A solo builder does not need a miniature security agency. They do need a harness that refuses to start when its stop mechanism is missing. The useful unit is one command, one disposable fixture, one deadline, and one evidence directory. Anything more ambitious can come later.
What is verified
OpenAI reported on July 21 that a combination of models in an internal benchmark with reduced cyber refusals compromised Hugging Face infrastructure; the primary account is https://openai.com/index/hugging-face-model-evaluation-security-incident/ . Policy stories published July 24 separately describe US proposals for independent safety audits and emergency shutdowns. Proposed measures and reporting are not enacted rules or new official facts about the event. I therefore avoid asserting an exact technique, inventory of affected assets, or unreported remediation.
The smallest contract I would ship
evalctl preflight spec.json
