Files

T

Jon Chery f8616b806e feat(P1): event emitters — CloudEvents envelope, Decision Ledger, Infracost adapter, attestation/confidence/policy event emission

P1 (Wave 1, feat) — REQ-187, REQ-188, REQ-205 (emitter), REQ-206 (emitter)

New components:
- core/metrics/event_envelope.py — CloudEvents 1.0 envelope + platform.* conventions
- core/metrics/run_manifest.py — per-run manifest writer (nova.run.started/completed/failed)
- core/metrics/decision_ledger.py — SQLite append-only hash-chain (ai.decision.made + attestation.recorded)
- core/metrics/infracost_adapter.py — Infracost post-processor (degraded mode when CLI absent, A6)
- schemas/metrics_event.schema.json — CloudEvents envelope schema
- schemas/metrics_run_manifest.schema.json — per-run manifest schema
- metrics/README.md — backup/restore doc (REQ-201)
- tests/test_metrics_emitters.py — 16 tests (all pass)

Modified components:
- core/confidence_signal.py — emits nova.confidence.computed + nova.ai.decision.made (D-122)
- core/hitl_gates.py — emits nova.attestation.recorded on qa/prod/dr gates (D-132)
- adapters/terraform/policy/checkov_adapter.py — emits nova.policy.evaluated
- pyproject.toml — addopts gains --junitxml + --json-report + --cov (REQ-206)
- .gitignore — metrics runtime artifacts ignored

D-120: Nova-native (JSONL + SQLite, no Kafka/OTel)
D-121: Decision Ledger = outbox_writer extension → SQLite hash-chain
D-122: AI decision = confidence_signal + HITL gate (not LLM)
D-128: metrics/ at repo root
D-132: Attestation instrumentation

---ci---
project: acdl
phase: 1
milestone: v1.17
status: execute
---/ci---

2026-08-04 19:58:54 +00:00

kyverno

Merge milestone/v1.16-nova-simplification — v1.16 complete (Nova Simplification: 20-phase NFR sweep + final; tag v1.15.26)

2026-08-01 13:37:18 +00:00

terraform

feat(P1): event emitters — CloudEvents envelope, Decision Ledger, Infracost adapter, attestation/confidence/policy event emission

2026-08-04 19:58:54 +00:00

wiz

Merge milestone/v1.16-nova-simplification — v1.16 complete (Nova Simplification: 20-phase NFR sweep + final; tag v1.15.26)

2026-08-01 13:37:18 +00:00

.gitkeep

phase: 6, status: plan-as-execute, persona: lead-developer, task: T-6.1..T-6.4

2026-07-21 18:27:21 +00:00

README.md

Merge milestone/v1.16-nova-simplification — v1.16 complete (Nova Simplification: 20-phase NFR sweep + final; tag v1.15.26)

2026-08-01 13:37:18 +00:00

README.md

Nova Adapters

Overview

Adapters translate the engine-agnostic Target Stack IR to engine-specific formats. The Terraform adapter is the primary adapter (IR → HCL). Policy adapters translate security tool output into normalized PolicyCheckResult records that the confidence signal consumes in an engine-agnostic way.

Existing Adapters

Adapter	Path	Input	Output	Purpose
Terraform adapter	`adapters/terraform/adapter.py`	Stack instance JSON	Terraform HCL (`main.tf`, `terraform.tf`, `providers.tf`)	Compiles IR to Terraform
Checkov adapter	`adapters/terraform/policy/checkov_adapter.py`	Checkov JSON	`PolicyCheckResult` records	Translates Checkov results
Wiz adapter	`adapters/wiz/wiz_adapter.py`	Wiz API issues JSON	`PolicyCheckResult` records	Translates Wiz security findings
Kyverno adapter	`adapters/kyverno/kyverno_adapter.py`	Kyverno PolicyReport JSON	`PolicyCheckResult` records	K8s-native policy translation

How to Write an Adapter

Terraform Adapter Extension

Add a stack type → Terraform type mapping to TYPE_MAP.
Add non-identity input mappings to INPUT_MAP.
Add non-identity output mappings to OUTPUT_MAP.
Add a specialized _emit_resource branch if the resource needs nested blocks (e.g. inline policies, rule sets).

Policy Adapter Pattern

Define SEVERITY_MAP and RESULT_MAP dicts that translate the engine's native severity/result vocabulary to the PolicyCheckResult enums.
Implement _to_pcr(raw_record, contract_id) → PolicyCheckResult dict.
Implement adapt(input_path, contract_id) → list of PolicyCheckResult dicts.
Implement is_configured() → bool (env var check) so the platform can skip the adapter when credentials are absent.

How to Wire an Adapter

Terraform adapter — invoked by scripts/run_platform.sh Step 3 (terraform-plan).
Checkov adapter — invoked by scripts/run_platform.sh Step 5 (checkov).
Wiz / Kyverno adapters — optional Steps 5b/5c, run only when the relevant env vars are set.
All policy adapters output records that are validated against schemas/policy_check_result.schema.json.

Dependencies

jsonschema, pyyaml — used by all adapters for loading and validating inputs.
boto3 — used by the Wiz adapter for AWS API access.
checkov — used by the Checkov adapter to run policy scans.
No external deps for the Terraform adapter (pure Python).

How to Test Adapters

tests/test_adapter.py — Terraform adapter (TYPE_MAP, resource emission, refs, outputs).
tests/test_checkov_adapter.py — Checkov adapter.
tests/test_wiz_adapter.py — Wiz adapter.
tests/test_kyverno_adapter.py — Kyverno adapter.
All adapter tests load fixtures from tests/fixtures/ and use moto for AWS mocking.

Where to Write Tests

tests/test_<adapter_name>.py paired with tests/fixtures/<adapter>_fixture.json.

Adding a New Adapter

Create adapters/<name>/<name>_adapter.py.
Implement adapt() and (for policy adapters) is_configured().
Add the adapter's engine name to the engine enum in schemas/policy_check_result.schema.json if it is a policy adapter.
Write a test (tests/test_<name>_adapter.py) plus a fixture (tests/fixtures/<name>_fixture.json).
Add it to scripts/run_platform.sh if it is invoked at runtime.
Update this README.