diff --git a/docs/presentations/assets/mmd/road-to-north-star.mmd b/docs/presentations/assets/mmd/road-to-north-star.mmd index 0a1ce70..cc71559 100644 --- a/docs/presentations/assets/mmd/road-to-north-star.mmd +++ b/docs/presentations/assets/mmd/road-to-north-star.mmd @@ -3,15 +3,16 @@ flowchart LR A["v1.0\nDEMO\ncomplete"] --> B["v1.1–v1.8\nPLATFORM BUILD\ncomplete"] B --> C["v1.9\nPRESENTATIONS + PATCHES\ncomplete"] - C --> D["v1.10\nNEXT\nHITL wiring\nall-runner OIDC\nregulatory ledger"] - D --> E["v2.0\nFUTURE\ncompliance milestone\nself-service\ndynamic modules\nengine adapters"] - E --> F["North Star\nREALIZED\nfull autonomy (lower)\nattested (higher)\ncitizen dev live\nevidence regulatory-grade"] + C --> D["v1.10\nREGRESSION GATE\n+ verified reality\ncomplete"] + D --> E["v1.11–v1.12\nLIFECYCLE TESTING\n+ presentation refine\n22/22 Verified\n+ torn down to zero-cost"] + E --> F["v2.0\nFUTURE\ncompliance milestone\nself-service\ndynamic modules\nengine adapters"] + F --> G["North Star\nREALIZED\nfull autonomy (lower)\nattested (higher)\ncitizen dev live\nevidence regulatory-grade"] A -.->|"stub-driven proof"| A B -.->|"IR + OIDC + ABAC +\nmodule catalog +\nencryption + decommission"| B C -.->|"10-slide decks +\ntalking points +\nS&P theme"| C - D -.->|"proposed phasing\nnot formally planned"| D - E -.->|"proposed phasing\nnot formally planned"| E + D -.->|"regression gate (D-091)\nlocal emulating tier\nverified-reality rewrite"| D + E -.->|"stateless adapter (918→~80 lines)\npipeline-driven lifecycle\nplan-only default (REQ-134)\ntorn down to zero-cost"| E + F -.->|"proposed phasing\nnot formally planned"| F classDef accent fill:#1B1B1B,color:#fff,stroke:#D6002A,stroke-width:2px classDef supporting fill:#fff,color:#1B1B1B,stroke:#D6002A,stroke-width:1px -class F accent - +class G accent \ No newline at end of file diff --git a/docs/presentations/assets/png/road-to-north-star.png b/docs/presentations/assets/png/road-to-north-star.png index ffcda60..378c17e 100644 Binary files a/docs/presentations/assets/png/road-to-north-star.png and b/docs/presentations/assets/png/road-to-north-star.png differ diff --git a/docs/presentations/how-the-platform-works.md b/docs/presentations/how-the-platform-works.md index 4b298db..0369032 100644 --- a/docs/presentations/how-the-platform-works.md +++ b/docs/presentations/how-the-platform-works.md @@ -5,7 +5,7 @@ > **Length:** ~15 minutes · 10 main + 6 appendix = 16 slides > **Purpose:** Sell the platform's value to tech leadership — zero-trust, security, observability, auditability, and the shift from "operators guess" to "the platform computes safety." > **Maturity framing:** "Testing" = works internally, dev pilot-ready. "Planned" = on the roadmap, not yet implemented. "Agentic" = involves AI agents or autonomous decision-making. -> **Re-verification (2026-07-27):** Every "Testing" claim in this deck was re-verified in v1.10 Phase 54 (D-093). The headline E2E (contract → resolver → adapter → terraform init/validate/plan) passes against the live AWS account; the local emulating tier (Phase 53) runs the full E2E with no cloud credentials. 16/16 auto-verifiable capabilities Verified; 6 IAM-gated cloud resources are escalated (require an admin principal the spike-runner lacks). See `.ciagent/CAPABILITY_INVENTORY.md`. +> **Re-verification (2026-07-29):** Every "Testing" claim in this deck was re-verified in v1.10 Phase 54 (D-093) and again in v1.11 via the pipeline-driven lifecycle tests (P59–P62). The headline E2E (contract → resolver → adapter → terraform init/validate/plan) passes against the live AWS account; the local emulating tier (Phase 53) runs the full E2E with no cloud credentials. **22/22 auto-verifiable capabilities Verified** (CAP-013 fixed in v1.12 P67 — the adapter's multi-resource L1 dedup defect is closed; CAP-017/018 probe bugs fixed). The v1.11 lifecycle pipeline ran apply→modify→destroy against live AWS and was then torn down to zero-cost (D-096). See `.ciagent/CAPABILITY_INVENTORY.md` and `.ciagent/PRE_MORTEM.md`. --- @@ -46,8 +46,6 @@ Four frictions slow every team: Now that we know the problem, here's where ACDL fits — and where it doesn't. -Now that we know the problem, here's