The multi-box
and regulated surface.
One codebase, compiled with the enterprise feature, gated by an Ed25519-signed license verified offline. On your metal, under your keys — and when licensing is unhappy, it degrades loudly to the free capability set instead of taking the box down.
What Enterprise adds
on the licensed plansA licensed multi-root table — each root its own unit of authorization, its own grants, its own readonly flag. Boot-gated, write-gated, and URL-labeled end to end.
Proof delegated to your authority: OIDC and the trusted-proxy header on Pro, LDAP at Team, Kerberos and SAML at the top — beside the local passkey, password+TOTP, and PAM every edition carries.
Declare your client CA and the TLS handshake itself refuses unanchored clients — device certificates as a precondition, not a login form. Anchors stay strictly separate from the server chain.
Signed status envelopes between instances — each engine owns an
Ed25519 instance key from first boot. The /fleet page
shows live cards: up with reasons, or down with reasons.
asciinema-format casts of terminal sessions when the posture demands them — recordings a compliance officer can replay.
The ledger's full scope records who read what,
when — not only mutations. The scope mode is stamped into the hash
chain itself.
A license may cap accounts, roots, and the highest declarable Tier
— enforced where the mutations happen, shown live as
ceilings on /status.
Licensing never takes the box down
degrade, loudlyAn Enterprise build without a valid
license degrades — loudly — to exactly the free capability set.
The verdict is live: a recheck thread re-presents the license every five
minutes, so a license that lapses mid-run degrades the running install,
the transition lands in the ledger as license.degraded, and
recovery needs no restart. A witnessed wall clock means rolling time
back cannot resurrect a lapsed license; a boot-time
stores_overlap check dies before licensing can so much as
write a clock witness. A missing license is the trial shape; the one
thing that refuses to start is a configured-but-unreadable license path
— an operator typo, not a licensing verdict.
On your keys
self-issuance, deliberatelyAn on-prem install that wants independence can issue its
own licenses against its own issuer key — set
[license] issuer_public_key in the config and sign with your
own ceremony. The engine's issuer key is baked at build time and the
generation ceremony is operator-side by design: a build machine never
holds the signing seed.
Talk to us
inquiry → pilot → productionEnterprise licenses are issued per install with the ceilings and tier caps your environment needs. The fastest path runs through the trial shape — an Enterprise binary with no license, which is the pilot — and upgrades in place when the signed envelope arrives: same binary, same stores, one restart.
Build or download the Enterprise edition and run it without a
license: it degrades to exactly the free capability set and says so
on /status. Evaluate the box, the mounts, the ledger,
the recovery story — the parts no demo can fake — before any
paperwork exists.
An email that already contains the license's shape gets a signed answer fastest. What to send is on the right; a pilot number and a production number if they differ.
A signed envelope with pilot ceilings arrives by reply; you drop it in and restart. When the pilot becomes production the license is re-issued — in place, no migration, the ledger carries forward untouched.
| tell us | why the license needs it |
|---|---|
| Install count | the license is per install — how many boxes, and how many matter for the pilot vs. production |
| Account and root ceilings | signed into the envelope and shown live on /status; pick generously — ceilings are ceilings, not bills |
| Verifier needs | OIDC at the edge, an LDAP directory, Kerberos realm, SAML IdP, a trusted reverse proxy asserting headers, client-certificate mTLS — the plan and the config follow from this |
| Highest tier you will declare | the license may cap the declarable Tier (T0–T4); your posture review names the number |
| Ledger scope | mutations-only, or full — who read what, when — the question your auditors answer, not us |
| Self-issuance? | if yes, the engagement is the ceremony runbook and support, and your key signs the envelopes |
| Procurement shape | annual invoice, PO, reseller, EU VAT specifics — the paperwork is drafted to fit, not the other way around |