Skip to content

License recommendation — decision record draft

We are preparing for an eventual open source release. No license is granted or applied by this document. Do not copy license text into private repositories as part of preparation.

Recommendation: Apache License 2.0

Apache-2.0 is an OSI-approved permissive license with an explicit contributor patent grant and patent-termination provisions. Its familiar terms suit enterprise adoption while allowing commercial use and modification. Its notice and attribution obligations need to be preserved. It is a good default for the planned engine and node agent, subject to ownership and dependency review.

MIT is a simpler permissive alternative, but does not express the same explicit patent grant. Choose it only after weighing that trade-off. Existing repositories may have their own licenses; inventory those rather than overwriting them. A repository may need a different decision because of third-party obligations.

Contributions

Recommend DCO sign-off, not a CLA, as the initial contribution-rights process. DCO is a provenance certification, not a substitute for a project license or rights audit. Confirm copyright ownership, employer permissions, and any contractor agreements before adopting it. Counsel should review patent and contribution-rights questions.

Before any repository goes public

  • Approve exact release scope and license with the rights holders.
  • Audit direct and transitive dependencies, vendored code, copied snippets, datasets, fonts, images, and brand assets; record licenses and required notices in an inventory/SBOM.
  • Check copyleft compatibility and any redistribution restrictions; prepare NOTICE/attribution files where required.
  • Scan the entire Git history and all publishable branches/tags for secrets, personal data, customer information, and private infrastructure. Rotate exposed secrets; deletion alone is not remediation.
  • Review workflows, release artifacts, package metadata, and deployment hooks for accidental publication or production access.
  • Approve supported versions, maintainers, vulnerability intake, and release gates.
  • Only after explicit launch approval, add the selected LICENSE and notices to the approved release branches. Do not change visibility automatically.

References: https://opensource.org/license/apache-2-0 · https://opensource.org/license/mit · https://developercertificate.org/