{
  "schema": 1,
  "baseline": "Reviewed R6 1.1.2.0 runtime bytes; R7 1.1.3.0 retains dependency pins",
  "review_status": "notice mapping with explicit version/provenance limits; owner Microsoft eligibility and exact standalone LibTomMath source revision remain review items",
  "native_files": [
    {
      "path": "_internal/_bz2.pyd",
      "sha256": "9590a3f4b7c0801cd379341d40bb89b5dc9a4e232c9498b6f3bc6b5e99d4ae7f",
      "components": [
        "CPython 3.14.10",
        "bzip2 1.0.8 (CPython source pin)"
      ],
      "notices": [
        "CPython-LICENSE.txt",
        "native/bzip2-1.0.8-LICENSE.txt"
      ],
      "evidence": "Byte-identical R6 runtime payload, linked to recorded CPython installer or pinned Pillow wheel origin. Component version basis is stated explicitly; not blanket legal clearance."
    },
    {
      "path": "_internal/_ctypes.pyd",
      "sha256": "adf71d85781a2fe937fcc44c0961498e2cf30849f9863ff7b5f7510817cea952",
      "components": [
        "CPython 3.14.10"
      ],
      "notices": [
        "CPython-LICENSE.txt"
      ],
      "evidence": "Byte-identical R6 runtime payload, linked to recorded CPython installer or pinned Pillow wheel origin. Component version basis is stated explicitly; not blanket legal clearance."
    },
    {
      "path": "_internal/_decimal.pyd",
      "sha256": "9605f332fb52636d77a3125abc7e42ba22b3838dcf136d81f37fe5875cbd62d6",
      "components": [
        "CPython 3.14.10",
        "mpdecimal 4.0.0"
      ],
      "notices": [
        "CPython-LICENSE.txt",
        "native/mpdecimal-4.0.0-COPYRIGHT.txt"
      ],
      "evidence": "Byte-identical R6 runtime payload, linked to recorded CPython installer or pinned Pillow wheel origin. Component version basis is stated explicitly; not blanket legal clearance."
    },
    {
      "path": "_internal/_elementtree.pyd",
      "sha256": "77707cb19dc91eb634d70f31b21022ee4c6ea5ce834c6952bc56ba00c6fd644d",
      "components": [
        "CPython 3.14.10"
      ],
      "notices": [
        "CPython-LICENSE.txt"
      ],
      "evidence": "Byte-identical R6 runtime payload, linked to recorded CPython installer or pinned Pillow wheel origin. Component version basis is stated explicitly; not blanket legal clearance."
    },
    {
      "path": "_internal/_hashlib.pyd",
      "sha256": "9052a85ac9947afbbdfdd62b0cad7501b668e6107832cefaa4b76377d710dae0",
      "components": [
        "CPython 3.14.10"
      ],
      "notices": [
        "CPython-LICENSE.txt"
      ],
      "evidence": "Byte-identical R6 runtime payload, linked to recorded CPython installer or pinned Pillow wheel origin. Component version basis is stated explicitly; not blanket legal clearance."
    },
    {
      "path": "_internal/_lzma.pyd",
      "sha256": "9ff9f63ad79f161722106e029b4c3afc6494848fd73f9bcc2ed5434a15c71bde",
      "components": [
        "CPython 3.14.10",
        "liblzma (CPython source pin 5.2.5)"
      ],
      "notices": [
        "CPython-LICENSE.txt",
        "native/xz-5.2.5-COPYING.txt"
      ],
      "evidence": "Byte-identical R6 runtime payload, linked to recorded CPython installer or pinned Pillow wheel origin. Component version basis is stated explicitly; not blanket legal clearance."
    },
    {
      "path": "_internal/_queue.pyd",
      "sha256": "51a3d8e40b061db4fc77f9a3b18e6c2f912c4edf467e46c95ac325d35f2be4df",
      "components": [
        "CPython 3.14.10"
      ],
      "notices": [
        "CPython-LICENSE.txt"
      ],
      "evidence": "Byte-identical R6 runtime payload, linked to recorded CPython installer or pinned Pillow wheel origin. Component version basis is stated explicitly; not blanket legal clearance."
    },
    {
      "path": "_internal/_socket.pyd",
      "sha256": "11f2ace2a37e59bf0f2fcfcc2523307408fa2e7f0aec561bc7531a8db130a83c",
      "components": [
        "CPython 3.14.10"
      ],
      "notices": [
        "CPython-LICENSE.txt"
      ],
      "evidence": "Byte-identical R6 runtime payload, linked to recorded CPython installer or pinned Pillow wheel origin. Component version basis is stated explicitly; not blanket legal clearance."
