# Release binding across Hugging Face, Kaggle and Cloudflare

**11 November 2026 · Read-only distribution check, not a new training run or authority system.**

## Why this exists

A successful notebook and a working mirror can still belong to different releases. This checker separates **matching the reviewed snapshot** from **being the latest full repository release**. It does not change either deployment, rerun a notebook, or silently update a trusted reference.

The initial executed readback checked 85 selected file observations: 18 reference-HF files, those same 18 files at the captured current HF head, 19 files at the immutable Cloudflare deployment, the same 19 at its mutable branch alias, and 11 files in the existing Kaggle dataset. It also checked the completed Kaggle result's exact hash and the notebook's normalized source before/after reading. HTTP success alone is not enough; empty, missing or altered content is not a match.

The result was `PINNED_RELEASE_MATCH`, with `HEAD_ADVANCED_SELECTED_ASSETS_UNCHANGED` and `is_latest_release:false`. The Cloudflare snapshot is therefore consistent with its declared research source, not a mirror of every newer repository change. This is selected-file coverage, not every repository file.

## Readback and checker

- `observation.json` contains the collected hashes and statuses, not secrets or private data.
- `verdict.json` contains the separate consistency and freshness result.
- `release-binding-lock.json` fixes the reviewed source, data/code hashes and exact endpoint identities.
- `release_binding.py` evaluates that evidence without network access.
- `collect_release_binding.py` performs one bounded read-only collection through existing HF/Kaggle clients and public Cloudflare HTTP reads.
- `qualification.json` records the classifier tests. They are synthetic controls, not 44 independent live deployments.

Run from a downloaded copy of this directory using the already installed clients:

```sh
python3 collect_release_binding.py --out ./new-observation
python3 release_binding.py ./new-observation/observation.json
python3 test_release_binding.py
node test-readback-view.mjs
```

Use a new output directory for each collection so old observations remain intact. The collector reads existing public Kaggle data and notebook outputs through your authorised account. It does not start a notebook or HF Job, call a model, change Cloudflare or enable a scheduler. Do not put tokens in source, command arguments, reports or public files.

The standard-library evaluator can replay an old observation with `--at` and an explicit timestamp, but marks it **historical replay at caller time**. It is not then a fresh/current check. Without `--at`, an observation older than one hour fails the declared recency policy. The web page also changes to a historical/recheck-required state after that hour; a stored successful report never becomes perpetual live health evidence.

## What the controls cover

Tests distinguish matched snapshots, newer heads with unchanged selected files, newer selected code needing review, source changes during a read, altered model/dataset bytes, branch-alias divergence, missing/empty/error responses, changed notebook source, false result files, queued/failed notebooks, changed accelerator/internet configuration, malformed dates, expired observations and authority assertions. Strict parsing rejects duplicate keys and nonfinite JSON constants.

An initial unshipped control exposed an incorrect latest flag for a deliberately inconsistent head/byte record. That failure is retained in `initial-qualification-failure.json`. The corrected classifier refuses the contradiction and only labels a latest head when the exact selected source identity also matches. Existing remote applications were not involved in that synthetic test failure.

## Scope and trust

This is byte/source/version consistency, not a signature or proof of truth. A malicious report author can fabricate hashes; obtain the checker/lock through a trusted channel and run the live collector when current assurance is needed. Account-authenticated transport does not independently authenticate model claims, original input capture, human approval or real-world validity. The clock and one-hour observation policy also remain explicit assumptions.

No authenticated approval-to-effect, independent organisation, fresh blind evaluation, model promotion, protected merge, automatic sync, paid compute or GSPC admission is claimed. The pinned Cloudflare preview and existing Kaggle run are left unchanged. Later legitimate source changes require review, not automatically changing this lock until they pass.

## Primary platform semantics

Hugging Face supports full-commit-pinned downloads: https://huggingface.co/docs/huggingface_hub/en/guides/download . Cloudflare distinguishes immutable deployment addresses from mutable branch aliases: https://developers.cloudflare.com/pages/configuration/preview-deployments/ . The checker tests both addresses separately. These documents explain platform behaviour; they do not endorse this research.

## Completed post-publication acceptance

All 44 classifier controls and eight display-state controls passed. The hosted page passed 18 checks across desktop and mobile-sized Chromium, including expired and future observations, a missing report and an altered latest flag. The two report artifacts and methods link were accessible; normal journeys produced no JavaScript errors or network writes. Twelve served source/evidence files matched the retained bytes before this evidence-only update. See `browser-acceptance.json`, `served-readback.json` and `release.json`. This is same-author qualification, not an independent external certification.