diff --git a/.ciagent/CLARIFY.md b/.ciagent/CLARIFY.md index 232c080..6134e1b 100644 --- a/.ciagent/CLARIFY.md +++ b/.ciagent/CLARIFY.md @@ -51,11 +51,12 @@ python-pptx → `*-python.pptx`; Step 5 stage all. The inline step runs only on the HTML (not the PPTX — both PPTX formats embed media in their zip by construction). -## C6 — "penetrate" absence test scope (conf 0.95) -**Ambiguity:** How is "penetrate" absence asserted? -**Resolution:** `grep -ri penetrat docs/presentations/` returns nothing -(covers `.md`, `-marp.md`, `talking-points.md`, `.html`; `.pptx` is -binary so excluded). A new test `test_no_penetrate_term` asserts this. +## C6 — absence-of-loaded-term test scope (conf 0.95) +**Ambiguity:** How is absence of the purged loaded term asserted? +**Resolution:** A grep for the purged term's stem across +`docs/presentations/` returns nothing (covers `.md`, `-marp.md`, +`talking-points.md`, `.html`; `.pptx` is binary so excluded). A new test +`test_no_purged_loaded_term` asserts this. ## C7 — attach_release_asset.py dual-PPTX (conf 0.85) **Ambiguity:** Does the release attach both PPTX files? diff --git a/.ciagent/NORTH_STAR.md b/.ciagent/NORTH_STAR.md index 524fad2..622dd62 100644 --- a/.ciagent/NORTH_STAR.md +++ b/.ciagent/NORTH_STAR.md @@ -93,7 +93,7 @@ deploy — not a vendor arriving late to that market. 3. **Not an upstream development platform.** Nova does not own the product backlog, IDE workflows, code authorship, or application business logic. The PDLC is upstream; Nova integrates with it through - a validated contract boundary — Nova never penetrates it. + a validated contract boundary — Nova never reaches into it. 4. **Not a replacement for the Product Development Lifecycle (PDLC).** Nova governs infrastructure + delivery only. Product lifecycle decisions (what to build, when to ship, for whom) remain with the diff --git a/.ciagent/PROJECT.md b/.ciagent/PROJECT.md index d8251b9..be9114e 100644 --- a/.ciagent/PROJECT.md +++ b/.ciagent/PROJECT.md @@ -33,7 +33,7 @@ traceable to a human attestation and an immutable evidence stream. 1. **Operations are Declared, Not Executed.** Consumers define what they need; the platform reconciles, provisions, and progresses. 2. **The Delivery Lifecycle is a Sovereign Boundary.** The platform - governs infra and delivery; it does not penetrate upstream product/SDLC. + governs infra and delivery; it does not reach into upstream product/SDLC. Integration is only through validated, published contracts. 3. **Lower Environments are Autonomous; Higher Environments are Attested.** Dev = zero-touch agentic. QA/prod/dr = deliberate human attestation, not @@ -66,7 +66,7 @@ traceable to a human attestation and an immutable evidence stream. The **Product Development Lifecycle (PDLC)** — product backlog, code authorship, IDE workflows, sprint planning, application business logic — -is **upstream** of Nova. Nova never penetrates the PDLC. Nova's domain is +is **upstream** of Nova. Nova never reaches into the PDLC. Nova's domain is **infrastructure + delivery only**: environment progression, cloud resource lifecycle, operational security/observability NFRs, policy enforcement, immutable audit lineage, and the two consumer surfaces @@ -711,7 +711,7 @@ is acceptable to start**. Five user-directed inputs drive the milestone: `sp-theme.json` survived; only the Marp CSS theme was lost. 2. **PDLC-upstream scope made explicit.** Core Tenet #2 already states the - platform "does not penetrate upstream product/SDLC" and Anti-Goal #1 says + platform "does not reach into upstream product/SDLC" and Anti-Goal #1 says "Not an upstream development platform." v1.18 promotes this from a buried tenet to a dedicated, unmissable scope statement in PROJECT.md + `docs/scope.md` + a deck slide: **the PDLC (Product Development @@ -1559,7 +1559,7 @@ fragile). The milestone delivers: redistribution. - **Parallel python-pptx generator** — structured, editable, S&P-themed PPTX alongside the MARP image-of-slide PPTX. -- **Targeted word-count trim** + "penetrate" term removal. +- **Targeted word-count trim** + removal of the previously-used loaded scope term. **Phase count:** 7 (P0 pre-execution + 5 execution + 1 final). @@ -1576,4 +1576,4 @@ fragile). The milestone delivers: New requirements REQ-263..REQ-275 — see `REQUIREMENTS.md` §v1.23. Summary: consolidation (REQ-263,264), style restoration (REQ-265,266,267), image inlining (REQ-268), python-pptx generator (REQ-269,270), word-count -trim + "penetrate" removal (REQ-271,272), CI/tests/README (REQ-273,274,275). +trim + loaded-scope-term removal (REQ-271,272), CI/tests/README (REQ-273,274,275). diff --git a/docs/presentations/nova-autonomous-cloud-delivery-marp.md b/docs/presentations/nova-autonomous-cloud-delivery-marp.md index 74ef110..1c745a3 100644 --- a/docs/presentations/nova-autonomous-cloud-delivery-marp.md +++ b/docs/presentations/nova-autonomous-cloud-delivery-marp.md @@ -41,14 +41,12 @@ Product Development & Citizen Developer Overview **Product teams now own their cloud infrastructure — but ownership without discipline is destroying value.** -- **No lifecycle planning.** Resources are authored for creation, not for patching, decommissioning, or rollback — so changes are destructive. -- **Proactive scanning is not part of authoring.** AI-frontier models exploit zero-days at a rapid pace; teams cannot keep up by reacting. Modules must be scanned as code and at runtime — and remediated at the pace the threat moves. -- **Bandwidth gaps in infrastructure operations.** Time spent on remediation + the push for innovation leaves operations chronically under-resourced; detections are missed, incidents grow. -- **Tribal knowledge and the rockstar-operator problem.** Operations depend on a handful of administrators; when they leave, the knowledge leaves with them. The platform should encode the discipline, not the person. +- **No lifecycle planning.** Resources are authored for creation, not for patching or rollback — so changes are destructive. +- **No proactive scanning in authoring.** AI-frontier models exploit zero-days faster than teams can react; modules must be scanned as code and at runtime, remediated at threat pace. +- **Bandwidth gaps.** Remediation plus the push for innovation leaves operations under-resourced; detections are missed, incidents grow. +- **Tribal knowledge.** Operations depend on a few administrators; when they leave, the knowledge leaves with them. The platform should encode the discipline, not the person. -Every hour a developer spends writing, deploying, fixing, or remediating infrastructure is an hour not spent releasing features to production. - -
the answer is an autonomous cloud delivery platform that encodes discipline as policy, scans proactively, remediates rapidly, and makes operations visible to leadership rather than hidden in tribal knowledge.
+
an autonomous cloud delivery platform that encodes discipline as policy, scans proactively, remediates rapidly, and makes operations visible to leadership.
@@ -106,18 +104,17 @@ Every hour a developer spends writing, deploying, fixing, or remediating infrast ## Slide 5 — Scope: Downstream of PDLC -**Nova governs infrastructure and delivery. The PDLC is upstream — Nova never penetrates it. Integration is through one validated contract.** +**Nova governs infrastructure and delivery. The PDLC is upstream — Nova stays downstream of it. Integration is through one validated contract.** -- **The PDLC is upstream:** product backlog, code authorship (AI agent, IDE, agentic SDLC), sprint planning, application business logic +- **The PDLC is upstream** — product backlog, code authorship (AI agent, IDE, agentic SDLC), sprint planning, application business logic. Nova stays downstream of it. - **Nova is downstream:** contract ingestion → submission-readiness gate → policy enforcement → cloud resource lifecycle → environment progression (dev → qa → prod → dr) → immutable audit + attestation -- **The integration point is one contract** — any upstream source (AI agent, agentic SDLC, dev platform) produces submissions subject to the same compliance standards -- **Nova validates the submission, not the author** — the audit trail, the policy envelope, and the evidence stream are the same regardless of source +- **One validated contract** — any upstream source (AI agent, agentic SDLC, dev platform) produces submissions subject to the same compliance standards; Nova validates the submission, not the author -
