Transfer the skill. Prove the gain. Adapt for the hardware you have.
A model strong everywhere except one capability? SILT moves that narrow skill from a teacher to a learner — and admits it only if held-out evidence shows the learner improved.
Skill packets travel from teacher to learner — the gate decides whether they arrive.
Evidence decides. Nothing else does.
The whole of SILT in one move: a skill packet may only enter the learner when held-out tests, safety checks and regression sweeps say so. Try sending two different packets through the gate.
Illustration of the gate discipline — not a real model run. Real verdicts come only from recorded held-out evaluations.
A model should not need to know everything from birth.
Installing or merging code starts no model run and grants no certificate. No model weights live in this public repository; no model or endpoint is auto-activated.
What each status means · the 2026-09-12 snapshot in one place
Default when run = an explicitly invoked core run · optional backend = backend/API selection · experimental opt-in = a separate CLI or opt-in local workbench · local diagnostic = a requested local check. Each still needs its supported models, dependencies and evidence.
The 2026-09-12 integrated snapshot adds hardware-adaptive planning/execution, controller safeguards, numeric/state fixes and Studio repairs. Linux CPU is exercised; CUDA stays GPU_UNVERIFIED. Its historical local regression count predates the generation-policy readiness fix and is not a current quality or all-green claim. See the generation-policy notice — fresh governed data and a verified protocol are required for quality claims. Public deployment is verified separately; publication adds no weights or quality result.
Represent a narrow skill
An inspectable Skill Packet — rules, glossaries, exemplars, structured instructions. Teacher weights are never copied.
Full discipline
The default L3 path creates capability/modality-specific packets. Extraction includes gap measurement, relevance filtering and safety tripwires. Cross-family transfer assumes no shared vocabulary.
Evaluate beyond extraction
Held-out A/B: baseline vs candidate, regression sweep, declared provenance. Verdict: PROMOTED, REJECTED, or PENDING_HUMAN only when approval metadata is the missing piece.
Full discipline
Held-out cases are separated from the extraction workflow — not guaranteed unseen in pretraining. High-risk medical/legal/finance domains require caller-supplied approval metadata; the approver name is not verified human review. A gate can only measure what its tests and policies cover.
Fit the deployment constraint
Optional removable-LoRA deep-apply, re-gated by an independent Gate 2. SiltSpring measures quantized-state loss. A separate path rebuilds smaller specialists from source weights.
Full discipline
Deep-apply trains LoRA only from Gate-1-approved packets; adapters stay removable, never merged into base weights. Training completion alone never admits an adapter. SiltSpring compares next-token loss on operator-provided suites against a resident reference — held-out-only filtering is not automatic, and loss thresholds do not prove whole-device fit. Construction complete (BUILT_UNCERTIFIED) is not quality passed. Native Windows, macOS/MPS, ROCm, multi-GPU and offload are unsupported; CUDA staging is not out-of-core execution.
How a capability is produced is separate from whether it is allowed in.
Skill Packet path
Teacher manifest → extract & distil → held-out evaluation → trust gate. Packets apply at inference; no learner weights change. Approved and rejected states stay physically separated.
Training backends
Standard, SiltStream (layer-streamed LoRA) and ZeroForge (zeroth-order, no backprop) deep-apply — each followed by an independent Gate 2. Adapters remain removable.
Specialist pipeline
Source-weight reconstruction → teacher-guided recovery → teacher-independent export. Engineering admission is never quality admission; frozen finals stay quarantined.
The full boundary text — every caveat, nothing hidden
Evidence controls have boundaries. Core safety checks are rule-based tripwires; provenance depends on trusted declarations and regression coverage on supplied suites. Hash-chained audit records, runner telemetry, local HMAC reports and retained traces are different evidence types — not external authentication. Mock fixtures demonstrate mechanics; recorded model runs support bounded results; neither establishes broader capability.
SiltSpring: int8/int4/int2 reports compare next-token loss on operator-provided suites against a resident reference; neither decoder-layer bytes nor loss thresholds prove whole-device fit or task quality. Real HF and toy Spring reject invalid/non-finite loss evidence. Streamer exit restores banked parameters and persistent buffers — not live LoRA or failed-entry states. Toy state-selection is not the real Studio report path.
Deep-apply + Gate 2: packet-derived LoRA training then a second benchmark; Gate 2 inherits source-packet safety scores and is not a comprehensive trained-output safety audit.
SiltStream: layer-streamed LoRA with disk-backed frozen decoder layers; sampled pre-training forward logits prove parity, not identical gradients or learned weights; full resident loading/parity is still required first.
