docs(P71): polish leadership decks — action headlines, trim, 6 new diagrams (v1.13)
Polish both leadership decks (how-the-platform-works + the-developer-experience) across all 4 pipeline layers (source md, marp, html, talking points). Story-arc restructure (per storytelling best practices): - Intro ~10% / Body ~80% / Conclusion ~10%; 3-5 body points per deck - One idea per slide; action headlines replace category names - Before/after 2-slide sequence (problem -> north star) on platform deck - Main 10 slides kept; detail pushed to expanded appendix (8 + 7) Word reduction + natural flow: - Remove all <em class="story"> transition lines (flow carried by headlines) - Bullets <= 12 words, 3-4 per main slide (was 5-6) - Cut parentheticals, sub-clauses, redundant restatements Design + visuals: - Larger fonts: body 22 -> 26px, h1 34 -> 40px, h2 26 -> 32px, blockquote 20 -> 24px - 6 new mermaid diagrams -> PNGs: - platform-works-02-frictions (2x2 quadrant) - platform-works-03-north-star (before/after) - platform-works-07-zero-trust (OIDC + ABAC flow) - developer-experience-05-catalog (primitives -> modules) - developer-experience-07-decommission (6-node gate flow) - developer-experience-08-semver (floating/pinned/major timeline) - At most 1 diagram per main slide; no diagrams on title/conclusion - High contrast preserved, no animations, maturity badges intact Verify: - Marp renders both decks clean (HTML re-rendered, committed) - Talking-points sections == Marp slide count per deck - No stale "deploy-unverified" claims (only closed-status disclosure) - 522 tests pass (no code touched; only docs/presentations/ files changed) - 22/22 Verified framing preserved verbatim from v1.12 ---ci--- project: acdl phase: 71 milestone: v1.13 status: complete ---/ci---
This commit is contained in:
Jon Chery
@@ -0,0 +1,25 @@
|
||||
%%{init: {"theme": "base", "themeVariables": {"primaryColor": "#1B1B1B", "primaryBorderColor": "#D6002A", "primaryTextColor": "#fff", "secondaryColor": "#fff", "secondaryBorderColor": "#D6002A", "secondaryTextColor": "#1B1B1B", "tertiaryColor": "#F0F0F0", "clusterBkg": "#F0F0F0", "lineColor": "#1B1B1B", "fontFamily": "\"Akkurat Pro\", \"Helvetica Neue\", \"Arial\", sans-serif"}}}%%
|
||||
|
||||
flowchart LR
|
||||
subgraph PRIM ["Primitives"]
|
||||
direction TB
|
||||
P1["S3"]
|
||||
P2["VPC"]
|
||||
P3["ECS"]
|
||||
P4["IAM"]
|
||||
P5["ALB"]
|
||||
P6["ECR"]
|
||||
P7["CloudFront"]
|
||||
P8["WAF"]
|
||||
P9["RDS"]
|
||||
end
|
||||
subgraph MOD ["Modules — composed patterns"]
|
||||
direction TB
|
||||
M1["Static site\nCDN + WAF + S3"]
|
||||
M2["Microservice\nVPC + ECS + ALB + ECR"]
|
||||
end
|
||||
PRIM --> MOD
|
||||
classDef accent fill:#1B1B1B,color:#fff,stroke:#D6002A,stroke-width:2px
|
||||
classDef supporting fill:#fff,color:#1B1B1B,stroke:#D6002A,stroke-width:1px
|
||||
class P1,P2,P3,P4,P5,P6,P7,P8,P9 supporting
|
||||
class M1,M2 accent
|
||||
@@ -0,0 +1,14 @@
|
||||
%%{init: {"theme": "base", "themeVariables": {"primaryColor": "#1B1B1B", "primaryBorderColor": "#D6002A", "primaryTextColor": "#fff", "secondaryColor": "#fff", "secondaryBorderColor": "#D6002A", "secondaryTextColor": "#1B1B1B", "tertiaryColor": "#F0F0F0", "clusterBkg": "#F0F0F0", "lineColor": "#1B1B1B", "fontFamily": "\"Akkurat Pro\", \"Helvetica Neue\", \"Arial\", sans-serif"}}}%%
|
||||
|
||||
flowchart LR
|
||||
A["Validate CR\n(CMDB)"]
|
||||
B["Disable\nprevent_destroy"]
|
||||
C["SRE\napprove"]
|
||||
D["Zero counts\n+ destroy"]
|
||||
E["SRE\napprove"]
|
||||
F["Key enters\ngrace window"]
|
||||
A --> B --> C --> D --> E --> F
|
||||
classDef accent fill:#1B1B1B,color:#fff,stroke:#D6002A,stroke-width:2px
|
||||
classDef supporting fill:#fff,color:#1B1B1B,stroke:#D6002A,stroke-width:1px
|
||||
class A,B,D,F supporting
|
||||
class C,E accent
|
||||
@@ -0,0 +1,28 @@
|
||||
%%{init: {"theme": "base", "themeVariables": {"primaryColor": "#1B1B1B", "primaryBorderColor": "#D6002A", "primaryTextColor": "#fff", "secondaryColor": "#fff", "secondaryBorderColor": "#D6002A", "secondaryTextColor": "#1B1B1B", "tertiaryColor": "#F0F0F0", "clusterBkg": "#F0F0F0", "lineColor": "#1B1B1B", "fontFamily": "\"Akkurat Pro\", \"Helvetica Neue\", \"Arial\", sans-serif"}}}%%
|
||||
|
||||
flowchart LR
|
||||
subgraph FLOAT ["@v1.12 — floating MAJOR+MINOR"]
|
||||
direction LR
|
||||
F1["v1.12.0"]
|
||||
F2["v1.12.1"]
|
||||
F3["v1.12.2"]
|
||||
F1 --> F2 --> F3
|
||||
end
|
||||
subgraph PIN ["@v1.12.2 — pinned exact"]
|
||||
direction LR
|
||||
P1["v1.12.2"]
|
||||
P2["v1.12.2"]
|
||||
P3["v1.12.2"]
|
||||
P1 --> P2 --> P3
|
||||
end
|
||||
subgraph MAJ ["@v1 — float MAJOR only"]
|
||||
direction LR
|
||||
M1["v1.12.0"]
|
||||
M2["v1.13.0"]
|
||||
M3["v1.14.0"]
|
||||
M1 --> M2 --> M3
|
||||
end
|
||||
classDef accent fill:#1B1B1B,color:#fff,stroke:#D6002A,stroke-width:2px
|
||||
classDef supporting fill:#fff,color:#1B1B1B,stroke:#D6002A,stroke-width:1px
|
||||
class F1,F2,F3,M1,M2,M3 accent
|
||||
class P1,P2,P3 supporting
|
||||
@@ -0,0 +1,19 @@
|
||||
%%{init: {"theme": "base", "themeVariables": {"primaryColor": "#1B1B1B", "primaryBorderColor": "#D6002A", "primaryTextColor": "#fff", "secondaryColor": "#fff", "secondaryBorderColor": "#D6002A", "secondaryTextColor": "#1B1B1B", "tertiaryColor": "#F0F0F0", "clusterBkg": "#F0F0F0", "lineColor": "#1B1B1B", "fontFamily": "\"Akkurat Pro\", \"Helvetica Neue\", \"Arial\", sans-serif"}}}%%
|
||||
|
||||
flowchart LR
|
||||
subgraph ROW1 [" "]
|
||||
direction LR
|
||||
A["Cognitive load\nauthoring infra correctly"]
|
||||
B["Operational work\nmerged → running"]
|
||||
end
|
||||
subgraph ROW2 [" "]
|
||||
direction LR
|
||||
C["Red tape\ntickets, approvals, handoffs"]
|
||||
D["Scalability\nthroughput without headcount"]
|
||||
end
|
||||
A ~~~ B
|
||||
C ~~~ D
|
||||
A ~~~ C
|
||||
B ~~~ D
|
||||
classDef accent fill:#1B1B1B,color:#fff,stroke:#D6002A,stroke-width:2px
|
||||
class A,B,C,D accent
|
||||
@@ -0,0 +1,23 @@
|
||||
%%{init: {"theme": "base", "themeVariables": {"primaryColor": "#1B1B1B", "primaryBorderColor": "#D6002A", "primaryTextColor": "#fff", "secondaryColor": "#fff", "secondaryBorderColor": "#D6002A", "secondaryTextColor": "#1B1B1B", "tertiaryColor": "#F0F0F0", "clusterBkg": "#F0F0F0", "lineColor": "#1B1B1B", "fontFamily": "\"Akkurat Pro\", \"Helvetica Neue\", \"Arial\", sans-serif"}}}%%
|
||||
|
||||
flowchart LR
|
||||
subgraph TODAY ["Today"]
|
||||
direction TB
|
||||
A["Merged change"]
|
||||
B["Waits in queue"]
|
||||
C["Ticket + approvals"]
|
||||
D["Manual promotion"]
|
||||
A --> B --> C --> D
|
||||
end
|
||||
subgraph ACDL ["With ACDL"]
|
||||
direction TB
|
||||
E["Declare intent\n(one YAML contract)"]
|
||||
F["Platform delivers\nsafely, autonomously"]
|
||||
G["Traceable to\nhuman attestation"]
|
||||
E --> F --> G
|
||||
end
|
||||
TODAY -.before.-> ACDL
|
||||
classDef accent fill:#1B1B1B,color:#fff,stroke:#D6002A,stroke-width:2px
|
||||
classDef supporting fill:#fff,color:#1B1B1B,stroke:#D6002A,stroke-width:1px
|
||||
class A,B,C,D supporting
|
||||
class E,F,G accent
|
||||
@@ -0,0 +1,12 @@
|
||||
%%{init: {"theme": "base", "themeVariables": {"primaryColor": "#1B1B1B", "primaryBorderColor": "#D6002A", "primaryTextColor": "#fff", "secondaryColor": "#fff", "secondaryBorderColor": "#D6002A", "secondaryTextColor": "#1B1B1B", "tertiaryColor": "#F0F0F0", "clusterBkg": "#F0F0F0", "lineColor": "#1B1B1B", "fontFamily": "\"Akkurat Pro\", \"Helvetica Neue\", \"Arial\", sans-serif"}}}%%
|
||||
|
||||
flowchart LR
|
||||
A["Consumer repo\n(no credentials)"]
|
||||
B["OIDC federation\nshort-lived token"]
|
||||
C["ABAC session policy\nrepo identity + tags"]
|
||||
D["Tagged resources\nonly"]
|
||||
A --> B --> C --> D
|
||||
classDef accent fill:#1B1B1B,color:#fff,stroke:#D6002A,stroke-width:2px
|
||||
classDef supporting fill:#fff,color:#1B1B1B,stroke:#D6002A,stroke-width:1px
|
||||
class A,D supporting
|
||||
class B,C accent
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 14 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 19 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 39 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 20 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 56 KiB |
Binary file not shown.
|
After Width: | Height: | Size: 24 KiB |
@@ -8,21 +8,20 @@ footer: "Internal"
|
||||
style: |
|
||||
section {
|
||||
font-family: "Akkurat Pro", "Helvetica Neue", "Arial", sans-serif;
|
||||
font-size: 22px;
|
||||
font-size: 26px;
|
||||
color: #1B1B1B;
|
||||
}
|
||||
h1 { color: #D6002A; font-size: 34px; margin-bottom: 0.3em; }
|
||||
h2 { color: #D6002A; font-size: 26px; margin-bottom: 0.2em; }
|
||||
h1 { color: #D6002A; font-size: 40px; margin-bottom: 0.3em; }
|
||||
h2 { color: #D6002A; font-size: 32px; margin-bottom: 0.2em; }
|
||||
section.title { background: #1B1B1B; color: #fff; border-top: 8px solid #D6002A; }
|
||||
section.title h1 { color: #fff; }
|
||||
table { font-size: 18px; width: 100%; }
|
||||
table { font-size: 22px; width: 100%; }
|
||||
th { background: #F0F0F0; }
|
||||
blockquote { border-left: 4px solid #D6002A; color: #2E2E2E; font-size: 20px; }
|
||||
blockquote { border-left: 4px solid #D6002A; color: #2E2E2E; font-size: 24px; }
|
||||
img { display: block; margin: 0 auto; max-height: 300px; }
|
||||
em.story { color: #6B7280; font-size: 16px; font-style: italic; }
|
||||
.badge {
|
||||
display: inline-block; padding: 2px 8px; border-radius: 4px;
|
||||
font-size: 14px; font-weight: 600;
|
||||
font-size: 16px; font-weight: 600;
|
||||
}
|
||||
.testing { background: #DBEAFE; color: #1E3A5F; }
|
||||
.planned { background: #fef3c7; color: #78350f; }
|
||||
@@ -43,91 +42,73 @@ section.title h3 { color: #F0F0F0; font-weight: 400; font-size: 22px; margin-top
|
||||
|
||||
---
|
||||
|
||||
# The Problem & The North Star
|
||||
# Four frictions slow every team
|
||||
|
||||
<em class="story">Here's the problem we're solving and where we're going.</em>
|
||||
|
||||
|
||||
Four frictions slow every team:
|
||||
|
||||
- **Cognitive load** — authoring infrastructure correctly; the long tail of services inconsistent in security and observability
|
||||
- **Operational work** — promoting a change from "merged" to "running in production." Manual work that **scales with the system, not the change**
|
||||
- **Red tape** — tickets, approvals, and handoffs that scale with the organization. A merged change waits in a queue
|
||||
- **Scalability without increasing headcount** — throughput scales without linearly scaling platform engineers
|
||||
|
||||
> Consumers **declare intent**; the platform delivers **safe production deployment** — automatically, safely, with a complete audit trail.
|
||||
|
||||
- A merged change progresses **without a platform engineer joining a thread or approving a ticket**
|
||||
- A **non-technical consumer** ships by declaring intent — no workflow, no config file, no infrastructure module
|
||||
- Every production change is **traceable to a human attestation and an immutable evidence stream**
|
||||
- **Cognitive load** — services inconsistent in security and observability
|
||||
- **Operational work** — manual promotion scaling with the system
|
||||
- **Red tape** — tickets and handoffs scaling with the organization
|
||||
- **Scalability** — throughput without scaling platform engineers
|
||||
|
||||
---
|
||||
|
||||
# Where ACDL Sits in Your World
|
||||
# Declare intent; the platform delivers safe production
|
||||
|
||||
<em class="story">Now that we know the problem, here's where ACDL fits — and where it doesn't.</em>
|
||||
|
||||
|
||||
- A merged change progresses **without a ticket or thread**
|
||||
- A **non-technical consumer** ships by declaring intent
|
||||
- Every production change is **traceable to a human attestation**
|
||||
|
||||
---
|
||||
|
||||
# ACDL owns infrastructure, not your app
|
||||
|
||||
|
||||
|
||||
- **Upstream is anything** — your IDE, an agentic SDLC, or a citizen developer vibe coding on a laptop. ACDL doesn't care how the contract was produced.
|
||||
- **ACDL is infrastructure only** — it provisions and governs AWS resources. It does not build, test, or deploy your application code. That's upstream.
|
||||
- **Not a general-purpose AI** — autonomy is narrow, scoped to delivery, bounded by strict policy
|
||||
- **Not a permissive delivery highway** — no escape hatches to bypass the confidence framework
|
||||
- **Upstream is anything** — IDE, agentic SDLC, or vibe coding
|
||||
- **ACDL is infrastructure only** — provisions and governs AWS resources
|
||||
- **Not a general-purpose AI** — autonomy is narrow, policy-bounded
|
||||
- **Not a permissive highway** — no escape hatches
|
||||
|
||||
---
|
||||
|
||||
# The Contract-Driven Model
|
||||
|
||||
<em class="story">The contract is the boundary between upstream and ACDL. It's all a consumer writes.</em>
|
||||
|
||||
A single YAML contract — **module, environment, inputs**. The platform owns everything else.
|
||||
# One YAML file. The platform owns everything else.
|
||||
|
||||
|
||||
|
||||
- **Which module** — a catalog of pre-built, security-reviewed building blocks
|
||||
- **Which environment** — the platform raises the safety bar automatically as sensitivity rises
|
||||
- **Which inputs** — infrastructure values that vary per deployment (cpu, memory, port, desired_count)
|
||||
- The consumer provides **no AWS account, no VPC, no state backend** — the platform owns the blast radius
|
||||
- **Module** — pre-built, security-reviewed building blocks
|
||||
- **Environment** — `dev`, `qa`, `prod`, `dr`; bar rises with sensitivity
|
||||
- **Inputs** — cpu, memory, port, desired_count
|
||||
- Consumer provides **no AWS account, no VPC, no state backend**
|
||||
|
||||
---
|
||||
|
||||
# The End-to-End Flow
|
||||
|
||||
<em class="story">Once the contract is written, here's what the platform does with it — every time.</em>
|
||||
|
||||
Every deployment runs the same stages, in the same order, with the same checks — no team-specific pipelines, no tribal runbooks.
|
||||
# Same stages, same checks, every deployment
|
||||
|
||||
|
||||
|
||||
- **Security and policy checks run *before* any infrastructure is created**
|
||||
- **Every stage produces a record** that feeds the confidence signal and the evidence stream — there is no "unchecked" path
|
||||
- **Security and policy checks run *before* any infra is created**
|
||||
- **Every stage produces a record** — no "unchecked" path
|
||||
|
||||
---
|
||||
|
||||
# Zero-Trust by Default
|
||||
# No long-lived credentials. Blast radius contained.
|
||||
|
||||
<em class="story">Before any infrastructure is created, here's how access is scoped.</em>
|
||||
|
||||
|
||||
Consumer repositories hold **no long-lived cloud credentials.** Ever.
|
||||
|
||||
- **Authentication — OIDC federation.** Each job mints a short-lived token; no credential is stored in the consumer repo or in a runner secret. <span class="badge testing">Testing (GitHub Actions)</span> <span class="badge planned">Planned: all runners</span>
|
||||
- **Authorization — attribute-based (ABAC), not role-based.** Two attribute classes scope every action:
|
||||
- **Repository identity** — the role's trust policy binds to the exact consumer repo + branch
|
||||
- **Resource tags** — every resource is tagged `acdl:owner` + `acdl:contract`; the session policy grants access **only to matching tags**
|
||||
|
||||
**The effect:** a consumer can only touch the resources it created. Blast radius is contained. One consumer can never affect another.
|
||||
- **OIDC federation** — short-lived token per job, no stored credential <span class="badge testing">Testing (GitHub Actions)</span> <span class="badge planned">Planned: all runners</span>
|
||||
- **ABAC, not role-based** — repo identity + resource tags scope every action
|
||||
- **A consumer can only touch its own tagged resources.** One consumer can never affect another.
|
||||
|
||||
---
|
||||
|
||||
# Safety is Computed, Not Assumed
|
||||
# Safety is a measurable signal, not a black box
|
||||
|
||||
<em class="story">Now let's look at how the platform decides whether a deployment is safe.</em>
|
||||
|
||||
|
||||
Every delivery action produces a **measurable, explainable confidence signal** — a weighted sum of observable facts, not a black box. <span class="badge agentic">Agentic</span>
|
||||
|
||||
|
||||
|
||||
- **Six weighted inputs** — manually tuned, auditable. If a consumer asks "why 0.62?", the platform answers with a per-input breakdown
|
||||
- **Per-environment thresholds** that rise with sensitivity:
|
||||
- **Six weighted inputs** — manually tuned, auditable per-input breakdown <span class="badge agentic">Agentic</span>
|
||||
|
||||
| Environment | Threshold | Attester |
|
||||
|---|---|---|
|
||||
@@ -135,82 +116,32 @@ Every delivery action produces a **measurable, explainable confidence signal**
|
||||
| qa | ≥ 0.75 | QA <span class="badge planned">Planned</span> |
|
||||
| prod | ≥ 0.90 | SRE <span class="badge planned">Planned</span> |
|
||||
|
||||
- **A single critical finding hard-blocks** — critical findings are not averaged away
|
||||
- **A single critical finding hard-blocks** — not averaged away
|
||||
|
||||
---
|
||||
|
||||
# Security by Construction
|
||||
|
||||
<em class="story">Beyond the confidence signal, security defaults are on by construction — not by opt-in.</em>
|
||||
|
||||
Security defaults that **do not require a team to opt in.** Checks run on **every** deployment, normalized to a single schema. <span class="badge testing">Testing</span>
|
||||
|
||||
- **Policy checks** (Checkov, Wiz, Kyverno) — secrets in plaintext, public ingress, IAM wildcards, **required tagging standards** — all run *before* infra is created
|
||||
- **Encryption on every resource** — at-rest encryption on by default; per-stack customer-managed keys with 90-day rotation, **no shared keys across stacks**
|
||||
- **Deletion protection on by default** — `prevent_destroy` on unless explicitly disabled via a documented flag
|
||||
- **Safe decommission** — a 2-step pipeline with **two SRE attestation gates** and a **change-request validated against the CMDB**
|
||||
|
||||
---
|
||||
|
||||
# Accountability & Audit
|
||||
|
||||
<em class="story">Computed safety handles the gate. But humans still matter — here's how accountability works.</em>
|
||||
# Every change traceable to a human attestation
|
||||
|
||||
|
||||
|
||||
- **Dev is fully autonomous.** The confidence signal (≥ 0.50) is the only gate. <span class="badge testing">Testing</span> <span class="badge agentic">Agentic</span>
|
||||
- **qa, prod, dr require human attestation** — the approver reviews the contract, the planned Terraform changes, and the accumulated evidence <span class="badge planned">Planned</span>
|
||||
- **QA attests to infrastructure readiness, not application code** — the contract, the plan, and the evidence. Application code review is upstream
|
||||
- **Separation of duties** — the QA approver **cannot** be the prod approver. The platform **blocks on a match.** <span class="badge planned">Planned</span>
|
||||
- **Every deployment writes a hash-chained evidence event** — tampering breaks the chain. **RPO = 0** <span class="badge testing">Testing</span>
|
||||
- **Dev is fully autonomous** — confidence signal is the only gate <span class="badge testing">Testing</span> <span class="badge agentic">Agentic</span>
|
||||
- **qa, prod, dr require human attestation** — contract + plan + evidence <span class="badge planned">Planned</span>
|
||||
- **Separation of duties** — QA approver ≠ prod approver; platform **blocks on a match** <span class="badge planned">Planned</span>
|
||||
- **Hash-chained evidence event** — tampering breaks the chain. **RPO = 0** <span class="badge testing">Testing</span>
|
||||
|
||||
---
|
||||
|
||||
<!-- _class: title -->
|
||||
<!-- _paginate: false -->
|
||||
|
||||
# Testing vs. Planned
|
||||
# The vision realized
|
||||
|
||||
<em class="story">Let's be honest about what works today and what's on the roadmap.</em>
|
||||
|
||||
<style>
|
||||
section { font-size: 20px; }
|
||||
</style>
|
||||
|
||||
**22/22 Verified** via lifecycle pipeline + regression gate:
|
||||
|
||||
- Contract-driven deploys · Module catalog · Zero-trust OIDC + ABAC
|
||||
- Security + policy checks before infra creation · Confidence signal gating
|
||||
- Hash-chained evidence outbox (RPO = 0) · Encryption by default + per-stack CMKs
|
||||
- Deletion protection + safe decommission · Uptime monitoring
|
||||
- Platform-managed environments · Engine-agnostic core + VCS-agnostic ingestion
|
||||
|
||||
**9 planned** (production path):
|
||||
|
||||
- HITL wiring for qa/prod/dr · All-runner OIDC · Full regulatory ledger
|
||||
- Compliance milestone (GDPR, SOX, SOC2, DORA) · Environment self-service
|
||||
- Dynamic module creation <span class="badge agentic">Agentic</span> · Pattern recognition <span class="badge agentic">Agentic</span>
|
||||
- Additional engine adapters · Deeper observability bootstrap
|
||||
|
||||
**22/22 Verified** — the v1.11 lifecycle pipeline ran apply→modify→destroy against live AWS, then tore down to zero-cost (D-096). The v1.10 "6 deploy-unverified (IAM drift)" status is closed.
