@ondeinference / onde
Code Commits Issues Pulls Cloud Agent CI/CD
main
copilot/assess-inference-engine-complexity copilot/fix-onde-npm-sdk-v1-1-2-release development feature/diffusion-vision main
md 257 lines 10.6 KB
Rendered Raw
1 ---
2 name: legal-and-trademarks
3 description: Legal compliance, license management, trademark guidelines, and distribution requirements for the Onde Inference project and its SDKs.
4 ---
5
6 # Legal & Trademarks — Onde Inference
7
8 > Reference for AI agents and human contributors on all legal, licensing, trademark, and distribution compliance topics for the `onde` crate, `onde-swift`, and all downstream SDKs.
9
10 ---
11
12 ## License
13
14 Onde is dual-licensed under **MIT** and **Apache 2.0**, at the user's option. This mirrors the licensing model used by the Rust language itself.
15
16 ```
17 SPDX-License-Identifier: MIT OR Apache-2.0
18 ```
19
20 ### Why dual license?
21
22 | Concern | MIT alone | MIT OR Apache-2.0 |
23 |---|---|---|
24 | Patent grant | ❌ None | ✅ Apache 2.0 includes irrevocable patent grant |
25 | Enterprise adoption | ⚠️ Legal teams may ask questions | ✅ Widely understood and accepted |
26 | Rust ecosystem compatibility | ✅ | ✅ |
27 | Contributor protection | ❌ | ✅ Patent termination clause deters trolling |
28 | Simplicity | ✅ | ✅ User just picks one |
29
30 ### License files
31
32 | File | Contents |
33 |---|---|
34 | `LICENSE-MIT` | MIT License, copyright Onde Inference (Splitfire AB) |
35 | `LICENSE-APACHE` | Apache License 2.0 |
36
37 Never use a single `LICENSE` file for dual-licensed projects. Always maintain both files separately.
38
39 ### Cargo.toml declaration
40
41 ```toml
42 license = "MIT OR Apache-2.0"
43 ```
44
45 Use `OR` (uppercase, SPDX standard), not `AND` or `/`. `AND` would mean the user must comply with **both** simultaneously — that is a different and more restrictive claim.
46
47 ---
48
49 ## Copyright
50
51 The canonical copyright notice for all Onde Inference files is:
52
53 ```
54 Copyright (c) 2026 Onde Inference (Splitfire AB)
55 ```
56
57 - **Onde Inference** — the product/brand name
58 - **Splitfire AB** — the Swedish legal entity (org. nr. on file)
59 - Use the year of first publication; do not update the year annually in LICENSE files
60
61 This notice must appear in:
62 - `LICENSE-MIT`
63 - `LICENSE-APACHE` (NOTICE file section)
64 - Any generated SDK packages distributed to registries (crates.io, pub.dev, npm, PyPI)
65
66 ---
67
68 ## Dependency Licenses
69
70 ### Direct dependencies — audit table
71
72 | Crate | License | Notes |
73 |---|---|---|
74 | `mistral.rs` (Eric Buehler) | MIT | Must preserve `Copyright (c) 2024 Eric Buehler` |
75 | `uniffi` | MPL-2.0 | File-level copyleft; compatible with MIT/Apache 2.0 for binary distribution |
76 | `tokio` | MIT | — |
77 | `serde` | MIT OR Apache-2.0 | — |
78 | `anyhow` / `thiserror` | MIT OR Apache-2.0 | — |
79 | `hf-hub` | Apache-2.0 | — |
80 | `log` | MIT OR Apache-2.0 | — |
81
82 ### MPL-2.0 (`uniffi`) — what it means in practice
83
84 Mozilla Public License 2.0 is **file-level copyleft**:
85 - You may distribute binaries combining MPL code with MIT/Apache code without restriction.
86 - If you **modify** MPL-licensed source files, you must make those modifications available.
87 - As a consumer of `uniffi` (not modifying its internals), **no disclosure obligation applies**.
88
89 ### GPL — hard blocker
90
91 Never introduce a GPL-licensed dependency (v2-only in particular). GPL v2 is **incompatible** with Apache 2.0 and would contaminate the entire binary.
92
93 Before adding any new dependency, verify its license with:
94
95 ```bash
96 cargo license --all-features
97 ```
98
99 Acceptable licenses for new dependencies: MIT, Apache-2.0, MIT OR Apache-2.0, ISC, BSD-2-Clause, BSD-3-Clause, MPL-2.0, Unicode-3.0, Zlib.
