| # Optional Gradio SaaS section |
|
|
| ## Decision |
|
|
| JackAILocal keeps its existing product architecture. Gradio is added only as an optional SaaS/configuration surface. |
|
|
| ```text |
| Gradio SaaS layer |
| ↓ |
| hardware profile intake |
| ↓ |
| model/backend recommendation |
| ↓ |
| build manifest export |
| ↓ |
| existing JackAILocal builder/factory pipeline |
| ↓ |
| prepared USB key |
| ↓ |
| offline JackAILocal runtime |
| ``` |
|
|
| ## What changes |
|
|
| Added: |
|
|
| - `saas/gradio/app.py` |
| - `saas/gradio/requirements.txt` |
| - `saas/gradio/README.md` |
| - `scripts/run-gradio-saas-preview.cmd` |
| - `docs/GRADIO_SAAS_SECTION.md` |
|
|
| ## What does not change |
|
|
| Unchanged: |
|
|
| - Windows portable flow |
| - Linux bootable flow |
| - `jackailocald` Rust runtime |
| - USB web UI |
| - backend policy |
| - model storage policy |
| - update signing policy |
| - offline runtime behavior |
|
|
| ## Intended use |
|
|
| The Gradio layer is for: |
|
|
| - hackathon demonstration |
| - SaaS MVP preview |
| - customer hardware profile collection |
| - model recommendation display |
| - package manifest generation |
| - one-click local target preparation when Gradio runs on the operator's Windows machine |
| - platform package publication for Windows, macOS, and Linux/Docker appliance targets |
|
|
| It is not the production USB runtime. |
|
|
| ## Model download policy |
|
|
| Models are never downloaded on every USB insertion. |
|
|
| Allowed download moments: |
|
|
| 1. factory preparation |
| 2. customer package build |
| 3. explicit signed update |
| 4. explicit advanced add-model workflow |
|
|
| Normal use after preparation is offline. |
|
|
| ## Security boundary |
|
|
| The Gradio SaaS layer is online by nature. The USB runtime is offline by design. |
|
|
| Rules: |
|
|
| - no private signing keys in the Gradio app |
| - no shell/system tools exposed from hosted Gradio |
| - local Gradio may call the checked-in builder scripts only for explicit operator-initiated target preparation |
| - no model execution claims unless a real model backend is attached |
| - no automatic LAN exposure |
| - no runtime override of USB security defaults |
|
|
| ## Production path |
|
|
| Hackathon/MVP: |
|
|
| ```text |
| Gradio only |
| ``` |
|
|
| Production: |
|
|
| ```text |
| Gradio frontend |
| ↓ |
| FastAPI API |
| ↓ |
| build worker |
| ↓ |
| object storage |
| ↓ |
| signed manifests |
| ↓ |
| existing JackAILocal builder |
| ``` |
|
|
