This is a recommendation, not a legal opinion. Chris can swap LICENSE before any public publish.
Company OS is infrastructure: operators embed it next to other companies on one Linux host. Apache-2.0 is typical for that shape.
- Patent grant. Contributors grant patent rights on their contributions, with a defensive termination if the user sues for infringement of the Work. MIT does not say this.
- Infra-typical. Operators already see Apache-2.0 on kernels, runtimes, and control planes. It does not surprise a self-hoster.
- Later dual-license. Apache-2.0 is compatible with a later commercial / dual-license overlay if Chris ever wants one. Changing SPDX later is an owner action; this file does not lock that in.
LICENSE in this tree is Apache-2.0. Publishing that file is what makes the choice real.
MIT is shorter and is what hobbyists expect. It would be a reasonable swap if the only audience is tinkerers copying a single file. It does not include an express patent grant. For an operating layer that other companies embed, Apache-2.0 is the better default.
GPL (v2 or v3) would scare operators who embed Company OS beside their own code and tenant configs. Copyleft questions around “is my tenant.json a derivative” are a drag even when the answer is no. Company OS 1.0 is meant to be installed, not to infect neighboring businesses.
AGPL would be worse for the same reason (network use as a trigger).
Chris may replace LICENSE with MIT, a proprietary notice, or a dual-license pair. Do that before the first public push. Do not claim customers, pricing, or product-market fit in the license text. Collected cash is $0.