continuous-intelligence/acdl
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity
Files
da0de6068ab30218c1485e025904b3c2a36beb9d
acdl/.ciagent/PLAN.md
T
Jon Chery d14b55b774 docs(P00): incorporate grill binding mitigations G-104/G-106/G-108 
GRILL (ci-griller): 9 axes, 8 findings G-103..G-110, verdict
proceed-with-conditions (conf 0.82). 3 binding mitigations incorporated:
- G-104 (scope/technical, conf 0.90): re-tag Major milestone on its OWN
  minor line (v1.15.x), not the v1.14.x patch line (NFR convention).
  Precedent: v1.10.2→v1.11.0, v1.9.x→v1.10.0. Updated PLAN/ROADMAP/
  PROJECT/REQUIREMENTS/ARCHITECTURE tag refs: v1.15.0(P0)→v1.15.4(P5).
- G-106 (risk/technical, conf 0.88): .env.secrets direct-read paths
  (run_platform.sh:288-289 + regression_verify.py:309-312) bypass the
  core/env.py helper — P2 MUST dual-read these (NOVA_* first, ACDL_*
  fallback) or AWS creds vanish mid-rename. Bound in PLAN.md P2 task 2.
- G-108 (security, conf 0.80): CI workflow secrets: refs (deploy.yml +
  modules-lifecycle.yml, .gitea + .github) reference secrets.ACDL_* —
  P2 MUST update to secrets.NOVA_* in lockstep with Gitea secret
  creation. Bound in PLAN.md P2 task 3 (hard gate). 5 accepted-as-is
  findings (G-103/105/107/109/110), 0 open escalations.

---ci---
project: acdl
phase: 0
milestone: v1.15
status: grill
---/ci---
2026-07-30 00:40:35 +00:00

19 KiB
Raw Blame History

phase, name, milestone, requirements, wave, depends_on
phase name milestone requirements wave depends_on
P0 pre-execution v1.15
REQ-155
REQ-156
REQ-157
REQ-158
REQ-159
REQ-160
REQ-161
REQ-162
REQ-163
REQ-164
0

v1.15 — Nova Rebrand Plan (4 execution phases + 1 final)

Milestone: v1.15 (Nova Rebrand — Major/breaking) Type: Major (breaking — consumer path, env vars, SSM path, tag keys, AWS resource names all change). Per the branch-strategy precedent (v1.10.2 → v1.11.0, v1.9.x → v1.10.0 — breaking/feature milestones tag on their OWN minor line, not the previous minor's patch line), v1.15 tags run on the v1.15.x minor line: v1.15.0 (P0) → v1.15.1..v1.15.4 (P1–P4) → v1.15.4 (P5 = milestone release). (G-104 binding: the v1.14.x patch line is the NFR convention; a Major milestone ships on its own minor.) Branch: milestone/v1.15-nova → phase/NN-<slug>

Wave ordering (D-098 v1.15 analogue)

  • Wave 1 (P1): docs/decks/prose — no runtime impact; establishes the Nova vocabulary + ships the consumer migration guide. REQ-155, REQ-156, REQ-157. Independent (first phase).
  • Wave 2 (P2): code + env vars (dual-read) + consumer path — deployments don't break during the transition window. REQ-158, REQ-159, REQ-160. Depends on P1 (docs establish the guide P2 changes are announced in).
  • Wave 3 (P3): SSM path + tag keys — SSM copy/read/delete; tag keys parallel-tag → policy swap → remove old. REQ-161, REQ-162. Depends on P2 (env var dual-read + nova_tagging.py warn mode must land first).
  • Wave 4 (P4): AWS resource names — staged terraform migration. REQ-163. Depends on P3 (tag keys nova:* enforced hard before resource recreation; nova_tagging.py hard mode).
  • Wave 5 (P5): final-review-ship — remove dual-read fallback, review, audit, milestone ship. REQ-164. Depends on P1–P4.

Execution approach

Each phase: EXECUTE (persona-assigned task groups) → VERIFY (4 layers + regression gate stays 16/16) → SHIP (patch tag on v1.14.x line). Phase boundary checkpoint resets context. The execute workflow reads this PLAN.md + ROADMAP.md §v1.15 + PERSONAS.md §v1.15 for task decomposition.

