# ADR-18: Licensing (CeCILL-2.1 vs MIT)

**Status**: accepted (2026-06-13) — relicensed to dual `CeCILL-2.1 OR AGPL-3.0-or-later`
**Blocks**: workstream C, workstream D, all releases

## Accepted decision (2026-06-13)

The maintainer chose to **relicense `dag-ml` and `dag-ml-data` to the ecosystem-standard
dual open-source license `CeCILL-2.1 OR AGPL-3.0-or-later`** (a stronger variant of option
(b) below — CeCILL-2.1 with AGPL-3.0-or-later as the co-equal international equivalent, rather
than MIT). This makes the crates license-compatible with the rest of the nirs4all ecosystem
(`nirs4all`, `nirs4all-methods`, `nirs4all-io`, `nirs4all-formats`, …), so they can be combined
or vendored without the path-(c) non-incorporation constraint. No commercial layer is attached
to these two low-level coordinator libraries.

Crate metadata now declares `license = "CECILL-2.1 OR AGPL-3.0-or-later"`; the root `LICENSE`
ships the AGPL-3.0-or-later text (recognized by code hosts) and the dual choice is documented in
`LICENSING.md`. The options below are retained for historical context.



## Context

`nirs4all` is licensed CeCILL-2.1. `dag-ml` and `dag-ml-data` are MIT. When nirs4all takes a hard dependency on the MIT crates/wheels, the redistribution obligations of the combined work must be analyzed. This is load-bearing for any release that ships nirs4all together with the dag-ml backend.

This ADR is **proposed**, not accepted: it documents the options and requires the maintainer (Guilhem) to choose. Until a decision lands, releases proceed under path (c) by default.

## Decision (options — maintainer must select one)

**(a) Keep current licenses + thin CeCILL-compatible wrapper.** nirs4all stays CeCILL-2.1 and depends on MIT dag-ml as an external runtime dependency. MIT is permissive and CeCILL-2.1 is GPL-compatible, so MIT-into-CeCILL is generally fine, but the combined-work obligations warrant a one-page legal read before this is declared safe.

**(b) Dual-license dag-ml / dag-ml-data as `MIT OR CeCILL-2.1`.** Lets nirs4all incorporate dag-ml source under matching terms if source vendoring is ever needed. Costs: every contributor must agree to dual-licensing; the `LICENSE` files and crate metadata change.

**(c) Explicit non-incorporation (recommended default).** nirs4all consumes dag-ml strictly as a PyPI / crates.io **runtime dependency** — no source vendoring, no static linking of source into the nirs4all distribution. The license boundary stays clean: each project ships under its own license and users install both. Lowest friction; recommended unless source vendoring becomes necessary.

## Consequences

- Workstream G task 4 produces a one-page redistribution analysis once a path is chosen; this ADR is then updated to **accepted** with the selected path and the analysis linked.
- Until then, the release train (ADR-10) operates under path (c): dag-ml and dag-ml-data are published as independent dependencies, never vendored into nirs4all's source tree.
- Crate metadata (`license = "MIT"`) and nirs4all's `license = "CECILL-2.1"` remain unchanged under path (c).

## Risk

- Choosing (a) or (b) later, after path (c) has shipped, is non-breaking for users (they already install both packages) but requires the legal read and, for (b), contributor re-licensing consent. Deferring the decision is therefore low-risk as long as path (c) is the operating default.