Air-Gapped Deployment

Dryade Plugin Manager is designed to keep running when the marketplace is unreachable, but it is not designed to run forever offline. This page explains the offline-tolerance defaults, how to extend them for sovereign contracts, and what happens to your subscription state while you are disconnected.

The 30-Day Default

Every license carries a signed max_offline_days field. The default value for self-serve subscriptions is 30 days, which matches the monthly billing cycle. The Plugin Manager records the timestamp of every successful heartbeat with the marketplace and, on each startup and after each heartbeat failure, computes:

days_since_last_heartbeat = now - last_successful_heartbeat_at

If this exceeds max_offline_days, the Plugin Manager exits with a clear log message naming the constraint. This is not a soft warning — it is a hard exit, the same way an invalid license fails.

The 30-day window is sized so that a normally-billed customer who loses connectivity has plenty of room to restore network access before the next billing cycle, without giving uncontrolled offline runtime to a fleet that has stopped paying.

Custom Offline Windows for Sovereign Contracts

For air-gapped environments where 30 days is unworkable — defense, intelligence, regulated industrial, or any sovereign deployment with annual or semi-annual site visits — your contract can specify a longer offline tolerance. Common values:

• 365 days for annual site-visit contracts
• 180 days for semi-annual visits
• Custom for any contract where the operator specifies the cadence

The custom value is signed into your license token at forge time by Dryade operations. The Plugin Manager reads whatever value the token carries and enforces it verbatim — there is no special “sovereign mode” code path, no environment variable, no command-line flag. The license itself defines its own grace window.

How to request a custom value

Email support@dryade.ai with:

1. Your subscription tier
2. The desired max_offline_days value (e.g. 365 for annual)
3. A brief description of the deployment context

The override is one-time at license forge. Rotating the value later means downloading a new .dryadelicense file and rerunning the installer wizard on each affected device.

Self-serve subscriptions use the 30-day default. Custom offline windows are negotiated manually for enterprise and sovereign contracts. Starter and Team self-serve tiers cannot request a custom window through the dashboard.

Subscription State While Offline

Independently of the connectivity grace window, the marketplace tracks your subscription billing state — active, past_due, not_renewed. When the Plugin Manager last heartbeated successfully it pulled the latest subscription_status and persisted it locally. The same state machine that runs online also runs offline against this last-known status:

Days since not_renewed	Behavior
0 – 6 days	Normal operation, warning logged
7 – 13 days	Day 7 warn — visible warning in PM logs and admin status
14 – 20 days	Day 14 restrict — non-essential operations refused
21 days +	Day 21 hard exit — Plugin Manager exits with code 1

These thresholds mirror the online behavior so a customer cannot extend their effective subscription by yanking the network cable. The offline state machine uses the last known subscription_status — a customer who was active at last heartbeat keeps running normally until either the heartbeat grace window or the token expiry ceiling kicks in.

Worst-Case Runtime After Last Contact

The two grace windows compose. A fully air-gapped customer on the default 30-day window has:

• 30 days of offline tolerance from max_offline_days
• +7 days of token expiry grace (EXPIRY_GRACE_DAYS) as the absolute ceiling

Worst case is approximately 37 days of uncontrolled runtime after the last successful marketplace contact. A sovereign customer with max_offline_days = 365 has approximately 372 days. These are revenue-protection ceilings — they are intentional, signed into the token, and cannot be bypassed locally.

Reinstalling or Rotating a License

There is no “change license” button in the Plugin Manager. To replace a license — for example because operations issued you a new sovereign license with a longer offline window, or because you are moving to a higher tier — download the new .dryadelicense file from your account page and run the installer wizard again on each device. The installer always overwrites cleanly.

See the Installer License Wizard page for the per-platform installer steps.

What Happens If You Exceed the Grace Window

The Plugin Manager exits with code 1 and logs a clear message naming the constraint that triggered the exit. Plugins do not load. The Dryade backend cannot start. There is no read-only mode and no degraded operation — once the grace window is exceeded, the only remediation is to restore connectivity (or, for true air-gapped sites, to receive a new license file with a refreshed heartbeat timestamp via your operator support contract).

If you administer an air-gapped fleet, monitor dryade-pm status (the operator status command) on each device to track days_since_last_heartbeat against max_offline_days and surface warnings to your ops team well before the hard exit.