_{Part of the SZL Holdings governed estate — claims are designed to carry checkable receipts. Verification proves integrity & origin, never accuracy or performance.}

K H I P U

Retrieval that cannot hallucinate a citation. Grounding is structural.

KANCHAY · Doctrine v11 · Lean 749/14/163 · Λ = Conjecture 1 (advisory) · a-11-oy.com

Formerly published as SZL-Khipu-1.5B-BrainNavigator — same weights, renamed to the flagship line. All old links redirect.

STATUS: TRAINED + OWNER-EVALUATED on a small synthetic harness. The two receipt signatures, repo-declared Ed25519 key ID, and evaluation-to-training hash chain have been verified from the committed files. This proves receipt integrity relative to that key; it does not independently validate model quality, data provenance, or production readiness. Uploaded weights and adapter hashes are listed below.

One line

A compact 1.5B model for governed agent navigation. Given a query and a set of candidate Brain node handles (ids + synthetic metadata only — never node content), it proposes a retrieval plan as JSON: route over the handles, cite only the handles whose metadata supports the query, and abstain when none do. It holds no node content and never answers from memory — a controller resolves handles outside the weights.

The cut

The model is blind to content. Citations cannot be invented from memory because memory never saw the nodes. That is a capability nobody else wants, and we trained it.

Retrieval that cannot hallucinate a citation. Grounding is structural.

Silhouette → leave → SZL

Nobody else ships this combination. That is the point of a one-of-one.

Canonical GitHub: szl-holdings/szl-forge

Specification

GGUF quants available: SZL-Khipu-1.5B-GGUF — Q4_K_M · Q5_K_M · Q8_0 · F16, Ollama-ready. The signed receipts travel with the quants.

Receipts (committed here, verified)

Provenance boundary. The committed receipt signatures are reproducible against the repo-declared public key. That establishes signer continuity and tamper evidence, not independent validation of the training run, evaluation, or underlying data.

Derived from training_receipt.signed.json + eval_receipt.signed.json (keyId 89540347a69b789e):

Raw counts are the receipt-bound values. Derived rates are 100% plan validity (11/11), 80% grounding (4/5), and 33.3% abstention correctness (2/6); the small denominators and owner-run synthetic harness make them preliminary. The 2/6 abstention result is a visible release blocker for autonomous or high-stakes use. No deployed Alloy endpoint status is asserted by this card.

What it does

• Emits a single JSON plan conforming to the Khipu output schema (khipu.schema.json): contentAccess=HANDLES_ONLY, brainBinding.status=NOT_RESOLVED, a decision of NAVIGATE (≥1 citation, no abstainReason) or ABSTAIN (zero citations, an abstainReason), and citedNodeIds that are a subset of the offered candidates.
• The model is a navigator inside a controller boundary: Alloy validates the plan, resolves handles, and applies governance outside the weights. The model never resolves content and never acts.

Architecture

BrainNavigator sits inside a controller boundary: it plans over provided candidate handles and emits a schema-constrained JSON proposal, while an external controller resolves handles and gates execution outside the model weights. Zones: SIGNED (teal — receipts: real Ed25519 over canonical JSON, verify offline), REPORTED (blue — owner-run eval counts on a small synthetic harness), MODELED (gold — the schema + prompt contract + external-gate governance mechanism, modeled and not formally verified — no formal verification claimed).

Quick start

1. Python (transformers)

import json
from transformers import AutoModelForCausalLM, AutoTokenizer

model_id = "SZLHOLDINGS/SZL-Khipu-1.5B"
tok = AutoTokenizer.from_pretrained(model_id)
model = AutoModelForCausalLM.from_pretrained(model_id, torch_dtype="auto", device_map="auto")

# The user turn is a JSON object: {"query": ..., "candidates": [{nodeId, nodeKind, label, note}, ...]}
user = {
    "query": "Which handle records the rolling 24h spend-cap policy?",
    "candidates": [
        {"nodeId": "node://khipu-synthetic/0000000000000000", "nodeKind": "CLAIM",
         "label": "DECLARED", "note": "synthetic handle - topic tag policy-spend-cap; no node content."}
    ],
}
messages = [{"role": "user", "content": json.dumps(user)}]
inputs = tok.apply_chat_template(messages, add_generation_prompt=True, return_tensors="pt").to(model.device)
out = model.generate(inputs, max_new_tokens=512, do_sample=False)
print(tok.decode(out[0][inputs.shape[-1]:], skip_special_tokens=True))

expected versions: transformers>=4.37 (qwen2 arch), torch>=2.1 — this exact path is not agent-verified.

