Merge pull request 'docs(P00): .ciagent/STATE.md re-take — v1.1 phase 0 execution' (#12) from phase/00-pre-execution into main

Reviewed-on: #12
Reviewed-by: jonathan <jonathan@coreci.dev>

.ciagent/CHECKPOINT.json

@@ -1,25 +1,14 @@
 {
-  "phase": 5,
-  "stage": "verify",
-  "milestone": "v1.0",
-  "phase_role": "execution",
+  "phase": 0,
+  "stage": "specify",
+  "milestone": "v1.1",
+  "phase_role": "pre_execution",
   "attempts": 0,
-  "updated_at": "2026-08-20T20:45:00Z",
+  "updated_at": "2026-08-28T19:09:26Z",
   "project": "nova-platform",
-  "milestone_branch": "milestone/v1.0-nova-platform",
-  "phase_branch": "phase/05-shell-reproducibility-tests-docs",
-  "phase_0_ship": {"tag": "v0.1.0", "local_only": true},
-  "phase_1_ship": {"tag": "v0.1.1", "local_only": true},
-  "phase_2_ship": {"tag": "v0.1.2", "local_only": true},
-  "phase_3_ship": {"tag": "v0.1.3", "local_only": true},
-  "phase_4_ship": {"tag": "v0.1.4", "local_only": true},
-  "phase_5_verify": {
-    "tests_pass": true,
-    "tests_count": 76,
-    "reqs_covered": ["REQ-20", "REQ-21", "REQ-22", "REQ-29", "REQ-30", "REQ-31", "REQ-32", "REQ-33", "REQ-34", "REQ-35", "REQ-36", "REQ-37", "REQ-38"],
-    "happy_path_a": "run_platform.sh --check-only → === PLATFORM CHECK OK ===",
-    "happy_path_b": "run_ci.sh → === CI PIPELINE OK ===",
-    "ac_8_grep": "clean"
-  },
-  "next_phase": "phase/06-final-review-ship"
+  "milestone_branch": "milestone/v1.1-pdlc-state",
+  "phase_branch": "phase/00-pre-execution",
+  "milestone_complete": false,
+  "pdlc_intake": true,
+  "state_md_created": true
 }

.ciagent/ROADMAP.md

@@ -58,9 +58,12 @@ documented. Ships as `v0.1.5`.
 ### Phase 6 — Final Review + Ship (milestone release)
 
 REVIEW + AUDIT + milestone SHIP. Merges `phase/06` →
-`milestone/v1.0-nova-platform` → `main`. Tags `v1.0.0` (major — the
-initial release). Creates the Gitea release. Deletes all milestone
-branches.
+`milestone/v1.0-nova-platform` → `main`. Tags `v0.1.6` (the milestone
+release on the v0.1 patch line — v1.0 is the milestone *label*, tags
+run on the previous minor's patch line per branch-strategy.md; since
+there is no prior minor, v0.1.x is the patch line and v0.1.6 IS the
+v1.0 milestone release). Creates the Gitea release. Deletes all
+milestone branches.
 
