Merge pull request 'docs(P00): .ciagent/STATE.md re-take — v1.1 phase 0 execution' (#12) from phase/00-pre-execution into main

Reviewed-on: #12
Reviewed-by: jonathan <jonathan@coreci.dev>

.ciagent/STATE.md

@@ -1,10 +1,64 @@
 # STATE — Nova Platform
 
 > PDLC Phase 0 intake. Absolute ground truth as of 2026-08-28T19:09Z.
+> RE-TAKEN 2026-10-31T22:09Z — phase 0 execution of the ratified v1.1 plan (fresh single
+> pass by PO coreci-nova-po; ratification: coreci/nova-platform#11 comment
+> 16383, 2026-10-31T20:39:34Z). The 2026-08-28 intake text is preserved
+> below; every moved fact is marked (re-take) inline and catalogued in
+> §0 Re-take Deltas. Nothing is rewritten silently.
 > Single-pass discovery for the Product Owner/Manager.
 
 ---
 
+## 0. Re-take Deltas (added by the phase 0 re-take; evidence ids on every move)
+
+This section is the phase 0 re-take delta record (PO coreci-nova-po,
+2026-10-31T22:09Z). The v1.1 five-phase plan is ratified in full
+(coreci/nova-platform#11, comment 16383, 2026-10-31T20:39:34Z); this
+refresh is that ratification's phase 0 execution work.
+
+Moved since 2026-08-28 (3 facts):
+
+1. Forge release — intake tension (1) reads "v0.1.6 shipped local-only,
+   gitea release pending". MOVED: release v0.1.6 EXISTS on the forge
+   (API-verified 2026-10-31: tag v0.1.6, created 2026-08-25T02:18:39Z).
+   No claim is made here about the .env.secrets token state.
+2. CI/CD — §3's "Local shell only; NO .github/workflows (OOS per
+   D-007)" is stale in fact: the repo carries .gitea/workflows/ci.yml
+   and main runs green (run 30, success, 2026-10-26T23:17:26Z — PR #9
+   merge commit 8a92f57b). The D-007 canon correction itself is phase-2
+   work and rides there as a dated addition; this re-take does not
+   rewrite any locked decision.
+3. Forge host/org — §3 names git.cloudinit.dev/continuous-intelligence;
+   the forge is now git.coreci.dev, repo coreci/nova-platform (verified
+   by the API host this re-take's reads answered on).
+
+Not moved since 2026-08-28 (verified 2026-10-31):
+
+- Environments: only core/environments/dev.json exists; qa/prod/dr still
+  resolve nowhere — phase 1's whole target, unchanged.
+- Coverage: pyproject.toml carries no coverage config and no pytest-cov
+  reference — RULED OUT of v1.1 (comment 16383); D-030 stands; if the
+  missing floor ever bites it reopens through its own lane.
+
+Rulings carried into the record by comment 16383 (same verdict):
+
+- NORTH_STAR.md stays OUT of v1.1 (gap noted for the next product
+  review, not minted mid-milestone).
+- Phase tag numbering stays with the product's own harness at phase 0.
+- Phase 4 (nova-bcx consumer unblock) shape DECIDED 2026-10-31 (hip's
+  comment 16379 on coreci/nova-platform#10): adapter option 1 mirror;
+  execution filed as MR coreci/nova-blockchain-exchange#3; the merge rides
+  the gate with no bypass (merge-path ruling comment 16503: the fleet lane
+  serves the runner plane via coreci/company#139) until a green nova-bcx
+  deploy run newer than 6210 lands.
+
+This re-take does NOT touch .ciagent/CHECKPOINT.json (the harness's own
+state file) and does NOT rewrite any locked decision. The original intake
+sections below are preserved as the 2026-08-28 record.
+
+---
+
 ## 1. Header
 
 Project:            nova-platform
@@ -12,6 +66,9 @@ Initiative:         PDLC Phase 0 — State Intake for next milestone planning
 Initiator:          CIAgent (automated harness)
 Date (UTC):         2026-08-28T19:09:26Z
 Current Version:    v1.0 milestone complete; release v0.1.6 on main; no active milestone in progress
+  (re-take 2026-10-31: milestone v1.1 is ACTIVE — five-phase plan ratified
+  2026-10-31T20:39:34Z, coreci/nova-platform#11 comment 16383; phase 0
+  execution is this re-take)
 System Health:      GREEN — 76/76 tests pass, engine boundary holds, zero OOS files, both happy paths green
 Raw Idea (≤ 3 sentences):
   Nova Platform v1.0 shipped a simplified infrastructure-delivery platform (contract → resolve → terraform adapter → apply) derived from the Nova/acdl reference, with security/audit/identity/CI-workflow machinery deliberately excluded.
@@ -53,10 +110,15 @@ Audit Stream:
 Language(s) and runtime(s):       Python 3.11 (>=3.11 required per pyproject.toml); Bash (shell scripts); HCL (Terraform 1.9.* pinned)
 Build / packaging:                pyproject.toml (setuptools backend); no CLI package (D-027 — scripts invoked via shell, no [project.scripts]); requirements-test.txt pins 5 deps
 CI / CD:                          Local shell only (scripts/run_ci.sh: lint → test → check-only); NO .github/workflows (OOS per D-007); NO pipelines/ central contract (OOS)
+  (re-take 2026-10-31: stale — .gitea/workflows/ci.yml is live and main runs
+  green, run 30 success 2026-10-26T23:17:26Z, merge commit 8a92f57b; the
+  D-007 canon correction is phase-2, as a dated addition)
 Infrastructure:                   AWS (S3 state backend, DynamoDB lock table, ECS Fargate, ALB, CloudFront, WAF, RDS, KMS, ECR, IAM); terraform/bootstrap/ scripts create S3 bucket nova-tfstate-<account>-<region> + DynamoDB nova-tfstate-locks (D-022); only dev.json environment exists (account_id placeholder 000000000000 for offline)
 Data stores:                      S3 (state backend, static assets), DynamoDB (state locking — nova-tfstate-locks; also L1 dynamodb primitive for consumer tables), RDS (L1 rds primitive)
 Secrets / KMS:                    Static AWS key only (NOVA_AWS_* in .ciagent/.env.secrets, chmod 600, gitignored); NO OIDC (OOS per D-025); KMS via L1 kms-key primitive (consumer-side, not platform-side); NOVA_FORGE_TOKEN for gitea release (currently blank in .env.secrets — release pending)
 External integrations in scope:   gitea @ https://git.cloudinit.dev/continuous-intelligence/nova-platform (release forge; token NOVA_FORGE_TOKEN); AWS (boto3 for bootstrap scripts + terraform apply)
+  (re-take 2026-10-31: the forge is now git.coreci.dev, repo
+  coreci/nova-platform)
 
