Licensing

Commission is proprietary. The repository is private. All rights reserved.

See LICENSE LICENSE for the terms.

This page records the decision, why it overrides the recommendation in business-model.md docs/business-model.md, and — more usefully — what it changes about how Commission has to be built.

The decision

Commission is a commercial product. It is not open source, not source-available, and the repository is not public. Distribution is by compiled binary under a commercial agreement.

The business-model document recommended Apache-2.0. That recommendation was considered and overridden by the owner, for a reason the analysis underweighted: Commission is not a component, it is the coordination layer a company would run its engineering through. A permissive licence on that is giving away the product, not seeding a channel.

The counter-arguments in business-model.md §6 stand and are not withdrawn. They are consequences to manage, listed below, rather than reasons to revisit.

What this changes about building Commission

Three of them are load-bearing. This is the section that matters.

1. In-product teaching is now the entire teaching surface

The strongest argument for openness was corpus presence: an agent’s ability to operate Commission correctly is a function of how much Commission text exists publicly. A private repository means there will be none. No source in training data, no forks, no Stack Overflow answers, no other people’s CLAUDE.md files.

Every model that ever operates Commission will learn it from exactly three places:

1. commission prime — the operating manual the CLI prints
2. MCP tool descriptions — what a model reads before choosing a tool
3. Refusal messages — what it reads when it gets something wrong

That is the whole channel. It moves those three from “nice polish” to the product’s primary interface, and it means a vague tool description or a lazy refusal is not a cosmetic problem — it is the only lesson the model will ever get. Budget accordingly.

2. Distribution has to be built for proprietary binaries

• Homebrew core will not accept a proprietary formula. A private tap is required, which relay-52 already plans — but it must be a cask or a binary-only formula, never a build-from-source one.
• npm can host it, but only as a package that downloads or embeds a binary. The source tree must never be published. package.json is therefore marked private: true and license: UNLICENSED, which makes accidental publication fail loudly rather than silently succeed. A separate, minimal distribution package is needed for relay-52.
• Container images are fine and unaffected.
• The install script is fine, and becomes the most important path, because it is the only one with no third-party policy in the way.

3. Nothing may point at a public repository

No “View on GitHub” link, no “edit this page” link, no issue tracker URL, no repository field pointing somewhere a reader cannot go. A 404 is worse than an absence: it reads as broken rather than deliberate. The marketing site already handles this correctly and must keep doing so.

Nothing is free

Commission is a paid product. There is no free tier and no trial. A valid licence is required from the first command.

This overrides business-model.md docs/business-model.md §2 and §4, which recommend a free-forever local tier and price it at $0. That analysis is kept rather than edited into agreement — it is sound work and the reasoning is worth reading — but its conclusion is superseded by the owner, for the same reason the licence recommendation was: this is the coordination layer a company runs its engineering through, and giving the whole of it away is giving away the product.

The argument being overridden, stated properly

business-model.md’s case for a free local tier is not a pricing preference. It is an engineering claim, and it is a good one:

Commission’s distribution runs through agents installing it. An agent cannot complete a signup, accept a EULA, or reason about a quota. Every gate on the local path is a hard stop, not friction.

Every word of that is true, and it does not survive as an argument against charging — it is an argument about the shape of authentication. A human authorises once, the machine holds the credential, and every agent on that machine inherits it. That is how gh and the Stripe CLI work, and it is what commission login (relay-91) implements.

What it costs, and what that obliges

Being honest about the consequence rather than filing it under “solved”:

An agent that reaches an unlicensed machine stops. It cannot sign up, cannot accept terms, and must not sit waiting on stdin that nobody will type into. So the licence refusal is held to a higher standard than any other refusal in the product: it has to name the exact command a human runs, be legible to a model relaying it to a person, and never — under any circumstance — block on input.

That is a real cost of this decision and it is paid in refusal quality. It is also why relay-90 verifies licences offline for a bounded period: a per-command call to a licence server would put a vendor’s uptime between an agent and its work, which is the failure this product exists to remove.

How long revocation takes

Offline verification bought that independence and cost the ability to stop a licence at all. Short-lived entitlements buy it back without giving the independence up, and the numbers are stated here rather than implied because somebody deciding whether a leak needs a key rotation has to know how long the leaked token stays usable.

Licence	long-lived, verified offline, never phones home
Entitlement	signed, short-lived, refreshed in the background
Entitlement lifetime	12 hours (COMMISSION_ENTITLEMENT_HOURS)
Refreshed after	half its life — so roughly every 6 hours of use
Grace window	7 days (COMMISSION_ENTITLEMENT_GRACE_DAYS)
Revocation takes effect within	12 hours + 7 days, worst case
Never refreshed at all	14 days from the first failed attempt, then stop

Both numbers are set by the ISSUER and travel inside each entitlement, so they can be changed without shipping a new binary to anybody. That is the whole reason they are not constants in the client.

What a machine with no network does: keeps working for the entire grace window, warns on every command well before it closes, and says how many days are left. A refresh that fails because of a socket, a proxy, a 5xx, or a request this client got wrong is never treated as a revocation — only the issuer’s own sentence about that licence counts. An agent on a plane is not a licensing event.

What commission licence --revoke does NOT do: stop a running machine that moment. Nothing can, without putting a network call in front of every command. If a leak needs closing faster than the grace window, the only instant remedy remains a new issuer key and a new release — which is why the window is short enough to be useful and long enough to survive an outage.

Open questions for counsel

Not blockers for RC1, but they need answering before Commission is sold:

• Terms of service and an acceptable-use policy for any hosted offering
• Whether the free tier is a licence grant or a revocable permission, and what happens to a customer’s local database if that permission ends
• A contributor agreement, if anyone outside the copyright holder ever commits
• Trademark registration for the Commission name and any wordmark
• Export and data-residency posture, which enterprise procurement will ask about

Revisiting

This decision is reversible in one direction only: proprietary can become open, open cannot become proprietary. Nothing needs to be decided again unless the strategy changes.

The one signal worth watching is agent competence. If models operating Commission turn out to struggle in a way that traceably comes from Commission’s absence from public text, that is the corpus-presence argument arriving as a real product defect rather than a theoretical cost — and it would be worth re-reading business-model.md §6 at that point.