docs(milestone): complete v1.30 Single-shot Leadership Deck (release v1.29.3)

---ci---
project: acdl
phase: 2
milestone: v1.30
status: complete
requirements:
  covered: [REQ-372.1,REQ-372.2,REQ-372.3,REQ-372.4,REQ-372.5,REQ-372.6,REQ-372.7,REQ-372.8,REQ-372.9,REQ-372.10,REQ-372.11,REQ-372.12]
  partial: []
---/ci---

.ciagent/CHECKPOINT.json

@@ -1,27 +1,37 @@
 {
-  "phase": 0,
+  "phase": 2,
-  "stage": "mvp_ux_check",
+  "stage": "complete",
   "milestone": "v1.30",
-  "phase_role": "pre_execution",
+  "phase_role": "final",
   "attempts": 0,
-  "updated_at": "2026-08-20T13:52:00Z",
+  "updated_at": "2026-08-20T14:40:00Z",
   "project": "acdl",
   "projects": ["acdl", "nova-blockchain-exchange"],
   "active_milestone": "v1.30",
-  "milestone_branch": "milestone/v1.30-leadership-deck",
+  "milestone_branch": null,
-  "phase_branch": "phase/00-pre-execution",
+  "phase_branch": null,
   "tag_line": "v1.29.x",
-  "phase_name": "pre-execution",
+  "phase_name": "final-review-ship",
   "milestone_type": "feature",
-  "reqs_covered": [],
+  "reqs_covered": ["REQ-372.1","REQ-372.2","REQ-372.3","REQ-372.4","REQ-372.5","REQ-372.6","REQ-372.7","REQ-372.8","REQ-372.9","REQ-372.10","REQ-372.11","REQ-372.12"],
   "reqs_partial": [],
   "previous_milestone": {
-    "milestone": "v1.29",
+    "milestone": "v1.30",
-    "tag": "v1.28.6",
+    "tag": "v1.29.3",
     "complete": true,
-    "merged_to_main": "9dc5669",
+    "merged_to_main": "96765fe",
     "branches_deleted": true,
-    "releases_created": true
+    "releases_created": true,
+    "release_ids": [811, 812, 813]
   },
-  "notes": "v1.30 Phase 0 MVP/UX CHECK passed. PLAN.md has all 3 sections: User-Facing Surface (PPTX+source+smoke test), Happy Path (J1), UX Acceptance Criteria (8 items). Auto-generated at full autonomy. Next: PHASE 0 SHIP."
+  "ship": {
+    "tag": "v1.29.3",
+    "release_id": 813,
+    "release_url": "https://git.cloudinit.dev/continuous-intelligence/acdl/releases/tag/v1.29.3",
+    "merged_to_main": true,
+    "merge_commit": "96765fe",
+    "branches_deleted": ["phase/02-final-review-ship", "milestone/v1.30-leadership-deck"],
+    "local_only": false
+  },
+  "notes": "v1.30 MILESTONE COMPLETE. Tag v1.29.3 (milestone release), Gitea release id=813. Merged to main 96765fe. All milestone branches deleted (local + remote). REQ-372.1..12 all complete. CAP-042 + D-241..D-243 recorded. 3 Gitea releases: 811 (P0 v1.29.1), 812 (P1 v1.29.2), 813 (P2 v1.29.3). Checkpoint cleared — next run starts a new milestone."
 }

.ciagent/PROJECT.md

@@ -691,6 +691,22 @@ New requirements REQ-354..REQ-369 + REQ-371 + REQ-363b — full text in
 
 - **Decisions:** `D-241..D-243` (3 decisions, authored in CLARIFY).
   Max existing D = D-240 (v1.29). Next free: D-244.
+  - **D-241** — Leadership deck is a single-shot, discrete, hand-
+    authored artifact (NOT a compression of the existing citizen-
+    developer pitch `nova-autonomous-cloud-delivery-marp.md`).
+    Audience: Infrastructure & Operations leadership (CTO + VP
+    Technology + Product Management). August 2026 presentation
+    anchor + November 2026 runway anchor. The existing citizen-
+    developer deck remains untouched. Overrides the post-v1.29
+    STATE.md intake assumption 3.
+  - **D-242** — Narrow `scripts/render_pptx.py` extension: accept an
+    explicit source `.md` path + `--output` filename; render a
+    right-aligned footer textbox on every slide (python-pptx does
+    not read the Marp `footer:` directive). Non-REQ-372 prerequisite
+    per spec §3.3 Edge 2.
+  - **D-243** — Date anchor discipline: August 2026 is a month-only
+    presentation anchor (no specific day); November 2026 is the
+    runway anchor (~90 days).
 - **Capabilities:** `CAP-042` (1 capability, appended at ship).
   Max existing CAP = CAP-041 (v1.29). Next free: CAP-043.
 

.ciagent/REQUIREMENTS.md

@@ -1025,15 +1025,15 @@ principles, anti-goals, and integration-boundary claims to
 
 | REQ | Phase | Status |
 |-----|-------|--------|
-| REQ-372.1 | P1 | planned |
+| REQ-372.1 | P1 | complete (v1.29.2) |
-| REQ-372.2 | P1 | planned |
+| REQ-372.2 | P1 | complete (v1.29.2) |
-| REQ-372.3 | P1 | planned |
+| REQ-372.3 | P1 | complete (v1.29.2) |
-| REQ-372.4 | P1 | planned |
+| REQ-372.4 | P1 | complete (v1.29.2) |
-| REQ-372.5 | P1 | planned |
+| REQ-372.5 | P1 | complete (v1.29.2) |
-| REQ-372.6 | P1 | planned |
+| REQ-372.6 | P1 | complete (v1.29.2) |
-| REQ-372.7 | P1 | planned (visual review) |
+| REQ-372.7 | P1 | complete (v1.29.2, visual review pass) |
-| REQ-372.8 | P1 | planned |
+| REQ-372.8 | P1 | complete (v1.29.2) |
-| REQ-372.9 | P1 | planned |
+| REQ-372.9 | P1 | complete (v1.29.2) |
-| REQ-372.10 | P1 | planned |
+| REQ-372.10 | P1 | complete (v1.29.2) |
-| REQ-372.11 | P1 | planned |
+| REQ-372.11 | P1 | complete (v1.29.2) |
-| REQ-372.12 | P1 | planned |
+| REQ-372.12 | P1 | complete (v1.29.2) |

