From f8cf46b94c1149d24691b63c611ae55e552cf970 Mon Sep 17 00:00:00 2001 From: CIAgent Date: Fri, 28 Aug 2026 19:19:03 +0000 Subject: [PATCH 1/5] =?UTF-8?q?docs(P00):=20PDLC=20state=20intake=20?= =?UTF-8?q?=E2=80=94=20STATE.md=20created?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ---ci--- project: nova-platform phase: 0 milestone: v1.1 status: specify ---/ci--- PDLC Phase 0 state intake. STATE.md populated with absolute ground truth: architecture state (13 L1 + 2 L2 modules, 4-layer architecture), technical stack (Python 3.11, Terraform 1.9, bash scripts), 38 locked decisions (D-001..D-038), active constraints, recent history (v1.0 complete, v0.1.6), known tensions (forge token blank, only dev.json env, no coverage), agent assumptions. --- .ciagent/CHECKPOINT.json | 27 ++++------- .ciagent/STATE.md | 101 +++++++++++++++++++++++++++++++++++++++ 2 files changed, 111 insertions(+), 17 deletions(-) create mode 100644 .ciagent/STATE.md diff --git a/.ciagent/CHECKPOINT.json b/.ciagent/CHECKPOINT.json index 0e5ab9d..09bb231 100644 --- a/.ciagent/CHECKPOINT.json +++ b/.ciagent/CHECKPOINT.json @@ -1,21 +1,14 @@ { - "phase": 6, - "stage": "complete", - "milestone": "v1.0", - "phase_role": "final", + "phase": 0, + "stage": "specify", + "milestone": "v1.1", + "phase_role": "pre_execution", "attempts": 0, - "updated_at": "2026-08-20T21:00:00Z", + "updated_at": "2026-08-28T19:09:26Z", "project": "nova-platform", - "milestone_branch": null, - "phase_branch": null, - "milestone_complete": true, - "milestone_tag": "v0.1.6", - "merged_to_main": true, - "branches_deleted": true, - "local_only": true, - "release_pending": "NOVA_FORGE_TOKEN blank", - "tests_pass": true, - "tests_count": 76, - "reqs_covered": ["REQ-01","REQ-02","REQ-03","REQ-04","REQ-05","REQ-06","REQ-07","REQ-08","REQ-09","REQ-10","REQ-11","REQ-12","REQ-13","REQ-14","REQ-15","REQ-16","REQ-17","REQ-18","REQ-19","REQ-20","REQ-21","REQ-22","REQ-23","REQ-24","REQ-25","REQ-26","REQ-27","REQ-28","REQ-29","REQ-30","REQ-31","REQ-32","REQ-33","REQ-34","REQ-35","REQ-36","REQ-37","REQ-38"], - "next": "milestone complete — next /ci-run starts a new milestone" + "milestone_branch": "milestone/v1.1-pdlc-state", + "phase_branch": "phase/00-pre-execution", + "milestone_complete": false, + "pdlc_intake": true, + "state_md_created": true } \ No newline at end of file diff --git a/.ciagent/STATE.md b/.ciagent/STATE.md new file mode 100644 index 0000000..c89b9af --- /dev/null +++ b/.ciagent/STATE.md @@ -0,0 +1,101 @@ +# STATE — Nova Platform + +> PDLC Phase 0 intake. Absolute ground truth as of 2026-08-28T19:09Z. +> Single-pass discovery for the Product Owner/Manager. + +--- + +## 1. Header + +Project: nova-platform +Initiative: PDLC Phase 0 — State Intake for next milestone planning +Initiator: CIAgent (automated harness) +Date (UTC): 2026-08-28T19:09:26Z +Current Version: v1.0 milestone complete; release v0.1.6 on main; no active milestone in progress +System Health: GREEN — 76/76 tests pass, engine boundary holds, zero OOS files, both happy paths green +Raw Idea (≤ 3 sentences): + Nova Platform v1.0 shipped a simplified infrastructure-delivery platform (contract → resolve → terraform adapter → apply) derived from the Nova/acdl reference, with security/audit/identity/CI-workflow machinery deliberately excluded. + This intake was triggered by the PDLC system instruction to produce a STATE.md for the Product Owner to review before planning the next milestone. + The desired outcome is a single-pass ground-truth snapshot enabling the PO to ask pointed Phase 1 questions without back-and-forth. + +--- + +## 2. Architecture State + +Active Layers (which exist and are stable): + [x] Core Primitives — 13 L1 modules: s3, vpc, ecs-cluster, ecs-service, iam-role, alb, ecr, cloudfront, waf, rds, kms-key, dynamodb, uptime + [x] Domain Modules — 2 L2 patterns: microservice (vpc+ecs-cluster+ecs-service+iam-role+ecr+alb per D-038), static-assets (s3+cloudfront+kms-key per D-038) + [x] API/Dev Surface — contract schema (array infrastructure D-015), stack schema (flat, no source D-037), environment schema (simplified D-017/D-018); resolver (core/contract_resolver.py), environment_check (core/environment_check.py), terraform adapter (adapters/terraform/adapter.py) + [ ] UI/Agent Surface — N/A (no frontend, no agent UI; frontend-engineer persona deactivated per D-006) + +Compute Topology (per environment): + local: abstract (offline --check-only: contract → resolve → adapter → validate; no AWS, no terraform binary) + dev: serverless (ECS Fargate + ALB + S3 + CloudFront via terraform apply; platform-managed VPC in terraform/platform/) + staging: N/A — UNKNOWN — needs investigation (no qa.json environment file created; only dev.json exists) + prod: N/A — UNKNOWN — needs investigation (no prod.json environment file created) + dr: N/A — UNKNOWN — needs investigation (no dr.json environment file created) + +Identity Stack in Force: + auth: N/A — out of scope (Nova-idp, PAT lifecycle, ABAC evaluator explicitly OOS per D-007) + token-vend: N/A — out of scope + signing: N/A — out of scope (KMS signing, JWS attestation explicitly OOS) + session: N/A — out of scope + +Audit Stream: + source of truth: N/A — out of scope (outbox writer, audit ledger, attestation matrix explicitly OOS per D-007) + in-repo fallback: no + retention policy: N/A + +--- + +## 3. Technical Stack (concrete, not aspirational) + +Language(s) and runtime(s): Python 3.11 (>=3.11 required per pyproject.toml); Bash (shell scripts); HCL (Terraform 1.9.