Merge milestone/v1.15-nova — v1.15 complete (Nova Rebrand: full ACDL→Nova rebrand across docs, decks, code, configs, CI, env vars, consumer path, SSM path, tag keys, AWS resource names; 4 execution phases + final; tag v1.15.4)

Merge phase/05-final-review-ship — v1.15.4 (Nova P5 final-review-ship complete, milestone release)
docs(milestone): complete v1.15 — Nova Rebrand (tag v1.15.4)
2026-07-30 02:24:50 +00:00 · 2026-07-30 02:24:20 +00:00 · 2026-07-30 02:23:55 +00:00 · 2026-07-30 02:11:12 +00:00 · 2026-07-30 02:05:57 +00:00 · 2026-07-30 02:03:16 +00:00
104 changed files with 2396 additions and 770 deletions
@@ -1,8 +1,8 @@
-# ACDL — Architecture (v1.1 target)
+# Nova — Architecture (v1.1 target)

-> Target architecture for the real Agentic Cloud Delivery Platform.
-> Source of truth for **how**: `docs/architecture.md` (v0.2) is the upstream
-> draft; this file is the ACDL-repo operating copy, refined at phase
+> Target architecture for the real Agentic Cloud Delivery Platform (rebranded
+> Nova in v1.15). Source of truth for **how**: `docs/architecture.md` (v0.2) is the upstream
+> draft; this file is the Nova-repo operating copy, refined at phase
 > boundaries. Where this file and `docs/vision.md` conflict, the vision wins.

 ## Status
@@ -598,10 +598,11 @@ VPC; the microservice composition references it via
 `terraform_remote_state` (data source). State keys are deterministic and
 env-aware (`spike/{contract.id}/{contract.environment}/terraform.tfstate`).

-**ACDL_LIFECYCLE_MODE (v1.12, REQ-134).** The lifecycle pipeline defaults
+**NOVA_LIFECYCLE_MODE (v1.12, REQ-134; renamed ACDL→NOVA in v1.15 P2).** The lifecycle pipeline defaults
 to plan-only (fast, no AWS mutation, no cost). A CI variable
-`ACDL_LIFECYCLE_MODE` (default `plan`) overrides to `full` for the real
-apply→modify→destroy.
+`NOVA_LIFECYCLE_MODE` (default `plan`) overrides to `full` for the real
+apply→modify→destroy. (P2–P4 dual-read fallback to `ACDL_LIFECYCLE_MODE`;
+fallback removed in P5 per the v1.15 addendum.)

 ## v1.12 Addendum — Presentation Refinement + CAP-013 Fix

@@ -1,11 +1,11 @@
 {
-  "phase": 1,
+  "phase": 5,
  "stage": "complete",
  "milestone": "v1.15",
-  "phase_role": "execution",
+  "phase_role": "final",
  "attempts": 0,
-  "updated_at": "2026-07-30T00:07:00Z",
-  "milestone_complete": false,
-  "requirements": ["REQ-155", "REQ-156", "REQ-157"],
-  "tag": "v1.15.1"
+  "updated_at": "2026-07-30T00:11:00Z",
+  "milestone_complete": true,
+  "requirements": ["REQ-155", "REQ-156", "REQ-157", "REQ-158", "REQ-159", "REQ-160", "REQ-161", "REQ-162", "REQ-163", "REQ-164"],
+  "tag": "v1.15.4"
 }
@@ -1,6 +1,6 @@
 {
-  "run_id": "regr-1785329757",
-  "run_at_utc": "2026-07-29T12:55:57Z",
+  "run_id": "regr-1785375318",
+  "run_at_utc": "2026-07-30T01:35:18Z",
  "milestone": "v1.10",
  "phase": 52,
  "summary": {
@@ -16,7 +16,7 @@
      "status": "Verified",
      "detail": "exit 0; 2 sample contracts validate",
      "tier": "local",
-      "duration_ms": 252
+      "duration_ms": 230
    },
    {
      "capability_id": "CAP-002",
@@ -24,7 +24,7 @@
      "status": "Verified",
      "detail": "exit 0; env schema validates",
      "tier": "local",
-      "duration_ms": 196
+      "duration_ms": 204
    },
    {
      "capability_id": "CAP-003",
@@ -32,7 +32,7 @@
      "status": "Verified",
      "detail": "exit 0; ",
      "tier": "local",
-      "duration_ms": 258
+      "duration_ms": 247
    },
    {
      "capability_id": "CAP-004",
@@ -40,7 +40,7 @@
      "status": "Verified",
      "detail": "exit 0; ",
      "tier": "local",
-      "duration_ms": 264
+      "duration_ms": 241
    },
    {
      "capability_id": "CAP-005",
@@ -48,7 +48,7 @@
      "status": "Verified",
      "detail": "exit 0; ",
      "tier": "local",
-      "duration_ms": 314
+      "duration_ms": 326
    },
    {
      "capability_id": "CAP-006",
@@ -56,7 +56,7 @@
      "status": "Verified",
      "detail": "exit 0; interpolation ok",
      "tier": "local",
-      "duration_ms": 223
+      "duration_ms": 216
    },
    {
      "capability_id": "CAP-007",
@@ -64,7 +64,7 @@
      "status": "Verified",
      "detail": "exit 0; confidence band=pass",
      "tier": "local",
-      "duration_ms": 80
+      "duration_ms": 79
    },
    {
      "capability_id": "CAP-008",
@@ -72,15 +72,15 @@
      "status": "Verified",
      "detail": "exit 0; outbox hash chain ok",
      "tier": "local",
-      "duration_ms": 358
+      "duration_ms": 333
    },
    {
      "capability_id": "CAP-009",
      "name": "offline pytest suite passes",
      "status": "Verified",
-      "detail": "exit 0;                                 [ 98%]\ntests/test_wiz_adapter_real_client.py .........                          [100%]\n\n====================== 462 passed, 2 deselected in 34.63s ======================",
+      "detail": "exit 0;                                 [ 98%]\ntests/test_wiz_adapter_real_client.py .........                          [100%]\n\n====================== 555 passed, 2 deselected in 51.11s ======================",
      "tier": "local",
-      "duration_ms": 36065
+      "duration_ms": 52574
    },
    {
      "capability_id": "CAP-010",
@@ -88,23 +88,23 @@
      "status": "Verified",
      "detail": "exit 0; resource(s))\n\n=== PLATFORM CHECK OK ===\ncontract -> resolver -> stack -> adapter -> structure validated (offline, no AWS)\ncheck-only: OK\n\n=== CI PIPELINE OK ===\n3 stages passed: lint, test, check-only",
      "tier": "local",
-      "duration_ms": 40668
+      "duration_ms": 59608
    },
    {
      "capability_id": "CAP-011",
      "name": "headline E2E runs against the local emulating tier (microservice)",
      "status": "Verified",
-      "detail": "exit 0; al-emulator\",\n    \"desired_count\": 1,\n    \"running_count\": 1\n  },\n  \"outbox_dir\": \"/tmp/acdl_local_e2e_416d0fmr/outbox\",\n  \"outbox_events\": 2,\n  \"outbox_chain_verified\": true,\n  \"lambda_status\": 200\n}",
+      "detail": "exit 0; al-emulator\",\n    \"desired_count\": 1,\n    \"running_count\": 1\n  },\n  \"outbox_dir\": \"/tmp/acdl_local_e2e_0v1bpi48/outbox\",\n  \"outbox_events\": 2,\n  \"outbox_chain_verified\": true,\n  \"lambda_status\": 200\n}",
      "tier": "local",
-      "duration_ms": 583
+      "duration_ms": 1072
    },
    {
      "capability_id": "CAP-012",
      "name": "local E2E on the static-assets stack (no ECS)",
      "status": "Verified",
-      "detail": "exit 0; acdl_local_e2e_ijhcj1z8/tf\",\n  \"backend\": \"local\",\n  \"ecs\": null,\n  \"outbox_dir\": \"/tmp/acdl_local_e2e_ijhcj1z8/outbox\",\n  \"outbox_events\": 2,\n  \"outbox_chain_verified\": true,\n  \"lambda_status\": 200\n}",
+      "detail": "exit 0; acdl_local_e2e_0cjcizgd/tf\",\n  \"backend\": \"local\",\n  \"ecs\": null,\n  \"outbox_dir\": \"/tmp/acdl_local_e2e_0cjcizgd/outbox\",\n  \"outbox_events\": 2,\n  \"outbox_chain_verified\": true,\n  \"lambda_status\": 200\n}",
      "tier": "local",
-      "duration_ms": 489
+      "duration_ms": 490
    },
    {
      "capability_id": "CAP-013",
@@ -112,7 +112,7 @@
      "status": "Verified",
      "detail": "terraform init+validate+plan OK (live AWS, microservice)",
      "tier": "live-aws",
-      "duration_ms": 28811
+      "duration_ms": 28176
    },
    {
      "capability_id": "CAP-014",
@@ -120,7 +120,7 @@
      "status": "Verified",
      "detail": "terraform init+validate+plan OK (live AWS, static-assets)",
      "tier": "live-aws",
-      "duration_ms": 31772
+      "duration_ms": 31892
    },
    {
      "capability_id": "CAP-015",
@@ -128,23 +128,23 @@
      "status": "Verified",
      "detail": "acdl-outbox exists, item_count=9",
      "tier": "live-aws",
-      "duration_ms": 477
+      "duration_ms": 507
    },
    {
      "capability_id": "CAP-016",
      "name": "S3 state bucket exists + readable (live AWS)",
      "status": "Verified",
-      "detail": "state bucket exists, keys=['platform/terraform.tfstate', 'spike/alb/dev/terraform.tfstate', 'spike/cdn/dev/terraform.tfstate', 'spike/ci-vpc/terraform.tfstate', 'spike/clus/dev/terraform.tfstate']",
+      "detail": "state bucket exists, keys=['platform/terraform.tfstate', 'spike/alb/dev/terraform.tfstate', 'spike/assets/dev/terraform.tfstate', 'spike/cdn/dev/terraform.tfstate', 'spike/ci-vpc/terraform.tfstate']",
      "tier": "live-aws",
-      "duration_ms": 324
+      "duration_ms": 329
    },
    {
      "capability_id": "CAP-017",
      "name": "DynamoDB acdl-contracts table (lifecycle pipeline evidence)",
      "status": "Verified",
-      "detail": "terraform files present + simple/complex contracts resolve",
+      "detail": "terraform files present + fmt -check passes + simple/complex contracts resolve",
      "tier": "lifecycle-pipeline",
-      "duration_ms": 520
+      "duration_ms": 588
    },
    {
      "capability_id": "CAP-018",
@@ -152,39 +152,39 @@
      "status": "Verified",
      "detail": "LocalLambdaStub instantiates (local tier evidence)",
      "tier": "lifecycle-pipeline",
-      "duration_ms": 137
+      "duration_ms": 135
    },
    {
      "capability_id": "CAP-019",
      "name": "ECS cluster + service (L2 microservice lifecycle evidence)",
      "status": "Verified",
-      "detail": "L2 composition resolves (simple + complex contracts)",
+      "detail": "L2 composition resolves (simple + complex contracts; offline proxy)",
      "tier": "lifecycle-pipeline",
-      "duration_ms": 534
+      "duration_ms": 498
    },
    {
      "capability_id": "CAP-020",
      "name": "CloudFront + WAF (L2 static-assets lifecycle evidence)",
      "status": "Verified",
-      "detail": "L2 composition resolves (simple + complex contracts)",
+      "detail": "L2 composition resolves (simple + complex contracts; offline proxy)",
      "tier": "lifecycle-pipeline",
-      "duration_ms": 567
+      "duration_ms": 510
    },
    {
      "capability_id": "CAP-021",
      "name": "uptime-kuma (L1 uptime lifecycle evidence)",
      "status": "Verified",
-      "detail": "terraform files present + simple/complex contracts resolve",
+      "detail": "terraform files present + fmt -check passes + simple/complex contracts resolve",
      "tier": "lifecycle-pipeline",
-      "duration_ms": 606
+      "duration_ms": 562
    },
    {
      "capability_id": "CAP-022",
      "name": "OIDC role (L1 iam-role lifecycle evidence)",
      "status": "Verified",
-      "detail": "terraform files present + simple/complex contracts resolve",
+      "detail": "terraform files present + fmt -check passes + simple/complex contracts resolve",
      "tier": "lifecycle-pipeline",
-      "duration_ms": 529
+      "duration_ms": 554
    }
  ]
 }
@@ -1,51 +1,51 @@
 # Regression Report — v1.10 Phase 52

- **Run ID:** `regr-1785329757`
- **Run at (UTC):** 2026-07-29T12:55:57Z
+- **Run ID:** `regr-1785375318`
+- **Run at (UTC):** 2026-07-30T01:35:18Z
 - **Summary:** {'Verified': 22, 'Decayed': 0, 'Broken': 0}
 - **Passed (milestone gate):** True

 | Capability | Name | Tier | Status | Duration (ms) | Detail |
 |-----------|------|------|--------|--------------|--------|
-| CAP-001 | contract.schema.json validates sample contracts | local | **Verified** | 252 | exit 0; 2 sample contracts validate |
-| CAP-002 | environment.schema.json validates env files | local | **Verified** | 196 | exit 0; env schema validates |
-| CAP-003 | contract_resolver resolves static-assets | local | **Verified** | 258 | exit 0;  |
-| CAP-004 | contract_resolver resolves microservice | local | **Verified** | 264 | exit 0;  |
-| CAP-005 | terraform adapter emits .tf files | local | **Verified** | 314 | exit 0;  |
-| CAP-006 | contract interpolation expands env/contract tokens | local | **Verified** | 223 | exit 0; interpolation ok |
-| CAP-007 | confidence_signal.compute returns a band | local | **Verified** | 80 | exit 0; confidence band=pass |
-| CAP-008 | outbox_writer builds a hash-chained item | local | **Verified** | 358 | exit 0; outbox hash chain ok |
-| CAP-009 | offline pytest suite passes | local | **Verified** | 36065 | exit 0;                                 [ 98%]
+| CAP-001 | contract.schema.json validates sample contracts | local | **Verified** | 230 | exit 0; 2 sample contracts validate |
+| CAP-002 | environment.schema.json validates env files | local | **Verified** | 204 | exit 0; env schema validates |
+| CAP-003 | contract_resolver resolves static-assets | local | **Verified** | 247 | exit 0;  |
+| CAP-004 | contract_resolver resolves microservice | local | **Verified** | 241 | exit 0;  |
+| CAP-005 | terraform adapter emits .tf files | local | **Verified** | 326 | exit 0;  |
+| CAP-006 | contract interpolation expands env/contract tokens | local | **Verified** | 216 | exit 0; interpolation ok |
+| CAP-007 | confidence_signal.compute returns a band | local | **Verified** | 79 | exit 0; confidence band=pass |
+| CAP-008 | outbox_writer builds a hash-chained item | local | **Verified** | 333 | exit 0; outbox hash chain ok |
+| CAP-009 | offline pytest suite passes | local | **Verified** | 52574 | exit 0;                                 [ 98%]
 tests/test_wiz_adapter_real_client.py .........                          [100%]

-====================== 462 passe |
-| CAP-010 | run_ci.sh reproduces CI pipeline locally | local | **Verified** | 40668 | exit 0; resource(s))
+====================== 555 passe |
+| CAP-010 | run_ci.sh reproduces CI pipeline locally | local | **Verified** | 59608 | exit 0; resource(s))

 === PLATFORM CHECK OK ===
 contract -> resolver -> stack -> adapter -> structure validated (offline, no AWS)
 check-only: OK

 === CI PIPELIN |
-| CAP-011 | headline E2E runs against the local emulating tier (microservice) | local | **Verified** | 583 | exit 0; al-emulator",
+| CAP-011 | headline E2E runs against the local emulating tier (microservice) | local | **Verified** | 1072 | exit 0; al-emulator",
    "desired_count": 1,
    "running_count": 1
  },
-  "outbox_dir": "/tmp/acdl_local_e2e_416d0fmr/outbox",
+  "outbox_dir": "/tmp/acdl_local_e2e_0v1bpi48/outbox",
  "outbox_events": 2,
  "outbox |
-| CAP-012 | local E2E on the static-assets stack (no ECS) | local | **Verified** | 489 | exit 0; acdl_local_e2e_ijhcj1z8/tf",
+| CAP-012 | local E2E on the static-assets stack (no ECS) | local | **Verified** | 490 | exit 0; acdl_local_e2e_0cjcizgd/tf",
  "backend": "local",
  "ecs": null,
-  "outbox_dir": "/tmp/acdl_local_e2e_ijhcj1z8/outbox",
+  "outbox_dir": "/tmp/acdl_local_e2e_0cjcizgd/outbox",
  "outbox_events": 2,
  "outbox |
-| CAP-013 | terraform init+validate+plan live AWS (microservice) | live-aws | **Verified** | 28811 | terraform init+validate+plan OK (live AWS, microservice) |
-| CAP-014 | terraform init+validate+plan live AWS (static-assets) | live-aws | **Verified** | 31772 | terraform init+validate+plan OK (live AWS, static-assets) |
-| CAP-015 | DynamoDB outbox table exists (live AWS) | live-aws | **Verified** | 477 | acdl-outbox exists, item_count=9 |
-| CAP-016 | S3 state bucket exists + readable (live AWS) | live-aws | **Verified** | 324 | state bucket exists, keys=['platform/terraform.tfstate', 'spike/alb/dev/terraform.tfstate', 'spike/cdn/dev/terraform.tfstate', 'spike/ci-vpc/terraform.tfstate', |
-| CAP-017 | DynamoDB acdl-contracts table (lifecycle pipeline evidence) | lifecycle-pipeline | **Verified** | 520 | terraform files present + simple/complex contracts resolve |
-| CAP-018 | Lambda contract-ingestor (local stub + lifecycle evidence) | lifecycle-pipeline | **Verified** | 137 | LocalLambdaStub instantiates (local tier evidence) |
-| CAP-019 | ECS cluster + service (L2 microservice lifecycle evidence) | lifecycle-pipeline | **Verified** | 534 | L2 composition resolves (simple + complex contracts) |
-| CAP-020 | CloudFront + WAF (L2 static-assets lifecycle evidence) | lifecycle-pipeline | **Verified** | 567 | L2 composition resolves (simple + complex contracts) |
-| CAP-021 | uptime-kuma (L1 uptime lifecycle evidence) | lifecycle-pipeline | **Verified** | 606 | terraform files present + simple/complex contracts resolve |
-| CAP-022 | OIDC role (L1 iam-role lifecycle evidence) | lifecycle-pipeline | **Verified** | 529 | terraform files present + simple/complex contracts resolve |
+| CAP-013 | terraform init+validate+plan live AWS (microservice) | live-aws | **Verified** | 28176 | terraform init+validate+plan OK (live AWS, microservice) |
+| CAP-014 | terraform init+validate+plan live AWS (static-assets) | live-aws | **Verified** | 31892 | terraform init+validate+plan OK (live AWS, static-assets) |
+| CAP-015 | DynamoDB outbox table exists (live AWS) | live-aws | **Verified** | 507 | acdl-outbox exists, item_count=9 |
+| CAP-016 | S3 state bucket exists + readable (live AWS) | live-aws | **Verified** | 329 | state bucket exists, keys=['platform/terraform.tfstate', 'spike/alb/dev/terraform.tfstate', 'spike/assets/dev/terraform.tfstate', 'spike/cdn/dev/terraform.tfsta |
+| CAP-017 | DynamoDB acdl-contracts table (lifecycle pipeline evidence) | lifecycle-pipeline | **Verified** | 588 | terraform files present + fmt -check passes + simple/complex contracts resolve |
+| CAP-018 | Lambda contract-ingestor (local stub + lifecycle evidence) | lifecycle-pipeline | **Verified** | 135 | LocalLambdaStub instantiates (local tier evidence) |
+| CAP-019 | ECS cluster + service (L2 microservice lifecycle evidence) | lifecycle-pipeline | **Verified** | 498 | L2 composition resolves (simple + complex contracts; offline proxy) |
+| CAP-020 | CloudFront + WAF (L2 static-assets lifecycle evidence) | lifecycle-pipeline | **Verified** | 510 | L2 composition resolves (simple + complex contracts; offline proxy) |
+| CAP-021 | uptime-kuma (L1 uptime lifecycle evidence) | lifecycle-pipeline | **Verified** | 562 | terraform files present + fmt -check passes + simple/complex contracts resolve |
+| CAP-022 | OIDC role (L1 iam-role lifecycle evidence) | lifecycle-pipeline | **Verified** | 554 | terraform files present + fmt -check passes + simple/complex contracts resolve |
@@ -822,13 +822,13 @@ IDEATE-01..IDEATE-10, mapped to REQ-155..REQ-164.
 | REQ-155 | P1 | complete |
 | REQ-156 | P1 | complete |
 | REQ-157 | P1 | complete |
-| REQ-158 | P2 | pending |
-| REQ-159 | P2 | pending |
-| REQ-160 | P2 | pending |
-| REQ-161 | P3 | pending |
-| REQ-162 | P3 | pending |
-| REQ-163 | P4 | pending |
-| REQ-164 | P5 | pending |
+| REQ-158 | P2 | complete |
+| REQ-159 | P2 | complete |
+| REQ-160 | P2 | complete |
+| REQ-161 | P3 | complete |
+| REQ-162 | P3 | complete |
+| REQ-163 | P4 | complete |
+| REQ-164 | P5 | complete |

 ### Out of Scope (v1.15)
 - Renaming the real Gitea org/repo (`continuous-intelligence/acdl`) or
@@ -1435,7 +1435,7 @@ After Phase P21: milestone COMPLETE — `v1.13.24` IS the v1.14 release.

 ---

-## v1.15 (active — Nova Rebrand, tag `v1.15.4`)
+## v1.15 (complete — Nova Rebrand, tag `v1.15.4`)

 A full rebrand from **ACDL** / "Agentic Cloud Delivery Platform" →
 **Nova** / "The New Dawn of DevSecOps — security as a seamless enabler
@@ -1504,7 +1504,7 @@ milestone release). (G-104 binding.)
  announcing the `.acdl/`→`.nova/` path, `ACDL_*`→`NOVA_*` env vars,
  `/acdl/`→`/nova/` SSM path, `acdl:*`→`nova:*` tag keys, and
  `acdl-*`→`nova-*` AWS resource names changes coming in P2–P4.
- **Status:** pending
+- **Status:** complete (v1.15.1)
 - **Depends on:** —
 - **Requirements:** REQ-155, REQ-156, REQ-157
 - **Success Criteria:**
@@ -1536,7 +1536,7 @@ milestone release). (G-104 binding.)
  contract resolver, deploy workflow checkout path, consumer docs, and
  the contract schema description. Rotate Gitea repo secrets via API
  (rename keys `ACDL_*` → `NOVA_*`, values stay).
- **Status:** pending
+- **Status:** complete (v1.15.2)
 - **Depends on:** [P1]
 - **Requirements:** REQ-158, REQ-159, REQ-160
 - **Success Criteria:**
@@ -1564,7 +1564,7 @@ milestone release). (G-104 binding.)
  to match `nova:*`, update `nova_tagging.py` to enforce `nova:*`
  (hard, no warn), then remove `acdl:*` tags once consumers are
  verified. Terraform tagging updated to emit `nova:*`.
- **Status:** pending
+- **Status:** complete (v1.15.3)
 - **Depends on:** [P2]
 - **Requirements:** REQ-161, REQ-162
 - **Success Criteria:**
@@ -1596,7 +1596,7 @@ milestone release). (G-104 binding.)
  passes; live apply/modify/destroy is exercised by the
  modules-lifecycle workflow when `ACDL_LIFECYCLE_MODE` (now
  `NOVA_LIFECYCLE_MODE`) is set to full.
- **Status:** pending
+- **Status:** complete (v1.15.4)
 - **Depends on:** [P3]
 - **Requirements:** REQ-163
 - **Success Criteria:**
@@ -1620,7 +1620,7 @@ milestone release). (G-104 binding.)
  update REQUIREMENTS.md (REQ-155..164 marked complete), ROADMAP.md
  (v1.15 complete), PROJECT.md. Tag final patch `v1.14.5` (IS the
  milestone release). Merge `milestone/v1.15-nova` → `main`.
- **Status:** pending
+- **Status:** complete (v1.15.4, milestone release)
 - **Depends on:** [P1-P4]
 - **Requirements:** REQ-164
 - **Success Criteria:**
@@ -26,7 +26,7 @@
 #      platform log) for auditability.
 #
 # Inputs:
-#   contract  — path to the consumer's contract YAML (default .acdl/contract.yml)
+#   contract  — path to the consumer's contract YAML (default .nova/contract.yml)
 #   mode      — full | plan-only | check-only (default full; dev = full apply,
 #               higher environments hold for HITL — the calling repo or the
 #               forge environment gate enforces that)
@@ -39,11 +39,11 @@
 #   policy restricts view/update to resources tagged acdl:owner=<consumer-repo>.
 #
 #   Override (where OIDC is unavailable, e.g. Gitea pending
-#   go-gitea/gitea#36988): set ACDL_AWS_ACCESS_KEY_ID + ACDL_AWS_SECRET_ACCESS_KEY
+#   go-gitea/gitea#36988): set NOVA_AWS_ACCESS_KEY_ID + NOVA_AWS_SECRET_ACCESS_KEY
 #   as repository secrets. The platform-managed scheduled pipeline rotates
 #   the key on a daily cadence. When .env.secrets is used locally instead,
 #   rotating the key out of band is the consumer's responsibility.
-name: acdl-deploy
+name: nova-deploy

 on:
  workflow_call:
@@ -51,7 +51,7 @@ on:
      contract:
        description: Path to the consumer contract YAML (in the consumer repo)
        type: string
-        default: .acdl/contract.yml
+        default: .nova/contract.yml
      mode:
        description: Pipeline mode — full (apply), plan-only, check-only, or decommission
        type: string
@@ -102,10 +102,11 @@ jobs:
      - name: Configure AWS credentials (OIDC default + static-key override)
        uses: aws-actions/configure-aws-credentials@v4
        with:
-          role-to-assume: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID == '' && format('arn:aws:iam::{0}:role/acdl-deploy-{1}', secrets.ACDL_AWS_ACCOUNT_ID, github.repository_id) || '' }}
+          # P4 (REQ-163): IAM role renamed acdl-deploy- → nova-deploy-.
+          role-to-assume: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID == '' && format('arn:aws:iam::{0}:role/nova-deploy-{1}', secrets.NOVA_AWS_ACCOUNT_ID, github.repository_id) || '' }}
          aws-region: us-east-1
-          access-key-id: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
-          secret-access-key: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
+          access-key-id: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
+          secret-access-key: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}

      - name: Run the platform pipeline
        working-directory: ${{ github.workspace }}
@@ -145,7 +146,7 @@ jobs:
          AWS_DEFAULT_REGION: us-east-1
        run: |
          aws lambda invoke-function-url \
-            --function-url "${{ secrets.ACDL_LAMBDA_URL }}" \
+            --function-url "${{ secrets.NOVA_LAMBDA_URL }}" \
            --cli-binary-format raw-in-base64-out \
            --payload "$(python3 -c "import json,os; print(json.dumps({'action':'report_error','consumerRepo':os.environ.get('GITHUB_REPOSITORY',''),'contractId':'${{ github.run_id }}','error':'Deploy pipeline failed. See run logs.','runUrl':'${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}','environment':'dev'}))")" \
            /dev/null || true
@@ -153,13 +154,13 @@ jobs:
      - name: Upload emitted Terraform
        uses: actions/upload-artifact@v4
        with:
-          name: acdl-terraform
+          name: nova-terraform
          path: /tmp/acdl_platform_run_v18/tf/*.tf
          if-no-files-found: warn

      - name: Upload platform log
        uses: actions/upload-artifact@v4
        with:
-          name: acdl-platform-log
+          name: nova-platform-log
          path: platform/logs/
          if-no-files-found: warn
@@ -15,7 +15,7 @@
 # "plan" — the lifecycle scripts run `run_platform.sh --plan-only` (fast,
 # no AWS mutation, validates the contract->resolver->adapter->plan chain
 # for every module on every PR, with no AWS credentials or cost). Set to
-# "full" via workflow_dispatch (or the ACDL_LIFECYCLE_MODE repo variable)
+# "full" via workflow_dispatch (or the NOVA_LIFECYCLE_MODE repo variable)
 # to run the real apply→modify→destroy against live AWS. In plan mode the
 # short-lived CI VPC apply/destroy jobs are skipped (nothing is applied).
 #
@@ -49,7 +49,7 @@ jobs:
  ci-vpc-apply:
    name: CI VPC apply
    runs-on: ubuntu-latest
-    if: ${{ github.event.inputs.lifecycle_mode != 'plan' && vars.ACDL_LIFECYCLE_MODE != 'plan' }}
+    if: ${{ github.event.inputs.lifecycle_mode != 'plan' && vars.NOVA_LIFECYCLE_MODE != 'plan' }}
    steps:
      - uses: actions/checkout@v4
      - name: Install Terraform 1.9.*
@@ -60,8 +60,8 @@ jobs:
      - name: Apply CI VPC
        working-directory: terraform/ci-vpc
        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: |
          terraform init -input=false -lock=false
@@ -78,7 +78,7 @@ jobs:
      matrix:
        module: [s3, kms-key, ecr, ecs-cluster, iam-role, cloudfront, waf, vpc, alb, ecs-service, rds, uptime]
    env:
-      ACDL_LIFECYCLE_MODE: ${{ github.event.inputs.lifecycle_mode || vars.ACDL_LIFECYCLE_MODE || 'plan' }}
+      NOVA_LIFECYCLE_MODE: ${{ github.event.inputs.lifecycle_mode || vars.NOVA_LIFECYCLE_MODE || 'plan' }}
    steps:
      - uses: actions/checkout@v4
      - name: Free disk space
@@ -97,31 +97,31 @@ jobs:
          echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
          sudo apt-get update && sudo apt-get install -y terraform=1.9.*
      - name: Read CI VPC outputs
-        if: ${{ env.ACDL_LIFECYCLE_MODE == 'full' }}
+        if: ${{ env.NOVA_LIFECYCLE_MODE == 'full' }}
        working-directory: terraform/ci-vpc
        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: |
          terraform init -input=false -lock=false
          terraform output -json > /tmp/ci-vpc-outputs.json
      - name: Apply (simple)
        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: bash scripts/run_lifecycle_test.sh ${{ matrix.module }} simple /tmp/ci-vpc-outputs.json
      - name: Modify (complex)
        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: bash scripts/run_lifecycle_test.sh ${{ matrix.module }} complex /tmp/ci-vpc-outputs.json
      - name: Destroy
        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: bash scripts/run_lifecycle_destroy.sh ${{ matrix.module }} /tmp/ci-vpc-outputs.json

@@ -136,7 +136,7 @@ jobs:
      matrix:
        module: [static-assets, microservice]
    env:
-      ACDL_LIFECYCLE_MODE: ${{ github.event.inputs.lifecycle_mode || vars.ACDL_LIFECYCLE_MODE || 'plan' }}
+      NOVA_LIFECYCLE_MODE: ${{ github.event.inputs.lifecycle_mode || vars.NOVA_LIFECYCLE_MODE || 'plan' }}
    steps:
      - uses: actions/checkout@v4
      - name: Free disk space
@@ -155,31 +155,31 @@ jobs:
          echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
          sudo apt-get update && sudo apt-get install -y terraform=1.9.*
      - name: Read CI VPC outputs
-        if: ${{ env.ACDL_LIFECYCLE_MODE == 'full' }}
+        if: ${{ env.NOVA_LIFECYCLE_MODE == 'full' }}
        working-directory: terraform/ci-vpc
        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: |
          terraform init -input=false -lock=false
          terraform output -json > /tmp/ci-vpc-outputs.json
      - name: Apply (simple)
        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: bash scripts/run_l2_lifecycle_test.sh ${{ matrix.module }} simple /tmp/ci-vpc-outputs.json
      - name: Modify (complex)
        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: bash scripts/run_l2_lifecycle_test.sh ${{ matrix.module }} complex /tmp/ci-vpc-outputs.json
      - name: Destroy
        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: bash scripts/run_l2_lifecycle_destroy.sh ${{ matrix.module }} /tmp/ci-vpc-outputs.json

@@ -188,7 +188,7 @@ jobs:
    name: CI VPC destroy
    needs: [lifecycle, l2-lifecycle]
    runs-on: ubuntu-latest
-    if: ${{ always() && github.event.inputs.lifecycle_mode != 'plan' && vars.ACDL_LIFECYCLE_MODE != 'plan' }}
+    if: ${{ always() && github.event.inputs.lifecycle_mode != 'plan' && vars.NOVA_LIFECYCLE_MODE != 'plan' }}
    steps:
      - uses: actions/checkout@v4
      - name: Install Terraform 1.9.*
@@ -199,8 +199,8 @@ jobs:
      - name: Destroy CI VPC
        working-directory: terraform/ci-vpc
        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: |
          terraform init -input=false -lock=false
@@ -26,7 +26,7 @@
 #      platform log) for auditability.
 #
 # Inputs:
-#   contract  — path to the consumer's contract YAML (default .acdl/contract.yml)
+#   contract  — path to the consumer's contract YAML (default .nova/contract.yml)
 #   mode      — full | plan-only | check-only (default full; dev = full apply,
 #               higher environments hold for HITL — the calling repo or the
 #               forge environment gate enforces that)
@@ -39,11 +39,11 @@
 #   policy restricts view/update to resources tagged acdl:owner=<consumer-repo>.
 #
 #   Override (where OIDC is unavailable, e.g. Gitea pending
-#   go-gitea/gitea#36988): set ACDL_AWS_ACCESS_KEY_ID + ACDL_AWS_SECRET_ACCESS_KEY
+#   go-gitea/gitea#36988): set NOVA_AWS_ACCESS_KEY_ID + NOVA_AWS_SECRET_ACCESS_KEY
 #   as repository secrets. The platform-managed scheduled pipeline rotates
 #   the key on a daily cadence. When .env.secrets is used locally instead,
 #   rotating the key out of band is the consumer's responsibility.
-name: acdl-deploy
+name: nova-deploy

 on:
  workflow_call:
@@ -51,7 +51,7 @@ on:
      contract:
        description: Path to the consumer contract YAML (in the consumer repo)
        type: string
-        default: .acdl/contract.yml
+        default: .nova/contract.yml
      mode:
        description: Pipeline mode — full (apply), plan-only, check-only, or decommission
        type: string
@@ -102,10 +102,11 @@ jobs:
      - name: Configure AWS credentials (OIDC default + static-key override)
        uses: aws-actions/configure-aws-credentials@v4
        with:
-          role-to-assume: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID == '' && format('arn:aws:iam::{0}:role/acdl-deploy-{1}', secrets.ACDL_AWS_ACCOUNT_ID, github.repository_id) || '' }}
+          # P4 (REQ-163): IAM role renamed acdl-deploy- → nova-deploy-.
+          role-to-assume: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID == '' && format('arn:aws:iam::{0}:role/nova-deploy-{1}', secrets.NOVA_AWS_ACCOUNT_ID, github.repository_id) || '' }}
          aws-region: us-east-1
-          access-key-id: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
-          secret-access-key: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
+          access-key-id: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
+          secret-access-key: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}

      - name: Run the platform pipeline
        working-directory: ${{ github.workspace }}
@@ -145,7 +146,7 @@ jobs:
          AWS_DEFAULT_REGION: us-east-1
        run: |
          aws lambda invoke-function-url \
-            --function-url "${{ secrets.ACDL_LAMBDA_URL }}" \
+            --function-url "${{ secrets.NOVA_LAMBDA_URL }}" \
            --cli-binary-format raw-in-base64-out \
            --payload "$(python3 -c "import json,os; print(json.dumps({'action':'report_error','consumerRepo':os.environ.get('GITHUB_REPOSITORY',''),'contractId':'${{ github.run_id }}','error':'Deploy pipeline failed. See run logs.','runUrl':'${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}','environment':'dev'}))")" \
            /dev/null || true
@@ -153,13 +154,13 @@ jobs:
      - name: Upload emitted Terraform
        uses: actions/upload-artifact@v4
        with:
-          name: acdl-terraform
+          name: nova-terraform
          path: /tmp/acdl_platform_run_v18/tf/*.tf
          if-no-files-found: warn

      - name: Upload platform log
        uses: actions/upload-artifact@v4
        with:
-          name: acdl-platform-log
+          name: nova-platform-log
          path: platform/logs/
          if-no-files-found: warn
@@ -15,7 +15,7 @@
 # "plan" — the lifecycle scripts run `run_platform.sh --plan-only` (fast,
 # no AWS mutation, validates the contract->resolver->adapter->plan chain
 # for every module on every PR, with no AWS credentials or cost). Set to
-# "full" via workflow_dispatch (or the ACDL_LIFECYCLE_MODE repo variable)
+# "full" via workflow_dispatch (or the NOVA_LIFECYCLE_MODE repo variable)
 # to run the real apply→modify→destroy against live AWS. In plan mode the
 # short-lived CI VPC apply/destroy jobs are skipped (nothing is applied).
 #
@@ -49,7 +49,7 @@ jobs:
  ci-vpc-apply:
    name: CI VPC apply
    runs-on: ubuntu-latest
-    if: ${{ github.event.inputs.lifecycle_mode != 'plan' && vars.ACDL_LIFECYCLE_MODE != 'plan' }}
+    if: ${{ github.event.inputs.lifecycle_mode != 'plan' && vars.NOVA_LIFECYCLE_MODE != 'plan' }}
    steps:
      - uses: actions/checkout@v4
      - name: Install Terraform 1.9.*
@@ -60,8 +60,8 @@ jobs:
      - name: Apply CI VPC
        working-directory: terraform/ci-vpc
        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: |
          terraform init -input=false -lock=false
@@ -78,7 +78,7 @@ jobs:
      matrix:
        module: [s3, kms-key, ecr, ecs-cluster, iam-role, cloudfront, waf, vpc, alb, ecs-service, rds, uptime]
    env:
-      ACDL_LIFECYCLE_MODE: ${{ github.event.inputs.lifecycle_mode || vars.ACDL_LIFECYCLE_MODE || 'plan' }}
+      NOVA_LIFECYCLE_MODE: ${{ github.event.inputs.lifecycle_mode || vars.NOVA_LIFECYCLE_MODE || 'plan' }}
    steps:
      - uses: actions/checkout@v4
      - name: Free disk space
@@ -97,31 +97,31 @@ jobs:
          echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
          sudo apt-get update && sudo apt-get install -y terraform=1.9.*
      - name: Read CI VPC outputs
-        if: ${{ env.ACDL_LIFECYCLE_MODE == 'full' }}
+        if: ${{ env.NOVA_LIFECYCLE_MODE == 'full' }}
        working-directory: terraform/ci-vpc
        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: |
          terraform init -input=false -lock=false
          terraform output -json > /tmp/ci-vpc-outputs.json
      - name: Apply (simple)
        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: bash scripts/run_lifecycle_test.sh ${{ matrix.module }} simple /tmp/ci-vpc-outputs.json
      - name: Modify (complex)
        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: bash scripts/run_lifecycle_test.sh ${{ matrix.module }} complex /tmp/ci-vpc-outputs.json
      - name: Destroy
        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: bash scripts/run_lifecycle_destroy.sh ${{ matrix.module }} /tmp/ci-vpc-outputs.json

