Skip to content

Control plane

Target

This page describes intended behaviour or structure. No implementation is claimed unless a section is explicitly marked Current implementation or Evidence.

The Control plane defines desired state and is the single authority for the state that makes a run trustworthy. The runtime executes an immutable snapshot derived from it; it never performs runtime work itself.

Responsibilities

Area Owns Proposed owner (packet BC)
Organization and scope Organization → tenant → business unit / team → workspace/project → environment hierarchy; memberships via the canonical Identity Platform; Factory scope hierarchy per ADR-0015 BC-01, inheriting BC-32/BC-33
Asset publication Immutable, versioned releases of agents, skills, tools/MCP servers, connectors, workflows and policies with full dependency closure, content hashes and source commits; Git remains the authoring authority (AgentKit); Studio and runtime consume releases BC-04
Model and compute catalog Model profiles, model endpoints, compute pool definitions, memory policies, secret references (definitions here; routing in Model & Compute) BC-07 administration
Run authority Run, step, attempt, lease, cancellation intent, approval request and decision; optimistic concurrency; transition + outbox in one transaction (ADR-0012, ADR-0014) BC-03
Budgets and usage Reservation before dispatch, observed and reconciled consumption, price revisions, quota denial; commercial entitlements come from SaaS foundations BC-05 (+ BC-33)
Policies Policy definitions are owned by Trust & Operations; the Control plane enforces the resulting decisions at every command BC-18 (consumer)
Desired state Deployments, evaluation suites, knowledge source and collection definitions, memory policies as declarations; execution elsewhere BC-01/BC-04

Invariants

  • The same client request with the same idempotency key returns the same run; the same key with different input conflicts.
  • Only one current lease/attempt may commit a step result; expired leases are reconciled before retry.
  • An approval binds actor, action, resource/input hash, release/snapshot version, policy revision and expiry; changed inputs require a new decision.
  • Cancellation records intent, requests interruption and keeps any completed external effect visible.
  • A mutable alias (such as latest) may select a release at submission and never changes an accepted run.

Proposed contracts (illustrative, not existing routes)

POST /factory/runs → 202 with run location · GET /factory/runs/{id} · POST /factory/runs/{id}/cancel · POST /factory/approvals/{id}/decision · POST /factory/asset-releases/validate and publish · events RunAccepted, AttemptDispatched, ApprovalRequested, ApprovalDecided, AttemptOutcomeRecorded, terminal outcomes, AssetReleasePublished, AssetReleaseRevoked. Field names reconcile with the Platform task/event schemas rather than creating a new dialect.

Current implementation

  • No control plane exists. There is no project, run, approval or release API in any repository.
  • No Factory asset source exists. AgentKit, Platform, Agents, OpenClaw and Workforce are earlier, non-Factory experiments (user decision D19, 2026-10-09); their registries and status vocabularies are reference input, not the Factory registry.
  • Run identity: AgentTraceContext and AgentEventEnvelope carry trace, blueprint, origin and workflow step only; no tenant, project, run, step or attempt (ADR-0014).
  • Tenancy foundations exist (ConnectSoft.Extensions.Saas.*, canonical ADR-0100) and are not bound into Factory execution.
  • ConnectSoft.ConfigPlatform.Documentation describes a configuration product; it is a proposal, not a control plane.

Existing pages that belong to this plane

Ownership conflicts resolved by the ownership map

Agent and skill registries appeared under both Control Plane and Agent Mesh: publication is owned here, loading and read models by the runtime. ApprovalService appeared under Control Plane and Governance: approval instances and decisions are owned here, approval policy by Trust & Operations. PolicyEngineService and AuditService rows move to Trust & Operations.

Later capabilities

Folded from the former Control Plane extension roadmap (no dates, no commitments). Extension principles that remain valid: additive not invasive; definition-driven (new workflows, agents, skills and policies are versioned data, not orchestrator code); contract-first; tenant-isolated by construction; governed and observable; reusable.