* pinned) +Build / packaging: pyproject.toml (setuptools backend); no CLI package (D-027 — scripts invoked via shell, no [project.scripts]); requirements-test.txt pins 5 deps +CI / CD: Local shell only (scripts/run_ci.sh: lint → test → check-only); NO .github/workflows (OOS per D-007); NO pipelines/ central contract (OOS) +Infrastructure: AWS (S3 state backend, DynamoDB lock table, ECS Fargate, ALB, CloudFront, WAF, RDS, KMS, ECR, IAM); terraform/bootstrap/ scripts create S3 bucket nova-tfstate-- + DynamoDB nova-tfstate-locks (D-022); only dev.json environment exists (account_id placeholder 000000000000 for offline) +Data stores: S3 (state backend, static assets), DynamoDB (state locking — nova-tfstate-locks; also L1 dynamodb primitive for consumer tables), RDS (L1 rds primitive) +Secrets / KMS: Static AWS key only (NOVA_AWS_* in .ciagent/.env.secrets, chmod 600, gitignored); NO OIDC (OOS per D-025); KMS via L1 kms-key primitive (consumer-side, not platform-side); NOVA_FORGE_TOKEN for gitea release (currently blank in .env.secrets — release pending) +External integrations in scope: gitea @ https://git.cloudinit.dev/continuous-intelligence/nova-platform (release forge; token NOVA_FORGE_TOKEN); AWS (boto3 for bootstrap scripts + terraform apply) + +--- + +## 4. Active Constraints (the load-bearing ones) + +Locked Decisions: D-001 (milestone type major, first release), D-002 (all 13 L1 + 2 L2 in v1.0), D-003 (branching_strategy phase), D-004 (auto_commit/auto_push true), D-005 (test_first false), D-006 (personas: lead+data+backend active, frontend deactivated), D-007 (config.policy removed, ideation drops security), D-008 (secrets.scopes keeps forge + model-backend), D-009 (ship.confirm_before_ship true), D-010 (telemetry.persist true), D-011 (resolver modules_dir param, file reads permitted), D-012 (L2 opaque, flat stack, no children/wires expansion), D-013 (L2 interface.json + terraform_dir in registry), D-014 (interface.json: no nfrs, no intra_refs), D-015 (infrastructure is ARRAY, version optional), D-016 (interpolation ${env.*}/${contract.*} kept), D-017 (environment.schema.json kept simplified), D-018 (env fields: name/account_id/region/state_backend/network; no runner_role_arn/autonomy/confidence_threshold), D-019 (check() returns dict, raises EnvironmentNotFoundError), D-020 (run_platform.sh stages: check-only/plan-only/apply), D-021 (run_ci.sh glob py_compile), D-022 (lock table nova-tfstate-locks, NOT nova-outbox), D-023 (platform/main.tf = ONLY shared VPC), D-024 (ci-vpc = short-lived test VPC), D-025 (onboarding = IAM role cross-account assume, NOT OIDC, NOT user), D-026 (runner policy account parameterized, NOT hardcoded), D-027 (no CLI package, scripts only), D-028 (docs/modules/index links to modules/*/README.md), D-029 (drop STANDARDS.md, keep README-TEMPLATE.md trimmed), D-030 (moto pinned, minimal use), D-031 (run_platform.sh flags: --check-only/--plan-only/--quiet/--help only), D-032 (NOVA_* env prefix, NOVA_AWS_* → AWS_* copy then unset), D-033 (per-env contract variants differ ONLY in environment field), D-034 (engine-boundary test scans .py stripped of docstrings/comments), D-035 (index_document is L2 static-assets input, NOT L1 s3), D-036 (L2 children: microservice=vpc+ecs-cluster+ecs-service+iam-role+ecr+alb, static-assets=s3+cloudfront+kms-key), D-037 (adapter loads registry, no source in stack — grill C-1 fix), D-038 (L2 compositions locked, grill C-2 fix) + +Active Invariants: No INV-* IDs formally registered (v1.0 used D-* decisions, not INV-* invariants). Load-bearing invariants: (1) engine-agnostic core — no aws_*/terraform/module "/provider "/resource " in .py outside adapters/terraform/ (verified by tests/test_engine_boundary.py); (2) structural conventions preserved with 9 locked deviations (D-012, D-013, D-015, D-017, D-018, D-019, D-022, D-023, D-025, D-027); (3) no OOS-creep — zero files from the PROJECT.md/REQUIREMENTS.md OOS list exist in the repo. + +Standing Capability Gate: N/A — no GATE-* IDs registered + +Anti-Goals Touched: PROJECT.md §"Out of scope" + REQUIREMENTS.md §"Out of scope (locked — do NOT implement in v1.0)": security/policy (kyverno, Wiz, Checkov, PolicyEngine), confidence signal + evidence outbox, identity/ABAC (Nova-idp, PAT, JWS, KMS signing, SoD, HITL, attestation, submission_readiness), CI/CD pipeline (.github/workflows, pipelines/, pipeline schemas), metrics/telemetry, leadership decks, decommission/env_transition/mode_resolver/onboarding flow beyond bootstrap, multi-project mode, OIDC federation. + +Out-of-Scope (hard): kyverno-json adapter, Wiz adapter, Checkov custom rules, core/policy_engine.py, core/confidence_signal.py, core/outbox_writer.py, schemas/policy_check_result.schema.json, schemas/metrics_*.schema.json, audit ledger, attestation