Skip to content

Deployment profiles

Decision

This page records a decision and its status. A Proposed decision is not binding; an Accepted decision is binding on the Factory until amended or superseded.

Decided on 2026-10-09 (ADR-0017; D29): ConnectSoft-managed SaaS is the default profile. Hybrid, on-premises and hybrid compute are designed with the same contracts and documented as supported profiles, not defaults. A service declares which profiles it supports in its model entry (deployment.topologies); the topologies catalog counts them.

The four profiles

Profile Control plane Runtime workers and tools Data Model deployments Who operates
saas-default ConnectSoft, Azure, tenant-selectable region (D31) ConnectSoft ConnectSoft, tenant-isolated per canonical ADR-0100 ConnectSoft-approved deployments ConnectSoft
hybrid ConnectSoft Customer environment (workers, sandboxes, tools, source access) Customer data stays in the customer environment; control-plane state at ConnectSoft Customer policy (local or cloud) Shared: ConnectSoft for control plane, customer for runtime
on-prem Customer environment Customer environment Customer environment Customer-approved Customer, with ConnectSoft releases and runbooks
hybrid-compute Any of the above Any of the above Any of the above Local models for sensitive workloads, cloud models for the rest, selected by profile and policy As the base profile

Placement per profile

C4Deployment
    title saas-default — reference placement (pilot class, single region)
    Deployment_Node(user, "User device") {
        Container(studio, "Factory Studio", "Blazor", "Scoped shell, modules")
        Container(cli, "CLI / VS Code", ".NET", "Same APIs as the Studio")
    }
    Deployment_Node(az, "Azure region (tenant-selectable; default West Europe)") {
        Deployment_Node(aks, "AKS cluster") {
            Container(gw, "Edge gateway GW-01 / BFF GW-02", "ApiGatewayTemplate", "Token validation, routing, composition")
            Container(cp, "ControlPlaneApi", ".NET 10", "Projects, publication, run control, approvals, usage, tenancy, commerce modules")
            Container(rt, "AgentRuntimeWorker", ".NET 10", "Attempt execution, workflow engine, release loading; model gateway in-process (GW-04)")
            Container(tools, "ToolExecutorHost", ".NET 10", "Governed tool executor GW-05, MCP hosting")
            Container(kn, "KnowledgeHost", ".NET 10", "Ingestion, retrieval, artifacts, context, memory")
            Container(gov, "GovernanceHost / ObservabilityHost", ".NET 10", "Policy, audit, secret broker; projections, evaluation, FinOps")
            Container(sb, "Sandbox pool", "microVM / container", "Per-run workspaces, egress policy")
        }
        Deployment_Node(data, "Data services") {
            ContainerDb(sql, "Azure SQL", "Control, runtime, knowledge, governance, observability stores")
            ContainerDb(vec, "Vector index", "Qdrant (self-hosted profile) or Azure AI Search")
            ContainerDb(blob, "Blob storage", "Artifacts, immutable audit")
            ContainerDb(bus, "Messaging transport", "Orleans outbox/inbox, Azure Service Bus or NServiceBus profile")
            ContainerDb(kv, "Key Vault", "Secrets behind the secret broker")
        }
    }
    Deployment_Node(ext, "Outside the Factory boundary") {
        Container(idp, "Identity Platform", "AuthServer + Identity", "Sole token issuer")
        Container(models, "Model deployments", "OpenAI, Azure OpenAI, Azure AI Inference, Ollama, Anthropic", "Behind GW-04")
        Container(scm, "Azure DevOps / GitHub", "", "Sources, PRs, pipelines")
    }
    Rel(studio, gw, "HTTPS")
    Rel(gw, cp, "REST / gRPC")
    Rel(cp, rt, "Dispatch and receipts via messaging")
    Rel(rt, tools, "gRPC")
    Rel(rt, kn, "gRPC")
    Rel(rt, models, "HTTPS via GW-04")
    Rel(tools, sb, "Job broker")
    Rel(cp, sql, "NHibernate")
Hold "Alt" / "Option" to enable pan & zoom

In hybrid, the AgentRuntimeWorker, ToolExecutorHost, sandbox pool and the customer's source and tool connections move into the customer environment and reach the control plane through authenticated gRPC over a private link; control-plane stores stay at ConnectSoft and never hold customer source content. In on-prem, every node above runs in the customer environment; the Identity Platform is the customer's installation of the same templates. Hybrid compute changes only the model deployment node: a local inference pool (Ollama or a self-hosted server) is reachable by the model gateway and selected through pii-local and other private profiles.

What is identical in every profile

  • Contracts: the run submission, snapshot, approval, tool invocation, model invocation, usage and artifact schemas (reference schemas); the ADR-0014 envelope; topic naming.
  • Trust: canonical ADR-0100 tenant resolution and ADR-0101 identity responsibilities; the seven Factory roles (ADR-0015); approval binding to exact versions (D21).
  • Authority: one writer per state (ownership map); projections never substitute for the authoritative store.
  • Observability: OpenTelemetry GenAI conventions; no raw prompt or output logging by default (D31).

What differs

Concern saas-default hybrid on-prem hybrid-compute
Residency and region Tenant-selectable Azure region Customer data in customer region; control state at ConnectSoft Customer Per base profile
Network Private endpoints inside the region Private link between control plane and runtime Customer network, egress allow-list Model egress restricted to local pool for private profiles
Secrets Key Vault via secret broker Customer vault for runtime secrets; ConnectSoft vault for control plane Customer vault Per base profile
Upgrades ConnectSoft rolling ConnectSoft control plane; customer-scheduled runtime Customer-scheduled with ConnectSoft releases Per base profile
Support and SLOs ConnectSoft SLOs (D30) Shared responsibility matrix per contract Customer Per base profile