Continuity

What happens to your install, your evidence, and your access to the source if KordLoom disappears tomorrow. Vendor risk reviews ask this of every vendor, so here is the whole answer in one place.

Your install keeps running

The binary is self-hosted and self-contained. There is no license server, no online activation, and no phone-home, so nothing stops working when the vendor does. A paid license keeps verifying offline through the end of its term. When a term lapses, its paid features and services stop and nothing else does: your data, your evidence, and every Community feature keep working.

Your evidence stays verifiable forever

Every audit bundle and run receipt verifies offline with the open verifier, against the open LoomSeal format. Verification needs no KordLoom service, no network, and no permission. Evidence you exported years ago verifies the same way on the day an auditor asks. The witness command ships in the binary itself, so a countersigning witness can be run by anyone, including you.

The source outlives the vendor

Three layers, strongest first:

1. Every release attaches its own source tarball as a release asset, listed in the signed SHA256SUMS manifest beside the binaries. Keeping a release means keeping its exact source. The code of each release before v1.101.0 is kept in this repository as a snapshot/vX.Y.Z tag.
2. The license converts. Each release becomes Apache 2.0 two years after it ships, automatically, with no trigger event, agent, or dispute. The conversion is written into the license itself, and into an irrevocable supplemental grant, LICENSE-GRANT.md, covering the versions released before the license file carried the two-year wording.
3. You can mirror the repository today, and you should if the software matters to you:

git clone --mirror https://github.com/kordloom/switchtender.git
cd switchtender.git && git fetch --all --tags   # repeat on a schedule

Under BSL 1.1 you may copy, modify, and run the source in production for your own organization right now. Continuity does not wait for the conversion date.

This is also the answer to source code escrow. Escrow exists to hand you the code, and the right to keep using it, if the vendor goes under. You already have both: the source is public now, and the continuity clause makes every published version Apache 2.0 on the day it triggers, with no escrow agent in between.

What degrades on vendor death

Honesty requires the other column. Vendor-operated services stop: hosted witness countersignatures, scheduled delivery of paid evidence packs, and support. Each has a self-service equivalent in the free binary for two of the three (run your own witness, and lean on the community), while the scheduled evidence packs have only their raw material free: the per-run dossiers, receipts, and signed bundles the free binary always emits (the change register that assembles them on a cadence is itself Team), but the operated versions are what a subscription buys, and they end with the vendor.