Sync the self-hosting stack

.env.example

@@ -142,7 +142,7 @@ OPENAI_API_KEY=
 # ---------------------------------------------------------------------------
 
 # Leave this empty and the instance runs the COMMUNITY EDITION: 1 organization, 3 users, 5 agents,
-# 10 assets, no expiry, nothing to renew, and nothing reported to anybody. Every feature works inside
+# 10 assets, no expiry and nothing to renew. Every feature works inside
 # those numbers. A full limit refuses the NEXT thing of that kind and touches nothing already there.
 #
 # A key raises the limits — ask antoine@luxit.be for one. It is verified offline, on this machine. A
@@ -154,3 +154,17 @@ OPENAI_API_KEY=
 # through the check-in and is stored, so leaving an old key here cannot roll you back. To replace a
 # key, use Settings → Licence.
 #JARVIS_LICENSE_KEY=
+
+# Whether an instance WITHOUT a licence reports to your provider. On unless you say otherwise.
+#
+# It sends the same fields a licensed instance does — counts, the version it runs, its contract
+# checksum and its public address — to checkin.luxit.be. No names, no conversation content, nothing
+# about what you administer. The README lists every field.
+#
+# Set it to off and nothing leaves this network at all. You keep every community allowance and every
+# feature; what stops working is the licence request form in Settings → Licence, which needs the same
+# channel. Accepted values for off: off, false, 0, no.
+#
+# A LICENSED instance reports regardless — that is part of what a licence is, and this variable does
+# not change it.
+#JARVIS_TELEMETRY=on

CHANGELOG.md

@@ -9,6 +9,42 @@ one of them changed. An entry says which artefact and which version, so `web 0.1
 Every version published to a channel appears here. Nothing is written from memory afterwards: a build
 cannot be published without its entry.
 
+## api 0.84.0 · web 0.105.0 — 2026-08-21
+
+**Ask for a licence from inside Jarvis.** Settings → Licence has a form: your company, somebody to
+answer, roughly what you need. Send it and your provider gets it with your instance's version and
+counts attached, so the conversation starts at "here is what fits" instead of "how many machines do
+you have".
+
+**An approved licence installs itself.** The request is signed by your installation, so the licence
+is issued for that exact deployment and arrives on it at the next report — no key to copy, nothing to
+paste, and no way to paste it into the wrong instance. You get the key by email as well, for your
+records and in case you rebuilt the host while you waited. A decline comes back the same way, with
+your provider's reason on the licence screen and in your inbox. You can withdraw a request you no
+longer want, and ask again whenever something changes.
+
+**Community instances now report, and this reverses what we told you this morning.** api 0.83.0 said
+— here, and in the README — that an instance without a licence contacts nobody at all. That is no
+longer true. A community instance now sends the same fields a licensed one does: counts, the version
+it runs, its contract checksum and its public address, to `checkin.luxit.be`. No names, no
+conversation content, nothing about what you administer; the README lists every field, and it is the
+same list as before.
+
+Why: we could not tell whether the community edition had reached anybody, or which builds were
+running when we needed to warn people about one — and the request form above needs the same channel
+to work at all.
+
+**`JARVIS_TELEMETRY=off` in `.env` stops it completely**, and costs you nothing else: every
+community allowance, every feature and every connected machine stay exactly as they are. What you
+lose is the licence request form, which has nowhere to send. A licensed instance reports regardless —
+that has always been part of what a licence is, and the licence screen says so.
+
+If you would rather not report, set that variable before you upgrade. Nothing is sent until the
+instance's first check-in after start-up.
+
+**On the licence screen**: what leaves your network, the exact address it goes to, and whether
+reporting is on at all — all three visible without opening a compose file.
+
 ## api 0.83.0 · web 0.104.0 — 2026-08-21
 
 **Jarvis no longer needs a licence key to be useful.** An instance without one now runs the

README.md

@@ -18,9 +18,14 @@ This repository runs Jarvis from published container images — no source, no bu
 the project.
 
