docs: PST-verbatim model card v0.4.3 (Commission template 2025-07-24)

README.md

@@ -10,7 +10,7 @@ tags:
   - art-52
   - art-53
   - gpai-fine-tune
-  - pst-aligned
+  - pst-2025-07-24
 language:
   - en
 library_name: peft
@@ -18,180 +18,160 @@ library_name: peft
 
 # eu-kiki-devstral-cpp-lora
 
-LoRA adapter for **mistralai/Devstral-Small-2-24B-Instruct-2512**, part of the [eu-kiki](https://github.com/L-electron-Rare/eu-kiki) project — a 100 % EU-sovereign multi-model LLM serving pipeline.
+LoRA adapter for **mistralai/Devstral-Small-2-24B-Instruct-2512**, part of the [eu-kiki](https://github.com/L-electron-Rare/eu-kiki) project. Live demo: https://ml.saillant.cc.
 
-> **EU AI Act compliance posture.** This model card is structured to follow the
-> European Commission's *Public Summary Template* (PST) for the training content
-> of general-purpose AI models, published by the AI Office under
-> **Article 53(1)(d)** of Regulation (EU) 2024/1689. The structure below
-> (Sections 1–4) maps directly to the PST. Where the official template wording
-> differs from what is reproduced here, the **official template wins**;
-> please consult the
-> [AI Office page](https://digital-strategy.ec.europa.eu/en/policies/ai-office)
-> for the canonical version. This card is **PST-aligned, not PST-verbatim**.
+> **EU AI Act compliance.** This card follows the **European Commission's
+> *Template for the Public Summary of Training Content* for general-purpose
+> AI models** (Art. 53(1)(d) of Regulation (EU) 2024/1689, published by the
+> AI Office on 2025-07-24). Section numbering and field labels reproduce
+> the official template. Where this card and the official template differ
+> in wording, the **official template wins** — see the
+> [AI Office page](https://digital-strategy.ec.europa.eu/en/library/explanatory-notice-and-template-public-summary-training-content-general-purpose-ai-models).
 
 ---
 
-## Section 1 — General information about the model
+# 1. General information
+
+## 1.1. Provider identification
+
+| Field | Value |
+|---|---|
+| **Provider name and contact details** | L'Électron Rare (Saillant Clément) — `clemsail` on Hugging Face — Issues: https://github.com/L-electron-Rare/eu-kiki/issues |
+| **Authorised representative name and contact details** | Not applicable — provider is established within the European Union (France). |
+
+## 1.2. Model identification
+
+| Field | Value |
+|---|---|
+| **Versioned model name(s)** | `clemsail/eu-kiki-devstral-cpp-lora` (this LoRA adapter, v0.4.2) |
+| **Model dependencies** | This is a **fine-tune (LoRA, rank 16)** of the general-purpose AI model [`mistralai/Devstral-Small-2-24B-Instruct-2512`](https://huggingface.co/mistralai/Devstral-Small-2-24B-Instruct-2512). Refer to the base-model provider's PST for the underlying training summary. |
+| **Date of placement of the model on the Union market** | 2026-05-06 |
+
+## 1.3. Modalities, overall training data size and other characteristics
 
 | Field | Value |
 |---|---|
-| **Model name** | `eu-kiki-devstral-cpp-lora` |
-| **Type** | LoRA adapter (parameter-efficient fine-tune) |
-| **Base model** | [`mistralai/Devstral-Small-2-24B-Instruct-2512`](https://huggingface.co/mistralai/Devstral-Small-2-24B-Instruct-2512) |
-| **Provider of the fine-tune** | L'Électron Rare (Saillant Clément), `clemsail` |
-| **Provider contact** | https://github.com/L-electron-Rare/eu-kiki/issues |
-| **Date of first public release** | 2026-05-06 |
-| **Latest version date** | 2026-05-06 |
-| **Modalities** | Text in / text out (no image, audio, or video) |
-| **Languages of intended use** | English |
-| **Risk classification (EU AI Act)** | Limited risk (Art. 52) |
-| **Systemic-risk class (Art. 51 / 55)** | **Not applicable** — this is a LoRA fine-tune, not a foundation model > 10²⁵ FLOPs |
-| **Foundation-model provider responsibility** | The base model provider remains the GPAI provider for the base; this card describes only the fine-tune delta |
+| **Modality** | ☒ Text  ☐ Image  ☐ Audio  ☐ Video  ☐ Other |
+| **Training data size** (text bucket) | ☒ Less than 1 billion tokens  ☐ 1 billion to 10 trillion tokens  ☐ More than 10 trillion tokens |
+| **Types of content** | Instruction-tuning pairs, technical text, source code, multilingual instruction templates (EU official languages where applicable). |
+| **Approximate size in alternative units** | ≈ 0.6 M tokens (2 850 rows × ≈ 200 tokens/row). |
+| **Latest date of data acquisition / collection for model training** | 10/2025 (last commit on scraped repos). The model is **not** continuously trained on new data after this date. |
+| **Linguistic characteristics of the overall training data** | English (technical instruction language). No other natural languages. |
+| **Other relevant characteristics / additional comments** | LoRA fine-tune (rank 16, alpha 32, dropout 0.05); only attention projections (`q_proj`, `k_proj`, `v_proj`, `o_proj`) are trained. Per-record `_provenance` (source, SPDX licence, `record_idx`, `access_date`) attached at the system level (see [`docs/eu-ai-act-transparency.md`](https://github.com/L-electron-Rare/eu-kiki/blob/main/docs/eu-ai-act-transparency.md) §4.4). Tokenizer: inherited from the base model. |
 
