CE feature subset
Availability today
The Community Edition —
edssa-server-ce, the self-hosted verifier binary — is not publicly distributed yet. Two consequences, both of which you will hit as concrete errors rather than as a notice:
- The repository is private.
github.com/edssa-io/edssais not public, sogit clonefails with a permission error unless your account has been granted access. Access is arranged per customer, because the code is BSL 1.1 and part of it is under a patent filing hold — write to support@edssa.io.- The CE image is not on Docker Hub.
edssa/server-ce:1.0.0is referenced throughout the samples but has not been pushed, sodocker pullfails withpull access denied. Publishing is operator-side, after the public migration ofv1.0.0-ce. Every command in these docs runs against an image you build locally from the source tree, so none of them needs the registry.Autopliance, the hosted product, is live and needs none of the above — no source access, no image, no self-hosting. If you want verified traffic and compliance reports today, that is the path that is open: see Autopliance — getting started.
The Community Edition binary edssa-server-ce enforces these
constraints at boot. Held-back paths fail validation with a
clear error message naming the offending knob + a pointer back to
this page; there is no EDSSA_CE_PERMIT_*=1 override.
What’s in
| Capability | CE constraint |
|---|---|
Token width N | Pinned at 64 |
| Plasticity presets (ADR-008) | All three (high-security / balanced / high-resilience) |
| Per-field plasticity override | chaff_C and threshold_T only; width_N not overridable |
| Fleet count | Exactly 1 per process (singular [fleet] table) |
| Audit tier | One of silent / errors / result (Tiers 0–2) |
| Criticality | Pinned at standard |
| Sub-ID range | Any [lo, hi) with 1 ≤ lo < hi ≤ 65536 |
| Replay defence | None at the CE binary layer (Phase-2 ratchet + Tier-1 Bloom are Enterprise) |
| Relay role (F-04) | edge-only |
What’s held back
| Capability | Why held back |
|---|---|
| Multi-fleet routing (F-01 with N > 1 fleets) | Enterprise — multi-tenant + auth lives on the panel |
| Token widths 32 / 128 / 256 | Compile matrix kept lean for CE; Enterprise compiles the full set |
| Ratchet driver | Phase-2 hot-publish + ratchet is Enterprise; CE ships static state |
| Drift corrector (F-16) | Depends on Enterprise control oracles (NTS / GNSS / ledger timestamp) |
[fleet.swarm] block (F-03) | EdSSA Swarm |
[fleet.relay] role ∈ {peer, anchor} | F-04 higher-tier relay roles |
Audit Tier 3 (trace) | Per-byte derivation chain digest — Enterprise |
Audit Tier 4 (merkle) | F-21 tamper-evident Merkle anchors |
| Tier-3 response-ID chain (F-19) | Per-response binding for sensitive / critical fleets |
| Schema-embedded payload channel (F-26 / F-27 / F-28) | Substrate landed in Phase 7; the credential-embedded wire is not yet enabled in any edition — it awaits a patent filing, not an edition toggle. Not to be confused with substance binding, which is available self-serve: that commits your records’ fields into the audit chain over plain HTTP, and nothing rides inside credential bytes. |
| Cooperative post-compromise recovery (F-24 / F-25) | SPAKE2 / recipe / recovery anchor — Enterprise |
| ML-KEM onboarding (F-07) | Phase-6 handshake — Enterprise |
| WebAuthn / SSO panel auth (D-2) | Panel is Enterprise |
| Multi-region, 24/7 support | Operational, not a code feature |
What the validation gate rejects
Every reject names the offending knob + this docs page anchor:
| Manifest input | Error pointer |
|---|---|
[[fleet]] (multi-fleet) | #single-fleet |
width_N = 32 (or 128 / 256) | #width |
audit_tier = "trace" or "merkle" | #audit |
criticality = "sensitive" or "critical" | #replay |
[fleet.swarm] block present | #swarm |
[fleet.relay] role ∈ {peer, anchor} | #relay |
Upgrade path
When you need a held-back feature:
- Try a different operational shape first. E.g., run two CE binaries side-by-side instead of asking for multi-fleet; use a Tier-2 sliding-window audit pipeline you build yourself instead of asking for Tier-3 trace.
- Switch to the Enterprise binary. Same
edssa-coreengine, same wire format, same client SDK — only the operator-facing binary changes. There is no client-side rewrite when you upgrade.
The CE manifest is a subset of the Enterprise manifest, so an Enterprise binary will load a CE manifest without modification. The reverse is not true.