# Nova — The Autonomous Cloud Delivery Platform: Talking Points

> Step 4 of the 4-step deck process. Presenter cues that mirror the
> `<!-- Talking points: -->` comments in
> `nova-autonomous-cloud-delivery-marp.md` (the sole source of truth).
> 3-6 bullets per slide + key takeaway. Indexed by Marp slide #.
> v1.21 — REQ-245

---

### Slide 1 — The Problem
- Open with the shift: "you build it, you run it" put Terraform into product teams — ownership without discipline is destroying value
- Land the lifecycle-planning gap: resources authored for creation, not for patching/rollback → destructive changes
- Land the urgency: AI-era 0-day pace demands proactive scanning as code + at runtime, remediated at threat pace
- Call out tribal knowledge / the rockstar-operator problem — the platform should encode the discipline, not the person
- Do NOT frame this as "humans are the problem" — the problem is ownership without the discipline and tooling
- **Key takeaway:** the problem is infrastructure ownership without discipline; the answer is an autonomous platform that encodes the discipline

### Slide 2 — Nova's Vision
- Read the vision verbatim — "infrastructure operations become visible" is the operative phrase
- Emphasize "provable, not promised" — trust established by deterministic scripts; the platform functions without AI
- State the attestation model up front: QA for production, SRE for operational readiness
- **Key takeaway:** autonomous operations with provable trust — security, remediation velocity, reliability, lead time made visible, not promised

### Slide 3 — Strategic Objectives
- Objective #1: zero-touch operations — autonomy as the default, not the demo; stage-gate attestation (QA, SRE) remains human by design
- Objective #2 is the one to land carefully: trust = deterministic scoring, not an LLM; the platform functions without AI
- Objective #3: four CTO-grade metrics (Lead Time, Vuln Count, MTTR, Spend) — all flow into PowerBI
- Objective #4 is the integration thesis: Nova integrates with any upstream source; provides skills + MCP; all prod intents go through the same controls
- **Key takeaway:** the scope is explicit — Nova governs infra + delivery, integrates with any source through one contract, measures success on four CTO metrics

### Slide 4 — Anti-Goals (What Nova Is NOT)
- Not a general-purpose AI agent platform
- Not a system that removes humans from accountability — only from normal operations
- Not an upstream development platform (no product backlogs, IDE, code authorship)
- Not a replacement for the Product Development Lifecycle (PDLC)
- Anti-goals #3 and #4 protect the scope boundary — Nova will not become an IDE or a product-planning tool
- **Key takeaway:** the boundaries are explicit — Nova is purpose-built for infra ops + delivery, not a general-purpose AI agent or an upstream dev platform

### Slide 5 — Scope: Downstream of PDLC
- Nova governs infra + delivery only; the PDLC (backlog, code authorship, IDE) is upstream — Nova stays downstream of it
- Integration is only through the validated contract boundary
- Any upstream source (AI agent, agentic SDLC, dev platform) produces submissions subject to the same compliance standards
- Nova validates the submission, not the author
- **Key takeaway:** Nova is purpose-built for infrastructure operations; the scope boundary is clean and bounded

### Slide 6 — RACI: Who Owns What
- Four roles now: Citizen Developer, Platform, Quality Engineering, SRE
- Quality attestation is owned by Quality Engineering (not the Platform); Production readiness is owned by SRE
- The Platform runs the checks agentically but is never the Accountable party for the gate — that separation keeps the platform honest
- Production readiness is co-owned: the platform runs attestations; the citizen developer authorizes the promotion at the stage gate
- **Key takeaway:** you bring FRs + UAT; Nova provides NFRs + infra; QE guards the gate evidence; SRE signs off on production readiness

### Slide 7 — The Platform Pipeline
- Walk the pipeline left-to-right: contract → resolver → adapter → Checkov (static) → plan → Wiz (on plan) → confidence → gate → apply
- Two-stage scan: Checkov on static code BEFORE the plan (fail-fast dev feedback); Wiz on the plan (or Checkov as drop-in if no Wiz creds)
- Never both Wiz + Checkov on the plan — avoid duplicate noise
- Dev is autonomous; qa/prod/dr require attestation (QA for quality, SRE for production readiness)
- **Key takeaway:** two layers of scanning, zero operator involvement in normal operations

### Slide 8 — The Decision Ledger
- "AI decisions" are really automated decisions — deterministic scripts calculate a score; the platform functions without AI
- Do not dwell on the storage substrate — the value is accountability (immutable, queryable, traceable to outcome), not the database
- Every stage-gate attestation is captured with approver identity and the evidence presented
- When an LLM planner is added later, it emits richer alternatives without breaking the schema
- **Key takeaway:** autonomous is defensible because every decision is immutable, queryable, accountable — and "automated" means deterministic scoring, not a black-box LLM

### Slide 9 — Attestation Matrix: QA
- The matrix is not a rubber stamp — structured, freshness-validated
- Each concern now has a plain-language description of what is being attested (the old "operator-supplied" label is gone)
- Three QA concerns: functional correctness (24h), performance baseline (7d), security posture (24h)
- Each concern has a freshness window — evidence older than the window does not satisfy the gate
- **Key takeaway:** QA signs off on quality before any promotion — the gate is explicit, not implicit

