docs(P57): polish PW & DX decks — new contract shape, S&P mermaid theme, Verification Coverage, Operating Model appendix

Contract examples updated to new shape: - DX Slide 3 contract example: id/name/environment/infrastructure (no uses:, no module:) - Version pins bumped from @v1.6/@v1.8 to @v1.10 - .acdl/contract.yaml → .acdl/contract.yml in all deck examples Story beat prefix stripped: - All 'Story beat: ' prefixes removed from narrative lines (DX source + both Marp decks) - PW source-of-truth: added narrative lines to fix P51 drift (PW Marp had them, PW source didn't) DX Slide 2 reconciliation: - Title: 'Where ACDL Sits' → 'Where Agentic Cloud Delivery (ACDL) Sits' (spelled out) - Source-of-truth inline mermaid reconciled to match .mmd/PNG (subgraphed LR version) - Prose: added ACDL definition line S&P mermaid theme (all 10 diagrams): - assets/mmd/sp-theme.json: canonical S&P Red/Black/White theme - Each .mmd file: %%{init:...}%% block with inline theme (self-contained) - Two-tone classDef: accent (dark fill, white text, red border) for key nodes, supporting (white fill, black text, red border) for the rest - All 10 PNGs re-rendered with --configFile sp-theme.json - README build command updated with --configFile flag GRILL G-005 (Verification Coverage): - PW Slide 9: added block listing 6 deploy-unverified capabilities (CAP-017..022) - DX A6: same block included in the new appendix slide GRILL G-008 (Operating Model & Cost): - Both decks: new A6 appendix slide (local emulators primary tier, zero cloud cost, live-AWS one-off spike per milestone, no BAU spend) Cross-deck consistency: - DX glossary: added missing IR row (PW had it, DX didn't) - Both decks: 7-appendix convention (TOC updated, A1-A6) HTML re-rendered: - Both decks re-rendered from updated Marp source ---ci--- project: acdl phase: 57 milestone: v1.10.2 status: execute ---/ci---
2026-07-27 21:43:04 +00:00
parent 031887ec56
commit 10b87a644c
28 changed files with 431 additions and 147 deletions
@@ -155,6 +155,7 @@ docs/presentations/
 └── assets/
    ├── puppeteer-config.json                   ← no-sandbox config for mmdc
    ├── mmd/                                     ← mermaid source files (Step 2 input)
+    │   ├── sp-theme.json                         ← S&P Red/Black/White theme (mermaid-cli --configFile)
    │   ├── platform-works-01-contract-driven.mmd
    │   ├── platform-works-02-end-to-end-flow.mmd
    │   ├── platform-works-03-scope-boundary.mmd
@@ -256,12 +257,18 @@ for f in mmd/*.mmd; do
  PUPPETEER_EXECUTABLE_PATH=/root/.cache/ms-playwright/chromium-1217/chrome-linux64/chrome \
    npx --yes @mermaid-js/mermaid-cli@latest \
    -i "$f" -o "png/$name.png" \
-    -p puppeteer-config.json -s 2 -b transparent
+    -p puppeteer-config.json -s 2 -b transparent \
+    --configFile mmd/sp-theme.json
 done
 ```

 The `puppeteer-config.json` passes `--no-sandbox` to the headless browser
-(required when running as root in this environment).
+(required when running as root in this environment). The `--configFile
+mmd/sp-theme.json` applies the S&P Global Red/Black/White theme (dark
+`#1B1B1B` accent nodes with `#D6002A` red borders, white supporting nodes,
+`#F0F0F0` subgraph backgrounds). Each `.mmd` file also carries the same
+theme inline via a `%%{init:...}%%` block so it renders correctly even
+without the `--configFile` flag.

 ### Export a Marp deck to HTML (committed to repo)

@@ -1,3 +1,5 @@
+%%{init: {"theme": "base", "themeVariables": {"primaryColor": "#1B1B1B", "primaryBorderColor": "#D6002A", "primaryTextColor": "#fff", "secondaryColor": "#fff", "secondaryBorderColor": "#D6002A", "secondaryTextColor": "#1B1B1B", "tertiaryColor": "#F0F0F0", "clusterBkg": "#F0F0F0", "lineColor": "#1B1B1B", "fontFamily": "\"Akkurat Pro\", \"Helvetica Neue\", \"Arial\", sans-serif"}}}%%
+
 flowchart LR
    subgraph UP ["Upstream — anything"]
        direction TB
@@ -18,4 +20,8 @@ flowchart LR
    C --> D
    C --> E
    D --> F
-    F --> G
+    F --> G
+classDef accent fill:#1B1B1B,color:#fff,stroke:#D6002A,stroke-width:2px
+classDef supporting fill:#fff,color:#1B1B1B,stroke:#D6002A,stroke-width:1px
+class C,D,E accent
+
@@ -1,5 +1,11 @@
+%%{init: {"theme": "base", "themeVariables": {"primaryColor": "#1B1B1B", "primaryBorderColor": "#D6002A", "primaryTextColor": "#fff", "secondaryColor": "#fff", "secondaryBorderColor": "#D6002A", "secondaryTextColor": "#1B1B1B", "tertiaryColor": "#F0F0F0", "clusterBkg": "#F0F0F0", "lineColor": "#1B1B1B", "fontFamily": "\"Akkurat Pro\", \"Helvetica Neue\", \"Arial\", sans-serif"}}}%%
+
 flowchart LR
    A["1. App code<br/>(top level of the repo)"] --> D["Push to main"]
