docs(P49): consolidate both Marp decks to 10 high-impact slides
How The Platform Works: 16 → 10 slides - Merged Problem + North Star + What It Is/Isn't → 1 slide (4 frictions → North Star → 3 success criteria → 2 anti-goals) - Merged Policy & Security + Secure by Default → 'Security by Construction' - Merged Immutable Audit + Human-in-the-Loop → 'Accountability & Audit' - Folded Observability, Platform-Managed Environments, Portability into existing slides as bullets (Roadmap, Contract-Driven) - Added 'The Vision Realized' closing slide - Removed '5-line YAML' claim (credibility — complex stacks are more) The Developer Experience: 15 → 10 slides - Merged What Dev Does + Contract + No Platform Code → 'The Contract — The Entire Consumer Surface' - Merged Instant Feedback + Deploy Outputs → 'The Developer Feedback Loop' - Merged Safe Promotion Path + Rising Bar → 1 slide with side-by-side approaches + threshold table - Cut Citizen Developer Experience as standalone (mentioned on slide 2 and slide 10 Outcomes) - Kept Versioned Releases, Friendly Onboarding, Safe Decommission as standalone (per user request) - Removed '5-line YAML' claim Source markdown files unchanged (remain complete reference with speaker notes for all original slides). ---ci--- phase: 49 milestone: v1.9 status: complete requirements: covered: [] partial: [] ---/ci---
This commit is contained in:
Jon Chery
@@ -42,60 +42,35 @@ section.title h3 { color: #F0F0F0; font-weight: 400; font-size: 22px; margin-top
|
||||
|
||||
---
|
||||
|
||||
# The Problem We Solve
|
||||
|
||||
Software delivery scales with the **coordination surface around it**, not the engineering inside it.
|
||||
# The Problem & The North Star
|
||||
|
||||
Four frictions slow every team:
|
||||
|
||||
- **Cognitive load** — authoring the infrastructure that runs a service *correctly*. The long tail of services that are difficult to deploy, inconsistent in security and observability posture.
|
||||
- **Operational work** — promoting a change from "merged" to "running in production with policy, observability, and security enforced." Manual work that **scales with the system, not with the change.**
|
||||
- **Red tape** — every deployment requires tickets, approvals, and manual handoffs that scale with the organization, not with the change. A merged change waits in a queue for someone to press a button.
|
||||
- **Scalability without increasing headcount** — the platform allows delivery throughput to scale without linearly scaling platform engineers. Today, every new team adds load to the same ticket queue.
|
||||
- **Cognitive load** — authoring infrastructure correctly; the long tail of services inconsistent in security and observability
|
||||
- **Operational work** — promoting a change from "merged" to "running in production." Manual work that **scales with the system, not the change**
|
||||
- **Red tape** — tickets, approvals, and handoffs that scale with the organization. A merged change waits in a queue
|
||||
- **Scalability without increasing headcount** — throughput scales without linearly scaling platform engineers
|
||||
|
||||
The platform absorbs **all four** frictions.
|
||||
> Consumers **declare intent**; the platform delivers **safe production deployment** — automatically, safely, with a complete audit trail.
|
||||
|
||||
---
|
||||
|
||||
# The North Star
|
||||
|
||||
> Consumers **declare intent**; the platform delivers **safe production deployment** — automatically, safely, and with a complete audit trail.
|
||||
|
||||
Success looks like:
|
||||
|
||||
- A merged change progresses through lower environments **without a platform engineer joining a thread, approving a ticket, or triggering a stage.**
|
||||
- A **non-technical consumer** ships a production deployment by declaring intent — without authoring a workflow, a configuration file, or an infrastructure module.
|
||||
- Every production change is **traceable to a human attestation and an immutable evidence stream.**
|
||||
|
||||
---
|
||||
|
||||
# What This Platform Is — and Isn't
|
||||
|
||||
**What it is:**
|
||||
|
||||
- **A sovereign delivery boundary.** The platform governs infrastructure and delivery. It does not penetrate upstream product or software development lifecycles. Integration happens through validated, published contracts.
