Five modes
weldctl and the Naasson SaaS surface around it can be thought of as
five distinct operating modes. They share the same binary and the same
account model, but they differ in who is allowed to do what and
whether we charge money.
| Mode | Name | Description | Auth required? | Billed? |
|---|---|---|---|---|
| 1 | Self-mesh | Talking to your own VMs / clusters from your own laptop. Local-only. | No | No |
| 2 | Peer-mesh | A teammate joins your private mesh. Two people, one cluster. | Yes (PKCE) | No |
| 3 | Rental | You rent compute from a stranger via the Naasson marketplace. | Yes | Yes (per-hour) |
| 4 | Managed | We run the cluster for you (cloud.naasson.com). | Yes | Yes (subscription) |
| 5 | Batch | You ship sharded jobs into the rental queue (WASM workloads). | Yes | Yes (per-task) |
Mode 1 — Self-mesh
The default. weldctl init --provider yandex (or aws, or local)
writes a weld.yml, generates infrastructure-as-code under
infra/targets/<name>/, and weldctl deploy apply brings up the
target. The CLI never talks to api.cloud.naasson.com. You can run
without any account at all.
This is the only mode where the CLI must not prompt for login. If you ever see a login prompt for a Mode-1 command, file a bug — it’s a regression.
Mode 2 — Peer-mesh
You and a co-worker both sign in at cloud.naasson.com and link your
weldctl installs to your accounts. One of you provisions a cluster,
invites the other via weldctl mesh invite, and the other accepts.
Inside the mesh, both clients can reach the cluster’s services
through a single shared TLS root. We host the invite-redemption
endpoint; we don’t run your cluster.
Mode 3 — Rental
The marketplace side of the same mesh. Someone with idle compute (a homelab, a spare cloud VM, an Android phone) registers it as a listing. Someone who needs compute books the listing for an hourly fee. We’re the broker — we hold the escrow, route the traffic, and revoke access at expiry.
Rental hosts can carry any workload the renter trusts the host with (full containers, raw VM). Untrusted-host workloads are limited to WASM sandboxes — that’s Mode 5.
Mode 4 — Managed
The Naasson Apps SaaS. You don’t touch a CLI — you go to
cloud.naasson.com, pick an app, fill the wizard, and we provision
into your cloud account using credentials you provide. Same backend
worker as Mode 1, just driven by a web UI instead of a weldctl
process running on your laptop.
Mode 5 — Batch
A different shape: instead of provisioning a long-lived service, you submit a job (a sharded WASM workload) and the rental queue distributes shards to whatever hosts are willing to run them. The workload is sandboxed, audited by content hash, and replicated to N hosts for redundancy.
This mode is deferred to v1.1 of the platform — the API surface
(/batch/* operations) is deployed, but the WASM runtime side and
the trust model are still in design.
Picking a mode
Most people start in Mode 1 and stay there forever. Mode 2 unlocks when a second person joins. Modes 3-5 are about earning or paying for compute, and they only make sense once you have at least one stable self-mesh workload that you understand.
Read Quickstart for an end-to-end Mode-1 example, then Edge network for how the routing works under the hood.