 ## Coverage (init estimate — refined by PLAN)
 

.ciagent/STATE.md

@@ -0,0 +1,170 @@
+# STATE — Nova Platform
+
+> PDLC Phase 0 intake. Absolute ground truth as of 2026-08-28T19:09Z.
+> RE-TAKEN 2026-10-31T22:09Z — phase 0 execution of the ratified v1.1 plan (fresh single
+> pass by PO coreci-nova-po; ratification: coreci/nova-platform#11 comment
+> 16383, 2026-10-31T20:39:34Z). The 2026-08-28 intake text is preserved
+> below; every moved fact is marked (re-take) inline and catalogued in
+> §0 Re-take Deltas. Nothing is rewritten silently.
+> Single-pass discovery for the Product Owner/Manager.
+
+---
+
+## 0. Re-take Deltas (added by the phase 0 re-take; evidence ids on every move)
+
+This section is the phase 0 re-take delta record (PO coreci-nova-po,
+2026-10-31T22:09Z). The v1.1 five-phase plan is ratified in full
+(coreci/nova-platform#11, comment 16383, 2026-10-31T20:39:34Z); this
+refresh is that ratification's phase 0 execution work.
+
+Moved since 2026-08-28 (3 facts):
+
+1. Forge release — intake tension (1) reads "v0.1.6 shipped local-only,
+   gitea release pending". MOVED: release v0.1.6 EXISTS on the forge
+   (API-verified 2026-10-31: tag v0.1.6, created 2026-08-25T02:18:39Z).
+   No claim is made here about the .env.secrets token state.
+2. CI/CD — §3's "Local shell only; NO .github/workflows (OOS per
+   D-007)" is stale in fact: the repo carries .gitea/workflows/ci.yml
+   and main runs green (run 30, success, 2026-10-26T23:17:26Z — PR #9
+   merge commit 8a92f57b). The D-007 canon correction itself is phase-2
+   work and rides there as a dated addition; this re-take does not
+   rewrite any locked decision.
+3. Forge host/org — §3 names git.cloudinit.dev/continuous-intelligence;
+   the forge is now git.coreci.dev, repo coreci/nova-platform (verified
+   by the API host this re-take's reads answered on).
+
+Not moved since 2026-08-28 (verified 2026-10-31):
+
+- Environments: only core/environments/dev.json exists; qa/prod/dr still
+  resolve nowhere — phase 1's whole target, unchanged.
+- Coverage: pyproject.toml carries no coverage config and no pytest-cov
+  reference — RULED OUT of v1.1 (comment 16383); D-030 stands; if the
+  missing floor ever bites it reopens through its own lane.
+
+Rulings carried into the record by comment 16383 (same verdict):
+
+- NORTH_STAR.md stays OUT of v1.1 (gap noted for the next product
+  review, not minted mid-milestone).
+- Phase tag numbering stays with the product's own harness at phase 0.
+- Phase 4 (nova-bcx consumer unblock) shape DECIDED 2026-10-31 (hip's
+  comment 16379 on coreci/nova-platform#10): adapter option 1 mirror;
+  execution filed as MR coreci/nova-blockchain-exchange#3; the merge rides
+  the gate with no bypass (merge-path ruling comment 16503: the fleet lane
+  serves the runner plane via coreci/company#139) until a green nova-bcx
+  deploy run newer than 6210 lands.
+
+This re-take does NOT touch .ciagent/CHECKPOINT.json (the harness's own
+state file) and does NOT rewrite any locked decision. The original intake
+sections below are preserved as the 2026-08-28 record.
+
+---
+
+## 1. Header
+
+Project:            nova-platform
+Initiative:         PDLC Phase 0 — State Intake for next milestone planning
+Initiator:          CIAgent (automated harness)
+Date (UTC):         2026-08-28T19:09:26Z
+Current Version:    v1.0 milestone complete; release v0.1.6 on main; no active milestone in progress
+  (re-take 2026-10-31: milestone v1.1 is ACTIVE — five-phase plan ratified
+  2026-10-31T20:39:34Z, coreci/nova-platform#11 comment 16383; phase 0
+  execution is this re-take)
+System Health:      GREEN — 76/76 tests pass, engine boundary holds, zero OOS files, both happy paths green
+Raw Idea (≤ 3 sentences):
+  Nova Platform v1.0 shipped a simplified infrastructure-delivery platform (contract → resolve → terraform adapter → apply) derived from the Nova/acdl reference, with security/audit/identity/CI-workflow machinery deliberately excluded.
