This is the instruction-tuned form of a 5.04B-parameter GLM-5.2 Fruit serving proxy trained for conversational instruction following; it is not the 754B GLM-5.2 model. It is encoded in QSRT's canonical QSRT atom format and served without reconstructing dense expert weights.

The artifact packages the codec, storage, and runtime integration for the instruction-tuned Fruit checkpoint. Its sealed qualification reports matched live-runtime generation, decode rate, memory, and full-vocabulary fidelity against BF16 on the pinned single-GPU serving path below.

What is included

13 transformer layers: 3 dense and 10 MoE layers, plus the packaged MTP expert layer.
Hidden size 1,024; MoE intermediate size 512; 256 routed experts per MoE/MTP layer.
2,816 QSRT experts in 11 canonical atom files.
SQG-XOR-Cheb-T12 E4M3 codebook, three-bit trellis payload, fixed P24/P33 pair records, and physical atom rotation.
Canonical qsrt_atoms_v1 storage with complete per-file SHA-256 manifests and a fail-closed QSRT_COMPLETE.json marker.
W4A16 prefill/reference execution and W4A8 decode execution through B12X.

The expert allocation selected by the frozen calibration evidence is recorded in each qsrt-layer-*.json sidecar. Aggregate allocation counts are:

Allocation code	Experts
`R13=0,R2=0`	2,794
`R13=0,R2=1`	1
`R13=1,R2=0`	13
`R13=1,R2=1`	7
`R13=2,R2=2`	1

Size and memory

The apples-to-apples baseline is the complete BF16 tensor set. All three rows below cover the same 5,040,368,896 logical parameters and count only Safetensors files; effective bpw is stored bytes times eight divided by that parameter count, so it includes container and quantization metadata.

Tensor payload	Bytes	GiB	Effective bpw	Relative to BF16
BF16 source	10,081,800,232	9.3894	16.0017	baseline
Prior SIQ mixed	3,102,116,152	2.8891	4.9236	69.23% smaller
This QSRT model	2,909,352,104	2.7095	4.6177	71.14% smaller

The whole-model rates include 611,183,872 non-routed parameters retained in BF16. Isolating the 4,429,185,024 routed-expert weights gives:

Routed-expert format	Stored bytes	Nominal path bpw	Effective stored bpw
BF16	8,858,370,048	16.0000	16.0000
Prior SIQ mixed (1,856 K3 / 960 K4 experts)	1,879,717,272	3.3409	3.3951
QSRT P24/P33 atoms	1,686,953,224	3.0000	3.0470

QSRT is therefore 10.25% smaller than SIQ on the routed-expert component and 6.21% smaller on the compared tensor files. Package-level totals are not used for the comparison because tokenizer, card, and evaluation evidence files are not model weights. The previous card's 7,593,020,594-byte BF16 row was not the complete BF16 tensor set and has been removed.

W4A8 and W4A16 use the same stored weights, so their loader weight storage is identical; W4A8 changes the decode execution path, not the checkpoint size.

Hugging Face repository-size audit

The Hugging Face model API with blobs=true reported the following immutable snapshot on 2026-08-08. Repository bytes sums every sibling's reported size; Safetensors bytes sums only *.safetensors. These are observed repository payloads, not parameter-count estimates.

Artifact	Revision	Repository bytes	Safetensors bytes
Fruit Instruct BF16	`678954f6`	10,102,017,674	10,081,800,232
Fruit Instruct prior mixed SIQ	`48452ef3`	3,122,333,594	3,102,116,152
Full GLM-5.2 BF16	`b4734de4`	1,506,693,036,946	1,506,667,387,408
Full GLM-5.2 FP8	`ba978f7d`	755,663,676,164	755,632,050,320
Full GLM-5.2 NVFP4	`aec724e8`	464,874,323,992	464,823,042,096

The three full-model rows ground real download/storage scale only. They are not used for Fruit percentage claims because Fruit has 5.04B parameters while the production model has roughly 754B. The apples-to-apples Fruit tensor comparison above remains the codec-size result.

Adjacent-rate evidence

evaluation/fruit-uniform-rate-sweep.json re-encodes the same authenticated expert sample at uniform K2, K3, and K4, with fresh per-endpoint FP16 scales. It measured 16 of 19 predeclared assignments; 3 lacked the minimum routed calibration support and were skipped rather than imputed. These are pre-layer-deduplication expert-local endpoints, not package sizes.

