# Solomon -- runtime pins.
#
# These are the EXACT pins of the image the shipped weights were qualified and live-accepted on
# (one B200, CUDA, fp32 arithmetic). They are the image definition, not a resolved lock file:
# four packages were installed unpinned in the qualified image and their resolved versions were
# not captured at run time. They are listed below as unpinned, honestly, rather than guessed.
#
# Pinned in the qualified image:
torch==2.13.0                 # observed at run time as 2.13.0+cu130; bound in the serving binding
torchvision==0.28.0
transformers==5.17.0
flash-linear-attention==0.5.2

# Installed UNPINNED in the qualified image; resolved versions were not recorded.
# Pin them yourself before relying on numerical reproducibility.
safetensors
accelerate
numpy
scipy
pillow

# Python 3.12.
#
# The serving binding (serving/serving-binding.json) records `torch: 2.13.0+cu130` among 15 runtime
# identity keys and REFUSES TO LOAD if the live engine differs on any of them. A different torch build
# will not silently serve different numbers; it will refuse.
#
# Not required for serving: the MLX path is not qualified and is not shipped.

# ---------------------------------------------------------------------------
# DEPENDENCY LICENCES
#
# None of these packages is redistributed in this repository. You install them from their own
# publishers, so Apache-2.0 4(a) imposes no bundled-notice obligation here and no dependency licence
# text is packaged. The summary below is provided because a reviewer will ask.
#
# Each licence is the one declared in that distribution's OWN package metadata, read from a copy on
# the maintainer's machine. Where no copy existed, the row says NOT VERIFIED rather than guessing.
# A licence read from one version is evidence about that version only.
#
#   torch                    BSD-3-Clause — read from version 2.8.0
#       evidence: .venv-probes/lib/python3.12/site-packages/torch-2.8.0.dist-info/METADATA, field `License: BSD-3-Clause`
#   torchvision              NOT VERIFIED
#       evidence: NOT VERIFIED: no copy of torchvision exists anywhere in this project, so no licence statement is made here. Check the distribution you install.
#   transformers             Apache 2.0 License
#       evidence: .venv/lib/python3.12/site-packages/transformers-5.17.0.dist-info/METADATA, field `License: Apache 2.0 License`
#   flash-linear-attention   NOT VERIFIED
#       evidence: NOT VERIFIED: no copy of flash-linear-attention exists anywhere in this project, so no licence statement is made here. Check the distribution you install.
#   safetensors              Apache Software License — read from version 0.8.0
#       evidence: .venv-reference/lib/python3.12/site-packages/safetensors-0.8.0.dist-info/METADATA, classifier `License :: OSI Approved :: Apache Software License`
#   accelerate               Apache (Apache Software License) — read from version 1.15.0
#       evidence: .venv-reference/lib/python3.12/site-packages/accelerate-1.15.0.dist-info/METADATA, field `License: Apache`, classifier `License :: OSI Approved :: Apache Software License`
#   numpy                    BSD-3-Clause AND 0BSD AND MIT AND Zlib AND CC0-1.0 — read from version 2.5.3
#       evidence: .venv-reference/lib/python3.12/site-packages/numpy-2.5.3.dist-info/METADATA, field `License-Expression`
#   scipy                    BSD License (classifier); the METADATA `License` field carries the Enthought / SciPy Developers copyright line rather than an SPDX identifier — read from version 1.18.1
#       evidence: .venv/lib/python3.12/site-packages/scipy-1.18.1.dist-info/METADATA, classifier `License :: OSI Approved :: BSD License`
#   pillow                   MIT-CMU — read from version 12.3.0
#       evidence: .venv/lib/python3.12/site-packages/pillow-12.3.0.dist-info/METADATA, field `License-Expression: MIT-CMU`
#
# See README.md, "Third-party dependency licences".