Online installation only — no third-party binary redistribution

Nine exact packages are retained in requirements.lock (version/hash form).
requirements-online.lock uses the SAME wheel hashes and explicit original
files.pythonhosted.org HTTPS URLs from PyPI release metadata. Install using the
clean-environment command in INSTALL.txt; --require-hashes and --only-binary=:all:
are mandatory. No dependency version substitution, optional extras or source build.

Inventory: attrs 26.1.0; cffi 2.1.1; cryptography 46.0.0; jsonschema 4.25.1;
jsonschema-specifications 2025.9.1; pycparser 3.0; referencing 0.37.0;
rpds-py 2026.6.3; typing-extensions 4.16.0.
Native tags: cffi/rpds cp312 manylinux_2_17_aarch64; cryptography cp311-abi3
manylinux_2_28_aarch64. Other wheels are py3-none-any. Ubuntu 24.04 glibc supports
these tag floors; actual execution is untested here. CPython 3.12.3 is the tested
parent reference. Complete active Requires-Dist closure was checked for that
Linux environment with no extras (records/STATIC-AUDIT.json).

records/ARTIFACTS.json is preserved acquisition provenance: exact filenames,
versions, original URLs, wheel tags, sizes and SHA-256 values matched to official
PyPI metadata. Its local quarantine paths describe INTERNAL acquisition evidence,
not files required by this distributable. No wheel exists here. Original metadata
and the nine quarantine files remain with the internal packaging records.
records/PIP-CHECK.json records actual pip download-only validation of both lock
forms with target flags. No downloaded package was installed, imported or executed.
This is not evidence that fresh Linux installation or native imports succeed.

Applicable top-level licensing/attribution text is preserved under materials/:
MIT: attrs (Hynek Schlawack and contributors), jsonschema/jsonschema-specifications/
referencing/rpds-py (Julian Berman); MIT-0: cffi (upstream material retained);
BSD-3-Clause: pycparser (Eli Bendersky); PSF/historical license texts: typing-extensions;
Apache-2.0 OR BSD-3-Clause: cryptography (upstream contributors, original notices).
Retain the supplied texts, copyrights and disclaimers; no endorsement is implied.
The wheel publishers' native component notices remain part of the deferred
bundled-wheel review, recorded in records/LICENSE-REVIEW.*. Online installation
was explicitly selected to remove redistribution of those binaries from this
handoff. It is NOT a finding that wheel redistribution has been cleared, or a
waiver of upstream terms. Do not turn this directory into an offline wheel bundle.
The rpds SBOM is copied as attribution/provenance text, not as an executed component.