 **And no licence key.** A fresh install comes up on the **community edition**: one organization,
-three users, five agents, ten assets, no expiry, nothing to renew, and nothing reported to anybody.
+three users, five agents, ten assets, no expiry, nothing to renew. Everything Jarvis does works
-Everything Jarvis does works inside those numbers — every connector, the agent, the remote terminal,
+inside those numbers — every connector, the agent, the remote terminal, the assistant itself. A
-the assistant itself. A licence from your provider raises the limits; it does not switch anything on.
+licence from your provider raises the limits; it does not switch anything on.
+
+When you outgrow it, **ask for a licence from inside Jarvis** — Settings → Licence — and the key
+arrives on your instance by itself. A community instance reports its version and its counts so that
+we can see which builds are in the field; [what it sends](#licence-keys-and-what-your-instance-reports)
+is listed in full below, and `JARVIS_TELEMETRY=off` stops it without costing you anything.
 
 - [What it does](#what-it-does)
 - [What decides whether a tool call runs](#what-decides-whether-a-tool-call-runs)
@@ -37,6 +42,7 @@ the assistant itself. A licence from your provider raises the limits; it does no
 - [Removing it](#removing-it)
 - [The community edition](#the-community-edition)
 - [Licence keys, and what your instance reports](#licence-keys-and-what-your-instance-reports)
+- [Asking for a licence](#asking-for-a-licence)
 - [Getting a licence, and getting help](#getting-a-licence-and-getting-help)
 
 ## What it does
@@ -424,7 +430,7 @@ community edition:
 | Agents | 5 |
 | Assets | 10 |
 | Term | Perpetual. No expiry, nothing to renew, no key to lose |
-| Reporting | None. Nothing leaves your network, ever |
+| Reporting | Version, counts and address — the same fields a licensed instance sends. Switchable off |
 | Features | All of them — every connector, the agent, the remote terminal, the assistant |
 
 Nothing is disabled, watermarked or time-limited. What a licence buys is a **higher ceiling**, not
@@ -438,13 +444,28 @@ disconnected, and the assistant keeps working on everything you have. So an inst
 the community numbers — through an imported estate, say — keeps running in full; it simply cannot
 add to that meter until a key raises it.
 
-**A community instance contacts nobody.** No check-in, no telemetry, no licence server, no counting.
+### What changed on 21 August 2026, and why we are saying it loudly
-The reporting described below begins only once a key is in place, and never before. One consequence
-we accept knowingly: we cannot tell how many community instances exist. If Jarvis is useful to you,
-the only way we find out is if you say so.
 
-To go further — more organizations for a real client base, more seats, more machines — ask for a key
+**Until this release, a community instance contacted nobody at all**, and this file said so in those
-(see [below](#getting-a-licence-and-getting-help)).
+words. That is no longer true: an instance without a licence now reports the same fields a licensed
+one does — counts, version, contract checksum and its public address — to `checkin.luxit.be`, which
+is compiled into the build because an instance with no licence has no address in one to read.
+
+We changed it for two reasons, and neither of them is nicer for you than for us. We could not tell
+whether the community edition was reaching anybody, or which builds were running when we needed to
+warn people about one. And the licence request below needs the same channel — a form that could not
+reach us would just be an email with extra steps.
+
+**`JARVIS_TELEMETRY=off` in `.env` stops it completely.** You keep every community allowance, every
+feature and every machine; what you lose is the request form, and our ability to know you exist. That
+is a fair trade and we would rather you took it than felt watched.
+
+Everything in the next section applies to a community instance as well: the field list is the whole
+field list, and it is the same one.
+
+To go further — more organizations for a real client base, more seats, more machines — ask for a
+licence from **Settings → Licence** inside your own instance. That form is signed by your
+installation, so an approved licence lands on it by itself, with nothing to paste.
 
 ## Licence keys, and what your instance reports
 
@@ -458,14 +479,17 @@ withdrawn, or a key that will not verify: the instance keeps every allowance in
 keeps running everything already set up. There is no state in which Jarvis stops being usable because
 of a billing question, and there never will be.
 
