Sync the self-hosting stack

CHANGELOG.md

@@ -9,6 +9,80 @@ one of them changed. An entry says which artefact and which version, so `web 0.1
 Every version published to a channel appears here. Nothing is written from memory afterwards: a build
 cannot be published without its entry.
 
+## 2026-09-24 — A licensed instance can choose a managed model, and this is exactly what it sends `api 0.112.0` `web 0.137.0`
+
+**No conversation content leaves unless somebody chooses it.** The assistant keeps using your own
+OpenAI-compatible provider after this upgrade, exactly as before. What is new is a second option
+under **Settings → Platform → Model**: a model your Jarvis provider runs for instances with a paid
+or trial licence, with no endpoint and no key of your own to manage. Only a platform administrator
+can choose it, only on that screen, and only after ticking a box under a statement of what leaves
+the instance. No environment variable, licence or server answer selects it, and a community instance
+cannot use it. On a licensed instance, opening that screen asks the licence server whether the
+managed model is offered and which model it is, with a request signed like the licence report that
+carries the product, the licence id, the instance id and public key, and the version — no content.
+
+**Once chosen, conversation content goes to your Jarvis provider rather than to your own endpoint.**
+Every request the assistant makes to the model carries each message, the conversation so far, the
+instructions and the list of tools Jarvis gives the model, and the output of every tool the
+assistant ran — command output, file contents and API responses from the systems you administer —
+including runs nobody is watching, such as scheduled wake-ups and runs resumed after a restart; your
+own provider receives the same on every request it answers. It goes over HTTPS to the host your
+licence reports to (`checkin.luxit.be` on current licences), never following a redirect away from
+it, with a short-lived credential your instance obtains by signing a request exactly as it signs its
+licence report, and from there to the model provider named on the settings screen. A relay in front
+of the licence server must also forward `/api/inference/`.
+
+**What your provider keeps is metadata, never content**: when, which model, the Jarvis version, the
+request's size, token counts, timings and outcome — each request's record for 90 days, and daily and
+monthly totals for 26 months. **Usage counts against a monthly allowance per licence**, in UTC and
+shared by every instance on the licence. When it is used up, or the licence is no longer in force,
+the assistant refuses new requests with a sentence saying why and, for a spent allowance, when it
+renews. It never falls back to your own provider by itself; everything else in Jarvis keeps working,
+and your own provider's settings, key included, are kept as they were so switching back is one
+click. The [README](README.md#if-you-choose-the-managed-model) has the full statement, including how
+a request whose usage the model did not report is counted.
+
+**What earlier entries said about "no conversation content" is still true of the licence report**:
+the report's fields have not changed, and the managed model travels on a separate channel, which
+carries content only once a platform administrator has chosen it.
+
+**Also in this release.** The model step of the install wizard says the managed model exists and
+where to choose it later — it cannot be chosen during installation, because an instance is only
+bound to its licence once it has reported, after setup. A run the managed model refuses, or cannot
+reach, now explains itself in the reader's own language in the conversation, with a link to the
+model settings for a platform administrator; a refusal Jarvis decided on its own — a licence no
+longer in force, an identity key it cannot decrypt — is no longer presented as something your
+provider said. When the managed model is waiting on a licence report — an instance not yet bound, or
+a licence your provider has just reactivated — the model settings offer to send one now.
+
+**A licence key you remove stays removed.** The licence server answers every report with the licence
+it still has your instance bound to, and the next report used to put a removed key straight back,
+silently. That licence is now taken back only when somebody pastes it on the licence screen — not
+from a report, and not from `JARVIS_LICENSE_KEY` at a restart. Every licence your instance does take
+from a report, a renewal included, is now on the audit trail as `settings.license.adopted`.
+
+**A provider that is briefly unable to answer is no longer called a misconfiguration.** A rate limit
+or a 5xx from your own provider, or from a proxy in front of it, was retried and then written into
+the conversation as "a configuration or account fault … it will repeat identically until it is
+fixed". It now says the provider could not answer, how many times Jarvis tried, and that you can ask
+it to continue.
+
+**Self-hosters:** api and console. The schema gains five things, applied automatically when the api
+starts: which of the two providers is chosen, when that last changed, which version of the
+disclosure was accepted, on each assistant message which of the two answered it, and which licence
+was last removed on the licence screen. They only add, so the schema guard has nothing to refuse. No
+new environment variable.
+
+**Rolling back past this version is not a plain image change.** An older build's schema sync would
+drop `aiProvider`, `aiProviderChangedAt`, `aiManagedDisclosure` and `licenseReleasedId` on the
+instance settings, `aiProvider` on messages, and the `AiProvider` type; the schema guard refuses
+that and the api does not start. To go back anyway, set `SCHEMA_ACCEPT_DATA_LOSS=true` for that one
+deploy — in `.env` on compose, on the `jarvis-migrate` Job on Kubernetes — then put it back. What is
+lost is only the choice itself, the record of the disclosure accepted, which of the two answered
+each message and which licence was removed — no conversation and none of your own provider's
+settings — and the older build answers with your own provider, and takes a removed licence back at
+its next report. Take a dump first either way.
+
 ## 2026-09-12 — Long conversations open quickly, and you can search inside them `web 0.136.0`
 
 A conversation of several hundred turns had become slow in a way that spread past itself. Opening one