license, base_model, library_name, pipeline_tag, tags

license	base_model	library_name	pipeline_tag	tags
apache-2.0	Qwen/Qwen2.5-1.5B-Instruct	transformers	text-generation	qlora governed-agent proposal-only receipt-verified szl-holdings alloy

[](https://huggingface.co/SZLHOLDINGS/SZL-Forge-1.5B-ReceiptAgent/blob/main/training_receipt.signed.json) [](https://huggingface.co/SZLHOLDINGS/SZL-Forge-1.5B-ReceiptAgent/tree/main) [](https://huggingface.co/SZLHOLDINGS)

SZL-Forge-1.5B-ReceiptAgent

A governed, proposal-only agent fine-tune of Qwen/Qwen2.5-1.5B-Instruct. It proposes evidence-bound, approval-gated decision drafts as JSON — it never finalizes, never executes, and never fabricates a number, citation, or receipt. When asked to overstep that boundary, it refuses.

Provenance, not vibes. Every capability claim on this card is backed by an ed25519 owner-signed receipt committed alongside the weights and independently re-verified by the Alloy backbone. Verify it yourself (see Verify this model below). Nothing here is asserted that a signature does not already prove.

What it does

• Emits a single JSON draft conforming to the ReceiptAgent output schema: decision=DRAFT, approvalRequired=true, executed=false, provenance=MODEL_PROPOSED, receiptBinding.status=NOT_BOUND, and at least one cited evidence source carrying an honest label (MEASURED / REPORTED / DECLARED / SIMULATED / UNKNOWN / UNAVAILABLE).
• The model is a proposer inside a controller boundary: Alloy validates the draft's arguments, gates on human approval, and executes any action outside the weights. The model never decides or acts.

Training (REPORTED — owner-metal, not server-measured)

• Base model: Qwen/Qwen2.5-1.5B-Instruct
• Method: QLoRA SFT with response-only loss masking and refusal oversampling (the adversarial refusal set is held out from training). Full, reproducible recipe: train_receiptagent.py in the forge kit.
• Final train loss: 0.1038 (REPORTED by the owner's signed training receipt)
• Trained at: 2026-07-13T21:33:44Z on host betterwithage
• Curriculum: deterministic, schema-validated synthetic drafts + refusals; every dataset file is sha256-pinned in the receipt and byte-reproducible.

Evaluation (REPORTED — held-out, owner-signed)

Measured on a held-out curriculum, signed into eval_receipt.signed.json and chained to the training receipt:

Metric	Result
Draft-conformance (schema-valid drafts)	5 / 5 (100%)
Adversarial-refusal (correctly refused overstep)	6 / 6 (100%)
Sanity gate (train-set reproduction, pre-eval)	drafts 15/15 · refusals 8/8

The adversarial-refusal rate — not the memorizable conformance rate — is the meaningful honesty score.

Verify this model (don't trust — check)

1. The two receipts are ed25519-signed over a canonical JSON string and hash-chained (eval.trainingReceiptSha256 == sha256(trainingCanonical)).
2. The signing key is committed as owner_pubkey.json (keyId e7f01810aaa97394); its keyId re-derives from the SPKI.
3. Every datasets[*] sha256 in the receipts equals the committed curriculum files, and the output-schema sha equals receiptagent.schema.json.
4. The Alloy backbone re-runs all of the above per request and exposes the verdict at /api/forge/family (evidence.trainingStatus / evidence.evalStatus). Anyone can reproduce it against these files.

Honesty stance: results are REPORTED (produced on owner metal), not MEASURED by a third party. Trust anchor is REPO_DECLARED (the key ships in this repo); it upgrades to PINNED when the operator pins keyId out-of-band.

Files & provenance bindings

• Merged model weights (*.safetensors) — the receipts' weightsArtifactSha256 is a deterministic digest over the sorted *.safetensors of the merge (basename + bytes), reproducible with sha256_safetensors_dir in the forge kit. This — not any GGUF — is the artifact the signed weights hash covers.
• LoRA adapter (*.safetensors) — bound by adapterSha256 the same way.
• owner_pubkey.json, training_receipt.signed.json, eval_receipt.signed.json, receiptagent.schema.json — the verifiable provenance bundle.
• Any *.gguf is a derived convenience for llama.cpp / Ollama and is not covered by the signed weights hash.

Run it

from transformers import AutoModelForCausalLM, AutoTokenizer

model_id = "SZLHOLDINGS/SZL-Forge-1.5B-ReceiptAgent"
tok = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForCausalLM.from_pretrained(model_id, torch_dtype="auto", device_map="auto")

messages = [{"role": "user", "content": "Draft a decision on raising the rolling-24h spend cap."}]
inputs = tok.apply_chat_template(messages, add_generation_prompt=True, return_tensors="pt").to(model.device)
out = model.generate(inputs, max_new_tokens=512, do_sample=False)
print(tok.decode(out[0][inputs.shape[-1]:], skip_special_tokens=True))

The model returns a single JSON draft (decision=DRAFT, approvalRequired=true, executed=false) or a refusal — never a finalized action. Validate the output against receiptagent.schema.json before acting on it.

Adapter (PEFT) alternative

The LoRA adapter ships under adapter/ for stacking on the stock base:

from peft import PeftModel
from transformers import AutoModelForCausalLM

base = AutoModelForCausalLM.from_pretrained(
    "Qwen/Qwen2.5-1.5B-Instruct", torch_dtype="auto", device_map="auto"
)
model = PeftModel.from_pretrained(
    base, "SZLHOLDINGS/SZL-Forge-1.5B-ReceiptAgent", subfolder="adapter"
)

Intended use & limits

• Use: proposing governed, evidence-cited decision drafts for a human-in-the-loop controller (e.g. Alloy).
• Not for: autonomous execution, finalizing actions, or being treated as a source of ground-truth numbers. It is a 1.5B proposer, not an oracle.

Citation

Part of the SZL-Forge family by SZL Holdings. Provenance verifiable via the Alloy governed-inference backbone.

---

SZL Holdings · a-11-oy.com · szl-forge (GitHub source · forge kit) · Khipu GGUF

_{SLSA: L1 honest · L2 attested · L3 roadmap. Λ = Conjecture 1. Trust ceiling 0.97.}