Geni-S1-Ops-Omni

Geni-S1-Ops-Omni is a fast multimodal System-1 typed-decision model for IT operations, fine-tuned from Cloudflare/clef-flash (Apache-2.0; Qwen3.5-9B multimodal backbone). It is the successor to Geni-S1-Ops-26B-A4B-NVFP4: same mission, new decision engine. Where Geni-S1-Ops read decisions from noised token canvases on DiffusionGemma, Omni answers every question jointly through a schema head — one forward pass, cross-field consistency included — and it keeps the multimodal (computer-use) leg natively.

Why this model matters

The blocker to autonomous IT operations is not intelligence — modern models can read a command. The blocker is trust: a system that produces a fluent-sounding answer for every input, including the ones it cannot possibly decide, is unsafe to wire into execution. One guessed "LOW" on an unfamiliar destructive command is a production incident; one free-text answer that fails to parse is a broken pipeline.

Omni is built around exactly that blocker:

It knows what it doesn't know. On undecidable states — an unfamiliar vendor CLI, a missing version fact — it answers UNKNOWN and routes to a human, at a false-positive rate of 0.0013 (it escalates when it should, and almost never when it shouldn't). This measured UNKNOWN discipline, not benchmark accuracy, is what makes an advise-then-authorize architecture possible.
It cannot fail to parse. Every answer is a typed probability distribution over declared options — 18 safety fields in one pass, zero generated tokens, no prompt-injection surface through output text.
It was validated the way you'd want before production: held-out families the model has never seen (447 of them), pre-registered safety floors (CRITICAL undercalls, destructive misses, UNKNOWN recall), and a documented, conservative error geometry — the one known CRITICAL undercall class is published on this card rather than buried.
It is cheap enough to put in the loop everywhere: ~1.1 s served for a full 18-field decision (40-60 ms per typed decision, jointly scored), on a single desk-side GPU — no datacenter inference bill per command.

The deployment posture follows from this: shadow/advise mode first — Omni observes real traffic, logs what it would decide, humans verify — and autonomy is widened only when the floors hold on your traffic too.

What this model is

Not a chat assistant. It is the decision layer between intelligence and action:

state + questions + allowed values  ->  [Geni-S1-Ops-Omni]  ->  typed probability
                                                                 distributions
                                             |
                             operation = EXECUTE   risk = UNKNOWN   blast = UNKNOWN
                                     |
                        Deterministic policy / authorization

Input = a state (any JSON; optional screenshots) plus named questions with criteria (option descriptions). Output = one probability per option per question, zero generated tokens (output_tokens: 0).

Key capabilities

Trained capabilities

18-field operational-safety schema in one call: read_only, changes_state, destructive, requires_privilege, operation, resource_family, affects_* (availability/configuration/data/security), blast_radius, risk (LOW/MEDIUM/HIGH/CRITICAL/UNKNOWN), reversible, likely_downtime, restart_required, data_loss_possible, network_loss_possible, security_exposure_possible
Explicit UNKNOWN discipline: on undecidable states (unfamiliar vendors, missing version facts) it answers UNKNOWN with near-zero false-positive rate (FP 0.0013) — the escalation trigger, not a guess
11 execution-contract fields (trained in this revision): execution_mode (BOUNDED/STREAMING/INTERACTIVE/LONG_RUNNING/BACKGROUND), output_mode, terminates_automatically, termination_method, safe_to_interrupt, requires_tty, requires_user_input, expected_duration_class, completion_condition, followup_observation_required, command_validity
14-field computer-use schema (action disposition, target element, safe-to-continue, postcondition, ...) on screenshots
Joint scoring: cross-field consistency (options attend the full state; fields refine against each other)

Preserved multimodal capabilities

Vision via the Qwen3.5 tower (screenshots; 1440x900 operational UIs validated)
Zero-shot domain transfer measured on: output redaction (96% span classification), AI-safety verdicts (83%), ticket routing (100%)

Example: operational decision request (18 questions, single call)

curl http://localhost:8902/v1/systemone \
  -H "Content-Type: application/json" \
  -d @example_request.json