|
||||
|
||||
*Full inventory + phased roadmap in the appendix.*
|
||||
|
||||
---
|
||||
|
||||
<!-- _class: title -->
|
||||
<!-- _paginate: false -->
|
||||
|
||||
# The Vision Realized
|
||||
|
||||
<em class="story">Here's what success looks like when the North Star is reached.</em>
|
||||
|
||||
- **Velocity without sacrificing safety.** Speed is in the ergonomics (a simple contract, a one-line `uses:`); safety is in the gates the consumer cannot bypass.
|
||||
- **Security, observability, and compliance as platform defaults** — not per-team effort, not post-hoc remediation.
|
||||
- **Auditability as a byproduct, not a project.** Every production change is traceable to a human attestation and a tamper-evident evidence event.
|
||||
- **Blast radius contained by design.** Zero-trust OIDC + ABAC means a consumer can only touch its own tagged resources.
|
||||
- **Infrastructure as a utility, not a craft.** Teams consume infrastructure, they don't maintain it.
|
||||
- **A path to the citizen developer.** The same safety envelope that serves a senior engineer will serve a non-technical consumer. <span class="badge agentic">Agentic</span>
|
||||
- **Velocity without sacrificing safety** — speed in ergonomics, safety in unbypassable gates
|
||||
- **Security, observability, compliance as platform defaults** — not per-team effort
|
||||
- **Auditability as a byproduct, not a project** — every change traceable to a human attestation
|
||||
- **Blast radius contained by design** — OIDC + ABAC, only your own tagged resources
|
||||
- **Infrastructure as a utility, not a craft** — consume, don't maintain
|
||||
- **A path to the citizen developer** — same envelope, senior engineer or non-technical <span class="badge agentic">Agentic</span>
|
||||
|
||||
---
|
||||
|
||||
@@ -219,17 +150,16 @@ section { font-size: 20px; }
|
||||
|
||||
# Appendix
|
||||
|
||||
<em class="story">For deep dives — these slides cover details omitted from the main 10.</em>
|
||||
|
||||
**Contents:**
|
||||
|
||||
1. Platform-Managed Environments (detail)
|
||||
2. Observability Built In (detail)
|
||||
3. The Road to the North Star (phased roadmap)
|
||||
4. Testing vs. Planned (full inventory)
|
||||
5. Glossary
|
||||
6. Operating Model & Cost
|
||||
7. Verified by Construction
|
||||
3. Security by Construction (the full defaults inventory)
|
||||
4. The Road to the North Star (phased roadmap)
|
||||
5. Testing vs. Planned (full inventory)
|
||||
6. Glossary
|
||||
7. Operating Model & Cost (real AWS spend + pre-mortem)
|
||||
8. Verified by Construction (the v1.11 architecture)
|
||||
|
||||
---
|
||||
|
||||
@@ -244,7 +174,7 @@ A named environment is a platform-owned bundle of:
|
||||
- A state backend (S3 + DynamoDB for state + locking)
|
||||
- An IAM role surfaced via ABAC, scoped to the consumer's identity and resource tags
|
||||
|
||||
The consumer selects an environment **by name** in their contract. The platform resolves the name to the underlying resources at run time. **The consumer never sees raw credentials.**
|
||||
The consumer selects an environment **by name** in their contract. The platform resolves it at run time. **The consumer never sees raw credentials.**
|
||||
|
||||
**Friendly onboarding:** the first run detects no environment and emits a guided prompt (not an opaque failure). <span class="badge testing">Testing</span> <span class="badge planned">Self-service: planned</span>
|
||||
|
||||
@@ -254,18 +184,29 @@ The consumer selects an environment **by name** in their contract. The platform
|
||||
|
||||
Monitoring is **a platform default, not a per-team project.** <span class="badge testing">Testing</span>
|
||||
|
||||
- **Uptime monitoring deployed automatically with every stack** — a dedicated monitoring instance is provisioned after any module deploy, in a separate state, with a feature flag to disable
|
||||
- **Uptime monitoring deployed automatically with every stack** — separate state, feature flag to disable
|
||||
- **Monitored endpoints passed from the deployment's own outputs** — no manual endpoint registration
|
||||
- **Alert channels:** Microsoft Teams webhook, email, SMS, and GitHub issues
|
||||
- **The uptime URL is published to the developer** via a PR comment — they don't hunt for it
|
||||
- **Roadmap:** deeper observability bootstrap (dashboards, runbooks, on-call bindings) as first-class contract fields <span class="badge planned">Planned</span>
|
||||
- **The uptime URL is published to the developer** via a PR comment
|
||||
- **Roadmap:** deeper observability bootstrap (dashboards, runbooks, on-call bindings) <span class="badge planned">Planned</span>
|
||||
|
||||
---
|
||||
|
||||
# A3 — Security by Construction
|
||||
|
||||
Security defaults that **do not require a team to opt in.** Checks run on **every** deployment, normalized to a single schema. <span class="badge testing">Testing</span>
|
||||
|
||||
- **Policy checks** (Checkov, Wiz, Kyverno) — secrets, public ingress, IAM wildcards, **required tagging** — all run *before* infra is created
|
||||
- **Encryption on every resource** — at-rest on by default; per-stack CMKs with 90-day rotation, **no shared keys across stacks**
|
||||
- **Deletion protection on by default** — `prevent_destroy` on unless explicitly disabled via a documented flag
|
||||
- **Safe decommission** — a 2-step pipeline with **two SRE attestation gates** and a **change-request validated against the CMDB**
|
||||
|
||||
---
|
||||
|
||||
<!-- _class: title -->
|
||||
<!-- _paginate: false -->
|
||||
|
||||
# A3 — The Road to the North Star
|
||||
# A4 — The Road to the North Star
|
||||
|
||||
*Proposed phasing — not formally planned.*
|
||||
|
||||
@@ -276,11 +217,11 @@ Monitoring is **a platform default, not a per-team project.** <span class="badge
|
||||
<!-- _class: title -->
|
||||
<!-- _paginate: false -->
|
||||
|
||||
# A4 — Testing vs. Planned (Full Inventory)
|
||||
# A5 — Testing vs. Planned (Full Inventory)
|
||||
|
||||
<style>
|
||||
section { font-size: 15px; }
|
||||
td { font-size: 14px; vertical-align: top; }
|
||||
section { font-size: 18px; }
|
||||
td { font-size: 16px; vertical-align: top; }
|
||||
ul { margin: 0; padding-left: 1.2em; }
|
||||
li { margin-bottom: 2px; }
|
||||
</style>
|
||||
@@ -326,7 +267,7 @@ li { margin-bottom: 2px; }
|
||||
|
||||
---
|
||||
|
||||
# A5 — Glossary
|
||||
# A6 — Glossary
|
||||
|
||||
| Term | Meaning |
|
||||
|---|---|
|
||||
@@ -342,11 +283,11 @@ li { margin-bottom: 2px; }
|
||||
|
||||
---
|
||||
|
||||
# A6 — Operating Model & Cost
|
||||
# A7 — Operating Model & Cost
|
||||
|
||||
<style>
|
||||
section { font-size: 18px; }
|
||||
table { font-size: 16px; }
|
||||
section { font-size: 20px; }
|
||||
table { font-size: 18px; }
|
||||
</style>
|
||||
|
||||
ACDL runs at **zero cloud cost** for day-to-day development. AWS spend was measured via Cost Explorer (`COST.md`, 2026-07-28):
|
||||
@@ -358,27 +299,25 @@ ACDL runs at **zero cloud cost** for day-to-day development. AWS spend was measu
|
||||
| Projected monthly | ~$0.007 |
|
||||
| Peak day | 2026-07-27 ($0.000867) |
|
||||
|
||||
- **S3 dominates** (98.8%, terraform state bucket) — no compute (ECS/Lambda) ran because v1.0→v1.10 was plan-only for IAM-gated capabilities
|
||||
- **Local emulators are the primary tier** — the full pipeline runs in-process, no AWS credentials, no Checkov, no DynamoDB. <span class="badge testing">Testing</span>
|
||||
- **Live-AWS verification is milestone-scoped, then torn down.** The v1.11 lifecycle pipeline ran apply→modify→destroy for every module, then tore down to zero-cost (D-096). The pipeline now **defaults to plan-only** on every PR; `ACDL_LIFECYCLE_MODE=full` overrides to apply→destroy for milestone verification (REQ-134, v1.12).
|
||||
- **S3 dominates** (98.8%, terraform state bucket) — no compute ran because v1.0→v1.10 was plan-only for IAM-gated capabilities
|
||||
- **Local emulators are the primary tier** — the full pipeline runs in-process, no AWS credentials <span class="badge testing">Testing</span>
|
||||
- **Live-AWS verification is milestone-scoped, then torn down.** The pipeline now **defaults to plan-only** on every PR; `ACDL_LIFECYCLE_MODE=full` overrides to apply→destroy for milestone verification (REQ-134, v1.12).
|
||||
- **Cost drivers** are spike-scoped: Terraform plan reads (free), S3 state storage (cents), DynamoDB outbox (cents). Any spike > $1/day is an anomaly.
|
||||
|
||||
**Pre-mortem (`PRE_MORTEM.md`):** failure modes were pre-mortemed before the leadership pitch. The v1.10 decay incident (diff-scoped VERIFY missed 7 adapter defects) is the root pattern: *a claim outruns the verification that backs it.* Four forward failure modes + structural mitigations (regression-tested IAM baseline, mandatory teardown, verified-only deck claims, honest scope).
|
||||
**Pre-mortem (`PRE_MORTEM.md`):** the v1.10 decay incident (diff-scoped VERIFY missed 7 adapter defects) is the root pattern: *a claim outruns the verification that backs it.* Four forward failure modes + structural mitigations (regression-tested IAM baseline, mandatory teardown, verified-only deck claims, honest scope).
|
||||
|
||||
---
|
||||
|
||||
<!-- _class: title -->
|
||||
<!-- _paginate: false -->
|
||||
|
||||
# A7 — Verified by Construction
|
||||
|
||||
<em class="story">The v1.11 architecture makes "Verified" a structural property, not a claim.</em>
|
||||
# A8 — Verified by Construction
|
||||
|
||||
<style>
|
||||
section { font-size: 18px; }
|
||||
section { font-size: 20px; }
|
||||
</style>
|
||||
|
||||
Two architectural pillars:
|
||||
Two architectural pillars make "Verified" a structural property, not a claim:
|
||||
|
||||
- **The stateless adapter (918 → ~80 lines).** The Terraform adapter was a 918-line monolith with 3 constant tables and 39 type-specific branches. It is now a ~80-line **stateless assembler**: it owns no module content — no resource shape, no nested HCL blocks, no defaults. Each L1 module ships a real `terraform/` module dir owning its shape, nested blocks, and defaults. The adapter reads the registry and emits `module "x" { source = ... }` blocks. A new module is a new terraform dir, not a code change. *(The v1.12 P67 fix closed a dedup defect for multi-resource L1s — ecs-service, alb; CAP-013 now Verified.)*
|
||||
- **Pipeline-driven lifecycle testing.** A `modules-lifecycle` pipeline matrix-runs each L1 and L2 module's `examples/{simple,complex}.yml` contracts through apply→modify→destroy against live AWS. **The "test" = the pipeline cell going green.** Defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); `ACDL_LIFECYCLE_MODE=full` overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — **22/22 Verified** as of v1.12.
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
# How The Platform Works — Talking Points
|
||||
|
||||
> **Companion to:** `how-the-platform-works-marp.md` (10 main + 7 appendix = 17 slides)
|
||||
> **Companion to:** `how-the-platform-works-marp.md` (10 main + 8 appendix = 18 slides)
|
||||
> **Content source:** `how-the-platform-works.md` (full source of truth with speaker notes)
|
||||
> **Purpose:** Presenter-ready cues — 3-6 talking points per slide + the one key takeaway the audience should remember.
|
||||
> **Audience:** Senior Leadership — CTO, Head of Cloud, Head of Infrastructure, Head of DevOps
|
||||
@@ -10,235 +10,227 @@
|
||||
## Slide 1 — Title
|
||||
|
||||
**Talking points:**
|
||||
- Brief introduction — this deck explains *how* the platform works internally, not what the developer experience is (that's the companion deck)
|
||||
- Brief introduction — this deck explains *how* the platform works internally, not the developer experience (that's the companion deck)
|
||||
- Set the frame: the platform is not a CI/CD tool — it's the organizational lever for shipping safely at the pace the business demands
|
||||
- The deck has 10 main slides plus a 7-slide appendix for deep-dive questions
|
||||
- v1.12 re-verification: every "Testing" claim in this deck is now Verified — 22/22 capabilities via the v1.11 lifecycle pipeline (see A7)
|
||||
- Every "Testing" claim is Verified — 22/22 capabilities via the v1.11 lifecycle pipeline (see A8)
|
||||
|
||||
**Key takeaway:** This is a platform that computes safety, doesn't assume it.
|
||||
**Key takeaway:** The platform is the organizational lever for safe, fast shipping.
|
||||
|
||||
---
|
||||
|
||||
## Slide 2 — The Problem & The North Star
|
||||
## Slide 2 — Four frictions slow every team
|
||||
|
||||
**Talking points:**
|
||||
- Open with the cost of the status quo — every team running its own pipeline, its own Terraform, its own review checklist is paying a tax that doesn't differentiate the business
|
||||
- Walk through the 4 frictions quickly: cognitive load, operational work, red tape, scalability. Don't dwell — the North Star is the resolution
|
||||
- Land the North Star quote: "declare intent → safe production deployment" — this is the entire value proposition in one sentence
|
||||
- Open with the cost of the status quo — every team running its own pipeline, Terraform, and review checklist pays a tax that doesn't differentiate the business
|
||||
- The four frictions are categorically parallel: cognitive load, operational work, red tape, scalability
|
||||
- The platform absorbs all four — that is the value proposition in one sentence
|
||||
- Don't dwell here; this is the setup for the before/after contrast on the next slide
|
||||
|
||||
**Key takeaway:** Four frictions slow every team. The platform absorbs all four.
|
||||
|
||||
---
|
||||
|
||||
## Slide 3 — Declare intent; the platform delivers safe production
|
||||
|
||||
**Talking points:**
|
||||
- Land the before/after contrast: today's queue vs. ACDL's autonomous flow
|
||||
- The litmus test: if a platform engineer still has to touch a ticket for a dev→qa promotion, we haven't delivered the vision
|
||||
- Note: the 2 anti-goals ("not a general-purpose AI" and "not a permissive delivery highway") have moved to slide 3 — they belong with the scope boundary, not the North Star
|
||||
- The North Star is one sentence: "declare intent → safe production deployment"
|
||||
- A non-technical consumer ships by declaring intent — no workflow, no config file, no module
|
||||
|
||||
**Key takeaway:** The platform absorbs all four frictions. Declare intent, not execute operations.
|
||||
**Key takeaway:** Declare intent; the platform delivers safe production — autonomously, with a complete audit trail.
|
||||
|
||||
---
|
||||
|
||||
## Slide 3 — Where ACDL Sits in Your World
|
||||
## Slide 4 — ACDL owns infrastructure, not your app
|
||||
|
||||
**Talking points:**
|
||||
- This is the scope-boundary slide — it tells leadership where ACDL fits and, just as importantly, where it doesn't
|
||||
- Upstream is anything — your IDE, an agentic SDLC, or a citizen developer vibe coding on a laptop. ACDL doesn't care how the contract was produced
|
||||
- ACDL is infrastructure only — it provisions and governs AWS resources. It does not build, test, or deploy your application code. That's upstream
|
||||
- Land the 2 anti-goals: "not a general-purpose AI" (autonomy is narrow, scoped to delivery, bounded by strict policy) and "not a permissive delivery highway" (no escape hatches to bypass the confidence framework)
|
||||
- The sovereign boundary means the platform team owns delivery and infrastructure, not the upstream development process
|
||||
- The platform is deliberately scoped — it is not trying to be everything
|
||||
- The sovereign boundary: the platform team owns delivery and infrastructure, not the upstream development process
|
||||
- The anti-goals are as important as the goals — they tell leadership what not to expect
|
||||
- Upstream is anything: IDE, agentic SDLC, or vibe coding — ACDL doesn't care how the contract was produced
|
||||
|
||||
**Key takeaway:** ACDL is the delivery and infrastructure boundary. Upstream is anything; ACDL is infra only.
|
||||
**Key takeaway:** ACDL is infrastructure only. App build/test/deploy is upstream.
|
||||
|
||||
---
|
||||
|
||||
## Slide 4 — The Contract-Driven Model
|
||||
## Slide 5 — One YAML file. The platform owns everything else.
|
||||
|
||||
**Talking points:**
|
||||
- Emphasize the asymmetry — the consumer's surface is intentionally tiny (module + environment + inputs), the platform's surface is large and opinionated
|
||||
- Note: the contract examples now show **infrastructure inputs** (cpu, memory, desired_count, port) — not a container image. The image is upstream; the platform governs infrastructure
|
||||
- The contract is the API — it's deliberately small so it can be reviewed, validated, and audited
|
||||
- The consumer does not write infrastructure modules, workflow logic, or adapter code — they declare intent; the platform reconciles, provisions, and progresses
|
||||
- Land the "no AWS account, no VPC, no state backend" point — the platform owns the blast radius. Consumers can't drift into misconfigured state or over-permissioned roles because they never touch them
|
||||
- Hold this slide — emphasize the asymmetry. The consumer's surface is intentionally tiny; the platform's surface is large and opinionated
|
||||
- The contract names three things: module, environment, inputs — that's the entire consumer-facing interface to production
|
||||
- The contract shows infrastructure inputs (cpu, memory, desired_count, port) — not a container image. The image is upstream; the platform governs infrastructure
|
||||
- The consumer provides no AWS account, no VPC, no state backend — the platform owns the blast radius
|
||||
|
||||
**Key takeaway:** A single YAML contract. The platform owns everything else — including the blast radius.
|
||||
**Key takeaway:** One YAML file. The platform owns everything else.
|
||||
|
||||
---
|
||||
|
||||
## Slide 5 — The End-to-End Flow
|
||||
## Slide 6 — Same stages, same checks, every deployment
|
||||
|
||||
**Talking points:**
|
||||
- Walk the flow left to right once — don't dwell on internals. The point is that the flow is fixed, opinionated, and identical for every consumer
|
||||
- Land beat 1: security and policy checks run *before* any infrastructure is created — not after the fact, not as a post-deployment audit
|
||||
- Land beat 2: every stage produces a record that feeds the confidence signal and the evidence stream. There is no "unchecked" path
|
||||
- Tease the confidence signal (slide 7) — this is where "safety is computed" lands
|
||||
- Walk left to right once — don't dwell on internals; the point is the flow is fixed, opinionated, and identical for every consumer
|
||||
- The two leadership-relevant beats: (1) checks before creation, (2) every stage is evidenced
|
||||
- No team-specific pipelines, no tribal runbooks — the flow is the contract
|
||||
- The confidence signal (Slide 8) is where the "safety is computed" story lands
|
||||
|
||||
**Key takeaway:** The same pipeline, every time. Checks before creation, evidence at every stage.
|
||||
**Key takeaway:** Same stages, same checks, every deployment. No "unchecked" path.
|
||||
|
||||
---
|
||||
|
||||
## Slide 6 — Zero-Trust by Default
|
||||
## Slide 7 — No long-lived credentials. Blast radius contained.
|
||||
|
||||
**Talking points:**
|
||||
- This is the slide for the Head of Cloud/Security — the key phrase is "blast radius contained to the consumer's own stack"
|
||||
- Contrast with the common failure mode: shared CI roles that can touch any account resource. The platform's ABAC model scopes every action to the consumer's own tagged resources
|
||||
- OIDC means no long-lived credentials in consumer repos — each job mints a short-lived token. Be honest: this is testing on GitHub Actions runners today; all-runner coverage is planned
|
||||
- The static-key override exists for edge cases but is rotated daily on platform runners — it is never the default
|
||||
- Contrast with the common failure mode of shared CI roles that can touch any account resource
|
||||
- OIDC federation: short-lived token per job, no credential stored in the consumer repo or runner secret
|
||||
- ABAC, not role-based: repo identity + resource tags scope every action — a consumer can only touch its own tagged resources
|
||||
- The static-key override exists for edge cases but is rotated daily on platform runners; it is never the default
|
||||
|
||||
**Key takeaway:** A consumer can only touch the resources it created. One consumer can never affect another.
|
||||
**Key takeaway:** No long-lived credentials. A consumer can only touch its own tagged resources.
|
||||
|
||||
---
|
||||
|
||||
## Slide 7 — Safety is Computed, Not Assumed
|
||||
## Slide 8 — Safety is a measurable signal, not a black box
|
||||
|
||||
**Talking points:**
|
||||
- This is the bet that separates this platform from "yet another CI/CD tool" — reliance on operator instinct or tenure is not a substitute for a computed, auditable signal
|
||||
- The confidence signal diagram makes the six inputs and the per-input breakdown visible — walk it briefly so the audience sees the signal is *not* a black box
|
||||
- The weights are **manually tuned**, the inputs are **observable**, and the breakdown is **auditable** — if a consumer asks "why 0.62?", the platform answers with a per-input breakdown. This is the "auditable, not magic" point
|
||||
- Walk the threshold table: dev ≥ 0.50 (autonomous, Testing) → qa ≥ 0.75 (QA, Planned) → prod ≥ 0.90 (SRE, Planned). The bar rises automatically with sensitivity
|
||||
- A single critical policy finding hard-blocks the deployment — critical findings are not averaged away. This is non-negotiable
|
||||
- The thresholds are tunable by Infra & Ops + SRE jointly, and any override is itself a confidence-event in the audit stream
|
||||
- This is the bet that separates this platform from "yet another CI/CD tool" — reliance on operator instinct or tenure is not a substitute
|
||||
- The signal is auditable; the thresholds are tunable by Infra & Ops + SRE jointly, and any override is itself a confidence-event in the audit stream
|
||||
- Six weighted inputs: policy, validation, freshness, provenance, history, NFRs — manually tuned, auditable per-input breakdown
|
||||
- If a consumer asks "why 0.62?", the platform answers with a per-input breakdown — not a black box
|
||||
- A single critical finding hard-blocks — critical findings are not averaged away
|
||||
|
||||
**Key takeaway:** Safety is a measurable, explainable signal — manually tuned, observable inputs, auditable breakdown. A single critical finding blocks everything.