|
||||
- **Infrastructure consumed, not maintained.** Compute is abstract, containerized, or serverless. The platform does not manage node, OS, or bare-metal lifecycles. Infrastructure is a utility, not a craft.
|
||||
|
||||
**What it isn't:**
|
||||
|
||||
- **Not an upstream development platform.** No product backlogs, sprint ceremonies, or IDE workflows.
|
||||
- **Not a general-purpose AI.** Autonomy is narrow, scoped to delivery and infrastructure reconciliation, bounded by strict policy envelopes.
|
||||
- **Not a legacy infrastructure bridge.** No VMs, bare metal, or OS lifecycles.
|
||||
- **Not a permissive delivery highway.** No escape hatches to bypass the confidence framework or human attestation requirements.
|
||||
- A merged change progresses **without a platform engineer joining a thread or approving a ticket**
|
||||
- A **non-technical consumer** ships by declaring intent — no workflow, no config file, no infrastructure module
|
||||
- Every production change is **traceable to a human attestation and an immutable evidence stream**
|
||||
- **Not a general-purpose AI** — autonomy is narrow, scoped to delivery, bounded by strict policy
|
||||
- **Not a permissive delivery highway** — no escape hatches to bypass the confidence framework
|
||||
|
||||
---
|
||||
|
||||
# The Contract-Driven Model
|
||||
|
||||
One small YAML file is all a consumer writes. The platform owns everything else.
|
||||
A single YAML contract is all a consumer writes — **module, environment, inputs**. The platform owns everything else.
|
||||
|
||||
|
||||
|
||||
The contract names three things:
|
||||
|
||||
|
||||
- **Which module** — a catalog of pre-built, security-reviewed building blocks
|
||||
- **Which environment** — the platform raises the safety bar automatically as sensitivity rises
|
||||
- **Which inputs** — the handful of values that vary per deployment
|
||||
- The consumer provides **no AWS account, no VPC, no state backend, no runner key** — the platform owns the blast radius
|
||||
|
||||
---
|
||||
|
||||
@@ -142,89 +117,26 @@ Every delivery action produces a **measurable, explainable confidence signal**
|
||||
|
||||
---
|
||||
|
||||
# Policy & Security Enforcement
|
||||
# Security by Construction
|
||||
|
||||
Checks run on **every** deployment, normalized to a single schema regardless of which engine produced them.
|
||||
Security defaults that **do not require a team to opt in.** Checks run on **every** deployment, normalized to a single schema. <span class="badge testing">Testing</span>
|
||||
|
||||
- **Infrastructure policy** (Checkov) — secrets in plaintext, public ingress, IAM wildcards, KMS references, **required tagging standards** (`acdl:owner`, `acdl:contract`, `acdl:environment`, `acdl:cost-center`) <span class="badge testing">Testing</span>
|
||||
- **Cloud security posture** (Wiz adapter) — translates cloud security findings into the same normalized record <span class="badge testing">Testing</span>
|
||||
- **Kubernetes-native policy** (Kyverno adapter) — ready for the GitOps reconciler <span class="badge testing">Testing</span>
|
||||
|
||||
Every check produces a record with **severity, rule ID, pass/fail status, and a human-readable message** — consumed uniformly by the confidence signal.