-    B["2. Contract<br/>(.acdl/contract.yaml)"] --> D
+    B["2. Contract<br/>(.acdl/contract.yml)"] --> D
    C["3. CI definition<br/>(.github/workflows/deploy.yml<br/>— one 'uses:' line)"] --> D
-    D --> E["Platform does the rest"]
+    D --> E["Platform does the rest"]
+classDef accent fill:#1B1B1B,color:#fff,stroke:#D6002A,stroke-width:2px
+classDef supporting fill:#fff,color:#1B1B1B,stroke:#D6002A,stroke-width:1px
+class E accent
+
@@ -1,6 +1,12 @@
+%%{init: {"theme": "base", "themeVariables": {"primaryColor": "#1B1B1B", "primaryBorderColor": "#D6002A", "primaryTextColor": "#fff", "secondaryColor": "#fff", "secondaryBorderColor": "#D6002A", "secondaryTextColor": "#1B1B1B", "tertiaryColor": "#F0F0F0", "clusterBkg": "#F0F0F0", "lineColor": "#1B1B1B", "fontFamily": "\"Akkurat Pro\", \"Helvetica Neue\", \"Arial\", sans-serif"}}}%%
+
 flowchart LR
    A["Consumer repo<br/>app + contract + 'uses:'"] -->|triggers on push to main| B["Platform runner"]
    B -->|checks out the consumer repo| A
    B -->|checks out the ACDL platform repo<br/>into the workspace| C["Platform code<br/>(modules, adapters, schemas)"]
    C --> B
-    B -->|runs the pipeline against<br/>the consumer's contract| D["Consumer's resources in AWS"]
+    B -->|runs the pipeline against<br/>the consumer's contract| D["Consumer's resources in AWS"]
+classDef accent fill:#1B1B1B,color:#fff,stroke:#D6002A,stroke-width:2px
+classDef supporting fill:#fff,color:#1B1B1B,stroke:#D6002A,stroke-width:1px
+class B,C accent
+
@@ -1,3 +1,5 @@
+%%{init: {"theme": "base", "themeVariables": {"primaryColor": "#1B1B1B", "primaryBorderColor": "#D6002A", "primaryTextColor": "#fff", "secondaryColor": "#fff", "secondaryBorderColor": "#D6002A", "secondaryTextColor": "#1B1B1B", "tertiaryColor": "#F0F0F0", "clusterBkg": "#F0F0F0", "lineColor": "#1B1B1B", "fontFamily": "\"Akkurat Pro\", \"Helvetica Neue\", \"Arial\", sans-serif"}}}%%
+
 flowchart LR
    A["dev\n≥ 0.50\nautonomous"] -->|promotion| B["qa\n≥ 0.75\nQA attests"]
    B -->|promotion| C["prod\n≥ 0.90\nSRE attests"]
@@ -5,4 +7,7 @@ flowchart LR
    A -.->|"Testing\n(pilot-ready)"| A
    B -.->|"Planned"| B
    C -.->|"Planned"| C
-    D -.->|"Planned"| D
+    D -.->|"Planned"| D
+classDef accent fill:#1B1B1B,color:#fff,stroke:#D6002A,stroke-width:2px
+classDef supporting fill:#fff,color:#1B1B1B,stroke:#D6002A,stroke-width:1px
+
@@ -1,3 +1,9 @@
+%%{init: {"theme": "base", "themeVariables": {"primaryColor": "#1B1B1B", "primaryBorderColor": "#D6002A", "primaryTextColor": "#fff", "secondaryColor": "#fff", "secondaryBorderColor": "#D6002A", "secondaryTextColor": "#1B1B1B", "tertiaryColor": "#F0F0F0", "clusterBkg": "#F0F0F0", "lineColor": "#1B1B1B", "fontFamily": "\"Akkurat Pro\", \"Helvetica Neue\", \"Arial\", sans-serif"}}}%%
+
 flowchart LR
    A["Consumer<br/>writes a contract"] --> B["Platform resolves,<br/>compiles, checks,<br/>deploys, records"]
-    B --> C["Resources running in AWS<br/>+ tamper-evident evidence"]
+    B --> C["Resources running in AWS<br/>+ tamper-evident evidence"]
+classDef accent fill:#1B1B1B,color:#fff,stroke:#D6002A,stroke-width:2px
+classDef supporting fill:#fff,color:#1B1B1B,stroke:#D6002A,stroke-width:1px
+class B accent
+
@@ -1,3 +1,5 @@
+%%{init: {"theme": "base", "themeVariables": {"primaryColor": "#1B1B1B", "primaryBorderColor": "#D6002A", "primaryTextColor": "#fff", "secondaryColor": "#fff", "secondaryBorderColor": "#D6002A", "secondaryTextColor": "#1B1B1B", "tertiaryColor": "#F0F0F0", "clusterBkg": "#F0F0F0", "lineColor": "#1B1B1B", "fontFamily": "\"Akkurat Pro\", \"Helvetica Neue\", \"Arial\", sans-serif"}}}%%
+
 flowchart TD
    subgraph R1 [" "]
        direction LR
@@ -7,4 +9,8 @@ flowchart TD
        direction LR
        F["Policy<br/>checks"] --> G["Confidence<br/>signal"] --> H["Evidence<br/>event"] --> I["Infrastructure<br/>apply"]
    end
-    E --> F
+    E --> F
+classDef accent fill:#1B1B1B,color:#fff,stroke:#D6002A,stroke-width:2px
+classDef supporting fill:#fff,color:#1B1B1B,stroke:#D6002A,stroke-width:1px
+class C,D,E,G,H accent
+
@@ -1,3 +1,5 @@
+%%{init: {"theme": "base", "themeVariables": {"primaryColor": "#1B1B1B", "primaryBorderColor": "#D6002A", "primaryTextColor": "#fff", "secondaryColor": "#fff", "secondaryBorderColor": "#D6002A", "secondaryTextColor": "#1B1B1B", "tertiaryColor": "#F0F0F0", "clusterBkg": "#F0F0F0", "lineColor": "#1B1B1B", "fontFamily": "\"Akkurat Pro\", \"Helvetica Neue\", \"Arial\", sans-serif"}}}%%
+
 flowchart LR
    subgraph UP ["Upstream — anything"]
        direction TB
@@ -22,4 +24,8 @@ flowchart LR
    E --> F
    E --> G
