Curated model volume for Enclave confidential inference: Qwen3.6-27B at unsloth Dynamic Q4_K_XL (~18 GB), a single-file GGUF bundled with the official tokenizer.json so the volume is self-contained.

Upstream unsloth/Qwen3.6-27B-GGUF ships 21 quantizations plus vision mmproj-* files and an imatrix (~370 GB total) and no tokenizer.json. This volume carries ONLY the one served quant plus the tokenizer (same rationale as qwen3.5-9b-gguf / qwen3.5-122b-gguf): a multi-gguf volume makes the host's preload pick ambiguous, and wrapping the whole repo wastes ~350 GB of attested volume for files that never serve. The mmproj files are omitted deliberately: llm-chat's ggml path is text-only and preloads a single LLM gguf.

The tokenizer is byte-identical to the one in qwen3.5-9b-gguf and qwen3.5-122b-gguf: Qwen3.6 kept the Qwen3.5 family tokenizer (same sha256, same vocab 248320, <|im_end|> 248046 / <|endoftext|> 248044).

The GGUF declares general.architecture = qwen35 (the hybrid SSM + full attention layout, full_attention_interval 4), the same arch the fleet's pinned llama.cpp already serves for the Qwen3.5 volumes.

LICENSE is the Apache-2.0 text; both upstreams are Apache-2.0.

Wrapped as a Tinfoil Modelwrap volume (dm-verity; the root hash is part of the enclave measurement). Deployments attach it by name and the guest reads it at /models/<name>; the host preloads the GGUF as the wasi-nn ggml graph. As the volume's single gguf it needs no MODEL_VOLUMES third field and no model_file override, and with the tokenizer bundled, llm-chat's default tokenizer.json lookup works with no cross-volume configuration.