Specta Licenses

Not configured. Set CONSTELLATION_SPECTA_LICENSE_PRIV_PEM (base64-encoded PKCS#8 PEM, paired with priv/specta_license_public.pem) for local dev, or CONSTELLATION_SPECTA_LICENSE_PRIV_PEM_SM to a Secrets Manager name/ARN holding the same value. Run python scripts/gen_specta_signing_key.py if you need to generate a dev keypair. Issuance is disabled until one of these is set.

Issue offline license blobs for Specta. Customers paste the blob into Specta's admin UI at #/admin/llm-profile → Activate license; Specta verifies an RSA signature against the bundled public key, writes var/specta/llm-license.json, and the heartbeat picks it up within 60s. The signed envelope enforces only expiry. Licenses carry no model claims — model access is scoped on the gateway virtual key, and the models field below is a kW-internal note.

Issue a license

RSA-SHA256-PKCS1v15 envelope, 60s heartbeat
Route
Gateway routing (signed)
Models note (free-form, kW-internal — not signed, not enforced; the virtual key is the real model scope)
Access mode (shared hosts)

Adds the signed accessMode:"signed" claim: every user on the instance needs a kW-signed access grant (their spectaAuth tag), and nothing editable on the box can switch the mode back off. The deployer's personal grant (1-year term) is minted in this run and delivered together with the license — it is the only way in once the license installs. Grants for everyone else: the Access Grants tab, on the access request the deployer generates from Settings → Users. For a license issued before signed access existed, use → signed on its row.

Re-issue with signed access

Customer:
License:

A signed blob can't be edited, so this signs a new license with the same customer, route, and expiry plus the accessMode:"signed" claim, and mints the deployer's bootstrap grant (1-year term). The old record stays; the customer pastes the new license blob over the old one, then their grant on the refusal page.

Delete Constellation record?

Customer:
License:

This only removes the row from Constellation. The license already deployed to the customer's SkySpark will keep working until its expiration date — this delete does NOT revoke it.

To revoke the deployed license, an admin must delete var/specta/llm-license.json on the customer's SkySpark host, or issue a replacement license with an immediate expiry.

Past issuances

Show to re-display the snippet, ✕ to remove the record
License ID Customer Issued Expires Route Models note By
No licenses issued yet.

For instances in signed access mode (accessMode:"signed") — every user needs a kW-signed access grant on their spectaAuth tag. The deployer generates an access request on the instance's Settings → Users tab (any ungranted user can generate their own from the refusal page) and sends it to kW. Paste it below, review who is being let in, and sign. Grants are individually signed with the same key as licenses; the term is the revocation lever, so offboarding is "don't renew".

Sign access grants

access request in → roster review → signed bundle out

Specta's in-app feedback files a GitHub issue on the private kW-Labs/kw.specta repo. Client hosts can't hold that credential, so their instance POSTs the finished issue to /api/feedback/ingest authenticated by its license blob, and Constellation — the one kW-controlled box with the token — files it. The client is taken from the signed license, never the request body.

Relay status

kW-Labs/kw.specta
No GitHub credential. Set CONSTELLATION_FEEDBACK_GITHUB_TOKEN (a PAT with issues:write on kW-Labs/kw.specta), or CONSTELLATION_FEEDBACK_GITHUB_TOKEN_SM to a Secrets Manager name/ARN. Until one is set, ingest still verifies and rate-limits but returns a retryable 5xx instead of filing — clients keep their queued feedback and retry, so nothing is lost.

Disabled clients

a denied org gets a permanent 403 — no change needed on their box

No clients disabled. Feedback is on for every licensed client.

Recent deliveries

last 0 ingest attempts

No feedback received yet.