    F --> H
-    H --> I
+    H --> I
+classDef accent fill:#1B1B1B,color:#fff,stroke:#D6002A,stroke-width:2px
+classDef supporting fill:#fff,color:#1B1B1B,stroke:#D6002A,stroke-width:1px
+class D,E,F,G accent
+
@@ -1,3 +1,5 @@
+%%{init: {"theme": "base", "themeVariables": {"primaryColor": "#1B1B1B", "primaryBorderColor": "#D6002A", "primaryTextColor": "#fff", "secondaryColor": "#fff", "secondaryBorderColor": "#D6002A", "secondaryTextColor": "#1B1B1B", "tertiaryColor": "#F0F0F0", "clusterBkg": "#F0F0F0", "lineColor": "#1B1B1B", "fontFamily": "\"Akkurat Pro\", \"Helvetica Neue\", \"Arial\", sans-serif"}}}%%
+
 flowchart LR
    subgraph IN ["6 weighted inputs"]
        direction TB
@@ -12,4 +14,8 @@ flowchart LR
    G --> H{"Threshold\ngate"}
    H -->|Meets threshold| I["Proceed"]
    H -->|Below threshold| J["Halt +\nexplainable reason"]
-    H -->|Critical finding| J
+    H -->|Critical finding| J
+classDef accent fill:#1B1B1B,color:#fff,stroke:#D6002A,stroke-width:2px
+classDef supporting fill:#fff,color:#1B1B1B,stroke:#D6002A,stroke-width:1px
+class G,H,J accent
+
@@ -1,3 +1,5 @@
+%%{init: {"theme": "base", "themeVariables": {"primaryColor": "#1B1B1B", "primaryBorderColor": "#D6002A", "primaryTextColor": "#fff", "secondaryColor": "#fff", "secondaryBorderColor": "#D6002A", "secondaryTextColor": "#1B1B1B", "tertiaryColor": "#F0F0F0", "clusterBkg": "#F0F0F0", "lineColor": "#1B1B1B", "fontFamily": "\"Akkurat Pro\", \"Helvetica Neue\", \"Arial\", sans-serif"}}}%%
+
 flowchart LR
    A["Deployment arrives\nat env gate"] --> B["Confidence signal\ncomputed"]
    B --> C{"Meets\nthreshold?"}
@@ -10,4 +12,8 @@ flowchart LR
    H -->|Reject| J["Halt — rejection\nextends audit chain"]
    I --> K["Deployment\nproceeds"]
    F --> K
-    K --> L["Evidence written\nRPO=0"]
+    K --> L["Evidence written\nRPO=0"]
+classDef accent fill:#1B1B1B,color:#fff,stroke:#D6002A,stroke-width:2px
+classDef supporting fill:#fff,color:#1B1B1B,stroke:#D6002A,stroke-width:1px
+class C,E,I,K,L accent
+
@@ -1,3 +1,5 @@
+%%{init: {"theme": "base", "themeVariables": {"primaryColor": "#1B1B1B", "primaryBorderColor": "#D6002A", "primaryTextColor": "#fff", "secondaryColor": "#fff", "secondaryBorderColor": "#D6002A", "secondaryTextColor": "#1B1B1B", "tertiaryColor": "#F0F0F0", "clusterBkg": "#F0F0F0", "lineColor": "#1B1B1B", "fontFamily": "\"Akkurat Pro\", \"Helvetica Neue\", \"Arial\", sans-serif"}}}%%
+
 flowchart LR
    A["v1.0\nDEMO\ncomplete"] --> B["v1.1–v1.8\nPLATFORM BUILD\ncomplete"]
    B --> C["v1.9\nPRESENTATIONS + PATCHES\ncomplete"]
@@ -8,4 +10,8 @@ flowchart LR
    B -.->|"IR + OIDC + ABAC +\nmodule catalog +\nencryption + decommission"| B
    C -.->|"10-slide decks +\ntalking points +\nS&P theme"| C
    D -.->|"proposed phasing\nnot formally planned"| D
-    E -.->|"proposed phasing\nnot formally planned"| E
+    E -.->|"proposed phasing\nnot formally planned"| E
+classDef accent fill:#1B1B1B,color:#fff,stroke:#D6002A,stroke-width:2px
+classDef supporting fill:#fff,color:#1B1B1B,stroke:#D6002A,stroke-width:1px
+class F accent
+
@@ -0,0 +1,15 @@
+{
+  "theme": "base",
+  "themeVariables": {
+    "primaryColor": "#1B1B1B",
+    "primaryBorderColor": "#D6002A",
+    "primaryTextColor": "#fff",
+    "secondaryColor": "#fff",
+    "secondaryBorderColor": "#D6002A",
+    "secondaryTextColor": "#1B1B1B",
+    "tertiaryColor": "#F0F0F0",
+    "clusterBkg": "#F0F0F0",
+    "lineColor": "#1B1B1B",
+    "fontFamily": "\"Akkurat Pro\", \"Helvetica Neue\", \"Arial\", sans-serif"
+  }
+}
@@ -45,7 +45,7 @@ section.title h3 { color: #F0F0F0; font-weight: 400; font-size: 22px; margin-top

 # The Problem & The North Star

-<em class="story">Story beat: Here's the problem we're solving and where we're going.</em>
+<em class="story">Here's the problem we're solving and where we're going.</em>

 Four frictions slow every team:

@@ -64,7 +64,7 @@ Four frictions slow every team:

 # Where ACDL Sits in Your World

-<em class="story">Story beat: Now that we know the problem, here's where ACDL fits — and where it doesn't.</em>
+<em class="story">Now that we know the problem, here's where ACDL fits — and where it doesn't.</em>

 ![w:1100](assets/png/platform-works-03-scope-boundary.png)

@@ -77,7 +77,7 @@ Four frictions slow every team:

 # The Contract-Driven Model

-<em class="story">Story beat: The contract is the boundary between upstream and ACDL. It's all a consumer writes.</em>
+<em class="story">The contract is the boundary between upstream and ACDL. It's all a consumer writes.</em>

 A single YAML contract — **module, environment, inputs**. The platform owns everything else.

