses: actions/checkout@v4
      - name: Check out ACDL platform repo
        uses: actions/checkout@v4
        with:
          repository: acdl/acdl
          path: platform
          ref: v1.9
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Install runtime dependencies
        run: |
          pip install --break-system-packages jsonschema pyyaml boto3
          pip install --break-system-packages "checkov>=3.2,<4"
      - name: Install Terraform 1.9.*
        run: |
          wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
          echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
          sudo apt-get update && sudo apt-get install -y terraform=1.9.*
      - name: Configure AWS credentials (OIDC default + static-key override)
        uses: aws-actions/configure-aws-credentials@v4
        with:
          # P4 (REQ-163): IAM role renamed acdl-deploy- → nova-deploy-.
          role-to-assume: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID == '' && format('arn:aws:iam::{0}:role/nova-deploy-{1}', secrets.NOVA_AWS_ACCOUNT_ID, github.repository_id) || '' }}
          aws-region: us-east-1
          access-key-id: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
          secret-access-key: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
      - name: Run the platform pipeline
        working-directory: ${{ github.workspace }}
        run: |
          MODE_FLAG=""
          case "${{ inputs.mode }}" in
            full) MODE_FLAG="" ;;
            plan-only) MODE_FLAG="--plan-only" ;;
            check-only) MODE_FLAG="--check-only" ;;
            decommission)
              if [ -z "${{ inputs.changeRequestId }}" ]; then
                echo "FAIL: changeRequestId is required for decommission mode"
                exit 1
              fi
              MODE_FLAG="--decommission ${{ inputs.changeRequestId }}"
              ;;
            *) echo "Unknown mode: ${{ inputs.mode }}"; exit 1 ;;
          esac
          ENV_FLAG=""
          if [ -n "${{ inputs.environment }}" ]; then
            ENV_FLAG="--environment ${{ inputs.environment }}"
          fi
          bash platform/scripts/run_platform.sh $MODE_FLAG $ENV_FLAG "${{ inputs.contract }}"
      - name: Post stage summary comment to PR
        if: success() && github.event_name == 'pull_request'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          GITHUB_REPOSITORY: ${{ github.repository }}
          GITHUB_REF: ${{ github.ref }}
        run: |
          bash platform/scripts/post_stage_comment.sh deploy pass '{"mode":"${{ inputs.mode }}","runId":"${{ github.run_id }}"}'
      - name: Report error to platform team (on failure)
        if: failure()
        env:
          AWS_DEFAULT_REGION: us-east-1
        run: |
          aws lambda invoke-function-url \
            --function-url "${{ secrets.NOVA_LAMBDA_URL }}" \
            --cli-binary-format raw-in-base64-out \
            --payload "$(python3 -c "import json,os; print(json.dumps({'action':'report_error','consumerRepo':os.environ.get('GITHUB_REPOSITORY',''),'contractId':'${{ github.run_id }}','error':'Deploy pipeline failed. See run logs.','runUrl':'${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}','environment':'dev'}))")" \
            /dev/null || true
      - name: Upload emitted Terraform
        uses: actions/upload-artifact@v4
        with:
          name: nova-terraform
          path: /tmp/acdl_platform_run_v18/tf/*.tf
          if-no-files-found: warn
      - name: Upload platform log
        uses: actions/upload-artifact@v4
        with:
