@kontextmind/kxm/docs/architecture/hosted-direction.md

KXM local-first multi-agent orchestration and operator dashboard

# Hosted direction

Target. This page is a direction, not a live deployment.

Read from `plans/plan-per-tenant-hosting.md`.
`plans/plan-greenfield-infra.md` is in this checkout as a `kxm.doc.v1`
stub committed in #373 (status draft, authority instruction). The
long-form proposal is not in this repository. The canonical facts below
come from the implementation-plan greenfield bullets.

```mermaid
flowchart LR
  titleNode["Target: hosted direction, not a live deployment"]
  tenant["one box per tenant"]
  edge["edge identity in front"]
  portal["portal backend"]
  hub["loopback hub"]
  store["SQLite hub store"]
  titleNode --> tenant
  edge --> portal
  portal --> hub
  hub --> store
```

## Per-tenant hosting plan

`plans/plan-per-tenant-hosting.md` frontmatter says `status: "draft"` and
`blocked_by: []`.

The file's own summary says it is the rationale and boundary for hosting KXM
beside the portal: one tenant per box, Authentik at the edge, existing
static-token auth unchanged, hub state stays SQLite, and the portal backend
is the hosted client of the loopback hub. It says delivery order lives only
in the implementation tracker and that this file keeps no schedule.

The four decisions in that file, in its words:

1. Tenancy is the machine.
2. Auth stays exactly as it is. Hosting is additive.
3. Authentik owns the browser. The portal backend is the hub's client.
4. No PostgreSQL for the hub. If one is ever needed, one database per hub.

The file says none of the delivery is scheduled there. The ordered queue is
the tracker's Still open section. The tracker records S0 through S4 as
delivered and S5 as still open on interactive login. That disagreement is a
roadmap question. The tracker wins.

## Greenfield infra plan

`plans/plan-greenfield-infra.md` is a `kxm.doc.v1` stub committed in #373
(status draft, authority instruction, updated 2026-09-28). The long-form
proposal is not in this repository. Its delivery position is unchanged:
none of the delivery is scheduled there.

Today the Node hub and Runtime still write local SQLite and local files. The
checked-in MG1 Python control API is the narrow exception: it owns only central
registration and bounded tenant artifacts in the fixed `kxmd` PostgreSQL
account. Temporal is provisioned for `kxmd`, but no production workflow cutover
is selected. Redis Streams, NATS, raw WebSockets, the A2A Python SDK, and S3
remain backlog. The rest of this page remains a target, not a live deployment
description.

## Related

- [Roadmap](../roadmap/dashboard.md)
- [SQLite ADR](../adr/ADR-0003-sqlite-only-store.md)