.ciagent/ROADMAP.md

@@ -146,6 +146,24 @@
   10 NFR constraints. Tags: `v1.28.0` (P0) → `v1.28.1..v1.28.5` (P1..P5)
   → `v1.28.6` (P6 final = milestone release).
 
+- **v1.30 (complete, tag `v1.29.3` = the v1.30 release, merged to main
+  2026-08-20):** Single-shot Leadership Deck. Feature milestone. A
+  hand-authored 7-slide PPTX deck for Infrastructure & Operations
+  leadership (CTO + VP Technology + Product Management), presented
+  August 2026, securing architecture endorsement and a November 2026
+  runway. The deck is a **discrete artifact** (D-241: NOT a
+  compression of the existing citizen-developer pitch
+  `nova-autonomous-cloud-delivery-marp.md`, which remains unmodified).
+  Authored as Marp markdown, rendered via the existing
+  `scripts/render_pptx.py` (narrowly extended per D-242: path arg +
+  `--output` + per-slide footer textbox + leading-comment skip).
+  Smoke test `scripts/check_leadership_deck.sh` (on-demand, NOT a CI
+  gate). Vision `[1]` grounding in slides 3/5/7 speaker notes
+  (resolve to `docs/vision.md`). 12 requirements (REQ-372.1..12), 1
+  capability (CAP-042), 3 decisions (D-241..D-243). Tags: `v1.29.1`
+  (P0) → `v1.29.2` (P1 execution) → `v1.29.3` (P2 final = milestone
+  release).
+
 > **Full v1.0–v1.24 phase detail, wave ordering, success criteria, and
 > decision cross-references:** `.ciagent/archive/ROADMAP-v1.0-v1.24.md`.
 

.ciagent/STATE.md

@@ -357,6 +357,7 @@
 | CAP-039 | Platform ops reposplit | v1.29 / `v1.28.6` | `nova-platform-ops` (out-of-band), `docs/operator-guide-platform-ops.md`, `docs/archive/nova-idp-cfn-v1.28.md` | REQ-369, REQ-OPS-GUIDE, D-232, D-235 | covered-reference | engineering (`acdl/acdl`, GitHub) ends at the artifact; operations (`nova-platform-ops`, Gitea-private, OPER-PRIV) begins at the live platform; tag-pin handoff; CFN archived; covered-reference REQs tracked via cutover gates |
 | CAP-040 | KJ substrate lockstep | v1.29 / `v1.28.6` | `nova-platform-ops` (out-of-band), `platform/abac/kj-version.txt`, `.github/workflows/publish.yml` | REQ-371, REQ-363, REQ-363b, D-238, D-239 | covered-reference | one ECR image digest shared by Lambda `image_uri` + Fargate task `image`; `lifecycle.precondition` on both resources at `terraform plan`; KJ-STATIC (`CGO_ENABLED=0`, `file(1)` asserts `statically linked`); no second pipeline, no second SHA pin |
 | CAP-041 | JWKS edge-only | v1.29 / `v1.28.6` | `nova-platform-ops` (out-of-band), `docs/operator-guide-platform-ops.md` | REQ-364, REQ-365, REQ-366, INV-18, D-233 | covered-reference | JWKS is the only public read surface; CloudFront + OAC (`AuthType: AWS_IAM`, NOT `NONE`, `OriginAccessControlOriginType: lambda`, `SigningBehavior: always`); direct Function URL → 403, via-CloudFront → 200; WAF rate-limit 3000/5min + AWSManagedRulesCommonRuleSet; ACM DNS-validated in us-east-1; Route53 A-alias |
+| CAP-042 | Leadership presentation deck (single-shot) | v1.30 / `v1.29.3` | `docs/presentations/nova-leadership-deck-marp.md`, `docs/presentations/nova-leadership-deck.pptx`, `scripts/check_leadership_deck.sh` | REQ-372.1..REQ-372.12, D-241, D-242, D-243 | local | Single-shot 7-slide PPTX deck for Infrastructure & Operations leadership (CTO + VP Technology + Product Management); presented August 2026; November 2026 runway anchor; discrete hand-authored artifact (NOT a compression of the citizen-developer pitch per D-241); rendered via existing `scripts/render_pptx.py` (narrowly extended per D-242); smoke test on-demand (NOT a CI gate); vision `[1]` grounding in slides 3/5/7 |
 
 ## Archive pointers
 
@@ -497,7 +498,7 @@ Locked Decisions:                 D-001..D-240 (full ledger in PROJECT.md + CLAR
 
 Active Invariants:                INV-1..INV-18 (full text above). New in v1.28: INV-12 (mode observability), INV-13 (mode determinism), INV-14 (credential type encodes role), INV-15 (no AWS-managed identity), INV-16 (Argon2id password storage), INV-17 (ABAC discipline fail-closed). New in v1.29: INV-18 (JWKS-EDGE-ONLY) + 10 NFR constraints (KJ-STATIC, KJ-LOCKSTEP, KJ-WARMUP-HEALTH, OPER-PRIV, IAM-NARROW, DRIFT-DETECT, IMPORT-IDEMPOTENT, TFM-HITL, JWKS-SLO, JWKS-ROTATION)
 
