[turinglambdaai]

Goal

Use Permit as the single commercial-entitlement engine for gPTP Studio and remove the product-local RSA/OpenSSL/hardware-fingerprint licensing stack.

Product behavior

• keep Free / Pro / 14-day local Trial
• keep fully offline paid entitlement verification
• keep the existing ~/.gptp-studio/license.lic installed-license location
• preserve the current activation/deactivation RPC surface

Architecture

• Permit Protocol v1 + Ed25519 replaces the old RSA-2048/OpenSSL verifier
• product entitlement signing keys remain separate from updater signing keys
• default installation identity is random and privacy-preserving, not Linux machine-id / hardware fingerprinting
• Pro actions are checked by feature id + immutable feature publication timestamp, so features_through actually enforces maintenance-window economics
• the local 14-day Trial uses Permit local-trial state; it is nuisance resistance, not DRM

Operations

• add scripts/issue-license.rkt for manual permanent/subscription issuance
• add docs/permit-operations.md for key provisioning, renewal, optional installation binding, team-seat operational handling, and offline revocation limits
• ship a fail-closed empty trust-store placeholder in source
• Release refuses to build an official artifact until a valid production Permit trust store is committed
• CI/Release install a pinned Permit commit

Cleanup

• delete support/license.rkt
• delete the legacy RSA public key
• remove OpenSSL as a licensing runtime dependency
• update pricing, EULA/notices, architecture and legacy vendor docs

Validation

A product-level gate test signs a real temporary Permit entitlement, proves an explicit engine-control right does not also unlock export, then verifies local Trial behavior.

Protocol v1 itself is unchanged.