Adopt AGPLv3 and offer matching client and service source - #68
Conversation
Signed-off-by: Fredrik Ahlgren <fredrik@sourceful-labs.com>
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
ftw-webapp | ab00b0b | Commit Preview URL Branch Preview URL |
Sep 12 2026, 01:38 PM |
Signed-off-by: Fredrik Ahlgren <fredrik@sourceful-labs.com>
Signed-off-by: Fredrik Ahlgren <fredrik@sourceful-labs.com>
Signed-off-by: Fredrik Ahlgren <fredrik@sourceful-labs.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Bugbot couldn't run - usage limit reachedBugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit. A user or team admin can review and increase usage limits in the Cursor dashboard. (requestId: serverGenReqId_67176398-4d12-49a4-9a17-6ff4f17ad26b) |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ab00b0b8e2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| "ftw-webapp": minor | ||
| --- | ||
|
|
||
| Adopt AGPLv3 with a narrow Energyplan combination permission and expose source access. New Energyplan workers use separate private-household terms; commercial use and distribution require a Sourceful license. Earlier grants remain unchanged. |
There was a problem hiding this comment.
When this changeset is published as release notes, the unqualified statement that “commercial use and distribution require a Sourceful license” implies that this applies to the AGPL-covered app and to all redistribution. That contradicts LICENSING.md, which permits selling the AGPL software and permits free noncommercial redistribution of new Energyplan workers. Limit this clause explicitly to commercial use, bundling, resale, or services involving the restricted Energyplan binaries so users are not told their granted rights are narrower than they are.
Useful? React with 👍 / 👎.
1 participant
The client, relay and escrow now use AGPLv3 with the narrow Energyplan permission, while NOTICE preserves earlier Apache rights. The client offers source for its build revision and includes the complete license and earlier notices in a separate precached chunk, loaded when the license menu opens. The initial JavaScript remains within the 90,000-byte gzip budget (76,341 bytes locally).
Relay and escrow images create source archives during the build, before runtime state exists. GET /source serves the archive; HTTP responses and relay WebSocket handshakes advertise it. The archive retains build paths, Dockerfiles and deployment files; relay also includes the installed dependency source and lockfile. Downloads never traverse runtime data.
Validation: Svelte check, 1,033 tests and production build passed. Two runs under high concurrent load timed out in unchanged escrow timing tests; the full suite passed with
--maxWorkers=2. Both Docker builds and HTTP smoke tests passed. Tests inserted runtime sentinel files, verified their exclusion, compared source files with the checkout and rebuilt both images from downloaded archives. Local browser review passed.Contribution guidance welcomes external PRs and requires new contributions to carry AGPL-3.0-only with the Energyplan permission. DCO sign-off grants no copyright assignment or commercial relicensing rights. NOTICE preserves the Apache-licensed default-branch snapshot at
1ae2390b7bea4986d01500c90c33a914833b3801, including its exact prior license and any prior notice.Relay and escrow READMEs explain AGPL commercial use, the matching-source endpoint and source obligations for modified hosted versions.
This is part of the FTW license transition: AGPL-3.0-only for the open code, with a narrow section 7 permission for the proprietary Energyplan workers. Energyplan Home Use terms apply only to new workers; AGPL commercial use remains permitted. Prior Apache, MIT and Energyplan grants remain available, and third-party terms remain intact.
Automated legal review checked license scope, retained notices, source offers, the Energyplan boundary, commercial installer use and source packaging. It is not a human legal opinion and does not establish copyright assignments or app-store compatibility. Commercial rights can be offered only for software and rights Sourceful controls.
Paired PRs:
Note
Medium Risk
License and distribution obligations change for all consumers and operators; relay/escrow add new HTTP routes and Docker build steps, though runtime behavior of core protocols is largely unchanged.
Overview
Replaces Apache-2.0 with AGPL-3.0-only for this repo, plus a narrow Energyplan combination permission in
LICENSE.NOTICErecords the 2026-09-12 transition and keeps the prior Apache grant for the pinned snapshot;LICENSING.mdandCONTRIBUTING.mdspell out redistribution, Energyplan boundaries, and that new contributions are AGPL-only (DCO does not assign copyright).AGPL source offers in the product: the web client adds a Source & licenses footer (
SourceNotice) with a GitHub archive link keyed to__APP_BUILD__, and lazy-loads fullLICENSE/NOTICEtext from a separate chunk.package.jsonnow points atSEE LICENSE IN LICENSE.Relay and escrow containers bake a build-time
source.tar.gz(no runtime data), serve it atGET /source, and advertise it viaLinkheaders (relay also on WebSocket upgrade). Service READMEs document operator obligations for modified hosted builds.Reviewed by Cursor Bugbot for commit ab00b0b. Bugbot is set up for automated code reviews on this repo. Configure here.