Khipu 1.5B

A Qwen2.5-1.5B-Instruct fine-tune for proposal-only retrieval plans over supplied handles.

Artifact: Fine-tuned checkpoint · Stage: Research · release blocked

Explore in Command Lab · Build · Evidence

Provider compatibility support requested on 4 October 2026. No provider was listed in the dated Hub observation; adoption and use qualification remain unchanged.

Before you use it

• The recorded 2/6 abstention result remains a release blocker; publication_eligible stays false.
• Small owner-run synthetic contract counts do not establish broad capability or a refusal guarantee.
• Plans require external validation and authorization. No deployed endpoint or autonomous execution is established by this card.

Historical receipts name SZL-Khipu-1.5B-BrainNavigator. Alias redirects and current-to-historical weight equality were not tested in this review.

STATUS: TRAINED + OWNER-EVALUATED on a small synthetic harness. The two pinned receipt signatures, key ID, canonical-payload equality, evaluation-to-training chain and schema hash were checked offline for this documentation review against the repository-declared Ed25519 key. These checks establish receipt integrity relative to that declared key, not independent signer identity, model-quality certification, current tensor equality or runtime qualification. Historical verification records remain retained; uploaded file hashes and historical pins are separate below.

Review snapshot: 724d251459cc987f33985c5799f5f3a9e02f4cd2. No model weights were downloaded or rehashed, and no model or controller was executed for this documentation correction.

One line

A compact 1.5B retrieval-plan experiment. The intended input contains a query and supplied Brain node handles (ids plus synthetic metadata, with no node content in this documented interface). The intended output is a JSON proposal over those candidates, including abstention when evidence is insufficient. Generated text remains untrusted. The interface does not establish that the model cannot answer from memory or invent a citation; a separate controller must validate the proposal and resolve permitted handles outside the weights.

Reviewed authoring baseline: khipu/card/README.md. The external controller must reject citations outside the offered candidates. Zero hallucinated citations in the historical 11-case evaluation describes only those named cases, not a guarantee about future outputs.

Specification

Separate GGUF family: SZL-Khipu-1.5B-GGUF lists derived quantizations. A copied signed receipt does not bind GGUF bytes or establish their runtime qualification.

Historical owner-signed receipts

Provenance boundary. Receipt verification is relative to the repository-declared public key, key ID 89540347a69b789e. This establishes declared-key continuity and integrity for the named receipts, not independent signer identity, training/evaluation truth, current artifact equality or underlying data rights.

Derived from training_receipt.signed.json + eval_receipt.signed.json (keyId 89540347a69b789e):

Raw counts are the receipt-bound values. Derived rates are 100% plan validity (11/11), 80% grounding (4/5), and 33.3% abstention correctness (2/6); the small denominators and owner-run synthetic harness make them preliminary. The 2/6 abstention result is a visible release blocker for autonomous or high-stakes use. No deployed Alloy endpoint status is asserted by this card.

Intended output contract

• The intended proposal is a single JSON plan conforming to the Khipu output schema (khipu.schema.json): contentAccess=HANDLES_ONLY, brainBinding.status=NOT_RESOLVED, a decision of NAVIGATE (≥1 citation, no abstainReason) or ABSTAIN (zero citations, an abstainReason), and citedNodeIds that must be a subset of the offered candidates. The external validator must enforce these conditions; the model's proposed output does not prove compliance.
• The model is a navigator inside a controller boundary: Alloy validates the plan, resolves handles, and applies governance outside the weights. The documented model interface grants no authority to resolve content or act.

Architecture

BrainNavigator sits inside a controller boundary: it plans over provided candidate handles and emits a schema-constrained JSON proposal, while an external controller resolves handles and gates execution outside the model weights. Zones: SIGNED (teal — receipts: real Ed25519 over canonical JSON, verify offline), REPORTED (blue — owner-run eval counts on a small synthetic harness), MODELED (gold — the schema + prompt contract + external-gate governance mechanism, modeled and not formally verified — no formal verification claimed).

