coreci/acdl
7
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity

128 Releases 190 Tags

RSS Feed
  • v1.28.3 8c0c2dd268
    Compare

    v1.28.3: v1.29 P3 cfn-archive-tf-delegation — REQ-369 (CFN archive + terraform delegation)
    Nova Slides Render / render (push) Failing after 25s
    Details
    Stable

    coreci-bot released this 2026-08-20 05:20:43 +00:00 | 43 commits to main since this release

    v1.29 Phase 3 cfn-archive-tf-delegation. CFN template archived to docs/archive/nova-idp-cfn-v1.28.md (551 lines, full template as read-only reference). nova/idp/setup.py --apply now delegates to terraform apply via shutil.which('terraform') detection (44 lines, <=50 CAP-034). --verify delegates to terraform plan. CFN fallback path emits DeprecationWarning. core/lambda/nova_idp_setup.py: terraform_apply() + terraform_plan() functions added. test_idp_setup_tf_delegation.py authored (11 assertions: apply/verify x terraform-present/absent, deprecation warning, dry-run no-warn).

    Downloads
  • v1.28.2 c19cc68d15
    Compare

    v1.28.2: v1.29 P2 gitea-scrub-decisions — REQ-367 (Gitea scrub) + REQ-368 (D-232..240)
    Nova Slides Render / render (push) Failing after 14m19s
    Details
    Stable

    coreci-bot released this 2026-08-20 05:16:53 +00:00 | 44 commits to main since this release

    v1.29 Phase 2 gitea-scrub-decisions. .gitea/ directory removed (7 workflow files + README). scripts/sync_workflows.py (byte-identical-forges generator) + scripts/ship_phase.sh + scripts/attach_release_asset.py removed. scripts/rotate_spike_key.sh + sync_to_nova.sh scrubbed. pyproject.toml version bumped 1.14.0 -> 1.29.0. forge_parity_disabled CI assertion added to .github/workflows/ci.yml (asserts .gitea/ absent + no forge refs in .github/workflows/). 5 forge parity tests updated to assert disabled state (D-232). Decisions D-232..D-240 verified present in PROJECT.md + CLARIFY.md + REQUIREMENTS.md.

    Downloads
  • v1.29.0 d247db3569
    Compare

    v1.29.0: intermediate artifact tag (grill CF-3/G-3) — NOT the milestone release
    Nova Slides Render / render (push) Failing after 24s
    Details
    Stable

    coreci-bot released this 2026-08-20 05:07:34 +00:00 | 45 commits to main since this release

    This is an INTERMEDIATE artifact tag, NOT the milestone release. The milestone release is v1.28.6 (final phase).

    This tag triggers publish.yml to produce the v1.29 publish artifacts:

    • nova-lambda-token-vend-v1.29.0.zip
    • nova-cli-layer-v1.29.0.zip
    • nova-1.29.0-py3-none-any.whl
    • ECR image v1.29.0-kj-

    P5 smoke test (nova-blockchain-exchange) runs against these artifacts. Per grill CF-3/G-3: P1 pushes this intermediate tag at P1 ship to produce publish artifacts; P5 smoke test must run against real artifacts (no hedge, fails closed).

    Downloads
  • v1.28.1 d247db3569
    Compare

    v1.28.1: v1.29 P1 publish-pipeline — REQ-354 (ECR image + Lambda zip + GitHub Release)
    Nova Slides Render / render (push) Failing after 24s
    Details
    Stable

    coreci-bot released this 2026-08-20 05:07:34 +00:00 | 45 commits to main since this release

    v1.29 Phase 1 publish-pipeline. publish.yml rewritten: tag-triggered (v1.29.*), build-kj-image job (CGO_ENABLED=0 GOOS=linux GOARCH=amd64, KJ-STATIC file(1) gate asserts statically linked + no shared library, readelf -d no NEEDED), ECR tag v1.29.x-kj- (D-239: + invalid in ECR -> - separator), Lambda zip + layer wheel + Python wheel + ECR image URI/digest attached to GitHub Release with SHA-256. kj-version.txt updated with repo URL (CF-4: github.com/kyverno/kyverno-json, tag v0.0.3 -> commit 924a6af). M1.5 gate tests authored: test_abac_e2e.py (5 tests: ABAC allowed/denied/fail-closed, INV-17), test_kms_roundtrip.py (live_aws marker added).