matrix, core/abac_evaluator.py, core/auth_store.py, core/jws_attestation.py, core/kms_signing.py, core/pat_lifecycle.py, core/separation_of_duties.py, core/hitl_gates.py, core/attestation_matrix.py, core/submission_readiness.py, .github/workflows/ci.yml, .github/workflows/deploy.yml, pipelines/, schemas/pipeline.schema.json, schemas/deploy-pipeline.schema.json, metrics/, core/metrics/, core/regression_verify*.py, modules/STANDARDS.md, PPTX/marp slides, core/env_transition.py, core/decommission_transform.py, core/mode_resolver.py, core/onboarding.py, OIDC federation. + +--- + +## 5. Recent History & Quality Gates (last 1-2 milestones) + +Last Shipped: v1.0 milestone — 2026-08-25 (tag v0.1.6 on main); delivered: simplified infrastructure-delivery platform with 13 L1 + 2 L2 modules, contract surface, resolver, terraform adapter, engine boundary, 5 terraform roots, bootstrap scripts, shell reproducibility, 76 tests, docs; 38 REQ-IDs all complete; 38 decisions (D-001..D-038) +In Progress: No active milestone in progress (v1.0 complete; checkpoint cleared; next /ci-run starts a new milestone) +Coverage Floor: UNKNOWN — needs investigation (pytest-cov not installed; no coverage measurement configured in pyproject.toml addopts; D-030 dropped pytest-cov as OOS) +Recent Incidents: none +Known Tensions: (1) NOVA_FORGE_TOKEN blank in .ciagent/.env.secrets — v0.1.6 shipped local-only (tag + merge complete, gitea release pending); the forge repo was created during this intake but the token must be set before releases can be created. (2) Only dev.json environment exists — qa/prod/dr environment files were not created in v1.0 (contracts reference them via enum but environment_check will raise EnvironmentNotFoundError for qa/prod/dr). (3) Coverage measurement is absent — pytest-cov was dropped as OOS but this means no coverage floor is enforceable. + +--- + +## 6. Agent Context & Assumptions (Agent Initiators Only) + +Missing Context: (1) qa/prod/dr environment JSON files — not created in v1.0 (only core/environments/dev.json exists); the contract schema allows these environment values but no environment record exists for them. (2) Coverage percentage — pytest-cov is not installed; no coverage data available. (3) NORTH_STAR.md — not created (the reference acdl has one; nova-platform deferred it to a future /ci-run specify stage). (4) Live AWS verification — bootstrap scripts + terraform roots were authored but never applied against real AWS (offline-only verification via --check-only). + +Agent Assumptions: (1) Assumed the gitea forge token from the acdl reference repo (/home/opencode/acdl/.env.secrets) is valid for the nova-platform org — verified via API (200 auth). (2) Assumed the next milestone is v1.1 (incrementing from v1.0) — no ROADMAP.md entry exists for a next milestone yet. (3) Assumed PDLC Phase 0 STATE.md work belongs on a new milestone/phase-0 branch hierarchy (milestone/v1.1-pdlc-state → phase/00-pre-execution) per the branch gate convention. (4) Assumed "merge to the forge upstream but DO NOT perform a release" means: push main + branches to origin, do NOT create a gitea release (no tag push, no release API call). + +--- + +## 7. Canonical State References (Version/Hash) + +Vision/Strategy doc: UNKNOWN — needs investigation (NORTH_STAR.md not created; PROJECT.md §"Vision / Core Value" serves as the de facto vision but is not versioned as a strategy doc) +Architecture document: v0.1.6 (tag on main commit fe9ab7e); .ciagent/ARCHITECTURE.md + docs/architecture.md are the architecture source of truth +Last approved SPEC: N/A — no SPEC-ID system in use; REQUIREMENTS.md (38 REQ-IDs, REQ-01..REQ-38) is the requirements source of truth at commit fe9ab7e +Decision log: fe9ab7e (last synced commit on main); decisions D-001..D-035 in .ciagent/CLARIFY.md; D-036..D-038 (grill fixes) in .ciagent/CLARIFY.md §"Grill fixes"; D-001..D-010 also in .ciagent/PROJECT.md +Invariants catalog: N/A — no INV-* IDs formally registered; load-bearing invariants documented in STATE.md §4 above \ No newline at end of file -- 2.43.0 From 9b88105bff66d2a75415b5f4fa4171efda87396d Mon Sep 17 00:00:00 2001 From: coreci-nova-po Date: Sat, 31 Oct 2026 22:09:35 +0000 Subject: [PATCH 2/5] =?UTF-8?q?docs(P00):=20state=20re-take=20=E2=80=94=20?= =?UTF-8?q?refresh=20.ciagent/STATE.md=20ground=20truth=20to=202026-10-31?= =?UTF-8?q?=20(v1.1=20plan=20ratified,=20nova-platform#11=20comment=201638?= =?UTF-8?q?3)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .ciagent/STATE.md | 69 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 69 insertions(+) diff --git a/.ciagent/STATE.md b/.ciagent/STATE.md index c89b9af..4f0cb5a 100644 --- a/.ciagent/STATE.md +++ b/.ciagent/STATE.md @@ -1,10 +1,64 @@ # STATE — Nova Platform > PDLC Phase 0 intake. Absolute ground truth as of 2026-08-28T19:09Z. +> RE-TAKEN — phase 0 execution of the ratified v1.1 plan (fresh single +> pass by PO coreci-nova-po; ratification: coreci/nova-platform#11 comment +> 16383, 2026-10-31T20:39:34Z). The 2026-08-28 intake text is preserved +> below; every moved fact is marked (re-take) inline and catalogued in +> §0 Re-take Deltas. Nothing is rewritten silently. > Single-pass discovery for the Product Owner/Manager. --- +## 0. Re-take Deltas (added by the phase 0 re-take; evidence ids on every move) + +This section is the phase 0 re-take delta record (PO coreci-nova-po, +2026-10-31T22:09Z). The v1.1 five-phase plan is