@@ -136,7 +136,7 @@ jobs:
      matrix:
        module: [static-assets, microservice]
    env:
-      ACDL_LIFECYCLE_MODE: ${{ github.event.inputs.lifecycle_mode || vars.ACDL_LIFECYCLE_MODE || 'plan' }}
+      NOVA_LIFECYCLE_MODE: ${{ github.event.inputs.lifecycle_mode || vars.NOVA_LIFECYCLE_MODE || 'plan' }}
    steps:
      - uses: actions/checkout@v4
      - name: Free disk space
@@ -155,31 +155,31 @@ jobs:
          echo "deb [signed-by=/usr/share/keyrings/hashicorp.gpg] https://apt.releases.hashicorp.com $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/hashicorp.list
          sudo apt-get update && sudo apt-get install -y terraform=1.9.*
      - name: Read CI VPC outputs
-        if: ${{ env.ACDL_LIFECYCLE_MODE == 'full' }}
+        if: ${{ env.NOVA_LIFECYCLE_MODE == 'full' }}
        working-directory: terraform/ci-vpc
        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: |
          terraform init -input=false -lock=false
          terraform output -json > /tmp/ci-vpc-outputs.json
      - name: Apply (simple)
        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: bash scripts/run_l2_lifecycle_test.sh ${{ matrix.module }} simple /tmp/ci-vpc-outputs.json
      - name: Modify (complex)
        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: bash scripts/run_l2_lifecycle_test.sh ${{ matrix.module }} complex /tmp/ci-vpc-outputs.json
      - name: Destroy
        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: bash scripts/run_l2_lifecycle_destroy.sh ${{ matrix.module }} /tmp/ci-vpc-outputs.json

@@ -188,7 +188,7 @@ jobs:
    name: CI VPC destroy
    needs: [lifecycle, l2-lifecycle]
    runs-on: ubuntu-latest
-    if: ${{ always() && github.event.inputs.lifecycle_mode != 'plan' && vars.ACDL_LIFECYCLE_MODE != 'plan' }}
+    if: ${{ always() && github.event.inputs.lifecycle_mode != 'plan' && vars.NOVA_LIFECYCLE_MODE != 'plan' }}
    steps:
      - uses: actions/checkout@v4
      - name: Install Terraform 1.9.*
@@ -199,8 +199,8 @@ jobs:
      - name: Destroy CI VPC
        working-directory: terraform/ci-vpc
        env:
-          AWS_ACCESS_KEY_ID: ${{ secrets.ACDL_AWS_ACCESS_KEY_ID }}
-          AWS_SECRET_ACCESS_KEY: ${{ secrets.ACDL_AWS_SECRET_ACCESS_KEY }}
+          AWS_ACCESS_KEY_ID: ${{ secrets.NOVA_AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.NOVA_AWS_SECRET_ACCESS_KEY }}
          AWS_DEFAULT_REGION: us-east-1
        run: |
          terraform init -input=false -lock=false
@@ -28,7 +28,7 @@ There are two kinds of repository in the Nova model:
  A **consumer never clones it.**
 - **Consumer repo (yours).** A consumer repo contains only:
  1. **Its application code** — the service or site being deployed.
-  2. **One or more contracts** — small YAML files at `.acdl/contract.yml`
+  2. **One or more contracts** — small YAML files at `.nova/contract.yml`
     that declare infrastructure (one or more modules by name + version),
     select an environment, and supply module-specific inputs.
  3. **One or more CI definitions** — thin `.github/workflows/*.yml` files
@@ -144,7 +144,7 @@ engine-specific code. `modules/`, `schemas/`, `contracts/`,
 ```bash
 # 1. Bootstrap the AWS state backend + runner IAM user (one-time, idempotent)
 #    (requires the bootstrap root key in env — skip if the state bucket +
-#    acdl-spike-runner already exist)
+#    nova-spike-runner already exist)
 ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID=... ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY=... \
  python3 terraform/bootstrap/create_state_backend.py
 ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID=... ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY=... \
@@ -285,8 +285,8 @@ no static credentials in repo secrets.
    `repo:org/consumer-repo:ref:refs/heads/main`) binds the role's trust
    policy to the exact consumer repo + branch that invoked the workflow.
  - **Resource-creation attributes** — every resource the pipeline creates
-    is tagged with `acdl:owner=<consumer-repo>` and
-    `acdl:contract=<contract-id>`. The session policy grants
+    is tagged with `nova:owner=<consumer-repo>` and
+    `nova:contract=<contract-id>`. The session policy grants
    view/update/delete **only on resources whose tags match the calling
    repo**.

@@ -10,9 +10,10 @@ lives in the per-module terraform/ subdir, NOT in this file.
 CLI: adapter.py <instance.json> <out_dir>
 """

-import json
-import os
-import sys
+import json, os, sys
+_R = os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+sys.path.insert(0, _R) if _R not in sys.path else None
+from core import env


 def _load_registry(repo_root):
@@ -112,7 +113,7 @@ def adapt(stack_instance, out_dir):

    stack_name = stack.get("name", "spike")
    environment = stack.get("environment", "dev")
-    account_id = os.environ.get("ACDL_AWS_ACCOUNT_ID", "581513795199")
+    account_id = env.get_env("AWS_ACCOUNT_ID", "581513795199")
    state_bucket = f"acdl-tfstate-{account_id}-us-east-1"
    terraform_tf = (
        'terraform {\n'
@@ -134,7 +135,7 @@ def adapt(stack_instance, out_dir):
    data_source_names = stack_instance.get("data_sources", [])
    parts = []
    if data_source_names:
-        remote_state_key = os.environ.get("ACDL_REMOTE_STATE_KEY", "platform/terraform.tfstate")
+        remote_state_key = env.get_env("REMOTE_STATE_KEY", "platform/terraform.tfstate")
        parts.append(
            'data "terraform_remote_state" "platform" {\n'
            '  backend = "s3"\n'
@@ -1,4 +1,4 @@
-"""Translate Checkov JSON output to ACDL PolicyCheckResult records.
+"""Translate Checkov JSON output to Nova PolicyCheckResult records.

 Reads Checkov's JSON output (one framework key, e.g. terraform_plan),
 emits a list of PolicyCheckResult dicts conforming to
@@ -6,10 +6,13 @@ schemas/policy_check_result.schema.json. Run Checkov with --soft-fail so
 Checkov never exits non-zero; the confidence signal decides the gate, not
 Checkov's exit code.

-The ACDL tagging standard (D-054, D-043 closure) is enforced by a custom
-Checkov rule at adapters/terraform/policy/custom_rules/acdl_tagging.py,
-loaded via --external-checks-dir. The adapter therefore maps
-ACDL_TAG_NAMING as a real rule (no synthetic SKIPPED record is emitted).
+The Nova tagging standard (D-054, D-043 closure, D-109 hard mode in P3)
+is enforced by a custom Checkov rule at
+adapters/terraform/policy/custom_rules/nova_tagging.py, loaded via
+--external-checks-dir. The adapter therefore maps NOVA_TAG_NAMING as a
+real rule (no synthetic SKIPPED record is emitted). Renamed from
+ACDL_TAG_NAMING in P2 (REQ-158); the rule is in hard mode as of P3
+(REQ-162: hard-fail on missing nova:* or acdl:*-only tags).
 """

 import datetime
@@ -29,10 +32,12 @@ RULE_MAP = {
    "CKV_AWS_40": ("iam-wildcard", "medium"),
    "CKV_AWS_7": ("kms-key-reference", "medium"),
    "CKV_AWS_33": ("kms-key-reference", "medium"),
-    # D-054 / D-043 closure: ACDL_TAG_NAMING is now a real custom Checkov
-    # rule (adapters/terraform/policy/custom_rules/acdl_tagging.py), loaded
-    # via --external-checks-dir. No synthetic SKIPPED record is emitted.
-    "ACDL_TAG_NAMING": ("tagging-standard", "medium"),
+    # D-054 / D-043 closure, D-109 hard mode (P3): NOVA_TAG_NAMING is a real
+    # custom Checkov rule (adapters/terraform/policy/custom_rules/nova_tagging.py),
+    # loaded via --external-checks-dir. No synthetic SKIPPED record is emitted.
+    # Renamed from ACDL_TAG_NAMING in P2 (REQ-158). Hard mode as of P3
+    # (REQ-162: hard-fail on missing nova:* or acdl:*-only tags).
+    "NOVA_TAG_NAMING": ("tagging-standard", "medium"),
 }

 _RESULT_MAP = {"PASSED": "pass", "FAILED": "fail", "SKIPPED": "skipped"}
@@ -1,16 +1,24 @@
-# ACDL Custom Checkov Rules
+# Nova Custom Checkov Rules

-This directory holds ACDL-authored Checkov custom rules, written in the
+This directory holds Nova-authored Checkov custom rules, written in the
 [Checkov Python custom-rule framework](https://www.checkov.io/4.Contributing/Custom%20Policies.html).

 ## Files

- `acdl_tagging.py` — `ACDL_TAG_NAMING` (D-054): ensures every taggable AWS
-  resource carries the four required ACDL tags
-  (`acdl:owner`, `acdl:contract`, `acdl:environment`, `acdl:cost-center`).
-  This rule replaces the synthetic SKIPPED `ACDL_TAG_NAMING` record that the
-  Checkov adapter previously emitted (D-043 closure). The canonical tag set
-  is declared in [`schemas/tagging-standard.json`](../../../schemas/tagging-standard.json).
+- `nova_tagging.py` — `NOVA_TAG_NAMING` (D-054, D-109 warn mode in P2):
+  ensures every taggable AWS resource carries the four required Nova tags
+  (`nova:owner`, `nova:contract`, `nova:environment`, `nova:cost-center`).
+  This rule replaces the synthetic SKIPPED `NOVA_TAG_NAMING` record that the
+  Checkov adapter previously emitted (D-043 closure). Renamed from
+  `acdl_tagging.py` / `ACDL_TAG_NAMING` in P2 (REQ-158). The canonical tag
+  set is declared in [`schemas/tagging-standard.json`](../../../schemas/tagging-standard.json).
+
+  **P2 warn mode (D-109):** existing resources still carry `acdl:*` tag-key
+  values (left for P3). When a resource has only `acdl:*`-style tags and no
+  `nova:*` tags, the rule logs a WARNING instead of failing, so the
+  regression gate stays green during the parallel-tag transition window.
+  P3 flips to hard-fail once `nova:*` tags are emitted in parallel and the
+  ABAC policy is swapped.

 ## How Checkov loads them

@@ -23,12 +31,12 @@ checkov -f terraform/spike/main.tf --framework terraform -o json --soft-fail \
 ```

 Checkov imports each `*.py` file in the directory and instantiates the
-module-level `check` object (see the `check = AcdlTaggingStandard()` line at
-the bottom of `acdl_tagging.py`).
+module-level `check` object (see the `check = NovaTaggingStandard()` line at
+the bottom of `nova_tagging.py`).

 ## Severity / result mapping

 The Checkov adapter (`adapters/terraform/policy/checkov_adapter.py`)
-maps `ACDL_TAG_NAMING` to `(tagging-standard, medium)` in `RULE_MAP`. The
+maps `NOVA_TAG_NAMING` to `(tagging-standard, medium)` in `RULE_MAP`. The
 custom rule therefore produces real `PASS`/`FAIL` PolicyCheckResult records,
 feeding the confidence signal instead of the old SKIPPED placeholder.
@@ -1,54 +0,0 @@
-"""ACDL tagging standard custom Checkov rule (D-054).
-
-Checks that all taggable AWS resources have the required ACDL tags:
-  acdl:owner, acdl:contract, acdl:environment, acdl:cost-center
-
-Fails (severity medium) when any required tag is missing.
-Closes the D-043 deferral (the SKIPPED ACDL_TAG_NAMING placeholder
-becomes a real check).
-"""
-
-from __future__ import annotations
-
-from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
-from checkov.common.models.enums import CheckResult, CheckCategories
-
-REQUIRED_TAGS = ("acdl:owner", "acdl:contract", "acdl:environment", "acdl:cost-center")
-
-# Resources that support tags (exclude resources that have no tags attribute)
-NON_TAGGABLE_TYPES = (
-    "aws_cloudfront_origin_access_control",
-    "aws_lambda_function_url",
-    "aws_route_table_association",
-    "aws_internet_gateway",
-)
-
-class AcdlTaggingStandard(BaseResourceCheck):
-    def __init__(self):
-        name = "Ensure all taggable AWS resources have required ACDL tags"
-        check_id = "ACDL_TAG_NAMING"
-        supported_resources = ["*"]  # all resources
-        categories = [CheckCategories.GENERAL_SECURITY]
-        super().__init__(name=name, check_id=check_id, categories=categories, supported_resources=supported_resources)
-
-    def scan_resource_conf(self, conf, entity_type):
-        # Skip non-taggable resources
-        if entity_type in NON_TAGGABLE_TYPES:
-            return CheckResult.PASSED
-        # Check for a tags block
-        tags = conf.get("tags")
-        if not tags:
-            return CheckResult.FAILED
-        tag_keys = set()
-        if isinstance(tags, list) and tags:
-            tag_block = tags[0]
-            if isinstance(tag_block, dict):
-                tag_keys = set(tag_block.keys())
-        elif isinstance(tags, dict):
-            tag_keys = set(tags.keys())
-        missing = [t for t in REQUIRED_TAGS if t not in tag_keys]
-        if missing:
-            return CheckResult.FAILED
-        return CheckResult.PASSED
-
-check = AcdlTaggingStandard()
@@ -0,0 +1,82 @@
+"""Nova tagging standard custom Checkov rule (D-054, D-109 hard mode).
+
+Checks that all taggable AWS resources have the required Nova tags:
+  nova:owner, nova:contract, nova:environment, nova:cost-center
+
+In **hard mode** (P3, REQ-162): the rule hard-fails when a taggable resource
+is missing any required `nova:*` tag, OR when a resource carries only the
+legacy `acdl:*` tag keys (and no `nova:*` keys). P2 shipped warn mode
+(`_WARN_MODE = True`) so the regression gate stayed green during the
+parallel-tag transition window; P3 flips to hard-fail (`_WARN_MODE = False`)
+once `nova:*` tags are emitted in terraform and the ABAC policy is swapped
+to match `nova:*`. P5 keeps hard mode and additionally hard-fails on any
+`acdl:*` tag key present at all (no legacy tolerated post-cutoff).
+
+Closes the D-043 deferral (the SKIPPED NOVA_TAG_NAMING placeholder
+becomes a real check). Renamed from acdl_tagging.py in P2 (REQ-158);
+the Checkov rule ID ACDL_TAG_NAMING → NOVA_TAG_NAMING.
+"""
+
+from __future__ import annotations
+
+import sys
+
+from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
+from checkov.common.models.enums import CheckResult, CheckCategories
+
+REQUIRED_TAGS = ("nova:owner", "nova:contract", "nova:environment", "nova:cost-center")
+
+# Legacy acdl:* tag keys — the parallel-tag period (P3) emits both nova:*
+# and acdl:*; P2 warn mode treats acdl:*-only tags as a warning, not a
+# failure. The acdl:* VALUES in tagging-standard.json are left for P3.
+LEGACY_TAGS = ("acdl:owner", "acdl:contract", "acdl:environment", "acdl:cost-center")
+
+# Resources that support tags (exclude resources that have no tags attribute)
+NON_TAGGABLE_TYPES = (
+    "aws_cloudfront_origin_access_control",
+    "aws_lambda_function_url",
+    "aws_route_table_association",
+    "aws_internet_gateway",
+)
+
+# P5 hard mode (D-109, REQ-164): `_WARN_MODE = False` (set in P3) AND
+# any `acdl:*` tag key present at all is a hard FAIL (P5 tightens from
+# P3's "acdl:*-only fails" to "any acdl:* key fails"). The legacy tag
+# keys are fully removed from terraform (P3); any remaining `acdl:*` key
+# is a rebrand regression.
+_WARN_MODE = False
+
+
+class NovaTaggingStandard(BaseResourceCheck):
+    def __init__(self):
+        name = "Ensure all taggable AWS resources have required Nova tags"
+        check_id = "NOVA_TAG_NAMING"
+        supported_resources = ["*"]  # all resources
+        categories = [CheckCategories.GENERAL_SECURITY]
+        super().__init__(name=name, check_id=check_id, categories=categories, supported_resources=supported_resources)
+
+    def scan_resource_conf(self, conf, entity_type):
+        # Skip non-taggable resources
+        if entity_type in NON_TAGGABLE_TYPES:
+            return CheckResult.PASSED
+        # Check for a tags block
+        tags = conf.get("tags")
+        if not tags:
+            return CheckResult.FAILED
+        tag_keys = set()
+        if isinstance(tags, list) and tags:
+            tag_block = tags[0]
+            if isinstance(tag_block, dict):
+                tag_keys = set(tag_block.keys())
+        elif isinstance(tags, dict):
+            tag_keys = set(tags.keys())
+        # P5 (REQ-164): any legacy acdl:* tag key present = hard FAIL.
+        legacy_present = tag_keys & set(LEGACY_TAGS)
+        if legacy_present:
+            return CheckResult.FAILED
+        missing = [t for t in REQUIRED_TAGS if t not in tag_keys]
+        if not missing:
+            return CheckResult.PASSED
+        return CheckResult.FAILED
+
+check = NovaTaggingStandard()
@@ -14,7 +14,8 @@ concerns split into two tiers:
 The operator-supplied evidence artifact is a JSON blob with `timestamp`,
 `type`, `payload`, and an optional `signature` (JWS detached). Freshness
 is validated against the window from §10.4. Signature verification runs
-when `ACDL_ATTESTATION_SIGNING_KEY_ID` is set; it is skipped + logged
+when `NOVA_ATTESTATION_SIGNING_KEY_ID` is set (dual-read via core/env.py:
+NOVA_* preferred, ACDL_* fallback until P5); it is skipped + logged
 when unset (dev/CI — D-089). The matrix fails loud if an operator-supplied
 concern is missing or expired for prod/dr.
 """
@@ -24,6 +25,14 @@ import os
 import sys
 from typing import Optional, Tuple

+# Repo root on sys.path so `from core import env` resolves to THIS package
+# when run as a script (avoids editable-installed third-party `core` shadow).
+_REPO_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+if _REPO_ROOT not in sys.path:
+    sys.path.insert(0, _REPO_ROOT)
+
+from core import env
+

 # Freshness windows (days) from hitl_matrix_design.md §10.4.
 FRESHNESS_DAYS = {
@@ -81,14 +90,15 @@ def _is_fresh(artifact: dict, concern: str) -> bool:


 def _verify_signature(artifact: dict) -> bool:
-    """Verify the JWS detached signature when ACDL_ATTESTATION_SIGNING_KEY_ID is set.
+    """Verify the JWS detached signature when NOVA_ATTESTATION_SIGNING_KEY_ID is set.

    When unset (dev/CI — D-089), signature verification is skipped + logged.
+    Dual-read via core/env.py: NOVA_* preferred, ACDL_* fallback until P5.
    """
-    key_id = os.environ.get("ACDL_ATTESTATION_SIGNING_KEY_ID", "")
+    key_id = env.get_env("ATTESTATION_SIGNING_KEY_ID", "") or ""
    if not key_id:
        sys.stderr.write(
-            "[attestation] ACDL_ATTESTATION_SIGNING_KEY_ID unset — "
+            "[attestation] NOVA_ATTESTATION_SIGNING_KEY_ID unset — "
            "signature verification skipped (dev/CI, D-089)\n"
        )
        return True
@@ -36,6 +36,16 @@ import sys
 import yaml
 import jsonschema

+# Ensure the repo root (parent of core/) is on sys.path so `from core
+# import env` resolves to THIS package when contract_resolver.py is run
+# as a script (python3 core/contract_resolver.py) — otherwise an
+# editable-installed third-party `core` package can shadow it.
+_REPO_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+if _REPO_ROOT not in sys.path:
+    sys.path.insert(0, _REPO_ROOT)
+
+from core import env
+

 def _load_env(env_name, repo_root):
    """Load the environment onboarding JSON for env_name.
@@ -620,9 +630,10 @@ if __name__ == "__main__":
        idx = sys.argv.index("--environment")
        if idx + 1 < len(sys.argv):
            env_override = sys.argv[idx + 1]
-    # Also honor the ACDL_ENVIRONMENT_OVERRIDE env var (used by run_platform.sh).
-    if env_override is None and os.environ.get("ACDL_ENVIRONMENT_OVERRIDE"):
-        env_override = os.environ["ACDL_ENVIRONMENT_OVERRIDE"]
+    # Also honor the NOVA_ENVIRONMENT_OVERRIDE env var (used by run_platform.sh).
+    # Dual-read via core/env.py: NOVA_* preferred, ACDL_* fallback until P5.
+    if env_override is None and env.get_env("ENVIRONMENT_OVERRIDE"):
+        env_override = env.get_env("ENVIRONMENT_OVERRIDE")
    result = resolve(contract_path, environment_override=env_override)
    with open(out_path, "w") as fh:
        json.dump(result, fh, indent=2)
@@ -0,0 +1,31 @@
+"""Environment helper (D-108, REQ-159, REQ-164).
+
+During the Nova rebrand transition window (P2–P4), `get_env` read
+`NOVA_*` preferred with the legacy `ACDL_*` name as the fallback. **P5
+(REQ-164) removed the fallback** — `get_env` now reads `NOVA_*` only.
+
+`get_env(name, default=None)` resolves `NOVA_<name>`, then returns
+`default` if unset. Direct-read paths that bypass this helper (the
+`.env.secrets` shell export in `scripts/run_platform.sh` and the Python
+parser in `core/regression_verify.py`) were updated to NOVA-only in P5
+(the G-106 dual-read contract was retired with the fallback).
+"""
+
+from __future__ import annotations
+
+import os
+from typing import Optional
+
+__all__ = ["get_env"]
+
+
+def get_env(name: str, default: Optional[str] = None) -> Optional[str]:
+    """Resolve a config value from the `NOVA_*` environment.
+
+    `name` is the bare key WITHOUT the prefix (e.g. ``"AWS_ACCOUNT_ID"``).
+    Returns ``NOVA_<name>`` if set and non-empty, else ``default``.
+    """
+    val = os.environ.get(f"NOVA_{name}")
+    if val:
+        return val
+    return default
@@ -93,7 +93,7 @@ The full table (lifted verbatim from §10.4):
 The operator-supplied evidence artifact is a JSON blob with `timestamp`,
 `type`, `payload`, and an optional `signature` (JWS detached). Freshness
 is validated against the window above. Signature verification runs when
-`ACDL_ATTESTATION_SIGNING_KEY_ID` is set; it is skipped + logged when
+`NOVA_ATTESTATION_SIGNING_KEY_ID` is set; it is skipped + logged when
 unset (dev/CI — D-089). The matrix fails loud if an operator-supplied
 concern is missing or expired for prod/dr.

@@ -140,7 +140,7 @@ not Kyverno (in v1). Sequence:
   in the same process that has authority to block the promotion.

 v1.9 implements `route_halt_artifact` as a real SNS publish (topic
-`acdl-sod-halt`, ARN from `ACDL_SOD_HALT_TOPIC_ARN`) with an outbox-event
+`acdl-sod-halt`, ARN from `NOVA_SOD_HALT_TOPIC_ARN`) with an outbox-event
 fallback when the topic ARN is unset (REQ-107). The attestation gate
 itself is `core/hitl_gates.py` (`attest(contract_id, env, approver,
 evidence)`), which records the approver to the outbox, runs the SoD
@@ -171,5 +171,5 @@ v1.9 (Phase 41 + Phase 42) wires the gates end-to-end:
  concerns run for real; operator-supplied concerns accept signed
  evidence artifacts validated for freshness + schema.
 - **D-089** (v1.9) — attestation artifact signature verification is
-  skipped when `ACDL_ATTESTATION_SIGNING_KEY_ID` is unset (dev/CI);
+  skipped when `NOVA_ATTESTATION_SIGNING_KEY_ID` is unset (dev/CI);
  required for prod/dr.
@@ -2,7 +2,7 @@

 Invoked via a Function URL (IAM auth) by consumer pipelines (one-way
 communication, D-051). Accepts { consumerRepo, contractId, contract,
-environment, action } and writes contracts to DynamoDB table acdl-contracts
+environment, action } and writes contracts to DynamoDB table nova-contracts
 (PK consumerRepo, SK contractId#submittedAt).

 The report_error action (D-055) creates a GitHub issue on the platform repo
@@ -22,10 +22,10 @@ import urllib.parse

 import boto3

-TABLE_NAME = os.environ.get("CONTRACTS_TABLE", "acdl-contracts")
-CHANGE_REQUESTS_TABLE = os.environ.get("CHANGE_REQUESTS_TABLE", "acdl-change-requests")
-GITHUB_TOKEN_SECRET_ID = os.environ.get("GITHUB_TOKEN_SECRET_ID", "acdl/github-token")
-PLATFORM_REPO = os.environ.get("PLATFORM_REPO", "acdl/acdl")
+TABLE_NAME = os.environ.get("CONTRACTS_TABLE", "nova-contracts")
+CHANGE_REQUESTS_TABLE = os.environ.get("CHANGE_REQUESTS_TABLE", "nova-change-requests")
+GITHUB_TOKEN_SECRET_ID = os.environ.get("GITHUB_TOKEN_SECRET_ID", "nova/github-token")
+PLATFORM_REPO = os.environ.get("PLATFORM_REPO", "nova/acdl")
 # P1-9: Forge-agnostic API base URL. Defaults to GitHub; set GITHUB_API_BASE
 # to a Gitea API root (e.g. https://git.cloudinit.dev/api/v1) for Gitea.
 GITHUB_API_BASE = os.environ.get("GITHUB_API_BASE", "https://api.github.com")
@@ -243,7 +243,7 @@ def _validate_caller_identity(event, payload):
    error length. The ABAC reliance is documented here: the Function URL IAM
    identity does not expose principal tags in the event, so full enforcement
    of consumerRepo ownership is at the IAM layer (ABAC via
-    aws:PrincipalTag/acdl:owner). This function validates format only, not
+     aws:PrincipalTag/nova:owner). This function validates format only, not
    ownership.
    """
    identity = event.get("requestContext", {}).get("identity", {})
@@ -279,7 +279,7 @@ def _validate_caller_identity(event, payload):
 def _validate_change_request(payload):
    """REQ-93: Validate a change request ID against the CMDB (DynamoDB).

-    Queries the acdl-change-requests table for the given changeRequestId.
+    Queries the nova-change-requests table for the given changeRequestId.
    Returns the CR details if status is 'approved' and the consumerRepo matches.
    Raises ValueError if the CR is not found, not approved, or the repo doesn't match.
    """
@@ -12,7 +12,8 @@ evidence event) runs end-to-end against the local tier with no AWS:

 Each adapter exposes the same interface as the live counterpart so the
 caller code path is unchanged; only the I/O target swaps. Selection is
-gated on the ACDL_LOCAL_TIER env var (set by run_platform.sh --local).
+gated on the NOVA_LOCAL_TIER env var (set by run_platform.sh --local).
+Dual-read via core/env.py: NOVA_* preferred, ACDL_* fallback until P5.
 """

 from __future__ import annotations
@@ -32,12 +33,20 @@ from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any, Dict, List, Optional, Tuple

+# Repo root on sys.path so `from core import env` resolves to THIS package
+# when run as a script (avoids editable-installed third-party `core` shadow).
+_REPO_ROOT = str(Path(__file__).resolve().parent.parent)
+if _REPO_ROOT not in sys.path:
+    sys.path.insert(0, _REPO_ROOT)
+
+from core import env
+
 ROOT = Path(__file__).resolve().parent.parent


 def is_local_tier() -> bool:
    """True when the local emulating tier is active."""
-    return os.environ.get("ACDL_LOCAL_TIER", "") == "1"
+    return env.get_env("LOCAL_TIER", "") == "1"


 # ---------------------------------------------------------------------------
@@ -78,7 +87,7 @@ class FlatFileOutbox:
        return hashlib.sha256(canonical.encode("utf-8")).hexdigest()

    def write_event(self, event: Dict[str, Any],
-                    outbox_table: str = "acdl-outbox-local",
+                    outbox_table: str = "nova-outbox-local",
                    region: str = "local") -> Dict[str, Any]:
        """Write an evidence event to the flat-file outbox.

@@ -286,7 +295,7 @@ class LocalLambdaStub:

        Returns the handler's response dict
        ({statusCode, body}). The handler's DynamoDB calls are
-        intercepted via the ACDL_LOCAL_TIER env var (the handler checks
+        intercepted via the NOVA_LOCAL_TIER env var (the handler checks
        _get_dynamodb(); under local tier it would need patching - we
        patch the module's _get_dynamodb to return a local stub)."""
        # Import the handler module (the dir is named `lambda`, a Python
@@ -419,7 +428,7 @@ def run_local_e2e(contract_path: str, repo_root: Optional[Path] = None) -> Dict[

        stack = resolve(contract_path, str(root))
        stack_name = stack["stack"]["name"]
-        work = Path(tempfile.mkdtemp(prefix="acdl_local_e2e_"))
+        work = Path(tempfile.mkdtemp(prefix="nova_local_e2e_"))
        tf_dir = work / "tf"
        tf_dir.mkdir(exist_ok=True)
        adapter.adapt(stack, str(tf_dir))
@@ -490,6 +499,9 @@ def run_local_e2e(contract_path: str, repo_root: Optional[Path] = None) -> Dict[

 if __name__ == "__main__":
    contract = sys.argv[1] if len(sys.argv) > 1 else "contracts/microservice.yml"
-    os.environ["ACDL_LOCAL_TIER"] = "1"
+    # Set both so the dual-read in is_local_tier() finds NOVA_* (preferred);
+    # the ACDL_* alias stays for any unmigrated reader until P5.
+    os.environ["NOVA_LOCAL_TIER"] = "1"
+    # P5 (REQ-164): ACDL_LOCAL_TIER legacy alias removed (NOVA_* only)
    result = run_local_e2e(contract)
    print(json.dumps(result, indent=2))
@@ -1,11 +1,11 @@
-"""ACDL Outbox Writer — write an evidence event to the DynamoDB outbox.
+"""Nova Outbox Writer — write an evidence event to the DynamoDB outbox.

 ARCHITECTURE.md §9: DynamoDB outbox, RPO=0 (synchronous write before
 ack). The event is hash-chained (SHA-256 over canonical JSON); the first
 event has prev_event_hash="GENESIS". D-P10-3: the spike writes ONE
 CONFIDENCE_COMPUTED event.

-The outbox table (Phase 08): acdl-outbox, PAY_PER_REQUEST, PK contractId,
+The outbox table (Phase 08): nova-outbox, PAY_PER_REQUEST, PK contractId,
 SK eventType#eventTs, TTL expire_at = now + 365d (D-044).

 CLI: outbox_writer.py <event.json>  (uses AWS creds from env)
@@ -20,7 +20,7 @@ import sys
 import boto3


-OUTBOX_TABLE = "acdl-outbox"
+OUTBOX_TABLE = "nova-outbox"
 REGION = os.environ.get("AWS_DEFAULT_REGION", "us-east-1")


@@ -8,8 +8,10 @@ Two canonical mechanisms:
     strings, ALB DNS, S3 bucket URL, CloudFront domain). No raw secrets in
     the comment — only non-sensitive outputs (DNS names, ARNs, bucket names).

-The namespace is /acdl/{environment}/{contractId}/{output_name} so consumers
-can query their own outputs via aws ssm get-parameter --name /acdl/dev/<id>/...
+The namespace is /nova/{environment}/{contractId}/{output_name} so consumers
+can query their own outputs via aws ssm get-parameter --name /nova/dev/<id>/...
+(REQ-161, P3: migrated from /acdl/... ; scripts/migrate_ssm_paths.py copies
+existing /acdl/... parameters to /nova/... and deletes the old ones.)
 """

 import json
@@ -21,8 +23,16 @@ try:
 except ImportError:
    boto3 = None

-SSM_PREFIX = "/acdl"
-KMS_KEY_ID_ENV = "ACDL_KMS_KEY_ID"
+# Repo root on sys.path so `from core import env` resolves to THIS package
+# when run as a script (avoids editable-installed third-party `core` shadow).
+_REPO_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+if _REPO_ROOT not in sys.path:
+    sys.path.insert(0, _REPO_ROOT)
+
+from core import env as _envhelper
+
+SSM_PREFIX = "/nova"
+KMS_KEY_ID_ENV = "NOVA_KMS_KEY_ID"

 # Outputs that are safe to display in a PR comment (no secrets).
 SAFE_OUTPUT_NAMES = {
@@ -54,20 +64,22 @@ def _ssm_client():
 def _kms_key_id():
    """Return the KMS key ID for SSM SecureString encryption.

-    P1-3: Fail loud when ACDL_KMS_KEY_ID is not set — silently falling back
+    P1-3: Fail loud when NOVA_KMS_KEY_ID is not set — silently falling back
    to the AWS-managed key (`alias/aws/ssm`) was a security gap. The platform
-    CMK must be explicitly configured. Set ACDL_ALLOW_DEFAULT_KMS=1 to use
-    the AWS-managed key as an escape hatch for local testing.
+    CMK must be explicitly configured. Set NOVA_ALLOW_DEFAULT_KMS=1 to use
+    the AWS-managed key as an escape hatch for local testing. (Dual-read
+    via core/env.py: NOVA_* preferred, ACDL_* fallback until P5.)
    """
-    key_id = os.environ.get(KMS_KEY_ID_ENV)
+    key_id = _envhelper.get_env("KMS_KEY_ID")
    if key_id:
        return key_id
-    if os.environ.get("ACDL_ALLOW_DEFAULT_KMS") == "1":
+    if _envhelper.get_env("ALLOW_DEFAULT_KMS") == "1":
        return "alias/aws/ssm"
    raise RuntimeError(
        f"{KMS_KEY_ID_ENV} is not set — refusing to use the AWS-managed SSM key "
        f"silently. Set {KMS_KEY_ID_ENV} to your platform CMK ARN, or set "
-        f"ACDL_ALLOW_DEFAULT_KMS=1 to use alias/aws/ssm (escape hatch for local testing)."
+        f"NOVA_ALLOW_DEFAULT_KMS=1 (ACDL_ALLOW_DEFAULT_KMS=1 fallback) to use "
+        f"alias/aws/ssm (escape hatch for local testing)."
    )


@@ -112,7 +124,7 @@ def format_comment(outputs, environment, contract_id, ssm_results=None):
    outputs are noted as 'published to SSM' without their values.
    """
    lines = [
-        f"### ACDL Deploy Outputs ({environment})",
+        f"### Nova Deploy Outputs ({environment})",
        "",
        f"**Contract:** `{contract_id}`",
        f"**Environment:** `{environment}`",
@@ -134,7 +146,7 @@ def format_comment(outputs, environment, contract_id, ssm_results=None):
            ssm_path = "—"
        lines.append(f"| `{name}` | {display} | {ssm_path} |")
    lines.append("")
-    lines.append("> Sensitive outputs are available via `aws ssm get-parameter --name /acdl/" + environment + "/" + contract_id + "/<output_name>` (KMS-encrypted SecureString).")
+    lines.append("> Sensitive outputs are available via `aws ssm get-parameter --name /nova/" + environment + "/" + contract_id + "/<output_name>` (KMS-encrypted SecureString).")
    return "\n".join(lines)


@@ -32,6 +32,15 @@ from dataclasses import dataclass, field, asdict
 from pathlib import Path
 from typing import Callable, Dict, List, Optional, Tuple

+# Repo root on sys.path so `from core import env` resolves to THIS package
+# when regression_verify.py is run as a script (avoids editable-installed
+# third-party `core` shadow).
+_REPO_ROOT = str(Path(__file__).resolve().parent.parent)
+if _REPO_ROOT not in sys.path:
+    sys.path.insert(0, _REPO_ROOT)
+
+from core import env as _envhelper
+
 ROOT = Path(__file__).resolve().parent.parent
 CIAgent = ROOT / ".ciagent"

@@ -306,9 +315,10 @@ def _load_aws_env() -> Dict[str, str]:
                    continue
                if "=" in line:
                    k, v = line.split("=", 1)
-                    if k == "ACDL_AWS_ACCESS_KEY_ID":
+                    # P5 (REQ-164): dual-read fallback removed — NOVA_* only.
+                    if k == "NOVA_AWS_ACCESS_KEY_ID":
                        env["AWS_ACCESS_KEY_ID"] = v
-                    elif k == "ACDL_AWS_SECRET_ACCESS_KEY":
+                    elif k == "NOVA_AWS_SECRET_ACCESS_KEY":
                        env["AWS_SECRET_ACCESS_KEY"] = v
                    elif k == "AWS_DEFAULT_REGION":
                        env["AWS_DEFAULT_REGION"] = v
@@ -319,10 +329,11 @@ def _check_live_terraform_plan_microservice() -> Tuple[Status, str]:
    """CAP-013: terraform init+validate+plan against live AWS for the
    microservice stack (D-093 live-AWS tier of the headline E2E).