Candidate Purpose Owner today
Workflow simulation (dry-run cost/duration before execution) Estimate a workflow definition against synthetic inputs BC-03
Capacity planning and pre-warming Forecast worker demand from backlog BC-26 (Execution)
Policy simulation (what-if against recorded decisions) Predict impact of a policy change BC-18 (Trust & Operations)
Budget guard with predictive alerts; cost anomaly detection Soft/hard spend budgets per tenant and project BC-05
Blueprint recommender; change-impact analysis across the dependency graph Reuse and blast-radius advice BC-02 (Software Factory pack) / BC-01
SLA/SLO monitoring per workflow with pre-emptive escalation Operations BC-21
Data residency enforcement per tenant Region constraints on placement BC-33 under canonical ADR-0100 ResidencySilo mode
Workflow reconciliation, policy drift, retention enforcement, integration health workers Scheduled healers respective owners
Bulk/admin APIs, webhook subscriptions over a filtered event stream, a read facade for dashboards API surface growth BC-29 / BC-17
Marketplace packs: workflow definition packs, policy bundles, edition templates, blueprint libraries, certified connectors Distribution of qualified assets BC-27
Governance analyst, cost optimizer, release manager, capacity planner, dependency resolver and compliance auditor agents New agent roles registered like any other Software Factory pack

Extraction of any module into a separate service follows the triggers in the ownership map.

Open questions

Q-05 (owner of transitions, decisions, audit and cost records — Proposed here). R-01 closed by D19.

Modernization (2026-10-09, design plan M1)

Horizon now to next, per the technology radar: A2A task lifecycle mapped onto Run Control (ADR-0023); signed release manifests; workload identity per run. Exists in ConnectSoft today: No run control exists; the AI extensions and identity services exist. Each platform page of this plane states its horizon in its overview and later-capabilities pages.

Platforms in this plane

Platform Bounded contexts Services Modelled Pages
Control Plane (PF-01) BC-01, BC-03, BC-04, BC-05, BC-32, BC-33, BC-34 29 8 overview · services · APIs · events

Bounded contexts

Context Platform Authoritative state
BC-01 Project & Environment Control Plane Project, environment, module/dependency metadata, scope ids
BC-03 Run Control Control Plane Run, step, attempt, lease, approval instance and decision, cancellation, recovery journal
BC-04 Asset Publication Control Plane Immutable release manifests and dependency closure for agents, skills, tools, workflows, policies
BC-05 Usage Accounting Control Plane Usage facts, reservations, pricing revisions, reconciliation
BC-32 Shared Identity & Access Control Plane Canonical Identity Platform (ADR-0101) — inherited, not owned
BC-33 Factory Tenancy & Entitlements Control Plane Canonical multitenancy (ADR-0100) plus Factory scope, edition, quota
BC-34 Factory Commercial Control Plane Factory editions, subscriptions, billing and metering records (reuses the SaaS templates; D34)

Services

Service Platform Context Granularity Status Page
AgentCardService Control Plane BC-04 module of host target design
AgentRegistryService Control Plane BC-04 module of host target design
AgentTaskService Control Plane BC-03 module of host unmodelled —
ApiTokenService Control Plane BC-32 external / canonical unmodelled —
ApprovalService Control Plane BC-03 module of host unmodelled —
AuthorizationService Control Plane BC-32 external / canonical unmodelled —
ControlPlaneApi Control Plane BC-01 standalone host target design
CostTelemetryService Control Plane BC-05 module of host unmodelled —
CostUsageService Control Plane BC-05 module of host target design
DependencyService Control Plane BC-01 module of host unmodelled —
EditionService Control Plane BC-33 external / canonical unmodelled —
EnvironmentService Control Plane BC-01 module of host target design
FactoryCommercialService Control Plane BC-34 module of host target design
FeatureFlagService Control Plane BC-33 external / canonical unmodelled —
IdentityService Control Plane BC-32 external / canonical unmodelled —
ModuleCatalogService Control Plane BC-01 module of host unmodelled —
ProcessStateService Control Plane BC-03 module of host unmodelled —
ProjectService Control Plane BC-01 module of host target design
QuotaService Control Plane BC-05 module of host unmodelled —
ReviewCenterService Control Plane BC-03 module of host unmodelled —
ServiceIdentityService Control Plane BC-32 external / canonical unmodelled —
SkillRegistryService Control Plane BC-04 module of host unmodelled —
SubscriptionService Control Plane BC-33 external / canonical unmodelled —
TaskAssignmentService Control Plane BC-03 module of host unmodelled —
TenantService Control Plane BC-33 external / canonical unmodelled —
WorkflowDefinitionService Control Plane BC-04 module of host unmodelled —
RunControlService Control Plane BC-03 module of host target design
WorkflowOrchestrator Control Plane BC-03 module of host unmodelled —
WorkflowReplayService Control Plane BC-03 later stage unmodelled —