ZeroForge: forward-only SPSA-style LoRA updates — zero backward passes still means multiple forward passes per update and real memory costs; not free compute or a GPU-independence advantage.
Asymmetric SPRT (evaluator API): stops sufficiently negative candidate evaluations early; never early-promotes; off by default; nominal error settings depend on test assumptions.
Compiler (experimental): native Switch pruning physically removes experts/router rows and exports weights; certification is a separate narrow seq2seq-text operation; pruning is not admission; repair-training unsupported; not an arbitrary-MoE compiler.
Reconstruction & recovery: Qwen2 MLP-channel slicing and Switch→dense-T5 are family-specific transformations requiring explicit local source weights and calibration; RECONSTRUCTED_UNVALIDATED establishes nothing about retained quality. Factor-preserving bundles need complete base + factors + tokenizer + matching SILT/PEFT runtime — not plain HF-root or GGUF loading. The recorded BF16 merge failed and was preserved, not relaxed.
Portable artifacts: dependency-inclusive Compose export and bounded import validate inventories and rebind paths; imports stay unadmitted until fresh local evaluation; relocation is not clean-machine certification. Legacy packet export produces unexecuted job recipes, not checkpoints.
Compose & speech bridges: typed linear chains of 1–16 local nodes (not arbitrary branching or latent fusion); Whisper/Vits/MMS are bounded CPU float32 paths; audio-output admission stays blocked — waveform/listening packets are pending-human, not intelligibility or MOS certificates. Matched SmolVLM/Idefics3 vision→text is an implemented bridge, not broad OCR certification. Model licensing constrains use.
Governance & observability: validation registries, consumed final reservations, external function-IO grading, generation/oracle traces and resource probes expose what ran and failed. Linux process_as limits virtual address space, not aggregate RSS; unsupported Windows/cgroup execution fails closed.
Full activation catalog: commands, dependencies, evidence and usable limits → · Hardware contract · Device-local runbook
Signed Capability Diff
LOCAL DIAGNOSTICdiff/diff-verify compare approved-set snapshots. Local HMAC = holder-key integrity, not external authorship.
Skill-layer Unlearning
LOCAL DIAGNOSTICChecks managed packet removal against the native baseline. Suite-limited evidence — not weight deletion.
Asymmetric SPRT
EVALUATOR APIEarly-stops sufficiently negative evaluations. Never early-promotes; off by default.
SiltStream
OPTIONALLayer-streamed LoRA with disk-backed frozen layers, resident parity first.
ZeroForge
OPTIONALForward-only, zeroth-order LoRA updates. Multiple forward passes; not free compute.
SiltSpring
OPTIONALint8/int4/int2 loss-vs-reference reports. Loss is not whole-device fit.
Structural compiler
EXPERIMENTALPhysically prunes Switch experts + router rows, exports weights. Pruning ≠ admission.
Reconstruction
EXPERIMENTALQwen2 MLP-channel slices; Switch→dense T5. Unvalidated until independently scored.
Recovery & export
EXPERIMENTALReal LoRA factors, teacher KL, teacher-independent bundles. Engineering ≠ quality.
Compose & bridges
EXPERIMENTALTyped 1–16 node chains; bounded Whisper/Vits + matched vision→text. Not broad cross-modal transplantation.
Governance
EXPERIMENTALRegistries, reservations, external grading, traces. Fails closed where unsupported.
Capability-build research
EXPERIMENTALTeacher footprinting, causal intervention, minimum-capability search. See research below.
Footprint a teacher's capability. Intervene causally. Search for the minimum.
A separate research CLI (silt-capability) asks one question under an operator-written spec: what is the minimum artifact that reproduces a narrow capability in a much smaller student — proven on untouched held-out tests, without regressing controls? Read the guide →
Teacher footprinting
Two never-mixed evidence classes: behavioural (per-run remote consent) or instrumented open weights via an isolated worker. A footprint names components associated with a capability — routing usage is never called causal importance.
Causal intervention
Temporarily mask one component, measure target vs control drops, restore, verify weights byte-identical. Unrestorable = never causal evidence. The loop is wired end-to-end in code, but no GLM intervention has been measured — the open-weight worker is hardware-blocked on small hosts and reports a typed BLOCKED_RESOURCE, honest, not a skip.
Teach, then reduce
Fresh five-split datasets with leakage guards; no measured gap → no distillation. Every candidate and failure recorded. A smaller parameter count is not evidence — only held-out scores count.
