DVARA 1.4.0 — Community Edition
DVARA 1.4.0 is available today. It introduces a Community Edition — a free edition of the gateway that sits alongside the full Enterprise Edition. Until now DVARA was single-edition: a valid license was required to start at all. From 1.4.0 there are two, decided at boot by whether a valid enterprise license is present.
Community Edition is free, but not open source. DVARA does not publish its source, and 1.4.0 does not change that.
One binary, two editions
There is no separate Community build. gateway-server and flightdeck ship every enterprise module and decide the edition at startup:
- A valid, signature-verified license → Enterprise Edition. The full governance graph activates.
- No license, an invalid one, or one expired beyond its 14-day grace → Community Edition. The app boots and passes traffic on the Community feature set instead of failing to start.
The current edition is reported as edition (COMMUNITY / ENTERPRISE) on /actuator/gateway-status, so an operator can always confirm which one is running.
Keyless boot is deliberately not blanket. It is an opt-in a component declares at build time, and only gateway-server and flightdeck opt in. The MCP and A2A proxies keep the hard-fail: those planes are Enterprise-only with no Community tier, so booting them without a license would leave every call throwing rather than serving anything useful. Fail-closed remains the default; the relaxation is granted per component, on purpose.
One thing that does not change by edition: Postgres is required for every edition. Community Edition is a persistent, single-environment deployment — not an in-memory or dev-only mode.
What Community Edition includes
The whole LLM gateway, unrestricted:
- The OpenAI-compatible surface —
/v1/chat/completions,/completions,/responses,/embeddings,/models,/batches,/files - 15+ providers, provider switching by model string, default fallback, and the resilience layer (circuit breakers, retries)
- API-key authentication with tenant plumbing, request and access logging
- Raw token-usage metering, Prometheus/Micrometer metrics
- The Console, with built-in username/password login and RBAC roles
On top of that, 1.4.0 adds four scaled-down governance features so a free install shows what governance actually feels like rather than being a bare proxy:
- Static model allow/deny list — a single list, no policy DSL and no dry-run. A blocked model returns
POLICY_DENIED. - Local request log — who, when, which model, how many tokens, viewable in the Console, retained about 7 days. It is unsigned: no HMAC, no hash chain, no SIEM export.
- Regex-only PII detection — the built-in patterns (SSN, checksum-validated card numbers), with log or block as the action. No redaction, no tokenization.
- Read-only cost estimate — per-model spend visibility. No budgets, no caps, no enforcement.
Where the line is
| Community | Enterprise | |
|---|---|---|
| LLM gateway, providers, routing, fallback, Console | Full | Full |
| Policy | Static model allow/deny list | Policy-as-code — DSL, versioning, dry-run, shadow, conflict detection |
| Audit | Local, unsigned, ~7-day | Tamper-evident HMAC hash chain, unlimited retention, SIEM export, compliance reports |
| PII | Regex detect → log or block | Presidio/GLiNER + composite detection, redaction, reversible tokenization |
| Cost | Read-only estimate | Budgets, hard caps, per-call gate, chargeback, forecast, model downgrade |
| MCP governance plane | — | Full governed tool chain |
| A2A governance plane | — | Full governed hop |
| SSO, real rate limiting, semantic cache, advanced routing, Vault/mTLS | — | Included |
The shape of that split is deliberate. In Community Edition you can see your traffic, catch an obvious SSN, and block an expensive model — enough to feel what governance does. What you cannot do is prove any of it to an auditor, enforce it richly, or protect the data itself. Those are the things a regulated production deployment actually needs, and they are what Enterprise Edition is for.
No lock-in
Community Edition changes what happens when a paid license lapses, and it is worth being precise about the mechanics.
An Enterprise license that expires gets a 14-day grace period, fully operational, with warning headers and audit events. After the grace period the data plane returns 402 LICENSE_EXPIRED — administrative reads stay available so an operator can still diagnose and export configuration. That block is intentional: a paid product should be able to stop on non-payment.
What Community Edition adds is a floor beneath it. An operator who does not want to renew can drop the enterprise key and restart — the instance boots into Community Edition and serves traffic again, free and unblocked, at the Community feature set. This is an operator action, not an automatic fallback for a running instance.
So the honest promise is not "Enterprise never stops." It is you can always drop to the free edition and keep running.
Hardening the license root of trust
1.4.0 also tightens how license signatures are verified. The root of trust is now a compiled-in map of pinned key fingerprints (key id → SHA-256 of the raw public-key bytes) rather than the public-key files on the classpath. A repacked jar that swaps a bundled verify key, or adds a key id to the key list, is rejected.
The tradeoff is deliberate: rotating a verify key is now a code change and a rebuild. A build-time test fails if a shipped public key is not pinned, so a key can never ship unpinned by accident.
Upgrade
1.4.0 is a drop-in upgrade over 1.3.x. Pull the 1.4.0 images (or the oci://ghcr.io/dvarahq/charts/dvara:1.4.0 chart), keep your existing license and configuration, and roll. Enterprise installs are unaffected — a valid license behaves exactly as before, and the degradation fix extends the expired-license block to the MCP and A2A planes, which previously kept serving after grace.
A note on what this release is and is not. 1.4.0 ships the Community Edition code: the edition model, keyless boot, the four scaled-down features, and the in-product upgrade path. The public Community Edition image — a build that carries no Enterprise bytecode at all — is packaging work landing in a later release, and the free-install quickstart follows it. Today's images are unchanged in how they are distributed.
If you are new to DVARA: it is self-managed, activated by a signed license key, with bring-your-own-key credentials so provider keys and request data never leave your perimeter. Start with a 30-day, all-features trial license — every feature unlocked, including the MCP and A2A planes, no credit card. Get the trial or, for production licensing or a managed deployment in your region, talk to us.