Open Models Need Open Science

Two teams can run the same model and report different scores. The scaffold around the model produced the gap. That makes the scaffold part of the result, and disclosure part of the science.

The scaffold is the loop from the agent-loop note. It runs observe, decide, act, examine, then remember. Every joint in it moves a score, and a leaderboard shows none of them.

Three Levels of Access, and One Supports Science

Open covers three kinds of release, and they differ by what an outsider can inspect.

• Black-box API. A user calls the model and cannot inspect the weights or the training process.
• Open weights. A user runs and adapts the weights, while the data and the training details stay closed.
• Fully open release. Weights, data, code, recipes, and reporting are public enough for outside scrutiny.

Open weights help a team run and adapt a model. The data shows what shaped it, and the recipe lets a stranger repeat the run. Published evaluations let an outsider prove the claim instead of trusting the release note.

A model can be useful to run and still be hard to audit or repeat. Treating open release as a slogan blurs five separate things. Reproducible science, useful artifacts, commercial reuse, safety review, and downstream accountability each need a different layer.

Agents Add a Second Black Box

An agent is a system. When the model is closed and the scaffold is closed, a benchmark compares two products. The number ranks the products and leaves the mechanism unnamed.

An open system lets a researcher ask a sharper question. Which part helped: the model, the tool interface, the retrieval source, the scoring code, or the search budget? Each answer sends the team to different work.

The reasoning note drew a line: reflection lives inside the model, and verification lives outside it. A closed scaffold pulls verification back inside the vendor, where no outsider repeats it.

For Agents, Openness Has More Layers Than Weights

Sort what a release can disclose into four groups.

• Model. Weights, tokenizer, architecture, and the training recipe where a team can publish it.
• Data. Pretraining data, instruction data, filtering choices, and known contamination checks.
• Scaffold. Prompt, tool definitions, memory policy, retrieval corpus, retries, action budget, stopping rule, and the code that runs the loop.
• Evaluation. Task set, environment version, scoring code, and failure analysis.

The scaffold row is where an agent score moves. Tool definitions are the action interface, and the memory policy is the state the loop carries. The stopping rule decides when a run ends.

One release can be open for use, closed for provenance, strong for adaptation, and weak for accountability at once. A score reported without those four groups is hard to read.

Two Teams, One Model, Different Scores

With a plain model, a team compares prompt in and answer out. With an agent, the scaffold joins the measured system.

The gap between two labs on the same weights comes from five knobs. Tool surface, attempts, context budget, retrieval, and environment each move the number. A cleaner browser interface and a hidden retrieval source both show up as model quality. None of the five touches the weights.

A team that states the knobs publishes evidence. A team that hides them publishes a product claim. Both ran the same model, and only one said what else it ran.

The demo-thinking note named the quiet version of this. A human supplied the missing state, and the system took the credit. An undisclosed scaffold does the same thing on a leaderboard.

Opacity Slows the Field Down

Two costs land right away. A team repeats a mistake because the recipe stayed private. A benchmark drifts into marketing because hidden details decided the result.

The third cost lands on safety. An agent acts through tools, so its trail matters more than the trail of a model that only answers. An outsider cannot audit what a release does not show.

The enterprise-agent note made every action name what it relied on, what it changed, and how to undo it. A release owes an outsider the same three answers.

The honest trade runs between scientific inspectability, competitive advantage, misuse risk, and privacy. Serious people draw that line in different places. A team that closes a layer and names it stays honest.

The Builder Test

Ask what a stranger can prove without help from the team that shipped the model.

• Run the model from the released artifact alone.
• Inspect the data: what went in, what got filtered out, which contamination checks ran.
• Repeat the recipe closely enough that the numbers land in the same place.
• Compare evaluations: task set, environment version, scoring code, and the failure cases.
• Read the license and the safety report, then name what each one forbids.

Whatever fails that list is the part of the release that only the team can vouch for. Add one line to the release note: who maintains this, and for how long.

What Carries

Openness is a stack of evidence. One label on a release tells a reader nothing about which layer opened.

Calling an API and reproducing a result are different claims. Both can be true, and only the second one lets the field build on the work.

Disclosure tells an outsider what happened. A release gate decides whether it happens at all.