a clean scope boundary — Nova is purpose-built for infrastructure operations and integrates with any upstream source through one validated contract, so the platform team's surface area stays bounded.
+
a clean scope boundary — Nova is purpose-built for infrastructure operations and integrates with any upstream source through one contract, so the platform team's surface area stays bounded.
- + --- @@ -152,9 +149,9 @@ Every hour a developer spends writing, deploying, fixing, or remediating infrast ![h:480 class:tall](assets/png/platform-pipeline.png) -- **Contract → resolver → adapter → Checkov on static code (before plan) → terraform plan → Wiz on the plan → confidence signal → stage gate → apply → evidence + ledger** +- **The pipeline** — see the diagram; two scan stages (static code, then resolved plan) feed a confidence signal to the stage gate before apply + evidence + ledger - **Fail-fast, quick feedback** — Checkov runs on the authored Terraform code before `terraform plan` so developers get immediate policy feedback -- **Wiz on the plan when configured; Checkov as a drop-in otherwise** — Wiz scans the plan output; when Wiz credentials are absent, Checkov runs against the plan. **Wiz and Checkov are never both run on the plan.** +- **Wiz on the plan when configured; Checkov as a drop-in otherwise** — Wiz scans the plan output; when Wiz credentials are absent, Checkov runs against the plan instead. **Wiz and Checkov are never both run on the plan.**
two layers of scanning, zero operator involvement in normal operations — fast deterministic feedback at authoring time and a runtime scan on the resolved plan.
@@ -169,7 +166,7 @@ Every hour a developer spends writing, deploying, fixing, or remediating infrast **Every automated decision is captured, immutable, queryable — and accountable.** - **What is captured:** the chosen action, the confidence score, the alternatives considered, whether a human overrode it, and the outcome (backfilled once the apply completes). Every stage-gate attestation (QA, SRE) is captured with approver identity and the evidence presented. -- **"AI decisions" are really automated decisions** — made by deterministic scripts that calculate a score and a band; the platform functions without AI. When an LLM planner is added later, it will emit richer alternatives without breaking the schema. +- **"AI decisions" are really automated decisions** — deterministic scripts calculate a score and a band; the platform functions without AI, and a later LLM planner emits richer alternatives without breaking the schema. - **The value is accountability, not the storage engine** — the ledger is append-only and tamper-evident; every decision is queryable for auditing, traceable to an outcome, and impossible to rewrite after the fact.
"autonomous" is defensible because every decision is immutable, queryable, and accountable — and the audience knows exactly what "automated" means here: deterministic scoring, not a black-box LLM.
@@ -265,7 +262,7 @@ Separation-of-duties on prod: the approver cannot be the same person who built t - **The ROI formula:** `Platform ROI = (FTE hours saved × blended rate + cloud savings + avoided downtime) ÷ platform op cost` - **The four CTO-grade metrics are the ROI proof:** Lead Time (PR → Prod), Infrastructure Vulnerability Count (trend), MTTR, Cloud Spend Reduction — all flow into PowerBI -- **Honest caveat:** derived metrics are computed on internal runs today; the production-denominator activates when a pilot estate runs. The formula is grounded; the production numbers are not yet. +- **Honest caveat:** derived metrics run on internal data today; the production-denominator activates with a pilot estate.
the ROI is not a black box — the formula is shown, the four metrics are committed, and the production-denominator caveat is stated up front. The CFO sees exactly what is real today and what activates with a pilot.
@@ -279,7 +276,7 @@ Separation-of-duties on prod: the approver cannot be the same person who built t **Honesty about what is not measured yet — and the blocking work for each.** -To be clear: these deferrals are *measurement infrastructure*, not the autonomy itself. The platform runs without an operator in the loop of normal operations. What is deferred is the evidence pipeline for certain metrics — not the autonomy. +These deferrals are measurement infrastructure, not the autonomy itself — the platform runs without an operator in normal operations. | # | Deferred metric | Blocking work | |---|-----------------|---------------| @@ -403,7 +400,7 @@ Grounded in the four strategic objectives (autonomy, provable trust, ROI, integr - **Proof:** 100% ledger coverage, 100% attestation coverage, grounded ROI formula, four CTO-grade metrics flowing into PowerBI - **Roadmap:** deferred metrics have unblock paths; the 12-month product arc activates one strategic objective per quarter -**The ask:** "Approve a pilot estate to activate the production-denominator metrics (Lead Time, Vulnerability Count, MTTR, Cloud Spend), and approve the tamper-evident ledger build-out to move from the local hash-chain to S3 Object Lock + signed checkpoints. These two decisions move Nova from 'pipeline-ready' to 'production-proven.'" +**The ask:** "Approve a pilot estate to activate the production-denominator metrics (Lead Time, Vulnerability Count, MTTR, Cloud Spend). Then approve the tamper-evident ledger build-out (S3 Object Lock + signed checkpoints). Together these move Nova from 'pipeline-ready' to 'production-proven.'"
a clear business decision — approve a pilot and the ledger build-out — with the confidence that every claim in this deck is grounded, derived, or honestly deferred.
diff --git a/docs/presentations/nova-autonomous-cloud-delivery-python.pptx b/docs/presentations/nova-autonomous-cloud-delivery-python.pptx index 44a7335..c4dcce7 100644 Binary files a/docs/presentations/nova-autonomous-cloud-delivery-python.pptx and b/docs/presentations/nova-autonomous-cloud-delivery-python.pptx differ diff --git a/docs/presentations/nova-autonomous-cloud-delivery-talking-points.md b/docs/presentations/nova-autonomous-cloud-delivery-talking-points.md index d462b75..ea0cf77 100644 --- a/docs/presentations/nova-autonomous-cloud-delivery-talking-points.md +++ b/docs/presentations/nova-autonomous-cloud-delivery-talking-points.md @@ -38,7 +38,7 @@ - **Key takeaway:** the boundaries are explicit — Nova is purpose-built for infra ops + delivery, not a general-purpose AI agent or an upstream dev platform ### Slide 5 — Scope: Downstream of PDLC -- Nova governs infra + delivery only; the PDLC (backlog, code authorship, IDE) is upstream — Nova never penetrates it +- Nova governs infra + delivery only; the PDLC (backlog, code authorship, IDE) is upstream — Nova stays downstream of it - Integration is only through the validated contract boundary - Any upstream source (AI agent, agentic SDLC, dev platform) produces submissions subject to the same compliance standards - Nova validates the submission, not the author diff --git a/docs/presentations/nova-autonomous-cloud-delivery.html b/docs/presentations/nova-autonomous-cloud-delivery.html index 9642cb5..1e1a9e0 100644 --- a/docs/presentations/nova-autonomous-cloud-delivery.html +++ b/docs/presentations/nova-autonomous-cloud-delivery.html @@ -94,13 +94,12 @@ section.title .benefit { color: #fff; }

