Authenticate. Install. Accept.

Release files

Download the complete delivery packet. The archive contains 22 locked wheels, installation and acceptance tools, and original license notices. Model evaluation uses the separate SDK and CKODMK installation.

A signed release authenticates software delivery. It is not a purchased entitlement, a model-admission result or an indication that live checkout is enabled. The licensing service reports purchase availability. Standalone receipt verification remains free.

Confirm the publisher independently

Enroll the full publisher fingerprint through an already trusted MFENX channel or your administrator’s trust configuration. A fingerprint downloaded beside an archive does not authenticate itself. Store the accepted version and sequence floor outside the download directory.

Publisher · Ed25519 SPKI SHA-256

c11c70a4a29721aec1df7322a5dfae328ff4a60ebed110570cbd27279bca12a2

Version / minimum sequence

0.3.0rc3 / 1

Manifest validity · UTC

24 September 2026, 01:40 to 24 September 2027, 01:40, excluding the end.

The manifest binds a separate live entitlement issuer at https://license.mfenx.com, key ID mfenx-license-live-20260924. Its public SPKI SHA-256 is:

2c04b488e5151534ec5cc58d2cbcd66e7924db207a45d3789a0c24ad68088e4d

Publisher, entitlement issuer and customer purchase key have different roles. This packet is scoped to live entitlements; sandbox licenses do not become live licenses by changing configuration.

Check before execution

Use a new private directory owned by your operator. Do not use symlinks or allow other users to replace the files. OpenSSL with Ed25519 support and CPython 3.13 must already be installed.

openssl pkey -pubin -in publisher.pem -outform DER | openssl dgst -sha256

Compare the complete result with your enrolled publisher pin. Then construct the domain-separated signature input using only the standard library:

python3.13 -I - <<'PY'
from pathlib import Path
raw = Path('delivery-manifest.json').read_bytes()
if not 0 < len(raw) <= 16384:
    raise SystemExit('Manifest size rejected')
with Path('signed-message.bin').open('xb') as output:
    output.write(b'MFENX-GATE-DELIVERY-MANIFEST-V1\n' + raw)
PY
openssl pkeyutl -verify -pubin -inkey publisher.pem -rawin \
  -in signed-message.bin -sigfile delivery-manifest.sig

Stop unless OpenSSL succeeds. Inspect the authenticated manifest as data: check product, target, exact version, sequence, current time and issuer scope. Compare both the archive and verifier byte counts and SHA-256 values with their signed records before extracting or executing either.

wc -c mfenx-gate-licensed-runtime-0.3.0rc3-linux-x86_64-py313.tar.gz delivery_manifest.py
sha256sum mfenx-gate-licensed-runtime-0.3.0rc3-linux-x86_64-py313.tar.gz delivery_manifest.py

Archive · 8,600,105 bytes

180f92ca6cf053eb7ebb10a0bbf2ad2e9f1a060e9ad761d4669fabb5047769b5

Verifier · 17,460 bytes

3340d0452be607204064a463af1149f8a5684f83f4184395b885234a83846cff

The detached signature covers exact manifest bytes, not reformatted JSON. A reliable clock and administrator-maintained release policy are required: an offline check cannot discover newer releases or revoked keys.

Install without a package index

After authentication, extract the archive into your private directory. Choose a new, persistent runtime environment outside the extracted bundle; replace the absolute paths below with your operator-owned locations.

tar -xzf mfenx-gate-licensed-runtime-0.3.0rc3-linux-x86_64-py313.tar.gz
cd mfenx-gate-licensed-runtime
python3.13 -I install.py /absolute/path/to/new-runtime-venv

The installer rejects an existing destination, verifies its inventory and installs the exact hashed wheels without dependency resolution or network package downloads. Python’s venv and pip bootstrap must already be present. It does not start or register a service.

Use the installed Python to verify the full delivery contract and export its authenticated public issuer trust into a new directory:

/absolute/path/to/new-runtime-venv/bin/python -I /absolute/download/delivery_manifest.py verify \
  --manifest /absolute/download/delivery-manifest.json \
  --signature /absolute/download/delivery-manifest.sig \
  --publisher-key /absolute/download/publisher.pem \
  --publisher-key-sha256 sha256:c11c70a4a29721aec1df7322a5dfae328ff4a60ebed110570cbd27279bca12a2 \
  --archive /absolute/download/mfenx-gate-licensed-runtime-0.3.0rc3-linux-x86_64-py313.tar.gz \
  --expected-version 0.3.0rc3 --minimum-sequence 1 \
  --expected-origin https://license.mfenx.com \
  --trust-directory /absolute/private/new-trust-directory

Use your enrolled publisher pin and retained sequence floor, increasing that floor after accepting a later release. This command exports trusted-license-issuer.pem and verified-release-trust.json. It does not grant a license or alter runtime configuration.

Connect your deployment and license

Follow the bundled runtime-configuration.md. Your organization supplies its OIDC identity provider, database, TLS proxy, backups and public runtime origin. MFENX billing configuration does not belong in this customer runtime.

The current runtime security and data-flow record describes this separation. The retained technical-pack v1 ZIP is historical SDK evidence, not the current organization-runtime configuration guide.

When purchasing through the licensing workspace, retain your encrypted key-recovery file and passphrase separately. Record the holder fingerprint from your own purchase key, not solely from the downloaded license. Refresh after payment and download the confirmed entitlement.

Configure the authenticated issuer public key, key ID, origin and environment, your independently recorded holder fingerprint, and the license file path. Set the organization plan explicitly: the default allowance is Developer and cannot exceed the purchased plan. A valid software license does not replace organization authorization.

/absolute/path/to/new-runtime-venv/bin/python -I -m gate_control.license_verify \
  /absolute/private/runtime/license.json \
  --issuer-key /absolute/private/new-trust-directory/trusted-license-issuer.pem \
  --key-id mfenx-license-live-20260924 \
  --issuer https://license.mfenx.com \
  --holder-sha256 sha256:OWN_PURCHASE_KEY_FINGERPRINT

Exercise the installed runtime

From the extracted bundle, run its 14-case acceptance worker with a new empty, operator-owned scratch directory. It uses synthetic licenses and identities, real loopback HTTP and Python-level network guards. It does not activate your purchase or validate your organization’s identity-provider integration.

/absolute/path/to/new-runtime-venv/bin/python -I acceptance.py \
  --_worker /absolute/path/to/empty-scratch --_expected-version 0.3.0rc3

After your own deployment acceptance, use the licensed entry point behind your configured TLS proxy:

/absolute/path/to/new-runtime-venv/bin/uvicorn \
  gate_control.licensed_app:create_app --factory \
  --host 127.0.0.1 --port 8090 --workers 1 --no-access-log

Do not substitute the legacy gate_control.app:create_app factory. A health HTTP 200 establishes liveness, not paid admission: inspect paid_features_available and test an authorized governed operation. Missing or invalid licenses fail governed requests closed.

Keep the signed term current

Team and Business grants need renewal before their signed expiry. The bundle includes tools/renew_license.py and its customer-renewal guide. Test that one-shot helper with your protected recovery files and independent trust pins before scheduling it. No scheduled job is installed automatically.

Private air-gap delivery remains manual and disconnected. Cancellation prevents fresh grants, not use of an already issued offline grant before its signed expiry. Free receipt verification is independent of the organization subscription.

The archive and its notices are unchanged. The external delivery signature authenticates this retained release; older build-time candidate wording inside it is not silently rewritten. Software rights follow the commercial terms and applicable order. For assistance, use support; do not send private keys, passphrases, models or datasets.