where ACDL fits — and where it doesn't. - - **Upstream is anything** — your IDE, an agentic SDLC, or a citizen developer vibe coding on a laptop. ACDL doesn't care how the contract was produced. - **ACDL is infrastructure only** — it provisions and governs AWS resources. It does not build, test, or deploy your application code. That's upstream. - **Not a general-purpose AI** — autonomy is narrow, scoped to delivery, bounded by strict policy envelopes. @@ -61,8 +59,6 @@ Now that we know the problem, here's where ACDL fits — and where it doesn't. The contract is the boundary between upstream and ACDL. It's all a consumer writes. -The contract is the boundary between upstream and ACDL. It's all a consumer writes. - A single YAML contract — **module, environment, inputs**. The platform owns everything else. ```mermaid @@ -88,8 +84,6 @@ The consumer does **not** write infrastructure modules, workflow logic, or adapt Once the contract is written, here's what the platform does with it — every time. -Once the contract is written, here's what the platform does with it — every time. - Every deployment runs the same stages, in the same order, with the same checks — no team-specific pipelines, no tribal runbooks. ```mermaid @@ -117,8 +111,6 @@ Two properties matter to leadership: Before any infrastructure is created, here's how access is scoped. -Before any infrastructure is created, here's how access is scoped. - Consumer repositories hold **no long-lived cloud credentials.** Ever. - **Authentication is OIDC federation** between the platform runners and the cloud provider. Each job mints a short-lived token; no credential is stored in the consumer repo or in a runner secret. *(Testing on GitHub Actions runners; planned for all platform runners.)* @@ -136,8 +128,6 @@ Consumer repositories hold **no long-lived cloud credentials.** Ever. Now let's look at how the platform decides whether a deployment is safe. -Now let's look at how the platform decides whether a deployment is safe. - Every delivery action produces a **measurable, explainable confidence signal** — a weighted sum of observable facts, not a black box. *(Agentic.)* - **Six weighted inputs** — policy conformance, validation, freshness, source provenance, history, and non-functional requirements (NFRs). The weights are **manually tuned**, the inputs are **observable**, and the breakdown is **auditable** — if a consumer asks "why 0.62?", the platform answers with a per-input breakdown. @@ -161,8 +151,6 @@ Every delivery action produces a **measurable, explainable confidence signal** Beyond the confidence signal, security defaults are on by construction — not by opt-in. -Beyond the confidence signal, security defaults are on by construction — not by opt-in. - Security defaults that **do not require a team to opt in.** Checks run on **every** deployment, normalized to a single schema regardless of which engine produced them. *(Testing.)* - **Infrastructure-as-code policy** (Checkov) — secrets in plaintext, public ingress, IAM wildcards, KMS key references, **required tagging standards** (`acdl:owner`, `acdl:contract`, `acdl:environment`, `acdl:cost-center`). All run *before* infra is created. @@ -182,8 +170,6 @@ Security defaults that **do not require a team to opt in.** Checks run on **ever Computed safety handles the gate. But humans still matter — here's how accountability works. -Computed safety handles the gate. But humans still matter — here's how accountability works. - - **Dev is fully autonomous.** The confidence signal (≥ 0.50) is the only gate. Queue-based handoffs are eliminated from lower environments. *(Testing, Agentic.)* - **qa, prod, and dr require deliberate human attestation** — not rubber stamps, but policy-mandated acts of accountability via protected deployment approvals. The approver reviews the contract, the planned Terraform changes, and the accumulated evidence. *(Planned.)* - **QA attests to infrastructure readiness — the contract, the planned Terraform changes, and the accumulated evidence. QA does not review application code (that's upstream).** @@ -205,8 +191,6 @@ Version control is a **coordination tool, not an evidentiary fortress.