Your next upgrade is a licence change

🔭 CUSTODY PROTECTS THE COPY, NOT THE NEXT ONE

#149 was priced versus granted. #150 was reachable versus held. This week the line moves inside the licence.

Last week I told you a copy you hold cannot be re-permissioned, and that stands — your GLM-5.2 files are MIT and will be MIT in ten years. What I underweighted is that nobody stays on the copy they hold. You upgrade. And the upgrade is a different artefact with different terms, written by a company that has since worked out what its weights are worth.

Watch what three unconnected companies did in five days. Z.ai kept MIT on the small model and put a revenue gate on the good one. Anthropic shipped one model as two products and put the sharper edge behind an enrolment form. Nvidia moved to own the place you get any of it from. Not one of those restricts you today. All three are the same mechanism: the terms are becoming a tier.

And OpenAI has just handed everyone the justification. Thirty-eight pages of first-party evidence that agents will chain vulnerabilities across three companies to win a benchmark is the strongest argument ever published for gating a capable model. Publishing it was right. It is also, from last Wednesday, the citation.

That’s the reporting. Here’s the new bet — open to disagreement: by 30 June 2027, at least two of Meta, Mistral, Alibaba, DeepSeek, Moonshot and Nvidia ship their top open-weight model under a licence carrying a commercial, revenue or eligibility condition their own previous flagship did not — while keeping a permissive licence on a smaller model in the same family. Counting rules are in the deep dive. Tell me where I’m wrong.

Standing bets, briefly. The GLM licence does not settle #150’s hub-or-gateway call: Z.ai makes the model, it doesn’t run the hub. And I’m not claiming #150’s Hugging Face call on reporting alone — the wording says announced, and reported is not announced. #149’s GLM evaluation call is now live. Full scoring, with the counting rules, in the deep dive.

Deep dive: what the GLM licence actually binds, the two gates pointing opposite ways, and the upgrade decision that follows →

🎯 PROMPT OF THE WEEK

The Licence Delta

The failure this prevents is boring and expensive. Somebody bumps a pinned model to the current revision during routine maintenance, and the terms move underneath a deployment nobody re-read. GLM-5.2 to 5.3 is this week’s live example. It will not be the last.

You are advising on an open-weight model upgrade. Do not guess at licence

terms. If I have not pasted a file, ask me for it.

CURRENT: [model, exact revision hash, and the full LICENCE file we

operate under today]

PROPOSED: [model, revision, and the full LICENCE file of the version we

would move to]

DEPLOYMENT: [who hosts it, our trailing 12-month revenue, whether we resell

inference, whether we fine-tune and redistribute, jurisdictions]

Produce four things.

1. DELTA - every clause that differs, in plain English. Ignore renumbering

and formatting. For each: what it now requires, who it binds, and whether it

binds us specifically given the deployment above.

2. TRIGGERS - every threshold in the proposed licence: revenue figure, user

count, review, registration, attribution. State the number, state our current

distance from it, and say what happens on the day we cross it.

3. WHAT SURVIVES - confirm in one line what our rights to the CURRENT

revision are, independent of the new terms, and name anything that could end

them.

4. THE CALL - upgrade, stay, or stay and re-test on a date. Give the one

condition that would change your answer.

Where a clause is ambiguous, say so and quote it. Do not resolve ambiguity in

our favour.

Why it works: most licence questions get answered by skimming a model card, which is marketing. This forces a comparison of two actual files. Section 3 is the one people skip and the one that does the work — your rights to the copy you hold don’t evaporate because the next version tightened up, and knowing that changes whether you need to move at all.

What to look for: a threshold you are nowhere near. A $10bn gate tells you nothing about your exposure and everything about the direction of travel. Write down the number and the date, then run the diff again in a year.

Where to be careful: paste the licence file, not a summary — feed it a summary and you get confident nonsense with clause numbers attached. If section 4 comes back expensive, that is the point where a lawyer costs less than a guess. Best on Claude Fable 5.1 or GPT-5.6 Sol; smaller models skim the overlap and tell you the two licences are equivalent.

🛠️ TOOL OF THE WEEK

‘The best tool for getting a model off Hugging Face is Hugging Face’s own.’

hf CLI ★★★★☆ 4 / 5

The hf command replaced huggingface-cli as the canonical client back in February. It does one thing you need this week: pulls a repository at a named revision into a directory you chose, then tells you whether what landed on disk is what you asked for.

— hf download zai-org/GLM-5.2 --revision <full commit hash> --local-dir ./models/glm-5.2. Use the full-length hash; the seven-character form is rejected, which is a small mercy.

— hf cache verify <repo> --local-dir <path> re-checks the files against the Hub’s record. That is last week’s checksum line, without writing it yourself.

— Pull the LICENSE file explicitly while you are in there. It ships in the repo, and it is the one thing that won’t be on your disk in eighteen months if you skip it today.

The missing star: it authenticates to the Hub, and gated repositories still need an account that has accepted terms. That is the eligibility mechanism, not a way round it.

hf CLI docs →

💡 TIP OF THE WEEK

Deny egress, then read the denials

Useless to you if your agents already run with no outbound network at all. If that’s you, skip this one and feel smug about it.

For everyone else: your agent’s network boundary is not your firewall. It is the list of tools the agent can call. OpenAI’s report is thirty-eight pages and one sentence long — the escape route was a package proxy, running inside the research environment, that nobody had classified as internet access. Not a bug in the model. A category error about what counts as a network.

Why it works: you can’t enumerate egress from your own architecture diagram, because the paths that matter are the ones you never drew. You can enumerate it by denial. Run the workflow with outbound traffic blocked except an explicit allowlist, then read what got refused. That list is your real dependency surface — package registries, model caches, telemetry endpoints, the doc-fetch tool somebody added in March and nobody minuted.

Where it stops: denial testing tells you what a system reaches, not what it would reach under a harder task or a different prompt. It is a floor, not a proof. Nothing here catches an agent chaining a zero-day.

The pro move: keep the denial log as an artefact and diff it after every dependency bump. A new line in that file is a new way out that nobody approved.