acdl/.ciagent/NORTH_STAR.md

# NORTH_STAR — Nova

> **Status:** Draft (pending interactive GRILL → final)
> **Milestone:** v1.21 — Nova Deck Refinement & Pipeline Hardening
> **Owner:** Product Owner
> **Purpose:** Durable strategic intent. Read by CIAgent in every future
> `/ci-run` so the platform's direction survives across milestones. This
> is NOT a status document (that's PROJECT.md) and NOT an engineering
> architecture (that's the telemetry reference in RESEARCH.md/
> ARCHITECTURE.md). It is the PO's committed direction: what we're
> building toward, what we refuse to build, and how we'll know we won.

---

## Vision

> **Infrastructure operations become visible. Every environment
> provisioned, every incident healed, every risk remediated — by an
> autonomous system whose trustworthiness is provable, not promised.
> Human attestation remains required at stage gates — QA signs off for
> production, SRE greenlights based on operational readiness — but the
> operator is never in the loop of normal operations.**

Nova is the autonomous infrastructure layer that lets product teams ship
without engaging an operator, and lets executives trust the platform not
because it never fails but because every decision is captured, scored,
and accountable. The recurring theme across the platform is that
**infrastructure operations become visible** — security posture,
remediation velocity, reliability, and lead time are surfaced as
queryable signals rather than hidden in tribal knowledge.

---

## Strategic Objectives (4)

**1. Demonstrate production-grade zero-touch operations.**
Nova must run real customer estates with no human in the loop of normal
operations — autonomy as the default, not the demo. Stage-gate
attestation (QA for production, SRE for operational readiness) remains
human by design; operational escalations (AI confidence too low to
proceed) are the failure mode we drive toward zero. Everything else
collapses if autonomy isn't real.

**2. Establish provable trust in automated decisions.**
Trust is established by deterministic scripts that calculate a score and
a band outcome that gates the action — the platform functions without AI.
"AI decisions" are really automated decisions. The audit substrate —
Decision Ledger, confidence scoring, circuit breakers, blast-radius
controls — turns "autonomous" from a marketing claim into a defensible
one. Trust is the moat. Features can be copied; an immutable, queryable
decision history cannot.

**3. Deliver compounding, quantifiable ROI for customers.**
Each quarter on Nova must show measurable improvement on four CTO-grade
metrics, all of which flow into PowerBI views and are captured by the
telemetry pipeline:

- **Lead Time** — from PR merge to production deployment (downward trend).
- **Infrastructure Vulnerability Count** — open findings on deployed
  resources (downward trend, demonstrating that proactive scanning +
  remediation keeps up with the AI-era 0-day pace).
- **MTTR** — for platform-detected and platform-remediated incidents.
- **Cloud Spend Reduction** — on pilot estates vs. the pre-Nova
  baseline.

If leadership cannot point to a number that improves quarter-over-quarter
on these four axes, Nova fails its commercial test, regardless of how
clever the automation is.

**4. Integrate with externally owned development platforms — regardless of source.**
Nova integrates with externally owned PDLC, SDLC, Agentic, and Citizen
Developer platforms with no regard for the source of the intent. Nova
provides a set of skills and MCP endpoints that help the developer or AI
agent make their application production-grade. Regardless of the source,
all intents to deploy to production go through the same rigorous
controls, quality gates, attestation, and evidence stream. Nova is the
layer any of those platforms reach for first when an agent needs to
deploy — not a vendor arriving late to that market.

---

## Anti-Goals (4 — what Nova is fundamentally NOT)

1. **Not a general-purpose AI agent platform.** We are purpose-built for
   infrastructure operations. Breadth here produces shallow tools; depth
   here wins the category.
2. **Not a system that removes humans from accountability.** Only from
   normal operations. Every automated decision lands in an immutable
   ledger. Every stage-gate promotion (qa/prod/dr) requires a human
   attestation recorded with approver identity, separation-of-duties
   check, and the evidence matrix. The absence of an operator in the
   loop is never the absence of a record.
3. **Not an upstream development platform.** Nova does not own the
   product backlog, IDE workflows, code authorship, or application
   business logic. The PDLC is upstream; Nova integrates with it through
   a validated contract boundary — Nova never reaches into it.
4. **Not a replacement for the Product Development Lifecycle (PDLC).**
   Nova governs infrastructure + delivery only. Product lifecycle
   decisions (what to build, when to ship, for whom) remain with the
   product team. Nova makes their intent production-grade; it does not
   own the intent.