Slide 1 — The Problem

Product teams now own their cloud infrastructure — but ownership without discipline is destroying value.

-

Every hour a developer spends writing, deploying, fixing, or remediating infrastructure is an hour not spent releasing features to production.

-
the answer is an autonomous cloud delivery platform that encodes discipline as policy, scans proactively, remediates rapidly, and makes operations visible to leadership rather than hidden in tribal knowledge.
+
an autonomous cloud delivery platform that encodes discipline as policy, scans proactively, remediates rapidly, and makes operations visible to leadership.

Slide 5 — Scope: Downstream of PDLC

-

Nova governs infrastructure and delivery. The PDLC is upstream — Nova never penetrates it. Integration is through one validated contract.

+

Nova governs infrastructure and delivery. The PDLC is upstream — Nova stays downstream of it. Integration is through one validated contract.

    -
  • The PDLC is upstream: product backlog, code authorship (AI agent, IDE, agentic SDLC), sprint planning, application business logic
    • +
  • The PDLC is upstream — product backlog, code authorship (AI agent, IDE, agentic SDLC), sprint planning, application business logic. Nova stays downstream of it.
  • Nova is downstream: contract ingestion → submission-readiness gate → policy enforcement → cloud resource lifecycle → environment progression (dev → qa → prod → dr) → immutable audit + attestation
    • -
  • The integration point is one contract — any upstream source (AI agent, agentic SDLC, dev platform) produces submissions subject to the same compliance standards
    • -
  • Nova validates the submission, not the author — the audit trail, the policy envelope, and the evidence stream are the same regardless of source
    • +
  • One validated contract — any upstream source (AI agent, agentic SDLC, dev platform) produces submissions subject to the same compliance standards; Nova validates the submission, not the author
-
a clean scope boundary — Nova is purpose-built for infrastructure operations and integrates with any upstream source through one validated contract, so the platform team's surface area stays bounded.
+
a clean scope boundary — Nova is purpose-built for infrastructure operations and integrates with any upstream source through one contract, so the platform team's surface area stays bounded.

    -
  • Contract → resolver → adapter → Checkov on static code (before plan) → terraform plan → Wiz on the plan → confidence signal → stage gate → apply → evidence + ledger
    • +
  • The pipeline — see the diagram; two scan stages (static code, then resolved plan) feed a confidence signal to the stage gate before apply + evidence + ledger
  • Fail-fast, quick feedback — Checkov runs on the authored Terraform code before terraform plan so developers get immediate policy feedback
    • -
  • Wiz on the plan when configured; Checkov as a drop-in otherwise — Wiz scans the plan output; when Wiz credentials are absent, Checkov runs against the plan. Wiz and Checkov are never both run on the plan.
    • +
  • Wiz on the plan when configured; Checkov as a drop-in otherwise — Wiz scans the plan output; when Wiz credentials are absent, Checkov runs against the plan instead. Wiz and Checkov are never both run on the plan.
two layers of scanning, zero operator involvement in normal operations — fast deterministic feedback at authoring time and a runtime scan on the resolved plan.
Nova — The Autonomous Cloud Delivery Platform
@@ -514,7 +512,7 @@ section.title .benefit { color: #fff; }

Every automated decision is captured, immutable, queryable — and accountable.

  • What is captured: the chosen action, the confidence score, the alternatives considered, whether a human overrode it, and the outcome (backfilled once the apply completes). Every stage-gate attestation (QA, SRE) is captured with approver identity and the evidence presented.
    • -
  • "AI decisions" are really automated decisions — made by deterministic scripts that calculate a score and a band; the platform functions without AI. When an LLM planner is added later, it will emit richer alternatives without breaking the schema.
    • +
  • "AI decisions" are really automated decisions — deterministic scripts calculate a score and a band; the platform functions without AI, and a later LLM planner emits richer alternatives without breaking the schema.
  • The value is accountability, not the storage engine — the ledger is append-only and tamper-evident; every decision is queryable for auditing, traceable to an outcome, and impossible to rewrite after the fact.
"autonomous" is defensible because every decision is immutable, queryable, and accountable — and the audience knows exactly what "automated" means here: deterministic scoring, not a black-box LLM.
@@ -839,7 +837,7 @@ section.title .benefit { color: #fff; }
  • The ROI formula:
    Platform ROI = (FTE hours saved × blended rate + cloud savings + avoided downtime) ÷ platform op cost
  • The four CTO-grade metrics are the ROI proof: Lead Time (PR → Prod), Infrastructure Vulnerability Count (trend), MTTR, Cloud Spend Reduction — all flow into PowerBI
    • -
  • Honest caveat: derived metrics are computed on internal runs today; the production-denominator activates when a pilot estate runs. The formula is grounded; the production numbers are not yet.
    • +
  • Honest caveat: derived metrics run on internal data today; the production-denominator activates with a pilot estate.
    • the ROI is not a black box — the formula is shown, the four metrics are committed, and the production-denominator caveat is stated up front. The CFO sees exactly what is real today and what activates with a pilot.
    Nova — The Autonomous Cloud Delivery Platform
    @@ -885,7 +883,7 @@ section.title .benefit { color: #fff; } ;" data-marpit-pagination-total="22">

    Slide 14 — What's Deferred — and Why

    Honesty about what is not measured yet — and the blocking work for each.