|
||||
- **Policy checks** (Checkov, Wiz, Kyverno) — secrets in plaintext, public ingress, IAM wildcards, **required tagging standards** — all run *before* infra is created
|
||||
- **Encryption on every resource** — at-rest encryption on by default; per-stack customer-managed keys with 90-day rotation, **no shared keys across stacks**
|
||||
- **Deletion protection on by default** — `prevent_destroy` on unless explicitly disabled via a documented flag
|
||||
- **Safe decommission** — a 2-step pipeline with **two SRE attestation gates** and a **change-request validated against the CMDB**
|
||||
|
||||
---
|
||||
|
||||
# Secure by Default
|
||||
|
||||
Security defaults that **do not require a team to opt in.** <span class="badge testing">Testing</span>
|
||||
|
||||
- **Encryption on every resource** — at-rest encryption on by default for every primitive (S3, RDS, ECR, ECS, and more)
|
||||
- **Per-stack customer-managed keys** — one key per deployment, 90-day rotation, **no shared keys across stacks**
|
||||
- **Managed-key fallback with a loud warning** — silent use of cloud-managed keys is a security gap we refuse to hide
|
||||
- **Deletion protection on by default** — `prevent_destroy` on unless a consumer explicitly disables it via a documented flag
|
||||
- **Safe decommission** — a 2-step pipeline (disable protection → zero counts → destroy) with **two SRE attestation gates** and a **change-request validated against the CMDB**
|
||||
|
||||
---
|
||||
|
||||
# Immutable Audit & Evidence
|
||||
|
||||
Version control is a **coordination tool, not an evidentiary fortress.** True compliance requires an immutable, externally-stored ledger.
|
||||
|
||||
- **Every deployment writes a hash-chained evidence event** — each event links to the previous via a cryptographic hash; tampering breaks the chain <span class="badge testing">Testing</span>
|
||||
- **Tiered storage:** cold, tamper-proof source of truth (S3 Object Lock, 7-year retention) + a hot query index <span class="badge testing">Outbox tested</span> <span class="badge planned">Full ledger: planned</span>
|
||||
- **RPO = 0** — the evidence write is synchronous; a deployment is not acknowledged until the evidence event is durably recorded
|
||||
- **Every production change is traceable to a human attestation** — approver identities are the only durable record outside the VCS's audit log
|
||||
|
||||
---
|
||||
|
||||
# Human-in-the-Loop Where It Matters
|
||||
# Accountability & Audit
|
||||
|
||||
Autonomy and accountability are **not in tension** — they apply at different environments.
|
||||
|
||||
- **Dev is fully autonomous.** The confidence signal (≥ 0.50) is the only gate. Queue-based handoffs are eliminated from lower environments. <span class="badge agentic">Agentic</span>
|
||||
- **qa, prod, and dr require deliberate human attestation** — not rubber stamps, but policy-mandated acts of accountability via protected deployment approvals.
|
||||
- **Separation of duties is enforced** — the QA approver **cannot** be the prod approver. The platform reads both identities from the outbox and **blocks on a match.** <span class="badge testing">Design tested</span> <span class="badge planned">Wiring: planned</span>
|
||||
- **Timeout discipline** — 1 business day = warn + escalate; 2 business days = auto-freeze + re-submit
|
||||
|
||||
---
|
||||
|
||||
# Observability Built In
|
||||
|
||||
Monitoring is **a platform default, not a per-team project.** <span class="badge testing">Testing</span>
|
||||
|
||||
- **Uptime monitoring deployed automatically with every stack** — a dedicated monitoring instance is provisioned after any module deploy, in a separate state, with a feature flag to disable
|
||||
- **Monitored endpoints passed from the deployment's own outputs** — no manual endpoint registration
|
||||
- **Alert channels:** Microsoft Teams webhook, email, SMS, and GitHub issues
|
||||
- **The uptime URL is published to the developer** via a PR comment — they don't hunt for it
|
||||
- **Roadmap:** deeper observability bootstrap (dashboards, runbooks, on-call bindings) as first-class contract fields
|
||||
|
||||
---
|
||||
|
||||
# Platform-Managed Environments
|
||||
|
||||
A consumer provides **no AWS account, no VPC, no subnet, no state backend, no runner key.** The platform owns the blast radius.