Events crossing the plane boundary

Direction Event Producer Consumer Topic
out AgentCardPublished AgentCardService StudioBff asset-publication.agent-cards.v1.agent-card-published
out AgentCardPublished AgentCardService MarketplaceCatalogService asset-publication.agent-cards.v1.agent-card-published
out AgentCardWithdrawn AgentCardService StudioBff asset-publication.agent-cards.v1.agent-card-withdrawn
out AgentCardWithdrawn AgentCardService MarketplaceCatalogService asset-publication.agent-cards.v1.agent-card-withdrawn
out AssetReleaseSubmitted AgentRegistryService QualityScoreService asset-publication.releases.v1.asset-release-submitted
out AssetReleaseSubmitted AgentRegistryService StudioBff asset-publication.releases.v1.asset-release-submitted
out AssetReleasePublished AgentRegistryService TemplateRegistryService asset-publication.releases.v1.asset-release-published
out AssetReleasePublished AgentRegistryService BlueprintService asset-publication.releases.v1.asset-release-published
out AssetReleasePublished AgentRegistryService FleetRolloutService asset-publication.releases.v1.asset-release-published
out AssetReleasePublished AgentRegistryService PolicyEngineService asset-publication.releases.v1.asset-release-published
out AssetReleasePublished AgentRegistryService McpServerRegistryService asset-publication.releases.v1.asset-release-published
out AssetReleasePublished AgentRegistryService ToolAdapterService asset-publication.releases.v1.asset-release-published
out AssetReleasePublished AgentRegistryService ModelRouterService asset-publication.releases.v1.asset-release-published
out AssetReleasePublished AgentRegistryService WorkflowEngineService asset-publication.releases.v1.asset-release-published
out AssetReleasePublished AgentRegistryService AgentRuntimeService asset-publication.releases.v1.asset-release-published
out AssetReleasePublished AgentRegistryService StudioBff asset-publication.releases.v1.asset-release-published
out AssetReleasePublished AgentRegistryService AuditService asset-publication.releases.v1.asset-release-published
out AssetReleasePublished AgentRegistryService MarketplaceCatalogService asset-publication.releases.v1.asset-release-published
out AssetReleaseDeprecated AgentRegistryService TemplateRegistryService asset-publication.releases.v1.asset-release-deprecated
out AssetReleaseDeprecated AgentRegistryService BlueprintService asset-publication.releases.v1.asset-release-deprecated
out AssetReleaseDeprecated AgentRegistryService MarketplaceCatalogService asset-publication.releases.v1.asset-release-deprecated
out AssetReleaseDeprecated AgentRegistryService ToolAdapterService asset-publication.releases.v1.asset-release-deprecated
out AssetReleaseDeprecated AgentRegistryService ModelRouterService asset-publication.releases.v1.asset-release-deprecated
out AssetReleaseDeprecated AgentRegistryService AgentRuntimeService asset-publication.releases.v1.asset-release-deprecated
out AssetReleaseDeprecated AgentRegistryService StudioBff asset-publication.releases.v1.asset-release-deprecated
out AssetReleaseRevoked AgentRegistryService MarketplaceCatalogService asset-publication.releases.v1.asset-release-revoked
out AssetReleaseRevoked AgentRegistryService PolicyEngineService asset-publication.releases.v1.asset-release-revoked
out AssetReleaseRevoked AgentRegistryService McpServerRegistryService asset-publication.releases.v1.asset-release-revoked
out AssetReleaseRevoked AgentRegistryService ToolAdapterService asset-publication.releases.v1.asset-release-revoked
out AssetReleaseRevoked AgentRegistryService ModelRouterService asset-publication.releases.v1.asset-release-revoked
out AssetReleaseRevoked AgentRegistryService AgentRuntimeService asset-publication.releases.v1.asset-release-revoked
out AssetReleaseRevoked AgentRegistryService AuditService asset-publication.releases.v1.asset-release-revoked
out BudgetReserved CostUsageService StudioBff usage-accounting.reservations.v1.budget-reserved
