-**Testing** (works internally, not yet released to consumers)
+**Testing** (works internally, dev pilot-ready)
- Contract-driven deploys with a versioned reusable workflow
- Module catalog (primitives + modules) with validated examples
@@ -191,14 +320,16 @@ li { margin-bottom: 2px; }
---
-
-
+# A5 — Glossary
-# The Vision Realized
-
-- **Velocity without sacrificing safety.** Speed is in the ergonomics (a simple contract, a one-line `uses:`); safety is in the gates the consumer cannot bypass.
-- **Security, observability, and compliance as platform defaults** — not per-team effort, not post-hoc remediation. Encryption, deletion protection, uptime monitoring, policy checks, and evidence are on by construction.
-- **Auditability as a byproduct, not a project.** Every production change is traceable to a human attestation and a tamper-evident evidence event.
-- **Blast radius contained by design.** Zero-trust OIDC + ABAC means a consumer can only touch its own tagged resources.
-- **Infrastructure as a utility, not a craft.** The platform abstracts compute, networking, and state. Teams consume infrastructure, they don't maintain it.
-- **A path to the citizen developer.** The same safety envelope that serves a senior engineer will serve a non-technical consumer — expanding who can ship safely without lowering the bar. Agentic
\ No newline at end of file
+| Term | Meaning |
+|---|---|
+| **OIDC** | OpenID Connect — federation protocol for short-lived tokens, no long-lived credentials |
+| **ABAC** | Attribute-Based Access Control — access scoped by resource tags + repo identity, not roles |
+| **CMK** | Customer-Managed Key — per-stack encryption key, 90-day rotation, no shared keys |
+| **CMDB** | Configuration Management Database — validates change requests for decommission |
+| **RPO** | Recovery Point Objective — RPO = 0 means evidence is written synchronously, no data loss |
+| **HITL** | Human-in-the-Loop — deliberate human attestation required for qa/prod/dr environments |
+| **VCS** | Version Control System — the git hosting platform (GitHub, Gitea, GitLab) |
+| **NFR** | Non-Functional Requirement — encryption, tagging, observability standards |
+| **IR** | Intermediate Representation — the engine-agnostic stack definition between contract and Terraform |
\ No newline at end of file
diff --git a/docs/presentations/how-the-platform-works.html b/docs/presentations/how-the-platform-works.html
index 9a3c21f..60ceed4 100644
--- a/docs/presentations/how-the-platform-works.html
+++ b/docs/presentations/how-the-platform-works.html
@@ -7,7 +7,7 @@
* @auto-scaling true
* @size 16:9 1280px 720px
* @size 4:3 960px 720px
- */div#\:\$p > svg > foreignObject > section [data-theme=light],div#\:\$p > svg > foreignObject > section{color-scheme:light}div#\:\$p > svg > foreignObject > section [data-theme=dark],div#\:\$p > svg > foreignObject > section:where(.invert){color-scheme:dark}div#\:\$p > svg > foreignObject > section{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;margin:0;font-weight:var(--base-text-weight-normal, 400);color:var(--fgColor-default);background-color:var(--bgColor-default);font-family:var(--fontStack-sansSerif, -apple-system, BlinkMacSystemFont, "Segoe UI", "Noto Sans", Helvetica, Arial, sans-serif, "Apple Color Emoji", "Segoe UI Emoji");font-size:16px;line-height:1.5;word-wrap:break-word}div#\:\$p > svg > foreignObject > section{--marpit-root-font-size:16px}div#\:\$p > svg > foreignObject > section a{text-decoration:underline;text-underline-offset:calc(var(--marpit-root-font-size, 1rem) * .2)}div#\:\$p > svg > foreignObject > section :is(h1, marp-h1):hover .anchor .octicon-link:before,div#\:\$p > svg > foreignObject > section :is(h2, marp-h2):hover .anchor .octicon-link:before,div#\:\$p > svg > foreignObject > section :is(h3, marp-h3):hover .anchor .octicon-link:before,div#\:\$p > svg > foreignObject > section :is(h4, marp-h4):hover .anchor .octicon-link:before,div#\:\$p > svg > foreignObject > section :is(h5, marp-h5):hover .anchor .octicon-link:before,div#\:\$p > svg > foreignObject > section :is(h6, marp-h6):hover .anchor .octicon-link:before{width:16px;height:16px;content:" ";display:inline-block;background-color:currentColor;-webkit-mask-image:url('data:image/svg+xml;charset=utf-8,Previous slide Next slide Toggle fullscreen Toggle overview view Open presenter view
+;" data-marpit-pagination-total="17">
The Problem & The North Star
+Story beat: Here's the problem we're solving and where we're going.
