RELEASE_AUDIT.md

# BERTose/AFFINose Training Code Release Audit

Date: 2026-06-10

## Current Hugging Face State

Fresh no-token readback showed the public inference/model repositories are open. Training and reproducibility code is published in a dedicated public companion repository.

| Repository | Public | Gated | Snapshot | Training code present |
|---|---:|---:|---|---:|
| `supanthadey1/bertose-glycan-encoder` | yes | no | `62e2bb88557c` | no |
| `supanthadey1/bertose-iar-resolver` | yes | no | `68938794e4af` | no |
| `supanthadey1/affinose-interaction-model` | yes | no | `f13784cb11c7` | no |
| `supanthadey1/bertose-affinose-inference` | yes | no | `8b9eee2aac0c` | no |
| `supanthadey1/bertose-affinose-training-code` | yes | no | see current Hub head | yes |

Conclusion: the Hugging Face release is split cleanly between inference artifacts and the dedicated training/reproducibility companion.

## Published Release Contents

The public Hugging Face training-code repository is staged from:

```text
huggingface_release/bertose-affinose-training-code/
```

It contains:

```text
130 files, approximately 54 MB
```

The repository is a curated public training/reproducibility companion. It includes code, configs, vocabulary/split metadata, package-local dependencies, and provenance notes. It intentionally does not include the multi-GB corpora, intermediate mappings, checkpoints, generated figures, or full result bundles.

## Reproducibility Gap Fixed

The original code release had a concrete import gap:

```python
from training.multimodal_dataset import MultimodalGlycanDataset, create_multimodal_dataloaders
from training.multimodal_masking import MultimodalMaskingStrategy
```

`train_multimodal.py` imported those modules, but they were missing from the release package.

Added files:

- `code/training/multimodal_dataset.py`
- `code/training/multimodal_masking.py`
- `code/training/masking.py`
- `code/training/__init__.py`

Related package-local utility gaps were also repaired:

- `code/model/tokenizer.py`
- `code/model/wurcs_bpe_tokenizer.py`
- `code/downstream_tasks/__init__.py`
- `code/downstream_tasks/utils/__init__.py`
- `code/downstream_tasks/utils/tokenizer.py`
- `code/downstream_tasks/utils/wurcs_bpe_tokenizer.py`
- `code/downstream_tasks/utils/dataset.py`
- `code/downstream_tasks/utils/baseline_results.py`

`code/training/train_wurcs_bpe.py` was updated so it imports the BPE tokenizer from the package-local release tree instead of an old nested development path.

## Verification

The following checks passed on the repaired local package:

- Static first-party import resolution over `code/**/*.py`.
- Runtime import check for the repaired BERTose training, tokenizer, model dataset, and downstream utility modules.
- No `__pycache__` or `.pyc` files in the repaired release folder.
- No Hugging Face token-looking strings found in the repaired folder.
- Full staged-folder SHA256 verification using `SHA256SUMS`.
- SHA256 coverage check for all staged files except `SHA256SUMS` itself.

The following checks passed on the uploaded Hugging Face repository with `token=False`:

- `private=False` and `gated=False`.
- Required public files are present, including the repaired training modules.
- Model card license metadata is `apache-2.0`, and each public repo contains an Apache-2.0 `LICENSE` file.
- Full no-token snapshot download succeeds.
- Downloaded snapshot passes `SHA256SUMS` verification and coverage checks.
- Downloaded snapshot has no `.secrets`, `__pycache__`, `.pyc`, or `.DS_Store` artifacts.
- Downloaded snapshot has no Hugging Face token-looking strings.
- Runtime import check passes from the downloaded snapshot.

These checks prove release packaging, public access, checksum integrity, token hygiene, and import completeness for the repaired surface. They do not prove a full end-to-end retraining run.

## Known Scope Limits

1. Full retraining requires large data artifacts that are intentionally not bundled here, including full pretraining corpus pickles and multi-GB intermediate mapping files.
2. Full model checkpoints are hosted in the separate public inference/model repositories listed above.
3. ESM-C protein embeddings required for AFFINose training are not redistributed here. Users should generate or provide them according to the ESM-C access rules.
4. Historical executable names such as `code/bertint/` and versioned script names are retained for provenance, while public-facing documentation uses AFFINose.
5. Cluster scripts under `provenance/compute_provenance/` preserve original Nova compute context. They are provenance records, not portable launchers for every environment.
6. The public release metadata and repository license files declare Apache License 2.0 for the BERTose/AFFINose code, notebooks and released model artifacts. Third-party dependencies and external models, including EvolutionaryScale ESM-C, retain their own licenses and access terms.
7. A small synthetic-data smoke test for `train_multimodal.py` would be a useful future addition for users who want to validate the training loop without the multi-GB corpus.

## Published Hugging Face Repository

Repository:

```text
supanthadey1/bertose-affinose-training-code
```

Type:

```text
model
```

Access contract:

```text
Public, not gated, no token required for download.
```