|
||||
|
||||
A named environment is a platform-owned bundle of:
|
||||
|
||||
- An AWS account (or a scoped partition of one)
|
||||
- A network (VPC + subnets)
|
||||
- A state backend (S3 + DynamoDB for state + locking)
|
||||
- An IAM role surfaced via ABAC, scoped to the consumer's identity and resource tags
|
||||
|
||||
The consumer selects an environment **by name** in their contract. The platform resolves the name to the underlying resources at run time. **The consumer never sees raw credentials.**
|
||||
|
||||
**Friendly onboarding:** the first run detects no environment and emits a guided prompt (not an opaque failure). <span class="badge testing">Testing</span> <span class="badge planned">Self-service: planned</span>
|
||||
|
||||
---
|
||||
|
||||
# Portability & Future-Proofing
|
||||
|
||||
The platform is **opinionated, but not painted into a corner.**
|
||||
|
||||
- **Engine-agnostic core.** The contract, the resolved stack, the policy results, the confidence signal, and the evidence stream are all defined *without reference to any specific infrastructure tool.* <span class="badge testing">1 adapter: Terraform</span> <span class="badge planned">OpenTofu / Pulumi / K8s</span>
|
||||
- **VCS-agnostic contract ingestion.** The platform Lambda reads a configurable API base for GitHub or Gitea. <span class="badge testing">Testing</span>
|
||||
- **Portable contracts.** A second VCS needs a VCS adapter + a workflow translator — **no change to modules, contracts, confidence, or audit**
|
||||
- **Pattern recognition compounds value over time.** As the platform observes recurring patterns, it can synthesize reusable modules. <span class="badge planned">Future capability</span> <span class="badge agentic">Agentic</span>
|
||||
- **Dev is fully autonomous.** The confidence signal (≥ 0.50) is the only gate. Queue-based handoffs are eliminated. <span class="badge agentic">Agentic</span>
|
||||
- **qa, prod, dr require deliberate human attestation** — policy-mandated acts of accountability, not rubber stamps
|
||||
- **Separation of duties is enforced** — the QA approver **cannot** be the prod approver. The platform **blocks on a match.** <span class="badge testing">Design tested</span> <span class="badge planned">Wiring: planned</span>
|
||||
- **Every deployment writes a hash-chained evidence event** — tampering breaks the chain. **RPO = 0** — the evidence write is synchronous <span class="badge testing">Testing</span>
|
||||
- **Every production change is traceable to a human attestation** — the only durable record outside the VCS's audit log
|
||||
|
||||
---
|
||||
|
||||
@@ -256,7 +168,7 @@ li { margin-bottom: 2px; }
|
||||
- Deletion protection by default + safe decommission with SRE gates
|
||||
- Uptime monitoring deployed automatically with every stack
|
||||
- Platform-managed environments + friendly onboarding
|
||||
- Local reproducibility + VCS-agnostic contract ingestion
|
||||
- Engine-agnostic core (1 adapter: Terraform) + VCS-agnostic ingestion
|
||||
|
||||
</td>
|
||||
<td style="width: 48%; border: none; padding-left: 12px;">
|
||||
@@ -269,8 +181,24 @@ li { margin-bottom: 2px; }
|
||||
- Compliance milestone: GDPR, SOX, SOC2, DORA extension points
|
||||
- Environment self-service provisioning
|
||||
- Dynamic module creation from a contract (agentic citizen-developer flow) <span class="badge agentic">Agentic</span>
|
||||
- Pattern recognition compounds value over time <span class="badge agentic">Agentic</span>
|
||||
- Additional engine adapters (OpenTofu, Pulumi, Kubernetes CRDs)
|
||||
- Deeper observability bootstrap (dashboards, runbooks, on-call)
|
||||
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
</table>
|
||||
|
||||
---
|
||||
|
||||
<!-- _class: title -->
|
||||
<!-- _paginate: false -->
|
||||
|
||||
# The Vision Realized
|
||||
|
||||
- **Velocity without sacrificing safety.** Speed is in the ergonomics (a simple contract, a one-line `uses:`); safety is in the gates the consumer cannot bypass.