### Slide 10 — Attestation Matrix: Prod/DR
- Seven prod/DR concerns: operational readiness, incident response, capacity & cost, DR drill, chaos, backup, DR region deploy
- SRE signs off on operability (runbooks, dashboards, on-call), incident response, capacity, and the three resilience checks
- Each concern has a freshness window — 30d/90d/180d depending on the control
- SoD on prod: the approver can't be the same person who built it — the rule that keeps the gate honest
- **Key takeaway:** autonomy in operations, human in accountability, by design — the matrix is what makes autonomous operations safe enough to trust in production

### Slide 11 — Telemetry & Live Ops
- Deliberately minimal: Nova-native CloudEvents; no Kafka/Prometheus/ClickHouse
- The live-ops dashboard is built in PowerBI on top of the exported views — leadership sees the same numbers the platform produces
- Every number in the Proof slides is traceable to a signal — "where does this number come from?" → a query against the cold store
- This is where the "infrastructure operations become visible" theme lands concretely
- **Key takeaway:** the architecture is the trust substrate — operations become visible in PowerBI, with full traceability

### Slide 12 — Decision Ledger + Attestation Coverage
- Both 100% — no automated decision is ever lost; no prod/dr promotion lands without a human sign-off
- The mandatory-by-design point: the ledger entry + the human attestation are a gate, not a best-effort feature
- Easily queried: by run, by environment, by approver, by outcome — the audit trail is a query, not a forensic exercise
- **Key takeaway:** trust is provable — not a marketing claim, a queryable record; no change to production without both the ledger entry and the human attestation

### Slide 13 — Cost & ROI
- The ROI formula is shown inline — not hidden in a footnote
- The four CTO-grade metrics are the ROI proof — Lead Time, Vuln Count, MTTR, Cloud Spend
- The N=0 caveat is stated explicitly: the formula is grounded; the production numbers activate with a pilot
- **Key takeaway:** the ROI is not a black box — the formula is shown, the four metrics are committed, the production-denominator caveat is up front

### Slide 14 — What's Deferred — and Why
- The preempt is critical: these deferrals are measurement infrastructure, not autonomy — the platform IS autonomous in operations
- The blocking work is named in plain language (no decision IDs) — "live AWS re-provisioning", "drift-detection scheduler", "ML service"
- Showing this to leadership demonstrates honesty, not weakness
- **Key takeaway:** the autonomy is real; the measurement gaps are documented with the work that unblocks each one

### Slide 15 — Roadmap to the North Star
- Each deferred metric has an unblock path and a timeframe — near-term, mid-term, longer-term
- No status column: most of it is not implemented yet, so status would be noise
- Re-evaluation triggers: each blocking piece of work lifts on its own schedule
- **Key takeaway:** every deferred metric has a plan and a timeframe — nothing is hand-waved

### Slide 16 — 12-Month Product Roadmap
- This is the *product* roadmap, forward-looking only
- Q1 Pilot Activation → Q2 Provable Trust → Q3 Compounding ROI → Q4 Integration & Predictive
- Each quarter activates one strategic objective from the North Star
- **Key takeaway:** the 12-month product arc — each quarter activates a strategic objective and its board-level metric

### Slide 17 — Quarter-by-Quarter Outcomes
- Q1: three post-pilot metrics go live (Touchless ≥99%, Escalation <0.1%, Accuracy ≥99.5%) — denominator activates with the pilot
- Q2: Decision Ledger Coverage was already grounded — tamper-evidence is the Q2 upgrade (local hash-chain → Object Lock + signed checkpoints)
- Q3: Drift Auto-Reversal ≥95% unblocks when the drift scheduler ships; Spend Reduction ≥25% measured against the pilot baseline
- Q4: Predictive:Reactive ≥3:1 requires the ML forecasting service; AI-Agent Intent Share is a first measurement (aspirational-metric)
- **Key takeaway:** each quarter has a concrete deliverable, a target metric grounded in a strategic objective, and a path from deferred to shipped

### Slide 18 — Production-Grade Guidance via Atelier (1/2)
- Nova instructs the citizen developer's AI agent via skills (markdown, keyed to engineering domains) + an MCP server (4 tools, plugin-registry, stdio)
- The integration point is the same regardless of source — AI agent, agentic SDLC, traditional IDE all get the same skills + MCP
- This is how Nova makes the citizen developer production-grade without owning the PDLC
- **Key takeaway:** the citizen developer's AI agent is not unguided — Nova provides engineering principles as skills + MCP

### Slide 19 — Production-Grade Guidance via Atelier (2/2)
- The value is the gap deterministic scanners leave: engineering discipline (Wiz/Checkmarx/Mend check policy/secrets, not discipline)
- The MCP server catches "is this service observable?", "is this error path handled?", "is this API contract clear?"
- Vendored at a pinned tag → audit reproducibility — a validation result is replayable months later
- **Key takeaway:** submissions are checked for engineering discipline, not just policy compliance — and the check is reproducible for audit

### Slide 20 — Recap + Ask
- Recap the 4-beat arc so the audience leaves with the structure
- The ask is a business decision: approve a pilot estate + the tamper-evident ledger build-out
- "Pipeline-ready" → "production-proven" is the value proposition
- **Key takeaway:** approve a pilot + the ledger build-out to move from pipeline-ready to production-proven

### Appendix A1 — Metrics Glossary
- Reference for every metric mentioned in the deck
- Use if the audience asks "what does X mean?"