# Appliances

What customers actually run — Leumas Studio as an EXE, a self-host and a white-label, plus Leumas Social on iOS. Written for machines we do not control.


**What customers actually run.**

Leumas Studio (the EXE, the self-host, the white-label) and Leumas Social on iOS. These are the
products that leave the building, so everything here is written for a machine we do not control.

Companions: [CONTROL-PLANE.md](CONTROL-PLANE.md) · [PLATFORM.md](PLATFORM.md)
Execution: [ops/todos/leumas-consolidation-roadmap.md](ops/todos/leumas-consolidation-roadmap.md)

---

## The six products

| Product | One line | Who runs it | Plane |
|---|---|---|---|
| **leumas-studio** | Imperium — host sites, run AI, install apps | **customers** | Appliance |
| **leumas-ios** | mobile Leumas, social-first | end users | Appliance |
| **leumas-web** | the public index, accounts, the social network | Leumas | Platform |
| **leumas-docs** | docs, with an MCP server so agents can read them | Leumas | Platform |
| **leumas-admin** | the staff console | **Leumas only** | Control |
| **leumas-api** | the one backend — a kernel plus role packs | all of them | all three |

```
                              leumas-api
                   ONE binary · four roles · one kernel
     ┌──────────────────┬──────────────────┬──────────────────┐
 ROLE=platform     ROLE=control       ROLE=appliance      ROLE=dev
 api.leumas.tech   admin.leumas.tech  every customer      a checkout
     │                  │                  │
     ▼                  ▼                  ▼
 leumas-web        leumas-admin       leumas-studio
 leumas-ios                           (+ its installed plugins)
 leumas-docs
     ▲                                     │
     └──────────── hosts ──────────────────┘
              (leumas.tech runs on a Leumas-run Studio)
```

**Products are thin.** A product imports `packages/*`, mounts `engines/*`, calls `services/*`. It
never re-implements auth, UI, CRUD, routing or schemas. `pnpm check:escapes` and `pnpm check:vendor`
hold the line.

---

## The two facts that shape everything

**1. Gating is not slimming.** A capability a tenant cannot see is still *in the build*. Hiding a
domain does not remove its code, and the appliance a customer downloads ships the whole thing. Slim
means "not compiled in" — that is what a plane pack and an edition are for. Confusing the two is how
an EXE quietly becomes 400 MB.

**2. The store is how a Studio grows.** A domain is an app; an app is installable; installing it
changes *links*, never routes. That property is what lets a plugin be sandboxed, priced, revoked and
reviewed without touching the host — see the `build-leumas-plugin` skill.

---

## How it relates to the other two

```
 CONTROL ── licence · release feed · store ──-> APPLIANCE ── hosts ──-> PLATFORM
      ▲                                              │
      └──────── licence heartbeat only ──────────────┘
```

An appliance is autonomous by design: it runs offline, holds its own data, and phones home only to
say it is alive. Everything Leumas can do *to* it goes through the licence.

---

## The boundary rule

> Anything a *customer* does on their own instance → **Studio**.
> Anything *Leumas* does to or about that customer → **[CONTROL-PLANE.md](CONTROL-PLANE.md)**.
> What the instance serves to the public → **[PLATFORM.md](PLATFORM.md)**.

---

Detail — per-product shape, the API kernel and plane packs, the plugin contract, the host runtime,
install & monetize end to end, and the traps:
[ops/reference/appliances-detail.md](ops/reference/appliances-detail.md)

Per-product specifics live in each `products/*/README.md`.


---
Source: APPLIANCES.md
Canonical: https://docs.leumas.tech/p/architecture/appliances