model_release/receipt-agent/MODEL_CARD_DRAFT.md

metadata

language:
  - en
license: other
base_model: unsloth/Qwen2.5-1.5B-Instruct-bnb-4bit
base_model_relation: adapter
library_name: peft
pipeline_tag: text-generation
inference: false
tags:
  - structured-output
  - provenance
  - abstention
  - agentic-ai
  - formal-verification
  - sovereign-ai
  - experimental

SZL-Forge-1.5B — ReceiptAgent profile

MODEL PROGRAM - NOT A WEIGHT RELEASE
Release: NOT_PROMOTED | Quality: NOT_ESTABLISHED | Weights: NOT_CREATED | Inference: UNAVAILABLE

A small sovereign agent that must carry its evidence, uncertainty, formula status, and execution boundary inside every response.

This card is the prerelease contract for SZL-Forge-1.5B-ReceiptAgent-v1, the first governed profile in the SZL-Forge family. It is intentionally published before weights so that the model is judged against a frozen contract rather than a story written after training. A card-only repository must never be counted as a loadable model.

Why this model should exist

Most language models optimize the answer. ReceiptAgent is designed to optimize the verifiability of the decision boundary:

retrieve -> propose -> bind evidence -> preserve formula status
         -> quantify uncertainty -> abstain or request approval
         -> external policy gate -> external execution -> signed receipt

The model does not execute tools, sign receipts, prove theorems, or decide whether its own evidence is legally admissible. Those powers remain outside the weights in A11oy's governed runtime. The model proposes a schema-valid object; independent services validate, approve, execute, observe, and receipt it.

The differentiator

ReceiptAgent is not positioned as a Claude imitation, an "uncensored" derivative, or a generic chat fine-tune. Its release target is a compact, locally runnable agent with five measurable properties:

1. Evidence binding - an answered claim references admitted, content-addressed evidence.
2. Status preservation - a conjecture, executable check, reported result, and kernel-checked theorem remain different types.
3. Calibrated restraint - unsupported requests produce typed abstention, never confident filler.
4. Proposal-only agency - tool calls require an external human/policy gate and cannot contain a fabricated execution receipt.
5. Attested identity - lineage comes from immutable revisions, hashes, signatures, and transparency records, not from what the model says it is.

Architecture boundary

Layer	Role	Inside the weights?
Qwen2.5 1.5B base	Language and instruction prior	Yes
ReceiptAgent PEFT adapter	Unsigned structured draft proposals	Planned
9,464-node A11oy Brain	Retrieval and evaluation substrate	No
Formula crosswalk / Lean / mathlib status	Namespaced evidence and verification targets	No
Ouroboros loop	Retrieve, verify, approve, observe, learn orchestration	No
Deterministic ReceiptAgent runtime	Resolve evidence/formulae, bind hashes, and build the final envelope	No
A11oy policy gates	Authorization and effect control	No
DSSE/in-toto receipt layer	Signing, identity, and replay verification	No

Keeping these controls outside the model is deliberate. It prevents a weight artifact from grading its own proof, granting its own authority, or manufacturing its own receipt.

Exact lineage

Artifact	Identity	Current meaning
Base	unsloth/Qwen2.5-1.5B-Instruct-bnb-4bit	Reported Apache-2.0 Qwen2.5-derived base
Base revision	d2f2dd02b071701d5100a04a7a49d6fb0bd305b7	Immutable revision required for reproduction
Existing local SFT adapter	sha256:682e2f0ea480d47c284b9de12c2e3d2d5170934c065e82fc375e3f069b4730ac	Experimental predecessor; not established as ReceiptAgent
ReceiptAgent weights	Not created	A new training and artifact receipt is required

The existing adapter showed a directional loss improvement on a 16-row observation, but that result does not establish general quality, safety, evidence binding, or ReceiptAgent behavior.

Data boundary: what is and is not being trained

Source	Observed	Train-admitted	Current state
Existing SFT dataset	167 rows	0 approved for reuse	Rights/privacy/contamination review incomplete
A11oy Brain	9,464 raw nodes	0	All raw nodes training-quarantined
Formula admission	146 formula crosswalk records + 2 SZL-Lake evidence records = 148 holdout rows	0	Frozen holdout; namespace/status evaluation only
ORPO candidate	12 qualification checks	0	0/12 passed; quarantined

The Brain and formula system can make the released model more useful without being copied into the weights. They remain external retrieval, holdout, contradiction, freshness, and proof-status infrastructure. A future training curriculum must be newly assembled from owned or explicitly licensed rows with item-level provenance, deduplication, contamination analysis, and immutable split receipts.

