GeneratedProductHost

Target

This page describes intended behaviour or structure. No implementation is claimed unless a section is explicitly marked Current implementation or Evidence.

Bounded context	BC-30 Generated Product Domains
Platform / plane	Generated SaaS / Generated SaaS pack
Deployment granularity	standalone host
Status	target · ConnectSoft.Factory.Generated.Product
Built from	connectsoft-microservice · libraries: connectsoft-extensions-saas-abstractions, connectsoft-extensions-saas-asp-net-core, connectsoft-extensions-messaging-model, connectsoft-extensions-persistence-model-nhibernate, connectsoft-extensions-observability, connectsoft-extensions-diagnostics-health-checks
Decisions	ADR-0004, ADR-0006, ADR-0012, ADR-0015
Traceability	FR-06 FR-07 FR-09 FUX-05 NFR-06 NFR-14 NFR-17 XL-07 XL-10 XL-14

Purpose and responsibilities

GeneratedProductHost is not a Factory service: it is the shape every generated product has, modelled once so the Factory's other platforms can design against it. A product is one or more domain microservices on the BaseTemplate project shape (EntityModel … InfrastructureModel), one per bounded context of its Service Blueprint, generated from a recipe, delivered as a release, promoted into environments and, under decision D33, operated by ConnectSoft. What the Factory needs from every product is the same: a product descriptor (identity, release, provenance to Published blueprint and template releases, tenancy mode, contexts, health and admin endpoints, objectives) exposed through the product's gateway (GW-07), health the fleet probes, and — for managed products — a managed-operations handover record the owner acknowledges before fleet onboarding, plus export and delete admin operations that governance orders invoke during off-boarding.

Context and boundaries

flowchart LR
    S["GeneratedProductHost"]
    FleetInventoryService["FleetInventoryService"] -->|sync-http| S
    FleetIncidentService["FleetIncidentService"] -->|sync-http| S
    S -->|sync-http| ext_identity_platform["ext-identity-platform"]
    S -->|grpc| GeneratedSaasFoundations["GeneratedSaasFoundations"]
    S -->|sync-http| ext_otel_backend["ext-otel-backend"]
    S -. "ProductDescriptorPublished" .-> E_ProductDescriptorPublished(("event"))
    S -. "OperationsHandoverAcknowledged" .-> E_OperationsHandoverAcknowledged(("event"))

Hold "Alt" / "Option" to enable pan & zoom

The Factory reads a product only through GW-07 and the product's own authorization; it never reaches into a product's stores. Customer identity lives in the product (canonical ADR-0101 through the Authorization Server); the Factory sees an opaque customer-tenant id. A product's own domain events stay inside the product; only descriptor and operations events cross to the Factory.

Domain model

ProductDescriptor — What every generated product exposes about itself through its admin API: product and release identity, the generating blueprint and template versions (provenance), tenancy mode, editions in use, health endpoints, admin endpoints, and the objectives it commits to. (catalog entry)

Field	Type	Required	Description
productId	string	yes
tenantId	string	yes	The Factory tenant that owns the product.
releaseId	guid	yes
generatedBy	json	yes	blueprint versions, template versions, recipe version, agent releases
tenancyMode	enum:TenancyMode	yes
operationsMode	enum:OperationsMode	yes
contexts	list:string	yes	Bounded contexts of the product.
gatewayRef	string	yes	GW-07 endpoint.
healthEndpoints	json	yes
adminEndpoints	json	yes
objectives	json	yes

Invariants:

• The descriptor is generated from the recipe and the product's own model; it is read by the fleet (through GW-07), never written by the Factory.
• Provenance names Published blueprint and template releases; a product cannot claim a release that was never Published.

Events: ProductDescriptorPublished · Tables: ProductDescriptors · Repository: ProductDescriptorRepository

ManagedOperationsHandover — The record a product carries when ConnectSoft operates it (D33): the managed edition, objectives and response targets, runbook references, escalation contacts, maintenance windows, data-handover and off-boarding terms, and the acknowledgement of the product owner. (catalog entry)

Field	Type	Required	Description
handoverId	guid	yes
tenantId	string	yes
productId	string	yes
managedEdition	string	yes
objectives	json	yes
runbookRefs	list:string	yes
contacts	json	yes
maintenanceWindows	json	no
offboardingTerms	json	yes
acknowledgedBy	string	no
acknowledgedAt	datetime	no

Invariants:

• A product is operated only after the owner acknowledged the handover; the fleet inventory onboards it from this record.
• Objectives never fall below the edition floor (D33).