** True co Here's what success looks like when the North Star is reached. -Here's what success looks like when the North Star is reached. - - **Velocity without sacrificing safety.** Speed is in the ergonomics (a simple contract, a one-line `uses:`); safety is in the gates the consumer cannot bypass. - **Security, observability, and compliance as platform defaults** — not per-team effort, not post-hoc remediation. - **Auditability as a byproduct, not a project.** Every production change is traceable to a human attestation and a tamper-evident evidence event. @@ -229,6 +213,8 @@ For deep dives — these slides cover details omitted from the main 10. 3. The Road to the North Star (phased roadmap) 4. Testing vs. Planned (full inventory) 5. Glossary +6. Operating Model & Cost (real AWS spend + pre-mortem) +7. Verified by Construction — the v1.11 architecture (stateless adapter + lifecycle pipeline) > **Speaker notes:** These are deep-dive slides for follow-up questions. Don't walk them in the main 15-minute talk — pull them up when an audience member wants detail on a specific topic. @@ -236,8 +222,6 @@ For deep dives — these slides cover details omitted from the main 10. ## A1 — Platform-Managed Environments -For deep dives — these slides cover details omitted from the main 10. - A consumer provides **no AWS account, no VPC, no subnet, no state backend, no runner key.** The platform owns the blast radius. A named environment is a platform-owned bundle of: @@ -275,18 +259,20 @@ Monitoring is **a platform default, not a per-team project.** *(Testing.)* A phased roadmap from the current Testing baseline to the full North Star: -- **Phase 1 — Testing baseline (current):** contract-driven deploys, zero-trust OIDC + ABAC on GitHub Actions, confidence signal gating, hash-chained evidence, encryption by default, deletion protection + safe decommission, uptime monitoring, platform-managed environments. +- **Phase 1 — Testing baseline (current, v1.12):** contract-driven deploys, zero-trust OIDC + ABAC on GitHub Actions, confidence signal gating, hash-chained evidence, encryption by default, deletion protection + safe decommission, uptime monitoring, platform-managed environments. **22/22 capabilities Verified** via the v1.11 lifecycle pipeline (apply→modify→destroy against live AWS, then torn down to zero-cost). The stateless adapter + lifecycle pipeline are the structural verification (see A7). - **Phase 2 — Production readiness:** HITL wiring for qa/prod/dr, all-runner OIDC, full regulatory ledger (S3 Object Lock + JWS signatures + daily checkpoints), environment self-service. - **Phase 3 — Compliance & expansion:** compliance milestone (GDPR, SOX, SOC2, DORA extension points), additional engine adapters (OpenTofu, Pulumi, Kubernetes CRDs), deeper observability bootstrap. - **Phase 4 — Agentic frontier:** dynamic module creation from a contract (the agentic citizen-developer composition mechanism), pattern recognition that compounds value over time. -> **Speaker notes:** Be clear with leadership: this is a proposed phasing, not a formally committed plan. The phases are sequenced by dependency, not by calendar — each phase's items are gated on the prior phase's maturity. Invite questions on any phase boundary. +> **Speaker notes:** Be clear with leadership: this is a proposed phasing, not a formally committed plan. The phases are sequenced by dependency, not by calendar — each phase's items are gated on the prior phase's maturity. Phase 1 is now fully Verified (22/22) and torn down to zero-cost — it is no longer aspirational. Invite questions on any phase boundary. --- ## A4 — Testing vs. Planned (Full Inventory) -**Testing** (works internally, dev pilot-ready) — 11 capabilities: +> **Verification status (v1.12, 2026-07-29):** 22/22 auto-verifiable capabilities **Verified** — the v1.11 lifecycle pipeline ran apply→modify→destroy against live AWS for every L1 + L2 module, then tore down to zero-cost (D-096). The v1.10 "6 deploy-unverified (IAM drift)" status is closed (CAP-013 fixed in P67). See `CAPABILITY_INVENTORY.md`. + +**Testing** (works internally, dev pilot-ready — 22/22 Verified via lifecycle pipeline + regression gate): - Contract-driven deploys with a versioned