control-plane

A security engineering program, built in public, by one person and a governed coding agent. The human is the control plane: directing the workloads through architecture, standards, and gates, without doing the work packet by packet. Every claim carries its record: decisions with their rejected alternatives, controls with their proving tests, releases with their provenance, the agent's failures with what caught them.

The parts

role-call

Governance for non-human identities: import cloud identity snapshots, derive state from history rather than storing status, put owners and review campaigns on the record. Building in motion: fifty recorded decisions and the record of what the coding agent got wrong, kept on purpose.

secure-expense-mvp

A small expense tool, finished and hardened: every request-path gate tied to the failure it prevents, mutation-tested, deliberately complete.

build-guidelines

The doctrine: standards where every rule records the incident that produced it, and the promotion path from human check to automated gate.

aws-platform

Arrives with Phase 3: generic Terraform modules for an organization, its baseline, account vending, and keyless deploy federation.

The program documents

The current phase's plan, fixed before the work · monitoring by layer, each signal with its listener · recovery, split between rebuildable and stateful, with drills that expire · how every repository is gated

The method

Design before code, the plan published before building starts. Every change through a pull request: the agent proposes under its own installed-app identity, required checks gate, a human approving review is required, and the merge is the review's receipt.

Every figure a document states is asserted against the running system or gated against its source. Every incident becomes a rule; the second identical hand-fix becomes automation. What is deliberately absent is recorded beside what exists.

The arc

The eight phases as a timeline, with the current position marked
  1. Design, before any code
  2. The application, twelve review-gated subphases
  3. Local Kubernetes: admission, network policy, identity
  4. The cloud enclave as code, in progress
  5. Managed Kubernetes
  6. The security-gated pipeline, proven by a planted flaw
  7. Runtime detection and response
  8. Human-triggered remediation, last, because write access is earned