Licensing

All of that landed on 17 September 2026. Before that date both repositories were MIT. This page is the announcement and the reference, because a licence post that is only an announcement goes stale and a reference with no date leaves people guessing what applied when.

Nothing was taken away

Every commit published under MIT is still available under MIT, permanently. That is b689f9c and earlier in heliograph, f664ea0 and earlier in heliograph-relay, including the relay's v0.1.0 and v0.1.1 tags. Fork any of them and MIT is what you have, for ever. The NOTICE file in each repository says so rather than leaving you to work it out.

A licence change cannot reach backwards. Anybody telling you otherwise about any project is wrong about how copyright licences work.

And nothing was relicensed over anybody's head. Both repositories have one author, under a handful of addresses, plus a CI identity and dependabot (git shortlog -sne --all). There was no contributor whose permission was needed and not obtained.

Why Apache 2.0 rather than MIT

MIT has no patent language, so patent rights are at best implied. Apache grants them expressly in section 3, and terminates the grant for a contributor who turns round and sues over a patent. That is a question an enterprise legal team asks about an infrastructure dependency, and it gets sharper as the beam pulls in Noise, ICE and WebRTC.

Two smaller reasons point the same way. Section 6 states that the licence conveys no trademark rights, which is where the actual boundary sits. Section 4(b) obliges a fork to say it modified the work.

Permissive to permissive, one copyright holder, and everybody gains a patent grant they did not have before. It is the least controversial relicence available.

Why the relay is fair source rather than open source

The relay is the component in the data path. Its source stays published and checkable, because "the code carrying your bytes is code you can read" is the strongest thing this project says and it has to remain true.

What FSL stops is Competing Use: making the software available to others in a commercial product or service that substitutes for it. Concretely, selling relay hosting. Hosted relay is a tier we sell, so somebody selling it from our own source is the one case the licence exists for.

Calling it open source would be false, and so would calling it source-available-and-nothing-more. Each release converts to Apache 2.0 two years after it ships, on a rolling clock, so a two-year-old relay is a fully open-source relay.

Professional services are expressly permitted

FSL's own Permitted Purposes cover professional services provided "to a licensee using the Software". That requires your client to be a licensee in their own right, which is narrower than what is intended here, so the copyright holder grants this in addition, irrevocably, in the relay's NOTICE:

> Deploying the relay to reach estates you or your clients operate, as part of > professional services you provide, provided you do not offer relay hosting > itself as a hosted or subscription service to third parties.

Run a relay so you can do a client's work: fine, and always was. Sell relay hosting: that is the competing use.

The honest limit

FSL's protection is worth whatever release velocity makes it worth. That cuts badly for this component, because the relay is deliberately stable - a two-year-old relay is still a good relay, so the conversion clock hands a competitor something useful.

That is accepted rather than solved, and it is written down here rather than left in a design document. By the time somebody has a two-year-old beacon relay, the value has moved to the beam, the governance plane, and operating the thing.

Why not AGPL

It does not do the job. Section 13 binds somebody hosting a modified copy, so a competitor running this relay unmodified would owe nothing and could charge for it. AGPL is reciprocity, not protection against competing hosting.

It is also prohibited outright at a good number of the organisations this is built for, and section 13 has no case law to lean on.

What did not change

No shape is ever gated. Beacon, flare and beam all work on a relay you host yourself and on the hosted one. Nothing that crosses the gap moves behind a paywall. What is sold above that is many-to-many orchestration.

Nothing is installed on the far side. Stations stay plain bash and plain PowerShell, planted as source, readable before they are run.

The documentation takes pull requests, including the documentation for the proprietary service. The security page is the one a buyer reads adversarially, and its whole argument is that each claim is checkable without trusting us. A security page whose source is private and accepts no corrections would be weaker for no gain.

Contributing

Inbound equals outbound. There is no CLA and no copyright assignment - you keep your copyright, and the project gets the same licence everybody else gets. Sign your commits off with the Developer Certificate of Origin, which is git commit -s.

FSL has no copyleft, so nothing about keeping the hosted service private depends on taking anybody's rights away.

Where the boundary is written down

The security page states what each component can and cannot do, and provenance is the command for checking the binary you are holding is the source you read. v0.4.2 was the first signed release and every release since carries a Sigstore bundle that verifies.

Third-party code vendored into these repositories keeps its own licence and its own notice, and this change does not touch any of it.