100
101 ---
102
103 ## Model Licenses
104
105 **This is the most critical compliance area for downstream users.**
106
107 Onde downloads AI models from HuggingFace at runtime. These models carry their own licenses, entirely separate from Onde's MIT OR Apache-2.0 license. Any application that ships with or downloads these models must comply with the model's license.
108
109 ### Current model license table
110
111 | Model | HuggingFace Repo | License | Commercial use |
112 |---|---|---|---|
113 | Qwen 2.5 1.5B Instruct | `Qwen/Qwen2.5-1.5B-Instruct` | [Qwen Community License](https://huggingface.co/Qwen/Qwen2.5-1.5B-Instruct/blob/main/LICENSE) | ✅ Allowed with conditions |
114 | Qwen 2.5 3B Instruct | `Qwen/Qwen2.5-3B-Instruct` | Qwen Community License | ✅ Allowed with conditions |
115 | Qwen 2.5 Coder 1.5B | `Qwen/Qwen2.5-Coder-1.5B-Instruct` | Qwen Community License | ✅ Allowed with conditions |
116 | Qwen 2.5 Coder 3B | `Qwen/Qwen2.5-Coder-3B-Instruct` | Qwen Community License | ✅ Allowed with conditions |
117 | Qwen 2.5 Coder 7B | `Qwen/Qwen2.5-Coder-7B-Instruct` | Qwen Community License | ✅ Allowed with conditions |
118
119 ### Key Qwen Community License restrictions
120
121 1. **No training competing models** — you may not use outputs or weights to train a model that competes with Qwen/Alibaba offerings.
122 2. **Attribution required** — downstream products must acknowledge the use of Qwen models.
123 3. **No misrepresentation** — you may not claim the model is your own original work.
124 4. **Threshold clause** — organisations with >100 million monthly active users must obtain a separate commercial licence from Alibaba Cloud.
125
126 ### Disclosure obligation
127
128 Onde's README and any SDK README must contain a `## Model Licenses` section that:
129 - Lists every bundled or downloadable model
130 - Links to the model's license on HuggingFace
131 - States that the model license is independent of Onde's own license
132
133 When a new model is added to `src/inference/models.rs`, the model license table in the README **must be updated in the same commit**.
134
135 ---
136
137 ## Trademark Guidelines
138
139 ### Onde Inference brand
140
141 **"Onde Inference"** and the Onde logo (`assets/onde-inference-logo.svg`) are trademarks of Splitfire AB.
142
143 MIT and Apache 2.0 grant code rights only — **neither license grants trademark rights**. This is intentional and protective.
144
145 #### Permitted uses
146
147 - Referring to the project by name: *"built with Onde Inference"*, *"powered by Onde"*
148 - Linking to the official website or repository
149 - Stating compatibility: *"compatible with Onde Inference 0.x"*
150 - Press, editorial, and factual references
151
152 #### Prohibited uses
153
154 - Using "Onde Inference" or the logo as the name of a fork, competing product, or derived SDK
155 - Implying official endorsement or affiliation without written permission from Splitfire AB
156 - Using the logo in a way that could cause confusion about the origin of a product
157
158 #### Forks
159
160 A fork of `onde` may use the code freely under MIT OR Apache-2.0 but **must not**:
161 - Use the "Onde Inference" name as its product name
162 - Use the Onde logo
163 - Claim to be the official Onde Inference project
164
165 This is standard open-source brand protection and is consistent with how the Apache Software Foundation, Mozilla, and Rust Foundation handle their trademarks.
166
167 ---
168
169 ## mistral.rs Fork — Attribution Requirements
170
171 Onde depends on a personal fork of `mistral.rs` by Eric Buehler:
172
173 ```toml
174 mistralrs = { git = "https://github.com/setoelkahfi/mistral.rs",
175 branch = "fix/all-platform-fixes", ... }
176 ```
177
178 ### Obligations
179
180 1. **Preserve the upstream LICENSE** — `mistral.rs/LICENSE` must remain intact and contain `Copyright (c) 2024 Eric Buehler`. Never alter it.
