منصة تموين — LEAP + DeepFest 2026

Independent, bilingual enterprise platform brief presenting منصة تموين / SBAY during LEAP and DeepFest 2026 in Riyadh, 31 August–3 September 2026.

Live targets:

• Primary hardened domain: https://leap2026.sbay.sa
• Repository mirror: https://sbay-dev.github.io/leap2026-pressroom/

The custom domain is served through Cloudflare and applies the checked-in security headers. Its no-transform cache directive prevents edge analytics injection, while the CSP grants only the narrow WebAssembly compilation capability required by the small public evidence module. That module exposes integer equality, bit extraction, population count and an empty trace_void; it does not contain the private Arabic analyser. GitHub Pages does not support repository-defined response headers, so the mirror uses GitHub's default headers and is not the canonical security boundary.

The narrative now opens with the public-domain Birmingham Quran manuscript as a historical witness, before any commercial or technical presentation. The opening summarizes the bounded Quran 20:13 raw-to-abstract result: the exact naturally written source remains preserved, combining marks are removed only from the rasm projection, five of five word blocks match five abstract slots, and four of four local typed relations are preserved under pinned location-bound morphology evidence. The manuscript image itself was not used for OCR or text extraction. The result is not independent syntax gold, blind grammar recovery, a model capability, or Quran-wide generalization. Its public-safe record is docs/assets/evidence/quran-20-13-raw-abstract-equivalence-public.json. The same opening links this research context to the live https://adg.sbay.sa/ adjudication platform and invites linguists and researchers to participate during the LEAP announcement. Parser predictions remain hidden until independent review is complete, and the invitation is explicitly not presented as prior adoption or independent adjudication of the Quran 20:13 proof.

The subsequent platform narrative follows:

Problem → Platform → Intelligence → Outcomes → Vision

The primary positioning is SBAY as an enterprise AI procurement and supply platform. NewsBoy, CP, Sarmad, CNS and QdrantServer appear as bounded operating or technical evidence. KSAR now has a dedicated live-commerce stage linked to its verified 2.1.0-leap2026 production release.

The CNS stage is rendered continuously from the trained-only, public-safe engineering artifact at docs/assets/evidence/cns-model-graph-public.json. The source ONNX matches SHA-256 8847832167ec643c66461ef8c6b7182b48286821d0fd20fd600414bf51f5dfef; its canonical value-independent structural graph hash is 51740c50a975b5c510f1685a939abd26fe9ef6ea0ba65fc10b6c59fffb9c67f1. Every rendered point represents one authentic ONNX operator at its measured topological depth. The public view exposes aggregate block and edge counts but withholds exact node/tensor names, exact wiring, initializer identities, weights, vectors and activations.

The audit is explicitly trained-only. The only local zero-named candidate is a v1 epoch-1 artifact with a different architecture, so it is rejected as an authentic step-0 match. The page therefore makes no zero-versus-trained, training-effect, Neural Persistence, representation-topology or curvature claim. It also does not present the animated depth scan as live inference.

The same stage includes values declared from the hash-identified CNS Cultural NewsBoy A3 ledger at CNSEmbedding commit 0ebf9988eff77078ea61e99d500092e10cd8baef. The source requires repository access and returned HTTP 404 to an unauthenticated verification request, so the pressroom does not describe it as an independently accessible public source or claim to have rerun the workload. Local copies of the report and token-accounting rules matched their Git blob identities byte-for-byte, establishing document identity rather than an independent workload replay. The disclosure record contains whole-corpus descriptive classification, throughput, memory, and per-million-token resource coefficients for 10,800 owned articles and 2,053,810 paired non-padding R9 tokens. The page states that training, development, and calibration rows are included, fresh holdout evidence remains the quality authority, and activation is disabled. It also publishes the token accounting rule: one million paired non-padding R9 model-input tokens, with raw preprocessing, GPU, CPU, memory, and energy separated. GPU-energy values are upper bounds from the enforced 50 W limit rather than measured power draw.

