acdl/.ciagent/REVIEW-AUDIT-P05.md

P05 Final Review + Audit — v1.26 Live Pilot Estate Activation

Phase: 5 (final review + audit + ship) — review + audit only; the milestone ship (merge to main / tag v1.25.5 / branch deletion) is the orchestrator's next step, deliberately out of scope here. Branch: phase/05-final-review-ship Milestone: milestone/v1.26-pilot-activation Tags so far: v1.25.0 (P0) → v1.25.1 (P1) → v1.25.2 (P2) → v1.25.3 (P3) → v1.25.4 (P4). P5 ships v1.25.5 (= the v1.26 release). Date: 2026-08-19

---

1. Review (ciagent-review equivalent)

Multi-persona review across P1..P4 (lead-developer coordination; correctness / testing / security / maintainability axes). The spot-checks below confirm the P3/P4 commits deliver what their messages claim.

Correctness spot-checks (all PASS)

• kyverno-json substrate fix (59d837f): the engine _translate parses the real kj v0.0.3 bare-list output (not the v1.25-assumed {"results":[...]} dict); _materialize_yaml_policy_dir mirrors .json policies to .yaml twins (kj v0.0.3 ignores .json); the validate wrapper was removed from all 16 policies + the check syntax fixed (expression: expected_value). All 36 kj-dependent tests pass against real kj (0 skips). The install script fixed (go install .../kyverno-json@latest + symlink, not the broken cmd/kj@latest).
• outcome backfill (51b886f, REQ-317): core/metrics/outcome_backfill.py updates fact_decision.outcome pending → succeeded/failed; idempotent + terminal (no overwrite of a non-pending outcome); wired into the collector. The P4 run evidence (6ced8ed) confirms nova.outcome.backfilled (pending->succeeded).
• Gitea adapter (P3 W0): the consumer deploy.yml has no cross-repo uses: — inline actions/checkout@v4 of acdl/acdl @ ref: v1.25 into platform/ then bash platform/scripts/run_platform.sh. SPEC §10 Q1 resolved by evidence.
• env-JSON state_backend (3300ed2, REQ-319): the adapter reads env.state_backend.bucket when present (fallback to the computed nova-tfstate-{account_id}-{region} for backwards compat). dev.json bound to 581513795199 + nova-tfstate-581513795199-us-east-1; qa/prod/dr stay placeholder (account 000000000000 — the pilot-readiness policy blocks apply, D-208).
• pilot policies (e22661a, REQ-315/320): no-placeholder-account.json passes on dev (581513795199), fails on placeholder; all-matches-committed.json asserts all_committed == true. Both run against real kj (not skipped).

Testing

• 844 tests collected; 844 pass (839 fast + 5 slow individually re-run: 2 test_run_local_e2e_* + 3 test_verify_regression_mode::*). 0 failures, 0 skips that shouldn't skip.
• New feature coverage confirmed: REQ-317 backfill test (test_outcome_backfill.py), REQ-318 escalation_reason test (test_confidence_escalation_reason.py), REQ-315/320 policy tests (test_settlement_finality_policy.py, test_pilot_readiness_policy.py — both real-kj), REQ-316 CAP-025 test (test_regression_pilot.py), Gitea adapter tests (test_deploy_workflow_invocation.py + test_deploy_gitea_invocation.py — assert no cross-repo uses:, ref: v1.25, secrets: inherit), rotation workflow test (test_rotate_key_workflow.py), CAP-025 test (test_deploy_workflow_env_input.py).
• The v1.25 pytest.skip("kj not installed") skips are gone — _require_kj no longer skips (kj v0.0.3 installed). All kj-dependent tests exercise the real engine.

Security

• No NOVA_AWS_* secrets in committed files. .env.secrets is gitignored and NOT tracked (git ls-files confirms). All NOVA_AWS_* references in committed workflow files are ${{ secrets.* }} placeholder references — the correct pattern. The W6 fix (b237b3e) removed raw NOVA_AWS_* from the shell env in run_platform.sh's local fallback.
• No forge mentions in synced files. test_no_forge_mentions PASS (the REQ-230 guard). The W6/W7 fix (03edd82) renamed NOVA_GITEA_TOKEN → NOVA_FORGE_TOKEN (forge-agnostic) after the guard tripped.

