diff --git a/.ciagent/GRILL.md b/.ciagent/GRILL.md index 9e754c2..4e235ce 100644 --- a/.ciagent/GRILL.md +++ b/.ciagent/GRILL.md @@ -1,897 +1,207 @@ # CIAgent Grill Report -## Run: 2026-07-27 19:30 (mode: interactive, focus: all) +## Run: 2026-08-12 (mode: interactive, focus: all axes) — v1.23 Nova Deck Cleanup & Python PPTX -### Verdict: Proceed with conditions (confidence: 0.72) +### Overall Verdict: PROCEED-WITH-REVISIONS (confidence: 0.78) -Two escalations must be resolved before the leadership pitch: -- **G-005 (risks):** 6 cloud capabilities (CAP-017..022) are deploy-unverified. - **RESOLVED (v1.11):** CAP-017..022 are now Verified live-aws via the - modules-lifecycle pipeline (apply/modify/destroy exit 0). The IAM-drift - framing is removed. See CAPABILITY_INVENTORY.md. -- **G-008 (budget):** No cost documentation exists despite live AWS resources. - **RESOLVED (v1.11):** COST.md now exists, documenting the v1.0→v1.10 spend - window + the v1.11 cost projection. The v1.14 P19 phase extends the - window to v1.11–v1.14. - -The project is reclassified as an **OSS reference implementation** (G-003), -not a sponsored product. The grill's sponsor/ROI/budget/timeline axes apply -in weakened form; the adoption, architecture, and risks axes apply in full. - -### Axis 1 — Business Case -- **Q1**: What problem does this actually solve, and is that problem still the top priority? - - Evidence: PROJECT.md:3-21 (vision + North Star); G-003 reframing (OSS reference) - - Answer: ACDL is an OSS reference implementation showing the shape of an agentic cloud delivery platform. The problem (cognitive load of infra + operational work of safe change) is documented in docs/vision.md. - - Confidence: 0.85 - - Decision: G-003 — reframe as OSS reference implementation; no sponsor/ROI required. -- **Q2**: Who is the named executive sponsor, and when did they last make a decision under pressure? - - Evidence: MISSING (no named sponsor in any .ciagent/ file) - - Answer: Not applicable for an OSS reference implementation (G-003). Senior leadership requesting the pitch is interest, not sponsorship. - - Confidence: 0.85 - - Decision: G-003 (carries forward). -- **Q3**: What happens to the business if the project is cancelled? - - Evidence: PROJECT.md:487 ("0 consumer adoption"); 10 milestones shipped with no consumers - - Answer: If cancelled, no consumer loses a deployed system. The reference value (clonable shape) persists in the repo. Cancellation cost is low — consistent with OSS reference framing. - - Confidence: 0.80 - - Decision: G-003 (carries forward). -- **Q4**: Is the ROI calculated against a counterfactual? - - Evidence: MISSING (no ROI calculation anywhere) - - Answer: Not applicable for an OSS reference implementation. The bar is "is it a credible, demonstrable reference?" not "is there a paying customer?" - - Confidence: 0.85 - - Decision: G-003 (carries forward). - -### Axis 2 — Scope and Requirements -- **Q1**: Is the scope expanding, contracting, or genuinely stable? - - Evidence: ROADMAP.md (v1.0→v1.10, 55 phases); v1.7 added uptime-kuma + decommission + RDS; v1.9.x added decks; v1.10 added regression-class VERIFY + local emulators - - Answer: Expanding. The Out-of-Scope table (REQUIREMENTS.md:61-72) is scoped to v1.1 only; later milestones added scope without boundary updates. - - Confidence: 0.70 - - Decision: G-010 — OSS scope is contributor-bounded; no out-of-scope table needed. -- **Q2**: Who owns the requirements, and have they been frozen? - - Evidence: REQUIREMENTS.md (115 REQs, REQ-01..REQ-115); config.json autonomy=full - - Answer: The user owns requirements via CLARIFY auto-resolution under full autonomy. Not frozen — each milestone adds REQs. - - Confidence: 0.70 - - Decision: G-010 (carries forward). -- **Q3**: What is explicitly out of scope? - - Evidence: REQUIREMENTS.md:61-72 (v1.1 Out-of-Scope table only); PROJECT.md:42-51 (Domain Boundaries) - - Answer: Domain Boundaries section (PROJECT.md:42-51) defines durable out-of-scope: application business logic, IDE workflows, product backlog, node/OS-level compute. No per-milestone out-of-scope updates since v1.1. - - Confidence: 0.65 - - Decision: G-010 — contributor-bounded scope accepted for OSS reference. -- **Q4**: Are there hidden requirements only disclosed late in delivery? - - Evidence: v1.10 milestone (decay disclosure, PROJECT.md:59-67) — 7 adapter defects undisclosed across 8 phases - - Answer: Yes — the v1.10 decay incident is a late-disclosed hidden requirement (reproducibility). D-091 regression gate is the mitigation. - - Confidence: 0.72 - - Decision: G-007 (carries forward — milestone-level regression gate catches late-disclosed decay). - -### Axis 3 — Architecture and Technical Feasibility -- **Q1**: Has the proposed architecture been validated by the people who will build and operate it? - - Evidence: PERSONAS.md (agent personas only); ARCHITECTURE.md (29KB); no human reviewer sign-off - - Answer: Validated by the agent that built it, not by a downstream platform team. Acceptable for an OSS reference (G-002 — Platform Team joins post-clone). - - Confidence: 0.72 - - Decision: G-002 (carries forward). -- **Q2**: What is the integration surface? - - Evidence: ARCHITECTURE.md; adapters/ (terraform, wiz, kyverno, local emulators); contracts/ schema - - Answer: Contract schema (upstream) + engine adapters (downstream). Integration is bounded by the IR + PolicyCheckResult schemas. - - Confidence: 0.78 - - Decision: (resolved by existing architecture; no new binding decision) -- **Q3**: Is there an existing system being replaced? - - Evidence: PROJECT.md:7-8 (vision: absorb cognitive load + operational work) - - Answer: ACDL replaces manual platform engineering + ticket-driven delivery. No existing system in this repo; downstream teams replace their own. - - Confidence: 0.75 - - Decision: (resolved by G-002 white-label framing) -- **Q4**: What is the technical debt being inherited, and is it budgeted for? - - Evidence: v1.10 decay (7 adapter defects); D-091 regression gate at milestone completion (not per-phase) - - Answer: Diff-scoped VERIFY debt was paid down in v1.10. Per-phase regression gap is accepted debt (G-007). - - Confidence: 0.70 - - Decision: G-007 — milestone-level regression gate is correct; inter-milestone decay is an accepted trade-off. - -### Axis 4 — People, Skills, and Organization -- **Q1**: Which 2-3 people, if they left, would the project fail? - - Evidence: PERSONAS.md (agent personas); all binding decisions made by the user (D-034, D-090, G-001..G-012) - - Answer: One person — the user. Bus factor is 1. - - Confidence: 0.82 - - Decision: G-011 — single-maintainer is normal for OSS reference; no action. -- **Q2**: Are the assigned resources actually allocated at the percentages claimed? - - Evidence: config.json (autonomy=full, max_concurrent_agents=5) - - Answer: The agent is the resource; allocation is 100% when invoked, 0% otherwise. No BAU fire-fighting claim to verify. - - Confidence: 0.78 - - Decision: G-011 (carries forward). -- **Q3**: Is there a product owner with actual authority to prioritize? - - Evidence: config.json (autonomy=full, decision_confidence_threshold=0.6) - - Answer: The user is the product owner with absolute authority (full autonomy within user-locked constraints). - - Confidence: 0.80 - - Decision: G-011 (carries forward). -- **Q4**: Is the team building capability they don't have? - - Evidence: RESEARCH.md (101KB); local emulating adapters (Phase 53) — capability was built and proven - - Answer: No — the agent built and verified the capability. Not a prototype-hoping-to-learn scenario. - - Confidence: 0.78 - - Decision: (resolved by existing evidence) - -### Axis 5 — Timeline and Estimates -- **Q1**: Was the deadline set before or after the scope was understood? - - Evidence: ROADMAP.md (v1.0 07-21 → v1.10 07-27, 6 days); no deadline documented anywhere - - Answer: No deadline. Milestones complete when the agent finishes committing. - - Confidence: 0.78 - - Decision: G-006 — autonomous OSS build has no deadline; cadence is fine. -- **Q2**: What is the project's critical path? - - Evidence: MISSING (no critical path analysis) - - Answer: Not applicable — no deadline means no critical path to push. - - Confidence: 0.75 - - Decision: G-006 (carries forward). -- **Q3**: Are the estimates evidence-based? - - Evidence: MISSING (no estimates; phases complete in agent-time) - - Answer: No estimates. The cadence is a function of agent speed, not engineering sizing. - - Confidence: 0.72 - - Decision: G-006 (carries forward — acceptable for autonomous OSS reference). -- **Q4**: Is there a working definition of done? - - Evidence: VERIFY.md; AUDIT.md; 4-layer verify gate (structural, behavioral, security, quality) - - Answer: Yes — the 4-layer verify gate + regression gate (D-091) is the definition of done. "Done" is not "whatever the latest demo shows"; it is a gated, audited state. - - Confidence: 0.80 - - Decision: (resolved by existing verify gate) - -### Axis 6 — Budget and Financial Realism -- **Q1**: What percentage of the