Vavitien
Copyright 2026 The Vavitien authors

This product includes software developed as the open-source Vavitien core,
licensed under the Apache License, Version 2.0 (see LICENSE).

Open-core boundary
------------------
The Apache-2.0 license covers the SDK and reference implementation in this
repository — the parts developers must be able to inspect before putting
Vavitien near real AI actions:

  - the protocol: signing, verification, the Proof schema, key registry,
    replay protection, policy engine, audit log, and anchoring
  - the ActionGateway and the framework integrations (MCP, LangChain,
    FastAPI, generic HTTP)
  - the billing PRIMITIVES (Ticket, TicketAuthority, TicketVerifier, the
    signer abstraction) and a single-node reference server

The following are PROPRIETARY and are NOT licensed under Apache-2.0. Their
source lives in this repository under `cloud/` and `enterprise/`, each of which
carries its own `LICENSE` file (proprietary, all rights reserved) that governs
over this root Apache-2.0 license for those directories:

  - the managed ticket-authority / verifier service (multi-tenant, KMS/HSM-
    backed keys, SLA, key rotation as a service)          -> cloud/
  - the hosted billing backend, metering, and customer dashboard  -> cloud/, enterprise/
  - the managed, externally-anchored audit ledger          -> cloud/
  - enterprise deployment, SSO, and support tooling         -> enterprise/

The Apache-2.0 LICENSE at the repository root applies ONLY to the open-source
SDK — the `vavitien/` package and its reference server. It does NOT grant any
license to `cloud/` or `enterprise/`; see those directories' `LICENSE` files.

In short: the code you need to trust and integrate is open (`vavitien/`); the
hosted trust infrastructure (`cloud/`, `enterprise/`) is proprietary and is the
product.
