Files

T

Jon Chery e74a8c2f5d feat(P42): stub implementation — SoD, HITL gates, attestation matrix, Wiz, Kyverno

---ci---
project: acdl
phase: 42
milestone: v1.9
status: execute
---/ci---

Phase 42 — stub-implementation (REQ-107..111, D-084):

route_halt_artifact (REQ-107):
- core/separation_of_duties.py: real SNS publish (ACDL_SOD_HALT_TOPIC_ARN)
  + outbox fallback (SEPARATION_OF_DUTIES_VIOLATION event via
  outbox_writer) + stderr emission. No silent print-only stub.
- terraform/platform/main.tf: aws_sns_topic.acdl-sod-halt + output.

HITL attestation gates (REQ-108):
- core/hitl_gates.py: attest(contract_id, env, approver, evidence,
  outbox_client) records approver_qa/approver_prod/approver_dr to
  outbox, runs SoD check on prod, invokes attestation matrix, returns
  (ok, reason). Dev skips (autonomous). approver_from_env() reads
  GITHUB_ACTOR/GITEA_ACTOR.
- scripts/run_platform.sh: Step 7b HITL gate before apply for qa/prod/dr.

8-concern attestation matrix (REQ-109, D-084):
- core/attestation_matrix.py: check(env, evidence) runs the 8 concerns
  from hitl_matrix_design.md §10.4. Offline-testable (contract_nfrs,
  schema_validity, policy_pass) run for real. Operator-supplied accept
  signed artifacts validated for freshness (FRESHNESS_DAYS table) +
  schema. Signature skip when ACDL_ATTESTATION_SIGNING_KEY_ID unset
  (D-089). Fail loud if missing/expired for prod/dr.

Wiz real client (REQ-110):
- adapters/wiz/wiz_adapter.py: WizClient (GraphQL API, Bearer auth,
  pagination via pageInfo.hasNextPage + endCursor). fetch_and_adapt
  translates issues → PolicyCheckResult; graceful degrade when
  WIZ_API_TOKEN/WIZ_API_URL unset.

Kyverno fleshed out (REQ-111):
- adapters/kyverno/kyverno_adapter.py: full PolicyReport →
  PolicyCheckResult mapping (pass/fail/skip/warn + severity + skip-with-
  reason + resource ref construction from kind/name/namespace).
  adapt_inactive() emits KYVERNO_INACTIVE_TF_STACK guard. --kube-version
  stub parsed for future GitOps.

Tests: +47 (test_route_halt_artifact.py, test_hitl_gates.py,
test_attestation_matrix.py, test_wiz_adapter_real_client.py, expanded
test_kyverno_adapter.py). Existing wiz_adapter tests updated for the
real client's control.name ruleId. 493 passed; run_ci.sh green;
run_platform.sh --check-only green.

2026-07-23 04:40:44 +00:00

__init__.py

feat(P23): tagging standard + Wiz adapter + Kyverno adapter

2026-07-22 20:00:46 +00:00

README.md

feat(P23): tagging standard + Wiz adapter + Kyverno adapter

2026-07-22 20:00:46 +00:00

wiz_adapter.py

feat(P42): stub implementation — SoD, HITL gates, attestation matrix, Wiz, Kyverno

2026-07-23 04:40:44 +00:00

README.md

Wiz Adapter

The Wiz adapter translates Wiz API issue records to the normalized ACDL PolicyCheckResult schema (engine: "wiz"), mirroring the Checkov adapter pattern.

What Wiz is

Wiz is a cloud security SaaS platform that continuously scans CSPM / CWPP / KSPM findings across AWS, Azure, GCP and Kubernetes. It exposes a GraphQL/REST API for fetching issue records.

Adapter behaviour

wiz_adapter.py <wiz_issues.json> <contract-id> reads a JSON file of Wiz issue records (the shape returned by the Wiz issues GraphQL query / list endpoint) and emits a list of PolicyCheckResult dicts:

Wiz field	PolicyCheckResult field
`id` / `control.id`	`ruleId`
`severity`	`severity` (mapped `CRITICAL/HIGH/MEDIUM/LOW/INFO`)
`status`	`result` (`OPEN→fail`, `RESOLVED→pass`, `IN_PROGRESS/DISMISSED→skipped`)
`title` / `control.name`	`message`
`entity.id`	`resourceRef` + `evidence.resource`
`entity.{name,cloudPlatform,subscriptionId}`	`evidence.*`

The adapter is read-only against a local JSON fixture; the pipeline is responsible for fetching from Wiz (when configured) and writing the file.

Offline / degraded behaviour (D-052)

When Wiz is not configured the pipeline passes an empty issues payload (or simply does not invoke the adapter). The adapter degrades gracefully:

an empty issues list → the adapter emits a single WIZ_NOT_CONFIGURED PolicyCheckResult with result: "skipped" so the confidence policy input stays non-empty (and does not falsely inflate the score).

is_configured() returns True only when the WIZ_API_TOKEN environment variable is set; the pipeline uses it to decide whether to fetch and invoke the adapter at all.

Configuration

Env var	Required	Purpose
`WIZ_API_TOKEN`	yes	Bearer token for the Wiz REST API. When unset, `is_configured()` returns `False`.
`WIZ_ENDPOINT`	no	Wiz API endpoint (defaults to `https://api.wiz.io` when implemented).

Schema path

The output records validate against schemas/policy_check_result.schema.json (engine: "wiz" was added to the enum in Phase 23).