    -

    To be clear: these deferrals are measurement infrastructure, not the autonomy itself. The platform runs without an operator in the loop of normal operations. What is deferred is the evidence pipeline for certain metrics — not the autonomy.

    +

    These deferrals are measurement infrastructure, not the autonomy itself — the platform runs without an operator in normal operations.

    @@ -1318,7 +1316,7 @@ section.title .benefit { color: #fff; }
  • Proof: 100% ledger coverage, 100% attestation coverage, grounded ROI formula, four CTO-grade metrics flowing into PowerBI
  • Roadmap: deferred metrics have unblock paths; the 12-month product arc activates one strategic objective per quarter
    • -

    The ask: "Approve a pilot estate to activate the production-denominator metrics (Lead Time, Vulnerability Count, MTTR, Cloud Spend), and approve the tamper-evident ledger build-out to move from the local hash-chain to S3 Object Lock + signed checkpoints. These two decisions move Nova from 'pipeline-ready' to 'production-proven.'"

    +

    The ask: "Approve a pilot estate to activate the production-denominator metrics (Lead Time, Vulnerability Count, MTTR, Cloud Spend). Then approve the tamper-evident ledger build-out (S3 Object Lock + signed checkpoints). Together these move Nova from 'pipeline-ready' to 'production-proven.'"

    a clear business decision — approve a pilot and the ledger build-out — with the confidence that every claim in this deck is grounded, derived, or honestly deferred.
    Nova — The Autonomous Cloud Delivery Platform
    @@ -1442,5 +1440,5 @@ section.title .benefit { color: #fff; }
    Nova — The Autonomous Cloud Delivery Platform

    Speaker notes: Do not frame this as "humans are the problem." The problem is that ownership was granted without the discipline, tooling, and lifecycle planning that infrastructure requires. The operator is not the bottleneck because operators exist — the bottleneck is that operations depend on a few individuals instead of an encoded system.

    Transition: Here is the destination Nova is building toward.

    Talking points: Open with the shift: "you build it, you run it" put Terraform into product teams — ownership without discipline is destroying value; Land the lifecycle-planning gap: resources authored for creation, not for patching/rollback → destructive changes; Land the urgency: AI-era 0-day pace demands proactive scanning as code + at runtime, remediated at threat pace; Call out tribal knowledge / the rockstar-operator problem — the platform should encode the discipline, not the person; Do NOT frame this as "humans are the problem" — the problem is ownership without the discipline and tooling; Key takeaway: the problem is infrastructure ownership without discipline; the answer is an autonomous platform that encodes the discipline

    Speaker notes: "Visible" is the operative word. The vision is not just that operations run without an operator — it is that operations become observable, queryable, and accountable. That is what makes the trust defensible.

    Transition: The vision is ambitious — here are the strategic objectives that make it concrete, and the anti-goals that keep it focused.

    Talking points: Read the vision verbatim — "infrastructure operations become visible" is the operative phrase; Emphasize "provable, not promised" — trust established by deterministic scripts; the platform functions without AI; State the attestation model up front: QA for production, SRE for operational readiness; Key takeaway: autonomous operations with provable trust — security, remediation velocity, reliability, lead time made visible, not promised

    Speaker notes: Objective #2 is the one to land carefully: trust is established by deterministic scoring, not by an LLM. The platform functions without AI.

    Transition: The objectives are concrete — here is what Nova is NOT, to keep it focused.

    Talking points: Objective #1: zero-touch operations — autonomy as the default, not the demo; stage-gate attestation (QA, SRE) remains human by design; Objective #2 is the one to land carefully: trust = deterministic scoring, not an LLM; the platform functions without AI; Objective #3: four CTO-grade metrics (Lead Time, Vuln Count, MTTR, Spend) — all flow into PowerBI; Objective #4 is the integration thesis: Nova integrates with any upstream source; provides skills + MCP; all prod intents go through the same controls; Key takeaway: the scope is explicit — Nova governs infra + delivery, integrates with any source through one contract, measures success on four CTO metrics

    Speaker notes: Anti-goals #3 and #4 protect the scope boundary — Nova will not become an IDE or a product-planning tool.

    Transition: The scope boundary is explicit — here is exactly where Nova sits relative to the product development lifecycle.

    Talking points: Not a general-purpose AI agent platform; Not a system that removes humans from accountability — only from normal operations; Not an upstream development platform (no product backlogs, IDE, code authorship); Not a replacement for the Product Development Lifecycle (PDLC); Anti-goals #3 and #4 protect the scope boundary — Nova will not become an IDE or a product-planning tool; Key takeaway: the boundaries are explicit — Nova is purpose-built for infra ops + delivery, not a general-purpose AI agent or an upstream dev platform

    Speaker notes: This slide protects the scope. The moment Nova starts owning the PDLC, it loses focus. The contract boundary is what keeps Nova deep on infrastructure and delivery rather than shallow on everything.

    Transition: With the scope clear, here is who owns what across the delivery lifecycle.

    Talking points: Nova governs infra + delivery only; the PDLC (backlog, code authorship, IDE) is upstream — Nova never penetrates it; Integration is only through the validated contract boundary; Any upstream source (AI agent, agentic SDLC, dev platform) produces submissions subject to the same compliance standards; Nova validates the submission, not the author; Key takeaway: Nova is purpose-built for infrastructure operations; the scope boundary is clean and bounded

    Speaker notes: Quality attestation is now owned by Quality Engineering (not the Platform), and Production readiness is owned by SRE. The Platform runs the checks agentically but is never the Accountable party for the gate — that separation keeps the platform honest.

    Transition: With ownership clear, here is how the pipeline enforces it.

    Talking points: Four roles now: Citizen Developer, Platform, Quality Engineering, SRE; Quality attestation is owned by Quality Engineering (not the Platform); Production readiness is owned by SRE; The Platform runs the checks agentically but is never the Accountable party for the gate — that separation keeps the platform honest; Production readiness is co-owned: the platform runs attestations; the citizen developer authorizes the promotion at the stage gate; Key takeaway: you bring FRs + UAT; Nova provides NFRs + infra; QE guards the gate evidence; SRE signs off on production readiness

    Speaker notes: The two-stage scan is the key design: static code scanning catches policy violations before the cost of a plan; runtime plan scanning catches what the static code cannot (resolved values, cross-resource issues). The platform picks the runtime scanner based on configuration — never both, to avoid duplicate noise.

    Transition: The pipeline produces decisions — here is how every decision is captured and made accountable.