What the executed pilot showed — and did not
One judged pilot ran the full chain against an operator-selected cloud teacher: a frozen five-split case set (its final split was never generated — never traced, judged or used), 16 consented teacher traces, and the same host oracle grading teacher and a much smaller local student on identical checks — 0.8649 vs 0.4595 target-check pass rate, a measurement of that case set only, never a model-quality claim. The 6 judged training traces became KD pairs, which trained a real LoRA adapter through the production trainer; an independent oracle A/B then judged base vs adapter. An external audit of the committed record found a scoring defect — candidate-error cases silently vanished from the denominators, and the published "held-out improved" claim was false. The corrected accounting (authored denominators; unjudged checks count as failed) republishes a net negative result: held-out 0.8889→0.6667, aggregate target 0.8108→0.5405, retention 0.625 — recorded as the product, because with 6 training pairs this is mechanism-scale evidence and the honest numbers are the point. Nothing was admitted, activated or certified: production admission stays with the existing Deep-apply/Gate 2 path, and minimum-capability search remains unexecuted — its CLI refuses honestly rather than emit placeholders.
Extract a compiled capability from GLM-5.3-Flash — preregistered, gated, honest at every exit.
A second research CLI (silt-extract) runs a preregistered program: identify the computational structure a defined capability requires in a ~320B-parameter open-weight teacher, extract it into a standalone CompiledCapabilityModel, repair extraction damage, and prove retention on a sealed final split — H1: ≥90% retention AND ≥25% stored-parameter reduction, thresholds never weakened after results. Read the ledger →
Hypothesis before implementation
The hypothesis, decision rule and thresholds were committed before any program code. Judged traces only (verdict is a required bool); unjudged telemetry is storage, never evidence; joins across source revisions are rejected; the failed-attempt ledger is append-only and hash-chained.
Hardware honesty at the gate
The real-model stages (baseline/trace/intervene) pass the SAME admission arithmetic the worker preflight uses (~1.2 TiB host RAM for the BF16 source). On this 8 GB-class host they report a typed BLOCKED_RESOURCE — the honest output, never a fixture substitute.
Causal, not correlational
Routing frequency is never called importance. A component is marked causally REQUIRED only from verified mask-and-restore interventions whose effect exceeds the matched control arm — and the extraction plan retains exactly those experts plus the dense backbone, bound by hash to the pinned source.
What exists today — and what does not
The schemas (15), the CLI (18 commands, exit codes 0/2/3/4/5 tested against real subprocess status), the sealed-split and failed-attempt-ledger mechanics, the admission-gated stage scaffolds, the offline causal graph and plan builders, and a governed seed dataset (14 target families + 4 control families, 54 CC0 cases, selection lock frozen before any model run, final split deliberately not generated) are implemented and fixture-verified only. The seed dataset is honestly PARTIAL: its power analysis requires ~25 cases per family and it carries 2–3. No CompiledCapabilityModel has been built, extracted, evaluated or certified — the preregistered hypothesis remains untested by any real-model run, and the build/recover/certify stages refuse honestly as NOT_IMPLEMENTED until they are implemented.
Failures are part of the evidence.
Every recorded run below is a real verdict from a real gate — including the refusals. Decimal scores are the named evaluator metrics, not absolute quality. Bounded release report.
No aggregate gain over reconstruction or the smaller baseline — retention remains unfinished. Archived logs recorded sampling-default overrides in four derived arms, so the four lost tasks cannot be attributed solely to compression/training. The 2026-09-12 correction documents this in full. The final is consumed — never a tuning set.
NLLB-200 → Qwen2.5-0.5B · lexical metric
The candidate made the sample suite slightly worse. The gate refused.
NLLB-200 → Qwen2.5-0.5B · embedding metric
Same models and data, different verdict after a metric inconsistency was corrected. Iterative sample-data rerun — not an untouched final.
NLLB-200 → SmolLM2-360M
The cross-family learner could not use the glossary and damaged a Hindi control. The gate refused.
Medical triage rules · Qwen2.5-0.5B → SmolLM2-360M
Scores improved with a calibrated relevance floor; the otherwise-eligible medical candidate awaited caller-supplied approval metadata — not verified clinical review. Not efficacy evidence.
Real LoRA deep-apply · SmolLM2-135M CPU run
Three real CPU optimization steps produced a real adapter. Gate 2 rejected it: mechanism evidence, not an end-to-end quality win.
Smaller models, real recovery training
Qwen source reconstructed and trained 64 steps: ~494M → 417M unique stored parameters including LoRA factors. A Switch→dense-T5 path reached 224.5M from 619M in 32 steps.
