When buying a custom website, an inventory that says “all open source” is not a usable dependency handover. Record exact packages and versions, the licence declaration and the supporting text. A metadata field can point to a licence file; it cannot establish every obligation for a particular redistribution.
Primary evidence and claim boundaries
npm package.json documentation describes SPDX licence expressions and the SEE LICENSE IN filename form. UNLICENSED and missing declarations must not be silently interpreted as a permissive licence. Primary reference · Read 18 October 2026.
Filled acceptance example
Original synthetic teaching scenario, not a client case, provider integration test or business result. The example policy needs the actual owner’s approval; scroll the table on narrow screens.
| Input and state | Declared check | Expected output and decision |
|---|---|---|
| Synthetic package alpha@1.2; declaration MIT | Exact package includes LICENSE text | Record declaration+file hash; obligations still require review |
| beta@2.0; SEE LICENSE IN TERMS.txt | TERMS.txt missing from handover | Evidence gap; do not mark cleared |
| gamma@3.0; UNLICENSED | Not a permissive grant | Hold for owner/vendor permission evidence |
| delta@4.0; no licence field | Licence elsewhere unknown | Unknown, not zero obligations or automatic permission |
Practical handover procedure
- Export an exact direct/transitive dependency inventory for the delivered source and build. Include package version, integrity, declaration and location of supporting text without registry credentials.
- Reconcile the filled four-row manifest against actual files for that version. Keep missing text, conflicting declarations and unknown entries visible rather than auto-grading them permissive.
- Have the responsible licensing reviewer decide notices, source or distribution requirements for the actual delivery. Preserve that decision with the artefact version.
Interpret the outcome
Only the first row has both a declaration and a supporting text in the teaching record. Even that row is evidence-ready rather than a legal clearance result. The useful output is an actionable gap list tied to exact versions, not a claim that all open-source packages share one licence.
Acceptance decision
Require exact-version traceability and a recorded reviewer decision for unresolved entries before the relevant redistribution. Keep the factual inventory separate from legal conclusions.
Limits and unverified work
Fictional packages only, no licence audit of the frozen site, no package downloads and no legal advice. Metadata completeness alone cannot certify compliance.
Download the filled bilingual acceptance record — Contains the inputs, steps, expectations and limits. This is a teaching record, not an executable production integration.