|
||||
- **Security, observability, and compliance as platform defaults** — not per-team effort, not post-hoc remediation. Encryption, deletion protection, uptime monitoring, policy checks, and evidence are on by construction.
|
||||
- **Auditability as a byproduct, not a project.** Every production change is traceable to a human attestation and a tamper-evident evidence event.
|
||||
- **Blast radius contained by design.** Zero-trust OIDC + ABAC means a consumer can only touch its own tagged resources.
|
||||
- **Infrastructure as a utility, not a craft.** The platform abstracts compute, networking, and state. Teams consume infrastructure, they don't maintain it.
|
||||
- **A path to the citizen developer.** The same safety envelope that serves a senior engineer will serve a non-technical consumer — expanding who can ship safely without lowering the bar. <span class="badge agentic">Agentic</span>
|
||||
File diff suppressed because one or more lines are too long
@@ -18,8 +18,8 @@ style: |
|
||||
table { font-size: 18px; width: 100%; }
|
||||
th { background: #F0F0F0; }
|
||||
blockquote { border-left: 4px solid #D6002A; color: #2E2E2E; font-size: 20px; }
|
||||
pre { font-size: 16px; line-height: 1.3; }
|
||||
code { font-size: 16px; }
|
||||
pre { font-size: 14px; line-height: 1.3; }
|
||||
code { font-size: 14px; }
|
||||
img { display: block; margin: 0 auto; max-height: 300px; }
|
||||
.badge {
|
||||
display: inline-block; padding: 2px 8px; border-radius: 4px;
|
||||
@@ -46,7 +46,7 @@ section.title h3 { color: #F0F0F0; font-weight: 400; font-size: 22px; margin-top
|
||||
|
||||
# Two Consumer Surfaces, One Platform
|
||||
|
||||
The platform serves **two kinds of consumer** through two coordinated interfaces — both converge on the **same contract, the same policy envelope, and the same evidence stream.**
|
||||
The platform serves **two kinds of consumer** — both converge on the **same contract, the same policy envelope, and the same evidence stream.**
|
||||
|
||||
|
||||
|
||||
@@ -57,56 +57,16 @@ The platform is **opinionated in what it accepts, regardless of who is declaring
|
||||
|
||||
---
|
||||
|
||||
# What a Developer Actually Does
|
||||
# The Contract — The Entire Consumer Surface
|
||||
|
||||
Three things. That is the entire consumer-side surface.
|
||||
|
||||
<img src="assets/png/developer-experience-02-what-dev-does.png" style="float: right; width: 45%; margin-left: 20px; margin-bottom: 10px;" />
|
||||
<img src="assets/png/developer-experience-02-what-dev-does.png" style="float: right; width: 40%; margin-left: 20px; margin-bottom: 10px;" />
|
||||
|
||||
The developer does **not**:
|
||||
|
||||
- Write infrastructure modules
|
||||
- Author workflow YAML beyond the one-line `uses:` wrapper
|
||||
- Clone the platform repo
|
||||
- Hold cloud credentials
|
||||
- Maintain a state backend, a VPC, or a runner
|
||||
|
||||
---
|
||||
|
||||
# The Citizen Developer Experience
|
||||
|
||||
A non-technical consumer ships a production deployment **by declaring intent** — without authoring a workflow, a configuration file, or an infrastructure module.
|
||||
|
||||
- The consumer opens an issue describing what they need (e.g. "a web API for the pricing service")
|
||||
- An AI agent maps the intent to a contract referencing a module from the **reviewed skill catalog**
|
||||
- The contract enters the **same pipeline** and must clear the **same confidence gate** before promotion
|
||||
|
||||
**Guardrails that make this safe:**
|
||||
|
||||
- Skills are **versioned, signed, and reviewed for sensitive data before release** (Infra & Ops owns the review)
|
||||
- Agents are **stateless** — all state lives in the platform; the platform trusts and **always verifies**
|
||||
- The agent's trace and submission confidence are captured in the contract for review
|
||||
|
||||
<span class="badge planned">Skill catalog + real agent runtime: planned</span> <span class="badge agentic">Agentic</span>
|
||||
|
||||
---
|
||||
|
||||
# The Contract
|
||||
|
||||
A 5-line YAML file. This is the entire consumer-facing interface to production.
