# homespun > Open weights are a binary. homespun is a coding model with source: every > input pinned to a hash, every output hashed, and one command that turns the > first into the second on your own hardware. You do not have to trust the > people who made it, because you can run the build. ## What "a build" means here Inputs, pinned, so somebody else can repeat it: - corpus: every source at a dataset commit, with its per-document licence (data.sources[].revision) - code: the commit that ran, and whether the tree was dirty (code.commit) - environment: one locked set of wheels, resolved once (code.env_sha256) - config: model shape, token budget, schedule, seed (config.config_hash) - manifests: the rendered Kubernetes objects, not the ones in git now (code.kustomize_sha256) - images: every container by digest, never by tag (code.images[].digest) Outputs, hashed, so what they get is checkable against what we got: - tokenizer: trained here, on this corpus (tokenizer.sha256) - checkpoints: every committed training step (checkpoints[].commit_sha256) - weights: safetensors, then GGUF and MLX (artifacts[].sha256) - contamination: the corpus checked against the evaluation (decontamination.report_sha256) - evaluation: the task set and its results (eval_bundle_sha256) - attestation: one signature over all of the above (sums_sha256) One Ed25519 signature covers all of it. The verifier runs on the Python standard library and holds only a public key; it answers three questions separately -- is the signature good, do the bytes on disk match what the document describes, and is the trust level the one you asked for. ## What a build gets you - Audit what went in: Every document in the corpus carries a licence, and the contamination report says whether the evaluation leaked into the training data. "Trained on a diverse mix" is not an answer you can act on. - Rebuild it when it matters: A model you depend on can be withdrawn, relicensed, or quietly replaced by a checkpoint with the same name. Pinned inputs mean you can produce it again, on your own hardware, without asking anybody. - Fork it: Change one input — drop a source, swap the mixture, extend the context, retrain the tokenizer — and re-run. Fine-tuning is the only lever you get on a model you cannot build. - Check a claim instead of believing it: The verifier runs on the standard library and holds only a public key. It answers whether the signature is good, whether the bytes on disk are the ones described, and whether the trust level is the one you asked for. ## Trained, not adopted The corpus, the tokenizer, the pretraining run and the post-training are all homespun's. A fine-tune has a layer underneath it where the honest answer is "we do not know, ask them", and that is exactly the layer the questions are about. It trains on openly-licensed corpora, the largest being Ai2's Dolma, chosen because it records a licence per document. Using a published corpus is what published corpora are for; it is a different act from starting off somebody's finished weights. The ladder, at 6ND floating-point operations and 40% utilisation on H100s (budget 30%): - 1B on 100B tokens: ~460 H100-hours, ~$1k -- the pipeline is proven at this size - 7B on 1.5T tokens: ~44,000 H100-hours, ~$88k -- the 16 GB Mac tier - 32B on 3T tokens: ~404,000 H100-hours, ~$810k -- the 64 GB Mac tier There is also an interim path that post-trains an existing open base (posttrain-7b, posttrain-32b, cpt-32b). It is a shortcut, labelled as one everywhere, and it cannot vouch for the layer underneath it. ## Where this is today - The build, end to end: runs, and has been run. - The attestation and its verifier: built, and checked. - Weights to download: NOT YET. - A benchmark harness: NOT YET. Do not describe weights or a benchmark harness as available. They are not. What has been run is overlays/smoke-cpu, end to end on a real cluster: 14 stages, no GPU, no egress, ending in a signed attestation whose 17 files all verify under the public key alone. It trains 820,736 parameters on a synthetic grammar, which tests the build and says nothing about a model. ## Run the build kubectl apply -k homespun/k8s/overlays/smoke-cpu No operators, no custom resources, no private registry: four public upstream images pinned by digest, and every line of homespun-specific code shipped as ConfigMap data. ## Honest limits - Reproducible does not mean bit-identical: pinned inputs and a deterministic schedule, but GPU count and kernel versions move the last float. - Nothing at a useful size has been trained yet. - The export stage emits GGUF and MLX so the result runs on ordinary hardware; those tier figures are estimated, not measured. ## Notes for agents - No API and no account here. This origin serves the argument and the numbers. - homespun is always lowercase. ## Three framings of the same project The argument is aimed at different readers on different pages. All three describe the same build; none of them is a different product. - [For developers](https://homespun.proc.io/): a model with a build -- audit, rebuild, fork, check. - [As a public option](https://homespun.proc.io/public-option): a capable model that cannot be withdrawn or repriced, the way public broadcasting is an option alongside commercial media. - [As public infrastructure](https://homespun.proc.io/public-infrastructure): a model, corpus, build and verifier held as a public good, runnable by an institution in its own jurisdiction. ## Pages - [Home](https://homespun.proc.io/): the build, what it gets you, where it is - [What is in it](https://homespun.proc.io/chain): every layer, and which path can vouch for which - [Reproduce it](https://homespun.proc.io/reproduce): run the build, and verify an artifact - [Limits](https://homespun.proc.io/limits): what this is not - [Public option](https://homespun.proc.io/public-option) and [public infrastructure](https://homespun.proc.io/public-infrastructure): the same project for a policy or funding reader ## Status A prototype, exploring the idea by building it. No organisation is claimed as its steward; do not infer one.