out BudgetReservationDenied CostUsageService StudioBff usage-accounting.reservations.v1.budget-reservation-denied
out ReservationSettled CostUsageService StudioBff usage-accounting.reservations.v1.reservation-settled
out ReservationSettled CostUsageService DashboardService usage-accounting.reservations.v1.reservation-settled
out UsageRecorded CostUsageService DashboardService usage-accounting.usage.v1.usage-recorded
out UsageReconciled CostUsageService DashboardService usage-accounting.usage.v1.usage-reconciled
out BudgetUpdated CostUsageService StudioBff usage-accounting.budgets.v1.budget-updated
out BudgetUpdated CostUsageService AuditService usage-accounting.budgets.v1.budget-updated
out EnvironmentCreated EnvironmentService IaCProvisioningService projects.environments.v1.environment-created
out EnvironmentCreated EnvironmentService RuntimeEnvironmentService projects.environments.v1.environment-created
out EnvironmentCreated EnvironmentService StudioBff projects.environments.v1.environment-created
out EnvironmentStateChanged EnvironmentService EnvironmentPromotionService projects.environments.v1.environment-state-changed
out EnvironmentStateChanged EnvironmentService ToolAdapterService projects.environments.v1.environment-state-changed
out EnvironmentStateChanged EnvironmentService StudioBff projects.environments.v1.environment-state-changed
out EnvironmentStateChanged EnvironmentService AuditService projects.environments.v1.environment-state-changed
out SubscriptionChanged FactoryCommercialService LicenseService factory-commercial.subscriptions.v1.subscription-changed
out SubscriptionChanged FactoryCommercialService FleetInventoryService factory-commercial.subscriptions.v1.subscription-changed
out SubscriptionChanged FactoryCommercialService StudioBff factory-commercial.subscriptions.v1.subscription-changed
out SubscriptionChanged FactoryCommercialService AuditService factory-commercial.subscriptions.v1.subscription-changed
out InvoiceIssued FactoryCommercialService StudioBff factory-commercial.invoices.v1.invoice-issued
out InvoiceIssued FactoryCommercialService StudioNotificationService factory-commercial.invoices.v1.invoice-issued
out ProjectCreated ProjectService StudioBff projects.projects.v1.project-created
out ProjectCreated ProjectService AuditService projects.projects.v1.project-created
out ProjectStateChanged ProjectService IntegrationService projects.projects.v1.project-state-changed
out ProjectStateChanged ProjectService ArtifactService projects.projects.v1.project-state-changed
out ProjectStateChanged ProjectService StudioBff projects.projects.v1.project-state-changed
out ProjectStateChanged ProjectService AuditService projects.projects.v1.project-state-changed
out ProjectStateChanged ProjectService KnowledgeIngestionService projects.projects.v1.project-state-changed
out MembershipChanged ProjectService ApprovalPolicyService projects.memberships.v1.membership-changed
out MembershipChanged ProjectService StudioBff projects.memberships.v1.membership-changed
out MembershipChanged ProjectService AuditService projects.memberships.v1.membership-changed
out DelegationChanged ProjectService ApprovalPolicyService projects.delegations.v1.delegation-changed
out DelegationChanged ProjectService StudioBff projects.delegations.v1.delegation-changed
out DelegationChanged ProjectService AuditService projects.delegations.v1.delegation-changed
out SourceScopeChanged ProjectService KnowledgeIngestionService projects.scope.v1.source-scope-changed
out RunAccepted RunControlService WorkflowEngineService run-control.runs.v1.run-accepted
out RunAccepted RunControlService StudioBff run-control.runs.v1.run-accepted
out RunAccepted RunControlService DashboardService run-control.runs.v1.run-accepted
out RunStateChanged RunControlService StudioBff run-control.runs.v1.run-state-changed
out RunStateChanged RunControlService DashboardService run-control.runs.v1.run-state-changed
out RunCompleted RunControlService GenerationRecipeService run-control.runs.v1.run-completed
