Three namespaces with different blast radii: control, workers and platform. Network policy denies east-west traffic between workers, so a compromised handler cannot reach another tenant's worker or the control plane directly.
One worker deployment per task type rather than one generic worker. It costs four deployments instead of one and buys independent scaling bounds, independent resource limits, independent rollout, and a circuit breaker that isolates by type (view 21).
The Outbox Relay is a StatefulSet with four change-feed leases rather than a Deployment. Change feed processing is partitioned and stateful; pretending otherwise produces duplicate dispatch under rescale.
Sizing rationale
Orchestration at 6 to 24 pods is driven by completion-message throughput, not by execution count: at 900 tasks per second each pod handles roughly 40 completions per second including the Cosmos write.
Service Bus Premium at 4 messaging units is chosen for predictable throughput, VNet integration and the 100 MB message ceiling the claim-check pattern makes unnecessary but useful as headroom.
Cosmos autoscale at 40,000 RU/s covers peak with roughly 30% headroom. The RU driver is the transactional batch per state change, not reads.
Deliberate omissions
Node pools, subnets and zone placement are on view 22; this view is about what is deployed, not where.
Sidecars other than the OTel collector are omitted. Service mesh was evaluated and rejected for V1 as cost without a current requirement.
The operations console is a separate front-end deployment outside this cluster and is not shown.
