Skip to content

RuntimeCloudHost

Target

This page describes intended behaviour or structure. No implementation is claimed unless a section is explicitly marked Current implementation or Evidence.
Bounded context BC-25 Provisioning & Reconciliation
Platform / plane Runtime Cloud / Execution
Deployment granularity standalone host
Status target · ConnectSoft.Factory.RuntimeCloud
Built from connectsoft-microservice · libraries: connectsoft-extensions-saas-abstractions, connectsoft-extensions-saas-asp-net-core, connectsoft-extensions-messaging-model, connectsoft-extensions-messaging-model-orleans, connectsoft-extensions-persistence-model-nhibernate, connectsoft-extensions-observability, connectsoft-extensions-diagnostics-health-checks
Decisions ADR-0004, ADR-0012, ADR-0014, ADR-0017
Traceability FR-08 FR-09 FUX-05 NFR-06 NFR-08 NFR-09 XL-04 XL-10 XL-14

Purpose and responsibilities

RuntimeCloudHost composes IaCProvisioningService (desired state in Git, plan and apply receipts from the Pulumi runner, reconciliation), RuntimeEnvironmentService (what actually runs where, drift, reviewable reconciliation proposals) and ExecutionCapacityService (worker pools, quotas per edition, capacity leases for attempts, sandboxes, builds and browser sessions). It is the only host that holds a cloud identity able to change infrastructure, and it does so only through recorded provisioning runs.

The June-2026 catalog had seven runtime services and a separate GitOps service in the DevOps platform; the ownership map gave provisioning one owner (BC-25) and capacity another (BC-26), and that is the shape here.

Context and boundaries

flowchart LR
    S["RuntimeCloudHost"]
    DeliveryHost["DeliveryHost"] -->|event| S
    AgentRuntimeWorker["AgentRuntimeWorker"] -->|grpc| S
    ToolExecutorHost["ToolExecutorHost"] -->|grpc| S
    StudioBff["StudioBff"] -->|sync-http| S
    S -->|sync-http| ext_pulumi["ext-pulumi"]
    S -->|sync-http| ext_config_platform["ext-config-platform"]
    S -->|grpc| DeliveryHost["DeliveryHost"]
    S -->|grpc| ControlPlaneApi["ControlPlaneApi"]
    S -->|grpc| GovernanceHost["GovernanceHost"]
    S -->|grpc| KnowledgeHost["KnowledgeHost"]
    S -->|sync-http| ext_identity_platform["ext-identity-platform"]
Hold "Alt" / "Option" to enable pan & zoom

Promotions (BC-24) hand desired state to this host and receive ProvisioningApplied or ProvisioningFailed; runtime workers and the tool executor acquire capacity leases from it; the Studio reads inventory, drift, proposals and capacity. Configuration stays in the Config Platform and secrets in the Secret Broker, both referenced at apply time.

Domain model

None modelled

No aggregates are modelled for this item yet.

No entities modelled.

Entities and value objects

None modelled

No entities or value objects are modelled for this item yet.

Data model and storage

Store Role Engine / profile Tables
Runtime Cloud store primary azure-sql / nhibernate-sqlserver —

None modelled

No tables are modelled for this item yet.

APIs

Method Path Operation Scope Side effects Idempotency Gateway Summary
GET /runtime-cloud/health RuntimeCloudHealth factory.health.read read natural GW-01 Liveness, readiness and dependency health (runtime-cloud store, IaC runner, cluster API, Config Platform, inbox lag).
GET /runtime-cloud/meta/targets RuntimeCloudTargets factory.meta.read read natural GW-03 Provisioning targets configured per installation (Azure subscriptions, clusters, on-prem endpoints) and the IaC runner version.

None modelled

No gRPC methods are modelled for this item yet.

Messages

None modelled

No events are modelled for this item yet.

None modelled

No commands are modelled for this item yet.

None modelled

No consumed events are modelled for this item yet.

Workers and jobs

None modelled

No workers are modelled for this item yet.

Actors and grains

None modelled

No grains are modelled for this item yet.

