F2T2EA: Enterprise Operational Cycle
Find what matters. Fix what's broken. Track what moves. Target what's next. Engage your stakeholders. Access everything from one place.
F2T2EA is the enterprise operational cycle that powers the xOps Sovereign AI Command Centre. It transforms a single operations manager's ability to govern multi-account Landing Zones across regulated industries.
The Cycle
Stage Progression
| Stage | Monthly Cost | Infrastructure | F2T2EA Scope | Validation |
|---|---|---|---|---|
| LOCAL ($0) | $0 | Docker Compose + K3D | Single-account dry-run, sample data | docker compose up |
| TEST (~$45) | ~$45/mo | K3s single-node | 3-account Landing Zone subset | /inventory:discover |
| SIT (~$120) | ~$120/mo | EKS dev cluster | Full org discovery (50+ accounts) | /inventory:lz-cross-validate |
| PROD (~$180) | ~$180/mo | EKS production | Full F2T2EA cycle with HITL gates | /xops:f2t2ea-cycle |
| PEAK (~$380) | ~$380/mo | Multi-region EKS | Multi-cloud (AWS + Azure) | Full 4-way cross-validation |
Phase Details
FIND (Discover)
Org-wide discovery across all accounts in a single API call.
| Tool | What It Discovers | Evidence |
|---|---|---|
| Resource Explorer AGGREGATOR | All resources (88 types) | find-inventory-*.json |
| Config Aggregator | Compliance posture | find-security-*.json |
| Cost Explorer | Per-account spend | find-cost-*.json |
| Security Hub | CRITICAL/HIGH findings | find-security-*.json |
Command: /inventory:lz-cross-validate
TARGET (Prioritize)
Score and rank remediation candidates using WSJF (Weighted Shortest Job First).
- Scream test scoring (S1-S5, 0-100 scale)
- Score >= 70 = decommission candidate
- WSJF = (Business Value + Time Criticality + Risk Reduction) / Job Size
FIX (Remediate)
Execute remediation with dry-run validation and human approval gates.
- Always --dry-run first (no mutations without approval)
- HITL approval required per action
- Rollback documented before execution
- Post-fix validation confirms savings
TRACK (Monitor)
Continuous monitoring of operational health.
- DORA 4 key metrics (deploy frequency, lead time, MTTR, change failure rate)
- Cost trends (month-over-month comparison)
- SLO compliance (availability, latency, error rate)
ENGAGE (Execute)
Generate persona-based reports and stakeholder communication.
| Persona | Focus | Output |
|---|---|---|
| CFO | Cost savings, budget variance | report-cfo-*.md |
| CTO | Infrastructure health, security posture | report-cto-*.md |
| CloudOps | Operations, pipeline health | report-cloudops-*.md |
| FinOps | Optimization, waste, coverage | report-finops-*.md |
Email: Max 15 lines, business language, specific action required.
ACCESS (Visualize)
Single-pane-of-glass operational dashboards.
