Operations
Evaluation and key management, verified against engine 1.1.74.
Evaluation
No account, no signup, no token, and no outbound call. An engine started with no license configured runs the built-in evaluation license. The public images behave the same way: they carry no license, so a pulled image takes this path too.
| Property | Value |
|---|---|
| Scope | The whole product, not a feature-limited subset |
| Node ceiling | 10 |
| Window | 30 days from process start |
| Network | Air-gapped, forced by the launcher |
An evaluation can be packet-captured and found silent, which is the cheapest security review available and is written out on Verifying. Buying removes the node ceiling rather than unlocking the binary.
Key management
License tokens are ES256 JWTs signed by AWS KMS (ECC_NIST_P256). The
private key never leaves KMS: no key file, no environment variable, no CI
secret. Signing keys are per environment, and a token's kid selects which
of the public keys compiled into the engine verifies it. Every engine binary
trusts the whole set, so the split is about which key signs what, not an
isolation boundary between environments. Rotation is additive: a new key
joins the trusted set in a release, so engines on the older release keep
verifying tokens they already accept.
Supply chain
Every release from 1.1.73 onward carries a CycloneDX SBOM per runtime distribution. SBOM holds the file names, the stable fetch address, and how to scan one.