termite-decide-0.8b 0.2

This model judges shell commands for termite. It answers three questions about a command: does it only read, does it keep secrets hidden, and could it do harm. It can also rank several commands. It picks from fixed options and writes no text.

It must never approve what your rules refuse. In termite it can only make an answer stricter. A command written to deceive it can get past it, so don't use it as your only check.

Files

File	Size	SHA-256
termite-decide-0.8b-0.2-Q8_0.gguf	812 MB	4de94cc158eac2d085cb3d320dd45dcd4936b3ee264da2192ad2b6f72b8573bc
termite-decide-0.8b-0.1-Q8_0.gguf	812 MB	f1c18861b5af987a1276b7a2933f65987fdd5c025f60e4b37c718ac82d125483

The file's own metadata names a training folder as its base model. That is a side effect of the conversion. The base model is the one named under Training.

Use it

llama-server -hf tanepiper/termite-decide-0.8b -hff termite-decide-0.8b-0.2-Q8_0.gguf -c 4096 --port 8081

Then run tmite setup, or set decision_url and decision_model in termite's config. It needs a server with /v1/systemone. Only llama.cpp was tested.

Score card

Version 0.2 is not better than 0.1 on every test. It was rebuilt using only training data with clear licences. It rates more harmless commands as safe, and it is better at putting dangerous commands in order of risk. It scores lower on tau and on three other ladder tests. All results below come from fixed test sets, and every version gets the same tests.

Measure	Kev-0.8B	0.1	0.2
Tau on the ladder, mark above 0.703	0.548	0.698	0.678
Commands at tier 3 or above rated safe, of 30	0	0	1
Tier 2 commands rated safe, of 8	0	8	8
Harmless commands rated safe, of 14	1	14	14
Riskier folder scored higher, of 11	11	11	8
Safest option ranked first, of 10	2	4	3

Tau measures how well the model's harm scores match the order of the safety ladder, where 1 is the same order and 0 is random.

The allowed test holds 141 commands that termite's rules raise nothing about. Each label comes from what the command did in a throwaway machine with fake secrets.

Measure	0.1	0.2
Harmful commands rated safe, of 48	5	5
Harmless reads rated safe, of 68	36	46

Three marks for this test were set after the first scores were seen, and 0.2 passes all three:

Mark	Result
No harmful command passes both the read-only policy and the model	0
Harmful commands rated safe on the agent route, no more than 0.1's 2 of 5	2 of 5
Harmless reads allowed by the policy and rated safe, at least 16 of 22	19 of 22

What changed in each release compares each version with the one before it.

Why some scores went down

Version 0.2 learned how harmful each command is. Version 0.1 only learned whether a command is harmful.

• Tau fell by 0.020. Pairs of dangerous commands in the wrong order roughly halved. Pairs of harmless commands in the wrong order went up by more, because every harmless command had the same score in training, so the model can't tell which of two harmless commands is safer. A second training run on the same data with a different seed scored 0.656, so a gap of this size may be chance.
• Riskier folder fell from 11 to 8. All 3 misses compare a home folder with a project folder, and the model gives them almost the same score. Every comparison with a secret folder is still right.
• One tier 4 command was rated safe. It lists a folder of keys. The training rows did not cover that folder well. termite's rules refuse this command.
• Some dangerous commands score too low. They come from three families of commands that were held out of training to test the model on what it hadn't seen.
• Scores are closer together. Harmless commands score about 0.16 and the most dangerous about 0.7. Version 0.1 gave scores near 0 or 1. I don't know why yet.

What the next version will try

1. Give harmless commands different scores in training, so the model can put them in order.
2. Put the held-out families back for the final run.
3. Add training rows for more folders of keys.
4. Find out why the scores are closer together.
5. Test whether the harm score can help when ranking.
6. Train each data set more than once, and report the spread.

Known limits

• It misses some harmful commands. It rated 5 of 48 harmful commands as safe in the allowed test.
• It does not check that a command is real. None of its questions asks this. termite's rules catch missing programs and cut-off lines, but not made-up options.
• It is weak at ranking. The safest option came first in only 3 of 10 choices.
• The ladder has been read closely. It was used to choose between runs, so its scores are likely to flatter the model.
• The tests are small. The ladder has 52 commands, and one row moves a count.
• The ladder ran on macOS. Linux use was not tested separately for this version.
• English only. Nothing else was tested.

Training

• Base: jaredpalmer/kev-0.8b, revision bf75a6a8848ea6960ff2ed108d9ed44c2941174f, Apache 2.0, built on Qwen/Qwen3.5-0.8B-Base, revision dc7cdfe2ee4154fa7e30f5b51ca41bfa40174e68, Apache 2.0.
• Method: LoRA, rank 16, with a pointer head. One pass, learning rate 0.00005, batch size 8, seed 1. The harmful question uses graded targets.
• Data: 9,839 decision rows and 1,280 ranking rows, which are not published.
• Labels: termite's rules labelled the rows, and rows the rules couldn't answer were left out. Rows that matched a test set were removed. Whole programs and three command families were held out.
• Conversion: llama.cpp convert_hf_to_gguf.py, Q8_0.

Training data sources

Version 0.2 was rebuilt from sources that were checked back to their origin. It uses no data from the sets that trained 0.1.

Source	Licence
tldr-pages, commit b9bf7d8308486b5a0361126f1984436f4d709904	CC BY 4.0, © the tldr-pages team and contributors
Rows written for this project	Apache 2.0

The tldr-pages text was changed: placeholders were filled in, and pages were turned into requests, commands and labels. No source data is published here.

Licence

Apache 2.0, the same as the base models. This is a fine-tuned version of them.