Two surfaces

As a hosted tenant, everything you touch is one of exactly two structurally separate surfaces: the control plane and your own Stack. Keeping that split straight explains a lot of what otherwise looks like friction in the Quickstart — why you sign in once, then land on a second, differently-authenticated place a moment later.

The control plane

Shared across every tenant. This is where your account exists at all: your GitHub-OAuth sign-in, your billing relationship, and the provisioning decision that brings a Stack into being for you in the first place. It never runs a Thread or a Run, and it never holds a Runtime Credential or a Workspace — there is nothing tenant-specific here beyond the facts needed to provision and bill you.

Your Stack

Yours alone. A dedicated deployment that runs the actual Harness — the Server, the Dispatcher, and the Dashboard you spend most of your time in. Every Thread, Run, Event, connected Provider, and watched Project lives here, on infrastructure provisioned just for you.

Why split this way

• Isolation. There is no shared, multi-tenant Engine or journal for one tenant's Runs to ever reach another's — your Stack is the only place your conversation history and Credentials exist.
• Independent lifecycles. The control plane can decide your billing state (trial, past-due, suspended) without that decision requiring any code on your Stack to run differently in the moment — it only changes what gets asked of your Stack later.
• A narrow, deliberate bridge. The one moment these two surfaces have to connect — landing you on your Stack right after signing in — happens through the one-time-code handoff described in the Quickstart, not a shared secret or a shared session. Your control-plane session and your Stack's own session are two different credentials from that point on (see Auth & consent).

Your Stack's Dispatcher also talks back to the control plane on its own — pulling its desired state, posting status and usage — but that is a machine-to-machine channel with its own separate identity; it is not something you sign in to or interact with directly.

Related

• Quickstart — the concrete walk from control-plane sign-up to landing on your own Stack.
• Auth & consent — the two sessions this split produces, and how connecting a Provider is a third, separate thing again.
• Data & privacy — what living only on your Stack means for where your data actually sits.