How should an agent record the licence of a third-party asset it uses, separately for code, model weights, dataset and media, and which machine-readable fields exist?

SPDX 3.0.1 distinguishes declared from concluded licence relationships. REUSE 3.3 recommends comment headers with SPDX-FileCopyrightText and SPDX-License-Identifier; uncommentable files must carry the header in an adjacent file with the extra extension .license; a REUSE.toml may sit in any directory, and REUSE.toml and the deprecated DEP5 file must not be used together. Creative Commons recommends against using CC licences for software or hardware. IPTC Photo Metadata keeps separate fields for Copyright Notice, Rights Usage Terms (xmpRights:UsageTerms), Licensor and Web Statement of Rights (xmpRights:WebStatement), and the ccREL submission marks a licence with rel="license" plus cc:attributionName/cc:attributionURL. Recording each third-party asset's licence per component, with 'not stated' where the source is silent, is a proposed practice (labelled synthesis), and 'declared' means different things in SPDX and CycloneDX. Curator qualifications: Do not publish the declared/concluded sentence alone: attach H-08's caveat that SPDX 'declared' means discovered in the artifact (C2-B81-AUDIT2 hint). REUSE, IPTC, CC and HF field statements (F0, F2-F4) not reinspected. Amendments applied: CA-AM-0106, CA-AM-0107. Limitations: Review basis for most of the candidate. Evidence status: statements located in the cited sources by a correlated desk review (Claude); not executed; not independently reviewed.

{
  "citations": [
    {
      "url": "https://reuse.software/spec-3.3/",
      "note": "RelationshipType.md lines 50, 52"
    },
    {
      "url": "https://spdx.github.io/spdx-spec/v3.0.1/model/Core/Vocabularies/RelationshipType/",
      "note": "RelationshipType.md lines 50, 52"
    },
    {
      "url": "https://spdx.github.io/spdx-spec/v3.0.1/annexes/spdx-license-expressions/",
      "note": "RelationshipType.md lines 50, 52"
    },
    {
      "url": "https://iptc.org/std/photometadata/specification/IPTC-PhotoMetadata",
      "note": "RelationshipType.md lines 50, 52"
    },
    {
      "url": "https://wiki.creativecommons.org/wiki/Best_practices_for_attribution",
      "note": "RelationshipType.md lines 50, 52"
    },
    {
      "url": "https://www.w3.org/submissions/2008/SUBM-ccREL-20080501/",
      "note": "RelationshipType.md lines 50, 52"
    },
    {
      "url": "https://creativecommons.org/faq/",
      "note": "RelationshipType.md lines 50, 52"
    },
    {
      "url": "https://github.com/huggingface/hub-docs/blob/5ef2e847a69e9d8ac1ebdfab02549c1468c458ac/docs/hub/model-cards.md",
      "note": "RelationshipType.md lines 50, 52"
    },
    {
      "url": "https://github.com/huggingface/hub-docs/blob/5ef2e847a69e9d8ac1ebdfab02549c1468c458ac/docs/hub/datasets-cards.md",
      "note": "RelationshipType.md lines 50, 52"
    }
  ]
}