Internal Developer Platform  ·  View 13 of 21  ·  Runtime

Critical Flow — Golden Path to First Deploy

Eighteen messages from choosing a path to a running workload, including the one that must never surprise anyone.

Editable source SVG draw.io All views
Product Engineer Platform API Scaffolder Team Repository Shared Pipeline Policy Evaluator Reconciler AKS Runtime 1. choose a golden path 2. scaffold component 3. repo · intent · pipeline ref 4. catalog descriptor 5. repo url · next step 6. push event 7. build · sign · attest 8. advisory evaluation 9. verdict ≤ 90 s 10. pin image digest in intent 11. intent changed 12. apply desired state 13. admission check 14. deny — no owner label 15. admit ≤ 250 ms p99 16. converged 17. deploy fact 18. running · component page Critical Flow — From Golden Path to First Production Deploy Message 14 is the failure that must never be a surprise: the same policy source produced message 9, so an advisory pass followed by an admission deny is a platform defect, not a normal outcome. v 1.0 · owner Platform Architecture · date 2026-09

The message that matters

  • Message 14 — an admission deny — is drawn on the same page as message 9, the advisory pass. Both come from one policy source, so a pass followed by a deny is a platform defect, tracked as a metric in view 18 (ADR-06).
  • The reconciler, not the pipeline, applies to the runtime. The pipeline's last act is to pin a digest into intent (ADR-02).
  • The platform API learns of the deploy from the reconciler, not from the pipeline, because the runtime is what actually happened.

Targets

  • Advisory verdict ≤ 90 s p95; admission evaluation ≤ 250 ms p99, since it is in the path of every workload admission (stated assumptions).
  • Reconciliation lag from intent to converged state ≤ 5 min p95.

Risks

  • Eight lifelines is the practical ceiling for a readable sequence; the registry, Key Vault and Entra are folded into the lifelines that call them.
  • A slow admission webhook becomes a fleet-wide deploy outage, which is why the bundle is local and the webhook is replicated (ADR-06).
◀  Core Data Model All views Self-Service Provisioning  ▶
Solution Architecture v1.0 · Microsoft Azure · Platform Architecture · 2026-09 · 21 views · 16 architecture decision records13-scaffold-to-first-deploy