Why local is the source of truth, not the cloud
Keenrig's first architectural principle: the instance holds all state required to operate, and the cloud is an optional layer on top. Here is what that choice costs as well as what it buys.
Most modern deployment platforms put the brain in the cloud: the cloud knows which apps you have, what state they should be in, and it issues orders downward. That model is tidy, and it is wrong for our problem.
Keenrig inverts it. Every instance carries its own database, its own identity store, a complete admin UI and a reconcile loop running locally. The cloud holds no state the instance requires in order to operate — only the environment list, pairing tokens, billing, managed DNS configuration, and your backups if you chose managed storage.
The comfortable consequences
The clearest one is that "disconnected" stops being a special mode we have to write extra code to support. It is the natural state of an instance, and pairing is the addition. You cannot forget to maintain a mode you run every single day.
- Our cloud going down does not take your apps down with it.
- NAT and firewalls are a non-issue: the agent only calls outward, no inbound port is opened.
- The self-hosted build needs no account and makes no mandatory outbound calls.
The uncomfortable consequences
In exchange, the Console is not allowed to reach into an instance directly. Every Console command is an intent placed on a queue, which the instance pulls. That means pressing a button in the Console does not complete instantly — it completes within a few seconds. We designed the interface around that truth rather than pretending it is immediate.
It also means the Console shows state a few seconds behind the instance, because state arrives via a sync payload. For a multi-environment overview that lag is irrelevant. For a detail view you should open the local admin UI instead, and we put a link exactly where you would look for it.
The real test
The test we hold ourselves to is simple: cut the network link between an instance and the cloud, then try to do every ordinary operational task. Install an app, change configuration, restore a backup, add a user. Anything that fails is either unfinished, or must be spelled out in the preflight before disconnecting. There is no third option.