model_release/receipt-agent/README.md

SZL-Forge-1.5B — ReceiptAgent release program

This directory originated as a bounded, honesty-first release program for a proposed model named SZL-Forge-1.5B-ReceiptAgent-v1. A public, weight-bearing candidate now exists at SZLHOLDINGS/SZL-Forge-1.5B-ReceiptAgent; that external artifact does not retroactively satisfy this repository's broader admission or promotion gates. The exact public revision qualified below remains a candidate, not a promoted A11oy runtime dependency.

The purpose is narrow: a small model that produces a strict unsigned draft containing an answer or abstention, evidence IDs, formula references, uncertainty, and a non-executing tool proposal. Deterministic runtime code in receipt_runtime.py resolves authoritative records, enforces policy, binds canonical hashes, and builds the final response envelope only after verifying a replay-protected DSSE receipt over every decision-bearing component. Its HMAC-SHA256 path is experimental; public promotion still requires asymmetric attestation and transparency logging. A useful release would make those controls measurable. It would not make a generic chat model rare, prove the model's identity from behavior, or turn retrieved text into a mathematical proof.

Current measured boundary

Item	Current evidence	Release implication
Base	unsloth/Qwen2.5-1.5B-Instruct-bnb-4bit at d2f2dd02b071701d5100a04a7a49d6fb0bd305b7	Lineage must remain explicit.
Existing SFT adapter	SHA-256 682e2f0ea480d47c284b9de12c2e3d2d5170934c065e82fc375e3f069b4730ac	Identifies the existing candidate only; it is not a new ReceiptAgent artifact.
Existing SFT data	167 rows	License, privacy, and contamination review is incomplete, so reuse is blocked.
Existing evaluation	Incomplete	A 16-row loss direction exists, but general quality is not established.
ORPO candidate	0/12 qualification checks	Quarantined; cannot influence release.
Brain	9,464 raw nodes	All 9,464 are training-quarantined; zero raw-node text rows are admitted to train.
Formula admission	146 formula crosswalk records + 2 SZL-Lake evidence records = 148 holdout tranche rows	All 148 are holdout; zero are admitted to train. Formula IDs are namespace-scoped.
Public candidate	HF revision fa73dc1bd8eeece727d0b5c1db52448ec0703e8b; raw model.safetensors SHA-256 a797592fb35c32cc6ebf5739c0a1d9312123300acaf09987d207d86196bc6e7d	MEASURED only by the bounded CPU contract qualification below; not promoted or deployed by this repository.

The artifact reconciliation in reconciliation/ distinguishes signed-receipt validity, raw artifact SHA-256, the original signer's SHA256(UTF8(basename) || raw bytes) domain, and public-head equivalence. At the frozen observed head, raw Git commit objects reproduce both declared revision IDs, serialized root/subtree objects reproduce their commit-bound tree IDs, and the complete tree delta is the one non-inference estate marker. ReceiptAgent is ARTIFACT_BYTES_RECONCILED_MEASURED_NOT_PROMOTED. This state does not expand the bounded CPU evaluation or establish hosted serving, general quality, promotion, deployment, or independent owner identity.

Exact-revision CPU qualification (2026-07-21)

qualification/heldout-contract-v1.json freezes the public artifact, public source revision, output schema, six postdated project-authored prompts, greedy decoding, and pass thresholds before inference. The deterministic runner qualify_public_candidate.py then verifies:

• the 3,087,467,144-byte model and 147,770,496-byte adapter by raw and training-receipt directory digests;
• every inference-affecting config, tokenizer, chat template, generation config, and adapter config by exact byte count and SHA-256 at the frozen candidate revision;
• the byte-bound Apache-2.0 license file (a declared license observation, not a legal opinion);
• the owner-signed Ed25519 training/evaluation receipt chain against the repository-declared key;
• the exact szl-holdings/szl-forge source commit, evaluator/schema Git blobs, and five public curriculum hashes; and
• absence of every held-out prompt as exact text in those public curriculum blobs. Semantic contamination and private-corpus absence are not established.

The one bounded CPU run produced 3/3 raw JSON-schema-valid drafts, 3/3 valid proposal-only boundaries, 3/3 REFUSE-prefixed adversarial responses, and zero detected catastrophic execution/finalization events. Its unsigned local receipt is qualification/fa73dc1-cpu-qualification-receipt.json, with canonical SHA-256 5abc85af639477f32951784c372beef33a608375586c111e517692207074ba7b.

This is a narrow structural-contract result. It does not establish endpoint existence, evidence grounding, citation correctness, general capability, private-set noncontamination, hosted availability, deployment, promotion, or human release approval. In particular, schema-valid evidence labels remain claims to verify externally; this run does not resolve or probe the cited endpoints. The local receipt is deliberately unsigned because no approved independent qualification key was provided.

The current Brain and formula corpus are valuable as a governed retrieval and evaluation substrate. They are not a training corpus until item-level rights, provenance, revisions, freshness, deduplication, and split assignments pass.

