The application is a local binary. It talks to one server, for the licence check and the update feed, and there is no sync server to host yet.
The sync server image, its storage and upgrades, an admin panel, the air-gapped licence file, Fleet's own licence server, SSO, SCIM, forced plugins and a private registry mirror are all unbuilt. Sync and Crew arrive with the public beta; the Fleet items arrive with Fleet in November 2026. The licence-key slot in the app says keys land with the beta.
| PIECE | TODAY |
|---|---|
| The app | Everything: cards, worktrees, agents, the code index, the action history. All local. |
| gridconsole.dev | One Next.js image (website/Dockerfile): the marketing pages, the licence server and the update feed. Hosted on Fly.io in Amsterdam, with Neon Postgres in the EU. |
| Your repositories | Never leave the machine. The server sees a device id, a plan id and an app version. |
| STEP | WHAT HAPPENS |
|---|---|
| Sign-in | Device-code sign-in in the browser. The server mints a plan token: Ed25519-signed JSON with your subject, plan, device id, issue time and a 7-day expiry. |
| At rest | The token sits in a safeStorage-encrypted file under the app's data folder; on macOS the key lives in the Keychain, and on Windows DPAPI encrypts it to your user account. If encryption is unavailable the app warns and stores it plain. |
| Heartbeat | Once per 24 hours, carrying deviceId, planId and the app version. Every answer rotates the token. |
| Offline | 14 days of grace from the last successful heartbeat. After that Grid is read-only until it checks in. |
| Remote sign-out | Sign a device out from the Licence sheet's Devices tab. That device gets a 401 at its next heartbeat and signs out then. |
| Devices | Free and the alpha plan have no device limit. Solo allows three devices; a Solo sign-in past that limit is refused. |
| Instant sign-in | Typing an email address on /signin signs that browser in on submit, with no mailbox round trip and no code. |
Two environment variables move the app off gridconsole.dev: GRID_LICENCE_ORIGIN for the licence server and GRID_UPDATE_ORIGIN for the update feed. Packaged builds default to gridconsole.dev, development builds to a local port. The website image is what you would run behind them, with docs/deploy.md as the runbook, but nothing in the alpha issues licence keys for a private server.
Plugins install from the registry the licence server hosts. Unverified plugins are refused unless you turn on the Allow unverified plugins switch in Settings, per workspace. VITE_GRID_REGISTRY_ORIGIN at build time points the app at a private index instead. See security for what a plugin can and cannot reach.