Skip to content

DevOps / GitOps — overview

Target

This page describes intended behaviour or structure. No implementation is claimed unless a section is explicitly marked Current implementation or Evidence.

Rewritten 2026-10-09 (design plan P10)

This page replaces the June-2026 overview, which designed repositories, branches, commits, pull requests, pipelines, packaging, infrastructure and GitOps synchronization as Factory services. The 2026 design keeps Azure DevOps or GitHub as the system of record, moves provisioning and GitOps reconciliation to the Runtime Cloud platform (BC-25), and makes this platform own receipts, releases and gates. The old page is archived under catalogs 2026-06.

The DevOps / GitOps platform is the bridge from a validated change set to a running environment, with every step evidenced. It does not replace the customer's source control and CI; it drives them through connectors, mirrors what they did with provenance, assembles releases from what they built, and decides — with policy and human approval — what runs where.
Platform PF-08 DevOps / GitOps (Execution)
Bounded contexts BC-23, BC-24
Services 13 (1 hosts, 5 modules, 7 external, 0 later) — 4 modelled
Gateways —
Status target

Purpose

  • The system of record stays the system of record. Repositories, branches, commits, pull requests and pipeline runs live in Azure DevOps or GitHub; the Factory acts through connectors with the shared-write class and keeps receipts (BC-23).
  • Provenance on every commit. Factory-authored commits carry the run id, change-set hash and agent release as trailers; proposals and runs mirror the system of record from verified deliveries.
  • Releases are immutable evidence. Version, merged commit, component digests, SBOM, attestations, pipeline run, merged proposals and generating asset releases; Released only with publication evidence for every component (BC-24).
  • Promotion is a gate, not a script. Pipeline results, policy, prior environment, readiness, evaluation evidence; a production-class approval bound to the exact release; desired state handed to provisioning; verification and rollback with evidence (D21, ADR-0015).
  • Agents deliver through tools. propose-change-set (shared-write) and deploy-environment (production) are the only ways an agent reaches this platform, so every delivery action has a tool receipt and class.

Bounded contexts and services

Context Owns Services (granularity)
BC-23 Source & Pipelines Change proposals, pipeline runs, typed results, provenance PipelineExecutionService (module; build results row merged); repository, branch, commit, pull-request rows external canonical
BC-24 Package & Release Delivery Product releases, components and publication evidence, promotions and rollbacks ReleaseService (module; container image row merged) · EnvironmentPromotionService (module); package and template publishing rows external canonical (existing CI)
Host Composition DeliveryHost (standalone)
Service Context Granularity Status
BranchService BC-23 external / canonical unmodelled
BuildResultService BC-23 module of host unmodelled
CommitService BC-23 external / canonical unmodelled
ContainerImageService BC-24 module of host unmodelled
DeliveryHost BC-23 standalone host target
EnvironmentPromotionService BC-24 module of host target
PackagePublisherService BC-24 external / canonical unmodelled
PackagePublishingService BC-24 external / canonical unmodelled
PipelineExecutionService BC-23 module of host target
PullRequestService BC-23 external / canonical unmodelled
ReleaseService BC-24 module of host target
RepositoryService BC-23 external / canonical unmodelled
TemplatePublishingService BC-24 external / canonical unmodelled

Context

flowchart LR
    subgraph P["DevOps / GitOps"]
        DeliveryHost["DeliveryHost"]
    end
    P --> IntegrationHost["IntegrationHost"]
    P --> KnowledgeHost["KnowledgeHost"]
    P --> ControlPlaneApi["ControlPlaneApi"]
    P --> GovernanceHost["GovernanceHost"]
    P --> ext_identity_platform["ext-identity-platform"]
    P --> PolicyEngineService["PolicyEngineService"]
    P --> RunControlService["RunControlService"]
    P --> IaCProvisioningService["IaCProvisioningService"]
    P --> SloService["SloService"]
    P --> ConnectorRegistryService["ConnectorRegistryService"]
    P --> ArtifactService["ArtifactService"]
    P --> ModelRouterService["ModelRouterService"]
Hold "Alt" / "Option" to enable pan & zoom

Containers

See microservices for the container view of hosts and modules.

What is where

Concern Owner This platform's part
Repositories, branches, pull requests, reviews Azure DevOps / GitHub proposal receipts with provenance
Pipeline definitions generated from the pipeline blueprint into the repository (Template & Library) typed results of runs
Package and image publication existing CI (ConnectSoft.AzurePipelines, Azure Artifacts, registries) publication evidence per component
Infrastructure and GitOps reconciliation Runtime Cloud (BC-25, Pulumi, ADR-0004) desired-state hand-off and verification
Environments Control plane (EnvironmentService) readiness gate and current-release tracking
Operating generated products after promotion Product Fleet Operations (P12) releases and promotions as the units it works with