SENTRA Licensing Authority

What changed in each version of SENTRA Licensing Authority.

Newest first. Latest version: v1.2.3.

v1.2.3 · 2026-10-27#

Downtime The portal restarts and is sealed until unsealed.

The browser re-checks the portal's page and scripts on every load, so new buttons show straight after an update (they could stay cached for hours)

Downtime The portal restarts and is sealed until unsealed.

Customers: Delete a customer that never held a licence (its draft designs go with it); a customer with licences on record is archived instead (hidden from lists and new designs, every record kept, restore any time). Both need a fresh 2FA code and are audited.

Downtime The portal restarts and is sealed until unsealed.

Releases: Build now reaches the builder straight away (the request file was unreadable to it, so builds only ran on the 10-minute timer)

Downtime The portal restarts and is sealed until unsealed.

Releases: a new page to approve and publish signed software releases for SENTRA AI Threat Shield, SENTRA NTS and SENTRA GUARD & VIEW, with test results and what's new; a fresh 2FA code and four eyes; withdraw a bad release.
A release key in the vault, certified by the root key, signs each product's release list; every SENTRA system checks the chain before installing.
Release builder service: tests each product's main and prepares candidates; it never signs.
updates.sentra-ai.com: the release server (nginx on 127.0.0.1:8641 behind SENTRA AI Threat Shield).

Downtime The portal restarts and is sealed until unsealed.

A GUARD on its own (no VIEW) gets its GUARD licence plus a signing authority for its boxes, with limits and a plan; one enrolment code connects it.
Online check-in: every ATS, NTS, GUARD and VIEW with internet reports its licences; the portal answers with each key's status and hands over renewals.
Revoke a licence: systems that check in stop using it.
Registry shows when each licence was last seen online; the dashboard shows systems online today.

Downtime The portal restarts and is sealed until unsealed.

Each VIEW authority now receives its licensing plan (GUARD seats and tier, ATS modules, terms) from the deployment designed here, so VIEW licenses its fleet on its own.

Downtime First release.

Encrypted vault: every record and audit entry is AES-256-GCM encrypted; the master key is wrapped with the vault passphrase (scrypt) and only held in memory while unsealed. Usernames are looked up through a blind index.
Sign-in with password plus TOTP; 2FA is set up at the first sign-in and can't be skipped; recovery codes; a fresh 2FA code is needed for keys, approvals, users, root keys and policy.
Root signing keys sealed in the vault; never shown again.
Hierarchy designer: stand-alone ATS, stand-alone NTS, GUARD with its boxes, VIEW fleet; term, modules, seats and delegation per level; a preview of exactly what will be issued.
Approvals: the Super Admin's approval is final; issuers and approvers with per-user limits (levels, longest term, perpetual, boxes); four eyes.
VIEW signing authorities: certified VIEW keys with limits; online enrolment by code or offline request code; signed sync and ledger upload so every key a VIEW issues is on record here.
Licence registry, key bundles, import of existing licence files, customers, dashboard, hash-chained audit trail with verification, IP allow-list, seal now, break-glass from the server console.