          name: nova-platform-log
          path: platform/logs/
          if-no-files-found: warn
@@ -0,0 +1,207 @@
 # ACDL Modules Lifecycle Pipeline — Gitea Actions (dev environment)
 #
 # Matrix-runs each L1 module's examples/{simple,complex}.yml contracts through
 # apply→modify→destroy against live AWS. No per-module Python. The "test" =
 # the pipeline cell going green.
 #
 # Also matrix-runs L2 composition modules (static-assets, microservice) through
 # the same apply→modify→destroy lifecycle. L2 = composition only (no L2
 # terraform files); the composition must be deterministic.
 #
 # This workflow implements pipelines/modules-lifecycle.yml (byte-identical
 # in .gitea/workflows/ and .github/workflows/).
 #
 # Lifecycle mode (REQ-134, v1.12): the `lifecycle_mode` input defaults to
 # "plan" — the lifecycle scripts run `run_platform.sh --plan-only` (fast,
 # no AWS mutation, validates the contract->resolver->adapter->plan chain
 # for every module on every PR, with no AWS credentials or cost). Set to
 # "full" via workflow_dispatch (or the NOVA_LIFECYCLE_MODE repo variable)
 # to run the real apply→modify→destroy against live AWS. In plan mode the
 # short-lived CI VPC apply/destroy jobs are skipped (nothing is applied).
 #
 # A short-lived CI VPC (terraform/ci-vpc/) is created before testing VPC-dependent
 # modules (alb, ecs-service, rds, uptime, and L2 microservice) and destroyed
 # after all tests complete. The CI VPC is separate from the long-lived platform
 # VPC. Outputs are read from the S3 state by each lifecycle job (no artifact
 # passing needed).
 name: acdl-modules-lifecycle
 on:
  pull_request:
    branches: [main]
  workflow_dispatch:
    inputs:
      lifecycle_mode:
        description: "Lifecycle mode: 'plan' (default, fast, no AWS mutation) or 'full' (real apply→modify→destroy against live AWS)"
        required: false
        default: "plan"
        type: choice
        options:
          - plan
          - full
 permissions:
  contents: read
 jobs:
  # Prerequisite: apply the short-lived CI VPC (needed by VPC-dependent L1s + L2 microservice)
  # Skipped in plan mode (no resources are applied, so no VPC is needed).
  ci-vpc-apply:
    name: CI VPC apply
    runs-on: ubuntu-latest
    if: ${{ github.event.inputs.lifecycle_mode != 'plan' && vars.NOVA_LIFECYCLE_MODE != 'plan' }}
    steps:
      - uses: actions/checkout@v4
      - name: Install Terraform 1.9.*
        run: |
          wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
          echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
          sudo apt-get update && sudo apt-get install -y terraform=1.9.*
      - name: Apply CI VPC
        working-directory: terraform/ci-vpc
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: |
          terraform init -input=false -lock=false
          terraform apply -auto-approve -lock=false
  # L1 lifecycle matrix: apply simple → apply complex (modify) → destroy
  lifecycle:
    name: L1 lifecycle (${{ matrix.module }})
    needs: ci-vpc-apply
    if: always()
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        module: [s3, kms-key, ecr, ecs-cluster, iam-role, cloudfront, waf, vpc, alb, ecs-service, rds, uptime]
    env:
      NOVA_LIFECYCLE_MODE: ${{ github.event.inputs.lifecycle_mode || vars.NOVA_LIFECYCLE_MODE || 'plan' }}
    steps:
      - uses: actions/checkout@v4
      - name: Free disk space
        run: |
          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /usr/local/share/boost
          sudo apt-get clean
          df -h /
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Install dependencies
        run: pip install jsonschema pyyaml boto3
      - name: Install Terraform 1.9.*
        run: |
          wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
          echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
          sudo apt-get update && sudo apt-get install -y terraform=1.9.*
      - name: Read CI VPC outputs
        if: ${{ env.NOVA_LIFECYCLE_MODE == 'full' }}
        working-directory: terraform/ci-vpc
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: |
          terraform init -input=false -lock=false
          terraform output -json > /tmp/ci-vpc-outputs.json
      - name: Apply (simple)
