# Architecture

```text
Product + Go SDK
  ├─ local Ed25519 license verification
  ├─ feature/limit gates
  ├─ signed lease cache (hybrid offline)
  └─ POST /api/v1/licenses/validate
              │
              ▼
License Platform
  ├─ Admin / Management portal
  ├─ Reseller / Author portal
  ├─ Customer / Client portal
  ├─ encrypted issuer + lease key vault
  ├─ encrypted license-token registry
  ├─ revocation and lease service
  └─ audit trail / role isolation
```

The issuer key signs long-lived product licenses. The lease key signs short-lived runtime confirmations. Clients embed only public keys. The management UI never returns either private key.

The platform intentionally uses a `Store` boundary. The included JSON implementation is safe for one process and atomic file replacement. A database implementation can preserve the portal and API layers while adding transactions, replication and tenant indexing.