Conceptual trust boundary and review layers

A conceptual relationship diagram moves from OpenAI's research environment to reported activity on Hugging Face production systems, then separates host evidence, company response, vendor remediation, independent analysis, and legal review. Every connection uses equal-width geometry.

Technical containment, company response, vendor remediation, independent analysis, and legal review are separate layers with different evidence owners.

Semantic data for Conceptual trust boundary and review layers
Record typeSourceRelationship or nodeTargetEvidence laneSource IDsState
NodeOpenAI investigation, control changes, and evaluationsNodeOpenAI company reportoa-1, oa-2Caution
NodeHost containment, reconstruction, and affected-asset assessmentNodeHugging Face host telemetryhf-1, hf-2Verified
NodeMETR and Redwood analysis with access limitsNodeMETR and Redwood independent investigationmr-1, mr-2Caution
NodeAlabama investigation and records demandsNodeLegal processal-1, al-2Caution
NodeReported activity on Hugging Face production systemsNodeOpenAI company reportoa-1, oa-2Caution
NodeOpenAI research and evaluation environmentNodeOpenAI company reportoa-1, oa-2Caution
NodeJFrog statement and advisory contextNodeVendor remediationjf-1, jf-2Caution
EdgeOpenAI investigation, control changes, and evaluationsLegal inquiry; no liability findingAlabama investigation and records demandsLegal processal-1, al-2Caution
EdgeOpenAI investigation, control changes, and evaluationsVendor remediation contextJFrog statement and advisory contextVendor remediationjf-1, jf-2Caution
EdgeHost containment, reconstruction, and affected-asset assessmentSeparate company review layerOpenAI investigation, control changes, and evaluationsOpenAI company reportoa-1, oa-2Caution
EdgeHost containment, reconstruction, and affected-asset assessmentEvidence supplied for bounded reviewMETR and Redwood analysis with access limitsMETR and Redwood independent investigationmr-1, mr-2Caution
EdgeReported activity on Hugging Face production systemsHost response record; no causal claimHost containment, reconstruction, and affected-asset assessmentHugging Face host telemetryhf-1, hf-2Verified
EdgeOpenAI research and evaluation environmentCompany-reported sequence; no causal claimReported activity on Hugging Face production systemsOpenAI company reportoa-1, oa-2Caution
Conceptual trust boundary and review layers A conceptual relationship diagram moves from OpenAI's research environment to reported activity on Hugging Face production systems, then separates host evidence, company response, vendor remediation, independent analysis, and legal review. Every connection uses equal-width geometry. Technical containment, company response, vendor remediation, independent analysis, and legal review are separate layers with different evidence owners. SYSTEMSPUBLIC EVIDENCELegal inquiry; no liability finding Vendor remediation context Separate company review layer Evidence supplied for bounded review Host response record; no causal claim Company-reported sequence; no causal claim OpenAI investigation, … Company response Host containment, reco… Host evidence METR and Redwood analy… Independent analysis Alabama investigation … Open legal process Reported activity on H… Reported crossing OpenAI research and ev… Company-reported boundary JFrog statement and ad… Vendor remediation Flywheel platform parent lines show hierarchy. Dashed related lines are companion links, not runtime dependency.Rounded primary node and lab nodes are visual grouping only; evidence nodes remain receipts.
Sources
Retrieved
Units
conceptual relationships
Transformations
  • Keep the diagram conceptual and omit reusable technical instructions, secret indicators, and sensitive infrastructure detail.
  • Render every connection with equal-width lines.
  • Use relationship labels and state labels in addition to color.
Uncertainty
The diagram reconciles reported layers and is not a complete architecture or control inventory. Every node remains attributable to its source family.
What this figure does not prove
The diagram does not establish a complete technical path, traffic volume, probability, intent, severity, control effectiveness, liability, or universal agent behavior.