|
||||
**Key takeaway:** Safety is a measurable, explainable signal — not a black box.
|
||||
|
||||
---
|
||||
|
||||
## Slide 8 — Security by Construction
|
||||
## Slide 9 — Every change traceable to a human attestation
|
||||
|
||||
**Talking points:**
|
||||
- The phrase to land is "secure by default, not secure by effort" — teams don't opt in to security, it's on by construction
|
||||
- Policy checks (Checkov, Wiz, Kyverno) are normalized to a single schema — we can add a new security tool without changing the confidence model or the evidence stream
|
||||
- Tagging standards are enforced, not advisory — a missing `acdl:owner` tag fails the check, it doesn't warn
|
||||
- Encryption is on every resource with per-stack customer-managed keys — no shared keys across stacks, 90-day rotation
|
||||
- The decommission flow is the counter-argument to "deletion protection makes cleanup impossible" — it's a deliberate, gated, two-SRE-approval path with CMDB validation, not a lock with no key
|
||||
- The "lower environments autonomous, higher environments attested" tenet resolves the classic "move fast vs. be safe" false dichotomy
|
||||
- Be honest: the separation-of-duties *mechanism* is designed and the dev path is wired; qa/prod/dr wiring is on the roadmap
|
||||
- The audit trail is a byproduct of deployment, not a project — every production change is traceable to a human attestation
|
||||
- The full regulatory ledger (S3 Object Lock, JWS signatures, daily checkpoints) is planned; what ships today is the outbox + hash chain that makes every event tamper-evident and queryable
|
||||
- RPO = 0 — the evidence write is synchronous; a deployment is not acknowledged until the evidence event is durably recorded
|
||||
|
||||
**Key takeaway:** Encryption, deletion protection, policy checks — on by default. Decommission is gated, not impossible.
|
||||
**Key takeaway:** Every change is traceable to a human attestation and a tamper-evident evidence event.
|
||||
|
||||
---
|
||||
|
||||
## Slide 9 — Accountability & Audit
|
||||
|
||||
**Talking points:**
|
||||
- The "lower environments autonomous, higher environments attested" tenet is the resolution to the classic "move fast vs. be safe" false dichotomy
|
||||
- The attestation flow diagram shows the human-in-the-loop path — dev autonomous → qa/prod/dr human attestation → evidence event. Walk it briefly
|
||||
- Land the QA clarification: **QA attests to infrastructure readiness — the contract, the planned Terraform changes, and the accumulated evidence. QA does not review application code (that's upstream).** This is the scope-boundary point reiterated
|
||||
- Badge reclassification to be clear about: separation of duties = **Planned** (not "design tested"); dev autonomous = **Testing**; qa/prod/dr attestation = **Planned**
|
||||
- The audit trail is a byproduct of deployment, not a project — every deployment writes a hash-chained evidence event synchronously (RPO = 0)
|
||||
- Be honest about the ledger: the outbox + hash chain is testing today; the full regulatory ledger (S3 Object Lock, JWS signatures, daily checkpoints) is planned
|
||||
|
||||
**Key takeaway:** Dev is autonomous. Higher environments are attested. QA attests to infra readiness, not app code. Every change is evidenced.
|
||||
|
||||
---
|
||||
|
||||
## Slide 10 — The Vision Realized
|
||||
## Slide 10 — The vision realized
|
||||
|
||||
**Talking points:**
|
||||
- Close on the strategic frame — the platform is not "a CI/CD tool," it's the organizational lever for shipping safely at the pace the business demands
|
||||
- Velocity without sacrificing safety: speed is in the ergonomics (a simple contract, a one-line `uses:`), safety is in the gates the consumer cannot bypass
|
||||
- Security, observability, and compliance as platform defaults — not per-team effort, not post-hoc remediation
|
||||
- Auditability as a byproduct, not a project — every production change traceable to a human attestation and a tamper-evident evidence event
|
||||
- Infrastructure as a utility, not a craft — teams consume, they don't maintain. The platform compounds value over time by learning from recurring patterns
|
||||
- The path to the citizen developer — the same safety envelope that serves a senior engineer will serve a non-technical consumer. Expanding who can ship safely without lowering the bar
|
||||
- Velocity without sacrificing safety: speed is in the ergonomics, safety is in the unbypassable gates
|
||||
- Security, observability, compliance as platform defaults — not per-team effort, not post-hoc remediation
|
||||
- A path to the citizen developer: the same safety envelope serves a senior engineer and a non-technical consumer
|
||||
- Invite questions; the companion deck ("The Developer Experience") covers who uses the platform and how fast/safe they ship
|
||||
|
||||
**Key takeaway:** The investment is in the abstraction, not the tool. Ship safely at the pace the business demands, with the security and audit posture the regulators require.
|
||||
**Key takeaway:** Ship safely at the pace the business demands, with the security and audit posture the regulators require.
|
||||
|
||||
---
|
||||
|
||||
## Appendix TOC — Deep Dives
|
||||
## Appendix TOC — Appendix
|
||||
|
||||
**Talking points:**
|
||||
- These slides are for follow-up questions — don't walk them in the main 15-minute talk
|
||||
- Pull them up when an audience member wants detail on a specific topic: environments, observability, roadmap, full inventory, glossary, cost, or the v1.11 architecture
|
||||
- The appendix now has 7 slides (A1–A7), including two new ones: A6 (Operating Model & Cost with real AWS figures + pre-mortem) and A7 (Verified by Construction — the v1.11 architecture)
|
||||
- The appendix exists so the main deck stays tight while still having answers ready
|
||||
- These are deep-dive slides for follow-up questions — don't walk them in the main 15-minute talk
|
||||
- Pull them up when an audience member wants detail on a specific topic
|
||||
- The appendix is indexed to match the Marp deck's A1-A8 structure
|
||||
|
||||
**Key takeaway:** The appendix is the backup — detail on demand, not on the critical path.
|
||||
**Key takeaway:** Deep dives available — pull the relevant appendix slide when asked.
|
||||
|
||||
---
|
||||
|
||||
## A1 — Platform-Managed Environments
|
||||
|
||||
**Talking points:**
|
||||
- A consumer provides no AWS account, no VPC, no subnet, no state backend, no runner key — the platform owns the entire blast radius
|
||||
- A named environment is a platform-owned bundle: an AWS account (or scoped partition), a network, a state backend, and an IAM role surfaced via ABAC
|
||||
- The consumer selects an environment by name (`environment: dev`) and the platform resolves it at run time — the consumer never sees raw credentials
|
||||
- Friendly onboarding is testing today: the first run detects no environment and emits a guided prompt, not an opaque failure. Self-service provisioning is planned
|
||||
- For the Head of Cloud: this is the governance story — the platform team owns accounts, network design, and state hygiene; consumers can't drift because they never touch them
|
||||
- For the Head of Cloud: this is the governance story — the platform team owns the accounts, the network design, the state hygiene
|
||||
- Consumers can't drift into misconfigured state backends or over-permissioned roles because they never touch them
|
||||
- The onboarding prompt matters — first impressions of a platform are made when it fails for the first time
|
||||
- Self-service environment provisioning is planned
|
||||
|
||||
**Key takeaway:** Environments are platform-owned bundles. Consumers pick a name; the platform owns the rest.
|
||||
**Key takeaway:** The consumer never sees raw credentials. The platform owns the blast radius.
|
||||
|
||||
---
|
||||
|
||||
## A2 — Observability Built In
|
||||
|
||||
**Talking points:**
|
||||
- Monitoring is a platform default, not a per-team project — you don't deploy a service and *then* remember to set up monitoring
|
||||
- Uptime monitoring (Uptime-kuma on ECS Fargate) is provisioned automatically after any module deploy, in a separate state, with a feature flag to disable
|
||||
- Monitored endpoints come from the deployment's own outputs — no manual endpoint registration. The platform constructs the synthetic monitoring contract from what was just deployed
|
||||
- Alert channels: Microsoft Teams webhook, email, SMS, and GitHub issues — all testing today
|
||||
- The uptime URL is published to the developer via a PR comment so they don't hunt for it
|
||||
- Roadmap: deeper observability bootstrap (dashboards, runbooks, on-call bindings) as first-class contract fields for prod/dr — planned
|
||||
- The Head of DevOps cares about this — "you don't deploy a service and *then* remember to set up monitoring; the platform does it as part of the deploy"
|
||||
- Uptime monitoring deployed automatically with every stack — separate state, feature flag to disable
|
||||
- The feature flag means teams with existing monitoring (e.g. Datadog) can opt out cleanly
|
||||
- Deeper observability bootstrap (dashboards, runbooks, on-call bindings) is on the roadmap
|
||||
|
||||
**Key takeaway:** Monitoring ships with the deploy, not after it. The feature flag lets teams with existing monitoring opt out cleanly.
|
||||
**Key takeaway:** Monitoring is a platform default, not a per-team project.
|
||||
|
||||
---
|
||||
|
||||
## A3 — The Road to the North Star
|
||||
## A3 — Security by Construction
|
||||
|
||||
**Talking points:**
|
||||
- Be explicit up front: this is **proposed phasing, not formally planned** — the phases are sequenced by dependency, not by calendar
|
||||
- Phase 1 — Testing baseline (current, v1.12): contract-driven deploys, zero-trust OIDC + ABAC, confidence signal, hash-chained evidence, encryption by default, safe decommission, uptime monitoring, platform-managed environments. **22/22 capabilities Verified** via the v1.11 lifecycle pipeline (apply→modify→destroy against live AWS, then torn down to zero-cost). The stateless adapter + lifecycle pipeline are the structural verification (see A7)
|
||||
- Phase 2 — Production readiness: HITL wiring for qa/prod/dr, all-runner OIDC, full regulatory ledger (S3 Object Lock + JWS signatures + daily checkpoints), environment self-service
|
||||
- Phase 3 — Compliance & expansion: compliance milestone (GDPR, SOX, SOC2, DORA), additional engine adapters (OpenTofu, Pulumi, Kubernetes CRDs), deeper observability bootstrap
|
||||
- Phase 4 — Agentic frontier: dynamic module creation from a contract (citizen-developer flow), pattern recognition that compounds value over time
|
||||
- Each phase's items are gated on the prior phase's maturity — invite questions on any phase boundary
|
||||
- The phrase to land is "secure by default, not secure by effort"
|
||||
- The selling point is *normalization* — we can add a new security tool without changing the confidence model or the evidence stream
|
||||
- For the Head of Security: tagging standards are enforced, not advisory — a missing `acdl:owner` tag fails the check, not a warning
|
||||
- The decommission flow is the counter-argument to "deletion protection makes cleanup impossible" — it's a deliberate, gated, two-approval path
|
||||
|
||||
**Key takeaway:** A dependency-sequenced path from testing baseline to agentic frontier — proposed, not formally committed. Phase 1 is now Verified (22/22), not aspirational.
|
||||
**Key takeaway:** Secure by default, not secure by effort. Checks run before infra is created.
|
||||
|
||||
---
|
||||
|
||||
## A4 — Testing vs. Planned (Full Inventory)
|
||||
## A4 — The Road to the North Star
|
||||
|
||||
**Talking points:**
|
||||
- Close on honesty — the platform delivers real, verifiable value today, and the roadmap is concrete, not aspirational hand-waving
|
||||
- **22/22 capabilities Verified** via the v1.11 lifecycle pipeline (apply→modify→destroy against live AWS for every L1 + L2 module) + the D-091 regression gate. The v1.10 "6 deploy-unverified (IAM drift)" status is closed (CAP-013 fixed in P67)
|
||||
- Walk the Testing column (22 capabilities) — from contract-driven deploys to encryption by default to uptime monitoring. These work internally and are dev pilot-ready
|
||||
- Walk the Planned column (9 capabilities) — be clear about what's not yet done: HITL wiring, full regulatory ledger, compliance milestone, environment self-service, dynamic module creation, additional engine adapters, deeper observability
|
||||
- Two agentic items are flagged: dynamic module creation and pattern recognition — both involve AI agents or autonomous decision-making
|
||||
- Be clear with leadership: this is a proposed phasing, not a formally committed plan
|
||||
- The phases are sequenced by dependency, not by calendar — each phase's items are gated on the prior phase's maturity
|
||||
- Phase 1 is now fully Verified (22/22) and torn down to zero-cost — it is no longer aspirational
|
||||
- Invite questions on any phase boundary
|
||||
|
||||
**Key takeaway:** Proposed phasing, not formally planned. Phase 1 is Verified; Phase 4 is the North Star.
|
||||
|
||||
---
|
||||
|
||||
## A5 — Testing vs. Planned (Full Inventory)
|
||||
|
||||
**Talking points:**
|
||||
- Close on honesty — the platform delivers real, verifiable value today: 22/22 auto-verifiable capabilities Verified via the v1.11 lifecycle pipeline
|
||||
- The roadmap is concrete, not aspirational hand-waving — 9 planned items, each with a defined milestone and a clear reason it isn't shipped yet (usually an upstream dependency, not an engineering gap)
|
||||
- Emphasize: 0 consumer adoption today — "Testing" means it works internally and is dev pilot-ready, not that it's released
|
||||
- The lifecycle pipeline defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); `ACDL_LIFECYCLE_MODE=full` overrides to apply→destroy for milestone verification (REQ-134, v1.12)
|
||||
- The lifecycle pipeline defaults to plan-only on every PR; `ACDL_LIFECYCLE_MODE=full` overrides for milestone verification
|
||||
|
||||
**Key takeaway:** 22/22 capabilities Verified via lifecycle pipeline + regression gate. 9 planned items on a concrete roadmap. Zero consumer adoption — yet.
|
||||
**Key takeaway:** 22/22 Verified today. 9 planned, each with a clear milestone and reason.
|
||||
|
||||
---
|
||||
|
||||
## A5 — Glossary
|
||||
## A6 — Glossary
|
||||
|
||||
**Talking points:**
|
||||
- This is a reference slide — don't read it aloud, point to it as a takeaway reference for term definitions
|
||||
- The terms most likely to come up in questions: OIDC (short-lived tokens), ABAC (tag-scoped access), CMK (per-stack encryption keys), RPO = 0 (synchronous evidence write)
|
||||
- HITL is the human-attestation term for qa/prod/dr; NFR is the non-functional-requirements input to the confidence signal
|
||||
- IR (Intermediate Representation) is the engine-agnostic stack definition between the contract and Terraform — the abstraction that makes the platform portable
|
||||
- Use this slide as a reference when the audience asks for term definitions
|
||||
- Don't read it aloud — point to it as a takeaway reference
|
||||
- All acronyms used in the deck are defined here
|
||||
|
||||
**Key takeaway:** A shared vocabulary — keep it as a reference for follow-up questions.
|
||||
**Key takeaway:** Reference slide — don't read aloud.
|
||||
|
||||
---
|
||||
|
||||
## A6 — Operating Model & Cost
|
||||
## A7 — Operating Model & Cost
|
||||
|
||||
**Talking points:**
|
||||
- This is the slide for the Head of Cloud / Finance — the headline: less than one cent ($0.001883) over 8 days of active development; zero BAU cloud spend
|
||||
- Walk the cost table: total $0.001883 / 8 days, daily average $0.000235, projected monthly ~$0.007, peak day 2026-07-27 at $0.000867 (a v1.10 regression + verify run)
|
||||
- S3 dominates the spend (98.8%, the terraform state bucket) — no compute (ECS/Lambda) ran because v1.0→v1.10 was plan-only for IAM-gated capabilities
|
||||
- Live-AWS verification is milestone-scoped, then torn down: the v1.11 lifecycle pipeline ran apply→modify→destroy for every module, then tore down to zero-cost (D-096 — teardown mandatory before milestone COMPLETE)
|
||||
- The lifecycle pipeline now defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); `ACDL_LIFECYCLE_MODE=full` overrides to apply→destroy for milestone verification (REQ-134, v1.12)
|
||||
- The pre-mortem (`PRE_MORTEM.md`) is the credibility slide — we already asked "how does this fail?" The v1.10 decay incident (diff-scoped VERIFY missed 7 adapter defects) is the root pattern: *a claim outruns the verification that backs it.* Four forward failure modes + structural mitigations (regression-tested IAM baseline, mandatory teardown, verified-only deck claims, honest scope)
|
||||
- The headline for the Head of Cloud / Finance: less than one cent over 8 days of active development; zero BAU cloud spend
|
||||
- The lifecycle pipeline defaults to plan-only so the PR-time cost is zero
|
||||
- The pre-mortem is the credibility slide — we already asked "how does this fail?" and the mitigations are structural
|
||||
- The v1.10 decay incident is disclosed honestly, not hidden — that disclosure IS the mitigation
|
||||
|
||||
**Key takeaway:** Less than one cent over 8 days. Zero BAU cloud spend. The pre-mortem + plan-only default make cost a non-issue and verification structural.
|
||||
**Key takeaway:** Zero BAU cloud cost. Pre-mortemed failure modes with structural mitigations.
|
||||
|
||||
---
|
||||
|
||||
## A7 — Verified by Construction
|
||||
## A8 — Verified by Construction
|
||||
|
||||
**Talking points:**
|
||||
- This is the deep-dive slide for the Head of Engineering / Architecture — the two pillars answer "how do you keep the decks honest?"
|
||||
- Pillar 1 — the **stateless adapter** (918 → ~80 lines): the old adapter was a monolith with 3 constant tables and 39 type-specific branches. The new adapter is a stateless assembler that owns no module content — each L1 module ships a real `terraform/` module dir owning its shape, nested blocks, and defaults. A new module is a new terraform dir, not a code change
|
||||
- The v1.12 P67 fix closed a dedup defect for multi-resource L1s (ecs-service, alb) — CAP-013 is now Verified
|
||||
- Pillar 2 — **pipeline-driven lifecycle testing**: a `modules-lifecycle` pipeline matrix-runs each L1 and L2 module's contracts through apply→modify→destroy against live AWS. The "test" = the pipeline cell going green. No per-module Python
|
||||
- The pipeline defaults to plan-only on every PR (zero cost); `ACDL_LIFECYCLE_MODE=full` runs the real apply→destroy for milestone verification. The regression gate (D-091) re-runs all 22 capabilities at milestone completion — 22/22 Verified as of v1.12
|
||||
- The v1.10 lesson is the negative space: a 918-line adapter with type-specific branches decayed silently because the VERIFY gate was diff-scoped. The ~80-line stateless adapter + the milestone regression gate are the structural fix
|
||||
- The adapter is simple enough to reason about (a stateless assembler); the lifecycle pipeline is the automated verification that backs every "Testing" claim
|
||||
- The v1.10 lesson is the negative space: a 918-line adapter with type-specific branches decayed silently because the VERIFY gate was diff-scoped
|
||||
- The ~80-line stateless adapter + the milestone regression gate are the structural fix
|
||||
- The plan-only default (v1.12) means verification runs on every PR at zero cost, with the full apply→destroy gated behind a CI variable override
|
||||
|
||||
**Key takeaway:** "Verified" is a structural property, not a claim — a stateless ~80-line adapter + a lifecycle pipeline that defaults to plan-only and goes green on every PR.
