A model with a build.

Open weights are a binary. You can run it and you can fine-tune it, but you cannot read what went into it, cannot rebuild it, and cannot check that the thing you downloaded is the thing that was described.

homespun is a coding model with source. Every input is pinned to a hash, every output is hashed, and one command turns the first into the second on your hardware. Trust is not something you extend to the people who made it; it is something you establish by running the build.

Inputs, pinned

so somebody else can repeat the build

corpus every source at a dataset commit, with its per-document licence data.sources[].revision

code the commit that ran, and whether the tree was dirty code.commit

environment one locked set of wheels, resolved once code.env_sha256

config model shape, token budget, schedule, seed config.config_hash

manifests the rendered Kubernetes objects, not the ones in git now code.kustomize_sha256

images every container by digest, never by tag code.images[].digest

Outputs, hashed

so what they get is checkable against what we got

tokenizer trained here, on this corpus tokenizer.sha256

checkpoints every committed training step checkpoints[].commit_sha256

weights safetensors, then GGUF and MLX artifacts[].sha256

contamination the corpus checked against the evaluation decontamination.report_sha256

evaluation the task set and its results eval_bundle_sha256

attestation one signature over all of the above sums_sha256

Run the whole build on any Kubernetes cluster — no GPU, no credentials, no egress:

$ kubectl apply -k homespun/k8s/overlays/smoke-cpu

Fourteen stages in minutes, ending in a signed attestation the last stage verifies with the public key alone. It trains a model far too small to be useful, on purpose: at this size the build is the thing being tested, not the model.

What a build gets you

Four things you cannot do with a checkpoint and a model card.

Audit what went in

Every document in the corpus carries a licence, and the contamination report says whether the evaluation leaked into the training data. "Trained on a diverse mix" is not an answer you can act on.

Rebuild it when it matters

A model you depend on can be withdrawn, relicensed, or quietly replaced by a checkpoint with the same name. Pinned inputs mean you can produce it again, on your own hardware, without asking anybody.

Fork it

Change one input — drop a source, swap the mixture, extend the context, retrain the tokenizer — and re-run. Fine-tuning is the only lever you get on a model you cannot build.

Check a claim instead of believing it

The verifier runs on the standard library and holds only a public key. It answers whether the signature is good, whether the bytes on disk are the ones described, and whether the trust level is the one you asked for.

Trained, not adopted

A fine-tune has a layer underneath it where the honest answer is "we do not know, ask them" — and that is exactly the layer the questions are about.

So the corpus, the tokenizer, the pretraining run and the post-training are all homespun's. It trains on openly-licensed corpora, the largest being Ai2's Dolma, chosen because it records a licence for every document. Using a published corpus is what published corpora are for; it is a different act from starting off somebody's finished weights.

model	tokens	compute	cost	status
`1B`	100B	~460 H100-hours	~$1k	the pipeline is proven at this size
`7B`	1.5T	~44,000 H100-hours	~$88k	the 16 GB Mac tier
`32B`	3T	~404,000 H100-hours	~$810k	the 64 GB Mac tier

Arithmetic, not a forecast: six floating-point operations per parameter per token at 40% utilisation on H100s. Budget 30%. The 7B is about seven days on 256 GPUs, the 32B about sixty-six. What each layer is made of.

Where this is today

The build, end to end: runs, and has been run
The attestation and its verifier: built, and checked
Weights to download: not yet
A benchmark harness: not yet

The build has been run end to end on a real cluster: 14 stages, no GPU, ending in a signed attestation whose 17 files all verify. Nothing at a useful size has been trained — the GPU runs are specified and costed, and until somebody runs them there are no weights here. How to run it, and what this is not.