Licensing · the open-core architecture
Open where trust requires it.
Closed where moat requires it.
A closed-source verifier is a contradiction. A regulator cannot trust a black-box audit layer. So the verifier is fully open. The factory that emits products and the infrastructure that operates them — that's the commercial engine.
Sigstore is the model. Linux Foundation runs the operational trust infrastructure; the verifier code is fully open; competitors cannot credibly fork because they don't have the operated infrastructure or the reputation accumulated under it. The substrate applies the same pattern to runtime-AI containment.
The architecture is three-tier: the verifier is Apache-2.0 (regulators must be able to read + fork it; trust requires transparency). The SDK is Business Source License 1.1 — source-available for inspection, free for operators to use inside their own product, prohibited as a competing hosted service. Auto-converts to Apache-2.0 on 2030-05-15. The framework templates, dashboard, federation, HSM hooks, and hosted operations are proprietary — those are the operationally-anchored engine (federation + HSM still in development on Scale + Enterprise).
A fork of the open code starts with: zero operator pilots, zero regulator citations, zero continuous chain history, zero corpus, an unproven trust anchor. A fork of Sigstore would face the same problem against the Linux Foundation. Why forks don't compete →
The exact split
Component by component. No ambiguity.
Apache-2.0 · auditable · regulator-readable
— promethean.software/verify.mjsverify.mjs
~500 lines of plain Node 18+ stdlib — zero dependencies, zero install. The regulator-grade verifier. MUST be auditable to be trusted; that's why it's Apache-2.0 even though the rest of the package isn't.
apache-2.0 · served at /verify.mjs
L12 canonical-form specification
The byte-for-byte serialization rules every entry's signature commits to. Implemented in the BSL SDK but the spec itself is public — anyone can read it and re-implement an emitter or verifier in any language.
apache-2.0 · documented in verify.mjs source
BSL-1.1 · source-available · operator-installable
— promethean.software/runtime-ai/latest.tgz · converts to Apache-2.0 on 2030-05-15runConstrainedAI SDK entry point
Bind every LLM call to a closed-enum schema, sign the L12 entry, append to chain. Read it before deploying; use it freely inside your product. Forks for competing hosted services are prohibited until the 2030-05-15 Change Date.
bsl-1.1 · runtime-ai-sdk.ts
RuntimeAISpec types + validation
The closed-enum contract every spec conforms to. Categories · model identity · input schema · output schema · reviewer gate · fallback. Spec hashing is canonical so identical specs hash to identical bytes.
bsl-1.1 · runtime-ai-spec.ts
L12 chain emission + Ed25519 signing
appendRuntimeAIReceipt + verifyRuntimeAIReceiptLog + canonicaliseEntry. The same canonical-form math verify.mjs uses, just emitter-side. The two implementations agree by construction — the smoke test in the package proves it.
bsl-1.1 · runtime-ai-receipt-log.ts
Mock LLM client + reviewer queue primitives
createMockRuntimeAIClient · createSchemaShapedMockClient · createMemoryReviewerQueue. Lets your tests exercise the whole spec → SDK → chain pipeline without network calls or model spend.
bsl-1.1 · runtime-ai-sdk.ts
Proprietary · hosted · never shipped
— runs on Promethean infrastructure · paid-tier capabilityFramework handoff templates · 7 regulators · 37 articles
GDPR · EU AI Act · PSD3 · DORA · NIS 2 · MDR · HIPAA. Each article mapped to evidence kinds with citation URLs + plain-English obligation + operator-side gap. The actual regulatory IP. Never in the SDK.
proprietary · explainer/lib/regulatory-frameworks.ts
Handoff packet renderer
Workspace state + framework → Markdown + JSON packet. Surfaces PRESENT / EXPECTED / OPERATOR-SUPPLIED / TIER-GATED per article. Honest framing, never claims compliance — enumerates evidence the regulator can verify.
proprietary · explainer/lib/handoff-renderer.ts
Workspace dashboard + multi-tenant Redis layer
Self-service signup, per-workspace Ed25519 keypair generation, chain-continuity check on ingest, billing, spec authoring, audit-bundle download. Hosted on Vercel + Upstash; never distributed.
proprietary · explainer/ private code
Anchor cron + Promethean attestation key
Every 15 min: iterate workspaces, sign chain-head observations under the Promethean trust anchor (S/n4yLMG...). Third-party evidence the head existed by the anchored time. Operator's chain stays authoritative.
proprietary · app/api/cron/anchor
Stripe checkout · Resend email · billing infrastructure
Self-service tier upgrade, EU VAT via Stripe Tax, dunning, webhook signature verification, transactional email pipeline. The commercial machinery that turns the SaaS into revenue.
proprietary · app/api/{webhooks,workspaces}/billing
HSM key custody hooks · on-prem deployment option (in development)
Enterprise-tier capability on the roadmap for operators who need customer-controlled signing material (PKCS#11 / YubiHSM / AWS CloudHSM / Thales Luna). On-prem deployment for operators who can't use a hosted SaaS. Today: operator-managed env-var key custody + Promethean-hosted Vercel/Upstash EU.
proprietary · enterprise tier
Federation full (read + commit) (in development)
Cross-substrate federation primitives. The protocol is documented; the production read+commit implementation ships on Scale + Enterprise per the roadmap. Allows operators to commit decisions to a shared substrate without trusting Promethean as referee.
proprietary · scale + enterprise tiers
Substrate development repo (healer · learning · evolution · ADRs)
The substrate's deeper proprietary code — constraint engine, healer, learning loops, federation logic, 45 architecture decision records, 200+ tests. Private monorepo. May go public after first paying-pilot validation.
proprietary · private repo
Trademark + operational exclusivity
→ policyThe name 'Promethean'
Trademark-protected in EU + US. Forks of the open code must rebrand. Cannot represent themselves as Promethean.
trademark
'Promethean Verified' badge
Issued only to AI vendors who passed the AI-Verified-tier integration audit. Badge controls who can claim regulator-grade integration.
trademark · vendor channel
The Ed25519 trust anchor
Operational, not legal — anyone can generate their own key. But every chain signed under Promethean's key carries Promethean's accumulated reputation. Forks start with a brand-new key with zero history.
operationally exclusive
Full guidelines for nominative fair use, prohibited uses, DCO sign-off for verify.mjs contributions, and how to request a trademark licence are in the Trademark Policy.
