# Signox

> Signox는 소프트웨어 라이센스 관리(License Management) SaaS다. 벤더(제품 제조사)가 대시보드에서 라이센스를 발급하고, 벤더의 앱에 임베드된 Signox SDK가 라이센스 키를 검증·활성화한다. 이 문서는 Signox를 자기 제품에 통합하는 개발자를 위한 것이다.

## Current integration contract
- For AI integration, read /start/quickstart-ai/ (English /en/start/quickstart-ai/) first. Select one language/path, use /guides/integration-checks/ for exact commands, and consume input/file replies before continuing. waiting_input, waiting_challenge and waiting_license are not completion.
- The separate Node sample at /samples/node/ includes verify-online.mjs: actual SDK/server verification with JSON expected/observed rows. Run with --inputs <private JSON> --report <local result>. SDK verification does not replace testing the generated app feature gate. Never manually turn not_run into pass.
- SDKs: Node, Java, C#, Python. Use ActivationClient for customer approval; the SDK detects device protection. Start with /start/install/, then /sdk/{language}/ and /samples/{language}/. Development SDK is 0.3.1; Java 0.3.1-SNAPSHOT. Public registry release is separate.
- Required app inputs: API URL, product UUID, pinned SPKI PEM product public key and private persistent stateDir. The customer owns or registers a key only in the customer portal. Never embed a customer password, retrieval secret or installation state into an image.
- Connected flow: start -> system browser -> customer login -> owned-license selection -> explicit approval -> poll -> apply/validate. Manual transport: createRequest -> portal /activate import -> activation.signox -> applyResponse(text). No middle challenge/proof file in the new flow.
- One license reserves one registered target at issuance. Issued and applied are separate states. Request IDs are public; result retrieval secrets stay app-side and travel only in POST bodies. Requests last seven days.
- Same protected hardware can recover its binding. Another device or unrecoverable installation identity requires a reasoned customer transfer request and explicit vendor review of the exact destination. Old offline use can remain unconfirmed; never claim immediate secure return.
- Use valid AND the required feature value to gate features. Only VALID and IN_GRACE_PERIOD permit use. Pending, skipped and unavailable hardware are not passes. Persist explicit denial across reconnect failures instead of falling back to an old grant.
- Network grace follows signed networkGraceDays and the SDK local cap. Expiry grace is separate. No initial offline activation from an empty cache. Protected issuance requires a supported runtime, trusted device enrollment and eligible plan. Linux/Python3/tpm2-tools are currently required; USB providers and automatic manufacturer certificate validation are not implemented.
- Do not mock the SDK or invent inputs. Record commands, exit codes, expected/observed results and local evidence. Use /start/quickstart-ai/ for the task prompt and /start/llm-reference/ for the short contract. Collect unresolved integration questions in a local Q&A file.
- Environment addresses: dashboard https://app.signox.twentyoz.dev, portal https://portal.signox.twentyoz.dev, API https://api.signox.twentyoz.dev. Use the evaluation URLs supplied for your integration.
- Short contract: /start/llm-reference/ and /en/start/llm-reference/. Every documentation page has a Markdown source URL: replace its trailing slash with .md. Online monitor intervals are milliseconds in Node/Python and seconds in Java/C#.
- Documentation MCP: https://api.signox.twentyoz.dev/mcp, tools list_docs and read_doc. Use the supplied evaluation API URL when needed. /llms.txt and /llms-full.txt on the Wiki also provide documentation.

## Documentation Sets

- [Abridged documentation](https://wiki.signox.twentyoz.dev/llms-small.txt): a compact version of the documentation for Signox, with non-essential content removed
- [Complete documentation](https://wiki.signox.twentyoz.dev/llms-full.txt): the full documentation for Signox

## Notes

- The complete documentation includes all content from the official documentation
- The content is automatically generated from the same source as the official documentation