Sagas and long-running flows

None modelled

No sagas are modelled for this item yet.

flowchart LR
    PROMO[EnvironmentPromotionService] -- PromotionApproved · desired state --> P[IaCProvisioningService]
    P -- plan · apply via Pulumi runner --> CLOUD["(Azure · clusters · on-prem targets)"]
    P -- ProvisioningApplied · Failed --> PROMO
    P -- SpecificationDeclared · Applied --> I[RuntimeEnvironmentService]
    CLOUD -. observe .-> I
    I -- RuntimeDriftDetected · ReconciliationProposed --> OP[Operator]
    OP -- accept --> P
    W[AgentRuntimeWorker · ToolExecutorHost] -- AcquireLease --> C[ExecutionCapacityService]
    C -- pool size changes --> P
Hold "Alt" / "Option" to enable pan & zoom

Options and configuration

Section Key Type Default Reloadable Secret Summary
RuntimeCloud:Host EnabledModules string[] [provisioning, inventory, capacity] no no Modules composed into this host.
RuntimeCloud:IaC Runner string pulumi no no IaC runner (Pulumi per ADR-0004); programs come from the repositories' InfrastructureModel projects.
OrleansMessaging ServiceName string runtime-cloud no no Messaging profile service name.

Metrics and observability

Metric Instrument Unit Dimensions Summary
connectsoft.factory.runtime_cloud.host.inbox_lag gauge s module Age of the oldest unprocessed event per module.

Security
Authentication client-credentials
Scopes factory.health.read (Health probes.); factory.meta.read (Target metadata.)
Roles Operator, PlatformAdmin, Observer
Tenant isolation row-filter
Data classification confidential
Max side-effect class production
Secrets runtime-cloud-sql (key-vault, rotate 90 d); iac-runner-identity (key-vault, rotate 30 d); messaging-transport (key-vault, rotate 90 d)

Dependencies

Outbound

Target Kind Purpose Failure mode Required
ext-pulumi sync-http Azure Resource Manager, AKS and the IaC runner's cloud credentials (workload identity). fail-fast yes
ext-config-platform sync-http Runtime configuration and feature flags of environments (canonical, by reference). degrade yes
DeliveryHost grpc Release resolution and promotion reports. fail-fast yes
ControlPlaneApi grpc Environments, approvals for production applies, quotas per edition. fail-fast yes
GovernanceHost grpc Deployment-domain policy; secret references; audit evidence of applies. fail-fast yes
KnowledgeHost grpc Plan and apply receipts, outputs and drift reports as artifacts. fail-fast yes
ext-identity-platform sync-http Workload identity. fail-fast yes

Inbound

Target Kind Purpose Failure mode Required
DeliveryHost event Promotion hand-offs and provisioning reports. — yes
AgentRuntimeWorker grpc Capacity leases for attempts. — yes
ToolExecutorHost grpc Sandbox capacity leases. — yes
StudioBff sync-http Provisioning, inventory, drift and capacity views. — yes

Failure and recovery

Scenario Detection Recovery Data impact RTO (min)
Cloud control plane unreachable runner and cluster API errors applies fail with receipts; promotions report ProvisioningFailed; observed state is marked stale, never assumed none 60
Runtime-cloud store lost readiness restore from backup (RPO 15 min); desired state is in Git, observed state is re-inventoried, leases expire and are re-granted none 240

NFR targets

Target Class value (pilot-batch) Override
latency_p95_ms 0 —
availability_pct 99.5 —
throughput_rps 10 —
rpo_minutes 15 —
rto_minutes 240 —
cost_class medium —

Deployment
Granularity standalone host
Topologies saas-default, hybrid, on-prem, hybrid-compute
Runtime aks; replicas 2–6
Ports https 8130, grpc 8132, silo 12130, gateway 31130

Current implementation

Pulumi programs exist in every template's InfrastructureModel project and in DerechHaLev's services (ADR-0004 evidence); AKS, docker-compose and kubernetes manifests ship with templates. No Factory provisioning service, receipt, inventory, drift detection, pool or quota exists.

Later capabilities

Multi-cluster and multi-region targets with per-tenant failover; customer-hosted pools enrolled through an agent; cost-aware placement across pools.

Decisions and traceability

Family Ids
FR FR-08, FR-09
FUX FUX-05
NFR NFR-06, NFR-08, NFR-09
XL XL-04, XL-10, XL-14