docs: the engine stays free and open, in plainer words

CONTRIBUTING.md

@@ -154,10 +154,11 @@ This is not an anti-AI policy. It is a "stand behind your work" policy.
 
 ## What belongs in this repository
 
-Everything. Socair is developed entirely in the open, with no closed or paid
-edition: the engine and checks, the report format, signing and verification,
-the airlock, the integrations, and the reference data a feed carries. Checks
-that need GPUs or the network land here too, behind an explicit opt-in.
+Everything Socair does. It is developed in the open, and no check is held
+back for anything else: the engine and checks, the report format, signing and
+verification, the airlock, the integrations, and the reference data a feed
+carries. Checks that need GPUs or the network land here too, behind an
+explicit opt-in.
 
 ## Code of conduct
 

GOVERNANCE.md

@@ -52,8 +52,11 @@ can alter a verdict.
 
 These hold for as long as Defilan maintains Socair:
 
-- **No paid edition.** Every feature is in this repository under Apache-2.0.
-  Nothing is held back for a commercial version.
+- **The engine stays free and open.** Every check, and everything needed to
+  scan, sign, verify, and gate a model, is in this repository under
+  Apache-2.0, and stays here. Defilan may offer products and services built
+  on Socair. They are not a paid edition of it, and none of them holds a
+  check back from this repository.
 - **Defilan never issues attestations for others.** The issuer of an
   attestation is whoever signs it, with their own key. An unsigned report
   says that no one has signed it. Socair, the tool, is never the issuer of a

README.md

@@ -235,9 +235,9 @@ what they do not check.
 
 Socair is open source under the Apache License 2.0, all of it: the engine and
 every check, the report format, signing and verification, the airlock, signed
-acceptances and feeds, the wizard and console, and the integrations. There is
-no paid edition and no feature held back. The work still to come, including
-checks that run the model on your own GPUs, is built here in the open.
+acceptances and feeds, the wizard and console, and the integrations. It is
+free, and every check stays here. The work still to come, including checks
+that run the model on your own GPUs, is built here in the open.
 
 ## Documentation
 

ROADMAP.md

@@ -132,7 +132,8 @@ Still to come:
 
 - **Scanning agent skills, MCP servers, or other agent artifacts.** Socair
   checks model artifacts.
-- **A hosted service or a paid edition** ([GOVERNANCE.md](GOVERNANCE.md)).
+- **A paid edition of the engine.** Every check stays here, free
+  ([GOVERNANCE.md](GOVERNANCE.md)).
 - **Saying a model is free of backdoors.** Socair reports what it inspected
   and lists what it cannot see in its
   [detection ceiling](docs/detection-ceiling.json).

SUPPORT.md

@@ -12,5 +12,4 @@
   [SECURITY.md](SECURITY.md) describes. Never in a public issue, discussion,
   or pull request. A malicious file that earns a PASS is a detection bypass.
 
-Socair has few maintainers, so an answer can take a few days. There is no paid
-support.
+Socair has few maintainers, so an answer can take a few days.

docs/brand.md

@@ -20,8 +20,10 @@ Socair and the cairn logo are trademarks of Defilan Technologies.
 ## Positioning
 
 Socair is an open-source project from Defilan Technologies, under
-Apache-2.0, with no paid edition. The trademark keeps the name: anyone may use,
-change, and ship the code, but only the project ships something called Socair.
+Apache-2.0. The engine and every check stay free. Defilan may offer products
+built on it under the same name; they build on the open engine and hold no
+check back from it. The trademark keeps the name: anyone may use, change, and
+ship the code, but only Defilan ships something called Socair.
 
 LLMKube remains the open-source serving platform. Socair carries its own name
 under Defilan, not an LLMKube prefix, which leaves room for a product family