Use the Web edition directly
The admitted Web product is a local, zero-telemetry static runtime. No installer is required for the current Web portfolio.
Open 38 tools →LOCAL FORENSIC WORKSPACE · ZERO TELEMETRY
Downloads without trust shortcuts.
Release availability is separated from source readiness: exact provenance is published, while unadmitted signed or private delivery channels remain fail-closed.
CLI public download is not admitted yet
The deterministic CLI release candidate is source-proven, but GA signing, production trust material and activation remain separate stop-lines.
Review release boundaries →Desktop distribution remains fail-closed
A public Desktop installer is not presented until production signing identity and platform clearance are independently proven.
See the trust model →UPDATES / MANUAL EXPLICIT
No silent semantic upgrades.
Engine, profile and ruleset versions stay attributable. Paid perpetual licenses remain usable after update coverage expires; update eligibility does not require telemetry, device fingerprinting or a heartbeat.
UPDATE_DEFAULT = MANUAL_EXPLICIT SILENT_SEMANTIC_UPGRADE = FALSE PERPETUAL_RUNTIME_SURVIVES_UPDATE_EXPIRY = TRUE TELEMETRY_FOR_UPDATE_ELIGIBILITY = FALSE
Availability is never inferred from build success.
Release candidates bind source SHA, artifact SHA-256, SBOM and provenance. Public/signed delivery is a separate admission step.