---
icon: material/cog-outline
title: "Operations"
description: "Evaluating 10x without an account, and how license tokens are signed and scoped."
---

# Operations

Evaluation and key management, verified against engine **1.1.74**.

## :material-play-circle-outline: Evaluation

No account, no signup, no token, and no outbound call. An engine started with
no license configured runs the built-in [evaluation license](../manage/license.md).
The public images behave the same way: they carry no license, so a pulled
image takes this path too.

| Property | Value |
|----------|-------|
| Scope | The whole product, not a feature-limited subset |
| Node ceiling | 10 |
| Window | 30 days from process start |
| Network | Air-gapped, forced by the launcher |

An evaluation can be packet-captured and found silent, which is the cheapest
security review available and is written out on [Verifying](verifying.md).
Buying removes the node ceiling rather than unlocking the binary.

## :material-key-chain: Key management

License tokens are ES256 JWTs signed by **AWS KMS** (`ECC_NIST_P256`). The
private key never leaves KMS: no key file, no environment variable, no CI
secret. Signing keys are per environment, and a token's `kid` selects which
of the public keys compiled into the engine verifies it. Every engine binary
trusts the whole set, so the split is about which key signs what, not an
isolation boundary between environments. Rotation is additive: a new key
joins the trusted set in a release, so engines on the older release keep
verifying tokens they already accept.

## :material-package-variant-closed: Supply chain

Every release from 1.1.73 onward carries a CycloneDX SBOM per runtime
distribution. [SBOM](sbom.md) holds the file names, the stable fetch
address, and how to scan one.