-Standing Capability Gate:         CAP-001..CAP-041 — all Verified (32 from v1.0..v1.27 + 6 from v1.28 + 3 from v1.29 covered-reference). Gate enforced by `core/regression_verify.py` + CI merge gates. CAP-033..038 added v1.28 (CLI surface, delegation AST, layer/wheel match, auth flow, KMS sign, PAT revocation). CAP-039..041 added v1.29 (platform-ops-reposplit, kj-substrate-lockstep, jwks-edge-only — covered-reference, live cutover pending operator action in nova-platform-ops).
+Standing Capability Gate:         CAP-001..CAP-042 — all Verified (32 from v1.0..v1.27 + 6 from v1.28 + 3 from v1.29 covered-reference + 1 from v1.30 single-shot deck). Gate enforced by `core/regression_verify.py` + CI merge gates. CAP-033..038 added v1.28 (CLI surface, delegation AST, layer/wheel match, auth flow, KMS sign, PAT revocation). CAP-039..041 added v1.29 (platform-ops-reposplit, kj-substrate-lockstep, jwks-edge-only — covered-reference, live cutover pending operator action in nova-platform-ops). CAP-042 added v1.30 (leadership-deck — single-shot, on-demand smoke test, NOT a CI gate).
 
 Anti-Goals Touched:               `docs/vision.md` §7 / `NORTH_STAR.md` §Anti-Goals — (1) not an upstream dev platform; (2) not a general-purpose AI; (3) not a legacy infra bridge; (4) not a permissive delivery highway; (5) not a mutable audit log. v1.29 honored all 5 (no PDLC reach, narrow CLI autonomy, no VMs, ABAC fail-closed + HITL gates intact, immutable outbox).
 

