feat(intel): publish E13/E14/E15 intelligence seams to OSS core

Publish the generic, tier-neutral OSS intelligence base so downstream
consumers resolve it on public main (publish-before-consume):

- pkg/scheduler: E13 recurring-evaluation seam (OSS registers no jobs → no-op)
- pkg/signalsources: prometheus/tempo queriers, registry, metric/trace shapes
- pkg/storage: ModelStore lifecycle (E14) over the base Provider
- pkg/core: typed signal seam (SignalLearner/Detector/Observation/TypedVerdict)
- pkg/agent: brain seam (E15 per-type) + analyze metric/trace query tools
- cmd, config, services wiring; fake-metrics script, helm + docs

All exported funcs covered by *_test.go; go vet + go build clean.

Author: hoalongnatsu

GOVERNANCE.md

@@ -157,6 +157,16 @@ In practice:
 > enterprise-gated. That is the boundary in action: the seam is open, the
 > org-scaling wrapper is paid.
 
+> **"All signal sources" means the log-based sources shipped under MIT**
+> (Elasticsearch, Graylog, Splunk, Loki, CloudWatch Logs, file, …) — these are
+> OSS forever under §1. A **standing metric/trace ingestion source** (a source
+> that polls a PromQL/TraceQL rule each tick to *start* incidents) has **not**
+> shipped under MIT and is a **new** Enterprise capability; only the on-demand
+> `query_metrics`/`query_traces` correlation tools, the shared queriers, and the
+> generic `core.SignalSource` seam + registration hook are OSS. This is the
+> seam-in-OSS / wrapper-in-Enterprise pattern, not a narrowing of the OSS surface
+> (nothing MIT-released moves out).
+
 #### Documentation is part of the open core
 
 The product **documentation content** (the Markdown under `versus-incident/src`)
@@ -172,6 +182,13 @@ build tool that **pulls the public `versus-incident/src` Markdown at build time*
 site deployed to the public docs domain. The renderer may be private; the
 **content it renders must remain in the public MIT repo.**
 
+**Enterprise features are documented (not licensed) in the open.** Enterprise-tier
+capabilities are documented openly on the public docs site — including how to run
+them — for transparency and to show tier value; documenting an Enterprise feature
+publicly does **not** make it OSS, and such pages must clearly label the feature
+as Enterprise and state that running it requires a licensed Enterprise
+distribution.
+
 ### 3. Same binary, license-gated — no open-source bait-and-switch fork
 
 - There is **no fork** of OSS product logic. Community and Enterprise are the

README.md

@@ -15,8 +15,7 @@
 </p>
 
 <p align="center">
-  Free with MIT license · priced on monitored services, never per seat ·
-  <a href="https://docs.versusincident.com/#/pricing">Pricing</a>
+  Free with MIT license · <a href="https://docs.versusincident.com/#/pricing">Enterprise Pricing</a>
 </p>
 
 ![Versus](src/docs/images/versus-dashboard-01.png)

SPONSORS.md

@@ -35,7 +35,7 @@ the two ladders read coherently and never compete:
 | **Backer** | $25 | Individual self-hoster | Name listed in `SPONSORS.md` |
 | **Bronze** | $100 | Small team self-hosting the core | Logo in `README.md` (small) + `SPONSORS.md` |
 | **Silver** | $500 | Mid team self-hosting the core | Logo in `README.md` (medium) + priority issue triage + private Discord channel |
-| **Gold** | $2,000 | Org running the core at scale (≈ Enterprise Starter interest) | Logo in `README.md` (large) + monthly roadmap call (1h) + priority feature review |
+| **Gold** | $2,000 | Org running the core at scale (≈ Versus Enterprise interest) | Logo in `README.md` (large) + monthly roadmap call (1h) + priority feature review |
 | **Platinum** | Custom | Strategic backer / pre-commercial enterprise | Everything above + named integration ("Datadog support sponsored by …") + co-marketing |
 
