# Nova Custom Checkov Rules

This directory holds Nova-authored Checkov custom rules, written in the
[Checkov Python custom-rule framework](https://www.checkov.io/4.Contributing/Custom%20Policies.html).

## Files

- `nova_tagging.py` — `NOVA_TAG_NAMING` (D-054, D-109 warn mode in P2):
  ensures every taggable AWS resource carries the four required Nova tags
  (`nova:owner`, `nova:contract`, `nova:environment`, `nova:cost-center`).
  This rule replaces the synthetic SKIPPED `NOVA_TAG_NAMING` record that the
  Checkov adapter previously emitted (D-043 closure). Renamed from
  `acdl_tagging.py` / `ACDL_TAG_NAMING` in P2 (REQ-158). The canonical tag
  set is declared in [`schemas/tagging-standard.json`](../../../schemas/tagging-standard.json).

  **P2 warn mode (D-109):** existing resources still carry `acdl:*` tag-key
  values (left for P3). When a resource has only `acdl:*`-style tags and no
  `nova:*` tags, the rule logs a WARNING instead of failing, so the
  regression gate stays green during the parallel-tag transition window.
  P3 flips to hard-fail once `nova:*` tags are emitted in parallel and the
  ABAC policy is swapped.

## How Checkov loads them

Checkov custom rules are discovered via the `--external-checks-dir` flag.
`scripts/run_platform.sh` invokes Checkov with:

```
checkov -f terraform/spike/main.tf --framework terraform -o json --soft-fail \
        --external-checks-dir adapters/terraform/policy/custom_rules/
```

Checkov imports each `*.py` file in the directory and instantiates the
module-level `check` object (see the `check = NovaTaggingStandard()` line at
the bottom of `nova_tagging.py`).

## Severity / result mapping

The Checkov adapter (`adapters/terraform/policy/checkov_adapter.py`)
maps `NOVA_TAG_NAMING` to `(tagging-standard, medium)` in `RULE_MAP`. The
custom rule therefore produces real `PASS`/`FAIL` PolicyCheckResult records,
feeding the confidence signal instead of the old SKIPPED placeholder.