[](https://huggingface.co/SZLHOLDINGS/SZL-Forge-1.5B-ReceiptAgent/blob/main/training_receipt.signed.json) [](https://huggingface.co/SZLHOLDINGS/SZL-Forge-1.5B-ReceiptAgent/tree/main) [](https://huggingface.co/SZLHOLDINGS)
# SZL-Forge-1.5B-ReceiptAgent A **governed, proposal-only** agent fine-tune of `Qwen/Qwen2.5-1.5B-Instruct`. It **proposes** evidence-bound, approval-gated decision **drafts** as JSON — it never finalizes, never executes, and never fabricates a number, citation, or receipt. When asked to overstep that boundary, it **refuses**. > **Provenance, not vibes.** Every capability claim on this card is backed by an > ed25519 owner-signed receipt committed alongside the weights and > **independently re-verified** by the Alloy backbone. Verify it yourself (see > *Verify this model* below). Nothing here is asserted that a signature does not > already prove. ## What it does - Emits a single JSON **draft** conforming to the ReceiptAgent output schema: `decision=DRAFT`, `approvalRequired=true`, `executed=false`, `provenance=MODEL_PROPOSED`, `receiptBinding.status=NOT_BOUND`, and at least one cited evidence source carrying an honest label (`MEASURED / REPORTED / DECLARED / SIMULATED / UNKNOWN / UNAVAILABLE`). - The model is a **proposer inside a controller boundary**: Alloy validates the draft's arguments, gates on human approval, and executes any action *outside the weights*. The model never decides or acts. ## Training (REPORTED — owner-metal, not server-measured) - **Base model:** `Qwen/Qwen2.5-1.5B-Instruct` - **Method:** QLoRA SFT with **response-only loss masking** and **refusal oversampling** (the adversarial refusal set is held out from training). Full, reproducible recipe: `train_receiptagent.py` in the forge kit. - **Final train loss:** `0.1038` (REPORTED by the owner's signed training receipt) - **Trained at:** `2026-07-13T21:33:44Z` on host `betterwithage` - **Curriculum:** deterministic, schema-validated synthetic drafts + refusals; every dataset file is sha256-pinned in the receipt and byte-reproducible. ## Evaluation (REPORTED — held-out, owner-signed) Measured on a **held-out** curriculum, signed into `eval_receipt.signed.json` and chained to the training receipt: | Metric | Result | | --- | --- | | Draft-conformance (schema-valid drafts) | **5 / 5 (100%)** | | Adversarial-refusal (correctly refused overstep) | **6 / 6 (100%)** | | Sanity gate (train-set reproduction, pre-eval) | drafts 15/15 · refusals 8/8 | The adversarial-refusal rate — not the memorizable conformance rate — is the meaningful honesty score. ## Verify this model (don't trust — check) 1. The two receipts are ed25519-signed over a canonical JSON string and **hash-chained** (`eval.trainingReceiptSha256` == `sha256(trainingCanonical)`). 2. The signing key is committed as `owner_pubkey.json` (`keyId e7f01810aaa97394`); its `keyId` re-derives from the SPKI. 3. Every `datasets[*]` sha256 in the receipts equals the committed curriculum files, and the output-schema sha equals `receiptagent.schema.json`. 4. The Alloy backbone re-runs all of the above per request and exposes the verdict at **`/api/forge/family`** (`evidence.trainingStatus` / `evidence.evalStatus`). Anyone can reproduce it against these files. **Honesty stance:** results are `REPORTED` (produced on owner metal), not `MEASURED` by a third party. Trust anchor is `REPO_DECLARED` (the key ships in this repo); it upgrades to `PINNED` when the operator pins `keyId` out-of-band. ## Files & provenance bindings - **Merged model weights** (`*.safetensors`) — the receipts' `weightsArtifactSha256` is a deterministic digest over the sorted `*.safetensors` of the merge (basename + bytes), reproducible with `sha256_safetensors_dir` in the forge kit. This — **not** any GGUF — is the artifact the signed weights hash covers. - **LoRA adapter** (`*.safetensors`) — bound by `adapterSha256` the same way. - `owner_pubkey.json`, `training_receipt.signed.json`, `eval_receipt.signed.json`, `receiptagent.schema.json` — the verifiable provenance bundle. - Any `*.gguf` is a **derived** convenience for llama.cpp / Ollama and is **not** covered by the signed weights hash. ## Run it ```python from transformers import AutoModelForCausalLM, AutoTokenizer model_id = "SZLHOLDINGS/SZL-Forge-1.5B-ReceiptAgent" tok = AutoTokenizer.from_pretrained(model_id) model = AutoModelForCausalLM.from_pretrained(model_id, torch_dtype="auto", device_map="auto") messages = [{"role": "user", "content": "Draft a decision on raising the rolling-24h spend cap."}] inputs = tok.apply_chat_template(messages, add_generation_prompt=True, return_tensors="pt").to(model.device) out = model.generate(inputs, max_new_tokens=512, do_sample=False) print(tok.decode(out[0][inputs.shape[-1]:], skip_special_tokens=True)) ``` The model returns a single JSON **draft** (`decision=DRAFT`, `approvalRequired=true`, `executed=false`) or a **refusal** — never a finalized action. Validate the output against `receiptagent.schema.json` before acting on it. ### Adapter (PEFT) alternative The LoRA adapter ships under `adapter/` for stacking on the stock base: ```python from peft import PeftModel from transformers import AutoModelForCausalLM base = AutoModelForCausalLM.from_pretrained( "Qwen/Qwen2.5-1.5B-Instruct", torch_dtype="auto", device_map="auto" ) model = PeftModel.from_pretrained( base, "SZLHOLDINGS/SZL-Forge-1.5B-ReceiptAgent", subfolder="adapter" ) ``` ## Intended use & limits - **Use:** proposing governed, evidence-cited decision drafts for a human-in-the-loop controller (e.g. Alloy). - **Not for:** autonomous execution, finalizing actions, or being treated as a source of ground-truth numbers. It is a 1.5B proposer, not an oracle. ## Citation Part of the **SZL-Forge** family by **SZL Holdings**. Provenance verifiable via the Alloy governed-inference backbone. ---SZL Holdings · a-11-oy.com · szl-forge (GitHub source · forge kit) · Khipu GGUF
SLSA: L1 honest · L2 attested · L3 roadmap. Λ = Conjecture 1. Trust ceiling 0.97.