CE feature subset
The Community Edition binary edssa-server-ce enforces these
constraints at boot. Held-back paths fail validation with a
clear error message naming the offending knob + a pointer back to
this page; there is no EDSSA_CE_PERMIT_*=1 override.
What’s in
| Capability | CE constraint |
|---|---|
Token width N | Pinned at 64 |
| Plasticity presets (ADR-008) | All three (high-security / balanced / high-resilience) |
| Per-field plasticity override | chaff_C and threshold_T only; width_N not overridable |
| Fleet count | Exactly 1 per process (singular [fleet] table) |
| Audit tier | One of silent / errors / result (Tiers 0–2) |
| Criticality | Pinned at standard |
| Sub-ID range | Any [lo, hi) with 1 ≤ lo < hi ≤ 65536 |
| Replay defence | None at the CE binary layer (Phase-2 ratchet + Tier-1 Bloom are Enterprise) |
| Relay role (F-04) | edge-only |
What’s held back
| Capability | Why held back |
|---|---|
| Multi-fleet routing (F-01 with N > 1 fleets) | Enterprise — multi-tenant + auth lives on the panel |
| Token widths 32 / 128 / 256 | Compile matrix kept lean for CE; Enterprise compiles the full set |
| Ratchet driver | Phase-2 hot-publish + ratchet is Enterprise; CE ships static state |
| Drift corrector (F-16) | Depends on Enterprise control oracles (NTS / GNSS / ledger timestamp) |
[fleet.swarm] block (F-03) | EdSSA Swarm |
[fleet.relay] role ∈ {peer, anchor} | F-04 higher-tier relay roles |
Audit Tier 3 (trace) | Per-byte derivation chain digest — Enterprise |
Audit Tier 4 (merkle) | F-21 tamper-evident Merkle anchors |
| Tier-3 response-ID chain (F-19) | Per-response binding for sensitive / critical fleets |
| Schema-embedded payload channel (F-26 / F-27 / F-28) | Enterprise — substrate landed in Phase 7, wiring in Phase 9 |
| Cooperative post-compromise recovery (F-24 / F-25) | SPAKE2 / recipe / recovery anchor — Enterprise |
| ML-KEM onboarding (F-07) | Phase-6 handshake — Enterprise |
| WebAuthn / SSO panel auth (D-2) | Panel is Enterprise |
| Multi-region, 24/7 support | Operational, not a code feature |
What the validation gate rejects
Every reject names the offending knob + this docs page anchor:
| Manifest input | Error pointer |
|---|---|
[[fleet]] (multi-fleet) | #single-fleet |
width_N = 32 (or 128 / 256) | #width |
audit_tier = "trace" or "merkle" | #audit |
criticality = "sensitive" or "critical" | #replay |
[fleet.swarm] block present | #swarm |
[fleet.relay] role ∈ {peer, anchor} | #relay |
Upgrade path
When you need a held-back feature:
- Try a different operational shape first. E.g., run two CE binaries side-by-side instead of asking for multi-fleet; use a Tier-2 sliding-window audit pipeline you build yourself instead of asking for Tier-3 trace.
- Switch to the Enterprise binary. Same
edssa-coreengine, same wire format, same client SDK — only the operator-facing binary changes. There is no client-side rewrite when you upgrade.
The CE manifest is a subset of the Enterprise manifest, so an Enterprise binary will load a CE manifest without modification. The reverse is not true.