#Resource Hierarchy

Every object in ByteOr Cloud belongs to a strict ownership tree. Understanding this tree is essential for RBAC scoping, API path construction, and lifecycle management.

#Ownership Tree

Organization
├── Project
│   ├── Environment
│   │   ├── Agent
│   │   ├── Deployment
│   │   ├── Pipeline Draft
│   │   ├── Pipeline Version
│   │   ├── Config Bundle
│   │   ├── Artifact
│   │   └── Approval
│   └── ...
└── ...

Deleting a parent cascades to all children. For example, deleting a project removes every environment, agent, deployment, and artifact under it.

#Deployment Status Lifecycle

A deployment moves through a linear pipeline with well-defined branch points for failures and rollbacks.

pending_approval ──→ approved ──→ building ──→ deploying ──→ active
       │                                          │
       ▼                                          ▼
     denied                                     failed
                                                  │
                                                  ▼
                                            rolling_back
                                                  │
                                                  ▼
                                            rolled_back

#Approval Status Lifecycle

Approval records track the human decision associated with a deployment.

pending ──→ approved
       ──→ denied
       ──→ expired
       ──→ revoked

#Worker Background Jobs

The worker process runs asynchronous jobs triggered by API events or scheduled timers.

#Job Status Flow

queued ──→ running ──→ completed
                  ──→ failed ──→ retrying ──→ completed
                                          ──→ dead_letter

Jobs that exhaust their retry budget are moved to dead_letter for manual inspection.

#Rate Limiting & Abuse Controls

ByteOr Cloud applies rate limits at several layers to protect shared infrastructure:

• Per-token rate limits — Bearer and agent key endpoints enforce sliding-window limits. The current budget is returned in X-RateLimit-Remaining and X-RateLimit-Reset headers.
• Enrollment throttle — Agent enrollment is limited per environment to prevent credential-stuffing.
• Payload size caps — Request bodies are capped at 4 MiB for API calls and 64 MiB for artifact uploads.
• Concurrent deployment cap — Each environment allows a configurable maximum number of in-flight deployments to prevent resource exhaustion.

Clients that exceed limits receive 429 Too Many Requests with a Retry-After header.

#Hosted Environments