acdl/docs/vision.md

# Nova Vision

> **Nova — The New Dawn of DevSecOps.** Security as a seamless enabler of fast deployments — not a bottleneck, not a "no" department.

## 1. The Friction

Software delivery scales with the coordination surface around it, not the engineering inside it. Most teams know how to write code; far fewer know how to author the infrastructure that runs it correctly. The result is a long tail of well-meaning services that are difficult to deploy, hard to operate, and inconsistent in their security and observability posture.

Once code is merged, the second friction begins. Moving a service from "merged" to "running in production with policy, observability, and security enforced" requires manual work that scales with the system, not with the change. The platform's job is to absorb both frictions — the cognitive load of getting the infrastructure right, and the operational work of getting the change to production safely.

## 2. The North Star

Consumers declare intent; the platform delivers safe production deployment through an agentic stack.

## 3. Core Tenets

* **Operations are Declared, Not Executed.** Consumers define what they need — workload shape, dependencies, non-functional requirements, policy constraints. The platform handles reconciliation, provisioning, and environment progression. The execution burden moves from the human to the platform.
* **The Delivery Lifecycle is a Sovereign Boundary.** The platform governs the infrastructure and delivery engine. It does not reach into upstream product or software development lifecycles. Integration happens exclusively through validated, published contracts.
* **Lower Environments are Autonomous; Higher Environments are Attested.** Progression through lower environments proceeds through zero-touch agentic automation. Promotion to higher-stakes environments requires deliberate human attestation — not as a rubber stamp, but as a policy-mandated act of accountability.
* **Safety is Computed, Not Assumed.** Every delivery action produces a measurable, explainable confidence signal aggregating policy conformance, validation evidence, and historical behavior. The signal is the platform's certified answer to "is this safe to proceed?" Reliance on operator instinct or tenure is not a substitute.
* **Infrastructure is Consumed, Not Maintained.** Compute is abstract, containerized, or serverless. The platform does not manage node, OS, or bare-metal lifecycles. Infrastructure is treated as a utility, not a craft.
* **Two Consumer Surfaces, One Platform.** The platform serves technical developers and non-technical consumers through two coordinated interfaces. Both converge on the same contract schema, the same policy envelope, and the same evidence stream. The platform is opinionated in what it accepts, regardless of who is declaring.

## 4. Domain Boundaries

The platform begins where the artifact is compiled and ends where it runs in production under operational guardrails.

* **In scope:** Environment progression, cloud resource lifecycle, operational security and observability NFRs, policy enforcement, immutable audit lineage, confidence frameworks, two consumer surfaces (developer and agentic).
* **Out of scope:** Application business logic, IDE workflows, product backlog management, sprint planning, compute requiring node-level or OS-level management.
* **Interface:** Upstream systems interact with the platform through a strict contract boundary. The platform validates, enriches with operational standards, and reconciles the target state. Visibility into how software is authored is not required — only assurance about what is being delivered and under what policy constraints.

## 5. Strategic Bets

These are the leaps of faith underlying this vision. If any prove false, the vision requires fundamental revision.

* **Autonomous progression through lower environments is sufficiently safe.** End-to-end agentic progression through non-production environments — with rigorous policy, testing, and observability gates — is less risky than human-driven pipelines that rely on manual checklist discipline.
* **Confidence can replace presumption.** A computed, policy-derived confidence signal is a legitimate arbiter for autonomous action, replacing the instinct of an operator who "knows the system."
* **Narrow capability interfaces beat broad access.** Infrastructure capabilities are exposed to autonomous systems through constrained, domain-specific interfaces — never through raw, unbounded platform credentials. Agents call capabilities, not APIs.
* **Audit truth lives outside the repository.** Version control is a coordination tool, not an evidentiary fortress. True compliance requires an immutable, externally-stored ledger to which the platform writes; repositories hold only lightweight attestation linkage.
* **Pattern recognition can compound platform value over time.** As the platform observes recurring contract patterns, it can synthesize and offer reusable infrastructure compositions. This is a future capability, not a current commitment — but the platform's design must allow it.

## 6. Trade-offs Accepted

This vision is purchased with deliberate sacrifices:

* **Velocity over Legacy Flexibility.** Standardizing on abstract, containerized, and serverless compute eliminates undifferentiated toil. Teams operating non-cloud-native workloads must modernize or route elsewhere.
* **Abstraction over Granular Control.** Removing node-level access sacrifices fine-tuned performance optimization in favor of uniform operability and security posture.
* **Delegated Risk over Queue-based Safety.** An autonomous agent may occasionally halt, reject, or escalate a change that a human would have greenlit. In exchange, queue-based handoffs are eliminated from lower environments.
* **Immutability over Convenience.** Every action leaves a cryptographic shadow in an external evidence stream. The operational overhead of signing, linking, and streaming is accepted in exchange for tamper-evident assurance rather than reliance on mutable, rewritable logs.

## 7. Anti-Goals

* **Not an upstream development platform.** No management of product backlogs, sprint ceremonies, IDE extensions, or code authorship workflows.
* **Not a general-purpose AI.** The platform is not an open-ended conversational assistant. Autonomy is narrow, scoped to delivery and infrastructure reconciliation, and bounded by strict policy envelopes.
* **Not a legacy infrastructure bridge.** No management of VMs, bare metal, or OS lifecycles. The engine will not extend to non-cloud-native patterns.
* **Not a permissive delivery highway.** No escape hatches to bypass the confidence framework or the human attestation requirements at higher environments. Speed is a byproduct of confidence and policy compliance, not an override.
* **Not a mutable audit log.** Version control history does not satisfy regulatory evidence. Auditability requires an immutable, externally-stored stream.

## 8. Signals of Success

The vision is realized when:

* A merged change progresses through lower environments end-to-end without a platform engineer joining a thread, approving a ticket, or manually triggering a stage gate.
* A developer deploys compliant, observable, and secured infrastructure by authoring a contract and a workflow — not by reading tribal runbooks or filing infrastructure requests.
* A non-technical consumer ships a production deployment by declaring intent — without authoring a workflow, a configuration file, or a Terraform module.
* An auditor can trace any production change to a human attestation and an immutable evidence stream without interpreting shell scripts, pipeline logs, or repository history.
* Security, resiliency, and observability standards are satisfied automatically through platform-enriched contracts, rather than through post-hoc remediation.
* When the platform halts a delivery, it provides a measured, explainable reason — a policy violation, an insufficient confidence signal, or a missing attestation — rather than requiring an opaque, manual-debugging exercise.

## What this vision is, and what it isn't

* **It is:** A principles document. The North Star, the tenets, the strategic bets, the anti-goals. It's intended to be the page that orients a new team, a new stakeholder, or a new architectural decision. It should not need to be rewritten when a tool changes.
* **It isn't:** An architecture. The four-layer model (primitives, modules, developer surface, agentic surface), the central pipeline template model, the schema location, the dual HITL mechanics, the enterprise evidence stream integration — all of that belongs in the architecture document, where it can be specific and evolve independently.