# Nova — The Autonomous Cloud Delivery Platform: Talking Points > Step 4 of the 4-step deck process. Presenter cues that mirror the > `` comments in > `nova-autonomous-cloud-delivery-marp.md` (the sole source of truth). > 3-6 bullets per slide + key takeaway. Indexed by Marp slide #. > v1.21 — REQ-245 --- ### Slide 1 — The Problem - Open with the shift: "you build it, you run it" put Terraform into product teams — ownership without discipline is destroying value - Land the lifecycle-planning gap: resources authored for creation, not for patching/rollback → destructive changes - Land the urgency: AI-era 0-day pace demands proactive scanning as code + at runtime, remediated at threat pace - Call out tribal knowledge / the rockstar-operator problem — the platform should encode the discipline, not the person - Do NOT frame this as "humans are the problem" — the problem is ownership without the discipline and tooling - **Key takeaway:** the problem is infrastructure ownership without discipline; the answer is an autonomous platform that encodes the discipline ### Slide 2 — Nova's Vision - Read the vision verbatim — "infrastructure operations become visible" is the operative phrase - Emphasize "provable, not promised" — trust established by deterministic scripts; the platform functions without AI - State the attestation model up front: QA for production, SRE for operational readiness - **Key takeaway:** autonomous operations with provable trust — security, remediation velocity, reliability, lead time made visible, not promised ### Slide 3 — Strategic Objectives - Objective #1: zero-touch operations — autonomy as the default, not the demo; stage-gate attestation (QA, SRE) remains human by design - Objective #2 is the one to land carefully: trust = deterministic scoring, not an LLM; the platform functions without AI - Objective #3: four CTO-grade metrics (Lead Time, Vuln Count, MTTR, Spend) — all flow into PowerBI - Objective #4 is the integration thesis: Nova integrates with any upstream source; provides skills + MCP; all prod intents go through the same controls - **Key takeaway:** the scope is explicit — Nova governs infra + delivery, integrates with any source through one contract, measures success on four CTO metrics ### Slide 4 — Anti-Goals (What Nova Is NOT) - Not a general-purpose AI agent platform - Not a system that removes humans from accountability — only from normal operations - Not an upstream development platform (no product backlogs, IDE, code authorship) - Not a replacement for the Product Development Lifecycle (PDLC) - Anti-goals #3 and #4 protect the scope boundary — Nova will not become an IDE or a product-planning tool - **Key takeaway:** the boundaries are explicit — Nova is purpose-built for infra ops + delivery, not a general-purpose AI agent or an upstream dev platform ### Slide 5 — Scope: Downstream of PDLC - Nova governs infra + delivery only; the PDLC (backlog, code authorship, IDE) is upstream — Nova stays downstream of it - Integration is only through the validated contract boundary - Any upstream source (AI agent, agentic SDLC, dev platform) produces submissions subject to the same compliance standards - Nova validates the submission, not the author - **Key takeaway:** Nova is purpose-built for infrastructure operations; the scope boundary is clean and bounded ### Slide 6 — RACI: Who Owns What - Four roles now: Citizen Developer, Platform, Quality Engineering, SRE - Quality attestation is owned by Quality Engineering (not the Platform); Production readiness is owned by SRE - The Platform runs the checks agentically but is never the Accountable party for the gate — that separation keeps the platform honest - Production readiness is co-owned: the platform runs attestations; the citizen developer authorizes the promotion at the stage gate - **Key takeaway:** you bring FRs + UAT; Nova provides NFRs + infra; QE guards the gate evidence; SRE signs off on production readiness ### Slide 7 — The Platform Pipeline - Walk the pipeline left-to-right: contract → resolver → adapter → Checkov (static) → plan → Wiz (on plan) → confidence → gate → apply - Two-stage scan: Checkov on static code BEFORE the plan (fail-fast dev feedback); Wiz on the plan (or Checkov as drop-in if no Wiz creds) - Never both Wiz + Checkov on the plan — avoid duplicate noise - Dev is autonomous; qa/prod/dr require attestation (QA for quality, SRE for production readiness) - **Key takeaway:** two layers of scanning, zero operator involvement in normal operations ### Slide 8 — The Decision Ledger - "AI decisions" are really automated decisions — deterministic scripts calculate a score; the platform functions without AI - Do not dwell on the storage substrate — the value is accountability (immutable, queryable, traceable to outcome), not the database - Every stage-gate attestation is captured with approver identity and the evidence presented - When an LLM planner is added later, it emits richer alternatives without breaking the schema - **Key takeaway:** autonomous is defensible because every decision is immutable, queryable, accountable — and "automated" means deterministic scoring, not a black-box LLM ### Slide 9 — Attestation Matrix: QA - The matrix is not a rubber stamp — structured, freshness-validated - Each concern now has a plain-language description of what is being attested (the old "operator-supplied" label is gone) - Three QA concerns: functional correctness (24h), performance baseline (7d), security posture (24h) - Each concern has a freshness window — evidence older than the window does not satisfy the gate - **Key takeaway:** QA signs off on quality before any promotion — the gate is explicit, not implicit ### Slide 10 — Attestation Matrix: Prod/DR - Seven prod/DR concerns: operational readiness, incident response, capacity & cost, DR drill, chaos, backup, DR region deploy - SRE signs off on operability (runbooks, dashboards, on-call), incident response, capacity, and the three resilience checks - Each concern has a freshness window — 30d/90d/180d depending on the control - SoD on prod: the approver can't be the same person who built it — the rule that keeps the gate honest - **Key takeaway:** autonomy in operations, human in accountability, by design — the matrix is what makes autonomous operations safe enough to trust in production ### Slide 11 — Telemetry & Live Ops - Deliberately minimal: Nova-native CloudEvents; no Kafka/Prometheus/ClickHouse - The live-ops dashboard is built in PowerBI on top of the exported views — leadership sees the same numbers the platform produces - Every number in the Proof slides is traceable to a signal — "where does this number come from?" → a query against the cold store - This is where the "infrastructure operations become visible" theme lands concretely - **Key takeaway:** the architecture is the trust substrate — operations become visible in PowerBI, with full traceability ### Slide 12 — Decision Ledger + Attestation Coverage - Both 100% — no automated decision is ever lost; no prod/dr promotion lands without a human sign-off - The mandatory-by-design point: the ledger entry + the human attestation are a gate, not a best-effort feature - Easily queried: by run, by environment, by approver, by outcome — the audit trail is a query, not a forensic exercise - **Key takeaway:** trust is provable — not a marketing claim, a queryable record; no change to production without both the ledger entry and the human attestation ### Slide 13 — Cost & ROI - The ROI formula is shown inline — not hidden in a footnote - The four CTO-grade metrics are the ROI proof — Lead Time, Vuln Count, MTTR, Cloud Spend - The N=0 caveat is stated explicitly: the formula is grounded; the production numbers activate with a pilot - **Key takeaway:** the ROI is not a black box — the formula is shown, the four metrics are committed, the production-denominator caveat is up front ### Slide 14 — What's Deferred — and Why - The preempt is critical: these deferrals are measurement infrastructure, not autonomy — the platform IS autonomous in operations - The blocking work is named in plain language (no decision IDs) — "live AWS re-provisioning", "drift-detection scheduler", "ML service" - Showing this to leadership demonstrates honesty, not weakness - **Key takeaway:** the autonomy is real; the measurement gaps are documented with the work that unblocks each one ### Slide 15 — Roadmap to the North Star - Each deferred metric has an unblock path and a timeframe — near-term, mid-term, longer-term - No status column: most of it is not implemented yet, so status would be noise - Re-evaluation triggers: each blocking piece of work lifts on its own schedule - **Key takeaway:** every deferred metric has a plan and a timeframe — nothing is hand-waved ### Slide 16 — 12-Month Product Roadmap - This is the *product* roadmap, forward-looking only - Q1 Pilot Activation → Q2 Provable Trust → Q3 Compounding ROI → Q4 Integration & Predictive - Each quarter activates one strategic objective from the North Star - **Key takeaway:** the 12-month product arc — each quarter activates a strategic objective and its board-level metric ### Slide 17 — Quarter-by-Quarter Outcomes - Q1: three post-pilot metrics go live (Touchless ≥99%, Escalation <0.1%, Accuracy ≥99.5%) — denominator activates with the pilot - Q2: Decision Ledger Coverage was already grounded — tamper-evidence is the Q2 upgrade (local hash-chain → Object Lock + signed checkpoints) - Q3: Drift Auto-Reversal ≥95% unblocks when the drift scheduler ships; Spend Reduction ≥25% measured against the pilot baseline - Q4: Predictive:Reactive ≥3:1 requires the ML forecasting service; AI-Agent Intent Share is a first measurement (aspirational-metric) - **Key takeaway:** each quarter has a concrete deliverable, a target metric grounded in a strategic objective, and a path from deferred to shipped ### Slide 18 — Production-Grade Guidance via Atelier (1/2) - Nova instructs the citizen developer's AI agent via skills (markdown, keyed to engineering domains) + an MCP server (4 tools, plugin-registry, stdio) - The integration point is the same regardless of source — AI agent, agentic SDLC, traditional IDE all get the same skills + MCP - This is how Nova makes the citizen developer production-grade without owning the PDLC - **Key takeaway:** the citizen developer's AI agent is not unguided — Nova provides engineering principles as skills + MCP ### Slide 19 — Production-Grade Guidance via Atelier (2/2) - The value is the gap deterministic scanners leave: engineering discipline (Wiz/Checkmarx/Mend check policy/secrets, not discipline) - The MCP server catches "is this service observable?", "is this error path handled?", "is this API contract clear?" - Vendored at a pinned tag → audit reproducibility — a validation result is replayable months later - **Key takeaway:** submissions are checked for engineering discipline, not just policy compliance — and the check is reproducible for audit ### Slide 20 — Recap + Ask - Recap the 4-beat arc so the audience leaves with the structure - The ask is a business decision: approve a pilot estate + the tamper-evident ledger build-out - "Pipeline-ready" → "production-proven" is the value proposition - **Key takeaway:** approve a pilot + the ledger build-out to move from pipeline-ready to production-proven ### Appendix A1 — Metrics Glossary - Reference for every metric mentioned in the deck - Use if the audience asks "what does X mean?"