budget is already spent vs. remaining? - - Evidence: MISSING (no budget file in .ciagent/) - - Answer: Unresolved — no budget documented. - - Confidence: 0.50 - - Decision: G-008 — ESCALATION. -- **Q2**: Are there predictable cost drivers not in the original budget? - - Evidence: config.json escalation_hooks (deploy, delete_data); CAP-013..016 verified against live AWS account 581513795199 - - Answer: Yes — live AWS resources exist (S3 state, DynamoDB outbox, ECS, CloudFront). No cost driver documentation. - - Confidence: 0.60 - - Decision: G-008 (carries forward — escalation). -- **Q3**: What's the burn rate, and how long until the money runs out? - - Evidence: MISSING - - Answer: Unresolved. - - Confidence: 0.40 - - Decision: G-008 (carries forward — escalation). -- **Q4**: Is the budget contingent on something that hasn't happened yet? - - Evidence: MISSING - - Answer: Unresolved — likely contingent on the leadership pitch yielding a pilot platform team (G-001). - - Confidence: 0.55 - - Decision: G-008 (carries forward — escalation). - -### Axis 7 — Risks, Assumptions, and Dependencies -- **Q1**: What are the top 3 assumptions the plan rests on? - - Evidence: PROJECT.md:79-88 (CAP-017..022 IAM-gated); D-039 (OIDC federation deferred, blocked on go-gitea/gitea#36988); D-090 (no cap on re-verification sweep) - - Answer: (1) Terraform plan path proves deployability. (2) Local emulators prove runtime behavior. (3) Gitea OIDC will eventually merge. - - Confidence: 0.72 - - Decision: (resolved by G-005 escalation) -- **Q2**: What are you dependent on outside the team? - - Evidence: PROJECT.md:79-88 (admin principal needed for IAM re-bootstrap); go-gitea/gitea#36988 (OIDC blocker) - - Answer: An admin AWS principal (for CAP-017..022) and the Gitea OIDC PR (for D-039 waiver closure). - - Confidence: 0.78 - - Decision: G-005 (carries forward — escalation). -- **Q3**: What is the single risk that, if it materializes, kills the project? - - Evidence: CAPABILITY_INVENTORY.md §"Cloud capabilities NOT re-verified" (6 of 22 capabilities, 27%) - - Answer: The unverifiable deploy path for CAP-017..022. If the terraform plan path does not translate to a real deploy, 27% of advertised capability is fictional. - - Confidence: 0.80 - - Decision: G-005 — ESCALATION. -- **Q4**: Have you done a pre-mortem? - - Evidence: MISSING (no pre-mortem document) - - Answer: No pre-mortem on file. The v1.10 decay incident is the closest thing to a post-mortem. - - Confidence: 0.65 - - Decision: (flagged; no binding decision — user accepted autonomous governance in G-009) - -### Axis 8 — Governance, Decision-Making, and Communication -- **Q1**: Who is the decision-maker when two executives disagree? - - Evidence: config.json (autonomy=full); no human governance body documented - - Answer: The user is the single decision-maker. No executive disagreement is possible because there is no executive body. - - Confidence: 0.78 - - Decision: G-009 — autonomous CI is the governance. -- **Q2**: How often does governance meet, and what's the escalation pattern? - - Evidence: config.json (escalation_hooks: deploy, delete_data, merge_to_main; escalation_timeout_ms: 300000) - - Answer: Governance is event-driven (escalation hooks), not cadence-driven. 5-minute timeout. - - Confidence: 0.72 - - Decision: G-009 (carries forward). -- **Q3**: What is being omitted from the status reports? - - Evidence: v1.10 decay disclosure (PROJECT.md:59-67) — 8 phases omitted the decay from status - - Answer: The v1.10 incident is direct evidence that status reports (decks) omitted material decay. D-094 (rewrite to verified reality) is the correction. - - Confidence: 0.75 - - Decision: (resolved by D-094 + G-007 regression gate) -- **Q4**: Is there a "stop the project" trigger? - - Evidence: MISSING (no stop-trigger documented) - - Answer: No formal stop-trigger. The user is the single point of cancellation authority. - - Confidence: 0.68 - - Decision: G-009 — autonomous CI is the governance; no human stop-trigger needed. - -### Axis 9 — Change, Adoption, and Operational Readiness -- **Q1**: Who will use this, and what is in it for them? - - Evidence: PROJECT.md:487 ("0 consumer adoption"); G-001 (MVP for leadership pitch + pilot consumers) - - Answer: Pilot platform teams (post-pitch) will clone, customize, and deploy for their internal consumers. The value to them is a working reference shape. - - Confidence: 0.65 - - Decision: G-001 — feature-complete MVP for pitch + pilot consumers in parallel. -- **Q2**: Is the operations/support team involved now or being handed a finished product? - - Evidence: MISSING (no Platform Team involvement in 55 phases); G-002 (white-label, out-of-repo) - - Answer: Intentionally out-of-scope — ACDL is white-label; Platform Team customization happens outside this repo. - - Confidence: 0.78 - - Decision: G-002 — white-label; Platform Team customization is out-of-repo. -- **Q3**: What is the rollback plan if it goes wrong? - - Evidence: D-070 (decommission mode, 2-step pipeline with HITL SRE gates) - - Answer: Decommission mode exists for deployed stacks. For the reference repo itself, rollback = git revert (no production state to roll back). - - Confidence: 0.75 - - Decision: (resolved by existing D-070 decommission mode) -- **Q4**: Has anyone validated the success criteria with the people who will judge success? - - Evidence: PROJECT.md (leadership pitch requested); no documented success-criteria validation with leadership - - Answer: The leadership pitch IS the validation moment. Success criteria for an OSS reference = "leadership says this is a credible shape." - - Confidence: 0.68 - - Decision: G-001 (carries forward — pitch is the validation). - -### Meta — Closing Review -- **Q1**: If you were the auditor, what would you flag? - - Evidence: This grill run - - Answer: (1) 6 unverifiable cloud capabilities (G-005). (2) No cost documentation (G-008). (3) Vision doc vs. OSS-reference framing tension (G-004 — resolved by keeping vision as target-state description). - - Confidence: 0.78 - - Decision: (aggregated; G-005 + G-008 are the actionable flags) -- **Q2**: What is the project not doing that it should? - - Evidence: MISSING (no pre-mortem, no cost doc, no Platform Team engagement, no stop-trigger) - - Answer: Documenting the operating model (cost, deploy verification, governance) for a downstream team. The grill surfaced this across G-005, G-008, G-009. - - Confidence: 0.75 - - Decision: (aggregated; G-005 + G-008 are the actionable items) -- **Q3**: What is the simplest possible version that could deliver 80% of the value? - - Evidence: ROADMAP.md (v1.1 spike, Phase 10, REQ-27 — core E2E proven); v1.2-v1.10 (45 phases of expansion) - - Answer: The v1.1 spike (contract → IR → terraform plan → Checkov → confidence → outbox) is the 80%-value version. The full 115-requirement build is accepted as the reference value (G-012). - - Confidence: 0.68 - - Decision: G-012 — full catalog is the value; no minimal release needed. -- **Q4**: What would have to be true for this to succeed in the next 90 days, and is it true today? - - Evidence: G-001 (pitch + pilot); G-005 (IAM re-bootstrap); G-008 (cost doc) - - Answer: (1) Leadership pitch yields a pilot platform team — NOT TRUE today (pitch not yet delivered). (2) CAP-017..022 deploy path is verifiable — NOT TRUE today (G-005 escalation). (3) Cost operating model is documented — NOT TRUE today (G-008 escalation). - - Confidence: 0.72 - - Decision: (aggregated; G-005 + G-008 + G-001 pitch are the 90-day conditions) - -### Binding Decisions -| ID | Axis | Decision | Confidence | -|----|------|----------|-----------| -| G-001 | adoption | Feature-complete MVP for leadership pitch + pilot consumers in parallel; CIAgent builds, Platform Team deploys | 0.65 | -| G-002 | adoption | ACDL is white-label; Platform Team customization is out-of-repo; resolves ops-handoff concern | 0.78 | -| G-003 | business | Reframe as OSS reference implementation; no sponsor/ROI required | 0.85 | -| G-004 | business | Keep production-deployment vision; reference describes target state | 0.75 | -| G-005 | risks | ESCALATION — re-bootstrap IAM or mark CAP-017..022 deploy-unverified in decks | 0.80 | -| G-006 | timeline | Autonomous OSS build has no deadline; cadence acceptable | 0.72 | -| G-007 | architecture | Milestone-level regression gate is correct; system worked as designed | 0.70 | -| G-008 | budget | ESCALATION — add COST.md or document zero-cloud-cost operating model | 0.74 | -| G-009 | governance | Autonomous CI is the governance; no human stop-trigger needed | 0.68 | -| G-010 | scope | OSS scope is contributor-bounded; no out-of-scope table needed | 0.65 | -| G-011 | people | Single-maintainer is normal for OSS reference; no action | 0.70 | -| G-012 | meta | Full catalog is the value; no minimal release needed | 0.68 | - -### Escalations -- **[G-005] risks** — 6 cloud capabilities (CAP-017..022: DynamoDB contracts table, Lambda contract-ingestor, ECS service live, CloudFront production stack, uptime-kuma, OIDC role) are deploy-unverified. The `acdl-spike-runner` IAM user cannot fix its own IAM (chicken-and-egg). Either re-bootstrap IAM with an admin principal to re-verify, or explicitly mark these 6 as "design-verified, deploy-unverified" in every leadership deck before the pitch. Resolves: project-killing risk (Axis 7 Q3). -- **[G-008] budget** — No cost documentation exists in `.ciagent/` despite live AWS resources (account 581513795199, CAP-013..016 verified). Either add a `COST.md` documenting monthly AWS spend, or explicitly document that ACDL runs at zero cloud cost (local emulators are the primary tier; live-AWS is a one-off spike per milestone). Resolves: financial-control gap (Axis 6 Q1-Q4). +The plan is fundamentally sound — the empirical checks (image format, Marp +`
