The core is one thousand percent open. The content on top isn't. Here's the line.
Hub's platform core is being released under the AGPL: the broker, the gates, the audit, the records engine, the run ledger and the agent layer. The skills, automations, workflows and dashboard presets built on top stay proprietary and are sold with the setup work. Builders own what they build.
Why give the hard part away.
Free users are the marketing
Open source can't stop free, non-paying use, and we're not trying to. Consulting and the content layer are the revenue. A team that runs the core well is a team that might want the presets.
Copyleft keeps hosted forks honest
AGPL means anyone running a modified hosted version has to publish their changes. That defangs the free-rider without an anti-resale clause, which is the model the well-run open-core companies settled on.
The governance is the moat, and it's near-unreviewable alone
Ten-step fail-closed gate chains and eight-thousand-line migrations are a strength and a bus-factor. Opening them is how they get more eyes than one.
It's how we'd want to be sold to
The pitch we give clients ends with a question: has a job ever run start to finish, and can I see the receipt? A public board is the only honest way to answer it.
What's open, what isn't.
One repository, not two. A core and an extensions directory with licence markers, an import-lint rule at the boundary, contract tests and one exported public surface. A contributor licence agreement before the first outside contribution. The MIT scaffold on the old mirror is being corrected to AGPL before anything publishes, because one MIT push can never be taken back.
| Layer | What | Licence | Model |
|---|---|---|---|
| Platform core | Broker, gates, audit, records engine, run ledger, approvals desk, agent layer, the app | AGPL-3.0 | Free |
| Skills, automations, workflows, presets | The built content layer: what a marketing agency's Hub knows and does | Proprietary | Consulting and licensing |
| Third-party plumbing | Supabase, Airbyte, Nango, n8n | Their own | Bought, not built |
Why the repo isn't public already.
The private repo has no live credentials in its tree or history. It is saturated with client-identifying data: client names, contact details, a revenue ledger, meeting recaps, and hundreds of internal operating docs. About three quarters of its commit history is multi-agent ledger bookkeeping. It can never be safely flipped public, and rewriting its live history would break every worktree and the lanes protocol the agents work under. So the public repo is a filtered, fresh-history mirror.
The gates the mirror passes before a person pushes it
- 01
A canary-checked term sweep over every commit: blobs, messages and identities. Zero hits or the build fails.
- 02
A secrets scanner over the full history, with audited false positives allowlisted.
- 03
A clean install, the full test battery and a production build on the mirror tip.
- 04
Every scrubbed worker's own test suite.
- 05
No git remote on the mirror. Publishing is a person's act, never automated.
The one hard blocker left: a bundled icon font whose licence forbids redistribution. It's being swapped for an open set before the first push.
The order things happen in.
- 01
This site, the board and the docs
livePublic now. The roadmap is generated from the same file the agents work from.
- 02
The first end-to-end run
aheadA deliberately boring task on a throwaway target, watched, with a receipt. The board's highest-weighted risk closes.
- 03
The licence acts
aheadAGPL stamped, lawyer read, the MIT scaffold corrected, a CLA in place.
- 04
The marketing-agency preset becomes a preset
aheadNo public release before the agency shape is genuinely config, not code.
- 05
The fresh-history mirror
aheadBuilt by the pipeline, gated, then pushed by a person to the public repo.
- 06
The Next.js rebuild, in the open
aheadOne section at a time, on the public repo, behind the same design system.
How to follow along.
Before the mirror lands there's nothing to send a pull request to, and we'd rather say that than pretend. What helps now: tell us what you'd need to run this in your own shop, and what in the docs doesn't make sense to a stranger. Both go straight onto the board.