gpt2-small-weights 607a30d

GPT-2 small (124M-class) weights and tokenizer files, pinned to one Hugging Face revision. The registry stores the manifest, not the bytes.

✓ Signature verified (DEV key)

Checked against the dev trust set only: a DEV ONLY key, not a trust root. It proves the manifest was not altered since signing, not that the code is safe.

What is this?

The learned numbers of GPT-2 small, a 2019 text-prediction model, plus the files that split text into tokens. The registry does not keep these files (the main one is about 548 MB). It records exactly which published copy is meant and the fingerprint of every file, so a runner can refuse anything that is not byte-for-byte that copy.

Who uses it?

The M2 GPT-2 port and its oracle comparison (docs/ml-m2-gpt2.md).
A Phaistos or Cloud job that wants text generation, once the runner enforces the pins (M3).

What does it need?

No network at run time once downloaded (scripts/fetch-gpt2.sh fetches the pinned revision). About 1.1 GB of memory when loaded by today's host (documented, not measured here).

Facts

Kind: weights
Determinism: pure
Licence: MIT
Size: 548.1 MB (548105171 bytes)
Clay ability: unknown
Not an ability implementation: the Tensor ability's `load` operation reads these files by name; the tokenizer files are read by the host's Tokenizer handler.
Status: ok
Manifest id: 0a5bb6a24b825ed16931b5dd965eb853e1c0bc74aaecd8f4f0bd1db76db46845

Upstream pin

Project: https://huggingface.co/openai-community/gpt2
Version: unknown
Commit / revision: 607a30d783dfa663caf39e06633721c8d4cfcd7e
Licence: MIT

Pinned upstream files

Repository: openai-community/gpt2
Revision: 607a30d783dfa663caf39e06633721c8d4cfcd7e
Format: safetensors
Licence: MIT; redistribution: allowed Hub licence tag MIT (docs/ml-m0-scope.md); the repository's licence file and the training-data terms were not read. The registry does not host the bytes.
Stored here: no (the manifest points at the pinned revision)

File	Role	Size	SHA-256
model.safetensors	weights	548.1 MB	`248dfc3911869ec493c76e65bf2fcf7f615828b0254c12b473182f0f81d3a707`
config.json	config	665 bytes	`0daed7749b4f02b8f76240d5444551d7b08712dab4d0adb8239c56ba823bb7b4`
vocab.json tokenizer	vocab	1.0 MB	`196139668be63f3b5d6574427317ae82f612a97c5d1cdaf36ed2256dbf636783`
merges.txt tokenizer	vocab	456.3 KB	`1ce1664773c50f3e0cc8842619a93edc4624525b728b188a9e0be33b7726adc5`
tokenizer.json tokenizer	tokenizer	1.4 MB	`8414cab924d8b9b33013f0d221c5862f365ee9be39c5c2bfae8a5a9e970478a6`

Artifact

SHA-256: 248dfc3911869ec493c76e65bf2fcf7f615828b0254c12b473182f0f81d3a707
Format: file
Source path: .tools/models/gpt2/model.safetensors
Download: not stored here, by design. Fetch from the pinned revision and check the fingerprint: https://huggingface.co/openai-community/gpt2/resolve/607a30d783dfa663caf39e06633721c8d4cfcd7e/model.safetensors

Resources

Memory: unknown
CPU: unknown
Network: none

Provenance

Toolchain: scripts/fetch-gpt2.sh (curl)
Built by: seed script (dev)
Built at: 2026-11-11T06:12:18Z
Notes: builtAt is the local file time of model.safetensors. The artifact url follows the pattern scripts/fetch-gpt2.sh uses; it was not fetched again when this manifest was made. needs.memoryBytes is null: the M2 note (wishlist W32) says the host holds the whole file and peaks near 1.1 GB for GPT-2, but that was not measured for this entry.

scripts/fetch-gpt2.sh downloads each file from the pinned revision into .tools/models/gpt2 and refuses any sha256 that differs from packages/tensor-host/models/gpt2.json.
This manifest was built from those local files; the sha256 values equal models/gpt2.json.

Signatures (checked when this page was built)

c5878029baeb4574 DEV ONLY signing key (not a trust root) DEV ONLY: valid (ok)

How a runner loads it

Fetch /v1/manifests/0a5bb6a24b825ed16931b5dd965eb853e1c0bc74aaecd8f4f0bd1db76db46845.json, get the artifact bytes by hash (and the other pinned files), then call checkLoadable(manifest, bytes, policy, companionFiles). It checks the signature against the trusted keys, the revocation list, the fingerprints and sizes, and the policy's allowed kinds and determinism classes, and returns a reason when it refuses.