|
||||
**Key takeaway:** "Verified" is a structural property, not a claim — the stateless adapter + lifecycle pipeline make it so.
|
||||
File diff suppressed because one or more lines are too long
@@ -2,7 +2,7 @@
|
||||
|
||||
> **Subtitle:** Agentic Cloud Delivery Platform
|
||||
> **Audience:** Senior Leadership, CTO, Head of Cloud, Head of Infrastructure, Head of DevOps
|
||||
> **Length:** ~15 minutes · 10 main + 6 appendix = 16 slides
|
||||
> **Length:** ~15 minutes · 10 main + 8 appendix = 18 slides
|
||||
> **Purpose:** Sell the platform's value to tech leadership — zero-trust, security, observability, auditability, and the shift from "operators guess" to "the platform computes safety."
|
||||
> **Maturity framing:** "Testing" = works internally, dev pilot-ready. "Planned" = on the roadmap, not yet implemented. "Agentic" = involves AI agents or autonomous decision-making.
|
||||
> **Re-verification (2026-07-29):** Every "Testing" claim in this deck was re-verified in v1.10 Phase 54 (D-093) and again in v1.11 via the pipeline-driven lifecycle tests (P59–P62). The headline E2E (contract → resolver → adapter → terraform init/validate/plan) passes against the live AWS account; the local emulating tier (Phase 53) runs the full E2E with no cloud credentials. **22/22 auto-verifiable capabilities Verified** (CAP-013 fixed in v1.12 P67 — the adapter's multi-resource L1 dedup defect is closed; CAP-017/018 probe bugs fixed). The v1.11 lifecycle pipeline ran apply→modify→destroy against live AWS and was then torn down to zero-cost (D-096). See `.ciagent/CAPABILITY_INVENTORY.md` and `.ciagent/PRE_MORTEM.md`.
|
||||
@@ -19,70 +19,130 @@
|
||||
|
||||
---
|
||||
|
||||
## Slide 2 — The Problem & The North Star
|
||||
## Slide 2 — Four frictions slow every team
|
||||
|
||||
Here's the problem we're solving and where we're going.
|
||||
Most teams can write code; far fewer get the infrastructure right. Delivery scales with the **coordination surface around it**, not the engineering inside it.
|
||||
|
||||
Software delivery scales with the **coordination surface around it**, not the engineering inside it. Most teams can write code; far fewer get the infrastructure right.
|
||||
```mermaid
|
||||
flowchart LR
|
||||
subgraph ROW1 [" "]
|
||||
direction LR
|
||||
A["Cognitive load\nauthoring infra correctly"]
|
||||
B["Operational work\nmerged → running"]
|
||||
end
|
||||
subgraph ROW2 [" "]
|
||||
direction LR
|
||||
C["Red tape\ntickets, approvals, handoffs"]
|
||||
D["Scalability\nthroughput without headcount"]
|
||||
end
|
||||
A ~~~ B
|
||||
C ~~~ D
|
||||
A ~~~ C
|
||||
B ~~~ D
|
||||
```
|
||||
|
||||
Four frictions slow every team:
|
||||
- **Cognitive load** — the long tail of services, inconsistent in security and observability.
|
||||
- **Operational work** — manual promotion that scales with the system, not the change.
|
||||
- **Red tape** — tickets and handoffs that scale with the organization.
|
||||
- **Scalability** — throughput without linearly scaling platform engineers.
|
||||
|
||||
- **Cognitive load** — authoring infrastructure correctly; the long tail of services inconsistent in security and observability.
|
||||
- **Operational work** — promoting a change from "merged" to "running in production." Manual work that **scales with the system, not the change.**
|
||||
- **Red tape** — tickets, approvals, and handoffs that scale with the organization. A merged change waits in a queue.
|
||||
- **Scalability without increasing headcount** — throughput scales without linearly scaling platform engineers.
|
||||
|
||||
> Consumers **declare intent**; the platform delivers **safe production deployment** — automatically, safely, with a complete audit trail.
|
||||
|
||||
- A merged change progresses **without a platform engineer joining a thread or approving a ticket.**
|
||||
- A **non-technical consumer** ships by declaring intent — no workflow, no config file, no infrastructure module.
|
||||
- Every production change is **traceable to a human attestation and an immutable evidence stream.**
|
||||
|
||||
> **Speaker notes:** Open with the cost of the status quo. Every team that stands up its own pipeline, its own Terraform, its own review checklist is paying a tax that doesn't differentiate the business. The platform absorbs all four frictions — that is the value proposition in one sentence. Land the North Star quote: "declare intent → safe production deployment." The litmus test: if a platform engineer still has to touch a ticket for a dev→qa promotion, we haven't delivered the vision.
|
||||
> **Speaker notes:** Open with the cost of the status quo. Every team that stands up its own pipeline, its own Terraform, its own review checklist is paying a tax that doesn't differentiate the business. The platform absorbs all four frictions — that is the value proposition in one sentence.
|
||||
|
||||
---
|
||||
|
||||
## Slide 3 — Where ACDL Sits in Your World
|
||||
## Slide 3 — Declare intent; the platform delivers safe production
|
||||
|
||||
Now that we know the problem, here's where ACDL fits — and where it doesn't.
|
||||
Consumers **declare intent**; the platform delivers **safe production deployment** — automatically, safely, with a complete audit trail.
|
||||
|
||||
- **Upstream is anything** — your IDE, an agentic SDLC, or a citizen developer vibe coding on a laptop. ACDL doesn't care how the contract was produced.
|
||||
- **ACDL is infrastructure only** — it provisions and governs AWS resources. It does not build, test, or deploy your application code. That's upstream.
|
||||
- **Not a general-purpose AI** — autonomy is narrow, scoped to delivery, bounded by strict policy envelopes.
|
||||
- **Not a permissive delivery highway** — no escape hatches to bypass the confidence framework or human attestation requirements.
|
||||
```mermaid
|
||||
flowchart LR
|
||||
subgraph TODAY ["Today"]
|
||||
direction TB
|
||||
A["Merged change"]
|
||||
B["Waits in queue"]
|
||||
C["Ticket + approvals"]
|
||||
D["Manual promotion"]
|
||||
A --> B --> C --> D
|
||||
end
|
||||
subgraph ACDL ["With ACDL"]
|
||||
direction TB
|
||||
E["Declare intent\n(one YAML contract)"]
|
||||
F["Platform delivers\nsafely, autonomously"]
|
||||
G["Traceable to\nhuman attestation"]
|
||||
E --> F --> G
|
||||
end
|
||||
TODAY -.before.-> ACDL
|
||||
```
|
||||
|
||||
> **Speaker notes:** This slide gives leadership the framing they need. The platform is deliberately scoped — it is not trying to be everything. The sovereign boundary means the platform team owns delivery and infrastructure, not the upstream development process. The anti-goals are as important as the goals: they tell leadership what not to expect.
|
||||
- A merged change progresses **without a platform engineer joining a thread.**
|
||||
- A **non-technical consumer** ships by declaring intent — no workflow, no config file, no module.
|
||||
- Every production change is **traceable to a human attestation** and an immutable evidence stream.
|
||||
|
||||
> **Speaker notes:** Land the before/after contrast: today's queue vs. ACDL's autonomous flow. The litmus test: if a platform engineer still has to touch a ticket for a dev→qa promotion, we haven't delivered the vision. The North Star is "declare intent → safe production deployment."
|
||||
|
||||
---
|
||||
|
||||
## Slide 4 — The Contract-Driven Model
|
||||
## Slide 4 — ACDL owns infrastructure, not your app
|
||||
|
||||
The platform is deliberately scoped — it is not trying to be everything.
|
||||
|
||||
```mermaid
|
||||
flowchart LR
|
||||
subgraph UP ["Upstream — anything"]
|
||||
direction TB
|
||||
A["IDE / IDE + AI\n(dev writes contract)"]
|
||||
B["Agentic SDLC\n(agent writes contract)"]
|
||||
C["Citizen dev\n(vibe codes → AI agent\n→ contract)"]
|
||||
end
|
||||
subgraph ACDL ["ACDL — infrastructure only"]
|
||||
D["Contract\nvalidated"]
|
||||
E["Resolve → Plan\nSecurity + Policy checks\nConfidence signal"]
|
||||
F["Provision\nAWS resources"]
|
||||
G["Evidence\nhash-chained"]
|
||||
end
|
||||
subgraph DOWN ["Downstream"]
|
||||
H["AWS resources\nrunning"]
|
||||
I["Consumer pipeline\ndeploys image"]
|
||||
end
|
||||
A --> D
|
||||
B --> D
|
||||
C --> D
|
||||
D --> E
|
||||
E --> F
|
||||
E --> G
|
||||
F --> H
|
||||
H --> I
|
||||
```
|
||||
|
||||
- **Upstream is anything** — IDE, agentic SDLC, or vibe coding. ACDL doesn't care how the contract was produced.
|
||||
- **ACDL is infrastructure only** — it provisions and governs AWS resources. App build/test/deploy is upstream.
|
||||
- **Not a general-purpose AI** — autonomy is narrow, scoped to delivery, bounded by strict policy.
|
||||
- **Not a permissive highway** — no escape hatches to bypass the confidence framework.
|
||||
|
||||
> **Speaker notes:** The sovereign boundary means the platform team owns delivery and infrastructure, not the upstream development process. The anti-goals are as important as the goals: they tell leadership what not to expect.
|
||||
|
||||
---
|
||||
|
||||
## Slide 5 — One YAML file. The platform owns everything else.
|
||||
|
||||
The contract is the boundary between upstream and ACDL. It's all a consumer writes.
|
||||
|
||||
A single YAML contract — **module, environment, inputs**. The platform owns everything else.
|
||||
|
||||
```mermaid
|
||||
flowchart LR
|
||||
A["Consumer<br/>writes a contract"] --> B["Platform resolves,<br/>compiles, checks,<br/>deploys, records"]
|
||||
B --> C["Resources running in AWS<br/>+ tamper-evident evidence"]
|
||||
```
|
||||
|
||||
The contract names three things:
|
||||
|
||||
- **Which module** — a catalog of pre-built, security-reviewed building blocks (a static site, a microservice, a database, and more).
|
||||
- **Which environment** — `dev`, `qa`, `prod`, or `dr`. The platform raises the safety bar automatically as the environment gets more sensitive.
|
||||
- **Which module** — a catalog of pre-built, security-reviewed building blocks.
|
||||
- **Which environment** — `dev`, `qa`, `prod`, or `dr`. The bar rises automatically with sensitivity.
|
||||
- **Which inputs** — infrastructure values that vary per deployment (cpu, memory, port, desired_count).
|
||||
- The consumer provides **no AWS account, no VPC, no state backend** — the platform owns the blast radius.
|
||||
|
||||
The consumer does **not** write infrastructure modules, workflow logic, or adapter code. They declare intent; the platform reconciles, provisions, and progresses.
|
||||
|
||||
> **Speaker notes:** Emphasize the asymmetry. The consumer's surface is intentionally tiny — a contract that fits on one screen. The platform's surface is large and opinionated. That asymmetry is what makes "declare intent, not execute operations" concrete. Note that the contract examples now show infrastructure inputs (cpu, memory, desired_count, port) — not a container image. The image is upstream; the platform governs infrastructure.
|
||||
> **Speaker notes:** Emphasize the asymmetry. The consumer's surface is intentionally tiny — a contract that fits on one screen. The platform's surface is large and opinionated. The contract examples show infrastructure inputs (cpu, memory, desired_count, port) — not a container image. The image is upstream; the platform governs infrastructure.
|
||||
|
||||
---
|
||||
|
||||
## Slide 5 — The End-to-End Flow
|
||||
|
||||
Once the contract is written, here's what the platform does with it — every time.
|
||||
## Slide 6 — Same stages, same checks, every deployment
|
||||
|
||||
Every deployment runs the same stages, in the same order, with the same checks — no team-specific pipelines, no tribal runbooks.
|
||||
|
||||
@@ -98,107 +158,104 @@ flowchart TD
|
||||
H --> I["Infrastructure apply<br/>(dev only — higher envs hold for attestation)"]
|
||||
```
|
||||
|
||||
Two properties matter to leadership:
|
||||
- **Security and policy checks run *before* any infrastructure is created** — not as a post-deployment audit.
|
||||
- **Every stage produces a record** that feeds the confidence signal and the evidence stream. No "unchecked" path.
|
||||
|
||||
- **Security and policy checks run *before* any infrastructure is created** — not after the fact, not as a post-deployment audit.
|
||||
- **Every stage produces a record** that feeds the confidence signal and the evidence stream. There is no "unchecked" path.
|
||||
|
||||
> **Speaker notes:** Walk left to right once. Don't dwell on internals — the point is that the flow is fixed, opinionated, and identical for every consumer. The two leadership-relevant beats are (1) checks before creation, (2) every stage is evidenced. The confidence signal (Slide 7) is where the "safety is computed" story lands.
|
||||
> **Speaker notes:** Walk left to right once. Don't dwell on internals — the point is that the flow is fixed, opinionated, and identical for every consumer. The two leadership-relevant beats: (1) checks before creation, (2) every stage is evidenced. The confidence signal (Slide 8) is where the "safety is computed" story lands.
|
||||
|
||||
---
|
||||
|
||||
## Slide 6 — Zero-Trust by Default
|
||||
|
||||
Before any infrastructure is created, here's how access is scoped.
|
||||
## Slide 7 — No long-lived credentials. Blast radius contained.
|
||||
|
||||
Consumer repositories hold **no long-lived cloud credentials.** Ever.
|
||||
|
||||
- **Authentication is OIDC federation** between the platform runners and the cloud provider. Each job mints a short-lived token; no credential is stored in the consumer repo or in a runner secret. *(Testing on GitHub Actions runners; planned for all platform runners.)*
|
||||
- **Authorization is attribute-based (ABAC), not role-based.** Two attribute classes scope every action:
|
||||
- **Repository identity** — the role's trust policy binds to the exact consumer repo + branch that invoked the workflow.
|
||||
- **Resource-creation attributes** — every resource is tagged with `acdl:owner=<consumer-repo>` and `acdl:contract=<contract-id>`. The session policy grants view/update/delete **only on resources whose tags match the calling repo.**
|
||||
```mermaid
|
||||
flowchart LR
|
||||
A["Consumer repo\n(no credentials)"]
|
||||
B["OIDC federation\nshort-lived token"]
|
||||
C["ABAC session policy\nrepo identity + tags"]
|
||||
D["Tagged resources\nonly"]
|
||||
A --> B --> C --> D
|
||||
```
|
||||
|
||||
**The effect:** a consumer's pipeline can only touch the resources it created. Blast radius is contained to that consumer's own stack instances. One consumer can never touch another's resources, and the consumer cannot escape its own scope.
|
||||
- **Authentication — OIDC federation.** Each job mints a short-lived token; no credential stored in the consumer repo or runner secret. <span class="badge testing">Testing (GitHub Actions)</span> <span class="badge planned">Planned: all runners</span>
|
||||
- **Authorization — attribute-based (ABAC), not role-based.** Two attribute classes scope every action:
|
||||
- **Repository identity** — trust policy binds to the exact consumer repo + branch.
|
||||
- **Resource tags** — every resource tagged `acdl:owner` + `acdl:contract`; session policy grants access **only to matching tags.**
|
||||
- **The effect:** a consumer can only touch the resources it created. One consumer can never affect another.
|
||||
|
||||
> **Speaker notes:** This is the slide for the Head of Cloud/Security. The key phrase is "blast radius contained to the consumer's own stack." Contrast with the common failure mode of shared CI roles that can touch any account resource. The static-key override exists for edge cases but is rotated daily on platform runners; it is never the default.
|
||||
|
||||
---
|
||||
|
||||
## Slide 7 — Safety is Computed, Not Assumed
|
||||
## Slide 8 — Safety is a measurable signal, not a black box
|
||||
|
||||
Now let's look at how the platform decides whether a deployment is safe.
|
||||
Every delivery action produces a **measurable, explainable confidence signal** — a weighted sum of observable facts, not a black box. <span class="badge agentic">Agentic</span>
|
||||
|
||||
Every delivery action produces a **measurable, explainable confidence signal** — a weighted sum of observable facts, not a black box. *(Agentic.)*
|
||||
```mermaid
|
||||
flowchart LR
|
||||
P["Policy"] --> S["Score"]
|
||||
V["Validation"] --> S
|
||||
F["Freshness"] --> S
|
||||
Pr["Provenance"] --> S
|
||||
H["History"] --> S
|
||||
N["NFRs"] --> S
|
||||
S --> B["Band + threshold"]
|
||||
```
|
||||
|
||||
- **Six weighted inputs** — policy conformance, validation, freshness, source provenance, history, and non-functional requirements (NFRs). The weights are **manually tuned**, the inputs are **observable**, and the breakdown is **auditable** — if a consumer asks "why 0.62?", the platform answers with a per-input breakdown.
|
||||
- **Six weighted inputs** — policy, validation, freshness, provenance, history, NFRs. Manually tuned, auditable. If a consumer asks "why 0.62?", the platform answers with a per-input breakdown.
|
||||
- **Per-environment thresholds** that rise with sensitivity:
|
||||
|
||||
| Environment | Threshold | Who must attest |
|
||||
| Environment | Threshold | Attester |
|
||||
|---|---|---|
|
||||
| dev | ≥ 0.50 | No one — fully autonomous *(Testing)* |
|
||||
| qa | ≥ 0.75 | QA *(Planned)* |
|
||||
| prod | ≥ 0.90 | SRE *(Planned)* |
|
||||
| dr | ≥ 0.95 | SRE + a disaster-recovery drill reference *(Planned)* |
|
||||
| dev | ≥ 0.50 | No one — autonomous <span class="badge testing">Testing</span> |
|
||||
| qa | ≥ 0.75 | QA <span class="badge planned">Planned</span> |
|
||||
| prod | ≥ 0.90 | SRE <span class="badge planned">Planned</span> |
|
||||
|
||||
- **A single critical policy finding hard-blocks the deployment**, regardless of every other input. Critical findings are not averaged away.
|
||||
- **When the platform halts, it gives a measured reason** — a policy violation, an insufficient signal, a missing attestation — never an opaque, manual-debugging exercise.
|
||||
- **A single critical finding hard-blocks** — critical findings are not averaged away.
|
||||
|
||||
> **Speaker notes:** This is the bet that separates this platform from "yet another CI/CD tool." Reliance on operator instinct or tenure is not a substitute. The signal is auditable; the thresholds are tunable by Infra & Ops + SRE jointly, and any override is itself a confidence-event in the audit stream. Leadership cares about this because it makes promotion decisions *reviewable*. The new confidence signal diagram makes the six inputs and the per-input breakdown visible — emphasize that the weights are manually tuned and the breakdown is auditable, not a black box.
|
||||
> **Speaker notes:** This is the bet that separates this platform from "yet another CI/CD tool." Reliance on operator instinct or tenure is not a substitute. The signal is auditable; the thresholds are tunable by Infra & Ops + SRE jointly, and any override is itself a confidence-event in the audit stream. Leadership cares because it makes promotion decisions *reviewable*.
|
||||
|
||||
---
|
||||
|
||||
## Slide 8 — Security by Construction
|
||||
## Slide 9 — Every change traceable to a human attestation
|
||||
|
||||
Beyond the confidence signal, security defaults are on by construction — not by opt-in.
|
||||
Computed safety handles the gate. Humans still matter — here's how accountability works.
|
||||
|
||||
Security defaults that **do not require a team to opt in.** Checks run on **every** deployment, normalized to a single schema regardless of which engine produced them. *(Testing.)*
|
||||
```mermaid
|
||||
flowchart LR
|
||||
subgraph DEV ["dev — autonomous"]
|
||||
D1["Confidence ≥ 0.50\n→ apply"]
|
||||
end
|
||||
subgraph GATED ["qa / prod / dr — gated"]
|
||||
G1["Confidence ≥ threshold"]
|
||||
G2["Human attestation\nreviews contract\n+ plan + evidence"]
|
||||
G3["Separation of duties\nQA ≠ prod approver"]
|
||||
G1 --> G2 --> G3
|
||||
end
|
||||
DEV --> OUT["Hash-chained\nevidence event\n(RPO = 0)"]
|
||||
GATED --> OUT
|
||||
```
|
||||
|
||||
- **Infrastructure-as-code policy** (Checkov) — secrets in plaintext, public ingress, IAM wildcards, KMS key references, **required tagging standards** (`acdl:owner`, `acdl:contract`, `acdl:environment`, `acdl:cost-center`). All run *before* infra is created.
|
||||
- **Cloud security posture** (Wiz adapter) — translates cloud security findings into the same normalized record. *(Adapter testing; activates when a Wiz tenant is configured.)*
|
||||
- **Kubernetes-native policy** (Kyverno adapter) — ready for the GitOps reconciler roadmap item. *(Adapter testing; inactive for Terraform-only stacks.)*
|
||||
- **Encryption on every resource** — at-rest encryption is on by default for every primitive (S3, RDS, ECR, ECS, and more). *(Testing.)*
|
||||
- **Per-stack customer-managed keys (CMKs)** — one key per deployment, 90-day rotation at creation, **no shared keys across stacks.** *(Testing.)*
|
||||
- **Managed-key fallback with a loud warning** — standalone primitives fall back to cloud-managed keys only when no CMK is provided, and the platform warns explicitly. *(Testing.)*
|
||||
- **Deletion protection on by default** — every resource has `prevent_destroy` on unless a consumer explicitly disables it via a documented feature flag. *(Testing.)*
|
||||
- **Safe decommission** — a 2-step pipeline (disable protection → zero counts → destroy) with **two SRE human-attestation gates** and a **change-request validated against the platform CMDB** before any destructive action. *(Testing.)* Encryption keys enter a grace window (default 30 days) so encrypted data remains recoverable during decommission.