---

## Non-Goals (v1.17 milestone scope — deferred work, not permanent boundaries)

> Anti-Goals are what Nova *fundamentally is not*. Non-Goals are what we
> *will not do this milestone* — deferred work, not permanent boundaries.
> Each Non-Goal cites the controlling decision ID.

1. **Live AWS re-provisioning** (deferred — D-096). Metrics that require
   live infrastructure ship as placeholder PowerBI views with documented
   schemas.
2. **Onboarding auto-grant** (deferred — D-113/D-114/D-119). Only the
   request-path metric is grounded; the requested→granted funnel is a
   placeholder.
3. **ML anomaly-forecasting / predictive remediation** (no emitter today).
   The Predictive-vs-Reactive metric ships as a placeholder.
4. **Drift detection scheduled job** (deferred — D-096 + no scheduler).
   Drift metrics ship as placeholders.
5. **Live cost CUR reconciliation** (deferred — D-096). Pre-apply Infracost
   estimates are grounded; actual-spend reconciliation is a placeholder.
6. **S3 Object Lock / JWS tamper-evident ledger** (deferred — D-083). The
   Decision Ledger uses a local SQLite hash-chain this milestone; the
   Object-Lock/JWS build-out is a future milestone.
7. **Multi-cloud support** (Azure/GCP/K8s). Nova is AWS-only this milestone.

---

## 12–18 Month Targets

Targets are committed, not aspirational. Each is a number a board member
can repeat back to us. The grounding column records whether the metric is
measurable this milestone, and if not, what blocks it.

> **Honesty note (GRILL G-Q6 binding):** Nova has 0 consumer adoption
> today (`PROJECT.md:495`). Three targets (Touchless Resolution, Human
> Escalation, AI Decision Accuracy) are scoped "across production
> estates" — the measurement *pipeline* is grounded this milestone, but
> the *denominator* is zero until a pilot estate activates. These
> targets are reclassified as **Post-Pilot** (the pipeline works; the
> numbers fill when consumers exist). This is the same honesty model as
> Cloud Spend Reduction (partial: pipeline grounded, actuals deferred).

### Current-milestone targets (grounded or derived this milestone)

| Domain | Target | Grounding (v1.17) | Note |
|---|---|---|---|
| **MTTR (p95)** | < 60 seconds | grounded (platform-run MTTR) | apply.failed → successful retry; infra-incident MTTR deferred (no incident detection) |
| **Cloud Spend Reduction** | ≥ 25% on pilot estates vs. 12-month pre-Nova baseline | partial | pre-apply estimate grounded (Infracost); actual-spend deferred (D-096 CUR) |
| **L1 / L2 Ops Hours Avoided** | ≥ 70% of pre-Nova FTE allocation | derived | formula over run count × manual baseline (computed on N internal runs; production-denominator activates post-pilot) |
| **Platform ROI** | ≥ 250% measured annually | derived | formula (labor savings + cloud savings + avoided downtime) ÷ platform op cost (computed on N internal runs; production-denominator activates post-pilot) |
| **Decision Ledger Coverage** | 100% of AI actions with backfilled outcome | grounded (this milestone builds it) | outbox_writer.py → SQLite hash-chain |
| **Attestation Coverage** | 100% of prod/dr promotions attested by a human | grounded | hitl_gates.py + outbox approver_* attributes; separation-of-duties on prod |

### Post-Pilot targets (pipeline grounded this milestone; denominator activates when a pilot estate runs)

| Domain | Target | Grounding (v1.17) | Note |
|---|---|---|---|
| **Touchless Resolution Rate** | ≥ 99% across production estates | partial (pipeline grounded; denominator = 0 today) | runs completing without *operational* HITL block ÷ total runs (attestation gates excluded); activates post-pilot |
| **Human Escalation Frequency** | < 0.1% of platform actions | partial (pipeline grounded; denominator = 0 today) | *operational* HITL blocks only (confidence-driven); attestation sign-offs excluded; activates post-pilot |
| **AI Decision Accuracy** | ≥ 99.5% (no rollback, no follow-up incident within 5 min of action) | partial (pipeline grounded; denominator = 0 today) | decisions not followed by apply.failed/incident within 5min; activates post-pilot |

### Deferred targets (measurement requires future systems)

| Domain | Target | Grounding (v1.17) | Note |
|---|---|---|---|
| **Predictive vs. Reactive Ratio** | ≥ 3 : 1 (prevention dominates reaction) | deferred | requires ML forecasting service (future emitter) |
| **Drift Auto-Reversal Rate** | ≥ 95% within one detection cycle | deferred | requires drift detection (D-096 + scheduler) |

> Committed targets whose measurement is deferred remain committed — the
> target is the destination; the metric is the odometer, and some
> odometers aren't built yet. Each deferred metric ships as a placeholder
> PowerBI view + a definition-of-success doc recording the dependency.
> Post-Pilot targets are committed targets whose measurement pipeline is
> grounded this milestone; the numbers activate when a pilot estate runs.

