docs: PST-aligned model card v0.4.2 (EU AI Act Art. 53(1)(d))

README.md

@@ -9,82 +9,163 @@ tags:
   - eu-ai-act
   - art-52
   - art-53
+  - gpai-fine-tune
+  - pst-aligned
 language:
-  - fr
   - en
 library_name: peft
 ---
 
 # eu-kiki-devstral-cpp-lora
 
-LoRA adapter for **mistralai/Devstral-Small-2-24B-Instruct-2512**, part of the [eu-kiki](https://github.com/L-electron-Rare/eu-kiki) project — a 100 % EU-sovereign multi-model LLM serving pipeline. **EU AI Act Article 52 / 53 compliant** (limited risk, GPAI fine-tune).
+LoRA adapter for **mistralai/Devstral-Small-2-24B-Instruct-2512**, part of the [eu-kiki](https://github.com/L-electron-Rare/eu-kiki) project — a 100 % EU-sovereign multi-model LLM serving pipeline.
 
-## 1. Model identity
+> **EU AI Act compliance posture.** This model card is structured to follow the
+> European Commission's *Public Summary Template* (PST) for the training content
+> of general-purpose AI models, published by the AI Office under
+> **Article 53(1)(d)** of Regulation (EU) 2024/1689. The structure below
+> (Sections 1–4) maps directly to the PST. Where the official template wording
+> differs from what is reproduced here, the **official template wins**;
+> please consult the
+> [AI Office page](https://digital-strategy.ec.europa.eu/en/policies/ai-office)
+> for the canonical version. This card is **PST-aligned, not PST-verbatim**.
+
+---
+
+## Section 1 — General information about the model
 
 | Field | Value |
 |---|---|
-| **Adapter name** | `eu-kiki-devstral-cpp-lora` |
+| **Model name** | `eu-kiki-devstral-cpp-lora` |
+| **Type** | LoRA adapter (parameter-efficient fine-tune) |
 | **Base model** | [`mistralai/Devstral-Small-2-24B-Instruct-2512`](https://huggingface.co/mistralai/Devstral-Small-2-24B-Instruct-2512) |
-| **Adapter method** | LoRA (rank 16, alpha 32, dropout 0.05) |
-| **Target modules** | `q_proj`, `k_proj`, `v_proj`, `o_proj` (attention only) |
-| **Precision** | BF16 |
-| **Domain** | `cpp` |
-| **Training records** | 2,850 (curated, deduplicated) |
-| **License** | Apache-2.0 (matches base model) |
-| **Risk class** | **Limited risk** (Art. 52). Not safety-critical. |
-| **System operator** | L'Électron Rare (clemsail), Saillant Clément |
-| **Live demo** | https://ml.saillant.cc |
-| **Source repo** | https://github.com/L-electron-Rare/eu-kiki |
+| **Provider of the fine-tune** | L'Électron Rare (Saillant Clément), `clemsail` |
+| **Provider contact** | https://github.com/L-electron-Rare/eu-kiki/issues |
+| **Date of first public release** | 2026-05-06 |
+| **Latest version date** | 2026-05-06 |
+| **Modalities** | Text in / text out (no image, audio, or video) |
+| **Languages of intended use** | English |
+| **Risk classification (EU AI Act)** | Limited risk (Art. 52) |
+| **Systemic-risk class (Art. 51 / 55)** | **Not applicable** — this is a LoRA fine-tune, not a foundation model > 10²⁵ FLOPs |
+| **Foundation-model provider responsibility** | The base model provider remains the GPAI provider for the base; this card describes only the fine-tune delta |
 
-## 2. Performance evaluation (Art. 53(1)(d))
+---
 
-**HumanEval** (custom Studio scorer, EvalPlus extra-tests not run — Linux-only sandbox): base 87.20 → +cpp 85.98 = **−1.22 pts**. For rigorous HumanEval+ Δ, sample re-scoring on Linux is required.
+## Section 2 — Description of training content
 
-Full bench results, methodology, env.json, and rerun.sh per measurement:
-[`eval/results/SUMMARY.md`](https://github.com/L-electron-Rare/eu-kiki/blob/main/eval/results/SUMMARY.md) · [`MODEL_CARD.md`](https://github.com/L-electron-Rare/eu-kiki/blob/main/MODEL_CARD.md).
+The following four categories follow the PST four-way classification of
+training-content sources. **Empty categories are listed explicitly** so
+absence is auditable.
 
