Weights vs code licenses

AI releases often stack different legal instruments: training code license, inference code license, weight license, dataset license, and (if hosted) API terms. Literacy goal: never assume one file covers the stack. Not legal advice.

<!-- IMAGE: layered cake: data → code → weights → API terms -->

A GitHub repo under Apache 2.0 can ship weights under a Community License with AUP and scale thresholds (Llama 4 example). Mistral notes many open models are Apache 2.0, while some use modified MIT with a revenue threshold. OSAID treats parameters as their own pillar under OSI-approved terms—separate from “files are downloadable.”

For each artifact, answer:

1. What file/URL is authoritative?
2. What SPDX / Hub id is declared?
3. What extra restrictions (AUP, MAU, revenue, non-compete)?
4. What attribution / naming rules?
5. Does self-hosting still leave you under API terms for some features?

Open-source oven firmware vs a patented cake mix inside. You can hack the oven and still be restricted on the mix.

Create a 4-row table for one model: code / weights / data docs / API (if any). Fill license name + URL + date checked.

⚠️ Myth: One LICENSE at repo root covers finetuned weights you publish.

✓ Reality: Your finetune may add obligations; base weight license still matters.

⚠️ Myth: Hugging Face license: apache-2.0 always means OSAID open source AI.

✓ Reality: It’s a card field; still verify artifacts and data information.

• Llama 4 LICENSE: https://github.com/meta-llama/llama-models/blob/main/models/llama4/LICENSE ↗
• Mistral licensing article: https://help.mistral.ai/en/articles/347393-under-which-license-are-mistral-s-open-models-available ↗
• Hub licenses: https://huggingface.co/docs/hub/main/en/repositories-licenses ↗
• OSAID: https://opensource.org/ai/open-source-ai-definition ↗
• SPDX: https://spdx.org/licenses/ ↗