Jon Chery
2c08c778a9
REQ-221: skills/ directory with 9 Atelier-derived skill files mapped to the BA.A citizen-developer catalog: api, security, data, testing, observability, errors, devops, infrastructure-as-code, compliance. Each names the Atelier source path, distills first-principles to the citizen-dev-relevant subset, links to agent-checklist triggers, maps to BA.A 5-skill catalog. REQ-222: docs/skills.md index (9-skill table, Atelier provenance, 8 core principles C1-C8, consumption instructions, reference-only domains, excluded domains). PROJECT.md BA.A decision extended with the Atelier-derived skill catalog reference. ---ci--- project: acdl phase: 4 milestone: v1.18 status: execute requirements: covered: [REQ-221, REQ-222] partial: [] ---/ci---
1.9 KiB
Skill: Infrastructure as Code
Atelier source:
domains/infrastructure-as-code/(first-principles + terraform, opentofu, state, modules) Core principles: C1 Correctness, C5 Reversibility, C8 Economy BA.A mapping: static asset Consumer: read this before authoring a contract that declares infrastructure.
First Principles (citizen-developer-relevant subset)
- Configuration is declarative, not scripted. The contract declares what; Terraform reconciles how. No imperative scripts in the contract.
- Provider versions are pinned, never
latest. The contract's infrastructure map may pin module versions (semver); the platform pins provider versions. - State is remote with locking; never committed. Nova manages state in S3 + DynamoDB; the citizen developer never touches state files.
planis reviewed before everyapply. The confidence signal gates the apply; the HITL gate (qa/prod/dr) requires human attestation before the apply proceeds.- No secrets in HCL; secrets via providers/stores. Secrets live in SSM SecureString / Secrets Manager, not in the contract or HCL.
Agent-Checklist Triggers (§ Infrastructure as Code)
- Configuration is declarative, not scripted (P1)
- Provider versions are pinned, never
latest(P5) - State is remote with locking; never committed (P3, P8)
planis reviewed before everyapply(P4)- No secrets in HCL; secrets via providers/stores (P10)
How Nova Uses This
Nova IS the infrastructure-as-code platform. The citizen developer
declares intent in the contract; Nova's adapter (stateless assembler,
v1.11) translates to Terraform modules; the pipeline runs plan → policy →
confidence → (HITL) → apply. The IaC skill tells you what the platform
expects from your contract: declarative inputs (not scripts), pinned
versions (not latest), no secrets in the contract (secrets via SSM),
and acceptance that the platform owns state + the apply path.