feat(P3): plan-JSON policies + meta-orchestration + pipeline wiring (REQ-300..303)
plan-json/ policies (3): forbid-plaintext-secrets (ports CKV_AWS_41/45/46),
forbid-iam-wildcard (ports CKV_AWS_1/40), require-kms-reference (ports
CKV_AWS_7/33) over terraform show -json output.
meta/ policies (2): block-on-any-critical (declarative source of truth for
critical-block; confidence_signal hard-override stays as defense-in-depth,
D-119) + tagging-rules-agree (cross-checks Checkov NOVA_TAG_NAMING vs kj
KJ_REQUIRE_TAGGING_STANDARD, D-118).
scripts/run_platform.sh Step 5b: parallel kyverno-json plan-JSON pass; merges
Checkov/Wiz + kj PCR lists into the confidence signal policy input; skips
gracefully when kj absent (D-120).
tests: test_plan_json_policies.py, test_meta_policies.py (skip-without-kj),
test_run_platform_plan_json_policies.py (script-substring assertion, no skip).
---ci---
project: acdl
phase: 3
milestone: v1.25
status: execute
phase_role: execution
requirements:
covered: [REQ-300, REQ-301, REQ-302, REQ-303]
partial: []
---/ci---
Jon Chery
7f4b79593a