    Talking points: Walk the pipeline left-to-right: contract → resolver → adapter → Checkov (static) → plan → Wiz (on plan) → confidence → gate → apply; Two-stage scan: Checkov on static code BEFORE the plan (fail-fast dev feedback); Wiz on the plan (or Checkov as drop-in if no Wiz creds); Never both Wiz + Checkov on the plan — avoid duplicate noise; Dev is autonomous; qa/prod/dr require attestation (QA for quality, SRE for production readiness); Key takeaway: two layers of scanning, zero operator involvement in normal operations

    Speaker notes: Do not dwell on the storage substrate. The audience cares that the ledger is append-only, queryable, and tied to outcomes — not that it is a hash-chain in a SQLite file. The D-122 honesty point is restated without the decision ID: the platform's decisions are deterministic; the ledger captures that real path.

    Transition: Decisions are captured — here is how stage-gate attestation keeps humans in accountability.

    Talking points: "AI decisions" are really automated decisions — deterministic scripts calculate a score; the platform functions without AI; Do not dwell on the storage substrate — the value is accountability (immutable, queryable, traceable to outcome), not the database; Every stage-gate attestation is captured with approver identity and the evidence presented; When an LLM planner is added later, it emits richer alternatives without breaking the schema; Key takeaway: autonomous is defensible because every decision is immutable, queryable, accountable — and "automated" means deterministic scoring, not a black-box LLM

    Speaker notes: The matrix is not a rubber stamp. Each concern has a freshness window and a plain-language description of what is being attested. The "operator-supplied" label from the prior deck was dropped — every concern now has a plain-language description.

    Transition: QA is half the matrix — here are the production and DR controls.

    Talking points: The matrix is not a rubber stamp — structured, freshness-validated; Each concern now has a plain-language description of what is being attested (the old "operator-supplied" label is gone); Three QA concerns: functional correctness (24h), performance baseline (7d), security posture (24h); Each concern has a freshness window — evidence older than the window does not satisfy the gate; Key takeaway: QA signs off on quality before any promotion — the gate is explicit, not implicit

    Speaker notes: The prod/DR rows are the operational-readiness and resilience gates — SRE signs off on operability, incident response, capacity, and the three resilience checks (DR drill, chaos, backup). Separation-of-duties on prod is the rule that keeps the gate honest: the approver cannot be the same person who built the deployment.

    Transition: You've seen how Nova works — the pipeline, the ledger, the attestation gates. Here is how Nova instruments itself so that every claim in this deck is traceable to a real signal.

    Talking points: Seven prod/DR concerns: operational readiness, incident response, capacity & cost, DR drill, chaos, backup, DR region deploy; SRE signs off on operability (runbooks, dashboards, on-call), incident response, capacity, and the three resilience checks; Each concern has a freshness window — 30d/90d/180d depending on the control; SoD on prod: the approver can't be the same person who built it — the rule that keeps the gate honest; Key takeaway: autonomy in operations, human in accountability, by design — the matrix is what makes autonomous operations safe enough to trust in production

    Speaker notes: The value is not the plumbing — it is that the platform's metrics surface in a tool leadership already uses (PowerBI), and every number is traceable. The live-ops dashboard is where the "infrastructure operations become visible" theme lands concretely.

    Transition: The architecture is sound — here is the measured proof.

    Talking points: Deliberately minimal: Nova-native CloudEvents; no Kafka/Prometheus/ClickHouse; The live-ops dashboard is built in PowerBI on top of the exported views — leadership sees the same numbers the platform produces; Every number in the Proof slides is traceable to a signal — "where does this number come from?" → a query against the cold store; This is where the "infrastructure operations become visible" theme lands concretely; Key takeaway: the architecture is the trust substrate — operations become visible in PowerBI, with full traceability

    Speaker notes: The mandatory-by-design point is the one to land. The ledger + attestation are not a best-effort feature; they are a gate. No change reaches production without both. That is what makes the 100% numbers credible — they are enforced, not aspirational.

    Transition: Trust is provable — here is the cost side of the ROI.

    Talking points: Both 100% — no automated decision is ever lost; no prod/dr promotion lands without a human sign-off; The mandatory-by-design point: the ledger entry + the human attestation are a gate, not a best-effort feature; Easily queried: by run, by environment, by approver, by outcome — the audit trail is a query, not a forensic exercise; Key takeaway: trust is provable — not a marketing claim, a queryable record; no change to production without both the ledger entry and the human attestation

    Speaker notes: The formula is shown inline, not hidden. The "no fabrication" constraint in action: show the formula, show the caveat, do not pretend the production numbers exist.

    Transition: The proof is grounded — here is what is honestly deferred, and why.

    Talking points: The ROI formula is shown inline — not hidden in a footnote; The four CTO-grade metrics are the ROI proof — Lead Time, Vuln Count, MTTR, Cloud Spend; The N=0 caveat is stated explicitly: the formula is grounded; the production numbers activate with a pilot; Key takeaway: the ROI is not a black box — the formula is shown, the four metrics are committed, the production-denominator caveat is up front

    Speaker notes: The preempt is critical: these deferrals are measurement infrastructure, not autonomy. The platform runs without an operator in the loop. What is deferred is the evidence pipeline for live-infra health, drift, predictive remediation — not the autonomy itself.

    Transition: The proof is honest — here is the roadmap from here to the targets.

    Talking points: The preempt is critical: these deferrals are measurement infrastructure, not autonomy — the platform IS autonomous in operations; The blocking work is named in plain language (no decision IDs) — "live AWS re-provisioning", "drift-detection scheduler", "ML service"; Showing this to leadership demonstrates honesty, not weakness; Key takeaway: the autonomy is real; the measurement gaps are documented with the work that unblocks each one

    Speaker notes: This is the bridge from "honestly deferred" to "here is how we get there." The roadmap uses timeframes, not status — most of it is not implemented yet, so a status column would be noise.

    Transition: The unblock path is clear — here is the 12-month product arc.

    Talking points: Each deferred metric has an unblock path and a timeframe — near-term, mid-term, longer-term; No status column: most of it is not implemented yet, so status would be noise; Re-evaluation triggers: each blocking piece of work lifts on its own schedule; Key takeaway: every deferred metric has a plan and a timeframe — nothing is hand-waved

    Speaker notes: The roadmap is organized by product outcome, not by technical milestone. Each quarter activates one strategic objective from the North Star.

    Transition: Here is the quarter-by-quarter detail.

    Talking points: This is the *product* roadmap, forward-looking only; Q1 Pilot Activation → Q2 Provable Trust → Q3 Compounding ROI → Q4 Integration & Predictive; Each quarter activates one strategic objective from the North Star; Key takeaway: the 12-month product arc — each quarter activates a strategic objective and its board-level metric

    Speaker notes: Q1–Q3 are committed (grounded pipeline + known unblock paths). Q4 targets are committed-deliverable, aspirational-metric — the ML service ships, the intent-share number is a first measurement (we do not control adoption rate).

