Skip to content

License States

Every state is produced by the signed-lease verifier or by a server-reported terminal response. Only ACTIVE and EXPIRING are usable; every other state locks the PteroCloud control layer (never customer infrastructure).

State Usable Cause Operator action
active Yes Valid signed lease, window healthy. None.
expiring Yes Within the expiring window of expiry. Renew.
expired No Signed expires_at passed, or server LICENSE_EXPIRED. Renew; unlock is automatic on a fresh lease.
suspended No Server SUSPENDED (newer generation). Contact vendor / resolve billing.
revoked No Server REVOKED / blacklisted. Contact vendor.
invalid No Malformed/invalid signature, unknown key, bad status. Re-activate.
installation_limit No Server INSTALLATION_LIMIT. Deactivate a stale installation, then retry.
product_mismatch No Signed product ≠ configured product. Correct KRAPPLE_PRODUCT.
version_not_owned No Running version not in owned_versions. Upgrade the license or downgrade.
tamper_suspected No Release manifest / critical-file hash mismatch. Restore files, re-verify.
lease_expired No Signed lease_expires_at passed. Revalidate online.
server_unavailable No No usable lease and the server is unreachable. Restore connectivity; a valid lease keeps working until its window lapses.
unverified No No trusted lease and no verified transport state. Activate.

Transition rules

  • A newer valid SUSPENDED/REVOKED state always overrides an older ACTIVE state.
  • An older lease_generation never overrides a newer one.
  • A server-reported terminal state can only ever lock; a later signed lease with a strictly higher lease_generation is required to unlock.
  • A transient server outage does not invalidate a valid signed lease before the server-signed lease_expires_at passes. After that the state is lease_expired and the control layer locks.
  • A forward clock jump triggers revalidation; a significant rollback is recorded as LICENSE_CLOCK_ANOMALY and requires online revalidation.

Safety-critical actions that remain available

Even in the most locked state, these remain available so an operator can administer and recover existing infrastructure:

view, power, delete instance, release IP, delete volume, console access (existing sessions), restore in place, manage firewall, emergency security, diagnostics, provider reconciliation, monitoring.