Cloud Control

Everything MagicLock encrypts by default runs fully offline, forever. That is a promise, and it cuts both ways: once you have shipped an offline artifact, you cannot reach it again. Cloud control is the opt-in alternative for the cases where you need to.

Add --web-gate when you protect something, and before it decrypts, the artifact asks for a signed approval that you control. Flip it off in the portal and it stops — everywhere it runs, at its next check. Flip it back on and it works again, with nothing re-shipped.

Use it for rentals and subscriptions, evaluations that must end, delivery against final payment, or containing a leak. Use the default for everything else. The choice is per artifact, not per account — you can mix both in one product.

Turning it on

magiclock protect app.py --web-gate
magiclock protect-model weights.bin --web-gate
magiclock build app.py --web-gate

Registration happens at encrypt time and requires being online and signed in. There is no offline fallback for producing a cloud-controlled artifact — an artifact nobody registered could never be controlled, so MagicLock refuses to pretend otherwise.

What happens when it runs

1. The artifact asks the server for a signed allow or deny.
2. While that approval is still valid it runs with no network at all — it is not phoning home on every run.
3. Once the approval expires it refreshes. A deny stops it immediately — no grace period.
4. If the refresh fails because the network is down, it keeps running inside its grace window, then fails closed.

Two details worth knowing. A deny is sticky: replaying an old cached approval on a disconnected machine cannot revive a stopped artifact. And the first run must be online — with no approval cached yet there is nothing to fall back on.

The grace window

--gate-grace sets how long an artifact keeps working offline after its last approval:

magiclock protect app.py --web-gate --gate-grace 24h
magiclock protect app.py --web-gate --gate-grace 7d

Anywhere from 1h to 30d; the default is 12h. Shorter means tighter control but more dependence on your customer's network — pick for the deployment, not for the paranoia. --gate-grace only applies together with --web-gate.

Managing what you have shipped

In the customer portal, Artifacts lists everything you have registered, with its status and recent activity. Disabling one takes effect at that artifact's next check; re-enabling heals it just as quickly.

From the CLI:

magiclock artifacts     # id, label, status and gate activity

Deleting an artifact is permanent: it answers deny forever after that, and cannot be re-enabled. Disable it instead unless you mean exactly that.

Making a disable land faster

A cloud-controlled artifact re-checks at its own checkpoints, so a long-running process (a server, a worker) can keep going on an approval it fetched at startup. If you need a portal disable to land promptly on such a process, have it call magiclock.revalidate() on a timer — that forces a fresh approval right then. This is the difference between "stops in seconds" and "stops eventually".

What cloud control is not

It is not a license check. A lapsed subscription stops you from packaging new artifacts — it does not reach back and stop the ones you already shipped, cloud-controlled or not. The portal switch is yours, and it is the only thing that stops a cloud-controlled artifact.

And it does not change the default. Artifacts protected without --web-gate remain permanently offline and can never be stopped remotely — including by us.

Availability

Cloud control is included in every paid plan. It is not part of the free trial, which covers the complete offline protection instead.

Why it cannot be bypassed

The gate parameters are carried inside the encrypted envelope's authenticated data, not beside it — stripping them, editing them, or moving them to another artifact breaks decryption outright. Compiled builds carry the same parameters as a per-module compiled-in constant.

Approvals are signed with the vendor key that is pinned inside your MagicLock package, so a forged or replayed verdict does not verify. The clock used for expiry and grace is the later of the system clock and a persisted high-water mark, so winding a machine's clock back does not extend anything.