-    Requires AWS credentials (ACDL_AWS_ACCESS_KEY_ID etc. in .env.secrets).
+    Requires AWS credentials (NOVA_AWS_ACCESS_KEY_ID etc. in .env.secrets;
+    dual-read NOVA_* first, ACDL_* fallback per G-106).
    Runs in a temp dir; does NOT apply (plan only)."""
    import tempfile, os
-    work = tempfile.mkdtemp(prefix="acdl_regr_live_")
+    work = tempfile.mkdtemp(prefix="nova_regr_live_")
    stack_path = os.path.join(work, "stack.json")
    tf_dir = os.path.join(work, "tf")
    os.makedirs(tf_dir, exist_ok=True)
@@ -362,7 +373,7 @@ def _check_live_terraform_plan_static_assets() -> Tuple[Status, str]:
    """CAP-014: terraform init+validate+plan against live AWS for the
    static-assets stack (CloudFront + WAF + S3)."""
    import tempfile, os
-    work = tempfile.mkdtemp(prefix="acdl_regr_live_sa_")
+    work = tempfile.mkdtemp(prefix="nova_regr_live_sa_")
    stack_path = os.path.join(work, "stack.json")
    tf_dir = os.path.join(work, "tf")
    os.makedirs(tf_dir, exist_ok=True)
@@ -406,9 +417,9 @@ def _check_dynamodb_outbox_table() -> Tuple[Status, str]:
        dyn = boto3.client("dynamodb", region_name=env.get("AWS_DEFAULT_REGION", "us-east-1"),
                           aws_access_key_id=env.get("AWS_ACCESS_KEY_ID"),
                           aws_secret_access_key=env.get("AWS_SECRET_ACCESS_KEY"))
-        r = dyn.describe_table(TableName="acdl-outbox")
+        r = dyn.describe_table(TableName="nova-outbox")
        count = r["Table"].get("ItemCount", "unknown")
-        return "Verified", f"acdl-outbox exists, item_count={count}"
+        return "Verified", f"nova-outbox exists, item_count={count}"
    except Exception as e:
        return "Decayed", f"describe_table failed: {type(e).__name__}: {str(e)[:150]}"

@@ -421,8 +432,8 @@ def _check_s3_state_bucket() -> Tuple[Status, str]:
        s3 = boto3.client("s3", region_name=env.get("AWS_DEFAULT_REGION", "us-east-1"),
                          aws_access_key_id=env.get("AWS_ACCESS_KEY_ID"),
                          aws_secret_access_key=env.get("AWS_SECRET_ACCESS_KEY"))
-        account_id = os.environ.get("ACDL_AWS_ACCOUNT_ID", "581513795199")
-        state_bucket = f"acdl-tfstate-{account_id}-us-east-1"
+        account_id = _envhelper.get_env("AWS_ACCOUNT_ID", "581513795199")
+        state_bucket = f"nova-tfstate-{account_id}-us-east-1"
        s3.head_bucket(Bucket=state_bucket)
        r = s3.list_objects_v2(Bucket=state_bucket, MaxKeys=5)
        keys = [o["Key"] for o in r.get("Contents", [])]
@@ -494,7 +505,7 @@ def _check_lifecycle_l2_module(module: str) -> Tuple[Status, str]:


 def _check_cap_017_dynamodb() -> Tuple[Status, str]:
-    """CAP-017: DynamoDB acdl-contracts table. Evidence = L1 rds module
+    """CAP-017: DynamoDB nova-contracts table. Evidence = L1 rds module
    lifecycle pipeline green (terraform validate + contracts resolve).
    The DynamoDB table is created via the microservice stack (L2 lifecycle).
    """
@@ -509,7 +520,7 @@ def _check_cap_018_lambda() -> Tuple[Status, str]:
        "python3", "-c",
        "from core.local_emulators import LocalLambdaStub, FlatFileOutbox; "
        "import tempfile; "
-        "stub = LocalLambdaStub(outbox=FlatFileOutbox(tempfile.mkdtemp(prefix='acdl_stub_'))); "
+        "stub = LocalLambdaStub(outbox=FlatFileOutbox(tempfile.mkdtemp(prefix='nova_stub_'))); "
        "print('LocalLambdaStub instantiates OK')",
    ])
    if rc != 0:
@@ -578,7 +589,7 @@ CAPABILITY_REGISTRY: List[Tuple[str, str, str, Callable[[], Tuple[Status, str]]]
     _check_dynamodb_outbox_table),
    ("CAP-016", "S3 state bucket exists + readable (live AWS)", "live-aws",
     _check_s3_state_bucket),
-    ("CAP-017", "DynamoDB acdl-contracts table (lifecycle pipeline evidence)", "lifecycle-pipeline",
+    ("CAP-017", "DynamoDB nova-contracts table (lifecycle pipeline evidence)", "lifecycle-pipeline",
     _check_cap_017_dynamodb),
    ("CAP-018", "Lambda contract-ingestor (local stub + lifecycle evidence)", "lifecycle-pipeline",
     _check_cap_018_lambda),
@@ -643,8 +654,8 @@ def write_report(report: RegressionReport,


 def main() -> int:
-    milestone = os.environ.get("ACDL_REGRESSION_MILESTONE", "v1.10")
-    phase = int(os.environ.get("ACDL_REGRESSION_PHASE", "52"))
+    milestone = _envhelper.get_env("REGRESSION_MILESTONE", "v1.10") or "v1.10"
+    phase = int(_envhelper.get_env("REGRESSION_PHASE", "52") or "52")
    report = run_regression(milestone=milestone, phase=phase)
    md, js = write_report(report)
    print(f"regression: {report.summary} -> {md}")
@@ -5,16 +5,27 @@ Blocks on equality, emits `SEPARATION_OF_DUTIES_VIOLATION`, routes a halt
 artifact to SRE on-call.

 v1.9 (REQ-107, D-085): route_halt_artifact is a real implementation —
-publishes to SNS topic `acdl-sod-halt` (ARN from ACDL_SOD_HALT_TOPIC_ARN)
+publishes to SNS topic `acdl-sod-halt` (ARN from NOVA_SOD_HALT_TOPIC_ARN)
 when set; falls back to a structured stderr emission + a
 SEPARATION_OF_DUTIES_VIOLATION event write to the DynamoDB outbox when
-unset. No silent print-only stub.
+unset. No silent print-only stub. (Dual-read via core/env.py: NOVA_*
+preferred, ACDL_* fallback until P5; the SNS topic ARN is the AWS
+resource `acdl-sod-halt` → renamed `nova-sod-halt` in P4.)
 """

 import os
 import sys
 from typing import Optional, Tuple

+# Repo root on sys.path so `from core import env` resolves to THIS package
+# when imported/run in a context where an editable-installed third-party
+# `core` package would otherwise shadow it.
+_REPO_ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+if _REPO_ROOT not in sys.path:
+    sys.path.insert(0, _REPO_ROOT)
+
+from core import env
+

 def check(outbox_client, contract_id: str,
          current_prod_approver: Optional[str]) -> Tuple[bool, str]:
@@ -40,13 +51,13 @@ def route_halt_artifact(contract_id: str, violation_reason: str,
                        oncall_client=None) -> None:
    """Route a halt artifact to SRE on-call (REQ-107, D-085).

-    When ACDL_SOD_HALT_TOPIC_ARN is set, publish to the SNS topic via
+    When NOVA_SOD_HALT_TOPIC_ARN is set, publish to the SNS topic via
    boto3. When unset (dev/CI), fall back to a structured stderr emission
    + a SEPARATION_OF_DUTIES_VIOLATION event write to the DynamoDB outbox
    via outbox_writer.write_event (so the halt is in the audit chain).
    The oncall_client, when provided, is the SNS client (test injection).
    """
-    topic_arn = os.environ.get("ACDL_SOD_HALT_TOPIC_ARN", "")
+    topic_arn = env.get_env("SOD_HALT_TOPIC_ARN", "") or ""
    halt_payload = {
        "contractId": contract_id,
        "reason": violation_reason,
@@ -63,7 +74,7 @@ def route_halt_artifact(contract_id: str, violation_reason: str,
            sns.publish(
                TopicArn=topic_arn,
                Message=json.dumps(halt_payload),
-                Subject="ACDL SoD halt",
+                Subject="Nova SoD halt",
            )
            print(f"[halt-artifact] SNS published contract={contract_id} "
                  f"topic={topic_arn}", flush=True)
@@ -0,0 +1,270 @@
+# Nova AWS Resource Migration Runbook (REQ-163, P4)
+
+> **Milestone:** v1.15-Nova (Wave 4, P4). Renames every `acdl-*` AWS
+> resource name → `nova-*` via Terraform. This is the heaviest Terraform
+> phase of the rebrand and requires a **maintenance window**.
+>
+> **Plan-validated only.** Per A1, `NOVA_LIFECYCLE_MODE` defaults to
+> `plan` (no live AWS mutation from CI). `terraform validate` passes; the
+> live apply steps below are executed by a platform operator during the
+> scheduled maintenance window. Each step has a verification + rollback.
+
+## Scope (renamed resources)
+
+| AWS resource | Before | After | Strategy |
+|---|---|---|---|
+| KMS alias | `alias/acdl-platform` | `alias/nova-platform` | cheap rename |
+| SNS topic | `acdl-sod-halt` | `nova-sod-halt` | recreate |
+| Security group | `acdl-ecs-sg` | `nova-ecs-sg` | recreate |
+| Lambda (role/policy/function) | `acdl-contract-ingestor` | `nova-contract-ingestor` | recreate |
+| DynamoDB contracts | `acdl-contracts` | `nova-contracts` | scan + copy |
+| DynamoDB change-requests | `acdl-change-requests` | `nova-change-requests` | scan + copy |
+| Secrets Manager secret | `acdl/github-token` | `nova/github-token` | recreate + re-store |
+| ECR repo | `acdl-microservice` | `nova-microservice` | re-push |
+| ECS cluster/service/task/role | `acdl-microservice` | `nova-microservice` | recreate |
+| IAM user + policy | `acdl-spike-runner` (+ `-policy`) | `nova-spike-runner` (+ `-policy`) | re-bootstrap |
+| IAM act-runner role | `acdl-act-runner-role` | `nova-act-runner-role` | re-bootstrap |
+| IAM deploy role | `acdl-deploy-<repo>` | `nova-deploy-<repo>` | re-bootstrap |
+| S3 state bucket | `acdl-tfstate-581513795199-us-east-1` | `nova-tfstate-581513795199-us-east-1` | `-migrate-state` |
+| DynamoDB outbox | `acdl-outbox` | `nova-outbox` | scan + copy |
+| Platform VPC/subnet/IGW/RT | `acdl-shared*` | `nova-shared*` | recreate (brief downtime) |
+| CI VPC/subnet/SG/cluster | `acdl-ci-*` | `nova-ci-*` | recreate (CI-only) |
+| ALB name prefix | `acdl-alb` | `nova-alb` | recreate (brief downtime, LAST) |
+
+## Migration ordering (binding)
+
+Order: **KMS alias → SNS/SG → Lambda → DynamoDB → ECR → IAM → state bucket → ALB**.
+Each step is independently rollback-able. The ALB is last because it
+requires the briefest downtime window.
+
+---
+
+## Pre-flight
+
+1. **Announce the maintenance window** (consumers are notified via the
+   P1 migration guide `docs/NOVA_MIGRATION.md`).
+2. **Back up state** for every stack (see §State bucket — back up the
+   state JSON *before* `-migrate-state`).
+3. Confirm `NOVA_LIFECYCLE_MODE=plan` (default) so CI does not mutate
+   AWS during the window.
+4. Confirm the new `nova-*` destination tables/repos will be created by
+   the same Terraform apply (no manual pre-creation needed).
+
+## Step 1 — KMS alias (`alias/acdl-platform` → `alias/nova-platform`)
+
+- **Command (in `terraform/platform/`):**
+  ```bash
+  terraform init -upgrade
+  terraform apply -replace=aws_kms_alias.nova_platform
+  ```
+  (Terraform destroys the old alias + creates the new one — aliases are
+  cheap; the underlying key ID is unchanged.)
+- **Verify:** `aws kms list-aliases --query 'Aliases[?AliasName==`alias/nova-platform`]'` returns the new alias; `alias/acdl-platform` is gone.
+- **Rollback:** `terraform apply -replace=aws_kms_alias.nova_platform` against the prior revision (re-creates `alias/acdl-platform`). Resources encrypted by the key are unaffected (key ID unchanged).
+
+## Step 2 — SNS topic + Security group (recreate)
+
+- **Command:** `terraform apply` in `terraform/platform/`.
+  - SNS `acdl-sod-halt` → `nova-sod-halt` (the topic ARN changes; update `NOVA_SOD_HALT_TOPIC_ARN` wherever it is set).
+  - SG `acdl-ecs-sg` → `nova-ecs-sg` (the security group is re-attached to running ECS tasks; brief task restart).
+- **Verify:** `aws sns list-topics` shows `nova-sod-halt`; `aws ec2 describe-security-groups` shows `nova-ecs-sg`.
+- **Rollback:** `terraform apply` the prior revision re-creates the `acdl-*` names. The SNS topic has no message backlog (halt artifacts are fire-and-forget); the SG drift resolves on next task deploy.
+
+## Step 3 — Lambda (recreate)
+
+- **Command:** `terraform apply` in `terraform/platform/`.
+  - Lambda function `acdl-contract-ingestor` → `nova-contract-ingestor`.
+  - Execution role `acdl-contract-ingestor-role` → `nova-contract-ingestor-role`.
+  - Inline policy `acdl-contract-ingestor-policy` → `nova-contract-ingestor-policy`.
+  - The Lambda env vars (`CONTRACTS_TABLE`, `GITHUB_TOKEN_SECRET_ID`) now resolve to `nova-*` defaults.
+- **Verify:** `aws lambda list-functions` shows `nova-contract-ingestor`; the Function URL returns 200 on a SigV4-signed invoke. The `consumer_invoke_policy.json` rendered output (Terraform `consumer_invoke_policy_rendered`) now references `function:nova-contract-ingestor` — re-distribute to consumer deploy roles.
+- **Rollback:** `terraform apply` the prior revision re-creates `acdl-contract-ingestor`. Consumer deploy roles must point back at the old Function ARN (re-distribute the prior `consumer_invoke_policy.json`).
+
+## Step 4 — DynamoDB (scan + copy)
+
+DynamoDB table names are immutable post-creation, so the migration is a
+**scan + copy** (not a rename). The new `nova-*` tables are created by
+the same Terraform apply (Step 3). The data-migration script copies
+every item and verifies row counts.
+
+- **Command (from repo root):**
+  ```bash
+  # Dry-run first (no writes):
+  python3 scripts/migrate_dynamodb_data.py
+  # Execute the copy:
+  python3 scripts/migrate_dynamodb_data.py --apply
+  # A single table:
+  python3 scripts/migrate_dynamodb_data.py --table contracts --apply
+  ```
+  The script scans `acdl-contracts` → copies to `nova-contracts`, and
+  `acdl-change-requests` → `nova-change-requests`, then verifies the
+  destination row count == source row count (re-scan, not
+  `DescribeTable.ItemCount` which lags ~6h).
+- **Verify:**
+  ```bash
+  # Row counts must match (printed by the script). Manual cross-check:
+  aws dynamodb scan --table-name nova-contracts --select COUNT
+  aws dynamodb scan --table-name acdl-contracts --select COUNT
+  ```
+  Then **point consumers at the new tables** (the Lambda already reads
+  `nova-*` defaults; any direct DynamoDB consumers update their env).
+- **Keep the old tables** (`acdl-contracts`, `acdl-change-requests`)
+  until consumers are verified reading from `nova-*`. **Deletion is a
+  manual post-verification step:**
+  ```bash
+  aws dynamodb delete-table --table-name acdl-contracts
+  aws dynamodb delete-table --table-name acdl-change-requests
+  ```
+  Only delete after a full soak period confirms `nova-*` reads succeed.
+- **Rollback:** Re-point consumers at `acdl-*` (the old tables are
+  retained). The copy is additive (no data loss). To roll back a partial
+  copy, re-run `--apply` (idempotent — `PutItem` overwrites).
+
+### Outbox table (`acdl-outbox` → `nova-outbox`)
+
+The evidence outbox table follows the same scan+copy pattern (it is
+created by `terraform/bootstrap/create_state_backend.py`).
+- **Command:** `python3 scripts/migrate_dynamodb_data.py --source acdl-outbox --dest nova-outbox --apply`
+- The `core/outbox_writer.py` default + `core/regression_verify.py`
+  CAP-015 probe now reference `nova-outbox` (P4 updated both). The
+  regression gate's live-AWS CAP-015 will return `Verified` once the
+  `nova-outbox` table exists live; until then it is `Decayed` (the gate
+  is re-run at milestone complete after the live migration).
+
+## Step 5 — ECR (re-push)
+
+- **Command:** `terraform apply` in `terraform/microservice/` creates
+  the new `nova-microservice` ECR repo. Re-push the image:
+  ```bash
+  python3 scripts/push_consumer_image.py   # creates nova-microservice + prints docker tag/push
+  ```
+  (The script's `ECR_REPO_NAME` is now `nova-microservice`.)
+- **Verify:** `aws ecr describe-repositories` shows `nova-microservice`; `docker pull <acct>.dkr.ecr.us-east-1.amazonaws.com/nova-microservice:latest` succeeds.
+- **Rollback:** The old `acdl-microservice` repo is retained until the
+  soak passes. Re-push to it if a rollback is needed. Delete it manually:
+  `aws ecr delete-repository --repository-name acdl-microservice --force`.
+
+## Step 6 — IAM (re-bootstrap)
+
+- **Command:**
+  ```bash
+  export NOVA_BOOTSTRAP_AWS_ACCESS_KEY_ID="<root key>"
+  export NOVA_BOOTSTRAP_AWS_SECRET_ACCESS_KEY="<root secret>"
+  python3 terraform/bootstrap/create_state_backend.py        # creates nova-outbox (idempotent)
+  python3 terraform/bootstrap/create_iam_user.py             # creates nova-spike-runner
+  python3 terraform/bootstrap/apply_iam_baseline.py          # creates nova-spike-runner-policy + nova-act-runner-role
+  bash scripts/rotate_spike_key.sh                          # rotates the nova-spike-runner key
+  ```
+  The deploy role `acdl-deploy-<repo>` → `nova-deploy-<repo>` is
+  created by the bootstrap (the deploy workflow
+  `.gitea/.github/workflows/deploy.yml` now references
+  `role/nova-deploy-{1}`).
+- **Verify:** `aws iam get-user --user-name nova-spike-runner`;
+  `aws iam list-attached-user-policies --user-name nova-spike-runner`
+  shows `nova-spike-runner-policy`;
+  `aws iam get-role --role-name nova-act-runner-role`.
+- **Rollback:** Re-run the prior bootstrap scripts (they create
+  `acdl-spike-runner` + `acdl-act-runner-role`). The deploy workflow's
+  `role-to-assume` must be reverted to `acdl-deploy-` (prior revision).
+
+## Step 7 — State bucket (`acdl-tfstate-*` → `nova-tfstate-*`, `-migrate-state`)
+
+The S3 state backend is renamed. Terraform's `-migrate-state` copies the
+state objects to the new bucket. **Back up the state JSON first.**
+
+- **Back up state (per stack):**
+  ```bash
+  for stack in platform microservice ci-vpc; do
+    aws s3 cp s3://acdl-tfstate-581513795199-us-east-1/$stack/terraform.tfstate \
+      ./backup-$stack.tfstate
+  done
+  ```
+- **Command (per stack):** the backend config in each
+  `terraform/*/terraform.tf` now points at `nova-tfstate-...`.
+  ```bash
+  cd terraform/platform
+  terraform init -migrate-state        # copies state acdl-tfstate → nova-tfstate
+  cd ../microservice
+  terraform init -migrate-state
+  cd ../ci-vpc
+  terraform init -migrate-state
+  ```
+- **Verify:** `aws s3 ls s3://nova-tfstate-581513795199-us-east-1/`
+  shows the state keys; `terraform state list` in each dir lists the
+  expected resources.
+- **Rollback:** Point the backend back at `acdl-tfstate-*` and re-run
+  `terraform init -migrate-state` (restores from the backup bucket). The
+  old `acdl-tfstate-*` bucket is retained until the soak passes. Delete
+  it manually:
+  `aws s3 rb s3://acdl-tfstate-581513795199-us-east-1 --force`.
+
+## Step 8 — ALB (recreate, brief downtime, LAST)
+
+The ALB is last because its recreation requires the briefest downtime
+window (the ECS service is re-attached to the new target group).
+
+- **Command:** `terraform apply` in `terraform/microservice/`. The ALB
+  `acdl-microservice` / `acdl-alb` → `nova-microservice` / `nova-alb`.
+- **Verify:** `aws elbv2 describe-load-balancers` shows the new ALB;
+  `curl http://<new-alb-dns>/` returns 200.
+- **Rollback:** `terraform apply` the prior revision re-creates the
+  `acdl-*` ALB (brief downtime again). The old ALB DNS is retained until
+  consumers are re-pointed.
+
+---
+
+## Post-migration
+
+1. **Soak:** run consumers against `nova-*` for a full verification
+   window (deploy a test contract end-to-end).
+2. **Delete old resources** (manual, only after soak):
+   - DynamoDB: `acdl-contracts`, `acdl-change-requests`, `acdl-outbox`
+   - ECR: `acdl-microservice`
+   - IAM: `acdl-spike-runner` (+ policy), `acdl-act-runner-role`,
+     `acdl-deploy-<repo>`
+   - S3: `acdl-tfstate-581513795199-us-east-1`
+   - SNS: `acdl-sod-halt`
+   - SG: `acdl-ecs-sg`
+   - Secrets Manager: `acdl/github-token`
+   - KMS alias: `alias/acdl-platform`
+   - ALB: `acdl-alb` / `acdl-microservice`
+3. **Regression gate:** re-run `bash scripts/run_regression.sh`. The
+   live-AWS CAP-013..016 probes should return `Verified` (the `nova-*`
+   tables + state bucket exist). CAP-015 (outbox) flips from `Decayed`
+   → `Verified` once `nova-outbox` is live.
+
+## What P5 owns (not P4)
+
+- **Remove dual-read fallback:** `core/env.py` `get_env()` drops the
+  `ACDL_*` fallback; shell scripts drop `:-$ACDL_X`. P4 keeps the
+  dual-read (deployments don't break mid-window).
+- **`nova_tagging.py` hard-fail on `acdl:*`:** P3 set hard mode (no
+  `acdl:*`-only tags); P5 tightens to fail on any `acdl:*` presence. P4
+  leaves P3's behavior.
+- **Delete `ACDL_*` Gitea secrets:** the `NOVA_*` aliases created in P2
+  are now the only source.
+- **Finalize `docs/NOVA_MIGRATION.md`:** mark the migration complete
+  (cutoff passed).
+- **Milestone ship:** tag `v1.15.4`, merge to `main`, Gitea release.
+
+## Files touched in P4
+
+- `terraform/platform/main.tf`, `terraform/microservice/main.tf`,
+  `terraform/ci-vpc/main.tf` — resource renames + backend bucket.
+- `terraform/{platform,microservice,ci-vpc}/terraform.tf` — state bucket.
+- `terraform/platform/consumer_invoke_policy.json` — Lambda ARN.
+- `terraform/bootstrap/{create_state_backend,create_iam_user,apply_iam_baseline}.py`,
+  `spike_runner_policy.json`, `.bootstrap_state.json`, `README.md` —
+  IAM/outbox/state-bucket renames.
+- `modules/l1/*/terraform/**` + `modules/l1/alb/instance.json` — L1
+  resource-name defaults.
+- `modules/l2/microservice/composition.json` — `nova-app-role` default.
+- `core/lambda/contract_ingestor.py` — default table names (D-111).
+- `core/outbox_writer.py`, `core/regression_verify.py`,
+  `core/local_emulators.py` — outbox table consistency (cross-territory,
+  minimal).
+- `.gitea/workflows/deploy.yml` + `.github/workflows/deploy.yml` —
+  `nova-deploy-` role ARN + artifact names.
+- `scripts/migrate_dynamodb_data.py` (NEW), `scripts/rotate_spike_key.sh`,
+  `scripts/push_consumer_image.py`.
+- `tests/**` — fixtures updated to assert `nova-*`.
@@ -1,16 +1,17 @@
 # Nova Migration Guide — What Consumers Must Know

-> **Nova** is the new product brand for the platform formerly known as
-> **ACDL** (Agentic Cloud Delivery Platform). This guide announces the
-> scheduled breaking changes coming in the rebrand rollout (Phases P2–P4)
-> and tells you exactly what to do, when, and how long you have.
+> **STATUS: COMPLETE (milestone v1.15.4, 2026-07-30).** The Nova rebrand
+> is fully rolled out. The dual-read / parallel-write grace period has
+> ended (P5 cutoff passed). All `ACDL_*` env var fallbacks, `.acdl/`
+> consumer-path fallbacks, `/acdl/` SSM-path fallbacks, `acdl:*` tag-key
+> fallbacks, and `acdl-*` AWS resource names are removed. Consumers must
+> use the `NOVA_*` / `.nova/` / `/nova/` / `nova:*` / `nova-*` names
+> exclusively. If you have not yet migrated, follow the steps below.

-The product is being rebranded **A C D L → Nova**. The rebrand is staged
-across phases so that **no consumer deployment breaks during the
-transition**. Phases P2–P4 ship the breaking changes behind a **dual-read
-/ parallel-write grace period**; Phase P5 removes the fallback and the old
-names stop working. This document is the consumer-facing contract for that
-rollout.
+> **Nova** is the new product brand for the platform formerly known as
+> **ACDL** (Agentic Cloud Delivery Platform). This guide documents the
+> breaking changes from the rebrand rollout (Phases P2–P4, cutoff P5)
+> and tells you exactly what to do.

 ## What is NOT changing

@@ -63,15 +64,18 @@ scheduled into a phase, ships with a grace period, and has a cutoff.
  dual-read, you can do this incrementally across P2–P4 — but it must be
  complete before P5.

-### 3. SSM parameter path — Phase P3
+### 3. SSM parameter path — Phase P3 (DONE)

 - **Old:** `/acdl/{env}/{contractId}/{output}`
 - **New:** `/nova/{env}/{contractId}/{output}`
- **Phase:** P3 (SSM paths + tag keys)
+- **Phase:** P3 (SSM paths + tag keys) — **shipped in P3**
 - **Grace period — parallel-write:** during P3–P4 the platform **writes
  every output to both** the `/acdl/…` and `/nova/…` SSM paths, and reads
  from `/nova/…` first (falling back to `/acdl/…`). Any hardcoded SSM path
-  reads in your application code keep resolving through P4.
+  reads in your application code keep resolving through P4. The P3
+  migration script (`scripts/migrate_ssm_paths.py`) copies existing
+  `/acdl/…` parameters to `/nova/…`, verifies the copy, and deletes the
+  old ones.
 - **Cutoff:** P5 stops writing to `/acdl/…` and removes the read fallback.
  After P5 only `/nova/…` exists.
 - **What you must do:** if your application code or runbooks read deploy
@@ -80,19 +84,22 @@ scheduled into a phase, ships with a grace period, and has a cutoff.
  issue surface, you do nothing — the platform republishes under the new
  path automatically.

-### 4. AWS tag keys — Phase P3
+### 4. AWS tag keys — Phase P3 (DONE)

 - **Old:** `acdl:owner`, `acdl:environment`, `acdl:contract`,
  `acdl:cost-center`, `acdl:ref`
 - **New:** `nova:owner`, `nova:environment`, `nova:contract`,
  `nova:cost-center`, `nova:ref`
- **Phase:** P3 (SSM paths + tag keys)
+- **Phase:** P3 (SSM paths + tag keys) — **shipped in P3**
 - **Grace period — parallel-tag period:** during P3–P4 the platform
  **tags every resource with both** the `acdl:*` and `nova:*` keys (same
  values). The ABAC session policy matches on **either** key set, so your
  existing scoped permissions keep working. The default cost-center value
  moves from `acdl-default` to `nova-default` (both written during the
-  parallel-tag period).
+  parallel-tag period). Terraform now emits `nova:*` keys; old `acdl:*`
+  tags on pre-P3 live resources are removed by the P4 runbook's
+  `scripts/untag_acdl_keys.py` step after the `nova:*` tags are applied
+  live.
 - **Cutoff:** P5 stops writing the `acdl:*` keys and the ABAC policy matches
  only on `nova:*`. After P5, resources created before P5 still carry the
  old `acdl:*` tags (tags are not retroactively rewritten) but **new**
@@ -53,7 +53,7 @@ platform-managed. See [Environments](environments/).
 ## Step 1 — Create a consumer repo

 Create a repository for your application. The top level holds your app
-code; your contract lives at `.acdl/contract.yml`. Example for a static
+code; your contract lives at `.nova/contract.yml`. Example for a static
 site:

 ```
@@ -62,7 +62,7 @@ my-static-site/
  assets/
    style.css
    logo.png
-  .acdl/
+  .nova/
    contract.yaml
  .github/
    workflows/
@@ -75,7 +75,7 @@ Example for a microservice:
 my-microservice/
  app.py
  Dockerfile
-  .acdl/
+  .nova/
    contract.yaml
  .github/
    workflows/
@@ -83,7 +83,7 @@ my-microservice/
 ```

 Your app code lives at the top level. Your contract lives at
-`.acdl/contract.yml` regardless of the module you deploy. Your CI
+`.nova/contract.yml` regardless of the module you deploy. Your CI
 definition lives at `.github/workflows/deploy.yml`.

 ## Step 2 — Reference the central pipeline
@@ -96,7 +96,7 @@ jobs:
  deploy:
    uses: acdl/.github/workflows/deploy.yml@v1.13
    with:
-      contract: .acdl/contract.yml
+      contract: .nova/contract.yml
      environment: dev
 ```

@@ -106,7 +106,7 @@ field; the version pin lives in the CI workflow reference.

 ## Step 3 — Define the contract

-Write `.acdl/contract.yml`. The `static-assets` example:
+Write `.nova/contract.yml`. The `static-assets` example:

 ```yaml
 environment: dev
@@ -179,7 +179,7 @@ jobs:
  deploy:
    uses: acdl/.github/workflows/deploy.yml@v1.13
    with:
-      contract: .acdl/contract.yml
+      contract: .nova/contract.yml
 ```

 That is the entire consumer-side workflow. When you push to `main`:
@@ -192,7 +192,7 @@ That is the entire consumer-side workflow. When you push to `main`:
   never clone the platform repo yourself.
 4. The runner installs the runtime dependencies the platform requires.
 5. The runner invokes `scripts/run_platform.sh` against your
-   `.acdl/contract.yml`.
+   `.nova/contract.yml`.

 You see the streamed output (infrastructure plan, policy-check results,
 confidence signal) in your run logs. The `--check-only` and `--plan-only`
@@ -213,7 +213,7 @@ static key in `.env.secrets` (gitignored) is rotated **out of band by you**
 locally-held copies.

 ```bash
-bash scripts/run_platform.sh --check-only path/to/your/.acdl/contract.yml
+bash scripts/run_platform.sh --check-only path/to/your/.nova/contract.yml
 ```

 ## Step 5 — What the pipeline does
@@ -345,7 +345,7 @@ process is a 2-step pipeline with **HITL SRE gates** to prevent accidental
 destruction:

 1. **Request a change request (CR):** Contact the platform team to create a
-   change request in the platform CMDB (DynamoDB `acdl-change-requests`
+   change request in the platform CMDB (DynamoDB `nova-change-requests`
   table). The CR must be approved before decommission can proceed. The CR
   includes the consumer repo, contract ID, and the reason for decommission.

@@ -355,7 +355,7 @@ destruction:
   ```yaml
   uses: acdl/.github/workflows/deploy.yml@v1.13
   with:
-     contract: .acdl/contract.yml
+     contract: .nova/contract.yml
     mode: decommission
     changeRequestId: "CHG0678912"
   ```
@@ -404,8 +404,8 @@ input). Promotion = running the matching job.
 ### Two shapes (both supported)

 **Shape 1 — per-environment contract files:** a consumer repo has one
-contract per environment (e.g. `.acdl/static-assets.dev.yml`,
-`.acdl/static-assets.qa.yml`, …). Each sets `environment:` to its own
+contract per environment (e.g. `.nova/static-assets.dev.yml`,
+`.nova/static-assets.qa.yml`, …). Each sets `environment:` to its own
 name and uses interpolation so env-specific values differ automatically:

 ```yaml
@@ -439,7 +439,7 @@ jobs:
    uses: acdl/.github/workflows/deploy.yml@v1.13
    with:
      environment: qa
-      contract: .acdl/contract.yml
+      contract: .nova/contract.yml
 ```

 ### One job per environment
@@ -467,7 +467,7 @@ duties check blocks a prod promotion when `approver_qa == approver_prod`
 | `${env.environment}` | the environment name (dev/qa/prod/dr) | `qa` |
 | `${env.region}` | the environment's AWS region | `us-east-1` |
 | `${env.account_id}` | the environment's AWS account id | `123456789012` |
-| `${env.state_backend.bucket}` | the environment's state bucket | `acdl-qa-state` |
+| `${env.state_backend.bucket}` | the environment's state bucket | `nova-qa-state` |
 | `${env.network.vpc_cidr}` | the environment's VPC CIDR | `10.1.0.0/16` |
 | `${contract.id}` | the contract's operational acronym | `assets` |
 | `${contract.environment}` | the contract's environment field | `qa` |
@@ -7,7 +7,7 @@ deploys it.

 ## The contract file

-A consumer repo keeps its contract at `.acdl/contract.yml`. A minimal
+A consumer repo keeps its contract at `.nova/contract.yml`. A minimal
 example (the `static-assets` module):

 ```yaml
@@ -56,13 +56,13 @@ threshold. Staging does not exist.
 ## Cross-account contract ingestion grant (D-051)

 Onboarding now also grants the consumer repo's deploy role permission to
-invoke the **platform Lambda** — `acdl-contract-ingestor` — across
+invoke the **platform Lambda** — `nova-contract-ingestor` — across
 accounts. The Lambda is invoked via a Function URL with IAM auth, so the
 grant is an inline IAM policy applied to the consumer's deploy role. The
 policy template lives at
 [`terraform/platform/consumer_invoke_policy.json`](https://github.com/nova/nova/blob/main/terraform/platform/consumer_invoke_policy.json)
 and is scoped via **ABAC**: the condition
-`aws:PrincipalTag/acdl:owner == ${consumerRepo}` ensures a repo can only
+`aws:PrincipalTag/nova:owner == ${consumerRepo}` ensures a repo can only
 invoke the Lambda when its principal tag matches its claimed identity.

 The consumer's deploy workflow signs the Function URL request with
@@ -75,7 +75,7 @@ is used for two purposes:

 1. **Contract ingestion** — the consumer submits its resolved deployment
   contract (`action: "submit_contract"`) so the platform has a durable
-   record in the `acdl-contracts` DynamoDB table (PK `consumerRepo`, SK
+   record in the `nova-contracts` DynamoDB table (PK `consumerRepo`, SK
   `contractId#submittedAt`).
 2. **Error reporting** (D-055) — the consumer reports a deployment error
   (`action: "report_error"`) which the platform turns into a GitHub
@@ -18,7 +18,7 @@ There are two kinds of repository in the Nova model:
  and the reusable workflow files. Platform engineers work here. A consumer
  never clones it.
 - **Consumer repo (yours).** A consumer repo contains only its application
-  code, one or more contracts (`.acdl/contract.yml`), and one or more CI
+  code, one or more contracts (`.nova/contract.yml`), and one or more CI
  definitions (a thin `.github/workflows/deploy.yml` that `uses:` the central
  reusable workflow, pointing at the appropriate environment + contract).
  The consumer does not write infrastructure modules, workflow YAML, or
@@ -28,7 +28,7 @@ jobs:
  deploy:
    uses: acdl/.github/workflows/deploy.yml@v1.13
    with:
-      contract: .acdl/contract.yml
+      contract: .nova/contract.yml
 ```

 The version pin lives in the CI workflow reference (not in the contract
@@ -2,7 +2,7 @@

 flowchart LR
    A["1. App code<br/>(top level of the repo)"] --> D["Push to main"]
-    B["2. Contract<br/>(.acdl/contract.yml)"] --> D
+    B["2. Contract<br/>(.nova/contract.yml)"] --> D
    C["3. CI definition<br/>(.github/workflows/deploy.yml<br/>— one 'uses:' line)"] --> D
    D --> E["Platform does the rest"]
 classDef accent fill:#1B1B1B,color:#fff,stroke:#D6002A,stroke-width:2px
@@ -310,7 +310,7 @@ Nova runs at **zero cloud cost** for day-to-day development. AWS spend was measu

 - **S3 dominates** (98.8%, terraform state bucket) — no compute ran because v1.0→v1.10 was plan-only for IAM-gated capabilities
 - **Local emulators are the primary tier** — the full pipeline runs in-process, no AWS credentials
- **Live-AWS verification is milestone-scoped, then torn down.** The pipeline now **defaults to plan-only** on every PR; `ACDL_LIFECYCLE_MODE=full` overrides to apply→destroy for milestone verification (REQ-134, v1.12).
+- **Live-AWS verification is milestone-scoped, then torn down.** The pipeline now **defaults to plan-only** on every PR; `NOVA_LIFECYCLE_MODE=full` overrides to apply→destroy for milestone verification (REQ-134, v1.12).
 - **Cost drivers** are spike-scoped: Terraform plan reads (free), S3 state storage (cents), DynamoDB outbox (cents). Any spike > $1/day is an anomaly.

 **Pre-mortem (`PRE_MORTEM.md`):** the v1.10 decay incident (diff-scoped VERIFY missed 7 adapter defects) is the root pattern: *a claim outruns the verification that backs it.* Four forward failure modes + structural mitigations (regression-tested IAM baseline, mandatory teardown, verified-only deck claims, honest scope).
@@ -329,6 +329,6 @@ section { font-size: 20px; }
 Two architectural pillars make "Verified" a structural property, not a claim:

 - **The stateless adapter (918 → ~80 lines).** The Terraform adapter was a 918-line monolith with 3 constant tables and 39 type-specific branches. It is now a ~80-line **stateless assembler**: it owns no module content — no resource shape, no nested HCL blocks, no defaults. Each L1 module ships a real `terraform/` module dir owning its shape, nested blocks, and defaults. The adapter reads the registry and emits `module "x" { source = ... }` blocks. A new module is a new terraform dir, not a code change. *(The v1.12 P67 fix closed a dedup defect for multi-resource L1s — ecs-service, alb; CAP-013 now Verified.)*
- **Pipeline-driven lifecycle testing.** A `modules-lifecycle` pipeline matrix-runs each L1 and L2 module's `examples/{simple,complex}.yml` contracts through apply→modify→destroy against live AWS. **The "test" = the pipeline cell going green.** Defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); `ACDL_LIFECYCLE_MODE=full` overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — **22/22 Verified** as of v1.12.
+- **Pipeline-driven lifecycle testing.** A `modules-lifecycle` pipeline matrix-runs each L1 and L2 module's `examples/{simple,complex}.yml` contracts through apply→modify→destroy against live AWS. **The "test" = the pipeline cell going green.** Defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); `NOVA_LIFECYCLE_MODE=full` overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — **22/22 Verified** as of v1.12.

 The v1.10 lesson is the negative space: a 918-line adapter with type-specific branches decayed silently. The ~80-line stateless adapter + the milestone regression gate are the structural fix.
@@ -182,7 +182,7 @@
 **Talking points:**
 - The phrase to land is "secure by default, not secure by effort"
 - The selling point is *normalization* — we can add a new security tool without changing the confidence model or the evidence stream
- For the Head of Security: tagging standards are enforced, not advisory — a missing `acdl:owner` tag fails the check, not a warning
+- For the Head of Security: tagging standards are enforced, not advisory — a missing `nova:owner` tag fails the check, not a warning
 - The decommission flow is the counter-argument to "deletion protection makes cleanup impossible" — it's a deliberate, gated, two-approval path

 **Key takeaway:** Secure by default, not secure by effort. Checks run before infra is created.
@@ -207,7 +207,7 @@
 - Close on honesty — the platform delivers real, verifiable value today: 22/22 auto-verifiable capabilities Verified via the v1.11 lifecycle pipeline
 - The roadmap is concrete, not aspirational hand-waving — 9 planned items, each with a defined milestone and a clear reason it isn't shipped yet (usually an upstream dependency, not an engineering gap)
 - Emphasize: 0 consumer adoption today — "Testing" means it works internally and is dev pilot-ready, not that it's released
- The lifecycle pipeline defaults to plan-only on every PR; `ACDL_LIFECYCLE_MODE=full` overrides for milestone verification
+- The lifecycle pipeline defaults to plan-only on every PR; `NOVA_LIFECYCLE_MODE=full` overrides for milestone verification

 **Key takeaway:** 22/22 Verified today. 9 planned, each with a clear milestone and reason.

@@ -1035,7 +1035,7 @@ img { display: block; margin: 0 auto; max-height: 300px; }
 <ul>
 <li><strong>S3 dominates</strong> (98.8%, terraform state bucket) — no compute ran because v1.0→v1.10 was plan-only for IAM-gated capabilities</li>
 <li><strong>Local emulators are the primary tier</strong> — the full pipeline runs in-process, no AWS credentials</li>
-<li><strong>Live-AWS verification is milestone-scoped, then torn down.</strong> The pipeline now <strong>defaults to plan-only</strong> on every PR; <code>ACDL_LIFECYCLE_MODE=full</code> overrides to apply→destroy for milestone verification (REQ-134, v1.12).</li>
+<li><strong>Live-AWS verification is milestone-scoped, then torn down.</strong> The pipeline now <strong>defaults to plan-only</strong> on every PR; <code>NOVA_LIFECYCLE_MODE=full</code> overrides to apply→destroy for milestone verification (REQ-134, v1.12).</li>
 <li><strong>Cost drivers</strong> are spike-scoped: Terraform plan reads (free), S3 state storage (cents), DynamoDB outbox (cents). Any spike &gt; $1/day is an anomaly.</li>
 </ul>
 <p><strong>Pre-mortem (<code>PRE_MORTEM.md</code>):</strong> the v1.10 decay incident (diff-scoped VERIFY missed 7 adapter defects) is the root pattern: <em>a claim outruns the verification that backs it.</em> Four forward failure modes + structural mitigations (regression-tested IAM baseline, mandatory teardown, verified-only deck claims, honest scope).</p>
@@ -1085,7 +1085,7 @@ img { display: block; margin: 0 auto; max-height: 300px; }
 <p>Two architectural pillars make &quot;Verified&quot; a structural property, not a claim:</p>
 <ul>
 <li><strong>The stateless adapter (918 → ~80 lines).</strong> The Terraform adapter was a 918-line monolith with 3 constant tables and 39 type-specific branches. It is now a ~80-line <strong>stateless assembler</strong>: it owns no module content — no resource shape, no nested HCL blocks, no defaults. Each L1 module ships a real <code>terraform/</code> module dir owning its shape, nested blocks, and defaults. The adapter reads the registry and emits <code>module &quot;x&quot; { source = ... }</code> blocks. A new module is a new terraform dir, not a code change. <em>(The v1.12 P67 fix closed a dedup defect for multi-resource L1s — ecs-service, alb; CAP-013 now Verified.)</em></li>
-<li><strong>Pipeline-driven lifecycle testing.</strong> A <code>modules-lifecycle</code> pipeline matrix-runs each L1 and L2 module's <code>examples/{simple,complex}.yml</code> contracts through apply→modify→destroy against live AWS. <strong>The &quot;test&quot; = the pipeline cell going green.</strong> Defaults to <strong>plan-only</strong> on every PR (fast, no AWS mutation, no cost); <code>ACDL_LIFECYCLE_MODE=full</code> overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — <strong>22/22 Verified</strong> as of v1.12.</li>
+<li><strong>Pipeline-driven lifecycle testing.</strong> A <code>modules-lifecycle</code> pipeline matrix-runs each L1 and L2 module's <code>examples/{simple,complex}.yml</code> contracts through apply→modify→destroy against live AWS. <strong>The &quot;test&quot; = the pipeline cell going green.</strong> Defaults to <strong>plan-only</strong> on every PR (fast, no AWS mutation, no cost); <code>NOVA_LIFECYCLE_MODE=full</code> overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — <strong>22/22 Verified</strong> as of v1.12.</li>
 </ul>
 <p>The v1.10 lesson is the negative space: a 918-line adapter with type-specific branches decayed silently. The ~80-line stateless adapter + the milestone regression gate are the structural fix.</p>
 <footer>Internal</footer>
@@ -242,7 +242,7 @@ flowchart LR
 - **Authentication — OIDC federation.** Each job mints a short-lived token; no credential stored in the consumer repo or runner secret. <span class="badge planned">Planned: all runners</span>
 - **Authorization — attribute-based (ABAC), not role-based.** Two attribute classes scope every action:
  - **Repository identity** — trust policy binds to the exact consumer repo + branch.
-  - **Resource tags** — every resource tagged `acdl:owner` + `acdl:contract`; session policy grants access **only to matching tags.**
+  - **Resource tags** — every resource tagged `nova:owner` + `nova:contract`; session policy grants access **only to matching tags.**
 - **The effect:** a consumer can only touch the resources it created. One consumer can never affect another.

 > **Speaker notes:** This is the slide for the Head of Cloud/Security. The key phrase is "blast radius contained to the consumer's own stack." Contrast with the common failure mode of shared CI roles that can touch any account resource. The static-key override exists for edge cases but is rotated daily on platform runners; it is never the default.
@@ -376,7 +376,7 @@ Monitoring is **a platform default, not a per-team project.** *(Testing.)*

 Security defaults that **do not require a team to opt in.** Checks run on **every** deployment, normalized to a single schema regardless of which engine produced them. *(Testing.)*

- **Infrastructure-as-code policy** (Checkov) — secrets in plaintext, public ingress, IAM wildcards, KMS key references, **required tagging standards** (`acdl:owner`, `acdl:contract`, `acdl:environment`, `acdl:cost-center`). All run *before* infra is created.
+- **Infrastructure-as-code policy** (Checkov) — secrets in plaintext, public ingress, IAM wildcards, KMS key references, **required tagging standards** (`nova:owner`, `nova:contract`, `nova:environment`, `nova:cost-center`). All run *before* infra is created.
 - **Cloud security posture** (Wiz adapter) — translates cloud security findings into the same normalized record. *(Adapter testing; activates when a Wiz tenant is configured.)*
 - **Kubernetes-native policy** (Kyverno adapter) — ready for the GitOps reconciler roadmap item. *(Adapter testing; inactive for Terraform-only stacks.)*
 - **Encryption on every resource** — at-rest encryption is on by default for every primitive (S3, RDS, ECR, ECS, and more). *(Testing.)*
@@ -385,7 +385,7 @@ Security defaults that **do not require a team to opt in.** Checks run on **ever
 - **Deletion protection on by default** — every resource has `prevent_destroy` on unless a consumer explicitly disables it via a documented feature flag. *(Testing.)*
 - **Safe decommission** — a 2-step pipeline (disable protection → zero counts → destroy) with **two SRE human-attestation gates** and a **change-request validated against the platform CMDB** before any destructive action. *(Testing.)* Encryption keys enter a grace window (default 30 days) so encrypted data remains recoverable during decommission.

-> **Speaker notes:** The phrase to land is "secure by default, not secure by effort." The selling point is *normalization* — we can add a new security tool without changing the confidence model or the evidence stream. For the Head of Security: tagging standards are enforced, not advisory — a missing `acdl:owner` tag fails the check, not a warning. The decommission flow is the counter-argument to "deletion protection makes cleanup impossible" — it's a deliberate, gated, two-approval path, not a lock with no key.
+> **Speaker notes:** The phrase to land is "secure by default, not secure by effort." The selling point is *normalization* — we can add a new security tool without changing the confidence model or the evidence stream. For the Head of Security: tagging standards are enforced, not advisory — a missing `nova:owner` tag fails the check, not a warning. The decommission flow is the counter-argument to "deletion protection makes cleanup impossible" — it's a deliberate, gated, two-approval path, not a lock with no key.

 ---

@@ -434,7 +434,7 @@ A phased roadmap from the current Testing baseline to the full North Star:
 - Additional engine adapters (OpenTofu, Pulumi, Kubernetes CRDs).
 - Deeper observability bootstrap (dashboards, runbooks, on-call bindings).

-> **Speaker notes:** Close on honesty. The platform delivers real, verifiable value today — 22/22 auto-verifiable capabilities are Verified via the v1.11 lifecycle pipeline (apply→modify→destroy against live AWS) + the D-091 regression gate. The roadmap is concrete, not aspirational hand-waving — 9 planned items, each with a defined milestone and a clear reason it isn't shipped yet (usually an upstream dependency, not an engineering gap). Emphasize: 0 consumer adoption today — "Testing" means it works internally and is dev pilot-ready, not that it's released. The lifecycle pipeline defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); a CI variable (`ACDL_LIFECYCLE_MODE=full`) overrides to the real apply→destroy for milestone verification (REQ-134, v1.12).
+> **Speaker notes:** Close on honesty. The platform delivers real, verifiable value today — 22/22 auto-verifiable capabilities are Verified via the v1.11 lifecycle pipeline (apply→modify→destroy against live AWS) + the D-091 regression gate. The roadmap is concrete, not aspirational hand-waving — 9 planned items, each with a defined milestone and a clear reason it isn't shipped yet (usually an upstream dependency, not an engineering gap). Emphasize: 0 consumer adoption today — "Testing" means it works internally and is dev pilot-ready, not that it's released. The lifecycle pipeline defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); a CI variable (`NOVA_LIFECYCLE_MODE=full`) overrides to the real apply→destroy for milestone verification (REQ-134, v1.12).

 ---

@@ -469,7 +469,7 @@ Nova runs at **zero cloud cost** for day-to-day development. The v1.0→v1.10 AW

 - **S3 dominates** (98.8%, terraform state bucket) — no compute (ECS/Lambda) ran because v1.0→v1.10 was plan-only for IAM-gated capabilities.
 - **Local emulators are the primary tier** — the full pipeline runs in-process, no AWS credentials, no Checkov, no DynamoDB. *(Testing.)*
- **Live-AWS verification is milestone-scoped, then torn down.** The v1.11 lifecycle pipeline ran apply→modify→destroy for every module, then tore down to zero-cost steady state (D-096 — teardown mandatory before milestone COMPLETE; no merge to main until `terraform show` confirms no resources). The lifecycle pipeline now **defaults to plan-only** on every PR (fast, no AWS mutation, no cost); a CI variable (`ACDL_LIFECYCLE_MODE=full`) overrides to the real apply→destroy for milestone verification (REQ-134, v1.12).
+- **Live-AWS verification is milestone-scoped, then torn down.** The v1.11 lifecycle pipeline ran apply→modify→destroy for every module, then tore down to zero-cost steady state (D-096 — teardown mandatory before milestone COMPLETE; no merge to main until `terraform show` confirms no resources). The lifecycle pipeline now **defaults to plan-only** on every PR (fast, no AWS mutation, no cost); a CI variable (`NOVA_LIFECYCLE_MODE=full`) overrides to the real apply→destroy for milestone verification (REQ-134, v1.12).
 - **Cost drivers** are spike-scoped: Terraform plan reads (free), S3 state storage (cents), DynamoDB outbox (cents). Any cost spike > $1/day is an anomaly.

 **Pre-mortem (`PRE_MORTEM.md`):** the project's failure modes were pre-mortemed before the leadership pitch. The v1.10 decay incident (diff-scoped VERIFY missed 7 adapter defects across 8 NFR-patch phases — decks advertised capability that wasn't reproducible) is the root pattern: *a claim outruns the verification that backs it.* Four forward failure modes + structural mitigations: (FM-1) IAM-drift recurrence → IAM policy baseline is regression-tested; (FM-2) cost spike from un-torn-down stacks → D-096 mandatory teardown; (FM-3) deck overstates capability → verified-only claims + decks unfrozen only after re-verification; (FM-4) pilot contract gap → honest scope (microservice + static-assets today; the L2 pattern is extensible). All mitigations are structural, not procedural.
@@ -483,6 +483,6 @@ Nova runs at **zero cloud cost** for day-to-day development. The v1.0→v1.10 AW
 v1.11 rebuilt the platform on two architectural pillars that make "Verified" a structural property, not a claim:

 - **The stateless adapter (REQ-123, 918 → ~80 lines).** The Terraform adapter was a 918-line monolith with 3 constant tables and 39 type-specific branches. It is now a ~80-line **stateless assembler**: it owns no module content — no resource shape, no nested HCL blocks, no defaults, no type-specific logic. Each L1 module ships a real `terraform/` module dir owning its resource shape, nested blocks, and defaults (centralized in `locals.tf`). The adapter reads the registry and emits `module "x" { source = ... }` blocks. No type-specific logic in the adapter means a new module is a new terraform dir, not a code change. *(The v1.12 P67 fix closed a dedup defect where multi-resource L1s — ecs-service, alb — produced invalid Terraform; CAP-013 now Verified.)*
- **Pipeline-driven lifecycle testing (REQ-127/128).** A `modules-lifecycle` pipeline matrix-runs each L1 and L2 module's `examples/{simple,complex}.yml` contracts through apply→modify→destroy against live AWS. No per-module Python. **The "test" = the pipeline cell going green.** Defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); `ACDL_LIFECYCLE_MODE=full` runs the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — 22/22 Verified as of v1.12.
+- **Pipeline-driven lifecycle testing (REQ-127/128).** A `modules-lifecycle` pipeline matrix-runs each L1 and L2 module's `examples/{simple,complex}.yml` contracts through apply→modify→destroy against live AWS. No per-module Python. **The "test" = the pipeline cell going green.** Defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); `NOVA_LIFECYCLE_MODE=full` runs the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — 22/22 Verified as of v1.12.

 > **Speaker notes:** This is the deep-dive slide for the Head of Engineering / Architecture. The two pillars are the answer to "how do you keep the decks honest?" The adapter is simple enough to reason about (a stateless assembler), and the lifecycle pipeline is the automated verification that backs every "Testing" claim. The v1.10 lesson is the negative space: a 918-line adapter with type-specific branches decayed silently because the VERIFY gate was diff-scoped. The ~80-line stateless adapter + the milestone regression gate are the structural fix. The plan-only default (v1.12) means this verification runs on every PR at zero cost, with the full apply→destroy gated behind a CI variable override.
@@ -140,7 +140,7 @@ code { font-size: 13px; }
 ```yaml
 uses: acdl/.github/workflows/deploy.yml@v1.12
 with:
-  contract: .acdl/contract.yml
+  contract: .nova/contract.yml
  mode: decommission
  changeRequestId: "CHG0678912"
 ```
@@ -297,7 +297,7 @@ Nova runs at **zero cloud cost** for day-to-day development. AWS spend was measu
 | Peak day | 2026-07-27 ($0.000867) |

 - **Local emulators are the primary tier** — the full pipeline runs in-process, no AWS credentials
- **Live-AWS verification is milestone-scoped, then torn down.** The pipeline now **defaults to plan-only** on every PR; `ACDL_LIFECYCLE_MODE=full` overrides to apply→destroy for milestone verification (REQ-134, v1.12).
+- **Live-AWS verification is milestone-scoped, then torn down.** The pipeline now **defaults to plan-only** on every PR; `NOVA_LIFECYCLE_MODE=full` overrides to apply→destroy for milestone verification (REQ-134, v1.12).
 - **Cost drivers** are spike-scoped: Terraform plan reads (free), S3 state storage (cents), DynamoDB outbox (cents). No running infrastructure between milestones.

 **Pre-mortem (`PRE_MORTEM.md`):** the v1.10 decay incident (diff-scoped VERIFY missed 7 adapter defects) is the root pattern: *a claim outruns the verification that backs it.* Four forward failure modes + structural mitigations (regression-tested IAM baseline, mandatory teardown, verified-only deck claims, honest scope).
@@ -316,6 +316,6 @@ section { font-size: 20px; }
 Two architectural pillars make "Verified" a structural property, not a claim:

 - **The stateless adapter (918 → ~80 lines).** The Terraform adapter was a 918-line monolith with 3 constant tables and 39 type-specific branches. It is now a ~80-line **stateless assembler**: it owns no module content — no resource shape, no nested HCL blocks, no defaults. Each L1 module ships a real `terraform/` module dir owning its shape, nested blocks, and defaults. The adapter reads the registry and emits `module "x" { source = ... }` blocks. A new module is a new terraform dir, not a code change. *(The v1.12 P67 fix closed a dedup defect for multi-resource L1s — ecs-service, alb; CAP-013 now Verified.)*
- **Pipeline-driven lifecycle testing.** A `modules-lifecycle` pipeline matrix-runs each L1 and L2 module's contracts through apply→modify→destroy against live AWS. **The "test" = the pipeline cell going green.** Defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); `ACDL_LIFECYCLE_MODE=full` overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — **22/22 Verified** as of v1.12.
+- **Pipeline-driven lifecycle testing.** A `modules-lifecycle` pipeline matrix-runs each L1 and L2 module's contracts through apply→modify→destroy against live AWS. **The "test" = the pipeline cell going green.** Defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); `NOVA_LIFECYCLE_MODE=full` overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — **22/22 Verified** as of v1.12.

 The v1.10 lesson is the negative space: a 918-line adapter with type-specific branches decayed silently. The ~80-line stateless adapter + the milestone regression gate are the structural fix.
@@ -232,7 +232,7 @@

 **Talking points:**
 - The headline for the Head of Cloud / Finance: less than one cent over 8 days of active development; zero BAU cloud spend
- The lifecycle pipeline defaults to plan-only so the PR-time cost is zero; `ACDL_LIFECYCLE_MODE=full` overrides for milestone verification
+- The lifecycle pipeline defaults to plan-only so the PR-time cost is zero; `NOVA_LIFECYCLE_MODE=full` overrides for milestone verification
 - The pre-mortem is the credibility slide — we already asked "how does this fail?" and the mitigations are structural
 - The v1.10 decay incident is disclosed honestly, not hidden — that disclosure IS the mitigation
 - Cost drivers are spike-scoped: Terraform plan reads (free), S3 state storage (cents), DynamoDB outbox (cents). No running infrastructure between milestones
@@ -456,7 +456,7 @@ img { display: block; margin: 0 auto; max-height: 280px; }
 <p><img src="assets/png/developer-experience-07-decommission.png" alt="" style="width:1100px;" /></p>
 <pre is="marp-pre" data-auto-scaling="downscale-only"><code class="language-yaml"><span class="hljs-attr">uses:</span> <span class="hljs-string">acdl/.github/workflows/deploy.yml@v1.12</span>
 <span class="hljs-attr">with:</span>
-  <span class="hljs-attr">contract:</span> <span class="hljs-string">.acdl/contract.yml</span>
+  <span class="hljs-attr">contract:</span> <span class="hljs-string">.nova/contract.yml</span>
  <span class="hljs-attr">mode:</span> <span class="hljs-string">decommission</span>
  <span class="hljs-attr">changeRequestId:</span> <span class="hljs-string">&quot;CHG0678912&quot;</span>
 </code></pre>
@@ -1057,7 +1057,7 @@ img { display: block; margin: 0 auto; max-height: 280px; }
 </table>
 <ul>
 <li><strong>Local emulators are the primary tier</strong> — the full pipeline runs in-process, no AWS credentials</li>
-<li><strong>Live-AWS verification is milestone-scoped, then torn down.</strong> The pipeline now <strong>defaults to plan-only</strong> on every PR; <code>ACDL_LIFECYCLE_MODE=full</code> overrides to apply→destroy for milestone verification (REQ-134, v1.12).</li>
+<li><strong>Live-AWS verification is milestone-scoped, then torn down.</strong> The pipeline now <strong>defaults to plan-only</strong> on every PR; <code>NOVA_LIFECYCLE_MODE=full</code> overrides to apply→destroy for milestone verification (REQ-134, v1.12).</li>
 <li><strong>Cost drivers</strong> are spike-scoped: Terraform plan reads (free), S3 state storage (cents), DynamoDB outbox (cents). No running infrastructure between milestones.</li>
 </ul>
 <p><strong>Pre-mortem (<code>PRE_MORTEM.md</code>):</strong> the v1.10 decay incident (diff-scoped VERIFY missed 7 adapter defects) is the root pattern: <em>a claim outruns the verification that backs it.</em> Four forward failure modes + structural mitigations (regression-tested IAM baseline, mandatory teardown, verified-only deck claims, honest scope).</p>
@@ -1111,7 +1111,7 @@ img { display: block; margin: 0 auto; max-height: 280px; }
 <p>Two architectural pillars make &quot;Verified&quot; a structural property, not a claim:</p>
 <ul>
 <li><strong>The stateless adapter (918 → ~80 lines).</strong> The Terraform adapter was a 918-line monolith with 3 constant tables and 39 type-specific branches. It is now a ~80-line <strong>stateless assembler</strong>: it owns no module content — no resource shape, no nested HCL blocks, no defaults. Each L1 module ships a real <code>terraform/</code> module dir owning its shape, nested blocks, and defaults. The adapter reads the registry and emits <code>module &quot;x&quot; { source = ... }</code> blocks. A new module is a new terraform dir, not a code change. <em>(The v1.12 P67 fix closed a dedup defect for multi-resource L1s — ecs-service, alb; CAP-013 now Verified.)</em></li>
-<li><strong>Pipeline-driven lifecycle testing.</strong> A <code>modules-lifecycle</code> pipeline matrix-runs each L1 and L2 module's contracts through apply→modify→destroy against live AWS. <strong>The &quot;test&quot; = the pipeline cell going green.</strong> Defaults to <strong>plan-only</strong> on every PR (fast, no AWS mutation, no cost); <code>ACDL_LIFECYCLE_MODE=full</code> overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — <strong>22/22 Verified</strong> as of v1.12.</li>
+<li><strong>Pipeline-driven lifecycle testing.</strong> A <code>modules-lifecycle</code> pipeline matrix-runs each L1 and L2 module's contracts through apply→modify→destroy against live AWS. <strong>The &quot;test&quot; = the pipeline cell going green.</strong> Defaults to <strong>plan-only</strong> on every PR (fast, no AWS mutation, no cost); <code>NOVA_LIFECYCLE_MODE=full</code> overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — <strong>22/22 Verified</strong> as of v1.12.</li>
 </ul>
 <p>The v1.10 lesson is the negative space: a 918-line adapter with type-specific branches decayed silently. The ~80-line stateless adapter + the milestone regression gate are the structural fix.</p>
 <footer>Internal</footer>
@@ -233,7 +233,7 @@ flowchart LR
 ```yaml
 uses: acdl/.github/workflows/deploy.yml@v1.12
 with:
-  contract: .acdl/contract.yml
+  contract: .nova/contract.yml
  mode: decommission
  changeRequestId: "CHG0678912"
 ```
@@ -438,7 +438,7 @@ Nova runs at **zero cloud cost** for day-to-day development. The v1.0→v1.10 AW
 | Peak day | 2026-07-27 ($0.000867 — v1.10 regression + verify run) |

 - **Local emulators are the primary tier** — the full pipeline runs in-process, no AWS credentials, no Checkov, no DynamoDB.
- **Live-AWS verification is milestone-scoped, then torn down.** The v1.11 lifecycle pipeline ran apply→modify→destroy for every module, then tore down to zero-cost steady state (D-096 — teardown mandatory before milestone COMPLETE). The lifecycle pipeline now **defaults to plan-only** on every PR (fast, no AWS mutation, no cost); a CI variable (`ACDL_LIFECYCLE_MODE=full`) overrides to the real apply→destroy for milestone verification (REQ-134, v1.12).
+- **Live-AWS verification is milestone-scoped, then torn down.** The v1.11 lifecycle pipeline ran apply→modify→destroy for every module, then tore down to zero-cost steady state (D-096 — teardown mandatory before milestone COMPLETE). The lifecycle pipeline now **defaults to plan-only** on every PR (fast, no AWS mutation, no cost); a CI variable (`NOVA_LIFECYCLE_MODE=full`) overrides to the real apply→destroy for milestone verification (REQ-134, v1.12).
 - **Cost drivers** are spike-scoped: Terraform plan reads (free), S3 state storage (cents), DynamoDB outbox (cents). No running infrastructure between milestones.

 **Pre-mortem (`PRE_MORTEM.md`):** the project's failure modes were pre-mortemed before the leadership pitch. The v1.10 decay incident (diff-scoped VERIFY missed 7 adapter defects — decks advertised capability that wasn't reproducible) is the root pattern: *a claim outruns the verification that backs it.* Four forward failure modes + structural mitigations (regression-tested IAM baseline, mandatory teardown, verified-only deck claims, honest scope).
@@ -452,6 +452,6 @@ Nova runs at **zero cloud cost** for day-to-day development. The v1.0→v1.10 AW
 v1.11 rebuilt the platform on two architectural pillars that make "Verified" a structural property, not a claim:

 - **The stateless adapter (918 → ~80 lines).** The Terraform adapter was a 918-line monolith with 3 constant tables and 39 type-specific branches. It is now a ~80-line **stateless assembler**: it owns no module content. Each L1 module ships a real `terraform/` module dir owning its resource shape, nested blocks, and defaults. A new module is a new terraform dir, not a code change. *(The v1.12 P67 fix closed a dedup defect for multi-resource L1s — ecs-service, alb; CAP-013 now Verified.)*
- **Pipeline-driven lifecycle testing.** A `modules-lifecycle` pipeline matrix-runs each L1 and L2 module's contracts through apply→modify→destroy against live AWS. **The "test" = the pipeline cell going green.** Defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); `ACDL_LIFECYCLE_MODE=full` runs the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — 22/22 Verified as of v1.12.
+- **Pipeline-driven lifecycle testing.** A `modules-lifecycle` pipeline matrix-runs each L1 and L2 module's contracts through apply→modify→destroy against live AWS. **The "test" = the pipeline cell going green.** Defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); `NOVA_LIFECYCLE_MODE=full` runs the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — 22/22 Verified as of v1.12.

 > **Speaker notes:** This is the deep-dive slide for the Head of Engineering / Architecture. The two pillars answer "how do you keep the decks honest?" The adapter is simple enough to reason about (a stateless assembler); the lifecycle pipeline is the automated verification that backs every "Testing" claim. The v1.10 lesson is the negative space: a 918-line adapter with type-specific branches decayed silently. The ~80-line stateless adapter + the milestone regression gate are the structural fix. The plan-only default (v1.12) means verification runs on every PR at zero cost, with the full apply→destroy gated behind a CI variable override.
@@ -11,7 +11,7 @@
      "type": "aws:elbv2:loadbalancer",
      "module": "alb@1.0.0",
      "inputs": {
-        "name": "acdl-alb",
+        "name": "nova-alb",
        "subnets": "subnet-12345",
        "security_group": "sg-12345",
        "region": "us-east-1"
@@ -27,7 +27,7 @@
      "type": "aws:elbv2:targetgroup",
      "module": "alb@1.0.0",
      "inputs": {
-        "name": "acdl-alb",
+        "name": "nova-alb",
        "port": 80,
        "protocol": "HTTP",
        "region": "us-east-1"
@@ -1,7 +1,7 @@
 locals {
  # OAC defaults (adapter previously hardcoded these).
-  oac_name              = "acdl-oac"
-  oac_origin_type       = "s3"
-  oac_signing_behavior  = "always"
-  oac_signing_protocol  = "sigv4"
+  oac_name             = "nova-oac"
+  oac_origin_type      = "s3"
+  oac_signing_behavior = "always"
+  oac_signing_protocol = "sigv4"
 }
@@ -1,7 +1,7 @@
 variable "name" {
  type        = string
  description = "ECS cluster name."
-  default     = "acdl-cluster"
+  default     = "nova-cluster"
 }

 variable "region" {
@@ -8,15 +8,15 @@ resource "aws_ecs_task_definition" "this" {
 }

 resource "aws_ecs_service" "this" {
-  name            = "acdl-microservice"
+  name            = "nova-microservice"
  cluster         = var.cluster_arn
  task_definition = aws_ecs_task_definition.this.arn
  desired_count   = var.desired_count
  launch_type     = var.launch_type

  network_configuration {
-    subnets         = local.subnet_list
-    security_groups = local.security_groups
+    subnets          = local.subnet_list
+    security_groups  = local.security_groups
    assign_public_ip = var.launch_type == "FARGATE"
  }

@@ -1,7 +1,7 @@
 variable "role_name" {
  type        = string
  description = "The IAM role name."
-  default     = "acdl-microservice-role"
+  default     = "nova-microservice-role"
 }

 variable "assume_role_policy" {
@@ -1,3 +1,3 @@
 locals {
-  alias_name = "alias/acdl-ci-kms"
+  alias_name = "alias/nova-ci-kms"
 }
@@ -1,6 +1,6 @@
 resource "aws_db_subnet_group" "this" {
  count      = var.subnet_ids != "" ? 1 : 0
-  name       = "acdl-ci-rds-subnet-group"
+  name       = "nova-ci-rds-subnet-group"
  subnet_ids = split(",", var.subnet_ids)
 }

@@ -6,8 +6,8 @@ locals {
  # Tags: merge caller-supplied tags with the module defaults.
  tags = merge(
    {
-      "acdl:owner"       = "acdl"
-      "acdl:environment" = "dev"
+      "nova:owner"       = "acdl"
+      "nova:environment" = "dev"
    },
    var.tags
  )
@@ -10,5 +10,5 @@ output "bucket_name" {

 output "bucket_regional_domain_name" {
  value       = aws_s3_bucket.this.bucket_regional_domain_name
-  description = "The bucket regional domain name (e.g. acdl-spike-bucket.s3.us-east-1.amazonaws.com)."
+  description = "The bucket regional domain name (e.g. nova-spike-bucket.s3.us-east-1.amazonaws.com)."
 }
@@ -1,5 +1,5 @@
 resource "aws_ecs_task_definition" "uptime" {
-  family                   = "acdl-uptime"
+  family                   = "nova-uptime"
  cpu                      = tostring(var.cpu)
  memory                   = tostring(var.memory)
  requires_compatibilities = ["FARGATE"]
@@ -8,7 +8,7 @@ resource "aws_ecs_task_definition" "uptime" {
 }