Binding constraint (capability gate): the regression gate (CAP-001..CAP-016, scripts/run_regression.sh) MUST stay 16/16 Verified throughout the rebrand. Each phase updates test fixtures that reference ACDL/acdl so the gate stays green. No capability is added, removed, or reclassified — the rebrand is nomenclature + identifiers, not behavior.

Wave 1 — Docs / Decks / Prose (P1)

P1 — docs-decks-prose (REQ-155, REQ-156, REQ-157)

Persona: lead-developer Territory: README.md, docs/**, .ciagent/*.md, deck .md/-marp.md/-talking-points.md/.html, docs/presentations/assets/mmd/*.mmd (+ PNG re-export), pyproject.toml, schemas/*.schema.json $id (D-110), docs/NOVA_MIGRATION.md (NEW), .github/workflows/release.yml title, .gitea/workflows/release.yml (if present), modules/STANDARDS.md, contracts/** prose Tasks:

  1. Prose rebrand (REQ-155). Find/replace across all docs + .ciagent markdown: ACDL → Nova, Agentic Cloud Delivery Platform → Nova (full phrase). Preserve historical narrative (e.g. "formerly ACDL" in any changelog-style section is acceptable; otherwise full swap). Update pyproject.toml name → nova, description → Nova. Update release.yml release-title prefix ACDL → Nova . Update illustrative URLs in docs: github.com/acdl/... → github.com/nova/..., git.cloudinit.dev/continuous-intelligence/acdl* → .../nova* (prose only; config.json release.gitea.repo stays acdl per D-105).
  2. Schema $id rebrand (D-110, REQ-155). Update $id in all schemas/*.schema.json + schemas/tagging-standard.json: https://acdl.cloudinit.dev/schemas/... → https://nova.cloudinit.dev/schemas/.... Update test fixtures that assert the $id value.
  3. Deck + mermaid rebrand (REQ-156). Edit both deck markdown sources (docs/presentations/how-the-platform-works.md, the-developer-experience.md + their -marp.md + -talking-points.md variants): ACDL → Nova in slide content + mermaid cluster labels (["ACDL — infrastructure only"] → ["Nova — infrastructure only"]). Edit the 5 .mmd sources (docs/presentations/assets/mmd/*.mmd): ACDL → Nova. Re-export the PNG diagrams from the edited .mmd sources so the committed PNGs match the new labels (use the deck README's documented process: mmdc CLI or the render script).
  4. Nova tagline insertion (REQ-157). Add the tagline "The New Dawn of DevSecOps — security as a seamless enabler of fast deployments" to: the README header (below the title), both deck title slides (as the subtitle, replacing "Agentic Cloud Delivery Platform"), and docs/vision.md (top of the Vision section). Retain the existing "North Star" / "consumers declare intent" framing — do NOT remove it (D-106).
  5. Consumer migration guide (REQ-155/160). Create docs/NOVA_MIGRATION.md announcing the 5 breaking changes coming in P2–P4: (a) .acdl/contract.yml → .nova/contract.yml (P2); (b) ACDL_* env vars → NOVA_* (P2, dual-read fallback); (c) SSM path /acdl/ → /nova/ (P3); (d) AWS tag keys acdl:* → nova:* (P3); (e) AWS resource names acdl-* → nova-* (P4, maintenance window). Include the dual-read fallback window (P2–P4) + the cutoff (P5 removes fallback).
  6. HTML re-render (REQ-156). Re-render both deck HTML files from the updated -marp.md sources (self-contained, base64 images, S&P theme unchanged per D-107). Commit the re-rendered HTML.
  7. Regress gate. bash scripts/run_regression.sh — expect 16/16 Verified (fixtures referencing ACDL/acdl in paths are updated in P2; P1 only touches prose/decks/schema-$id, so the gate should stay green. If a test asserts an ACDL string in a doc it reads, update the assertion to Nova).