    Downloads
  • v1.28.0 0789c27ca2
    Compare

    v1.28.0: v1.29 P0 pre-execution — Reposplit + Identity Layer Bring-Live
    Nova Slides Render / render (push) Failing after 14m27s
    Details
    Stable

    coreci-bot released this 2026-08-20 05:00:38 +00:00 | 47 commits to main since this release

    v1.29 Phase 0 pre-execution. SPECIFY: v1.29 spec validated (REQ-354..369 + 371 + 363b, D-232..238, INV-18). CLARIFY: 14 ambiguities resolved, scope split locked (Terraform out-of-band in nova-platform-ops), Q7 carry-forward. RESEARCH: 10 topics, D-239 (ECR tag +->-) + D-240 (Terraform precondition floor v1.2.0). PLAN: 6 phases (P1 publish, P2 scrub, P3 CFN archive, P4 operator guide, P5 consumer bump, P6 final). GRILL: PROCEED-WITH-CONDITIONS 0.72, 4 critical fixes. MVP/UX: 3 sections present.

    Downloads
  • v1.27.6 adc55a17ab
    Compare

    v1.28 — CLI Canonicalization + Identity Layer (milestone release)
    Nova Slides Render / render (push) Failing after 29s
    Details
    Stable

    cloudinit-bot released this 2026-08-19 23:47:44 +00:00 | 52 commits to main since this release

    v1.28 — CLI Canonicalization + Identity Layer

    Milestone release (tag v1.27.6 on the v1.27.x patch line, merged to main 2026-08-19).

    What shipped

    CLI Substrate (P1, REQ-323..328, CAP-033/034/035):

    • nova/ CLI package — 15 subcommands (argparse-only, auto-discovered, ≤50-line thin delegates to core/)
    • nova init scaffolds .nova/, .gitignore, .nova/contract.yml.attestations/
    • nova cli-action composite action (GitHub + Gitea, byte-identical, Python 3.12)
    • core/mode_resolver.py (flag → env → credential type → sys.stdin.isatty(), D-226)
    • INV-12 audit emission on every invocation
    • CodeArtifact wheel + Lambda layer publish pipeline (co-versioned, CAP-035)

    Lambda Packaging (P2, REQ-329..332):

    • Dual-use core/lambda/contract_ingestor.py (≥80% code share, Lambda + CLI)
    • core/env.synthesize_local_env() for nova apply --local
    • JWS-from-PAT via HKDF-SHA256 (HS256 symmetric, C-5.2 grill fix)

    Identity Layer — Auth (P3, REQ-333..335, CAP-036):

    • nova-idp-auth Lambda (sign-up, sign-in, session creation)
    • Argon2id (t=3, m=65536, p=1) — fail-closed on ImportError (D-228 amended)
    • 4 DynamoDB tables (nova-users, nova-sessions, nova-password-resets, nova-pats) + PITR

    Identity Layer — Token Vend + PAT (P4, REQ-336..344 + REQ-340/341, CAP-037/038):

    • nova-idp-token-vend Lambda — KMS-signed OIDC tokens (ECDSA P-256 / ES256, DER→raw conversion)
    • kyverno-json ABAC policy (platform/abac/token-vend.policy) — fail-closed (C-6.1, 7 tests, never fail open)
    • nova-idp-jwks Lambda (JWKS endpoint, AuthType: NONE, 1h cache, optional CloudFront/WAF)
    • PAT lifecycle (signed JWT, hash-only in DDB, strong-read revocation D-229, 60s SLO)
    • nova auth login/revoke/status (credentials.json 0600, OIDC token + metadata only — NOT raw PAT, C-7.3)
    • nova idp setup --check/--apply/--verify (CloudFormation template review, NFR-10 explicit approval)

