Model library and naming

Note

Part of the upcoming 0.2 line. The model library, model references and the local store are used by the 0.2-line commands (Model, key and runtime commands (0.2 line)). They are present on the main branch and are not part of a tagged release.

kLLM keeps a curated model library: a catalog of models whose architecture kLLM can seal and serve, each pinned to an exact upstream repository and revision. The library grows as the kLLM team adapts and validates further architectures. It covers transformer models across modalities: language models (dense and mixture-of-experts), image diffusion and video generation. A model outside the library can still be served plain from a local directory or a Hugging Face repository; sealing needs a validated implementation for its architecture (Supported models), and support for further models is requested as described in Requesting model support.

Model references

Every command of the 0.2 line that takes a model accepts a reference in one of the following forms. The first matching rule applies.

Form	Example	Meaning
Local directory	./models/Qwen3-8B	An existing directory, used in place. It is never copied into the store.
Hugging Face, explicit	hf://Qwen/Qwen3-8B, hf://Qwen/Qwen3-8B@<revision>	A Hugging Face repository, optionally at a revision (a commit, branch or tag).
ModelScope	ms://Qwen/Qwen3-8B	A ModelScope repository. Requires the modelscope package.
Hugging Face, short	Qwen/Qwen3-8B, Qwen/Qwen3-8B@<revision>	The same as the explicit hf:// form.
Library alias	qwen3, qwen3:8b, qwen3:8b-fp8	A family name and an optional tag, resolved through the library.

A reference that matches none of these forms is refused with an explanation. Downloads from Hugging Face honour the usual huggingface_hub settings, such as HF_TOKEN for gated repositories and HF_ENDPOINT for a mirror.

Aliases and tags

An alias has the form family[:tag], in lowercase letters, digits, ., _ and -.

• The family names a model line, such as qwen3, qwen3-moe or llama3.2.

• The tag names a size and, where it matters, a format: 8b, 30b-a3b, 8b-fp8. A tag ending in -fp8 is the publisher’s FP8 checkpoint; FP8 checkpoints are sealed under perm only (Sealing FP8 and mixture-of-experts checkpoints).

• Without a tag, the family’s default tag applies: qwen3 means qwen3:8b.

Every alias resolves to a pinned upstream repository and revision, so the same alias downloads the same files on every machine until the library entry is updated. kllm show prints the repository and revision behind a local model.

Models created locally with kllm create take the name given on the command line, in the same name[:tag] form, for example my-qwen3:8b; a name without a tag gets the tag latest. Names of library models, and library family names without a tag, are refused.

Library contents

At the time of writing the library holds the families below, with their plain tags. The families also hold the tags of the official sealed models, listed in Official sealed models. kllm search prints the current contents, and kllm search TEXT filters them.

Family	Tags	Default tag	Modality	Engines
qwen3	1.7b, 4b, 8b, 14b, 32b, and the same sizes with -fp8	8b	Text	SGLang, vLLM
qwen3-moe	30b-a3b, 30b-a3b-fp8	30b-a3b	Text	SGLang, vLLM
qwen2.5	0.5b, 1.5b, 3b, 7b (Instruct)	7b	Text	SGLang, vLLM
llama3.2	1b, 3b (Instruct; gated)	3b	Text	SGLang, vLLM
llama3.1	8b (Instruct; gated)	8b	Text	SGLang, vLLM
minimax-h3	fl2va	fl2va	Video and audio	SGLang
z-image	6b	6b	Image	kLLM latent server (Generating images in client-keyed mode)

Gated repositories require accepting the publisher’s license on Hugging Face and setting HF_TOKEN. Each model keeps its upstream license; kllm show and the website’s model pages name it.

The library is bundled with kLLM as src/kllm/models/library.json and is kept consistent with the model catalog of the kLLM website, web/data/models.json: each family lists the website catalog entries it covers in its catalog field. KLLM_LIBRARY replaces it with another catalog, given as a file path or an https:// address (Settings).