Wave 2 — Code / Env Vars / Consumer Path (P2)

P2 — code-envvars-consumer-path (REQ-158, REQ-159, REQ-160)

Persona: backend-engineer (lead) + lead-developer (docs/runbook) Territory: core/env.py (NEW), core/*.py, scripts/*.py + *.sh, adapters/**, tests/**, .gitea/workflows/** + .github/workflows/**, .env + .env.secrets (key rename), schemas/tagging-standard.json, adapters/terraform/policy/custom_rules/acdl_tagging.py → nova_tagging.py Tasks:

  1. Dual-read env helper (D-108, REQ-159). Create core/env.py with get_env(name, default=None) that reads NOVA_<name> then falls back to ACDL_<name>, returning default if neither. Add unit tests in tests/test_env_helper.py covering: both set (NOVA wins), only NOVA set, only ACDL set (fallback), neither set (default).
  2. Env var rename (REQ-159). Migrate all 21 ACDL_* env var references → NOVA_* across core/*.py, scripts/*.py + *.sh, adapters/**, tests/**, .gitea/workflows/**, .github/workflows/**. Use the core/env.py helper at Python call sites (replace os.environ.get("ACDL_X") → env.get_env("X")); for shell scripts, use ${NOVA_X:-$ACDL_X} dual-read inline. Rename keys in .env + .env.secrets (KEY names only — VALUES/secret material stay). Leave a comment in .env.secrets noting the legacy ACDL_* keys are the dual-read fallback source until P5. G-106 binding: the .env.secrets direct-read paths (scripts/run_platform.sh:288-289 export AWS_ACCESS_KEY_ID="$ACDL_AWS_ACCESS_KEY_ID"
    • core/regression_verify.py:309-312 if k == "ACDL_AWS_ACCESS_KEY_ID") bypass the helper and MUST be updated to dual-read NOVA_* first, ACDL_* fallback (shell: ${NOVA_AWS_ACCESS_KEY_ID:-$ACDL_AWS_ACCESS_KEY_ID}; Python: match k == "NOVA_AWS_ACCESS_KEY_ID" or k == "ACDL_AWS_ACCESS_KEY_ID") — otherwise AWS creds vanish mid-rename and CAP-013/014/015 fail.
  3. Gitea secrets rotation + workflow refs (G-108 binding, REQ-159). Use the Gitea API (scripts/rotate_spike_key.sh pattern or a new scripts/rename_gitea_secrets.py) to create NOVA_* secrets mirroring the ACDL_* values (idempotent + retry-on-failure), then (after P5) delete the old ACDL_* secrets. For P2, just create the NOVA_* aliases; deletion is P5. G-108 binding: when NOVA_* secrets are created, the CI workflow secrets: references (.gitea/workflows/deploy.yml:105,107,108,148, .gitea/workflows/modules-lifecycle.yml:63,64,103,104,111,112,117,118,123,124,161,162,169,170, .github/workflows/* mirrored) MUST be updated from secrets.ACDL_* → secrets.NOVA_* in the SAME phase, with graceful degrade + the acdl-deploy- role name in deploy.yml:105 → nova-deploy- (P4 renames the IAM role). Until both secrets + refs are updated, CI breaks — this is a hard gate, not a silent skip.
  4. Checkov rule rename (D-109 warn mode, REQ-158). Rename adapters/terraform/policy/custom_rules/acdl_tagging.py → nova_tagging.py. Update the Checkov registration in schemas/tagging-standard.json (line 5 + the description) and the adapter config (adapters/terraform/policy/checkov_adapter.py). The rule enforces nova:* tag keys BUT in warn mode for P2 (existing resources still carry acdl:* until P3) — log a warning, don't fail the check. Update ACDL_TAG_NAMING → NOVA_TAG_NAMING.
  5. Consumer path rename (REQ-160). Rename the consumer on-disk contract path .acdl/contract.yml → .nova/contract.yml across: core/contract_resolver.py (any default path), the deploy workflow default: field (.gitea/workflows/deploy.yml + .github/workflows/deploy.yml line 54), schemas/contract.schema.json description, tests/test_pipeline_contract.py:313 assertion, and consumer docs (docs/consumer-guide.md, docs/modules/index.md). Also .acdl/static-assets.*.yml → .nova/... + .acdl/contract.yaml → .nova/contract.yaml.
  6. Test fixture update (binding). Update all test fixtures in tests/** that reference ACDL/acdl (env var names, paths, table names, tag keys) to the new NOVA/nova values — EXCEPT fixtures that assert the dual-read fallback behavior (those keep ACDL_* as the fallback source). pytest must pass.
  7. Regress gate. bash scripts/run_regression.sh — 16/16 Verified.