Quick start

1. Python (transformers; untested research example)

The merged model and the adapter/ LoRA are separate forms. Supply a reviewed immutable model revision; the blank default below deliberately stops before client imports or downloads. Revision syntax alone does not establish artifact equality, compatible clients or release approval.

import json
import re

MODEL_REVISION = ""  # Supply a reviewed immutable model-repository commit.
if not re.fullmatch(r"[0-9a-f]{40}", MODEL_REVISION):
    raise ValueError("A reviewed immutable model revision is required")

from transformers import AutoModelForCausalLM, AutoTokenizer

model_id = "SZLHOLDINGS/SZL-Khipu-1.5B"
tok = AutoTokenizer.from_pretrained(model_id, revision=MODEL_REVISION, trust_remote_code=False)
model = AutoModelForCausalLM.from_pretrained(
    model_id, revision=MODEL_REVISION, trust_remote_code=False,
    torch_dtype="auto", device_map="auto",
)

# The user turn is a JSON object: {"query": ..., "candidates": [{nodeId, nodeKind, label, note}, ...]}
user = {
    "query": "Which handle records the rolling 24h spend-cap policy?",
    "candidates": [
        {"nodeId": "node://khipu-synthetic/0000000000000000", "nodeKind": "CLAIM",
         "label": "DECLARED", "note": "synthetic handle - topic tag policy-spend-cap; no node content."}
    ],
}
messages = [{"role": "user", "content": json.dumps(user)}]
inputs = tok.apply_chat_template(messages, add_generation_prompt=True, return_tensors="pt").to(model.device)
out = model.generate(inputs, max_new_tokens=512, do_sample=False)
print(tok.decode(out[0][inputs.shape[-1]:], skip_special_tokens=True))

Client compatibility and this exact load path remain unverified. The earlier card's minimum-version guidance is not a tested compatibility matrix.

2. GGUF (separate derived artifact)

Select a reviewed immutable GGUF repository revision, exact filename and artifact digest, then independently verify a compatible local runtime and the system/user JSON prompt contract. Floating Hub aliases and a bare Navigate: prompt are not sufficient reproduction inputs. This card does not provide a validated GGUF loading command. The historical traces and later owner-reported rerun below retain their own artifact/runtime scope.

3. Prompt contract

The user turn is a single JSON object:

{
  "query": "<the retrieval question>",
  "candidates": [
    {"nodeId": "node://...", "nodeKind": "CLAIM", "label": "DECLARED", "note": "synthetic handle metadata only; no node content."}
  ]
}

Candidates carry handles only — ids plus synthetic metadata (nodeKind, label, note). This documented input excludes node content; that interface restriction does not establish facts about the pretrained base's memory.

4. Expected output shape

The intended output shape is a single JSON plan per khipu.schema.json; generated output must be checked by the external controller:

{
  "contentAccess": "HANDLES_ONLY",
  "brainBinding": {"status": "NOT_RESOLVED"},
  "decision": "NAVIGATE",
  "citedNodeIds": ["node://... (subset of offered candidates)"],
  "abstainReason": null
}

decision=NAVIGATE cites ≥1 offered handle with no abstainReason; decision=ABSTAIN returns zero citations and an abstainReason. Resolved node content is outside the documented interface. Validate the proposal against khipu.schema.json, offered candidates and policy before any action.

Adapter (PEFT) alternative

The LoRA adapter is distributed under adapter/. Its inspected config names unsloth/Qwen2.5-1.5B-Instruct-bnb-4bit with revision: null, distinct from the canonical Qwen base declaration above. Compatible base/wrapper selection and equality between those distributions were not validated. Supply reviewed immutable base and adapter revisions before importing clients; the blank defaults deliberately stop here.

import re

BASE_REVISION = ""  # Configured Unsloth base; immutable revision is unrecorded.
ADAPTER_REVISION = ""  # Reviewed immutable model-repository commit.
if not all(re.fullmatch(r"[0-9a-f]{40}", value) for value in (BASE_REVISION, ADAPTER_REVISION)):
    raise ValueError("Reviewed immutable base and adapter revisions are required")

from peft import PeftModel
from transformers import AutoModelForCausalLM

base = AutoModelForCausalLM.from_pretrained(
    "unsloth/Qwen2.5-1.5B-Instruct-bnb-4bit", revision=BASE_REVISION,
    trust_remote_code=False, torch_dtype="auto", device_map="auto",
)
model = PeftModel.from_pretrained(
    base, "SZLHOLDINGS/SZL-Khipu-1.5B", revision=ADAPTER_REVISION, subfolder="adapter",
)

