Pipelines and infrastructure as code, the program view¶
The program's active repositories, manifest-identity and build-doctrine and this site, are gated the same way: nothing lands without passing required checks and a human approval, every tool arrives from its canonical release and is checksum-verified before it runs, and what a gate may block on is decided and recorded, because an alarm that is always red teaches the eye to skip it. The finished reference, secure-expense-mvp, keeps the gates it was finished with and is not retrofitted unless the reference itself changes; the study repositories carry the writing rules and their own parity checks and no more, because they hold no code that runs.
The shared method¶
- Changes travel branches and pull requests; the mainline refuses direct pushes, force pushes, and deletion.
- The coding agent proposes under its own installed-app identity with named permissions; a human approving review is required, and the approve button lives past the diff, so the diff gets read.
- Commits and release tags are signed; releases carry build provenance attestations verifiable against the platform's transparency log.
- Writing rules, status-truth gates, and secret scans run at commit time and again in the pipeline.
- Weekly scheduled runs cover what changes while the code does not: a base image fix shipping, a new advisory against a pinned tree.
Per repository¶
| Repository | The gates, beyond the shared set |
|---|---|
| The application | Tests with a coverage floor, strict typing, a mutation check that breaks one control at a time and requires the tests to notice, migration drift against a real database, dependency audits, container lint, base image scan, manifest schema and posture checks, and a documented route surface asserted against the live route table |
| The guidelines | The writing rules enforced on the documents that define the writing rules |
| The platform (arrives at Phase 3) | Format and validation, IaC misconfiguration scanning with the already-vetted scanner's config mode, a cost delta stated on every pull request, drift detection on the weekly clock, and the cloud's own reviewers (Config, Security Hub, Access Analyzer) checking what actually exists independently of what any plan claimed |
Infrastructure as code, the posture¶
Terraform as the primary tool, state in versioned S3 with native locking, no account identifiers in shipped modules (identity is discovered from credentials; environment specifics live in a thin live layer), and no stored cloud credential anywhere: humans authenticate through short-lived Identity Center sessions, pipelines federate through OIDC into scoped roles. A plan is a claim about intent, so the cloud's own configuration record is the independent reviewer of what exists, the same relationship the application's tests have to its controls.