@@ -92,7 +92,7 @@ A single YAML contract — **module, environment, inputs**. The platform owns ev

 # The End-to-End Flow

-<em class="story">Story beat: Once the contract is written, here's what the platform does with it — every time.</em>
+<em class="story">Once the contract is written, here's what the platform does with it — every time.</em>

 Every deployment runs the same stages, in the same order, with the same checks — no team-specific pipelines, no tribal runbooks.

@@ -105,7 +105,7 @@ Every deployment runs the same stages, in the same order, with the same checks

 # Zero-Trust by Default

-<em class="story">Story beat: Before any infrastructure is created, here's how access is scoped.</em>
+<em class="story">Before any infrastructure is created, here's how access is scoped.</em>

 Consumer repositories hold **no long-lived cloud credentials.** Ever.

@@ -120,7 +120,7 @@ Consumer repositories hold **no long-lived cloud credentials.** Ever.

 # Safety is Computed, Not Assumed

-<em class="story">Story beat: Now let's look at how the platform decides whether a deployment is safe.</em>
+<em class="story">Now let's look at how the platform decides whether a deployment is safe.</em>

 Every delivery action produces a **measurable, explainable confidence signal** — a weighted sum of observable facts, not a black box. <span class="badge agentic">Agentic</span>

@@ -141,7 +141,7 @@ Every delivery action produces a **measurable, explainable confidence signal**

 # Security by Construction

-<em class="story">Story beat: Beyond the confidence signal, security defaults are on by construction — not by opt-in.</em>
+<em class="story">Beyond the confidence signal, security defaults are on by construction — not by opt-in.</em>

 Security defaults that **do not require a team to opt in.** Checks run on **every** deployment, normalized to a single schema. <span class="badge testing">Testing</span>

@@ -154,7 +154,7 @@ Security defaults that **do not require a team to opt in.** Checks run on **ever

 # Accountability & Audit

-<em class="story">Story beat: Computed safety handles the gate. But humans still matter — here's how accountability works.</em>
+<em class="story">Computed safety handles the gate. But humans still matter — here's how accountability works.</em>

 ![w:1100](assets/png/platform-works-05-attestation-flow.png)

@@ -171,7 +171,7 @@ Security defaults that **do not require a team to opt in.** Checks run on **ever

 # Testing vs. Planned

-<em class="story">Story beat: Let's be honest about what works today and what's on the roadmap.</em>
+<em class="story">Let's be honest about what works today and what's on the roadmap.</em>

 <style>
 section { font-size: 20px; }
@@ -192,6 +192,9 @@ section { font-size: 20px; }
 - Dynamic module creation <span class="badge agentic">Agentic</span> · Pattern recognition <span class="badge agentic">Agentic</span>
 - Additional engine adapters · Deeper observability bootstrap

+**Verification Coverage** — 6 cloud capabilities are design-verified + locally emulated, deploy-unverified (IAM drift):
+DynamoDB contracts table · Lambda contract-ingestor · ECS service live · CloudFront prod stack · uptime-kuma · OIDC role
+
 *Full inventory + phased roadmap in the appendix.*

 ---
@@ -201,7 +204,7 @@ section { font-size: 20px; }

 # The Vision Realized

-<em class="story">Story beat: Here's what success looks like when the North Star is reached.</em>
+<em class="story">Here's what success looks like when the North Star is reached.</em>

 - **Velocity without sacrificing safety.** Speed is in the ergonomics (a simple contract, a one-line `uses:`); safety is in the gates the consumer cannot bypass.
 - **Security, observability, and compliance as platform defaults** — not per-team effort, not post-hoc remediation.
@@ -226,6 +229,7 @@ section { font-size: 20px; }
 3. The Road to the North Star (phased roadmap)
 4. Testing vs. Planned (full inventory)
 5. Glossary
+6. Operating Model & Cost

 ---

@@ -332,4 +336,17 @@ li { margin-bottom: 2px; }
 | **HITL** | Human-in-the-Loop — deliberate human attestation required for qa/prod/dr environments |
 | **VCS** | Version Control System — the git hosting platform (GitHub, Gitea, GitLab) |
 | **NFR** | Non-Functional Requirement — encryption, tagging, observability standards |
-| **IR** | Intermediate Representation — the engine-agnostic stack definition between contract and Terraform |
+| **IR** | Intermediate Representation — the engine-agnostic stack definition between contract and Terraform |
+
+---
+
+# A6 — Operating Model & Cost
+
+ACDL runs at **zero cloud cost** for day-to-day development.
+
+- **Local emulators are the primary tier** — the full pipeline (contract → resolver → adapter → local ECS → flat-file outbox → local Lambda) runs in-process, no AWS credentials, no Checkov, no DynamoDB. <span class="badge testing">Testing</span>
+- **Live-AWS is a one-off spike per milestone** — `terraform init/validate/plan` against the real account verifies the adapter emits valid Terraform. No BAU cloud spend.
+- **No running infrastructure between milestones** — state is in S3 (one bucket), the outbox is in DynamoDB (one table), both are query-only between spikes.