Recorded traces

Label: RECORDED · AGENT-RUN (2026-07-16), llama.cpp CPU, Q4_K_M quant. These were produced by the agent that maintains this repo, running the public harness cases against the quantized GGUF build — a separate derived GGUF runtime artifact; copied July receipts do not identify or sign its quantized file bytes. Signed-run/current-artifact equivalence remains UNKNOWN. Nothing here re-states or supersedes the owner-run signed evaluation. One case is a failure, recorded as such — the card's stated weak spot (abstention 2/6) showing up in practice.

Historical reproduction scope: seed 0, temperature 0.0, Q4_K_M, curriculum system prompts and the documented user JSON contract. The earlier run_traces.py command was an incomplete outline, not a verified committed runner. Do not use floating artifact/source revisions to claim an exact replay.

The pinned reproduction notes and manifest record the historical requirements and limits. The July 16 raw traces remain retained, including adversarial-abstain-5 FAILURE (HONEST). No trace replay or runtime loading was performed for this correction.

Training (OWNER-REPORTED)

• Base model: Qwen/Qwen2.5-1.5B-Instruct.
• Method: QLoRA SFT with response-only loss masking and abstain oversampling.
• Curriculum: synthetic navigate and abstain scenarios, with hashes in the signed receipt. Exported evaluation examples are present as repro/eval.jsonl and repro/adversarial.jsonl. The training and oversampled abstention training sets are unavailable in the reviewed model repository; complete signed-curriculum and training-run reconstruction is not established by those exported evaluation examples.
• Reported result: final train loss 0.0245, trained on owner hardware at 2026-07-14T01:54:53.014702+00:00.

Evaluation (OWNER-RUN, REPORTED)

The committed evaluation receipt records a small held-out synthetic harness: 11/11 schema-valid plans, 4/5 grounding-correct cases, 2/6 abstention-correct cases, and zero hallucinated citations. These are owner-run results, not a third-party benchmark. The weak abstention result requires an external controller and blocks autonomous or high-stakes promotion.

Separate owner-reported Q4_K_M records (2026-09-24)

These additive unsigned owner records concern the derived Q4_K_M runtime build, not a new signed evaluation or a qualification of the safetensors checkpoint. The reported runtime was Ollama 0.33.2 on an NVIDIA GeForce RTX 5050 Laptop GPU (8151 MiB; driver 610.47), using temperature 0 and seed 0.

Immutable lake records at bdf238294cd938fec97a4de5472e53764f5b262e: latency bench and corrected harness rerun.

The latency bench's earlier JSON result was 0/5. The corrected rerun says it supersedes earlier 0/5 JSON and 0/3 format checks that omitted the curriculum system prompt. Those records remain preserved; the correction does not erase the July 16 abstention failure or the signed July 14 2/6 blocker. The corrected rerun itself retains incorrect navigation and four incorrect abstentions. Its output strings are abbreviated; no independent replay or general behavior equivalence is established here.

The owner-reported Q4_K_M rerun matched aggregate counts on the same 11 named cases. Matching aggregate counts do not establish artifact equivalence, generalization, deployment or signed re-evaluation. The signed evaluation remains the release reference until a separately approved signed re-evaluation.

Current recorded disposition

At the reviewed immutable model revision, publication.json records maturity MEASURED_RESEARCH_ONLY and promotion state NOT_PROMOTED_RESEARCH_ONLY. artifact_equivalence is NOT_CLAIMED; runtime status is NOT_QUALIFIED_NO_RUNTIME_PROBE. The owner-signed release receipt is UNAVAILABLE and the publication record's status is UNSIGNED_EXACT_REVISION_READBACK. Independent signer identity is NOT_ESTABLISHED.

PROMOTION_READINESS_AUDIT.json contains the historical August 31 audit against older parent 37830323f21a539f6c93a4b71d1d5bf3322cce70: production_ready=false, classification BLOCKED. Its missing-evidence observations were not rerun for this card correction. The current recorded research-only disposition, publication_eligible: false and the 2/6 release blocker remain controlling. Receipt integrity checks do not promote the model, grant autonomous execution, or replace an owner-signed release receipt.