|
||||
- **Dev is fully autonomous.** The confidence signal (≥ 0.50) is the only gate. <span class="badge testing">Testing</span> <span class="badge agentic">Agentic</span>
|
||||
- **qa, prod, dr require human attestation** — the approver reviews contract, planned Terraform, and accumulated evidence. <span class="badge planned">Planned</span>
|
||||
- **Separation of duties is enforced** — the QA approver **cannot** be the prod approver. The platform **blocks on a match.** <span class="badge planned">Planned</span>
|
||||
- **Every deployment writes a hash-chained evidence event** — tampering breaks the chain. **RPO = 0.** <span class="badge testing">Testing</span>
|
||||
|
||||
> **Speaker notes:** The phrase to land is "secure by default, not secure by effort." The selling point is *normalization* — we can add a new security tool without changing the confidence model or the evidence stream. For the Head of Security: tagging standards are enforced, not advisory — a missing `acdl:owner` tag fails the check, not a warning. The decommission flow is the counter-argument to "deletion protection makes cleanup impossible" — it's a deliberate, gated, two-approval path, not a lock with no key.
|
||||
> **Speaker notes:** The "lower environments autonomous, higher environments attested" tenet is the resolution to the classic "move fast vs. be safe" false dichotomy. Be honest: the separation-of-duties *mechanism* is designed and the dev path is wired; qa/prod/dr wiring is on the roadmap. The audit trail is a byproduct of deployment, not a project. The full regulatory ledger (S3 Object Lock, JWS signatures, daily checkpoints) is planned; what ships today is the outbox + hash chain that makes every event tamper-evident and queryable.
|
||||
|
||||
---
|
||||
|
||||
## Slide 9 — Accountability & Audit
|
||||
## Slide 10 — The vision realized
|
||||
|
||||
Computed safety handles the gate. But humans still matter — here's how accountability works.
|
||||
|
||||
- **Dev is fully autonomous.** The confidence signal (≥ 0.50) is the only gate. Queue-based handoffs are eliminated from lower environments. *(Testing, Agentic.)*
|
||||
- **qa, prod, and dr require deliberate human attestation** — not rubber stamps, but policy-mandated acts of accountability via protected deployment approvals. The approver reviews the contract, the planned Terraform changes, and the accumulated evidence. *(Planned.)*
|
||||
- **QA attests to infrastructure readiness — the contract, the planned Terraform changes, and the accumulated evidence. QA does not review application code (that's upstream).**
|
||||
- **Separation of duties is enforced** *(Planned)* — the person who approved the qa promotion **cannot** be the person who approves the prod promotion. The platform reads both identities from the outbox and **blocks** on a match, emitting a `SEPARATION_OF_DUTIES_VIOLATION` and routing a halt artifact to SRE on-call.
|
||||
- **Timeout discipline** — 1 business day = warn + escalate; 2 business days = auto-freeze + re-submit. Rejection extends the audit chain; it does not tear it up.
|
||||
|
||||
Version control is a **coordination tool, not an evidentiary fortress.** True compliance requires an immutable, externally-stored ledger.
|
||||
|
||||
- **Every deployment writes a hash-chained evidence event** — each event links to the previous via a cryptographic hash. Tampering breaks the chain. *(Testing — the DynamoDB outbox.)*
|
||||
- **Tiered storage design:** cold, tamper-proof source of truth (S3 Object Lock, compliance mode, 7-year retention) + a hot query index for fast lookup. *(Outbox tested; S3 Object Lock + JWS detached signatures are planned regulatory-ledger build-out.)*
|
||||
- **RPO = 0** — the evidence write is synchronous; a deployment is not acknowledged until the evidence event is durably recorded.
|
||||
- **Every production change is traceable to a human attestation** — the QA and prod approver identities are the only durable record outside the VCS's audit log, stored in the outbox keyed by contract.
|
||||
|
||||
> **Speaker notes:** The "lower environments autonomous, higher environments attested" tenet is the resolution to the classic "move fast vs. be safe" false dichotomy. Be honest: the separation-of-duties *mechanism* (CODEOWNERS routing, identity-distinctness check, the 8-concern attestation matrix) is designed and the dev path is wired; the qa/prod/dr wiring is on the roadmap. The new attestation flow diagram makes the human-in-the-loop path visible. Note the QA clarification: QA attests to infrastructure readiness — the contract, the plan, and the evidence — not application code. The audit trail is a byproduct of deployment, not a project. Note honestly that the full regulatory ledger (S3 Object Lock, JWS signatures, daily checkpoints) is planned; what ships today is the outbox + hash chain that makes every event tamper-evident and queryable. Badge reclassification: separation of duties = Planned (not "design tested"), dev autonomous = Testing, qa/prod/dr attestation = Planned.
|
||||
|
||||
---
|
||||
|
||||
## Slide 10 — The Vision Realized
|
||||
|
||||
Here's what success looks like when the North Star is reached.
|
||||
|
||||
- **Velocity without sacrificing safety.** Speed is in the ergonomics (a simple contract, a one-line `uses:`); safety is in the gates the consumer cannot bypass.
|
||||
- **Velocity without sacrificing safety.** Speed is in the ergonomics; safety is in the gates the consumer cannot bypass.
|
||||
- **Security, observability, and compliance as platform defaults** — not per-team effort, not post-hoc remediation.
|
||||
- **Auditability as a byproduct, not a project.** Every production change is traceable to a human attestation and a tamper-evident evidence event.
|
||||
- **Blast radius contained by design.** Zero-trust OIDC + ABAC means a consumer can only touch its own tagged resources.
|
||||
- **Infrastructure as a utility, not a craft.** Teams consume infrastructure, they don't maintain it.
|
||||
- **A path to the citizen developer.** The same safety envelope that serves a senior engineer will serve a non-technical consumer. *(Agentic.)*
|
||||
- **A path to the citizen developer.** The same safety envelope serves a senior engineer and a non-technical consumer. <span class="badge agentic">Agentic</span>
|
||||
|
||||
> **Speaker notes:** Close on the strategic frame. The platform is not "a CI/CD tool," it's the organizational lever for shipping safely at the pace the business demands. The investment is in the abstraction, not the tool. Ship safely at the pace the business demands, with the security and audit posture the regulators require.
|
||||
> **Speaker notes:** Close on the strategic frame. The platform is not "a CI/CD tool" — it's the organizational lever for shipping safely at the pace the business demands, with the security and audit posture the regulators require. The investment is in the abstraction, not the tool.
|
||||
|
||||
---
|
||||
|
||||
@@ -210,11 +267,12 @@ For deep dives — these slides cover details omitted from the main 10.
|
||||
|
||||
1. Platform-Managed Environments (detail)
|
||||
2. Observability Built In (detail)
|
||||
3. The Road to the North Star (phased roadmap)
|
||||
4. Testing vs. Planned (full inventory)
|
||||
5. Glossary
|
||||
6. Operating Model & Cost (real AWS spend + pre-mortem)
|
||||
7. Verified by Construction — the v1.11 architecture (stateless adapter + lifecycle pipeline)
|
||||
3. Security by Construction (the full defaults inventory)
|
||||
4. The Road to the North Star (phased roadmap)
|
||||
5. Testing vs. Planned (full inventory)
|
||||
6. Glossary
|
||||
7. Operating Model & Cost (real AWS spend + pre-mortem)
|
||||
8. Verified by Construction (the v1.11 architecture)
|
||||
|
||||
> **Speaker notes:** These are deep-dive slides for follow-up questions. Don't walk them in the main 15-minute talk — pull them up when an audience member wants detail on a specific topic.
|
||||
|
||||
@@ -253,13 +311,30 @@ Monitoring is **a platform default, not a per-team project.** *(Testing.)*
|
||||
|
||||
---
|
||||
|
||||
## A3 — The Road to the North Star
|
||||
## A3 — Security by Construction
|
||||
|
||||
Security defaults that **do not require a team to opt in.** Checks run on **every** deployment, normalized to a single schema regardless of which engine produced them. *(Testing.)*
|
||||
|
||||
- **Infrastructure-as-code policy** (Checkov) — secrets in plaintext, public ingress, IAM wildcards, KMS key references, **required tagging standards** (`acdl:owner`, `acdl:contract`, `acdl:environment`, `acdl:cost-center`). All run *before* infra is created.
|
||||
- **Cloud security posture** (Wiz adapter) — translates cloud security findings into the same normalized record. *(Adapter testing; activates when a Wiz tenant is configured.)*
|
||||
- **Kubernetes-native policy** (Kyverno adapter) — ready for the GitOps reconciler roadmap item. *(Adapter testing; inactive for Terraform-only stacks.)*
|
||||
- **Encryption on every resource** — at-rest encryption is on by default for every primitive (S3, RDS, ECR, ECS, and more). *(Testing.)*
|
||||
- **Per-stack customer-managed keys (CMKs)** — one key per deployment, 90-day rotation at creation, **no shared keys across stacks.** *(Testing.)*
|
||||
- **Managed-key fallback with a loud warning** — standalone primitives fall back to cloud-managed keys only when no CMK is provided, and the platform warns explicitly. *(Testing.)*
|
||||
- **Deletion protection on by default** — every resource has `prevent_destroy` on unless a consumer explicitly disables it via a documented feature flag. *(Testing.)*
|
||||
- **Safe decommission** — a 2-step pipeline (disable protection → zero counts → destroy) with **two SRE human-attestation gates** and a **change-request validated against the platform CMDB** before any destructive action. *(Testing.)* Encryption keys enter a grace window (default 30 days) so encrypted data remains recoverable during decommission.
|
||||
|
||||
> **Speaker notes:** The phrase to land is "secure by default, not secure by effort." The selling point is *normalization* — we can add a new security tool without changing the confidence model or the evidence stream. For the Head of Security: tagging standards are enforced, not advisory — a missing `acdl:owner` tag fails the check, not a warning. The decommission flow is the counter-argument to "deletion protection makes cleanup impossible" — it's a deliberate, gated, two-approval path, not a lock with no key.
|
||||
|
||||
---
|
||||
|
||||
## A4 — The Road to the North Star
|
||||
|
||||
*Proposed phasing — not formally planned.*
|
||||
|
||||
A phased roadmap from the current Testing baseline to the full North Star:
|
||||
|
||||
- **Phase 1 — Testing baseline (current, v1.12):** contract-driven deploys, zero-trust OIDC + ABAC on GitHub Actions, confidence signal gating, hash-chained evidence, encryption by default, deletion protection + safe decommission, uptime monitoring, platform-managed environments. **22/22 capabilities Verified** via the v1.11 lifecycle pipeline (apply→modify→destroy against live AWS, then torn down to zero-cost). The stateless adapter + lifecycle pipeline are the structural verification (see A7).
|
||||
- **Phase 1 — Testing baseline (current, v1.12):** contract-driven deploys, zero-trust OIDC + ABAC on GitHub Actions, confidence signal gating, hash-chained evidence, encryption by default, deletion protection + safe decommission, uptime monitoring, platform-managed environments. **22/22 capabilities Verified** via the v1.11 lifecycle pipeline (apply→modify→destroy against live AWS, then torn down to zero-cost). The stateless adapter + lifecycle pipeline are the structural verification (see A8).
|
||||
- **Phase 2 — Production readiness:** HITL wiring for qa/prod/dr, all-runner OIDC, full regulatory ledger (S3 Object Lock + JWS signatures + daily checkpoints), environment self-service.
|
||||
- **Phase 3 — Compliance & expansion:** compliance milestone (GDPR, SOX, SOC2, DORA extension points), additional engine adapters (OpenTofu, Pulumi, Kubernetes CRDs), deeper observability bootstrap.
|
||||
- **Phase 4 — Agentic frontier:** dynamic module creation from a contract (the agentic citizen-developer composition mechanism), pattern recognition that compounds value over time.
|
||||
@@ -268,7 +343,7 @@ A phased roadmap from the current Testing baseline to the full North Star:
|
||||
|
||||
---
|
||||
|
||||
## A4 — Testing vs. Planned (Full Inventory)
|
||||
## A5 — Testing vs. Planned (Full Inventory)
|
||||
|
||||
> **Verification status (v1.12, 2026-07-29):** 22/22 auto-verifiable capabilities **Verified** — the v1.11 lifecycle pipeline ran apply→modify→destroy against live AWS for every L1 + L2 module, then tore down to zero-cost (D-096). The v1.10 "6 deploy-unverified (IAM drift)" status is closed (CAP-013 fixed in P67). See `CAPABILITY_INVENTORY.md`.
|
||||
|
||||
@@ -302,7 +377,7 @@ A phased roadmap from the current Testing baseline to the full North Star:
|
||||
|
||||
---
|
||||
|
||||
## A5 — Glossary
|
||||
## A6 — Glossary
|
||||
|
||||
| Term | Meaning |
|
||||
|---|---|
|
||||
@@ -320,7 +395,7 @@ A phased roadmap from the current Testing baseline to the full North Star:
|
||||
|
||||
---
|
||||
|
||||
## A6 — Operating Model & Cost (real AWS spend + pre-mortem)
|
||||
## A7 — Operating Model & Cost (real AWS spend + pre-mortem)
|
||||
|
||||
ACDL runs at **zero cloud cost** for day-to-day development. The v1.0→v1.10 AWS spend was measured directly via Cost Explorer (`COST.md`, 2026-07-28):
|
||||
|
||||
@@ -342,7 +417,7 @@ ACDL runs at **zero cloud cost** for day-to-day development. The v1.0→v1.10 AW
|
||||
|
||||
---
|
||||
|
||||
## A7 — Verified by Construction (the v1.11 architecture)
|
||||
## A8 — Verified by Construction (the v1.11 architecture)
|
||||
|
||||
v1.11 rebuilt the platform on two architectural pillars that make "Verified" a structural property, not a claim:
|
||||
|
||||
|
||||
@@ -8,23 +8,22 @@ footer: "Internal"
|
||||
style: |
|
||||
section {
|
||||
font-family: "Akkurat Pro", "Helvetica Neue", "Arial", sans-serif;
|
||||
font-size: 22px;
|
||||
font-size: 26px;
|
||||
color: #1B1B1B;
|
||||
}
|
||||
h1 { color: #D6002A; font-size: 34px; margin-bottom: 0.3em; }
|
||||
h2 { color: #D6002A; font-size: 26px; margin-bottom: 0.2em; }
|
||||
h1 { color: #D6002A; font-size: 40px; margin-bottom: 0.3em; }
|
||||
h2 { color: #D6002A; font-size: 32px; margin-bottom: 0.2em; }
|
||||
section.title { background: #1B1B1B; color: #fff; border-top: 8px solid #D6002A; }
|
||||
section.title h1 { color: #fff; }
|
||||
table { font-size: 18px; width: 100%; }
|
||||
table { font-size: 22px; width: 100%; }
|
||||
th { background: #F0F0F0; }
|
||||
blockquote { border-left: 4px solid #D6002A; color: #2E2E2E; font-size: 20px; }
|
||||
pre { font-size: 14px; line-height: 1.3; }
|
||||
code { font-size: 14px; }
|
||||
blockquote { border-left: 4px solid #D6002A; color: #2E2E2E; font-size: 24px; }
|
||||
pre { font-size: 16px; line-height: 1.3; }
|
||||
code { font-size: 16px; }
|
||||
img { display: block; margin: 0 auto; max-height: 280px; }
|
||||
em.story { color: #6B7280; font-size: 16px; font-style: italic; }
|
||||
.badge {
|
||||
display: inline-block; padding: 2px 8px; border-radius: 4px;
|
||||
font-size: 14px; font-weight: 600;
|
||||
font-size: 16px; font-weight: 600;
|
||||
}
|
||||
.testing { background: #DBEAFE; color: #1E3A5F; }
|
||||
.planned { background: #fef3c7; color: #78350f; }
|
||||
@@ -45,24 +44,18 @@ section.title h3 { color: #F0F0F0; font-weight: 400; font-size: 22px; margin-top
|
||||
|
||||
---
|
||||
|
||||
# Where Agentic Cloud Delivery (ACDL) Sits in Your World
|
||||
|
||||
<em class="story">Here's who uses the platform and where the boundary is.</em>
|
||||
# Two consumer paths, one safety envelope
|
||||
|
||||
|
||||
|
||||
- **Technical developer** — owns app code + a contract + a thin CI definition
|
||||
- **Citizen developer** — declares intent in plain language; an AI agent produces a contract that passes the **same** safety envelope <span class="badge agentic">Agentic</span>
|
||||
- **Upstream is anything** — your IDE, an agentic SDLC, or vibe coding on a laptop. ACDL doesn't care how the contract was produced
|
||||
- **ACDL is infrastructure only** — it provisions and governs AWS resources. Application deployment is upstream
|
||||
- **Citizen developer** — declares intent; an AI agent produces a contract that passes the **same** safety envelope <span class="badge agentic">Agentic</span>
|
||||
- **Upstream is anything** — IDE, agentic SDLC, or vibe coding. ACDL doesn't care how the contract was produced
|
||||
- **ACDL is infrastructure only** — provisions and governs AWS resources. Application deployment is upstream
|
||||
|
||||
---
|
||||
|
||||
# The Contract — The Entire Consumer Surface
|
||||
|
||||
<em class="story">Now let's look at what a consumer actually writes — it's tiny.</em>
|
||||
|
||||
Three things. That is the entire consumer-side surface.
|
||||
# Three things. The entire consumer surface.
|
||||
|
||||
<img src="assets/png/developer-experience-02-what-dev-does.png" style="float: right; width: 38%; margin-left: 20px; margin-bottom: 10px;" />
|
||||
|
||||
@@ -84,42 +77,84 @@ infrastructure:
|
||||
```
|
||||
|
||||
- **3. A one-line CI definition** — a thin `uses:` wrapper pointing at a versioned platform workflow
|
||||
- The developer does **not**: write infrastructure modules, clone the platform repo, hold cloud credentials, or maintain a state backend
|
||||
- The developer does **not**: write modules, clone the platform repo, hold cloud credentials, or maintain a state backend
|
||||
|
||||
---
|
||||
|
||||
# The Developer Feedback Loop
|
||||
# See what the platform does, in real time
|
||||
|
||||
<em class="story">Once you push, here's what you see — in real time, in your own logs.</em>
|
||||
|
||||
Developers see **what the platform is doing**, in real time. <span class="badge testing">Testing</span>
|
||||
|
||||
- **Streamed output by default** — the infrastructure plan, policy-check results, and each check record flow to stdout
|
||||
- **PR comments after every successful pipeline stage** — a developer always knows where they stand without refreshing a dashboard
|
||||
- **Clear, explainable halt reasons** — a policy violation, an insufficient confidence signal, or a missing attestation. **Never an opaque debugging exercise.**
|
||||
- **Connection strings posted as PR comments** — human-readable, no hunting
|
||||
- **Runtime secrets in encrypted Parameter Store** — KMS-encrypted, namespaced, **no raw secrets in logs**
|
||||
- **Errors become GitHub issues, automatically** — a failed deploy opens an issue on the platform repo
|
||||
- **Streamed output by default** — the plan, policy results, and each check record flow to stdout
|
||||
- **PR comments after every successful pipeline stage** — always know where you stand
|
||||
- **Clear, explainable halt reasons** — a policy violation, an insufficient signal, or a missing attestation. **Never opaque.**
|
||||
- **Connection strings posted as PR comments** — human-readable, no hunting. Runtime secrets go to encrypted Parameter Store, never to logs
|
||||
- **Errors become GitHub issues, automatically** — a failed deploy opens an issue on the platform repo <span class="badge testing">Testing</span>
|
||||
|
||||
---
|
||||
|
||||
# Versioned, Predictable Releases
|
||||
# Pick from pre-built, security-reviewed blocks
|
||||
|
||||
<em class="story">You control when you absorb platform improvements — no surprise upgrades.</em>
|
||||
|
||||
|
||||
Consumers control **when** they absorb platform improvements. <span class="badge testing">Testing</span>
|
||||
- **Primitives** — single-purpose resources (S3, VPC, ECS, IAM, ALB, ECR, CloudFront, WAF, RDS)
|
||||
- **Modules** — composed patterns (static site with CDN + WAF; microservice with VPC + ECS + ALB + ECR)
|
||||
- **Validated examples per module** — `simple.yaml` + `complex.yaml`, validated against the contract schema in CI
|
||||
- **Auto-promotion of patterns** — after 3 observed usages <span class="badge planned">Planned</span> <span class="badge agentic">Agentic</span>
|
||||
|
||||
- **Floating MAJOR + MINOR tags** (e.g. `@v1.12`) — a consumer automatically receives patch updates within the line
|
||||
---
|
||||
|
||||
# The bar rises automatically with sensitivity
|
||||
|
||||
|
||||
|
||||
| Environment | What the platform adds | Maturity |
|
||||
|---|---|---|
|
||||
| dev | Confidence ≥ 0.50, fully autonomous | <span class="badge testing">Testing</span> |
|
||||
| qa | QA human attestation + confidence ≥ 0.75 | <span class="badge planned">Planned</span> |
|
||||
| prod | SRE human attestation + confidence ≥ 0.90 | <span class="badge planned">Planned</span> |
|
||||
| dr | SRE human attestation + confidence ≥ 0.95 + DR drill | <span class="badge planned">Planned</span> |
|
||||
|
||||
- **No staging environment** — dev is the only autonomous environment
|
||||
- **Separation of duties** — the QA approver cannot be the prod approver
|
||||
|
||||
---
|
||||
|
||||
# Tearing down is as gated as deploying
|
||||
|
||||
|
||||
|
||||
<style>
|
||||
section { font-size: 22px; }
|
||||
pre { font-size: 13px; line-height: 1.2; }
|
||||
code { font-size: 13px; }
|
||||
</style>
|
||||
|
||||
```yaml
|
||||
uses: acdl/.github/workflows/deploy.yml@v1.12
|
||||
with:
|
||||
contract: .acdl/contract.yml
|
||||
mode: decommission
|
||||
changeRequestId: "CHG0678912"
|
||||
```
|
||||
|
||||
- **Validate the change request** — platform queries the CMDB; CR must be `approved` and match the consumer repo
|
||||
- **Two SRE human-attestation gates** — disable protection → SRE approves → zero counts + destroy → second SRE approves
|
||||
- **Per-stack encryption key enters a grace window** (default 30 days) so encrypted data remains recoverable <span class="badge testing">Testing</span>
|
||||
|
||||
---
|
||||
|
||||
# You control when you absorb improvements
|
||||
|
||||
|
||||
|
||||
- **Floating MAJOR + MINOR tags** (e.g. `@v1.12`) — automatically receive patch updates within the line
|
||||
- **Semantic versioning with a clear contract:** interface → MAJOR, behavior → MINOR, lifecycle → PATCH
|
||||
- **A consumer can pin to an exact version** for maximum stability, or float on MAJOR only (`@v1`) to absorb new features on their own cadence
|
||||
- **Pin to an exact version** for stability, or float on MAJOR only (`@v1`) to absorb new features on your own cadence
|
||||
- **Unversioned references (`@main`, bare) are discouraged** — the versioned tag is the only immutability lever
|
||||
- **Automated release job** computes the next semver on merge to main, creates the tag, and updates the floating tags
|
||||
- **Automated release job** computes the next semver on merge to main, creates the tag, and updates floating tags <span class="badge testing">Testing</span>
|
||||
|
||||
---
|
||||
|
||||
# Friendly Onboarding
|
||||
|
||||
<em class="story">First impressions matter — the platform fails gracefully, not opaquely.</em>
|
||||
# Fails gracefully, not opaquely
|
||||
|
||||
First impressions of a platform are made **when it fails for the first time.** The platform fails gracefully. <span class="badge testing">Testing</span>
|
||||
|
||||
@@ -136,111 +171,18 @@ The pipeline then **exits without attempting a deployment** — no partial state
|
||||
|
||||
---
|
||||
|
||||
# Safe Promotion Path
|
||||
|
||||
<em class="story">Promotion is a workflow choice, not a contract edit — and the bar rises automatically.</em>
|
||||
|
||||
The contract is environment-agnostic. The platform raises the bar automatically.