Wave 3 — SSM Path + Tag Keys (P3)

P3 — ssm-tagkeys (REQ-161, REQ-162)

Persona: data-engineer (lead) + backend-engineer (readers) Territory: core/output_publisher.py, core/contract_resolver.py, scripts/migrate_ssm_paths.py (NEW), terraform/** (tag keys), adapters/terraform/policy/custom_rules/nova_tagging.py (hard mode), ABAC session-policy terraform Tasks:

  1. SSM path migration (REQ-161). Update core/output_publisher.py: the SSM parameter path prefix /acdl/{env}/{contractId}/{output} → /nova/{env}/{contractId}/{output}. Update core/contract_resolver.py SSM reads. Update consumer docs. Create scripts/migrate_ssm_paths.py that: (a) lists /acdl/... parameters, (b) copies each to /nova/... (same value/type), (c) verifies the copy, (d) deletes the old /acdl/... parameters. The script is idempotent + dry-run by default (--apply to execute).
  2. Tag keys: parallel-tag (REQ-162). Update terraform tagging (terraform/platform/main.tf, terraform/microservice/main.tf, terraform/ci-vpc/main.tf, modules/l1/*/terraform/main.tf, modules/l2/*/composition.json tag defaults) to emit both nova:* and acdl:* tag keys during P3 (parallel-tag period). The acdl:cost-center default acdl-default → nova-default for the nova:cost-center key (keep acdl-default on the acdl:cost-center key during the parallel period).
  3. Tag keys: ABAC policy swap (REQ-162). Update the ABAC session policies (the deploy role's inline policy in terraform/platform/main.tf + terraform/bootstrap/**) to match nova:* tags (the StringEquals/Resource tag conditions reference nova:owner/nova:environment/etc.). Keep the acdl:* match as a secondary condition during the parallel period so neither old nor new consumers break.
  4. Checkov rule: hard mode (D-109, REQ-162). Update nova_tagging.py from warn → hard mode: enforce nova:* tag keys (hard fail on missing nova:* or presence of acdl:*-only tags). Update schemas/tagging-standard.json tag keys → nova:*.
  5. Tag keys: remove old (REQ-162). Once the parallel-tag period is verified (terraform validate passes; the ABAC policy matches nova:*), remove the acdl:* tag emissions from terraform. (Live removal of acdl:* tags from existing AWS resources is a documentation/runbook step — the terraform null_resource or a script scripts/untag_acdl_keys.py can do it with live AWS access; without live access, this is documented in the P4 runbook as a runtime step.)
  6. Test fixture + regress gate. Update test fixtures asserting acdl:* tag keys → nova:*. pytest passes; bash scripts/run_regression.sh — 16/16 Verified.

Wave 4 — AWS Resource Name Migration (P4)

P4 — aws-resource-migration (REQ-163)

Persona: data-engineer (lead) + lead-developer (runbook) Territory: terraform/platform/main.tf, terraform/microservice/main.tf, terraform/ci-vpc/main.tf, terraform/bootstrap/**, modules/l1/alb/instance.json, scripts/migrate_dynamodb_data.py (NEW), docs/NOVA_AWS_MIGRATION.md (NEW runbook), core/lambda/contract_ingestor.py (default table names, D-111) Tasks:

  1. Runbook (REQ-163). Create docs/NOVA_AWS_MIGRATION.md — the maintenance-window + rollback runbook. Documents each resource rename, the migration command, the verification step, and the rollback procedure. Orders the migration: KMS alias (cheap) → SNS/SG (recreate) → Lambda (recreate) → DynamoDB (scan+copy) → ECR (re-push) → IAM (re-bootstrap) → state bucket (-migrate-state) → ALB (recreate, brief downtime, last).
  2. Terraform resource names (REQ-163). Rename all acdl-* resource names/labels → nova-* in terraform/platform/main.tf, terraform/microservice/main.tf, terraform/ci-vpc/main.tf, terraform/bootstrap/**, modules/l1/alb/instance.json:
    • DynamoDB: acdl-contracts → nova-contracts, acdl-change-requests → nova-change-requests
    • Secrets Manager: acdl/github-token → nova/github-token
    • Lambda: acdl-contract-ingestor (role/policy/function) → nova-contract-ingestor
    • SNS: acdl-sod-halt → nova-sod-halt
    • SG: acdl-ecs-sg → nova-ecs-sg
    • KMS: alias/acdl-platform → alias/nova-platform
    • ECS: acdl-microservice (cluster/service/task/role) → nova-microservice
    • ECR: acdl-microservice → nova-microservice
    • IAM: acdl-spike-runner (+policy) → nova-spike-runner
    • S3 state bucket: acdl-tfstate-581513795199-us-east-1 → nova-tfstate-581513795199-us-east-1
    • ALB: acdl-alb → nova-alb
  3. Lambda default table names (D-111, REQ-163). Update core/lambda/contract_ingestor.py default env-var values: CONTRACTS_TABLE default acdl-contracts → nova-contracts, CHANGE_REQUESTS_TABLE acdl-change-requests → nova-change-requests, GITHUB_TOKEN_SECRET_ID acdl/github-token → nova/github-token, PLATFORM_REPO acdl/acdl → nova/acdl (prose consistency; real repo unchanged).
  4. State bucket migration (REQ-63). Update the terraform backend config (terraform/{platform,microservice,ci-vpc}/terraform.tf + bootstrap/create_state_backend.py + bootstrap/.bootstrap_state.json) to the new nova-tfstate-... bucket. Document the terraform init -migrate-state command in the runbook (back up the state JSON first).
  5. DynamoDB data-migration script (REQ-163). Create scripts/migrate_dynamodb_data.py — scan+copy all items from acdl-contracts → nova-contracts + acdl-change-requests → nova-change-requests. Verify row counts match. Keep old tables until verified (deletion is a manual post-verification step, documented in the runbook).
  6. terraform validate + regress gate. terraform validate passes for platform/microservice/ci-vpc. grep -rn "acdl-" terraform/ returns 0 hits. pytest passes; bash scripts/run_regression.sh — 16/16 Verified.

Wave 5 — Final Review + Ship (P5)

P5 — final-review-ship (REQ-164)

Persona: lead-developer (lead) + all active (review) Territory: .ciagent/**, core/env.py (remove fallback), nova_tagging.py (hard-fail acdl:*), review + audit Tasks:

  1. Remove dual-read fallback (REQ-164). Update core/env.py get_env() to read NOVA_* only (remove the ACDL_* fallback). Update shell scripts to ${NOVA_X} only (remove :-$ACDL_X). Update nova_tagging.py to hard-fail on any acdl:* tag key (no warn). Delete the ACDL_* secrets from Gitea (the NOVA_* aliases created in P2 are now the only source). Remove the legacy comment from .env.secrets.
  2. Multi-persona review. Run ciagent-review across all v1.15 phases (P1–P4 changes). Auto-apply P0 fixes; flag P1+ for post-hoc. If P1+ found, fix in this phase.
  3. Audit. Run ciagent-audit — reconstruction test (git log matches .ciagent/ files), file discipline, branch hygiene, commit discipline. If critical issues, fix in this phase.
  4. Finalize consumer migration guide (REQ-164). Update docs/NOVA_MIGRATION.md to mark the migration complete (cutoff passed; ACDL_* fallback removed).
  5. Complete milestone. Update REQUIREMENTS.md (REQ-155..164 → complete), ROADMAP.md (v1.15 complete), PROJECT.md. Tag v1.14.5 (IS the milestone release). Merge milestone/v1.15-nova → main. Create Gitea release with full milestone summary.

Success Criteria (milestone gate)

  1. All 10 REQ-155..REQ-164 marked complete in REQUIREMENTS.md.
  2. Review: 0 new P0; all P1+ flagged or auto-fixed.
  3. Audit: clean; reconstruction test passes.
  4. Regression gate (D-091) 16/16 Verified throughout + at milestone complete.
  5. grep -rni "ACDL\|Agentic Cloud Delivery" README.md docs/ .ciagent/*.md returns 0 hits (except explicit "formerly ACDL" historical notes).
  6. grep -rn "ACDL_" core/ scripts/ adapters/ tests/ .gitea/ .github/ returns 0 hits (except the removed-fallback test in P5 that asserts the fallback is gone).
  7. grep -rn "acdl-" terraform/ returns 0 hits.
  8. pytest passes; run_ci.sh exits 0; terraform validate passes for platform/microservice/ci-vpc.
  9. Tag v1.15.4 created (IS the milestone release, G-104); milestone merged to main.
Reference in New Issue View Git Blame Copy Permalink