> *Velocity is up; the coordination surface around each change is up faster.*
> *Velocity is up; the coordination surface around each change is up faster.*
- → Infrastructure is authored by people who don't specialize in infrastructure.
- → Infrastructure is authored by people who don't specialize in infrastructure — the platform team is not standing behind every bucket, every instance, every key.
- → Every change is gated because one misconfiguration can expose the entire estate.
- → Every change is gated because one misconfiguration can expose the entire estate — so every change is reviewed, every change is manual, and the cost of getting it wrong is account-wide.
- → Compliance, security, and NFRs are checked late — fueling remediation cycles that erode delivery cadence and team morale.
- → Compliance, security, and NFRs are checked late — after the PR, after the merge, sometimes after the deploy — fueling remediation cycles that erode delivery cadence and team morale.
> *Nova absorbs all three — owned building blocks, separation of concerns, attested compliance up front.*
> *Nova absorbs all three — owned building blocks, separation of concerns, attested compliance up front.*
@@ -80,12 +80,16 @@ Nova absorbs all three. Owned building blocks, separation of concerns, attested
> *You already recognize this pattern.*
> *You already recognize this pattern.*
Every Central IT team curates a golden image for Windows, for Linux, for macOS. They own it, they patch it, they ship it — and consumers consume it without thinking about what is inside. That trade — per-application control for uniform operability — is one every enterprise has already made at the OS layer.
Central IT curates the golden image; Nova curates the cloud infrastructure. Owned, patched, attested, consumed by contract.
Nova plays the same role one layer up: for everything that runs your cloud. S3 buckets with SSE-KMS posture. RDS instances with deletion protection and PITR. Lambda containers with static ABAC binaries. ALBs, ECS services, KMS keys, DynamoDB tables. Each primitive is owned by the platform team, patched by the platform team, attested by the platform team, and consumed by anyone who declares a contract.
The difference is rigor: every primitive is versioned, tested across its entire lifecycle, and bounded by policy before any consumer ever touches it.
> *Nova's lane is the infrastructure beneath the application. AppSec stays with the application team.*
> *Nova's lane is the infrastructure beneath the application. AppSec stays with the application team.*
<!--
<!--
The Central IT golden-image pattern is one every leadership team already recognizes. Central IT curates the Windows image, the Linux image, the macOS image. They own it, they patch it, they ship it, and consumers consume it without thinking about what is inside. That trade — per-application control for uniform operability — is a trade every enterprise has already made at the OS layer.
The Central IT golden-image pattern is one every leadership team already recognizes. Central IT curates the Windows image, the Linux image, the macOS image. They own it, they patch it, they ship it, and consumers consume it without thinking about what is inside. That trade — per-application control for uniform operability — is a trade every enterprise has already made at the OS layer.
@@ -102,12 +106,14 @@ And the lane stays narrow. Nova's lane is the infrastructure beneath the applica
> *Two tenets discipline every other decision.*
> *Two tenets discipline every other decision.*
**Sovereign boundary** — Nova governs the delivery lifecycle; it does not reach upstream into product or software development [1]. Integration with SDLC and PDLC partners — the IDE, the sprint tool, the author workflow, the agent harness — happens exclusively through the validated, published contract surface. What lives outside the contract is not Nova's domain.
**Lower autonomous · higher attested** — lower environments proceed through agentic, zero-touch automation; promotion to qa, prod, and dr requires deliberate human attestation [1]. Not a rubber stamp — a policy-mandated act of accountability by a named human distinct from the PR author. The compute the platform makes; the choice the human keeps.
> *Everything else in the architecture inherits from these two.*
**Sovereign boundary** — Nova governs the delivery lifecycle; it does not reach upstream [1]. Integration with SDLC and PDLC happens exclusively through the contract surface.
**Lower autonomous · higher attested** — lower environments proceed through agentic automation; promotion requires deliberate human attestation [1]. The compute the platform makes; the choice the human keeps.
<!--
<!--
The architecture is principled, not improvised. Two tenets discipline every other decision the platform makes, and both come straight from the vision document [1].
The architecture is principled, not improvised. Two tenets discipline every other decision the platform makes, and both come straight from the vision document [1].
@@ -122,14 +128,14 @@ And the point for this room: these two tenets are not aspirational. They are loa
## Live · Attested · Stays human
## Live · Attested · Stays human
**Live today** — 41 capabilities across 12 domains; pilot confidence 0.800. The contract ingestor, the audit outbox, the state buckets, and the live pilot run have operated in our AWS estate since v1.7. DORA, adoption, and policy-conformance metrics flow to PowerBI from the same audit stream as the lineage — one pane, no second source of truth. Every finding carries one owner, one patch state, one audit entry.
**Attested on promotion** — qa, prod, and dr require a named human approver distinct from the PR author. Rubber stamps cannot be silently issued; the attestation is a policy-mandated act of accountability.
**Stays human — by design** — confidence below the autonomy threshold at qa, prod, or dr triggers human escalation [1]. Some categories of decision are preserved for human judgment, and the platform says so out loud.
**Live today** — 41 capabilities across 12 domains; pilot confidence 0.800. One pane, no second source of truth.
**Attested on promotion** — qa, prod, dr require a named human approver distinct from the PR author.
**Stays human — by design** — confidence below the autonomy threshold triggers human escalation [1].
<!--
<!--
Three columns, three claims, one disambiguation. The claims are real, observable, and disciplined — and the distinction matters for this room.
Three columns, three claims, one disambiguation. The claims are real, observable, and disciplined — and the distinction matters for this room.