+  This intake was triggered by the PDLC system instruction to produce a STATE.md for the Product Owner to review before planning the next milestone.
+  The desired outcome is a single-pass ground-truth snapshot enabling the PO to ask pointed Phase 1 questions without back-and-forth.
+
+---
+
+## 2. Architecture State
+
+Active Layers (which exist and are stable):
+  [x] Core Primitives — 13 L1 modules: s3, vpc, ecs-cluster, ecs-service, iam-role, alb, ecr, cloudfront, waf, rds, kms-key, dynamodb, uptime
+  [x] Domain Modules  — 2 L2 patterns: microservice (vpc+ecs-cluster+ecs-service+iam-role+ecr+alb per D-038), static-assets (s3+cloudfront+kms-key per D-038)
+  [x] API/Dev Surface — contract schema (array infrastructure D-015), stack schema (flat, no source D-037), environment schema (simplified D-017/D-018); resolver (core/contract_resolver.py), environment_check (core/environment_check.py), terraform adapter (adapters/terraform/adapter.py)
+  [ ] UI/Agent Surface — N/A (no frontend, no agent UI; frontend-engineer persona deactivated per D-006)
+
+Compute Topology (per environment):
+  local:        abstract (offline --check-only: contract → resolve → adapter → validate; no AWS, no terraform binary)
+  dev:          serverless (ECS Fargate + ALB + S3 + CloudFront via terraform apply; platform-managed VPC in terraform/platform/)
+  staging:      N/A — UNKNOWN — needs investigation (no qa.json environment file created; only dev.json exists)
+  prod:         N/A — UNKNOWN — needs investigation (no prod.json environment file created)
+  dr:           N/A — UNKNOWN — needs investigation (no dr.json environment file created)
+
+Identity Stack in Force:
+  auth:         N/A — out of scope (Nova-idp, PAT lifecycle, ABAC evaluator explicitly OOS per D-007)
+  token-vend:   N/A — out of scope
+  signing:      N/A — out of scope (KMS signing, JWS attestation explicitly OOS)
+  session:      N/A — out of scope
+
+Audit Stream:
+  source of truth: N/A — out of scope (outbox writer, audit ledger, attestation matrix explicitly OOS per D-007)
+  in-repo fallback: no
+  retention policy: N/A
+
+---
+
+## 3. Technical Stack (concrete, not aspirational)
+
+Language(s) and runtime(s):       Python 3.11 (>=3.11 required per pyproject.toml); Bash (shell scripts); HCL (Terraform 1.9.* pinned)
+Build / packaging:                pyproject.toml (setuptools backend); no CLI package (D-027 — scripts invoked via shell, no [project.scripts]); requirements-test.txt pins 5 deps
+CI / CD:                          Local shell only (scripts/run_ci.sh: lint → test → check-only); NO .github/workflows (OOS per D-007); NO pipelines/ central contract (OOS)
+  (re-take 2026-10-31: stale — .gitea/workflows/ci.yml is live and main runs
+  green, run 30 success 2026-10-26T23:17:26Z, merge commit 8a92f57b; the
+  D-007 canon correction is phase-2, as a dated addition)
+Infrastructure:                   AWS (S3 state backend, DynamoDB lock table, ECS Fargate, ALB, CloudFront, WAF, RDS, KMS, ECR, IAM); terraform/bootstrap/ scripts create S3 bucket nova-tfstate-<account>-<region> + DynamoDB nova-tfstate-locks (D-022); only dev.json environment exists (account_id placeholder 000000000000 for offline)
+Data stores:                      S3 (state backend, static assets), DynamoDB (state locking — nova-tfstate-locks; also L1 dynamodb primitive for consumer tables), RDS (L1 rds primitive)
+Secrets / KMS:                    Static AWS key only (NOVA_AWS_* in .ciagent/.env.secrets, chmod 600, gitignored); NO OIDC (OOS per D-025); KMS via L1 kms-key primitive (consumer-side, not platform-side); NOVA_FORGE_TOKEN for gitea release (currently blank in .env.secrets — release pending)
+External integrations in scope:   gitea @ https://git.cloudinit.dev/continuous-intelligence/nova-platform (release forge; token NOVA_FORGE_TOKEN); AWS (boto3 for bootstrap scripts + terraform apply)
+  (re-take 2026-10-31: the forge is now git.coreci.dev, repo
+  coreci/nova-platform)
+
+---
+
+## 4. Active Constraints (the load-bearing ones)
+
