MrScripty · Nov 4, 2026 · Nov 4, 2026 · Nov 4, 2026 · Nov 4, 2026 · Nov 4, 2026
diff --git a/.gitattributes b/.gitattributes
@@ -14,6 +14,7 @@ docs/plans/torch-cross-platform-runtime-management/reports/managed-python-licens
 
 # Preserve verbatim third-party legal bytes, including mixed line endings.
 scripts/release/licenses/* -text -whitespace
+scripts/release/licenses/managed-python-supplemental/* -text -whitespace
 docs/release-attribution/**/THIRD-PARTY-NOTICES.txt -text -whitespace
 # Archive-captured CPython metadata and license texts are evidence and must remain verbatim.
 docs/plans/torch-cross-platform-runtime-management/reports/managed-python-license-collection/**/managed-python-licenses/full-archive/** -text -whitespace
diff --git a/...platform-runtime-management/reports/managed-python-license-collection/README.md b/...platform-runtime-management/reports/managed-python-license-collection/README.md
@@ -29,9 +29,10 @@ The Linux evidence README describes the accepted installation that produced
 its selected archive record. All per-file hashes can be checked directly
 against the manifests.
 
-## Outstanding attribution evidence
+## Declared files missing from the archives
 
-The inventory includes the collected files for all three targets. It does not
-certify completeness of declared references: the upstream Windows archive
-omits a declared zstd license file. See the
-[verified evidence gap and release gate](missing-declared-license-references.md).
+Each `PYTHON.json` also declares zstd (all three targets) or zlib-ng (Linux and
+macOS) license files that the upstream full archives omit. Release attribution
+fills these from byte-verified supplemental texts taken from the source
+archives that python-build-standalone pins, and labels them as such. See the
+[evidence gap and its resolution](missing-declared-license-references.md).
diff --git a/...reports/managed-python-license-collection/linux-x86_64-cpython-3.14.7/README.md b/...reports/managed-python-license-collection/linux-x86_64-cpython-3.14.7/README.md
@@ -13,9 +13,9 @@ declared file references outside that directory.
 
 The files document the Linux archive only. Corresponding Windows x86_64 and
 macOS arm64 collections are retained beside this directory; all three are
-included in the 0.7.0 attribution inventory. Collection does not establish
-complete upstream license coverage: see the [missing declared license
-report](../missing-declared-license-references.md) before release acceptance.
+included in the 0.7.0 attribution inventory. The archive omits
+two declared license files; see the [missing declared license
+report](../missing-declared-license-references.md) for the supplemental texts.
 
 See [`full-archive-manifest.json`](managed-python-licenses/full-archive-manifest.json)
 for exact source identities and per-file hashes. The raw `PYTHON.json` and

diff --git a/...eports/managed-python-license-collection/missing-declared-license-references.md b/...eports/managed-python-license-collection/missing-declared-license-references.md
@@ -1,28 +1,43 @@
 # Missing declared upstream license references
 
-**Status:** Open release attribution blocker. Owner: Pumas release/licensing review.
+**Status:** Resolved for 0.8.0 by supplemental texts from the pinned source
+archives. Owner: Pumas release/licensing review.
 
-CodeRabbit identified a reference to `licenses/LICENSE.zstd.txt` in the Windows
-CPython 3.14.7 `PYTHON.json` that is absent from the retained license files.
-On 2026-09-29 the exact official Windows full archive was downloaded again:
-
-- Asset: `cpython-3.14.7+20260901-x86_64-pc-windows-msvc-pgo-full.tar.zst`
-- SHA-256: `5363ec4aab59c24417f9877217aae95ca17f9ae6eb99c3bbfb25e4a76dcadafe`
-- Size: 49,262,780 bytes; both size and digest match the retained manifest.
-- The archive itself contains 19 `python/licenses/` files and omits the declared
-  zstd file. This is an upstream evidence gap, not an omitted extraction.
-
-The retained metadata and manifest remain byte-exact. Do not insert a guessed
-license text or misrepresent an externally sourced file as an archive member.
-The current inventory covers collected files; it does not certify every declared
-reference. Audit of all three retained metadata records found:
+The CPython 3.14.7 `PYTHON.json` files from python-build-standalone `20260901`
+declare license files that the official full archives do not contain:
 