| Dashboard | Port | Start |
|---|---|---|
| Vizro FinOps | 8050 | docker compose --profile dashboards up |
| JupyterLab | 8888 | docker compose up jupyter |
| MkDocs CLI Docs | 8001 | docker compose up mkdocs |
Command Integration by Phase
| Phase | Primary Commands | Agent | Evidence |
|---|---|---|---|
| FIND | /inventory:discover, /inventory:lz-cross-validate, /aws:security-posture | sre-engineer | find-*.json |
| TARGET | /finops:decommission-inventory, /aws:ec2-investigate, /aws:rds-investigate | cloud-architect | target-wsjf-*.json |
| FIX | /itsm:create-change, /itsm:create-cr, /aws:alb-decommission | sre-engineer | fix-plan-*.md |
| TRACK | /ceremony:standup, /metrics:update-dora, /finops:analyze | observability-engineer | track-dora-*.json |
| ENGAGE | /finops:aws-monthly, /finops:azure-monthly, /finops:report | finops-engineer | engage-report-*.md |
| ACCESS | /dashboards:generate, /dashboards:validate, /documentation:browse | fullstack-engineer | access-dashboards-*.json |
7 Integrated Components
| # | Component | Role |
|---|---|---|
| 1 | xOps | Orchestrator + RAG chatbot |
| 2 | runbooks | CLI execution engine (160+ commands) |
| 3 | runbooks docs | Knowledge base (MkDocs) |
| 4 | JupyterLab | Analysis workbench (184 notebooks) |
| 5 | Vizro | Interactive dashboards |
| 6 | Executive Summary | Persona-based HITL deliverables |
| 7 | Stakeholder communication |
ADLC Components
| Component Type | Used in F2T2EA | Purpose |
|---|---|---|
| Agents | sre-engineer, cloud-architect, finops-engineer, observability-engineer, python-engineer, fullstack-engineer | Phase-specific execution |
| Commands | 18 commands across 6 phases | Orchestration entry points |
| Hooks | enforce-coordination.sh, validate-bash.sh, detect-nato-violation.sh | Governance gates |
| Skills | finops/aws-monthly, inventory/org-wide-discovery, ceremonies/agent-scoring-pdca | Domain knowledge |
| MCPs | awslabs-cost-explorer, atlassian-tools (for ITSM), vizro-analytics (dashboards) | External tool connectivity |
| Rules | aws-profile-semantics.md, operational-efficiency.md, docker-first-enforcement.md | Behavioral guardrails |
Agent Team
| Agent | F2T2EA Role | Golden Path Phase | Talent Bench |
|---|---|---|---|
| sre-engineer | FIND inventory + FIX remediation | FIND, FIX | Profile |
| cloud-architect | TARGET scoring + architecture review | TARGET | Profile |
| finops-engineer | ENGAGE cost reports | ENGAGE | Profile |
| observability-engineer | TRACK DORA + monitoring | TRACK | Profile |
| python-engineer | CLI execution engine | All phases | Profile |
| fullstack-engineer | ACCESS dashboards | ACCESS | Profile |
| product-owner | Cycle prioritization | TARGET (WSJF) | Profile |
| security-compliance-engineer | Security posture assessment | FIND | Profile |
7 Skills Coverage
| Skill | F2T2EA Coverage | Implementation |
|---|---|---|
| S1 System Design | F2T2EA IS the system architecture (6-phase cycle, 7 components) | This golden path |
| S2 Tool Design | 18 commands with typed CLI inputs, MCP schema validation | Command integration table |
| S3 Retrieval | Config Aggregator (org-wide), Resource Explorer, Cost Explorer | FIND phase tools |
| S4 Reliability | Retry on AWS APIs, ` | |
| S5 Security | READONLY profiles, deny lists, HITL gates before FIX mutations | validate-bash.sh, Principle I |
| S6 Evaluation | DORA metrics, 4-way cross-validation, persona-based scoring | TRACK phase + PDCA |
| S7 Product | CxO persona reports (CFO/CTO/CloudOps/FinOps), email templates | ENGAGE phase outputs |
Cycle Triggers
F2T2EA cycles are initiated by three trigger types. Each trigger maps to an entry phase.
| Trigger | Entry Phase | Example |
|---|---|---|
| Scheduled (weekly) | FIND | task ceremony:standup → auto-runs FIND + TRACK |
| Event-driven | TARGET | AWS Health event → EC2 retirement notice → scream test |
| On-demand | Any | HITL runs /xops:f2t2ea-cycle --phase engage --persona cfo |
| Incident-driven | FIX | OPS ticket opened → FIX phase with change request |
| Cost spike alert | ENGAGE | Budget threshold breached → CFO report auto-generated |
Cycle frequency recommendation: Full cycle weekly; FIND + TRACK daily (read-only, cost-free).