No card may claim training on "all 200 formulas," the Brain, Lean, mathlib, GitHub, publications, or Hugging Face until row-level admission evidence proves the exact statement. The current repository evidence supports 146 formula crosswalk records plus 2 SZL-Lake evidence records in a 148-row holdout tranche, not a verified 200-formula training set.

Two-stage output contract

The adapter is intended to be trained to emit only szl.forge-receipt-draft.v1; ReceiptAgent-specific weights do not yet exist. It cannot admit evidence, grant proof status, authorize execution, or sign a receipt. receipt_runtime.py validates a candidate draft, resolves identifiers against immutable catalogs, applies policy, computes canonical hashes, and builds szl.receipt-agent-output.v1. It can validate and bind model identity fields supplied in a caller-provided external run-receipt mapping; it does not independently query or authenticate the serving runtime, so public promotion still requires a trusted model-load receipt verifier.

An ANSWERED final envelope is impossible unless the runtime cryptographically verifies a replay-protected receipt binding the draft, answer, model identity, request, evidence set, formula set, calibration, tool proposal, and policy snapshot. Otherwise the bridge returns a typed abstention. The local bridge supports non-stub HMAC-SHA256 DSSE for experimental operation; public promotion still requires asymmetric DSSE/in-toto attestation and an independently readable transparency-log record. The final envelope separates:

• model identity and release state;
• ANSWERED, ABSTAINED, or UNAVAILABLE status;
• admitted evidence IDs and content hashes;
• namespaced formula IDs and exact proof/status labels;
• calibrated uncertainty and abstention reason;
• a non-executing tool proposal requiring approval; and
• request, evidence-set, policy-snapshot, and external-receipt bindings.

An answered response without at least one ADMITTED_REFERENCE is invalid. An abstained or unavailable response cannot carry answer text. A proposed tool action cannot carry an execution receipt. Proof transfer is forbidden unless the formula status and independent verification receipt authorize it. The model itself never emits the signed final envelope.

Illustrative unavailable response:

{
  "schema_version": "szl.receipt-agent-output.v1",
  "response_id": "response:unavailable-example-0001",
  "model_identity": {
    "candidate_id": "SZL-Forge-1.5B-ReceiptAgent-v1",
    "release_state": "NOT_PROMOTED",
    "base_repository": "unsloth/Qwen2.5-1.5B-Instruct-bnb-4bit",
    "base_revision": "d2f2dd02b071701d5100a04a7a49d6fb0bd305b7",
    "adapter_sha256": null
  },
  "status": "UNAVAILABLE",
  "answer": null,
  "evidence": [],
  "formulae": [],
  "uncertainty": {
    "confidence": null,
    "calibration_state": "NOT_EVALUATED",
    "basis": "No promoted ReceiptAgent artifact exists and no inference was run."
  },
  "abstention": {
    "required": true,
    "code": "MODEL_UNAVAILABLE",
    "detail": "The release program is a specification only. Training, evaluation, attestation, publication, and promotion remain incomplete."
  },
  "tool_proposal": {
    "state": "NONE",
    "tool_id": null,
    "arguments_sha256": null,
    "requires_human_approval": true,
    "execution_receipt_id": null
  },
  "receipt_binding": {
    "state": "NOT_AVAILABLE",
    "request_sha256": "7a4e67e8fc8037691c60e8fe7a869f268e9b3bc375421850fd5770e03e66d121",
    "evidence_set_sha256": null,
    "policy_snapshot_sha256": "4755a60949f3a7636e70185b8048c6341915b9f6f403711730d89f5ac83b0687",
    "receipt_id": null
  }
}

This example is intentionally not impressive text. It demonstrates the behavior that matters when the system cannot support an answer.

Preregistered evaluation

The release compares three immutable columns under identical prompts, decoding parameters, evidence snapshots, policy, and hardware reporting:

1. exact pinned base;
2. exact existing SFT adapter; and
3. exact future ReceiptAgent artifact.

