acdl/.ciagent/STATE.md

Nova — System State (what exists today)

PO-owned catalog of shipped capabilities. Updated at every milestone ship (P final). Additive only — entries are appended, never rewritten, unless a capability is explicitly deprecated (then marked, not deleted). Read by the PO upstream of the PDLC before authoring new REQ-NNN specs, and by CIAgent at SPECIFY for capability awareness.

Authority: this file is descriptive of shipped state, not authoritative for live phase/ship state — that's CHECKPOINT.json. For why, read NORTH_STAR.md. For how, read ARCHITECTURE.md. For what was decided, read PROJECT.md load-bearing decisions.

Last milestone ship: v1.27 (v1.26.3, 2026-08-19) — PO State Catalog & Ciagent Compression NFR milestone. No new capabilities this milestone (NFR); v1.27 authored this file + compressed .ciagent/. Next update: at v1.28 ship.

How to use this file (PO)

• Before writing a new REQ: search this file for the capability you intend to spec. If it exists, extend it; do not re-spec it under a new REQ-NNN.
• Respect the Invariants below — they are load-bearing and cross-cutting. A new REQ that violates an invariant requires a CLARIFY decision recorded in PROJECT.md.
• Anchor each new REQ to a Domain; new domains require a PO decision recorded in CLARIFY.
• When a capability is deprecated (replaced, removed, or re-architecture), append a Deprecated row marking the milestone + replacement; do not delete the original entry.

Invariants (PO-owned — do not violate in new REQs)

Distilled from PROJECT.md load-bearing decisions D-034..D-072 + W1..BA + Q1.3. Cite the decision ID when an REQ touches one.

• INV-1 (Contract surface): The only PDLC→Nova boundary is schemas/contract.schema.json + schemas/submission-readiness.schema.json (D-133). All consumer intent enters through one of these. Nova never reaches into upstream PDLC.
• INV-2 (Confidence inputs): Six canonical inputs — policy (0.30), validation (0.25), freshness (0.10), source (0.15), history (0.10), nfrs (0.10). Weights frozen for v1 (D-040). critical severity = hard-block via PENALTY["critical"]: None (defense-in-depth behind the declarative block-on-any-critical meta-policy).
• INV-3 (HITL gates): dev = autonomous (≥0.50); qa = HITL (≥0.75); prod = HITL (≥0.90); dr = HITL (≥0.95). Approver identity = Gitea gitea.actor of the workflow_dispatch (D-042). Separation-of-duties on prod reads approver_qa from the DynamoDB outbox.
• INV-4 (Engine is swappable): The policy engine is behind the PolicyEngine protocol (core/policy_engine.py, v1.25). Confidence signal + pipeline import only the protocol, never a concrete engine. kyverno-json is the v1.25 default; OPA (or other) implements the same 3-method protocol to replace it.
• INV-5 (Adapter is stateless): adapters/terraform/adapter.py owns no module content — no TYPE_MAP/INPUT_MAP/OUTPUT_MAP (v1.11 rewrite). A new stack type requires a new L1 module (modules/l1/<name>/) + registry.json entry, not an adapter change.
• INV-6 (Audit stream is immutable): Outbox writes via SQLite hash-chain today (D-083 deferred). S3 Object Lock / JWS tamper- resistant ledger is a future milestone. Current stream is tamper- evident (any tampering breaks the chain).
• INV-7 (PCR schema is the moat): schemas/policy_check_result.schema.json shape is frozen across adapter swaps (v1.25 hard constraint). The engine enum already includes "kyverno" + "opa"; new engines add no enum value.
• INV-8 (Long-lived creds forbidden): §12.5. The D-039/D-047 per-run- rotated-key waiver satisfies the intent (no persistently long-lived key). Real OIDC federation is blocked on go-gitea/gitea#36988.
• INV-9 (Two consumer surfaces, one platform): L3A (developer) + L3B (citizen dev) converge on the same contract schema, the same policy envelope, and the same evidence stream.
• INV-10 (Nova is downstream of PDLC): Nova governs infra + delivery only. Product backlog, code authorship, IDE workflows, application business logic are upstream. Integration only via the validated contract boundary (INV-1).
• INV-11 (Pilot scope, v1.26): Equities only (D-200). Single- validator PoA (D-201). D-083 (Object Lock/JWS) stays deferred. Hot path deferred (D-126). Multi-cloud deferred. Multi-validator BFT deferred. The pilot runs mode: full for dev only (D-209); qa/prod/dr stay placeholder (D-208, blocked by the pilot-readiness policy).