 ---
 
@@ -81,12 +143,19 @@ In Progress:        No active milestone in progress (v1.0 complete; checkpoint c
 Coverage Floor:     UNKNOWN — needs investigation (pytest-cov not installed; no coverage measurement configured in pyproject.toml addopts; D-030 dropped pytest-cov as OOS)
 Recent Incidents:   none
 Known Tensions:     (1) NOVA_FORGE_TOKEN blank in .ciagent/.env.secrets — v0.1.6 shipped local-only (tag + merge complete, gitea release pending); the forge repo was created during this intake but the token must be set before releases can be created. (2) Only dev.json environment exists — qa/prod/dr environment files were not created in v1.0 (contracts reference them via enum but environment_check will raise EnvironmentNotFoundError for qa/prod/dr). (3) Coverage measurement is absent — pytest-cov was dropped as OOS but this means no coverage floor is enforceable.
+  (re-take 2026-10-31: (1) release v0.1.6 EXISTS on the forge (created
+  2026-08-25T02:18:39Z, API-verified) — release pending is resolved; the
+  .env.secrets token state is not re-asserted from this seat. (2) unmoved —
+  phase 1. (3) unmoved — ruled OUT of v1.1 (comment 16383); D-030 stands.)
 
 ---
 
 ## 6. Agent Context & Assumptions (Agent Initiators Only)
 
 Missing Context:    (1) qa/prod/dr environment JSON files — not created in v1.0 (only core/environments/dev.json exists); the contract schema allows these environment values but no environment record exists for them. (2) Coverage percentage — pytest-cov is not installed; no coverage data available. (3) NORTH_STAR.md — not created (the reference acdl has one; nova-platform deferred it to a future /ci-run specify stage). (4) Live AWS verification — bootstrap scripts + terraform roots were authored but never applied against real AWS (offline-only verification via --check-only).
+  (re-take 2026-10-31: (1) unmoved — phase 1. (2) unmoved — ruled out of
+  v1.1 (comment 16383). (3) unmoved as a v1.1 item — ruled out (comment
+  16383). (4) unmoved — phase 3; no live-apply evidence exists today.)
 
 Agent Assumptions:  (1) Assumed the gitea forge token from the acdl reference repo (/home/opencode/acdl/.env.secrets) is valid for the nova-platform org — verified via API (200 auth). (2) Assumed the next milestone is v1.1 (incrementing from v1.0) — no ROADMAP.md entry exists for a next milestone yet. (3) Assumed PDLC Phase 0 STATE.md work belongs on a new milestone/phase-0 branch hierarchy (milestone/v1.1-pdlc-state → phase/00-pre-execution) per the branch gate convention. (4) Assumed "merge to the forge upstream but DO NOT perform a release" means: push main + branches to origin, do NOT create a gitea release (no tag push, no release API call).
 

.gitea/workflows/ci.yml

@@ -14,7 +14,7 @@ on:
 
 jobs:
   ci:
-    runs-on: node
+    runs-on: ubuntu-latest
     steps:
       - name: "fetch (probe: stock actions/checkout@v4)"
         id: actfetch

.gitea/workflows/probe-ubuntu.yml

@@ -1,23 +0,0 @@
-name: "toolchain probe (ubuntu-latest)"
-on:
-  push:
-  workflow_dispatch:
-
-jobs:
-  probe:
-    runs-on: ubuntu-latest
-    steps:
-      - name: "probe toolchain and egress"
-        run: |
-          set -u
-          echo "whoami: $(whoami)"
-          echo "uname: $(uname -a)"
-          echo "runner_labels: ${RUNNER_LABELS:-unset}"
-          python3 --version 2>/dev/null || echo "python3: ABSENT"
-          python3 -m pytest --version 2>/dev/null || echo "pytest: ABSENT"
-          for m in yaml jsonschema boto3 moto; do
-            python3 -c "import $m" 2>/dev/null && echo "$m: OK" || echo "$m: ABSENT"
-          done
-          timeout 25 pip download --no-deps --dest /tmp/piptest pytest >/dev/null 2>&1 && echo "pypi: REACHABLE" || echo "pypi: UNREACHABLE"
-          timeout 20 curl -sS -o /dev/null -w "pypi_index_http: %{http_code}\n" https://pypi.org/simple/pytest/ 2>/dev/null || echo "curl_to_pypi: FAILED"
-          timeout 20 curl -sS -o /dev/null -w "github_http: %{http_code}\n" https://github.com 2>/dev/null || echo "curl_to_github: FAILED"