Four frictions slow every team:
Cognitive load — authoring infrastructure correctly; the long tail of services inconsistent in security and observabilityA merged change progresses without a platform engineer joining a thread or approving a ticket
A non-technical consumer ships by declaring intent — no workflow, no config file, no infrastructure module
Every production change is traceable to a human attestation and an immutable evidence stream
-Not a general-purpose AI — autonomy is narrow, scoped to delivery, bounded by strict policyNot a permissive delivery highway — no escape hatches to bypass the confidence framework
@@ -129,7 +132,8 @@ section.title h1 { color: #fff; }
table { font-size: 18px; width: 100%; }
th { background: #F0F0F0; }
blockquote { border-left: 4px solid #D6002A; color: #2E2E2E; font-size: 20px; }
-img { display: block; margin: 0 auto; max-height: 320px; }
+img { display: block; margin: 0 auto; max-height: 300px; }
+em.story { color: #6B7280; font-size: 16px; font-style: italic; }
.badge {
display: inline-block; padding: 2px 8px; border-radius: 4px;
font-size: 14px; font-weight: 600;
@@ -149,7 +153,8 @@ section.title h1 { color: #fff; }
table { font-size: 18px; width: 100%; }
th { background: #F0F0F0; }
blockquote { border-left: 4px solid #D6002A; color: #2E2E2E; font-size: 20px; }
-img { display: block; margin: 0 auto; max-height: 320px; }
+img { display: block; margin: 0 auto; max-height: 300px; }
+em.story { color: #6B7280; font-size: 16px; font-style: italic; }
.badge {
display: inline-block; padding: 2px 8px; border-radius: 4px;
font-size: 14px; font-weight: 600;
@@ -157,16 +162,16 @@ img { display: block; margin: 0 auto; max-height: 320px; }
.testing { background: #DBEAFE; color: #1E3A5F; }
.planned { background: #fef3c7; color: #78350f; }
.agentic { background: #EDE9FE; color: #4C1D95; }
-;" data-marpit-pagination-total="10">
+;" data-marpit-pagination-total="17">
-The Contract-Driven Model
-A single YAML contract is all a consumer writes — module, environment, inputs . The platform owns everything else.
-
+Where ACDL Sits in Your World
+Story beat: Now that we know the problem, here's where ACDL fits — and where it doesn't.
