01 / DEPLOYMENT
Deployment & self-hosting
From a single sellable product to an air-gapped closed loop — five frozen profiles and a capability-mode matrix for both hosted and self-hosted delivery.
02 / PROFILES
Five deployment profiles
Scenario packs orchestrate multiple independent Compose projects — never merge six products into one project.
| profile | Meaning | Minimum stack | Allowed capability modes |
|---|---|---|---|
| standalone | Single product, sold and run alone | One product plane + its own database | identity: any; entitlement: off / offline_license recommended; ai=off|local_byok |
| control-plane | Shared control plane only | Identity (+ Auth Gateway) + Entitlement | Must declare services.identity |
| agent-commerce | Baseline closed loop | VistaCast + SyncroBrain + DoerFlow (+ optional control plane) | All three product planes required |
| smart-site | Full upper loop (layers on agent-commerce) | Above + VistaRemote + DataLuminary (+ BlockyEdu training entry) | BlockyEdu required must be false |
| air-gapped | Offline / intranet delivery | Single product or a bundle with no egress | ai≠central; entitlement∈{off, offline_license}; identity: external_oidc recommended, local allowed |
standalone
- Meaning
- Single product, sold and run alone
- Minimum stack
- One product plane + its own database
- Allowed capability modes
- identity: any; entitlement: off / offline_license recommended; ai=off|local_byok
control-plane
- Meaning
- Shared control plane only
- Minimum stack
- Identity (+ Auth Gateway) + Entitlement
- Allowed capability modes
- Must declare services.identity
agent-commerce
- Meaning
- Baseline closed loop
- Minimum stack
- VistaCast + SyncroBrain + DoerFlow (+ optional control plane)
- Allowed capability modes
- All three product planes required
smart-site
- Meaning
- Full upper loop (layers on agent-commerce)
- Minimum stack
- Above + VistaRemote + DataLuminary (+ BlockyEdu training entry)
- Allowed capability modes
- BlockyEdu required must be false
air-gapped
- Meaning
- Offline / intranet delivery
- Minimum stack
- Single product or a bundle with no egress
- Allowed capability modes
- ai≠central; entitlement∈{off, offline_license}; identity: external_oidc recommended, local allowed
03 / CAPABILITIES
Capability-mode matrix
Control Manifest declares every mode explicitly; unknown versions must fail startup.
identity=central|external_oidc|local · entitlement=off|shadow_read|enforce|offline_license · ai=off|central|local_byok · notification=none|smtp
| Capability | Modes |
|---|---|
| identity | central · external_oidc · local (lab — rejected in pilot/production) |
| entitlement | off · shadow_read · enforce · offline_license |
| ai | off · central (lab — blocked in pilot/production) · local_byok |
| notification | none · smtp |
04 / INSTALL
Install packs
luminaryworks-install provides a wizard-driven private install: pick products, configure domains and admin accounts, then run acceptance checks. Step-by-step env docs live on the docs site to avoid drift from the install bundle.
05 / AIR-GAPPED
Air-gapped delivery, offline License & local BYOK
Air-gapped delivery is a first-class spec concern — not a post-ship patch.
- The air-gapped profile forbids ai=central; entitlement is off or offline_license only.
- offline_license verifies signed licenses locally — no hard dependency on central Entitlement.
- local_byok keeps model keys on the customer side; central AI Platform is lab today and must not enter production.
- identity should use the customer IdP (external_oidc); local directory mode remains lab.
06 / MATURITY
Maturity labels
Shipped code is not the same as production-ready. Docs and manifests must carry stage labels.
| Label | Meaning | Allowed wording |
|---|---|---|
| production | Live, sellable, regression-covered | "Generally available" |
| pilot | Real users, bounded scope | "Pilot" |
| lab | Runs on a laptop or intranet, not hardened | "Experimental" |
| stub | API exists, implementation is a placeholder | "Not implemented" — no monetization or metering |
ai=central is lab today: no AuthN, no Entitlement gate, no /ready. Preflight rejects pilot/production.
Need private or offline delivery?
Contact the workshop team to discuss profiles, License and delivery scope.
Contact sales