Architecture and terminology

Keystone Gateway sits between product installations and a vendor-issued Gateway license. The Gateway is authoritative for live lease allocation; the signed license is authoritative for which deployment and capacities it may serve.

flowchart LR
  L[Signed Gateway license] --> G[Customer-operated Gateway]
  P[PHOCOL / LMC Exporter installation] -->|acquire, renew, release| G
  G -->|time-bounded capacity grant| P

• Gateway: customer-operated licensing hub.
• Node: a product installation requesting authority to run. In client code this is represented by a persistent instance identity.
• Gateway node identity: configured gateway_id plus replica ID, checked against the signed license.
• Entitlement: licensed concurrent capacity for a component; “seat” is not a separate V1 object.
• Licensed component: independently requested component under phocol or lmc_exporter.
• Principal: an authenticated caller identity. Each principal is authorized for exactly one product license type; deployments serving both types use separate principals.
• Lease: time-bounded allocation to one product installation. A client may continue only until its last successful lease expires.
• Standalone: one Gateway replica with no redundancy.
• Active/Standby: the V1 two-replica topology; one writes normally, the other can become degraded-active after peer loss.
• Stable endpoint: client-reachable DNS names or an optional readiness-aware VIP; clients should have both replica targets.
• Offline reporting: local report generation and customer-controlled transfer; no runtime vendor connection.