` passthrough, versioning, test-inversion completeness) all pass. But +four binding revisions restructure the wave/phase plan and expand the +"penetrate" purge scope. Two axes were escalated-but-resolved (the empirical +verifications de-risked P2 and P3). The plan proceeds with the revisions +below. --- -## Run: 2026-07-29 20:25 (mode: adversarial, focus: v1.14 NFR plan) +### Per-Axis Findings -### Verdict: FEASIBLE WITH BINDING DECISIONS (confidence: 0.72) +#### Axis 1 — Scope / over-reach: PASS (conf 0.80) +Building a whole new `render_pptx.py` + markdown parser is significant for a +"deck cleanup" milestone, but REQ-269 explicitly mandates it, the milestone +is NFR docs/render/test-only (no runtime impact), and the dual-PPTX value +(MARP image-of-slide + python structured/editable) is a real deliverable, not +gold-plating. The G-003 split (P3a/P3b) mitigates the parser-complexity risk. +The plan stays in scope; it does not reach into the deck's 4-beat narrative +arc (out-of-scope section confirms). -The v1.14 milestone is a sound, well-evidenced NFR sweep with a genuine, -traceable backlog. Not fundamentally infeasible. Four binding decisions -close plan defects + unverified assumptions that would otherwise re-expose -the v1.11 4-VPC failure mode. One escalation (E-001) auto-resolved at full -autonomy with assumption logging. +#### Axis 2 — Hidden dependencies (P3/P4 "zero file overlap"): REVISE → G-002 (conf 0.85) +The "zero file overlap" claim is true for EDITS but false for VERIFICATION. +P3's `render_pptx.py` parsing logic depends on the deck markdown structure +that P4 is simultaneously trimming; P4's verify step runs `render_slides.sh` +that P3 is mid-editing. **Binding revision G-002:** serialize P3→P4. -### 9-Axis scores +#### Axis 3 — Test inversion risk: PASS (conf 0.92) +The plan's test-update list (Finding 5 / P5 tasks) is complete and accurate. +Empirically confirmed all affected tests: +- `test_marp_deck_not_using_default_theme` (line 66-74: invert — we now USE + `theme: default`) ✓ plan mentions +- `test_marp_deck_uses_sp_theme` (line 55-64: rewrite to assert inline `style:` + block) ✓ plan mentions +- `test_theme_css_*` trio (lines 275, 284, 295: retarget to inline `style:`) ✓ +- `test_html_embeds_theme` (line 353: `--sp-red` → `#D6002A`) ✓ plan mentions +- `test_source_md_*` pair (lines 240, 266: delete — plain `.md` gone) ✓ +- `test_render_slides_script_renders_marp` (line 92: still produces `.pptx` + via marp-cli for the fallback PPTX) — ✓ plan handles +- No latent assertions missed. The plan's enumeration is thorough. -| Axis | Confidence | Forcing question (short) | -|------|-----------|---------------------------| -| 1 Business | 0.80 | Real backlog (5 P1 + 4 P2 + 6 swallowed errors + 15+ hardcoded IDs); cancellation survivable but inherits decay risk | -| 2 Scope | 0.70 | User-directed + frozen; P13 has a hidden feature door (implement vs remove); P2 conditional-child edges past wiring | -| 3 Architecture | 0.62 | P8 grep unsatisfiable for backend blocks; P8 state-bucket continuity unguarded; P9 IAM naming unverified; P4/P8 file overlap | -| 4 People | 0.85 | Agentic single-operator; runtime availability is the key-person risk | -| 5 Timeline | 0.68 | No deadline; 20-phase unverified span is the longest since G-007; P8 is the latent multi-phase-rework risk | -| 6 Budget | 0.85 | NFR-only, no new AWS resources; P8 re-creation is a one-shot accident not structural cost | -| 7 Risks | 0.60 | A1 (acdl-* naming unverified), A2 (fallback constant unbound), A3 (P4 gate hardening); kill-risk = P8 orphans state | -| 8 Governance | 0.72 | Full autonomy; no mid-milestone stop trigger; per-phase "green" ≠ "capabilities Verified" | -| 9 Adoption | 0.70 | No external users; rollback is git-level for code, AWS-state rollback unaddressed if P8 misfires pre-detection | +#### Axis 4 — Image-inlining correctness: PASS (conf 0.95) +Empirically verified the rendered HTML at +`docs/presentations/nova-autonomous-cloud-delivery.html` uses plain +`` and +`` — standard `` tags +inside Marp's SVG `` wrapper. Zero `xlink:href` occurrences. +The `inline_images.py` regex (`` HTML blocks) plus edge cases +(tables with `**bold**` R/A cells, nested bullets, `class:tall` image alt +text) plus two python-pptx constraints (no CSS font fallback — single +`font.name`; blank layout has no bullets — must inject `` XML). +Finding 3 confirmed the APIs exist but the parser is non-trivial. With P3 +on the serial critical path (G-002), an overflow blocks everything. +**Binding revision G-003:** split P3 into P3a (inline_images + render_slides.sh ++ pyproject — low-risk mechanical) and P3b (render_pptx.py + parser + the +attach_release_asset.py extension — high-risk). + +#### Axis 6 — Benefit callout `
` in Marp: PASS (conf 0.95) +Empirically verified by rendering a minimal test deck through +`@marp-team/marp-cli@4.5.0` (the pinned version): `
text
` +passes through verbatim into the rendered `
`. Marpit's `html: true` +option is on by default; no sanitization of styling divs. The `.benefit` class +in the inline `style:` block will apply. P2's restyle approach is valid. +**P0 risk cleared.** + +#### Axis 7 — "penetrate" removal completeness: REVISE → G-001 (conf 0.85) +CRITICAL gap. The plan's verify step `grep -ri penetrat docs/presentations/` +misses `docs/scope.md` (line 16: "Nova never penetrates the PDLC") and +`docs/vision.md` (line 18: "It does not penetrate upstream product or +software development lifecycles") — the repo's two core strategic docs. The +term also appears in every `.ciagent/` file (PLAN, REQUIREMENTS, RESEARCH, +CLARIFY, ROADMAP, PROJECT, PERSONAS, NORTH_STAR). The deck does not link out +to these docs, but they are audience-reachable via the repo. +**Binding revision G-001:** purge "penetrate" (and derivatives) from the +entire repo — `docs/` AND `.ciagent/`. P4's verify step becomes +`grep -ri penetrat docs/ .ciagent/` returns nothing. `test_no_penetrate_term` +asserts the same. The deleted plain `.md` (P1) already removes its +occurrence; `docs/scope.md` + `docs/vision.md` reworded in P4; all +`.ciagent/` files reworded across the relevant phases (the phase that owns +each file's edit window). + +#### Axis 8 — Wave 3 parallelization feasibility: REVISE → G-002 (conf 0.85) +Resolved by G-002 (serialize P3→P4). Wave 3 is no longer parallel. P3's +`render_slides.sh` is stable before P4 runs its verify render; P3's parser +is tested against the current (untrimmed) deck before P4 trims it. + +#### Axis 9 — Phase count vs. value: REVISE → G-004 (conf 0.80) +G-003 split P3 (→8 phases); G-004 merges P5+P6 to compensate. P6 +(final-review-ship) for an NFR docs-only milestone is largely ceremonial — +the review/audit/ship work folds into P5's final commits. **Binding revision +G-004:** merge P5+P6. Net phase count returns to 7. + +#### Axis 10 — Versioning: PASS (conf 0.95) +`git tag --list 'v1.22.*'` returns nothing — no conflicts. The v1.21.x line +(v1.21.0..v1.21.6) is the precedent; v1.23 tags v1.22.0..v1.22.6 per the +revised phase plan (G-003 split shifts tag numbers; G-004 merge keeps the +final at v1.22.6). + +--- ### Binding Decisions -| ID | Axis | Decision | Confidence | -|----|------|----------|-----------| -| G-101 | architecture | P8 grep scope amended to exclude terraform `backend "s3"` blocks (bucket arg is static-config-only, evaluated pre-init; cannot reference `data.aws_caller_identity`). Resource ARNs in policy/code ARE externalized; backend blocks stay literal or move to `-backend-config` (separate change). | 0.80 | -| G-102 | risks | P8 must bind `ACDL_AWS_ACCOUNT_ID` fallback to the live account ID (not a placeholder) AND the lifecycle workflow (full-mode jobs) must set `ACDL_AWS_ACCOUNT_ID` from `aws sts get-caller-identity` before any lifecycle invocation. No full-mode run proceeds with the env unset. | 0.78 | -| G-103 | scope | P13 must take the removal+documentation path (remove `--kube-version` + document deferral to GitOps reconciler roadmap), NOT the implementation path. Implementing version-aware policy selection is a new feature, violating D-095. | 0.85 | -| G-104 | architecture | P9 must verify (grep/audit of `modules/l1/*/terraform/main.tf` + `modules/l2/*/composition.json`) that every IAM role + KMS key created by the lifecycle pipeline matches `acdl-*` prefix before merge. CloudFront + WAFv2 (CloudFront scope) remain `Resource: "*"` with a documented global-ARN constraint. | 0.70 | -| G-105 | governance | P4's regression-gate hardening must be validated by running the full regression gate immediately after P4 lands (not deferred to P21). Gate must pass clean post-P4 before W2 begins. | 0.70 | -| G-106 | governance | A mid-milestone regression-gate checkpoint is added after W2 (P12), before W3 begins. Gate runs offline (D-091); a non-Verified result halts W3 until fixed. Not a re-litigation of G-007 (per-phase stays deferred) — a single checkpoint at the natural seam after the security wave. | 0.65 | +| ID | Decision | Confidence | Rationale | +|----|----------|-----------|----------| +| G-001 | Purge "penetrate" (and derivatives) from the entire repo — `docs/` AND `.ciagent/`, not just `docs/presentations/`. P4 verify: `grep -ri penetrat docs/ .ciagent/` returns nothing. `test_no_penetrate_term` asserts the same. `docs/scope.md:16` + `docs/vision.md:18` reworded in P4; all `.ciagent/` files reworded in the phase that owns each file's edit window. | 0.85 | The term appears in the repo's two core strategic docs (audience-reachable) and all internal metadata. REQ-272 says "removed from all presentation files"; the user confirmed a full-repo purge (politically loaded term). The plan's `docs/presentations/`-only grep is a gap. | +| G-002 | Serialize P3→P4. Wave 3 is no longer parallel. P3 completes (stable `render_slides.sh` + tested parser against the current deck) before P4 trims the deck + purges "penetrate" (per G-001). C8's parallelization rationale is overruled. | 0.85 | "Zero file overlap" is true for edits but false for verification: P3's parser depends on the deck structure P4 is trimming; P4's verify render depends on P3's `render_slides.sh` being stable. The interaction risk is the failure mode. | +| G-003 | Split P3 into P3a (inline_images.py + render_slides.sh inline-images step + pyproject.toml — low-risk mechanical) and P3b (render_pptx.py + the full markdown parser + render_slides.sh python-pptx step + attach_release_asset.py extension — high-risk). Both serial in Wave 3. | 0.80 | The parser handles 10+ markdown constructs + python-pptx XML constraints (font fallback, bullet injection); on the serial critical path (G-002) an overflow blocks everything. Splitting isolates the high-risk work. | +| G-004 | Merge P5+P6. P5 absorbs the final-review/audit/ship work (multi-persona review, reconstruction audit, milestone merge, tag, release, branch cleanup, REQUIREMENTS/ROADMAP update) as its final commits. Tag v1.22.6 = milestone release. | 0.80 | For an NFR docs-only milestone, a dedicated review/ship phase is ceremonial overhead. P5 already asserts the final state via tests. The merge compensates for the G-003 split, returning to 7 phases. | ### Escalations -- **[E-001] risks** — P8 state-bucket continuity re-exposes the v1.11 4-VPC - root cause. G-102 proposes a binding mitigation (bind fallback + wire env - into workflow), but the residual risk (a future full-mode lifecycle run - with a misconfigured env orphans live state and re-creates resources) - cannot be reduced below 0.20 by plan-level decisions alone. **Auto- - resolved at full autonomy (D-101):** accept the residual risk; G-102's - binding mitigation (fallback bound to live account ID + workflow env - wiring) is the control. The lifecycle pipeline defaults to plan-only - (REQ-134) — full-mode runs are workflow_dispatch only, reducing the - accident surface. If the user prefers zero residual risk, direct that - P8 exclude the state-bucket name from externalization entirely - (externalize only resource ARNs, leave the backend `bucket` literal). - Confidence 0.55; auto-resolved per `config.autonomy.level=full`. +None. All axes resolved at confidence ≥ 0.78. Two axes (4 and 6) were +escalation candidates (P0 risks if the empirical checks failed) but both +were cleared by direct verification — the rendered HTML uses plain `` (not SVG xlink:href), and Marp 4.5.0 passes through +`
` verbatim (empirically confirmed with a minimal test +deck). --- -## Run: 2026-07-30 (mode: interactive, focus: v1.15-Nova rebrand, all 9 axes) +### Revised Wave/Phase Plan (post-revisions) -### Verdict: Proceed with conditions (confidence: 0.82) +``` +Wave 1 (P1): consolidate-docs (edits -marp.md, deletes plain .md) + ↓ +Wave 2 (P2): restore-clean-style (edits -marp.md frontmatter + + ↓ benefit callouts; edits render_slides.sh; retires + nova-sp-theme.css from render) + ↓ +Wave 3 (P3a → P3b, serial): + P3a: inline-images (inline_images.py + render_slides.sh step + pyproject) + ↓ + P3b: python-pptx-generator (render_pptx.py + parser + render_slides.sh + step + attach_release_asset.py extension) + ↓ +Wave 4 (P4): trim-wordcount + purge "penetrate" (edits -marp.md + + ↓ talking-points.md + docs/scope.md + docs/vision.md + + all .ciagent/ files per G-001) + ↓ +Wave 5 (P5+P6 merged): ci-tests-readme + final-review-ship (tests, CI, + README, multi-persona review, audit, ship — + tag v1.22.6 = milestone release) +``` -A Major/breaking rebrand (ACDL → Nova) across prose, decks, code, env vars, -consumer path, SSM path, AWS tag keys, and AWS resource names — 4 execution -phases + 1 final. The plan is technically sound and the scope is user-directed -(D-102..D-112). Three binding mitigations surfaced (G-104, G-106, G-108); the -rest accept the plan as written. Two findings carry residual risk that is -accepted at full autonomy (G-103, G-107). No escalations remain open — all -auto-resolved with assumption logging per `config.autonomy.level=full`. +### Revised Tag Plan -The single most material correction: **the versioning scheme was wrong**. -The plan tagged a Major/breaking milestone on the v1.14.x PATCH line -(`v1.14.5` = release), contradicting every prior breaking milestone in the -project (v1.1→v1.2.0, v1.5→v1.5.0, v1.11→v1.11.0 — all minor bumps). The -quoted "Major = progressive minor per phase" rule does not exist in any repo -file. **G-104 binds: re-tag as v1.15.x minor-bumped phases** (P1→v1.15.0 … -P5→v1.15.4, with v1.15.4 IS the milestone release). +- v1.22.0 (P0 — already tagged) +- v1.22.1 (P1) +- v1.22.2 (P2) +- v1.22.3 (P3a) +- v1.22.4 (P3b) +- v1.22.5 (P4) +- v1.22.6 (P5+P6 merged — final patch = milestone release) -### Per-axis findings +### P4 expanded scope (per G-001) -#### Axis 1 — Feasibility -**Challenge:** Can the full rebrand (1,465 `ACDL`/`acdl` occurrences across 205 -files, 21 env vars, 11 AWS resources, 5 tag keys, 67 SSM refs, 23 consumer-path -refs) actually be done in 4 execution phases? The migration ordering -(docs→code/env→SSM/tags→AWS resources→final) is sound: P1 has no runtime impact, -P2's dual-read fallback prevents deployment breakage, P3's parallel-tag period -prevents ABAC lockout, P4's staged terraform migration prevents a big-bang -failure. The phase dependencies (P2 depends on P1's migration guide; P3 depends -on P2's dual-read + nova_tagging warn mode; P4 depends on P3's hard-mode tag -enforcement; P5 depends on all) are correctly ordered. **Confidence 0.85** that -the 4-phase structure is feasible. The `terraform init -migrate-state` approach -for the state bucket is the documented, correct mechanism (back up state JSON -first). No hidden dependencies found: the `.env.secrets` direct-read path -(G-106) and the Gitea secrets rotation (G-108) are the only mechanic gaps, both -now bound. **Verdict: ACCEPT-AS-IS.** **G-103.** +P4 now owns, in addition to the deck word-count trim: +- `docs/scope.md:16` — reword "Nova never penetrates the PDLC" +- `docs/vision.md:18` — reword "It does not penetrate upstream product or + software development lifecycles" +- `.ciagent/PLAN.md`, `REQUIREMENTS.md`, `RESEARCH.md`, `CLARIFY.md`, + `ROADMAP.md`, `PROJECT.md`, `PERSONAS.md`, `NORTH_STAR.md` — reword every + "penetrate" occurrence (or the phase that owns each file's edit window + does so; P4 is the natural owner since it owns the "penetrate" removal + requirement REQ-272). -#### Axis 2 — Scope -**Challenge:** Is the full AWS resource rename WITH migration (downtime -accepted) over-scoped for a rebrand? D-102 locked this as user-directed. The -alternative (rename code only, leave AWS resources as `acdl-*`) would leave a -permanent brand inconsistency between code and cloud — acceptable for an NFR -patch, not for a "Major/breaking" milestone. The S&P visual theme is correctly -out of scope (D-107). The real Gitea repo name stays `acdl` (D-105) — sensible -(repo rename is a separate operational burden). Past Gitea release titles stay -`ACDL vX.Y.Z` (forward-only) — sensible (no history rewrite). Git branch/tag -naming has no brand name (D-112) — sensible. **Missing from scope:** the CI -workflow secret-references (`.gitea/workflows/*` `secrets.ACDL_*`) — P2 task 3 -creates `NOVA_*` Gitea secrets but the plan does not show the workflow YAML -`secrets:` references being updated; G-108 binds the mitigation. **Confidence -0.80.** **Verdict: ACCEPT-AS-IS.