Files

T

Jon Chery 51c3edf458 feat(P3): Nova rebrand — SSM path + tag keys (REQ-161/162)

SSM path /acdl/{env}/{contractId}/{output} → /nova/... across
core/output_publisher + contract resolver + consumer docs. New
scripts/migrate_ssm_paths.py (copy/verify/delete, dry-run default).
AWS tag keys acdl:owner|environment|contract|cost-center|ref → nova:*
across terraform tagging + ABAC session policies (iam:ResourceTag/acdl:*
→ iam:ResourceTag/nova:*). nova_tagging.py hard mode (D-109 warn→hard).
tagging-standard.json tag-key values → nova:*. New
scripts/untag_acdl_keys.py (remove old acdl:* tags, dry-run default).
Test fixtures updated; pytest + run_ci.sh PASS.

---ci---
project: acdl
phase: 3
milestone: v1.15
status: execute
---/ci---

2026-07-30 01:38:30 +00:00

__init__.py

feat(P23): tagging standard + Wiz adapter + Kyverno adapter

2026-07-22 20:00:46 +00:00

nova_tagging.py

feat(P3): Nova rebrand — SSM path + tag keys (REQ-161/162)

2026-07-30 01:38:30 +00:00

README.md

feat(P2): Nova rebrand — code/env-vars/consumer-path (REQ-158/159/160)

2026-07-30 01:25:24 +00:00

README.md

Nova Custom Checkov Rules

This directory holds Nova-authored Checkov custom rules, written in the Checkov Python custom-rule framework.

Files

nova_tagging.py — NOVA_TAG_NAMING (D-054, D-109 warn mode in P2): ensures every taggable AWS resource carries the four required Nova tags (nova:owner, nova:contract, nova:environment, nova:cost-center). This rule replaces the synthetic SKIPPED NOVA_TAG_NAMING record that the Checkov adapter previously emitted (D-043 closure). Renamed from acdl_tagging.py / ACDL_TAG_NAMING in P2 (REQ-158). The canonical tag set is declared in schemas/tagging-standard.json.

P2 warn mode (D-109): existing resources still carry acdl:* tag-key values (left for P3). When a resource has only acdl:*-style tags and no nova:* tags, the rule logs a WARNING instead of failing, so the regression gate stays green during the parallel-tag transition window. P3 flips to hard-fail once nova:* tags are emitted in parallel and the ABAC policy is swapped.

How Checkov loads them

Checkov custom rules are discovered via the --external-checks-dir flag. scripts/run_platform.sh invokes Checkov with:

checkov -f terraform/spike/main.tf --framework terraform -o json --soft-fail \
        --external-checks-dir adapters/terraform/policy/custom_rules/

Checkov imports each *.py file in the directory and instantiates the module-level check object (see the check = NovaTaggingStandard() line at the bottom of nova_tagging.py).

Severity / result mapping

The Checkov adapter (adapters/terraform/policy/checkov_adapter.py) maps NOVA_TAG_NAMING to (tagging-standard, medium) in RULE_MAP. The custom rule therefore produces real PASS/FAIL PolicyCheckResult records, feeding the confidence signal instead of the old SKIPPED placeholder.