|
||||
- **1. App code** — the consumer's service, at the top level of the repo
|
||||
- **2. A contract** — a single YAML file: module, environment, inputs
|
||||
|
||||
```yaml
|
||||
# .acdl/contract.yaml — a static site
|
||||
uses: acdl/pipelines/deploy.yaml@v1.6
|
||||
module: static-assets
|
||||
environment: dev
|
||||
inputs:
|
||||
bucket_name: my-static-site-assets
|
||||
region: us-east-1
|
||||
```
|
||||
|
||||
```yaml
|
||||
# .acdl/contract.yaml — a microservice
|
||||
uses: acdl/pipelines/deploy.yaml@v1.6
|
||||
module: microservice
|
||||
environment: dev
|
||||
@@ -115,54 +75,33 @@ inputs:
|
||||
port: 8080
|
||||
```
|
||||
|
||||
An invalid contract **fails fast at validation** with a clear error — not an opaque failure three stages in.
|
||||
- **3. A one-line CI definition** — a thin `uses:` wrapper pointing at a versioned platform workflow
|
||||
- The developer does **not**: write infrastructure modules, clone the platform repo, hold cloud credentials, or maintain a state backend
|
||||
|
||||
---
|
||||
|
||||
# No Platform Code, No Cloning
|
||||
# The Developer Feedback Loop
|
||||
|
||||
Consumers `uses:` a **versioned** central workflow. The platform fetches itself at run time. The consumer **never touches platform internals.**
|
||||
Developers see **what the platform is doing**, in real time, in their own run logs. <span class="badge testing">Testing</span>
|
||||
|
||||
|
||||
|
||||
- The consumer's CI definition is a thin wrapper — one `uses:` line
|
||||
- The runner checks out the consumer repo, then checks out the platform repo into the workspace
|
||||
- The platform installs its own runtime dependencies — the consumer installs nothing
|
||||
- When the platform ships a fix, every consumer on a floating tag gets it on their next run
|
||||
- **Streamed output by default** — the infrastructure plan, policy-check results, and each check record flow to stdout
|
||||
- **PR comments after every successful pipeline stage** — a developer always knows where they stand without refreshing a dashboard
|
||||
- **Clear, explainable halt reasons** — a policy violation, an insufficient confidence signal, or a missing attestation. **Never an opaque debugging exercise.**
|
||||
- **Connection strings posted as PR comments** — human-readable, no hunting
|
||||
- **Runtime secrets in encrypted Parameter Store** — KMS-encrypted, namespaced, **no raw secrets in logs**
|
||||
- **Errors become GitHub issues, automatically** — a failed deploy opens an issue on the platform repo
|
||||
|
||||
---
|
||||
|
||||
# Versioned, Predictable Releases
|
||||
|
||||
Consumers control **when** they absorb platform improvements.