** **G-104** (versioning — see Axis 5). +### P5 expanded scope (per G-004) -#### Axis 3 — Cost -**Challenge:** What's the real cost (downtime, person-hours, risk) and is it -justified for a *rebrand*? Per A1 (conf 0.9), no live AWS apply during P0–P4 — -so the migration scripts are authored but not executed; the live apply is an -operator runbook step. Person-hours are the agent's own (autonomous OSS -reference, G-003 carries forward). Downtime is accepted (D-102) but deferred to -the operator runbook. Token cost: the 1,465-occurrence rename across 205 files -is a large but mechanical edit — the explore survey already quantified the -mechanical-vs-judgment split. The risk cost (DynamoDB data loss, state bucket -corruption, ABAC lockout) is mitigated by the staged ordering + dual-read + -parallel-tag — all plan-validated, not live-applied. For an OSS reference with -0 consumer adoption (PROJECT.md:487), the cost is bounded. **Confidence 0.80.** -**Verdict: ACCEPT-AS-IS.** **G-105.** - -#### Axis 4 — Schedule / risk -**Challenge:** DynamoDB data loss, state bucket migration, ABAC breakage, -consumer disruption. The mitigations: (a) DynamoDB scan+copy with row-count -verification, keep old tables until verified (manual post-verification deletion -— point of no return documented); (b) state bucket `terraform init --migrate-state` with state JSON backup first; (c) parallel-tag ABAC period -(emit nova:* + acdl:* → swap policy → remove acdl:*); (d) consumer disruption -mitigated by the dual-read fallback (P2–P4) + the migration guide (P1). The top -3 assumptions: A1 (no live apply — conf 0.9, verified by the established -v1.11–v1.14 pattern), A2 (.env.secrets keys renamed, values stay — conf 0.85, -now bound by G-106), A3 (Gitea release API reachable — conf 0.8, verified HTTP -200). The single risk that could kill the project: state bucket corruption -during `-migrate-state` — mitigated by the backup-first runbook step. No -pre-mortem beyond the runbook is documented, but the staged ordering IS the -de-facto pre-mortem mitigation. **Confidence 0.78.** **Verdict: ACCEPT-AS-IS.** -**G-106.** - -#### Axis 5 — Technical soundness -**Challenge:** Is the dual-read fallback design sound? Is the parallel-tag ABAC -migration safe? Is `terraform init -migrate-state` correct? **Dual-read:** -sound in principle (NOVA_X preferred, ACDL_X fallback), BUT the `.env.secrets` -load path bypasses the `core/env.py` helper — `run_platform.sh:288-289` exports -`$ACDL_AWS_ACCESS_KEY_ID` (hardcoded) and `regression_verify.py:309-312` -parses the file matching `k == "ACDL_AWS_ACCESS_KEY_ID"` (hardcoded). If P2 -renames the `.env.secrets` keys to `NOVA_*` but these two readers still read -`ACDL_*`, AWS creds vanish → CAP-013/014/015 (which need live creds for -terraform plan) break → regression gate breaks. **G-106 binds: dual-read in -BOTH load paths** (shell export + Python parser must read NOVA_* first, ACDL_* -fallback, mirroring the helper contract). **Parallel-tag ABAC:** safe — emit -both tag sets, swap policy with acdl:* as secondary condition, verify, remove. -Plan-validated only per A1 (live ABAC stays acdl:* until operator runbook). -**`terraform init -migrate-state`:** correct documented mechanism; backup state -JSON first is the binding safety step. **Versioning contradiction:** the plan -tags a Major milestone on the v1.14.x PATCH line — G-104 binds re-tag as -v1.15.x minor-bumped. **Confidence 0.85.** **Verdict: MITIGATE-BINDING (G-106).** -**G-104, G-106.** - -#### Axis 6 — Testability / verifiability -**Challenge:** Can the success criteria actually be verified? Will the -regression gate stay 16/16 across a 1,465-occurrence rename? Is `grep -rni ACDL` -returning 0 realistic? The gate-stays-16/16 binding constraint (PLAN.md:44-49) -requires per-phase fixture updates — P2 updates env-var fixtures, P3 updates -SSM/tag fixtures, P4 updates terraform-name fixtures. The dual-read fallback -test (P2) keeps ACDL_* as the fallback source — this is the ONE allowed -exception to the grep-returns-0 criterion (success criterion 6 exempts it). -`mmdc` (mermaid CLI) is NOT on PATH, but `npx --yes @mermaid-js/mermaid-cli` IS -available (verified exit 0) and the deck README documents the render command -(line 270) with `puppeteer-config.json` for no-sandbox — so the 5 `.mmd` PNG -re-exports in P1 task 3 are feasible. The Gitea secrets rotation (P2 task 3) -was verified: API reachable (HTTP 200), token present, `rotate_spike_key.sh` -pattern exists. **Confidence 0.82.** **Verdict: ACCEPT-AS-IS.** **G-107.** - -#### Axis 7 — Security -**Challenge:** Does the rebrand introduce a security regression? (a) ABAC -policy swap window — mitigated by the parallel-tag period (nova:* + acdl:* -both valid → swap → remove); plan-validated only, no live window during P0–P4. -(b) Secret rotation — `.env.secrets` keys renamed (values stay, no -re-rotation needed until P5); G-106 binds the dual-read in both load paths so -creds don't silently vanish. (c) `.env.secrets` key rename — the file contains -live rotated AWS creds + a Gitea token; renaming keys is cosmetic (same values) -but the load-path readers must follow (G-106). (d) IAM policy scope (v1.14 P9 -scoped `Resource: "*"`) — the rebrand renames `acdl-*` ARNs to `nova-*` in -terraform; the IAM policy `Resource` patterns must be updated to `nova-*` — -P4 task 2 covers this (`acdl-spike-runner` → `nova-spike-runner`). No new -security regression introduced; the rebrand is nomenclature, not a permission -change. **Confidence 0.80.** **Verdict: ACCEPT-AS-IS.** **G-108.** - -#### Axis 8 — Maintainability -**Challenge:** Will the dual-read fallback + parallel-tag period create -technical debt that's hard to clean up? Is P5 (remove fallback) realistic? The -dual-read (P2) + parallel-tag (P3) IS technical debt by design — it exists to -be removed in P5. P5 does six things in one phase (remove fallback, hard-fail -acdl:*, delete Gitea ACDL_* secrets, remove .env.secrets legacy comment, -multi-persona review + audit, milestone ship). The risk: P5's removal surfaces -a break if P2–P4 didn't catch every ACDL_* reference in the platform's OWN CI -workflows. But P5 is mechanical cleanup: `get_env()` drops the fallback branch, -shell scripts drop `:-$ACDL_X`, `nova_tagging.py` flips warn→hard-fail. The -grep-returns-0 success criteria are verifiable. The 0-consumer-adoption state -(PROJECT.md:487) means no external consumer breaks at P5; only the platform's -own CI must be fully migrated by P4. **Confidence 0.78.** **Verdict: -ACCEPT-AS-IS.** **G-109.** - -#### Axis 9 — Adversarial -**Challenge:** Worst-case scenario? What breaks first? Rollback plan if P4 -goes wrong mid-flight? **Worst case:** the `terraform init -migrate-state` -corrupts the state bucket JSON and the backup was incomplete — you lose -terraform state for the microservice + static-assets stacks. **Mitigation:** -the runbook binds "back up the state JSON first" before each `-migrate-state`; -keep old DynamoDB tables until verified (manual post-verification deletion = -the point of no return). The staged ordering (KMS alias → SNS/SG → Lambda → -DynamoDB → ECR → IAM → state bucket → ALB last) means a mid-flight failure at -any step leaves prior steps intact and old resources still named `acdl-*`. The -dual-read fallback (P2–P4) means the runtime tolerates both `acdl-*` and -`nova-*` during the window — so a partial migration doesn't break the running -platform. **What breaks first:** the `.env.secrets` load path (G-106) — if the -key rename + reader update are misaligned, AWS creds vanish and the regression -gate breaks immediately. G-106 binds the mitigation. **Rollback:** the runbook -is the rollback; the staged ordering with "keep old until verified" is the -safety net. ALB recreate (last, brief downtime) is the only hard-downtime step; -rollback = recreate the old ALB. **Confidence 0.75.** **Verdict: ACCEPT-AS-IS.** -**G-110.** - -### Binding decisions (G-103..G-110) - -| ID | Axis | Decision | Confidence | Rationale | -|----|------|----------|-----------|-----------| -| G-103 | 1 (Feasibility) | ACCEPT-AS-IS | 0.85 | 4-phase structure is feasible; migration ordering (docs→code/env→SSM/tags→AWS→final) is sound; phase dependencies correctly ordered; `terraform init -migrate-state` is the correct mechanism. | -| G-104 | 2/5 (Scope/Technical) | MITIGATE-BINDING | 0.90 | **Re-tag as v1.15.x minor-bumped phases** (P1→v1.15.0 … P5→v1.15.4, v1.15.4 IS the milestone release). The v1.14.x PATCH-line scheme contradicts every prior breaking milestone (v1.1→v1.2.0, v1.5→v1.5.0, v1.11→v1.11.0). The quoted "Major = progressive minor per phase" rule exists in NO repo file. A Major/breaking milestone shipping as v1.14.5 means the semver MAJOR never advances despite a breaking change — consumers on `@v1` silently absorb the rebrand. Update PLAN.md, ROADMAP.md §v1.15, PROJECT.md §v1.15, and ARCHITECTURE.md §v1.15 Addendum tag references. | -| G-105 | 3 (Cost) | ACCEPT-AS-IS | 0.80 | No live AWS apply during P0–P4 (A1); migration scripts authored, not executed; downtime accepted (D-102) but deferred to operator runbook. For an OSS reference with 0 consumer adoption, cost is bounded. | -| G-106 | 4/5 (Risk/Technical) | MITIGATE-BINDING | 0.88 | **Dual-read in BOTH `.env.secrets` load paths.