 Sponsor amounts deliberately sit **alongside, not on top of**, the commercial
@@ -88,36 +88,31 @@ core, **Versus Enterprise** is the commercial tier. It is priced on **monitored
 services, never per-seat**, and billed **monthly**:
 
 - **Versus Enterprise** — self-hosted commercial license for multi-tenant org
-  isolation, SSO/SCIM, RBAC + audit, per-org model gateway, and air-gapped
-  supply-chain packaging. **Enterprise Starter** list **$1,500/mo** →
-  Enterprise ($3,500/mo) → Plus ($7,000/mo+).
+  isolation, SSO/SCIM, RBAC + audit, per-org model gateway, the
+  standing-intelligence metric/trace data source, and air-gapped supply-chain
+  packaging. There is **one tier today — Founding, $199/mo** — the full feature
+  set on the same binary, self-hosted.
 
-### Founding-Customer Beta — Enterprise Starter at $199/mo
+### Founding — Versus Enterprise at $199/mo
 
-**Get in before we're well-known.** We're opening the **Enterprise Starter**
-tier to the **first 10 founding customers** at an introductory self-hosted beta
-price. Low-risk first price, full features, locked in — and a transparent path
-to list price later.
+**Get in before we're well-known.** Versus Enterprise has exactly **one paid
+tier** today: **Founding, $199/mo**, an introductory founding-cohort price for
+the complete self-hosted feature set.
 
-> **Enterprise Starter:** ~~$1,500/mo list~~ → **$199/mo founding-customer
-> beta** — first **10 customers only**, price **locked at $199/mo for 12
-> months**.
+> **Founding:** **$199/mo** — the full Versus Enterprise feature set, self-hosted,
+> your data never leaves your infrastructure. Nothing held back.
 
 - **Full feature set, no asterisks.** Founding customers run the **complete
-  Enterprise Starter feature set — same binary, same features**. The discount is
-  on **price, not capability**; nothing is feature-clipped to reach $199/mo.
-- **Price-locked for 12 months** from signup, then a **published, honest
-  conversion path** — no surprise re-rate:
-  - **Year 2** — $750/mo (founding-loyalty rate)
-  - **Year 3+** — $1,500/mo (Enterprise Starter list)
-  - We send a **60-day pre-renewal notice** before any step-up.
-- **Why act now.** The cohort is capped at **10 customers** and the **12-month
-  lock** is only available to founding signups. Once the 10 seats are filled,
-  Starter is list price for everyone else.
-
-This is the **self-hosted Versus Enterprise beta**. It is **not** the deferred,
-managed **Versus Cloud** tier — the Cloud "Team" price point is a separate
-future offering that is not sold today.
+  Enterprise feature set — same binary, same features**, including the
+  standing-intelligence metric/trace data source. The introductory price is on
+  **price, not capability**; nothing is feature-clipped to reach $199/mo.
+- **One price today.** $199/mo is the only Versus Enterprise price right now.
+  We are **not** quoting a multi-tier list ladder or a hosted Cloud plan — higher
+  self-hosted tiers and Cloud pricing are TBD and not offered yet.
+
+This is the **self-hosted Versus Enterprise** offer. It is **not** the deferred,
+managed **Versus Cloud** product — Cloud pricing is a separate future offering
+that is not sold today.
 
 > A hosted **Versus Cloud** (managed, usage-based SaaS) is a **future** offering
 > built on the same binary. It is **not sold today** — we are shipping and selling

cmd/main.go

@@ -352,6 +352,13 @@ func handlerRedisOptions(rc c.RedisConfig) *redis.Options {
 		DB:       rc.DB,
 	}
 
