Files

T

CIAgent 2443909362 docs(milestone): complete v1.0-nova-platform (release v0.1.6)

---ci---
project: nova-platform
milestone: v1.0
status: complete
requirements:
  covered: [REQ-01,REQ-02,REQ-03,REQ-04,REQ-05,REQ-06,REQ-07,REQ-08,REQ-09,REQ-10,REQ-11,REQ-12,REQ-13,REQ-14,REQ-15,REQ-16,REQ-17,REQ-18,REQ-19,REQ-20,REQ-21,REQ-22,REQ-23,REQ-24,REQ-25,REQ-26,REQ-27,REQ-28,REQ-29,REQ-30,REQ-31,REQ-32,REQ-33,REQ-34,REQ-35,REQ-36,REQ-37,REQ-38]
  partial: []
---/ci---

v1.0 milestone complete: simplified infrastructure-delivery platform
derived from Nova (acdl). 6 phases (P0-P5 + P6 final). 38 REQ-IDs.
38 decisions (D-001..D-038). 76 tests pass. Engine boundary holds.
Happy paths green (check-only + CI). 13 L1 + 2 L2 modules. 5 terraform
roots. Shell reproducibility. Zero OOS files.

Tags: v0.1.0 (P0) → v0.1.1..v0.1.5 (P1..P5) → v0.1.6 (P6 = milestone
release on v0.1 patch line).

2026-08-25 02:18:35 +00:00

5.2 KiB

Raw Blame History

Nova Platform — Architecture

Simplified from the Nova reference. The reference's six cross-cutting concerns (security, policy, confidence, outbox/audit, identity, CI pipeline contract) are removed. What remains is the four-layer infrastructure-delivery core.

Layers (4)

┌──────────────────────────────────────────────────────┐
│  1. Contract Surface      schemas/contract.schema.json
│                           contracts/*.yaml (samples)
├──────────────────────────────────────────────────────┤
│  2. Resolution            core/contract_resolver.py
│                           core/environment_check.py
│                           schemas/stack.schema.json
├──────────────────────────────────────────────────────┤
│  3. Engine Adapter        adapters/terraform/ (the only
│  (only engine-specific)   engine-specific code)
├──────────────────────────────────────────────────────┤
│  4. Apply                 terraform/ (bootstrap, modules)
│                           scripts/run_platform.sh
└──────────────────────────────────────────────────────┘

Layer 1 — Contract Surface

A consumer writes a small YAML contract:

id: stsi
name: My Static Site
environment: dev
infrastructure:
  - module: static-assets
    version: "1.0.0"
    inputs:
      bucket_name: my-static-site-assets
      index_document: index.html

Validated against schemas/contract.schema.json. The contract is the only consumer-facing surface. It is engine-agnostic — no aws_* terms.

Layer 2 — Resolution

core/contract_resolver.py resolves a validated contract to a Stack instance (a typed structure conforming to schemas/stack.schema.json). Resolution is pure: contract in, stack out. No I/O, no engine terms.

core/environment_check.py validates that the named environment exists in core/environments/*.json and that the caller is permitted to use it. Environments are platform-managed (consumers provide no AWS account, VPC, or state bucket).

Layer 3 — Engine Adapter

adapters/terraform/ is the only engine-specific code. It takes a Stack and emits Terraform (module "x" { source = "../../modules/..." } blocks). The adapter is a stateless assembler — lifecycle ownership belongs to Terraform via the shell orchestrator. This is the only place aws_* / Terraform terms appear.

Layer 4 — Apply

scripts/run_platform.sh orchestrates: contract → resolve → adapter → terraform init → terraform plan → terraform apply. Modes: --check-only (offline, structure validation), --plan-only (no apply), full (apply). --quiet suppresses streaming.

Engine Boundary (Enforced)

The engine boundary is strict. Code outside adapters/terraform/ MUST NOT contain engine-specific terms (aws_s3_bucket, aws_*, Terraform HCL). This invariant is verified by tests (tests/test_engine_boundary.py).

What is NOT here (intentionally removed vs the reference)

No core/confidence_signal.py — no score gating apply.
No core/outbox_writer.py — no hash-chained evidence events.
No core/policy_engine.py / adapters/kyverno-json/ / adapters/wiz/ — no policy checks.
No core/abac_evaluator.py / core/auth_store.py / core/jws_attestation.py / core/kms_signing.py / core/pat_lifecycle.py / core/separation_of_duties.py / core/hitl_gates.py / core/attestation_matrix.py / core/submission_readiness.py — no identity/ABAC/HITL.
No adapters/checkov/ custom rules — no Checkov.
No .github/workflows/ — no CI pipeline (local shell only).
No pipelines/ — no central pipeline contract.
No schemas/pipeline.schema.json / schemas/deploy-pipeline.schema.json / schemas/policy_check_result.schema.json / schemas/metrics_*.schema.json — those schemas are dropped.
No metrics/ — no platform telemetry.
No core/regression_verify*.py / core/metrics/ — no regression or metrics modules.
No leadership decks, PPTX rendering, marp slides.
No core/env_transition.py / core/decommission_transform.py / core/mode_resolver.py / core/onboarding.py — no env transition, decommission, mode resolution, or onboarding flow beyond bootstrap.

Module Catalog

L1 primitives (single resources) + L2 patterns (composites of primitives). Each module has an interface.json (inputs/outputs, no engine terms) and a terraform/ directory. modules/registry.json indexes every module + version.

L1 (primitives): s3, vpc, ecs-cluster, ecs-service, iam-role, alb, ecr, cloudfront, waf, rds, kms-key, dynamodb, uptime.

L2 (patterns): microservice (vpc + ecs-cluster + ecs-service + iam-role + ecr + alb — locked D-038), static-assets (s3 + cloudfront + kms-key — locked D-038, drops waf from reference).

5.2 KiB Raw Blame History