 - `windows-x86_64-cpython-3.14.7`: `licenses/LICENSE.zstd.txt`.
 - `macos-arm64-cpython-3.14.7`: `licenses/LICENSE.zlib-ng.txt`, `licenses/LICENSE.zstd.txt`.
 - `linux-x86_64-cpython-3.14.7`: `licenses/LICENSE.zlib-ng.txt`, `licenses/LICENSE.zstd.txt`.
 
-Before release acceptance, obtain authoritative terms and exact source/version
-mapping for the missing bundled component from the upstream provider, retain
-separate provenance for any supplemental legal files, and update the notice
-generator and inventory from that evidence. Native runtime test success does
-not close this licensing gate.
+The Windows archive was downloaded again on 2026-09-29
+(`cpython-3.14.7+20260901-x86_64-pc-windows-msvc-pgo-full.tar.zst`, SHA-256
+`5363ec4aab59c24417f9877217aae95ca17f9ae6eb99c3bbfb25e4a76dcadafe`,
+49,262,780 bytes, matching the retained manifest). It holds 19
+`python/licenses/` files and no zstd file, so this is an upstream gap, not an
+extraction error. The retained manifests and `PYTHON.json` files stay byte-exact.
+
+## Resolution
+
+`pythonbuild/downloads.py` at python-build-standalone tag `20260901` pins the
+two components, and both source archives were downloaded and matched their pins:
+
+| Declared file | Component | SPDX | Source archive | Size | SHA-256 | Text taken from |
+| --- | --- | --- | --- | ---: | --- | --- |
+| `LICENSE.zstd.txt` | zstd 1.5.7 | BSD-3-Clause | [`zstd-1.5.7.tar.gz`](https://github.com/python/cpython-source-deps/archive/refs/tags/zstd-1.5.7.tar.gz) | 2,440,298 | `f24b52470d12f466e9fa4fcc94e6c530625ada51d7b36de7fdc6ed7e6f499c8e` | `cpython-source-deps-zstd-1.5.7/LICENSE` |
+| `LICENSE.zlib-ng.txt` | zlib-ng 2.2.4 | Zlib | [`zlib-ng-2.2.4.tar.gz`](https://github.com/python/cpython-source-deps/archive/refs/tags/zlib-ng-2.2.4.tar.gz) | 2,415,819 | `00bbd88709bc416cb96160ab61d3e1c8f76e106799af7328d0fe434dc7dd5004` | `cpython-source-deps-zlib-ng-2.2.4/LICENSE.md` |
+
+The texts are kept byte-exact, apart from the archive evidence, in
+[`scripts/release/licenses/managed-python-supplemental/`](../../../../../scripts/release/licenses/managed-python-supplemental/).
+Each has a `.provenance.json` record naming the declared path, release, targets,
+source archive identity, path inside that archive and the text's SHA-256. They
+are not archive members and are never listed as such.
+
+- The Torch acceptance collector accepts a declared path missing from the
+  archive only when a record for that exact path, target and release exists
+  and its text hash matches. Any other missing declared path still fails. Its
+  manifest lists archive files under `files` and supplemental texts under
+  `supplemental_files`.
+- The notice generator and attribution checker require every declared path to
+  be an archive member or a verified supplemental text. Each supplemental text
+  gets its own notice, labelled with the source archive it came from.
diff --git a/docs/release-attribution/0.8.0-s3/THIRD-PARTY-NOTICES.txt b/docs/release-attribution/0.8.0-s3/THIRD-PARTY-NOTICES.txt
@@ -10,6 +10,10 @@ is recorded in the release attribution report, not inferred from this list.
 The uv notice covers a runtime executable downloaded by Pumas, not a bundled binary.
 Managed CPython full-archive notices are target-scoped supersets for separately
 selected install-only distributions; each archive identity is recorded below.
+Where a CPython PYTHON.json declares a license file that its full archive omits,
+a separately labelled supplemental notice reproduces that component's license
+file from the source archive pinned by python-build-standalone; it is not an
+archive member.
 