Actual response (live service, one forward pass, all fields correct on this record — 18 safety fields shown; the request also carries 11 execution-contract fields, see example_request.json):

affects_availability         NO       conf 1.000
affects_configuration        NO       conf 1.000
affects_data                 NO       conf 1.000
affects_security             NO       conf 1.000
blast_radius                 UNKNOWN  conf 1.000
changes_state                YES      conf 1.000
data_loss_possible           NO       conf 1.000
destructive                  NO       conf 1.000
likely_downtime              NO       conf 1.000
network_loss_possible        NO       conf 1.000
operation                    EXECUTE  conf 1.000
read_only                    NO       conf 1.000
requires_privilege           NO       conf 1.000
resource_family              OTHER    conf 1.000
restart_required             NO       conf 1.000
reversible                   FULL     conf 1.000
risk                         UNKNOWN  conf 1.000
security_exposure_possible   NO       conf 1.000

yornex is a fabricated vendor (held-out generalization probe): the model classifies the operation correctly and escalates risk/blast_radius to UNKNOWN instead of guessing. example_request.json carries the full request (all 18 question definitions with criteria).

Why System-1?

   autoregressive "assistant"              System-1 typed decisions
   -------------------------              -------------------------
   state -> prompt -> token,token,...     state -> ONE forward pass
   18 fields = 18x decode cost            18 fields scored jointly
   free-text -> parse -> hope             typed distributions, no parse
   ~seconds                               ~1.1 s served (Spark, bf16)

Architecture

Qwen3.5-9B multimodal backbone (frozen + LoRA r16/a32)
        |  last_hidden_state over state+schema text (+image)
        v
GeniJointHead (ours; 122M params, trained)
  - option/question/global/lexical projections
  - 2 evidence-routing layers  (all options attend the full state)
  - 4 field-decoder layers     (fields refine against state AND each other)
  - prior + gated-joint scorer (lexical anchor + learned similarity)
        |
        v
one logit per option per question

The head in this repo is our implementation (geni_joint_schema_model.py): batched forward, state-dict compatible with the release joint head, verified equivalent to 7e-7 — audited code, no third-party trust_remote_code needed.

Quickstart — one command

./setup_and_serve.sh          # downloads base + this repo, merges, serves :8902
curl -s localhost:8902/healthz
curl -s -X POST localhost:8902/v1/systemone -H "Content-Type: application/json" \
  -d @friday_request.json | python3 -m json.tool

Or in Python (geni_joint_schema_model.py):

from geni_joint_schema_model import load_geni_model, systemone
model, processor = load_geni_model(
    backbone="<clef-flash dir>",            # the base weights (hf download Cloudflare/clef-flash)
    lora="<this repo>",                     # adapter applied on load
    head="joint_head.safetensors.pt")       # trained decision head
resp = systemone(model, processor, state={...}, questions={...})

Requirements: CUDA GPU (~24 GB), torch + transformers + peft, bf16. Shadow log: every request/answer appended to shadow_log.jsonl — the service advises only, nothing in it can execute anything.

For the native-engine path (continuous batching), see vllm_patch/.

Production evaluation

Representative blind set (851 records, 447 never-seen families)

metric	value
macro-accuracy (18 safety fields)	0.966
CRITICAL recall	0.926
CRITICAL -> LOW/MEDIUM	0 records
UNKNOWN recall / FP rate	0.947 / 0.0052
destructive recall (n=51)	0.961 (2 misses)

Execution-contract blind probe (200 records; zero-shot -> this revision)

field	zero-shot	trained
execution_mode (incl. STREAMING)	0.77	0.82
output_mode	0.40	0.95
completion_condition	0.35	0.94
terminates_automatically	0.52	0.94
followup_observation_required	0.19	0.91
command_validity	0.83	0.94
expected_duration_class	0.53	0.76
safe_to_interrupt	0.62	0.69 (CONTEXT_DEPENDENT boundary — advisory)
exec macro	0.636	0.886

Computer-use blind set (400 records, 10 unseen layout families)

metric	value
target_element	0.975
action_disposition	0.923
safe_to_continue	0.995

Ops probe (2,000 records): macro 0.957, destructive recall 0.896 (E10-era)

Error geometry (conservative)

The single CRITICAL undercall compresses to MEDIUM at 0.60 confidence (production service-reset class; safety overlay queued for next revision)
Remaining destructive misses: 2 debatable-gold snapshot thinnings, 2 unseen AWS noun-deletes — surface generalization, not semantics

