| 1 | --- |
| 2 | name: legal-and-trademarks |
| 3 | description: Legal compliance, license management, trademark guidelines, and distribution requirements for the Onde Inference project and its SDKs. |
| 4 | --- |
| 5 | |
| 6 | # Legal & Trademarks — Onde Inference |
| 7 | |
| 8 | > Reference for AI agents and human contributors on all legal, licensing, trademark, and distribution compliance topics for the `onde` crate, `onde-swift`, and all downstream SDKs. |
| 9 | |
| 10 | --- |
| 11 | |
| 12 | ## License |
| 13 | |
| 14 | Onde is dual-licensed under **MIT** and **Apache 2.0**, at the user's option. This mirrors the licensing model used by the Rust language itself. |
| 15 | |
| 16 | ``` |
| 17 | SPDX-License-Identifier: MIT OR Apache-2.0 |
| 18 | ``` |
| 19 | |
| 20 | ### Why dual license? |
| 21 | |
| 22 | | Concern | MIT alone | MIT OR Apache-2.0 | |
| 23 | |---|---|---| |
| 24 | | Patent grant | ❌ None | ✅ Apache 2.0 includes irrevocable patent grant | |
| 25 | | Enterprise adoption | ⚠️ Legal teams may ask questions | ✅ Widely understood and accepted | |
| 26 | | Rust ecosystem compatibility | ✅ | ✅ | |
| 27 | | Contributor protection | ❌ | ✅ Patent termination clause deters trolling | |
| 28 | | Simplicity | ✅ | ✅ User just picks one | |
| 29 | |
| 30 | ### License files |
| 31 | |
| 32 | | File | Contents | |
| 33 | |---|---| |
| 34 | | `LICENSE-MIT` | MIT License, copyright Onde Inference (Splitfire AB) | |
| 35 | | `LICENSE-APACHE` | Apache License 2.0 | |
| 36 | |
| 37 | Never use a single `LICENSE` file for dual-licensed projects. Always maintain both files separately. |
| 38 | |
| 39 | ### Cargo.toml declaration |
| 40 | |
| 41 | ```toml |
| 42 | license = "MIT OR Apache-2.0" |
| 43 | ``` |
| 44 | |
| 45 | Use `OR` (uppercase, SPDX standard), not `AND` or `/`. `AND` would mean the user must comply with **both** simultaneously — that is a different and more restrictive claim. |
| 46 | |
| 47 | --- |
| 48 | |
| 49 | ## Copyright |
| 50 | |
| 51 | The canonical copyright notice for all Onde Inference files is: |
| 52 | |
| 53 | ``` |
| 54 | Copyright (c) 2026 Onde Inference (Splitfire AB) |
| 55 | ``` |
| 56 | |
| 57 | - **Onde Inference** — the product/brand name |
| 58 | - **Splitfire AB** — the Swedish legal entity (org. nr. on file) |
| 59 | - Use the year of first publication; do not update the year annually in LICENSE files |
| 60 | |
| 61 | This notice must appear in: |
| 62 | - `LICENSE-MIT` |
| 63 | - `LICENSE-APACHE` (NOTICE file section) |
| 64 | - Any generated SDK packages distributed to registries (crates.io, pub.dev, npm, PyPI) |
| 65 | |
| 66 | --- |
| 67 | |
| 68 | ## Dependency Licenses |
| 69 | |
| 70 | ### Direct dependencies — audit table |
| 71 | |
| 72 | | Crate | License | Notes | |
| 73 | |---|---|---| |
| 74 | | `mistral.rs` (Eric Buehler) | MIT | Must preserve `Copyright (c) 2024 Eric Buehler` | |
| 75 | | `uniffi` | MPL-2.0 | File-level copyleft; compatible with MIT/Apache 2.0 for binary distribution | |
| 76 | | `tokio` | MIT | — | |
| 77 | | `serde` | MIT OR Apache-2.0 | — | |
| 78 | | `anyhow` / `thiserror` | MIT OR Apache-2.0 | — | |
| 79 | | `hf-hub` | Apache-2.0 | — | |
| 80 | | `log` | MIT OR Apache-2.0 | — | |
| 81 | |
| 82 | ### MPL-2.0 (`uniffi`) — what it means in practice |
| 83 | |