The seven operational moats
None of these live in the code. All of them compound over time.
Live reference deployments
paysafe (PSD3+DORA) · cliniclens (HIPAA+MDR+AI Act) · civicgate (eIDAS+GDPR Art. 22). Signed under Promethean's trust anchor since v0.1. A fork starts with zero reference chains.
Regulator relationships + citations
Each citation in a regulator's guidance document reduces the next operator's compliance cost. Citations compound. A fork would have to rebuild every relationship from scratch.
Continuous chain history under one trust anchor
Every L12 chain signed under Promethean's Ed25519 key, Bitcoin-anchored monthly via OpenTimestamps. The chain history itself is a non-portable asset — competitors can't retroactively create a 2026-onward Bitcoin-anchored record.
Empirical corpus from operator pilots
Each operator pilot produces signed evidence the substrate uses to improve next-pilot generators (Phase 3 reverse loop). A fork has no corpus, no L5 signed observations, no §47.6 convergence detection signal.
The team
Substrate engineers who designed Phase R and ran the six audit passes. Running an operator pilot well requires substrate-shaped intuition; that's not in the docs. Forks have to rebuild the team.
Three compounding loops
Empirical compounding (corpus grows from pilots) · regulatory compounding (citations reduce next operator's cost) · capability-transfer compounding (operator-described intents become substrate components). All three documented on /investors; none replicable without operator engagement.
Brand trust + the 'Promethean-anchored' Schelling point
As regulators cite Promethean-emitted deployments, the substrate becomes the conversation default. AI vendors integrate not because Promethean is technically best, but because regulators recognise the chain shape. Switching cost compounds.
The parallel that explains it
Sigstore is open. Nobody forks it.
Sigstore (Linux Foundation) · 2021+
Software supply-chain verification infrastructure. Fully open source under Apache 2.0. Used by Kubernetes, npm, PyPI, Maven Central, and every major Linux distribution.
In four years of operation: zero credible commercial forks. Why?
- Operated infrastructure (Fulcio CA, Rekor transparency log) is run by the Linux Foundation
- Trust accumulated under their operational identity
- Forks would need to rebuild operator relationships and the trust-anchor reputation
- Brand + trademark protected
Promethean · same pattern, applied to runtime AI
Runtime-AI containment infrastructure. Apache-2.0 verifier + canonical-form spec (must be auditable). BSL-1.1 source-available SDK (operator-installable, competing-service prohibited). Proprietary framework templates, dashboard, cron (federation + HSM hooks in development).
Same fork-resistance logic.
- Operated trust anchor (Promethean's Ed25519 key) — every reference chain signed under it
- Continuous chain history Bitcoin-anchored — competitors can't retroactively create one
- Regulator citations + relationships compound non-portably
- Trademark + 'Promethean Verified' badge protect brand
Why this split
Apache-2.0 where openness IS the moat. BSL where the moat needs protection.
The verifier (verify.mjs) is Apache-2.0 unconditionally. A regulator auditing a black-box verifier is just trusting a logo. A defence contractor needs the right to fork the verifier into an air-gapped environment without our permission. Source-available with a four-year clock kills that. The verifier has to be actually open or the substrate's whole proposition collapses.
The SDK is BSL-1.1 because moat protection on operational infrastructure is different from moat protection on verification infrastructure. HashiCorp (Terraform, Vault), MongoDB, Sentry, CockroachDB, MariaDB MaxScale all moved to BSL to prevent AWS-style hostile resale of their hosted services. The SDK code is the operational kernel of a hosted service — that's the shape of code BSL was invented for. Operators using it inside their product: zero friction. Competitors trying to host it as a service: contractually prevented until the2030-05-15 Change Date, after which it auto-converts to Apache-2.0.
The framework templates, the cron, the dashboard, the federation implementation, the HSM hooks (the latter two still in development) — those stay proprietary because they ARE the differentiated commercial engine. No license clock; never source-available. Three tiers of openness, calibrated to where trust vs moat-protection has to sit.
Three doors
“The moat is what you operate, not what you write. Open the verifier. Keep the engine. Brand the trust anchor. Compound the references.”
Read the verifier
verify.mjs · Apache-2.0
~500 lines of plain Node stdlib at promethean.software/verify.mjs. Read every line. Run it air-gapped against any L12 chain. Read the source before running.
Install the SDK
@promethean/runtime-ai · BSL-1.1
Source-available source you can read before installing. npm install https://promethean.software/runtime-ai/latest.tgz. Use freely inside your product. Auto-converts to Apache-2.0 on 2030-05-15.
See the commercial tiers
Pricing
Five self-service tiers from Dev (€0) to Enterprise (€2,499/mo). Stripe checkout, monthly billing, cancel anytime. Framework templates land at Enterprise.