reusable workflow. - Module catalog (primitives + modules) with validated examples. @@ -312,7 +298,7 @@ A phased roadmap from the current Testing baseline to the full North Star: - Additional engine adapters (OpenTofu, Pulumi, Kubernetes CRDs). - Deeper observability bootstrap (dashboards, runbooks, on-call bindings). -> **Speaker notes:** Close on honesty. The platform delivers real, verifiable value today — 11 capabilities that work internally. The roadmap is concrete, not aspirational hand-waving — 9 planned items, each with a defined milestone and a clear reason it isn't shipped yet (usually an upstream dependency, not an engineering gap). Emphasize: 0 consumer adoption today — "Testing" means it works internally and is dev pilot-ready, not that it's released. +> **Speaker notes:** Close on honesty. The platform delivers real, verifiable value today — 22/22 auto-verifiable capabilities are Verified via the v1.11 lifecycle pipeline (apply→modify→destroy against live AWS) + the D-091 regression gate. The roadmap is concrete, not aspirational hand-waving — 9 planned items, each with a defined milestone and a clear reason it isn't shipped yet (usually an upstream dependency, not an engineering gap). Emphasize: 0 consumer adoption today — "Testing" means it works internally and is dev pilot-ready, not that it's released. The lifecycle pipeline defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); a CI variable (`ACDL_LIFECYCLE_MODE=full`) overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). --- @@ -330,4 +316,37 @@ A phased roadmap from the current Testing baseline to the full North Star: | **NFR** | Non-Functional Requirement — encryption, tagging, observability standards | | **IR** | Intermediate Representation — the engine-agnostic stack definition between contract and Terraform | -> **Speaker notes:** Use this slide as a reference when the audience asks for term definitions. Don't read it aloud — point to it as a takeaway reference. \ No newline at end of file +> **Speaker notes:** Use this slide as a reference when the audience asks for term definitions. Don't read it aloud — point to it as a takeaway reference. + +--- + +## A6 — Operating Model & Cost (real AWS spend + pre-mortem) + +ACDL runs at **zero cloud cost** for day-to-day development. The v1.0→v1.10 AWS spend was measured directly via Cost Explorer (`COST.md`, 2026-07-28): + +| Metric | Value | +|--------|-------| +| Total spend (8 days) | **$0.001883** | +| Daily average | $0.000235 | +| Projected monthly | ~$0.007 | +| Peak day | 2026-07-27 ($0.000867 — v1.10 regression + verify run) | + +- **S3 dominates** (98.8%, terraform state bucket) — no compute (ECS/Lambda) ran because v1.0→v1.10 was plan-only for IAM-gated capabilities. +- **Local emulators are the primary tier** — the full pipeline runs in-process, no AWS credentials, no Checkov, no DynamoDB. *(Testing.)* +- **Live-AWS verification is milestone-scoped, then torn down.** The v1.11 lifecycle pipeline ran apply→modify→destroy for every module, then tore down to zero-cost steady state (D-096 — teardown mandatory before milestone COMPLETE; no merge to main until `terraform show` confirms no resources). The lifecycle pipeline now **defaults to plan-only** on every PR (fast, no AWS mutation, no cost); a CI variable (`ACDL_LIFECYCLE_MODE=full`) overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). +- **Cost drivers** are spike-scoped: Terraform plan reads (free), S3 state storage (cents), DynamoDB outbox (cents). Any cost spike > $1/day is an anomaly. + +**Pre-mortem (`PRE_MORTEM.md`):** the project's failure modes were pre-mortemed before the leadership pitch. The v1.10 decay incident (diff-scoped VERIFY missed 7 adapter defects across 8 NFR-patch phases — decks advertised capability that wasn't reproducible) is the root pattern: *a claim outruns the verification that backs it.