The license gate

No non-commercially licensed model, weight, LoRA, preprocessor or code dependency enters this pipeline anywhere — including in experiments. CC-BY-NC, research-only and academic-only are banned outright.

The reason is not principle, it is waste. An experiment concluded on a banned model is a conclusion that has to be thrown away, so it never starts. A licence check is minutes; a discarded arc is a session.

This page summarizes the stance and the findings. The canonical, dated map is docs/license-map.md in the repo — every row there carries the URL of the actual licence document, the operative clause, and the date it was fetched.

How a dependency enters

1. Fetch the actual licence document — model card, LICENSE file, or official terms page. Not a blog summary, not a README badge.
2. Record name, version, licence name, URL, a short quote of the operative clause, and the fetch date.
3. Rule COMMERCIAL: YES / NO / CONDITIONAL(<condition>).
4. NO → the dependency does not enter, and the spec names what replaces it.
5. CONDITIONAL → a Director decision, surfaced with its condition stated. Never a quiet yes.
6. UNVERIFIED → treated as NO until retrieved.

The check is recorded in the spec that introduces the dependency, and the row lands in the map. Entries older than 90 days are advisory until re-fetched — licences in this space change.

And the rule that catches the most people: the same family can split across variants. Check the exact variant and version you are about to run, not the family name.

Two traps this caught immediately

Both are the kind of thing the gate exists for, and both are worth knowing whether or not you ever touch armature.

1. OpenPose is non-commercial. The most widely used pose extractor in the entire ControlNet ecosystem is under a CMU academic licence permitting use for your own noncommercial internal research purposes. It is banned here — and the obvious replacements are a trap of their own, caught on a second pass (2026-08-10): DWPose’s code is Apache 2.0, but its weights are a separate grant that has never been fetched, so no detector cleanly replaces it. The honest replacement is no detector at all: armature renders pose from geometry it owns.

2. The Small/Large split is real. Depth Anything V2 Small is Apache 2.0; Depth Anything V2 Large is CC-BY-NC-4.0. Same family, same page structure, different licence. Depth Anything V3’s code is Apache while its weights are CC-BY-NC across the board — and the weights are what a pipeline actually runs.

3. The badge is not the grant. A community-LoRA page can render the base model’s Apache badge beside an adapter whose actual grant matrix withholds the rights you need. Caught 2026-08-13, twice in one afternoon: CivitAI’s structured permissions API reversed two page-derived verdicts — one wrong YES killed, one wrong NO revived — and a third model died on a clause banning use “on any image/video generation service,” which is what running it through a hosted tier is. Fetch the grant, not the badge.

The architectural consequence, which is the interesting part

armature renders depth from Blender’s own Z-buffer, and can draw a skeleton from bone transforms that are already known. Where it does that, no depth or pose estimator is in the pipeline at all.

The entire banned preprocessor tier is sidestepped by construction, not by substitution. That is a genuine advantage of CG-sourced control over video-extracted control, it was found by doing the licence work rather than by design taste, and the first exporter is built to keep it.

One open question this raises, flagged for a later ruling: matching a pose ControlNet’s expected drawing convention is a format question, but the conditioning model’s own weights carry their own licence. Any pose or depth ControlNet checkpoint gets its own row before it runs.

What the map says today

Fetched 2026-08-10.

Generation models. Wan 2.x is the default route — the only family that is unconditionally Apache 2.0 across base, VACE and Fun-Control, and it explicitly disclaims rights in generated outputs. Mochi 1 preview is Apache 2.0. LTX-Video 0.9.x is open-weights with no revenue cap found.

Conditional, and therefore a Director decision rather than a default. LTX-2 requires a paid licence above $10M annual revenue. HunyuanVideo’s community licence excludes the European Union, the United Kingdom and South Korea by territory, which makes it unusable for a game sold internationally. CogVideoX-5b requires registration and caps traffic at one million visits per month.

Preprocessors, if one is ever needed. DWPose, RTMPose/MMPose, SAM, SAM 2 and Depth Anything V2 Small are Apache 2.0; BiRefNet is MIT. OpenPose and Depth Anything V2 Large / V3 weights are banned. rembg is conditional — MIT covers the code, and its bundled weights carry separate licences that have not been fetched.

Services. Comfy Cloud’s terms state that the customer retains all right, title and interest in outputs, and that inputs and outputs will not be used to train generative AI.

The wan2.x partner tier (wan2.6/2.7 hosted, reference-to-video) was retrieved 2026-08-12 — the consumer terms via export where every fetcher got a JavaScript shell — and ruled CONDITIONAL, accepted by the Director: outputs are assigned to the user; published footage carries a clear-and-conspicuous AI-generated disclosure duty; the consumer surface licenses everything uploaded broadly (training use included) while both vendor papers on the API chain — Comfy’s contractual no-training clause and Alibaba’s published API-tier posture — commit the other way, and which paper governs API-mediated calls is recorded as not established. The residual no fetch can close is the reseller agreement between the two vendors, a residual every partner tier carries permanently.

The Animate-2 loadout resolved on 2026-08-13, off a consult round that delivered the served template’s loader filenames as exact strings: the upstream, Wan2.2-Animate-2-14B, is Apache 2.0; the entire served loadout lives in one repack repo declaring the same; and the CLIP-vision upstream is MIT (with its intended-use caveat quoted in the map rather than discovered later). Every verdict YES — the driven route’s unpark is licence-clear, and what still gates it is experimental, not legal.

Per-route disclosure

The condition attached to that ruling became standing law (Director, 2026-08-12): any route through a third-party tier documents what a user of that route is exposed to — the providers’ data-use and training posture, AI-content disclosure duties, and watermark policy, each grounded in the licence map’s fetched documents. Fully-local routes state that nothing leaves the rig. A route without its disclosure note is not complete. The first application rides the E13 spec in the repo.

What is unverified is recorded rather than assumed

Each blocks the thing that depends on it:

Item	Why unverified
Kling terms	HTTP 446, Cloudflare block, on two URLs
MiniMax terms	JavaScript-rendered page, no text returned
ByteDance / Seedance output ownership	the master terms contain no AI-output clause; the service-specific agreement was not located
rembg bundled weights (u2net / isnet)	individual model licences not fetched

Two founding-era rows have since been resolved by retrieval: Blender (the installed build carries its own licence documents — a better source than the 403ing website, because it is the licence of the exact binary that renders here) and the wan2.x partner tier (above). The rest are hard blocks: Kling, MiniMax and Seedance may not be used here until their terms are fetched.

Note the shape of those gaps. Every unverified row is a partner API or a bundled weight; every verified-clean row is open weights. Partner-API terms are the harder half of this map to establish, which is itself an argument for the open-weights route being the default.

No test exemption

“Just for a test” is a named drift tripwire in the roadmap. The gate has no test exemption, because the output of a test is a conclusion, and a conclusion drawn on a banned model is one that has to be discarded.