# Open-source governance

Decision date: 2026-08-27  
Copyright holder: NPO NT
Application licence: GNU AGPLv3 only (`AGPL-3.0-only`)  
Status: strategic decision confirmed; public source location assigned; other administrative release details pending

## Decision

NPO NT has selected open distribution for the MIKA De-ID Local client. The decision covers the combined local application, including the code that directly integrates the AGPL edition of PyMuPDF/MuPDF.

This licence decision concerns software. It does not authorize publication of patient documents, medical datasets, credentials, production configuration, or MIKA case data.

## Binary/source pairing rule

Every distributed binary must be paired with exact Corresponding Source. The release record must contain:

- application version and immutable source identifier;
- binary and source SHA-256 values;
- complete build and installer scripts;
- exact dependency lock and build environment;
- OCR model identifiers and hashes;
- complete licence and third-party notices;
- source acquisition link visible next to the binary;
- verification that a clean third party can rebuild the product;
- archive-retention owner and duration.

## Interface notice

Every interactive build must visibly expose:

- NPO NT copyright;
- GNU AGPLv3 licence identity;
- absence-of-warranty notice;
- how to view the full licence;
- how to receive exact Corresponding Source;
- clear separation between open software rights and private medical data.

## Trademark boundary

The AGPL licence grants software rights but does not grant a right to imply that a modified build is an official MIKA or NPO NT release. A separate trademark and official-build policy must be approved before P1.

## External contributions

No real patient material may enter the repository. A contributor signoff or contributor agreement process, code-review ownership, and release-maintainer roles must be approved before accepting external production code.

## Pending administrative details

- exact registered legal name and postal address of NPO NT;
- public security-reporting contact;
- official trademark-use policy;
- contributor signoff or CLA/DCO decision;
- long-term source archive owner;
- jurisdiction-specific legal review of the release package.