@@ -144,14 +150,25 @@ Disciplined: attested on promotion, stays human by design. qa, prod, and dr requ
## The boundary keeps us honest
## The boundary keeps us honest
> *Nova stays where it belongs.*
**In Nova's lane** — infrastructure primitives, operational guardrails, CVE response at the infra layer.
**In Nova's lane**
**Outside Nova's lane** — application business logic, IDE & sprint workflows [1], AppSec, VM/bare-metal/OS lifecycles [1].
> *The line is the contract. Everything below it is Nova. Everything above it stays where it has always been.*
> *The line is the contract. Everything below it is Nova. Everything above it stays where it has always been.*
<!--
<!--
The boundary is not a defensive posture. It is an operating principle — and it is the principle that keeps the architecture honest [1].
The boundary is not a defensive posture. It is an operating principle — and it is the principle that keeps the architecture honest [1].
@@ -168,15 +185,18 @@ The line is the contract. Everything below the contract is Nova. Everything abov
> *Where CDLC meets SDLC + PDLC — through the contract surface, not above it.*
> *Where CDLC meets SDLC + PDLC — through the contract surface, not above it.*
**α (now → Q4'26) — Operating model + federated governance.** A named platform-ops body owns the platform; SLAs on every L2 are ratifiable by platform and consumer. The operating model is published; integration surfaces for SDLC and PDLC harnesses are documented at the contract boundary.
**α (now → Q4'26)** Operating model + federated governance.
**β (Q1'27) — Auto-published infra observability.** Every consumer stack ships with CloudWatch dashboards, uptime-kuma monitors, and alert routing on apply — infrastructure observability as a property, no per-team authoring required.
**β (Q1'27)** Auto-published infra observability.
**γ (Q2'27)** Runbook generation from telemetry.
**γ (Q2'27) — Runbook generation from telemetry.** Every L1 primitive ships with an auto-generated incident runbook derived from observed patterns. SREs get a starting runbook, not a blank page.
**δ (Q3'27 → Q4'27) — Audit ledger, tamper-resistant.** The SQLite hash-evidence stream migrates to S3 Object Lock + JWS signatures. External counsel verifies any production change back to a named human attestation.
> *Nova absorbs no IDE, no editor, no sprint tool, no agent harness.*
> *Nova absorbs no IDE, no editor, no sprint tool, no agent harness.*
<!--
<!--
The 18-month shape is a boundary-respecting integration arc, not an expansion arc. Four milestones, each disciplined by the sovereign-boundary tenet [1]: Nova meets SDLC and PDLC through the contract surface, not above it.
The 18-month shape is a boundary-respecting integration arc, not an expansion arc. Four milestones, each disciplined by the sovereign-boundary tenet [1]: Nova meets SDLC and PDLC through the contract surface, not above it.
@@ -195,8 +215,6 @@ Nova absorbs no IDE, no editor, no sprint tool, no agent harness. The contract s
## What we ask · What comes back
## What we ask · What comes back
**What works now.** Deploying L1 & L2 stacks works today in the sandbox AWS account — 13 L1 primitives and 2 L2 modules, live-applied at confidence 0.800. Next steps: ingest greenfield pilot projects, promote from sandbox to production, integrate with the SPGE constitutional library, and serve as the infrastructure layer.
**What works now.** Deploying L1 & L2 stacks works today in the sandbox AWS account — 13 L1 primitives and 2 L2 modules, live-applied at confidence 0.800. Next steps: ingest greenfield pilot projects, promote from sandbox to production, integrate with the SPGE constitutional library, and serve as the infrastructure layer.
**What we ask.** Architecture endorsement. Runway to the next milestone.
**What we ask.** Architecture endorsement. Runway to the next milestone.
@@ -207,6 +225,8 @@ Nova absorbs no IDE, no editor, no sprint tool, no agent harness. The contract s
> *What we do not ask for: an IDE, a sprint tool, an author workflow, an upstream pipeline. Nova stays in its lane [1].*
> *What we do not ask for: an IDE, a sprint tool, an author workflow, an upstream pipeline. Nova stays in its lane [1].*
<!--
<!--
This is presented to Infrastructure and Operations leadership in August 2026. What works now: deploying L1 and L2 stacks works today. 13 L1 primitives and 2 L2 modules are live in the registry; the pilot ran a live terraform apply against the dev AWS account at v1.26 and returned confidence 0.800 — a measured number, not a forecast. We refer to the dev account colloquially as the sandbox. Next steps: ingest greenfield pilot projects (greenfield consumers with no legacy to reconcile), promote from sandbox to production (the promotion path with HITL gates exists; the pilot was dev-only, so activating qa, prod, dr is the next step), integrate with the SPGE constitutional library (an external governance system the audience recognizes; the platform meets it at the contract surface), and serve as the infrastructure layer.
This is presented to Infrastructure and Operations leadership in August 2026. What works now: deploying L1 and L2 stacks works today. 13 L1 primitives and 2 L2 modules are live in the registry; the pilot ran a live terraform apply against the dev AWS account at v1.26 and returned confidence 0.800 — a measured number, not a forecast. We refer to the dev account colloquially as the sandbox. Next steps: ingest greenfield pilot projects (greenfield consumers with no legacy to reconcile), promote from sandbox to production (the promotion path with HITL gates exists; the pilot was dev-only, so activating qa, prod, dr is the next step), integrate with the SPGE constitutional library (an external governance system the audience recognizes; the platform meets it at the contract surface), and serve as the infrastructure layer.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
CIAgent