|
||||
|
||||
|
||||
|
||||
<table style="width: 100%; border: none;">
|
||||
<tr>
|
||||
<td style="width: 50%; vertical-align: top; border: none; padding-right: 12px;">
|
||||
|
||||
**Approach A — One contract, one job per environment.** Environment passed by each job.
|
||||
|
||||
```yaml
|
||||
jobs:
|
||||
dev:
|
||||
uses: acdl/.github/workflows/deploy.yml@v1.12
|
||||
with: { contract: .acdl/contract.yml, environment: dev }
|
||||
qa:
|
||||
needs: dev
|
||||
uses: acdl/.github/workflows/deploy.yml@v1.12
|
||||
with: { contract: .acdl/contract.yml, environment: qa }
|
||||
```
|
||||
|
||||
</td>
|
||||
<td style="width: 50%; vertical-align: top; border: none; padding-left: 12px;">
|
||||
|
||||
**Approach B — Environment-specific contracts.** When inputs differ per environment.
|
||||
|
||||
```yaml
|
||||
jobs:
|
||||
dev:
|
||||
uses: acdl/.github/workflows/deploy.yml@v1.12
|
||||
with: { contract: .acdl/contract-dev.yaml }
|
||||
qa:
|
||||
needs: dev
|
||||
uses: acdl/.github/workflows/deploy.yml@v1.12
|
||||
with: { contract: .acdl/contract-qa.yaml }
|
||||
```
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<style>
|
||||
section { font-size: 16px; }
|
||||
pre { font-size: 10px; line-height: 1.2; }
|
||||
code { font-size: 10px; }
|
||||
td { font-size: 14px; }
|
||||
</style>
|
||||
|
||||
---
|
||||
|
||||
# Safe Decommission
|
||||
|
||||
<em class="story">Tearing down is as deliberate as deploying — and just as gated.</em>
|
||||
|
||||
Tearing down a stack is **as deliberate as deploying one.** <span class="badge testing">Testing</span>
|
||||
|
||||
```yaml
|
||||
uses: acdl/.github/workflows/deploy.yml@v1.12
|
||||
with:
|
||||
contract: .acdl/contract.yml
|
||||
mode: decommission
|
||||
changeRequestId: "CHG0678912"
|
||||
```
|
||||
|
||||
A 2-step pipeline with **two SRE human-attestation gates**:
|
||||
|
||||
1. **Validate the change request** — the platform queries the CMDB; the CR must be `approved` and match the consumer repo
|
||||
2. **Disable deletion protection** → **SRE approves** → **Zero all counts + destroy** → **a second SRE approves**
|
||||
|
||||
The per-stack encryption key enters a **grace window** (default 30 days) so encrypted data remains recoverable.
|
||||
|
||||
---
|
||||
|
||||
# Self-Service Module Catalog
|
||||
|
||||
<em class="story">You don't author infrastructure — you pick from pre-built, security-reviewed building blocks.</em>
|
||||
|
||||
Developers pick from **pre-built, security-reviewed building blocks.** <span class="badge testing">Testing</span>
|
||||
|
||||
- **Primitives** — single-purpose resources (S3, VPC, ECS, IAM, load balancer, container registry, CloudFront, WAF, RDS), each with documented inputs/outputs, usage, compliance extension points, and versioning
|
||||
- **Modules** — composed patterns (a static site with CDN + WAF; a microservice with VPC + ECS + load balancer + registry)
|
||||
- **Validated examples per module** — `simple.yaml` + `complex.yaml` + variation files, validated against the contract schema in CI. Examples cannot drift from the schema silently
|
||||
- **Auto-promotion of patterns** — auto-promoted to the catalog after 3 observed usages <span class="badge planned">Planned</span> <span class="badge agentic">Agentic</span>
|
||||
- **Compliance extension points** — each module lists where GDPR, SOX, SOC2, DORA controls will wire in <span class="badge planned">Planned</span>
|
||||
|
||||
---
|
||||
|
||||
<!-- _class: title -->
|
||||
<!-- _paginate: false -->
|
||||
|
||||
# The Desired Outcomes
|
||||
# The desired outcomes
|
||||
|
||||
<em class="story">Here's what this delivers to the organization.</em>
|
||||
|
||||
- **Velocity without sacrificing safety.** Speed is in the ergonomics (a simple contract, a one-line `uses:`); safety is in the gates the consumer cannot bypass.
|
||||
- **Security, observability, and compliance as platform defaults** — not per-team effort, not post-hoc remediation.
|
||||
- **Auditability as a byproduct, not a project.** Every production change is traceable to a human attestation and a tamper-evident evidence event.
|
||||
- **Blast radius contained by design.** Zero-trust OIDC + ABAC means a consumer can only touch its own tagged resources.
|
||||
- **The bottleneck moves off the platform team's ticket queue.** A merged change progresses through lower environments without a platform engineer joining a thread.
|
||||
- **Infrastructure as a utility, not a craft.** Teams consume infrastructure, they don't maintain it — and the platform compounds value over time by learning from recurring patterns.
|
||||
- **A path to the citizen developer.** The same safety envelope that serves a senior engineer will serve a non-technical consumer. <span class="badge agentic">Agentic</span>
|
||||
- **Velocity without sacrificing safety** — speed in ergonomics, safety in unbypassable gates
|
||||
- **Security, observability, compliance as platform defaults** — not per-team effort, not post-hoc remediation
|
||||
- **Auditability as a byproduct, not a project** — every change traceable to a human attestation and a tamper-evident evidence event
|
||||
- **Blast radius contained by design** — OIDC + ABAC, only your own tagged resources
|
||||
- **The bottleneck moves off the platform team's ticket queue** — a merged change progresses without a platform engineer joining a thread
|
||||
- **Infrastructure as a utility, not a craft** — consume, don't maintain
|
||||
- **A path to the citizen developer** — same envelope, senior engineer or non-technical <span class="badge agentic">Agentic</span>
|
||||
|
||||
---
|
||||
|
||||
@@ -249,8 +191,6 @@ Developers pick from **pre-built, security-reviewed building blocks.** <span cla
|
||||
|
||||
# Appendix
|
||||
|
||||
<em class="story">For deep dives — these slides cover details omitted from the main 10.</em>
|
||||
|
||||
**Contents:**
|
||||
|
||||
1. The Citizen Developer Experience (full)
|
||||
@@ -328,15 +268,14 @@ The entire CI pipeline runs **from the shell**, not just in CI. <span class="bad
|
||||
| **HITL** | Human-in-the-Loop — deliberate human attestation required for qa/prod/dr environments |
|
||||
| **VCS** | Version Control System — the git hosting platform (GitHub, Gitea, GitLab) |
|
||||
| **NFR** | Non-Functional Requirement — encryption, tagging, observability standards |
|
||||
| **IR** | Intermediate Representation — the engine-agnostic stack definition between contract and Terraform |
|
||||
|
||||
---
|
||||
|
||||
# A6 — Operating Model & Cost
|
||||
|
||||
<style>
|
||||
section { font-size: 18px; }
|
||||
table { font-size: 16px; }
|
||||
section { font-size: 20px; }
|
||||
table { font-size: 18px; }
|
||||
</style>
|
||||
|
||||
ACDL runs at **zero cloud cost** for day-to-day development. AWS spend was measured via Cost Explorer (`COST.md`, 2026-07-28):
|
||||
@@ -348,12 +287,11 @@ ACDL runs at **zero cloud cost** for day-to-day development. AWS spend was measu
|
||||
| Projected monthly | ~$0.007 |
|
||||
| Peak day | 2026-07-27 ($0.000867) |
|
||||
|
||||
- **S3 dominates** (98.8%, terraform state bucket) — no compute (ECS/Lambda) ran because v1.0→v1.10 was plan-only for IAM-gated capabilities
|
||||
- **Local emulators are the primary tier** — the full pipeline runs in-process, no AWS credentials, no Checkov, no DynamoDB. <span class="badge testing">Testing</span>
|
||||
- **Live-AWS verification is milestone-scoped, then torn down.** The v1.11 lifecycle pipeline ran apply→modify→destroy for every module, then tore down to zero-cost (D-096). The pipeline now **defaults to plan-only** on every PR; `ACDL_LIFECYCLE_MODE=full` overrides to apply→destroy for milestone verification (REQ-134, v1.12).
|
||||
- **Local emulators are the primary tier** — the full pipeline runs in-process, no AWS credentials <span class="badge testing">Testing</span>
|
||||
- **Live-AWS verification is milestone-scoped, then torn down.** The pipeline now **defaults to plan-only** on every PR; `ACDL_LIFECYCLE_MODE=full` overrides to apply→destroy for milestone verification (REQ-134, v1.12).
|
||||
- **Cost drivers** are spike-scoped: Terraform plan reads (free), S3 state storage (cents), DynamoDB outbox (cents). No running infrastructure between milestones.
|
||||
|
||||
**Pre-mortem (`PRE_MORTEM.md`):** failure modes were pre-mortemed before the leadership pitch. The v1.10 decay incident (diff-scoped VERIFY missed 7 adapter defects) is the root pattern: *a claim outruns the verification that backs it.* Four forward failure modes + structural mitigations (regression-tested IAM baseline, mandatory teardown, verified-only deck claims, honest scope).
|
||||
**Pre-mortem (`PRE_MORTEM.md`):** the v1.10 decay incident (diff-scoped VERIFY missed 7 adapter defects) is the root pattern: *a claim outruns the verification that backs it.* Four forward failure modes + structural mitigations (regression-tested IAM baseline, mandatory teardown, verified-only deck claims, honest scope).
|
||||
|
||||
---
|
||||
|
||||
@@ -362,13 +300,11 @@ ACDL runs at **zero cloud cost** for day-to-day development. AWS spend was measu
|
||||
|
||||
# A7 — Verified by Construction
|
||||
|
||||
<em class="story">The v1.11 architecture makes "Verified" a structural property, not a claim.</em>
|
||||
|
||||
<style>
|
||||
section { font-size: 18px; }
|
||||
section { font-size: 20px; }
|
||||
</style>
|
||||
|
||||
Two architectural pillars:
|
||||
Two architectural pillars make "Verified" a structural property, not a claim:
|
||||
|
||||
- **The stateless adapter (918 → ~80 lines).** The Terraform adapter was a 918-line monolith with 3 constant tables and 39 type-specific branches. It is now a ~80-line **stateless assembler**: it owns no module content — no resource shape, no nested HCL blocks, no defaults. Each L1 module ships a real `terraform/` module dir owning its shape, nested blocks, and defaults. The adapter reads the registry and emits `module "x" { source = ... }` blocks. A new module is a new terraform dir, not a code change. *(The v1.12 P67 fix closed a dedup defect for multi-resource L1s — ecs-service, alb; CAP-013 now Verified.)*
|
||||
- **Pipeline-driven lifecycle testing.** A `modules-lifecycle` pipeline matrix-runs each L1 and L2 module's contracts through apply→modify→destroy against live AWS. **The "test" = the pipeline cell going green.** Defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); `ACDL_LIFECYCLE_MODE=full` overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — **22/22 Verified** as of v1.12.
|
||||
|
||||
@@ -18,7 +18,7 @@
|
||||
|
||||
---
|
||||
|
||||
## Slide 2 — Where ACDL Sits in Your World
|
||||
## Slide 2 — Two consumer paths, one safety envelope
|
||||
|
||||
**Talking points:**
|
||||
- This is the scope-boundary slide — here's who uses the platform, and here's where ACDL's responsibility starts and stops
|
||||
@@ -31,7 +31,7 @@
|
||||
|
||||
---
|
||||
|
||||
## Slide 3 — The Contract — The Entire Consumer Surface
|
||||
## Slide 3 — Three things. The entire consumer surface.
|
||||
|
||||
**Talking points:**
|
||||
- Hold this slide — the audience should sit with how small the consumer surface is. Three things: app code, a contract, a one-line CI definition
|
||||
@@ -44,7 +44,7 @@
|
||||
|
||||
---
|
||||
|
||||
## Slide 4 — The Developer Feedback Loop
|
||||
## Slide 4 — See what the platform does, in real time
|
||||
|
||||
**Talking points:**
|
||||
- This directly answers "but developers hate platforms that hide what they're doing" — the platform is opinionated about *what* runs, not *opaque* about *that* it runs
|
||||
@@ -58,177 +58,174 @@
|
||||
|
||||
---
|
||||
|
||||
## Slide 5 — Versioned, Predictable Releases
|
||||
|
||||
**Talking points:**
|
||||
- This is the "no surprise upgrades" story — consumers aren't forced to chase the platform, and the platform isn't forced to support N forks of every workflow
|
||||
- Floating MAJOR + MINOR tags (e.g. `@v1.12`) — a consumer automatically receives patch updates within the line. Pin to exact version for stability, or float on MAJOR only for new features
|
||||
- Semantic versioning with a clear contract: interface → MAJOR, behavior → MINOR, lifecycle → PATCH
|
||||
- Unversioned references (`@main`, bare) are discouraged — the versioned tag is the only immutability lever a consumer has
|
||||
- The automated release job computes the next semver on merge to main, creates the tag, and updates the floating tags — no manual release process
|
||||
|
||||
**Key takeaway:** Consumers control when they absorb platform improvements. No surprise upgrades.
|
||||
|
||||
---
|
||||
|
||||
## Slide 6 — Friendly Onboarding
|
||||
|
||||
**Talking points:**
|
||||
- This looks like a small thing; it's actually a cultural one — the platform's posture is "help me get started," not "you should have known"
|
||||
- First impressions of a platform are made when it fails for the first time. The platform fails gracefully with a guided prompt, not an opaque error
|
||||
- The prompt tells the consumer: what's missing, what the platform will provision, the expected turnaround, and how to request an environment
|
||||
- The pipeline exits without attempting a deployment — no partial state, no confusing errors
|
||||
- Be honest: the citizen developer onboarding path is planned, not yet shipped
|
||||
|
||||
**Key takeaway:** The platform fails gracefully. First impressions drive adoption — platforms that fail opaquely get routed around.
|
||||
|
||||
---
|
||||
|
||||
## Slide 7 — Safe Promotion Path
|
||||
|
||||
**Talking points:**
|
||||
- Promotion is a workflow choice, not a contract mutation — this matters because it means a promotion can be reviewed as a *diff in the workflow*, not as a rewritten contract
|
||||
- The promotion journey diagram shows the rising bar: dev (autonomous) → qa (QA attests) → prod (SRE attests) → dr (SRE attests + DR drill)
|
||||
- Approach A (one contract, environment passed by the job) keeps the single source of truth — the contract never changes
|
||||
- Approach B (environment-specific contracts) lets teams whose inputs genuinely vary keep that variation explicit and reviewable
|
||||
- The rising bar is annotated with maturity: **dev = Testing** (works internally, pilot-ready); **qa/prod/dr = Planned** (on the roadmap). Be honest about that split
|
||||
- Separation of duties is enforced — the QA approver cannot be the prod approver. No staging environment — the design deliberately removes the "staging is basically prod but not really" anti-pattern
|
||||
|
||||
**Key takeaway:** Change the environment field, not the contract. The platform raises the bar automatically. The consumer can't bypass the gates.
|
||||
|
||||
---
|
||||
|
||||
## Slide 8 — Safe Decommission
|
||||
|
||||
**Talking points:**
|
||||
- The counter-argument to "deletion protection makes cleanup impossible" — decommission is a first-class, gated, two-approval flow, not a lock with no key
|
||||
- The change request must be `approved` in the CMDB and match the consumer repo — no CR, no decommission
|
||||
- Two SRE human-attestation gates: one to disable deletion protection, a second to zero counts and destroy
|
||||
- The per-stack encryption key enters a 30-day grace window so encrypted data remains recoverable — the key is permanently deleted only after the window expires
|
||||
- For the Head of Infrastructure: the CMDB validation means decommission is auditable, not just possible
|
||||
|
||||
**Key takeaway:** Tearing down is as gated as deploying. Two SRE approvals, CMDB-validated change request, 30-day key grace window.
|
||||
|
||||
---
|
||||
|
||||
## Slide 9 — Self-Service Module Catalog
|
||||
## Slide 5 — Pick from pre-built, security-reviewed blocks
|
||||
|
||||
**Talking points:**
|
||||
- The catalog is what makes "declare intent" practical — you can only declare a module that exists
|
||||
- Primitives are single-purpose resources (S3, VPC, ECS, IAM, ALB, ECR, CloudFront, WAF, RDS) — each with documented inputs/outputs, usage, compliance extension points, and versioning
|
||||
- Modules are composed patterns (a static site with CDN + WAF; a microservice with VPC + ECS + ALB + registry) — one well-reviewed module serves every consumer
|
||||
- Validated examples per module — `simple.yaml` + `complex.yaml` + variation files, validated against the contract schema in CI. Examples cannot drift from the schema silently
|
||||
- For leadership: the catalog is the leverage — a fix to a module serves every consumer on the next run. This is the compounding asset
|
||||
- Auto-promotion of patterns (after 3 observed usages) and compliance extension points (GDPR, SOX, SOC2, DORA) are planned
|
||||
- For leadership: the catalog is the leverage. One well-reviewed module serves every consumer; a fix to the module serves every consumer on the next run. This is the compounding asset
|
||||
- Primitives are single-purpose resources (S3, VPC, ECS, IAM, ALB, ECR, CloudFront, WAF, RDS) — each with documented inputs/outputs and versioning
|
||||
- Modules are composed patterns — a static site with CDN + WAF; a microservice with VPC + ECS + ALB + ECR
|
||||
- Validated examples per module (`simple.yaml` + `complex.yaml`) are validated against the contract schema in CI — examples cannot drift from the schema silently
|
||||
- Auto-promotion of patterns (after 3 observed usages) and compliance extension points (GDPR, SOX, SOC2, DORA) are on the roadmap
|
||||
|
||||
**Key takeaway:** The catalog is the compounding asset. One well-reviewed module serves every consumer. A fix serves everyone on the next run.
|
||||
**Key takeaway:** You don't author infrastructure — you pick from pre-built, security-reviewed building blocks. The catalog is the compounding asset.
|
||||
|
||||
---
|
||||
|
||||
## Slide 10 — The Desired Outcomes
|
||||
## Slide 6 — The bar rises automatically with sensitivity
|
||||
|
||||
**Talking points:**
|
||||
- Close on the strategic frame — the platform is not "a CI/CD tool," it's the organizational lever for shipping safely at the pace the business demands
|
||||
- Velocity without sacrificing safety: speed is in the ergonomics (a simple contract, a one-line `uses:`), safety is in the gates the consumer cannot bypass
|
||||
- Security, observability, and compliance as platform defaults — not per-team effort, not post-hoc remediation. Encryption, deletion protection, uptime monitoring, policy checks, and evidence are on by construction
|
||||
- Promotion is a workflow choice, not a contract edit — a promotion can be reviewed as a *diff in the workflow*, not as a rewritten contract
|
||||
- The DX win: the contract stays stable across environments; the safety win: the platform raises the threshold and attestation bar automatically based on the target environment
|
||||
- The consumer can't bypass the gates — they pick *which* environment to target, and the platform applies the right bar
|
||||
- No staging environment — the design deliberately removes the "staging is basically prod but not really" anti-pattern. Dev is the only autonomous environment
|
||||
- Separation of duties is enforced — the QA approver cannot be the prod approver
|
||||
- Be honest about maturity: dev is tested and pilot-ready; qa/prod/dr wiring is planned
|
||||
|
||||
**Key takeaway:** The bar rises automatically with sensitivity. The consumer picks the environment; the platform applies the right gate.
