Skip to content

Runtime Cloud — workflows

Target

This page describes intended behaviour or structure. No implementation is claimed unless a section is explicitly marked Current implementation or Evidence.

Rewritten 2026-10-09 (design plan P11)

The June-2026 page is archived under catalogs 2026-06.

W1 — A promotion is provisioned

sequenceDiagram
    participant E as EnvironmentPromotionService
    participant P as IaCProvisioningService
    participant R as Pulumi runner
    participant I as RuntimeEnvironmentService
    E-)P: PromotionApproved (release, environment, strategy, approval)
    P->>P: SpecificationDeclared (program version, release, config and secret refs)
    P->>R: plan → plan receipt (adds, changes, deletes)
    Note over P: production: the promotion's approval covers the apply
    P->>R: apply → apply receipt (outputs, duration, result)
    P-)E: ProvisioningApplied
    P-)I: ProvisioningApplied → observe after apply, resolve findings
Hold "Alt" / "Option" to enable pan & zoom

W2 — A new environment gets its baseline

EnvironmentCreated (Control plane) plans the environment-baseline specification (network, cluster namespace or resource group, observability wiring, data stores through StoreProfileService bindings); outside production it applies after a policy allow; in production it waits for an approval. The environment turns Ready in Control when ProvisioningApplied arrives and the first observation is healthy.

W3 — Reconciliation finds drift and proposes a fix

flowchart LR
    S[GitOpsReconciler every 4 h · re-plan declared state] --> D{differences?}
    D -- none --> OK[no action]
    D -- non-destructive, not production, policy allows --> A[apply · receipt]
    D -- destructive or production --> PR[ReconciliationProposed]
    O[Observer every 5 min] --> C[DriftComparer]
    C -- findings --> PR
    PR --> OP[Operator: accept or reject]
    OP -- accept --> P[provisioning run planned]
Hold "Alt" / "Option" to enable pan & zoom

W4 — An Operator accepts a destructive proposal in production

The proposal shows the findings, the plan summary with deletes highlighted, and the direction (apply declared or adopt observed). Acceptance is a production-class action; the planned run waits for an approval decided by someone other than the accepting Operator when policy requires quorum; the apply receipt and the resolved findings are evidence.

W5 — An attempt acquires capacity

sequenceDiagram
    participant RC as RunControlService
    participant W as AgentRuntimeWorker
    participant C as ExecutionCapacityService
    RC-)W: AttemptDispatched (attempt lease)
    W->>C: AcquireLease (attempt, cpu, memory)
    alt granted
        C-->>W: capacity lease (pool, expiresAt)
        W->>W: execute, renew every 60 s
        W->>C: ReleaseLease
    else denied by quota
        C-)RC: QuotaExceeded (limit named)
        Note over RC: the run shows "waiting for capacity: concurrentRuns 5/5" (FUX-08)
    end
Hold "Alt" / "Option" to enable pan & zoom

W6 — Recovery

Desired state is in Git; observed state is re-read; leases expire within their TTL and are re-granted; receipts are restored from backup (RPO 15 min) and the audit mirror. Nothing in this platform's store is the only copy of infrastructure truth.