 resource "aws_ecs_service" "uptime" {
-  name            = "acdl-uptime"
+  name            = "nova-uptime"
  cluster         = local.cluster_ref
  task_definition = aws_ecs_task_definition.uptime.arn
  desired_count   = var.feature_flag_enabled ? 1 : 0
@@ -1,7 +1,7 @@
 locals {
  cidr_block = var.cidr != null ? var.cidr : "10.0.0.0/16"
  az_list    = split(",", var.azs)
-  name_tag  = var.name != null ? var.name : "acdl-vpc"
+  name_tag   = var.name != null ? var.name : "nova-vpc"

  # Derive subnet CIDRs from the VPC CIDR
  subnet_cidrs = [
@@ -13,7 +13,7 @@ variable "azs" {
 variable "name" {
  type        = string
  description = "Name tag for the VPC and child resources."
-  default     = "acdl-vpc"
+  default     = "nova-vpc"
 }

 variable "region" {
@@ -15,7 +15,7 @@ resource "aws_wafv2_web_acl" "this" {

  visibility_config {
    cloudwatch_metrics_enabled = true
-    metric_name                = "acdl-waf-metrics"
+    metric_name                = "nova-waf-metrics"
    sampled_requests_enabled   = true
  }

@@ -1,7 +1,7 @@
 variable "name" {
  type        = string
  description = "WAF Web ACL name."
-  default     = "acdl-waf"
+  default     = "nova-waf"
 }

 variable "scope" {
@@ -18,7 +18,7 @@
  "wires": [
    {"from": "contract.inputs.name", "to": "alb.inputs.name", "default": "app"},
    {"from": "contract.inputs.name", "to": "ecr.inputs.name", "default": "app-repo"},
-    {"from": "contract.inputs.name", "to": "roles.inputs.role_name", "default": "acdl-app-role"},
+    {"from": "contract.inputs.name", "to": "roles.inputs.role_name", "default": "nova-app-role"},
    {"from": "contract.inputs.region", "to": "cluster.inputs.region"},
    {"from": "contract.inputs.region", "to": "ecr.inputs.region"},
    {"from": "contract.inputs.region", "to": "roles.inputs.region"},
@@ -17,7 +17,7 @@
 #
 # Validated against schemas/deploy-pipeline.schema.json.

-name: acdl-deploy
+name: nova-deploy
 environment: dev
 triggers:
  push: [main]
@@ -13,7 +13,7 @@ name: acdl-modules-lifecycle
 #
 # Lifecycle mode (REQ-134, v1.12): `default_mode: plan` — the lifecycle
 # scripts run `run_platform.sh --plan-only` (fast, no AWS mutation, no
-# AWS credentials, no cost) on every PR. Set the ACDL_LIFECYCLE_MODE CI
+# AWS credentials, no cost) on every PR. Set the NOVA_LIFECYCLE_MODE CI
 # variable (workflow_dispatch input `lifecycle_mode`) to `full` for the
 # real apply→modify→destroy against live AWS. The CI VPC apply/destroy
 # jobs are skipped in plan mode (nothing is applied).
@@ -36,7 +36,7 @@ terraform_version: "1.9.*"

 # Default lifecycle mode: "plan" (plan-only, fast, no AWS mutation) or "full"
 # (real apply→modify→destroy against live AWS). Overridable via the
-# ACDL_LIFECYCLE_MODE CI variable / workflow_dispatch input.
+# NOVA_LIFECYCLE_MODE CI variable / workflow_dispatch input.
 default_mode: plan

 stages:
@@ -13,7 +13,7 @@ Nova uses JSON Schema draft 2020-12 for all declarative contracts. Schemas are t
 | Nova Central Pipeline Contract | `pipeline.schema.json` | Central CI pipeline contract (stages, commands, triggers, runner) | `tests/test_pipeline_contract.py` |
 | Nova Central Deployment Pipeline Contract | `deploy-pipeline.schema.json` | Central deploy pipeline contract (validate → resolve → plan → checkov → confidence → apply → publish → uptime → comment) | `tests/test_pipeline_contract.py` |
 | Nova PolicyCheckResult | `policy_check_result.schema.json` | Normalized policy check result schema (the contract between policy engines and the confidence signal) | `tests/conftest.py`, all adapter tests |
-| Nova Tagging Standard | `tagging-standard.json` | Required tag set for all taggable AWS resources | `adapters/terraform/policy/custom_rules/acdl_tagging.py` |
+| Nova Tagging Standard | `tagging-standard.json` | Required tag set for all taggable AWS resources | `adapters/terraform/policy/custom_rules/nova_tagging.py` |

 ## How to Write a Schema

@@ -24,7 +24,7 @@
    },
    "ruleId": {
      "type": "string",
-      "description": "Rule identifier (e.g. CKV_AWS_24, KYVERNO_NO_PRIVILEGED, ACDL_TAG_NAMING)."
+      "description": "Rule identifier (e.g. CKV_AWS_24, KYVERNO_NO_PRIVILEGED, NOVA_TAG_NAMING)."
    },
    "severity": {
      "type": "string",
@@ -2,41 +2,45 @@
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://nova.dev/schemas/tagging-standard.json",
  "title": "Nova Tagging Standard",
-  "description": "Required tags for all taggable AWS resources created by the platform. Enforced by a Checkov custom Python rule (adapters/terraform/policy/custom_rules/acdl_tagging.py). The checkov adapter maps ACDL_TAG_NAMING as a real rule (D-054, D-043 closure).",
+  "description": "Required tags for all taggable AWS resources created by the platform. Enforced by a Checkov custom Python rule (adapters/terraform/policy/custom_rules/nova_tagging.py, D-109 hard mode in P3 — tag-key values are nova:*; legacy acdl:* tag keys are rejected by the hard-mode rule). The checkov adapter maps NOVA_TAG_NAMING as a real rule (D-054, D-043 closure; renamed from ACDL_TAG_NAMING in P2, REQ-158).",
  "type": "object",
  "properties": {
    "required_tags": {
      "type": "object",
      "description": "The set of tags that must be present on every taggable AWS resource.",
      "properties": {
-        "acdl:owner": {
+        "nova:owner": {
          "type": "string",
          "description": "The consumer repository name (e.g. 'consumer-repo'). Injected from the ABAC session."
        },
-        "acdl:contract": {
+        "nova:contract": {
          "type": "string",
          "description": "The contract ID (UUID)."
        },
-        "acdl:environment": {
+        "nova:environment": {
          "type": "string",
          "enum": ["dev", "qa", "prod", "dr"],
          "description": "The environment name."
        },
-        "acdl:cost-center": {
+        "nova:cost-center": {
          "type": "string",
-          "description": "The cost center (consumer-provided or platform-default 'acdl-default')."
+          "description": "The cost center (consumer-provided or platform-default 'nova-default')."
+        },
+        "nova:ref": {
+          "type": "string",
+          "description": "Optional reference tag (e.g. a change-request ID or external tracker)."
        }
      },
-      "required": ["acdl:owner", "acdl:contract", "acdl:environment", "acdl:cost-center"],
+      "required": ["nova:owner", "nova:contract", "nova:environment", "nova:cost-center"],
      "additionalProperties": false
    },
    "default_values": {
      "type": "object",
      "description": "Default values used when the consumer does not supply the tag.",
      "properties": {
-        "acdl:cost-center": {
+        "nova:cost-center": {
          "type": "string",
-          "default": "acdl-default"
+          "default": "nova-default"
        }
      }
    }
@@ -0,0 +1,263 @@
+#!/usr/bin/env python3
+"""Migrate DynamoDB table data from acdl-* → nova-* (REQ-163, P4).
+
+The Nova rebrand (v1.15) renames the platform DynamoDB tables:
+  - ``acdl-contracts``       → ``nova-contracts``
+  - ``acdl-change-requests`` → ``nova-change-requests``
+
+DynamoDB table names are immutable post-creation, so the migration is a
+**scan + copy**: every item in the old table is written to the new table
+(preserving the full item shape — PK, SK, and all attributes). Row counts
+are verified to match post-copy. The old tables are **kept** until the
+operator verifies the copy; deletion is a manual post-verification step
+documented in ``docs/NOVA_AWS_MIGRATION.md`` (runbook).
+
+Design:
+  - **Dry-run by default.** Prints the planned copy operations + counts
+    without touching AWS. Pass ``--apply`` to execute the copy.
+  - **Idempotent.** Re-running against an already-migrated item is a
+    no-op (``PutItem`` overwrites in place; the copy is re-run but the
+    row counts still match). The script does NOT delete the old tables
+    (deletion is a manual runbook step).
+  - **Item-mapping logic is pure + unit-tested** (see
+    ``tests/test_migrate_dynamodb_data.py``); the AWS I/O is thin boto3
+    glue around ``map_item()`` + ``scan_all()``.
+  - **boto3 lazy import.** The module is importable + unit-testable
+    without AWS credentials (the client is constructed inside ``run()``).
+
+Usage:
+  python3 scripts/migrate_dynamodb_data.py                 # dry-run (default)
+  python3 scripts/migrate_dynamodb_data.py --apply         # execute the copy
+  python3 scripts/migrate_dynamodb_data.py --region us-east-1 --apply
+  python3 scripts/migrate_dynamodb_data.py --table contracts --apply
+  python3 scripts/migrate_dynamodb_data.py --source acdl-contracts --dest nova-contracts --apply
+
+Pre-requisites (live AWS, documented in the runbook):
+  - The nova-* destination tables must already exist (created via
+    ``terraform/platform/main.tf``).
+  - AWS credentials in env with scan+PutItem on both old + new tables.
+"""
+
+from __future__ import annotations
+
+import argparse
+import copy
+import sys
+from typing import Dict, List, Optional, Tuple
+
+try:
+    import boto3
+except ImportError:  # pragma: no cover - boto3 is a test dep
+    boto3 = None  # type: ignore
+
+
+# ---------------------------------------------------------------------------
+# Default table-pair mapping (REQ-163)
+# ---------------------------------------------------------------------------
+
+DEFAULT_TABLE_PAIRS: List[Tuple[str, str]] = [
+    ("acdl-contracts", "nova-contracts"),
+    ("acdl-change-requests", "nova-change-requests"),
+]
+
+
+# ---------------------------------------------------------------------------
+# Pure item-mapping logic (unit-tested)
+# ---------------------------------------------------------------------------
+
+def map_item(item: Dict) -> Dict:
+    """Return a copy of a DynamoDB item suitable for PutItem into the new table.
+
+    DynamoDB items returned by ``scan``/``get_item`` are in the typed-attribute
+    shape (``{"attr": {"S": "value"}, ...}``). The copy is identity-preserving:
+    the item is written verbatim to the destination table so the PK/SK + every
+    attribute land identically. No key-rewrite is needed because the old + new
+    tables share the same key schema (PK ``consumerRepo``, SK
+    ``contractId#submittedAt`` for contracts; PK ``changeRequestId``, SK
+    ``submittedAt`` for change-requests).
+
+    The mapping is a deep copy so callers can mutate the result without
+    aliasing the scanned item (DynamoDB items nest typed-attribute dicts,
+    e.g. ``{"attr": {"S": "value"}}``). ``map_item`` is pure +
+    side-effect-free.
+
+    Examples:
+      >>> map_item({"consumerRepo": {"S": "acdl/c"}, "k": {"N": "1"}})
+      {'consumerRepo': {'S': 'acdl/c'}, 'k': {'N': '1'}}
+      >>> map_item({}) == {}
+      True
+    """
+    return copy.deepcopy(item)
+
+
+def table_pair_for(name: str, pairs: Optional[List[Tuple[str, str]]] = None) -> Tuple[str, str]:
+    """Resolve a logical table name (``contracts`` / ``change-requests``) or a
+    literal source-table name to its ``(source, dest)`` pair.
+
+    Examples:
+      >>> table_pair_for("contracts")
+      ('acdl-contracts', 'nova-contracts')
+      >>> table_pair_for("change-requests")
+      ('acdl-change-requests', 'nova-change-requests')
+      >>> table_pair_for("acdl-contracts")
+      ('acdl-contracts', 'nova-contracts')
+      >>> table_pair_for("nova-contracts")
+      ('nova-contracts', 'nova-contracts')
+    """
+    table = pairs if pairs is not None else DEFAULT_TABLE_PAIRS
+    aliases = {
+        "contracts": ("acdl-contracts", "nova-contracts"),
+        "change-requests": ("acdl-change-requests", "nova-change-requests"),
+    }
+    if name in aliases:
+        return aliases[name]
+    for src, dst in table:
+        if name == src:
+            return (src, dst)
+        if name == dst:
+            return (src, dst)
+    raise ValueError(
+        f"unknown table {name!r}; expected one of: contracts, change-requests, "
+        f"or a literal source name from {table!r}"
+    )
+
+
+# ---------------------------------------------------------------------------
+# Thin AWS I/O glue (constructed lazily inside run)
+# ---------------------------------------------------------------------------
+
+def scan_all(client, table_name: str) -> List[Dict]:
+    """Scan every item in ``table_name`` (paginates through all segments).
+
+    Returns the full list of items (typed-attribute shape). Uses
+    ``table.scan()`` with pagination on ``LastEvaluatedKey``.
+    """
+    items: List[Dict] = []
+    last_key: Optional[Dict] = None
+    while True:
+        kwargs: Dict = {"TableName": table_name}
+        if last_key is not None:
+            kwargs["ExclusiveStartKey"] = last_key
+        resp = client.scan(**kwargs)
+        items.extend(resp.get("Items", []))
+        last_key = resp.get("LastEvaluatedKey")
+        if not last_key:
+            break
+    return items
+
+
+def copy_items(client, source_table: str, dest_table: str, items: List[Dict]) -> int:
+    """PutItem every mapped item into ``dest_table``. Returns the count written."""
+    written = 0
+    for item in items:
+        client.put_item(TableName=dest_table, Item=map_item(item))
+        written += 1
+    return written
+
+
+def count_items(client, table_name: str) -> int:
+    """Return the approximate item count via ``DescribeTable``.
+
+    Uses ``Table.ItemCount`` (updated ~6hourly by AWS) for a fast count; for
+    exact verification prefer ``len(scan_all(...))`` (the runbook documents
+    both — scan is the source of truth for row-count verification).
+    """
+    resp = client.describe_table(TableName=table_name)
+    return int(resp["Table"].get("ItemCount", 0))
+
+
+# ---------------------------------------------------------------------------
+# Driver
+# ---------------------------------------------------------------------------
+
+def run(args: argparse.Namespace) -> int:
+    pairs = DEFAULT_TABLE_PAIRS
+    if args.source and args.dest:
+        pairs = [(args.source, args.dest)]
+    elif args.table:
+        pairs = [table_pair_for(args.table)]
+
+    region = args.region
+    if boto3 is None:
+        print("FAIL: boto3 is not installed (pip install boto3)", file=sys.stderr)
+        return 2
+
+    client = boto3.client("dynamodb", region_name=region)
+    mode = "APPLY" if args.apply else "DRY-RUN"
+    overall_rc = 0
+
+    for source, dest in pairs:
+        print(f"\n=== {mode}: {source} → {dest} (region {region}) ===")
+        try:
+            client.describe_table(TableName=source)
+        except Exception as e:
+            print(f"  FAIL: source table {source!r} not describable: "
+                  f"{type(e).__name__}: {e}", file=sys.stderr)
+            overall_rc = 1
+            continue
+        try:
+            client.describe_table(TableName=dest)
+        except Exception as e:
+            print(f"  FAIL: dest table {dest!r} not describable (create it via "
+                  f"terraform first): {type(e).__name__}: {e}", file=sys.stderr)
+            overall_rc = 1
+            continue
+
+        items = scan_all(client, source)
+        src_count = len(items)
+        print(f"  scanned {src_count} item(s) from {source}")
+
+        if not args.apply:
+            print(f"  [dry-run] would PutItem {src_count} item(s) into {dest}")
+            print(f"  [dry-run] would verify {dest} row count == {src_count}")
+            print(f"  [dry-run] old table {source} is NOT deleted (manual runbook step)")
+            continue
+
+        written = copy_items(client, source, dest, items)
+        print(f"  copied {written} item(s) → {dest}")
+
+        # Verify by re-scanning the destination (source of truth, not DescribeTable).
+        dest_items = scan_all(client, dest)
+        dest_count = len(dest_items)
+        if dest_count != src_count:
+            print(f"  WARNING: row-count mismatch — source={src_count}, "
+                  f"dest={dest_count}. Investigate before deleting {source}.",
+                  file=sys.stderr)
+            overall_rc = 1
+        else:
+            print(f"  VERIFIED: {dest} row count ({dest_count}) == source ({src_count})")
+            print(f"  Old table {source} is KEPT. Delete it manually only after "
+                  f"verifying consumers read from {dest} (runbook step).")
+
+    if overall_rc == 0:
+        print(f"\n=== {mode} complete ({len(pairs)} pair(s)) ===")
+    else:
+        print(f"\n=== {mode} complete with FAILURES ===", file=sys.stderr)
+    return overall_rc
+
+
+def build_parser() -> argparse.ArgumentParser:
+    p = argparse.ArgumentParser(
+        description="Migrate DynamoDB data acdl-* → nova-* (REQ-163, P4).",
+    )
+    p.add_argument("--apply", action="store_true",
+                   help="Execute the copy (default: dry-run, no AWS writes).")
+    p.add_argument("--region", default="us-east-1",
+                   help="AWS region (default: us-east-1).")
+    p.add_argument("--table", default=None,
+                   help="Migrate a single logical table: 'contracts' or "
+                        "'change-requests' (default: both).")
+    p.add_argument("--source", default=None,
+                   help="Override the source table name (paired with --dest).")
+    p.add_argument("--dest", default=None,
+                   help="Override the destination table name (paired with --source).")
+    return p
+
+
+def main(argv: Optional[List[str]] = None) -> int:
+    args = build_parser().parse_args(argv)
+    return run(args)
+
+
+if __name__ == "__main__":
+    sys.exit(main())
@@ -0,0 +1,247 @@
+#!/usr/bin/env python3
+"""Migrate SSM parameter paths from /acdl/... → /nova/... (REQ-161, P3).
+
+The Nova rebrand (v1.15) moves the SSM parameter namespace prefix from
+`/acdl/{env}/{contractId}/{output}` to `/nova/{env}/{contractId}/{output}`.
+This script copies every existing `/acdl/...` parameter to its `/nova/...`
+twin (same value, same Type, SecureString preserved, same KMS key), verifies
+the copy round-trips, then deletes the old `/acdl/...` parameter.
+
+Design:
+  - **Dry-run by default.** Prints the planned copy/delete operations without
+    touching AWS. Pass ``--apply`` to execute.
+  - **Idempotent.** If the `/nova/...` target already exists with the same
+    value, the copy is skipped (and reported as a no-op); the old `/acdl/...`
+    parameter is still deleted (the migration is re-runnable). If the target
+    exists with a *different* value, the copy is skipped with a WARNING and
+    the old parameter is NOT deleted (manual review required) unless
+    ``--force`` is passed.
+  - **Path-mapping logic is unit-tested** (see ``tests/test_migrate_ssm_paths.py``);
+    the AWS I/O is thin boto3 glue around ``map_path()``.
+
+Usage:
+  python3 scripts/migrate_ssm_paths.py                  # dry-run, /acdl → /nova
+  python3 scripts/migrate_ssm_paths.py --apply          # execute
+  python3 scripts/migrate_ssm_paths.py --source /acdl --dest /nova --apply
+  python3 scripts/migrate_ssm_paths.py --region us-east-1 --apply
+
+This script does NOT need live AWS to be importable; the boto3 client is
+constructed lazily inside ``run()`` so the module can be imported + the
+path-mapping logic unit-tested without credentials.
+"""
+
+from __future__ import annotations
+
+import argparse
+import sys
+from typing import Optional
+
+try:
+    import boto3
+except ImportError:  # pragma: no cover - boto3 is a test dep
+    boto3 = None  # type: ignore
+
+
+# ---------------------------------------------------------------------------
+# Path-mapping logic (pure, unit-tested)
+# ---------------------------------------------------------------------------
+
+def map_path(source_path: str, source_prefix: str = "/acdl", dest_prefix: str = "/nova") -> str:
+    """Map an SSM parameter path from the source prefix to the dest prefix.
+
+    The match is on a *path-segment* boundary: ``/acdl`` matches ``/acdl/dev/...``
+    but a literal like ``/acdl-platform`` is left untouched (it does not start
+    with the ``/acdl/`` segment). A path that does not start with the source
+    prefix (as a leading segment) raises ``ValueError`` so callers can filter
+    or surface stray parameters.
+
+    Examples:
+      >>> map_path("/acdl/dev/svc-x/output")
+      '/nova/dev/svc-x/output'
+      >>> map_path("/acdl/dev/c-1/vpc_id", "/acdl", "/nova")
+      '/nova/dev/c-1/vpc_id'
+      >>> map_path("/acdl/qa/c-2/db_endpoint")
+      '/nova/qa/c-2/db_endpoint'
+    """
+    if not source_path.startswith(source_prefix + "/"):
+        raise ValueError(
+            f"path {source_path!r} does not start with source prefix "
+            f"{source_prefix!r} (as a path segment)"
+        )
+    return dest_prefix + source_path[len(source_prefix):]
+
+
+def list_acdl_params(client, source_prefix: str = "/acdl"):
+    """List all SSM parameters whose Name starts with ``source_prefix/``.
+
+    Uses ``DescribeParameters`` with a ParameterFilters Path prefix (the
+    documented, pagination-friendly way to scope by path). Returns a list of
+    parameter-summary dicts (Name, Type, KeyId, ...).
+    """
+    params: list[dict] = []
+    paginator = client.get_paginator("describe_parameters")
+    iterator = paginator.paginate(
+        ParameterFilters=[
+            {"Key": "Path", "Option": "Recursive", "Values": [source_prefix + "/"]}
+        ]
+    )
+    for page in iterator:
+        for p in page.get("Parameters", []):
+            params.append(p)
+    return params
+
+
+def copy_one_param(client, source_name: str, dest_name: str, force: bool = False) -> str:
+    """Copy a single SSM parameter from source to dest.
+
+    Returns one of: ``"copied"``, ``"skipped-equal"`` (already migrated),
+    ``"skipped-mismatch"`` (dest exists with a different value; needs --force
+    to overwrite), ``"overwritten"`` (force=True overwrote a mismatching dest).
+    """
+    src = client.get_parameter(Name=source_name, WithDecryption=True)
+    value = src["Parameter"]["Value"]
+    ptype = src["Parameter"]["Type"]
+    key_id = src["Parameter"].get("KeyId")
+
+    # Check if dest already exists
+    try:
+        dst = client.get_parameter(Name=dest_name, WithDecryption=True)
+        if dst["Parameter"]["Value"] == value:
+            return "skipped-equal"
+        if not force:
+            return "skipped-mismatch"
+    except Exception:  # ParameterNotFound → proceed to put
+        pass
+
+    put_kwargs = {
+        "Name": dest_name,
+        "Value": value,
+        "Type": ptype,
+        "Overwrite": True,
+    }
+    if ptype == "SecureString" and key_id:
+        put_kwargs["KeyId"] = key_id
+    client.put_parameter(**put_kwargs)
+    return "overwritten" if force else "copied"
+
+
+def verify_one_param(client, source_name: str, dest_name: str) -> bool:
+    """Verify the dest parameter holds the same value as the source."""
+    src = client.get_parameter(Name=source_name, WithDecryption=True)
+    dst = client.get_parameter(Name=dest_name, WithDecryption=True)
+    return src["Parameter"]["Value"] == dst["Parameter"]["Value"]
+
+
+def delete_one_param(client, name: str) -> None:
+    """Delete a single SSM parameter."""
+    client.delete_parameter(Name=name)
+
+
+def run(
+    source_prefix: str = "/acdl",
+    dest_prefix: str = "/nova",
+    region: Optional[str] = None,
+    apply: bool = False,
+    force: bool = False,
+    client=None,
+) -> dict:
+    """Run the migration. Returns a summary dict.
+
+    When ``apply`` is False (default, dry-run), no AWS mutations happen — the
+    function lists the source parameters and reports the planned copy/delete
+    operations. When ``apply`` is True, it copies, verifies, and deletes.
+
+    A pre-built boto3 SSM ``client`` may be injected for testing.
+    """
+    if apply and client is None:
+        if boto3 is None:
+            raise RuntimeError("boto3 is required for --apply (live AWS)")
+        client = boto3.client("ssm", region_name=region) if region else boto3.client("ssm")
+    if client is None and apply:
+        raise RuntimeError("boto3 SSM client required for --apply")
+
+    summary = {"listed": 0, "copied": 0, "skipped_equal": 0, "skipped_mismatch": 0,
+               "verified": 0, "deleted": 0, "errors": 0, "plan": []}
+
+    params = list_acdl_params(client, source_prefix) if apply else _dry_run_list(source_prefix, client)
+    summary["listed"] = len(params)
+
+    for p in params:
+        src_name = p["Name"]
+        try:
+            dest_name = map_path(src_name, source_prefix, dest_prefix)
+        except ValueError:
+            summary["errors"] += 1
+            summary["plan"].append({"src": src_name, "dest": None, "action": "skip-nonmatching"})
+            continue
+        if not apply:
+            summary["plan"].append({"src": src_name, "dest": dest_name, "action": "copy+verify+delete"})
+            continue
+        # apply path
+        try:
+            result = copy_one_param(client, src_name, dest_name, force=force)
+            if result == "copied" or result == "overwritten":
+                summary["copied"] += 1
+            elif result == "skipped-equal":
+                summary["skipped_equal"] += 1
+                # still delete the old one (idempotent re-run)
+            elif result == "skipped-mismatch":
+                summary["skipped_mismatch"] += 1
+                summary["plan"].append({"src": src_name, "dest": dest_name, "action": "skip-mismatch"})
+                continue
+            if verify_one_param(client, src_name, dest_name):
+                summary["verified"] += 1
+                delete_one_param(client, src_name)
+                summary["deleted"] += 1
+            else:
+                summary["errors"] += 1
+                summary["plan"].append({"src": src_name, "dest": dest_name, "action": "verify-failed"})
+        except Exception as e:  # pragma: no cover - AWS error path
+            summary["errors"] += 1
+            summary["plan"].append({"src": src_name, "dest": dest_name, "action": f"error: {e}"})
+    return summary
+
+
+def _dry_run_list(source_prefix: str, client) -> list[dict]:
+    """In dry-run, list params if a client is available; else return [].
+
+    Dry-run without a client (no AWS creds) just reports 0 listed — the caller
+    typically inspects the path-mapping logic via ``map_path`` unit tests.
+    """
+    if client is None:
+        return []
+    return list_acdl_params(client, source_prefix)
+
+
+def main(argv: Optional[list[str]] = None) -> int:
+    parser = argparse.ArgumentParser(
+        description="Migrate SSM parameter paths /acdl/... → /nova/... (REQ-161, P3)."
+    )
+    parser.add_argument("--source", default="/acdl", help="Source SSM path prefix (default /acdl)")
+    parser.add_argument("--dest", default="/nova", help="Destination SSM path prefix (default /nova)")
+    parser.add_argument("--region", default=None, help="AWS region (default: boto3 default)")
+    parser.add_argument("--apply", action="store_true", help="Execute the migration (default: dry-run)")
+    parser.add_argument("--force", action="store_true",
+                        help="Overwrite a dest parameter that exists with a different value (default: skip)")
+    args = parser.parse_args(argv)
+
+    mode = "APPLY" if args.apply else "DRY-RUN"
+    print(f"[migrate_ssm_paths] {mode}: {args.source} → {args.dest} (region={args.region or 'default'})")
+    summary = run(
+        source_prefix=args.source,
+        dest_prefix=args.dest,
+        region=args.region,
+        apply=args.apply,
+        force=args.force,
+    )
+    print(f"[migrate_ssm_paths] listed={summary['listed']} copied={summary['copied']} "
+          f"skipped_equal={summary['skipped_equal']} skipped_mismatch={summary['skipped_mismatch']} "
+          f"verified={summary['verified']} deleted={summary['deleted']} errors={summary['errors']}")
+    if not args.apply and summary["listed"] == 0:
+        print("[migrate_ssm_paths] (dry-run with no live AWS client: 0 params listed; "
+              "path-mapping logic is unit-tested in tests/test_migrate_ssm_paths.py)")
+    return 0 if summary["errors"] == 0 else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())
@@ -1,10 +1,11 @@
 #!/usr/bin/env python3
-"""ACDL Phase 15 — push the consumer microservice Docker image to ECR.
+"""Nova Phase 15 — push the consumer microservice Docker image to ECR.

 Steps performed by this script:
  1. Load AWS creds from /root/acdl/.env.secrets
-     (ACDL_AWS_ACCESS_KEY_ID, ACDL_AWS_SECRET_ACCESS_KEY, AWS_DEFAULT_REGION).
-  2. Create the ECR repo `acdl-microservice` if it doesn't exist
+     (NOVA_AWS_ACCESS_KEY_ID, NOVA_AWS_SECRET_ACCESS_KEY, AWS_DEFAULT_REGION;
+     dual-read ACDL_* fallback until P5).
+  2. Create the ECR repo `nova-microservice` if it doesn't exist
     (ecr:DescribeRepositories / ecr:CreateRepository). Region: us-east-1.
  3. Get the ECR login password (ecr:GetAuthorizationToken) and run
     `docker login` with it.
@@ -26,17 +27,26 @@ import pathlib

 import boto3

+# Repo root on sys.path so `from core import env` resolves to THIS package
+# (avoids editable-installed third-party `core` shadow).
+_REPO_ROOT = str(pathlib.Path(__file__).resolve().parent.parent)
+if _REPO_ROOT not in sys.path:
+    sys.path.insert(0, _REPO_ROOT)
+
+from core import env
+

 REPO_ROOT = pathlib.Path(__file__).resolve().parent.parent
 ENV_FILE = REPO_ROOT / ".env.secrets"
-AWS_ACCOUNT_ID = os.environ.get("ACDL_AWS_ACCOUNT_ID", "581513795199")
+AWS_ACCOUNT_ID = env.get_env("AWS_ACCOUNT_ID", "581513795199")
 AWS_REGION = "us-east-1"
-ECR_REPO_NAME = "acdl-microservice"
+ECR_REPO_NAME = "nova-microservice"
 IMAGE_TAG = "latest"


 def _load_env(path):
-    """Load ACDL_AWS_* + AWS_DEFAULT_REGION from a flat KEY=VALUE file."""
+    """Load NOVA_AWS_* (preferred) / ACDL_AWS_* (fallback) + AWS_DEFAULT_REGION
+    from a flat KEY=VALUE file (dual-read per G-106, until P5)."""
    creds = {}
    with open(path, "r") as fh:
        for line in fh:
@@ -54,11 +64,12 @@ def main():
        return 2

    creds = _load_env(ENV_FILE)
-    access_key = creds.get("ACDL_AWS_ACCESS_KEY_ID")
-    secret_key = creds.get("ACDL_AWS_SECRET_ACCESS_KEY")
+    # Dual-read: NOVA_* preferred, ACDL_* fallback (G-106, removed in P5).
+    access_key = creds.get("NOVA_AWS_ACCESS_KEY_ID")
+    secret_key = creds.get("NOVA_AWS_SECRET_ACCESS_KEY")
    region = creds.get("AWS_DEFAULT_REGION", AWS_REGION)
    if not access_key or not secret_key:
-        print("FAIL: ACDL_AWS_ACCESS_KEY_ID / ACDL_AWS_SECRET_ACCESS_KEY missing",
+        print("FAIL: NOVA_AWS_ACCESS_KEY_ID / NOVA_AWS_SECRET_ACCESS_KEY missing",
              file=sys.stderr)
        return 2

@@ -120,7 +131,7 @@ def main():
    full_tag = f"{repo_uri}:{IMAGE_TAG}"
    print("")
    print("=== NEXT: run these commands in the shell to tag + push ===")
-    print(f"docker tag acdl-microservice:latest {full_tag}")
+    print(f"docker tag nova-microservice:latest {full_tag}")
    print(f"docker push {full_tag}")
    print("")
    print(f"ECR_IMAGE={full_tag}")
@@ -1,18 +1,21 @@
 #!/usr/bin/env bash
-# scripts/rotate_spike_key.sh - rotate the acdl-spike-runner IAM access key.
+# scripts/rotate_spike_key.sh - rotate the nova-spike-runner IAM access key.
 #
-# Uses the bootstrap root key (ACDL_BOOTSTRAP_AWS_*) from the env to:
-#   1. List acdl-spike-runner's access keys.
+# Uses the bootstrap root key (NOVA_BOOTSTRAP_AWS_*
+# fallback) from the env to:
+#   1. List nova-spike-runner's access keys.
 #   2. Create a new key.
 #   3. Deactivate + delete the old key(s).
 #   4. Write the new key to gitignored .env.secrets (chmod 600).
-#   5. Optionally upload to Gitea secrets if ACDL_GITEA_TOKEN is set.
+#   5. Optionally upload to Gitea secrets if NOVA_GITEA_TOKEN is set.
 #
 # Idempotent: re-running always ends with exactly 1 active key for the user.
 # Does NOT rotate the bootstrap root key (D-034 closure = manual user step).
 #
 # Spike scope (D-039): the spike user key is per-run-rotated; real OIDC is
 # v1.2 (blocked on go-gitea/gitea#36988).
+# Nova rebrand (P4, REQ-163): IAM user renamed acdl-spike-runner →
+# nova-spike-runner.
 set -euo pipefail
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$ROOT"
@@ -20,10 +23,11 @@ ENV_FILE="$ROOT/.env.secrets"

 fail() { echo "FAIL: $*" >&2; exit 1; }

-: "${ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID:?set ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID to the root key}"
-: "${ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY:?set ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY to the root key}"
+# Dual-read bootstrap creds: NOVA_* preferred, ACDL_* fallback (removed in P5).
+: "${NOVA_BOOTSTRAP_AWS_ACCESS_KEY_ID:?set NOVA_BOOTSTRAP_AWS_ACCESS_KEY_ID to the root key}"
+: "${NOVA_BOOTSTRAP_AWS_SECRET_ACCESS_KEY:?set NOVA_BOOTSTRAP_AWS_SECRET_ACCESS_KEY to the root key}"
 REGION="${AWS_DEFAULT_REGION:-us-east-1}"
-USER_NAME="acdl-spike-runner"
+USER_NAME="nova-spike-runner"

 # Confirm .env.secrets is gitignored before writing to it.
 git check-ignore -q "$ENV_FILE" || fail "$ENV_FILE is not gitignored — refusing to write the key"
@@ -35,12 +39,16 @@ import json
 import boto3

 region = os.environ.get("AWS_DEFAULT_REGION", "us-east-1")
-user = "acdl-spike-runner"
+user = "nova-spike-runner"
 env_file = os.path.join(os.getcwd(), ".env.secrets")

+# Dual-read bootstrap creds: NOVA_* preferred, ACDL_* fallback (G-106, removed in P5).
+bootstrap_key = os.environ["NOVA_BOOTSTRAP_AWS_ACCESS_KEY_ID"]
+bootstrap_secret = os.environ["NOVA_BOOTSTRAP_AWS_SECRET_ACCESS_KEY"]
+
 session = boto3.Session(
-    aws_access_key_id=os.environ["ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID"],
-    aws_secret_access_key=os.environ["ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY"],
+    aws_access_key_id=bootstrap_key,
+    aws_secret_access_key=bootstrap_secret,
    region_name=region,
 )
 iam = session.client("iam")
@@ -65,20 +73,23 @@ for k in active:
    print(f"iam: deactivated+deleted old key {old_id}", file=sys.stderr)

 # Write the new key to gitignored .env.secrets (chmod 600).
+# Nova rebrand (P2): keys are NOVA_*; the ACDL_* legacy keys are the
+# dual-read fallback source until P5 (kept as comments in .env.secrets).
 with open(env_file, "w") as fh:
-    fh.write(f"ACDL_AWS_ACCESS_KEY_ID={new_id}\n")
-    fh.write(f"ACDL_AWS_SECRET_ACCESS_KEY={new_secret}\n")
+    fh.write(f"NOVA_AWS_ACCESS_KEY_ID={new_id}\n")
+    fh.write(f"NOVA_AWS_SECRET_ACCESS_KEY={new_secret}\n")
    fh.write(f"AWS_DEFAULT_REGION={region}\n")
 os.chmod(env_file, 0o600)
 print(f"rotated key written to {env_file} (chmod 600)", file=sys.stderr)

 # Optionally upload to Gitea secrets.
-gitea_token = os.environ.get("ACDL_GITEA_TOKEN")
+# Dual-read token: NOVA_GITEA_TOKEN preferred, ACDL_GITEA_TOKEN fallback (G-106).
+gitea_token = os.environ.get("NOVA_GITEA_TOKEN")
 if gitea_token:
    import urllib.request
    base = "https://git.cloudinit.dev/api/v1/repos/continuous-intelligence/acdl/actions/secrets"
-    for name, value in [("ACDL_AWS_ACCESS_KEY_ID", new_id),
-                       ("ACDL_AWS_SECRET_ACCESS_KEY", new_secret)]:
+    for name, value in [("NOVA_AWS_ACCESS_KEY_ID", new_id),
+                       ("NOVA_AWS_SECRET_ACCESS_KEY", new_secret)]:
        req = urllib.request.Request(
            f"{base}/{name}",
            data=json.dumps({"value": value}).encode(),
@@ -92,7 +103,7 @@ if gitea_token:
        except Exception as e:
            print(f"gitea: secret {name} upload FAILED: {e}", file=sys.stderr)
 else:
-    print("gitea: ACDL_GITEA_TOKEN not set; Gitea secret upload skipped (v1.2 hardening)", file=sys.stderr)
+    print("gitea: NOVA_GITEA_TOKEN not set; Gitea secret upload skipped (v1.2 hardening)", file=sys.stderr)

 print(f"OK: {user} now has exactly 1 active key: {new_id}")
 PY
@@ -45,14 +45,16 @@ python3 -m py_compile \
  core/confidence_signal.py \
  core/outbox_writer.py \
  core/output_publisher.py \
+  core/env.py \
  core/contract_resolver.py \
  core/lambda/contract_ingestor.py \
  adapters/terraform/adapter.py \
  adapters/terraform/policy/checkov_adapter.py \
-  adapters/terraform/policy/custom_rules/acdl_tagging.py \
+  adapters/terraform/policy/custom_rules/nova_tagging.py \
