Deployment · 18 of 19 · Fleet placement

Where it runs: dev gets the write path and the runs, upper gets none

This follows the cluster registry's dev and upper types. Bootstrap-tier mutations are already dev-only, and agent runs are the same shape, so a production cluster holds no agent credential and runs no agent.

Where it runs: dev gets the write path and the runs, upper gets none Deployment diagram with three zones: the dev cluster hosting the planned clearance service with its model proxy, a glidepath and broker pod with a planned agent-token route and agent-scope gate, and ArgoCD with Crossplane and a planned agentrun composition; GitHub with required checks; and the upper cluster with ArgoCD only and no agent write path. KIAC-DEV · TYPE: DEV · ARM64GITHUB.COMKIND-PROD · TYPE: UPPER · AMD64BROKERCLAIMHTTPS · CHECKSHTTPS · PRPULLPULL AFTER HUMAN MERGEPODglidepath · broker/agent-token routeplannedagent-scope gateplannedPODclearanceMCP + policy + auditplannedmodel proxyplannedPODargocd · crossplaneairframev0.3.90agentrun compositionplannedMANAGEDGitHub App + reposrequired checksexistingPODargocd-appsairframev0.3.90agent write pathnoneNo Clearance and no runs on upper clusters:agents reach them only as a PR that a human merges.LEGENDNew serviceExists todayCrosses a boundaryInside a clusterThe claim

Principle honored

Cluster-agnostic and generator-driven (ADR-0006). A cluster gets the feature by a toggle in cluster.yaml, and customize-cluster.sh refuses the invalid combination.

What changes

  • apron/cluster.yaml: components.autopilot, refused on type: upper like providerGithub and platformCicd. New types hub and inference for the model fleet.
  • New group apron/55-autopilot/, and provider-kubernetes grants for the kinds a run renders.
  • Registry ConfigMap gains autopilotReady, set only after the network-policy canary passes.

Verify live

kiac-dev's CNI does not enforce NetworkPolicy; kind-prod's Calico does. Do not set autopilotReady on a claim. Run a canary pod that must fail to reach a blocked service, and gate the flag on that result.

Hangar · Autopilot