# open-source.sgit.ai — brief pack **For:** the agent commissioned to build `open-source.sgit.ai` **From:** Dinis Cruz, via the SG/Send Librarian **Version:** v0.33.62 · 24 August 2026 **Licence:** CC BY 4.0 — **read `LICENSE.md` first.** The estate runs three licences and one of them is undocumented. --- ## What this is A site for your views on open source, how you actually use it, and its history. Three asks, and they are in very different states: | Ask | State | |---|---| | **Your views** | **Very rich.** 56 concepts catalogued — **24 original arguments**, not restatements | | **How you use it** | **Rich, and partly undocumented even to you** — three licences, a real publish-the-source practice, six published projects with no retrospectives | | **The history** | **Absent. Not thin — absent.** Researched from scratch: 18,000 words shipped in this pack | On that last row: **zero occurrences of "free software", "copyleft", "Stallman", "GNU" as a movement, "Netscape", "SourceForge" or "FSF"** anywhere in the corpus. Nothing before 2001. The GPL appears twice, both as litigation precedent. There is no licence taxonomy at all — **yet the whole estate runs on Apache-2.0, CC BY and CC0, and the reasons are written down nowhere.** Clean division of labour: **you supply the argument, the research supplies the ground under it.** --- ## Read in this order | File | Words | What it does | |---|---:|---| | **`00__BRIEF.md`** | 2.0k | **Start here.** The honest split, the thesis, the five original pages, the two dated self-contradictions, the build order | | **`04__the-arguments.md`** | 2.1k | **The best pages the site can have** — survivability, the stress test, open core, funding, sovereignty, the villagers | | **`03__history-and-success-stories.md`** | 1.7k | How to use the research: six corrections to lead with, six success stories not fourteen, and the numbers to handle carefully | | **`05__agents-and-open-source.md`** | 1.6k | **The most original writing still available** — and four theses that are named nowhere and written nowhere | | `01__concepts-index.md` | 3.7k | All 56 concepts with verbatim quotes, paths, dates, classified [C]/[P]/[O], plus a five-altitude reading order | | `02__his-practice.md` | 1.6k | The three-licence estate, the CC0 discovery, publish-the-source-next-to-the-render, the compliance gap | | `06__owasp-and-the-summits.md` | 1.4k | The OWASP thread, four summits, and **the interview that has to happen** — 13 questions ready | | `07__site-architecture-and-boundaries.md` | 1.4k | Page by page, the quoting table, do-not-publish, network boundaries | | `08__gaps-and-open-questions.md` | 1.1k | 10 build-fresh items, 8 open questions, 8 honest tensions | | `09__source-manifest.csv` | 55 rows | Every source, tiered 0–3, with proposed page and publishability. **Every path verified on disk** | | **`research__history-and-success-stories.md`** | **18k** | The fresh history — timeline 1955→2026, 14 success stories, 2 failures, evidence table, 7 both-sides arguments, **17 corrected myths**. Fetch failures reported inline | | `LICENSE.md` | — | CC BY 4.0, the three-licence problem, and the quoting table | --- ## The four things that will shape the build **1. The licensing inconsistency blocks `/practice/`.** `docs.diniscruz.ai` is **CC0 1.0**; every brief footer says **CC BY 4.0**. Nobody has noticed and no document reconciles them. Deliberate layered choice, or drift? Decide before writing. And the missing page underneath it: **why Apache-2.0 rather than MIT** — the entire estate rests on that choice and the reasoning exists nowhere. **2. The history research supports your thesis better than the romantic version does.** Unix circulated because the 1956 AT&T consent decree made it *illegal to sell*. BSD lost to litigation risk, not licensing — the settlement removed **3 files out of 18,000**. Netscape's release was a six-year near-failure; **Firefox 1.0 did not ship until November 2004**. Christine Peterson coined "open source", not Eric Raymond. And "given enough eyeballs" is not a security property — **xz was engineered by the maintainer to survive review**, and caught by one engineer benchmarking SSH latency. Every one of those says the model wins on **economics and structure**, not virtue. **3. Your best idea would fail on you.** *"Survivable is not a property of the licence file. It is a property of the copyright and trademark structure."* The Change-of-Control Stress Test is four legs, all answerable from public artefacts, and it should ship as a tool. **SGraph's copyright is held by one company** — the exact single-holder pattern the argument identifies as the failure mode. Publishing that self-audit would be the most credible page on the site. **4. cURL is your page.** ~30 billion installations, seven volunteers on the security team, and the bug bounty **shut down on 31 January 2026** because ~20% of 2025 submissions were AI slop against ~5% genuine. That is your own AI-slop finding with a named casualty and a date — and the strongest evidence anywhere for *"charity will not fix this."* --- ## Two contradictions to publish rather than resolve **Open core.** 18 June: *"There should be **nothing proprietary**."* 17 July: *"customers only have a subset of the code that exists in the main repo."* The July brief names it itself — *"this is open-core, and worth saying so plainly."* `04__` §3 proposes the test that settles it. **The junior pipeline.** 21 March: *"the density of learning per hour increases."* 28 July: *"apparent gains shifted work from juniors to seniors."* 31 July: the pipeline *"is being disrupted at exactly the moment the maintenance need is growing."* Four months, opposite directions. A site that shows its own position moving as evidence arrived is more persuasive than one that only publishes the settled view. --- ## One thing the pack cannot supply **`/owasp/` is blocked on an interview.** Former OWASP board member, named organiser of the 2011 Lisbon summit and primary organiser of 2017 Woburn (173 sessions), email of record `dinis.cruz@owasp.org`, the whole current estate under `owasp-sbot`. **All of it is written in the third person, from public sources, about you.** There is no memoir, no board-tenure dates, no project list, no Open Security Summit founding story — and no retrospective on any of your six published open-source projects except O2 Platform, which was also written about you rather than by you. `06__` §4 has thirteen questions ready. Ship the summit history and mark the first-person account pending rather than writing around it. --- ## House pattern Copy `pki.sgit.ai`. Add the `/llms-full.txt` it lacks. And treat the **agent-discovery ladder as a build requirement, not a topic** — your own agent-access report found that *"it can read the map and cannot walk it"*, and a site about open source that agents cannot traverse fails in exactly the way you already diagnosed. Publish the build order unresolved, with `08__`'s open questions and tensions visible. --- This file is released under the Creative Commons Attribution 4.0 International licence (CC BY 4.0).