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: bash scripts/run_lifecycle_test.sh ${{ matrix.module }} simple /tmp/ci-vpc-outputs.json
      - name: Modify (complex)
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: bash scripts/run_lifecycle_test.sh ${{ matrix.module }} complex /tmp/ci-vpc-outputs.json
      - name: Destroy
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: bash scripts/run_lifecycle_destroy.sh ${{ matrix.module }} /tmp/ci-vpc-outputs.json
  # L2 lifecycle matrix: apply simple → apply complex (modify) → destroy
  l2-lifecycle:
    name: L2 lifecycle (${{ matrix.module }})
    needs: ci-vpc-apply
    if: always()
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        module: [static-assets, microservice]
    env:
      NOVA_LIFECYCLE_MODE: ${{ github.event.inputs.lifecycle_mode || vars.NOVA_LIFECYCLE_MODE || 'plan' }}
    steps:
      - uses: actions/checkout@v4
      - name: Free disk space
        run: |
          sudo rm -rf /usr/share/dotnet /usr/local/lib/android /opt/ghc /usr/local/share/boost
          sudo apt-get clean
          df -h /
      - uses: actions/setup-python@v5
        with:
          python-version: "3.12"
      - name: Install dependencies
        run: pip install jsonschema pyyaml boto3
      - name: Install Terraform 1.9.*
        run: |
          wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
          echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
          sudo apt-get update && sudo apt-get install -y terraform=1.9.*
      - name: Read CI VPC outputs
        if: ${{ env.NOVA_LIFECYCLE_MODE == 'full' }}
        working-directory: terraform/ci-vpc
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: |
          terraform init -input=false -lock=false
          terraform output -json > /tmp/ci-vpc-outputs.json
      - name: Apply (simple)
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: bash scripts/run_l2_lifecycle_test.sh ${{ matrix.module }} simple /tmp/ci-vpc-outputs.json
      - name: Modify (complex)
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: bash scripts/run_l2_lifecycle_test.sh ${{ matrix.module }} complex /tmp/ci-vpc-outputs.json
      - name: Destroy
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: bash scripts/run_l2_lifecycle_destroy.sh ${{ matrix.module }} /tmp/ci-vpc-outputs.json
  # Cleanup: destroy the CI VPC (always runs in full mode, even if lifecycle fails)
  ci-vpc-destroy:
    name: CI VPC destroy
    needs: [lifecycle, l2-lifecycle]
    runs-on: ubuntu-latest
    if: ${{ always() && github.event.inputs.lifecycle_mode != 'plan' && vars.NOVA_LIFECYCLE_MODE != 'plan' }}
    steps:
      - uses: actions/checkout@v4
      - name: Install Terraform 1.9.*
        run: |
          wget -qO- https://apt.releases.hashicorp.com/gpg | sudo gpg --dearmor -o /usr/share/keyrings/hashicorp.gpg
          echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
          sudo apt-get update && sudo apt-get install -y terraform=1.9.*
      - name: Destroy CI VPC
        working-directory: terraform/ci-vpc
        env:
          AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: |
          terraform init -input=false -lock=false
          terraform destroy -auto-approve -lock=false
Author	SHA1	Message	Date
Jon Chery	76714bebc4	verify(P10): contract-ingestor-defense-in-depth — 4-layer verify PASS + ship VERIFY: structural — fail-closed + env discovery; behavioral — 49 tests + CI PASS; security — defense-in-depth on IAM identity. ---ci--- project: acdl phase: 10 milestone: v1.16 status: complete phase_role: execution requirements: covered: [REQ-174] partial: [] ---/ci---	2026-08-01 12:58:23 +00:00
Jon Chery	f12f6edd23	verify(P9): run-platform-split — 4-layer verify PASS + ship VERIFY: structural — 2 helpers extracted (sourced, G-112); behavioral — CI PASS + regression gate 18V+4S PASS (G-111, D-118); quality — run_platform.sh ~80 lines smaller. ---ci--- project: acdl phase: 9 milestone: v1.16 status: complete phase_role: execution requirements: covered: [REQ-173] partial: [] ---/ci---	2026-08-01 12:52:07 +00:00