** `run_platform.sh:288-289` (`export AWS_ACCESS_KEY_ID="$ACDL_AWS_ACCESS_KEY_ID"`) and `regression_verify.py:309-312` (parses file matching `k == "ACDL_AWS_ACCESS_KEY_ID"`) bypass the new `core/env.py get_env()` helper. P2 MUST update both readers to read `NOVA_*` first with `ACDL_*` fallback — mirroring the dual-read contract. Without this, renaming `.env.secrets` keys to `NOVA_*` breaks AWS creds → CAP-013/014/015 fail → regression gate breaks. Old `ACDL_*` keys removed in P5. | -| G-107 | 6 (Testability) | ACCEPT-AS-IS | 0.82 | Per-phase fixture updates keep the gate 16/16 (PLAN.md:44-49 binding constraint). `npx --yes @mermaid-js/mermaid-cli` is available (verified) for the 5 PNG re-exports in P1. Gitea API reachable (HTTP 200) + token present for P2 task 3. | -| G-108 | 7 (Security) | MITIGATE-BINDING | 0.80 | **P2 task 3 must update the CI workflow `secrets:` references** (`.gitea/workflows/*`, `.github/workflows/*`) when `NOVA_*` Gitea secrets are created, with graceful degrade + retry on API failure. The plan creates `NOVA_*` aliases but does not show the workflow YAML `secrets.ACDL_*` references being updated. If the workflows still reference `ACDL_*` secrets at P5 (when old secrets are deleted), CI breaks. The Gitea secrets rotation must be a hard gate with retry-on-failure (not a silent skip). | -| G-109 | 8 (Maintainability) | ACCEPT-AS-IS | 0.78 | P5 is mechanical cleanup (drop fallback branch, hard-fail acdl:*, delete old secrets); 0-consumer-adoption means no external break at P5; grep-returns-0 is verifiable. | -| G-110 | 9 (Adversarial) | ACCEPT-AS-IS | 0.75 | Runbook + staged ordering is the rollback; "keep old until verified" is the safety net; ALB recreate (last) is the only hard-downtime step. The `.env.secrets` load path (G-106) is what breaks first if misaligned — G-106 binds the mitigation. | - -### Escalations - -None remain open. All material questions resolved with confidence ≥ 0.60. -Two findings carry accepted residual risk (auto-resolved at full autonomy -with assumption logging): - -- **G-103 (Axis 1):** residual risk that the 4-phase structure underestimates - the 1,465-occurrence rename effort — accepted; per-phase fixture updates - (G-107) + the explore survey's mechanical-vs-judgment split bound the effort. -- **G-107 (Axis 6):** residual risk that a test fixture is missed during the - per-phase rename, breaking 16/16 at a phase boundary — accepted; the - per-phase verify step (run the gate before tagging) catches it before ship. - -### Forcing questions asked (7) - -1. **Versioning contradiction** — Major milestone on v1.14.x PATCH line vs. - prior breaking milestones all minor-bumped. → **G-104 MITIGATE-BINDING** - (re-tag as v1.15.x). -2. **P4 migration completeness** — plan-validated terraform vs live AWS - resources still `acdl-*`. → **G-103/105 ACCEPT-AS-IS** (runbook for live). -3. **`.env.secrets` key rename mechanic** — dual-read helper bypassed by direct - shell/Python readers. → **G-106 MITIGATE-BINDING** (dual-read in both load - paths). -4. **Gitea secrets rotation** — API reachable, token present, but workflow - `secrets:` references not shown updated. → **G-108 MITIGATE-BINDING** (update - workflow refs, hard gate + retry). -5. **ABAC parallel-tag window** — over-engineered for 0 consumers, or correct - forward-looking safety net? → **G-108/Axis-4 ACCEPT-AS-IS** (parallel-tag is - the mitigation, plan-validated). -6. **Regression gate during rebrand** — 16/16 across 1,465-occurrence rename? - → **G-107 ACCEPT-AS-IS** (per-phase fixture updates). -7. **P5 fallback removal realism** — cleanup + review + audit + ship in one - phase? → **G-109 ACCEPT-AS-IS** (mechanical cleanup). -8. **P4 rollback plan** — runbook + staged ordering sufficient? → **G-110 - ACCEPT-AS-IS** (staged ordering is the rollback). - -### What the project is NOT doing that it should (adversarial close) - -- **Documenting the versioning rule it now follows.** G-104 binds the - v1.15.x minor-bumped scheme, but no `.ciagent/` file records the - versioning convention. The plan should add a one-line versioning note to - PROJECT.md §v1.15 or a `VERSIONING.md` so the next milestone doesn't - re-litigate this. -- **Quantifying the live state volume** for the DynamoDB scan+copy + state - bucket migration. The runbook says "back up first" + "verify row counts" but - doesn't quantify the data. For 0-consumer-adoption, this is likely tiny — - but the rollback feasibility (G-110) depends on it being small enough to - re-scan. Accepted residual risk. - -### Simplest 80%-value version - -The simplest version that delivers 80% of the rebrand value: **P1 (docs/decks) -+ P2 (code/env dual-read) + P5 (ship)** — skip the live AWS resource migration -(P3 SSM/tags + P4 AWS resources) entirely. The code + docs would say Nova; the -cloud would still say `acdl-*`. This is the "rename code only, leave cloud" -option D-102 rejected. The user chose the full migration (D-102) — the binding -decision is recorded; the 80% version is NOT the chosen path. The full scope is -accepted as user-directed. - -### What must be true for success in the next 90 days, and is it true today? - -1. **The dual-read helper + both `.env.secrets` load paths are updated in - lockstep (G-106).** — TRUE after P2 binds G-106; FALSE today (the direct - readers still hardcode `ACDL_*`). -2. **The regression gate stays 16/16 at every phase boundary (G-107).** — - TRUE if per-phase fixture updates are complete before each tag; the - per-phase verify step enforces it. -3. **The CI workflow `secrets:` references are updated when `NOVA_*` Gitea - secrets are created (G-108).** — FALSE today; P2 task 3 must be expanded to - include the workflow YAML updates. -4. **The versioning scheme is corrected to v1.15.x (G-104).** — FALSE today; - the plan says v1.14.x. Must be corrected before P0 ship. - -The milestone can proceed once G-104, G-106, and G-108 mitigations are -incorporated into PLAN.md. Confidence 0.82. +P5 now owns, in addition to the test/CI/README work: +- Multi-persona code review (`ciagent-review`) of the milestone branch +- Audit (`ciagent-audit`) — reconstruction test + .ciagent discipline +- Milestone ship (`ciagent-ship`) — merge to milestone branch → main, tag + v1.22.6, release with both PPTX attached, delete milestone branches +- Update REQUIREMENTS.md (mark v1.23 complete) + ROADMAP.md (mark v1.23 + complete) +- Commit: `docs(milestone): complete v1.23 — Nova Deck Cleanup & Python PPTX` --- -# v1.16 NFR Simplification — Grill (2026-07-30) +### Evidence Index -**Griller:** ci-griller (glm-5.2). **Milestone:** v1.16 (NFR). -**Verdict:** PASS-with-binding (3 binding decisions G-111..G-113, 1 -escalation E-002). The plan is evidence-grounded and does not re-litigate -v1.14 (D-117 clean). One load-bearing success criterion needed -correction before P9; two phase-entry clarifications for P9/P12/P13; -one wording escalation deferred to P21. - -## Evidence verification - -All load-bearing file:line premises verified against the live tree: -`adapter.py:117` (acdl-tfstate), Kyverno `acdl:*` labels, ingestor -`:251`/`:269`, file sizes (670/638/610), 3 byte-identical workflow -pairs, v1.14 grill G-101..G-106 + E-001 all CLOSED. - -## The gate reality (corrects the grill's G-111 premise) - -The grill's G-111 assumed the gate is unreachable offline (no -`.env.secrets`). **Corrected via live run:** `.env.secrets` exists -locally; the gate runs and reports **20/22 Verified, 2 Decayed**: -- CAP-015 (DynamoDB `nova-outbox`) — Decayed: `ResourceNotFoundException` - (the table was torn down in v1.11 D-096 and never re-provisioned; v1.15 - P4 was plan-only, no live apply). -- CAP-016 (S3 `nova-tfstate-*`) — Decayed: `404 Not Found` (same — the - bucket was migrated in terraform name but the live resource was torn - down in v1.11 and not re-created). - -This is the **documented post-v1.11-teardown steady state** (D-096: -"live resources do not persist past v1.11"). CAP-015/016 Decayed is not -a v1.16 regression — it is the known, accepted zero-cost state. The -v1.16 P1 state-bucket fix (`adapter.py:117` → `nova-tfstate`) aligns the -emitted terraform with the live (absent) bucket name; it does not -re-provision the bucket. - -## Binding decisions (G-111..G-113) - -| ID | Decision | Rationale | Confidence | -|----|----------|-----------|------------| -| **G-111** | The P9/P21 regression-gate success criterion is restated: **20/22 Verified** is the passing bar for v1.16. CAP-015/016 (DynamoDB outbox + S3 state bucket) are the documented post-v1.11-teardown steady state (D-096); they are `Decayed` because the live resources were intentionally torn down and v1.15 P4 was plan-only (no live apply). Re-provisioning them is a future feature milestone, not an NFR. The gate (`regression_verify.py:77` `passed = all(...)