Rules - Delivery Constraint & Opportunity Analysis

Rules in Delivery Constraint & Opportunity Analysis

IDE rules exported with workflows to your editor

Rules 19

Title	Slug	Activities
Big Picture Before Detail	`big-picture-before-detail`	3	Read the 'Big Picture Before Detail' rule from playbook 'Delivery Constraint & Opportunity Analysis'. Slug: big-picture-before-detail. always_apply: true. Open with the reconstructed delivery cycle (all BizDevTestSecOps stages) showing effort, wall-clock, and impact on each stage. Then the opportunity quadrant (gain vs effort). Then the deficiency register (dE/dK/dI + routes). Then only promoted stage detail or starter mart tabs. Never lead with Feature Cycle Time, Commits, or any single-stage chart. The rendering tool (Streamlit, Jupyter, QuickSight, Power BI) is a skill pick, not the opening.
Eliminate Before Automate Before Delegate	`eliminate-before-automate-before-delegate`	1	Read the 'Eliminate Before Automate Before Delegate' rule from playbook 'Delivery Constraint & Opportunity Analysis'. Slug: eliminate-before-automate-before-delegate. always_apply: true. Work every constraint in this order: eliminate the step if it's pure waste; if it must stay, automate it with the smallest tool (a Lambda paired with Guardrails); only delegate the remaining judgment-requiring work to an agent once eliminate and automate are exhausted. Don't automate a step that should have been eliminated, and don't delegate to an agent what a Lambda could safely do.
Execute by Workflow Order	`execute-by-step-labels`	4	Read the 'Execute by Workflow Order' rule from playbook 'Delivery Constraint & Opportunity Analysis'. Slug: execute-by-step-labels. always_apply: true. Run the four workflows in the `order` field sequence (1→4): (1) scope and stand up the lake as code, (2) land operational history, (3) reconstruct the cycle, score impact, look until trusted, triage, (4) tell the story. Names and descriptions do not carry STEP numbers. Jupyter / Streamlit / QuickSight / Power BI are skills, not workflows.
Fix the Constraint, Not Everything	`fix-the-constraint-not-everything`	1	Read the 'Fix the Constraint, Not Everything' rule from playbook 'Delivery Constraint & Opportunity Analysis'. Slug: fix-the-constraint-not-everything. always_apply: true. Per the DevOps Handbook's 1st Way, continually identify and address the single most significant bottleneck in the BizDevTestSecOps flow. Optimizing a non-constraint just moves the queue elsewhere and burns effort without moving end-to-end lead time.
GitHub OIDC Trust Both Sub Shapes	`github-oidc-trust-both-sub-shapes`	2	Read the 'GitHub OIDC Trust Both Sub Shapes' rule from playbook 'Delivery Constraint & Opportunity Analysis'. Slug: github-oidc-trust-both-sub-shapes. always_apply: true. GitHub Actions OIDC `sub` claims come in two shapes: name-only `repo:{org}/{repo}:` and ID-qualified `repo:{org}@{ORG_ID}/{repo}@{REPO_ID}:ref:...`. The deploy IAM role must trust both*. Trusting only the name-only pattern causes AssumeRoleWithWebIdentity to fail on `main` pushes.
Headcount Is an Assumptions Table	`headcount-is-an-assumptions-table`	1
Infrastructure as Code First	`infrastructure-as-code-first`	9	Read the 'Infrastructure as Code First' rule from playbook 'Delivery Constraint & Opportunity Analysis'. Slug: infrastructure-as-code-first. always_apply: true. Every AWS resource this playbook creates — S3 buckets, Lambda functions, Glue database/crawlers, the Athena workgroup, IAM roles/policies, ECS Fargate Streamlit mart, GitHub OIDC deploy role — is defined in the CDK app (four stacks: Deploy, Ingestion, Catalog, Eda), not clicked into existence in the console. Deploy that app exclusively through CI (GitHub Actions or GitLab CI, matching wherever the repo lives) via `cdk deploy`; a laptop only ever runs `cdk bootstrap` plus one sandbox mint of the OIDC DeployStack, never a shared environment after that.
Least-Privilege IAM and Encryption by Default	`least-privilege-iam-and-encryption-by-default`	5	Read the 'Least-Privilege IAM and Encryption by Default' rule from playbook 'Delivery Constraint & Opportunity Analysis'. Slug: least-privilege-iam-and-encryption-by-default. always_apply: true. Use IAM user/role policies (not just bucket ACLs) scoped to what each ingestion function and analytics tool actually needs. Encrypt data at rest with SSE-KMS and S3 Bucket Keys (`bucket_key_enabled=True` on raw, curated, and Athena-results buckets) and keep API tokens for GitLab/GitHub/Jira in Secrets Manager or SSM Parameter Store — never in code or SAM templates.
Lifecycle Cold Data to Cheaper Tiers	`lifecycle-cold-data-to-cheaper-tiers`	0