* Four forward failure modes + structural mitigations: (FM-1) IAM-drift recurrence → IAM policy baseline is regression-tested; (FM-2) cost spike from un-torn-down stacks → D-096 mandatory teardown; (FM-3) deck overstates capability → verified-only claims + decks unfrozen only after re-verification; (FM-4) pilot contract gap → honest scope (microservice + static-assets today; the L2 pattern is extensible). All mitigations are structural, not procedural. + +> **Speaker notes:** This is the slide for the Head of Cloud / Finance. The headline: less than one cent over 8 days of active development; zero BAU cloud spend; the lifecycle pipeline defaults to plan-only so the PR-time cost is zero. The pre-mortem is the credibility slide — we have already asked "how does this fail?" and the mitigations are structural (regression-tested baselines, mandatory teardown, verified-only deck claims). The v1.10 decay incident is disclosed honestly, not hidden — that disclosure IS the mitigation. + +--- + +## A7 — Verified by Construction (the v1.11 architecture) + +v1.11 rebuilt the platform on two architectural pillars that make "Verified" a structural property, not a claim: + +- **The stateless adapter (REQ-123, 918 → ~80 lines).** The Terraform adapter was a 918-line monolith with 3 constant tables and 39 type-specific branches. It is now a ~80-line **stateless assembler**: it owns no module content — no resource shape, no nested HCL blocks, no defaults, no type-specific logic. Each L1 module ships a real `terraform/` module dir owning its resource shape, nested blocks, and defaults (centralized in `locals.tf`). The adapter reads the registry and emits `module "x" { source = ... }` blocks. No type-specific logic in the adapter means a new module is a new terraform dir, not a code change. *(The v1.12 P67 fix closed a dedup defect where multi-resource L1s — ecs-service, alb — produced invalid Terraform; CAP-013 now Verified.)* +- **Pipeline-driven lifecycle testing (REQ-127/128).** A `modules-lifecycle` pipeline matrix-runs each L1 and L2 module's `examples/{simple,complex}.yml` contracts through apply→modify→destroy against live AWS. No per-module Python. **The "test" = the pipeline cell going green.** Defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); `ACDL_LIFECYCLE_MODE=full` runs the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — 22/22 Verified as of v1.12. + +> **Speaker notes:** This is the deep-dive slide for the Head of Engineering / Architecture. The two pillars are the answer to "how do you keep the decks honest?" The adapter is simple enough to reason about (a stateless assembler), and the lifecycle pipeline is the automated verification that backs every "Testing" claim. The v1.10 lesson is the negative space: a 918-line adapter with type-specific branches decayed silently because the VERIFY gate was diff-scoped. The ~80-line stateless adapter + the milestone regression gate are the structural fix. The plan-only default (v1.12) means this verification runs on every PR at zero cost, with the full apply→destroy gated behind a CI variable override. \ No newline at end of file diff --git a/docs/presentations/the-developer-experience.md b/docs/presentations/the-developer-experience.md index 1c4f214..7e74f3f 100644 --- a/docs/presentations/the-developer-experience.md +++ b/docs/presentations/the-developer-experience.md @@ -5,7 +5,7 @@ > **Length:** ~15 minutes · 10 main + 6 appendix = 16 slides > **Purpose:** Sell the developer experience and the citizen developer experience to tech leadership — velocity without sacrificing safety, and security/observability/compliance as platform defaults rather than per-team effort. > **Maturity framing:** "Testing" = works internally, dev pilot-ready. "Planned" = on the roadmap. "Agentic" = involves AI agents or autonomous decision-making. -> **Re-verification (2026-07-27):** Every "Testing" claim in this deck was re-verified in v1.10 Phase 54 (D-093). The headline E2E (contract → resolver → adapter → terraform init/validate/plan) passes against the live AWS account; the local emulating tier (Phase 53) runs the full E2E with no cloud credentials. 