ADR 0001 — Third-party license compatibility

Accepted (amended 2026-11-01: third-party data and published facts) · 2026-10-31 · reflex/docs/adr/0001-third-party-license-compatibility.md

Status: Accepted (amended 2026-11-01: third-party data and published facts) Date: 2026-10-31 Source: the stack’s license posture, set in cortex’s ADR 0001 Related: ADR-0002

Context

reflex is MIT-licensed (see the top-level LICENSE), like the rest of the Branes.AI stack. Its controllers, filters and models are meant to be redistributed inside partners’ flight software, so every dependency has to be compatible with MIT and carry its notices. cortex records the same posture in its ADR 0001. reflex had followed it without recording it.

Dependency license matrix

Dependency	License	Compatible with MIT reflex?	How it is used	Obligation
MTL5	MIT	Yes	FetchContent: the vectors and matrices	Bundle its LICENSE in a distribution
Universal	MIT	Yes	FetchContent, tests only: the components are generic and never name a Universal type	Bundle its LICENSE with source
mp-dsp	MIT	Yes	FetchContent, tests only: the reference the dsp/ tests compare against	Bundle its LICENSE with source
Catch2 v3	BSL-1.0	Yes	FetchContent, tests only	None for object code; bundle with source
Emscripten (emsdk)	MIT or University of Illinois/NCSA	Yes	Build tool for the WebAssembly module the docs site runs	None for the tool
Emscripten’s runtime libraries: musl, LLVM libc++, libc++abi and compiler-rt	MIT; Apache-2.0 WITH LLVM-exception	Yes	Linked into the WebAssembly module	The LLVM exception waives the notice requirement for compiled code; the musl notice goes with a distribution of the module

| ajv | MIT | Yes | Runtime dependency of the trace player (packages/trace-player), released with reflex: validates traces | Its notice goes with a distribution of the package | | three | MIT | Yes | Runtime dependency of the trace player: the 3-D view | Its notice goes with a distribution of the package |

The trace player itself is reflex’s own code, MIT-licensed, and other repos’ sites use it, so its dependencies are part of what reflex ships.

Data is someone’s work too. Fixtures, traces and tuning made by reflex are its own. A third-party dataset or set of pretrained weights may be committed or fetched only under a license this table records; data without one, or under a non-commercial or share-alike license (CC BY-NC, CC BY-SA, …), stays outside the repo. A dataset’s published facts are not its data: calibration parameters, sensor specifications and results printed in a paper may be written into the repo’s own files, with a citation to their source. A file copied from a dataset is the dataset’s, and follows the rule above.

No GPL, LGPL, AGPL, MPL or SSPL dependency is accepted. ADR-0002 is the wider policy: no GPL code for any purpose, including the flight stacks most often used as references. An exception would need an ADR of its own that supersedes this one.

Decision

1. reflex stays MIT-licensed. Every dependency must be compatible with MIT.
2. A PR that adds a dependency must add it to this table, with its license and its obligation. A dependency that is dual-licensed is used under its permissive branch.
3. Any file of someone else’s work committed to reflex (copied, ported or generated from a third-party source) is listed, with its license text, in a top-level THIRD_PARTY_NOTICES.md, as synapse does. The PR that adds the first such file creates it.
4. Third-party data and weights are committed or fetched only under a license recorded in the table above; the rest stays outside the repo. Published facts (calibrations, specifications, a paper’s results) may be quoted, with a citation.

Consequences

• This table answers a partner’s license review: what reflex links, and under which terms.
• Scope. This covers what reflex ships, the code that builds it and the tests, the WebAssembly module and the trace player included. The docs site’s toolchain is not part of it. Astro brings in sharp (Apache-2.0) to process images, and sharp brings prebuilt libvips binaries, the @img/sharp-libvips-* packages (LGPL-3.0-or-later). They only build the documentation, in CI and on developers’ machines.
• Current state: reflex’s dependencies, and the trace player’s, are those in the table. It contains no third-party code and no third-party data, so it has no THIRD_PARTY_NOTICES.md yet. No release artifact bundles the dependencies’ license files, because reflex has no packaged release.