165 lines
11 KiB
Markdown
165 lines
11 KiB
Markdown
# Zero-Network License and Activation Policy
|
|
|
|
**Status**: Approval draft; no implementation authority.
|
|
|
|
## Goals
|
|
|
|
Nexus One AI licensing MUST be independently verifiable with no network, distinguish product category
|
|
from Server tier, preserve customer data through license-state changes, and never convert missing,
|
|
invalid, expired, time-uncertain, revoked, or machine-mismatched material into a valid entitlement.
|
|
|
|
Release artifact signatures and customer license signatures are separate trust domains. The current
|
|
RSA-SHA256 `cezen.license.v2` format remains compatible until an approved migration changes it.
|
|
|
|
## Observed Existing Behavior and Gaps
|
|
|
|
- The canonical evaluator verifies RSA-SHA256, `issued_at`, `expires_at`, optional machine binding,
|
|
tier and feature overrides locally.
|
|
- A missing license returns `field-staging`, `needs_activation: true`, and compatibility tier `basic`.
|
|
- Invalid signatures, future-issued, expired, and machine-mismatched licenses are not valid, but their
|
|
normalized `allowed_tier` can still remain available to surrounding code unless every consumer also
|
|
honors `valid/staging_only`.
|
|
- Machine binding is enforced only when the caller supplies `machine_id`; current CLI flows can omit it.
|
|
- No signed offline license-revocation list, trustworthy-clock state, backward-clock detection, or
|
|
durable last-known-good license-evaluation time is defined.
|
|
|
|
These are planning blockers. A `basic` compatibility default is not evidence of a Server M
|
|
entitlement, and an omitted machine ID cannot make a bound license portable.
|
|
|
|
## Required License Envelope
|
|
|
|
A production signed license MUST declare schema/version, unique license ID, customer/project ID,
|
|
product category (`workstation` or `server`), exact Workstation entitlement or Server tier ceiling,
|
|
issued-at, optional not-before, expiry/support policy, feature overrides, machine-binding mode/value,
|
|
license-policy version, signing-key ID, and signature algorithm/signature. Optional fields never
|
|
weaken the default policy.
|
|
|
|
Customer-visible and diagnostic views expose only an allowlisted summary. Raw signature, license key,
|
|
customer identifiers beyond approved display fields, and machine-binding source values are excluded
|
|
from logs and support exports.
|
|
|
|
## Offline Import and First Activation
|
|
|
|
1. Import from approved removable media or local browser/console input; copy to a protected staging
|
|
path and never execute content from that media.
|
|
2. Parse size-bounded canonical JSON and reject duplicate keys, unknown critical fields, unsupported
|
|
schema/algorithm, malformed dates, and invalid category/tier combinations.
|
|
3. Verify the license-signing key and signature using the embedded approved license trust store.
|
|
4. Resolve a stable device identity locally and evaluate binding whenever the license declares one.
|
|
Failure to obtain the identity is `binding_unavailable`, not a binding bypass.
|
|
5. Evaluate trustworthy-clock state, issued/not-before/expiry, offline revocation policy, product,
|
|
hardware/provisioning constraints, and feature overrides.
|
|
6. Display the exact resulting state and allowed actions before activation.
|
|
7. Persist the signed license atomically with root-owned least-privilege permissions, record only a
|
|
redacted audit summary, then re-evaluate from the persisted copy.
|
|
|
|
No online activation callback is required for a license designed for offline use.
|
|
|
|
## License States and Behavior
|
|
|
|
| State | Meaning | Required behavior |
|
|
|---|---|---|
|
|
| `valid` | Signature, policy, time, revocation, category/tier and binding pass | Enable only licensed + provisioned + hardware-supported + healthy capabilities |
|
|
| `missing` | No license supplied | Enter explicit field-staging mode only when operator chose it; never infer a purchased tier |
|
|
| `invalid_signature` / `unsupported` | Untrusted or unreadable artifact | Reject import; do not alter active valid license or entitlement |
|
|
| `not_yet_valid` | Trusted license before allowed start | Preserve existing valid entitlement if applicable; otherwise restricted/staging state |
|
|
| `expired` | Trusted license beyond expiry policy | Preserve data, backup/export and license replacement; restrict gated operations per approved expiry matrix |
|
|
| `machine_mismatch` | Bound identity differs | Reject activation; preserve existing valid license; provide redacted device/support reference |
|
|
| `binding_unavailable` | Required identity cannot be derived | Fail closed for activation; allow local diagnostics/retry |
|
|
| `revoked` | License ID or signing key is on trusted offline revocation data | Enter restricted recovery-safe state; never delete data/models |
|
|
| `clock_uncertain` | Current time cannot be trusted sufficiently | Do not newly activate a time-bounded license; preserve safe existing state per continuity rule |
|
|
| `clock_rollback` | Clock moved behind durable last-known-good evaluation beyond tolerance | Block new activation/renewal and gated mutations; require authorized clock recovery |
|
|
|
|
## Field-Staging Contract
|
|
|
|
Field staging is a deliberate installation state, not a free Server tier and not a fallback for an
|
|
invalid license. It permits only the approved staging allowlist needed to configure network, inspect
|
|
hardware, import a license, validate artifact identity, view local help, collect redacted diagnostics,
|
|
perform backup/export, and prove core readiness.
