Wendy Self-Hosted Rule

The wendy stack (wendyos / wendy-agent) must ALWAYS be able to run without the SaaS stack.

Every agent working on interop must keep the self-hosted path intact — or create it where it doesn't exist yet. A SaaS-only feature is an incomplete feature.

This is not a preference or a stretch goal. Wendy serves critical-infrastructure partners who will not — and in some cases legally cannot — run their fleet control loop through a vendor's multi-tenant cloud. If a change only works when pki-core, Wendy Cloud, or wendy-auth are the managed GCP services, it is not done.

Scope

• wendy-agent / wendyos — always. The device fleet's core loop (enrollment, renewal, postbox polling, image pull) must work with zero SaaS reachability from the device's perspective beyond whatever the operator's own private infrastructure provides.
• pki-core — must itself be self-hostable. It is the trust root for both profiles; it cannot itself hard-depend on GCP.
• wendy-auth — potentially later, but write for it now. No path in wendy-auth service code should hard-assume GCP or SaaS reachability, even before a self-hosted wendy-auth ships. Retrofitting this later is far more expensive than not regressing it now.

The Two Deployment Profiles

The contract treats self-hosted as a first-class deployment profile, not an afterthought — cite this when someone claims SaaS-only is fine (§11.1):