Curated model volume for Enclave confidential inference: Qwen3.5-9B at unsloth Dynamic Q4_K_XL (~6 GB), a single-file GGUF bundled with the official tokenizer.json so the volume is self-contained.

Upstream unsloth/Qwen3.5-9B-GGUF ships 22 quantizations plus a BF16 export and vision mmproj-* files (~160 GB total) and no tokenizer.json. This volume carries ONLY the one served quant plus the tokenizer (same rationale as qwen2.5-0.5b-gguf / qwen3.5-122b-gguf): a multi-gguf volume makes the host's preload pick ambiguous, and wrapping the whole repo wastes ~154 GB of attested volume for files that never serve. The mmproj files are omitted deliberately — llm-chat's ggml path is text-only and preloads a single LLM gguf.

The tokenizer is byte-identical to the one in qwen3.5-122b-gguf (the Qwen3.5 family shares it — same sha256, same vocab 248320, <|im_end|> 248046 / <|endoftext|> 248044).

LICENSE is the Apache-2.0 text; both upstreams are Apache-2.0.

Wrapped as a Tinfoil Modelwrap volume (dm-verity; the root hash is part of the enclave measurement). Deployments attach it by name and the guest reads it at /models/<name>; the host preloads the GGUF as the wasi-nn ggml graph. As the volume's single gguf it needs no MODEL_VOLUMES third field and no model_file override, and with the tokenizer bundled, llm-chat's default tokenizer.json lookup works with no cross-volume configuration.