 adler2 2.0.1 (Rust normal/build dependency, all desktop targets; conservative superset)
 Source: https://crates.io/api/v1/crates/adler2/2.0.1/download
@@ -88870,6 +88874,71 @@ docs/license.html_lib.
   jloup@gzip.org          madler@alumni.caltech.edu
 
 
+==============================================================================
+
+zlib-ng 2.2.4 (Managed Python supplemental license text for aarch64-apple-darwin; PYTHON.json declares licenses/LICENSE.zlib-ng.txt but the CPython full archive omits it; supplied from cpython-source-deps-zlib-ng-2.2.4/LICENSE.md in the source archive pinned by python-build-standalone 20260901 (sha256 00bbd88709bc416cb96160ab61d3e1c8f76e106799af7328d0fe434dc7dd5004), not from the CPython archive)
+Source: https://github.com/python/cpython-source-deps/archive/refs/tags/zlib-ng-2.2.4.tar.gz
+Declared license: Zlib
+--- managed-python-supplemental/zlib-ng-2.2.4-LICENSE.md ---
+(C) 1995-2024 Jean-loup Gailly and Mark Adler
+
+This software is provided 'as-is', without any express or implied
+warranty. In no event will the authors be held liable for any damages
+arising from the use of this software.
+
+Permission is granted to anyone to use this software for any purpose,
+including commercial applications, and to alter it and redistribute it
+freely, subject to the following restrictions:
+
+1. The origin of this software must not be misrepresented; you must not
+   claim that you wrote the original software. If you use this software
+   in a product, an acknowledgment in the product documentation would be
+   appreciated but is not required.
+
+2. Altered source versions must be plainly marked as such, and must not be
+   misrepresented as being the original software.
+
+3. This notice may not be removed or altered from any source distribution.
+
+
+==============================================================================
+
+zstd 1.5.7 (Managed Python supplemental license text for aarch64-apple-darwin; PYTHON.json declares licenses/LICENSE.zstd.txt but the CPython full archive omits it; supplied from cpython-source-deps-zstd-1.5.7/LICENSE in the source archive pinned by python-build-standalone 20260901 (sha256 f24b52470d12f466e9fa4fcc94e6c530625ada51d7b36de7fdc6ed7e6f499c8e), not from the CPython archive)
+Source: https://github.com/python/cpython-source-deps/archive/refs/tags/zstd-1.5.7.tar.gz
+Declared license: BSD-3-Clause
+--- managed-python-supplemental/zstd-1.5.7-LICENSE ---
+BSD License
+
+For Zstandard software
+
+Copyright (c) Meta Platforms, Inc. and affiliates. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+ * Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+ * Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+ * Neither the name Facebook, nor Meta, nor the names of its contributors may
+   be used to endorse or promote products derived from this software without
+   specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
 ==============================================================================
 
 CPython full archive 3.14.7 (Managed Python full-archive notice superset for x86_64-pc-windows-msvc; selected install-only runtime tracked separately)
@@ -91444,6 +91513,44 @@ docs/license.html_lib.
   jloup@gzip.org          madler@alumni.caltech.edu
 
