acdl/docs/presentations/nova-autonomous-cloud-delivery-talking-points.md

Nova — The Autonomous Cloud Delivery Platform: Talking Points

Step 4 of the 4-step deck process. Presenter cues that mirror the <!-- Talking points: --> comments in nova-autonomous-cloud-delivery-marp.md (the sole source of truth). 3-6 bullets per slide + key takeaway. Indexed by Marp slide #. v1.21 — REQ-245

---

Slide 1 — The Problem

• Open with the shift: "you build it, you run it" put Terraform into product teams — ownership without discipline is destroying value
• Land the lifecycle-planning gap: resources authored for creation, not for patching/rollback → destructive changes
• Land the urgency: AI-era 0-day pace demands proactive scanning as code + at runtime, remediated at threat pace
• Call out tribal knowledge / the rockstar-operator problem — the platform should encode the discipline, not the person
• Do NOT frame this as "humans are the problem" — the problem is ownership without the discipline and tooling
• Key takeaway: the problem is infrastructure ownership without discipline; the answer is an autonomous platform that encodes the discipline

Slide 2 — Nova's Vision

• Read the vision verbatim — "infrastructure operations become visible" is the operative phrase
• Emphasize "provable, not promised" — trust established by deterministic scripts; the platform functions without AI
• State the attestation model up front: QA for production, SRE for operational readiness
• Key takeaway: autonomous operations with provable trust — security, remediation velocity, reliability, lead time made visible, not promised

Slide 3 — Strategic Objectives

• Objective #1: zero-touch operations — autonomy as the default, not the demo; stage-gate attestation (QA, SRE) remains human by design
• Objective #2 is the one to land carefully: trust = deterministic scoring, not an LLM; the platform functions without AI
• Objective #3: four CTO-grade metrics (Lead Time, Vuln Count, MTTR, Spend) — all flow into PowerBI
• Objective #4 is the integration thesis: Nova integrates with any upstream source; provides skills + MCP; all prod intents go through the same controls
• Key takeaway: the scope is explicit — Nova governs infra + delivery, integrates with any source through one contract, measures success on four CTO metrics

Slide 4 — Anti-Goals (What Nova Is NOT)

• Not a general-purpose AI agent platform
• Not a system that removes humans from accountability — only from normal operations
• Not an upstream development platform (no product backlogs, IDE, code authorship)
• Not a replacement for the Product Development Lifecycle (PDLC)
• Anti-goals #3 and #4 protect the scope boundary — Nova will not become an IDE or a product-planning tool
• Key takeaway: the boundaries are explicit — Nova is purpose-built for infra ops + delivery, not a general-purpose AI agent or an upstream dev platform

Slide 5 — Scope: Downstream of PDLC

• Nova governs infra + delivery only; the PDLC (backlog, code authorship, IDE) is upstream — Nova stays downstream of it
• Integration is only through the validated contract boundary
• Any upstream source (AI agent, agentic SDLC, dev platform) produces submissions subject to the same compliance standards
• Nova validates the submission, not the author
• Key takeaway: Nova is purpose-built for infrastructure operations; the scope boundary is clean and bounded

Slide 6 — RACI: Who Owns What

• Four roles now: Citizen Developer, Platform, Quality Engineering, SRE
• Quality attestation is owned by Quality Engineering (not the Platform); Production readiness is owned by SRE
• The Platform runs the checks agentically but is never the Accountable party for the gate — that separation keeps the platform honest
• Production readiness is co-owned: the platform runs attestations; the citizen developer authorizes the promotion at the stage gate
• Key takeaway: you bring FRs + UAT; Nova provides NFRs + infra; QE guards the gate evidence; SRE signs off on production readiness

Slide 7 — The Platform Pipeline

• Walk the pipeline left-to-right: contract → resolver → adapter → Checkov (static) → plan → Wiz (on plan) → confidence → gate → apply
• Two-stage scan: Checkov on static code BEFORE the plan (fail-fast dev feedback); Wiz on the plan (or Checkov as drop-in if no Wiz creds)
• Never both Wiz + Checkov on the plan — avoid duplicate noise
• Dev is autonomous; qa/prod/dr require attestation (QA for quality, SRE for production readiness)
• Key takeaway: two layers of scanning, zero operator involvement in normal operations

Slide 8 — The Decision Ledger

• "AI decisions" are really automated decisions — deterministic scripts calculate a score; the platform functions without AI
• Do not dwell on the storage substrate — the value is accountability (immutable, queryable, traceable to outcome), not the database
• Every stage-gate attestation is captured with approver identity and the evidence presented
• When an LLM planner is added later, it emits richer alternatives without breaking the schema
• Key takeaway: autonomous is defensible because every decision is immutable, queryable, accountable — and "automated" means deterministic scoring, not a black-box LLM

Slide 9 — Attestation Matrix: QA

• The matrix is not a rubber stamp — structured, freshness-validated
• Each concern now has a plain-language description of what is being attested (the old "operator-supplied" label is gone)
• Three QA concerns: functional correctness (24h), performance baseline (7d), security posture (24h)
• Each concern has a freshness window — evidence older than the window does not satisfy the gate
• Key takeaway: QA signs off on quality before any promotion — the gate is explicit, not implicit

