Jarvis needs a licence key, and this says what a licensed instance reports

The stack now refuses to create new organizations, users or agents without
`JARVIS_LICENSE_KEY`. Everything already set up keeps running, and an instance
with no key contacts nobody at all — but a fresh install gets as far as its
first administrator account and then needs a key, and that was documented
nowhere here.

The README now lists, in full and field by field, everything a licensed
instance sends: counts and a version string, no names, no addresses, no
conversation text, no asset inventory, no credentials. The only field that
identifies your network rather than measuring something is the public URL, and
it can be switched off.

.env.example

@@ -81,8 +81,8 @@ OPENAI_API_KEY=
 # Both services track `latest` unless you set these, so `docker compose pull && up -d` upgrades you.
 # Pinning makes an upgrade a decision instead of a side effect of pulling. The app reports its real
 # version either way — `latest` is a second name on the same image, not a build that forgot its number.
-#JARVIS_IMAGE_API=git.luxit.be/luxit/jarvis-api:0.59.0
+#JARVIS_IMAGE_API=git.luxit.be/luxit/jarvis-api:0.59.1
-#JARVIS_IMAGE_WEB=git.luxit.be/luxit/jarvis-web:0.74.0
+#JARVIS_IMAGE_WEB=git.luxit.be/luxit/jarvis-web:0.74.2
 # Only read when the agent overlay is enabled, just below. Its version is the AGENT's, and moves
 # independently of the two above — a Jarvis release usually does not change the agent at all.
 #JARVIS_IMAGE_AGENT=git.luxit.be/luxit/jarvis-agent-dist:0.20.0
@@ -107,3 +107,19 @@ OPENAI_API_KEY=
 
 #AGENT_HEARTBEAT_INTERVAL_SEC=30
 #RUN_SHUTDOWN_GRACE_SEC=25
+
+# ---------------------------------------------------------------------------
+# Licence (required to create anything)
+# ---------------------------------------------------------------------------
+
+# The key your provider gave you. REQUIRED to create anything new.
+#
+# Without it, an instance keeps running everything already set up and refuses to create new
+# organizations, users and agents — so an existing deployment does not stop working when this
+# reaches it, and a fresh install gets as far as its first administrator and then needs a key. An
+# unlicensed instance also contacts nobody at all. See the README for exactly what a licensed one
+# reports.
+#
+# This value SEEDS the database on first boot and does not govern it afterwards: a renewal arrives
+# through the check-in and is stored, so leaving an old key here cannot roll you back.
+#JARVIS_LICENSE_KEY=

README.md

@@ -131,6 +131,45 @@ docker compose exec -T postgres pg_dump -U jarvis jarvis | gzip > jarvis.sql.gz
 Plus `VAULT_MASTER_KEY`, stored somewhere that is not this host. A dump without the key is a database
 whose credentials cannot be read.
 
+## Licence keys, and what your instance reports
+
+**Jarvis needs a licence key.** Ask your provider for one and put it in `.env` as
+`JARVIS_LICENSE_KEY`. The key is a signed token your instance verifies **offline** — it carries your
+term and your limits, and it needs no network to be checked.
+
+Without one, an instance keeps running everything already set up — every organization, every user,
+every agent, and the assistant itself — and refuses to create anything NEW. So an existing
+deployment does not stop working when this reaches it, and a fresh install gets as far as its first
+administrator account and then needs a key.
+
+**An unlicensed instance contacts nobody.** No check-in, no telemetry, nothing leaves your network at
+all. The reporting below starts only once a key is in place.
+
+A licensed instance then reports to the address written into that key, by default once a day. This is
+everything it sends, in full:
+
+| Field                   | What it is                                        |
+| ----------------------- | ------------------------------------------------- |
+| Licence id              | Which licence this is                             |
+| Instance id + public key | A key pair your instance generated, identifying it |
+| Version                 | Which Jarvis build you are running                |
+| Counts                  | How many organizations, users, agents and assets  |
+| Public URL              | Your instance's address — **optional, see below** |
+| Timestamps              | When the process started, and when it reported    |
+
+**Counts, not contents.** No names, no email addresses, no conversation text, no asset inventory, no
+credentials, nothing about what you administer. The only field that identifies your network rather
+than measuring something is the public URL, and it can be switched off.
+
+The reply can carry a renewed key, which your instance adopts on its own — so a renewal reaches you
+without anybody re-pasting anything.
+
+**Your platform does not stop working because of a licence.** Expiry gives you a grace period, then
+refuses only the creation of new organizations, users and agents — everything already set up keeps
+running, and so does the assistant. There is no state in which Jarvis disables, deletes or locks you
+out of something you are already using. If the check-in cannot reach the server, nothing changes at
+all: the key you hold is what governs, and it is checked without a network.
+
 ## Licence
 
 The images are provided as-is with no warranty, no support and no commitment to future availability.

docker-compose.yml

@@ -100,6 +100,10 @@ services:
       # log, in the session list and in the enrollment rate limit.
       TRUST_PROXY_HOPS: ${TRUST_PROXY_HOPS:-2}
 
+      # Required to create new organizations, users or agents. Without it an instance keeps running
+      # everything it already has, creates nothing new, and contacts nobody. See the README.
+      JARVIS_LICENSE_KEY: ${JARVIS_LICENSE_KEY:-}
+
       AGENT_HEARTBEAT_INTERVAL_SEC: ${AGENT_HEARTBEAT_INTERVAL_SEC:-30}
       RUN_SHUTDOWN_GRACE_SEC: ${RUN_SHUTDOWN_GRACE_SEC:-25}