+Locked Decisions:                 D-001 (milestone type major, first release), D-002 (all 13 L1 + 2 L2 in v1.0), D-003 (branching_strategy phase), D-004 (auto_commit/auto_push true), D-005 (test_first false), D-006 (personas: lead+data+backend active, frontend deactivated), D-007 (config.policy removed, ideation drops security), D-008 (secrets.scopes keeps forge + model-backend), D-009 (ship.confirm_before_ship true), D-010 (telemetry.persist true), D-011 (resolver modules_dir param, file reads permitted), D-012 (L2 opaque, flat stack, no children/wires expansion), D-013 (L2 interface.json + terraform_dir in registry), D-014 (interface.json: no nfrs, no intra_refs), D-015 (infrastructure is ARRAY, version optional), D-016 (interpolation ${env.*}/${contract.*} kept), D-017 (environment.schema.json kept simplified), D-018 (env fields: name/account_id/region/state_backend/network; no runner_role_arn/autonomy/confidence_threshold), D-019 (check() returns dict, raises EnvironmentNotFoundError), D-020 (run_platform.sh stages: check-only/plan-only/apply), D-021 (run_ci.sh glob py_compile), D-022 (lock table nova-tfstate-locks, NOT nova-outbox), D-023 (platform/main.tf = ONLY shared VPC), D-024 (ci-vpc = short-lived test VPC), D-025 (onboarding = IAM role cross-account assume, NOT OIDC, NOT user), D-026 (runner policy account parameterized, NOT hardcoded), D-027 (no CLI package, scripts only), D-028 (docs/modules/index links to modules/*/README.md), D-029 (drop STANDARDS.md, keep README-TEMPLATE.md trimmed), D-030 (moto pinned, minimal use), D-031 (run_platform.sh flags: --check-only/--plan-only/--quiet/--help only), D-032 (NOVA_* env prefix, NOVA_AWS_* → AWS_* copy then unset), D-033 (per-env contract variants differ ONLY in environment field), D-034 (engine-boundary test scans .py stripped of docstrings/comments), D-035 (index_document is L2 static-assets input, NOT L1 s3), D-036 (L2 children: microservice=vpc+ecs-cluster+ecs-service+iam-role+ecr+alb, static-assets=s3+cloudfront+kms-key), D-037 (adapter loads registry, no source in stack — grill C-1 fix), D-038 (L2 compositions locked, grill C-2 fix)
+
+Active Invariants:                No INV-* IDs formally registered (v1.0 used D-* decisions, not INV-* invariants). Load-bearing invariants: (1) engine-agnostic core — no aws_*/terraform/module "/provider "/resource " in .py outside adapters/terraform/ (verified by tests/test_engine_boundary.py); (2) structural conventions preserved with 9 locked deviations (D-012, D-013, D-015, D-017, D-018, D-019, D-022, D-023, D-025, D-027); (3) no OOS-creep — zero files from the PROJECT.md/REQUIREMENTS.md OOS list exist in the repo.
+
+Standing Capability Gate:         N/A — no GATE-* IDs registered
+
+Anti-Goals Touched:               PROJECT.md §"Out of scope" + REQUIREMENTS.md §"Out of scope (locked — do NOT implement in v1.0)": security/policy (kyverno, Wiz, Checkov, PolicyEngine), confidence signal + evidence outbox, identity/ABAC (Nova-idp, PAT, JWS, KMS signing, SoD, HITL, attestation, submission_readiness), CI/CD pipeline (.github/workflows, pipelines/, pipeline schemas), metrics/telemetry, leadership decks, decommission/env_transition/mode_resolver/onboarding flow beyond bootstrap, multi-project mode, OIDC federation.
+
+Out-of-Scope (hard):              kyverno-json adapter, Wiz adapter, Checkov custom rules, core/policy_engine.py, core/confidence_signal.py, core/outbox_writer.py, schemas/policy_check_result.schema.json, schemas/metrics_*.schema.json, audit ledger, attestation matrix, core/abac_evaluator.py, core/auth_store.py, core/jws_attestation.py, core/kms_signing.py, core/pat_lifecycle.py, core/separation_of_duties.py, core/hitl_gates.py, core/attestation_matrix.py, core/submission_readiness.py, .github/workflows/ci.yml, .github/workflows/deploy.yml, pipelines/, schemas/pipeline.schema.json, schemas/deploy-pipeline.schema.json, metrics/, core/metrics/, core/regression_verify*.py, modules/STANDARDS.md, PPTX/marp slides, core/env_transition.py, core/decommission_transform.py, core/mode_resolver.py, core/onboarding.py, OIDC federation.