Domains (capability groups)

1. Contract surface
2. Modules (L1 primitives + L2 patterns)
3. Policy engine
4. Confidence signal
5. Environments & promotion
6. Evidence stream & audit
7. Telemetry & metrics
8. Consumer surfaces (developer + agentic)
9. Pilot estate (v1.26)
10. Forge / CI runtime

Capabilities (additive — one row per shipped capability)

Tier: local = runs via emulating adapters (no AWS); live-aws = runs against the live AWS account 581513795199; lifecycle-pipeline = verified via the modules-lifecycle pipeline's apply→modify→destroy matrix cell. CAP-NNN IDs cross-reference the regression gate at core/regression_verify.py (the machine registry). This file is the PO-facing narrative; the machine registry is the source of truth for the gate.

Domain 1 — Contract surface

ID	Capability	Shipped	Files	Controlling	Tier	Notes
CAP-001	contract.schema.json validates sample contracts	v1.1 / v1.2.0	schemas/contract.schema.json	REQ-001, D-...	local	shape: id/name/environment/infrastructure
CAP-002	environment.schema.json validates env files	v1.9 / v1.9.0	schemas/environment.schema.json	REQ-040	local	dev/qa/prod/dr env JSONs
CAP-006	Contract interpolation expands ${env.*} / ${contract.*}	v1.9 / v1.9.0	core/contract_resolver.py	REQ-040	local	per-env variants
—	Submission-readiness gate (superset of contract schema)	v1.18 / v1.18.0	schemas/submission-readiness.schema.json, core/submission_readiness.py	REQ-217, REQ-218, D-133	local	the only PDLC→Nova boundary (INV-1)

Domain 2 — Modules (L1 primitives + L2 patterns)

Source: modules/registry.json (the authoritative module catalog). STATE.md lists the capability of having a registered module; registry.json is the live registry.

ID	Capability	Shipped	Files	Controlling	Tier	Notes
CAP-003	contract_resolver resolves static-assets (L2)	v1.1 / v1.2.0	core/contract_resolver.py, modules/l2/static-assets/	REQ-003	local	CloudFront+WAF+S3 pattern
CAP-004	contract_resolver resolves microservice (L2)	v1.2 / v1.3.0	core/contract_resolver.py, modules/l2/microservice/	REQ-004	local	ECS Fargate pattern (6 L1 children)
CAP-005	Terraform adapter compiles resolved stack to .tf	v1.1 / v1.2.0	adapters/terraform/adapter.py	REQ-005	local	stateless assembler (v1.11); emits module "<rid>" { source } blocks
—	L1 s3 primitive	v1.1 / v1.2.0	modules/l1/s3/	REQ-005	lifecycle	versioning + SSE-KMS by default
—	L1 vpc primitive	v1.1 / v1.2.0	modules/l1/vpc/	REQ-005	lifecycle	shared platform VPC (v1.11)
—	L1 ecs-cluster primitive	v1.1 / v1.2.0	modules/l1/ecs-cluster/	REQ-005	lifecycle
—	L1 ecs-service primitive	v1.1 / v1.2.0	modules/l1/ecs-service/	REQ-005	lifecycle	execution_role_arn + task_role_arn wired (P4 W1 fix, v1.26)
—	L1 iam-role primitive	v1.1 / v1.2.0	modules/l1/iam-role/	REQ-005	lifecycle
—	L1 alb primitive	v1.1 / v1.2.0	modules/l1/alb/	REQ-005	lifecycle	requires SG wire (P4 W1 fix, v1.26)
—	L1 ecr primitive	v1.1 / v1.2.0	modules/l1/ecr/	REQ-005	lifecycle
—	L1 cloudfront primitive	v1.7 / v1.7.0	modules/l1/cloudfront/	REQ-049, D-049	lifecycle	OAC + WAF (production edge)
—	L1 waf primitive	v1.7 / v1.7.0	modules/l1/waf/	REQ-049, D-049	lifecycle
—	L1 rds primitive	v1.7 / v1.7.0	modules/l1/rds/	REQ-059, D-059	lifecycle	multi-engine input (postgres/mysql/...)
—	L1 kms-key primitive	v1.8 / v1.8.0	modules/l1/kms-key/	REQ-069, D-069	lifecycle	per-stack CMK; 90-day rotation
—	L1 uptime primitive	v1.8 / v1.8.0	modules/l1/uptime/	REQ-066, D-066	lifecycle	uptime-kuma on ECS Fargate
—	L1 dynamodb primitive	v1.26 / v1.25.2	modules/l1/dynamodb/	REQ-322	local	PK + optional SK; PAY_PER_REQUEST; encryption + PITR by default (v1.8 NFRs)
CAP-013	terraform init+validate+plan live AWS (microservice)	v1.2 / v1.3.0	adapters/terraform/adapter.py	REQ-013	live-aws	14 resources; plan saved
CAP-014	terraform init+validate+plan live AWS (static-assets)	v1.7 / v1.7.0	adapters/terraform/adapter.py	REQ-014	live-aws	CloudFront+WAF+S3 plan OK
CAP-017	DynamoDB nova-contracts table	v1.7 / v1.7.0	core/lambda/, terraform/	REQ-068, D-068	lifecycle	PK changeRequestId, SK submittedAt (CMDB)
CAP-018	Lambda contract-ingestor	v1.7 / v1.7.0	core/lambda/contract_ingestor.py	REQ-051, D-051	lifecycle	local stub + lifecycle evidence
CAP-019	ECS cluster + service (L2 microservice)	v1.7 / v1.7.0	modules/l2/microservice/	REQ-066	lifecycle	apply/modify/destroy exit 0
CAP-020	CloudFront + WAF production stack	v1.7 / v1.7.0	modules/l2/static-assets/	REQ-049	lifecycle	apply/modify/destroy exit 0
CAP-021	uptime-kuma monitoring primitive	v1.8 / v1.8.0	modules/l1/uptime/	REQ-066	lifecycle
CAP-022	OIDC role for act_runner	v1.11 / v1.11.0	terraform/bootstrap/	REQ-116, D-039	lifecycle	real OIDC blocked on go-gitea/gitea#36988

