1

The subscription, its resource providers and its quotas.

2

One bootstrap: the deployment identity, federated to the repository.

3

Infrastructure pipeline — the whole estate, reviewed as a diff first.

4

Record what exists: the estate manifest and the instance's record, from the outputs.

5

Secrets pipeline — everything a machine can create; the rest named for a person.

6

Release pipeline — the control instance itself.

7

Verify, sync the records, adopt the operations lane. Every further instance is then provisioned from the control instance.