# Models, compatibility, and licenses

The 2026-10-19 [local selection update](/reference/docs/LOCAL_AI_SELECTION.md) supersedes memory-size ordering. Automatic upgrades require matching native task/performance evidence; the former largest-model rule and fallback recommendation despite insufficient free memory have been removed. Historical catalog measurements below remain historical and are not new physical-device certifications.

Research checked against official publisher documentation on 2026-10-15. A downloadable weight file is not automatically open source. HOLD's application license does not relicense weights. The catalog records the upstream repository, immutable revision, exact filename, size, SHA-256, and license separately.

## Shipping catalog

| Model | Quantization | Exact download bytes | Planning memory budget* | Intended use | Status |
| --- | --- | ---: | ---: | --- | --- |
| Qwen 2.5 0.5B Instruct | Q4_K_M | 491,400,032 | 2 GiB | Fast setup, simple drafts and questions | Verified local Windows CPU streaming chat |
| Qwen 3 0.6B | Q8_0 | 639,446,688 | 3 GiB | Compact general chat | Verified local Windows CPU streaming chat and bounded agent |
| Qwen 3.5 0.8B | Q4_0 | 563,036,064 | 3 GiB | Experimental text mode | Windows Vulkan load verified; failed arithmetic check and flawed coding explanation. Not recommended; vision not integrated. |
| Qwen 3.5 2B | Q4_K_M | 1,280,835,840 | 4 GiB estimate; exact-host CPU peak recorded separately | Evaluated experimental text preview | New Windows CPU runs: original 2/15, precision comparison 4/13 strict tasks. No automatic promotion; vision/audio/tools unverified. |
| Qwen 3 4B | Q4_K_M | 2,497,280,256 | 6 GiB | Balanced general chat and light coding | Verified pinned download, Windows Vulkan streaming, short arithmetic and coding checks |
| SmolVLM 256M + projector | Q8_0 | 278,824,384 total | 2 GiB | Simple local photo descriptions | Verified CPU image input, exact image-aware token measurement, replay and cancellation; see [vision evidence](/reference/docs/vision.md) |
| Qwen 2.5 Coder 7B Instruct | Q4_K_M | 4,683,073,536 | 7 GiB | Optional code-focused choice | Verified CUDA; 7/10 bounded structured-answer checks, including concrete logic and SQL errors |
| Qwen 3 1.7B | Q8_0 | 1,834,426,016 | 4 GiB | Optional compact thinking mode | Verified CUDA; 3/10 nonthinking checks, 2/2 thinking-mode logic checks |
| Qwen 3 8B | Q4_K_M | 5,027,783,488 | 8 GiB | Optional larger general model | Verified CUDA; 8/10 nonthinking checks, 2/2 thinking-mode logic checks |

*Memory budgets are conservative product estimates at a 4,096-token configured context, not benchmark measurements or guaranteed fit. Current selection adds OS reserve, checks free host/GPU memory and storage, accounts for context/projectors, and requires matching native task/performance evidence for automatic upgrades. Exact-host CPU peak observations may refine an estimate with a safety margin. Without sufficient evidence, the established tiny starter remains an explicitly limited fallback. Qwen 3 4B's earlier size-based recommendation is superseded; its known-good pin and manual selection remain available. See [current selection rules and actual results](/reference/docs/LOCAL_AI_SELECTION.md).

The exact audited pins are in `packages/core/catalog.js`. The official Hugging Face model API supplied commit IDs, byte counts, and LFS SHA-256 values. Downloads use commit URLs, not mutable `main` URLs, and the app checks the entire SHA-256 before installation and each model load. The GGUF file header is also checked. Pins are an integrity guarantee relative to the audited publisher artifact; they do not prove a model parser is vulnerability-free.

