What requires the hosted Platform

The orchestrator and agent do all of KiCI’s execution work and can run fully self-hosted, in independent mode, with the hosted Platform out of the loop entirely — webhooks arrive directly, jobs dispatch and run, and logs stream back, none of it touching KiCI’s servers. The hosted Platform is the control plane layered on top of that execution core. This page is the authoritative list of what the Platform provides — and therefore what a bare independent orchestrator does not have.

For the mechanics of running without the Platform, see Platform-down behavior and Direct GitHub webhook ingress. For how to choose a mode, see Configuration.

What requires the hosted Platform

Each item lists the local substitute where one exists.

Hosted dashboard. The web UI — run history, run detail, the live-log viewer, and every settings/management screen — is served by the Platform. Viewing your webhook sources and their ingress URLs is part of this dashboard (read-only). Substitute when self-hosted: the kici-admin CLI, which reads the same run, log, and source data directly from your orchestrator.
GitHub App webhook relay. In platform and hybrid mode the Platform’s webhook relay forwards App events to you, and the one-click GitHub-App manifest flow bakes the Platform’s webhook URL into a new App. Self-hosted substitute: expose direct webhook ingress so events arrive without the relay. The manifest flow then bakes the orchestrator’s own URL, and you register sources with kici-admin source add as always (see the note below).
User identity and login. Signing in (OIDC), personal access tokens, and the kici login developer flow authenticate against the hosted Platform. A self-hosted orchestrator authenticates callers with orchestrator admin tokens (kici-admin token create) instead; a developer passes one to kici connect.
Organizations, teams, and member roles. The multi-tenant control plane — inviting users, organizing teams, and assigning per-user roles — lives on the Platform. (Your orchestrator still enforces its own admin-action permissions.) The dashboard’s orchestrator-token reconciliation report is part of this: it reads your orchestrator’s admin tokens and compares each one against the holder your organization knows. Self-hosted substitute: kici-admin token list, which shows each token’s role, source scope, and recorded holder — there is no membership to compare it against. Member CI trust reaches your orchestrator on the Platform’s next push, so a role change takes effect there a moment after it takes effect on the Platform — and not at all while the connection is down. Check the lag with kici-admin trust-policy directory or the kici_orch_trust_directory_age_seconds metric. See How a CI-trust change reaches the orchestrator.
Billing, quotas, and usage metering. Plan limits and metering are a Platform concept. They do not apply to a self-hosted orchestrator, and direct-ingress webhooks are never metered.
Webhook relay and relayed-delivery records. Forwarding a webhook from the Platform to your orchestrator, which verifies its signature, (and recording that delivery) is Platform-side. Self-hosted, events arrive by direct ingress instead.
Dynamic peer matchmaking. Platform-connected clusters discover peers through the Platform. Independent clusters configure their peers statically.
Platform-side developer CLI commands. kici login, kici org, kici orchestrators, kici runs, kici approve / kici reject, kici workflows, kici notifications, kici secrets list, kici pat, and Platform-routed kici run remote runs talk to the Platform. Compiling workflows, running locally (kici run --local), verifying attestations offline, and kici run remote or kici types against an orchestrator directly (kici connect) do not.
Private issue-report upload. kici report writes its diagnostic bundle locally with no Platform involvement. Sending it — kici report --upload, and the kici report list / kici report withdraw commands that manage what you sent — uploads to KiCI-operated storage and is Platform-side. Self-hosted, you still get the bundle; you share it however you prefer.
Platform-side scheduled jobs and dashboard notifications.

Source registration is always `kici-admin`

There is no “register a source through the Platform” action. Sources are always created with kici-admin source add …, which writes to your orchestrator. The hosted dashboard only displays your registered sources and their ingress URLs; a Platform-connected orchestrator additionally announces its routing keys to the Platform so the relay knows where to forward events, but that announcement is an internal handshake, not source registration.

What still works fully self-hosted

With no Platform at all (independent mode), the whole execution path works:

Webhook ingestion (direct), local signature verification, delivery deduplication, trigger matching against the compiled lock file, job dispatch, agent execution, and log streaming.
Local inspection and administration through kici-admin — runs, event log, access log, audit, secrets, variables, agents, and join tokens.
Clustering across instances that share a database, with statically configured peers.
kici run --local and offline kici verify-attestation.
kici run remote and kici types straight against the orchestrator, with a per-person orchestrator admin token (kici connect). See Direct mode.
Build provenance and attestations. Your orchestrator owns the provenance root of trust: it holds its own ES256 signing key, mints and signs identity tokens locally, and publishes its own OIDC discovery + JWKS, so builds produce verifiable provenance with no hosted-Platform dependency. See signing keys.

The boundary is simple: the execution core — including build provenance signing — is fully self-hostable; the control plane — dashboard, identity, organizations, billing, and relay — is what the hosted Platform adds.

Keeping the dashboard without the relay: `observed` mode

observed mode splits that boundary one step finer. It keeps everything in the list above except the webhook relay: providers deliver straight to your orchestrator’s own ingress (no payload transits KiCI) while the Platform connection stays up, so the hosted dashboard, identity, organizations, and billing all keep working. The one-click GitHub-App manifest flow and GitHub-App sources work in this mode: the App delivers to the orchestrator’s own URL. Only the relay is absent. See Configuration, Direct GitHub webhook ingress and Data residency.

What requires the hosted Platform