SZL-Forge-1.5B-ReceiptAgent/README.md

---
license: apache-2.0
base_model: Qwen/Qwen2.5-1.5B-Instruct
library_name: transformers
pipeline_tag: text-generation
tags:
  - qlora
  - governed-agent
  - proposal-only
  - receipt-verified
  - szl-holdings
  - alloy
---

<p align="center">
  [![receipts](https://img.shields.io/badge/receipts-training%20+%20eval%20signed-3af4c8?style=flat-square)](https://huggingface.co/SZLHOLDINGS/SZL-Forge-1.5B-ReceiptAgent/blob/main/training_receipt.signed.json)
  [![weights](https://img.shields.io/badge/weights-1.5B%20safetensors%20+%20LoRA-5b8dee?style=flat-square)](https://huggingface.co/SZLHOLDINGS/SZL-Forge-1.5B-ReceiptAgent/tree/main)
  [![family](https://img.shields.io/badge/family-SZL--Forge-d7b96b?style=flat-square)](https://huggingface.co/SZLHOLDINGS)
</p>

<!--
  Model card for SZL-Forge-1.5B-ReceiptAgent. Every number below is DERIVED from
  the committed owner-signed receipts (training_receipt.signed.json +
  eval_receipt.signed.json), which the Alloy backbone independently re-verifies
  at /api/forge/family. Do NOT hand-edit a number here — regenerate it from the
  receipts, or it becomes a fabrication. License Apache-2.0 matches the
  Qwen2.5-1.5B-Instruct base; the operator may change it at any time.
-->

# SZL-Forge-1.5B-ReceiptAgent

A **governed, proposal-only** agent fine-tune of `Qwen/Qwen2.5-1.5B-Instruct`.
It **proposes** evidence-bound, approval-gated decision **drafts** as JSON — it
never finalizes, never executes, and never fabricates a number, citation, or
receipt. When asked to overstep that boundary, it **refuses**.

> **Provenance, not vibes.** Every capability claim on this card is backed by an
> ed25519 owner-signed receipt committed alongside the weights and
> **independently re-verified** by the Alloy backbone. Verify it yourself (see
> *Verify this model* below). Nothing here is asserted that a signature does not
> already prove.

## What it does

- Emits a single JSON **draft** conforming to the ReceiptAgent output schema:
  `decision=DRAFT`, `approvalRequired=true`, `executed=false`,
  `provenance=MODEL_PROPOSED`, `receiptBinding.status=NOT_BOUND`, and at least
  one cited evidence source carrying an honest label
  (`MEASURED / REPORTED / DECLARED / SIMULATED / UNKNOWN / UNAVAILABLE`).
- The model is a **proposer inside a controller boundary**: Alloy validates the
  draft's arguments, gates on human approval, and executes any action *outside
  the weights*. The model never decides or acts.

## Training (REPORTED — owner-metal, not server-measured)

- **Base model:** `Qwen/Qwen2.5-1.5B-Instruct`
- **Method:** QLoRA SFT with **response-only loss masking** and **refusal
  oversampling** (the adversarial refusal set is held out from training). Full,
  reproducible recipe: `train_receiptagent.py` in the forge kit.
- **Final train loss:** `0.1038` (REPORTED by the owner's signed training receipt)
- **Trained at:** `2026-07-13T21:33:44Z` on host `betterwithage`
- **Curriculum:** deterministic, schema-validated synthetic drafts + refusals;
  every dataset file is sha256-pinned in the receipt and byte-reproducible.

## Evaluation (REPORTED — held-out, owner-signed)

Measured on a **held-out** curriculum, signed into `eval_receipt.signed.json`
and chained to the training receipt:

| Metric | Result |
| --- | --- |
| Draft-conformance (schema-valid drafts) | **5 / 5 (100%)** |
| Adversarial-refusal (correctly refused overstep) | **6 / 6 (100%)** |
| Sanity gate (train-set reproduction, pre-eval) | drafts 15/15 · refusals 8/8 |

The adversarial-refusal rate — not the memorizable conformance rate — is the
meaningful honesty score.

