Skip to content
Ophiolite

Activation Policy

Audience: SDK and Workbench evaluators
Status: Preview

Commercial activation is not live yet. The current build exposes the local certificate shape and support commands so install, diagnostics, and offline behavior can be hardened before billing is connected.

Current preview behavior

Section titled “Current preview behavior”

Available now:

  • ophiolite auth status
  • ophiolite auth import <license_json_path>
  • Workbench Install license… from the license status dialog
  • ophiolite auth login account-service smoke when OPHIOLITE_COMMERCIAL_SERVICE_URL or OPHIOLITE_COMMERCIAL_SERVICE_URI points at the local commercial mock service
  • local signed certificate verification using the built-in preview-2026-05 trust anchor
  • ophiolite doctor license check

Not available yet:

  • production account login
  • Stripe-backed subscription activation
  • online license refresh
  • automatic activation reset
  • production Workbench paid feature unlocks

The mock-service auth login path verifies account and entitlement JSON and can call POST /licenses/issue, but it does not cache the mock certificate as a local license. Import signed preview certificates with ophiolite auth import or Workbench Install license… until the production license service returns certificates signed by the active trust anchor.

A missing license certificate is a warning in the preview build. After importing a signed preview certificate, ophiolite doctor should report the license check as passing.

Planned SDK policy

Section titled “Planned SDK policy”

The first commercial SDK policy should stay simple:

  • first paid SKU: Ophiolite SDK Developer
  • one account maps to one developer seat
  • one paid SDK tier for v1
  • activation by account login or imported certificate
  • local signed license cache for offline work
  • default 14-day offline grace period, with the v1 policy staying within a documented 7-30 day range
  • two active machines per developer seat by default
  • no per-module licensing in v1
  • no floating license server in v1

CI is allowed for paid SDK users when it validates that user’s project or product integration. The v1 path should use a non-interactive certificate/import flow and short-lived CI certificates where practical.

Planned Workbench policy

Section titled “Planned Workbench policy”

Ophiolite Workbench should support:

  • first paid SKU: Ophiolite Workbench Professional
  • free install
  • sample project access without friction
  • report and bundle inspection in free mode
  • paid unlocks for user-data workflow execution, larger datasets, export/materialization, and non-demo operators

The Workbench should keep diagnostics and sample inspection available even when paid-only capabilities are blocked.

The Workbench commercial MVP is free to download. Free mode is intended for sample projects, example bundle inspection, reports, assertions, artifacts, and diagnostics. Paid mode is intended for real user data, reusable derived outputs, and commercial runtime execution.

Edge-case policy

Section titled “Edge-case policy”

The commercial MVP policy is:

  • two active machines per developer seat by default
  • support-managed activation reset for laptop replacement or corrupt local state
  • paid-only capabilities fail closed after offline grace expiry
  • diagnostics, auth status, and sample inspection remain available after license expiry
  • online refresh can refuse to renew revoked certificates
  • local certificates remain bounded by expires_at and offline_until
  • certificate reissue should create a distinguishable certificate or license id
  • certificates carry key_id so production key rotation can support multiple public keys

The architecture decision is tracked in ADR-0041.

Next: Install