`) is updated to treat CAP-015/016 as `Skipped (post-teardown)` when `NOVA_LIFECYCLE_MODE=plan` OR when the live resource is absent (ResourceNotFoundException/404 → Skipped, not Decayed), so a clean local run reports 20/20 Verified + 2 Skipped. The PLAN.md/PROJECT.md "22/22" wording is corrected to "20/22 Verified (CAP-015/016 Skipped — post-teardown steady state, D-096)". | Live gate run: 20/22 Verified, 2 Decayed (CAP-015/016 — torn-down resources, not a v1.16 regression). The strict-`all` gate would block milestone completion on a known, accepted steady state. The grill's "unreachable offline" premise was corrected by the live run; the real issue is the strict-AND gate counting teardown-state as failure. | **0.90** | -| **G-112** | P9 MUST pin the sourcing model for `run_decommission.sh`/`run_uptime.sh`: **`source`** (shared shell env), not `invoke` (subshell). The extracted blocks reference `run_platform.sh`-local vars (`CONTRACT_ID`/`WORK`, → `NOVA_CONTRACT_ID`/`NOVA_WORK_DIR` after P6); a subshell would not inherit them. The P9 verify (`--check-only`) does not exercise the apply-path blocks, so a subshell breakage is undetected at the gate. | PLAN.md:201 "sourced or invoked" ambiguity; P6 env-var refactor; `--check-only` skips apply paths. | **0.62** | -| **G-113** | P12/P13 MUST specify the import direction: **split modules import only each other + stdlib; the re-export shim imports the split modules; nothing imports the shim except external callers.** This prevents the latent cycle (shim → split → split → shim). Documented in the phase plan. | Re-export shim pattern; no import-direction stated in PLAN.md. | **0.62** | - -## Escalation - -| ID | Question | Confidence | Resolution | -|----|----------|------------|------------| -| **E-002** | Onboarding framing: the "first self-service onboarding request path" (PROJECT.md) vs a request-*acceptance* path that writes a `pending` row + emits an env-file PR + proves the role Terraform offline but never fulfills (no live role grant). Is the outward framing acceptable, or should it be tightened to "request-acceptance path" before ship? | **0.55** | Deferred to P21 final review (wording tightening, not a scope change). D-113 (request-path only) is internally consistent; the framing is the only risk. | - -## Mitigations incorporated into PLAN.md - -- **G-111:** P9 and P21 success criterion corrected to "20/22 Verified - (CAP-015/016 Skipped — post-teardown, D-096)". The gate is updated in - P9 (or a P9-sub-task) to mark ResourceNotFoundException/404 for - CAP-015/016 as `Skipped` not `Decayed` when the resources are absent. -- **G-112:** P9 pins `source` (shared env) for the extracted helpers. -- **G-113:** P12/P13 document the one-way import rule. - -## Can the milestone proceed? - -YES, once G-111's criterion restatement + gate update are incorporated -(into P9's must-haves). G-112/G-113 are phase-entry clarifications for -P9/P12/P13. E-002 is deferred to P21. Confidence 0.85. - ---- - -# GRILL — v1.17 "Strategic Direction, Leadership Metrics & Unified Story" (2026-08-04) - -> **Griller:** CIAgent (red-team mode). **Milestone:** v1.17. **Axes:** 3 -> (NORTH_STAR alignment, Deck story & arc, Deck per-slide rigor) per PO -> direction. **Stance:** adversarial — presumed over-scoped / infeasible / -> storytelling-weak until evidence forced otherwise. - -## Evidence base - -- `NORTH_STAR.md` (183 lines, draft), `PLAN.md` (1,114 lines, deck rebuild - plan incl. slide-by-slide), `REQUIREMENTS.md` v1.17 (REQ-185..213), - `RESEARCH.md` v1.17 (signal inventory, scorecard, deferred-decision - ledger, deck research). -- Codebase cross-checks: `REGRESSION_REPORT.json` = **18 Verified + 4 - Skipped** (NOT "22/22 Verified" — the new deck plan correctly says - 18V+4S; the *existing* decks still claim 22/22). `PROJECT.md:495` = - **0 consumer adoption**. `docs/NO_HUMANS_THESIS.md`, `docs/METRICS.md`, - `metrics/` do not yet exist (P4/P5 deliverables — expected). -- Decisions locked (D-120..D-132) — not re-litigated. - -## The central contradiction - -**NORTH_STAR.md:111** states: *"Targets are committed, not aspirational."* -**PO's G-Q6 answer:** *"the goal is simply to target a high touchless -resolution rate, not to say we have reached those targets given there are -0 consumers."* - -These two statements are in direct conflict. "Committed, not aspirational" -+ "simply to target" = the document is lying about its own epistemic -status. This is the v1.10 decay root cause (PRE_MORTEM FM-3: decks -outrunning verified reality) repeating itself in the document meant to -prevent it. - -## Axis 1 — NORTH_STAR alignment - -### G-Q1 — Target with no backing REQ / placeholder -**Finding:** AI-Agent Intent Share (≥40%) is a committed 12–18mo target -(NORTH_STAR:128) with "placeholder view" claimed, but it is NOT among the -8 placeholder views in PLAN P3 (lines 309–315), and no REQ-185..213 builds -an emitter or placeholder for it. RESEARCH §3 marks it "future" with no -controlling decision ID (unlike every other deferred metric). NORTH_STAR:128 -falsely claims a placeholder view exists → violates the "no fabrication" -hard constraint. -**Verdict: BIND.** Add a 9th placeholder view OR move the target to a -"Future Horizons" section; correct NORTH_STAR:128. **Confidence: 0.90.** - -### G-Q2 — Anti-goal pursuit -**Finding:** No REQ builds an anti-goal. Deck title "No-Humans Infrastructure -Platform" is one weak slide away from violating anti-goal #3 (not removing -humans from accountability) — mitigation is entirely in slide 3's execution. -**Verdict: PASS (conditional on slide 3 landing the attestation model).** -**Confidence: 0.75.** - -### G-Q3 — Attestation clarification consistency -**Finding:** The attestation clarification is the most consistently -propagated concept in the plan — NORTH_STAR (3 places), REQUIREMENTS -(3 REQs), deck (3 slides). Well done. -**Verdict: PASS.** **Confidence: 0.92.** - -### G-Q4 — "AI decision" framing (D-122 honesty) -**Finding:** D-122 (confidence_signal + HITL gate, NOT an LLM) is cited on -slide 7 and required in NO_HUMANS_THESIS.md (REQ-213). BUT slide 7's -*Delivers* says "every AI decision captured" without ever telling the -audience what the "AI" is. The honesty is buried in a linked doc + a -decision ID the audience has never heard. -**Verdict: BIND.** Add one sentence to slide 7 *Delivers*: "Nova's 'AI -decision' is the confidence-gated policy engine, not an LLM planner -(D-122)." **Confidence: 0.85.** - -### G-Q5 — Secretly ungrounded metrics -**Finding:** The 8 deferred placeholder views cover their list. BUT (a) -AI-Agent Intent Share's placeholder is falsely claimed (G-Q1), and (b) -derived metrics (FTE Hours Saved, Platform ROI) are computed on zero -production runs yet shown on slide 12 without the zero-denominator caveat. -A "derived" metric from zero runs is technically not fabricated but is -misleading. -**Verdict: BIND.** (1) Resolve G-Q1; (2) slide 12 must annotate derived -metrics with "(computed on N internal runs; production-denominator activates -post-pilot)." **Confidence: 0.82.** - -### G-Q6 — 12–18mo target feasibility (0 consumers) -**Finding:** PO's answer ("simply to target") conflicts with NORTH_STAR:111 -("committed, not aspirational"). 3 "grounded (after P1)" targets (Touchless -Resolution, Human Escalation, AI Decision Accuracy) have scope "across -production estates" — but PROJECT.md:495 = 0 consumer adoption. The metric -IS computable on internal dev runs, but the target scope doesn't exist. -Marking "grounded" while the scope is absent is the overclaim the "no -fabrication" constraint exists to prevent. -**Verdict: BIND.** (1) Rewrite NORTH_STAR:111 → "Targets are committed -destinations; the grounding column records whether each is measurable this -milestone." (2) Reclassify the 3 targets to `partial — measurement pipeline -grounded on internal runs; production-estate scope activates post-pilot` -(the Cloud Spend Reduction precedent at NORTH_STAR:123). (3) Deck slide 5 -regroup as "Measurable today (internal runs)" vs "Activates post-pilot -(production estates)." Requires NORTH_STAR-CHANGE commit trailer (REQ-204). -**Confidence: 0.80.** - -## Axis 2 — Deck plan: story & arc - -### G-Q7 — Arc order (Problem→Vision→How→Proof→Roadmap vs Proof-first) -**Finding:** Current arc puts Proof at Act 4 (slides 10–13) — 40% of the -deck before a number. For a leadership audience that has seen 10+ milestone -decks, this risks losing the room by slide 4. BUT the "no-humans" thesis -is contentious; jumping to proof without the attestation model invites the -"removing humans from accountability" objection. The Vision act makes the -Proof credible. -**Verdict: PASS (marginal).** Defensible IF the Problem act is tight and -slide 3 front-loads the attestation clarification. **Confidence: 0.62.** - -### G-Q8 — x3 structure at deck level -**Finding:** Slide 1's 5-act preview is orienting (a table of contents), -not too much meta-structure. BUT it's also not a hook — it gives structure, -not stakes. A C-suite audience decides in the first 30 seconds. -**Verdict: BIND (minor).** Add one stake-establishing line to slide 1 -*Delivers* with a real number (18 verified, 0 consumers, honest deferral -list). **Confidence: 0.70.