 ---
 
-## Section 2 — Description of training content
+# 2. List of data sources
 
-The following four categories follow the PST four-way classification of
-training-content sources. **Empty categories are listed explicitly** so
-absence is auditable.
+## 2.1. Publicly available datasets
 
-### 2.1 Publicly available datasets
+**Have you used publicly available datasets to train the model?** ☒ Yes  ☐ No
 
-| Source | URL / Hub ID | SPDX licence | Records | Notes |
+**Modality(ies) of the content covered:** ☒ Text  ☐ Image  ☐ Video  ☐ Audio  ☐ Other
+
+**List of large publicly available datasets:**
+
+| Dataset | URL | SPDX licence | Records | Notes |
 |---|---|---|---:|---|
-| CommitPackFT (C/C++ subset) | https://huggingface.co/datasets/bigcode/commitpackft | `MIT` | 1,500 | Public HF dataset, real-world commit pairs |
+| CommitPackFT (C/C++ subset) | https://huggingface.co/datasets/bigcode/commitpackft | `MIT` | 1,500 | Public HF dataset; real-world commit message + diff pairs. |
 
-### 2.2 Data obtained from third parties under licence
+## 2.2. Private non-publicly available datasets obtained from third parties
 
-_No third-party-licensed data used._
+### 2.2.1. Datasets commercially licensed by rightsholders or their representatives
 
-### 2.3 Data collected through web scraping
+**Have you concluded transactional commercial licensing agreement(s) with rightsholder(s) or with their representatives?** ☐ Yes  ☒ No
 
-| Source | URL / Hub ID | SPDX licence | Records | Notes |
-|---|---|---|---:|---|
-| ESP-IDF examples | https://github.com/espressif/esp-idf | `Apache-2.0` | 700 | Official Espressif repo, scraped under DSM Art. 4 TDM, robots.txt verified |
-| STM32Cube examples | https://github.com/STMicroelectronics/STM32CubeF4 | `BSD-3-Clause` | 450 | Official STMicroelectronics repo, scraped under DSM Art. 4 TDM |
-| Arduino examples | https://github.com/arduino/Arduino | `CC0-1.0` | 200 | Official Arduino repo, scraped under DSM Art. 4 TDM |
+_(N/A — no commercial licensing agreements concluded.)_
 
-### 2.4 User-provided data and synthetic data
+### 2.2.2. Private datasets obtained from other third parties
 
-_No user-provided or synthetic data used._
+**Have you obtained private datasets from third parties that are not licensed as described in Section 2.2.1?** ☐ Yes  ☒ No
 
----
+_(N/A — no private third-party datasets obtained.)_
 
-## Section 3 — Aggregate description of training content
+## 2.3. Data crawled and scraped from online sources
 
-| Aggregate field | Value |
-|---|---|
-| **Total records used for this LoRA** | 2,850 |
-| **Domain label in the eu-kiki router** | `cpp` |
-| **Time-period of source data** | Mixed; per-source download dates logged in `_provenance` fields |
-| **Modalities in training data** | Text only |
-| **Languages in training data** | English |
-| **Estimated total tokens** | ≈ 570,000 (heuristic 200 tokens / record average) |
-
-The full system-level inventory (all 35+ domains across 7 base models /
-candidates, ≈ 82 K records, with per-source SPDX license, download dates,
-and `n_used` counts) is published at
-[`docs/eu-ai-act-transparency.md`](https://github.com/L-electron-Rare/eu-kiki/blob/main/docs/eu-ai-act-transparency.md)
-§4.4. This adapter consumes a strict subset of that inventory.
+**Were crawlers used by the provider or on behalf of?** ☒ Yes  ☐ No
 
