[S4] Pro revocation never enforced offline; local heartbeat self-refreshes

[DsThakurRawat]

Labels: security, bug, pro, priority:high
File: src/tether/pro/license.py:253 (staleness gate), :270-294 (unconditional local refresh), enforcement src/tether/runtime/server.py:~2903, soft-fail src/tether/pro/heartbeat.py:~79

Description. load_license never consults the server revocation list; it checks a local last_heartbeat_at, then rewrites it to now on every successful load. The signed payload excludes last_heartbeat_at, so it's freely editable even on a v2 license. Runtime heartbeat network failures are swallowed as "soft failures" and retried silently.

Why it matters. The 24 h freshness gate can never trip as long as the process restarts periodically, and an operator who firewalls the license endpoint keeps a revoked license fully working. Revocation only bites if the worker is reachable and returns 403.

Tasks.

• Require a fresh, server-confirmed heartbeat; fail-closed after a grace window.
• Check the revocation endpoint on load.
• Do not refresh the local heartbeat without server confirmation; include it in the signed payload.

Dedup. PR #229 preserves signed fields but does not add revocation enforcement or server-confirmed freshness.

[rylinjames]

The code fix has merged in PR #312. The real serve --pro path now loads the signed license, starts the verified heartbeat lifecycle, gates every paid admission at the exact deadline, and fails unsupported alternate transports before startup. All seven required CI jobs passed. I am keeping this issue open until the Worker/client rollout is verified in production; this maintenance pass did not deploy or change signer secrets.