Technical Reference

Understand how MP-OPT works internally

These pages explain mechanisms and boundaries. Use the User Guide for everyday workflows and the Operator Guide for commands and recovery procedures.

System architecture

Desktop, server, browser, publishing, and external-service boundaries.

Planning inputs, task instances, finalised schedules, publishing, and web overlays.

Optimisation controls, constraints, objectives, and benchmark interpretation.

Passkeys, sessions, authorisation, secrets, snapshots, replication, and HA fencing.

Security trust boundaries

Each boundary uses a different credential and limits what a compromise can reach.

Desktop workstation

Local project database, per-launch backend token, publish credentials in the OS secure store

User device

Passkey private key in the authenticator; session in a protected browser cookie

Public HTTPS boundary

Cloudflare and Caddy

Routing, TLS, headers, and request boundary

FastAPI

Passkeys, sessions, CSRF, roles, reauthentication, limits, and audit

PostgreSQL

Application data, public keys, hashed sessions, and hashed publish secrets

Protected service secrets

Docker secret files on the relevant VPS; node-local HA identities stay local

Operator recovery custody

Only the public age recipient is configured on servers; the private identity remains off-host