nova-platform/.ciagent/GRILL.md

GRILL — Nova Platform v1.0 (Phase 0)

Adversarial red-team of the v1.0 plan. 9 axes reviewed against the reference at /home/opencode/acdl/ + locked decisions.

Verdict: PROCEED-WITH-CONDITIONS — Confidence 0.82 → PROCEED (all conditions resolved)

One blocking architectural contradiction (C-1) + 5 non-binding conditions. All resolved under supervised autonomy:

• C-1 (BLOCKING): D-037 locked — adapter loads registry, no source in stack. REQ-04 + REQ-07 updated.
• C-2 (High): D-038 locked — L2 compositions = ARCHITECTURE.md's.
• C-3 (Medium): AC-8 now mechanically checkable (docs OOS grep).
• C-4 (Medium): Wave graph reordered — P3-W1 before P2-W1.
• C-5 (Low): Concurrency note added to PLAN.md.
• C-6 (Low): "without deviation" → "with 9 locked deviations" in PROJECT.md + PERSONAS.md.

Binding conditions

C-1 (BLOCKING) — resolver-source / engine-boundary / adapter-signature contradiction

The kill shot. Three locked decisions are mutually unsatisfiable:

Decision	Requires	Location
REQ-04 + D-012	Stack resource carries source field (Terraform path)	core/contract_resolver.py populates it
REQ-09 + D-034	No .py in core/ may contain terraform	tests/test_engine_boundary.py greps
REQ-07	adapt(stack, modules_dir) -> str — no registry param	adapter can't resolve source

Verified against reference: acdl/schemas/stack.schema.json has NO source field. acdl/adapters/terraform/adapter.py:19 loads registry.json itself (_load_registry). The reference resolver never writes a terraform_dir path into the stack. nova-platform's design inverts this — putting source in the stack (resolver's job) while keeping the adapter signature registry-less. The resolver must write "modules/l1/s3/terraform" (contains forbidden terraform) → **AC-5

• AC-10 will fail.**

Fix (recommended — matches reference):

• Drop source from stack.schema.json (REQ-04).
• Change adapt(stack, modules_dir) → adapt(stack, repo_root) (REQ-07).
• Adapter loads registry.json internally (inside the boundary — it's the engine-specific code, permitted to read terraform_dir).
• L2 terraform_dir in registry (D-013) consumed by adapter, not resolver.

Side effect (C-4): if adopted, P2 (adapter) gains a dependency on P3-W1 (registry.json). Reorder: P3-W1 before P2-W1, or split P3.

C-2 (High) — L2 child set underspecified

ARCHITECTURE.md:114-115 describes L2 compositions:

• microservice = vpc + ecs-cluster + ecs-service + iam-role + ecr + alb
• static-assets = s3 + cloudfront + kms-key

But the reference microservice children = cluster, ecr, roles, alb, service, kms (no vpc); static-assets = s3, cloudfront, waf, kms. Nova drops waf from static-assets (consistent — waf L1 kept but not in the L2). These are fresh-authored under D-012 (opaque L2), so not a reference-mirror violation, but the composition is underspecified — no decision locks the L2 child set.

Fix: Lock D-036 before P4-W2 specifying exactly which L1 modules each L2 composes. Reconcile ARCHITECTURE.md.

C-3 (Medium) — AC-8 not mechanically checkable

AC-8 ("docs... no OOS sections") is subjective. P6-W3 greps for OOS file names but not OOS content inside allowed docs. A doc could contain a "Security" section and pass.

Fix: Add grep check for OOS section headings ("Security", "Compliance", "OIDC", "Attestation", "ABAC") inside docs/*.md + modules/*/README.md. Make AC-8 mechanically checkable.

C-4 (Medium) — missing dep if C-1(a) adopted

If C-1's recommended fix is adopted (adapter loads registry), P2 gains a dependency on P3-W1 (registry.json). Current graph runs P2 + P3 in parallel after P1.

Fix: Reorder P3-W1 before P2-W1, or split P3 into "registry first"

• "L1 terraform second". Update the wave dependency graph.

C-5 (Low) — concurrency cap violation

PLAN claims "No wave has >5 parallel tasks" but P3-W1 has 13, P3-W2 has 13, P4-W1 has 8. max_concurrent_agents=5 → these batch-serialize into 3-5 rounds, inflating P3 wall-clock ~2-3×.

Fix: Either raise the cap for these waves or restate the schedule estimate to reflect batching. Non-blocking.

C-6 (Low) — "without deviation" claim is false

PROJECT.md:11 + PERSONAS.md:17,148 claim "structural conventions preserved without deviation." RESEARCH.md itself lists 9 locked deviations (D-012, D-013, D-015, D-017, D-018, D-019, D-022, D-023, D-025, D-027). An implementer may reject the needed C-1 fix as "violating conventions."

Fix: Rewrite the claim to "structural conventions preserved except the 9 locked deviations in CLARIFY.md."

Additional notes (non-binding)

• ARCHITECTURE.md:32 example bug: id: my-static-site (14 chars) fails the locked pattern ^[a-z][a-z0-9-]{2,5}$ (max 6). Fix to id: stsi or id: assets.
• D-014 (0.72), D-017 (0.70), D-030 (0.68): marked below threshold in CLARIFY.md but D-017/D-030 show no human-lock record (unlike D-025). These WERE escalated + answered in the clarify stage question round — confirmed locked. No action needed.
• moto pinned but unused (D-030): harmless. Keep or drop; not blocking.