Carnice-V3 for Hermes Agent

Important limitations: this release did not pass the project's formal behavioral quality gate. A small internal Hermes diagnostic showed weaker long-horizon completion and task-level tool-contract performance than the base model. Do not use it for unattended, destructive, high-stakes, or production agents without independent evaluation and strong runtime controls.

Carnice V3 is a full merged BF16 checkpoint containing the complete Qwen3.8-27B model weights after merging the trained Carnice rank-64 rsLoRA into the exact Qwen/Qwen3.8-27B base model. It loads directly as a standard Transformers checkpoint.

Artifact format

The repository contains an ordinary sharded Transformers model:

• 27,781,427,952 BF16 parameters across 1,199 tensors;
• 55562855904 bytes of model tensor data;
• 16 model-xxxxx-of-xxxxx.safetensors shards plus an index;
• standard Qwen configuration, tokenizer, chat template, and multimodal processor metadata.

The model was safely merged, saved, and reloaded as a standalone AutoModelForImageTextToText checkpoint before packaging. The frozen 15-tensor MTP block is not instantiated by that Transformers inference class, so the builder restores those exact BF16 tensors from the base model in a dedicated shard and then audits the complete 1,199-tensor checkpoint. Those MTP tensors were not post-trained.

Chat template and tool contract

chat_template.jinja is unchanged from Qwen3.8-27B. The release pipeline tests tool definitions, Hermes-style <tool_call> / <function=...> XML, <tool_response> history, prior <think> content, reasoning_effort="xhigh", and thinking-disabled rendering.

Do not replace this template with generic ChatML or OpenAI-JSON formatting. Pass standard OpenAI-style function schemas through tools= and let the template serialize them. A Hermes runtime must parse and dispatch the resulting XML function-call envelope.

For long-running jobs, keep thinking enabled, use the strongest supported reasoning effort, expose every tool the runtime can actually dispatch, and configure explicit context, per-response, and iteration ceilings. Those ceilings should prevent silent short defaults. Log limit contacts and count them as incomplete tasks rather than successes.

Loading

Load the model directly with Transformers 5.15.0, the version used for merge/reload validation.

pip install "torch>=2.13" "transformers==5.15.0" "accelerate==1.14.0"

import torch
from transformers import AutoModelForImageTextToText, AutoTokenizer

MODEL_ID = "kai-os/Carnice-V3"

tokenizer = AutoTokenizer.from_pretrained(MODEL_ID)
model = AutoModelForImageTextToText.from_pretrained(
    MODEL_ID,
    dtype=torch.bfloat16,
    device_map="auto",
    low_cpu_mem_usage=True,
)
model.eval()

tools = [{
    "type": "function",
    "function": {
        "name": "terminal",
        "description": "Run a command in the current sandbox.",
        "parameters": {
            "type": "object",
            "properties": {"command": {"type": "string"}},
            "required": ["command"],
        },
    },
}]
messages = [
    {"role": "system", "content": "You are Hermes, a careful engineering agent."},
    {"role": "user", "content": "Inspect the current directory and summarize it."},
]

inputs = tokenizer.apply_chat_template(
    messages,
    tools=tools,
    tokenize=True,
    add_generation_prompt=True,
    enable_thinking=True,
    preserve_thinking=True,
    reasoning_effort="xhigh",
    return_tensors="pt",
    return_dict=True,
)
inputs = {name: value.to(model.device) for name, value in inputs.items()}
with torch.inference_mode():
    output = model.generate(**inputs, max_new_tokens=32768, do_sample=False)
new_tokens = output[0, inputs["input_ids"].shape[-1] :]
print(tokenizer.decode(new_tokens, skip_special_tokens=True))

Training data

The task specifications, deterministic fixtures, and hidden verifiers were locally authored for Carnice V3. Teacher trajectories were executed inside the pinned Hermes Agent runtime using Qwen-Ambassador/Qwen3.8-Max through the ModelScope inference endpoint. Collection requested xhigh reasoning and exposed the complete pinned Hermes tool schema.