docs/presentations/nova-leadership-deck-marp.md

@@ -0,0 +1,218 @@
+<!--
+  REQ-372 — Nova Leadership Presentation Deck (v1.30, single-shot artifact).
+
+  This deck is the leadership artifact for Infrastructure & Operations
+  (CTO + VP Technology + Product Management), presented live in
+  August 2026, securing architecture endorsement and a November 2026
+  runway to demonstrate Nova's next milestone.
+
+  Related-but-distinct artifact: nova-autonomous-cloud-delivery-marp.md
+  (the citizen-developer pitch). This deck does NOT compress or modify
+  that artifact — the two decks remain discrete (D-241). The existing
+  citizen-developer deck is untouched.
+
+  Vision grounding: [1] citations in slides 3, 5, 7 speaker notes
+  resolve to docs/vision.md (the spec's acdl-vision.md reference).
+
+  Render: python3 scripts/render_pptx.py docs/presentations/nova-leadership-deck-marp.md \
+          --output docs/presentations/nova-leadership-deck.pptx
+  Smoke test: bash scripts/check_leadership_deck.sh
+-->
+---
+marp: true
+theme: default
+footer: "Nova Platform - Infrastructure & Operations"
+paginate: false
+size: 16x9
+style: |
+  section { font-family: "Akkurat Pro", "Helvetica Neue", "Arial", sans-serif; font-size: 22px; color: #1B1B1B; padding: 48px 56px 40px; overflow: auto; }
+  h1 { color: #D6002A; font-size: 34px; margin-bottom: 0.3em; }
+  h2 { color: #D6002A; font-size: 26px; margin-bottom: 0.2em; }
+  h3 { color: #D6002A; font-size: 22px; margin-bottom: 0.2em; }
+  table { font-size: 18px; width: 100%; border-collapse: collapse; }
+  th { background: #F0F0F0; border-bottom: 2px solid #D6002A; padding: 4px 8px; text-align: left; }
+  td { border-bottom: 1px solid #F0F0F0; padding: 4px 8px; }
+  blockquote { border-left: 4px solid #D6002A; color: #1B1B1B; font-size: 20px; padding-left: 12px; }
+  pre { background: #1B1B1B; color: #FFFFFF; border-radius: 4px; padding: 12px; font-size: 16px; }
+  code { background: #F0F0F0; color: #1B1B1B; border-radius: 2px; padding: 1px 4px; font-size: 18px; }
+  pre code { background: transparent; color: #FFFFFF; }
+  img { display: block; margin: 0 auto; max-width: 100%; max-height: 380px; object-fit: contain; }
+  strong { color: #D6002A; }
+  .benefit { margin-top: 0.6em; padding-top: 0.4em; border-top: 1px solid #D6002A; color: #1B1B1B; font-size: 20px; font-style: italic; }
+  @media print { section { overflow: hidden; } }
+---
+
+## The friction every delivery team lives today
+
+> *Velocity is up; the coordination surface around each change is up faster.*
+
+- → Infrastructure is authored by people who don't specialize in infrastructure.
+- → Every change is gated because one misconfiguration can expose the entire estate.
+- → Compliance, security, and NFRs are checked late — fueling remediation cycles that erode delivery cadence and team morale.
+
+> *Nova absorbs all three — owned building blocks, separation of concerns, attested compliance up front.*
+
+<!--
+Three patterns drive the friction every delivery team lives today, and all three trace back to one binding constraint: software delivery scales with the coordination surface around it, not the engineering inside it [1]. That is the claim the vision document opens with, and it is the lens for everything Nova does.
+
+The first pattern: infrastructure is authored by people who do not specialize in infrastructure. The platform team is not standing behind every S3 bucket, every RDS instance, every KMS key. The application team is. They are smart, they are capable, but infrastructure is not their craft, and the long tail of well-meaning services shows it.
+
+The second pattern: every change is gated because one misconfiguration can expose the entire estate. A single bucket without SSE-KMS, a single RDS without deletion protection, a single Lambda with an over-privileged role — and the blast radius is the whole account. So every change is reviewed, every change is gated, and the gate is manual because the cost of getting it wrong is account-wide.
+
+The third pattern: compliance, security, and NFRs are checked late. They are checked after the PR, after the merge, sometimes after the deploy. By then remediation is a cycle — it erodes delivery cadence and it erodes morale.
+
+Nova absorbs all three. Owned building blocks, separation of concerns, attested compliance up front. And one distinction that matters for this room: Nova's lane is infrastructure patching. AppSec — dependency review, runtime application security, the application-layer threat model — stays with the application team. Nova is not a remediation tool. Nova is not a security blanket. Nova is the infrastructure beneath the application, owned by the platform, attested before the consumer ever touches it.
+-->
+
+---
+
+## Nova in one frame
+
+> *You already recognize this pattern.*
+
+Every Central IT team curates a golden image for Windows, for Linux, for macOS. They own it. They patch it. They ship it. Consumers consume it without thinking about what's inside.
+
+Nova plays the same role one layer up — for everything that runs your cloud. S3 buckets with SSE-KMS posture. RDS instances with deletion protection and PITR. Lambda containers with static ABAC binaries. ALBs, ECS services, KMS keys, DynamoDB tables. Each one is owned by the platform team, patched by the platform team, attested by the platform team, and consumed by anyone who declares a contract.
+
+The difference: every primitive is versioned, tested across its entire lifecycle, and bounded by policy before any consumer ever touches it.
+
+> *Nova's lane is the infrastructure beneath the application. AppSec, dependency review, and runtime application security stay where they have always been — with the application team.*
+
+<!--
+The Central IT golden-image pattern is one every leadership team already recognizes. Central IT curates the Windows image, the Linux image, the macOS image. They own it, they patch it, they ship it, and consumers consume it without thinking about what is inside. That trade — per-application control for uniform operability — is a trade every enterprise has already made at the OS layer.
+
+Nova plays the same role one layer up. Not the OS image, but everything that runs your cloud: S3 buckets with SSE-KMS posture, RDS instances with deletion protection and PITR, Lambda containers with static ABAC binaries, ALBs, ECS services, KMS keys, DynamoDB tables. Each primitive is owned by the platform team, patched by the platform team, attested by the platform team, and consumed by anyone who declares a contract. The platform begins where the artifact is compiled and ends where it runs in production under operational guardrails [1]. That boundary is the sovereignty claim — Nova governs the delivery lifecycle, not the upstream product or software development lifecycle.
+
+The difference from Central IT is rigor: every primitive is versioned, tested across its entire lifecycle, and bounded by policy before any consumer ever touches it. The sovereignty-via-boundary argument is not defensive. It is the same argument Central IT already won at the OS layer: the platform owns the primitive so the consumer does not have to.
+
+And the lane stays narrow. Nova's lane is the infrastructure beneath the application. AppSec, dependency review, and runtime application security stay where they have always been — with the application team.
+-->
+
+---
+
+## Two principles that organize everything else
+
+> *The architecture is principled, not improvised. Two tenets discipline every other decision.*
+
+**Sovereign boundary.** Nova governs the delivery lifecycle; it does not reach upstream into product or software development [1]. Integration with SDLC and PDLC partners happens exclusively through the validated, published contract surface. What lives outside the contract is not Nova's domain.
+
+**Lower autonomous · higher attested.** Lower environments proceed through agentic automation. Promotion to higher environments requires deliberate human attestation — not as a rubber stamp, but as policy-mandated accountability [1]. The compute the platform makes; the choice the human keeps.
+
+> *Everything else in the architecture inherits from these two.*
+
+<!--
+The architecture is principled, not improvised. Two tenets discipline every other decision the platform makes, and both come straight from the vision document [1].
+
+The first tenet is the sovereign boundary. Nova governs the delivery lifecycle. It does not reach upstream into product or software development. Integration with SDLC and PDLC partners — the IDE, the sprint tool, the author workflow, the agent harness — happens exclusively through the validated, published contract surface. What lives outside the contract is not Nova's domain. This is not a defensive posture. It is an operating principle: the platform owns its lane, the upstream owns its lane, and the contract is where they meet. The four-layer model, the contract schema, the policy envelope — all of it inherits from this tenet.
+
+The second tenet is lower autonomous, higher attested. Lower environments proceed through agentic automation — zero-touch, the platform reconciles. Promotion to higher environments — qa, prod, dr — requires deliberate human attestation. Not a rubber stamp. Not a courtesy notification. A policy-mandated act of accountability by a named human distinct from the PR author. The compute the platform makes; the choice the human keeps. The HITL gates, the confidence threshold, the escalation paths — all of it inherits from this tenet.
+
+And the point for this room: these two tenets are not aspirational. They are load-bearing. Every other architectural decision — the four-layer model, the contract schema, the policy envelope, the audit lineage, the confidence signal — inherits from these two. If you endorse the architecture, you are endorsing these two tenets and everything that flows from them. The next slide is what the line looks like in 18 months of milestones.
+-->
+
+---
+
+## Live · Attested · Stays human
+
+**Live today**
