CIAgent
ad280b181b
Enrich on-slide body wording on all 7 slides (slides 2-6 were sparse, 43-67 visible words; now 97-168). Re-balance layout: title -> frame -> body -> diagram -> closing italic benefit. Invariants preserved: 7 slides, S&P theme tokens, speaker-note bands, [1] citations 3/5/7, diagram PNGs, footer string. PPTX re-rendered. Smoke test PASS. REQ-373.1 visible prose density enriched REQ-373.2 layout improved (renderer block vocabulary unchanged) REQ-373.3 invariants preserved (D-247) REQ-373.4 PPTX re-rendered; check_leadership_deck.sh exits 0 ---ci--- project: acdl phase: 1 milestone: v1.31 status: execute ---/ci---
21 KiB
marp: true theme: default footer: "Nova Platform - Infrastructure & Operations" paginate: false size: 16x9 style: | section { font-family: "Akkurat Pro", "Helvetica Neue", "Arial", sans-serif; font-size: 22px; color: #1B1B1B; padding: 48px 56px 40px; overflow: auto; } h1 { color: #D6002A; font-size: 34px; margin-bottom: 0.3em; } h2 { color: #D6002A; font-size: 26px; margin-bottom: 0.2em; } h3 { color: #D6002A; font-size: 22px; margin-bottom: 0.2em; } table { font-size: 18px; width: 100%; border-collapse: collapse; } th { background: #F0F0F0; border-bottom: 2px solid #D6002A; padding: 4px 8px; text-align: left; } td { border-bottom: 1px solid #F0F0F0; padding: 4px 8px; } blockquote { border-left: 4px solid #D6002A; color: #1B1B1B; font-size: 20px; padding-left: 12px; } pre { background: #1B1B1B; color: #FFFFFF; border-radius: 4px; padding: 12px; font-size: 16px; } code { background: #F0F0F0; color: #1B1B1B; border-radius: 2px; padding: 1px 4px; font-size: 18px; } pre code { background: transparent; color: #FFFFFF; } img { display: block; margin: 0 auto; max-width: 100%; max-height: 380px; object-fit: contain; } strong { color: #D6002A; } .benefit { margin-top: 0.6em; padding-top: 0.4em; border-top: 1px solid #D6002A; color: #1B1B1B; font-size: 20px; font-style: italic; } @media print { section { overflow: hidden; } }
The friction every delivery team lives today
Velocity is up; the coordination surface around each change is up faster.
- → Infrastructure is authored by people who don't specialize in infrastructure — the platform team is not standing behind every bucket, every instance, every key.
- → Every change is gated because one misconfiguration can expose the entire estate — so every change is reviewed, every change is manual, and the cost of getting it wrong is account-wide.
- → Compliance, security, and NFRs are checked late — after the PR, after the merge, sometimes after the deploy — fueling remediation cycles that erode delivery cadence and team morale.
Nova absorbs all three — owned building blocks, separation of concerns, attested compliance up front.
Nova in one frame
You already recognize this pattern.
Every Central IT team curates a golden image for Windows, for Linux, for macOS. They own it, they patch it, they ship it — and consumers consume it without thinking about what is inside. That trade — per-application control for uniform operability — is one every enterprise has already made at the OS layer.
Nova plays the same role one layer up: for everything that runs your cloud. S3 buckets with SSE-KMS posture. RDS instances with deletion protection and PITR. Lambda containers with static ABAC binaries. ALBs, ECS services, KMS keys, DynamoDB tables. Each primitive is owned by the platform team, patched by the platform team, attested by the platform team, and consumed by anyone who declares a contract.
The difference is rigor: every primitive is versioned, tested across its entire lifecycle, and bounded by policy before any consumer ever touches it.
Nova's lane is the infrastructure beneath the application. AppSec stays with the application team.
Two principles that organize everything else
Two tenets discipline every other decision.