Never Name GitHub Actions Secrets GITHUB_*	`never-name-gha-secrets-github-prefix`	2	Read the 'Never Name GitHub Actions Secrets GITHUB_*' rule from playbook 'Delivery Constraint & Opportunity Analysis'. Slug: never-name-gha-secrets-github-prefix. always_apply: true. Do not name GitHub Actions repository secrets with the `GITHUB_` prefix (for example `GITHUB_PAT`). GitHub rejects that prefix. Use `AWS_DEPLOY_ROLE_ARN` for OIDC and `OPSLAKE_GITHUB_PAT` (or similar) for the GitHub API token, then sync the PAT into Secrets Manager from populate-lake.
No AI on Low Impact Just Because Easy	`no-ai-on-low-impact-just-because-easy`	1
No EMR or Persistent Clusters for Ingestion	`no-emr-or-persistent-clusters-for-ingestion`	4	Read the 'No EMR or Persistent Clusters for Ingestion' rule from playbook 'Delivery Constraint & Opportunity Analysis'. Slug: no-emr-or-persistent-clusters-for-ingestion. always_apply: true. Keep the ingestion path serverless and simple: CDK-modeled Lambda functions (and a CDK-modeled Kinesis Firehose delivery stream for streams) only. Do not stand up EMR or any persistent cluster to get operational data from GitLab/GitHub/Jira into the lake — that complexity belongs, if ever, to the broader analytics portfolio, not to basic ingestion.
No Huginn MCP Yet — Treat as Manual	`no-huginn-mcp-yet-treat-as-manual`	1	Read the 'No Huginn MCP Yet — Treat as Manual' rule from playbook 'Delivery Constraint & Opportunity Analysis'. Slug: no-huginn-mcp-yet-treat-as-manual. always_apply: true. There is no MCP connector for Huginn today. Configure Huginn Agents through browser automation against its web UI (check the ../huginn repo for existing agent/scenario definitions first), and flag this as a candidate for a future MCP connector rather than trying to script around the gap.
Parquet Over Raw Formats	`parquet-over-raw-formats`	1	Read the 'Parquet Over Raw Formats' rule from playbook 'Delivery Constraint & Opportunity Analysis'. Slug: parquet-over-raw-formats. always_apply: true. Transform raw JSON/CSV into Apache Parquet before it's queried at scale. AWS's benchmark: ~87% space savings, ~34x faster Athena queries, ~99.7% lower query cost versus CSV on the same 1 TB of log data. Raw format is fine for the landing zone; Parquet is required for anything queried repeatedly.
Partition by Source and Date at Minimum	`partition-by-source-and-date-at-minimum`	2	Read the 'Partition by Source and Date at Minimum' rule from playbook 'Delivery Constraint & Opportunity Analysis'. Slug: partition-by-source-and-date-at-minimum. always_apply: true. Every curated table is Hive-partitioned as `{table}/source={source}/dt={yyyy-mm-dd}/` so Athena and Glue crawlers prune scans. `{table}` is a Lake Scope Contract view name. Raw JSON uses prefix `{source}/{yyyy}/{mm}/{dd}/` in a separate bucket. Add finer partitions only if query patterns justify them.
Partition Keys Stay Out of Parquet Body	`partition-keys-out-of-parquet-body`	1	Read the 'Partition Keys Stay Out of Parquet Body' rule from playbook 'Delivery Constraint & Opportunity Analysis'. Slug: partition-keys-out-of-parquet-body. always_apply: true. Hive partition keys (`source`, `dt`) live in the S3 path `{table}/source={source}/dt={yyyy-mm-dd}/`. Do not also write those columns into the Parquet body. Glue crawlers then see duplicate columns and cataloging fails. Template: `infra/lambdas/parquet_transform.py` `_normalize_row` omits `source`.
S3 Bucket Keys With SSE-KMS	`s3-bucket-keys-with-sse-kms`	2	Read the 'S3 Bucket Keys With SSE-KMS' rule from playbook 'Delivery Constraint & Opportunity Analysis'. Slug: s3-bucket-keys-with-sse-kms. always_apply: true. SSE-KMS on lake buckets (raw, curated, Athena results) must set `bucket_key_enabled=True` (S3 Bucket Keys). Without it, every PutObject is a KMS `GenerateDataKey` and every GetObject is a `Decrypt`. One-file-per-event Parquet plus Glue/Athena reads burned the 20k always-free KMS requests in a single backfill morning (opsdl, 2026-09-15). Template: `infra/ops_lake/ingestion_stack.py` `_make_bucket` / `_make_results_bucket`. Bucket Keys apply to new objects; existing objects keep per-object keys until overwritten. Do not attach a customer-managed `kms.Key` to buckets that also have S3→SQS notifications — CloudFormation hits `LakeKey -> RawBucket -> LakeKey`. Use `BucketEncryption.KMS_MANAGED` + Bucket Keys.
Streamlit Mart on ECS ALB Never App Runner	`streamlit-mart-ecs-alb-not-apprunner`	1	Read the 'Streamlit Mart on ECS ALB Never App Runner' rule from playbook 'Delivery Constraint & Opportunity Analysis'. Slug: streamlit-mart-ecs-alb-not-apprunner. always_apply: true. Host the Streamlit data mart on ECS Fargate behind an ALB (WebSocket-capable). Do not use AWS App Runner: it does not support Streamlit WebSockets (`/_stcore/stream` → 403, blank loading skeleton). Image platform `linux/amd64`. Dockerfile must COPY all `*.py`, `pages/`, and `data/`.
Touch Time Is Not Wait Time	`touch-time-is-not-wait-time`	1