Official sealed models

The kLLM team seals selected public models ahead of time, each under its own model key, and publishes them in the ANetResearch organization on Hugging Face as the catalog (The catalog of official sealed models). The catalog is rolling out; no catalog model has been confirmed as published yet.

Each catalog model is a tag of its base’s family, named after the base’s plain tag with -sealed appended. A base without a plain tag uses its repository name in lowercase, without the family prefix:

Alias	Catalog model
qwen3:8b-sealed	ANetResearch/Qwen3-8B-kllm
qwen3:4b-instruct-2507-sealed	ANetResearch/Qwen3-4B-Instruct-2507-kllm
qwen3:32b-sealed	ANetResearch/Qwen3-32B-kllm
qwen2.5:7b-sealed	ANetResearch/Qwen2.5-7B-Instruct-kllm
llama3.1:8b-sealed	ANetResearch/Llama-3.1-8B-Instruct-kllm
qwen3-moe:30b-a3b-instruct-2507-sealed	ANetResearch/Qwen3-30B-A3B-Instruct-2507-kllm
qwen3-moe:30b-a3b-instruct-2507-fp8-sealed	ANetResearch/Qwen3-30B-A3B-Instruct-2507-FP8-kllm
z-image:6b-sealed	ANetResearch/Z-Image-kllm
z-image:turbo-sealed	ANetResearch/Z-Image-Turbo-kllm
minimax-h3:fl2va-sealed	ANetResearch/MiniMax-H3-FL2VA-kllm (held, not published; see Licenses)

The library records the status of each one: rolling out until the upload is confirmed, available once published, or held. A rolling-out model is pulled when it is requested, and a repository that does not exist yet is reported as not published; a held model is never pulled. kllm search sealed lists the catalog models with their status, and kllm show prints the base, the base revision, the key version and whether the weights are locked.

Every catalog model is published with a catalog manifest, kllm-manifest.json, that lists the SHA-256 digest of every file. kllm pull downloads exactly the listed files and checks them against it, and kllm check checks the local copy again at any time; the manifest is kept as published. kllm verify goes further: with the model key, it rebuilds the model from the public base and compares the two (Checking a published model).

The weights of a catalog model are locked. Loaded into a stock engine without kLLM and the model key, a catalog model computes nothing useful; with kLLM and its model key it runs normally. Every applicant approved for a model holds the same key, and the catalog models are sealed copies of public models, so these artifacts provide no confidentiality between key holders and no protection of the weights once unlocked to run; see Model keys.

Local store

Downloaded and locally created models are kept under KLLM_HOME/models (by default ~/.kllm/models):

Reference	Directory
qwen3:8b	models/qwen3/8b
hf://Qwen/Qwen3-8B@<revision>	models/hf/Qwen/Qwen3-8B/<revision> (main when no revision is given)
Local directory	The directory itself; nothing is copied.

A download is written to a temporary directory next to its destination and renamed into place only when it is complete, so an interrupted download never leaves a partial model in the store. kllm list lists the store, kllm rm removes a model from it, and kllm show prints the details of one model.

Store record and manifests

Each model in the store has a store record next to its directory, never inside it: .DIRECTORY.kllm-store.json. The record holds:

• the reference and the source repository and revision;

• the SHA-256 digest and size of every file;

• for a sealed model, the public seal metadata read from the sealed config.json: the transform, the scheme, the key fingerprint and whether the weights are locked.

The record stays outside the directory because the directory is the model as published: a catalog model carries its own kllm-manifest.json, which kLLM reads and never changes, and kllm verify treats any additional file in the directory as a difference. Stores written by earlier builds of the 0.2 line kept the record inside the directory as kllm-manifest.json; such a file is still read as a store record.

Neither the record nor the manifest contains key material. Both show that the files are those recorded at download, sealing or publication time; neither is a signature, and neither establishes who produced a model. Artifact signing is on the Roadmap.

See also

• Quickstart for the pull and run workflow.

• The catalog of official sealed models for the official sealed models.

• Model keys for the keys of the official sealed models.

• Supported models for the architectures that can be sealed and the measured results.

• Model, key and runtime commands (0.2 line) for the commands.