[S4] Pro revocation never enforced offline; local heartbeat self-refreshes

[DsThakurRawat]

Labels: security, bug, pro, priority:high
File: src/tether/pro/license.py:253 (staleness gate), :270-294 (unconditional local refresh), enforcement src/tether/runtime/server.py:~2903, soft-fail src/tether/pro/heartbeat.py:~79

Description. load_license never consults the server revocation list; it checks a local last_heartbeat_at, then rewrites it to now on every successful load. The signed payload excludes last_heartbeat_at, so it's freely editable even on a v2 license. Runtime heartbeat network failures are swallowed as "soft failures" and retried silently.

Why it matters. The 24 h freshness gate can never trip as long as the process restarts periodically, and an operator who firewalls the license endpoint keeps a revoked license fully working. Revocation only bites if the worker is reachable and returns 403.

Tasks.

• Require a fresh, server-confirmed heartbeat; fail-closed after a grace window.
• Check the revocation endpoint on load.
• Do not refresh the local heartbeat without server confirmation; include it in the signed payload.

Dedup. PR #229 preserves signed fields but does not add revocation enforcement or server-confirmed freshness.