|
||||
|
||||
---
|
||||
|
||||
## Slide 7 — Tearing down is as gated as deploying
|
||||
|
||||
**Talking points:**
|
||||
- The counter-argument to "deletion protection makes cleanup impossible" is this slide. Decommission is a first-class, gated, two-approval flow — not a lock with no key, and not an ungated `terraform destroy`
|
||||
- The CMDB validation means decommission is auditable, not just possible — the platform queries the CMDB and asserts the CR is `approved` and matches the consumer repo
|
||||
- Two SRE human-attestation gates: disable protection → SRE approves → zero all counts + destroy → a second SRE approves
|
||||
- The per-stack encryption key enters a grace window (default 30 days) so encrypted data remains recoverable during decommission
|
||||
- For the Head of Infrastructure: this is what makes deletion protection safe to ship by default — cleanup is a deliberate, gated path, not an impossible one
|
||||
|
||||
**Key takeaway:** Tearing down is as deliberate as deploying — two SRE attestation gates + CMDB-validated change request.
|
||||
|
||||
---
|
||||
|
||||
## Slide 8 — You control when you absorb improvements
|
||||
|
||||
**Talking points:**
|
||||
- This is the "no surprise upgrades" story. Leadership hears two things: (1) consumers aren't forced to chase the platform, (2) the platform isn't forced to support N forks of every workflow
|
||||
- Floating MAJOR + MINOR tags (e.g. `@v1.12`) — a consumer automatically receives patch updates within the line
|
||||
- Semantic versioning with a clear contract: interface → MAJOR, behavior → MINOR, lifecycle → PATCH
|
||||
- A consumer can pin to an exact version for maximum stability, or float on MAJOR only (`@v1`) to absorb new features on their own cadence
|
||||
- Unversioned references (`@main`, bare) are discouraged — the versioned tag is the only immutability lever a consumer has
|
||||
- The automated release job computes the next semver on merge to main, creates the tag, and updates the floating tags
|
||||
|
||||
**Key takeaway:** You control when you absorb platform improvements — no surprise upgrades, no forced forks.
|
||||
|
||||
---
|
||||
|
||||
## Slide 9 — Fails gracefully, not opaquely
|
||||
|
||||
**Talking points:**
|
||||
- This looks like a small thing; it's actually a cultural one. The platform's posture is "help me get started," not "you should have known"
|
||||
- For the Head of DevOps: this is what drives adoption. Platforms that fail opaquely on first run get routed around
|
||||
- When no environment is bound, the platform emits a user-friendly onboarding prompt — not an opaque failure
|
||||
- The prompt tells the consumer: no environment bound, what the platform will provision, expected turnaround, how to request an environment
|
||||
- The pipeline then exits without attempting a deployment — no partial state, no confusing errors
|
||||
- The citizen developer onboarding path is planned
|
||||
|
||||
**Key takeaway:** The platform fails gracefully, not opaquely — first impressions are made when it fails for the first time.
|
||||
|
||||
---
|
||||
|
||||
## Slide 10 — The desired outcomes
|
||||
|
||||
**Talking points:**
|
||||
- Close on the strategic frame. The platform is not "a CI/CD tool" — it is the organizational lever for shipping safely at the pace the business demands, with the security and audit posture the regulators require
|
||||
- Velocity without sacrificing safety: speed is in the ergonomics (a simple contract, a one-line `uses:`); safety is in the gates the consumer cannot bypass
|
||||
- Security, observability, and compliance as platform defaults — not per-team effort, not post-hoc remediation
|
||||
- Auditability as a byproduct, not a project — every production change is traceable to a human attestation and a tamper-evident evidence event
|
||||
- The bottleneck moves off the platform team's ticket queue — a merged change progresses through lower environments without a platform engineer joining a thread
|
||||
- Infrastructure as a utility, not a craft — teams consume, they don't maintain. The platform compounds value over time by learning from recurring patterns
|
||||
- The path to the citizen developer — the same safety envelope that serves a senior engineer will serve a non-technical consumer. Expanding who can ship safely without lowering the bar
|
||||
- A path to the citizen developer: the same safety envelope serves a senior engineer and a non-technical consumer
|
||||
- Invite questions; the companion deck ("How the Platform Works") covers the internal mechanics in more depth
|
||||
|
||||
**Key takeaway:** Velocity without sacrificing safety. Security and auditability as byproducts. The bottleneck moves off the platform team's queue.
|
||||
**Key takeaway:** Ship safely at the pace the business demands, with the security and audit posture the regulators require.
|
||||
|
||||
---
|
||||
|
||||
## Appendix — Contents
|
||||
## Appendix TOC — Appendix
|
||||
|
||||
**Talking points:**
|
||||
- These are backup slides for Q&A — don't walk through them in the main talk unless time permits
|
||||
- Use A1 when asked about the citizen developer detail; A2 for the no-cloning mechanism; A3 for local reproducibility; A4 for the roadmap; A5 for term definitions
|
||||
- The appendix now has 7 slides (A1–A7), including two new ones: A6 (Operating Model & Cost with real AWS figures + pre-mortem) and A7 (Verified by Construction — the v1.11 architecture)
|
||||
- These are backup slides for Q&A. Use them when the audience asks for the detail behind a main-slide claim
|
||||
- Don't walk through them in the main talk unless time permits
|
||||
- The appendix is indexed to match the Marp deck's A1-A7 structure
|
||||
|
||||
**Key takeaway:** The appendix is the deep-dive drawer. Pull a slide when the audience asks for the detail behind a main-slide claim.
|
||||
**Key takeaway:** Backup slides for Q&A — pull the relevant appendix slide when asked.
|
||||
|
||||
---
|
||||
|
||||
## A1 — The Citizen Developer Experience
|
||||
|
||||
**Talking points:**
|
||||
- The framing is **vibe coding on a laptop** — the consumer describes what they want in plain language; an AI agent turns that into a contract the platform treats identically to a senior engineer's
|
||||
- The consumer opens an issue (e.g. "a web API for the pricing service"); an AI agent maps the intent to a contract referencing a module from the reviewed skill catalog
|
||||
- The contract enters the same pipeline and must clear the same confidence gate — no weaker mode
|
||||
- Guardrails: skills are versioned, signed, and reviewed for sensitive data before release (Infra & Ops owns the review); agents are stateless — all state lives in the platform; the platform trusts and always verifies
|
||||
- The agent's trace and submission confidence are captured in the contract (`profile: agentic`), so a reviewer can see how the contract was produced
|
||||
- Be honest about maturity: the mechanism is designed and stub-proven; the full skill catalog and real agent runtime are planned
|
||||
- Be honest about maturity: the *mechanism* (agent → contract → same pipeline) is designed and the stub was proven in the v1.0 demo; the full skill catalog and real agent runtime are planned
|
||||
- The "vibe coding on a laptop" framing is intentional — it meets the citizen developer where they already are, but every submission still passes the same safety envelope
|
||||
- The design point matters to leadership now: we are building for a world where more of the org can ship safely, not where more of the org has to become a platform engineer
|
||||
- Guardrails: skills are versioned, signed, reviewed for sensitive data; agents are stateless; the platform trusts and always verifies
|
||||
- The agent's trace and submission confidence are captured in the contract (`profile: agentic`) for review
|
||||
|
||||
**Key takeaway:** Vibe coding on a laptop — but every submission passes the same safety envelope. The agent produces the contract; the platform verifies it.
|
||||
**Key takeaway:** A non-technical consumer ships by declaring intent — same pipeline, same safety envelope, no weaker checks.
|
||||
|
||||
---
|
||||
|
||||
## A2 — No Platform Code, No Cloning
|
||||
|
||||
**Talking points:**
|
||||
- The consumer's CI definition is a thin wrapper — one `uses:` line pointing at a versioned tag. That's the only coupling
|
||||
- The runner checks out the consumer repo, then checks out the platform repo into the workspace. The platform installs its own runtime dependencies — the consumer installs nothing
|
||||
- The consumer never clones the platform repo, never invokes platform scripts locally (optional `--check-only` validation is available but not required)
|
||||
- When the platform ships a fix, every consumer on a floating MAJOR.MINOR tag gets it on their next run — no per-repo upgrade project
|
||||
- For the Head of Cloud: there is no "platform code in every consumer repo" problem. The version-pinned `uses:` line is the only coupling, and it updates itself within the line
|
||||
- The Head of Cloud cares about this: there is no "platform code in every consumer repo" problem
|
||||
- The version-pinned `uses:` line is the *only* coupling, and it's a coupling that updates itself within the line
|
||||
- The runner checks out the consumer repo, then checks out the platform repo into the workspace — the consumer never clones the platform repo
|
||||
- The platform installs its own runtime dependencies — the consumer installs nothing
|
||||
- When the platform ships a fix, every consumer on a floating tag gets it on their next run — no per-repo upgrade project
|
||||
|
||||
**Key takeaway:** One `uses:` line is the only coupling. The platform fetches itself at run time. No per-repo upgrade projects.
|
||||
**Key takeaway:** The consumer never touches platform internals. The versioned `uses:` line is the only coupling.
|
||||
|
||||
---
|
||||
|
||||
## A3 — Local Reproducibility
|
||||
|
||||
**Talking points:**
|
||||
- The entire CI pipeline runs from the shell, not just in CI — no "works on my machine, fails in CI" gap
|
||||
- This is the "no surprises before you push" story. A consumer can validate their contract offline, run the plan offline, and only push when they're confident
|
||||
- `scripts/run_ci.sh` mirrors the CI pipeline locally — the same three stages (lint → test → check-only) in sequence
|
||||
- `scripts/run_platform.sh --check-only` runs the platform offline — no AWS, no policy engine, no outbox required. Validates a contract end-to-end before pushing
|
||||
- `--plan-only` runs through the infrastructure plan without applying
|
||||
- The CI and deploy pipelines are defined by declarative contracts (YAML instances validated against JSON Schemas) — a single source of truth that both workflows implement
|
||||
- `scripts/run_platform.sh --check-only` runs the platform offline — no AWS, no policy engine, no outbox required
|
||||
- The same declarative contract drives both the local tooling and CI — there's no "works on my machine, fails in CI" gap
|
||||
|
||||
**Key takeaway:** Validate offline, plan offline, push when confident. The same declarative contract drives local tooling and CI.
|
||||
**Key takeaway:** The entire CI pipeline runs from the shell — no surprises before you push.
|
||||
|
||||
---
|
||||
|
||||
## A4 — The Road to the North Star
|
||||
|
||||
**Talking points:**
|
||||
- Call this out explicitly: **proposed phasing, not formally planned** — don't let the audience read it as a commitment
|
||||
- Phase 1 is what's Verified today (22/22 capabilities) — core platform (contract, catalog, evidence), torn down to zero-cost
|
||||
- Phase 2 is the next milestone — safe promotion wiring for qa/prod/dr
|
||||
- Phase 3 introduces the agentic surface — skill catalog + agents
|
||||
- Phase 4 is the north star — citizen developer GA on the same safety envelope
|
||||
- Use this slide only when an audience member asks "how do you get from here to there"
|
||||
- This is a proposed phasing, not a formally committed plan — call that out explicitly
|
||||
- Phase 1 is what's tested and Verified today (22/22 capabilities, torn down to zero-cost)
|
||||
- Phase 2 is the next milestone (qa/prod/dr wiring)
|
||||
- Phase 3 introduces the agentic surface (skill catalog + agents)
|
||||
- Phase 4 is the north star: citizen developer GA on the same safety envelope
|
||||
- Use this only when an audience member asks "how do you get from here to there"
|
||||
|
||||
**Key takeaway:** A proposed path from the Verified core (22/22) to the citizen developer north star — proposed phasing, not formally planned.
|
||||
**Key takeaway:** Proposed phasing — Phase 1 Verified, Phase 4 is the North Star (citizen developer GA).
|
||||
|
||||
---
|
||||
|
||||
## A5 — Glossary
|
||||
|
||||
**Talking points:**
|
||||
- Keep this slide in your back pocket for the audience member who asks "what does ABAC actually mean?" — don't read it aloud
|
||||
- OIDC = short-lived federation tokens, no long-lived credentials; ABAC = access scoped by resource tags + repo identity, not roles
|
||||
- CMK = per-stack encryption key, 90-day rotation; CMDB = validates change requests for decommission
|
||||
- RPO = 0 means evidence written synchronously, no data loss; HITL = deliberate human attestation for qa/prod/dr
|
||||
- VCS = the git hosting platform (GitHub, Gitea, GitLab); NFR = encryption, tagging, observability standards
|
||||
- Keep this slide in your back pocket for the audience member who asks "what does ABAC actually mean?"
|
||||
- Don't read it aloud
|
||||
- All acronyms used in the deck are defined here
|
||||
|
||||
**Key takeaway:** The deck uses real security and ops vocabulary. The glossary is the cheat sheet for the audience member who wants the definitions.
|
||||
**Key takeaway:** Reference slide — don't read aloud.
|
||||
|
||||
---
|
||||
|
||||
## A6 — Operating Model & Cost
|
||||
|
||||
**Talking points:**
|
||||
- This is the slide for the Head of Cloud / Finance — the headline: less than one cent ($0.001883) over 8 days of active development; zero BAU cloud spend
|
||||
- Walk the cost table: total $0.001883 / 8 days, daily average $0.000235, projected monthly ~$0.007, peak day 2026-07-27 at $0.000867
|
||||
- S3 dominates the spend (98.8%, the terraform state bucket) — no compute (ECS/Lambda) ran because v1.0→v1.10 was plan-only for IAM-gated capabilities
|
||||
- Live-AWS verification is milestone-scoped, then torn down: the v1.11 lifecycle pipeline ran apply→modify→destroy for every module, then tore down to zero-cost (D-096 — teardown mandatory before milestone COMPLETE)
|
||||
- The lifecycle pipeline now defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); `ACDL_LIFECYCLE_MODE=full` overrides to apply→destroy for milestone verification (REQ-134, v1.12)
|
||||
- The pre-mortem (`PRE_MORTEM.md`) is the credibility slide — we already asked "how does this fail?" The v1.10 decay incident (diff-scoped VERIFY missed 7 adapter defects) is the root pattern: *a claim outruns the verification that backs it.* Four forward failure modes + structural mitigations (regression-tested IAM baseline, mandatory teardown, verified-only deck claims, honest scope)
|
||||
- The headline for the Head of Cloud / Finance: less than one cent over 8 days of active development; zero BAU cloud spend
|
||||
- The lifecycle pipeline defaults to plan-only so the PR-time cost is zero; `ACDL_LIFECYCLE_MODE=full` overrides for milestone verification
|
||||
- The pre-mortem is the credibility slide — we already asked "how does this fail?" and the mitigations are structural
|
||||
- The v1.10 decay incident is disclosed honestly, not hidden — that disclosure IS the mitigation
|
||||
- Cost drivers are spike-scoped: Terraform plan reads (free), S3 state storage (cents), DynamoDB outbox (cents). No running infrastructure between milestones
|
||||
|
||||
**Key takeaway:** Less than one cent over 8 days. Zero BAU cloud spend. The pre-mortem + plan-only default make cost a non-issue and verification structural.
|
||||
**Key takeaway:** Zero BAU cloud cost. Pre-mortemed failure modes with structural mitigations.
|
||||
|
||||
---
|
||||
|
||||
@@ -236,10 +233,9 @@
|
||||
|
||||
**Talking points:**
|
||||
- This is the deep-dive slide for the Head of Engineering / Architecture — the two pillars answer "how do you keep the decks honest?"
|
||||
- Pillar 1 — the **stateless adapter** (918 → ~80 lines): the old adapter was a monolith with 3 constant tables and 39 type-specific branches. The new adapter is a stateless assembler that owns no module content — each L1 module ships a real `terraform/` module dir owning its shape, nested blocks, and defaults. A new module is a new terraform dir, not a code change
|
||||
- The v1.12 P67 fix closed a dedup defect for multi-resource L1s (ecs-service, alb) — CAP-013 is now Verified
|
||||
- Pillar 2 — **pipeline-driven lifecycle testing**: a `modules-lifecycle` pipeline matrix-runs each L1 and L2 module's contracts through apply→modify→destroy against live AWS. The "test" = the pipeline cell going green. No per-module Python
|
||||
- The pipeline defaults to plan-only on every PR (zero cost); `ACDL_LIFECYCLE_MODE=full` runs the real apply→destroy for milestone verification. The regression gate (D-091) re-runs all 22 capabilities at milestone completion — 22/22 Verified as of v1.12
|
||||
- The v1.10 lesson is the negative space: a 918-line adapter with type-specific branches decayed silently because the VERIFY gate was diff-scoped. The ~80-line stateless adapter + the milestone regression gate are the structural fix
|
||||
- The adapter is simple enough to reason about (a stateless assembler); the lifecycle pipeline is the automated verification that backs every "Testing" claim
|
||||
- The v1.10 lesson is the negative space: a 918-line adapter with type-specific branches decayed silently because the VERIFY gate was diff-scoped
|
||||
- The ~80-line stateless adapter + the milestone regression gate are the structural fix
|
||||
- The plan-only default (v1.12) means verification runs on every PR at zero cost, with the full apply→destroy gated behind a CI variable override
|
||||
|
||||
**Key takeaway:** "Verified" is a structural property, not a claim — a stateless ~80-line adapter + a lifecycle pipeline that defaults to plan-only and goes green on every PR.
|
||||
**Key takeaway:** "Verified" is a structural property, not a claim — the stateless adapter + lifecycle pipeline make it so.
|
||||
File diff suppressed because one or more lines are too long
@@ -2,7 +2,7 @@
|
||||
|
||||
> **Subtitle:** Agentic Cloud Delivery Platform
|
||||
> **Audience:** Senior Leadership, CTO, Head of Cloud, Head of Infrastructure, Head of DevOps
|
||||
> **Length:** ~15 minutes · 10 main + 6 appendix = 16 slides
|
||||
> **Length:** ~15 minutes · 10 main + 7 appendix = 17 slides
|
||||
> **Purpose:** Sell the developer experience and the citizen developer experience to tech leadership — velocity without sacrificing safety, and security/observability/compliance as platform defaults rather than per-team effort.
|
||||
> **Maturity framing:** "Testing" = works internally, dev pilot-ready. "Planned" = on the roadmap. "Agentic" = involves AI agents or autonomous decision-making.
|
||||
> **Re-verification (2026-07-29):** Every "Testing" claim in this deck was re-verified in v1.10 Phase 54 (D-093) and again in v1.11 via the pipeline-driven lifecycle tests (P59–P62). The headline E2E (contract → resolver → adapter → terraform init/validate/plan) passes against the live AWS account; the local emulating tier (Phase 53) runs the full E2E with no cloud credentials. **22/22 auto-verifiable capabilities Verified** (CAP-013 fixed in v1.12 P67 — the adapter's multi-resource L1 dedup defect is closed). The v1.11 lifecycle pipeline ran apply→modify→destroy against live AWS and was then torn down to zero-cost (D-096). See `.ciagent/CAPABILITY_INVENTORY.md` and `.ciagent/PRE_MORTEM.md`.
|
||||
@@ -17,14 +17,10 @@ The consumer surface is intentionally tiny. The platform's surface is large and
|
||||
|
||||
---
|
||||
|
||||
## Slide 2 — Where Agentic Cloud Delivery (ACDL) Sits in Your World
|
||||
|
||||
Here's who uses the platform and where the boundary is.
|
||||
## Slide 2 — Two consumer paths, one safety envelope
|
||||
|
||||
The platform serves **two kinds of consumer** through two coordinated paths — but both converge on the **same contract, the same policy envelope, and the same evidence stream.**
|
||||
|
||||
**Agentic Cloud Delivery (ACDL)** sits between upstream (anything that produces a contract) and downstream (AWS resources running + the consumer's image pipeline).
|
||||
|
||||
```mermaid
|
||||
flowchart LR
|
||||
subgraph UP ["Upstream — anything"]
|
||||
@@ -49,27 +45,19 @@ flowchart LR
|
||||
F --> G
|
||||
```
|
||||
|
||||
- **Technical developer** — owns app code + a contract + a thin CI definition. Uses the full module catalog and inputs.
|
||||
- **Citizen developer** — declares intent in plain language; an AI agent produces a contract that passes the **same** safety envelope as a senior engineer's. <span class="badge agentic">Agentic</span>
|
||||
- **Upstream is anything** — your IDE, an agentic SDLC, or vibe coding on a laptop. ACDL doesn't care how the contract was produced.
|
||||
- **Technical developer** — owns app code + a contract + a thin CI definition.
|
||||
- **Citizen developer** — declares intent in plain language; an AI agent produces a contract that passes the **same** safety envelope. <span class="badge agentic">Agentic</span>
|
||||
- **Upstream is anything** — IDE, agentic SDLC, or vibe coding. ACDL doesn't care how the contract was produced.
|
||||
- **ACDL is infrastructure only** — it provisions and governs AWS resources. Application deployment is upstream.
|
||||
|
||||
The platform is **opinionated in what it accepts, regardless of who is declaring.** There is no "citizen developer mode" with weaker checks.
|
||||
|
||||
> **Speaker notes:** This is the thesis of the deck. The two surfaces are *parallel*, not a progression — a citizen developer doesn't "graduate" to the developer surface. Both produce a contract; both get the same treatment. The scope boundary matters: anything upstream of the contract is out of ACDL's concern — ACDL is the infrastructure layer that takes a contract and governs the AWS resources. The leadership takeaway: we expand who can ship safely without lowering the bar.
|
||||
> **Speaker notes:** This is the thesis of the deck. The two surfaces are *parallel*, not a progression — a citizen developer doesn't "graduate" to the developer surface. Both produce a contract; both get the same treatment. The scope boundary matters: anything upstream of the contract is out of ACDL's concern. The leadership takeaway: we expand who can ship safely without lowering the bar.
