# Current delivery: STEP158

See [current notices and source provision](STEP158.html) and [exact file/source manifest](STEP158-manifest.json). Older unresolved-scope entries below are historical. STEP158 retains official MediaPipe binary hashes, supplies its release-pinned Eigen source and replaces the opaque tfweb prebuilt runtime with the documented source build.

# LENBLING third-party notices (STEP 16-120 isolated candidate)

This inventory does not grant rights beyond the original licenses. Unresolved items below block redistribution approval. Application logic, models and assets are not replaced in this step.

TensorFlow.js core/backend-cpu 4.9.0, tfjs-tflite 0.0.1-alpha.10, MediaPipe Tasks Vision 0.10.21: Apache-2.0 per official npm metadata. Copyright their respective TensorFlow/MediaPipe authors. Retain the existing vendor LICENSE files, source notices and any applicable NOTICE. Windows checkout changed line endings in some text assets; no model/WASM byte changes in this step. Compiled WASM third-party notice completeness remains under review; the official npm archives do not include a separate NOTICE file.

MediaPipe Face Landmarker float16/1: the official Face Landmarker guide links Apache-2.0 model cards for BlazeFace short range, FaceMesh V2 and Blendshape V2. Bundle component hashes and sources are documented outside the runtime in license-evidence.json. The geometry metadata component and exact card-to-version applicability require further confirmation. Iris model-specific weight terms also remain unconfirmed; a code repository license alone is not treated as a weight license.

MediaPipe LICENSE: ../vendor/mediapipe/LICENSE
TensorFlow LICENSE: ../vendor/iris/TENSORFLOW-LICENSE
MediaPipe Iris code LICENSE: ../vendor/iris/MEDIAPIPE-LICENSE

Python package licenses: original installed-wheel license texts are copied alongside this notice without editing. They include Pillow's third-party font and native library notices, NumPy, OpenCV and other native components. OS package copyright/license texts remain at /usr/share/doc in the container. CPython's LICENSE is retained in its standard installation. These files must remain with redistributed images; GPL/LGPL source/relinking obligations require a corresponding-source provision before conveying an image to third parties.

Server-internal use: comply with licenses and preserve attribution; it is not automatically the same as conveying binaries. Container delivery: preserve all applicable licenses/notices and satisfy copyleft source obligations. Browser download: it is distribution of the downloaded JS/WASM/model; include accessible licenses and required notices. An unresolved model license is not cleared by hosting it on one's own server.

No trademark license or warranty is granted. No third-party author endorses LENBLING. Model cards, training dataset descriptions, and model weight licensing are distinct; no training dataset is distributed here.


## STEP 16-121 geometry provenance clarification
The bundled geometry_pipeline_metadata_landmarks.binarypb (SHA256 bdbcda96dfcb7da883da124aaa2c55dee49770d934f0fcc71747f8c21bdc75b4) is byte-identical to serialization of the official v0.10.21 geometry_pipeline_metadata_landmarks.pbtxt using its published proto2 schema. That source carries Copyright 2020 The MediaPipe Authors and the Apache License, Version 2.0. The BUILD target explicitly generates this binary from that text. This establishes the license scope for this metadata; it does not extend to unrelated weights or WASM components.
Source: https://github.com/google-ai-edge/mediapipe/blob/v0.10.21/mediapipe/modules/face_geometry/data/geometry_pipeline_metadata_landmarks.pbtxt
Schema/build: https://github.com/google-ai-edge/mediapipe/blob/v0.10.21/mediapipe/modules/face_geometry/data/BUILD
License: /static/vendor/mediapipe/LICENSE (use the existing MediaPipe LICENSE linked above). Preserve copyright, license, applicable NOTICE and modification notices when redistributing. Commercial use, redistribution and modification are permitted subject to Apache-2.0 conditions; no warranty or trademark grant. The earlier unresolved geometry entry is superseded only for this exact metadata hash. Iris weights and full WASM third-party notice coverage remain unresolved.

## STEP 16-133 superseding scope
See [STEP133 notice](STEP133-NOTICE.txt). Iris no longer requires a separate permission on the reviewed official evidence. The WASM third-party conditions remain unresolved. Original licenses: [MediaPipe](MEDIAPIPE-LICENSE.txt), [TensorFlow](TENSORFLOW-LICENSE.txt).

See [STEP134 supplemental notice](STEP134-NOTICE.txt).

## STEP 16-134 delivery-scope clarification
This inventory describes evidence and remaining artifact-to-source uncertainty; it does not mean that a private internal test is prohibited. The planned test is for one owner within the owner's organization and does not intentionally distribute WASM to outside recipients. The Eigen MPL-2.0 text is included. If these WASM binaries are later conveyed outside the organization, first map the covered Eigen source and modifications and tell recipients how to obtain that source as required by MPL-2.0. The exact Eigen source files and patch set in the four binaries remain unmapped. The Iris weight's separate-permission question is superseded by the official maintainer statement cited in STEP133-NOTICE.txt. The geometry metadata conclusion remains limited to its exact recorded hash.