Files

T

Jon Chery e15eea067b docs(milestone): complete v1.15 — Nova Rebrand (tag v1.15.4)

P5 final-review-ship complete: dual-read fallback removed (REQ-164) —
core/env.py NOVA-only, .env.secrets load paths NOVA-only (G-106 retired),
nova_tagging.py hard-fails any acdl:* tag, legacy ACDL_* Gitea secrets
deleted, ACDL_LIFECYCLE_MODE/ACDL_LOCAL_TIER/ACDL_HITL_* exports removed
from scripts, SNS subject → Nova SoD halt (P1-2), bootstrap scripts
NOVA-only. Review: 2 P0 auto-fixed (duplicate delenv), P1-1/P1-2 resolved,
doc-drift fixed. Audit: tags v1.15.0-4 exist; traceability REQ-155..164
all complete; ARCHITECTURE naming table matches codebase. 615 pytest PASS;
run_ci.sh 3-stage PASS. NOVA_MIGRATION.md marked COMPLETE.

---ci---
project: acdl
phase: 5
milestone: v1.15
status: complete
phase_role: final
requirements:
  covered: [REQ-155, REQ-156, REQ-157, REQ-158, REQ-159, REQ-160, REQ-161, REQ-162, REQ-163, REQ-164]
  partial: []
---/ci---

2026-07-30 02:23:55 +00:00

__init__.py

feat(P23): tagging standard + Wiz adapter + Kyverno adapter

2026-07-22 20:00:46 +00:00

nova_tagging.py

docs(milestone): complete v1.15 — Nova Rebrand (tag v1.15.4)

2026-07-30 02:23:55 +00:00

README.md

feat(P2): Nova rebrand — code/env-vars/consumer-path (REQ-158/159/160)

2026-07-30 01:25:24 +00:00

README.md

Nova Custom Checkov Rules

This directory holds Nova-authored Checkov custom rules, written in the Checkov Python custom-rule framework.

Files

nova_tagging.py — NOVA_TAG_NAMING (D-054, D-109 warn mode in P2): ensures every taggable AWS resource carries the four required Nova tags (nova:owner, nova:contract, nova:environment, nova:cost-center). This rule replaces the synthetic SKIPPED NOVA_TAG_NAMING record that the Checkov adapter previously emitted (D-043 closure). Renamed from acdl_tagging.py / ACDL_TAG_NAMING in P2 (REQ-158). The canonical tag set is declared in schemas/tagging-standard.json.

P2 warn mode (D-109): existing resources still carry acdl:* tag-key values (left for P3). When a resource has only acdl:*-style tags and no nova:* tags, the rule logs a WARNING instead of failing, so the regression gate stays green during the parallel-tag transition window. P3 flips to hard-fail once nova:* tags are emitted in parallel and the ABAC policy is swapped.

How Checkov loads them

Checkov custom rules are discovered via the --external-checks-dir flag. scripts/run_platform.sh invokes Checkov with:

checkov -f terraform/spike/main.tf --framework terraform -o json --soft-fail \
        --external-checks-dir adapters/terraform/policy/custom_rules/

Checkov imports each *.py file in the directory and instantiates the module-level check object (see the check = NovaTaggingStandard() line at the bottom of nova_tagging.py).

Severity / result mapping

The Checkov adapter (adapters/terraform/policy/checkov_adapter.py) maps NOVA_TAG_NAMING to (tagging-standard, medium) in RULE_MAP. The custom rule therefore produces real PASS/FAIL PolicyCheckResult records, feeding the confidence signal instead of the old SKIPPED placeholder.