    Transition: Production-grade guidance is how Nova helps the citizen developer's AI agent meet the bar — here is the first half.

    Talking points: Q1: three post-pilot metrics go live (Touchless ≥99%, Escalation <0.1%, Accuracy ≥99.5%) — denominator activates with the pilot; Q2: Decision Ledger Coverage was already grounded — tamper-evidence is the Q2 upgrade (local hash-chain → Object Lock + signed checkpoints); Q3: Drift Auto-Reversal ≥95% unblocks when the drift scheduler ships; Spend Reduction ≥25% measured against the pilot baseline; Q4: Predictive:Reactive ≥3:1 requires the ML forecasting service; AI-Agent Intent Share is a first measurement (aspirational-metric); Key takeaway: each quarter has a concrete deliverable, a target metric grounded in a strategic objective, and a path from deferred to shipped

    Speaker notes: This is the first half of the Atelier story — the surface (skills + MCP). The next slide is what the surface catches that deterministic scanners cannot.

    Transition: Here is what that guidance catches that deterministic scanners cannot.

    Talking points: Nova instructs the citizen developer's AI agent via skills (markdown, keyed to engineering domains) + an MCP server (4 tools, plugin-registry, stdio); The integration point is the same regardless of source — AI agent, agentic SDLC, traditional IDE all get the same skills + MCP; This is how Nova makes the citizen developer production-grade without owning the PDLC; Key takeaway: the citizen developer's AI agent is not unguided — Nova provides engineering principles as skills + MCP

    Speaker notes: The value is the gap deterministic scanners leave: engineering discipline. Policy scanners catch "is this S3 bucket public?"; the MCP server catches "is this service observable if that bucket fails?". The vendoring point is audit reproducibility — the validation is not a black box.

    Transition: You've seen the problem, the solution, and the proof. Here is the recap and the ask.

    Talking points: The value is the gap deterministic scanners leave: engineering discipline (Wiz/Checkmarx/Mend check policy/secrets, not discipline); The MCP server catches "is this service observable?", "is this error path handled?", "is this API contract clear?"; Vendored at a pinned tag → audit reproducibility — a validation result is replayable months later; Key takeaway: submissions are checked for engineering discipline, not just policy compliance — and the check is reproducible for audit

    Speaker notes: The ask is a business decision, not insider language. "Approve a pilot estate" is a C-suite decision. "Approve the ledger build-out" is a budget decision. The recap reinforces the 4-beat arc — the audience leaves with the structure, not a pile of facts.

    Talking points: Recap the 4-beat arc so the audience leaves with the structure; The ask is a business decision: approve a pilot estate + the tamper-evident ledger build-out; "Pipeline-ready" → "production-proven" is the value proposition; Key takeaway: approve a pilot + the ledger build-out to move from pipeline-ready to production-proven

    Talking points: Reference for every metric mentioned in the deck; Use if the audience asks "what does X mean?"

    Speaker notes: Do not frame this as "humans are the problem." The problem is that ownership was granted without the discipline, tooling, and lifecycle planning that infrastructure requires. The operator is not the bottleneck because operators exist — the bottleneck is that operations depend on a few individuals instead of an encoded system.

    Transition: Here is the destination Nova is building toward.

    Talking points: Open with the shift: "you build it, you run it" put Terraform into product teams — ownership without discipline is destroying value; Land the lifecycle-planning gap: resources authored for creation, not for patching/rollback → destructive changes; Land the urgency: AI-era 0-day pace demands proactive scanning as code + at runtime, remediated at threat pace; Call out tribal knowledge / the rockstar-operator problem — the platform should encode the discipline, not the person; Do NOT frame this as "humans are the problem" — the problem is ownership without the discipline and tooling; Key takeaway: the problem is infrastructure ownership without discipline; the answer is an autonomous platform that encodes the discipline

    Speaker notes: "Visible" is the operative word. The vision is not just that operations run without an operator — it is that operations become observable, queryable, and accountable. That is what makes the trust defensible.

    Transition: The vision is ambitious — here are the strategic objectives that make it concrete, and the anti-goals that keep it focused.

    Talking points: Read the vision verbatim — "infrastructure operations become visible" is the operative phrase; Emphasize "provable, not promised" — trust established by deterministic scripts; the platform functions without AI; State the attestation model up front: QA for production, SRE for operational readiness; Key takeaway: autonomous operations with provable trust — security, remediation velocity, reliability, lead time made visible, not promised

    Speaker notes: Objective #2 is the one to land carefully: trust is established by deterministic scoring, not by an LLM. The platform functions without AI.

    Transition: The objectives are concrete — here is what Nova is NOT, to keep it focused.

    Talking points: Objective #1: zero-touch operations — autonomy as the default, not the demo; stage-gate attestation (QA, SRE) remains human by design; Objective #2 is the one to land carefully: trust = deterministic scoring, not an LLM; the platform functions without AI; Objective #3: four CTO-grade metrics (Lead Time, Vuln Count, MTTR, Spend) — all flow into PowerBI; Objective #4 is the integration thesis: Nova integrates with any upstream source; provides skills + MCP; all prod intents go through the same controls; Key takeaway: the scope is explicit — Nova governs infra + delivery, integrates with any source through one contract, measures success on four CTO metrics

    Speaker notes: Anti-goals #3 and #4 protect the scope boundary — Nova will not become an IDE or a product-planning tool.

    Transition: The scope boundary is explicit — here is exactly where Nova sits relative to the product development lifecycle.

    Talking points: Not a general-purpose AI agent platform; Not a system that removes humans from accountability — only from normal operations; Not an upstream development platform (no product backlogs, IDE, code authorship); Not a replacement for the Product Development Lifecycle (PDLC); Anti-goals #3 and #4 protect the scope boundary — Nova will not become an IDE or a product-planning tool; Key takeaway: the boundaries are explicit — Nova is purpose-built for infra ops + delivery, not a general-purpose AI agent or an upstream dev platform

    Speaker notes: This slide protects the scope. The moment Nova starts owning the PDLC, it loses focus. The contract boundary is what keeps Nova deep on infrastructure and delivery rather than shallow on everything.

    Transition: With the scope clear, here is who owns what across the delivery lifecycle.

    Talking points: Nova governs infra + delivery only; the PDLC (backlog, code authorship, IDE) is upstream — Nova stays downstream of it; Integration is only through the validated contract boundary; Any upstream source (AI agent, agentic SDLC, dev platform) produces submissions subject to the same compliance standards; Nova validates the submission, not the author; Key takeaway: Nova is purpose-built for infrastructure operations; the scope boundary is clean and bounded

    Speaker notes: Quality attestation is now owned by Quality Engineering (not the Platform), and Production readiness is owned by SRE. The Platform runs the checks agentically but is never the Accountable party for the gate — that separation keeps the platform honest.