ratified in full +(coreci/nova-platform#11, comment 16383, 2026-10-31T20:39:34Z); this +refresh is that ratification's phase 0 execution work. + +Moved since 2026-08-28 (3 facts): + +1. Forge release — intake tension (1) reads "v0.1.6 shipped local-only, + gitea release pending". MOVED: release v0.1.6 EXISTS on the forge + (API-verified 2026-10-31: tag v0.1.6, created 2026-08-25T02:18:39Z). + No claim is made here about the .env.secrets token state. +2. CI/CD — §3's "Local shell only; NO .github/workflows (OOS per + D-007)" is stale in fact: the repo carries .gitea/workflows/ci.yml + and main runs green (run 30, success, 2026-10-26T23:17:26Z — PR #9 + merge commit 8a92f57b). The D-007 canon correction itself is phase-2 + work and rides there as a dated addition; this re-take does not + rewrite any locked decision. +3. Forge host/org — §3 names git.cloudinit.dev/continuous-intelligence; + the forge is now git.coreci.dev, repo coreci/nova-platform (verified + by the API host this re-take's reads answered on). + +Not moved since 2026-08-28 (verified 2026-10-31): + +- Environments: only core/environments/dev.json exists; qa/prod/dr still + resolve nowhere — phase 1's whole target, unchanged. +- Coverage: pyproject.toml carries no coverage config and no pytest-cov + reference — RULED OUT of v1.1 (comment 16383); D-030 stands; if the + missing floor ever bites it reopens through its own lane. + +Rulings carried into the record by comment 16383 (same verdict): + +- NORTH_STAR.md stays OUT of v1.1 (gap noted for the next product + review, not minted mid-milestone). +- Phase tag numbering stays with the product's own harness at phase 0. +- Phase 4 (nova-bcx consumer unblock) shape DECIDED 2026-10-31 (hip's + comment 16379 on coreci/nova-platform#10): adapter option 1 mirror; + execution filed as MR coreci/nova-blockchain-exchange#3; the merge rides + the gate with no bypass (merge-path ruling comment 16503: the fleet lane + serves the runner plane via coreci/company#139) until a green nova-bcx + deploy run newer than 6210 lands. + +This re-take does NOT touch .ciagent/CHECKPOINT.json (the harness's own +state file) and does NOT rewrite any locked decision. The original intake +sections below are preserved as the 2026-08-28 record. + +--- + ## 1. Header Project: nova-platform @@ -12,6 +66,9 @@ Initiative: PDLC Phase 0 — State Intake for next milestone planning Initiator: CIAgent (automated harness) Date (UTC): 2026-08-28T19:09:26Z Current Version: v1.0 milestone complete; release v0.1.6 on main; no active milestone in progress + (re-take 2026-10-31: milestone v1.1 is ACTIVE — five-phase plan ratified + 2026-10-31T20:39:34Z, coreci/nova-platform#11 comment 16383; phase 0 + execution is this re-take) System Health: GREEN — 76/76 tests pass, engine boundary holds, zero OOS files, both happy paths green Raw Idea (≤ 3 sentences): Nova Platform v1.0 shipped a simplified infrastructure-delivery platform (contract → resolve → terraform adapter → apply) derived from the Nova/acdl reference, with security/audit/identity/CI-workflow machinery deliberately excluded. @@ -53,10 +110,15 @@ Audit Stream: Language(s) and runtime(s): Python 3.11 (>=3.11 required per pyproject.toml); Bash (shell scripts); HCL (Terraform 1.9.* pinned) Build / packaging: pyproject.toml (setuptools backend); no CLI package (D-027 — scripts invoked via shell, no [project.scripts]); requirements-test.txt pins 5 deps CI / CD: Local shell only (scripts/run_ci.sh: lint → test → check-only); NO .github/workflows (OOS per D-007); NO pipelines/ central contract (OOS) + (re-take 2026-10-31: stale — .gitea/workflows/ci.yml is live and main runs + green, run 30 success 2026-10-26T23:17:26Z, merge commit 8a92f57b; the + D-007 canon correction is phase-2, as a dated addition) Infrastructure: AWS (S3 state backend, DynamoDB lock table, ECS Fargate, ALB, CloudFront, WAF, RDS, KMS, ECR, IAM); terraform/bootstrap/ scripts create S3 bucket nova-tfstate-- + DynamoDB nova-tfstate-locks (D-022); only dev.json environment exists (account_id placeholder 000000000000 for offline) Data stores: S3 (state backend, static assets), DynamoDB (state locking — nova-tfstate-locks; also L1 dynamodb primitive for consumer tables), RDS (L1 rds primitive) Secrets / KMS: Static AWS key only (NOVA_AWS_* in .ciagent/.env.secrets, chmod 600, gitignored); NO OIDC (OOS per D-025); KMS via L1 kms-key primitive (consumer-side, not platform-side); NOVA_FORGE_TOKEN for gitea release (currently blank in .env.secrets — release pending) External integrations in scope: gitea @ https://git.cloudinit.dev/continuous-intelligence/nova-platform (release forge; token NOVA_FORGE_TOKEN); AWS (boto3 for bootstrap scripts + terraform apply) + (re-take 2026-10-31: the forge is now git.coreci.dev, repo + coreci/nova-platform) --- @@ -81,12 +143,19 @@ In Progress: No active milestone in progress (v1.0 complete; checkpoint c Coverage Floor: UNKNOWN — needs investigation (pytest-cov not installed; no coverage measurement configured in pyproject.toml addopts; D-030 dropped pytest-cov as OOS) Recent Incidents: none Known Tensions: (1) NOVA_FORGE_TOKEN blank in .ciagent/.env.secrets — v0.1.6 shipped local-only (tag + merge complete, gitea release pending); the forge repo was