Slide 10 — Attestation Matrix: Prod/DR

• Seven prod/DR concerns: operational readiness, incident response, capacity & cost, DR drill, chaos, backup, DR region deploy
• SRE signs off on operability (runbooks, dashboards, on-call), incident response, capacity, and the three resilience checks
• Each concern has a freshness window — 30d/90d/180d depending on the control
• SoD on prod: the approver can't be the same person who built it — the rule that keeps the gate honest
• Key takeaway: autonomy in operations, human in accountability, by design — the matrix is what makes autonomous operations safe enough to trust in production

Slide 11 — Telemetry & Live Ops

• Deliberately minimal: Nova-native CloudEvents; no Kafka/Prometheus/ClickHouse
• The live-ops dashboard is built in PowerBI on top of the exported views — leadership sees the same numbers the platform produces
• Every number in the Proof slides is traceable to a signal — "where does this number come from?" → a query against the cold store
• This is where the "infrastructure operations become visible" theme lands concretely
• Key takeaway: the architecture is the trust substrate — operations become visible in PowerBI, with full traceability

Slide 12 — Decision Ledger + Attestation Coverage

• Both 100% — no automated decision is ever lost; no prod/dr promotion lands without a human sign-off
• The mandatory-by-design point: the ledger entry + the human attestation are a gate, not a best-effort feature
• Easily queried: by run, by environment, by approver, by outcome — the audit trail is a query, not a forensic exercise
• Key takeaway: trust is provable — not a marketing claim, a queryable record; no change to production without both the ledger entry and the human attestation

Slide 13 — Cost & ROI

• The ROI formula is shown inline — not hidden in a footnote
• The four CTO-grade metrics are the ROI proof — Lead Time, Vuln Count, MTTR, Cloud Spend
• The N=0 caveat is stated explicitly: the formula is grounded; the production numbers activate with a pilot
• Key takeaway: the ROI is not a black box — the formula is shown, the four metrics are committed, the production-denominator caveat is up front

Slide 14 — What's Deferred — and Why

• The preempt is critical: these deferrals are measurement infrastructure, not autonomy — the platform IS autonomous in operations
• The blocking work is named in plain language (no decision IDs) — "live AWS re-provisioning", "drift-detection scheduler", "ML service"
• Showing this to leadership demonstrates honesty, not weakness
• Key takeaway: the autonomy is real; the measurement gaps are documented with the work that unblocks each one

Slide 15 — Roadmap to the North Star

• Each deferred metric has an unblock path and a timeframe — near-term, mid-term, longer-term
• No status column: most of it is not implemented yet, so status would be noise
• Re-evaluation triggers: each blocking piece of work lifts on its own schedule
• Key takeaway: every deferred metric has a plan and a timeframe — nothing is hand-waved

Slide 16 — 12-Month Product Roadmap

• This is the product roadmap, forward-looking only
• Q1 Pilot Activation → Q2 Provable Trust → Q3 Compounding ROI → Q4 Integration & Predictive
• Each quarter activates one strategic objective from the North Star
• Key takeaway: the 12-month product arc — each quarter activates a strategic objective and its board-level metric

Slide 17 — Quarter-by-Quarter Outcomes

• Q1: three post-pilot metrics go live (Touchless ≥99%, Escalation <0.1%, Accuracy ≥99.5%) — denominator activates with the pilot
• Q2: Decision Ledger Coverage was already grounded — tamper-evidence is the Q2 upgrade (local hash-chain → Object Lock + signed checkpoints)
• Q3: Drift Auto-Reversal ≥95% unblocks when the drift scheduler ships; Spend Reduction ≥25% measured against the pilot baseline
• Q4: Predictive:Reactive ≥3:1 requires the ML forecasting service; AI-Agent Intent Share is a first measurement (aspirational-metric)
• Key takeaway: each quarter has a concrete deliverable, a target metric grounded in a strategic objective, and a path from deferred to shipped

Slide 18 — Production-Grade Guidance via Atelier (1/2)

• Nova instructs the citizen developer's AI agent via skills (markdown, keyed to engineering domains) + an MCP server (4 tools, plugin-registry, stdio)
• The integration point is the same regardless of source — AI agent, agentic SDLC, traditional IDE all get the same skills + MCP
• This is how Nova makes the citizen developer production-grade without owning the PDLC
• Key takeaway: the citizen developer's AI agent is not unguided — Nova provides engineering principles as skills + MCP

Slide 19 — Production-Grade Guidance via Atelier (2/2)

• The value is the gap deterministic scanners leave: engineering discipline (Wiz/Checkmarx/Mend check policy/secrets, not discipline)
• The MCP server catches "is this service observable?", "is this error path handled?", "is this API contract clear?"
• Vendored at a pinned tag → audit reproducibility — a validation result is replayable months later
• Key takeaway: submissions are checked for engineering discipline, not just policy compliance — and the check is reproducible for audit

Slide 20 — Recap + Ask

• Recap the 4-beat arc so the audience leaves with the structure
• The ask is a business decision: approve a pilot estate + the tamper-evident ledger build-out
• "Pipeline-ready" → "production-proven" is the value proposition
• Key takeaway: approve a pilot + the ledger build-out to move from pipeline-ready to production-proven

Appendix A1 — Metrics Glossary

• Reference for every metric mentioned in the deck
• Use if the audience asks "what does X mean?"