Jon Chery
e7866fda84
Nova Slides Render / render (push) Failing after 1m4s
AUTONOMY_THESIS.md (git mv from NO_HUMANS_THESIS.md): reframe from 'removing humans' to 'autonomy in operations, human at stage gates'. Drop D-### citations + internal file paths; keep anti-claims, reworded. Anti-claim #1 now: 'decisions are NOT made by an LLM — deterministic scripts calculate a score; the platform functions without AI'. NORTH_STAR.md: - Vision: 'invisible' → 'visible' (operations become visible — recurring theme); polish for technical audience (security, remediation velocity, reliability, lead time). - Objective #2: 'provable trust in AI decisions' → 'provable trust in automated decisions' (deterministic scripts calculate a score; platform functions without AI). - Objective #3: four CTO-grade metrics (Lead Time PR→Prod, Infra Vuln Count trend, MTTR, Cloud Spend Reduction) → all flow into PowerBI. - Objective #4: 'default substrate for agentic consumption' → integrate with externally owned PDLC/SDLC/Agentic/Citizen Developer platforms regardless of source; Nova provides skills + MCP endpoints; all prod intents go through the same controls + quality gates. - Anti-goals: drop #1 (hyperscaler competitor), #4 (legacy untagged), #5 (sold to operators). Add: 'not an upstream development platform', 'not a replacement for the PDLC'. Reword #3 (no 'removes humans'). docs/raci.md: 3 roles → 4 roles. Add Quality Engineering column. Rename Release Management → SRE. Split release attestation into Quality attestation (QA) + Production readiness (SRE). Platform no longer holds A for attestation — reassigned to QE/SRE. docs/scope.md: add integration framing (skills + MCP endpoints, all sources go through same controls). Render scripts: default deck name → nova-autonomous-cloud-delivery. ONBOARDING + terraform/onboarding: 'no-humans' → 'autonomous'. ---ci--- project: acdl phase: 1 milestone: v1.21 status: execute phase_role: execution ---/ci---
87 lines
3.2 KiB
Markdown
87 lines
3.2 KiB
Markdown
# Nova Onboarding — Autonomous Request Path (v1.16, REQ-182..184)
|
|
|
|
The v1.16 milestone implements the **request path** of the autonomous
|
|
onboarding flow (D-113). A consumer can submit an onboarding request
|
|
without contacting the platform team; the platform generates an
|
|
environment binding + (in a future milestone) provisions the AWS resources.
|
|
|
|
## The 3-step request path
|
|
|
|
### Step 1 — Submit an onboarding request (P18, REQ-182)
|
|
|
|
A consumer submits an onboarding request to the Nova platform Lambda:
|
|
|
|
```bash
|
|
# Via the Lambda Function URL (IAM auth):
|
|
curl -X POST "$NOVA_LAMBDA_URL" \
|
|
-H "Content-Type: application/json" \
|
|
-d '{
|
|
"action": "onboard_consumer",
|
|
"consumerRepo": "acdl/my-app",
|
|
"requestedEnvironment": "dev",
|
|
"ownerId": "team-x",
|
|
"billingTag": "cost-center-x"
|
|
}'
|
|
```
|
|
|
|
The Lambda validates the payload against
|
|
[`schemas/onboarding.schema.json`](../schemas/onboarding.schema.json),
|
|
then writes a `pending` row to the `nova-contracts` DynamoDB table
|
|
(D-119). No AWS resources are created by this action (D-113).
|
|
|
|
### Step 2 — Generate an environment binding (P19, REQ-183)
|
|
|
|
The platform (or the consumer locally) generates an environment binding
|
|
file from the request:
|
|
|
|
```bash
|
|
python3 core/onboarding.py --request '{
|
|
"consumerRepo": "acdl/my-app",
|
|
"requestedEnvironment": "qa",
|
|
"ownerId": "team-x",
|
|
"billingTag": "cost-center-x"
|
|
}' --out core/environments/qa.json
|
|
```
|
|
|
|
This produces a `<env>.json` from the `dev.json` template, filling in
|
|
the `ownerId` + `billingTag` + a description. The `account_id` is a
|
|
placeholder (`000000000000`) for the platform team to fill with the real
|
|
account. The generated file validates against
|
|
[`schemas/environment.schema.json`](../schemas/environment.schema.json).
|
|
|
|
### Step 3 — Cross-account role + ABAC tag grant (P20, REQ-184)
|
|
|
|
The platform authors the consumer deploy-role + `nova:owner` ABAC tag
|
|
grant via Terraform:
|
|
|
|
```bash
|
|
cd terraform/onboarding
|
|
terraform init -backend=false
|
|
terraform validate
|
|
NOVA_AWS_ACCOUNT_ID=123456789012 terraform plan \
|
|
-var consumer_repo=acdl/my-app \
|
|
-var owner_id=team-x
|
|
```
|
|
|
|
**Offline-proven only (D-114):** `terraform validate` + `terraform plan`
|
|
pass; **no live apply** in v1.16. The live apply (creating the real
|
|
cross-account role + OIDC trust) is deferred to a future feature
|
|
milestone (D-113).
|
|
|
|
## What is NOT automated (deferred)
|
|
|
|
- **Real AWS account/network/state provisioning** — the request path
|
|
generates a binding file with a placeholder `account_id`; the actual
|
|
AWS account creation + VPC + state backend is a future feature (D-113).
|
|
- **Live cross-account role apply** — the Terraform is offline-proven
|
|
only (D-114); live apply is deferred.
|
|
- **OIDC trust policy** — the onboarding Terraform uses a placeholder
|
|
OIDC provider; real OIDC federation is blocked on
|
|
upstream forge OIDC support (carries forward from v1.1).
|
|
|
|
## See also
|
|
|
|
- [`schemas/onboarding.schema.json`](../schemas/onboarding.schema.json) — the request schema
|
|
- [`core/onboarding.py`](../core/onboarding.py) — the env-file generator
|
|
- [`terraform/onboarding/`](../terraform/onboarding/) — the role-grant Terraform
|
|
- [`core/environments/README.md`](../core/environments/README.md) — environment binding docs |