    Docs + Integration (P5, REQ-345..351):

    • Operator guide (KMS rotation, layer update, PITR restore, emergency PAT revocation — C-6.3)
    • Developer guide (quickstart, mode resolution, JWS KDF, service-account PATs)
    • Threat model (8 threats + INV-18..21 compression audit — C-6.2, C-9.2)
    • E2E integration test (sign-up → sign-in → token-vend → apply → audit chain)

    Numbers

    • 31 requirements (REQ-323..353) — all complete
    • 6 capabilities (CAP-033..038) — all verified
    • 6 invariants (INV-12..17) — added to STATE.md
    • 6 decisions (D-226..231) — locked in CLARIFY
    • 7 phases (P0 pre-execution + P1..P5 execution + P6 final)
    • 1000 tests passing, 0 failures
    • Grill: PROCEED-WITH-CONDITIONS (0.76) — 3 critical fixes + 16 tracked conditions resolved
    • Audit: reconstruction PASS, commit/branch/file discipline CLEAN
    • Cost envelope: ~$9/month (default deployment)

    Phases

    • P0 pre-execution → v1.27.0 (release 796)
    • P1 cli-substrate → v1.27.1 (release 797)
    • P2 lambda-packaging → v1.27.2 (release 798)
    • P3 idp-auth → v1.27.3 (release 799)
    • P4 token-vend-pat → v1.27.4 (release 800)
    • P5 docs-integration → v1.27.5 (release 801)
    • P6 final-review-ship → v1.27.6 (this release = milestone release)

    ---ci---
    project: acdl
    phase: 6
    milestone: v1.28
    status: complete
    requirements:
    covered: [REQ-323..353]
    partial: []
    ---/ci---

    Downloads
  • v1.27.5 4697692ce7
    Compare

    v1.28 P5 — docs-integration
    Nova Slides Render / render (push) Failing after 26s
    Details
    Pre-Release

    cloudinit-bot released this 2026-08-19 23:34:11 +00:00 | 54 commits to main since this release

    P5 docs-integration complete. REQ-345..351. Operator guide (C-6.3), developer guide (C-7.3), threat model (C-6.2, C-9.2), E2E test (REQ-348). 1000 tests passing, 0 failures.

    Downloads
  • v1.27.4 f68349d94d
    Compare

    v1.28 P4 — token-vend-pat (highest-risk phase)
    Nova Slides Render / render (push) Failing after 28s
    Details
    Pre-Release

    cloudinit-bot released this 2026-08-19 23:17:31 +00:00 | 61 commits to main since this release

    P4 token-vend-pat complete. REQ-336..344 + REQ-340/341 (P5 folded). CAP-037/038 verified. ABAC fail-closed (C-6.1, 7 tests), KMS ES256 DER->raw, JWKS, PAT lifecycle, nova auth, nova idp setup. 54 P4 tests + 998 total passing. kj binary pinned (C-8.2).

    Downloads
  • v1.27.3 05bf8bf221
    Compare

    v1.28 P3 — idp-auth
    Nova Slides Render / render (push) Failing after 24s
    Details
    Pre-Release

    cloudinit-bot released this 2026-08-19 23:00:37 +00:00 | 71 commits to main since this release

    P3 idp-auth complete. REQ-333..335, CAP-036. nova-idp-auth Lambda (sign-up/sign-in/session), Argon2id t=3 m=65536 p=1 fail-closed (D-228), 4 DDB tables. 22 P3 tests + 944 total passing.

    Downloads
  • v1.27.2 a8ef1e8864
    Compare

    v1.28 P2 — lambda-packaging
    Nova Slides Render / render (push) Failing after 26s
    Details
    Pre-Release

    cloudinit-bot released this 2026-08-19 22:52:36 +00:00 | 77 commits to main since this release

    P2 lambda-packaging complete. REQ-329..332. Dual-use refactor, local env synthesizer, JWS-from-PAT HKDF (C-5.2), attestations dir. 43 P2 tests + 922 total passing.

    Downloads