Four frictions slow every team

• Cognitive load — services inconsistent in security and observability
• Operational work — manual promotion scaling with the system
• Red tape — tickets and handoffs scaling with the organization
• Scalability — throughput without scaling platform engineers

The platform at a glance

• Consumer surfaces — technical dev or citizen dev; both produce a contract
• Central pipeline — fixed stages, identical for every deployment: validate → resolve → security → plan → policy → confidence → evidence → apply
• Module catalog + engine adapter — security-reviewed blocks; the adapter is the only engine-specific code (Terraform today)
• HITL gates + evidence stream — human attestation for qa/prod/dr; every deployment writes a hash-chained event (RPO = 0)

Declare intent; the platform delivers safe production

• A merged change progresses without a ticket or thread
• A non-technical consumer ships by declaring intent
• Every production change is traceable to a human attestation

Nova owns infrastructure, not your app

• Upstream is anything — IDE, agentic SDLC, or vibe coding
• Nova is infrastructure only — provisions and governs AWS resources
• Not a general-purpose AI — autonomy is narrow, policy-bounded
• Not a permissive highway — no escape hatches

One YAML file. The platform owns everything else.

• Module — pre-built, security-reviewed building blocks
• Environment — dev, qa, prod, dr; bar rises with sensitivity
• Inputs — cpu, memory, port, desired_count
• Consumer provides no AWS account, no VPC, no state backend

Same stages, same checks, every deployment

• Security and policy checks run before any infra is created
• Every stage produces a record — no "unchecked" path

No long-lived credentials. Blast radius contained.

• OIDC federation — short-lived token per job, no stored credential Planned: all runners
• ABAC, not role-based — repo identity + resource tags scope every action
• A consumer can only touch its own tagged resources. One consumer can never affect another.

Safety is a measurable signal, not a black box

• Six weighted inputs — manually tuned, auditable per-input breakdown

• A single critical finding hard-blocks — not averaged away

Every change traceable to a human attestation

• Dev is fully autonomous — confidence signal is the only gate
• qa, prod, dr require human attestation — contract + plan + evidence Planned
• Separation of duties — QA approver ≠ prod approver; platform blocks on a match Planned
• Hash-chained evidence event — tampering breaks the chain. RPO = 0

A1 — Platform-Managed Environments

A consumer provides no AWS account, no VPC, no subnet, no state backend, no runner key. The platform owns the blast radius.

A named environment is a platform-owned bundle of:

• An AWS account (or a scoped partition of one)
• A network (VPC + subnets)
• A state backend (S3 + DynamoDB for state + locking)
• An IAM role surfaced via ABAC, scoped to the consumer's identity and resource tags

The consumer selects an environment by name in their contract. The platform resolves it at run time. The consumer never sees raw credentials.

Friendly onboarding: the first run detects no environment and emits a guided prompt (not an opaque failure). Self-service: planned

A2 — Observability Built In

Monitoring is a platform default, not a per-team project.

• Uptime monitoring deployed automatically with every stack — separate state, feature flag to disable
• Monitored endpoints passed from the deployment's own outputs — no manual endpoint registration
• Alert channels: Microsoft Teams webhook, email, SMS, and GitHub issues
• The uptime URL is published to the developer via a PR comment
• Roadmap: deeper observability bootstrap (dashboards, runbooks, on-call bindings) Planned

A3 — Security by Construction

Security defaults that do not require a team to opt in. Checks run on every deployment, normalized to a single schema.

• Policy checks (Checkov, Wiz, Kyverno) — secrets, public ingress, IAM wildcards, required tagging — all run before infra is created
• Encryption on every resource — at-rest on by default; per-stack CMKs with 90-day rotation, no shared keys across stacks
• Deletion protection on by default — prevent_destroy on unless explicitly disabled via a documented flag
• Safe decommission — a 2-step pipeline with two SRE attestation gates and a change-request validated against the CMDB

A6 — Glossary

A7 — Operating Model & Cost

Nova runs at zero cloud cost for day-to-day development. AWS spend was measured via Cost Explorer (COST.md, 2026-07-28):

• S3 dominates (98.8%, terraform state bucket) — no compute ran because v1.0→v1.10 was plan-only for IAM-gated capabilities
• Local emulators are the primary tier — the full pipeline runs in-process, no AWS credentials
• Live-AWS verification is milestone-scoped, then torn down. The pipeline now defaults to plan-only on every PR; NOVA_LIFECYCLE_MODE=full overrides to apply→destroy for milestone verification (REQ-134, v1.12).
• Cost drivers are spike-scoped: Terraform plan reads (free), S3 state storage (cents), DynamoDB outbox (cents). Any spike > $1/day is an anomaly.

Pre-mortem (PRE_MORTEM.md): the v1.10 decay incident (diff-scoped VERIFY missed 7 adapter defects) is the root pattern: a claim outruns the verification that backs it. Four forward failure modes + structural mitigations (regression-tested IAM baseline, mandatory teardown, verified-only deck claims, honest scope).