acdl/docs/raci.md

RACI — Who Owns What

Source of truth: .ciagent/PROJECT.md § RACI Matrix (v1.18, REQ-215, D-139). This page is the citizen-developer-facing copy.

Nova's delivery lifecycle has three roles. This page clarifies who owns what — so the citizen developer knows what they bring, what the platform provides, and what is co-owned.

The Three Roles

Citizen Developer (CD)

That's you — the consumer (technical developer L3A or non-technical L3B). You are Responsible for all Functional Requirements (FRs) and User Acceptance Testing (UAT). You produce the FRs + UAT via your AI coding agent, an upstream agentic SDLC platform, or any upstream development platform. The source does not matter — all are subject to the same compliance standards (the submission-readiness gate, the contract schema, the policy envelope, the immutable audit stream). Nova validates the submission, not the author.

Platform (Nova)

Nova is Responsible for all Non-Functional Requirements (NFRs), Infrastructure (cloud resource lifecycle, state, IAM), QA (the platform-side quality checks: policy enforcement, confidence scoring, schema validation), and Production deployments to cloud (the apply path, the pipeline, the release mechanics).

Release Management (RM) — co-owned

The release is co-owned. The platform performs the QA + SRE attestations agentically (it runs the confidence signal, the policy checks, the separation-of-duties). The citizen developer oversees and triggers the actual release — the human attestation at the stage gate is your authorization. The platform runs the checks; you authorize the promotion. This is the "autonomy in operations, human at stage gates" model.

The Matrix

Work Category	Citizen Developer	Platform	Release Management
Functional Requirements (FRs)	R/A	C	I
User Acceptance Testing (UAT)	R/A	C	I
Non-Functional Requirements (NFRs)	I	R/A	C
Infrastructure (cloud, state, IAM)	I	R/A	C
QA (policy, confidence, schema checks)	C	R/A	I
Production deployment to cloud	I	R/A	C
Release attestation (QA + SRE sign-off)	A	R	R

Key: R = Responsible (does the work) · A = Accountable (owns the outcome, sign-off) · C = Consulted · I = Informed.

What This Means in Practice

You (Citizen Developer) bring:

• Your application code + a contract that declares intent.
• Your FRs (what the application does).
• Your UAT (you accept the deployment when it meets your FRs).

Nova (Platform) provides:

• The NFRs (security, observability, compliance — baked into the pipeline, not your concern).
• The infrastructure (cloud resources, state management, IAM scoping).
• The QA (policy enforcement, confidence scoring, schema validation).
• The production deployment (the apply path, the pipeline, the release).

You co-own the release:

• Nova runs the attestations (QA confidence, SRE operational readiness).
• You authorize the promotion at the stage gate. No promotion happens without your recorded attestation.

Compliance Standards Apply Equally

Your FRs + UAT may come from any source — an AI coding agent, an agentic SDLC platform, or a traditional IDE. Nova does not differentiate. All submissions pass through the same gate (schemas/submission-readiness.schema.json): tags, environment metadata, policy preconditions, profile markers. The compliance standards are the same regardless of how the code was authored. This is by design: the audit trail is the same, the policy envelope is the same, the evidence stream is the same. The source does not matter; the submission does.