continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity

128 Releases 190 Tags

RSS Feed
  • v1.28.6 932923ee99
    Compare

    v1.28.6: v1.29 Reposplit + Identity Layer Bring-Live — milestone release
    Nova Slides Render / render (push) Failing after 22s
    Details
    Stable

    coreci-bot released this 2026-08-20 05:29:51 +00:00 | 45 commits to main since this release

    v1.29 — Reposplit + Identity Layer Bring-Live

    Feature milestone — complete. v1.29 makes platform operations a Terraform-controlled discipline that lives outside the engineering repo, with a narrow-IAM kj substrate shared by the primary runtime and its defensive fallback. acdl/acdl standardizes on GitHub (Gitea scrub); Nova-idp is brought live in account 581513795199 (code complete since v1.28, unverified in-account at Phase 0); kj has exactly one identity (one ECR image digest) shared by both substrates (KJ-LOCKSTEP, REQ-371).

    Phases

    Phase Tag Scope
    P0 v1.28.0 Pre-execution: SPECIFY + CLARIFY + RESEARCH + PLAN + GRILL + MVP/UX
    P1 v1.28.1 publish.yml ECR image + Lambda zip + GitHub Release (REQ-354)
    P2 v1.28.2 Gitea scrub (REQ-367) + decisions D-232..240 (REQ-368)
    P3 v1.28.3 CFN archive + terraform delegation (REQ-369)
    P4 v1.28.4 Operator guide + ARCHITECTURE §12.11 + STATE v1.29
    P5 v1.28.5 Consumer deploy.yml @v1.25 -> @v1.29 (REQ-CONSUMER-BUMP)
    P6 v1.28.6 Final review + audit + milestone ship (this release)

    Requirements (17 total)

    Acdl-side (6, complete):

    • REQ-354: publish.yml ECR image + Lambda zip + GitHub Release
    • REQ-367: Gitea scrub (.gitea/ removed, forge_parity_disabled CI)
    • REQ-368: Decisions D-232..240 recorded
    • REQ-369: CFN archive + terraform delegation
    • REQ-OPS-GUIDE: operator-guide-platform-ops.md (747 lines, 18 sections)
    • REQ-CONSUMER-BUMP: consumer deploy.yml @v1.25 -> @v1.29

    Covered-reference (14, verified via M1/M1.5/M2 cutover gates in nova-platform-ops):

    • REQ-355, 356, 357, 358 (ops repo CI/HITL/version-pin)
    • REQ-359, 360 (Gitea-private repo, IAM scope bounded)
    • REQ-361, 362 (terraform import, KMS key provisioning)
    • REQ-363, 363b (Lambda/Fargate substrate, KJ-LOCKSTEP)
    • REQ-364, 365, 366 (JWKS/WAF/ACM edge)
    • REQ-371 (KJ-LOCKSTEP lifecycle.precondition)

    Decisions (9)

    • D-232: Forge parity abandoned (Gitea -> GitHub standardization)
    • D-233: JWKS public-read via CloudFront edge (INV-18)
    • D-234: KMS asymmetric key provisioning (ECC_NIST_P256, 90-day rotation)
    • D-235: Tag-pin handoff (engineering -> ops via GitHub Releases)
    • D-236: Cutover shape + rollback procedure
    • D-237: Fargate sunset discipline (>=30 days green + architecture review)
    • D-238: KJ-LOCKSTEP release-gate invariant
    • D-239: ECR tag format correction (+ invalid -> - separator)
    • D-240: Terraform lifecycle.precondition floor v1.2.0 (not v1.4+)

    Invariants + NFR constraints

    • INV-18 (JWKS-EDGE-ONLY): JWKS is the only public read surface
    • KJ-STATIC: kj binary compiled CGO_ENABLED=0, statically linked
    • KJ-LOCKSTEP: Fargate digest == Lambda image_uri digest at every plan
    • KJ-WARMUP-HEALTH: Fargate standby READY probe every 10s
    • OPER-PRIV, IAM-NARROW, DRIFT-DETECT, IMPORT-IDEMPOTENT, TFM-HITL, JWKS-SLO, JWKS-ROTATION

    Capabilities (3 new)

    • CAP-039: platform-ops-reposplit
    • CAP-040: kj-substrate-lockstep
    • CAP-041: jwks-edge-only

    Grill + Review + Audit

    • Grill: PROCEED-WITH-CONDITIONS 0.72 (4 critical fixes: M1.5 hard gate, covered-reference Result column, P1 intermediate tag, kj source-fetch)
    • Review: PASS-WITH-ISSUES (3 P0 fixes auto-applied: wheel upload masking, forge-mention CI block, vacuous test pass; 5 P1+ flagged — STATE.md footer fixed in P6)
    • Audit: all 7 checks PASS (reconstruction, file discipline, branch hygiene, commit discipline, tag discipline, M1.5 gate template, covered-reference tracking)

    Carry-forward

    • Q7 (kj image verification — M1.5 gate, operator attests in nova-platform-ops CI)
    • M-001 (ABAC empty-policy-dir fail-open gap — pinned in test, mitigated)

    Key deliverables

    • .github/workflows/publish.yml — tag-triggered, ECR image build with KJ-STATIC gate
    • docs/operator-guide-platform-ops.md — 747-line operator runbook with 18 sections + Cutover Gates table
    • docs/archive/nova-idp-cfn-v1.28.md — CFN template archived as read-only reference
    • nova/idp/setup.py — terraform delegation (--apply -> terraform apply)
    • tests/test_abac_e2e.py — ABAC allowed/denied/fail-closed (INV-17)
    • platform/abac/kj-version.txt — kj v0.0.3 pinned + repo URL

    Milestone branch: milestone/v1.29-reposplit-identity (deleted after merge).
    Tag line: v1.28.x (P0=v1.28.0 -> P6=v1.28.6=milestone release).
    Intermediate tag: v1.29.0 (CF-3 artifact production for P5 smoke test).

    Downloads