licensing: transition from MIT to dual-license model (PolyForm Shield + Commercial)

[mark-e-deyoung]

Audit Summary

Current State

WineBot and desktop-ui-cv both use the MIT License. Maintenance has no license file.

Dependencies and Their Licenses

Runtime dependencies (by license type):

• MIT — charset-normalizer, Deprecated, h11, ifaddr, pluggy, PyYAML, rfc3339-validator, six
• BSD — httpx (BSD-3), openapi-schema-validator (BSD-3), pywin32-ctypes (BSD-3), Pygments (BSD-2), wrapt (BSD)
• Apache-2.0 — jsonschema-path, openapi-spec-validator, pathable, requests
• MPL-2.0 — certifi
• LGPLv3 — websockify (used for VNC proxy; is a standalone binary, not linked)
• Unknown/NOASSERTION — ~35 packages (annotated-types, anyio, attrs, cffi, click, colorama, cryptography, fastapi, httpcore, iniconfig, jaraco., jsonschema, jwcrypto, keyring, lazy-object-proxy, more-itertools, numpy, packaging, pillow, pluggy, pycparser, pydantic, pytest, python-multipart, redis, referencing, rpds-py, starlette, typing-, urllib3, uvicorn, zeroconf)

Key concern: websockify is LGPLv3. LGPLv3 requires that any modifications to the library itself be shared, and allows reverse engineering for debugging. Since WineBot uses websockify as a standalone process (not linked/integrated), this is likely a "mere aggregation" and the LGPL does not "infect" the WineBot codebase. However, the LGPLv3 notice must be preserved in distribution.

System dependencies (Docker):

• Debian Trixie — various licenses (GPL, LGPL, BSD, MIT). These are system-level dependencies not linked into WineBot code.
• Wine — LGPL (standalone Windows compatibility layer, not linked)
• AutoIt/AHK — freeware (standalone binaries, not linked)
• WinInspect — MIT (standalone tool, not linked)

Project Characteristics

• Containerized — runs as Docker image on GHCR; distribution = image pulls
• Python-based — FastAPI server; pip dependencies
• Public repo — visible for audit; invite-only contributions
• Invite-only governance — only approved collaborators can contribute
• No CLA — no Contributor License Agreement exists
• Dual-purpose — open source for audit + commercial licensing for author income

Requirements

1. ✅ Open source for auditability by others
2. ✅ Commercial releases by author for income
3. ❌ Others must be prohibited from commercial reuse/resale without consent
4. ❌ Corporations/governments/organizations must have commercial license
5. ✅ Private individuals can use without commercial license
6. ❌ Liability protection for author (MIT already disclaims warranty, but can be stronger)
7. ❌ User must accept all liability for use

Recommendation: PolyForm Shield 1.0.0 + Commercial Licenses

PolyForm Shield 1.0.0 is a noncommercial license specifically designed for this exact pattern:

• ✅ Free for individuals and all non-commercial use
• ✅ Organizations (businesses, governments) need a commercial license for any commercial use
• ✅ Strong liability disclaimer
• ✅ No patent grant to organizations without a license (extra protection)
• ✅ Specifically designed for "source available + commercial license" model
• ❌ Not OSI-approved (not "open source" by OSI definition, but source-code-available)

Verdict: PolyForm Shield best matches your requirements. It is source-available (auditable) but restricts commercial use by organizations. You sell commercial licenses to organizations.

Concerns

1. Not OSI-approved — You cannot call it "Open Source" officially. You can say "source-available."
2. Websocket (LGPLv3) — The LGPLv3 notice from websockify must be preserved if you distribute the Docker image. This is compatible with PolyForm Shield.
3. Compatibility with other projects — If you want code from WineBot used in other OSS projects, PolyForm Shield prevents that.

Proposal

Phase 1: WineBot License Change (MIT → PolyForm Shield)

• Replace LICENSE file
• Update README with licensing badge and commercial licensing info
• Create CONTRIBUTORS.md / CLA for future contributions
• Preserve websockify LGPLv3 attribution

Phase 2: Create Commercial License Template

• Standard commercial license with indemnification, support tiers
• Publish contact/inquiry method (email or website)

Phase 3: desktop-ui-cv License Alignment

• Sync desktop-ui-cv to same license model
• The CV sidecar is separable and independently licensable

Phase 4: Maintenance Repo License

• Add a license (MIT or PolyForm Shield depending on content)