+- **Cost drivers** are spike-scoped: Terraform plan reads (free), S3 state storage (cents), DynamoDB outbox (cents). No ECS, no CloudFront, no Lambda running persistently.
+
+**The operating model:** local-first development, milestone-scoped verification, zero BAU cloud spend.
@@ -21,6 +21,8 @@

 ## Slide 2 — The Problem & The North Star

+Here's the problem we're solving and where we're going.
+
 Software delivery scales with the **coordination surface around it**, not the engineering inside it. Most teams can write code; far fewer get the infrastructure right.

 Four frictions slow every team:
@@ -44,6 +46,8 @@ Four frictions slow every team:

 Now that we know the problem, here's where ACDL fits — and where it doesn't.

+Now that we know the problem, here's where ACDL fits — and where it doesn't.
+
 - **Upstream is anything** — your IDE, an agentic SDLC, or a citizen developer vibe coding on a laptop. ACDL doesn't care how the contract was produced.
 - **ACDL is infrastructure only** — it provisions and governs AWS resources. It does not build, test, or deploy your application code. That's upstream.
 - **Not a general-purpose AI** — autonomy is narrow, scoped to delivery, bounded by strict policy envelopes.
@@ -57,6 +61,8 @@ Now that we know the problem, here's where ACDL fits — and where it doesn't.

 The contract is the boundary between upstream and ACDL. It's all a consumer writes.

+The contract is the boundary between upstream and ACDL. It's all a consumer writes.
+
 A single YAML contract — **module, environment, inputs**. The platform owns everything else.

 ```mermaid
@@ -82,6 +88,8 @@ The consumer does **not** write infrastructure modules, workflow logic, or adapt

 Once the contract is written, here's what the platform does with it — every time.

+Once the contract is written, here's what the platform does with it — every time.
+
 Every deployment runs the same stages, in the same order, with the same checks — no team-specific pipelines, no tribal runbooks.

 ```mermaid
@@ -109,6 +117,8 @@ Two properties matter to leadership:

 Before any infrastructure is created, here's how access is scoped.

+Before any infrastructure is created, here's how access is scoped.
+
 Consumer repositories hold **no long-lived cloud credentials.** Ever.

 - **Authentication is OIDC federation** between the platform runners and the cloud provider. Each job mints a short-lived token; no credential is stored in the consumer repo or in a runner secret. *(Testing on GitHub Actions runners; planned for all platform runners.)*
@@ -126,6 +136,8 @@ Consumer repositories hold **no long-lived cloud credentials.** Ever.

 Now let's look at how the platform decides whether a deployment is safe.

+Now let's look at how the platform decides whether a deployment is safe.
+
 Every delivery action produces a **measurable, explainable confidence signal** — a weighted sum of observable facts, not a black box. *(Agentic.)*

 - **Six weighted inputs** — policy conformance, validation, freshness, source provenance, history, and non-functional requirements (NFRs). The weights are **manually tuned**, the inputs are **observable**, and the breakdown is **auditable** — if a consumer asks "why 0.62?", the platform answers with a per-input breakdown.
@@ -149,6 +161,8 @@ Every delivery action produces a **measurable, explainable confidence signal**

 Beyond the confidence signal, security defaults are on by construction — not by opt-in.

+Beyond the confidence signal, security defaults are on by construction — not by opt-in.
+
 Security defaults that **do not require a team to opt in.** Checks run on **every** deployment, normalized to a single schema regardless of which engine produced them. *(Testing.)*

 - **Infrastructure-as-code policy** (Checkov) — secrets in plaintext, public ingress, IAM wildcards, KMS key references, **required tagging standards** (`acdl:owner`, `acdl:contract`, `acdl:environment`, `acdl:cost-center`). All run *before* infra is created.
@@ -168,6 +182,8 @@ Security defaults that **do not require a team to opt in.** Checks run on **ever

 Computed safety handles the gate. But humans still matter — here's how accountability works.

+Computed safety handles the gate. But humans still matter — here's how accountability works.
+
 - **Dev is fully autonomous.** The confidence signal (≥ 0.50) is the only gate. Queue-based handoffs are eliminated from lower environments. *(Testing, Agentic.)*
 - **qa, prod, and dr require deliberate human attestation** — not rubber stamps, but policy-mandated acts of accountability via protected deployment approvals. The approver reviews the contract, the planned Terraform changes, and the accumulated evidence. *(Planned.)*
 - **QA attests to infrastructure readiness — the contract, the planned Terraform changes, and the accumulated evidence. QA does not review application code (that's upstream).**
@@ -189,6 +205,8 @@ Version control is a **coordination tool, not an evidentiary fortress.** True co

 Here's what success looks like when the North Star is reached.

+Here's what success looks like when the North Star is reached.
+
 - **Velocity without sacrificing safety.** Speed is in the ergonomics (a simple contract, a one-line `uses:`); safety is in the gates the consumer cannot bypass.
 - **Security, observability, and compliance as platform defaults** — not per-team effort, not post-hoc remediation.
 - **Auditability as a byproduct, not a project.** Every production change is traceable to a human attestation and a tamper-evident evidence event.
@@ -218,6 +236,8 @@ For deep dives — these slides cover details omitted from the main 10.

 ## A1 — Platform-Managed Environments

+For deep dives — these slides cover details omitted from the main 10.
+
 A consumer provides **no AWS account, no VPC, no subnet, no state backend, no runner key.** The platform owns the blast radius.