    Transition: With ownership clear, here is how the pipeline enforces it.

    Talking points: Four roles now: Citizen Developer, Platform, Quality Engineering, SRE; Quality attestation is owned by Quality Engineering (not the Platform); Production readiness is owned by SRE; The Platform runs the checks agentically but is never the Accountable party for the gate — that separation keeps the platform honest; Production readiness is co-owned: the platform runs attestations; the citizen developer authorizes the promotion at the stage gate; Key takeaway: you bring FRs + UAT; Nova provides NFRs + infra; QE guards the gate evidence; SRE signs off on production readiness

    Speaker notes: The two-stage scan is the key design: static code scanning catches policy violations before the cost of a plan; runtime plan scanning catches what the static code cannot (resolved values, cross-resource issues). The platform picks the runtime scanner based on configuration — never both, to avoid duplicate noise.

    Transition: The pipeline produces decisions — here is how every decision is captured and made accountable.

    Talking points: Walk the pipeline left-to-right: contract → resolver → adapter → Checkov (static) → plan → Wiz (on plan) → confidence → gate → apply; Two-stage scan: Checkov on static code BEFORE the plan (fail-fast dev feedback); Wiz on the plan (or Checkov as drop-in if no Wiz creds); Never both Wiz + Checkov on the plan — avoid duplicate noise; Dev is autonomous; qa/prod/dr require attestation (QA for quality, SRE for production readiness); Key takeaway: two layers of scanning, zero operator involvement in normal operations

    Speaker notes: Do not dwell on the storage substrate. The audience cares that the ledger is append-only, queryable, and tied to outcomes — not that it is a hash-chain in a SQLite file. The D-122 honesty point is restated without the decision ID: the platform's decisions are deterministic; the ledger captures that real path.

    Transition: Decisions are captured — here is how stage-gate attestation keeps humans in accountability.

    Talking points: "AI decisions" are really automated decisions — deterministic scripts calculate a score; the platform functions without AI; Do not dwell on the storage substrate — the value is accountability (immutable, queryable, traceable to outcome), not the database; Every stage-gate attestation is captured with approver identity and the evidence presented; When an LLM planner is added later, it emits richer alternatives without breaking the schema; Key takeaway: autonomous is defensible because every decision is immutable, queryable, accountable — and "automated" means deterministic scoring, not a black-box LLM

    Speaker notes: The matrix is not a rubber stamp. Each concern has a freshness window and a plain-language description of what is being attested. The "operator-supplied" label from the prior deck was dropped — every concern now has a plain-language description.

    Transition: QA is half the matrix — here are the production and DR controls.

    Talking points: The matrix is not a rubber stamp — structured, freshness-validated; Each concern now has a plain-language description of what is being attested (the old "operator-supplied" label is gone); Three QA concerns: functional correctness (24h), performance baseline (7d), security posture (24h); Each concern has a freshness window — evidence older than the window does not satisfy the gate; Key takeaway: QA signs off on quality before any promotion — the gate is explicit, not implicit

    Speaker notes: The prod/DR rows are the operational-readiness and resilience gates — SRE signs off on operability, incident response, capacity, and the three resilience checks (DR drill, chaos, backup). Separation-of-duties on prod is the rule that keeps the gate honest: the approver cannot be the same person who built the deployment.

    Transition: You've seen how Nova works — the pipeline, the ledger, the attestation gates. Here is how Nova instruments itself so that every claim in this deck is traceable to a real signal.

    Talking points: Seven prod/DR concerns: operational readiness, incident response, capacity & cost, DR drill, chaos, backup, DR region deploy; SRE signs off on operability (runbooks, dashboards, on-call), incident response, capacity, and the three resilience checks; Each concern has a freshness window — 30d/90d/180d depending on the control; SoD on prod: the approver can't be the same person who built it — the rule that keeps the gate honest; Key takeaway: autonomy in operations, human in accountability, by design — the matrix is what makes autonomous operations safe enough to trust in production

    Speaker notes: The value is not the plumbing — it is that the platform's metrics surface in a tool leadership already uses (PowerBI), and every number is traceable. The live-ops dashboard is where the "infrastructure operations become visible" theme lands concretely.

    Transition: The architecture is sound — here is the measured proof.

    Talking points: Deliberately minimal: Nova-native CloudEvents; no Kafka/Prometheus/ClickHouse; The live-ops dashboard is built in PowerBI on top of the exported views — leadership sees the same numbers the platform produces; Every number in the Proof slides is traceable to a signal — "where does this number come from?" → a query against the cold store; This is where the "infrastructure operations become visible" theme lands concretely; Key takeaway: the architecture is the trust substrate — operations become visible in PowerBI, with full traceability

    Speaker notes: The mandatory-by-design point is the one to land. The ledger + attestation are not a best-effort feature; they are a gate. No change reaches production without both. That is what makes the 100% numbers credible — they are enforced, not aspirational.

    Transition: Trust is provable — here is the cost side of the ROI.

    Talking points: Both 100% — no automated decision is ever lost; no prod/dr promotion lands without a human sign-off; The mandatory-by-design point: the ledger entry + the human attestation are a gate, not a best-effort feature; Easily queried: by run, by environment, by approver, by outcome — the audit trail is a query, not a forensic exercise; Key takeaway: trust is provable — not a marketing claim, a queryable record; no change to production without both the ledger entry and the human attestation

    Speaker notes: The formula is shown inline, not hidden. The "no fabrication" constraint in action: show the formula, show the caveat, do not pretend the production numbers exist.

    Transition: The proof is grounded — here is what is honestly deferred, and why.

    Talking points: The ROI formula is shown inline — not hidden in a footnote; The four CTO-grade metrics are the ROI proof — Lead Time, Vuln Count, MTTR, Cloud Spend; The N=0 caveat is stated explicitly: the formula is grounded; the production numbers activate with a pilot; Key takeaway: the ROI is not a black box — the formula is shown, the four metrics are committed, the production-denominator caveat is up front

    Speaker notes: The preempt is critical: these deferrals are measurement infrastructure, not autonomy. The platform runs without an operator in the loop. What is deferred is the evidence pipeline for live-infra health, drift, predictive remediation — not the autonomy itself.

    Transition: The proof is honest — here is the roadmap from here to the targets.

    Talking points: The preempt is critical: these deferrals are measurement infrastructure, not autonomy — the platform IS autonomous in operations; The blocking work is named in plain language (no decision IDs) — "live AWS re-provisioning", "drift-detection scheduler", "ML service"; Showing this to leadership demonstrates honesty, not weakness; Key takeaway: the autonomy is real; the measurement gaps are documented with the work that unblocks each one

    Speaker notes: This is the bridge from "honestly deferred" to "here is how we get there." The roadmap uses timeframes, not status — most of it is not implemented yet, so a status column would be noise.

