Appliances

What customers actually run — Leumas Studio as an EXE, a self-host and a white-label, plus Leumas Social on iOS. Written for machines we do not control.

Appliances

What customers actually run.

Leumas Studio (the EXE, the self-host, the white-label) and Leumas Social on iOS. These are the products that leave the building, so everything here is written for a machine we do not control.

Companions: CONTROL-PLANE.md · PLATFORM.md Execution: ops/todos/leumas-consolidation-roadmap.md

The six products

Product	One line	Who runs it	Plane
leumas-studio	Imperium — host sites, run AI, install apps	customers	Appliance
leumas-ios	mobile Leumas, social-first	end users	Appliance
leumas-web	the public index, accounts, the social network	Leumas	Platform
leumas-docs	docs, with an MCP server so agents can read them	Leumas	Platform
leumas-admin	the staff console	Leumas only	Control
leumas-api	the one backend — a kernel plus role packs	all of them	all three

                              leumas-api
                   ONE binary · four roles · one kernel
     ┌──────────────────┬──────────────────┬──────────────────┐
 ROLE=platform     ROLE=control       ROLE=appliance      ROLE=dev
 api.leumas.tech   admin.leumas.tech  every customer      a checkout
     │                  │                  │
     ▼                  ▼                  ▼
 leumas-web        leumas-admin       leumas-studio
 leumas-ios                           (+ its installed plugins)
 leumas-docs
     ▲                                     │
     └──────────── hosts ──────────────────┘
              (leumas.tech runs on a Leumas-run Studio)

Products are thin. A product imports packages/, mounts engines/, calls services/*. It never re-implements auth, UI, CRUD, routing or schemas. pnpm check:escapes and pnpm check:vendor hold the line.

The two facts that shape everything

1. Gating is not slimming. A capability a tenant cannot see is still in the build. Hiding a domain does not remove its code, and the appliance a customer downloads ships the whole thing. Slim means "not compiled in" — that is what a plane pack and an edition are for. Confusing the two is how an EXE quietly becomes 400 MB.

2. The store is how a Studio grows. A domain is an app; an app is installable; installing it changes links, never routes. That property is what lets a plugin be sandboxed, priced, revoked and reviewed without touching the host — see the build-leumas-plugin skill.

How it relates to the other two

 CONTROL ── licence · release feed · store ──-> APPLIANCE ── hosts ──-> PLATFORM
      ▲                                              │
      └──────── licence heartbeat only ──────────────┘

An appliance is autonomous by design: it runs offline, holds its own data, and phones home only to say it is alive. Everything Leumas can do to it goes through the licence.

The boundary rule

Anything a customer does on their own instance → Studio. Anything Leumas does to or about that customer → CONTROL-PLANE.md. What the instance serves to the public → PLATFORM.md.

Detail — per-product shape, the API kernel and plane packs, the plugin contract, the host runtime, install & monetize end to end, and the traps: ops/reference/appliances-detail.md

Per-product specifics live in each products/*/README.md.