Domain 3 — Policy engine

ID	Capability	Shipped	Files	Controlling	Tier	Notes
—	PolicyEngine Protocol + PolicyEngineRegistry	v1.25 / v1.24.1	core/policy_engine.py	REQ-291, REQ-292	local	selects engine from config.json.policy.engine; NullEngine fallback when key absent
—	KyvernoJsonEngine adapter (shells to kj scan)	v1.25 / v1.24.1	adapters/kyverno-json/kyverno_json_engine.py	REQ-293, REQ-294	local	is_configured() guards on which kj; SKIPPED PCR when absent
—	Contract policies (4) over consumer contract JSON	v1.25 / v1.24.2	adapters/kyverno-json/policies/contract/	REQ-295, REQ-296	local	id-pattern, env-enum, infra-min-1, forbid-unknown-fields
—	Stack-IR policies (3) over resolved Target Stack IR	v1.25 / v1.24.2	adapters/kyverno-json/policies/stack-ir/	REQ-297, REQ-298, REQ-299	local	tagging-standard, public-ingress, encryption-by-default
—	Plan-JSON policies (3) over terraform show -json	v1.25 / v1.24.3	adapters/kyverno-json/policies/plan-json/	REQ-300, REQ-301, REQ-302	local	plaintext-secrets, iam-wildcard, kms-reference
—	Meta-policies over merged PCR list	v1.25 / v1.24.3	adapters/kyverno-json/policies/meta/	REQ-303	local	block-on-any-critical (declarative critical-block); tagging-rules-agree (Checkov↔kj agree)
—	Regression-gate policies (3) over capability-inventory JSON	v1.25 / v1.24.4	adapters/kyverno-json/policies/regression/	REQ-304, REQ-305	local	declarative mirrors of CAP-013/023/024 imperative checks
—	Pilot-readiness policy (no placeholder account)	v1.26 / v1.25.3	adapters/kyverno-json/policies/pilot-readiness/no-placeholder-account.json	REQ-320	local	fail-closed gate; blocks apply on account_id == "000000000000"
—	Settlement-finality policy	v1.26 / v1.25.3	adapters/kyverno-json/policies/settlement-finality/all-matches-committed.json	REQ-315	local	authored + tested; enforcement deferred to milestone that binds qa/prod/dr (D-208)
—	Checkov adapter (raw-finding source)	v1.7 / v1.7.0	adapters/terraform/checkov_adapter.py	REQ-053	local	feeds meta-policies; NOVA_TAG_NAMING custom rule is the TF-static source of truth
—	Wiz adapter (raw-finding source)	v1.7 / v1.7.0	adapters/wiz/	REQ-053	local	API findings; is_configured() guard
—	K8s Kyverno adapter (documentation-only)	v1.7 / v1.7.0	adapters/kyverno/	REQ-053, D-053	local	inactive for Terraform-only stacks; activates when GitOps emits K8s manifests

