Commercial/licensing decision surface: copyright audit + business-model choice before any proprietary transition

[Chris0Jeky]

Problem / outcome

The maintainer's recorded intention (decision-studio Q61, 2026-08) is a GPL-3.0-only beta followed by a proprietary full release before v1. Current binding policy points the other way: ADR-0050 (GPL-3.0-only core, prior MIT grants preserved), LICENSING.md's free-boundary commitments ("will not remove those capabilities from the GPL-covered core"), and DCO inbound-equals-outbound (no CLA — no relicensing assignment is collected from contributors). A silent switch is not possible: already-distributed GPL copies keep their rights, and any external core contribution accepted before this decision may constrain future relicensing options.

The outcome is a deliberate, recorded commercial/licensing decision with the groundwork that makes it real, before any proprietary transition and before broad publicity invites external contributions.

Work items (agent-preparable ≠ decidable)

Agent-preparable groundwork:

• Copyright-ownership and external-contribution audit (who authored what; any accepted non-maintainer core contributions and their size).
• Dependency/licence-constraint inventory (GPL-compat obligations, packaging).
• A compact options memo: proprietary core vs open-core (ee/) vs dual-licence vs source-available vs managed-service-only — each scored against ADR-0050's commitments and the free boundary.

Human/legal-only:

• Maintainer selects the business model (may require legal advice).
• Decide whether a CLA or contribution policy change is needed before accepting further external core contributions.
• If a transition is chosen: record the boundary (versions, dates, what stays free) in a new ADR superseding/amending ADR-0050. Until then, ADR-0050 and LICENSING.md remain unchanged.

Relation

Name/trademark legal residuals stay on #1482 (commercial gate, q-6). Monetization sequencing intent is recorded in docs/REVIVAL_PLAN.md §2. Direction guardrail: docs/strategy/PRODUCT_DIRECTION.md §6.

Stop / close criterion

Closes when the maintainer's model decision is recorded (ADR or dated ruling) and the contribution-policy question is answered. The decision itself is human-owned; agents may only prepare the audit and memo.

Seeded by the 2026-08-23 repository realignment (see docs/analysis/2026-08-23-realignment/REALIGNMENT_LOG.md).

[Chris0Jeky]

Copyright / contribution audit — prepared under the maintainer's 2026-08-24 authorization (walkthrough q-8 A)

Maintainer statement recorded the same day (verbatim intent): no external contributors are expected, and none will be accepted, until the repository states clearly that it may either become proprietary or be used as the base of a proprietary product. A contributions-paused notice for CONTRIBUTING.md and README.md ships in the follow-up docs PR.

---

Audited 2026-08-24 at HEAD 9766edbb5 (7,612 commits). Read-only audit. This is a factual audit of repository and GitHub records, not legal advice.

Authorship

git shortlog -sne HEAD — 8 author identities; committer variants cross-checked:

Identity	Commits	Classification
Chris0Jeky (jeky.tck@gmail.com)	6,188	Maintainer
Cristian Tcaci (59696583+Chris0Jeky@users.noreply.github.com)	1,180	Maintainer (GitHub noreply, account ID 59696583 = Chris0Jeky)
Chris Jeky / Cristian Tcaci / Chris (jeky.tck@gmail.com)	68 + 4 + 1	Maintainer (name variants, same email)
dependabot[bot]	84	Bot
copilot-swe-agent[bot]	60	Bot (GitHub Copilot coding agent, maintainer-initiated runs)
Claude (noreply@anthropic.com)	27	AI agent (Claude Code sessions operated by the maintainer)

Total maintainer-identity commits: 7,441 of 7,612. The GitHub contributors API agrees exactly: Chris0Jeky 7,441, dependabot[bot] 84, Copilot 60, claude 27.

Third-party human commits: none. Every non-bot commit resolves to the maintainer. The 27 Claude-authored commits fall on exactly two dates (2025-11-18 foundation; 2026-04-09 merges + one vitest fix) — before includeCoAuthoredBy was disabled. The 60 Copilot commits (Feb 2026) are substantive code produced in 10 maintainer-initiated agent runs.

External contributions

• Merged PRs: 1,059 total — Chris0Jeky 975, dependabot 84, copilot-swe-agent 10.
• gh api "search/issues?q=repo:Chris0Jeky/Taskdeck+is:pr+is:merged+-author:Chris0Jeky+-author:app/dependabot+-author:app/copilot-swe-agent" → 0. The same query without is:merged (any state, ever) → 0. No outside account has ever opened a PR against this repository.
• Dependabot's file footprint: 53 unique files, almost all workflows/manifests/lockfiles. Three squash-merged PRs (deps(npm): bump eslint from 8.57.1 to 10.1.0 in /frontend/taskdeck-web #487, deps(npm): bump @vitest/ui from 2.1.9 to 4.1.2 in /frontend/taskdeck-web #488, deps(npm): bump the npm-minor-patch group across 1 directory with 11 updates #530, pre-dating the no-squash rule) also carry small mechanical compatibility edits under dependabot authorship.