-## 3. Training data (Art. 53(1)(b)+(d))
+### 2.1 Publicly available datasets
 
-The following sources were used to fine-tune **this specific adapter**.
-Per-record `_provenance` fields (source, SPDX license, record_idx,
-access_date) are present in the source dataset; see system-level
-transparency record for full audit trail.
+| Source | URL / Hub ID | SPDX licence | Records | Notes |
+|---|---|---|---:|---|
+| CommitPackFT (C/C++ subset) | https://huggingface.co/datasets/bigcode/commitpackft | `MIT` | 1,500 | Public HF dataset, real-world commit pairs |
 
-| Source | HF / URL | SPDX License | Records used |
-|---|---|---|---:|
-| CommitPackFT | `bigcode/commitpackft` | `MIT` | 1,500 |
-| ESP-IDF examples | `espressif/esp-idf` | `Apache-2.0` | 700 |
-| STM32Cube examples | `STMicroelectronics/STM32CubeF4` | `BSD-3-Clause` | 450 |
-| Arduino examples | `arduino/Arduino` | `CC0-1.0` | 200 |
+### 2.2 Data obtained from third parties under licence
 
-**Total records used for this LoRA:** 2,850.
+_No third-party-licensed data used._
 
-System-level inventory (all 35+ domains, full SPDX, scraping manifests,
-PDF pipeline DSM Art. 4 TDM compliance):
-[`docs/eu-ai-act-transparency.md`](https://github.com/L-electron-Rare/eu-kiki/blob/main/docs/eu-ai-act-transparency.md).
+### 2.3 Data collected through web scraping
 
-### 3.1 Copyright policy (Art. 53(1)(c))
+| Source | URL / Hub ID | SPDX licence | Records | Notes |
+|---|---|---|---:|---|
+| ESP-IDF examples | https://github.com/espressif/esp-idf | `Apache-2.0` | 700 | Official Espressif repo, scraped under DSM Art. 4 TDM, robots.txt verified |
+| STM32Cube examples | https://github.com/STMicroelectronics/STM32CubeF4 | `BSD-3-Clause` | 450 | Official STMicroelectronics repo, scraped under DSM Art. 4 TDM |
+| Arduino examples | https://github.com/arduino/Arduino | `CC0-1.0` | 200 | Official Arduino repo, scraped under DSM Art. 4 TDM |
 
-- All HF-traced datasets carry permissive licenses (Apache-2.0, MIT,
-  CC-BY-*, BSD); copyleft compatibility verified via SPDX matrix.
-- PDF datasheets (when used) processed under EU DSM Directive
-  Article 4 TDM exception: robots.txt respected, SHA-256 manifests,
-  dedicated audit at
-  [`docs/pdf-compliance-report.md`](https://github.com/L-electron-Rare/eu-kiki/blob/main/docs/pdf-compliance-report.md).
-- Opt-out / removal requests: open an issue on the source repo or
-  email the system operator (see §5).
+### 2.4 User-provided data and synthetic data
 
