The License Maze

We open-cored Bike4Mind today. Cutting the repo loose was grep and grind — a bug bash, a scrub checklist, a week of mechanical work. The thing that actually kept me up at night was one file: LICENSE.

Because I've watched this industry run both failure modes, live, with money on the table. I watched Redis, Elastic, and HashiCorp flip the table on their own communities — the rug-pull, in slow motion, each one swearing it would never happen right up until the board meeting where it did. And I've watched the opposite corpse too: gorgeous MIT projects with six-figure star counts and zero revenue, while a hyperscaler sells managed hosting of their own code back to their own users. Getting strip-mined by AWS is not a business model. Neither is being loved.

Here's the thing thirty years of shipping games — Starfleet Command, FarmVille, MMOs — beat into me: a license is a ruleset, and rulesets get min-maxed by the most ruthless player at the table, not the nicest. You don't write rules for the community you're hoping for. You write them for the griefers you are absolutely going to get. Every economy I ever shipped got exploited within a week by someone smarter and hungrier than my design doc, and a license is just an economy with lawyers.

So I built this decision the way I'd build a dungeon, and I'm handing you the torch. Walk it. The dead ends aren't filler — the dead ends are the argument.

The five walls

Before I opened a single door I carved five rules into the entrance. Not aspirations — load-bearing walls. Any license that cracks one of them is a wipe, no matter how good it looks on the tin:

Hold those five in your head. Here's the territory.

The map

Now let's actually walk it.

The maze

Pick a door. Every one of these is a door I genuinely stood in front of.

The ratchet, drawn

The mechanism that makes the exit trustworthy deserves its own picture.

The anti-ratchet

One more exhibit before the scorecard, because it's the most instructive room in the whole dungeon — and it isn't even in my maze. It's next door, wearing the open-source halo.

Dify — the biggest "open source" agent platform on the board — ships a modified Apache license that bars you from running a multi-tenant service without their written permission, forbids removing their logo from your own product, and, in its own words, reserves the right to "adjust the agreement to be more strict as deemed necessary." That's a direct quote. Go read it — reading the license instead of the logo is the entire sport here.

Look at what that clause is: a ratchet, pointed the other way. Mine turns toward Apache on a clock no board vote can stop. Theirs turns toward stricter, whenever they deem it necessary, and they had the foresight to write the deciding-otherwise into the license itself. Open until we decide otherwise isn't open. It's a trial with good marketing.

I'm not saying they're bad people. I'm saying they built a trapdoor into the floor and I built a conveyor belt out the front door, and you should know which one you're standing on before you build your product on it.

The scorecard

Every door, against every wall:

The three knobs I could still turn

Even at the exit, there were settings. Here's where I left them and why:

The clock: two years, not one. One year sounds more generous until you run the tape: enterprise deals take about a year to close, so a one-year clock hands a funded competitor my near-current code while my own deals are still sitting in someone's legal queue. That's not generosity — that's shipping an exploit against myself and calling it virtue. Two years is the number Sentry already battle-tested with the FSL.

The carve-out: surgical. The real generosity of a source-available license lives in how narrowly you define the forbidden thing. Ours is one sentence — a competing hosted Bike4Mind service — defined by primary value proposition, not by component reuse. Tight definition means the gray areas default to allowed.

Contributions: steered, not solicited. Wall #3 spares us BSL's ugliest optic — we're not asking volunteers to enrich a license they don't hold. The Apache layer is the natural home for anyone who wants to contribute anyway, and it's real open source the day it ships.

Out of the maze

I couldn't find a more permissive license that still leaves a business standing. So we shipped the most permissive one that does — and put the conversion to Apache on a clock we can't stop.

The rug-pull isn't prevented by our character. It's prevented by the license text.

Read it, run it, fork it, build on it — keep what you kill: bike4mind.com/open. And if you think I took a wrong turn in this dungeon, prove it. The whole point of the arrangement is that you can check my work: every claim survives a git clone.

— Erik