|
||||
Consumers control **when** they absorb platform improvements. <span class="badge testing">Testing</span>
|
||||
|
||||
- **Floating MAJOR + MINOR tags** (e.g. `@v1.6`) — a consumer automatically receives patch updates within the line <span class="badge testing">Testing</span>
|
||||
- **Floating MAJOR + MINOR tags** (e.g. `@v1.6`) — a consumer automatically receives patch updates within the line
|
||||
- **Semantic versioning with a clear contract:** interface → MAJOR, behavior → MINOR, lifecycle → PATCH
|
||||
- **A consumer can pin to an exact version** for maximum stability, or float on MAJOR only (`@v1`) to absorb new features on their own cadence
|
||||
- **Unversioned references (`@main`, bare) are discouraged** — the versioned tag is the only immutability lever
|
||||
- **Automated release job** computes the next semver on merge to main, creates the tag, and updates the floating tags <span class="badge testing">Testing</span>
|
||||
|
||||
---
|
||||
|
||||
# Instant Feedback
|
||||
|
||||
Developers see **what the platform is doing**, in real time, in their own run logs. <span class="badge testing">Testing</span>
|
||||
|
||||
- **Streamed output by default** — the infrastructure plan, policy-check results, and each check record (severity, rule ID, pass/fail) flow to stdout
|
||||
- **PR comments after every successful pipeline stage** — a developer always knows where they stand without refreshing a dashboard
|
||||
- **Clear, explainable halt reasons** — a policy violation, an insufficient confidence signal, or a missing attestation. **Never an opaque debugging exercise.**
|
||||
- **A `--quiet` mode** suppresses streaming for log-only contexts
|
||||
|
||||
---
|
||||
|
||||
# Deploy Outputs That Just Work
|
||||
|
||||
After a successful deploy, the developer gets their connection information **without hunting for it** — and without secrets leaking into logs. <span class="badge testing">Testing</span>
|
||||
|
||||
- **Human-readable connection strings** posted as a structured GitHub PR comment / job summary
|
||||
- **Runtime-injectable values** written to encrypted Parameter Store (`SecureString`, KMS-encrypted, namespaced `/acdl/{env}/{contractId}/{output_name}`)
|
||||
- **No raw secrets in logs** — enforced by construction
|
||||
- **Errors become GitHub issues, automatically** — a failed deploy reports through the platform Lambda, which opens (or comments on) an issue on the platform repo. The consumer's only grant is the onboarding-granted Lambda-invoke permission
|
||||
- **Automated release job** computes the next semver on merge to main, creates the tag, and updates the floating tags
|
||||
|
||||
---
|
||||
|
||||
@@ -179,8 +118,6 @@ When no environment is bound, the platform emits a **user-friendly onboarding pr
|
||||
|
||||
The pipeline then **exits without attempting a deployment** — no partial state, no confusing errors.
|
||||
|
||||
Both onboarding paths end in a **sandbox dev submission that must pass the confidence gate** before the consumer is promoted.
|
||||
|
||||
<span class="badge planned">Citizen developer onboarding path: planned</span>
|
||||
|
||||
---
|
||||
@@ -193,7 +130,7 @@ The contract is environment-agnostic by design. Promotion is **a workflow choice
|
||||
<tr>
|
||||
<td style="width: 50%; vertical-align: top; border: none; padding-right: 12px;">
|
||||
|
||||
**Approach A — One contract, one job per environment.** The environment is passed by each job and interpolated at runtime. The contract never changes.
|
||||
**Approach A — One contract, one job per environment.** The environment is passed by each job and interpolated at runtime.
|
||||
|
||||
```yaml
|
||||
jobs:
|
||||
@@ -209,7 +146,7 @@ jobs:
|
||||
</td>
|
||||
<td style="width: 50%; vertical-align: top; border: none; padding-left: 12px;">
|
||||
|
||||
**Approach B — Environment-specific contracts.** When inputs genuinely differ per environment, each job points at its own contract file.