License consistency

• LICENSE = full GPLv3. ADR-0050 (Accepted 2026-08-12) governs; LICENSING.md/RELICENSING.md record the MIT→GPL-3.0-only transition; LICENSES/MIT.txt retained ("Copyright (c) 2026 Taskdeck Contributors" — given the single-author history, effectively the maintainer).
• Metadata fully consistent: all 11 csproj declare GPL-3.0-only; both package.json files declare "license": "GPL-3.0-only"; README badge matches.
• No file-level license headers anywhere (0 SPDX identifiers outside LICENSES/). Common practice, but GPLv3's how-to-apply appendix recommends per-file notices.
• ee/LICENSE reserves the ee/ path outside the root GPL grant (placeholder, no code) — consistent with LICENSING.md's separately-licensed-modules posture.

Vendored / third-party material

• No vendored code found (no vendor dirs, no SPDX-marked foreign files, attribution searches hit only docs).
• Fonts via npm only: @fontsource Fraunces/Inter/JetBrains Mono (SIL OFL 1.1), @material-symbols/font-200 (Apache-2.0, license text correctly retained in LICENSES/).
• 14 tracked images, all project-generated in character.
• Direct dependencies, coarse pass only (not a transitive audit): frontend (vue, pinia, vue-router, vue-i18n, axios, marked, dompurify, @microsoft/signalr, @tanstack/vue-virtual, ws) and backend NuGet (Microsoft.*/EF Core, OpenTelemetry, Swashbuckle, StackExchange.Redis, Sentry, YamlDotNet, BCrypt.Net-Next, PdfPig, SQLitePCLRaw/SQLite, ModelContextProtocol) are MIT/Apache-2.0/public-domain class. No copyleft direct dependency identified — dependencies do not themselves obstruct a proprietary derivative; the only GPL constraint is the project's own outbound license, which its copyright holder can change for future versions.

Relicensing posture

Factual audit of the record, not legal advice.

• No CLA exists; DCO enforcement is paused (2026-08-23). A DCO certifies provenance — it never granted relicensing rights, so the pause changes nothing for this question.
• The history is single-human-author plus bots: the maintainer authored every human commit and merged every PR. As sole human copyright holder he retains the right to relicense his own contributions in future versions; the GPL binds licensees, not the copyright holder.
• Bot/AI caveat (for counsel to confirm): dependabot commits are mechanical. The Copilot (60) and Claude (27) commits are substantive AI-generated code operated by the maintainer; provider terms assign/disclaim provider interest to the customer, and copyrightability of AI-generated code is unsettled law. This is the only authorship surface a lawyer should look at before a proprietary pivot.
• Irrevocable prior grants: copies distributed under MIT (pre-2026-08-12) keep MIT rights; copies distributed under GPL-3.0-only (including v0.1.x release artifacts) keep GPL rights. Relicensing forward applies to new versions only.

CONTRIBUTING surface — currently invites contributions, contrary to the stated intent

• README.md L185: "PRs are welcome. Start with CONTRIBUTING.md…"
• CONTRIBUTING.md L3-4: "…a friendly onramp for new contributors…", plus a "Good First Issues" section and "Thanks for contributing."
• LICENSING.md: "Contributions to the core are accepted under the same GPL-3.0-only terms (inbound equals outbound)."

Follow-ups

1. Contributions-paused notice (ships in the follow-up docs PR): CONTRIBUTING.md top + README line replaced with an explicit statement that external code contributions are not accepted while the long-term licensing (including a possible commercial/proprietary future) is being settled; issues and bug reports remain welcome; existing releases keep their stated licenses.
2. Decide the inbound-rights instrument before ever reopening contributions — a CLA or exclusive-license grant if relicensing flexibility must be preserved; DCO alone does not preserve it. Update LICENSING.md's inbound=outbound sentence at the same time.
3. Counsel review of the AI-agent commits (Copilot 60, Claude 27) as the one non-maintainer authorship surface.
4. Optional hygiene: per-file SPDX headers (or a root notice naming the actual rights holder), and a .mailmap consolidating the five maintainer identities.

Audit basis: git shortlog -sne, committer/author uniq counts, git log --author=… --name-only, gh api search/issues author-exclusion queries, gh api repos/…/contributors, git grep for SPDX/copyright/attribution, license fields in all 11 csproj + both package.json, and reads of LICENSE, LICENSES/, LICENSING.md, RELICENSING.md, ee/LICENSE, ADR-0050, CONTRIBUTING.md, README.md. Not verified: transitive dependency licenses (out of scope); contents of stale .worktrees/ checkouts (historical states of this same repo).