nativesoul 1.1.2 → 1.1.4

package/CHANGELOG.md

@@ -15,6 +15,40 @@ product after ADR-045; there is no Free/Pro split.
 ### Product
 - _Nothing yet._
 
+## [1.1.4] — 2026-07-08
+
+Patch (ADR-043 §1 — licensing-robustness fix, no API change). **Recommended for
+Codex users and any restricted-filesystem host** — supersedes 1.1.3.
+
+### Fixed
+- **A valid license no longer reads as "not activated" under a sandboxed or
+  read-only `~/.nativesoul`.** The license check writes an advisory audit event;
+  if that write failed (e.g. Codex runs `nativesoul` under a workspace-write
+  sandbox that blocks writes outside the workspace), the error bubbled up and the
+  gate reported "not activated" even though the cached license was valid. The
+  audit write is now best-effort — it can never deny a valid license. This
+  restores licensing for Codex and any restricted-filesystem host.
+
+## [1.1.3] — 2026-07-08
+
+Patch (ADR-043 §1 — licensing-connectivity fix, no API change). **Recommended
+for all users** — the previous default could block a valid paid license after
+the offline-grace window.
+
+### Fixed
+- **License validation reached a non-existent host.** The daily license check
+  defaulted to `https://api.dodopayments.com`, which does not resolve (NXDOMAIN),
+  so every online validation failed and a paid license survived only on the
+  14-day offline grace window — after which the CLI/MCP reported "not activated".
+  The default is now Dodo's real host, **`https://live.dodopayments.com`**
+  (test-mode still available via `NATIVESOUL_DODO_LICENSE_API_BASE_URL`). No key
+  re-activation is needed once updated.
+- **Transient gateway failures no longer hard-block a paid license.** A Dodo
+  `5xx`, `429` (rate limit), or `408` (timeout) response is now treated as a
+  network condition — so the offline grace window applies — instead of being
+  misread as an invalid key. Only a genuine `valid:false` (or a definitive
+  client error) still means the key itself is rejected.
+
 ## [1.1.2] — 2026-07-08
 
 Patch (ADR-043 §1 — reporting-honesty fix, no API change).

package/README.md

@@ -29,7 +29,7 @@ NativeSoul is a **local-first continuity layer for coding agents**. If you run m
 
 It runs entirely on your machine (`~/.nativesoul/`), keeps **no background process**, **never copies your credentials**, and sends **no usage telemetry** — your code and memory never leave your machine. The only network call is a **once-a-day license check** that sends nothing but your license key, written to the audit log. You can read your own files, run one health check, and remove it cleanly at any time. It doesn't fake it — a capability only reads "ready" after it passes a real auth and health check.
 
-> **Proprietary, closed-source, paid — not open source, no free tier.** NativeSoul is **$29 one-time** (1 year of updates, perpetual build, 30-day money-back). You may not fork, redistribute, decompile, or create derivative works. See [License](#license).
+> **Proprietary, closed-source, paid — not open source, no free tier.** NativeSoul is **$19 one-time** (1 year of updates, perpetual build, 30-day money-back). You may not fork, redistribute, decompile, or create derivative works. See [License](#license).
 
 <p align="center">
   <img src="docs/assets/nativesoul-architecture.svg" alt="NativeSoul architecture — one identity, native across every host" width="100%">
@@ -279,17 +279,17 @@ printf '{"jsonrpc":"2.0","id":1,"method":"life_status"}\n' | nativesoul-mcp --ho
 
 ## Pricing
 
-NativeSoul is a **single paid product — no free tier**: **$29 one-time**, 1 year of updates, perpetual build, **30-day money-back**, no subscription.
+NativeSoul is a **single paid product — no free tier**: **$19 one-time**, 1 year of updates, perpetual build, **30-day money-back**, no subscription.
 
 | Everything is in the one product | Terms |
 | --- | --- |
-| Identity across every host | **$29 one-time** |
+| Identity across every host | **$19 one-time** |
 | Searchable local memory (FTS5) | 1 year of updates, then keep the build forever (perpetual fallback) |
 | Honest capability inventory + idempotent follow-ups | New major = optional paid upgrade |
 | Hybrid recall ranking (local), read-only dashboard, importers, policy packs | **30-day money-back**, no questions |
 | Reversible install/uninstall, `doctor`, audit log | No subscription |
 
-> **Honesty note.** The **licensing/boot gate is not shipped yet** — it is specced in [`EPIC-018`](docs/stories/epics/EPIC-018-monetization-entitlements.md) ([ADR-045](docs/adr/ADR-045-paid-only-closed-distribution.md), authoritative). Until it lands, the product runs ungated. Pricing is **perpetual fallback** ($29 + 1 year of updates), not "lifetime." Licensing is **Dodo-managed** — the product checks the license **once a day** (sending only the key, logged to the audit log) with an **offline grace window**; it is **not** "zero network." The single source of truth for what may be claimed is [`docs/architecture/feature-registry.yaml`](docs/architecture/feature-registry.yaml).
+> **Honesty note.** The **licensing/boot gate is not shipped yet** — it is specced in [`EPIC-018`](docs/stories/epics/EPIC-018-monetization-entitlements.md) ([ADR-045](docs/adr/ADR-045-paid-only-closed-distribution.md), authoritative). Until it lands, the product runs ungated. Pricing is **perpetual fallback** ($19 + 1 year of updates), not "lifetime." Licensing is **Dodo-managed** — the product checks the license **once a day** (sending only the key, logged to the audit log) with an **offline grace window**; it is **not** "zero network." The single source of truth for what may be claimed is [`docs/architecture/feature-registry.yaml`](docs/architecture/feature-registry.yaml).
 
 ---
 
@@ -379,7 +379,7 @@ npm run release:provenance:dry-run
 
 ## License
 
-**Proprietary, closed-source, paid — not open source, no free tier.** Use requires a paid license (**$29 one-time**, 1 year of updates, perpetual build, 30-day money-back). You may **not** fork, redistribute, decompile, reverse-engineer, or create derivative works for distribution.
+**Proprietary, closed-source, paid — not open source, no free tier.** Use requires a paid license (**$19 one-time**, 1 year of updates, perpetual build, 30-day money-back). You may **not** fork, redistribute, decompile, reverse-engineer, or create derivative works for distribution.
 
 See [`LICENSE`](LICENSE) and the full [`docs/legal/EULA.md`](docs/legal/EULA.md). Licensing is **Dodo-managed** ([ADR-045](docs/adr/ADR-045-paid-only-closed-distribution.md)): a once-a-day license check (sends only the key, logged to the audit log) with an offline grace window. No usage telemetry; your code and memory never leave your machine.
 

package/dist/package.json

@@ -1,6 +1,6 @@
 {
     "name": "nativesoul",
-    "version": "1.1.2",
+    "version": "1.1.4",
     "description": "Local-first continuity layer for coding agents.",
     "type": "module",
     "license": "UNLICENSED",