SZLHOLDINGS

SZL-Forge-1.5B-ReceiptAgent

README

License: apache-2.0

The cut

Agents that 'use tools' skip the envelope. This model cannot act. It proposes. The controller signs. That split is the product.

An agent whose weights are physically incapable of being the actor. Authority lives outside the tensor.

Silhouette → leave → SZL

Table with columns: Leader, Take, then tweak
Leader	Take, then tweak
Anthropic	Claude tool-use, but the tool is always 'emit a proposal'.
NVIDIA	NIM agent runtime, minus the runtime — we refuse to let the weights call.
Unsloth	QLoRA on Qwen2.5-1.5B-Instruct, receipt-verified tag, signed train+eval.

Nobody else ships this combination. That is the point of a one-of-one.

Intended use

Alloy controller inbound. Never a naked chatbot.

Limitations

Proposal-only. Ungoverned decode is misuse.
Owner eval, not a public leaderboard.

Canonical GitHub: szl-holdings/szl-forge

What it does

Emits a single JSON draft conforming to the ReceiptAgent output schema: decision=DRAFT, approvalRequired=true, executed=false, provenance=MODEL_PROPOSED, receiptBinding.status=NOT_BOUND, and at least one cited evidence source carrying an honest label (MEASURED / REPORTED / DECLARED / SIMULATED / UNKNOWN / UNAVAILABLE).
The model is a proposer inside a controller boundary: Alloy validates the draft's arguments, gates on human approval, and executes any action outside the weights. The model never decides or acts.

Training (REPORTED — owner-metal, not server-measured)

Base model: Qwen/Qwen2.5-1.5B-Instruct
Method: QLoRA SFT with response-only loss masking and refusal oversampling (the adversarial refusal set is held out from training). Full, reproducible recipe: train_receiptagent.py in the forge kit.
Final train loss: 0.1038 (REPORTED by the owner's signed training receipt)
Trained at: 2026-07-13T21:33:44Z on host betterwithage
Curriculum: deterministic, schema-validated synthetic drafts + refusals; every dataset file is sha256-pinned in the receipt and byte-reproducible.

Evaluation (REPORTED — held-out, owner-signed)

Measured on a held-out curriculum, signed into eval_receipt.signed.json and chained to the training receipt:

Table with columns: Metric, Result
Metric	Result
Draft-conformance (schema-valid drafts)	5 / 5 (100%)
Adversarial-refusal (correctly refused overstep)	6 / 6 (100%)
Sanity gate (train-set reproduction, pre-eval)	drafts 15/15 · refusals 8/8

The adversarial-refusal rate — not the memorizable conformance rate — is the meaningful honesty score.

Verify this model (don't trust — check)

The two receipts are ed25519-signed over a canonical JSON string and hash-chained (eval.trainingReceiptSha256 == sha256(trainingCanonical)).
The signing key is committed as owner_pubkey.json (keyId e7f01810aaa97394); its keyId re-derives from the SPKI.
Every datasets[*] sha256 in the receipts equals the committed curriculum files, and the output-schema sha equals receiptagent.schema.json.
The Alloy backbone re-runs all of the above per request and exposes the verdict at /api/forge/family (evidence.trainingStatus / evidence.evalStatus). Anyone can reproduce it against these files.

Honesty stance: results are REPORTED (produced on owner metal), not MEASURED by a third party. Trust anchor is REPO_DECLARED (the key ships in this repo); it upgrades to PINNED when the operator pins keyId out-of-band.

Files & provenance bindings

Merged model weights (*.safetensors) — the receipts' weightsArtifactSha256 is a deterministic digest over the sorted *.safetensors of the merge (basename + bytes), reproducible with sha256_safetensors_dir in the forge kit. This — not any GGUF — is the artifact the signed weights hash covers.
LoRA adapter (*.safetensors) — bound by adapterSha256 the same way.
owner_pubkey.json, training_receipt.signed.json, eval_receipt.signed.json, receiptagent.schema.json — the verifiable provenance bundle.
Any *.gguf is a derived convenience for llama.cpp / Ollama and is covered by the signed weights hash.

Run it

python
from transformers import AutoModelForCausalLM, AutoTokenizer

model_id = "SZLHOLDINGS/SZL-Forge-1.5B-ReceiptAgent"
tok = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForCausalLM.from_pretrained(model_id, torch_dtype="auto", device_map="auto")

messages = [{"role": "user", "content": "Draft a decision on raising the rolling-24h spend cap."}]
inputs = tok.apply_chat_template(messages, add_generation_prompt=True, return_tensors="pt").to(model.device)
out = model.generate(inputs, max_new_tokens=512, do_sample=False)
print(tok.decode(out[0][inputs.shape[-1]:], skip_special_tokens=True))

The model returns a single JSON draft (decision=DRAFT, approvalRequired=true, executed=false) or a refusal — never a finalized action. Validate the output against receiptagent.schema.json before acting on it.

Adapter (PEFT) alternative

The LoRA adapter ships under adapter/ for stacking on the stock base:

python
from peft import PeftModel
from transformers import AutoModelForCausalLM

base = AutoModelForCausalLM.from_pretrained(
    "Qwen/Qwen2.5-1.5B-Instruct", torch_dtype="auto", device_map="auto"
)
model = PeftModel.from_pretrained(
    base, "SZLHOLDINGS/SZL-Forge-1.5B-ReceiptAgent", subfolder="adapter"
)

Intended use & limits

Use: proposing governed, evidence-cited decision drafts for a human-in-the-loop controller (e.g. Alloy).
Not for: autonomous execution, finalizing actions, or being treated as a source of ground-truth numbers. It is a 1.5B proposer, not an oracle.

Citation

Part of the SZL-Forge family by SZL Holdings. Provenance verifiable via the Alloy governed-inference backbone.

Available on FriendliAI

Dedicated Endpoints

Run this model inference on single tenant GPU with unmatched speed and reliability at scale.

Learn more

Container

Run this model inference with full control and performance in your environment.

Learn more

Model Details

Model Provider

SZLHOLDINGS

Model Tree

Base

Qwen/Qwen2.5-1.5B-Instruct

Fine-tuned

this model

Input Modalities

Text

Output Modalities