+	if !rc.TLSEnabled() {
+		// Plaintext Redis (e.g. a local/dev redis:7-alpine): dial without
+		// TLS by leaving TLSConfig nil. Make the downgrade auditable.
+		log.Println("WARNING: Redis TLS disabled (plaintext connection) — intended for dev/local only")
+		return redisOptions
+	}
+
 	if rc.InsecureSkipVerify {
 		// Configure TLS
 		redisOptions.TLSConfig = &tls.Config{

cmd/main_test.go

@@ -0,0 +1,43 @@
+package main
+
+import (
+	"testing"
+
+	c "github.com/VersusControl/versus-incident/pkg/config"
+)
+
+// TestHandlerRedisOptionsTLS covers QA-002: with TLS disabled the Redis
+// client must not set TLSConfig (so a plaintext Redis can connect), while
+// the existing default-on / insecure_skip_verify TLS behaviour is preserved.
+func TestHandlerRedisOptionsTLS(t *testing.T) {
+	tru := true
+	fls := false
+
+	t.Run("tls disabled produces no TLSConfig", func(t *testing.T) {
+		opts := handlerRedisOptions(c.RedisConfig{Host: "localhost", Port: 6379, TLS: &fls})
+		if opts.TLSConfig != nil {
+			t.Fatalf("expected nil TLSConfig when redis.tls=false, got %#v", opts.TLSConfig)
+		}
+	})
+
+	t.Run("tls omitted defaults to TLS", func(t *testing.T) {
+		opts := handlerRedisOptions(c.RedisConfig{Host: "localhost", Port: 6379})
+		if opts.TLSConfig == nil {
+			t.Fatal("expected TLSConfig when redis.tls is omitted (default-on)")
+		}
+	})
+
+	t.Run("tls enabled keeps TLS", func(t *testing.T) {
+		opts := handlerRedisOptions(c.RedisConfig{Host: "localhost", Port: 6379, TLS: &tru})
+		if opts.TLSConfig == nil {
+			t.Fatal("expected TLSConfig when redis.tls=true")
+		}
+	})
+
+	t.Run("tls enabled with insecure_skip_verify", func(t *testing.T) {
+		opts := handlerRedisOptions(c.RedisConfig{Host: "localhost", Port: 6379, TLS: &tru, InsecureSkipVerify: true})
+		if opts.TLSConfig == nil || !opts.TLSConfig.InsecureSkipVerify {
+			t.Fatal("expected InsecureSkipVerify TLSConfig when redis.tls=true and insecure_skip_verify=true")
+		}
+	})
+}

examples/README.md

@@ -12,6 +12,7 @@ runs only the services required for that source.
 |---|---|
 | [docker-compose/file/](./docker-compose/file/) | (none — local file) |
 | [docker-compose/loki/](./docker-compose/loki/) | Loki + Grafana |
+| [docker-compose/metrics/](./docker-compose/metrics/) | Prometheus + loadgen (Tempo optional) |
 | [docker-compose/elasticsearch/](./docker-compose/elasticsearch/) | Elasticsearch + Kibana |
 | [docker-compose/cloudwatch/](./docker-compose/cloudwatch/) | (your AWS account) |
 

examples/docker-compose/README.md

@@ -9,6 +9,7 @@ spun up alongside Versus + Redis.
 |---|---|---|
 | [file/](./file/) | versus + redis | Quickest start; tail a local log file |
 | [loki/](./loki/) | versus + redis + **loki** + **grafana** | Test the `loki` source against a real Loki |
+| [metrics/](./metrics/) | versus + redis + **prometheus** + **pushgateway** | OSS metric/trace **correlation**: `query_metrics`/`query_traces` analyze tools pull host-pushed series during an AI investigation (incident triggered via a `file` log source). All fake data comes from the `scripts/` generators. The standing `prometheus`/`traces` *source* is Enterprise. |
 | [elasticsearch/](./elasticsearch/) | versus + redis + **elasticsearch** + **kibana** | Test the `elasticsearch` source against a real ES |
 | [cloudwatch/](./cloudwatch/) | versus + redis | Test the `cloudwatchlogs` source against your AWS account |
 | [graylog/](./graylog/) | versus + redis + **graylog** + mongodb + opensearch | Test the `graylog` source against a real Graylog |