Jon Chery
e7866fda84
Nova Slides Render / render (push) Failing after 1m4s
AUTONOMY_THESIS.md (git mv from NO_HUMANS_THESIS.md): reframe from 'removing humans' to 'autonomy in operations, human at stage gates'. Drop D-### citations + internal file paths; keep anti-claims, reworded. Anti-claim #1 now: 'decisions are NOT made by an LLM — deterministic scripts calculate a score; the platform functions without AI'. NORTH_STAR.md: - Vision: 'invisible' → 'visible' (operations become visible — recurring theme); polish for technical audience (security, remediation velocity, reliability, lead time). - Objective #2: 'provable trust in AI decisions' → 'provable trust in automated decisions' (deterministic scripts calculate a score; platform functions without AI). - Objective #3: four CTO-grade metrics (Lead Time PR→Prod, Infra Vuln Count trend, MTTR, Cloud Spend Reduction) → all flow into PowerBI. - Objective #4: 'default substrate for agentic consumption' → integrate with externally owned PDLC/SDLC/Agentic/Citizen Developer platforms regardless of source; Nova provides skills + MCP endpoints; all prod intents go through the same controls + quality gates. - Anti-goals: drop #1 (hyperscaler competitor), #4 (legacy untagged), #5 (sold to operators). Add: 'not an upstream development platform', 'not a replacement for the PDLC'. Reword #3 (no 'removes humans'). docs/raci.md: 3 roles → 4 roles. Add Quality Engineering column. Rename Release Management → SRE. Split release attestation into Quality attestation (QA) + Production readiness (SRE). Platform no longer holds A for attestation — reassigned to QE/SRE. docs/scope.md: add integration framing (skills + MCP endpoints, all sources go through same controls). Render scripts: default deck name → nova-autonomous-cloud-delivery. ONBOARDING + terraform/onboarding: 'no-humans' → 'autonomous'. ---ci--- project: acdl phase: 1 milestone: v1.21 status: execute phase_role: execution ---/ci---
42 lines
1.6 KiB
Markdown
42 lines
1.6 KiB
Markdown
# terraform/onboarding/ — Consumer deploy-role + ABAC tag grant (P20, REQ-184)
|
|
|
|
Offline-proven Terraform for the cross-account consumer deploy-role +
|
|
`nova:owner` ABAC tag grant. This is the "role grant" half of the
|
|
autonomous onboarding flow (D-113); the "request" half is P18 (Lambda
|
|
action) + P19 (env-file autogen).
|
|
|
|
## Scope (D-114)
|
|
|
|
This Terraform is **offline-proven only** in v1.16:
|
|
- `terraform validate` passes.
|
|
- `terraform plan` (with `NOVA_AWS_ACCOUNT_ID` set) produces the expected
|
|
role + policy.
|
|
- **No live apply** — `NOVA_LIFECYCLE_MODE=plan` default. Live apply is
|
|
deferred to a future feature milestone (D-113/D-114).
|
|
|
|
## Variables
|
|
|
|
| Variable | Description | Default |
|
|
|----------|-------------|---------|
|
|
| `consumer_repo` | The consumer repository (org/repo) | `acdl/consumer-a` |
|
|
| `owner_id` | The owning team (for `nova:owner` tag) | `team-a` |
|
|
| `account_id` | The consumer's AWS account ID | `000000000000` |
|
|
| `region` | AWS region | `us-east-1` |
|
|
|
|
## Resources
|
|
|
|
- `aws_iam_role.consumer_deploy` — the consumer's deploy role with a
|
|
trust policy (assumed by the consumer's CI runner).
|
|
- `aws_iam_role_policy.consumer_invoke` — inline policy granting
|
|
`lambda:InvokeFunctionUrl` on the platform Lambda, scoped via
|
|
`aws:PrincipalTag/nova:owner == var.owner_id` (ABAC).
|
|
- `aws_iam_tag.owner` — tags the role with `nova:owner` + `nova:contract`.
|
|
|
|
## Usage (offline)
|
|
|
|
```bash
|
|
cd terraform/onboarding
|
|
terraform init -backend=false
|
|
terraform validate
|
|
NOVA_AWS_ACCOUNT_ID=123456789012 terraform plan -var consumer_repo=acdl/my-app -var owner_id=team-x
|
|
``` |