JobCache host routing

JobCache no longer multiplexes its public API, MCP and UI through one Render process. The public product perspectives are separate Worker peers; Core is a protected origin behind the App boundary.

Host Owner Surface
api.jobcache.corbet.ch jobcache-api Worker public role search/evidence plus opaque link-capability sessions, saved views, snapshots and reductions
mcp.jobcache.corbet.ch jobcache-mcp Worker exact 14-tool MCP projection over App API through a private service binding
jobcache.corbet.ch jobcache-ui Worker live shared-shell SvelteKit UI over a private jobcache-api service binding
richc.alwaysdata.net/core @cv/jobcache-interface protected Core corpus/control/lifecycle API; not a public App perspective

The MCP Worker has no Core bearer or direct Crate access. The App Worker owns the Core control/lifecycle connection and the private EU D1. A jcs_ session capability never crosses to Core.

The old Render service is suspended and owns none of the App API/MCP domains. Its Svelte UI, embedded MCP and Host-header router have been deleted from jobcache/interface; that package is now Core-only. New UI/session work lives in jobcache/ui/ above the same jobcache/api/ contract used by MCP.

Failure boundaries

  • Unknown App or MCP routes return 404 in their own Worker.
  • Core requires separate strong control and lifecycle credentials.
  • App public traffic is rate-limited before Core work.
  • The App's five-minute scheduled erasure drain invokes the same authenticated HTTP route as an external operator; it does not bypass route authorization.
  • Core runtime secrets live in a mode-0600 file, not the provider-visible site environment.

See also

Source: jobcache/wiki/content/architecture/host-routing.md