 A named environment is a platform-owned bundle of:
@@ -45,9 +45,9 @@ section.title h3 { color: #F0F0F0; font-weight: 400; font-size: 22px; margin-top

 ---

-# Where ACDL Sits in Your World
+# Where Agentic Cloud Delivery (ACDL) Sits in Your World

-<em class="story">Story beat: Here's who uses the platform and where the boundary is.</em>
+<em class="story">Here's who uses the platform and where the boundary is.</em>

 ![w:1100](assets/png/developer-experience-01b-scope-boundary.png)

@@ -60,24 +60,27 @@ section.title h3 { color: #F0F0F0; font-weight: 400; font-size: 22px; margin-top

 # The Contract — The Entire Consumer Surface

-<em class="story">Story beat: Now let's look at what a consumer actually writes — it's tiny.</em>
+<em class="story">Now let's look at what a consumer actually writes — it's tiny.</em>

 Three things. That is the entire consumer-side surface.

 <img src="assets/png/developer-experience-02-what-dev-does.png" style="float: right; width: 38%; margin-left: 20px; margin-bottom: 10px;" />

 - **1. App code** — the consumer's service, at the top level of the repo
- **2. A contract** — a single YAML file: module, environment, inputs
+- **2. A contract** — a single YAML file: id, name, environment, infrastructure

 ```yaml
-uses: acdl/pipelines/deploy.yaml@v1.6
-module: microservice
+id: msvc
+name: microservice
 environment: dev
-inputs:
-  cpu: 256
-  memory: 512
-  desired_count: 2
-  port: 8080
+infrastructure:
+  microservice:
+    version: "1.0.0"
+    inputs:
+      cpu: 256
+      memory: 512
+      desired_count: 2
+      port: 8080
 ```

 - **3. A one-line CI definition** — a thin `uses:` wrapper pointing at a versioned platform workflow
@@ -87,7 +90,7 @@ inputs:

 # The Developer Feedback Loop

-<em class="story">Story beat: Once you push, here's what you see — in real time, in your own logs.</em>
+<em class="story">Once you push, here's what you see — in real time, in your own logs.</em>

 Developers see **what the platform is doing**, in real time. <span class="badge testing">Testing</span>

@@ -102,11 +105,11 @@ Developers see **what the platform is doing**, in real time. <span class="badge

 # Versioned, Predictable Releases

-<em class="story">Story beat: You control when you absorb platform improvements — no surprise upgrades.</em>
+<em class="story">You control when you absorb platform improvements — no surprise upgrades.</em>

 Consumers control **when** they absorb platform improvements. <span class="badge testing">Testing</span>

- **Floating MAJOR + MINOR tags** (e.g. `@v1.6`) — a consumer automatically receives patch updates within the line
+- **Floating MAJOR + MINOR tags** (e.g. `@v1.10`) — a consumer automatically receives patch updates within the line
 - **Semantic versioning with a clear contract:** interface → MAJOR, behavior → MINOR, lifecycle → PATCH
 - **A consumer can pin to an exact version** for maximum stability, or float on MAJOR only (`@v1`) to absorb new features on their own cadence
 - **Unversioned references (`@main`, bare) are discouraged** — the versioned tag is the only immutability lever
@@ -116,7 +119,7 @@ Consumers control **when** they absorb platform improvements. <span class="badge

 # Friendly Onboarding

-<em class="story">Story beat: First impressions matter — the platform fails gracefully, not opaquely.</em>
+<em class="story">First impressions matter — the platform fails gracefully, not opaquely.</em>

 First impressions of a platform are made **when it fails for the first time.** The platform fails gracefully. <span class="badge testing">Testing</span>

@@ -135,7 +138,7 @@ The pipeline then **exits without attempting a deployment** — no partial state

 # Safe Promotion Path

-<em class="story">Story beat: Promotion is a workflow choice, not a contract edit — and the bar rises automatically.</em>
+<em class="story">Promotion is a workflow choice, not a contract edit — and the bar rises automatically.</em>

 The contract is environment-agnostic. The platform raises the bar automatically.

@@ -150,12 +153,12 @@ The contract is environment-agnostic. The platform raises the bar automatically.
 ```yaml
 jobs:
  dev:
-    uses: acdl/.github/workflows/deploy.yml@v1.6
-    with: { contract: .acdl/contract.yaml, environment: dev }
+    uses: acdl/.github/workflows/deploy.yml@v1.10
+    with: { contract: .acdl/contract.yml, environment: dev }
  qa:
    needs: dev
-    uses: acdl/.github/workflows/deploy.yml@v1.6
-    with: { contract: .acdl/contract.yaml, environment: qa }
+    uses: acdl/.github/workflows/deploy.yml@v1.10
+    with: { contract: .acdl/contract.yml, environment: qa }
 ```

 </td>
@@ -166,11 +169,11 @@ jobs:
 ```yaml
 jobs:
  dev:
-    uses: acdl/.github/workflows/deploy.yml@v1.6
+    uses: acdl/.github/workflows/deploy.yml@v1.10
    with: { contract: .acdl/contract-dev.yaml }
  qa:
    needs: dev
-    uses: acdl/.github/workflows/deploy.yml@v1.6
+    uses: acdl/.github/workflows/deploy.yml@v1.10
    with: { contract: .acdl/contract-qa.yaml }
 ```

@@ -189,14 +192,14 @@ td { font-size: 14px; }

 # Safe Decommission

-<em class="story">Story beat: Tearing down is as deliberate as deploying — and just as gated.</em>
+<em class="story">Tearing down is as deliberate as deploying — and just as gated.</em>

 Tearing down a stack is **as deliberate as deploying one.** <span class="badge testing">Testing</span>

 ```yaml
-uses: acdl/.github/workflows/deploy.yml@v1.8
+uses: acdl/.github/workflows/deploy.yml@v1.10
 with:
-  contract: .acdl/contract.yaml
+  contract: .acdl/contract.yml
  mode: decommission
  changeRequestId: "CHG0678912"
 ```
@@ -212,7 +215,7 @@ The per-stack encryption key enters a **grace window** (default 30 days) so encr

 # Self-Service Module Catalog

-<em class="story">Story beat: You don't author infrastructure — you pick from pre-built, security-reviewed building blocks.</em>
+<em class="story">You don't author infrastructure — you pick from pre-built, security-reviewed building blocks.</em>

 Developers pick from **pre-built, security-reviewed building blocks.** <span class="badge testing">Testing</span>

@@ -229,7 +232,7 @@ Developers pick from **pre-built, security-reviewed building blocks.** <span cla

 # The Desired Outcomes

-<em class="story">Story beat: Here's what this delivers to the organization.</em>
+<em class="story">Here's what this delivers to the organization.</em>

 - **Velocity without sacrificing safety.** Speed is in the ergonomics (a simple contract, a one-line `uses:`); safety is in the gates the consumer cannot bypass.