+
-Which module — a catalog of pre-built, security-reviewed building blocksWhich environment — the platform raises the safety bar automatically as sensitivity risesWhich inputs — the handful of values that vary per deploymentThe consumer provides no AWS account, no VPC, no state backend, no runner key — the platform owns the blast radius
+Upstream is anything — your IDE, an agentic SDLC, or a citizen developer vibe coding on a laptop. ACDL doesn't care how the contract was produced.ACDL is infrastructure only — it provisions and governs AWS resources. It does not build, test, or deploy your application code. That's upstream.Not a general-purpose AI — autonomy is narrow, scoped to delivery, bounded by strict policyNot a permissive delivery highway — no escape hatches to bypass the confidence framework
@@ -182,7 +187,8 @@ section.title h1 { color: #fff; }
table { font-size: 18px; width: 100%; }
th { background: #F0F0F0; }
blockquote { border-left: 4px solid #D6002A; color: #2E2E2E; font-size: 20px; }
-img { display: block; margin: 0 auto; max-height: 320px; }
+img { display: block; margin: 0 auto; max-height: 300px; }
+em.story { color: #6B7280; font-size: 16px; font-style: italic; }
.badge {
display: inline-block; padding: 2px 8px; border-radius: 4px;
font-size: 14px; font-weight: 600;
@@ -202,7 +208,8 @@ section.title h1 { color: #fff; }
table { font-size: 18px; width: 100%; }
th { background: #F0F0F0; }
blockquote { border-left: 4px solid #D6002A; color: #2E2E2E; font-size: 20px; }
-img { display: block; margin: 0 auto; max-height: 320px; }
+img { display: block; margin: 0 auto; max-height: 300px; }
+em.story { color: #6B7280; font-size: 16px; font-style: italic; }
.badge {
display: inline-block; padding: 2px 8px; border-radius: 4px;
font-size: 14px; font-weight: 600;
@@ -210,14 +217,17 @@ img { display: block; margin: 0 auto; max-height: 320px; }
.testing { background: #DBEAFE; color: #1E3A5F; }
.planned { background: #fef3c7; color: #78350f; }
.agentic { background: #EDE9FE; color: #4C1D95; }
-;" data-marpit-pagination-total="10">
+;" data-marpit-pagination-total="17">
-The End-to-End Flow
-Every deployment runs the same stages, in the same order, with the same checks — no team-specific pipelines, no tribal runbooks.
-
+The Contract-Driven Model
+Story beat: The contract is the boundary between upstream and ACDL. It's all a consumer writes.
+A single YAML contract — module, environment, inputs . The platform owns everything else.
+
-Security and policy checks run before any infrastructure is created Every stage produces a record that feeds the confidence signal and the evidence stream — there is no "unchecked" pathWhich module — a catalog of pre-built, security-reviewed building blocksWhich environment — the platform raises the safety bar automatically as sensitivity risesWhich inputs — infrastructure values that vary per deployment (cpu, memory, port, desired_count)The consumer provides no AWS account, no VPC, no state backend — the platform owns the blast radius
@@ -233,7 +243,8 @@ section.title h1 { color: #fff; }
table { font-size: 18px; width: 100%; }
th { background: #F0F0F0; }
blockquote { border-left: 4px solid #D6002A; color: #2E2E2E; font-size: 20px; }
-img { display: block; margin: 0 auto; max-height: 320px; }
+img { display: block; margin: 0 auto; max-height: 300px; }
+em.story { color: #6B7280; font-size: 16px; font-style: italic; }
.badge {
display: inline-block; padding: 2px 8px; border-radius: 4px;
font-size: 14px; font-weight: 600;
@@ -253,7 +264,8 @@ section.title h1 { color: #fff; }
table { font-size: 18px; width: 100%; }
th { background: #F0F0F0; }
blockquote { border-left: 4px solid #D6002A; color: #2E2E2E; font-size: 20px; }
-img { display: block; margin: 0 auto; max-height: 320px; }
+img { display: block; margin: 0 auto; max-height: 300px; }
+em.story { color: #6B7280; font-size: 16px; font-style: italic; }
.badge {
display: inline-block; padding: 2px 8px; border-radius: 4px;
font-size: 14px; font-weight: 600;
@@ -261,20 +273,16 @@ img { display: block; margin: 0 auto; max-height: 320px; }
.testing { background: #DBEAFE; color: #1E3A5F; }
.planned { background: #fef3c7; color: #78350f; }
.agentic { background: #EDE9FE; color: #4C1D95; }
-;" data-marpit-pagination-total="10">
+;" data-marpit-pagination-total="17">
-Zero-Trust by Default
-Consumer repositories hold no long-lived cloud credentials. Ever.
+The End-to-End Flow
+Story beat: Once the contract is written, here's what the platform does with it — every time.
+Every deployment runs the same stages, in the same order, with the same checks — no team-specific pipelines, no tribal runbooks.
+
-Authentication — OIDC federation. Each job mints a short-lived token; no credential is stored in the consumer repo or in a runner secret. Testing (GitHub Actions) Planned: all runners Authorization — attribute-based (ABAC), not role-based. Two attribute classes scope every action:
-
-Repository identity — the role's trust policy binds to the exact consumer repo + branchResource tags — every resource is tagged acdl:owner + acdl:contract; the session policy grants access only to matching tags Security and policy checks run before any infrastructure is created Every stage produces a record that feeds the confidence signal and the evidence stream — there is no "unchecked" path
-
-The effect: a consumer can only touch the resources it created. Blast radius is contained. One consumer can never affect another.