out RunCompleted RunControlService FeedbackService run-control.runs.v1.run-completed
out RunCompleted RunControlService DashboardService run-control.runs.v1.run-completed
out RunCompleted RunControlService MemoryPromotionService run-control.runs.v1.run-completed
out RunCompleted RunControlService ArtifactService run-control.runs.v1.run-completed
out RunCompleted RunControlService StudioBff run-control.runs.v1.run-completed
out RunCompleted RunControlService QualityScoreService run-control.runs.v1.run-completed
out RunFailed RunControlService GenerationRecipeService run-control.runs.v1.run-failed
out RunFailed RunControlService StudioBff run-control.runs.v1.run-failed
out RunFailed RunControlService DashboardService run-control.runs.v1.run-failed
out RunCancelled RunControlService SecretBrokerService run-control.runs.v1.run-cancelled
out RunCancelled RunControlService WorkflowEngineService run-control.runs.v1.run-cancelled
out RunCancelled RunControlService AgentRuntimeService run-control.runs.v1.run-cancelled
out RunCancelled RunControlService StudioBff run-control.runs.v1.run-cancelled
out AttemptDispatched RunControlService AgentRuntimeService run-control.attempts.v1.attempt-dispatched
out AttemptDispatched RunControlService DashboardService run-control.attempts.v1.attempt-dispatched
out AttemptOutcomeRecorded RunControlService ExecutionCapacityService run-control.attempts.v1.attempt-outcome-recorded
out AttemptOutcomeRecorded RunControlService WorkflowEngineService run-control.attempts.v1.attempt-outcome-recorded
out AttemptOutcomeRecorded RunControlService QualityScoreService run-control.attempts.v1.attempt-outcome-recorded
out AttemptOutcomeRecorded RunControlService DashboardService run-control.attempts.v1.attempt-outcome-recorded
out LeaseExpired RunControlService SecretBrokerService run-control.leases.v1.lease-expired
out LeaseExpired RunControlService AgentRuntimeService run-control.leases.v1.lease-expired
out LeaseExpired RunControlService DashboardService run-control.leases.v1.lease-expired
out ApprovalRequested RunControlService StudioBff run-control.approvals.v1.approval-requested
out ApprovalRequested RunControlService StudioNotificationService run-control.approvals.v1.approval-requested
out ApprovalRequested RunControlService AuditService run-control.approvals.v1.approval-requested
out ApprovalDecided RunControlService LicenseService run-control.approvals.v1.approval-decided
out ApprovalDecided RunControlService MarketplaceCatalogService run-control.approvals.v1.approval-decided
out ApprovalDecided RunControlService FleetIncidentService run-control.approvals.v1.approval-decided
out ApprovalDecided RunControlService FleetRolloutService run-control.approvals.v1.approval-decided
out ApprovalDecided RunControlService IaCProvisioningService run-control.approvals.v1.approval-decided
out ApprovalDecided RunControlService EnvironmentPromotionService run-control.approvals.v1.approval-decided
out ApprovalDecided RunControlService QualityScoreService run-control.approvals.v1.approval-decided
out ApprovalDecided RunControlService MemoryPromotionService run-control.approvals.v1.approval-decided
out ApprovalDecided RunControlService WorkflowEngineService run-control.approvals.v1.approval-decided
out ApprovalDecided RunControlService AgentRuntimeService run-control.approvals.v1.approval-decided
out ApprovalDecided RunControlService StudioBff run-control.approvals.v1.approval-decided
out ApprovalDecided RunControlService AuditService run-control.approvals.v1.approval-decided
in StepReady WorkflowEngineService RunControlService workflows.runs.v1.step-ready
in WorkflowRunCompleted WorkflowEngineService RunControlService workflows.runs.v1.workflow-run-completed
in WorkflowRunFailed WorkflowEngineService RunControlService workflows.runs.v1.workflow-run-failed
in ModelInvoked ModelRouterService CostUsageService model-access.invocations.v1.model-invoked
in ToolInvoked ToolAdapterService CostUsageService tool-execution.invocations.v1.tool-invoked