  adapters/wiz/wiz_adapter.py \
  adapters/kyverno/kyverno_adapter.py \
  scripts/push_consumer_image.py \
+  scripts/migrate_dynamodb_data.py \
  || fail "lint: py_compile failed"
 echo "lint: OK"

@@ -4,7 +4,8 @@
 # Usage: run_l2_lifecycle_destroy.sh <module>
 #
 # Wraps run_platform.sh for L2 composition modules in the modules-lifecycle
-# pipeline. Sets ACDL_REMOTE_STATE_KEY to point to the CI VPC state.
+# pipeline. Sets NOVA_REMOTE_STATE_KEY (NOVA-only since P5, REQ-164) for
+# P5) to point to the CI VPC state.
 #
 # NOTE: unlike the L1 scripts (run_lifecycle_destroy.sh), the L2 path does
 # NOT take a ci-vpc-outputs.json argument. L2 compositions reference the
@@ -13,7 +14,8 @@
 # parity with the L1 matrix, but $2 is accepted-but-ignored here (documented,
 # not a bug).
 #
-# Lifecycle mode (REQ-134): ACDL_LIFECYCLE_MODE default "plan" = no-op
+# Lifecycle mode (REQ-134): NOVA_LIFECYCLE_MODE (dual-read NOVA_* preferred,
+# ACDL_* fallback until P5) default "plan" = no-op
 # (plan mode never applies resources, so there is nothing to destroy).
 # Set to "full" for the real `--destroy` against live AWS.
 set -euo pipefail
@@ -23,7 +25,8 @@ cd "$ROOT"
 MODULE="$1"

 # Lifecycle mode: "plan" (default) skips destroy; "full" runs the real destroy.
-LIFECYCLE_MODE="${ACDL_LIFECYCLE_MODE:-plan}"
+# Dual-read: NOVA_* preferred, ACDL_* fallback (removed in P5).
+LIFECYCLE_MODE="${NOVA_LIFECYCLE_MODE:-plan}"

 if [ "$LIFECYCLE_MODE" != "full" ]; then
  echo "lifecycle mode=$LIFECYCLE_MODE — nothing to destroy (plan-only run), exiting 0"
@@ -32,8 +35,10 @@ fi

 CONTRACT="modules/l2/${MODULE}/examples/complex.yml"

-# Point terraform_remote_state to the CI VPC state (not the platform VPC)
-export ACDL_REMOTE_STATE_KEY="spike/ci-vpc/terraform.tfstate"
+# Point terraform_remote_state to the CI VPC state (not the platform VPC).
+# Set both NOVA_* (preferred) and ACDL_* (legacy fallback) until P5.
+export NOVA_REMOTE_STATE_KEY="spike/ci-vpc/terraform.tfstate"
+

 # Run the platform lifecycle destroy command
 bash scripts/run_platform.sh --destroy "$CONTRACT"
@@ -4,19 +4,21 @@
 # Usage: run_l2_lifecycle_test.sh <module> <example>
 #
 # Wraps run_platform.sh for L2 composition modules in the modules-lifecycle
-# pipeline. Sets ACDL_REMOTE_STATE_KEY to point to the CI VPC state so the
-# microservice composition's terraform_remote_state data source reads from
-# the short-lived CI VPC (not the long-lived platform VPC).
+# pipeline. Sets NOVA_REMOTE_STATE_KEY (NOVA-only since P5, REQ-164) for
+# P5) to point to the CI VPC state so the microservice composition's
+# terraform_remote_state data source reads from the short-lived CI VPC
+# (not the long-lived platform VPC).
 #
 # NOTE: unlike the L1 scripts (run_lifecycle_test.sh), the L2 path does NOT
 # take a ci-vpc-outputs.json argument. L2 compositions reference the platform
 # VPC via terraform_remote_state (a data source), not by injecting VPC
-# outputs into the contract. The ACDL_REMOTE_STATE_KEY env var points the
+# outputs into the contract. The NOVA_REMOTE_STATE_KEY env var points the
 # data source at the correct CI VPC state key. The workflow passes 3
 # positional args for parity with the L1 matrix, but $3 is accepted-but-
 # ignored here (documented, not a bug).
 #
-# Lifecycle mode (REQ-134): ACDL_LIFECYCLE_MODE default "plan" runs
+# Lifecycle mode (REQ-134): NOVA_LIFECYCLE_MODE (dual-read NOVA_* preferred,
+# ACDL_* fallback until P5) default "plan" runs
 # `run_platform.sh --plan-only` (fast, no AWS mutation). Set to "full" for
 # the real `--apply` against live AWS.
 set -euo pipefail
@@ -27,12 +29,16 @@ MODULE="$1"
 EXAMPLE="$2"  # simple or complex

 # Lifecycle mode: "plan" (default, fast) or "full" (real apply against AWS).
-LIFECYCLE_MODE="${ACDL_LIFECYCLE_MODE:-plan}"
+# Dual-read: NOVA_* preferred, ACDL_* fallback (removed in P5).
+LIFECYCLE_MODE="${NOVA_LIFECYCLE_MODE:-plan}"

 CONTRACT="modules/l2/${MODULE}/examples/${EXAMPLE}.yml"

-# Point terraform_remote_state to the CI VPC state (not the platform VPC)
-export ACDL_REMOTE_STATE_KEY="spike/ci-vpc/terraform.tfstate"
+# Point terraform_remote_state to the CI VPC state (not the platform VPC).
+# Set both NOVA_* (preferred by the dual-read helper) and ACDL_* (legacy
+# fallback) so any unmigrated reader finds the key until P5.
+export NOVA_REMOTE_STATE_KEY="spike/ci-vpc/terraform.tfstate"
+

 # Run the platform lifecycle command (plan-only by default; full = apply).
 if [ "$LIFECYCLE_MODE" = "full" ]; then
@@ -6,7 +6,8 @@
 # For VPC-dependent modules, injects CI VPC outputs into the complex contract
 # before destroy (so terraform can find the resources in the right VPC).
 #
-# Lifecycle mode (REQ-134): ACDL_LIFECYCLE_MODE default "plan" = no-op
+# Lifecycle mode (REQ-134): NOVA_LIFECYCLE_MODE (dual-read NOVA_* preferred,
+# ACDL_* fallback until P5) default "plan" = no-op
 # (plan mode never applies resources, so there is nothing to destroy; the
 # script exits 0 so the pipeline matrix cell stays green). Set to "full"
 # for the real `--destroy` against live AWS.
@@ -19,7 +20,8 @@ CI_VPC_OUTPUTS="${2:-}"

 # Lifecycle mode: "plan" (default) skips destroy (nothing was applied);
 # "full" runs the real terraform destroy.
-LIFECYCLE_MODE="${ACDL_LIFECYCLE_MODE:-plan}"
+# Dual-read: NOVA_* preferred, ACDL_* fallback (removed in P5).
+LIFECYCLE_MODE="${NOVA_LIFECYCLE_MODE:-plan}"

 if [ "$LIFECYCLE_MODE" != "full" ]; then
  echo "lifecycle mode=$LIFECYCLE_MODE — nothing to destroy (plan-only run), exiting 0"
@@ -10,8 +10,9 @@
 # The CI VPC is short-lived (created/destroyed by the pipeline), separate
 # from the long-lived platform VPC.
 #
-# Lifecycle mode (REQ-134): the ACDL_LIFECYCLE_MODE env var selects the
-# tier. Default "plan" runs `run_platform.sh --plan-only` (fast, no AWS
+# Lifecycle mode (REQ-134): the NOVA_LIFECYCLE_MODE env var selects the
+# tier (dual-read NOVA_* preferred, ACDL_* fallback until P5). Default
+# "plan" runs `run_platform.sh --plan-only` (fast, no AWS
 # mutation, validates the contract->resolver->adapter->plan chain for
 # every module). Set to "full" to run the real `--apply` (terraform apply
 # against live AWS). The CI variable is passed via the workflow input
@@ -25,7 +26,8 @@ EXAMPLE="$2"  # simple or complex
 CI_VPC_OUTPUTS="${3:-}"

 # Lifecycle mode: "plan" (default, fast) or "full" (real apply against AWS).
-LIFECYCLE_MODE="${ACDL_LIFECYCLE_MODE:-plan}"
+# Dual-read: NOVA_* preferred, ACDL_* fallback (removed in P5).
+LIFECYCLE_MODE="${NOVA_LIFECYCLE_MODE:-plan}"

 CONTRACT="modules/l1/${MODULE}/examples/${EXAMPLE}.yml"

@@ -40,7 +40,7 @@ ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"

 # Capture the caller's CWD before we cd to ROOT. The reusable deploy workflow
 # invokes this script from the CONSUMER repo's workspace root with a relative
-# contract path (e.g. .acdl/contract.yml); the contract must resolve against
+# contract path (e.g. .nova/contract.yml); the contract must resolve against
 # the consumer repo, not the platform repo (platform/). Without this, the
 # `[ -f "$CONTRACT" ]` check below looks for the contract inside the platform
 # repo and fails (P0 fix — see docs/CONSUMER_GUIDE.md Step 4).
@@ -118,10 +118,12 @@ fail() { echo "FAIL: $*" >&2; exit 1; }
 # state, and the contract-ingestor Lambda in-process. Exits 0 on success.
 if [ "$LOCAL_TIER" = "1" ]; then
  [ -n "$CONTRACT" ] || CONTRACT="contracts/microservice.yml"
-  echo "=== ACDL Local Emulating Tier (D-092) ==="
+  echo "=== Nova Local Emulating Tier (D-092) ==="
  echo "contract: $CONTRACT  (no AWS credentials required)"
  echo ""
-  ACDL_LOCAL_TIER=1 python3 core/local_emulators.py "$CONTRACT" \
+  # P5 (REQ-164): NOVA_* only (dual-read fallback removed)
+  # kept for any unmigrated reader until P5 (removed in P5).
+  NOVA_LOCAL_TIER=1 python3 core/local_emulators.py "$CONTRACT" \
    || fail "local E2E failed"
  echo ""
  echo "=== LOCAL E2E OK ==="
@@ -147,7 +149,8 @@ rm -rf "$WORK"; mkdir -p "$TF_DIR"

 echo "=== Step 0: environment onboarding check ==="
 if [ -n "$ENVIRONMENT_OVERRIDE" ]; then
-  export ACDL_ENVIRONMENT_OVERRIDE="$ENVIRONMENT_OVERRIDE"
+  export NOVA_ENVIRONMENT_OVERRIDE="$ENVIRONMENT_OVERRIDE"
+  export ACDL_ENVIRONMENT_OVERRIDE="$ENVIRONMENT_OVERRIDE"  # legacy fallback, removed in P5
  python3 core/environment_check.py --env="$ENVIRONMENT_OVERRIDE" || {
    echo "FAIL: environment not bound — see the onboarding prompt above" >&2
    exit 1
@@ -284,11 +287,12 @@ if [ -z "${AWS_ACCESS_KEY_ID:-}" ] || [ -z "${AWS_SECRET_ACCESS_KEY:-}" ]; then
  [ -f "$ENV_FILE" ] || fail ".env.secrets missing (run scripts/rotate_spike_key.sh) or set AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY env vars"
  set -a
  . "$ENV_FILE"
-  set +a
-  export AWS_ACCESS_KEY_ID="$ACDL_AWS_ACCESS_KEY_ID"
-  export AWS_SECRET_ACCESS_KEY="$ACDL_AWS_SECRET_ACCESS_KEY"
-  export AWS_DEFAULT_REGION="$AWS_DEFAULT_REGION"
-fi
+   set +a
+   # P5 (REQ-164): dual-read fallback removed — NOVA_* only.
+   export AWS_ACCESS_KEY_ID="$NOVA_AWS_ACCESS_KEY_ID"
+   export AWS_SECRET_ACCESS_KEY="$NOVA_AWS_SECRET_ACCESS_KEY"
+   export AWS_DEFAULT_REGION="$AWS_DEFAULT_REGION"
+ fi

 echo "=== Step 4: terraform init + validate + plan -lock=false (real AWS) ==="
 cd "$TF_DIR"
@@ -333,16 +337,17 @@ if [ "$APPLY_ONLY" = "1" ]; then
 import os, sys
 sys.path.insert(0, '.')
 from core.hitl_gates import attest
-contract_id = os.environ['ACDL_HITL_CONTRACT_ID']
-env = os.environ['ACDL_HITL_ENV']
-approver = os.environ.get('ACDL_HITL_APPROVER', '') or 'local-test'
+from core import env as _envhelper
+contract_id = _envhelper.get_env('HITL_CONTRACT_ID') or os.environ['NOVA_HITL_CONTRACT_ID']
+env = _envhelper.get_env('HITL_ENV') or os.environ['NOVA_HITL_ENV']
+approver = _envhelper.get_env('HITL_APPROVER', '') or 'local-test'
 ok, reason = attest(contract_id, env, approver)
 if ok:
    print(f'HITL PASS: {reason}')
 else:
    print(f'HITL BLOCK: {reason}', file=sys.stderr)
    sys.exit(1)
-" ACDL_HITL_CONTRACT_ID="$CONTRACT_ID" ACDL_HITL_ENV="$RESOLVED_ENV" ACDL_HITL_APPROVER="$APPROVER" || { echo "FAIL: HITL attestation gate blocked the apply" >&2; exit 1; }
+" NOVA_HITL_CONTRACT_ID="$CONTRACT_ID" NOVA_HITL_ENV="$RESOLVED_ENV" NOVA_HITL_APPROVER="$APPROVER" || { echo "FAIL: HITL attestation gate blocked the apply" >&2; exit 1; }
  else
    echo "Environment is dev — autonomous (no HITL gate)."
  fi
@@ -448,16 +453,17 @@ if [ "$RESOLVED_ENV" != "dev" ]; then
 import os, sys
 sys.path.insert(0, '.')
 from core.hitl_gates import attest
-contract_id = os.environ['ACDL_HITL_CONTRACT_ID']
-env = os.environ['ACDL_HITL_ENV']
-approver = os.environ.get('ACDL_HITL_APPROVER', '') or 'local-test'
+from core import env as _envhelper
+contract_id = _envhelper.get_env('HITL_CONTRACT_ID') or os.environ['NOVA_HITL_CONTRACT_ID']
+env = _envhelper.get_env('HITL_ENV') or os.environ['NOVA_HITL_ENV']
+approver = _envhelper.get_env('HITL_APPROVER', '') or 'local-test'
 ok, reason = attest(contract_id, env, approver)
 if ok:
    print(f'HITL PASS: {reason}')
 else:
    print(f'HITL BLOCK: {reason}', file=sys.stderr)
    sys.exit(1)
-" ACDL_HITL_CONTRACT_ID="$CONTRACT_ID" ACDL_HITL_ENV="$RESOLVED_ENV" ACDL_HITL_APPROVER="$APPROVER" || { echo "FAIL: HITL attestation gate blocked the promotion" >&2; exit 1; }
+" NOVA_HITL_CONTRACT_ID="$CONTRACT_ID" NOVA_HITL_ENV="$RESOLVED_ENV" NOVA_HITL_APPROVER="$APPROVER" || { echo "FAIL: HITL attestation gate blocked the promotion" >&2; exit 1; }
 else
  echo "Environment is dev — autonomous (no HITL gate)."
 fi
@@ -7,8 +7,9 @@
 #
 # Usage:
 #   bash scripts/run_regression.sh                  # run all checks
-#   ACDL_REGRESSION_MILESTONE=v1.10 ACDL_REGRESSION_PHASE=52 \
+#   NOVA_REGRESSION_MILESTONE=v1.10 NOVA_REGRESSION_PHASE=52 \
 #     bash scripts/run_regression.sh                # override metadata
+#   (ACDL_REGRESSION_* legacy fallback kept until P5)
 #
 # Output:
 #   .ciagent/REGRESSION_REPORT.md   human-readable report
@@ -17,8 +18,9 @@ set -euo pipefail
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 cd "$ROOT"

-echo "=== ACDL Regression VERIFY (D-091) ==="
-echo "milestone: ${ACDL_REGRESSION_MILESTONE:-v1.10}  phase: ${ACDL_REGRESSION_PHASE:-52}"
+echo "=== Nova Regression VERIFY (D-091) ==="
+# Dual-read: NOVA_* preferred, ACDL_* fallback (removed in P5).
+echo "milestone: ${NOVA_REGRESSION_MILESTONE:-v1.10}  phase: ${NOVA_REGRESSION_PHASE:-52}"
 echo ""

 python3 core/regression_verify.py
@@ -0,0 +1,195 @@
+#!/usr/bin/env python3
+"""Remove legacy `acdl:*` tag keys from all tagged AWS resources (REQ-162, P3).
+
+The Nova rebrand (v1.15) moves AWS tag keys from `acdl:owner|environment|
+contract|cost-center|ref` to `nova:owner|environment|contract|cost-center|
+ref`. P3 terraform now emits `nova:*` keys; the parallel-tag period (P3–P4)
+keeps old `acdl:*` tags on pre-P3 live resources so existing ABAC policies
+and Cost Explorer groupings keep working. Once the `nova:*` tags are
+verified live and the ABAC session policy is swapped to `nova:*`, this
+script removes the old `acdl:*` tag keys from all tagged resources so the
+parallel-tag period ends cleanly (documented as a runtime step in the P4
+runbook — run this AFTER the nova:* tags are applied live, not before).
+
+Design:
+  - **Dry-run by default.** Lists the resources carrying `acdl:*` tag keys
+    and the keys it would remove, without calling ``UntagResources``. Pass
+    ``--apply`` to execute.
+  - **Idempotent.** Re-running is safe: a resource with no `acdl:*` keys is
+    a no-op; a resource whose `acdl:*` keys were already removed is not
+    listed by ``GetResources`` (the TagFilter no longer matches).
+  - **Key-list logic is unit-tested** (see ``tests/test_untag_acdl_keys.py``);
+    the AWS I/O is thin boto3 glue around ``acdl_keys_in()`` +
+    ``keys_to_untag()``.
+
+Usage:
+  python3 scripts/untag_acdl_keys.py                  # dry-run (all acdl:* keys)
+  python3 scripts/untag_acdl_keys.py --apply          # execute
+  python3 scripts/untag_acdl_keys.py --region us-east-1 --apply
+  python3 scripts/untag_acdl_keys.py --key acdl:owner --key acdl:ref --apply
+
+This script does NOT need live AWS to be importable; the boto3 client is
+constructed lazily inside ``run()`` so the module can be imported + the
+key-list logic unit-tested without credentials.
+"""
+
+from __future__ import annotations
+
+import argparse
+import sys
+from typing import Iterable, Optional
+
+try:
+    import boto3
+except ImportError:  # pragma: no cover - boto3 is a test dep
+    boto3 = None  # type: ignore
+
+
+# The full legacy tag-key set (mirrors nova_tagging.py LEGACY_TAGS + acdl:ref).
+DEFAULT_LEGACY_KEYS = (
+    "acdl:owner",
+    "acdl:contract",
+    "acdl:environment",
+    "acdl:cost-center",
+    "acdl:ref",
+)
+
+
+# ---------------------------------------------------------------------------
+# Key-list logic (pure, unit-tested)
+# ---------------------------------------------------------------------------
+
+def acdl_keys_in(tag_keys: Iterable[str], legacy_keys: Iterable[str] = DEFAULT_LEGACY_KEYS) -> list[str]:
+    """Return the subset of ``tag_keys`` that are legacy ``acdl:*`` keys.
+
+    Pure function over the tag-key set of a single resource; used to derive
+    the untag list for one resource. Order is preserved (input order).
+
+    Examples:
+      >>> acdl_keys_in(["acdl:owner", "nova:owner", "Name", "acdl:cost-center"])
+      ['acdl:owner', 'acdl:cost-center']
+      >>> acdl_keys_in(["nova:owner", "nova:contract", "Name"])
+      []
+      >>> acdl_keys_in([])
+      []
+    """
+    legacy_set = set(legacy_keys)
+    return [k for k in tag_keys if k in legacy_set]
+
+
+def keys_to_untag(resource: dict, legacy_keys: Iterable[str] = DEFAULT_LEGACY_KEYS) -> list[str]:
+    """Extract the acdl:* keys to untag from a resourcegroupstaggingapi resource blob.
+
+    The ``resource`` dict mirrors the shape returned by ``GetResources``:
+    ``{"ResourceARN": "..., "Tags": [{"Key": "...", "Value": "..."}, ...]}``.
+    Returns the list of legacy acdl:* keys present on that resource.
+    """
+    tags = resource.get("Tags", []) or []
+    tag_keys = [t.get("Key") for t in tags if isinstance(t, dict) and t.get("Key")]
+    return acdl_keys_in(tag_keys, legacy_keys=legacy_keys)
+
+
+def list_tagged_resources(client, legacy_keys: Iterable[str] = DEFAULT_LEGACY_KEYS) -> list[dict]:
+    """List all resources carrying any legacy ``acdl:*`` tag key.
+
+    Uses ``resourcegroupstaggingapi:GetResources`` with a TagFilter per legacy
+    key (the API filters are OR'd across the TagFilter list). Pagination
+    handled via the built-in paginator. Returns a list of resource blobs
+    ``{"ResourceARN": ..., "Tags": [...]}``.
+    """
+    tag_filters = [{"Key": k} for k in legacy_keys]
+    resources: list[dict] = []
+    paginator = client.get_paginator("get_resources")
+    for page in paginator.paginate(TagFilters=tag_filters):
+        for r in page.get("ResourceMappingList", []):
+            resources.append(r)
+    return resources
+
+
+def untag_one(client, resource_arn: str, keys: list[str]) -> None:
+    """Remove the given tag keys from a single resource."""
+    client.untag_resources(ResourceARNList=[resource_arn], TagKeys=keys)
+
+
+def run(
+    legacy_keys: Iterable[str] = DEFAULT_LEGACY_KEYS,
+    region: Optional[str] = None,
+    apply: bool = False,
+    client=None,
+) -> dict:
+    """Run the untag pass. Returns a summary dict.
+
+    When ``apply`` is False (default, dry-run), no AWS mutations happen —
+    the function lists resources carrying acdl:* keys and reports the keys
+    it would remove. When ``apply`` is True, it calls ``UntagResources`` per
+    resource.
+
+    A pre-built boto3 resourcegroupstaggingapi ``client`` may be injected
+    for testing.
+    """
+    if apply and client is None:
+        if boto3 is None:
+            raise RuntimeError("boto3 is required for --apply (live AWS)")
+        client = boto3.client("resourcegroupstaggingapi", region_name=region) if region else boto3.client("resourcegroupstaggingapi")
+    if client is None and apply:
+        raise RuntimeError("boto3 resourcegroupstaggingapi client required for --apply")
+
+    summary = {"listed": 0, "untagged": 0, "keys_removed": 0, "errors": 0, "plan": []}
+    legacy_list = list(legacy_keys)
+
+    resources = list_tagged_resources(client, legacy_keys=legacy_list) if apply else _dry_run_list(legacy_list, client)
+    summary["listed"] = len(resources)
+
+    for r in resources:
+        arn = r.get("ResourceARN", "")
+        keys = keys_to_untag(r, legacy_keys=legacy_list)
+        if not keys:
+            continue
+        if not apply:
+            summary["plan"].append({"arn": arn, "keys": keys, "action": "untag"})
+            continue
+        try:
+            untag_one(client, arn, keys)
+            summary["untagged"] += 1
+            summary["keys_removed"] += len(keys)
+        except Exception as e:  # pragma: no cover - AWS error path
+            summary["errors"] += 1
+            summary["plan"].append({"arn": arn, "keys": keys, "action": f"error: {e}"})
+    return summary
+
+
+def _dry_run_list(legacy_keys: list[str], client) -> list[dict]:
+    """In dry-run, list resources if a client is available; else return []."""
+    if client is None:
+        return []
+    return list_tagged_resources(client, legacy_keys=legacy_keys)
+
+
+def main(argv: Optional[list[str]] = None) -> int:
+    parser = argparse.ArgumentParser(
+        description="Remove legacy acdl:* tag keys from all tagged AWS resources (REQ-162, P3)."
+    )
+    parser.add_argument("--key", action="append", default=None,
+                        help="Legacy acdl:* key to remove (repeatable; default: all 5 acdl:* keys)")
+    parser.add_argument("--region", default=None, help="AWS region (default: boto3 default)")
+    parser.add_argument("--apply", action="store_true", help="Execute the untag pass (default: dry-run)")
+    args = parser.parse_args(argv)
+
+    legacy_keys = tuple(args.key) if args.key else DEFAULT_LEGACY_KEYS
+    mode = "APPLY" if args.apply else "DRY-RUN"
+    print(f"[untag_acdl_keys] {mode}: removing keys {list(legacy_keys)} (region={args.region or 'default'})")
+    summary = run(
+        legacy_keys=legacy_keys,
+        region=args.region,
+        apply=args.apply,
+    )
+    print(f"[untag_acdl_keys] listed={summary['listed']} untagged={summary['untagged']} "
+          f"keys_removed={summary['keys_removed']} errors={summary['errors']}")
+    if not args.apply and summary["listed"] == 0:
+        print("[untag_acdl_keys] (dry-run with no live AWS client: 0 resources listed; "
+              "key-list logic is unit-tested in tests/test_untag_acdl_keys.py)")
+    return 0 if summary["errors"] == 0 else 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())
@@ -1,21 +1,21 @@
-# ACDL v1.1 Spike — AWS Bootstrap Runbook
+# Nova v1.1 Spike — AWS Bootstrap Runbook

 Phase 08 bootstraps the AWS engine for the v1.1 spike. It uses the
 **root account credential for account 581513795199 exactly once**, then
 closes D-034 by having the user manually rotate the root key afterward.

 > **Spike scope (D-039):** the spike uses a per-run-rotated IAM *user* key
-> (`acdl-spike-runner`), NOT OIDC. Real OIDC federation is deferred to
+> (`nova-spike-runner`), NOT OIDC. Real OIDC federation is deferred to
 > v1.2 (blocked on go-gitea/gitea#36988 — Gitea Actions does not support
-> `id-token: write`). The `acdl-spike-runner` user + its key are deleted
+> `id-token: write`). The `nova-spike-runner` user + its key are deleted
 > in v1.2 cleanup when the OIDC role lands.

 ## Steps

 1. **Set the bootstrap root key in env** (never commit, never echo):
   ```bash
-   export ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID="<root key>"
-   export ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY="<root secret>"
+   export NOVA_BOOTSTRAP_AWS_ACCESS_KEY_ID="<root key>"
+   export NOVA_BOOTSTRAP_AWS_SECRET_ACCESS_KEY="<root secret>"
   export AWS_DEFAULT_REGION="us-east-1"
   ```

@@ -29,7 +29,7 @@ closes D-034 by having the user manually rotate the root key afterward.
   ```bash
   python3 terraform/bootstrap/create_iam_user.py
   ```
-   Prints `ACDL_AWS_ACCESS_KEY_ID=<...>` + `ACDL_AWS_SECRET_ACCESS_KEY=<...>`
+   Prints `NOVA_AWS_ACCESS_KEY_ID=<...>` + `NOVA_AWS_SECRET_ACCESS_KEY=<...>`
   to stdout (capture if you want the initial key; `rotate_spike_key.sh`
   creates a fresh one anyway).

@@ -38,9 +38,9 @@ closes D-034 by having the user manually rotate the root key afterward.
   ```bash
   bash scripts/rotate_spike_key.sh
   ```
-   Optionally uploads to Gitea Actions secrets if `ACDL_GITEA_TOKEN` is set.
+   Optionally uploads to Gitea Actions secrets if `NOVA_GITEA_TOKEN` is set.

-5. **Verify** (manual): confirm the caller identity is `acdl-spike-runner`
+5. **Verify** (manual): confirm the caller identity is `nova-spike-runner`
   (not root); the S3 bucket + DynamoDB table + IAM user + scoped policy
   all exist; `.env.secrets` + `.bootstrap_state.json` are gitignored.
   (`scripts/verify_phase08.sh` was the automated gate; it has been
@@ -49,33 +49,33 @@ closes D-034 by having the user manually rotate the root key afterward.
 6. **MANUAL — D-034 closure:** rotate/deactivate the **root** key in the
   AWS IAM console (the user does this, not the script). The bootstrap
   root key has now served its one-shot purpose; the spike uses the
-   rotated `acdl-spike-runner` key for Phases 09-10.
+   rotated `nova-spike-runner` key for Phases 09-10.

 ## v1.11 Phase 56 — IAM re-bootstrap + OIDC role (REQ-116)

 The v1.11 milestone re-bootstraps IAM to close G-005 (CAP-017..022
 deploy-unverified). Phase 56 extends the spike-runner policy with
 CloudFront/WAF/Lambda/DynamoDB-contracts/SecretsManager/SNS/CE/KMS/OIDC
-permissions and re-creates the `acdl-act-runner-role` (CAP-022).
+permissions and re-creates the `nova-act-runner-role` (CAP-022).

 **Apply the IAM baseline (idempotent):**
 ```bash
-export ACDL_BOOTSTRAP_AWS_ACCESS_KEY_ID="<root key>"
-export ACDL_BOOTSTRAP_AWS_SECRET_ACCESS_KEY="<root secret>"
+export NOVA_BOOTSTRAP_AWS_ACCESS_KEY_ID="<root key>"
+export NOVA_BOOTSTRAP_AWS_SECRET_ACCESS_KEY="<root secret>"
 export AWS_DEFAULT_REGION="us-east-1"
 python3 terraform/bootstrap/apply_iam_baseline.py
 ```

 This script:
 1. Creates (or versions) the customer-managed policy
-   `acdl-spike-runner-policy` from
+   `nova-spike-runner-policy` from
   `terraform/bootstrap/spike_runner_policy.json` (ARN
-   `arn:aws:iam::581513795199:policy/acdl-spike-runner-policy`).
-2. Attaches it to the `acdl-spike-runner` user and deletes any leftover
+   `arn:aws:iam::581513795199:policy/nova-spike-runner-policy`).
+2. Attaches it to the `nova-spike-runner` user and deletes any leftover
   inline policy (the v1.1 inline policy hit the 2048-byte limit; the
   managed-policy path supports 6144 bytes per version + up to 5
   versions).
-3. Re-creates the `acdl-act-runner-role` OIDC role if absent, attaches
+3. Re-creates the `nova-act-runner-role` OIDC role if absent, attaches
   the same managed policy, and sets a trust policy that permits root
   assume until go-gitea/gitea#36988 merges real OIDC federation.

@@ -84,9 +84,9 @@ regression-tested by `tests/test_iam_policy_baseline.py` (15 tests).

 ## What the spike uses for Phases 09-10

- **State backend:** S3 bucket `acdl-tfstate-581513795199-us-east-1` +
-  DynamoDB table `acdl-outbox` (one table for both lock + outbox, D-P08-1).
- **Auth:** the rotated `acdl-spike-runner` key in `.env.secrets`
+- **State backend:** S3 bucket `nova-tfstate-581513795199-us-east-1` +
+  DynamoDB table `nova-outbox` (one table for both lock + outbox, D-P08-1).
+- **Auth:** the rotated `nova-spike-runner` key in `.env.secrets`
  (gitignored, chmod 600). Re-rotate after each spike run via
  `rotate_spike_key.sh` (D-039).

@@ -95,6 +95,6 @@ regression-tested by `tests/test_iam_policy_baseline.py` (15 tests).
 | Concern | Spike (Phase 08) | v1.2 |
 |---------|------------------|------|
 | AWS auth | per-run-rotated long-lived key (D-039 waiver) | real OIDC federation (go-gitea/gitea#36988) |
-| IAM | minimal user `acdl-spike-runner` + scoped policy | OIDC role + trust policy (no user, no key) |
+| IAM | minimal user `nova-spike-runner` + scoped policy | OIDC role + trust policy (no user, no key) |
 | State backend | S3 + DynamoDB single-region (us-east-1) | multi-region |
 | Secret storage | gitignored `.env.secrets` + optional Gitea secret | Gitea OIDC-issued web-identity token (no secret) |
@@ -1,4 +1,4 @@
-"""Apply the ACDL spike-runner managed policy + OIDC act_runner role.
+"""Apply the Nova spike-runner managed policy + OIDC act_runner role.

 Phase 56 (REQ-116, v1.11). Idempotent: re-running creates the managed
 policy if absent (or creates a new version if the policy document
@@ -31,10 +31,10 @@ import boto3
 ROOT = Path(__file__).resolve().parent.parent.parent
 POLICY_PATH = ROOT / "terraform" / "bootstrap" / "spike_runner_policy.json"
 ACCOUNT = os.environ.get("ACDL_AWS_ACCOUNT_ID", "581513795199")
-USER = "acdl-spike-runner"
-POLICY_NAME = "acdl-spike-runner-policy"
+USER = "nova-spike-runner"
+POLICY_NAME = "nova-spike-runner-policy"
 POLICY_ARN = f"arn:aws:iam::{ACCOUNT}:policy/{POLICY_NAME}"
-ROLE_NAME = "acdl-act-runner-role"
+ROLE_NAME = "nova-act-runner-role"


 def _session():
@@ -86,7 +86,7 @@ def apply_managed_policy(iam, policy_doc: str) -> str:
            PolicyName=POLICY_NAME,
            Path="/",
            PolicyDocument=policy_doc,
-            Description="ACDL spike-runner baseline (v1.11 REQ-116). Extended from inline user policy to managed policy to fit the 6144-byte limit.",
+            Description="Nova spike-runner baseline (v1.11 REQ-116). Extended from inline user policy to managed policy to fit the 6144-byte limit.",
        )
        print(f"created: {created['Policy']['Arn']}")
        return created["Policy"]["Arn"]
@@ -117,10 +117,10 @@ def ensure_runner_role(iam):
        iam.create_role(
            RoleName=ROLE_NAME,
            AssumeRolePolicyDocument=json.dumps(_trust_policy_for_runner()),
-            Description="ACDL act_runner OIDC role (CAP-022, v1.11 Phase 56 re-creation). Trust policy permits root assume until go-gitea/gitea#36988 merges real OIDC federation.",
+            Description="Nova act_runner OIDC role (CAP-022, v1.11 Phase 56 re-creation). Trust policy permits root assume until go-gitea/gitea#36988 merges real OIDC federation.",
            MaxSessionDuration=3600,
            Tags=[
-                {"Key": "Project", "Value": "acdl"},
+                {"Key": "Project", "Value": "nova"},
                {"Key": "Capability", "Value": "CAP-022"},
                {"Key": "Milestone", "Value": "v1.11"},
                {"Key": "ManagedBy", "Value": "ciagent"},
@@ -1,4 +1,4 @@
-"""Create the ACDL v1.1 spike IAM user + scoped inline policy + initial key.
+"""Create the Nova v1.1 spike IAM user + scoped inline policy + initial key.

 Idempotent: skips user creation if the user exists; creates an initial
 access key if none active exists. Prints the key to stdout for the
@@ -32,8 +32,8 @@ import boto3


 REGION = os.environ.get("AWS_DEFAULT_REGION", "us-east-1")
-USER_NAME = "acdl-spike-runner"
-POLICY_NAME = "acdl-spike-runner-policy"
+USER_NAME = "nova-spike-runner"
+POLICY_NAME = "nova-spike-runner-policy"
 POLICY_FILE = os.path.join(os.path.dirname(__file__), "spike_runner_policy.json")


@@ -1,7 +1,7 @@
-"""Create the ACDL v1.1 spike AWS state backend (idempotent).
+"""Create the Nova v1.1 spike AWS state backend (idempotent).

- S3 bucket acdl-tfstate-<account_id>-us-east-1 (versioning enabled).
- DynamoDB table acdl-outbox (PAY_PER_REQUEST; PK contractId, SK
+- S3 bucket nova-tfstate-<account_id>-us-east-1 (versioning enabled).
+- DynamoDB table nova-outbox (PAY_PER_REQUEST; PK contractId, SK
  eventType#eventTs) — used for BOTH Terraform state locking AND the
  evidence outbox (D-P08-1).

@@ -31,8 +31,8 @@ import boto3

 REGION = os.environ.get("AWS_DEFAULT_REGION", "us-east-1")
 ACCOUNT_ID = os.environ.get("ACDL_AWS_ACCOUNT_ID", "581513795199")
-STATE_BUCKET = f"acdl-tfstate-{ACCOUNT_ID}-us-east-1"
-OUTBOX_TABLE = "acdl-outbox"
+STATE_BUCKET = f"nova-tfstate-{ACCOUNT_ID}-us-east-1"
+OUTBOX_TABLE = "nova-outbox"


 def main():
@@ -12,8 +12,8 @@
        "s3:GetBucketVersioning"
      ],
      "Resource": [
-        "arn:aws:s3:::acdl-tfstate-581513795199-us-east-1",
-        "arn:aws:s3:::acdl-tfstate-581513795199-us-east-1/*"
+        "arn:aws:s3:::nova-tfstate-581513795199-us-east-1",
+        "arn:aws:s3:::nova-tfstate-581513795199-us-east-1/*"
      ]
    },
    {
@@ -27,7 +27,7 @@
        "dynamodb:Scan",
        "dynamodb:DescribeTable"
      ],
-      "Resource": "arn:aws:dynamodb:us-east-1:581513795199:table/acdl-outbox"
+      "Resource": "arn:aws:dynamodb:us-east-1:581513795199:table/nova-outbox"
    },
    {
      "Effect": "Allow",
@@ -142,7 +142,7 @@
        "lambda:UntagResource",
        "lambda:PublishLayerVersion"
      ],
-      "Resource": "arn:aws:lambda:us-east-1:581513795199:function:acdl-*"
+      "Resource": "arn:aws:lambda:us-east-1:581513795199:function:nova-*"
    },
    {
      "Effect": "Allow",
@@ -158,10 +158,10 @@
        "dynamodb:Batch*"
      ],
      "Resource": [
-        "arn:aws:dynamodb:us-east-1:581513795199:table/acdl-contracts",
-        "arn:aws:dynamodb:us-east-1:581513795199:table/acdl-contracts/*",
-        "arn:aws:dynamodb:us-east-1:581513795199:table/acdl-change-requests",
-        "arn:aws:dynamodb:us-east-1:581513795199:table/acdl-change-requests/*"
+        "arn:aws:dynamodb:us-east-1:581513795199:table/nova-contracts",
+        "arn:aws:dynamodb:us-east-1:581513795199:table/nova-contracts/*",
+        "arn:aws:dynamodb:us-east-1:581513795199:table/nova-change-requests",
+        "arn:aws:dynamodb:us-east-1:581513795199:table/nova-change-requests/*"
      ]
    },
    {
@@ -174,7 +174,7 @@
        "secretsmanager:DeleteSecret",
        "secretsmanager:ListSecrets"
      ],
-      "Resource": "arn:aws:secretsmanager:us-east-1:581513795199:secret:acdl/*"
+      "Resource": "arn:aws:secretsmanager:us-east-1:581513795199:secret:nova/*"
    },
    {
      "Effect": "Allow",
@@ -186,7 +186,7 @@
        "sns:DeleteTopic",
        "sns:ListTopics"
      ],
-      "Resource": "arn:aws:sns:us-east-1:581513795199:acdl-*"
+      "Resource": "arn:aws:sns:us-east-1:581513795199:nova-*"
    },
    {
      "Effect": "Allow",
@@ -217,7 +217,7 @@
      ],
      "Resource": [
        "arn:aws:kms:*:*:key/*",
-        "arn:aws:kms:*:*:alias/acdl-*"
+        "arn:aws:kms:*:*:alias/nova-*"
      ]
    },
    {
@@ -236,7 +236,7 @@
        "iam:TagRole",
        "iam:UntagRole"
      ],
-      "Resource": "arn:aws:iam::*:role/acdl-*"
+      "Resource": "arn:aws:iam::*:role/nova-*"
    }
  ]
 }
@@ -1,4 +1,4 @@
-# ACDL CI VPC — short-lived VPC for L1 module lifecycle testing.
+# Nova CI VPC — short-lived VPC for L1 module lifecycle testing.
 #
 # Created by the modules-lifecycle pipeline before testing VPC-dependent
 # modules (alb, ecs-service, rds, uptime). Destroyed after all tests complete.
@@ -15,7 +15,7 @@ terraform {
    }
  }
  backend "s3" {
-    bucket = "acdl-tfstate-581513795199-us-east-1"
+    bucket = "nova-tfstate-581513795199-us-east-1"
    key    = "spike/ci-vpc/terraform.tfstate"
    region = "us-east-1"
  }
@@ -32,9 +32,9 @@ data "aws_availability_zones" "available" {
 resource "aws_vpc" "ci" {
  cidr_block = "10.1.0.0/16"
  tags = {
-    Name               = "acdl-ci-vpc"
-    "acdl:owner"       = "acdl"
-    "acdl:environment" = "ci"
+    Name               = "nova-ci-vpc"
+    "nova:owner"       = "acdl"
+    "nova:environment" = "ci"
  }
 }

@@ -44,16 +44,16 @@ resource "aws_subnet" "ci" {
  cidr_block        = cidrsubnet(aws_vpc.ci.cidr_block, 8, count.index + 1)
  availability_zone = data.aws_availability_zones.available.names[count.index]
  tags = {
-    Name               = "acdl-ci-subnet-${count.index}"
-    "acdl:owner"       = "acdl"
-    "acdl:environment" = "ci"
+    Name               = "nova-ci-subnet-${count.index}"
+    "nova:owner"       = "acdl"
+    "nova:environment" = "ci"
  }
 }

 resource "aws_internet_gateway" "ci" {
  vpc_id = aws_vpc.ci.id
  tags = {
-    Name = "acdl-ci-igw"
+    Name = "nova-ci-igw"
  }
 }

@@ -72,7 +72,7 @@ resource "aws_route_table_association" "ci" {
 }

 resource "aws_security_group" "ecs" {
-  name        = "acdl-ci-ecs-sg"
+  name        = "nova-ci-ecs-sg"
  description = "Security group for CI ECS services"
  vpc_id      = aws_vpc.ci.id

@@ -92,7 +92,7 @@ resource "aws_security_group" "ecs" {
 }

 resource "aws_ecs_cluster" "ci" {
-  name = "acdl-ci-cluster"
+  name = "nova-ci-cluster"
 }

 output "vpc_id" {
@@ -1,7 +1,7 @@
 resource "aws_vpc" "vpc-vpc" {
  cidr_block = "10.0.0.0/16"
  tags = {
-    Name = "acdl-microservice"
+    Name = "nova-microservice"
  }
 }

@@ -11,9 +11,9 @@ output "vpc_id" {

 resource "aws_subnet" "vpc-subnet" {
  cidr_block = "10.0.0.0/16"
-  vpc_id = aws_vpc.vpc-vpc.id
+  vpc_id     = aws_vpc.vpc-vpc.id
  tags = {
-    Name = "acdl-microservice"
+    Name = "nova-microservice"
  }
 }

@@ -24,12 +24,12 @@ resource "aws_route_table" "vpc-routetable" {
    gateway_id = aws_internet_gateway.vpc-igw.id
  }
  tags = {
-    Name = "acdl-microservice-rt"
+    Name = "nova-microservice-rt"
  }
 }

 resource "aws_ecs_cluster" "cluster" {
-  name = "acdl-microservice"
+  name = "nova-microservice"
 }

 output "cluster_arn" {
@@ -41,7 +41,7 @@ output "cluster_id" {
 }

 resource "aws_ecr_repository" "ecr" {
-  name = "acdl-microservice"
+  name = "nova-microservice"
 }

 output "repository_url" {
@@ -53,8 +53,8 @@ output "repository_arn" {
 }

 resource "aws_iam_role" "roles" {
-  name = "acdl-microservice-exec"
-  assume_role_policy = jsonencode({"Statement": [{"Action": "sts:AssumeRole", "Effect": "Allow", "Principal": {"Service": "ecs-tasks.amazonaws.com"}}], "Version": "2012-10-17"})
+  name                = "nova-microservice-exec"
+  assume_role_policy  = jsonencode({ "Statement" : [{ "Action" : "sts:AssumeRole", "Effect" : "Allow", "Principal" : { "Service" : "ecs-tasks.amazonaws.com" } }], "Version" : "2012-10-17" })