    Transition: The unblock path is clear — here is the 12-month product arc.

    Talking points: Each deferred metric has an unblock path and a timeframe — near-term, mid-term, longer-term; No status column: most of it is not implemented yet, so status would be noise; Re-evaluation triggers: each blocking piece of work lifts on its own schedule; Key takeaway: every deferred metric has a plan and a timeframe — nothing is hand-waved

    Speaker notes: The roadmap is organized by product outcome, not by technical milestone. Each quarter activates one strategic objective from the North Star.

    Transition: Here is the quarter-by-quarter detail.

    Talking points: This is the *product* roadmap, forward-looking only; Q1 Pilot Activation → Q2 Provable Trust → Q3 Compounding ROI → Q4 Integration & Predictive; Each quarter activates one strategic objective from the North Star; Key takeaway: the 12-month product arc — each quarter activates a strategic objective and its board-level metric

    Speaker notes: Q1–Q3 are committed (grounded pipeline + known unblock paths). Q4 targets are committed-deliverable, aspirational-metric — the ML service ships, the intent-share number is a first measurement (we do not control adoption rate).

    Transition: Production-grade guidance is how Nova helps the citizen developer's AI agent meet the bar — here is the first half.

    Talking points: Q1: three post-pilot metrics go live (Touchless ≥99%, Escalation <0.1%, Accuracy ≥99.5%) — denominator activates with the pilot; Q2: Decision Ledger Coverage was already grounded — tamper-evidence is the Q2 upgrade (local hash-chain → Object Lock + signed checkpoints); Q3: Drift Auto-Reversal ≥95% unblocks when the drift scheduler ships; Spend Reduction ≥25% measured against the pilot baseline; Q4: Predictive:Reactive ≥3:1 requires the ML forecasting service; AI-Agent Intent Share is a first measurement (aspirational-metric); Key takeaway: each quarter has a concrete deliverable, a target metric grounded in a strategic objective, and a path from deferred to shipped

    Speaker notes: This is the first half of the Atelier story — the surface (skills + MCP). The next slide is what the surface catches that deterministic scanners cannot.

    Transition: Here is what that guidance catches that deterministic scanners cannot.

    Talking points: Nova instructs the citizen developer's AI agent via skills (markdown, keyed to engineering domains) + an MCP server (4 tools, plugin-registry, stdio); The integration point is the same regardless of source — AI agent, agentic SDLC, traditional IDE all get the same skills + MCP; This is how Nova makes the citizen developer production-grade without owning the PDLC; Key takeaway: the citizen developer's AI agent is not unguided — Nova provides engineering principles as skills + MCP

    Speaker notes: The value is the gap deterministic scanners leave: engineering discipline. Policy scanners catch "is this S3 bucket public?"; the MCP server catches "is this service observable if that bucket fails?". The vendoring point is audit reproducibility — the validation is not a black box.

    Transition: You've seen the problem, the solution, and the proof. Here is the recap and the ask.

    Talking points: The value is the gap deterministic scanners leave: engineering discipline (Wiz/Checkmarx/Mend check policy/secrets, not discipline); The MCP server catches "is this service observable?", "is this error path handled?", "is this API contract clear?"; Vendored at a pinned tag → audit reproducibility — a validation result is replayable months later; Key takeaway: submissions are checked for engineering discipline, not just policy compliance — and the check is reproducible for audit

    Speaker notes: The ask is a business decision, not insider language. "Approve a pilot estate" is a C-suite decision. "Approve the ledger build-out" is a budget decision. The recap reinforces the 4-beat arc — the audience leaves with the structure, not a pile of facts.

    Talking points: Recap the 4-beat arc so the audience leaves with the structure; The ask is a business decision: approve a pilot estate + the tamper-evident ledger build-out; "Pipeline-ready" → "production-proven" is the value proposition; Key takeaway: approve a pilot + the ledger build-out to move from pipeline-ready to production-proven

    Talking points: Reference for every metric mentioned in the deck; Use if the audience asks "what does X mean?"

    \ No newline at end of file diff --git a/docs/presentations/nova-autonomous-cloud-delivery.pptx b/docs/presentations/nova-autonomous-cloud-delivery.pptx index ec92f54..e880bc1 100644 Binary files a/docs/presentations/nova-autonomous-cloud-delivery.pptx and b/docs/presentations/nova-autonomous-cloud-delivery.pptx differ diff --git a/docs/scope.md b/docs/scope.md index 43a307a..b990d5a 100644 --- a/docs/scope.md +++ b/docs/scope.md @@ -13,7 +13,7 @@ PDLC includes: - Application business logic - IDE workflows / developer experience -Nova never penetrates the PDLC. Nova's domain is **infrastructure + +Nova never reaches into the PDLC. Nova's domain is **infrastructure + delivery only**. Nova integrates with externally owned PDLC, SDLC, Agentic, and Citizen Developer platforms with no regard for the source of the intent: Nova provides a set of skills and MCP endpoints that help diff --git a/docs/vision.md b/docs/vision.md index ef8281d..a172dcd 100644 --- a/docs/vision.md +++ b/docs/vision.md @@ -15,7 +15,7 @@ Consumers declare intent; the platform delivers safe production deployment throu ## 3. Core Tenets * **Operations are Declared, Not Executed.** Consumers define what they need — workload shape, dependencies, non-functional requirements, policy constraints. The platform handles reconciliation, provisioning, and environment progression. The execution burden moves from the human to the platform. -* **The Delivery Lifecycle is a Sovereign Boundary.** The platform governs the infrastructure and delivery engine. It does not penetrate upstream product or software development lifecycles. Integration happens exclusively through validated, published contracts. +* **The Delivery Lifecycle is a Sovereign Boundary.** The platform governs the infrastructure and delivery engine. It does not reach into upstream product or software development lifecycles. Integration happens exclusively through validated, published contracts. * **Lower Environments are Autonomous; Higher Environments are Attested.** Progression through lower environments proceeds through zero-touch agentic automation. Promotion to higher-stakes environments requires deliberate human attestation — not as a rubber stamp, but as a policy-mandated act of accountability. * **Safety is Computed, Not Assumed.** Every delivery action produces a measurable, explainable confidence signal aggregating policy conformance, validation evidence, and historical behavior. The signal is the platform's certified answer to "is this safe to proceed?" Reliance on operator instinct or tenure is not a substitute. * **Infrastructure is Consumed, Not Maintained.** Compute is abstract, containerized, or serverless. The platform does not manage node, OS, or bare-metal lifecycles. Infrastructure is treated as a utility, not a craft.