Skip to content

Licensing & IP#

The CSO requires "ownership or appropriate licensing and data rights for all proposed technologies." This document is the dependency inventory and the production-migration plan.

Argus-authored components#

All code in src/argus_aitr/, scripts/, tests/, and docs/ authored by Argus Defense is Apache-2.0 (see LICENSE). Apache-2.0 is permissive, government-compatible, and standard for defense-adjacent open-source work.

This covers:

  • Pipeline orchestrator (pipeline.py)
  • Module contracts (types.py)
  • Ingest sources + post-award stubs
  • IoU+Hungarian tracker
  • Monocular ranger + class priors
  • Threat heuristic
  • Stabilizer (Identity + Feature)
  • Perturbation simulator
  • Operator HMI (server, overlay, static frontend)
  • CROWS adapter (mock + GVA stub)
  • Telemetry sink (JSONFileSink + TAK stub)
  • Audit logger
  • All test code, sample-data generator, demo launcher

Open-source dependencies#

Package License Used for Production migration
numpy BSD-3 array math keep
opencv-python Apache-2.0 video I/O, image ops, drawing keep
pydantic MIT contracts keep
fastapi MIT HMI keep
uvicorn[standard] BSD-3 HMI server keep
sse-starlette MIT SSE for live HMI events keep
structlog Apache-2.0 logging primitives keep
scipy BSD-3 Hungarian assignment keep
ultralytics AGPL-3.0 YOLOv8 model loading + inference (PoC convenience) migrate: replace with RT-DETR (Apache-2.0) or Ultralytics commercial license post-award (see below)
torch / torchvision BSD-3 underlying ML runtime keep
pytest, ruff, httpx MIT / BSD dev/test keep

The AGPL caveat (Ultralytics) and migration plan#

Why it matters for the proposal. Ultralytics 8.x (the YOLOv8/v10 package) is licensed AGPL-3.0. The AGPL "service over a network" clause means a derivative work shipped as a network service must also be AGPL-compatible. For a public PoC repository this is acceptable — the repository is public and Apache-2.0 imposes no additional restriction the AGPL forbids. For a production deployment to a DoD customer, the AGPL obligations conflict with the typical procurement posture.

Two clean migration paths, planned for Month 1–2 post-award:

  1. Replace the detector with RT-DETR (Apache-2.0). RT-DETR has the same call surface (HuggingFace transformers or standalone). The YOLODetector is already constructor-parameterized — swapping weights and the loader is a single-file change. Performance is competitive.
  2. License Ultralytics commercially. Ultralytics offers a commercial license that supersedes the AGPL. If retaining the YOLOv8/v10 family is preferred (operator ergonomics, tooling), Argus would purchase the license as part of the post-award budget.

The architecture decouples this concern entirely. The Detector ABC and the constructor-driven configuration mean either migration is days of work, not weeks.

Data rights#

  • Code: Apache-2.0 (Argus-authored); see table above for deps.
  • Training data (PoC): No fine-tuning performed in 48 h; the PoC uses pretrained COCO weights. No training data dependency exists in this artifact.
  • Sample video clips (PoC): Fetched at install time via samples/download.sh, never committed. Each clip is attributed in samples/README.md with its source and license (target: CC-BY / CC0).
  • Training data (post-award): Argus will license UAS imagery for the fine-tuning round. Source candidates include commercial drone-imagery vendors, the open Anti-UAV / MAV-VID research datasets (research-only; reference only, not redistribution), and government-shared collections. License terms will be tracked per-dataset.

Foreign IP / supply-chain posture#

  • No restricted-country contributions to Argus-authored code.
  • No use of components originating from restricted jurisdictions per EAR / ITAR guidance.
  • Domestic-controlled hosting for the public artifact (GitHub) and the hosted demo (Hugging Face Spaces or fly.io, both US-controlled).

Patents / trade secrets#

  • No patents asserted on the 48-hour PoC artifact. All code is open.
  • Post-award, the AiTR pipeline's tuning, fine-tuned weights, and any novel integration with CROWS / supplementary sensors will be evaluated for trade-secret protection in coordination with DIU and Argus counsel.

Bottom line#

Argus owns the integration code, the architecture, the HMI, the audit framework, the perturbation simulator, and the integration contracts. OSS dependencies are catalogued and the one AGPL component has a documented two-path migration plan that fits inside the 3-month post-award window.