chore: switch license from MIT to BSL 1.1 (auto-converts to MIT on 2030-05-15) by RBKunnela · Pull Request #5 · RBKunnela/paybot-sdk

RBKunnela · 2026-05-15T13:49:42Z

Summary

Rationale: Switch from MIT to Business Source License 1.1 to protect the paybot-sdk commercial surface through 2030-05-15, after which the work auto-converts to MIT (fully permissive open source). Non-production use stays unrestricted today; production use is permitted except as a competing hosted/embedded offering of substantially the same functionality the Licensor sells.
SPDX identifier: package.json uses BUSL-1.1 (the canonical SPDX identifier for Business Source License 1.1 — not BSL-1.1, which is unrelated/incorrect).
No API or runtime changes: zero code touched. Only LICENSE, package.json license field, and the README license section are modified. Existing installs, builds, and behavior are unaffected.
Underlying business reason: the paybot-sdk facilitator (x402 / USDC payments for bots) needs commercial protection while the network is bootstrapping; the 4-year Change Date is the standard BSL window and guarantees the community a fully open-source future under MIT.

Files changed

LICENSE — replaced with the canonical Business Source License 1.1 template, parameters filled in (Licensor: FriendlyAI / Renata Baldissara-Kunnela; Licensed Work: paybot-sdk; Change Date: 2030-05-15; Change License: MIT; Additional Use Grant scoped to block competing hosted/embedded offerings only)
package.json — "license": "MIT" → "license": "BUSL-1.1"
README.md — license section updated to describe BSL 1.1, the 2030-05-15 auto-conversion, and the competitive-service carve-out

Notes for reviewers

Authorized directly by Renata.
Do NOT merge until Renata gives final sign-off on the Additional Use Grant phrasing.
Covenant docs: PayBot liability management improvements from community feedback #1 of the BSL (Change License must be GPLv2-or-later compatible) is satisfied — MIT/Expat is GPL-compatible per OSI and FSF.

Summary by CodeRabbit

Chores
- Updated project license to Business Source License 1.1 (BUSL-1.1) with automatic conversion to MIT on 2030-05-15.
- Added usage restrictions and an additional use grant limiting certain production/competitive offerings.
- Updated README license notice and package metadata to reflect the new license.

…5 to MIT - LICENSE: replace MIT text with canonical Business Source License 1.1 template (Licensor: FriendlyAI / Renata Baldissara-Kunnela; Licensed Work: paybot-sdk; Change Date: 2030-05-15; Change License: MIT; Additional Use Grant blocks competing hosted/embedded offerings only) - package.json: license field MIT -> BUSL-1.1 (canonical SPDX identifier) - README.md: update license section to reflect BSL 1.1 with auto-conversion to MIT on 2030-05-15 and the competitive-service carve-out Rationale: commercial protection of the paybot-sdk facilitator surface through the Change Date, after which the work auto-converts to MIT (fully open source). No API or runtime changes.

coderabbitai · 2026-05-15T13:49:55Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: ad30be0c-b4fc-4e3d-915a-d7d4cce940dd

📥 Commits

Reviewing files that changed from the base of the PR and between 8102fb8 and decdd83.

📒 Files selected for processing (2)

LICENSE
README.md

🚧 Files skipped from review as they are similar to previous changes (2)

README.md
LICENSE

Walkthrough

Repository license changed from MIT to Business Source License 1.1 (BUSL-1.1) with a Change Date of 2030-05-15 and automatic conversion to MIT thereafter; README license notice and package.json license field were updated accordingly.

Changes

License transition to BUSL-1.1

Layer / File(s)	Summary
BUSL-1.1 license documentation and metadata `LICENSE`, `README.md`, `package.json`	LICENSE replaced with BUSL-1.1 text including Additional Use Grant, Change Date (2030-05-15), and Change License (MIT). README license section updated to reflect BUSL-1.1 and production-use restrictions. `package.json` license field changed from `MIT` to `BUSL-1.1`.

🎯 3 (Moderate) | ⏱️ ~20 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately and specifically summarizes the main changeset: replacing MIT with BSL 1.1 and noting the 2030-05-15 auto-conversion date.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch chore/license-change

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@README.md`:
- Around line 192-194: Update the README.md restriction sentence to match the
LICENSE wording exactly: in the paragraph that currently reads "Non-production
use is permitted without restriction. Production use is permitted **except** for
offering the Licensed Work to third parties on a hosted or embedded basis that
competes with the Licensor's paid version(s)," include the missing qualifier
"for a fee" so it matches the LICENSE phrase "to third parties for a fee on a
hosted or embedded basis"; ensure the README mirrors the LICENSE's full
restriction language verbatim.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 3cdb1cb1-607f-40c5-bfb0-74fa5e41882b

📥 Commits

Reviewing files that changed from the base of the PR and between f12642e and 8102fb8.

