GControl

Two halves

GControl is the broker that runs inside your own infrastructure. GPlatform Control is the cloud side of it.

Splitting it this way is deliberate. Self-hosting shouldn't cost you the coordination a hosted control plane gives you, and using a hosted control plane shouldn't mean handing over your keys.

What the broker does

One GControl instance per organisation. It manages licensing, delivery, deployment, health and lifecycle for every G-App that organisation runs, and it is the only host in the deployment that needs outbound internet access.

That last point is the whole design. Everything else in your estate can sit behind a firewall with no route out, and one broker talks upstream on its behalf.

Licensing itself

Licences are per product, and GControl is one of those products. It sells tiers of itself through the same catalog it serves everything else through.

The bottom rung is free, and it is what an unenrolled instance runs forever. A GControl instance works fully with no licence at all. Everything except the licence-dependent features runs standalone with no outbound calls: paid modules, upstream advisories and vendor support sessions are what you lose, and nothing else.

What can never be sold

There is a frozen list of surfaces that cannot be put behind a tier, whatever tier an instance is on, and whether or not its licence has lapsed.

Signing in. Your second factor and your recovery codes. Reading and exporting the audit chain. The compliance export. Taking and restoring backups. Freeze, lockdown and unseal. Installing and removing a licence. Decommissioning the instance.

The list is enforced by a check at registration rather than by review, because a policy that depends on somebody remembering it is not a policy. It is written up in the threat model.

The reasoning is simple enough. A licence lapsing is a commercial event. Being locked out of your own audit log, your own backups, or your own ability to turn the thing off is not something a commercial event should be able to cause.

Layout

The broker is a Fastify service carrying the LAN API that apps talk to, the upstream loop, the job runner, the runtime adapters and the command executor. The admin UI is Next.js.

There is also an agent, a small process that runs on each host your apps run on, so that host never has to expose its Docker socket.

The protocol logic lives in its own framework-free package behind ports and adapters, with the wire contracts, the signing and verification, and the app-side SDK each split out separately. Both sides sign and verify the same artifacts, which is why there is exactly one copy of the lease shape. Two copies is how the halves start disagreeing about what a lease means.

Status

Shipped, and still moving fast.