Sources: [Qwen 2.5 0.5B official GGUF](https://huggingface.co/Qwen/Qwen2.5-0.5B-Instruct-GGUF), [Qwen 3 0.6B official GGUF](https://huggingface.co/Qwen/Qwen3-0.6B-GGUF), [Qwen 3 4B official GGUF](https://huggingface.co/Qwen/Qwen3-4B-GGUF), [Qwen 3.5 0.8B publisher](https://huggingface.co/Qwen/Qwen3.5-0.8B), [llama.cpp organization's conversion](https://huggingface.co/ggml-org/Qwen3.5-0.8B-GGUF).

## Actual balanced and experimental model validation

On 2026-10-15, `node scripts/verify-catalog-models.mjs` acquired both pinned files into an isolated profile, independently verified their complete SHA-256 and exact length, and exercised the actual HOLD core with llama.cpp b11429 on Windows, a Ryzen 9 5950X, 32 GiB RAM and an RTX 4080. Application fetch was restricted to HTTP loopback after acquisition; zero external requests were attempted during inference. Raw prompts, unedited responses, hashes, usage, native process memory and shared-GPU snapshots are recorded in [model validation evidence](/reference/docs/evidence/model-4b.json). The reproducible script is [verify-catalog-models.mjs](/reference/scripts/verify-catalog-models.mjs).

| Observation | Qwen 3 4B | Qwen 3.5 0.8B experimental |
| --- | --- | --- |
| Complete download/hash | Passed, 2,497,280,256 bytes | Passed, 563,036,064 bytes |
| Vulkan load | 37 layers offloaded; 4.94 s | 25 layers offloaded; 2.90 s |
| Arithmetic: 4 × 6 − 7 | Correct: 17 | Incorrect: changed 7 to 21 and answered 3 |
| JavaScript loop diagnosis | Correct one-past-last-index explanation and `i < nums.length` | Corrected loop condition, but falsely described `nums[nums.length]` as the last element |
| Arithmetic elapsed / first token | 0.275 s / 0.059 s | 6.513 s / 6.218 s |
| Coding elapsed / first token | 7.376 s / 6.462 s | 2.511 s / 2.372 s |
| Native working set after the two replies | 2.82–2.94 GiB | 1.22–1.28 GiB |

Qwen 3 4B passed four narrowly defined checks. The experimental entry passed three of four automated checks because the coding assertion checks the corrected loop condition; manual review also identified its inaccurate explanation. The full script correctly exits with failure and records `passed: false`. A successful load does not establish response quality, and the experimental entry remains excluded from automatic recommendations. Neither model was tested for vision.

These are short functional observations, not a quality benchmark, sustained throughput measurement, minimum-hardware certification or model ranking. The GPU and development host were shared with other validation work; prompt caching, process startup, concurrent work and diagnostic sampling affect timing. Whole-GPU memory snapshots include other processes and are not per-model allocations. Broader task evaluations and additional physical hardware remain required.

## Families evaluated

| Family and examined release | License evidence | Product decision |
| --- | --- | --- |
| Qwen 2.5 / Qwen 3 / Qwen 3.5 entries above | Apache-2.0 for the exact selected artifacts. Do not assume every Qwen release shares one license. | Ship pinned small and balanced GGUF choices. No capability claim based on family name alone. |
| Gemma 4 | Apache-2.0; official model card lists E2B, E4B, 12B, 26B A4B, 31B. | Promising mobile/multimodal candidate. No app download offered until format, projector, memory and runtime validation are complete. |
| Earlier Gemma families | Custom Gemma terms, with downstream notices and use obligations. | Keep separate from Gemma 4 licensing. No blanket “all Gemma is Apache” claim. |
| gpt-oss-20b / 120b | Apache-2.0 and accompanying usage-policy text. | Evaluate separately for higher-memory hardware. Not offered as an untested default download. |
| IBM Granite 4.0 h-350m | Apache-2.0, official IBM model and GGUF repositories. | Small hybrid architecture candidate; verify backend support and quality before shipping catalog inclusion. |
| DeepSeek V4 | Official repository/model card states MIT for code and weights. | Much larger deployment needs; not suitable as a default laptop recommendation. Distilled older releases require their own source-model checks. |