📒 Files selected for processing (3)

LICENSE
README.md
package.json

gemini-code-assist

Code Review

This pull request transitions the project license from MIT to the Business Source License 1.1 (BUSL-1.1), updating the LICENSE file, README.md, and package.json. The reviewer identified an inaccuracy in the README regarding non-production use restrictions and suggested aligning the package author with the licensor name for consistency. Additionally, it was recommended to include the full MIT license text within the LICENSE file to ensure the terms are self-contained and avoid future ambiguity.

gemini-code-assist · 2026-05-15T13:53:39Z

-[MIT](LICENSE)
+[Business Source License 1.1](LICENSE) (BUSL-1.1) — auto-converts to [MIT](https://opensource.org/licenses/MIT) on 2030-05-15.
+
+Non-production use is permitted without restriction. Production use is permitted **except** for offering the Licensed Work to third parties on a hosted or embedded basis that competes with the Licensor's paid version(s). For commercial licensing, contact the Licensor.


The statement "Non-production use is permitted without restriction" is technically inaccurate. The Business Source License 1.1 (BSL 1.1) includes specific conditions for all uses, such as the requirement to conspicuously display the license and copyright notice (as stated in line 63 of the LICENSE file). It is more accurate to state that non-production use is permitted under the terms of the license.

Suggested change

Non-production use is permitted without restriction. Production use is permitted **except** for offering the Licensed Work to third parties on a hosted or embedded basis that competes with the Licensor's paid version(s). For commercial licensing, contact the Licensor.

Non-production use is permitted under the terms of the BSL 1.1. Production use is permitted **except** for offering the Licensed Work to third parties on a hosted or embedded basis that competes with the Licensor's paid version(s). For commercial licensing, contact the Licensor.

gemini-code-assist · 2026-05-15T13:53:39Z

  ],
  "author": "RBKunnela",
-  "license": "MIT",
+  "license": "BUSL-1.1",


While the license field is correctly updated to BUSL-1.1, there is an inconsistency between the author field ("RBKunnela") and the Licensor specified in the LICENSE file ("FriendlyAI / Renata Baldissara-Kunnela"). For legal clarity and consistency, especially under a commercial license like BSL, consider updating the author field to match the Licensor's full name or entity.

gemini-code-assist · 2026-05-15T13:53:39Z

+Change License:       MIT License, as published by the Open Source Initiative
+                      at https://opensource.org/licenses/MIT.


To ensure the "Change License" terms are fully self-contained and legally unambiguous, it is a best practice to include the full text of the MIT license at the end of this file. Relying solely on a URL for the Change License terms can be problematic if the link becomes unavailable or if there is any ambiguity about which specific variation of the MIT license is intended when the Change Date is reached in 2030.

…contributor-friendly)

RBKunnela · 2026-05-15T13:56:45Z

Narrowed Additional Use Grant

Pushed accacb8 to narrow the BSL Additional Use Grant clause.

What changed

The Additional Use Grant in LICENSE was rewritten from the broad "hosted or embedded basis competing with the Licensor's paid version(s)" wording to a tighter MariaDB-style clause:

Additional Use Grant: You may make production use of the Licensed Work, provided that you do not offer the Licensed Work to third parties as a hosted or embedded SDK or library product that competes with paybot-sdk distribution.

Why

The previous wording could chill external contributors who run their own facilitators or commercial services built on top of paybot-sdk (e.g., contributors operating hosted x402 facilitators). That was not the intent.

What the restriction now targets

The restriction is narrowly scoped to the Licensed Work itself — paybot-sdk distribution. Specifically:

✅ Allowed: Using paybot-sdk to run your own facilitator, hosted service, or commercial product (including ones that compete with api.paybotcore.com).
✅ Allowed: Building derivative products and services on top of paybot-sdk.
❌ Restricted: Forking paybot-sdk and offering it to third parties as a competing hosted/embedded SDK or library product.

This aligns with the original spirit of BSL 1.1 (protect the SDK distribution itself) without restricting downstream derivative use.

Change Date 2030-05-15 → MIT remains unchanged.