 - **Security, observability, and compliance as platform defaults** — not per-team effort, not post-hoc remediation.
@@ -255,6 +258,7 @@ Developers pick from **pre-built, security-reviewed building blocks.** <span cla
 3. Local Reproducibility (detail)
 4. The Road to the North Star (phased roadmap)
 5. Glossary
+6. Operating Model & Cost

 ---

@@ -322,4 +326,21 @@ The entire CI pipeline runs **from the shell**, not just in CI. <span class="bad
 | **RPO** | Recovery Point Objective — RPO = 0 means evidence is written synchronously, no data loss |
 | **HITL** | Human-in-the-Loop — deliberate human attestation required for qa/prod/dr environments |
 | **VCS** | Version Control System — the git hosting platform (GitHub, Gitea, GitLab) |
-| **NFR** | Non-Functional Requirement — encryption, tagging, observability standards |
+| **NFR** | Non-Functional Requirement — encryption, tagging, observability standards |
+| **IR** | Intermediate Representation — the engine-agnostic stack definition between contract and Terraform |
+
+---
+
+# A6 — Operating Model & Cost
+
+ACDL runs at **zero cloud cost** for day-to-day development.
+
+- **Local emulators are the primary tier** — the full pipeline runs in-process, no AWS credentials, no Checkov, no DynamoDB. <span class="badge testing">Testing</span>
+- **Live-AWS is a one-off spike per milestone** — `terraform init/validate/plan` verifies the adapter. No BAU cloud spend.
+- **No running infrastructure between milestones** — state in S3 (one bucket), outbox in DynamoDB (one table), both query-only.
+- **Cost drivers** are spike-scoped: Terraform plan reads (free), S3 state storage (cents), DynamoDB outbox (cents).
+
+**Verification Coverage** — 6 cloud capabilities are design-verified + locally emulated, deploy-unverified (IAM drift):
+DynamoDB contracts table · Lambda contract-ingestor · ECS service live · CloudFront prod stack · uptime-kuma · OIDC role
+
+**The operating model:** local-first development, milestone-scoped verification, zero BAU cloud spend.
@@ -17,21 +17,36 @@ The consumer surface is intentionally tiny. The platform's surface is large and

 ---

-## Slide 2 — Where ACDL Sits in Your World
+## Slide 2 — Where Agentic Cloud Delivery (ACDL) Sits in Your World

-Story beat: Here's who uses the platform and where the boundary is.
+Here's who uses the platform and where the boundary is.

 The platform serves **two kinds of consumer** through two coordinated paths — but both converge on the **same contract, the same policy envelope, and the same evidence stream.**

+**Agentic Cloud Delivery (ACDL)** sits between upstream (anything that produces a contract) and downstream (AWS resources running + the consumer's image pipeline).
+
 ```mermaid
-flowchart TD
-    U1["Anything upstream<br/>(IDE / agentic SDLC / vibe coding)"] --> T["Technical developer<br/>writes app + contract"]
-    U1 --> C["Citizen developer<br/>declares intent"]
-    T --> K["Contract YAML"]
-    C --> AI["An AI agent maps intent<br/>to a reviewed-skill contract"]
-    AI --> K
-    K --> ACDL["ACDL — infrastructure only<br/>resolve → check → plan → policy<br/>→ confidence → evidence → apply"]
-    ACDL --> AWS["AWS resources provisioned + governed"]
+flowchart LR
+    subgraph UP ["Upstream — anything"]
+        direction TB
+        A["Technical dev\n(app code + contract)"]
+        B["Citizen dev\n(intent → AI agent\n→ contract)"]
+    end
+    subgraph ACDL ["ACDL — infrastructure only"]
+        C["Same contract\nSame pipeline\nSame safety"]
+        D["Provision\nAWS resources"]
+        E["Evidence\nhash-chained"]
+    end
+    subgraph DOWN ["Downstream"]
+        F["AWS resources\nrunning"]
+        G["Consumer pipeline\ndeploys image"]
+    end
+    A --> C
+    B --> C
+    C --> D
+    C --> E
+    D --> F
+    F --> G
 ```

 - **Technical developer** — owns app code + a contract + a thin CI definition. Uses the full module catalog and inputs.
@@ -47,23 +62,26 @@ The platform is **opinionated in what it accepts, regardless of who is declaring

 ## Slide 3 — The Contract — The Entire Consumer Surface

-Story beat: Now let's look at what a consumer actually writes — it's tiny.
+Now let's look at what a consumer actually writes — it's tiny.

 Three things. That is the entire consumer-side surface.

