renar v0.1.0
enterprise

The multi-box
and regulated surface.

One codebase, compiled with the enterprise feature, gated by an Ed25519-signed license verified offline. On your metal, under your keys — and when licensing is unhappy, it degrades loudly to the free capability set instead of taking the box down.

01

What Enterprise adds

on the licensed plans
Multiple roots

A licensed multi-root table — each root its own unit of authorization, its own grants, its own readonly flag. Boot-gated, write-gated, and URL-labeled end to end.

Directory verifiers

Proof delegated to your authority: OIDC and the trusted-proxy header on Pro, LDAP at Team, Kerberos and SAML at the top — beside the local passkey, password+TOTP, and PAM every edition carries.

Client mTLS

Declare your client CA and the TLS handshake itself refuses unanchored clients — device certificates as a precondition, not a login form. Anchors stay strictly separate from the server chain.

Fleet management

Signed status envelopes between instances — each engine owns an Ed25519 instance key from first boot. The /fleet page shows live cards: up with reasons, or down with reasons.

Session recording

asciinema-format casts of terminal sessions when the posture demands them — recordings a compliance officer can replay.

Full-scope ledger

The ledger's full scope records who read what, when — not only mutations. The scope mode is stamped into the hash chain itself.

Ceilings and tier caps

A license may cap accounts, roots, and the highest declarable Tier — enforced where the mutations happen, shown live as ceilings on /status.

02

Licensing never takes the box down

degrade, loudly

An Enterprise build without a valid license degrades — loudly — to exactly the free capability set. The verdict is live: a recheck thread re-presents the license every five minutes, so a license that lapses mid-run degrades the running install, the transition lands in the ledger as license.degraded, and recovery needs no restart. A witnessed wall clock means rolling time back cannot resurrect a lapsed license; a boot-time stores_overlap check dies before licensing can so much as write a clock witness. A missing license is the trial shape; the one thing that refuses to start is a configured-but-unreadable license path — an operator typo, not a licensing verdict.

Offline revocation. Every edition verifies an installed revocation list signed by the license issuer — break-glass accounts arm the emergency door. No phone-home, ever: licenses, revocation, and updates all verify offline.
03

On your keys

self-issuance, deliberately

An on-prem install that wants independence can issue its own licenses against its own issuer key — set [license] issuer_public_key in the config and sign with your own ceremony. The engine's issuer key is baked at build time and the generation ceremony is operator-side by design: a build machine never holds the signing seed.

/account1440×900
The Renar account page: credential management for the signed-in account, including passkey and password options.
accounts are engine-local in every edition — verifiers delegate proof, never your identity store
04

Talk to us

inquiry → pilot → production

Enterprise licenses are issued per install with the ceilings and tier caps your environment needs. The fastest path runs through the trial shape — an Enterprise binary with no license, which is the pilot — and upgrades in place when the signed envelope arrives: same binary, same stores, one restart.

1 — The trial is self-serve

Build or download the Enterprise edition and run it without a license: it degrades to exactly the free capability set and says so on /status. Evaluate the box, the mounts, the ledger, the recovery story — the parts no demo can fake — before any paperwork exists.

2 — The inquiry, precisely

An email that already contains the license's shape gets a signed answer fastest. What to send is on the right; a pilot number and a production number if they differ.

3 — The pilot, on your metal

A signed envelope with pilot ceilings arrives by reply; you drop it in and restart. When the pilot becomes production the license is re-issued — in place, no migration, the ledger carries forward untouched.

tell uswhy the license needs it
Install countthe license is per install — how many boxes, and how many matter for the pilot vs. production
Account and root ceilingssigned into the envelope and shown live on /status; pick generously — ceilings are ceilings, not bills
Verifier needsOIDC at the edge, an LDAP directory, Kerberos realm, SAML IdP, a trusted reverse proxy asserting headers, client-certificate mTLS — the plan and the config follow from this
Highest tier you will declarethe license may cap the declarable Tier (T0–T4); your posture review names the number
Ledger scopemutations-only, or full — who read what, when — the question your auditors answer, not us
Self-issuance?if yes, the engagement is the ceremony runbook and support, and your key signs the envelopes
Procurement shapeannual invoice, PO, reseller, EU VAT specifics — the paperwork is drafted to fit, not the other way around
Contact details publish with the domain. The sales and procurement address will stand here at launch; nothing is invented in its place. Until then the pilot path above needs no permission — the binary is the conversation.