What you actually believe, in order
Take one verified artifact on your disk and ask: what had to be true for this to be the right file? The answers stack into a chain, and the chain — not any single link — is what your confidence rests on:
- The address is the maker's. The repo you pulled from belongs to the entity that made the model (track three's judgment — org account, authorship history, publication trail).
- The revision is the one you chose. You pinned a sha and fetched it; the address did not silently serve you "current" instead (track two's discipline).
- The reference digest is trustworthy. The LFS pointer's oid — the value you compared against — is published by the platform on upload and consistent across independent mirrors (this track's lesson two).
- The bytes you hold match the reference. Your local SHA-256 equals that oid; the size matches; the header parses (lessons three through five).
- The stored copy still matches. The periodic sweep says the file has not decayed since landing (lesson five's rest check).
Each link is a separate belief with a separate failure mode: link 1 fails to impersonation, link 2 to drift, link 3 to platform compromise, link 4 to transfer corruption, link 5 to storage decay. And each has its own instrument — which is the useful part: when something is wrong, the chain tells you which question to re-ask.
Why the chain, not the checklist
A checklist ends; a chain explains. "Digest matches" is a green checkbox that would be equally green for a perfectly-verified download of the wrong file — an attacker's model, served at a convincing address, digested honestly. The chain framing keeps the earlier links visible: verification of bytes (link 4) is worthless without verification of reference (link 3) and address (link 1). Security people say the same thing about TLS: the lock icon proves the connection, not the counterparty. Your digest proves the bytes, not the maker.
The chain also prices your trust realistically. Most archives hold artifacts whose link 1 is weaker than they would like — a vanished maker, a mirror of record, a community re-release. That is fine if the record says so: a holding marked "chain: 3-5 verified, 1-2 weak (mirror of record, maker gone)" is an honest artifact; the same holding with an unexamined link 1 is a comfortable mistake.
The one-line chain record
Close the integrity track by making the chain explicit in your acquisition notes. One line per artifact — address verdict, revision, reference source, digest result, last sweep — turns your archive into a place where the question "why do we trust this file?" always has a current, checkable answer. That line is the whole quest's definition of ownership, compressed to practice.