+;" data-marpit-pagination-total="17">
-Safety is Computed, Not Assumed
-Every delivery action produces a measurable, explainable confidence signal — the platform's certified answer to "is this safe to proceed?" Agentic
+Zero-Trust by Default
+Story beat: Before any infrastructure is created, here's how access is scoped.
+Consumer repositories hold no long-lived cloud credentials. Ever.
-Six weighted inputs: policy conformance, validation, freshness, source provenance, history, NFRsPer-environment thresholds that rise with sensitivity:
-
-
-
-Environment
-Threshold
-Attester
-
-
-
-
-dev
-≥ 0.50
-No one — autonomous
-
-
-qa
-≥ 0.75
-QA
-
-
-prod
-≥ 0.90
-SRE
-
-
-dr
-≥ 0.95
-SRE + DR drill
-
-
-
+Authentication — OIDC federation. Each job mints a short-lived token; no credential is stored in the consumer repo or in a runner secret. Testing (GitHub Actions) Planned: all runners Authorization — attribute-based (ABAC), not role-based. Two attribute classes scope every action:
-A single critical finding hard-blocks the deployment — critical findings are not averaged awayWhen the platform halts, it gives a measured reason — never an opaque debugging exerciseRepository identity — the role's trust policy binds to the exact consumer repo + branchResource tags — every resource is tagged acdl:owner + acdl:contract; the session policy grants access only to matching tags
+The effect: a consumer can only touch the resources it created. Blast radius is contained. One consumer can never affect another.
+;" data-marpit-pagination-total="17">
-Security by Construction
-Security defaults that do not require a team to opt in. Checks run on every deployment, normalized to a single schema. Testing
+Safety is Computed, Not Assumed
+Story beat: Now let's look at how the platform decides whether a deployment is safe.
+Every delivery action produces a measurable, explainable confidence signal — a weighted sum of observable facts, not a black box. Agentic
+
-Policy checks (Checkov, Wiz, Kyverno) — secrets in plaintext, public ingress, IAM wildcards, required tagging standards — all run before infra is createdEncryption on every resource — at-rest encryption on by default; per-stack customer-managed keys with 90-day rotation, no shared keys across stacks Deletion protection on by default — prevent_destroy on unless explicitly disabled via a documented flagSafe decommission — a 2-step pipeline with two SRE attestation gates and a change-request validated against the CMDB Six weighted inputs — manually tuned, auditable. If a consumer asks "why 0.62?", the platform answers with a per-input breakdownPer-environment thresholds that rise with sensitivity:
+
+
+
+Environment
+Threshold
+Attester
+
+
+
+
+dev
+≥ 0.50
+No one — autonomous Testing
+
+
+qa
+≥ 0.75
+QA Planned
+
+
+prod
+≥ 0.90
+SRE Planned
+
+
+
+
+A single critical finding hard-blocks — critical findings are not averaged away
@@ -426,7 +439,8 @@ section.title h1 { color: #fff; }
table { font-size: 18px; width: 100%; }
th { background: #F0F0F0; }
blockquote { border-left: 4px solid #D6002A; color: #2E2E2E; font-size: 20px; }
-img { display: block; margin: 0 auto; max-height: 320px; }
+img { display: block; margin: 0 auto; max-height: 300px; }
+em.story { color: #6B7280; font-size: 16px; font-style: italic; }
.badge {
display: inline-block; padding: 2px 8px; border-radius: 4px;
font-size: 14px; font-weight: 600;
@@ -446,7 +460,8 @@ section.title h1 { color: #fff; }
table { font-size: 18px; width: 100%; }
th { background: #F0F0F0; }
blockquote { border-left: 4px solid #D6002A; color: #2E2E2E; font-size: 20px; }
-img { display: block; margin: 0 auto; max-height: 320px; }
+img { display: block; margin: 0 auto; max-height: 300px; }
+em.story { color: #6B7280; font-size: 16px; font-style: italic; }
.badge {
display: inline-block; padding: 2px 8px; border-radius: 4px;
font-size: 14px; font-weight: 600;
@@ -454,20 +469,20 @@ img { display: block; margin: 0 auto; max-height: 320px; }
.testing { background: #DBEAFE; color: #1E3A5F; }
.planned { background: #fef3c7; color: #78350f; }
.agentic { background: #EDE9FE; color: #4C1D95; }
-;" data-marpit-pagination-total="10">
+;" data-marpit-pagination-total="17">
-Accountability & Audit
-Autonomy and accountability are not in tension — they apply at different environments.