----
+**Crawler name(s) / identifier(s):** custom `huggingface_hub` + `requests` Python collectors operated by the provider.
+
+**Purposes of the crawler(s):** Acquire authoritative vendor reference code for technical training (firmware examples, EDA libraries).
+
+**General description of crawler behaviour:** Respects `robots.txt`, `meta robots noai`, `ai.txt`, and TDM-Reservation headers. Low QPS (≤ 1 req/s). Authenticated GitHub API where available. Captchas, password-protected pages and paywalls not bypassed.
+
+**Period of data collection:** Mixed; per-source `access_date` fields logged. Latest collection date: 10/2025.
+
+**Comprehensive description of the type of content and online sources crawled:** Three official vendor repositories scraped via authenticated GitHub API at low QPS. Robots.txt and rate limits respected. Per-source SHA-256 manifest in `data/scraped/<source>/manifest.json`. Compliant with EU DSM Directive Art. 4 TDM exception.
+
+**Type of modality covered:** ☒ Text  ☐ Image  ☐ Video  ☐ Audio  ☐ Other
+
+**Summary of the most relevant domain names crawled (top 5 % / max 1 000 — SME provider):**
+
+- `https://github.com` — github.com (espressif/esp-idf, STMicroelectronics/STM32CubeF4, arduino/Arduino) (SPDX: `Apache-2.0 (ESP-IDF) / BSD-3-Clause (STM32Cube) / CC0-1.0 (Arduino)`, ≈ 1,350 records)
+
+## 2.4. User data
+
+**Was data from user interactions with the AI model (e.g. user input and prompts) used to train the model?** ☐ Yes  ☒ No
 
-## Section 4 — Other relevant elements
-
-### 4.1 Copyright compliance and TDM opt-out (Art. 53(1)(c))
-
-- **Public datasets (§2.1):** all carry permissive open-source licenses
-  (Apache-2.0, MIT, CC-BY-*, BSD); SPDX matrix verified.
-- **Third-party-licensed data (§2.2):** vendor datasheets used under EU
-  Directive 2019/790 (DSM Directive) **Article 4 — Text and Data Mining
-  exception**. Robots.txt respected at collection time. SHA-256 manifests
-  published at
-  [`docs/pdf-compliance-report.md`](https://github.com/L-electron-Rare/eu-kiki/blob/main/docs/pdf-compliance-report.md).
-- **Scraped data (§2.3):** opt-out signals (robots.txt `Disallow`,
-  `<meta name="robots" content="noai">`, TDM Reservation headers,
-  ai.txt) are honoured at collection time. Manifests under
-  `data/scraped/<source>/manifest.json` in the source repo.
-- **Removal requests:** open an issue at the source repo URL above or
-  contact the operator listed in §1. We commit to remove disputed
-  content within 30 days and re-train the adapter on the next release
-  cycle.
-
-### 4.2 Quality and curation
-
-- Per-record `_provenance` fields (source URL, SPDX license,
-  `record_idx`, `access_date`) attached to 49,956 records across
-  21 domains (system-level), enabling per-record audit and removal.
-- Per-domain cap of ≤ 3 000 records applied to keep classes balanced
-  across the routing surface.
-- Synthetic data (when present) is explicitly marked `source: "synthetic"`
-  in the row provenance.
-
-### 4.3 Personal data and PII (Art. 10 + Art. 53(1)(d))
-
-Training data scanned with **Microsoft Presidio + en_core_web_lg**
-(2026-04-28) across all 35+ domain directories. **One** email address
-detected in the unrelated `traduction-tech` corpus was redacted before
-training. **No high-signal PII** (email, phone, credit card, SSN, IBAN)
-remains in the released adapters. Low-signal Presidio detections
-(PERSON, LOCATION, DATE_TIME) are common false positives in technical
-text and were left in place. Full report:
-`data/pii-scan-report.json` in the source repo.
-
-### 4.4 Special categories of personal data (GDPR Art. 9)
-
-No special-category data (health, religion, sexual orientation, etc.)
-was intentionally collected. The PII scan above also screens for
-identifiers that could lead to special-category inference; none were
-flagged.
-
-### 4.5 Copyright opt-out registry
-
-The provider tracks opt-outs via the Issues tracker on the source
-repository. As of release date no removal requests have been received.
+**Was data collected from user interactions with the provider's other services or products used to train the model?** ☐ Yes  ☒ No
+
+_(N/A — no user data collected from any provider service or AI-model interaction is used to train this LoRA.)_
+
+## 2.5. Synthetic data
+
+**Was synthetic AI-generated data created by the provider or on their behalf to train the model?** ☐ Yes  ☒ No
+
+_(N/A — no synthetic AI-generated data created by the provider or on their behalf to train this LoRA.)_
+
+## 2.6. Other sources of data
+
+**Have data sources other than those described in Sections 2.1 to 2.5 been used to train the model?** ☐ Yes  ☒ No
+
+_(N/A — no other data sources used.)_
 
