Skip to content

ADR 0031 — Distribution licensing: free open-source (MIT) + customer-deployed BYOL

  • Status: Accepted
  • Date: 2026-07-09
  • Deciders: @TheurgicDuke771
  • Amends: ADR 0013 (the §5 "licensing model + entitlement/license-key" line and the licensed-revenue framing of BYOL)

Context

ADR 0013 chose customer-deployed BYOL as the marketplace distribution model and deferred the commercial/legal scope to the post-v1 initiative, listing "licensing model + entitlement/license-key (we are not metering under BYOL)" among the open items (§5). The 2026-07-09 marketplace-readiness review (issue #732) surfaced the tension that line carries: the repository is already published under the MIT license, which grants everyone the right to use, copy, modify, distribute, and sell the software — a paid-entitlement model layered on top would be incoherent (you cannot sell a key to rights the license already gives away), and retrofitting a restrictive license onto an already-public MIT repo only gets harder with time and adoption.

The same review ran a full dependency license audit against the actual installed trees (not declared metadata alone):

  • Backend — 239 packages in the conda env: zero strong-copyleft or source-available licenses. Core stack: Great Expectations, FastMCP, the Snowflake/Databricks connectors, pyiceberg, boto3, pyarrow, OpenTelemetry (Apache-2.0); FastAPI, SQLAlchemy, Pydantic, Alembic (MIT); Celery, uvicorn, pandas, numpy (BSD). Weak copyleft only: psycopg2-binary (LGPL-3.0, dynamically linked), certifi/pathspec (MPL-2.0, file-level).
  • Frontend — 643 packages in node_modules: zero strong copyleft. dompurify is dual-licensed MPL-2.0 OR Apache-2.0 (Apache elected); lightningcss (MPL-2.0) is build-time only and never distributed; @fontsource/* fonts are OFL-1.1 (standard for bundled web fonts).

So the only distribution-compliance obligation is notice preservation (MIT/BSD copyright lines, Apache-2.0 NOTICE content) — there is no copyleft constraint on the model.

Decision

  1. DataQ is and remains free open-source software under the MIT license. There is no paid license, no entitlement check, and no license-key machinery — this ADR supersedes the "licensing model + entitlement/license-key" line of ADR 0013 §5 and ADR 0013's licensed-revenue framing of BYOL (the comparison table's "billed outside the meter", the Consequences' "revenue is licensed outside the meter", the Alternatives' "approximate with BYOL licensing"): there is no license revenue at all. ADR 0013's distribution model (customer-deployed BYOL), the Azure→AWS/GCP phasing, and the anti-lock-in guardrails stand; under this decision "BYOL" reads as bring your own (free, MIT) license — the customer deploys the OSS into their own account, and no marketplace metering or entitlement integration is needed.
  2. Marketplace listings are free/BYOL offers of the OSS artifacts (the public GHCR images — ADR 0023 for the backend, ADR 0028 for the frontend — plus the portable install artifact when it lands). Listings still require seller registration, per-marketplace certification, and the listing's legal terms (e.g. Partner Center requires attached license terms even for free offers), but not commerce integration.
  3. Distribution compliance = notices, wired into the release path. Container images and GitHub releases ship a THIRD-PARTY-NOTICES file (or an SPDX SBOM carrying license data) covering the bundled dependency licenses; generation is automated in CI/publish rather than hand-maintained (tracked in #732).
  4. Dependency license guardrail (standing, binding on future PRs): the dependency tree stays free of strong-copyleft and source-available licenses (GPL, AGPL, SSPL, BUSL/Elastic, Commons-Clause). Weak copyleft (LGPL/MPL/EPL) is acceptable with notice. Adding a dependency that violates this needs an explicit ADR-level exception. Distilled into CONTRIBUTING rule 40 (this PR), which schedules the license sweep alongside the rule-39 quarterly supply-chain audit and before any release/image publish.
  5. Monetization, if it ever happens, is built beside the OSS, not into it — support/services, a hosted offering, or commercially-licensed additions; never retroactive enforcement against the MIT core.

Consequences

Positive

  • No entitlement/license-server build — the commercial build items ADR 0013 carried disappear; the marketplace path reduces to packaging + certification + the listing's legal terms. The rest of ADR 0013 §5's commercial/legal surface survives with per-item keep/defer/drop dispositions recorded in #732 (listing terms/EULA kept; DPA and tax/banking not needed while there is no hosted/paid tier — recorded, not dropped; SOC 2 / pen test remain an enterprise-buyer ask independent of price).
  • Free offers are the lowest-friction marketplace listing type (no metering/transaction integration), and the OSS grant maximizes eval→adoption conversion — consistent with the anti-lock-in posture of ADR 0010/0013.
  • One coherent license story: repo, images, and marketplace artifact all carry the same MIT grant; the audit above confirms nothing in the tree contradicts it.

Negative / accepted trade-offs

  • No direct license revenue, and anyone may fork, rebrand, or resell DataQ — inherent to MIT and accepted knowingly; the countermove is execution and trust, not license enforcement.
  • Free users still generate support expectations — set them explicitly (SUPPORT.md, community channels; a #732 checklist item).
  • A future pivot to a restrictive license would be practically irreversible for already-published versions; this decision treats that door as closed.

Alternatives considered

  • Dual licensing (AGPL + commercial) — rejected. AGPL chills exactly the enterprise/self-hosted adoption BYOL targets, and dual licensing requires CLA overhead plus ownership discipline over every contribution for the commercial grant to stay clean.
  • Source-available (BSL/Elastic-style) — rejected. Not open source, adds marketplace-certification and procurement friction, and contradicts the stated intent of a free OSS offering; also awkward to apply retroactively to an already-MIT repo.
  • Proprietary core + free tier with entitlement keys — rejected. This is precisely the machinery ADR 0013 hoped to scope and this review found incoherent against the existing MIT grant; it would also forfeit the OSS adoption channel.
  • Keep MIT but sell entitlement keys anyway — rejected as legally incoherent: MIT already grants every right a key would gate.
  • ADR 0013 — the BYOL distribution decision this ADR completes; its §5 licensing-model line and its licensed-revenue framing are superseded here (see the amendment note at its top), the distribution model/phasing/guardrails stand.
  • ADR 0023 / ADR 0028 — the public GHCR backend and frontend images, the free distribution channel.
  • Issue #732 — marketplace-readiness checklist (license-audit record, THIRD-PARTY-NOTICES/SBOM automation, SUPPORT.md, G-h/G-i prerequisites).