+Security by Construction
+Story beat: Beyond the confidence signal, security defaults are on by construction — not by opt-in.
+Security defaults that do not require a team to opt in. Checks run on every deployment, normalized to a single schema. Testing
-Dev is fully autonomous. The confidence signal (≥ 0.50) is the only gate. Queue-based handoffs are eliminated. Agentic qa, prod, dr require deliberate human attestation — policy-mandated acts of accountability, not rubber stampsSeparation of duties is enforced — the QA approver cannot be the prod approver. The platform blocks on a match. Design tested Wiring: planned Every deployment writes a hash-chained evidence event — tampering breaks the chain. RPO = 0 — the evidence write is synchronous Testing Every production change is traceable to a human attestation — the only durable record outside the VCS's audit logPolicy checks (Checkov, Wiz, Kyverno) — secrets in plaintext, public ingress, IAM wildcards, required tagging standards — all run before infra is createdEncryption on every resource — at-rest encryption on by default; per-stack customer-managed keys with 90-day rotation, no shared keys across stacks Deletion protection on by default — prevent_destroy on unless explicitly disabled via a documented flagSafe decommission — a 2-step pipeline with two SRE attestation gates and a change-request validated against the CMDB
-
+
+Accountability & Audit
+Story beat: Computed safety handles the gate. But humans still matter — here's how accountability works.
+
+
+Dev is fully autonomous. The confidence signal (≥ 0.50) is the only gate. Testing Agentic qa, prod, dr require human attestation — the approver reviews the contract, the planned Terraform changes, and the accumulated evidence Planned QA attests to infrastructure readiness, not application code — the contract, the plan, and the evidence. Application code review is upstreamSeparation of duties — the QA approver cannot be the prod approver. The platform blocks on a match. Planned Every deployment writes a hash-chained evidence event — tampering breaks the chain. RPO = 0 Testing
+
+
+Testing vs. Planned
+Story beat: Let's be honest about what works today and what's on the roadmap.
+
+11 capabilities testing today (dev pilot-ready):
+
+Contract-driven deploys · Module catalog · Zero-trust OIDC + ABAC
+Security + policy checks before infra creation · Confidence signal gating
+Hash-chained evidence outbox (RPO = 0) · Encryption by default + per-stack CMKs
+Deletion protection + safe decommission · Uptime monitoring
+Platform-managed environments · Engine-agnostic core + VCS-agnostic ingestion
+
+9 planned (production path):
+
+HITL wiring for qa/prod/dr · All-runner OIDC · Full regulatory ledger
+Compliance milestone (GDPR, SOX, SOC2, DORA) · Environment self-service
+Dynamic module creation Agentic · Pattern recognition Agentic
+Additional engine adapters · Deeper observability bootstrap
+
+Full inventory + phased roadmap in the appendix.
+
+
+
+
+
+The Vision Realized
+Story beat: Here's what success looks like when the North Star is reached.
+
+Velocity without sacrificing safety. Speed is in the ergonomics (a simple contract, a one-line uses:); safety is in the gates the consumer cannot bypass.Security, observability, and compliance as platform defaults — not per-team effort, not post-hoc remediation.Auditability as a byproduct, not a project. Every production change is traceable to a human attestation and a tamper-evident evidence event.Blast radius contained by design. Zero-trust OIDC + ABAC means a consumer can only touch its own tagged resources.Infrastructure as a utility, not a craft. Teams consume infrastructure, they don't maintain it.A path to the citizen developer. The same safety envelope that serves a senior engineer will serve a non-technical consumer. Agentic
+
+
+
+
+
+Appendix
+For deep dives — these slides cover details omitted from the main 10.