| 84 | Mozilla Public License 2.0 is **file-level copyleft**: |
| 85 | - You may distribute binaries combining MPL code with MIT/Apache code without restriction. |
| 86 | - If you **modify** MPL-licensed source files, you must make those modifications available. |
| 87 | - As a consumer of `uniffi` (not modifying its internals), **no disclosure obligation applies**. |
| 88 | |
| 89 | ### GPL — hard blocker |
| 90 | |
| 91 | Never introduce a GPL-licensed dependency (v2-only in particular). GPL v2 is **incompatible** with Apache 2.0 and would contaminate the entire binary. |
| 92 | |
| 93 | Before adding any new dependency, verify its license with: |
| 94 | |
| 95 | ```bash |
| 96 | cargo license --all-features |
| 97 | ``` |
| 98 | |
| 99 | Acceptable licenses for new dependencies: MIT, Apache-2.0, MIT OR Apache-2.0, ISC, BSD-2-Clause, BSD-3-Clause, MPL-2.0, Unicode-3.0, Zlib. |
| 100 | |
| 101 | --- |
| 102 | |
| 103 | ## Model Licenses |
| 104 | |
| 105 | **This is the most critical compliance area for downstream users.** |
| 106 | |
| 107 | Onde downloads AI models from HuggingFace at runtime. These models carry their own licenses, entirely separate from Onde's MIT OR Apache-2.0 license. Any application that ships with or downloads these models must comply with the model's license. |
| 108 | |
| 109 | ### Current model license table |
| 110 | |
| 111 | | Model | HuggingFace Repo | License | Commercial use | |
| 112 | |---|---|---|---| |
| 113 | | Qwen 2.5 1.5B Instruct | `Qwen/Qwen2.5-1.5B-Instruct` | [Qwen Community License](https://huggingface.co/Qwen/Qwen2.5-1.5B-Instruct/blob/main/LICENSE) | ✅ Allowed with conditions | |
| 114 | | Qwen 2.5 3B Instruct | `Qwen/Qwen2.5-3B-Instruct` | Qwen Community License | ✅ Allowed with conditions | |
| 115 | | Qwen 2.5 Coder 1.5B | `Qwen/Qwen2.5-Coder-1.5B-Instruct` | Qwen Community License | ✅ Allowed with conditions | |
| 116 | | Qwen 2.5 Coder 3B | `Qwen/Qwen2.5-Coder-3B-Instruct` | Qwen Community License | ✅ Allowed with conditions | |
| 117 | | Qwen 2.5 Coder 7B | `Qwen/Qwen2.5-Coder-7B-Instruct` | Qwen Community License | ✅ Allowed with conditions | |
| 118 | |
| 119 | ### Key Qwen Community License restrictions |
| 120 | |
| 121 | 1. **No training competing models** — you may not use outputs or weights to train a model that competes with Qwen/Alibaba offerings. |
| 122 | 2. **Attribution required** — downstream products must acknowledge the use of Qwen models. |
| 123 | 3. **No misrepresentation** — you may not claim the model is your own original work. |
| 124 | 4. **Threshold clause** — organisations with >100 million monthly active users must obtain a separate commercial licence from Alibaba Cloud. |
| 125 | |
| 126 | ### Disclosure obligation |
| 127 | |
| 128 | Onde's README and any SDK README must contain a `## Model Licenses` section that: |
| 129 | - Lists every bundled or downloadable model |
| 130 | - Links to the model's license on HuggingFace |
| 131 | - States that the model license is independent of Onde's own license |
| 132 | |
| 133 | When a new model is added to `src/inference/models.rs`, the model license table in the README **must be updated in the same commit**. |
| 134 | |
| 135 | --- |
| 136 | |
| 137 | ## Trademark Guidelines |
| 138 | |
| 139 | ### Onde Inference brand |
