Skip to main content

Plans and Limits

Tiers​

TierEvaluations per monthPrice
ProUnlimited$5/month — see accounts.sigmashake.com
EnterpriseUnlimitedContact sales

A valid Pro or Enterprise subscription is required to run ssg. Activate your license after subscribing:

ssg auth login

The evaluation counter is per-device and resets at the start of each calendar month. It is shown for usage reporting; Pro is not capped.

What counts as an evaluation​

One evaluation is one call to the governance engine — one PreToolUse hook firing, or one direct ssg eval call. Both write an audit row and increment the monthly counter. Ambient-rule reads, ssg status, ssg policy status, and other read-only CLI commands do not count.

What happens if the license check fails​

Every code path that runs governance is fail-closed when no verified license exists. A verified Pro or Enterprise license JWT is required. If the check finds none, the engine blocks the call. It does not allow the call through.

This applies to ssg eval, to the PreToolUse hook (ssg hook eval), to the daemon, and to the offline hook fallback. The block result looks like this:

{
  "decision": "block",
  "rule_id": "license-required",
  "reason": "Pro license required: https://billing.sigmashake.com/start-checkout"
}

The block result carries no rule details from the underlying evaluation. The caller learns only that a license is required. To clear the block, activate a license:

ssg auth login

The rationale: failing open would silently remove governance. A temporary block is a better outcome than a silent loss of governance. Governance rules are never weakened by the license check. The check can only turn an allow or ask into a block.

Note 2026-10-11: an earlier version of this page said that the PreToolUse hook fails open and prints "License check failed — allowing through". That behavior existed only in the legacy TypeScript hook. The shipped Go runtime does not allow the call through.

Expiry warnings​

ssg does not print a 7-day or 1-day reminder before a license expires. The only license notice at eval time is the "Pro license required" block shown above. To check your state, run ssg auth status. To re-fetch the license after a subscription change, run ssg auth refresh.

Note 2026-10-13: an earlier version of this page described "7 days" and "1 day" expiry warnings on stderr. The Go runtime has no such warnings.

Checking your usage​

ssg status           # shows this month's eval count and subscription tier
ssg usage            # eval usage, storage and plan limits

The dashboard Overview card also displays this month's eval count in real time.

Subscribing​

Subscribe at accounts.sigmashake.com. Pro gives unlimited evaluations per month.

After subscribing, activate the license on your machine with the device-flow login — there is no key to copy or paste:

ssg auth login       # opens the browser, writes the license automatically

For headless, Docker, Kubernetes, or CI environments where the browser flow isn't available, mint a CLI token in Settings → CLI Tokens and pass it as SSG_API_KEY:

docker run --rm -e SSG_API_KEY ghcr.io/sigmashakeinc/ssg:1.0.7 status

Legacy direct license JWT injection is also supported:

export SSG_LICENSE_KEY="<your-jwt>"

Run ssg status to confirm the tier:

ssg status --json | grep tier

See also​