Jon Chery
2c08c778a9
REQ-221: skills/ directory with 9 Atelier-derived skill files mapped to the BA.A citizen-developer catalog: api, security, data, testing, observability, errors, devops, infrastructure-as-code, compliance. Each names the Atelier source path, distills first-principles to the citizen-dev-relevant subset, links to agent-checklist triggers, maps to BA.A 5-skill catalog. REQ-222: docs/skills.md index (9-skill table, Atelier provenance, 8 core principles C1-C8, consumption instructions, reference-only domains, excluded domains). PROJECT.md BA.A decision extended with the Atelier-derived skill catalog reference. ---ci--- project: acdl phase: 4 milestone: v1.18 status: execute requirements: covered: [REQ-221, REQ-222] partial: [] ---/ci---
41 lines
1.9 KiB
Markdown
41 lines
1.9 KiB
Markdown
# Skill: Infrastructure as Code
|
|
|
|
> **Atelier source:** `domains/infrastructure-as-code/` (first-principles +
|
|
> terraform, opentofu, state, modules)
|
|
> **Core principles:** C1 Correctness, C5 Reversibility, C8 Economy
|
|
> **BA.A mapping:** static asset
|
|
> **Consumer:** read this before authoring a contract that declares
|
|
> infrastructure.
|
|
|
|
## First Principles (citizen-developer-relevant subset)
|
|
|
|
- **Configuration is declarative, not scripted.** The contract declares
|
|
what; Terraform reconciles how. No imperative scripts in the contract.
|
|
- **Provider versions are pinned, never `latest`.** The contract's
|
|
infrastructure map may pin module versions (semver); the platform pins
|
|
provider versions.
|
|
- **State is remote with locking; never committed.** Nova manages state
|
|
in S3 + DynamoDB; the citizen developer never touches state files.
|
|
- **`plan` is reviewed before every `apply`.** The confidence signal
|
|
gates the apply; the HITL gate (qa/prod/dr) requires human attestation
|
|
before the apply proceeds.
|
|
- **No secrets in HCL; secrets via providers/stores.** Secrets live in
|
|
SSM SecureString / Secrets Manager, not in the contract or HCL.
|
|
|
|
## Agent-Checklist Triggers (§ Infrastructure as Code)
|
|
|
|
- Configuration is declarative, not scripted (P1)
|
|
- Provider versions are pinned, never `latest` (P5)
|
|
- State is remote with locking; never committed (P3, P8)
|
|
- `plan` is reviewed before every `apply` (P4)
|
|
- No secrets in HCL; secrets via providers/stores (P10)
|
|
|
|
## How Nova Uses This
|
|
|
|
Nova IS the infrastructure-as-code platform. The citizen developer
|
|
declares intent in the contract; Nova's adapter (stateless assembler,
|
|
v1.11) translates to Terraform modules; the pipeline runs plan → policy →
|
|
confidence → (HITL) → apply. The IaC skill tells you what the platform
|
|
expects from your contract: declarative inputs (not scripts), pinned
|
|
versions (not `latest`), no secrets in the contract (secrets via SSM),
|
|
and acceptance that the platform owns state + the apply path. |