Contributing and License

Contributing & License

Maestro is fair-code / open-core: the whole platform is source-available and free to self-host, revenue comes from the hosted subscription. This page covers the license, the contribution terms, and the coding standards CI enforces.

License — Sustainable Use License v1.0

The same model as n8n. Copyright © 2026 Yiğit Erdoğan (Maestro).

• You may use, copy, distribute, and modify Maestro for internal business, personal, or non-commercial use; you may redistribute it free of charge for non-commercial purposes.
• You may not offer Maestro (or a modified version) to third parties as a hosted/managed service that exposes a substantial set of its features — i.e. no competing "Maestro Cloud." You may not remove license/copyright notices.
• It is source-available, not OSI-approved. No MIT/Apache grant.
• Versions published before 2026-07-11 were Apache-2.0 and remain so under that license — a fork of those versions keeps Apache rights (irreversible). The name and logo are trademarks not covered by the license.
• SPDX id: LicenseRef-SustainableUse-1.0 (backend/pyproject.toml); the frontend uses SEE LICENSE IN LICENSE.

What stays private

The real payment-processor adapter (iyzico/Stripe/etc.), cloud/tenant infrastructure, and operational deploy scripts. The PaymentProvider adapter pattern already supports this split — the public repo ships only MockPaymentProvider, and existing code doesn't change when a real one is added. See Billing-and-Quota.

Contribution terms (CLA-lite)

There is no separate CLA signature or DCO sign-off — opening a PR constitutes acceptance. By submitting a pull request you agree that:

1. your contribution is licensed under the Sustainable Use License;
2. you grant the maintainer the right to relicense it (including commercial licensing for the hosted service or a future project relicense);
3. you have the right to submit it.

A formal CLA bot is intentionally not used yet; it may be added if external contribution volume grows.

Before you open a PR

Run the exact checks CI runs (see Development-Setup):

Backend (backend/): ruff check ., ruff format --check ., pytest. Frontend (frontend/): npm run lint, npm run type-check, npm run build.

The frontend has no test runner — don't add npm test without an issue first.

Coding standards

• Language: all code, identifiers, comments, and commit messages in English. User-facing UI strings may be localized.
• Python: 3.11+, mandatory type annotations, Ruff (88 cols, rules E,W,F,I,UP,B), all endpoints async, Pydantic v2. Business logic in services/; thin route handlers.
• TypeScript: strict: true, never any (use unknown), functional components, Zustand for state, Tailwind for styling.
• No magic numbers/strings — constants live in constants.py / constants.ts.
• Adapter pattern for every external integration (LLM, payment, email) — add a new adapter, never modify existing ones. See LLM-Providers-and-BYOK.
• Migrations via Alembic only — never hand-run SQL.
• Tests: pytest + pytest-asyncio (asyncio_mode="auto"), flat backend/tests/test_*.py, run on SQLite (no Docker).

Commits & PRs

• Conventional Commits — feat / fix / refactor / test / docs / chore (+ build / ci / perf). Imperative subject under 72 chars. PR titles are lint-enforced (pr-lint.yml).

Merge blockers (hard rules)

• Never commit secrets or .env files.
• Never log, store in plaintext, or return API keys.
• Never bypass Alembic.
• Always bound agent loops (iteration + review + timeout limits).
• Never allow cross-user data leakage.

See Security for the reasoning behind these.

Business model (open-core)

The public repo is a fully working platform — auth, orchestration, BYOK, RAG, marketplace, mock payments, and a zero-cost local flow via Ollama. Revenue is hosted subscriptions (Billing-and-Quota); enterprise features (SSO, team workspaces, audit logs) may be added open-core later. Self-hosting on your own machine is — and stays — free, including the local Ollama scenario a hosted instance can't offer.