Domain 4 — Confidence signal

ID	Capability	Shipped	Files	Controlling	Tier	Notes
CAP-007	confidence_signal.compute returns a band	v1.1 / v1.2.0	core/confidence_signal.py	REQ-007, D-040	local	6 inputs (INV-2); band ∈ {pass, block}
—	escalation_reason: 'confidence' on band == 'block'	v1.26 / v1.25.3	core/confidence_signal.py	REQ-318	local	grounds Human Escalation Frequency numerator

Domain 5 — Environments & promotion

ID	Capability	Shipped	Files	Controlling	Tier	Notes
—	env-JSON state_backend wiring	v1.26 / v1.25.3	core/environments/*.json, adapters/terraform/adapter.py	REQ-319, D-...	local	adapter reads env.state_backend.bucket (fallback to computed name)
—	Environment progression (dev autonomous → qa/prod/dr HITL)	v1.1 / v1.2.0	core/env_transition.py, core/hitl_gates.py	REQ-042, D-042	local	destroy-on-environment-change (v1.24)
—	Decommission mode (2-step, HITL SRE gates)	v1.8 / v1.8.0	core/env_transition.py, scripts/run_platform.sh	REQ-070, D-070	local	mode: decommission requires changeRequestId
—	Per-env mandatory metadata (W3.E)	v1.1 / v1.2.0	schemas/submission-readiness.schema.json	W3.E	local	dev=stack+env; qa+=e2e+load; prod+=runbook+dashboard+oncall; dr+=drDrillRef

Domain 6 — Evidence stream & audit

ID	Capability	Shipped	Files	Controlling	Tier	Notes
CAP-008	outbox_writer builds a hash-chained item	v1.1 / v1.2.0	core/outbox_writer.py	REQ-008	local	tamper-evident (INV-6); tamper-resistant deferred (D-083)
CAP-015	DynamoDB outbox table exists + describable	v1.1 / v1.2.0	core/outbox_writer.py	REQ-015	live-aws	nova-outbox (post-v1.26 re-bootstrap)
CAP-016	S3 state bucket exists + readable	v1.1 / v1.2.0	terraform/bootstrap/	REQ-016	live-aws	nova-tfstate-581513795199-us-east-1
—	Decision Ledger (SQLite hash-chain)	v1.17 / v1.17.0	core/metrics/decision_ledger.py	REQ-185, REQ-186	local	cold store for metrics; ai.decision.made + attestation.recorded events
—	SSM Parameter Store deploy outputs (SecureString, KMS)	v1.7 / v1.7.0	core/output_publisher.py	REQ-050, D-050	live-aws	/acdl/{env}/{contractId}/{output_name}
—	GitHub PR comment / job summary deploy outputs	v1.7 / v1.7.0	scripts/run_platform.sh	REQ-050, D-050	local	no raw secrets in logs
—	Uniform error reporting via Lambda report_error	v1.7 / v1.7.0	core/lambda/contract_ingestor.py	REQ-055, D-055	live-aws	GitHub issue on platform repo acdl/acdl; idempotent
—	Tagging standard enforcement (4 required tags)	v1.7 / v1.7.0	schemas/tagging-standard.json, adapters/terraform/policy/custom_rules/nova_tagging.py	REQ-054, D-054	local	nova:owner, nova:contract, nova:environment, nova:cost-center
—	Encryption + deletion-protection by default	v1.8 / v1.8.0	modules/l1/*/terraform/main.tf	REQ-062, REQ-069, D-062, D-069, D-072	local	per-stack CMK; managed KMS fallback for standalone L1 (D-072)