A root was admitted only after all model calls settled, the parent and any delegated child had complete lineage, tool arguments passed the pinned schemas, privacy checks passed, and an independent executable verifier accepted the task outcome. Rejected, partial, over-limit, unverifiable, or rights-unapproved attempts contributed no SFT tokens.

The final reviewed boundary corpus contains eight private trajectories across six agent-task families: six training trajectories across four families, one validation trajectory, and one test trajectory. The training split produced 24 token-continuation windows at a maximum length of 16,384, with 359,363 rendered input tokens and 162,798 supervised tokens. Across the complete corpus, all 115 reasoning turns received explicit decisions: 94 were included and 21 masked. Masking a reasoning span did not remove its associated tool-action or final-answer supervision.

The eight-trajectory corpus contains 158 admitted tool calls:

Tool	Calls
terminal	43
write_file	34
patch	32
read_file	28
browser tools	11
search_files	4
todo	3
delegate_task	2
execute_code	1

Every trajectory used for this checkpoint carried an approved source/license decision and was marked release-eligible by the local admission manifest. No dataset rows, private reasoning, prompts, tool arguments, or user data are included. The private training data is not redistributed. The corpus is far too small to support broad generalization claims.

Training and merge procedure

The Qwen3.8-27B base remained unquantized in BF16 during training. Only LoRA parameters were optimized; vision and MTP modules remained frozen. The adapter was applied to the exact base model and merged with PEFT's safe-merge path. The frozen MTP tensors omitted by the runtime inference class during serialization were restored exactly from the base model. The result contains no LoRA modules and is saved as full BF16 safetensors.

Setting	Value
Objective	supervised causal LM over accepted assistant tokens
Loss policy	uniform reasoning, tool-action, and final-answer labels; reviewed reasoning masks honored
Post-training method	rank-64 rsLoRA, subsequently merged
Alpha / dropout	64 / 0.05
Target modules	496 language-model modules
Optimized LoRA parameters	466,911,232
Maximum sequence length	16,384
Optimizer	8-bit AdamW
Learning rate / schedule	1e-5 / cosine
Weight decay / warmup	0.01 / 0.04
Batch / accumulation	1 / 1
Steps	24
Selected checkpoint	step 12, best validation loss
Training hardware	1x NVIDIA GH200, 96 GB HBM
Measured training runtime	2,638 seconds (about 44 minutes)
Peak allocated / reserved HBM	82.68 / 84.56 GiB

The selected checkpoint reduced training-format validation loss from 0.40724 to 0.35186 at step 12. That measures fit to the tiny validation split; it is not evidence of general quality.

Merge verification

The release pipeline compares the adapter-attached, merged, and freshly reloaded checkpoints on deterministic prompts covering plain text, a tool request, and tool-call history. It checks numerical agreement, top-token consistency, serialization parity, and the absence of unexpected adapter, pickle, or non-BF16 model tensors.

These checks establish merge and serialization parity only. They do not repair or override the behavioral limitations below.

Evaluation

The only behavioral comparison is a small private Hermes development diagnostic. It is not a benchmark, is too small for general claims, and did not pass the formal release gate. Verifier and per-call schema-shape signals improved, while long-horizon completion and task-level tool contracts regressed. These results do not establish an overall agent-quality improvement.

Limitations and risks

• Long-horizon reliability regressed in the available diagnostic.
• Exact task-level tool-contract performance was worse than the pinned base.
• The training set is too small to cover broad tools, environments, languages, multimodal workflows, failure modes, or adversarial inputs.
• Tool syntax validity does not imply correct tool choice, arguments, safe execution, successful completion, or faithful interpretation of results.
• The model inherits the upstream model's knowledge limits, biases, and safety limitations.
• Vision behavior was not post-trained even though the complete multimodal base is included.

Use sandboxing, least-privilege credentials, durable logs, cost ceilings, loop detection, human approval for consequential actions, and task-specific verifiers.

License and attribution

The merged model and repository documentation are released under Apache-2.0. The upstream Qwen3.8-27B base is also Apache-2.0; consult its model card for documentation and limitations. The private training corpus is not distributed by this license or repository.

Built by kai-os. Thanks to the Qwen team for the base model and to Hermes Agent for the development runtime.