2. GGUF (llama.cpp / Ollama)

Ollama

ollama run hf.co/SZLHOLDINGS/SZL-Khipu-1.5B-GGUF:Q4_K_M

llama.cpp

llama-cli -hf SZLHOLDINGS/SZL-Khipu-1.5B-GGUF:Q4_K_M -p "Navigate: which receipt signed decision d-42?"

LM Studio — search SZLHOLDINGS/SZL-Khipu-1.5B-GGUF, pick Q4_K_M.

3. Prompt contract

The user turn is a single JSON object:

{
  "query": "<the retrieval question>",
  "candidates": [
    {"nodeId": "node://...", "nodeKind": "CLAIM", "label": "DECLARED", "note": "synthetic handle metadata only; no node content."}
  ]
}

Candidates carry handles only — ids plus synthetic metadata (nodeKind, label, note). The model never receives node content.

4. Expected output shape

The model returns a single JSON plan per khipu.schema.json:

{
  "contentAccess": "HANDLES_ONLY",
  "brainBinding": {"status": "NOT_RESOLVED"},
  "decision": "NAVIGATE",
  "citedNodeIds": ["node://... (subset of offered candidates)"],
  "abstainReason": null
}

decision=NAVIGATE cites ≥1 offered handle with no abstainReason; decision=ABSTAIN returns zero citations and an abstainReason. Never resolved node content. Validate the output against khipu.schema.json before acting on it.

Adapter (PEFT) alternative

The LoRA adapter ships under adapter/ for stacking on the stock base:

from peft import PeftModel
from transformers import AutoModelForCausalLM

base = AutoModelForCausalLM.from_pretrained(
    "Qwen/Qwen2.5-1.5B-Instruct", torch_dtype="auto", device_map="auto"
)
model = PeftModel.from_pretrained(
    base, "SZLHOLDINGS/SZL-Khipu-1.5B", subfolder="adapter"
)

Recorded traces

Label: RECORDED · AGENT-RUN (2026-07-16), llama.cpp CPU, Q4_K_M quant. These were produced by the agent that maintains this repo, running the public harness cases against the quantized GGUF build — a different artifact from the signed-receipt safetensors; numerics differ and nothing here re-states the owner-run eval. One case is a failure, recorded as such — the card's stated weak spot (abstention 2/6) showing up in practice.

Reproduce (seed 0, temp 0.0, Q4_K_M):

pip install llama-cpp-python jsonschema
curl -sSL https://huggingface.co/SZLHOLDINGS/SZL-Khipu-1.5B-GGUF/resolve/main/SZL-Khipu-1.5B-Q4_K_M.gguf -o /tmp/SZL-Khipu-1.5B-Q4_K_M.gguf
# fetch harness from github.com/szl-holdings/szl-forge main: khipu/{eval.jsonl,adversarial.jsonl,khipu.schema.json,eval_khipu.py}
python run_traces.py  # llama-cpp-python create_chat_completion, temperature=0, seed=0, GGUF embedded ChatML template

Full trace files (exact prompts, seeds, runtime versions, raw model JSON): repro/agent-run-2026-07-16/ · harness: repro/ · known-weak abstention discussion: see the pinned feedback thread.

Training (OWNER-REPORTED)

• Base model: Qwen/Qwen2.5-1.5B-Instruct.
• Method: QLoRA SFT with response-only loss masking and abstain oversampling.
• Curriculum: synthetic navigate and abstain scenarios. Their hashes are recorded in the signed receipt, but the curriculum files are not published in this model repo; the training data cannot be independently reconstructed from this repository alone.
• Reported result: final train loss 0.0245, trained on owner hardware at 2026-07-14T01:54:53.014702+00:00.

