Licensing and Entitlement

VCAL Semantic Cache uses mandatory signed-license enforcement. Each instance validates its signed license at startup and will not start with missing, unreadable, invalid, or expired entitlement material.

Semantic Cache is not licensed as an independently marketed public product. Its entitlement is issued by VCAL when the module is included in an agreed AI Cost Firewall or broader VCAL deployment.

There is no self-service trial issuance flow. Contact VCAL for an architecture review, evaluation arrangement, renewal, or replacement license.

Supplied entitlement material

The deployment package normally identifies:

• the licensed organization and deployment;
• the validity period and applicable capacity or feature limits;
• the signed license file;
• the runtime verification public key, when it is not embedded in the supplied build; and
• the approved artifact version and deployment form.

Commercial scope, support, evaluation conditions, and renewal terms belong to the wider VCAL deployment agreement rather than a public Semantic Cache tier.

License sources

VCAL Semantic Cache can read a license from the following supported sources:

Variable	Purpose
VCAL_LICENSE_JSON	Inline signed license JSON
VCAL_LICENSE_PATH	Path to the signed license file
VCAL_LICENSE_FILE	Alternate path to the signed license file
VCAL_DOCKER_LICENSE_PATH	Docker-specific license-path override

The default path is:

/etc/vcal/license.json

Use one unambiguous license source. When using a container, the configured path must exist inside the container.

Public-key verification

VCAL Semantic Cache validates the signed license using Ed25519. Configure an external verification key only when the supplied deployment instructions require it:

Variable	Purpose
VCAL_LICENSE_PUBKEY_FILE	Path to the supplied Ed25519 public key

Example container fragment:

-v /etc/vcal/license.json:/etc/vcal/license.json:ro \
-v /etc/vcal/ed25519.pk.b64:/etc/vcal/ed25519.pk.b64:ro \
-e VCAL_LICENSE_PATH=/etc/vcal/license.json \
-e VCAL_LICENSE_PUBKEY_FILE=/etc/vcal/ed25519.pk.b64

Do not confuse the runtime license-verification key with a release-signing key used to verify a delivered artifact.

Validation flow

At startup:

1. The process resolves the configured license source.
2. It loads the embedded or configured verification public key.
3. It reads the signed license document.
4. It verifies the signature, expiry, and applicable entitlement fields.
5. It exposes non-secret status through the administrative endpoint and metrics.

If validation fails, the process exits with a diagnostic message. Cached data remains on disk and can be used again after valid entitlement material is installed.

License status

Check the active license using an admin key:

curl -H "X-VCAL-Key: <admin_key>" \
  http://127.0.0.1:8084/v1/license/status

Useful metrics include:

vcal_license_valid
vcal_license_days_until_expiry
vcal_license_enforcement_events_total

Do not expose the administrative endpoint or metrics interface to an untrusted network.

Renewal or replacement

Coordinate renewal or replacement with VCAL before the existing entitlement expires. After receiving the new signed file:

1. verify that it belongs to the intended organization and deployment;
2. replace the existing license atomically while retaining a protected backup;
3. restart VCAL Semantic Cache; and
4. confirm /v1/license/status, readiness, and license metrics.

docker restart vcal-semantic-cache

For licensing, deployment, or support questions, use the VCAL contact page.