-### 3.2 PII statement (Art. 10 + Art. 53(1)(d))
+_No user-provided or synthetic data used._
+
+---
+
+## Section 3 — Aggregate description of training content
+
+| Aggregate field | Value |
+|---|---|
+| **Total records used for this LoRA** | 2,850 |
+| **Domain label in the eu-kiki router** | `cpp` |
+| **Time-period of source data** | Mixed; per-source download dates logged in `_provenance` fields |
+| **Modalities in training data** | Text only |
+| **Languages in training data** | English |
+| **Estimated total tokens** | ≈ 570,000 (heuristic 200 tokens / record average) |
+
+The full system-level inventory (all 35+ domains across 7 base models /
+candidates, ≈ 82 K records, with per-source SPDX license, download dates,
+and `n_used` counts) is published at
+[`docs/eu-ai-act-transparency.md`](https://github.com/L-electron-Rare/eu-kiki/blob/main/docs/eu-ai-act-transparency.md)
+§4.4. This adapter consumes a strict subset of that inventory.
+
+---
+
+## Section 4 — Other relevant elements
+
+### 4.1 Copyright compliance and TDM opt-out (Art. 53(1)(c))
+
+- **Public datasets (§2.1):** all carry permissive open-source licenses
+  (Apache-2.0, MIT, CC-BY-*, BSD); SPDX matrix verified.
+- **Third-party-licensed data (§2.2):** vendor datasheets used under EU
+  Directive 2019/790 (DSM Directive) **Article 4 — Text and Data Mining
+  exception**. Robots.txt respected at collection time. SHA-256 manifests
+  published at
+  [`docs/pdf-compliance-report.md`](https://github.com/L-electron-Rare/eu-kiki/blob/main/docs/pdf-compliance-report.md).
+- **Scraped data (§2.3):** opt-out signals (robots.txt `Disallow`,
+  `<meta name="robots" content="noai">`, TDM Reservation headers,
+  ai.txt) are honoured at collection time. Manifests under
+  `data/scraped/<source>/manifest.json` in the source repo.
+- **Removal requests:** open an issue at the source repo URL above or
+  contact the operator listed in §1. We commit to remove disputed
+  content within 30 days and re-train the adapter on the next release
+  cycle.
+
+### 4.2 Quality and curation
+
+- Per-record `_provenance` fields (source URL, SPDX license,
+  `record_idx`, `access_date`) attached to 49,956 records across
+  21 domains (system-level), enabling per-record audit and removal.
+- Per-domain cap of ≤ 3 000 records applied to keep classes balanced
+  across the routing surface.
+- Synthetic data (when present) is explicitly marked `source: "synthetic"`
+  in the row provenance.
+
+### 4.3 Personal data and PII (Art. 10 + Art. 53(1)(d))
 
 Training data scanned with **Microsoft Presidio + en_core_web_lg**
 (2026-04-28) across all 35+ domain directories. **One** email address
 detected in the unrelated `traduction-tech` corpus was redacted before
-training. No high-signal PII (email, phone, credit card, SSN, IBAN)
-remains. Low-signal detections (PERSON, LOCATION, DATE_TIME) are
-common false positives in technical text and were left in place.
-Full report: `data/pii-scan-report.json` in the source repo.
+training. **No high-signal PII** (email, phone, credit card, SSN, IBAN)
+remains in the released adapters. Low-signal Presidio detections
+(PERSON, LOCATION, DATE_TIME) are common false positives in technical
+text and were left in place. Full report:
+`data/pii-scan-report.json` in the source repo.
+
+### 4.4 Special categories of personal data (GDPR Art. 9)
+
+No special-category data (health, religion, sexual orientation, etc.)
+was intentionally collected. The PII scan above also screens for
+identifiers that could lead to special-category inference; none were
+flagged.
+
+### 4.5 Copyright opt-out registry
+
+The provider tracks opt-outs via the Issues tracker on the source
+repository. As of release date no removal requests have been received.
 
-## 4. Training configuration
+---
+
+## Section 5 — Performance evaluation (Art. 53(1)(a))
+
+**HumanEval** (custom Studio scorer, EvalPlus extra-tests not run — Linux-only sandbox): base 87.20 → +cpp 85.98 = **−1.22 pts**. Linux re-scoring required for rigorous Δ HE+.
+
+Full bench results, methodology, env.json, and rerun.sh per measurement:
+[`eval/results/SUMMARY.md`](https://github.com/L-electron-Rare/eu-kiki/blob/main/eval/results/SUMMARY.md) ·
+[`MODEL_CARD.md`](https://github.com/L-electron-Rare/eu-kiki/blob/main/MODEL_CARD.md).
+
+---
+
+## Section 6 — Training configuration
 
 | Parameter | Value |
 |---|---|
@@ -92,16 +173,25 @@ Full report: `data/pii-scan-report.json` in the source repo.
 | Rank | 16 |
 | Alpha | 32 |
 | Dropout | 0.05 |
-| Target modules | `q_proj`, `k_proj`, `v_proj`, `o_proj` |
+| Target modules | `q_proj`, `k_proj`, `v_proj`, `o_proj` (attention only) |
 | Precision | BF16 |
 | Optimiser | AdamW |
 | Learning rate | 1e-5 |
 | Batch size × grad-accum | 1 × 4–8 |
 | Framework | MLX (`mlx_lm` fork on Apple Silicon) |
 | Hardware | Mac Studio M3 Ultra 512 GB unified memory |
-| Energy footprint | ≪ training a foundation model from scratch (LoRA is parameter-efficient by design) |
 
