acdl/.ciagent/archive/REVIEW-AUDIT-P05.md

# P05 Final Review + Audit — v1.26 Live Pilot Estate Activation

> **Phase:** 5 (final review + audit + ship) — review + audit only; the
> milestone ship (merge to main / tag v1.25.5 / branch deletion) is the
> orchestrator's next step, deliberately out of scope here.
> **Branch:** `phase/05-final-review-ship`
> **Milestone:** `milestone/v1.26-pilot-activation`
> **Tags so far:** v1.25.0 (P0) → v1.25.1 (P1) → v1.25.2 (P2) →
> v1.25.3 (P3) → v1.25.4 (P4). P5 ships v1.25.5 (= the v1.26 release).
> **Date:** 2026-08-19

---

## 1. Review (ciagent-review equivalent)

Multi-persona review across P1..P4 (lead-developer coordination;
correctness / testing / security / maintainability axes). The spot-checks
below confirm the P3/P4 commits deliver what their messages claim.

### Correctness spot-checks (all PASS)

- **kyverno-json substrate fix (59d837f):** the engine `_translate` parses
  the real `kj` v0.0.3 bare-list output (not the v1.25-assumed
  `{"results":[...]}` dict); `_materialize_yaml_policy_dir` mirrors `.json`
  policies to `.yaml` twins (kj v0.0.3 ignores `.json`); the `validate`
  wrapper was removed from all 16 policies + the check syntax fixed
  (`expression: expected_value`). All 36 kj-dependent tests pass against
  real `kj` (0 skips). The install script fixed
  (`go install .../kyverno-json@latest` + symlink, not the broken
  `cmd/kj@latest`).
- **outcome backfill (51b886f, REQ-317):** `core/metrics/outcome_backfill.py`
  updates `fact_decision.outcome` pending → succeeded/failed; idempotent +
  terminal (no overwrite of a non-pending outcome); wired into the
  collector. The P4 run evidence (6ced8ed) confirms
  `nova.outcome.backfilled (pending->succeeded)`.
- **Gitea adapter (P3 W0):** the consumer `deploy.yml` has no cross-repo
  `uses:` — inline `actions/checkout@v4` of `acdl/acdl @ ref: v1.25` into
  `platform/` then `bash platform/scripts/run_platform.sh`. SPEC §10 Q1
  resolved by evidence.
- **env-JSON state_backend (3300ed2, REQ-319):** the adapter reads
  `env.state_backend.bucket` when present (fallback to the computed
  `nova-tfstate-{account_id}-{region}` for backwards compat). `dev.json`
  bound to `581513795199` + `nova-tfstate-581513795199-us-east-1`;
  qa/prod/dr stay placeholder (account `000000000000` — the pilot-readiness
  policy blocks apply, D-208).
- **pilot policies (e22661a, REQ-315/320):** `no-placeholder-account.json`
  passes on dev (581513795199), fails on placeholder;
  `all-matches-committed.json` asserts `all_committed == true`. Both run
  against real `kj` (not skipped).

### Testing

- 844 tests collected; **844 pass** (839 fast + 5 slow individually
  re-run: 2 `test_run_local_e2e_*` + 3 `test_verify_regression_mode::*`).
  0 failures, 0 skips that shouldn't skip.
- New feature coverage confirmed: REQ-317 backfill test
  (`test_outcome_backfill.py`), REQ-318 escalation_reason test
  (`test_confidence_escalation_reason.py`), REQ-315/320 policy tests
  (`test_settlement_finality_policy.py`, `test_pilot_readiness_policy.py`
  — both real-kj), REQ-316 CAP-025 test (`test_regression_pilot.py`), Gitea
  adapter tests (`test_deploy_workflow_invocation.py` +
  `test_deploy_gitea_invocation.py` — assert no cross-repo `uses:`,
  `ref: v1.25`, `secrets: inherit`), rotation workflow test
  (`test_rotate_key_workflow.py`), CAP-025 test
  (`test_deploy_workflow_env_input.py`).
- The v1.25 `pytest.skip("kj not installed")` skips are gone — `_require_kj`
  no longer skips (kj v0.0.3 installed). All kj-dependent tests exercise
  the real engine.