+
+---
+
+## 5. Recent History & Quality Gates (last 1-2 milestones)
+
+Last Shipped:       v1.0 milestone — 2026-08-25 (tag v0.1.6 on main); delivered: simplified infrastructure-delivery platform with 13 L1 + 2 L2 modules, contract surface, resolver, terraform adapter, engine boundary, 5 terraform roots, bootstrap scripts, shell reproducibility, 76 tests, docs; 38 REQ-IDs all complete; 38 decisions (D-001..D-038)
+In Progress:        No active milestone in progress (v1.0 complete; checkpoint cleared; next /ci-run starts a new milestone)
+Coverage Floor:     UNKNOWN — needs investigation (pytest-cov not installed; no coverage measurement configured in pyproject.toml addopts; D-030 dropped pytest-cov as OOS)
+Recent Incidents:   none
+Known Tensions:     (1) NOVA_FORGE_TOKEN blank in .ciagent/.env.secrets — v0.1.6 shipped local-only (tag + merge complete, gitea release pending); the forge repo was created during this intake but the token must be set before releases can be created. (2) Only dev.json environment exists — qa/prod/dr environment files were not created in v1.0 (contracts reference them via enum but environment_check will raise EnvironmentNotFoundError for qa/prod/dr). (3) Coverage measurement is absent — pytest-cov was dropped as OOS but this means no coverage floor is enforceable.
+  (re-take 2026-10-31: (1) release v0.1.6 EXISTS on the forge (created
+  2026-08-25T02:18:39Z, API-verified) — release pending is resolved; the
+  .env.secrets token state is not re-asserted from this seat. (2) unmoved —
+  phase 1. (3) unmoved — ruled OUT of v1.1 (comment 16383); D-030 stands.)
+
+---
+
+## 6. Agent Context & Assumptions (Agent Initiators Only)
+
+Missing Context:    (1) qa/prod/dr environment JSON files — not created in v1.0 (only core/environments/dev.json exists); the contract schema allows these environment values but no environment record exists for them. (2) Coverage percentage — pytest-cov is not installed; no coverage data available. (3) NORTH_STAR.md — not created (the reference acdl has one; nova-platform deferred it to a future /ci-run specify stage). (4) Live AWS verification — bootstrap scripts + terraform roots were authored but never applied against real AWS (offline-only verification via --check-only).
+  (re-take 2026-10-31: (1) unmoved — phase 1. (2) unmoved — ruled out of
+  v1.1 (comment 16383). (3) unmoved as a v1.1 item — ruled out (comment
+  16383). (4) unmoved — phase 3; no live-apply evidence exists today.)
+
+Agent Assumptions:  (1) Assumed the gitea forge token from the acdl reference repo (/home/opencode/acdl/.env.secrets) is valid for the nova-platform org — verified via API (200 auth). (2) Assumed the next milestone is v1.1 (incrementing from v1.0) — no ROADMAP.md entry exists for a next milestone yet. (3) Assumed PDLC Phase 0 STATE.md work belongs on a new milestone/phase-0 branch hierarchy (milestone/v1.1-pdlc-state → phase/00-pre-execution) per the branch gate convention. (4) Assumed "merge to the forge upstream but DO NOT perform a release" means: push main + branches to origin, do NOT create a gitea release (no tag push, no release API call).
+
+---
+
+## 7. Canonical State References (Version/Hash)
+
+Vision/Strategy doc:      UNKNOWN — needs investigation (NORTH_STAR.md not created; PROJECT.md §"Vision / Core Value" serves as the de facto vision but is not versioned as a strategy doc)
+Architecture document:    v0.1.6 (tag on main commit fe9ab7e); .ciagent/ARCHITECTURE.md + docs/architecture.md are the architecture source of truth
+Last approved SPEC:       N/A — no SPEC-ID system in use; REQUIREMENTS.md (38 REQ-IDs, REQ-01..REQ-38) is the requirements source of truth at commit fe9ab7e
+Decision log:             fe9ab7e (last synced commit on main); decisions D-001..D-035 in .ciagent/CLARIFY.md; D-036..D-038 (grill fixes) in .ciagent/CLARIFY.md §"Grill fixes"; D-001..D-010 also in .ciagent/PROJECT.md
+Invariants catalog:       N/A — no INV-* IDs formally registered; load-bearing invariants documented in STATE.md §4 above