Jon Chery	1db5ca8286	verify(P8): workflow-generator-dedup — 4-layer verify PASS + ship VERIFY: structural — generator + sources; behavioral — 98 tests + CI PASS; quality — ~20KB dedup, single source of truth. ---ci--- project: acdl phase: 8 milestone: v1.16 status: complete phase_role: execution requirements: covered: [REQ-172] partial: [] ---/ci---	2026-08-01 12:41:10 +00:00
Jon Chery	93ae9e4a39	verify(P7): contract-resolver-envloader-and-kind — 4-layer verify PASS + ship VERIFY: structural — envloader dedup + kind field; behavioral — 49 tests + CI PASS; quality — fragile is_l2 heuristic replaced. ---ci--- project: acdl phase: 7 milestone: v1.16 status: complete phase_role: execution requirements: covered: [REQ-171] partial: [] ---/ci---	2026-08-01 12:38:56 +00:00
Jon Chery	d3179fff37	verify(P6): run-platform-deadcode-and-hitl-fn — 4-layer verify PASS + ship VERIFY: structural — HITL fn extracted + deadcode/config; behavioral — syntax clean + CI PASS; quality — ~14 lines saved. ---ci--- project: acdl phase: 6 milestone: v1.16 status: complete phase_role: execution requirements: covered: [REQ-170] partial: [] ---/ci---	2026-08-01 12:36:40 +00:00
Jon Chery	c029b102a3	verify(P5): regression-verify-dedup — 4-layer verify PASS + ship VERIFY: structural — 3 shared helpers extracted; behavioral — 611 tests + CI PASS; quality — behavior preserved, ~70 lines saved. ---ci--- project: acdl phase: 5 milestone: v1.16 status: complete phase_role: execution requirements: covered: [REQ-169] partial: [] ---/ci---	2026-08-01 12:31:08 +00:00
Jon Chery	2806c6c3ed	verify(P4): migrate-ssm-except-narrowing — 4-layer verify PASS + ship VERIFY: structural — narrowed excepts; behavioral — 48 tests + CI PASS; security — non-ParameterNotFound errors surface; quality — 2 new + 2 updated tests. ---ci--- project: acdl phase: 4 milestone: v1.16 status: complete phase_role: execution requirements: covered: [REQ-168] partial: [] ---/ci---	2026-08-01 12:24:30 +00:00
Jon Chery	e048acd4dd	verify(P3): dead-code-and-stale-prefix-cleanup — 4-layer verify PASS + ship VERIFY: structural — dead export + stale comments + prefixes gone; behavioral — 616 tests + CI PASS; quality — env-override test updated. ---ci--- project: acdl phase: 3 milestone: v1.16 status: complete phase_role: execution requirements: covered: [REQ-167] partial: [] ---/ci---	2026-08-01 12:20:40 +00:00
Jon Chery	9421442afd	verify(P2): user-facing ACDL→Nova sweep — 4-layer verify PASS + ship VERIFY: structural — all user-facing strings Nova; behavioral — 79 tests + CI PASS; security — no creds; quality — new onboarding Nova-header test. REQ-166 complete. Internal ship_phase.sh helper added. ---ci--- project: acdl phase: 2 milestone: v1.16 status: complete phase_role: execution requirements: covered: [REQ-166] partial: [] ---/ci---	2026-08-01 12:12:45 +00:00
Jon Chery	bb43d94563	verify(P1): state-bucket + Kyverno rebrand — 4-layer verify PASS + ship VERIFY: structural — adapter.py:117 nova-tfstate-; kyverno policy nova: labels; behavioral — 80 tests PASS + run_ci.sh 3-stage PASS; security — emitted backend no longer points at a non-existent bucket; quality — new test_adapt_emits_nova_state_bucket regression guard. REQ-165 complete. ---ci--- project: acdl phase: 1 milestone: v1.16 status: complete phase_role: execution requirements: covered: [REQ-165] partial: [] ---/ci---	2026-07-30 15:17:43 +00:00
Jon Chery	ee5c372e65	docs(P00): complete pre-execution phase — v1.16 NFR scope Phase 0: SPECIFY → CLARIFY → RESEARCH → IDEATE → PLAN → GRILL. NFR milestone v1.16 (Nova Simplification), 20 execution phases + final. Tags on v1.15.x line: v1.15.5 (this phase) → v1.15.6..v1.15.25 (P1-P20) → v1.15.26 (P21 final = release). Scope (D-113..D-119): Simplify without regressions, Security, Maintainability, User/Developer Experience, No Humans Onboarding Flow (request-path only; real AWS provisioning deferred). Regression gate (D-118, G-111) gates P9 + P21 at 20/22 Verified + 2 Skipped. Grill: PASS-with-binding (G-111..G-113, E-002 deferred to P21). ---ci--- project: acdl phase: 0 milestone: v1.16 status: complete phase_role: pre_execution requirements: covered: [REQ-165, REQ-166, REQ-167, REQ-168, REQ-169, REQ-170, REQ-171, REQ-172, REQ-173, REQ-174, REQ-175, REQ-176, REQ-177, REQ-178, REQ-179, REQ-180, REQ-181, REQ-182, REQ-183, REQ-184] partial: [] ---/ci---	2026-07-30 15:12:32 +00:00
`@@ -1,4 +1,4 @@`
	`# ACDL Adapters`	`# Nova Adapters`

	`## Overview`	`## Overview`