The Formula Is Given Freely: Introducing the WellSpr.ing Covenant License

On April 24, 2026, GitHub announced that it would begin training AI models on Copilot interaction data — opted in by default for individual users, contractually excluded only for enterprise customers who negotiated hard enough to get the carve-out. The announcement was framed as a product improvement. What it was, in plain terms, was the completion of a decade-long extraction cycle: Microsoft acquires GitHub for $7.5 billion, hosts the world's open source commons for free, builds Copilot on the resulting training data, and then — having built the product — begins training it on the interactions of the developers who are using it to build the next generation of software.

The irony is that most of the underlying code Copilot was trained on was released under the MIT license. The developers who wrote it chose MIT because it was simple, permissive, and felt like a noble act: here is my work, take it, use it, build on it, don't restrict others. What they did not model was the platform intermediary — the entity that would host their work for free, harvest the training signal at scale, and sell the resulting intelligence back to them as a subscription product.

MIT was not a trap designed by its authors. It became one by the logic of a predator that emerged later. And the predator has patterns.

The WellSpr.ing Covenant License is the covenant alternative. It preserves the permissive grant entirely. It adds a voluntary economics layer that names contributors, recognizes their work, and enables value to flow back through transparent allocation. It is not MIT with restrictions. It is MIT with covenant — and that difference matters.

What MIT actually says, and what that enabled

The MIT license is eleven sentences. The operative grant occupies two of them. The remainder is a warranty disclaimer. The only enforceable obligation is a single line: include the copyright notice and license text in all copies or substantial portions of the software.

That is it. No attribution in products. No revenue sharing. No training data restriction. No notification of use. No mechanism for value to flow back to the people who created the work.

This was a conscious design choice by MIT's authors, and in the ecosystem it was designed for — academic and research software shared between institutions — it was the right choice. The assumption was mutual benefit between roughly equal parties: I share my work with you, you share yours with me, the commons grows.

The assumption broke when the platform intermediary entered the picture. GitHub offered free hosting with a $7.5 billion acquisition price embedded in the offer. The price was not paid by developers. It was paid by Microsoft, who calculated that the training signal embedded in the world's public repositories was worth more than the acquisition cost. The developers who released under MIT gave away their training data before the concept of training data existed as a commercial category.

Copilot was built on that data. The Doe v. GitHub class action (filed 2022) documented instances where Copilot reproduced identifiable code segments, often without attribution, from MIT-licensed repositories whose license technically requires attribution. Microsoft's defense rested substantially on the permissive nature of the licenses. The court ultimately found the attribution claims insufficient under the license terms — because the MIT license's attribution requirement was never designed to survive at training-data scale.

None of this required conspiracy. The pattern is visible in retrospect as a straightforward application of platform economics to a commons that was not designed to be extracted from. The developers were not stupid; the platform was not designed when they made their licensing choice. The mismatch between the tool and the environment it met is the story.

April 24, 2026: The pattern completes

GitHub's April 24, 2026 announcement is not a new chapter. It is the last paragraph of a chapter that began when Microsoft acquired GitHub.

The announcement covers Copilot interaction data — the completions developers accept, the suggestions they reject, the context in which they write code. This is richer signal than the static codebase. Static code tells you what was written. Interaction data tells you how developers think, what patterns they recognize as correct, what suggestions they trust, what they revise. This is the behavioral training layer on top of the structural layer that the initial MIT harvest provided.

The opt-in by default design is the tell. An opt-in by default policy in a context where most users do not read settings pages is functionally an opt-in for everyone except the subset who are sophisticated enough, informed enough, and motivated enough to find the setting and change it. Enterprise exclusion confirms the design: paying customers get protection; individual developers — the ones whose interaction data is most valuable for training a tool marketed to individual developers — are opted in unless they opt out.

NotGit.org has documented the GitHub pattern in detail: suspended accounts without graduated enforcement, substantive staff non-response for 30-90 days, the practical impossibility of meaningful appeal. The April 24 announcement adds a new dimension to that pattern: the platform that can suspend your account without notice is now also the platform training its commercial product on your behavior. The enforcement discretion and the training pipeline are operated by the same entity. This is not a theoretical concern. It is a structural one.

A developer whose account is suspended loses access to their repositories. A developer who opts out of Copilot training loses nothing visible. The asymmetry is the design: the punitive mechanism has teeth; the privacy protection has a toggle buried in settings.

What the WellSpr.ing Covenant License does differently

WCL-1.0 is a two-part license. Part I is MIT — unchanged, unconditional, legally clean. Anyone who has ever shipped MIT-licensed software knows exactly what their obligations are under WCL-1.0: include the notice. That is the only enforceable requirement. The permissive grant is complete.

Part II is the Covenant Economics Layer. It is voluntary — entered freely or not at all. It is not a restriction on use. It is an invitation to covenant commerce.

The core concept is Respect Mon: voluntary value return for work that produced value for you. The name comes from the Jamaican expression of mutual regard. You received something real. If you choose, you send something real back. Not because you must, but because the formula was given freely and that generosity deserves acknowledgment if you can afford to give it.