181 2. **Pin to a commit SHA, not a branch** — branches can be force-pushed or deleted. For any production release, the dependency must be pinned:
182 ```toml
183 mistralrs = { git = "https://github.com/setoelkahfi/mistral.rs", rev = "<commit-sha>" }
184 ```
185 3. **Upstream-first policy** — fixes that are not Onde-specific should be submitted as PRs to `EricLBuehler/mistral.rs`. Maintaining a long-lived divergent fork creates legal ambiguity about authorship of patches.
186 4. **NOTICE file** — if Onde ever produces an Apache 2.0 binary distribution (e.g., via PyPI), a `NOTICE` file must include: *"This product includes software developed by Eric Buehler (mistral.rs)."*
187
188 ---
189
190 ## Distribution Registry Compliance
191
192 ### crates.io
193
194 - `license = "MIT OR Apache-2.0"` in `Cargo.toml` ✅
195 - Both `LICENSE-MIT` and `LICENSE-APACHE` must be present in the repo root
196 - `readme = "README.md"` must point to a file that contains the `## Model Licenses` section
197
198 ### pub.dev (Flutter/Dart)
199
200 - `pubspec.yaml` must declare `license: MIT OR Apache-2.0`
201 - The `## Model Licenses` section must be present in the published README
202 - pub.dev displays the license on the package page — verify after each publish
203
204 ### Swift Package Manager / onde-swift
205
206 - `onde-swift/README.md` license section must state MIT OR Apache-2.0
207 - The XCFramework binary is a compiled artifact — it carries Onde's license, mistral.rs attribution, and the model license notice
208 - The GitHub Release notes for every onde-swift release must include a `## Licenses` section
209
210 ### Apple App Store
211
212 - Apple's review guidelines do not restrict MIT/Apache 2.0 licensed code
213 - The Qwen model license does not conflict with App Store distribution
214 - Ensure the app's **Privacy Policy** states that inference runs entirely on-device and no user data is transmitted (this is a functional claim Onde enables, not a license issue, but legal teams will ask)
215
216 ---
217
218 ## Checklist — Adding a New Model
219
220 When adding a new model to `src/inference/models.rs`:
221
222 - [ ] Verify the model's license on HuggingFace before adding
223 - [ ] Check for the >100M MAU commercial threshold clause
224 - [ ] Add the model to the `## Model Licenses` table in `onde/README.md`
225 - [ ] Add the model to the `## Model Licenses` table in `onde-swift/README.md`
226 - [ ] Add the model to the model license table in this SKILL.md
227 - [ ] If the model license is more restrictive than Qwen Community License, escalate before shipping
228
229 ## Checklist — Adding a New Dependency
230
231 - [ ] Run `cargo license --all-features` and confirm no GPL appears
232 - [ ] If MPL-2.0: confirm you are not modifying the MPL files
233 - [ ] If Apache-2.0 only (not MIT): compatible, no action needed
234 - [ ] If custom/proprietary license: stop and escalate to Splitfire AB legal
235
236 ## Checklist — New SDK Release
237
238 - [ ] Both `LICENSE-MIT` and `LICENSE-APACHE` are present
239 - [ ] `Cargo.toml` / `pubspec.yaml` / `package.json` declare `MIT OR Apache-2.0`
240 - [ ] README contains `## Model Licenses` section
241 - [ ] Copyright year and entity (`Onde Inference (Splitfire AB)`) is correct
242 - [ ] mistral.rs fork dependency is pinned to a commit SHA
243 - [ ] mistral.rs `LICENSE` (Eric Buehler) is intact and unmodified
244
245 ---
246
247 ## Quick Reference
248
249 | Question | Answer |
250 |---|---|
251 | What license is Onde? | MIT OR Apache-2.0 (user's choice) |
252 | Who holds the copyright? | Onde Inference (Splitfire AB) |
253 | Can someone fork Onde and sell it? | Yes, under MIT or Apache 2.0, but they cannot use the "Onde Inference" name or logo |
254 | Are Qwen models MIT? | No — Qwen Community License. Disclose to users. |
255 | Can enterprises use Onde commercially? | Yes. Apache 2.0 + Qwen Community License both permit commercial use. |
256 | Does the patent grant apply? | Yes, under Apache 2.0. Choose Apache 2.0 if patent protection matters to you. |
257 | Who is Eric Buehler? | Author of mistral.rs. His MIT copyright must be preserved in our fork. |