The previous visual treatment is preserved byte-for-byte under cepha-templates/k-space-concept-v1. A runnable, noindex fallback is available at /cepha-k-space-concept/ and linked from the primary stage. It retains the old interaction and presentation capability while identifying itself visibly as a non-evidentiary Cepha concept template. It cannot replace the measured engineering graph in any scientific claim.

The hero replays the WebAssembly-derived public flag pattern through WebGPU when available and Canvas2D otherwise: octet read, bit decode, bloom, quiet, then a live trace_void call. The processor-stage labels are explanatory, not a recording of physical CPU cycles. Release checks prove that this specific void function returns no value and leaves WebAssembly linear memory unchanged. The scene's “one bit” precision statement describes its smallest visible representation grain, not model accuracy. A deterministic five-second VP8 replay uses the verified Canvas2D fallback to draw 25 explicitly addressed samples from the same scene model and hold them across 150 encoded frames; WebGPU remains the primary live renderer where available. A five-card board in the technical annex binds every human-readable phase to its implementing file, public call contract and recomputable compute amount.

The KSAR stage presents one bounded proposition: watch the product, negotiate with the direct seller, and move toward an agreement in one live session. It links to the storefront, live market and public documentation, and publishes the release identities without claiming Saudi physical hosting, universal cross-device acceptance, sales or audience performance, raw IR broadcasting, or correction of the reported CPOLY freeze.

NewsBoy is represented by its supplied classic editorial and modern culture edition captures plus its native LEAP and DeepFest page embedded directly from https://newsboy.sbay.sa/coverage/leap-2026. The compact preview is non-interactive; its primary action expands the same original page to a full-viewport reader. Closing reloads the route at the top and restores the original card position and focus. A separate action opens the canonical source in a new tab.

NewsBoy permits framing only by itself or HTTPS subdomains of sbay.sa through frame-ancestors 'self' https://*.sbay.sa; its public Worker omits X-Frame-Options because that header cannot express the scoped allowlist. The pressroom CSP permits only the exact https://newsboy.sbay.sa frame origin, and the iframe keeps scripts, same-origin application requests, forms and user-initiated popups inside an explicit sandbox. The former same-origin /newsboy-reader relay remains available as an inactive compatibility fallback but is no longer the published reader path. The separate NewsBoy administrator surface remains non-embeddable.

The pressroom also includes the public ADG Arabic Adjudication Platform as a separate institutional research announcement. Its two-sample public pilot uses blind independent annotation, a third adjudicator for disagreements and an explicit identity/evidence separation boundary. It is not presented as a final Arabic correction service or final parser-readiness judgment.

A bilingual media brief is prepared in PNU-MEDIA-CENTER-BRIEF.md for submission to Princess Nourah bint Abdulrahman University’s media center. The brief expressly denies university issuance, approval, sponsorship, endorsement or partnership unless the center publishes an official announcement.

The investor-facing narrative centers on operating products, an enterprise platform scope and a measurable institutional-expansion thesis. Public evidence is linked directly from the page; detailed module availability, integrations and requirements are confirmed through the live demo and contract. AI capabilities are framed as accountable decision support rather than guaranteed automation.

This repository does not contain model weights, training data, tokenizers, expert maps, routing thresholds, private topology, credentials, private patent claims, or proprietary source code. Run the disclosure gate before publishing:

npm ci
npm run check

The Public disclosure boundary workflow also runs npm audit, rebuilds the deterministic release manifest and uploads a retained public-boundary-security-evidence-<commit> artifact. Report conventions are documented in security/reports/README.md.

Media capture uses a fresh headless Edge context and public, unauthenticated pages only:

npm run capture
npm run capture:adjudication
npm run capture:newsboy-leap
npm run capture:trace
npm run trace:evidence
npm run manifest

SBAY is an independent participant. This repository is not an official LEAP, DeepFest, Tahaluf, SDAIA, or MCIT website and does not imply sponsorship, endorsement, or partnership.