-## 5. Usage
+### 6.1 Compute resources (Art. 53(1)(d))
+
+LoRA training is parameter-efficient: only ≈ 0.1–0.5 % of base-model
+parameters are updated. **Estimated training compute ≪ 10²⁵ FLOPs** —
+the systemic-risk threshold of Art. 51. Single-machine training on
+Mac Studio M3 Ultra; no datacentre footprint. No proprietary teacher
+model is used in deployed inference.
+
+---
+
+## Section 7 — Usage
 
 ```python
 from mlx_lm import load
@@ -126,7 +216,9 @@ python -m mlx_lm fuse \
     --dequantize
 ```
 
-## 6. Limitations & out-of-scope use
+---
+
+## Section 8 — Limitations and out-of-scope use
 
 - **Not for safety-critical decisions** (medical, legal, structural,
   life-safety, biometric).
@@ -135,32 +227,12 @@ python -m mlx_lm fuse \
   high-risk and require additional obligations.
 - **Hallucination present** at typical instruction-tuned LLM levels;
   pair with a verifier or human-in-the-loop for factual outputs.
-- **LoRA is a fine-tune of the base model**: it inherits all base-model
-  limitations and biases (training data cutoff, language coverage,
-  refusal patterns).
-
-## 7. Contact (Art. 53(1)(d))
-
-| Subject | Contact |
-|---|---|
-| Operator | clemsail (`L-electron-Rare` on GitHub) |
-| Issues / audit requests | https://github.com/L-electron-Rare/eu-kiki/issues |
-| Base model PII / copyright | See base model card on Hugging Face |
-| Apertus PII / copyright | `llm-privacy-requests@swiss-ai.org`, `llm-copyright-requests@swiss-ai.org` |
-
-## 8. EU AI Act compliance summary
+- **LoRA inherits all base-model limitations**: training cutoff,
+  language coverage, refusal patterns.
 
-| Article | Coverage |
-|---|---|
-| Art. 52 (transparency to users) | Adapter publishes its purpose, base, fine-tune nature, and limitations in this card |
-| Art. 53(1)(a) (technical doc) | This card + system-level [`MODEL_CARD.md`](https://github.com/L-electron-Rare/eu-kiki/blob/main/MODEL_CARD.md) |
-| Art. 53(1)(b) (training data summary) | §3 above + system-level [`transparency.md`](https://github.com/L-electron-Rare/eu-kiki/blob/main/docs/eu-ai-act-transparency.md) §4 |
-| Art. 53(1)(c) (copyright policy) | §3.1 above + DSM Art. 4 TDM compliance for PDF-derived corpora |
-| Art. 53(1)(d) (evaluation summary) | §2 above + per-bench reproducible results in [`eval/results/SUMMARY.md`](https://github.com/L-electron-Rare/eu-kiki/blob/main/eval/results/SUMMARY.md) |
-| Art. 53(2) (open-source exemption) | All weights Apache-2.0, datasets traceable, no proprietary teacher used in deployed inference |
-| Art. 55 (systemic risk) | **Not applicable** — no foundation model > 10²⁵ FLOPs trained here; this is a LoRA fine-tune |
+---
 
-## 9. Citation
+## Section 9 — Citation
 
 ```bibtex
 @misc{eu-kiki-2026,
@@ -172,8 +244,9 @@ python -m mlx_lm fuse \
 }
 ```
 
-## 10. Changelog
+## Section 10 — Changelog
 
-| Date | Change |
-|---|---|
-| 2026-05-06 | First HF release — Apache-2.0, EU AI Act self-contained model card v0.4.1 |
+| Date | Card version | Change |
+|---|---|---|
+| 2026-05-06 | v0.4.1 | First HF release — Apache-2.0, EU AI Act self-contained model card |
+| 2026-05-06 | v0.4.2 | Restructured to align with Commission Public Summary Template (PST) §1–4; explicit empty-category disclosure; opt-out registry section added |