  managed_policy_arns = ["arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy"]
 }

@@ -67,9 +67,9 @@ output "role_id" {
 }

 resource "aws_lb" "alb-loadbalancer" {
-  name = "acdl-microservice"
-  subnets = [aws_subnet.vpc-subnet.id]
-  security_groups = [aws_iam_role.roles.arn]
+  name               = "nova-microservice"
+  subnets            = [aws_subnet.vpc-subnet.id]
+  security_groups    = [aws_iam_role.roles.arn]
  load_balancer_type = "application"
 }

@@ -78,11 +78,11 @@ output "lb_arn" {
 }

 resource "aws_lb_target_group" "alb-targetgroup" {
-  name = "acdl-microservice"
-  port = 8080
+  name        = "nova-microservice"
+  port        = 8080
  target_type = "ip"
-  vpc_id = aws_vpc.vpc-vpc.id
-  protocol = "HTTP"
+  vpc_id      = aws_vpc.vpc-vpc.id
+  protocol    = "HTTP"
 }

 output "target_group_arn" {
@@ -92,7 +92,7 @@ output "target_group_arn" {
 resource "aws_lb_listener" "alb-listener" {
  port = 8080
  default_action {
-    type = "forward"
+    type             = "forward"
    target_group_arn = aws_lb_target_group.alb-targetgroup.arn
  }
  load_balancer_arn = aws_lb.alb-loadbalancer.id
@@ -103,10 +103,10 @@ output "listener_arn" {
 }

 resource "aws_ecs_task_definition" "service-taskdefinition" {
-  cpu = 256
-  memory = 512
-  container_definitions = jsonencode([{"essential": true, "image": "581513795199.dkr.ecr.us-east-1.amazonaws.com/acdl-microservice:latest", "name": "app", "portMappings": [{"containerPort": 8080}]}])
-  family = "app"
+  cpu                   = 256
+  memory                = 512
+  container_definitions = jsonencode([{ "essential" : true, "image" : "581513795199.dkr.ecr.us-east-1.amazonaws.com/nova-microservice:latest", "name" : "app", "portMappings" : [{ "containerPort" : 8080 }] }])
+  family                = "app"
 }

 output "task_def_arn" {
@@ -117,17 +117,17 @@ resource "aws_ecs_service" "service-service" {
  cluster = aws_ecs_cluster.cluster.arn
  load_balancer {
    target_group_arn = aws_lb_target_group.alb-targetgroup.arn
-    container_name = "app"
-    container_port = 8080
+    container_name   = "app"
+    container_port   = 8080
  }
  network_configuration {
-    subnets = [aws_subnet.vpc-subnet.id]
+    subnets         = [aws_subnet.vpc-subnet.id]
    security_groups = [aws_iam_role.roles.arn]
  }
-  desired_count = 1
-  launch_type = "FARGATE"
+  desired_count   = 1
+  launch_type     = "FARGATE"
  task_definition = aws_ecs_task_definition.service-taskdefinition.arn
-  name = "acdl-microservice"
+  name            = "nova-microservice"
 }

 output "service_arn" {
@@ -137,11 +137,11 @@ output "service_arn" {
 resource "aws_internet_gateway" "vpc-igw" {
  vpc_id = aws_vpc.vpc-vpc.id
  tags = {
-    Name = "acdl-microservice-igw"
+    Name = "nova-microservice-igw"
  }
 }

 resource "aws_route_table_association" "vpc-rta" {
-  subnet_id = aws_subnet.vpc-subnet.id
+  subnet_id      = aws_subnet.vpc-subnet.id
  route_table_id = aws_route_table.vpc-routetable.id
-}
+}
@@ -7,7 +7,7 @@ terraform {
    }
  }
  backend "s3" {
-    bucket = "acdl-tfstate-581513795199-us-east-1"
+    bucket = "nova-tfstate-581513795199-us-east-1"
    key    = "spike/microservice/terraform.tfstate"
    region = "us-east-1"
  }
@@ -1,4 +1,4 @@
-# ACDL Platform Infrastructure (D-051)
+# Nova Platform Infrastructure (D-051)

 Terraform configuration for the **platform-side** infrastructure that
 ingests consumer deployment contracts and (Phase 25) reports errors as
@@ -13,11 +13,11 @@ consumers — the contract ingestion pipeline and the secrets it needs.

 | Resource | Name | Purpose |
 |----------|------|---------|
-| `aws_dynamodb_table` | `acdl-contracts` | Stores submitted consumer contracts. PK `consumerRepo`, SK `contractId#submittedAt`. SSE via CMK, PITR enabled. |
-| `aws_kms_key` + `aws_kms_alias` | `alias/acdl-platform` | Customer-managed key — encrypts DynamoDB SSE, Secrets Manager, and SSM. Key rotation enabled. |
-| `aws_secretsmanager_secret` | `acdl/github-token` | GitHub PAT used by the Lambda to create issues on the platform repo (D-055, wired in Phase 25). |
-| `aws_iam_role` + `aws_iam_role_policy` | `acdl-contract-ingestor-role` | Execution role for the Lambda — DynamoDB write, Secrets Manager read, KMS decrypt, CloudWatch logs. |
-| `aws_lambda_function` | `acdl-contract-ingestor` | Python 3.12 Lambda. Handler `contract_ingestor.lambda_handler`. Source: `core/lambda/contract_ingestor.py`, packaged as `contract_ingestor.zip`. |
+| `aws_dynamodb_table` | `nova-contracts` | Stores submitted consumer contracts. PK `consumerRepo`, SK `contractId#submittedAt`. SSE via CMK, PITR enabled. |
+| `aws_kms_key` + `aws_kms_alias` | `alias/nova-platform` | Customer-managed key — encrypts DynamoDB SSE, Secrets Manager, and SSM. Key rotation enabled. |
+| `aws_secretsmanager_secret` | `nova/github-token` | GitHub PAT used by the Lambda to create issues on the platform repo (D-055, wired in Phase 25). |
+| `aws_iam_role` + `aws_iam_role_policy` | `nova-contract-ingestor-role` | Execution role for the Lambda — DynamoDB write, Secrets Manager read, KMS decrypt, CloudWatch logs. |
+| `aws_lambda_function` | `nova-contract-ingestor` | Python 3.12 Lambda. Handler `contract_ingestor.lambda_handler`. Source: `core/lambda/contract_ingestor.py`, packaged as `contract_ingestor.zip`. |
 | `aws_lambda_function_url` | — | Function URL with `AWS_IAM` authorization. Consumers invoke it via SigV4-signed requests. |

 ## State
@@ -25,7 +25,7 @@ consumers — the contract ingestion pipeline and the secrets it needs.
 | Key | Value |
 |-----|-------|
 | Backend | S3 |
-| Bucket | `acdl-tfstate-581513795199-us-east-1` |
+| Bucket | `nova-tfstate-581513795199-us-east-1` |
 | State key | `platform/terraform.tfstate` |
 | Region | `us-east-1` |

@@ -59,14 +59,14 @@ flow:
   applies [`consumer_invoke_policy.json`](./consumer_invoke_policy.json)
   to the consumer's deploy role. The policy grants
   `lambda:InvokeFunctionUrl` on the Lambda ARN, scoped via ABAC — the
-   condition `aws:PrincipalTag/acdl:owner == ${consumerRepo}` ensures a
+   condition `aws:PrincipalTag/nova:owner == ${consumerRepo}` ensures a
   repo can only invoke when it is the owner it claims to be.
 2. **Runtime.** The consumer's deploy workflow (running in the consumer
   AWS account under the consumer's deploy role) signs the Function URL
   request with SigV4 using its deploy-role credentials. The IAM auth on
   the Function URL validates the signature and the ABAC condition.
 3. **Lambda.** The Lambda parses the JSON body, validates the fields,
-   and writes the contract to `acdl-contracts`.
+   and writes the contract to `nova-contracts`.

 This is a **one-way** channel (D-051): the consumer pushes contracts
 *to* the platform; the platform never reaches back into the consumer
@@ -4,10 +4,10 @@
    {
      "Effect": "Allow",
      "Action": "lambda:InvokeFunctionUrl",
-      "Resource": "arn:aws:lambda:${region}:${account_id}:function:acdl-contract-ingestor",
+      "Resource": "arn:aws:lambda:${region}:${account_id}:function:nova-contract-ingestor",
      "Condition": {
        "StringEquals": {
-          "aws:PrincipalTag/acdl:owner": "${consumerRepo}"
+          "aws:PrincipalTag/nova:owner": "${consumerRepo}"
        }
      }
    }
@@ -1,11 +1,11 @@
-# ACDL platform infrastructure — contract ingestion Lambda + DynamoDB (D-051)
+# Nova platform infrastructure — contract ingestion Lambda + DynamoDB (D-051)
 #
 # Deploys:
-#   - DynamoDB table acdl-contracts (PK consumerRepo, SK contractId#submittedAt, SSE via CMK, PITR)
+#   - DynamoDB table nova-contracts (PK consumerRepo, SK contractId#submittedAt, SSE via CMK, PITR)
 #   - KMS customer-managed key for DynamoDB + SSM (shared CMK)
-#   - Lambda function acdl-contract-ingestor (Python 3.12, handler contract_ingestor.lambda_handler)
+#   - Lambda function nova-contract-ingestor (Python 3.12, handler contract_ingestor.lambda_handler)
 #   - Lambda Function URL (IAM auth — consumers invoke via SigV4)
-#   - Secrets Manager secret acdl/github-token (stores the Lambda's GitHub PAT for issue creation)
+#   - Secrets Manager secret nova/github-token (stores the Lambda's GitHub PAT for issue creation)
 #   - IAM execution role for the Lambda (DynamoDB write + Secrets Manager read + KMS decrypt)
 #
 # State: terraform/platform/terraform.tfstate (separate from spike/ and microservice/)
@@ -19,7 +19,7 @@ terraform {
    }
  }
  backend "s3" {
-    bucket = "acdl-tfstate-581513795199-us-east-1"
+    bucket = "nova-tfstate-581513795199-us-east-1"
    key    = "platform/terraform.tfstate"
    region = "us-east-1"
  }
@@ -37,20 +37,20 @@ variable "vpc_cidr" {
 }

 # KMS customer-managed key for DynamoDB SSE + SSM Parameter Store encryption
-resource "aws_kms_key" "acdl_platform" {
-  description             = "ACDL platform KMS key (DynamoDB SSE + SSM + Secrets Manager)"
+resource "aws_kms_key" "nova_platform" {
+  description             = "Nova platform KMS key (DynamoDB SSE + SSM + Secrets Manager)"
  enable_key_rotation     = true
  deletion_window_in_days = 30
 }

-resource "aws_kms_alias" "acdl_platform" {
-  name          = "alias/acdl-platform"
-  target_key_id = aws_kms_key.acdl_platform.key_id
+resource "aws_kms_alias" "nova_platform" {
+  name          = "alias/nova-platform"
+  target_key_id = aws_kms_key.nova_platform.key_id
 }

 # DynamoDB table for contract ingestion
-resource "aws_dynamodb_table" "acdl_contracts" {
-  name         = "acdl-contracts"
+resource "aws_dynamodb_table" "nova_contracts" {
+  name         = "nova-contracts"
  billing_mode = "PAY_PER_REQUEST"
  hash_key     = "consumerRepo"
  range_key    = "contractId#submittedAt"
@@ -71,34 +71,34 @@ resource "aws_dynamodb_table" "acdl_contracts" {

  server_side_encryption {
    enabled     = true
-    kms_key_arn = aws_kms_key.acdl_platform.arn
+    kms_key_arn = aws_kms_key.nova_platform.arn
  }

  tags = {
-    "acdl:owner"       = "acdl"
-    "acdl:contract"    = "platform"
-    "acdl:environment" = "prod"
-    "acdl:cost-center" = "acdl-default"
+    "nova:owner"       = "acdl"
+    "nova:contract"    = "platform"
+    "nova:environment" = "prod"
+    "nova:cost-center" = "nova-default"
  }
 }

 # Secrets Manager secret for the Lambda's GitHub token (issue creation)
 resource "aws_secretsmanager_secret" "github_token" {
-  name        = "acdl/github-token"
+  name        = "nova/github-token"
  description = "GitHub PAT for the platform Lambda to create issues on the platform repo (D-055)."
-  kms_key_id  = aws_kms_key.acdl_platform.arn
+  kms_key_id  = aws_kms_key.nova_platform.arn

  tags = {
-    "acdl:owner"       = "acdl"
-    "acdl:contract"    = "platform"
-    "acdl:environment" = "prod"
-    "acdl:cost-center" = "acdl-default"
+    "nova:owner"       = "acdl"
+    "nova:contract"    = "platform"
+    "nova:environment" = "prod"
+    "nova:cost-center" = "nova-default"
  }
 }

 # IAM execution role for the Lambda
 resource "aws_iam_role" "lambda_exec" {
-  name = "acdl-contract-ingestor-role"
+  name = "nova-contract-ingestor-role"
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
@@ -110,7 +110,7 @@ resource "aws_iam_role" "lambda_exec" {
 }

 resource "aws_iam_role_policy" "lambda_permissions" {
-  name = "acdl-contract-ingestor-policy"
+  name = "nova-contract-ingestor-policy"
  role = aws_iam_role.lambda_exec.id
  policy = jsonencode({
    Version = "2012-10-17"
@@ -118,12 +118,12 @@ resource "aws_iam_role_policy" "lambda_permissions" {
      {
        Effect   = "Allow"
        Action   = ["dynamodb:PutItem", "dynamodb:GetItem", "dynamodb:Query", "dynamodb:UpdateItem"]
-        Resource = aws_dynamodb_table.acdl_contracts.arn
+        Resource = aws_dynamodb_table.nova_contracts.arn
      },
      {
        Effect   = "Allow"
        Action   = ["dynamodb:GetItem", "dynamodb:Query"]
-        Resource = aws_dynamodb_table.acdl_change_requests.arn
+        Resource = aws_dynamodb_table.nova_change_requests.arn
      },
      {
        Effect   = "Allow"
@@ -133,7 +133,7 @@ resource "aws_iam_role_policy" "lambda_permissions" {
      {
        Effect   = "Allow"
        Action   = ["kms:Decrypt"]
-        Resource = aws_kms_key.acdl_platform.arn
+        Resource = aws_kms_key.nova_platform.arn
      },
      {
        Effect   = "Allow"
@@ -152,7 +152,7 @@ locals {

 resource "aws_lambda_function" "contract_ingestor" {
  count            = local.lambda_zip_exists ? 1 : 0
-  function_name    = "acdl-contract-ingestor"
+  function_name    = "nova-contract-ingestor"
  handler          = "contract_ingestor.lambda_handler"
  runtime          = "python3.12"
  role             = aws_iam_role.lambda_exec.arn
@@ -161,17 +161,17 @@ resource "aws_lambda_function" "contract_ingestor" {

  environment {
    variables = {
-      CONTRACTS_TABLE        = aws_dynamodb_table.acdl_contracts.name
+      CONTRACTS_TABLE        = aws_dynamodb_table.nova_contracts.name
      GITHUB_TOKEN_SECRET_ID = aws_secretsmanager_secret.github_token.name
-      PLATFORM_REPO          = "acdl/acdl"
+      PLATFORM_REPO          = "nova/acdl"
    }
  }

  tags = {
-    "acdl:owner"       = "acdl"
-    "acdl:contract"    = "platform"
-    "acdl:environment" = "prod"
-    "acdl:cost-center" = "acdl-default"
+    "nova:owner"       = "acdl"
+    "nova:contract"    = "platform"
+    "nova:environment" = "prod"
+    "nova:cost-center" = "nova-default"
  }
 }

@@ -204,8 +204,8 @@ output "consumer_invoke_policy_rendered" {
 }

 # REQ-93: DynamoDB table for change requests (CMDB for decommission validation)
-resource "aws_dynamodb_table" "acdl_change_requests" {
-  name         = "acdl-change-requests"
+resource "aws_dynamodb_table" "nova_change_requests" {
+  name         = "nova-change-requests"
  billing_mode = "PAY_PER_REQUEST"
  hash_key     = "changeRequestId"
  range_key    = "submittedAt"
@@ -226,31 +226,31 @@ resource "aws_dynamodb_table" "acdl_change_requests" {

  server_side_encryption {
    enabled     = true
-    kms_key_arn = aws_kms_key.acdl_platform.arn
+    kms_key_arn = aws_kms_key.nova_platform.arn
  }

  tags = {
-    "acdl:owner"       = "acdl"
-    "acdl:contract"    = "platform"
-    "acdl:environment" = "prod"
-    "acdl:cost-center" = "acdl-default"
+    "nova:owner"       = "acdl"
+    "nova:contract"    = "platform"
+    "nova:environment" = "prod"
+    "nova:cost-center" = "nova-default"
  }
 }
 # REQ-107: SNS topic for separation-of-duties halt artifacts.
-# route_halt_artifact publishes here when ACDL_SOD_HALT_TOPIC_ARN is set.
-resource "aws_sns_topic" "acdl_sod_halt" {
-  name              = "acdl-sod-halt"
-  kms_master_key_id = aws_kms_key.acdl_platform.id
+# route_halt_artifact publishes here when NOVA_SOD_HALT_TOPIC_ARN is set.
+resource "aws_sns_topic" "nova_sod_halt" {
+  name              = "nova-sod-halt"
+  kms_master_key_id = aws_kms_key.nova_platform.id
  tags = {
-    "acdl:owner"       = "acdl"
-    "acdl:contract"    = "platform"
-    "acdl:environment" = "prod"
-    "acdl:cost-center" = "acdl-default"
+    "nova:owner"       = "acdl"
+    "nova:contract"    = "platform"
+    "nova:environment" = "prod"
+    "nova:cost-center" = "nova-default"
  }
 }

-output "acdl_sod_halt_topic_arn" {
-  value = aws_sns_topic.acdl_sod_halt.arn
+output "nova_sod_halt_topic_arn" {
+  value = aws_sns_topic.nova_sod_halt.arn
 }

 # ---------------------------------------------------------------------------
@@ -258,28 +258,28 @@ output "acdl_sod_halt_topic_arn" {
 # via terraform_remote_state (data source). No per-contract VPC ever again.
 # ---------------------------------------------------------------------------

-resource "aws_vpc" "acdl_shared" {
+resource "aws_vpc" "nova_shared" {
  cidr_block = var.vpc_cidr
  tags = {
-    Name               = "acdl-shared"
-    "acdl:owner"       = "acdl"
-    "acdl:contract"    = "platform"
-    "acdl:environment" = "shared"
-    "acdl:cost-center" = "acdl-default"
+    Name               = "nova-shared"
+    "nova:owner"       = "acdl"
+    "nova:contract"    = "platform"
+    "nova:environment" = "shared"
+    "nova:cost-center" = "nova-default"
  }
 }

-resource "aws_subnet" "acdl_shared" {
+resource "aws_subnet" "nova_shared" {
  count             = length(data.aws_availability_zones.available.names)
-  vpc_id            = aws_vpc.acdl_shared.id
-  cidr_block        = cidrsubnet(aws_vpc.acdl_shared.cidr_block, 8, count.index + 1)
+  vpc_id            = aws_vpc.nova_shared.id
+  cidr_block        = cidrsubnet(aws_vpc.nova_shared.cidr_block, 8, count.index + 1)
  availability_zone = data.aws_availability_zones.available.names[count.index]
  tags = {
-    Name               = "acdl-shared-subnet-${count.index}"
-    "acdl:owner"       = "acdl"
-    "acdl:contract"    = "platform"
-    "acdl:environment" = "shared"
-    "acdl:cost-center" = "acdl-default"
+    Name               = "nova-shared-subnet-${count.index}"
+    "nova:owner"       = "acdl"
+    "nova:contract"    = "platform"
+    "nova:environment" = "shared"
+    "nova:cost-center" = "nova-default"
  }
 }

@@ -287,42 +287,42 @@ data "aws_availability_zones" "available" {
  state = "available"
 }

-resource "aws_internet_gateway" "acdl_shared" {
-  vpc_id = aws_vpc.acdl_shared.id
+resource "aws_internet_gateway" "nova_shared" {
+  vpc_id = aws_vpc.nova_shared.id
  tags = {
-    Name               = "acdl-shared-igw"
-    "acdl:owner"       = "acdl"
-    "acdl:contract"    = "platform"
-    "acdl:environment" = "shared"
-    "acdl:cost-center" = "acdl-default"
+    Name               = "nova-shared-igw"
+    "nova:owner"       = "acdl"
+    "nova:contract"    = "platform"
+    "nova:environment" = "shared"
+    "nova:cost-center" = "nova-default"
  }
 }

-resource "aws_route_table" "acdl_shared" {
-  vpc_id = aws_vpc.acdl_shared.id
+resource "aws_route_table" "nova_shared" {
+  vpc_id = aws_vpc.nova_shared.id
  route {
    cidr_block = "0.0.0.0/0"
-    gateway_id = aws_internet_gateway.acdl_shared.id
+    gateway_id = aws_internet_gateway.nova_shared.id
  }
  tags = {
-    Name               = "acdl-shared-rt"
-    "acdl:owner"       = "acdl"
-    "acdl:contract"    = "platform"
-    "acdl:environment" = "shared"
-    "acdl:cost-center" = "acdl-default"
+    Name               = "nova-shared-rt"
+    "nova:owner"       = "acdl"
+    "nova:contract"    = "platform"
+    "nova:environment" = "shared"
+    "nova:cost-center" = "nova-default"
  }
 }

-resource "aws_route_table_association" "acdl_shared" {
+resource "aws_route_table_association" "nova_shared" {
  count          = 2
-  subnet_id      = aws_subnet.acdl_shared[count.index].id
-  route_table_id = aws_route_table.acdl_shared.id
+  subnet_id      = aws_subnet.nova_shared[count.index].id
+  route_table_id = aws_route_table.nova_shared.id
 }

 resource "aws_security_group" "ecs" {
-  name        = "acdl-ecs-sg"
+  name        = "nova-ecs-sg"
  description = "Security group for ECS Fargate services (platform VPC)"
-  vpc_id      = aws_vpc.acdl_shared.id
+  vpc_id      = aws_vpc.nova_shared.id

  # Ingress on port 80 is open to 0.0.0.0/0 — this is acceptable because
  # the ECS service is fronted by a public-facing ALB (the ALB terminates
@@ -343,25 +343,25 @@ resource "aws_security_group" "ecs" {
  }

  tags = {
-    Name               = "acdl-ecs-sg"
-    "acdl:owner"       = "acdl"
-    "acdl:contract"    = "platform"
-    "acdl:environment" = "shared"
-    "acdl:cost-center" = "acdl-default"
+    Name               = "nova-ecs-sg"
+    "nova:owner"       = "acdl"
+    "nova:contract"    = "platform"
+    "nova:environment" = "shared"
+    "nova:cost-center" = "nova-default"
  }
 }

 output "vpc_id" {
-  value       = aws_vpc.acdl_shared.id
+  value       = aws_vpc.nova_shared.id
  description = "The shared platform VPC ID. Consumer stacks reference this via terraform_remote_state."
 }

 output "subnet_ids" {
-  value       = join(",", aws_subnet.acdl_shared[*].id)
+  value       = join(",", aws_subnet.nova_shared[*].id)
  description = "Comma-separated subnet IDs in the shared platform VPC."
 }

 output "ecs_security_group_id" {
  value       = aws_security_group.ecs.id
  description = "Security group ID for ECS Fargate services in the platform VPC."
-}
+}
@@ -20,7 +20,7 @@
      "policy": "require-resource-labels",
      "severity": "medium",
      "result": "fail",
-      "message": "Pod missing required label acdl:owner.",
+      "message": "Pod missing required label nova:owner.",
      "resource": "default/Pod/acdl-bad-app",
      "namespace": "default",
      "kind": "Pod",
@@ -408,15 +408,17 @@ class TestAdapterDedupMergesSameModule:


 class TestAdapterRemoteStateKeyOverride:
-    """P2-2 (v1.14, REQ-139): ACDL_REMOTE_STATE_KEY env var overrides the
-    default 'platform/terraform.tfstate' key in the emitted
+    """P2-2 (v1.14, REQ-139): NOVA_REMOTE_STATE_KEY env var (P2 renamed from
+    NOVA_REMOTE_STATE_KEY; dual-read NOVA_* preferred, ACDL_* fallback until
+    P5) overrides the default 'platform/terraform.tfstate' key in the emitted
    data terraform_remote_state block. This is the load-bearing correctness
    mechanism for the microservice L2 lifecycle (remote state points at the
    CI VPC, not the platform VPC)."""

    def test_default_remote_state_key(self, tmp_path, monkeypatch):
-        """When ACDL_REMOTE_STATE_KEY is unset, the default key is used."""
-        monkeypatch.delenv("ACDL_REMOTE_STATE_KEY", raising=False)
+        """When NOVA_REMOTE_STATE_KEY is unset, the default key is used."""
+        # P5 (REQ-164): ACDL_* fallback removed — NOVA_* only.
+        monkeypatch.delenv("NOVA_REMOTE_STATE_KEY", raising=False)
        stack = {
            "resources": [
                {"id": "s3", "type": "aws:s3:bucket", "module": "s3@1.0.0", "inputs": {"bucket_name": "test", "region": "us-east-1"}}
@@ -431,9 +433,9 @@ class TestAdapterRemoteStateKeyOverride:
        assert "platform/terraform.tfstate" in main_tf

    def test_env_override_remote_state_key(self, tmp_path, monkeypatch):
-        """When ACDL_REMOTE_STATE_KEY is set, the emitted data block uses
+        """When NOVA_REMOTE_STATE_KEY is set, the emitted data block uses
        the overridden key (e.g. 'spike/ci-vpc/terraform.tfstate')."""
-        monkeypatch.setenv("ACDL_REMOTE_STATE_KEY", "spike/ci-vpc/terraform.tfstate")
+        monkeypatch.setenv("NOVA_REMOTE_STATE_KEY", "spike/ci-vpc/terraform.tfstate")
        stack = {
            "resources": [
                {"id": "s3", "type": "aws:s3:bucket", "module": "s3@1.0.0", "inputs": {"bucket_name": "test", "region": "us-east-1"}}
@@ -102,7 +102,10 @@ def test_dr_blocks_on_missing_dr_drill():

 def test_signature_skip_when_key_unset(monkeypatch, capsys):
    """D-089: signature verification is skipped when the signing key is unset."""
-    monkeypatch.delenv("ACDL_ATTESTATION_SIGNING_KEY_ID", raising=False)
+    # P5 (REQ-164): dual-read fallback removed — NOVA_* only. Deleting
+    # NOVA_ATTESTATION_SIGNING_KEY_ID is sufficient for the skip (the
+    # ACDL_* fallback no longer exists in core/env.py).
+    monkeypatch.delenv("NOVA_ATTESTATION_SIGNING_KEY_ID", raising=False)
    artifact = {"timestamp": datetime.datetime.now(datetime.timezone.utc).isoformat(),
                "type": "x", "payload": {}, "signature": "sig"}
    assert _verify_signature(artifact) is True
@@ -112,7 +115,7 @@ def test_signature_skip_when_key_unset(monkeypatch, capsys):

 def test_signature_required_when_key_set(monkeypatch):
    """When the signing key is set, a missing signature fails."""
-    monkeypatch.setenv("ACDL_ATTESTATION_SIGNING_KEY_ID", "kms-key-id")
+    monkeypatch.setenv("NOVA_ATTESTATION_SIGNING_KEY_ID", "kms-key-id")
    artifact = {"timestamp": datetime.datetime.now(datetime.timezone.utc).isoformat(),
                "type": "x", "payload": {}}  # no signature
    assert _verify_signature(artifact) is False
@@ -67,10 +67,10 @@ class TestToPcr:


 class TestRuleMapTagging:
-    def test_acdl_tag_naming_is_real_rule(self):
-        # D-054 / D-043 closure: ACDL_TAG_NAMING is now a real custom Checkov
-        # rule, not a synthetic SKIPPED record.
-        assert RULE_MAP["ACDL_TAG_NAMING"] == ("tagging-standard", "medium")
+    def test_nova_tag_naming_is_real_rule(self):
+        # D-054 / D-043 closure, P2 rename (REQ-158): NOVA_TAG_NAMING is now
+        # a real custom Checkov rule, not a synthetic SKIPPED record.
+        assert RULE_MAP["NOVA_TAG_NAMING"] == ("tagging-standard", "medium")


 class TestAdapt:
@@ -100,13 +100,13 @@ class TestAdapt:

    def test_adapt_does_not_emit_synthetic_tag_naming(self, tmp_path):
        # D-043 closure: adapt() no longer appends a synthetic SKIPPED
-        # ACDL_TAG_NAMING record. The custom Checkov rule (loaded via
+        # NOVA_TAG_NAMING record. The custom Checkov rule (loaded via
        # --external-checks-dir) produces real PASS/FAIL records instead.
        data = self._sample_checkov_json()
        f = tmp_path / "checkov.json"
        f.write_text(json.dumps(data))
        results = adapt(str(f), "c-1")
-        tag = [r for r in results if r["ruleId"] == "ACDL_TAG_NAMING"]
+        tag = [r for r in results if r["ruleId"] == "NOVA_TAG_NAMING"]
        assert tag == []  # no synthetic record

    def test_adapt_has_passed_and_failed(self, tmp_path):
@@ -66,7 +66,7 @@ def moto_contracts_table(monkeypatch):
    with mock_aws():
        dyn = boto3.client("dynamodb", region_name="us-east-1")
        dyn.create_table(
-            TableName="acdl-contracts",
+            TableName="nova-contracts",
            KeySchema=[
                {"AttributeName": "consumerRepo", "KeyType": "HASH"},
                {"AttributeName": "contractId#submittedAt", "KeyType": "RANGE"},
@@ -84,7 +84,7 @@ def moto_contracts_table(monkeypatch):
        saved_secrets = ingestor._secrets_client
        ingestor._dynamodb = None
        ingestor._secrets_client = None
-        monkeypatch.setattr(ingestor, "TABLE_NAME", "acdl-contracts")
+        monkeypatch.setattr(ingestor, "TABLE_NAME", "nova-contracts")

        yield dyn

@@ -108,7 +108,7 @@ class TestSubmitContract:
        # Verify what landed in DynamoDB.
        sk = f"contract-001#{result['submittedAt']}"
        resp = moto_contracts_table.get_item(
-            TableName="acdl-contracts",
+            TableName="nova-contracts",
            Key={
                "consumerRepo": {"S": "acdl/consumer-a"},
                "contractId#submittedAt": {"S": sk},
@@ -369,7 +369,7 @@ class TestCallerIdentityValidation:
    def test_invalid_consumer_repo_format_rejected(self, moto_contracts_table, sample_payload):
        # A consumerRepo without "/" is invalid (not org/repo format).
        sample_payload["consumerRepo"] = "not-a-repo-format"
-        event = {"body": json.dumps(sample_payload), "requestContext": {"identity": {"userArn": "arn:aws:sts::000:assumed-role/acdl-deploy/session"}}}
+        event = {"body": json.dumps(sample_payload), "requestContext": {"identity": {"userArn": "arn:aws:sts::000:assumed-role/nova-deploy/session"}}}
        resp = ingestor.lambda_handler(event, None)
        assert resp["statusCode"] == 400
        assert "invalid consumerRepo" in json.loads(resp["body"])["error"]
@@ -378,7 +378,7 @@ class TestCallerIdentityValidation:
        # A valid org/repo consumerRepo with an identity present — passes.
        event = {
            "body": json.dumps(sample_payload),
-            "requestContext": {"identity": {"userArn": "arn:aws:sts::000:assumed-role/acdl-deploy/acdl-consumer-a"}},
+            "requestContext": {"identity": {"userArn": "arn:aws:sts::000:assumed-role/nova-deploy/nova-consumer-a"}},
        }
        resp = ingestor.lambda_handler(event, None)
        assert resp["statusCode"] == 200
@@ -431,12 +431,12 @@ class TestValidateChangeRequest:
        monkeypatch.setenv("AWS_DEFAULT_REGION", "us-east-1")
        monkeypatch.setenv("AWS_ACCESS_KEY_ID", "testing")
        monkeypatch.setenv("AWS_SECRET_ACCESS_KEY", "testing")
-        monkeypatch.setenv("CHANGE_REQUESTS_TABLE", "acdl-change-requests")
+        monkeypatch.setenv("CHANGE_REQUESTS_TABLE", "nova-change-requests")

        with mock_aws():
            dynamodb = boto3.resource("dynamodb", region_name="us-east-1")
            table = dynamodb.create_table(
-                TableName="acdl-change-requests",
+                TableName="nova-change-requests",
                KeySchema=[
                    {"AttributeName": "changeRequestId", "KeyType": "HASH"},
                    {"AttributeName": "submittedAt", "KeyType": "RANGE"},
@@ -67,7 +67,7 @@ class TestResolveMicroservice:
                "microservice": {
                    "version": "1.0.0",
                    "inputs": {
-                        "image": "581513795199.dkr.ecr.us-east-1.amazonaws.com/acdl-microservice:latest",
+                        "image": "581513795199.dkr.ecr.us-east-1.amazonaws.com/nova-microservice:latest",
                        "port": 8080,
                        "region": "us-east-1",
                    },
@@ -78,4 +78,6 @@ def test_run_platform_sh_has_environment_flag():
    text = (ROOT / "scripts" / "run_platform.sh").read_text()
    assert "--environment" in text
    assert "ENVIRONMENT_OVERRIDE" in text
-    assert "ACDL_ENVIRONMENT_OVERRIDE" in text
+    # P2 (REQ-159): NOVA_* preferred; ACDL_* kept as dual-read fallback until P5.
+    assert "NOVA_ENVIRONMENT_OVERRIDE" in text
+    assert "ACDL_ENVIRONMENT_OVERRIDE" in text  # legacy fallback, removed in P5
@@ -0,0 +1,56 @@
+"""Unit tests for the NOVA-only env helper (core/env.py, D-108, REQ-164).
+
+P5 (REQ-164) removed the ACDL_* dual-read fallback. `get_env` now reads
+`NOVA_*` only. These tests verify:
+  - only NOVA_* set → returned
+  - neither set → default returned
+  - ACDL_* set but NOVA_* unset → default returned (fallback REMOVED)
+  - blank NOVA_* → default returned (not the ACDL_* value)
+"""
+
+from __future__ import annotations
+
+import pytest
+
+from core import env
+
+
+@pytest.fixture(autouse=True)
+def _isolate_env(monkeypatch):
+    """Ensure no ACDL_*/NOVA_* leakage between tests."""
+    for key in list(__import__("os").environ):
+        if key.startswith(("ACDL_", "NOVA_")):
+            monkeypatch.delenv(key, raising=False)
+    yield
+
+
+def test_only_nova_set(monkeypatch):
+    monkeypatch.setenv("NOVA_AWS_ACCOUNT_ID", "nova-value")
+    assert env.get_env("AWS_ACCOUNT_ID") == "nova-value"
+
+
+def test_neither_set_returns_default():
+    assert env.get_env("AWS_ACCOUNT_ID") is None
+    assert env.get_env("AWS_ACCOUNT_ID", default="581513795199") == "581513795199"
+
+
+def test_only_acdl_set_no_fallback(monkeypatch):
+    # P5 (REQ-164): ACDL_* fallback removed — ACDL_* alone returns default.
+    monkeypatch.setenv("ACDL_AWS_ACCOUNT_ID", "acdl-value")
+    assert env.get_env("AWS_ACCOUNT_ID") is None
+    assert env.get_env("AWS_ACCOUNT_ID", default="fallback") == "fallback"
+
+
+def test_both_set_nova_wins(monkeypatch):
+    # NOVA_* takes precedence; ACDL_* is ignored.
+    monkeypatch.setenv("NOVA_AWS_ACCOUNT_ID", "nova-value")
+    monkeypatch.setenv("ACDL_AWS_ACCOUNT_ID", "acdl-value")
+    assert env.get_env("AWS_ACCOUNT_ID") == "nova-value"
+
+
+def test_blank_nova_returns_default_not_acdl(monkeypatch):
+    # An explicitly-empty NOVA key returns default (not an ACDL_* value).
+    monkeypatch.setenv("NOVA_AWS_ACCOUNT_ID", "")
+    monkeypatch.setenv("ACDL_AWS_ACCOUNT_ID", "acdl-value")
+    assert env.get_env("AWS_ACCOUNT_ID") is None
+    assert env.get_env("AWS_ACCOUNT_ID", default="d") == "d"
@@ -134,13 +134,13 @@ class TestIAMPolicyBaseline:
    def test_dynamodb_contracts_table_in_resource(self, policy):
        contracts_stmts = [
            s for s in policy["Statement"]
-            if any("acdl-contracts" in r for r in (
+            if any("nova-contracts" in r for r in (
                s.get("Resource") if isinstance(s.get("Resource"), list) else [s.get("Resource", "")]
            ))
        ]
-        assert contracts_stmts, "no statement references the acdl-contracts table"
+        assert contracts_stmts, "no statement references the nova-contracts table"

-    def test_lambda_scoped_to_acdl_functions(self, policy):
+    def test_lambda_scoped_to_nova_functions(self, policy):
        lambda_stmts = [s for s in policy["Statement"] if any(
            a.startswith("lambda:") for a in (
                s.get("Action") if isinstance(s.get("Action"), list) else [s.get("Action", "")]
@@ -151,8 +151,8 @@ class TestIAMPolicyBaseline:
            res = s.get("Resource", "")
            if isinstance(res, list):
                res = " ".join(res)
-            assert "function:acdl-*" in res or res == "*", \
-                "lambda actions not scoped to acdl-* functions"
+            assert "function:nova-*" in res or res == "*", \
+                "lambda actions not scoped to nova-* functions"

    def test_cost_explorer_is_read_only(self, policy):
        ce_actions = set()
@@ -178,8 +178,8 @@ class TestIAMPolicyBaseline:
                    res = " ".join(res)
                assert res != "*", "iam:PassRole must not be granted to Resource: *"

-    def test_iam_role_creation_scoped_to_acdl_prefix(self, policy):
-        """G-104: iam:CreateRole must be scoped to role/acdl-* (not Resource: *)."""
+    def test_iam_role_creation_scoped_to_nova_prefix(self, policy):
+        """G-104: iam:CreateRole must be scoped to role/nova-* (not Resource: *)."""
        for s in policy["Statement"]:
            acts = s.get("Action", [])
            if isinstance(acts, str):
@@ -188,10 +188,10 @@ class TestIAMPolicyBaseline:
                res = s.get("Resource", "")
                if isinstance(res, list):
                    res = " ".join(res)
-                assert "acdl-*" in res, f"iam:CreateRole must be scoped to acdl-* (got: {res})"
+                assert "nova-*" in res, f"iam:CreateRole must be scoped to nova-* (got: {res})"

-    def test_kms_scoped_to_acdl_alias(self, policy):
-        """G-104: kms:CreateKey etc. must be scoped to alias/acdl-* (not Resource: *)."""
+    def test_kms_scoped_to_nova_alias(self, policy):
+        """G-104: kms:CreateKey etc. must be scoped to alias/nova-* (not Resource: *)."""
        for s in policy["Statement"]:
            acts = s.get("Action", [])
            if isinstance(acts, str):
@@ -200,7 +200,7 @@ class TestIAMPolicyBaseline:
                res = s.get("Resource", "")
                if isinstance(res, list):
                    res = " ".join(res)
-                assert "acdl-*" in res, f"kms actions must be scoped to acdl-* (got: {res})"
+                assert "nova-*" in res, f"kms actions must be scoped to nova-* (got: {res})"

    def test_cloudfront_waf_remain_global(self, policy):
        """G-104: CloudFront + WAFv2 (CloudFront scope) ARNs are global;
@@ -215,4 +215,4 @@ class TestIAMPolicyBaseline:
                if isinstance(res, list):
                    res = res[0] if res else ""
                # CloudFront/WAFv2 are allowed to be * (global ARNs)
-                assert res == "*" or "acdl" in res
+                assert res == "*" or "nova" in res
@@ -2,9 +2,10 @@

 The lifecycle scripts (run_lifecycle_test.sh, run_lifecycle_destroy.sh,
 run_l2_lifecycle_test.sh, run_l2_lifecycle_destroy.sh) wrap run_platform.sh.
-REQ-134 (v1.12) adds the ACDL_LIFECYCLE_MODE env var: default "plan" runs
-`run_platform.sh --plan-only` (fast, no AWS mutation); "full" runs the real
-`--apply`/`--destroy` against live AWS.
+REQ-134 (v1.12) adds the NOVA_LIFECYCLE_MODE env var (P2 renamed from
+ACDL_LIFECYCLE_MODE, dual-read NOVA_* preferred / ACDL_* fallback until
+P5): default "plan" runs `run_platform.sh --plan-only` (fast, no AWS
+mutation); "full" runs the real `--apply`/`--destroy` against live AWS.

 These tests verify the dispatch logic offline by inspecting script content
 (running the scripts end-to-end requires AWS credentials in full mode).
@@ -31,13 +32,15 @@ class TestLifecycleModeFlag:
    """REQ-134: the lifecycle scripts dispatch to plan-only by default."""

    @pytest.mark.parametrize("script", SCRIPTS)
-    def test_script_reads_acdl_lifecycle_mode(self, script):
-        """Every lifecycle script reads ACDL_LIFECYCLE_MODE with a 'plan' default."""
+    def test_script_reads_nova_lifecycle_mode(self, script):