CodeRabbit flagged README line 194 dropping the "for a fee" qualifier present in LICENSE line 20. Mirror the LICENSE phrase exactly to remove legal ambiguity between the README summary and the binding license text. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

@RBKunnela

…, proposal cleanup) (#28) * chore(hygiene+hardening): SHA-pin actions, CODEOWNERS, uv ecosystem, prune proposal Bundle of four backlog items for paybot-sdk supply-chain + governance hygiene: #5 Delete stale .github/workflows/ci.yml.proposed (speculative draft from earlier experimentation; left dead in tree, creates confusion when reading workflows). #6 Add .github/CODEOWNERS routing all paths to @RBKunnela (solo-founder phase). Removes the duplicate root /CODEOWNERS — .github/CODEOWNERS takes precedence per GitHub's discovery order, so the root file would be dead-ignored. #11 Add `uv` ecosystem block to dependabot.yml covering /packages/python. Variance from task spec (which said `pip`): the live evidence — Dependabot's own auto-opened PR #12 on this repo carrying `package-manager=uv` — proves Dependabot natively understands the uv.lock format. Using `pip` would only cover pyproject.toml manifests and miss lockfile-pinned transitive deps. #12 SHA-pin all GitHub Actions references across ci.yml, codeql.yml, and osv-scanner.yml to 40-char immutable commit SHAs with adjacent `# vX` comments preserving floating-tag intent for Dependabot upgrades. Adds `persist-credentials: false` to checkout steps where applicable. The `npm publish` job in ci.yml intentionally omits it (OIDC GITHUB_TOKEN must remain for `--provenance`). Resolutions (gh api repos/<owner>/git/refs/tags/<v>): actions/checkout@v4 -> 34e114876b0b11c390a56381ad16ebd13914f8d5 actions/setup-node@v4 -> 49933ea5288caeca8642d1e84afbd3f7d6820020 github/codeql-action/*@V3 -> 03e4368ac7daa2bd82b3e85262f3bf87ee112f57 osv-scanner-reusable.yml@v2.2.1 -> 456ceb78310755116e0a3738121351006286b797 CodeRabbit on PR #11 (squash 2513676) flagged action pinning as MAJOR tech-debt; this closes that finding. Precedent: paybot-core sibling PR (parallel hygiene-and-hardening track, same convocation). Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> * chore(codeowners): preserve path-partitioned reviewer rules from pre-existing root CODEOWNERS Restore the /packages/python/ rule routing reviews to both @RBKunnela and @kite-builds. Operator confirmed 2026-05-22 that this rule is intentional (specialized reviewer for the Python port), not stale — reversing the prior session decision that flagged it for removal. Other path rules from the deleted root CODEOWNERS (/src/, /examples/) routed to @RBKunnela only and were therefore functionally equivalent to the `*` catch-all. Not restored — restoring them would add noise without changing review routing. Operator's amendment spec also omits them, aligning with this reading. If review routing for those paths needs to differ from the catch-all in future, partition then. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

coderabbitai Bot requested changes May 15, 2026

View reviewed changes

Comment thread README.md Outdated

gemini-code-assist Bot reviewed May 15, 2026

View reviewed changes

chore(license): narrow Use Grant to Licensed Work distribution only (…

accacb8

…contributor-friendly)

coderabbitai Bot approved these changes May 15, 2026

View reviewed changes

RBKunnela mentioned this pull request May 22, 2026

chore: hygiene + hardening bundle (CODEOWNERS, SHA-pins, uv ecosystem, proposal cleanup) #28

Merged

5 tasks

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore: switch license from MIT to BSL 1.1 (auto-converts to MIT on 2030-05-15)#5

chore: switch license from MIT to BSL 1.1 (auto-converts to MIT on 2030-05-15)#5
RBKunnela wants to merge 3 commits into
mainfrom
chore/license-change

RBKunnela commented May 15, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented May 15, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot May 15, 2026

Uh oh!

gemini-code-assist Bot May 15, 2026

Uh oh!

gemini-code-assist Bot May 15, 2026

Uh oh!

RBKunnela commented May 15, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	Non-production use is permitted without restriction. Production use is permitted except for offering the Licensed Work to third parties on a hosted or embedded basis that competes with the Licensor's paid version(s). For commercial licensing, contact the Licensor.
	Non-production use is permitted under the terms of the BSL 1.1. Production use is permitted except for offering the Licensed Work to third parties on a hosted or embedded basis that competes with the Licensor's paid version(s). For commercial licensing, contact the Licensor.

		Change License: MIT License, as published by the Open Source Initiative
		at https://opensource.org/licenses/MIT.

Conversation

RBKunnela commented May 15, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Files changed

Notes for reviewers

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented May 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot May 15, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 15, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot May 15, 2026

Choose a reason for hiding this comment

Uh oh!

RBKunnela commented May 15, 2026

Narrowed Additional Use Grant

What changed

Why

What the restriction now targets

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

RBKunnela commented May 15, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented May 15, 2026 •

edited

Loading