Quick Start
# Run one full F2T2EA cycle
/xops:f2t2ea-cycle
# Run a single phase
/xops:f2t2ea-cycle --phase find
/xops:f2t2ea-cycle --phase target
/xops:f2t2ea-cycle --phase engage --persona cfo
# Inventory cross-validation only (FIND phase)
/inventory:lz-cross-validate
# Security posture only (FIND phase)
/aws:security-posture --severity critical
Evidence Directory
All F2T2EA artifacts are written to tmp/command-center/f2t2ea/ with date-stamped filenames:
tmp/command-center/f2t2ea/
find-inventory-YYYY-MM-DD.json
find-cost-YYYY-MM-DD.json
find-security-YYYY-MM-DD.json
target-wsjf-YYYY-MM-DD.json
fix-plan-YYYY-MM-DD.md
track-dora-YYYY-MM-DD.json
track-cost-trend-YYYY-MM-DD.json
engage-report-{persona}-YYYY-MM-DD.md
email.txt
access-dashboards-YYYY-MM-DD.json
Related Golden Paths
| Golden Path | Relationship to F2T2EA |
|---|---|
| FinOps Analytics Lifecycle | FIND cost discovery + ENGAGE reporting |
| ITSM Lifecycle | FIX change management + TRACK incident monitoring |
| CloudOps Infrastructure | FIX infrastructure remediation patterns |
| ADLC Governance | Governance hooks and rules across all phases |
| Security & Quality | FIND security posture assessment |
| Stage Progression Overview | LOCAL→TEST→SIT→PROD cost model |
HITL Governance Gates
Each F2T2EA phase has defined HITL checkpoints. Agents operate autonomously within the boundary; mutations require HITL approval.
| Phase | Autonomous (Agent) | HITL Required |
|---|---|---|
| FIND | READONLY queries (describe-*, list-*, get-*), Config Aggregator, Resource Explorer | None — discovery is read-only |
| TARGET | WSJF scoring, scream test evaluation, decommission candidate ranking | Approval of final decommission shortlist |
| FIX | --dry-run validation, rollback plan generation, change request drafting | All mutation operations (terminate-*, delete-*, stop-*) |
| TRACK | DORA metric collection, cost trend calculation, SLO status read | None — monitoring is read-only |
| ENGAGE | Report generation, email drafting, Confluence page updates | Send email to external stakeholders |
| ACCESS | Dashboard generation, validation screenshots | None — dashboard creation is non-destructive |
Authority reference: principle-i-acceptable-agency.md — Agents prepare. Humans decide. Humans commit.
Anti-Patterns to Avoid
Lessons learned embedded in the F2T2EA governance cycle.
| Anti-Pattern | Phase | Prevention |
|---|---|---|
NARROW_SEARCH_SCOPE | FIND | Use Resource Explorer AGGREGATOR (org-wide), not per-account describe-instances |
SINGLE_ACCOUNT_ASSUMPTION | FIND | Phase 0: Config Aggregator returns accountId for every resource before per-account queries |
CROSS_ACCOUNT_SILENT_ZERO | FIND, TARGET | 0 results from MANAGEMENT profile != clean; verify account matches resource's actual account |
EXISTENCE_WITHOUT_ACTIVITY | TARGET | Discovery alone does not prove active use; validate S3 last-modified, VPC flow logs, CloudWatch metrics |
REBOOT_FIRST_DECOMMISSION_SECOND | TARGET | Run scream test scoring (S1-S5) before any maintenance preparation; score >= 70 = decommission, not reboot |
TECHNICAL_WITHOUT_PROCESS | FIX | Every HITL action must include change management process (who approves, which form, which team) |
DRYRUN_OVER_READONLY | FIX | READONLY profiles are the safety mechanism; skip --dry-run when READONLY profiles exist |
EVIDENCE_NOT_DELIVERABLE | ENGAGE | JSON evidence in tmp/ is agent-consumable; CFO/CTO needs a CxO-readable Confluence page |
SAMPLE_DATA_IN_NOTEBOOKS | ACCESS | Notebooks must assert returncode==0; no fallback sample data when AWS CLI fails |
AWS_PROFILE_SEMANTIC_MISMATCH | All phases | BILLING→Cost Explorer only; MANAGEMENT→Organizations only; workload resources need per-account profiles |