+41 capabilities across 12 domains. Contract ingestor, audit outbox, state buckets, and the live pilot run have been operating in our AWS estate since v1.7; pilot evidence at v1.26 returned confidence 0.800. DORA + adoption + policy-conformance metrics flow to PowerBI from the same audit stream as the lineage. Every finding carries one owner, one patch state, one audit entry — one pane, no second source of truth. A POC is production-grade by construction: there is no "POC that became prod" surprise.
+
+**Attested on promotion**
+qa, prod, and dr require a named human approver distinct from the PR author. Rubber stamps cannot be silently issued.
+
+**Stays human — by design**
+Confidence below the autonomy threshold at qa, prod, or dr triggers human escalation [1]. Some categories of decision are preserved for human judgment, and the platform says so out loud.
+
+<!--
+Three columns, three claims, one disambiguation. The claims are real, observable, and disciplined — and the distinction matters for this room.
+
+Real: 41 capabilities across 12 domains are live today. The contract ingestor, the audit outbox, the state buckets, and the live pilot run have been operating in our AWS estate since v1.7. Pilot evidence at v1.26 returned confidence 0.800 — that is a measured, recorded number, not a forecast. DORA, adoption, and policy-conformance metrics flow to PowerBI from the same audit stream as the lineage. One pane, no second source of truth. Every finding carries one owner, one patch state, one audit entry. A POC is production-grade by construction — there is no "POC that became prod" surprise, because the platform enforces production-grade posture from the first apply [1].
+
+Observable: the audit lineage is the single pane. DORA, adoption, policy-conformance — all from the same stream. That is not three dashboards stitched together. It is one stream, one schema, one owner per finding. The POC-to-prod discipline [1] is the same claim from the other direction: the platform does not have a "POC mode" that gets quietly upgraded to "prod mode." Production-grade is the default.
+
+Disciplined: attested on promotion, stays human by design. qa, prod, and dr require a named human approver distinct from the PR author. Rubber stamps cannot be silently issued. Confidence below the autonomy threshold at qa, prod, or dr triggers human escalation [1]. Some categories of decision are preserved for human judgment, and the platform says so out loud. That is the HITL discipline closing [1]: the platform makes the compute, the human keeps the choice, and the boundary is policy-mandated, not discretionary.
+-->
+
+---
+
+## The boundary keeps us honest
+
+> *Nova stays where it belongs.*
+
+**In Nova's lane**
+- → Infrastructure primitives: S3, RDS, Lambda, ECS, DynamoDB, KMS, CloudFront.
+- → Operational guardrails: confidence, policy, attestation, audit lineage.
+- → CVE response at the infrastructure layer.
+
+**Outside Nova's lane**
+- → Application business logic.
+- → IDE, sprint, author workflows [1].
+- → Application-layer security: AppSec, dependency review, runtime threat modeling.
+- → VM, bare-metal, OS lifecycles [1].
+
+> *The line is the contract. Everything below the contract is Nova. Everything above it stays where it has always been.*
+
+<!--
+The boundary is not a defensive posture. It is an operating principle — and it is the principle that keeps the architecture honest [1].
+
+In Nova's lane: infrastructure primitives. S3, RDS, Lambda, ECS, DynamoDB, KMS, CloudFront. Operational guardrails — confidence, policy, attestation, audit lineage. CVE response at the infrastructure layer. These are the things the platform owns, the things the platform patches, the things the platform attests. The consumer declares intent; the platform delivers safe production deployment.
+
+Outside Nova's lane: application business logic. The IDE, the sprint, the author workflow [1] — those are upstream of the contract, and the platform does not reach into them. Application-layer security — AppSec, dependency review, runtime threat modeling — stays with the application team. That is not a gap. It is an autonomy-preserving design choice: the application team owns their lane, the platform owns its lane, and the contract is where they meet. VM, bare-metal, OS lifecycles [1] — the vision document is explicit: infrastructure is consumed, not maintained. Compute is abstract, containerized, or serverless. The platform does not manage node-level or OS-level lifecycles.
+
+The line is the contract. Everything below the contract is Nova. Everything above it stays where it has always been. That is the boundary discipline, and it is the discipline that lets the platform scale without becoming the application team's bottleneck — and lets the application team scale without becoming the platform's risk. The boundary is what makes the ask small and the return large: the platform owns its surface, the consumer owns theirs, and neither side silently absorbs the other's burden.
+-->
+
+---
+
+## The 18-month shape
+
+> *Where CDLC meets SDLC + PDLC — through the contract surface, not above it.*
+
+**α (now → Q4'26) — Operating model + federated governance.** A named platform-ops body owns the platform; SLAs on every L2 are ratifiable by platform + consumer. The operating model is published; integration surfaces for SDLC and PDLC harnesses are documented at the contract boundary.
+
+**β (Q1'27) — Auto-published infra observability.** Every consumer stack ships with CloudWatch dashboards, uptime-kuma monitors, and alert routing on apply — infrastructure primitives publish observability as a property, no per-team authoring required.
+
+**γ (Q2'27) — Runbook generation from telemetry.** Every L1 primitive ships with an auto-generated incident runbook derived from observed patterns. SREs get a starting runbook, not a blank page.
+
+**δ (Q3'27 → Q4'27) — Audit ledger, tamper-resistant + externally addressable.** The SQLite hash-evidence stream migrates to S3 Object Lock + JWS signatures. External counsel verifies any production change back to a named human attestation.
+
+> *Nova absorbs no IDE, no editor, no sprint tool, no agent harness.*
+
+<!--
+The 18-month shape is a boundary-respecting integration arc, not an expansion arc. Four milestones, each disciplined by the sovereign-boundary tenet [1]: Nova meets SDLC and PDLC through the contract surface, not above it.
+
+Alpha, now through Q4 2026, is the operating model and federated governance. A named platform-ops body owns the platform. SLAs on every L2 are ratifiable by platform and consumer. The operating model is published. Integration surfaces for SDLC and PDLC harnesses are documented at the contract boundary [1] — that is the unlock. The platform publishes the contract; the upstream tool integrates against it.
+
+Beta, Q1 2027, is auto-published infra observability. Every consumer stack ships with CloudWatch dashboards, uptime-kuma monitors, and alert routing on apply. The infra-vs-app observability discipline [1]: the platform publishes infrastructure observability. Application observability stays with the app team.
+
+Gamma, Q2 2027, is runbook generation from telemetry. Every L1 primitive ships with an auto-generated incident runbook derived from observed patterns. SREs get a starting runbook, not a blank page. The infra-vs-app runbook discipline [1]: the platform generates the infrastructure runbook. The application runbook stays with the app team.
+
+Delta, Q3 through Q4 2027, is the audit ledger, tamper-resistant and externally addressable. The SQLite hash-evidence stream migrates to S3 Object Lock plus JWS signatures. External counsel verifies any production change back to a named human attestation — audit lineage outward [1], not upstream. The ledger is the proof, the attestation is the name, and the boundary holds.
+
+Nova absorbs no IDE, no editor, no sprint tool, no agent harness. The contract surface is where CDLC meets SDLC and PDLC.
+-->
+
+---
+
+## What we ask · What comes back
+
+**What we ask.**
+Architecture endorsement. Runway to the next milestone.
+
+**Why now.**
+Agentic SDLC is reshaping the delivery curve. What is barely keepable today — incident response, compliance reconciliation, security remediation — does not compress at the same rate as the velocity it has to keep pace with. By the end of 2027, the gap between delivery acceleration and operational absorption is the structural risk.
+
+**What comes back.**
+The infrastructure foundation that absorbs the velocity. Metrics that tell us where to push next. Audit lineage that closes the regulatory question. The next milestone, **by November 2026**.
+
+> *What we do not ask for: an IDE, a sprint tool, an author workflow, an upstream pipeline. Nova stays in its lane [1].*
+
+<!--
+This is presented to Infrastructure and Operations leadership in August 2026. The ask is two things: architecture endorsement, and runway to the next milestone by November 2026.
+
+Why now. Agentic SDLC is reshaping the delivery curve. The velocity is up, and it is going to keep going up. What is barely keepable today — incident response, compliance reconciliation, security remediation — does not compress at the same rate as the velocity it has to keep pace with. The operational absorption side of the curve is steeper than the delivery acceleration side, and the gap between them is the structural risk. By the end of 2027, that gap is the thing that breaks cadence. Internal directional target: a 60% reduction in the operational absorption gap is the goal we are holding ourselves to — not a sourced claim, a directional target, and the metrics the platform already produces will tell us whether we are closing it.
+
+What comes back. The infrastructure foundation that absorbs the velocity. Metrics that tell us where to push next. Audit lineage that closes the regulatory question. And the next milestone, by November 2026. That is the runway ask: not a budget, not a headcount, not a re-org. Runway to land the architecture endorsement and demonstrate the next milestone.
+
+What we do not ask for: an IDE, a sprint tool, an author workflow, an upstream pipeline. Nova stays in its lane [1]. The sovereign boundary is the discipline that makes the ask small and the return large. Use the runway to land the architecture endorsement.
+-->