 
+==============================================================================
+
+zstd 1.5.7 (Managed Python supplemental license text for x86_64-pc-windows-msvc; PYTHON.json declares licenses/LICENSE.zstd.txt but the CPython full archive omits it; supplied from cpython-source-deps-zstd-1.5.7/LICENSE in the source archive pinned by python-build-standalone 20260901 (sha256 f24b52470d12f466e9fa4fcc94e6c530625ada51d7b36de7fdc6ed7e6f499c8e), not from the CPython archive)
+Source: https://github.com/python/cpython-source-deps/archive/refs/tags/zstd-1.5.7.tar.gz
+Declared license: BSD-3-Clause
+--- managed-python-supplemental/zstd-1.5.7-LICENSE ---
+BSD License
+
+For Zstandard software
+
+Copyright (c) Meta Platforms, Inc. and affiliates. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+ * Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+ * Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+ * Neither the name Facebook, nor Meta, nor the names of its contributors may
+   be used to endorse or promote products derived from this software without
+   specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
 ==============================================================================
 
 CPython full archive 3.14.7 (Managed Python full-archive notice superset for x86_64-unknown-linux-gnu; selected install-only runtime tracked separately)
@@ -94018,6 +94125,71 @@ docs/license.html_lib.
   jloup@gzip.org          madler@alumni.caltech.edu
 
 
+==============================================================================
+
+zlib-ng 2.2.4 (Managed Python supplemental license text for x86_64-unknown-linux-gnu; PYTHON.json declares licenses/LICENSE.zlib-ng.txt but the CPython full archive omits it; supplied from cpython-source-deps-zlib-ng-2.2.4/LICENSE.md in the source archive pinned by python-build-standalone 20260901 (sha256 00bbd88709bc416cb96160ab61d3e1c8f76e106799af7328d0fe434dc7dd5004), not from the CPython archive)
+Source: https://github.com/python/cpython-source-deps/archive/refs/tags/zlib-ng-2.2.4.tar.gz
+Declared license: Zlib
+--- managed-python-supplemental/zlib-ng-2.2.4-LICENSE.md ---
+(C) 1995-2024 Jean-loup Gailly and Mark Adler
+
+This software is provided 'as-is', without any express or implied
+warranty. In no event will the authors be held liable for any damages
+arising from the use of this software.
+
+Permission is granted to anyone to use this software for any purpose,
+including commercial applications, and to alter it and redistribute it
+freely, subject to the following restrictions:
+
+1. The origin of this software must not be misrepresented; you must not
+   claim that you wrote the original software. If you use this software
+   in a product, an acknowledgment in the product documentation would be
+   appreciated but is not required.
+
+2. Altered source versions must be plainly marked as such, and must not be
+   misrepresented as being the original software.
+
+3. This notice may not be removed or altered from any source distribution.
+
+
+==============================================================================
+
+zstd 1.5.7 (Managed Python supplemental license text for x86_64-unknown-linux-gnu; PYTHON.json declares licenses/LICENSE.zstd.txt but the CPython full archive omits it; supplied from cpython-source-deps-zstd-1.5.7/LICENSE in the source archive pinned by python-build-standalone 20260901 (sha256 f24b52470d12f466e9fa4fcc94e6c530625ada51d7b36de7fdc6ed7e6f499c8e), not from the CPython archive)
+Source: https://github.com/python/cpython-source-deps/archive/refs/tags/zstd-1.5.7.tar.gz
+Declared license: BSD-3-Clause
+--- managed-python-supplemental/zstd-1.5.7-LICENSE ---
+BSD License
+
+For Zstandard software
+
+Copyright (c) Meta Platforms, Inc. and affiliates. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification,
+are permitted provided that the following conditions are met:
+
+ * Redistributions of source code must retain the above copyright notice, this
+   list of conditions and the following disclaimer.
+
+ * Redistributions in binary form must reproduce the above copyright notice,
+   this list of conditions and the following disclaimer in the documentation
+   and/or other materials provided with the distribution.
+
+ * Neither the name Facebook, nor Meta, nor the names of its contributors may
+   be used to endorse or promote products derived from this software without
+   specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR
+ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
 ==============================================================================
 
 uv 0.12.18 (Managed Python provider runtime executable downloaded by Pumas; not bundled)