Dependency License Inventory¶

This is OpenMed's checked-in review inventory for the dependency declarations in pyproject.toml. It covers the base dependency set and every optional integration except the dev extra. Version constraints stay in pyproject.toml; this file records the locally reviewed SPDX-like license expression and the extras that use each distribution.

The inventory gate is intentionally offline. Run it from the repository root:

python scripts/licenses/inventory.py

The gate reads this table and pyproject.toml, then fails closed if a declared distribution is missing here or has an unknown or restricted license without an explicit policy exception. Add a reviewed row before adding a dependency. Do not paste package metadata, URLs, credentials, or application data into this inventory.

The extract-msg row is intentionally restricted: it is allowed only for the email-msg-gpl extra's documented out-of-process bridge, and remains excluded from the bundled and in-process runtime. The exception requires the reviewed GPL-3.0-only expression. Project audits verify the dependency's actual extras in pyproject.toml; an inventory scope label cannot exempt a base dependency or a dependency also declared in another extra.