-A licensed instance then reports to the address written into that key, at an interval your provider
+**Every instance reports**, licensed or not. A licensed one reports to the address written into its
-sets — every ten minutes on the current arrangement, so that a renewal or a revocation reaches you
+key; a community one to `checkin.luxit.be`, compiled into the build. The interval is your provider's
-promptly rather than tomorrow. This is everything it sends, in full:
+to set — every ten minutes on the current arrangement, so that a renewal or a revocation reaches you
+promptly rather than tomorrow.
+
+This is everything either of them sends, in full:
 
 | Field                    | What it is                                        |
 | ------------------------ | ------------------------------------------------- |
 | Product                  | The literal string `jarvis`                        |
-| Licence id               | Which licence this is                              |
+| Licence id               | Which licence this is. **Absent on a community instance** — there is none to quote |
 | Instance id + public key | A key pair your instance generated, identifying it |
 | Version                  | Which Jarvis build you are running                 |
 | Contract version         | Which set of limits this build understands — a checksum, not a document |
@@ -477,13 +501,17 @@ promptly rather than tomorrow. This is everything it sends, in full:
 **Counts, not contents.** No names, no email addresses, no conversation text, no asset inventory, no
 credentials, nothing about what you administer.
 
-**The public URL is the one field that names your network rather than measuring something, and on a
+**The public URL is the one field that names your network rather than measuring something, and it is
-licensed instance it is sent.** It used to be a switch on the licence screen; it is not any more,
+sent.** It used to be a switch on the licence screen; it is not any more, because an installation the
-because an installation the publisher can identify only by a fingerprint is one where "which of these
+publisher can identify only by a fingerprint is one where "which of these is the customer calling
-is the customer calling about" has no answer. The screen shows you the exact address that leaves,
+about" has no answer. The screen shows you the exact address that leaves, under **Settings →
-under **Settings → Platform → Licence**. If that is not acceptable for your deployment, the answer is
+Licence**.
-to stay on the community edition — which contacts nobody at all — or to take it up with us before
+
-installing.
+**The whole of it is switchable off, and only on a community instance**: set `JARVIS_TELEMETRY=off`
+in `.env` and nothing leaves your network at all. A licensed instance always reports — that is part
+of what a licence is, and the licence screen says so rather than offering a switch that would make
+the arrangement a matter of opinion. If neither suits your deployment, take it up with us before you
+buy anything.
 
 The reply can carry a renewed key, which your instance adopts on its own — so a renewal reaches you
 without anybody re-pasting anything.
@@ -496,6 +524,27 @@ state in which Jarvis disables, deletes or locks you out of something you are al
 check-in cannot reach the server, nothing changes at all: the key you hold is what governs, and it is
 checked without a network.
 
+## Asking for a licence
+
+**From inside your own instance: Settings → Licence → Ask for a licence.** Fill in who you are — a
+company name and somebody to answer are the only required fields — roughly what you need, and send.
+
+What makes this worth doing from in there rather than by email: the form is **signed by your
+installation**, so when your provider approves it, the licence is issued for that exact deployment
+and **lands on it by itself at the next report**. There is no key to copy, nothing to paste, and no
+way to paste it into the wrong instance. You get the key by email as well, for your records and in
+case you rebuild the host before the answer arrives.
+
+Sent with the form: your instance's id, its version, what it currently counts, and its address. That
+is the same information it already reports, so the form adds only what you typed.
+
+While it is pending, the licence screen says so. If your provider declines, their reason appears on
+that screen and in your inbox — and you can ask again from the same button whenever something has
+changed. You can also withdraw a request you no longer want.
+
+If you have turned reporting off, the form cannot reach anybody and says so. Write to the address
+below instead, quoting the instance id from the licence screen.
+
 ## Getting a licence, and getting help
 
 **Antoine Cavelier — <antoine@luxit.be>.** Licence keys, pricing, and anything wrong with the