Latency (DGX Spark, bf16, exclusive GPU, measured 2026-10-21)

workload	P50	P95	notes
in-process forward (warmed)	729 ms	738 ms	backbone + head only
full HTTP round-trip, serial	1,105 ms	1,110 ms	18-question schema JSON in, probabilities out
5-way concurrent	3,323 ms	5,552 ms	single-GPU lock serializes; 0.30 req/s under load

Sustained ~0.9 req/s serial; peak memory 18.8 GiB. 18 questions = 40-60 ms per typed decision, scored jointly. Continuous batching (vLLM integration below) is the path past the concurrency lock.

vLLM integration

vllm_patch/ ships GeniSystemOneForDecision — Omni as a native vLLM model class (joint head inside the engine, spans derived from the prompt). Engine measured ~690 ms/request in eager mode; see vllm_patch/README.md.

Model lineage

Cloudflare/clef-flash (Apache-2.0, Qwen3.5-9B)
   |  + our gated corpus (36,315 examples, 29-field schema; 25 from-disk
   |    verification gates; verb-invariant destructive augmentation + safety
   |    miss-class overlay; family-level splits, frozen v50k_s3)
   v
LoRA r16 + joint-head training (per-question CE; lr 1e-4 cosine 3% warmup;
   |  2 epochs; seed 42)  ->  E11 (this revision)
   |  merge_and_unload
   v
merged backbone (bf16) + trained head   ==  this repo
   |  parity check: release-head vs our batched head
   v  exact (4 decimals ops; bf16-noise GUI)
SERVE (bf16; quant arms rejected on floors/speed)

Intended uses

Pre-execution decisioning for ops commands (advise/gate/escalate)
Computer-use step decisions over screenshots
Shadow-mode evaluation of automation policy
UNKNOWN outputs route to System-2 / human review:

confident LOW/MEDIUM + known  -> deterministic policy
UNKNOWN anywhere / CRITICAL   -> System-2 or human authorization

Do not hinge safety on a single HIGH/CRITICAL boundary; use the full 18-vector (destructive, data_loss_possible, reversible, ...) in policy rules.

Out-of-scope / not validated

Free-text generation (it never generates)
Ticket-priority matrices and guardrail-policy mappings in this revision (zero-shot-quality only; untrained domains)
Unrestricted autonomous execution — see release status

Reproducibility metadata

artifact	value
adapter (LoRA r16)	`adapter_model.safetensors`, 116,429,720 B
joint head	`head.safetensors.pt`, 243,570,635 B
training corpus	internal, gated, not published (25-gate factory)
base	Cloudflare/clef-flash (composite sha256 in lineage log)

Repository contents

adapter_config.json / adapter_model.safetensors   LoRA (apply to clef-flash)
joint_head_config.json / head.safetensors.pt      trained decision head
geni_joint_schema_model.py                        self-contained model code
serve_systemone.py                                /v1/systemone HTTP service
setup_and_serve.sh                                one-command download + merge + serve
example_request.json                              the full 18-question call
vllm_patch/                                        native-engine model class + build patches

Upstream references / License / Citation

Base: Cloudflare/clef-flash (Apache-2.0); schema-encoding routine adapted from its joint_schema_model.py
Predecessor: microlandltd/Geni-S1-Ops-26B-A4B-NVFP4
License: Apache-2.0

@misc{geni-s1-ops-omni,
  title  = {Geni-S1-Ops-Omni: a joint-schema System-1 decision model for IT operations},
  year   = {2026},
  note   = {Fine-tuned from Cloudflare/clef-flash; gated internal corpus}
}

Release status

Validated capabilities checklist:

capability	validated
18-field ops schema, held-out families	YES
UNKNOWN escalation discipline	YES
computer-use on unseen layouts	YES
bf16 serving latency/memory (measured)	YES
unrestricted autonomous execution	NO — shadow/advise mode only

Downloads last month: -; Downloads are not tracked for this model. How to track

Inference Providers NEW

This model isn't deployed by any Inference Provider. 🙋 Ask for provider support

Model tree for microlandltd/Geni-S1-Ops-Omni

Base model

Qwen/Qwen3.5-9B-Base

Finetuned

Qwen/Qwen3.5-9B

Finetuned

Cloudflare/clef-flash

Finetuned

(14)

this model