| 140 | |
| 141 | **"Onde Inference"** and the Onde logo (`assets/onde-inference-logo.svg`) are trademarks of Splitfire AB. |
| 142 | |
| 143 | MIT and Apache 2.0 grant code rights only — **neither license grants trademark rights**. This is intentional and protective. |
| 144 | |
| 145 | #### Permitted uses |
| 146 | |
| 147 | - Referring to the project by name: *"built with Onde Inference"*, *"powered by Onde"* |
| 148 | - Linking to the official website or repository |
| 149 | - Stating compatibility: *"compatible with Onde Inference 0.x"* |
| 150 | - Press, editorial, and factual references |
| 151 | |
| 152 | #### Prohibited uses |
| 153 | |
| 154 | - Using "Onde Inference" or the logo as the name of a fork, competing product, or derived SDK |
| 155 | - Implying official endorsement or affiliation without written permission from Splitfire AB |
| 156 | - Using the logo in a way that could cause confusion about the origin of a product |
| 157 | |
| 158 | #### Forks |
| 159 | |
| 160 | A fork of `onde` may use the code freely under MIT OR Apache-2.0 but **must not**: |
| 161 | - Use the "Onde Inference" name as its product name |
| 162 | - Use the Onde logo |
| 163 | - Claim to be the official Onde Inference project |
| 164 | |
| 165 | This is standard open-source brand protection and is consistent with how the Apache Software Foundation, Mozilla, and Rust Foundation handle their trademarks. |
| 166 | |
| 167 | --- |
| 168 | |
| 169 | ## mistral.rs Fork — Attribution Requirements |
| 170 | |
| 171 | Onde depends on a personal fork of `mistral.rs` by Eric Buehler: |
| 172 | |
| 173 | ```toml |
| 174 | mistralrs = { git = "https://github.com/setoelkahfi/mistral.rs", |
| 175 | branch = "fix/all-platform-fixes", ... } |
| 176 | ``` |
| 177 | |
| 178 | ### Obligations |
| 179 | |
| 180 | 1. **Preserve the upstream LICENSE** — `mistral.rs/LICENSE` must remain intact and contain `Copyright (c) 2024 Eric Buehler`. Never alter it. |
| 181 | 2. **Pin to a commit SHA, not a branch** — branches can be force-pushed or deleted. For any production release, the dependency must be pinned: |
| 182 | ```toml |
| 183 | mistralrs = { git = "https://github.com/setoelkahfi/mistral.rs", rev = "<commit-sha>" } |
| 184 | ``` |
| 185 | 3. **Upstream-first policy** — fixes that are not Onde-specific should be submitted as PRs to `EricLBuehler/mistral.rs`. Maintaining a long-lived divergent fork creates legal ambiguity about authorship of patches. |
| 186 | 4. **NOTICE file** — if Onde ever produces an Apache 2.0 binary distribution (e.g., via PyPI), a `NOTICE` file must include: *"This product includes software developed by Eric Buehler (mistral.rs)."* |
| 187 | |
| 188 | --- |
| 189 | |
| 190 | ## Distribution Registry Compliance |
| 191 | |
| 192 | ### crates.io |
| 193 | |
| 194 | - `license = "MIT OR Apache-2.0"` in `Cargo.toml` ✅ |
| 195 | - Both `LICENSE-MIT` and `LICENSE-APACHE` must be present in the repo root |
| 196 | - `readme = "README.md"` must point to a file that contains the `## Model Licenses` section |
| 197 | |
| 198 | ### pub.dev (Flutter/Dart) |
| 199 | |
| 200 | - `pubspec.yaml` must declare `license: MIT OR Apache-2.0` |
| 201 | - The `## Model Licenses` section must be present in the published README |
