# GRILL — v1.28 CLI Canonicalization + Identity Layer

> Adversarial review of the v1.28 SPECIFY + CLARIFY + RESEARCH + PLAN.
> Griller: ci-griller subagent. Autonomy: full. All 9 axes reviewed;
> every claim verified against the live codebase.

---

## Overall verdict: **PROCEED-WITH-CONDITIONS** · Confidence 0.76

The plan is fundamentally sound — architecture correct, re-mapping
clean (no ID collisions), technical depth accurate (DER→raw, strong-
read revocation, stdin TTY), highest-risk item (kj binary) has a
Fargate fallback. Not unfeasible, not over-scoped beyond an agent-driven
repo's capacity, not security-broken by design.

**3 critical conditions (must-fix before P1) + 16 tracked conditions.**
No escalations (all axes ≥ 0.70 confidence).

---

## Axis verdicts

| Axis | Verdict | Confidence | Critical condition |
|------|---------|-----------|-------------------|
| §1 Feasibility | PROCEED-WITH-CONDITIONS | 0.82 | C-1.1 KMS asym verify; C-1.2 Argon2 fail-closed test |
| §2 Scope | PROCEED-WITH-CONDITIONS | 0.74 | C-2.1 fold P5 into P4; C-2.2 P4 overload |
| §3 Cost | PROCEED-WITH-CONDITIONS | 0.70 | C-3.1 cost estimate; C-3.2 CodeArtifact P1 task |
| §4 Schedule | PROCEED-WITH-CONDITIONS | 0.76 | C-4.1 P4 critical path; C-4.2 per-phase exit |
| §5 Technical Depth | PROCEED-WITH-CONDITIONS | 0.80 | C-5.1 ABAC shape; **C-5.2 JWS KDF** |
| §6 Operational Readiness | PROCEED-WITH-CONDITIONS | 0.72 | **C-6.1 ABAC fail-closed**; C-6.2 threat model; C-6.3 ops guide |
| §7 Security Posture | PROCEED-WITH-CONDITIONS | 0.73 | **C-7.1 ABAC fail-closed**; C-7.2 Argon2 params; C-7.3 cred file |
| §8 Dependency Risk | PROCEED-WITH-CONDITIONS | 0.83 | C-8.1 CodeArtifact P1; C-8.2 pin kj version |
| §9 Re-mapping Integrity | PROCEED-WITH-CONDITIONS | 0.84 | **C-9.1 traceability fix**; C-9.2 INV audit |

---

## Critical conditions (the 3 must-fix-before-P1)

### 🔴 C-6.1 / C-7.1 — ABAC fail-closed
The token-vend Lambda's behavior on `kj` absence/error is unspecified.
Without fail-closed, INV-17 is documentation, not a runtime guarantee —
a `kj` load failure would bypass the ABAC gate (every PAT gets a token).
**Fix applied to PLAN.md P4 Wave 4 Task 4.1:** "If
`KyvernoJsonEngine.is_configured()` returns false or `evaluate()`
raises, return 403 + audit `token.vend.denied` (reason:
`abac_eval_failed`). Never fail open. Test: `tests/test_abac_fail_closed.py`."

### 🔴 C-5.2 — JWS-from-PAT key derivation
REQ-332's AC ("public key derivable from the PAT") is unimplementable
without a specified KDF. A PAT is a JWT, not a keypair.
**Fix applied to PLAN.md P2 Wave 2 Task 2.3 + REQ-332 AC:** the JWS
uses HMAC-SHA256 with a key derived via
`HKDF-SHA256(PAT_bytes, salt='nova-local-attestation', info='jws-signing-key')`
→ 32-byte symmetric key. The "public key derivable" AC is re-interpreted:
the *verification key* is derived from the PAT via the same KDF (the
PAT is the shared secret). This is a symmetric scheme, not asymmetric.

### 🔴 C-9.1 — Traceability drift
REQUIREMENTS.md §v1.28 traceability table mapped 16 REQs to P2;
PLAN.md splits them across P2/P3/P4/P5/P6. **Fix applied to
REQUIREMENTS.md** — traceability table updated to match PLAN.md phase
structure.

---

## Tracked conditions (16 — applied to PLAN.md as amendments)

- **C-1.1** KMS asymmetric key verification before P4 Wave 3 (one
  `aws kms create-key --key-spec ECC_NIST_P256` call).
- **C-1.2** Argon2 fail-closed test in P3 Wave 2 (Lambda returns 503
  on `ImportError`, not a crash or pure-Python hash).
- **C-2.1** Fold P5 (idp-setup) into P4 as P4 Wave 8 → **reduces to 6
  execution phases** (P1..P6, P7 = final). Applied.
- **C-2.2** P4 is a double-length phase; acknowledged in P4 header.
- **C-3.1** Cost envelope subsection added to PLAN.md.
- **C-3.2 / C-8.1** CodeArtifact provisioning = P1 Wave 0 task with
  binary go/no-go gate; Gitea wheel index fallback documented.
- **C-4.1** P4 flagged as critical-path phase (kj spike = highest-
  probability schedule slip; Fargate = +1 week).
- **C-4.2** Per-phase exit criteria added to PLAN.md.
- **C-5.1** `requested_claims` = list of claim names (the policy
  asserts the subject is *allowed* to request those claims).
- **C-6.2** Threat model (REQ-347) adds: JWKS DDoS surface, PAT theft
  + max TTL (≤24h dev, ≤1h service-account), ABAC fail-closed,
  INV-18..21 compression audit.
- **C-6.3** Operator guide (REQ-345) adds: KMS rotation, layer update,
  PITR restore, emergency PAT revocation.
- **C-7.2** Argon2id parameters: t=3, m=65536 KiB, p=1 (OWASP min).
- **C-7.3** `~/.nova/credentials.json` stores OIDC token + PAT metadata
  (jti, exp, type), NOT the raw PAT.
- **C-8.2** `kj` pinned to a specific release + SHA256 recorded.
- **C-9.2** Threat model includes INV-18..21 compression audit
  (verify spec's attestation invariant semantics are captured by
  INV-15/16/17 + REQ-332).

---

## Escalations

None. All 9 axes resolved at confidence ≥ 0.70. No human escalation
required (full autonomy).

---

## Grill complete

The plan proceeds with the 3 critical fixes and 16 tracked conditions
applied to PLAN.md + REQUIREMENTS.md. The binding decisions above are
the authoritative grill record. Next: MVP/UX CHECK → SHIP phase 0.