Editions

trstctl is an MPL-2.0 open-core Machine Identity Security Control Plane. The product line keeps core credential issuance, enrollment, rotation primitives, protocol interoperability, audit/export, PostgreSQL RLS tenant isolation, and the offline license verifier in Free. Enterprise adds the commercial ee/ feature set. Provider / MSP includes every Enterprise feature and adds provider-plane operations plus managed-service and resale rights.

Pricing Posture

The canonical billing reference is Pricing; the posture in brief: Free has no license bill. Enterprise uses control_plane_deployment. Provider / MSP uses a negotiated managed_customer_band as its wholesale anchor. The MSP controls its downstream hosting and support prices. Certificates, SVIDs, secrets, API keys, tokens, rotations, nodes, and deployment count are not automatic Provider wholesale billing units.

Buyer Matrix

The same binary lineage serves all three tiers. The offline signed tier drives both feature inheritance and use rights. Core multi-tenancy, audit/export, crypto, and the license verifier remain in core.

Core Protocols

These protocol surfaces are Free/Community capabilities. They are not Enterprise-only features in internal/license.

License-Gated Features

This table mirrors internal/license exactly. A feature absent from this table is Free/Community by default unless a signed license explicitly grants it as an extra. Provider inherits every Enterprise row below, then adds the Provider rows.