Skip to content

Runtime Cloud — deployment

Target

This page describes intended behaviour or structure. No implementation is claimed unless a section is explicitly marked Current implementation or Evidence.

Rewritten 2026-10-09 (design plan P11)

The June-2026 page is archived under catalogs 2026-06.

Host Modules Topologies
RuntimeCloudHost 10 saas-default, hybrid, on-prem, hybrid-compute

Shape

flowchart TB
    subgraph host [RuntimeCloudHost · AKS · 2–6 replicas · runner identity]
        P[IaCProvisioningService]
        I[RuntimeEnvironmentService]
        C[ExecutionCapacityService · PoolGrain]
    end
    host --> SQL["(runtime-cloud-sql)"]
    host --> BLOB["(artifact-blob · plans, logs, state)"]
    P --> RUN[Pulumi runner · workload identity]
    RUN --> T["(targets · Azure subscriptions · clusters · on-prem)"]
    I -. observe .-> T
    C --> POOLS["(worker pools · agent runtime · sandbox · build · browser)"]
    host <--> CFG[Config Platform]
    host <--> SB[Secret Broker]
Hold "Alt" / "Option" to enable pan & zoom

Per topology

Topology Targets Runner Pools Notes
saas-default Factory-managed AKS and tenant environments in the tenant's region hosted in the Factory with workload identity shared pools per region; tenant-dedicated on stricter editions default
hybrid the customer's clusters through Pulumi with their credentials in their own vault hosted in the Factory; credentials referenced from the customer's vault customer-hosted pools enrolled through an agent control stays in Azure
on-prem the customer's infrastructure runs inside the customer's network all pools customer-hosted receipts stay on-prem
hybrid-compute as saas-default as saas-default model-serving pools elsewhere (BC-41); execution pools as saas-default

Bootstrap

The Factory's own environments are provisioned by the same service from the Factory's own specifications, after an initial bootstrap stack (the host, its store and identity) applied by the ConnectSoft operations team from the repository. From then on the Factory is self-hosted.

Data and recovery

runtime-cloud-sql: RPO 15 min, RTO 4 h (D30). Desired state is in Git, observed state is re-read, leases expire; receipts restore from backup and the audit mirror. Retention: receipts for the environment's lifetime plus 7 years; drift 13 months; leases 90 days.

Ports and runtime

HTTPS 8130, gRPC 8132, silo 12130, gateway 31130 (messaging profile runtime-cloud). Secrets runtime-cloud-sql, iac-runner-identity (30-day rotation), messaging-transport.