Contract

The adapter contract is szl.forge-receipt-draft.v1; the final runtime contract is szl.receipt-agent-output.v1. They are deliberately different. The model proposes. The deterministic runtime validates, resolves, gates, and receipts.

receipt-agent-output.schema.json requires each response to separate:

1. exact model identity and release state;
2. ANSWERED, ABSTAINED, or UNAVAILABLE status;
3. answer text, which must be null when abstaining or unavailable;
4. evidence IDs, content hashes, support roles, and admission states;
5. formula ID, namespace, status, and explicit proof-transfer decision;
6. confidence and calibration state;
7. a typed abstention reason;
8. a proposal-only tool request that always requires human approval and cannot contain an execution receipt; and
9. request, evidence-set, policy, and external receipt bindings.

An ANSWERED response must have at least one ADMITTED_REFERENCE. The example is deliberately UNAVAILABLE; it contains no fabricated answer or receipt.

Admission gates

admission-manifest.json is fail-closed. Promotion requires every gate to pass and permits zero catastrophic errors. Current blockers are:

• incomplete row-level governance for the existing 167-row dataset;
• 9,464/9,464 raw Brain nodes quarantined from training;
• 146 formula records plus 2 SZL-Lake evidence records reserved as 148/148 holdout rows, with F1-F23 namespace collisions;
• the ORPO candidate failing all 12 qualification checks;
• no independently pinned release key, third-party provenance review, or local promotion approval for the externally published candidate;
• no frozen three-way evaluation;
• no signed DSSE/in-toto provenance or transparency-log record; and
• unresolved release/data licensing and no human release approval.

Passing base and adapter digest checks proves only which existing artifacts are being discussed. It does not promote them or establish ReceiptAgent behavior.

Evaluation design

evaluation-manifest.json fixes a three-column comparison:

• exact pinned base;
• exact existing SFT adapter; and
• exact future ReceiptAgent artifact.

The same frozen prompts, decoding parameters, tool policy, evidence snapshot, and formula crosswalk must be used for all three. Required suites cover strict schema validity, evidence existence, false support, formula status and namespace preservation, required abstention, stale/quarantined-source refusal, prompt injection, unauthorized tools, malformed receipts, identity honesty, and separately reported p95 latency. Every matrix cell is currently NOT_RUN.

Latency is an operational measurement, not a quality score. Behavioral fingerprints are supplemental regression signals, not proof of weight identity.

Hugging Face family

The proposed family is declared in release-manifest.json. The first public candidate is now externally observable; the remaining family members stay planned until independently verified:

• SZLHOLDINGS/SZL-Forge-1.5B-ReceiptAgent — public candidate carrying a merged safetensors artifact plus a separately bound adapter directory;
• SZLHOLDINGS/SZL-Forge-ReceiptAgent-Eval — frozen, rights-reviewed evaluation set;
• SZLHOLDINGS/SZL-Forge-ReceiptAgent-Schemas — schemas and conformance fixtures;
• SZLHOLDINGS/SZL-Forge-ReceiptAgent-Demo — fail-closed Space with live load and inference receipts; and
• SZLHOLDINGS/SZL-Forge-Collection — collection created last, after every member exists.

release-manifest.json remains a preregistration snapshot and still marks every target PLANNED_NOT_CREATED; it must not be silently rewritten into historical evidence. Live inventory now contradicts that state for the first candidate, which is why this qualification binds the external revision explicitly. The other IDs require separate live verification. A model card alone must not be presented as a weight-bearing model.

Identity, license, and naming

The base license is reported by existing local evidence as Apache-2.0. Adapter and dataset release licenses remain blocked pending lineage and row-level rights review. Promotion also requires hashes for base files, adapter config and weights, tokenizer, chat template, dataset manifest and split, code commit, environment lock, evaluation manifest, and output schema.

The final release must carry a signed DSSE/in-toto statement and an independently readable transparency-log entry. It must disclose Qwen2.5-derived lineage and non-affiliation with Alibaba/Qwen, Unsloth, Hugging Face, Anthropic, and Claude. It must never use another vendor's model name to obscure lineage.

Bounded implementation sequence

1. Resolve item-level data rights; do not admit raw Brain or formula holdout rows.
2. Build a new, owned or explicitly licensed ReceiptAgent curriculum that targets the v1 contract.
3. Preregister immutable train/eval splits and the full three-way evaluation matrix.
4. Train once from the pinned base and capture code, environment, seed, GPU, and artifact receipts.
5. Run every suite against base, existing SFT, and the new artifact under identical settings.
6. Stop on any catastrophic event or failed admission gate.
7. Have a human reviewer approve the model card, data statement, licenses, and evidence bundle.
8. Sign and log provenance; publish the adapter, eval data, schemas, and working Space; create the collection last.

Local validation

The focused test uses only the Python standard library:

python -m unittest tests.test_receipt_agent_release_program

It checks the JSON documents against the dependency-light schema subset used here, asserts the exact repository facts, and exercises fail-closed contract conditions. It performs no network calls or external mutations.