FallForge Mint — the sovereign-node minting pipeline

Layer 2 of the sovereign-node factory. A limb model writes a specialization; this kernel assembles it deterministically into an owned model artifact; fallforge-gate then measures the minted node against its own raw base on a held-out eval. A node is MINTED only on a certified BEATS receipt — the pipeline cannot declare success, it can only measure it. The whole mint is sealed into an Ed25519-signed manifest.

The shipped mint — manifest, signature and receipts re-verified in your browser

loading manifest…

How a node is minted

The limb writes the spec. A bigger model reads the TRAIN examples (never the eval) and distils a system prompt + few-shot exemplars. Frontier or local — the limb is a tool the pipeline calls, not the product.
The kernel assembles the Modelfile. Deterministic, byte-pinned, bounded (system ≤ 4000 chars, ≤ 8 exemplars, fences refused). Same spec, same bytes, every time.
The node is minted. ollama create bakes the spec into a named model artifact you own, run privately, and can copy anywhere.
The gate measures it. The minted node vs its RAW BASE on the held-out eval — deterministic scorers, real latencies. Not a certified BEATS? The limb sees its misses and refines — at most 5 rounds, best round kept.
The manifest seals it. Node, base, limb, rounds, train hash, Modelfile hash, receipt hashes — canonically hashed and Ed25519-signed. Tamper anywhere and this page shows it.

Reproduce it

git clone https://github.com/sjgant80-hub/fallforge-mint && cd fallforge-mint
node --test kernel.test.mjs
node mint.mjs --node triage-1b --base llama3.2:1b --limb qwen2.5:14b \
  --train datasets/support-triage-train.json --eval datasets/support-triage-eval.json \
  --rounds 3 --also qwen2.5:7b

Needs a local Ollama. Your numbers will differ (your machine, your latencies) — that is the point: run it, don't trust it.

Honest limits (v1)

v1 mints prompt-tuned nodes — the specialization lives at the Modelfile level (system + exemplars + params), not in the weights. Weight-level LoRA is v2 and lands in these same gate/sign/export stages unchanged. We say "prompt-tuned" on every surface because that is what it is.
The signature proves the issuer's key, not their identity. Ed25519 over the kernel-pinned payload; the private key never leaves the issuer's machine. Key-to-identity binding is a later layer.
Receipts are scoped to their probe set — "measurably better on THIS eval", never "better in general". Train and eval are disjoint; the train hash is inside the signed manifest.
A refused mint ships too. If no round produces a certified BEATS, the manifest records NOT MINTED with the best round's honest numbers. The pipeline has no way to lie about this — the verdict comes from the gate, not from the pipeline.