Events: OperationsHandoverAcknowledged · Tables: OperationsHandovers · Repository: ManagedOperationsHandoverRepository

erDiagram
    ProductDescriptor {
        string productId PK
        string tenantId
        guid releaseId
        json generatedBy
        enum_TenancyMode tenancyMode
        enum_OperationsMode operationsMode
        list_string contexts
        string gatewayRef
        json healthEndpoints
        json adminEndpoints
        json objectives
    }
    ManagedOperationsHandover {
        guid handoverId PK
        string tenantId
        string productId
        string managedEdition
        json objectives
        list_string runbookRefs
        json contacts
        json maintenanceWindows
        json offboardingTerms
        string acknowledgedBy
        datetime acknowledgedAt
    }

Hold "Alt" / "Option" to enable pan & zoom

Entities and value objects

None modelled

No entities or value objects are modelled for this item yet.

Data model and storage

Store	Role	Engine / profile	Tables
Generated product store (representative)	primary	azure-sql / nhibernate-sqlserver	ProductDescriptors, OperationsHandovers

Table	Owner	Columns	Indexes
dbo.ProductDescriptors	ProductDescriptor	11	0
dbo.OperationsHandovers	ManagedOperationsHandover	11	0

Full DDL: appendix.

APIs

Method	Path	Operation	Scope	Side effects	Idempotency	Gateway	Summary
GET	/product/descriptor	GetProductDescriptor	product.admin.read	read	natural	GW-07	The product descriptor (identity, provenance, tenancy mode, contexts, health and admin endpoints, objectives); read by fleet inventory through GW-07.
GET	/product/health	ProductHealth	product.health.read	read	natural	GW-07	Liveness, readiness and dependency health of the product's services.
GET	/product/operations/handover	GetOperationsHandover	product.admin.read	read	natural	GW-07	The managed-operations handover record.
POST	/product/operations/handover/acknowledge	AcknowledgeOperationsHandover	product.admin.write	shared-write	natural	GW-07	The product owner acknowledges the handover; fleet onboarding may proceed.
POST	/product/operations/export	ExportProductData	product.admin.write	external	key-header	GW-07	Export a customer tenant's data in open formats (invoked by an off-boarding order).
POST	/product/operations/delete-tenant	DeleteProductTenant	product.admin.write	production	key-header	GW-07	Delete a customer tenant's data (invoked by a deletion order after an acknowledged handover; production class).

None modelled

No gRPC methods are modelled for this item yet.

Messages

Event	Topic	Scope / v	Aggregate	Consumers	Summary
ProductDescriptorPublished	product-domains.descriptor.v1.product-descriptor-published	integration / 1	ProductDescriptor	FleetInventoryService, StudioBff, AuditService	The product (re)published its descriptor after a deployment.
OperationsHandoverAcknowledged	product-domains.operations.v1.operations-handover-acknowledged	integration / 1	ManagedOperationsHandover	FleetInventoryService, FactoryCommercialService, AuditService, StudioBff	The owner acknowledged the managed-operations handover.

ProductDescriptorPublished payload:

Field	Type	Required	Description
productId	string	yes
tenantId	string	yes
releaseId	guid	yes
tenancyMode	enum:TenancyMode	yes
operationsMode	enum:OperationsMode	yes

OperationsHandoverAcknowledged payload:

Field	Type	Required	Description
handoverId	guid	yes
tenantId	string	yes
productId	string	yes
managedEdition	string	yes

Command	Handled by	Result events	Summary
AcknowledgeOperationsHandover	ManagedOperationsHandover	OperationsHandoverAcknowledged
ExportProductData	ProductDescriptor	—
DeleteProductTenant	ProductDescriptor	—

None modelled

No consumed events are modelled for this item yet.