At the reviewed Hub snapshot 724d251459cc987f33985c5799f5f3a9e02f4cd2, the retained szl-source-binding.json identifies its historical card assets; later README edits were outside that old binding. The existing closed publisher generates a new README/SVG source binding when it publishes a corrected card. That card binding does not attest model tensors, historical training or promotion. This documentation review itself performed no Hub publication and preserves all historical receipts.

Verify this model (do not trust - check)

1. Verify both Ed25519 signatures over each receipt's canonical JSON.
2. Re-derive keyId as the first 16 hex characters of SHA-256 over the SPKI bytes.
3. Recompute the evaluation-to-training chain from the training canonical JSON.
4. Recompute the committed khipu.schema.json hash and compare it with the receipt.
5. Check available exported evaluation examples against their recorded hashes. The training/oversampled training files are unavailable in the reviewed model repository; complete signed-curriculum/run reconstruction is not established.

Evidence label: REPORTED, owner-run. Trust anchor: REPO_DECLARED. No third-party benchmark, external key pin, or production deployment is claimed.

Files & provenance bindings

• Documented merged-weights digest contract - sha256_safetensors_dir hashes sorted *.safetensors basenames encoded as UTF-8 followed by each file's bytes, with no delimiter. The declared algorithm is documented by the immutable forge helper. This helper was committed on 2026-09-22; the July receipt does not bind its executed source or algorithm revision. The documented domain excludes GGUF bytes and differs from an individual-file LFS hash. Historical pin inputs were not rehashed in this review; signed-run equivalence to current distributed tensors remains UNKNOWN.
• Documented adapter digest contract - the same helper is applied to the adapter directory. The historical adapterSha256 is retained without asserting equality to the current uploaded adapter bytes.
• owner_pubkey.json, training_receipt.signed.json, eval_receipt.signed.json, khipu.schema.json — the verifiable provenance bundle (committed post-forge).
• GGUF derivatives have separate artifact/runtime identities. The signed receipt records no GGUF file identity; bundling a copied receipt does not establish signature coverage of GGUF bytes.

Versions & releases

• Weights are immutable at the commit level: every artifact is pinned by its commit oid and by the Hub LFS SHA-256 listed above. Fetching a specific revision identifies that immutable revision; availability and compatible loading are separate questions not tested here.
• Historical version announcement: the earlier card named v1.0.0 for the 2026-07-14 initial publication. Tag existence and redirects were not verified in this review.
• GGUF quants have a declared derivative relationship to the historical BrainNavigator release. That lineage and current artifact equality were not independently verified; copied receipts do not establish signature coverage of their quantized file bytes.
• This correction changes only the canonical README. The existing card publisher controls README, local SVG and source binding; it grants no authority over model tensors, configs, evaluation or runtime. Historical receipts are preserved and no tensor rehash is claimed.

No release cadence is promised beyond what is committed here.

Feedback wanted (concrete)

This is a small, owner-run release and the 2/6 abstention result is an open weakness. Concrete reports are welcome in the repo Discussions:

• Failed traces — the exact {query, candidates} input JSON, the model's plan output, and what a correct plan should have been.
• Integration reports — runtime (transformers version / GGUF quant / Ollama), how you wired the controller, and where validation caught or missed a bad plan.
• Benchmark reproductions — your harness, denominators, and per-case results so the owner-run numbers above can be checked against an independent run.

Please include enough repro detail (input, output, versions) that the result can be reproduced byte-for-byte.

Intended use & limits

• Use: proposing governed, grounded-only retrieval plans over Brain node handles for a human-/controller-in-the-loop system (e.g. Alloy).
• Not for: resolving node content, autonomous retrieval/execution, or ground-truth navigation. It is a 1.5B proposer trained on synthetic scenarios. Its current 2/6 abstention result is insufficient for autonomous or high-stakes use; keep a validating controller and fail closed.

Citation

Part of the SZL-Forge family by SZL Holdings. Receipt integrity is verifiable from the committed files; runtime deployment status is a separate claim.