Control Plane — Later capabilities¶
Target
This page describes intended behaviour or structure. No implementation is claimed unless a section is explicitly marked Current implementation or Evidence.
Nothing on this page is promised. Each item names the trigger that would make it the next design increment and the owner that would design it. Extension principles that stay valid from the former roadmap: additive, definition-driven, contract-first, tenant-isolated by construction, governed and observable.
Per service¶
| Service | Later capability | Trigger |
|---|---|---|
RunControlService |
Deterministic replay against a newer release (explicitly not promised by ADR-0014) | a tenant need with evidence, decided by a new ADR |
RunControlService |
Bulk approval decisions with per-item outcomes; run templates with pre-approved action classes | approval volume in the Studio inbox |
ProjectService |
Project templates per vertical; cross-project source sharing; organization groups from the Identity Platform | second vertical onboarded |
EnvironmentService |
Ephemeral preview environments per run; promotion chains; environment-scoped secrets through BC-40 | Runtime Cloud reconciliation in place |
AgentRegistryService |
Signed manifests verified at load; marketplace sharing with licence terms; SBOM export; automatic deprecation proposals | first partner-published asset |
AgentCardService |
Outbound A2A client; push notifications; card signing; public marketplace listing | first partner agent integration |
CostUsageService |
Predictive budget alerts and anomaly detection; per-step attribution; chargeback export; statement import per provider | reconciliation debt or finance request |
FactoryCommercialService |
Marketplace revenue share; reseller billing; managed-operations invoice lines from fleet operations | Marketplace or Fleet Operations platform live |
Platform-wide¶
| Candidate | Purpose | Owner |
|---|---|---|
| Workflow simulation (dry-run cost and duration) | Estimate a workflow definition against synthetic inputs | BC-38 with BC-05 |
| Policy simulation | Predict the impact of a policy change on recorded decisions | BC-18 |
| SLA/SLO monitoring per workflow with pre-emptive escalation | Operations | BC-21 |
| Data residency enforcement per tenant | Region constraints on placement | BC-33 under canonical ADR-0100 ResidencySilo mode |
| Reconciliation, policy drift, retention and integration health workers | Scheduled healers | respective owners |
| Bulk and admin APIs; webhook subscriptions over a filtered event stream; a read facade for dashboards | API surface growth | BC-29, BC-17 |
| Marketplace packs: workflow packs, policy bundles, edition templates, blueprint libraries, certified connectors | Distribution of qualified assets | BC-27 |
| Governance analyst, cost optimizer, release manager, capacity planner, dependency resolver and compliance auditor agents | New agent roles, registered like any other | Software Factory pack |
| Extraction of a module into its own host | Throughput, trust boundary, external gRPC consumer or region split | ownership map triggers |
Deferred questions¶
Q-22 (SaaS descriptor to generator interface) was decided on 2026-10-14 (ADR-0025: descriptors are imported into blueprints, generation is a run); it never blocked the Control Plane; WorkflowReplayService stays later in the registry so that the id is never reused for something else.