 1. **App code** — the consumer's service, at the top level of the repo
-2. **A contract** — a single YAML file: module, environment, inputs
+2. **A contract** — a single YAML file: id, name, environment, infrastructure
 3. **A one-line CI definition** — a thin `uses:` wrapper pointing at a versioned platform workflow

 ```yaml
-uses: acdl/pipelines/deploy.yaml@v1.6
-module: microservice
+id: msvc
+name: microservice
 environment: dev
-inputs:
-  cpu: 256
-  memory: 512
-  desired_count: 2
-  port: 8080
+infrastructure:
+  microservice:
+    version: "1.0.0"
+    inputs:
+      cpu: 256
+      memory: 512
+      desired_count: 2
+      port: 8080
 ```

 The developer does **not**:
@@ -80,7 +98,7 @@ The developer does **not**:

 ## Slide 4 — The Developer Feedback Loop

-Story beat: Once you push, here's what you see — in real time, in your own logs.
+Once you push, here's what you see — in real time, in your own logs.

 Developers see **what the platform is doing**, in real time. <span class="badge testing">Testing</span>

@@ -96,11 +114,11 @@ Developers see **what the platform is doing**, in real time. <span class="badge

 ## Slide 5 — Versioned, Predictable Releases

-Story beat: You control when you absorb platform improvements — no surprise upgrades.
+You control when you absorb platform improvements — no surprise upgrades.

 Consumers control **when** they absorb platform improvements. <span class="badge testing">Testing</span>

- **Floating MAJOR + MINOR tags** (e.g. `@v1.6`) — a consumer automatically receives patch updates within the line.
+- **Floating MAJOR + MINOR tags** (e.g. `@v1.10`) — a consumer automatically receives patch updates within the line.
 - **Semantic versioning with a clear contract:** interface → MAJOR, behavior → MINOR, lifecycle → PATCH.
 - **A consumer can pin to an exact version** for maximum stability, or float on MAJOR only (`@v1`) to absorb new features on their own cadence.
 - **Unversioned references (`@main`, bare) are discouraged** — the versioned tag is the only immutability lever a consumer has.
@@ -112,7 +130,7 @@ Consumers control **when** they absorb platform improvements. <span class="badge

 ## Slide 6 — Friendly Onboarding

-Story beat: First impressions matter — the platform fails gracefully, not opaquely.
+First impressions matter — the platform fails gracefully, not opaquely.

 First impressions of a platform are made **when it fails for the first time.** The platform fails gracefully. <span class="badge testing">Testing</span>

@@ -133,7 +151,7 @@ The pipeline then **exits without attempting a deployment** — no partial state

 ## Slide 7 — Safe Promotion Path

-Story beat: Promotion is a workflow choice, not a contract edit — and the bar rises automatically.
+Promotion is a workflow choice, not a contract edit — and the bar rises automatically.

 The contract is environment-agnostic. The platform raises the bar automatically.

@@ -149,12 +167,12 @@ flowchart LR
 ```yaml
 jobs:
  dev:
-    uses: acdl/.github/workflows/deploy.yml@v1.6
-    with: { contract: .acdl/contract.yaml, environment: dev }
+    uses: acdl/.github/workflows/deploy.yml@v1.10
+    with: { contract: .acdl/contract.yml, environment: dev }
  qa:
    needs: dev
-    uses: acdl/.github/workflows/deploy.yml@v1.6
-    with: { contract: .acdl/contract.yaml, environment: qa }
+    uses: acdl/.github/workflows/deploy.yml@v1.10
+    with: { contract: .acdl/contract.yml, environment: qa }
 ```

 **Approach B — Environment-specific contracts.** When inputs genuinely differ per environment, each job points at its own contract file. The pipeline, policy, and confidence model stay identical.
@@ -162,11 +180,11 @@ jobs:
 ```yaml
 jobs:
  dev:
-    uses: acdl/.github/workflows/deploy.yml@v1.6
+    uses: acdl/.github/workflows/deploy.yml@v1.10
    with: { contract: .acdl/contract-dev.yaml }
  qa:
    needs: dev
-    uses: acdl/.github/workflows/deploy.yml@v1.6
+    uses: acdl/.github/workflows/deploy.yml@v1.10
    with: { contract: .acdl/contract-qa.yaml }
 ```

@@ -189,14 +207,14 @@ Whichever approach a team picks, the platform applies the same rising bar:

 ## Slide 8 — Safe Decommission

-Story beat: Tearing down is as deliberate as deploying — and just as gated.
+Tearing down is as deliberate as deploying — and just as gated.

 Tearing down a stack is **as deliberate as deploying one.** <span class="badge testing">Testing</span>

 ```yaml
-uses: acdl/.github/workflows/deploy.yml@v1.8
+uses: acdl/.github/workflows/deploy.yml@v1.10
 with:
-  contract: .acdl/contract.yaml
+  contract: .acdl/contract.yml
  mode: decommission
  changeRequestId: "CHG0678912"
 ```
@@ -214,7 +232,7 @@ The per-stack encryption key enters a **grace window** (default 30 days) so encr

 ## Slide 9 — Self-Service Module Catalog

-Story beat: You don't author infrastructure — you pick from pre-built, security-reviewed building blocks.
+You don't author infrastructure — you pick from pre-built, security-reviewed building blocks.

 Developers pick from **pre-built, security-reviewed building blocks.** <span class="badge testing">Testing</span>

@@ -230,7 +248,7 @@ Developers pick from **pre-built, security-reviewed building blocks.** <span cla

 ## Slide 10 — The Desired Outcomes

-Story beat: Here's what this delivers to the organization.
+Here's what this delivers to the organization.

 - **Velocity without sacrificing safety.** Speed is in the ergonomics (a simple contract, a one-line `uses:`); safety is in the gates the consumer cannot bypass.
 - **Security, observability, and compliance as platform defaults** — not per-team effort, not post-hoc remediation. Encryption, deletion protection, uptime monitoring, policy checks, and evidence are on by construction.