Sources: [Gemma 4 official model card](https://ai.google.dev/gemma/docs/core/model_card_4), [Gemma Apache license](https://ai.google.dev/gemma/apache_2), [earlier Gemma terms](https://ai.google.dev/gemma/terms/), [gpt-oss-20b publisher](https://huggingface.co/openai/gpt-oss-20b), [gpt-oss usage policy](https://huggingface.co/openai/gpt-oss-20b/blob/8080c07ce50334f9af015f40aa0b99ea4eb09820/USAGE_POLICY), [Granite publisher](https://huggingface.co/ibm-granite/granite-4.0-h-350m), [Granite GGUF](https://huggingface.co/ibm-granite/granite-4.0-h-350m-GGUF), [DeepSeek V4 publisher model card](https://huggingface.co/deepseek-ai/DeepSeek-V4-Pro/blob/main/README.md).

## Redistribution and updates

Weights are downloaded only after the user's action. They are not embedded in the app installer. Preserve upstream license and notice files when distributing or mirroring weights. A new upstream revision is a new audited catalog entry; never silently replace a known hash. Quantization reduces memory with quality tradeoffs. Small models are particularly unreliable for elaborate instructions and tool plans, so the permission broker remains authoritative regardless of model output.

Arbitrary local GGUF imports, local photo input with a verified projector, project embedding retrieval, explicit owner-hosted inference endpoints and model comparisons are implemented. Imported files receive a content hash and a separate library entry; their provenance/license and architecture compatibility are not publisher-audited by HOLD. No automatic model replacement runs in the background. Adding a recommended catalog entry requires publisher/licensing review, a pinned source, a verified hash, supported GGUF architecture, actual load/chat tests, and resource measurements.

## Optional coding, reasoning and larger models

The extra choices in [catalog-extended.js](/reference/packages/core/catalog-extended.js) preserve the established small/balanced recommendations. Their categories describe intended use and size, not a guarantee of correctness. The official sources are [Qwen 2.5 Coder 7B](https://huggingface.co/Qwen/Qwen2.5-Coder-7B-Instruct-GGUF), [Qwen 3 1.7B](https://huggingface.co/Qwen/Qwen3-1.7B-GGUF), and [Qwen 3 8B](https://huggingface.co/Qwen/Qwen3-8B-GGUF). All three selected immutable revisions contain Apache-2.0 license files; complete source/license texts and pins are retained in [provenance evidence](/reference/docs/evidence/model-provenance-v2.json).

[The evaluation evidence](/reference/docs/evidence/model-evaluation-v2.json) contains 34 actual local CUDA runs through the production HOLD core and b11429 runtime. Each model answered ten independent prompts covering successive discounts, integer allocation, ordering, shortest paths, JavaScript, Python aliasing, a loop-bound fix, SQL NULL semantics, stable deduplication and supplied-record interpretation. Two logic prompts were repeated with thinking enabled for each Qwen 3 model. Grading compares the entire parsed JSON value with the expected value; merely mentioning the right answer does not pass. Generated code was not executed. Full prompts, unedited final answers, individual failures, usage, load/offload evidence and timings remain recorded. Private reasoning text is not recorded.

The code-focused 7B model returned incorrect ordering, shortest-path distance and SQL count answers. Both Qwen 3 models gave incorrect ordering and path answers without thinking; the compact 1.7B model also failed several arithmetic, code and evidence tasks. Thinking mode corrected the two repeated logic tasks. These results support functional compatibility and expose limits; the small single-run suite does not establish a general quality ranking, and timings on this shared development host are not controlled performance benchmarks. Model context was 4,096 tokens, with 256 output tokens for ordinary answers and 2,048 for thinking checks. After acquisition, the test allowed application fetch only to authenticated HTTP loopback and recorded zero external attempts.

Reproduce with `node scripts/acquire-evaluation-models.mjs`, then `node scripts/verify-model-evaluation.mjs` on the tested Windows CUDA runtime. The first command downloads about 11.55 GB; the second starts one model at a time. Answer failures remain evidence rather than being retried until they pass.