CIAgent
d66b7b0e73
---ci--- project: acdl phase: 1 milestone: v1.30 status: execute wave: 2 persona: ci-doc-writer ---/ci---
20 KiB
marp: true theme: default footer: "Nova Platform - Infrastructure & Operations" paginate: false size: 16x9 style: | section { font-family: "Akkurat Pro", "Helvetica Neue", "Arial", sans-serif; font-size: 22px; color: #1B1B1B; padding: 48px 56px 40px; overflow: auto; } h1 { color: #D6002A; font-size: 34px; margin-bottom: 0.3em; } h2 { color: #D6002A; font-size: 26px; margin-bottom: 0.2em; } h3 { color: #D6002A; font-size: 22px; margin-bottom: 0.2em; } table { font-size: 18px; width: 100%; border-collapse: collapse; } th { background: #F0F0F0; border-bottom: 2px solid #D6002A; padding: 4px 8px; text-align: left; } td { border-bottom: 1px solid #F0F0F0; padding: 4px 8px; } blockquote { border-left: 4px solid #D6002A; color: #1B1B1B; font-size: 20px; padding-left: 12px; } pre { background: #1B1B1B; color: #FFFFFF; border-radius: 4px; padding: 12px; font-size: 16px; } code { background: #F0F0F0; color: #1B1B1B; border-radius: 2px; padding: 1px 4px; font-size: 18px; } pre code { background: transparent; color: #FFFFFF; } img { display: block; margin: 0 auto; max-width: 100%; max-height: 380px; object-fit: contain; } strong { color: #D6002A; } .benefit { margin-top: 0.6em; padding-top: 0.4em; border-top: 1px solid #D6002A; color: #1B1B1B; font-size: 20px; font-style: italic; } @media print { section { overflow: hidden; } }
The friction every delivery team lives today
Velocity is up; the coordination surface around each change is up faster.
- → Infrastructure is authored by people who don't specialize in infrastructure.
- → Every change is gated because one misconfiguration can expose the entire estate.
- → Compliance, security, and NFRs are checked late — fueling remediation cycles that erode delivery cadence and team morale.
Nova absorbs all three — owned building blocks, separation of concerns, attested compliance up front.
Nova in one frame
You already recognize this pattern.
Every Central IT team curates a golden image for Windows, for Linux, for macOS. They own it. They patch it. They ship it. Consumers consume it without thinking about what's inside.
Nova plays the same role one layer up — for everything that runs your cloud. S3 buckets with SSE-KMS posture. RDS instances with deletion protection and PITR. Lambda containers with static ABAC binaries. ALBs, ECS services, KMS keys, DynamoDB tables. Each one is owned by the platform team, patched by the platform team, attested by the platform team, and consumed by anyone who declares a contract.
The difference: every primitive is versioned, tested across its entire lifecycle, and bounded by policy before any consumer ever touches it.
Nova's lane is the infrastructure beneath the application. AppSec, dependency review, and runtime application security stay where they have always been — with the application team.
Two principles that organize everything else
The architecture is principled, not improvised. Two tenets discipline every other decision.
Sovereign boundary. Nova governs the delivery lifecycle; it does not reach upstream into product or software development [1]. Integration with SDLC and PDLC partners happens exclusively through the validated, published contract surface. What lives outside the contract is not Nova's domain.
Lower autonomous · higher attested. Lower environments proceed through agentic automation. Promotion to higher environments requires deliberate human attestation — not as a rubber stamp, but as policy-mandated accountability [1]. The compute the platform makes; the choice the human keeps.
Everything else in the architecture inherits from these two.
Live · Attested · Stays human
Live today 41 capabilities across 12 domains. Contract ingestor, audit outbox, state buckets, and the live pilot run have been operating in our AWS estate since v1.7; pilot evidence at v1.26 returned confidence 0.800. DORA + adoption + policy-conformance metrics flow to PowerBI from the same audit stream as the lineage. Every finding carries one owner, one patch state, one audit entry — one pane, no second source of truth. A POC is production-grade by construction: there is no "POC that became prod" surprise.
Attested on promotion qa, prod, and dr require a named human approver distinct from the PR author. Rubber stamps cannot be silently issued.
Stays human — by design Confidence below the autonomy threshold at qa, prod, or dr triggers human escalation [1]. Some categories of decision are preserved for human judgment, and the platform says so out loud.
The boundary keeps us honest
Nova stays where it belongs.
In Nova's lane
- → Infrastructure primitives: S3, RDS, Lambda, ECS, DynamoDB, KMS, CloudFront.
- → Operational guardrails: confidence, policy, attestation, audit lineage.
- → CVE response at the infrastructure layer.
Outside Nova's lane
- → Application business logic.
- → IDE, sprint, author workflows [1].
- → Application-layer security: AppSec, dependency review, runtime threat modeling.
- → VM, bare-metal, OS lifecycles [1].
The line is the contract. Everything below the contract is Nova. Everything above it stays where it has always been.
The 18-month shape
Where CDLC meets SDLC + PDLC — through the contract surface, not above it.
α (now → Q4'26) — Operating model + federated governance. A named platform-ops body owns the platform; SLAs on every L2 are ratifiable by platform + consumer. The operating model is published; integration surfaces for SDLC and PDLC harnesses are documented at the contract boundary.
β (Q1'27) — Auto-published infra observability. Every consumer stack ships with CloudWatch dashboards, uptime-kuma monitors, and alert routing on apply — infrastructure primitives publish observability as a property, no per-team authoring required.
γ (Q2'27) — Runbook generation from telemetry. Every L1 primitive ships with an auto-generated incident runbook derived from observed patterns. SREs get a starting runbook, not a blank page.
δ (Q3'27 → Q4'27) — Audit ledger, tamper-resistant + externally addressable. The SQLite hash-evidence stream migrates to S3 Object Lock + JWS signatures. External counsel verifies any production change back to a named human attestation.
Nova absorbs no IDE, no editor, no sprint tool, no agent harness.
What we ask · What comes back
What we ask. Architecture endorsement. Runway to the next milestone.
Why now. Agentic SDLC is reshaping the delivery curve. What is barely keepable today — incident response, compliance reconciliation, security remediation — does not compress at the same rate as the velocity it has to keep pace with. By the end of 2027, the gap between delivery acceleration and operational absorption is the structural risk.
What comes back. The infrastructure foundation that absorbs the velocity. Metrics that tell us where to push next. Audit lineage that closes the regulatory question. The next milestone, by November 2026.
What we do not ask for: an IDE, a sprint tool, an author workflow, an upstream pipeline. Nova stays in its lane [1].