0004. License the core under the AGPL and the clients under MIT

• Status: accepted (the -only / -or-later variant is provisional), revised after the structure review (round 1)
• Date: 2026-10-26

Context

The analysis (chapter 20) decided on AGPL-3.0 for the core and MIT for the SDK and client libraries. GuestCraft is distributed as source: whoever installs it runs it, so the AGPL guarantees that a modified network service shares its changes, while MIT clients let anyone integrate without license concerns. Two details were left open: the exact AGPL variant, and how to keep the two licenses from leaking into each other.

Decision

• Core and applications: AGPL-3.0-only, provisionally. The choice between AGPL-3.0-only and AGPL-3.0-or-later is confirmed with a lawyer before the first public release; until then the repository is private and the identifier can change in one commit.
• Clients and shared libraries (channex-client, channex-simulator, identity-provider-simulator, webhooks, sdk, react, tokens, i18n, testing, tsconfig): MIT.
• Public contracts: GuestCraft’s own OpenAPI document in openapi/, the descriptions and examples it carries, the event and webhook schemas, and the code generated from them are MIT, so that the SDK and any third-party client can be redistributed freely. The implementation that serves them stays AGPL.
• Direction: an AGPL package may depend on an MIT package, never the reverse. Two checks enforce it: a script reads every package.json (declared dependencies), and a dependency-cruiser rule rejects any import, including relative and type-only ones, from an MIT package into an AGPL one. Before an MIT package is published, its packed tarball is installed in an isolated consumer, and the closure of its runtime and type dependencies is checked again.

• Per-file licensing with REUSE 3.3: every source file carries SPDX-FileCopyrightText and SPDX-License-Identifier headers; files that cannot carry comments (JSON, images, the PDF) are covered by REUSE.toml. License texts live in LICENSES/, and reuse lint runs in CI.

• Third-party material keeps its license and attribution. The Contributor Covenant is CC-BY-SA-4.0. The Channex OpenAPI specification declares no license and is therefore not committed (ADR 0006).
• Contributions are accepted under the Developer Certificate of Origin (git commit -s). No CLA: one would be needed only for dual licensing. The DCO check is enabled when the repository opens to outside contributors.

Consequences

• Every new file needs a header; the editor template and reuse annotate make it cheap, and reuse lint makes it impossible to forget.
• The license check prevents the most likely accident: an MIT package importing a helper from the core.
• Whoever runs a modified GuestCraft for others must offer its source: the dashboard and the guest pages link to the source of the running version.

Alternatives considered

• MIT or Apache-2.0 everywhere. Rejected in the analysis: a hosted fork could close the source.
• BSL or FSL. Not open source; incompatible with the goal.