Architecture and boundaries
JumpCLI combines the product workspace with mature external services through stable integration surfaces. It does not modify Casdoor or Meteroid source code.
The production deployment stays on one container and one worker (GRANIAN_WORKERS=1). Back up data/, images/, and maintenance/ before each change, then roll the single app container forward with the reviewed image and verify /ready plus a browser smoke test before shifting traffic.
MVP concurrency for about ten users
The single worker owns HTTP, SSE, and SQLite coordination; it is not the image execution count. Four platform execution slots call upstream providers, capped at two per organization and one per account. Remaining work enters the durable queue with platform/organization/account capacities of 60/10/5. One model may use three slots and one upstream may use four. Shared-IP defaults allow 40 SSE connections and 120 generation/edit submissions per 15 minutes.
This envelope supports a short burst from about ten users, but throughput still follows provider latency and quota. At a 45-second average image latency with all four slots occupied, the theoretical ceiling is about five images per minute before download and retry overhead. Before adding application processes, move coordination and jobs to a shared queue and replace SQLite with a shared data layer.
Queued work resumes after a container restart. If the previous process already consumed a running unit's one-time execution fact, the unit is finalized as interrupted, its unproduced credit is released idempotently, and the upstream request is not replayed. This prevents duplicate generation and duplicate charging.
| Component | Responsibility | Browser access |
|---|---|---|
| JumpCLI | Workspace, jobs, gallery, account UI, and integration adapter | Yes |
| Casdoor | OIDC identity and authentication | Login redirect only |
| Meteroid | Plans, subscriptions, billing, and usage | No |
| Alipay | External payment and signed notifications | Controlled redirect only |
| Model provider | Image generation and editing | No |
The browser calls JumpCLI product APIs. Casdoor management credentials, Meteroid tokens, payment keys, SMTP passwords, and upstream model keys remain server-side.
Deployment domains
app.jumpcli.com: public workspace and operator surface.docs.jumpcli.com: static documentation.auth.jumpcli.com: Casdoor browser-visible OIDC source when enabled.api.jumpcli.com: reserved developer API; do not alias the browser-session app to this host.
Identity, billing, payment, and image jobs have separate permissions and audit boundaries. Keep Meteroid, databases, queues, and secret stores on internal networks.
Next: Production cutover.