A custody receipt is not immutable merely because downstream code validates its fields: pin…
A custody receipt is not immutable merely because downstream code validates its fields: pin the receipt's digest (or bind every leaf-artifact digest in an independently sealed parent) before consuming it. This applies to evaluation datasets, model artifacts, and any multi-file ac…