 ---
 
-## Section 5 — Performance evaluation (Art. 53(1)(a))
+# 3. Data processing aspects
 
-**HumanEval** (custom Studio scorer, EvalPlus extra-tests not run — Linux-only sandbox): base 87.20 → +cpp 85.98 = **−1.22 pts**. Linux re-scoring required for rigorous Δ HE+.
+## 3.1. Respect of reservation of rights from text and data mining exception or limitation
 
-Full bench results, methodology, env.json, and rerun.sh per measurement:
-[`eval/results/SUMMARY.md`](https://github.com/L-electron-Rare/eu-kiki/blob/main/eval/results/SUMMARY.md) ·
-[`MODEL_CARD.md`](https://github.com/L-electron-Rare/eu-kiki/blob/main/MODEL_CARD.md).
+**Are you a Signatory to the Code of Practice for general-purpose AI models that includes commitments to respect reservations of rights from the TDM exception or limitation?** ☐ Yes  ☒ No  *(SME / individual provider; commitments equivalent in substance, see below.)*
+
+**Measures implemented before model training to respect reservations of rights from the TDM exception or limitation:**
+
+- **Public HF datasets (§2.1):** all carry permissive open licences (Apache-2.0, MIT, CC-BY-*, BSD); SPDX matrix verified per-source. The licences explicitly authorise instructional / model-training use for the rows actually selected.
+- **Web-scraped sources (§2.3):** prior to collection the provider verified `robots.txt`, `<meta name="robots" content="noai">`, `ai.txt`, and TDM-Reservation HTTP headers. Any source returning a reservation under Article 4(3) of Directive (EU) 2019/790 was excluded from collection. Scraping was limited to authoritative vendor-controlled repositories (ESP-IDF, STM32Cube, Arduino, KiCad symbols/footprints) operating under permissive licences.
+- **Vendor PDF datasheets (§2.2.2 where present):** processed under the EU DSM Directive Article 4 TDM exception. SHA-256 manifests and per-source legal-basis records are published in [`docs/pdf-compliance-report.md`](https://github.com/L-electron-Rare/eu-kiki/blob/main/docs/pdf-compliance-report.md).
+- **Public copyright policy (Art. 53(1)(c)):** [`docs/eu-ai-act-transparency.md`](https://github.com/L-electron-Rare/eu-kiki/blob/main/docs/eu-ai-act-transparency.md). Removal requests are handled via the issue tracker on the source repository; the provider commits to remove disputed content within 30 days and re-train on the next release cycle.
+
+## 3.2. Removal of illegal content
+
+**General description of measures taken:**
+
+- The provider does not crawl the open web at large; sources are restricted to curated public HF datasets and authoritative vendor repositories where the risk of illegal content (CSAM, terrorist content, IP-violating works) is structurally low.
+- Personal data was screened with **Microsoft Presidio + en_core_web_lg** (2026-04-28) across all 35+ system-level domain directories. **One** email address detected in the unrelated `traduction-tech` corpus was redacted before training. Full report: `data/pii-scan-report.json`.
+- No special-category data (GDPR Art. 9: health, religion, sexual orientation, etc.) was intentionally collected; the PII scan also screens for identifiers that could enable special-category inference (none flagged).
+- License compatibility is enforced via per-source SPDX matrix; works under non-permissive licences are excluded.
+
+## 3.3. Other information (optional)
+
+- **Per-record provenance:** 49 956 system-level training records carry `_provenance.{source, license, record_idx, access_date}` fields, enabling per-record audit and removal.
+- **Compute footprint:** LoRA training updates ≈ 0.1–0.5 % of base-model parameters. **Estimated training compute for this LoRA ≪ 10²⁵ FLOPs**, well below the systemic-risk threshold of EU AI Act Art. 51. No proprietary teacher model is used in deployed inference.
+- **Risk classification:** Limited risk (Art. 52). Not deployed in safety-critical contexts.
 