Packaging, serving and verification boundaries
Factor-bundle serving needs the complete base, factors, tokenizer and matching SILT/PEFT runtime — not the teacher, and not plain HF-root or GGUF loading. The local generation fix requires Transformers 4.51.3 and non-prompt PEFT 0.15.2. Tiny and retained-Qwen nonfinal checks verify generation mechanics under both seeds, not quality. A subsequent readiness verification rebuilt the wheel/sdist and confirmed payload equality — packaging integrity, not new model-quality or CUDA evidence. Teacher-forced loss and strict reload probes sit outside the recorded default-merge defect. Construction and export evidence.
Qwen2.5-Coder-3B study preparation
The integrated wrapper binds recipes, dataset sidecars and exact blocked/rejected outcomes; terminal reports need a separate fsync acknowledgement. A config-only 3B proposal is not READY without local checkpoint/tokenizer/data evidence; final needs an explicit engineering-only waiver.
GLM-5.3-Flash teacher → 0.5B student, real LoRA + independent oracle
Frozen five-split case set (its final split was never generated — never traced, judged or used); teacher and a local 0.5B student judged by the same host oracle on identical checks. Six judged traces became KD pairs, trained a real adapter through the production trainer; the independent A/B REGRESSED the measured target capability under corrected authored-denominator scoring (an external audit found the original rates dropped candidate-error cases from the denominators — the published "held-out improved" claim was false and is withdrawn).
Full record · nothing admitted, activated or certified
Admission is a state transition, not a loose copy
Promotion carries snapshot/rollback metadata and pipeline audit events. Rollback restores the approved set. The local hash chain is tamper evidence, not tamper-proof external authentication.
Bigger KD set, bigger student, GPU — same honest answer
The expansion re-ran the chain with 22 KD pairs (16 newly authored cases, evaluation splits reused byte-identical) and a 3× larger student trained on GPU through the production trainer. The independent oracle A/B regressed every split, including untouched held-out cases.
Full record · recorded as a result, not a failure to hide
What SILT claims — and what it does not.
What exists in the repository
- ✓ Inspectable L3 Skill Packets and held-out A/B evaluation.
- ✓ All-or-nothing admission with regression suites, safety tripwires, provenance, rollback and audit.
- ✓ Mandatory approval metadata for declared high-risk domains (not verified human identity).
- ✓ Optional removable-LoRA deep-apply + independent Gate 2; SiltStream, ZeroForge, SiltSpring, opt-in SPRT.
- ✓ Local diagnostics: Capability Diff, skill-layer Unlearning.
- ✓ Experimental reconstruction/recovery/export, composition and media bridges, compiler, governance, portability.
- ✓ Studio, CLI, examples, tests and recorded real-run findings — including every rejection.
Full activation catalog — completed models remain uncertified.
What SILT does not claim
- ✗ Universal arbitrary capability copying between any two models.
- ✗ Complete transfer of a teacher's knowledge or internal weights.
- ✗ AGI or unrestricted autonomous self-improvement.
- ✗ Frontier-model reconstruction, arbitrary billion-parameter models on 4 GB, or universal GPU/Windows validation.
- ✗ A fabricated "percentage of knowledge transferred" — SILT reports measured deltas with their evidence class: gate verdicts where a gate has spoken, judged measurements with authored denominators, and honest refusals (net-negative, blocked, unmeasured) where it has not.
- ✗ A universal safety guarantee: a gate measures only what its tests and policies cover.
- ✗ Patent novelty for standard LoRA, or coverage of the reconstruction/recovery mechanisms by the existing provisional.
Use Studio locally. Choose where inference runs.
This page and public /studio/ are static setup pages — not a hosted engine. Start the local service, then open 127.0.0.1:8377. Privacy follows your endpoint choice: local orchestration does not make cloud-backed inference local.
- Install the required extras and compatible models.
- Choose local or remote model endpoints — explicitly, every time.
- Start Studio and open
127.0.0.1:8377. - Optional workbench: set
SILT_ENABLE_EXPERIMENTAL=1before startup, then open/experimental. Off by default; restart after changing an off-start.
"App available" is not verified model readiness. Experimental CLI commands are separately explicit and never use the Studio flag. Activation catalog and prerequisites →
Don't take the landing page at face value. Clone it, run it, test the gate, challenge the assumptions.
The repository carries the architecture, Studio, tests, recorded findings — including every rejected and blocked outcome. Start with the capability catalog so availability is never mistaken for evidence.