Maintainability

• No stale TYPE_MAP refs in active docs. The P4 W2 fix (a0799f1) fixed the stale TYPE_MAP/INPUT_MAP references in adapters/README.md (IDEATE I8). Remaining TYPE_MAP mentions are in .ciagent/archive/ (historical, correct) + .ciagent/{CLARIFY,IDEATE,RESEARCH}.md (decision records, correct context).
• No new TODOs/FIXMEs in P3/P4. grep over core/ for TODO|FIXME|XXX|HACK returns 0 matches.
• The P3 W0.5 fix (3735330) resolved pre-existing P2 drift (dynamodb simple.yaml → simple.yml, sync_workflows re-sync, CAP-024 deck path → nova-autonomous-cloud-delivery-marp.md).

Review verdict

0 P0 issues remain after the one P0 fix applied this phase (see §3). P1+ issues for post-hoc review (none blocking ship):

#	Severity	Issue	Disposition
R-1	P2 (cosmetic)	CHECKPOINT.json phase_branch field is stale (phase/03-pilot-metrics-and-policies) — should be phase/04-pilot-run-and-docs or cleared.	Post-hoc. The orchestrator's ship step overwrites CHECKPOINT entirely (stage: complete, phase: 5, phase_role: final), so this field is transient. Not fixed here to avoid touching CHECKPOINT outside the ship step.
R-2	P3 (historical)	The v1.26 consumer-repo merge commit (78da051) + the P0 merge (d391cdf) use ---/ci--- close markers; the v1.26 platform-repo commits (P3/P4) use ---ci--- only. Minor format inconsistency from the multi-project boundary.	Post-hoc. Cosmetic; both markers are recognized by the audit tooling.
R-3	P3 (future-hardening)	Single NOVA_AWS_* root-equivalent key (D-207). Documented in PLAN.md §Future Hardening — a future milestone should split into NOVA_BOOTSTRAP_AWS_* + least-privilege NOVA_AWS_* runner key.	Post-hoc. Out of v1.26 scope by design (D-207, G-Q9).

---

2. Audit (ciagent-audit equivalent)

2.1 Reconstruction test — PASS

The git log ---ci--- blocks are consistent with the .ciagent/ file states. The last 20 commits on milestone/v1.26-pilot-activation show the expected phase progression:

• P0 (d391cdf, status: complete) → P1 ship (2ee541f) → P2 reconcile (d022ddc) → P2 complete (6a3d47e) → P3 W0.5 → W2 → W3 → W4 → W5 → W6 → W6/W7 → verify (5d1a985) → docs (732998b) → merge+complete (268f695, 6b60c0c) → P4 W1 (cec34ab, 6ced8ed) → W2 (a0799f1) → verify (074ee05) → merge+complete (6eb7af2, f266dcf).

Each phase follows the execute → verify → complete lifecycle. The CHECKPOINT current_phase (phase 4, status complete, tag v1.25.4) matches the latest commit (f266dcf docs(ship): P4 complete → v1.25.4). The previous_phase (phase 3, tag v1.25.3, complete) is consistent.

All 4 merge commits on the milestone branch (d391cdf, 78da051, 268f695, 6eb7af2) carry ---ci--- blocks with project/phase/milestone/status.

