Platform boundaries · Deployment business cases
Dedicated deployments and shared infrastructure
Two business cases share one management contract: customer control through a dedicated environment, and quicker creation and trimming through retained parent infrastructure. Their evidence levels differ.
Platform boundaries · Deployment business cases
Dedicated deployments and shared infrastructure
Two business cases share one management contract: customer control through a dedicated environment, and quicker creation and trimming through retained parent infrastructure. Their evidence levels differ.
What this view establishes
The architectural commitments
- Dedicated deployment serves customer control; shared infrastructure serves efficient environment creation and trimming.
- Shared-pool isolation is observed both locally and hosted: one pg and one minio parent per deployment, a child's own database, role, bucket and policy, restart adoption and sibling preservation.
- Multi-tenant means isolated child resources on retained infrastructure by default, and since 2026-10-05 one deliberate exception: a shared data tier is a named database and bucket that admitted members attach to, so members of one tier share that database, its approval list, its identity table and its token table. Nothing else shares data, and a member owns no storage of its own.
- Browser-driven create, duplicate, restore, retire and abandon run behind the same session-derived admin authority, a bound single role store and a hard capacity cap of ten live environments; hosted acceptance was run against the live deployment.
Layered platform stack
Dedicated customer control
Dedicated environment
Separate application authority, database, object storage and credentials.
Development to production
Stage and domain identity stay separate from placement choice.
Hosted pilot proof
The first hosted three-client journey, 2026-09. Dedicated hosting has run as a live service since 2026-09-13.
Shared infrastructure efficiency
One management surface
Authorized admin view
Projects, environments, release identity, status and admitted actions.
Hosted shared-pool service
Live. Two shared parents per deployment, each child with its own database, role, bucket, user and policy, isolation asserted on every effect and every absence observed before a tombstone. Quotas exist as a route and have no console control.
Reclamation, not recovery
Recovery stays refused. Five reclamation verbs observe every provider reference and let an allocation go -- reclaim, reclaimFailedDelete, reclaimUnjournalledDelete, reclaimUnjournalledCreate, expireRetained -- and four are reachable from the console Abandon button.
Browser-driven lifecycle
Create, duplicate and retire an environment from the admin panel: an admission-gated owner bootstrap, a session-derived actor re-checked on every action, one bound role store, and a hard global capacity cap (default 10 live environments) enforced in plan and again inside create's transaction. Duplicate copies a source's release and domain pins plus its stage/region/recipe/retention configuration into a fresh isolated child -- never its data. Retire reuses the existing bounded delete/trim, confirmed by exact target and generation match. Recovery stays refused: nothing re-enters a failed dispatch. Hosted acceptance ran -- plan, create, duplicate, durable retire with capture, restore into a new environment and abandon have all been driven from the browser against the live deployment between 2026-09-26 and 2026-10-05.
Connections and evidence
Open the 12-relationship source key
Numbers set an explanatory reading order. They do not measure runtime timing.
Connections and evidence
Open the 12-relationship source key
- 01observed
Dedicated environment→Hosted pilot proof
hosted demonstration
- 02implemented
Development to production→Authorized admin view
project and stage identity
- 03implemented
Retained parent pool→Isolated child environments
reserve and provision
- 04observed
Isolated child environments→Trim one child
child-only cleanup
- 05implemented
Authorized admin view→Retained parent pool
manage local placement
- 06implemented
Authorized admin view→Dedicated environment
inspect registered state
- 07observed
Retained parent pool→Hosted shared-pool service
the live hosted path
- 08observed
Authorized admin view→Reclamation, not recovery
abandon reaches the reclamation verbs
- 09implemented
Authorized admin view→Browser-driven lifecycle
authorizes via session-derived actor
- 10implemented
Browser-driven lifecycle→Isolated child environments
create/duplicate provisions a fresh isolated child
- 11implemented
Browser-driven lifecycle→Trim one child
retire reuses the bounded delete/trim path
- 12observed
Browser-driven lifecycle→Hosted shared-pool service
hosted acceptance, run live
Connections and evidence
12 directed, source-backed relationships
Numbers set an explanatory reading order. They do not measure runtime timing.
- 01observed
Dedicated environment→Hosted pilot proof
hosted demonstration
- 02implemented
Development to production→Authorized admin view
project and stage identity
- 03implemented
Retained parent pool→Isolated child environments
reserve and provision
- 04observed
Isolated child environments→Trim one child
child-only cleanup
- 05implemented
Authorized admin view→Retained parent pool
manage local placement
- 06implemented
Authorized admin view→Dedicated environment
inspect registered state
- 07observed
Retained parent pool→Hosted shared-pool service
the live hosted path
- 08observed
Authorized admin view→Reclamation, not recovery
abandon reaches the reclamation verbs
- 09implemented
Authorized admin view→Browser-driven lifecycle
authorizes via session-derived actor
- 10implemented
Browser-driven lifecycle→Isolated child environments
create/duplicate provisions a fresh isolated child
- 11implemented
Browser-driven lifecycle→Trim one child
retire reuses the bounded delete/trim path
- 12observed
Browser-driven lifecycle→Hosted shared-pool service
hosted acceptance, run live
What this view establishes
The architectural commitments
- Dedicated deployment serves customer control; shared infrastructure serves efficient environment creation and trimming.
- Shared-pool isolation is observed both locally and hosted: one pg and one minio parent per deployment, a child's own database, role, bucket and policy, restart adoption and sibling preservation.
- Multi-tenant means isolated child resources on retained infrastructure by default, and since 2026-10-05 one deliberate exception: a shared data tier is a named database and bucket that admitted members attach to, so members of one tier share that database, its approval list, its identity table and its token table. Nothing else shares data, and a member owns no storage of its own.
- Browser-driven create, duplicate, restore, retire and abandon run behind the same session-derived admin authority, a bound single role store and a hard capacity cap of ten live environments; hosted acceptance was run against the live deployment.
Follow the live system
Move from explanation to inspection
The Atlas is static and source-backed. The Observatory shows authenticated environment state.
16 repository sources behind this view
docs/delegation/browser-driven-lifecycle-2026-09-12.mddocs/delegation/browser-driven-lifecycle-design-2026-09-12.mddocs/delegation/platform-groundwork-landing-2026-09-11.mddocs/platform-business-cases.mddocs/releases/evidence/records-v2-provider-readiness/hosted-three-client-receipt.jsondocs/releases/evidence/shared-provider-repairs/probe-receipt.jsonplatform/contracts/deployment-control-v1.jsonplatform/control-plane/control_plane.pyplatform/control-plane/field_notebook_shared_pool.pyplatform/control-plane/hosted_lifecycle_service.pyplatform/control-plane/records_v2_admin_lifecycle.pyplatform/control-plane/records_v2_admin_projection.pyplatform/control-plane/session_service.pyplatform/control-plane/shared_pool.pyplatform/control-plane/workspace_admission.pyplatform/deployment-console/src/app.js