VeriLoop E2 Ships a 27B Apache Checkpoint That Refuses to Self-Certify

Tsinghua Shenzhen International Graduate School’s Intelligent Robotics Laboratory published VeriLoop-E2 on Hugging Face as an ungated Apache 2.0 post-trained 27B model, with Hugging Face API metadata showing the repository created September 22, 2026 and last modified September 23. The English model card, credited to Libo Wang, describes a checkpoint built on Qwen3.8-27B for code, mathematics, and physics, a native 262,144-token context window, and a deliberate split between what the model may propose and what an external VeriLoop Harness may admit as evidence. Hugging Face tags list license:apache-2.0, Transformers loading via Qwen3_5ForConditionalGeneration, and a safetensors shard set totaling about 27.9 billion parameters.

The release’s claim is architectural as much as numerical. VeriLoop-Governed Recurrence (VGR) treats model output as a candidate state: the model proposes, abstracts, diagnoses, and suggests repairs; the Harness compiles the contract, runs deterministic and external checks, compares a protected evidence state, then commits, rolls back, or stops. The card is explicit that the production Harness implementation is not included in the open repository—the weights, tokenizer, configuration, public vLLM launch path, and evaluation evidence are Apache 2.0; proprietary orchestration is not. That boundary matters for operators who would otherwise assume “open model” means “open control plane.”

Public benchmark tables on the card report frozen release scores for the evaluated E2 system configuration, not for an untouched Qwen base outside that runtime. Headline rows include SWE-bench Pro at 76.2%, Terminal-Bench 2.1 at 88.8%, DeepSWE v1.1 at 64.6%, AIME 2026 at 98.3%, GPQA Diamond at 93.9%, and Apex 2025 at 89.6%, with per-benchmark evidence directories published under tsinghua-sigs-robot-lab/VeriLoop-E2-Evaluation-Evidence. The card’s attribution boundary is unusually careful: results characterize the evaluated configuration with harness and evaluator versions frozen in the evidence package, and seven of the descriptors currently map to Hugging Face Native Benchmark leaderboards while Apex and SWE-Marathon are labeled laboratory self-published release results with public links.

Post-training accounting on the card lists 1,841,831 records spanning repository-level software engineering, terminal and tool use, mathematical and scientific reasoning, verifier-sensitive repair, and recurrence-oriented training. A public fourteen-rule engineering contract—current-request supremacy, evidence before escalation, fail loud never fake success, typed tool accountability, checkpointing long tasks—defines the model-visible discipline for long-horizon work. Scientific demonstration artifacts for a finite-dimensional Riemann ζ certificate and Asymptotic Graviton Tomography ship separately under research-only, non-commercial terms; the card refuses to treat those percentages as substitutes for mathematical provenance or as covered by the Apache grant on the weights.

Serving guidance pins a validated reference stack: Python 3.12, vLLM 0.17.0, PyTorch 2.10.0 with CUDA 12.9, Transformers 4.57.6, bfloat16, and a 131,072-token validated serving length even though the tokenizer advertises 262,144 natively. The card publishes an OpenAI-compatible vllm serve recipe with --language-model-only, a curl smoke test that expects 8001_OK, and a warning that replacing role delimiters or tool-call syntax can change behavior even when the weights are unchanged. A companion GGUF precision ladder for llama.cpp-oriented local runs is discussed in companion Hugging Face Forum posts around the same window, extending the release beyond datacenter vLLM.

Limitations on the card are equally operational. The model can still emit incorrect code, invalid proofs, insecure commands, or incomplete analyses; a plausible derivation is not a verified result; long-context behavior depends on accelerator memory and KV-cache budget; and community-modified templates can change tool-use behavior even when the weights are unchanged. Operators who need the full propose-verify-commit loop must therefore bring their own tests, sandboxes, and evidence stores—or accept the open weights as a strong proposal engine with the Harness contract documented but not redistributed.

For Writeble’s opensource desk, VeriLoop E2 clears the bar that hosted-only agent demos do not: ungated Apache weights, a verified create date, an explicit license boundary between model and harness, and an evaluation evidence package meant to be inspected rather than believed. Teams that need a commercially friendly 27B coding-and-reasoning checkpoint can load it under a pinned vLLM recipe, treat the Harness contract as documentation of intent rather than a redistributable runtime, and decide whether the propose-verify-commit loop is worth rebuilding on their own verification stack—without waiting on a gated frontier SKU.