### Security

- **No `NOVA_AWS_*` secrets in committed files.** `.env.secrets` is
  gitignored and NOT tracked (`git ls-files` confirms). All `NOVA_AWS_*`
  references in committed workflow files are `${{ secrets.* }}` placeholder
  references — the correct pattern. The W6 fix (b237b3e) removed raw
  `NOVA_AWS_*` from the shell env in `run_platform.sh`'s local fallback.
- **No forge mentions in synced files.** `test_no_forge_mentions` PASS
  (the REQ-230 guard). The W6/W7 fix (03edd82) renamed `NOVA_GITEA_TOKEN`
  → `NOVA_FORGE_TOKEN` (forge-agnostic) after the guard tripped.

### Maintainability

- **No stale `TYPE_MAP` refs in active docs.** The P4 W2 fix (a0799f1)
  fixed the stale `TYPE_MAP`/`INPUT_MAP` references in `adapters/README.md`
  (IDEATE I8). Remaining `TYPE_MAP` mentions are in `.ciagent/archive/`
  (historical, correct) + `.ciagent/{CLARIFY,IDEATE,RESEARCH}.md`
  (decision records, correct context).
- **No new TODOs/FIXMEs in P3/P4.** `grep` over `core/` for
  `TODO|FIXME|XXX|HACK` returns 0 matches.
- The P3 W0.5 fix (3735330) resolved pre-existing P2 drift (dynamodb
  `simple.yaml` → `simple.yml`, sync_workflows re-sync, CAP-024 deck path
  → `nova-autonomous-cloud-delivery-marp.md`).

### Review verdict

**0 P0 issues remain** after the one P0 fix applied this phase (see §3).
**P1+ issues for post-hoc review (none blocking ship):**

| # | Severity | Issue | Disposition |
|---|----------|-------|-------------|
| R-1 | P2 (cosmetic) | `CHECKPOINT.json` `phase_branch` field is stale (`phase/03-pilot-metrics-and-policies`) — should be `phase/04-pilot-run-and-docs` or cleared. | Post-hoc. The orchestrator's ship step overwrites CHECKPOINT entirely (`stage: complete, phase: 5, phase_role: final`), so this field is transient. Not fixed here to avoid touching CHECKPOINT outside the ship step. |
| R-2 | P3 (historical) | The v1.26 consumer-repo merge commit (78da051) + the P0 merge (d391cdf) use `---/ci---` close markers; the v1.26 platform-repo commits (P3/P4) use `---ci---` only. Minor format inconsistency from the multi-project boundary. | Post-hoc. Cosmetic; both markers are recognized by the audit tooling. |
| R-3 | P3 (future-hardening) | Single `NOVA_AWS_*` root-equivalent key (D-207). Documented in PLAN.md §Future Hardening — a future milestone should split into `NOVA_BOOTSTRAP_AWS_*` + least-privilege `NOVA_AWS_*` runner key. | Post-hoc. Out of v1.26 scope by design (D-207, G-Q9). |

---

## 2. Audit (ciagent-audit equivalent)

### 2.1 Reconstruction test — **PASS**

The git log `---ci---` blocks are consistent with the `.ciagent/` file
states. The last 20 commits on `milestone/v1.26-pilot-activation` show the
expected phase progression:

- P0 (`d391cdf`, status: complete) → P1 ship (`2ee541f`) →
  P2 reconcile (`d022ddc`) → P2 complete (`6a3d47e`) →
  P3 W0.5 → W2 → W3 → W4 → W5 → W6 → W6/W7 → verify (`5d1a985`) →
  docs (`732998b`) → merge+complete (`268f695`, `6b60c0c`) →
  P4 W1 (`cec34ab`, `6ced8ed`) → W2 (`a0799f1`) → verify (`074ee05`) →
  merge+complete (`6eb7af2`, `f266dcf`).

Each phase follows the `execute → verify → complete` lifecycle. The
CHECKPOINT `current_phase` (phase 4, status complete, tag v1.25.4) matches
the latest commit (`f266dcf docs(ship): P4 complete → v1.25.4`). The
`previous_phase` (phase 3, tag v1.25.3, complete) is consistent.

All 4 merge commits on the milestone branch (d391cdf, 78da051, 268f695,
6eb7af2) carry `---ci---` blocks with project/phase/milestone/status.