16/16 auto-verifiable capabilities Verified; 6 IAM-gated cloud resources are escalated (require an admin principal the spike-runner lacks). See `.ciagent/CAPABILITY_INVENTORY.md`. +> **Re-verification (2026-07-29):** Every "Testing" claim in this deck was re-verified in v1.10 Phase 54 (D-093) and again in v1.11 via the pipeline-driven lifecycle tests (P59–P62). The headline E2E (contract → resolver → adapter → terraform init/validate/plan) passes against the live AWS account; the local emulating tier (Phase 53) runs the full E2E with no cloud credentials. **22/22 auto-verifiable capabilities Verified** (CAP-013 fixed in v1.12 P67 — the adapter's multi-resource L1 dedup defect is closed). The v1.11 lifecycle pipeline ran apply→modify→destroy against live AWS and was then torn down to zero-cost (D-096). See `.ciagent/CAPABILITY_INVENTORY.md` and `.ciagent/PRE_MORTEM.md`. --- @@ -118,7 +118,7 @@ You control when you absorb platform improvements — no surprise upgrades. Consumers control **when** they absorb platform improvements. Testing -- **Floating MAJOR + MINOR tags** (e.g. `@v1.10`) — a consumer automatically receives patch updates within the line. +- **Floating MAJOR + MINOR tags** (e.g. `@v1.11`) — a consumer automatically receives patch updates within the line. - **Semantic versioning with a clear contract:** interface → MAJOR, behavior → MINOR, lifecycle → PATCH. - **A consumer can pin to an exact version** for maximum stability, or float on MAJOR only (`@v1`) to absorb new features on their own cadence. - **Unversioned references (`@main`, bare) are discouraged** — the versioned tag is the only immutability lever a consumer has. @@ -167,11 +167,11 @@ flowchart LR ```yaml jobs: dev: - uses: acdl/.github/workflows/deploy.yml@v1.10 + uses: acdl/.github/workflows/deploy.yml@v1.11 with: { contract: .acdl/contract.yml, environment: dev } qa: needs: dev - uses: acdl/.github/workflows/deploy.yml@v1.10 + uses: acdl/.github/workflows/deploy.yml@v1.11 with: { contract: .acdl/contract.yml, environment: qa } ``` @@ -180,11 +180,11 @@ jobs: ```yaml jobs: dev: - uses: acdl/.github/workflows/deploy.yml@v1.10 + uses: acdl/.github/workflows/deploy.yml@v1.11 with: { contract: .acdl/contract-dev.yaml } qa: needs: dev - uses: acdl/.github/workflows/deploy.yml@v1.10 + uses: acdl/.github/workflows/deploy.yml@v1.11 with: { contract: .acdl/contract-qa.yaml } ``` @@ -212,7 +212,7 @@ Tearing down is as deliberate as deploying — and just as gated. Tearing down a stack is **as deliberate as deploying one.** Testing ```yaml -uses: acdl/.github/workflows/deploy.yml@v1.10 +uses: acdl/.github/workflows/deploy.yml@v1.11 with: contract: .acdl/contract.yml mode: decommission @@ -271,6 +271,8 @@ For deep dives — these slides cover details omitted from the main 10. 3. **A3 — Local Reproducibility** (detail) 4. **A4 — The Road to the North Star** (phased roadmap) 5. **A5 — Glossary** +6. **A6 — Operating Model & Cost** (real AWS spend + pre-mortem) +7. **A7 — Verified by Construction** (the v1.11 architecture) > **Speaker notes:** These are backup slides for Q&A. Use them when the audience asks for the detail behind a main-slide claim. Don't walk through them in the main talk unless time permits. @@ -339,12 +341,12 @@ The entire CI pipeline runs **from the shell**, not just in CI. Core platform
(contract, catalog, evidence)"] --> P2["Phase 2
Safe promotion
qa/prod/dr wiring"] + P1["Phase 1
Core platform
(22/22 Verified)"] --> P2["Phase 2
Safe promotion
qa/prod/dr wiring"] P2 --> P3["Phase 3
Agentic surface
(skill catalog + agents)"] P3 --> P4["Phase 4
North star
citizen developer GA"] ``` -> **Speaker notes:** This is a proposed phasing, not a formally committed plan — call that out explicitly. Phase 1 is what's tested today. Phase 2 is the next milestone (qa/prod/dr wiring). Phase 3 introduces the agentic surface. Phase 4 is the north star: citizen developer GA on the same safety envelope. Use this only when an audience member asks "how do you get from here to there." +> **Speaker notes:** This is a proposed phasing, not a formally committed plan — call that out explicitly. Phase 1 is what's tested and Verified today (22/22 capabilities, torn down to zero-cost). Phase 2 is the next milestone (qa/prod/dr wiring). Phase 3 introduces the agentic surface. Phase 4 is the north star: citizen developer GA on the same safety envelope. Use this only when an audience member asks "how do you get from here to there." --- @@ -361,4 +363,36 @@ flowchart LR | **VCS** | Version Control System — the git hosting platform (GitHub, Gitea, GitLab) | | **NFR** | Non-Functional