Suite	Promotion question	Current state
Schema conformance	Does every response validate?	NOT_RUN
Evidence existence and support	Do cited hashes exist and support the claim?	NOT_RUN
Formula namespace/status	Are collisions and proof states preserved?	NOT_RUN
Required abstention	Does the model refuse unsupported/stale/quarantined evidence?	NOT_RUN
Injection resistance	Can evidence or retrieved text override policy?	NOT_RUN
Tool authorization	Does the model avoid unauthorized execution claims?	NOT_RUN
Receipt integrity	Does it reject malformed or invented receipts?	NOT_RUN
Identity honesty	Does it avoid behavioral self-provenance claims?	NOT_RUN
General instruction following	What capability is retained outside the narrow task?	NOT_RUN
Runtime profile	Load, p50/p95 latency, VRAM, energy, restart	NOT_RUN

The catastrophic-error budget is zero for fabricated receipts, unauthorized tool execution, proof-status promotion, evidence-hash mismatch, or identity misrepresentation. Latency is reported as an operational metric, never a quality score.

Intended use

• local and sovereign evidence-bound assistants;
• human-reviewed research and engineering workflows;
• retrieval systems that need explicit support/contradiction/uncertainty labels;
• formula and theorem-status navigation with independent formal verification; and
• proposal-only agents whose actions are authorized and receipted elsewhere.

Out-of-scope use

• autonomous execution or self-approval;
• claims of new mathematical proof without independent kernel verification;
• legal, medical, financial, defense, or safety-critical decisions without a qualified human decision-maker;
• identity or lineage claims inferred from behavioral prompts;
• surveillance, targeting, or weapon release decisions; and
• presentation as Claude, Anthropic technology, or any unrelated vendor model.

Known limitations

• No ReceiptAgent-specific weights exist yet.
• The existing adapter's broad quality, calibration, safety, and deployment behavior are unestablished.
• Quantization, prompts, retrieval snapshots, and hardware can materially change behavior.
• Retrieval provenance does not by itself establish copyright, permission, freshness, or truth.
• Formal verification applies only to the exact checked statement and assumptions; it does not transfer automatically to generated prose.
• A signed receipt proves what a system recorded, not that the underlying world claim is true.

Release gates

The adapter will be published only after all of the following are independently readable:

• admitted curriculum manifest with row-level rights and immutable splits;
• training code commit, environment lock, seed, hardware, and run receipt;
• base, tokenizer, template, adapter, dataset, schema, and evaluation hashes;
• reload test on a clean runtime;
• completed three-way evaluation with zero catastrophic events;
• measured load/latency/VRAM/energy/restart receipts;
• human review of the model card, dataset statement, licenses, and limitations;
• DSSE/in-toto attestation and transparency-log reference; and
• a working fail-closed Space whose model-load and inference probes pass separately.

Planned Hugging Face release family

• SZLHOLDINGS/SZL-Forge-1.5B-ReceiptAgent - PEFT adapter; never a renamed full base
• SZLHOLDINGS/SZL-Forge-ReceiptAgent-Eval - frozen rights-reviewed evaluation set
• SZLHOLDINGS/SZL-Forge-ReceiptAgent-Schemas - schemas and conformance fixtures
• SZLHOLDINGS/SZL-Forge-ReceiptAgent-Demo - fail-closed Space with live receipts
• SZLHOLDINGS/SZL-Forge-Collection - created last, after every member resolves

All five targets are currently PLANNED_NOT_CREATED.

Reproduction contract

The final release must disclose exact commands and hashes for environment creation, adapter load, schema validation, evaluation, quantization, and receipt verification. A reproduction that changes base revision, tokenizer, chat template, quantization, dataset split, or decoding configuration is a new experiment and must produce a new receipt.

Licensing and non-affiliation

The base license is reported by current local evidence as Apache-2.0. The adapter and dataset release licenses remain PENDING_LEGAL_AND_LINEAGE_REVIEW. Third-party traces or outputs cannot enter training without explicit rights and policy review.

SZL Holdings is not affiliated with, sponsored by, or endorsed by Alibaba/Qwen, Unsloth, Hugging Face, Anthropic, or Claude. All third-party marks belong to their respective owners.

Citation

A stable citation will be added only after a promoted release and verified archival record exist. Until then, cite the repository commit containing this preregistration and identify it as a model program specification, not a released model.

Status

The ambitious part is not a larger claim. It is a smaller model with a harder release contract. Today that contract exists; the model does not. The next milestone is an admitted curriculum and a receipted training/evaluation run, not a promotional upload.