    },
    {
      "path": "_internal/_ssl.pyd",
      "sha256": "56fdbe70896e4b3c6d4e8897fad1d011129354172566832371289edca0d85a21",
      "components": [
        "CPython 3.14.10"
      ],
      "notices": [
        "CPython-LICENSE.txt"
      ],
      "evidence": "Byte-identical R6 runtime payload, linked to recorded CPython installer or pinned Pillow wheel origin. Component version basis is stated explicitly; not blanket legal clearance."
    },
    {
      "path": "_internal/_tkinter.pyd",
      "sha256": "2d90e065b82292f06a403383d94e7574ba5308ed3956184f554c04c54c4becb3",
      "components": [
        "CPython 3.14.10"
      ],
      "notices": [
        "CPython-LICENSE.txt"
      ],
      "evidence": "Byte-identical R6 runtime payload, linked to recorded CPython installer or pinned Pillow wheel origin. Component version basis is stated explicitly; not blanket legal clearance."
    },
    {
      "path": "_internal/_uuid.pyd",
      "sha256": "ad949327a9730feefc7f2c14db9b1b43f4351df1aad3688dc1e68e4a23f7e81c",
      "components": [
        "CPython 3.14.10"
      ],
      "notices": [
        "CPython-LICENSE.txt"
      ],
      "evidence": "Byte-identical R6 runtime payload, linked to recorded CPython installer or pinned Pillow wheel origin. Component version basis is stated explicitly; not blanket legal clearance."
    },
    {
      "path": "_internal/_wmi.pyd",
      "sha256": "c8f6705d2da1be12b10050a1311b7c865fd79f11404cfad1a70b3f8962051056",
      "components": [
        "CPython 3.14.10"
      ],
      "notices": [
        "CPython-LICENSE.txt"
      ],
      "evidence": "Byte-identical R6 runtime payload, linked to recorded CPython installer or pinned Pillow wheel origin. Component version basis is stated explicitly; not blanket legal clearance."
    },
    {
      "path": "_internal/_zstd.pyd",
      "sha256": "7a7b50c580428daf3d43c87b121988d2e8c7af9533fa2195f1aef8652fc2c489",
      "components": [
        "CPython 3.14.10",
        "Zstandard 1.5.7"
      ],
      "notices": [
        "CPython-LICENSE.txt",
        "native/zstd-1.5.7-LICENSE.txt"
      ],
      "evidence": "Byte-identical R6 runtime payload, linked to recorded CPython installer or pinned Pillow wheel origin. Component version basis is stated explicitly; not blanket legal clearance."
    },
    {
      "path": "_internal/libcrypto-3.dll",
      "sha256": "75495fe0e079ab00d49be740d3c710a0b94e3f74f9648cb7cc9f768fc7f52319",
      "components": [
        "CPython 3.14.10",
        "OpenSSL 3.5.9"
      ],
      "notices": [
        "CPython-LICENSE.txt",
        "native/openssl-3.5.9-LICENSE.txt"
      ],
      "evidence": "Byte-identical R6 runtime payload, linked to recorded CPython installer or pinned Pillow wheel origin. Component version basis is stated explicitly; not blanket legal clearance."
    },
    {
      "path": "_internal/libffi-8.dll",
      "sha256": "eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a",
      "components": [
        "CPython 3.14.10",
        "libffi (CPython source pin 3.4.4)"
      ],
      "notices": [
        "CPython-LICENSE.txt",
        "native/libffi-3.4.4-LICENSE.txt"
      ],
      "evidence": "Byte-identical R6 runtime payload, linked to recorded CPython installer or pinned Pillow wheel origin. Component version basis is stated explicitly; not blanket legal clearance."
    },
    {
      "path": "_internal/libssl-3.dll",
      "sha256": "8957182a9c385bfd9f3f790921de2ddc614cf91f99edbed4e9e5446a46504e32",
      "components": [
        "CPython 3.14.10",
        "OpenSSL 3.5.9"
      ],
      "notices": [
        "CPython-LICENSE.txt",
        "native/openssl-3.5.9-LICENSE.txt"
      ],
      "evidence": "Byte-identical R6 runtime payload, linked to recorded CPython installer or pinned Pillow wheel origin. Component version basis is stated explicitly; not blanket legal clearance."