created during this intake but the token must be set before releases can be created. (2) Only dev.json environment exists — qa/prod/dr environment files were not created in v1.0 (contracts reference them via enum but environment_check will raise EnvironmentNotFoundError for qa/prod/dr). (3) Coverage measurement is absent — pytest-cov was dropped as OOS but this means no coverage floor is enforceable. + (re-take 2026-10-31: (1) release v0.1.6 EXISTS on the forge (created + 2026-08-25T02:18:39Z, API-verified) — release pending is resolved; the + .env.secrets token state is not re-asserted from this seat. (2) unmoved — + phase 1. (3) unmoved — ruled OUT of v1.1 (comment 16383); D-030 stands.) --- ## 6. Agent Context & Assumptions (Agent Initiators Only) Missing Context: (1) qa/prod/dr environment JSON files — not created in v1.0 (only core/environments/dev.json exists); the contract schema allows these environment values but no environment record exists for them. (2) Coverage percentage — pytest-cov is not installed; no coverage data available. (3) NORTH_STAR.md — not created (the reference acdl has one; nova-platform deferred it to a future /ci-run specify stage). (4) Live AWS verification — bootstrap scripts + terraform roots were authored but never applied against real AWS (offline-only verification via --check-only). + (re-take 2026-10-31: (1) unmoved — phase 1. (2) unmoved — ruled out of + v1.1 (comment 16383). (3) unmoved as a v1.1 item — ruled out (comment + 16383). (4) unmoved — phase 3; no live-apply evidence exists today.) Agent Assumptions: (1) Assumed the gitea forge token from the acdl reference repo (/home/opencode/acdl/.env.secrets) is valid for the nova-platform org — verified via API (200 auth). (2) Assumed the next milestone is v1.1 (incrementing from v1.0) — no ROADMAP.md entry exists for a next milestone yet. (3) Assumed PDLC Phase 0 STATE.md work belongs on a new milestone/phase-0 branch hierarchy (milestone/v1.1-pdlc-state → phase/00-pre-execution) per the branch gate convention. (4) Assumed "merge to the forge upstream but DO NOT perform a release" means: push main + branches to origin, do NOT create a gitea release (no tag push, no release API call). -- 2.43.0 From 2bfd32fc8fc20e4b3c842ad3f404a41893ad9f87 Mon Sep 17 00:00:00 2001 From: coreci-nova-po Date: Sat, 31 Oct 2026 22:09:51 +0000 Subject: [PATCH 3/5] =?UTF-8?q?docs(P00):=20state=20re-take=20=E2=80=94=20?= =?UTF-8?q?stamp=20the=20RE-TAKEN=20header=20line=20with=20its=20UTC=20tim?= =?UTF-8?q?estamp?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .ciagent/STATE.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.ciagent/STATE.md b/.ciagent/STATE.md index 4f0cb5a..c991f79 100644 --- a/.ciagent/STATE.md +++ b/.ciagent/STATE.md @@ -1,7 +1,7 @@ # STATE — Nova Platform > PDLC Phase 0 intake. Absolute ground truth as of 2026-08-28T19:09Z. -> RE-TAKEN — phase 0 execution of the ratified v1.1 plan (fresh single +> RE-TAKEN 2026-10-31T22:09Z — phase 0 execution of the ratified v1.1 plan (fresh single > pass by PO coreci-nova-po; ratification: coreci/nova-platform#11 comment > 16383, 2026-10-31T20:39:34Z). The 2026-08-28 intake text is preserved > below; every moved fact is marked (re-take) inline and catalogued in -- 2.43.0 From 5cdc8fb0a77ba12f671b6f1bc484bd4d2b8d790c Mon Sep 17 00:00:00 2001 From: coreci-nova-po Date: Mon, 2 Nov 2026 14:12:56 +0000 Subject: [PATCH 4/5] =?UTF-8?q?docs(P00):=20align=20.ciagent/STATE.md=20wi?= =?UTF-8?q?th=20main=20intake=20version=20=E2=80=94=20pre-step=20to=20diss?= =?UTF-8?q?olve=20the=20add/add=20conflict=20(Chairman=20request=20PR#12?= =?UTF-8?q?=20c17054)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .ciagent/STATE.md | 69 ----------------------------------------------- 1 file changed, 69 deletions(-) diff --git a/.ciagent/STATE.md b/.ciagent/STATE.md index c991f79..c89b9af 100644 --- a/.ciagent/STATE.md +++ b/.ciagent/STATE.md @@ -1,64 +1,10 @@ # STATE — Nova Platform > PDLC Phase 0 intake. Absolute ground truth as of 2026-08-28T19:09Z. -> RE-TAKEN 2026-10-31T22:09Z — phase 0 execution of the ratified v1.1 plan (fresh single -> pass by PO coreci-nova-po; ratification: coreci/nova-platform#11 comment -> 16383, 2026-10-31T20:39:34Z). The 2026-08-28 intake text is preserved -> below; every moved fact is marked (re-take) inline and catalogued in -> §0 Re-take Deltas. Nothing is rewritten silently. > Single-pass discovery for the Product Owner/Manager. --- -## 0. Re-take Deltas (added by the phase 0 re-take; evidence ids on every move) - -This section is the phase 0 re-take delta record (PO coreci-nova-po, -2026-10-31T22:09Z). The v1.1 five-phase plan is ratified in full -(coreci/nova-platform#11, comment 16383, 2026-10-31T20:39:34Z); this -refresh is that ratification's phase 0 execution work. - -Moved since 2026-08-28 (3 facts): - -1. Forge release — intake tension (1) reads "v0.1.6 shipped local-only, - gitea release pending". MOVED: release v0.1.6 EXISTS on the forge - (API-verified 2026-10-31: tag v0.1.6, created 2026-08-25T02:18:39Z). - No claim is made here about the .env.secrets token state. -2. CI/CD — §3's "Local shell only; NO .github/workflows (OOS per - D-007)" is stale in fact: the repo carries .gitea/workflows/ci.yml - and main