+Contents:
+
+Platform-Managed Environments (detail)
+Observability Built In (detail)
+The Road to the North Star (phased roadmap)
+Testing vs. Planned (full inventory)
+Glossary
+
+
+
+
+
+
+A consumer provides no AWS account, no VPC, no subnet, no state backend, no runner key. The platform owns the blast radius.
+A named environment is a platform-owned bundle of:
+
+An AWS account (or a scoped partition of one)
+A network (VPC + subnets)
+A state backend (S3 + DynamoDB for state + locking)
+An IAM role surfaced via ABAC, scoped to the consumer's identity and resource tags
+
+The consumer selects an environment by name in their contract. The platform resolves the name to the underlying resources at run time. The consumer never sees raw credentials.
+Friendly onboarding: the first run detects no environment and emits a guided prompt (not an opaque failure). Testing Self-service: planned
+
+
+
+
+A2 — Observability Built In
+Monitoring is a platform default, not a per-team project. Testing
+
+Uptime monitoring deployed automatically with every stack — a dedicated monitoring instance is provisioned after any module deploy, in a separate state, with a feature flag to disableMonitored endpoints passed from the deployment's own outputs — no manual endpoint registrationAlert channels: Microsoft Teams webhook, email, SMS, and GitHub issuesThe uptime URL is published to the developer via a PR comment — they don't hunt for itRoadmap: deeper observability bootstrap (dashboards, runbooks, on-call bindings) as first-class contract fields Planned
+
+
+
+
+
+A3 — The Road to the North Star
+Proposed phasing — not formally planned.
+
+
+
+
+
+
+A4 — Testing vs. Planned (Full Inventory)
-Testing (works internally, not yet released to consumers)
+Testing (works internally, dev pilot-ready)
Contract-driven deploys with a versioned reusable workflow
Module catalog (primitives + modules) with validated examples
@@ -547,7 +962,7 @@ img { display: block; margin: 0 auto; max-height: 320px; }
-
+;" data-marpit-pagination-total="17">
-
-The Vision Realized
-
-Velocity without sacrificing safety. Speed is in the ergonomics (a simple contract, a one-line uses:); safety is in the gates the consumer cannot bypass.Security, observability, and compliance as platform defaults — not per-team effort, not post-hoc remediation. Encryption, deletion protection, uptime monitoring, policy checks, and evidence are on by construction.Auditability as a byproduct, not a project. Every production change is traceable to a human attestation and a tamper-evident evidence event.Blast radius contained by design. Zero-trust OIDC + ABAC means a consumer can only touch its own tagged resources.Infrastructure as a utility, not a craft. The platform abstracts compute, networking, and state. Teams consume infrastructure, they don't maintain it.A path to the citizen developer. The same safety envelope that serves a senior engineer will serve a non-technical consumer — expanding who can ship safely without lowering the bar. Agentic
+A5 — Glossary
+
+
+
+Term
+Meaning
+
+
+
+
+OIDC OpenID Connect — federation protocol for short-lived tokens, no long-lived credentials
+
+
+ABAC Attribute-Based Access Control — access scoped by resource tags + repo identity, not roles
+
+
+CMK Customer-Managed Key — per-stack encryption key, 90-day rotation, no shared keys
+
+
+CMDB Configuration Management Database — validates change requests for decommission
+
+
+RPO Recovery Point Objective — RPO = 0 means evidence is written synchronously, no data loss
+
+
+HITL Human-in-the-Loop — deliberate human attestation required for qa/prod/dr environments
+
+
+VCS Version Control System — the git hosting platform (GitHub, Gitea, GitLab)
+
+
+NFR Non-Functional Requirement — encryption, tagging, observability standards
+
+
+IR Intermediate Representation — the engine-agnostic stack definition between contract and Terraform
+
+
+