    },
    {
      "path": "_internal/libtommath.dll",
      "sha256": "2d760fefb452665b6af8c8d9d29f3a8378f10fc0847cdd9938ea0cb5edf1d573",
      "components": [
        "CPython 3.14.10",
        "LibTomMath (Tcl 9.0.4 source notice; standalone DLL revision not independently established)"
      ],
      "notices": [
        "CPython-LICENSE.txt",
        "native/libtommath-Tcl-9.0.4-LICENSE.txt"
      ],
      "evidence": "Byte-identical R6 runtime payload, linked to recorded CPython installer or pinned Pillow wheel origin. Component version basis is stated explicitly; not blanket legal clearance."
    },
    {
      "path": "_internal/PIL/_avif.cp314-win_amd64.pyd",
      "sha256": "5a11e1e5a381572355e3ecbcf65ff5a9f4a9876f65c7264a530a3b4d08fbe9e6",
      "components": [
        "Pillow 13.0.0 (exact pinned wheel)",
        "libavif 1.4.2",
        "libaom 3.14.1",
        "dav1d 1.5.3"
      ],
      "notices": [
        "wheels/pillow/pillow-13.0.0.dist-info/licenses/LICENSE",
        "native/libaom-3.14.1-LICENSE.txt",
        "native/libaom-3.14.1-PATENTS.txt",
        "native/dav1d-1.5.3-COPYING.txt",
        "native/dav1d-1.5.3-PATENTS.txt"
      ],
      "evidence": "Byte-identical R6 runtime payload, linked to recorded CPython installer or pinned Pillow wheel origin. Component version basis is stated explicitly; not blanket legal clearance."
    },
    {
      "path": "_internal/PIL/_imaging.cp314-win_amd64.pyd",
      "sha256": "9ca27b1a45178437d9b57e0d3024ed535226f5150ff16fd2363d90171856f0d8",
      "components": [
        "Pillow 13.0.0 (exact pinned wheel)",
        "libjpeg-turbo 3.2.0",
        "OpenJPEG 2.5.4",
        "libtiff 4.7.2",
        "zlib-ng 2.3.3 (Pillow static build)"
      ],
      "notices": [
        "wheels/pillow/pillow-13.0.0.dist-info/licenses/LICENSE"
      ],
      "evidence": "Byte-identical R6 runtime payload, linked to recorded CPython installer or pinned Pillow wheel origin. Component version basis is stated explicitly; not blanket legal clearance."
    },
    {
      "path": "_internal/PIL/_imagingcms.cp314-win_amd64.pyd",
      "sha256": "358c2378268f96e283c590e45a4c8864df0f5400814f1b84e555336a15484ee3",
      "components": [
        "Pillow 13.0.0 (exact pinned wheel)",
        "LittleCMS2 (wheel reports 2.19.1; runtime displays 2.19)"
      ],
      "notices": [
        "wheels/pillow/pillow-13.0.0.dist-info/licenses/LICENSE"
      ],
      "evidence": "Byte-identical R6 runtime payload, linked to recorded CPython installer or pinned Pillow wheel origin. Component version basis is stated explicitly; not blanket legal clearance."
    },
    {
      "path": "_internal/PIL/_imagingtk.cp314-win_amd64.pyd",
      "sha256": "b4e95439db8008cdede934b11ae8984b48ebf658140cb243d48fe5751dd7b96e",
      "components": [
        "Pillow 13.0.0 (exact pinned wheel)"
      ],
      "notices": [
        "wheels/pillow/pillow-13.0.0.dist-info/licenses/LICENSE"
      ],
      "evidence": "Byte-identical R6 runtime payload, linked to recorded CPython installer or pinned Pillow wheel origin. Component version basis is stated explicitly; not blanket legal clearance."
    },
    {
      "path": "_internal/PIL/_webp.cp314-win_amd64.pyd",
      "sha256": "0a52c832b08413721f0bb09b7bdd496ef7b10e5e22a27e64a756f7daa184b425",
      "components": [
        "Pillow 13.0.0 (exact pinned wheel)",
        "libwebp 1.6.0"
      ],
      "notices": [
        "wheels/pillow/pillow-13.0.0.dist-info/licenses/LICENSE"
      ],
      "evidence": "Byte-identical R6 runtime payload, linked to recorded CPython installer or pinned Pillow wheel origin. Component version basis is stated explicitly; not blanket legal clearance."
    },
    {
      "path": "_internal/pyexpat.pyd",
      "sha256": "87b0f7401749bd19bddf8872c17965a99142928fdefab0b513ded9c116f3da6b",
      "components": [
        "CPython 3.14.10",
        "Expat 2.9.0"
      ],
      "notices": [
        "CPython-LICENSE.txt",
        "native/expat-CPython-3.14.10-COPYING.txt"
      ],
      "evidence": "Byte-identical R6 runtime payload, linked to recorded CPython installer or pinned Pillow wheel origin. Component version basis is stated explicitly; not blanket legal clearance."