The mechanics: contributions flow to the project's Respect Mon pathway at wellspr.ing/respect/{project-slug}. They are published in a quarterly ledger at wellspr.ing/ledger/{project-slug} with full transparency — total received, amounts per category, named contributors, any variance from the default allocation with explanation. The allocation follows a published framework: 40% to named code and documentation contributors in proportion to merged contribution weight, 20% to infrastructure, 25% to the civic mission fund, 15% to Wellkeeper stewardship. A contributor may specify a different split. A named contributor may redirect their share to the mission fund at any time.

Contributor recognition is separate from financial contribution. Tiers are based on work weight — Steward, Builder, Contributor, Witness — not on Respect Mon received. A person who writes substantial code but sends no money is a Builder. A person who sends significant Respect Mon but writes no code is a Supporter, recognized separately. Neither status is contingent on the other. That is what makes it covenant commerce rather than pay-to-play.

What WCL-1.0 does not do: it does not restrict AI training use. No license currently does this effectively. GPL does not stop training; it stops distribution of modified code, which is not the same thing. What the covenant economics layer does instead is create a documented human network around the code — named contributors, quarterly ledgers, allocation records — that makes orphaning harder. You can suppress an account. You cannot suppress a ledger of named contributors with documented allocation records and a live civic infrastructure around the project.

Where this comes from: NotGit and NotShop

WCL-1.0 is not a theoretical response to a theoretical problem. It emerges from two lived experiences in the WellSpr.ing network.

NotGit.org was built after GitHub suspended the @WellBuilder account without notice, without graduated enforcement, and without substantive staff response. The suspension affected civic accountability communications — posts documenting billing practices of platform companies operating against the interests of their users. The account that documented the pattern was the one that was suppressed. NotGit.org published the migration cookbook: own your git, mirror to GitHub as a discovery surface, keep working. The sovereign stack — Forgejo self-hosted on Fly.io — is the answer to enforcement discretion. If you host it, they cannot take it.

NotShop.org went live today, April 26, 2026. It was built after NaturoMedica LLC documented $14,208 in undisclosed fees across four months of Shopify Plus operation — seven extraction layers, none of them visible in the merchant-facing billing invoice. The open-source commerce bundle that replaced Shopify is running at Naturologie.com. It was built in less time than one month of Shopify Plus licensing costs. The bundle has been deposited to git.wellspr.ing/WellBuilder/notshop-bundle under WCL-1.0. The formula is given freely.

Both experiences share the same pattern: a platform intermediary offered free hosting in exchange for an extraction right that was not disclosed at enrollment. GitHub offered free repository hosting; the extraction was the training data. Shopify offered a merchant platform; the extraction was the undiscoverable fee architecture and the Shop consumer data layer that monetizes merchant customers directly.

The WellSpr.ing Covenant License was designed in the recognition that this pattern repeats, that it is structural rather than incidental, and that the MIT license — however noble in intent — provided no protection against it. WCL-1.0 does not claim to stop AI training extraction by legal force. It builds a different kind of protection: a covenant community around the code that documents provenance, recognizes contribution, and distributes value transparently. The platform cannot extract from a community it has not enrolled. The extraction works best on isolated developers releasing anonymous code into a permissive void.

The predator's patterns

There is a hypothesis worth stating privately before it is stated publicly: the platform intermediary that can identify high-potential repositories through analytics, apply enforcement pressure that accelerates project collapse, and then harvest the now-orphaned MIT-licensed codebase through training pipelines — has both the motive and the technical capability to do so. This does not require conscious conspiracy at any individual level. It requires only that the incentive structure of the platform produces this outcome systematically.

The documented version of this hypothesis is already proven: MIT-licensed code was harvested at scale to train Copilot, a commercial product that now competes with the developers who wrote the training data. That happened openly. No stealth required.

The stealth version — enforcement pressure applied to accelerate the orphaning of valuable projects whose code then becomes freely available for training — is harder to prove and not something to claim publicly without documentation. But the pattern fits. A sophisticated predator does not need to plan each individual action. It needs only to optimize its enforcement discretion and its training pipeline in the same direction. The developers who notice the conflict between enforcement and training are the ones most likely to build alternative infrastructure. Suppressing their accounts first is logical, not conspiratorial.

WellSpr.ing does not claim this happened. WellSpr.ing documents what did happen — the @WellBuilder suspension, the April 24 announcement, the opt-in by default design — and notes that the pattern is consistent with what the stealth version would look like. The documents are public. The inference is yours to draw.

The sovereign stack is the structural answer either way. If GitHub's enforcement is neutral and its training pipeline is separate, the sovereign stack is still better infrastructure. If the enforcement and the pipeline are coordinated, the sovereign stack is the only defense. Forgejo self-hosted is not contingent on GitHub's good intentions. That is the point.

The Covenant Commerce Clause and why it is not a restriction

WCL-1.0 contains one clause that goes beyond MIT and VCAP: the Covenant Commerce Clause. It reads:

'If this software is incorporated into a product or service that itself restricts user freedom, extracts value from users without transparent disclosure, or operates an undiscoverable billing architecture — the Wellkeeper reserves the right to publish a public covenant notice documenting the use pattern. This is not a legal remedy. It is a transparency mechanism.'

