Platform Architecture Diagrams
Five diagrams covering the platform's architecture, identity flow, onboarding pipeline, orchestration dispatch, and MCP server. Click any diagram to open it full-screen with zoom (scroll / +/− buttons) and pan (drag) — press Esc or click the backdrop to close.
The draw.io source for the original platform architecture diagram is also committed at docs/diagrams/platform-architecture.drawio for offline/local editing in draw.io.
Platform architecture — full estate
Automation (CI/CD, Key Vault reads) runs as service principals / managed identities per WAF/CAF — the personal user account is owner and break-glass access only, never the acting identity for pipelines.
Identity and secrets flow
Key Vault is the single source of truth. Pipelines authenticate as the SPN/workload identity and never see raw values; local tools are break-glass/dev only, not the automation path.
Onboarding — phase dependency and execution order
The six-phase onboarding pipeline that stands up identities, seeds secrets, and brings every repo into compliance. Tracked in the Onboarding Tracker.
Orchestration — Tier A dispatch flow
How a Claude Code (Tier A) dispatch resolves a task into validation waves and the non-overridable security-waf-caf gate. See the orchestration overview.
MCP server architecture
The HCS Governance MCP server exposes the platform's source of truth to any AI client on any machine. See the MCP server page.
Updating these diagrams
These diagrams are authored inline as Mermaid and render at build time — edit the fenced ```mermaid blocks in docs/diagrams/index.md directly. When the platform scope changes (new tenants, orgs, projects), update the affected diagram here and the platform-architecture.drawio source, per the documentation standard.