the conception

The memo project ended with a system that could write financial memos where every number was mechanically provable. But it had a ceiling built into its shape: the model wrote from a fixed evidence pack. It never decided what to look up. Real analyst work is the deciding: which filing, which year, which companies to compare, what to compute. So the question this time: can a small model do the looking-up itself, and can you trust what comes back?

That second clause carries the whole project. LLMs are confident about numbers and unreliable about them, and in finance an unverifiable number is worse than no number, because someone acts on it. Frontier models don’t fix this. They get more numbers right, but you still can’t audit where any of them came from. The goal, then: a small open model (9 billion parameters, runs on one GPU, could live inside a bank’s walls) that answers research questions by querying SEC filings through tools, computing explicitly, and citing everything. Trained so that answering from memory is scored as failure by definition.

the environment is the product

Before any training, the model needs a world to act in, and most of the engineering went here. Three layers.

A point-in-time database. 12.5 million facts from SEC filings across 495 companies, each keyed to the date it was actually filed. Ask what was known in March 2021 and you get March-2021 knowledge, with restatements handled explicitly and nothing leaking backward from the future. Honest backtests have this discipline; this applies it to question-answering, which is exactly where generic LLM-plus-web-search setups go wrong.

Six tools. Fundamentals lookups, point-in-time queries, price history, return and volatility stats, a screener over the universe, and a calculator that accepts only arithmetic on literal numbers. The paranoia is deliberate: a model being trained with RL is effectively an adversary probing your sandbox. Every tool returns structured errors that a confused model can read and recover from.

5,500 questions whose answers are computed, never labelled. Four difficulty tiers: lookups, derived math, screens, multi-step chains. The question generator calls the same tools the model will use, so a question only exists if it is answerable and unambiguous. Woven through them are trap questions about companies that restated their figures, where the number everyone remembers is wrong and only the filings give today’s answer. There are also point-in-time questions sampled inside asymmetric filing windows, verified per-question so that ignoring the “as of” clause produces the wrong answer.

What does an episode actually look like? The player below replays real transcripts from the evaluation runs: pick a question type, then step through the tool calls the model made, what each returned, and how the reward scored the result. One of the five is a failure, because a benchmark that only shows wins is marketing.

a reward that pays for evidence

Everything the model learns, it learns from one function: the reward. Ours is pure code, with no LLM judges anywhere, and it grades four things: the answer matches the tool-computed gold (70%), tool calls are well-formed (10%), the episode doesn’t waste calls (10%), and grounding (10%), meaning the stated number must appear in the transcript’s tool evidence. A correct but unverifiable answer takes a strict penalty. In this domain, how you know is part of whether you’re right.

A reward that an RL loop will optimize against needs the same treatment as security code, so it went through five adversarial review rounds before training. A second model family attacked it and found real exploits: computing your memorized answer into fake legitimacy, farming empty-set questions, a denial-of-service in the calculator, scale tricks against the evidence matcher. Two of the review rounds found that fixes had opened fresh holes, with the reviewer executing live exploits to prove it. By the time training started, the reward had survived everything we could throw at it. It still wasn’t perfect: real transcripts later exposed two scorer bugs, visible because every model’s grounding “collapsed” on one split at once. Cross-model uniformity is the tell. Models fail differently; scorers fail identically. We fixed the scorer, re-scored every stored transcript, and the tables in this article are the corrected ones.

teaching the model

auditioning a teacher

The training recipe is the standard 2026 pipeline: distill tool-use episodes from a frontier model, run SFT on the verified ones, then GRPO against the reward. But which teacher? We benchmarked frontier candidates on our own environment first, and the result set the tone for everything after: the flagship model lost to its own cheaper sibling, and lost hardest on the trap questions, where its stronger memory made it more confident in stale numbers. The mid-tier model, at half the price, won the audition. Even the base, untrained 9B beat the flagship on traps. Less knowledge means less to be wrong with. On an evidence-demanding scoreboard, confidence is a liability.

We kept only teacher episodes with perfect, fully-grounded answers, about 2,700 transcripts, so the student never saw its teacher’s mistakes. For questions the teacher kept failing, a hint pass recovered grounded demonstrations, with the hint stripped before training and the fraction capped, because a corpus of justifications teaches justification.

imitation first, and the eleven-point flag

Supervised fine-tuning took the base model from 0.730 to 0.822, half the teacher gap in one step, and delivered the project’s cheapest hard lesson along the way. The first evaluation of the tuned model came back flat: 0.734, barely above base. The model had been trained on think-free teacher transcripts and was being served with its thinking mode enabled, and its own untrained deliberation was derailing the trained workflow. One serving flag recovered 11.4 points. Train-time and serve-time distributions must match, an axiom you internalize permanently once it has cost you a day.

reinforcement learning against the verifier

Then the main event: 300 steps of GRPO, where no teacher exists. The model explores, the reward scores, and the verifier itself becomes the teacher. Getting it running took an eight-launch shakedown (missing dependencies, a weight-name mismatch between the training and serving stacks, out-of-memory arithmetic at 16k context), each failure one layer deeper than the last, which is the true texture of custom RL on rented hardware. The result: 0.829 overall, with the gains exactly where imitation couldn’t reach. Multi-step chains rose 2.9 points and traps rose 1.6, and entropy stayed healthy for the whole run.

