Skip to content

C4 — deployment view

Target

This page describes intended behaviour or structure. No implementation is claimed unless a section is explicitly marked Current implementation or Evidence.

Rewritten 2026-10-09

The reference placement is the saas-default profile (ADR-0017, pilot class per ADR-0018). The other profiles are described on deployment profiles, which also carries the full C4 deployment diagram of the default profile.

C4Deployment
    title saas-default — deployment nodes (pilot class, single region)
    Deployment_Node(client, "User device", "Browser / terminal / IDE") {
        Container(studio, "Factory Studio", "Blazor")
        Container(ide, "CLI / VS Code", ".NET")
    }
    Deployment_Node(region, "Azure region (tenant-selectable)", "ADR-0019") {
        Deployment_Node(aks, "AKS", "2–6 replicas per host, pilot class") {
            Container(gw, "GW-01 / GW-02", "ApiGatewayTemplate")
            Container(cp, "ControlPlaneApi", ".NET 10")
            Container(rt, "AgentRuntimeWorker + GW-04", ".NET 10")
            Container(tl, "ToolExecutorHost GW-05 / IntegrationHost GW-06", ".NET 10")
            Container(kn, "KnowledgeHost", ".NET 10")
            Container(ops, "GovernanceHost / ObservabilityHost / DeliveryHost / RuntimeCloudHost / FleetOperationsHost", ".NET 10")
            Container(sb, "Sandbox pool", "microVM / containers")
        }
        Deployment_Node(svc, "Managed data services") {
            ContainerDb(sql, "Azure SQL", "RPO 15 min, TDE/CMK")
            ContainerDb(vec, "Vector index", "Qdrant / Azure AI Search")
            ContainerDb(blob, "Blob", "Artifacts; immutable audit")
            ContainerQueue(bus, "Messaging", "Orleans outbox/inbox or Azure Service Bus")
            ContainerDb(kv, "Key Vault", "Secrets")
            ContainerDb(otel, "Azure Monitor", "Traces 30 d, metrics 13 m")
        }
    }
    Deployment_Node(ext, "Outside the boundary") {
        Container(idp, "Identity Platform", "AuthServer + Identity")
        Container(models, "Model deployments", "Approved providers")
        Container(scm, "Azure DevOps / GitHub", "")
    }
    Rel(studio, gw, "HTTPS")
    Rel(ide, gw, "HTTPS")
    Rel(gw, cp, "")
    Rel(gw, idp, "Token validation")
    Rel(cp, bus, "")
    Rel(bus, rt, "")
    Rel(rt, models, "GW-04")
    Rel(rt, tl, "")
    Rel(tl, sb, "")
    Rel(tl, scm, "Connectors")
    Rel(rt, kn, "")
    Rel(cp, sql, "")
    Rel(kn, vec, "")
    Rel(kn, blob, "")
    Rel(ops, kv, "")
    Rel(ops, otel, "")
    UpdateLayoutConfig($c4ShapeInRow="3", $c4BoundaryInRow="2")
Hold "Alt" / "Option" to enable pan & zoom

Profiles at a glance

Node saas-default hybrid on-prem hybrid-compute
Gateways and ControlPlaneApi ConnectSoft region ConnectSoft region Customer per base profile
AgentRuntimeWorker, ToolExecutorHost, sandboxes, connectors ConnectSoft region Customer environment Customer per base profile
Stores ConnectSoft region (tenant-isolated) Control stores at ConnectSoft; content stores at the customer Customer per base profile
Model deployments ConnectSoft-approved Customer policy Customer-approved Local pool for private profiles, cloud for others
Identity Platform ConnectSoft-operated ConnectSoft-operated Customer installation per base profile