 ---
 
-## Section 6 — Training configuration
+# Appendix A — Performance evaluation (Art. 53(1)(a))
 
-| Parameter | Value |
-|---|---|
-| Method | LoRA |
-| Rank | 16 |
-| Alpha | 32 |
-| Dropout | 0.05 |
-| Target modules | `q_proj`, `k_proj`, `v_proj`, `o_proj` (attention only) |
-| Precision | BF16 |
-| Optimiser | AdamW |
-| Learning rate | 1e-5 |
-| Batch size × grad-accum | 1 × 4–8 |
-| Framework | MLX (`mlx_lm` fork on Apple Silicon) |
-| Hardware | Mac Studio M3 Ultra 512 GB unified memory |
-
-### 6.1 Compute resources (Art. 53(1)(d))
-
-LoRA training is parameter-efficient: only ≈ 0.1–0.5 % of base-model
-parameters are updated. **Estimated training compute ≪ 10²⁵ FLOPs** —
-the systemic-risk threshold of Art. 51. Single-machine training on
-Mac Studio M3 Ultra; no datacentre footprint. No proprietary teacher
-model is used in deployed inference.
+**HumanEval** (custom Studio scorer; EvalPlus extra-tests not run — Linux-only sandbox): base 87.20 → +cpp 85.98 = **−1.22 pts**. For rigorous HumanEval+ Δ, sample re-scoring on Linux is required (samples preserved at `eval/results/2026-05-04/devstral-cpp-fused-humanevalplus/`).
+
+Full bench results, methodology, env.json, and rerun.sh per measurement:
+[`eval/results/SUMMARY.md`](https://github.com/L-electron-Rare/eu-kiki/blob/main/eval/results/SUMMARY.md) ·
+[`MODEL_CARD.md`](https://github.com/L-electron-Rare/eu-kiki/blob/main/MODEL_CARD.md).
 
 ---
 
-## Section 7 — Usage
+# Appendix B — Usage
 
 ```python
 from mlx_lm import load
@@ -218,21 +198,16 @@ python -m mlx_lm fuse \
 
 ---
 
-## Section 8 — Limitations and out-of-scope use
+# Appendix C — Limitations and out-of-scope use
 
-- **Not for safety-critical decisions** (medical, legal, structural,
-  life-safety, biometric).
-- **Not for high-stakes individual decisions** (hiring, credit, law
-  enforcement) — that would re-classify under EU AI Act Art. 6
-  high-risk and require additional obligations.
-- **Hallucination present** at typical instruction-tuned LLM levels;
-  pair with a verifier or human-in-the-loop for factual outputs.
-- **LoRA inherits all base-model limitations**: training cutoff,
-  language coverage, refusal patterns.
+- Not for safety-critical decisions (medical, legal, structural, life-safety, biometric).
+- Not for high-stakes individual decisions (hiring, credit, law enforcement) — that would re-classify under EU AI Act Art. 6 high-risk and require additional obligations.
+- Hallucination present at typical instruction-tuned LLM levels; pair with a verifier or human-in-the-loop for factual outputs.
+- LoRA inherits all base-model limitations (training cutoff, language coverage, refusal patterns).
 
 ---
 
-## Section 9 — Citation
+# Appendix D — Citation
 
 ```bibtex
 @misc{eu-kiki-2026,
@@ -244,9 +219,13 @@ python -m mlx_lm fuse \
 }
 ```
 
-## Section 10 — Changelog
+---
+
+# Appendix E — Changelog
 
 | Date | Card version | Change |
 |---|---|---|
-| 2026-05-06 | v0.4.1 | First HF release — Apache-2.0, EU AI Act self-contained model card |
-| 2026-05-06 | v0.4.2 | Restructured to align with Commission Public Summary Template (PST) §1–4; explicit empty-category disclosure; opt-out registry section added |
+| 2026-05-06 | v0.4.0 | Initial HF release |
+| 2026-05-06 | v0.4.1 | Self-contained EU AI Act card (per-adapter dataset table, PII statement, contact) |
+| 2026-05-06 | v0.4.2 | PST-aligned (Commission template structure, Sections §1–4) |
+| 2026-05-06 | **v0.4.3** | **PST-verbatim** — section labels and field names reproduced from the official Commission template (PDF 2025-07-24, English version). |