scripts/check_leadership_deck.sh

@@ -0,0 +1,98 @@
+#!/usr/bin/env bash
+# Nova Leadership Deck smoke test (REQ-372.8).
+#
+# Runnable on demand from the repo root. NOT a CI gate (single-shot
+# artifact per REQ-372.8 / D-241). Asserts:
+#   (a) source markdown exists
+#   (b) slide count = 7
+#   (c) per-slide speaker-note word counts in band
+#       (1/2/4/6: 150-300; 3/5: 250-400; 7: 200-300)
+#   (d) footer string present in source
+#   (e) only S&P hex colors (#D6002A, #1B1B1B, #FFFFFF, #F0F0F0)
+#   (f) rendered PPTX file exists
+#
+# Usage: bash scripts/check_leadership_deck.sh
+# Returns: 0 on pass, 1 on fail.
+set -euo pipefail
+
+SRC="docs/presentations/nova-leadership-deck-marp.md"
+PPTX="docs/presentations/nova-leadership-deck.pptx"
+FOOTER='Nova Platform - Infrastructure & Operations'
+ALLOWED_COLORS='#D6002A #1B1B1B #FFFFFF #F0F0F0'
+
+fail() { echo "FAIL: $1" >&2; exit 1; }
+ok()   { echo "PASS: $1"; }
+
+# (a) source exists
+[ -f "$SRC" ] || fail "(a) source not found: $SRC"
+ok "(a) source exists: $SRC"
+
+# (b) slide count = 7
+# Strip frontmatter (first --- ... --- block, which may follow a header
+# HTML comment), then count --- separators + 1.
+SLIDE_COUNT=$(awk '
+  !started && /^---[[:space:]]*$/ { started=1; next }
+  started && !infm_done && /^---[[:space:]]*$/ { infm_done=1; next }
+  infm_done && /^---[[:space:]]*$/ { count++ }
+  END { print count + 1 }
+' "$SRC")
+[ "$SLIDE_COUNT" -eq 7 ] || fail "(b) slide count=$SLIDE_COUNT (expected 7)"
+ok "(b) slide count=7"
+
+# (c) per-slide speaker-note word counts in band.
+# Extract per-slide speaker notes (HTML comments) and count words.
+# Bands: 1/2/4/6 -> 150-300; 3/5 -> 250-400; 7 -> 200-300.
+python3 - "$SRC" << 'PYEOF' || fail "(c) speaker-note word count out of band"
+import re, sys
+md = open(sys.argv[1]).read()
+lines = md.splitlines()
+# find frontmatter end
+fm_begin = None
+for i, l in enumerate(lines):
+    if l.strip() == "---":
+        fm_begin = i
+        break
+fm_end = None
+for i in range(fm_begin+1, len(lines)):
+    if lines[i].strip() == "---":
+        fm_end = i
+        break
+body = "\n".join(lines[fm_end+1:])
+parts = re.split(r"\n---\s*\n", body)
+slides = [p for p in parts if p.strip()]
+bands = {1:(150,300), 2:(150,300), 3:(250,400), 4:(150,300), 5:(250,400), 6:(150,300), 7:(200,300)}
+for idx, slide in enumerate(slides, 1):
+    notes = re.findall(r"<!--\s*(.*?)\s*-->", slide, re.DOTALL)
+    note_text = " ".join(notes)
+    wc = len(note_text.split())
+    lo, hi = bands[idx]
+    if not (lo <= wc <= hi):
+        print(f"  slide {idx}: {wc} words (band {lo}-{hi}) FAIL", file=sys.stderr)
+        sys.exit(1)
+    print(f"  slide {idx}: {wc} words (band {lo}-{hi}) ok")
+print("PASS (c) all speaker-note word counts in band")
+PYEOF
+ok "(c) speaker-note word counts in band"
+
+# (d) footer string present in source
+grep -qF "$FOOTER" "$SRC" || fail "(d) footer string not found in source"
+ok "(d) footer string present in source"
+
+# (e) only S&P hex colors in source
+COLORS=$(grep -oiE '#[0-9A-Fa-f]{6}' "$SRC" | sort -u | tr '\n' ' ' | sed 's/ $//')
+for c in $COLORS; do
+  found=0
+  for a in $ALLOWED_COLORS; do
+    [ "$c" = "$a" ] && found=1 && break
+  done
+  [ "$found" -eq 1 ] || fail "(e) non-S&P color found: $c (allowed: $ALLOWED_COLORS)"
+done
+ok "(e) only S&P theme colors: ${COLORS:-<none>}"
+
+# (f) PPTX file exists (hard fail per Q-M4)
+[ -f "$PPTX" ] || fail "(f) PPTX not found: $PPTX (run: python3 scripts/render_pptx.py $SRC --output $PPTX)"
+ok "(f) PPTX exists: $PPTX"
+
+echo
+echo "ALL CHECKS PASSED"
+exit 0