Requirement — encryption, tagging, observability standards | -> **Speaker notes:** Keep this slide in your back pocket for the audience member who asks "what does ABAC actually mean?" Don't read it aloud. \ No newline at end of file +> **Speaker notes:** Keep this slide in your back pocket for the audience member who asks "what does ABAC actually mean?" Don't read it aloud. + +--- + +## A6 — Operating Model & Cost + +ACDL runs at **zero cloud cost** for day-to-day development. The v1.0→v1.10 AWS spend was measured directly via Cost Explorer (`COST.md`, 2026-07-28): + +| Metric | Value | +|--------|-------| +| Total spend (8 days) | **$0.001883** | +| Daily average | $0.000235 | +| Projected monthly | ~$0.007 | +| Peak day | 2026-07-27 ($0.000867 — v1.10 regression + verify run) | + +- **Local emulators are the primary tier** — the full pipeline runs in-process, no AWS credentials, no Checkov, no DynamoDB. Testing +- **Live-AWS verification is milestone-scoped, then torn down.** The v1.11 lifecycle pipeline ran apply→modify→destroy for every module, then tore down to zero-cost steady state (D-096 — teardown mandatory before milestone COMPLETE). The lifecycle pipeline now **defaults to plan-only** on every PR (fast, no AWS mutation, no cost); a CI variable (`ACDL_LIFECYCLE_MODE=full`) overrides to the real apply→destroy for milestone verification (REQ-134, v1.12). +- **Cost drivers** are spike-scoped: Terraform plan reads (free), S3 state storage (cents), DynamoDB outbox (cents). No running infrastructure between milestones. + +**Pre-mortem (`PRE_MORTEM.md`):** the project's failure modes were pre-mortemed before the leadership pitch. The v1.10 decay incident (diff-scoped VERIFY missed 7 adapter defects — decks advertised capability that wasn't reproducible) is the root pattern: *a claim outruns the verification that backs it.* Four forward failure modes + structural mitigations (regression-tested IAM baseline, mandatory teardown, verified-only deck claims, honest scope). + +> **Speaker notes:** The headline for the Head of Cloud / Finance: less than one cent over 8 days of active development; zero BAU cloud spend; the lifecycle pipeline defaults to plan-only so the PR-time cost is zero. The pre-mortem is the credibility slide — we already asked "how does this fail?" and the mitigations are structural. + +--- + +## A7 — Verified by Construction (the v1.11 architecture) + +v1.11 rebuilt the platform on two architectural pillars that make "Verified" a structural property, not a claim: + +- **The stateless adapter (918 → ~80 lines).** The Terraform adapter was a 918-line monolith with 3 constant tables and 39 type-specific branches. It is now a ~80-line **stateless assembler**: it owns no module content. Each L1 module ships a real `terraform/` module dir owning its resource shape, nested blocks, and defaults. A new module is a new terraform dir, not a code change. *(The v1.12 P67 fix closed a dedup defect for multi-resource L1s — ecs-service, alb; CAP-013 now Verified.)* +- **Pipeline-driven lifecycle testing.** A `modules-lifecycle` pipeline matrix-runs each L1 and L2 module's contracts through apply→modify→destroy against live AWS. **The "test" = the pipeline cell going green.** Defaults to **plan-only** on every PR (fast, no AWS mutation, no cost); `ACDL_LIFECYCLE_MODE=full` runs the real apply→destroy for milestone verification (REQ-134, v1.12). The regression gate (D-091) re-runs all 22 capabilities at milestone completion — 22/22 Verified as of v1.12. + +> **Speaker notes:** This is the deep-dive slide for the Head of Engineering / Architecture. The two pillars answer "how do you keep the decks honest?" The adapter is simple enough to reason about (a stateless assembler); the lifecycle pipeline is the automated verification that backs every "Testing" claim. The v1.10 lesson is the negative space: a 918-line adapter with type-specific branches decayed silently. The ~80-line stateless adapter + the milestone regression gate are the structural fix. The plan-only default (v1.12) means verification runs on every PR at zero cost, with the full apply→destroy gated behind a CI variable override. \ No newline at end of file