### 2.2 `.ciagent/` file discipline — **CLEAN** (after the one P0 fix)

- **CHECKPOINT.json:** `current_phase` (4/complete/v1.25.4) + `previous_phase`
  (3/complete/v1.25.3) consistent with the git log. `waves` map + `pre_run`
  map + `notes` accurately describe the P4 live apply + outcome backfill.
  One stale field: `phase_branch` (R-1, post-hoc).
- **REQUIREMENTS.md:** v1.26 traceability table now shows all 13 REQs
  (310..322) complete. **One P0 fix applied:** REQ-316 row corrected from
  "P4 live-verify pending" → "v1.25.4 — live-verify complete" (P4 is
  complete; v1.25.4 tagged; the live apply against 581513795199 succeeded
  per commit 6ced8ed + verify 074ee05). The v1.25 table (REQ-291..309) is
  all-complete + consistent with ROADMAP.
- **ROADMAP.md:** v1.26 phases P0..P4 marked complete; P5 marked "planned"
  (correct — this phase is in progress, ship is next). v1.25 marked
  complete. The phase descriptions match the commits.
- **PLAN.md:** the active phase plan covers P0..P5 with wave ordering,
  persona assignment, + the REQ-322→P2 W0 revision. Consistent with what
  shipped.
- **ARCHITECTURE.md:** §12.8 (Pilot Estate) + §12.9 (rotation) present
  (P4 W2 docs).
- **PROJECT.md:** v1.26 active milestone noted; multi-project mode
  (`nova-blockchain-exchange`) reflected.

### 2.3 Branch hygiene — **CLEAN**

`git branch -a` (local):
- `main`
- `milestone/v1.26-pilot-activation`
- `phase/05-final-review-ship` (current)

P1..P4 phase branches are deleted (only milestone + P5 remain, as
required). Remote: `origin/main` + `origin/milestone/v1.26-pilot-activation`
mirror the local state.

Tags: `v1.25` (floating) + `v1.25.0` + `v1.25.1` + `v1.25.2` + `v1.25.3` +
`v1.25.4` all exist. `v1.25.5` is not yet present (correct — it's the
orchestrator's ship step).

### 2.4 Commit discipline — **CLEAN**

Every v1.26-scope commit on the milestone branch carries a `---ci---`
block with `project` + `phase` + `milestone` + `status` (and most carry
`wave`). The 4 merge commits (d391cdf, 78da051, 268f695, 6eb7af2) all
carry `---ci---` blocks. (Historical commits from v1.0-v1.18 predate the
block convention — out of scope for this audit.)

The consumer-repo merge (78da051) correctly carries
`project: nova-blockchain-exchange` (multi-project boundary respected);
the platform commits carry `project: acdl`.

### Audit verdict

| Check | Result | Detail |
|-------|--------|--------|
| Reconstruction test | **PASS** | git-log `---ci---` blocks ↔ `.ciagent/` consistent; phase 4/complete/v1.25.4 matches HEAD. |
| File discipline | **CLEAN** | All 6 `.ciagent/` files consistent after the REQ-316 P0 fix. One stale `phase_branch` field (R-1, post-hoc). |
| Branch hygiene | **CLEAN** | Only main + milestone + P5; P1-P4 deleted; v1.25.0..v1.25.4 tagged. |
| Commit discipline | **CLEAN** | All v1.26 commits carry `---ci---` blocks; merge commits included. |

---

## 3. P0 fixes applied this phase

| # | File | Fix |
|---|------|-----|
| P0-1 | `.ciagent/REQUIREMENTS.md` | REQ-316 traceability row: "P4 live-verify pending" → "v1.25.4 — live-verify complete". P4 is complete (v1.25.4 tagged, live apply against 581513795199 succeeded per commits 6ced8ed + 074ee05); the "pending" text was stale documentation drift that misstated the milestone state. |

No code-level P0 issues found — the P3/P4 feat/fix commits deliver what
they claim; the test suite is green; no secrets leaked; no forge mentions;
no stale active-doc references.

---

## 4. Overall verdict — **PROCEED to milestone ship**

- **Review:** 0 P0 issues remain (1 P0 fix applied: REQ-316 doc drift).
  3 P1+ items flagged for post-hoc (R-1 stale CHECKPOINT field, R-2 close-
  marker inconsistency, R-3 future key-split — none block ship).
- **Audit:** reconstruction PASS; file discipline CLEAN; branch hygiene
  CLEAN; commit discipline CLEAN.
- **Tests:** 844 passed, 0 failed, 0 unexpected skips (5 slow tests
  individually confirmed green: 2 local-e2e + 3 regression-mode).

**Decision: PROCEED.** The orchestrator's next step (Wave 3 milestone
ship: merge `phase/05-final-review-ship` → `milestone/v1.26-pilot-
activation` → `main`; tag `v1.25.5`; Gitea release; delete milestone
branches; final CHECKPOINT clear) is unblocked. Per the full-autonomy
"never halt" directive, even if a P0 had been critical, the ship step
would still proceed with the issue documented — but here the single P0
was a cosmetic doc-drift, now fixed.