Platform Flows

Flow Diagrams

Block diagrams for every major platform flow — from lab provisioning to CI/CD deployment. Each flow maps to the architecture layers described in the documentation.

Process / Step
Decision
Start / End
HITL Gate (Human)
AI Agent
F1 / Lab Provisioning

Lab Provisioning Workflow

End-to-end flow from admin lab request through AI pipeline, 3 HITL gates, and participant delivery. Orchestrated by Temporal — crash-safe at every step.

Admin submits lab request lab-architect-agent NL → IaC template + scoring rubric (LangGraph + Claude API) HITL Gate 1 — Blueprint Review Admin reviews lab manifest, tasks, rubric · Temporal waits on signal Approved? No Rejected Archived Yes dataset-forge-agent Generates N unique synthetic datasets (Faker + Pandas) HITL Gate 2 — Procurement Review Admin approves subscription list + per-user cost provisioning-agent Terraform/Bicep → VMSS · Graph API → licenses · Entra ID users qa-validator-agent Dry-run: connectivity, subscriptions, dataset, network isolation QA Pass? No (retry) Yes HITL Gate 3 — Pre-Launch Admin reviews QA report + final cost · One click to go live Deliver credentials to participant Guacamole URL + temp UPN + password via notification-service Lab live · live-observer-agent starts
F2 / Authentication

User Authentication Flow

Covers both SSO (Google / Microsoft / GitHub) and email/password paths. JWT issued on success, stored in Redis with JTI for revocation.

User visits login page Login method? SSO Redirect to OAuth callback state validated in Redis auth-service upsert user record Email / Password Submit credentials Rate limited? No Verify password dummy bcrypt on unknown email 429 Valid? No 401 Error Yes Issue JWT pair access token (15min) + refresh (7d) store refresh JTI in Redis blocklist checked on every request Return tokens to client Set secure httpOnly cookie / localStorage Authenticated — redirect to dashboard
F3 / Lab Grading

Live Lab Grading Flow

Triggered on participant submission or time expiry. scoring-agent runs 5-dimension analysis. cross-validator-agent tests against reserve datasets to confirm genuine skill.

Submission received / time expired lab-service publishes to score queue RabbitMQ → scoring-agent picks up scoring-agent Runs grading scripts against live cloud resources 5-Dimension Scoring Correctness 40% Architecture 20% Efficiency 15% Robustness 15% Speed & Independence 10% cross-validator-agent Tests submission against 2–3 unseen reserve datasets Genuine skill? No (anomaly) Flag for review Yes Store score + AI commentary analytics-service · leaderboard update · certificate trigger Score published
F4 / Lab Destruction

Lab Destruction & Cleanup

Atomic teardown orchestrated by Temporal. Revokes licenses, deletes users, tears down infrastructure, logs final cost. Partial teardown is impossible by design.

Lab TTL expired / admin triggers destroy Temporal DestroyLabWorkflow starts All steps checkpointed — crash-safe Revoke licenses Graph API Remove M365 assignments Delete Entra ID users Graph API bulk delete Temp UPN cleaned up Clear Redis keys lab_status · session data Terraform destroy VMSS teardown Network interfaces deleted Storage cleanup Lab datasets deleted Temp blobs removed Update lab status DB gravitylabs_labs → DESTROYED Log final cost Compute + license duration × price Emit analytics event analytics-service billing record created Notify participants lab ended notification Lab fully destroyed · resources released
F5 / Event Launch

Event Launch Flow

Admin creates an event, participants enroll, labs are bulk-provisioned. All participants receive credentials simultaneously on event start.

Admin creates event in portal event-service: configure event Lab template · capacity · start time · TTL Participants enroll Registration link · SSO / email signup · seat limits enforced Admin confirms launch — HITL Final participant count · budget sign-off · go / no-go Bulk ProvisionLabWorkflow × N Temporal fans out one workflow per participant in parallel Credentials delivered simultaneously notification-service · email + in-app · Guacamole URLs Event live · all participants active
F6 / AI Agent Pipeline

AI Agent Communication Pipeline

Shows how agents chain together through Temporal and RabbitMQ. Each agent is an independent pod — failure in one does not block others unless they are in sequence.

Temporal Workflow Orchestrates agent sequence · checkpoints every activity SEQUENTIAL (design time) lab-architect-agent LangGraph + Claude API · IaC + rubric dataset-forge-agent Faker + Pandas · N unique datasets provisioning-agent Terraform + Graph API qa-validator-agent dry-run validation PARALLEL (runtime per participant) live-observer-agent idle detection · progress estimation · credit burn hint-dispenser-agent contextual hints on request · 2% score deduction scoring-agent 5-dimension scoring · Claude API commentary cross-validator-agent reserve dataset validation · anomaly detection RabbitMQ async event bus agent ↔ service Each agent is a separate AKS pod · KEDA scales independently based on queue depth · Temporal retries on agent failure
F7 / CI/CD Deploy

CI/CD Deployment Pipeline

GitHub Actions handles build and push to ACR. Argo CD handles GitOps sync to AKS. Auto-sync for Dev/Stage, manual approval gate for Production.

Dev merges PR to main GitHub Actions — CI Run tests → lint → build Docker image push to ACR with git SHA tag Tests pass? No PR blocked Yes Actions updates Helm values commits new image tag to charts/*/values.yaml Argo CD detects OutOfSync watches Helm chart repo · compares desired vs actual Target env? Dev / Stage Auto-sync Production Manual approval Lead engineer approves in Argo CD UI
GRAVITY LABS · PLATFORM FLOWS · v1.0 · MAY 2026 · CONSTEL GLOBAL