scripts/render_pptx.py

@@ -10,10 +10,15 @@ titles, bullets, blockquotes, images, tables, and benefit callouts.
 
 Usage:
     python3 scripts/render_pptx.py [deck-name]
+    python3 scripts/render_pptx.py <source.md> [--output <out.pptx>]
 
-Defaults to `nova-autonomous-cloud-delivery`. Reads
+Defaults to `nova-autonomous-cloud-delivery`. If the first arg ends in
+`.md` or contains a path separator, it is treated as an explicit source
+path (D-242 extension); else it is a deck name (reads
 `docs/presentations/{deck}-marp.md`, writes
-`docs/presentations/{deck}-python.pptx`.
+`docs/presentations/{deck}-python.pptx`). `--output` overrides the
+output path. The Marp `footer:` frontmatter directive is rendered as a
+right-aligned textbox on every slide (D-242).
 """
 import os
 import re
@@ -58,15 +63,75 @@ IMG_MAX_H = Inches(4.0)
 
 
 # --- Markdown parsing --------------------------------------------------------
+def parse_frontmatter(md_text: str):
+    """Extract YAML frontmatter as a dict (simple key: value parse).
+
+    Returns {} if no frontmatter. Only handles flat key:value pairs
+    (no nested structures) — sufficient for Marp deck frontmatter
+    (marp, theme, footer, paginate, size). The `style:` block (multi-
+    line `|`) is skipped (not needed by the python-pptx renderer).
+    Skips leading HTML comments before the frontmatter fence.
+    """
+    text = md_text.lstrip()
+    # Skip leading HTML comments before frontmatter.
+    while text.startswith("<!--"):
+        end = text.find("-->")
+        if end == -1:
+            return {}
+        text = text[end + 3 :].lstrip()
+    if not text.startswith("---"):
+        return {}
+    end = text.find("\n---", 3)
+    if end == -1:
+        return {}
+    fm_text = text[3:end]
+    fm = {}
+    in_multiline = False
+    for line in fm_text.splitlines():
+        s = line.strip()
+        if not s or s.startswith("#"):
+            continue
+        if in_multiline:
+            # skip multi-line block values (e.g. style: |)
+            if s and not s.startswith(" ") and ":" in s:
+                in_multiline = False
+            else:
+                continue
+        if ":" in s:
+            k, _, v = s.partition(":")
+            k = k.strip()
+            v = v.strip()
+            if v in ("|", ">"):
+                in_multiline = True
+                continue
+            # strip surrounding quotes
+            if v and v[0] in "\"'" and v[-1] == v[0]:
+                v = v[1:-1]
+            fm[k] = v
+    return fm
+
+
 def split_slides(md_text: str):
-    """Strip YAML frontmatter, then split the deck into slide source strings."""
+    """Strip leading HTML comments + YAML frontmatter, then split into slides.
+
+    A Marp deck may carry a header HTML comment before the frontmatter
+    (e.g. the REQ-372 related-artifacts comment). Skip leading comments
+    before detecting the `---` frontmatter fence.
+    """
+    text = md_text.lstrip()
+    # Skip leading HTML comments (<!-- ... -->) before frontmatter.
+    while text.startswith("<!--"):
+        end = text.find("-->")
+        if end == -1:
+            break
+        text = text[end + 3 :].lstrip()
     # Strip YAML frontmatter (between first pair of `---` lines).
-    if md_text.lstrip().startswith("---"):
+    if text.startswith("---"):
-        end = md_text.find("\n---", 3)
+        end = text.find("\n---", 3)
         if end != -1:
-            md_text = md_text[end + 4 :]
+            text = text[end + 4 :]
     # Normalize slide separators. Marp uses `\n---\n` on its own line.
-    parts = re.split(r"\n---\s*\n", md_text)
+    parts = re.split(r"\n---\s*\n", text)
     slides = []
     for p in parts:
         p = p.strip("\n")
@@ -141,6 +206,29 @@ def _add_title_bar(slide):
     return bar
 
