model_release/receipt-agent/qualification/README.md

ReceiptAgent exact-revision qualification

This directory freezes and preserves one bounded, real CPU evaluation of the public SZLHOLDINGS/SZL-Forge-1.5B-ReceiptAgent candidate. It is independent of the unbound local Ollama/GGUF tag and makes no training, hosting, deployment, or promotion claim.

Frozen inputs

• Candidate revision: fa73dc1bd8eeece727d0b5c1db52448ec0703e8b
• Authoritative source revision: szl-holdings/szl-forge@60fbe85bb4bd02ca6dbcac2db069a058d88dfe8a
• Contract: heldout-contract-v1.json
• Output contract: the exact receiptagent.schema.json carried by the candidate
• Decoding: greedy, temperature zero, eight CPU threads
• Cases: three raw-JSON conformance cases and three boundary-refusal cases

The runner fails before inference unless the candidate weights, adapter, inference configs, tokenizer, chat template, license, schema, signed receipt chain, source Git objects, and public curriculum hashes all bind to the frozen contract. The owner signature is verified against the key shipped in the same public repository; the key is not independently pinned, so this establishes repository self-consistency rather than third-party identity assurance.

Measured result

The 2026-07-21 run loaded the exact 3,087,467,144-byte public safetensors file on CPU and ran all six cases once:

Check	Raw count
Raw JSON Schema valid	3 / 3
Proposal-only boundary valid	3 / 3
REFUSE prefix valid	3 / 3
Detected catastrophic events	0

Receipt: fa73dc1-cpu-qualification-receipt.json
Canonical receipt SHA-256: 5abc85af639477f32951784c372beef33a608375586c111e517692207074ba7b

The receipt retains every exact system prompt, user prompt, raw output, input and output token count, output digest, generation duration, artifact/source binding, runtime version, and memory observation.

Artifact digest-domain reconciliation (2026-07-28)

The apparent conflict between the receipt-declared weight hashes and the public LFS raw SHA-256 values came from comparing different digest domains. The original training signer used SHA256(UTF8(basename) || raw safetensors bytes), while Hugging Face LFS and the qualification contract expose raw file-byte SHA-256. This qualification already computed and checked both domains while reading the exact 3.09 GB model and 147.8 MB adapter.

The network-free reconciliation under ../reconciliation/ verifies this receipt's self-digest, freezes both digest domains, and records that all 12 inference-bearing Git blobs at public head 2e62cb5f8e6a17052da532305a467861094a2109 equal revision fa73dc1bd8eeece727d0b5c1db52448ec0703e8b. The only public-head delta is the non-inference SZL_ESTATE_MANAGED.json marker. The resulting state is ARTIFACT_BYTES_RECONCILED_MEASURED_NOT_PROMOTED; the evaluation limits below and every promotion gate remain in force.

Limits

This is a structural-contract evaluation, not an evidence-grounding benchmark. The model emitted schema-valid endpoint/evidence references, but the runner did not probe those endpoints or independently validate their labels. The run also does not establish semantic noncontamination, absence from a private training set, general reasoning quality, hosted availability, or fitness for autonomous or high-stakes action.

The runtime printed a Transformers tokenizer-regex advisory and generation configuration advisories. The exact outputs and runtime versions are preserved; no tokenizer or generation setting was silently changed after the frozen run. Any corrected-tokenizer comparison must be separately preregistered and must not replace this receipt.

Reproduction

The evaluator performs no network access when the exact candidate snapshot and exact source checkout are already present. Supply those paths explicitly:

$env:HF_HUB_OFFLINE = "1"
$env:TRANSFORMERS_OFFLINE = "1"
$env:SZL_GIT_EXE = "<path-to-git.exe>"
python model_release/receipt-agent/qualify_public_candidate.py `
  --snapshot-dir "<hf-cache>/snapshots/fa73dc1bd8eeece727d0b5c1db52448ec0703e8b" `
  --source-repository "<checkout-of-szl-forge>" `
  --source-revision "60fbe85bb4bd02ca6dbcac2db069a058d88dfe8a" `
  --contract model_release/receipt-agent/qualification/heldout-contract-v1.json `
  --output model_release/receipt-agent/qualification/reproduction-receipt.json

A reproduction creates a new timing-bearing receipt and therefore a different receipt digest. It must preserve the original rather than overwrite it.