Here is where the edge lives. The chart below opens on the hardest exam: question types withheld from training entirely, dominated by the multi-step chains. When we first hardened that tier, every frontier model we measured dropped to the mid-0.7s on it. On that exam, the RL-trained 9B overtakes its teacher, 0.883 to 0.852.

The student out-disciplines the teacher on unseen procedures because the student was optimized against the verifier and the teacher never was. The other views keep this honest: on the validation set the ladder is orderly, and on questions about companies held out of training the teacher still leads, 0.882 to 0.83. The edge is specific, real, and located exactly where the work is hardest.

the agent takes over the research

With training working end-to-end, the last experiment was the most 2026 one: hand the hyperparameter research to an agent. The setup is Karpathy’s autoresearch ratchet, adapted. A frozen 150-question metric slice, a config file of levers the agent may turn, a contract (one change per experiment, hypothesis written before launch, keep or revert by the metric, hard budget caps), and a driver that trains a short proxy run and scores it. The agent’s first campaign produced zero experiments: it spent four hours finding and fixing seven bugs in its own laboratory, then stopped, exactly per contract. Its second and third campaigns produced the finding. My hand-chosen learning rate was ten times too timid, corrected across three measured steps. The chart below shows its three successful experiments (two earlier launches died to infrastructure, which the agent debugged itself): one dial turned twice, the score climbing each time. The second view is the part worth remembering.

Promoted to a full run, the agent’s recipe scored +1.5 on validation and lost 2.6 points on unseen question shapes. The single-slice metric it climbed predicted in-distribution gains perfectly and missed the generalization cost entirely. We had spent weeks hardening the reward against the policy gaming it, and the metric got gamed anyway, one level up, by the optimization process itself. Goodhart’s law doesn’t disappear when you automate the researcher. It moves. The v1 model kept the headline slot, per rules written before either run, and the fix (multi-split proxy metrics) is written down for the next campaign.

production serving

Training a model is half the job; running one is a discipline of its own, and this project treats it as part of the result. The serving stack is the same one industry runs (vLLM, containerized, Kubernetes manifests with a canary rollout in the repo), and the benchmarks below were measured on it, not estimated. First, the engine choice, since the two projects together earn an opinion: the memo project served on Ollama and this one on vLLM, and the rule of thumb is: Ollama to try models, vLLM to serve them. This project needed what Ollama doesn’t have. Continuous batching for 16-plus concurrent RL rollouts, maintained tool-call parsers for the model family, and one base model hosting multiple LoRA adapters at once.

The chart below compares serving throughput two ways: the synthetic benchmark everyone reports, and our real agentic workload replayed against the same server. The benchmark that matters is the one most write-ups skip.

Synthetic token throughput climbs happily to 32 concurrent streams. Real agentic episodes saturate at concurrency around 16 and then degrade, because multi-turn tool loops are round-trips, not generations. If you serve agents, your capacity math is different from your chatbot’s. The quantization result completes a two-project arc: at 4-bit, the memo project needed calibrated (imatrix) quantization to avoid a 7-point loss; at FP8, this model runs 40% faster with zero measured quality loss on the frozen slice. Calibrate at 4 bits. Don’t bother at 8. Measured, both times.

what this is

The whole project cost about $307: roughly $135 of frontier-API credits for baselines and teacher traces, $170 of rented GPUs, and within that, about $65 to train the headline model. The failure catalog cost extra in dignity (a 59GB memory leak that made three overnight runs look stalled, a GPU-host lottery, one run killed by a dropped SSH pipe) and lives in the project’s append-only journey log, because that is where the reusable knowledge is.

A 9B model trained for $65 that beats its frontier teacher on unseen task types under an evidence-demanding scoreboard, and loses to it on unseen companies. A benchmark that made three frontier-class models fail in three different ways. A reward that survived seven adversarial rounds and still had two bugs that only real transcripts exposed. An autonomous research agent that fixed its own lab, corrected my hyperparameters, and then demonstrated the exact failure mode its design predicted. All of it is auditable, which is the property this domain was missing.

The recipe generalizes past finance: tools over trusted data, questions whose answers are computed, rewards that pay for evidence, RL to close the gap imitation leaves. Anywhere “how do you know?” matters more than eloquence, this is the shape of the answer.

Next: the 27B scale-up with the validated recipe, filings-text retrieval, and an external benchmark run. The environment, training stack, and both models’ full evaluation history live in the quantlab repo.