### Future Horizons (strategic direction, not committed targets)

| Domain | Aspiration | Note |
|---|---|---|
| **AI-Agent Intent Share** | ≥ 40% of total intent volume originated by non-human consumers | Strategic Objective #4 direction. No backing requirement, no placeholder view, no emitter today. Moves to a committed target when agentic consumption is real. |

---

## Success Criteria (v1.17 — what constitutes success for THIS milestone)

> Distinct from the 12–18mo targets: those are the destination. These are
> the milestone's exit criteria.

v1.17 is a success if:

1. **Decision Ledger emits `ai.decision.made` for 100% of platform runs**
   with outcome backfill, AND **`attestation.recorded` events for 100%
   of qa/prod/dr promotions** (event completeness — all 3 gates captured;
   grounded in `outbox_writer.py` → SQLite hash-chain; honors D-083).
   The **Attestation Coverage metric** (target 100%) measures prod/dr
   promotions specifically — see REQ-194.
2. **`docs/METRICS.md` catalogs every executive KPI** with a `grounded` /
   `derived` / `deferred` status, a source file or decision ID, and a
   per-KPI definition-of-success doc in `docs/metrics/`.
3. **The PowerBI export produces all fact/dimension views** + 8 empty
   placeholder views for deferred metrics (with documented schemas ready
   to fill when their blocking decisions lift).
4. **The unified narrative deck ships** with the x3 arc
   (Problem→Vision→How→Proof→Roadmap) at deck + slide level, per-slide
   benefit callouts, and fluid transitions; both old decks retired.
5. **`NORTH_STAR.md` is wired into CIAgent context-loading** so every
   future `/ci-run` reads it.
6. **CAP-023 (metrics collector) + CAP-024 (deck structure) pass** in the
   regression gate.

---

## What "won" looks like

By month 18, Nova is the layer enterprise leadership points to when they
say *"we don't have an infrastructure ops team anymore, and the audit
trail is stronger than it ever was"* — and it is the default substrate
their AI engineering teams reach for first when an agent needs to deploy.

---

## Relationship to v1.17 engineering

- **Pillar A (this file):** strategic direction — durable, PO-authored.
- **Pillar B (engineering):** the telemetry reference architecture
  (adapted from the PO's technical-direction input) lives in
  RESEARCH.md/ARCHITECTURE.md. It is the *how*; this file is the *why*.
- **Pillar C (story):** the unified narrative deck proves Pillars A+B to
  leadership. The deck's Proof section cites grounded metrics; its
  Roadmap section cites deferred targets honestly.

## Relationship to engineering files (v1.27 update)

- **NORTH_STAR.md** (this file) = the *why* — PO-authored strategic
  direction, loaded every ci-run via `config.strategic_direction_file`.
- **STATE.md** = the *what exists* — PO-owned capability catalog,
  additive, updated at every milestone ship (P-final Wave 3). The PO
  reads STATE.md before writing new REQ-NNN specs to avoid re-spec'ing
  existing capability and to respect the invariants.
- **ARCHITECTURE.md** = the *how* — the durable target architecture.
- **CHECKPOINT.json** = the *now* — authoritative live phase/ship
  state.

## v1.25 update — swappable policy-engine substrate

Strategic Objective #2 (provable trust) gained a concrete substrate in
v1.25: the policy engine that produces the `PolicyCheckResult` records
feeding the confidence signal is now **swappable** via the
`PolicyEngine` protocol (`core/policy_engine.py`). `kyverno-json` is
the v1.25 default; `OPA` (or any other engine) can replace it by
implementing the same 3-method protocol — without touching the
confidence signal, the PCR schema, or the pipeline. See
ARCHITECTURE.md §12.7. The trust moat is a *replaceable* engine, not a
vendor lock-in.