|
|
|
|
General customer AI use, tier-gated Server capabilities, optional model packs, production data import,
|
|
and update actions above the staging maintenance allowance remain disabled unless a valid signed
|
|
license or separately signed time-bounded evaluation license authorizes them.
|
|
|
|
The current `STAGING_MAX_TIER=basic` remains an internal compatibility value only and MUST NOT be used
|
|
as authorization. Product/security owners must approve the staging capability allowlist, duration,
|
|
evaluation-license process, and whether an unsigned staging install may persist indefinitely in a
|
|
non-production restricted state.
|
|
|
|
## Clock Confidence Without Network
|
|
|
|
The appliance records UTC reading, clock source/confidence, boot ID, and the highest trusted license
|
|
evaluation time in tamper-evident local state. It compares RTC/current time with signed license dates,
|
|
signed update/build times, and last-known-good evaluation. NTP is helpful but never mandatory.
|
|
|
|
- A normal forward clock continues evaluation.
|
|
- A small approved tolerance accommodates RTC drift; the exact tolerance requires security approval.
|
|
- A backward move beyond tolerance becomes `clock_rollback`.
|
|
- No trustworthy time on first activation of a time-bounded license becomes `clock_uncertain`.
|
|
- Manual clock correction requires an authorized local action and audit record.
|
|
- Changing the clock never changes a bad signature, revoked key/license, category, tier or binding.
|
|
|
|
## Expiry and Continuity
|
|
|
|
Expiry MUST NOT erase customer data, uninstall services/models, invalidate backups, or prevent license
|
|
replacement and recovery. The approved expiry matrix separately controls existing inference sessions,
|
|
new sessions/jobs, data ingestion, model import, configuration, updates, user administration,
|
|
backup/export, restore, diagnostics, and emergency security updates.
|
|
|
|
Recommended safe default: block new license-gated workload creation and commercial expansion while
|
|
allowing read-only access, completion/cancellation of already-running safe work where feasible,
|
|
backup/export, diagnostics, local help, and license replacement. Exact grace periods and emergency
|
|
security-update rights require product/security/legal approval and MUST be encoded in the signed policy,
|
|
not hard-coded differently by UI and backend.
|
|
|
|
## Machine Binding
|
|
|
|
Binding modes are `none`, `single_device`, or an explicitly approved cluster/appliance mode. Device
|
|
identity must be stable across reboot and ordinary service/OS updates, replaceable only through a
|
|
signed rehost/recovery artifact, and derived without exposing raw serials in customer-facing evidence.
|
|
The binding algorithm/version and hashed identity components are part of license policy.
|
|
|
|
Hardware replacement never silently adopts the old binding. The recovery process preserves data,
|
|
produces a redacted old/new device reference, imports a signed rehost authorization or replacement
|
|
license, and records the actor and result.
|
|
|
|
## Offline Revocation and Trust Updates
|
|
|
|
A root-signed license trust/revocation bundle contains version, issued/expires policy, revoked license
|
|
IDs, revoked signing-key IDs, reasons suitable for operators, replacement trust roots, and signature.
|
|
It is imported through the shared trust-bundle mechanism and verified before replacing active policy.
|
|
|
|
Stale revocation data behavior must distinguish new activation from continuity of an already-valid
|
|
installed license. Recommended default: block new license activation when revocation policy exceeds
|
|
its approved maximum age; warn and preserve a currently operating non-revoked license until the
|
|
approved continuity limit, while retaining backup/export and recovery. Exact ages require approval.
|
|
|
|
## Interruption and Recovery
|
|
|
|
- Interrupted copy/parse/verification leaves the active license unchanged and staging quarantined.
|
|
- Interruption after atomic persistence re-evaluates the persisted artifact on reboot.
|
|
- A rejected replacement never overwrites an existing valid license.
|
|
- Trust-bundle interruption retains the prior trusted policy.
|
|
- Clock or binding recovery resumes the same durable activation operation.
|
|
- If entitlement decreases, stop new gated work first; do not corrupt in-flight work or delete data.
|
|
- License removal is authorized/audited and moves to explicit staging/restricted state; it never
|
|
fabricates `basic` entitlement.
|
|
|
|
## Evidence Gate
|
|
|
|
Test valid Workstation and each Server tier; deliberate staging; missing; malformed; duplicate-key;
|
|
unsupported schema/algorithm; invalid signature; future-issued/not-before; expiry boundary; clock
|
|
uncertain; backward clock; machine match/mismatch/unavailable/rehost; category/tier mismatch; feature
|
|
override; revoked license/key; stale revocation policy; interrupted import/persist/trust update; license
|
|
replacement; entitlement reduction; reboot persistence; and denied-role access. Verify every surface
|
|
reports the same state and no raw license/binding secret enters logs or support evidence.
|
|
|
|
## Owner Decisions Still Open
|
|
|
|
- Staging allowlist, duration and signed evaluation-license process.
|
|
- Expiry/grace/continuity matrix and emergency security-update rights.
|
|
- Device identity inputs, hashing/version, rehost authority and cluster binding.
|
|
- Clock tolerance, trustworthy-first-time procedure and authorized correction role.
|
|
- License revocation maximum age and stale-policy continuity limit.
|
|
- License signing-key custody/rotation relationship to the separate artifact-signing trust domain.
|