What this is not
The claim is a coding model you can build from source: every input pinned, every output hashed, and a build somebody else can run. Not a frontier model, and not finished. What that costs you, first rather than last.
-
Nothing at useful scale is trained yet
The pipeline is built, proven end to end, and costed. The models are not made. The ladder is a 1B at roughly 460 H100-hours, a 7B at 44,000, a 32B at 404,000 — arithmetic at 40% utilisation, and you should budget 30%.
Until somebody runs them there are no weights to download, and nothing here should be read as though there are.
-
Speed is the open question, not memory
A dense 32B is the slowest thing you can put behind an agent loop on ordinary hardware: roughly 25 tokens per second at 4-bit on an M5 Max, against about 62 for a comparable mixture-of-experts model. Memory is comfortable; throughput is not.
That is fine for asking questions and marginal for an agent burning tens of thousands of output tokens across many turns. The architecture decision is still open, and a mixture-of-experts at the same total size may be the better answer.
-
Reproducible does not mean bit-identical
Every input is pinned, so a second run reads exactly the bytes the first one read, and the attestation lets you prove it. What it does not promise is the same weights down to the last float: different GPU counts, kernel versions and reduction orders move the result, and claiming otherwise would be a lie you could catch with a diff.
What is checked is what can be checked. The training loop is deterministic under restart — a killed run resumed from its last checkpoint produces byte-identical losses, and a test asserts it — so the inputs, the schedule and the data order reproduce even where the floating-point arithmetic does not.
-
The interim path is a shortcut
The post-training overlays start from an existing open base, because a useful model this year beats a perfect model in three. A model made that way has a pretraining layer homespun did not make and cannot fully vouch for, so the attestation puts it in its own block — and the contamination check on that path is structurally blind to it. How each layer is made sets out which path vouches for what.
What the evaluation does not tell you
Publishing our own agentic tasks is contamination we can only measure, never prevent. They are canary-tagged, version-dated, and checked against the training mixture — and the check's own report states what n-gram overlap does not catch: paraphrase, translation, or the same problem in another language. It is a floor, not a guarantee.
On the default path the check builds its sketch from the post-training data only, so it structurally cannot see whether a problem was sitting in the base's pretraining corpus. On the from-scratch path it sees everything, because we read everything.
| dropped | why |
|---|---|
| LiveCodeBench | Terminal release; problems stop at April 2025. For a model trained on 2026 data, a number from it measures contamination rather than capability. |
| BigCodeBench | Repository archived by its owner in July 2026. |
| Aider polyglot | Leaderboard frozen at November 2025; 225 fixed exercises that have been in every corpus since 2024. |
| EvalPlus | Unmaintained since 2024 and saturated at 96–98%. It runs during training, where it still discriminates at small scale. It is never reported. |
What has actually been run
The CPU smoke overlay, end to end on a real cluster: 14 stages, 17 files verified against a signed attestation. That proves the pipeline and the provenance chain, and nothing about a model — it trains 820,736 parameters on a synthetic grammar. The GPU runs are specified with measured budgets and have not been run. The Mac tier numbers are estimates from published measurements, every one marked as such.
Not yet built: the benchmark harness, the laptop command-line tool.