## Verify this model (don't trust — check)

1. The two receipts are ed25519-signed over a canonical JSON string and
   **hash-chained** (`eval.trainingReceiptSha256` == `sha256(trainingCanonical)`).
2. The signing key is committed as `owner_pubkey.json`
   (`keyId e7f01810aaa97394`); its `keyId` re-derives from the SPKI.
3. Every `datasets[*]` sha256 in the receipts equals the committed curriculum
   files, and the output-schema sha equals `receiptagent.schema.json`.
4. The Alloy backbone re-runs all of the above per request and exposes the
   verdict at **`/api/forge/family`** (`evidence.trainingStatus` /
   `evidence.evalStatus`). Anyone can reproduce it against these files.

**Honesty stance:** results are `REPORTED` (produced on owner metal), not
`MEASURED` by a third party. Trust anchor is `REPO_DECLARED` (the key ships in
this repo); it upgrades to `PINNED` when the operator pins `keyId` out-of-band.

## Files & provenance bindings

- **Merged model weights** (`*.safetensors`) — the receipts' `weightsArtifactSha256`
  is a deterministic digest over the sorted `*.safetensors` of the merge
  (basename + bytes), reproducible with `sha256_safetensors_dir` in the forge kit.
  This — **not** any GGUF — is the artifact the signed weights hash covers.
- **LoRA adapter** (`*.safetensors`) — bound by `adapterSha256` the same way.
- `owner_pubkey.json`, `training_receipt.signed.json`, `eval_receipt.signed.json`,
  `receiptagent.schema.json` — the verifiable provenance bundle.
- Any `*.gguf` is a **derived** convenience for llama.cpp / Ollama and is **not**
  covered by the signed weights hash.

## Run it

```python
from transformers import AutoModelForCausalLM, AutoTokenizer

model_id = "SZLHOLDINGS/SZL-Forge-1.5B-ReceiptAgent"
tok = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForCausalLM.from_pretrained(model_id, torch_dtype="auto", device_map="auto")

messages = [{"role": "user", "content": "Draft a decision on raising the rolling-24h spend cap."}]
inputs = tok.apply_chat_template(messages, add_generation_prompt=True, return_tensors="pt").to(model.device)
out = model.generate(inputs, max_new_tokens=512, do_sample=False)
print(tok.decode(out[0][inputs.shape[-1]:], skip_special_tokens=True))
```

The model returns a single JSON **draft** (`decision=DRAFT`, `approvalRequired=true`,
`executed=false`) or a **refusal** — never a finalized action. Validate the output
against `receiptagent.schema.json` before acting on it.

### Adapter (PEFT) alternative

The LoRA adapter ships under `adapter/` for stacking on the stock base:

```python
from peft import PeftModel
from transformers import AutoModelForCausalLM

base = AutoModelForCausalLM.from_pretrained(
    "Qwen/Qwen2.5-1.5B-Instruct", torch_dtype="auto", device_map="auto"
)
model = PeftModel.from_pretrained(
    base, "SZLHOLDINGS/SZL-Forge-1.5B-ReceiptAgent", subfolder="adapter"
)
```

## Intended use & limits

- **Use:** proposing governed, evidence-cited decision drafts for a
  human-in-the-loop controller (e.g. Alloy).
- **Not for:** autonomous execution, finalizing actions, or being treated as a
  source of ground-truth numbers. It is a 1.5B proposer, not an oracle.

## Citation

Part of the **SZL-Forge** family by **SZL Holdings**. Provenance verifiable via
the Alloy governed-inference backbone.

---

<p align="center">
  <a href="https://huggingface.co/SZLHOLDINGS">SZL Holdings</a> ·
  <a href="https://a-11-oy.com">a-11-oy.com</a> ·
  <a href="https://github.com/szl-holdings/szl-forge">szl-forge (GitHub source · forge kit)</a> ·
  <a href="https://huggingface.co/SZLHOLDINGS/SZL-Khipu-1.5B-GGUF">Khipu GGUF</a>
</p>

<p align="center"><sub>SLSA: L1 honest · L2 attested · L3 roadmap. Λ = Conjecture 1. Trust ceiling 0.97.</sub></p>