# ADR-0004 — License: GPL-3.0-or-later

- **Status:** Accepted
- **Date:** 2026-06
- **Closes:** the license open-decision carried in the founding docs

## Context

The founding docs (and the [vision-revision](../superpowers/specs/2026-06-26-vision-revision-design.md)
open-decisions list) left license open. rutster is a self-hosted engine whose competitor set
([ADR-0002](0002-north-star-and-fused-core.md)) includes cloud CCaaS that could *wrap-and-resell*
it as a managed service — the classic strong-copyleft concern.

## Decision

**GPL-3.0-or-later.**

Strong copyleft (requires source-sharing on binary conveyance), OSI-clean, modernized one notch
over Asterisk's GPLv2+. `SPDX-License-Identifier: GPL-3.0-or-later`.

## Alternatives considered

- **AGPL-3.0-or-later** — *considered.* AGPL additionally closes the network-use / SaaS loophole:
  GPLv3 §13 states network use is **not** conveyance (so a hosted service triggers no
  source-sharing obligation); AGPL §13 fixes that, compelling source disclosure for network-served
  use. Given that cloud CCaaS is a named competitor, AGPL would harder-prevent a vendor from
  hosting rutster-as-managed-CCaaS without contributing back.
- **GPL-3.0-or-later was chosen** in favor of simplicity and lower downstream-embedding friction
  (operators and tooling/library authors integrating rutster avoid AGPL's network-trigger), while
  remaining strong copyleft against proprietary forking of the engine itself.

## Trade-off accepted deliberately

A cloud competitor *can* host GPL rutster and owe source only on binary distribution, which for a
hosted service may be nothing. The license is the **floor**, not the moat: the wedge — self-host
+ data-ownership + one auditable boundary + operational simplicity + data-ownership as a buying
criterion — is the actual reason operators self-host rather than wrap.

If cloud-wrap becomes a demonstrated threat, **re-evaluate AGPL-3.0-or-later** (this ADR's
"or-later" clause permits that transition cleanly, since GPL-3.0-or-later is a strict subset of
AGPL-3.0-or-later for recipients).

## Consequences

- **Positive:** OSI-clean strong copyleft in the Asterisk lineage; compatible with the project's
  dependencies (Valkey BSD-3-Clause per [ADR-0005](0005-event-bus.md); Rust-ecosystem MIT/Apache crates).
- **Negative:** the network-use loophole is open **by design choice** — mitigated by the wedge, not
  the license.