+        """Every lifecycle script reads NOVA_LIFECYCLE_MODE (NOVA-only since
+        P5, REQ-164 — dual-read fallback removed) with a 'plan' default."""
        src = _read(script)
-        # The default must be 'plan' (the speed-up default). The scripts use
-        # an intermediate LIFECYCLE_MODE var sourced from ACDL_LIFECYCLE_MODE.
-        assert "${ACDL_LIFECYCLE_MODE:-plan}" in src, \
-            f"{script} must read ACDL_LIFECYCLE_MODE defaulting to 'plan'"
+        # P5 (REQ-164): NOVA_* only (dual-read fallback removed).
+        assert "${NOVA_LIFECYCLE_MODE:-plan}" in src, \
+            f"{script} must read NOVA_LIFECYCLE_MODE defaulting to 'plan'"
+        assert "ACDL_LIFECYCLE_MODE" not in src, \
+            f"{script} must not reference ACDL_LIFECYCLE_MODE (P5 removed the fallback)"
        assert "LIFECYCLE_MODE=" in src, \
            f"{script} must assign LIFECYCLE_MODE from the env var"

@@ -121,7 +121,7 @@ def test_local_s3_backend_rewrites_s3_to_local(tmp_path):
    tf = tmp_path / "terraform.tf"
    tf.write_text(
        'terraform {\n  required_version = ">= 1.9"\n  backend "s3" {\n'
-        '    bucket = "acdl-tfstate-x"\n    key = "spike/s.tfstate"\n'
+        '    bucket = "nova-tfstate-x"\n    key = "spike/s.tfstate"\n'
        '    region = "us-east-1"\n  }\n}\n'
    )
    backend.rewrite_terraform_tf(tf, "test-stack")
@@ -179,11 +179,11 @@ def test_local_lambda_stub_rejects_missing_field(tmp_path):
 def test_run_local_e2e_microservice():
    """Headline E2E: contract -> resolver -> adapter -> local S3 backend
    -> local ECS (HTTP 200) -> flat-file outbox -> local Lambda. No AWS."""
-    os.environ["ACDL_LOCAL_TIER"] = "1"
+    os.environ["NOVA_LOCAL_TIER"] = "1"
    try:
        result = le.run_local_e2e("contracts/microservice.yml")
    finally:
-        os.environ.pop("ACDL_LOCAL_TIER", None)
+        os.environ.pop("NOVA_LOCAL_TIER", None); os.environ.pop("ACDL_LOCAL_TIER", None)
    assert result["tier"] == "local-emulator"
    assert result["backend"] == "local"
    assert result["ecs"] is not None
@@ -196,11 +196,11 @@ def test_run_local_e2e_microservice():
 def test_run_local_e2e_static_assets():
    """Static-assets stack has no ECS service; the local E2E must still
    complete (ecs=None) and the outbox chain + Lambda stub must pass."""
-    os.environ["ACDL_LOCAL_TIER"] = "1"
+    os.environ["NOVA_LOCAL_TIER"] = "1"
    try:
        result = le.run_local_e2e("contracts/static-assets.yml")
    finally:
-        os.environ.pop("ACDL_LOCAL_TIER", None)
+        os.environ.pop("NOVA_LOCAL_TIER", None); os.environ.pop("ACDL_LOCAL_TIER", None)
    assert result["tier"] == "local-emulator"
    assert result["ecs"] is None  # no ECS service in this stack
    assert result["outbox_chain_verified"] is True
@@ -209,9 +209,9 @@ def test_run_local_e2e_static_assets():

 def test_is_local_tier_flag():
    assert le.is_local_tier() is False
-    os.environ["ACDL_LOCAL_TIER"] = "1"
+    os.environ["NOVA_LOCAL_TIER"] = "1"
    try:
        assert le.is_local_tier() is True
    finally:
-        os.environ.pop("ACDL_LOCAL_TIER", None)
+        os.environ.pop("NOVA_LOCAL_TIER", None); os.environ.pop("ACDL_LOCAL_TIER", None)
    assert le.is_local_tier() is False
@@ -0,0 +1,148 @@
+"""Unit tests for scripts/migrate_dynamodb_data.py (REQ-163, P4).
+
+Tests the pure item-mapping logic + table-pair resolution. The AWS I/O
+(scan_all/copy_items) is thin boto3 glue, not unit-tested here (covered
+by the dry-run path + the runbook's live verification).
+"""
+import sys
+from pathlib import Path
+
+import pytest
+
+ROOT = Path(__file__).resolve().parent.parent
+sys.path.insert(0, str(ROOT / "scripts"))
+
+import migrate_dynamodb_data as mig
+
+
+class TestMapItem:
+    def test_map_item_preserves_typed_attributes(self):
+        item = {
+            "consumerRepo": {"S": "acdl/consumer-a"},
+            "contractId#submittedAt": {"S": "c-1#2026-01-01T00:00:00Z"},
+            "contract": {"S": "name: foo\n"},
+            "count": {"N": "42"},
+        }
+        result = mig.map_item(item)
+        assert result == item
+
+    def test_map_item_returns_independent_copy(self):
+        """The mapped item must not alias the scanned item (callers may mutate)."""
+        item = {"k": {"S": "v"}}
+        result = mig.map_item(item)
+        result["k"]["S"] = "mutated"
+        assert item["k"]["S"] == "v", "map_item returned an alias, not a copy"
+
+    def test_map_item_empty(self):
+        assert mig.map_item({}) == {}
+
+    def test_map_item_preserves_binary_and_nested(self):
+        item = {
+            "pk": {"B": b"\x01\x02"},
+            "nested": {"M": {"a": {"S": "x"}}},
+            "list": {"L": [{"S": "1"}, {"S": "2"}]},
+        }
+        assert mig.map_item(item) == item
+
+
+class TestTablePair:
+    def test_contracts_alias(self):
+        assert mig.table_pair_for("contracts") == ("acdl-contracts", "nova-contracts")
+
+    def test_change_requests_alias(self):
+        assert mig.table_pair_for("change-requests") == (
+            "acdl-change-requests", "nova-change-requests"
+        )
+
+    def test_literal_source_name(self):
+        assert mig.table_pair_for("acdl-contracts") == ("acdl-contracts", "nova-contracts")
+
+    def test_literal_dest_name(self):
+        assert mig.table_pair_for("nova-contracts") == ("acdl-contracts", "nova-contracts")
+
+    def test_unknown_name_raises(self):
+        with pytest.raises(ValueError, match="unknown table"):
+            mig.table_pair_for("nope")
+
+    def test_custom_pairs(self):
+        pairs = [("old-x", "new-x")]
+        assert mig.table_pair_for("old-x", pairs=pairs) == ("old-x", "new-x")
+
+
+class TestDefaultPairs:
+    def test_default_pairs_cover_both_tables(self):
+        sources = [s for s, _ in mig.DEFAULT_TABLE_PAIRS]
+        dests = [d for _, d in mig.DEFAULT_TABLE_PAIRS]
+        assert sources == ["acdl-contracts", "acdl-change-requests"]
+        assert dests == ["nova-contracts", "nova-change-requests"]
+
+
+class TestArgparser:
+    def test_dry_run_default(self):
+        args = mig.build_parser().parse_args([])
+        assert args.apply is False
+        assert args.region == "us-east-1"
+        assert args.table is None
+
+    def test_apply_flag(self):
+        args = mig.build_parser().parse_args(["--apply"])
+        assert args.apply is True
+
+    def test_table_filter(self):
+        args = mig.build_parser().parse_args(["--table", "contracts"])
+        assert args.table == "contracts"
+
+    def test_source_dest_override(self):
+        args = mig.build_parser().parse_args(["--source", "old", "--dest", "new"])
+        assert args.source == "old"
+        assert args.dest == "new"
+
+
+class TestRunDryRun:
+    """The dry-run path exercises the table-pair resolution + describes both
+    tables without writing. We stub the boto3 client so no AWS access occurs."""
+
+    def _fake_client(self, describable=True):
+        client = type("FakeClient", (), {})()
+        def describe_table(TableName):
+            if not describable:
+                raise Exception("ResourceNotFoundException")
+            return {"Table": {"ItemCount": 0}}
+        client.describe_table = describe_table
+        client.scan = lambda **k: {"Items": []}
+        client.put_item = lambda **k: None
+        return client
+
+    def test_run_dry_run_reports_planned_copy(self, monkeypatch, capsys):
+        # Build args with both default pairs.
+        args = mig.build_parser().parse_args([])
+        # Stub the client constructor so no real boto3 client is built.
+        monkeypatch.setattr(mig.boto3, "client", lambda *a, **k: self._fake_client())
+        rc = mig.run(args)
+        out = capsys.readouterr().out
+        assert rc == 0
+        assert "DRY-RUN" in out
+        assert "acdl-contracts" in out and "nova-contracts" in out
+        assert "acdl-change-requests" in out and "nova-change-requests" in out
+        assert "would PutItem" in out
+        assert "NOT deleted" in out
+
+    def test_run_source_table_not_describable_fails(self, monkeypatch, capsys):
+        args = mig.build_parser().parse_args([])
+        # First describe_table (source) raises, second (dest) is fine — emulate by
+        # raising on the first call only.
+        calls = {"n": 0}
+        client = type("FakeClient", (), {})()
+        def describe_table(TableName):
+            calls["n"] += 1
+            if calls["n"] % 2 == 1:  # source (odd calls)
+                raise Exception("ResourceNotFoundException")
+            return {"Table": {"ItemCount": 0}}
+        client.describe_table = describe_table
+        client.scan = lambda **k: {"Items": []}
+        client.put_item = lambda **k: None
+        monkeypatch.setattr(mig.boto3, "client", lambda *a, **k: client)
+        rc = mig.run(args)
+        err = capsys.readouterr().err
+        assert rc == 1
+        assert "not describable" in err
@@ -0,0 +1,77 @@
+"""Unit tests for scripts/migrate_ssm_paths.py path-mapping logic (REQ-161, P3).
+
+Tests the pure ``map_path()`` function (the AWS I/O glue is thin boto3 around
+it). The script does not need live AWS to be importable.
+"""
+
+import sys
+from pathlib import Path
+
+import pytest
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent / "scripts"))
+
+from migrate_ssm_paths import map_path  # noqa: E402
+
+
+class TestMapPath:
+    def test_basic_dev_path(self):
+        assert map_path("/acdl/dev/svc-x/output") == "/nova/dev/svc-x/output"
+
+    def test_basic_contract_path(self):
+        assert map_path("/acdl/dev/c-1/vpc_id") == "/nova/dev/c-1/vpc_id"
+
+    def test_qa_env(self):
+        assert map_path("/acdl/qa/c-2/db_endpoint") == "/nova/qa/c-2/db_endpoint"
+
+    def test_prod_env(self):
+        assert map_path("/acdl/prod/c-3/distribution_domain_name") == "/nova/prod/c-3/distribution_domain_name"
+
+    def test_dr_env(self):
+        assert map_path("/acdl/dr/c-4/bucket_arn") == "/nova/dr/c-4/bucket_arn"
+
+    def test_deep_nested_path(self):
+        assert map_path("/acdl/dev/contract-001/nested/deep/output") == "/nova/dev/contract-001/nested/deep/output"
+
+    def test_preserves_trailing_segment(self):
+        # The output name segment is preserved verbatim
+        assert map_path("/acdl/dev/c/secret_token") == "/nova/dev/c/secret_token"
+
+    def test_custom_prefixes(self):
+        assert map_path("/acdl/dev/c/x", "/acdl", "/nova") == "/nova/dev/c/x"
+        assert map_path("/old/dev/c/x", "/old", "/new") == "/new/dev/c/x"
+
+    def test_raises_on_nonmatching_path(self):
+        with pytest.raises(ValueError, match="does not start with source prefix"):
+            map_path("/nova/dev/c/output")
+
+    def test_raises_on_path_not_segment_prefixed(self):
+        # /acdl-platform is NOT a path-segment match for /acdl (no trailing /)
+        with pytest.raises(ValueError, match="does not start with source prefix"):
+            map_path("/acdl-platform-key")
+
+    def test_raises_on_empty_path(self):
+        with pytest.raises(ValueError):
+            map_path("")
+
+    def test_raises_on_just_prefix(self):
+        # Exactly /acdl (no trailing slash) is not a valid parameter path
+        with pytest.raises(ValueError):
+            map_path("/acdl")
+
+    def test_round_trip_identity(self):
+        # map_path is its own inverse when source/dest are swapped
+        src = "/acdl/dev/svc-x/output"
+        mapped = map_path(src, "/acdl", "/nova")
+        back = map_path(mapped, "/nova", "/acdl")
+        assert back == src
+
+    def test_idempotent_on_already_migrated(self):
+        # If somehow a /nova/ path is passed with default args, it raises
+        # (the script filters by source prefix before mapping)
+        with pytest.raises(ValueError):
+            map_path("/nova/dev/c/output")
+
+    def test_preserves_value_segment_exactly(self):
+        # Hyphens, dots, underscores in output names are preserved
+        assert map_path("/acdl/dev/c-1/my.output-name_2") == "/nova/dev/c-1/my.output-name_2"
@@ -55,7 +55,7 @@ class TestWriteEvent:
        with mock_aws():
            dyn = boto3.client("dynamodb", region_name="us-east-1")
            dyn.create_table(
-                TableName="acdl-outbox",
+                TableName="nova-outbox",
                KeySchema=[
                    {"AttributeName": "contractId", "KeyType": "HASH"},
                    {"AttributeName": "eventType#eventTs", "KeyType": "RANGE"},
@@ -68,7 +68,7 @@ class TestWriteEvent:
            )

            event = self._sample_event()
-            item = write_event(event, outbox_table="acdl-outbox", region="us-east-1")
+            item = write_event(event, outbox_table="nova-outbox", region="us-east-1")

            assert item["contractId"]["S"] == "test-contract-001"
            assert item["prev_event_hash"]["S"] == "GENESIS"
@@ -84,7 +84,7 @@ class TestWriteEvent:
        with mock_aws():
            dyn = boto3.client("dynamodb", region_name="us-east-1")
            dyn.create_table(
-                TableName="acdl-outbox",
+                TableName="nova-outbox",
                KeySchema=[
                    {"AttributeName": "contractId", "KeyType": "HASH"},
                    {"AttributeName": "eventType#eventTs", "KeyType": "RANGE"},
@@ -97,7 +97,7 @@ class TestWriteEvent:
            )

            event = self._sample_event()
-            item = write_event(event, outbox_table="acdl-outbox", region="us-east-1")
+            item = write_event(event, outbox_table="nova-outbox", region="us-east-1")
            expected_hash = _canonical_hash(event)
            assert item["hash"]["S"] == expected_hash

@@ -109,7 +109,7 @@ class TestWriteEvent:
        with mock_aws():
            dyn = boto3.client("dynamodb", region_name="us-east-1")
            dyn.create_table(
-                TableName="acdl-outbox",
+                TableName="nova-outbox",
                KeySchema=[
                    {"AttributeName": "contractId", "KeyType": "HASH"},
                    {"AttributeName": "eventType#eventTs", "KeyType": "RANGE"},
@@ -122,10 +122,10 @@ class TestWriteEvent:
            )

            event = self._sample_event()
-            write_event(event, outbox_table="acdl-outbox", region="us-east-1")
+            write_event(event, outbox_table="nova-outbox", region="us-east-1")

            resp = dyn.get_item(
-                TableName="acdl-outbox",
+                TableName="nova-outbox",
                Key={
                    "contractId": {"S": "test-contract-001"},
                    "eventType#eventTs": {"S": "CONFIDENCE_COMPUTED#2026-07-22T00:00:00Z"},
@@ -43,19 +43,19 @@ class TestPublishToSsm:
        monkeypatch.setenv("AWS_DEFAULT_REGION", "us-east-1")
        monkeypatch.setenv("AWS_ACCESS_KEY_ID", "testing")
        monkeypatch.setenv("AWS_SECRET_ACCESS_KEY", "testing")
-        monkeypatch.setenv("ACDL_KMS_KEY_ID", "alias/aws/ssm")
+        monkeypatch.setenv("NOVA_KMS_KEY_ID", "alias/aws/ssm")

        with mock_aws():
            ssm = boto3.client("ssm", region_name="us-east-1")
            outputs = {"bucket_name": "acdl-spike-bucket", "secret_token": "s3cret"}
            results = publish_to_ssm(outputs, "dev", "contract-001")

-            assert results["bucket_name"] == "/acdl/dev/contract-001/bucket_name"
-            assert results["secret_token"] == "/acdl/dev/contract-001/secret_token"
+            assert results["bucket_name"] == "/nova/dev/contract-001/bucket_name"
+            assert results["secret_token"] == "/nova/dev/contract-001/secret_token"

            # Verify the parameter landed in SSM correctly
            param = ssm.get_parameter(
-                Name="/acdl/dev/contract-001/bucket_name", WithDecryption=True
+                Name="/nova/dev/contract-001/bucket_name", WithDecryption=True
            )
            assert param["Parameter"]["Type"] == "SecureString"
            assert param["Parameter"]["Value"] == "acdl-spike-bucket"
@@ -67,12 +67,12 @@ class TestPublishToSsm:
        monkeypatch.setenv("AWS_DEFAULT_REGION", "us-east-1")
        monkeypatch.setenv("AWS_ACCESS_KEY_ID", "testing")
        monkeypatch.setenv("AWS_SECRET_ACCESS_KEY", "testing")
-        monkeypatch.setenv("ACDL_KMS_KEY_ID", "alias/aws/ssm")
+        monkeypatch.setenv("NOVA_KMS_KEY_ID", "alias/aws/ssm")

        with mock_aws():
            ssm = boto3.client("ssm", region_name="us-east-1")
            publish_to_ssm({"vpc_id": "vpc-123"}, "dev", "c-1")
-            param = ssm.get_parameter(Name="/acdl/dev/c-1/vpc_id", WithDecryption=True)
+            param = ssm.get_parameter(Name="/nova/dev/c-1/vpc_id", WithDecryption=True)
            assert param["Parameter"]["Type"] == "SecureString"

    def test_publish_skips_none_and_empty_values(self, monkeypatch):
@@ -82,7 +82,7 @@ class TestPublishToSsm:
        monkeypatch.setenv("AWS_DEFAULT_REGION", "us-east-1")
        monkeypatch.setenv("AWS_ACCESS_KEY_ID", "testing")
        monkeypatch.setenv("AWS_SECRET_ACCESS_KEY", "testing")
-        monkeypatch.setenv("ACDL_KMS_KEY_ID", "alias/aws/ssm")
+        monkeypatch.setenv("NOVA_KMS_KEY_ID", "alias/aws/ssm")

        with mock_aws():
            ssm = boto3.client("ssm", region_name="us-east-1")
@@ -105,14 +105,14 @@ class TestPublishToSsm:
        monkeypatch.setenv("AWS_DEFAULT_REGION", "us-east-1")
        monkeypatch.setenv("AWS_ACCESS_KEY_ID", "testing")
        monkeypatch.setenv("AWS_SECRET_ACCESS_KEY", "testing")
-        monkeypatch.setenv("ACDL_KMS_KEY_ID", "alias/aws/ssm")
+        monkeypatch.setenv("NOVA_KMS_KEY_ID", "alias/aws/ssm")

        with mock_aws():
            ssm = boto3.client("ssm", region_name="us-east-1")
            publish_to_ssm({"vpc_id": "vpc-1"}, "dev", "c-1")
            # Second publish with a new value should overwrite, not error
            publish_to_ssm({"vpc_id": "vpc-2"}, "dev", "c-1")
-            param = ssm.get_parameter(Name="/acdl/dev/c-1/vpc_id", WithDecryption=True)
+            param = ssm.get_parameter(Name="/nova/dev/c-1/vpc_id", WithDecryption=True)
            assert param["Parameter"]["Value"] == "vpc-2"

    def test_publish_continues_on_single_failure(self, monkeypatch):
@@ -123,7 +123,7 @@ class TestPublishToSsm:
        monkeypatch.setenv("AWS_DEFAULT_REGION", "us-east-1")
        monkeypatch.setenv("AWS_ACCESS_KEY_ID", "testing")
        monkeypatch.setenv("AWS_SECRET_ACCESS_KEY", "testing")
-        monkeypatch.setenv("ACDL_KMS_KEY_ID", "alias/aws/ssm")
+        monkeypatch.setenv("NOVA_KMS_KEY_ID", "alias/aws/ssm")

        with mock_aws():
            ssm = boto3.client("ssm", region_name="us-east-1")
@@ -142,7 +142,7 @@ class TestPublishToSsm:
                    results = publish_to_ssm(
                        {"good": "val", "bad": "val"}, "dev", "c-1"
                    )
-            assert results["good"] == "/acdl/dev/c-1/good"
+            assert results["good"] == "/nova/dev/c-1/good"
            assert results["bad"] is None


@@ -156,7 +156,7 @@ class TestFormatComment:
        comment = format_comment(outputs, "dev", "contract-001")
        assert "acdl-spike-bucket" in comment
        assert "vpc-abc123" in comment
-        assert "### ACDL Deploy Outputs (dev)" in comment
+        assert "### Nova Deploy Outputs (dev)" in comment
        assert "`contract-001`" in comment

    def test_sensitive_outputs_show_published_to_ssm(self):
@@ -175,12 +175,12 @@ class TestFormatComment:
    def test_ssm_path_included_when_results_provided(self):
        outputs = {"bucket_name": "my-bucket", "secret_token": "s3cret"}
        ssm_results = {
-            "bucket_name": "/acdl/dev/contract-001/bucket_name",
-            "secret_token": "/acdl/dev/contract-001/secret_token",
+            "bucket_name": "/nova/dev/contract-001/bucket_name",
+            "secret_token": "/nova/dev/contract-001/secret_token",
        }
        comment = format_comment(outputs, "dev", "contract-001", ssm_results)
-        assert "/acdl/dev/contract-001/bucket_name" in comment
-        assert "/acdl/dev/contract-001/secret_token" in comment
+        assert "/nova/dev/contract-001/bucket_name" in comment
+        assert "/nova/dev/contract-001/secret_token" in comment

    def test_dash_shown_when_ssm_results_provided_but_missing(self):
        outputs = {"bucket_name": "my-bucket"}
@@ -193,12 +193,12 @@ class TestFormatComment:
        outputs = {"bucket_name": "my-bucket"}
        comment = format_comment(outputs, "dev", "contract-001", ssm_results=None)
        # No SSM column content when ssm_results is None
-        assert "/acdl/" not in comment or "get-parameter" in comment  # only footer
+        assert "/nova/" not in comment or "get-parameter" in comment  # only footer

    def test_ssm_footer_contains_correct_path(self):
        outputs = {"bucket_name": "b"}
        comment = format_comment(outputs, "dev", "contract-001")
-        assert "/acdl/dev/contract-001/<output_name>" in comment
+        assert "/nova/dev/contract-001/<output_name>" in comment

    def test_skips_none_and_empty_values(self):
        outputs = {"real": "val", "none_val": None, "empty": ""}
@@ -355,7 +355,7 @@ class TestCli:
            output = captured.getvalue()
            assert "cli-bucket" in output
            assert "vpc-1" in output
-            assert "### ACDL Deploy Outputs (dev)" in output
+            assert "### Nova Deploy Outputs (dev)" in output
        finally:
            op.boto3 = saved_boto3
            sys.argv = old_argv
@@ -376,7 +376,9 @@ class TestCli:
 # ---------------------------------------------------------------------------

 class TestKmsFailLoud:
-    """P1-3: SSM publisher must fail loud when ACDL_KMS_KEY_ID is unset."""
+    """P1-3: SSM publisher must fail loud when NOVA_KMS_KEY_ID is unset
+    (P2 renamed from NOVA_KMS_KEY_ID; dual-read NOVA_* preferred,
+    ACDL_* fallback until P5)."""

    def test_kms_unset_raises(self, monkeypatch):
        from moto import mock_aws
@@ -385,11 +387,14 @@ class TestKmsFailLoud:
        monkeypatch.setenv("AWS_DEFAULT_REGION", "us-east-1")
        monkeypatch.setenv("AWS_ACCESS_KEY_ID", "testing")
        monkeypatch.setenv("AWS_SECRET_ACCESS_KEY", "testing")
-        monkeypatch.delenv("ACDL_KMS_KEY_ID", raising=False)
-        monkeypatch.delenv("ACDL_ALLOW_DEFAULT_KMS", raising=False)
+        # Both NOVA_* and ACDL_* unset → helper returns default (None) → fail loud.
+        monkeypatch.delenv("NOVA_KMS_KEY_ID", raising=False)
+        monkeypatch.delenv("NOVA_KMS_KEY_ID", raising=False)
+        monkeypatch.delenv("NOVA_ALLOW_DEFAULT_KMS", raising=False)
+        monkeypatch.delenv("NOVA_ALLOW_DEFAULT_KMS", raising=False)

        with mock_aws():
-            with pytest.raises(RuntimeError, match="ACDL_KMS_KEY_ID is not set"):
+            with pytest.raises(RuntimeError, match="NOVA_KMS_KEY_ID is not set"):
                publish_to_ssm({"vpc_id": "vpc-1"}, "dev", "c-1")

    def test_kms_unset_allow_default_kms_escape_hatch(self, monkeypatch):
@@ -399,14 +404,15 @@ class TestKmsFailLoud:
        monkeypatch.setenv("AWS_DEFAULT_REGION", "us-east-1")
        monkeypatch.setenv("AWS_ACCESS_KEY_ID", "testing")
        monkeypatch.setenv("AWS_SECRET_ACCESS_KEY", "testing")
-        monkeypatch.delenv("ACDL_KMS_KEY_ID", raising=False)
-        monkeypatch.setenv("ACDL_ALLOW_DEFAULT_KMS", "1")
+        monkeypatch.delenv("NOVA_KMS_KEY_ID", raising=False)
+        monkeypatch.delenv("NOVA_KMS_KEY_ID", raising=False)
+        monkeypatch.setenv("NOVA_ALLOW_DEFAULT_KMS", "1")

        with mock_aws():
            ssm = boto3.client("ssm", region_name="us-east-1")
            results = publish_to_ssm({"vpc_id": "vpc-1"}, "dev", "c-1")
-            assert results["vpc_id"] == "/acdl/dev/c-1/vpc_id"
-            param = ssm.get_parameter(Name="/acdl/dev/c-1/vpc_id", WithDecryption=True)
+            assert results["vpc_id"] == "/nova/dev/c-1/vpc_id"
+            param = ssm.get_parameter(Name="/nova/dev/c-1/vpc_id", WithDecryption=True)
            assert param["Parameter"]["Type"] == "SecureString"

    def test_kms_set_takes_precedence_over_allow_default(self, monkeypatch):
@@ -415,8 +421,8 @@ class TestKmsFailLoud:
        monkeypatch.setenv("AWS_DEFAULT_REGION", "us-east-1")
        monkeypatch.setenv("AWS_ACCESS_KEY_ID", "testing")
        monkeypatch.setenv("AWS_SECRET_ACCESS_KEY", "testing")
-        monkeypatch.setenv("ACDL_KMS_KEY_ID", "arn:aws:kms:us-east-1:123:key/abc")
-        monkeypatch.setenv("ACDL_ALLOW_DEFAULT_KMS", "1")
+        monkeypatch.setenv("NOVA_KMS_KEY_ID", "arn:aws:kms:us-east-1:123:key/abc")
+        monkeypatch.setenv("NOVA_ALLOW_DEFAULT_KMS", "1")

        from core.output_publisher import _kms_key_id
        assert _kms_key_id() == "arn:aws:kms:us-east-1:123:key/abc"
@@ -449,7 +455,7 @@ class TestInvokePolicyTemplate:
        rendered = template.replace("${account_id}", "123456789012").replace("${region}", "us-east-1")
        policy = json.loads(rendered)
        resource_arn = policy["Statement"][0]["Resource"]
-        assert resource_arn == "arn:aws:lambda:us-east-1:123456789012:function:acdl-contract-ingestor"
+        assert resource_arn == "arn:aws:lambda:us-east-1:123456789012:function:nova-contract-ingestor"
        assert "000000000000" not in resource_arn
        # ${consumerRepo} is a runtime placeholder (not a Terraform variable) — it stays.
        assert "${account_id}" not in rendered
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Jon Chery	a420e3b952	Merge milestone/v1.15-nova — v1.15 complete (Nova Rebrand: full ACDL→Nova rebrand across docs, decks, code, configs, CI, env vars, consumer path, SSM path, tag keys, AWS resource names; 4 execution phases + final; tag v1.15.4) acdl-ci / Lint (push) Successful in 20s Details acdl-ci / Platform check-only (offline) (push) Successful in 29s Details acdl-ci / Test (push) Successful in 6m41s Details	2026-07-30 02:24:50 +00:00
Jon Chery	3c765c3211	Merge phase/05-final-review-ship — v1.15.4 (Nova P5 final-review-ship complete, milestone release)	2026-07-30 02:24:20 +00:00
Jon Chery	e15eea067b	docs(milestone): complete v1.15 — Nova Rebrand (tag v1.15.4) P5 final-review-ship complete: dual-read fallback removed (REQ-164) — core/env.py NOVA-only, .env.secrets load paths NOVA-only (G-106 retired), nova_tagging.py hard-fails any acdl:* tag, legacy ACDL_* Gitea secrets deleted, ACDL_LIFECYCLE_MODE/ACDL_LOCAL_TIER/ACDL_HITL_* exports removed from scripts, SNS subject → Nova SoD halt (P1-2), bootstrap scripts NOVA-only. Review: 2 P0 auto-fixed (duplicate delenv), P1-1/P1-2 resolved, doc-drift fixed. Audit: tags v1.15.0-4 exist; traceability REQ-155..164 all complete; ARCHITECTURE naming table matches codebase. 615 pytest PASS; run_ci.sh 3-stage PASS. NOVA_MIGRATION.md marked COMPLETE. ---ci--- project: acdl phase: 5 milestone: v1.15 status: complete phase_role: final requirements: covered: [REQ-155, REQ-156, REQ-157, REQ-158, REQ-159, REQ-160, REQ-161, REQ-162, REQ-163, REQ-164] partial: [] ---/ci---	2026-07-30 02:23:55 +00:00
Jon Chery	eb7634da28	fix(P5): doc drift — Nova rebrand stale refs in docs/decks/roadmap/arch v1.15-Nova rebrand doc verification (phase/05-final-review-ship) found stale ACDL references where the code/terraform already uses Nova names. Critical drift fixed (doc said old name; code uses new): - README.md: `.acdl/contract.yml` -> `.nova/contract.yml`; `acdl-spike-runner` -> `nova-spike-runner`; ABAC tag keys `acdl:owner\|contract` -> `nova:owner\|contract`. - docs/environments/index.md: `acdl-contract-ingestor` -> `nova-contract-ingestor`; `aws:PrincipalTag/acdl:owner` -> `nova:owner`; `acdl-contracts` -> `nova-contracts`. - docs/consumer-guide.md: `acdl-change-requests` -> `nova-change-requests`; state bucket example `acdl-qa-state` -> `nova-qa-state`. - docs/presentations/* (4 decks + 2 HTML + talking-points): `acdl:owner\|contract\| environment\|cost-center` -> `nova:`; `ACDL_LIFECYCLE_MODE` -> `NOVA_LIFECYCLE_MODE`. - pipelines/modules-lifecycle.yml comments: `ACDL_LIFECYCLE_MODE` -> `NOVA_LIFECYCLE_MODE` (workflows already use NOVA_; the contract comments were stale). - docs/NOVA_MIGRATION.md: status banner -> COMPLETE (P5 cutoff passed). - .ciagent/ARCHITECTURE.md: header `ACDL` -> `Nova`; NOVA_LIFECYCLE_MODE rename noted in the live lifecycle-mode section (v1.15 addendum already correct). - .ciagent/ROADMAP.md: v1.15 phase statuses P1-P4 pending -> complete (v1.15.1..v1.15.4); P5 -> in progress (phase/05-final-review-ship). Verification: - grep for `acdl:` tag keys / `.acdl/contract` / `acdl-contract-ingestor` / `acdl-contracts` / `ACDL_LIFECYCLE_MODE` in README/docs/pipelines -> 0 hits (excluding explicitly-unchanged repo path `acdl/.github/...`, `continuous-intelligence/acdl`, and historical narrative). - core/output_publisher.py uses `/nova`; schemas/tagging-standard.json uses `nova:`; terraform uses `nova-` (0 `acdl-` in *.tf) — docs now match. - git tag v1.15.0..v1.15.4 exist. - pytest tests/test_lifecycle_mode_flag.py tests/test_pipeline_contract.py -> 111 passed. ---ci--- project: acdl	2026-07-30 02:11:12 +00:00
Jon Chery	13846d553a	fix(P5): review P0 — collapse duplicate NOVA_* delenv in route-halt + adapter tests Code review (correctness lens) found the same P5 mechanical-edit defect in two more test files: the ACDL_* fallback delenv was replaced with a duplicate NOVA_* delenv (leaving a dead duplicate line, a stale 'ACDL_* fallback until P5' comment, and the ACDL_* var no longer cleaned). - tests/test_route_halt_artifact.py: two sites (stderr-fallback + outbox-fallback) each deleted NOVA_SOD_HALT_TOPIC_ARN twice. - tests/test_adapter.py::test_default_remote_state_key: deleted NOVA_REMOTE_STATE_KEY twice. With core/env.py NOVA-only as of P5, a single NOVA_* delenv is the correct precondition. Collapsed to one delenv per var + updated comments. ---ci--- project: acdl phase: 5 milestone: v1.15 status: verify lessons: - P0 fix applied: duplicate monkeypatch.delenv('NOVA_*') in test_route_halt_artifact.py (2 sites) + test_adapter.py collapsed to a single delenv consistent with the P5 NOVA-only core/env.py. ---/ci---	2026-07-30 02:05:57 +00:00
Jon Chery	d14f9289da	fix(P5): review P0 — remove duplicate delenv in attestation signature-skip test Code review (correctness lens) found a P0 in tests/test_attestation_matrix.py introduced by the P5 fallback-removal pass: the dual-read delenv of ACDL_ATTESTATION_SIGNING_KEY_ID was replaced with a second (duplicate) delenv of NOVA_ATTESTATION_SIGNING_KEY_ID, leaving the test misleading (comment claimed 'both NOVA_* and ACDL_* must be unset' while only NOVA_* was deleted twice) and the ACDL_* var no longer cleaned. With P5 having removed the ACDL_* fallback from core/env.py, deleting NOVA_* alone is the correct and sufficient precondition for the skip; this commit drops the duplicate line and updates the comment to match the NOVA-only contract. ---ci--- project: acdl phase: 5 milestone: v1.15 status: verify lessons: - P0 fix applied: duplicate monkeypatch.delenv('NOVA_ATTESTATION_SIGNING_KEY_ID') in test_signature_skip_when_key_unset left the test misleading and the ACDL_* var uncleaned; collapsed to a single NOVA_* delenv consistent with the P5 NOVA-only core/env.py. ---/ci---	2026-07-30 02:03:16 +00:00
Jon Chery	d4b8b5e1e9	Merge phase/04-aws-resource-migration — v1.15.4 (Nova P4 AWS resource migration complete)	2026-07-30 01:56:16 +00:00
Jon Chery	bf8ac0fe49	verify(P4): Nova rebrand AWS resource migration — 4-layer verify PASS VERIFY: structural — all acdl-→nova- in terraform (DynamoDB, Secrets, Lambda, SNS, SG, KMS alias, ECS, ECR, IAM, state bucket, ALB, VPC) + Lambda defaults (D-111) + nova-deploy role ARN; behavioral — terraform validate PASS + 615 pytest PASS + run_ci.sh 3-stage PASS; security — ABAC policy ARNs updated, state-bucket -migrate-state documented; quality — grep-zero on acdl- in terraform (0 hits). New docs/NOVA_AWS_MIGRATION.md runbook + scripts/migrate_dynamodb_data.py (+17 tests). REQ-163 complete. ---ci--- project: acdl phase: 4 milestone: v1.15 status: verify requirements_covered: [REQ-163] ---/ci---	2026-07-30 01:56:11 +00:00
Jon Chery	0e6ecae26d	feat(P4): Nova rebrand — AWS resource migration (REQ-163) Rename all acdl-* AWS resources → nova-* across terraform (DynamoDB, Secrets Manager, Lambda, SNS, SG, KMS alias, ECS, ECR, IAM user/policy, state bucket, ALB, VPC/subnet names). Lambda default table names → nova-* (D-111). State bucket backend → nova-tfstate (-migrate-state documented). New docs/NOVA_AWS_MIGRATION.md runbook (staged migration + rollback). New scripts/migrate_dynamodb_data.py (scan+copy, dry-run default). acdl-deploy- → nova-deploy- role ARN in deploy workflows. Test fixtures updated; terraform validate + pytest + run_ci.sh PASS. ---ci--- project: acdl phase: 4 milestone: v1.15 status: execute ---/ci---	2026-07-30 01:54:26 +00:00
Jon Chery	267df4ad0d	Merge phase/03-ssm-tagkeys — v1.15.3 (Nova P3 SSM+tagkeys complete)	2026-07-30 01:40:16 +00:00
Jon Chery	da0de6068a	verify(P3): Nova rebrand SSM path + tag keys — 4-layer verify PASS VERIFY: structural — SSM_PREFIX /acdl→/nova, tag keys acdl:→nova: in terraform + tagging-standard.json, nova_tagging hard mode (_WARN_MODE=False); behavioral — 598 pytest PASS (+32 new) + run_ci.sh 3-stage PASS + regression gate 22/22 Verified; security — ABAC PrincipalTag/acdl:owner→nova:owner, migration scripts dry-run-default; quality — grep-zero on acdl: tag keys (remaining = legacy-detection constant + migration guide). REQ-161/162 complete. New scripts/migrate_ssm_paths.py + untag_acdl_keys.py (+32 tests). ---ci--- project: acdl phase: 3 milestone: v1.15 status: verify requirements_covered: [REQ-161, REQ-162] ---/ci---	2026-07-30 01:40:12 +00:00
Jon Chery	51c3edf458	feat(P3): Nova rebrand — SSM path + tag keys (REQ-161/162) SSM path /acdl/{env}/{contractId}/{output} → /nova/... across core/output_publisher + contract resolver + consumer docs. New scripts/migrate_ssm_paths.py (copy/verify/delete, dry-run default). AWS tag keys acdl:owner\|environment\|contract\|cost-center\|ref → nova:* across terraform tagging + ABAC session policies (iam:ResourceTag/acdl:* → iam:ResourceTag/nova:). nova_tagging.py hard mode (D-109 warn→hard). tagging-standard.json tag-key values → nova:. New scripts/untag_acdl_keys.py (remove old acdl:* tags, dry-run default). Test fixtures updated; pytest + run_ci.sh PASS. ---ci--- project: acdl phase: 3 milestone: v1.15 status: execute ---/ci---	2026-07-30 01:38:30 +00:00
Jon Chery	e998d9fa6b	Merge phase/02-code-envvars-consumer-path — v1.15.2 (Nova P2 complete)	2026-07-30 01:27:09 +00:00
Jon Chery	7ea58ec1c9	verify(P2): Nova rebrand code/env-vars/consumer-path — 4-layer verify PASS VERIFY: structural — core/env.py dual-read helper + nova_tagging.py warn-mode + .acdl/→.nova/ + 21 NOVA_* env vars; behavioral — 566 pytest PASS + run_ci.sh 3-stage PASS; security — G-106 dual-read in both .env.secrets load paths (run_platform.sh:294-295 + regression_verify.py :322-325), G-108 Gitea NOVA_* secrets created (4/5 HTTP 201/204, 1 skip-no-source) + workflow secrets: refs updated; quality — grep-zero on stray ACDL_ code reads (remaining = intentional dual-read fallback). REQ-158/159/160 complete. ---ci--- project: acdl phase: 2 milestone: v1.15 status: verify requirements_covered: [REQ-158, REQ-159, REQ-160] ---/ci---	2026-07-30 01:27:06 +00:00
Jon Chery	d5bae868a4	feat(P2): Nova rebrand — code/env-vars/consumer-path (REQ-158/159/160) core/env.py dual-read helper (D-108); 21 ACDL_→NOVA_ env vars migrated across core/scripts/adapters/tests/workflows + .env/.env.secrets (key rename, values stay). G-106 binding: run_platform.sh:288-289 + regression_verify.py:309-312 dual-read (NOVA first, ACDL fallback). G-108 binding: Gitea NOVA_* secrets created via API + workflow secrets: refs updated (deploy.yml + modules-lifecycle.yml, .gitea + .github). acdl_tagging.py→nova_tagging.py (D-109 warn mode, nova:* enforced). .acdl/→.nova/ consumer path (resolver + deploy workflow + schema + tests + docs). Test fixtures updated; pytest + run_ci.sh PASS. ---ci--- project: acdl phase: 2 milestone: v1.15 status: execute ---/ci---	2026-07-30 01:25:24 +00:00
Jon Chery	0bc70a3d95	Merge phase/01-docs-decks-prose — v1.15.1 (Nova P1 docs/decks/prose complete)	2026-07-30 00:58:22 +00:00