model-sourcing

Vet the concrete third-party model a study will be built on — this repository, this revision, this checkpoint — not the architecture family. Records a model dossier (source and version pin, licence and the file it was read from, intended use, pretrained-weight provenance, model task vs study task, reported validation, what the model was developed on, your evaluation arms) and gates it deterministically. Catches what a licence check and a citation count cannot: an evaluation arm sitting on the benchmark the model was developed or tuned on, so the arm reads like validation while being closer to a training-set score. Also an evaluation set inside a pretraining corpus, an unstated or use-incompatible licence, an unpinned revision, and a hardware claim never executed. It vets an artifact; it never downloads or runs one.