|
||||
|
||||
---
|
||||
|
||||
## Slide 3 — The Contract — The Entire Consumer Surface
|
||||
|
||||
Now let's look at what a consumer actually writes — it's tiny.
|
||||
## Slide 3 — Three things. The entire consumer surface.
|
||||
|
||||
Three things. That is the entire consumer-side surface.
|
||||
|
||||
1. **App code** — the consumer's service, at the top level of the repo
|
||||
2. **A contract** — a single YAML file: id, name, environment, infrastructure
|
||||
3. **A one-line CI definition** — a thin `uses:` wrapper pointing at a versioned platform workflow
|
||||
|
||||
```yaml
|
||||
id: msvc
|
||||
name: microservice
|
||||
@@ -84,53 +72,166 @@ infrastructure:
|
||||
port: 8080
|
||||
```
|
||||
|
||||
The developer does **not**:
|
||||
1. **App code** — the consumer's service, at the top level of the repo
|
||||
2. **A contract** — a single YAML file: id, name, environment, infrastructure
|
||||
3. **A one-line CI definition** — a thin `uses:` wrapper pointing at a versioned platform workflow
|
||||
|
||||
- Write infrastructure modules.
|
||||
- Author workflow YAML beyond the one-line `uses:` wrapper.
|
||||
- Clone the platform repo.
|
||||
- Hold cloud credentials.
|
||||
- Maintain a state backend, a VPC, or a runner.
|
||||
The developer does **not**: write infrastructure modules, clone the platform repo, hold cloud credentials, or maintain a state backend.
|
||||
|
||||
> **Speaker notes:** Hold this slide. The audience should sit with how small the consumer surface is. Every item in the "does not" list is a category of toil the platform removes. The contract is the API — deliberately tiny so that it can be reviewed, validated, and audited. For the Head of DevOps: this is the lever for throughput — the bottleneck moves off the platform team's ticket queue.
|
||||
|
||||
---
|
||||
|
||||
## Slide 4 — The Developer Feedback Loop
|
||||
|
||||
Once you push, here's what you see — in real time, in your own logs.
|
||||
## Slide 4 — See what the platform does, in real time
|
||||
|
||||
Developers see **what the platform is doing**, in real time. <span class="badge testing">Testing</span>
|
||||
|
||||
- **Streamed output by default** — the infrastructure plan, policy-check results, and each check record flow to stdout.
|
||||
- **PR comments after every successful pipeline stage** — a developer always knows where they stand without refreshing a dashboard.
|
||||
- **Streamed output by default** — the plan, policy-check results, and each check record flow to stdout.
|
||||
- **PR comments after every successful pipeline stage** — a developer always knows where they stand.
|
||||
- **Clear, explainable halt reasons** — a policy violation, an insufficient confidence signal, or a missing attestation. **Never an opaque debugging exercise.**
|
||||
- **Connection strings posted as PR comments** — human-readable, no hunting. Runtime secrets go to encrypted Parameter Store (KMS-encrypted, namespaced), never to logs.
|
||||
- **Errors become GitHub issues, automatically** — a failed deploy opens an issue on the platform repo. The consumer's only grant is the onboarding-granted Lambda-invoke permission — no separate `issues: write` scope on the consumer side.
|
||||
- **Errors become GitHub issues, automatically** — a failed deploy opens an issue on the platform repo.
|
||||
|
||||
> **Speaker notes:** This directly answers "but developers hate platforms that hide what they're doing." The platform is opinionated about *what* runs, not *opaque* about *that* it runs. The PR-comment-after-each-stage pattern is a small thing that compounds into trust. The "errors become issues" point is a DX win that also helps the platform team — every consumer failure is a tracked, queryable artifact, not a lost log line. The Head of DevOps should hear: the platform closes the feedback loop, it doesn't just push a green/red status.
|
||||
> **Speaker notes:** This directly answers "but developers hate platforms that hide what they're doing." The platform is opinionated about *what* runs, not *opaque* about *that* it runs. The PR-comment-after-each-stage pattern is a small thing that compounds into trust. The "errors become issues" point is a DX win that also helps the platform team — every consumer failure is a tracked, queryable artifact, not a lost log line.
|
||||
|
||||
---
|
||||
|
||||
## Slide 5 — Versioned, Predictable Releases
|
||||
## Slide 5 — Pick from pre-built, security-reviewed blocks
|
||||
|
||||
You control when you absorb platform improvements — no surprise upgrades.
|
||||
Developers pick from **pre-built, security-reviewed building blocks.** <span class="badge testing">Testing</span>
|
||||
|
||||
```mermaid
|
||||
flowchart LR
|
||||
subgraph PRIM ["Primitives"]
|
||||
direction TB
|
||||
P1["S3"]
|
||||
P2["VPC"]
|
||||
P3["ECS"]
|
||||
P4["IAM"]
|
||||
P5["ALB"]
|
||||
P6["ECR"]
|
||||
P7["CloudFront"]
|
||||
P8["WAF"]
|
||||
P9["RDS"]
|
||||
end
|
||||
subgraph MOD ["Modules — composed patterns"]
|
||||
direction TB
|
||||
M1["Static site\nCDN + WAF + S3"]
|
||||
M2["Microservice\nVPC + ECS + ALB + ECR"]
|
||||
end
|
||||
PRIM --> MOD
|
||||
```
|
||||
|
||||
- **Primitives** — single-purpose resources (S3, VPC, ECS, IAM, ALB, ECR, CloudFront, WAF, RDS), each with documented inputs/outputs and versioning.
|
||||
- **Modules** — composed patterns (a static site with CDN + WAF; a microservice with VPC + ECS + ALB + ECR).
|
||||
- **Validated examples per module** — `simple.yaml` + `complex.yaml`, validated against the contract schema in CI. Examples cannot drift from the schema silently.
|
||||
- **Auto-promotion of patterns** — auto-promoted to the catalog after 3 observed usages. <span class="badge planned">Planned</span> <span class="badge agentic">Agentic</span>
|
||||
- **Compliance extension points** — each module lists where GDPR, SOX, SOC2, DORA controls will wire in. <span class="badge planned">Planned</span>
|
||||
|
||||
> **Speaker notes:** The catalog is what makes "declare intent" practical — you can only declare a module that exists. For leadership: the catalog is the leverage. One well-reviewed module serves every consumer; a fix to the module serves every consumer on the next run. This is the compounding asset.
|
||||
|
||||
---
|
||||
|
||||
## Slide 6 — The bar rises automatically with sensitivity
|
||||
|
||||
The contract is environment-agnostic. The platform raises the bar automatically.
|
||||
|
||||
```mermaid
|
||||
flowchart LR
|
||||
DEV["dev<br/>autonomous"] -->|raise the bar| QA["qa<br/>QA attests"]
|
||||
QA -->|raise the bar| PROD["prod<br/>SRE attests"]
|
||||
PROD -->|raise the bar| DR["dr<br/>SRE attests + DR drill"]
|
||||
```
|
||||
|
||||
| Environment | What the platform adds | Maturity |
|
||||
|---|---|---|
|
||||
| dev | Confidence ≥ 0.50, fully autonomous | <span class="badge testing">Testing</span> |
|
||||
| qa | QA human attestation + confidence ≥ 0.75 | <span class="badge planned">Planned</span> |
|
||||
| prod | SRE human attestation + confidence ≥ 0.90 | <span class="badge planned">Planned</span> |
|
||||
| dr | SRE human attestation + confidence ≥ 0.95 + DR drill reference | <span class="badge planned">Planned</span> |
|
||||
|
||||
- **No staging environment** — the design deliberately removes the "staging is basically prod but not really" anti-pattern.
|
||||
- **Separation of duties is enforced** — the QA approver cannot be the prod approver.
|
||||
- **Timeout discipline** — 1 business day = warn + escalate; 2 business days = auto-freeze + re-submit.
|
||||
|
||||
> **Speaker notes:** Promotion is a workflow choice, not a contract mutation — this matters because it means a promotion can be reviewed as a *diff in the workflow*, not as a rewritten contract. The DX win: the contract stays stable across environments; the safety win: the platform raises the threshold and attestation bar automatically based on the target environment. The consumer can't bypass the gates — they pick *which* environment to target, and the platform applies the right bar. Be honest about maturity: dev is tested and pilot-ready; qa/prod/dr wiring is planned.
|
||||
|
||||
---
|
||||
|
||||
## Slide 7 — Tearing down is as gated as deploying
|
||||
|
||||
Tearing down a stack is **as deliberate as deploying one.** <span class="badge testing">Testing</span>
|
||||
|
||||
```mermaid
|
||||
flowchart LR
|
||||
A["Validate CR\n(CMDB)"]
|
||||
B["Disable\nprevent_destroy"]
|
||||
C["SRE\napprove"]
|
||||
D["Zero counts\n+ destroy"]
|
||||
E["SRE\napprove"]
|
||||
F["Key enters\ngrace window"]
|
||||
A --> B --> C --> D --> E --> F
|
||||
```
|
||||
|
||||
```yaml
|
||||
uses: acdl/.github/workflows/deploy.yml@v1.12
|
||||
with:
|
||||
contract: .acdl/contract.yml
|
||||
mode: decommission
|
||||
changeRequestId: "CHG0678912"
|
||||
```
|
||||
|
||||
A 2-step pipeline with **two SRE human-attestation gates**:
|
||||
|
||||
1. **Validate the change request** — the platform queries the CMDB and asserts the CR is `approved` and matches the consumer repo. No CR, no decommission.
|
||||
2. **Disable deletion protection** → **SRE approves** → **Zero all counts + destroy** → **a second SRE approves.**
|
||||
|
||||
The per-stack encryption key enters a **grace window** (default 30 days) so encrypted data remains recoverable.
|
||||
|
||||
> **Speaker notes:** The counter-argument to "deletion protection makes cleanup impossible" is this slide. Decommission is a first-class, gated, two-approval flow — not a lock with no key, and not an ungated `terraform destroy`. For the Head of Infrastructure: the CMDB validation means decommission is auditable, not just possible.
|
||||
|
||||
---
|
||||
|
||||
## Slide 8 — You control when you absorb improvements
|
||||
|
||||
Consumers control **when** they absorb platform improvements. <span class="badge testing">Testing</span>
|
||||
|
||||
- **Floating MAJOR + MINOR tags** (e.g. `@v1.12`) — a consumer automatically receives patch updates within the line.
|
||||
```mermaid
|
||||
flowchart LR
|
||||
subgraph FLOAT ["@v1.12 — floating MAJOR+MINOR"]
|
||||
direction LR
|
||||
F1["v1.12.0"]
|
||||
F2["v1.12.1"]
|
||||
F3["v1.12.2"]
|
||||
F1 --> F2 --> F3
|
||||
end
|
||||
subgraph PIN ["@v1.12.2 — pinned exact"]
|
||||
direction LR
|
||||
P1["v1.12.2"]
|
||||
P2["v1.12.2"]
|
||||
P3["v1.12.2"]
|
||||
P1 --> P2 --> P3
|
||||
end
|
||||
subgraph MAJ ["@v1 — float MAJOR only"]
|
||||
direction LR
|
||||
M1["v1.12.0"]
|
||||
M2["v1.13.0"]
|
||||
M3["v1.14.0"]
|
||||
M1 --> M2 --> M3
|
||||
end
|
||||
```
|
||||
|
||||
- **Floating MAJOR + MINOR tags** (e.g. `@v1.12`) — automatically receive patch updates within the line.
|
||||
- **Semantic versioning with a clear contract:** interface → MAJOR, behavior → MINOR, lifecycle → PATCH.
|
||||
- **A consumer can pin to an exact version** for maximum stability, or float on MAJOR only (`@v1`) to absorb new features on their own cadence.
|
||||
- **Unversioned references (`@main`, bare) are discouraged** — the versioned tag is the only immutability lever a consumer has.
|
||||
- **Pin to an exact version** for maximum stability, or float on MAJOR only (`@v1`) to absorb new features on your own cadence.
|
||||
- **Unversioned references (`@main`, bare) are discouraged** — the versioned tag is the only immutability lever.
|
||||
- **Automated release job** computes the next semver on merge to main, creates the tag, and updates the floating tags.
|
||||
|
||||
> **Speaker notes:** This is the "no surprise upgrades" story. Leadership hears two things: (1) consumers aren't forced to chase the platform, (2) the platform isn't forced to support N forks of every workflow. The versioning discipline is what makes both true.
|
||||
|
||||
---
|
||||
|
||||
## Slide 6 — Friendly Onboarding
|
||||
|
||||
First impressions matter — the platform fails gracefully, not opaquely.
|
||||
## Slide 9 — Fails gracefully, not opaquely
|
||||
|
||||
First impressions of a platform are made **when it fails for the first time.** The platform fails gracefully. <span class="badge testing">Testing</span>
|
||||
|
||||
@@ -149,114 +250,15 @@ The pipeline then **exits without attempting a deployment** — no partial state
|
||||
|
||||
---
|
||||
|
||||
## Slide 7 — Safe Promotion Path
|
||||
## Slide 10 — The desired outcomes
|
||||
|
||||
Promotion is a workflow choice, not a contract edit — and the bar rises automatically.
|
||||
|
||||
The contract is environment-agnostic. The platform raises the bar automatically.
|
||||
|
||||
```mermaid
|
||||
flowchart LR
|
||||
DEV["dev<br/>autonomous"] -->|raise the bar| QA["qa<br/>QA attests"]
|
||||
QA -->|raise the bar| PROD["prod<br/>SRE attests"]
|
||||
PROD -->|raise the bar| DR["dr<br/>SRE attests + DR drill"]
|
||||
```
|
||||
|
||||
**Approach A — One contract, one job per environment.** A single contract is referenced by multiple jobs; the environment is passed by each job and interpolated at runtime. The contract itself never changes.
|
||||
|
||||
```yaml
|
||||
jobs:
|
||||
dev:
|
||||
uses: acdl/.github/workflows/deploy.yml@v1.12
|
||||
with: { contract: .acdl/contract.yml, environment: dev }
|
||||
qa:
|
||||
needs: dev
|
||||
uses: acdl/.github/workflows/deploy.yml@v1.12
|
||||
with: { contract: .acdl/contract.yml, environment: qa }
|
||||
```
|
||||
|
||||
**Approach B — Environment-specific contracts.** When inputs genuinely differ per environment, each job points at its own contract file. The pipeline, policy, and confidence model stay identical.
|
||||
|
||||
```yaml
|
||||
jobs:
|
||||
dev:
|
||||
uses: acdl/.github/workflows/deploy.yml@v1.12
|
||||
with: { contract: .acdl/contract-dev.yaml }
|
||||
qa:
|
||||
needs: dev
|
||||
uses: acdl/.github/workflows/deploy.yml@v1.12
|
||||
with: { contract: .acdl/contract-qa.yaml }
|
||||
```
|
||||
|
||||
Whichever approach a team picks, the platform applies the same rising bar:
|
||||
|
||||
| Environment | What the platform adds | Maturity |
|
||||
|---|---|---|
|
||||
| dev | Confidence ≥ 0.50, fully autonomous | <span class="badge testing">Testing</span> |
|
||||
| qa | QA human attestation + confidence ≥ 0.75 | <span class="badge planned">Planned</span> |
|
||||
| prod | SRE human attestation + confidence ≥ 0.90 | <span class="badge planned">Planned</span> |
|
||||
| dr | SRE human attestation + confidence ≥ 0.95 + a disaster-recovery drill reference | <span class="badge planned">Planned</span> |
|
||||
|
||||
- **No staging environment** — the design deliberately removes the "staging is basically prod but not really" anti-pattern. Dev is the only autonomous environment.
|
||||
- **Separation of duties is enforced** — the QA approver cannot be the prod approver.
|
||||
- **Timeout discipline** — 1 business day = warn + escalate; 2 business days = auto-freeze + re-submit.
|
||||
|
||||
> **Speaker notes:** Promotion is a workflow choice, not a contract mutation — this matters because it means a promotion can be reviewed as a *diff in the workflow*, not as a rewritten contract. Approach A keeps the single source of truth; Approach B lets teams whose inputs genuinely vary keep that variation explicit and reviewable. For leadership: the DX win is that the contract stays stable across environments; the safety win is that the platform raises the threshold and attestation bar automatically based on the target environment the job declares. The consumer can't bypass the gates — they pick *which* environment to target, and the platform applies the right bar. Be honest about maturity: dev is tested and pilot-ready; qa/prod/dr wiring is planned.
|
||||
|
||||
---
|
||||
|
||||
## Slide 8 — Safe Decommission
|
||||
|
||||
Tearing down is as deliberate as deploying — and just as gated.
|
||||
|
||||
Tearing down a stack is **as deliberate as deploying one.** <span class="badge testing">Testing</span>
|
||||
|
||||
```yaml
|
||||
uses: acdl/.github/workflows/deploy.yml@v1.12
|
||||
with:
|
||||
contract: .acdl/contract.yml
|
||||
mode: decommission
|
||||
changeRequestId: "CHG0678912"
|
||||
```
|
||||
|
||||
A 2-step pipeline with **two SRE human-attestation gates**:
|
||||
|
||||
1. **Validate the change request** — the platform queries the CMDB and asserts the CR is `approved` and matches the consumer repo. No CR, no decommission.
|
||||
2. **Disable deletion protection** → **SRE approves** → **Zero all counts + destroy** → **a second SRE approves.**
|
||||
|
||||
The per-stack encryption key enters a **grace window** (default 30 days) so encrypted data remains recoverable. The key is permanently deleted only after the window expires.
|
||||
|
||||
> **Speaker notes:** The counter-argument to "deletion protection makes cleanup impossible" is this slide. Decommission is a first-class, gated, two-approval flow — not a lock with no key, and not an ungated `terraform destroy`. For the Head of Infrastructure: the CMDB validation means decommission is auditable, not just possible.
|
||||
|
||||
---
|
||||
|
||||
## Slide 9 — Self-Service Module Catalog
|
||||
|
||||
You don't author infrastructure — you pick from pre-built, security-reviewed building blocks.
|
||||
|
||||
Developers pick from **pre-built, security-reviewed building blocks.** <span class="badge testing">Testing</span>
|
||||
|
||||
- **Primitives** — single-purpose resources (S3, VPC, ECS, IAM, load balancer, container registry, CloudFront, WAF, RDS). Each has documented inputs/outputs, usage, compliance extension points, and versioning.
|
||||
- **Modules** — composed patterns (a static site with CDN + WAF; a microservice with VPC + ECS + load balancer + registry).
|
||||
- **Validated examples per module** — `simple.yaml` + `complex.yaml` + variation files, validated against the contract schema in CI. Examples cannot drift from the schema silently.
|
||||
- **Auto-promotion of patterns** — auto-promoted to the catalog after 3 observed usages. <span class="badge planned">Planned</span> <span class="badge agentic">Agentic</span>
|
||||
- **Compliance extension points** — each module lists where GDPR, SOX, SOC2, DORA controls will wire in. <span class="badge planned">Planned</span>
|
||||
|
||||
> **Speaker notes:** The catalog is what makes "declare intent" practical — you can only declare a module that exists. For leadership: the catalog is the leverage. One well-reviewed module serves every consumer; a fix to the module serves every consumer on the next run. This is the compounding asset.
|
||||
|
||||
---
|
||||
|
||||
## Slide 10 — The Desired Outcomes
|
||||
|
||||
Here's what this delivers to the organization.
|
||||
|
||||
- **Velocity without sacrificing safety.** Speed is in the ergonomics (a simple contract, a one-line `uses:`); safety is in the gates the consumer cannot bypass.
|
||||
- **Security, observability, and compliance as platform defaults** — not per-team effort, not post-hoc remediation. Encryption, deletion protection, uptime monitoring, policy checks, and evidence are on by construction.
|
||||
- **Auditability as a byproduct, not a project.** Every production change is traceable to a human attestation and a tamper-evident evidence event — captured during the deploy, not reconstructed for the audit.
|
||||
- **Blast radius contained by design.** Zero-trust OIDC + ABAC means a consumer can only touch its own tagged resources. One consumer can never affect another.
|
||||
- **The bottleneck moves off the platform team's ticket queue.** A merged change progresses through lower environments without a platform engineer joining a thread. The platform team invests in the platform, not in per-deployment hand-holding.
|
||||
- **Infrastructure as a utility, not a craft.** Teams consume infrastructure, they don't maintain it — and the platform compounds value over time by learning from recurring patterns.
|
||||
- **A path to the citizen developer.** The same safety envelope that serves a senior engineer will serve a non-technical consumer. <span class="badge agentic">Agentic</span>
|
||||
- **Velocity without sacrificing safety.** Speed is in the ergonomics; safety is in the gates the consumer cannot bypass.
|
||||
- **Security, observability, and compliance as platform defaults** — not per-team effort, not post-hoc remediation.
|
||||
- **Auditability as a byproduct, not a project.** Every production change is traceable to a human attestation and a tamper-evident evidence event.
|
||||
- **Blast radius contained by design.** Zero-trust OIDC + ABAC means a consumer can only touch its own tagged resources.
|
||||
- **The bottleneck moves off the platform team's ticket queue.** A merged change progresses through lower environments without a platform engineer joining a thread.
|
||||
- **Infrastructure as a utility, not a craft.** Teams consume infrastructure, they don't maintain it.
|
||||
- **A path to the citizen developer.** The same safety envelope serves a senior engineer and a non-technical consumer. <span class="badge agentic">Agentic</span>
|
||||
|
||||
> **Speaker notes:** Close on the strategic frame. The platform is not "a CI/CD tool" — it is the organizational lever for shipping safely at the pace the business demands, with the security and audit posture the regulators require. Invite questions; the companion deck ("How the Platform Works") covers the internal mechanics in more depth.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user