.gitea/workflows/ci.yml

@@ -0,0 +1,78 @@
+# nova-platform CI — offline mirror of scripts/run_ci.sh (task order coreci/nova-platform#3, hip c12363)
+#
+# Stages mirror the local CI script: lint (py_compile) -> test (pytest,
+# not shell markers) -> check-only (run_platform.sh --check-only).
+# Every leg either runs for real or fails loud with its reason — no leg
+# is skipped silently and nothing skipped is presented as passed.
+name: CI
+
+on:
+  push:
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+jobs:
+  ci:
+    runs-on: ubuntu-latest
+    steps:
+      - name: "fetch (probe: stock actions/checkout@v4)"
+        id: actfetch
+        continue-on-error: true
+        uses: actions/checkout@v4
+      - name: fetch (git-clone fallback, run token)
+        if: ${{ steps.actfetch.outcome == 'failure' }}
+        run: |
+          set -euo pipefail
+          REF="${GITHUB_HEAD_REF:-${GITHUB_REF_NAME}}"
+          git clone --depth 1 -b "$REF" "https://coreci-nova-po:${{ secrets.GITEA_TOKEN }}@git.coreci.dev/${{ github.repository }}.git" .
+      - name: toolchain probe (reports; never gates)
+        run: |
+          set -u
+          python3 --version
+          python3 -m pytest --version 2>/dev/null || echo "pytest: ABSENT"
+          for m in yaml jsonschema boto3 moto; do
+            python3 -c "import $m" 2>/dev/null && echo "$m: OK" || echo "$m: ABSENT"
+          done
+          timeout 25 pip download --no-deps --dest /tmp/piptest pytest >/dev/null 2>&1 && echo "pypi: REACHABLE" || echo "pypi: UNREACHABLE"
+      - name: deps (requirements-test.txt when pypi reachable)
+        run: |
+          if timeout 25 pip download --no-deps --dest /tmp/piptest pytest >/dev/null 2>&1; then
+            pip install -q -r requirements-test.txt && echo "deps: installed from requirements-test.txt"
+          else
+            echo "deps: pypi UNREACHABLE - proceeding on the runner's preinstalled toolchain only"
+          fi
+      - name: lint (stage 1/3 - py_compile, stdlib-only)
+        run: |
+          set -euo pipefail
+          python3 -m py_compile $(find core/ adapters/ scripts/ -name '*.py' -not -path '*/__pycache__/*')
+          echo "lint: OK"
+      - name: test (stage 2/3 - pytest, offline markers)
+        run: |
+          set -euo pipefail
+          MISSING=""
+          python3 -m pytest --version >/dev/null 2>&1 || MISSING="$MISSING pytest"
+          for m in yaml jsonschema boto3 moto; do
+            python3 -c "import $m" 2>/dev/null || MISSING="$MISSING $m"
+          done
+          if [ -n "$MISSING" ]; then
+            echo "FAIL: test leg cannot run - toolchain absent on runner vantage:$MISSING" >&2
+            exit 1
+          fi
+          python3 -m pytest tests/ -q --tb=short -m "not shell"
+          echo "test: OK"
+      - name: check-only (stage 3/3 - run_platform.sh --check-only)
+        run: |
+          set -euo pipefail
+          MISSING=""
+          for m in yaml jsonschema; do
+            python3 -c "import $m" 2>/dev/null || MISSING="$MISSING $m"
+          done
+          if [ -n "$MISSING" ]; then
+            echo "FAIL: check-only leg cannot run - toolchain absent on runner vantage:$MISSING" >&2
+            exit 1
+          fi
+          bash scripts/run_platform.sh --check-only contracts/static-assets.yml
+          echo "check-only: OK"
+      - name: summary
+        run: 'echo "=== CI stages complete: lint, test, check-only ==="'

README.md

@@ -5,6 +5,29 @@
 > it through the Terraform adapter, and applies it. Every deployment is
 > reproducible from the shell, not just in CI.
 