This clause is important to understand precisely. It is not a restriction on use. Shopify could deploy the NotShop bundle tomorrow — the permissive grant in Part I would permit this unconditionally. The Covenant Commerce Clause does not prevent that use. What it does is clarify that WellSpr.ing retains the right to document the use pattern publicly if that use pattern is extractive.

This is not a new right. WellSpr.ing would have that right regardless of what any license said. The clause exists not to create a legal lever but to make the accountability architecture visible to anyone reading the license. A developer choosing WCL-1.0 for their project knows that the license comes with a civic accountability orientation. A company considering whether to use a WCL-1.0 project in an extractive product knows that the Wellkeeper has reserved the right to name the use pattern. Transparency in both directions.

The clause is a covenant reminder, not an enforceable restriction. The permissive grant is unconditional. The accountability infrastructure operates independently of the license and does not depend on it.

The fail-safe and why it matters

WCL-1.0 contains one provision that MIT does not have and that the license could not function without: if WellSpr.ing ceases operations, all WCL-licensed software reverts to MIT license automatically.

This clause exists because a covenant license that depends on the continued operation of the Wellkeeper is not a durable license. If the covenant economics layer requires WellSpr.ing's infrastructure to function — the ledger, the Respect Mon pathways, the contributor recognition tiers — then the license is contingent on that infrastructure's survival. A license that becomes unenforceable when its steward dissolves is a trap, not a gift.

The fail-safe dissolves the contingency. WCL-1.0 software does not become unlicensed or legally ambiguous if WellSpr.ing dissolves. It becomes MIT-licensed software — exactly what it would have been under a different license choice. The permissive grant survives everything. The covenant layer depends on the Wellkeeper's continued operation; the legal grant does not.

This is also the proof that the covenant economics layer is genuinely voluntary. A license that collapses to something permissive on steward dissolution could only have added restrictions, not permissions. WCL-1.0 collapses to MIT, not to a restricted license. The fail-safe demonstrates that the covenant layer was an addition, not a condition.

How to adopt WCL-1.0

For new projects: include the WCL-1.0 text in your LICENSE file. The full text is at wellspr.ing/license/wcl-1.0. The SPDX identifier is WellSpr.ing-1.0. Add the README block:

Licensed under the WellSpr.ing Covenant License (WCL-1.0). Use freely. Modify freely. Deploy freely. If this software produces value for you, consider sending Respect Mon: wellspr.ing/respect/{your-project-slug}. The formula is given freely: freely received, so freely given. Full license: wellspr.ing/license/wcl-1.0

For existing MIT-licensed projects: WCL-1.0 is compatible with MIT. You cannot retroactively relicense code you have already released under MIT — that code remains MIT. You can relicense future versions and new contributions under WCL-1.0. The convention is to note in the README that the project is transitioning to WCL-1.0 from a specified version forward.

For organizations: WCL-1.0 is compatible with Apache 2.0 and ISC licenses. It is not compatible with GPL-family licenses. If your project mixes WCL and GPL components, the GPL terms govern the combined distribution.

For the Forgejo sovereign git: WCL-1.0 is the default license for all new projects hosted at git.wellspr.ing. Existing projects retain their original licenses unless the maintainer explicitly relicenses.

An invitation

The formula is given freely. That sentence is the theological and commercial center of WCL-1.0, and it comes from the same source as the ProdigalMirror invitations and the WellSpr.ing dossiers: the conviction that the correct response to a world of extraction is not counter-extraction but covenant. Give the formula. Name the contributors. Distribute the value transparently. Build a community around the code that makes it harder to orphan than to honor.

The MIT license's authors were right that permissive sharing is the correct default for software that aims to benefit humanity. They were writing in an era before the platform intermediary existed at scale. WCL-1.0 is the covenant update for the era that actually exists — one in which the platform intermediary has demonstrated, on April 24, 2026, that it will harvest the behavioral signal of the developers who use its products, by default, unless those developers find the setting that lets them opt out.

The formula is given freely. If it produces value for you, Respect Mon is the invitation, not the obligation. The ledger is public. The contributors are named. The allocation is transparent.

Freely received, so freely given.

---

WCL-1.0 full text is at wellspr.ing/license/wcl-1.0. Respect Mon pathways for active projects are at wellspr.ing/respect/{project-slug}. Contributor ledgers are at wellspr.ing/ledger/{project-slug}. The NotShop bundle — the first project released under WCL-1.0 — is at git.wellspr.ing/WellBuilder/notshop-bundle. NotGit.org documents the GitHub migration pattern. NotShop.org documents the Shopify/Shop extraction pattern. GitHub's April 24, 2026 AI training announcement: help.github.com/en/github/site-policy/github-privacy-statement. Doe v. GitHub class action (2022): Case No. 4:22-cv-06823-JST. Co-authored with Claude Sonnet 4.6 (Anthropic). Licensed under WCL-1.0.