2.2 .ciagent/ file discipline — CLEAN (after the one P0 fix)

• CHECKPOINT.json: current_phase (4/complete/v1.25.4) + previous_phase (3/complete/v1.25.3) consistent with the git log. waves map + pre_run map + notes accurately describe the P4 live apply + outcome backfill. One stale field: phase_branch (R-1, post-hoc).
• REQUIREMENTS.md: v1.26 traceability table now shows all 13 REQs (310..322) complete. One P0 fix applied: REQ-316 row corrected from "P4 live-verify pending" → "v1.25.4 — live-verify complete" (P4 is complete; v1.25.4 tagged; the live apply against 581513795199 succeeded per commit 6ced8ed + verify 074ee05). The v1.25 table (REQ-291..309) is all-complete + consistent with ROADMAP.
• ROADMAP.md: v1.26 phases P0..P4 marked complete; P5 marked "planned" (correct — this phase is in progress, ship is next). v1.25 marked complete. The phase descriptions match the commits.
• PLAN.md: the active phase plan covers P0..P5 with wave ordering, persona assignment, + the REQ-322→P2 W0 revision. Consistent with what shipped.
• ARCHITECTURE.md: §12.8 (Pilot Estate) + §12.9 (rotation) present (P4 W2 docs).
• PROJECT.md: v1.26 active milestone noted; multi-project mode (nova-blockchain-exchange) reflected.

2.3 Branch hygiene — CLEAN

git branch -a (local):

• main
• milestone/v1.26-pilot-activation
• phase/05-final-review-ship (current)

P1..P4 phase branches are deleted (only milestone + P5 remain, as required). Remote: origin/main + origin/milestone/v1.26-pilot-activation mirror the local state.

Tags: v1.25 (floating) + v1.25.0 + v1.25.1 + v1.25.2 + v1.25.3 + v1.25.4 all exist. v1.25.5 is not yet present (correct — it's the orchestrator's ship step).

2.4 Commit discipline — CLEAN

Every v1.26-scope commit on the milestone branch carries a ---ci--- block with project + phase + milestone + status (and most carry wave). The 4 merge commits (d391cdf, 78da051, 268f695, 6eb7af2) all carry ---ci--- blocks. (Historical commits from v1.0-v1.18 predate the block convention — out of scope for this audit.)

The consumer-repo merge (78da051) correctly carries project: nova-blockchain-exchange (multi-project boundary respected); the platform commits carry project: acdl.

Audit verdict

Check	Result	Detail
Reconstruction test	PASS	git-log ---ci--- blocks ↔ .ciagent/ consistent; phase 4/complete/v1.25.4 matches HEAD.
File discipline	CLEAN	All 6 .ciagent/ files consistent after the REQ-316 P0 fix. One stale phase_branch field (R-1, post-hoc).
Branch hygiene	CLEAN	Only main + milestone + P5; P1-P4 deleted; v1.25.0..v1.25.4 tagged.
Commit discipline	CLEAN	All v1.26 commits carry ---ci--- blocks; merge commits included.

---

3. P0 fixes applied this phase

#	File	Fix
P0-1	.ciagent/REQUIREMENTS.md	REQ-316 traceability row: "P4 live-verify pending" → "v1.25.4 — live-verify complete". P4 is complete (v1.25.4 tagged, live apply against 581513795199 succeeded per commits 6ced8ed + 074ee05); the "pending" text was stale documentation drift that misstated the milestone state.

No code-level P0 issues found — the P3/P4 feat/fix commits deliver what they claim; the test suite is green; no secrets leaked; no forge mentions; no stale active-doc references.

---

4. Overall verdict — PROCEED to milestone ship

• Review: 0 P0 issues remain (1 P0 fix applied: REQ-316 doc drift). 3 P1+ items flagged for post-hoc (R-1 stale CHECKPOINT field, R-2 close- marker inconsistency, R-3 future key-split — none block ship).
• Audit: reconstruction PASS; file discipline CLEAN; branch hygiene CLEAN; commit discipline CLEAN.
• Tests: 844 passed, 0 failed, 0 unexpected skips (5 slow tests individually confirmed green: 2 local-e2e + 3 regression-mode).

Decision: PROCEED. The orchestrator's next step (Wave 3 milestone ship: merge phase/05-final-review-ship → milestone/v1.26-pilot- activation → main; tag v1.25.5; Gitea release; delete milestone branches; final CHECKPOINT clear) is unblocked. Per the full-autonomy "never halt" directive, even if a P0 had been critical, the ship step would still proceed with the issue documented — but here the single P0 was a cosmetic doc-drift, now fixed.