Licence¶

AHEGAO Kit is distributed under the Elastic License 2.0 (ELv2) or under a commercial licence. The full text of ELv2 is in LICENSE at the root of the repository; what requires a contract and why is in COMMERCIAL-LICENSE.md.

The source is open to read, change and run — but this is not open source in the OSI sense, and the difference matters. Below, in plain words.

What you may do, for free, without asking¶

download, study, change, build and distribute it;
run it in your own infrastructure, including production — you never pay for the fact of running it;
write your own kits, drivers and patches and keep them to yourself;
work in a closed network: no calls to a licence server, no registration, no internet.

The three things you may not do¶

ELv2 has exactly three limitations, and they are licence terms, not technical measures:

You may not provide the product to third parties as a hosted or managed service — hosting, a managed service, "we will set up AHEGAO Kit for you and run it". Serving your own infrastructure any way you like is fine; selling access to this product as a service is not.
You may not move, change, disable or circumvent the licence-key check, nor remove or obscure functionality that the key protects.
You may not alter, remove or obscure the licensing, copyright or other notices. Every source file carries the ELv2 notice; that is a requirement of this clause, not decoration.

Everything else is permitted. If your case does not fall under these three points, you do not need a contract.

Two different things: the licence, and the free level¶

The licence permits self-hosted production use without limit. It says nothing about how much the software agrees to do without a key — that is a separate matter.

The free level is the absence of a key, not a special key. It has numeric limits, declared in one place per side: each kit in its manifest, the core in one table. The exact grid is a pre-release decision; at the time of writing the manifests say:

	Free	With a key
Core	one user; sites not capped; storages of every kind, S3 buckets included; alerts to every channel; one map, with everything on it; one agent per kit installed	more users — a team; on-call rotas and escalation lines; more maps; more agents
Network Map Kit	networks and hosts declared but not capped yet; export	nothing yet — the kit is whole on the free level
PostgreSQL Kit	backup and verification by restoring; targets not capped	nothing yet — the kit is whole on the free level
Nexus OSS Kit	clean-up and cadences — 2 of them, which is what one registry needs: a cleanup and the compaction that frees the disk; 1 registry, 1 rule	more cadences, rules and registries; protected lists

The kits say it themselves when a key is missing, for example: "copying on a cadence is a paid feature of this kit. Copying by hand works on the free level — the button on each project — and a key is what makes it happen without anybody remembering".

The barrier is meant to be inconvenient, not insurmountable: nobody stops you from running a thousand free installations instead of one paid one — a thousand squats against one payment. The point is that the honest path is cheaper than the dishonest one. That is exactly why the second prohibition exists: the free-level limit is protected by the licence, not hidden in the code. The key check is in the source in the open, one function, no obfuscation — technically removable, legally not.

Why not AGPL¶

The first version of the licensing document proposed AGPL-3.0 with dual licensing, and that was wrong in the main point: AGPL does not forbid running a competing hosted service on this code. It only requires publishing the changes. That is why it protected neither MongoDB nor Elastic from cloud providers — both eventually moved to their own licences.

The other side of the choice is named plainly: AHEGAO Kit is not open source by the OSI definition, will not appear in Debian or Fedora repositories, and some of the audience will walk past on principle. That is a deliberate price for the product's only hosting being its author's.

The licence key¶

A signed token (Ed25519), verified offline against the public key in the build. There are no calls to a licence server.
Issued to an organisation, and kits are licensed one by one: buying a kit's paid level adds it to the key with its features, limits and its own expiry; another kit is added to the same key later without reinstalling anything. A kit with no entry in the key runs at the free level rather than switching off.
The key carries the name of the organisation it was issued to, and that name is always visible in the interface: a shared key is a shared name.
When the key expires, the platform does not stop. Data stays readable, export keeps working, and scheduled jobs — including backups — continue. Only creating new things beyond the free level is refused; existing over-limit entities are neither disabled nor deleted. A backup stopped because of an expired key is data loss, and there is no such behaviour here.
The platform warns about an approaching expiry in advance, in the interface and in the notification channels.

Commercial licence¶

Needed in two cases:

you want to provide AHEGAO Kit to third parties as a service — a separate agreement is required, and it is possible;
you need the capabilities of the paid levels — they are unlocked by a key.

Support and agreed response times are a separate agreement, not part of the key. If AHEGAO Kit is useful to you and you do not need the paid capabilities, a paid level can be taken simply as support: the product is made by one person, and this is the only source it is financed from.

To obtain one, write to license@adminguide.online with the organisation, the kits you need, and the expected number of installations.

The link to the source¶

The Overview screen of every installation shows: "AHEGAO Kit is distributed under the Elastic License 2.0. The source of this version:" followed by the repository address and the build version. The specification says this is not an obligation ELv2 imposes — but the code is open, and whoever sees the platform must be able to reach its code and the exact version of the build. The link is not a setting and cannot be switched off.

Contributions and the CLA¶

Every accepted change is accompanied by a Contributor Licence Agreement: the contributor keeps authorship and grants the copyright holder a non-exclusive right to license the contribution under any terms — ELv2, the commercial licence, and any future open-source licence. In practice it is one line in the commit message; CONTRIBUTING.md has the wording and the reason: the first change accepted without a CLA takes away the project's right to dispose of that code, for good.

Third-party components¶

Listed in NOTICE, with their licences preserved: Cytoscape.js, cytoscape-edgehandles and Lodash (MIT, vendored in the repository); FastAPI, Starlette, Pydantic, uvicorn, httpx, psycopg 3, PostgreSQL and Python at run time. psycopg is LGPL-3: it may be used from a program under any terms as long as the library itself is unmodified and pluggable as a separate dependency — which is why it is installed from PyPI and never patched or vendored.

The copyright holder is Artur Sagutdinov.