# ADR-0004 — License: GPL-3.0-or-later

- **Status:** Accepted
- **Date:** 2026-06
- **Closes:** the license open-decision carried in the founding docs

## Context

The founding docs (and the [vision-revision](../superpowers/specs/2026-06-26-vision-revision-design.md)
open-decisions list) left license open. rutster is a self-hosted engine whose competitor set
([ADR-0002](0002-north-star-and-fused-core.md)) includes cloud CCaaS that could *wrap-and-resell*
it as a managed service — the classic strong-copyleft concern.

## Decision

**GPL-3.0-or-later.**

Strong copyleft (requires source-sharing on binary conveyance), OSI-clean, modernized one notch
over Asterisk's GPLv2+. `SPDX-License-Identifier: GPL-3.0-or-later`.

## Alternatives considered

- **AGPL-3.0-or-later** — *considered.* AGPL additionally closes the network-use / SaaS loophole:
  GPLv3 §13 states network use is **not** conveyance (so a hosted service triggers no
  source-sharing obligation); AGPL §13 fixes that, compelling source disclosure for network-served
  use. Given that cloud CCaaS is a named competitor, AGPL would harder-prevent a vendor from
  hosting rutster-as-managed-CCaaS without contributing back.
- **GPL-3.0-or-later was chosen** in favor of simplicity and lower downstream-embedding friction
  (operators and tooling/library authors integrating rutster avoid AGPL's network-trigger), while
  remaining strong copyleft against proprietary forking of the engine itself.

## Trade-off accepted deliberately

A cloud competitor *can* host GPL rutster and owe source only on binary distribution, which for a
hosted service may be nothing. The license is the **floor**, not the moat: the wedge — self-host
+ data-ownership + one auditable boundary + operational simplicity + data-ownership as a buying
criterion — is the actual reason operators self-host rather than wrap.

> **Amended 2026-07-03** (maintainer-ratified; origin:
> [adversarial review D5](../reviews/2026-07-03-adversarial-review.md)). The paragraph this note
> replaces claimed the "or-later" clause permits a clean later transition to AGPL. **That claim
> was wrong:** "or-later" covers later versions of the *GNU GPL* (GPLv3 §14); AGPL is a different
> license, not a later GPL version — GPLv3 §13 permits *combining* with AGPL works, not
> relicensing GPL code as AGPL. Relicensing requires the consent of every copyright holder, so
> the option would die at the first external contribution accepted without a CLA.
>
> **Resolution:** rutster accepts **GPL-3.0-or-later permanently** for the engine. No CLA — the
> contributor friction and community optics were judged worse than the loss of a relicensing
> option. Cloud-wrap remains a named, accepted risk mitigated by the wedge, exactly as the
> trade-off paragraph above already argued. (The tap *protocol spec* and client SDKs are
> intended to be permissively licensed for adoption — engine GPL, protocol permissive — to be
> ratified in the tap-protocol ADR when that interface hardens.)

## Consequences

- **Positive:** OSI-clean strong copyleft in the Asterisk lineage; compatible with the project's
  dependencies (Valkey BSD-3-Clause per [ADR-0005](0005-event-bus.md); Rust-ecosystem MIT/Apache crates).
- **Negative:** the network-use loophole is open **by design choice** — mitigated by the wedge, not
  the license.