Sovereign boundary — Nova governs the delivery lifecycle; it does not reach upstream into product or software development [1]. Integration with SDLC and PDLC partners — the IDE, the sprint tool, the author workflow, the agent harness — happens exclusively through the validated, published contract surface. What lives outside the contract is not Nova's domain.
Lower autonomous · higher attested — lower environments proceed through agentic, zero-touch automation; promotion to qa, prod, and dr requires deliberate human attestation [1]. Not a rubber stamp — a policy-mandated act of accountability by a named human distinct from the PR author. The compute the platform makes; the choice the human keeps.
Everything else in the architecture inherits from these two.
Live · Attested · Stays human
Live today — 41 capabilities across 12 domains; pilot confidence 0.800. The contract ingestor, the audit outbox, the state buckets, and the live pilot run have operated in our AWS estate since v1.7. DORA, adoption, and policy-conformance metrics flow to PowerBI from the same audit stream as the lineage — one pane, no second source of truth. Every finding carries one owner, one patch state, one audit entry.
Attested on promotion — qa, prod, and dr require a named human approver distinct from the PR author. Rubber stamps cannot be silently issued; the attestation is a policy-mandated act of accountability.
Stays human — by design — confidence below the autonomy threshold at qa, prod, or dr triggers human escalation [1]. Some categories of decision are preserved for human judgment, and the platform says so out loud.
The boundary keeps us honest
Nova stays where it belongs.
In Nova's lane
- → Infrastructure primitives: S3, RDS, Lambda, ECS, DynamoDB, KMS, CloudFront.
- → Operational guardrails: confidence, policy, attestation, audit lineage.
- → CVE response at the infrastructure layer.
Outside Nova's lane
- → Application business logic.
- → IDE, sprint, and author workflows [1].
- → Application-layer security: AppSec, dependency review, runtime threat modeling.
- → VM, bare-metal, and OS lifecycles [1].
The line is the contract. Everything below it is Nova. Everything above it stays where it has always been.
The 18-month shape
Where CDLC meets SDLC + PDLC — through the contract surface, not above it.
α (now → Q4'26) — Operating model + federated governance. A named platform-ops body owns the platform; SLAs on every L2 are ratifiable by platform and consumer. The operating model is published; integration surfaces for SDLC and PDLC harnesses are documented at the contract boundary.
β (Q1'27) — Auto-published infra observability. Every consumer stack ships with CloudWatch dashboards, uptime-kuma monitors, and alert routing on apply — infrastructure observability as a property, no per-team authoring required.
γ (Q2'27) — Runbook generation from telemetry. Every L1 primitive ships with an auto-generated incident runbook derived from observed patterns. SREs get a starting runbook, not a blank page.
δ (Q3'27 → Q4'27) — Audit ledger, tamper-resistant. The SQLite hash-evidence stream migrates to S3 Object Lock + JWS signatures. External counsel verifies any production change back to a named human attestation.
Nova absorbs no IDE, no editor, no sprint tool, no agent harness.
What we ask · What comes back
What works now. Deploying L1 & L2 stacks works today in the sandbox AWS account — 13 L1 primitives and 2 L2 modules, live-applied at confidence 0.800. Next steps: ingest greenfield pilot projects, promote from sandbox to production, integrate with the SPGE constitutional library, and serve as the infrastructure layer.
What we ask. Architecture endorsement. Runway to the next milestone.
Why now. Agentic SDLC is reshaping the delivery curve. What is barely keepable today — incident response, compliance reconciliation, security remediation — does not compress at the same rate as the velocity it has to keep pace with. By the end of 2027, the gap between delivery acceleration and operational absorption is the structural risk.
What comes back. The infrastructure foundation that absorbs the velocity. Metrics that tell us where to push next. Audit lineage that closes the regulatory question. The next milestone, by November 2026.
What we do not ask for: an IDE, a sprint tool, an author workflow, an upstream pipeline. Nova stays in its lane [1].