Endpoint	Mean bpw	Mean bytes/expert	Weight NMSE	Captured-H NMSE	Validation routed NMSE
K2	2.0469	402,432	0.082114	0.023574	0.054806
K3	3.0469	599,040	0.020809	0.005843	0.012805
K4	4.0469	795,648	0.005343	0.001492	0.003267

Relative to K3, K2 is 3.946x / 4.035x / 4.280x on weight, captured-H, and validation-routed NMSE. K4 is 0.257x / 0.255x / 0.255x on the same metrics.

Runtime and quality qualification

The sealed receipt evaluation/fruit-runtime-qualification.json records the exact BF16 reference, legacy SIQ comparator, and QSRT model identities, candidate tensors, producer, GPU and driver, per-arm immutable runtime images, exact launch argv, environment and software revisions, parsed loader memory fields, decode runs, generation outputs, and full-vocabulary fidelity rows. Under its fixed hardware, prompt tokens, generation settings, recorded launch order, TP1, and max_num_seqs=1, 3-repetition same-prompt protocol:

Arm	Median client-observed end-to-end generated-token rate (tokens/s)	Rate / BF16	Loader weight GiB	Backend / CUDA graph mode
BF16	445.04	1.000x	9.730	`inductor` / `FULL_AND_PIECEWISE`
SIQ	428.63	0.963x	3.240	`inductor` / `FULL_AND_PIECEWISE`
QSRT	425.67	0.956x	3.100	`inductor` / `FULL_AND_PIECEWISE`

All three arms use the same immutable image, software stack, non-eager compilation backend, CUDA-graph mode, and fixed launcher contract; only the model identity, served name, port, and model-specific quantization/load options differ. The QSRT runtime-path record separately proves W4A16 prompt/prefill and W4A8 decode graph capture and replay for the MTP layer. The rates include request and serving overhead, so they are not decode-only kernel rates or a general throughput benchmark.

Candidate relative to BF16	Mean forward KL	Max forward KL	Top-1 agreement	Top-10 agreement
SIQ	0.0551245	3.22484	90.05%	99.88%
QSRT	0.0528832	1.2783	90.24%	99.78%

The raw generation section covers 8 matched targeted prompts across BF16, SIQ, and QSRT. This focused live-runtime suite complements the full-vocabulary fidelity measurement; it is not a standardized leaderboard benchmark.

Evidence boundary

The completion seal covers every top-level package file and every regular file under evaluation/. The sealed adjacent-rate report measures local routed expert reconstruction on authenticated, document-disjoint calibration rows. The runtime receipt establishes matched live loading, generation, targeted assistant behavior, full-vocabulary fidelity, and observed decode rate under the pinned conditions. These artifacts do not replace workload-specific or standardized benchmark evaluation.

Reproducible runtime

The runtime is pinned to the reviewed commits below:

QSRT encoder: local-inference-lab/qsrt#4, encoded with QSRT revision 2113af303f37cedf4b538dcf68eb699d5e31f7df.
B12X kernels: local-inference-lab/b12x#129, packaged producer revision f4064d06f029240040a128388f32c861a535ad68.
vLLM loader: local-inference-lab/vllm#269, packaged producer revision 0429cb4c11ad7a67ec8b40b621eae061a363b6cb.

The derived image starts from the content-addressed public base docker.io/voipmonitor/vllm@sha256:3230c25ff95f8678a8eeb52a463f0d3b9f96f6ad550418cc51ea12177a55b41c hard-coded by Dockerfile.fruit-qsrt. It installs the exact B12X checkout, copies the base's compiled vLLM extensions into the reviewed source tree, and seals the exact runtime package bytes. MODEL_REVISION resolves the Hub branch once; hf download then uses the resulting immutable commit SHA.

bash

git clone https://github.com/malaiwah/vllm-voipmonitor.git vllm-fruit
git -C vllm-fruit checkout --detach 0429cb4c11ad7a67ec8b40b621eae061a363b6cb

docker build \
  --file vllm-fruit/Dockerfile.fruit-qsrt \
  --build-arg VLLM_REVISION=0429cb4c11ad7a67ec8b40b621eae061a363b6cb \
  --build-arg B12X_REVISION=f4064d06f029240040a128388f32c861a535ad68 \
  --tag fruit-qsrt:0429cb4c11ad7a67ec8b40b621eae061a363b6cb \
  vllm-fruit

# This digest is an operator-supplied trust root obtained independently of the
# package being authenticated. Never derive it from MODEL_DIR.
test -n "${FRUIT_QSRT_EXPECTED_COMPLETE_SHA256:?set an independently supplied completion digest}"
test "${#FRUIT_QSRT_EXPECTED_COMPLETE_SHA256}" -eq 64

