Redistribution gate: BLOCKED; this is an internal acquisition record.
No conclusion that redistribution is categorically prohibited is made. Complete
required third-party notice coverage has not been established.

Top-level licenses collected verbatim from verified wheel contents:
  attrs 26.1.0                    MIT
  jsonschema 4.25.1               MIT
  jsonschema-specifications 2025.9.1  MIT
  referencing 0.37.0              MIT
  pycparser 3.0                   BSD-3-Clause
  typing-extensions 4.16.0        PSF-2.0 with historical license texts retained
  rpds-py 2026.6.3                MIT (project-level only; BLOCKER below)
  cffi 2.1.1                     MIT-0 (project-level; native review incomplete)
  cryptography 46.0.0            Apache-2.0 OR BSD-3-Clause (native review incomplete)

The MIT texts require retention of copyright and permission notices. BSD texts
require retention/reproduction of copyright, terms and disclaimers and prohibit
unauthorized endorsement. PSF materials require the agreement and copyright;
unmodified wheels are retained. Apache material is retained in full, including
its notice and attribution requirements. No licenses have been rewritten.
The extracted files under materials/ supplement the unmodified wheel copies.

B002: rpds_py-2026.6.3-cp312-cp312-manylinux_2_17_aarch64.manylinux2014_aarch64.whl
Its supplied CycloneDX SBOM identifies direct required native dependencies
archery 1.2.2 and rpds 1.2.1, each under MIT, authored by Diogo Sousa. The only
license text in the wheel is the rpds-py project MIT notice for Julian Berman.
No component-specific copyright/permission notices for archery/rpds are present.
The SBOM identifies licenses but supplies no license text for these components.
Its upstream references are crates.io/GitHub/docs.rs, outside authorized hosts.
No requests were made to those hosts. No source distributions were downloaded.
This review does not claim no matching material could exist elsewhere on PyPI;
it establishes that the approved exact release metadata/wheel materials do not
supply it. Stop rather than assume the top-level notice covers another project.

The all-targets SBOM also lists Unicode-3.0 and LLVM-exception components; some
may be build-time only. Runtime incorporation and any corresponding obligations
remain to be resolved, not automatically charged to the distributed binary.
Cryptography's binary includes an OpenSSL 3.5.3 version string, with only the
three project license files in the wheel. CFFI contains libffi-related symbols.
Their complete native third-party notice coverage is also not cleared. Do not
interpret permissive top-level metadata as proof of complete binary coverage.

The entire wheel set is held in quarantine/wheels as acquisition evidence.
Do not redistribute this folder as a completed developer handoff. The complete
verified and redistributable wheel set required by authorization item 7 has not
yet been established. Review stopped; launcher/client preparation did not resume.