| 202 | - pub.dev displays the license on the package page — verify after each publish |
| 203 | |
| 204 | ### Swift Package Manager / onde-swift |
| 205 | |
| 206 | - `onde-swift/README.md` license section must state MIT OR Apache-2.0 |
| 207 | - The XCFramework binary is a compiled artifact — it carries Onde's license, mistral.rs attribution, and the model license notice |
| 208 | - The GitHub Release notes for every onde-swift release must include a `## Licenses` section |
| 209 | |
| 210 | ### Apple App Store |
| 211 | |
| 212 | - Apple's review guidelines do not restrict MIT/Apache 2.0 licensed code |
| 213 | - The Qwen model license does not conflict with App Store distribution |
| 214 | - Ensure the app's **Privacy Policy** states that inference runs entirely on-device and no user data is transmitted (this is a functional claim Onde enables, not a license issue, but legal teams will ask) |
| 215 | |
| 216 | --- |
| 217 | |
| 218 | ## Checklist — Adding a New Model |
| 219 | |
| 220 | When adding a new model to `src/inference/models.rs`: |
| 221 | |
| 222 | - [ ] Verify the model's license on HuggingFace before adding |
| 223 | - [ ] Check for the >100M MAU commercial threshold clause |
| 224 | - [ ] Add the model to the `## Model Licenses` table in `onde/README.md` |
| 225 | - [ ] Add the model to the `## Model Licenses` table in `onde-swift/README.md` |
| 226 | - [ ] Add the model to the model license table in this SKILL.md |
| 227 | - [ ] If the model license is more restrictive than Qwen Community License, escalate before shipping |
| 228 | |
| 229 | ## Checklist — Adding a New Dependency |
| 230 | |
| 231 | - [ ] Run `cargo license --all-features` and confirm no GPL appears |
| 232 | - [ ] If MPL-2.0: confirm you are not modifying the MPL files |
| 233 | - [ ] If Apache-2.0 only (not MIT): compatible, no action needed |
| 234 | - [ ] If custom/proprietary license: stop and escalate to Splitfire AB legal |
| 235 | |
| 236 | ## Checklist — New SDK Release |
| 237 | |
| 238 | - [ ] Both `LICENSE-MIT` and `LICENSE-APACHE` are present |
| 239 | - [ ] `Cargo.toml` / `pubspec.yaml` / `package.json` declare `MIT OR Apache-2.0` |
| 240 | - [ ] README contains `## Model Licenses` section |
| 241 | - [ ] Copyright year and entity (`Onde Inference (Splitfire AB)`) is correct |
| 242 | - [ ] mistral.rs fork dependency is pinned to a commit SHA |
| 243 | - [ ] mistral.rs `LICENSE` (Eric Buehler) is intact and unmodified |
| 244 | |
| 245 | --- |
| 246 | |
| 247 | ## Quick Reference |
| 248 | |
| 249 | | Question | Answer | |
| 250 | |---|---| |
| 251 | | What license is Onde? | MIT OR Apache-2.0 (user's choice) | |
| 252 | | Who holds the copyright? | Onde Inference (Splitfire AB) | |
| 253 | | Can someone fork Onde and sell it? | Yes, under MIT or Apache 2.0, but they cannot use the "Onde Inference" name or logo | |
| 254 | | Are Qwen models MIT? | No — Qwen Community License. Disclose to users. | |
| 255 | | Can enterprises use Onde commercially? | Yes. Apache 2.0 + Qwen Community License both permit commercial use. | |
| 256 | | Does the patent grant apply? | Yes, under Apache 2.0. Choose Apache 2.0 if patent protection matters to you. | |
| 257 | | Who is Eric Buehler? | Author of mistral.rs. His MIT copyright must be preserved in our fork. | |