Evaluation (OWNER-RUN, REPORTED)

The committed evaluation receipt records a small held-out synthetic harness: 11/11 schema-valid plans, 4/5 grounding-correct cases, 2/6 abstention-correct cases, and zero hallucinated citations. These are owner-run results, not a third-party benchmark. The weak abstention result requires an external controller and blocks autonomous or high-stakes promotion.

Verify this model (do not trust — check)

1. Verify both Ed25519 signatures over each receipt's canonical JSON.
2. Re-derive keyId as the first 16 hex characters of SHA-256 over the SPKI bytes.
3. Recompute the evaluation-to-training chain from the training canonical JSON.
4. Recompute the committed khipu.schema.json hash and compare it with the receipt.
5. Treat the curriculum hashes as owner assertions here: their source files are not present in this model repository, so they cannot be independently recomputed here.

Evidence label: REPORTED, owner-run. Trust anchor: REPO_DECLARED. No third-party benchmark, external key pin, or production deployment is claimed.

Files & provenance bindings

• Merged model weights (*.safetensors) — the receipts' weightsArtifactSha256 is a deterministic digest over the sorted *.safetensors of the merge (basename + bytes), reproducible with sha256_safetensors_dir in the forge kit. This — not any GGUF — is the artifact the signed weights hash covers.
• LoRA adapter (*.safetensors) — bound by adapterSha256 the same way.
• owner_pubkey.json, training_receipt.signed.json, eval_receipt.signed.json, khipu.schema.json — the verifiable provenance bundle (committed post-forge).
• Any *.gguf is a derived convenience for llama.cpp / Ollama and is not covered by the signed weights hash.

Versions & releases

• Weights are immutable at the commit level: every artifact is pinned by its commit oid and by the Hub LFS SHA-256 listed above. Fetching a specific revision always returns the same bytes.
• Named tags are being added: v1.0.0 = 2026-07-14, the initial publish (weights + LoRA adapter + signed receipt bundle).
• GGUF quants are derived artifacts of that release, produced from the BrainNavigator weights; they are convenience builds and are not covered by the signed weights hash.
• Prompt-template or card edits never change the weights. Documentation and metadata revisions leave the model tensors byte-identical.

No release cadence is promised beyond what is committed here.

Feedback wanted (concrete)

This is a small, owner-run release and the 2/6 abstention result is an open weakness. Concrete reports are welcome in the repo Discussions:

• Failed traces — the exact {query, candidates} input JSON, the model's plan output, and what a correct plan should have been.
• Integration reports — runtime (transformers version / GGUF quant / Ollama), how you wired the controller, and where validation caught or missed a bad plan.
• Benchmark reproductions — your harness, denominators, and per-case results so the owner-run numbers above can be checked against an independent run.

Please include enough repro detail (input, output, versions) that the result can be reproduced byte-for-byte.

Intended use & limits

• Use: proposing governed, grounded-only retrieval plans over Brain node handles for a human-/controller-in-the-loop system (e.g. Alloy).
• Not for: resolving node content, autonomous retrieval/execution, or ground-truth navigation. It is a 1.5B proposer trained on synthetic scenarios. Its current 2/6 abstention result is insufficient for autonomous or high-stakes use; keep a validating controller and fail closed.

Citation

Part of the SZL-Forge family by SZL Holdings. Receipt integrity is verifiable from the committed files; runtime deployment status is a separate claim.

---

SZL Holdings · a-11-oy.com · Khipu GGUF · ReceiptAgent (sibling forge) · base model · szl-holdings/szl-forge (source/harness) · governed-receipts-bench

_{SLSA: L1 honest · L2 attested · L3 roadmap. Λ = Conjecture 1 (advisory, never a theorem). Trust ceiling 0.97 — never 100%. Labels honest by default: MEASURED / REPORTED / MODELED / HEURISTIC / UNKNOWN / UNAVAILABLE. locked-proven = exactly 8 {F1,F4,F7,F11,F12,F18,F19,F22}.}