MODEL_REVISION="$(
  curl -fsSL https://huggingface.co/api/models/malaiwah/GLM-5.2-QSRT-Fruit-Instruct \
    | python3 -c 'import json,sys; print(json.load(sys.stdin)["sha"])'
)"
MODEL_DIR="Fruit-QSRT-${MODEL_REVISION}"
test ! -e "${MODEL_DIR}"
hf download malaiwah/GLM-5.2-QSRT-Fruit-Instruct \
  --revision "${MODEL_REVISION}" \
  --local-dir "${MODEL_DIR}"

docker run --rm --gpus '"device=0"' --shm-size=16g \
  --read-only \
  --tmpfs /tmp:rw,exec,nosuid,size=8g \
  --tmpfs /cache:rw,exec,nosuid,size=16g \
  --tmpfs /root/.cache:rw,nosuid,size=1g \
  --publish 8000:8000 \
  --volume "$PWD/${MODEL_DIR}:/model:ro" \
  --env MODEL=/model \
  --env FRUIT_QSRT_EXPECTED_COMPLETE_SHA256="${FRUIT_QSRT_EXPECTED_COMPLETE_SHA256}" \
  fruit-qsrt:0429cb4c11ad7a67ec8b40b621eae061a363b6cb

The container configuration targets SM120 with CUDA 13.2.1 and PyTorch 2.12.0+cu132 in the content-addressed base, plus nvidia-cutlass-dsl == 4.6.0 in the derived image. The launcher rejects extra vLLM arguments and any value other than TP1, max_num_seqs=1, max_model_len=4096, and max_num_batched_tokens=4096 before importing the GPU runtime. The current B12X sparse-prefill backend requires single-request prefill chunks.

The runtime manifest is an integrity check rooted in the trusted immutable image, not an independent signature. The build host and container operator remain trusted. Run the container read-only, keep writable tmpfs mounts outside /opt/vllm-fruit, /opt/b12x-fruit, and /opt/fruit-runtime, and mount the authenticated model read-only as shown above.

W4A16 is used for prefill and any row count above the W4A8 decode ceiling. W4A8 is selected for decode-sized batches of at most 16 rows. Unsupported shapes, activation modes, metadata, or incomplete manifests fail closed.

Provenance and integrity

Authenticated BF16 source: malaiwah/GLM-5.2-SIQ-Fruit-Instruct-bf16 at immutable revision 678954f65e056a0f508e21eeb9251c655bb9463f.
Authenticated source manifest (safetensors_manifest) SHA-256: 8f23aed5e9b12000ed103a76da772a20730ca53ab7e352d6cb94da2709165245.
Calibration capture ID: ddf1b740a6b0a12f0bc447a22467e64b19213ba793d2d4651e0bcb6c27e56d7b.
Calibration manifest SHA-256: 19448bc37e46cbd4a545b8f9e7b77713180f7854fc096ec663409d364a07e1ce.
The encoder authenticated 256 documents / 46,223 tokens from disjoint fit, confirmation, and validation splits.
Full encoding: 2,816 experts, 1,390.66 GPU-seconds, 2.550 GiB peak CUDA allocation.
MANIFEST.sha256, qsrt-manifest.json, .qsrt-source-evidence.json, qsrt-calibration-evidence.json, evaluation/fruit-runtime-qualification.json, and QSRT_COMPLETE.json bind the published package to the source, producer, and evaluation receipts.

Known limitations

Compact proxy, not the 754B teacher. Capability, knowledge, and long-tail behavior can differ from the full GLM-5.2 model; evaluate it on your workload.
No absolute assistant-quality claim. In the sealed eight-probe suite, BF16, SIQ, and QSRT each passed 0/8 behavior contracts: code, reasoning, instruction following, debugging, structured output, SQL, security, and needle recall. The publication gates establish relative QSRT fidelity, not general assistant capability.
The packaged launcher permits TP1. TP2 atom ownership is unit-tested, but no package-specific TP2 serving benchmark is claimed.
The current sparse-attention prefill backend requires max_num_seqs=1.
The included evidence is a targeted live-runtime qualification rather than a broad standardized downstream benchmark suite.

License

The packaged model files are MIT, matching the authenticated Fruit BF16 source license. B12X and vLLM are Apache-2.0. QSRT is not redistributed in this model repository and remains subject to its upstream repository licensing.