ADR-0006: AGPLv3 license

• Status: Accepted
• Date: 2026-07-11
• Clarified by: ADR-0033

Context

The license decides whether the codebase can be enclosed. A privacy project's worst failure mode is becoming the engine of a proprietary, telemetry-laden fork.

Decision

GNU Affero General Public License v3.0 (AGPL-3.0-only) for all project-authored software. Documentation, specifications, screenshots, fonts, logos, artwork, and third-party assets require the explicit inventory and policy tracked by stabilization gate P1-05; their presence in the repository is not silently treated as proof of ownership or compatible relicensing.

Alternatives considered

• MIT/Apache-2.0 dual: maximum adoption, Rust-ecosystem default, and explicit permission for closed, surveillance-friendly forks. Rejected on mission grounds.
• MPL-2.0: file-level copyleft middle ground; still allows the app around the core to be closed and hostile.
• GPLv3: strong copyleft, but the network-service loophole matters here: relays and gateways are services, and AGPL's remote-interaction clause is exactly the coverage a serverless-but-relayed architecture needs.

Consequences

Anyone may use Komms, including companies and governments. When AGPL section 13 applies, an operator of a modified covered version that supports remote network interaction must prominently offer the interacting users that version's Corresponding Source. Distribution obligations apply under the exact license terms.

The license does not prohibit surveillance or commercial use, automatically cover every separate interoperating service, guarantee general-public publication, or prove that a deployed binary matches offered source. Some corporate contributors and proprietary integrators may abstain because of the strong reciprocal terms; preserving that reciprocity is the intended trade.