Apache-2.0 and CC-BY-4.0; DCO; BDFL; no telemetry; no accounts

Context

A community project with one maintainer’s final say needs a license that welcomes contribution and use, a governance model that is written down, and privacy commitments an enthusiast audience will hold it to.

The three plans

• Grok: Apache-2.0 or MIT for original userland; model licenses listed honestly.
• Fable: Apache-2.0 code (patent grant), CC-BY-4.0 docs and themes; BDFL for the first year with GOVERNANCE.md early; sponsors cover hosting, not salaries; Discussions plus one Matrix room.
• Codex: Apache-2.0; CC-BY-4.0 or CC-BY-SA-4.0 for docs; trademark reserved and cleared; no telemetry; no accounts; bring your own key; open source, not a business.

Decision

Apache-2.0 for code. CC-BY-4.0 for documentation (not ShareAlike: documentation ships inside binaries and on-box help, and copyleft text inside Apache binaries is a needless tangle; review). Developer Certificate of Origin, no contributor license agreement. Governance: a single maintainer with final say, area reviewers, ADRs for decisions, RFCs for large changes, a proposals queue for agent-drafted changes, AI-contribution disclosure, key custody in SECURITY.md. Trademark held by the maintainer with clearance against existing “TacID” marks before public branding spend. No telemetry: crash and hardware reports are user-initiated actions. No accounts. Bring your own key. Funding through sponsors for bills only. Versioning: components SemVer, stable releases CalVer YY.MM, channel revisions YYYY.MM.DD-HHMM.

Consequences

• Relicensing later requires every contributor’s consent; this decision is effectively permanent once the first outside contribution lands.
• A commercial fork is permitted; a fork using the name is not.

Alternatives rejected

• GPL/AGPL: stronger guarantees of openness, weaker embedding in the devices “any device” implies; all three plans preferred permissive.
• A CLA: enables relicensing and chills contribution.