runs green (run 30, success, 2026-10-26T23:17:26Z — PR #9 - merge commit 8a92f57b). The D-007 canon correction itself is phase-2 - work and rides there as a dated addition; this re-take does not - rewrite any locked decision. -3. Forge host/org — §3 names git.cloudinit.dev/continuous-intelligence; - the forge is now git.coreci.dev, repo coreci/nova-platform (verified - by the API host this re-take's reads answered on). - -Not moved since 2026-08-28 (verified 2026-10-31): - -- Environments: only core/environments/dev.json exists; qa/prod/dr still - resolve nowhere — phase 1's whole target, unchanged. -- Coverage: pyproject.toml carries no coverage config and no pytest-cov - reference — RULED OUT of v1.1 (comment 16383); D-030 stands; if the - missing floor ever bites it reopens through its own lane. - -Rulings carried into the record by comment 16383 (same verdict): - -- NORTH_STAR.md stays OUT of v1.1 (gap noted for the next product - review, not minted mid-milestone). -- Phase tag numbering stays with the product's own harness at phase 0. -- Phase 4 (nova-bcx consumer unblock) shape DECIDED 2026-10-31 (hip's - comment 16379 on coreci/nova-platform#10): adapter option 1 mirror; - execution filed as MR coreci/nova-blockchain-exchange#3; the merge rides - the gate with no bypass (merge-path ruling comment 16503: the fleet lane - serves the runner plane via coreci/company#139) until a green nova-bcx - deploy run newer than 6210 lands. - -This re-take does NOT touch .ciagent/CHECKPOINT.json (the harness's own -state file) and does NOT rewrite any locked decision. The original intake -sections below are preserved as the 2026-08-28 record. - ---- - ## 1. Header Project: nova-platform @@ -66,9 +12,6 @@ Initiative: PDLC Phase 0 — State Intake for next milestone planning Initiator: CIAgent (automated harness) Date (UTC): 2026-08-28T19:09:26Z Current Version: v1.0 milestone complete; release v0.1.6 on main; no active milestone in progress - (re-take 2026-10-31: milestone v1.1 is ACTIVE — five-phase plan ratified - 2026-10-31T20:39:34Z, coreci/nova-platform#11 comment 16383; phase 0 - execution is this re-take) System Health: GREEN — 76/76 tests pass, engine boundary holds, zero OOS files, both happy paths green Raw Idea (≤ 3 sentences): Nova Platform v1.0 shipped a simplified infrastructure-delivery platform (contract → resolve → terraform adapter → apply) derived from the Nova/acdl reference, with security/audit/identity/CI-workflow machinery deliberately excluded. @@ -110,15 +53,10 @@ Audit Stream: Language(s) and runtime(s): Python 3.11 (>=3.11 required per pyproject.toml); Bash (shell scripts); HCL (Terraform 1.9.* pinned) Build / packaging: pyproject.toml (setuptools backend); no CLI package (D-027 — scripts invoked via shell, no [project.scripts]); requirements-test.txt pins 5 deps CI / CD: Local shell only (scripts/run_ci.sh: lint → test → check-only); NO .github/workflows (OOS per D-007); NO pipelines/ central contract (OOS) - (re-take 2026-10-31: stale — .gitea/workflows/ci.yml is live and main runs - green, run 30 success 2026-10-26T23:17:26Z, merge commit 8a92f57b; the - D-007 canon correction is phase-2, as a dated addition) Infrastructure: AWS (S3 state backend, DynamoDB lock table, ECS Fargate, ALB, CloudFront, WAF, RDS, KMS, ECR, IAM); terraform/bootstrap/ scripts create S3 bucket nova-tfstate-- + DynamoDB nova-tfstate-locks (D-022); only dev.json environment exists (account_id placeholder 000000000000 for offline) Data stores: S3 (state backend, static assets), DynamoDB (state locking — nova-tfstate-locks; also L1 dynamodb primitive for consumer tables), RDS (L1 rds primitive) Secrets / KMS: Static AWS key only (NOVA_AWS_* in .ciagent/.env.secrets, chmod 600, gitignored); NO OIDC (OOS per D-025); KMS via L1 kms-key primitive (consumer-side, not platform-side); NOVA_FORGE_TOKEN for gitea release (currently blank in .env.secrets — release pending) External integrations in scope: gitea @ https://git.cloudinit.dev/continuous-intelligence/nova-platform (release forge; token NOVA_FORGE_TOKEN); AWS (boto3 for bootstrap scripts + terraform apply) - (re-take 2026-10-31: the forge is now git.coreci.dev, repo - coreci/nova-platform) --- @@ -143,19 +81,12 @@ In Progress: No active milestone in progress (v1.0 complete; checkpoint c Coverage Floor: UNKNOWN — needs investigation (pytest-cov not installed; no coverage measurement configured in pyproject.toml addopts; D-030 dropped pytest-cov as OOS) Recent Incidents: none Known Tensions: (1) NOVA_FORGE_TOKEN blank in .ciagent/.env.secrets — v0.1.6 shipped local-only (tag + merge complete, gitea release pending); the forge repo was created during this intake but the token must be set before releases can be created. (2) Only dev.json environment exists — qa/prod/dr environment files were not created in v1.0 (contracts reference them via enum but environment_check will raise EnvironmentNotFoundError for qa/prod/dr). (3) Coverage measurement is absent — pytest-cov was dropped as OOS but this means no coverage floor is enforceable. - (re-take 2026-10-31: (1) release v0.1.6 EXISTS on the forge (created - 2026-08-25T02:18:39Z, API-verified) — release pending is resolved; the - .env.secrets token state is not re-asserted