Start with the right question
A project can contain original code, dependencies, copied snippets, fonts, media, and AI-assisted contributions. Keep those components visible at delivery. The aim is an accurate inventory for technical and legal review, not an automated declaration that every license is compatible.
Work through the checks
Inventory shipped components
Record package names, versions, source locations, and the files actually distributed. Distinguish development-only tools from shipped assets, but verify that build output does not include material you assumed was excluded.
Preserve license evidence
Keep the applicable license text and required notices with the version used. A package name or repository badge is not a substitute for checking the actual terms and any exceptions.
Record provenance
Document copied snippets, contractor contributions, generated code, and client-supplied assets. If the origin of a component is uncertain, flag it for review rather than inventing an authorship history.
Define the handoff
List source code, build instructions, keys handled separately, documentation, and maintenance responsibilities. Ask a qualified reviewer about distribution or modification obligations that may apply to the intended use.
A record you can use
- Component and version
- Origin and contributor
- License or permission reference
- Where it is distributed
- Unresolved obligation
Keep this record locally. Use document references rather than publishing account numbers or other people's personal details. An empty field means the information is still missing; it should not be filled with an AI guess.
Worked example
A fictional developer hands over an application containing a chart library and a separately licensed icon set. The code repository includes the chart license but not the icon terms. The inventory exposes that gap before the client assumes all assets can be reused in a second commercial product.
This example is fictional and illustrates the method, not a real case result.
Limits and next steps
This is not a license-compatibility analysis. Copyright protection of computer programs and permission under a particular license are different questions. Do not remove notices or publish proprietary code merely to simplify a handoff.
Use the inventory with the actual license texts and proposed deployment model. Resolve unclear components before release and retain the reviewed version of the handoff record.