    },
    {
      "path": "_internal/python314.dll",
      "sha256": "d8a06cc6ca3348925ea29e343e1c5c5895fe0bb433ff913e1cee44caf358aa6a",
      "components": [
        "CPython 3.14.10",
        "zlib-ng (CPython source pin 2.2.4; compatibility string 1.3.1.zlib-ng)"
      ],
      "notices": [
        "CPython-LICENSE.txt",
        "native/zlib-ng-2.2.4-LICENSE.txt"
      ],
      "evidence": "Byte-identical R6 runtime payload, linked to recorded CPython installer or pinned Pillow wheel origin. Component version basis is stated explicitly; not blanket legal clearance."
    },
    {
      "path": "_internal/select.pyd",
      "sha256": "0da869c017fd3231cfc1c1e4c4bef1bb7bf5cba38236e6d7bf1630c3507c5a1d",
      "components": [
        "CPython 3.14.10"
      ],
      "notices": [
        "CPython-LICENSE.txt"
      ],
      "evidence": "Byte-identical R6 runtime payload, linked to recorded CPython installer or pinned Pillow wheel origin. Component version basis is stated explicitly; not blanket legal clearance."
    },
    {
      "path": "_internal/tcl90.dll",
      "sha256": "a1fb45f963b05cb083a97df1449c2023b484eb921d40a463da7501b0f60e0f70",
      "components": [
        "CPython 3.14.10",
        "Tcl 9.0.4"
      ],
      "notices": [
        "CPython-LICENSE.txt",
        "tcl-9.0.4-license.terms"
      ],
      "evidence": "Byte-identical R6 runtime payload, linked to recorded CPython installer or pinned Pillow wheel origin. Component version basis is stated explicitly; not blanket legal clearance."
    },
    {
      "path": "_internal/tcl9tk90.dll",
      "sha256": "31f625c52e65d29d126e710ed8bab2ec964cb770e4fc59bc329dfff02cb6ddcf",
      "components": [
        "CPython 3.14.10",
        "Tk 9.0.4"
      ],
      "notices": [
        "CPython-LICENSE.txt",
        "tk-9.0.4-license.terms"
      ],
      "evidence": "Byte-identical R6 runtime payload, linked to recorded CPython installer or pinned Pillow wheel origin. Component version basis is stated explicitly; not blanket legal clearance."
    },
    {
      "path": "_internal/unicodedata.pyd",
      "sha256": "4c4e9f9e71e299a7e0093830e79f955f2b12b4eb0a6bb45003d42256b6e5985d",
      "components": [
        "CPython 3.14.10"
      ],
      "notices": [
        "CPython-LICENSE.txt"
      ],
      "evidence": "Byte-identical R6 runtime payload, linked to recorded CPython installer or pinned Pillow wheel origin. Component version basis is stated explicitly; not blanket legal clearance."
    },
    {
      "path": "_internal/VCRUNTIME140.dll",
      "sha256": "d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7",
      "components": [
        "Microsoft Visual C++ runtime 14.51.36247.0"
      ],
      "notices": [
        "MICROSOFT_REDISTRIBUTION.md"
      ],
      "evidence": "Byte-identical R6 runtime payload, linked to recorded CPython installer or pinned Pillow wheel origin. Component version basis is stated explicitly; not blanket legal clearance."
    },
    {
      "path": "_internal/VCRUNTIME140_1.dll",
      "sha256": "a7146c08f89fe5b04541ab507cdb59ff7b44534d4ba3c668a426c6450a03434e",
      "components": [
        "Microsoft Visual C++ runtime 14.51.36247.0"
      ],
      "notices": [
        "MICROSOFT_REDISTRIBUTION.md"
      ],
      "evidence": "Byte-identical R6 runtime payload, linked to recorded CPython installer or pinned Pillow wheel origin. Component version basis is stated explicitly; not blanket legal clearance."
    },
    {
      "path": "_internal/zlib1.dll",
      "sha256": "f07195206534ebb1fe75093d4ec6c54a7a9227281b0c09d2113465b71da9e900",
      "components": [
        "zlib 1.3.2 (Tcl runtime DLL)"
      ],
      "notices": [
        "native/zlib-1.3.2-LICENSE.txt"
      ],
      "evidence": "Byte-identical R6 runtime payload, linked to recorded CPython installer or pinned Pillow wheel origin. Component version basis is stated explicitly; not blanket legal clearance."
    }
  ]
}