 
+def _add_footer(slide, text: str):
+    """Right-aligned footer textbox at the bottom of every slide.
+
+    REQ-372.5 / D-242: the python-pptx path does not read the Marp
+    `footer:` directive, so the footer is rendered as a textbox.
+    """
+    if not text:
+        return None
+    tb = slide.shapes.add_textbox(
+        MARGIN_X, Inches(7.12), CONTENT_W, Inches(0.3)
+    )
+    tf = tb.text_frame
+    tf.word_wrap = True
+    p = tf.paragraphs[0]
+    p.alignment = PP_ALIGN.RIGHT
+    r = p.add_run()
+    r.text = text
+    r.font.name = FONT_NAME
+    r.font.size = Pt(10)
+    r.font.color.rgb = GREY_HEADER
+    return tb
+
+
 def _add_title_text(slide, title: str, *, color: RGBColor = RED,
                     size: int = 28, top: float = 0.25, bold: bool = True,
                     height: float = 0.7, white_bg: bool = False):
@@ -498,7 +586,7 @@ def parse_slide(slide_src: str):
     }
 
 
-def render_title_slide(prs, slide_data):
+def render_title_slide(prs, slide_data, footer_text: str = ""):
     slide = prs.slides.add_slide(prs.slide_layouts[6])  # blank
     _set_bg(slide, BLACK)
     # red top bar
@@ -547,9 +635,10 @@ def render_title_slide(prs, slide_data):
             r_b.font.italic = True
             r_b.font.color.rgb = WHITE
             cur_top += Inches(0.85)
+    _add_footer(slide, footer_text)
 
 
-def render_content_slide(prs, slide_data, deck_dir: Path):
+def render_content_slide(prs, slide_data, deck_dir: Path, footer_text: str = ""):
     slide = prs.slides.add_slide(prs.slide_layouts[6])  # blank
     _set_bg(slide, WHITE)
     _add_title_bar(slide)
@@ -643,10 +732,13 @@ def render_content_slide(prs, slide_data, deck_dir: Path):
         elif kind == "benefit":
             _add_benefit(slide, item[1], top=cur_top)
             cur_top += Inches(0.75)
+    _add_footer(slide, footer_text)
 
 
 def render_deck(md_path: Path, pptx_path: Path):
     md_text = md_path.read_text(encoding="utf-8")
+    fm = parse_frontmatter(md_text)
+    footer_text = fm.get("footer", "")
     slide_sources = split_slides(md_text)
     prs = Presentation()
     prs.slide_width = SLIDE_W
@@ -659,13 +751,13 @@ def render_deck(md_path: Path, pptx_path: Path):
         is_title = (idx == 0) or data["is_title_class"] or data["title_is_h1"]
         # The appendix is a content slide (rendered normally)
         if idx == 0 and (data["title_is_h1"] or data["is_title_class"]):
-            render_title_slide(prs, data)
+            render_title_slide(prs, data, footer_text=footer_text)
         elif data["is_title_class"] and not data["title_is_h1"] and idx != 0:
             # Marp _class: title on a non-H1 slide (e.g., appendix) — render as
             # content but with a title-style bar. Keep it simple: content slide.
-            render_content_slide(prs, data, deck_dir)
+            render_content_slide(prs, data, deck_dir, footer_text=footer_text)
         else:
-            render_content_slide(prs, data, deck_dir)
+            render_content_slide(prs, data, deck_dir, footer_text=footer_text)
         print(f"  [{idx + 1:02d}] {data['title']}  (body: {len(data['body'])} blocks)")
 
     pptx_path.parent.mkdir(parents=True, exist_ok=True)
@@ -674,10 +766,43 @@ def render_deck(md_path: Path, pptx_path: Path):
 
 
 def main():
-    deck = sys.argv[1] if len(sys.argv) > 1 else "nova-autonomous-cloud-delivery"
+    # Argv handling (D-242 extension):
+    #   python3 scripts/render_pptx.py [source.md | deck-name] [--output out.pptx]
+    # If argv[1] ends in .md or contains a path separator, treat as an
+    # explicit source path; else treat as a deck name (backward compatible:
+    # reads docs/presentations/{deck}-marp.md, writes {deck}-python.pptx).
     repo_root = Path(__file__).resolve().parent.parent
-    md_path = repo_root / "docs" / "presentations" / f"{deck}-marp.md"
+    args = sys.argv[1:]
-    pptx_path = repo_root / "docs" / "presentations" / f"{deck}-python.pptx"
+    output_arg = None
+    if "--output" in args:
+        i = args.index("--output")
+        if i + 1 < len(args):
+            output_arg = args[i + 1]
+            args = args[:i] + args[i + 2 :]
+    deck = args[0] if args else "nova-autonomous-cloud-delivery"
+    if deck.endswith(".md") or "/" in deck or "\\" in deck:
+        # Explicit source path (relative to repo root if not absolute)
+        p = Path(deck)
+        md_path = p if p.is_absolute() else (repo_root / p)
+        if output_arg:
+            op = Path(output_arg)
+            pptx_path = op if op.is_absolute() else (repo_root / op)
+        else:
+            # default output: strip -marp.md, add .pptx
+            stem = md_path.name
+            if stem.endswith("-marp.md"):
+                stem = stem[: -len("-marp.md")]
+            elif stem.endswith(".md"):
+                stem = stem[: -len(".md")]
+            pptx_path = md_path.parent / f"{stem}.pptx"
+    else:
+        # Deck name (backward compatible)
+        md_path = repo_root / "docs" / "presentations" / f"{deck}-marp.md"
+        if output_arg:
+            op = Path(output_arg)
+            pptx_path = op if op.is_absolute() else (repo_root / op)
+        else:
+            pptx_path = repo_root / "docs" / "presentations" / f"{deck}-python.pptx"
     if not md_path.is_file():
         print(f"ERROR: source deck not found: {md_path}", file=sys.stderr)
         sys.exit(1)