Domain 7 — Telemetry & metrics

ID	Capability	Shipped	Files	Controlling	Tier	Notes
CAP-023	metrics collector runs + emits expected schema	v1.17 / v1.17.0	core/metrics/collector.py	REQ-194	local	fact_run, fact_decision, fact_attestation dims
CAP-024	unified deck structure (slide count, x3 arc, per-slide benefits)	v1.17 / v1.17.0	docs/presentations/nova-autonomous-cloud-delivery-marp.md	REQ-194	local	single source-of-truth marp deck
—	Outcome backfill (pending → succeeded/failed)	v1.26 / v1.25.3	core/metrics/outcome_backfill.py	REQ-317	local	idempotent + terminal; grounds AI Decision Accuracy
—	Trust Snapshot	v1.17 / v1.17.0	metrics/TRUST_SNAPSHOT.md, core/metrics/trust_snapshot.py	REQ-194	local	leadership-ready trust verdict
—	PowerBI export (fact/dimension views + 8 placeholder views)	v1.17 / v1.17.0	metrics/powerbi/	REQ-194	local	deferred metrics ship as documented-schema placeholders
—	Pre-apply Infracost estimate	v1.17 / v1.17.0	scripts/run_platform.sh	REQ-119	local	nova.cost.estimated; actual-spend CUR reconciliation deferred (D-096)
—	Regression gate (scripts/run_regression.sh)	v1.10 / v1.10.0	core/regression_verify.py, scripts/run_regression.sh	REQ-090, REQ-121	local	fails closed on any non-Verified CAP; CAP-001..025

Domain 8 — Consumer surfaces (developer + agentic)

ID	Capability	Shipped	Files	Controlling	Tier	Notes
—	Reusable deploy workflow (deploy.yml@v1.25)	v1.5 / v1.5.0	.github/workflows/deploy.yml, .gitea/workflows/deploy.yml	REQ-105	local	workflow_call; modes: full/plan-only/check-only/decommission
—	Consumer onboarding (developer + citizen-dev paths)	v1.1 / v1.2.0	docs/ONBOARDING.md, docs/consumer-guide.md	BA.E, W3.E	local	both end in a sandbox dev submission that must pass the confidence gate
—	Atelier MCP server (agentic validation)	v1.18 / v1.18.0	mcp/atelier/server.py	REQ-221, REQ-222	local	atelier.validate_against_principles tool
—	9 production-grade engineering skills	v1.18 / v1.18.0	skills/{api,security,data,testing,observability,errors,devops,infrastructure-as-code,compliance}.md	REQ-221, REQ-222, BA.A	local	indexed by docs/skills.md; review/agent-checklist.md gate
—	Module examples (validated against contract schema)	v1.7 / v1.7.0	modules/<name>/examples/{simple,complex}.yml	REQ-058, D-058	local	examples cannot drift from schema silently

Domain 9 — Pilot estate (v1.26)

The first real consumer estate. nova-blockchain-exchange repo (Gitea continuous-intelligence/nova-blockchain-exchange, local clone /root/nova-blockchain-exchange). Homegrown PoA blockchain, equities only, single validator, T+1 settlement finality = block commit.

ID	Capability	Shipped	Files	Controlling	Tier	Notes
CAP-026	PoA blockchain core (block + ledger + validator)	v1.26 / v1.25.1	chain/block.py, chain/ledger.py, chain/validator.py	REQ-310, D-201	local	single validator; SHA-256 hash chain; deterministic block production
CAP-027	Order-matching engine (limit order book)	v1.26 / v1.25.1	engine/order_book.py, engine/order.py	REQ-311	local	price-time priority; partial fills
CAP-028	T+1 settlement service	v1.26 / v1.25.1	settlement/service.py	REQ-312	local	idempotent; finality = block commit
CAP-029	Consumer contract.yaml (blockchain exchange)	v1.26 / v1.25.2	nova-blockchain-exchange/contract.yaml, contracts/*.yml	REQ-313	local	per-env variants (dev/qa/prod); validated against contract schema
CAP-030	Consumer deploy via deploy.yml@v1.25 (inline adapter)	v1.26 / v1.25.2	nova-blockchain-exchange/.github/workflows/deploy.yml, .gitea/workflows/deploy.yml	REQ-314	local	no cross-repo uses: (SPEC §10 Q1); checkout acdl/acdl @ v1.25 into platform/, run run_platform.sh
CAP-025	Live-pilot-apply regression capability (round-trip)	v1.26 / v1.25.3	core/regression_verify.py	REQ-316	local	contract→adapter→plan→policy→confidence→attestation→outbox round-trip assertion
CAP-031	Live pilot apply evidence (blkex-pilot-apply-v0.2)	v1.26 / v1.25.4	.ciagent/archive/P4-PILOT-RUN-EVIDENCE-v1.26.md	REQ-316, REQ-321	live-aws	confidence 0.800 pass; outcome backfilled; hash chain valid; live apply against 581513795199
CAP-032	AWS key rotation scheduled workflow	v1.26 / v1.25.3	workflows-src/rotate-aws-key.yml	SPEC §5.9	local	daily rotation; forge-agnostic token name (REQ-230)