|
||||
**Approach B — Environment-specific contracts.** When inputs genuinely differ, each job points at its own contract file.
|
||||
|
||||
```yaml
|
||||
jobs:
|
||||
@@ -226,31 +163,19 @@ jobs:
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
<style>
|
||||
section { font-size: 18px; }
|
||||
pre { font-size: 11px; line-height: 1.2; }
|
||||
code { font-size: 11px; }
|
||||
td { font-size: 16px; }
|
||||
</style>
|
||||
|
||||
---
|
||||
|
||||
# Safe Promotion Path — The Rising Bar
|
||||
|
||||
Whichever approach a team picks, the platform applies the same rising bar:
|
||||
|
||||
| Environment | What the platform adds |
|
||||
|---|---|
|
||||
| dev | Confidence ≥ 0.50, fully autonomous <span class="badge agentic">Agentic</span> |
|
||||
| qa | QA human attestation + confidence ≥ 0.75 |
|
||||
| prod | SRE human attestation + confidence ≥ 0.90 |
|
||||
| dr | SRE human attestation + confidence ≥ 0.95 + DR drill reference |
|
||||
|
||||
- **No staging environment** — the design deliberately removes the "staging is basically prod but not really" anti-pattern
|
||||
- **Separation of duties is enforced** — the QA approver cannot be the prod approver <span class="badge testing">Design tested</span> <span class="badge planned">Wiring: planned</span>
|
||||
- **Timeout discipline** — 1 business day = warn + escalate; 2 business days = auto-freeze + re-submit
|
||||
|
||||
The DX win: the contract stays stable across environments. The safety win: the platform raises the threshold and attestation bar automatically based on the job's declared environment.
|
||||
<style>
|
||||
section { font-size: 16px; }
|
||||
pre { font-size: 10px; line-height: 1.2; }
|
||||
code { font-size: 10px; }
|
||||
td { font-size: 14px; }
|
||||
table { font-size: 14px; }
|
||||
</style>
|
||||
|
||||
---
|
||||
|
||||
@@ -269,9 +194,7 @@ with:
|
||||
A 2-step pipeline with **two SRE human-attestation gates**:
|
||||
|
||||
1. **Validate the change request** — the platform queries the CMDB; the CR must be `approved` and match the consumer repo
|
||||
2. **Disable deletion protection** (plan + apply) → **SRE approves**
|
||||
3. **Zero all counts + destroy** (plan + apply) → **a second SRE approves**
|
||||
4. **Confirmation** — the stack is destroyed
|
||||
2. **Disable deletion protection** → **SRE approves** → **Zero all counts + destroy** → **a second SRE approves**
|
||||
|
||||
The per-stack encryption key enters a **grace window** (default 30 days) so encrypted data remains recoverable.
|
||||
|
||||
@@ -294,14 +217,10 @@ Developers pick from **pre-built, security-reviewed building blocks** — they d
|
||||
|
||||
# The Desired Outcomes
|
||||
|
||||
<style>
|
||||
section { font-size: 22px; }
|
||||
</style>
|
||||
|
||||
- **Velocity without sacrificing safety.** Speed is in the ergonomics (a 5-line contract, a one-line `uses:`); safety is in the gates the consumer cannot bypass.
|
||||
- **Velocity without sacrificing safety.** Speed is in the ergonomics (a simple contract, a one-line `uses:`); safety is in the gates the consumer cannot bypass.
|
||||
- **Security, observability, and compliance as platform defaults** — not per-team effort, not post-hoc remediation. Encryption, deletion protection, uptime monitoring, policy checks, and evidence are on by construction.
|
||||
- **Auditability as a byproduct, not a project.** Every production change is traceable to a human attestation and a tamper-evident evidence event.
|
||||
- **Blast radius contained by design.** Zero-trust OIDC + ABAC means a consumer can only touch its own tagged resources.
|
||||
- **The bottleneck moves off the platform team's ticket queue.** A merged change progresses through lower environments without a platform engineer joining a thread.
|
||||
- **Infrastructure as a utility, not a craft.** The platform abstracts compute, networking, and state. Teams consume infrastructure, they don't maintain it — and the platform compounds value over time by learning from recurring patterns.
|
||||
- **A path to the citizen developer.** The same safety envelope that serves a senior engineer is the one that will serve a non-technical consumer — expanding who can ship safely without lowering the bar. <span class="badge agentic">Agentic</span>
|
||||
- **A path to the citizen developer.** The same safety envelope that serves a senior engineer will serve a non-technical consumer — expanding who can ship safely without lowering the bar. <span class="badge agentic">Agentic</span>
|
||||
File diff suppressed because one or more lines are too long
Reference in New Issue
Block a user