Jon Chery
3300ed2557
The adapter reads env.state_backend.bucket from the env JSON when present
(fallback to the computed nova-tfstate-{account_id}-{region} pattern for
backwards compat). dev.json bound to the real account 581513795199 +
bucket nova-tfstate-581513795199-us-east-1 (D-203). qa/prod/dr stay
placeholder (account_id 000000000000 — the pilot-readiness policy blocks
apply on placeholder, D-208). dynamodb added to the adapter test
EXPECTED_L1_KEYS + a resolution/emission test.
---ci---
project: acdl
phase: 3
milestone: v1.26
status: execute
wave: W3
---
Platform-managed environments
This directory holds environment definitions used by the onboarding scaffold. Each file is a named environment the platform owns (an AWS account or scoped partition, a network, a state backend, and an IAM role surfaced to the consumer via ABAC).
A consumer never provides an AWS account, VPC, subnet, S3 state bucket, or runner key — the platform manages all of that here.
Files
dev.json— the default dev environment (autonomous, confidence >= 0.50).qa.json— QA environment (attested, QA HITL gate, confidence >= 0.75). Placeholder binding (replace account_id with the real QA account).prod.json— Production environment (attested, SRE HITL gate, confidence >= 0.90). Placeholder binding.dr.json— DR environment (attested, SRE HITL gate, confidence >= 0.95). Placeholder binding.
All files validate against schemas/environment.schema.json. The qa/prod/dr
placeholders use account_id: 000000000000 with a stderr warning at load
time (prompts real binding before deploying).
How it is used
core/environment_check.py reads a contract's environment field and
looks up the matching <name>.json in this directory. If no matching file
exists, the check prints a friendly onboarding prompt and exits non-zero,
halting the pipeline before any work is done.
Adding an environment
A new environment is a platform-team action: provision the AWS account /
network / state backend / IAM role, then add a <name>.json here and bind
it to the consumer repo.
P19 (REQ-183): the request step is now self-service. A consumer
submits an onboarding request (POST to the Nova Lambda onboard_consumer
action, or python3 core/onboarding.py --request '{...}') and the
platform generates a <name>.json binding file from the request + opens
a PR. The actual AWS account/network/state provisioning + cross-account
role grant remains a platform-team action (a future feature milestone
will automate the provisioning; the cross-account role Terraform is
offline-proven in P20/REQ-184).