Workers and jobs

Worker	Trigger	Output events	Retry	Idempotency key	Summary
DescriptorPublisher	manual on start-up and after deployment	ProductDescriptorPublished	exponential	productId + releaseId	Publishes the descriptor at start-up and after every deployment so the fleet sees the running release and provenance.

Actors and grains

None modelled

No grains are modelled for this item yet.

Sagas and long-running flows

None modelled

No sagas are modelled for this item yet.

flowchart LR
    REC[Approved recipe · BC-15] --> GEN[Generation run · agents]
    GEN --> REL[Product release · BC-24]
    REL --> PROMO[Promotion · BC-24] --> PROV[Provisioning · BC-25]
    PROV --> P["(Generated product · services per context · GW-07)"]
    P -- descriptor · health --> FLEET[FleetInventoryService]
    P -- handover acknowledged --> FLEET
    FLEET -- rollouts · incidents · off-boarding --> P

Hold "Alt" / "Option" to enable pan & zoom

Options and configuration

Section	Key	Type	Default	Reloadable	Secret	Summary
Product	ProductId	string	<generated>	no	no	Product identity from the recipe.
Product:Tenancy	Mode	string	RowFilter	no	no	ADR-0100 isolation mode from the Agentic SaaS Product Blueprint.
Product:Operations	Mode	string	SelfOperated	no	no	SelfOperated or ManagedByConnectSoft (D33).

Metrics and observability

Metric	Instrument	Unit	Dimensions	Summary
connectsoft.factory.product.health	gauge	1	productId, service	Health per product service (read by fleet probes).
connectsoft.factory.product.requests	counter	{request}	productId, context, outcome	Product traffic by context.

Security

Authentication	oauth2-jwt
Scopes	product.admin.read (Descriptor and handover (fleet operations, product owner).); product.admin.write (Acknowledge handover; export and delete on governance orders.); product.health.read (Health probes.)
Roles	ProductOwner, FleetOperator, Observer
Tenant isolation	per-request-claim
Data classification	confidential
Max side-effect class	production
Secrets	product-sql (key-vault, rotate 90 d)

Dependencies

Outbound

Target	Kind	Purpose	Failure mode	Required
ext-identity-platform	sync-http	The product's own identity through the Authorization Server (ADR-0101).	fail-fast	yes
GeneratedSaasFoundations	grpc	Product tenants, editions, entitlements and metering.	fail-fast	yes
ext-otel-backend	sync-http	Telemetry export with Factory attributes.	degrade	yes

Inbound

Target	Kind	Purpose	Failure mode	Required
FleetInventoryService	sync-http	Descriptor and health through GW-07.	—	yes
FleetIncidentService	sync-http	Export and delete on off-boarding orders.	—	yes

Failure and recovery

Scenario	Detection	Recovery	Data impact	RTO (min)
Foundations unavailable	dependency health	product refuses tenant-scoped requests; health reports Degraded; fleet alerts	none	30

NFR targets

Target	Class value (pilot-interactive)	Override
latency_p95_ms	2000	—
availability_pct	99.5	—
throughput_rps	50	—
rpo_minutes	15	—
rto_minutes	240	—
cost_class	low	—

Deployment

Granularity	standalone host
Topologies	saas-default, hybrid, on-prem
Runtime	aks; replicas 2–10
Ports	https 9000, grpc 9002, silo 13000, gateway 32000

Current implementation

DerechHaLev is the production proof of the shape: services on the BaseTemplate, the AuthServer and Identity services, Pulumi stacks, Azure Pipelines. It exposes no descriptor or handover record yet.

Later capabilities

Products created from imported SaaS descriptors (ADR-0025); product-side A2A agent cards for products that embed agents; embedded Studio widgets.

Decisions and traceability

Family	Ids
FR	FR-06, FR-07, FR-09
FUX	FUX-05
NFR	NFR-06, NFR-14, NFR-17
XL	XL-07, XL-10, XL-14

Related

• Generated SaaS overview · SaaS platform foundations · GeneratedSaasFoundations · FleetInventoryService · GenerationRecipeService

• Generated SaaS microservices · bounded contexts · APIs · events · data model

• Services catalog · Ownership map