Support for a signed pilot.
Policy revision 2026.1-r2 · published text dated with that revision
A signed pilot or OEM agreement gets staffed, manual support. Email and a private case record are the required path. This page states the hours, the severity targets, the maintenance line, and the routes that are not offered.
The full customer text is 2026.1-r2 (SHA-256 ff888c12f00b5f283b19a233b3ea5d19f24bc319994b32c9367b4f9ea130e7bf). This page does not add terms. Where a sentence below and that file disagree, the file wins.
What a signed pilot includes
Revision 2026.1-r2 does not define a separate product named Standard. Paid response objectives apply to enrolled pilot customers. Community users can still report defects, and security intake is available to everyone.
- Path. Email, plus a private manual case record with a human owner. Using the support application is optional. That application is Preview and is not required to meet these objectives.
- Hours. Monday–Friday, 09:00–17:00 Pacific/Honolulu (HST, UTC−10, no daylight-saving change). Company holidays are January 1, July 4, and December 25. A Saturday holiday is observed on the preceding Friday, and a Sunday holiday on the following Monday.
- Clock. One business hour is 60 minutes inside coverage. One business day is eight such hours. Clocks start when any supported route receives the report and carry remaining time into the next coverage window.
What is not offered
- 24×7 response is not offered. Email accepts reports at any time. After-hours reports enter the next coverage window unless a separately acknowledged staffed change window applies.
- No telephone hotline. A call may be arranged in the case thread. Any customer-specific phone route has to be written into the acknowledged pilot handoff.
- No customer portal, public status page, automatic paging service, support marketplace, or automated support product. An automatic email, API response, or machine diagnosis does not count as a first response.
How to reach support
| Purpose | Route | Fallback |
|---|---|---|
| Paid pilot support and incident intake | Email mike@honua.io. Subject: Honua support: <severity> <short impact>. |
Email info@honua.io with the original receipt time, asking for the support owner. |
| Confidential vulnerability or security incident | Email security@honua.io. Subject: Confidential Honua security report. |
Email mike@honua.io and request a secure exchange before sending sensitive evidence. See also the security page. |
| Public, non-confidential product defect | Honua Server issue intake. | Use the support email if GitHub is unavailable or the report needs privacy. A public issue is not the paid queue. Email the issue URL to support to start a paid case. |
Severity and response objectives
Severity follows impact, not account size. Support confirms it at first response. A first response is a human acknowledgement with a case ID, confirmed impact, owner, next action, and next update deadline. Mitigation is a communicated, validated workaround, containment, rollback, or patch. These are objectives, not guaranteed fix deadlines.
| Severity | First human response | Mitigation target from receipt | Update while open |
|---|---|---|---|
Sev1 Critical (critical, p1, sev1) |
Within 4 business hours | Within 1 business day | At each material change and at least every 1 business day |
Sev2 High (high, p2, sev2) |
By next business day | Within 3 business days | At each material change and by the end of each subsequent business day |
Sev3 Medium (medium, p3, sev3) |
Within 2 business days | Within 10 business days | At each material change and at least every 5 business days |
Sev4 Low (low, p4, sev4) |
Within 2 business days | Within 20 business days | At each material change and at least every 10 business days |
Sev1 is a customer incident severity. It is not an engineering backlog priority. A supported production service or essential workflow that is down, with no safe workaround, is Sev1. So is confirmed or credibly suspected unauthorized access, data loss, corruption, or silent wrong results.
Security reports and CVE remediation
General researcher intake, under the organization security policy: acknowledgement within 3 business days, initial assessment within 10 business days, and updates at least every 10 business days. A paid customer's security incident also follows the severity table above. The earlier deadline applies.
There is no separate CVE calendar beyond those targets. A high-impact security fix can ship out of band. Availability of a patch does not change a customer deployment by itself.
Supported versions and patch cadence
After general availability, 2026.1 is the sole supported maintenance line. Support diagnoses the reported released patch. Fixes ship on the latest qualified patch in that line, and a customer may need to update to receive them. The maintenance period is at least 12 calendar months from the actual GA publication date. The GA release notes have to announce that date and the earliest maintenance end date.
Ending support also requires at least 90 calendar days' notice and one full subsequent platform release cycle of notice, with a documented upgrade path. Whether a later line becomes current-plus-previous is decided before 2026.2. This revision does not promise support for a previous minor release.
For the first 90 calendar days after GA, ready fixes are reviewed on a weekly patch train and published only when qualification passes. Out-of-band patches address an outage, a tenant-isolation failure, data loss or corruption, a high-impact security issue, or a severe issue without a safe workaround.
Planned Honua-assisted maintenance gets at least 5 business days' notice in the support thread, and it needs customer approval for the window and for production changes.
Source licenses are a different page
Edition entitlements and source licenses do not set these response targets. Those boundaries are on Editions.