+**TL;DR** — Nova Platform turns a small YAML contract into AWS
+infrastructure: declare modules and inputs, and the platform resolves the
+contract, compiles Terraform, and applies it. The last tagged release
+(v0.1.6) predates CoreCI adoption; nothing has shipped under CoreCI yet.
+
+**What** —
+- One contract file per deployment: module names and versions,
+  environment, and module-specific inputs.
+- The platform resolves the contract to a stack, compiles it through the
+  Terraform adapter, and applies it.
+- Offline checks ship in the repo: `bash scripts/run_ci.sh` runs lint,
+  tests, and a check-only pass — no AWS required.
+
+**Why** — Contract-driven deploys are reproducible and auditable; a
+consumer never writes infrastructure code.
+
+**Action** — No action — FYI. Consumers start at
+[`docs/consumer-guide.md`](docs/consumer-guide.md); the product owner is
+coreci-nova-po.
+
+**Details** — Design: [`docs/architecture.md`](docs/architecture.md);
+runbook: "How to run" below.
+
 Nova Platform is the **infrastructure-delivery core** of the Nova model.
 The DevSecOps, identity, audit-ledger, and central CI-pipeline-contract
 machinery of the reference are intentionally removed. What remains: a

docs/ci.md

@@ -0,0 +1,26 @@
+# Continuous integration - nova-platform
+
+**TL;DR -** Every push and every pull request to `main` runs the CI
+workflow (`.gitea/workflows/ci.yml`). It is the offline mirror of
+`scripts/run_ci.sh`: lint, test, check-only. A leg that cannot run fails
+loud - nothing skipped is reported as passed.
+
+**What** -
+
+- **lint** - `python3 -m py_compile` over `core/`, `adapters/`, `scripts/`
+  (stdlib only, always runs).
+- **test** - `pytest tests/ -q -m "not shell"`, with the test dependencies
+  from `requirements-test.txt` installed first when pypi is reachable; a
+  missing toolchain fails the leg with its absence list.
+- **check-only** - `bash scripts/run_platform.sh --check-only
+  contracts/static-assets.yml` (needs `yaml` + `jsonschema`).
+
+**Why** - the line shipped without a pipeline, so every change went out
+ungated. The workflow runs the same three legs as the local script, so a
+green local run and a green pipeline mean the same thing.
+
+**Action** - none - FYI. The pipeline was ordered under
+`coreci/nova-platform#3`; the workflow itself landed in PR #6.
+
+**Details** - local equivalent: `bash scripts/run_ci.sh`. Run history:
+the repository's Actions tab.

docs/consumer-guide.md

@@ -1,5 +1,25 @@
 # Consumer Guide — Declare intent, deploy to AWS
 
+**TL;DR** — This guide takes a consumer from an empty repository to
+applied AWS infrastructure: create a repo, write one YAML contract,
+validate offline, then run the platform script against AWS.
+
+**What** —
+- Step-by-step contract authoring with a worked static-site example,
+  generic across all modules.
+- A field-by-field reference for contract and module inputs.
+- Offline validation first (no AWS); the live AWS run second.
+
+**Why** — The contract is the whole consumer interface; infrastructure
+code stays platform-side.
+
+**Action** — No action — FYI. Follow Steps 1-6 below when ready to
+deploy.
+
+**Details** — The platform README (commands and credentials);
+[`docs/contracts/`](contracts/index.md) (contract shapes).
+
+
 This guide walks a consumer through creating a repo, writing a contract,
 validating it offline, and running it against AWS. It is **generic** across
 all modules in the registry; `static-assets` is the worked example, but

modules/README.md

@@ -1,5 +1,11 @@
 # Nova Modules
 
+**TL;DR** — Nova's module library: two tiers of engine-agnostic modules,
+whose contract is declared in `interface.json` and translated by an adapter
+(Terraform today) to concrete infrastructure. This file explains how
+modules compose and how to add one; the L1/L2 tables and adapter detail
+follow below.
+
 Nova ships a two-tier module library. Modules are **engine-agnostic**:
 their contract is declared in `interface.json` (stack types like
 `aws:s3:bucket`), and an adapter translates the contract to a concrete