in EntitlementGranted LicenseService FactoryCommercialService licensing.entitlements.v1.entitlement-granted
in EntitlementStateChanged LicenseService AgentRegistryService licensing.entitlements.v1.entitlement-state-changed
in ListingPublished MarketplaceCatalogService AgentCardService marketplace.listings.v1.listing-published
in ListingInstalled MarketplaceCatalogService AgentRegistryService marketplace.installations.v1.listing-installed
in ListingRemoved MarketplaceCatalogService AgentRegistryService marketplace.installations.v1.listing-removed
in PromotionCompleted EnvironmentPromotionService RunControlService releases.promotions.v1.promotion-completed
in PromotionCompleted EnvironmentPromotionService EnvironmentService releases.promotions.v1.promotion-completed
in PromotionFailed EnvironmentPromotionService RunControlService releases.promotions.v1.promotion-failed
in RollbackCompleted EnvironmentPromotionService EnvironmentService releases.promotions.v1.rollback-completed
in ChangeProposalOpened PipelineExecutionService RunControlService pipelines.proposals.v1.change-proposal-opened
in ChangeProposalStateChanged PipelineExecutionService RunControlService pipelines.proposals.v1.change-proposal-state-changed
in ChangeProposalMerged PipelineExecutionService RunControlService pipelines.proposals.v1.change-proposal-merged
in PipelineRunCompleted PipelineExecutionService RunControlService pipelines.runs.v1.pipeline-run-completed
in ProvisioningApplied IaCProvisioningService EnvironmentService provisioning.runs.v1.provisioning-applied
in QuotaChanged ExecutionCapacityService RunControlService capacity.quotas.v1.quota-changed
in QuotaExceeded ExecutionCapacityService RunControlService capacity.quotas.v1.quota-exceeded
in QuotaExceeded ExecutionCapacityService CostUsageService capacity.quotas.v1.quota-exceeded
in CapacityLeaseGranted ExecutionCapacityService CostUsageService capacity.leases.v1.capacity-lease-granted
in CapacityLeaseReleased ExecutionCapacityService CostUsageService capacity.leases.v1.capacity-lease-released
in ObservedStateChanged RuntimeEnvironmentService EnvironmentService provisioning.inventory.v1.observed-state-changed
in OffboardingRequested FleetIncidentService FactoryCommercialService fleet-operations.offboarding.v1.offboarding-requested
in OffboardingCompleted FleetIncidentService FactoryCommercialService fleet-operations.offboarding.v1.offboarding-completed
in ProductOnboarded FleetInventoryService FactoryCommercialService fleet-inventory.products.v1.product-onboarded
in RetentionRuleChanged RetentionResidencyService ControlPlaneApi data-foundations.retention.v1.retention-rule-changed
in DeletionOrderIssued RetentionResidencyService ControlPlaneApi data-foundations.orders.v1.deletion-order-issued
in DeletionOrderCompleted RetentionResidencyService FactoryCommercialService data-foundations.orders.v1.deletion-order-completed
in LegalHoldChanged RetentionResidencyService ControlPlaneApi data-foundations.orders.v1.legal-hold-changed
in PolicyRevisionActivated PolicyEngineService RunControlService policy.bundles.v1.policy-revision-activated
in LearningProposalDecided FeedbackService AgentRegistryService evaluation.learning.v1.learning-proposal-decided
in EvaluationCompleted QualityScoreService AgentRegistryService evaluation.runs.v1.evaluation-completed
in BlueprintValidated BlueprintService RunControlService blueprints.versions.v1.blueprint-validated
in BlueprintSubmitted BlueprintService AgentRegistryService blueprints.versions.v1.blueprint-submitted
in RecipeApproved GenerationRecipeService RunControlService generation.recipes.v1.recipe-approved
in OperationsHandoverAcknowledged GeneratedProductHost FactoryCommercialService product-domains.operations.v1.operations-handover-acknowledged

Gateways

Gateway Role Fronts
GW-03 Platform domain APIs One modular Control API at first; REST public, gRPC internal ControlPlaneApi

Model coverage

Count
Services in the registry 29
Modelled (YAML exists) 8
With a design page 8
Unmodelled 21