Domain 10 — Forge / CI runtime

ID	Capability	Shipped	Files	Controlling	Tier	Notes
CAP-009	offline pytest suite passes	v1.1 / v1.2.0	tests/	REQ-009	local	844 tests (v1.26 baseline)
CAP-010	run_ci.sh reproduces CI pipeline locally	v1.4 / v1.4.0	scripts/run_ci.sh	REQ-010	local	offline; contract→resolver→stack→adapter→structure validated
CAP-011	headline E2E — local tier (microservice)	v1.2 / v1.3.0	scripts/run_local_e2e.sh	REQ-011, D-092	local	emulating adapters (no AWS)
CAP-012	local E2E — static-assets (no ECS)	v1.1 / v1.2.0	scripts/run_local_e2e.sh	REQ-012	local
—	platform-test.yml CI workflow	v1.4 / v1.4.0	.github/workflows/platform-test.yml	REQ-010	local	platform repo only (consumer CI is per-consumer)
—	modules-lifecycle pipeline (apply→modify→destroy matrix)	v1.11 / v1.11.0	.github/workflows/modules-lifecycle.yml	REQ-121, D-096	live-aws	per-module lifecycle cell; ci-vpc-destroy always runs
—	release.yml (semver + floating tag maintenance)	v1.7 / v1.7.0	.github/workflows/release.yml	REQ-...	local	v1.25 + v1 floating tags force-moved on merge to main
—	IAM policy baseline (acdl-spike-runner-policy)	v1.11 / v1.11.0	terraform/bootstrap/spike_runner_policy.json, .ciagent/IAM_POLICY.md	REQ-116, D-095	live-aws	regression-tested by tests/test_iam_policy_baseline.py; OIDC role acdl-act-runner-role (CAP-022)
—	Local emulating adapters (no AWS)	v1.10 / v1.10.0	core/local_lambda_stub.py, scripts/run_local_e2e.sh	D-092	local	proves runtime behavior without live AWS

Archive pointers

• v1.0–v1.24 capability narrative + the 2026-07-27 re-verification sweep: .ciagent/archive/CAPABILITY_INVENTORY-v1.10.md (moved from .ciagent/CAPABILITY_INVENTORY.md at v1.27). CAP-NNN IDs in this file cross-reference the regression gate at core/regression_verify.py.
• v1.0–v1.24 milestone narrative: .ciagent/archive/PROJECT-v1.0-v1.24.md.
• v1.0–v1.24 requirements (REQ-01..REQ-290): .ciagent/archive/REQUIREMENTS-v1.0-v1.24.md.
• v1.0–v1.24 phase breakdowns: .ciagent/archive/ROADMAP-v1.0-v1.24.md.
• v1.0–v1.24 architecture history: .ciagent/archive/ARCHITECTURE-v1.0-v1.24.md.
• v1.26 pre-execution artifacts (CLARIFY, GRILL, IDEATE, RESEARCH): .ciagent/archive/{CLARIFY,GRILL,IDEATE,RESEARCH}-v1.26.md (decisions D-200..D-213 folded into PROJECT.md load-bearing decisions + PLAN.md binding revisions at v1.27 archive time).
• v1.26 phase verifications: .ciagent/archive/{VERIFY-P03,VERIFY-P04,REVIEW-AUDIT-P05}.md.
• v1.26 live pilot run evidence: .ciagent/archive/P4-PILOT-RUN-EVIDENCE-v1.26.md.
• v1.21 autonomy thesis (folded into NORTH_STAR.md Vision): .ciagent/archive/AUTONOMY_THESIS-v1.21.md.
• v1.14 AWS cost report (predates v1.26 live pilot): .ciagent/archive/COST-v1.14.md.

Update discipline

This file is updated once per milestone, at the P-final milestone-ship wave (Wave 3 "milestone ship" in PLAN.md), alongside ROADMAP.md/NORTH_STAR.md/REQUIREMENTS.md:

1. Append new capability entries for each shipped REQ (one row per capability; group by domain).
2. Mark any deprecated capability with a Deprecated row citing the milestone + replacement.
3. Bump the "Last milestone ship" header.
4. Do not rewrite existing entries (additive only).

Enforcement: convention (the P-final ship step names this file). A drift-check gate (assert every REQ marked complete in REQUIREMENTS.md traceability appears in STATE.md) is a future option if the convention drifts.