** - -### G-Q9 — Per-slide benefit callouts (substantive vs filler) -**Finding:** 4 of 17 closes are filler (slides 1, 4, 12, 15); 2 borderline -(8, A1). Worst offender: slide 12 (ROI) restates the *objective* ("ROI is -quantifiable") rather than giving the *number* or the *honest caveat*. -**Verdict: BIND.** Rewrite 4 filler closes. Slide 12's close must be: -"Benefit: you now know the ROI formula — (labor + cloud + avoided downtime) -÷ platform cost — and that it computes on internal runs today, with -production-denominator activating post-pilot." **Confidence: 0.78.** - -### G-Q10 — Deck length (17 slides) -**Finding:** 17 is at the upper bound but justifiable for 5 acts. The risk -is density, not length: slide 12 crams 6 metrics (Touchless, Human -Escalation, MTTR, Cost, FTE, ROI) into one slide — a wall of bullets. -**Verdict: BIND (minor).** Split slide 12 into "Zero-Touch Efficiency" -(Touchless, Human Escalation, MTTR) + "Cost & ROI" (Cost, FTE, ROI). Deck -→ 18 slides, each earning its place. **Confidence: 0.68.** - -### G-Q11 — "What's Deferred" slide (13) -**Finding:** The honesty strengthens the grounded claims BUT surfaces the -gap: Nova claims "no-humans in operations" while deferring the metrics -that would prove operations are healthy without humans (Live Infra Health, -SLA, Drift Auto-Reversal). A skeptical viewer notes the contradiction. -**Verdict: BIND.** Add preempt to slide 13: "These deferrals are about -*measurement infrastructure*, not about whether the platform runs without -humans — the platform runs autonomously today on internal runs; what's -deferred is the production-estate dashboard that would prove it at scale." -**Confidence: 0.75.** - -## Axis 3 — Deck plan: per-slide rigor - -### G-Q12 — Slide opening lines -**Finding:** The "This slide shows X" formula is orienting, not patronizing, -because each includes a stake-bearing clause. Consistent without being empty. -**Verdict: PASS.** **Confidence: 0.80.** - -### G-Q13 — Transitions (written vs hand-waved) -**Finding:** ~10 of 13 transitions are written (specific reference to prior -close). 3 are hand-waved (slides 8→9, 11→12, 13→14). Worst: the Act 3→4 -boundary (slide 8→9, How→Proof) — the most important transition in the deck -— is the weakest. -**Verdict: BIND.** Rewrite the 3 hand-waved transitions. The 8→9 Act -boundary must carry weight: "Having seen the gate model — autonomy in -operations, human in accountability — here is how Nova instruments itself -to prove that model at scale." **Confidence: 0.85.** - -### G-Q14 — Weakest slide (audience-loss point) -**Finding:** Slide 9 (Telemetry Architecture) is the audience-loss slide. -It's the 4th consecutive architecture slide (6,7,8,9), the most abstract -(CloudEvents, SQLite, PowerBI), its Benefit is about data plumbing not -business value, and it sits between the attestation matrix (slide 8, -emotionally resonant) and the Proof act (slide 10, the numbers) — between -the two things the audience came for. -**Verdict: BIND.** Compress slide 9 into slide 10 OR reframe its Benefit -from data plumbing to trust: "Benefit: you now know the proof you're about -to see isn't fabricated — every number traces to a file you can audit." -**Confidence: 0.78.** - -### G-Q15 — Proof act citation specificity -**Finding:** 5 of 6 Proof citations are specific (file paths + real numbers). -Gap: slide 12's derived metrics (FTE, ROI) cite "derived" without showing -the formula or the input count. -**Verdict: BIND (minor).** Show the ROI formula inline on slide 12 + the -N=0 production-runs caveat. **Confidence: 0.80.** - -### G-Q16 — Closing slide (15) — does the ask land? -**Finding:** THE ask is present but framed as insider language ("fund the -hot-path activation (post-D-096) + the tamper-evident ledger build-out -(D-083 lift)"). A leadership audience doesn't know what "hot-path -activation" means. The ask is a technical request, not a business decision -a leader can make in the room. -**Verdict: BIND.** Reframe slide 15's ask as a business decision: "The -ask: (1) approve a pilot estate to activate production-estate metrics -(unblocks D-096), and (2) approve the tamper-evident ledger build-out -(lifts D-083) — turning grounded claims into complete proof." Make it a -yes/no a leader can give. **Confidence: 0.82.** - -## Binding decisions (must resolve before SHIP) - -| G-ID | Axis | Verdict | What must change | Conf | -|---|---|---|---|---| -| G-Q1 | 1 | BIND | Add 9th placeholder view for AI-Agent Intent Share OR move to "Future Horizons"; correct NORTH_STAR:128 | 0.90 | -| G-Q4 | 1 | BIND | Add D-122 honesty sentence to slide 7 *Delivers* | 0.85 | -| G-Q5 | 1 | BIND | Annotate derived metrics on slide 12 with zero-run caveat | 0.82 | -| G-Q6 | 1 | BIND | Rewrite NORTH_STAR:111; reclassify 3 targets to `partial`; regroup deck slide 5. NORTH_STAR-CHANGE trailer required | 0.80 | -| G-Q8 | 2 | BIND (minor) | Add stake line with real number to slide 1 *Delivers* | 0.70 | -| G-Q9 | 2 | BIND | Rewrite 4 filler closes (slides 1, 4, 12, 15); slide 12 must give ROI formula + caveat | 0.78 | -| G-Q10 | 2 | BIND (minor) | Split slide 12 into two (Efficiency + Cost/ROI); deck → 18 slides | 0.68 | -| G-Q11 | 2 | BIND | Add preempt to slide 13 (deferrals are measurement infra, not whether platform runs without humans) | 0.75 | -| G-Q13 | 3 | BIND | Rewrite 3 hand-waved transitions (esp. Act 3→4 boundary 8→9) | 0.85 | -| G-Q14 | 3 | BIND | Compress slide 9 into slide 10 OR reframe its Benefit to trust | 0.78 | -| G-Q15 | 3 | BIND (minor) | Show ROI formula inline + N=0 caveat on slide 12 | 0.80 | -| G-Q16 | 3 | BIND | Reframe slide 15 ask as a business decision (pilot estate + ledger build-out) | 0.82 | - -**PASS (no change):** G-Q2 (anti-goals, conditional on slide 3), G-Q3 -(attestation consistency — excellent), G-Q7 (arc order — marginal), -G-Q12 (slide openings — formulaic but substantive). - -## Escalations (only the PO can decide) - -| E-ID | Question | Confidence | -|---|---|---| -| E-003 | Should the 3 "grounded (after P1)" targets with "production estates" scope be reclassified to `partial` (Cloud Spend precedent), or should "grounded" be redefined to mean "measurement pipeline grounded"? Changes a committed NORTH_STAR target's grounding label; requires NORTH_STAR-CHANGE trailer (REQ-204). | <0.60 | -| E-004 | Should AI-Agent Intent Share (≥40%) remain a "12–18mo Target" with no backing REQ/placeholder, or move to a "Future Horizons" section? Strategic-scope question (is agentic consumption a 12–18mo commitment or a longer horizon?). | <0.60 | - -## Overall verdict - -**🟡 REDUCE SCOPE / BINDING FIXES REQUIRED — not ready to ship as-is.** - -The plan is architecturally sound (metrics pipeline, Decision Ledger, -PowerBI export, x3 deck structure are well-designed and grounded). The -attestation clarification (G-Q3) is the best-propagated concept in the -plan. The regression-capability gate (CAP-023/024) is a credible safeguard. - -But the plan has one structural contradiction (NORTH_STAR:111 vs PO intent -vs grounding column) that infects 4 other findings (G-Q1, G-Q5, G-Q6, -G-Q9/slide 12). This is the v1.10 decay pattern (PRE_MORTEM FM-3) -repeating in the document meant to prevent it. The "no fabrication" hard -constraint is self-violated in two places (AI-Agent Intent Share placeholder -claim, derived-metrics-without-caveat) before a single slide is rendered. - -The deck plan is story-competent but not story-excellent. 4 benefit -callouts are filler, 3 transitions are hand-waved (incl. the critical -Act 3→4 boundary), slide 9 is the audience-loss slide, and the closing -ask is insider language. - -**12 binding decisions, 2 escalations.** None require re-architecting the -plan; all are edits to NORTH_STAR (2 rows + 1 line, with commit trailer), -the deck slide plan (4 slide rewrites, 1 split, 3 transition rewrites), -and one placeholder-view addition. Estimate: 1–2 phases of rework, not a -milestone restart. The plan does NOT need a revision loop — it needs -these 12 fixes applied in P0 (NORTH_STAR) and P5 (deck) before the -respective phases ship. Critical path unchanged. - -**Can the milestone proceed?** - -YES, once the 12 BIND decisions are incorporated (G-Q1/Q4/Q5/Q6 into P0 -NORTH_STAR + P5 deck plan; G-Q8/Q9/Q10/Q11/Q13/Q14/Q15/Q16 into P5 deck -plan). E-003/E-004 require PO decisions on NORTH_STAR target framing. -Confidence 0.80. +- Image format: `docs/presentations/nova-autonomous-cloud-delivery.html` + grep — 2× ``, 0× `xlink:href` +- Marp `
` passthrough: minimal test deck rendered through + `@marp-team/marp-cli@4.5.0` → `
` survives verbatim +- Versioning: `git tag --list 'v1.22.*'` → empty (no conflicts) +- "penetrate" occurrences: `grep -riI penetrat` → docs/scope.md:16, + docs/vision.md:18, docs/presentations/{-marp.md, .html, .md, + -talking-points.md}, all .ciagent/*.md +- Test inversion targets: tests/test_slides_pipeline.py lines 55-64 + (rewrite), 66-74 (invert), 240-270 (delete), 275-302 (retarget), 353-359 + (assert #D6002A not --sp-red) +- Benefit callout count: 21 `**Benefit:**` in current deck → 21 + `
` in P2 \ No newline at end of file