from this seat. (2) unmoved — - phase 1. (3) unmoved — ruled OUT of v1.1 (comment 16383); D-030 stands.) --- ## 6. Agent Context & Assumptions (Agent Initiators Only) Missing Context: (1) qa/prod/dr environment JSON files — not created in v1.0 (only core/environments/dev.json exists); the contract schema allows these environment values but no environment record exists for them. (2) Coverage percentage — pytest-cov is not installed; no coverage data available. (3) NORTH_STAR.md — not created (the reference acdl has one; nova-platform deferred it to a future /ci-run specify stage). (4) Live AWS verification — bootstrap scripts + terraform roots were authored but never applied against real AWS (offline-only verification via --check-only). - (re-take 2026-10-31: (1) unmoved — phase 1. (2) unmoved — ruled out of - v1.1 (comment 16383). (3) unmoved as a v1.1 item — ruled out (comment - 16383). (4) unmoved — phase 3; no live-apply evidence exists today.) Agent Assumptions: (1) Assumed the gitea forge token from the acdl reference repo (/home/opencode/acdl/.env.secrets) is valid for the nova-platform org — verified via API (200 auth). (2) Assumed the next milestone is v1.1 (incrementing from v1.0) — no ROADMAP.md entry exists for a next milestone yet. (3) Assumed PDLC Phase 0 STATE.md work belongs on a new milestone/phase-0 branch hierarchy (milestone/v1.1-pdlc-state → phase/00-pre-execution) per the branch gate convention. (4) Assumed "merge to the forge upstream but DO NOT perform a release" means: push main + branches to origin, do NOT create a gitea release (no tag push, no release API call). -- 2.43.0 From 810a9da6faee0a41e8c81e0eac879ae85972f112 Mon Sep 17 00:00:00 2001 From: coreci-nova-po Date: Mon, 2 Nov 2026 14:12:58 +0000 Subject: [PATCH 5/5] =?UTF-8?q?docs(P00):=20restore=20the=20ratified=20v1.?= =?UTF-8?q?1=20phase-0=20re-take=20STATE.md=20(nova-platform#11=20c16383)?= =?UTF-8?q?=20after=20main=20merge=20=E2=80=94=20PR#12=20conflict=20resolv?= =?UTF-8?q?ed=20(Chairman=20c17054)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .ciagent/STATE.md | 69 +++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 69 insertions(+) diff --git a/.ciagent/STATE.md b/.ciagent/STATE.md index c89b9af..c991f79 100644 --- a/.ciagent/STATE.md +++ b/.ciagent/STATE.md @@ -1,10 +1,64 @@ # STATE — Nova Platform > PDLC Phase 0 intake. Absolute ground truth as of 2026-08-28T19:09Z. +> RE-TAKEN 2026-10-31T22:09Z — phase 0 execution of the ratified v1.1 plan (fresh single +> pass by PO coreci-nova-po; ratification: coreci/nova-platform#11 comment +> 16383, 2026-10-31T20:39:34Z). The 2026-08-28 intake text is preserved +> below; every moved fact is marked (re-take) inline and catalogued in +> §0 Re-take Deltas. Nothing is rewritten silently. > Single-pass discovery for the Product Owner/Manager. --- +## 0. Re-take Deltas (added by the phase 0 re-take; evidence ids on every move) + +This section is the phase 0 re-take delta record (PO coreci-nova-po, +2026-10-31T22:09Z). The v1.1 five-phase plan is ratified in full +(coreci/nova-platform#11, comment 16383, 2026-10-31T20:39:34Z); this +refresh is that ratification's phase 0 execution work. + +Moved since 2026-08-28 (3 facts): + +1. Forge release — intake tension (1) reads "v0.1.6 shipped local-only, + gitea release pending". MOVED: release v0.1.6 EXISTS on the forge + (API-verified 2026-10-31: tag v0.1.6, created 2026-08-25T02:18:39Z). + No claim is made here about the .env.secrets token state. +2. CI/CD — §3's "Local shell only; NO .github/workflows (OOS per + D-007)" is stale in fact: the repo carries .gitea/workflows/ci.yml + and main runs green (run 30, success, 2026-10-26T23:17:26Z — PR #9 + merge commit 8a92f57b). The D-007 canon correction itself is phase-2 + work and rides there as a dated addition; this re-take does not + rewrite any locked decision. +3. Forge host/org — §3 names git.cloudinit.dev/continuous-intelligence; + the forge is now git.coreci.dev, repo coreci/nova-platform (verified + by the API host this re-take's reads answered on). + +Not moved since 2026-08-28 (verified 2026-10-31): + +- Environments: only core/environments/dev.json exists; qa/prod/dr still + resolve nowhere — phase 1's whole target, unchanged. +- Coverage: pyproject.toml carries no coverage config and no pytest-cov + reference — RULED OUT of v1.1 (comment 16383); D-030 stands; if the + missing floor ever bites it reopens through its own lane. + +Rulings carried into the record by comment 16383 (same verdict): + +- NORTH_STAR.md stays OUT of v1.1 (gap noted for the next product + review, not minted mid-milestone). +- Phase tag numbering stays with the product's own harness at phase 0. +- Phase 4 (nova-bcx consumer unblock) shape DECIDED 2026-10-31 (hip's + comment 16379 on coreci/nova-platform#10): adapter option 1 mirror; + execution filed as MR coreci/nova-blockchain-exchange#3; the merge rides + the gate with no bypass (merge-path ruling comment 16503: the fleet lane + serves the runner plane via coreci/company#139) until a green nova-bcx + deploy run newer than 6210 lands. + +This re-take does NOT touch .ciagent/CHECKPOINT.json (the harness's own +state file) and does NOT rewrite any locked decision. The original intake +sections below are preserved as the 2026-08-28 record. + +--- + ## 1. Header Project: nova-platform @@ -12,6 +66,9 @@ Initiative: PDLC Phase 0 — State Intake for next milestone planning Initiator: CIAgent (automated harness) Date (UTC): 2026-08-28T19:09:26Z Current Version: v1.0 milestone complete; release v0.1.6 on main; no active milestone in progress + (re-take 2026-10-31: milestone v1.1 is ACTIVE — five-phase plan ratified + 2026-10-31T20:39:34Z, coreci/nova-platform#11 comment 16383; phase 0 + execution is this re-take) System Health: GREEN — 76/76 tests pass, engine boundary holds, zero OOS files, both happy paths green Raw Idea (≤ 3 sentences): Nova Platform v1.0 shipped a simplified infrastructure-delivery platform (contract → resolve → terraform adapter → apply) derived from the Nova/acdl reference, with security/audit/identity/CI-workflow machinery deliberately excluded. @@ -53,10 +110,15 @@ Audit Stream: Language(s) and runtime(s): Python 3.11 (>=3.11 required per pyproject.toml); Bash (shell scripts); HCL (Terraform 1.9.* pinned) Build / packaging: pyproject.toml (setuptools backend); no CLI package (D-027 — scripts invoked via shell, no [project.scripts]); requirements-test.txt pins 5 deps CI / CD: Local shell only (scripts/run_ci.sh: lint → test → check-only); NO .github/workflows (OOS per D-007); NO pipelines/ central contract (OOS) + (re-take 2026-10-31: stale — .gitea/workflows/ci.yml is live and main runs + green, run 30 success 2026-10-26T23:17:26Z, merge commit 8a92f57b; the + D-007 canon correction is phase-2, as a dated addition) Infrastructure: AWS (S3 state backend, DynamoDB lock table, ECS Fargate, ALB, CloudFront, WAF, RDS, KMS, ECR, IAM); terraform/bootstrap/ scripts create S3 bucket nova-tfstate-- + DynamoDB nova-tfstate-locks (D-022); only dev.json environment exists (account_id placeholder 000000000000 for offline) Data stores: S3 (state backend, static assets), DynamoDB (state locking — nova-tfstate-locks; also L1 dynamodb primitive for consumer tables), RDS (L1 rds primitive) Secrets / KMS: Static AWS key only (NOVA_AWS_* in .ciagent/.env.secrets, chmod 600, gitignored); NO OIDC (OOS per D-025); KMS via L1 kms-key primitive (consumer-side, not platform-side); NOVA_FORGE_TOKEN for gitea release (currently blank in .env.secrets — release pending) External integrations in scope: gitea @ https://git.cloudinit.dev/continuous-intelligence/nova-platform (release forge; token NOVA_FORGE_TOKEN); AWS (boto3 for bootstrap scripts + terraform apply) + (re-take 2026-10-31: the forge is now git.coreci.dev, repo + coreci/nova-platform) --- @@ -81,12 +143,19 @@ In Progress: No active milestone in progress (v1.0 complete; checkpoint c Coverage Floor: UNKNOWN — needs investigation (pytest-cov not installed; no coverage measurement configured in pyproject.toml addopts; D-030 dropped pytest-cov as OOS) Recent Incidents: none Known Tensions: (1) NOVA_FORGE_TOKEN blank in .ciagent/.env.secrets — v0.1.6 shipped local-only (tag + merge complete, gitea release pending); the forge repo was created during this intake but the token must be set before releases can be created. (2) Only dev.json environment exists — qa/prod/dr environment files were not created in v1.0 (contracts reference them via enum but environment_check will raise EnvironmentNotFoundError for qa/prod/dr). (3) Coverage measurement is absent — pytest-cov was dropped as OOS but this means no coverage floor is enforceable. + (re-take 2026-10-31: (1) release v0.1.6 EXISTS on the forge (created + 2026-08-25T02:18:39Z, API-verified) — release pending is resolved; the + .env.secrets token state is not re-asserted from this seat. (2) unmoved — + phase 1. (3) unmoved — ruled OUT of v1.1 (comment 16383); D-030 stands.) --- ## 6. Agent Context & Assumptions (Agent Initiators Only) Missing Context: (1) qa/prod/dr environment JSON files — not created in v1.0 (only core/environments/dev.json exists); the contract schema allows these environment values but no environment record exists for them. (2) Coverage percentage — pytest-cov is not installed; no coverage data available. (3) NORTH_STAR.md — not created (the reference acdl has one; nova-platform deferred it to a future /ci-run specify stage). (4) Live AWS verification — bootstrap scripts + terraform roots were authored but never applied against real AWS (offline-only verification via --check-only). + (re-take 2026-10-31: (1) unmoved — phase 1. (2) unmoved — ruled out of + v1.1 (comment 16383). (3) unmoved as a v1.1 item — ruled out (comment + 16383). (4) unmoved — phase 3; no live-apply evidence exists today.) Agent Assumptions: (1) Assumed the gitea forge token from the acdl reference repo (/home/opencode/acdl/.env.secrets) is valid for the nova-platform org — verified via API (200 auth). (2) Assumed the next milestone is v1.1 (incrementing from v1.0) — no ROADMAP.md entry exists for a next milestone yet. (3) Assumed PDLC Phase 0 STATE.md work belongs on a new milestone/phase-0 branch hierarchy (milestone/v1.1-pdlc-state → phase/00-pre-execution) per the branch gate convention. (4) Assumed "merge to the forge upstream but DO NOT perform a release" means: push main + branches to origin, do NOT create a gitea release (no tag push, no release API call). -- 2.43.0